- 09 May, 2018 30 commits
-
-
Clemens Hammacher authored
This is a reland of e084eea6. Undefined behavious was fixed in https://crrev.com/c/1051235. Original change's description: > Fix SourcePositionInfo for wasm > > In wasm we often don't have a SharedFunctionInfo associated with a > compilation job, so we can't get a Script. Just print "unknown" in > these cases (instead of crashing). > > R=titzer@chromium.org > CC=herhut@chromium.org > > Bug: chromium:840757, v8:7738 > Change-Id: I850c6adfd9e07c9a0f6dd018f1a9314feb89d887 > Reviewed-on: https://chromium-review.googlesource.com/1049632 > Commit-Queue: Clemens Hammacher <clemensh@chromium.org> > Reviewed-by: Ben Titzer <titzer@chromium.org> > Cr-Commit-Position: refs/heads/master@{#53080} TBR=titzer@chromium.org Bug: chromium:840757, v8:7738 Change-Id: If04040a33766955cfed78e7c27226dd04c3f9b9f Reviewed-on: https://chromium-review.googlesource.com/1051266Reviewed-by:
Clemens Hammacher <clemensh@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#53111}
-
Igor Sheludko authored
Bug: v8:7570 Change-Id: I2101a3fed996385b076352d20a2ca4d65c31a828 Reviewed-on: https://chromium-review.googlesource.com/1044374 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#53110}
-
Clemens Hammacher authored
The 'pause' instruction is used for implementing retpolines. It is currently being printed as 'nop', which is incorrect. R=titzer@chromium.org Change-Id: I134b6dae332103fd7f9b3c4e5520f0d5db06ba74 Reviewed-on: https://chromium-review.googlesource.com/1051789Reviewed-by:
Ben Titzer <titzer@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#53109}
-
Clemens Hammacher authored
As SSCA mitigation, use retpoline for each indirect call. We currently only support retpolines on ia32 and x64. R=titzer@chromium.org Bug: v8:6600, chromium:798964 Change-Id: I32472c15e149977b00bf923f4d87e259b7b54800 Reviewed-on: https://chromium-review.googlesource.com/1052113Reviewed-by:
-
Clemens Hammacher authored
Code comments are heap-allocated and never freed. We don't want to attach them to the code object via a finalizer, since that could change gc timing and heap layout when you enable code comments. They are used to testing only anyway, so leaking is acceptable here. R=bmeurer@chromium.org, jarin@chromium.org Bug: v8:7738 Change-Id: I27b0f95db1d66b57f4f113c154f23edb84e6700d Reviewed-on: https://chromium-review.googlesource.com/1051241 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#53107}
-
Dominic Farolino authored
Implement console.countReset() from the WHATWG Console Standard R=bmeurer@chromium.org, dgozman@chromium.org, kozyatinskiy@chromium.org Bug: chromium:839947 Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel Change-Id: I8a900e9cdf3e5b08506f709cf6497476c8c6c00b Reviewed-on: https://chromium-review.googlesource.com/1044902Reviewed-by:
Aleksey Kozyatinskiy <kozyatinskiy@chromium.org> Reviewed-by:
-
Andreas Haas authored
R=ulan@chromium.org CC=jbroman@chromium.org Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng Change-Id: I606a182774188b953247b62e5426ee7feadd1a74 Reviewed-on: https://chromium-review.googlesource.com/1047206 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#53105}
-
Andreas Haas authored
R=ulan@chromium.org Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng Change-Id: Iaa9968945ce8196de75b4c4a637bda9ee57c0509 Reviewed-on: https://chromium-review.googlesource.com/1047207Reviewed-by:
-
Marja Hölttä authored
Bug: v8:7308 Change-Id: I967e036dc584f585dddda0eef480389a33e45bdf Reviewed-on: https://chromium-review.googlesource.com/1046649Reviewed-by:
Igor Sheludko <ishell@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/master@{#53103}
-
Igor Sheludko authored
Plus a bit of CSA typification. Bug: v8:7725 Change-Id: I43fea4a4c0739f9c24d84035816b046e742372ee Reviewed-on: https://chromium-review.googlesource.com/1051653Reviewed-by:
Marja Hölttä <marja@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#53102}
-
Simon Zünd authored
This CL adds a counter for sorting non-packed JSArrays where Object.prototype was modified, or the prototype of the instance differs from Array.prototype. This is the V8 side of the change. The Chromium-side CL: https://crrev.com/c/1051651 R=jgruber@chromium.org Bug: v8:7382 Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng Change-Id: I3ce9789a5df4bb9af5d1bfc89681fcd112e28e83 Reviewed-on: https://chromium-review.googlesource.com/1051650 Commit-Queue: Simon Zünd <szuend@google.com> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
Clemens Hammacher authored
