- 13 May, 2022 1 commit
-
-
Clemens Backes authored
Now that we require C++17 support, we can just use the standard static_assert without message, instead of our STATIC_ASSERT macro. R=leszeks@chromium.org Bug: v8:12425 Change-Id: I1d4e39c310b533bcd3a4af33d027827e6c083afe Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3647353Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Hannes Payer <hpayer@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#80524}
-
- 26 Apr, 2022 1 commit
-
-
Liu Yu authored
The size of flag is now 16 bits. Bug: v8:12161 Change-Id: I5db5e05171281f27cce739c7b76e1d4b9ebf20b9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3602236Reviewed-by: Jakob Linke <jgruber@chromium.org> Commit-Queue: Yu Liu <liuyu@loongson.cn> Cr-Commit-Position: refs/heads/main@{#80165}
-
- 19 Apr, 2022 2 commits
-
-
Tobias Tebbi authored
This reverts commit dec4bb06. Reason for revert: https://ci.chromium.org/p/v8/builders/ci/Linux%20V8%20FYI%20Release%20(NVIDIA) Original change's description: > [turbofan] Support additional operators in SLVerifier > > This CL extends SimplifiedLoweringVerifier by a few additional operators. > > It fixes the missing type on a LoadElement node generated during > js-typed-lowering, that was detected by the verifier. > > Bug: v8:12619 > Change-Id: I14e3ece15f6a90e6906c140696dcd2e6b74a2527 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3557510 > Reviewed-by: Tobias Tebbi <tebbi@chromium.org> > Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> > Cr-Commit-Position: refs/heads/main@{#80014} Bug: v8:12619 Change-Id: I79caa97bba1f29b549d494a747d0f65a85d60315 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3593135 Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/main@{#80029}
-
Nico Hartmann authored
This CL extends SimplifiedLoweringVerifier by a few additional operators. It fixes the missing type on a LoadElement node generated during js-typed-lowering, that was detected by the verifier. Bug: v8:12619 Change-Id: I14e3ece15f6a90e6906c140696dcd2e6b74a2527 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3557510Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#80014}
-
- 27 Jan, 2022 1 commit
-
-
Samuel Groß authored
This type is no longer required: all ExternalPointers are now sandboxified in turbofan, so we use that type instead. Bug: v8:10391 Change-Id: Ia2bd261bfe3cfd5c7d9c350ba0e553e57a596a42 Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3359632Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#78802}
-
- 27 Dec, 2021 1 commit
-
-
Patrick Thier authored
This CL splits the TF type for JSFunction into CallableFunction and ClassConstructor. This differentiation allows us to lower calls to the CallFunction Builtin only for functions that we can actually call. Class Constructors are special, as they are callable but should raise an exception if called. By not lowering class constructors to calls to CallFunction (but the more generall Call) builtin, we can remove the checks for class constructors from CallFunction (in a follow-up CL). Bug: chromium:1262750 Change-Id: I399967eb03b2f20d2dcb67aef2243b32c9d3174e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3350457Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#78445}
-
- 15 Dec, 2021 1 commit
-
-
Samuel Groß authored
This CL renames a number of things related to the V8 sandbox. Mainly, what used to be under V8_HEAP_SANDBOX is now under V8_SANDBOXED_EXTERNAL_POINTERS, while the previous V8 VirtualMemoryCage is now simply the V8 Sandbox: V8_VIRTUAL_MEMORY_CAGE => V8_SANDBOX V8_HEAP_SANDBOX => V8_SANDBOXED_EXTERNAL_POINTERS V8_CAGED_POINTERS => V8_SANDBOXED_POINTERS V8VirtualMemoryCage => Sandbox CagedPointer => SandboxedPointer fake cage => partially reserved sandbox src/security => src/sandbox This naming scheme should simplify things: the sandbox is now the large region of virtual address space inside which V8 mainly operates and which should be considered untrusted. Mechanisms like sandboxed pointers are then used to attempt to prevent escapes from the sandbox (i.e. corruption of memory outside of it). Furthermore, the new naming scheme avoids the confusion with the various other "cages" in V8, in particular, the VirtualMemoryCage class, by dropping that name entirely. Future sandbox features are developed under their own V8_SANDBOX_X flag, and will, once final, be merged into V8_SANDBOX. Current future features are sandboxed external pointers (using the external pointer table), and sandboxed pointers (pointers guaranteed to point into the sandbox, e.g. because they are encoded as offsets). This CL then also introduces a new build flag, v8_enable_sandbox_future, which enables all future features. Bug: v8:10391 Change-Id: I5174ea8f5ab40fb96a04af10853da735ad775c96 Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3322981Reviewed-by: Hannes Payer <hpayer@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#78384}
