- 14 Jul, 2020 1 commit
-
-
Santiago Aboy Solanes authored
This CL adds functionality to read the source positions directly from the JS heap rather than from serialized data. In order to do this, we create a PersistentHandles container in the OptimizedCompilationInfo which gets passed onto the JSHeapBroker. This allows us to create the handles in the main thread and pass them safely to the background thread. In order to read safely from the background thread, we need a LocalHeap which blocks the GC from running and potentially moving the handles. This LocalHeap is created only when the JSHeapBroker has finalized serializing and destroyed when retiring it. Bug: v8:7790 Change-Id: I19f8b08d12e5be0a3df34d6af2043310c0c7b6fe Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2277802Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Dominik Inführ <dinfuehr@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Cr-Commit-Position: refs/heads/master@{#68836}
-
- 10 Jul, 2020 1 commit
-
-
Ulan Degenbaev authored
PersistentHandles::NewHandle/LocalHeap::NewPersistentHandle currently erase the type of the object. This patch templatizes them to preserve the type and introduces versions that take Handle<T> Bug: v8:10315 Change-Id: I899179a5b842b7b16144b340f6cd2b91e1db228f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2287501 Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/master@{#68779}
-
- 09 Jul, 2020 1 commit
-
-
Dominik Inführ authored
When local heap is parked it is not allowed to dereference any handles. A GC might be relocating objects at that point. Change-Id: I557682d47f8f0acfe041506833f6b397feb4438b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2289981Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/master@{#68768}
-
- 08 Jul, 2020 1 commit
-
-
Ulan Degenbaev authored
Bug: v8:10315 Change-Id: I6be83e742a3ef488e09ac44a379e028592a5ff64 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2287493 Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/master@{#68736}
-
- 22 Jun, 2020 1 commit
-
-
Dan Elphick authored
This changes black/white list to block/allow list. Bug: v8:10619 Change-Id: Id55d72f90891670ca57b62dfeb6b3251025927dc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2257228Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Dan Elphick <delphick@chromium.org> Cr-Commit-Position: refs/heads/master@{#68464}
-
- 28 May, 2020 2 commits
-
-
Ng Zhi An authored
Making them private was a way to hide the constructor, we can explicitly delete them, which give a better compilation error message as well. Also see: https://stackoverflow.com/q/55205874 Bug: v8:10488 Change-Id: I1c037a501c1da39f027c071e5e64d36fd1c95c6d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2219419Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Zhi An Ng <zhin@chromium.org> Cr-Commit-Position: refs/heads/master@{#68049}
-
Leszek Swirski authored
Make sure that any GCs required for off-thread heap merging happen before any off-thread handle transferring (both transferring using OffThreadTransferHandle, and the handles created for the string slot fixups). This is to avoid the marker from walking Handle roots that point into off-thread pages which the sweeper doesn't see (and can't clear mark bits on) Now, the merging and handle creation is atomic as far as the GC is concerned. The merging is done before handle creation to avoid the incremental marker from entering off-thread pages, but we ensure that the raw objects pointers that point into the off-thread pages (which are used for creating the main-thread handles) stay valid until the handle creation completes. Since handle transfer now happens in the middle of publishing, this patch also moves the OffThreadTransferHandleStorage ownership over to OffThreadHeap. This requires some header juggling to avoid leaking OffThreadTransferHandleStorage into the off-thread-isolate header. Bug: chromium:1086478, chromium:1011762 Change-Id: Id5e7622d6b5520400a4872c5f6ad396c74b30ca6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2218058Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#68043}
-
- 14 May, 2020 1 commit
-
-
Leszek Swirski authored
Add a new OffThreadObjectDeserializer, which can deserialize a snapshot into an OffThreadIsolate. This involves templating the Deserializer base class on Isolate, and amending OffThreadHeap to be able to create Reservations same as the main-thread Heap can. Various off-thread incompatible methods are stubbed out as UNREACHABLE in OffThreadIsolate overloads. There is currently no API entry into the off-thread deserialization, but under --stress-background-compile it now runs the CodeDeserializer (i.e. code cache deserialization) in a background thread. Bug: chromium:1075999 Change-Id: I2453f51ae31df4d4b6aa94b0804a9d6d3a03781e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2172741 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#67799}
-
- 12 May, 2020 1 commit
-
-
Georg Neis authored
R=dinfuehr@chromium.org Bug: v8:10315 Change-Id: I595bc76907c9f0f437d460916aec804b55895376 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2195822Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Auto-Submit: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#67731}
