| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
Reland^2 "Embedding feedback in BytecodeArray for StrictEqual" This is a reland of commit e295f1f18da01c386eda73f535fb67a56c004d88 Original change's description: > Reland "Embedding feedback in BytecodeArray for StrictEqual" > > This is a reland of commit f0fed41e48b1966e3e565ae278d018da538ef123 > > Original change's description: > > Embedding feedback in BytecodeArray for StrictEqual > > > > This CL removes the feedback vector slot for StrictEqual and stores its feedback values directly in the BytecodeArray. Optimized compilers will now access the type feedback from the BytecodeArray. > > > > Before: > > 75 04 00 TestEqualStrict a1, [0] > > > > After: > > 75 04 00 00 TestEqualStrict a1, #0 > > > > This change saves moemory by reducing FeedbackVector size, and is part of the Sparkplug+ optimization effort. > > > > Bug: chromium:429351411 > > Change-Id: I24390811c12755b0a19beaefe2b0319d75ceaf6c > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6986847 > > Reviewed-by: Xu, Hao A <hao.a.xu@intel.com> > > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#103656} > > Bug: chromium:429351411 > Change-Id: I77286b0e9c65f8a9e257a2125adab7f68fe09aec > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7148333 > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103800} Bug: chromium:429351411 Change-Id: I5020c9dffbed90ff207520728b13cf0dbcfb5903 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7197099 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> Cr-Commit-Position: refs/heads/main@{#103962} | 7 个月前 | |
【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Signed-off-by: Marja Hölttä <marja@chromium.org> | 28 天前 | |
Reland^2 "Embedding feedback in BytecodeArray for StrictEqual" This is a reland of commit e295f1f18da01c386eda73f535fb67a56c004d88 Original change's description: > Reland "Embedding feedback in BytecodeArray for StrictEqual" > > This is a reland of commit f0fed41e48b1966e3e565ae278d018da538ef123 > > Original change's description: > > Embedding feedback in BytecodeArray for StrictEqual > > > > This CL removes the feedback vector slot for StrictEqual and stores its feedback values directly in the BytecodeArray. Optimized compilers will now access the type feedback from the BytecodeArray. > > > > Before: > > 75 04 00 TestEqualStrict a1, [0] > > > > After: > > 75 04 00 00 TestEqualStrict a1, #0 > > > > This change saves moemory by reducing FeedbackVector size, and is part of the Sparkplug+ optimization effort. > > > > Bug: chromium:429351411 > > Change-Id: I24390811c12755b0a19beaefe2b0319d75ceaf6c > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6986847 > > Reviewed-by: Xu, Hao A <hao.a.xu@intel.com> > > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#103656} > > Bug: chromium:429351411 > Change-Id: I77286b0e9c65f8a9e257a2125adab7f68fe09aec > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7148333 > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103800} Bug: chromium:429351411 Change-Id: I5020c9dffbed90ff207520728b13cf0dbcfb5903 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7197099 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> Cr-Commit-Position: refs/heads/main@{#103962} | 7 个月前 | |
【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Signed-off-by: Marja Hölttä <marja@chromium.org> | 28 天前 | |
Reland^2 "Embedding feedback in BytecodeArray for StrictEqual" This is a reland of commit e295f1f18da01c386eda73f535fb67a56c004d88 Original change's description: > Reland "Embedding feedback in BytecodeArray for StrictEqual" > > This is a reland of commit f0fed41e48b1966e3e565ae278d018da538ef123 > > Original change's description: > > Embedding feedback in BytecodeArray for StrictEqual > > > > This CL removes the feedback vector slot for StrictEqual and stores its feedback values directly in the BytecodeArray. Optimized compilers will now access the type feedback from the BytecodeArray. > > > > Before: > > 75 04 00 TestEqualStrict a1, [0] > > > > After: > > 75 04 00 00 TestEqualStrict a1, #0 > > > > This change saves moemory by reducing FeedbackVector size, and is part of the Sparkplug+ optimization effort. > > > > Bug: chromium:429351411 > > Change-Id: I24390811c12755b0a19beaefe2b0319d75ceaf6c > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6986847 > > Reviewed-by: Xu, Hao A <hao.a.xu@intel.com> > > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#103656} > > Bug: chromium:429351411 > Change-Id: I77286b0e9c65f8a9e257a2125adab7f68fe09aec > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7148333 > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103800} Bug: chromium:429351411 Change-Id: I5020c9dffbed90ff207520728b13cf0dbcfb5903 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7197099 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> Cr-Commit-Position: refs/heads/main@{#103962} | 7 个月前 | |
Reland^2 "Embedding feedback in BytecodeArray for StrictEqual" This is a reland of commit e295f1f18da01c386eda73f535fb67a56c004d88 Original change's description: > Reland "Embedding feedback in BytecodeArray for StrictEqual" > > This is a reland of commit f0fed41e48b1966e3e565ae278d018da538ef123 > > Original change's description: > > Embedding feedback in BytecodeArray for StrictEqual > > > > This CL removes the feedback vector slot for StrictEqual and stores its feedback values directly in the BytecodeArray. Optimized compilers will now access the type feedback from the BytecodeArray. > > > > Before: > > 75 04 00 TestEqualStrict a1, [0] > > > > After: > > 75 04 00 00 TestEqualStrict a1, #0 > > > > This change saves moemory by reducing FeedbackVector size, and is part of the Sparkplug+ optimization effort. > > > > Bug: chromium:429351411 > > Change-Id: I24390811c12755b0a19beaefe2b0319d75ceaf6c > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6986847 > > Reviewed-by: Xu, Hao A <hao.a.xu@intel.com> > > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#103656} > > Bug: chromium:429351411 > Change-Id: I77286b0e9c65f8a9e257a2125adab7f68fe09aec > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7148333 > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103800} Bug: chromium:429351411 Change-Id: I5020c9dffbed90ff207520728b13cf0dbcfb5903 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7197099 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> Cr-Commit-Position: refs/heads/main@{#103962} | 7 个月前 | |
【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Signed-off-by: Marja Hölttä <marja@chromium.org> | 28 天前 | |
Reland^2 "Embedding feedback in BytecodeArray for StrictEqual" This is a reland of commit e295f1f18da01c386eda73f535fb67a56c004d88 Original change's description: > Reland "Embedding feedback in BytecodeArray for StrictEqual" > > This is a reland of commit f0fed41e48b1966e3e565ae278d018da538ef123 > > Original change's description: > > Embedding feedback in BytecodeArray for StrictEqual > > > > This CL removes the feedback vector slot for StrictEqual and stores its feedback values directly in the BytecodeArray. Optimized compilers will now access the type feedback from the BytecodeArray. > > > > Before: > > 75 04 00 TestEqualStrict a1, [0] > > > > After: > > 75 04 00 00 TestEqualStrict a1, #0 > > > > This change saves moemory by reducing FeedbackVector size, and is part of the Sparkplug+ optimization effort. > > > > Bug: chromium:429351411 > > Change-Id: I24390811c12755b0a19beaefe2b0319d75ceaf6c > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6986847 > > Reviewed-by: Xu, Hao A <hao.a.xu@intel.com> > > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#103656} > > Bug: chromium:429351411 > Change-Id: I77286b0e9c65f8a9e257a2125adab7f68fe09aec > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7148333 > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103800} Bug: chromium:429351411 Change-Id: I5020c9dffbed90ff207520728b13cf0dbcfb5903 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7197099 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> Cr-Commit-Position: refs/heads/main@{#103962} | 7 个月前 | |
Fix various typos in comments This patch fixes several spelling mistakes in comments across the codebase. R=clemensb@chromium.org Change-Id: I4a2bfaabfc557d5e18d98ec384ec055c44652708 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6998776 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#102901} | 9 个月前 | |
【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Signed-off-by: Marja Hölttä <marja@chromium.org> | 28 天前 | |
third_party: Move valgrind - Move src/third_party_valgrind/ to third_party/valgrind - Add README.v8 Bug: 383356859 Change-Id: I7f6b3471648707c0f40c72d687f4261711056454 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6088199 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Achenbach <machenbach@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#97756} | 1 年前 | |
