- 07 Jan, 2022 3 commits
-
-
Clemens Backes authored
Spilling was already fixed if a fixed SIMD register overlaps with an allocated FP register, but the other way around was missing: If an odd FP register (in this case d1) is used as a fixed output register, but this register is in use as the upper half of a SIMD register (in this case q0), we did not detect this and would just use overwrite the SIMD half. This CL also fixes this case. R=thibaudm@chromium.org Bug: v8:12330, chromium:1284980 Change-Id: Id3f98b7accd77e38ab4cd5ff8910aaf5ad96a1ed Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3372910Reviewed-by:
Thibaud Michaud <thibaudm@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#78514}
-
Shu-yu Guo authored
This is a reland of c7c5b492 Changes since revert: - Save position instead of using PushBack - Allow private-name-surrogate-pair to fail on no_i18n builds Original change's description: > [scanner] Combine surrogate pairs at start when scanning private names > > Bug: v8:12523 > Change-Id: Ic3779fe6f20965d177d99d0a570a735df72e4fde > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3366994 > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Commit-Queue: Shu-yu Guo <syg@chromium.org> > Cr-Commit-Position: refs/heads/main@{#78493} Bug: v8:12523 Change-Id: I8a92953549f5b38bfa004488db42bf9d835e1222 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3368361Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#78513}
-
Victor Costan authored
https://crrev.com/c/3297708 changed the serialization format for typed arrays without bumping the format version. As a consequence, builds that include that CL fail to deserialize typed arrays serialized by previous V8 versions. This CL reverts the serialization format change, and does minimal test changes to reflect the revert. https://crbug.com/v8/12532 tracks serializing typed array flags in a backwards-compatible manner. Bug: chromium:1284506 Change-Id: Ib32e88c6383e0ad4ad1a9ff63f413a1eb123b1ef Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3370408Reviewed-by:
Adam Klein <adamk@chromium.org> Reviewed-by:
Shu-yu Guo <syg@chromium.org> Commit-Queue: Victor Costan <pwnall@chromium.org> Cr-Commit-Position: refs/heads/main@{#78507}
-
- 05 Jan, 2022 5 commits
-
-
Frank Tang authored
https://chromium.googlesource.com/external/github.com/tc39/test262/+log/04cd6da0..6c9b4de Bug: v8:7834 Change-Id: I29159c3421ad81ec86544ac9682c76abc73c6703 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3367376Reviewed-by:
Shu-yu Guo <syg@chromium.org> Commit-Queue: Frank Tang <ftang@chromium.org> Cr-Commit-Position: refs/heads/main@{#78503}
-
Manos Koukoutos authored
We implement loop peeling for wasm, currently available behind a flag. Loops are peeled regardless of size. Bug: v8:11510 Change-Id: Ia4c883abdee83df632b2611584d608c44e3295c8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3367615Reviewed-by:
Andreas Haas <ahaas@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#78496}
-
Leszek Swirski authored
This reverts commit c7c5b492. Reason for revert: Looks like test needs to be disabled for noi18n: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20noi18n%20-%20debug/40832/overview Original change's description: > [scanner] Combine surrogate pairs at start when scanning private names > > Bug: v8:12523 > Change-Id: Ic3779fe6f20965d177d99d0a570a735df72e4fde > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3366994 > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Commit-Queue: Shu-yu Guo <syg@chromium.org> > Cr-Commit-Position: refs/heads/main@{#78493} Bug: v8:12523 Change-Id: I678d69a7acb793ed03ce049a05c37685d0cdee1a No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3368106 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#78495}
-
Shu-yu Guo authored
Bug: v8:12523 Change-Id: Ic3779fe6f20965d177d99d0a570a735df72e4fde Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3366994Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#78493}
-
Benedikt Meurer authored
The V8InspectorSessionImpl constructor accepts a state, as either text or CBOR encoded, and generally ignores all invalid inputs, except for the case where it's a valid value, but not a dictionary value, in which case it'll leak the value and crash upon casting to a `DictionaryValue`. This is purely an issue with the test driver, so no security impact on Chromium in the wild. Fixed: chromium:1281031 Change-Id: I7b4d0aea83370499b1274d3fa214a14dc098d2f2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3361838 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Auto-Submit: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/main@{#78490}
