- 11 Oct, 2018 13 commits
-
-
Sigurd Schneider authored
Change-Id: I63abed81995b408ac4e82a4d3b31c948a96de06d Bug: v8:6666, v8:8288 Reviewed-on: https://chromium-review.googlesource.com/c/1275809 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#56558}
-
Georg Neis authored
For now, all it does is control when the heap broker starts serializing. Eventually it will do what its name suggests. I'm also renaming --concurrent-compiler-frontend to the more accurate --concurrent-typed-lowering. Note that it's forceably implied by --concurrent-inlining. Bug: v8:7790 Change-Id: I55c1d8f1538146e89f3e166cb9165f6f38447146 Reviewed-on: https://chromium-review.googlesource.com/c/1270839Reviewed-by:
Maya Lekova <mslekova@chromium.org> Reviewed-by:
Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#56557}
-
Michael Starzinger authored
This makes sure that catch blocks that are practically unreachable due to missing exceptional projections are handled properly. Note that this is independent of how reachability will be outlined in the final spec for exception handling. Currently we just assume that all catch blocks are spec-wise reachable. R=titzer@chromium.org TEST=mjsunit/wasm/exceptions-catchall BUG=v8:8091 Change-Id: I13607a59bd76be146df836e88105a2fbafedb760 Reviewed-on: https://chromium-review.googlesource.com/c/1273018Reviewed-by:
Ben Titzer <titzer@chromium.org> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#56556}
-
Daniel Clifford authored
The implicit parameter syntax adds a second parameter list before the explicit parameter list when declaring macros, builtins and runtime functions: extern macro MyMacro(implicit a: Smi)(b: Oddball); when calling the macro, only the formal parameters can be provided at the call site. The implicit parameters are implicitly looked-up by name in the scope of the call and prepended to the explicit parameter list. The values that are found by name for each implicit parameter must be castable the corresponding implicit parameter type: MyMacro(Null); // Error, a is not defined ... const a: Smi = 0; MyMacro(Null); // OK ... const a: Object = 0; MyMacro(Null); // Error, a has wrong type For external macros, builtins and runtime functions, the formal parameter list expected on the C++ side is the concatenation of the implicit and explicit parameter lists. As a drive-by: fix the formatting of typeswitch statements in the the presence of deferred-marked blocks and funky white space. Bug: v8:7793 Change-Id: I40da8405c706d7cdeca35367c9c954d0b33f6bf4 Reviewed-on: https://chromium-review.googlesource.com/c/1270996 Commit-Queue: Daniel Clifford <danno@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#56555}
-
Benedikt Meurer authored
This JSAsyncFunctionObject represents the implicit generator object inside of async functions, and also holds the outer promise for the async functions. This in turn allows us to get rid of the .promise in the Parser / BytecodeGenerator completely, and will make it possible to build zero-cost async stack traces independent of the concrete synchronous part of the stack frame (which currently breaks in Node.js). In the bytecode all the async function operations now take this new JSAsyncFunctionObject instead of passing both the .generator_object and the .promise, which further simplifies and shrinks the bytecode. It also reduces the size of async function frames, potentially making the suspend/resume cheaper. This also changes `await` to use intrinsics instead of calling to special JSFunctions on the native context, and thus reduces the size of the native contexts. Drive-by-fix: Introduce a dedicated JSCreateAsyncFunctionObject operator to TurboFan. Bug: v8:7253, v8:7522 Change-Id: I2305302285156aa1f71328ecac70377abdd92c80 Ref: nodejs/node#11865 Design-Document: http://bit.ly/v8-zero-cost-async-stack-traces Reviewed-on: https://chromium-review.googlesource.com/c/1273049 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Sathya Gunasekaran <gsathya@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#56554}
-
Dan Elphick authored
Cast byte* to void* before printing so that it's not interpreted as a null-terminated string. Change-Id: I32b5a51913c3382b43d7b231d6b8fd4c17e32bb6 Reviewed-on: https://chromium-review.googlesource.com/c/1275352Reviewed-by:
-
Igor Sheludko authored
