| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
TicketNo:DTS2026040312077;DTS2026040207037;DTS2026040207036;DTS2026040135724;DTS2026040135722;DTS2026032818442;DTS2026032530470;DTS2026032530464;DTS2026031327981;DTS2026031222703;DTS2026031222694;DTS2026031222686;DTS2026031222671;DTS2026031222662;DTS2026031222654 Description:【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Team:v8 Feature or Bugfix:Bugfix Binary Source:No PrivateCode(Yes/No):No Change-Id: Iae84c8fcc36a25b1936ec0997008368f70096cd6 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/534 Merged-by: public pjenkins Signed-off-by: Marja Hölttä <marja@chromium.org> | 1 个月前 | |
TicketNo:DTS2026040312077;DTS2026040207037;DTS2026040207036;DTS2026040135724;DTS2026040135722;DTS2026032818442;DTS2026032530470;DTS2026032530464;DTS2026031327981;DTS2026031222703;DTS2026031222694;DTS2026031222686;DTS2026031222671;DTS2026031222662;DTS2026031222654 Description:【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Team:v8 Feature or Bugfix:Bugfix Binary Source:No PrivateCode(Yes/No):No Change-Id: Iae84c8fcc36a25b1936ec0997008368f70096cd6 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/534 Merged-by: public pjenkins Signed-off-by: Marja Hölttä <marja@chromium.org> | 1 个月前 | |
TicketNo:DTS2026040312077;DTS2026040207037;DTS2026040207036;DTS2026040135724;DTS2026040135722;DTS2026032818442;DTS2026032530470;DTS2026032530464;DTS2026031327981;DTS2026031222703;DTS2026031222694;DTS2026031222686;DTS2026031222671;DTS2026031222662;DTS2026031222654 Description:【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Team:v8 Feature or Bugfix:Bugfix Binary Source:No PrivateCode(Yes/No):No Change-Id: Iae84c8fcc36a25b1936ec0997008368f70096cd6 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/534 Merged-by: public pjenkins Signed-off-by: Marja Hölttä <marja@chromium.org> | 1 个月前 | |
TicketNo:DTS2026040312077;DTS2026040207037;DTS2026040207036;DTS2026040135724;DTS2026040135722;DTS2026032818442;DTS2026032530470;DTS2026032530464;DTS2026031327981;DTS2026031222703;DTS2026031222694;DTS2026031222686;DTS2026031222671;DTS2026031222662;DTS2026031222654 Description:【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Team:v8 Feature or Bugfix:Bugfix Binary Source:No PrivateCode(Yes/No):No Change-Id: Iae84c8fcc36a25b1936ec0997008368f70096cd6 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/534 Merged-by: public pjenkins Signed-off-by: Marja Hölttä <marja@chromium.org> | 1 个月前 | |
[runtime][ic][api] Pass proper holder to Api callbacks This is a follow-up to v8::PropertyCallbackInfo<T>::Holder() removal, this CL makes sure that the holder passed is never a hidden prototype and removes special handling of this case from implementation of v8::PropertyCallbackInfo<T>::HolderV2(). Drive-by: - in KeyAccumulator::FilterForEnumerableProperties() reuse the existing PropertyCallbackArguments object since it's the same for all callback calls, - fix crashes when calling %DebugPrint() with weak pointers, - fix LoadHandler::LoadInterceptorHolderIsLookupStartupObject() to make it load the holder from data handler when holder is a global object. Bug: 333672197 Change-Id: Ie83b126f52bd491eec7e217eb12f4a7507c11bc4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7184979 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#103883} | 7 个月前 | |
ppc/s390: [wasmfx] Implement tag parameters and returns Original Commit Message: Pass the tag arguments and returns via a stack buffer. The buffer is immediately unpacked by the receiving stack and never used again, so we don't need to visit the tagged slots within that buffer. The pointer to the buffer is passed as an extra argument to the stack switching builtins, and forwarded to the target stack. On the receiving end: - The suspend builtin returns the pointer received from the resume builtin, - The resume handler uses a new pseudo-instruction to materialize the buffer in a fixed register, similar to how we materialize the exception or the continuation object. Arguments and return values in the initial func ref are not supported yet. Bug: 388533754 Change-Id: I7fa9f4a1aa38b4ebc3c82c78662c2d717ef94d5c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7207915 Reviewed-by: Joran Siu <joransiu@ca.ibm.com> Commit-Queue: Joran Siu <joransiu@ca.ibm.com> Cr-Commit-Position: refs/heads/main@{#104011} | 7 个月前 | |
TicketNo:DTS2026040312077;DTS2026040207037;DTS2026040207036;DTS2026040135724;DTS2026040135722;DTS2026032818442;DTS2026032530470;DTS2026032530464;DTS2026031327981;DTS2026031222703;DTS2026031222694;DTS2026031222686;DTS2026031222671;DTS2026031222662;DTS2026031222654 Description:【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Team:v8 Feature or Bugfix:Bugfix Binary Source:No PrivateCode(Yes/No):No Change-Id: Iae84c8fcc36a25b1936ec0997008368f70096cd6 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/534 Merged-by: public pjenkins Signed-off-by: Marja Hölttä <marja@chromium.org> | 1 个月前 | |
ppc/s390: [wasmfx] Implement tag parameters and returns Original Commit Message: Pass the tag arguments and returns via a stack buffer. The buffer is immediately unpacked by the receiving stack and never used again, so we don't need to visit the tagged slots within that buffer. The pointer to the buffer is passed as an extra argument to the stack switching builtins, and forwarded to the target stack. On the receiving end: - The suspend builtin returns the pointer received from the resume builtin, - The resume handler uses a new pseudo-instruction to materialize the buffer in a fixed register, similar to how we materialize the exception or the continuation object. Arguments and return values in the initial func ref are not supported yet. Bug: 388533754 Change-Id: I7fa9f4a1aa38b4ebc3c82c78662c2d717ef94d5c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7207915 Reviewed-by: Joran Siu <joransiu@ca.ibm.com> Commit-Queue: Joran Siu <joransiu@ca.ibm.com> Cr-Commit-Position: refs/heads/main@{#104011} | 7 个月前 | |
TicketNo:DTS2026040312077;DTS2026040207037;DTS2026040207036;DTS2026040135724;DTS2026040135722;DTS2026032818442;DTS2026032530470;DTS2026032530464;DTS2026031327981;DTS2026031222703;DTS2026031222694;DTS2026031222686;DTS2026031222671;DTS2026031222662;DTS2026031222654 Description:【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Team:v8 Feature or Bugfix:Bugfix Binary Source:No PrivateCode(Yes/No):No Change-Id: Iae84c8fcc36a25b1936ec0997008368f70096cd6 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/534 Merged-by: public pjenkins Signed-off-by: Marja Hölttä <marja@chromium.org> | 1 个月前 | |
[turboshaft][tsa] Implement BytecodeHandlerAssembler in Turboshaft And port BitwiseNot_WithFeedback builtin and BitwiseNot bytecode handler to TSA. A number of drive by changes: - Implement a FeedbackCollectorReducer to handle feedback collection - Separate Turboshaft's builtin compilation into separate files (turboshaft/builtin-compiler.*). - Rename and slightly extend Variables (Var, ScopedVar). - Add a number of include exceptions to temporarily allow includes into compiler directories until we have a properly defined new structure for stuff that is shared between builtins and TurboFan. Bug: chromium:348031042 Change-Id: Ia1e23f5aa8e660002cd98e2b72d719171c6dfcdd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5691733 Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/main@{#96025} | 1 年前 | |
buganizer: fix component IDs in DIR_METADATA This only matches the old monorail components. Bug: 341800538 Change-Id: Id74fbdb3b9be0c858b77af84966c6c37adf78c5c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6025833 Reviewed-by: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Paul Semel <paulsemel@chromium.org> Commit-Queue: Paul Semel <paulsemel@chromium.org> Cr-Commit-Position: refs/heads/main@{#97252} | 1 年前 | |
Add DIR_METADATA files to v8. Generate DIR_METADATA files and remove metadata from OWNERS files for v8. R=jkummerow@chromium.org, ochang@chromium.org, yangguo@chromium.org Bug: chromium:1113033 Change-Id: I82cbb62e438d82dbbc408e87120af39fa9da0afa Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2476680 Reviewed-by: Adam Klein <adamk@chromium.org> Reviewed-by: Maya Lekova <mslekova@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Yang Guo <yangguo@chromium.org> Commit-Queue: Edward Lesmes <ehmaldonado@chromium.org> Auto-Submit: Edward Lesmes <ehmaldonado@chromium.org> Cr-Commit-Position: refs/heads/master@{#70669} | 5 年前 | |
[runtime][api] Relax requirements for setter/definer/deleter callbacks Previously V8 expected these callbacks to throw TypeError exception on failure depending on v8::PropertyCallbackInfo<T>::ShouldThrowOnError(). The embedders wasn't always doing it right anyway. This CL removes the requirement to handle ShouldThrowOnError() - it's enough to set the result to false and V8 will do the rest (throw TypeError with some default error message depending on the operation). Drive-by: advance deprecation of v8::ReturnValue<void>::Set(Local<S>). Bug: 348688196 Change-Id: If0245e3b5c8bd2cd6a012d3d4cfb4d07e0622d12 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7168624 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#103833} | 7 个月前 | |
[api] Prepare for deprecation of v8::PropertyCallbackInfo<T>::This() This is a step towards making native data property accessor callback calls and interceptor callback calls faster. Native data property being semantically a data property should not access anything else than a holder object. The same applies to interceptors which provided access to the receiver although it's not actually used by Blink. Given that interceptors were introduced mostly for Blink we can avoid the overhead of passing unused receiver value to all interceptor callbacks. This CL deprecates usages of This() and replaces some usages in tests with HolderV2(). There are Api tests which validate that the callbacks get proper receiver value, they are updated to suppress warnings about usage of deprecated Api. Once we remove usages of This() on embedder side, these tests will be updated or removed. Bug: 455600234 Change-Id: Ic5d8ba8896e30d8781d1af18960c1cde6ba163f7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7093356 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#103561} | 7 个月前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[change-array-by-copy] Refactor ConvertToRelativeIndex This refactors ConvertToRelativeIndex into a clamping version and a version that takes OOB labels for the upcoming implementation of Array#with and TypedArray#with. Also gets rid of the the "to" in the name, because these macros are actually converting _from_ a relative index to an absolute one, not the other way around. Bug: v8:12764 Change-Id: I8bf1c16ce73008164acbd6b849f4259fb9315274 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3669655 Reviewed-by: Adam Klein <adamk@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#80786} | 4 年前 | |
[sandbox][leaptiering] Pass dispatch_handle during JS function calls Some callees need to be able to determine the number of arguments passed to them. Due to argument padding, this requires knowledge of both the actual argument count and of the formal parameter count of the invoked function (the number of arguments on the stack is then the maximum of the two). With the sandbox attacker model, it is not safe to load the formal parameter count from within the sandbox. Instead, this CL adds a new parameter to the JS calling convention which contains the JSDispatchHandle that was used to invoke a function. The callee can then simply use that dispatch handle to load the (trusted) parameter count from the JSDispatchTable. Drive-By: add various DCHECKs and static_asserts into places that rely on the JavaScript calling convention. Bug: 40931165, 42204201 Change-Id: I009606c298af2071052c859bfc8b27c5fcc72072 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5907404 Commit-Queue: Samuel Groß <saelo@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#96672} | 1 年前 | |
[change-array-by-copy] Refactor ConvertToRelativeIndex This refactors ConvertToRelativeIndex into a clamping version and a version that takes OOB labels for the upcoming implementation of Array#with and TypedArray#with. Also gets rid of the the "to" in the name, because these macros are actually converting _from_ a relative index to an absolute one, not the other way around. Bug: v8:12764 Change-Id: I8bf1c16ce73008164acbd6b849f4259fb9315274 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3669655 Reviewed-by: Adam Klein <adamk@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#80786} | 4 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[use-counters] Add use counters for some features This adds use counters for: - Array.p.findLast - {Object,Map}.groupBy - Promise.withResolvers - ArrayBuffer.{transfer,transferToFixed} - Atomics.waitAsync Change-Id: Ief9b43ec192e3db146227017990f9475ed2355db Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6020828 Commit-Queue: Shu-yu Guo <syg@chromium.org> Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Cr-Commit-Position: refs/heads/main@{#97211} | 1 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[builtin][tq] Fix bad DCHECK in Array.prototype.flat Bug: v8:14306, chromium:1507416, chromium:1509252 Change-Id: I48ac9a43c8c9d8469f541b6ab7b715a09e37d3ad Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5097307 Commit-Queue: Patrick Thier <pthier@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Auto-Submit: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#91407} | 2 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[use-counters] Use @incrementUseCounter in more Torque builtins Also fix torque-format rules for decorators to account for decorators with arguments. Change-Id: If040784ef7080bc5cec132262f4f7878909e3d00 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6050475 Auto-Submit: Shu-yu Guo <syg@chromium.org> Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#97386} | 1 年前 | |
[iterator-helpers] Close receiver on failures In this CL, we close receiver of iterator helpers on argument validation failures. Bug: 381805376 Change-Id: I82c0e09b40c6b78c6c2939edea926063db9642c8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6081111 Reviewed-by: Shu-yu Guo <syg@chromium.org> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Cr-Commit-Position: refs/heads/main@{#98711} | 1 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[objects] Port Microtask and Promise classes to StructLayout This CL ports Microtask, PromiseReaction, PromiseCapability, and their subclasses to use the new StructLayout definition. This involves: - Changing Torque definition annotations to @cppObjectLayoutDefinition. - Updating C++ headers to inherit from StructLayout and defining fields using TaggedMember. - Implementing inline accessors using TaggedMember methods. - Updating body descriptors and printers/verifiers. - Updating call sites (mostly in builtins and code stub assembler) to use offsetof() or public accessors. - Refactoring verification logic to use a common MicrotaskVerify method. - Minor modification to format-torque.py to format generates expressions that are close to 80 characters. Bug: 42202654 Change-Id: Ie4b147decc918aa0270b10dee9d0e5c894e90076 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7181923 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103986} | 7 个月前 | |
[runtime][torque] Undefined Doubles Introduce a special nan value to represent undefined values in doubles to allow JSArrays to stay in (holey) double elements instead of transitioning into tagged representation. This is only the first part of a larger change as proper handling in the compiler is still missing. Bug: 385155404 Change-Id: I1c1c9418447d0f060dca5b28a63b858b4e1a6dd5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6063479 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#98120} | 1 年前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
Fix various typos in comments This patch fixes several spelling mistakes in comments across the codebase. R=clemensb@chromium.org Change-Id: I4a2bfaabfc557d5e18d98ec384ec055c44652708 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6998776 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#102901} | 8 个月前 | |
Fix various typos in comments This patch fixes several spelling mistakes in comments across the codebase. R=clemensb@chromium.org Change-Id: I4a2bfaabfc557d5e18d98ec384ec055c44652708 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6998776 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#102901} | 8 个月前 | |
Update V8 DEPS (trusted) and reformat Also slightly rewrite a pattern in ic-callable.tq as otherwise the torque formatter script will not reach a stable state. Rolling buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/d51c118..fa96185 Fixed: 347509735 Change-Id: Idc1f81748b0be91804a99b960178d0a86adf11e7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6239632 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/main@{#98554} | 1 年前 | |
[sandbox][leaptiering] Pass dispatch_handle during JS function calls Some callees need to be able to determine the number of arguments passed to them. Due to argument padding, this requires knowledge of both the actual argument count and of the formal parameter count of the invoked function (the number of arguments on the stack is then the maximum of the two). With the sandbox attacker model, it is not safe to load the formal parameter count from within the sandbox. Instead, this CL adds a new parameter to the JS calling convention which contains the JSDispatchHandle that was used to invoke a function. The callee can then simply use that dispatch handle to load the (trusted) parameter count from the JSDispatchTable. Drive-By: add various DCHECKs and static_asserts into places that rely on the JavaScript calling convention. Bug: 40931165, 42204201 Change-Id: I009606c298af2071052c859bfc8b27c5fcc72072 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5907404 Commit-Queue: Samuel Groß <saelo@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#96672} | 1 年前 | |
