- 18 Feb, 2022 1 commit
-
-
Dominik Inführ authored
When we know that the value in a write barrier is a map, we know that we are not going to have an old-to-new reference (maps are always in old generation). Therefore we also don't really need the generational barrier in RecordWrite. While this is technically correct, we don't gain much from this optimization. The inline and out-of-line generated code for the barrier is still the same as in all other cases. Which means that outside marking we don't even reach the RecordWrite builtin. Most write barrier executions happen outside incremental marking, hence performance of the incremental marking barrier isn't critical. This CL always uses the full RecordWrite builtin using a flag in order to allow for an easy revert. This CL is motivated by the shared heap work, which needs an additional always-on barrier in the future (similar to OLD_TO_NEW) to keep a OLD_TO_SHARED remembered set up-to-date. While maps are always in the old generation, they maybe by located in the shared heap. Bug: v8:11708 Change-Id: I71a6ded2547a0b2bbb9bbbd796dbcae0987b2232 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3471854Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#79160}
-
- 17 Feb, 2022 1 commit
-
-
Shu-yu Guo authored
Unlike the Stage 1 proposal, for simplicity the prototype does not add any new syntax, instead opting for exposing a SharedStructType constructor which takes an array of field names. This type constructor returns constructors for shared structs. Shared structs can be shared across Isolates, are fixed layout, have no prototype, have no .constructor, and can only store primitives and other shared structs. The initial prototype does not have TurboFan support. Bug: v8:12547 Change-Id: I23bdd819940b42139692bcdb53d372099b0d4426 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3390643Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
Marja Hölttä <marja@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#79156}
-
- 15 Feb, 2022 5 commits
-
-
Clemens Backes authored
Even though this is not a perfect protection, it will make it harder to write to the wasm code space because it's not permanently RWX. After optimizations (see https://crbug.com/v8/11974) the performance is good enough that it's worth just enabling it. R=ahaas@chromium.org Bug: v8:11974 Change-Id: I82786e932387732863c3c5e3aa743f7836cc45e4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3464035Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#79109}
-
Clemens Backes authored
Both stability and performance looks good on Linux and ChromeOS, which is the only operation systems that currently support PKU. Hence enable the feature by default before launching via finch. R=ahaas@chromium.org Bug: v8:11974, chromium:1204982 Change-Id: I2c1e7e7bb70ba73218d4db630219870b198ba6e6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3461934Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#79103}
-
Dominik Inführ authored
Now that all known correctness issues with map space compaction are fixed, add more test coverage by enabling it with --future. Bug: v8:12578 Change-Id: I23d04a162f742480c4e83de1f3980509543e5a97 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3460409Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#79100}
-
Omer Katz authored
This CL replaces evacuation in MinorMC with always promoting pages. Pages in new space are promoted first within new space and then to old space upon a second GC. This implementation should not yet be used in production and is guarded behind a runtime flag. In case all pages in new space have at least one live object on them, all pages will be promoted and new space will still be out of memory, thus immediately triggering a second young gen GC that will promote all objects to old space. Further CLs will mitigate this issue. Bug: v8:12612 Change-Id: I329ea01d6d15c0942db2eeeea87c5cefcac75502 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3448385Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#79099}
-
Jakob Gruber authored
1. feedback_vector_allocation -> feedback_allocation like elsewhere. 2. A consistent --interrupt-budget prefix. 3. Remove the on-by-default --feedback-allocation-on-bytecode-size. Bug: v8:7700 Change-Id: I1d0af11e89398973a65bf9cb7c7722740d9452ea Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3463718 Auto-Submit: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#79097}