... and Heap::root_handle() to RootsTable. This is a preliminary step before moving IsolateData object from Heap to Isolate which is required for pointer-compression friendly heap layout. Bug: v8:8182 Change-Id: Ideacc1c9e4435be7a33db08415ac1ad46e956199 Reviewed-on: https://chromium-review.googlesource.com/c/1273238Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
-
Igor Sheludko authored
... containing RootsTable, ExternalReferenceTable, builtins array and potentially some other data that can be accessed via the RootRegister. This is a preliminary step before adding support for pointer-compression friendly heap layout. Bug: v8:8182 Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng Change-Id: I2899f657aaff1351a5304afa0b1a4c5ae4cfc31d Reviewed-on: https://chromium-review.googlesource.com/c/1245426Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#56551}
-
Georg Neis authored
This is behind a new flag --harmony-namespace-exports. Bug: v8:8101 Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng Change-Id: I9c252b6de2b08223fcf3296340b78d721471bdb4 Reviewed-on: https://chromium-review.googlesource.com/c/1258004 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Adam Klein <adamk@chromium.org> Reviewed-by:
-
Frank Tang authored
Remove InstallWithIntrinsicDefaultProto which is not needed and reduce the size of context Bug: v8:5751 Change-Id: Ia830629abdf94921315faadc708f4f135f720949 Reviewed-on: https://chromium-review.googlesource.com/c/1274986 Commit-Queue: Frank Tang <ftang@chromium.org> Reviewed-by:
-
Michael Achenbach authored
This reverts commit 2148d827. Reason for revert: bug was fixed Original change's description: > [test] Skip test on gc fuzzer > > TBR=marja@chromium.org > > Bug: v8:8286 > Change-Id: I862d557c22e373c81171f0bb33b23d37157fbccd > Reviewed-on: https://chromium-review.googlesource.com/c/1273120 > Reviewed-by: Michael Achenbach <machenbach@chromium.org> > Commit-Queue: Michael Achenbach <machenbach@chromium.org> > Cr-Commit-Position: refs/heads/master@{#56527} TBR=machenbach@chromium.org,marja@chromium.org Change-Id: I9bf0632815acdd1ea29f5e622e8313b061ddd20e No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:8286 Reviewed-on: https://chromium-review.googlesource.com/c/1275805Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#56548}
-
Michael Achenbach authored
This migrates the test configurations of all builders on the main console (aka client.v8) to the V8 repository, preparing removal from build/scripts/slave/recipe_modules/v8/builders.py. NOTRY=true Bug: chromium:830557 Change-Id: I40b8f31ab48426c7122c87e0221d6f05dc205e81 Reviewed-on: https://chromium-review.googlesource.com/c/1273237 Commit-Queue: Michael Achenbach <machenbach@chromium.org> Reviewed-by:
Sergiy Byelozyorov <sergiyb@chromium.org> Cr-Commit-Position: refs/heads/master@{#56547}
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/a5cd715..85ceec4 Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/357c5c2..cd3378c Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/83bd7f4..2fddb95 Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/2e889f5..a245b95 TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org Change-Id: I3c04bbbf1f7bbeb5230ab9f68c30de05401c8aec Reviewed-on: https://chromium-review.googlesource.com/c/1275350 Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Reviewed-by:
v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#56546}
-
- 10 Oct, 2018 27 commits
-
-
Ben Smith authored
Use naming similar to the spec: "table" instead of "function table", "element segment" instead of "function table init". Change-Id: Ib1b6cdfa566f8bd00017ccedf9440084204f10ff Reviewed-on: https://chromium-review.googlesource.com/c/1273612 Commit-Queue: Ben Smith <binji@chromium.org> Reviewed-by:
Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#56545}
-
andrew-cc-chen authored
and load Change-Id: I710e82b2c2e0f4802d0efb11875a37b186828350 Reviewed-on: https://chromium-review.googlesource.com/c/1263828Reviewed-by:
Junliang Yan <jyan@ca.ibm.com> Commit-Queue: Junliang Yan <jyan@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#56544}
-
Junliang Yan authored
R=titzer@chromium.org Change-Id: Ia39d4ec981e6a539cc7466c7b20ff5bd85a49090 Reviewed-on: https://chromium-review.googlesource.com/c/1274266Reviewed-by:
-
Michael Lippautz authored
