- 04 May, 2018 26 commits
-
-
Clemens Hammacher authored
First untrusted code mitigation in Liftoff: Mask memory accesses (loads and stores) by the mask stored in the WasmInstanceObject. R=titzer@chromium.org Bug: v8:6600, chromium:798964 Change-Id: Iddf577977451444b51c42fbc2ad34430832a9e71 Reviewed-on: https://chromium-review.googlesource.com/1044215Reviewed-by:
Ben Titzer <titzer@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#53000}
-
Vincent Belliard authored
Bug: v8:6600 Change-Id: I1bd2db402d6e97ab468dc24cd4d12bef6523d784 Reviewed-on: https://chromium-review.googlesource.com/1043091 Commit-Queue: Vincent Belliard <vincent.belliard@arm.com> Reviewed-by:
Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#52999}
-
jgruber authored
This method is intended for use by code caching as follows: 1. The module is compiled (and perhaps instantiated). 2. The embedder fetches and stores the module's unbound script (i.e. the shared function info). 3. Module evaluation, maybe triggering lazy compilation. 4. Generated code for the module (which hangs off the shared function info) is inserted into the code cache. Subsequent module loads can load from the code cache prior to evaluation. Bug: v8:7685 Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng Change-Id: I80018cd921ab1a18323906a548b249e19d9f9509 Reviewed-on: https://chromium-review.googlesource.com/1041745 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/master@{#52998}
-
Daniel Clifford authored
* Empty string literals (e.g. "" and '') were not recognized a strings. This is now fixed. * return statements without expressions (e.g. for functions with void return types) caused crashes. Change-Id: Ied60f9abffca457a0d85c9e01e3795839fe777c9 Reviewed-on: https://chromium-review.googlesource.com/1042310 Commit-Queue: Daniel Clifford <danno@chromium.org> Reviewed-by:
Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#52997}
-
Hannes Payer authored
Bug: chromium:800348, chromium:827627, chromium:839750 Change-Id: I112e20b83eb1937476ebb4f30cf5679113759c0c Reviewed-on: https://chromium-review.googlesource.com/1044195Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Commit-Queue: Hannes Payer <hpayer@chromium.org> Cr-Commit-Position: refs/heads/master@{#52996}
-
Clemens Hammacher authored
On div and rem on ia32 and x64, we sometimes need to spill. If this spilling code happens inside of a branch, the cache state will reflect that the value was spilled, even though the actual spilling code might not have executed. R=titzer@chromium.org Bug: v8:6600, chromium:839800 Change-Id: I93b681a23119f903feb54235d6d44a7cbd5815fe Reviewed-on: https://chromium-review.googlesource.com/1044185Reviewed-by:
-
Clemens Hammacher authored
The {baseline_compilation_units_} and {tiering_compilation_units_} fields should only be accessed if the {mutex_} is held. Also, the number of compilation units is already taken care of inside of {RestartBackgroundTasks}, so no need to explicitly pass it. R=ahaas@chromium.org Change-Id: I8f36ed141b587ee1bea41291545f39546d8cf24e Reviewed-on: https://chromium-review.googlesource.com/1044213Reviewed-by:Andreas Haas <ahaas@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#52994}
-
Clemens Hammacher authored
Since address is a uintptr_t, there is no need to implement a specific hasher. R=mstarzinger@chromium.org Bug: v8:7570 Change-Id: I47e652929ef201e742224541d9df4360444e3ba8 Reviewed-on: https://chromium-review.googlesource.com/1044209Reviewed-by:
-
Benoît Lizé authored
ExternalString::kShortSize is not the same as i::kShortSize, caused incorrect reporting for code stats for two byte strings. Bug: chromium:837659 Change-Id: Icbb39f2103aa4fa72bd5b1258cb8e1d4aee10441 Reviewed-on: https://chromium-review.googlesource.com/1044212Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Benoit L <lizeb@chromium.org> Cr-Commit-Position: refs/heads/master@{#52992}
-
Clemens Hammacher authored
macros.h already not only defines macros, but also templatized helpers like {bit_cast} and {arraysize}. Thus {implicit_cast} also belongs there. R=tebbi@chromium.org Bug: v8:7570 Change-Id: Iaea6075dad359d62498453575f22d73ca84e2323 Reviewed-on: https://chromium-review.googlesource.com/1042401 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#52991}
-
Ben L. Titzer authored
This CL factors the parts of the JSGraph that only depend on the machine part of JSGraph into a separate base class, MachineGraph. This helps separate the two layers and also allows the MachineGraph to be constructed without an Isolate, which is needed for fully asynchronous compilation, a goal for WASM. R=mstarzinger@chromium.org CC=jarin@chromium.org, mvstanton@chromium.org BUG=v8:7721 Change-Id: Ie8bc3de40159332645dcb3cadcee581e1bf9830a Reviewed-on: https://chromium-review.googlesource.com/1043746Reviewed-by:
