- 06 Apr, 2022 2 commits
-
-
Leszek Swirski authored
This reverts commit 8ba60b7a. Reason for revert: code_serializer failures: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20debug/38940/overview Original change's description: > [string] Non-transitioning shared strings > > Instead of transitioning shared strings to ThinString on > internalization, use a forwarding table to the internalized string and > store the index into the forwarding table in the string's hash field. > > This way we don't need to handle concurrent string transitions that > modify the underlying string data. > > During stop-the-world GC, live strings in the forwarding table are > migrated to regular ThinStrings. > > Bug: v8:12007 > Change-Id: I6c6f3d41c6f644e0aaeafbf25ecec5ce0aa0d2d8 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3536647 > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> > Reviewed-by: Jakob Linke <jgruber@chromium.org> > Reviewed-by: Shu-yu Guo <syg@chromium.org> > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Commit-Queue: Patrick Thier <pthier@chromium.org> > Cr-Commit-Position: refs/heads/main@{#79801} Bug: v8:12007 Change-Id: I740904f3edfc395331f06c7218e89476b06b0563 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3574543 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Owners-Override: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#79810}
-
Patrick Thier authored
Instead of transitioning shared strings to ThinString on internalization, use a forwarding table to the internalized string and store the index into the forwarding table in the string's hash field. This way we don't need to handle concurrent string transitions that modify the underlying string data. During stop-the-world GC, live strings in the forwarding table are migrated to regular ThinStrings. Bug: v8:12007 Change-Id: I6c6f3d41c6f644e0aaeafbf25ecec5ce0aa0d2d8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3536647Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Jakob Linke <jgruber@chromium.org> Reviewed-by: Shu-yu Guo <syg@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#79801}
-
- 23 Feb, 2022 1 commit
-
-
Shu-yu Guo authored
This is a reland of 1025bf26 Changes since revert: - TSAN issue fixed by https://crrev.com/c/3475084 - Skip the shared-struct-workers test until shared GC deadlock is fixed, being tracked in v8:12645 Original change's description: > [shared-struct] Prototype JS shared structs > > Unlike the Stage 1 proposal, for simplicity the prototype does not add > any new syntax, instead opting for exposing a SharedStructType > constructor which takes an array of field names. This type constructor > returns constructors for shared structs. > > Shared structs can be shared across Isolates, are fixed layout, have no > prototype, have no .constructor, and can only store primitives and > other shared structs. > > The initial prototype does not have TurboFan support. > > Bug: v8:12547 > Change-Id: I23bdd819940b42139692bcdb53d372099b0d4426 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3390643 > Reviewed-by: Tobias Tebbi <tebbi@chromium.org> > Reviewed-by: Marja Hölttä <marja@chromium.org> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> > Commit-Queue: Shu-yu Guo <syg@chromium.org> > Cr-Commit-Position: refs/heads/main@{#79156} Bug: v8:12547 Change-Id: Ic1f5cf9fa9791ae2d5d5dc7c110614ca10b5d98e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3475078Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Marja Hölttä <marja@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#79215}
-
- 18 Feb, 2022 1 commit
-
-
Michael Achenbach authored
This reverts commit 1025bf26. Reason for revert: https://crbug.com/v8/12645 Original change's description: > [shared-struct] Prototype JS shared structs > > Unlike the Stage 1 proposal, for simplicity the prototype does not add > any new syntax, instead opting for exposing a SharedStructType > constructor which takes an array of field names. This type constructor > returns constructors for shared structs. > > Shared structs can be shared across Isolates, are fixed layout, have no > prototype, have no .constructor, and can only store primitives and > other shared structs. > > The initial prototype does not have TurboFan support. > > Bug: v8:12547 > Change-Id: I23bdd819940b42139692bcdb53d372099b0d4426 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3390643 > Reviewed-by: Tobias Tebbi <tebbi@chromium.org> > Reviewed-by: Marja Hölttä <marja@chromium.org> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> > Commit-Queue: Shu-yu Guo <syg@chromium.org> > Cr-Commit-Position: refs/heads/main@{#79156} Bug: v8:12547 Change-Id: I44f2b8bb7487b4d39ba1282585e0b2282501230f No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3474676 Auto-Submit: Michael Achenbach <machenbach@chromium.org> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Owners-Override: Michael Achenbach <machenbach@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/main@{#79170}
