- 27 Jun, 2022 1 commit
-
-
Samuel Groß authored
The ExternalPointerTags are assumed to be compile-time constants in most cases, so turning them into template parameters enforces that. As decisions such as whether to use the per-isolate or the shared external pointer table are encoded into the tag values, forcing those to be compile-time constants guarantees that the compiler will be able to inline the correct logic when accessing an external pointer. With this, there are now two (high-level) ways of accessing external pointer fields from C++: the Read/WriteExternalPointerField methods which require the ExternalPointerTag to be a template parameter, and the ExternalPointerSlot class which takes the tag as an argument. The latter is for example used for snapshot deserialization and by the garbage collector (more generally, by the ObjectVisitor::VisitExternalPointer method), where the tag is not a compile-time constant. Finally, this CL also introduces a new ExternalPointerHandle type which represents the (opaque) on-heap representation of a reference to an entry in an ExternalPointerTable when sandboxing is enabled. Making this its own type makes the code a bit more readable. Bug: v8:10391 Change-Id: I867b8ce41d15d485f1dc66786f233c710c56afcb Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3720641Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#81402}
-
- 22 Jun, 2022 1 commit
-
-
Luis Fernando Pardo Sixtos authored
Initial implementation for concurrent shared arrays. Current implementation exposes a `SharedArray` constructor, but its syntax might change in the future. Shared arrays can be shared across Isolates, have a fixed size, have no prototype, have no constructor, and can only store primitives, shared structs and other shared arrays. With this CL shared structs are also allowed to store shared arrays. The Backing storage for the SharedArrays is a `FixedArrayBase`. This CL introdces a new ElementKind: `SHARED_ARRAY_ELEMENTS`. The new kind should match the overall functionality of the `PACKED_SEALED_ELEMENTS` kind, but having it as standalone kind allows for easier branching in CSA and turbofan code. Bug: v8:12547 Change-Id: I054a04624d4cf1f37bc26ae4b92b6fe33408538a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3585353Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Luis Fernando Pardo Sixtos <lpardosixtos@microsoft.com> Reviewed-by: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#81285}
-
- 13 May, 2022 1 commit
-
-
Clemens Backes authored
Now that we require C++17 support, we can just use the standard static_assert without message, instead of our STATIC_ASSERT macro. R=leszeks@chromium.org Bug: v8:12425 Change-Id: I1d4e39c310b533bcd3a4af33d027827e6c083afe Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3647353Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Hannes Payer <hpayer@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#80524}
-
- 05 May, 2022 1 commit
-
-
Peter Kasting authored
This prevents ambiguity errors in C++20 due to ADL when casting types in std::, which gains std::bit_cast<>(). Bug: chromium:1284275 Change-Id: I25046d1952a9304852e481ad8b84049c6769c289 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3625838 Auto-Submit: Peter Kasting <pkasting@chromium.org> Reviewed-by: Adam Klein <adamk@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Adam Klein <adamk@chromium.org> Cr-Commit-Position: refs/heads/main@{#80378}
-
- 25 Apr, 2022 1 commit
-
-
Shu-yu Guo authored
Currently the Isolate is gotten off of the object that the operation is being performed on. Shared objects return the shared Isolate, which is incorrect as it shouldn't be used to run JS, nor does it have HandleScopes open. Plumb the executing Isolate through. Bug: v8:12547 Change-Id: I3d960751c798ac657a6122598154e36d9d504c31 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3606489Reviewed-by: Adam Klein <adamk@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#80163}
-
- 08 Apr, 2022 1 commit
-
-
Marja Hölttä authored
Bug: v8:11111 Change-Id: I94f992f78a12a86c89924261bd64c73f935051b5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3576118Reviewed-by: Shu-yu Guo <syg@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/main@{#79869}
-
- 17 Mar, 2022 1 commit
-
-
Shu-yu Guo authored
Bug: v8:12547 Change-Id: Ie27831b793f214368a003adac24b7c92f1a5fc11 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3518426Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#79504}
-
- 16 Mar, 2022 2 commits
-
-
Samuel Groß authored
JSObject::InitializeBody now checks whether the instance type of the object being initialized can have embedder data slots around the initialization logic for these slots. This fixes a performance regression on certain benchmarks. To perform this check efficiently, a new instance type, JSObjectWithEmbedderSlots, is introduced so that the check becomes a simple range check. Bug: chromium:1304139 Change-Id: I00c892bc2276e950b59602257ca1c2435c10e517 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3507712Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#79497}