-
- 02 Dec, 2021 1 commit
-
-
Samuel Groß authored
This CL turns references to ArrayBuffer backing stores from JSArrayBuffers, JSTypedArrays, and JSDataViews into CagedPointers when those are enabled. CagedPointers cannot generally represent nullptr, as NULL usually lies outside the cage. As such, nullptr backing stores are replaced with a special empty backing store value, which, in the current implementation, points to the end of the cage, right in front of the trailing guard regions. Due to this, it is no longer correct to compare a backing store pointer against nullptr. Bug: chromium:1218005 Change-Id: I4a6c7a82aabb4debcb6bb2babe4035ba2da8e79f Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3244419 Commit-Queue: Samuel Groß <saelo@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#78218}
-
- 09 Sep, 2021 1 commit
-
-
Georg Neis authored
It could happen that the information about the feedback vector cached in a JSFunctionData disagreed with the current value of the function's feedback cell. The inlining code wasn't prepared for that and a CHECK could fail. The CL fixes this by removing the caching of has_feedback_vector and feedback_vector and by getting hold of the bytecode array before fetching the feedback vector in inlining. Bug: v8:12172, v8:7790 Change-Id: Ife3ab8872085d9496e6d1f34514114a086f653ad Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3148010 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#76751}
-
- 17 Aug, 2021 1 commit
-
-
Samuel Groß authored
ArrayBuffer backing stores will instead use the virtual memory cage and be referenced through offsets rather than pointers when the sandbox is enabled. This will be implemented in an independent CL. Bug: v8:10391 Change-Id: Icc9781003e53c76dbbf4c84ee165151e4182da4b Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3086458Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/master@{#76348}
-
- 12 Aug, 2021 1 commit
-
-
Ross McIlroy authored
These are no longer enabled, so remove the code mitigation logic from the codebase. BUG=chromium:1003890 Change-Id: I536bb1732e8463281c21da446bbba8f47ede8ebe Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3045704 Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#76256}
-
- 10 May, 2021 1 commit
-
-
Samuel Groß authored
This change turns the previously used XOR-based type checks for external pointers into AND-based type checks. With those, the type tag is ORed into the top bits of an external pointer when it is written, and the type check performed on every load is done by ANDing the value with the inverted tag. This will later allow type checking and masking off the GC marking bits of external pointers in a single operation. Bug: v8:10391 Change-Id: I89f2b22588b3f7467c79c7916c11f25cd9bcc82d Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2850639 Commit-Queue: Samuel Groß <saelo@google.com> Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#74464}
-
- 12 Apr, 2021 1 commit
-
-
Wenyu Zhao authored
This CL adds features to pack/unpack map words. Currently V8 cannot store extra metadata in object headers -- because V8 objects do not have a proper header, but only a map pointer at the start of the object. To store per-object metadata like marking data, a side table is required as the per-object metadata storage. This CL enables V8 to use higher unused bits in a 64-bit map word as per-object metadata storage. Map pointer stores come with an extra step to encode the metadata into the pointer (we call it "map packing"). Map pointer loads will also remove the metadata bits as well (we call it "map packing"). Since the map word is no longer a valid pointer after packing, we also change the tag of the packed map word to make it looks like a Smi. This helps various GC and barrier code to correctly skip them instead of blindly dereferencing this invalid pointer. A ninja flag `v8_enable_map_packing` is provided to turn this map-packing feature on and off. It is disabled by default. * Only works on x64 platform, with `v8_enable_pointer_compression` set to `false` Bug: v8:11624 Change-Id: Ia2bdf79553945e5fc0b0874c87803d2cc733e073 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2247561Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#73915}
-
- 11 Nov, 2020 1 commit
-
-
Igor Sheludko authored
This CL * renames Name::hash_field field to raw_hash_field. * all local variables that store raw_hash_field value are also renamed to raw_hash_field where possible. Bug: chromium:1133527, v8:11074 Change-Id: I17313f386110b33a64f629cc2b9d4afd1e06c6c0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2471999Reviewed-by: Peter Marshall <petermarshall@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#71114}
