- 20 Jan, 2022 9 commits
-
-
Jakob Gruber authored
Bug: v8:12552 Change-Id: I99e4d8e8aeba5460f11e54cc1b2bcaea98a5276d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3400964Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#78698}
-
Samuel Groß authored
In case the requested permissions are kNoAccess, nothing needs to be done as the mapping backing an AddressSpaceReservation is always mapped kNoAccess. This fixes a performance regression on macOS. Bug: chromium:1287599 Change-Id: I77d80489caf477e29434f9d0a06899746cb9403f Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3398144Reviewed-by:
-
Liviu Rau authored
Bug: v8:12405 Change-Id: I00f727ad5172d08f430b5dc2b7a348cbec344c4a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3401721Reviewed-by:
Lutz Vahl <vahl@chromium.org> Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Commit-Queue: Liviu Rau <liviurau@chromium.org> Cr-Commit-Position: refs/heads/main@{#78696}
-
Jochen Eisinger authored
Change-Id: I8fd11742c4ea13cfd5cd3864e167785b97f1383a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3404274Reviewed-by:
-
Maya Lekova authored
Bug: v8:12558 Change-Id: If5f8048d1a48719329c257282195f5096e101512 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3401586 Auto-Submit: Maya Lekova <mslekova@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#78694}
-
Samuel Groß authored
This CL fixes two issues: 1) When the specified vmar_offset was zero, the previous logic would incorrectly conclude that no target address was specified, and would potentially place the allocation elsewhere in memory, not at the desired address. This CL now passes both the target address and the VMAR base address to AllocateInternal, which can then correctly determine whether a target address was supplied. 2) When the root_vmar was used and a hint specified, the previous logic would incorrectly use nullptr as base address of the root_vmar, which appears to be incorrect. The new logic now obtains the actual base (apparently 2MB) through zx_object_get_info during initialization. Bug: v8:10391 Change-Id: Ia8215440a790b4a2a0c8d33f623d3ecb6a731a97 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3398506Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Victor Gomes <victorgomes@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#78693}
-
Jakob Gruber authored
Use the FatalProcessOutOfMemory function such that tooling recognizes these crashes as OOM's. Drive-by: Skip one more test that leads to such stack overflows. Fixed: v8:12555, chromium:1288456 Bug: v8:12472 Change-Id: Ib9203a4aa0487744f7cea9a212aeeffda579ae23 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3401861 Auto-Submit: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Clemens Backes <clemensb@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#78692}
-
Lu Yahan authored
Port commit db9f6bff Bug: v8:11112 Change-Id: I6c69e0501cae6c46e723d847bf56e69bb4835bec Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3398260Reviewed-by:
ji qiu <qiuji@iscas.ac.cn> Commit-Queue: ji qiu <qiuji@iscas.ac.cn> Cr-Commit-Position: refs/heads/main@{#78691}
-
v8-ci-autoroll-builder authored
Rolling v8/base/trace_event/common: https://chromium.googlesource.com/chromium/src/base/trace_event/common/+log/7f36dbc..d115b03 Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/f3be6e8..841e388 Rolling v8/buildtools/third_party/libc++abi/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi/+log/94855f7..7d79126 Rolling v8/buildtools/third_party/libunwind/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/57e4aff..efb2cbd Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/f92a0a2..8bc3659 Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/cb340f5..a657331 Rolling v8/third_party/googletest/src: https://chromium.googlesource.com/external/github.com/google/googletest/+log/c9643a2..100f6fb Rolling v8/tools/luci-go: git_revision:d1e877e2b3e5a05a5cd34c4a340fedba14a16c2b..git_revision:5b02a4aaeb5fd78d6fe41d6d54d1cb58da17f192 Rolling v8/tools/luci-go: git_revision:d1e877e2b3e5a05a5cd34c4a340fedba14a16c2b..git_revision:5b02a4aaeb5fd78d6fe41d6d54d1cb58da17f192 R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com Change-Id: Ic20a71114072b6240b0ba01252ed9cd562395b80 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3402380 Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#78690}
-
- 19 Jan, 2022 17 commits
-
-
Seth Brenith authored
This is a regression test for the fixes in https://crrev.com/c/v8/v8/+/3299592 . Some of the helper functions were copied from console-retaining-path.js in the same directory. Bug: v8:12112 Change-Id: I3c313ad003ede5e5036f886161e1d164c98f87fe Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3400149Reviewed-by:
Simon Zünd <szuend@chromium.org> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com> Cr-Commit-Position: refs/heads/main@{#78689}
-
Milad Fa authored
