- 05 Oct, 2021 1 commit
-
-
Clemens Backes authored
The error showed when printing the resulting code object, because the tier was neither TurboFan nor Liftoff, even though the code was registered as a standard wasm function (instead of an import wrapper). R=jkummerow@chromium.org Bug: chromium:1254674 Change-Id: I26482fd88d72403393428979abf08e9f60cd8c4c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3202001 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#77238}
-
- 04 Oct, 2021 1 commit
-
-
Manos Koukoutos authored
Trying to optimize in such case breaks down the optimization, as we end up with potentially non-eliminatable nodes that depend on the dead IfTrue/IfFalse node. Drive-by: Clean up dead nodes with {Kill()}. Bug: v8:11510, chromium:1255354 Change-Id: Ia89fe6c243974c3c2abac6ad80bd4677a935f637 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3200073Reviewed-by:
Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#77211}
-
- 01 Oct, 2021 1 commit
-
-
Ng Zhi An authored
Bug: chromium:1254675 Change-Id: I8c24d3956752a367a4fa60827ee47a589c48e699 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3197700Reviewed-by:
Clemens Backes <clemensb@chromium.org> Commit-Queue: Zhi An Ng <zhin@chromium.org> Cr-Commit-Position: refs/heads/main@{#77201}
-
- 24 Sep, 2021 1 commit
-
-
Thibaud Michaud authored
In Liftoff, the result of table.grow was smi-untagged and sign-extended to a ptr-sized value. However the result is typed as i32, so the upper 32 bits should be cleared on 64 bit platforms. In particular this is observable when the value is used as an index for a memory operand, which leads to the repro in the attached issue. Match the TF behavior by untagging the value as a 32-bit int. R=clemensb@chromium.org CC=ahaas@chromium.org Bug: chromium:1251465 Change-Id: Ia57fd8a69ecb2787b42bbf8217e448976aa1dbd9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3173680Reviewed-by:
Clemens Backes <clemensb@chromium.org> Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Cr-Commit-Position: refs/heads/main@{#77044}
-
- 21 Sep, 2021 1 commit
-
-
Clemens Backes authored
The fix is released now, so we can add the tests to the public repo. R=ahaas@chromium.org Bug: chromium:1239116 Change-Id: Ie1489f6bcd934f84222b4631921475c389f778dd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3172752Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#76957}
-
- 15 Sep, 2021 1 commit
-
-
Jakob Kummerow authored
Per https://github.com/WebAssembly/gc/issues/234, this implements "nominal" type definitions with explicit supertypes, and statically typed RTT-less instructions for allocation and testing/casting. This should be fully backwards compatible with existing Wasm modules. Spec: https://bit.ly/3cWcm6Q ("version 4") Bug: v8:7748 Change-Id: Id5a1399b368fdfad22036cfd66f1bef593e640f7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3144916 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#76844}
-
- 10 Sep, 2021 2 commits
-
-
Clemens Backes authored
In the case that {dst}, {lhs} and {rhs} all point to the same register, we would emit wrong code (negating the register and adding it to itself). This CL fixes this by checking if {lhs == rhs}, and just clearing the {dst} register in that case. R=thibaudm@chromium.org Bug: chromium:1247659 Change-Id: I7913617850adb34a5ad812369f16a7422358454d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3151955Reviewed-by:
Thibaud Michaud <thibaudm@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#76765}
-
Clemens Backes authored
With statically in-bounds memory accesses (implemented in https://crrev.com/c/2919827) we would only have an offset but no index register for {TraceMemoryOperation}. This CL fixes that situation. R=thibaudm@chromium.org Bug: chromium:1248024 Change-Id: I856b263a560cb71791c61e446e78dd99c9664190 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3149464Reviewed-by:
Thibaud Michaud <thibaudm@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#76763}
-
- 07 Sep, 2021 1 commit
-
-
Clemens Backes authored
