- 14 Jul, 2022 25 commits
-
-
Samuel Groß authored
This reverts commit 543b54da. Reason for revert: Causes crashes on Android due to TBI: https://crbug.com/chromium/1344581 Original change's description: > [sandbox] Sandboxify Foreign external pointer > > Bug: v8:10391 > Change-Id: I4c5c209454db316fe86f379f6b2e6dfc7ba7754e > Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3757340 > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Commit-Queue: Samuel Groß <saelo@chromium.org> > Cr-Commit-Position: refs/heads/main@{#81703} Bug: v8:10391 Change-Id: I88899def209c592cd353dd4ed81003f1bbb7a760 Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3764440 Commit-Queue: Igor Sheludko <ishell@chromium.org> Auto-Submit: Samuel Groß <saelo@chromium.org> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#81731}
-
Adam Klein authored
This reverts commit 8218c061. Reason for revert: compile failures, e.g.: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Mac%20-%20arm64%20-%20release%20builder/11040/overview Original change's description: > [wasm] Reset PKRU before spawning new threads > > We sometimes hit the DCHECK in the wasm code manager: > DCHECK_IMPLIES(writable, !MemoryProtectionKeyWritable()); > > This is because we spawn new threads while having a > {CodeSpaceWriteScope} open. In the case of PKU, this changes the PKRU > register to allow writes to the code space, and the value of that > register is inherited by any new thread. If this thread then tries to > switch to writable code spaces, it hits the DCHECK. It would hit a > similar DCHECK when trying to execute code. > > We fix this issue by temporarily resetting the PKRU register to > non-writable while we call the {NotifyConcurrencyIncrease} method. This > is not a very robust solution, as any new call that potentially happens > inside a {CodeSpaceWriteScope} needs to do the same, but refactoring the > code to avoid spawning new threads while being in writable state would > be a lot of work with other downsides. > > R=jkummerow@chromium.org > > Bug: v8:13075 > Change-Id: Ibc7270aa597902dc6d9649cb6bcdfce8b1a9bafc > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3762579 > Commit-Queue: Clemens Backes <clemensb@chromium.org> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> > Cr-Commit-Position: refs/heads/main@{#81729} Bug: v8:13075 Change-Id: I235e7263856a37cf0f4aa1c27493aac8e6db7910 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3763587 Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Auto-Submit: Adam Klein <adamk@chromium.org> Cr-Commit-Position: refs/heads/main@{#81730}
-
Clemens Backes authored
We sometimes hit the DCHECK in the wasm code manager: DCHECK_IMPLIES(writable, !MemoryProtectionKeyWritable()); This is because we spawn new threads while having a {CodeSpaceWriteScope} open. In the case of PKU, this changes the PKRU register to allow writes to the code space, and the value of that register is inherited by any new thread. If this thread then tries to switch to writable code spaces, it hits the DCHECK. It would hit a similar DCHECK when trying to execute code. We fix this issue by temporarily resetting the PKRU register to non-writable while we call the {NotifyConcurrencyIncrease} method. This is not a very robust solution, as any new call that potentially happens inside a {CodeSpaceWriteScope} needs to do the same, but refactoring the code to avoid spawning new threads while being in writable state would be a lot of work with other downsides. R=jkummerow@chromium.org Bug: v8:13075 Change-Id: Ibc7270aa597902dc6d9649cb6bcdfce8b1a9bafc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3762579 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#81729}
-
Adam Klein authored
It's flaky in that config, and the failures are not considered actionable. Bug: v8:12267 Change-Id: Ibc020cd7d28ddda431ec5f79f3c1952a14ffbfa9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3763582 Auto-Submit: Adam Klein <adamk@chromium.org> Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#81728}
-
Dominik Inführ authored
Test was already skipped for quite some time. Bug: v8:8169 Change-Id: I1cb4f024e43a42c48b425ad0c713fb85bbfb2354 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3762580Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#81727}
-
Clemens Backes authored
