Oopenharmony_ciCVE: 497404188
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
CVE: 502300817 Signed-off-by: jiang-qunchao <jiangqunchao@huawei.com> | 10 天前 | |
[ArkWeb][安全][自动提交] 修复 Chromium issue 509268941: 修复 V8: Wasm GC Load Elimination Stale Loop-Phi Replacement Enables V8 Heap-Sandbox Read/Write Signed-off-by: ringking <renkang2@huawei.com> | 10 天前 | |
[wasm-gc] Fix and extend trapping null accesses We extend null-trapping accesses to include array.copy and call_ref, and fix a few related issues. Most importantly, fix issues which prevented tagged loads and stores from emitting out-of-line traps. - Fix {WasmArrayCopyWithChecks} builtin to check against wasm null over JS null. - Fix {WasmArrayCopy} builtin (invoked when array bounds checks are off) to still check against null. - In arm64 and x64 backends, add three instructions each to the list of instructions with memory access mode. For these three instructions as well as {kArchStoreWithWriteBarrier}, emit out-of-line traps if needed. - In arm64 backend, mark write-barrier stores as null-trapping if needed. Bug: v8:7748 Change-Id: I0cccc53e9a356cf18fbfd94ff95ea6b4f454086e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4285906 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/main@{#86042} | 3 年前 | |
buganizer: fix component IDs in DIR_METADATA This only matches the old monorail components. Bug: 341800538 Change-Id: Id74fbdb3b9be0c858b77af84966c6c37adf78c5c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6025833 Reviewed-by: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Paul Semel <paulsemel@chromium.org> Commit-Queue: Paul Semel <paulsemel@chromium.org> Cr-Commit-Position: refs/heads/main@{#97252} | 1 年前 | |
[compiler] Add victorgomes as OWNER Change-Id: I014c9c961a00a050ebad51d6690c70b985199758 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6654959 Commit-Queue: Victor Gomes <victorgomes@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#100897} | 1 年前 | |
[objects] Port EnumCache to StructLayout Port EnumCache to use the new StructLayout definition. This involves: - Changing Torque definition annotation to @cppObjectLayoutDefinition. - Updating C++ headers to inherit from StructLayout and defining fields using TaggedMember. - Implementing inline accessors using TaggedMember methods. - Updating body descriptors and printers/verifiers. - Updating call sites to use offsetof(). Bug: 42202654 Change-Id: I64164300b41f658128219e0561431ad760b4c3fd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7203124 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103948} | 7 个月前 | |
[compiler] Preserve field repr in property array extension Walk the descriptor array in lockstep with the property array when extending the latter. Fixed: 460017370 Change-Id: If0b4fc3c5f62fc0cc373588cbddc3c0a95c7225c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7146166 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#103674} | 7 个月前 | |
Always use acquire load in Map::instance_descriptors Fixed: 448026614, 448850682, 448566463 Change-Id: If1c3b88ee323809536749b3d8f544976d50720a0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7003014 Auto-Submit: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102912} | 9 个月前 | |
[wasm] Proxy-on-Prototype: support non-frozen targets This slightly widens the fast path: we inline Proxy traps in a few more cases where we can safely notice when we need to bail out. Specifically: - For indexed accesses, we can inline the trap when the Proxy's target is the unmodified Array.prototype or Object.prototype, thanks to code dependencies on these prototypes having no elements. - When the Proxy's target is an empty object constructed by a regular JS constructor function, we can install a dependency on this map's stability. Bug: 403372470 Change-Id: I84256bea391ecd5d26b0b9342cd00a502de220e1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6668132 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#101191} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[compiler] fix false positives of --assert-types Type assertions were added as floating nodes, which lead to many false positives as they could be scheduled before protective checks. This CL fixes this by placing the type assertions after the operations that they are checking using an extra schedule. As a drive-by change, this also removes the need for FoldConstant, and earlier incomplete workaround for the same issue. Fixed: chromium:1425711, chromium:1423602, chromium:1411156 Change-Id: I082b1bd5dd5649223bb99054f32d6ae3da89203f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4370027 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#86695} | 3 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[compiler] Remove unused BasicBlockInstrumentor Change-Id: I919506a1a407daf36a7170e6d4ee3636573b0cfa Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7093518 Reviewed-by: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103379} | 8 个月前 | |
[compiler] Remove unused BasicBlockInstrumentor Change-Id: I919506a1a407daf36a7170e6d4ee3636573b0cfa Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7093518 Reviewed-by: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103379} | 8 个月前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[interpreter] Improve bytecode disassembler output Pass the constant pool to the bytecode decoder, so that constants can be printed as part of the bytecode itself. Also improve printing of the new split index types. Change-Id: Ia65149765b03a8d2665810b1d377e5b497600d15 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7209311 Commit-Queue: Patrick Thier <pthier@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#104020} | 7 个月前 | |
[compiler] Store LoopInfos in a sorted vector Rather than a reasonably heavyweight std::map mapping loop header offsets to LoopInfo, store LoopInfo in a more cache-friendly std::vector, sorted by loop header offset, and binary search for it. Since loops are collected in a reverse bytecode walk, maintaining a header-order sorted list would initially be quite inefficient, since most loops would end up getting inserted close to the start of the vector. So, we first keep a list in visitation order, and only after the first pass of analysis completes do we sort it in header order. Drive-by, add an emplace method to ZoneVector for emplacing in a concrete location -- not used here (used in a previous version of this patch) but still useful. Change-Id: I9dbe9bd77eb4331a71642b96b8e6c1119310e484 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6722272 Reviewed-by: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101348} | 11 个月前 | |
[ignition] Split bytecode index operand types This refactoring replaces the generic kIdx bytecode operand type with more specialized types: kConstantPoolIndex, kFeedbackSlot, kContextSlot, kCoverageSlot, and kAbortReason. Change-Id: I15f86a05f649e3941e5f543d77eba375aa91580c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7208946 Reviewed-by: Patrick Thier <pthier@chromium.org> Commit-Queue: Patrick Thier <pthier@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#104014} | 7 个月前 | |
[sandbox] Add some hardening around parameter counts in src/compiler The JSDispatchTable is used to ensure that callee and caller agree on the signature during a JS function call. This works by making sure that the parameter count of a dispatch entry always matches the parameter count of the code installed in it. This in turn relies on the parameter count reported by the Code object. As such, during compilation we need to make sure that the parameter_count reported by the produced Code object matches the parameter count used/expected by the generated code. Otherwise, we may still end up with (effectively) signature mismatches. This CL adds a few defense-in-depth CHECKs for that purpose. Bug: 40931165 Change-Id: I776258ba3ac42884f6363134a07e5f8389fec2e4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6031884 Reviewed-by: Olivier Flückiger <olivf@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#97285} | 1 年前 | |
[compiler] Make accumulator index 0 in liveness bitvectors Previously, the accumulator was at the end of liveness bitvectors, which meant that checking for accumulator liveness required a length lookup. This CL moves it to the start of the bitvector, with registers starting at index 1 -- the assumption is that the addition of 1 to the index on register liveness access can be constant folded away. As a cleanup, replace all the custom liveness printing code with a single unified ToString. This places the accumulator at the end of the printed liveness, to avoid having to change test expectations (also, the position of the accumulator is now an implementation detail). As a similar cleanup, change StateValue node building to use the BytecodeLivenessState interface rather than the underlying bitvector. These two cleanups allow us to remove the raw bitvector accessor from liveness entirely. Change-Id: Ic2744b5e8e16b8527e6a4e8d3b4ddad7096289d9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3455144 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/main@{#79066} | 4 年前 | |
[zone] Rename Zone::NewArray to Zone::AllocateArray The function does not construct the objects in the array and therefore is not comparable to new T[length] in C++. Follow-up change for renaming NewVector: https://crrev.com/c/4685550 Change-Id: I0db92dae2895bbb1162a3f7a483025ca89adf819 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4686973 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#88985} | 2 年前 | |
[sandbox] Remove kDefaultCodeEntrypointTag, pt.1 This is a step towards making code entrypoint tag verification strict. This CL - introduces kCodeEntrypointTagForTesting, - introduces CodeKind::FOR_TESTING_JS in addition to existing CodeKind::FOR_TESTING in order to assign them different code entrypoint tags (kJSEntrypointTag for the former and kCodeEntrypointTagForTesting for the latter), - add SBXCHECK for Code object's entrypoint tags when generating calls and tail calls to compile-time known Code objects, - introduce Linkage::GetCPPBuiltinCallDescriptor() - a CEntry call descriptor customized for CPP builtins, - replaces some of the kDefaultCodeEntrypointTag usages with correct tags, - fixes usages of entrypoint tags in various code generation unit tests. Drive-by: - assign proper descriptor for GenericJSToWasmInterpreterWrapper builtin, - make Builtins::CallInterfaceDescriptorFor() work for bytecode handlers, - make switches over CodeKind values case-complete. Bug: 435630464 Change-Id: I2e34666df5314b0cd4e604a4deaf74e2f0de6f1a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6976541 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102733} | 9 个月前 | |
[turbofan] Don't expect framestate input to be a Framestate It could also be a DeadValue. A regression test will take a while but the fix is straightforward. Bug: chromium:1027045 Change-Id: I49a66668b7189b7ea7d6d79d514b9e0de3edc966 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1928853 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#65094} | 6 年前 | |
Remove some unused includes (3) Mostly src/codegen, src/compiler, src/snapshot, src/utils. Bug: v8:13006 Change-Id: I2fb31acc749a7376e6f2a7424ed2e67ff479d971 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3749178 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#81575} | 3 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
Merge: Update EmbeddedFeedback with unaligned load/store (cherry picked from commit 3ab87be5440bd603c79db3425752a0edbf26ad66) Change-Id: Id2647a2710fa9aafa6a2c97063b24756e4e41530 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7234874 Commit-Queue: Liu Yu <liuyu@loongson.cn> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#104219} Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7264345 Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Reviewed-by: Lutz Vahl <vahl@chromium.org> Commit-Queue: Lutz Vahl <vahl@chromium.org> Auto-Submit: Lutz Vahl <vahl@chromium.org> Owners-Override: Lutz Vahl <vahl@chromium.org> Cr-Commit-Position: refs/branch-heads/14.4@{#24} Cr-Branched-From: 80acc26727d5a34e77dabeebe7c9213ec1bd4768-refs/heads/14.4.258@{#1} Cr-Branched-From: ce7e597e90f6df3fa4b6df224bc613b80c635450-refs/heads/main@{#104020} | 6 个月前 | |
Merge: Update EmbeddedFeedback with unaligned load/store (cherry picked from commit 3ab87be5440bd603c79db3425752a0edbf26ad66) Change-Id: Id2647a2710fa9aafa6a2c97063b24756e4e41530 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7234874 Commit-Queue: Liu Yu <liuyu@loongson.cn> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#104219} Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7264345 Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Reviewed-by: Lutz Vahl <vahl@chromium.org> Commit-Queue: Lutz Vahl <vahl@chromium.org> Auto-Submit: Lutz Vahl <vahl@chromium.org> Owners-Override: Lutz Vahl <vahl@chromium.org> Cr-Commit-Position: refs/branch-heads/14.4@{#24} Cr-Branched-From: 80acc26727d5a34e77dabeebe7c9213ec1bd4768-refs/heads/14.4.258@{#1} Cr-Branched-From: ce7e597e90f6df3fa4b6df224bc613b80c635450-refs/heads/main@{#104020} | 6 个月前 | |
[compiler] Store isolate_address as ID in ExternalReference So far ExternalReference stored isolate-relative addresses as absolute addresses. These absolute addresses got converted to offsets for root-relative loads with pointer arithmetic. However, for this pointer arithmetic a valid isolate was needed, which is not available e.g. in WebAssembly compilation. This CL is a first step to allow to store IDs in the ExternalReference. At the moment only the isolate_address() is handled with the IsolateDataId, but other isolate-relative address should follow eventually. Bug: 349952800 Change-Id: I31bc38f91cb87a59a66000e8be11fa49eda0f1d7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5645078 Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/main@{#94815} | 1 年前 | |
Reland^2 "[hole] Remove hole raw number value" This is a reland of commit b998e975fc46f94d8f073c2e7b859e611a313786 Reland changes: * Only check Operator class tag in non-component builds, because of dynamic linker issues. Original change's description: > Reland "[hole] Remove hole raw number value" > > This is a reland of commit 47ac4aacc9726e35627b584cdb5c25aa6d1c754c > > Reland changes: > * Correctly load the Float64 instead of double parameter when > processing Float64Constant. > * Add debug checking to OpParameter which ensures that parameter > loads use the correct type. > > Original change's description: > > [hole] Remove hole raw number value > > > > Holes should, in general, not flow through code as values that need to > > be read. In particular, we should never perform a JS ToNumber operation > > on a Hole, since holes are not JS-visible values. > > > > Historically, holes were considered a form of oddball, and oddballs > > _did_ have ToNumber handling (by reading their raw number offset as if > > they were a HeapNumber), and in a few cases we ended up being sloppy and > > allowed Holes to go through the same path (to read the hole NaN value on > > array initialization or elements kinds transitions). > > > > However, in such cases, we _know_ that we are looking for the hole, and > > we _know_ that we actually want the hole NaN. So, we can be explicit > > about this, with the benefit that we can avoid the hole constant load > > and read from its raw number field, and instead can embed the hole NaN > > float64 constant where needed. > > > > This required a few changes to Float64Constant encoding in TurboFan > > (using an integer bit encoding rather than a double, to avoid losing the > > special NaN bits), and a few adjustments to representation changing > > which are explicit that we are converting a NumberOrHole rather than > > NumberOrOddball when changing a HOLEY_SMI_ELEMENTS array to > > HOLEY_DOUBLE_ELEMENTS. > > > > With these changes, we can remove the raw number field from Holes > > entirely. > > > > Bug: 434179415 > > Change-Id: I4d158466dcdcad9f676e6ba7dc1d6cb6e817d440 > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6786712 > > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#101712} > > Bug: 434179415 > Change-Id: Ic0995bdf4b0d050db645aa6c7899e5e2ec1ea38c > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6811578 > Auto-Submit: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#101758} Cq-Include-Trybots: luci.v8.try:v8_win64_dbg Bug: 434179415 Change-Id: Ia11950c24e29e69acc772aea45f1e3aa3ef2c76e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6821533 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101779} | 10 个月前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[compiler] Add %MajorGCForCompilerTesting intrinsic So far, the way to invoke GCs from JS was to use gc() in combination with --expose-gc. However, this was leading to GC calls being generic runtime calls in the optimizing compilers, which was blocking all kind of optimizations. As such, weird tricks had to be used in order to repro GC timing issues, cf the repros in https://crrev.com/c/7184739 (which this CL nicely simplifies). The new %MajorGCForCompilerTesting intrinsic is marked as no-read no-write in Turbofan, Turboshaft and Maglev, which means that it won't block any optimizations and will allow to more easily fuzz and repro GC-timing-related bugs. Change-Id: I66cb03c77f350880b2667ca5ae44ab823ddb8f34 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7198340 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103914} | 7 个月前 | |