-
- 05 May, 2020 1 commit
-
-
Samuel Groß authored
Bug: v8:10391 Change-Id: I55d4d33820c83711d3ea3c6a2f3a20a36707fe36 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2151354Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#67566}
-
- 15 Apr, 2020 1 commit
-
-
Yang Guo authored
R=jgruber@chromium.org Bug: v8:6071 Change-Id: I346775e827fe9b2f24409dbba642c97622e9ea7e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2149423Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/master@{#67143}
-
- 06 Apr, 2020 1 commit
-
-
Dominik Inführ authored
Adds the PersistentHandles class, which serves as a container for handles that can be passed back and forth between threads. Allocation and deallocation of this class is thread-safe and the isolate tracks all PersistentHandles containers. Design doc: https://docs.google.com/document/d/17yKs-6apE2rGEag7tDsoyeRxg99c1dXyXQ2MfHe65tY/edit?usp=sharing Bug: v8:10315 Change-Id: I4b9c958c9a57d755ca68862197501f75274670fb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2128058 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#67004}
-
- 25 Mar, 2020 1 commit
-
-
Dominik Inführ authored
Add LocalHandleScope to allow for local handles in LocalHeaps (background threads). This class is similar to HandleScope which still needs to be used on the main thread. When performing a GC, the main thread halts all background threads at a safepoint such that it can safely iterate their roots. Bug: v8:10315 Change-Id: Id8f5d54cc2535e004081ccdef15dc03a39b2d0f0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2111218 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#66853}
-
- 18 Mar, 2020 1 commit
-
-
Leszek Swirski authored
Remove the wrapped arguments and outer scope info handles from ParseInfo, and instead infer them from the SharedFunctionInfo or Script, or in the case of eval pass it through to the parser as an argument. Bug: v8:10314 Change-Id: Ia1d1dbab5b62252e10fa2055f7e91f914324efd4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2106200 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Simon Zünd <szuend@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#66771}
-
- 10 Mar, 2020 1 commit
-
-
Dominik Inführ authored
Report the allocated size of global handles in GetHeapStatistics as well, not including free handles. Bug: chromium:1060192 Change-Id: I1aedba36735f897cd8518edbb5ef2261cc348bff Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2093493 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#66651}
-
- 04 Mar, 2020 2 commits
-
-
Camillo Bruni authored
Drive-by-fix: Add V8_WARN_UNUSED_RESULT to MaybeHandle::ToHandle Bug: chromium:1057653 Change-Id: I2834806ca498a2fa43a64f5391606cdbfb4af4fa Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2084814Reviewed-by:
Igor Sheludko <ishell@chromium.org> Commit-Queue: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#66582}
-
Leszek Swirski authored
Add off-thread support for class boilerplate allocation, removing a previously "unreachable" overload. Notably, this requires support for off-thread allocation of Dictionaries and DescriptorArrays. Due to template fun, the off-thread allocation of Dictionaries in particular requires some amount of boilerplate (no pun intended). Bug: chromium:1011762 Change-Id: I37139d924858e31e45d369742329826784a8f614 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2080370 Commit-Queue: Igor Sheludko <ishell@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#66580}
-
- 03 Mar, 2020 2 commits
-
-
Leszek Swirski authored
Add the remaining missing templatizations to allow an initial wiring in of the off-thread factory into streaming compilation finalization. The off-thread finalization is behind a flag, disabled by default: --finalize-streaming-on-background When the flag is enabled, background tasks will perform perform the finalization during their background execution, and will release the parser and compilation jobs once they are no longer needed. The implementation is complete enough for performance testing, but not enough for launch. Notably, there is no support for: * Class boilerplates (the code is marked unreachable), * Exceptions during finalization, i.e. parse/compile warnings/errors, * Allocation sampling, * Logging, * Asm.js, * Parallel complication tasks * Forced source positions (for "NeedsDetailedOptimizedCodeLineInfo()") This patch also adds some tracing events for the various stages of the off-thread finalization (including the main-thread merge) for further performance improvements. Bug: chromium:1011762 Change-Id: Ia44fa56975dd689f0d92c1543b294cdb063eb199 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2066965 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Clemens Backes <clemensb@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#66566}
-
Dominik Inführ authored
Report the total size of global handles in GetHeapStatistics as well. This size includes used and free global handles. Change-Id: I08c0647d993a810a37ae9f332732de9551b5ea8d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2083020 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#66562}
