- 17 Feb, 2022 1 commit
-
-
Camillo Bruni authored
Avoiding handles in tight loops and setup code improves performance and reduces code size. This CL also makes more non-allocating mode more explicit by adding more DisallowGarbageCollection scopes. Change-Id: I95b5b1a29204c27a23c42ccd67fff150b3fa4a3e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3460740Reviewed-by:
Igor Sheludko <ishell@chromium.org> Commit-Queue: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/main@{#79142}
-
- 14 Feb, 2022 1 commit
-
-
Victor Gomes authored
This is a reland of c927ada7 Fix: Recalculate encoding after an allocation (that can potentially trigger GC) in EnsureHasFullTransitionArray. Original change's description: > [runtime] Refactor TransitionsAccessor > > Problems: > - The class uses a bare Map field, but some methods can trigger GC > causing it to have a potential dangling pointer in case of map > compaction. > - Some methods invalidate the object state and should not be used again. > - Complicate logic with a no_gc and a gc aware constructors. Some > methods can only be called if the object is constructed with a > particular constructor (e.g, Insert and PutPrototypeTransition). > > Note: Most usages of this class is done by constructing an object and > calling a single method: > `TransitionAccessor(...).Method(...)` > So we can easily change them to a static method. > > This CL: > 1. Adds DISALLOW_GARBAGE_COLLECTION to the class. > 2. Makes methods that can trigger GC static. > 3. Creates static helper functions that wrap the class in a different > scope, since TransitionsAccessor now forces the scope to disallow gc. > 4. Removes now unnecessary "Reload" logic. > > Bug: chromium:1295133, v8:12578 > Change-Id: I85484e7235fbd5e69894e26f5e1c491c6f69635e > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3450416 > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Commit-Queue: Victor Gomes <victorgomes@chromium.org> > Cr-Commit-Position: refs/heads/main@{#79051} Bug: chromium:1295133, v8:12578 Change-Id: If3880c2480433b78567870c8d14508d6ad9eccbd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3460405Reviewed-by:
Dominik Inführ <dinfuehr@chromium.org> Auto-Submit: Victor Gomes <victorgomes@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#79069}
-
- 11 Feb, 2022 2 commits
-
-
Deepti Gandluri authored
This reverts commit c927ada7. Reason for revert: GC stress failures: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20gc%20stress/37276/overview Original change's description: > [runtime] Refactor TransitionsAccessor > > Problems: > - The class uses a bare Map field, but some methods can trigger GC > causing it to have a potential dangling pointer in case of map > compaction. > - Some methods invalidate the object state and should not be used again. > - Complicate logic with a no_gc and a gc aware constructors. Some > methods can only be called if the object is constructed with a > particular constructor (e.g, Insert and PutPrototypeTransition). > > Note: Most usages of this class is done by constructing an object and > calling a single method: > `TransitionAccessor(...).Method(...)` > So we can easily change them to a static method. > > This CL: > 1. Adds DISALLOW_GARBAGE_COLLECTION to the class. > 2. Makes methods that can trigger GC static. > 3. Creates static helper functions that wrap the class in a different > scope, since TransitionsAccessor now forces the scope to disallow gc. > 4. Removes now unnecessary "Reload" logic. > > Bug: chromium:1295133, v8:12578 > Change-Id: I85484e7235fbd5e69894e26f5e1c491c6f69635e > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3450416 > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Commit-Queue: Victor Gomes <victorgomes@chromium.org> > Cr-Commit-Position: refs/heads/main@{#79051} Bug: chromium:1295133, v8:12578 Change-Id: Ia567cdcae73bc7fdfaf08b62eeeb899d6a933e21 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3456682 Auto-Submit: Deepti Gandluri <gdeepti@chromium.org> Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Owners-Override: Deepti Gandluri <gdeepti@chromium.org> Cr-Commit-Position: refs/heads/main@{#79052}
-
Victor Gomes authored