[iftt] Add annotations to (Reduce)ArrayPrototypeSlice Change-Id: I31105157b55b1d1d9ffb3fe0ac40fa7f158b1c17 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6343233 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Auto-Submit: Marja Hölttä <marja@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#99179} | 1 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
Introduce a PromiseHole Introduce a new PromiseHole that is used exclusively for marking promise resolution. Bug: chromium:1445008 Change-Id: I50bbca1980f1785f4ae937db2d08241e84d1b38a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5003525 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Carl Smith <cffsmith@chromium.org> Cr-Commit-Position: refs/heads/main@{#90734} | 2 年前 | |
Update V8 DEPS (trusted) and reformat Also slightly rewrite a pattern in ic-callable.tq as otherwise the torque formatter script will not reach a stable state. Rolling buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/d51c118..fa96185 Fixed: 347509735 Change-Id: Idc1f81748b0be91804a99b960178d0a86adf11e7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6239632 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/main@{#98554} | 1 年前 | |
[use-counters] Use @incrementUseCounter in more Torque builtins Also fix torque-format rules for decorators to account for decorators with arguments. Change-Id: If040784ef7080bc5cec132262f4f7878909e3d00 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6050475 Auto-Submit: Shu-yu Guo <syg@chromium.org> Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#97386} | 1 年前 | |
[use-counters] Use @incrementUseCounter in more Torque builtins Also fix torque-format rules for decorators to account for decorators with arguments. Change-Id: If040784ef7080bc5cec132262f4f7878909e3d00 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6050475 Auto-Submit: Shu-yu Guo <syg@chromium.org> Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#97386} | 1 年前 | |
[sandbox][leaptiering] Pass dispatch_handle during JS function calls Some callees need to be able to determine the number of arguments passed to them. Due to argument padding, this requires knowledge of both the actual argument count and of the formal parameter count of the invoked function (the number of arguments on the stack is then the maximum of the two). With the sandbox attacker model, it is not safe to load the formal parameter count from within the sandbox. Instead, this CL adds a new parameter to the JS calling convention which contains the JSDispatchHandle that was used to invoke a function. The callee can then simply use that dispatch handle to load the (trusted) parameter count from the JSDispatchTable. Drive-By: add various DCHECKs and static_asserts into places that rely on the JavaScript calling convention. Bug: 40931165, 42204201 Change-Id: I009606c298af2071052c859bfc8b27c5fcc72072 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5907404 Commit-Queue: Samuel Groß <saelo@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#96672} | 1 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
Loosen type of Map::instance_descriptors So that Wasm structs can store a "custom descriptor" in that slot. (That will follow in another CL soon.) Bug: 403372470 Change-Id: Id9a7b41b5d96cdb3883f08f18535f50a674ebce1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6383040 Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#99416} | 1 年前 | |
[wasm][rab] Wasm Memory RAB integration fixup This addresses the issue discussed at: https://github.com/WebAssembly/spec/issues/1895 Summary: the spec allows the {maxByteLength} property of a wasm memory buffer to be up to 2^32 (= 2^16 maximum pages * 2^16 bytes per page), which cannot be represented in the size_t {max_byte_length} field of the buffer on 32 bit. A similar issue happens on 64 bit with memory64. The solution agreed upon in the GitHub thread is to ignore the {max_byte_length} field in the {maxByteLength} getter and recompute the value instead. There are other references to the {max_byte_length} field inside V8, therefore we still compute the expected value in {WasmMemoryObject::FixUpResizableArrayBuffer} and store it in the field. And for the exceptional case where it is not representable, we keep the old hack that consists in subtracting one page size from the value. But this hack is no longer expected to be observable. Another issue discussed in the thread is that with memory64, {maxByteLength} is potentially bigger than MAX_SAFE_INTEGER (= 2^53-1). However, as discussed in the thread, there is an implementation-defined limit of 2^18 for memory64's maximum pages [1], and in V8 this limit is validated when we create the memory (which is not the case for all engines, there is an open issue about that here [2]). With our current interpretation of the limit, {maxByteLength} is at most 2^18 * 2*16, which is less than MAX_SAFE_INTEGER. [1] https://webassembly.github.io/memory64/js-api/#limits [2] https://github.com/WebAssembly/spec/issues/1863 R=jkummerow@chromium.org Bug: 42202693 Change-Id: I55dfb2acc6ddb036ec9b40c33a978d222f06bae3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6871493 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Cr-Commit-Position: refs/heads/main@{#101986} | 10 个月前 | |
[fuzzer] Make undefined double bit pattern unobservable through Wasm When passing JS undefined to f32 or f64 arguments of Wasm functions, the bit pattern of the respective NaN is observable. To avoid false positives from differential fuzzers, we pass a canonical quiet NaN to Wasm when undefined doubles are enabled. This did exist for f64 arguments already, but this CL patches the gap for f32 args. Bug: 461225188 Change-Id: I2245d5b9f9e38c5b1aaacfc7e188bb4027745b92 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7198185 Auto-Submit: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#103938} | 7 个月前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[handles] Migration to direct handles, part 8 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, asmjs, builtins, codegen, compiler, date, debug, diagnostics, execution, heap, ic, init, interpreter, json, logging, objects, parsing, regexp, runtime, snapshot, strings, wasm. Bug: 42203211 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Change-Id: Ib35bb03997bb4a646c56674f834b952dffdeaf02 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6074945 Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#97624} | 1 年前 | |
Revert "[api] Prepare for passing flags to Api callbacks in isolate slot" This reverts commit 41fc89c1675988305b257d68cc4ec9fa7e6df148. Reason for revert: causes perf regression https://crbug.com/462926099 Original change's description: > [api] Prepare for passing flags to Api callbacks in isolate slot > > This is a preliminary step towards removing kShouldThrowOnErrorIndex > slot from v8::PropertyCallbackInfo<T> and kNewTargetIndex slot from > v8::FunctionCallbackInfo<T> for non-constructor calls. > > Bug: 326505377, 455600234 > Change-Id: Icbe384815583844e73ac630372bc38c8dc220ada > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7185161 > Commit-Queue: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103887} Fixed: 462926099 Bug: 326505377, 455600234 Change-Id: Iae68f106e3a96d3adec8ad4aee9ab4c72e0b90a8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7203996 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#103997} | 7 个月前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
[torque] Emit TNode<Union<...>> for Union types ... and propagate this throughought the CSA code, predominantly transitively propagating JSAny. To make this easier, there is additional support for: * Compatibility between torque definitions of types via Unions and C++ definitions of some types (e.g. handling MaybeObject which is a single type in C++ and a Union in torque). We will want to align these more closely in the future. * A new Union::Without helper to remove types from a Union (e.g. after a Smi check). Bug: 42202654 Change-Id: I85f4b007d071d912966e4f00571058e79a3fd70f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6269398 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#98722} | 1 年前 | |
Enable undefined double on bots and make it non-experimental Bug: 385155404 Change-Id: Ib0ee24769f515d70ac9f4f5b4d8ff989e74fe8a2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6939123 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102519} | 9 个月前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
[explicit-resource-management] Fix cast in AsyncDisposeFromSyncDispose Sync dispose method could be a bound function so instead of casting to JSFunction, we need to cast it to JSReciever. The callability of the method has been checked before. Bug: 440585463 Change-Id: Ic0abbb43a1d05b53296c032614624b5dfee2a5de Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6893267 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Cr-Commit-Position: refs/heads/main@{#102115} | 10 个月前 | |
Reland "[contexts] Unify context accessors after ContextCells" This is a reland of commit d2ab66c2a942893b9f6d7628ff8892e1d6a607b3 Changes from original: - The test inspector/debugger/set-breakpoint-after-gc relies on precise garbage collection and may fail if conservative stack scanning is used. We call GC multiple times to ensure the weak reference hold by the script is eventually collected. - Allow reading a ContextCell when printing debug stack frame. Original change's description: > [contexts] Unify context accessors after ContextCells > > The introduction of ContextCells removed the need for special handling > for ScriptContext (which previously used a side table for > let/const tracking and mutable numbers). > > This change refactors the context access logic: > - Internal get/set accessors are now protected to the Context class. > - External access should use the new functions: > - Get/Set: A safe (though potentially slower) > function for accessing elements in any context. > - GetNoCell/SetNoCell: A faster function that verifies the > element being accessed is not a ContextCell. > > Additionally, related bytecode operations and optimizer functions have > been renamed for consistency with these changes. > > Bug: 408128754 > > Change-Id: I785281ab6f13b0ae65578eb5d2f0a5750457ab5e > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6450582 > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Commit-Queue: Victor Gomes <victorgomes@chromium.org> > Cr-Commit-Position: refs/heads/main@{#99844} Bug: 408128754, 40789559 Change-Id: I78a3a99a4f364ed78965fbed56a084d38382d2fc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6479814 Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#99865} | 1 年前 | |
Reland "[contexts] Unify context accessors after ContextCells" This is a reland of commit d2ab66c2a942893b9f6d7628ff8892e1d6a607b3 Changes from original: - The test inspector/debugger/set-breakpoint-after-gc relies on precise garbage collection and may fail if conservative stack scanning is used. We call GC multiple times to ensure the weak reference hold by the script is eventually collected. - Allow reading a ContextCell when printing debug stack frame. Original change's description: > [contexts] Unify context accessors after ContextCells > > The introduction of ContextCells removed the need for special handling > for ScriptContext (which previously used a side table for > let/const tracking and mutable numbers). > > This change refactors the context access logic: > - Internal get/set accessors are now protected to the Context class. > - External access should use the new functions: > - Get/Set: A safe (though potentially slower) > function for accessing elements in any context. > - GetNoCell/SetNoCell: A faster function that verifies the > element being accessed is not a ContextCell. > > Additionally, related bytecode operations and optimizer functions have > been renamed for consistency with these changes. > > Bug: 408128754 > > Change-Id: I785281ab6f13b0ae65578eb5d2f0a5750457ab5e > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6450582 > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Commit-Queue: Victor Gomes <victorgomes@chromium.org> > Cr-Commit-Position: refs/heads/main@{#99844} Bug: 408128754, 40789559 Change-Id: I78a3a99a4f364ed78965fbed56a084d38382d2fc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6479814 Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#99865} | 1 年前 | |
[torque] Emit TNode<Union<...>> for Union types ... and propagate this throughought the CSA code, predominantly transitively propagating JSAny. To make this easier, there is additional support for: * Compatibility between torque definitions of types via Unions and C++ definitions of some types (e.g. handling MaybeObject which is a single type in C++ and a Union in torque). We will want to align these more closely in the future. * A new Union::Without helper to remove types from a Union (e.g. after a Smi check). Bug: 42202654 Change-Id: I85f4b007d071d912966e4f00571058e79a3fd70f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6269398 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#98722} | 1 年前 | |
Reland "[contexts] Unify context accessors after ContextCells" This is a reland of commit d2ab66c2a942893b9f6d7628ff8892e1d6a607b3 Changes from original: - The test inspector/debugger/set-breakpoint-after-gc relies on precise garbage collection and may fail if conservative stack scanning is used. We call GC multiple times to ensure the weak reference hold by the script is eventually collected. - Allow reading a ContextCell when printing debug stack frame. Original change's description: > [contexts] Unify context accessors after ContextCells > > The introduction of ContextCells removed the need for special handling > for ScriptContext (which previously used a side table for > let/const tracking and mutable numbers). > > This change refactors the context access logic: > - Internal get/set accessors are now protected to the Context class. > - External access should use the new functions: > - Get/Set: A safe (though potentially slower) > function for accessing elements in any context. > - GetNoCell/SetNoCell: A faster function that verifies the > element being accessed is not a ContextCell. > > Additionally, related bytecode operations and optimizer functions have > been renamed for consistency with these changes. > > Bug: 408128754 > > Change-Id: I785281ab6f13b0ae65578eb5d2f0a5750457ab5e > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6450582 > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Commit-Queue: Victor Gomes <victorgomes@chromium.org> > Cr-Commit-Position: refs/heads/main@{#99844} Bug: 408128754, 40789559 Change-Id: I78a3a99a4f364ed78965fbed56a084d38382d2fc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6479814 Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#99865} | 1 年前 | |
Reland "[contexts] Unify context accessors after ContextCells" This is a reland of commit d2ab66c2a942893b9f6d7628ff8892e1d6a607b3 Changes from original: - The test inspector/debugger/set-breakpoint-after-gc relies on precise garbage collection and may fail if conservative stack scanning is used. We call GC multiple times to ensure the weak reference hold by the script is eventually collected. - Allow reading a ContextCell when printing debug stack frame. Original change's description: > [contexts] Unify context accessors after ContextCells > > The introduction of ContextCells removed the need for special handling > for ScriptContext (which previously used a side table for > let/const tracking and mutable numbers). > > This change refactors the context access logic: > - Internal get/set accessors are now protected to the Context class. > - External access should use the new functions: > - Get/Set: A safe (though potentially slower) > function for accessing elements in any context. > - GetNoCell/SetNoCell: A faster function that verifies the > element being accessed is not a ContextCell. > > Additionally, related bytecode operations and optimizer functions have > been renamed for consistency with these changes. > > Bug: 408128754 > > Change-Id: I785281ab6f13b0ae65578eb5d2f0a5750457ab5e > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6450582 > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Commit-Queue: Victor Gomes <victorgomes@chromium.org> > Cr-Commit-Position: refs/heads/main@{#99844} Bug: 408128754, 40789559 Change-Id: I78a3a99a4f364ed78965fbed56a084d38382d2fc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6479814 Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#99865} | 1 年前 | |