-
Clemens Hammacher authored
Add binop tests for div and rem of i32 and i64. The test is extended to handle traps, and to check that the value of local variables is not affected by the operation. R=titzer@chromium.org Bug: v8:6600, chromium:839800 Change-Id: I1a4cbc40bd399666d9831d021afb96e0c53a9f64 Reviewed-on: https://chromium-review.googlesource.com/1044166Reviewed-by:
-
Michael Achenbach authored
Bug: chromium:830557 Change-Id: I99bfa92f46a03782232e6949dd437afb5a3f6c26 Reviewed-on: https://chromium-review.googlesource.com/1043866Reviewed-by:
Sergiy Byelozyorov <sergiyb@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#52988}
-
Clemens Hammacher authored
In order to get more test coverage (also on ClusterFuzz), stage Liftoff and tier up behind --future. R=hablich@chromium.org CC=titzer@chromium.org Bug: v8:6600 Change-Id: I718e17957b26f60aa4c002333035f693344806e0 Reviewed-on: https://chromium-review.googlesource.com/1042385Reviewed-by:
Michael Hablich <hablich@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#52987}
-
Wez authored
The Promoted* prefix was used to refer both to the total number of old generation objects, and to the delta of objects moved from the new to old generations. PromotedTotalSize() is also renamed, to reflect the actual calculation it performs Bug: chromium:837583 Change-Id: Id27a0661618257ef64eb469a83bb49c0e8ce6923 Reviewed-on: https://chromium-review.googlesource.com/1042314 Commit-Queue: Wez <wez@chromium.org> Reviewed-by:
Hannes Payer <hpayer@chromium.org> Cr-Commit-Position: refs/heads/master@{#52986}
-
Michael Starzinger authored
This is a reland of a0c57368 Original change's description: > [wasm] Maintain link from Instance to Module. > > This moves the link from a {WasmInstanceObject} to its corresponding > {WasmModuleObject} into the right place and also makes it strong. This > ensures that an instance always keeps the underlying module alive and > hence removes the situation of an "orphaned instance". > > R=clemensh@chromium.org > > Change-Id: Id59f6a49740af8ef0248679c3d2c696bb9776944 > Reviewed-on: https://chromium-review.googlesource.com/1041691 > Reviewed-by: Clemens Hammacher <clemensh@chromium.org> > Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> > Cr-Commit-Position: refs/heads/master@{#52942} Change-Id: I9854400bfc1d22bd258f17118fcb7460cdc3acd5 Reviewed-on: https://chromium-review.googlesource.com/1043786Reviewed-by:
-
Daniel Clifford authored
- In debug builds, 'assert(<expr>)' evaluates and aborts execution if the provided Torque expression is false at runtime. assert(<expr>) supports the same set of expressions protocols as Toruqe's if statement, i.e. both bool values and BranchIf- style tests. Upon failure, the assertion prints the Torque source code of the failed expression, not the generated CSA code. - 'unreachable' calls CSA's Unreachable() and signals to Torque that code execution cannot continue (i.e. its statement returns the 'never' type). In debug builds, the line number and position of the statement are printed before breaking. - 'debug' calls CSA's DebugBreak(). In debug builds, the line number and position of the 'debug' are printed before breaking. Change-Id: I4efd052536bb402c097a0d5f7be56e154b5b3676 Reviewed-on: https://chromium-review.googlesource.com/1042570 Commit-Queue: Daniel Clifford <danno@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#52984}
-
Toon Verwaest authored
Instead rely on the scope info containing the name as well. Change-Id: Ie1f96ea023a793b11209510566f6831b1dfd40ab Reviewed-on: https://chromium-review.googlesource.com/1042567 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by:
-
Miran.Karic authored
The CL fixes the mips port in the CL [debug] introduced runtime side effect check (7a2c3713), that caused several test failures. BUG= Change-Id: Ia1b45fd57d7b77c912562c97f7fc6bf2aa378fe2 Reviewed-on: https://chromium-review.googlesource.com/1030193Reviewed-by:
Ivica Bogosavljevic <ivica.bogosavljevic@mips.com> Commit-Queue: Miran Karić <miran.karic@mips.com> Cr-Commit-Position: refs/heads/master@{#52982}
-
Toon Verwaest authored
Bug: v8:7066 Change-Id: Icfcb40b2048997c158fba5f3e250145bed4ca1e3 Reviewed-on: https://chromium-review.googlesource.com/1042386 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by:
-
Wez authored
Change-Id: I58f3eb9259822650a3b31010213e3df030821be2 Reviewed-on: https://chromium-review.googlesource.com/1042187Reviewed-by:
