- 12 Jan, 2021 21 commits
-
-
Milad Fa authored
`0x12345678` will be written to memory in the same order on BE machines however, as Wasm is LE enforced, a memory load will force a byte reverse operation on BE machines which changes the value. To fix the problem, we write the reversed value to memory. Change-Id: I0d562768d5cef823cb918ed1b57a2a41e404ffc6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2622927 Commit-Queue: Milad Fa <mfarazma@redhat.com> Reviewed-by:
Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#72041}
-
Leszek Swirski authored
The dead target check in TransitionArrayNeedsCompaction, confirming that Smi (uninitialized) targets imply that no other target is dead, has to additionally support Smi entries. Bug: v8:11305 Change-Id: I6f3fa9e7420b1bd0a64a25dae670f439e3f41162 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2622914 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#72040}
-
Camillo Bruni authored
Make sure gcmole detects issue in DisallowGarbageCollection scopes. DisallowGarbageCollection is widely used in the codebase to document code that doesn't allocate. However, this has the rather unexpected side-effect that gcmole is not run when such a scope is active. This CL changes the default behavior of gcmole to run even with DisallowGarbageCollection scopes present. This will give us the best results of both worlds, dynamic checks by the fuzzer, and static analysis by gcmole. To allow crazy local raw pointer operations there is a new DisableGCMole scope that explicitly disables gcmole. Change-Id: I0a78fb3b4ceaad35be9bcf7293d917a41f90c91f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2615419Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#72039}
-
Leszek Swirski authored
Add a pre-loop over transition arrays during compaction, that checks whether compaction is needed at all, and whether any of the entries are still uninitialized values as part of deserialization (and therefore no other targets can be dead). Bails out of compaction early if this is the case. Bug: v8:11305 Change-Id: I27af792a8a0bd3df17892f54ac95ed15e4bdfcc0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2622910Reviewed-by:
-
Jakob Gruber authored
.. instead of implicitly using -1 as a marker in a few spots. Bug: chromium:1161357 Change-Id: Icfb9a2b81dbda844c8405c57454d63ae89dfe4f9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2606336 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Andreas Haas <ahaas@chromium.org> Auto-Submit: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#72037}
-
Georgia Kouveli authored
The frame pointer did not point to the previous frame pointer, which made the stack non-iterable with SafeStackFrameIterator. This can cause pointer authentication failures when CFI is enabled, as we expect the value stored above the previous frame pointer to be a return address. Bug: v8:10026 Change-Id: Ia55181038b1b277d0a6df519f1e7f61859847b1a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2614429Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
-
Clemens Backes authored
... and fix an issue in TurboFan and issues in Liftoff. R=manoskouk@chromium.org Bug: v8:10949 Change-Id: I3493205ab56a4ded550af6fcd75c465f7d8894ca Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2618246 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/master@{#72035}
-
Manos Koukoutos authored
Changes: - Rename PassThrough -> Forward in function-body-decoder. - Introduce IsHeapSubtypeOf in subtyping. - Do not push a redundant bottom value in br_on_null, remove fallthrough. Also, improve code structure. - Update a couple of comments. Bug: v8:7748 Change-Id: I8d23cd3829c5504156ace595f8ac86c511c9f5e1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2611250 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#72034}
-
Manos Koukoutos authored
Change-Id: I6970506864a5b2604f9d4607c2f20ffa2b409c9e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2621078Reviewed-by:
-
Sathya Gunasekaran authored
As per https://v8.dev/docs/contribute: Code contributions to v8 are done through Gerrit, not using GitHub pull requests. Unfortunately not a lot of people seem to read this and end up opening PRs on the github v8 mirror which then needs to be closed manually: https://github.com/v8/v8/pulls?q=is%3Apr+is%3Aclosed Rather than manually closing these PRs, once we add this config, we can make the google GitHub bot automatically do this. See: https://opensource.google/docs/github/disable-features/#close Bug: v8:11301 Change-Id: I2b55f60cb095bd4d3e26e5a096dac2c1c886ba31 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2617080Reviewed-by:
Hannes Payer <hpayer@chromium.org> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Cr-Commit-Position: refs/heads/master@{#72032}
-
Clemens Backes authored
The watchdog previously didn't terminate execution, it just prevented the execution of additional tasks. This CL fixes that by making {TaskRunner::Terminate} actually terminate execution in the isolate. It also adds a regression test for this. R=szuend@chromium.org Bug: chromium:1154412, chromium:1142437 Change-Id: Ic6638e8a5c37e8840a85651b4d4bea2ee0f71c43 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2622212Reviewed-by:Simon Zünd <szuend@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#72031}
-
Manos Koukoutos authored
Changes: - Add LoopExit and LoopExitValue functions in wasm-compiler. - Handle kLoopExitValue opcode in simd-scalar-lowering. Bug: v8:11298 Change-Id: I4d00402ed1913f927bec973b3d480ddc1990962b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2611251Reviewed-by:
Zhi An Ng <zhin@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/master@{#72030}
-
Zhi An Ng authored
Prototype these 4 instructions: - i64x2.widen_low_i32x4_s - i64x2.widen_high_i32x4_s - i64x2.widen_low_i32x4_u - i64x2.widen_high_i32x4_u Bug: v8:10972 Change-Id: I57508a7fcafdf3b8a9477d6e9292fbb6b67e3619 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2612342 Commit-Queue: Zhi An Ng <zhin@chromium.org> Reviewed-by:
Deepti Gandluri <gdeepti@chromium.org> Cr-Commit-Position: refs/heads/master@{#72029}
-
Frank Tang authored
Use a bit to work around the issue of ICU getType() bug. Bug: v8:11295 Change-Id: I15d65bd44c489031d789e7638ea8abab90128124 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2614216 Commit-Queue: Frank Tang <ftang@chromium.org> Reviewed-by:
Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/master@{#72028}
-
LiuYu authored
Change-Id: I1024b336ac3d24c69f5a47a919b69a9ef363ec66 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2620002 Auto-Submit: Liu yu <liuyu@loongson.cn> Reviewed-by:
Zhao Jiazhong <zhaojiazhong-hf@loongson.cn> Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn> Cr-Commit-Position: refs/heads/master@{#72027}
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/d1a7463..d599553 Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/2277272..235cfe4 Rolling v8/buildtools/linux64: git_revision:0d67e272bdb8145f87d238bc0b2cb8bf80ccec90..git_revision:595e3be7c8381d4eeefce62a63ec12bae9ce5140 Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/e174329..d1a3011 Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/c1aa4ec..82b992a Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/01d7e1f..2246bee TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com Change-Id: Ib358f0e49fab39cf13fb91a0db2a2b453b28c94a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2622902Reviewed-by:
v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#72026}
-
Zhi An Ng authored
Prototype these 4 instructions: - i64x2.widen_low_i32x4_s - i64x2.widen_high_i32x4_s - i64x2.widen_low_i32x4_u - i64x2.widen_high_i32x4_u Implementation is the same as x64. Drive-by fix to add a missing CpuFeatureScope to x64. Bug: v8:10972 Change-Id: Iacc84bce156053d0ac39b1a419727c93c499a8c9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2612339 Commit-Queue: Zhi An Ng <zhin@chromium.org> Reviewed-by:
-
Zhi An Ng authored
Also remove some ifdefs since it is implemented on all architectures. Bug: v8:10997 Change-Id: I06f82e2c67219a8990bdd7c78e63b1300c8f34d2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2620907Reviewed-by:
-
Zhi An Ng authored
Removing ifdef guards since our 4 supported architectures implement this now. Bug: v8:10971 Change-Id: Ic0295b1492a6316df61340a38f3e6d06d8fe64ed Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2620900 Commit-Queue: Zhi An Ng <zhin@chromium.org> Reviewed-by:
Bill Budge <bbudge@chromium.org> Cr-Commit-Position: refs/heads/master@{#72023}
-
Zhi An Ng authored
Bug: v8:10997 Change-Id: Ic7a3848792867ef3068151eff8dbf45e628ce6c2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2620901Reviewed-by:
-
Zhi An Ng authored
Implementation is the same as x64. Disassembly support for the new instruction, pmulhrsw, is already supported due to the macro list. Bug: v8:10971 Change-Id: I099c4f8c3da521006ef5e2b151626f25a5df1ed9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2620898Reviewed-by:
-
- 11 Jan, 2021 19 commits
-
-
Milad Fa authored
Bug: v8:11086 Change-Id: Ib896020b0865c0f87cabbde254bc8af36ce705d3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2623007Reviewed-by:
Junliang Yan <junyan@redhat.com> Commit-Queue: Milad Fa <mfarazma@redhat.com> Cr-Commit-Position: refs/heads/master@{#72020}
