1. 24 May, 2022 1 commit
    • Clemens Backes's avatar
      [wasm] Fix C API for dynamic tiering · 23611173
      Clemens Backes authored
      The Wasm C API currently disabled dynamic tiering, in order to have
      deterministic behaviour for serialization of Wasm modules.
      As dynamic tiering is now shipped, also the C API should follow.
      
      Serialization of a Wasm module now just serializes the current state, so
      embedders are responsible for warming up a module before serializing it.
      
      If requested, we can add an internal API to enforce full tier-up of all
      functions, but we will leave that for later.
      
      R=ahaas@chromium.org, jkummerow@chromium.org
      
      Bug: v8:12899
      Change-Id: I55df63f0b6c1f285e4983f9f7d5fb66aa41637bd
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3660261Reviewed-by: 's avatarJakob Kummerow <jkummerow@chromium.org>
      Reviewed-by: 's avatarAndreas Haas <ahaas@chromium.org>
      Commit-Queue: Clemens Backes <clemensb@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#80727}
      23611173
  2. 18 May, 2022 1 commit
  3. 13 May, 2022 1 commit
  4. 04 Mar, 2022 1 commit
    • Camillo Bruni's avatar
      [tools] Improve gcmole part II · ecc3cd25
      Camillo Bruni authored
      Prepare gcmole.cc for the next update:
      - Print possible GC locations when discovering stale/dead variables
      - Make error messages less confusing for the modern V8 engineer
      - Prepare gcmole to read suspects.allowlist instead of .whitelist
      - Use more readable variable names
      - Only log non-found types with --verbose
      - Change the currently unusued gccauses format in gcmole.py and
        support loading it back in gcmole.cc
      - Implemented first basic gc call-chain printing (disabled by default)
      
      GCmole packaging:
      - Add debug mode to bootstrap.sh build script
      - Update gcmole.py run instructions in bootstrap.sh and package.sh
      
      Bug: v8:10009
      Change-Id: I369d48baa2980455d2e8f57e7a803d0384fe83f1
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3480095Reviewed-by: 's avatarJakob Kummerow <jkummerow@chromium.org>
      Reviewed-by: 's avatarMaya Lekova <mslekova@chromium.org>
      Commit-Queue: Camillo Bruni <cbruni@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#79357}
      ecc3cd25
  5. 01 Mar, 2022 1 commit
  6. 31 Jan, 2022 1 commit
  7. 16 Dec, 2021 1 commit
  8. 15 Dec, 2021 1 commit
    • Samuel Groß's avatar
      V8 Sandbox rebranding · 277fdd1d
      Samuel Groß authored
      This CL renames a number of things related to the V8 sandbox.
      Mainly, what used to be under V8_HEAP_SANDBOX is now under
      V8_SANDBOXED_EXTERNAL_POINTERS, while the previous V8 VirtualMemoryCage
      is now simply the V8 Sandbox:
      
      V8_VIRTUAL_MEMORY_CAGE => V8_SANDBOX
      V8_HEAP_SANDBOX => V8_SANDBOXED_EXTERNAL_POINTERS
      V8_CAGED_POINTERS => V8_SANDBOXED_POINTERS
      V8VirtualMemoryCage => Sandbox
      CagedPointer => SandboxedPointer
      fake cage => partially reserved sandbox
      src/security => src/sandbox
      
      This naming scheme should simplify things: the sandbox is now the large
      region of virtual address space inside which V8 mainly operates and
      which should be considered untrusted. Mechanisms like sandboxed pointers
      are then used to attempt to prevent escapes from the sandbox (i.e.
      corruption of memory outside of it). Furthermore, the new naming scheme
      avoids the confusion with the various other "cages" in V8, in
      particular, the VirtualMemoryCage class, by dropping that name entirely.
      
      Future sandbox features are developed under their own V8_SANDBOX_X flag,
      and will, once final, be merged into V8_SANDBOX. Current future features
      are sandboxed external pointers (using the external pointer table), and
      sandboxed pointers (pointers guaranteed to point into the sandbox, e.g.
      because they are encoded as offsets). This CL then also introduces a new
      build flag, v8_enable_sandbox_future, which enables all future features.
      
