- 15 Nov, 2021 10 commits
-
-
Camillo Bruni authored
Bug: v8:11165 Change-Id: I4b5160245d032f3b57167344b03553e5c0374ca2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3275564Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/main@{#77895}
-
Leszek Swirski authored
Posting compile tasks from the parser has several issues: 1. We don't know how many functions there will be total, so we can't yet allocate shared_function_infos array on the Script 2. Without this array, inner function compiles can't look up their own inner functions during bytecode finalization, so we can't run that finalization before script parse completes 3. Scope analysis can't have run yet, so we can only post top-level function tasks and if we allocate SharedFunctionInfos early they are forced into a bit of a limbo state without an outer ScopeInfo. Instead, we can post compile tasks during bytecode generation. Then, the script parse is guaranteed to have completed, so we'll have a shared_function_infos array and we will have allocated ScopeInfos already. This also opens the door for posting tasks for compiling more inner functions than just top-level, as well as generating better code for functions/methods that reference same-script top-level let/const/class. Bug: chromium:1267680 Change-Id: Ie1a3a3c6f1b264c4ef28cd4763bfc6dc08f45d4d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277884 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#77894}
-
Shu-yu Guo authored
Bug: v8:12382 Change-Id: I31a9e919db56cf7642b2f5e22352ce3ebe0f6e23 Cq-Include-Trybots: luci.v8.try:v8_linux64_single_generation_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3278675 Auto-Submit: Shu-yu Guo <syg@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#77893}
-
Johann authored
TestExpectations has been empty for almost 3 years and its use in v8 is not documented. Change-Id: I9cf51ddf0934869ed3ba6214b8d6a383dab8a11c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3281260Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Commit-Queue: Johann Koenig <johannkoenig@google.com> Cr-Commit-Position: refs/heads/main@{#77892}
-
Dominik Inführ authored
Complete implementation of Heap::MakeHeapIterable() by also making the LABs of paged spaces iterable. This method is the one to use when the heap and/or a particular space shall be iterable. Bug: v8:12338 Change-Id: Id859cf1a05df21a54939c504c59d7b1ccd659c9b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277888Reviewed-by:
-
Andreas Haas authored
With eager compilation, CompilationEventCallbacks get released when all compilation units in the compilation state are finished. This is possible because no future compilation event could get triggered after that. With dynamic tiering, though, the {FinishedCompilationChunk} event can trigger repeatedly, even after all compilation units finish at some point in time, as dynamic tiering can create new CompilationUnits. As a temporary fix, CompilationEventCallbacks don't get released when dynamic tiering is enabled. This CL fixes this issue by turning the callback from an std::function into a class, and adding a second function to the class which indicates whether the callback can be released when all compilation units in the compilation state are finished. Thereby all callbacks can be deallocated except the ones like the code caching callback which waits for the {FinishedCompilationChunk} events. R=jkummerow@chromium.org Bug: v8:12289 Change-Id: I0f73f4bd2dffe644c9a26c274cb52ac6fa49ab67 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3264288 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#77890}
-
Manos Koukoutos authored
In each wasm CallDescriptor, we store the signature of the call based on the real parameters passed to the call. This signature is more precise than the formal function signature. We use this signature in inlining to enable more optimizations. Changes: - Add wasm_sig_ field to CallDescriptor. - Construct the real signature in {DoCall} and {DoReturnCall} in graph-builder-interface, and pass it to all call-related functions in WasmGraphBuilder. - Update {ReplaceTypeInCallDescriptorWith} to use ValueType over MachineType. Construct the updated function signature. - In wasm-inlining, kill the Call node after inlining. - Add two tests. Bug: v8:11510 Change-Id: Ica711b6b4d83945ecb7201be26577eab7db3c060 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3270539Reviewed-by:Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#77889}
