| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
[heap] Format sizes for OOM crash keys Large sizes are a bit hard to read at the moment. This CL formats sizes in KB or MB when emitting those values as crash keys. Bug: 389951203 Change-Id: I4d70929bfa1fd67411c011e2db8b0d56b3b27667 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7121988 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#103588} | 7 个月前 | |
[execution, heap] Remove Isolate::InFastCCall() Isolate::InFastCCall() simply returns whether the latest transition from JS to native code was a regular CEntry or a fast API call. This also used to be the only JS to native transition that could be a fast API call. So Isolate::InFastCCall() would correctly report whether there was a fast API call on the stack or not and this method was used in this way. However, now that we allow JS calls from fast api calls, it could return false even though there is an earlier fast API call on the stack. This CL removes this method to clean up this confusion. It also drops --allow_allocation_in_fast_api_call as this is now fully supported and enabled in V8. Bug: 424905890 Change-Id: Ib1626b30e1e8436513648c906ed4476f3cb6f77c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6678594 Reviewed-by: Andreas Haas <ahaas@google.com> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#103212} | 8 个月前 | |
[ArkWeb][安全][自动提交] 修复 Chromium issue 515275150: [cppgc] Fix memory ordering race in ObjectStartBitmap Signed-off-by: ringking <renkang2@huawei.com> | 11 天前 | |
buganizer: fix component IDs in DIR_METADATA This only matches the old monorail components. Bug: 341800538 Change-Id: Id74fbdb3b9be0c858b77af84966c6c37adf78c5c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6025833 Reviewed-by: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Paul Semel <paulsemel@chromium.org> Commit-Queue: Paul Semel <paulsemel@chromium.org> Cr-Commit-Position: refs/heads/main@{#97252} | 1 年前 | |
[ro-promotion] Add instance types to tracing output We can't use Print(o) or Brief(o) since the heap is not yet finalized; but the instance type is available. Example output with --trace-read-only-promotion: ro-promotion: rejected due to failed predicate 0x9b00014399d (FUNCTION_TEMPLATE_INFO_TYPE) ro-promotion: rejected due to rejected subgraph 0x9b0001439d9 (CALL_HANDLER_INFO_TYPE) at slot offset 8 0x9b00014399d (FUNCTION_TEMPLATE_INFO_TYPE) Also, set src/snapshot/OWNERS as per-file owners of src/heap/read-only-promotion.*. Bug: v8:13789 Change-Id: I8b469cc4533cfe6020e0849eb7381feb2bdfe027 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4827305 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Auto-Submit: Jakob Linke <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#89723} | 2 年前 | |
[heap] Add write barrier markdown documentation Add documentation about write barrier implementations in our compilers. Bug: 338342768 Change-Id: I14c997256ead7927d7e1c4a7af5a11d6f7605cbf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5595016 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#94243} | 2 年前 | |
[heap] Fix some clang-tidy warnings Fix a few clang tidy warnings. Change-Id: I3e025948a70c99a1513eb2ee66bc0da5d02437c8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5797192 Reviewed-by: Anton Bikineev <bikineev@chromium.org> Auto-Submit: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Anton Bikineev <bikineev@chromium.org> Cr-Commit-Position: refs/heads/main@{#95741} | 1 年前 | |
Reland "[heap] Merge large allocation code paths" This is a reland of commit 2ca77f5fc33901e8f6ee356c64fc1f10d9c5c4c6 Now that https://crrev.com/c/5040952 landed again with a fix. This CL can reland unchanged. Original change's description: > [heap] Merge large allocation code paths > > This CL merges large object allocation code paths for main and > background threads. > > Bug: chromium:1480975 > Change-Id: I641b55561d7a27be6651bb230441ed3aac2e5f41 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5033404 > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> > Cr-Commit-Position: refs/heads/main@{#91015} Bug: chromium:1480975 Change-Id: I201b8250ceae5938768ddd387c7186b2f5bf4999 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5038712 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#91052} | 2 年前 | |
[heap] Unify CustomAllocateWithRetry with normal retry logic Unify CustomAllocateWithRetry and AllocateRawWithRetryOrFailSlowPath. This ensures we actually retry allocation of dispatch handles twice. Bug: 395536898 Change-Id: I27e1bb36a8b00c32073db24c572d3bb6241f01cc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6275065 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Auto-Submit: Olivier Flückiger <olivf@chromium.org> Commit-Queue: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#98746} | 1 年前 | |
[base] Rename functional.h to hashing.h That header defines our custom hashing infrastructure, so we should name it appropriately. There's no reason to follow the stdlib naming, which defines std::hash in the <functional> header. R=leszeks@chromium.org Bug: 380896845 Change-Id: I5e45ba5e55f677daacbb342b4e6591e1b3e186ea Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6054260 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#97450} | 1 年前 | |
[heap] Add ArrayBuffers back to Heap::backing_store_bytes() This CL adds back ArrayBuffer sizes to Heap::backing_store_bytes(), which was removed in https://crrev.com/c/7159853. We add/subtract from the global counter in the exact same spot as we used to before. Bug: 460166671 Change-Id: I7cbe5137aa5b954894f645a7c6e5e14585a7cec4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7203939 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#104008} | 7 个月前 | |
[heap] Add ArrayBuffers back to Heap::backing_store_bytes() This CL adds back ArrayBuffer sizes to Heap::backing_store_bytes(), which was removed in https://crrev.com/c/7159853. We add/subtract from the global counter in the exact same spot as we used to before. Bug: 460166671 Change-Id: I7cbe5137aa5b954894f645a7c6e5e14585a7cec4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7203939 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#104008} | 7 个月前 | |
Adopt ToString() and operator<<() pattern for heap enums Change-Id: I0a50fc697ff019d742105f71eb6f1f60e6e76813 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4665400 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Auto-Submit: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#88657} | 2 年前 | |
enable jitfort for memory w^x protection Signed-off-by: zzhengxiang <zhengxiang27@h-partners.com> | 25 天前 | |
Reland "[heap] Fix removal of red zones in CodeRange" This is a reland of commit a2b6725bdb5bdc30e687bba87642886a3917adea Original change's description: > [heap] Fix removal of red zones in CodeRange > > The allocator does not support returning partial reservations. > Implement proper red-zone management that returns the whole region and > re-allocates sub-regions to accomodate for this restriction. > > Bug: 429538831 > Change-Id: I1503b000e4f558da0eb49ddd00112f14d7156982 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6978766 > Commit-Queue: Michael Lippautz <mlippautz@chromium.org> > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Cr-Commit-Position: refs/heads/main@{#102740} Bug: 429538831 Fixed: 447256479 Change-Id: Idae5865ee1b37c7a415230ae632211cd9a0d03d3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6982564 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102759} | 9 个月前 | |
[heap] Remove code comment accounting from --code-stats As far as I can tell, this accounts code section sizes, bucketed by code comment contents. The accounting is broken for comments that refer to sections past instructions_size (e.g. the safepoint table). I don't think this is in use or could be useful. Let's remove it. Fixed: 373025978 Change-Id: I3555c8d9ec8e8cbbcee6bb36d6a2fe249ed72c2b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6021041 Auto-Submit: Jakob Linke <jgruber@chromium.org> Commit-Queue: Jakob Linke <jgruber@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#97259} | 1 年前 | |
[heap] Remove code comment accounting from --code-stats As far as I can tell, this accounts code section sizes, bucketed by code comment contents. The accounting is broken for comments that refer to sections past instructions_size (e.g. the safepoint table). I don't think this is in use or could be useful. Let's remove it. Fixed: 373025978 Change-Id: I3555c8d9ec8e8cbbcee6bb36d6a2fe249ed72c2b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6021041 Auto-Submit: Jakob Linke <jgruber@chromium.org> Commit-Queue: Jakob Linke <jgruber@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#97259} | 1 年前 | |
[heap] Support CollectAllAvailableGarbage from background This makes HeapAllocator retry loop more consistent between main and background threads. Bug: 448848875 Change-Id: Id793532aeeb99d45515ae9ca10aa1d09c4ba50a7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7017890 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org> Cr-Commit-Position: refs/heads/main@{#103139} | 8 个月前 | |
[heap] Support CollectAllAvailableGarbage from background This makes HeapAllocator retry loop more consistent between main and background threads. Bug: 448848875 Change-Id: Id793532aeeb99d45515ae9ca10aa1d09c4ba50a7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7017890 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org> Cr-Commit-Position: refs/heads/main@{#103139} | 8 个月前 | |
[tagged-ptr] Move heap.h/cc to use Tagged<T> Bug: v8:12710 Change-Id: I0d864b554e221abbc25349d95a3e2822460a88a6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4675726 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#88895} | 2 年前 | |
[heap] Remove third party heap interface The interface at this point is outdated and not actively used. In addition, there's various bits and pieces missing for incremental/concurrent GCs. Change-Id: I346007d579ccc9803f5764eef905a61a2a6e6947 Bug: 360909070 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5797605 Reviewed-by: Anton Bikineev <bikineev@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#95718} | 1 年前 | |
[heap] Unify young and old epochs to a single epoch Scavenger can't run during incremental marking anymore, so we can unify epoch_young_ and epoch_old now to a single epoch_. Bug: 456384548 Change-Id: I400aef02ace44d251415083edac74573e7940a3c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7150844 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#103715} | 7 个月前 | |
[heap] Remove code to turn off --separate-gc-phases --no-separate-gc-phases is no longer supported, and resulting unused code is also removed. Bug: 365694581 Change-Id: Iacb746b04156470a73b60297364088dd264c8050 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6419255 Feels: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#99626} | 1 年前 | |
[heap] Fix ConservativeStackVisitorBase initialization Instead of initializing trusted_cage_base_ with the cage base from IsolateData, it was initialized with the address of the cage base. Change-Id: I7407343560aa284ffca2ae7728453f1927caac2a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6836352 Reviewed-by: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#101851} | 10 个月前 | |
[heap] Avoid repeatedly loading page metadata in css The young gen conservative visitor loads the the page metadata address many times per page during page iteration. It only need to the marking bitmap from the page metadata. Avoid the repeated loads by stashing the bitmap pointer and passing it to the visitor as an argument for the methods that need it. Bug: 379788114 Change-Id: I97512b4195f905f759976a73ab55f62bf1830a89 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6189988 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#98273} | 1 年前 | |
[base] Merge SpinningMutex back into Mutex They are now the same; beyond that we can't do ave THREAD_SAFETY_ANALYSIS on a bunch of previous SpinningMutex cases, so we'll need to propagate this into Mutex. Bug: 384940357 Change-Id: Ifbd4ffc4090738455036f32d9a5cf813b9f15781 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6244422 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#98597} | 1 年前 | |
[heap] Avoid using ephemeron remembered set in full GC The ephemeron_remembered_set() is used as the OLD_TO_NEW remembered set for ephemeron keys. It is an optimization to avoid strongifying such references in minor GCs. After a full GC there are no OLD_TO_NEW references anymore, so we are already able to drop this remembered set at the end of the GC. But we still need this remembered set for updating pointers during the GC for the same reason we need OLD_TO_NEW there as well: We don't record pointers to new space in the OLD_TO_OLD remembered set. We need it to find all pointers to new space objects for relocating them. This CL is able to avoid usage of the ephemeron_remembered_set() during the full GC entirely. During incremental marking the write barrier and marker record pointers to young objects for ephemeron keys in the regular OLD_TO_NEW remembered set instead. With this the "update pointers" phase can treat ephemeron keys like regular OLD_TO_NEW slots and doesn't need special handling anymore. Change-Id: Id2ba6884e69ed01d8d09951b30060b10ea867937 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6917693 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#102391} | 9 个月前 | |
【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Signed-off-by: Marja Hölttä <marja@chromium.org> | 25 天前 | |
[objects, heap] Introduce SafeHeapObjectSize as uint32_t alias A lot of code in the GC uses unsigned sizes (e.g. size_t) to copy around bytes or iterate objects. The size of on-heap objects is stored as int. Attackers can craft negative sizes that can lead to very large offsets via sign extension and e.g. conversion to size_t. We can mitigate this problem by relying on SafeHeapObjectSize which is an alias to uint32_t. The alias allows for highlighting potentially violations and incrementally changing code. uint32_t is safe as it can always be used as byte size directly or cast to size_t without exceeding the sandbox. Bug: 425896305 Change-Id: I30abb716f7fa588f60991886d956a6024b170e2e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6651890 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Samuel Groß <saelo@chromium.org> Reviewed-by: Anton Bikineev <bikineev@chromium.org> Cr-Commit-Position: refs/heads/main@{#100896} | 1 年前 | |
[heap] Use SafeHeapObjectSize in more places In particular use it for iterating live object ranges and rework the affected callsites. Bug: 425896305 Change-Id: I5a086e1eafb0f151cf7d6e2b1eb79aab4eeeb50b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6719831 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Anton Bikineev <bikineev@chromium.org> Cr-Commit-Position: refs/heads/main@{#101342} | 11 个月前 | |
[heap] Move evacuation and allocation related flags to metadata EVACUATION_CANDIDATE: Duplicate the flag in the metadata object. The untrusted flag is preserved for fast write barrier checks. Moved completely to metadata object: - NEVER_EVACUATE - NEVER_ALLOCATE_ON_PAGE - FORCE_EVACUATION_CANDIDATE_FOR_TESTING Bug: 429538831 Change-Id: I844301affe07b20aeaf7f56f459c1cff530fbbd0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6783000 Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#101632} | 11 个月前 | |
Reland: [objects] Fully remove instance_type-dispatch (Reland of https://crrev.com/c/5957196) This CL removes the instance_type-dispatch used for object visitation and switches all remaining users to the visitor_id-dispatch. Non-heap users of object visitation can now use VisitObject() or VisitObjectBody() to visit an object, which both use the visitor_id-dispatch under the hood. Heap-internal users can also use the HeapVisitor class directly. Changes in Reland: The instance_type-dispatch always visited the full JSObject including slack. In the marking visitor we didn't want that. However, the serializer silently breaks as soon as we don't visit the slack anymore. This CL fixes this by adding an additional ShouldVisitFullJSObject() predicate. All VisitObjectXXX()-methods set this predicate to true to preserve behavior from the instance_type-dispatch. This CL also starts overriding the VisitEphemeron() method. Bug: 372749729 Change-Id: I87a0b4a03c03391eb5b433ef20efbe8143cce889 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5972073 Reviewed-by: Anton Bikineev <bikineev@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#96904} | 1 年前 | |
