Skip to content

V
V8
Switch branch/tag
  1. 10 Mar, 2017 1 commit
  3. 09 Mar, 2017 1 commit
  5. 08 Mar, 2017 1 commit
  7. 07 Mar, 2017 4 commits
  9. 06 Mar, 2017 1 commit
  11. 03 Mar, 2017 4 commits
  13. 01 Mar, 2017 2 commits
  15. 28 Feb, 2017 3 commits
  17. 27 Feb, 2017 2 commits
  19. 24 Feb, 2017 2 commits
  21. 23 Feb, 2017 2 commits
  23. 22 Feb, 2017 3 commits
  25. 20 Feb, 2017 3 commits
  27. 17 Feb, 2017 4 commits
  29. 16 Feb, 2017 4 commits
    • dcheng's avatar
      Make instance checks understand remote contexts. · 692cccce
      dcheng authored 
      https://crrev.com/2500363002 updated FunctionTemplate::HasInstance to
follow the hidden prototype chain of a global proxy to the global
object. However, remote contexts don't have a global object to check;
instead, teach the instance check knows about the conventions of
global proxy setup and have it also check the constructor's prototype.

Similarly, also teach Object::FindInstanceInPrototypeChain about the
unusual conventions for remote contexts.

BUG=527190

Review-Url: https://codereview.chromium.org/2698683003
Cr-Commit-Position: refs/heads/master@{#43263}
      692cccce
    • Daniel Clifford's avatar
      [ignition] Optimize reloading of registers before Dispatch · bd21c2bd
      Daniel Clifford authored 
      Before this patch, the registers needed for bytecode dispatch in interpreter
handlers were inconsistently stored in the interpreter frame and/or kept in
values that remained live across calls.

After this patch, these registers are explicitly reloaded after calls, making it
possible to elide the spills of those registers before the call in many cases.

Some highlights from the CL:

* Added methods to the CSA and InterpreterAssembler to efficiently store and
  load Smis values and Smi interpreter registers on x64 without explicit
  tagging/untagging.

* Created Variables for all of the interpreter-internal values that need to be
  reloaded before bytecode dispatch at the end of an interpreter handler.

* The bytecode offset can be written out early in a handler by marking it
  has having a call along it's critical path. By moving this early in a
  handler, it becomes possible to use memory operands for pushes used to
  marshall parameters when making calls.

Change-Id: Icf8d7798789f88a4489e06a7092616bbbb881577
Reviewed-on: https://chromium-review.googlesource.com/442566
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: 's avatarRoss McIlroy <rmcilroy@chromium.org>
Reviewed-by: 's avatarMichael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43260}
      bd21c2bd
    • jbroman's avatar
      ValueDeserializer: Only allow valid keys when deserializing object properties. · 8990399d
      jbroman authored 
      The serializer won't ever write a more complex object. Not validating this
allows other things to be used as keys, and converted to string when the
property set actually occurs. It turns out this gives an opportunity to trigger
OOM by giving an object a key which is a very large sparse array (whose string
representation is very large).

This case is now rejected by the deserializer.

BUG=chromium:686511

Review-Url: https://codereview.chromium.org/2697023002
Cr-Commit-Position: refs/heads/master@{#43249}
      8990399d
    • Michael Starzinger's avatar
      [turbofan] Handle arithmetic addition in early lowering. · 9d53d16b
      Michael Starzinger authored 
      This handles arithmetic addition operations during the early type-hint
lowering (i.e. during graph construction). The string addition case is
still handled by {JSTypedLowering} as it needs static type information.

R=bmeurer@chromium.org

Change-Id: I9df47dfc5bf7613c51f6d803ab43d5d3f6c21be8
Reviewed-on: https://chromium-review.googlesource.com/443185Reviewed-by: 's avatarBenedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43235}
      9d53d16b
  31. 15 Feb, 2017 2 commits
  33. 14 Feb, 2017 1 commit