This reverts commit fa65063a. Reason for revert: This changes API contract with Blink as some state is destroyed before actually tearing down the Isolate. Flushing the second round tasks then tries to access various state that is already gone on the Blink side. See bugs. Bug: chromium:893944, chromium:893549, chromium:890631 Original change's description: > [heap] Run phantom handle callbacks on tear down > > Pending phantom handle callbacks are not reliably executed if the heap > shuts down. This can cause to memory leaks or other unwanted behaviour, > like in wasm where the NativeModules (held in Managed objects > implemented via phantom handles) unregister from the WasmEngine in the > second-pass callback. This must be executed before tearing down the > WasmEngine. > > This CL fixes this by running pending callback synchronously on heap > tear down. > > R=ulan@chromium.org, mlippautz@chromium.org > > Bug: v8:8208 > Change-Id: I27b630c4d8f1fb12309040ea2179b64eed38710a > Reviewed-on: https://chromium-review.googlesource.com/1249101 > Commit-Queue: Clemens Hammacher <clemensh@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Cr-Commit-Position: refs/heads/master@{#56286} TBR=ulan@chromium.org,mlippautz@chromium.org,clemensh@chromium.org Bug: v8:8208 Change-Id: I4b403fd84473edb8895c3725ff3348574c54247b Reviewed-on: https://chromium-review.googlesource.com/c/1274085 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
-
Junliang Yan authored
Port a2b34806 Original Commit Message: This CL refactors the implementation of WASM->JS import wrappers in order to make the wrapper code shareable. Instead of specializing to the import index, we use a tuple as the object ref in the both the import and indirect tables. The tuple allows the wrapper code to load both the calling instance and the target callable, rather than relying on code specialization. This requires some tricky codegen machinery, because WASM call descriptors expect an instance argument in a given register, yet the wrappers receive a tuple, the code generator must generate a prologue that loads the instance (and the callable), since it is not possible to express this at the graph level. R=titzer@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com BUG= LOG=N Change-Id: I34302b8ff737296fc98c032f1e9848b4bb9fae13 Reviewed-on: https://chromium-review.googlesource.com/c/1273866Reviewed-by:
Joran Siu <joransiu@ca.ibm.com> Commit-Queue: Junliang Yan <jyan@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#56541}
-
Michael Lippautz authored
Pass on information about the embedder state using the fact that tasks are run from top level Bug: chromium:893944 Change-Id: I01441778770c5acc784540e496eec5c3fdb87796 Reviewed-on: https://chromium-review.googlesource.com/c/1273048 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
-
Benedikt Meurer authored
The NumberMultiply typing rule gave up in the presence of NaN inputs, but we can still infer useful ranges here and just union the result of that with the NaN propagation (similar for MinusZero propagation). This way we can still makes sense of these ranges at the uses. Bug: v8:8015 Change-Id: Ic4c5e8edc6c68776ff3baca9628ad7de0f8e2a92 Reviewed-on: https://chromium-review.googlesource.com/c/1261143 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#56539}
-
Nico Weber authored
Bug: chromium:101600, v8:8257 Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel Change-Id: Ie6c4f80cdec855355c0b8985e4f8a88da2ddfef9 Reviewed-on: https://chromium-review.googlesource.com/c/1273322Reviewed-by:
Dmitry Gozman <dgozman@chromium.org> Commit-Queue: Nico Weber <thakis@chromium.org> Cr-Commit-Position: refs/heads/master@{#56538}
-
Jaroslav Sevcik authored
Bug: chromium:866847 Change-Id: Icfda750c64c31ab48a882822883f6cef51c5bf92 Reviewed-on: https://chromium-review.googlesource.com/c/1270918Reviewed-by:
-
Junliang Yan authored
Port 4cbec82c Original Commit Message: Pure refactoring CL. Introduce a symbolic name for the register used to hold the function index when calling the lazy compile stub. This makes it easier to see this contract when looking at the macro assembler. R=titzer@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com BUG= LOG=N Change-Id: I320373dfe4734b27b85217a829bf574bc7b90a2d Reviewed-on: https://chromium-review.googlesource.com/c/1273825Reviewed-by:
-
Michael Achenbach authored