Problems: - The class uses a bare Map field, but some methods can trigger GC causing it to have a potential dangling pointer in case of map compaction. - Some methods invalidate the object state and should not be used again. - Complicate logic with a no_gc and a gc aware constructors. Some methods can only be called if the object is constructed with a particular constructor (e.g, Insert and PutPrototypeTransition). Note: Most usages of this class is done by constructing an object and calling a single method: `TransitionAccessor(...).Method(...)` So we can easily change them to a static method. This CL: 1. Adds DISALLOW_GARBAGE_COLLECTION to the class. 2. Makes methods that can trigger GC static. 3. Creates static helper functions that wrap the class in a different scope, since TransitionsAccessor now forces the scope to disallow gc. 4. Removes now unnecessary "Reload" logic. Bug: chromium:1295133, v8:12578 Change-Id: I85484e7235fbd5e69894e26f5e1c491c6f69635e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3450416Reviewed-by:
Dominik Inführ <dinfuehr@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Commit-Queue: Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/main@{#79051}
-
- 13 Jan, 2022 1 commit
-
-
Jakob Gruber authored
CompleteInobjectSlackTracking potentially shrinks multiple maps, and the relation between these maps should be preserved in a concurrent environment. Thus it is not enough to make each modification atomically, but all related map modifications must be within a critical section. We do this by locking the map_updater_access mutex CompleteInobjectSlackTracking, and hence moving the function to the MapUpdater class. Bug: chromium:1274445,v8:7990 Change-Id: If99bb8b55e03180128ee397d845fa4c269c4241e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3379819Reviewed-by:
Igor Sheludko <ishell@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#78597}
-
- 24 Nov, 2021 1 commit
-
-
Manos Koukoutos authored
Design doc: bit.ly/3jEVgzz We separate the internal representation of function references in Wasm from their JSFunction-based (external) representation. This improves performance of call_ref by requiring less indirections to load the context and call target from a function reference. In the boundary between wasm and JS/the C API, we add transformations between the two representations. Detailed changes: - Introduce WasmInternalFunction, containing fields required by call_ref, as well as a reference to the corresponding WasmExternalFunction. Add a reference to the WasmInternalFunction in WasmFunctionData. The {WasmInternalFunction::FromExternal} helper extracts the internal out of an external function. - Change {WasmInstanceObject::external_functions()} to internal functions. - Change wasm function tables to contain internal functions. - Change the following code to use internal functions: - call_ref in liftoff and Turbofan - function type checks in liftoff and Turbofan - CallRefIC and GenericJSToWasmWrapper builtins - {InitExprInterface::RefFunc} - module-compiler.cc in {ProcessTypeFeedback} - In module-instantiate.cc, in function-rtt creation. - Add transformations between internal and external functions in: - WasmWrapperGraphBuilder::{ToJS, BuildUnpackObjectWrapper, FromJS, BuildJSToJSWrapper}. - debug-wasm-objects.cc in {FunctionProxy::Get}, {WasmValueObject::New} and {AddWasmTableObjectInternalProperties}. - runtime-wasm.cc in ReplaceWrapper - the C and JS APIs - module-instantiate.cc, in import and export processing, as well as {InitializeIndirectFunctionTables} - WasmTableObject::{IsValidElement, SetFunctionTableEntry} - {WasmGlobalObject::SetFuncRef} - Simplify body descriptors of WasmExternalFunction variants. - Adjust tests. Bug: v8:11510 Change-Id: I8377f46f55c3771391ae1c5c8201a83854ee7878 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277878Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#78068}
-
- 18 Nov, 2021 1 commit
-
-
Jakob Gruber authored
Prior to this CL we regularly generated high counts of code dependencies, and installation was not the most efficient. This CL 1) implements early dependency deduplication and 2) simplifies the way dependencies are persisted on the heap through DependentCode. Re 1): we dedupe twice, once based on the CompilationDependency contents, and again once we know the final target object. Re 2): Instead of a linked list of weak fixed arrays per dependency group, store deps in a flat array together with a bitset of their dependency groups. See also: https://docs.google.com/document/d/1B34S1s3Iv6hbquZ93RugD0b-ZKfHEptJ8Fk_YyOvjDk/edit Bug: v8:12195,v8:12397 Change-Id: I9ab47f6d87b10558194b5de30a36b1122f7e362a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3283074Reviewed-by:
Dominik Inführ <dinfuehr@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#77969}
-
- 15 Nov, 2021 1 commit
-
-
Ng Zhi An authored
Bug: v8:12244,v8:12245 Change-Id: I3029cfb8e9afdcb5e53aa406359aa7246c23ea40 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3274021Reviewed-by:
Maya Lekova <mslekova@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Dominik Inführ <dinfuehr@chromium.org> Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Commit-Queue: Zhi An Ng <zhin@chromium.org> Cr-Commit-Position: refs/heads/main@{#77906}
-
- 28 Sep, 2021 1 commit
-
-
Ng Zhi An authored
Bug: v8:12244 Change-Id: I7ea68dd74a376221631d7f56b4a012207f68a1ec Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3182899Reviewed-by:
Hannes Payer <hpayer@chromium.org> Commit-Queue: Zhi An Ng <zhin@chromium.org> Cr-Commit-Position: refs/heads/main@{#77129}
-
- 16 Sep, 2021 1 commit
-
-
Georg Neis authored
... by adding atomic (relaxed) accessor's for a map's constructor_or_backpointer field, and using them in the two functions. Bug: chromium:1250216, v8:7790 Change-Id: I3416799cca73792ff5f8963685274ad9afdc6229 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162129Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/main@{#76876}
-
- 19 Aug, 2021 1 commit
-
-
Jakob Kummerow authored
It must be possible to determine an object's size on the heap without relying on the presence of any other objects. Specifically, if an object and its WasmTypeInfo die at the same time, they can be swept in any order, and the sweeper may need to know their sizes. This patch solves the problem by repurposing two bytes in the Map, where WasmStructs can store their instance size, and WasmArrays can store their element size (which can be used to compute their size). Fixed: chromium:1240670 Change-Id: Ib960fd0a409936aff1aef4daafed4c38b8497880 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3106649 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#76391}
-
- 12 Aug, 2021 1 commit
-
-
Jakob Gruber authored
The concurrent version was added recently in crrev.com/c/3085262. - UnusedPropertyFields requires the MapUpdater lock. - instance_descriptors must be read atomically on the bg thread. Finally, there appears to be a false positive report for the pattern: x = is_concurrent ? foo(kAcquireLoad) : foo(); Here, clang emits code that executes both the atomic and nonatomic reads when is_concurrent is true. Needs more investigation. Bug: v8:7790, chromium:1239009 Change-Id: I07d442e72cf0278f79f202a267e8d246f8abca1b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3090341 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Auto-Submit: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Santiago Aboy Solanes <solanes@chromium.org> Cr-Commit-Position: refs/heads/master@{#76261}
-
- 11 Aug, 2021 1 commit
-
-
Jakob Gruber authored
Re-enable the creation of elements transition groups in JSHeapBroker::ProcessFeedbackMapsForElementAccess. This turned out to be quite important for performance. Bug: v8:7790,v8:12031 Change-Id: I4d24837a668a5f7e78a5078212a7dc34b767d703 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3085262Reviewed-by:
Igor Sheludko <ishell@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#76215}
-
- 20 Jul, 2021 1 commit
-
-
Seth Brenith authored
Most Torque-defined extern classes already use @generateCppClass. As Nico pointed out in [1], it would be nice to convert the remaining classes and remove this option. This change converts most of those remaining classes. I know that the future of Torque-defined classes is a subject of some debate right now, but I think that it's worth doing a few mechanical changes to reduce the existing variety of options. Changes that don't exactly follow the usual pattern: 1. BigIntBase, MutableBigInt: we can define these without a body, and then Torque treats them as "really external" rather than "kind of external, but with some Torque-generated parts". 2. RegExpMatchInfo: moved its inline functions into a separate file, which the generated -tq.cc file requires. [1] https://docs.google.com/document/d/1q_gZLnXd4bGnCx3IUfbln46K3bSs9UHBGasy9McQtHI/edit# Bug: v8:8952 Change-Id: I84c7958a295caa0bab847683c05022e18c921cad Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3027742Reviewed-by:
Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com> Cr-Commit-Position: refs/heads/master@{#75817}
-
- 19 Jul, 2021 1 commit
-
-
Seth Brenith authored
I've noticed a few places where class fields as defined in Torque have different names than the corresponding accessors in the C++ class. I think they should match. Most of this change is just mechanically updating the various places that use k##Field##Offset for those fields. Change-Id: I8ba52aed7f6a1cd6b2d71158f71150b66c2c0da0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3027263 Commit-Queue: Seth Brenith <seth.brenith@microsoft.com> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#75796}
-
- 05 Jul, 2021 1 commit
-
-
Santiago Aboy Solanes authored
We were already performing these accessors in an atomic relaxed way for concurrent marking. In no-cm builds I thought we could get away with performing it non-atomically but we are seeing TSAN warnings. Bug: v8:7790, v8:11945 Change-Id: I4f3b1be3e2ae726ac15777e6eb464979b3c0159c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3001179 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#75568}
-
- 14 Jun, 2021 1 commit
-
-
Dan Elphick authored
This moves all of the FunctionTemplateInfo code into templates.cc and removes the inline keyword from BreakAtEntry which is moved out of templates-inl.h. As a result templates-inl.h no longer depends on shared-function-info-inl.h. This in turn uncovered lots of other missing includes which are now in place. Change-Id: I9bc152d5e3db0e793db135a8cfcf97f6d8bcbb8a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2953295Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Dan Elphick <delphick@chromium.org> Cr-Commit-Position: refs/heads/master@{#75120}
-
- 11 Jun, 2021 1 commit
-
-
Igor Sheludko authored
This CL adds WASM_ARRAY_ELEMENTS to distinguish WasmArray maps. Bug: v8:11804 Change-Id: I243ce24c2f2246efbc223af14361c28506e9a2d2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2922884 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#75109}
-
- 26 May, 2021 1 commit
-
-
Jakob Gruber authored
.. when concurrent-inlining, use direct reads instead. Two fields were changed to have a non-atomic getter and acq-rel accessors: - Map::prototype_info - PrototypeInfo::object_create_map Bug: v8:7790 Change-Id: I05e888240d73ab6e961b1048a25713ec45fb0305 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2876852Reviewed-by:
Georg Neis <neis@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#74777}
-
- 10 May, 2021 1 commit
-
-
Marja Hölttä authored
Detailed list of changes: https://docs.google.com/document/d/15i4-SZDzFDW7FfclIYuZEhFn-q-KpobCBy23x9zZZLc/edit?usp=sharing Bug: v8:11111 Change-Id: I931003bd4552cf91d57de95af04a427a9e6d6ac9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2814259Reviewed-by:
Igor Sheludko <ishell@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Shu-yu Guo <syg@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/master@{#74459}
-
- 05 May, 2021 1 commit
-
-
Santiago Aboy Solanes authored
This field has been used with atomically relaxed semantics due to a race with layout_descriptor [1]. Even though layout_descriptor doens't exist anymore, this race is still present presumably because the transition to a new map happens on StoreIC. We can set it as atomic for non-cm and atomic relaxed for cm like we did with the other Map's fields. Note that originally, this field was relaxed so we are reverting it back to what it was for concurrent marking. [1]: https://chromium-review.googlesource.com/c/v8/v8/+/555210/ Bug: v8:7790, v8:11696 Change-Id: I5d8c18bedb84b4bd5dc771e87310bc14409cfed8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2874454Reviewed-by:
Georg Neis <neis@chromium.org> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Cr-Commit-Position: refs/heads/master@{#74386}
-
- 03 May, 2021 1 commit
-
-
Igor Sheludko authored
When fast deleting properties generalize all outgoing transitions to mutable instead of generalizing when property is reconfigured. Bug: chromium:1201938 Change-Id: I080f2f43de1691a742be2a2bec5cd20d02d78dbc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2859960 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#74334}
-
- 28 Apr, 2021 1 commit
-
-
Dominik Inführ authored