-
Samuel Groß authored
This method now handles external pointers in HeapObjects during serialization by encoding the representation of the external pointer (sandboxed, raw), the origin (internal, api) and potentially the external pointer tag. It is currently only used to handle JSExternalObjects but could, in the future, be extended to handle all external pointers that need special handling during serialization/deserialization. Bug: v8:12700 Change-Id: Ib0747d765ddc632e4ca4ee94521616d0271be0bc Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3521904Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#79496}
-
- 14 Mar, 2022 1 commit
-
-
Samuel Groß authored
Instead of implementing ExternalObjects as plain JSObjects with a single EmbedderDataSlot pointing to a Foreign containing the actual raw pointer, this CL now creates a new JSExternalObject type that directly contains the external pointer. As a side-effect of this refactoring, nullptr values are now no longer valid for ExternalObjects. Change-Id: Ic8ff334681c966e823ca70f34dd1efaaa21a0789 Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3513234Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#79459}
-
- 10 Mar, 2022 1 commit
-
-
Shu-yu Guo authored
Atomics.load and Atomics.store now accept string field names as the 2nd argument when the 1st argument is a shared struct. Currently these are implemented in C++ and not yet in CSA. Bug: v8:12547 Change-Id: Ideeafc13fb6a925540edf3dc17428c8e50bcee79 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3510837 Commit-Queue: Shu-yu Guo <syg@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#79431}
-
- 07 Mar, 2022 1 commit
-
-
Samuel Groß authored
This simplifies various bits of logic around EmbedderDataSlots as the raw part will now always contain a valid index into an external pointer table entry. This CL also unifies the initialization of EmbedderDataSlots by providing a EmbedderDataSlots::Initialize method and adds more documentation about the layout of EmbedderDataSlots in the different configurations. Bug: v8:10391 Change-Id: Ie952598898a7a6c9d40b28d3a7370bfc1291bcf0 Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3472495Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#79384}
-
- 23 Feb, 2022 1 commit
-
-
Shu-yu Guo authored
This is a reland of 1025bf26 Changes since revert: - TSAN issue fixed by https://crrev.com/c/3475084 - Skip the shared-struct-workers test until shared GC deadlock is fixed, being tracked in v8:12645 Original change's description: > [shared-struct] Prototype JS shared structs > > Unlike the Stage 1 proposal, for simplicity the prototype does not add > any new syntax, instead opting for exposing a SharedStructType > constructor which takes an array of field names. This type constructor > returns constructors for shared structs. > > Shared structs can be shared across Isolates, are fixed layout, have no > prototype, have no .constructor, and can only store primitives and > other shared structs. > > The initial prototype does not have TurboFan support. > > Bug: v8:12547 > Change-Id: I23bdd819940b42139692bcdb53d372099b0d4426 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3390643 > Reviewed-by: Tobias Tebbi <tebbi@chromium.org> > Reviewed-by: Marja Hölttä <marja@chromium.org> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> > Commit-Queue: Shu-yu Guo <syg@chromium.org> > Cr-Commit-Position: refs/heads/main@{#79156} Bug: v8:12547 Change-Id: Ic1f5cf9fa9791ae2d5d5dc7c110614ca10b5d98e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3475078Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Marja Hölttä <marja@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#79215}
-
- 22 Feb, 2022 1 commit
-
-
Samuel Groß authored
Similar to other external pointers, the indices into the external pointer table are stored shifted to the left to guarantee an upper bound. Bug: v8:10391 Change-Id: I079dc1568f49ae349c326a8e83fc32c93bdb35cf Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3455152Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#79209}
-
- 18 Feb, 2022 2 commits
-
-
Shu-yu Guo authored
Currently the Isolate is gotten off of the object that the operation is being performed on. GetDataProperty may end up using a per-Isolate lookup cache, which is not threadsafe when the Isolate is shared. Plumb the executing, non-shared Isolate through. Bug: v8:12646, v8:12547 Change-Id: Ia08ece9a9e8cbd7eba9ea38b01caa511895f5bf4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3475084Reviewed-by: Adam Klein <adamk@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#79180}
-
Michael Achenbach authored