This is a reland of 1786f8d7. It turned out that also x64 is broken, and only for TurboFan. Both is fixed now. Original change's description: > [arm64][liftoff] Fix trap handling on load lane > > This fixes the registered {protected_load_pc} to (always) point to the > actual load instruction. If {dst != src} we would emit a register move > before the load, and the trap handler would then not recognize the PC > where the signal occurs, leading to a segfault. > > R=thibaudm@chromium.org > > Bug: chromium:1242300, v8:12018 > Change-Id: I3ed2a8307e353fd85a7ddedf6ecb73e90a112d32 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3136454 > Reviewed-by: Thibaud Michaud <thibaudm@chromium.org> > Commit-Queue: Clemens Backes <clemensb@chromium.org> > Cr-Commit-Position: refs/heads/main@{#76642} Bug: chromium:1242300, v8:12018 Change-Id: I79284ab9815f5363f759569d98c8c4b52d48e738 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3140609Reviewed-by:
Thibaud Michaud <thibaudm@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#76698}
-
- 02 Sep, 2021 2 commits
-
-
Nico Hartmann authored
This reverts commit 1786f8d7. Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64/44442/overview Original change's description: > [arm64][liftoff] Fix trap handling on load lane > > This fixes the registered {protected_load_pc} to (always) point to the > actual load instruction. If {dst != src} we would emit a register move > before the load, and the trap handler would then not recognize the PC > where the signal occurs, leading to a segfault. > > R=thibaudm@chromium.org > > Bug: chromium:1242300, v8:12018 > Change-Id: I3ed2a8307e353fd85a7ddedf6ecb73e90a112d32 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3136454 > Reviewed-by: Thibaud Michaud <thibaudm@chromium.org> > Commit-Queue: Clemens Backes <clemensb@chromium.org> > Cr-Commit-Position: refs/heads/main@{#76642} Bug: chromium:1242300, v8:12018 Change-Id: I7bc9d00a4fba3101e7ee68695961d1b543268c4e No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3138202Reviewed-by:
Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#76644}
-
Clemens Backes authored
This fixes the registered {protected_load_pc} to (always) point to the actual load instruction. If {dst != src} we would emit a register move before the load, and the trap handler would then not recognize the PC where the signal occurs, leading to a segfault. R=thibaudm@chromium.org Bug: chromium:1242300, v8:12018 Change-Id: I3ed2a8307e353fd85a7ddedf6ecb73e90a112d32 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3136454Reviewed-by:
Thibaud Michaud <thibaudm@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#76642}
-
- 24 Aug, 2021 1 commit
-
-
Ng Zhi An authored
We were overwriting the shift Register, instead, we should be using the tmp_shift register. Bug: chromium:1242689 Change-Id: I732c9c1f8a43401ce003b22893db9e39dfac3817 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3116115 Commit-Queue: Zhi An Ng <zhin@chromium.org> Reviewed-by:
Adam Klein <adamk@chromium.org> Cr-Commit-Position: refs/heads/main@{#76466}
-
- 19 Aug, 2021 1 commit
-
-
Jakob Kummerow authored
Operator::kEliminatable has the unfortunate consequence that depending on surrounding code, the allocating builtin call could get scheduled before the max length check, causing a crash instead of a trap. Fixed: chromium:1239954 Change-Id: Ice2e3e4f67e8fce44a886c0079e0e31f124c02b0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3103315Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Manos Koukoutos <manoskouk@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#76385}
-
- 16 Aug, 2021 2 commits
-
-
Clemens Backes authored
The {CodeSpaceWriteScope} in {InstanceBuilder::Build} was kept open while processing imports, which could compile another wasm module via {compiler::ResolveWasmImportCall} and {WasmEngine::SyncCompileTranslatedAsmJs}. This leads to errors since {CodeSpaceWriteScope}s for different modules cannot be held open at the same time. This CL fixes that by only opening the {CodeSpaceWriteScope} for the actual compilation of import wrappers. Drive-by: Only call {ProcessImports} if there are imports to be processed, to avoid some of the overhead of {ProcessImports} and {CompileImportWrappers}. R=jkummerow@chromium.org Bug: chromium:1239522 Change-Id: Ifbaf64a4be92088ae4a3fd7e9700a33397b2a967 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097283 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#76311}
-
Jakob Kummerow authored
The static limit didn't account for possible S128 elements. This patch makes the limit element type specific. Fixed: chromium:1237024 Change-Id: Ic1e37656e2882c0eb7ea6400c83e4094eb747e88 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3097269Reviewed-by:
Clemens Backes <clemensb@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#76303}
-
- 09 Aug, 2021 2 commits
-
-
Manos Koukoutos authored
Since array.new_with_rtt implicitly introduces a loop, we should mark any loop including this instruction as non-innermost. Bug: chromium:1236958 Change-Id: I2d92b5fdba748df0e4ac1d6cbc524428b1042578 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3080574 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#76178}
-
Manos Koukoutos authored
We currently print reference type indices as unsigned LEB. This will not work properly for large indices (>=64), as they will be interpreted as negative indices when read back. They may also alias with builtin types. In this CL, we fix this by defining builtin types as negative numbers. We add positive byte constants that can be used in function bodies. We adapt wasm-module-builder and tests to the above changes. Bug: v8:7748 Change-Id: I4dfaa65d4cbf77a6731ca2283148bd842ea5c56b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3080569 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#76176}
-
- 03 Aug, 2021 1 commit
-
-
Thibaud Michaud authored
Also introduce a separate error type for WebAssembly.Exception, since the properties should not be added to RuntimeError. R=jkummerow@chromium.org Bug: v8:11992 Change-Id: I8f4ae0da9a95184366e07dc43e58a5a9ff4382ae Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3055304Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Cr-Commit-Position: refs/heads/master@{#76061}
-
- 29 Jul, 2021 1 commit
-
-
Thibaud Michaud authored
The JS API constructor was renamed to "WebAssembly.Tag" to match the spec: https://github.com/WebAssembly/exception-handling/issues/159 Rename "exception" to "tag" throughout the codebase for consistency with the JS API, and to match the spec terminology (e.g. "tag section"). R=clemensb@chromium.org,nicohartmann@chromium.org Bug: v8:11992 Change-Id: I63f9f3101abfeefd49117461bd59c594ca5dab70 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3053583Reviewed-by:
Clemens Backes <clemensb@chromium.org> Reviewed-by:
Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#75994}
-
- 24 Jul, 2021 1 commit
-
-
Clemens Backes authored
This is a reland of b99fe75c. The test is now skipped on non-SIMD hardware. Original change's description: > [liftoff][arm64] Zero-extend offsets also for SIMD > > This extends https://crrev.com/c/2917612 also for SIMD, which > (sometimes) uses the special {GetMemOpWithImmOffsetZero} method. > As part of this CL, that method is renamed to {GetEffectiveAddress} > which IMO is a better name. Also, it just returns a register to make the > semantic of that function obvious in the signature. > > Drive-by: When sign extending to 32 bit, only write to the W portion of > the register. This is a bit cleaner, and I first thought that > this would be the bug. > > R=jkummerow@chromium.org > CC=thibaudm@chromium.org > > Bug: chromium:1231950, v8:12018 > Change-Id: Ifaefe1f18e3a00534a30c99e3c37ed09d9508f6e > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3049073 > Reviewed-by: Zhi An Ng <zhin@chromium.org> > Commit-Queue: Clemens Backes <clemensb@chromium.org> > Cr-Commit-Position: refs/heads/master@{#75898} TBR=zhin@chromium.org CC=jkummerow@chromium.org, thibaudm@chromium.org Bug: chromium:1231950, v8:12018 Change-Id: I662b62fafe99389be7a6c23b970fdf3768f866cf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3051610Reviewed-by:
Clemens Backes <clemensb@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#75901}
-
- 23 Jul, 2021 2 commits
-
-
Michael Achenbach authored
This reverts commit b99fe75c. Reason for revert: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux/43105 Original change's description: > [liftoff][arm64] Zero-extend offsets also for SIMD > > This extends https://crrev.com/c/2917612 also for SIMD, which > (sometimes) uses the special {GetMemOpWithImmOffsetZero} method. > As part of this CL, that method is renamed to {GetEffectiveAddress} > which IMO is a better name. Also, it just returns a register to make the > semantic of that function obvious in the signature. > > Drive-by: When sign extending to 32 bit, only write to the W portion of > the register. This is a bit cleaner, and I first thought that > this would be the bug. > > R=jkummerow@chromium.org > CC=thibaudm@chromium.org > > Bug: chromium:1231950, v8:12018 > Change-Id: Ifaefe1f18e3a00534a30c99e3c37ed09d9508f6e > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3049073 > Reviewed-by: Zhi An Ng <zhin@chromium.org> > Commit-Queue: Clemens Backes <clemensb@chromium.org> > Cr-Commit-Position: refs/heads/master@{#75898} Bug: chromium:1231950, v8:12018 Change-Id: I4e7a9d6fa6809b7c4d9be919cd5698737d784849 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3049085 Auto-Submit: Michael Achenbach <machenbach@chromium.org> Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#75900}