A NativeContext is initialized in two steps: First the map is allocated, only afterwards the NativeContext. It could happen that there is a GC happening when allocating the NativeContext. In such a case the native_context for the Map is still set to null. Fix this by also allowing null in Map::MapVerify. Bug: v8:11695 Change-Id: Id8dcd6aef83aff4cbfff45a1e993e555cff8e7bb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2853587Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/master@{#74237}
-
- 26 Apr, 2021 1 commit
-
-
Santiago Aboy Solanes authored
The property kInObjectPropertiesStartOrConstructorFunctionIndexOffset was set as relaxed due to races with the layout_descriptor (https://chromium-review.googlesource.com/c/v8/v8/+/555210/). The layout_descriptor was removed with the removal of double field unboxing. We are able to turn those property's accessors into non-atomic ones since they are set at construction time. Bug: v8:7790 Change-Id: I25c53f0e00718cca72ba86f8475af9ecefb7ba3d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843359 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#74174}
-
- 20 Apr, 2021 1 commit
-
-
Santiago Aboy Solanes authored
Mistakenly had its set as non-atomic when it was modifying maps the concurrent compiler could see. Since this accessor is set after map initialization, but it is not necessary for synchronization we can set it as relaxed write. Bug: v8:7790, v8:11668 Change-Id: I605935e96b3da47ed6abfb6676bf14456feeeddd Fixed: v8:11668 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2839548Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Cr-Commit-Position: refs/heads/master@{#74066}
-
- 13 Apr, 2021 1 commit
-
-
Santiago Aboy Solanes authored
From the concurrent compiler's perspective, we can perform those read/writes non-atomically and have wider TSAN coverage. The concurrent marker, however, needs them to be atomic. Bug: v8:7790 Change-Id: I96897f4f6237c90da018ec89be838aae894c24bc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2817538 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#73935}
-
- 12 Apr, 2021 1 commit
-
-
Santiago Aboy Solanes authored
We have to have special rules for bit_fields since we multiple accesors touch the same field. I used: * If the accessor is set at map initalization time only and: * only the main thread accesses it: non-atomic write/read * bg accesses it too: non-atomic write, relaxed read (read has to be relaxed due to the whole bit_field being modified concurrently via other bit_field3 accessors) * If the accessor is set after map initialization: * but it is not necessary for synchronization: relaxed write/read * If the accessor is needed for synchronization: release/acquire As a note, Map::NumberOfOwnDescriptors are the bits accessed by the concurrent marker. For concurrent marker reasons it can be relaxed, but we would like it to be release/acquire for the compiler since that's where we synchronize Maps with adding descriptors to the descriptor array. Bug: v8:7790, chromium:1150811 Change-Id: I0ba7d2f8cb81d65a487970b4ea0bfa2a4cb3a975 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2773286Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Cr-Commit-Position: refs/heads/master@{#73911}
-
- 08 Apr, 2021 1 commit
-
-
Jakob Gruber authored
This is part of moving towards MapUpdater as the bottleneck for map updates. Drive-by: Move helpers. Drive-by: Use a plain std::queue instead of a ZoneQueue in UpdateFieldType. Bug: v8:7790 Change-Id: Iff80a6e9bf3390a010305f7998d6f6dad2bce09f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2807602 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Auto-Submit: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#73851}
-
- 06 Apr, 2021 1 commit
-
-
Shu-yu Guo authored
This is a reland of e28dadc2 The original failure was due to a stale Win32 bot. The reland failure was due to idempotent task deduplication returning the exact same failure. See crbug/1196064 Original change's description: > [ptr-cage] Rename IsolateRoot to PtrComprCageBase > > Currently, IsolateRoot is both the address of the Isolate root and the > base address of the pointer compression reservation. This CL teases the > two uses apart by renaming IsolateRoot to PtrComprCageBase. > > - In addition to V8_COMPRESS_POINTERS, add a > V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE (vs SHARED_CAGE). > > - Rename GetIsolate* helpers to GetPtrComprCageBase. When > V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE is true, the helpers remain as > aliases to GetPtrComprCageBase. > > - Rename kPtrComprIsolateRootAlignment to kPtrComprCageBaseAlignment. > > Bug: v8:11460 > Change-Id: I1d715f678ce9a0b5731895612ca14f56579b1c48 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2783672 > Commit-Queue: Shu-yu Guo <syg@chromium.org> > Auto-Submit: Shu-yu Guo <syg@chromium.org> > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> > Cr-Commit-Position: refs/heads/master@{#73790} Bug: v8:11460 No-Try: true Tbr: ishell@chromium.org Tbr: rmcilroy@chromium.org Change-Id: Id69311cf3267ebe1297fff159de0be48b15b65a3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2806546Reviewed-by:
Shu-yu Guo <syg@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/master@{#73795}
-
- 05 Apr, 2021 4 commits
-
-
Shu-yu Guo authored
This reverts commit 15c78b45. Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Win32/32277/overview Original change's description: > Reland "[ptr-cage] Rename IsolateRoot to PtrComprCageBase" > > This is a reland of e28dadc2 > > Relanding to see if Win32 rel failures from > https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Win32/32275/overview > were infra flakes. Could not repro on try bots. > > Original change's description: > > [ptr-cage] Rename IsolateRoot to PtrComprCageBase > > > > Currently, IsolateRoot is both the address of the Isolate root and the > > base address of the pointer compression reservation. This CL teases the > > two uses apart by renaming IsolateRoot to PtrComprCageBase. > > > > - In addition to V8_COMPRESS_POINTERS, add a > > V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE (vs SHARED_CAGE). > > > > - Rename GetIsolate* helpers to GetPtrComprCageBase. When > > V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE is true, the helpers remain as > > aliases to GetPtrComprCageBase. > > > > - Rename kPtrComprIsolateRootAlignment to kPtrComprCageBaseAlignment. > > > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2783672 > > Reviewed-by: Igor Sheludko <ishell@chromium.org> > > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> > > No-Try: true > Bug: v8:11460 > Tbr: ishell@chromium.org > Tbr: rmcilroy@chromium.org > Change-Id: I0a8c3a48999d6737c8c64d2c2703607f14f3fdd0 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2806169 > Reviewed-by: Shu-yu Guo <syg@chromium.org> > Commit-Queue: Shu-yu Guo <syg@chromium.org> > Cr-Commit-Position: refs/heads/master@{#73792} Bug: v8:11460 Change-Id: Ifee92d622c43a91c15f45ef94ff739237bd2024b No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2806545 Auto-Submit: Shu-yu Guo <syg@chromium.org> Reviewed-by:
Shu-yu Guo <syg@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/master@{#73793}
-
Shu-yu Guo authored
This is a reland of e28dadc2 Relanding to see if Win32 rel failures from https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Win32/32275/overview were infra flakes. Could not repro on try bots. Original change's description: > [ptr-cage] Rename IsolateRoot to PtrComprCageBase > > Currently, IsolateRoot is both the address of the Isolate root and the > base address of the pointer compression reservation. This CL teases the > two uses apart by renaming IsolateRoot to PtrComprCageBase. > > - In addition to V8_COMPRESS_POINTERS, add a > V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE (vs SHARED_CAGE). > > - Rename GetIsolate* helpers to GetPtrComprCageBase. When > V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE is true, the helpers remain as > aliases to GetPtrComprCageBase. > > - Rename kPtrComprIsolateRootAlignment to kPtrComprCageBaseAlignment. > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2783672 > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> No-Try: true Bug: v8:11460 Tbr: ishell@chromium.org Tbr: rmcilroy@chromium.org Change-Id: I0a8c3a48999d6737c8c64d2c2703607f14f3fdd0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2806169Reviewed-by:
Shu-yu Guo <syg@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/master@{#73792}
-
Francis McCabe authored