Reland "[contexts] Unify context accessors after ContextCells" This is a reland of commit d2ab66c2a942893b9f6d7628ff8892e1d6a607b3 Changes from original: - The test inspector/debugger/set-breakpoint-after-gc relies on precise garbage collection and may fail if conservative stack scanning is used. We call GC multiple times to ensure the weak reference hold by the script is eventually collected. - Allow reading a ContextCell when printing debug stack frame. Original change's description: > [contexts] Unify context accessors after ContextCells > > The introduction of ContextCells removed the need for special handling > for ScriptContext (which previously used a side table for > let/const tracking and mutable numbers). > > This change refactors the context access logic: > - Internal get/set accessors are now protected to the Context class. > - External access should use the new functions: > - Get/Set: A safe (though potentially slower) > function for accessing elements in any context. > - GetNoCell/SetNoCell: A faster function that verifies the > element being accessed is not a ContextCell. > > Additionally, related bytecode operations and optimizer functions have > been renamed for consistency with these changes. > > Bug: 408128754 > > Change-Id: I785281ab6f13b0ae65578eb5d2f0a5750457ab5e > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6450582 > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Commit-Queue: Victor Gomes <victorgomes@chromium.org> > Cr-Commit-Position: refs/heads/main@{#99844} Bug: 408128754, 40789559 Change-Id: I78a3a99a4f364ed78965fbed56a084d38382d2fc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6479814 Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#99865} | 1 年前 | |
[shared-struct] Remove lockAsync and waitAsync APIs Remove lockAsync and waitAsync experimental APIs. These are not needed right now, they are listed as future work in the TC39 shared structs proposal. Bug: 42202493 Change-Id: I47b93e056c76d20fa3a943a841aeffc4ca5021c2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7139418 Reviewed-by: Olivier Flückiger <olivf@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Luis Pardo <lpardosixtos@microsoft.com> Cr-Commit-Position: refs/heads/main@{#103652} | 7 个月前 | |
[jumbo] Split CSA_ macros out of code-stub-assembler.h. Putting these in a separate file makes the header more fine-grained -- not everyone who #includes code-stub-assdembler.h needs these. (Along similar lines, this also moves some macros that are only used by a single file to that file directly.) Both these changes fractionally reduce input size to the compiler, too. This also makes it easier/more parallel to undefine these symbols when they're no longer used, which is necessary for the build configuration experiments I'm doing. Bug: none Change-Id: I5e490670d8ab14fc9a22f9f92203b23cda03a93e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5774207 Auto-Submit: Peter Kasting <pkasting@chromium.org> Commit-Queue: Peter Kasting <pkasting@chromium.org> Reviewed-by: Daniel Lehmann <dlehmann@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#95785} | 1 年前 | |
[turbofan] Support BigInt shift operations This CL implements Torque builtins for BigInt left shift and right shift and truncates shift operations when the shift amount is a constant. - Propagate truncation if we know the operation is a left shift. - Lower the operation to a word64 right shift if the lhs is Signed- or UnsignedBigInt64 and we know the op is a right shift. A side effect of truncating left shift is it will not throw a BigIntTooBig exception in optimized code. Bug: v8:9407 Change-Id: Ibd42cf897ef8a35f6addd09674faf409654d6d7c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4028142 Commit-Queue: Qifan Pan <panq@google.com> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#84396} | 3 年前 | |
Remove old MAYBE_ prefixed macros Cleanup after https://crrev.com/c/6678531 Bug: 427539322 Change-Id: I6a6a6964dd12cedcffbc44130cd166e2da198779 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6690657 Reviewed-by: Olivier Flückiger <olivf@chromium.org> Commit-Queue: Manish Goregaokar <manishearth@google.com> Cr-Commit-Position: refs/heads/main@{#101209} | 11 个月前 | |
[tsa] Port Add_WithFeedback builtin to TSA Drive-by: Improve error messages when TSA Labels are misused. Some improvements are still todo in a follow-up CL. Bug: 348031042 Change-Id: I4207a363486e5ec363829095357d7b97235a86a3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6806039 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101816} | 10 个月前 | |
Throw TypeError with detailed error message The default behavior is to use the callable check in [[call]], which produces a "the identifier is not callable" message. Function.prototype.apply and Function.prototype.call produces "Uncaught TypeError: <ident> is not a function " and Reflect.apply() produces "TypeError: Function.prototype.apply was called on undefined, which is a undefined and not a function" differently. Therefore, check the callable of each call path and modify the error message template to include the method name and target, to produce an error message same with Reflect.apply(). Bug: 352528966 Change-Id: I47fffc0d9a69ca956ad3960e78e552b6d6fa0218 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5806138 Commit-Queue: Seokho Song <seokho@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102394} | 9 个月前 | |
[torque] Emit TNode<Union<...>> for Union types ... and propagate this throughought the CSA code, predominantly transitively propagating JSAny. To make this easier, there is additional support for: * Compatibility between torque definitions of types via Unions and C++ definitions of some types (e.g. handling MaybeObject which is a single type in C++ and a Union in torque). We will want to align these more closely in the future. * A new Union::Without helper to remove types from a Union (e.g. after a Smi check). Bug: 42202654 Change-Id: I85f4b007d071d912966e4f00571058e79a3fd70f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6269398 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#98722} | 1 年前 | |
[casting] Remove Foo::cast Replace Foo::cast with Cast<Foo>. This is, blessedly, the same number of characters, and allows us to remove the need to declare cast functions in every type (instead using instance-type based type checks for most things, and a few template specializations of CastTraits for the remainder). Bug: 345640551 Change-Id: Ic215e2d4519f3128457db8a828a73c18204714bd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5614630 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#94425} | 2 年前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
[upsert] Implement and stage upsert Bug: 434977728 Change-Id: I3376e4a39f4a94861853d6b46128860ec4803369 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6863074 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#103017} | 8 个月前 | |
Move more relevant files to src/objects TBR=bmeurer@chromium.org,leszeks@chromium.org Bug: v8:9247 Change-Id: I8d14d0192ea8c705f8274e8e61a162531826edb6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1624220 Reviewed-by: Yang Guo <yangguo@chromium.org> Reviewed-by: Hannes Payer <hpayer@chromium.org> Reviewed-by: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#61769} | 6 年前 | |
[runtime] Get rid of more GetIsolate calls Bug: 412408521 Change-Id: I0fbc5ac27c1f7b0304b4120681f534d80a29d08d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6480097 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Auto-Submit: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#99869} | 1 年前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
[context] Add ContextCells to FunctionContext Bug: 408128754 Change-Id: I886561ecb126ebb4e236c3c0f73b600c75be8a77 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6508809 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Victor Gomes <victorgomes@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#100351} | 1 年前 | |
[builtins] Use v8_flags for accessing flag values Avoid the deprecated FLAG_* syntax, access flag values via the {v8_flags} struct instead. R=nicohartmann@chromium.org Bug: v8:12887 Change-Id: Icc9016552c53489afd821ff6d360c025e48fee18 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3871201 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#82981} | 3 年前 | |
Reland "[maglev] Inline Math.clz32" Original version of the patch: https://chromium-review.googlesource.com/c/v8/v8/+/6469911 returned NaN instead of 32 for parameterless case, and didn't take into account kIntPtr value representation. Change-Id: Id5fd0e51181bcbcc896dda9a9eacaebd9983b0b9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6532337 Commit-Queue: Yahan Lu (LuYahan) <yahan@iscas.ac.cn> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Reviewed-by: Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/main@{#100340} | 1 年前 | |
[torque] check TNode return types of CSA macros This disallows using CSA macros from Torque that have a Node* return type instead of TNode<>. By enforcing CSA types at the boundary between CSA and Torque, we can ensure that the Torque types and the CSA types match. As a drive-by, this CL adds a bit more of CSA typing where it made sense. Bug: v8:7793, v8:6949 Change-Id: I12ea0337c628105ea3c420be747ae50d3a172547 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1660481 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#62293} | 6 年前 | |
[runtime] Optimize JSObject creation from JSON builder Add a fast path that avoids - the embedder field check - the write barrier for the properties in case we set the empty array - Compared to http://crrev.com/c/6915239 the stores are not using MemsetTagged as that seems to cause regressions. Bug: 442989225 Change-Id: I1b341a13cc6eb9f1aa1613a4c02f297cb5df2179 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6920390 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102345} | 9 个月前 | |
[compiler] Optimize Date.prototype.getXXX() accessors ... in Maglev and TurboFan. This CL: - adds NoDateTimeConfigurationChangeProtector, - makes sure that JSDate's cached fields are always initialized, which make it possible to read cached fields directly without additional run-time checks. Drive-by: - move DateCache::stamp_ field to IsolateData (this removes one indirection on access and avoids potential issues with reallocated DateCache object), - make deserializer recompute cached fields after deserialization to match current date/time configuration which could have been different during snapshot creation, - simplify definition of alignment padding fields in ISOLATE_DATA_FIELDS by introducing PADDING_FIELD macro. Bug: 411352101 Change-Id: I69e25b1ce7e2c79f9aeee69e97192be62a08c2c0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6535917 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#100248} | 1 年前 | |
[compiler] Optimize Date.prototype.getXXX() accessors ... in Maglev and TurboFan. This CL: - adds NoDateTimeConfigurationChangeProtector, - makes sure that JSDate's cached fields are always initialized, which make it possible to read cached fields directly without additional run-time checks. Drive-by: - move DateCache::stamp_ field to IsolateData (this removes one indirection on access and avoids potential issues with reallocated DateCache object), - make deserializer recompute cached fields after deserialization to match current date/time configuration which could have been different during snapshot creation, - simplify definition of alignment padding fields in ISOLATE_DATA_FIELDS by introducing PADDING_FIELD macro. Bug: 411352101 Change-Id: I69e25b1ce7e2c79f9aeee69e97192be62a08c2c0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6535917 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#100248} | 1 年前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
[tsa] Add concurrent builtin compilation for TSA-based builtins Drive-by: Rename some of the builtin macros and functions to be less confusing and more consistent (e.g. the Turboshaft version of TFJ is no longer TSJ but TFJ_TSA). Bug: 348031042 Change-Id: I866a9e724b29b2bd52800e7957d8b127cd915bb4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6781182 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#101687} | 11 个月前 | |
Reland "[contexts] Unify context accessors after ContextCells" This is a reland of commit d2ab66c2a942893b9f6d7628ff8892e1d6a607b3 Changes from original: - The test inspector/debugger/set-breakpoint-after-gc relies on precise garbage collection and may fail if conservative stack scanning is used. We call GC multiple times to ensure the weak reference hold by the script is eventually collected. - Allow reading a ContextCell when printing debug stack frame. Original change's description: > [contexts] Unify context accessors after ContextCells > > The introduction of ContextCells removed the need for special handling > for ScriptContext (which previously used a side table for > let/const tracking and mutable numbers). > > This change refactors the context access logic: > - Internal get/set accessors are now protected to the Context class. > - External access should use the new functions: > - Get/Set: A safe (though potentially slower) > function for accessing elements in any context. > - GetNoCell/SetNoCell: A faster function that verifies the > element being accessed is not a ContextCell. > > Additionally, related bytecode operations and optimizer functions have > been renamed for consistency with these changes. > > Bug: 408128754 > > Change-Id: I785281ab6f13b0ae65578eb5d2f0a5750457ab5e > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6450582 > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Commit-Queue: Victor Gomes <victorgomes@chromium.org> > Cr-Commit-Position: refs/heads/main@{#99844} Bug: 408128754, 40789559 Change-Id: I78a3a99a4f364ed78965fbed56a084d38382d2fc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6479814 Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#99865} | 1 年前 | |
[builtins] Verify CanAllocate effects for builtins in Turboshaft/Maglev Bug: 42204439 Change-Id: If13d9f78ddcfb77ccc14749a534ac1711dac3754 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6372502 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#100113} | 1 年前 | |
[builtins] Verify CanAllocate effects for builtins in Turboshaft/Maglev Bug: 42204439 Change-Id: If13d9f78ddcfb77ccc14749a534ac1711dac3754 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6372502 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#100113} | 1 年前 | |
Reland "[api] Introduce CppHeapExternal" This is a reland of c6c2d15dd468cfd8166967560f22eab9f2841c07 The unit tests were relying an on-stack handle to keep the test object alive after GC with StackState::kNoHeapPointers, which doesn't work with CSS. Instead, use a a GCed object with a TracedReference to the CppHeapExternal, and keep that GCed object alive with a Persistent as needed. Tests: https://ci.chromium.org/ui/p/v8/builders/try/v8_linux64_css_dbg/b8718488560320906769/overview Original change's description: > [api] Introduce CppHeapExternal > > CppHeapExternal is an on-heap version of External, allowing embedders to > store GarbageCollected objects in JS values that aren't exposed to > JavaScript, and therefore aren't associated with a particular Context. > > Unlike JS wrapper objects, this new type extends HeapObject rather than > JSObject since it is not exposed to JavaScript. To support this, the > existing Cpp heap pointer logic is being updated to support objects with > different layouts. The Cpp object is otherwise handled in the same way > as Object::Wrap and Object::Unwrap, including using CppHeapPointerTag > (we'll use distinct tags in Blink to separate these objects from > ScriptWrappable objects; see crrev.com/c/6350413). > > Bug: 380911428 > Change-Id: I8777f7ce5c5447437557111be064ea195eaba175 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6343961 > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Commit-Queue: Scott Haseley <shaseley@chromium.org> > Cr-Commit-Position: refs/heads/main@{#99676} Bug: 380911428 Change-Id: I6a5460b914a2435ea5ce74e11b12af044b71aae1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6434692 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Scott Haseley <shaseley@chromium.org> Cr-Commit-Position: refs/heads/main@{#99702} | 1 年前 | |
Reland "[json] Detect more cases where reviver has only 2 args" This is a reland of commit ff400bd358aecbad995e080f38f4d6d892b4879d Original change's description: > [json] Detect more cases where reviver has only 2 args > > Propagate allocation of arguments variable to ScopeInfo to enable 2 argument > optimization for non-arrow functions. > > Change-Id: I442b5ff35385cf4993528de79c3c019acb57e23a > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7048397 > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Commit-Queue: Erik Corry <erikcorry@chromium.org> > Reviewed-by: Erik Corry <erikcorry@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103159} Change-Id: I089d40396824e83ee1d5eb367adc649210c371f1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7062033 Reviewed-by: Erik Corry <erikcorry@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#103224} | 8 个月前 | |
[torque] Emit TNode<Union<...>> for Union types ... and propagate this throughought the CSA code, predominantly transitively propagating JSAny. To make this easier, there is additional support for: * Compatibility between torque definitions of types via Unions and C++ definitions of some types (e.g. handling MaybeObject which is a single type in C++ and a Union in torque). We will want to align these more closely in the future. * A new Union::Without helper to remove types from a Union (e.g. after a Smi check). Bug: 42202654 Change-Id: I85f4b007d071d912966e4f00571058e79a3fd70f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6269398 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#98722} | 1 年前 | |
[jumbo] Split CSA_ macros out of code-stub-assembler.h. Putting these in a separate file makes the header more fine-grained -- not everyone who #includes code-stub-assdembler.h needs these. (Along similar lines, this also moves some macros that are only used by a single file to that file directly.) Both these changes fractionally reduce input size to the compiler, too. This also makes it easier/more parallel to undefine these symbols when they're no longer used, which is necessary for the build configuration experiments I'm doing. Bug: none Change-Id: I5e490670d8ab14fc9a22f9f92203b23cda03a93e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5774207 Auto-Submit: Peter Kasting <pkasting@chromium.org> Commit-Queue: Peter Kasting <pkasting@chromium.org> Reviewed-by: Daniel Lehmann <dlehmann@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#95785} | 1 年前 | |