[compiler] Add %MajorGCForCompilerTesting intrinsic So far, the way to invoke GCs from JS was to use gc() in combination with --expose-gc. However, this was leading to GC calls being generic runtime calls in the optimizing compilers, which was blocking all kind of optimizations. As such, weird tricks had to be used in order to repro GC timing issues, cf the repros in https://crrev.com/c/7184739 (which this CL nicely simplifies). The new %MajorGCForCompilerTesting intrinsic is marked as no-read no-write in Turbofan, Turboshaft and Maglev, which means that it won't block any optimizations and will allow to more easily fuzz and repro GC-timing-related bugs. Change-Id: I66cb03c77f350880b2667ca5ae44ab823ddb8f34 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7198340 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103914} | 7 个月前 | |
[maglev] Fix const string concatenating The corresponding logic in TF checks against the max string length early, so Maglev must too, Fixed: 429656023 Bug: 428882137 Change-Id: I9fbdb3a0d833fa5f41caadf217417aa0309d8e11 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6703669 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by: Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/main@{#101287} | 11 个月前 | |
[maglev] Fix const string concatenating The corresponding logic in TF checks against the max string length early, so Maglev must too, Fixed: 429656023 Bug: 428882137 Change-Id: I9fbdb3a0d833fa5f41caadf217417aa0309d8e11 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6703669 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by: Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/main@{#101287} | 11 个月前 | |
[wasm-custom-desc] Store immediate supertype on Map This patch overlays the Map::dependent_code slot, which is unused for Wasm objects, to store the immediate supertype RTT on maps for types with custom descriptors. That makes the supertype faster to access, which speeds up type checks. Bug: 403372470 Change-Id: I32a0d9c01140aa1571576be3e6030d8b23e121bf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7045131 Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Daniel Lehmann <dlehmann@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#103242} | 8 个月前 | |
[typed array length loading] Switch to a protector-free approach Instead, check whether we're calling the TypedArrayLength builtin and create the special TypedArrayLength AccessInfo based on that. This CL removes the typed array length protector and the associated tests, but the typed-array-length-custom-*.js tests ensure that typed array length loading works correctly without the protector. Bug: 388844115 Change-Id: Ia42261cc457835d0166293e43962256b97faa8fd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6574425 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/main@{#100450} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Prevent creation of unexpected Hole constant nodes Prevent creation of Hole constant nodes during Turbofan graph creation in places where we don't expect them. Bug: chromium:1486789 Change-Id: Iff09a22b9d32a65fc4ebcfd80b6913a822e3101e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4892848 Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Carl Smith <cffsmith@google.com> Cr-Commit-Position: refs/heads/main@{#90467} | 2 年前 | |
[cleanup] Replace DISALLOW_COPY_AND_ASSIGN with deleted functions Bug: v8:11074 Change-Id: I6d58d523254915a6b0d6542d8f80ddc6cee71dee Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2520907 Reviewed-by: Zhi An Ng <zhin@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/master@{#71003} | 5 年前 | |
[compiler] Fix asan issue Using an element of a container after removing it causes a "container- overflow" asan error. Change-Id: Ic94a810cd2d97521a796d8a5ce1295bca2cdd935 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4747083 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/main@{#89393} | 2 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[cleanup] Modernize std::*::value and ::type Mechanically replacing std::foo<X>::value with std::foo_v<X>, and the same for ::type -> _t. Change-Id: I543dda07ba4c95534cdcd51f1f438f2626be8273 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6491388 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#99940} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[tagged] Make FixedArray a HeapObjectLayout class Move TaggedArrayBase and all its subclasses to be C++ object definitions, inheriting from HeapObjectLayout. The TaggedArrayBase holds both the length/capacity and the elements, with subclasses not expected (or able) to hold extra fields -- the Shape can include an ExtraFields mixin class for subclasses that need extra fields (like ArrayList), which is injected using template magic between the length/capacity and elements. This requires some extensions to the C++ object layout capability: * Adding a TrustedObjectLayout for starting to port over TrustedObjects, since some TaggedArrays are trusted, * Fixing TaggedMember to work with non-main cages (also for trusted arrays), * More atomics support for TaggedMember, * Adding support for the ephemeron barrier to TaggedMember (in fact, I just made EphemeronHashTable call the write barrier directly instead of having a generic macro, it's a very special case and can be treated as such), * Making sure that HeapObjectLayout is non-movable/non-copyable, to catch issues where we were passing it by value due to *this, Bug: 42202654 Change-Id: I23df96ef2815c4592438137b4d7a77d496e1fe52 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5873241 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#96556} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[deoptimizer] Store register params first for continuation stubs Builtin continuation stubs can have both in-register and on-stack parameters. The intuitive way of storing these is register params followed by stack params, since that's how they are defined in the descriptors (the first N parameters go into registers, the remainder go onto the stack). Until now, the translation frames were storing stack parameters first, and register parameters second. This had a good reason -- JS continuation builtin frames want to have the first translation parameter be the receiver for consistency with unoptimized frames during frame iteration. However, this leads to awkward re-ordering of the parameters to continuation stubs, which need to move the on stack parameters to the start of the parameters array, and notably we were forgetting to do this in Maglev (which caused issues in Turbolev on ia32, where there are fewer registers and therefore more stack parameters). We can make the parameter ordering more natural while preserving the receiver-first property by splitting up the encoding of JS-linkage continuation builtins and stub continuation builtins; these anyway differ in stack parameter order (JS-linkage pushes stack arguments in reverse order). This simplifies the stub parameter encoding (even removing the need for an intermediate std::vector) in TF, and keeps the Maglev one as-is. I've also added some documentation static_asserts for the receiver-first property of JS continuation frames, since that was surprising at first when I tried to make _all_ register parameters be before stack parameters, and code assuming that this is the case was spread out over a couple of different locations. Fixed: 428754707 Change-Id: If83d05536b0f62068be5ebb1e9ce8f5f79e6ae9a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6701447 Reviewed-by: Victor Gomes <victorgomes@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101281} | 11 个月前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Signed-off-by: Marja Hölttä <marja@chromium.org> | 24 天前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
Reland^2 "Embedding feedback in BytecodeArray for StrictEqual" This is a reland of commit e295f1f18da01c386eda73f535fb67a56c004d88 Original change's description: > Reland "Embedding feedback in BytecodeArray for StrictEqual" > > This is a reland of commit f0fed41e48b1966e3e565ae278d018da538ef123 > > Original change's description: > > Embedding feedback in BytecodeArray for StrictEqual > > > > This CL removes the feedback vector slot for StrictEqual and stores its feedback values directly in the BytecodeArray. Optimized compilers will now access the type feedback from the BytecodeArray. > > > > Before: > > 75 04 00 TestEqualStrict a1, [0] > > > > After: > > 75 04 00 00 TestEqualStrict a1, #0 > > > > This change saves moemory by reducing FeedbackVector size, and is part of the Sparkplug+ optimization effort. > > > > Bug: chromium:429351411 > > Change-Id: I24390811c12755b0a19beaefe2b0319d75ceaf6c > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6986847 > > Reviewed-by: Xu, Hao A <hao.a.xu@intel.com> > > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#103656} > > Bug: chromium:429351411 > Change-Id: I77286b0e9c65f8a9e257a2125adab7f68fe09aec > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7148333 > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103800} Bug: chromium:429351411 Change-Id: I5020c9dffbed90ff207520728b13cf0dbcfb5903 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7197099 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> Cr-Commit-Position: refs/heads/main@{#103962} | 7 个月前 | |
Reland^2 "Embedding feedback in BytecodeArray for StrictEqual" This is a reland of commit e295f1f18da01c386eda73f535fb67a56c004d88 Original change's description: > Reland "Embedding feedback in BytecodeArray for StrictEqual" > > This is a reland of commit f0fed41e48b1966e3e565ae278d018da538ef123 > > Original change's description: > > Embedding feedback in BytecodeArray for StrictEqual > > > > This CL removes the feedback vector slot for StrictEqual and stores its feedback values directly in the BytecodeArray. Optimized compilers will now access the type feedback from the BytecodeArray. > > > > Before: > > 75 04 00 TestEqualStrict a1, [0] > > > > After: > > 75 04 00 00 TestEqualStrict a1, #0 > > > > This change saves moemory by reducing FeedbackVector size, and is part of the Sparkplug+ optimization effort. > > > > Bug: chromium:429351411 > > Change-Id: I24390811c12755b0a19beaefe2b0319d75ceaf6c > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6986847 > > Reviewed-by: Xu, Hao A <hao.a.xu@intel.com> > > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#103656} > > Bug: chromium:429351411 > Change-Id: I77286b0e9c65f8a9e257a2125adab7f68fe09aec > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7148333 > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103800} Bug: chromium:429351411 Change-Id: I5020c9dffbed90ff207520728b13cf0dbcfb5903 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7197099 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> Cr-Commit-Position: refs/heads/main@{#103962} | 7 个月前 | |
CVE: 497404188 Signed-off-by: jiang-qunchao <jiangqunchao@huawei.com> | 3 天前 | |
CVE: 497404188 Signed-off-by: jiang-qunchao <jiangqunchao@huawei.com> | 3 天前 | |
[wasm][jspi] Disable SP-relative operands if wasm switches stacks If a function switches to the central stack, this temporarily invalidates the SP, so we disable using SP-relative memory operands for this function. This was only done for wasm builtins and wasm-to-js wrappers so far. We also need to do this for regular wasm functions now since they may switch for Fast API calls. Detect this more precisely based on the presence of the SetStackPointer instruction. R=jkummerow@chromium.org Fixed: 408242499 Change-Id: I6e20c49426fcb83029ae025226959c2636ed95af Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6448591 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Cr-Commit-Position: refs/heads/main@{#99761} | 1 年前 | |
[wasm][jspi] Disable SP-relative operands if wasm switches stacks If a function switches to the central stack, this temporarily invalidates the SP, so we disable using SP-relative memory operands for this function. This was only done for wasm builtins and wasm-to-js wrappers so far. We also need to do this for regular wasm functions now since they may switch for Fast API calls. Detect this more precisely based on the presence of the SetStackPointer instruction. R=jkummerow@chromium.org Fixed: 408242499 Change-Id: I6e20c49426fcb83029ae025226959c2636ed95af Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6448591 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Cr-Commit-Position: refs/heads/main@{#99761} | 1 年前 | |
Remove std::iterator uses std: :iterator is deprecated C++17. Use base::iterator instead. Change-Id: I682dc3b1547120e067a64eea4f71ffe4ee55ad16 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3289168 Commit-Queue: Maya Lekova <mslekova@chromium.org> Auto-Submit: Patrick Thier <pthier@chromium.org> Reviewed-by: Maya Lekova <mslekova@chromium.org> Cr-Commit-Position: refs/heads/main@{#77992} | 4 年前 | |
[compiler] Lower stack checks later in the pipeline So far, StackChecks were lowered in JSGenericLowering, right after simplified lowering. However, there is really nothing to be gained from lowering them so early, and Turboshaft anyways already has the machinery necessary to lower stack checks (because it's needed for Wasm and Turbolev). So, this CL keeps stack checks around until the very end of the Turboshaft pipeline, so that we don't have to bother with them in optimizations (a few optimizations were looking at calls and trying to find out if they were stack checks, which wasn't super clean and a bit unfortunate). Change-Id: I9d7bed0d15d69444dbf6474f9feafdafa53a9f9a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6565584 Commit-Queue: Darius Mercadier <dmercadier@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Auto-Submit: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#100415} | 1 年前 | |
[turbofan] Remove obsolete Chained operator Bug: 391750831 Change-Id: I99f139c57604330d005a49ec1239a7896f7ee62c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6668473 Auto-Submit: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#101056} | 1 年前 | |
[turbofan] Remove obsolete Chained operator Bug: 391750831 Change-Id: I99f139c57604330d005a49ec1239a7896f7ee62c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6668473 Auto-Submit: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#101056} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[zone] Remove zone compression Compression has been unused for many years. Removing it allows simplifying allocation/freeing paths. Bug: 409953791 Change-Id: I65a38d48e8d2ca2e2ffb131799d20dacb7899d0a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6568895 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#100686} | 1 年前 | |
【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Signed-off-by: Marja Hölttä <marja@chromium.org> | 24 天前 | |
【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Signed-off-by: Marja Hölttä <marja@chromium.org> | 24 天前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Signed-off-by: Marja Hölttä <marja@chromium.org> | 24 天前 | |
[wasm-custom-desc] JS Interop: wrap methods instead of "stamping" them. The problem we need to solve is that methods installed on prototypes should not ignore the JS-side "receiver" (as regular exported Wasm functions do), but rather pass it on as the first Wasm-side parameter. The previous approach was to set a bit on the exported function to indicate the changed behavior; this CL uses wrapper functions instead, at the cost of slower instantiation. Bug: 403372470 Change-Id: I132e4e5f053de7dc5737b7edaa3b97507084b2c6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6948076 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Daniel Lehmann <dlehmann@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#102516} | 9 个月前 | |
