- 25 Feb, 2019 21 commits
-
-
Benedikt Meurer authored
Mark the not_ok case as deferred. Bug: v8:8834 Change-Id: I17536e45fb6aa309347b8faaf5f25fb3bbfbf6cf Reviewed-on: https://chromium-review.googlesource.com/c/1485973Reviewed-by:
Yang Guo <yangguo@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#59830}
-
Benedikt Meurer authored
Add some additional safety net to the CSA code for triggering promise reactions to make sure we catch security bugs (specifically related to misuse of the V8 Extras API) on the fast-path. Bug: chromium:931640, chromium:931949 Change-Id: I76b5dc6653e2404411a29dcd9c54245d7c43d883 Reviewed-on: https://chromium-review.googlesource.com/c/1485972Reviewed-by:
-
Sigurd Schneider authored
This reverts commit b3d8eeb6. Reason for revert: https://ci.chromium.org/p/chromium/builders/luci.chromium.try/win7-rel/25961 Original change's description: > [Torque] Port Array.prototype.reduce and reduceRight to Torque > > BUG: v8:7672 > Change-Id: I8816ab9051e7900119fd65c239f9e207f5c3d417 > Reviewed-on: https://chromium-review.googlesource.com/c/1478697 > Commit-Queue: Michael Stanton <mvstanton@chromium.org> > Reviewed-by: Tobias Tebbi <tebbi@chromium.org> > Cr-Commit-Position: refs/heads/master@{#59807} TBR=mvstanton@chromium.org,tebbi@chromium.org # Not skipping CQ checks because original CL landed > 1 day ago. Change-Id: Ib15bd4499618a22185d8ef173c4df7b7d55f54ce Reviewed-on: https://chromium-review.googlesource.com/c/1485971Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
Michael Stanton <mvstanton@chromium.org> Commit-Queue: Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#59828}
-
Toon Verwaest authored
All uses of ParseMemberExpression go through ParseMemberWithNewPrefixesExpression, and ParseMemberExpression always starts with ParsePrimaryExprssion, so we can simply move Token::NEW handling into ParsePrimaryExpression. That avoids an unnecessary branch on the hot path. Change-Id: I2bcce8e106c547c6d308ee6b0fce8747c7214886 Reviewed-on: https://chromium-review.googlesource.com/c/1485838Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#59827}
-
Toon Verwaest authored
This saves some binary size. Change-Id: I64d20be63922ba0aab0b664fb30c3e2e023bb860 Reviewed-on: https://chromium-review.googlesource.com/c/1485841 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by:
-
Benedikt Meurer authored
When calling a known function from optimized code, where the number of actual arguments does not match the number of expected arguments, TurboFan has to call indirectly via the arguments adaptor trampoline, which creates an argument adaptor frame underneath the activation record for the callee. This is done so that the callee can still get to the actual arguments, using either 1. the arguments object, or 2. rest parameters (to get to superfluous arguments), or 3. the non-standard Function.arguments accessor (for sloppy mode functions), or 4. direct eval(), where we don't know whether there's a use of the arguments object hiding somewhere in the string. However going through the arguments adaptor trampoline is quite expensive usually, it seems to be responsible for over 60% of the call overhead in those cases. So this adds a fast path for the case of calling strict mode functions where we have an arguments mismatch, but where we are sure that the callee cannot observe the actual arguments. We use a bit on the SharedFunctionInfo to indicate that this is safe, which is controlled by hints from the Parser which knows whether the callee uses either arguments object or rest parameters. In those cases we use a direct call from optimized code, passing the expected arguments instead of the actual arguments. This improves the benchmark on the document below by around 60-65%, which is exactly the overhead of the arguments adaptor trampoline that we save in this case. This also adds a runtime flag --fast_calls_with_arguments_mismatches, which can be used to turn off the new behavior. This might be handy for checking the performance impact via Finch. Bug: v8:8895 Change-Id: Idea51dba7ee6cb989e86e0742eaf3516e5afe3c4 Cq-Include-Trybots: luci.chromium.try:linux-blink-rel Doc: http://bit.ly/v8-faster-calls-with-arguments-mismatch Reviewed-on: https://chromium-review.googlesource.com/c/1482735 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#59825}