[runtime] Avoid some GetIsolate calls Bug: 412408521, 411352262 Change-Id: I855c11be13b9ab033b9ec2a2c46582d2a41b18c5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6478172 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#99837} | 1 年前 | |
[builtin] Introduce Gearbox for builtins This CL introduces a new mechanism to support builtins run with the latest ISA for the current client's CPU. Bug: 420782518 Change-Id: I7fd159217c857de71a3568e9ebc98c13653c0c62 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5922604 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Wenqin Yang <wenqin.yang@intel.com> Reviewed-by: Jakob Linke <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#100663} | 1 年前 | |
Sparkplug+: support patchable baseline code A bytecode handler for an operation is often a generic handler that deal with different types of inputs. This make the baseline compiler to generate a call to a generic builtin for that operation. The generic builtin can deal with all types of inputs, but this makes the builtin very large and introduces a lot of branches to distinguish inputs' types, which hurts the performance. Sparkplug+ introduces some small and specific handlers to deal with one single type of input. For example, this CL introduces some small monomorphic handlers for builtin LoadIC to deal with one specific kind of IC. We will patch the baseline code to use these specific handlers on IC misses dynamically. Bug: chromium:429351411 Change-Id: I85f842ae4050eebbdd8d25d5e113deae743c95d0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6627216 Commit-Queue: Xu, Hao A <hao.a.xu@intel.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103495} | 7 个月前 | |
[sandbox][maglev] Generate direct calls only to compatible builtins ... i.e. to enabled JS builtins having compatible parameter count and which are not JS trampolines (it doesn't make sense to call them from generated code). NO_IFTTT=Introducing IFTTT, no logical change. Fixed: 454927471 Change-Id: I91914ffe5854b5d2e19b3644c7d28b93d7598e38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7102180 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#103439} | 8 个月前 | |
[cleanup] remove V8_ENABLE_LEAPTIERING as it's always defined Change-Id: I63421cc19f96e4063178f1ad83b3215f0f2bbbea Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7100740 Reviewed-by: Olivier Flückiger <olivf@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Dan Carney <dcarney@chromium.org> Cr-Commit-Position: refs/heads/main@{#103430} | 8 个月前 | |
[sandbox] Don't allow to use disabled builtins, pt.2 ... i.e. the ones that belong to features that are not currently enabled. This CL: - adds kDisabledBuiltinEntrypointTag, - adds Code::is_disabled_builtin() flag which is set during RO heap deserialization for disabled JS builtins, - disables builtins by using kDisabledBuiltinEntrypointTag for them instead of kJSEntrypointTag, - initializes preallocated dispatch table entries for disabled builtins with Illegal builtin's Code. Drive-by: - add TEST_WITH_FLAG macro for cctests which need to change flag values before initializing the Isolate, - fixed respective cctests. Bug: 435630464 Change-Id: Ibfd8f66ede06210e79184fde027331775c80634b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7003083 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#102936} | 8 个月前 | |
[ext-code-space] Add InterpreterEntryTrampolineForProfiling builtin ... - a code range size agnostic version of InterpreterEntryTrampoline builtin. The new builtin is fully compatible with the default version and used as a template for creating interpreter entry trampoline Code objects when --interpreted-frames-native-stack is enabled. This CL introduces a new assembler option "position_independent_code" which affects the way builtin calls are generated. This mode is enabled only for InterpreterEntryTrampolineForProfiling. Motivation: * InterpreterEntryTrampoline uses RelocInfo::CODE_TARGET for calling other builtins which requires the code range to be small enough to allow PC-relative jumps/calls between Code objects. This is the reason why --interpreted-frames-native-stack was not supported on arm and might not work on arm64 because the code range is bigger than the max PC-relative distance for call/jump instructions. The new builtin calls other builtins via builtins entry table which makes the code fully relocatable and usable for any code range size. * RelocInfo::CODE_TARGET requires a target code to be materialized as a Code object which contradicts the Code-less builtins goal. * The --interpreted-frames-native-stack is rarely used in the wild but we have to pay the price of deserializing InterpreterEntryTrampoline builtin as a Code object which consumes address space in the code range and thus limits the number of V8 isolates that can be created because of code range exhaustion. Now the pointer compression cage becomes the limiting factor instead of the code range. * We can remove complicated logic of Factory::CopyCode() and respective support on GC side. Bug: v8:11880, v8:8713, v8:12592 Change-Id: Ib72e28c03496c43db42f6fe46622def12e102f31 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3811287 Reviewed-by: Jakob Linke <jgruber@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#82263} | 3 年前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
TicketNo:DTS2026040312077;DTS2026040207037;DTS2026040207036;DTS2026040135724;DTS2026040135722;DTS2026032818442;DTS2026032530470;DTS2026032530464;DTS2026031327981;DTS2026031222703;DTS2026031222694;DTS2026031222686;DTS2026031222671;DTS2026031222662;DTS2026031222654 Description:【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Team:v8 Feature or Bugfix:Bugfix Binary Source:No PrivateCode(Yes/No):No Change-Id: Iae84c8fcc36a25b1936ec0997008368f70096cd6 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/534 Merged-by: public pjenkins Signed-off-by: Marja Hölttä <marja@chromium.org> | 1 个月前 | |
[temporal] Remove builtins-temporal-gen We don't use it anymore; it was needed for some Instant stuff. Change-Id: Ia0d0f08a92f53cac968f5ee8c106cf9bb6e4bf96 Bug: 401065166 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6604651 Auto-Submit: Manish Goregaokar <manishearth@google.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#100605} | 1 年前 | |
[torque] Emit TNode<Union<...>> for Union types ... and propagate this throughought the CSA code, predominantly transitively propagating JSAny. To make this easier, there is additional support for: * Compatibility between torque definitions of types via Unions and C++ definitions of some types (e.g. handling MaybeObject which is a single type in C++ and a Union in torque). We will want to align these more closely in the future. * A new Union::Without helper to remove types from a Union (e.g. after a Smi check). Bug: 42202654 Change-Id: I85f4b007d071d912966e4f00571058e79a3fd70f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6269398 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#98722} | 1 年前 | |
[json] Add ScriptOriginOptions parameter to JSON::Parse This change adds an optional ScriptOriginOptions parameter to the JSON::Parse API, allowing embedders to provide proper origin context when parsing JSON modules. Problem: When JSON parser encounters a parse error in ReportUnexpectedToken() json-parser.cc, it creates a new Script object for error reporting but has no way to pass origin information from the embedder. The parser currently tries to infer origin_options from the JavaScript stack frame, but for this case, there is no JavaScript frame with the correct cross-origin flags. Impact: This causes JSON module parse errors to be incorrectly sanitized to "Script error." even when loaded with proper CORS headers, making debugging harder for developers. Solution: - Add optional v8::ScriptOriginOptions parameter to JSON::Parse API - Store script_origin_options_ in JsonParser - Use provided origin when creating Script object instead of relying solely on stack frame inference cr.src change: https://crrev.com/c/6656128 Bug: 399689609,399692449 Change-Id: I0f1ab85ad2ee7bf67eec8dcc70cdfe7a75434328 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6652517 Commit-Queue: Issack John <issackjohn@microsoft.com> Reviewed-by: Luis Pardo <lpardosixtos@microsoft.com> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#101013} | 1 年前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
Reland^2 "Embedding feedback in BytecodeArray for StrictEqual" This is a reland of commit e295f1f18da01c386eda73f535fb67a56c004d88 Original change's description: > Reland "Embedding feedback in BytecodeArray for StrictEqual" > > This is a reland of commit f0fed41e48b1966e3e565ae278d018da538ef123 > > Original change's description: > > Embedding feedback in BytecodeArray for StrictEqual > > > > This CL removes the feedback vector slot for StrictEqual and stores its feedback values directly in the BytecodeArray. Optimized compilers will now access the type feedback from the BytecodeArray. > > > > Before: > > 75 04 00 TestEqualStrict a1, [0] > > > > After: > > 75 04 00 00 TestEqualStrict a1, #0 > > > > This change saves moemory by reducing FeedbackVector size, and is part of the Sparkplug+ optimization effort. > > > > Bug: chromium:429351411 > > Change-Id: I24390811c12755b0a19beaefe2b0319d75ceaf6c > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6986847 > > Reviewed-by: Xu, Hao A <hao.a.xu@intel.com> > > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#103656} > > Bug: chromium:429351411 > Change-Id: I77286b0e9c65f8a9e257a2125adab7f68fe09aec > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7148333 > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103800} Bug: chromium:429351411 Change-Id: I5020c9dffbed90ff207520728b13cf0dbcfb5903 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7197099 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> Cr-Commit-Position: refs/heads/main@{#103962} | 7 个月前 | |
[turboshaft] Use new call descriptor format for runtime calls Bug: 348031042 Change-Id: I1b87db1f9d3da93bf7594aa7a4d21104ddff95d5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7067913 Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Auto-Submit: Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#103285} | 8 个月前 | |
Remove old MAYBE_ prefixed macros Cleanup after https://crrev.com/c/6678531 Bug: 427539322 Change-Id: I6a6a6964dd12cedcffbc44130cd166e2da198779 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6690657 Reviewed-by: Olivier Flückiger <olivf@chromium.org> Commit-Queue: Manish Goregaokar <manishearth@google.com> Cr-Commit-Position: refs/heads/main@{#101209} | 11 个月前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
[torque] Emit TNode<Union<...>> for Union types ... and propagate this throughought the CSA code, predominantly transitively propagating JSAny. To make this easier, there is additional support for: * Compatibility between torque definitions of types via Unions and C++ definitions of some types (e.g. handling MaybeObject which is a single type in C++ and a Union in torque). We will want to align these more closely in the future. * A new Union::Without helper to remove types from a Union (e.g. after a Smi check). Bug: 42202654 Change-Id: I85f4b007d071d912966e4f00571058e79a3fd70f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6269398 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#98722} | 1 年前 | |
[lookup] Don't wrap primitive Strings in LookupIterator This CL adds new LookupIterator state STRING_LOOKUP_START_OBJECT which allows us to avoid creation of JSPrimitiveWrapper objects for lookups starting from primitive Strings. Bug: 411351391 Change-Id: Id2f2cbbf49ddb9a158bc91dae90edcfe158e2d6b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6607339 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#100608} | 1 年前 | |
[csa] Use CallBuiltin/TailCallBuiltin where possible, pt.8 ... instead of CallStub/TailCallStub(Callable&, ...). This will allow CSA to control which builtin calls/tailcalls what and ensure that propagation of incumbent context through builtins is correct. Drive-by: - introduce code-stub-assembler-inl.h, - make it possible to call CodeAssembler::CallJS() not only with CallTrampoline descriptor (without new_target parameter) but also with JSTrampoline one (with new_target parameter). Bug: v8:14496 Change-Id: I4391d310364d5a134af6647d45817adfa05c845b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5077500 Reviewed-by: Patrick Thier <pthier@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#91431} | 2 年前 | |
[torque] make map field const As an escape hatch, add UnsafeConstCast() to still mutate the map field where necessary. Drive-by change: Refactor NewPromiseReactionJobTask to avoid unsafe allocation and map mutations. Bug: v8:7793 Change-Id: I90e06340c1cf048059b544f1c0a6f730f75d200c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2096675 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/master@{#66766} | 6 年前 | |
[Promise.all] Use FixedArray for "values" There's no need for it to be a JSArray. In the spec it's a List which roughly corresponds to FixedArray (but not JSArray). Gotchas: - There's no good point in time where we know the array length, since resolving might be interleaved with iteration. - Using ExtractFixedArray in places where we don't need to extract, since it takes care of things like allocating the resulting array in the right space etc. Drive-by fix: Previously we pre-allocated an array 1 elements too big, but never noticed it since the last element was the hole. Bug: v8:10506 Change-Id: I6a72fbf1fc0cc031f2c8bad9314c4ed21d544a0f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2202905 Reviewed-by: Shu-yu Guo <syg@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/master@{#67919} | 6 年前 | |
[proxy] Distinguish revocable Proxies Proxies created with the default "new Proxy" constructor are not revocable, and that property is useful for building fast paths for them. So this CL adds a field JSProxy::flags, which is used to annotate Proxies as revocable when applicable. (No actual fast paths are added in this patch.) Bug: 403372470 Change-Id: Ia240eaeadb80369b393a555d9de727ffd727f874 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6593533 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#100561} | 1 年前 | |
[proxy] Distinguish revocable Proxies Proxies created with the default "new Proxy" constructor are not revocable, and that property is useful for building fast paths for them. So this CL adds a field JSProxy::flags, which is used to annotate Proxies as revocable when applicable. (No actual fast paths are added in this patch.) Bug: 403372470 Change-Id: Ia240eaeadb80369b393a555d9de727ffd727f874 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6593533 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#100561} | 1 年前 | |
[handles] Migration to direct handles, part 8 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, asmjs, builtins, codegen, compiler, date, debug, diagnostics, execution, heap, ic, init, interpreter, json, logging, objects, parsing, regexp, runtime, snapshot, strings, wasm. Bug: 42203211 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Change-Id: Ib35bb03997bb4a646c56674f834b952dffdeaf02 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6074945 Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#97624} | 1 年前 | |
[builtins] Use regular SKIP_WRITE_BARRIER We can skip those write barriers because we have Smis here. Using SKIP_WRITE_BARRIER to allow for write barrier verification. Bug: 437096305 Change-Id: I59fecaa017d8a63a39ae4f3b746e7c52e681fa8c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6884742 Commit-Queue: Patrick Thier <pthier@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Auto-Submit: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#102960} | 8 个月前 | |
[regexp] Fix wrong type cast in AdvanceStringIndexSlow For slow RegExp, AdvanceStringIndex can be any number, so the type cast to Smi was wrong. This had no affect on production code, but could cause spurious crashes in debug builds. Fixed: 426068809 Change-Id: Ic5831f688911765f6fb367b5f79a5a892eaf75b9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6656474 Commit-Queue: Jakob Linke <jgruber@chromium.org> Reviewed-by: Jakob Linke <jgruber@chromium.org> Commit-Queue: Patrick Thier <pthier@chromium.org> Auto-Submit: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#100960} | 1 年前 | |
[regexp] Add WebDX counters for RegExp static properties This commit introduces two new UseCounters to track the usage of legacy RegExp static properties for WebDX. - kRegExpStaticProperties: A general counter for legacy static properties on the RegExp constructor. - kRegExpStaticPropertiesWithLastMatch: A more specific counter for properties that depend on the result of the last successful match (i.e., those accessing captures 0 or 1). Bug: 427938674 Change-Id: Ibe69ea2efbd757ba921dc1360a512fec73ac427b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6835868 Auto-Submit: Olivier Flückiger <olivf@chromium.org> Commit-Queue: Olivier Flückiger <olivf@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101831} | 10 个月前 | |