buganizer: fix component IDs in DIR_METADATA This only matches the old monorail components. Bug: 341800538 Change-Id: Id74fbdb3b9be0c858b77af84966c6c37adf78c5c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6025833 Reviewed-by: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Paul Semel <paulsemel@chromium.org> Commit-Queue: Paul Semel <paulsemel@chromium.org> Cr-Commit-Position: refs/heads/main@{#97252} | 1 年前 | |
[owners] Add olivf@ to codegen No-Try: true Change-Id: I8f7823b705d9daef22d830557fa6d6173a45d534 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5797074 Reviewed-by: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Olivier Flückiger <olivf@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#95713} | 1 年前 | |
Fix most instances of -Wunreachable-code-aggressive. There are still a few cases remaining that seem more controversial; I'll upload those separately. Bug: chromium:1066980 Change-Id: Iabbaf23f9bbe97781857c0c589f2b3db685dfdc2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2994804 Commit-Queue: Peter Kasting <pkasting@chromium.org> Auto-Submit: Peter Kasting <pkasting@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#75494} | 4 年前 | |
Reland "Reland "Reland "[compiler][wasm] Align Frame slots to value size""" This is a reland of 352b9ecbdb090cbb22ee3362fadae28f86ba6773 The test/fix CL has been merged in, as the fixes to return slot accounting are needed to fix Arm64 issues turned up by the fuzzers: https://chromium-review.googlesource.com/c/v8/v8/+/2644139 The reverted fix for Wasm return slot allocation is added in patchset #2, to avoid fuzzer issues that it fixed: https://chromium-review.googlesource.com/c/v8/v8/+/2683024 TBR=neis@chromium.org Original change's description: > Reland "Reland "[compiler][wasm] Align Frame slots to value size"" > > This is a reland of 1694925c728a1be1b7084028bd656ddfc75f6471 > > Minor fix to linkage for constexpr. > > TBR=ahaas@chromium.org,neis@chromium.org > > Original change's description: > > Reland "[compiler][wasm] Align Frame slots to value size" > > > > This is a reland of cddaf66c371c2433c391434776f31b8771c5ab45 > > > > Original change's description: > > > [compiler][wasm] Align Frame slots to value size > > > > > > - Adds an AlignedSlotAllocator class and tests, to unify slot > > > allocation. This attempts to use alignment holes for smaller > > > values. > > > - Reworks Frame to use the new allocator for stack slots. > > > - Reworks LinkageAllocator to use the new allocator for stack > > > slots and for ARMv7 FP register aliasing. > > > - Fixes the RegisterAllocator to align spill slots. > > > - Fixes InstructionSelector to align spill slots. > > > > > > Bug: v8:9198 > > > > > > Change-Id: Ida148db428be89ef95de748ec5fc0e7b0358f523 > > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2512840 > > > Commit-Queue: Bill Budge <bbudge@chromium.org> > > > Reviewed-by: Georg Neis <neis@chromium.org> > > > Reviewed-by: Andreas Haas <ahaas@chromium.org> > > > Cr-Commit-Position: refs/heads/master@{#71644} > > > > Bug: v8:9198 > > Change-Id: Ib91fa6746370c38496706341e12d05c7bf999389 > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2633390 > > Commit-Queue: Bill Budge <bbudge@chromium.org> > > Reviewed-by: Andreas Haas <ahaas@chromium.org> > > Reviewed-by: Georg Neis <neis@chromium.org> > > Cr-Commit-Position: refs/heads/master@{#72195} > > Bug: v8:9198 > Change-Id: I91e02b823af8ec925dacf075388fb22e3eeb3384 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2640890 > Reviewed-by: Bill Budge <bbudge@chromium.org> > Commit-Queue: Bill Budge <bbudge@chromium.org> > Cr-Commit-Position: refs/heads/master@{#72209} Bug: v8:9198 Change-Id: Ia5cf63af4e5991bc7cf42da9972ffd044fc829f0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2733177 Commit-Queue: Bill Budge <bbudge@chromium.org> Reviewed-by: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#73238} | 5 年前 | |
S390x: remove support for s390 32-bit, part 1 s390 has been out of support for a long time now. This CL removes the following from v8 codebase: - V8_TARGET_ARCH_S390 - V8_HOST_ARCH_S390 - V8_TARGET_ARCH_S390_LE_SIM - v8_current_cpu == "s390" - arch == s390 Change-Id: I97d4cafe0be65c91c872466b94dd835f695aaeab Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5857023 Commit-Queue: Milad Farazmand <mfarazma@redhat.com> Reviewed-by: Junliang Yan <junyan@redhat.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#96110} | 1 年前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[riscv] Support architectures with 256-bit vector units Most operations that work for 128-bit vector units automatically work with vector units that have more bits. An earlier CL changed the AVL (application vector length) such that the unit was only working on 128-bits of each vector. This CL furthermore adjusts LMUL. The LMUL can be used to restrict the size of a vector (very similar to what AVL does), or to group multiple adjacent registers into a bigger one. Also, operations that didn't just work are refactored to take the actual vector length into account and provide different implementations. Change-Id: I4e645c3f4fbe73fb4bd942e77668a10ac4152df6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6948289 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Yahan Lu (LuYahan) <yahan@iscas.ac.cn> Reviewed-by: Kasper Lund <kasperl@rivosinc.com> Commit-Queue: Florian Loitsch <floitsch@rivosinc.com> Cr-Commit-Position: refs/heads/main@{#102547} | 9 个月前 | |
PPC: Avoid using the constant pool during Wasm code generation constant pool register is not yet handled during stack switching. More details available under the comment section of https://crrev.com/c/7008594 Change-Id: I6649a7e5768b52eb33acc3ebbb44a6bd638ea224 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7054745 Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Milad Farazmand <mfarazma@ibm.com> Cr-Commit-Position: refs/heads/main@{#103184} | 8 个月前 | |
Reland "[compiler] Support acq/rel accesses and atomic accesses on tagged" This is a reland of faf2208a0b4fd87811fd9cb7923ec0630bd6636e Changes since revert: - Fix arm64 codegen for full pointer mode Original change's description: > [compiler] Support acq/rel accesses and atomic accesses on tagged > > This CL adds an AtomicMemoryOrder parameter to the various atomic load > and store operators. Currently only acquire release (kAcqRel) and > sequentially consistent (kSeqCst) orders are supported. > > Additionally, atomic loads and stores are extended to work with tagged > values. > > This CL is a pre-requisite for supporting atomic accesses in Torque, > which is in turn a pre-requisite for prototyping shared strings. > > Bug: v8:11995 > Change-Id: Ic77d2640e2dc7e5581b1211a054c93210c219355 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3101765 > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Reviewed-by: Zhi An Ng <zhin@chromium.org> > Commit-Queue: Shu-yu Guo <syg@chromium.org> > Cr-Commit-Position: refs/heads/main@{#76393} Bug: v8:11995 Change-Id: I23577486334fec6b08fb3a2f5be1f6e5e16db11b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3107220 Reviewed-by: Zhi An Ng <zhin@chromium.org> Reviewed-by: Adam Klein <adamk@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#76399} | 4 年前 | |
[compiler] Ensure old SFIs stay alive for merging When merging two scripts, we decide whether to use new or old SFIs in one pass over the script info list, and patch old SFIs (in bytecode constant pools) with new ones in another pass. If there is a GC that clears some of the weak script info list pointers between these two passes, then various assumptions break, leading to SFIs in the published result pointing at the wrong script. Make sure that any old SFIs that were encountered in the first pass stay alive for the second pass. Bug: 355575275 Change-Id: I3589bc5169c8a17b32347a1b372773c9f54c6e12 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5786964 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#95631} | 1 年前 | |
Reland "[sandbox] Block sandbox access during SBXCHECK macros" This is a reland of commit a21d19021a726c9357437d68e06085505b4ca4eb Fix: V8_EXPORT_PRIVATE the SandboxHardwareSupport class Original change's description: > [sandbox] Block sandbox access during SBXCHECK macros > > to avoid race conditions. These checks are only enabled in debug builds, > but that should be enough to find potential issues. > > Change-Id: I11a07ac984122e53ba0c261bced7a7486b7858a2 > Cq-Include-Trybots: luci.v8.try:v8_linux64_pku_rel > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5666702 > Commit-Queue: Stephen Röttger <sroettger@google.com> > Reviewed-by: Samuel Groß <saelo@chromium.org> > Reviewed-by: Nikolaos Papaspyrou <nikolaos@chromium.org> > Cr-Commit-Position: refs/heads/main@{#94836} Change-Id: Ibc2ef37fd5e94f4c0510c3ef4702b1f05dd3a1ae Cq-Include-Trybots: luci.v8.try:v8_linux64_pku_rel Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5682062 Reviewed-by: Nikolaos Papaspyrou <nikolaos@chromium.org> Commit-Queue: Stephen Röttger <sroettger@google.com> Reviewed-by: Samuel Groß <saelo@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#94881} | 1 年前 | |