-
Michael Starzinger authored
This makes sure that allocations of {HeapNumber} objects happening in the JS-to-Wasm and Wasm-to-JS wrappers are ordered with respect to changes of the {trap_handler::IsThreadInWasm} predicate. Otherwise the compiler can (and will) move the allocations across changes of this predicate and cause safety checks to fire. R=clemensh@chromium.org Change-Id: I5366ec0c184929fbd5b60c827d9908fb6ca1d91a Reviewed-on: https://chromium-review.googlesource.com/1042399 Commit-Queue: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: -
Clemens Hammacher authored
The grow_memory opcode basically just executes a runtime call, but needs to check a condition first, and convert to and from Smi. R=titzer@chromium.org Bug: v8:6600 Change-Id: If7d62a8bb0ca6d02bd47ef6048cc65da502b002b Reviewed-on: https://chromium-review.googlesource.com/1042185 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
-
Clemens Hammacher authored
On arm64, we had {RegisterBase::bit} (defined in assembler.h) and {CPURegister::bit} (defined in assembler-arm.h). {CPURegister} inherits from {RegisterBase}. The two methods methods have different behaviour on the special {no_reg}, which is only relied on in very few places. This CL fixes these places to avoid the use of {no_reg}, and removes the overwritten method. R=mstarzinger@chromium.org CC=rodolph.perfetta@arm.com Change-Id: I859cc0d4ffc48fae018ee262f3e5403774db87a8 Reviewed-on: https://chromium-review.googlesource.com/1042188Reviewed-by:Rodolph Perfetta <rodolph.perfetta%arm.com@gtempaccount.com> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#52977}
-
Erik Luo authored
Side effect free whitelist now - supports 'typeof' when it performs Load operations - runtime checks for Array.p.splice Bug: v8:7588 Change-Id: I45bcd705f8d3f2d2ee61f018566439bf56d1bcbc Reviewed-on: https://chromium-review.googlesource.com/1037926Reviewed-by:
-
v8-autoroll authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/34746fc..55b398a Rolling v8/third_party/android_ndk: https://chromium.googlesource.com/android_ndk/+log/635bc38..5cd8631 Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/978be74..153134e TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org Change-Id: Id123826d5fd7df1c53f2e2bb36591c9e29e20833 Reviewed-on: https://chromium-review.googlesource.com/1043431Reviewed-by:
v8 autoroll <v8-autoroll@chromium.org> Commit-Queue: v8 autoroll <v8-autoroll@chromium.org> Cr-Commit-Position: refs/heads/master@{#52975}
-
- 03 May, 2018 14 commits
-
-
Jakob Kummerow authored
Since 94ce16b7, when loading an iterator from null or undefined, we generate the error message "x is not iterable" instead of the unwieldy "Cannot read property 'Symbol(Symbol.iterator)' of undefined". However Runtime::GetObjectProperty, which is used as slow path by LoadICs, did not check for this case, leading to different messages being generated depending on IC state. Bug: chromium:823130 Change-Id: Ie98500b97efef401aac9880b9af47d58c3c2825d Reviewed-on: https://chromium-review.googlesource.com/1042951Reviewed-by:
Sathya Gunasekaran <gsathya@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#52974}
-
Junliang Yan authored
Port 519bd47f Original Commit Message: With the exception of the InterpreterEntryTrampoline, all builtins are now isolate-independent and can be embedded into the binary. This CL updates the corresponding list and also contains a few smallish tweaks to support having these builtins off the heap: * wasm: copy the off-heap builtin, not its trampoline. * Code::contains: support off-heap builtins. * JSFunction::is_compiled: compare builtin index instead of identity (this is relevant during mksnapshot when we transition from the on-heap builtin to its off-heap representation + the trampoline). * Remove old DCHECKs. * A few tweaks in macro-assembler ports that have snuck in recently. R=jgruber@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com BUG= LOG=N Change-Id: Ib16ce35f5ebdade42720f536ac521c79e7c46778 Reviewed-on: https://chromium-review.googlesource.com/1042927Reviewed-by:
Joran Siu <joransiu@ca.ibm.com> Commit-Queue: Junliang Yan <jyan@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#52973}
-
Junliang Yan authored