-
- 04 Jan, 2022 5 commits
-
-
Clemens Backes authored
If a fixed register is defined for an input, we did only spill the sibling SIMD register if the other sibling was allocated. This is not correct. If only the sibling is in use (e.g. s1 colliding with q0) we also have to spill that sibling. R=mslekova@chromium.org Bug: chromium:1283042, v8:12330 Change-Id: I6a22eaf461774a0b4603ec3ff17062134a528161 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3359615Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#78483}
-
Clemens Backes authored
The mid-tier register allocator did not handle block merges correctly where a SIMD register was partially overlapping with a non-SIMD register. This CL fixes that, and reorders the code to allow for early exits. R=mslekova@chromium.org Bug: chromium:1282224, v8:12330 Change-Id: I2e9275d5c1aaa764ecb63fbf8fa197b68d6b6c3c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3358294Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#78482}
-
Benedikt Meurer authored
This change fixes the implementation of the previously introduced API `Runtime.setMaxCallStackSizeToCapture` to work correctly and also apply (consistently) to stack traces captured by V8 when exceptions are thrown. It does so in a fully backwards compatible manner. This change thus makes the previous fix for catapult (which landed in http://crrev.com/c/3347789) effective, and therefore ensures that real world performance benchmarks aren't affected by the use of the `Runtime` domain in the catapult test framework. Note this is basically a reland of crrev.com/c/3361839, but without touching the stack traces for console messages (which led to the regressions in crbug/1283516, crbug/1283523, etc.). Fixed: chromium:1280831 Bug: chromium:1283162, chromium:1278650, chromium:1258599 Bug: chromium:1280803, chromium:1280832, chromium:1280818 Doc: https://bit.ly/v8-cheaper-inspector-stack-traces Change-Id: I3dcec7b75d76ca267fac8bd6fcb2cda60d5e60dd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3364086Reviewed-by:
Yang Guo <yangguo@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Auto-Submit: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/main@{#78479}
-
Manos Koukoutos authored
We unify the implementation of element segment expression entries with other initializer expressions: we represent them with a {WireBytesRef} and decode them with {InitExprInterface}. Except for reducing code duplication, this also fixes a bug where {global.get} entries in element segments could reference invalid globals. Changes: - Change {WasmElemSegment::Entry} to a union of a {WireBytesRef} initializer expression and a {uint32_t} function index. - In module-decoder, change parsing of expression entries to use {consume_init_expr}. Add type checking to {consume_element_func_index}, to complement type checking happening in {consume_init_expr}. - In module-instantiate.cc: - Move instantiation of indirect tables before loading of element segments. This way, when we call {UpdateDispatchTables} in {SetTableEntry}, the indirect table for the current table will also be updated. - Consolidate table entry instantiation into {SetTableEntry}, which handles lazily instantiated functions, or dispatches to {WasmTableObject::Set}. - Rename {InitializeIndirectFunctionTables} to {InitializeNonDefaultableTables}. - Change {InitializeNonDefaultableTables} and {LoadElemSegmentImpl} to use {EvaluateInitExpression}. - Add a test to exclude mutable/non-imported globals from the element section. - Update tests as needed. - Update .js module emission in wasm-fuzzer-common. Change-Id: I29c541bbca8531e8d0312ed95869c8e78a5a0c57 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3364082Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#78476}
-
Manos Koukoutos authored
See related CL for context. Changes: - In InitExprInterface, add the ability to evaluate function references as index only. Remove the global buffers and use the ones passed with the instance object instead. - In WasmElemSegment, add a field indicating if elements should be parsed as expressions or indices. Change module-decoder.cc to reflect this change. - In module-instantiate, change the signatures of LoadElemSegment, LoadElemSegmentImpl, and EvaluateInitExpr. Move the latter out of InstanceBuilder. Change-Id: I1df54393b2005fba49380654bdd40429bd4869dd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3364081Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#78470}
