- 08 Sep, 2022 40 commits
-
-
Greg Thompson authored
In the process, switch to using the Fuchsia GN SDK templates for building the component and package. Bug: v8:12589 Change-Id: I9b5a82accb0da2067e83bc80d691133550ce82cd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879501 Auto-Submit: Greg Thompson <grt@chromium.org> Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Reviewed-by:
Alexander Schulze <alexschulze@chromium.org> Reviewed-by:
Victor Gomes <victorgomes@chromium.org> Commit-Queue: Greg Thompson <grt@chromium.org> Cr-Commit-Position: refs/heads/main@{#83084}
-
Samuel Groß authored
Now that all external pointers have been sandboxed, V8_SANDBOXED_EXTERNAL_POINTERS is no longer needed. This change also shrinks external pointer slots to 32 bits when the sandbox is enabled. Bug: v8:10391 Change-Id: Iccbef27ac107b988cb23fe9ef66da6fe0bae087a Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3869269Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Manos Koukoutos <manoskouk@chromium.org> Reviewed-by:
Nico Hartmann <nicohartmann@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#83083}
-
Leszek Swirski authored
Support LoadHandler::Kind::kAccessorFromPrototype, which is an accessor on the prototype and is a direct call to the accessor. Bug: v8:7700 Change-Id: I288972c027d37c8eb7c3558db4951bffdfba201f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3882975 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
-
Victor Gomes authored
This mimics Ignition, which calls AbortIfRegisterCountInvalid. This adds a --maglev-assert flag, since we do not want to emit different code per IR node for debug vs. release modes. Bug: v8:7700 Change-Id: Iddb17f0ccadf9d6009b242883b2e5d126875c844 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3876385Reviewed-by:
-
Omer Katz authored
Inlining of bar into foo required taking allocation in foo into account as well (crrev.com/c/1021734), but this makes the test vulnerable to gc timing changes since other allocations are also inlined into foo and may die at arbitrary times (as observed when enabling MinorMC). Fix by preventing inlining of bar into foo. Bug: v8:12612 Change-Id: I2d8848d4002334d329c4b2cc8f18bff1296f5cc1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3882970Reviewed-by:
Dominik Inführ <dinfuehr@chromium.org> Auto-Submit: Omer Katz <omerkatz@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#83080}
-
Dominik Inführ authored
Currently this observer uses 80% of initial new space capacity as step size. But this means that after the first minor GC this will most likely decouple from the current new space size since the allocation counter isn't reset after a GC and surviving objects aren't accounted. Use 64K as step-size since this should be large enough to not cause regression but it should still work for Scavenger and Minor MC such that a step invocation will be performed close to reaching 80% of new space capacity. Bug: v8:12612 Change-Id: I4abc17eaeded90e0f72d9467a4410159ef0e6dda Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879618Reviewed-by:
Omer Katz <omerkatz@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#83079}
-
Omer Katz authored
Drive-by: merge all collector choosing criteria into SelectGarbageCollector. Bug: v8:12612 Change-Id: I84d9e1aa5f658f48d5deeab1a8ef49ed1871cba5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879608Reviewed-by:
-
Leszek Swirski authored
Change the constructor and instance registers into a single constructor_then_instance register, and add some register allocation scopes to reduce temporary register use. This also allows us to change FindNonDefaultConstructor to only need one output for both constructor and instance. Also make BuildCreateArrayLiteral a bit more friendly to the interpreter register allocation., Bug: v8:13091 Change-Id: I0b6015b0bc6810bb4607157d715b7e536efb89f3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3876386Reviewed-by:
Marja Hölttä <marja@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#83077}
-
Marja Hölttä authored
I.e., implement a baseline handler for the FindNonDefaultConstructor bytecode. Bug: v8:13091 Change-Id: If1b119ae0479e54d2a89143bf8f40faeadb1abaf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3871206Reviewed-by:
-
Camillo authored
Skip over DCHECK in fuzzing that is always checked later by getting the value from a Maybe object. Bug: chromium:1359230, chromium:1360735 Change-Id: I9512e27fdeb1d6919e24bd631ae2caece7aed466 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3874934 Commit-Queue: Camillo Bruni <cbruni@chromium.org> Reviewed-by:
Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#83075}
-
Milad Fa authored