This reverts commit 1025bf26. Reason for revert: https://crbug.com/v8/12645 Original change's description: > [shared-struct] Prototype JS shared structs > > Unlike the Stage 1 proposal, for simplicity the prototype does not add > any new syntax, instead opting for exposing a SharedStructType > constructor which takes an array of field names. This type constructor > returns constructors for shared structs. > > Shared structs can be shared across Isolates, are fixed layout, have no > prototype, have no .constructor, and can only store primitives and > other shared structs. > > The initial prototype does not have TurboFan support. > > Bug: v8:12547 > Change-Id: I23bdd819940b42139692bcdb53d372099b0d4426 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3390643 > Reviewed-by: Tobias Tebbi <tebbi@chromium.org> > Reviewed-by: Marja Hölttä <marja@chromium.org> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> > Commit-Queue: Shu-yu Guo <syg@chromium.org> > Cr-Commit-Position: refs/heads/main@{#79156} Bug: v8:12547 Change-Id: I44f2b8bb7487b4d39ba1282585e0b2282501230f No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3474676 Auto-Submit: Michael Achenbach <machenbach@chromium.org> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Owners-Override: Michael Achenbach <machenbach@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/main@{#79170}
-
- 17 Feb, 2022 1 commit
-
-
Shu-yu Guo authored
Unlike the Stage 1 proposal, for simplicity the prototype does not add any new syntax, instead opting for exposing a SharedStructType constructor which takes an array of field names. This type constructor returns constructors for shared structs. Shared structs can be shared across Isolates, are fixed layout, have no prototype, have no .constructor, and can only store primitives and other shared structs. The initial prototype does not have TurboFan support. Bug: v8:12547 Change-Id: I23bdd819940b42139692bcdb53d372099b0d4426 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3390643Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Marja Hölttä <marja@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#79156}
-
- 05 Feb, 2022 1 commit
-
-
Shu-yu Guo authored
Currently the Isolate is gotten off of the object that the operation is being performed on. Shared objects return the shared Isolate, which is incorrect as it shouldn't be used to run JS, nor does it have HandleScopes open. Plumb the executing Isolate through. Bug: v8:12547 Change-Id: I52d5a172ea602f4ad058d979003d51a80cdb4405 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3441022Reviewed-by: Adam Klein <adamk@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#78961}
-
- 30 Nov, 2021 1 commit
-
-
Igor Sheludko authored
This will allow making HeapObject::IsBlah() checks faster when external code space is enabled. Bug: v8:11880 Change-Id: I68473ba88063c555c90330c9748462adeb35aa0b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3308797Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#78156}
-
- 15 Nov, 2021 1 commit
-
-
Ng Zhi An authored
Bug: v8:12244,v8:12245 Change-Id: I3029cfb8e9afdcb5e53aa406359aa7246c23ea40 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3274021Reviewed-by: Maya Lekova <mslekova@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Commit-Queue: Zhi An Ng <zhin@chromium.org> Cr-Commit-Position: refs/heads/main@{#77906}
-
- 12 Nov, 2021 1 commit
-
-
Dominik Inführ authored
Speculative fix for a data race involving memory measurement. For memory measurement we use JSGlobalObject::native_context_unchecked in NativeContextInferrer::InferForJSObject when trying to infer the NativeContext for a JS object from a concurrent marking thread. This load can race e.g. with the context deserializer running on the main thread. Fix this race by making the load relaxed atomic. Bug: chromium:1269681 Change-Id: Id04a92572d7d722594b2f8465e579b7231e54e29 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277885 Auto-Submit: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#77870}
-
- 27 Oct, 2021 1 commit
-
-
legendecas authored
As of the normative change [1] of spec, the export name can be arbitrary strings. Element accesses on module namespace objects will be interpreted as indexed properties, so those element key exports should be setup as elements. [1]: https://github.com/tc39/ecma262/pull/2154 Bug: v8:11690 Change-Id: I3b724d11b9306739268fc5348bae87911a8da18c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3219945Reviewed-by: Shu-yu Guo <syg@chromium.org> Commit-Queue: legendecas <legendecas@gmail.com> Cr-Commit-Position: refs/heads/main@{#77581}
-
- 28 Sep, 2021 1 commit
-
-
Ng Zhi An authored
Bug: v8:12244 Change-Id: I7ea68dd74a376221631d7f56b4a012207f68a1ec Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3182899Reviewed-by: Hannes Payer <hpayer@chromium.org> Commit-Queue: Zhi An Ng <zhin@chromium.org> Cr-Commit-Position: refs/heads/main@{#77129}
-
- 30 Aug, 2021 1 commit
-
-
Seth Brenith authored
