- 16 May, 2022 32 commits
-
-
Issack John authored
Part of the improve error messages initiative. Based on a resource of JSON.parse() errors found at https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Errors/JSON_bad_parse Previously JSON.parse(NaN) would output: SyntaxError: Unexpected token N in JSON at position 0 Now the output is: SyntaxError: "NaN" is not valid JSON Previously JSON.parse("{a:1}") would output: SyntaxError: Unexpected token a in JSON at position 1 Now the output is: SyntaxError: Expected property name or '}' in JSON at position 1 Bug: v8:6551 Change-Id: Ic9fad1fdbd295e1302805b81e6603fc526121960 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3513684Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Commit-Queue: Issack John <issackjohn@microsoft.com> Cr-Commit-Position: refs/heads/main@{#80567}
-
Michael Lippautz authored
The check whether worklists are empty sits after marking the transitive closure, when it is guaranteed that no concurrent marker is running anymore. Bug: chromium:1325628 Change-Id: Ibfa7278df2181a0aa6c7e0f1d53d51e8afaa3352 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3647830 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#80566}
-
Clemens Backes authored
This adds a new struct "OOMDetails" which is passed to the OOMErrorCallback. It currently holds the "is_heap_oom" bool that was also passed before, plus an optional "detail" string. The struct can later be extended without having to change the signature of the OOMErrorCallback. Removing fields will have to follow the standard deprecation rules, but this is also easily possible without the hassle for this initial change. We modify the deprecated OOMErrorCallback definition and un-deprecate it, which can be seen as removing a deprecated API and adding a new one in one CL. R=mlippautz@chromium.org, jkummerow@chromium.org Bug: chromium:1323177 Change-Id: Ic4c2cb5856906ebd664626fe463d8e96cb99b0a5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3647827Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#80565}
-
Igor Sheludko authored
Return empty optional instead of optional with empty Map on failure. Bug: v8:7790, chromium:1323119 Change-Id: I1e6e9e2361d12d0f8d106a7929221d3116d0d547 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3650715 Auto-Submit: Igor Sheludko <ishell@chromium.org> Reviewed-by:
-
Omer Katz authored
This includes: 1) Inline UncommintFromSpace into Shrink (always called together) 2) Replace ZapFromSpace with virtual ZapUnusedMemory 3) Replace EnsureFromSpaceIsCommited with virtual Prologue Bug: v8:12612 Change-Id: I934479761c877e10734f54e6d5896a4741b92ef7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3650738Reviewed-by:
-
Nikolaos Papaspyrou authored
Mostly in comments, not much to be said... Bug: v8:12425 Change-Id: Ib1e4d3913f9b91eeafefbef13330fd1388223c06 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3650597 Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by:
-
Omer Katz authored
Calls to Flip and ResetLinearAllocationArea of SemiSpaceNewSpace are (almost) always called together, and always at the start of evacuation. Introducing NewSpace::EvacuatePrologue, allows removing these methods from SemiSpaceNewSpace public interface and reduces future branches between the semi space and paged new space cases. Bug: v8:12612 Change-Id: Ic589a48c1e7751631603da757f4f5f7edb69e571 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3650599Reviewed-by:
-
Jakob Kummerow authored
This fixes a flaky crash when running with --turbo-stats or --turbo-stats-wasm. With dynamic tiering, it can happen that a compilation job is started shortly before the program/test/benchmark terminates and the main thread goes through its teardown sequence. When such a late job finishes, it still wants to report its statistics, which currently crashes due to UAF if the CompilationStats object, which is owned by the main thread, has already been deleted. Change-Id: Ie25a97299fdf40ece8f286487063feadcfa2eea9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3645410 Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/main@{#80560}
-
Toon Verwaest authored
Otherwise opening a HandleScope nested in a SHS also wouldn't allow PHS. This currently happens in maglev.. Bug: v8:7700 Change-Id: Id279cf7ad8c83f68a3ba0050a0df718892636e9f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3650601Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#80559}
-
Jakob Kummerow authored
This patch adds a side table to the MachineGraph that stores the previously observed call count for the Call nodes used for Wasm direct calls. This replaces a more convoluted system that accessed processed feedback during compilation, keyed on source position. Bug: v8:12166 Change-Id: I06109918030b8f256c5f170da5853394c1a69cc2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3644803Reviewed-by:
-
jameslahm authored
... /objects/representation-unittest. Bug: v8:12781 Change-Id: I3ae39df619ac6920c5ff722ed481bed20b5a5c6d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3612669 Commit-Queue: 王澳 <wangao.james@bytedance.com> Reviewed-by:
-
jameslahm authored
... /base/double-unittest. Bug: v8:12781 Change-Id: I13817728735a53fbc28a4e2d1babdcbd9bbf419d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3607113 Commit-Queue: 王澳 <wangao.james@bytedance.com> Reviewed-by:
-
Dominik Inführ authored
Record old-to-shared references in the C++ write barrier. When an old-to-shared reference is created, this particular slot will be atomically inserted into the old-to-new remembered set. We already stopped clearing the old-to-new-remembered set after a shared GC, so we already need to be able to handle such slots when invalidating objects and in the sweeper. Bug: v8:11708 Change-Id: I1b5854d58f6496228f3a3d9eb7acfd9492f09e68 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3557232Reviewed-by:
-
Clemens Backes authored
This uses a SparseBitVector instead of a BitVector for storing sets of blocks. As we only use the mid-tier register allocator for huge functions, this should generally be a win in both compile time and memory usage. R=mslekova@chromium.org Bug: chromium:1313379, v8:12780 Change-Id: Icf5b50c62f1c5fd69877cd54833d9dea8d1c37e1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3634781Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#80554}
-
jameslahm authored
... /objects/elements-kind-unittest. Bug: v8:12781 Change-Id: I335cec050faf584652a43041437ec0a14539cf1e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3607115Reviewed-by:
-
Milad Fa authored
Port 1fcfc6a6 Original Commit Message: Read only a single byte of FLAG_trace_osr in assembly builtin code to make asan happy in the simulator. R=cbruni@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com BUG= LOG=N Change-Id: I29d21bfb79999e5e73ca546368bdf812a2353eef Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3648167Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Commit-Queue: Milad Farazmand <mfarazma@redhat.com> Cr-Commit-Position: refs/heads/main@{#80552}
-
Milad Fa authored
A few of LogTests have been crashing intermittently after they were moved to unittests in this CL: https://crrev.com/c/3616424 Will re-enable once issue is investigated. Change-Id: I53435596274c935c028a625b610c54eadda9d1de Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3647092Reviewed-by:
-
Tobias Tebbi authored
This is a follow-up to https://chromium-review.googlesource.com/c/v8/v8/+/3630081 Bug: chromium:1323114 Change-Id: Ie6e3cbdecf370c5fdf9544c2f47f7b4f8f27bd70 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3647826Reviewed-by:
Nico Hartmann <nicohartmann@chromium.org> Auto-Submit: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#80550}
-
Omer Katz authored
SpaceWithLinearArea will holds a ref to a struct containing original_top_ and original_limit_ as well the lock used to sync them for querying IsPendingAllocation. PagedSpace is split into PagedSpaceBase (that holds all funcitonality) and PagedSpace. The actual fields are owned by PagedSpace and NewSpace. This is done in preparation for PagedNewSpace to allow PagedSpaceiBase and NewSpace to share the same original_top_ and original_limit_ fields. Bug: v8:12612 Change-Id: Iefbbd5209c5553db4ee16cb261734e6479e0f23f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3644795 Commit-Queue: Omer Katz <omerkatz@chromium.org> Reviewed-by:
-
Jakob Kummerow authored
The LookupIterator only handles JSReceivers, so special-case oddballs. Change-Id: I03d2875124775390c9b928fb7cfe4d938213b5d0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3645409 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#80548}
-
Clemens Backes authored
Use the newly introduced FormattedString class (https://crrev.com/c/3644622) for formatting OOM messages in Wasm. Those details will soon be put in a special "OOMDetails" struct instead of in the location (see linked bug), but we will still generate a similar string. R=mlippautz@chromium.org Bug: chromium:1323177 Change-Id: I4012e8816965285ec654f67ac700befbbbbeb9e7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3644625Reviewed-by:
-
Clemens Backes authored
We currently have a BitVector implementation which is used a lot by the two (mid-tier and top-tier) register allocators. Their size is the number of virtual registers or the number of blocks in the function. If one of those numbers gets huge, the BitVector does not perform well any more, and it consumes huge amounts of memory (we see up to several GBs for huge Wasm functions). This CL introduces a SparseBitVector implementation with a compatible interface, meant to replace the BitVector implementation. Usages will be introduced in follow-up CLs, first for the mid-tier allocator, then top-tier. This will allow us to assess performance changes better, and revert individual usages. R=mslekova@chromium.org Bug: chromium:1313379, v8:12780 Change-Id: I804311e0c188526961f70e88a43dd1ea26497cda Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3634780 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
-
Andy Wingo authored
Bug: v8:12868 This wires up the parser and the decoder interface for stringref. All of the interfaces throw UNIMPLEMENTED, however. Change-Id: If8cb131032e425a5672f793c6e4c24ddd188aebc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3645115Reviewed-by:
-
Samuel Groß authored
This CL removes some deprecated sandbox APIs and introduces new ones, in particular IsSandboxInitialized and GetSandboxReservationSizeInBytes. In additon, this CL also adds comments to the various public methods of the Sandbox class. Bug: v8:10391 Change-Id: If5c3081a0b9f7f192966150a0d2716099357363a Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3647362Reviewed-by:
Igor Sheludko <ishell@chromium.org> Reviewed-by:
-
Lu Yahan authored
Port commit bd22e3be Bug: v8:12284 Change-Id: I72ba5cfe221693125c366e7fcbc31dc936d18a16 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3647968 Commit-Queue: Yahan Lu <yahan@iscas.ac.cn> Commit-Queue: ji qiu <qiuji@iscas.ac.cn> Reviewed-by:
ji qiu <qiuji@iscas.ac.cn> Cr-Commit-Position: refs/heads/main@{#80543}
-
Dominik Inführ authored
This is a reland of commit 2b79eefe A DCHECK was using map[key] and inadvertently inserted into the map that way. Original change's description: > Reland^2: [heap] Store size with invalidated object > > This is a reland of commit 23b2d571 > > When updating pointers during a full GC, a page might not be swept > already. In such cases there might be invalid objects and slots > recorded in free memory. Updating tagged slots in free memory is fine > even though not strictly necessary. > > However, the GC also needs to calculate the size of potentially dead > invalid objects in order to be able to check whether a slot is within > that object. But since that object is dead, its map might be dead as > well which makes size calculation impossible on such objects. The CL > changes this to cache the size of invalid objects. A follow-up CL will > also check the marking bit of invalid objects. > > Reason for reverts: > > Revert #2: In-object slack tracking on JSObjects doesn't update the > cached size of invalidated objects. The fix here was to stop > invalidating recorded slots on JSObjects at all and avoid that problem > completely (see https://crrev.com/c/3620274). > > Revert #1: Not all size changes go through NotifyObjectLayoutChange, so > https://crrev.com/c/3607992 introduced NotifyObjectSizeChange as a > bottleneck for object size changes/right-trimming. This method is > now used to update the size of invalidated objects. > > Bug: v8:12578, chromium:1316289 > Change-Id: I0478d04601c0270ddb39419ca6cf98719951eb4d > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3623542 > Reviewed-by: Jakob Linke <jgruber@chromium.org> > Reviewed-by: Patrick Thier <pthier@chromium.org> > Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Cr-Commit-Position: refs/heads/main@{#80344} Bug: v8:12578, chromium:1316289 Change-Id: Ibcc04c209213c584860a7c473082526cb4e53c59 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3627635Reviewed-by:
Patrick Thier <pthier@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by:
-
Marja Hölttä authored
Bug: v8:11111,v8:1321980 Change-Id: I4dead5d50a2e1a9c1011c16d13aad2722598e456 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3642297Reviewed-by:
Shu-yu Guo <syg@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by:
Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#80541}
-
Clemens Backes authored
GCC complains about empty format strings, and also clang already required special-handling for this case. We could either drop it, since statically empty strings are not that useful anyway, but for completeness I fix it via "if constexpr" instead. R=tebbi@chromium.org Bug: chromium:1323177 Change-Id: I4d59e1b361afd1edcd552e8a9ce395759646e67f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3644433Reviewed-by:
-
Toon Verwaest authored
Bug: v8:7700 Change-Id: If4a9293649a15816504d2a9544484b67aa2b2fa1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3644791 Auto-Submit: Toon Verwaest <verwaest@chromium.org> Reviewed-by:
-
Nikolaos Papaspyrou authored
This CL adds to the existing experimental implementation of the object start bitmap, that is evaluated as a mechanism for resolving inner pointers (behind the flag v8_enable_conservative_stack_scanning). It fixes method ObjectStartBitmap::FindBasePtr to ensure that the correct base pointer is returned, even if the bitmap is not fully populated (e.g., with object evacuation or inline object allocation). This method now recalculates the part of the bitmap that is required for returning the correct result, by iterating through objects of the page. A special constructor has been introduced to the PagedSpaceObjectIterator for this purpose. It also moves the existing inline methods of ObjectStartBitmap to a new -inl.h header file, to avoid circular dependencies. Bug: v8:12851 Change-Id: Iabd0df020bee3bb63ef9d4888591b25d24d79dd9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3641179Reviewed-by:
Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#80538}
-
Camillo Bruni authored
Next steps: Move general code from V8FileLogger to Logger Bug: v8:12795, chromium:1316443 Change-Id: I66e0d7d3908a2a24cd1cf3858834bd57314754b9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3637795 Commit-Queue: Camillo Bruni <cbruni@chromium.org> Reviewed-by:
Andreas Haas <ahaas@chromium.org> Reviewed-by:
-
Lu Yahan authored
Change-Id: Ifaaa87234ab48869e828ba99e96de0d372538e81 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3647967 Commit-Queue: Yahan Lu <yahan@iscas.ac.cn> Commit-Queue: ji qiu <qiuji@iscas.ac.cn> Auto-Submit: Yahan Lu <yahan@iscas.ac.cn> Reviewed-by:
-
- 15 May, 2022 1 commit
-
-
Michael Lippautz authored
Forward deprecations of methods that are not supported anymore. Bug: v8:12819 Change-Id: I304ff159fa7e3936b5b12a5e43bb2a580576dd4e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3644792 Auto-Submit: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by:
-
- 14 May, 2022 1 commit
-
-
Simon Zünd authored
This is a reland of commit 8278cb50 The reland adds the RestartFrameTrampoline to the list of builtins that the deoptimizer is allowed to return from for control flow integrity. Original change's description: > [inspector] Re-enable Debugger#restartFrame > > Doc: https://bit.ly/revive-restart-frame > > This CL "undeprecates" Debugger#restartFrame and adds a new optional > "mode" parameter for back-wards compatibility. Moreover, the return > values are all deprecated. They were never actually used in the > DevTools frontend and the same information is available from the > Debugger#paused event that fires once execution stops at the > beginning of the restarted function. > > The CL also re-baselines all the restart-frame inspector tests that > now run successfully. > > R=bmeurer@chromium.org, kimanh@chromium.org > > Bug: chromium:1303521 > Change-Id: I34bddeb1f2f4ff3dee58dd82e779c111495566f3 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3616505 > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> > Reviewed-by: Kim-Anh Tran <kimanh@chromium.org> > Commit-Queue: Simon Zünd <szuend@chromium.org> > Cr-Commit-Position: refs/heads/main@{#80491} Bug: chromium:1303521 Change-Id: I13e2f8b5011795a38e541310622b8333a3d08049 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3644624Reviewed-by:
Kim-Anh Tran <kimanh@chromium.org> Cr-Commit-Position: refs/heads/main@{#80534}
-
- 13 May, 2022 6 commits
-
-
Clemens Backes authored
MSVC does not implicitly convert the std::array iterator to a char*, hence explicitly use the {data()} accessor instead of {begin()}, which is cleaner anyway. R=mlippautz@chromium.org Bug: chromium:1323177 Change-Id: I65c6836889eb57a18b655cb9e6c98008a8fbcaac Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3644794 Auto-Submit: Clemens Backes <clemensb@chromium.org> Reviewed-by:Deepti Gandluri <gdeepti@chromium.org> Commit-Queue: Deepti Gandluri <gdeepti@chromium.org> Cr-Commit-Position: refs/heads/main@{#80533}
-
Camillo Bruni authored
Read only a single byte of FLAG_trace_osr in assembly builtin code to make asan happy in the simulator. Bug: chromium:1324042 Change-Id: I002cea0b4917af3780d6bdedfb0ec55008e146c7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3644793Reviewed-by:
-
Leszek Swirski authored
This test tests the interpreted/baseline and optimized behaviour of cpu profiler ticks. We should eventually support this for maglev too, but for now just disable it. Bug: v8:7700 Change-Id: Iba89ab2c718025ebf90c86a84ed937c2d1d0af7f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3647363 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
-
Samuel Groß authored
This is more consistent with similar features, for example V8_ENABLE_WEBASSEMBLY or V8_ENABLE_MAGLEV. Drive-by: remove V8_SANDBOX_IS_AVAILABLE as it's no longer needed. Bug: v8:10391 Change-Id: I8658c5b0c331a4c73892737083b2c2f9b8f84056 Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3647355 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Auto-Submit: Samuel Groß <saelo@chromium.org> Reviewed-by:
-
Clemens Backes authored
This introduces a class which can be used for formatting dynamic values into a constant-size, stack-allocated array. You get ostream-style code but printf-style performance, and in particular no dynamic allocation. This makes this class also suitable to be used in OOM or other fatal situations where we cannot rely on dynamic memory allocation to still work. Using FormattedString will automatically compute the format string depending on the types. It also computes the maximum size of the output. Last but not least, it makes the code a lot more readable than traditional printf style printing. R=mlippautz@chromium.org Bug: chromium:1323177 Change-Id: I47228b3603c694c1fa23516dd3f1c57e39c0ca35 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3644622 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
-
Dominik Inführ authored
We initialize the JSObject in the payload of a ByteArray, so we know that no slots were recorded there. This also means we don't need to remove any recorded slots and thus invalidation isn't required. With this change only strings use object slot invalidation on String::MakeExternal. Bug: v8:12578 Change-Id: I009635c2a61ae8ff2b9e2480cb7d374451a8cc7d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3644614Reviewed-by:
-