-
Andrew Comminos authored
Currently, the CodeMap utilizes double indirection into a deque for entries in its map. Since we don't reuse CodeEntry objects, this doesn't confer any benefits really -- avoid this step and save memory by maintaining only a single mapping. Bug: v8:11054 Change-Id: I2cbc188ff64dd2faa9c4c03d9892b4c8e5e68794 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2617746Reviewed-by:
Peter Marshall <petermarshall@chromium.org> Commit-Queue: Andrew Comminos <acomminos@fb.com> Cr-Commit-Position: refs/heads/master@{#72019}
-
Andreas Haas authored
This CL fixes a bug in the code generation for I32AtomicCompareExchange in Liftoff on ia32. The problem is the inconsistency that LiftoffAssembler::PeekToRegister(...) introduces to the cache state. PeekToRegister loads the value from the value stack into a register, but does not pop the value off the stack. When the value was already stored in a register, the use counter of that register gets decreased, even though the value is still on the stack. The problem arises when this register later gets reused, which is necessary unfortunately on ia32. When SpillRegister is called for this register, all stack values that are stored in this register get written to memory. SpillRegister uses the use counter of the register to detect when the register was spilled to all stack slots that were cached by this register. However, as described above, the value stack and the use counter are inconsistent at that moment, so SpillRegister finishes early and does not spill the register to all stack values, and this causes the bug later. With this CL the decrement of the use counter gets delayed until when the value actually gets popped off the stack. R=clemensb@chromium.org Bug: chromium:1145135 Change-Id: I07cb256a7e5135dbce41b246c120650635ad2758 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2602464Reviewed-by:
-
Junliang Yan authored
Change-Id: Id077f3c85d0610d5da192a954c942208594f0377 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2622867Reviewed-by:
Milad Fa <mfarazma@redhat.com> Commit-Queue: Junliang Yan <junyan@redhat.com> Cr-Commit-Position: refs/heads/master@{#72017}
-
Clemens Backes authored
In memory64, the index is a 64-bit value even on 32 bit. Thus the bounds check needs to check explicitly that the high word is zero. The (pointer sized) low word is then checked against the actual memory size. R=manoskouk@chromium.org Bug: v8:10949 Change-Id: I311664ccadaec44a6c88777a60b1a3b45b6c0642 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2617088 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
-
Caleb Raitto authored
We're making a copy of ieee754.(cc|h) in Chromium in crrev.com/c/2582607. To ensure this copy stays in sync, we're adding a watchlist for changes on the original ieee754.(cc|h). Also, watch for changes in dependency of ieee754.(cc|h) overflowing-math.h, and for changes in the licenses (LICENSE.fdlibm). Bug: chromium:1145192 Change-Id: I5a967266c8b5c5c973afc48d9b453915f228a268 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2593649Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Commit-Queue: Caleb Raitto <caraitto@chromium.org> Cr-Commit-Position: refs/heads/master@{#72015}
-
Clemens Backes authored
This adds a first execution test for memory64 in the form of a cctest. Several things are still not working correctly, hence this test only checks TurboFan on 64-bit systems, and Liftoff. Bounds checks in Liftoff are fixed to work correctly on 32-bit. Follow-up CLs will extend the test to also test TurboFan on 32-bit, the interpreter, and traps. All of those features still have issues. R=manoskouk@chromium.org Bug: v8:10949 Change-Id: Ic7edcf3783421634fe2ec99eac6f257c557a29b5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2610968Reviewed-by:
Thibaud Michaud <thibaudm@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#72014}
-
Camillo Bruni authored
For simplicity this CL includes a first crude conversion of tickprocessor.mjs. Later CLs will introduce more ES6 syntax and clean up more code. Bug: v8:10667 Change-Id: Ief2ca623f5562114fb976a95d156e2ab3f961114 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2611252Reviewed-by:
Sathya Gunasekaran <gsathya@chromium.org> Commit-Queue: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#72013}
-
Santiago Aboy Solanes authored
Bug: v8:7790 Change-Id: I44469e08131ad6a5f95a465cf2d461da0785221e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2616218 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by:
-
Michael Achenbach authored
