- 19 May, 2021 11 commits
-
-
Manos Koukoutos authored
This reverts commit 4a037f87. Reason for revert: Bot failures, including MSVC compilation. Original change's description: > [wasm][bug] Fix a couple of bugs in validation of unreachable code > > Changes: > - SetBlockType now instantiates the block's start merge with values of > the correct type in unreachable code. > - EnsureStackArguments now keeps the existing stack values and moves > them over the new bottom values. > - Drop stack size validation in Drop(). > - Add new tests in unreachable-validation.js. > > Change-Id: Ie68b3d9abb0a41d1623d4a123fb526e71941c4e7 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2902733 > Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> > Cr-Commit-Position: refs/heads/master@{#74650} Change-Id: Icb16af9a8ed16e593fe345ab727b992d9c9b1500 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2905597 Auto-Submit: Manos Koukoutos <manoskouk@chromium.org> Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#74657}
-
Marja Hölttä authored
The logic is different for shared and non-shared memory, so it's cleaner to have different functions for them. Bug: v8:11111 Change-Id: I95d43b54c207b8059ea59d6d0f873623de946be3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2903152 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by:
Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/master@{#74656}
-
Dominik Inführ authored
Our synchronization protocol for top and limit only guarantees that we read the new limit in case we read the new top. However, it could happen that we read the old top but the new limit. In the allocation slow path we reset both top and limit to 0 first and then reset it to the free list allocation boundaries. With --no-inline-new we are changing top/limit a lot, so it could happen that we read the old value for top (0) but a regular address for limit. In such cases large parts of the heap would be incorrectly considered pending. Handle these cases here by checking that top is non-zero. This is temporary fix, we believe that it is at least theoretically possible to read non-0 but non-consistent values for top/limit as well. This will be addressed in a subsequent CL. Bug: v8:11778 Change-Id: I6b581f2a6df3f24c16443717b0cde9a18c5f3f40 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2903155 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#74655}
-
Jakob Gruber authored
The BytecodeArray itself was fetched by using a barrier so all reads from the constant pool are safe. Bug: v8:7790 Change-Id: If924d43a10c7aa20b69225fab8219e7bd988419c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2903149 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#74654}
-
Jakob Gruber authored
Using kAssumeMemoryFence works around the fact that the graph stores handles (and not refs). The assumption is that any handle inserted into the graph is safe to read; but we don't preserve the reason why it is safe to read. Thus we must over-approximate here and assume the existence of a memory fence. Note this is only valid if all spots that insert handles into the graph ensure that the handle can safely be read. In the future, we should consider having the graph store ObjectRefs or ObjectData pointer instead, which would make new ref construction here unnecessary. Bug: v8:7790,chromium:1209798 Change-Id: Ic22340ea9f34a24be530a3c62c8309d25e108f3f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2902742Reviewed-by:
-
Manos Koukoutos authored
Bug: v8:7748 Change-Id: I7894ad51ccf8ac41a5081c272a583a4ff25c1835 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2900225 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#74652}
-
Jakob Gruber authored
Bug: v8:11771 Tbr: machenbach@chromium.org Change-Id: Ib0e64e84c930c791023d8743fe0b0373ab626071 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2904216Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#74651}
-
Manos Koukoutos authored
Changes: - SetBlockType now instantiates the block's start merge with values of the correct type in unreachable code. - EnsureStackArguments now keeps the existing stack values and moves them over the new bottom values. - Drop stack size validation in Drop(). - Add new tests in unreachable-validation.js. Change-Id: Ie68b3d9abb0a41d1623d4a123fb526e71941c4e7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2902733 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by:
-
Manos Koukoutos authored
We used to verify its index as if it was a function index. Bug: chromium:1210447 Change-Id: I5e015b1b11b22b6b7e7e13dac4945f8eb6f3d846 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2903153Reviewed-by:
-
Dan Elphick authored