-
- 17 Feb, 2022 1 commit
-
-
Shu-yu Guo authored
Unlike the Stage 1 proposal, for simplicity the prototype does not add any new syntax, instead opting for exposing a SharedStructType constructor which takes an array of field names. This type constructor returns constructors for shared structs. Shared structs can be shared across Isolates, are fixed layout, have no prototype, have no .constructor, and can only store primitives and other shared structs. The initial prototype does not have TurboFan support. Bug: v8:12547 Change-Id: I23bdd819940b42139692bcdb53d372099b0d4426 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3390643Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Marja Hölttä <marja@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#79156}
-
- 20 Jan, 2022 1 commit
-
-
Samuel Groß authored
The external pointer table is now managed by the GC, which marks entries that are alive during major GC, then sweeps the table afterwards to free all dead entries and build a free list from them. For now, only major GCs are supported, Scavenger GCs do not interact with the external pointer table. In more detail, garbage collection of the external pointer table works as follows: 1. The external pointer table now reserves a large region of virtual address space for its backing buffer and is then never reallocated, only grown in place until the maximum size is reached. 2. When the GC's marking visitor marks a HeapObject with an external pointer as alive, it also marks the corresponding external pointer table entry as alive. This can happen on a background thread. 3. For that, it uses the MSB of each entry in the table to indicate whether the entry has been marked or not. This works because the MSB is always cleared during the AND-based type check performed when accessing an external pointer. 4. After marking, the external pointer table is swept while the mutator is stopped. This builds an inline, singly-linked freelist of all newly-dead and previously-free entries. 5. When allocating an entry from the table, the first entry on the freelist is used. If the freelist is empty, the table grows, populating the freelist with the new entries. 6. Every newly-allocated entry is marked as alive, and every store to an existing entry also automatically marks that entry as alive (by also setting the MSB). This simplifies the design of the table GC with regards to concurrency (See ExternalPointerTable::Mark). Bug: v8:10391 Change-Id: I8877fdf5576af3761bde65298951bb09e601bd14 Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3359625Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Maya Lekova <mslekova@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#78708}
-
- 17 Jan, 2022 1 commit
-
-
Andreas Haas authored
The wpt test external/wpt/wasm/jsapi/functions/entry.html failed because the current context was entered when executing the start function instead of the native context. The test crashed because in GetEnteredOrMicrotaskContext a NativeContext is expected. Bug: chromium:1098844 Change-Id: I52d50986c67a0a69c8d9e03756592dff670f83df Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3368107Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/main@{#78652}
-
- 04 Jan, 2022 1 commit
-
-
Clemens Backes authored
For low-cost exception handling, it's important to be able to quickly drop frames from the stack until reaching the exception handler. The Intel shadow stack offers an instruction to avoid offending stack discipline, incsspq, which drops N values from the stack. This CL integrates that instruction for v8 exception handling. Bug: v8:11246 Change-Id: I908f0ab8bb3de6c36e6078e27b65132287328f2d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3289637Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#78469}
-
- 16 Dec, 2021 1 commit
-
-
Igor Sheludko authored
This CL * removes Builtins::codet() and Builtins::codet_handle() returning builtins as CodeT objects in favor of code() and code_handle(), * removes BUILTIN_CODET macro in favor of BUILTIN_CODE, * removes CodeDataContainer table. Bug: v8:11880 Change-Id: Ic868549030744b0ff3ea5d5edbfcacf77c6de96d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3344650Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#78399}
-
- 15 Dec, 2021 1 commit
-
-
Samuel Groß authored