-
- 11 Feb, 2022 1 commit
-
-
Michael Lippautz authored
The flag has been turned on for a long time and we do not intend to support a mode without young LO objects. A side effect is that it removes a branch in AllocateRaw for the young generation. Drive-by: Reinstantiate the LO space verifier checking that only certain types can appear as large objects. Bug: v8:12615 Change-Id: I8c33019a04670f20459ea2faa9dc2f98b8cda40b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3450420Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#79044}
-
- 10 Feb, 2022 1 commit
-
-
Omer Katz authored
The build flag is on by default and the actual functionality is guarded by a runtime flag. Bug: v8:12612 Change-Id: I6adbd5b766f502400af32eeeb035edca3a3606ef Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3448383Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#79036}
-
- 07 Feb, 2022 1 commit
-
-
Junliang Yan authored
This reverts commit 78bc7852. Reason for revert: revert due to failure on native tests. Original change's description: > s390x: [baseline] enable sparkplug on s390x > > Change-Id: I4646bb0f3f6291c97bb4b397d6248b9bdaa2059a > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3439641 > Reviewed-by: Victor Gomes <victorgomes@chromium.org> > Commit-Queue: Junliang Yan <junyan@redhat.com> > Cr-Commit-Position: refs/heads/main@{#78959} Change-Id: I8d006211e42ace4db804f1a88f2749282ef2de32 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3440771 Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Reviewed-by:
Victor Gomes <victorgomes@chromium.org> Commit-Queue: Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/main@{#78985}
-
- 04 Feb, 2022 2 commits
-
-
Junliang Yan authored
Change-Id: I4646bb0f3f6291c97bb4b397d6248b9bdaa2059a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3439641Reviewed-by:
Victor Gomes <victorgomes@chromium.org> Commit-Queue: Junliang Yan <junyan@redhat.com> Cr-Commit-Position: refs/heads/main@{#78959}
-
Seth Brenith authored
The web app owner who notified me about bugs v8:12112 and v8:12126 asked me a reasonable question: "how am I ever supposed to trust the retaining paths in the devtools, if the heap snapshot is generated by a different component than the actual marking code?". This change is my attempt to answer that question. If verification is enabled, the heap snapshot generator will visit each heap object with a realistic marking visitor to find all references from that object. It will then check that those references match the HeapGraphEdges in the snapshot. I also considered the idea that we could collect retaining information during the last GC cycle before taking the heap snapshot, or during an extra GC cycle immediately after. However, running the full GC provides the embedder with the opportunity to run arbitrary code (including JS) both before and after PerformGarbageCollection, so there is no clear guarantee that the heap state during the snapshot actually matches the heap state during marking. Bug: v8:12112, v8:12126 Change-Id: Id29e75ecf9eee19e35daedbdb4a3e1df64785380 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3299590Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com> Cr-Commit-Position: refs/heads/main@{#78952}
-
- 01 Feb, 2022 1 commit
-
-
Frank Tang authored
Implement ALL in NumberFormat v3 except: * Add PluralRules.prototype.selectRange * Add NumberFormat.prototype.formatRange(ToParts)? (which will be reviewed in later CLs) * Change NumberFormat.prototpe.resolvedOptions https://github.com/tc39/proposal-intl-numberformat-v3 https://chromestatus.com/guide/edit/5707621009981440 Design Doc: https://docs.google.com/document/d/19jAogPBb6W4Samt8NWGZKu47iv0_KoQhBvLgQH3xvr8/edit Bug: v8:10776 Change-Id: I1acf833ec25fb05437cb0b21c5510bb99d1c4583 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3405649Reviewed-by:
Shu-yu Guo <syg@chromium.org> Commit-Queue: Frank Tang <ftang@chromium.org> Cr-Commit-Position: refs/heads/main@{#78878}
-
- 31 Jan, 2022 1 commit
-
-
Victor Gomes authored
Whenever running any test with --jitless, V8 crashes with Contradictory flag implications, because: jitless -> !sparkplug concurrent_sparkplug -> sparkplug Change-Id: I51206dfb8d6978a9f9bfdb73e9068dcd5d8f9274 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3423783 Commit-Queue: Victor Gomes <victorgomes@chromium.org> Auto-Submit: Victor Gomes <victorgomes@chromium.org> Reviewed-by:
Camillo Bruni <cbruni@chromium.org> Commit-Queue: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/main@{#78870}
-
- 28 Jan, 2022 1 commit
-
-
Dominik Inführ authored
Enable compaction of objects in the map space during a full GC. So far pages in the map space were never chosen as evacuation candidates. We might be able to improve memory usage a bit by also compacting map space. Luckily for us the marking barrier was already emitted when updating an object's map word. This CL adds a new flag FLAG_compact_map_space to easily turn off this feature again. For now we keep this flag (and with that map space compaction) disabled by default. So GC behavior does not change with this CL. Bug: v8:12578 Change-Id: I99c0cd826bd824af5383fb3ce64796693a59d1ff Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3404775Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#78844}
-
- 27 Jan, 2022 1 commit
-
-
legendecas authored
The Array Grouping proposal [1] reached Stage 3 in December 2021 TC39. [1] https://github.com/tc39/proposal-array-grouping/ Bug: v8:12499 Change-Id: I05b4838d915ab1b0cf8126aa30a3e48f47b9ee59 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3366630Reviewed-by:
Shu-yu Guo <syg@chromium.org> Commit-Queue: Chengzhong Wu <legendecas@gmail.com> Cr-Commit-Position: refs/heads/main@{#78794}
-
- 25 Jan, 2022 1 commit
-
-
legendecas authored
1. Expose all the functions to empty builtins. 2. Wire up the basic structure of ShadowRealm and internal slots. Bug: v8:11989 Change-Id: If7545fe18a74b2bd4b70a1a25776e41f03aaff89 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3195532Reviewed-by:
Shu-yu Guo <syg@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Commit-Queue: Chengzhong Wu <legendecas@gmail.com> Cr-Commit-Position: refs/heads/main@{#78757}
-
- 24 Jan, 2022 1 commit
-
-
Clemens Backes authored
This enables the --turbo-use-mid-tier-regalloc-for-huge-functions flag by default. This configuration has been run through fuzzers for several weeks, and all found issues have been fixed (see https://crbug.com/v8/12330). R=thibaudm@chromium.org Bug: chromium:1287331, chromium:1285389, v8:12320, v8:12287 Change-Id: I82cec61a143a78bf705019b2b2bc2c6342f577fc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3404096Reviewed-by:
Thibaud Michaud <thibaudm@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#78731}
-
- 20 Jan, 2022 1 commit
-
-
Jakob Gruber authored
Bug: v8:12552 Change-Id: I99e4d8e8aeba5460f11e54cc1b2bcaea98a5276d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3400964Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#78698}
-
- 17 Jan, 2022 1 commit
-
-
Jakob Gruber authored
Now that concurrent inlining is shipping on stable, remove support --no-concurrent-inlining. Note that it's still possible to run Turbofan exclusively on the main thread by passing --no-concurrent-recompilation. Bug: v8:7790, v8:12142, chromium:1240585 Change-Id: I1943bbbcad7dea7e3a3c337c239f14f7d96c23cd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3308798Reviewed-by:
Liviu Rau <liviurau@chromium.org> Reviewed-by:
Maya Lekova <mslekova@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#78644}
-
- 15 Jan, 2022 1 commit
-
-
Clemens Backes authored
This is a reland of 40b062ce. Known existing problems have been fixed, see https://crbug.com/v8/12330. Original change's description: > [future] Use mid-tier regalloc for huge functions > > Stage the --turbo-use-mid-tier-regalloc-for-huge-functions behind > --future. > > R=thibaudm@chromium.org > > Bug: v8:12287, v8:12320 > Change-Id: I7145ca1b022bfdcb0b61d6666daf855f14cbc4ce > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3236547 > Reviewed-by: Thibaud Michaud <thibaudm@chromium.org> > Commit-Queue: Clemens Backes <clemensb@chromium.org> > Cr-Commit-Position: refs/heads/main@{#77549} Bug: v8:12287, v8:12320, v8:12330 Change-Id: I90eb2cb54b42fca77c1e3db9c18b20080f0d9338 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3347822Reviewed-by:
Thibaud Michaud <thibaudm@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#78635}
-
- 13 Jan, 2022 1 commit
-
-
Lei Zhang authored
Use grep to check for obviously unneeded includes. e.g. headers that include <vector> but does not contain "std::vector". Change-Id: I43a9e9f01e072fd495918d28ca4cdad5cfa0294c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3354400Reviewed-by:
Marja Hölttä <marja@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Lei Zhang <thestig@chromium.org> Cr-Commit-Position: refs/heads/main@{#78613}