Reland "[hole] DCHECK that we don't access the hole map" This is a reland of commit 99f667c6c38669c0f4556e73553987b2da69b2ed Reland fixes: * Put the check behind a flag to make this incremental. * Only check the hole in left-trimming if we can do a value check. Original change's description: > [hole] DCHECK that we don't access the hole map > > Only ever check holes by value, never by map or instance type. This will > allow us to unmap the holes entirely, and use them only as sentinel > values. > > Bug: 434179415 > Change-Id: I3f1eca4049423f39fa10c8761460378d64a92ea3 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6845798 > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Cr-Commit-Position: refs/heads/main@{#102111} Bug: 434179415 Change-Id: Ifbebea894647608b9459dfabf948818909febc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6899264 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102123} | 10 个月前 | |
Reland "[contexts] Unify context accessors after ContextCells" This is a reland of commit d2ab66c2a942893b9f6d7628ff8892e1d6a607b3 Changes from original: - The test inspector/debugger/set-breakpoint-after-gc relies on precise garbage collection and may fail if conservative stack scanning is used. We call GC multiple times to ensure the weak reference hold by the script is eventually collected. - Allow reading a ContextCell when printing debug stack frame. Original change's description: > [contexts] Unify context accessors after ContextCells > > The introduction of ContextCells removed the need for special handling > for ScriptContext (which previously used a side table for > let/const tracking and mutable numbers). > > This change refactors the context access logic: > - Internal get/set accessors are now protected to the Context class. > - External access should use the new functions: > - Get/Set: A safe (though potentially slower) > function for accessing elements in any context. > - GetNoCell/SetNoCell: A faster function that verifies the > element being accessed is not a ContextCell. > > Additionally, related bytecode operations and optimizer functions have > been renamed for consistency with these changes. > > Bug: 408128754 > > Change-Id: I785281ab6f13b0ae65578eb5d2f0a5750457ab5e > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6450582 > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Commit-Queue: Victor Gomes <victorgomes@chromium.org> > Cr-Commit-Position: refs/heads/main@{#99844} Bug: 408128754, 40789559 Change-Id: I78a3a99a4f364ed78965fbed56a084d38382d2fc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6479814 Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#99865} | 1 年前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
[array] Remove ArrayConstructorProtector Remove the ArrayConstructorProtector, which guarded against Array constructor calls with too-large arguments, exceeding the max initial array size, where the optimizing compilers would deopt out of inlined Array construction when the elements didn't fit inside a new space page. The original idea here was that we can usually guard against deopts and deopt loops here by marking the allocation site, and we'd only set the protector when there is no allocation site available, which should be rare. However, this original idea predates lazy feedback allocation, which makes missing allocation sites common in the initial state rather than rare. Fortunately, we have another mechanism for preventing deopt loops, which is the call speculation bit on CallICs (which is also predated by the original ArrayConstructorProtector idea). So, with appropriate wiring, we can use this call speculation bit for call-sites which will never have an allocation site, and allow lazy feedback (and thus lazy allocation sites) to still be used for the common case without invalidating any global protectors. Only in a few very rare cases will we have neither an allocation site nor a CallIC on array construction (e.g. accessors an polymorphic construction sites), and for these cases we can disable the speculative array constructor inlining at compile time. Bug: 420613330 Change-Id: I0386cce96412baf1e0598d0d95167b3e01466fe1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6590918 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#100548} | 1 年前 | |
[for-of-performance] Add IC slots to feedback vector This CL adds three slots (one call slot and 2 load slots) to the feedback vector to fasten the ForOf loop on ArrayIterators. Bug: 408061015 Change-Id: I51e1dca0601edf8570132bab04123a4515e08807 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7008254 Reviewed-by: Marja Hölttä <marja@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Cr-Commit-Position: refs/heads/main@{#103993} | 7 个月前 | |
Include guards should be at the top of files. For the include guard optimization to kick in the include guards should be the first thing in the file, not counting comments. In some cases the guard has been moved above a comment for consistency even though this does not matter. A couple of include guards have been renamed for uniqueness. git cl upload complained about some lint nits which have been fixed. Change-Id: Iaa208ea6557c36c84bc7bb77c787ba9feb7cf037 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6275067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98907} | 1 年前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
Reland^2 "[hole] Remove hole raw number value" This is a reland of commit b998e975fc46f94d8f073c2e7b859e611a313786 Reland changes: * Only check Operator class tag in non-component builds, because of dynamic linker issues. Original change's description: > Reland "[hole] Remove hole raw number value" > > This is a reland of commit 47ac4aacc9726e35627b584cdb5c25aa6d1c754c > > Reland changes: > * Correctly load the Float64 instead of double parameter when > processing Float64Constant. > * Add debug checking to OpParameter which ensures that parameter > loads use the correct type. > > Original change's description: > > [hole] Remove hole raw number value > > > > Holes should, in general, not flow through code as values that need to > > be read. In particular, we should never perform a JS ToNumber operation > > on a Hole, since holes are not JS-visible values. > > > > Historically, holes were considered a form of oddball, and oddballs > > _did_ have ToNumber handling (by reading their raw number offset as if > > they were a HeapNumber), and in a few cases we ended up being sloppy and > > allowed Holes to go through the same path (to read the hole NaN value on > > array initialization or elements kinds transitions). > > > > However, in such cases, we _know_ that we are looking for the hole, and > > we _know_ that we actually want the hole NaN. So, we can be explicit > > about this, with the benefit that we can avoid the hole constant load > > and read from its raw number field, and instead can embed the hole NaN > > float64 constant where needed. > > > > This required a few changes to Float64Constant encoding in TurboFan > > (using an integer bit encoding rather than a double, to avoid losing the > > special NaN bits), and a few adjustments to representation changing > > which are explicit that we are converting a NumberOrHole rather than > > NumberOrOddball when changing a HOLEY_SMI_ELEMENTS array to > > HOLEY_DOUBLE_ELEMENTS. > > > > With these changes, we can remove the raw number field from Holes > > entirely. > > > > Bug: 434179415 > > Change-Id: I4d158466dcdcad9f676e6ba7dc1d6cb6e817d440 > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6786712 > > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#101712} > > Bug: 434179415 > Change-Id: Ic0995bdf4b0d050db645aa6c7899e5e2ec1ea38c > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6811578 > Auto-Submit: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#101758} Cq-Include-Trybots: luci.v8.try:v8_win64_dbg Bug: 434179415 Change-Id: Ia11950c24e29e69acc772aea45f1e3aa3ef2c76e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6821533 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101779} | 10 个月前 | |
[compiler] Fix V8_STATIC_ROOTS_BOOL check in FindRootIndex We should check if the V8_STATIC_ROOTS_BOOL value is true, not just if it's defined. Change-Id: I6c7a1a956cc2c50d3dddb1ee8afb8ff3154615a3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6897711 Commit-Queue: Kasper Lund <kasperl@rivosinc.com> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#102145} | 10 个月前 | |
Reland "Reland "[maglev] Unpack thin string names"" This is a reland of commit 5186d3a89bcf241744556989f178dd0972ad36da Changed since the last attempt: * This time we were too conservative with unpacking, and missed some places that require a unique name (such as Builtin::kLoadIC_Megamorphic). * AFAICT, preserving object identity is only important for BuildCheckInternalizedStringValueOrByReference when a keyed access has been refined to a named access. Same in Turbofan. All other spots should use the unpacked name. * Given this, the design changed as follows. NamedAccessFeedback now stores both the original object reference, and the unpacked name. name returns the unpacked string. original_name_maybe_thin returns the original reference. * Now that this change also affects Turbofan, update the reference check there as well. Original change's description: > Reland "[maglev] Unpack thin string names" > > This is a reland of commit b2d9b42c92424de1f277cc41f0c315a0c6852b52 > > In the reland, we no longer attempt to unpack thin strings wherever we > can - this was problematic since it leads to confusion whenever object > identity is important, e.g. in compilation dependency validation or > runtime identity checks that deopt if failed. > > The reland only unpacks where it's actually relevant instead: > > * When deciding whether to refine kElementAccess feedback to > kNamedAccess; and > * when creating the AccessInfo for this named access. > > Original change's description: > > [maglev] Unpack thin string names > > > > I noticed that kElementAccess -> kNamedAccess feedback refinement > > was blocked by thin string names that haven't yet been rewritten to > > internalized strings by gc shortcutting. > > > > This is quite an important optimization, e.g. on date-format-xparb-SP it > > bumps the overall score by 25% when it hits. Prior to this CL, the > > optimization was only applied once the first Scavenge pass completed. > > > > This changes all relevant spots where NameRef objects are constructed > > to call the new UnpackIfThin function. > > > > In a followup, we may want to look at the TF side of this as well. It's > > possible that the same issue exists there, but is less exposed due to > > TF being slower and tiering up later. Note UnpackIfThin is already > > called in JSGraph::ConstantNoHole, but there may be other spots > > where thin strings are used without being unpacked. > > > > Change-Id: I1a7343a5d9dde13892f3c9249dfbcf9e1fe43985 > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6905403 > > Commit-Queue: Jakob Linke <jgruber@chromium.org> > > Auto-Submit: Jakob Linke <jgruber@chromium.org> > > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > > Reviewed-by: Darius Mercadier <dmercadier@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#102185} > > Change-Id: Idea05f4c5d7de251fb990b7476077ac1fc27c1ec > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6913688 > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Darius Mercadier <dmercadier@chromium.org> > Commit-Queue: Jakob Linke <jgruber@chromium.org> > Cr-Commit-Position: refs/heads/main@{#102258} Change-Id: Ifb5c52ecd335d33dd668cf373ca767608e12a08e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6919232 Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Jakob Linke <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#102341} | 9 个月前 | |
Reland "[hole] DCHECK that we don't access the hole map" This is a reland of commit 99f667c6c38669c0f4556e73553987b2da69b2ed Reland fixes: * Put the check behind a flag to make this incremental. * Only check the hole in left-trimming if we can do a value check. Original change's description: > [hole] DCHECK that we don't access the hole map > > Only ever check holes by value, never by map or instance type. This will > allow us to unmap the holes entirely, and use them only as sentinel > values. > > Bug: 434179415 > Change-Id: I3f1eca4049423f39fa10c8761460378d64a92ea3 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6845798 > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Cr-Commit-Position: refs/heads/main@{#102111} Bug: 434179415 Change-Id: Ifbebea894647608b9459dfabf948818909febc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6899264 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102123} | 10 个月前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
Wasm-in-JS-inlining: Ensure consistent module The JSWasmCallParameters struct stores both a NativeModule* and a Module*. If they ever become inconsistent (the Module* not belonging to the NativeModule*) we would get all kinds of problems; also it's super cheap to get the Module* from the NativeModule*. This CL thus removes the Module* and the similarly redundant signature pointer. To be on the safe side we now also enforce that the NativeModule of all inlined Wasm functions is the same, not just the Module. Note that there is typically a 1:1 relation between them, except if the native module cache is explicitly disabled. R=dlehmann@chromium.org Change-Id: Ie6a9062281d58c8c513d77a06a48c11c0c85e498 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6616962 Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Daniel Lehmann <dlehmann@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#101225} | 11 个月前 | |
[turbofan] Avoid inlining calls with too many arguments Fixed: 451793024 Change-Id: Ie6f862a942800e13ca2c7948d5d29c38db2dcbfb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7053327 Auto-Submit: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#103253} | 8 个月前 | |
Wasm-in-JS-inlining: Ensure consistent module The JSWasmCallParameters struct stores both a NativeModule* and a Module*. If they ever become inconsistent (the Module* not belonging to the NativeModule*) we would get all kinds of problems; also it's super cheap to get the Module* from the NativeModule*. This CL thus removes the Module* and the similarly redundant signature pointer. To be on the safe side we now also enforce that the NativeModule of all inlined Wasm functions is the same, not just the Module. Note that there is typically a 1:1 relation between them, except if the native module cache is explicitly disabled. R=dlehmann@chromium.org Change-Id: Ie6a9062281d58c8c513d77a06a48c11c0c85e498 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6616962 Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Daniel Lehmann <dlehmann@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#101225} | 11 个月前 | |
[turbofan][maglev] Fix value uses of %MajorGCForCompilerTesting For Turbofan, this means removing uses of %MajorGCForCompilerTesting. For Maglev, this means setting the accumulator to undefined after %MajorGCForCompilerTesting. Fixed: 463606272 Change-Id: Id05ae9ff16913e0ef92227393f57b60f79f799b7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206242 Commit-Queue: Victor Gomes <victorgomes@chromium.org> Reviewed-by: Victor Gomes <victorgomes@chromium.org> Auto-Submit: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#104000} | 7 个月前 | |
[compiler] Add %MajorGCForCompilerTesting intrinsic So far, the way to invoke GCs from JS was to use gc() in combination with --expose-gc. However, this was leading to GC calls being generic runtime calls in the optimizing compilers, which was blocking all kind of optimizations. As such, weird tricks had to be used in order to repro GC timing issues, cf the repros in https://crrev.com/c/7184739 (which this CL nicely simplifies). The new %MajorGCForCompilerTesting intrinsic is marked as no-read no-write in Turbofan, Turboshaft and Maglev, which means that it won't block any optimizations and will allow to more easily fuzz and repro GC-timing-related bugs. Change-Id: I66cb03c77f350880b2667ca5ae44ab823ddb8f34 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7198340 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103914} | 7 个月前 | |
【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Signed-off-by: Marja Hölttä <marja@chromium.org> | 24 天前 | |