      Bug: v8:10391
      Change-Id: I5174ea8f5ab40fb96a04af10853da735ad775c96
      Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3322981Reviewed-by: 's avatarHannes Payer <hpayer@chromium.org>
      Reviewed-by: 's avatarIgor Sheludko <ishell@chromium.org>
      Reviewed-by: 's avatarMichael Achenbach <machenbach@chromium.org>
      Reviewed-by: 's avatarToon Verwaest <verwaest@chromium.org>
      Commit-Queue: Samuel Groß <saelo@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#78384}
      277fdd1d
  9. 14 Dec, 2021 4 commits
  10. 13 Dec, 2021 1 commit
  11. 30 Nov, 2021 1 commit
  12. 26 Nov, 2021 1 commit
  13. 24 Nov, 2021 1 commit
    • Manos Koukoutos's avatar
      [wasm] Internal representation for function references · f60132e9
      Manos Koukoutos authored
      Design doc: bit.ly/3jEVgzz
      
      We separate the internal representation of function references in Wasm
      from their JSFunction-based (external) representation. This improves
      performance of call_ref by requiring less indirections to load the
      context and call target from a function reference. In the boundary
      between wasm and JS/the C API, we add transformations between the two
      representations.
      
      Detailed changes:
      - Introduce WasmInternalFunction, containing fields required by
        call_ref, as well as a reference to the corresponding
        WasmExternalFunction. Add a reference to the WasmInternalFunction in
        WasmFunctionData. The {WasmInternalFunction::FromExternal} helper
        extracts the internal out of an external function.
      - Change {WasmInstanceObject::external_functions()} to internal
        functions.
      - Change wasm function tables to contain internal functions.
      - Change the following code to use internal functions:
        - call_ref in liftoff and Turbofan
        - function type checks in liftoff and Turbofan
        - CallRefIC and GenericJSToWasmWrapper builtins
        - {InitExprInterface::RefFunc}
        - module-compiler.cc in {ProcessTypeFeedback}
        - In module-instantiate.cc, in function-rtt creation.
      - Add transformations between internal and external functions in:
        - WasmWrapperGraphBuilder::{ToJS, BuildUnpackObjectWrapper, FromJS,
          BuildJSToJSWrapper}.
        - debug-wasm-objects.cc in {FunctionProxy::Get},
          {WasmValueObject::New} and {AddWasmTableObjectInternalProperties}.
        - runtime-wasm.cc in ReplaceWrapper
        - the C and JS APIs
        - module-instantiate.cc, in import and export processing, as well as
          {InitializeIndirectFunctionTables}
        - WasmTableObject::{IsValidElement, SetFunctionTableEntry}
        - {WasmGlobalObject::SetFuncRef}
      - Simplify body descriptors of WasmExternalFunction variants.
      - Adjust tests.
      
      Bug: v8:11510
      
      Change-Id: I8377f46f55c3771391ae1c5c8201a83854ee7878
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277878Reviewed-by: 's avatarMichael Lippautz <mlippautz@chromium.org>
      Reviewed-by: 's avatarJakob Gruber <jgruber@chromium.org>
      Reviewed-by: 's avatarJakob Kummerow <jkummerow@chromium.org>
      Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#78068}
      f60132e9
  14. 02 Nov, 2021 1 commit
    • Manos Koukoutos's avatar
      [wasm] Simplify 'ref' field for API-defined functions · 48b2b891
      Manos Koukoutos authored
      Design doc:  https://bit.ly/3jEVgzz
      
      Summary:
      We change the context for WasmJSFunction and WasmCapiFunction from a
      tuple containing the instance to a triple WasmAPIFunctionRef =
      {isolate root, context, callable}. This way we do not have to maintain
      the correct instance at runtime. Also, a few places in the code get
      simplified.
      
      Changes:
      - In WasmGraphBuilder, support having a WasmAPIFunctionRef at parameter
        0.
      - Remove unpacking of (instance, callable) tuple from code generators.
      - Remove the part in WasmGraphBuilder and LiftoffCompiler that used to
        set the instance field of the function reference.
      - Modify code that handles the 'ref' field in wasm-objects.*, factory.*
        and c-api.cc.
      - Fix the recorded safepoint address for arm when calling a C function
        from wasm.
      - (Drive-by) Remove WasmAllocatePair.
      