Port b2576418 Original Commit Message: Re-implement the --log-function-events functionality after refactoring the tiering state bits on the FeedbackVector. The new version also tries to log first-execution of non-interpreter code and will handle OSR events. Not-yet supported: - First-execution logging when OSR-ing in Sparkplug or Maglev R=cbruni@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com BUG= LOG=N Change-Id: I2a99ca0976bc81e5994fa2e1c6d8045c303fc0f1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3876375Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Commit-Queue: Milad Farazmand <mfarazma@redhat.com> Cr-Commit-Position: refs/heads/main@{#83074}
-
Dominik Inführ authored
We used to remove the page from the space in the "evacuation" phase, such that the following "update pointers" phase wouldn't try to update pointers for evacuation candidates. In this CL we move page removal to ReleaseEvacuationCandidates() which is run after the "update pointers" phase finished. In the "update pointers" we can skip evacuation candidates to not update pointers on those pages. That way PostProcessEvacuationCandidates() can be renamed to PostProcessAbortedEvacuationCandidates() since it now only handles aborted evacuation candidates. Bug: chromium:1359294, v8:12578 Change-Id: Ifc4f58d71b630c3ef72f2bd994fedeabba878945 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879486Reviewed-by:
-
Dominik Inführ authored
Move clearing of markbits in the evacuated area into ReRecordPage, which also resets all other metadata for that memory area. Since this case is now handled in ReRecordPage, all other use cases can delete markbits for the whole chunk and allows the VisitBlackObjects* methods to not deal with markbits anymore. Bug: chromium:1359294, v8:12578 Change-Id: Ic98debe04efb7f415cf06efb58af0f728071aa65 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879499Reviewed-by:
-
Teodor Dutu authored
This reverts commit f97f7d79. Reason for revert: a simpler approach will be used instead. Original change's description: > [ptr-compr-8gb] Align Turbofan allocations to 8 bytes > > In order to support a larger heap cage (8GB, 16GB), the cage offset > will take up more than 32 bits. As a consequence, for 8GB cages, the > least significant bit of the cage offset will overlap with the most > significant bit of the tagged offset. To avoid this, allocations need > to be aligned to 8 bytes to free up one bit from the offset. > > All changes are deactivated behind the build flag > `v8_enable_pointer_compression_8gb`. Allocation folding is not yet > supported. > > Bug: v8:13070 > Change-Id: I602c71232e98eac4e2701b0922704a7adc31a662 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3817741 > Commit-Queue: Teo Dutu <teodutu@google.com> > Reviewed-by: Marja Hölttä <marja@chromium.org> > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Tobias Tebbi <tebbi@chromium.org> > Cr-Commit-Position: refs/heads/main@{#82331} Bug: v8:13070 Change-Id: Id2186898596847142a80aba7604e870093a26d8b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879224Reviewed-by:
-
JialuZhang-intel authored
Before: 488bd6 REX.W movq rdx, rsi After: 8bd6 movl rdx, rsi This CL can save a 1-byte encoding length for move instruction. Change-Id: Ief482b4093f22ab810dbc693e8d9ed55a8c14c84 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3875397 Commit-Queue: Jialu Zhang <jialu.zhang@intel.com> Reviewed-by:
-
Camillo authored
- Add gcert/gcertstatus support for chrome helper - Skip pprof uploading for non-googlers - Print better local results instructions for multiple chromium results files - Fix docs link in --help text - Exit silently when a keyboard interrupt ocurred Drive-by-fix: - format files - sort imports Change-Id: I88bae27102dbf3d560c4203774d9746e96fdbdc5 No-Try: True No-CQ: True Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3878166Reviewed-by:
-
Ilya Rezvov authored
This is a reland of commit 0a1a579a The original CL has a bag in assigning no_reg to scoped Register variable. To fix it Scoped guard was added for automated release of scoped registers. Original change's description: > Port JS-Wasm Promise Integration for arm64 > > > Port Generic JS-Wasm Wrapper for arm64 > > Change-Id: I256e6511d47af9ab04c577beb6b829dfee34a6ed > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3841074 > Commit-Queue: Ilya Rezvov <irezvov@chromium.org> > Reviewed-by: Thibaud Michaud <thibaudm@chromium.org> > Cr-Commit-Position: refs/heads/main@{#83038} Change-Id: I7b8b355f5689e51529223f1156e74e980c3b50ea Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879492Reviewed-by:
Thibaud Michaud <thibaudm@chromium.org> Commit-Queue: Ilya Rezvov <irezvov@chromium.org> Cr-Commit-Position: refs/heads/main@{#83068}
-
Leszek Swirski authored
Bug: v8:7700 Change-Id: I4efa8f8b3b7df03b3fb6b6bd35c7310b0da07d49 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879613 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Jakob Linke <jgruber@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Jakob Linke <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#83067}