This reverts commit e28dadc2. Reason for revert: failed test262 tests;; see https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Win32/32275/steps?succeeded=true&debug=false Original change's description: > [ptr-cage] Rename IsolateRoot to PtrComprCageBase > > Currently, IsolateRoot is both the address of the Isolate root and the > base address of the pointer compression reservation. This CL teases the > two uses apart by renaming IsolateRoot to PtrComprCageBase. > > - In addition to V8_COMPRESS_POINTERS, add a > V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE (vs SHARED_CAGE). > > - Rename GetIsolate* helpers to GetPtrComprCageBase. When > V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE is true, the helpers remain as > aliases to GetPtrComprCageBase. > > - Rename kPtrComprIsolateRootAlignment to kPtrComprCageBaseAlignment. > > Bug: v8:11460 > Change-Id: I1d715f678ce9a0b5731895612ca14f56579b1c48 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2783672 > Commit-Queue: Shu-yu Guo <syg@chromium.org> > Auto-Submit: Shu-yu Guo <syg@chromium.org> > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> > Cr-Commit-Position: refs/heads/master@{#73790} Bug: v8:11460 Change-Id: I19d0e28194fcdb28e89f129a7694ca3fe29fa17a No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2806168 Auto-Submit: Francis McCabe <fgm@chromium.org> Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#73791}
-
Shu-yu Guo authored
Currently, IsolateRoot is both the address of the Isolate root and the base address of the pointer compression reservation. This CL teases the two uses apart by renaming IsolateRoot to PtrComprCageBase. - In addition to V8_COMPRESS_POINTERS, add a V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE (vs SHARED_CAGE). - Rename GetIsolate* helpers to GetPtrComprCageBase. When V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE is true, the helpers remain as aliases to GetPtrComprCageBase. - Rename kPtrComprIsolateRootAlignment to kPtrComprCageBaseAlignment. Bug: v8:11460 Change-Id: I1d715f678ce9a0b5731895612ca14f56579b1c48 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2783672 Commit-Queue: Shu-yu Guo <syg@chromium.org> Auto-Submit: Shu-yu Guo <syg@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#73790}
-
- 24 Mar, 2021 1 commit
-
-
Santiago Aboy Solanes authored
We set the bit_field_2 fields at map construction. Bug: v8:7790, chromium:1150811 Change-Id: I673334d6900993b8a52e3b85d504cbc3f457c020 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2773053 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by:
Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/master@{#73638}
-
- 22 Mar, 2021 1 commit
-
-
Santiago Aboy Solanes authored
The instance type is set before setting the map inside an Object. It is relaxed and not non-atomic to prevent a false positive TSAN failure (see https://chromium-review.googlesource.com/c/v8/v8/+/2682641). Bug: v8:7790 Change-Id: Iddd28ffb06b5a882e77c4bf88bf8580df792f198 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2773042Reviewed-by:
Georg Neis <neis@chromium.org> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Cr-Commit-Position: refs/heads/master@{#73570}
-
- 17 Mar, 2021 1 commit
-
-
Santiago Aboy Solanes authored
We can ensure that the constructor is set before the map is set on the JSObject. Setting the constructor remains non-atomic. Bug: v8:7790 Change-Id: Ie65519f61e29c9bed89bf09f582aa8bd39de1b03 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2761199Reviewed-by:
Georg Neis <neis@chromium.org> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Cr-Commit-Position: refs/heads/master@{#73460}
-
- 16 Mar, 2021 1 commit
-
-
Santiago Aboy Solanes authored
Most of Map's bit_field (as in not 2 or 3) accessors are not set after construction e.g. is_callable. They are also not used as a synchronization point. From the compiler's point of view, they can be set as non-atomic. There are two accessors (`prototype_slot` and `non_instance_prototype`) that have to be atomic for concurrent marker reasons (relaxed is fine for them). Bug: v8:7790, chromium:1150811 Change-Id: Ic3c81a59e7895ee9c35a128bb10656040b19dd42 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2752154Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Cr-Commit-Position: refs/heads/master@{#73432}
-
- 11 Mar, 2021 3 commits
-
-
Clemens Backes authored
