- 16 Feb, 2022 16 commits
-
-
Paolo Severini authored
Allow Wasm to generate calls directly to Fast API C functions. Also fixes a problem when calling a Fast Api C function with no FastApiCallbackOptions from JS. This is a rebase of https://chromium-review.googlesource.com/c/v8/v8/+/3364356, which was a rebase of the work originally done by devsnek in: https://chromium-review.googlesource.com/c/v8/v8/+/2718666. Bug: chromium:1052746, chromium:1292333 Change-Id: Ic56268e7723f80f7ea9e6799e777786d3a50222f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3440694Reviewed-by:
Maya Lekova <mslekova@chromium.org> Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Reviewed-by:
Manos Koukoutos <manoskouk@chromium.org> Commit-Queue: Paolo Severini <paolosev@microsoft.com> Cr-Commit-Position: refs/heads/main@{#79125}
-
Camillo Bruni authored
- Add build flag and disable runtime-call-stats by default - Partially fix trap-handler includes for 64-bit android Change-Id: I1c22dbb2a30b7d11ae332ee5b7964a6119ab1188 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3461933Reviewed-by:
Victor Gomes <victorgomes@chromium.org> Commit-Queue: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/main@{#79124}
-
Samuel Groß authored
This API allows allocating shared memory mappings inside a virtual address space from a platform-specific handle to a shared memory object. This will make it possible to allocate shared memory inside the sandbox, for example as backing memory for ArrayBuffers. Bug: chromium:1218005 Change-Id: I4f1f50baec50734e846496cff78046e4fffe75c5 Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3383777Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#79123}
-
Michael Lippautz authored
The information was previously kept heap-global but is really only used by spaces when refilling their LABs. Bug: v8:12615 Change-Id: Iee256d35ffa0112c93ec721bc3afdc2881c4743b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3465898Reviewed-by:
Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#79122}
-
Camillo Bruni authored
Change-Id: Icb77604d55353064cb793224b3f9c5b691503852 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3466794Reviewed-by:
Igor Sheludko <ishell@chromium.org> Commit-Queue: Camillo Bruni <cbruni@chromium.org> Auto-Submit: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/main@{#79121}
-
Michael Lippautz authored
Drive-by: Simplify pause logic. Bug: v8:12615 Change-Id: I64e44bff1de1419f1290c9f79cf5bdfe65d8903f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3466796Reviewed-by:
-
Samuel Groß authored
These should not be allowed inside the sandbox as they could be corrupted by an attacker, thus posing a security risk. Furthermore, executable pages require MAP_JIT on macOS, which causes fork() to become excessively slow, in turn causing tests to time out. Due to this, the sandbox now requires the external code space. In addition, this CL adds a max_page_permissions member to the VirtualAddressSpace API to make it possible to verify the maximum permissions of a subspace. Bug: v8:10391 Change-Id: Ib9562ecff6f018696bfa25143113d8583d1ec6cd Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3460406Reviewed-by:
-
Manos Koukoutos authored
The reason mentioned for requiring python2 is no longer valid. Bug: chromium:1292013, chromium:1292016 Change-Id: Id8fc938d32c8e967fff74239ccba8ad79e517c57 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3464034Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/main@{#79118}
-
Jakob Gruber authored
Now that different tiers use dedicated interrupt_budgets (which determine how often the runtime profiler (now tiering manager) is called), I don't see a meaningful way to use results from this counter. Bug: v8:7700 Change-Id: I2ec2242d3c7f6c2b9deab075a6f0500cc1350e96 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3467595Reviewed-by:
-
Jakob Gruber authored
TierUpCheck and UpdateInterruptBudget were only used by Turboprop (likewise feedback_cell_node). Bug: v8:12552 Change-Id: Ic73d44a5734e183bc1a2eda58cdf85163220e4d9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3463954 Auto-Submit: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/main@{#79116}
-
Jakob Gruber authored
This predicate is just confusing - it's a renamed version of HasBytecodeArray; but HasBytecodeArray also returns true if the SFI has attached Sparkplug code - and is thus not interpreted. Simply replace it by HasBytecodeArray. Bug: v8:7700 Change-Id: Id4be2048a625142ade1096044133d9cd2896b51d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3461935Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Auto-Submit: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#79115}
-
Camillo Bruni authored
- Simplify HeapObject::IsArrayList check - Dehandlify ArrayList initialization - Prevent auto-formatting of v8heapconst.py Change-Id: I9849ad82dae1a2dc671433e8d5eb8ec63ed830c9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3447906Reviewed-by:
Shu-yu Guo <syg@chromium.org> Reviewed-by:
Simon Zünd <szuend@chromium.org> Reviewed-by:
Omer Katz <omerkatz@chromium.org> Auto-Submit: Camillo Bruni <cbruni@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#79114}
-
Jakob Gruber authored
- bbudge - delphick - gsathya - mvstanton - sigurds - zhin + tebbi in src/torque/OWNERS Change-Id: I81ff27860cede273f1874b6079fa89e09486a99a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3461937Reviewed-by:
Emanuel Ziegler <ecmziegler@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#79113}
-
Lu Yahan authored
Change-Id: I5b17019a991f1540c0ecc1db0a94097334e5e335 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3463060Reviewed-by:
ji qiu <qiuji@iscas.ac.cn> Commit-Queue: ji qiu <qiuji@iscas.ac.cn> Cr-Commit-Position: refs/heads/main@{#79112}
-
Michael Achenbach authored
This ports: https://crrev.com/c/3321055 No-Tree-Checks: true Bug: chromium:1292013 Change-Id: I2ab939c43744725885329330f52dce1ef0a48ab7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3466795 Auto-Submit: Michael Achenbach <machenbach@chromium.org> Reviewed-by:
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/d5f9249..62a6377 Rolling v8/buildtools/third_party/libc++abi/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi/+log/01efcb5..738dc10 Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/7bede42..6fbe580 Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/4e4a2b8..d6a3040 Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/03f3212..9538f41 Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/ad74e59..62e2cd9 Rolling v8/tools/luci-go: git_revision:fbbb5b9748a05dd16fe621f7ea48a4ece1913874..git_revision:c4791d15e395b201e6a85336f7d8a21cce973dfa Rolling v8/tools/luci-go: git_revision:fbbb5b9748a05dd16fe621f7ea48a4ece1913874..git_revision:c4791d15e395b201e6a85336f7d8a21cce973dfa R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com Change-Id: I7ac51800087314d5c0bf5e6a186c63b059305f3f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3465720 Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#79110}
-
- 15 Feb, 2022 24 commits
-
-
Clemens Backes authored
Even though this is not a perfect protection, it will make it harder to write to the wasm code space because it's not permanently RWX. After optimizations (see https://crbug.com/v8/11974) the performance is good enough that it's worth just enabling it. R=ahaas@chromium.org Bug: v8:11974 Change-Id: I82786e932387732863c3c5e3aa743f7836cc45e4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3464035Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#79109}
-
Milad Fa authored
Change-Id: I809ebfb3e7c11a7cf61873043abae85dc069ed66 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3464914Reviewed-by:
Junliang Yan <junyan@redhat.com> Commit-Queue: Milad Farazmand <mfarazma@redhat.com> Cr-Commit-Position: refs/heads/main@{#79108}
-
Jakob Gruber authored
This was mostly unused. We should simply be able to use CodeKind plus related predicates instead. Replace FeedbackVector::optimization_tier with maybe_has_optimized_code, which states whether the optimized code cache is filled. The value is updated lazily and may lag behind the actual code cache state. We only use this field for quick cache-empty? checks from generated code. Bug: v8:7700,v8:12552 Change-Id: Ibfc5c0128eac56167a68ecba5690eab2e9369640 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3460741Reviewed-by:
-
Clemens Backes authored
Data segments were missing in the output of --wasm-fuzzer-gen-test. R=manoskouk@chromium.org Bug: v8:11863 Change-Id: I40e60ef8626125ca9df6bead688607215d9e5b58 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3461932Reviewed-by:
-
Thibaud Michaud authored
Split small chunks of assembly instructions into separate functions. This makes the code easier to follow and to maintain, especially for register allocation. Drive-by: simplify stack-switching test. R=ahaas@chromium.org Bug: v8:12191 Change-Id: Id7544a3b2d16085540d9f1863a0eabd1f72f22bb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3461929Reviewed-by:
-
Dominik Inführ authored
LocalAllocator was already renamed to EvacuationAllocator some time ago. Rename files now as well. Bug: v8:10315 Change-Id: I337f693998aaf5187a5ba05842cdb2474837b68d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3463719 Auto-Submit: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by:
-
Clemens Backes authored
Both stability and performance looks good on Linux and ChromeOS, which is the only operation systems that currently support PKU. Hence enable the feature by default before launching via finch. R=ahaas@chromium.org Bug: v8:11974, chromium:1204982 Change-Id: I2c1e7e7bb70ba73218d4db630219870b198ba6e6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3461934Reviewed-by:
-
Leszek Swirski authored
Instead of using runtime lookups of various bytecode properties (like whether they read/write the accumulator, what their operands do to registers, etc), do a switch over the bytecode itself once and dispatch to update methods that are templated on the bytecode and statically know everything about it. Change-Id: I0ae111af54277c26c7d0d67a404a2ef75f81fcf4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3455826Reviewed-by:
-
Jakob Gruber authored
.. to resolve the overloaded 'runtime' term and overall pick a more meaningful name for this class. It's neither very related to runtime (instead it's called periodically when the bytecode interrupt budget is exhausted); nor is profiling its main purpose. This class is responsible for controlling tiering decisions, hence the new name 'TieringManager'. Bug: v8:7700 Change-Id: Id6f1edf4ebe016d0d81903d0a13e0e1fe6e02142 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3463716Reviewed-by:
-
Dominik Inführ authored
Now that all known correctness issues with map space compaction are fixed, add more test coverage by enabling it with --future. Bug: v8:12578 Change-Id: I23d04a162f742480c4e83de1f3980509543e5a97 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3460409Reviewed-by:
-
Omer Katz authored
This CL replaces evacuation in MinorMC with always promoting pages. Pages in new space are promoted first within new space and then to old space upon a second GC. This implementation should not yet be used in production and is guarded behind a runtime flag. In case all pages in new space have at least one live object on them, all pages will be promoted and new space will still be out of memory, thus immediately triggering a second young gen GC that will promote all objects to old space. Further CLs will mitigate this issue. Bug: v8:12612 Change-Id: I329ea01d6d15c0942db2eeeea87c5cefcac75502 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3448385Reviewed-by:
-
Omer Katz authored
Bug: v8:12612 Change-Id: I120da76c304496b9b89ce764e5f1bfa4778e130f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3460413Reviewed-by:
-
Jakob Gruber authored
1. feedback_vector_allocation -> feedback_allocation like elsewhere. 2. A consistent --interrupt-budget prefix. 3. Remove the on-by-default --feedback-allocation-on-bytecode-size. Bug: v8:7700 Change-Id: I1d0af11e89398973a65bf9cb7c7722740d9452ea Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3463718 Auto-Submit: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
jameslahm authored
Originally, 'Promise.allSettled.call()' will throw "Promise.all called on non-object". It should be "Promise.allSettled called on non-object". Add test for it. Bug: v8:12122 Change-Id: I496a7c9d31baeb5b99012461387cfbccc4100d2b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3463063Reviewed-by:
Yang Guo <yangguo@chromium.org> Commit-Queue: Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/main@{#79096}
-
Clemens Backes authored
The hash of signatures currently has redundancy: We hash both the parameter count and the return count, plus all contained values. The total count of contained values is already implicitly captured by {hash_combine}ing the individual values, thus it's enough to only include one of parameter count and return count. R=manoskouk@chromium.org Bug: v8:12593 Change-Id: I6d3e8b15f4251964e3a74ae5411d06a7d41183a8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3460415Reviewed-by: -
Omer Katz authored
Bug: v8:12612 Change-Id: Ife6fd532a49b7f164e890fc9ddea5001d4547b38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3461928Reviewed-by:
-
jameslahm authored
according https://tc39.es/ecma262/#sec-runtime-semantics-iteratordestructuringassignmentevaluation, when desturcturing assignment with elision, iteratorValue should not be called, thus the returned object's "value" property should not be read during the assignment. Bug: v8:12595 Change-Id: Id4b2c236c30486397683b4ccd4d156b718e12df3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3459922Reviewed-by:
-
Jakob Gruber authored
.. in preparation for integrating addtl tiers into a single tiering system. 1. Explicitly spell out whether the request is concurrent or not. 2. Explicitly request the target compiler. Bug: v8:7700 Change-Id: I9d6e9f6a5d5f0f7218fe136ff50cea2ad7987f67 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3460739 Auto-Submit: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
Clemens Backes authored
The --wasm-fuzzer-gen-test functionality didn't handle imported functions correctly. R=manoskouk@chromium.org Bug: v8:11863 Change-Id: I0486e15465bfabead7bc352d1a94326a39439e43 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3460412Reviewed-by:
-
Clemens Backes authored
The module builder was outputting the address as an unsigned LEB value instead of a signed value, leading to wrong results. R=manoskouk@chromium.org Bug: v8:11863 Change-Id: I547ca98defcae0ba15b4004a506b65387534b08a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3463715Reviewed-by:
-
Dominik Inführ authored
We must not use TransferColor on objects promoted into shared objects when performing a scavenger during incremental marking. Bug: v8:12628, v8:11708 Change-Id: I5833c0da8aa3dcd03287d3803a68189e85875bc1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3463714Reviewed-by:
-
Kim-Anh Tran authored
This CL adds the functionality to remove instrumentation breakpoints in wasm. Bug: chromium:1133307 Change-Id: I05ec7f8ac634267d95744ef4565d81cd0c372a2d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3460407Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Clemens Backes <clemensb@chromium.org> Commit-Queue: Kim-Anh Tran <kimanh@chromium.org> Cr-Commit-Position: refs/heads/main@{#79088}
-
jameslahm authored
[bootstrapper] copy accessors in deserialized global into global object created using global proxy template Originally, the accessors wont be copied into global object from deserialized global. And the accessors in serialized global object will be lost. Fix to copy accessors in deserialized global into global object when recreating new global object using passed global proxy template. Tests credited to xiangyangemail@gmail.com https://chromium-review.googlesource.com/c/v8/v8/+/3405405 Bug: v8:12564 Change-Id: Iefb3a6dbfa5445b227d87c26eb423cf1b924dbb4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3459937Reviewed-by:
-
Balakrishna Avulapati authored
Adding ldflags for aix. This is a todo item noticed Change-Id: I09dc86a3e956408edb1bfeba6b60bf67843caf4d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3439339Reviewed-by:
-
