- 19 Jul, 2022 18 commits
-
-
ishell@chromium.org authored
The Code::constant_pool() segfaulted on configurations with disabled external code space when it was called on mallocced copy of a Code object. Bug: v8:11880 Change-Id: I86919002ef080486f1e4532c3a2d3352f4526508 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3772004 Auto-Submit: Igor Sheludko <ishell@chromium.org> Reviewed-by:
Patrick Thier <pthier@chromium.org> Commit-Queue: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#81811}
-
Danylo Boiko authored
- accelerated nodes selection for the old IR layout; - implemented turboshaft blocks layout building (blocks coordinates and edges); - extended interaction with user (selecting/hovering) for such things like: blocks/nodes/edges. Bug: v8:7327 Change-Id: I0b01679e9dde0bb7d94ba80dd0ee744f334e1968 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3747871Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Danylo Boiko <danielboyko02@gmail.com> Cr-Commit-Position: refs/heads/main@{#81810}
-
Philip Pfaffe authored
Thic CL adds a CDP API skeleton that will be used to disassemble WASM modules using V8's new disassembler. Bug: v8:12917, chromium:1325626 Change-Id: I4ca81aca923e9716653cd90367e5fad319483aae Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3721381Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Philip Pfaffe <pfaffe@chromium.org> Cr-Commit-Position: refs/heads/main@{#81809}
-
Jakob Kummerow authored
This includes several changes: - avoid a very-unlikely-but-theoretically-possible OOB write - avoid a somewhat-likely memory leak - grow the buffer less aggressively for medium-length strings Change-Id: I877f43d7e2e7cd4778ba8c7c7525ba988301f750 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3771900Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#81808}
-
Manos Koukoutos authored
Bug: v8:13006 Change-Id: Ia59bf5ca93403e055c65e4f28afc1b0f803bc531 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3771901Reviewed-by:
-
Manos Koukoutos authored
Notably: - As per convention, TrapIf/Unless should not return a control node. - Wasm-gc pipeline should not depend on FLAG_wasm_inlining. Change-Id: Ic593db1f979bec1cedfd9384b21487fc2763a35b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3771640Reviewed-by:
Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#81806}
-
Samuel Groß authored
To work properly and securely, the sandbox requires cooperation from the Embedder, for example in the form of a custom ArrayBufferAllocator and later on custom type tags for external objects. As such, it likely does not make sense to enable the sandbox by default everywhere. Bug: v8:10391, v8:13058 Change-Id: Ief2720122f70b9a1bc3f2e6802e60b5b95b855d1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3771841Reviewed-by:
Igor Sheludko <ishell@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#81805}
-
Leszek Swirski authored
DropRegisterAtEnd is used to free a register, to make space for the result of a node. Normally this frees up an input that is dead at the end of the node's lifetime, but under high local variable pressure, we might not have a dead value to drop. In these cases we have to spill a register through the normal spilling mechanism. Additionally, allow freeing up a blocked free register (i.e. a temporary) if this is possible. Bug: v8:7700 Change-Id: I0099751918cf5cb65c2a09337a3f080eb2c4dd14 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3769833Reviewed-by:
Victor Gomes <victorgomes@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#81804}
-
Nikolaos Papaspyrou authored
This CL fixes a bug in the units of the reported metrics for V8.GC.Cycle.MainThread.Full.Incremental.Mark (ms instead of us). It also reports incremental marking/sweeping metrics (both for the unified heap and the C++ managed heap) only when incremental marking/sweeping were used; otherwise, no zero values are reported. Bug: chromium:1154636 Bug: chromium:1343507 Change-Id: Ibc0103ea62fa0eeb5f7184280c8514e99a5c21a3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3768502Reviewed-by:
Omer Katz <omerkatz@chromium.org> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#81803}
-
Victor Gomes authored
Bug: v8:7700 Change-Id: Id108820c75d8a3a84b90b8bb498aaaa603dfb0e0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3768412 Commit-Queue: Victor Gomes <victorgomes@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/main@{#81802}
-
v8-ci-autoroll-builder authored
Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/48c2d1c..d4bc509 Fix SOVERSION of shared library (Dominic Hamon) https://chromium.googlesource.com/external/github.com/google/benchmark/+/d4bc509 v1.6.2 bump (Dominic Hamon) https://chromium.googlesource.com/external/github.com/google/benchmark/+/7a2024e R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,mlippautz@chromium.org Change-Id: I3aea0df8dc06edd78f3e4e8329ab17ed58a6ed6b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3768773Reviewed-by:
-
Victor Gomes authored
Similarly to TF, we inline ToBoolean directly on Maglev generated code. Most of the code is run as deferred, it "returns" true after 6 simple checks. ToBoolean is separated in a different function to be used by other nodes later (e.g. ToBooleanLogicalNot). Bug: v8:7700 Change-Id: I75d77b60ebfb1bb124c9e98ad381f8aefa0ac665 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3769688Reviewed-by:
-
Manos Koukoutos authored
Mostly test/fuzzer, test/inspector, test/unittests. Bug: v8:13006 Change-Id: I825efa5d72a224bb3cb9f86a9fac8763e9dbd1cf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3769696Reviewed-by:
-
Victor Gomes authored
Additionally, the CL creates a BranchIfRootConstant node and updates JumpIfTrue and JumpIfFalse. Bug: v8:7700 Change-Id: I7ee98f4b726ffef0f7969231b598d6216b09ccfc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3769828Reviewed-by:
-
Leon Bettscheider authored
This CL is part of an effort to enable concurrent marking in MinorMC. For this purpose we plan to reuse the IncrementalMarking class which already implements a part of the concurrent marking code for MajorMC (and is currently coupled with MarkCompactCollector). We plan to parameterize IncrementalMarking with CollectorBase, which can be either MinorMarkCompactCollector or MarkCompactCollector, in a subsequent CL. Bug: v8:13012 Change-Id: I595bfdcb6e1abaa270d8037d889620433f26a416 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3749183 Commit-Queue: Leon Bettscheider <bettscheider@google.com> Reviewed-by:
Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#81797}
-
Shu-yu Guo authored
Bug: v8:13081 Change-Id: I34a736e8c3aaf0712da677925ff7ad64842ebc54 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3770018 Auto-Submit: Shu-yu Guo <syg@chromium.org> Reviewed-by:
-
Frank Tang authored
Change the return value to fallback while the property is not one specified in the value. https://github.com/tc39/proposal-intl-numberformat-v3/pull/92 Bug: v8:13053 Change-Id: I40e430152c71258f1ff85fec1d69928937d0ad99 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3759224 Commit-Queue: Frank Tang <ftang@chromium.org> Reviewed-by:
Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#81795}
-
JianxiaoLuIntel authored
The LeftTrimFixedArray will call OnMoveEvent every time. Even though when the profiling is not enabled in user mode, it still need to do some check, and the function call itself has certain overhead. This patch aims to remove the unnecessary check. We only need to check it when the logging status changes. Change-Id: I0e957860616a18415398f7753ed21caab5a4361f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3751964Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Commit-Queue: Jianxiao Lu <jianxiao.lu@intel.com> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#81794}
-
- 18 Jul, 2022 22 commits
-
-
Shu-yu Guo authored
This reverts commit 50e944f0. Reason for revert: Breaking GPU tests on all platforms https://ci.chromium.org/ui/p/v8/builders/ci/Win%20V8%20FYI%20Release%20(NVIDIA)/15929/overview https://ci.chromium.org/ui/p/v8/builders/ci/Mac%20V8%20FYI%20Release%20(Intel)/18070/overview https://ci.chromium.org/ui/p/v8/builders/ci/Linux%20V8%20FYI%20Release%20(NVIDIA)/20597/overview Original change's description: > [turbofan] Support Phi nodes in SL Verifier > > Drive-by: Fix incorrect typing of Phi node in > JSTypedLowering::ReduceJSHasInProtoypeChain > > Bug: v8:12619 > Change-Id: Iac6e04e7de7596caa11d021f2cb0759b50aa9bc3 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3755113 > Reviewed-by: Tobias Tebbi <tebbi@chromium.org> > Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> > Cr-Commit-Position: refs/heads/main@{#81785} Bug: v8:12619 Change-Id: Idcd4881e981ae6f886ae2bc5ed77958f01bb178e No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3770010 Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Commit-Queue: Shu-yu Guo <syg@chromium.org> Auto-Submit: Shu-yu Guo <syg@chromium.org> Owners-Override: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#81793}
-
Frank Tang authored
