1. 17 Jan, 2022 1 commit
  2. 13 Jan, 2022 2 commits
    • Leszek Swirski's avatar
      Revert "cppgc-js,heap: Implement snapshots for embedder fields" · 7d4e3d35
      Leszek Swirski authored
      This reverts commit 142dd775.
      
      Reason for revert: TSAN breaks: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20stress-incremental-marking/6113/overview
      
      Original change's description:
      > cppgc-js,heap: Implement snapshots for embedder fields
      >
      > https://crrev.com/c/3293410 added concurrent processing of C++ objects
      > found through V8 embedder fields. The CL missed that those embedder
      > fields are not read atomically from JS objects. The problem is that
      > embedder fields are only aligned to kTaggedSize on builds with pointer
      > compression and are as such mis-aligned for atomic ops. This is not a
      > problem for on-heap values as the upper 32bits are anyways computed
      > from the cage. Is is a problem for generic C++ values though, as they
      > are used with Oilpan.
      >
      > This CL adds the standard marker snapshot protocol for embedder fields.
      >
      > Marker:
      > 1. Snapshot embedder fields
      > 2. Try to mark host object
      > 3. On success: process snapshot
      >
      > Main thread:
      > 1. On setting embedder fields mark the object black first
      > 2. Emit a write barrier for the embedder fields
      >
      > This will get simpler with the heap sandbox that uses a separate table
      > for embedder fields. Once the sandbox is the default configuration, we
      > 	can use it as dependency for the concurrent fast path.
      >
      > Bug: chromium:1285706
      > Change-Id: I6b975ea561be08cda840ef0dd27a11627de93900
      > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3380983
      > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
      > Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
      > Cr-Commit-Position: refs/heads/main@{#78604}
      
      Bug: chromium:1285706
      Change-Id: If1976c0356f450fc068aa4dcc39fb9a0d5417a40
      No-Presubmit: true
      No-Tree-Checks: true
      No-Try: true
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3386598
      Auto-Submit: Leszek Swirski <leszeks@chromium.org>
      Owners-Override: Leszek Swirski <leszeks@chromium.org>
      Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
      Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
      Cr-Commit-Position: refs/heads/main@{#78605}
      7d4e3d35
    • Michael Lippautz's avatar
      cppgc-js,heap: Implement snapshots for embedder fields · 142dd775
      Michael Lippautz authored
      https://crrev.com/c/3293410 added concurrent processing of C++ objects
      found through V8 embedder fields. The CL missed that those embedder
      fields are not read atomically from JS objects. The problem is that
      embedder fields are only aligned to kTaggedSize on builds with pointer
      compression and are as such mis-aligned for atomic ops. This is not a
      problem for on-heap values as the upper 32bits are anyways computed
      from the cage. Is is a problem for generic C++ values though, as they
      are used with Oilpan.
      
      This CL adds the standard marker snapshot protocol for embedder fields.
      
      Marker:
      1. Snapshot embedder fields
      2. Try to mark host object
      3. On success: process snapshot
      
      Main thread:
      1. On setting embedder fields mark the object black first
      2. Emit a write barrier for the embedder fields
      
      This will get simpler with the heap sandbox that uses a separate table
      for embedder fields. Once the sandbox is the default configuration, we
      	can use it as dependency for the concurrent fast path.
      
      Bug: chromium:1285706
      Change-Id: I6b975ea561be08cda840ef0dd27a11627de93900
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3380983Reviewed-by: 's avatarDominik Inführ <dinfuehr@chromium.org>
      Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#78604}
      142dd775
  3. 11 Jan, 2022 3 commits
  4. 10 Jan, 2022 7 commits
  5. 07 Jan, 2022 1 commit
  6. 05 Jan, 2022 4 commits
  7. 04 Jan, 2022 1 commit
  8. 27 Dec, 2021 1 commit
    • Omer Katz's avatar
      cppgc-js, heap: Concurrently push references from v8 to Oilpan · d10f61e1
      Omer Katz authored
      Included in this CL:
      (*) Introduce CppMarkingState that V8 should use to push references to
          Oilpan. CppMarkingState allocates its own Worklist::Locals to
          support concurrent updates from V8.
      (*) Split Oilpan MarkingWorklist object to form a base class used by
          CppMarkingState.
      (*) Remove MarkerFactory and split marking initialization. Marking
          worklists should already be initialized when V8 initializes
          visitors. For incremental marking, this requires splitting
          marking initialization and marking start.
      (*) Drive-by: Mark JSObject::IsApiWrapper and
          JSObject::IsDroppableApiWrapper as const.
      