      Bug: v8:11510
      Change-Id: I2a4ef3abaf9da36c4a2d85b434965a40a289b9ec
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3236719
      Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
      Reviewed-by: 's avatarJakob Kummerow <jkummerow@chromium.org>
      Reviewed-by: 's avatarMichael Lippautz <mlippautz@chromium.org>
      Reviewed-by: 's avatarMaya Lekova <mslekova@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#77639}
      48b2b891
  15. 20 Sep, 2021 1 commit
  16. 17 Sep, 2021 1 commit
  17. 25 Aug, 2021 1 commit
  18. 24 Aug, 2021 1 commit
    • Dan Elphick's avatar
      Reland "[include] Split out v8.h" · ec06bb6c
      Dan Elphick authored
      This is a reland of d1b27019
      
      Fixes include:
      Adding missing file to bazel build
      Forward-declaring classing before friend-classing them to fix win/gcc
      Add missing v8-isolate.h include for vtune builds
      
      Original change's description:
      > [include] Split out v8.h
      >
      > This moves every single class/function out of include/v8.h into a
      > separate header in include/, which v8.h then includes so that
      > externally nothing appears to have changed.
      >
      > Every include of v8.h from inside v8 has been changed to a more
      > fine-grained include.
      >
      > Previously inline functions defined at the bottom of v8.h would call
      > private non-inline functions in the V8 class. Since that class is now
      > in v8-initialization.h and is rarely included (as that would create
      > dependency cycles), this is not possible and so those methods have been
      > moved out of the V8 class into the namespace v8::api_internal.
      >
      > None of the previous files in include/ now #include v8.h, which means
      > if embedders were relying on this transitive dependency then it will
      > give compile failures.
      >
      > v8-inspector.h does depend on v8-scripts.h for the time being to ensure
      > that Chrome continue to compile but that change will be reverted once
      > those transitive #includes in chrome are changed to include it directly.
      >
      > Full design:
      > https://docs.google.com/document/d/1rTD--I8hCAr-Rho1WTumZzFKaDpEp0IJ8ejZtk4nJdA/edit?usp=sharing
      >
      > Bug: v8:11965
      > Change-Id: I53b84b29581632710edc80eb11f819c2097a2877
      > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097448
      > Reviewed-by: Yang Guo <yangguo@chromium.org>
      > Reviewed-by: Camillo Bruni <cbruni@chromium.org>
      > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
      > Reviewed-by: Leszek Swirski <leszeks@chromium.org>
      > Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
      > Commit-Queue: Dan Elphick <delphick@chromium.org>
      > Cr-Commit-Position: refs/heads/main@{#76424}
      
      Cq-Include-Trybots: luci.v8.try:v8_linux_vtunejit
      Bug: v8:11965
      Change-Id: I99f5d3a73bf8fe25b650adfaf9567dc4e44a09e6
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3113629Reviewed-by: 's avatarLeszek Swirski <leszeks@chromium.org>
      Reviewed-by: 's avatarCamillo Bruni <cbruni@chromium.org>
      Reviewed-by: 's avatarMichael Lippautz <mlippautz@chromium.org>
      Reviewed-by: 's avatarJakob Kummerow <jkummerow@chromium.org>
      Reviewed-by: 's avatarSimon Zünd <szuend@chromium.org>
      Commit-Queue: Dan Elphick <delphick@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#76460}
      ec06bb6c
  19. 23 Aug, 2021 2 commits
    • Dan Elphick's avatar
      Revert "[include] Split out v8.h" · 44fe02ce
      Dan Elphick authored
      This reverts commit d1b27019.
      
      Reason for revert: Broke vtune build, tsan build and possibly others
      
      Original change's description:
      > [include] Split out v8.h
      >
      > This moves every single class/function out of include/v8.h into a
      > separate header in include/, which v8.h then includes so that
      > externally nothing appears to have changed.
      >
      > Every include of v8.h from inside v8 has been changed to a more
      > fine-grained include.
      >
      > Previously inline functions defined at the bottom of v8.h would call
      > private non-inline functions in the V8 class. Since that class is now
      > in v8-initialization.h and is rarely included (as that would create
      > dependency cycles), this is not possible and so those methods have been
      > moved out of the V8 class into the namespace v8::api_internal.
      >
      > None of the previous files in include/ now #include v8.h, which means
      > if embedders were relying on this transitive dependency then it will
      > give compile failures.
      >
      > v8-inspector.h does depend on v8-scripts.h for the time being to ensure
      > that Chrome continue to compile but that change will be reverted once
      > those transitive #includes in chrome are changed to include it directly.
      >
      > Full design:
      > https://docs.google.com/document/d/1rTD--I8hCAr-Rho1WTumZzFKaDpEp0IJ8ejZtk4nJdA/edit?usp=sharing
      >
      > Bug: v8:11965
      > Change-Id: I53b84b29581632710edc80eb11f819c2097a2877
      > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097448
      > Reviewed-by: Yang Guo <yangguo@chromium.org>
      > Reviewed-by: Camillo Bruni <cbruni@chromium.org>
      > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
      > Reviewed-by: Leszek Swirski <leszeks@chromium.org>
      > Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
      > Commit-Queue: Dan Elphick <delphick@chromium.org>
      > Cr-Commit-Position: refs/heads/main@{#76424}
      