This CL renames a number of things related to the V8 sandbox. Mainly, what used to be under V8_HEAP_SANDBOX is now under V8_SANDBOXED_EXTERNAL_POINTERS, while the previous V8 VirtualMemoryCage is now simply the V8 Sandbox: V8_VIRTUAL_MEMORY_CAGE => V8_SANDBOX V8_HEAP_SANDBOX => V8_SANDBOXED_EXTERNAL_POINTERS V8_CAGED_POINTERS => V8_SANDBOXED_POINTERS V8VirtualMemoryCage => Sandbox CagedPointer => SandboxedPointer fake cage => partially reserved sandbox src/security => src/sandbox This naming scheme should simplify things: the sandbox is now the large region of virtual address space inside which V8 mainly operates and which should be considered untrusted. Mechanisms like sandboxed pointers are then used to attempt to prevent escapes from the sandbox (i.e. corruption of memory outside of it). Furthermore, the new naming scheme avoids the confusion with the various other "cages" in V8, in particular, the VirtualMemoryCage class, by dropping that name entirely. Future sandbox features are developed under their own V8_SANDBOX_X flag, and will, once final, be merged into V8_SANDBOX. Current future features are sandboxed external pointers (using the external pointer table), and sandboxed pointers (pointers guaranteed to point into the sandbox, e.g. because they are encoded as offsets). This CL then also introduces a new build flag, v8_enable_sandbox_future, which enables all future features. Bug: v8:10391 Change-Id: I5174ea8f5ab40fb96a04af10853da735ad775c96 Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3322981Reviewed-by: Hannes Payer <hpayer@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#78384}
-
- 02 Dec, 2021 1 commit
-
-
Samuel Groß authored
This CL turns references to ArrayBuffer backing stores from JSArrayBuffers, JSTypedArrays, and JSDataViews into CagedPointers when those are enabled. CagedPointers cannot generally represent nullptr, as NULL usually lies outside the cage. As such, nullptr backing stores are replaced with a special empty backing store value, which, in the current implementation, points to the end of the cage, right in front of the trailing guard regions. Due to this, it is no longer correct to compare a backing store pointer against nullptr. Bug: chromium:1218005 Change-Id: I4a6c7a82aabb4debcb6bb2babe4035ba2da8e79f Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3244419 Commit-Queue: Samuel Groß <saelo@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#78218}
-
- 24 Nov, 2021 1 commit
-
-
Maya Lekova authored
This is a reland of d7c3f1cd. It fixes a build failure on native arm64. Original change's description: > Reland "[fastcall] Enable float support on arm64 simulator" > > This is a reland of b9ddcbc8 > > The original CL was reverted due to an MSAN issue, that is fixed by > moving the signature mapping onto the Isolate (instead of having > per-thread storage, which got invalid on multithreaded compilation). > > This CL also contains fixes for the Bazel config and for a data race > when obtaining the PerIsolateSimulatorData. > > Original change's description: > > [fastcall] Enable float support on arm64 simulator > > > > This CL adds support for handling calls to C functions with arbitrary > > signatures on the arm64 simulator. It adds infrastructure for > > encoding the signature data from CallDescriptor and FunctionInfo > > classes into a compact representation, stored in the simulator and > > called EncodedCSignature. > > > > Design doc: > > https://docs.google.com/document/d/1ZxOF3GSyNmtU0C0YJvrsydPJj35W_tTJZymeXwfDxoI/edit > > > > This CL is a follow up on the native support added in > > https://chromium-review.googlesource.com/c/v8/v8/+/3182232 > > and is partially based on the previous attempt: > > https://chromium-review.googlesource.com/c/v8/v8/+/2343072 > > > > Bug: chromium:1052746 > > Change-Id: I0991b47bd644b2fc2244c5eb923b085261f04765 > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3060486 > > Commit-Queue: Maya Lekova <mslekova@chromium.org> > > Reviewed-by: Camillo Bruni <cbruni@chromium.org> > > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#77744} > > Bug: chromium:1052746, chromium:1267854 > Change-Id: I89bbd01e33fb1080543d98bcfd4c2d17b5c76861 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3270541 > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Reviewed-by: Camillo Bruni <cbruni@chromium.org> > Commit-Queue: Maya Lekova <mslekova@chromium.org> > Cr-Commit-Position: refs/heads/main@{#78018} Bug: chromium:1052746, chromium:1267854 Change-Id: Ib495573569a6c930b8f9e5f1fe7ff46eb57a0aa7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3295461 Auto-Submit: Maya Lekova <mslekova@chromium.org> Commit-Queue: Camillo Bruni <cbruni@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/main@{#78063}
-
- 23 Nov, 2021 2 commits
-
-
Marja Hölttä authored
