- 25 Jun, 2020 9 commits
-
-
Jakob Gruber authored
... and extend JS node wrapper functionality. Node wrappers now have accessors for value inputs and context/control/effect/frame-state inputs. Accessors are typed, although types aren't very meaningful so far (in current examples we only distinguish between Object/HeapObject). The following node kinds now take an additional feedback vector input, and use the new node wrapper functionality above: - CloneObject - CreateLiteralArray - CreateLiteralObject - CreateLiteralRegExp - GetIterator - GetTemplateObject - HasProperty - LoadProperty - StoreProperty Bug: v8:8888 Change-Id: I1eb33c078b11725a72ec983bbaa848b9a3c7b0d9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2259936 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#68538}
-
Maya Lekova authored
This reverts commit 2b6b85ab. Reason for revert: Broken Android builder https://cr-buildbucket.appspot.com/build/8876523558361397488 Original change's description: > Update V8 DEPS. > > Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/2dc7c7a..876a780 > > Rolling v8/third_party/aemu-linux-x64: UoYLOT0X6577j70eB9nPqYQs9Z3Nh5lA4I-pRtTchO0C..YFi4RbbToiNVSl0eKxjhhhAElSEXx2Y9i-5Q4eBGkUwC > > Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/95c1f42..761dfad > > Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/35c6274..87c8b91 > > Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/02daed1..93be846 > > Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/42b285f..62d4c43 > > TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com > > Change-Id: Ia948991c7735b13585cf12a7ccfb0e372ab86320 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2266393 > Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> > Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> > Cr-Commit-Position: refs/heads/master@{#68536} TBR=machenbach@chromium.org,v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com Change-Id: Ieea4f4fca222c053014bea68c4020ee27fa4a0d2 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2264104Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#68537}
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/2dc7c7a..876a780 Rolling v8/third_party/aemu-linux-x64: UoYLOT0X6577j70eB9nPqYQs9Z3Nh5lA4I-pRtTchO0C..YFi4RbbToiNVSl0eKxjhhhAElSEXx2Y9i-5Q4eBGkUwC Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/95c1f42..761dfad Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/35c6274..87c8b91 Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/02daed1..93be846 Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/42b285f..62d4c43 TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com Change-Id: Ia948991c7735b13585cf12a7ccfb0e372ab86320 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2266393Reviewed-by:
v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#68536}
-
Thibaud Michaud authored
- Add a separate function to load return slots, instead of encoding this in the offset, - Add fast path for single return. Drive-by: Reuse helper function for stack slot loads on ia32 and x64. R=clemensb@chromium.org Bug: v8:10576 Change-Id: Iea5ad2f0982c443cf2297227e9a2367cbb14581f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2264099Reviewed-by:
Clemens Backes <clemensb@chromium.org> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Cr-Commit-Position: refs/heads/master@{#68535}
-
Clemens Backes authored
This method was there to turn a trap into an exception. It's not used any more, so can be removed. R=ahaas@chromium.org Bug: v8:10389 Change-Id: I39bb3141722ddf1e09271348016c1d6f6d72b928 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2264103Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#68534}
-
Clemens Backes authored
This removes several dead functions from the wasm-module-runner.cc. R=ahaas@chromium.org Change-Id: I35efbc6960a28f41d14ca5d8e828c4e6f2953409 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2264100Reviewed-by:
-
Mike Stanton authored
Currently the FeedbackVector uses arrays in slots that are polymorphic, usually in a <map, handler> tuple pattern. Helper functions try to re-use an existing array if it's already in place. For Concurrent TurboFan, it would be far better if these FixedArrays were immutable. We could then count on semantic correctness when harvesting their information from a background thread without locking. Additionally, the arrays should always be initialized fully before being set in place. Bug: v8:7790 Change-Id: I81eae3bda48c2d0d8eea41d1bc9c62afb7e619d5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2264364Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Commit-Queue: Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#68532}
-
Peter Ralbovsky authored
Change-Id: Ia303e0384aee4f6998599fc9f04104517c51aa66 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2249663 Commit-Queue: Peter Ralbovsky <ralbovsky@google.com> Reviewed-by:
Michael Stanton <mvstanton@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#68531}
-
Jakob Kummerow authored