Spec text: https://tc39.es/proposal-temporal/#sec-temporal-iso8601grammar Support 'T' prefix in time-only strings and require it in cases of ambiguity Remove TemporalDateString and TemporalRelativeToString from parser Change algorithm of ParseTemporalDateString Related spec changes: https://github.com/tc39/proposal-temporal/pull/1952 https://github.com/tc39/proposal-temporal/pull/2187 Bug: v8:11544 Change-Id: I7430afabb7dd78930b339b818bad7c7721decb99 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3636361Reviewed-by:
-
Jakob Kummerow authored
This adds a bunch of tracing hooks to the module decoder and uses them to support "annotated hexdump" output for full modules in wami: $ out/x64.release/wami my_module.wasm --full-hexdump Change-Id: I5821d940b5ec236df9708eecd0124172d8893ffd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3754741Reviewed-by:
Manos Koukoutos <manoskouk@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#81791}
-
Lei Zhang authored
This file did not include all the headers it needed, so when https://crrev.com/c/3749178 removed a bunch of headers, the MSVC build broke. Add in the missing header to address the MSVC compiler falure. Change-Id: I646787cfde802d8cabe7d61bac2f2066beaec436 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3764190Reviewed-by:
-
Milad Fa authored
Port d5b3d8e9 Original Commit Message: This change already landed for x64, now come arm and ia32. The code already existed for arm64. The wasm instance got pushed three times in the lazy-compile builtin: 1) as part of the parameters; 2) as a parameter for the runtime function; 3) to load the jump table address after the runtime function; The third push can be avoided by loading the jump table address after all parameters get loaded from the stack again. R=ahaas@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com BUG= LOG=N Change-Id: I731473b2d5e08e7ea5841ef589dd3f896b5302db Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3769698 Commit-Queue: Milad Farazmand <mfarazma@redhat.com> Reviewed-by:
Junliang Yan <junyan@redhat.com> Reviewed-by:
-
ishell@chromium.org authored
... in order to avoid expensive computation of cage_base for Code objects and in order to avoid issues with wrong cage base values computed from Code objects in external code space. Drive-by: cage-bas'ify some accessors in JSFunction and Code. This is a step towards Code-less embedded builtins. Bug: v8:11880 Change-Id: I95dd8bcd4680e09c7463e1bc7d72dcbf9f2e5c1c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3769831Reviewed-by:
Anton Bikineev <bikineev@chromium.org> Cr-Commit-Position: refs/heads/main@{#81788}
-
Matthias Liedtke authored
Bug: v8:7748 Change-Id: Ib8fadc272178fb0d49f7d5fab7d1953e2328a1ad Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3770107 Auto-Submit: Matthias Liedtke <mliedtke@google.com> Commit-Queue: Matthias Liedtke <mliedtke@google.com> Reviewed-by:
-
ishell@chromium.org authored
Bug: v8:11880 Change-Id: I07d5811132d2b1e3cb853f58972970c77fdae026 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3769697 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by:
-
Nico Hartmann authored
Drive-by: Fix incorrect typing of Phi node in JSTypedLowering::ReduceJSHasInProtoypeChain Bug: v8:12619 Change-Id: Iac6e04e7de7596caa11d021f2cb0759b50aa9bc3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3755113Reviewed-by:
-
Thibaud Michaud authored
Until crbug.com/1269989 is completely resolved. R=clemensb@chromium.org Bug: chromium:1269989 Change-Id: I35f6278425857d727ea99470d9531fd70a58a3c0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3769692 Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Reviewed-by:
Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#81784}
-
ishell@chromium.org authored
... which might be undefined during initialization. Bug: v8:13054 Change-Id: Ia3a7a95ffb1133b5d3d299c36bfb3875bcee2dfa Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3769830Reviewed-by:
-
Andreas Haas authored
This change already landed for x64, now come arm and ia32. The code already existed for arm64. The wasm instance got pushed three times in the lazy-compile builtin: 1) as part of the parameters; 2) as a parameter for the runtime function; 3) to load the jump table address after the runtime function; The third push can be avoided by loading the jump table address after all parameters get loaded from the stack again. R=clemensb@chromium.org Bug: v8:13049, v8:12926 Change-Id: Ifdbe943520c031ec5c480798694bcacc490a64bc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3764348Reviewed-by:
-
Clemens Backes authored