-
Mike Stanton authored
We don't need dynamic allocation for these arrays. Change-Id: I12095ec0e3b6e9d70be56adfb77aded5c25eb3d5 Reviewed-on: https://chromium-review.googlesource.com/c/908462 Commit-Queue: Michael Stanton <mvstanton@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Reviewed-by:
Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#59824}
-
Maciej Goszczycki authored
This means ReadOnlyDeserializer can be made isolate independent. Without this Isolate is needed for rehashing read-only space. Bug: v8:7464 Change-Id: Id2c9968a0ecfa2362f499ded6c7e0f7b2be00dfb Reviewed-on: https://chromium-review.googlesource.com/c/1483054 Commit-Queue: Maciej Goszczycki <goszczycki@google.com> Reviewed-by:
Dan Elphick <delphick@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#59823}
-
Sigurd Schneider authored
This removes ast.h as include from about ~500 includers of the latter. Bug: v8:8834 Change-Id: I294026d4bb29b878820d43c117b04a9645a457ae Reviewed-on: https://chromium-review.googlesource.com/c/1485835Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
-
Benedikt Meurer authored
We'll need one bit in the SharedFunctionInfo::flags to record whether it's safe to skip arguments adaptor frames (for v8:8895), so this just removes the SharedFunctionInfo::IsDerivedConstructorBit which is redundant, since the same information is already available in the SharedFunctionInfo::FunctionKindBits, and most places in the code use that already, with the exception of the JSConstructStubGeneric builtin. This changes the JSConstructStubGeneric builtin to just check the function kind instead of testing the explicit bit, which also makes this more consistent. It seems like there's not much overhead to that, doing an additional bitmasking plus two comparisons instead of one. This shouldn't really matter since invocation and execution of the constructors is going to dominate and optimized code inlines all of this anyways. If this turns out to affect performance, we can still look into encoding the FunctionKindBits more cleverly. Drive-by-fix: Move the FunctionKindBits first in the flags to avoid the shift when accessing the function kind. This seems logic, since for the actual boolean bit fields it doesn't matter where they are in the flags, whereas for the function kind this saves one shift. Bug: v8:8834, v8:8895 Change-Id: I184a8f5cc5c140bdc272cf9a5ad546093c457306 Reviewed-on: https://chromium-review.googlesource.com/c/1482915Reviewed-by:
-
Jakob Gruber authored
Field representation tracking is only used by TurboFan. Bug: v8:7777 Change-Id: I0d930f8dc0b68ff030111f12092b183c4c257ac6 Reviewed-on: https://chromium-review.googlesource.com/c/1481218 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Reviewed-by:
-
Santiago Aboy Solanes authored
since these operators don't have any variable arguments. Bug: v8:8183 Change-Id: I602fe65a2137d6ffc6ece702da53d660577eee4a Reviewed-on: https://chromium-review.googlesource.com/c/1482736Reviewed-by:
-
Ross McIlroy authored
Template objects should be cached after they are first created and reused on subsiquent calls to tag functions. Currently these cached objects are stored on the feedback vector, which has appropriate lifetime, however with bytecode flushing the feedback vector could be cleared when the bytecode is flushed, causing the template object to be dropped. In order to retain the cached template objects in the face of bytecode flushing, this CL adds a weakmap for each native context that is (weakly) keyed by shared function info, and holds a linked list of cached template objects associated with that shared function info, indexed by feedback vector slot id. Misses will check this weakmap, and if no entry is found, a new template object is created and added into this weakmap alongside the feedback vector. BUG=v8:8799,v8:8799,v8:8395 Change-Id: Ia95d5cfc394ce58dc9fe6a1e49780f05299acc17 Reviewed-on: https://chromium-review.googlesource.com/c/1477746 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