[tagged-ptr] Convert more Objects to Tagged<> Convert a large amount of Objects to Tagged<Object>, by using a clang tool to convert all variables and parameters to Tagged<>, and manually fixing up any build failures this caused. Bug: v8:12710 Change-Id: I2bfc90220fe92ebc6487b5cddbc4166164637a71 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4827204 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89750} | 2 年前 | |
[ptr-compr] Use global cage when initialising from Isolate Don't read the IsolateData cage_base when initialising the PtrComprCageBase from Isolate/LocalIsolate, but just use the global cage. This should help the compiler deduplicate these values, and helps reduce the header tangle. Change-Id: If76f301a61342f3e813e8aebeb09a7aca4a3a329 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6491095 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#99918} | 1 年前 | |
Reland "[sandbox] Build foundation for bytecode verification" This is a reland of commit 4fc454962b371d3e5f94ba8d03f8268a66cf49df Gracefully handle non-initialized BytecodeWrapper in heap verification. Original change's description: > [sandbox] Build foundation for bytecode verification > > This CL creates the foundation for building bytecode verification and > enforcing that all bytecode is verified before use. It does not yet > implement any actual verification, which will be added in future CLs. > > Specifically, we introduce the BytecodeVerifier class that will be able > to verify bytecode in the future. Currently the verification is a no-op. > Then, we modify the BytecodeArray creation machinery to initially create > BytecodeArray objects in an unpublished state (see crrev.com/c/7172412) > and only make them accessible to the sandbox after verification. This > helps ensure that all bytecode is verified prior to use. > > Bug: 461681036 > Change-Id: I024db361f85d4aca24fae9cbd665d29b2b78fd64 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7169863 > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Commit-Queue: Samuel Groß <saelo@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#104003} Bug: 461681036 Change-Id: I1f0262132940a07249721b93b22b62627eb22191 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7209327 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#104007} | 7 个月前 | |
Reland "[sandbox] Build foundation for bytecode verification" This is a reland of commit 4fc454962b371d3e5f94ba8d03f8268a66cf49df Gracefully handle non-initialized BytecodeWrapper in heap verification. Original change's description: > [sandbox] Build foundation for bytecode verification > > This CL creates the foundation for building bytecode verification and > enforcing that all bytecode is verified before use. It does not yet > implement any actual verification, which will be added in future CLs. > > Specifically, we introduce the BytecodeVerifier class that will be able > to verify bytecode in the future. Currently the verification is a no-op. > Then, we modify the BytecodeArray creation machinery to initially create > BytecodeArray objects in an unpublished state (see crrev.com/c/7172412) > and only make them accessible to the sandbox after verification. This > helps ensure that all bytecode is verified prior to use. > > Bug: 461681036 > Change-Id: I024db361f85d4aca24fae9cbd665d29b2b78fd64 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7169863 > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Commit-Queue: Samuel Groß <saelo@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#104003} Bug: 461681036 Change-Id: I1f0262132940a07249721b93b22b62627eb22191 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7209327 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#104007} | 7 个月前 | |
[runtime] Split NumberToString cache to caches for Smis and doubles This is a preliminary step before making it possible to store raw doubles in the latter cache. Currently the keys in the latter cache are HeapNumber objects. This split also makes it possible to - avoid eviction of Smi entries by double entries (the former seem to be more important for performance), - avoid additional checks for distinguishing Smi keys from double keys, - configure cache size growing strategy independently, - configure tweak cache clearing logic based on "keys". As a side effect this CL increases the overall number of entries in combined number-to-string cache by 1.5. Drive-by: - add collection of number to string cache usage statistics behind --trace-number-string-cache flag (requires gn argument v8_enable_snapshot_native_code_counters = true to enable counters machinery in builtins), - add flags for configuring full number to string cache sizes. This CL changes heap layout and may regress some benchmarks, however the follow up CLs should recover potential regressions. Bug: 409808503 Change-Id: Ie33c6847c2608af5e359830ac4bbcc7017791bd1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6512976 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Auto-Submit: Igor Sheludko <ishell@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#100146} | 1 年前 | |
Reland "[sandbox] Build foundation for bytecode verification" This is a reland of commit 4fc454962b371d3e5f94ba8d03f8268a66cf49df Gracefully handle non-initialized BytecodeWrapper in heap verification. Original change's description: > [sandbox] Build foundation for bytecode verification > > This CL creates the foundation for building bytecode verification and > enforcing that all bytecode is verified before use. It does not yet > implement any actual verification, which will be added in future CLs. > > Specifically, we introduce the BytecodeVerifier class that will be able > to verify bytecode in the future. Currently the verification is a no-op. > Then, we modify the BytecodeArray creation machinery to initially create > BytecodeArray objects in an unpublished state (see crrev.com/c/7172412) > and only make them accessible to the sandbox after verification. This > helps ensure that all bytecode is verified prior to use. > > Bug: 461681036 > Change-Id: I024db361f85d4aca24fae9cbd665d29b2b78fd64 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7169863 > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Commit-Queue: Samuel Groß <saelo@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#104003} Bug: 461681036 Change-Id: I1f0262132940a07249721b93b22b62627eb22191 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7209327 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#104007} | 7 个月前 | |
[wasm][shared] Fix array.new_elem for shared element type and a few other issues for shared types, e.g. in constant expression evaluation and the Turbofan array.new_elem implementation. There are probably many more, a first step for fixing all the remaining issues would be to check for the TODO(14616) and TODO(42204563) and address those that are related to features part of our initial POC. Fixed: 454276076 Bug: 42204563 Change-Id: I10b090385140d637b72436a7e6552e930f47a6d2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7124023 Reviewed-by: Daniel Lehmann <dlehmann@chromium.org> Auto-Submit: Matthias Liedtke <mliedtke@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#103631} | 7 个月前 | |
[weakrefs] Fix clearing FR task posted bit The heap tracks when there is a FinalizationRegistry task posted to avoid posting duplicate tasks. This bit is not correctly cleared in the case when a context is disposed and all its FinalizationRegistries are removed from the dirty list, preventing future contexts in the same heap from clearing FinalizationRegistries. Fixed: 415223370 Change-Id: I6995a610742009c5c76d47b17900bacea8b883c0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6534137 Auto-Submit: Shu-yu Guo <syg@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#100199} | 1 年前 | |
Revert "Remove some unused includes" This reverts commit 0cb754290431cda34122ebf675c4e5c0647b0236. Reason for revert: Suspect for waterfall closure - https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Maa%20-%20arm64%20-%20no%20pointer%20compression%20debug%20builder/1072/overview Original change's description: > Remove some unused includes > > Bug: v8:13006 > Change-Id: Iee530e965786583330ff5e00ccfe58358a813f76 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3879500 > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> > Cr-Commit-Position: refs/heads/main@{#83332} Bug: v8:13006 Change-Id: I9d9d88a84786cb683042ab2ed665d61656d6de3b No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3904415 Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Owners-Override: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#83335} | 3 年前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[heap] Pass Isolate to metadata accessors Removes the implicit Isolate::Current() when looking up page metadata from a HeapObject or address, and either uses an available Isolate* or makes the Isolate::Current() explicit. There is still a MemoryChunk::Metadata() accessor which implicitly calls Isolate: :Current() -- this can be fixed in followup work. Change-Id: Ia64f1a38750f4c9c7279c631480b3ee9aadd8917 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6906859 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102184} | 10 个月前 | |
Reapply "Check current isolate when accessing MemoryChunk metadata" The parallel jobs from ParallelWeakHandlesProcessor don't have the current isolate set up, so many checks fail. The fix adds the setting scopes. Bug: 430498032 Change-Id: I5bc90983123bf09eab8c21ac7704bb82367b82a1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6765067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Anton Bikineev <bikineev@chromium.org> Cr-Commit-Position: refs/heads/main@{#101492} | 11 个月前 | |
[heap] Support multiple active GCRootsProviderScopes So far only one active scope was allowed. Allow multiple since this is needed for the JSON stringifier for both one and two bytes. Bug: 409069381 Change-Id: I7ab061ca2cf0a8b3a70ee77d2ab86942a038e9b2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6519360 Reviewed-by: Nikolaos Papaspyrou <nikolaos@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#100149} | 1 年前 | |
[heap] Support multiple active GCRootsProviderScopes So far only one active scope was allowed. Allow multiple since this is needed for the JSON stringifier for both one and two bytes. Bug: 409069381 Change-Id: I7ab061ca2cf0a8b3a70ee77d2ab86942a038e9b2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6519360 Reviewed-by: Nikolaos Papaspyrou <nikolaos@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#100149} | 1 年前 | |
[heap] Unify young and old epochs to a single epoch Scavenger can't run during incremental marking anymore, so we can unify epoch_young_ and epoch_old now to a single epoch_. Bug: 456384548 Change-Id: I400aef02ace44d251415083edac74573e7940a3c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7150844 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#103715} | 7 个月前 | |
[tracing] Emit isolate priority on a track This CL adds a "priority" track under heap. We can deduce this priority from other events, but as things are moving outside of v8, it's easier to see the effective priority that v8 got. Bug: 456731897 Change-Id: I89df0451e98d9a281b02d8f1a6ca8307fb7dd45a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7151092 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org> Cr-Commit-Position: refs/heads/main@{#103916} | 7 个月前 | |
[tracing] Emit isolate priority on a track This CL adds a "priority" track under heap. We can deduce this priority from other events, but as things are moving outside of v8, it's easier to see the effective priority that v8 got. Bug: 456731897 Change-Id: I89df0451e98d9a281b02d8f1a6ca8307fb7dd45a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7151092 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org> Cr-Commit-Position: refs/heads/main@{#103916} | 7 个月前 | |
【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Signed-off-by: Marja Hölttä <marja@chromium.org> | 25 天前 | |
[api] Adding total allocated bytes in HeapStatistics This change exposes total allocated bytes in v8::HeapStatistics API by introducing a new total_allocated_bytes() method that tracks all heap allocations since an Isolate creation. The implementation adds: - uint64_t total_allocated_bytes_ field to HeapStatistics. - An atomic total allocation counter is stored in the Heap class. - The counter is incremented whenever a RestLab is called. This approach can overestimate the total allocation for cases where the LAB is not fully used, but the leftover compared to the LAB itself is quite small, so it seems tolerable. Design doc reference: https://docs.google.com/document/d/1O4JPsoaxTQsX_7T5Fz4rsGeHMiM16jUrvDuq9FrtbNM Change-Id: Ic531698aaeb1578f943b7fdd346b9159ffd9b6c9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6996467 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dmitry Bezhetskov <dima00782@gmail.com> Cr-Commit-Position: refs/heads/main@{#103296} | 8 个月前 | |
Reland "[heap] Unify GC retry loops in HeapAllocator" This is a reland of commit 19e04644246a05bfa479054cd048e302885b3387 This CL got reverted to revert another CL. Now that https://crrev.com/c/7036836 landed again, we can reland this CL as well. Original change's description: > [heap] Unify GC retry loops in HeapAllocator > > This CL unifies the GC retry loops between the AllocateRaw() and > RetryCustomAllocate(OrFail)() methods. It also moves all such > methods from the -inl.h header file into the .cc file. This is > possible now because we only take the lambda as base::FunctionRef. > > We also don't need to handle different result types, because the > allocation lambda is storing the allocation result in some captured > local variable. > > Apart from this refactoring and sharing of code, this CL should not > GC any behavior. > > Bug: 40270831 > Change-Id: I9a8bbcfec196f1e97d4ffc10b50befd788dc38f5 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7021762 > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103019} Bug: 40270831 Change-Id: Id4563ae06d998c551571e9966e2ae9aec7aea550 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7036836 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#103148} | 8 个月前 | |
[heap] Fix spelling of Heap::Default(Min/Max)HeapSize Change-Id: I7d559dcf67380a4ae73c2e05c0ee8914d79a14f2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7062604 Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#103241} | 8 个月前 | |
[heap] Add high-end mode on Android based on physical memory This CL adds a new flag to enable high-end Android when the device has at least a specific amount of physical memory. HeapLimitMultiplier() and friends now need to take another argument as input, the amount of physical memory. Initially I tried to make those methods instance methods but this turned out to be tricky because we already use those methods in ResourceConstraints::ConfigureDefaults() when no Heap instance was created yet. Bug: 408962793 Change-Id: Ib3a052cacb94ee42c981a9aeb19ca2f66810560e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6632624 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#100826} | 1 年前 | |
[heap] Remove external backing store bytes tracking for space/page This CL removes tracking of external backing store bytes per page and per space. kExternalString was the only ExternalBackingStoreType left. We never used the per-page counter and only used the per-space counter for YoungAllocatedExternalBackingStoreBytes() but since we do not have young external strings, we can just drop it. However, we maintain a total counter for external strings in Heap::backing_store_bytes_ along with ArrayBuffers which are reported in GetHeapStatistics(). This CL removes that field but keeps this working by switching the Heap::backing_store_bytes() method to ExternalStringTable::GetBytes(). External strings are currently not accounted in external memory for GC scheduling. This CL does not change this but it adds a counter to the external string table which is currently only used for the tests in test-external-string-tracker.cc. A follow-up CL will add this tracking. Bug: 460166671 Change-Id: I1a08270fc0cf4df3ac98e78ecb08d9df5fbdaf09 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7203286 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#103988} | 7 个月前 | |
