- 28 Jun, 2022 8 commits
-
-
Michael Achenbach authored
No-Try: true Bug: chromium:1307180 Change-Id: I96701e45b4bc0c70e5e8fe085425cfbca480934d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3726306Reviewed-by:
Liviu Rau <liviurau@chromium.org> Auto-Submit: Michael Achenbach <machenbach@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/main@{#81412}
-
Jakob Kummerow authored
This remodels the tier-up checks on loop back edges to avoid modifying the cache state by taking temp registers passed in from the caller, and not causing the instance to get cached. Additionally, this introduces FreezeCacheState scopes, which allow us to enforce that certain ranges don't cause any cache modifications. Conditional jumps require such a scope to be around, which should help ensure that we don't forget to add them to any future code we write. Drive-by cleanup: drop {pinned} lists from a few Load helper functions. They don't allocate registers (and shouldn't), so they don't need to know about pinned registers. Fixed: chromium:1339321 Change-Id: I1c7660418a85259e96c5e0dcfeaf12dab2114e8c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3724787Reviewed-by:Manos Koukoutos <manoskouk@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#81411}
-
Michael Achenbach authored
No-Try: true Bug: chromium:1307180 Change-Id: Id1ed9e3d47d7b3c680e278eea2efd4195110cf37 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3726303 Auto-Submit: Michael Achenbach <machenbach@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#81410}
-
v8-ci-autoroll-builder authored
Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/086948b..c8f1e5e R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com Change-Id: I1a18acc96818bb70b0d953d23d236c0eb7fcc968 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3727242 Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#81409}
-
Michael Achenbach authored
This CL adds back a patch of Math.pow for correctness fuzzing, which drops some precision and hides a difference on the fast path. The same suppression was previously used on https://crbug.com/693426. No-Try: true Bug: chromium:1339320 Change-Id: Id52f25f8a2b6b5aeca956587b16a10c61aa68e36 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3726295Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Maya Lekova <mslekova@chromium.org> Auto-Submit: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/main@{#81408}
-
Michael Lippautz authored
Don't actually free memory as that would maintain free bytes accounting. Instead, just write a filler that is reclaimed on next garbage collection, updating counters. Bug: v8:13000, chromium:1338687 Change-Id: I5339505160fde4b2f522a1a4212d23d7afc2b5f3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3726292Reviewed-by:
Omer Katz <omerkatz@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#81407}
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/da9fb2e..4e6d71d Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/f575df1..086948b R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com Change-Id: I59650f42a13aafb10c1606231951dbe7c2a2198e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3727240 Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#81406}
-
v8-ci-autoroll-builder authored
Rolling v8/buildtools/third_party/libunwind/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/b387062..49191c5 Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/ebccac7..3c4d401 Rolling v8/third_party/fuchsia-sdk/sdk: version:8.20220626.2.1..version:8.20220627.3.1 R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com Change-Id: I96956a29f07049ba7b7a0e3d9cd6b40596fa3b0d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3727239 Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#81405}
-
- 27 Jun, 2022 31 commits
-
-
Nikolaos Papaspyrou authored
This CL introduces a compile flag v8_enable_inner_pointer_resolution_mb. Behind it, it introduces a method `FindBasePtr` in `MemoryChunk`, which implements inner pointer resolution using the chunk's marking bitmap. This method is intended to be used for conservative stack scanning, to resolve inner pointers to heap objects, at some point late in the marking phase. It also delays stack scanning during the marking phase of a full GC, to ensure that marking has proceeded and most heap objects have already been marked. Bug: v8:12851 Change-Id: I40e291a86bb8d2587a2c1d9505574dde3c65eb16 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3703837 Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#81404}
-
Michael Achenbach authored
Point to the same version as Chromium does: http://shortn/_8kg7qPA03I Bug: v8:13002 Change-Id: Ief1da2951499767e011cbf309f0ce99fea44ab22 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3726211Reviewed-by:
Alexander Schulze <alexschulze@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/main@{#81403}
-
Samuel Groß authored