-
Jon Kunkee authored
When stubbing out source line information emission for Windows, the ARM64 Windows branch was missed. This change copies the x86/x64 stubs as appropriate. Bug: chromium:893460,v8:8870 R=jgruber@chromium.org Bug: chromium:893460,v8:8870 Change-Id: I1416b602a4f96a68c37fdeeb816ce1ce33b12407 Reviewed-on: https://chromium-review.googlesource.com/c/1453637 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
Tobias Tebbi authored
Bug: v8:8863 Change-Id: I8907b7b0b7dfa53a2e1e607c0bad26939d312f4e Reviewed-on: https://chromium-review.googlesource.com/c/1485836Reviewed-by:
-
Jakob Gruber authored
to IsGeneratingEmbeddedBuiltins() to clarify its meaning. Bug: v8:6666 Change-Id: I8b282f29775a103a03f502c3e9629b40b4a690bd Reviewed-on: https://chromium-review.googlesource.com/c/1480380Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#59815}
-
Toon Verwaest authored
This merges all the possible targets for 'member expressions' previously parsed in ParseMemberExpression into ParsePrimaryExpression; since that's not independently used anyway. This will make it faster since we don't need to go through unnecessary branches before ParsePrimaryExpression on the fast path, *and* it will make the binary smaller since ParseMemberExpression is inlined but ParsePrimaryExpression is not. It saves 4kb. Yay :) Bug: chromium:913222 Change-Id: Ib92e1c2a128fffff1db85b625bb5f311ec8c24ef Reviewed-on: https://chromium-review.googlesource.com/c/1480379 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by:
-
Toon Verwaest authored
That way we can continue running in failure mode. Bug: chromium:933214 Change-Id: I975901a72f615e2b7ed9955b75ce86bbcad0bbbb Reviewed-on: https://chromium-review.googlesource.com/c/1481219Reviewed-by:
-
Anna Henningsen authored
Do not leak handles to the outer scopes from inspector methods. Add `SealHandleScope`s to the tests and the d8 binding, and `HandleScope`s in the places in the inspector source where handles are actually used. Change-Id: I80b1bb0ccc4778b32e9198513f63d5c0652c8f59 Reviewed-on: https://chromium-review.googlesource.com/c/1484304Reviewed-by:
-
Jakob Gruber authored
This fixes an early handle dereference before a potential allocation in ReplacementStringBuilder. Bug: chromium:935101 Change-Id: I03cf2b18b577a38af818dcc42f7c430faba23450 Reviewed-on: https://chromium-review.googlesource.com/c/1485831Reviewed-by:
-
Peter Marshall authored
This read can cause a guard page violation on Windows, where the sp is sometimes incorrect and points far into the future stack space. Bug: v8:8883, v8:5193 Change-Id: I55c1fcac873a9c43484a5d1c3f2661f3589b1daf Reviewed-on: https://chromium-review.googlesource.com/c/1480378Reviewed-by:
-
- 24 Feb, 2019 2 commits
-
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/93f8c0e..9f11dc3 Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/e4abf4c..a4323c9 Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/d7f7a3e..95ea36e TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org Change-Id: I14c7bbc2fa38d2fc5d4d6135c73bab8c4b2b3184 Reviewed-on: https://chromium-review.googlesource.com/c/1485240Reviewed-by:
v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#59809}
-
peterwmwong authored
Change-Id: I96935cd8e16715ce729a9830c00357c740696b3b Reviewed-on: https://chromium-review.googlesource.com/c/1470445 Commit-Queue: Peter Wong <peter.wm.wong@gmail.com> Reviewed-by:
Simon Zünd <szuend@chromium.org> Cr-Commit-Position: refs/heads/master@{#59808}
-
- 23 Feb, 2019 3 commits
-
-
Mike Stanton authored