-
JianxiaoLuIntel authored
Change-Id: I2c05683f2172cc4a37189382ad886f523d51e823 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3273814Reviewed-by:
Shu-yu Guo <syg@chromium.org> Reviewed-by:
Marja Hölttä <marja@chromium.org> Auto-Submit: Jianxiao Lu <jianxiao.lu@intel.com> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/main@{#77888}
-
v8-ci-autoroll-builder authored
Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/a17480d..8401429 Remove bazelbuild/rules_cc dependency (#1283) (Teodor Spæren) https://chromium.googlesource.com/external/github.com/google/benchmark/+/8401429 Support for building with LLVM clang-10/clang-11 on Windows. (#1227) (Alisenai) https://chromium.googlesource.com/external/github.com/google/benchmark/+/926f61d TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,mlippautz@chromium.org Change-Id: I8bf8ac6270221ea56ab065bb7acedd7dbe8f43f8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3281561Reviewed-by:
v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#77887}
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/2c7b246..d134d68 TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com Change-Id: Id7ae91bc1ac02eac6b9e5efe0c89b6e3a07a766b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3281560Reviewed-by:
-
- 14 Nov, 2021 1 commit
-
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/701766c..2c7b246 Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/08a95d8..3fca89b Rolling v8/third_party/googletest/src: https://chromium.googlesource.com/external/github.com/google/googletest/+log/9ca071b..1b18723 Rolling v8/tools/luci-go: git_revision:bf56a119c5f056a1f7a04c8dbe19cdd86728b540..git_revision:4cf9fa8105d30e3a6855bbfca50c5d6f88efb6b2 Rolling v8/tools/luci-go: git_revision:bf56a119c5f056a1f7a04c8dbe19cdd86728b540..git_revision:4cf9fa8105d30e3a6855bbfca50c5d6f88efb6b2 TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com Change-Id: I59ae20fdf916dc2d1fd24cb6c5fd3229d252b466 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3279044Reviewed-by:
-
- 13 Nov, 2021 1 commit
-
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/f38f611..701766c Rolling v8/third_party/aemu-linux-x64: eWKIKAWWZAJd3aNVfwGevVWupHnf0a31BNfVmvJfkucC.._9UC-vP_2UFSwkJLesq9YhIVywjThQvItoADZJtdSUcC Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/279fe4e..a7ad5b5 Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/0b187dc..08a95d8 Rolling v8/third_party/instrumented_libraries: https://chromium.googlesource.com/chromium/src/third_party/instrumented_libraries/+log/380f371..e09c4b6 Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/6da1d53..f8964a5 Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/92efe5e..32d7c38 TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com Change-Id: I1242a5a0b8efa55c9fa5c979c107122b84407b31 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3279042Reviewed-by:
-
- 12 Nov, 2021 23 commits
-
-
Jakob Kummerow authored
FLAG_wasm_dynamic_tiering is still off by default. When enabled, it now uses the technique previously behind --new-wasm-dynamic-tiering. Bug: v8:12281 Change-Id: I365c2c066e62418cd6abc7830f95d1fe0f950e33 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3275570 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/main@{#77883}
-
Igor Sheludko authored
The entered contexts stack must be in sync with the flags stack. Bug: chromium:1269225 Change-Id: Ibb522286b47866d5f13aaec1a0a02914c13a5545 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3279680 Commit-Queue: Igor Sheludko <ishell@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Auto-Submit: Igor Sheludko <ishell@chromium.org> Reviewed-by:
-
Shu-yu Guo authored