We can walk linear prototype chains using iteration instead of recursion, reducing the likelihood (though not excluding the possibility) that large prototype-relation graphs will run into a stack overflow. This partial mitigation should be performance neutral. Bug: v8:10522 Change-Id: Ia266efe38a9cc52fe6ab2189066f45c4566f3596 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2245591Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#68530}
-
- 24 Jun, 2020 31 commits
-
-
Shu-yu Guo authored
This is a reland of f0c9e932 TBR=machenbach@chromium.org Original change's description: > [test] Add is_cfi variable for test status files > > Bug: v8:10640 > Change-Id: Ifa485c285f345ca1ffba949feb8fc70b160a018c > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2264627 > Reviewed-by: Michael Achenbach <machenbach@chromium.org> > Commit-Queue: Shu-yu Guo <syg@chromium.org> > Cr-Commit-Position: refs/heads/master@{#68523} Bug: v8:10640 Change-Id: Iabf005127eea412b991f3f59d9e786f3c1eb7891 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2265240 Commit-Queue: Shu-yu Guo <syg@chromium.org> Reviewed-by:
Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/master@{#68529}
-
Shu-yu Guo authored
This reverts commit f7a1932e. Reason for revert: Breaking wasm wpt tests: https://ci.chromium.org/p/v8/builders/ci/V8%20Blink%20Linux/5408 Original change's description: > [wasm] Re-exported globals preserve their identity > > V8 fails a recently added spec test that when an imported global get > re-exported, it should preserve its identity. This CL fixes the behavior > in V8. > > Drive-by change: fix the object printer of globals: a global which > stores a reference type only has a tagged buffer, a global which stores > a value type only has an untagged buffer. > > R=clemensb@chromium.org > > Bug: v8:10556 > Change-Id: I949d147fe4395610cfec6cf60082e1faecb23036 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2235702 > Commit-Queue: Andreas Haas <ahaas@chromium.org> > Reviewed-by: Clemens Backes <clemensb@chromium.org> > Cr-Commit-Position: refs/heads/master@{#68513} TBR=ahaas@chromium.org,clemensb@chromium.org Change-Id: I06eb1996cafe7d4e93a7e59d21679fea239cf961 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:10556 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2264956Reviewed-by:
-
Shu-yu Guo authored
This reverts commit f0c9e932. Reason for revert: Suspicion of breaking infra somehow Original change's description: > [test] Add is_cfi variable for test status files > > Bug: v8:10640 > Change-Id: Ifa485c285f345ca1ffba949feb8fc70b160a018c > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2264627 > Reviewed-by: Michael Achenbach <machenbach@chromium.org> > Commit-Queue: Shu-yu Guo <syg@chromium.org> > Cr-Commit-Position: refs/heads/master@{#68523} TBR=machenbach@chromium.org,syg@chromium.org Change-Id: I9a71ac443d64d2e8121f6a7ea52af833bb8add36 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:10640 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2264953Reviewed-by:
-
Ng Zhi An authored
Prototype f32x4.nearest on ARM for both ARM v7 and ARM v8. ARM v8 has support for vrintn, and for ARM v7 we fallback to runtime. Since ARM v8 uses vrintn, which is the same instruction used for F32RoundTiesEven (scalar), wasm-compiler reuses the Float32RoundTiesEven check. Bug: v8:10553 Change-Id: I066b8c5f10fd86294afe1c530c516493deeb7b53 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2258037Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Deepti Gandluri <gdeepti@chromium.org> Commit-Queue: Zhi An Ng <zhin@chromium.org> Cr-Commit-Position: refs/heads/master@{#68526}
-
Manos Koukoutos authored
Bug: v8:7748 Change-Id: Ic55c1aeb2bceb72dff1338c4d9cbde9aa799f25a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2262914 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by:
-
Manos Koukoutos authored
Bug: v8:7748 Change-Id: I45a8f1398554da8a9543c866b4125fd9711e230b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2263933 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by:
-
Shu-yu Guo authored
Bug: v8:10640 Change-Id: Ifa485c285f345ca1ffba949feb8fc70b160a018c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2264627Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/master@{#68523}
-
Manos Koukoutos authored
Some operations require an immediate argument that represents a heap type. This CL introduces a class to represent it and uses it where appropriate. Also, the redundant TypeIndexImmediate is removed. Bug: v8:7748 Change-Id: Ib4b1d50764a79f5dd3240688f8165c39745eaad8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2260874 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by:
-
Clemens Backes authored
All error handling should be marked V8_UNLIKELY, because this is never on the hot path. R=thibaudm@chromium.org Bug: v8:10576 Change-Id: I8bc996e96a2e90f21ec065fbce4656d311097f74 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2263153Reviewed-by:
Thibaud Michaud <thibaudm@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#68521}
-