Most Torque-defined extern classes already use CPP class generation. As Nico pointed out in [1], it would be nice to convert the remaining classes and remove this option. This change converts most of those remaining classes. I know that the future of Torque-defined classes is a subject of some debate right now, but I think that it's worth doing a few mechanical changes to reduce the existing variety of options. A couple of minor fixes in the Torque compiler were required so that it generates correct code for shapes. [1] https://docs.google.com/document/d/1q_gZLnXd4bGnCx3IUfbln46K3bSs9UHBGasy9McQtHI/edit# Bug: v8:8952 Change-Id: I7e6087153a18d6ee80e67926793e8ba8e01d501e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3015666Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Anton Bikineev <bikineev@chromium.org> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com> Cr-Commit-Position: refs/heads/main@{#76586}
-
- 29 Jul, 2021 1 commit
-
-
Marja Hölttä authored
Bug: v8:11111 Change-Id: Ib3ae55349024ebeab9ceaf9472a6de2b4d86ce55 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3056975Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/master@{#75993}
-
- 06 Jul, 2021 1 commit
-
-
Mike Stanton authored
TurboFan reads the value in HeapNumber, and TSAN detects a data race between this read and sets on the main thread elsewhere. We mark this as relaxed atomic (meaning, correct value of the read is not guaranteed). The compiler uses the dependency mechanism to re-read the value safely on the main thread later, and aborts compilation if a change is detected. Bug: chromium:1224277, v8:7790 Change-Id: I8931d8989812550c0c57b6bd27aa796f6f5e779d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2996201Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Andreas Haas <ahaas@chromium.org> Commit-Queue: Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#75586}
-
- 23 Jun, 2021 1 commit
-
-
Igor Sheludko authored
... which didn't properly handle non-Smi integer indices with JSTypedArray receivers. The addition of new JSReceiver::OrdinaryDefineOwnProperty() overload with LookupIterator::Key caused circular dependency between lookup.h and js-objects.h, so the LookupIterator::Key was moved out of the LookupIterator class in order to make it forward-declarable. Bug: chromium:1209405 Change-Id: I265f0c00f65ab6476c8f1d0ca1264f555d43465f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2972727 Auto-Submit: Igor Sheludko <ishell@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#75326}
-
- 17 Jun, 2021 1 commit
-
-
Mike Stanton authored
Mark the write of the property as relaxed atomic. The compiler thread is examining the value. It is fine if the value is stale or new, we simply need to let TSAN know we are aware of the race. BUG=v8:11896 Change-Id: I42505a6e12c7eb3c1ef8d9376d7a420567646d62 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2968403Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org> Commit-Queue: Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#75209}
-
- 16 Jun, 2021 1 commit
-
-
Mike Stanton authored
In heap-refs.cc, GetOwnFastDataPropertyFromHeap() bottlenecks reading a fast property. To make it safe to use from the background thread we need to verify the object didn't shrink, and risk an out of heap bounds read. Bug: v8:7790 Change-Id: Idebbe0ffea089bf2a70aa7d611618430169082fd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2928185Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Commit-Queue: Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#75186}
-
- 09 Jun, 2021 1 commit
-
-
Jakob Gruber authored
This is a step towards making JSObjectRef non-serialized. Change JSObjectRef::RawFastPropertyAt to use a direct load with relaxed semantics. Special handling of `uninitialized` sentinel values is moved to the only use-site. A new lock `boilerplate_migration_access` protects against concurrent boilerplate migrations while we are iterating over properties. Bug: v8:7790 Change-Id: Ic9de54ca16c1f3364d497a77058cfa33d48dd4a4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2928184 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#75033}
-
- 07 Jun, 2021 1 commit
-
-
Jakob Gruber authored
.. and replace them by elements read directly from the heap object. With this change, consistency between `map` and `elements` is no longer guaranteed. Users were updated, when necessary, to deal with this, e.g. by being more careful not to read out of bounds, by inserting new `actual_elements == elements_constant` runtime checks, or through a new compilation dependency that verifies unchanged elements at finalization time. Drive-by: inline GetElementsKind into callsites. Bug: v8:7790 Change-Id: Ifba78182e185ff0d4e954e3be52f0eb24328c853 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2909655Reviewed-by: Georg Neis <neis@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#74977}
-
- 23 Apr, 2021 1 commit
-
-
Ulan Degenbaev authored
Currently the function normalizes only old sparse backing stores. This patch removed the age check to decouple the heuristic from GC. Change-Id: I9b7f787315b2b8facfa35358143173f7d207c8da Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2846897Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#74156}
-
- 12 Apr, 2021 1 commit
-
-