[maglev] Port const string add optimization from JSNativeContextSpecialization Bug: 428882137 Change-Id: Ifa07d5aab27268c368493bfc5eb08699a8a88262 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6695690 Auto-Submit: Marja Hölttä <marja@chromium.org> Commit-Queue: Victor Gomes <victorgomes@chromium.org> Reviewed-by: Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/main@{#101193} | 1 年前 | |
[for-of-performance] Add IC slots to feedback vector This CL adds three slots (one call slot and 2 load slots) to the feedback vector to fasten the ForOf loop on ArrayIterators. Bug: 408061015 Change-Id: I51e1dca0601edf8570132bab04123a4515e08807 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7008254 Reviewed-by: Marja Hölttä <marja@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Cr-Commit-Position: refs/heads/main@{#103993} | 7 个月前 | |
[for-of-performance] Add IC slots to feedback vector This CL adds three slots (one call slot and 2 load slots) to the feedback vector to fasten the ForOf loop on ArrayIterators. Bug: 408061015 Change-Id: I51e1dca0601edf8570132bab04123a4515e08807 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7008254 Reviewed-by: Marja Hölttä <marja@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Cr-Commit-Position: refs/heads/main@{#103993} | 7 个月前 | |
Reland^2 "Embedding feedback in BytecodeArray for StrictEqual" This is a reland of commit e295f1f18da01c386eda73f535fb67a56c004d88 Original change's description: > Reland "Embedding feedback in BytecodeArray for StrictEqual" > > This is a reland of commit f0fed41e48b1966e3e565ae278d018da538ef123 > > Original change's description: > > Embedding feedback in BytecodeArray for StrictEqual > > > > This CL removes the feedback vector slot for StrictEqual and stores its feedback values directly in the BytecodeArray. Optimized compilers will now access the type feedback from the BytecodeArray. > > > > Before: > > 75 04 00 TestEqualStrict a1, [0] > > > > After: > > 75 04 00 00 TestEqualStrict a1, #0 > > > > This change saves moemory by reducing FeedbackVector size, and is part of the Sparkplug+ optimization effort. > > > > Bug: chromium:429351411 > > Change-Id: I24390811c12755b0a19beaefe2b0319d75ceaf6c > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6986847 > > Reviewed-by: Xu, Hao A <hao.a.xu@intel.com> > > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#103656} > > Bug: chromium:429351411 > Change-Id: I77286b0e9c65f8a9e257a2125adab7f68fe09aec > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7148333 > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103800} Bug: chromium:429351411 Change-Id: I5020c9dffbed90ff207520728b13cf0dbcfb5903 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7197099 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> Cr-Commit-Position: refs/heads/main@{#103962} | 7 个月前 | |
Reland^2 "Embedding feedback in BytecodeArray for StrictEqual" This is a reland of commit e295f1f18da01c386eda73f535fb67a56c004d88 Original change's description: > Reland "Embedding feedback in BytecodeArray for StrictEqual" > > This is a reland of commit f0fed41e48b1966e3e565ae278d018da538ef123 > > Original change's description: > > Embedding feedback in BytecodeArray for StrictEqual > > > > This CL removes the feedback vector slot for StrictEqual and stores its feedback values directly in the BytecodeArray. Optimized compilers will now access the type feedback from the BytecodeArray. > > > > Before: > > 75 04 00 TestEqualStrict a1, [0] > > > > After: > > 75 04 00 00 TestEqualStrict a1, #0 > > > > This change saves moemory by reducing FeedbackVector size, and is part of the Sparkplug+ optimization effort. > > > > Bug: chromium:429351411 > > Change-Id: I24390811c12755b0a19beaefe2b0319d75ceaf6c > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6986847 > > Reviewed-by: Xu, Hao A <hao.a.xu@intel.com> > > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#103656} > > Bug: chromium:429351411 > Change-Id: I77286b0e9c65f8a9e257a2125adab7f68fe09aec > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7148333 > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103800} Bug: chromium:429351411 Change-Id: I5020c9dffbed90ff207520728b13cf0dbcfb5903 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7197099 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> Cr-Commit-Position: refs/heads/main@{#103962} | 7 个月前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
Reland "[contexts] Unify context accessors after ContextCells" This is a reland of commit d2ab66c2a942893b9f6d7628ff8892e1d6a607b3 Changes from original: - The test inspector/debugger/set-breakpoint-after-gc relies on precise garbage collection and may fail if conservative stack scanning is used. We call GC multiple times to ensure the weak reference hold by the script is eventually collected. - Allow reading a ContextCell when printing debug stack frame. Original change's description: > [contexts] Unify context accessors after ContextCells > > The introduction of ContextCells removed the need for special handling > for ScriptContext (which previously used a side table for > let/const tracking and mutable numbers). > > This change refactors the context access logic: > - Internal get/set accessors are now protected to the Context class. > - External access should use the new functions: > - Get/Set: A safe (though potentially slower) > function for accessing elements in any context. > - GetNoCell/SetNoCell: A faster function that verifies the > element being accessed is not a ContextCell. > > Additionally, related bytecode operations and optimizer functions have > been renamed for consistency with these changes. > > Bug: 408128754 > > Change-Id: I785281ab6f13b0ae65578eb5d2f0a5750457ab5e > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6450582 > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Commit-Queue: Victor Gomes <victorgomes@chromium.org> > Cr-Commit-Position: refs/heads/main@{#99844} Bug: 408128754, 40789559 Change-Id: I78a3a99a4f364ed78965fbed56a084d38382d2fc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6479814 Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#99865} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[sandbox] Remove kDefaultCodeEntrypointTag, pt.1 This is a step towards making code entrypoint tag verification strict. This CL - introduces kCodeEntrypointTagForTesting, - introduces CodeKind::FOR_TESTING_JS in addition to existing CodeKind::FOR_TESTING in order to assign them different code entrypoint tags (kJSEntrypointTag for the former and kCodeEntrypointTagForTesting for the latter), - add SBXCHECK for Code object's entrypoint tags when generating calls and tail calls to compile-time known Code objects, - introduce Linkage::GetCPPBuiltinCallDescriptor() - a CEntry call descriptor customized for CPP builtins, - replaces some of the kDefaultCodeEntrypointTag usages with correct tags, - fixes usages of entrypoint tags in various code generation unit tests. Drive-by: - assign proper descriptor for GenericJSToWasmInterpreterWrapper builtin, - make Builtins::CallInterfaceDescriptorFor() work for bytecode handlers, - make switches over CodeKind values case-complete. Bug: 435630464 Change-Id: I2e34666df5314b0cd4e604a4deaf74e2f0de6f1a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6976541 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102733} | 9 个月前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
[turbofan] Add --trace-turbo-bailouts flag ... which traces whenever we bail out on optimizations because of various limits that we have in place to avoid worst-case blowups. This is useful when doing performance investigation. Change-Id: Ic13a994b3c413d8698f433cbce6b93d2776907b5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6516085 Auto-Submit: Darius Mercadier <dmercadier@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#100087} | 1 年前 | |
[turbofan] Add --trace-turbo-bailouts flag ... which traces whenever we bail out on optimizations because of various limits that we have in place to avoid worst-case blowups. This is useful when doing performance investigation. Change-Id: Ic13a994b3c413d8698f433cbce6b93d2776907b5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6516085 Auto-Submit: Darius Mercadier <dmercadier@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#100087} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[compiler] Add %MajorGCForCompilerTesting intrinsic So far, the way to invoke GCs from JS was to use gc() in combination with --expose-gc. However, this was leading to GC calls being generic runtime calls in the optimizing compilers, which was blocking all kind of optimizations. As such, weird tricks had to be used in order to repro GC timing issues, cf the repros in https://crrev.com/c/7184739 (which this CL nicely simplifies). The new %MajorGCForCompilerTesting intrinsic is marked as no-read no-write in Turbofan, Turboshaft and Maglev, which means that it won't block any optimizations and will allow to more easily fuzz and repro GC-timing-related bugs. Change-Id: I66cb03c77f350880b2667ca5ae44ab823ddb8f34 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7198340 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103914} | 7 个月前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[code health] Ban std::bit_cast, use base::bit_cast instead base::bit_cast has some additional checks, so use that exclusively. Replace a few pointer-casts by reinterpret_casts instead. R=leszeks@chromium.org, machenbach@chromium.org Bug: 445301908, 40947442 Change-Id: Ib9f711cf4e786cfbf01883a8e9e4883e57e1ea51 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6959216 Reviewed-by: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#102601} | 9 个月前 | |
Reland^2 "[hole] Remove hole raw number value" This is a reland of commit b998e975fc46f94d8f073c2e7b859e611a313786 Reland changes: * Only check Operator class tag in non-component builds, because of dynamic linker issues. Original change's description: > Reland "[hole] Remove hole raw number value" > > This is a reland of commit 47ac4aacc9726e35627b584cdb5c25aa6d1c754c > > Reland changes: > * Correctly load the Float64 instead of double parameter when > processing Float64Constant. > * Add debug checking to OpParameter which ensures that parameter > loads use the correct type. > > Original change's description: > > [hole] Remove hole raw number value > > > > Holes should, in general, not flow through code as values that need to > > be read. In particular, we should never perform a JS ToNumber operation > > on a Hole, since holes are not JS-visible values. > > > > Historically, holes were considered a form of oddball, and oddballs > > _did_ have ToNumber handling (by reading their raw number offset as if > > they were a HeapNumber), and in a few cases we ended up being sloppy and > > allowed Holes to go through the same path (to read the hole NaN value on > > array initialization or elements kinds transitions). > > > > However, in such cases, we _know_ that we are looking for the hole, and > > we _know_ that we actually want the hole NaN. So, we can be explicit > > about this, with the benefit that we can avoid the hole constant load > > and read from its raw number field, and instead can embed the hole NaN > > float64 constant where needed. > > > > This required a few changes to Float64Constant encoding in TurboFan > > (using an integer bit encoding rather than a double, to avoid losing the > > special NaN bits), and a few adjustments to representation changing > > which are explicit that we are converting a NumberOrHole rather than > > NumberOrOddball when changing a HOLEY_SMI_ELEMENTS array to > > HOLEY_DOUBLE_ELEMENTS. > > > > With these changes, we can remove the raw number field from Holes > > entirely. > > > > Bug: 434179415 > > Change-Id: I4d158466dcdcad9f676e6ba7dc1d6cb6e817d440 > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6786712 > > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#101712} > > Bug: 434179415 > Change-Id: Ic0995bdf4b0d050db645aa6c7899e5e2ec1ea38c > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6811578 > Auto-Submit: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#101758} Cq-Include-Trybots: luci.v8.try:v8_win64_dbg Bug: 434179415 Change-Id: Ia11950c24e29e69acc772aea45f1e3aa3ef2c76e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6821533 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101779} | 10 个月前 | |
Reland^2 "[hole] Remove hole raw number value" This is a reland of commit b998e975fc46f94d8f073c2e7b859e611a313786 Reland changes: * Only check Operator class tag in non-component builds, because of dynamic linker issues. Original change's description: > Reland "[hole] Remove hole raw number value" > > This is a reland of commit 47ac4aacc9726e35627b584cdb5c25aa6d1c754c > > Reland changes: > * Correctly load the Float64 instead of double parameter when > processing Float64Constant. > * Add debug checking to OpParameter which ensures that parameter > loads use the correct type. > > Original change's description: > > [hole] Remove hole raw number value > > > > Holes should, in general, not flow through code as values that need to > > be read. In particular, we should never perform a JS ToNumber operation > > on a Hole, since holes are not JS-visible values. > > > > Historically, holes were considered a form of oddball, and oddballs > > _did_ have ToNumber handling (by reading their raw number offset as if > > they were a HeapNumber), and in a few cases we ended up being sloppy and > > allowed Holes to go through the same path (to read the hole NaN value on > > array initialization or elements kinds transitions). > > > > However, in such cases, we _know_ that we are looking for the hole, and > > we _know_ that we actually want the hole NaN. So, we can be explicit > > about this, with the benefit that we can avoid the hole constant load > > and read from its raw number field, and instead can embed the hole NaN > > float64 constant where needed. > > > > This required a few changes to Float64Constant encoding in TurboFan > > (using an integer bit encoding rather than a double, to avoid losing the > > special NaN bits), and a few adjustments to representation changing > > which are explicit that we are converting a NumberOrHole rather than > > NumberOrOddball when changing a HOLEY_SMI_ELEMENTS array to > > HOLEY_DOUBLE_ELEMENTS. > > > > With these changes, we can remove the raw number field from Holes > > entirely. > > > > Bug: 434179415 > > Change-Id: I4d158466dcdcad9f676e6ba7dc1d6cb6e817d440 > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6786712 > > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#101712} > > Bug: 434179415 > Change-Id: Ic0995bdf4b0d050db645aa6c7899e5e2ec1ea38c > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6811578 > Auto-Submit: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#101758} Cq-Include-Trybots: luci.v8.try:v8_win64_dbg Bug: 434179415 Change-Id: Ia11950c24e29e69acc772aea45f1e3aa3ef2c76e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6821533 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101779} | 10 个月前 | |
[cleanup] Modernize std::*::value and ::type Mechanically replacing std::foo<X>::value with std::foo_v<X>, and the same for ::type -> _t. Change-Id: I543dda07ba4c95534cdcd51f1f438f2626be8273 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6491388 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#99940} | 1 年前 | |
Reland^2 "Embedding feedback in BytecodeArray for StrictEqual" This is a reland of commit e295f1f18da01c386eda73f535fb67a56c004d88 Original change's description: > Reland "Embedding feedback in BytecodeArray for StrictEqual" > > This is a reland of commit f0fed41e48b1966e3e565ae278d018da538ef123 > > Original change's description: > > Embedding feedback in BytecodeArray for StrictEqual > > > > This CL removes the feedback vector slot for StrictEqual and stores its feedback values directly in the BytecodeArray. Optimized compilers will now access the type feedback from the BytecodeArray. > > > > Before: > > 75 04 00 TestEqualStrict a1, [0] > > > > After: > > 75 04 00 00 TestEqualStrict a1, #0 > > > > This change saves moemory by reducing FeedbackVector size, and is part of the Sparkplug+ optimization effort. > > > > Bug: chromium:429351411 > > Change-Id: I24390811c12755b0a19beaefe2b0319d75ceaf6c > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6986847 > > Reviewed-by: Xu, Hao A <hao.a.xu@intel.com> > > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#103656} > > Bug: chromium:429351411 > Change-Id: I77286b0e9c65f8a9e257a2125adab7f68fe09aec > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7148333 > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103800} Bug: chromium:429351411 Change-Id: I5020c9dffbed90ff207520728b13cf0dbcfb5903 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7197099 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> Cr-Commit-Position: refs/heads/main@{#103962} | 7 个月前 | |