      Bug: v8:12407
      Change-Id: I35cc816343da86f69a68306204675720e9b3913f
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3293410Reviewed-by: 's avatarDominik Inführ <dinfuehr@chromium.org>
      Reviewed-by: 's avatarMichael Lippautz <mlippautz@chromium.org>
      Commit-Queue: Omer Katz <omerkatz@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#78446}
      d10f61e1
  9. 15 Dec, 2021 1 commit
    • Samuel Groß's avatar
      V8 Sandbox rebranding · 277fdd1d
      Samuel Groß authored
      This CL renames a number of things related to the V8 sandbox.
      Mainly, what used to be under V8_HEAP_SANDBOX is now under
      V8_SANDBOXED_EXTERNAL_POINTERS, while the previous V8 VirtualMemoryCage
      is now simply the V8 Sandbox:
      
      V8_VIRTUAL_MEMORY_CAGE => V8_SANDBOX
      V8_HEAP_SANDBOX => V8_SANDBOXED_EXTERNAL_POINTERS
      V8_CAGED_POINTERS => V8_SANDBOXED_POINTERS
      V8VirtualMemoryCage => Sandbox
      CagedPointer => SandboxedPointer
      fake cage => partially reserved sandbox
      src/security => src/sandbox
      
      This naming scheme should simplify things: the sandbox is now the large
      region of virtual address space inside which V8 mainly operates and
      which should be considered untrusted. Mechanisms like sandboxed pointers
      are then used to attempt to prevent escapes from the sandbox (i.e.
      corruption of memory outside of it). Furthermore, the new naming scheme
      avoids the confusion with the various other "cages" in V8, in
      particular, the VirtualMemoryCage class, by dropping that name entirely.
      
      Future sandbox features are developed under their own V8_SANDBOX_X flag,
      and will, once final, be merged into V8_SANDBOX. Current future features
      are sandboxed external pointers (using the external pointer table), and
      sandboxed pointers (pointers guaranteed to point into the sandbox, e.g.
      because they are encoded as offsets). This CL then also introduces a new
      build flag, v8_enable_sandbox_future, which enables all future features.
      
      Bug: v8:10391
      Change-Id: I5174ea8f5ab40fb96a04af10853da735ad775c96
      Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3322981Reviewed-by: 's avatarHannes Payer <hpayer@chromium.org>
      Reviewed-by: 's avatarIgor Sheludko <ishell@chromium.org>
      Reviewed-by: 's avatarMichael Achenbach <machenbach@chromium.org>
      Reviewed-by: 's avatarToon Verwaest <verwaest@chromium.org>
      Commit-Queue: Samuel Groß <saelo@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#78384}
      277fdd1d
  10. 14 Dec, 2021 2 commits
  11. 08 Dec, 2021 3 commits
  12. 07 Dec, 2021 1 commit
    • Corentin Pescheloche's avatar
      Reland "[profiler] Surface VM & Embedder State" · e155881f
      Corentin Pescheloche authored
      This is a reland of 2d087f23
      
      The changes are :
      * Fix redundant reinterpret_cast in test file for MSVC failure
      https://crbug.com/v8/12476
      * Fix flaky test
      https://crbug.com/v8/12475
      If a sample is captured during a GC, no embedder context is obtained
      defaulting to EMPTY. This is the expected behavior, made it in clear
      in implementation and in test.
      * Synchronized the embedder context filter behavior with existing
      native context filter.
      
