- 11 Aug, 2021 21 commits
-
-
Samuel Groß authored
When this is enabled, v8 reserves a large region of virtual address space during initialization, at the start of which it will place its 4GB pointer compression cage. The remainder of the cage is used to store ArrayBuffer backing stores and WASM memory buffers. This will later allow referencing these buffers from inside V8 through offsets from the cage base rather than through raw pointers. Bug: chromium:1218005 Change-Id: I300094b07f64985217104b14c320cc019f8438af Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3010195Reviewed-by:
Clemens Backes <clemensb@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Samuel Groß <saelo@google.com> Cr-Commit-Position: refs/heads/master@{#76234}
-
Clemens Backes authored
The combination of --wasm-write-protect-code-memory and MAP_JIT was not handled correctly. We were trying to unnecessarily switch permissions, and a DCHECK was failing because the writers count was not increased previously (because the {CodeSpaceWriteScope} uses a separate implementation if MAP_JIT is available). This CL fixes the issues by explicitly setting {WasmCodeAllocator::protect_code_memory_} to false if MAP_JIT is being used. R=jkummerow@chromium.org Bug: v8:12070 Change-Id: Ifb05ba01f8e2e7781d7c29fe80d1144a3d65543b Cq-Include-Trybots: luci.v8.try:v8_mac_arm64_rel_ng Cq-Include-Trybots: luci.v8.try:v8_mac_arm64_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3089159Reviewed-by:Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#76233}
-
Manos Koukoutos authored
We add a map from condition nodes to respective BranchConditions in ControlPathConditions for faster lookup. Bug: v8:11510 Change-Id: I571514beb699b76f2a1a0245c4785f518b9d8b1b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3041676 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#76232}
-
Jakob Gruber authored
We now have %FinalizeOptimization() to block until all concurrent compile jobs are done. Bug: v8:7790,v8:12004 Change-Id: Ibb9955be06957b3f395b680e9be570c7c3ec0dcb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3086478 Auto-Submit: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
-
Clemens Backes authored
This adds a comment to explain why the additional "ret" instruction added in https://crrev.com/c/3071202 is actually needed. R=mseaborn@chromium.org CC=ahaas@chromium.org Bug: v8:11955 Change-Id: Ifd874c499fd3094f7cf5383e991d6b193b23ca63 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3081601Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#76230}
-
Michael Lippautz authored
nullptr objects are considered alive to allow weakness to be used from stack while running into a conservative GC. Treating nullptr as dead would mean that e.g. custom collectins could not be strongified on stack. Bug: chromium:1231286 Change-Id: Ibeddef18fcbae366c3f54304bf36b75c47bd74ff Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3085280 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/master@{#76229}
-
Ross McIlroy authored
Got the data we need for now, reverting to enable --concurrent-inlining clean data on --future. BUG=v8:9684 Change-Id: I80b5bac1e852cb9f0915434a75115f6a59be8943 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3089154Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#76228}
-
Maya Lekova authored
This fixes a compilation error on GCC. Bug: v8:12072 Change-Id: Ief14968ba15776ad5f72b85b93c9158996833453 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3086475 Commit-Queue: Maya Lekova <mslekova@chromium.org> Auto-Submit: Maya Lekova <mslekova@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#76227}
-
legendecas authored
CallPrinter cannot determine the actual reason when the error is triggered by CallRuntime. In the case, throw iterator error by default instead of non-callable error to present more intuitive error messages. Bug: v8:12039 Change-Id: I240f9a729878b2dd606f4cc71236c8427bba316e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3086902Reviewed-by:
-
Jakob Gruber authored
Bug: v8:8888 Change-Id: I3ecbf73df482865d838a0b98b6acd45de7e186f2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3085270 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Auto-Submit: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
Jakob Gruber authored
.. to attempt to update deprecated maps. Used in JSHeapBroker::ReadFeedbackForPropertyAccess. Drive-by: Move Map::TryUpdate to MapUpdater to address an old TODO. Bug: v8:7790 Change-Id: Iaa791e204dd133f067014c0abdb23ef3b807a315 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3085274 Auto-Submit: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by:
-
Santiago Aboy Solanes authored
Bug: v8:7790, chromium:1236962 Change-Id: Idd84f7e154cc8977db7aef14d6b999ac929784dd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3075363 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by:
-
Clemens Backes authored
This makes flako usable on Windows using standard test names. A workaround to bisecting to failures before this CL is to replace the test_name by something like "mjsunit/regress\regress-1138075", i.e. using this on the command line to trigger flako: -p 'test_name="mjsunit/regress\\regress-1138075"' R=liviurau@chromium.org Bug: v8:9218 Change-Id: I37596efcaeca780eeacb27c2841fe8302ddb1e49 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3081610 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
Liviu Rau <liviurau@chromium.org> Cr-Commit-Position: refs/heads/master@{#76222}
-
Al Muthanna Athamina authored
Bug: chromium:1238360 Change-Id: Id81720d57e80c97ab46ef5b8cc8976b9305c53d4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3086468Reviewed-by:
-
Nico Hartmann authored
When running d8 with --trace-deopt, any deopt will contain the id of the node that caused this deopt. These ids also show up in the deoptimization data table of when using --print-opt-code. Change-Id: I412ca7a4ff20427100fa63101d78ee3846569a8e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3024144Reviewed-by:
-
Michael Lippautz authored
Avoid stray sweeper tasks still accessing heap after teardown has been initiated. This reverts https://crrev.com/c/2297466 and restores the invariant that no GC is running during teardown. Bug: v8:12025 Change-Id: I9974a63ef385783a9c3ec09725dce118f754b25f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3081615Reviewed-by:
Hannes Payer <hpayer@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/master@{#76219}
-
Georg Neis authored
One of the subtests relies on that. R=jgruber@chromium.org Bug: v8:12069 Change-Id: I648a766baf4d977f4df607754f666bd9e9102168 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3086473 Commit-Queue: Georg Neis <neis@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Auto-Submit: Georg Neis <neis@chromium.org> Reviewed-by:
-
Igor Sheludko authored
... which didn't properly handle negative Smi indices with JSTypedArray receivers. The logic was broken by the spec violation fix https://chromium-review.googlesource.com/c/v8/v8/+/2972727 Bug: chromium:1227476, chromium:1209405 Change-Id: I9bfa57d56bebccad00ed29666489f2003694e0a9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3086472 Commit-Queue: Igor Sheludko <ishell@chromium.org> Commit-Queue: Victor Gomes <victorgomes@chromium.org> Auto-Submit: Igor Sheludko <ishell@chromium.org> Reviewed-by:
Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/master@{#76217}
-
Jakob Gruber authored
MapRef::AsElementsKind can now concurrently walk transitions to find a map of the requested elements kind. Note this implementation is still less powerful than what we had before crrev.com/c/3021175, since we never allocate new maps. When the transition walk fails to find an appropriate map, we bail out. I don't expect this to be a problem - when optimizing, the code has already run multiple times and transitioned maps should exist. Bug: v8:7790, v8:11988 Change-Id: Ic767b40c29bb86f7c4167097c76c5417985420fb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3086471 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
Jakob Gruber authored
Re-enable the creation of elements transition groups in JSHeapBroker::ProcessFeedbackMapsForElementAccess. This turned out to be quite important for performance. Bug: v8:7790,v8:12031 Change-Id: I4d24837a668a5f7e78a5078212a7dc34b767d703 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3085262Reviewed-by:
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/8e6db3e..bbf7f0e Rolling v8/buildtools/third_party/libunwind/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/b79b97c..b825591 Rolling v8/third_party/aemu-linux-x64: zSIltuD7SHwbJrbeTyt6t1P_n6bQJXzs-YHXShrGDI8C..qWiGSH8A_xdaUVO-GsDJsJ5HCkIRwZqb-HDyxsLiuWwC Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/b35ee49..abc7ba7 Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/8550570..49a703f Rolling v8/third_party/googletest/src: https://chromium.googlesource.com/external/github.com/google/googletest/+log/aefb454..47f819c Rolling v8/tools/luci-go: git_revision:e7749d37e8e52fd6eb9c79266a17d7fcb6f6ec04..git_revision:1120f810b7ab7eb71bd618c4c57fe82a60d4f2fe Rolling v8/tools/luci-go: git_revision:e7749d37e8e52fd6eb9c79266a17d7fcb6f6ec04..git_revision:1120f810b7ab7eb71bd618c4c57fe82a60d4f2fe Rolling v8/tools/luci-go: git_revision:e7749d37e8e52fd6eb9c79266a17d7fcb6f6ec04..git_revision:1120f810b7ab7eb71bd618c4c57fe82a60d4f2fe TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com Change-Id: I188502d554c13aa599cb45a8a067c260dc61ec49 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3087565Reviewed-by:
v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#76214}
-
- 10 Aug, 2021 19 commits
-
-
Camillo Bruni authored
Marking V8_DEPRECATE_SOON from versions <= v9.1 as V8_DEPRECATED. Drive-by-fix: - list_deprecated.py handles non-committed deprecations Bug: v8:11165 Change-Id: I432e401d9d8d131d423c6a58ff9694abce87cef7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3085275Reviewed-by:
-
Milad Fa authored
This Cl optimizes 64bit FP min/max using scalar VSX instructions. FP values are always stored in DP format in a FP register which means 32bit FP min/max ops will also benefit from this change. Change-Id: I181e61b2d28ddf6920b548d33cb4d926da856be8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3086023 Commit-Queue: Milad Fa <mfarazma@redhat.com> Reviewed-by:
Junliang Yan <junyan@redhat.com> Cr-Commit-Position: refs/heads/master@{#76212}
-
Frank Tang authored
All marked as FAIL at this stage. Bug: v8:11544 Change-Id: I6e4346a57aa3df054d2ef5bd353544fba7fd855b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3044350 Commit-Queue: Frank Tang <ftang@chromium.org> Reviewed-by:
Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/master@{#76211}
-
Jakob Kummerow authored
This patch significantly speeds up parsing of small BigInts. Its primary idea is to move the loop that's iterating over the string into the FromStringAccumulator API. That enables using function- local variables instead of member fields. A second optimization is to use a stack-allocated digit_t[] array for small sizes, before falling back to a (comparatively slow) std::vector. As a particularly fast path, when this stack-allocated storage is guaranteed to be enough, we can perform inlined multiply-and-add steps directly on that data. Finally, this patch changes the conversion of characters to their numeric values from computations to a lookup table, which is a bit faster for radixes <= 10 (where, in the old code, only one range needed to be checked), and a lot faster for radixes > 10. Bug: v8:11515 Change-Id: Ifd8ec4799ac34447ba6d4350b7788b559307784c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3064603 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#76210}
-
Ng Zhi An authored
Use logical shifts to emulate arithmetic shift, by first adding a bias to make all signed values unsigned, then subtracting the shifted bias. Details are in code comments for SharedTurboAssembler::I64x2ShrS. Also refactor ia32 (which was already using this algorithm) to use the shared macro-assembler function. And convert Liftoff's implementation as well. Bug: v8:12058 Change-Id: Ia1fd5fe5a9a0b7a7f31c426d4112256c8bf7021b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3083291 Commit-Queue: Zhi An Ng <zhin@chromium.org> Reviewed-by:
-
Bruce Dawson authored
Now that V8 doesn't globally include windows.h we need to explicitly include it in source files that need it. This fixes a Windows ARM64 build break triggered by crrev.com/c/3042215. I did a test build of ARM64 V8 with and without this patch in order to reproduce the errors and confirm that there are no others. Bug: chromium:796644, chromium:1237067 Change-Id: I43045fcaab9e6296629775a9705aae6b2066adef Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3076019Reviewed-by:
-
Maya Lekova authored
This CL adds back the 8-byte element types and extends the fast API by hiding the unaligned memory reads performed for them. Bug: chromium:1052746 Change-Id: Ide49ce6bd2c77b9d2d544ca2df47b5f95c93eaa9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3056988 Commit-Queue: Maya Lekova <mslekova@chromium.org> Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Reviewed-by:
-
Georg Neis authored
Numfuzz runs our tests without the --testing-d8-test-runner flag. Bug: v8:12068 Change-Id: I8915a3e13c918009b8dd90fa05f050a89a484883 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3085279 Commit-Queue: Georg Neis <neis@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Georg Neis <neis@chromium.org> Reviewed-by:
-
Omer Katz authored
Bug: v8:12067 Change-Id: I69cfde8aa37c687cd1daffffc54e6de166ea65dc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3085277 Commit-Queue: Omer Katz <omerkatz@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Omer Katz <omerkatz@chromium.org> Reviewed-by:
-
Victor Gomes authored
This is useful to guarantee that the compiler can be run off-thread. - Changes BaselineCompiler isolate_ private member type. - Constructor still depends on Isolate, since it needs to construct a MacroAssembler reference. Bug: v8:12054 Change-Id: Ie7d18b8eb2d0b81a05713ce48d117f92796f2cde Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3085276 Commit-Queue: Victor Gomes <victorgomes@chromium.org> Reviewed-by:
-
Manos Koukoutos authored
Spending time on unrolling loops that contain function calls will often not be worth it, as these loops will run for potentially a long time, mitigating the performance benefit of loop unrolling. Bug: v8:11298, v8:12047 Change-Id: Idd59cea499e495e90c48f82133a809b22f899d74 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3081614 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by:
-
Manos Koukoutos authored
Change-Id: I7315ec39159986dd6f3e0ba0f46fc94cc35c607f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3085273Reviewed-by:
-
QiuJi authored
Change-Id: I9ef64cb1b91bb0af7c0199a5ae573613a579fc8a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3084361 Commit-Queue: Brice Dobry <brice.dobry@futurewei.com> Reviewed-by:
Brice Dobry <brice.dobry@futurewei.com> Cr-Commit-Position: refs/heads/master@{#76201}
-
Camillo Bruni authored
This is a reland of 9287befe - Add missing commas for api group - Add trailing commas for existing lists Original change's description: > [watchlist] Add cbruni@ to api watchlist > > - Remove unused ia32 watchlist group > - Add api watchlist group > > Change-Id: Ia64d2368de54a846ce548a66eef7e96ee5579a3a > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3084365 > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Commit-Queue: Camillo Bruni <cbruni@chromium.org> > Cr-Commit-Position: refs/heads/master@{#76189} Change-Id: Idb2a09e1b55bb3ad9aed0d8f0c37f48dfef28ec0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3085263Reviewed-by:
-
Milad Fa authored
Change-Id: Icd3e991d1b00c6846e7fa7330e39f62d16ef2028 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3083081Reviewed-by:
-
Clemens Backes authored
This cannot be defined in v8config.h because target architecture detection is not done in that file. This CL moves the logic to set V8_HAS_PTHREAD_JIT_WRITE_PROTECT to src/base/build_config.h, which also defines the V8_TARGET_ARCH* macros. R=jkummerow@chromium.org, mlippautz@chromium.org Bug: chromium:1238029 Change-Id: I2a688dad32b83df1d26bf23b15bf4485d78c8cc6 Cq-Include-Trybots: luci.v8.try:v8_mac_arm64_rel_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3085271 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
-
Jakob Gruber authored
The behavior here depends on the platform and may also differ between fast and slow paths [0]. Crash to let the fuzzer know there's nothing interesting here. [0] The reason for the fast-slow-path difference is that sometimes we may trigger different compile jobs on these paths. One example is `split`, which creates a new regexp instance on the slow path, but reuses an existing instance on the fast path. Bug: chromium:1236845 Change-Id: I87d9eb2601b235440014530d98df0e938b717650 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3080577 Auto-Submit: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#76197}
-
Michael Lippautz authored
Upon starting a new full garbage collection the global epoch is incremented. Since EmbedderHeapTracer::TraceEpilogue is called within the marking phase, it is too late to finalize sweeping there as it would use the previous cppgc epoch. This makes metric computation crash as a single V8 full GC epoch contains two different cppgc epochs (finalizing sweeping, new GC cycle). This CL avoids introducing a new EmbedderHeapTracer API and instead makes use of the fact that cppgc is known to V8's heap. Bug: chromium:1211795 Change-Id: I69837b083c4ee1edcad9d8c1a223278f992e5758 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3085264Reviewed-by:
-
Jakob Gruber authored
Prior to this CL, TraverseTransitionTree was a recursive post-order visitor. This led to stack overflows for deep transition trees. This CL changes to an iterative DFS algorithm instead. Since no user seems to rely on the visitation order, it was changed from postorder to preorder for ease of implementation. Bug: chromium:1224935 Change-Id: Ibda199422fb20fb4470c5c68947e0afbd9a5e596 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3084366 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