Previous version: https://chromium-review.googlesource.com/c/v8/v8/+/3259648 Fix 1: ValueSerializer <3 JSArrayBufferView Fix 2: set flags correctly when creating DataViews via the API Bug: v8:11111 Change-Id: I9cbfdaff29f97c7823eaa3d931689b363e1f4cf7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3297708Reviewed-by: Marja Hölttä <marja@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/main@{#78046}
-
Marja Hölttä authored
This reverts commit 8f3e53b8. Reason for revert: Blink test failures Original change's description: > [rab/gsab] Add RAB / GSAB support to DataViews > > Bug: v8:11111 > Change-Id: Ice66accee734484302d499b8098056ae1c68faf3 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3259648 > Commit-Queue: Marja Hölttä <marja@chromium.org> > Reviewed-by: Shu-yu Guo <syg@chromium.org> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> > Cr-Commit-Position: refs/heads/main@{#78028} Bug: v8:11111 Change-Id: Icaae7276dfede8c021f3ce1a7e96ed3ec13fe4fe No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3295577 Auto-Submit: Marja Hölttä <marja@chromium.org> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Marja Hölttä <marja@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#78039}
-
- 22 Nov, 2021 3 commits
-
-
Marja Hölttä authored
Bug: v8:11111 Change-Id: Ice66accee734484302d499b8098056ae1c68faf3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3259648 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by: Shu-yu Guo <syg@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#78028}
-
Nico Hartmann authored
This reverts commit d7c3f1cd. Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Android%20Arm64%20-%20debug%20builder/22043/overview Original change's description: > Reland "[fastcall] Enable float support on arm64 simulator" > > This is a reland of b9ddcbc8 > > The original CL was reverted due to an MSAN issue, that is fixed by > moving the signature mapping onto the Isolate (instead of having > per-thread storage, which got invalid on multithreaded compilation). > > This CL also contains fixes for the Bazel config and for a data race > when obtaining the PerIsolateSimulatorData. > > Original change's description: > > [fastcall] Enable float support on arm64 simulator > > > > This CL adds support for handling calls to C functions with arbitrary > > signatures on the arm64 simulator. It adds infrastructure for > > encoding the signature data from CallDescriptor and FunctionInfo > > classes into a compact representation, stored in the simulator and > > called EncodedCSignature. > > > > Design doc: > > https://docs.google.com/document/d/1ZxOF3GSyNmtU0C0YJvrsydPJj35W_tTJZymeXwfDxoI/edit > > > > This CL is a follow up on the native support added in > > https://chromium-review.googlesource.com/c/v8/v8/+/3182232 > > and is partially based on the previous attempt: > > https://chromium-review.googlesource.com/c/v8/v8/+/2343072 > > > > Bug: chromium:1052746 > > Change-Id: I0991b47bd644b2fc2244c5eb923b085261f04765 > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3060486 > > Commit-Queue: Maya Lekova <mslekova@chromium.org> > > Reviewed-by: Camillo Bruni <cbruni@chromium.org> > > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#77744} > > Bug: chromium:1052746, chromium:1267854 > Change-Id: I89bbd01e33fb1080543d98bcfd4c2d17b5c76861 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3270541 > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Reviewed-by: Camillo Bruni <cbruni@chromium.org> > Commit-Queue: Maya Lekova <mslekova@chromium.org> > Cr-Commit-Position: refs/heads/main@{#78018} Bug: chromium:1052746, chromium:1267854 Change-Id: Ia8f10d085d13990b331f306957f95ecf3e003cfd No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3295453 Owners-Override: Nico Hartmann <nicohartmann@chromium.org> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#78019}
-
Maya Lekova authored
This is a reland of b9ddcbc8 The original CL was reverted due to an MSAN issue, that is fixed by moving the signature mapping onto the Isolate (instead of having per-thread storage, which got invalid on multithreaded compilation). This CL also contains fixes for the Bazel config and for a data race when obtaining the PerIsolateSimulatorData. Original change's description: > [fastcall] Enable float support on arm64 simulator > > This CL adds support for handling calls to C functions with arbitrary > signatures on the arm64 simulator. It adds infrastructure for > encoding the signature data from CallDescriptor and FunctionInfo > classes into a compact representation, stored in the simulator and > called EncodedCSignature. > > Design doc: > https://docs.google.com/document/d/1ZxOF3GSyNmtU0C0YJvrsydPJj35W_tTJZymeXwfDxoI/edit > > This CL is a follow up on the native support added in > https://chromium-review.googlesource.com/c/v8/v8/+/3182232 > and is partially based on the previous attempt: > https://chromium-review.googlesource.com/c/v8/v8/+/2343072 > > Bug: chromium:1052746 > Change-Id: I0991b47bd644b2fc2244c5eb923b085261f04765 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3060486 > Commit-Queue: Maya Lekova <mslekova@chromium.org> > Reviewed-by: Camillo Bruni <cbruni@chromium.org> > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Cr-Commit-Position: refs/heads/main@{#77744} Bug: chromium:1052746, chromium:1267854 Change-Id: I89bbd01e33fb1080543d98bcfd4c2d17b5c76861 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3270541Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Commit-Queue: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/main@{#78018}
-
- 17 Nov, 2021 1 commit
-
-
Tobias Tebbi authored
This fast path works for ASCII-only strings and is similar to the existing fast-path in C++. Important differences: - The locale check is done at Turbofan optimization time instead of at runtime - Use tables of size 256 instead of 128 to save a bounds-check when handling one-byte strings. - It first performs an equality check that's optimized for detecting inequality quickly by comparing the strings from both ends. If the equality check succeeds, we are done. Otherwise chances are high that the strings differ according to collation level L1 already. Therefore, we first do an L1 check and perform the L3 check only when L1 didn't find a difference. This is based on the assumption that few strings are identical except for different capitalization. - Use the Torque version of string flattening instead of the runtime version. Bug: v8:12196 Change-Id: I2d043c1138846783f6d567b736d34063ba9301e5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3268465Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/main@{#77946}
-
- 09 Nov, 2021 1 commit
-
-
Maya Lekova authored
This reverts commit b9ddcbc8. Reason for revert: Hits unreachable on MSAN, see https://bugs.chromium.org/p/chromium/issues/detail?id=1267854 Original change's description: > [fastcall] Enable float support on arm64 simulator > > This CL adds support for handling calls to C functions with arbitrary > signatures on the arm64 simulator. It adds infrastructure for > encoding the signature data from CallDescriptor and FunctionInfo > classes into a compact representation, stored in the simulator and > called EncodedCSignature. > > Design doc: > https://docs.google.com/document/d/1ZxOF3GSyNmtU0C0YJvrsydPJj35W_tTJZymeXwfDxoI/edit > > This CL is a follow up on the native support added in > https://chromium-review.googlesource.com/c/v8/v8/+/3182232 > and is partially based on the previous attempt: > https://chromium-review.googlesource.com/c/v8/v8/+/2343072 > > Bug: chromium:1052746 > Change-Id: I0991b47bd644b2fc2244c5eb923b085261f04765 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3060486 > Commit-Queue: Maya Lekova <mslekova@chromium.org> > Reviewed-by: Camillo Bruni <cbruni@chromium.org> > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Cr-Commit-Position: refs/heads/main@{#77744} Bug: chromium:1052746, chromium:1267854, chromium:1267841 Change-Id: If3d5aaab6b5f4309ce90add614d674aaa86b43c7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3268910 Commit-Queue: Maya Lekova <mslekova@chromium.org> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#77788}
-
- 08 Nov, 2021 1 commit
-
-
Maya Lekova authored
This CL fixes a null dereference when an attempt is made to access the current arm64 simulator from a background thread. Bug: chromium:1267491 Change-Id: I9232fe134fccbff162eb5076aff20884872e4cc7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3264219 Auto-Submit: Maya Lekova <mslekova@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#77757}
-
- 05 Nov, 2021 1 commit
-
-
Maya Lekova authored
This CL adds support for handling calls to C functions with arbitrary signatures on the arm64 simulator. It adds infrastructure for encoding the signature data from CallDescriptor and FunctionInfo classes into a compact representation, stored in the simulator and called EncodedCSignature. Design doc: https://docs.google.com/document/d/1ZxOF3GSyNmtU0C0YJvrsydPJj35W_tTJZymeXwfDxoI/edit This CL is a follow up on the native support added in https://chromium-review.googlesource.com/c/v8/v8/+/3182232 and is partially based on the previous attempt: https://chromium-review.googlesource.com/c/v8/v8/+/2343072 Bug: chromium:1052746 Change-Id: I0991b47bd644b2fc2244c5eb923b085261f04765 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3060486 Commit-Queue: Maya Lekova <mslekova@chromium.org> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#77744}