-
- 28 Oct, 2020 2 commits
-
-
Tobias Tebbi authored
This CL splits the class definitions per .tq file, to realize the following relationship: A class defined in src/objects/foo.tq has a C++ definition in src/objects/foo.h. Torque then generates: - torque-generated/src/objects/foo-tq.inc An include file (no proper header) to be included in src/objects/foo.h containing the Torque-generated C++ class definition. - torque-generated/src/objects/foo-tq-inl.inc An include file (no proper header) to be included in src/objects/foo-inl.h containing inline function definitions. - torque-generated/src/objects/foo-tq.cc A source file including src/objects/foo-inl.h that contains non-inline function definitions. Advantages of this approach: - Avoid big monolithic headers and preserve the work that went into splitting objects.h - Moving a definition to Torque keeps everything in the same place from a C++ viewpoint, including a fully Torque-generated C++ class definition. - The Torque-generated include files do not need to be independent headers, necessary includes or forward declarations can just be added to the headers that include them. Drive-by changes: A bunch of definitions and files had to be moved or created to realize a consistent 1:1 relationship between .tq files and C++ headers. Bug: v8:7793 TBR: hpayer@chromium.org Change-Id: I239a89a16d0bc856a8669d7c92aeafe24a7c7663 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2470571 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Seth Brenith <seth.brenith@microsoft.com> Cr-Commit-Position: refs/heads/master@{#70853}
-
Mythri A authored
This is a reland of d7ece57e with a fix to failures on NumFuzz. Original change's description: > [turboprop] Add a slot for optimization marker in feedback vector > > Optimization marker and the optimized code used to share the same slot > in the feedback vector as they were mutually exclusive. With turboprop > we would want to mark the function for tier up to Turbofan while holding > the optimized code for Turboprop. So this cl uses the existing padding > field to hold the optimization marker instead. > > As a driveby, removes unused JSFunction::ClearOptimizedCodeSlot function > and fixes a minor bug in Runtime_GetOptimizationStatus. > > Bug: v8:9684 > Change-Id: I18c551a69648a0837d16c5453d023c0b295b1521 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2467836 > Commit-Queue: Mythri Alle <mythria@chromium.org> > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> > Cr-Commit-Position: refs/heads/master@{#70789} Bug: v8:9684 Change-Id: Ie6aa3c061a852bb047b5921e4e747d43505568e3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2502871 Commit-Queue: Mythri Alle <mythria@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#70834}
-
- 27 Oct, 2020 2 commits
-
-
Mythri Alle authored
This reverts commit d7ece57e. Reason for revert: failures on NumFuzz https://ci.chromium.org/p/v8/builders/ci/V8%20NumFuzz%20-%20debug/11818? Original change's description: > [turboprop] Add a slot for optimization marker in feedback vector > > Optimization marker and the optimized code used to share the same slot > in the feedback vector as they were mutually exclusive. With turboprop > we would want to mark the function for tier up to Turbofan while holding > the optimized code for Turboprop. So this cl uses the existing padding > field to hold the optimization marker instead. > > As a driveby, removes unused JSFunction::ClearOptimizedCodeSlot function > and fixes a minor bug in Runtime_GetOptimizationStatus. > > Bug: v8:9684 > Change-Id: I18c551a69648a0837d16c5453d023c0b295b1521 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2467836 > Commit-Queue: Mythri Alle <mythria@chromium.org> > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> > Cr-Commit-Position: refs/heads/master@{#70789} TBR=rmcilroy@chromium.org,mythria@chromium.org,jgruber@chromium.org Change-Id: Ia9894fef713a522b9c3d349bef4abcde3e1e1832 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:9684 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2502870Reviewed-by: Mythri Alle <mythria@chromium.org> Commit-Queue: Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#70803}
-
Mythri A authored
Optimization marker and the optimized code used to share the same slot in the feedback vector as they were mutually exclusive. With turboprop we would want to mark the function for tier up to Turbofan while holding the optimized code for Turboprop. So this cl uses the existing padding field to hold the optimization marker instead. As a driveby, removes unused JSFunction::ClearOptimizedCodeSlot function and fixes a minor bug in Runtime_GetOptimizationStatus. Bug: v8:9684 Change-Id: I18c551a69648a0837d16c5453d023c0b295b1521 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2467836 Commit-Queue: Mythri Alle <mythria@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#70789}