Since debug-interface.h and isolate.h only uses v8_inspector::V8Inspector as a pointer type, this removes the #includes and forward declares the type. Bug: v8:11384 Change-Id: Ia361fc3a028a9abf5ee42ecb3b2575bc84a81e35 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2903159 Auto-Submit: Dan Elphick <delphick@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/30196c5..4036cf1 Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/a68a003..c1e1d55 Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/1fc595b..6b0a611 Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/298d9e6..5b8d433 Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/701e2be..a38f01b Rolling v8/tools/luci-go: git_revision:bbac8f199026d706b08e53ca46d1a9560ae580d2..git_revision:22d464e2f8f3bd2bd33f69fe819326d63f881008 Rolling v8/tools/luci-go: git_revision:bbac8f199026d706b08e53ca46d1a9560ae580d2..git_revision:22d464e2f8f3bd2bd33f69fe819326d63f881008 Rolling v8/tools/luci-go: git_revision:bbac8f199026d706b08e53ca46d1a9560ae580d2..git_revision:22d464e2f8f3bd2bd33f69fe819326d63f881008 TBR=v8-waterfall-sheriff@grotations.appspotmail.com Change-Id: Id08b26af423f65f67a64289c03a5e2eba5c6bfa4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2904925Reviewed-by:
v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#74647}
-
- 18 May, 2021 29 commits
-
-
Michael Lippautz authored
Marking holds the process wide mutex for synchronizing CrossThread* references. In addition, marking may also create temporary copies of Member references for concurrent tracing (snapshot). Provide HeapRegistry with its own mutex to avoid a deadlock with Member checking during marking. Bug: chromium:1056170 Change-Id: I31d922ec1a476942e29d8d4fa7d864a015f428cc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2904211 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Auto-Submit: Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/master@{#74646}
-
Milad Fa authored
Change-Id: I8ecf009aa560144f572bd954a1aa8bde8732ffa1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2904267Reviewed-by:
Junliang Yan <junyan@redhat.com> Commit-Queue: Milad Fa <mfarazma@redhat.com> Cr-Commit-Position: refs/heads/master@{#74645}
-
Marja Hölttä authored
Drive-by fix: The file name for WATCHLISTS in the OWNERS file rule was wrong, so fixing that too so that it's possible to modify WATCHLISTS without eng reviewers approval in the future. Change-Id: I0e24c5d459aab2bb346aca64125eabe0ceac8274 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2903154Reviewed-by:
Hannes Payer <hpayer@chromium.org> Reviewed-by:
Patrick Thier <pthier@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/master@{#74644}
-
Paolo Severini authored
In order to support Fast API calls with overloads, store a FixedArray of c-function addresses and a FixedArray of the corresponding FunctionInfo*. For now keep using only the first function in the array. Bug: v8:11739 Change-Id: If23381aa9d04c5cd830043951da9c53836a36328 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2876592Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Paolo Severini <paolosev@microsoft.com> Cr-Commit-Position: refs/heads/master@{#74643}
-
Milad Fa authored
Using `thread_local` on AIX causes the following error during linking: ``` ld: 0711-317 ERROR: Undefined symbol: TLS init function for ... ``` To avoid the issue we can use the __thread keyword. More on this gcc bug: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100641 Bug: v8:11755 Change-Id: Ic9738e8dfb7110b550328c5d9929f4453e545b0b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2903586Reviewed-by:
Clemens Backes <clemensb@chromium.org> Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Milad Fa <mfarazma@redhat.com> Cr-Commit-Position: refs/heads/master@{#74642}
-
Thibaud Michaud authored
This was only relevant for the br_on_exn instruction, which doesn't exist anymore. R=clemensb@chromium.org Change-Id: I03f85a316a8265ad1c5e1c15862d7ae98b784977 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2902734Reviewed-by:
-
Ross McIlroy authored
The early/late graph trimming phases remove dead nodes from the graph, however these dead nodes don't have significant impact on the quality of the codegen or the performance of the rest of the pipeline. BUG=v8:9684 Change-Id: I1e797b520accc19ea59f2a430433e5b489c10e47 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2897889Reviewed-by:
-
Jakob Gruber authored
The test relies on deterministic GC behavior. Bug: v8:11771 Change-Id: I4c04f683ca51e0849e11736c97a2f2342977cc36 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2902735 Auto-Submit: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Reviewed-by:
-
Jakob Gruber authored