Use default constructors and algorithms. No functional change intended. R=jkummerow@chromium.org Bug: v8:13063 Change-Id: I74abfe17d265c95e38fde1440ba48d88fdb5a2c5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3760452 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
-
Leszek Swirski authored
Bug: v8:7700 Change-Id: Iba160350ad2062abf7da6b97d04d255e0f780f4d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3757893 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/main@{#81725}
-
Clemens Backes authored
The {std::min} followed by a loop does ensure that the new length is bigger than {needed_value}, but does not ensure that we always allocate at least {kInitialLength}. Maybe this was intended to be {std::max}? Anyway, this CL replaces the loop by a computation which ensures that we allocate a power of two that is greater than {needed_value} and at least {kInitialLength}. It also adds a CHECK to guard against integer overflows. R=jkummerow@chromium.org Bug: v8:13063 Change-Id: I374d304204a499536643a6c5df7111231d41d4bd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3760674Reviewed-by: -
Samuel Groß authored
When testing the serializer (e.g. via --stress-snapshot), raw external references (i.e. just raw pointers) can be embedded inside the snapshot. When those pointers are sandboxed, the corresponding external pointer tag also needs to be encoded in the snapshot. This CL adds the necessary logic to support this by introducing new serializer Bytecodes for raw external references and encoding the raw pointers together with the tag. Bug: v8:10391 Change-Id: I7b3710c2144e19f7507e3f6db537d250d102ee28 Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3762575Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#81723}
-
Jakob Kummerow authored
This extends the idea already used by "MaterializeMergedConstants": certain values have to be processed by every br*, so to protect against cascades of conditional jumps causing lots of repeated work, it makes sense to do such processing just once. For the module in the linked bug, this reduces Liftoff generated code size from 69MB to 181KB. Fixed: v8:13072 Change-Id: Ie9f98240e93751988067d4774d4a09b2b39bdad6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3760444Reviewed-by:
Clemens Backes <clemensb@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#81722}
-
Leszek Swirski authored
Avoid materializing a compressed value into a register if that value is only used for a compare afterward. Instead, emit it directly as an immediate on the cml. We can only do this for the Cmp(Register,...) overload, not Cmp(Operand,...), since the latter already has the lhs as a complex operand. Change-Id: I99f192c9919e401164d31d2e2e1c3a0c21a6aaf0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3762577 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by:
-
Samuel Groß authored
As sandboxed pointers assume a constant sandbox size (they are essentially n-bit offsets), it is no longer useful to be able to create smaller sandboxes. This CL simplifies the sandbox initialization logic accordingly and adds CHECKS to ensure a fixed-size sandbox is created. Bug: v8:10391 Change-Id: I6541ab769001e60c0256d3a719f926128a0a20b0 Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3647684Reviewed-by:
-
Leszek Swirski authored
Use the Operand overload of Cmp to avoid loading the object map into a temporary in CheckMaps; this also avoids uncompressing the map pointer when loading it. It does mean that the migration path of CheckMapsWithMigration has to re-load the map, and heavier use of the scratch register in that implementation, but it's a deferred path so that should be ok. Bug: v8:7700 Change-Id: I6741d5b5a8ad402bdef9025c43a86aca21db050e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3762574 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by:
-
Victor Gomes authored
Bug: v8:7700 Change-Id: Ibf21ca005754d9dba2669175a24a74f96ff871a5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3760459 Auto-Submit: Victor Gomes <victorgomes@chromium.org> Reviewed-by:
-
Anton Bikineev authored
Bug: chromium:1325007 Change-Id: I1d84175a50adc03fdb7a504432fda088b6f3d736 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3758214Reviewed-by:
-
Michael Achenbach authored
Also bump shards on a slow builder. No-Try: true Bug: v8:13074 Change-Id: I07131c53d1d632886039e811de38961dd4eb5752 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3760458Reviewed-by:
-
JianxiaoLuIntel authored
Change-Id: Ide57fbbe30c2d2f04c42af09784eb8fc4c8a52f2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3761974Reviewed-by:
Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Jianxiao Lu <jianxiao.lu@intel.com> Cr-Commit-Position: refs/heads/main@{#81715}
-
Clemens Backes authored
This change alone reduces the overall compile time of the reproducer from the linked issue by >30%. R=jkummerow@chromium.org Bug: v8:13063 Change-Id: I5ac69ab6ec2f1427b1511181664d34f4b1d26f93 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3760451Reviewed-by:
-
Marja Hölttä authored
In this part: filter Bug: v8:11111 Change-Id: I8ca08e94ad2ab56605e9a32ba52de426f8100da8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3758213Reviewed-by:
Shu-yu Guo <syg@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/main@{#81713}
-
Marja Hölttä authored
In this part: forEach, reduce, reduceRight + missing tests for includes Bug: v8:11111 Change-Id: I3586d56655bd65c054e0933816f5331d5a8d1860 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3758210 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by:
-
v8-ci-autoroll-builder authored
Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/78234e5..142c351 R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com Change-Id: If6ce5201a8b9ee75f54d6da84e0da61097f2e788 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3761236 Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#81711}
-
v8-ci-autoroll-builder authored
Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/8e95834..e8f62ff Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/d22bf60..c8fadda Rolling v8/third_party/fuchsia-sdk/sdk: version:8.20220712.1.1..version:8.20220713.2.1 Rolling v8/tools/luci-go: git_revision:be5d9aacf8987c0826223264f0427cd0b530b6a4..git_revision:a0ba80649473055bae3d789eec28c9967adb5e45 Rolling v8/tools/luci-go: git_revision:be5d9aacf8987c0826223264f0427cd0b530b6a4..git_revision:a0ba80649473055bae3d789eec28c9967adb5e45 R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com Change-Id: I96a5f587b802f8db537774fd03a050a841de9fb0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3761235 Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#81710}
-
JianxiaoLuIntel authored
See details at https://groups.google.com/g/v8-dev/c/H3YXXKoauLI Change-Id: Ibe255e95bfd1d09a115eb04d6cbfcca7a671d900 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3756729Reviewed-by:
Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#81709}
-
Shu-yu Guo authored
Errors in the callback were not correctly unlocking the mutex, oops. Bug: v8:12547 Change-Id: If44ebc023b8192605c9f29bfd4099a197110f5c4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3760986 Commit-Queue: Shu-yu Guo <syg@chromium.org> Reviewed-by:
Adam Klein <adamk@chromium.org> Cr-Commit-Position: refs/heads/main@{#81708}
-
Milad Fa authored
PPC Simd regs are already using separate set of register banks on ppc, more details can be found here: https://crrev.com/c/2718472 Here we are making use of this CL https://crrev.com/c/3005768 (fcd3ef48) and fully separating Simd regs during register allocation. Member function `toSimd()` is also introduced which will be used to cast FP regs to Simd regs in liftoff. Change-Id: Ic5551fb04f37de7fc9501a2f1aba8fb44f622d95 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3755213 Commit-Queue: Milad Farazmand <mfarazma@redhat.com> Reviewed-by:
-
- 13 Jul, 2022 15 commits
-
-
Anton Bikineev authored
The current compression scheme defines isomorphism with respect to relational operations (i.e. the relational operators preserve their results on the set of compressed pointers). In addition, provide overloads for nullptr/sentinel. Bug: chromium:1325007 Change-Id: I476a1c59e92f5210e26142320eb03802bd11ea51 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3758143Reviewed-by:
-
Anton Bikineev authored
The increase caused a significant PMF regression on Windows. Apparently, leaving the table in reserved state didn't eliminate the regression. The CL returns the age size back to 1MB. The followup is to investiage and fix the regression. Bug: chromium:1336420 Change-Id: I56542ba4efe0fc8d08d8c5febf758384559a8860 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3758146Reviewed-by:
-
Michael Achenbach authored