-
- 03 Jan, 2022 1 commit
-
-
Benedikt Meurer authored
This reverts commit 34f73cc7. Reason for revert: Performance regressions throughout a lot of system health and browsing benchmarks. Original change's description: > [inspector] Fix `Runtime.setMaxCallStackSizeToCapture`. > > This change fixes the implementation of the previously introduced API > `Runtime.setMaxCallStackSizeToCapture` to work correctly and also apply > (consistently) to stack traces captured by V8 when exceptions are > thrown. It does so in a fully backwards compatible manner. > > This change thus makes the previous fix for catapult (which landed in > http://crrev.com/c/3347789) effective, and therefore ensures that real > world performance benchmarks aren't affected by the use of the `Runtime` > domain in the catapult test framework. > > Bug: chromium:1283162, chromium:1278650, chromium:1258599 > Bug: chromium:1280803, chromium:1280832, chromium:1280818 > Fixed: chromium:1280831 > Doc: https://bit.ly/v8-cheaper-inspector-stack-traces > Change-Id: I4ec951a858317fa49096cd4023deb0104d92c9c9 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3361839 > Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> > Auto-Submit: Benedikt Meurer <bmeurer@chromium.org> > Reviewed-by: Yang Guo <yangguo@chromium.org> > Cr-Commit-Position: refs/heads/main@{#78458} Bug: chromium:1283162, chromium:1278650, chromium:1258599 Bug: chromium:1280803, chromium:1280832, chromium:1280818 Bug: chromium:1280831 Change-Id: Id1efaffa2f7f08c47f833f68b8a297494edee21e Fixed: chromium:1283751, chromium:1283749, chromium:1283746 Fixed: chromium:1283729, chromium:1283700, chromium:1283700 Fixed: chromium:1283691, chromium:1283687, chromium:1283678 Fixed: chromium:1283677, chromium:1283676, chromium:1283675 Fixed: chromium:1283674, chromium:1283618, chromium:1283536 Fixed: chromium:1283523, chromium:1283516 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3364078 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Auto-Submit: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Reviewed-by:
Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/main@{#78462}
-
- 31 Dec, 2021 1 commit
-
-
Benedikt Meurer authored
This change fixes the implementation of the previously introduced API `Runtime.setMaxCallStackSizeToCapture` to work correctly and also apply (consistently) to stack traces captured by V8 when exceptions are thrown. It does so in a fully backwards compatible manner. This change thus makes the previous fix for catapult (which landed in http://crrev.com/c/3347789) effective, and therefore ensures that real world performance benchmarks aren't affected by the use of the `Runtime` domain in the catapult test framework. Bug: chromium:1283162, chromium:1278650, chromium:1258599 Bug: chromium:1280803, chromium:1280832, chromium:1280818 Fixed: chromium:1280831 Doc: https://bit.ly/v8-cheaper-inspector-stack-traces Change-Id: I4ec951a858317fa49096cd4023deb0104d92c9c9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3361839 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Auto-Submit: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/main@{#78458}
-
- 29 Dec, 2021 1 commit
-
-
Benedikt Meurer authored
Previously the `Debugger.CallFrame`s in `Debugger.paused` events would report locations relative to the surrounding document in case of inline scripts with `//@ sourceURL` annotations (while `Runtime.CallFrame` was already fixed previously as part of crrev.com/c/3069289). With this CL the locations in `Debugger.CallFrame` are also appropriately adjusted. Drive-by-fix: Several inspector tests were (incorrectly) relying on this wrong treatment, and were also unnecessarily using //# sourceURL annotations. So part of this CL also addresses that problem and makes the tests more robust, using addInlineScript() helper. Fixed: chromium:1283049 Bug: chromium:1183990, chromium:578269 Change-Id: I6e3b215d951c3453c0a9cfc9bccf3dc3d5e92fd6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3359619 Auto-Submit: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Commit-Queue: Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/main@{#78450}
-
- 27 Dec, 2021 3 commits
-
-
Omer Katz authored