-
- 09 Oct, 2020 1 commit
-
-
Samuel Groß authored
This change tags pointers in the external pointer table with a type dependent value in order to prevent type confusions between different external pointers. Bug: v8:10391 Change-Id: I5a83178e5ac46d49a99c91047816926120d801d3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2443133Reviewed-by: Andreas Haas <ahaas@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Samuel Groß <saelo@google.com> Cr-Commit-Position: refs/heads/master@{#70430}
-
- 30 Sep, 2020 1 commit
-
-
Jakob Gruber authored
The invocation count is part of call feedback, and is used during tier-up to determine inlining candidates. For bytecode, it is updated by the InterpreterEntryTrampoline, which can be seen as a global prologue for all bytecode functions. Since NCI tiers up, it must also track the invocation count. This CL adds it to the NCI prologue sequence (emitted as part of every NCI code object). Bug: v8:8888 Change-Id: I04b33c9c8b0bdd975aceb97145f159798e18b97b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436340 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#70221}
-
- 25 Sep, 2020 1 commit
-
-
Tobias Tebbi authored
This is a reland of 64caf2b0 Original change's description: > [torque] refactor: use -tq only in filenames derived from .tq files > > This is to establish a naming rule for Torque-generated files: > - If the file is called foo/bar-tq..., then it is derived from a > file foo/bar.tq > - Otherwise it doesn't belong to a specific .tq file. > > So far, we attached -tq to all Torque-generated file names, where it > sometimes corresponded to a .tq file name and sometimes not. > It is not necessary to add -tq to file names to indicate that they are > Torque-generated, since they are already in a directory called > torque-generated, and we always refer to them as > "torque-generated/filename", so there is no confusion even though some > files now have the same name as a corresponding hand-written file, for > example factory.cc. > > TBR: hpayer@chromium.org > Bug: v8:7793 > Change-Id: Ie172babad1fc7422fd1059c48f5dafaa53e50c8b > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2414218 > Commit-Queue: Tobias Tebbi <tebbi@chromium.org> > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Cr-Commit-Position: refs/heads/master@{#70060} Bug: v8:7793 TBR: hpayer@chromium.org jgruber@chromium.org Change-Id: I6c492bc64aee1ff167e7ef401825eca9097a7f38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2431565 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#70137}
-
- 22 Sep, 2020 2 commits
-
-
Francis McCabe authored
This reverts commit 64caf2b0. Reason for revert: Seems to be causing a failure: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux/38809? Original change's description: > [torque] refactor: use -tq only in filenames derived from .tq files > > This is to establish a naming rule for Torque-generated files: > - If the file is called foo/bar-tq..., then it is derived from a > file foo/bar.tq > - Otherwise it doesn't belong to a specific .tq file. > > So far, we attached -tq to all Torque-generated file names, where it > sometimes corresponded to a .tq file name and sometimes not. > It is not necessary to add -tq to file names to indicate that they are > Torque-generated, since they are already in a directory called > torque-generated, and we always refer to them as > "torque-generated/filename", so there is no confusion even though some > files now have the same name as a corresponding hand-written file, for > example factory.cc. > > TBR: hpayer@chromium.org > Bug: v8:7793 > Change-Id: Ie172babad1fc7422fd1059c48f5dafaa53e50c8b > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2414218 > Commit-Queue: Tobias Tebbi <tebbi@chromium.org> > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Cr-Commit-Position: refs/heads/master@{#70060} TBR=jgruber@chromium.org,tebbi@chromium.org Change-Id: I6960fe540861947536c6ddfc0f4887ea80899fae No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:7793 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2424486Reviewed-by: Francis McCabe <fgm@chromium.org> Commit-Queue: Francis McCabe <fgm@chromium.org> Cr-Commit-Position: refs/heads/master@{#70065}
-
Tobias Tebbi authored
