- 16 Jan, 2018 1 commit
-
-
Ben L. Titzer authored
The WebAssembly JS API specification [1] covers the JS-visible side-effects of executing a grow_memory operation and states that a successful grow operation should always detach any prior array buffer. [1] https://github.com/WebAssembly/spec/blob/master/document/js-api/index.bs R=mstarzinger@chromium.org,gdeepti@chromium.org Bug: Change-Id: Ib9232e01209ba546c0bba1c9408c92da60ff6d92 Reviewed-on: https://chromium-review.googlesource.com/860011Reviewed-by:
Deepti Gandluri <gdeepti@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Commit-Queue: Ben Titzer <titzer@chromium.org> Cr-Commit-Position: refs/heads/master@{#50627}
-
- 11 Jan, 2018 1 commit
-
-
Ben L. Titzer authored
This CL centralizes constants related to decoding from several places into one place and makes it no longer necessary to include wasm-opcodes.h for some simple constants. R=clemensh@chromium.org Bug: Change-Id: I53aa81e34167df467bc7455b717bf67083033943 Reviewed-on: https://chromium-review.googlesource.com/859764 Commit-Queue: Ben Titzer <titzer@chromium.org> Reviewed-by:
Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#50503}
-
- 09 Jan, 2018 1 commit
-
-
Ben L. Titzer authored
Combined with existing masking, provides protection against speculative OOB accesses. R=clemensh@chromium.org Bug: chromium:798964 Change-Id: Ib7cdc8bccc6d22b8b45896c63f69cb647deba383 Reviewed-on: https://chromium-review.googlesource.com/856980 Commit-Queue: Ben Titzer <titzer@chromium.org> Reviewed-by:
Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#50448}
-
- 08 Jan, 2018 1 commit
-
-
Eric Holk authored
This is a reland of 9c79b37a Original change's description: > [wasm] use allocation tracker to track reserved address space > > This is a step towards falling back on bounds checks when there are too many > guarded Wasm memories. > > Bug: v8:7143 > Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng > Change-Id: I01916cbdd5ddb08fe1d946ab83b801f37a8fe1c6 > Reviewed-on: https://chromium-review.googlesource.com/832944 > Commit-Queue: Eric Holk <eholk@chromium.org> > Reviewed-by: Bill Budge <bbudge@chromium.org> > Cr-Commit-Position: refs/heads/master@{#50390} Bug: v8:7143 Change-Id: Iaf0d22d300a3f2da22649552a17162dcf7bc608b Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Reviewed-on: https://chromium-review.googlesource.com/853142Reviewed-by:
Bill Budge <bbudge@chromium.org> Commit-Queue: Eric Holk <eholk@chromium.org> Cr-Commit-Position: refs/heads/master@{#50418}
-
- 06 Jan, 2018 1 commit
-
-
Bill Budge authored
This reverts commit 9c79b37a. Reason for revert: breaks TSAN https://logs.chromium.org/v/?s=chromium%2Fbb%2Fclient.v8%2FV8_Linux64_TSAN%2F18959%2F%2B%2Frecipes%2Fsteps%2FCheck%2F0%2Flogs%2Finstance-gc%2F0 Original change's description: > [wasm] use allocation tracker to track reserved address space > > This is a step towards falling back on bounds checks when there are too many > guarded Wasm memories. > > Bug: v8:7143 > Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng > Change-Id: I01916cbdd5ddb08fe1d946ab83b801f37a8fe1c6 > Reviewed-on: https://chromium-review.googlesource.com/832944 > Commit-Queue: Eric Holk <eholk@chromium.org> > Reviewed-by: Bill Budge <bbudge@chromium.org> > Cr-Commit-Position: refs/heads/master@{#50390} TBR=bbudge@chromium.org,gdeepti@chromium.org,eholk@chromium.org,eholk@google.com Change-Id: I207b9466377ba50be17794e71407b0ebc8eb88e2 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:7143 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Reviewed-on: https://chromium-review.googlesource.com/853140Reviewed-by:
Bill Budge <bbudge@chromium.org> Commit-Queue: Bill Budge <bbudge@chromium.org> Cr-Commit-Position: refs/heads/master@{#50392}
-
- 05 Jan, 2018 1 commit
-
-
Eric Holk authored
This is a step towards falling back on bounds checks when there are too many guarded Wasm memories. Bug: v8:7143 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: I01916cbdd5ddb08fe1d946ab83b801f37a8fe1c6 Reviewed-on: https://chromium-review.googlesource.com/832944 Commit-Queue: Eric Holk <eholk@chromium.org> Reviewed-by:
Bill Budge <bbudge@chromium.org> Cr-Commit-Position: refs/heads/master@{#50390}
-
- 21 Dec, 2017 1 commit
-
-
Brad Nelson authored
R=eholk@chromium.org,mlippautz@chromium.org B=https://bugs.chromium.org/p/chromium/issues/detail?id=775047 Change-Id: Ia3b2f51d6cb4dabbf0f1f9ec78ecb8935775f53a Reviewed-on: https://chromium-review.googlesource.com/809165 Commit-Queue: Brad Nelson <bradnelson@chromium.org> Commit-Queue: Eric Holk <eholk@chromium.org> Reviewed-by:
Eric Holk <eholk@chromium.org> Cr-Commit-Position: refs/heads/master@{#50254}
-
- 15 Dec, 2017 1 commit
-
-
Bill Budge authored
- Creates a memory management API in v8::internal, which corresponds to the existing one in base::OS. - Implements the new API in terms of the old one. - Changes all usage of the base::OS API to the one in v8::internal. This includes all tests, except platform and OS tests. - Makes OS:: methods private. - Moves all LSAN calls into the v8::internal functions. Bug: chromium:756050 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng Change-Id: Iaa3f022e3e12fdebf937f3c76b6c6455014beb8a Reviewed-on: https://chromium-review.googlesource.com/794856 Commit-Queue: Bill Budge <bbudge@chromium.org> Reviewed-by:
Eric Holk <eholk@chromium.org> Reviewed-by:
Hannes Payer <hpayer@chromium.org> Cr-Commit-Position: refs/heads/master@{#50139}
-
- 03 Nov, 2017 1 commit
-
-
Bill Budge authored
- Sanitize Windows page size / alignment code. - Reorder some methods to match header file. - Rename AllocateAlignment to AllocatePageSize to be consistent with CommitPageSize. - Eliminate OS::Allocate overload with is_executable argument. - Eliminate base::OS::AllocateGuarded - it's not implemented. Bug: chromium:756050 Change-Id: I046bb019cddde0c0063d617adc2c94a23989d9d1 Reviewed-on: https://chromium-review.googlesource.com/742684 Commit-Queue: Bill Budge <bbudge@chromium.org> Reviewed-by:
Bill Budge <bbudge@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/master@{#49114}
-
- 23 Oct, 2017 1 commit
-
-
Deepti Gandluri authored
If the buffer associated with WebAssembly.Memory is used as memory for asm.js modules, throw a range error on Memory.Grow. Bug: chromium:776677 Change-Id: Iebcd7797fa7724002dd8073d1dbaeb98f080d316 Reviewed-on: https://chromium-review.googlesource.com/731844 Commit-Queue: Deepti Gandluri <gdeepti@chromium.org> Reviewed-by:
Brad Nelson <bradnelson@chromium.org> Reviewed-by:
Ben Titzer <titzer@chromium.org> Cr-Commit-Position: refs/heads/master@{#48837}
-
- 10 Oct, 2017 1 commit
-
-
Eric Holk authored
This flag was originally added as a staging mechanism to let us land and test guard regions without the full trap handler feature landing. Additionally, we thought we might enable guard regions without trap handlers on some systems. Trap handlers are now supported, and there's not a real compelling reason for why we need guard regions without trap handlers. Keeping the separate flag leads to confusion, since some code treats guard regions and trap handlers the same, while other code treats them as independent. Removing this flag and its associated special cases makes everything more uniform and predictable. R=gdeepti@chromium.org Change-Id: Icebab91d1f1e0c55e7a35c75b880085d37fa14ae Reviewed-on: https://chromium-review.googlesource.com/706570Reviewed-by:
Deepti Gandluri <gdeepti@chromium.org> Reviewed-by:
Mircea Trofin <mtrofin@chromium.org> Commit-Queue: Eric Holk <eholk@chromium.org> Cr-Commit-Position: refs/heads/master@{#48411}
-
- 04 Oct, 2017 2 commits
-
-
Eric Holk authored
This reverts commit 5e76ff5a. Reason for revert: tsan failures - https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/17574 Original change's description: > Reland "[wasm] always allocate memory when guard regions are needed" > > This reverts commit 7cf29d8d. > > Original change's description: > > [wasm] always allocate memory when guard regions are needed > > > > When using trap handlers, memory references do not get any checks inserted. This > > means there is no check for a null memory as happens when the memory size is > > 0. Normally this would be correctly caught as an out of bounds access, since the > > low memory addresses are not normally mapped. However, if they were mapped for > > some reason, we would not catch the out of bounds access. > > > > The fix is to ensure WebAssembly instances always have a guard region even if > > the memory is size 0. > > > > Bug: chromium:769637 > > Change-Id: I09fdaea92b7ccb3a6cc9e28392171ec098538a00 > Reviewed-on: https://chromium-review.googlesource.com/695812 > Commit-Queue: Eric Holk <eholk@chromium.org> > Reviewed-by: Clemens Hammacher <clemensh@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Cr-Commit-Position: refs/heads/master@{#48293} TBR=gdeepti@chromium.org,mtrofin@chromium.org,mlippautz@chromium.org,eholk@chromium.org,eholk@google.com,clemensh@chromium.org Change-Id: I52d5354126158a92602b08c48703d562ac95075b No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/699599Reviewed-by:
Eric Holk <eholk@chromium.org> Commit-Queue: Eric Holk <eholk@chromium.org> Cr-Commit-Position: refs/heads/master@{#48294}
-
Eric Holk (eholk) authored
This reverts commit 7cf29d8d. Original change's description: > [wasm] always allocate memory when guard regions are needed > > When using trap handlers, memory references do not get any checks inserted. This > means there is no check for a null memory as happens when the memory size is > 0. Normally this would be correctly caught as an out of bounds access, since the > low memory addresses are not normally mapped. However, if they were mapped for > some reason, we would not catch the out of bounds access. > > The fix is to ensure WebAssembly instances always have a guard region even if > the memory is size 0. > > Bug: chromium:769637 Change-Id: I09fdaea92b7ccb3a6cc9e28392171ec098538a00 Reviewed-on: https://chromium-review.googlesource.com/695812 Commit-Queue: Eric Holk <eholk@chromium.org> Reviewed-by:
Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/master@{#48293}
-
- 02 Oct, 2017 1 commit
-
-
Ben L. Titzer authored
R=gdeepti@chromium.org Bug: Change-Id: Ic2e519d24354b3327a92daa0d4d6e06c9ca4605e Reviewed-on: https://chromium-review.googlesource.com/687056 Commit-Queue: Ben Titzer <titzer@chromium.org> Reviewed-by:
Deepti Gandluri <gdeepti@chromium.org> Reviewed-by:
Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#48256}
-