Reland "[contexts] Unify context accessors after ContextCells" This is a reland of commit d2ab66c2a942893b9f6d7628ff8892e1d6a607b3 Changes from original: - The test inspector/debugger/set-breakpoint-after-gc relies on precise garbage collection and may fail if conservative stack scanning is used. We call GC multiple times to ensure the weak reference hold by the script is eventually collected. - Allow reading a ContextCell when printing debug stack frame. Original change's description: > [contexts] Unify context accessors after ContextCells > > The introduction of ContextCells removed the need for special handling > for ScriptContext (which previously used a side table for > let/const tracking and mutable numbers). > > This change refactors the context access logic: > - Internal get/set accessors are now protected to the Context class. > - External access should use the new functions: > - Get/Set: A safe (though potentially slower) > function for accessing elements in any context. > - GetNoCell/SetNoCell: A faster function that verifies the > element being accessed is not a ContextCell. > > Additionally, related bytecode operations and optimizer functions have > been renamed for consistency with these changes. > > Bug: 408128754 > > Change-Id: I785281ab6f13b0ae65578eb5d2f0a5750457ab5e > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6450582 > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Commit-Queue: Victor Gomes <victorgomes@chromium.org> > Cr-Commit-Position: refs/heads/main@{#99844} Bug: 408128754, 40789559 Change-Id: I78a3a99a4f364ed78965fbed56a084d38382d2fc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6479814 Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#99865} | 1 年前 | |
Replace uses of THROW_NEW_ERROR_RETURN_VALUE with THROW_NEW_ERROR Bug: 427539322 Change-Id: I6a6a696438e4c95830605ef043b3fa81948ac42f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6669137 Commit-Queue: Jakob Linke <jgruber@chromium.org> Auto-Submit: Manish Goregaokar <manishearth@google.com> Reviewed-by: Jakob Linke <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#101121} | 1 年前 | |
[handles] Migration to direct handles, part 10 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, ast, builtins, codegen, compiler, d8, debug, deoptimizer, execution, extensions, heap, ic, init, json, logging, objects, parsing, profiler, regexp, runtime, snapshot, wasm. Bug: 42203211 Change-Id: I160d5a74aecc6533db51323f0b96ef057cb22426 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6091534 Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#97865} | 1 年前 | |
[torque] Emit TNode<Union<...>> for Union types ... and propagate this throughought the CSA code, predominantly transitively propagating JSAny. To make this easier, there is additional support for: * Compatibility between torque definitions of types via Unions and C++ definitions of some types (e.g. handling MaybeObject which is a single type in C++ and a Union in torque). We will want to align these more closely in the future. * A new Union::Without helper to remove types from a Union (e.g. after a Smi check). Bug: 42202654 Change-Id: I85f4b007d071d912966e4f00571058e79a3fd70f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6269398 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#98722} | 1 年前 | |
Remove old MAYBE_ prefixed macros Cleanup after https://crrev.com/c/6678531 Bug: 427539322 Change-Id: I6a6a6964dd12cedcffbc44130cd166e2da198779 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6690657 Reviewed-by: Olivier Flückiger <olivf@chromium.org> Commit-Queue: Manish Goregaokar <manishearth@google.com> Cr-Commit-Position: refs/heads/main@{#101209} | 11 个月前 | |
[builtin] StringAdd builtin for mixed-width strings. Fix the StringAdd builtin so it can concatenate a short one-byte and a two-byte string without going to runtime. Change-Id: I0a8b18c800c0bbc189e9f88f68f817535360413a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7124843 Commit-Queue: Erik Corry <erikcorry@chromium.org> Reviewed-by: Jakob Linke <jgruber@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103590} | 7 个月前 | |
Don't call well-known Symbol methods for RegExp on primitive values Following the Normative Change approved by TC39, which states that the RegExp's well-known symbols method should not be executed on primitive values. https://github.com/tc39/ecma262/pull/3009 Fixed: 451217461 Change-Id: Iae42c70ae7067223ff580276f182ab050a365187 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7031243 Reviewed-by: Jakob Linke <jgruber@chromium.org> Commit-Queue: Patrick Thier <pthier@chromium.org> Commit-Queue: Jakob Linke <jgruber@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103211} | 8 个月前 | |
[tsa] Add concurrent builtin compilation for TSA-based builtins Drive-by: Rename some of the builtin macros and functions to be less confusing and more consistent (e.g. the Turboshaft version of TFJ is no longer TSJ but TFJ_TSA). Bug: 348031042 Change-Id: I866a9e724b29b2bd52800e7957d8b127cd915bb4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6781182 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#101687} | 11 个月前 | |
Fix toLocaleUpperCase in non-intl builds The check for required conversion from a 1-byte to a 2-byte string was missing in the specific case where we need to extend the result string and the next character was a 'µ' or 'ÿ' (the only characters with a 1-byte lower-case representation without a 1-byte upper-case representation). Fixed: 461531861 Change-Id: I61fe169b261b7b4aa9e520c1b1af0cf8af0882a3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7178442 Commit-Queue: Patrick Thier <pthier@chromium.org> Auto-Submit: Patrick Thier <pthier@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#103863} | 7 个月前 | |
Revert "Reland "[maglev] Turn add into stringconcat if string input"" This reverts commit f6be4827a049a8c3ea9218934c7bb5728369a3e7. Reason for revert: semantics issues with lazy deopt in tostring Original change's description: > Reland "[maglev] Turn add into stringconcat if string input" > > ... forgot about turbolev > > Bug: 406843931 > > Change-Id: I295bb9c44f318995270a436723689386f55be78d > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6414389 > Reviewed-by: Olivier Flückiger <olivf@chromium.org> > Commit-Queue: Olivier Flückiger <olivf@chromium.org> > Auto-Submit: Toon Verwaest <verwaest@chromium.org> > Commit-Queue: Toon Verwaest <verwaest@chromium.org> > Cr-Commit-Position: refs/heads/main@{#99571} Bug: 406843931 No-Presubmit: true No-Tree-Checks: true No-Try: true Change-Id: Ie3deb4a7694ca869dc51b879c984ebc1cb211656 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6415954 Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#99576} | 1 年前 | |
Remove old MAYBE_ prefixed macros Cleanup after https://crrev.com/c/6678531 Bug: 427539322 Change-Id: I6a6a6964dd12cedcffbc44130cd166e2da198779 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6690657 Reviewed-by: Olivier Flückiger <olivf@chromium.org> Commit-Queue: Manish Goregaokar <manishearth@google.com> Cr-Commit-Position: refs/heads/main@{#101209} | 11 个月前 | |
[casting] Remove Foo::cast Replace Foo::cast with Cast<Foo>. This is, blessedly, the same number of characters, and allows us to remove the need to declare cast functions in every type (instead using instance-type based type checks for most things, and a few template specializations of CastTraits for the remainder). Bug: 345640551 Change-Id: Ic215e2d4519f3128457db8a828a73c18204714bd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5614630 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#94425} | 2 年前 | |
[temporal] Remove old versioning guards Bug: 401065166 Change-Id: I6a6a69647761f4787519fc9bfe7bb144254daf6b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6977394 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Manish Goregaokar <manishearth@google.com> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102714} | 9 个月前 | |
[perfetto] Add V8_USE_PERFETTO_SDK build flag Add a build time flag to use Perfetto SDK header perfetto.h. Refs: https://github.com/nodejs/diagnostics/issues/654 Bug: 457135433 Change-Id: Ifefa3687d7bd7b1f1af78a681bb48ded39f84f57 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7111260 Reviewed-by: Camillo Bruni <cbruni@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Chengzhong Wu <cwu631@bloomberg.net> Cr-Commit-Position: refs/heads/main@{#103565} | 7 个月前 | |
Reland "[contexts] Unify context accessors after ContextCells" This is a reland of commit d2ab66c2a942893b9f6d7628ff8892e1d6a607b3 Changes from original: - The test inspector/debugger/set-breakpoint-after-gc relies on precise garbage collection and may fail if conservative stack scanning is used. We call GC multiple times to ensure the weak reference hold by the script is eventually collected. - Allow reading a ContextCell when printing debug stack frame. Original change's description: > [contexts] Unify context accessors after ContextCells > > The introduction of ContextCells removed the need for special handling > for ScriptContext (which previously used a side table for > let/const tracking and mutable numbers). > > This change refactors the context access logic: > - Internal get/set accessors are now protected to the Context class. > - External access should use the new functions: > - Get/Set: A safe (though potentially slower) > function for accessing elements in any context. > - GetNoCell/SetNoCell: A faster function that verifies the > element being accessed is not a ContextCell. > > Additionally, related bytecode operations and optimizer functions have > been renamed for consistency with these changes. > > Bug: 408128754 > > Change-Id: I785281ab6f13b0ae65578eb5d2f0a5750457ab5e > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6450582 > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Commit-Queue: Victor Gomes <victorgomes@chromium.org> > Cr-Commit-Position: refs/heads/main@{#99844} Bug: 408128754, 40789559 Change-Id: I78a3a99a4f364ed78965fbed56a084d38382d2fc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6479814 Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#99865} | 1 年前 | |
[context] Add ContextCells to FunctionContext Bug: 408128754 Change-Id: I886561ecb126ebb4e236c3c0f73b600c75be8a77 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6508809 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Victor Gomes <victorgomes@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#100351} | 1 年前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
[tsa] Port Add_WithFeedback builtin to TSA Drive-by: Improve error messages when TSA Labels are misused. Some improvements are still todo in a follow-up CL. Bug: 348031042 Change-Id: I4207a363486e5ec363829095357d7b97235a86a3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6806039 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101816} | 10 个月前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
[wasm-custom-desc] JS Interop: wrap methods instead of "stamping" them. The problem we need to solve is that methods installed on prototypes should not ignore the JS-side "receiver" (as regular exported Wasm functions do), but rather pass it on as the first Wasm-side parameter. The previous approach was to set a bit on the exported function to indicate the changed behavior; this CL uses wrapper functions instead, at the cost of slower instantiation. Bug: 403372470 Change-Id: I132e4e5f053de7dc5737b7edaa3b97507084b2c6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6948076 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Daniel Lehmann <dlehmann@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#102516} | 9 个月前 | |
[wasm][shared] Reject shared objects on unshared heap type casts when casting from unshared anyref to unshared (eqref, arrayref, structref), it isn't sufficient to check whether it's a wasm array or wasm struct, the cast also needs to verify that it is unshared as shared types can appear in unshared types due to how externref / anyref works with the JS API and https://github.com/WebAssembly/shared-everything-threads/issues/97 .) Bug: 42204563 Change-Id: I84a08d81649531a6eeb9e6dbf9c75c01047194c5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6494822 Reviewed-by: Manos Koukoutos <manoskouk@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#100028} | 1 年前 | |
[casting] Remove Tagged/Handle<T>::cast(value) Replace them both with Cast<T>(value). Bug: 345640551 Change-Id: Iee0a4b7e084d125cc0f8167d39de2c538469ef69 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5607996 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#94394} | 2 年前 | |
[shared-struct] Remove lockAsync and waitAsync APIs Remove lockAsync and waitAsync experimental APIs. These are not needed right now, they are listed as future work in the TC39 shared structs proposal. Bug: 42202493 Change-Id: I47b93e056c76d20fa3a943a841aeffc4ca5021c2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7139418 Reviewed-by: Olivier Flückiger <olivf@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Luis Pardo <lpardosixtos@microsoft.com> Cr-Commit-Position: refs/heads/main@{#103652} | 7 个月前 | |
Sparkplug+: support patchable baseline code A bytecode handler for an operation is often a generic handler that deal with different types of inputs. This make the baseline compiler to generate a call to a generic builtin for that operation. The generic builtin can deal with all types of inputs, but this makes the builtin very large and introduces a lot of branches to distinguish inputs' types, which hurts the performance. Sparkplug+ introduces some small and specific handlers to deal with one single type of input. For example, this CL introduces some small monomorphic handlers for builtin LoadIC to deal with one specific kind of IC. We will patch the baseline code to use these specific handlers on IC misses dynamically. Bug: chromium:429351411 Change-Id: I85f842ae4050eebbdd8d25d5e113deae743c95d0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6627216 Commit-Queue: Xu, Hao A <hao.a.xu@intel.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103495} | 7 个月前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
[collections] Internalize string keys This reduces lookup cost, and ensures that slice strings used as keys don't leak the underlying buffer. Change-Id: If9ed155aae920fe5e9903f61d3b2cb989e95fb44 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6965654 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Auto-Submit: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#102641} | 9 个月前 | |
[sandbox][leaptiering] Pass dispatch_handle during JS function calls Some callees need to be able to determine the number of arguments passed to them. Due to argument padding, this requires knowledge of both the actual argument count and of the formal parameter count of the invoked function (the number of arguments on the stack is then the maximum of the two). With the sandbox attacker model, it is not safe to load the formal parameter count from within the sandbox. Instead, this CL adds a new parameter to the JS calling convention which contains the JSDispatchHandle that was used to invoke a function. The callee can then simply use that dispatch handle to load the (trusted) parameter count from the JSDispatchTable. Drive-By: add various DCHECKs and static_asserts into places that rely on the JavaScript calling convention. Bug: 40931165, 42204201 Change-Id: I009606c298af2071052c859bfc8b27c5fcc72072 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5907404 Commit-Queue: Samuel Groß <saelo@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#96672} | 1 年前 | |
[sandbox] Disallow implicit unchecked downcasts to trusted objects To soundify C++ types of trusted objects we want to prevent accidentally casting to a trusted object without checking. To that end we enforce the explicit choice of one of three possible casts. * The (existing) TryCast should be used when we already have a type check. This construct ensures that the cast is correct by construction, since the target variable is not assigned if it fails. * The (new) (Checked|Sbx)Cast combines a (SBX)CHECK with a Cast. Replaces SBXCHECK(Is<Foo>(x)); Tagged<Foo> f = Cast<Foo>(x). * The (new) TrustedCast corresponds to Cast on non-trusted objects. The "Trusted" prefix signifies that the correctness obligations are solely on the caller. It should not be used at all if possible. Typically reasonable usecases are: * Reading a field of a trusted object. We trust them to be untampered. * Reading a trusted pointer with a type-tagged handle. The handle ensures correctness. * A visitor where the down-cast is generated by a macro. There is little possiblity for future error and TryCast would be cumbersome and potentially slower. * Low-risk code like debugging, or highly-performance sensitive code where the check is enforced indirectly. DriveBy: Add CastExposedTrustedObjectByTag which ties together the type of a ExposedTrustedObject with its IndirectPointerTag. This prevents the two from getting out of sync. Bug: 435645639 Change-Id: Id283b109ab3e0c3a4503467771bc35f1857fa236 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6859421 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Olivier Flückiger <olivf@chromium.org> Auto-Submit: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#101943} | 10 个月前 | |
[tsa] Add concurrent builtin compilation for TSA-based builtins Drive-by: Rename some of the builtin macros and functions to be less confusing and more consistent (e.g. the Turboshaft version of TFJ is no longer TSJ but TFJ_TSA). Bug: 348031042 Change-Id: I866a9e724b29b2bd52800e7957d8b127cd915bb4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6781182 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#101687} | 11 个月前 | |
