- 27 Aug, 2020 11 commits
-
-
Zeynep Cankara authored
This CL fixes the bug related with chunk position initialisation. The bug caused by not subtracting the timeline chunk start time from chunk start time. Additionally, it corrects the offset being used while detecting the chunk location. Bug: v8:10644 Change-Id: Icf426a297402f87d2acda0b2aa747b90e91686c6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2377740Reviewed-by:
Sathya Gunasekaran <gsathya@chromium.org> Commit-Queue: Zeynep Cankara <zcankara@google.com> Cr-Commit-Position: refs/heads/master@{#69589}
-
Clemens Backes authored
In certain situations (especially if the profiler is disabled) it can happen that multiple isolates trigger tier-up at the same time. Each recompilation would then identify the set of functions to recompile and add compilation units for them. This creates lots of redundant compilation, which takes time and can exceed the total wasm code space limit (code would later get garbage-collected, but there is a high peak). This CL fixes that by always finishing a running recompilation before starting a new one. Since typically concurrent recompilations all recompile for the same tier, this would avoid do most compilation only once, and later recompilations can skip most functions. The only redundant compilation that can happen is via compilation units that are still executing while the next recompilation starts, but those should not create too much redundant code. R=thibaudm@chromium.org Bug: chromium:1114093 Change-Id: If8fa7d953f3ce77a9d146458bf5e17bb9bf97219 Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_isolates_rel_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2379851 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
Thibaud Michaud <thibaudm@chromium.org> Cr-Commit-Position: refs/heads/master@{#69588}
-
Milad Farazmand authored
Port 6da647f5 Original Commit Message: Now that 86 has branched, we can move bitmask into the SIMD MVP, it will not affect the current OT. (We want any OT extension to include bitmask.) Bitmask was accepted into the proposal in https://github.com/WebAssembly/simd/pull/201. R=zhin@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com BUG= LOG=N Change-Id: I7518e1e8d7513a6931ff026eb3089fa896a6b587 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2379227Reviewed-by:
Junliang Yan <jyan@ca.ibm.com> Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#69587}
-
Santiago Aboy Solanes authored
Remove ParameterMode/Tnodify StoreFixedArrayOrPropertyArrayElement which had the last uses of: * ElementOffsetFromIndex * MatchesParameterMode So we can clean those methods too. With all of this combined, we can remove the ParameterMode declaration from the codebase. Bug: v8:9708, v8:6949 Change-Id: I981608681cefafe910dd40d3b82f8252e4b8994d Fixes: v8:9708 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2379514Reviewed-by:
Igor Sheludko <ishell@chromium.org> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Cr-Commit-Position: refs/heads/master@{#69586}
-
Arnaud Robin authored
In order to improve our tiering strategy, it is a good idea to start by tiering up functions that will be used the most, as this is done in most JavaScript engines. To decide which function requires tiering, we use as a basic strategy to define its compilation priority to 'func_size * number_of_calls', this roughly approximates the time we spend in the function. To handle prioritization, it seemed that using a concurrent priority queue similar to BigUnits was causing concurrencies issues. I then decided to use different priority queues for each worker thread. R=clemensb@chromium.org CC=thibaudm@chromium.org Bug: v8:10728 Change-Id: I6f314468549000b2a9b51d3d470f04a0cb997879 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2367859 Commit-Queue: Arnaud Robin <arobin@google.com> Reviewed-by:
Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#69585}
-
Santiago Aboy Solanes authored
Bug: v8:9708, v8:6949 Change-Id: I37c54a1f55f416d27a73dd96a201ead3c36da8f2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2379513Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Cr-Commit-Position: refs/heads/master@{#69584}
-
Victor Gomes authored