Reland "Reland "[heap] Funnel read-only allocations into read-only region"" This is a reland of commit 31df1f752f9eb6a756b11c1155c0abdf48bd2f53 Changes: - Fix off-by-one in overlap computation. Original change's description: > Reland "[heap] Funnel read-only allocations into read-only region" > > This is a reland of commit 03edefc0085e456b4474bcfde8d06e5108e530be > > Original change's description: > > [heap] Funnel read-only allocations into read-only region > > > > For configuration that use pointer compression and relies on a shared > > single data cage, which is the default in Chrome on 64-bit, this CL > > carves out an explicit contiguous memory region for read-only pages. > > > > Additionally, we also make sure that the same region is not used by > > the TrustedRange and CodeRange. As a consequence we can check for > > read-only objects by merely inspecting the object's address. > > > > The change here does not remove the page flag yet but merely rewire > > the allocations and use the condition in a DCHECK. > > > > In a follow up this property can be used for: > > - Checking for RO objects locally which is faster than checking page > > flags. It can also be combined with a partial Smi check (when we > > know that we are dealing with non-InstructionStream slots). > > - Moving the RO page bit away from MemoryChunk. > > > > A side effect is that this also filters out (more) small offsets for > > conservative stack scanning as the contiguous region is larger than > > the current static roots. > > > > Change-Id: I3888c74a5d555cd78b81b5cf7c9f408edeac6053 > > Bug: 429538831 > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6897249 > > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> > > Commit-Queue: Michael Lippautz <mlippautz@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#102168} > > Bug: 429538831 > Change-Id: I4cf6febd6cd41a2208cfc29066e575f91b5c2a0f > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6905245 > Commit-Queue: Michael Lippautz <mlippautz@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#102176} Bug: 429538831 Change-Id: I4420a329a8f785f562a767ea67da4caf5d6c1c6f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6909208 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102207} | 10 个月前 | |
[heap] Use task with kUserVisible priority instead of idle task This CL switches from idle tasks to kUserVisible tasks for "context disposal" GCs. @etiennep thankfully notices that this can improve JS score quite a bit. As we have no guarantee when this task will be run after being scheduled, we use gc_count() to only trigger a GC if no GC has been performed in-between. For idle tasks we limit this based on time, the task had to run within two frames (=16ms*2). Unlike idle tasks the regular tasks don't get a deadline, instead we use a hard coded limit of 5ms. In addition to the previous condition, we only perform the GC if the estimated time for it is less than 5ms. This CL improves JS2 by about +0.7%, JS3 by about +0.2%. Bug: 460477160 Change-Id: I9d084d59dca53a57d5cb6e81f26c122f037f15f7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6734023 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#104016} | 7 个月前 | |
[heap] Remove remaining uses of BasicMemoryChunk The BasicMemoryChunk class does not exist anymore and was replaced by MemoryChunk. Rename the remaining uses of this name to MemoryChunk as well. Bug: 42203297 Change-Id: Ibb40502b1ed0b124c885bac773ca7b430ef69494 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5607992 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#94314} | 2 年前 | |
[heap] Treat WeakCell weakly in Scavenger [2/3] This CL implements weak handling of the target and unregister_token fields of WeakCell. See design doc at https://docs.google.com/document/d/10u7VbYCVcYBFsyRf5AZ2TV7_2emCNL6JTwt8Z9AHUmA Bug: 340777103, 444761299 Change-Id: I38089aa12b4e4e76b4226ed2b08b34565124e038 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6920386 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102481} | 9 个月前 | |
[heap] Make WeakCell clearing support object pinning Casts and type checks need to account for object pinned in place. In such cases, the objects will not have a valid map pointer. Bug: 340777103 Change-Id: I9d47ad60dfd0fa6582d81c133f9f587515a1551e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6955057 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102549} | 9 个月前 | |
[heap] Remove MemoryChunk::GetHeap() Always go through the metadata object to make clear that this pointer is trusted. Bug: 429538831 Change-Id: I52369359faa5f9e45658070e54fb5a14ba8469c9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6765767 Reviewed-by: Anton Bikineev <bikineev@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#101494} | 11 个月前 | |
[handles, heap] Remove uses of GetIsolateFromWritableObject This CL removes some uses of GetIsolateFromWritableObject(). IsDereferenceAllowed() now uses Isolate::Current() instead on the main thread. This required some test changes because some tests did not set up a v8::Isolate::Scope so far. It also removes the uses in the write barrier DCHECKs. They were replaced by a new IsOwnedByAnyHeap() method. Bug: 368060007, 336738728 Change-Id: I7b8fd41b752e4c7a12849f43cfc8b8f0cf89fb9c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5886310 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#96305} | 1 年前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
[heap] Rework lifetimes of MemoryChunk and MemoryChunkMetadata MemoryChunk and MemoryChunkMetadata are acquired during page allocation. When entering the MemoryPool we would previously keep the objects alive in a possible broken state. We would just keep the objects and allocate new ones over them when acquiring memory from the MemoryPool. This somewhat worked as some accessors on MemoryChunkMetadata were still valid. It breaks though when trying to e.g. retrieve the owner() for a RO space check on the metadata object as the previously owning Isolate may have already been destroyed. This CL now reworks this logic: - MemoryChunk and MemoryChunkMetadata always use placement new() when initializing them for types that can enter the MemoryPool. - Upon adding MemoryChunk and MemoryChunkMetadata to the pool we properly call destructors (which also already reset the chunk-to-metadata link) and create a value object that holds the memory reservations. - When returning memory from the pool we use these uninitialized void* pointers for re-allocating the corresponding objects via placement new(). - Finally, we use trusted accessors when setting up the chunk-to-metadata link. Drive-by: Fix IsMutablePageMetadata() only checking owner() field which only works for detached RO heaps but misses the case when RO heap is still writable. Change-Id: Id8945b7fdc07e55b21d80a1d67df62c0d1c098fc Bug: 429538831 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6903968 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102201} | 10 个月前 | |
[heap] Pass Isolate to metadata accessors Removes the implicit Isolate::Current() when looking up page metadata from a HeapObject or address, and either uses an available Isolate* or makes the Isolate::Current() explicit. There is still a MemoryChunk::Metadata() accessor which implicitly calls Isolate: :Current() -- this can be fixed in followup work. Change-Id: Ia64f1a38750f4c9c7279c631480b3ee9aadd8917 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6906859 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102184} | 10 个月前 | |
[heap] Use regular casts in weak object processing This CL undoes a bunch of previous CL that replaced casts and type checks with GC safe alternatives. These are no longer needed since weakness in Scavenger is disabled when using pinning. Bug: 340777103 Change-Id: Ia624ccc02d509908c4efd604f2fc01b075a911e2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7046057 Commit-Queue: Omer Katz <omerkatz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103155} | 8 个月前 | |
[heap] Treat JSWeakRef weakly in Scavenger [1/3] This CL implements weak handling of the target field of JSWeakRef. See design doc at https://docs.google.com/document/d/10u7VbYCVcYBFsyRf5AZ2TV7_2emCNL6JTwt8Z9AHUmA Bug: 340777103 Change-Id: I55c5a7cfc1cd09d26cf7e1ccc022de5e9323f05d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6929546 Commit-Queue: Omer Katz <omerkatz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#102438} | 9 个月前 | |
[tagged] Introduce TrustedPointerMember This helper class simplifies defining trusted pointer members in HeapObjectLayout subclasses. Bug: 42202654 Change-Id: I505f9f70a0128899d13a464eda15026f5a435cc0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7181920 Reviewed-by: Samuel Groß <saelo@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#103897} | 7 个月前 | |
[heap] Remove uses of UNSAFE_SKIP_WRITE_BARRIER in C++ write barriers This CL removes usages of UNSAFE_SKIP_WRITE_BARRIER for C++ write barriers. We were using it only for avoiding write barriers on InstructionStream but we can now avoid this with the WriteBarrierModeScope. This CL uses that class to allow skipping the write barrier on that InstructionStream without UnsafeSkipWriteBarrier. Bug: 437096305 Change-Id: Iaeaf934c466a0033bbc8dfd04eeba93a35037ad5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7014096 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102990} | 8 个月前 | |
[tagged] Introduce TrustedPointerMember This helper class simplifies defining trusted pointer members in HeapObjectLayout subclasses. Bug: 42202654 Change-Id: I505f9f70a0128899d13a464eda15026f5a435cc0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7181920 Reviewed-by: Samuel Groß <saelo@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#103897} | 7 个月前 | |
heap_dump_1 for jsvm Signed-off-by: huanghan18 <huanghan18@huawei.com> | 25 天前 | |
[heap] Use task with kUserVisible priority instead of idle task This CL switches from idle tasks to kUserVisible tasks for "context disposal" GCs. @etiennep thankfully notices that this can improve JS score quite a bit. As we have no guarantee when this task will be run after being scheduled, we use gc_count() to only trigger a GC if no GC has been performed in-between. For idle tasks we limit this based on time, the task had to run within two frames (=16ms*2). Unlike idle tasks the regular tasks don't get a deadline, instead we use a hard coded limit of 5ms. In addition to the previous condition, we only perform the GC if the estimated time for it is less than 5ms. This CL improves JS2 by about +0.7%, JS3 by about +0.2%. Bug: 460477160 Change-Id: I9d084d59dca53a57d5cb6e81f26c122f037f15f7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6734023 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#104016} | 7 个月前 | |
[heap] Clean up incremental marking features incremental_marking_start_user_visible and incremental_marking_always_user_visible are enabled by default and no longer needed. Bug: 437004480, 361124432 Change-Id: I6a7e8ee40505fbddab4914fb751dd16730c1df63 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7127344 Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#103709} | 7 个月前 | |
[heap] Clean up incremental marking features incremental_marking_start_user_visible and incremental_marking_always_user_visible are enabled by default and no longer needed. Bug: 437004480, 361124432 Change-Id: I6a7e8ee40505fbddab4914fb751dd16730c1df63 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7127344 Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#103709} | 7 个月前 | |
[heap] Use task with kUserVisible priority instead of idle task This CL switches from idle tasks to kUserVisible tasks for "context disposal" GCs. @etiennep thankfully notices that this can improve JS score quite a bit. As we have no guarantee when this task will be run after being scheduled, we use gc_count() to only trigger a GC if no GC has been performed in-between. For idle tasks we limit this based on time, the task had to run within two frames (=16ms*2). Unlike idle tasks the regular tasks don't get a deadline, instead we use a hard coded limit of 5ms. In addition to the previous condition, we only perform the GC if the estimated time for it is less than 5ms. This CL improves JS2 by about +0.7%, JS3 by about +0.2%. Bug: 460477160 Change-Id: I9d084d59dca53a57d5cb6e81f26c122f037f15f7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6734023 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#104016} | 7 个月前 | |
[heap] Report more tracing data on marking start Split off of CL https://crrev.com/c/6965615 Report the reason returned by IncrementalMarkingLimitReached() when starting incremental marking. Also add additional GC/heap stats since we are already here. Bug: 408962793 Change-Id: Ie5dee081bcc1a7eeabc2d08312768730a6a21a80 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6983362 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#102853} | 9 个月前 | |
[base] Merge SpinningMutex back into Mutex They are now the same; beyond that we can't do ave THREAD_SAFETY_ANALYSIS on a bunch of previous SpinningMutex cases, so we'll need to propagate this into Mutex. Bug: 384940357 Change-Id: Ifbd4ffc4090738455036f32d9a5cf813b9f15781 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6244422 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#98597} | 1 年前 | |
[base] Merge SpinningMutex back into Mutex They are now the same; beyond that we can't do ave THREAD_SAFETY_ANALYSIS on a bunch of previous SpinningMutex cases, so we'll need to propagate this into Mutex. Bug: 384940357 Change-Id: Ifbd4ffc4090738455036f32d9a5cf813b9f15781 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6244422 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#98597} | 1 年前 | |
[heap] Pass Isolate to metadata accessors Removes the implicit Isolate::Current() when looking up page metadata from a HeapObject or address, and either uses an available Isolate* or makes the Isolate::Current() explicit. There is still a MemoryChunk::Metadata() accessor which implicitly calls Isolate: :Current() -- this can be fixed in followup work. Change-Id: Ia64f1a38750f4c9c7279c631480b3ee9aadd8917 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6906859 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102184} | 10 个月前 | |
[heap] Use trusted flag throughout recording slots Bug: 429538831 Change-Id: I98b2da66a4186323e965fd8a6f873036e0154a3b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6850476 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#101922} | 10 个月前 | |
[heap] Pass Isolate to metadata accessors Removes the implicit Isolate::Current() when looking up page metadata from a HeapObject or address, and either uses an available Isolate* or makes the Isolate::Current() explicit. There is still a MemoryChunk::Metadata() accessor which implicitly calls Isolate: :Current() -- this can be fixed in followup work. Change-Id: Ia64f1a38750f4c9c7279c631480b3ee9aadd8917 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6906859 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102184} | 10 个月前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
[heap] Add optional "may grow" hint for heap allocations This CL adds the capability to pass optional hints to heap allocations. In particular this CL adds a "may grow" hint but we can use this for other features in the future. The motivation behind "may grow" is the resizing of large objects that we now support using TryResizeLargeObject(). With out current "first fit" allocation strategy in the region allocation, we simply allocate a large object in the first free region large enough for the allocation. However, this might not work well with resizing because usually we start with a small allocation which we grow later if necessary. We can now run into situations were resizing often fails because we allocated in a small region initially with no room left for growing. The "may grow" hint should solve this by instead allocating in the largest free region instead which should enable us to grow the object to its final size successfully. Since we only grow the last allocation this should only fail if the the largest free region is not large enough for the final objects anyways and a GC needs to happen. In order to implement this, the allocation hint needs to be passed down all the way from the factory allocation method to RegionAllocator. This CL solves this by introducing a V8-internal AllocationHint class that we pass down from the factory method to the MemoryAllocator. In the MemoryAllocator we then need to pass the allocation hint through the V8 API-exposed v8::PageAllocator method. So we can't use our internal AllocationHint type for this. That's why this CL also adds a new v8::PageAllocator::AllocationHint class and a new method v8::PageAllocator::AllocatePages() on the API. This new method receives the allocation hint as an additional argument. The BoundedPageAllocator can then use the allocation hint to change the allocation strategy for RegionAllocator's AllocateRegion(). Bug: 409069381 Change-Id: I60ad4c6da56b2555d86a2f33b7d5f1640329d776 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6495193 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#100119} | 1 年前 | |