Reland^2 "Embedding feedback in BytecodeArray for StrictEqual" This is a reland of commit e295f1f18da01c386eda73f535fb67a56c004d88 Original change's description: > Reland "Embedding feedback in BytecodeArray for StrictEqual" > > This is a reland of commit f0fed41e48b1966e3e565ae278d018da538ef123 > > Original change's description: > > Embedding feedback in BytecodeArray for StrictEqual > > > > This CL removes the feedback vector slot for StrictEqual and stores its feedback values directly in the BytecodeArray. Optimized compilers will now access the type feedback from the BytecodeArray. > > > > Before: > > 75 04 00 TestEqualStrict a1, [0] > > > > After: > > 75 04 00 00 TestEqualStrict a1, #0 > > > > This change saves moemory by reducing FeedbackVector size, and is part of the Sparkplug+ optimization effort. > > > > Bug: chromium:429351411 > > Change-Id: I24390811c12755b0a19beaefe2b0319d75ceaf6c > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6986847 > > Reviewed-by: Xu, Hao A <hao.a.xu@intel.com> > > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#103656} > > Bug: chromium:429351411 > Change-Id: I77286b0e9c65f8a9e257a2125adab7f68fe09aec > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7148333 > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103800} Bug: chromium:429351411 Change-Id: I5020c9dffbed90ff207520728b13cf0dbcfb5903 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7197099 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> Cr-Commit-Position: refs/heads/main@{#103962} | 7 个月前 | |
[compiler] Reduce Handle<Map> use in compilers Change uses of ZoneHandleSet to a new specialization of ZoneCompactSet, called ZoneRefSet, which stores ObjectRefs instead of Handles. Propagate this throughough the two compilers, in particular avoiding converstions between ZoneRefSet and ZoneVector/ZoneUnorderedSet. This reduces: a) Copies of sets (between ZoneHandleSet<Map> and ZoneVector<MapRef>/ZoneUnorderedSet<MapRef>), and b) Reduces ref lookups from handles, since we keep MapRefs as refs. Change-Id: Iabdb417e3851ab12328ad75453e0b041d93d407e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4384481 Reviewed-by: Jakob Linke <jgruber@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#86801} | 3 年前 | |
[compiler] Reduce Handle<Map> use in compilers Change uses of ZoneHandleSet to a new specialization of ZoneCompactSet, called ZoneRefSet, which stores ObjectRefs instead of Handles. Propagate this throughough the two compilers, in particular avoiding converstions between ZoneRefSet and ZoneVector/ZoneUnorderedSet. This reduces: a) Copies of sets (between ZoneHandleSet<Map> and ZoneVector<MapRef>/ZoneUnorderedSet<MapRef>), and b) Reduces ref lookups from handles, since we keep MapRefs as refs. Change-Id: Iabdb417e3851ab12328ad75453e0b041d93d407e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4384481 Reviewed-by: Jakob Linke <jgruber@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#86801} | 3 年前 | |
Introduce IsolateFieldIds for new/old top and limit This avoids having to manually add the LinearAllocationArea::TopOffset() or LinearAllocationArea::LimitOffset() in multiple places. Instead, we can reference the top or limit field directly. R=mlippautz@chromium.org Bug: 442745065 Change-Id: Ie32dddf70ce3cd46b862f008e17d6ee9a5199207 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6916875 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#102278} | 9 个月前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] preserve node origins and emit them with --trace-turbo Bug: v8:12783, v8:7327 Change-Id: I7c4280b94abc8103472cbef0cf7bb226b918ae32 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3805886 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/main@{#82229} | 3 年前 | |
[base] Rename functional.h to hashing.h That header defines our custom hashing infrastructure, so we should name it appropriately. There's no reason to follow the stdlib naming, which defines std::hash in the <functional> header. R=leszeks@chromium.org Bug: 380896845 Change-Id: I5e45ba5e55f677daacbb342b4e6591e1b3e186ea Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6054260 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#97450} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Introduce BranchMatcher and DiamondMatcher helpers. R=bmeurer@chromium.org BUG= Review URL: https://codereview.chromium.org/1054963002 Cr-Commit-Position: refs/heads/master@{#27613} | 11 年前 | |
Reland^2 "[hole] Remove hole raw number value" This is a reland of commit b998e975fc46f94d8f073c2e7b859e611a313786 Reland changes: * Only check Operator class tag in non-component builds, because of dynamic linker issues. Original change's description: > Reland "[hole] Remove hole raw number value" > > This is a reland of commit 47ac4aacc9726e35627b584cdb5c25aa6d1c754c > > Reland changes: > * Correctly load the Float64 instead of double parameter when > processing Float64Constant. > * Add debug checking to OpParameter which ensures that parameter > loads use the correct type. > > Original change's description: > > [hole] Remove hole raw number value > > > > Holes should, in general, not flow through code as values that need to > > be read. In particular, we should never perform a JS ToNumber operation > > on a Hole, since holes are not JS-visible values. > > > > Historically, holes were considered a form of oddball, and oddballs > > _did_ have ToNumber handling (by reading their raw number offset as if > > they were a HeapNumber), and in a few cases we ended up being sloppy and > > allowed Holes to go through the same path (to read the hole NaN value on > > array initialization or elements kinds transitions). > > > > However, in such cases, we _know_ that we are looking for the hole, and > > we _know_ that we actually want the hole NaN. So, we can be explicit > > about this, with the benefit that we can avoid the hole constant load > > and read from its raw number field, and instead can embed the hole NaN > > float64 constant where needed. > > > > This required a few changes to Float64Constant encoding in TurboFan > > (using an integer bit encoding rather than a double, to avoid losing the > > special NaN bits), and a few adjustments to representation changing > > which are explicit that we are converting a NumberOrHole rather than > > NumberOrOddball when changing a HOLEY_SMI_ELEMENTS array to > > HOLEY_DOUBLE_ELEMENTS. > > > > With these changes, we can remove the raw number field from Holes > > entirely. > > > > Bug: 434179415 > > Change-Id: I4d158466dcdcad9f676e6ba7dc1d6cb6e817d440 > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6786712 > > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#101712} > > Bug: 434179415 > Change-Id: Ic0995bdf4b0d050db645aa6c7899e5e2ec1ea38c > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6811578 > Auto-Submit: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#101758} Cq-Include-Trybots: luci.v8.try:v8_win64_dbg Bug: 434179415 Change-Id: Ia11950c24e29e69acc772aea45f1e3aa3ef2c76e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6821533 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101779} | 10 个月前 | |
[test][compiler] Refactor 'inline JStoWasm calls' tests to use %ObserveNode Modify the cctests for the inlined JS-to-Wasm calls to use the %ObserveNode intrinsic, to verify that the JSCall node is actually inlined . This requires a small refactoring of the %ObserveNode implementation. Bug: v8:11092 Change-Id: I01727143fec64c6c11c58b1b664f51daae5bfdb6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2677811 Commit-Queue: Paolo Severini <paolosev@microsoft.com> Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/master@{#72838} | 5 年前 | |
Include guards should be at the top of files. For the include guard optimization to kick in the include guards should be the first thing in the file, not counting comments. In some cases the guard has been moved above a comment for consistency even though this does not matter. A couple of include guards have been renamed for uniqueness. git cl upload complained about some lint nits which have been fixed. Change-Id: Iaa208ea6557c36c84bc7bb77c787ba9feb7cf037 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6275067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98907} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Remove hole special case in InferReceiverMaps The TheHole hole check in InferReceiverMaps is not the whole hole story, since we can also observe the optimized-out hole here. Since reading hole maps (off TheHole and other holes) is wholly safe as of https://crrev.com/c/6979444, we can remove the whole TheHole hole check and allow the map inference to read the Hole map off both TheHole and OptimizedOutHole. Fixed: 448759761 Change-Id: I635c2f1e0e3ca70814c0703aa4c332e36f839f27 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7015050 Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102978} | 8 个月前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[zone] Remove zone compression Compression has been unused for many years. Removing it allows simplifying allocation/freeing paths. Bug: 409953791 Change-Id: I65a38d48e8d2ca2e2ffb131799d20dacb7899d0a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6568895 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#100686} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[compiler] Refactor opcode macro lists This extends the opcode macro lists to include both the long name (e.g.: JSAdd) and short name (Add) to reduce duplication. The change is only for JS operators for now but can be extended to others in the future. Drive-by: Base more predicates off the macro lists for robustness. Bug: v8:8888 Change-Id: I10debdf86166dbe9dac63a6df57938820a8af8d0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2255468 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#68477} | 5 年前 | |
Reland^2 "Embedding feedback in BytecodeArray for StrictEqual" This is a reland of commit e295f1f18da01c386eda73f535fb67a56c004d88 Original change's description: > Reland "Embedding feedback in BytecodeArray for StrictEqual" > > This is a reland of commit f0fed41e48b1966e3e565ae278d018da538ef123 > > Original change's description: > > Embedding feedback in BytecodeArray for StrictEqual > > > > This CL removes the feedback vector slot for StrictEqual and stores its feedback values directly in the BytecodeArray. Optimized compilers will now access the type feedback from the BytecodeArray. > > > > Before: > > 75 04 00 TestEqualStrict a1, [0] > > > > After: > > 75 04 00 00 TestEqualStrict a1, #0 > > > > This change saves moemory by reducing FeedbackVector size, and is part of the Sparkplug+ optimization effort. > > > > Bug: chromium:429351411 > > Change-Id: I24390811c12755b0a19beaefe2b0319d75ceaf6c > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6986847 > > Reviewed-by: Xu, Hao A <hao.a.xu@intel.com> > > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#103656} > > Bug: chromium:429351411 > Change-Id: I77286b0e9c65f8a9e257a2125adab7f68fe09aec > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7148333 > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103800} Bug: chromium:429351411 Change-Id: I5020c9dffbed90ff207520728b13cf0dbcfb5903 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7197099 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> Cr-Commit-Position: refs/heads/main@{#103962} | 7 个月前 | |
Enable undefined double on bots and make it non-experimental Bug: 385155404 Change-Id: Ib0ee24769f515d70ac9f4f5b4d8ff989e74fe8a2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6939123 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102519} | 9 个月前 | |
[turbofan] Handle undefined doubles in Turbofan Bug: 385155404 Change-Id: I10748715c9a5b4eaad422648b0954d407e931e36 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6172622 Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#100181} | 1 年前 | |
[compiler] Mark ForOfNext as a deoptimizing builtin Mark the JSForOfNext operator as needing a framestate, and make sure to attach one in the bytecode graph builder. Additionally, remove the path claiming it can't deopt in Sparkplug (since the debugger could set a breakpoint in the ForOfNext-owning bytecode). Bug: 408061015 Change-Id: I960a414c217e008ce133b4fb6d1131afe2374e4b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6964615 Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102595} | 9 个月前 | |
Remove some unused includes (4) Mostly src/codegen, src/compiler, src/interpreter, src/libplatform. Drive-by: Remove some unreachable code. Bug: v8:13006 Change-Id: I1a9467f7e42531c545f660d35416c388e8ef9d3c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3749193 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#81613} | 3 年前 | |
[turbofan] Make Operators smaller Remove the pred and hash fields from Operator1 (which are not needed, the predicate and hash are empty classes), and lightly reorder the fields in Operator, to reduce the allocated size of operators. Change-Id: I085cd079e4429d00423806f97a87cc7deb250c14 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6818293 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101790} | 10 个月前 | |
[turbofan] Make Operators smaller Remove the pred and hash fields from Operator1 (which are not needed, the predicate and hash are empty classes), and lightly reorder the fields in Operator, to reduce the allocated size of operators. Change-Id: I085cd079e4429d00423806f97a87cc7deb250c14 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6818293 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101790} | 10 个月前 | |
Remove some unused includes (4) Mostly src/codegen, src/compiler, src/interpreter, src/libplatform. Drive-by: Remove some unreachable code. Bug: v8:13006 Change-Id: I1a9467f7e42531c545f660d35416c388e8ef9d3c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3749193 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#81613} | 3 年前 | |
[turbofan] Clean up unused phases in pipeline.cc Bug: 391750831 Change-Id: Id419299a8645cfa3e93cf10a6f06dc36f5f972a6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6284851 Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#98831} | 1 年前 | |
[cleanup] Replace some usages of base version with std version #2 This CL includes replacing some usages of base version with std version. For example, base::Optional with std::optional, base::nullopt with std::nullopt, etc. Bug: chromium:355676041, chromium:355003178 Change-Id: I87334a37c5d791725e47ba191de7b12eb6ba5af5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5757258 Reviewed-by: Shu-yu Guo <syg@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Ho Cheung <hocheung@chromium.org> Cr-Commit-Position: refs/heads/main@{#95484} | 1 年前 | |
Include guards should be at the top of files. For the include guard optimization to kick in the include guards should be the first thing in the file, not counting comments. In some cases the guard has been moved above a comment for consistency even though this does not matter. A couple of include guards have been renamed for uniqueness. git cl upload complained about some lint nits which have been fixed. Change-Id: Iaa208ea6557c36c84bc7bb77c787ba9feb7cf037 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6275067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98907} | 1 年前 | |
Remove some unused includes (4) Mostly src/codegen, src/compiler, src/interpreter, src/libplatform. Drive-by: Remove some unreachable code. Bug: v8:13006 Change-Id: I1a9467f7e42531c545f660d35416c388e8ef9d3c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3749193 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#81613} | 3 年前 | |
[base] Rename functional.h to hashing.h That header defines our custom hashing infrastructure, so we should name it appropriately. There's no reason to follow the stdlib naming, which defines std::hash in the <functional> header. R=leszeks@chromium.org Bug: 380896845 Change-Id: I5e45ba5e55f677daacbb342b4e6591e1b3e186ea Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6054260 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#97450} | 1 年前 | |