The {CommentOperator}, used for implementing the --code-comments flag, is not UBSan-safe. This CL fixes this and adds a test which uses code comments. R=bmeurer@chromium.org Bug: v8:7744 Change-Id: Ia6ec509e77d998df085ac7377cb24854354e3aa2 Reviewed-on: https://chromium-review.googlesource.com/1051235 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#53100}
-
Marja Hölttä authored
The previous version was correct too, since we check sminess before. But with the new check, it's easier to see it's correct. BUG=v8:7308 Change-Id: I1632353ee5dfd305479858ec4a690b17bb70e6a6 Reviewed-on: https://chromium-review.googlesource.com/1039525Reviewed-by:
-
Clemens Hammacher authored
Instead of {base::AtomicNumber<intptr_t>} use {std::atomic<size_t>}, since we really want to store a size_t in there, and only abused negative values before to avoid a compare-and-swap loop. R=mstarzinger@chromium.org Bug: v8:7570 Change-Id: Ibff0fe0550396f11b343f7e3c098ccf94f6e8dbb Reviewed-on: https://chromium-review.googlesource.com/1049067Reviewed-by:Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:
-
Igor Sheludko authored
... in order to be able to use it in other constants definitions in the header. Bug: v8:7570 Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng Change-Id: Id5d6ae34ab401ecf063bf5897b87b6bb87c24960 Reviewed-on: https://chromium-review.googlesource.com/1032782Reviewed-by:
Yang Guo <yangguo@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#53097}
-
Dan Elphick authored
Moves all Oddballs, empty_feedback_metadata, lots of symbols and immortal heap numbers and several other empty collection objects. RO_SPACE NEW_SPACE OLD_SPACE CODE_SPACE MAP_SPACE LO_SPACE old 31800 0 241976 24032 176 0 new 35080 0 238680 24032 176 0 diff +3280 -3296 Reland of https://chromium-review.googlesource.com/c/v8/v8/+/1025996, without the empty_property_dictionary which is not read-only. Bug: v8:7464 Change-Id: I84840d86eb3e5906ddb8b4c4e9e70bfec0cf78bc Reviewed-on: https://chromium-review.googlesource.com/1049611 Commit-Queue: Dan Elphick <delphick@chromium.org> Reviewed-by:Hannes Payer <hpayer@chromium.org> Cr-Commit-Position: refs/heads/master@{#53096}
-
Dan Elphick authored
Re-enables and fixes msan test failures due to string padding being cleared only selectively in tests. This change instead makes sure it always happens in TestIsolate. Bug: v8:7746 Change-Id: I259b43ad25cb7af18bf16d29effb15772c981a67 Reviewed-on: https://chromium-review.googlesource.com/1051647Reviewed-by:
Peter Marshall <petermarshall@chromium.org> Reviewed-by:
-
Clemens Hammacher authored
These tests started failing after https://crrev.com/c/1046657. R=ahaas@chromium.org Bug: v8:7748 No-Try: true Change-Id: I67b44b144e5e62c5a88cbf6683e0678e6eab1dc6 Reviewed-on: https://chromium-review.googlesource.com/1051243Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#53094}
-
Georg Neis authored
The 'generates' clause was missing (so I suppose it got mapped to JSReceiver). Change-Id: I146546921e552f17dbadf74082b31315bf868bf7 Reviewed-on: https://chromium-review.googlesource.com/1032434 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Daniel Clifford <danno@chromium.org> Reviewed-by:
Michael Stanton <mvstanton@chromium.org> Cr-Commit-Position: refs/heads/master@{#53093}
-
Hannes Payer authored
Change-Id: I14237a71c34872e114d7e2afb73a758e011fd731 Reviewed-on: https://chromium-review.googlesource.com/1051239Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Hannes Payer <hpayer@chromium.org> Cr-Commit-Position: refs/heads/master@{#53092}
-
Mike Stanton authored
BUG=v8:7672 Change-Id: I0c157ce88b31312dfbea7a149c1d9fbdfb398278 Reviewed-on: https://chromium-review.googlesource.com/1013524 Commit-Queue: Michael Stanton <mvstanton@chromium.org> Reviewed-by:
-
Hannes Payer authored
Change-Id: Ia4d4211dbc8f0714dd11983ac7bc899f51ba69c5 Reviewed-on: https://chromium-review.googlesource.com/1051237Reviewed-by:
-
Clemens Hammacher authored
After closing a handle scope, and when allocating a new segment in a zone, treat that memory as uninitialized in MSan. This will hopefully catch more errors than handle zapping, which needs to be enabled explicitly. R=ahaas@chromium.org Bug: v8:7570 Change-Id: Ie3be07434bed878fb607a522787514421f397197 Reviewed-on: https://chromium-review.googlesource.com/1046657 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
-
Clemens Hammacher authored
The comment in {CallRuntime} was misleading. The {rsi}/{esi} register did not hold the instance, but the context instead. The generated code was correct thought. R=titzer@chromium.org Change-Id: I18020a04ac75faedf7ad5e4b07cab27ae0aedae7 Reviewed-on: https://chromium-review.googlesource.com/1051232Reviewed-by: -
