Oopenharmony_ciCVE: 497404188
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
[api] Add tag parameter to Context::GetAlignedPointerFromEmbedderData Bug: 433909571 Change-Id: I51bc8d628fcecf21ff4fc6867bfdbc03fbe837cb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6964617 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/main@{#102690} | 9 个月前 | |
[sandbox][bigint] Use unsigned types for lengths/indices This brings code in src/bigint/ in line with our modern sandbox-aware coding style, where we prefer unsigned types for indices and lengths of on-heap objects. This CL is not expected to change behavior or performance. Bug: 425122195 Change-Id: Ie57937362de9c5a8e1913dfbb1244148896fc0a7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6662967 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#101002} | 1 年前 | |
translate Signed-off-by: huanghan18 <huanghan18@huawei.com> | 27 天前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
[temporal] Remove --harmony-temporal from non-Temporal tests In https://chromium-review.googlesource.com/c/v8/v8/+/7111926 I added --harmony-temporal to some tests to ensure they still pass with Temporal enabled. However, they are not Temporal tests; they should not be enabling this flag long term. Now that Temporal is unflagged (https://chromium-review.googlesource.com/c/v8/v8/+/7123876), this can be removed. Bug: 401065166 Change-Id: I00a7f7d585670bd0ddc10501931add682e803cfc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7124594 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Manish Goregaokar <manishearth@google.com> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103562} | 8 个月前 | |
[debug][wasm] Fix GDB remote server compilation errors Fix compilation errors and test failures in the GDB remote server stub when enabled through v8_enable_wasm_gdb_remote_debugging. The GDB remote server stub has been broken for a long time due to V8 API changes. This patch addresses multiple issues: - Fix type conversions from internal Isolate* to v8::Isolate* - Update Handle to DirectHandle for WasmInstanceObject and WasmTrustedInstanceData - Fix WasmModuleObject API calls (module() -> native_module()->module()) - Add Zone/AccountingAllocator for more efficient memory management - Update include headers for changed APIs - Fix unit tests to work with current V8 codebase This enables native debuggers like GDB and LLDB to attach to V8 and debug WebAssembly modules when the GDB remote debugging flag is enabled. Bug: 433881953 Change-Id: Ib2d728b0e954d8701076a2ff07e59336794ddf82 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6785387 Reviewed-by: Paolo Severini <paolosev@microsoft.com> Commit-Queue: Paolo Severini <paolosev@microsoft.com> Reviewed-by: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#101856} | 10 个月前 | |
[flags] Handle --proto-assign-seq-opt-count=0 We shouldn't run the optimization if the value is zero. Specifying a negative implication from that case to the feature flag will disable it if it isn't explicitly enabled. If it is, this will crash the process with a meaningful error message. This is a follow-up to https://crrev.com/c/7178541. Bug: 429332174 Change-Id: Ifa9f0720d6593b89b37f5408109327813159f19b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7204863 Auto-Submit: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Raphael Herouart <rherouart@chromium.org> Commit-Queue: Raphael Herouart <rherouart@chromium.org> Cr-Commit-Position: refs/heads/main@{#103979} | 7 个月前 | |
Support wasm interpreter in ohos Signed-off-by: diking <wangzhongqi5@huawei.com> | 27 天前 | |
[fuzzilli] Repair test/fuzzilli The builds were failing with "error: 'main' should not be 'extern "C"'" Drive-By: update libreprl to the latest version. Change-Id: I9f80f24b5456e90bcfa377a462355b2fde58323b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5832026 Reviewed-by: Stephen Röttger <sroettger@google.com> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#95915} | 1 年前 | |
CVE:516311623 Signed-off-by: jiang-qunchao <jiangqunchao@huawei.com> | 13 天前 | |
[icu] Fix LookupAndValidateUnicodeExtensions() for ICU 77 ICU 77 getKeywordValue() changed to return U_STRING_NOT_TERMINATED_WARNING when the value is exactly the same size as the given buffer size. In this case, the buffer is not null-terminated[1]. This patch fixes LookupAndValidateUnicodeExtensions() for this change. [1] https://unicode-org.github.io/icu/userguide/strings/#using-c-strings-nul-terminated-vs-length-parameters Bug: 458186954 Change-Id: Iaff890f93cc392d4deb71ab881ab4bcce97f5b34 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7137918 Auto-Submit: Koji Ishii <kojii@chromium.org> Commit-Queue: Jakob Linke <jgruber@chromium.org> Reviewed-by: Jakob Linke <jgruber@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103662} | 7 个月前 | |