-
Al Muthanna Athamina authored
Bug: v8:7700 Change-Id: Ieff3e3b053f418e73699a208993c4d0771326522 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879614 Auto-Submit: Almothana Athamneh <almuthanna@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Reviewed-by:
-
Thibaud Michaud authored
Add the missing KB multiplier. Also add a flag to set the fixed stack size. R=clemensb@chromium.org Bug: v8:12191 Change-Id: I9782192d2eef1986286f726a05444a4bec49fc66 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3875902Reviewed-by:
Clemens Backes <clemensb@chromium.org> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Cr-Commit-Position: refs/heads/main@{#83065}
-
Leon Bettscheider authored
ShouldFinalize should only be called if major incremental marking is active, and can crash if minor incremental marking is active, if MajorMC's local_marking_worklists_ was reset. The only caller is IsMarkingComplete. This CL changes the IsMarking check to IsMajorMarking to solve this issue, and renames IsMarkingComplete to IsMajorMarkingComplete. Bug: v8:13012 Change-Id: Iba6bd5b7977ec8566c3ab0f047646d8cafd45038 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879485 Commit-Queue: Leon Bettscheider <bettscheider@google.com> Reviewed-by:
-
Victor Gomes authored
BytecodeArray::Disassemble fails a SLOW_DCHECK when invoking from a background thread, due to the little hack to recover the handle inside the function. This CL changes the method to static with a handle as input. The old method calls the static one, since it is allowed to be called by the main thread. Change-Id: I3546f0d2b160d15386da0980efc539693672c230 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879498 Auto-Submit: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
-
Michael Achenbach authored
Bug: v8:13113 Change-Id: Ie42a654378660e4a2dc45d53d40683281e7343dd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879496Reviewed-by:
-
Omer Katz authored
Fix broken DCHECK: When using MinorMC, new space is a paged space and only uses the TO_PAGE page flag. New large object space however still uses both TO_PAGE and FROM_PAGE page flags. With MinorMC it still possible to find reference to FROM_PAGEs, but those pages have to be large pages. Fix broken test: MinorMC may only free empty pages when shrinking. Therefore, shrink may actually not change the space capacity at all (e.g. when all pages have live objects on them). More specifically, the capacity is not guaranteed to be half the previous capacity. Bug: v8:12612 Change-Id: Ib0edcafd758828f821f82bc8c796c205f162809c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879493Reviewed-by:
-
Omer Katz authored
On allocation failure in new space we used to do at most 2 GCs before calling the near heap limits callback. The 2 GCs would empty new space, thus insuring that the current allocation can succeed. With MinorMC the 2nd GC has no effect and we should do a full GC instead to empty new space. Bug: v8:12612 Change-Id: I4f767136283b5d26fee4f4a3998359b3c1e2108b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879495Reviewed-by:
-
Leszek Swirski authored
For accessors, instead of storing the descriptor index + holder in the LoadHandler, store the getter directly (avoiding the map->descriptor->pair->getter hops). For the non-prototype case, where there's no LoadHandler, store the AccessorPair directly as a weak handler instead of the Smi handler. We can't store the getter here directly, because it could be in new space, and then we can't use it in the stub cache. Required some rejiggling of ic.cc method signatures, to allow ComputeHandler to return a weak ref. Change-Id: I22c0e64bec9880a3ba23c2d1eeb3a1c23179ca4b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3865557Reviewed-by:
-
Matthias Liedtke authored
assertEquals() compares objects by comparing each property for both objects. This was done by using Object.keys() which however only returns enumerable properties. With this change also non-enumerable properties are compared. Still, the comparison doesn't require the properties to be equal. So, if one property is marked enumerable in one object but not the other, the objects would still be considered equal. This could be adapted in a follow-up CL if desired. The prototype is still ignored for the comparison. Change-Id: I1bb9df055bfb764ac1c02d971ac6f4a50f4a98e8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3876384 Commit-Queue: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by:
-
Jakob Linke authored