      Bug: v8:11965
      Change-Id: Id57313ae992e720c8b19abc975cd69729e1344aa
      No-Presubmit: true
      No-Tree-Checks: true
      No-Try: true
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3113627
      Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
      Commit-Queue: Leszek Swirski <leszeks@chromium.org>
      Owners-Override: Leszek Swirski <leszeks@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#76428}
      44fe02ce
    • Dan Elphick's avatar
      [include] Split out v8.h · d1b27019
      Dan Elphick authored
      This moves every single class/function out of include/v8.h into a
      separate header in include/, which v8.h then includes so that
      externally nothing appears to have changed.
      
      Every include of v8.h from inside v8 has been changed to a more
      fine-grained include.
      
      Previously inline functions defined at the bottom of v8.h would call
      private non-inline functions in the V8 class. Since that class is now
      in v8-initialization.h and is rarely included (as that would create
      dependency cycles), this is not possible and so those methods have been
      moved out of the V8 class into the namespace v8::api_internal.
      
      None of the previous files in include/ now #include v8.h, which means
      if embedders were relying on this transitive dependency then it will
      give compile failures.
      
      v8-inspector.h does depend on v8-scripts.h for the time being to ensure
      that Chrome continue to compile but that change will be reverted once
      those transitive #includes in chrome are changed to include it directly.
      
      Full design:
      https://docs.google.com/document/d/1rTD--I8hCAr-Rho1WTumZzFKaDpEp0IJ8ejZtk4nJdA/edit?usp=sharing
      
      Bug: v8:11965
      Change-Id: I53b84b29581632710edc80eb11f819c2097a2877
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097448Reviewed-by: 's avatarYang Guo <yangguo@chromium.org>
      Reviewed-by: 's avatarCamillo Bruni <cbruni@chromium.org>
      Reviewed-by: 's avatarJakob Kummerow <jkummerow@chromium.org>
      Reviewed-by: 's avatarLeszek Swirski <leszeks@chromium.org>
      Reviewed-by: 's avatarMichael Lippautz <mlippautz@chromium.org>
      Commit-Queue: Dan Elphick <delphick@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#76424}
      d1b27019
  20. 29 Jul, 2021 1 commit
  21. 01 Jul, 2021 1 commit
  22. 21 Jun, 2021 1 commit
  23. 18 Jun, 2021 2 commits
  24. 10 Jun, 2021 2 commits
  25. 25 May, 2021 1 commit
  26. 19 May, 2021 2 commits
  27. 30 Apr, 2021 1 commit
  28. 29 Apr, 2021 1 commit
  29. 13 Apr, 2021 1 commit
  30. 22 Mar, 2021 1 commit
  31. 08 Mar, 2021 1 commit
  32. 22 Feb, 2021 1 commit
  33. 15 Feb, 2021 1 commit
    • Benedikt Meurer's avatar
      [stack-traces] Cache source position on StackFrameInfos. · 7b07c779
      Benedikt Meurer authored
      Previously we had cached the source position information on
      JSStackFrame (C++) objects and reused that between calls to
      GetLineNumber() and GetColumnNumber(). The refactoring in
      https://crrev.com/eed0d27c2f774b3adbc85d0a5fb30a8cf0f018a8
      effectively removed that cache, while still making things
      faster though.
      
      This CL puts back the caching on the StackFrameInfo objects
      by reusing the `offset` slot to store the computed source
      position (as indicated by a bit in the `flags`). For promise
      combinator async frames, the bit is always set and the
      `offset_or_source_position` slot thus always contains the source
      position (aka the `promise index` in this case). We also
      added a `StackFrameInfo::ComputeLocation()` method to remove the
      last remaining place where we'd peek into the StackFrameInfo from
      outside stack-frame-info.{cc,h}.
      
      Also-By: kimanh@chromium.org
      Bug: chromium:1077657, v8:8742, chromium:1069425
      Change-Id: I59e26a91965617163776e6cc2610b88e6925452c
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2695386
      Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
      Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
      Reviewed-by: 's avatarYang Guo <yangguo@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#72752}
      7b07c779