This is to establish a naming rule for Torque-generated files: - If the file is called foo/bar-tq..., then it is derived from a file foo/bar.tq - Otherwise it doesn't belong to a specific .tq file. So far, we attached -tq to all Torque-generated file names, where it sometimes corresponded to a .tq file name and sometimes not. It is not necessary to add -tq to file names to indicate that they are Torque-generated, since they are already in a directory called torque-generated, and we always refer to them as "torque-generated/filename", so there is no confusion even though some files now have the same name as a corresponding hand-written file, for example factory.cc. TBR: hpayer@chromium.org Bug: v8:7793 Change-Id: Ie172babad1fc7422fd1059c48f5dafaa53e50c8b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2414218 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#70060}
-
- 10 Sep, 2020 2 commits
-
-
Jakob Gruber authored
This is the final part of the tier-up commit series. It implements: - A prologue in NCI code objects that checks and acts upon the optimization marker. - Currently, handling is deferred to the InterpreterEntryTrampoline but this will change in the future. - The lifecycle is otherwise like Ignition-to-Turbofan; the runtime profiler marks a function for optimization, the next call to that function triggers optimization by calling into runtime, and the finished code object is installed both on the JSFunction and the optimized code cache. - The feedback vector's kOptimizedCodeWeakOrSmiOffset slot is currently reused for the mid-to-top tier up. Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng Bug: v8:8888 Change-Id: Iff50b05ddcc68b25d7ed0f1e0d20af076a1522a0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2361466Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Mythri Alle <mythria@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#69808}
-
Sathya Gunasekaran authored
The dynamic map checks operator loads the feedback vector and performs map checks against each map and handler entry in the feedback against the incoming map and handler. Instead of emitting code to iterate over this feedback vector at runtime, we unroll this loop at compile time. The generated code is similar to this pseudocode: length = feedback_slot.length if length >= 4: goto labels[3] if length == 3: goto labels[2] if length == 2: goto labels[1] if length == 1: goto labels[0] labels[3]: map = load(feedback_slot, 6) if incoming_map == map goto handler_check(7) goto labels[2] labels[2]: map = load(feedback_slot, 4) if incoming_map == map goto handler_check(5) goto labels[1] labels[1]: map = load(feedback_slot, 2) if incoming_map == map goto handler_check(3) goto labels[0] labels[0]: map = load(feedback_slot, 0) if incoming_map == map goto handler_check(1) bailout handler_check (index): handler = load(feedback_slot, index) if incoming_handler == handler goto done deoptimize Bug: v8:10582, v8:9684 Change-Id: I64d64ff8eda664e4d476bf1b2612e26a344e98a6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339960 Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Reviewed-by: Mythri Alle <mythria@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#69797}
-
- 29 Jul, 2020 1 commit
-
-
Jakob Gruber authored
This is the first step towards implementing a tier-up mechanism from NCI code to TF. We will follow the existing Ignition-to-Turbofan mechanics, which are, roughly: 1. Track a bytecode interrupt budget. 2. When exhausted, call the runtime profiler, which increments profiler ticks for the top frame's function. 3. When a function should tier up, it is marked as such using the FeedbackVector::optimized_code_weak_or_smi slot / the OptimizationMarker mechanism. 4. The InterpreterEntryTrampoline checks this slot and calls into runtime to compile if needed. 5. The finished code is also placed into this slot, as well as installed on the JSFunction. 6. Again, the IET checks the slot and tail-calls the code object if it exists. This CL implements step 1 for NCI code by inserting the new simplified UpdateInterruptBudget operator at the same spots (and using the same offsets) as Ignition. When the budget is exhausted, we call a runtime function that currently does nothing and will be implemented in the next CL. Bug: v8:8888 Change-Id: I98c0f8d96f32d515218dc2a76f961d44fe281c86 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2312778 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#69124}
-
- 20 Jul, 2020 1 commit
-
-
Sathya Gunasekaran authored
This CL introduces a new operator that loads the feedback vector and checks against maps at runtime, rather than embedding the map directly in the generated code. A follow on CL will use this operator when generating code for named property access. Bug: v8:10582, v8:9684 Change-Id: I372a01586d3048427760f0cb27619a59afc3f59e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2241518Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Mythri Alle <mythria@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Cr-Commit-Position: refs/heads/master@{#68930}