This is the second reland of 4683d6fe Initial CL: crrev.com/c/2874663 First reland: crrev.com/c/2886861 The first reland fixes Ref construction failures in: - MapRef::instance_descriptors - NativeContext reads (see also crrev.com/c/2891575) The second reland (this CL): - Adds required infrastructure (e.g. kAssumeMemoryFence) but without enabling the IsPendingAllocation check. Enabling the check will be done separately to avoid further revert chains. Original change's description: > [compiler] Consider IsPendingAllocation in Ref construction > > The logic in JSHeapBroker::TryGetOrCreateData assumes that parts > of the object are safe to read. In particular, the instance type > must be readable for the chain of `Is##Name()` type checks. > > This is guaranteed if > > - a global memory fence happened after object initialization and > prior to the read by the compiler; or > - the object was published through a release store and read through > an acquire read. > > The former is protected by the new call to ObjectMayBeUninitialized > (which internally calls IsPendingAllocation) in TryGetOrCreateData. > > The latter must be marked explicitly by calling the new > MakeRefAssumeMemoryFence variant. > > Note that support in this CL is expected to be incomplete and will > have to be extended in the future as more cases show up in which > MakeRef calls must be converted to MakeRefAssumeMemoryFence or to > TryMakeRef. > > Bug: v8:7790,v8:11711 > Change-Id: Ic2f7d9fc46e4bfc3f6bbe42816f73fc5ec174337 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2874663 > Commit-Queue: Jakob Gruber <jgruber@chromium.org> > Reviewed-by: Georg Neis <neis@chromium.org> > Cr-Commit-Position: refs/heads/master@{#74474} Bug: v8:7790,v8:11711,chromium:1207680,chromium:1207679 Change-Id: I123b2962df724a13dd2c7334ae949234bc3bf27a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2902738Reviewed-by:
-
Patrick Thier authored
We compile with Sparkplug when we allocate the feedback vector with lazy feedback vector allocation. With --no-lazy-feedback-allocation, it doesn't make sense to run baseline tests. Change-Id: Ib71e8624531ba927680e83c2e813c0886c460da4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2903148 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Patrick Thier <pthier@chromium.org> Reviewed-by:
-
Michael Achenbach authored
No-try: true Bug: v8:11784 Change-Id: I7d40cbead84d27a7783d3e05eeedcc8ea7597bc0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2903151 Commit-Queue: Michael Achenbach <machenbach@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Auto-Submit: Michael Achenbach <machenbach@chromium.org> Reviewed-by:
-
Patrick Thier authored
Different runs of the correctness fuzzer might flush the bytecode of the function passed to d8.test.verifySourcePositions, resulting in spurious errors. Therefore don't expose verifySourcePositions for correctness fuzzing. Bug: chromium:1209242 Change-Id: I0395afcd5a5e109779d7b79d9f6939899eaaf99c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2903144 Commit-Queue: Camillo Bruni <cbruni@chromium.org> Auto-Submit: Patrick Thier <pthier@chromium.org> Reviewed-by:
-
Georg Neis authored
The cycle mentioned in the comment has disappeared but we still need to set the native context Ref twice, once when the broker mode is kDisabled, and once when it's kSerializing (the earlier Ref is invalid by that time). Bug: v8:7790 Change-Id: I5778814a20c2706ca088557176aaa9ccfc3a39df Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2902741 Commit-Queue: Georg Neis <neis@chromium.org> Auto-Submit: Georg Neis <neis@chromium.org> Reviewed-by:
-
Dan Elphick authored
This header file is not used by the torque compiler but by the torque-generated headers. (Fixes 1 gn check error currently suppressed due to gn check exclusions). Bug: v8:7330 Change-Id: I23c05bac814c1e9c373dadcb3f69ea76ff7c2358 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2902737 Auto-Submit: Dan Elphick <delphick@chromium.org> Commit-Queue: Dan Elphick <delphick@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
-
Michael Achenbach authored
No-Tree-Checks: true Bug: v8:11784 Change-Id: I5dc72339fa7d72022cdfaad028297f572df2e907 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2902739 Commit-Queue: Michael Achenbach <machenbach@chromium.org> Auto-Submit: Michael Achenbach <machenbach@chromium.org> Reviewed-by:
Sathya Gunasekaran <gsathya@chromium.org> Cr-Commit-Position: refs/heads/master@{#74632}
-
Philip Pfaffe authored
Side-Effect-free debug evaluate is available through the CDP Runtime domain as well, besides the Debugger domain, and does not require debugging to be active. Change-Id: I84af194af65cbac311d208e35af7338cb675eb36 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2902729 Commit-Queue: Philip Pfaffe <pfaffe@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Auto-Submit: Philip Pfaffe <pfaffe@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#74631}
-
Michael Lippautz authored
The marking verifier already traverses the whole heap using page iteration. Add an option to allow checking that the verifier pass finds the same amount of live bytes as the marker traversal. Bug: chromium:1056170 Change-Id: I1dc4cd0c04147b8cd3e3eb7678276b665336e615 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2902724 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
-
Michael Lippautz authored