To prevent timeouts on arm64-sim debug and gc-stress builder. Also skip a very slow test on the arm64-sim gc-stress builder. No-Try: true Change-Id: I7d275aa893dbe4942b4d41c6e83d9b9e6f861a33 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3760455Reviewed-by:
-
Samuel Groß authored
Bug: v8:10391 Change-Id: I4c5c209454db316fe86f379f6b2e6dfc7ba7754e Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3757340Reviewed-by:
-
Anton Bikineev authored
The operator with raw pointer allows us to avoid Member decompression, which is more expensive than compression. It's also quite frequently called (e.g. in HeapHashSet::find()). The existing operator template <...> bool operator==(const Member<T1>&, const Member<T2>&); was not called for GCed* raw = ...; member == raw; because the compiler wouldn't deduce `T2` in `const Member<T2>` as `GCed` when the initializer expression `raw` is of different type (`GCed*`). Bug: chromium:1325007 Change-Id: Ie1ee12bad28081c66f4e08a146467fd7c040bb70 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3757344Reviewed-by:
-
Shu-yu Guo authored
Bug: chromium:1344014 Change-Id: I5009af963d95d96f70785593664a1145ad20c97d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3760975Reviewed-by:
-
Jakob Kummerow authored
When the control-flow aware type of a Node doesn't actually change, then we shouldn't claim that it did (which causes later re-visiting of the node). Fixed: v8:13061 Change-Id: I064cedf3721a79844bfc36ad3142428bdfbaf891 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3760675 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#81700}
-
Jacob Abraham authored
Implements an initial prototype of the Wasm Trace proposal. A custom section containing offsets to functions is decoded into trace instructions that are inserted into the function. In Liftoff, these are directly inserted. In TurboFan, these are added as StackEffect's, this is a work in progress. Traces will only be decoded and added when a flag is given to V8, currently "--experimental-wasm-instruction-tracing". If a trace is ever not valid or an error occurs, it is safe to just throw them away. Code Metadata Tool Convention: https://github.com/WebAssembly/tool-conventions/blob/main/CodeMetadata.md Design Doc: https://docs.google.com/document/d/1739a_LXbavBnek7pa0uqhHOCz8IJ56mn2C2Yvbssvkg/edit?usp=sharing Wasm Trace Proposal: https://github.com/WebAssembly/instrument-tracing Bug: chromium:1090122, chromium:1252113 Change-Id: Id4690d8deca482ff0e863761668ffabca159bd29 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3386604 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
-
Sergey Ulanov authored
V8 was compiled for Fuchsia with optimize_speed instead of optimize_max used on most other platfroms. There is no reason Fuchsia needs to be different, so it's better to use optimize_max. It also allows to save about 1MB on the binary size. Bug: chromium:1343990 Change-Id: Ie4a07fbbfd8100def61bf7709d2c4e6cb74209f4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3759647 Commit-Queue: Sergey Ulanov <sergeyu@chromium.org> Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Reviewed-by:
Anton Bikineev <bikineev@chromium.org> Auto-Submit: Sergey Ulanov <sergeyu@chromium.org> Cr-Commit-Position: refs/heads/main@{#81698}
-
Marja Hölttä authored
Bug: v8:11111 Change-Id: Ic07628bcf6018ea9814a38a0dab3667a7d8f0d69 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3755145 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by:
-
Shu-yu Guo authored
Bug: v8:13039 Change-Id: I80c9e0ab84437f8e932c13b3cb134b9bdb74c1a7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3759563Reviewed-by:
-
Victor Gomes authored
Bug: v8:7700 Change-Id: I07e63a33e1ef1ab8e423bf46be1d83b8724d924d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3760449 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Victor Gomes <victorgomes@chromium.org> Reviewed-by:
-
Andy Wingo authored
Feature complete! Bug: v8:12868 Change-Id: I7727071bdd062a6dae26206a65080f675ef7ee93 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3758226Reviewed-by:
-
Andy Wingo authored
Bug: v8:12868 Change-Id: I2e4a1733876a817dca36e0134ba4b7549f0cf4b8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3757886 Commit-Queue: Andy Wingo <wingo@igalia.com> Reviewed-by:
-
Andy Wingo authored
Bug: v8:12868 Change-Id: Ice7134d0ad5efddb85420543ea785253791d0258 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3757885Reviewed-by:
-