Introduce IsolateFieldIds for new/old top and limit This avoids having to manually add the LinearAllocationArea::TopOffset() or LinearAllocationArea::LimitOffset() in multiple places. Instead, we can reference the top or limit field directly. R=mlippautz@chromium.org Bug: 442745065 Change-Id: Ie32dddf70ce3cd46b862f008e17d6ee9a5199207 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6916875 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#102278} | 9 个月前 | |
[refactoring] Clean up read-only heap and co. Since IsolateGroup::current() is fast we merge paths for shared-cage and multiple-cage modes. Bug: 357931034 Change-Id: I543aa5453fe9cea95359381ffa127f4ccd962bf9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6088029 Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Dmitry Bezhetskov <dima00782@gmail.com> Cr-Commit-Position: refs/heads/main@{#97792} | 1 年前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[heap] Use SafeHeapObjectSize in more places In particular use it for iterating live object ranges and rework the affected callsites. Bug: 425896305 Change-Id: I5a086e1eafb0f151cf7d6e2b1eb79aab4eeeb50b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6719831 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Anton Bikineev <bikineev@chromium.org> Cr-Commit-Position: refs/heads/main@{#101342} | 11 个月前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[runtime] Split NumberToString cache to caches for Smis and doubles This is a preliminary step before making it possible to store raw doubles in the latter cache. Currently the keys in the latter cache are HeapNumber objects. This split also makes it possible to - avoid eviction of Smi entries by double entries (the former seem to be more important for performance), - avoid additional checks for distinguishing Smi keys from double keys, - configure cache size growing strategy independently, - configure tweak cache clearing logic based on "keys". As a side effect this CL increases the overall number of entries in combined number-to-string cache by 1.5. Drive-by: - add collection of number to string cache usage statistics behind --trace-number-string-cache flag (requires gn argument v8_enable_snapshot_native_code_counters = true to enable counters machinery in builtins), - add flags for configuring full number to string cache sizes. This CL changes heap layout and may regress some benchmarks, however the follow up CLs should recover potential regressions. Bug: 409808503 Change-Id: Ie33c6847c2608af5e359830ac4bbcc7017791bd1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6512976 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Auto-Submit: Igor Sheludko <ishell@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#100146} | 1 年前 | |
[runtime] Split NumberToString cache to caches for Smis and doubles This is a preliminary step before making it possible to store raw doubles in the latter cache. Currently the keys in the latter cache are HeapNumber objects. This split also makes it possible to - avoid eviction of Smi entries by double entries (the former seem to be more important for performance), - avoid additional checks for distinguishing Smi keys from double keys, - configure cache size growing strategy independently, - configure tweak cache clearing logic based on "keys". As a side effect this CL increases the overall number of entries in combined number-to-string cache by 1.5. Drive-by: - add collection of number to string cache usage statistics behind --trace-number-string-cache flag (requires gn argument v8_enable_snapshot_native_code_counters = true to enable counters machinery in builtins), - add flags for configuring full number to string cache sizes. This CL changes heap layout and may regress some benchmarks, however the follow up CLs should recover potential regressions. Bug: 409808503 Change-Id: Ie33c6847c2608af5e359830ac4bbcc7017791bd1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6512976 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Auto-Submit: Igor Sheludko <ishell@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#100146} | 1 年前 | |
Reland "[heap] LocalHeap::Current() now returns non-null on main thread" This is a reland of commit c25edbbc06b7611c26dbc55cd745c4d61b9ad8d1 It now sets the TLS variable in MinorGCJob::Task::RunInternal(). Original change's description: > [heap] LocalHeap::Current() now returns non-null on main thread > > This CL sets the LocalHeap TLS variable on the main thread to > isolate->main_thread_local_heap(). This allows us to simplify some > code and makes this TLS variable uniform with the Isolate and > MarkingBarrier TLS variables. Both variables are already non-null on > the main thread as well. > > Bug: 437096305 > Change-Id: Ib8244a13d0c6e89c4611169bc487432cf57f8824 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6830009 > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Auto-Submit: Dominik Inführ <dinfuehr@chromium.org> > Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> > Reviewed-by: Anton Bikineev <bikineev@chromium.org> > Cr-Commit-Position: refs/heads/main@{#101858} Bug: 437096305 Change-Id: I3c9aad03b766429e6bc5dff7f8c6d498fd6107e4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6842300 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#101880} | 10 个月前 | |
[heap] Support CollectAllAvailableGarbage from background This makes HeapAllocator retry loop more consistent between main and background threads. Bug: 448848875 Change-Id: Id793532aeeb99d45515ae9ca10aa1d09c4ba50a7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7017890 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org> Cr-Commit-Position: refs/heads/main@{#103139} | 8 个月前 | |
Reland^2 "[heap] Make write barrier verification more strict" This is a reland of commit 59fdb73b9f158a4f8499941164b2f0b79c4b61a5 The previous version of the CL wasn't working correctly with PKU. For this reason I had to move the last_young_allocation_ field into IsolateData for the main thread. Original change's description: > Reland "[heap] Make write barrier verification more strict" > > This is a reland of commit 41597fc1af5640c4c419d1a264228a3cc2951d54 > > On arm and arm64 we didn't have enough temporary registers. This > CL removes the need for the extra register. > > The original CL was also not correctly handling verification for > large objects. > > Original change's description: > > [heap] Make write barrier verification more strict > > > > This CL makes write barrier verification more strict by only > > looking at the last_young_allocation_ field. So far we were also > > allowing objects in the current new space LAB. > > > > Since Maglev also implements write barrier verification for skipped > > write barriers, this CL also needs to set last_young_allocation_ > > on Maglev allocations. > > > > Turbofan does not need any changes because it doesn't use write > > barrier verification at the moment. > > > > This CL allows us to update the unit tests for write barrier tests. > > They do not need to flush LABs anymore to trigger the crash. > > > > Bug: 437096305 > > Change-Id: Icb6459038f4986b8494445bf7f245ec037199ae5 > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6863073 > > Reviewed-by: Victor Gomes <victorgomes@chromium.org> > > Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> > > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#102053} > > Bug: 437096305 > Change-Id: If6dc7a5c81ad5d89e6b0e275c4120d6b01b7e7c2 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6890671 > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> > Reviewed-by: Victor Gomes <victorgomes@chromium.org> > Cr-Commit-Position: refs/heads/main@{#102082} Bug: 437096305 Change-Id: Id5ef206226c6496cc2837eaa1dacd59ebd2d3352 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6894614 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/main@{#102101} | 10 个月前 | |
【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Signed-off-by: Marja Hölttä <marja@chromium.org> | 25 天前 | |
【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Signed-off-by: Marja Hölttä <marja@chromium.org> | 25 天前 | |
【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Signed-off-by: Marja Hölttä <marja@chromium.org> | 25 天前 | |
[heap] Fix processing of JSDispatch handle through RelocInfo Before this patch any dispatch handles contained in RelocInfo were assumed to be kept alive by their corresponding JSFunctions. This was fine as: - RelocInfo treated the corresponding JSFunction weakly which meant that the Code would be deoptimized if the JSFunction went away. - The top most frame was always strongified all references in case it could not be deoptimized. This meant that JSFunction and the dispatch handle (and instrunction stream) were marked this way. In a world with sandbox corruptions assuming a liveness witness does not hold anymore as attackers can break the link from JSFunction to dispatch handle (and thus instructon stream). This patch implements proper weak handling in RelocInfo's dispatch handles: - For regular processing the handles are treated weakly and discovering a dead handle leads to deoptimization of the code objects. - For the top most frame the dispatch handle and the instruction stream are strongified. Despite fixing the sandbox problem this also better follows the principle of treating edges individually (weak or strong) without considering other liveness witnesses which generally leads to more robust code. Fixed: 443772809 Change-Id: I4608cc830019c5267dfe49539867a7f0bbb0a144 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6939390 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102520} | 9 个月前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
[heap] Refactor VisitWeakList Refactor VisitWeakList to use explicit write barriers when needed and delegate the barriers to the collectors. Change-Id: If05c22e9699e79f21a7fe09833a443f755780555 Bug: 340777103 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6989550 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102980} | 8 个月前 | |
[heap] Remove external backing store bytes tracking for space/page This CL removes tracking of external backing store bytes per page and per space. kExternalString was the only ExternalBackingStoreType left. We never used the per-page counter and only used the per-space counter for YoungAllocatedExternalBackingStoreBytes() but since we do not have young external strings, we can just drop it. However, we maintain a total counter for external strings in Heap::backing_store_bytes_ along with ArrayBuffers which are reported in GetHeapStatistics(). This CL removes that field but keeps this working by switching the Heap::backing_store_bytes() method to ExternalStringTable::GetBytes(). External strings are currently not accounted in external memory for GC scheduling. This CL does not change this but it adds a counter to the external string table which is currently only used for the tests in test-external-string-tracker.cc. A follow-up CL will add this tracking. Bug: 460166671 Change-Id: I1a08270fc0cf4df3ac98e78ecb08d9df5fbdaf09 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7203286 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#103988} | 7 个月前 | |
[heap] Remove external backing store bytes tracking for space/page This CL removes tracking of external backing store bytes per page and per space. kExternalString was the only ExternalBackingStoreType left. We never used the per-page counter and only used the per-space counter for YoungAllocatedExternalBackingStoreBytes() but since we do not have young external strings, we can just drop it. However, we maintain a total counter for external strings in Heap::backing_store_bytes_ along with ArrayBuffers which are reported in GetHeapStatistics(). This CL removes that field but keeps this working by switching the Heap::backing_store_bytes() method to ExternalStringTable::GetBytes(). External strings are currently not accounted in external memory for GC scheduling. This CL does not change this but it adds a counter to the external string table which is currently only used for the tests in test-external-string-tracker.cc. A follow-up CL will add this tracking. Bug: 460166671 Change-Id: I1a08270fc0cf4df3ac98e78ecb08d9df5fbdaf09 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7203286 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#103988} | 7 个月前 | |
[heap] Avoid using ephemeron remembered set in full GC The ephemeron_remembered_set() is used as the OLD_TO_NEW remembered set for ephemeron keys. It is an optimization to avoid strongifying such references in minor GCs. After a full GC there are no OLD_TO_NEW references anymore, so we are already able to drop this remembered set at the end of the GC. But we still need this remembered set for updating pointers during the GC for the same reason we need OLD_TO_NEW there as well: We don't record pointers to new space in the OLD_TO_OLD remembered set. We need it to find all pointers to new space objects for relocating them. This CL is able to avoid usage of the ephemeron_remembered_set() during the full GC entirely. During incremental marking the write barrier and marker record pointers to young objects for ephemeron keys in the regular OLD_TO_NEW remembered set instead. With this the "update pointers" phase can treat ephemeron keys like regular OLD_TO_NEW slots and doesn't need special handling anymore. Change-Id: Id2ba6884e69ed01d8d09951b30060b10ea867937 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6917693 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#102391} | 9 个月前 | |
[heap] Allow write barrier verification in release builds So far write barrier verification could only be enabled in debug builds. This CL allows to enable verification also in release builds. Bug: 437096305 Change-Id: I754933fc6b398cf7e2fa81fef4f8ce1329c9da31 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6881089 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/main@{#102037} | 10 个月前 | |
[heap] Avoid using ephemeron remembered set in full GC The ephemeron_remembered_set() is used as the OLD_TO_NEW remembered set for ephemeron keys. It is an optimization to avoid strongifying such references in minor GCs. After a full GC there are no OLD_TO_NEW references anymore, so we are already able to drop this remembered set at the end of the GC. But we still need this remembered set for updating pointers during the GC for the same reason we need OLD_TO_NEW there as well: We don't record pointers to new space in the OLD_TO_OLD remembered set. We need it to find all pointers to new space objects for relocating them. This CL is able to avoid usage of the ephemeron_remembered_set() during the full GC entirely. During incremental marking the write barrier and marker record pointers to young objects for ephemeron keys in the regular OLD_TO_NEW remembered set instead. With this the "update pointers" phase can treat ephemeron keys like regular OLD_TO_NEW slots and doesn't need special handling anymore. Change-Id: Id2ba6884e69ed01d8d09951b30060b10ea867937 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6917693 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#102391} | 9 个月前 | |
[heap] Refactor VisitWeakList Refactor VisitWeakList to use explicit write barriers when needed and delegate the barriers to the collectors. Change-Id: If05c22e9699e79f21a7fe09833a443f755780555 Bug: 340777103 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6989550 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102980} | 8 个月前 | |
heap: Mark large arrays concurrently The CL splits large arrays in chunks and pushes them into the global worklist so that other concurrent markers can participate. To do that, it changes the concept of ProgressBar (which was usefull at the time of incremental marking) into MarkingProgressTracker, which does chunking. Bug: 376493207 Change-Id: I0332a5d1440c5b707fcda494d7eb5e39a7035ca5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6022858 Auto-Submit: Anton Bikineev <bikineev@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Anton Bikineev <bikineev@chromium.org> Cr-Commit-Position: refs/heads/main@{#97245} | 1 年前 | |
[heap] Pass Isolate to metadata accessors Removes the implicit Isolate::Current() when looking up page metadata from a HeapObject or address, and either uses an available Isolate* or makes the Isolate::Current() explicit. There is still a MemoryChunk::Metadata() accessor which implicitly calls Isolate: :Current() -- this can be fixed in followup work. Change-Id: Ia64f1a38750f4c9c7279c631480b3ee9aadd8917 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6906859 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102184} | 10 个月前 | |