This is a reland of commit 8218c061. Compile errors on mac arm64 are fixed. Original change's description: > [wasm] Reset PKRU before spawning new threads > > We sometimes hit the DCHECK in the wasm code manager: > DCHECK_IMPLIES(writable, !MemoryProtectionKeyWritable()); > > This is because we spawn new threads while having a > {CodeSpaceWriteScope} open. In the case of PKU, this changes the PKRU > register to allow writes to the code space, and the value of that > register is inherited by any new thread. If this thread then tries to > switch to writable code spaces, it hits the DCHECK. It would hit a > similar DCHECK when trying to execute code. > > We fix this issue by temporarily resetting the PKRU register to > non-writable while we call the {NotifyConcurrencyIncrease} method. This > is not a very robust solution, as any new call that potentially happens > inside a {CodeSpaceWriteScope} needs to do the same, but refactoring the > code to avoid spawning new threads while being in writable state would > be a lot of work with other downsides. > > R=jkummerow@chromium.org > > Bug: v8:13075 > Change-Id: Ibc7270aa597902dc6d9649cb6bcdfce8b1a9bafc > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3762579 > Commit-Queue: Clemens Backes <clemensb@chromium.org> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> > Cr-Commit-Position: refs/heads/main@{#81729} Bug: v8:13075 Cq-Include-Trybots: luci.v8.try:v8_mac_arm64_compile_rel Cq-Include-Trybots: luci.v8.try:v8_mac_arm64_compile_dbg Change-Id: I2e634959c969fc022393ae51c391397c7195ee54 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3769829 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
-
Leszek Swirski authored
We check page flags in the deferred write barrier, and bail out early if pointers to that page are not interesting. Make sure that the slot register saving happens after that early bailout, to avoid unbalanced push/pop. To avoid bugs like this in the future, add a stack size check as a prefix to every node's code gen. Bug: v8:7700 Change-Id: I54a00fcbc843d473a1ca1e6cf3d852a0c60621c0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3769695Reviewed-by:
-
ishell@chromium.org authored
... in particular: * safepoint table accessors, * constant pool accessors, * handler table accessors. This is a step towards Code-less embedded builtins. Bug: v8:11880 Change-Id: I50c21000a821d0895295e4003ab321ddd8856546 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3764349Reviewed-by:
-
Clemens Backes authored
The stack offsets of cache slots are always positive, but the compiler does not know that. The lack of this knowledge makes division by the system pointer size significantly more expensive. One solution would be to rewrite the division to be an actual right shift. Another solution is to teach the compiler that offsets are positive. This CL does the latter. This reduces the overall Liftoff compile time of the reproducer in the linked issue by nearly 25%. R=jkummerow@chromium.org, cbruni@chromium.org Bug: v8:13063 Change-Id: Ib55b35d407e9909c792ae095a6767aaa03faebdc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3760453Reviewed-by:
-
Manos Koukoutos authored
Mostly test/cctest/. Bug: v8:13006 Change-Id: I8853d38feb79bed6234a4354ab25a13255a1871b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3755149 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by:
-
ishell@chromium.org authored
... for configurations with disabled pointer compression. Bug: v8:12797, v8:13059 Change-Id: I0547ded7934f1f28a4c2ca45738fefd7311576c3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3763868 Auto-Submit: Igor Sheludko <ishell@chromium.org> Reviewed-by:
-
Manos Koukoutos authored
In {ControlPathState} with {kMultipleInstances}, a node should be able to be mapped to different states, but not twice to an identical state. Change-Id: Ida340a6f4f5e891f586d5a90e7ae818f24dfbe98 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3769693 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by: -
Marja Hölttä authored
In this part: at Drive-by: test helper cleanup Bug: v8:11111 Change-Id: I760d0c4ee078c397c8a8365ec96101b488986d41 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3764344Reviewed-by:
-
Matthias Liedtke authored
Bug: v8:7748 Change-Id: Ie39a12097f287e0eaf7e3f6c0072dd4cd5a40457 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3764347Reviewed-by:
-
Manos Koukoutos authored
Templetize ControlPathState on whether multiple states are allowed for the same node. Instantiate BranchElimination to allow a single state per node, and WasmGCOperatorReducer to allow multiple. This fixes a performance regression caused by crrev.com/c/3717994. Bug: chromium:1339826 Change-Id: Id52d643daad618f45c3d8509f2a661e177609a0c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3754941 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by:
-