[ignition] Split bytecode index operand types This refactoring replaces the generic kIdx bytecode operand type with more specialized types: kConstantPoolIndex, kFeedbackSlot, kContextSlot, kCoverageSlot, and kAbortReason. Change-Id: I15f86a05f649e3941e5f543d77eba375aa91580c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7208946 Reviewed-by: Patrick Thier <pthier@chromium.org> Commit-Queue: Patrick Thier <pthier@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#104014} | 7 个月前 | |
Rename CodeDataContainer to Code This completes the big Code/CodeDataContainer name shuffle. Bug: v8:13654 Change-Id: If033e9153e751ab0d2a38572da2ce2f7029bc359 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4173569 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Jakob Linke <jgruber@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#85354} | 3 年前 | |
[sparkplug] Upstream Sparkplug Sparkplug is a new baseline, non-optimising second-tier compiler, designed to fit in the compiler trade-off space between Ignition and TurboProp/TurboFan. Design doc: https://docs.google.com/document/d/13c-xXmFOMcpUQNqo66XWQt3u46TsBjXrHrh4c045l-A/edit?usp=sharing Bug: v8:11420 Change-Id: Ideb7270db3d6548eedd8337a3f596eb6f8fea6b1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2667514 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Stanton <mvstanton@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Hannes Payer <hpayer@chromium.org> Cr-Commit-Position: refs/heads/master@{#72686} | 5 年前 | |
Rename Code to InstructionStream .. as part of the big Code/CodeDataContainer name shuffle. In the next step, CodeDataContainer will be renamed to Code. Bug: v8:13654 Change-Id: Ia80ac984d46dd6c2a108098055a5cd60e22a837c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4171628 Auto-Submit: Jakob Linke <jgruber@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#85337} | 3 年前 | |
[disassembler][arm64] Disassemble jump table entries On Arm64, we use position-independent jump table switches unconditionally, however, entries are disassembled as unallocated instructions, rather than jump entries. This is addressed by: - Making the jump-table-info disassembler datastructure available to non-x86 targets, and renames it (and its uses) to be decoupled from builtins. - Implementing Wasm support for jump-table-info metadata. This is preparation CL to eventually enable jump table switches in builtins on Arm64 too, taking care of disassembler support first. Change-Id: I2f146fa9d68c12848c167306a17b13f35c647b25 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6437736 Reviewed-by: Jakob Linke <jgruber@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Pierre Langlois <pierre.langlois@arm.com> Cr-Commit-Position: refs/heads/main@{#99853} | 1 年前 | |
[disassembler][arm64] Disassemble jump table entries On Arm64, we use position-independent jump table switches unconditionally, however, entries are disassembled as unallocated instructions, rather than jump entries. This is addressed by: - Making the jump-table-info disassembler datastructure available to non-x86 targets, and renames it (and its uses) to be decoupled from builtins. - Implementing Wasm support for jump-table-info metadata. This is preparation CL to eventually enable jump table switches in builtins on Arm64 too, taking care of disassembler support first. Change-Id: I2f146fa9d68c12848c167306a17b13f35c647b25 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6437736 Reviewed-by: Jakob Linke <jgruber@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Pierre Langlois <pierre.langlois@arm.com> Cr-Commit-Position: refs/heads/main@{#99853} | 1 年前 | |
Reland "[handles] Migration to direct handles, part 12" This is a reland of commit 5fa54d85a10049a55ba2fa02bc05145ddee7d19a Original change's description: > [handles] Migration to direct handles, part 12 > > This CL migrates a large number of handles to direct handles. The > changes are only relevant for builds with v8_enable_direct_handle=true. > > Affected source directories: api, asmjs, ast, builtins, codegen, > compiler, d8, debug, deoptimizer, diagnostics, execution, extensions, > heap, ic, init, interpreter, json, maglev, objects, parsing, profiler, > regexp, runtime, snapshot, strings, wasm, and tests. > > Bug: 42203211 > Change-Id: I2334b3295e5780e8f52d0b13d1545dce29fcf81e > Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6181904 > Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> > Reviewed-by: Omer Katz <omerkatz@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Cr-Commit-Position: refs/heads/main@{#98240} Bug: 42203211 Change-Id: Ie21acd681c12e7212185d61a19bd858365650204 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6187462 Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#98249} | 1 年前 | |
Reland "[handles] Migration to direct handles, part 12" This is a reland of commit 5fa54d85a10049a55ba2fa02bc05145ddee7d19a Original change's description: > [handles] Migration to direct handles, part 12 > > This CL migrates a large number of handles to direct handles. The > changes are only relevant for builds with v8_enable_direct_handle=true. > > Affected source directories: api, asmjs, ast, builtins, codegen, > compiler, d8, debug, deoptimizer, diagnostics, execution, extensions, > heap, ic, init, interpreter, json, maglev, objects, parsing, profiler, > regexp, runtime, snapshot, strings, wasm, and tests. > > Bug: 42203211 > Change-Id: I2334b3295e5780e8f52d0b13d1545dce29fcf81e > Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6181904 > Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> > Reviewed-by: Omer Katz <omerkatz@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Cr-Commit-Position: refs/heads/main@{#98240} Bug: 42203211 Change-Id: Ie21acd681c12e7212185d61a19bd858365650204 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6187462 Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#98249} | 1 年前 | |
[disassembler][arm64] Disassemble jump table entries On Arm64, we use position-independent jump table switches unconditionally, however, entries are disassembled as unallocated instructions, rather than jump entries. This is addressed by: - Making the jump-table-info disassembler datastructure available to non-x86 targets, and renames it (and its uses) to be decoupled from builtins. - Implementing Wasm support for jump-table-info metadata. This is preparation CL to eventually enable jump table switches in builtins on Arm64 too, taking care of disassembler support first. Change-Id: I2f146fa9d68c12848c167306a17b13f35c647b25 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6437736 Reviewed-by: Jakob Linke <jgruber@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Pierre Langlois <pierre.langlois@arm.com> Cr-Commit-Position: refs/heads/main@{#99853} | 1 年前 | |
[disassembler][arm64] Disassemble jump table entries On Arm64, we use position-independent jump table switches unconditionally, however, entries are disassembled as unallocated instructions, rather than jump entries. This is addressed by: - Making the jump-table-info disassembler datastructure available to non-x86 targets, and renames it (and its uses) to be decoupled from builtins. - Implementing Wasm support for jump-table-info metadata. This is preparation CL to eventually enable jump table switches in builtins on Arm64 too, taking care of disassembler support first. Change-Id: I2f146fa9d68c12848c167306a17b13f35c647b25 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6437736 Reviewed-by: Jakob Linke <jgruber@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Pierre Langlois <pierre.langlois@arm.com> Cr-Commit-Position: refs/heads/main@{#99853} | 1 年前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Signed-off-by: Marja Hölttä <marja@chromium.org> | 28 天前 | |
【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Signed-off-by: Marja Hölttä <marja@chromium.org> | 28 天前 | |
Rework memset methods - Remove the inline assembly snippets for stosl and friends as clang is able to generate better code. - Remove Uint32 and Address versions and instead just rely on the type being assignable. - Add a Relaxed atomic version for cases where we call this concurrently. Relying on the inline assembly meant that this was hidden from TSAN. Change-Id: I14d870378f7f5131408b757abab9e1569c87c49a Bug: 442989225 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6918971 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102359} | 9 个月前 | |