Dan Elphick authored
This is a reland of 40f1aaf3 Put back padding clearing into the SerializeObject method but only when the String is not in RO_SPACE. For RO_SPACE strings, if required iterate over the space before serialization clearing the strings. Original change's description: > [heap] Mark RO_SPACE as read-only after deserialization > > Adds MarkAsReadOnly and MarkAsReadWrite to ReadOnlySpace. The latter > is only usable with ReadOnlySpace::WritableScope to avoid the space > being left writable). MarkAsReadOnly updates the high water mark and > makes several previously mutating methods into no-ops. > > Moves some writes to immutable objects out of the bootstrapper to > setup-heap-internal so they don't write to a read-only page. > > Also avoid writing hashes to strings that already have the value set as > that invariably means writing to the "0" and "1" constant strings in > RO_SPACE. > > Before serialization, it makes RO_SPACE writable again so that any > padding can be cleared before writing it. > > Bug: v8:7464 > Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng > Change-Id: I22edc20dba7dde8943991a8fcaf87244af4490a3 > Reviewed-on: https://chromium-review.googlesource.com/1014128 > Commit-Queue: Dan Elphick <delphick@chromium.org> > Reviewed-by: Hannes Payer <hpayer@chromium.org> > Reviewed-by: Yang Guo <yangguo@chromium.org> > Cr-Commit-Position: refs/heads/master@{#52943} Bug: v8:7464 Change-Id: Ia8386c4ff5f5df3207f584caf7a9b1ff1e405f25 Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng Reviewed-on: https://chromium-review.googlesource.com/1042145Reviewed-by:
-
Ben L. Titzer authored
This CL removes the JSGraph from WasmGraphBuilder and uses MachineGraph, which is independent of the isolate, instead. In addition to using the machine graph in the WasmGraphBuilder, this CL splits off a subclass for compiling wrappers that does have a JSGraph and encapsulates it in the .cc file. This makes the separation of WASM function graphs and WASM wrapper graphs more explicit. R=mstarzinger@chromium.org CC=ahaas@chromium.org BUG=v8:7721 Change-Id: I3c190baef2084919d22a9a89a8c9f11d2ddcf3d0 Reviewed-on: https://chromium-review.googlesource.com/1050266 Commit-Queue: Ben Titzer <titzer@chromium.org> Reviewed-by:
-
Peter Marshall authored
The handles created for each SharedFunctionInfo within SourcePosition::InliningStack live for the life of the profile, reaching 5MiB+ on an example server application for Node. This HandleScope limits their lifetime locally, given that the handles do not escape. This saves ~10% of peak memory. Bug: v8:7719 Change-Id: I97ce0fd3658be89fdd9cb9c1369ea5bfae0ce579 Reviewed-on: https://chromium-review.googlesource.com/1049647Reviewed-by:
Alexei Filippov <alph@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#53085}
-
Michael Starzinger authored
This makes sure that the {WasmModuleObject} has been allocated before any debug events are fired. Since {WasmScript} objects reference the module object, it needs to be allocated earlier by now. R=ahaas@chromium.org TEST=debugger/regress/regress-crbug-840288 BUG=chromium:840288 Change-Id: I02783ce126c463ac953eb2192acb65f3a5d420a1 Reviewed-on: https://chromium-review.googlesource.com/1050246Reviewed-by: -
Jaroslav Sevcik authored
Bug: chromium:841117 Change-Id: I1e83dfc82f87d0b49d3cca96290ae1d738e37d20 Reviewed-on: https://chromium-review.googlesource.com/1051228Reviewed-by:
-
Michael Achenbach authored
This reverts commit e084eea6. Reason for revert: https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20UBSanVptr/builds/3163 Original change's description: > Fix SourcePositionInfo for wasm > > In wasm we often don't have a SharedFunctionInfo associated with a > compilation job, so we can't get a Script. Just print "unknown" in > these cases (instead of crashing). > > R=titzer@chromium.org > CC=herhut@chromium.org > > Bug: chromium:840757, v8:7738 > Change-Id: I850c6adfd9e07c9a0f6dd018f1a9314feb89d887 > Reviewed-on: https://chromium-review.googlesource.com/1049632 > Commit-Queue: Clemens Hammacher <clemensh@chromium.org> > Reviewed-by: Ben Titzer <titzer@chromium.org> > Cr-Commit-Position: refs/heads/master@{#53080} TBR=titzer@chromium.org,clemensh@chromium.org Change-Id: Ib2020ea3f2b778df9fe50ccbe803938f2f4fd709 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: chromium:840757, v8:7738 Reviewed-on: https://chromium-review.googlesource.com/1051265Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#53082}