BUG: v8:7672 Change-Id: I8816ab9051e7900119fd65c239f9e207f5c3d417 Reviewed-on: https://chromium-review.googlesource.com/c/1478697 Commit-Queue: Michael Stanton <mvstanton@chromium.org> Reviewed-by:
-
v8-ci-autoroll-builder authored
Rolling v8/base/trace_event/common: https://chromium.googlesource.com/chromium/src/base/trace_event/common/+log/e31a170..936ba8a Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/ba245a9..93f8c0e Rolling v8/test/wasm-js/data: https://chromium.googlesource.com/external/github.com/WebAssembly/spec/+log/2e2e3a9..4da0540 Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/76fb063..e4abf4c Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/36974ad..d7f7a3e TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org Change-Id: I5fa05932b8a7a2e9a8e97d00f5be84d2e5d0c2ec Reviewed-on: https://chromium-review.googlesource.com/c/1485018Reviewed-by:
-
Deepti Gandluri authored
When using a shared WebAssembly.Memory, always try to reserve up to the maximum to avoid having to move the buffer. If after multiple retries it is not possible to reserve the maximum, fall back to initial size reservation. - Add new methods to allocate a Shared WebAssemblyMemory.buffer - Use these to reserve upto the mazimum for a Shared WebAssembly.Memory - Cleanup js-api so actual allocation is done inside the constructor BUG: v8:8564 Change-Id: I97815c7c94a2b84416cd867fb23b3c815d7f0f12 Reviewed-on: https://chromium-review.googlesource.com/c/1480910Reviewed-by:
Ben Smith <binji@chromium.org> Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Deepti Gandluri <gdeepti@chromium.org> Cr-Commit-Position: refs/heads/master@{#59805}
-
- 22 Feb, 2019 14 commits
-
-
Deepti Gandluri authored
This reverts commit 6a88f0b1. Reason for revert: Fails UBSAN bots - https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux64%20UBSan/4866 Original change's description: > [wasm] ReturnCall Implementation (interpreter) > > Implement the ReturnCall functionality for the interpreter. > > Note that some tests have had to be deferred to the implementation > of ReturnCall for TurboFan. > > Bug: v8:7431 > Change-Id: I091528e72f9113ddf1929bd1a5650b490bc8cc0c > Reviewed-on: https://chromium-review.googlesource.com/c/1467343 > Reviewed-by: Andreas Haas <ahaas@chromium.org> > Reviewed-by: Clemens Hammacher <clemensh@chromium.org> > Commit-Queue: Francis McCabe <fgm@chromium.org> > Cr-Commit-Position: refs/heads/master@{#59803} TBR=adamk@chromium.org,ahaas@chromium.org,clemensh@chromium.org,fgm@chromium.org Change-Id: Ib2a85e586549e9c36f94d70f04f6e103a8272367 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:7431 Reviewed-on: https://chromium-review.googlesource.com/c/1484574Reviewed-by:
Deepti Gandluri <gdeepti@chromium.org> Commit-Queue: Deepti Gandluri <gdeepti@chromium.org> Cr-Commit-Position: refs/heads/master@{#59804}
-
Francis McCabe authored
Implement the ReturnCall functionality for the interpreter. Note that some tests have had to be deferred to the implementation of ReturnCall for TurboFan. Bug: v8:7431 Change-Id: I091528e72f9113ddf1929bd1a5650b490bc8cc0c Reviewed-on: https://chromium-review.googlesource.com/c/1467343Reviewed-by:
Clemens Hammacher <clemensh@chromium.org> Commit-Queue: Francis McCabe <fgm@chromium.org> Cr-Commit-Position: refs/heads/master@{#59803}
-
Ulan Degenbaev authored
This fixes a corner case where the main thread has items in the local segments but the global pool is empty. In such case concurrent marking tasks are not posted and marking is performed on the main thread. Bug: chromium:934453 Change-Id: Ic34cd4ecb59b848021d8d8b086904b415669f5e6 Reviewed-on: https://chromium-review.googlesource.com/c/1482739Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#59802}
-
Deepti Gandluri authored