Andreas Haas authored
R=clemensb@chromium.org Bug: v8:10108 Change-Id: I50e94888340601febcede6be9899ca1ffaaed5a5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2264358 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
-
Santiago Aboy Solanes authored
Bug: v8:7790 Change-Id: I1c0275401671bb85d92afd2910618a0a345c26c9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2210233 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by:
-
Maya Lekova authored
Bug: v8:10619 Change-Id: I9097e203404ca36301a08665a7383c9585301a67 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2264359 Commit-Queue: Maya Lekova <mslekova@chromium.org> Commit-Queue: Michael Stanton <mvstanton@chromium.org> Auto-Submit: Maya Lekova <mslekova@chromium.org> Reviewed-by:
-
Andreas Haas authored
R=clemensb@chromium.org Bug: v8:10108 Change-Id: I5050d58d9601214e88bb88b24502f288de0b7be8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2264357Reviewed-by:
-
Dan Elphick authored
Fix returning from TryAllocateLinearlyAligned without updating the allocation stats if a preceding filler was required. Also makes AllocateRaw take an int instead of size_t in line with other Spaces. Bug: v8:8875, chromium:1097389 Change-Id: If0932caa94dce1cd45b41f44fa225a2007772ea1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2264354 Auto-Submit: Dan Elphick <delphick@chromium.org> Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#68516}
-
Clemens Backes authored
Move more logic into the {TraceLine} class. In release builds, this class will not do anything. Since there is no code after the switch in {DecodeOp} any more after this CL, we can apply tail-call optimization (via explicit returns in C++), which will save an additional call in some cases. R=thibaudm@chromium.org Bug: v8:10576 Change-Id: Ie11ec550ab33d0c03a27375f34576e3a75dcf6ad Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2254021Reviewed-by: -
Clemens Backes authored
Every condition which can only fail on invalid wire bytes should be wrapped in the VALIDATE macro. This way, it will automatically be skipped if {validate} is false, and we will automatically add V8_LIKELY annotations to the branches. Also, consistently use the style if (!VALIDATE(condition)) { ... handle error ... } ... continue ... Drive-by: Remove unnecessary OPCODE_ERROR macro. Drive-by 2: Replace unreachable code (after a switch) by UNREACHABLE. R=thibaudm@chromium.org Bug: v8:10576 Change-Id: I9b592bd4abde80d86e72c63739d77b4814dc96de Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2262917Reviewed-by: -
Andreas Haas authored
V8 fails a recently added spec test that when an imported global get re-exported, it should preserve its identity. This CL fixes the behavior in V8. Drive-by change: fix the object printer of globals: a global which stores a reference type only has a tagged buffer, a global which stores a value type only has an untagged buffer. R=clemensb@chromium.org Bug: v8:10556 Change-Id: I949d147fe4395610cfec6cf60082e1faecb23036 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2235702 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
-
Clemens Backes authored
Since the interpreter is not used in production any more, it does not need to support lazy compilation. Since the code is still (accidentally) triggered by indirect calls, we need to refactor that code. It only allows calls within the same instance anyway. R=ahaas@chromium.org Bug: v8:10389 Change-Id: Ied1c8effd4c9fbb857a068db587de3463867ac80 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2259942Reviewed-by:
-
Manos Koukoutos authored
The more complicated subtyping checks due to the new wasm-gc types caused a performance regression. This CL: - Adds a V8_LIKELY annotation to the more common path (type equality). - Factors the rest of the check out of the inlinable part of subtype checking to reduce binary size, and thus cache misses. Bug: chromium:1096769, v8:7748 Change-Id: Idd92789b40cc175c268ef5a53f042d4b881992af Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2263156 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by:
-
Michael Achenbach authored
If we pass flags that make runs very slow, also the validity checks might time out. Previously this wasn't checked and output was just cut off. This also tightens the timeout on validity checks as they are expected to run very fast. No-Try: true Bug: chromium:1098646 Change-Id: Iea9a932be86e84040b72a2311aaa1d44100b3378 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2262915Reviewed-by:
Tamer Tas <tmrts@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#68510}
-
Almothana Athamneh authored
Bug: v8:10445 Change-Id: I2d5501fdf7f2c3a7c19176f15d002f4f7f0cc40e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2260564 Commit-Queue: Almothana Athamneh <almuthanna@chromium.org> Reviewed-by:
Liviu Rau <liviurau@chromium.org> Reviewed-by:
-
Clemens Backes authored
