- 19 Feb, 2020 6 commits
-
-
Georg Neis authored
JSCreate can have side effects (by looking up the prototype on an object), so once we walk past that the analysis result must be marked as "unreliable". Bug: chromium:1053604 Change-Id: I36625b14f374e74561c9b539bdf7a02ae767cf7f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2062396 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#66329}
-
Zhao Jiazhong authored
Port 59e96890 https://crrev.com/c/2036739 Change-Id: Ie90aa9afffe36938a97b06947db136dda7e2b840 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2063194 Commit-Queue: Zhi An Ng <zhin@chromium.org> Auto-Submit: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn> Reviewed-by:
Zhi An Ng <zhin@chromium.org> Reviewed-by:
Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#66328}
-
Shu-yu Guo authored
In the spec, WeakRefs that are dereferenced are kept alive until there's no JS on the stack, and then the host is expected to call ClearKeptObjects to clear those strong references [1]. HTML calls ClearKeptObjects at the end of a PerformMicrotaskCheckpoint [2]. In V8, leaving this up to the embedder is error prone in the same way the deprecated FinalizationGroup callback APIs were error prone: it depends on the embedder doing the right thing. This CL moves the call to ClearKeptObjects to be after running of microtasks within V8. However, the Isolate::ClearKeptObjects API should not be removed or deprecated in case an embedder uses an entirely custom MicrotaskQueue implementation and invokes MicrotaskQueue::PerformCheckpoint manually. [1] https://tc39.es/proposal-weakrefs/#sec-clear-kept-objects [2] https://github.com/whatwg/html/pull/4571 Bug: v8:8179 Change-Id: Ie243804157b56241ca69ed8fad300e839a0c9f75 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2055967 Commit-Queue: Shu-yu Guo <syg@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#66327}
-
Ng Zhi An authored
This is still very limited, but we will have some simd instructions. We add 2 kinds of instructions: - any_true to generate i32 from v128 - add to generate v128 from v128 and v128 - extract_lane to generate v128 from all other types We do not add v128 to the list of types returned by GetValueType, since that is used in a couple of places, like generating globals, which requires v128.const but is not implemented yet. Special case to enable the experimental-wasm-simd flag since simd is not included in wasm-staging yet. Bug: v8:10180 Change-Id: Ifd86f55bdd49cae9514b061965de81ff6d579934 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2040514Reviewed-by:
Deepti Gandluri <gdeepti@chromium.org> Commit-Queue: Zhi An Ng <zhin@chromium.org> Cr-Commit-Position: refs/heads/master@{#66326}
-
Ng Zhi An authored
Define macros to identify constant shift values, we can emit better codegen in these cases. Otherwise we need to mask the shift value before shifting. We also need separate cases for left and right shifts, since right shifts require the shift value to be negated. Bug: v8:10115 Change-Id: I9a032901d03d59cfaa871eefbc58f7f144fd521f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2041709Reviewed-by:
-
Ng Zhi An authored
This is the same as codegen used in TurboFan, with the registers being referred to in a different way. Bug: v8:9909 Change-Id: I082caabc49d6adb367b103a77e44a4e6e1be0ac1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2060265Reviewed-by:
-
- 18 Feb, 2020 24 commits
-
-
Shu-yu Guo authored
This reverts commit 50790c0b. Reason for revert: Arm sim compile breakage: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm%20-%20sim%20-%20lite/8657 Original change's description: > [turbofan] Fast API calls from TurboFan > > Design doc: > http://doc/1SAHn7d8M7CoazTd1laVF8gduFC_ikZWiYuytrR9c4Oc/ > > This CL implements basic API with integer and pointer types marshaling. > > What is not supported yet: > - sequences > - annotations > - floating point arguments > - 64-bit arguments > - exception handling > - InstanceOf checks for the pointer types > - functions with non-void return type > > Bug: chromium:1052746 > > Change-Id: Idbbf6dd50f43dfc9f8d707fe3333e5da3da84a13 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2030740 > Commit-Queue: Maya Lekova <mslekova@chromium.org> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Georg Neis <neis@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Reviewed-by: Michael Stanton <mvstanton@chromium.org> > Cr-Commit-Position: refs/heads/master@{#66322} TBR=yangguo@chromium.org,mvstanton@chromium.org,neis@chromium.org,leszeks@chromium.org,verwaest@chromium.org,mslekova@chromium.org,nicohartmann@chromium.org Change-Id: Id4301f46618d92fc1f65f1db8e1961793a91a09c No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: chromium:1052746 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2062570Reviewed-by:
Shu-yu Guo <syg@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/master@{#66323}
-
Maya Lekova authored
Design doc: http://doc/1SAHn7d8M7CoazTd1laVF8gduFC_ikZWiYuytrR9c4Oc/ This CL implements basic API with integer and pointer types marshaling. What is not supported yet: - sequences - annotations - floating point arguments - 64-bit arguments - exception handling - InstanceOf checks for the pointer types - functions with non-void return type Bug: chromium:1052746 Change-Id: Idbbf6dd50f43dfc9f8d707fe3333e5da3da84a13 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2030740 Commit-Queue: Maya Lekova <mslekova@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Nico Hartmann <nicohartmann@chromium.org> Reviewed-by:
-
Z Nguyen-Huu authored
Store a flag per isolate whether new modules should be kept in tiered-down state from the beginning. Adjust initial compilation if flag is set. Bug: v8:9654 Change-Id: I5aae435fb807f3eaa7efafe9af60451ad3c7e14d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2028452 Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com> Reviewed-by:
-
Shu-yu Guo authored
When running microtasks, the auto policy currently only invokes MicrotasksCompletedCallbacks when the microtask queue is non-empty, while all other policies unconditionally invokes the callbacks. Make the auto mode also unconditionally invoke the callbacks. Bug: v8:10213 Change-Id: I2f608459960b84e6f506646712ac935130646b9e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2057813Reviewed-by:
Sathya Gunasekaran <gsathya@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/master@{#66320}
-
Seth Brenith authored
Please take a look at tools/v8windbg/README.md for an overview of what v8windbg can do and how it's structured. This platform-specific debugging plugin makes use of the data provided by the V8 postmortem debugging API in tools/debug_helper. Note: This code began as https://github.com/billti/v8dbg and then moved into the Edge repository, where I added features gradually and got code reviews for individual changes. Now, taken in its entirety, it's an obnoxiously large CL. I'm open to breaking it up into a few chunks if that would be preferable. Bug: v8:9376 Change-Id: I3e503de00bb1aea870ae83e9bd99e4e2eab9ef98 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2031700Reviewed-by:
Tamer Tas <tmrts@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com> Cr-Commit-Position: refs/heads/master@{#66319}
-
Seth Brenith authored
This allows CoverageInfo to be distinguished from other kinds of FixedArray at runtime. I also updated it to use untagged data since it only stores ints, since that seems like the generally right thing to do (even though I doubt anybody allocates enough of these to notice the reduced GC work). Related Torque changes: - Allow structs containing untagged data to be used as class fields. This requires classifying them into the tagged or untagged sections of the class layout, and checking that their alignment requirements are met when stored in a packed array. - Generate a struct containing struct field offsets, so we can ensure that the layouts defined in Torque and C++ code match. Of course it would be nice to generate a lot more (indexed accessors, synchronized accessors, GC visitors, etc.), but we can't do it all at once. Change-Id: I29e2a2afe37e4805cd80e3a84ef9edfe7ca7bb6b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2047399Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
Michael Lippautz authored
Change-Id: I582af41a8b10957b8fc7acb388871b1d51783a8c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2062395Reviewed-by:
-
Michael Lippautz authored
The marking speed is computed from incremental marking steps reported. In case of embedder tracing, such steps should not include time spent processing embedder memory. Bug: chromium:1044630, chromium:1049084 Change-Id: Ie7b5af569b4114dd8dffd2d85eaf28ece9dfa18c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2062394 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Auto-Submit: Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
-
Frank Tang authored
Fix the gc_stress problem in Original by moving the NewStringFromAsciiChecked before the cast. This is a reland of a872c393 Original change's description: > [Intl] Fix RelativeTimeFormat fatal > > Intl.RelativeTimeFormat constructor crash while the locale or > numberingSystem contains an "algorithmic" numberingSystem. > Fix by fallback to the locale without the nu > > Bug: chromium:1041319 > Change-Id: Ica520e8dec6ace21264504274b92cb2c3d16286f > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2055970 > Reviewed-by: Shu-yu Guo <syg@chromium.org> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> > Commit-Queue: Frank Tang <ftang@chromium.org> > Cr-Commit-Position: refs/heads/master@{#66276} Bug: chromium:1041319 Change-Id: I97563c5dbac1842a4e740e2450070471ea2681a0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2057761Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Frank Tang <ftang@chromium.org> Cr-Commit-Position: refs/heads/master@{#66315}