Reapply "Check current isolate when accessing MemoryChunk metadata" The parallel jobs from ParallelWeakHandlesProcessor don't have the current isolate set up, so many checks fail. The fix adds the setting scopes. Bug: 430498032 Change-Id: I5bc90983123bf09eab8c21ac7704bb82367b82a1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6765067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Anton Bikineev <bikineev@chromium.org> Cr-Commit-Position: refs/heads/main@{#101492} | 11 个月前 | |
[heap, sandbox] Fix synchronization on JSFunction marking - Use acq/rel pairs for the actual accessors as their memory is not guaranteed to be synchronized in the concurrent marker. - Synchronize the dispatch table with acq/rel as well. - Remove the TryCast() methods as this is unnecessary when memory is properly synchronized for the sequential case. For the cncurrent marker we still need it because of deserializatin. Bug: 446074826 Change-Id: I38b6a4954c40bced8e07959ed56494498d437544 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6966204 Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#102734} | 9 个月前 | |
[heap] Perform key_to_values lookup in ProcessMarkingWorklist Instead of collecting newly traced/marked objects in a vector and then looking up each object in the key_to_values dictionary, we can just directly look up the traced object in key_to_values in the marking worklist itself. This also allows us to easily get rid of the special case when draining the marking worklist finds too many new objects. With this CL the fixpoint iteration conceptually works like this: 0) current_ephemerons is empty and will not be used. 1) Drain next_ephemerons and add them to key_to_values. 2) Drain marking worklist - Lookup every traced object in key_to_values and mark all found values. - New ephemerons are directly pushed into key_to_values_. We are allowed to directly insert in key_to_values because the linear-time algorithm is only ever run in single-threaded mode. Note that using key_to_values_ directly lets us remove the loop for ephemeron processing. We only need it for wrapper tracing. This CL also changes the used data structure from std::unordered_multimap to a abs::flat_hash_map of SmallVectors. The change seems to be performance-neutral when disabling the fixpoint iteration completely. Bug: 401897607 Change-Id: I93033b0d385239abfe4eb161386b1637f5e37825 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6330864 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#99174} | 1 年前 | |
[heap] Remove code to turn off --separate-gc-phases --no-separate-gc-phases is no longer supported, and resulting unused code is also removed. Bug: 365694581 Change-Id: Iacb746b04156470a73b60297364088dd264c8050 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6419255 Feels: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#99626} | 1 年前 | |
[heap] Simple MarkingWorklists clean-up. Created by Gemini CLI. Change-Id: I1477ba2b6df9bceb7f856cfa722cde7d45914163 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6798548 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Hannes Payer <hpayer@chromium.org> Cr-Commit-Position: refs/heads/main@{#101689} | 11 个月前 | |
[heap] Simple MarkingWorklists clean-up. Created by Gemini CLI. Change-Id: I1477ba2b6df9bceb7f856cfa722cde7d45914163 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6798548 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Hannes Payer <hpayer@chromium.org> Cr-Commit-Position: refs/heads/main@{#101689} | 11 个月前 | |
[heap] Pass Isolate to metadata accessors Removes the implicit Isolate::Current() when looking up page metadata from a HeapObject or address, and either uses an available Isolate* or makes the Isolate::Current() explicit. There is still a MemoryChunk::Metadata() accessor which implicitly calls Isolate: :Current() -- this can be fixed in followup work. Change-Id: Ia64f1a38750f4c9c7279c631480b3ee9aadd8917 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6906859 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102184} | 10 个月前 | |
[heap] Refactor VisitWeakList Refactor VisitWeakList to use explicit write barriers when needed and delegate the barriers to the collectors. Change-Id: If05c22e9699e79f21a7fe09833a443f755780555 Bug: 340777103 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6989550 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102980} | 8 个月前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
Reland "Reland "[heap] Funnel read-only allocations into read-only region"" This is a reland of commit 31df1f752f9eb6a756b11c1155c0abdf48bd2f53 Changes: - Fix off-by-one in overlap computation. Original change's description: > Reland "[heap] Funnel read-only allocations into read-only region" > > This is a reland of commit 03edefc0085e456b4474bcfde8d06e5108e530be > > Original change's description: > > [heap] Funnel read-only allocations into read-only region > > > > For configuration that use pointer compression and relies on a shared > > single data cage, which is the default in Chrome on 64-bit, this CL > > carves out an explicit contiguous memory region for read-only pages. > > > > Additionally, we also make sure that the same region is not used by > > the TrustedRange and CodeRange. As a consequence we can check for > > read-only objects by merely inspecting the object's address. > > > > The change here does not remove the page flag yet but merely rewire > > the allocations and use the condition in a DCHECK. > > > > In a follow up this property can be used for: > > - Checking for RO objects locally which is faster than checking page > > flags. It can also be combined with a partial Smi check (when we > > know that we are dealing with non-InstructionStream slots). > > - Moving the RO page bit away from MemoryChunk. > > > > A side effect is that this also filters out (more) small offsets for > > conservative stack scanning as the contiguous region is larger than > > the current static roots. > > > > Change-Id: I3888c74a5d555cd78b81b5cf7c9f408edeac6053 > > Bug: 429538831 > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6897249 > > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> > > Commit-Queue: Michael Lippautz <mlippautz@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#102168} > > Bug: 429538831 > Change-Id: I4cf6febd6cd41a2208cfc29066e575f91b5c2a0f > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6905245 > Commit-Queue: Michael Lippautz <mlippautz@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#102176} Bug: 429538831 Change-Id: I4420a329a8f785f562a767ea67da4caf5d6c1c6f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6909208 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102207} | 10 个月前 | |
[heap] Add tracing output to track allocation limit changes Add log output to emit when and why allocation limits are updated. Bug: 402791082 Change-Id: I2b6eae31f06af3f44511285a44ac40b79d5cce24 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6563565 Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#100367} | 1 年前 | |
[heap] Eradicate base::Optional from src/heap Replace by std::optional. Bug: 40179289 Change-Id: Ie3e1e399af42dabfb9071cbcb8f8def7f38c7b69 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5666697 Auto-Submit: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Anton Bikineev <bikineev@chromium.org> Commit-Queue: Anton Bikineev <bikineev@chromium.org> Cr-Commit-Position: refs/heads/main@{#94771} | 1 年前 | |
[isolate-groups][sandbox] Support per cage metadata pointer table for multi-cage mode. The memory chunk's metadata pointer table is global and to support multi-sandbox mode it should be per isolate group. Bug: 342905186 Change-Id: Ie0544c2c480d12448c401aebc38aa99b9cefed16 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5691782 Reviewed-by: Stephen Röttger <sroettger@google.com> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Dmitry Bezhetskov <dima00782@gmail.com> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#97519} | 1 年前 | |
Reland "Reland "[heap] Remove IS_EXECUTABLE flag on MemoryChunk"" This is a reland of commit fa6b07381856fedb86de39a59c24df099eb3a62d Fixes: - Remove spurious page init fence in https://crrev.com/c/6867872 Original change's description: > Reland "[heap] Remove IS_EXECUTABLE flag on MemoryChunk" > > This is a reland of commit bb0c12cf056b8d0b3aa608841c724362ada8e05e > > Original change's description: > > [heap] Remove IS_EXECUTABLE flag on MemoryChunk > > > > Always go through the trusted MemoryChunkMetadata object when checking > > the executability bit. > > > > Bug: 429538831 > > Change-Id: I81f9cf66d0d68219fc1c041e510c556bb587c7d4 > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6862536 > > Commit-Queue: Michael Lippautz <mlippautz@chromium.org> > > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#101949} > > Bug: 429538831 > Change-Id: I553f1d97464aee7cc382a19b473b94419f22859b > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6865997 > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> > Commit-Queue: Michael Lippautz <mlippautz@chromium.org> > Cr-Commit-Position: refs/heads/main@{#101958} Bug: 429538831 Change-Id: I7a926e9558dc551ae1f4ac057efb1e37bf23149a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6867871 Reviewed-by: Anton Bikineev <bikineev@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#101972} | 10 个月前 | |
[heap] Fix some includes Left over from https://crrev.com/c/6011903 Change-Id: Ib558d7b08bdd10f77ae549be45be08805f08f8bc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6049421 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Auto-Submit: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#97409} | 1 年前 | |
[heap] Rework lifetimes of MemoryChunk and MemoryChunkMetadata MemoryChunk and MemoryChunkMetadata are acquired during page allocation. When entering the MemoryPool we would previously keep the objects alive in a possible broken state. We would just keep the objects and allocate new ones over them when acquiring memory from the MemoryPool. This somewhat worked as some accessors on MemoryChunkMetadata were still valid. It breaks though when trying to e.g. retrieve the owner() for a RO space check on the metadata object as the previously owning Isolate may have already been destroyed. This CL now reworks this logic: - MemoryChunk and MemoryChunkMetadata always use placement new() when initializing them for types that can enter the MemoryPool. - Upon adding MemoryChunk and MemoryChunkMetadata to the pool we properly call destructors (which also already reset the chunk-to-metadata link) and create a value object that holds the memory reservations. - When returning memory from the pool we use these uninitialized void* pointers for re-allocating the corresponding objects via placement new(). - Finally, we use trusted accessors when setting up the chunk-to-metadata link. Drive-by: Fix IsMutablePageMetadata() only checking owner() field which only works for detached RO heaps but misses the case when RO heap is still writable. Change-Id: Id8945b7fdc07e55b21d80a1d67df62c0d1c098fc Bug: 429538831 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6903968 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102201} | 10 个月前 | |
[sandbox] Rename InsideSandbox to OutsideSandbox All existing users where doing !InsideSandbox(...), as the function only handles partial reservations correctly for that use case. A separate function for checking that something is inside the sandbox will be added in a later CL. Change-Id: I061b3f72981a02dbb833a83b83f1f68c582134bd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6939456 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/main@{#102445} | 9 个月前 | |
[heap] Rework lifetimes of MemoryChunk and MemoryChunkMetadata MemoryChunk and MemoryChunkMetadata are acquired during page allocation. When entering the MemoryPool we would previously keep the objects alive in a possible broken state. We would just keep the objects and allocate new ones over them when acquiring memory from the MemoryPool. This somewhat worked as some accessors on MemoryChunkMetadata were still valid. It breaks though when trying to e.g. retrieve the owner() for a RO space check on the metadata object as the previously owning Isolate may have already been destroyed. This CL now reworks this logic: - MemoryChunk and MemoryChunkMetadata always use placement new() when initializing them for types that can enter the MemoryPool. - Upon adding MemoryChunk and MemoryChunkMetadata to the pool we properly call destructors (which also already reset the chunk-to-metadata link) and create a value object that holds the memory reservations. - When returning memory from the pool we use these uninitialized void* pointers for re-allocating the corresponding objects via placement new(). - Finally, we use trusted accessors when setting up the chunk-to-metadata link. Drive-by: Fix IsMutablePageMetadata() only checking owner() field which only works for detached RO heaps but misses the case when RO heap is still writable. Change-Id: Id8945b7fdc07e55b21d80a1d67df62c0d1c098fc Bug: 429538831 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6903968 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102201} | 10 个月前 | |
[heap] Rework lifetimes of MemoryChunk and MemoryChunkMetadata MemoryChunk and MemoryChunkMetadata are acquired during page allocation. When entering the MemoryPool we would previously keep the objects alive in a possible broken state. We would just keep the objects and allocate new ones over them when acquiring memory from the MemoryPool. This somewhat worked as some accessors on MemoryChunkMetadata were still valid. It breaks though when trying to e.g. retrieve the owner() for a RO space check on the metadata object as the previously owning Isolate may have already been destroyed. This CL now reworks this logic: - MemoryChunk and MemoryChunkMetadata always use placement new() when initializing them for types that can enter the MemoryPool. - Upon adding MemoryChunk and MemoryChunkMetadata to the pool we properly call destructors (which also already reset the chunk-to-metadata link) and create a value object that holds the memory reservations. - When returning memory from the pool we use these uninitialized void* pointers for re-allocating the corresponding objects via placement new(). - Finally, we use trusted accessors when setting up the chunk-to-metadata link. Drive-by: Fix IsMutablePageMetadata() only checking owner() field which only works for detached RO heaps but misses the case when RO heap is still writable. Change-Id: Id8945b7fdc07e55b21d80a1d67df62c0d1c098fc Bug: 429538831 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6903968 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102201} | 10 个月前 | |
[turboshaft] Embed AssemblerOpInterface into reducer stack The Assembler no longer inherits directly from both, the ReducerStack and the AssemblerOpInterface, but the latter is part of the former's class hierarchy. This allows reducers to overwrite assembler functions (e.g. builtin reducers can provide a CallBuiltin that doesn't require a FrameState argument). Furthermore: Remove the additional layer of TS-abstraction in the Assembler setup that we introduced when we tried to make the Turboshaft architecture IR independent. NO_IFTTT=Only changed class name inside a comment. Bug: 348031042 Change-Id: If8b9b27a9655102b7c85353a8511482297c7c451 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7167247 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#103808} | 7 个月前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
Reland "[handles] Migration to direct handles, part 12" This is a reland of commit 5fa54d85a10049a55ba2fa02bc05145ddee7d19a Original change's description: > [handles] Migration to direct handles, part 12 > > This CL migrates a large number of handles to direct handles. The > changes are only relevant for builds with v8_enable_direct_handle=true. > > Affected source directories: api, asmjs, ast, builtins, codegen, > compiler, d8, debug, deoptimizer, diagnostics, execution, extensions, > heap, ic, init, interpreter, json, maglev, objects, parsing, profiler, > regexp, runtime, snapshot, strings, wasm, and tests. > > Bug: 42203211 > Change-Id: I2334b3295e5780e8f52d0b13d1545dce29fcf81e > Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6181904 > Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> > Reviewed-by: Omer Katz <omerkatz@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Cr-Commit-Position: refs/heads/main@{#98240} Bug: 42203211 Change-Id: Ie21acd681c12e7212185d61a19bd858365650204 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6187462 Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#98249} | 1 年前 | |