[context] Add ContextCells to FunctionContext Bug: 408128754 Change-Id: I886561ecb126ebb4e236c3c0f73b600c75be8a77 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6508809 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Victor Gomes <victorgomes@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#100351} | 1 年前 | |
[maglev] Add Smi/Int32/Float64ToString Bug: 431933185 Change-Id: Ic04a6c2cadbaf622e16941ba565d5f686daa238f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7146401 Reviewed-by: Marja Hölttä <marja@chromium.org> Commit-Queue: Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/main@{#103666} | 7 个月前 | |
[fuzzer] Make undefined double bit pattern unobservable through Wasm When passing JS undefined to f32 or f64 arguments of Wasm functions, the bit pattern of the respective NaN is observable. To avoid false positives from differential fuzzers, we pass a canonical quiet NaN to Wasm when undefined doubles are enabled. This did exist for f64 arguments already, but this CL patches the gap for f32 args. Bug: 461225188 Change-Id: I2245d5b9f9e38c5b1aaacfc7e188bb4027745b92 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7198185 Auto-Submit: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#103938} | 7 个月前 | |
[sandbox] Make ToString(DataViewOp) robust against invalid op enum The switch should have a default case to avoid undefined behavior in case the enum value is outside of its expected range (which can happen in the sandbox attacker model). Bug: 363072481 Change-Id: Ie97fe44bcea0af9a4c3ae68a0f2253833451d56f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5828945 Auto-Submit: Samuel Groß <saelo@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#95921} | 1 年前 | |
[float16array] Add use counter Bug: 42203953 Change-Id: If2a5b4aaa4b2d64e0db90d8b0d7e502dcee86c3a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6271006 Commit-Queue: Shu-yu Guo <syg@chromium.org> Reviewed-by: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/main@{#98767} | 1 年前 | |
Don't pretenure WeakCells Young WeakCells are supported out of the box and there's no correctness need to pretenure them. Having WeakCell allocated as young also simplifies followup planned changes. Bug: 340777103 Change-Id: I45235ae8f82cb48bf5173be0ec05c9a16ba67a1e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6917697 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102333} | 9 个月前 | |
Remove CodeStubArguments::SetArgumentValue The API is somewhat dangerous for the sandbox since it writes directly into the stack. As such, if used incorrectly (e.g. when there is confusion about the number of available arguments), it may cause stack memory corruption. Since the API doesn't seem to be in use at the moment, this CL simply removes it. Bug: 412741811 Change-Id: Ibf972f3aac04f0ec90cddbe076d1f265aa4e028d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6485689 Commit-Queue: Samuel Groß <saelo@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#99914} | 1 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[objects] Port Microtask and Promise classes to StructLayout This CL ports Microtask, PromiseReaction, PromiseCapability, and their subclasses to use the new StructLayout definition. This involves: - Changing Torque definition annotations to @cppObjectLayoutDefinition. - Updating C++ headers to inherit from StructLayout and defining fields using TaggedMember. - Implementing inline accessors using TaggedMember methods. - Updating body descriptors and printers/verifiers. - Updating call sites (mostly in builtins and code stub assembler) to use offsetof() or public accessors. - Refactoring verification logic to use a common MicrotaskVerify method. - Minor modification to format-torque.py to format generates expressions that are close to 80 characters. Bug: 42202654 Change-Id: Ie4b147decc918aa0270b10dee9d0e5c894e90076 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7181923 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103986} | 7 个月前 | |
[tsa] Add concurrent builtin compilation for TSA-based builtins Drive-by: Rename some of the builtin macros and functions to be less confusing and more consistent (e.g. the Turboshaft version of TFJ is no longer TSJ but TFJ_TSA). Bug: 348031042 Change-Id: I866a9e724b29b2bd52800e7957d8b127cd915bb4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6781182 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#101687} | 11 个月前 | |
[regexp] Reland global irregexp mode The revert: https://crrev.com/c/5992796 Since the revert, I've changed the result offsets vector design such that it is again non-moveable. Bug: 372285209 Change-Id: Ib6e3bfa93db0afc33748f8b1dc284f08783bc123 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5998611 Reviewed-by: Patrick Thier <pthier@chromium.org> Auto-Submit: Jakob Linke <jgruber@chromium.org> Commit-Queue: Jakob Linke <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#97036} | 1 年前 | |
[regexp] Reland global irregexp mode The revert: https://crrev.com/c/5992796 Since the revert, I've changed the result offsets vector design such that it is again non-moveable. Bug: 372285209 Change-Id: Ib6e3bfa93db0afc33748f8b1dc284f08783bc123 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5998611 Reviewed-by: Patrick Thier <pthier@chromium.org> Auto-Submit: Jakob Linke <jgruber@chromium.org> Commit-Queue: Jakob Linke <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#97036} | 1 年前 | |
Introduce a PromiseHole Introduce a new PromiseHole that is used exclusively for marking promise resolution. Bug: chromium:1445008 Change-Id: I50bbca1980f1785f4ae937db2d08241e84d1b38a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5003525 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Carl Smith <cffsmith@chromium.org> Cr-Commit-Position: refs/heads/main@{#90734} | 2 年前 | |
Update V8 DEPS (trusted) and reformat Also slightly rewrite a pattern in ic-callable.tq as otherwise the torque formatter script will not reach a stable state. Rolling buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/d51c118..fa96185 Fixed: 347509735 Change-Id: Idc1f81748b0be91804a99b960178d0a86adf11e7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6239632 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/main@{#98554} | 1 年前 | |
[taggedindex|maglev] Update more builtins to transmit feedback slot as TaggedIndex Currently, some builtins use TaggedIndex and some use Uintptr, and it's hard to select the correct one for each builtin. This CL unifies the following builtins to use TaggedIndex: ConstructWithSpread_WithFeedback ConstructWithSpread_Baseline ConstructForwardAllArgs_Baseline Bug: 42200059 Change-Id: I68e522ebc516c75c2d64d46dcd2ea37bb4828676 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5569090 Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/main@{#94071} | 2 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[iterator-helpers] Close receiver on failures In this CL, we close receiver of iterator helpers on argument validation failures. Bug: 381805376 Change-Id: I82c0e09b40c6b78c6c2939edea926063db9642c8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6081111 Reviewed-by: Shu-yu Guo <syg@chromium.org> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Cr-Commit-Position: refs/heads/main@{#98711} | 1 年前 | |
[for-of-performance] Add IC slots to feedback vector This CL adds three slots (one call slot and 2 load slots) to the feedback vector to fasten the ForOf loop on ArrayIterators. Bug: 408061015 Change-Id: I51e1dca0601edf8570132bab04123a4515e08807 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7008254 Reviewed-by: Marja Hölttä <marja@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Cr-Commit-Position: refs/heads/main@{#103993} | 7 个月前 | |
[wasm] ValueType refactoring This changes how we use the bits in the ValueType bit field to store some additional coarse-grained information about the referenced type. The motivation is that this lets us implement subtyping, type union, and type intersection much more efficiently. Bug: 393143505 Change-Id: Ifb49e21c9c8138baa9eabdcdd97dc0541f870510 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6288535 Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#98948} | 1 年前 | |
[objects] Port Microtask and Promise classes to StructLayout This CL ports Microtask, PromiseReaction, PromiseCapability, and their subclasses to use the new StructLayout definition. This involves: - Changing Torque definition annotations to @cppObjectLayoutDefinition. - Updating C++ headers to inherit from StructLayout and defining fields using TaggedMember. - Implementing inline accessors using TaggedMember methods. - Updating body descriptors and printers/verifiers. - Updating call sites (mostly in builtins and code stub assembler) to use offsetof() or public accessors. - Refactoring verification logic to use a common MicrotaskVerify method. - Minor modification to format-torque.py to format generates expressions that are close to 80 characters. Bug: 42202654 Change-Id: Ie4b147decc918aa0270b10dee9d0e5c894e90076 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7181923 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103986} | 7 个月前 | |
[cleanup] remove V8_ENABLE_LEAPTIERING as it's always defined Change-Id: I63421cc19f96e4063178f1ad83b3215f0f2bbbea Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7100740 Reviewed-by: Olivier Flückiger <olivf@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Dan Carney <dcarney@chromium.org> Cr-Commit-Position: refs/heads/main@{#103430} | 8 个月前 | |
[cleanup] remove V8_ENABLE_LEAPTIERING as it's always defined Change-Id: I63421cc19f96e4063178f1ad83b3215f0f2bbbea Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7100740 Reviewed-by: Olivier Flückiger <olivf@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Dan Carney <dcarney@chromium.org> Cr-Commit-Position: refs/heads/main@{#103430} | 8 个月前 | |
[use-counters] Add use counters for some features This adds use counters for: - Array.p.findLast - {Object,Map}.groupBy - Promise.withResolvers - ArrayBuffer.{transfer,transferToFixed} - Atomics.waitAsync Change-Id: Ief9b43ec192e3db146227017990f9475ed2355db Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6020828 Commit-Queue: Shu-yu Guo <syg@chromium.org> Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Cr-Commit-Position: refs/heads/main@{#97211} | 1 年前 | |
[objects] Port Microtask and Promise classes to StructLayout This CL ports Microtask, PromiseReaction, PromiseCapability, and their subclasses to use the new StructLayout definition. This involves: - Changing Torque definition annotations to @cppObjectLayoutDefinition. - Updating C++ headers to inherit from StructLayout and defining fields using TaggedMember. - Implementing inline accessors using TaggedMember methods. - Updating body descriptors and printers/verifiers. - Updating call sites (mostly in builtins and code stub assembler) to use offsetof() or public accessors. - Refactoring verification logic to use a common MicrotaskVerify method. - Minor modification to format-torque.py to format generates expressions that are close to 80 characters. Bug: 42202654 Change-Id: Ie4b147decc918aa0270b10dee9d0e5c894e90076 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7181923 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103986} | 7 个月前 | |
[turboshaft] Use new call descriptor format for runtime calls Bug: 348031042 Change-Id: I1b87db1f9d3da93bf7594aa7a4d21104ddff95d5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7067913 Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Auto-Submit: Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#103285} | 8 个月前 | |
[runtime] Preallocate number strings for [0-100) These values are common in Date fields and quite often being converted to strings. Bug: 411351730 Change-Id: I909ded4e1da94b5fa005e691d0addb53f1a9dfec Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6482069 Reviewed-by: Patrick Thier <pthier@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#99959} | 1 年前 | |
[iterator-helpers] Close receiver on failures In this CL, we close receiver of iterator helpers on argument validation failures. Bug: 381805376 Change-Id: I82c0e09b40c6b78c6c2939edea926063db9642c8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6081111 Reviewed-by: Shu-yu Guo <syg@chromium.org> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Cr-Commit-Position: refs/heads/main@{#98711} | 1 年前 | |
[collections] Internalize string keys This reduces lookup cost, and ensures that slice strings used as keys don't leak the underlying buffer. Change-Id: If9ed155aae920fe5e9903f61d3b2cb989e95fb44 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6965654 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Auto-Submit: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#102641} | 9 个月前 | |
[maps] Derived map cache Cache derived maps for reflect.construct or proxies on the prototype info. This ensures we have a re-usable map for every prototype+ constructor combination. Bug: chromium:1492212, v8:13978 Change-Id: I86caa5bc4277db730bf19fdb31f9092173d27c2b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4943950 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#91451} | 2 年前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
[turbolizer] Display block execution count This CL add a build flag "v8_log_builtins_block_count_input", which could input a builtin PGO raw data and generate .json file for turbolizer with builtin basic block execution count. Change-Id: Iae526001b7c25cb8c24add6303fe3025c8d39b58 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4219941 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Wenqin Yang <wenqin.yang@intel.com> Cr-Commit-Position: refs/heads/main@{#87228} | 3 年前 | |
[api] Avoid species lookup in v8::Promise::{Then,Catch} This aligns the C++ Promise API with the WebIDL specification by using the PerformPromiseThen abstract operation. This avoids species lookups, making the API more robust against monkey-patched Promise constructors and guaranteeing that the API result type can actually be v8::Promise. Drive-by clean up PromiseToLocal into ToLocal with the guaranteed type. Bug: 40050555 Change-Id: I0e1b1415cab4f35d63a0a30cf41d22e915fbe401 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7079568 Reviewed-by: Andreas Haas <ahaas@google.com> Reviewed-by: Olivier Flückiger <olivf@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103373} | 8 个月前 | |
Reland "[contexts] Unify context accessors after ContextCells" This is a reland of commit d2ab66c2a942893b9f6d7628ff8892e1d6a607b3 Changes from original: - The test inspector/debugger/set-breakpoint-after-gc relies on precise garbage collection and may fail if conservative stack scanning is used. We call GC multiple times to ensure the weak reference hold by the script is eventually collected. - Allow reading a ContextCell when printing debug stack frame. Original change's description: > [contexts] Unify context accessors after ContextCells > > The introduction of ContextCells removed the need for special handling > for ScriptContext (which previously used a side table for > let/const tracking and mutable numbers). > > This change refactors the context access logic: > - Internal get/set accessors are now protected to the Context class. > - External access should use the new functions: > - Get/Set: A safe (though potentially slower) > function for accessing elements in any context. > - GetNoCell/SetNoCell: A faster function that verifies the > element being accessed is not a ContextCell. > > Additionally, related bytecode operations and optimizer functions have > been renamed for consistency with these changes. > > Bug: 408128754 > > Change-Id: I785281ab6f13b0ae65578eb5d2f0a5750457ab5e > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6450582 > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Commit-Queue: Victor Gomes <victorgomes@chromium.org> > Cr-Commit-Position: refs/heads/main@{#99844} Bug: 408128754, 40789559 Change-Id: I78a3a99a4f364ed78965fbed56a084d38382d2fc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6479814 Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#99865} | 1 年前 | |
[iterator-helpers] Close receiver on failures In this CL, we close receiver of iterator helpers on argument validation failures. Bug: 381805376 Change-Id: I82c0e09b40c6b78c6c2939edea926063db9642c8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6081111 Reviewed-by: Shu-yu Guo <syg@chromium.org> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Cr-Commit-Position: refs/heads/main@{#98711} | 1 年前 | |
Reland "[contexts] Unify context accessors after ContextCells" This is a reland of commit d2ab66c2a942893b9f6d7628ff8892e1d6a607b3 Changes from original: - The test inspector/debugger/set-breakpoint-after-gc relies on precise garbage collection and may fail if conservative stack scanning is used. We call GC multiple times to ensure the weak reference hold by the script is eventually collected. - Allow reading a ContextCell when printing debug stack frame. Original change's description: > [contexts] Unify context accessors after ContextCells > > The introduction of ContextCells removed the need for special handling > for ScriptContext (which previously used a side table for > let/const tracking and mutable numbers). > > This change refactors the context access logic: > - Internal get/set accessors are now protected to the Context class. > - External access should use the new functions: > - Get/Set: A safe (though potentially slower) > function for accessing elements in any context. > - GetNoCell/SetNoCell: A faster function that verifies the > element being accessed is not a ContextCell. > > Additionally, related bytecode operations and optimizer functions have > been renamed for consistency with these changes. > > Bug: 408128754 > > Change-Id: I785281ab6f13b0ae65578eb5d2f0a5750457ab5e > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6450582 > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Commit-Queue: Victor Gomes <victorgomes@chromium.org> > Cr-Commit-Position: refs/heads/main@{#99844} Bug: 408128754, 40789559 Change-Id: I78a3a99a4f364ed78965fbed56a084d38382d2fc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6479814 Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#99865} | 1 年前 | |