-
- 02 Mar, 2020 1 commit
-
-
Leszek Swirski authored
Remove OffThreadHandle, HandleOrOffThreadHandle, and HandleFor, and make the OffThreadIsolate allocate "real" Handles. Rather than using the main-thread Isolate's handle scopes, these off-thread Handles are backed by a Zone, which is tied to the lifetime of the nearest OffThreadHandleScope. Eventually, we'll likely want to merge the implementation of OffThreadHandleScope and HandleScope, but currently the latter is too tightly coupled to the main thread to do so. Bug: chromium:1011762 Change-Id: I2a6361931fe3f90a7bef4cc28ee42155fa8d062f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2071865Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#66516}
-
- 20 Feb, 2020 1 commit
-
-
Leszek Swirski authored
Bug: chromium:1011762 Change-Id: I58284d50acaf349ed5c56654972e2c2bcece1ec3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2061550 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#66378}
-
- 13 Feb, 2020 1 commit
-
-
Leszek Swirski authored
This is a reland of 453e1a3b Added canonical "empty" arrays to ScannerStream::ForTesting, for the zero-length nullptr data case. Original change's description: > [offthread] Add SFI support to OffThreadFactory > > Add support for off-thread SharedFunctionInfo allocation, which > includes UncompiledData and PreparseData allocation. > > Bug: chromium:1011762 > Change-Id: Ia10f9ce762c7d7eb1108b9e71da75131dce919b7 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2050393 > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Cr-Commit-Position: refs/heads/master@{#66246} TBR=ulan@chromium.org Bug: chromium:1011762 Change-Id: I37d2c6b9317548922913887940a0164cc2067efb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2054085Reviewed-by:
Igor Sheludko <ishell@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#66253}
-
- 12 Feb, 2020 2 commits
-
-
Maya Lekova authored
This reverts commit 453e1a3b. Reason for revert: Makes UBSan unhappy - https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20UBSan/9893 Original change's description: > [offthread] Add SFI support to OffThreadFactory > > Add support for off-thread SharedFunctionInfo allocation, which > includes UncompiledData and PreparseData allocation. > > Bug: chromium:1011762 > Change-Id: Ia10f9ce762c7d7eb1108b9e71da75131dce919b7 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2050393 > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Cr-Commit-Position: refs/heads/master@{#66246} TBR=ulan@chromium.org,leszeks@chromium.org,ishell@chromium.org Change-Id: I26bc40ec1c351613f19745aed83f0c3a9fdd9a20 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: chromium:1011762 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2052172Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/master@{#66247}
-
Leszek Swirski authored
Add support for off-thread SharedFunctionInfo allocation, which includes UncompiledData and PreparseData allocation. Bug: chromium:1011762 Change-Id: Ia10f9ce762c7d7eb1108b9e71da75131dce919b7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2050393 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#66246}
-
- 10 Feb, 2020 1 commit
-
-
Leszek Swirski authored
Make sure we can't get the Isolate for writable off-thread space objects, to avoid leaking the Isolate into off-thread compilation. Bug: chromium:1011762 Change-Id: I5c4316e751736b8c8235fdcc8949d52b78313f38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2043791 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#66194}
-
- 06 Feb, 2020 2 commits
-
-
Leszek Swirski authored
Allow HandleOrOffThreadHandle to implicitly convert to any of Handle, MaybeHandle, and OffThreadHandle, so that it can be used in Isolate-templated code with fewer 'get' calls. As a drive-by, allow OffThreadHandle to have an OffThreadIsolate parameter (so that HandleFor<Isolate, Foo>(x, isolate) works), and use a static_cast rather than a T::cast in the implicit upcast constructor of OffThreadHandle to prevent implicit down-casts. Bug: chromium:1011762 Change-Id: I226f3a48b0f3b5e0347e6325be1cbd482c9048ed Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2042100 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#66157}
-
Leszek Swirski authored
Add off-thread support for literals, including object/array boilerplates. Notably, this includes adding FixedArray and HeapNumber support to OffThreadFactory. As a drive-by, OffThreadHandle is redefined to store an Address rather than an Object, similar to Handle, so that it still works with forward definitions of types. Bug: chromium:1011762 Change-Id: I7c8452f450d8c57fe683a9e44532ce5647c84a11 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2036084 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#66156}
-
- 04 Feb, 2020 1 commit
-
-
Leszek Swirski authored