[for-of-performance] Update bytecode expectations test This Cl aslo removes max-opt flag in perf test, because the improvement has been added to all layers of the compiler. Bug: 408061015 Change-Id: If3364d52908ad0a4ae464b62cbaca5d8a102412a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6991029 Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102834} | 9 个月前 | |
[snapshot] Add RO deserialization time graph .. and split it out from the isolate deserialization time graph. Previously, the DeserializationTimeIsolate metric measured everything inside Isolate::Init, i.e. RO deserialization, isolate deserialization, and various isolate setup code. With this change, DeserializationTimeIsolate measures only isolate deserialization, and DeserializationTimeReadOnly measures only RO space deserialization. Bug: v8:13789 Change-Id: I83762fa34b46c8cd6819f309f845b6b0dcedcde8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4840339 Auto-Submit: Jakob Linke <jgruber@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89808} | 2 年前 | |
Support wasm interpreter in ohos Signed-off-by: diking <wangzhongqi5@huawei.com> | 27 天前 | |
CVE: 497404188 Signed-off-by: jiang-qunchao <jiangqunchao@huawei.com> | 6 天前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
[test] Skip flaky test Flakes due to brittle time measurements of array truncation. Bug: 426431989 Change-Id: I90cb295fd568e7e67d8b6caf63e49c32173b7745 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6652838 Commit-Queue: Igor Sheludko <ishell@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/main@{#100923} | 1 年前 | |
[top-level-await] align async modules rejection and fulfillment order This implements the spec change from [1]. This PR changes the order of rejections to match the same order that happens on fufillment case. It meansd that First the rejection goes to module where it happens and then it bubbles up to its acenstros. For detailed discussion and reasoning, check links in the PR[1]. [1] Spec PR: https://github.com/tc39/ecma262/pull/3695 [2] Test262 PR: https://github.com/tc39/test262/pull/4591 Bug: 433891576 Change-Id: I3b16e276ad0d6bd0c5a17f20f8db06d56b483883 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7169324 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Andy Wingo <wingo@igalia.com> Reviewed-by: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#104017} | 7 个月前 | |
[runtime] Allow Cell to contain weak values The Cell has got two groups for accessors - maybe_value and value. The former is for accessing MaybeObject value and the latter is for use cases when it's known that the value is not weak. This CL makes the cleared weak reference a value indicating a valid prototype validity cell value. This is a preparation for storing weak references in valid prototype validity cells. Bug: 424154602 Change-Id: I6acacc95769a922b399dd7dafd4e4d13e19f9e00 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6641901 Reviewed-by: Patrick Thier <pthier@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#100828} | 1 年前 | |
[ArkWeb][安全][自动提交] 修复 Chromium issue 511228272: Reland "[scanner] Fix integer overflow in LiteralBuffer and guard stream limi… Signed-off-by: ringking <renkang2@huawei.com> | 13 天前 | |
Reland "Update V8 DEPS (trusted)" This temporarily skips the wasm-api-tests target on win-arm until https://crbug.com/445649941 is resolved. This is a reland of commit a3982f7a66ceb41ac9da4a85ff9e93eaabe47088 Original change's description: > Update V8 DEPS (trusted) > > Rolling build: https://chromium.googlesource.com/chromium/src/build/+log/1de7ce9..298617b > > Rolling buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/958004d..19bc370 > > Rolling buildtools/reclient: re_client_version:0.179.0.28341fc7-gomaip..re_client_version:0.183.0.3b3097cd-gomaip > > Rolling third_party/abseil-cpp: https://chromium.googlesource.com/chromium/src/third_party/abseil-cpp/+log/9d692d6..47b1fee > > Rolling third_party/catapult: https://chromium.googlesource.com/catapult/+log/375b4c2..0a50a85 > > Rolling third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/3598216..c932af8 > > Rolling third_party/libc++/src: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx/+log/0257666..7b8dc07 > > Rolling third_party/llvm-libc/src: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc/+log/06a10da..f2fc757 > > Rolling third_party/partition_alloc: https://chromium.googlesource.com/chromium/src/base/allocator/partition_allocator/+log/bb86434..2c06e4c > > Roll created at https://cr-buildbucket.appspot.com/build/8703481235607377441 > > Change-Id: If170d629686808098ba3659648eedefb35b341e2 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6958753 > Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> > Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> > Cr-Commit-Position: refs/heads/main@{#102550} Bug: 445649941 Change-Id: I0b538464fdcbf541e6e62c11f1103e4ba088b59e Cq-Include-Trybots: luci.v8.try:v8_win_arm64_compile_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6964614 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Auto-Submit: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/main@{#102616} | 9 个月前 | |
[wasm-custom-desc] Import spec tests Update update-wasm-spec-tests.sh to pull tests from the custom-descriptors proposal repo. Add failing tests and reasons to wasm-spec-tests.status. Bug: 403372470 Change-Id: I41c9ca8a2a89edeebfcc3a27e093658227c5e399 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7076309 Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#103310} | 8 个月前 | |
Support wasm interpreter in ohos Signed-off-by: diking <wangzhongqi5@huawei.com> | 27 天前 | |
[test] Skip failing test No-Try: true Bug: 447172713 Change-Id: I26b3456fa00bb8d6c322ea65fbe7d5df48b8ae22 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6979453 Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Auto-Submit: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/main@{#102745} | 9 个月前 | |
Reland "Update V8 DEPS (trusted)" This temporarily skips the wasm-api-tests target on win-arm until https://crbug.com/445649941 is resolved. This is a reland of commit a3982f7a66ceb41ac9da4a85ff9e93eaabe47088 Original change's description: > Update V8 DEPS (trusted) > > Rolling build: https://chromium.googlesource.com/chromium/src/build/+log/1de7ce9..298617b > > Rolling buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/958004d..19bc370 > > Rolling buildtools/reclient: re_client_version:0.179.0.28341fc7-gomaip..re_client_version:0.183.0.3b3097cd-gomaip > > Rolling third_party/abseil-cpp: https://chromium.googlesource.com/chromium/src/third_party/abseil-cpp/+log/9d692d6..47b1fee > > Rolling third_party/catapult: https://chromium.googlesource.com/catapult/+log/375b4c2..0a50a85 > > Rolling third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/3598216..c932af8 > > Rolling third_party/libc++/src: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx/+log/0257666..7b8dc07 > > Rolling third_party/llvm-libc/src: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc/+log/06a10da..f2fc757 > > Rolling third_party/partition_alloc: https://chromium.googlesource.com/chromium/src/base/allocator/partition_allocator/+log/bb86434..2c06e4c > > Roll created at https://cr-buildbucket.appspot.com/build/8703481235607377441 > > Change-Id: If170d629686808098ba3659648eedefb35b341e2 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6958753 > Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> > Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> > Cr-Commit-Position: refs/heads/main@{#102550} Bug: 445649941 Change-Id: I0b538464fdcbf541e6e62c11f1103e4ba088b59e Cq-Include-Trybots: luci.v8.try:v8_win_arm64_compile_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6964614 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Auto-Submit: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/main@{#102616} | 9 个月前 | |
[perf] Increase timeouts for JSTests2 › Array The test is running near the timeout threshold and regularly raises an alert. We increase the value by 20s as this is an expected test duration. Additionally, this change adds the infra team to the OWNERS of the test directory as it includes various infrastructure configurations. Bug: chromium:1414089 Change-Id: I322b4596031aaf2eac51ef1c583e1f4fedb05287 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4236124 Commit-Queue: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Michael Achenbach <machenbach@chromium.org> Auto-Submit: Alexander Schulze <alexschulze@chromium.org> Cr-Commit-Position: refs/heads/main@{#85752} | 3 年前 |