Also skip the slowest test. TBR=sergiyb@chromium.org NOTRY=true Change-Id: I9646dc750fafe47a0680e57ed029ab24a521d1a3 Reviewed-on: https://chromium-review.googlesource.com/c/1273885Reviewed-by:
-
Mike Stanton authored
a) The current size of the backing store for the array under splice wasn't considered. Additionally, allocate the array with the normal growing strategy. b) Use primitives memcpy and memmove when appropriate. These calls are wrapped in new CSA functions MoveElements and CopyElements, which use the C functions when a write barrier isn't needed (otherwise they just copy elements in a loop). Bug: chromium:880780 Change-Id: I39a917c71036f52250c68f2cced77a1c24f97b67 Reviewed-on: https://chromium-review.googlesource.com/c/1243104 Commit-Queue: Michael Stanton <mvstanton@chromium.org> Reviewed-by: -
David Benjamin authored
libc++'s _LIBCPP_DEBUG gets upset when comparators take non-const references. Bug: chromium:893810 Change-Id: I838ff08bfd53893984f0ce41a9d78d6f1d80a324 Reviewed-on: https://chromium-review.googlesource.com/c/1272184Reviewed-by:
-
Sigurd Schneider authored
Disable a new test that triggers a known issue with the arguments adaptor trampoline. TBR=jgruber@chromium.org Change-Id: Id89b71e49e5dbef06d75758d98ed162c07fc34f4 Bug: v8:6666 Reviewed-on: https://chromium-review.googlesource.com/c/1273052Reviewed-by:
-
Jakob Gruber authored
Block coverage is based on a system of ranges that can either have both a start and end position, or only a start position (so-called singleton ranges). When formatting coverage information, singletons are expanded until the end of the immediate full parent range. E.g. in: {0, 10} // Full range. {5, -1} // Singleton range. the singleton range is expanded to {5, 10}. Singletons are produced mostly for continuation counters that track whether we execute past a specific language construct. Unfortunately, continuation counters can turn up in spots that confuse our post-processing. For example: if (true) { ... block1 ... } else { ... block2 ... } If block1 produces a continuation counter, it could end up with the same start position as the else-branch counter. Since we merge identical blocks, the else-branch could incorrectly end up with an execution count of one. We need to avoid merging such cases. A full range should always take precedence over a singleton range; a singleton range should never expand to completely fill a full range. An additional post-processing pass ensures this. Bug: v8:8237 Change-Id: Idb3ec7b2feddc0585313810b9c8be1e9f4ec64bf Reviewed-on: https://chromium-review.googlesource.com/c/1273095Reviewed-by:Yang Guo <yangguo@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#56531}
-
Hai Dang authored
The MapIterator protector protects the original iteration behaviors of Map.prototype.keys(), Map.prototype.values(), and Set.prototype.entries(). It does not protect the original iteration behavior of Map.prototype[Symbol.iterator](). The protector is invalidated when: * The 'next' property is set on an object where the property holder is the %MapIteratorPrototype% (e.g. because the object is that very prototype). * The 'Symbol.iterator' property is set on an object where the property holder is the %IteratorPrototype%. Note that this also invalidates the SetIterator protector (see below). The SetIterator protector protects the original iteration behavior of Set.prototype.keys(), Set.prototype.values(), Set.prototype.entries(), and Set.prototype[Symbol.iterator](). The protector is invalidated when: * The 'next' property is set on an object where the property holder is the %SetIteratorPrototype% (e.g. because the object is that very prototype). * The 'Symbol.iterator' property is set on an object where the property holder is the %SetPrototype% OR %IteratorPrototype%. This means that setting Symbol.iterator on a MapIterator object can also invalidate the SetIterator protector, and vice versa, setting Symbol.iterator on a SetIterator object can also invalidate the MapIterator. This is an over- approximation for the sake of simplicity. Bug: v8:7980 Change-Id: I54ad6e4c7f19ccc27d7001f6c4b6c8d6ea4ee871 Reviewed-on: https://chromium-review.googlesource.com/c/1273102Reviewed-by:
-
Marja Hölttä authored
1) As found by the GC fuzzer: missing HandleScopes. 2) The RecordSlot barrier was missing for NativeContext::AddDirtyJSWeakFactory. 3) Need Context::Scope to surround the cleanup function (if it results in an error, we try to get native_context() from Isolate). BUG=v8:8179,v8:8286 Change-Id: I2d995a76770658848e3c9629333bedbc2ef43b82 Reviewed-on: https://chromium-review.googlesource.com/c/1273051Reviewed-by:
-
Michael Lippautz authored
The API will be used to post GC tasks that benefit from being executed at top level. Bug: chromium:843903 Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng Change-Id: I062855e810ca9a8d8af8ae8b66e02c85e108798b Reviewed-on: https://chromium-review.googlesource.com/c/1273045Reviewed-by:
-
Michael Achenbach authored
TBR=marja@chromium.org Bug: v8:8286 Change-Id: I862d557c22e373c81171f0bb33b23d37157fbccd Reviewed-on: https://chromium-review.googlesource.com/c/1273120Reviewed-by:
-
Ben L. Titzer authored
Now that import wrappers are no longer specialized to an index, they can be cached in the native module, keyed by (WasmImportCallKind, FunctionSig). This saves instantiation time and also fixes a (slow) memory leak. R=mstarzinger@chromium.org Change-Id: I5197bbfae79d6e811a01289b990db445373eea6c Reviewed-on: https://chromium-review.googlesource.com/c/1270943 Commit-Queue: Ben Titzer <titzer@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#56526}
-
Toon Verwaest authored
Change-Id: I15a22e7057d5e0fa154466a0ea3d7eba3bd5721c Reviewed-on: https://chromium-review.googlesource.com/c/1273241Reviewed-by:
Igor Sheludko <ishell@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#56525}
-
Michael Achenbach authored
NOTRY=true Bug: chromium:893991 Change-Id: I490c02266a367d93495a2de7516486aca2c8e26c Reviewed-on: https://chromium-review.googlesource.com/c/1273118Reviewed-by:
-
Tobias Tebbi authored
An asan bug on Windows breaks the chrome asan bot. This disables asan for the Torque build step as a workaround. Bug: chromium:893437 Change-Id: I4ccc25e7667abb3ea167c3e8af1210685ff06b9e Reviewed-on: https://chromium-review.googlesource.com/c/1273105Reviewed-by:
-
Ross McIlroy authored
Change-Id: I405172d79e0cbb043ce369ded625940178344dde Reviewed-on: https://chromium-review.googlesource.com/c/1273104Reviewed-by:
-
Matheus Marchini authored
R=bmeurer@google.com, yangguo@google.com Change-Id: Ica3f6308d92079d6602e16da31fa01488f9cc6bd Reviewed-on: https://chromium-review.googlesource.com/c/1261162 Commit-Queue: Yang Guo <yangguo@chromium.org> Reviewed-by:
-
Ben L. Titzer authored
This CL refactors the implementation of WASM->JS import wrappers in order to make the wrapper code shareable. Instead of specializing to the import index, we use a tuple as the object ref in the both the import and indirect tables. The tuple allows the wrapper code to load both the calling instance and the target callable, rather than relying on code specialization. This requires some tricky codegen machinery, because WASM call descriptors expect an instance argument in a given register, yet the wrappers receive a tuple, the code generator must generate a prologue that loads the instance (and the callable), since it is not possible to express this at the graph level. R=mstarzinger@chromium.org CC=clemensh@chromium.org Change-Id: Id67e307f7f5089e776f5439a53b5aee4b76934b6 Reviewed-on: https://chromium-review.googlesource.com/c/1268237 Commit-Queue: Ben Titzer <titzer@chromium.org> Reviewed-by:
-
Dan Elphick authored
This is a reland of 22b56f47 Nothing has changed. This is a reland of a speculative revert. Original change's description: > [snapshot] Factor out root serialization code > > Factors out a new method Serializer::SerializeRoot which attempts to > serialize a given object as a Root if it is one and the Serializer's > policy allows that root to be serialized (implemented as a new virtual > method RootCanBeSerialized).. > > This is in preparation for adding a ReadOnlySerializer which change the > way read-only roots are serialized. > > Bug: v8:8191 > Change-Id: I7fbb4e9520fba8b836a0b6bf95ca39abc3ded79e > Reviewed-on: https://chromium-review.googlesource.com/c/1264698 > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Commit-Queue: Dan Elphick <delphick@chromium.org> > Cr-Commit-Position: refs/heads/master@{#56494} TBR=jgruber Bug: v8:8191 Change-Id: I30a606b9c99f5651fae323d12f8f74b13bb085fa Reviewed-on: https://chromium-review.googlesource.com/c/1273103Reviewed-by:
Dan Elphick <delphick@chromium.org> Commit-Queue: Dan Elphick <delphick@chromium.org> Cr-Commit-Position: refs/heads/master@{#56519}
-