-
- 11 Jan, 2022 1 commit
-
-
Andreas Haas authored
The original CL introduced a test that does not work when it is executed concurrently on multiple isolates. This CL skips this test configuration. Original change's description: > [wasm] Lazy compilation after deserialization > > The serialization format contains one boolean flag per function which > specifies whether the function code exists in the serialized module or > not. With this CL, this boolean flag is extended to a three-value flag > which indicates whether the function exists, and if not, whether the > function was executed before serialization. This information can then be > used upon deserialization to compile only those functions that were > executed before serialization. > > Design doc: https://docs.google.com/document/d/1U3uqq4njqLqFhr1G2sU_bmpQxY-3bvfG55udSb-DvA4/edit?usp=sharing > > Bug: v8:12281 Change-Id: I36ce90b37736172aa01c47ab04e154ec8ea2d8aa Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3380590Reviewed-by:
Clemens Backes <clemensb@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/main@{#78564}
-
- 10 Jan, 2022 2 commits
-
-
Clemens Backes authored
This reverts commit fbcdb281. Reason for revert: New test fails for multiple (concurrent) isolates: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux/45152/overview Original change's description: > [wasm] Lazy compilation after deserialization > > The serialization format contains one boolean flag per function which > specifies whether the function code exists in the serialized module or > not. With this CL, this boolean flag is extended to a three-value flag > which indicates whether the function exists, and if not, whether the > function was executed before serialization. This information can then be > used upon deserialization to compile only those functions that were > executed before serialization. > > Design doc: https://docs.google.com/document/d/1U3uqq4njqLqFhr1G2sU_bmpQxY-3bvfG55udSb-DvA4/edit?usp=sharing > > Bug: v8:12281 > Change-Id: I465e31e5422fa45163256be0e6594045865f0174 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3364089 > Reviewed-by: Clemens Backes <clemensb@chromium.org> > Commit-Queue: Andreas Haas <ahaas@chromium.org> > Cr-Commit-Position: refs/heads/main@{#78545} Bug: v8:12281 Change-Id: If0e327d02e8257a4d1cfcf8b82381af11f28e91c No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3377126 Auto-Submit: Clemens Backes <clemensb@chromium.org> Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#78546}
-
Andreas Haas authored
The serialization format contains one boolean flag per function which specifies whether the function code exists in the serialized module or not. With this CL, this boolean flag is extended to a three-value flag which indicates whether the function exists, and if not, whether the function was executed before serialization. This information can then be used upon deserialization to compile only those functions that were executed before serialization. Design doc: https://docs.google.com/document/d/1U3uqq4njqLqFhr1G2sU_bmpQxY-3bvfG55udSb-DvA4/edit?usp=sharing Bug: v8:12281 Change-Id: I465e31e5422fa45163256be0e6594045865f0174 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3364089Reviewed-by:
Clemens Backes <clemensb@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/main@{#78545}
-
- 07 Jan, 2022 1 commit
-
-
Frank Tang authored
Bug: v8:11544 Change-Id: I3206ca3e0c505b14e4497ccb2af25a31940a1c1e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2967755Reviewed-by:
Shu-yu Guo <syg@chromium.org> Reviewed-by:
Clemens Backes <clemensb@chromium.org> Commit-Queue: Frank Tang <ftang@chromium.org> Cr-Commit-Position: refs/heads/main@{#78518}
-
- 05 Jan, 2022 1 commit
-
-
Manos Koukoutos authored
We implement loop peeling for wasm, currently available behind a flag. Loops are peeled regardless of size. Bug: v8:11510 Change-Id: Ia4c883abdee83df632b2611584d608c44e3295c8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3367615Reviewed-by:
Andreas Haas <ahaas@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#78496}
-
- 16 Dec, 2021 1 commit
-
-
Manos Koukoutos authored