-
- 03 Nov, 2021 1 commit
-
-
Igor Sheludko authored
Bug: v8:11880 Change-Id: Iffebca251d18d5637884b2181acdfb3e6c5496a0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3257715Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#77682}
-
- 29 Oct, 2021 1 commit
-
-
Samuel Groß authored
A CagedPointer is guaranteed to point into the Virtual Memory Cage and will for example be used for ArrayBuffer backing stores when the heap sandbox is enabled. In the current implementation, CagedPointers are stored as offsets from the cage base, shifted to the left. Because the cage base address is usually available in a register, accessing a CagedPointer is very efficient, requiring only an additional shift and add operation. Bug: chromium:1218005 Change-Id: Ifc8c088e3862400672051a8c52840514dee2911f Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3123417Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#77614}
-
- 27 Oct, 2021 1 commit
-
-
Igor Sheludko authored
... to Builtins class. Bug: v8:12244, v8:11880 Change-Id: Ia96e476b904618b5fc45d2e401cedc2f67e36e7d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3245346Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#77571}
-
- 19 Oct, 2021 1 commit
-
-
Jakob Gruber authored
Large character classes may easily be created when unicode properties (e.g.: /\p{L}/u and /\P{L}/u) are used - these are expanded internally into character classes that consist of hundreds of character ranges. Previously to this CL, we'd emit branching code for each of these ranges, leading to very large regexp code objects. This CL adds a new codegen mode for large character classes (where 'large' currently means > 16 ranges). Instead of emitting branching code inline, the ranges are written into a ByteArray and we call into the C function IsCharacterInRangeArray for the actual branching logic. The ByteArray is smaller than emitted code and is deduplicated if the same character class is matched repeatedly in the same pattern. Note this mode is *not* implemented for the interpreter, since we currently don't have a constant pool for irregexp bytecode, and thus cannot reference ByteArrays. Bug: v8:11069 Change-Id: I2d728e42d85114b796c637f791848731a104cd54 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3229377Reviewed-by: Patrick Thier <pthier@chromium.org> Auto-Submit: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#77463}
-
- 11 Oct, 2021 1 commit
-
-
Jakob Gruber authored
No functional changes. - Removed unused Isolate* argument from regexp extrefs. - Added const where possible. - Removed unused functions. - Shuffled declarations for better readability. - ... Change-Id: I6d9093052e8de4e33e9411541a691d0bab7b20c9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3217193 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Auto-Submit: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#77316}
-
- 01 Oct, 2021 1 commit
-
-
Maya Lekova authored
This CL adds support for handling calls to C functions with arbitrary signatures on native arm64. It introduces a new ExternalReference type FAST_C_CALL. The CL also splits the 10 bits used by kArchCallCFunction instruction to store the total number of parameters into two 5-bit values, representing the number of general purpose and floating point parameters. Design doc: https://docs.google.com/document/d/1ZxOF3GSyNmtU0C0YJvrsydPJj35W_tTJZymeXwfDxoI/edit This CL is partially based on the previous attempt: https://chromium-review.googlesource.com/c/v8/v8/+/2343072 Bug: chromium:1052746 Change-Id: Ib508626d57da26ec3c9186ee8fc46356e3c87f3a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3182232Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/main@{#77198}
-
- 23 Sep, 2021 1 commit
-
-
Jakob Gruber authored
.. by reusing the regexp stack from potentially multiple nested irregexp activations. To do this, we now maintain a stack pointer in RegExpStack. This stack pointer is synchronized at all boundaries between generated irregexp code and the outside world, i.e. when entering or returning from irregexp code, and when calling into C functions such as GrowStack. Fixed: v8:11382 Change-Id: I5ed27630c1a64ebf3afb9ddf80fb60ea067c0c40 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162604Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Auto-Submit: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#77013}
-
- 15 Sep, 2021 1 commit
-
-
Leszek Swirski authored
Change-Id: I14400c0efea88b4bbb40aa2fbe9527dc9c67d3fb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3160340 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#76837}
-