-
- 07 Jul, 2020 2 commits
-
-
Jakob Gruber authored
Similar to the feedback vector, we cannot embed the native context as a constant in NCI code (it is trivially native-context-dependent). In NCI mode, load it from the current context. In default turbofan, we keep the HeapConstant. Bug: v8:8888 Change-Id: Iff95c673b25245c701c7755416abf2038b5fdf08 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2282532 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#68712}
-
Jakob Gruber authored
HasProperty and InstanceOf now both have a feedback vector input, and collect feedback in generic lowering. CreateClosure loads the feedback cell (in nci mode) instead of embedding a heap constant. Bug: v8:8888 Change-Id: Id479cda344684aeb5054f687b087c4fedeac05d8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2282530Reviewed-by: Georg Neis <neis@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#68711}
-
- 22 Jun, 2020 1 commit
-
-
Jakob Gruber authored
In native context independent code we cannot embed the (native context dependent) feedback vector as a constant. Instead, we will load it from the JSFunction once and pass it to all users. This CL makes this change for all unary operators. All other {binary,compare} operators will need similar work in the future. Bug: v8:8888 Change-Id: I4d49a6e0effc84dcdf3599814e5c2708b16bcc44 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2246576Reviewed-by: Georg Neis <neis@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#68448}
-
- 25 May, 2020 1 commit
-
-
Daniel Clifford authored
Change-Id: I092c0d70bf517b4c714f5958b188d54030dd9774 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1932838 Commit-Queue: Daniel Clifford <danno@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#67954}
-
- 08 May, 2020 1 commit
-
-
Tobias Tebbi authored
Bug: v8:10391 Change-Id: I0c7e2110227f9c271a3a644d4e921c6b74b68cfd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2152648Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#67669}
-
- 06 May, 2020 1 commit
-
-
Leszek Swirski authored
Bug: v8:10391 Change-Id: I4e86394c53d02eab797c2daad2ccfde6acb83bf0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2151350 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/master@{#67619}
-
- 01 May, 2020 1 commit
-
-
Igor Sheludko authored
Bug: v8:10391 Change-Id: If1db52dc74f9027f06104ce719514b751b4d9504 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2149417 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#67515}
-
- 21 Nov, 2019 1 commit
-
-
Tobias Tebbi authored
This introduces a new keyword "shape" in addition to "class", which allows the definition of a type that extends a JSObject subclass and specifies one or several maps with statically known in-object properties. Differences compared to normal classes: - Shapes are transient since they specify maps instead of instance types. - Shapes have a known size. - Fields of shapes are always in-object properties. In particular, this means that their offset is after kHeaderSize. - It's forbidden to inherited from shapes. - Since shapes usually specify NativeContext-dependent maps, it's not possible to write runtime type-checks for them. Thus this CL avoids mapping them to their own TNode type, as the CAST macro won't work properly. We had runtime-checks for some of them nevertheless, some of them scarily confusing like IsJSSloppyArgumentsObject, that actually just checked the instance type. Drive-by cleanups and simplifications: - Allow subclassing from non-abstract classes and remove @dirtyInstantiatedAbstractClass. This attribute stems from a mis- conception of how instance types work, and with this change it ceases to have semantic influence. - Replace the existing JSArgumentsObject subclasses into two shapes. JSArgumentsObjectWithLength had to be removed since shapes don't support subclassing. - Place kHeaderSize correctly for objects with indexed fields. Design doc: https://docs.google.com/document/d/1zPy2ZYfNFjeEuw6Mz3YJA-GaPGbdcSYam3SrS7ETzRU Bug: v8:8944 Change-Id: Iabf185ccd27d0900e0890539a7fe9eaa8bf2d50e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1917140 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#65108}
-
- 07 Nov, 2019 1 commit
-
-
Santiago Aboy Solanes authored
Since the turbo_decompression_elimination flag is removed, there are several methods in machine-type.h that get simplified, e.g TypeCompressedTaggedPointer() can be replaced by just "TaggedPointer()". Also Removing the creation of Change to/from Compressed nodes. Removing these Change nodes' logic is left to a follow-up CL. Bug: v8:7703 Change-Id: Iff1f9aa8361189cf781a26317fd342b942fd5aa4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1897537 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#64834}