We switch the order of inlining and loop unrolling optimizations. This gives small improvements to wasm-gc benchmarks. Changes: - Change the loop analysis algorithm to accept loops directly connected to the graph's end. This is required because some nodes in an inlined function, such as tail calls, might be directly connected to the outer function's end without an intervening LoopExit node. - Based on the above, skip emitting loop exits for some Throw nodes in WasmGraphBuildingInterface. - Introduce WasmInliningPhase, add it before loop unrolling. Remove inlining from WasmOptimizationPhase. - Handle graph terminators in loop unrolling. - Add loops in the inlined function to the callers loop_infos. Drive-by: - Allow more wasm builtins in unrolled loops. - Reduce inlining parameters to reflect that functions are now slightly smaller during inlining, as no unrolling has taken place yet. Bug: v8:12166 Change-Id: Iadd6b2f75170aa153ca1efb47fbb0d185c2b8371 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3329783Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#78394}
-
- 15 Dec, 2021 2 commits
-
-
Samuel Groß authored
This CL renames a number of things related to the V8 sandbox. Mainly, what used to be under V8_HEAP_SANDBOX is now under V8_SANDBOXED_EXTERNAL_POINTERS, while the previous V8 VirtualMemoryCage is now simply the V8 Sandbox: V8_VIRTUAL_MEMORY_CAGE => V8_SANDBOX V8_HEAP_SANDBOX => V8_SANDBOXED_EXTERNAL_POINTERS V8_CAGED_POINTERS => V8_SANDBOXED_POINTERS V8VirtualMemoryCage => Sandbox CagedPointer => SandboxedPointer fake cage => partially reserved sandbox src/security => src/sandbox This naming scheme should simplify things: the sandbox is now the large region of virtual address space inside which V8 mainly operates and which should be considered untrusted. Mechanisms like sandboxed pointers are then used to attempt to prevent escapes from the sandbox (i.e. corruption of memory outside of it). Furthermore, the new naming scheme avoids the confusion with the various other "cages" in V8, in particular, the VirtualMemoryCage class, by dropping that name entirely. Future sandbox features are developed under their own V8_SANDBOX_X flag, and will, once final, be merged into V8_SANDBOX. Current future features are sandboxed external pointers (using the external pointer table), and sandboxed pointers (pointers guaranteed to point into the sandbox, e.g. because they are encoded as offsets). This CL then also introduces a new build flag, v8_enable_sandbox_future, which enables all future features. Bug: v8:10391 Change-Id: I5174ea8f5ab40fb96a04af10853da735ad775c96 Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3322981Reviewed-by:
Hannes Payer <hpayer@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#78384}
-
Frank Tang authored
This ship one method in Intl Intl.supportedValuesOf which is a Stage 3 TC39 proposal Design Doc: https://docs.google.com/document/d/1lbj_YVW-xhzYNMQeHB-qDjVkf4SA-eTHYpYXx3Oaud8 API Owner LGTMs: miketaylr@chromium.org, chrishtr@chromium.org, tkent@chromium.org Spec: https://tc39.es/proposal-intl-enumeration/ https: //chromestatus.com/guide/edit/5649454590853120 I2P: https://groups.google.com/a/chromium.org/g/blink-dev/c/Txtf_rSqGH8/m/e27FY33JAQAJ R2T: https://groups.google.com/a/chromium.org/g/blink-dev/c/IaTkvH_9DAY/m/1rDxe8lvAAAJ I2S: https://groups.google.com/a/chromium.org/g/blink-dev/c/I0Y4FrRMNSY/m/XIN_fgA5DAAJ Bug: v8:10743 Change-Id: I1e4c80e93ef903347a0e6da73b1e8514863bde09 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3315228Reviewed-by:
Shu-yu Guo <syg@chromium.org> Commit-Queue: Frank Tang <ftang@chromium.org> Cr-Commit-Position: refs/heads/main@{#78379}
-
- 14 Dec, 2021 2 commits
-
-
Frank Tang authored
DD: https://docs.google.com/document/d/1OwEsvs8VQwvR-ug01xLyIwpgcvUfaP24u9owc7aBKJ4/ Status: https://www.chromestatus.com/feature/5566859262820352 R2T: https://groups.google.com/a/chromium.org/g/blink-dev/c/5spmAncbooE/m/NdwZGjLpAgAJ I2S: https://groups.google.com/a/chromium.org/g/blink-dev/c/4ZMt5ukQNRs/m/0flHnuaBBgAJ API Owners LGTMs: chrishtr@chromium.org, miketaylr@chromium.org, tkent@chromium.org Bug: v8:11638 Change-Id: Ief40b7d545a268723e5fbe654cdc86dcb9523300 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3315223Reviewed-by:
Shu-yu Guo <syg@chromium.org> Commit-Queue: Frank Tang <ftang@chromium.org> Cr-Commit-Position: refs/heads/main@{#78378}
-
Andreas Haas authored
R=jkummerow@chromium.org Bug: v8:12281 Change-Id: If00f34053bb970a71a1826010050b79557dbb381 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3338259Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/main@{#78371}
-
- 13 Dec, 2021 1 commit
-
-
Manos Koukoutos authored