When incrementally marking a non-shared heap, shared values should not be marked. Similarly, non-shared values should not be marked when incrementally marking a shared heap. Bug: v8:11708 Change-Id: Iecd799e7e3060e5fb3897b8be0c4e8158d9ff57f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3278673 Commit-Queue: Shu-yu Guo <syg@chromium.org> Reviewed-by:
Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#77881}
-
Ng Zhi An authored
Bug: v8:12244,v8:12245 Change-Id: I4a57fbd187ffebb1c1f170865641caef7b193926 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3274017 Commit-Queue: Zhi An Ng <zhin@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#77880}
-
Junliang Yan authored
Change-Id: I8cd279059800567a81d8586944c8ed4c0ef9fa92 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3279101Reviewed-by:
Milad Fa <mfarazma@redhat.com> Commit-Queue: Junliang Yan <junyan@redhat.com> Cr-Commit-Position: refs/heads/main@{#77879}
-
Ng Zhi An authored
Bug: v8:12244,v8:12245 Change-Id: I02e08e79a7b3a07531bfac753beff13a866247e8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3269170Reviewed-by:
-
Igor Sheludko authored
Under certain conditions GC could flush bytecode array from SharedFunctionInfos. This CL ensures that the bytecode array is always available for reconstructing source positions. Bug: chromium:1265570 Change-Id: I2ce7eb04201f69121687ab0aaa2af42adb2caae0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3275569Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
-
Thibaud Michaud authored
Switching stack affects all instances, therefore make the active continuation a root object instead of an instance field. Bug: v8:12191 Change-Id: Ia521bf4e7c3cbca035f916e47804c2f75bbd8f18 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3268296Reviewed-by:
-
Ng Zhi An authored
This shadows ATOM used in js-regxp. Making this an enum class requires changing a lot of different places. Atom is an Intel brand name, so INTEL_ATOM kinda make sense. Bug: v8:12244,v8:12245 Change-Id: I80be342488328cde5aaca36f900375d2fb381253 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3276926Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Zhi An Ng <zhin@chromium.org> Cr-Commit-Position: refs/heads/main@{#77875}
-
Milad Fa authored
Change-Id: Iff669f6272e2a95d5150108d5a3a77e903afbeb9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3275568Reviewed-by:
Junliang Yan <junyan@redhat.com> Commit-Queue: Milad Fa <mfarazma@redhat.com> Cr-Commit-Position: refs/heads/main@{#77874}
-
Victor Gomes authored
UnprotectAndRegisterMemoryChunk should only be called if we have CodePageCollectionMemoryModificationScope or CodeSpaceMemoryModificationScope open. This also fixes cctests that create code objects without a code modification scope. Bug: v8:12054 Change-Id: Id931f1f8120050b2bb76ef3d5701b9a32e52ff37 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277882 Auto-Submit: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Victor Gomes <victorgomes@chromium.org> Reviewed-by:
-
Leszek Swirski authored
Unify parse post-processing between main-thread and background-thread parsing, now that we have LocalIsolate and can Internalize on background threads. As part of this, simplify the LocalIsolate parking pattern to explicitly park during ParseOnBackground, rather than being implicitly parked when ParseOnBackground is called. This reduces the amound of scoping needed in the BackgroundCompileTask::Run method. Change-Id: Ifdb128b763129bda78bd1bae89dac1c62f872350 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277876 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
-
Victor Gomes authored
When closing a concurrent allocator, for instance when closing a LocalHeap, we need to make the LAB of the code space iterable. We add then a CodePageMemoryModificationScope to allow code space modification. Bug: v8:12054 Change-Id: I438d7c1a50694930b7558dec2dd552bec22b7552 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277887 Commit-Queue: Victor Gomes <victorgomes@chromium.org> Reviewed-by:
-
Dominik Inführ authored