[use-counters] Add counters for recently shipped features This CL adds use counters for array-by-copy, array-from-async, iterator-methods, promise-any, and set-methods. Change-Id: Ie11811f9b5a7c12b8b23417878f0dd1e22218b1b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6012804 Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Reviewed-by: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#97140} | 1 年前 | |
[sandbox][leaptiering] Dispatch table entries for async builtins Drive-By: * Remove AsyncBuiltinsAssembler::InitializeNativeClosure and use AllocateRootFunctionWithContext instead. * Borrow the tricks from the former to make the latter faster (i.e., get the code from the builtin table instead of the sfi and let the caller provide a native context if it is already loaded). * Refactor AsyncBuiltinsAssembler::Await such that we can use AllocateRootFunctionWithContext, which needs to statically know which sfi is used. * Cleanup names. * Fix initialization of the builtins dispatch table when creating an isolate from scratch (needed for some serializer tests). Bug: 40931165, 42204201 Change-Id: I1bce621e932bfe37b3c06a4f6e1b48eab49dd5cb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5803782 Reviewed-by: Samuel Groß <saelo@chromium.org> Reviewed-by: Anton Bikineev <bikineev@chromium.org> Auto-Submit: Olivier Flückiger <olivf@chromium.org> Commit-Queue: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#95752} | 1 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[api] Add Isolate::[Get|Set]ContinuationPreservedEmbedderDataV2() CPED cannot be used with v8::CppHeapExternal because the API only works with v8::Value. To fix this, the current version will be replaced by a V2 API that works with v8::Data, which this CL introduces. The existing API will be deprecated once Chrome has been updated. Bug: chromium:376599402 Change-Id: I7d4b3759b4792a479e186284436b6c3440f43f73 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6506242 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Scott Haseley <shaseley@chromium.org> Cr-Commit-Position: refs/heads/main@{#100161} | 1 年前 | |
[iterator-helpers] Close receiver on failures In this CL, we close receiver of iterator helpers on argument validation failures. Bug: 381805376 Change-Id: I82c0e09b40c6b78c6c2939edea926063db9642c8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6081111 Reviewed-by: Shu-yu Guo <syg@chromium.org> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Cr-Commit-Position: refs/heads/main@{#98711} | 1 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[iterator-helpers] Add accessors for toStringTag and constructor This CL adds setters and getters for toStringTag and constructor properties to resolve iterator helpers web-incompatibility. https://github.com/tc39/proposal-iterator-helpers/pull/287 Bug: v8:13558 Change-Id: I763291e0e5760f445f56de02a26ab982acbb47fb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5089797 Reviewed-by: Shu-yu Guo <syg@chromium.org> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Reviewed-by: Adam Klein <adamk@chromium.org> Cr-Commit-Position: refs/heads/main@{#91457} | 2 年前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
[use-counters] Add more counters for shipped features This CL adds counters for - Promise.try - String.replaceAll - String.{is,to}WellFormed - WeakRef and FinalizationRegistry Bug: 366475997 Change-Id: I868ef8e9d64cc85e9894b87b0d2f7c3147a368e5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6068414 Auto-Submit: Shu-yu Guo <syg@chromium.org> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#97554} | 1 年前 | |
[use-counters] Add use counters for some features This adds use counters for: - Array.p.findLast - {Object,Map}.groupBy - Promise.withResolvers - ArrayBuffer.{transfer,transferToFixed} - Atomics.waitAsync Change-Id: Ief9b43ec192e3db146227017990f9475ed2355db Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6020828 Commit-Queue: Shu-yu Guo <syg@chromium.org> Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Cr-Commit-Position: refs/heads/main@{#97211} | 1 年前 | |
[proxy] Distinguish revocable Proxies Proxies created with the default "new Proxy" constructor are not revocable, and that property is useful for building fast paths for them. So this CL adds a field JSProxy::flags, which is used to annotate Proxies as revocable when applicable. (No actual fast paths are added in this patch.) Bug: 403372470 Change-Id: Ia240eaeadb80369b393a555d9de727ffd727f874 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6593533 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#100561} | 1 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[proxy] Distinguish revocable Proxies Proxies created with the default "new Proxy" constructor are not revocable, and that property is useful for building fast paths for them. So this CL adds a field JSProxy::flags, which is used to annotate Proxies as revocable when applicable. (No actual fast paths are added in this patch.) Bug: 403372470 Change-Id: Ia240eaeadb80369b393a555d9de727ffd727f874 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6593533 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#100561} | 1 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[proxy] Distinguish revocable Proxies Proxies created with the default "new Proxy" constructor are not revocable, and that property is useful for building fast paths for them. So this CL adds a field JSProxy::flags, which is used to annotate Proxies as revocable when applicable. (No actual fast paths are added in this patch.) Bug: 403372470 Change-Id: Ia240eaeadb80369b393a555d9de727ffd727f874 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6593533 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#100561} | 1 年前 | |
[wasm-gc] Fix for-in loops over Wasm objects When we loosened the restrictions that apply to Wasm objects on the JS side, we missed two cases: - for-in loops over a Wasm object do nothing (without throwing). - Reflect.setPrototypeOf returns false (without throwing; contrary to Object.setPrototypeOf, which does throw). Fixed: 450288143 Change-Id: I52022222c11e6bab1fc586b219ca32fcd56dcf83 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7124308 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#103593} | 7 个月前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[torque] Emit TNode<Union<...>> for Union types ... and propagate this throughought the CSA code, predominantly transitively propagating JSAny. To make this easier, there is additional support for: * Compatibility between torque definitions of types via Unions and C++ definitions of some types (e.g. handling MaybeObject which is a single type in C++ and a Union in torque). We will want to align these more closely in the future. * A new Union::Without helper to remove types from a Union (e.g. after a Smi check). Bug: 42202654 Change-Id: I85f4b007d071d912966e4f00571058e79a3fd70f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6269398 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#98722} | 1 年前 | |
Implement getting 'flags' property for RegExp.p.@@match According to the RegExp.prototype[ %Symbol.match% ] spec[1] , it says "4. Let flags be ? ToString(? Get(rx, "flags")).". However, the current implementation of RegExp.prototype[%Symbol.match%] does not get 'flags' from RegExp and leading to related test failures because it does not handle the getter behavior properly. Therefore, implements the to get the flags property in regexp-match.tq to match with -match-all.tq and remove unused FlagGetter functions. [1] https://tc39.es/ecma262/#sec-regexp.prototype-%symbol.match% Bug: v8:13174 Change-Id: I23aaed4130b230c15d201442fb3b503a17cb21f0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6359094 Reviewed-by: Shu-yu Guo <syg@chromium.org> Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Commit-Queue: Seokho Song <seokho@chromium.org> Cr-Commit-Position: refs/heads/main@{#99427} | 1 年前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
Update V8 DEPS (trusted) and reformat Also slightly rewrite a pattern in ic-callable.tq as otherwise the torque formatter script will not reach a stable state. Rolling buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/d51c118..fa96185 Fixed: 347509735 Change-Id: Idc1f81748b0be91804a99b960178d0a86adf11e7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6239632 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/main@{#98554} | 1 年前 | |
[regexp] Remove unused flag getter use counters The compatibility fixes have been standardized. Bug: chromium:581577 Change-Id: I4ab1df59cbcb4bcbcfe9e3a3c658b2d6b81fe68e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2633539 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Adam Klein <adamk@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/master@{#72210} | 5 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
Fix a few TypeError messages The message "Method X called on incompatible receiver Y" should include the receiver, correctly printed as Y, not "undefined". Change-Id: I5d08a98638678b4aafbd60e813c127bf9f78e178 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4877041 Reviewed-by: Marja Hölttä <marja@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#90105} | 2 年前 | |
[regexp] Fix wrong type cast in AdvanceStringIndexSlow For slow RegExp, AdvanceStringIndex can be any number, so the type cast to Smi was wrong. This had no affect on production code, but could cause spurious crashes in debug builds. Fixed: 426068809 Change-Id: Ic5831f688911765f6fb367b5f79a5a892eaf75b9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6656474 Commit-Queue: Jakob Linke <jgruber@chromium.org> Reviewed-by: Jakob Linke <jgruber@chromium.org> Commit-Queue: Patrick Thier <pthier@chromium.org> Auto-Submit: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#100960} | 1 年前 | |
[use-counters] Use @incrementUseCounter in more Torque builtins Also fix torque-format rules for decorators to account for decorators with arguments. Change-Id: If040784ef7080bc5cec132262f4f7878909e3d00 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6050475 Auto-Submit: Shu-yu Guo <syg@chromium.org> Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#97386} | 1 年前 | |
[use-counters] Use @incrementUseCounter in more Torque builtins Also fix torque-format rules for decorators to account for decorators with arguments. Change-Id: If040784ef7080bc5cec132262f4f7878909e3d00 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6050475 Auto-Submit: Shu-yu Guo <syg@chromium.org> Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#97386} | 1 年前 | |
[use-counters] Use @incrementUseCounter in more Torque builtins Also fix torque-format rules for decorators to account for decorators with arguments. Change-Id: If040784ef7080bc5cec132262f4f7878909e3d00 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6050475 Auto-Submit: Shu-yu Guo <syg@chromium.org> Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#97386} | 1 年前 | |
[use-counters] Use @incrementUseCounter in more Torque builtins Also fix torque-format rules for decorators to account for decorators with arguments. Change-Id: If040784ef7080bc5cec132262f4f7878909e3d00 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6050475 Auto-Submit: Shu-yu Guo <syg@chromium.org> Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#97386} | 1 年前 | |
[use-counters] Use @incrementUseCounter in more Torque builtins Also fix torque-format rules for decorators to account for decorators with arguments. Change-Id: If040784ef7080bc5cec132262f4f7878909e3d00 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6050475 Auto-Submit: Shu-yu Guo <syg@chromium.org> Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#97386} | 1 年前 | |
[use-counters] Use @incrementUseCounter in more Torque builtins Also fix torque-format rules for decorators to account for decorators with arguments. Change-Id: If040784ef7080bc5cec132262f4f7878909e3d00 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6050475 Auto-Submit: Shu-yu Guo <syg@chromium.org> Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#97386} | 1 年前 | |
[set-methods] Reload receiver table after getting other This CL fixes the bug of copying receiver table before getting other in union method. Bug: 352690887 Change-Id: I8dd2179848626c2d1bf050f857ff127d567f1242 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6065339 Reviewed-by: Shu-yu Guo <syg@chromium.org> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Cr-Commit-Position: refs/heads/main@{#97553} | 1 年前 | |
[sandbox] Disallow implicit unchecked downcasts to trusted objects To soundify C++ types of trusted objects we want to prevent accidentally casting to a trusted object without checking. To that end we enforce the explicit choice of one of three possible casts. * The (existing) TryCast should be used when we already have a type check. This construct ensures that the cast is correct by construction, since the target variable is not assigned if it fails. * The (new) (Checked|Sbx)Cast combines a (SBX)CHECK with a Cast. Replaces SBXCHECK(Is<Foo>(x)); Tagged<Foo> f = Cast<Foo>(x). * The (new) TrustedCast corresponds to Cast on non-trusted objects. The "Trusted" prefix signifies that the correctness obligations are solely on the caller. It should not be used at all if possible. Typically reasonable usecases are: * Reading a field of a trusted object. We trust them to be untampered. * Reading a trusted pointer with a type-tagged handle. The handle ensures correctness. * A visitor where the down-cast is generated by a macro. There is little possiblity for future error and TryCast would be cumbersome and potentially slower. * Low-risk code like debugging, or highly-performance sensitive code where the check is enforced indirectly. DriveBy: Add CastExposedTrustedObjectByTag which ties together the type of a ExposedTrustedObject with its IndirectPointerTag. This prevents the two from getting out of sync. Bug: 435645639 Change-Id: Id283b109ab3e0c3a4503467771bc35f1857fa236 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6859421 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Olivier Flückiger <olivf@chromium.org> Auto-Submit: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#101943} | 10 个月前 | |
implement Array/String/TypedArray item methods Bug: v8:10961 Change-Id: I79f8410cac1c949100231d4c57dbea0379e88475 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2441128 Commit-Queue: Gus Caplan <snek@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/master@{#71279} | 5 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[string] Add WebDX counter for String.prototype HTML wrapper methods This commit introduces a UseCounter for the String.prototype HTML wrapper methods (e.g., anchor, bold, link) to track their usage as a WebDX feature. Bug: 427938674 Change-Id: I6ec55e0f6b60b4358231e6561e4948e9ac35fdb5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6836368 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#101845} | 10 个月前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
Revert "[string] Remove String::IsOneByteRepresentationUnderneath" This reverts commit e3f33e99674eab3881d2d65b82dfe436829bb831. Reason for revert: https://crbug.com/398999390 This only reverts the fist part of the CL (Removing IsOneByteRepresentation). Using static roots to determine one-byte representation from the map word alone is kept. Original change's description: > [string] Remove String::IsOneByteRepresentationUnderneath > > All string maps are split into one- and two-byte versions, and enforce > that their underlying string must have the same byte width (e.g. we > can't change byteness when externalizing). This means that the old > IsOneByteRepresentationUnderneath loop is no longer needed, as we > already know the byteness from the top. > > Remove this function, replacing with calls to IsOneByteRepresentation. > Additionally, we have some static roots hacks to determine one-byte > representation from the map word alone (without needing to dereference > the instance type), so use that too where possible. > > Change-Id: I662daa3cb217d04cbfd717da53ae1238a0bcddd0 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6011010 > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Patrick Thier <pthier@chromium.org> > Cr-Commit-Position: refs/heads/main@{#97099} DISABLE_SPELLCHECKER Fixed: 398999390 Change-Id: Iee7e88257cb0d23669bcd7571d57b613a413bc29 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6304799 Commit-Queue: Patrick Thier <pthier@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#98942} | 1 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
Don't call well-known Symbol methods for RegExp on primitive values Following the Normative Change approved by TC39, which states that the RegExp's well-known symbols method should not be executed on primitive values. https://github.com/tc39/ecma262/pull/3009 Fixed: 451217461 Change-Id: Iae42c70ae7067223ff580276f182ab050a365187 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7031243 Reviewed-by: Jakob Linke <jgruber@chromium.org> Commit-Queue: Patrick Thier <pthier@chromium.org> Commit-Queue: Jakob Linke <jgruber@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103211} | 8 个月前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