Change-Id: Ifc0eba43a807a0c408ce47a48d1bd2a14a0f354d Bug: chromium:1120895, v8:10201 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2376817 Commit-Queue: Victor Gomes <victorgomes@chromium.org> Auto-Submit: Victor Gomes <victorgomes@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#69583}
-
Santiago Aboy Solanes authored
Reading the proper pc, fp and sp in a JSEntry frame is in a different offset than in the regular frames. Bug: v8:10779, v8:10833 Fixes: v8:10779 Change-Id: I9aec44276fba0aab95b761ab17a16ec3767f4eb8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2369173 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by:
-
Clemens Backes authored
Replace two unnecessary compare-exchange operations by simpler fetch_add or exchange. This makes it easier to read and potentially faster. R=thibaudm@chromium.org Change-Id: Id9347ce837863e62887619f905a646bf48c07347 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2377687Reviewed-by:
-
evih authored
Use a Foreign pointer for the signature in the generic JS-to-Wasm wrapper. Bug: v8:10701 Change-Id: I30d5894e8b8a48c258b7a6e003813c8403c1075e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2369178Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Eva Herencsárová <evih@google.com> Cr-Commit-Position: refs/heads/master@{#69580}
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/7946304..d78cd75 Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/a54f10f..aa79ac2 Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/e95b5d6..c08c71b Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/d9986ad..708cbfd TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com Change-Id: Id5b4f330e628a207f7bcd992c941ac46ac7653ea Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2378695Reviewed-by:
v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#69579}
-
- 26 Aug, 2020 15 commits
-
-
Milad Farazmand authored
The hight 32 bits of the result of MULHW/MULHWU are undefined which could be set to any random bits. This CL adds a few bits to the hight 32 bits of the result to simulate this behaviour. Change-Id: Iaaaaf83f39e2f4c051071ebd68023dc5fd024595 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2378573Reviewed-by:
-
Ng Zhi An authored
Now that 86 has branched, we can move bitmask into the SIMD MVP, it will not affect the current OT. (We want any OT extension to include bitmask.) Bitmask was accepted into the proposal in https://github.com/WebAssembly/simd/pull/201. Bug: v8:10308 Change-Id: Ib61190fcea2bfc0ce7bf733086e1a81388216a59 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2378290Reviewed-by:
Bill Budge <bbudge@chromium.org> Commit-Queue: Zhi An Ng <zhin@chromium.org> Cr-Commit-Position: refs/heads/master@{#69577}
-
Ulan Degenbaev authored
Since the typed slot set is not thread-safe, each concurrent marking barrier collects typed slots locally and publishes them to the main typed slot set in safepoints. Bug: v8:10315 Change-Id: If1f5c5df786df88aac7bc27088afe91a4173c826 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2370302Reviewed-by:
Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#69576}
-
Frank Tang authored
Fix Heap-use-after-free READ 2 in Intl.Segmenter when the segments got free during the iteration We need to keep a copy of the string in the iterator instead of depending on the one referenced from the segments. Bug: chromium:1121156, v8:6891 Change-Id: I26ef5baccaa470dc1bd8cc229c737f556d27160e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2376173 Commit-Queue: Frank Tang <ftang@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#69575}
-
Santiago Aboy Solanes authored
Merge StoreFixedDoubleArrayElementSmi into StoreFixedDoubleArrayElement. Bug: v8:9708, v8:6949 Change-Id: If82893e16117362b40219bbe768acfc94be498e5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2377949Reviewed-by:
-
Santiago Aboy Solanes authored
This is a partial reland of 7b9a0c20 Reason for reland: Reverted since the ScopeInfoData part was causing issues. Relanding the macro structure, which shouldn't cause issues and it is needed for other CLs. Original changes description: > [compiler] Replace ScopeInfoData with direct reads > > As part of this, introduce a new ObjectData kind for objects that we > want to read directly from the background thread rather than serialize. > ScopeInfoRef is the first user of that. > > For details, see: > https://docs.google.com/document/d/1U6x6Q2bpylfxS55nxSe17yyBW0bQG-ycoBhVA82VmS0/edit?usp=sharing > > Bug: v8:7790 > Change-Id: Ia3cda4f67d3922367afa4a5da2aeaae7160cf1f2 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2346405 > Auto-Submit: Georg Neis <neis@chromium.org> > Commit-Queue: Georg Neis <neis@chromium.org> > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org> > Cr-Commit-Position: refs/heads/master@{#69473} Bug: v8:7790 Change-Id: I8d13dc206bb319638e3f7209446c24d06a07c110 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2377690 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by:
-
Santiago Aboy Solanes authored
It has several variants that might need to be simplified but this CL focuses on removing ParameterMode. Bug: v8:9708, v8:6949 Change-Id: I1c300b7abe0b698a9f3d063e0af1ed931dbf4af2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2376820Reviewed-by:
Dan Elphick <delphick@chromium.org> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Cr-Commit-Position: refs/heads/master@{#69572}
-
Clemens Backes authored
The {priority_} field is being updated in {DefaultJobState::Join}, under {mutex_}. In other places though, it is read unprotected (without holding the mutex), leading to data races. This CL fixes that by reading the field while holding the mutex and using the read priority after releasing the mutex. Note that the {priority_} field is documented to be protected by {mutex_}, so the unprotected read was a bug. R=ulan@chromium.org CC=etiennep@chromium.org Bug: v8:10822 Change-Id: I80079f3cb6689e26116ffeb33755c6938c4a2cf1 Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_isolates_rel_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2377685Reviewed-by:Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#69571}
-
Clemens Backes authored
The fuzzers were calling the compiled function without passing explicit arguments. Thus all arguments were converted from the "undefined" value, which typically results in a zero value, as expected. For BigInt though, it's not allowed to pass "undefined". We have to pass a proper BigInt. This CL implements this by passing explicit parameter values for all parameters. This effectively unlocks testing BigInt parameters in all fuzzers, thus may increase coverage and find new bugs. R=ahaas@chromium.org Bug: chromium:1120355 Change-Id: I4e451d2418eb73d460fa937d1cf95a1ab6c99cf5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2377945 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
-
Santiago Aboy Solanes authored
I forgot to remove them when I removed the old API in https://chromium-review.googlesource.com/c/v8/v8/+/2369174. Bug: v8:8116 Change-Id: I74a9670f56d09b7907187d5abcf15d707c8100a6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2377688 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Auto-Submit: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by:
Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#69569}
-
Santiago Aboy Solanes authored
Partially TNodify the method just to get ParameterMode out of the way. There is more TNodification needed but method is complicated and we are now focusing on removing ParameterMode entirely. Bug: v8:9708, v8:6949 Change-Id: I705c35e9665488a280111683c275b7292bc47576 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2374547 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by:
-
Zeynep Cankara authored
This CL unifies both map-processor and ic-processor's map processing pipeline to the same format. Also, adds the functionality to search for map transitions on map panel by clicking on map property of the ic-panel. Bug: v8:10644 Change-Id: I9f95feebb08620fd489486cf459ebe0babbd32d6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2367865Reviewed-by:
-
Clemens Backes authored
When we used the tasks API, we distributed the compilation deadlines such that different tasks would finish (and publish) at slightly different times. When moving to the jobs API, this feature was lost, and all tasks now only publish once all compilation is done. This creates major contention and synchronization overhead after compilation, which can take roughly as long as the actual concurrent compilation. This CL reintroduces a mechanism for ensuring regular publishing. We choose a limit which is high enough to ensure that we don't publish too often (because that comes with overhead), but low enough to ensure that not too many units are published at the end, when all compilation is done. At that point, there will still be some contention. Also, choose a slightly different limit per task to ensure proper distribution of publishing over time (different tasks are likely to publish at different times). This removes the last remaining regressions when compiling big modules via the jobs API. In local measurements, it makes us even faster than with the tasks API. R=ahaas@chromium.org Bug: chromium:1101340, chromium:1113234 Change-Id: I504f32606b8ad31a951449709cf407c471fa9b25 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2375196Reviewed-by:
-
Victor Gomes authored
Change-Id: I31e205b696627913584016bb9197e1e719ca0237 Bug: chromium:1120905, v8:10201 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2375191 Commit-Queue: Victor Gomes <victorgomes@chromium.org> Auto-Submit: Victor Gomes <victorgomes@chromium.org> Reviewed-by:
-
Clemens Backes authored
Decommitting memory ranges is expensive, so try to merge as many of them as possible before decommitting. Minor drive-by: Slightly extend a GC tracing message. R=ahaas@chromium.org Change-Id: I91e44db1212f0c9b70b8c8fccebe8fd33ff37d9c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2375825Reviewed-by:
-
- 25 Aug, 2020 14 commits
-
-
Clemens Backes authored
This documents the outcome of the discussion with chromium security guts. R=ecmziegler@chromium.org Change-Id: I55835fe5b40e3daf856a8ec1d5ef0d3fed5adb4c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2375386 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
Emanuel Ziegler <ecmziegler@chromium.org> Cr-Commit-Position: refs/heads/master@{#69563}
-
Ng Zhi An authored
Some shuffles take have either register or memory operand for second input, but the codegen incorrectly assumes that it is always a register. Bug: v8:10824 Change-Id: Ia2df233dad4ed451e52e57e35cce5c80db0905db Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2373586 Commit-Queue: Zhi An Ng <zhin@chromium.org> Reviewed-by:
-
Dominik Inführ authored
Experiment with enabling FLAG_local_heaps for a few days to see whether pause times regress and to catch bugs. Bug: v8:10315 Change-Id: Iefc329bbc1b8131796f1db2a729ee358bef88894 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2375190Reviewed-by:
-
Clemens Backes authored
This is a reland of c2ea2047 Original change's description: > [wasm] Move kMaxWasmCodeSpaceSize to wasm directory > > This limit is wasm-internal, and does not need to be exposed via > src/common/globals.h. > This CL moves it into the {WasmCodeAllocator}. > > Drive-by: Minor simplification in jump table stress test. > > R=ecmziegler@chromium.org > > Change-Id: Iff8c4657697ae98123d840a022c5b21c4948fcdf > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2375189 > Reviewed-by: Emanuel Ziegler <ecmziegler@chromium.org> > Commit-Queue: Clemens Backes <clemensb@chromium.org> > Cr-Commit-Position: refs/heads/master@{#69558} Change-Id: I6e0432d14d23978dea599233e620e84d8255caf9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2375388Reviewed-by:
-
Clemens Backes authored
This reverts commit c2ea2047. Reason for revert: Link failures: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20-%20cfi/26209 Original change's description: > [wasm] Move kMaxWasmCodeSpaceSize to wasm directory > > This limit is wasm-internal, and does not need to be exposed via > src/common/globals.h. > This CL moves it into the {WasmCodeAllocator}. > > Drive-by: Minor simplification in jump table stress test. > > R=ecmziegler@chromium.org > > Change-Id: Iff8c4657697ae98123d840a022c5b21c4948fcdf > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2375189 > Reviewed-by: Emanuel Ziegler <ecmziegler@chromium.org> > Commit-Queue: Clemens Backes <clemensb@chromium.org> > Cr-Commit-Position: refs/heads/master@{#69558} TBR=clemensb@chromium.org,ecmziegler@chromium.org Change-Id: Ic3466eb17f2b3dfa4a0864002b0590fa0f571bb5 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2375387Reviewed-by:
-
Clemens Backes authored
This limit is wasm-internal, and does not need to be exposed via src/common/globals.h. This CL moves it into the {WasmCodeAllocator}. Drive-by: Minor simplification in jump table stress test. R=ecmziegler@chromium.org Change-Id: Iff8c4657697ae98123d840a022c5b21c4948fcdf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2375189Reviewed-by: -
Dominik Inführ authored
