- 17 Sep, 2021 18 commits
-
-
Michael Lippautz authored
The barrier checks whether an object has already been marked and strongifies all values in case it was. This means that DescriptorArray elements will not be reclaimed within the current garbage collection cycle in case a write barrier triggers for the array. Bug: v8:12133 Change-Id: I33df2f75d75527034a040275b6c55ac0aed94321 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3158325Reviewed-by:
Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#76906}
-
Andreas Haas authored
An initial value for Table.grow is supported by the core spec and does not depend on a proposal, see [1]. [1] https://webassembly.github.io/spec/js-api/index.html#tables R=thibaudm@chromium.org Bug: v8:12227 Change-Id: Ia4f16adc76a0422b2211c069614929a1a70afa76 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3164979Reviewed-by:
Thibaud Michaud <thibaudm@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/main@{#76905}
-
Thibaud Michaud authored
When checking for operand interference, if both operands are slots and one of them is 128 bit wide, check that the slot ranges don't intersect. R=nicohartmann@chromium.org Bug: chromium:1248817 Change-Id: Ib18b6e596dbb23427508b7cc07947a0ab4665e85 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162141Reviewed-by:
Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Cr-Commit-Position: refs/heads/main@{#76904}
-
Junliang Yan authored
Change-Id: I501d81c461f16ea483d4d2246fceb8b40cae261e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3167310Reviewed-by:
Milad Fa <mfarazma@redhat.com> Commit-Queue: Junliang Yan <junyan@redhat.com> Cr-Commit-Position: refs/heads/main@{#76903}
-
Clemens Backes authored
This ports the trap handler implementation for the arm64 simulator from POSIX to Windows. Apart from different registers being used for passing parameters, and different access to these register values in the signal handler, the implementation is exactly the same. The new logic is being used for sanitizer builds which automatically target arm64 via the simulator, or if manually compiling an arm64 simulator build on x64. I manually tested the latter. Also, the existing unit test is enabled for Mac (which was missing) and Windows now. R=ahaas@chromium.org, mseaborn@chromium.org Bug: v8:11955 Cq-Include-Trybots: luci.v8.try:v8_win64_asan_rel_ng Cq-Include-Trybots: luci.v8.try:v8_mac64_asan_rel_ng Change-Id: Ia62405b28808a3cc9f199e3f43a45ffc4bda491b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3163256 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/main@{#76902}
-
Georg Neis authored
Bug: v8:7790 Change-Id: I7c091ad3fd5e7d9a8c4b306d8559654f3fb06868 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3168271 Commit-Queue: Georg Neis <neis@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Auto-Submit: Georg Neis <neis@chromium.org> Reviewed-by:
-
Samuel Groß authored
Instead of explicitely splitting the cage into two separate regions, we now just create a single BoundedPageAllocator to manage the entire address range of the cage, then allocate the first 4GB for the pointer compression cage. Bug: chromium:1218005 Change-Id: I02c53ca8b6dda9074ae6caccc74c32bd6271d4d2 Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162044Reviewed-by:
Igor Sheludko <ishell@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#76900}
-
Georg Neis authored
Bug: v8:12201 Change-Id: I9a225184a887002859882d6960432a71da28b76e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3168230 Commit-Queue: Georg Neis <neis@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Auto-Submit: Georg Neis <neis@chromium.org> Reviewed-by:
-
Lu Yahan authored
Change-Id: Icd2ed5c6e54dec208afa9a09b0e4fe9bcd410687 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3167438 Commit-Queue: Yahan Lu <yahan@iscas.ac.cn> Commit-Queue: Ji Qiu <qiuji@iscas.ac.cn> Reviewed-by:
Ji Qiu <qiuji@iscas.ac.cn> Cr-Commit-Position: refs/heads/main@{#76898}
-
Leszek Swirski authored
