- 13 Apr, 2022 1 commit
-
-
Shu-yu Guo authored
Computing the length for variable-length TAs is a lot of code and was regressing microbenchmarks. Bug: v8:11111 Change-Id: Ia7c3c92bfb43938068aaf539b290f6a30b049c18 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3583898Reviewed-by:
Marja Hölttä <marja@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#79961}
-
- 29 Mar, 2022 1 commit
-
-
Shu-yu Guo authored
Bug: v8:11111, v8:12731, v8:12742 Change-Id: I2679c0e64faca25a2c16e15fd3a5c727eb941c92 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3551894Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Marja Hölttä <marja@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#79662}
-
- 23 Mar, 2022 1 commit
-
-
Marja Hölttä authored
Bug: v8:11111,chromium:1306929 Change-Id: I26e4c5d7e87f75844e60952f30e8fe20189910c4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3535783Reviewed-by:
Shu-yu Guo <syg@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/main@{#79577}
-
- 14 Jan, 2022 1 commit
-
-
Samuel Groß authored
This CL removes the global IsValidBackingStorePointer function and turns the DCHECKs that ensure that sandboxed pointers point into the sandbox, which essentially cover the same condition, into CHECKs. This is mostly to facilitate debugging during the initial rollout, and the CHECKs can later be turned back into DCHECKs. In addition, this CL adds a fallback to a partially-reserved sandbox when sandboxed pointers are enabled and when the regular initialization fails. Bug: chromium:1218005 Change-Id: I75526f1a00ddb9095ae0e797dc9bb80a210f867b Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3367617Reviewed-by:
Igor Sheludko <ishell@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#78620}
-
- 10 Dec, 2021 1 commit
-
-
Jakob Kummerow authored
To make sure that Wasm memories don't exceed JSArrayBuffer size. This change shouldn't affect real-world modules, because finding enough contiguous address space to allocate that much memory is virtually impossible anyway. Fixed: chromium:1242339 Change-Id: I68873796b9afb798cb1a64e5e1acc495cf509159 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3328783 Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Thibaud Michaud <thibaudm@chromium.org> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Cr-Commit-Position: refs/heads/main@{#78336}
-
- 02 Dec, 2021 1 commit
-
-
Samuel Groß authored
This CL turns references to ArrayBuffer backing stores from JSArrayBuffers, JSTypedArrays, and JSDataViews into CagedPointers when those are enabled. CagedPointers cannot generally represent nullptr, as NULL usually lies outside the cage. As such, nullptr backing stores are replaced with a special empty backing store value, which, in the current implementation, points to the end of the cage, right in front of the trailing guard regions. Due to this, it is no longer correct to compare a backing store pointer against nullptr. Bug: chromium:1218005 Change-Id: I4a6c7a82aabb4debcb6bb2babe4035ba2da8e79f Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3244419 Commit-Queue: Samuel Groß <saelo@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#78218}
-
- 24 Nov, 2021 1 commit
-
-
Samuel Groß authored
The main changes of this CL are: It should no longer be assumed that an empty ArrayBuffer has a nullptr backing store. This is in preparation for the move to caged pointers, which cannot represent nullptr, and will instead likely provide a EmptyBackingStore constant pointing inside the virtual memory cage. For that reason, a new JSArrayBuffer::IsEmpty() helper is introduced, which should be used instead of checking against nullptr. CodeStubAssembler::GetTypedArrayBuffer now checks for on-heap TypedArrays instead of comparing the backing store pointer to nullptr. This is consistent with the implementation in JSTypedArray::GetBuffer. v8::ArrayBufferView::CopyContents now uses JSTypedArray::DataPtr instead of relying on nullptr backing stores to handle on-heap TypedArrays. The serializer and deserializer now check for IsEmpty() and use the kEmptyBackingStoreRefSentinel value to serialize empty backing stores. Empty ArrayBuffers allocated for on-heap TypedArrays now have a byte_length of zero. This allows removing the allocation_length() (and allocation_buffer()) methods, which were only (incorrectly, as they don't account for GSABs) used for memory measurements. Bug: chromium:1218005 Change-Id: Ib889ccf855f68525f7a614f3963e46ea56865fa3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3297709Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Reviewed-by:
Marja Hölttä <marja@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#78069}
-
- 23 Nov, 2021 2 commits