While LocalHeap allow to dereference handles on background threads, this is only possible when FLAG_local_heaps is enabled. Bug: v8:10315 Change-Id: Ia27582cda7e4b4faf4d2c76959de418415e1ae68 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2372147 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by:
-
Andreas Haas authored
This CL is the start to implement reference types support in Liftoff. As a first step this CL implements the ref.null instruction, and allows reference types as return values. This allows register allocation to be extended to support reference types, and also adds an easy way to get a reference type value for tests. Additionally with ref.null we don't have to worry about garbage collection because 'null' is an immovable object and therefore does not have to be scanned by the GC. R=thibaudm@chromium.org Bug: v8:7581 Change-Id: I5785dcf522c0d9881e1386f2d8b5d8560a16225c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2352784 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
-
Jakob Gruber authored
NCI code deopts differently than TF code. Tbr: mythria@chromium.org Bug: v8:8888 Change-Id: Ica1352ed5aba648c95a8a26fd6c2dd703b0f335c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2375186Reviewed-by:
-
Pierre Langlois authored
We already make sure hints are 16K aligned on the Mac. On linux, it's possible to run with 64K pages enabled so we also need to align the hint there. Bug: v8:10808 Change-Id: I4ae7a56828135f6aa2980f164f25e2eb932b3cc0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2369176Reviewed-by:
-
Etienne Pierre-doray authored
- JobHandle::IsCompleted() - JobDelegate::GetTaskId() - worker_count passed as argument to GetMaxConcurrency(). Jobs implementation must call the new GetMaxConcurrency(), but Jobs users aren't migrated yet. Bug: chromium:1114823 Change-Id: I0f4295ccaf9eba866dd771f30e2e49aa3eae9551 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2352484 Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org> Reviewed-by:
-
Santiago Aboy Solanes authored
Also we can do ParameterToIntPtr since this was the last use. Bug: v8:9708, v8:6949 Change-Id: I61747205d9d747c80bd13cd98bc51d8f97946130 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2374546Reviewed-by:
-
Victor Gomes authored
Change-Id: Iee7d2d0d2abbb5e18640d0601203dfb58e5ec474 Bug: v8:10201, v8:10825 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2374527 Commit-Queue: Victor Gomes <victorgomes@chromium.org> Auto-Submit: Victor Gomes <victorgomes@chromium.org> Reviewed-by:
-
Pierre Langlois authored
The cctests need to simulate full pages, however the calculation of the remainging available space is wrong causing an assertion when we change the V8 page size to 512K: $ cctest test-array-buffer-tracker/ArrayBuffer_PagePromotion # # Fatal error in ../../test/cctest/heap/heap-utils.cc, line 94 # Check failed: padding_size <= overall_free_memory || overall_free_memory == 0. The reason is: - On startup, we register a scavenger observer on the new space. The observer is set to trigger when the new space capacity is at 80% by default. - On linux, the initial capacity of the new space is 512K, so the scavenger observer will be placed at 80% of 512K, which will either be in the second page of the space if the page size is 256K, or in the first page if the page size is 512K. - When placing the observer, if the observer hits the first page, we lower the allocation limit (see `ComputeLimit()`). This makes sure the observer isn't skipped by allocations inlined in generated code. However, when we simulate filling the current page, we compute the space left in the current page by comparing the top with the `page_high()` rather than `limit()`. This was done so the tests would also work when inlined allocations are disabled. If we don't look at the `limit()`, we don't take the observer into account and fill more space than is available, triggering the assertion. This can also be reproduced by reducing the % at which the scavenger is triggered so that it hits the first page instead of the second when the page size is 256K, for example passing --scavenge-task-trigger=10. Bug v8:10808, v8:9906 Change-Id: Iad50bb68995de5ee017dcbe069d1fb229c9f5985 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2372545 Commit-Queue: Pierre Langlois <pierre.langlois@arm.com> Reviewed-by:
-
