- 27 Oct, 2020 17 commits
-
-
Jakob Gruber authored
This reverts commit 3c49308a. Reason for revert: https://ci.chromium.org/p/v8/builders/ci/V8%20Clusterfuzz%20Mac64%20ASAN%20-%20debug%20builder/18360 Original change's description: > [DEPS] Add abseil to deps > > Add a dependency on the chromium abseil-cpp subdir mirror. > > Bug: v8:11006 > Change-Id: Icaad757269d27c65bc368ed539f84c5bb79ee62d > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2464940 > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Yang Guo <yangguo@chromium.org> > Reviewed-by: Victor Gomes <victorgomes@chromium.org> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> > Cr-Commit-Position: refs/heads/master@{#70786} TBR=rmcilroy@chromium.org,adamk@chromium.org,yangguo@chromium.org,hpayer@chromium.org,leszeks@chromium.org,victorgomes@chromium.org Change-Id: Iff2ac3b0da8725ec2df69aa527e5a4255ca3009c No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:11006 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2501843Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#70787}
-
Leszek Swirski authored
Add a dependency on the chromium abseil-cpp subdir mirror. Bug: v8:11006 Change-Id: Icaad757269d27c65bc368ed539f84c5bb79ee62d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2464940 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Reviewed-by:
Victor Gomes <victorgomes@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#70786}
-
Simon Zünd authored
The crash scenario is as follows: 1) Add a getter for 'then' to the Object prototype that is considered side-effecting. 2) Evaluate a simple string using 'REPL' mode with side-effect checks enabled. Note: REPL mode is not strictly necessary, but it causes a 'then' lookup as the evaluation result is not a promise. 3) Calling the 'then' getter causes a termination exception, due to the side-effect check. JSPromise::Resolve then tries to put the termination exception as the reject reason, which causes a CHECK failure. The solution is to check for termination in the "abrupt completion" case when 'then' was retrieved. Bug: chromium:1140845 Change-Id: I72b644cd49355cea40f599fcbe80264e99ed7bd6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2501283Reviewed-by:Camillo Bruni <cbruni@chromium.org> Commit-Queue: Simon Zünd <szuend@chromium.org> Cr-Commit-Position: refs/heads/master@{#70785}
-
Zhi An Ng authored
Implement v128.load32_zero and v128.load64_zero on Liftoff, for ARM and ARM64. Bug: v8:11038 Change-Id: I5f845aca23f10b1a45a7ce9d1eb5bea0c1a22a55 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2486237 Commit-Queue: Zhi An Ng <zhin@chromium.org> Reviewed-by:
Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#70784}
-
Charles Kerr authored
Halve the number of lookups in ExtractLocationForJSFunction() by calling GetPositionInfo() directly instead of making separate calls for column and line number. Improve the efficiency of position lookups in slow mode. The current code does a linear walk through the source by calling String::Get() for each character. This PR also does a linear walk, but avoids the overhead of multiple Get() calls by pulling the String's flat content into a local vector and walking through that. Downstream Electron discussion of this can be found at https://github.com/electron/electron/issues/24509 Apologies in advance if I've missed anything; this is my first V8 CL... Change-Id: I22b034dc1bfe967164d2f8515a9a0c1d7f043c83 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2496065 Commit-Queue: Simon Zünd <szuend@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Simon Zünd <szuend@chromium.org> Cr-Commit-Position: refs/heads/master@{#70783}
-
Zhi An Ng authored
Implement v128.load32_zero and v128.load64_zero on Liftoff, only for ia32 and x64. ARM will follow. Bug: v8:11038 Change-Id: I0fad054f462e27eb60825258dad385244b5e5a95 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2486236 Commit-Queue: Zhi An Ng <zhin@chromium.org> Reviewed-by:
-
Jakob Gruber authored
Like all metadata areas, the cp offset must be less than the body size. (In a follow-up, this will change s.t. offsets must be less than the metadata size.) Tbr: leszeks@chromium.org Bug: v8:11036 Change-Id: I108238601f36acd8d22fa161c042d4ca82b07e87 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2501281Reviewed-by:
-
Zhi An Ng authored