Bug: chromium:1164276 Change-Id: I5c257d407ed8c14037555cfcfd1550923bb79af2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2621079 Auto-Submit: Michael Achenbach <machenbach@chromium.org> Commit-Queue: Liviu Rau <liviurau@chromium.org> Reviewed-by:
Liviu Rau <liviurau@chromium.org> Cr-Commit-Position: refs/heads/master@{#72011}
-
Santiago Aboy Solanes authored
Bug: v8:7790 Change-Id: I2deb462c3467f7239d55b0f295feed1de5ca1c2f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2616198 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by:
-
Benedikt Meurer authored
This change unifies the locals, stack, and globals objects exposed for WebAssembly frames via the Scope view and via DebugEvaluate to use the same underlying objects (implemented via interceptors). This also means that for locals and globals we now consistently expose names prefixed by a dollar symbol everywhere. Drive-by-fix: Move the debug::ScopeIterator implementation for WasmFrame into debug-wasm-support.cc, so WebAssembly scope details are all found in one place instead of scattered around the code. Drive-by-cleanup: Rename GetJSDebugProxy to GetWasmDebugProxy for consistency. GetJSDebugProxy is a bit misleading, since the debug proxy is not about JavaScript, but just exposed to JavaScript. Doc: http://bit.ly/devtools-wasm-entities Bug: chromium:1159307, chromium:1127914, chromium:1162229 Change-Id: If932bd06bbce72542823f63dac1bd976ab33937a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2615348 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Auto-Submit: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/master@{#72009}
-
Camillo Bruni authored
1) Since we collect a stack trace for unhandled promises we might end up invoking code right before the shutdown phase. 2) Any dynamic module import that happens in this phase will enqueue a microtask job with a freshly allocated DynamicImportData object. It only gets deleted when fully emptying the microtask queue. 3) Since we're exiting we might end up with a non-empty microtask queue. 4) LSAN detects this as a leak on shutdown. To make LSAN happy again d8 now keeps track of DynamicImportData to free them on destructing PerIsolateData. Bug: chromium:1158223 Change-Id: I9bb21f71bffc75a0d5f4ffc5bf0727c7b4cbab88 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2599755 Commit-Queue: Camillo Bruni <cbruni@chromium.org> Reviewed-by:
-
Benedikt Meurer authored
Previously the implementation of the scope iterator objects and the debug proxy lived in src/wasm, and they are now being moved to src/debug, to better align with the JavaScript debugging interface, which also lives in src/debug. Bug: chromium:1162229, chromium:1071432 Change-Id: I7f89ced88a1231ad6a923be6e85a93f1876a2024 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2621084Reviewed-by:
-
Santiago Aboy Solanes authored
We shouldn't be creating those anymore since they are not thread-safe. Bug: v8:7790 Change-Id: I4546d995fa32eb076c8dfe9d95301fad719c9e07 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2615347Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Cr-Commit-Position: refs/heads/master@{#72006}
-
Santiago Aboy Solanes authored
ToNumber was already returning base::Optional but it still needed to be updated for the internal external uncached string case. As a note, both IsExternal and IsSeqString do not need to be updated since they only look at the map. Bug: v8:7790 Change-Id: Icb5ba7f40982c01cada2a9c2b96b824edce70d44 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2615422Reviewed-by:
-
Dan Elphick authored
V8_USE_PERFETTO appears in used in the include directory so should be in v8_header_features rather than features. Moving it means that all users of the v8 headers will automatically get the define without having to define it themselves. Bug: chromium:1006541 Change-Id: I7eb67787fb42499d29c98a76a19a4ad8c04f7aa7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2621083 Commit-Queue: Dan Elphick <delphick@chromium.org> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Auto-Submit: Dan Elphick <delphick@chromium.org> Reviewed-by:
-
Paolo Severini authored
Change-Id: I2c1dfb7fbcf9a23d9e156dc3918fb88140885195 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2614721Reviewed-by:
Nico Hartmann <nicohartmann@chromium.org> Reviewed-by:
-
Sathya Gunasekaran authored
There's no need for the force_instantiate argument as it's not used by any of the callers. Bug: v8:11284 Change-Id: I133ac55b1da7b247b7d4b601372d2b2f3fffe36a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2608204 Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Reviewed-by:
-