      Original change's description:
      
      > Add APIs to surface VMState and new EmbedderState to CpuProfile samples.
      >
      > EmbedderState:
      > * An EmbedderState is defined as a value uint8_t and a v8::context used
      > for filtering.
      > * EmbedderStates are stack allocated by the embedder, construction and
      > destruction set/unset the state to the isolate thread local top.
      > * A v8::context is used to filter states that are added to a CpuProfile,
      > if the CpuProfile do not have a ContextFilter set or if contexts do not
      > match, state defaults to Empty.
      >
      > * v8:StateTag is already propagated all the way to a Sample, simply add
      > an API to surface it.
      >
      > VMState:
      > Change-Id: I7eed08907360b99b0ad20ddcff59c95c7076c85e
      > Bug: chromium:1263871
      > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3188072
      > Auto-Submit: Corentin Pescheloche <cpescheloche@fb.com>
      > Reviewed-by: Camillo Bruni <cbruni@chromium.org>
      > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
      > Reviewed-by: Igor Sheludko <ishell@chromium.org>
      > Commit-Queue: Camillo Bruni <cbruni@chromium.org>
      > Cr-Commit-Position: refs/heads/main@{#78250}
      
      Bug: chromium:1263871
      Change-Id: Ief891b05da99c695e9fb70f94ed7ebdecc6c3b7b
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3320037
      Auto-Submit: Corentin Pescheloche <cpescheloche@fb.com>
      Reviewed-by: 's avatarCamillo Bruni <cbruni@chromium.org>
      Reviewed-by: 's avatarIgor Sheludko <ishell@chromium.org>
      Reviewed-by: 's avatarDominik Inführ <dinfuehr@chromium.org>
      Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#78281}
      e155881f
  13. 06 Dec, 2021 4 commits
    • Camillo Bruni's avatar
      Revert "[profiler] Surface VM & Embedder State" · 480a917d
      Camillo Bruni authored
      This reverts commit 2d087f23.
      
      Reason for revert: 
      - Causing MSVC build failures: https://crbug.com/v8/12476
      - Causing flaky failures: https://crbug.com/v8/12475
      
      Original change's description:
      > [profiler] Surface VM & Embedder State
      >
      > Add APIs to surface VMState and new EmbedderState to CpuProfile samples.
      >
      > EmbedderState:
      > * An EmbedderState is defined as a value uint8_t and a v8::context used
      > for filtering.
      > * EmbedderStates are stack allocated by the embedder, construction and
      > destruction set/unset the state to the isolate thread local top.
      > * A v8::context is used to filter states that are added to a CpuProfile,
      > if the CpuProfile do not have a ContextFilter set or if contexts do not
      > match, state defaults to Empty.
      >
      > * v8:StateTag is already propagated all the way to a Sample, simply add
      > an API to surface it.
      >
      > VMState: 
      > Change-Id: I7eed08907360b99b0ad20ddcff59c95c7076c85e
      > Bug: chromium:1263871
      > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3188072
      > Auto-Submit: Corentin Pescheloche <cpescheloche@fb.com>
      > Reviewed-by: Camillo Bruni <cbruni@chromium.org>
      > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
      > Reviewed-by: Igor Sheludko <ishell@chromium.org>
      > Commit-Queue: Camillo Bruni <cbruni@chromium.org>
      > Cr-Commit-Position: refs/heads/main@{#78250}
      
      Bug: chromium:1263871, v8:12475, v8:12476
      Change-Id: I02670b1ed3bb863033208369227642a7419fce00
      No-Presubmit: true
      No-Tree-Checks: true
      No-Try: true
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3315444
      Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
      Reviewed-by: 's avatarMichael Lippautz <mlippautz@chromium.org>
      Reviewed-by: 's avatarToon Verwaest <verwaest@chromium.org>
      Commit-Queue: Camillo Bruni <cbruni@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#78256}
      480a917d
    • Samuel Groß's avatar
      Add LsanVirtualAddressSpace implementation · ad9c395d
      Samuel Groß authored
      When leak sanitizer is active, an LsanVirtualAddressSpace is used and
      takes care of marking the allocated pages as lsan root regions.
      