[runtime] Reuse JSFunctions in eval Previously we'd store a native-context specific feedback cell in the eval cache as a way to share info across eval calls (+ sfi of course). This CL changes that to storing the entire JSFunction. When we run the code we'll load the context from the function, and all accesses to the context go through that. This means that the JSFunction[[context]] only needs to be correct on the initial call. So we can reuse the JSFunction and swap the context right before we run eval. Functions that are called are tracked in Call feedback though, so we need to make sure to break consuming that feedback. Otherwise the optimizing compiler might inline whatever context it sees on the function it tracked as the canonical context for that function. This CL updates the heap broker to ignore providing feedback for script-top-level functions (function literal id 0). Change-Id: I0d7aeb654fe9b4e03b6a9922b29078261cce99c3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6556163 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Auto-Submit: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#100334} | 1 年前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
[compiler] Load GetTrustedData once for IsCompiledScope Avoid re-loading the trusted data (and unnecessarily loading the untrusted data) of an SFI for IsCompiledScope for multiple predicates. Instead, load it once and check its map multiple times. Change-Id: I01a409e4c891e8ea03515ac079612096614f7081 Bug: 412587816 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6468892 Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#99839} | 1 年前 | |
[codegen] Split constant pool code for arm64, ppc, and riscv This is purely a refactoring, shuffling code around. No functional changes have been made to the code. The biggest downside to this change is that the code shared between arm64 and riscv have been copied to their respective header files. This is entirely intentional as the riscv parts are about to change to make use of the fact that we're not using 32 bit entries. Change-Id: Ia73e06f5d647428a307540aa19bb1bf252f05e1b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6974673 Commit-Queue: Kasper Lund <kasperl@rivosinc.com> Reviewed-by: Milad Farazmand <mfarazma@ibm.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102693} | 9 个月前 | |
[codegen] Split constant pool code for arm64, ppc, and riscv This is purely a refactoring, shuffling code around. No functional changes have been made to the code. The biggest downside to this change is that the code shared between arm64 and riscv have been copied to their respective header files. This is entirely intentional as the riscv parts are about to change to make use of the fact that we're not using 32 bit entries. Change-Id: Ia73e06f5d647428a307540aa19bb1bf252f05e1b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6974673 Commit-Queue: Kasper Lund <kasperl@rivosinc.com> Reviewed-by: Milad Farazmand <mfarazma@ibm.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102693} | 9 个月前 | |
S390x: remove support for s390 32-bit, part 1 s390 has been out of support for a long time now. This CL removes the following from v8 codebase: - V8_TARGET_ARCH_S390 - V8_HOST_ARCH_S390 - V8_TARGET_ARCH_S390_LE_SIM - v8_current_cpu == "s390" - arch == s390 Change-Id: I97d4cafe0be65c91c872466b94dd835f695aaeab Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5857023 Commit-Queue: Milad Farazmand <mfarazma@redhat.com> Reviewed-by: Junliang Yan <junyan@redhat.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#96110} | 1 年前 | |
[riscv] zicfiss assembler and disassembler Change-Id: I03f413e1a817dd57b3800870085765706081484d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6978248 Commit-Queue: Yahan Lu (LuYahan) <yahan@iscas.ac.cn> Reviewed-by: Clemens Backes <clemensb@chromium.org> Auto-Submit: Yahan Lu (LuYahan) <yahan@iscas.ac.cn> Reviewed-by: Ji Qiu <qiuji@iscas.ac.cn> Cr-Commit-Position: refs/heads/main@{#102715} | 9 个月前 | |
[sandbox] Make CSA_SBXCHECK always a CSA_CHECK In crrev.com/c/6862992 we changed SBXCHECK to always be a CHECK, even if the sandbox is not active. This CL does the same for the CSA variant. Change-Id: I8be06495f50ddcc1720a68ac5596ff9652f2b8b5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7162414 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#103786} | 7 个月前 | |
[serializer] Promote FunctionTemplateInfo to RO space when possible This CL adds v8::FunctionTemplate::SealAndPrepareForPromotionToReadOnly() which is supposed to be called by embedder when the function template is ready and is not going to be modified. In case serializer fails to promote such a template to read only space a CHECK failure will be triggered. Bug: 399393891 Change-Id: Ia8f205a84b5ae427932ca6e9fd25bd04ec596908 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6352058 Reviewed-by: Jakob Linke <jgruber@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#99353} | 1 年前 | |
[serializer] Promote FunctionTemplateInfo to RO space when possible This CL adds v8::FunctionTemplate::SealAndPrepareForPromotionToReadOnly() which is supposed to be called by embedder when the function template is ready and is not going to be modified. In case serializer fails to promote such a template to read only space a CHECK failure will be triggered. Bug: 399393891 Change-Id: Ia8f205a84b5ae427932ca6e9fd25bd04ec596908 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6352058 Reviewed-by: Jakob Linke <jgruber@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#99353} | 1 年前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
[isolate-groups][sandbox] Move the isolate independent part of external reference table into the isolate group. The external reference table has two parts - isolate dependent and isolate independent. Isolate-independent part includes global references which will be moved into isolate group to support multiple sandbox configuration. For example, memory_chunk_metadata_table_address, code_pointer_table_address and etc. This patch moves the global isolate independent part of the external reference table into the isolate group to allow future support for multiple sandbox configuration. Bug: 342905186 Change-Id: I7804a6261500e3bd0ae43f034eccdcfb5b6fd553 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5688991 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Samuel Groß <saelo@chromium.org> Reviewed-by: Andy Wingo <wingo@igalia.com> Commit-Queue: Dmitry Bezhetskov <dima00782@gmail.com> Cr-Commit-Position: refs/heads/main@{#95404} | 1 年前 | |
【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Signed-off-by: Marja Hölttä <marja@chromium.org> | 28 天前 | |
【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Signed-off-by: Marja Hölttä <marja@chromium.org> | 28 天前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
Move code generation related files to src/codegen Bug: v8:9247 TBR=bmeurer@chromium.org,neis@chromium.org NOPRESUBMIT=true Change-Id: Ia1e49d1aac09c4ff9e05d58fab9d08dd71198878 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1621931 Reviewed-by: Yang Guo <yangguo@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Commit-Queue: Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/master@{#61682} | 7 年前 | |
[ignition] CHECK that handler offsets fit in the bitfield Fixed: 443765373 Change-Id: I2be7258463c7787311105b7075f3007197cfccfe Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6943611 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102453} | 9 个月前 | |
[maglev] Lazy deopt on first throw to a so-far unused catch block This allows us to skip emitting code for the catch block entirely. Bug: v8:7700 Change-Id: Ie31da5094d14711aab619b146dabc14d215f0c62 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5516582 Reviewed-by: Victor Gomes <victorgomes@chromium.org> Auto-Submit: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#93735} | 2 年前 | |
Reland "[hole] DCHECK that we don't access the hole map" This is a reland of commit 99f667c6c38669c0f4556e73553987b2da69b2ed Reland fixes: * Put the check behind a flag to make this incremental. * Only check the hole in left-trimming if we can do a value check. Original change's description: > [hole] DCHECK that we don't access the hole map > > Only ever check holes by value, never by map or instance type. This will > allow us to unmap the holes entirely, and use them only as sentinel > values. > > Bug: 434179415 > Change-Id: I3f1eca4049423f39fa10c8761460378d64a92ea3 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6845798 > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Cr-Commit-Position: refs/heads/main@{#102111} Bug: 434179415 Change-Id: Ifbebea894647608b9459dfabf948818909febc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6899264 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102123} | 10 个月前 | |