The Factory/OffThreadFactory allows us to cleanly separate object construction behaviour between main-thread and off-thread in a syntactically consistent way (so that methods templated on the factory type can be made to work on both). However, there are cases where we also have to access the Isolate, for handle creation or exception throwing. So far we have been pushing more and more "customization points" into the factories to allow these factory-templated methods to dispatch on this isolate behaviour via these factory methods. Unfortunately, this is an increasing layering violation between Factory and Isolate, particularly around exception handling. Now, we introduce an OffThreadIsolate, analogous to Isolate in the same way as OffThreadFactory is analogous to Factory. All methods which were templated on Factory are now templated on Isolate, and methods which used to take an Isolate, and which were recently changed to take a templated Factory, are changed/reverted to take a templated Isolate. OffThreadFactory gets an isolate() method to match Factory's. Notably, FactoryHandle is changed to "HandleFor", where the template argument can be either of the Isolate type or the Factory type (allowing us to dispatch on both depending on what is available). Bug: chromium:1011762 Change-Id: Id144176f7da534dd76f3d535ab2ade008b6845e3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2030909 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#66101}
-
- 03 Feb, 2020 1 commit
-
-
Michael Lippautz authored
Similar to other stack references they don't need to be scanned on incremental marking start. Bug: chromium:1046277 Change-Id: I9fb3ee768df0288b5a61f09e680e321a8cb7b895 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2030915Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/master@{#66080}
-
- 19 Jan, 2020 1 commit
-
-
Michael Lippautz authored
- Fix copying of already initialized nodes - Add better verification - Add tests for moving/copying onto already initialized nodes Bug: chromium:1040038 Change-Id: I0c144fcfe980d7542cf6803e4dc861e3fd4ca708 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2007278Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/master@{#65858}
-
- 17 Jan, 2020 1 commit
-
-
Michael Lippautz authored
Similar to TracedReference, support TracedGlobal on stack as well. Bug: chromium:1040038 Change-Id: If3400a2df8b4a11410032bd5ad1b7bed64063b93 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2005071 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#65841}
-
- 16 Jan, 2020 2 commits
-
-
Michael Lippautz authored
Previously, V8 was just relinking nodes which broke when a move involves an on-stack reference as such nodes have different semantics. The solution is to create new internal nodes when necessary. Bug: chromium:1040038 Change-Id: Ia5b3866ae68d014beb30972c4266aa5bae6559fc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2002546 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#65823}
-
Leszek Swirski authored
Add support for internalizing an AstValueFactory using the off-thread factory. Includes adding ConsString support to OffThreadFactory. This introduces a Handle union wrapper, which is used in locations that can store a Handle or an OffThreadHandle. This is used in this patch for the internalized "string" field of AST strings, and will be able to be used for other similar fields in other classes (e.g. the ScopeInfo handle in Scope, object boilerplate descriptor handles, the inferred name handle on FunctionLiterals, etc.). It has a Factory-templated getter which returns the appropriate handle for the factory, and a debug-only tag to make sure the right getter is used at runtime. This union wrapper currently decomposes implicitly to a Handle if the getter is not called, to minimise code changes, but this implicit conversion will likely be removed for clarity. Bug: chromium:1011762 Change-Id: I5dd3a7bbdc483b66f5ff687e0079c545b636dc13 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1993971 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#65816}
-
- 15 Jan, 2020 2 commits
-
-
Leszek Swirski authored
Introduce OffThreadFactory with initial string construction support. The OffThreadFactory shares with Factory a new CRTP base class, called FactoryBase. Methods in FactoryBase return a FactoryHandle<Factory, T> alias, which is Handle<T> for normal Factory and a new OffThreadHandle<T> for OffThreadFactory. OffThreadHandle<T> behaves like Handle<T>, except it stores the object in-line rather than needing external storage. Any shared factory methods are moved into FactoryBase, which uses CRTP to call the sub-class's AllocateRaw method (plus a few more customization points which need Isolate access on the main thread). Methods that used to take an Isolate or Factory, and are needed off the main thread, are now expected to be templated on the factory type and to use the appropriate handle. Once an OffThreadFactory has finished being used (e.g. off-thread compilation completed) its pages are "Published" into the main-thread Heap. To deal with string internalization without creating a bunch of ThinStrings, this is done in two stages: 1. 'FinishOffThread': The off-thread pages are walked to collect all slots pointing to "internalized" strings. After this is called it is invalid to allocate any more objects with the factory. 2. 'Publish': On the main thread, we transform these slots into <Handle to holder, offset> pairs, then for each saved slot re-internalize its string and update the slot to point to the internalized string. Bug: chromium:1011762 Change-Id: I008a694da3c357de34362bd86fe7e1f46b535d5e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1992434 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#65787}