Wenyu Zhao authored
This CL adds features to pack/unpack map words. Currently V8 cannot store extra metadata in object headers -- because V8 objects do not have a proper header, but only a map pointer at the start of the object. To store per-object metadata like marking data, a side table is required as the per-object metadata storage. This CL enables V8 to use higher unused bits in a 64-bit map word as per-object metadata storage. Map pointer stores come with an extra step to encode the metadata into the pointer (we call it "map packing"). Map pointer loads will also remove the metadata bits as well (we call it "map packing"). Since the map word is no longer a valid pointer after packing, we also change the tag of the packed map word to make it looks like a Smi. This helps various GC and barrier code to correctly skip them instead of blindly dereferencing this invalid pointer. A ninja flag `v8_enable_map_packing` is provided to turn this map-packing feature on and off. It is disabled by default. * Only works on x64 platform, with `v8_enable_pointer_compression` set to `false` Bug: v8:11624 Change-Id: Ia2bdf79553945e5fc0b0874c87803d2cc733e073 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2247561Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#73915}
-
- 06 Apr, 2021 1 commit
-
-
Shu-yu Guo authored
This is a reland of e28dadc2 The original failure was due to a stale Win32 bot. The reland failure was due to idempotent task deduplication returning the exact same failure. See crbug/1196064 Original change's description: > [ptr-cage] Rename IsolateRoot to PtrComprCageBase > > Currently, IsolateRoot is both the address of the Isolate root and the > base address of the pointer compression reservation. This CL teases the > two uses apart by renaming IsolateRoot to PtrComprCageBase. > > - In addition to V8_COMPRESS_POINTERS, add a > V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE (vs SHARED_CAGE). > > - Rename GetIsolate* helpers to GetPtrComprCageBase. When > V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE is true, the helpers remain as > aliases to GetPtrComprCageBase. > > - Rename kPtrComprIsolateRootAlignment to kPtrComprCageBaseAlignment. > > Bug: v8:11460 > Change-Id: I1d715f678ce9a0b5731895612ca14f56579b1c48 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2783672 > Commit-Queue: Shu-yu Guo <syg@chromium.org> > Auto-Submit: Shu-yu Guo <syg@chromium.org> > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> > Cr-Commit-Position: refs/heads/master@{#73790} Bug: v8:11460 No-Try: true Tbr: ishell@chromium.org Tbr: rmcilroy@chromium.org Change-Id: Id69311cf3267ebe1297fff159de0be48b15b65a3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2806546Reviewed-by: Shu-yu Guo <syg@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/master@{#73795}
-
- 05 Apr, 2021 4 commits
-
-
Shu-yu Guo authored
This reverts commit 15c78b45. Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Win32/32277/overview Original change's description: > Reland "[ptr-cage] Rename IsolateRoot to PtrComprCageBase" > > This is a reland of e28dadc2 > > Relanding to see if Win32 rel failures from > https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Win32/32275/overview > were infra flakes. Could not repro on try bots. > > Original change's description: > > [ptr-cage] Rename IsolateRoot to PtrComprCageBase > > > > Currently, IsolateRoot is both the address of the Isolate root and the > > base address of the pointer compression reservation. This CL teases the > > two uses apart by renaming IsolateRoot to PtrComprCageBase. > > > > - In addition to V8_COMPRESS_POINTERS, add a > > V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE (vs SHARED_CAGE). > > > > - Rename GetIsolate* helpers to GetPtrComprCageBase. When > > V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE is true, the helpers remain as > > aliases to GetPtrComprCageBase. > > > > - Rename kPtrComprIsolateRootAlignment to kPtrComprCageBaseAlignment. > > > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2783672 > > Reviewed-by: Igor Sheludko <ishell@chromium.org> > > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> > > No-Try: true > Bug: v8:11460 > Tbr: ishell@chromium.org > Tbr: rmcilroy@chromium.org > Change-Id: I0a8c3a48999d6737c8c64d2c2703607f14f3fdd0 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2806169 > Reviewed-by: Shu-yu Guo <syg@chromium.org> > Commit-Queue: Shu-yu Guo <syg@chromium.org> > Cr-Commit-Position: refs/heads/master@{#73792} Bug: v8:11460 Change-Id: Ifee92d622c43a91c15f45ef94ff739237bd2024b No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2806545 Auto-Submit: Shu-yu Guo <syg@chromium.org> Reviewed-by: Shu-yu Guo <syg@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/master@{#73793}
-
Shu-yu Guo authored