[handles] Migration to direct handles, part 3 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: ast, baseline, codegen, compiler, d8, diagnostics, extensions, ic, init, interpreter, logging, maglev, parsing, profiler. Bug: 42203211 Change-Id: I3ca12892acfe45f8458d19aa4cbd56ad01842c0a Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5615411 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Cr-Commit-Position: refs/heads/main@{#94363} | 2 年前 | |
Wasm-in-JS-inlining: Ensure consistent module The JSWasmCallParameters struct stores both a NativeModule* and a Module*. If they ever become inconsistent (the Module* not belonging to the NativeModule*) we would get all kinds of problems; also it's super cheap to get the Module* from the NativeModule*. This CL thus removes the Module* and the similarly redundant signature pointer. To be on the safe side we now also enforce that the NativeModule of all inlined Wasm functions is the same, not just the Module. Note that there is typically a 1:1 relation between them, except if the native module cache is explicitly disabled. R=dlehmann@chromium.org Change-Id: Ie6a9062281d58c8c513d77a06a48c11c0c85e498 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6616962 Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Daniel Lehmann <dlehmann@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#101225} | 11 个月前 | |
[turboshaft] Fix --turbo-stats for wasm wrappers Extend the lifetime of the TurbofanPipelineStatistics object to also cover the "Finalize" phase of the WasmTurboshaftWrapperCompilationJob. Plus some drive-by changes I applied while figuring out what's wrong (making some fields const and making PipelineStatisticsBase non-copyable). R=nicohartmann@chromium.org Fixed: 375286252 Bug: 376153005 Change-Id: I46a2c76f3066a1d617f4203cf86928cb1794362d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6038841 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#97317} | 1 年前 | |
[turboshaft] Fix --turbo-stats for wasm wrappers Extend the lifetime of the TurbofanPipelineStatistics object to also cover the "Finalize" phase of the WasmTurboshaftWrapperCompilationJob. Plus some drive-by changes I applied while figuring out what's wrong (making some fields const and making PipelineStatisticsBase non-copyable). R=nicohartmann@chromium.org Fixed: 375286252 Bug: 376153005 Change-Id: I46a2c76f3066a1d617f4203cf86928cb1794362d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6038841 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#97317} | 1 年前 | |
Merged: [contexts] Cleanup NativeContext::IsDetached() and friends In particular: - remove Isolate parameter from JSGlobalProxy::IsDetachedFrom() and IsDetached() methods, - add more efficient implementations of global_proxy() and global_object() accessors to NativeContext compared to generic ones in Context, - make Isolate::DetachGlobal() do nothing if the context is already detached. Bug: 466990858 (cherry picked from commit bdded6d6795a1fcf21ba9bdb31071f74b7436402) Change-Id: I659378a43a472bc49ca60e3b6bf5accebfc08b46 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7241452 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Auto-Submit: Igor Sheludko <ishell@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/branch-heads/14.4@{#12} Cr-Branched-From: 80acc26727d5a34e77dabeebe7c9213ec1bd4768-refs/heads/14.4.258@{#1} Cr-Branched-From: ce7e597e90f6df3fa4b6df224bc613b80c635450-refs/heads/main@{#104020} | 6 个月前 | |
[turboshaft] Implement a TYPESWITCH primitive for Turboshaft Drive-by: Significantly extended Turboshaft's ReducerTest to allow TS graphs to be compiled and executed by the tests. This is used for a typeswitch unittest. Drive-by: Rename a few CASE macros to avoid name collisions with the TYPESWITCH's CASE. Change-Id: I75178debcc0775e5b8887e4230012c347bdd6042 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6983292 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103051} | 8 个月前 | |
Reland "Reland "[maglev] Unpack thin string names"" This is a reland of commit 5186d3a89bcf241744556989f178dd0972ad36da Changed since the last attempt: * This time we were too conservative with unpacking, and missed some places that require a unique name (such as Builtin::kLoadIC_Megamorphic). * AFAICT, preserving object identity is only important for BuildCheckInternalizedStringValueOrByReference when a keyed access has been refined to a named access. Same in Turbofan. All other spots should use the unpacked name. * Given this, the design changed as follows. NamedAccessFeedback now stores both the original object reference, and the unpacked name. name returns the unpacked string. original_name_maybe_thin returns the original reference. * Now that this change also affects Turbofan, update the reference check there as well. Original change's description: > Reland "[maglev] Unpack thin string names" > > This is a reland of commit b2d9b42c92424de1f277cc41f0c315a0c6852b52 > > In the reland, we no longer attempt to unpack thin strings wherever we > can - this was problematic since it leads to confusion whenever object > identity is important, e.g. in compilation dependency validation or > runtime identity checks that deopt if failed. > > The reland only unpacks where it's actually relevant instead: > > * When deciding whether to refine kElementAccess feedback to > kNamedAccess; and > * when creating the AccessInfo for this named access. > > Original change's description: > > [maglev] Unpack thin string names > > > > I noticed that kElementAccess -> kNamedAccess feedback refinement > > was blocked by thin string names that haven't yet been rewritten to > > internalized strings by gc shortcutting. > > > > This is quite an important optimization, e.g. on date-format-xparb-SP it > > bumps the overall score by 25% when it hits. Prior to this CL, the > > optimization was only applied once the first Scavenge pass completed. > > > > This changes all relevant spots where NameRef objects are constructed > > to call the new UnpackIfThin function. > > > > In a followup, we may want to look at the TF side of this as well. It's > > possible that the same issue exists there, but is less exposed due to > > TF being slower and tiering up later. Note UnpackIfThin is already > > called in JSGraph::ConstantNoHole, but there may be other spots > > where thin strings are used without being unpacked. > > > > Change-Id: I1a7343a5d9dde13892f3c9249dfbcf9e1fe43985 > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6905403 > > Commit-Queue: Jakob Linke <jgruber@chromium.org> > > Auto-Submit: Jakob Linke <jgruber@chromium.org> > > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > > Reviewed-by: Darius Mercadier <dmercadier@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#102185} > > Change-Id: Idea05f4c5d7de251fb990b7476077ac1fc27c1ec > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6913688 > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Darius Mercadier <dmercadier@chromium.org> > Commit-Queue: Jakob Linke <jgruber@chromium.org> > Cr-Commit-Position: refs/heads/main@{#102258} Change-Id: Ifb5c52ecd335d33dd668cf373ca767608e12a08e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6919232 Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Jakob Linke <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#102341} | 9 个月前 | |
Reland "[maglev] No implicit Float64 <=> HoleyFloat64 conversion" This reverts commit cfc9e609fb50a28bcfe49fbebd4c8fff62c35a43. Reland fixes a number of bugs by handling missing cases of HoleyFloat64 handling, introducing missing conversion nodes and relaxing some DCHECKs. Bug: 448997822, 455515497, 458609996, 458677902, 458790911, 458849015, 458957498, 459129418, 459130968, 459310839, 459335522, 459526523, 459526524, 459629118 Change-Id: I94d2fc32f4c4d04544afd185fcf67d1447386ed1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7137286 Reviewed-by: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#103671} | 7 个月前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
Reland^2 "Embedding feedback in BytecodeArray for StrictEqual" This is a reland of commit e295f1f18da01c386eda73f535fb67a56c004d88 Original change's description: > Reland "Embedding feedback in BytecodeArray for StrictEqual" > > This is a reland of commit f0fed41e48b1966e3e565ae278d018da538ef123 > > Original change's description: > > Embedding feedback in BytecodeArray for StrictEqual > > > > This CL removes the feedback vector slot for StrictEqual and stores its feedback values directly in the BytecodeArray. Optimized compilers will now access the type feedback from the BytecodeArray. > > > > Before: > > 75 04 00 TestEqualStrict a1, [0] > > > > After: > > 75 04 00 00 TestEqualStrict a1, #0 > > > > This change saves moemory by reducing FeedbackVector size, and is part of the Sparkplug+ optimization effort. > > > > Bug: chromium:429351411 > > Change-Id: I24390811c12755b0a19beaefe2b0319d75ceaf6c > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6986847 > > Reviewed-by: Xu, Hao A <hao.a.xu@intel.com> > > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#103656} > > Bug: chromium:429351411 > Change-Id: I77286b0e9c65f8a9e257a2125adab7f68fe09aec > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7148333 > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103800} Bug: chromium:429351411 Change-Id: I5020c9dffbed90ff207520728b13cf0dbcfb5903 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7197099 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> Cr-Commit-Position: refs/heads/main@{#103962} | 7 个月前 | |
Reland^2 "Embedding feedback in BytecodeArray for StrictEqual" This is a reland of commit e295f1f18da01c386eda73f535fb67a56c004d88 Original change's description: > Reland "Embedding feedback in BytecodeArray for StrictEqual" > > This is a reland of commit f0fed41e48b1966e3e565ae278d018da538ef123 > > Original change's description: > > Embedding feedback in BytecodeArray for StrictEqual > > > > This CL removes the feedback vector slot for StrictEqual and stores its feedback values directly in the BytecodeArray. Optimized compilers will now access the type feedback from the BytecodeArray. > > > > Before: > > 75 04 00 TestEqualStrict a1, [0] > > > > After: > > 75 04 00 00 TestEqualStrict a1, #0 > > > > This change saves moemory by reducing FeedbackVector size, and is part of the Sparkplug+ optimization effort. > > > > Bug: chromium:429351411 > > Change-Id: I24390811c12755b0a19beaefe2b0319d75ceaf6c > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6986847 > > Reviewed-by: Xu, Hao A <hao.a.xu@intel.com> > > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#103656} > > Bug: chromium:429351411 > Change-Id: I77286b0e9c65f8a9e257a2125adab7f68fe09aec > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7148333 > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103800} Bug: chromium:429351411 Change-Id: I5020c9dffbed90ff207520728b13cf0dbcfb5903 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7197099 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> Cr-Commit-Position: refs/heads/main@{#103962} | 7 个月前 | |
[turbofan] Fix CheckedTruncateTaggedToWord32 redudancy elimination We can only eliminate these checks if the first is stricter than the second. Fixed: 433068894 Change-Id: I8dbd6ced806dda250ab12b96d8388c632cd7053a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6772967 Auto-Submit: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#101558} | 11 个月前 | |
[turbofan] Add proper conversions in RedundancyElimination Change-Id: Ia832abb79894dfde290a8127534b161d6fcc8178 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4197350 Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#85504} | 3 年前 | |
[compiler] Mark holes as background serialized Allocate a full HeapObjectData for the holes, and mark them as background serialized, so that their map is cached. This allows the compiler to read hole maps in optimisations and pattern matching, even if the holes are unmapped. Also some drive-by cleanup that replaces LookupOrInsert with InsertNew, since we already did a lookup at the start of TryGetOrCreateData. Bug: 434179415 Change-Id: Ifc5ebb7eaf1275a9282086f9b7eb9654e3d68991 Fixed: 446730212 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6979444 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#102732} | 9 个月前 | |
[compiler] Mark holes as background serialized Allocate a full HeapObjectData for the holes, and mark them as background serialized, so that their map is cached. This allows the compiler to read hole maps in optimisations and pattern matching, even if the holes are unmapped. Also some drive-by cleanup that replaces LookupOrInsert with InsertNew, since we already did a lookup at the start of TryGetOrCreateData. Bug: 434179415 Change-Id: Ifc5ebb7eaf1275a9282086f9b7eb9654e3d68991 Fixed: 446730212 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6979444 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#102732} | 9 个月前 | |
Enable undefined double on bots and make it non-experimental Bug: 385155404 Change-Id: Ib0ee24769f515d70ac9f4f5b4d8ff989e74fe8a2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6939123 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102519} | 9 个月前 | |
[turbofan] Use AdditiveSafeInt feedback for faster int add/sub Add Int53 addition feedback and use it during simplified lowering to optimize integer addition and subtraction. When one of the inputs is known to be within the Int53 range (since the check is relatively expensive), we can use a shifted integer addition instead of floating addition. AdditiveSafeInteger (Int53) is used instead of SafeInteger because the safe integer range (-2^53 + 1 to 2^53 -1) excludes -2^53. Using SafeInteger directly would require an additional check after the operation to ensure the result remains within the valid bounds. This change does *not* implement Maglev-specific optimizations. Bug: 384959125 Change-Id: I7b54d075c55ab7828e407cec03933a34be6247d5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6038008 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/main@{#98643} | 1 年前 | |
[revectorizer] Use range insert for on_stack_. Replaces a loop with a single call to std::set::insert using iterators, which is more concise. Change-Id: I43a473ca40ceb265d8ce2f810132397b586b4cd4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7041802 Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Commit-Queue: Jeffrey Yu <yuje@chromium.org> Cr-Commit-Position: refs/heads/main@{#103265} | 8 个月前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[fastcall] Support throwing exceptions A function called with a fast call can set a flag on the isolate to indicate that an exception has been thrown. As for normally throwing an exception, the exception has to be stored on the isolate anyways. Generated code then checks after a fast call if the flag on the isolate is set. If so, a runtime function is called that triggers stack unwinding through the normal exception handling of the C-Entry stub. Additionally deopt info is added to fast API calls, not because deopt is possible, but because deopt info is needed to generate stack traces for exceptions. The CL does the following changes: (1) The TurboFan node FastApiCall gets two control outputs for IfSuccess and IfException; (2) The Turboshaft operation FastApiCallOp gets the ability to throw an exception, and gets a FrameState input so that deopt information is generated for the call; (3) The instruction selector adds to a kArchCallCFunction the information if deopt info is needed for the call, and the code generator generates deopt info in that case; (4) A new flag is added to the isolate that allows generated code to check after a fast API call whether an exception has been thrown. R=dmercadier@chromium.org Bug: 41492790 Change-Id: If283205d66873fd5b7ac24462f950e36d1e52fef Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5442855 Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Reviewed-by: Marja Hölttä <marja@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#93357} | 2 年前 | |
[compiler] Remove unused BasicBlockInstrumentor Change-Id: I919506a1a407daf36a7170e6d4ee3636573b0cfa Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7093518 Reviewed-by: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103379} | 8 个月前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