[wasmfx] Implement tag parameters and returns Pass the tag arguments and returns via a stack buffer. The buffer is immediately unpacked by the receiving stack and never used again, so we don't need to visit the tagged slots within that buffer. The pointer to the buffer is passed as an extra argument to the stack switching builtins, and forwarded to the target stack. On the receiving end: - The suspend builtin returns the pointer received from the resume builtin, - The resume handler uses a new pseudo-instruction to materialize the buffer in a fixed register, similar to how we materialize the exception or the continuation object. Arguments and return values in the initial func ref are not supported yet. R=jkummerow@chromium.org Bug: 388533754 Change-Id: I0618b5f41e3ac9981c7d5e2c1214f3ec87300757 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7170116 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Cr-Commit-Position: refs/heads/main@{#103917} | 7 个月前 | |
[sandbox] Add foundation for hardware sandbox support, part 2 This CL is another step towards a first hardware sandboxing prototype using memory protection keys (PKEYs). This CL: * Executes all JavaScript and WebAssembly code (interpreter and JIT-generated code) in sandboxed execution mode by switching the execution mode in the JSEntry trampolines. * Adds infrastructure to allow specifying the code sandboxing mode on a per-builtin basis. * Leaves sandboxed execution mode when invoking unsandboxed builtins (mostly CPP builtins and WriteBarriers) or runtime functions and re-enters when returning from them. In the future, more and more builtins (and runtime functions) should be marked as sandboxed to avoid the switching overhead and reduce the sandbox attack surface. With this CL, no memory is actually inaccessible in sandboxed execution mode yet as the RegisterOutOfSandboxMemory method isn't yet used. This will happen gradually for more and more memory regions in follow-up CLs. However, this CL already asserts (in debug builds with --debug-code) that the sandboxing mode is as expected on entry to JIT-generated code, when switching the sandboxing mode, and in various builtins. Bug: 350324877 Change-Id: I8d19af796b88ff15fb358445de213eb5dda1d68e Cq-Include-Trybots: luci.v8.try:v8_linux64_pku_dbg,v8_linux64_pku_rel Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6574336 Reviewed-by: Stephen Röttger <sroettger@google.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#100789} | 1 年前 | |
Reland^2 "Embedding feedback in BytecodeArray for StrictEqual" This is a reland of commit e295f1f18da01c386eda73f535fb67a56c004d88 Original change's description: > Reland "Embedding feedback in BytecodeArray for StrictEqual" > > This is a reland of commit f0fed41e48b1966e3e565ae278d018da538ef123 > > Original change's description: > > Embedding feedback in BytecodeArray for StrictEqual > > > > This CL removes the feedback vector slot for StrictEqual and stores its feedback values directly in the BytecodeArray. Optimized compilers will now access the type feedback from the BytecodeArray. > > > > Before: > > 75 04 00 TestEqualStrict a1, [0] > > > > After: > > 75 04 00 00 TestEqualStrict a1, #0 > > > > This change saves moemory by reducing FeedbackVector size, and is part of the Sparkplug+ optimization effort. > > > > Bug: chromium:429351411 > > Change-Id: I24390811c12755b0a19beaefe2b0319d75ceaf6c > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6986847 > > Reviewed-by: Xu, Hao A <hao.a.xu@intel.com> > > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#103656} > > Bug: chromium:429351411 > Change-Id: I77286b0e9c65f8a9e257a2125adab7f68fe09aec > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7148333 > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103800} Bug: chromium:429351411 Change-Id: I5020c9dffbed90ff207520728b13cf0dbcfb5903 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7197099 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> Cr-Commit-Position: refs/heads/main@{#103962} | 7 个月前 | |
[disassembler][arm64] Disassemble jump table entries On Arm64, we use position-independent jump table switches unconditionally, however, entries are disassembled as unallocated instructions, rather than jump entries. This is addressed by: - Making the jump-table-info disassembler datastructure available to non-x86 targets, and renames it (and its uses) to be decoupled from builtins. - Implementing Wasm support for jump-table-info metadata. This is preparation CL to eventually enable jump table switches in builtins on Arm64 too, taking care of disassembler support first. Change-Id: I2f146fa9d68c12848c167306a17b13f35c647b25 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6437736 Reviewed-by: Jakob Linke <jgruber@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Pierre Langlois <pierre.langlois@arm.com> Cr-Commit-Position: refs/heads/main@{#99853} | 1 年前 | |
[disassembler][arm64] Disassemble jump table entries On Arm64, we use position-independent jump table switches unconditionally, however, entries are disassembled as unallocated instructions, rather than jump entries. This is addressed by: - Making the jump-table-info disassembler datastructure available to non-x86 targets, and renames it (and its uses) to be decoupled from builtins. - Implementing Wasm support for jump-table-info metadata. This is preparation CL to eventually enable jump table switches in builtins on Arm64 too, taking care of disassembler support first. Change-Id: I2f146fa9d68c12848c167306a17b13f35c647b25 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6437736 Reviewed-by: Jakob Linke <jgruber@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Pierre Langlois <pierre.langlois@arm.com> Cr-Commit-Position: refs/heads/main@{#99853} | 1 年前 | |
[cleanup][codegen] Remove uses of DISALLOW_COPY_AND_ASSIGN Bug: v8:11074 Change-Id: Ifdd52d501a1d55a2fe176f0995f8c0e7f71ca1fd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2569131 Commit-Queue: Zhi An Ng <zhin@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#71568} | 5 年前 | |
[wasm] Support references in the wasm-to-js wrapper To support references in the generic wasm-to-js wrapper, the GC has to be able to scan incoming tagged parameters. For this the wrapper spills the incoming signature on the stack. The GC can then load the signature during frame scanning and process it to identify tagged parameters and their locations on the stack. The location of parameters on the stack is defined by the CallDescriptor. This CL moves the implementation of the LinkageLocation and the LinkageLocationAllocator so that the GC is able to share code with the CallDescriptor. Bug: v8:14035 Change-Id: I3480159d62b20862318292cac2350bd57305e49f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4738463 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/main@{#89368} | 2 年前 | |
[float16array] Fix fp64->fp16 representation change again The current way of eagerly inserting a NumberToFloat16RawBits node is incorrect, because it is typed as a Number. This means it can be constant folded away with a number constant, which will be the incorrect representation. This CL removes the higher level NumberToFloat16RawBits operator and introduces a MachineRepresentation::kFloat16RawBits for the purposes of representation conversion. As output, it is eagerly changed to a Float64. As input, it is first converted to float64, then truncated to float16, and finally bitcast to a word16. kFloat16RawBits is never used after machine lowering (similar to kMapWord being unused after memory lowering). Machine lowering always lowers uses of kFloat16RawBits to uint16. Fixed: 394327270 Bug: 42203953 Change-Id: I2e3fbc9d5956abbfc89202c004457483f2b51be8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6245152 Commit-Queue: Shu-yu Guo <syg@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#98613} | 1 年前 | |
[float16array] Fix fp64->fp16 representation change again The current way of eagerly inserting a NumberToFloat16RawBits node is incorrect, because it is typed as a Number. This means it can be constant folded away with a number constant, which will be the incorrect representation. This CL removes the higher level NumberToFloat16RawBits operator and introduces a MachineRepresentation::kFloat16RawBits for the purposes of representation conversion. As output, it is eagerly changed to a Float64. As input, it is first converted to float64, then truncated to float16, and finally bitcast to a word16. kFloat16RawBits is never used after machine lowering (similar to kMapWord being unused after memory lowering). Machine lowering always lowers uses of kFloat16RawBits to uint16. Fixed: 394327270 Bug: 42203953 Change-Id: I2e3fbc9d5956abbfc89202c004457483f2b51be8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6245152 Commit-Queue: Shu-yu Guo <syg@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#98613} | 1 年前 | |