This is a reland of e28dadc2 Relanding to see if Win32 rel failures from https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Win32/32275/overview were infra flakes. Could not repro on try bots. Original change's description: > [ptr-cage] Rename IsolateRoot to PtrComprCageBase > > Currently, IsolateRoot is both the address of the Isolate root and the > base address of the pointer compression reservation. This CL teases the > two uses apart by renaming IsolateRoot to PtrComprCageBase. > > - In addition to V8_COMPRESS_POINTERS, add a > V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE (vs SHARED_CAGE). > > - Rename GetIsolate* helpers to GetPtrComprCageBase. When > V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE is true, the helpers remain as > aliases to GetPtrComprCageBase. > > - Rename kPtrComprIsolateRootAlignment to kPtrComprCageBaseAlignment. > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2783672 > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> No-Try: true Bug: v8:11460 Tbr: ishell@chromium.org Tbr: rmcilroy@chromium.org Change-Id: I0a8c3a48999d6737c8c64d2c2703607f14f3fdd0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2806169Reviewed-by: Shu-yu Guo <syg@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/master@{#73792}
-
Francis McCabe authored
This reverts commit e28dadc2. Reason for revert: failed test262 tests;; see https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Win32/32275/steps?succeeded=true&debug=false Original change's description: > [ptr-cage] Rename IsolateRoot to PtrComprCageBase > > Currently, IsolateRoot is both the address of the Isolate root and the > base address of the pointer compression reservation. This CL teases the > two uses apart by renaming IsolateRoot to PtrComprCageBase. > > - In addition to V8_COMPRESS_POINTERS, add a > V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE (vs SHARED_CAGE). > > - Rename GetIsolate* helpers to GetPtrComprCageBase. When > V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE is true, the helpers remain as > aliases to GetPtrComprCageBase. > > - Rename kPtrComprIsolateRootAlignment to kPtrComprCageBaseAlignment. > > Bug: v8:11460 > Change-Id: I1d715f678ce9a0b5731895612ca14f56579b1c48 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2783672 > Commit-Queue: Shu-yu Guo <syg@chromium.org> > Auto-Submit: Shu-yu Guo <syg@chromium.org> > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> > Cr-Commit-Position: refs/heads/master@{#73790} Bug: v8:11460 Change-Id: I19d0e28194fcdb28e89f129a7694ca3fe29fa17a No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2806168 Auto-Submit: Francis McCabe <fgm@chromium.org> Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#73791}
-
Shu-yu Guo authored
Currently, IsolateRoot is both the address of the Isolate root and the base address of the pointer compression reservation. This CL teases the two uses apart by renaming IsolateRoot to PtrComprCageBase. - In addition to V8_COMPRESS_POINTERS, add a V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE (vs SHARED_CAGE). - Rename GetIsolate* helpers to GetPtrComprCageBase. When V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE is true, the helpers remain as aliases to GetPtrComprCageBase. - Rename kPtrComprIsolateRootAlignment to kPtrComprCageBaseAlignment. Bug: v8:11460 Change-Id: I1d715f678ce9a0b5731895612ca14f56579b1c48 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2783672 Commit-Queue: Shu-yu Guo <syg@chromium.org> Auto-Submit: Shu-yu Guo <syg@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#73790}
-
- 29 Mar, 2021 1 commit
-
-
Frank Emrich authored
The build time flag v8_dict_mode_prototypes is ill-named, because it does not control whether properties are kept in dictionary mode (this is done by the v8_dict_property_const_tracking flag), but instead it controls if SwissNameDictionary or NameDictionary is used as the property backing store for all dictionary mode objects. This CL renames the flag and updates its description. Change-Id: If1337838d1b6d8f089c281a77d9ef7cfd4007220 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2786859Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Omer Katz <omerkatz@chromium.org> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#73706}
-
- 08 Mar, 2021 1 commit
-
-
Frank Emrich authored
This CL is part of a series that makes SwissNameDictionary available as a new property backing store. Previously, the flag v8_dict_mode_prototypes allows selecting between NameDictionary and OrderedNameDictionary as the backing store used for all dictionary mode objects. This series of CLs changes this such that enabling the flag causes SwissNameDictionary being used instead of OrderedNameDictionary. The behavior for when the flag is not set remains unchanged (= use NameDictionary). This particular CL just collects many small changes, including some CSA changes where runtime calls are necessary. Bug: v8:11388 Change-Id: I38fd18098fc641a5d92a986da251a6b3ac09411a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2739642 Commit-Queue: Frank Emrich <emrich@google.com> Reviewed-by: Marja Hölttä <marja@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#73257}
-