-
- 08 May, 2018 10 commits
-
-
Junliang Yan authored
Port d8131cd6 Original Commit Message: Stubs and builtins are very similar. The main differences are that stubs can be parameterized and may be generated at runtime, whereas builtins are generated at mksnapshot-time and shipped with the snapshot (or embedded into the binary). My main motivation for these conversions is that we can generate faster calls and jumps to (embedded) builtins callees from (embedded) builtin callers. Instead of going through the builtins constants table indirection, we can simply do a pc-relative call/jump. This also unlocks other refactorings, e.g. removal of CallRuntimeDelayed. R=jgruber@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com BUG= LOG=N Change-Id: I193e4275470d492912a7d0f8523c3b8c29f1b146 Reviewed-on: https://chromium-review.googlesource.com/1050732 Commit-Queue: Junliang Yan <jyan@ca.ibm.com> Reviewed-by:
Joran Siu <joransiu@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#53081}
-
Clemens Hammacher authored
In wasm we often don't have a SharedFunctionInfo associated with a compilation job, so we can't get a Script. Just print "unknown" in these cases (instead of crashing). R=titzer@chromium.org CC=herhut@chromium.org Bug: chromium:840757, v8:7738 Change-Id: I850c6adfd9e07c9a0f6dd018f1a9314feb89d887 Reviewed-on: https://chromium-review.googlesource.com/1049632 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
-
Hannes Payer authored
This reverts commit 494068c1. Reason for revert: https://bugs.chromium.org/p/chromium/issues/detail?id=840282 Original change's description: > [heap] Clear from space after garbage collection. > > Bug: chromium:829771 > Change-Id: I9e71e6cbba347dd6951e5415332e5178df9b5122 > Reviewed-on: https://chromium-review.googlesource.com/1041685 > Commit-Queue: Hannes Payer <hpayer@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Cr-Commit-Position: refs/heads/master@{#52957} TBR=hpayer@chromium.org,mlippautz@chromium.org Bug: chromium:829771 Change-Id: I3c36baaf849a7d5dbf48db2ae2178e15b3b886f8 Reviewed-on: https://chromium-review.googlesource.com/1049888 Commit-Queue: Hannes Payer <hpayer@chromium.org> Reviewed-by:
-
Eric Holk authored
D8 enables the Wasm trap handler by default now, but we need to make sure the older bounds check case still gets test coverage too, as bounds checks will continue to be a supported configuration. Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng Change-Id: I5b0bdded6929a9b3a8480e87d038398b8d2a0fd8 Reviewed-on: https://chromium-review.googlesource.com/1048835Reviewed-by:
-
Dan Elphick authored
Removes lots of parameters that are never used (found using -Wunused-parameter). Also wires up the pretenure parameter for Factory::NewFrameArray so it's actually used. Change-Id: I486e22ac0683afb84bba6a286947674254f93832 Reviewed-on: https://chromium-review.googlesource.com/1041687Reviewed-by:
-
Clemens Hammacher authored
Next SSCA mitigation: Mask the function index on indirect calls. This avoids speculative jumps to arbitrary memory. R=titzer@chromium.org Bug: v8:6600, chromium:798964 Change-Id: Id4a54fbb42096655d48965b63202bb58f98dc9aa Reviewed-on: https://chromium-review.googlesource.com/1049627 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by:
-
Leszek Swirski authored
Change-Id: I2afefab5bf43abee5e5dc66224cea1c68fb85179 Reviewed-on: https://chromium-review.googlesource.com/1049973Reviewed-by:
-
Alexey Kozyatinskiy authored
If termination was requested on pause we should handle it properly as soon as execution resumed. R=yangguo@chromium.org Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel Change-Id: Ica50500094138097f115545db716264126fbe59e Reviewed-on: https://chromium-review.googlesource.com/1049486 Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org> Reviewed-by:
-
Clemens Hammacher authored
Similar to msan.h, asan should get its own header file such that the functionality can be reused. R=ahaas@chromium.org Bug: v8:7570 Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng Change-Id: Ib81e4ff4b1d08158df7730c32345d4facf9453b0 Reviewed-on: https://chromium-review.googlesource.com/1046656Reviewed-by:
-
Andreas Haas authored
In addition to a git grep I ran the virtual/enable_wasm_streaming/http/tests/wasm_streaming/wasm_response_apis.html layout test locally to confirm that the flag is not used in Chrome. R=titzer@chromium.org Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng Change-Id: I00d013b85b585d26e50aacaeb82fb0b1ce1ff56c Reviewed-on: https://chromium-review.googlesource.com/1049965Reviewed-by:
-