[handles] Migrate out-of-stack handles, part 2 This CL explicitly marks out-of-stack handles as IndirectHandle<T>. In particular, it revises: 1. Classes that may be allocated off-stack, containing handles: - AssemblerBase - BackgroundCompileTask - DeoptimizationLiteral - MacroAssemblerBase - OptimizedCompilationInfo - UnoptimizedCompilationInfo - baseline::BaselineCompilerTask - compiler::FrameStateDescriptor - compiler::FrameStateFunctionInfo - compiler::JSOperatorBuilder - compiler::JSToWasmFrameStateDescriptor - compiler::JSToWasmFrameStateFunctionInfo - compiler::ObjectData and derived classes - compiler::ObjectRef and derived classes - compiler::PipelineCompilationJob - compiler::turboshaft::PipelineData - compiler::TFPipelineData - maglev::MaglevCodeGenerator - maglev::MaglevCompilationInfo - maglev::MaglevCompilationJob - wasm::AsyncCompileJob 2. The class compiler::Constant that contains handle addresses. 3. Classes containing vectors (or other data structures) of handles: - ConstantPoolPointerForwarder - wasm::InstanceBuilder 4. Instances of the following templates with handle parameters: - compiler::OpParameter<H> - compiler::Operator1<H> - compiler::ValueMatcher<H, ...> - compiler::OpEqualTo<H> - compiler::OpHash<H> 5. The class SourcePositionTableIterator, which needs not be allocated off-stack. Bug: 372390038 Change-Id: I044372c4e2513caf8c1a6ad72f00368511544e6f Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5934872 Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Omer Katz <omerkatz@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#96739} | 1 年前 | |
[sandbox] Add foundation for hardware sandbox support, part 2 This CL is another step towards a first hardware sandboxing prototype using memory protection keys (PKEYs). This CL: * Executes all JavaScript and WebAssembly code (interpreter and JIT-generated code) in sandboxed execution mode by switching the execution mode in the JSEntry trampolines. * Adds infrastructure to allow specifying the code sandboxing mode on a per-builtin basis. * Leaves sandboxed execution mode when invoking unsandboxed builtins (mostly CPP builtins and WriteBarriers) or runtime functions and re-enters when returning from them. In the future, more and more builtins (and runtime functions) should be marked as sandboxed to avoid the switching overhead and reduce the sandbox attack surface. With this CL, no memory is actually inaccessible in sandboxed execution mode yet as the RegisterOutOfSandboxMemory method isn't yet used. This will happen gradually for more and more memory regions in follow-up CLs. However, this CL already asserts (in debug builds with --debug-code) that the sandboxing mode is as expected on entry to JIT-generated code, when switching the sandboxing mode, and in various builtins. Bug: 350324877 Change-Id: I8d19af796b88ff15fb358445de213eb5dda1d68e Cq-Include-Trybots: luci.v8.try:v8_linux64_pku_dbg,v8_linux64_pku_rel Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6574336 Reviewed-by: Stephen Röttger <sroettger@google.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#100789} | 1 年前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[debug] Only pass SourceLocation in debug in TurboShaft SourceLocation is almost only used for debug messages in TurboShaft, so pass it only in debug mode. Additionally, std::source_location (that it wraps) is a single pointer, so we can efficiently pass it by value rather than const ref. This reduces release build d8 by ~170kb, of which ~4kb is the by-value passing. Change-Id: Ia6b592f094dad0987b8a886bf16a7d3fe8611eb1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6888815 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102072} | 10 个月前 | |
[code] Embed stack slot metadata in instruction stream Move the stack slot metadata from the Code object to the safepoint table part of the instruction stream metadata. This keeps stack slot information coupled with the instruction stream that needs it, making frame iteration robust against mismatches of Code objects and their instruction streams (e.g. due to divergence of embedded builtins and the corresponding heap snapshot). Bug: 377850453 Change-Id: Ic7f2958f3cadcbb11d920dd4533393fb230b3a84 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5999365 Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#97087} | 1 年前 | |
[code] Embed stack slot metadata in instruction stream Move the stack slot metadata from the Code object to the safepoint table part of the instruction stream metadata. This keeps stack slot information coupled with the instruction stream that needs it, making frame iteration robust against mismatches of Code objects and their instruction streams (e.g. due to divergence of embedded builtins and the corresponding heap snapshot). Bug: 377850453 Change-Id: Ic7f2958f3cadcbb11d920dd4533393fb230b3a84 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5999365 Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#97087} | 1 年前 | |
[sandbox] Remove kDefaultCodeEntrypointTag, pt.1 This is a step towards making code entrypoint tag verification strict. This CL - introduces kCodeEntrypointTagForTesting, - introduces CodeKind::FOR_TESTING_JS in addition to existing CodeKind::FOR_TESTING in order to assign them different code entrypoint tags (kJSEntrypointTag for the former and kCodeEntrypointTagForTesting for the latter), - add SBXCHECK for Code object's entrypoint tags when generating calls and tail calls to compile-time known Code objects, - introduce Linkage::GetCPPBuiltinCallDescriptor() - a CEntry call descriptor customized for CPP builtins, - replaces some of the kDefaultCodeEntrypointTag usages with correct tags, - fixes usages of entrypoint tags in various code generation unit tests. Drive-by: - assign proper descriptor for GenericJSToWasmInterpreterWrapper builtin, - make Builtins::CallInterfaceDescriptorFor() work for bytecode handlers, - make switches over CodeKind values case-complete. Bug: 435630464 Change-Id: I2e34666df5314b0cd4e604a4deaf74e2f0de6f1a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6976541 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102733} | 9 个月前 | |
[wasmfx] Add a simple continuation wrapper The purpose of this wrapper is to adapt the 'resume' call interface to the func ref's call interface when we resume a continuation for the first time. It will also be responsible for switching back to the parent stack on return, and forwarding the return values. The current version is very incomplete and is essentially a placeholder: it does not handle arguments, return values, and does not switch stacks yet. The change focuses on supporting the new wrapper kind, compiling it, linking it and calling it. - Compile the continuation wrapper during module compilation and store it in the NativeModule. - During cont.new, initialize the jump buffer's PC to the continuation wrapper. - In resume, load the PC from the target stack and call it. Pass a pointer to the resumed StackMemory as an argument. - In the wrapper, load the func ref from the StackMemory argument and call it. - Add new enum values to represent the new code kind, frame type, and call kind. Bug: 388533754 Change-Id: I3fc0fab044570b5a69f36ff76d417a9c73d6ef68 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6827264 Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#102062} | 10 个月前 | |
Reland "Disallow calling %Optimize... without calling %Prepare..." Previous try: https://chromium-review.googlesource.com/c/v8/v8/+/7030722 Fix: don't change the behavior when --fuzzing is on. Change-Id: Ibe94d23176cf79cfddbe8430b40d056ddcc7f1a1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7036716 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/main@{#103131} | 8 个月前 | |
[handles] Migration to direct handles, part 3 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: ast, baseline, codegen, compiler, d8, diagnostics, extensions, ic, init, interpreter, logging, maglev, parsing, profiler. Bug: 42203211 Change-Id: I3ca12892acfe45f8458d19aa4cbd56ad01842c0a Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5615411 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Cr-Commit-Position: refs/heads/main@{#94363} | 2 年前 | |
S390x: remove support for s390 32-bit, part 1 s390 has been out of support for a long time now. This CL removes the following from v8 codebase: - V8_TARGET_ARCH_S390 - V8_HOST_ARCH_S390 - V8_TARGET_ARCH_S390_LE_SIM - v8_current_cpu == "s390" - arch == s390 Change-Id: I97d4cafe0be65c91c872466b94dd835f695aaeab Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5857023 Commit-Queue: Milad Farazmand <mfarazma@redhat.com> Reviewed-by: Junliang Yan <junyan@redhat.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#96110} | 1 年前 | |