Conceptually, Oilpan uses tri-color marking even though the implementatin only uses a single mark bit. The difference between gray and black is represented by the fact that an objet is contained within a worklist. Live bytes are accounted on gray->black transition and must only happen once. This is generally implemented when retrieving an object from the work list and processing it. For weak containers this CL fixes the following issues: 1. Weak containers that are strongified during stack scanning were double accounted as they were just added to the marking worklist. Instead, directly process them during stack scanning. 2. Accounting was missing in case of purely weak collections without ephemeron tracing. In such a case, the backing store would not be added to a worklist and be considered as black immediately. The fix is to directly account the marked bytes in such a scenario. Bug: chromium:1056170 Change-Id: I350ae1b90ad1753d024a3ce33fc3ec3126a2095d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2900661Reviewed-by:
-
Santiago Aboy Solanes authored
Most of the Map's fields are being read directly from the heap so there's no need to serialize them with concurrent inlining on. As an extra step, read NextFreePropertyIndex directly. Bug: v8:7790 Change-Id: Ia0c46a3bbb673f9fdea9b4700908f00a43c28e28 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2892665 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by:
-
Sathya Gunasekaran authored
This reverts commit 2c096b53. Reason for revert: speculative revert for https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20no-concurrent-marking/3838/overview Original change's description: > [codegen] Add TSAN support for tagged stores in generated code > > Mimics the kArchStoreWithWriteBarrier store in generated code by having > a relaxed store to the same address, with the same value. This is done > in order for TSAN to see these stores from generated code. > > Since it is done only for kArchStoreWithWriteBarrier TSAN will see > tagged stores only. > > Bug: v8:7790, v8:11600 > > Change-Id: I275dd46f5556b3a095c416adc03f2f0ac5bde41c > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2848470 > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> > Reviewed-by: Georg Neis <neis@chromium.org> > Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> > Cr-Commit-Position: refs/heads/master@{#74568} Bug: v8:7790 Bug: v8:11600 Change-Id: Ib0c7917af2b4ba43b81a8afebd687324cd78b228 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2902930 Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Cr-Commit-Position: refs/heads/master@{#74627}
-
Lu Yahan authored
Bug: v8:11767 Change-Id: Ie697921bf9d4247d1032015bddcbcc892223efdf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2902341Reviewed-by:
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/c81ea93..30196c5 Rolling v8/third_party/aemu-linux-x64: WNXEl7yxDUmMN9Rkovz3EfBwNd26BEXmanIIz_jO2DgC..-Sz2gSN_5yVSHDlitjxUlmZpHuz-F2kFDW6TnmggCZoC Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/a532699..a68a003 Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/cd15203..1fc595b Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/5ce08a7..298d9e6 Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/f6e0cbe..701e2be TBR=v8-waterfall-sheriff@grotations.appspotmail.com Change-Id: Ib55178cdcd99a94e5e38f552c990e38118fafe9d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2901251Reviewed-by:
-
Ross McIlroy authored
Reverts part of the change https://chromium-review.googlesource.com/c/v8/v8/+/2892664 to avoid using bitfields for Truncation since it causes older versions of gcc to report a warning. BUG=v8:9684 Change-Id: Ia807d6dbbb5ae1baae73bf5816c336b9b80ae83d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2900660 Auto-Submit: Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
Lu Yahan authored
Change-Id: I0fb3a4738c8e9b4b4328b8a1e142eefed61ec998 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2881494 Commit-Queue: Yahan Lu <yahan@iscas.ac.cn> Reviewed-by:
Brice Dobry <brice.dobry@futurewei.com> Reviewed-by:
-
Sathya Gunasekaran authored
This reverts commit 50cbeca9. Reason for revert: speculative revert for https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20no-concurrent-marking/3824/overview Original change's description: > [codegen] Use builtin calls for TSANRelaxedStore > > Instead of calling the C function directly from codegen, we call a > builtin that calls the C function. This is done to encapsulate the > push/pop registers in the code in the builtin. > > Bug: v8:7790, v8:11600 > Change-Id: I4c77a80803d4eb44526b716901afe0e8ccbe077d > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2892663 > Reviewed-by: Georg Neis <neis@chromium.org> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> > Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> > Cr-Commit-Position: refs/heads/master@{#74599} Bug: v8:7790 Bug: v8:11600 Change-Id: I3a4c57a29346fe6c84ec11404d8ff64cfac51a70 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2902926 Auto-Submit: Sathya Gunasekaran <gsathya@chromium.org> Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#74622}
-
Sathya Gunasekaran authored