-
- 22 Oct, 2019 3 commits
-
-
Victor Gomes authored
Original change's description: > [runtime] Remove extension slots from context objects > > Context objects have an extension slot, which contains further > additional data that depends on the type of the context. > > This CL removes the extension slot from contexts that don't need > them, hence reducing memory. > > The following contexts will still have an extension slot: native, > module, await, block and with contexts. See objects/contexts.h for > what the slot is used for. > The following contexts will not have an extension slot anymore (they > were not used before): script, catch and builtin contexts. > Eval and function contexts only have the extension slot if they > contain a sloppy eval. > > Bug: v8:9744 > Change-Id: I8ca56c22fa02437bbac392ea72174ebfca80e030 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1863191 > Commit-Queue: Victor Gomes <victorgomes@google.com> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Peter Marshall <petermarshall@chromium.org> > Auto-Submit: Victor Gomes <victorgomes@google.com> > Cr-Commit-Position: refs/heads/master@{#64372} TBR=verwaest@chromium.org,jgruber@chromium.org,ulan@chromium.org,leszeks@chromium.org,petermarshall@chromium.org Bug: v8:9744 Change-Id: I8700ed2fa62c89e86c39bb16ac3167f38ea8d63f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1873695 Commit-Queue: Victor Gomes <victorgomes@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#64477}
-
Clemens Backes authored
This reverts commit 392a1217. Reason for revert: Several failures on mac64 gc stress: https://ci.chromium.org/p/v8/builders/ci/V8%20Mac64%20GC%20Stress/9747 Original change's description: > Reland "Reland "[runtime] Remove extension slots from context objects"" > > This is a reland of c48096d4 > > Original change's description: > > Reland "[runtime] Remove extension slots from context objects" > > > > This is a reland of c07c02e1 > > > > Original change's description: > > > [runtime] Remove extension slots from context objects > > > > > > Context objects have an extension slot, which contains further > > > additional data that depends on the type of the context. > > > > > > This CL removes the extension slot from contexts that don't need > > > them, hence reducing memory. > > > > > > The following contexts will still have an extension slot: native, > > > module, await, block and with contexts. See objects/contexts.h for > > > what the slot is used for. > > > The following contexts will not have an extension slot anymore (they > > > were not used before): script, catch and builtin contexts. > > > Eval and function contexts only have the extension slot if they > > > contain a sloppy eval. > > > > > > Bug: v8:9744 > > > Change-Id: I8ca56c22fa02437bbac392ea72174ebfca80e030 > > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1863191 > > > Commit-Queue: Victor Gomes <victorgomes@google.com> > > > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > > > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > > > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > > > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > > > Reviewed-by: Peter Marshall <petermarshall@chromium.org> > > > Auto-Submit: Victor Gomes <victorgomes@google.com> > > > Cr-Commit-Position: refs/heads/master@{#64372} > > > > TBR=verwaest@chromium.org,jgruber@chromium.org,ulan@chromium.org,leszeks@chromium.org,petermarshall@chromium.org > > > > Bug: v8:9744 > > Change-Id: I0749cc2d8f59940c25841736634a70047116d647 > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1869192 > > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > > Reviewed-by: Peter Marshall <petermarshall@chromium.org> > > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > > Commit-Queue: Peter Marshall <petermarshall@chromium.org> > > Auto-Submit: Victor Gomes <victorgomes@google.com> > > Cr-Commit-Position: refs/heads/master@{#64380} > > TBR=verwaest@chromium.org,jgruber@chromium.org,ulan@chromium.org,leszeks@chromium.org,petermarshall@chromium.org > > Bug: v8:9744 > Change-Id: I621ffe98722f8c4defaf277b8d1666484ba2963f > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1872400 > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Peter Marshall <petermarshall@chromium.org> > Commit-Queue: Victor Gomes <victorgomes@google.com> > Cr-Commit-Position: refs/heads/master@{#64451} TBR=ulan@chromium.org,jgruber@chromium.org,petermarshall@chromium.org,leszeks@chromium.org,verwaest@chromium.org,victorgomes@google.com Change-Id: I99a71180c6a00a87478867a8210ff9ceb46cb3ee No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:9744 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1872405Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#64453}