This reverts commit 4950dec7. Reason for revert: Breaks on stress_background_compile variant https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket.appspot.com/8920804687849034208/+/steps/Mjsunit/0/logs/number-divide/0 Original change's description: > Temporarily unship constant field tracking > > This is to get better handle on improvements and regressions. > > Bug: v8:8361, chromium:930680 > Change-Id: I2963b55f3480036ada885267a277a95d24a67656 > Reviewed-on: https://chromium-review.googlesource.com/c/1482737 > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> > Cr-Commit-Position: refs/heads/master@{#59800} TBR=jarin@chromium.org,ishell@chromium.org Change-Id: Ibf38c9cb2bf0921b7d93972a1e6cdd4c3d57c592 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:8361, chromium:930680 Reviewed-on: https://chromium-review.googlesource.com/c/1483610Reviewed-by:
-
Jaroslav Sevcik authored
This is to get better handle on improvements and regressions. Bug: v8:8361, chromium:930680 Change-Id: I2963b55f3480036ada885267a277a95d24a67656 Reviewed-on: https://chromium-review.googlesource.com/c/1482737Reviewed-by:
-
Junliang Yan authored
Bug: v8:8075 Change-Id: I8547706b56bab28dc11685e73b5fc084c8f1bf69 Reviewed-on: https://chromium-review.googlesource.com/c/1480912 Commit-Queue: Junliang Yan <jyan@ca.ibm.com> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#59799}
-
Santiago Aboy Solanes authored
This now makes it so TurboFan now uses full pointer loads for arguments values located on stack. Bug: v8:8876, v8:7703 Change-Id: Ib82d6f3b0f4c8d33669c7f86ce803381d210c019 Reviewed-on: https://chromium-review.googlesource.com/c/1480382Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
-
Igor Sheludko authored
... which will work for 32-bit kTaggedSize but we are not there yet. Bug: v8:7703 Change-Id: Iaceb126ba316f37532221597cbd4f7e85ceb4fb9 Reviewed-on: https://chromium-review.googlesource.com/c/1482917Reviewed-by:
-
Farazmand authored
Port b0b1ba9a Original Commit Message: This CL changes the secondary stack check for WebAssembly functions with big stack frames in the code generator from calling a runtime function to calling a code stub. The runtime function caused problems with serialization. R=ahaas@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com BUG= LOG=N Change-Id: Ie2175eedb043304405fd271c3bf1337dac76ab49 Reviewed-on: https://chromium-review.googlesource.com/c/1483210Reviewed-by:
Junliang Yan <jyan@ca.ibm.com> Reviewed-by:
-
Stephan Herhut authored
Also cleans up the code slightly. Change-Id: I9d1e7305f69e5f746833ed7985a320023fc90f2e Reviewed-on: https://chromium-review.googlesource.com/c/1477744Reviewed-by:
-
Simon Zünd authored
The recent introduction of 'end' positions incorrectly tracked column positions. This CL fixes that. R=tebbi@chromium.org Bug: v8:7793 Change-Id: I2170ebb2dda062c9842dad657c3c516e0550b459 Reviewed-on: https://chromium-review.googlesource.com/c/1482830Reviewed-by:
-
Igor Sheludko authored
This is a reland of 6f763280 Original change's description: > [cleanup] Cleanup handling of padding field in Map > > Bug: v8:8834 > Change-Id: Iae9cbcccb8747298c5680ac1e865efebee85acec > Reviewed-on: https://chromium-review.googlesource.com/c/1480385 > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Commit-Queue: Igor Sheludko <ishell@chromium.org> > Cr-Commit-Position: refs/heads/master@{#59774} Bug: v8:8834 Change-Id: I6a3b436984a7a412f07bb66647864472a134d264 Reviewed-on: https://chromium-review.googlesource.com/c/1482914Reviewed-by:
-
Maciej Goszczycki authored
All HeapObjects already have roots access so this was redundant and made ComputeAndSetHash difficult to use. Eventually we need to get rid of the Isolate version of HashSeed, but this will touch a lot of files, so leaving it for now. Bug: v8:8562 Change-Id: I27d8fe10df72494d0a2146f408a2158cf02ce226 Reviewed-on: https://chromium-review.googlesource.com/c/1481630 Commit-Queue: Maciej Goszczycki <goszczycki@google.com> Reviewed-by:
Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#59792}
-
Michael Achenbach authored
Change-Id: I41bd7204e6c94bb26d25a16cb863dba1fb60688b Reviewed-on: https://chromium-review.googlesource.com/c/1482912Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#59791}
-