This reverts commit 4683d6fe. Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN/36744/overview Original change's description: > Reland "[compiler] Consider IsPendingAllocation in Ref construction" > > This is a reland of 5f0ac36c > > Fixes Ref construction failures in: > - MapRef::instance_descriptors > - NativeContext reads (see also crrev.com/c/2891575) > > Original change's description: > > [compiler] Consider IsPendingAllocation in Ref construction > > > > The logic in JSHeapBroker::TryGetOrCreateData assumes that parts > > of the object are safe to read. In particular, the instance type > > must be readable for the chain of `Is##Name()` type checks. > > > > This is guaranteed if > > > > - a global memory fence happened after object initialization and > > prior to the read by the compiler; or > > - the object was published through a release store and read through > > an acquire read. > > > > The former is protected by the new call to ObjectMayBeUninitialized > > (which internally calls IsPendingAllocation) in TryGetOrCreateData. > > > > The latter must be marked explicitly by calling the new > > MakeRefAssumeMemoryFence variant. > > > > Note that support in this CL is expected to be incomplete and will > > have to be extended in the future as more cases show up in which > > MakeRef calls must be converted to MakeRefAssumeMemoryFence or to > > TryMakeRef. > > > > Bug: v8:7790,v8:11711 > > Change-Id: Ic2f7d9fc46e4bfc3f6bbe42816f73fc5ec174337 > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2874663 > > Commit-Queue: Jakob Gruber <jgruber@chromium.org> > > Reviewed-by: Georg Neis <neis@chromium.org> > > Cr-Commit-Position: refs/heads/master@{#74474} > > Bug: v8:7790,v8:11711,chromium:1207680,chromium:1207679 > Change-Id: Ib3dbf59909e6982a3230dd6a67c9fb7d6ffb9ab4 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2886861 > Reviewed-by: Georg Neis <neis@chromium.org> > Commit-Queue: Jakob Gruber <jgruber@chromium.org> > Cr-Commit-Position: refs/heads/master@{#74587} Bug: v8:7790 Bug: v8:11711 Bug: chromium:1207680 Bug: chromium:1207679 Change-Id: I8cd45ac006b7b5f3d668d0df272bcba880c75926 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2901990Reviewed-by:
-
Sathya Gunasekaran authored
This reverts commit 0a661a9a. Reason for revert: 4683d6fe broke TSAN, reverting all its dependencies first (including this) https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN/36744/overview Original change's description: > Revert "[compiler] Temporarily change ContextRef back to kSerialized" > > This reverts commit 445f0f74. > > Reason for revert: TryMakeRef is again ready for this. > > Original change's description: > > [compiler] Temporarily change ContextRef back to kSerialized > > > > This can be reverted once TryMakeRef checks the heap predicate. > > I'm not reverting the previous CL because newer changes already depend > > on it. > > > > Tbr: jgruber@chromium.org > > Bug: v8:11765, v8:7790 > > Change-Id: Iacc6a78a70fe6f40c9421258889c2175fb400b04 > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891579 > > Reviewed-by: Georg Neis <neis@chromium.org> > > Commit-Queue: Georg Neis <neis@chromium.org> > > Auto-Submit: Georg Neis <neis@chromium.org> > > Cr-Commit-Position: refs/heads/master@{#74531} > > Bug: v8:11765 > Bug: v8:7790 > Change-Id: I0b38791255182f1f8d0a5cf79f18d86568172487 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2897101 > Commit-Queue: Georg Neis <neis@chromium.org> > Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> > Commit-Queue: Jakob Gruber <jgruber@chromium.org> > Auto-Submit: Georg Neis <neis@chromium.org> > Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Cr-Commit-Position: refs/heads/master@{#74591} Bug: v8:11765 Bug: v8:7790 Change-Id: I462b9b098781101549ebd6c185697d4b235c2888 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2901989 Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Reviewed-by:
-
Shu-yu Guo authored
Bug: v8:11719 Change-Id: Ib9064e09a77b03adc1234e2f1739983cdab24113 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2898778 Commit-Queue: Shu-yu Guo <syg@chromium.org> Reviewed-by:
Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/master@{#74619}
-
Sathya Gunasekaran authored
This reverts commit 59bb4325. Reason for revert: 4683d6fe broke TSAN, reverting all its dependencies first (including this) https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN/36744/overview Original change's description: > [compiler] Remove one ObjectRef constructor > > Remove the handle-taking ObjectRef constructor in favor of > (Try)MakeRef as bottleneck. > > Bug: v8:7790 > Change-Id: I3cc3a1dcef4bac53a91c573d1a532332b88c6eb4 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2883664 > Commit-Queue: Georg Neis <neis@chromium.org> > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Cr-Commit-Position: refs/heads/master@{#74593} Bug: v8:7790 Change-Id: Ifdecf93a3a8c09a3da7118a269fc66c2ae0f1a09 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2901988Reviewed-by:
-