This is a reland of 3c49308a Original change's description: > [DEPS] Add abseil to deps > > Add a dependency on the chromium abseil-cpp subdir mirror. > > Bug: v8:11006 > Change-Id: Icaad757269d27c65bc368ed539f84c5bb79ee62d > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2464940 > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Yang Guo <yangguo@chromium.org> > Reviewed-by: Victor Gomes <victorgomes@chromium.org> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> > Cr-Commit-Position: refs/heads/master@{#70786} Bug: v8:11006 Change-Id: I2befd2eadd11d485eee47c68119d93be9a3e1655 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2504257 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Adam Klein <adamk@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Reviewed-by:
Hannes Payer <hpayer@chromium.org> Reviewed-by:
Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/main@{#76897}
-
Georg Neis authored
Inlineability can change when a function gets its deoptimization disabled. We can bailout if we notice that (but keep in mind that it can still happen later). Bug: chromium:1250244, v8:7790 Change-Id: Ib088396f41eceeaae7ccdfce287cd11c5bee738a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3164980Reviewed-by:
-
Lu Yahan authored
vragther require that the destination vector register group cannot overlap with the source vector register groups, otherwise an illegal instruction exception is raised. Change-Id: I6d23ea80edc4a80be961531ded855ff372ca0da0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3161777 Commit-Queue: Yahan Lu <yahan@iscas.ac.cn> Reviewed-by:
-
Lu Yahan authored
Fix node.js build failed Change-Id: I3769a2f7a71b26b7d0d84bfc0e76c359e50191ad Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3167434 Commit-Queue: Ji Qiu <qiuji@iscas.ac.cn> Reviewed-by:
-
Benedikt Meurer authored
Previously the internal `[[ArrayBufferData]]` property for `ArrayBuffer` objects reported by the inspector (and used by the DevTools front-end to identify `ArrayBuffer`s and `WebAssembly.Memory`s using the same backing store) simply contained a hex string representation of the backing store pointer. However that unnecessarily leaks internal addresses and more importantly is not deterministic, which complicates tests (just blew up on layout tests). This CL introduces an automatically incremented `BackingStore::id()`, which is used instead now and is deterministic. Bug: chromium:1199701, chromium:1163802, chromium:1249961 Change-Id: I8ee47009cd825cfdbe00230f617c87c90508ab2a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162144 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#76893}
-
Andreas Haas authored
The default value for table entries in WebAssembly tables is null when the table gets allocated from WebAssembly, but when the table gets allocated from JavaScript, the default value is undefined when the table type is externref. With this CL V8 handles the JavaScript case spec-compliant. R=manoskouk@chromium.org Bug: v8:12227 Change-Id: Ic8a1361629d8e5dfb59e2ee22a5e0ae0f6de936d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162045 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#76892}
-
jiepan authored
Previous 256-bit implementation supports register to register move, this patch adds memory to/from register support. Bug: v8:12228 Change-Id: I3088bae47bacf13595c76506cdc016f01a31d8b6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3160296 Commit-Queue: Jie Pan <jie.pan@intel.com> Reviewed-by:
Zhi An Ng <zhin@chromium.org> Cr-Commit-Position: refs/heads/main@{#76891}
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/590c648..48f708c Rolling v8/buildtools/third_party/libc++abi/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi/+log/a5b6419..c883cb1 Rolling v8/buildtools/third_party/libunwind/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/44ea7ab..a7e4ce0 Rolling v8/third_party/aemu-linux-x64: FqiWusPGPs0zkuCyCSj2axBNOhCaD117fjIbnnj6h8kC..4_W8oYEfH2jwjpXXJX32HUtITINfNQfevdEMi6HVUm8C Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/5307522..9cba73f Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/83b09bd..c8d8b3e TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com Change-Id: I22da2220afa663166c361d04b9301c6940f97a91 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3167810Reviewed-by:
v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#76890}
-
Ng Zhi An authored
Optimize i64x2mul when AVX is supported to elide some moves. Bug: v8:11589 Change-Id: Ide0bba502a35cbb632e3fc311c9697c5f54f9d82 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3163280Reviewed-by:
-
- 16 Sep, 2021 22 commits
-
-
Junliang Yan authored