[heap] Fix exception in measureMemory in d8 The default MeasureMemoryDelegate was using V8 internal types. This is not okay for the promise as it's .then() may be hooked by user JS. In such a case we wouldn't have entered V8 properly which is a problem when dealing with exceptions. The fix uses the proper API types for context and promise. Following up here we should just deprecate the V8 API and implement the delegate in d8 with just using API types. Bug: 371237560, 374253377 Change-Id: Iecc8553fd2bad4104162299571fdfa93ef171843 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5942942 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#96718} | 1 年前 | |
Reland "Reland "Reland "heap: Release paged pools every K seconds""" This fixes the issue with the --single-threaded mode. When --single-threaded is on, the task needs access to the isolate to be able to repost itself to the isolate's task runner. The fix attaches the task to the CancellableTaskManager of the current isolate (not the IsolateGroup), to make sure that the task never executes when the isolate is gone. Bug: 429538831 Change-Id: I044cff44c7d8b0fcf13ec0565c020f0415f4ffcd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7095296 Auto-Submit: Anton Bikineev <bikineev@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103389} | 8 个月前 | |
Reland "Reland "Reland "heap: Release paged pools every K seconds""" This fixes the issue with the --single-threaded mode. When --single-threaded is on, the task needs access to the isolate to be able to repost itself to the isolate's task runner. The fix attaches the task to the CancellableTaskManager of the current isolate (not the IsolateGroup), to make sure that the task never executes when the isolate is gone. Bug: 429538831 Change-Id: I044cff44c7d8b0fcf13ec0565c020f0415f4ffcd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7095296 Auto-Submit: Anton Bikineev <bikineev@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103389} | 8 个月前 | |
[heap] Memory reducer should consider external bytes Account for external bytes in the memory reducer's heuristics. Bug: 372328123 Change-Id: I45867cb7c85c39ac0abf7bea98d6b3513df108d2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7054782 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103282} | 8 个月前 | |
[v8/memory-reducer] Avoid rescheduling MemoryReducer while frozen Currently, we sometimes run a GC after we have compacted Chrome's memory, which is counterproductive because we are immediately bringing back memory that we have just swapped out. This CL aims to fix this by limiting when we can run a GC in v8, to prevent this from happening. Bug: 379663698 Change-Id: Ib5e8ba95cbffd5768de54c4bfdb48fa8d25d3d34 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6051401 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Etienne Pierre-Doray <etiennep@chromium.org> Commit-Queue: Thiabaud Engelbrecht <thiabaud@google.com> Cr-Commit-Position: refs/heads/main@{#98203} | 1 年前 | |
Reland "[heap] LocalHeap::Current() now returns non-null on main thread" This is a reland of commit c25edbbc06b7611c26dbc55cd745c4d61b9ad8d1 It now sets the TLS variable in MinorGCJob::Task::RunInternal(). Original change's description: > [heap] LocalHeap::Current() now returns non-null on main thread > > This CL sets the LocalHeap TLS variable on the main thread to > isolate->main_thread_local_heap(). This allows us to simplify some > code and makes this TLS variable uniform with the Isolate and > MarkingBarrier TLS variables. Both variables are already non-null on > the main thread as well. > > Bug: 437096305 > Change-Id: Ib8244a13d0c6e89c4611169bc487432cf57f8824 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6830009 > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Auto-Submit: Dominik Inführ <dinfuehr@chromium.org> > Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> > Reviewed-by: Anton Bikineev <bikineev@chromium.org> > Cr-Commit-Position: refs/heads/main@{#101858} Bug: 437096305 Change-Id: I3c9aad03b766429e6bc5dff7f8c6d498fd6107e4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6842300 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#101880} | 10 个月前 | |
[heap] Allow running minor GC tasks with lower priority This adds a flag that allows minor GC tasks to run at kUserVisible priority which would queue them after possibly more important work is run on the main thread. Notably this allows prioritizing JS scheduled via setTimeout. This is generally okay as there's still synchronous triggers in case a minor GC must run. Drive-by: - Make the task observer a dependency of the job as its only purpose was to schedule a task for the job. - Add some more documentation on the differences between job and observer. Change-Id: I0ce4159943f01db1fc8596ad964d33d9ec7ec90b Bug: 382453604 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6070380 Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#97603} | 1 年前 | |
[cleanup] Modernize std::*::value and ::type Mechanically replacing std::foo<X>::value with std::foo_v<X>, and the same for ::type -> _t. Change-Id: I543dda07ba4c95534cdcd51f1f438f2626be8273 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6491388 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#99940} | 1 年前 | |
[heap] Remove support for young external strings There are no external strings in the young generation anymore. This means we can also drop support for them in the GC. Bug: 460166671 Change-Id: Idf2e445fc6abb3572a9f2a710116f268b3110495 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7178540 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#103877} | 7 个月前 | |
[heap] Add Heap::StartResizeNewSpace() for MinorMS MinorMS resizes the new space in two steps. With this CL MinorMS can now use the StartResizeNewSpace() and ResizeNewSpace() methods on the Heap class to do so. This change allows us to share the computation for the reduced new space size more naturally. Bug: 391129951 Change-Id: Idd566157d93c1bebf26483675c9907a833aecbea Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6298738 Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#98912} | 1 年前 | |
[heap] Remove external backing store bytes tracking for space/page This CL removes tracking of external backing store bytes per page and per space. kExternalString was the only ExternalBackingStoreType left. We never used the per-page counter and only used the per-space counter for YoungAllocatedExternalBackingStoreBytes() but since we do not have young external strings, we can just drop it. However, we maintain a total counter for external strings in Heap::backing_store_bytes_ along with ArrayBuffers which are reported in GetHeapStatistics(). This CL removes that field but keeps this working by switching the Heap::backing_store_bytes() method to ExternalStringTable::GetBytes(). External strings are currently not accounted in external memory for GC scheduling. This CL does not change this but it adds a counter to the external string table which is currently only used for the tests in test-external-string-tracker.cc. A follow-up CL will add this tracking. Bug: 460166671 Change-Id: I1a08270fc0cf4df3ac98e78ecb08d9df5fbdaf09 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7203286 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#103988} | 7 个月前 | |
[heap] Move stick mark bit flags behind compile-time flag The flags are currently not used in production and the mode itself is already behind a compile time GN arg. Bug: 429538831 Change-Id: Ie2e40cdb4caf8d987d2dfec73950b6f73e8b4ee9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6889911 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102073} | 10 个月前 | |
[heap] Remove external backing store bytes tracking for space/page This CL removes tracking of external backing store bytes per page and per space. kExternalString was the only ExternalBackingStoreType left. We never used the per-page counter and only used the per-space counter for YoungAllocatedExternalBackingStoreBytes() but since we do not have young external strings, we can just drop it. However, we maintain a total counter for external strings in Heap::backing_store_bytes_ along with ArrayBuffers which are reported in GetHeapStatistics(). This CL removes that field but keeps this working by switching the Heap::backing_store_bytes() method to ExternalStringTable::GetBytes(). External strings are currently not accounted in external memory for GC scheduling. This CL does not change this but it adds a counter to the external string table which is currently only used for the tests in test-external-string-tracker.cc. A follow-up CL will add this tracking. Bug: 460166671 Change-Id: I1a08270fc0cf4df3ac98e78ecb08d9df5fbdaf09 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7203286 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#103988} | 7 个月前 | |
Reland "[heap] Refactor new space containment calls" This is a reland of commit e42ce24ddcf5075586e5c1f2c56677245658bb43 Original change's description: > [heap] Refactor new space containment calls > > Relay them to MemoryChunkMetadata::owner() instead of using the chunk > flags. The calls are not as hot and this way is consistent with > PagedSpace. > > Bug: 429538831 > Change-Id: I2fb533ca5f2490312cefb7a17c576b539a8fd7e3 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6879446 > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> > Commit-Queue: Michael Lippautz <mlippautz@chromium.org> > Cr-Commit-Position: refs/heads/main@{#102022} Bug: 429538831 Change-Id: I6f004d697a0ab93e70d1fb073e9d2b37402d2ebc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6883751 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#102040} | 10 个月前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
[heap] Remove external backing store bytes tracking for space/page This CL removes tracking of external backing store bytes per page and per space. kExternalString was the only ExternalBackingStoreType left. We never used the per-page counter and only used the per-space counter for YoungAllocatedExternalBackingStoreBytes() but since we do not have young external strings, we can just drop it. However, we maintain a total counter for external strings in Heap::backing_store_bytes_ along with ArrayBuffers which are reported in GetHeapStatistics(). This CL removes that field but keeps this working by switching the Heap::backing_store_bytes() method to ExternalStringTable::GetBytes(). External strings are currently not accounted in external memory for GC scheduling. This CL does not change this but it adds a counter to the external string table which is currently only used for the tests in test-external-string-tracker.cc. A follow-up CL will add this tracking. Bug: 460166671 Change-Id: I1a08270fc0cf4df3ac98e78ecb08d9df5fbdaf09 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7203286 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#103988} | 7 个月前 | |
[heap] Pass Isolate to metadata accessors Removes the implicit Isolate::Current() when looking up page metadata from a HeapObject or address, and either uses an available Isolate* or makes the Isolate::Current() explicit. There is still a MemoryChunk::Metadata() accessor which implicitly calls Isolate: :Current() -- this can be fixed in followup work. Change-Id: Ia64f1a38750f4c9c7279c631480b3ee9aadd8917 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6906859 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102184} | 10 个月前 | |
[heap] Pass Isolate to metadata accessors Removes the implicit Isolate::Current() when looking up page metadata from a HeapObject or address, and either uses an available Isolate* or makes the Isolate::Current() explicit. There is still a MemoryChunk::Metadata() accessor which implicitly calls Isolate: :Current() -- this can be fixed in followup work. Change-Id: Ia64f1a38750f4c9c7279c631480b3ee9aadd8917 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6906859 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102184} | 10 个月前 | |
[heap] Use task with kUserVisible priority instead of idle task This CL switches from idle tasks to kUserVisible tasks for "context disposal" GCs. @etiennep thankfully notices that this can improve JS score quite a bit. As we have no guarantee when this task will be run after being scheduled, we use gc_count() to only trigger a GC if no GC has been performed in-between. For idle tasks we limit this based on time, the task had to run within two frames (=16ms*2). Unlike idle tasks the regular tasks don't get a deadline, instead we use a hard coded limit of 5ms. In addition to the previous condition, we only perform the GC if the estimated time for it is less than 5ms. This CL improves JS2 by about +0.7%, JS3 by about +0.2%. Bug: 460477160 Change-Id: I9d084d59dca53a57d5cb6e81f26c122f037f15f7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6734023 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#104016} | 7 个月前 | |
[heap] Use task with kUserVisible priority instead of idle task This CL switches from idle tasks to kUserVisible tasks for "context disposal" GCs. @etiennep thankfully notices that this can improve JS score quite a bit. As we have no guarantee when this task will be run after being scheduled, we use gc_count() to only trigger a GC if no GC has been performed in-between. For idle tasks we limit this based on time, the task had to run within two frames (=16ms*2). Unlike idle tasks the regular tasks don't get a deadline, instead we use a hard coded limit of 5ms. In addition to the previous condition, we only perform the GC if the estimated time for it is less than 5ms. This CL improves JS2 by about +0.7%, JS3 by about +0.2%. Bug: 460477160 Change-Id: I9d084d59dca53a57d5cb6e81f26c122f037f15f7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6734023 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#104016} | 7 个月前 | |
[heap] Rework COMPACTION_WAS_ABORTED This moves the flag that signals that compaction was aborted to the metadata object. The tricky part here is that when aborting compaction due to OOM we may leave behind multiple half-evacuated pages that we need to re-record pointers on. Such pages must: - still be evacuation candidates as otherwise they won't trigger recording; - aborted and to signal that we should not skip recorded, as we would otherwise to on evacuation candidates; Since the check for aborted evacuation candidates now becomes more expensive, only the visitor that implements recording of slots during the atomic pause (RecordMigratedSlotVisitor) implements this functionality. The rest of the CL is merely refactoring the calls a bit. Change-Id: I1ef717b11c0566642bf5c58603c9b255a6d77d90 Bug: 429538831 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6884745 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#102095} | 10 个月前 | |
[heap] Rework COMPACTION_WAS_ABORTED This moves the flag that signals that compaction was aborted to the metadata object. The tricky part here is that when aborting compaction due to OOM we may leave behind multiple half-evacuated pages that we need to re-record pointers on. Such pages must: - still be evacuation candidates as otherwise they won't trigger recording; - aborted and to signal that we should not skip recorded, as we would otherwise to on evacuation candidates; Since the check for aborted evacuation candidates now becomes more expensive, only the visitor that implements recording of slots during the atomic pause (RecordMigratedSlotVisitor) implements this functionality. The rest of the CL is merely refactoring the calls a bit. Change-Id: I1ef717b11c0566642bf5c58603c9b255a6d77d90 Bug: 429538831 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6884745 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#102095} | 10 个月前 | |
[heap] Rework COMPACTION_WAS_ABORTED This moves the flag that signals that compaction was aborted to the metadata object. The tricky part here is that when aborting compaction due to OOM we may leave behind multiple half-evacuated pages that we need to re-record pointers on. Such pages must: - still be evacuation candidates as otherwise they won't trigger recording; - aborted and to signal that we should not skip recorded, as we would otherwise to on evacuation candidates; Since the check for aborted evacuation candidates now becomes more expensive, only the visitor that implements recording of slots during the atomic pause (RecordMigratedSlotVisitor) implements this functionality. The rest of the CL is merely refactoring the calls a bit. Change-Id: I1ef717b11c0566642bf5c58603c9b255a6d77d90 Bug: 429538831 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6884745 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#102095} | 10 个月前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