- 14 Sep, 2021 1 commit
-
-
Leszek Swirski authored
CopyChars takes a count parameter, not an end parameter, so we can save some subtractions by passing in the count to WriteToFlat. Most of the time the start,end arguments into WriteToFlat are 0,length anyway, so this doesn't change a lot of places. Change-Id: I9587c7afce529218a16b728c0477b87569df8e21 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3157947Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#76813}
-
- 07 Sep, 2021 1 commit
-
-
Ng Zhi An authored
Bug: v8:12094 Change-Id: Ibefce881cbfcd4445485197a4a2615bdf0599ada Fixed: v8:12094 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3123638 Commit-Queue: Zhi An Ng <zhin@chromium.org> Reviewed-by: Deepti Gandluri <gdeepti@chromium.org> Cr-Commit-Position: refs/heads/main@{#76706}
-
- 03 Sep, 2021 1 commit
-
-
Manos Koukoutos authored
We use BuildCCall over CallBuiltin. This improves the performance of array.copy by up to 2x for small arrays. Bug: v8:7748 Change-Id: Ibbd6a69267edb229beda1f6de4ff1c48eb38b729 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3135580 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#76661}
-
- 01 Sep, 2021 1 commit
-
-
Shu-yu Guo authored
This CL does the following for x64: - Add seq cst TSAN helpers. - Refactors codegen's handling of TSAN helpers to also support seq cst accesses. - Perform stores only once instead twice under TSAN, since duplicating stores is unsound. Previously this was "fine" because all duplicated stores were relaxed. SeqCst stores are used for synchronization, however, and duplicating them breaks the synchronization. Bug: v8:7790, v8:11600, v8:11995 Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng Change-Id: I43071b0ed516cb0917a10f3b2b9861d74edca041 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3103308 Commit-Queue: Shu-yu Guo <syg@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Reviewed-by: Adam Klein <adamk@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#76612}
-
- 16 Aug, 2021 1 commit
-
-
Yu Yin authored
Bug: v8:12008 Change-Id: I2e1d918a1370dae1e15919fbf02d69cbe48f63bf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3089095Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Hannes Payer <hpayer@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#76308}
-
- 10 Aug, 2021 1 commit
-
-
Victor Gomes authored
This is useful to guarantee that the compiler can be run off-thread. - Changes BaselineCompiler isolate_ private member type. - Constructor still depends on Isolate, since it needs to construct a MacroAssembler reference. Bug: v8:12054 Change-Id: Ie7d18b8eb2d0b81a05713ce48d117f92796f2cde Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3085276 Commit-Queue: Victor Gomes <victorgomes@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#76204}
-
- 04 Aug, 2021 1 commit
-
-
Leszek Swirski authored
Bug: chromium:1232620 Change-Id: Ie19fe8839966a1abb3d0a01fee1fb4b105fb6bf1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3070702 Commit-Queue: Clemens Backes <clemensb@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#76085}
-
- 22 Jul, 2021 2 commits
-
-
Camillo Bruni authored
* Avoid accessing thread_local_top directly and use getters: - scheduled_exception - pending_exception - pending_message * Rename pending_message_obj to pending_message Bug: chromium:1014421 Change-Id: I080b7d5919e180a943776c79ee9321235d58d3c7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3010278Reviewed-by: Mythri Alle <mythria@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#75864}
-
Shu-yu Guo authored
RegExp match indices have shipped since M90 Bug: v8:9548 Change-Id: I8bf54ce1a50b5079aad71140f75c979a09aae5bb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3042842 Auto-Submit: Shu-yu Guo <syg@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#75848}
-
- 07 Jul, 2021 1 commit
-
-
Dan Elphick authored
To avoid external-reference.cc having to depend on code-assembler.h, this moves ObjectType and CheckObjectType into a separate objects/object-type.h/.cc. Bug: v8:11879 Change-Id: Ia086b37f72c330eefef2ce4d35cdf31d2a0ebe62 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3009220 Commit-Queue: Dan Elphick <delphick@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#75599}
-
- 28 Jun, 2021 1 commit
-
-
Maya Lekova authored
This CL implements setting the javascript_execution_assert on the isolate from generated code, so we don't need to create an expensive class in the embedder callback. Bug: chromium:1218898 Change-Id: Ia05b49281ab4c1cc3ac34caf2dfadb79feb86e84 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2982998 Commit-Queue: Maya Lekova <mslekova@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#75414}
-