Included in this CL: (*) Introduce CppMarkingState that V8 should use to push references to Oilpan. CppMarkingState allocates its own Worklist::Locals to support concurrent updates from V8. (*) Split Oilpan MarkingWorklist object to form a base class used by CppMarkingState. (*) Remove MarkerFactory and split marking initialization. Marking worklists should already be initialized when V8 initializes visitors. For incremental marking, this requires splitting marking initialization and marking start. (*) Drive-by: Mark JSObject::IsApiWrapper and JSObject::IsDroppableApiWrapper as const. Bug: v8:12407 Change-Id: I35cc816343da86f69a68306204675720e9b3913f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3293410Reviewed-by:
Dominik Inführ <dinfuehr@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#78446}
-
Patrick Thier authored
This CL splits the TF type for JSFunction into CallableFunction and ClassConstructor. This differentiation allows us to lower calls to the CallFunction Builtin only for functions that we can actually call. Class Constructors are special, as they are callable but should raise an exception if called. By not lowering class constructors to calls to CallFunction (but the more generall Call) builtin, we can remove the checks for class constructors from CallFunction (in a follow-up CL). Bug: chromium:1262750 Change-Id: I399967eb03b2f20d2dcb67aef2243b32c9d3174e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3350457Reviewed-by:
Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#78445}
-
Yujie Wang authored
- Add I8x16_Popcnt for WASM SIMD - Add vcpop_m and vfirst_m for riscv64 simulator Bug: v8:11976 Change-Id: I2b945bb947da0998663cac86f867f09d386b81a4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3356201Reviewed-by:
Yahan Lu <yahan@iscas.ac.cn> Commit-Queue: Yahan Lu <yahan@iscas.ac.cn> Cr-Commit-Position: refs/heads/main@{#78444}
-
- 24 Dec, 2021 1 commit
-
-
Zhao Jiazhong authored
Change-Id: Ie08574da9b2192aa250e2cbc0efaf049c6e9026a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3354670Reviewed-by:
Yu Liu <liuyu@loongson.cn> Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn> Cr-Commit-Position: refs/heads/main@{#78439}
-
- 23 Dec, 2021 2 commits
-
-
Lu Yahan authored
Change-Id: I7e61221775a616943886cdb369eb9bbe5e110a32 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3347499Reviewed-by:
ji qiu <qiuji@iscas.ac.cn> Commit-Queue: ji qiu <qiuji@iscas.ac.cn> Cr-Commit-Position: refs/heads/main@{#78436}
-
Lu Yahan authored
Change-Id: Ice5b9a09d4c4c1a8013cf5c0993c4ec6111f6c51 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3353070Reviewed-by:
ji qiu <qiuji@iscas.ac.cn> Commit-Queue: ji qiu <qiuji@iscas.ac.cn> Cr-Commit-Position: refs/heads/main@{#78435}
-
- 22 Dec, 2021 5 commits
-
-
Milad Fa authored
Wasm values are stored in memory in little endian order even on BE machines and as a result they need to be manually reversed after a load. Other such atomic ops get patched during Wasm compilation or during code-gen, this is one of the few places where a runtime call is made to C++ which requires this fix. As the the runtime stub is used on both TurboFan and Liftoff this patch will fix both cases. Up until now the cctest was passing incorrectly as it's mixing the Wasm memory buffer with TypedArrays. TypedArrays don't have the LE enforcement and use the native byte order. With this patch the test is now failing as expected and is being skipped for now. Bug: v8:12505 Change-Id: I49fac208f1fab7396b7d9911e803bc047b3b8263 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3350744Reviewed-by:
Andreas Haas <ahaas@chromium.org> Reviewed-by:
Shu-yu Guo <syg@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Commit-Queue: Milad Farazmand <mfarazma@redhat.com> Cr-Commit-Position: refs/heads/main@{#78433}
-
Benedikt Meurer authored
This updates the following set of console builtins in V8 to match the Console Standard (https://console.spec.whatwg.org) with respect to (potentially side effecting) type conversions: - console.debug - console.error - console.info - console.log - console.trace - console.warn - console.group - console.groupCollapsed - console.assert The V8 implementation only performs the type conversions and updates the arguments in-place with the results from the %String% constructor, %parseInt%, or %parseFloat% invocations. The actual formatting is still left completely to the debugger front-end. To give a concrete example, the following code ```js const msgFmt = { toString() { return 'Message %i' } }; console.log('LOG: %s`, msgFmt, 42); ``` sends the following parameters to the debugger front-end ```js ["LOG: %s", "Message %i", 42] ``` and it's then the job of the front-end to perform the actual string substitutions. It's also worth calling out that the console builtins are only concerned with %s, %f, %d, and %i formatting specifiers, since these are the only ones that trigger type conversions, and %o, %O, and %c can only be implemented in a meaningful way at a higher level. Fixed: chromium:1277944 Bug: chromium:1282076 Doc: https://bit.ly/v8-proper-console-type-conversions Spec: https://console.spec.whatwg.org Change-Id: I0996680811aa96236bd0d879e4a11101629ef1a7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3352118Reviewed-by:
Kim-Anh Tran <kimanh@chromium.org> Auto-Submit: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#78432}
-
Shu-yu Guo authored
Private method loads are compiled to a named load of a private brand, which always loads a BlockContext. This BlockContext holds the private methods common to all instances of a class. TurboFan currently considers JSLoadNamed to be of Type::NonInternal(). Private methods break this assumption, since BlockContext is of Type::OtherInternal(). This CL changes the typing of JSLoadNamed of private brands to be Type::OtherInternal(). Bug: v8:12500 Change-Id: I91f39747bf9422bd419d299f44152f567d8be8db Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3351167Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#78431}
-
JianxiaoLuIntel authored
Design doc: https://docs.google.com/document/d/1rxM3sDd-ZiOLznqw7MvYraulAPWJSVqC_CztO4YpUTQ/edit Change-Id: I471ff31f32b7bdd22cb03005c1dcc18aa485ad77 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3313793 Auto-Submit: Jianxiao Lu <jianxiao.lu@intel.com> Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Commit-Queue: Shiyu Zhang <shiyu.zhang@intel.com> Cr-Commit-Position: refs/heads/main@{#78428}
-
Lu Yahan authored
This commit allows using unaligned load/store, which is more efficient for 2 bytes,4 bytes and 8 bytes memory access. Use RISCV_HAS_NO_UNALIGNED to control whether enable the fast path or not. Change-Id: I1d321e6e5fa5bc31541c8dbfe582881d80743483 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3329803Reviewed-by:
ji qiu <qiuji@iscas.ac.cn> Commit-Queue: Yahan Lu <yahan@iscas.ac.cn> Cr-Commit-Position: refs/heads/main@{#78427}
-
- 21 Dec, 2021 1 commit
-
-
Lu Yahan authored
Port b36368d2 Change-Id: Icac5b041f2af423b2b81eab53bfc56644ca29374 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3347228Reviewed-by:
ji qiu <qiuji@iscas.ac.cn> Commit-Queue: ji qiu <qiuji@iscas.ac.cn> Cr-Commit-Position: refs/heads/main@{#78422}
-
- 20 Dec, 2021 5 commits
-
-
Clemens Backes authored
Shared array buffers are not tracked by the garbage collector, which makes the fuzzer run out of memory pretty quickly. Since shared memory is not needed any more for testing atomics, we can just make the memory non-shared again. This also improves the performance of the fuzzer (execs/s) by more than 2x locally. R=ahaas@chromium.org Bug: chromium:1281419 Change-Id: Ic7803617d6a14aaa698d9181327ec20b21d29faa Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3350764Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#78418}
-
Clemens Backes authored
Without simple FP aliasing, a SIMD register will overlap with two floating-point registers. If we spill an FP register to use it for a SIMD operation, we need to make sure to also spill the "sibling" FP register. R=leszeks@chromium.org Bug: v8:12330, chromium:1271244 Change-Id: I7fdc6cb8da35d66b4862a8a913ba4ff906cf05aa Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3347576Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#78414}
-
Clemens Backes authored
Initialize the (thread-local) memory protection key permissions for any isolate that joins the wasm engine. Otherwise it can happen that an isolate gets Wasm code from the cache without ever compiling anything (hence without ever changing memory protection key permissions), and then it would not be allowed to access (read or execute) the code. I tested this change manually on a PKU-enabled devices. The new test crashed before the fix, and completes successfully afterwards. R=ahaas@chromium.org Bug: v8:11974, chromium:1280451 Change-Id: I90dded8b4fdaa8cf34b44107291d3f525ce16335 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3347563Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#78413}
-
Clemens Backes authored