Update V8 DEPS (trusted) and reformat Also slightly rewrite a pattern in ic-callable.tq as otherwise the torque formatter script will not reach a stable state. Rolling buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/d51c118..fa96185 Fixed: 347509735 Change-Id: Idc1f81748b0be91804a99b960178d0a86adf11e7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6239632 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/main@{#98554} | 1 年前 | |
Don't call well-known Symbol methods for RegExp on primitive values Following the Normative Change approved by TC39, which states that the RegExp's well-known symbols method should not be executed on primitive values. https://github.com/tc39/ecma262/pull/3009 Fixed: 451217461 Change-Id: Iae42c70ae7067223ff580276f182ab050a365187 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7031243 Reviewed-by: Jakob Linke <jgruber@chromium.org> Commit-Queue: Patrick Thier <pthier@chromium.org> Commit-Queue: Jakob Linke <jgruber@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103211} | 8 个月前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
Revert "[string] Remove String::IsOneByteRepresentationUnderneath" This reverts commit e3f33e99674eab3881d2d65b82dfe436829bb831. Reason for revert: https://crbug.com/398999390 This only reverts the fist part of the CL (Removing IsOneByteRepresentation). Using static roots to determine one-byte representation from the map word alone is kept. Original change's description: > [string] Remove String::IsOneByteRepresentationUnderneath > > All string maps are split into one- and two-byte versions, and enforce > that their underlying string must have the same byte width (e.g. we > can't change byteness when externalizing). This means that the old > IsOneByteRepresentationUnderneath loop is no longer needed, as we > already know the byteness from the top. > > Remove this function, replacing with calls to IsOneByteRepresentation. > Additionally, we have some static roots hacks to determine one-byte > representation from the map word alone (without needing to dereference > the instance type), so use that too where possible. > > Change-Id: I662daa3cb217d04cbfd717da53ae1238a0bcddd0 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6011010 > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Patrick Thier <pthier@chromium.org> > Cr-Commit-Position: refs/heads/main@{#97099} DISABLE_SPELLCHECKER Fixed: 398999390 Change-Id: Iee7e88257cb0d23669bcd7571d57b613a413bc29 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6304799 Commit-Queue: Patrick Thier <pthier@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#98942} | 1 年前 | |
Fix spelling errors and other pedantry. Change-Id: I1ed7003c7e6f905101c8ab0e7f9a3167d2db3bf6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5797602 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#95727} | 1 年前 | |
[explicit-resource-management] Use ErrorUtil for SuppressedError This CL fixes an issue in SuppressedErrorConstructor when newTarget is undefined. Bug: 42203506, 359747084 Change-Id: I2f65d76109e721ef00530a3c7c5079d950729181 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5750691 Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Reviewed-by: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#95644} | 1 年前 | |
Update V8 DEPS (trusted) and reformat Also slightly rewrite a pattern in ic-callable.tq as otherwise the torque formatter script will not reach a stable state. Rolling buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/d51c118..fa96185 Fixed: 347509735 Change-Id: Idc1f81748b0be91804a99b960178d0a86adf11e7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6239632 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/main@{#98554} | 1 年前 | |
[torque] Remove unused field offset macros Nobody uses the generated *_FIELDS macros anymore, so we can remove them. I also renamed the generated file to represent its content better. Bug: v8:7793 Change-Id: I49ab39e363d6961e7210cd67018b6fb83b65a162 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3192191 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com> Cr-Commit-Position: refs/heads/main@{#77151} | 4 年前 | |
Enable undefined double on bots and make it non-experimental Bug: 385155404 Change-Id: Ib0ee24769f515d70ac9f4f5b4d8ff989e74fe8a2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6939123 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102519} | 9 个月前 | |
[rab/gsab] TypedArray.prototype.at: Support RAB / GSAB Bug: v8:11111 Change-Id: I0e7db9ca74b9d61f2e86581b0cd2f424ad006db9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3151958 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/main@{#76785} | 4 年前 | |
[typed-array] Optimize TypedArray creation from FastJSArray Adds a fast path to the CreateTypedArray builtin for FastJSArray arguments. This avoids the slower generic JSReceiver path, which will first clone the array via its iterator. Bug: 394187289 Change-Id: Iae56bf0077902f64c2084f6fe2a5c998dbb85ff9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6917700 Reviewed-by: Marja Hölttä <marja@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/main@{#102276} | 9 个月前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
Reland "[runtime] Use ThrowCalledNonCallable" This is a reland of commit a11e68f0845a76f1b1c97c9a326d9452bdf68541 Relanding without changes, but instead disabling (crrev.com/c/4595081) and afterward rebaselining (crrev.com/c/4595842) tests in Chromium. Original change's description: > [runtime] Use ThrowCalledNonCallable > > Call the ThrowCalledNonCallable runtime function where appropriate, > rather than the generic ThrowNewError. This ensures that it does the > appropriate call site rendering. > > Change-Id: I25ef5150ce7b87779f7591a18deb1595dac3705f > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4596060 > Auto-Submit: Leszek Swirski <leszeks@chromium.org> > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org> > Reviewed-by: Tobias Tebbi <tebbi@chromium.org> > Cr-Commit-Position: refs/heads/main@{#88112} Change-Id: Id68c68a0315ffd671243b8c57ae62a1f5f50d0ab Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4594631 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#88145} | 3 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
Use FastIterableToList for case source is JSArray in TypedArray.from Current implementation of TypedArray.from misses "a. Let values be ? IteratorToList(? GetIteratorFromMethod(source, usingIterator))." of the spec [1] for JSArray and JSTypedArray and use source directly. The element of JSArray may contain function and it may mutate source before TypedArray.from is finished. In contrast, JSTypedArray contains primitive types, so using source directly is not problematic. Therefore, case JSArray uses iterator::FastIterableToList to create clone of the source which is spec [1] intended if source array is CanCopyElementsFastNumber. [1] https://tc39.es/ecma262/#sec-%typedarray%.from Fixed: 409194177 Change-Id: Ifd88391417b6ca8ef6c1177a1902922f7da39140 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6441662 Commit-Queue: Seokho Song <seokho@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#100015} | 1 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[typedarray] Make [[Set]] on OOB ABs a no-op in TA helpers The StoreJSAny helper macro currently takes a label to jump to when the underlying buffer is detached/out-of-bounds. This macro is split into two instead: - StoreJSAnyInBounds, which dchecks that the store is not OOB - StoreJSAny, which does nothing when storing into an OOB buffer Fixed: 336841825 Change-Id: I9d4d26e5881fbdef1259523f7cfe1a020b1753f2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5486616 Commit-Queue: Shu-yu Guo <syg@chromium.org> Reviewed-by: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/main@{#93590} | 2 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[api] Limit max array buffer size through API. The embedder can intercept and deny large array buffer allocations through the ArrayBuffer Allocator. If allocations above a certain size are always going to be rejected it makes sense to detect this early and throw exceptions rather than cause a fatal OOM in the VM. With this change the embedder can set an upper limit that will be handled more cleanly. Change-Id: I3ab54afe7e203d5b82ce9022ae129702fad61c80 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6098133 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98290} | 1 年前 | |
[api] Limit max array buffer size through API. The embedder can intercept and deny large array buffer allocations through the ArrayBuffer Allocator. If allocations above a certain size are always going to be rejected it makes sense to detect this early and throw exceptions rather than cause a fatal OOM in the VM. With this change the embedder can set an upper limit that will be handled more cleanly. Change-Id: I3ab54afe7e203d5b82ce9022ae129702fad61c80 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6098133 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98290} | 1 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[api] Limit max array buffer size through API. The embedder can intercept and deny large array buffer allocations through the ArrayBuffer Allocator. If allocations above a certain size are always going to be rejected it makes sense to detect this early and throw exceptions rather than cause a fatal OOM in the VM. With this change the embedder can set an upper limit that will be handled more cleanly. Change-Id: I3ab54afe7e203d5b82ce9022ae129702fad61c80 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6098133 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98290} | 1 年前 | |
[change-array-by-copy] Implement toReversed Bug: v8:12764 Change-Id: I7e76647be838749b723400914b144b9ec2a27cd7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3656520 Commit-Queue: Shu-yu Guo <syg@chromium.org> Reviewed-by: Adam Klein <adamk@chromium.org> Cr-Commit-Position: refs/heads/main@{#80703} | 4 年前 | |
[api] Limit max array buffer size through API. The embedder can intercept and deny large array buffer allocations through the ArrayBuffer Allocator. If allocations above a certain size are always going to be rejected it makes sense to detect this early and throw exceptions rather than cause a fatal OOM in the VM. With this change the embedder can set an upper limit that will be handled more cleanly. Change-Id: I3ab54afe7e203d5b82ce9022ae129702fad61c80 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6098133 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98290} | 1 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[change-array-by-copy] Update TA.p.with to current spec Somewhere along the line since the spec draft, argument processing order was changed. Bug: 42202710 Change-Id: I0045741431fbc635eda1ade9a8bfc3d8960d3c76 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6203737 Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#98401} | 1 年前 | |
Update V8 DEPS (trusted) and reformat Also slightly rewrite a pattern in ic-callable.tq as otherwise the torque formatter script will not reach a stable state. Rolling buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/d51c118..fa96185 Fixed: 347509735 Change-Id: Idc1f81748b0be91804a99b960178d0a86adf11e7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6239632 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/main@{#98554} | 1 年前 | |
[wasm-custom-desc] New design for prototype setup This implements an initial version of the new design for installing methods on prototypes that has recently been discussed in the CG: calling a compile-time import from the start function with several arrays containing required data. Bug: 403372470 Change-Id: Ia16c070a2773b433805b8d95763b2cdd4a6048f7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6760393 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#101478} | 11 个月前 | |
Reland "Remove g_thread_in_wasm_code flag" This is a reland of commit 73288e18ba967b06e73cacd8f1659529915e3097 For ASan on Windows, we need more function to run without ASan instrumentation now. Original change's description: > Remove g_thread_in_wasm_code flag > > Keeping track of whether a thread is currently executing Wasm code or > not has become quite complex (see size of this change) and therefore a > maintenance burden. Furthermore, this feature now conflicts with future > V8 sandbox advancements as we want to forbid writes from sandboxed code > (which includes all Wasm code) to out-of-sandbox memory. As such, we can > no longer write to thread-local storage (where the flag was stored). > > This CL replaces the flag with a simpler guarding mechanism that ensures > that the trap handler is robust against nested faults and deadlocks. In > essence, we now set a thread-local flag (only) when entering the trap > handler or taking one of the locks used by it. If the flag is already > set when entering the trap handler, then we bail out immediately as it > means that we're either handling a nested fault (which we shouldn't) or > risk running into a deadlock because the current thread holds one of the > locks required by the trap handler. > > Bug: 350324877, 40192807 > Change-Id: Idb9fce83ac9b46ab04fd93d5bdbd8cb8c0722488 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6650680 > Reviewed-by: Clemens Backes <clemensb@chromium.org> > Reviewed-by: Mark Seaborn <mseaborn@chromium.org> > Commit-Queue: Samuel Groß <saelo@chromium.org> > Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Cr-Commit-Position: refs/heads/main@{#101213} Bug: 350324877, 40192807 Change-Id: I9c5a6b3820181129fa7ed4240831cfc1dbef1697 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6700520 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#101275} | 11 个月前 | |
[objects] Port Microtask and Promise classes to StructLayout This CL ports Microtask, PromiseReaction, PromiseCapability, and their subclasses to use the new StructLayout definition. This involves: - Changing Torque definition annotations to @cppObjectLayoutDefinition. - Updating C++ headers to inherit from StructLayout and defining fields using TaggedMember. - Implementing inline accessors using TaggedMember methods. - Updating body descriptors and printers/verifiers. - Updating call sites (mostly in builtins and code stub assembler) to use offsetof() or public accessors. - Refactoring verification logic to use a common MicrotaskVerify method. - Minor modification to format-torque.py to format generates expressions that are close to 80 characters. Bug: 42202654 Change-Id: Ie4b147decc918aa0270b10dee9d0e5c894e90076 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7181923 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103986} | 7 个月前 | |
[heap] Treat JSWeakRef weakly in Scavenger [1/3] This CL implements weak handling of the target field of JSWeakRef. See design doc at https://docs.google.com/document/d/10u7VbYCVcYBFsyRf5AZ2TV7_2emCNL6JTwt8Z9AHUmA Bug: 340777103 Change-Id: I55c5a7cfc1cd09d26cf7e1ccc022de5e9323f05d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6929546 Commit-Queue: Omer Katz <omerkatz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#102438} | 9 个月前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 1 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 1 个月前 | ||
| 7 个月前 | ||
| 1 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 5 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 2 年前 | ||
| 4 年前 | ||
| 1 年前 | ||
| 4 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 2 年前 | ||
| 8 个月前 | ||
| 8 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 10 个月前 | ||
| 7 个月前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 9 个月前 | ||
| 3 个月前 | ||
| 10 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 3 年前 | ||
| 11 个月前 | ||
| 10 个月前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 7 个月前 | ||
| 8 个月前 | ||
| 6 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 3 年前 | ||
| 1 年前 | ||
| 6 年前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 3 个月前 | ||
| 11 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 8 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 8 个月前 | ||
| 8 个月前 | ||
| 8 个月前 | ||
| 3 年前 | ||
| 3 个月前 | ||
| 1 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 3 个月前 | ||
| 7 个月前 | ||
| 8 个月前 | ||
| 11 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 6 年前 | ||
| 6 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 8 个月前 | ||
| 1 年前 | ||
| 10 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 11 个月前 | ||
| 7 个月前 | ||
| 8 个月前 | ||
| 11 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 11 个月前 | ||
| 2 年前 | ||
| 9 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 3 个月前 | ||
| 10 个月前 | ||
| 1 年前 | ||
| 3 个月前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 10 个月前 | ||
| 11 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 7 个月前 | ||
| 11 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 8 个月前 | ||
| 8 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 8 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 9 个月前 | ||
| 2 年前 | ||
| 3 个月前 | ||
| 3 年前 | ||
| 8 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 3 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 5 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 10 个月前 | ||
| 5 年前 | ||
| 2 年前 | ||
| 10 个月前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 8 个月前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 8 个月前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 4 年前 | ||
| 9 个月前 | ||
| 4 年前 | ||
| 9 个月前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 3 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 4 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 11 个月前 | ||
| 11 个月前 | ||
| 7 个月前 | ||
| 9 个月前 |