-
Michael Lippautz authored
V8 is capped by a maximum. Since the embedder step is computed from V8's speeds using concurrent marking it may be too aggressive. Cap the embedder step to the same maximum as V8 to workaround that issue. Bug: chromium:1044630 Change-Id: Idcd84cacf2f3fa4dd8df2a03aa3ae6ffb6cb36a6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2062393Reviewed-by:
-
Toon Verwaest authored
Bug: v8:8088 Change-Id: Ie92499a43e2286e9bb1c64b0d553a515d74d5aa2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2059989Reviewed-by:
Simon Zünd <szuend@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#66313}
-
Milad Farazmand authored
Change-Id: I847d01568f07da0a73e364a25e3e33e3875f3518 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2061229Reviewed-by:
Junliang Yan <jyan@ca.ibm.com> Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#66312}
-
Omer Katz authored
Use 1 less task for concurrent marking to allow Oilpan's concurrent marking a chance to run as well. Change-Id: I236f78925324dc4d21a38233d75dc101cc477930 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2062389 Commit-Queue: Omer Katz <omerkatz@chromium.org> Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Auto-Submit: Omer Katz <omerkatz@chromium.org> Reviewed-by:
-
Milad Farazmand authored
Port 59e96890 R=zhiguo.zhou@intel.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com BUG= LOG=N Change-Id: I01be626d6017d0d76daffc281f64352e3b8ead2b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2062248Reviewed-by:
-
Andreas Haas authored
R=jkummerow@chromium.org Change-Id: If8978ab9cac24cd650553013ac7d41f501ea243d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2061554 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
-
Milad Farazmand authored
Port 820faa6e Original Commit Message: The arm/arm64 simulators debugger has a command "mem" that prints the content of the memory. It also prints a short summary for JS objects (SMI, Array, JSFunction, ...). That is very handy, but when trying to print incomplete initialized memory, it could raise an exception. It is useful to have a command that prints the content of the memory for non-initialized or bogus values without the risk of raising an exception. This CL adds the command "dump". R=victorgomes@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com BUG= LOG=N Change-Id: Ie3931af0cf34052706618774ba95bf0057cfcabf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2062159Reviewed-by:
-
Michael Achenbach authored
Bug: v8:9098 Change-Id: I8200b60605228e6974cd76443ad9d2f93bff56ba Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2061552Reviewed-by:
-
Georg Neis authored
... in favor of CodeAssembler's ScopedExceptionHandler. Also remove unused exception arguments from some iterator related methods. Bug: v8:10187 Change-Id: I8eb7dfd4eb339e4f566970efa5757c3771926ba6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2060496 Commit-Queue: Georg Neis <neis@chromium.org> Auto-Submit: Georg Neis <neis@chromium.org> Reviewed-by:
-
Georg Neis authored
R=machenbach@chromium.org Bug: v8:10220 Change-Id: I541adfd7d02ecbd68474acaf8e672c1838fc318f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2061551Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#66305}
-
Michael Achenbach authored
This adds tests for the mock logic used in differential fuzzing. The tests uncovered a couple of issues in the mock files that are also fixed. This also does some minor code clean up in the mock code. Bug: chromium:1044942 Change-Id: I5b67f70f8b104bb681548f742ab863395a88360f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2043843 Commit-Queue: Michael Achenbach <machenbach@chromium.org> Reviewed-by:
Mathias Bynens <mathias@chromium.org> Cr-Commit-Position: refs/heads/master@{#66304}
-
Gus Caplan authored
This CL reinstates the old pow implementation which calls out to the system implementation of pow. Bug: v8:9622 Change-Id: I3df997888ced3fb8b5bd4b810098e967649aaa55 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1774898Reviewed-by:
Hannes Payer <hpayer@chromium.org> Reviewed-by:
-
Kim-Anh Tran authored
Wasm stack traces now show the url to the wasm script. Bug: v8:9762 Change-Id: Ie7feda499ec76bf001dea093efb720ffd691edad Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2051946 Commit-Queue: Kim-Anh Tran <kimanh@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#66302}
-
Simon Zünd authored