Change-Id: Ie3778dfc1b477a234399d58dd78ef1a3c1195b4d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3166250Reviewed-by:
-
Paolo Severini authored
Refactor TryCopyAndConvertArrayToCppBuffer to avoid using a CTypeInfo* pointer as template argument. Use instead a uint32 encoded value sufficient to reconstruct the CTypeInfo. Bug: v8:11739 Change-Id: I74052e59b3fa5ebed00cdb938504ba1947d959d7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3138832 Commit-Queue: Paolo Severini <paolosev@microsoft.com> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Reviewed-by:
-
Junliang Yan authored
Change-Id: I56592c8abf48c30ecdc1f4ce3084bd373a5930d9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3165691Reviewed-by:
-
Junliang Yan authored
Change-Id: Ia530c3505e3675f8170900e0c64fea2cdb8e44a8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3164907Reviewed-by:
-
Manos Koukoutos authored
Behind the --wasm-inlining flag, we introduce speculative direct calls as an alternative to invoking functions through references. In pseudocode, call_ref(func_ref, args...) reduces to if (func_ref == function_reference_at(expected_index)) { call_direct(expected_index, args...) } else call_ref(func_ref, args...) The introduced direct call can later get inlined in WasmInliningPhase. Currently, we always speculate that the reference is the function at index 0. Proper heuristics, based on liftoff runtime feedback, will come later. Bug: v8:12166, v8:7748 Change-Id: Icd1319d3091b436e71906717fd8a2662bfbb8481 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162602 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by: -
Junliang Yan authored
Change-Id: I1cfb706a429a67830640ec3274b95dd6ee9cdd56 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3164904Reviewed-by:
-
Junliang Yan authored
Change-Id: Ic4c295265162f5dbc7c425d5e196a1cf2c994003 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3164978 Commit-Queue: Junliang Yan <junyan@redhat.com> Reviewed-by:
-
Patrick Thier authored
JavascriptBuiltinContinuationFrame and BuiltinFrame didn't correctly handle the receiver when it was included in the argument count. Bug: v8:11112, chromium:1249941 Change-Id: I4d79bd152ea7e992fa3b87a4de2a509b79fcb37c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3165058 Commit-Queue: Patrick Thier <pthier@chromium.org> Reviewed-by:
-
Omer Katz authored
Bug: chromium:1249752 Change-Id: I18dee16c13f504f6669395f0ce4a753177aec9f5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3165059 Commit-Queue: Omer Katz <omerkatz@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Omer Katz <omerkatz@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#76880}
-
Hannes Payer authored
Change-Id: I5f3c83287fec334a56643f87d12a8dc1a7e47d72 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3109667 Commit-Queue: Hannes Payer <hpayer@chromium.org> Reviewed-by:
-
Milad Fa authored
Checks if the machine is running on a native BE and if so try to do the load/store ops using the new vector instructions form z15. If target machine is older than a z15, the memory offset is larger than 12 bits or we are running in the simulator then we fall back to the scalar method of loading/store from memory. Change-Id: Iec41ad21e7f292cf5b9c4707b4951a561f3dcda4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162247Reviewed-by:
Junliang Yan <junyan@redhat.com> Commit-Queue: Milad Fa <mfarazma@redhat.com> Cr-Commit-Position: refs/heads/main@{#76878}
-
Georg Neis authored
... as it has nothing to do with bootstrapping. Change-Id: I364469b023b3f0811a674ea39aefd46313dd10fc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3164536Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/main@{#76877}
-
Georg Neis authored
... by adding atomic (relaxed) accessor's for a map's constructor_or_backpointer field, and using them in the two functions. Bug: chromium:1250216, v8:7790 Change-Id: I3416799cca73792ff5f8963685274ad9afdc6229 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162129Reviewed-by:
-
Yoav Weiss authored
Change-Id: I528f43d6aaee068114fadb5a577ead0482eb425b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3160350Reviewed-by:
-
Jakob Gruber authored