The ExternalPointerTags are assumed to be compile-time constants in most cases, so turning them into template parameters enforces that. As decisions such as whether to use the per-isolate or the shared external pointer table are encoded into the tag values, forcing those to be compile-time constants guarantees that the compiler will be able to inline the correct logic when accessing an external pointer. With this, there are now two (high-level) ways of accessing external pointer fields from C++: the Read/WriteExternalPointerField methods which require the ExternalPointerTag to be a template parameter, and the ExternalPointerSlot class which takes the tag as an argument. The latter is for example used for snapshot deserialization and by the garbage collector (more generally, by the ObjectVisitor::VisitExternalPointer method), where the tag is not a compile-time constant. Finally, this CL also introduces a new ExternalPointerHandle type which represents the (opaque) on-heap representation of a reference to an entry in an ExternalPointerTable when sandboxing is enabled. Making this its own type makes the code a bit more readable. Bug: v8:10391 Change-Id: I867b8ce41d15d485f1dc66786f233c710c56afcb Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3720641Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Reviewed-by:
-
Pan, Tao authored
is before a new nesting loop This is probably a JumpLoop to loop nesting level 0 getting removed if it's dead code. Add before a new nesting loop to break condition of removing OSR code cache if deopt at inside of loop. Bug: chromium:1330883 Change-Id: I010e3ca2adaafae8dcc606c49860ca0a70442952 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3713093Reviewed-by:
-
Patrick Thier authored
- Change definition to macro-style to be able to assert that masks/tags are correct. - Split definition of shared/non-shared tags. - Use bit 62 (for now) to indicate tags are shared. Bug: v8:10391 Change-Id: Ia3ad6294cf5e6fd0c4dc2a328f976f295da762f5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3726009Reviewed-by:
Samuel Groß <saelo@chromium.org> Commit-Queue: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#81400}
-
Manos Koukoutos authored
Change-Id: I6f2e5fa04eba1b3c97212be945b776ebc2be5915 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3726210Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#81399}
-
Pan, Tao authored
Parameter of class UnoptimizedFrame and JavaScriptFrame was removed. Change-Id: I37c43ff491f039820f40d60ed9ada43fd59e7c05 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3725613Reviewed-by:
-
Anton Bikineev authored
Since v8config.h already defines the related logic for OS detection, it should be fine to move arch detection also there. The CL also makes Oilpan use one of those macros to avoid discrepancy between the compiler and custom macros (the discrepancy occurs for host tools, e.g. mksnapshot). Bug: chromium:1336222 Change-Id: Ibe7d9116d27c3e816f4778fd4c149d8142d0f7a9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3726208 Commit-Queue: Anton Bikineev <bikineev@chromium.org> Reviewed-by:
-
jameslahm authored
... value count. Bug: v8:11525 Change-Id: Iedc424a665dc412c278cf98457c169ffe98bb236 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3721178Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Commit-Queue: 王澳 <wangao.james@bytedance.com> Cr-Commit-Position: refs/heads/main@{#81396}
-
jameslahm authored
... objects/dictionary-unittest. Bug: v8:12781 Change-Id: I7faeb9fedf7857b25a85bf32f14323ba3da207c0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3706968Reviewed-by:
-
jameslahm authored
... base/atomicops-unittest. Bug: v8:12781 Change-Id: Iac23576cca9c50c2281a2d7e781dde4750e54c03 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3711344Reviewed-by:
-
Manos Koukoutos authored
Rename: - array.init(_static) -> array.new_fixed(_static) - array.init_from_data(_static) -> array.new_data(_static) - array.init_from_elem_static -> array.new_elem_static - (Wasm)ArrayInitFromSegment -> (Wasm)ArrayNewSegment Bug: v8:7748 Change-Id: I5ea314d653dd0e9f7f1f556469794d880934e01b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3726207Reviewed-by:
-
jameslahm authored
... api/access-check-unittest. Bug: v8:12781 Change-Id: I25025af204cdeaba1ba2b690cbaf5ba93e59441f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3725447 Commit-Queue: 王澳 <wangao.james@bytedance.com> Reviewed-by:
-
jameslahm authored
... unittests/heap/persistent-handles-unittest. Bug: v8:12781 Change-Id: I8d7abff3a34e11c920053c71a1a2c4b9c84235d9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3724791 Commit-Queue: 王澳 <wangao.james@bytedance.com> Reviewed-by:
-
jameslahm authored
... objects/global-object-unittest. Bug: v8:12781 Change-Id: I40a8d00301531e7d1a6dce90e1226c4568c8d72c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3713521 Commit-Queue: 王澳 <wangao.james@bytedance.com> Reviewed-by:
-
jameslahm authored
... /codegen/pointer-auth-arm64-unittest. Bug: v8:12781 Change-Id: Ibce77b62650c7a5f84b62282861297b9d4b2e591 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3724790Reviewed-by:
-
Jakob Kummerow authored
And add a test to ensure we've caught them all and won't forget any others in the future. Change-Id: I9bed83ada1c8991eaf08af4b34d4ccda7dc0e600 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3724788 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
-
Michael Achenbach authored
The following flag combinations run into a CHECK in d8: ('--assert-types', '--stress-concurrent-inlining') ('--assert-types', '--stress-concurrent-inlining-attach-code') All flags can be passed as clusterfuzz trials on d8 fuzzers and lead to poor fuzzing outcomes. This lowers their probability as a mitigation until a better solution is found. No-Try: true Bug: chromium:1336577 Change-Id: I63747bb0a466c01d2789fc76cb9232f7afe720f0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3721382 Auto-Submit: Michael Achenbach <machenbach@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: -