REPL 'let' declared variables use VariableLocation::REPL_GLOBAL which was not handled by a switch in the bytecode generator. The default case ran into an UNREACHABLE. This CL fixes this by properly handling VariableLocation::REPL_GLOBAL for delete. Drive-by: Replaced the default case with an explicit case for VariableLocation::MODULE. Bug: chromium:1052721 Change-Id: I1330ff2f2c6f042a596a8298599a5d58769894f3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2060488 Commit-Queue: Simon Zünd <szuend@chromium.org> Reviewed-by:
Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#66301}
-
Zhou, Zhiguo authored
Bug: v8:9909 Change-Id: Ia74282eab46335235cf4f0e55589af3fcc836d9e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2036739Reviewed-by:
-
- 17 Feb, 2020 10 commits
-
-
Jakob Kummerow authored
By replacing usage of the IsNotArrayIndex bit with IsNotIntegerIndex, we get back one bit that we can use to increase the number of hash bits stored. The price is that strings that represent array/integer indices beyond the cacheable range will have to be scanned more often, but these strings should be rare, and we expect that the additional hash bit is more worthwhile to have. Bug: v8:9904 Change-Id: I33f74b0a73f4754aee85805d4b7c409177668439 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2051947Reviewed-by:
-
Ulan Degenbaev authored
This also changes Heap::AllocateExternalBackingStore to avoid GC inside AlwaysAllocateScope. Bug: chromium:1042566 Change-Id: Ifa8fe8227af2d6492dbb4f9c52f43754d44926fb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2060295 Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
-
Emanuel Ziegler authored
Implement the latest spec changes: - Allow declarative segments to behave like passive & dropped segments. - Enforce that only declared functions may be returned or used in globals as funcref. - Ensure that table fill does not modify any entries if OOB. Spec tests for select and br_table are still failing due to proposal issue Bug: v8:10156 R=ahaas@chromium.org Change-Id: I5b95be36a67bc7482a84b848908cc4cbdf94af03 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2027458Reviewed-by:Andreas Haas <ahaas@chromium.org> Commit-Queue: Emanuel Ziegler <ecmziegler@chromium.org> Cr-Commit-Position: refs/heads/master@{#66297}
-
Shu-yu Guo authored
Currently dirty FinalizationGroups are processed by the cleanup task in LIFO order. This results in starvation when FinalizationGroups are added to the dirty list faster than the cleanup task is run. R=ulan@chromium.org Bug: v8:8179 Change-Id: I6e4a5bbd490396120b07ca6053176beded7cef6e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2051619Reviewed-by:
-
Z Nguyen-Huu authored
This is to fix the hang (rarely happen). The potential root cause is that before initialing recompilation, the recompilation callback is added and then already cleared out by other running threads from initial compilation. Bug: v8:10086, v8:9654 Change-Id: I769bac621cce4611ccde1f0998b0f2bc0e9c04cf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2053248 Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com> Reviewed-by:
-
Michael Achenbach authored
Bug: v8:10204, v8:10219 Change-Id: Ie08692121811bf23b9e8ea2c3fc38f38a8705fbf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2060489 Commit-Queue: Michael Achenbach <machenbach@chromium.org> Reviewed-by:
Mythri Alle <mythria@chromium.org> Reviewed-by:
-
Jakob Kummerow authored
There is a copy of the pointer decompression logic in TypedArrayBuiltinsAssembler::SetJSTypedArrayOnHeapDataPtr, which was not updated for the new ("smi-corrupting") pointer compression scheme: it erroneously used a sign-extending cast from compressed to full representation. This causes incorrect values to be computed when the heap size can grow beyond 2GB. Bug: v8:9706, chromium:1051005 Change-Id: I2220ce759df1147f255ffca93428888858929fd9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2060494Reviewed-by:Igor Sheludko <ishell@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#66293}
-
Michael Achenbach authored
Otherwise we report a spurious difference after OOM. Bug: chromium:1052849 Change-Id: I795f7393a8061ff41178295d49bdaea411d3c461 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2060307Reviewed-by:
-
Michael Achenbach authored
This adds 3 flags to the numfuzz fuzzer depending on a probability: --budget-for-feedback-vector-allocation=0 --interrupt-budget=100 --no-lazy-feedback-allocation No-Try: true Bug: v8:10204 Change-Id: I83dabcd0e3ca80bebe596d65d03b3e99d8ecbf03 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2060490 Commit-Queue: Michael Achenbach <machenbach@chromium.org> Reviewed-by:
-
Michael Achenbach authored
This reduces the pointer-compression experiment by 3% as it is in production since a while. This also uses turbofan when comparing across architectures as tests run faster and likely find the same or more relevant bugs. No-Try: true Change-Id: I35ec97188a101a7cb43454903f7bf9765e57893c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2059995 Commit-Queue: Michael Achenbach <machenbach@chromium.org> Reviewed-by:
-