This allows the compiler to eliminate more unneeded branches. Since all functions just do a lookup in a static table (either directly, or via compiling a switch to such a lookup), they are also good candidates for inlining, which is made possible by this change. One DCHECK is removed instead of pulling in the inl header, which would require more refactoring since the check is in a non-inl header. R=thibaudm@chromium.org TBR=jkummerow@chromium.org Bug: v8:10576 Change-Id: If0fd25fd62c5f30b896fc67a5458a5ae475a6351 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2259944 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
-
Almothana Athamneh authored
Bug: v8:10445 Change-Id: I13cfae71c12cf23c32f462d36f98bfcfd2dc2997 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2260558Reviewed-by:
-
Dominik Inführ authored
Test has flaky data race and will be fixed after branch to avoid regressions. Bug: v8:10637, v8:10315 Change-Id: Iddbbd91701aea622803146b84c9a9aa334bda927 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2263155Reviewed-by:
-
Maya Lekova authored
GCMole now comes with the long forgotten use-after-free detection enabled by default. The CL also improves error logging when test expectations mismatch with the actual output and updates the hash of GCMole to be used with the newly built version with enabled UAF detection. The CL also contains an ignore for isolate.cc due to inability to fix a warning there and fixes a couple of UAF warnings. Bug: v8:9680 Change-Id: I7a009ffd5f67b1b5437567691ca4235ea873de70 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2257236 Commit-Queue: Maya Lekova <mslekova@chromium.org> Reviewed-by:
-
Clemens Backes authored
This is a follow-up to https://crrev.com/c/2238569. R=cbruni@chromium.org No-Try: true Bug: v8:10556 Change-Id: Id667359a3098bf6e248716d33a8fcfc110236bb8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2262916Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#68504}
-
Camillo Bruni authored
With this CL d8 exits with an error code if there is an unhandled promise rejection, e.g. due tue a failed assertion in a promise. Up until now these assertions were just ignored. Bug: v8:10556 Change-Id: I25f20e4be45a2de130562deb15f6a144f0ac976f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2238569Reviewed-by:
Yang Guo <yangguo@chromium.org> Reviewed-by:
Marja Hölttä <marja@chromium.org> Reviewed-by:
-
Clemens Backes authored
This reverts commit fa9214a0. Reason for revert: Still broken: https://crbug.com/v8/10633 Original change's description: > Update V8 DEPS. > > Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/2dc7c7a..876a780 > > Rolling v8/third_party/aemu-linux-x64: UoYLOT0X6577j70eB9nPqYQs9Z3Nh5lA4I-pRtTchO0C..ipSYUvRoHZQDXIwxn-c7KPxUWeLwGcF_l0HPFMH3eooC > > Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/95c1f42..5718688 > > Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/35c6274..bdfbdd2 > > Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/42b285f..898dd03 > > TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com > > Change-Id: Ie77acff55525ad5775bed0e5ee81f8a31e85f689 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2262235 > Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> > Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> > Cr-Commit-Position: refs/heads/master@{#68501} TBR=machenbach@chromium.org,v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com Change-Id: Iefc8e1fb40d52d4c4c682cb26103d2860fb6d8c0 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2262912Reviewed-by:
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/2dc7c7a..876a780 Rolling v8/third_party/aemu-linux-x64: UoYLOT0X6577j70eB9nPqYQs9Z3Nh5lA4I-pRtTchO0C..ipSYUvRoHZQDXIwxn-c7KPxUWeLwGcF_l0HPFMH3eooC Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/95c1f42..5718688 Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/35c6274..bdfbdd2 Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/42b285f..898dd03 TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com Change-Id: Ie77acff55525ad5775bed0e5ee81f8a31e85f689 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2262235Reviewed-by:
-
Deepti Gandluri authored
The IsInBounds function is used in a few different places, when used for bounds checks on 32-bit platforms, size_t for max_memory_size leads to incorrect out of bounds accesses as size_t is not guaranteed to be 64-bit on all platforms. Use specific uint32_t, uint64_t methods for Wasm bounds checking instead of size_t. Bug: chromium:1080902 Change-Id: I0e21f0a310382c8ed0703c8302200d3352495c13 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2256858 Commit-Queue: Deepti Gandluri <gdeepti@chromium.org> Reviewed-by:
-
Deepti Gandluri authored
The current memory reservation approach for wasm memory tries to reserve upto the maximum, and only reserves initial if the maximum reservation fails. Add multiple retries with a smaller upper limit so that calls to grow have a higher probability of succeeding. Bug: v8:10519 Change-Id: Ice5b4c826ff993c9da7292e1b24a42a72306c098 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2259720 Commit-Queue: Deepti Gandluri <gdeepti@chromium.org> Reviewed-by:
-