Manos Koukoutos authored
- Use the lowered 32-bit signature when linking the inlined and caller graphs. - Tolerate non-projection uses of Call nodes when linking the graphs. These can be left over by Int64Lowering. - Drive-by: Inline really small functions even if their call count is low. Bug: v8:12166 Change-Id: I5b472d3f617f2f23820a5d142102c0a6c5c769dc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3720715Reviewed-by:
-
Danylo Boiko authored
- Moved graph-phase.ts to graph-phase folder - Refactored selection.ts, selection-broker.ts, selection-handler.ts, source-resolver.ts Bug: v8:7327 Change-Id: I922c8730f89c53a73a55414378ac1e29a6397a80 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3714945Reviewed-by:
Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Danylo Boiko <danielboyko02@gmail.com> Cr-Commit-Position: refs/heads/main@{#81385}
-
Samuel Groß authored
It is no longer necessary to postpone the allocation of backing stores to avoid triggering GC. As such, the logic around ArrayBuffer deserialization can be simplified. Bug: v8:10391, v8:11111 Change-Id: I7410392a6e658cd4be77e2192483c6d412b63412 Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3717982Reviewed-by:
Marja Hölttä <marja@chromium.org> Reviewed-by:
-
Michael Achenbach authored
No-Try: true Bug: v8:12999 Change-Id: I82b1d8d3dc9ab62341f581440665964652603b92 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3720718 Auto-Submit: Michael Achenbach <machenbach@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
-
Camillo authored
Now you can use 3-letter alias for all modes: rel, opt, dbg Example: gm.py x64.opt.d8 No-Try: True Change-Id: I825ebbf4cc1c509599f4fd2ac5aa0ac6fab998c0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3723506Reviewed-by:
-
Marja Hölttä authored
In this part: entries, keys, values Bug: v8:11111 Change-Id: I2a87be21348626e34f887c71026dba1120adb7d6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3723504Reviewed-by:
Shu-yu Guo <syg@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/main@{#81381}
-
Patrick Thier authored
The waiter queue node of JS Atomics.Mutex is now stored in the shared external pointer table. Bug: v8:12547 Change-Id: I2f4ce1c705d5e710b49872942702f60edf6c4043 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3721696Reviewed-by:
-
Samuel Groß authored
Instead of creating smaller sandboxes when the allocation of the virtual address space reservation fails, we now create partially-reserved sandboxes and halve the reservation size until the initialization succeeds. That way, the unreserved part of the sandbox can still be used for allocating objects. Bug: v8:10391 Change-Id: I89a7790ffcda87ab71cc7b7f1101c0a1c3c62829 Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3714241Reviewed-by:
-
Leon Bettscheider authored
Previously, only root marking performed during the final pause was accounted for in the tracing data. This CL enables tracing of the initial root marking step of MajorMC. Change-Id: I4aa8a52144d81a12e43a481518acbab118978992 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3724793 Commit-Queue: Leon Bettscheider <bettscheider@google.com> Reviewed-by:
-
Andy Wingo authored
Utf8Decoder used to use unibrow::Utf8::ValueOfIncremental, which had a fast path to avoid the decoder for bytes less than 0x80 in the start state. We had to switch away from ValueOfIncremental but it's probably a good idea to keep the fast path. Bug: v8:12868 Change-Id: I7d83d67f2c13a1c4f026dde04ef0a69b7de47dc3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3723498 Commit-Queue: Andy Wingo <wingo@igalia.com> Reviewed-by:
-
Andy Wingo authored
Quite embarassingly, the test that the WTF-8 decoder rejects surrogate pairs was broken: the trailing surrogate was invalid. (The range of the second byte for leading surrogates is [A0,AF], and for trailing is [B0,BF]). Of course the actual functionality was broken, because the code that detected surrogate pairs called IsSurrogatePair with swapped arguments. Bug: v8:12868 Change-Id: Icab5e2e4e200afb3d34f478ab4f98b739ada5645 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3723497Reviewed-by:
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/2089295..da9fb2e R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com Change-Id: I97069cb241823a1cd7841500c4c8fd546174ad88 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3725651 Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#81375}
-
v8-ci-autoroll-builder authored
Rolling v8/third_party/fuchsia-sdk/sdk: version:8.20220625.1.1..version:8.20220626.2.1 R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com Change-Id: I1062c51092c5b726eda8c676da482b2c40a914ca Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3725648 Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#81374}
-
- 26 Jun, 2022 1 commit
-
-
Manos Koukoutos authored
This CL adds control-path type-tracking for wasm-gc nodes in the WasmGCOperatorReducer. Nodes now use the types assigned to their argument nodes, as well as the additional information tracked along control paths. Drive-by: Add support for multiple instances of the same node to appear in control-path-state. Bug: v8:7748 Change-Id: I73e8f84595609b3a5fb61a2bffeb973182d17676 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3717994Reviewed-by:
-