This is a reland of dfdc3135 Original change's description: > PPC/s390: [interpreter] correctly advance over debug scaling prefixes. > > Port 7a07d74b > > R=yangguo@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com > BUG= > LOG=N > > Change-Id: I99553fde819cbdc8a12df5b82d9d7230ba4ef8b3 > Reviewed-on: https://chromium-review.googlesource.com/1042355 > Commit-Queue: Junliang Yan <jyan@ca.ibm.com> > Reviewed-by: Joran Siu <joransiu@ca.ibm.com> > Cr-Commit-Position: refs/heads/master@{#52970} Change-Id: I012e79ef5fbff37a8ded8c8cf5d4aaf324cd6ccb Reviewed-on: https://chromium-review.googlesource.com/1043026Reviewed-by:
-
Junliang Yan authored
This reverts commit dfdc3135. Reason for revert: <INSERT REASONING HERE> Original change's description: > PPC/s390: [interpreter] correctly advance over debug scaling prefixes. > > Port 7a07d74b > > R=yangguo@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com > BUG= > LOG=N > > Change-Id: I99553fde819cbdc8a12df5b82d9d7230ba4ef8b3 > Reviewed-on: https://chromium-review.googlesource.com/1042355 > Commit-Queue: Junliang Yan <jyan@ca.ibm.com> > Reviewed-by: Joran Siu <joransiu@ca.ibm.com> > Cr-Commit-Position: refs/heads/master@{#52970} TBR=yangguo@chromium.org,michael_dawson@ca.ibm.com,jyan@ca.ibm.com,joransiu@ca.ibm.com Change-Id: I04fadaa81a6dd124811c002ab4ffa61e3785b717 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/1043025Reviewed-by:
Junliang Yan <jyan@ca.ibm.com> Commit-Queue: Junliang Yan <jyan@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#52971}
-
Junliang Yan authored
Port 7a07d74b R=yangguo@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com BUG= LOG=N Change-Id: I99553fde819cbdc8a12df5b82d9d7230ba4ef8b3 Reviewed-on: https://chromium-review.googlesource.com/1042355 Commit-Queue: Junliang Yan <jyan@ca.ibm.com> Reviewed-by:
-
Junliang Yan authored
Port ab9e0124 Original Commit Message: Original CL: https://crrev.com/c/1018468 During code generation, we generate self-references (i.e. references to the Code object currently being generated) as references to a temporary handle. When the final Code object has been allocated, the handle's location is fixed up and RelocInfo iteration fixes up all references embedded in the generated code. This adds support for this mechanism to the builtins constants table builder. CodeObject() is now a new handle pointing to a dedicated self-reference marker in order to distinguish between self-references and references to undefined. In Factory::NewCode, we patch up the constants table. R=jgruber@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com BUG= LOG=N Change-Id: Iba0f4435125b9d6c3fda7fc3e9836494b6eb6f45 Reviewed-on: https://chromium-review.googlesource.com/1042216Reviewed-by:
-
Junliang Yan authored
Port a9db2c74 R=marja@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com BUG=v8:5402,v8:7570 LOG=N Change-Id: Ife3c7463066eb747c27c1479c76106b51e568f92 Reviewed-on: https://chromium-review.googlesource.com/1042451Reviewed-by:
-
Camillo Bruni authored
This is a preparatory CL to find a potential regression on x86. Bug: chromium:835558 Change-Id: I3859b59d1497d4b7447ad38ee352cf4bbdeb4502 Reviewed-on: https://chromium-review.googlesource.com/1027842 Commit-Queue: Camillo Bruni <cbruni@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#52967}
-
Michael Achenbach authored
TBR=santa Change-Id: I3841ddfd3de67dfe7f18d4f0d36c68d8b83da651 Reviewed-on: https://chromium-review.googlesource.com/1042574Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#52966}
-
Bill Budge authored
- Separates measuring from wasm::SerializeNativeModule so caller can allocate or reserve the buffer memory. Call site thus avoid one unnecessary copy. Bug: chromium:719007 Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng Change-Id: I50412c0c0279114dcdc1aead810ad39e7c4e2a6e Reviewed-on: https://chromium-review.googlesource.com/1039183 Commit-Queue: Bill Budge <bbudge@chromium.org> Reviewed-by:
-
Vincent Belliard authored
Bug: v8:6600 Change-Id: I1d8447349f73985653d3124c2b76d8756b0bf30a Reviewed-on: https://chromium-review.googlesource.com/1040673 Commit-Queue: Vincent Belliard <vincent.belliard@arm.com> Reviewed-by:
-
Vincent Belliard authored
Define and use TurboAssembler::AssertUnreachable Bug: v8:6600 Change-Id: I6901896ea4fd7e0fe24dd76a1afbb409a24a2994 Reviewed-on: https://chromium-review.googlesource.com/1040766 Commit-Queue: Vincent Belliard <vincent.belliard@arm.com> Reviewed-by:
-
Vincent Belliard authored
Bug: v8:6600 Change-Id: I9e4b4770286cb08e83dd5dbf9b5ae5cfd7d4d411 Reviewed-on: https://chromium-review.googlesource.com/1040649 Commit-Queue: Vincent Belliard <vincent.belliard@arm.com> Reviewed-by:
-
Vincent Belliard authored
Bug: v8:6600 Change-Id: If52fd4600c178354cb0631d062be71d19cc10a89 Reviewed-on: https://chromium-review.googlesource.com/1040669 Commit-Queue: Vincent Belliard <vincent.belliard@arm.com> Reviewed-by:
-