[liftoff] Add some more assumptions In particular, {CountTrailingZeros} can skip a dynamic check if it knows that the input is not zero. R=ahaas@chromium.org Bug: v8:13565, v8:13673 Change-Id: I46d4fea2952d22f57b0695f5db690d6fefd7c1ad Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4212401 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/main@{#85597} | 3 年前 | |
[mips] Remove remaining usages of obsolete V8_TARGET_ARCH_MIPS This define isn't set by any build configuration any more and 32 bit MIPS doesn't seem to be supported by V8. Change-Id: Ic5ca4d247bdfc88f9eb21f09d0bfddb2896d0aa5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6508867 Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn> Auto-Submit: Matthias Liedtke <mliedtke@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#100239} | 1 年前 | |
[deoptimizer][wasm] Support Simd128 values Attention: This CL changes how JavaScript handles double registers! This CL adds support for Simd128 values in the deoptimizer for wasm. Note that wasm deoptimizations are WIP and the current state is only implemented for x64. However, to support Simd128, the deoptimizer needs to know about Simd128 register values which overlap with double register values. So we need to migrate double register value handling to use Simd128 registers instead (meaning the 128 bit registers instead of the 64 bit variants). For JavaScript, this means that we need to move twice the amount of data for the double registers. In most cases: Push the value from the register to the stack, then copy it from the stack to the input FrameDescription, copy it from the FrameDescription to the TranslatedValue, from there into the outgoing FrameDescription and finally from there back into the register (if it's still in a register that is). Bug: 42204618 Change-Id: I7253d037460a095f893cea239d448b1977007d41 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5513446 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#93911} | 2 年前 | |
[cleanup] Use constraints instead of enable_if Run the modernize-use-constraints clang-tidy pass over our code base, with a few post-hoc cleanups around forward declared functions. Change-Id: If6169ce66544d5bab85b1c1a047807859df77bff Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6088210 Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#97727} | 1 年前 | |
[cleanup] Modernize std::*::value and ::type Mechanically replacing std::foo<X>::value with std::foo_v<X>, and the same for ::type -> _t. Change-Id: I543dda07ba4c95534cdcd51f1f438f2626be8273 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6491388 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#99940} | 1 年前 | |
S390x: remove support for s390 32-bit, part 1 s390 has been out of support for a long time now. This CL removes the following from v8 codebase: - V8_TARGET_ARCH_S390 - V8_HOST_ARCH_S390 - V8_TARGET_ARCH_S390_LE_SIM - v8_current_cpu == "s390" - arch == s390 Change-Id: I97d4cafe0be65c91c872466b94dd835f695aaeab Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5857023 Commit-Queue: Milad Farazmand <mfarazma@redhat.com> Reviewed-by: Junliang Yan <junyan@redhat.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#96110} | 1 年前 | |
[cleanup] remove V8_ENABLE_LEAPTIERING as it's always defined Change-Id: I63421cc19f96e4063178f1ad83b3215f0f2bbbea Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7100740 Reviewed-by: Olivier Flückiger <olivf@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Dan Carney <dcarney@chromium.org> Cr-Commit-Position: refs/heads/main@{#103430} | 8 个月前 | |
[cleanup] remove V8_ENABLE_LEAPTIERING as it's always defined Change-Id: I63421cc19f96e4063178f1ad83b3215f0f2bbbea Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7100740 Reviewed-by: Olivier Flückiger <olivf@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Dan Carney <dcarney@chromium.org> Cr-Commit-Position: refs/heads/main@{#103430} | 8 个月前 | |
Reland [deoptimizer] Fix transmitting DeoptimizeReasons Before the fix, GetDeoptInfo returned an unrelated DeoptimizationReason if there was no data associated with the queried_pc. This was because we retrieved data for the nearest pc which was < queried_pc and had data. This fix makes the pc matching exact, so we know whether there is or isn't data associated with queried_pc. Last try: https://chromium-review.googlesource.com/c/v8/v8/+/7003387 Bug: 431933185 Change-Id: Id4af45bf66596bf3107485f7467858c13e91ed08 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7003400 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#102939} | 9 个月前 | |
[code] Embed stack slot metadata in instruction stream Move the stack slot metadata from the Code object to the safepoint table part of the instruction stream metadata. This keeps stack slot information coupled with the instruction stream that needs it, making frame iteration robust against mismatches of Code objects and their instruction streams (e.g. due to divergence of embedded builtins and the corresponding heap snapshot). Bug: 377850453 Change-Id: Ic7f2958f3cadcbb11d920dd4533393fb230b3a84 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5999365 Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#97087} | 1 年前 | |
[code] Embed stack slot metadata in instruction stream Move the stack slot metadata from the Code object to the safepoint table part of the instruction stream metadata. This keeps stack slot information coupled with the instruction stream that needs it, making frame iteration robust against mismatches of Code objects and their instruction streams (e.g. due to divergence of embedded builtins and the corresponding heap snapshot). Bug: 377850453 Change-Id: Ic7f2958f3cadcbb11d920dd4533393fb230b3a84 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5999365 Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#97087} | 1 年前 | |
[code] Embed stack slot metadata in instruction stream Move the stack slot metadata from the Code object to the safepoint table part of the instruction stream metadata. This keeps stack slot information coupled with the instruction stream that needs it, making frame iteration robust against mismatches of Code objects and their instruction streams (e.g. due to divergence of embedded builtins and the corresponding heap snapshot). Bug: 377850453 Change-Id: Ic7f2958f3cadcbb11d920dd4533393fb230b3a84 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5999365 Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#97087} | 1 年前 | |
[compiler] reset script details in functions deserialized from code cache During the serialization of the code cache, V8 would wipe out the host-defined options, so after a script id deserialized from the code cache, the host-defined options need to be reset on the script using what's provided by the embedder when doing the deserializing compilation, otherwise the HostImportModuleDynamically callbacks can't get the data it needs to implement dynamic import(). Change-Id: I33cc6a5e43b6469d3527242e083f7ae6d8ed0c6a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5401780 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Joyee Cheung <joyee@igalia.com> Cr-Commit-Position: refs/heads/main@{#93323} | 2 年前 | |
[cleanup] Modernize std::*::value and ::type Mechanically replacing std::foo<X>::value with std::foo_v<X>, and the same for ::type -> _t. Change-Id: I543dda07ba4c95534cdcd51f1f438f2626be8273 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6491388 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#99940} | 1 年前 | |
Add a is_breakable flag to PositionTableEntry It will be used by the bytecode generator to mark source positions that are not supposed to be breakable by the debugger. This doesn't use the flag yet, that will be done as a follow up to mark mark “iterator.next” calls in for-of bytecode as non-breakable. See go/chrome-devtools:non-breakable-positions-proposal Bug: 407773675 Change-Id: I50103aea6a2954cc34ced4d81fb657b885421093 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6438994 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Simon Zünd <szuend@chromium.org> Commit-Queue: Andres Olivares <andoli@chromium.org> Cr-Commit-Position: refs/heads/main@{#99754} | 1 年前 | |