-
-
Marja Hölttä authored
Previous version: https://chromium-review.googlesource.com/c/v8/v8/+/3259648 Fix 1: ValueSerializer <3 JSArrayBufferView Fix 2: set flags correctly when creating DataViews via the API Bug: v8:11111 Change-Id: I9cbfdaff29f97c7823eaa3d931689b363e1f4cf7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3297708Reviewed-by:
Marja Hölttä <marja@chromium.org> Reviewed-by:
Dominik Inführ <dinfuehr@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/main@{#78046}
-
Marja Hölttä authored
This reverts commit 8f3e53b8. Reason for revert: Blink test failures Original change's description: > [rab/gsab] Add RAB / GSAB support to DataViews > > Bug: v8:11111 > Change-Id: Ice66accee734484302d499b8098056ae1c68faf3 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3259648 > Commit-Queue: Marja Hölttä <marja@chromium.org> > Reviewed-by: Shu-yu Guo <syg@chromium.org> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> > Cr-Commit-Position: refs/heads/main@{#78028} Bug: v8:11111 Change-Id: Icaae7276dfede8c021f3ce1a7e96ed3ec13fe4fe No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3295577 Auto-Submit: Marja Hölttä <marja@chromium.org> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Marja Hölttä <marja@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#78039}
-
- 22 Nov, 2021 1 commit
-
-
Marja Hölttä authored
Bug: v8:11111 Change-Id: Ice66accee734484302d499b8098056ae1c68faf3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3259648 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by:
Shu-yu Guo <syg@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#78028}
-
- 05 Oct, 2021 1 commit
-
-
Clemens Backes authored
R=dinfuehr@chromium.org Bug: v8:12278 Change-Id: I54c2e623e80e13b04b9acbb0915d251ab551eec3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3201996Reviewed-by:
Dominik Inführ <dinfuehr@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#77231}
-
- 22 Sep, 2021 1 commit
-
-
Marja Hölttä authored
Bug: v8:11111 Change-Id: I6a86dd1313a7bfb72024e9857a0c18dd6c83fe3c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3160518 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#76980}
-
- 17 Aug, 2021 1 commit
-
-
Samuel Groß authored
ArrayBuffer backing stores will instead use the virtual memory cage and be referenced through offsets rather than pointers when the sandbox is enabled. This will be implemented in an independent CL. Bug: v8:10391 Change-Id: Icc9781003e53c76dbbf4c84ee165151e4182da4b Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3086458Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/master@{#76348}
-
- 11 Aug, 2021 1 commit
-
-
Igor Sheludko authored
... which didn't properly handle negative Smi indices with JSTypedArray receivers. The logic was broken by the spec violation fix https://chromium-review.googlesource.com/c/v8/v8/+/2972727 Bug: chromium:1227476, chromium:1209405 Change-Id: I9bfa57d56bebccad00ed29666489f2003694e0a9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3086472 Commit-Queue: Igor Sheludko <ishell@chromium.org> Commit-Queue: Victor Gomes <victorgomes@chromium.org> Auto-Submit: Igor Sheludko <ishell@chromium.org> Reviewed-by:
Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/master@{#76217}
-
- 23 Jul, 2021 1 commit
-
-
Marja Hölttä authored
Bug: v8:11111 Change-Id: I41a318d3858e48035ae67e937420e2963a13d871 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3035091 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by:
Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/master@{#75878}
-
- 23 Jun, 2021 1 commit
-
-
Igor Sheludko authored
... which didn't properly handle non-Smi integer indices with JSTypedArray receivers. The addition of new JSReceiver::OrdinaryDefineOwnProperty() overload with LookupIterator::Key caused circular dependency between lookup.h and js-objects.h, so the LookupIterator::Key was moved out of the LookupIterator class in order to make it forward-declarable. Bug: chromium:1209405 Change-Id: I265f0c00f65ab6476c8f1d0ca1264f555d43465f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2972727 Auto-Submit: Igor Sheludko <ishell@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#75326}
-
- 10 Jun, 2021 1 commit
-
-
John Xu authored
For Cobalt's purpose in the past, we introduced base::Memcpy to intercept memcpy calls and replace it with SbMemoryCopy on Starboard/Cobalt. Recently Cobalt removed SbMemoryCopy because we found out that memcpy implementation is universal. To reduce the cost to maintain base::Memcpy, let us remove it and revert back to raw memcpy. Bug: v8:10927 Change-Id: I060f191f8f1aed8b78ffe4558a3743f3a2da008b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2951462Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Reviewed-by:
Marja Hölttä <marja@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Clemens Backes <clemensb@chromium.org> Commit-Queue: John Xu <johnx@google.com> Cr-Commit-Position: refs/heads/master@{#75070}
-
- 10 May, 2021 1 commit
-
-
Marja Hölttä authored
Detailed list of changes: https://docs.google.com/document/d/15i4-SZDzFDW7FfclIYuZEhFn-q-KpobCBy23x9zZZLc/edit?usp=sharing Bug: v8:11111 Change-Id: I931003bd4552cf91d57de95af04a427a9e6d6ac9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2814259Reviewed-by:
Igor Sheludko <ishell@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Shu-yu Guo <syg@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/master@{#74459}
-
- 07 May, 2021 1 commit
-
-
Dominik Inführ authored
This CL changes the accounting of array buffers, such that Detach deducts the backing store immediately. Previously this was corrected in the next GC cycle. Not updating backing_store_bytes_ immediately could cause an overflow in WasmMemoryObject::Grow. Grow first detaches the backing store from the old JSArrayBuffer and then attaches it to a new one. This results in the backing store being accounted twice temporarily, this could cause overflows on 32-bit systems. Bug: chromium:1204455 Change-Id: I7cf2ca9a12bb5caf7bcffa25a34567774cf155b8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2871458 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#74429}
-
- 07 Jan, 2021 1 commit
-
-
Shu-yu Guo authored
This implements the spec change in https://github.com/tc39/ecma262/pull/2164 Making TA elements configurable has interaction with delete. While the elements are configurable, they are only "deletable" via detaching the underlying ArrayBuffer, not via `delete`. That is, `delete ta[idx]` for an in-bounds `idx` still returns false. Bug: v8:11281 Change-Id: I2e9348a7ec3c3239a92cc35e51b7182423736834 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2605234Reviewed-by:
Marja Hölttä <marja@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/master@{#71955}
-
- 17 Nov, 2020 1 commit
-
-
John Xu authored
Bug: v8:10927 Change-Id: Icbdc0d7329ddd466e7d67a954246a35795b4dece Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2507310 Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Peter Marshall <petermarshall@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Clemens Backes <clemensb@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#71220}
-
- 29 Sep, 2020 1 commit
-
-
Samuel Groß authored
This change moves external pointers into a separate table and turns external pointers in heap objects into indices into that table. This CL implements one of two possible ownership models for the table entries. With this one, every heap object owns its table entries, and they are allocated when the owning object is allocated. As such, setting external pointer fields does not require allocation of table entries. On the other hand, table indices cannot be shared between multiple objects. This CL does not yet implement freeing of external pointer table entires. This will later happen by a table garbage collector. Bug: v8:10391 Change-Id: I4d37785295c25a7d1dcbc9871dd5887b9d788a4f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2235700Reviewed-by:
Igor Sheludko <ishell@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Samuel Groß <saelo@google.com> Cr-Commit-Position: refs/heads/master@{#70204}
-
- 12 Aug, 2020 1 commit
-
-
Dominik Inführ authored
ArrayBufferTracker was superseded by ArrayBufferList and ArrayBufferSweeper. Now that ArrayBufferSweeper is used in production, we can remove the unused ArrayBufferTracker mechanism. Bug: v8:10064 Change-Id: I479169c76b6c5c634672024f77e689bb64a36504 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339105Reviewed-by:
Simon Zünd <szuend@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/master@{#69351}
-
- 04 May, 2020 1 commit
-
-
Igor Sheludko authored
Bug: v8:10391 Change-Id: I316a3c5cd986a74d7f46da6d0b85cb3d549be497 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2153209 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#67533}
-
- 01 May, 2020 1 commit
-
-
Igor Sheludko authored
Bug: v8:10391 Change-Id: If1db52dc74f9027f06104ce719514b751b4d9504 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2149417 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#67515}
-
- 17 Mar, 2020 1 commit
-
-
Ulan Degenbaev authored
This adjusts v8::[Shared]ArrayBuffer::NewBackingStore to allow passing a known empty deleter -- v8::BackingStore::EmptyDeleter. Such API is useful if the backing store memory is static or is manually managed. We can skip adjusting the amount of external memory for ArrayBuffers with empty deleters and thus avoid scheduling ineffective GCs. Bug: chromium:1061960 Change-Id: I0ef5b2b0839098beb59d5cebbb28f9f81a73a042 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2105355Reviewed-by:
Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#66740}
-
- 02 Mar, 2020 1 commit
-
-
Dominik Inführ authored
The JSArrayBuffer::extension-field might not be aligned with pointer compression enabled. However on AArch64 pointers need to be aligned if you perform atomic operations on them. Therefore split extension into two 32-bit words that each get updated atomically. There is no ABA problem here since the extension field only transitions from NULL --> value --> NULL. After Detach(), Attach() isn't invoked anymore. Bug: v8:10064 Change-Id: I20c1a37ac35d1749a94bfd277a4f91d531015bc5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2078586Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/master@{#66515}
-
- 27 Feb, 2020 1 commit
-
-
Sathya Gunasekaran authored
This reverts commit 1f35c165. Reason for revert: speculative revert for TSAN failure: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20concurrent%20marking/12179 Original change's description: > [objects] Update JSArrayBuffer::extension-field in two steps > > The JSArrayBuffer::extension-field might not be aligned with pointer > compression enabled. However on AArch64 pointers need to be aligned if > you perform atomic operations on them. Therefore split extension into > two 32-bit words that each get updated atomically. There is no ABA > problem here since the extension field only transitions from > NULL --> value --> NULL. After Detach(), Attach() isn't invoked anymore. > > Bug: v8:10064 > Change-Id: If987ed51f0528ca7313980f3d36ffca300b75fdc > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2071256 > Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Cr-Commit-Position: refs/heads/master@{#66457} TBR=ulan@chromium.org,dinfuehr@chromium.org # Not skipping CQ checks because original CL landed > 1 day ago. Bug: v8:10064 Change-Id: I2107a4d49d2b127dc65ce11b3b61ccc592fb0736 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2078579Reviewed-by:
Sathya Gunasekaran <gsathya@chromium.org> Reviewed-by:
Tamer Tas <tmrts@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Cr-Commit-Position: refs/heads/master@{#66485}
-
- 26 Feb, 2020 1 commit
-
-
Dominik Inführ authored
The JSArrayBuffer::extension-field might not be aligned with pointer compression enabled. However on AArch64 pointers need to be aligned if you perform atomic operations on them. Therefore split extension into two 32-bit words that each get updated atomically. There is no ABA problem here since the extension field only transitions from NULL --> value --> NULL. After Detach(), Attach() isn't invoked anymore. Bug: v8:10064 Change-Id: If987ed51f0528ca7313980f3d36ffca300b75fdc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2071256 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#66457}
-
- 10 Feb, 2020 1 commit
-
-
Dominik Inführ authored
Update external memory counters when using ArrayBufferExtensions. In case the array buffers are swept concurrently, the counters are updated at the beginning of the next minor/full GC. A subsequent GC is going to update counters faster. ArrayBufferExtension now stores the accounting_length such that the sweeper always knows how much memory to deduct from the external memory on destruction. ArrayBufferList now also tracks the size of all ArrayBuffers in it. Bug: v8:10064 Change-Id: I50a8b1180aa837b6932f834df1610255bd2bd9fd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2041441 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#66195}
-
- 17 Jan, 2020 1 commit
-
-
Dominik Inführ authored
Split the linked list of array buffer extensions into two lists for young and old JSArrayBuffers. Process young extensions during the minor GC pause. When promoting JSArrayBuffers into the old gen, move the extension into the old linked list as well. Bug: v8:10064 Change-Id: I07275ffe7ba918c9b2d6d0648a6d1b59e4fa4891 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1997438 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#65842}
-
- 13 Jan, 2020 1 commit
-
-
Dominik Inführ authored
This CL adds the ArrayBufferExtension class, which is used to track JSArrayBuffers in a linked list. The ArrayBufferExtension is going to replace the ArrayBufferTracker in the future but is currently behind the v8_enable_array_buffer_extension feature flag. When enabled, each JSArrayBuffer has a corresponding native-heap allocated ArrayBufferExtension object. All extensions are currently tracked in a single linked list. During marking the GC not only marks the JSArrayBuffer but also its extension object. At the end of mark-compact the GC iterates all extensions and removes unmarked ones. Change-Id: I88298be255944d5ae1327c91b0d7f0fdbcd486d5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1969791Reviewed-by:
Peter Marshall <petermarshall@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/master@{#65724}
-
- 17 Dec, 2019 1 commit
-
-
Dominik Inführ authored
Add pointer-sized field extension to the JSArrayBuffer class. Only reserve space for this field when feature is enabled for now. Bug: v8:10064 Change-Id: Idb6fdcdce2a048e6aed9a892bc46ce029e1119f3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1956166Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/master@{#65471}
-
- 02 Dec, 2019 1 commit
-
-
Mike West authored
Blink CL: https://chromium-review.googlesource.com/c/chromium/src/+/1944474 Bug: chromium:1029700 Change-Id: I91936942b21d133e06f2583a4e3c70951e5e86f4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1946348 Commit-Queue: Mike West <mkwst@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#65290}
-
- 20 Nov, 2019 1 commit
-
-
Jakob Kummerow authored
They have to be in sync, so this patch updates both systems. Bug: v8:4153 Change-Id: I09252e41a710e79f823fe6818c1c6c0038faeb31 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1903434Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#65078}
-
- 15 Nov, 2019 1 commit
-
-
Maya Lekova authored
This helps reduce the number of false positives encountered by the dead variable analysis in gcmole. TBR=jgruber@chromium.org, verwaest@chromium.org, yangguo@chromium.org Bug: v8:9810 Change-Id: I1a34ccaab340e6abc37832b4ce1a0cabc56fa438 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1917146 Commit-Queue: Maya Lekova <mslekova@chromium.org> Reviewed-by:
Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#64981}
-
- 11 Oct, 2019 1 commit
-
-
Ulan Degenbaev authored
The backing store is now propagated to the constructors directly, instead of being attached after the construction. This ensures that the backing store is allocated before the array buffer so that we can trigger GCs on backing store allocation (if allocation fails). The only exception is builtin where we have to allocate the array buffer before the backing store to comply with the spec. Bug: v8:9380 Tbr: verwaest@chromium.org Change-Id: Ib37db65853f3673dd769368cc3e8b6538ad07ff2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1853444 Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#64240}
-
- 24 Sep, 2019 1 commit
-
-
Ulan Degenbaev authored
This moves the initialization to JSArrayBuffer::SetupEmpty, which is the proper bottleneck for all paths constructing array buffers. Bug: chromium:1006600,v8:9380 Change-Id: I1887cb867627d69ade20654e5bc372b1ba1ac4e3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1815132Reviewed-by:
Yang Guo <yangguo@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#63939}
-
- 23 Sep, 2019 1 commit
-
-
Joshua Litt authored
Bug: v8:9463 Change-Id: Ie0e04e102b56ffdfb636e94ef293bb0d46e5f4a9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1808485Reviewed-by:
Michael Stanton <mvstanton@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Joshua Litt <joshualitt@chromium.org> Cr-Commit-Position: refs/heads/master@{#63933}
-
- 19 Sep, 2019 1 commit
-
-
Igor Sheludko authored
This is a reland of 6f9b2bd4 We must load JSTypedArray::base_pointer in TurboFan as tagged value otherwise this value may become stale pointer after GC. Original change's description: > [ptr-compr] Make on-heap JSTypedArrays smi-corrupting friendly > > On-heap typed arrays contain HeapObject value in |base_pointer| field > and an offset in |external_pointer| field. When pointer compression is > enabled we want to combine decompression with the offset addition. > In order to do that we add an isolate root to the external_pointer value > and therefore the data pointer computation can is a simple addition of > a (potentially sign-extended) |base_pointer| loaded as Tagged_t value > and an |external_pointer| value. > > Bug: v8:9706 > Change-Id: Id5c546c353c81fb25e3598921bc78165d10a9c44 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1807369 > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Georg Neis <neis@chromium.org> > Commit-Queue: Igor Sheludko <ishell@chromium.org> > Cr-Commit-Position: refs/heads/master@{#63874} Bug: v8:9706, chromium:1005599 Cq-Include-Trybots: luci.chromium.try:gpu-fyi-try-win10-nvidia-rel-64 Change-Id: I7bbd2a439306cdd11f2bb0dab5863498624d9740 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1813744Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#63898}
-