-
Clemens Backes authored
This extends https://crrev.com/c/2917612 also for SIMD, which (sometimes) uses the special {GetMemOpWithImmOffsetZero} method. As part of this CL, that method is renamed to {GetEffectiveAddress} which IMO is a better name. Also, it just returns a register to make the semantic of that function obvious in the signature. Drive-by: When sign extending to 32 bit, only write to the W portion of the register. This is a bit cleaner, and I first thought that this would be the bug. R=jkummerow@chromium.org CC=thibaudm@chromium.org Bug: chromium:1231950, v8:12018 Change-Id: Ifaefe1f18e3a00534a30c99e3c37ed09d9508f6e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3049073Reviewed-by:
Zhi An Ng <zhin@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#75898}
-
- 14 Jul, 2021 1 commit
-
-
Clemens Backes authored
This avoids a DCHECK failure if we continue using the Assembler after code generation abortion. Even though it might not be the best style to still call methods on the Assembler after abortion, it's not a problem apart from the firing DCHECK, so we apply this simple fix instead of making sure to really abort everything immediately. R=leszeks@chromium.org Bug: chromium:1228720, chromium:1217074 Change-Id: Iac3a652f21e34534dd28fb1ab580ab2ee6df06dd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3024157Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#75716}
-
- 09 Jul, 2021 1 commit
-
-
Clemens Backes authored
We cannot emit the constant pool within the safepoint table data. It seems like we also don't do that, but the forgotten {BlockConstPoolScope} triggered a DCHECK. R=leszeks@chromium.org Bug: chromium:1227351, chromium:1217074 Change-Id: I187004c83e05002c651a15643bddea5b02cb00c3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3015559Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#75657}
-
- 07 Jul, 2021 1 commit
-
-
Clemens Backes authored
We did not handle conflicts between regular register moves and the cached instance / cached memory start correctly. This could lead to us overwriting a regular register when restoring the cached instance, which results in either crashes or miscalculations afterwards. R=ahaas@chromium.org Bug: chromium:1217064 Change-Id: Icd4b08b97a47726108a50d51b3a7ba410d132f98 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3003158Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#75602}
-
- 01 Jul, 2021 1 commit
-
-
Jakob Kummerow authored
We've already been zero-extending 32-bit offset registers since https://chromium-review.googlesource.com/c/v8/v8/+/2917612, but that patch only covered the case where offset_imm == 0. When there is a non-zero offset, we need the same fix. Bug: chromium:1224882,v8:11809 Change-Id: I1908f735929798f411346807fc4f3c79d8e04362 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2998582 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#75500}
-
- 30 Jun, 2021 1 commit
-
-
Clemens Backes authored
This will automatically skip the test in the stress_snapshot variant, where Wasm is not supported. R=cbruni@chromium.org Bug: v8:11937 Change-Id: I29078e070a7b1526470e15d8667c5256ea4d8fe1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2996642Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#75473}
-
- 07 Jun, 2021 1 commit
-
-
Clemens Backes authored
When growing a memory without a maximum, we should still check against the spec'ed limit, to avoid an overflow when computing the new number of pages. R=ahaas@chromium.org Bug: chromium:1215808 Change-Id: I476b954268277e7dce1106a9b8c3c713b0d1a560 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2944433Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#74980}
-
- 01 Jun, 2021 2 commits
-
-
Camillo Bruni authored