enum values need to be explicitly casted to int type to prevent the following error: ``` expects argument of type 'int', but argument 3 has type 'v8::internal::{anonymous}::V8StartupState' ``` Bug: v8:12309 Change-Id: I9515cde7d2496ca070ce4c6b751501236864730b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3401398Reviewed-by:Igor Sheludko <ishell@chromium.org> Commit-Queue: Milad Farazmand <mfarazma@redhat.com> Cr-Commit-Position: refs/heads/main@{#78688}
-
Shu-yu Guo authored
super.property accesses in heritage positions like `class C extends super.property` should resolve super in the current scope, not C's class scope. Bug: chromium:1282096 Change-Id: I7ef815bc02cfff35a2898ef9f39b133d1114046c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3400150Reviewed-by:
Marja Hölttä <marja@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#78687}
-
Manos Koukoutos authored
- Do not create a new handle for {target_instance}. - Only instantiate FunctionTargetAndRef once. Bug: chromium:1284557 Change-Id: I42aea5750e93ef4ac578003bca323cda4753b6f6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3395874Reviewed-by:Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#78686}
-
Scott Violet authored
The experiment has been would down, so these can be removed. This effectively reverts these two commits: https://chromium-review.googlesource.com/c/v8/v8/+/3271389 https://chromium-review.googlesource.com/c/v8/v8/+/3256006 chrome side here: https://chromium-review.googlesource.com/c/chromium/src/+/3399313 BUG=chromium:1257321 TEST=none Change-Id: I5e9e4e7f56a6f19159d1c8c20c5a1fe5ed2859fb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3399226Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
Andreas Haas authored
The method SetInstanceDescriptors accessed the bit field before it got initialized, which is undefined behavior. R=cbruni@chromium.org Change-Id: Ie17e6e840a9a4278e066278d1ce81ac4b836a429 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3400970Reviewed-by:
-
Dominik Inführ authored
Bug: v8:11708 Change-Id: I83c9559bb2aee062a53c1d67c293b8f6654c7d99 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3400965Reviewed-by:
-
Al Muthanna Athamina authored
Change-Id: I9499aacb4ddf4bc2afc3c72666910b4ad756cfc1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3400969 Auto-Submit: Almothana Athamneh <almuthanna@chromium.org> Commit-Queue: Almothana Athamneh <almuthanna@chromium.org> Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/main@{#78682}
-
Marja Hölttä authored
Also: - Refactor the ValueSerializer tests using raw data, so that we test all valid versions for each test (not only one hard-coded one) - Mark some tests as backwards compatibility tests, to make it less likely that somebody updates them not realizing they are backwards compatibility tests. Bug: v8:11111, v8:12532 Change-Id: I670849de07742c8d442249ef4f013781e4ee9255 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3386802Reviewed-by:
-
Al Muthanna Athamina authored
Change-Id: I47ff2062a8f9fbb52f1760a47ebfdc0d2c035900 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3400963 Auto-Submit: Almothana Athamneh <almuthanna@chromium.org> Reviewed-by:
-
Camillo Bruni authored
The startup and shutdown order is as follows: v8::V8::InitializePlatform(platform); v8::V8::Initialize(); v8::Isolate* isolate = v8::Isolate::New(...); ... isolate->Dispose(); v8::V8::Dispose(); v8::V8::DisposePlatform(); Bug: v8:12309 Change-Id: I043c19173e36b08b02677081a8f14c2b313f6891 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3300129Reviewed-by:
-
Nico Hartmann authored
Bug: v8:7793 Change-Id: I88e6ea24909ba1dde8cada90d7b195b6f6ecc783 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3400958Reviewed-by:
-
Manos Koukoutos authored
This is a reland of f1c2a208 Changes compared to original: Revert test change which used simd and caused problems in multiple test configurations. Original change's description: > [wasm] Various small cleanups/fixes > > Changes: > - Fix a bug in objects-printer where array elements were not treated as > tagged pointers. > - Fix a few TODOs, mainly in the wasm interpreter. > - Improve documentation, small refactorings. > > Change-Id: I1d70ad454b3a0693b9b784b17395434d81d01b61 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3383136 > Reviewed-by: Nikolaos Papaspyrou <nikolaos@chromium.org> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> > Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> > Cr-Commit-Position: refs/heads/main@{#78656} Change-Id: I91f4fed5fbc91acb8b42413a6f40a8202bd43096 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3398111Reviewed-by:
-
Simon Zünd authored