This is a reland of commit 24e60017 The reland changes %ClearFunctionFeedback to clear *all* feedback slot kinds including binary/compare/for-in slots. In the tests we thus no longer have to resort to tricks to restore the function to it's initial state, instead simply call %ClearFunctionFeedback. Original change's description: > [maglev] Deopt on overflow in >>> > > Re-enable the int32 fast path for ShiftRightLogical, but account for > Maglev's missing signed/unsigned representation tracking by a) > removing rhs==0 as the identity value (a shift by 0 is still a > signed-unsigned conversion) and b) deoptimizing if the result cannot > be converted to a non-negative smi. > > Note this is not a deopt loop, since a non-smi result will change the > feedback to kSignedSmallInputs (from kSignedSmall). > > To fix this properly, we should track signed/unsigned representations > and convert the result to a heap number if it doesn't fit within smi > range. > > Bug: v8:7700 > Change-Id: Ifd538d227a6f1290eb7f008d9bfad586ff91ea0f > Fixed: v8:13251 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3876366 > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Commit-Queue: Jakob Linke <jgruber@chromium.org> > Cr-Commit-Position: refs/heads/main@{#83025} Bug: v8:7700 Change-Id: I2f607a0fb863b80e8589c9c1e86ee31fbac48c25 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879491 Auto-Submit: Jakob Linke <jgruber@chromium.org> Commit-Queue: Jakob Linke <jgruber@chromium.org> Reviewed-by:
-
Michael Achenbach authored
Bug: v8:13113 Change-Id: I7cd37446d9ecbe271e0e5df96a4dcfd43b307c27 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879489Reviewed-by:
-
Leszek Swirski authored
Attempting to set a FunctionTemplate without a code handler as an accessor for a property will fail in the runtime, which expects to be able to call the handler. Add an API check that guards against this. Change-Id: I270f0ca3d20de507bc9bde2c4c8d23b2614313dd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879490Reviewed-by:
-
Victor Gomes authored
The current abort will crash if the generator is created by the interpreter and resumed by the maglevved code. This current workaround is not ideal since it can introduce a deopt-reopt loop. Bug: v8:7700, v8:13109 Change-Id: I7db71a896711255d866ace98eddde85538aa2903 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879228 Auto-Submit: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Jakob Linke <jgruber@chromium.org> Reviewed-by:
-
Jakob Linke authored
Bug: v8:7700 Change-Id: Ie9be2aaf0a75cf1fd19f50ce4697f71e92a36df6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879223Reviewed-by:
-
Shu-yu Guo authored
Bug: v8:11111 Change-Id: I4af1cc85a15833c360a5a454f8d36f43840232ad Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3878254Reviewed-by:
-
Victor Gomes authored
Change-Id: If4c6792d36423daafb2a4454354db2d9e4abe297 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879229Reviewed-by:
-
Dominik Inführ authored
At the moment the shared heap is internally implemented as its own isolate - the shared isolate. This CL prepares to remove the shared isolate and replace it with shared spaces in the main isolate. This CL introduces the --shared-space flag to opt-in into this shared heap-approach. Isolate::is_shared_space_isolate() and Isolate::shared_space_isolate() are added as well to identify the main isolate (or shared space isolate). Bug: v8:13267 Change-Id: I1a79c839de3b3b9cc988401e2e6e70ce3b02fa22 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3874928Reviewed-by:
Shu-yu Guo <syg@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#83050}
-
Jakob Linke authored
.. to increase bus factor in EU time zones. Change-Id: I7f1bca0fd765f8f1720ff5534823b4daaa290ea3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879488 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
-
Feng Yu authored
Bug: None Change-Id: I8cf2e4b651c0ccb784a5d668656cbfcd573b271d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3878450Reviewed-by:
-
Dominik Inführ authored
Set COMPACTION_WAS_ABORTED page flag also when aborting evacuation due to OOM. Bug: chromium:1359294, v8:12578 Change-Id: Ia9833dbf9213375698cb7b1595ade7df5e24189d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3877145Reviewed-by:
-
Frank Tang authored
The days is passing incorrectly between calls. Spec text: https://tc39.es/proposal-temporal/#sec-temporal-differencetemporalplaindatetime Bug: v8:11544 Change-Id: If818d0f42bdd3260e68eef2c6aba1c3781632c93 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3857869 Commit-Queue: Frank Tang <ftang@chromium.org> Reviewed-by:
Adam Klein <adamk@chromium.org> Cr-Commit-Position: refs/heads/main@{#83046}
-
Frank Tang authored
Access the correct years, months and weeks which modified previously instead of the value from the input. Spec text: https://tc39.es/proposal-temporal/#sec-temporal-roundduration Bug: v8:11544 Change-Id: I2ffaca5545e2359bc1cc03320068424bba4c7907 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3860649Reviewed-by:
-