- Add d8.file.read() and d8.file.execute() helpers - Change tools and tests to use new d8.file helper - Unify error throwing in v8::Shell::ReadFile Change-Id: I5ef4cb27f217508a367106f01e872a4059d5e399 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2928505 Commit-Queue: Camillo Bruni <cbruni@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Reviewed-by:
Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/master@{#74883}
-
Thibaud Michaud authored
The upper 32 bits of the 64 bit offset register are not guaranteed to be cleared, so a zero-extension is needed. We already do the zero-extension in the case of explicit bounds checking, but this should also be done if the trap handler is enabled. R=clemensb@chromium.org CC=jkummerow@chromium.org Bug: v8:11809 Change-Id: I21e2535c701041d11fa06c176fa683d82db0a3f1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2917612 Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Reviewed-by:
Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#74881}
-
- 25 May, 2021 1 commit
-
-
Clemens Backes authored
There are two different limits for the maximum memory size in WebAssembly: 1) A 4GB limit which is the same on all platforms, and is observable for JS programs. It is used to limit the allowed declared maximum size of a wasm memory. 2) A potentially lower limit (2GB on 32-bit systems, 4GB otherwise) which can be further limited using a command-line flag. This limit is used whenever actually allocating or growing a wasm memory. This limit is not directly observable, but we make sure that no wasm memory will ever be bigger than this limit. The second limit is the one we should check against when allocating or growing memory, while the first limit should be used when validating a module (or the parameters for WebAssembly.Memory). The compiler can rely on no memory being bigger than the second limit, which again is never bigger than the first limit. This CL adds some more documentation to the two limits, and cleans up all usages. This also makes {kPlatformMaxPages} and {kMaxMemoryPagesAtRuntime} obsolete. R=jkummerow@chromium.org Bug: chromium:1207263 Change-Id: I43541aafd3f497d1c368bd9400e9bc667bdfd3d9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2910787 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#74742}
-
- 05 May, 2021 2 commits
-
-
Benedikt Meurer authored
As per WebAssembly Web API[1], the engine should only consider names from the name section to synthesize function names in the context of call stacks. We previously also added support to harvest the exports table here in an attempt to improve the DevTools debugging experience, but that needs a separate fix specifically for the inspector (which should also take into account the imports to harvest names). [1]: https://webassembly.github.io/spec/web-api/index.html#conventions Fixed: chromium:1164305 Change-Id: I4bde5c8398a5164f1d8ac9060ad3743ed494c41e Bug: chromium:1159307, chromium:1164241, chromium:1071432 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2874464 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Auto-Submit: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#74382}
-
Manos Koukoutos authored
Element segments and tables in tests used an ad-hoc mechanism to describe the different types of initializer expressions, e.g. an number which could denote either the value of a constant or the index of a global. This CL tidies up and generalizes the test infrastructure by directly using WasmInitExpr in those cases. Additional changes: - Introduce WasmElemSegment class. - Remove obsolete --experimental-wasm-bulk-memory flag from tests. - Rename WasmInitExpr.type -> kind. - Remove dependency of wasm-module-builder from mjsunit.js (except in assertTraps). Change-Id: I716254a04ceea9ceb8ac6b848e12e1637f618f0d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2857638 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by:
Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#74368}
-
- 29 Apr, 2021 1 commit
-
-
Jakob Kummerow authored
Replacing a crash with a TypeError. Bug: chromium:1203692 Change-Id: I6970f980b46f20033f29c1deb9bc5d49ea2014ae Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2856842 Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#74266}
-
- 27 Apr, 2021 2 commits
-
-
Andreas Haas authored