Since the reftypes proposal has shipped, we remove the respective flag and the code that handled its absence. We maintain a WasmFeature for reftypes for feature detection purposes. We remove the flag declaration from tests, and adapt some tests that make no sense without the flag. Bug: v8:7581 Change-Id: Icf2f8d0feae8f30ec68d5560f1e7ee5959481483 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3329781Reviewed-by:
Andreas Haas <ahaas@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#78351}
-
- 08 Dec, 2021 4 commits
-
-
Shu-yu Guo authored
This reverts commit cb9e8608. Reason for revert: Causing timeouts on Wasm tests on TSAN and also seems to cause some deadlock issue on shared isolate GC: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20no-concurrent-marking/6847/overview Original change's description: > [wasm] Add --wasm-dynamic-tiering to --future > > R=jkummerow@chromium.org > > Bug: v8:12281 > Change-Id: Ic1a2534aef4b6335c068636ee4e3aa10300fca53 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3322767 > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> > Commit-Queue: Andreas Haas <ahaas@chromium.org> > Cr-Commit-Position: refs/heads/main@{#78309} Bug: v8:12281 Change-Id: Idf2bea0907daea645be922f0db776caa9dff07a3 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3325023 Auto-Submit: Shu-yu Guo <syg@chromium.org> Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#78311}
-
Andreas Haas authored
R=jkummerow@chromium.org Bug: v8:12281 Change-Id: Ic1a2534aef4b6335c068636ee4e3aa10300fca53 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3322767Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/main@{#78309}
-
Thibaud Michaud authored
Treat all stack pointers as roots: - Maintain a global linked-list of StackMemories - Update StackFrameIterator to process inactive stacks - Visit roots in all inactive stacks (including root marking and root pointer updating). Drive-by: - Fix some issues uncovered by the test - Refactor the builtin constants R=mlippautz@chromium.org,ahaas@chromium.org Bug: v8:12191 Change-Id: I5b6381f9818166e2eabf80dd59135673dddb2afc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3310932Reviewed-by:
Andreas Haas <ahaas@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Cr-Commit-Position: refs/heads/main@{#78291}
-
JianxiaoLuIntel authored
Change-Id: Ic79f5829ae47cb4217d424aa6582f4686751ff1a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3299279 Auto-Submit: Jianxiao Lu <jianxiao.lu@intel.com> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#78287}
-
- 07 Dec, 2021 1 commit
-
-
Dominik Inführ authored
Concurrent marking got accidentally disabled because V8_ATOMIC_MARKING_STATE got removed. Bug: v8:12470, chromium:1277264, chromium:1277330, chromium:1277392 Bug: chromium:1277287, chromium:1277260, chromium:1277259 Bug: chromium:1277256, chromium:1277252, chromium:1277250 Bug: chromium:1277254, chromium:1277251 Change-Id: I21211e8f6d3a65714ba3204e87863b71af42d82d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3318663 Auto-Submit: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#78269}
-
- 06 Dec, 2021 2 commits
-
-
Shu-yu Guo authored
This is a reland of 3ee4804f. The CL was originally reverted for blink test failures. Since the revert, the blink top-level await flag has been removed. Original change's description: > [top-level-await] Remove --harmony-top-level-await > > TLA has been shipped since v8.9. > > Bug: v8:9344, chromium:1271114 > Change-Id: Ibebf21da8bacb1f0d212390133847495ad8553e5 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3307103 > Commit-Queue: Shu-yu Guo <syg@chromium.org> > Reviewed-by: Camillo Bruni <cbruni@chromium.org> > Reviewed-by: Marja Hölttä <marja@chromium.org> > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Cr-Commit-Position: refs/heads/main@{#78169} Bug: v8:9344, chromium:1271114 Change-Id: I96a9641967a23a12ba2467a69e5859ad8647f3e3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3318717 Commit-Queue: Shu-yu Guo <syg@chromium.org> Reviewed-by:
Adam Klein <adamk@chromium.org> Cr-Commit-Position: refs/heads/main@{#78261}
-
Clemens Backes authored
--dump-counters and --dump-counters-nvp are only functional in d8, thus they should be d8-only flags. R=mlippautz@chromium.org Bug: v8:12464 Change-Id: Ie3295990a1b4691ab95f8403ff6d9932543b03cd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3312275Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#78247}
-