This is a refactor-only change in preparation for the upcoming builtins table split. - Define fields through a macro list to avoid some manual boilerplate code. - Consistent names for builtin_entry_table_ and builtin_table_, and update names of related methods as well. - Add Builtins::ToInt to replace manual static_casts. - Move around IsolateData methods s.t. they're in the same order as the underlying fields. Bug: v8:12203 Change-Id: I68cd036b8de1dd2708e2d4579d76bb3baaea5e1c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162128Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#76874}
-
Andreas Haas authored
Reason for revert: There was an out-dated wpt test in blink that failed after this CL. I adjusted the test expectations in https://chromium-review.googlesource.com/c/chromium/src/+/3162980 so that I can land this CL. Original change's description: > Revert "[wasm][externref] Support default value for the table.set" > > This reverts commit 6b578980. > > Reason for revert: Fails layout tests: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Blink%20Linux/13751/overview > > Original change's description: > > [wasm][externref] Support default value for the table.set > > > > WebAssembly.Table.set allows a default value instead of the second > > parameter, which was not supported by V8 so far. > > > > R=thibaudm@chromium.org > > > > Bug: v8:7581 > > Change-Id: I417790722b1cb4f854cd0056ecb8377c330c45fa > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3141574 > > Reviewed-by: Thibaud Michaud <thibaudm@chromium.org> > > Commit-Queue: Andreas Haas <ahaas@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#76846} > > Bug: v8:7581 > Change-Id: I83d9be59c66ece3184b5708e5b8a3b401e4938ed > No-Presubmit: true > No-Tree-Checks: true > No-Try: true > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3163257 > Auto-Submit: Clemens Backes <clemensb@chromium.org> > Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> > Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> > Cr-Commit-Position: refs/heads/main@{#76852} Bug: v8:7581 Change-Id: I248f836ba4de2a4e3f3d80c00e6f1ac0b46a38d7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162608 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
-
Omer Katz authored
GetWriteBarrierType used to consider the slot so that a barrier is not triggered for on-stack slots. For strongifying weak collections we want the write barrier to trigger even if the backing store is only reachable from stack. Blink counterpart: crrev.com/c/3162170 Bug: chromium:1244057 Change-Id: I75b1ca62ad5de7bae3d2f4c1a9acce839f3ccdc1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162127 Commit-Queue: Omer Katz <omerkatz@chromium.org> Reviewed-by:
-
Andreas Haas authored
R=thibaudm@chromium.org Bug: v8:12227 Change-Id: If10683be63beb32c658d2dfaac0a07d858c472ba Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162038 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
-
Milad Fa authored
Liftoff needs to be fully implemented for running this test. Change-Id: Ia229d478fa22d4ce9a715d13b3d2b09a2634ad1c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3163016Reviewed-by:
-
Andreas Haas authored
Drive-by: Reorder the entries in wasm-js.status a bit. R=thibaudm@chromium.org Change-Id: I7c854c41a58f16f95a8909f4d7aa103ae440007d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162126Reviewed-by:
-
Liu Yu authored
This test is added in commit bc3b9332 Bug: v8:7748 Change-Id: I8bada39c6fc9ed22f7a25786697aed880738bc9e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3163286 Auto-Submit: Liu yu <liuyu@loongson.cn> Reviewed-by:
-
Dominik Inführ authored
Safepoints were used in Heap::AddAllocationObserversToAllSpaces and Heap::RemoveAllocationObserversFromAllSpaces as a poor man's approach to synchronization. This CL removes the safepoint and protects the potential race on the free list with a mutex in PagedSpace::DecreaseLimit. The motivation for this CL is that SafepointScope might possibly park the main thread in the future. However parking is only allowed if GCs are also allowed. GCs are not allowed when running allocation observers, so an allocation observer would not be able to add or remove additional observers as is currently done in StressConcurrentAllocationObserver. Also adding additional checks to the safepoint to ensure that we are on the main thread. Bug: v8:11708 Change-Id: I4e65a83ac4015d30b15d8c4eeaed4ea759b7c982 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3160523 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by:
-