Bug: v8:10933 Change-Id: I4a889b087b4d33111533b8b04f151c8ac0fce042 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2497397 Commit-Queue: Zhi An Ng <zhin@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#70780}
-
Zhi An Ng authored
Implement these two instructions on arm. Bug: v8:11038 Change-Id: I23d9c7291f60e29415cfbebced1bff323fd2465a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2485250 Commit-Queue: Zhi An Ng <zhin@chromium.org> Reviewed-by:
Bill Budge <bbudge@chromium.org> Cr-Commit-Position: refs/heads/master@{#70779}
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/6da208e..929bcdb Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/4be464e..98881a1 Rolling v8/third_party/aemu-linux-x64: KsPqcAfQNpcMneTUR-X2XLHNoNCcTLmqK-CIvqJ9zSMC..q6rFFTDSZ6MexUJ2yo5-IHfI0g1sohftVPqHt-TwJtYC Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/7874beb..4f6c1bb Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/6f9b1bf..77cd4b4 Rolling v8/third_party/icu: https://chromium.googlesource.com/chromium/deps/icu/+log/715ec35..d3c1cdc Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/7371bff..cf34aa6 TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com Change-Id: I9ff0f860ce1064a3ae0fee99f46dbdc43cfb70fb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2499883Reviewed-by:
v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#70778}
-
Zhi An Ng authored
This reverts commit dde93768. Reason for revert: ubsan failures https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20UBSan/13518 Original change's description: > Add int64_t min and max to value helpers for test > > And also fix up a truncate float to int test that was using > int list as input instead of a float list. > > Change-Id: I544e38b2d212f8d11dfb5758db4fe6b283acae0d > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2419654 > Reviewed-by: Clemens Backes <clemensb@chromium.org> > Commit-Queue: Zhi An Ng <zhin@chromium.org> > Cr-Commit-Position: refs/heads/master@{#70774} TBR=clemensb@chromium.org,zhin@chromium.org Change-Id: If0faa8be8c55715a529dfe777c0ad9819105fc5b No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2500925Reviewed-by:
Zhi An Ng <zhin@chromium.org> Commit-Queue: Zhi An Ng <zhin@chromium.org> Cr-Commit-Position: refs/heads/master@{#70777}
-
Zhi An Ng authored
We fixed float->uint conversion checks in https://crrev.com/c/2491382, and so we can use those checks here. Bug: v8:10933 Change-Id: Ie2697aaf8fb7761541aca60d5d0a8812a8f39e41 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2497383Reviewed-by:
-
Zhi An Ng authored
The SpecialValue field used in the disassembler covers too wide a range, this causes some duplication in the disassembler of instructions like mov, since the SpecialValue includes a bit used for the immediate. Attempt to refactor and follow the decoding guide given in the architecture manual [0], F4.1 A32 instruction set encoding, with the eventual goal for removing the duplicated instruction disassembly. [0] ARM DDI 0487F.b ARMv8 A32 instruction set Bug: v8:10933 Change-Id: Iddf4df317f9a5b29be2544ad2f9f93180e9bcdfc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2497395 Commit-Queue: Zhi An Ng <zhin@chromium.org> Reviewed-by:
-
Ng Zhi An authored
And also fix up a truncate float to int test that was using int list as input instead of a float list. Change-Id: I544e38b2d212f8d11dfb5758db4fe6b283acae0d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2419654Reviewed-by:
-
Zhao Jiazhong authored
Port ba564604 https://chromium-review.googlesource.com/c/v8/v8/+/2489691 Change-Id: I2397db612dc99904ef1ef3876b973b74850c9c38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2496600 Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn> Reviewed-by:
-
Zhi An Ng authored
This reverts commit 795c0b1c. Reason for revert: TSAN failures https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/33884 Original change's description: > [Heap]: Convert Sweep to Job > > max concurrency is inferred from queue size for OLD_SPACE & MAP_SPACE. > Extra Sweeper::TearDown() in MarkCompactCollector::TearDown() is needed > to cancel job. > > Change-Id: Iafba7d7d24e8f6e5c5a1d5c0348dea731f0ac224 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2480783 > Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Cr-Commit-Position: refs/heads/master@{#70767} TBR=ulan@chromium.org,etiennep@chromium.org Change-Id: I79dc446cef195d49780fe919091e869ddf2557a4 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2500922Reviewed-by:
-
Ng Zhi An authored
i8x16.extract_lane_u is pextrb, and i16x8.extract_lane_u is pextrw, we can merge them instead of having separate opcodes. R=bbudge@chromium.org Bug: v8:10975 Change-Id: I7793a795905157b6094b1470d3437988c982af91 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2481834Reviewed-by:
-
- 26 Oct, 2020 23 commits
-
-
Ng Zhi An authored
Most instructions need get_modrm, and it doesn't affect instructions which don't use it, since get_modrm doesn't mess with any pointers. Bug: v8:10933 Change-Id: I5b97d138f7e6ab78e6a72dc6fa4f0d5d0784a03f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2497296Reviewed-by:
-
Zhi An Ng authored
This relands commit 61b56d16 The fix is to capture variables used in the lambda. Original change's description: > [wasm-simd] Add more tests for v128 load zero > > Add tests for all valid alignments, and using memarg immediate offset > instead of i32 index. > > Also randomize the memory to help catch cases where we are loading more > than we should, and accidentally get correct values with zero-ed memory. > > Bug: v8:10713 > Change-Id: I443c2799ba0d539bf23c63760c08e18c4d36607f > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2487880 > Reviewed-by: Bill Budge <bbudge@chromium.org> > Commit-Queue: Zhi An Ng <zhin@chromium.org> > Cr-Commit-Position: refs/heads/master@{#70693} Bug: v8:10713 Change-Id: Ib8fa58c6600d85a37fc0b6647ddbdb991f3b1c04 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2497382Reviewed-by:
-
Bill Budge authored
- Fix unaligned accesses by inserting a move. - These ops seem to have the issue: https://source.chromium.org/chromium/chromium/src/+/master:v8/src/compiler/backend/ia32/instruction-selector-ia32.cc;drc=fbc697b50b13df0c4078ad9c1fc6991f1f670e2e;l=2150 Bug: chromium:1142528 Change-Id: I502edf02f80c70f1d26b1b6dafd4d362e7dc5f96 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2499294Reviewed-by:
Adam Klein <adamk@chromium.org> Commit-Queue: Bill Budge <bbudge@chromium.org> Cr-Commit-Position: refs/heads/master@{#70768}
-
Etienne Pierre-doray authored
max concurrency is inferred from queue size for OLD_SPACE & MAP_SPACE. Extra Sweeper::TearDown() in MarkCompactCollector::TearDown() is needed to cancel job. Change-Id: Iafba7d7d24e8f6e5c5a1d5c0348dea731f0ac224 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2480783 Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org> Reviewed-by:
-
Milad Fa authored
Bug: v8:10583 Change-Id: I362b42cb14b9eae6d33d5410ce68e2974495247b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2498657Reviewed-by:
Junliang Yan <junyan@redhat.com> Commit-Queue: Milad Fa <mfarazma@redhat.com> Cr-Commit-Position: refs/heads/master@{#70766}
-
Leszek Swirski authored
Add support for empty values (i.e. set behaviour) and heterogeneous lookup (lookup with a different key than the one you'll insert) to TemplateHashMap, and use it for the string table in AstValueFactory. Change-Id: I0c1487c9598127aac97059d4b9220e5c3c6283ce Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2494705 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#70765}
-
Camillo Bruni authored
- The command line tool never fully worked - All the main features of the map-processor are now available in the system-analyzer Bug: v8:10644 Change-Id: Ic55b1d6de561079b079045097856a3b4e5f4bb95 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2497178Reviewed-by:
-
Maya Lekova authored
GCMole mistakenly thought that GC guards such as DisallowHeapAllocation covered the whole scope of the function they are declared in. This CL fixes the false negatives and adds appropriate testing. Bug: v8:10071 Change-Id: Iffb369977af90ca053a55ca8f451e037a4f460f2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2497451 Commit-Queue: Maya Lekova <mslekova@chromium.org> Reviewed-by:
-
Leszek Swirski authored
Make the array elements in msunit/regress/regress-542823 larger, so that it takes fewer of them to force the joined string to go into large object space. Also, set the array's size dynamically based on the maximum non-large object size, rather than having a fixed magic "large enough" size, and verify that the resulting joined string is indeed in LO space. This reduces the runtime of this test under slow_path and gc-stress from minutes to seconds. Bug: v8:11060 Change-Id: I51d960b6a3e052199f50c1a6ba6fbce1b6d1ae38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2498689 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#70762}