[heap] Remove external backing store bytes tracking for space/page This CL removes tracking of external backing store bytes per page and per space. kExternalString was the only ExternalBackingStoreType left. We never used the per-page counter and only used the per-space counter for YoungAllocatedExternalBackingStoreBytes() but since we do not have young external strings, we can just drop it. However, we maintain a total counter for external strings in Heap::backing_store_bytes_ along with ArrayBuffers which are reported in GetHeapStatistics(). This CL removes that field but keeps this working by switching the Heap::backing_store_bytes() method to ExternalStringTable::GetBytes(). External strings are currently not accounted in external memory for GC scheduling. This CL does not change this but it adds a counter to the external string table which is currently only used for the tests in test-external-string-tracker.cc. A follow-up CL will add this tracking. Bug: 460166671 Change-Id: I1a08270fc0cf4df3ac98e78ecb08d9df5fbdaf09 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7203286 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#103988} | 7 个月前 | |
[heap] Remove external backing store bytes tracking for space/page This CL removes tracking of external backing store bytes per page and per space. kExternalString was the only ExternalBackingStoreType left. We never used the per-page counter and only used the per-space counter for YoungAllocatedExternalBackingStoreBytes() but since we do not have young external strings, we can just drop it. However, we maintain a total counter for external strings in Heap::backing_store_bytes_ along with ArrayBuffers which are reported in GetHeapStatistics(). This CL removes that field but keeps this working by switching the Heap::backing_store_bytes() method to ExternalStringTable::GetBytes(). External strings are currently not accounted in external memory for GC scheduling. This CL does not change this but it adds a counter to the external string table which is currently only used for the tests in test-external-string-tracker.cc. A follow-up CL will add this tracking. Bug: 460166671 Change-Id: I1a08270fc0cf4df3ac98e78ecb08d9df5fbdaf09 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7203286 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#103988} | 7 个月前 | |
[heap] Use stashed remembered sets MinorMC's handling of OLD_TO_NEW remembered sets consisted of collecting pointers to all old pages that have a remembered set and iterating the sets atomically. For concurrent marking, MinorMC iterated atomically at the start of incremental marking. To reduce incremental marking start pause time, we want to iterate over the remembered sets concurrently. Remembered sets are transferred to the marker and merged back after marking. Write barriers ensure that (a) objects are marked and (b) new slots are recorded. Parallel marking is migrated to the new scheme as well to keep our visitors aligned and simplify the code while we still need to improve concurrent marking. Bug: v8:13012 Change-Id: I8aa6e721a9a90792beabf983850fef0903c6bb1f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4652188 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#88663} | 2 年前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[base] Merge SpinningMutex back into Mutex They are now the same; beyond that we can't do ave THREAD_SAFETY_ANALYSIS on a bunch of previous SpinningMutex cases, so we'll need to propagate this into Mutex. Bug: 384940357 Change-Id: Ifbd4ffc4090738455036f32d9a5cf813b9f15781 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6244422 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#98597} | 1 年前 | |
[heap] Merge PAGE_NEW_OLD_PROMOTION into metadata The flag has the same meaning as the existing flag in the metadata with the difference that it is used in the full GC instead of young generation GCs. The CL adjusts the meaning and merges the flag. Bug: 429538831 Change-Id: I6b9a10074b41c1f767fd5a902affc01af1dfdc00 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6779261 Reviewed-by: Samuel Groß <saelo@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#101594} | 11 个月前 | |
[heap] Remove kPointerMultiplier kPointerMultiplier is 1 on all our production builds. It can only be 2 on non-pointer compression builds on 64-bit platforms. This simplifies our default heap sizing and cleans up the table of possible heap configurations. Bug: 408962793 Change-Id: I5b07e6180ba81cfb6df4be2c377a4ed008dba276 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6962335 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#102585} | 9 个月前 | |
[objects, heap] Introduce SafeHeapObjectSize as uint32_t alias A lot of code in the GC uses unsigned sizes (e.g. size_t) to copy around bytes or iterate objects. The size of on-heap objects is stored as int. Attackers can craft negative sizes that can lead to very large offsets via sign extension and e.g. conversion to size_t. We can mitigate this problem by relying on SafeHeapObjectSize which is an alias to uint32_t. The alias allows for highlighting potentially violations and incrementally changing code. uint32_t is safe as it can always be used as byte size directly or cast to size_t without exceeding the sandbox. Bug: 425896305 Change-Id: I30abb716f7fa588f60991886d956a6024b170e2e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6651890 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Samuel Groß <saelo@chromium.org> Reviewed-by: Anton Bikineev <bikineev@chromium.org> Cr-Commit-Position: refs/heads/main@{#100896} | 1 年前 | |
Remove GetHeapFromWritableObject Same as https://crrev.com/c/6695012 but for the GetHeapFromWritableObject() method. R=mlippautz@chromium.org Bug: 396607238 Change-Id: I4986c52375d7848e2c300268a6b6118bc628883a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6695546 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#101330} | 11 个月前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
[cleanup] Remove some leaptiering ifdefs Remove non-leaptiering code from heap/* Bug: 42204201 Change-Id: I89f576a451192c030b04e7bd9c773627a34fc895 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6976511 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Auto-Submit: Olivier Flückiger <olivf@chromium.org> Commit-Queue: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#102706} | 9 个月前 | |
[heap] Remove OffHeapFullPointerSlot The reason to have OffHeap- variants of compressed pointer slots is to remove the operator*, which would not work - it uses the location of the slot to work out the base of the pointer cage. However the operator* of a FullPointerSlot works just fine, even off-heap, because it doesn't need any cage base to decompress a pointer that is not compressed. We were not consistently using OffHeapFullPointerSlot anyway - VisitRoots was not using it even though roots are off-heap. Change-Id: I296385f7ee7022e8b9ad2a52770f458051f971ef Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7002994 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102954} | 8 个月前 | |
[ro-promotion] Add further object types AccessCheckInfo, InterceptorInfo, and Symbol may now be ro-promoted. In the v8_context_snapshot: ReadOnlySerializer: Instance types (count and bytes): 53 848 ReadOnlyHeap SYMBOL_TYPE 2 40 ReadOnlyHeap ACCESS_CHECK_INFO_TYPE 11 440 ReadOnlyHeap INTERCEPTOR_INFO_TYPE My original intent was to promote FunctionTemplateInfo and other related objects (like FunctionTemplateRareData, TemplateList) as well. But sadly that turns out to be infeasible, because chrome startup may add properties to existing FTIs for runtime-enabled features. See e.g.: V8Window::Impl::InstallContextIndependentProperties. Although only few FTIs are modified in this way, they are referenced by almost all other snapshotted FTIs, and thus prevent promotion of most FTI objects. Bug: v8:13789 Change-Id: Ic11d6e3fcff5233c32a3cc0b596fc824908eab66 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4830122 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Jakob Linke <jgruber@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89745} | 2 年前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
[heap] Make hole maps readable even when unmapped Previously, all hole objects were placed inside a payload of the WasmNull object so that they would be fully unmapped, including their map pointer, making it a requirement to check them by value instead of by instance type. This is proving to be a difficult restriction to adhere to, particularly in optimized code (where reading the map is considered a somewhat operation and can be hoisted above hole checks). This patch refactors this by making each Hole object a large, page-minus-map-aligned object, with a readable map and its own unmappable payload. Since they are in their own area, we can revert the WasmNull to its previous single-payload layout, since it doesn't need to store the holes in its unmappable payload. We can also uncouple hole unmapping from Wasm being enabled. This unfortunately blows up the (virtual) size of the RO space, in particular requiring it to expand to multiple V8 pages. Bug: 434179415 Change-Id: Id64b1a3f1228e621590058661d33eca72604fe5f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7156717 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103929} | 7 个月前 | |
[heap] Avoid using ephemeron remembered set in full GC The ephemeron_remembered_set() is used as the OLD_TO_NEW remembered set for ephemeron keys. It is an optimization to avoid strongifying such references in minor GCs. After a full GC there are no OLD_TO_NEW references anymore, so we are already able to drop this remembered set at the end of the GC. But we still need this remembered set for updating pointers during the GC for the same reason we need OLD_TO_NEW there as well: We don't record pointers to new space in the OLD_TO_OLD remembered set. We need it to find all pointers to new space objects for relocating them. This CL is able to avoid usage of the ephemeron_remembered_set() during the full GC entirely. During incremental marking the write barrier and marker record pointers to young objects for ephemeron keys in the regular OLD_TO_NEW remembered set instead. With this the "update pointers" phase can treat ephemeron keys like regular OLD_TO_NEW slots and doesn't need special handling anymore. Change-Id: Id2ba6884e69ed01d8d09951b30060b10ea867937 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6917693 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#102391} | 9 个月前 | |
[tagged-ptr] Remove Tagged<Foo> -> Foo conversion Remove the implicit conversion from Tagged<Foo> to Foo, forcing all remaining Foo variables to be changed to Tagged<Foo> if there's a Tagged<Foo> involved. The conversion from Foo to Tagged<Foo> temporarily remains, for uses of the *this pointer, Bug: v8:12710 Change-Id: Id00c538d01670ad91d694d99e51e463db4850eee Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4838236 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89796} | 2 年前 | |
[ptr-compr] Remove OnHeapAddress from Decompress Since we're using a global cage, we never need an OnHeapAddress for decompressing pointers. Remove this unused parameter. Change-Id: Ie14a7284c1e793c0b9e146a4e57f981a2985de27 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6481261 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#99866} | 1 年前 | |
[sandbox] Disallow implicit unchecked downcasts to trusted objects To soundify C++ types of trusted objects we want to prevent accidentally casting to a trusted object without checking. To that end we enforce the explicit choice of one of three possible casts. * The (existing) TryCast should be used when we already have a type check. This construct ensures that the cast is correct by construction, since the target variable is not assigned if it fails. * The (new) (Checked|Sbx)Cast combines a (SBX)CHECK with a Cast. Replaces SBXCHECK(Is<Foo>(x)); Tagged<Foo> f = Cast<Foo>(x). * The (new) TrustedCast corresponds to Cast on non-trusted objects. The "Trusted" prefix signifies that the correctness obligations are solely on the caller. It should not be used at all if possible. Typically reasonable usecases are: * Reading a field of a trusted object. We trust them to be untampered. * Reading a trusted pointer with a type-tagged handle. The handle ensures correctness. * A visitor where the down-cast is generated by a macro. There is little possiblity for future error and TryCast would be cumbersome and potentially slower. * Low-risk code like debugging, or highly-performance sensitive code where the check is enforced indirectly. DriveBy: Add CastExposedTrustedObjectByTag which ties together the type of a ExposedTrustedObject with its IndirectPointerTag. This prevents the two from getting out of sync. Bug: 435645639 Change-Id: Id283b109ab3e0c3a4503467771bc35f1857fa236 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6859421 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Olivier Flückiger <olivf@chromium.org> Auto-Submit: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#101943} | 10 个月前 | |
[heap] Use task with kUserVisible priority instead of idle task This CL switches from idle tasks to kUserVisible tasks for "context disposal" GCs. @etiennep thankfully notices that this can improve JS score quite a bit. As we have no guarantee when this task will be run after being scheduled, we use gc_count() to only trigger a GC if no GC has been performed in-between. For idle tasks we limit this based on time, the task had to run within two frames (=16ms*2). Unlike idle tasks the regular tasks don't get a deadline, instead we use a hard coded limit of 5ms. In addition to the previous condition, we only perform the GC if the estimated time for it is less than 5ms. This CL improves JS2 by about +0.7%, JS3 by about +0.2%. Bug: 460477160 Change-Id: I9d084d59dca53a57d5cb6e81f26c122f037f15f7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6734023 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#104016} | 7 个月前 | |
[heap] Reach safepoint without triggering GC for left-trimming During left-trimming verification we need to reach a safepoint to iterate roots safely. However, with a shared heap a global safepoint may have already locked local_heaps_mutex_ to perform a shared GC. In such a scenario a shared GC would run during left trimming before the pointer in the owning JSArray got updated. This CL fixes this by using ReachSafepointWithoutTriggeringGC() to reach the safepoint. This method will always succeed to reach a safepoint without a shared heap but it might fail when a shared GC already holds the lock. Verification will only run when the safepoint was reached. Even with a shared heap, we should reach the safepoint in the vast majority of cases. Bug: 446992085 Change-Id: I519fe9fe45f3a5b15cb3e87533907251e547516f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7002762 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#102892} | 9 个月前 | |
[heap] Scavenger: Fix condition for updating max concurrency The condition was supposed to check global emptiness of the pool instead of local. Bug: 463327868 Change-Id: I1817ecb023bd304fb625691d8110ebf5320843a9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7199141 Auto-Submit: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#103940} | 7 个月前 | |
[heap] Move more stuff from scavenger.h to scavenger.cc Only the bare minimum remains in scavenger.h now. The rest is moved to scavenger.cc. When possible, methods are moved to be free standing methods. In other cases, a wrapper class is used to facilitate friending it from other classes. BYPASS_LARGE_CHANGE_WARNING: Moving code around. Change-Id: Idabc3b9076a79008ff67ac7458e20c9d2a25a222 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7074875 Commit-Queue: Omer Katz <omerkatz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103325} | 8 个月前 | |
[heap] Use task with kUserVisible priority instead of idle task This CL switches from idle tasks to kUserVisible tasks for "context disposal" GCs. @etiennep thankfully notices that this can improve JS score quite a bit. As we have no guarantee when this task will be run after being scheduled, we use gc_count() to only trigger a GC if no GC has been performed in-between. For idle tasks we limit this based on time, the task had to run within two frames (=16ms*2). Unlike idle tasks the regular tasks don't get a deadline, instead we use a hard coded limit of 5ms. In addition to the previous condition, we only perform the GC if the estimated time for it is less than 5ms. This CL improves JS2 by about +0.7%, JS3 by about +0.2%. Bug: 460477160 Change-Id: I9d084d59dca53a57d5cb6e81f26c122f037f15f7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6734023 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#104016} | 7 个月前 | |