CDP has a "ExceptionDetails" structure that is attached to various CDP commands, e.g. "Runtime#exceptionThrown" or "Runtime#evaluate". The stack trace in the "ExceptionDetails" structure is used in various places in DevTools. The information in the "ExceptionDetails" structure is extracted from a v8::Message object. Message objects are normally created at the exception throw site and may augment the error with manually inspecting the stack (both to capture a fresh stack trace in some cases, as well as to calculate location info). The problem is that in some cases we want to get an "ExceptionDetails" structure after the fact, e.g. when logging a JS "Error" object in a catch block. To help in this case, this CL introduces a new CDP method "Runtime#getExceptionDetails" that behaves exactly as advertised: It provides a populated "ExceptionDetails" structure from a JS Error object. R=bmeurer@chromium.org Doc: https://bit.ly/runtime-get-exception-details Bug: chromium:1278650 Change-Id: I084be10c1d852d3b7cac8d88e7f820e867be4722 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3337258 Commit-Queue: Simon Zünd <szuend@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/main@{#78676}
-
Dominik Inführ authored
We recently landed write barrier verification in https://crrev.com/c/3386803. This CL adds verification to set_map_no_write_barrier and similar methods as well. Bug: v8:12544 Change-Id: I54844b0323731281b4f41fd1502acdd44557a2c9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3395561Reviewed-by:
-
Frank Tang authored
get Temporal.ZonedDateTime.prototype.(hour|minute|*second) Bug: v8:11544 Change-Id: I5f3d20f371db4898365876483c49df73d96f3728 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3373927Reviewed-by:
Shu-yu Guo <syg@chromium.org> Commit-Queue: Frank Tang <ftang@chromium.org> Cr-Commit-Position: refs/heads/main@{#78674}
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/79e39b3..f3be6e8 Rolling v8/buildtools/third_party/libc++abi/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi/+log/d78d7bf..94855f7 Rolling v8/buildtools/third_party/libunwind/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/c27c97a..57e4aff Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/a2e49be..f92a0a2 Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/fd7427c..cb340f5 Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/3da260b..df50898 R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com Change-Id: I62542a767ce111879969a55920f256d36377731f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3398823 Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#78673}
-
- 18 Jan, 2022 14 commits
-
-
Jakob Kummerow authored
Avoid the worst case of spinning for 100ms on systems with low-resolution timers. It's unclear how widespread such systems are -- I couldn't find one, but one user claims to have one. Details and investigation results: http://shorturl.at/otyP4 Change-Id: I8d1aefef2552c5e8e16348bc86e663ac1bc4f6c5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3398501Reviewed-by:
-
Nico Hartmann authored
Previously, literals in Torque were stored as double values, which made it impossible to precisely represent 64 bit integer values. This CL replaces the old literal expression with an integer and floating point literal expression that are unbounded in size. We allow implicit conversion of these literals to arbitary integer and floating point types respectively and insert a corresponding bounds check into generated CSA. Bug: v8:7793 Change-Id: I46c231aab92bc2f0c26955d1876079f306b358c6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3329792Reviewed-by:
-
Victor Gomes authored
This hashtable will be used by ScopeInfo::Create which is instantiated with Isolate and LocalIsolate. Bug: v8:12315 Change-Id: I098c103eb884795ee84d50c0756af686c27ced31 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3398116 Auto-Submit: Victor Gomes <victorgomes@chromium.org> Reviewed-by:
-
Andreas Haas authored
Change-Id: Ia5c023bb77cd7cb1b85684b4d08b34c772732a1a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3398494Reviewed-by:
Emanuel Ziegler <ecmziegler@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/main@{#78669}
-
Jakob Gruber authored
Apply case-insensitive comparisons not only for the initial character, but for the entire prefix. This avoids degenerate behavior for patterns like /aaaa|AAAA|AAAA/i (i.e. generate a single 4-char prefix instead of four 1-char prefixes). Bug: v8:12472 Change-Id: Ib2b49fe73ca846a1b7ec90056cc64bdf5cf33026 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3398114Reviewed-by:
Patrick Thier <pthier@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#78668}
-
Jakob Gruber authored
Recursive ToNode node generation may overflow the stack for large graphs. As a quick fix, insert periodic stack overflow checks in selected ToNode methods. As a more permanent fix, in the future we could abort gracefully (instead of crashing on a CHECK), and/or refactor into iterative node generation. Bug: v8:12472 Change-Id: Ie5fbe838c5f6a5192d7d9b44bfe6f6c76a8d26e7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3398112Reviewed-by:
-
Samuel Groß authored
These tests cover the basic VirtualAddressSpace functionality for the three different types of address spaces currently available: the root space, subspaces, and emulated subspaces. This CL also includes minor bugfixes in VirtualAddressSpace implementations and removes RandomizedVirtualAlloc in platform-win32.cc which doesn't seem to do anything useful anymore but prevents page allocation hints from working correctly. Bug: v8:10391 Change-Id: Ifa260d18fd366516b5a41ab42ce2f1785c57d061 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3386801Reviewed-by:
-
Maya Lekova authored
This reverts commit bd72152e. Reason for revert: TSAN reports a data race, please see https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20isolates/18124/overview Original change's description: > [fastcall] Add Wasm entry for Fast API calls > > Allow Wasm to generate calls directly to Fast API C functions. > This massively reduces the overhead of these calls (~300%). > Currently options parameter is not supported. > > This is a rebase of the work originally done by devsnek in: > https://chromium-review.googlesource.com/c/v8/v8/+/2718666. > > Bug: chromium:1052746 > Change-Id: I1bb1de68b440044cc8a4e528adf9d8e0e6692a07 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3364356 > Reviewed-by: Clemens Backes <clemensb@chromium.org> > Reviewed-by: Manos Koukoutos <manoskouk@chromium.org> > Reviewed-by: Maya Lekova <mslekova@chromium.org> > Commit-Queue: Paolo Severini <paolosev@microsoft.com> > Cr-Commit-Position: refs/heads/main@{#78664} Bug: chromium:1052746 Change-Id: I957708cf1cff6ee8f90678ee48428f5c12f75a53 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3398121 Auto-Submit: Maya Lekova <mslekova@chromium.org> Owners-Override: Maya Lekova <mslekova@chromium.org> Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#78665}
-
Paolo Severini authored
Allow Wasm to generate calls directly to Fast API C functions. This massively reduces the overhead of these calls (~300%). Currently options parameter is not supported. This is a rebase of the work originally done by devsnek in: https://chromium-review.googlesource.com/c/v8/v8/+/2718666. Bug: chromium:1052746 Change-Id: I1bb1de68b440044cc8a4e528adf9d8e0e6692a07 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3364356Reviewed-by:
Manos Koukoutos <manoskouk@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Paolo Severini <paolosev@microsoft.com> Cr-Commit-Position: refs/heads/main@{#78664}
-
Camillo Bruni authored
Bug: v8:11165 Change-Id: I7c00d2dc87b232b24c4760922936580347358778 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3395881 Auto-Submit: Camillo Bruni <cbruni@chromium.org> Reviewed-by:
-
Liu Yu authored
Port commit db9f6bff Bug: v8:11112 Change-Id: I23e4f5e9fe854dce1c9cd93c28fdb656980c7094 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3397537 Auto-Submit: Yu Liu <liuyu@loongson.cn> Reviewed-by:
Zhao Jiazhong <zhaojiazhong-hf@loongson.cn> Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn> Cr-Commit-Position: refs/heads/main@{#78662}
-
v8-ci-autoroll-builder authored
Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/6cf20f1..9e859f5 Refine docs on changing cpufreq governor (#1325) (Dominic Hamon) https://chromium.googlesource.com/external/github.com/google/benchmark/+/9e859f5 Expand documentation for unpacking arbitrary arguments. (#1324) (Dominic Hamon) https://chromium.googlesource.com/external/github.com/google/benchmark/+/00e2211 R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,mlippautz@chromium.org Change-Id: I69f60ec9a6db9db57b1a3376730088a829a0aeb5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3396458 Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#78661}
-
Anton Bikineev authored
When the stack is split in safe and unsafe parts, on-stack TracedReferences are allocated on the unsafe stack. What currently happens is that on GC we destroy all the on-stack references below the current frame of the *safe* stack. If the safe stack is allocated above the unsafe counterpart, then all the traced references will be preliminary destructed on GC. This CL fixes it by using __builtin___get_unsafe_stack_ptr() if -fsanitize=safe-stack is enabled. In addition, deduplicate OnStackTracedNodeSpace::IsOnStack() and Stack::IsOnStack() and move more logic into ::heap::base::Stack. Bug: chromium:1278780 Change-Id: I9582bb1321958b7ec8ef2c0c46b9e42d51bb6f94 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3395033Reviewed-by:
-
Joyee Cheung authored
Previously, StoreOwnIC incorrectly reuses the [[Set]] semantics when initializing public literal class fields and object literals in certain cases (e.g. when there's no feedback). This was less of an issue for object literals, but with public class fields it's possible to define property attributes while the instance is still being initialized, or to encounter existing static "name" or "length" properties that should be readonly. This patch fixes it by 1) Emitting code that calls into the slow stub when handling StoreOwnIC with existing read-only properties. 2) Adding extra steps in StoreIC::Store to handle such stores properly with [[DefineOwnProperty]] semantics. Bug: v8:12421, v8:9888 Change-Id: I6547320a1caba58c66ee1043cd3183a2de7cefef Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3300092Reviewed-by:
-