-
Clemens Backes authored
This is a reland of bcb0a7c5. Data races detected by TSan are fixed by using (relaxed) atomic updates. Original change's description: > [wasm] Disallow late enabling of trap handlers > > It's dangerous if trap handlers are enabled after we already used the > information whether they are enabled or not. > This CL checks for such misbehaviour by remembering whether > {IsTrapHandlerEnabled} was already called, and disallowing > {EnableTrapHandler} afterwards. Also, calling {EnableTrapHandler} > multiple times is disallowed now. > > The trap handler tests are changed to only enable trap handlers once, > and to do that before allocating wasm memory or generating code. > > R=ahaas@chromium.org > > Bug: v8:11017 > Change-Id: Ib2256bb8435efd914c12769cedd4a0051052aeef > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2494935 > Reviewed-by: Andreas Haas <ahaas@chromium.org> > Commit-Queue: Clemens Backes <clemensb@chromium.org> > Cr-Commit-Position: refs/heads/master@{#70750} Bug: v8:11017 Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_isolates_rel_ng Change-Id: I24299c433ffa3ce31e2aac12134dc03f30609da2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2498683 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#70761}
-
Andreas Haas authored
This reverts commit 397ddfee. Reason for revert: The counter is actually used in benchmarks, e.g. https://ci.chromium.org/p/v8-internal/builders/ci/v8_linux64_perf/7593 Original change's description: > [wasm] Remove V8.LiftoffCompileMicroSeconds counter > > The counter gets created but isn't used anywhere. > > R=clemensb@chromium.org > > Bug: v8:10933 > Change-Id: I480e601f8118475a3ce750ba97fdae6780342d49 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2497166 > Reviewed-by: Clemens Backes <clemensb@chromium.org> > Commit-Queue: Andreas Haas <ahaas@chromium.org> > Cr-Commit-Position: refs/heads/master@{#70756} TBR=ahaas@chromium.org,clemensb@chromium.org Change-Id: I15679baa338e317c54fafd98f547db006b276bae No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:10933 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2498696Reviewed-by:
-
Ross McIlroy authored
BUG=v8:11056 Change-Id: I044a9f5dc0a37df6076eb1f3f36e3d71ec7b7915 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2498692 Auto-Submit: Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Mythri Alle <mythria@chromium.org> Reviewed-by:
Mythri Alle <mythria@chromium.org> Cr-Commit-Position: refs/heads/master@{#70759}
-
Leszek Swirski authored
Move CoverageInfo installation to the main-thread part of finalization. Since this is debug-only, it won't affect non-debug compiles. This allows us to use off-thread finalization when block coverage is enabled, removing the last non-flag reason for disabling off-thread finalization. This means we can remove the per-task "finalize off-thread" flag on BackgroundCompileTask, and make off-thread finalization always on when the flag is on. Bug: chromium:1011762 Change-Id: Ib733d501c4043b493ded9a1951cceb5cfc524eb4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2497177 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
-
Andreas Haas authored
For deserialized modules the compilation state was not set to kFinishedTopTierCompilation and co. A consequence was that code that required top tier compilation to be finished to block indefinitely. With this CL the compilation state is initialized properly. I tested this CL locally with the regression test mentioned in the bug tracker issue. However, this regression test required to run this test twice in separate processes. It would be possible to write a regression test for this that runs on the bots, but I considered it not worth it. R=clemensb@chromium.org Bug: v8:11024 Change-Id: Ib4e75eae03fab13a3ff013118fc1f33a1278b33f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2494930Reviewed-by:
-
Andreas Haas authored
The counter gets created but isn't used anywhere. R=clemensb@chromium.org Bug: v8:10933 Change-Id: I480e601f8118475a3ce750ba97fdae6780342d49 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2497166Reviewed-by:
-
Leszek Swirski authored