-
Victor Gomes authored
This is a reland of c48096d4 Original change's description: > Reland "[runtime] Remove extension slots from context objects" > > This is a reland of c07c02e1 > > Original change's description: > > [runtime] Remove extension slots from context objects > > > > Context objects have an extension slot, which contains further > > additional data that depends on the type of the context. > > > > This CL removes the extension slot from contexts that don't need > > them, hence reducing memory. > > > > The following contexts will still have an extension slot: native, > > module, await, block and with contexts. See objects/contexts.h for > > what the slot is used for. > > The following contexts will not have an extension slot anymore (they > > were not used before): script, catch and builtin contexts. > > Eval and function contexts only have the extension slot if they > > contain a sloppy eval. > > > > Bug: v8:9744 > > Change-Id: I8ca56c22fa02437bbac392ea72174ebfca80e030 > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1863191 > > Commit-Queue: Victor Gomes <victorgomes@google.com> > > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > > Reviewed-by: Peter Marshall <petermarshall@chromium.org> > > Auto-Submit: Victor Gomes <victorgomes@google.com> > > Cr-Commit-Position: refs/heads/master@{#64372} > > TBR=verwaest@chromium.org,jgruber@chromium.org,ulan@chromium.org,leszeks@chromium.org,petermarshall@chromium.org > > Bug: v8:9744 > Change-Id: I0749cc2d8f59940c25841736634a70047116d647 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1869192 > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Peter Marshall <petermarshall@chromium.org> > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Commit-Queue: Peter Marshall <petermarshall@chromium.org> > Auto-Submit: Victor Gomes <victorgomes@google.com> > Cr-Commit-Position: refs/heads/master@{#64380} TBR=verwaest@chromium.org,jgruber@chromium.org,ulan@chromium.org,leszeks@chromium.org,petermarshall@chromium.org Bug: v8:9744 Change-Id: I621ffe98722f8c4defaf277b8d1666484ba2963f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1872400Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Peter Marshall <petermarshall@chromium.org> Commit-Queue: Victor Gomes <victorgomes@google.com> Cr-Commit-Position: refs/heads/master@{#64451}
-
- 21 Oct, 2019 1 commit
-
-
Leszek Swirski authored
This reverts commit c48096d4. Reason for revert: Flaky bot failures (https://bugs.chromium.org/p/v8/issues/detail?id=9744#c9) Original change's description: > Reland "[runtime] Remove extension slots from context objects" > > This is a reland of c07c02e1 > > Original change's description: > > [runtime] Remove extension slots from context objects > > > > Context objects have an extension slot, which contains further > > additional data that depends on the type of the context. > > > > This CL removes the extension slot from contexts that don't need > > them, hence reducing memory. > > > > The following contexts will still have an extension slot: native, > > module, await, block and with contexts. See objects/contexts.h for > > what the slot is used for. > > The following contexts will not have an extension slot anymore (they > > were not used before): script, catch and builtin contexts. > > Eval and function contexts only have the extension slot if they > > contain a sloppy eval. > > > > Bug: v8:9744 > > Change-Id: I8ca56c22fa02437bbac392ea72174ebfca80e030 > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1863191 > > Commit-Queue: Victor Gomes <victorgomes@google.com> > > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > > Reviewed-by: Peter Marshall <petermarshall@chromium.org> > > Auto-Submit: Victor Gomes <victorgomes@google.com> > > Cr-Commit-Position: refs/heads/master@{#64372} > > TBR=verwaest@chromium.org,jgruber@chromium.org,ulan@chromium.org,leszeks@chromium.org,petermarshall@chromium.org > > Bug: v8:9744 > Change-Id: I0749cc2d8f59940c25841736634a70047116d647 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1869192 > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Peter Marshall <petermarshall@chromium.org> > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Commit-Queue: Peter Marshall <petermarshall@chromium.org> > Auto-Submit: Victor Gomes <victorgomes@google.com> > Cr-Commit-Position: refs/heads/master@{#64380} TBR=ulan@chromium.org,jgruber@chromium.org,petermarshall@chromium.org,leszeks@chromium.org,verwaest@chromium.org,victorgomes@google.com # Not skipping CQ checks because original CL landed > 1 day ago. Bug: v8:9744 Change-Id: Ia58067b41f1eb5880a52b36ead754d7190ff7f6f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1871922Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#64424}
-