[heap] Simplify Sweeper::CleanupInvalidTypedSlotsOfFreeRanges This CL only refactors code in the sweeper without changing behavior. This method can be simplified by moving duplicate code into new methods. Also move definition of FreeRangesMap into TypedSlotSet and replace all usages of that raw map type with that type-alias. Since we are already here, remove the unused argument in Sweeper::FreeAndProcessFreedMemory. Bug: v8:12760 Change-Id: Ifa1848b456aef7955eccbaafc00df55fbcbc385c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3574542 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#79822} | 4 年前 | |
[cleanup] Modernize std::*::value and ::type Mechanically replacing std::foo<X>::value with std::foo_v<X>, and the same for ::type -> _t. Change-Id: I543dda07ba4c95534cdcd51f1f438f2626be8273 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6491388 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#99940} | 1 年前 | |
[heap] Remove external backing store bytes tracking for space/page This CL removes tracking of external backing store bytes per page and per space. kExternalString was the only ExternalBackingStoreType left. We never used the per-page counter and only used the per-space counter for YoungAllocatedExternalBackingStoreBytes() but since we do not have young external strings, we can just drop it. However, we maintain a total counter for external strings in Heap::backing_store_bytes_ along with ArrayBuffers which are reported in GetHeapStatistics(). This CL removes that field but keeps this working by switching the Heap::backing_store_bytes() method to ExternalStringTable::GetBytes(). External strings are currently not accounted in external memory for GC scheduling. This CL does not change this but it adds a counter to the external string table which is currently only used for the tests in test-external-string-tracker.cc. A follow-up CL will add this tracking. Bug: 460166671 Change-Id: I1a08270fc0cf4df3ac98e78ecb08d9df5fbdaf09 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7203286 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#103988} | 7 个月前 | |
[heap] Remove code to turn off --separate-gc-phases --no-separate-gc-phases is no longer supported, and resulting unused code is also removed. Bug: 365694581 Change-Id: Iacb746b04156470a73b60297364088dd264c8050 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6419255 Feels: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#99626} | 1 年前 | |
[heap] Remove external backing store bytes tracking for space/page This CL removes tracking of external backing store bytes per page and per space. kExternalString was the only ExternalBackingStoreType left. We never used the per-page counter and only used the per-space counter for YoungAllocatedExternalBackingStoreBytes() but since we do not have young external strings, we can just drop it. However, we maintain a total counter for external strings in Heap::backing_store_bytes_ along with ArrayBuffers which are reported in GetHeapStatistics(). This CL removes that field but keeps this working by switching the Heap::backing_store_bytes() method to ExternalStringTable::GetBytes(). External strings are currently not accounted in external memory for GC scheduling. This CL does not change this but it adds a counter to the external string table which is currently only used for the tests in test-external-string-tracker.cc. A follow-up CL will add this tracking. Bug: 460166671 Change-Id: I1a08270fc0cf4df3ac98e78ecb08d9df5fbdaf09 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7203286 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#103988} | 7 个月前 | |
Reland "Reland "[heap] Allow PagedNewSpace to grow dynamically"" This is a reland of commit 278f8a03602eb4077997ef1bc6c0c28e31467127 Original change's description: > Reland "[heap] Allow PagedNewSpace to grow dynamically" > > This is a reland of commit 9a927342acf78235e7452dc11181dc6363abf0f2 > > Original change's description: > > [heap] Allow PagedNewSpace to grow dynamically > > > > Add pages dynamically when allocation fails as long as the usable > > capacity doesn't exceed the target capacity. Usable capacity is defined > > as target capacity - wasted bytes (due to blocks unusable by the > > freelist). > > > > After this CL, TotalCapacity() returns the target capactiy and Capacity() > > returns the current actual capacity. This CL also updates some callsites > > of Capacity() to TotalCapacity(). > > TotalCapacity() will be renamed to TargetCapacity() later in a followup CL. > > > > Bug: v8:12612 > > Change-Id: I84c520437feaa3323a6b91ad2803ca645ba1c88e > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4321246 > > Commit-Queue: Omer Katz <omerkatz@chromium.org> > > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#86330} > > Bug: v8:12612 > Change-Id: I12101c6b676c073c377bcd3d4257cc024f0a66dc > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4324603 > Commit-Queue: Omer Katz <omerkatz@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Cr-Commit-Position: refs/heads/main@{#86402} Bug: v8:12612 Change-Id: I8e274c368234422dcf6b225b2a0de47d1fdaf0e1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4334355 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#86419} | 3 年前 | |
Revert "Reland "[heap] Invoke allocation observers before limiting the LAB"" This reverts commit dbbccae19a5cda3345716095f7e5bc32f0ef3ca1. Reason for revert: Deadlock in TSAN with stress: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN/44651/overview Original change's description: > Reland "[heap] Invoke allocation observers before limiting the LAB" > > This is a reland of commit 39d387bb722d7e1b29a7219de8998286f8dbf71a > > Original change's description: > > [heap] Invoke allocation observers before limiting the LAB > > > > Currently whenever we reach a step we get a small LAB the same size as > > the allocated object. This is becuase the remaining step size is smaller > > then the current allocation. > > Invoking observers before limiting the LAB, and thus updating step > > sizes, should eliminate the small LAB we get whenever we reach a step. > > > > Drive-by: remove redundant method arguments. > > > > Bug: v8:12612 > > Change-Id: Ied92a947308368d3b289e246fdb4f40ac5e5981f > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4013683 > > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> > > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > > Commit-Queue: Omer Katz <omerkatz@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#84157} > > Bug: v8:12612, v8:13465 > Change-Id: I40fb930a755cb5decccd932c4d25ed7d5d224da4 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4020177 > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Commit-Queue: Omer Katz <omerkatz@chromium.org> > Cr-Commit-Position: refs/heads/main@{#84328} Bug: v8:12612, v8:13465 Change-Id: I70df00448c7413999b91412343915c503baf0dd3 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4035252 Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Commit-Queue: Shu-yu Guo <syg@chromium.org> Owners-Override: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#84345} | 3 年前 | |
[heap] Unify young and old epochs to a single epoch Scavenger can't run during incremental marking anymore, so we can unify epoch_young_ and epoch_old now to a single epoch_. Bug: 456384548 Change-Id: I400aef02ace44d251415083edac74573e7940a3c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7150844 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#103715} | 7 个月前 | |
[cleanup] Modernize std::*::value and ::type Mechanically replacing std::foo<X>::value with std::foo_v<X>, and the same for ::type -> _t. Change-Id: I543dda07ba4c95534cdcd51f1f438f2626be8273 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6491388 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#99940} | 1 年前 | |
[heap] Fix some clang-tidy warnings Fix a few clang tidy warnings. Change-Id: I3e025948a70c99a1513eb2ee66bc0da5d02437c8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5797192 Reviewed-by: Anton Bikineev <bikineev@chromium.org> Auto-Submit: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Anton Bikineev <bikineev@chromium.org> Cr-Commit-Position: refs/heads/main@{#95741} | 1 年前 | |
cppgc: Better manage marker dependency Use the same idiom (virtual method) for the marker dependency of cppgc. Bug: 391118563 Change-Id: I218bf201b182062e39a576c9f67c5df23f875f20 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6239572 Reviewed-by: Anton Bikineev <bikineev@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#98563} | 1 年前 | |
[heap] Remove runtime flag for reserving contiguous RO space The flag was default enabled for some time without any problems. We remove the flag to be able to depend on this feature at compile-time in various hot paths. Bug: 429538831 Change-Id: I6d45d2bd4bd7c5ff2bf5837e788a1566de7fe0c7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7173095 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103867} | 7 个月前 | |
[isolate-groups] Make TrustedRange per isolate group. Previously, all isolate groups in a process shared a single 4 GB TrustedRange. This both limited the number of isolate groups per process and allowed trusted objects to be visible across sandboxes, creating security concerns. This change allocates a dedicated TrustedRange for each isolate group and simplifies the single-cage mode code path. Bug: 42204573 Change-Id: I33be0f5a2aeb38c74fafc91b01792ae8f6e8f2ef Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6818342 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Dmitry Bezhetskov <dima00782@gmail.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102009} | 10 个月前 | |
[heap] Implement object pinning in Scavenger Object reachable from stack are pinned in place and not moved. Pages containing pinned objects are quarantined and not used for further allocations until they become empty and are freed. See design doc for more details: https://docs.google.com/document/d/1UHe6Ac60lnOshlgfP4XG6GXeh7szqbxPl4uu1x4i1EY/edit?tab=t.0#heading=h.n1atlriavj6v Bug: 379788114 Change-Id: I9acac6a26a16e617a93c967e134e7569a46acbc9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6038834 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#97535} | 1 年前 | |
Reland: [objects] Fully remove instance_type-dispatch (Reland of https://crrev.com/c/5957196) This CL removes the instance_type-dispatch used for object visitation and switches all remaining users to the visitor_id-dispatch. Non-heap users of object visitation can now use VisitObject() or VisitObjectBody() to visit an object, which both use the visitor_id-dispatch under the hood. Heap-internal users can also use the HeapVisitor class directly. Changes in Reland: The instance_type-dispatch always visited the full JSObject including slack. In the marking visitor we didn't want that. However, the serializer silently breaks as soon as we don't visit the slack anymore. This CL fixes this by adding an additional ShouldVisitFullJSObject() predicate. All VisitObjectXXX()-methods set this predicate to true to preserve behavior from the instance_type-dispatch. This CL also starts overriding the VisitEphemeron() method. Bug: 372749729 Change-Id: I87a0b4a03c03391eb5b433ef20efbe8143cce889 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5972073 Reviewed-by: Anton Bikineev <bikineev@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#96904} | 1 年前 | |
[heap] Remove code to turn off --separate-gc-phases --no-separate-gc-phases is no longer supported, and resulting unused code is also removed. Bug: 365694581 Change-Id: Iacb746b04156470a73b60297364088dd264c8050 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6419255 Feels: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#99626} | 1 年前 | |
[cleanup] Remove some leaptiering ifdefs Remove non-leaptiering code from heap/* Bug: 42204201 Change-Id: I89f576a451192c030b04e7bd9c773627a34fc895 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6976511 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Auto-Submit: Olivier Flückiger <olivf@chromium.org> Commit-Queue: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#102706} | 9 个月前 | |
[heap] Pass Isolate to metadata accessors Removes the implicit Isolate::Current() when looking up page metadata from a HeapObject or address, and either uses an available Isolate* or makes the Isolate::Current() explicit. There is still a MemoryChunk::Metadata() accessor which implicitly calls Isolate: :Current() -- this can be fixed in followup work. Change-Id: Ia64f1a38750f4c9c7279c631480b3ee9aadd8917 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6906859 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102184} | 10 个月前 | |
[heap] Fix build on latest Apple Clang Fixes the following compiler error seen in Node.js builds: In file included from ../../deps/v8/src/heap/cppgc-js/cpp-heap.cc:52: In file included from ../../deps/v8/src/heap/minor-mark-sweep.h:23: ../../deps/v8/src/heap/young-generation-marking-visitor.h:112:41: error: missing 'template' keyword prior to dependent template name 'Set' 112 | return MarkBit::From(isolate_, obj).Set<AccessMode::ATOMIC>(); | ^ ~~~~~~~~~~~~~~~~~~~~ 1 error generated. Change-Id: I7357c71245ddc446dc71ae26eccb59de91996d48 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6936362 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michaël Zasso <mic.besace@gmail.com> Cr-Commit-Position: refs/heads/main@{#102422} | 9 个月前 | |
[heap] Pass Isolate to metadata accessors Removes the implicit Isolate::Current() when looking up page metadata from a HeapObject or address, and either uses an available Isolate* or makes the Isolate::Current() explicit. There is still a MemoryChunk::Metadata() accessor which implicitly calls Isolate: :Current() -- this can be fixed in followup work. Change-Id: Ia64f1a38750f4c9c7279c631480b3ee9aadd8917 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6906859 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102184} | 10 个月前 | |
[heap] Random cleanups - Remove dead code - Move space sizing methods into heap.cc - Move zapping methods into a new zapping.h/.cc Change-Id: Ia3b56a2f75569fd3284fc17a568e64318017a0d5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4661040 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#88636} | 2 年前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 7 个月前 | ||
| 8 个月前 | ||
| 11 天前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 2 年前 | ||
| 25 天前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 8 个月前 | ||
| 8 个月前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 10 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 9 个月前 | ||
| 25 天前 | ||
| 1 年前 | ||
| 11 个月前 | ||
| 11 个月前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 3 年前 | ||
| 1 年前 | ||
| 10 个月前 | ||
| 11 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 25 天前 | ||
| 8 个月前 | ||
| 8 个月前 | ||
| 8 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 10 个月前 | ||
| 7 个月前 | ||
| 2 年前 | ||
| 9 个月前 | ||
| 9 个月前 | ||
| 11 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 10 个月前 | ||
| 10 个月前 | ||
| 8 个月前 | ||
| 9 个月前 | ||
| 7 个月前 | ||
| 8 个月前 | ||
| 7 个月前 | ||
| 25 天前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 10 个月前 | ||
| 10 个月前 | ||
| 10 个月前 | ||
| 3 个月前 | ||
| 1 年前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 11 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 10 个月前 | ||
| 8 个月前 | ||
| 10 个月前 | ||
| 25 天前 | ||
| 25 天前 | ||
| 25 天前 | ||
| 9 个月前 | ||
| 3 个月前 | ||
| 8 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 9 个月前 | ||
| 10 个月前 | ||
| 9 个月前 | ||
| 8 个月前 | ||
| 1 年前 | ||
| 10 个月前 | ||
| 11 个月前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 11 个月前 | ||
| 11 个月前 | ||
| 10 个月前 | ||
| 8 个月前 | ||
| 3 个月前 | ||
| 10 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 10 个月前 | ||
| 1 年前 | ||
| 10 个月前 | ||
| 9 个月前 | ||
| 10 个月前 | ||
| 10 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 8 个月前 | ||
| 8 个月前 | ||
| 8 个月前 | ||
| 1 年前 | ||
| 10 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 10 个月前 | ||
| 7 个月前 | ||
| 10 个月前 | ||
| 3 个月前 | ||
| 7 个月前 | ||
| 10 个月前 | ||
| 10 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 10 个月前 | ||
| 10 个月前 | ||
| 10 个月前 | ||
| 3 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 11 个月前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 11 个月前 | ||
| 7 个月前 | ||
| 9 个月前 | ||
| 8 个月前 | ||
| 2 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 9 个月前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 10 个月前 | ||
| 7 个月前 | ||
| 9 个月前 | ||
| 7 个月前 | ||
| 8 个月前 | ||
| 7 个月前 | ||
| 4 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 3 年前 | ||
| 3 年前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 10 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 9 个月前 | ||
| 10 个月前 | ||
| 9 个月前 | ||
| 10 个月前 | ||
| 2 年前 |