After https://crrev.com/c/3315446 we allocate the memory protection key unconditionally, so the method is redundant. R=ahaas@chromium.org Bug: v8:11974 Change-Id: I205a0cda86dfaf394c68788a662241d76a3f8510 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3347562Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#78412}
-
Clemens Backes authored
The mid-tier register allocator could not handle the case that the same virtual register was used for - the input corresponding to the 'same-as-input' output, and - another 'unique register' input. In this case, it cannot choose the already assigned register for the 'unique' register. Instead, it needs to allocate a new register and introduce a gap move to duplicate the input value in two different registers. FYI, the instruction where the current logic failed was: (v5(0), v6(R)) = IA32AddPair v7(R) v7(*) v8(R) v7(R) (where the last input was marked 'unique'). R=leszeks@chromium.org CC=thibaudm@chromium.org Bug: v8:12330, chromium:1272204 Change-Id: Ie4843aa9f5e027afe503e0481a4acdfa325dfe0e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3347821Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#78411}
-
- 17 Dec, 2021 1 commit
-
-
Lu Yahan authored
Change-Id: If9619a796865b402361f521c0529e8452a9a3078 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3343862Reviewed-by:
ji qiu <qiuji@iscas.ac.cn> Commit-Queue: ji qiu <qiuji@iscas.ac.cn> Cr-Commit-Position: refs/heads/main@{#78403}
-
- 16 Dec, 2021 6 commits
-
-
Deepti Gandluri authored
Change-Id: Idb14cbc5caf0bf17e0a1538ed116e41cf9180d42 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3345760Reviewed-by:
Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#78401}
-
Clemens Backes authored
A SIMD register can "block" more than one FP register. In that case, no virtual register will be assigned for one of the FP registers. This is fine, we just need to detect and handle that case correctly. R=thibaudm@chromium.org CC=leszeks@chromium.org Bug: chromium:1271538, v8:12330 Change-Id: I7ec19229445c5ace0782f63945acb89322816540 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3293082Reviewed-by:
Thibaud Michaud <thibaudm@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#78400}
-
Igor Sheludko authored
This CL * removes Builtins::codet() and Builtins::codet_handle() returning builtins as CodeT objects in favor of code() and code_handle(), * removes BUILTIN_CODET macro in favor of BUILTIN_CODE, * removes CodeDataContainer table. Bug: v8:11880 Change-Id: Ic868549030744b0ff3ea5d5edbfcacf77c6de96d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3344650Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#78399}
-
Leszek Swirski authored
We don't need this with reversed arguments. Change-Id: I86c5183bccc62ba1727080ebbd685df083608d2f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3344947 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/main@{#78396}
-
Manos Koukoutos authored
We switch the order of inlining and loop unrolling optimizations. This gives small improvements to wasm-gc benchmarks. Changes: - Change the loop analysis algorithm to accept loops directly connected to the graph's end. This is required because some nodes in an inlined function, such as tail calls, might be directly connected to the outer function's end without an intervening LoopExit node. - Based on the above, skip emitting loop exits for some Throw nodes in WasmGraphBuildingInterface. - Introduce WasmInliningPhase, add it before loop unrolling. Remove inlining from WasmOptimizationPhase. - Handle graph terminators in loop unrolling. - Add loops in the inlined function to the callers loop_infos. Drive-by: - Allow more wasm builtins in unrolled loops. - Reduce inlining parameters to reflect that functions are now slightly smaller during inlining, as no unrolling has taken place yet. Bug: v8:12166 Change-Id: Iadd6b2f75170aa153ca1efb47fbb0d185c2b8371 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3329783Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#78394}
-
Igor Sheludko authored
... in order to avoid Code <-> CodeT conversions in builtins. This CL changes the meaning of RelocInfo::CODE_TARGET which now expects CodeT objects as a code target. In order to reduce code churn this CL makes BUILTIN_CODE and friends return CodeT instead of Code. In the follow-up CLs BUILTIN_CODET and friends will be removed. Bug: v8:11880 Change-Id: Ib8f60973e55c60fc62ba84707471da388f8201b4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3338483Reviewed-by:
Patrick Thier <pthier@chromium.org> Reviewed-by:
Nico Hartmann <nicohartmann@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#78393}
-