Reland^2 "Embedding feedback in BytecodeArray for StrictEqual" This is a reland of commit e295f1f18da01c386eda73f535fb67a56c004d88 Original change's description: > Reland "Embedding feedback in BytecodeArray for StrictEqual" > > This is a reland of commit f0fed41e48b1966e3e565ae278d018da538ef123 > > Original change's description: > > Embedding feedback in BytecodeArray for StrictEqual > > > > This CL removes the feedback vector slot for StrictEqual and stores its feedback values directly in the BytecodeArray. Optimized compilers will now access the type feedback from the BytecodeArray. > > > > Before: > > 75 04 00 TestEqualStrict a1, [0] > > > > After: > > 75 04 00 00 TestEqualStrict a1, #0 > > > > This change saves moemory by reducing FeedbackVector size, and is part of the Sparkplug+ optimization effort. > > > > Bug: chromium:429351411 > > Change-Id: I24390811c12755b0a19beaefe2b0319d75ceaf6c > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6986847 > > Reviewed-by: Xu, Hao A <hao.a.xu@intel.com> > > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#103656} > > Bug: chromium:429351411 > Change-Id: I77286b0e9c65f8a9e257a2125adab7f68fe09aec > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7148333 > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103800} Bug: chromium:429351411 Change-Id: I5020c9dffbed90ff207520728b13cf0dbcfb5903 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7197099 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> Cr-Commit-Position: refs/heads/main@{#103962} | 7 个月前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[compiler] Add %MajorGCForCompilerTesting intrinsic So far, the way to invoke GCs from JS was to use gc() in combination with --expose-gc. However, this was leading to GC calls being generic runtime calls in the optimizing compilers, which was blocking all kind of optimizations. As such, weird tricks had to be used in order to repro GC timing issues, cf the repros in https://crrev.com/c/7184739 (which this CL nicely simplifies). The new %MajorGCForCompilerTesting intrinsic is marked as no-read no-write in Turbofan, Turboshaft and Maglev, which means that it won't block any optimizations and will allow to more easily fuzz and repro GC-timing-related bugs. Change-Id: I66cb03c77f350880b2667ca5ae44ab823ddb8f34 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7198340 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103914} | 7 个月前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Allow special nan patterns in NumberConstant Bug: 456131918 Change-Id: If01eff133d1f501ed77500bc870b10304d3f22d8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7124323 Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Auto-Submit: Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#103560} | 7 个月前 | |
Reland^2 "[hole] Remove hole raw number value" This is a reland of commit b998e975fc46f94d8f073c2e7b859e611a313786 Reland changes: * Only check Operator class tag in non-component builds, because of dynamic linker issues. Original change's description: > Reland "[hole] Remove hole raw number value" > > This is a reland of commit 47ac4aacc9726e35627b584cdb5c25aa6d1c754c > > Reland changes: > * Correctly load the Float64 instead of double parameter when > processing Float64Constant. > * Add debug checking to OpParameter which ensures that parameter > loads use the correct type. > > Original change's description: > > [hole] Remove hole raw number value > > > > Holes should, in general, not flow through code as values that need to > > be read. In particular, we should never perform a JS ToNumber operation > > on a Hole, since holes are not JS-visible values. > > > > Historically, holes were considered a form of oddball, and oddballs > > _did_ have ToNumber handling (by reading their raw number offset as if > > they were a HeapNumber), and in a few cases we ended up being sloppy and > > allowed Holes to go through the same path (to read the hole NaN value on > > array initialization or elements kinds transitions). > > > > However, in such cases, we _know_ that we are looking for the hole, and > > we _know_ that we actually want the hole NaN. So, we can be explicit > > about this, with the benefit that we can avoid the hole constant load > > and read from its raw number field, and instead can embed the hole NaN > > float64 constant where needed. > > > > This required a few changes to Float64Constant encoding in TurboFan > > (using an integer bit encoding rather than a double, to avoid losing the > > special NaN bits), and a few adjustments to representation changing > > which are explicit that we are converting a NumberOrHole rather than > > NumberOrOddball when changing a HOLEY_SMI_ELEMENTS array to > > HOLEY_DOUBLE_ELEMENTS. > > > > With these changes, we can remove the raw number field from Holes > > entirely. > > > > Bug: 434179415 > > Change-Id: I4d158466dcdcad9f676e6ba7dc1d6cb6e817d440 > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6786712 > > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#101712} > > Bug: 434179415 > Change-Id: Ic0995bdf4b0d050db645aa6c7899e5e2ec1ea38c > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6811578 > Auto-Submit: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#101758} Cq-Include-Trybots: luci.v8.try:v8_win64_dbg Bug: 434179415 Change-Id: Ia11950c24e29e69acc772aea45f1e3aa3ef2c76e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6821533 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101779} | 10 个月前 | |
[turbofan] Propagate context to StringToCaseIntl Fixed: 461531853 Change-Id: Ide9ffe81c243beb72fff1d32683f7e32a24d6135 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7177680 Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/main@{#103875} | 7 个月前 | |
[compiler] Add missing V8_EXPORT_PRIVATE Change-Id: Ie43f8b34cf31da6e5c12094ff509c1134ac5fdf4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6909220 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#102220} | 9 个月前 | |
Revert "[cleanup] Clean up extra inlined arguments frame" This reverts commit e5ba85174f1b152b7bb4d45bbda8291c8d23a9de. Reason for revert: Fails on blink bots: https://luci-milo.appspot.com/ui/inv/build-8759300068921273953/test-results?q=fast%2Fjs%2Fregress%2Ftear-off-arguments.html&sortby=&groupby= Original change's description: > [cleanup] Clean up extra inlined arguments frame > > Every time we inline a function with argument count different than > the parameter count, we retain all arguments (up to the parameter > count) twice in the deopt translated state. > > In the CL, we remove the duplication. > > Change-Id: I3de637dfeecad759328183ed369ac96e7c89ea98 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4714609 > Commit-Queue: Victor Gomes <victorgomes@chromium.org> > Reviewed-by: Darius Mercadier <dmercadier@chromium.org> > Cr-Commit-Position: refs/heads/main@{#91749} Change-Id: Ia5fe1498958fa8fa99235e68960ad38f9882e073 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5184178 Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Owners-Override: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#91751} | 2 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
Reland^2 "[hole] Remove hole raw number value" This is a reland of commit b998e975fc46f94d8f073c2e7b859e611a313786 Reland changes: * Only check Operator class tag in non-component builds, because of dynamic linker issues. Original change's description: > Reland "[hole] Remove hole raw number value" > > This is a reland of commit 47ac4aacc9726e35627b584cdb5c25aa6d1c754c > > Reland changes: > * Correctly load the Float64 instead of double parameter when > processing Float64Constant. > * Add debug checking to OpParameter which ensures that parameter > loads use the correct type. > > Original change's description: > > [hole] Remove hole raw number value > > > > Holes should, in general, not flow through code as values that need to > > be read. In particular, we should never perform a JS ToNumber operation > > on a Hole, since holes are not JS-visible values. > > > > Historically, holes were considered a form of oddball, and oddballs > > _did_ have ToNumber handling (by reading their raw number offset as if > > they were a HeapNumber), and in a few cases we ended up being sloppy and > > allowed Holes to go through the same path (to read the hole NaN value on > > array initialization or elements kinds transitions). > > > > However, in such cases, we _know_ that we are looking for the hole, and > > we _know_ that we actually want the hole NaN. So, we can be explicit > > about this, with the benefit that we can avoid the hole constant load > > and read from its raw number field, and instead can embed the hole NaN > > float64 constant where needed. > > > > This required a few changes to Float64Constant encoding in TurboFan > > (using an integer bit encoding rather than a double, to avoid losing the > > special NaN bits), and a few adjustments to representation changing > > which are explicit that we are converting a NumberOrHole rather than > > NumberOrOddball when changing a HOLEY_SMI_ELEMENTS array to > > HOLEY_DOUBLE_ELEMENTS. > > > > With these changes, we can remove the raw number field from Holes > > entirely. > > > > Bug: 434179415 > > Change-Id: I4d158466dcdcad9f676e6ba7dc1d6cb6e817d440 > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6786712 > > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#101712} > > Bug: 434179415 > Change-Id: Ic0995bdf4b0d050db645aa6c7899e5e2ec1ea38c > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6811578 > Auto-Submit: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#101758} Cq-Include-Trybots: luci.v8.try:v8_win64_dbg Bug: 434179415 Change-Id: Ia11950c24e29e69acc772aea45f1e3aa3ef2c76e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6821533 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101779} | 10 个月前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[tvos][wasm interpreter] Enable v8_enable_drumbrake This sets v8_enable_drumbrake on tvOS to use WebAssembly even though it couldn't have jit. tvOS works in a single process and v8 works with jitless on tvOS. Since v8 supports the wasm interpreter mode, v8_enable_drumbrake, tvOS enables WebAssembly with it in this patch. Bug: 430770578 Change-Id: Ie6da7523cd456c8d64a04963223ddd10ef11126e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6767696 Reviewed-by: Daniel Lehmann <dlehmann@chromium.org> Commit-Queue: Julie Jeongeun Kim <jkim@igalia.com> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#101755} | 10 个月前 | |
Rename JS-specific frame types and markers Turbofan is used for both JavaScript and Wasm, so we shouldn't assume that a TurboFan frame or code with TURBOFAN kind is JS. As Wasm uses its own CodeKind and its own frames, this CL renames the JS-specific types and constants to make it clear that they are JS specific. UnoptimizedFrame -> UnoptimizedJSFrame OptimizedFrame -> OptimizedJSFrame TurbofanFrame -> TurbofanJSFrame StackFrame::TURBOFAN -> StackFrame::TURBOFAN_JS plus some "java_script" -> "javascript" and JAVA_SCRIPT -> JAVASCRIPT. R=leszeks@chromium.org Change-Id: I822d27b39e5e72024091f42734d40c7c68aa439d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5904062 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#96567} | 1 年前 | |
[turbofan] fix JSON printing of constants containing special characters This will fix for instance function foo(x) { return x + '"'; } The '"' will be embedded in the bytecode as a constant, and when it gets printed, it needs to be properly escaped. Change-Id: I7b3f54c9bb5c7a8abe8074ff9c1b4ce4b3d8dc8a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7045186 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Auto-Submit: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103134} | 8 个月前 | |
[turbofan] fix JSON printing of constants containing special characters This will fix for instance function foo(x) { return x + '"'; } The '"' will be embedded in the bytecode as a constant, and when it gets printed, it needs to be properly escaped. Change-Id: I7b3f54c9bb5c7a8abe8074ff9c1b4ce4b3d8dc8a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7045186 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Auto-Submit: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103134} | 8 个月前 | |
[zone] Remove zone compression Compression has been unused for many years. Removing it allows simplifying allocation/freeing paths. Bug: 409953791 Change-Id: I65a38d48e8d2ca2e2ffb131799d20dacb7899d0a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6568895 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#100686} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
Reland^2 "Embedding feedback in BytecodeArray for StrictEqual" This is a reland of commit e295f1f18da01c386eda73f535fb67a56c004d88 Original change's description: > Reland "Embedding feedback in BytecodeArray for StrictEqual" > > This is a reland of commit f0fed41e48b1966e3e565ae278d018da538ef123 > > Original change's description: > > Embedding feedback in BytecodeArray for StrictEqual > > > > This CL removes the feedback vector slot for StrictEqual and stores its feedback values directly in the BytecodeArray. Optimized compilers will now access the type feedback from the BytecodeArray. > > > > Before: > > 75 04 00 TestEqualStrict a1, [0] > > > > After: > > 75 04 00 00 TestEqualStrict a1, #0 > > > > This change saves moemory by reducing FeedbackVector size, and is part of the Sparkplug+ optimization effort. > > > > Bug: chromium:429351411 > > Change-Id: I24390811c12755b0a19beaefe2b0319d75ceaf6c > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6986847 > > Reviewed-by: Xu, Hao A <hao.a.xu@intel.com> > > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#103656} > > Bug: chromium:429351411 > Change-Id: I77286b0e9c65f8a9e257a2125adab7f68fe09aec > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7148333 > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103800} Bug: chromium:429351411 Change-Id: I5020c9dffbed90ff207520728b13cf0dbcfb5903 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7197099 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> Cr-Commit-Position: refs/heads/main@{#103962} | 7 个月前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
[turbofan] Support null === string comparisons Bug: 421202289 Change-Id: Ic07fbe2bffdb7d3306e2e8511ae392ac56fb7066 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6607329 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#100650} | 1 年前 | |
[turbofan] Add the v8_enable_turbofan build option When disabled, Turbofan is fully excluded from the compilation result. This is expected to reduce V8's contribution to chromium's binary size by roughly 20%. If Turbofan is disabled, Maglev and Webassembly must also be disabled (since both depend on TF). Note this new configuration (v8_enable_turbofan=false) is not yet used anywhere - we'll probably enable it for lite_mode bots in an upcoming CL for test coverage. Changes in detail: - Split out all src/compiler files from the main source sets. This was mostly done already, here we only clean up the few files that were left. - Define a new main TF entry point in turbofan.h. NewCompilationJob replaces Pipeline::NewCompilationJob. - When TF is enabled, turbofan-enabled.cc implements the above. - When disabled, turbofan-disabled stubs out the above with a runtime FATAL message. - The build process is modified s.t. mksnapshot always has TF available since it's needed to generate builtins. When disabled, TF is removed from other components, in particular it is no longer included in v8_compiler and transitively in v8_base. - When disabled, v8_for_testing no longer has v8_initializers available. These were only needed for test-serialize.cc, which is now excluded from this build mode. - When disabled, remove all related cctest/ und unittest/ files from the build. Bug: v8:13629 Change-Id: I63ab7632f03d0ee4a787cfc01574b5fdb08fd80b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4128529 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Jakob Linke <jgruber@chromium.org> Reviewed-by: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Jakob Linke <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#85210} | 3 年前 | |
v8: Fix -Wextra-semi warnings, enable warning. For macros expanding to function definitions, I removed the spurious ; after macro invocations. For macros expandign to function declarations, I made the ; required and consistently inserted it. No behavior change. Bug: chromium:926235 Change-Id: Ib8085d85d913d74307e3481f7fee4b7dc78c7549 Reviewed-on: https://chromium-review.googlesource.com/c/1467545 Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Yang Guo <yangguo@chromium.org> Commit-Queue: Nico Weber <thakis@chromium.org> Cr-Commit-Position: refs/heads/master@{#59558} | 7 年前 | |