-
Michael Lippautz authored
The DCHECKs ensured that all on-stack handles removed when the embedder notifies V8 of an empty stack are indeed below the current stack limit. This is brittle, as the calls that are guaranteed to have no stack above, e.g., non-nestable tasks executing GC, sometimes have larger stack depth then previously registered on-stack handles. Resetting the slot to avoid UAF is not possible/needed as it is guaranteed in such cases that the stack is indeed different from the stack that was used when registering an on-stack handle. This CL removes the DCHECKs and trust the embedder on such calls, similar to when the embedder tells V8 that there's no interesting C++ stack on top of a call to avoid conservative stack scanning. Bug: chromium:1040038 Change-Id: I2e8c77d8080f2d888f773984646998bede59e19c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2000753Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/master@{#65786}
-
- 14 Jan, 2020 1 commit
-
-
Michael Lippautz authored
- Introduces a API to set top of the stack through EmbedderHeapTracer::SetStackTop. - Introduces a new API to inform V8 about an empty embedder stack. - Switch internal representation of TracedReference for on-stack handles to a proper stack that considers all contained handles as roots. - Handle garbage is avoided by cleaning up on handle creation or GC. Design doc: https://bit.ly/on-stack-traced-reference Bug: chromium:1040038 Change-Id: I927ef0abb268fdb5853c9e17b1bc96e2491cf101 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1993973 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/master@{#65757}
-
- 05 Dec, 2019 1 commit
-
-
Ulan Degenbaev authored
Currently a TracedNode of a TracedReference is freed only if its target V8 object is unreachable. This is problematic for TracedNodes created for long-living (or immortal) V8 objects and leads to memory leaks. This CL adds logic for collecting unreachable TracedNodes: 1) Each TracedNode gets a markbit. Initially the markbit is set (i.e. we have black allocation for TracedNodes). 2) During marking RegisterEmbedderReference sets the markbit of the corresonding TracedNode. 3) In the atomic pause of Mark-Compact when TracedNodes are iterated, we check the markbits and free TracedNodes with cleared markbits. After this processing all markbits are cleared for the next GC. Note that the new logic does not apply to TracedNode that have callbacks and/or destructors. Bug: chromium:1029738 Change-Id: I38e76a8b4a84170793998988b1a7962e40874428 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1948722 Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Omer Katz <omerkatz@chromium.org> Reviewed-by:
Hannes Payer <hpayer@chromium.org> Cr-Commit-Position: refs/heads/master@{#65347}
-
- 22 Nov, 2019 1 commit
-
-
Ulan Degenbaev authored
Currently these events are emitted by Blink in GC prologue/epilogue. That however does not respect event nesting and breaks with future perfetto changes. This CL emits the events inside V8 using a scope to guarantee proper event nesting. The events are same except for the "type" argument that now gets more detailed information. The corresponding Blink CL that removes these trace events: https://chromium-review.googlesource.com/c/chromium/src/+/1929227 Bug: chromium:1026658 Change-Id: Ifbfab647f40f81af7acf315ff4608b9dc9444f94 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1928857Reviewed-by:
Yang Guo <yangguo@chromium.org> Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#65120}
-
- 15 Nov, 2019 1 commit
-
-
Dan Elphick authored
utils.h itself is fairly large and contains lots of unrelated functions as well as having a fair number of dependencies itself, so this splits bounds checking and bit field operations into their own headers in base and replaces uses of utils.h with the more appropriate header where possible. (Also fixes some cases where other headers were previously brought in transitively). Bug: v8:9810, v8:8912 Change-Id: I76c53f953848a57e2c5bfad6ce45abcd6d2a4f1b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1916604Reviewed-by:
Clemens Backes <clemensb@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Dan Elphick <delphick@chromium.org> Cr-Commit-Position: refs/heads/master@{#64983}
-
- 31 Oct, 2019 1 commit
-
-
Yang Guo authored
R=hpayer@chromium.org Change-Id: If3586bf451e08ab4bbf6d91b9f15382fad411219 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1868609 Auto-Submit: Yang Guo <yangguo@chromium.org> Commit-Queue: Hannes Payer <hpayer@chromium.org> Reviewed-by:
Hannes Payer <hpayer@chromium.org> Cr-Commit-Position: refs/heads/master@{#64679}
-