      Bug: chromium:1276767
      Change-Id: I3d8a61f7d3c59e4574e46707d2217031a32e3f0e
      Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3314828
      Commit-Queue: Samuel Groß <saelo@chromium.org>
      Reviewed-by: 's avatarMichael Lippautz <mlippautz@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#78251}
      ad9c395d
    • Corentin Pescheloche's avatar
      [profiler] Surface VM & Embedder State · 2d087f23
      Corentin Pescheloche authored
      Add APIs to surface VMState and new EmbedderState to CpuProfile samples.
      
      EmbedderState:
      * An EmbedderState is defined as a value uint8_t and a v8::context used
      for filtering.
      * EmbedderStates are stack allocated by the embedder, construction and
      destruction set/unset the state to the isolate thread local top.
      * A v8::context is used to filter states that are added to a CpuProfile,
      if the CpuProfile do not have a ContextFilter set or if contexts do not
      match, state defaults to Empty.
      
      * v8:StateTag is already propagated all the way to a Sample, simply add
      an API to surface it.
      
      VMState: 
      Change-Id: I7eed08907360b99b0ad20ddcff59c95c7076c85e
      Bug: chromium:1263871
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3188072
      Auto-Submit: Corentin Pescheloche <cpescheloche@fb.com>
      Reviewed-by: 's avatarCamillo Bruni <cbruni@chromium.org>
      Reviewed-by: 's avatarDominik Inführ <dinfuehr@chromium.org>
      Reviewed-by: 's avatarIgor Sheludko <ishell@chromium.org>
      Commit-Queue: Camillo Bruni <cbruni@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#78250}
      2d087f23
    • Dominik Inführ's avatar
      [heap] Use atomic marking state in all configs · 18cb0cb4
      Dominik Inführ authored
      Use an atomic marking state in all builds - even builds with concurrent
      marking disabled. This will allow us to simplify our code a bit.
      
      This CL starts by always using MajorMarkingState for
      MarkCompactCollector::MarkingState and removing V8_ATOMIC_MARKING_STATE.
      
      Bug: v8:12470
      Change-Id: I88a65647fb2142a63b2b51fc21391c8ef1baa82d
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3314864
      Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
      Reviewed-by: 's avatarMichael Lippautz <mlippautz@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#78241}
      18cb0cb4
  14. 04 Dec, 2021 1 commit
    • Samuel Groß's avatar
      Introduce VirtualAddressSpace interface · a7cb30b0
      Samuel Groß authored
      This interface is meant to eventually replace the existing
      v8::PageAllocator interface. Beyond general refactoring of the
      PageAllocator APIs, the new interface now supports the concept of
      (contiguous) address space reservations, which previously had to be
      implemented through page allocations. These reservations now make better
      use of provided OS primitives on Fuchsia (VMARs) and Windows
      (placeholder mappings) and can be used to back many of the cages and
      virtual memory regions that V8 creates.
      
      The new interface is not yet stable and may change at any time without
      deprecating the old version first.
      
      Bug: chromium:1218005
      Change-Id: I295253c42e04cf311393c5dab9f8c06bd7451ce3
      Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3301475
      Commit-Queue: Samuel Groß <saelo@chromium.org>
      Reviewed-by: 's avatarToon Verwaest <verwaest@chromium.org>
      Reviewed-by: 's avatarMichael Lippautz <mlippautz@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#78235}
      a7cb30b0
  15. 02 Dec, 2021 1 commit
  16. 01 Dec, 2021 1 commit
  17. 24 Nov, 2021 2 commits
  18. 23 Nov, 2021 1 commit
  19. 22 Nov, 2021 3 commits