[compiler] Optimize Date.prototype.getXXX() accessors ... in Maglev and TurboFan. This CL: - adds NoDateTimeConfigurationChangeProtector, - makes sure that JSDate's cached fields are always initialized, which make it possible to read cached fields directly without additional run-time checks. Drive-by: - move DateCache::stamp_ field to IsolateData (this removes one indirection on access and avoids potential issues with reallocated DateCache object), - make deserializer recompute cached fields after deserialization to match current date/time configuration which could have been different during snapshot creation, - simplify definition of alignment padding fields in ISOLATE_DATA_FIELDS by introducing PADDING_FIELD macro. Bug: 411352101 Change-Id: I69e25b1ce7e2c79f9aeee69e97192be62a08c2c0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6535917 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#100248} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turboshaft] Support NewConsString in StringConcatEscapeAnalysis Drive-by: * Detect more cases where we can emit NewConsString rather than StringConcat. * Constant-fold StringLength(NewConsString). Bug: 431933185 Change-Id: Ie34ffc3bac0d8b6f4eb36aaecc6b23111b95579c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6909222 Commit-Queue: Darius Mercadier <dmercadier@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#102279} | 9 个月前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[turbofan] Set truncation check_safe_int for non Word32 truncation Used for monotonicity checking in debug mode. Fixed: 417385084 Change-Id: I98d96d4279c1dd26ce73a14053ad1abd231e6e99 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6555764 Auto-Submit: Victor Gomes <victorgomes@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/main@{#100316} | 1 年前 | |
[zone] Rename Zone::NewArray to Zone::AllocateArray The function does not construct the objects in the array and therefore is not comparable to new T[length] in C++. Follow-up change for renaming NewVector: https://crrev.com/c/4685550 Change-Id: I0db92dae2895bbb1162a3f7a483025ca89adf819 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4686973 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#88985} | 2 年前 | |
Move remaining files in src/ TBR=mvstanton@chromium.org,neis@chromium.org,ahaas@chromium.org Bug: v8:9247 Change-Id: I5433c863a54f3412d73df0d38aba3fdbcfac7ebe Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627973 Commit-Queue: Yang Guo <yangguo@chromium.org> Auto-Submit: Yang Guo <yangguo@chromium.org> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#61830} | 6 年前 | |
Reland^2 "Embedding feedback in BytecodeArray for StrictEqual" This is a reland of commit e295f1f18da01c386eda73f535fb67a56c004d88 Original change's description: > Reland "Embedding feedback in BytecodeArray for StrictEqual" > > This is a reland of commit f0fed41e48b1966e3e565ae278d018da538ef123 > > Original change's description: > > Embedding feedback in BytecodeArray for StrictEqual > > > > This CL removes the feedback vector slot for StrictEqual and stores its feedback values directly in the BytecodeArray. Optimized compilers will now access the type feedback from the BytecodeArray. > > > > Before: > > 75 04 00 TestEqualStrict a1, [0] > > > > After: > > 75 04 00 00 TestEqualStrict a1, #0 > > > > This change saves moemory by reducing FeedbackVector size, and is part of the Sparkplug+ optimization effort. > > > > Bug: chromium:429351411 > > Change-Id: I24390811c12755b0a19beaefe2b0319d75ceaf6c > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6986847 > > Reviewed-by: Xu, Hao A <hao.a.xu@intel.com> > > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#103656} > > Bug: chromium:429351411 > Change-Id: I77286b0e9c65f8a9e257a2125adab7f68fe09aec > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7148333 > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103800} Bug: chromium:429351411 Change-Id: I5020c9dffbed90ff207520728b13cf0dbcfb5903 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7197099 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> Cr-Commit-Position: refs/heads/main@{#103962} | 7 个月前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[build] Add Turboshaft sources to fast_mksnapshot Bug: 342692713 Change-Id: I03fccd012a8a7315b3f44979810b04d373e8e6bf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5893179 Auto-Submit: Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#96331} | 1 年前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[wasm] Wrappers: always call builtins via pointer This patch makes import wrappers always use StubCallMode::kCallBuiltinPointer, because that call mode is compatible with future process-wide wrapper sharing. Bug: 42204526 Change-Id: If93b680b683a8095367699c6500c7563b803cbe8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5783683 Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#95603} | 1 年前 | |
Include guards should be at the top of files. For the include guard optimization to kick in the include guards should be the first thing in the file, not counting comments. In some cases the guard has been moved above a comment for consistency even though this does not matter. A couple of include guards have been renamed for uniqueness. git cl upload complained about some lint nits which have been fixed. Change-Id: Iaa208ea6557c36c84bc7bb77c787ba9feb7cf037 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6275067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98907} | 1 年前 | |
[turboshaft][wasm] Add type assertions to type optimizer These assertions could help fuzzers in detecting type confusions in generated wasm-gc code. Bug: 450246010 Change-Id: I685b5b1a1d406459aeac4e1877e823e279ef2512 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7022989 Commit-Queue: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Auto-Submit: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#103045} | 8 个月前 | |
[turboshaft][wasm] Add type assertions to type optimizer These assertions could help fuzzers in detecting type confusions in generated wasm-gc code. Bug: 450246010 Change-Id: I685b5b1a1d406459aeac4e1877e823e279ef2512 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7022989 Commit-Queue: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Auto-Submit: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#103045} | 8 个月前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
[wasm] Argument flags for fast calls are not supported Bug: 455711115 Change-Id: I9192706f32be0f13c739229fa3259dea8432e1b0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7089595 Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Commit-Queue: Andreas Haas <ahaas@google.com> Cr-Commit-Position: refs/heads/main@{#103388} | 8 个月前 | |
[wasm][turbofan] Escape analysis: Ignore unused phi nodes In some cases there might be left-over phis without any uses. With this change the escape analysis will not preserve the allocation just because of such unused phis. Bug: v8:7748 Change-Id: I26c1f0a0323e278ab35a771e3ef9d4df454d1ad6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4654607 Commit-Queue: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#88576} | 2 年前 | |
Include guards should be at the top of files. For the include guard optimization to kick in the include guards should be the first thing in the file, not counting comments. In some cases the guard has been moved above a comment for consistency even though this does not matter. A couple of include guards have been renamed for uniqueness. git cl upload complained about some lint nits which have been fixed. Change-Id: Iaa208ea6557c36c84bc7bb77c787ba9feb7cf037 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6275067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98907} | 1 年前 | |
[wasm] Fix missing Smi checks since crrev.com/c/7054524 The recent refactoring crrev.com/c/7054524 caused a few Smi checks to be missed due to an overly strict equality comparison. Bonus change: the v8_wasm_deopt_fuzzer didn't properly distinguish between the sets of existing functions and existing function types. Fixed: 453769899, 453846765 Change-Id: I7c937d4adaf5675966ee574114afce6e0c723870 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7067198 Reviewed-by: Clemens Backes <clemensb@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#103279} | 8 个月前 | |
[compiler] Do not drop TypeGuards in WasmGCLowering Because when we have inlined Wasm into JS, WasmGCLowering also removes the JS TypeGuards, which then allows pure node to float above some checks. Fixed: 427502241 Change-Id: Icce65e3665cb31f64f9d5e9d4dd12f24b08d65dd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6728035 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Auto-Submit: Darius Mercadier <dmercadier@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#101366} | 11 个月前 | |
[wasm][cleanup] Subtyping: one module is often enough Several functions took two parameters (module1, module2) when in fact we'd only ever call them with the same module for both. This patch simplifies that code. No change in behavior intended. Change-Id: I8be4c8e4d930cbdc9eee78150cc1093ac384e125 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6512812 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#100068} | 1 年前 | |
Include guards should be at the top of files. For the include guard optimization to kick in the include guards should be the first thing in the file, not counting comments. In some cases the guard has been moved above a comment for consistency even though this does not matter. A couple of include guards have been renamed for uniqueness. git cl upload complained about some lint nits which have been fixed. Change-Id: Iaa208ea6557c36c84bc7bb77c787ba9feb7cf037 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6275067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98907} | 1 年前 | |
Reland "[contexts] Unify context accessors after ContextCells" This is a reland of commit d2ab66c2a942893b9f6d7628ff8892e1d6a607b3 Changes from original: - The test inspector/debugger/set-breakpoint-after-gc relies on precise garbage collection and may fail if conservative stack scanning is used. We call GC multiple times to ensure the weak reference hold by the script is eventually collected. - Allow reading a ContextCell when printing debug stack frame. Original change's description: > [contexts] Unify context accessors after ContextCells > > The introduction of ContextCells removed the need for special handling > for ScriptContext (which previously used a side table for > let/const tracking and mutable numbers). > > This change refactors the context access logic: > - Internal get/set accessors are now protected to the Context class. > - External access should use the new functions: > - Get/Set: A safe (though potentially slower) > function for accessing elements in any context. > - GetNoCell/SetNoCell: A faster function that verifies the > element being accessed is not a ContextCell. > > Additionally, related bytecode operations and optimizer functions have > been renamed for consistency with these changes. > > Bug: 408128754 > > Change-Id: I785281ab6f13b0ae65578eb5d2f0a5750457ab5e > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6450582 > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Commit-Queue: Victor Gomes <victorgomes@chromium.org> > Cr-Commit-Position: refs/heads/main@{#99844} Bug: 408128754, 40789559 Change-Id: I78a3a99a4f364ed78965fbed56a084d38382d2fc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6479814 Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#99865} | 1 年前 | |
[cleanup] Modernize std::*::value and ::type Mechanically replacing std::foo<X>::value with std::foo_v<X>, and the same for ::type -> _t. Change-Id: I543dda07ba4c95534cdcd51f1f438f2626be8273 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6491388 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#99940} | 1 年前 | |
[compiler][wasm] Wasm-into-JS inlining: Disable i64 operations on 32 bits In almost all cases i64 operations are implicitly disabled because the js-to-wasm wrapper does not get inlined if it has an i64 in its signature. Still, with careful crafting, cases can be constructed where the inlined graph contains i64 operations without performing the needed int64-lowering on 32 bit machines. Fixed: 454363539 Change-Id: Iea563e71985f5d91cf4aa9e058d415b3dbd3cebc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7079509 Commit-Queue: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Daniel Lehmann <dlehmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#103318} | 8 个月前 | |
Include guards should be at the top of files. For the include guard optimization to kick in the include guards should be the first thing in the file, not counting comments. In some cases the guard has been moved above a comment for consistency even though this does not matter. A couple of include guards have been renamed for uniqueness. git cl upload complained about some lint nits which have been fixed. Change-Id: Iaa208ea6557c36c84bc7bb77c787ba9feb7cf037 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6275067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98907} | 1 年前 | |
Reland "[wasm] Differentiate the stack guard on loop back edges" This is a reland of commit 5868db33ba95544a8945bfc6f478cb79de0cf641 Changed in reland: when we only handle no-heap-write interrupt requests, we should only check for such requests. Original review: crrev.com/c/7036471 Change-Id: I745216818096640672d3b75c230e6235b166d4c0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7062937 Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#103226} | 8 个月前 | |
[turbofan] Replace Adapter-dependent types in instruction selectors Drive-by: Rename Turbofan's Graph to TFGraph to avoid name collisions when compiler and turboshaft namespaces are present. Bug: 391750831 Change-Id: I20f8bd6f30a9d46dd7657715b2a9296c377af16a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6299391 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98899} | 1 年前 | |
[wasm][cleanup] Stop using HeapType::Representation That enum has been deprecated for a long time, this CL replaces all uses of it with its replacements (mostly "GenericKind"). This is, in particular, a prerequisite for increasing the maximum number of canonical type indices. Bug: 452635472, 42203975 Change-Id: Ia4c0d6b5f35c330e8f8f3b81a69d02b32e23e063 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7054524 Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103219} | 8 个月前 | |
Include guards should be at the top of files. For the include guard optimization to kick in the include guards should be the first thing in the file, not counting comments. In some cases the guard has been moved above a comment for consistency even though this does not matter. A couple of include guards have been renamed for uniqueness. git cl upload complained about some lint nits which have been fixed. Change-Id: Iaa208ea6557c36c84bc7bb77c787ba9feb7cf037 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6275067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98907} | 1 年前 | |
[compiler] Support skipped write barrier verification in Turbofan This CL adds skipped write barrier verification support to Turbofan. For this the compiler generates calls to Heap::VerifySkippedWriteBarrier to all stores which got their write barrier eliminated during compilation. For this we need to add a new WriteBarrierKind kSkippedWriteBarrier which is used by the compiler instead of kNoWriteBarrier when eliminating write barriers. We need this additional state to different stores with skipped write barriers from stores that cannot have a write barrier (e.g. Float64). Note that we only use kSkippedWriteBarrier when write barrier verification is enabled, production code should not be affected. Bug: 437096305 Change-Id: I303155ca769af209b443af0a9f547f99e8997ca0 Cq-Include-Trybots: luci.v8.try:v8_mac_arm64_dbg Cq-Include-Trybots: luci.v8.try:v8_linux_arm_dbg Cq-Include-Trybots: luci.v8.try:v8_linux_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6895961 Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#102246} | 9 个月前 | |
[zone] Remove zone compression Compression has been unused for many years. Removing it allows simplifying allocation/freeing paths. Bug: 409953791 Change-Id: I65a38d48e8d2ca2e2ffb131799d20dacb7899d0a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6568895 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#100686} | 1 年前 | |
[zone] Remove zone compression Compression has been unused for many years. Removing it allows simplifying allocation/freeing paths. Bug: 409953791 Change-Id: I65a38d48e8d2ca2e2ffb131799d20dacb7899d0a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6568895 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#100686} | 1 年前 |