msunit/regress/regress-542823 is intended to test large object allocation in Array.prototype.join, but to do so it has a pretty inefficient way of first building a large array. Speed-up this test by using Array.prototype.fill, call .join directly, and make the whole thing an IIFE to avoid global loads. Bug: v8:11060 Change-Id: I5906bcb6c65b10ec830b026cf1f24acb6d5e1aaf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2498681 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Maya Lekova <mslekova@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#70755}
-
Camillo Bruni authored
The test creates an import error that references the current Script for reporting the error location back to the embedder. - This is not supported by the serializer - We don't expect parse/import errors for serialization Bug: v8:6513 Change-Id: Idf98e7ae189e8ffeaa478e5118a7b3f2d2c06047 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2497171Reviewed-by:
-
Georg Neis authored
Due to the previous change to that function, we can end up with set (non-null) fields even when the overall serialized_ field is unset. This can cause DCHECK failures (I don't think it's otherwise observable). Bug: chromium:1142240,v8:7790 Change-Id: I2711fae8a73438277caf7aa539f24d628b03153c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2497170 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
-
Mathias Bynens authored
This patch aligns --harmony-regexp-sequence with the latest version of the corresponding TC39 and Unicode proposals. The list of supported properties has been changed: - https://github.com/tc39/proposal-regexp-unicode-sequence-properties#proposed-solution - https://unicode.org/reports/tr18/#Full_Properties Furthermore, the Unicode data now uses Unicode v13.0.0 instead of v12.0.0. Bug: v8:7467 Change-Id: I1ac386d87af68d68e84e919cb5ffc1313443844a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2497163Reviewed-by:
-
Leszek Swirski authored
This reverts commit bcb0a7c5. Reason for revert: TSAN failure (https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/33868) Original change's description: > [wasm] Disallow late enabling of trap handlers > > It's dangerous if trap handlers are enabled after we already used the > information whether they are enabled or not. > This CL checks for such misbehaviour by remembering whether > {IsTrapHandlerEnabled} was already called, and disallowing > {EnableTrapHandler} afterwards. Also, calling {EnableTrapHandler} > multiple times is disallowed now. > > The trap handler tests are changed to only enable trap handlers once, > and to do that before allocating wasm memory or generating code. > > R=ahaas@chromium.org > > Bug: v8:11017 > Change-Id: Ib2256bb8435efd914c12769cedd4a0051052aeef > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2494935 > Reviewed-by: Andreas Haas <ahaas@chromium.org> > Commit-Queue: Clemens Backes <clemensb@chromium.org> > Cr-Commit-Position: refs/heads/master@{#70750} TBR=ahaas@chromium.org,clemensb@chromium.org Change-Id: I1d93dcb399e2a0b5b0543aa60d34087317c01cb3 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:11017 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2497176Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#70751}
-
Clemens Backes authored
It's dangerous if trap handlers are enabled after we already used the information whether they are enabled or not. This CL checks for such misbehaviour by remembering whether {IsTrapHandlerEnabled} was already called, and disallowing {EnableTrapHandler} afterwards. Also, calling {EnableTrapHandler} multiple times is disallowed now. The trap handler tests are changed to only enable trap handlers once, and to do that before allocating wasm memory or generating code. R=ahaas@chromium.org Bug: v8:11017 Change-Id: Ib2256bb8435efd914c12769cedd4a0051052aeef Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2494935Reviewed-by: -
Leszek Swirski authored
Split GlobalObject tagging into collecting pairs of tags, followed by writing those tags into an unordered_map after entering a safepoint scope. This ensures that we follow moved global objects if they move in the GCs between the tagging and the safepoint. Bug: v8:11050 Change-Id: I333d50d000ec49e6c4218e71f0cc84a49b460ecf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2494932 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
-
Zhao Jiazhong authored
Port c7cb9bec https://chromium-review.googlesource.com/c/v8/v8/+/2488682 Change-Id: I782663f35d0beeea83a95a266cb787ef4c192ea8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2496406Reviewed-by:
-