Speculative fix for a data race involving memory measurement. For memory measurement we use JSGlobalObject::native_context_unchecked in NativeContextInferrer::InferForJSObject when trying to infer the NativeContext for a JS object from a concurrent marking thread. This load can race e.g. with the context deserializer running on the main thread. Fix this race by making the load relaxed atomic. Bug: chromium:1269681 Change-Id: Id04a92572d7d722594b2f8465e579b7231e54e29 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277885 Auto-Submit: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by:
-
Leszek Swirski authored
Due to streaming, the SFI enqueueing can happen concurrently with with main-thread finalising, so we need to add locks around accesses to the SFI->Job map. Bug: v8:12370 Change-Id: I60281a954ef10f7fcde559b9529077a6b9a82c31 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277874 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Victor Gomes <victorgomes@chromium.org> Reviewed-by:
Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/main@{#77869}
-
Frank Tang authored
Diary https://docs.google.com/document/d/1NqMw7DAVFCZRx67auC7sgOvrikHvCYuaB87JUf21yG8/edit# https://chromium.googlesource.com/chromium/deps/icu.git/+log/eedbaf76..3e05d9da chromium roll in https://chromium-review.googlesource.com/c/chromium/src/+/3224333 Bug: chromium:1260116 Change-Id: Ie1922a129310106985f3bf1bffd9101fce6bb73a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3237532Reviewed-by:
-
Michael Lippautz authored
The DCHECK ensures that a page that is going to be destroyed is not anymore part of the vector of pages of a space. This DCHECK runs while a potential concurrent sweeper task may add a page for a live object to the vector, resulting in a broken iteration. Use the pages lock to fix this. Bug: chromium:1268969 Change-Id: Ice87026957b3e6b5d36cf28293f7aa6901e96ba2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277132 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Anton Bikineev <bikineev@chromium.org> Cr-Commit-Position: refs/heads/main@{#77867}
-
Michael Achenbach authored
No-Try: true Bug: v8:12054 Change-Id: I118d1680939d1282c580530f8aa12a4cf72e54d1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277875Reviewed-by:
-
Yujie Wang authored
- Add Wasm SIMD packing instruction: `LiftoffAssembler::emit_i8x16_{s,u}convert_i16x8` - Add Wasm SIMD unpacking instructions: `LiftoffAssembler::emit_i64x2_{s,u}convert_i32x4_{low,high}` `LiftoffAssembler::emit_i32x4_{s,u}convert_i16x8_{low,high}` `LiftoffAssembler::emit_i64x2_{s,u}convert_i32x4_{low,high}` - Add RVV instrucions: `vzext_vf{2,4,8}` and `vsext_vf{2,4,8}` - Fixed simulator for `vslidedown_vi` Bug: v8:11976 Change-Id: Idd383bc566589ce183f4fcef2201d2ccfe03519f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3273812Reviewed-by:ji qiu <qiuji@iscas.ac.cn> Reviewed-by:
Yahan Lu <yahan@iscas.ac.cn> Commit-Queue: ji qiu <qiuji@iscas.ac.cn> Cr-Commit-Position: refs/heads/main@{#77865}
-
v8-ci-autoroll-builder authored
Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/b3c08f6..a17480d Fix dependency typo and unpin cibuildwheel version in wheel building … (#1263) (Nicholas Junge) https://chromium.googlesource.com/external/github.com/google/benchmark/+/a17480d TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,mlippautz@chromium.org Change-Id: Iee5b0189f850eba665fe60670b0bdaa7e5a3f779 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3275844Reviewed-by:
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/2f14357..f38f611 Rolling v8/third_party/aemu-linux-x64: j1lOwTKOsgGUj2jDFDa6IhTVhwEoPPzmdxFksCvz278C..eWKIKAWWZAJd3aNVfwGevVWupHnf0a31BNfVmvJfkucC Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/0dab16a..279fe4e Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/2df8443..0b187dc Rolling v8/third_party/googletest/src: https://chromium.googlesource.com/external/github.com/google/googletest/+log/79efd96..9ca071b Rolling v8/third_party/instrumented_libraries: https://chromium.googlesource.com/chromium/src/third_party/instrumented_libraries/+log/286f857..380f371 Rolling v8/tools/luci-go: git_revision:d17c642c8c3c6d9e37bd9c25535c4c5b66b99781..git_revision:bf56a119c5f056a1f7a04c8dbe19cdd86728b540 Rolling v8/tools/luci-go: git_revision:d17c642c8c3c6d9e37bd9c25535c4c5b66b99781..git_revision:bf56a119c5f056a1f7a04c8dbe19cdd86728b540 TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com Change-Id: If831f3ede3b0e01ad34b4901448b7482f6c64d33 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3275842Reviewed-by:
-
Lu Yahan authored
Port 9a900169 The second parameter of Int64Mul may be a 64-bit immediate value, treating it as a 32-bit value will lose the upper 32 bits. Bug: v8:12373 Change-Id: Ib824db839219307ba390a6dc3c697bedb792046f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3275135 Auto-Submit: Yahan Lu <yahan@iscas.ac.cn> Commit-Queue: ji qiu <qiuji@iscas.ac.cn> Reviewed-by:
-
Yolanda Chen authored
Bug: v8:12228 Change-Id: I9312716f78e79fd0759c2f7adfef065b5df5cfda Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3275566Reviewed-by:
Zhi An Ng <zhin@chromium.org> Commit-Queue: Yolanda Chen <yolanda.chen@intel.com> Cr-Commit-Position: refs/heads/main@{#77861}
-
- 11 Nov, 2021 5 commits
-
-
Ng Zhi An authored
This fixes a -Wshadow warning for NO_FLAG. The other option is to make it an enum class, which makes test-conversions.cc a bit verbose. Bug: v8:12244,v8:12245 Change-Id: I3ea429eb45e31b25d4c6658ceb86c33ba280ae51 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3274015Reviewed-by:
Dmitry Gozman <dgozman@chromium.org> Commit-Queue: Zhi An Ng <zhin@chromium.org> Cr-Commit-Position: refs/heads/main@{#77860}
-
Ng Zhi An authored
Bug: v8:12244,v8:12245 Change-Id: I1f0c7fa26e6db208f621470d4bcbea904909a799 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3274014 Commit-Queue: Zhi An Ng <zhin@chromium.org> Reviewed-by:
-
Zhi An Ng authored
This reverts commit 72e01a06. Reason for revert: Failing on Linux 64, local bisect to this change, run with --random-seed-stress-count=1000 Original change's description: > Reland "[baseline] Enable concurrent sparkplug on future" > > This is a reland of 0e4554b4 > > Original change's description: > > [baseline] Enable concurrent sparkplug on future > > > > Bug: v8:12054 > > Change-Id: I9d5040c806232ecbe71c26b7d65acbc8005bbd00 > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3233139 > > Commit-Queue: Victor Gomes <victorgomes@chromium.org> > > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#77842} > > Bug: v8:12054 > Change-Id: I60849c6c9c7c7e6687422669e5636b2a283cc6ff > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3275560 > Commit-Queue: Victor Gomes <victorgomes@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#77850} TBR=leszeks@chromium.org,v8-scoped@luci-project-accounts.iam.gserviceaccount.com,victorgomes@chromium.org Change-Id: I26b75edb26bd81128a2a266461e7a917dff3b176 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:12054 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3276912Reviewed-by:
-
Seth Brenith authored
My previous change https://crrev.com/c/3160299 introduced a runtime CHECK that crashes the process if V8 attempts to read a deoptimization literal which has been cleared. That CHECK is indeed crashing the process. It appears that the trouble arises in cases where the deoptimization data indicates that an object should be materialized as needed. In those cases, one of the deoptimization literals is the Map to use when materializing the object. It is possible to reach a part of the code that requires the materialized object, and therefore the Map, without there being any other owner of that Map. This is in contrast to most other deoptimization literals, which are logically equivalent to omitted values from the stack frame and therefore can't be reached without a real owner somewhere to keep them alive. To fix, I propose referring to Maps strongly from the deoptimization literals. The cases I investigated in v8:4578 didn't involve Maps, so I believe that the observed memory leaks are still fixed with this change. Bug: chromium:1268681, chromium:1268683, chromium:1268825, v8:12300 Change-Id: Ifd32a7f9cc29e0384650013ab16e05646bf57895 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3272880 Commit-Queue: Seth Brenith <seth.brenith@microsoft.com> Reviewed-by:
-
Ng Zhi An authored
Bug: v8:12244,v8:12245 Change-Id: I4adafe31ffc747f7184c8b868f97e4a549e619ce Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3273530Reviewed-by:
-