This is a reland of 80f5dfda. A condition in pipeline.cc was inverted, which lead to a CSA verifier error. Original change's description: > [no-wasm] Exclude src/wasm from compilation > > This is the biggest chunk, including > - all of src/wasm, > - torque file for wasm objects, > - torque file for wasm builtins, > - wasm builtins, > - wasm runtime functions, > - int64 lowering, > - simd scala lowering, > - WasmGraphBuilder (TF graph construction for wasm), > - wasm frame types, > - wasm interrupts, > - the JSWasmCall opcode, > - wasm backing store allocation. > > Those components are all recursively entangled, so I found no way to > split this change up further. > > Some includes that were recursively included by wasm headers needed to > be added explicitly now. > > backing-store-unittest.cc is renamed to wasm-backing-store-unittest.cc > because it only tests wasm backing stores. This file is excluded from > no-wasm builds then. > > R=jkummerow@chromium.org, jgruber@chromium.org, mlippautz@chromium.org, petermarshall@chromium.org > > Bug: v8:11238 > Change-Id: I7558f2d12d2dd6c65128c4de7b79173668c80b2b > Cq-Include-Trybots: luci.v8.try:v8_linux64_no_wasm_compile_rel > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2742955 > Commit-Queue: Clemens Backes <clemensb@chromium.org> > Reviewed-by: Peter Marshall <petermarshall@chromium.org> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Cr-Commit-Position: refs/heads/master@{#73344} TBR=jgruber@chromium.org Bug: v8:11238 Change-Id: I20bd2847a59c68738b5a336cd42582b7b1499585 Cq-Include-Trybots: luci.v8.try:v8_linux64_no_wasm_compile_rel Cq-Include-Trybots: luci.v8.try:v8_linux_verify_csa_rel_ng Cq-Include-Trybots: luci.v8.try:v8_linux64_verify_csa_rel_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2752867Reviewed-by:
Clemens Backes <clemensb@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#73348}
-
Clemens Backes authored
This reverts commit 80f5dfda. Reason for revert: Fails CSA verification: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20verify%20csa/21766/overview Original change's description: > [no-wasm] Exclude src/wasm from compilation > > This is the biggest chunk, including > - all of src/wasm, > - torque file for wasm objects, > - torque file for wasm builtins, > - wasm builtins, > - wasm runtime functions, > - int64 lowering, > - simd scala lowering, > - WasmGraphBuilder (TF graph construction for wasm), > - wasm frame types, > - wasm interrupts, > - the JSWasmCall opcode, > - wasm backing store allocation. > > Those components are all recursively entangled, so I found no way to > split this change up further. > > Some includes that were recursively included by wasm headers needed to > be added explicitly now. > > backing-store-unittest.cc is renamed to wasm-backing-store-unittest.cc > because it only tests wasm backing stores. This file is excluded from > no-wasm builds then. > > R=jkummerow@chromium.org, jgruber@chromium.org, mlippautz@chromium.org, petermarshall@chromium.org > > Bug: v8:11238 > Change-Id: I7558f2d12d2dd6c65128c4de7b79173668c80b2b > Cq-Include-Trybots: luci.v8.try:v8_linux64_no_wasm_compile_rel > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2742955 > Commit-Queue: Clemens Backes <clemensb@chromium.org> > Reviewed-by: Peter Marshall <petermarshall@chromium.org> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Cr-Commit-Position: refs/heads/master@{#73344} Bug: v8:11238 Change-Id: I93672002c1faa36bb0bb5b4a9cc2032ee2ccd814 Cq-Include-Trybots: luci.v8.try:v8_linux64_no_wasm_compile_rel No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2752866 Auto-Submit: Clemens Backes <clemensb@chromium.org> Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#73346}
-
Clemens Backes authored
This is the biggest chunk, including - all of src/wasm, - torque file for wasm objects, - torque file for wasm builtins, - wasm builtins, - wasm runtime functions, - int64 lowering, - simd scala lowering, - WasmGraphBuilder (TF graph construction for wasm), - wasm frame types, - wasm interrupts, - the JSWasmCall opcode, - wasm backing store allocation. Those components are all recursively entangled, so I found no way to split this change up further. Some includes that were recursively included by wasm headers needed to be added explicitly now. backing-store-unittest.cc is renamed to wasm-backing-store-unittest.cc because it only tests wasm backing stores. This file is excluded from no-wasm builds then. R=jkummerow@chromium.org, jgruber@chromium.org, mlippautz@chromium.org, petermarshall@chromium.org Bug: v8:11238 Change-Id: I7558f2d12d2dd6c65128c4de7b79173668c80b2b Cq-Include-Trybots: luci.v8.try:v8_linux64_no_wasm_compile_rel Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2742955 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
Peter Marshall <petermarshall@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#73344}
-