[maglev] Don't find property load continuations across try-catch blocks The search for polymorphic property load continuations now stops at try-catch boundaries. Previously, it would scan across them, which could cause it to visit the try-block start once in the first continuation, and cause the second continuation to think it's inside the handler. Drive-by, clean-up the predicate around merge points (to be more explicit about loop headers only not having merge points when loop peeling), and DCHECK that the source position table state doesn't change, since there's nothing in the continuation finding that would make it change. Fixed: 449549329 Change-Id: I1a6c0321497a1cecdc774521186ab5abebef3e84 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7011291 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Marja Hölttä <marja@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102971} | 8 个月前 | |
[sandbox] Disallow implicit unchecked downcasts to trusted objects To soundify C++ types of trusted objects we want to prevent accidentally casting to a trusted object without checking. To that end we enforce the explicit choice of one of three possible casts. * The (existing) TryCast should be used when we already have a type check. This construct ensures that the cast is correct by construction, since the target variable is not assigned if it fails. * The (new) (Checked|Sbx)Cast combines a (SBX)CHECK with a Cast. Replaces SBXCHECK(Is<Foo>(x)); Tagged<Foo> f = Cast<Foo>(x). * The (new) TrustedCast corresponds to Cast on non-trusted objects. The "Trusted" prefix signifies that the correctness obligations are solely on the caller. It should not be used at all if possible. Typically reasonable usecases are: * Reading a field of a trusted object. We trust them to be untampered. * Reading a trusted pointer with a type-tagged handle. The handle ensures correctness. * A visitor where the down-cast is generated by a macro. There is little possiblity for future error and TryCast would be cumbersome and potentially slower. * Low-risk code like debugging, or highly-performance sensitive code where the check is enforced indirectly. DriveBy: Add CastExposedTrustedObjectByTag which ties together the type of a ExposedTrustedObject with its IndirectPointerTag. This prevents the two from getting out of sync. Bug: 435645639 Change-Id: Id283b109ab3e0c3a4503467771bc35f1857fa236 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6859421 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Olivier Flückiger <olivf@chromium.org> Auto-Submit: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#101943} | 10 个月前 | |
[maglev] Cap inlining at MaxInliningId Bug: 430572435 Change-Id: I4f20bad6c99e9d3d5a959cb801485dfb117e9884 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6732846 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Auto-Submit: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#101423} | 11 个月前 | |
[compiler] Make TickCounter::TickAndMaybeEnterSafepoint() inlineable This is likely just an issue in non-PGO builds, but it might skew the results locally. JetStream2 seems to profit from this CL. Change-Id: Id70030074dbabf2669fd42fb5fd9399e8692bed6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3716475 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/main@{#81278} | 3 年前 | |
[compiler] Make TickCounter::TickAndMaybeEnterSafepoint() inlineable This is likely just an issue in non-PGO builds, but it might skew the results locally. JetStream2 seems to profit from this CL. Change-Id: Id70030074dbabf2669fd42fb5fd9399e8692bed6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3716475 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/main@{#81278} | 3 年前 | |
[CSA][cleanup] Tnodify builtins-internal-gen Also Tnodifies TryPrototypeChainLookup. Bug: v8:9810 Change-Id: I4950ad3bbcfcf3528589d343282517ee0b57e65f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1906375 Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#64881} | 6 年前 | |
[cleanup] Modernize std::*::value and ::type Mechanically replacing std::foo<X>::value with std::foo_v<X>, and the same for ::type -> _t. Change-Id: I543dda07ba4c95534cdcd51f1f438f2626be8273 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6491388 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#99940} | 1 年前 | |
[turboshaft] Embed AssemblerOpInterface into reducer stack The Assembler no longer inherits directly from both, the ReducerStack and the AssemblerOpInterface, but the latter is part of the former's class hierarchy. This allows reducers to overwrite assembler functions (e.g. builtin reducers can provide a CallBuiltin that doesn't require a FrameState argument). Furthermore: Remove the additional layer of TS-abstraction in the Assembler setup that we introduced when we tried to make the Turboshaft architecture IR independent. NO_IFTTT=Only changed class name inside a comment. Bug: 348031042 Change-Id: If8b9b27a9655102b7c85353a8511482297c7c451 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7167247 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#103808} | 7 个月前 | |
[jumbo] Split CSA_ macros out of code-stub-assembler.h. Putting these in a separate file makes the header more fine-grained -- not everyone who #includes code-stub-assdembler.h needs these. (Along similar lines, this also moves some macros that are only used by a single file to that file directly.) Both these changes fractionally reduce input size to the compiler, too. This also makes it easier/more parallel to undefine these symbols when they're no longer used, which is necessary for the build configuration experiments I'm doing. Bug: none Change-Id: I5e490670d8ab14fc9a22f9f92203b23cda03a93e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5774207 Auto-Submit: Peter Kasting <pkasting@chromium.org> Commit-Queue: Peter Kasting <pkasting@chromium.org> Reviewed-by: Daniel Lehmann <dlehmann@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#95785} | 1 年前 | |
[compiler] Introduce ReusableUnoptimizedCompileState Introduce a ReusableUnoptimizedCompileState class, passed to ParseInfo, which stores a couple of pointers and most importantly the Zone and AstValueFactory of the parse. This allows the Zone and AstValueFactory to be reused across multiple parses, rather than re-initialising per-Parse. With this, we can amend the LazyCompileDispatcher to initialise one LocalIsolate, Zone and AstValueFactory per background thread loop, rather than one per compile task, which allows us to reduce per-task costs and re-use the AstValueFactory's string table and previous String internalizations. Change-Id: Ia0e29c4e31fbe29af57674ebb10916865d38b2ce Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3313106 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#78289} | 4 年前 | |
Reland "[handles] Migration to direct handles, part 12" This is a reland of commit 5fa54d85a10049a55ba2fa02bc05145ddee7d19a Original change's description: > [handles] Migration to direct handles, part 12 > > This CL migrates a large number of handles to direct handles. The > changes are only relevant for builds with v8_enable_direct_handle=true. > > Affected source directories: api, asmjs, ast, builtins, codegen, > compiler, d8, debug, deoptimizer, diagnostics, execution, extensions, > heap, ic, init, interpreter, json, maglev, objects, parsing, profiler, > regexp, runtime, snapshot, strings, wasm, and tests. > > Bug: 42203211 > Change-Id: I2334b3295e5780e8f52d0b13d1545dce29fcf81e > Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6181904 > Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> > Reviewed-by: Omer Katz <omerkatz@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Cr-Commit-Position: refs/heads/main@{#98240} Bug: 42203211 Change-Id: Ie21acd681c12e7212185d61a19bd858365650204 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6187462 Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#98249} | 1 年前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 7 个月前 | ||
| 28 天前 | ||
| 7 个月前 | ||
| 28 天前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 28 天前 | ||
| 7 个月前 | ||
| 9 个月前 | ||
| 28 天前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 4 年前 | ||
| 5 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 9 个月前 | ||
| 8 个月前 | ||
| 4 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 3 年前 | ||
| 5 年前 | ||
| 3 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 28 天前 | ||
| 28 天前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 3 个月前 | ||
| 1 年前 | ||
| 9 个月前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 9 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 3 个月前 | ||
| 1 年前 | ||
| 28 天前 | ||
| 28 天前 | ||
| 3 个月前 | ||
| 7 年前 | ||
| 9 个月前 | ||
| 2 年前 | ||
| 10 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 5 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 10 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 9 个月前 | ||
| 10 个月前 | ||
| 8 个月前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 3 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 8 个月前 | ||
| 8 个月前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 8 个月前 | ||
| 10 个月前 | ||
| 11 个月前 | ||
| 3 年前 | ||
| 3 年前 | ||
| 6 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 4 年前 | ||
| 1 年前 |