R=clemensb@chromium.org Bug: chromium:1202736 Change-Id: Id4056ba60fdaa5d5fbe2099ef0823da70a28e6ac Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2853601 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#74234}
-
Manos Koukoutos authored
Changes: - Add WasmInitExpr class which knows how to create initializer expressions as pairs of {type, value}. Also define a default for every type. Emit such pairs to a byte array with emit_init_expr(). - Add an initializer expression to every global (addGlobal() uses the default if the argument is absent). - Introduce wasmI64Const(); - Update tests as needed. Change-Id: I75ffe96604891506ad78bd3677ce1efe5e0cee07 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2851892 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by:
Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#74231}
-
- 26 Apr, 2021 2 commits
-
-
Andreas Haas authored
R=clemensb@chromium.org Bug: chromium:1196837 Change-Id: I8945e25be12155482e1feefe1cfd980a94b0488d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2850646Reviewed-by:
Clemens Backes <clemensb@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#74180}
-
Clemens Backes authored
We were inconsistent in handling offsets >= 2GB on 32-bit systems. The code was still relying on this being detected as statically out of bounds, but with the increase of {kV8MaxWasmMemoryPages} to support 4GB memories, this is not the case any more. This CL fixes this by again detecting such situations as statically OOB. We do not expect to be able to allocate memories of size >2GB on such systems. If this assumptions turns out to be wrong, we will erroneously trap. If that happens, we will have to explicitly disallow memories of such size on 32-bit systems. R=jkummerow@chromium.org Bug: v8:7881, chromium:1201340 Change-Id: Ic89a67d38fb860eb8a48a4ff51bc02c53f8a2c2a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2848467Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#74175}
-
- 23 Apr, 2021 1 commit
-
-
Clemens Backes authored
JS-to-Wasm wrappers embed heap constants (like the undefined value), and those heap values are being accessed during compilation for tracing. This is not a data race, since those values are read-only. But if the isolate dies while we are compiling those wrappers, we might read from the heap after it has been free'd. Ideally we would not access the isolate or the heap at all during compilation, but delaying all tracing until the "finalization" phase is not feasible, and removing the heap value printing from tracing would significantly regress quality of this tracing. Hence this CL only fixes the actual issue: That we keep compiling wrappers when the isolate is already gone. It does so by introducing an {OperationsBarrier} per isolate that is being taken by each thread that executes wrapper compilation, and is used for waiting for background threads to finish before the isolate shuts down. Additionally, we actually cancel all compilation if a module dies (or the isolate shuts down) before it finished baseline compilation. In this state, the module cannot be shared between isolates yet, so it's safe to fully cancel all compilation. This cancellation is not strictly necessary, but it will reduce the time we are blocked while waiting for wrapper compilation to finish (because no new compilation will start). R=thibaudm@chromium.org CC=manoskouk@chromium.org Bug: v8:11626, chromium:1200231 Change-Id: I5b19141d22bd0cb00ba84ffa53fb07cf001e13cc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2846881Reviewed-by:
Thibaud Michaud <thibaudm@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#74142}
-
- 21 Apr, 2021 1 commit
-
-
Manos Koukoutos authored
Changes: - Remove TypeCheckBranchResult. Change TypeCheckBranch() to return bool. Refactor call sites to reflect this (decouple current code reachability check from type check). - Unify TypeCheckBranch(), TypeCheckFallthrough(), and the type-checking part of Return() into TypeCheckStackAgainstMerge(). - Make sure all TypeCheck* functions are only called within VALIDATE. - In graph-builder-interface, rename end_env -> merge_env to reflect its function for loops. - Change expected error messages in some tests. Change-Id: I857edc18db9c2454ad12d539ffe7a10e96367710 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2839560Reviewed-by:
Clemens Backes <clemensb@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/master@{#74100}
-