| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
[src] Replace base::Overloaded with absl::Overload We are allowing absl::Overload; we should replace base::Overloaded with it and remove. Bug: 392929829 Change-Id: I412a47021dba6b67952f9c98458e6631a9af765d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6629628 Commit-Queue: Ho Cheung <hocheung@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#100740} | 1 年前 | |
buganizer: fix component IDs in DIR_METADATA This only matches the old monorail components. Bug: 341800538 Change-Id: Id74fbdb3b9be0c858b77af84966c6c37adf78c5c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6025833 Reviewed-by: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Paul Semel <paulsemel@chromium.org> Commit-Queue: Paul Semel <paulsemel@chromium.org> Cr-Commit-Position: refs/heads/main@{#97252} | 1 年前 | |
Add DIR_METADATA files to v8. Generate DIR_METADATA files and remove metadata from OWNERS files for v8. R=jkummerow@chromium.org, ochang@chromium.org, yangguo@chromium.org Bug: chromium:1113033 Change-Id: I82cbb62e438d82dbbc408e87120af39fa9da0afa Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2476680 Reviewed-by: Adam Klein <adamk@chromium.org> Reviewed-by: Maya Lekova <mslekova@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Yang Guo <yangguo@chromium.org> Commit-Queue: Edward Lesmes <ehmaldonado@chromium.org> Auto-Submit: Edward Lesmes <ehmaldonado@chromium.org> Cr-Commit-Position: refs/heads/master@{#70669} | 5 年前 | |
[sandbox] Disallow implicit unchecked downcasts to trusted objects To soundify C++ types of trusted objects we want to prevent accidentally casting to a trusted object without checking. To that end we enforce the explicit choice of one of three possible casts. * The (existing) TryCast should be used when we already have a type check. This construct ensures that the cast is correct by construction, since the target variable is not assigned if it fails. * The (new) (Checked|Sbx)Cast combines a (SBX)CHECK with a Cast. Replaces SBXCHECK(Is<Foo>(x)); Tagged<Foo> f = Cast<Foo>(x). * The (new) TrustedCast corresponds to Cast on non-trusted objects. The "Trusted" prefix signifies that the correctness obligations are solely on the caller. It should not be used at all if possible. Typically reasonable usecases are: * Reading a field of a trusted object. We trust them to be untampered. * Reading a trusted pointer with a type-tagged handle. The handle ensures correctness. * A visitor where the down-cast is generated by a macro. There is little possiblity for future error and TryCast would be cumbersome and potentially slower. * Low-risk code like debugging, or highly-performance sensitive code where the check is enforced indirectly. DriveBy: Add CastExposedTrustedObjectByTag which ties together the type of a ExposedTrustedObject with its IndirectPointerTag. This prevents the two from getting out of sync. Bug: 435645639 Change-Id: Id283b109ab3e0c3a4503467771bc35f1857fa236 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6859421 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Olivier Flückiger <olivf@chromium.org> Auto-Submit: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#101943} | 10 个月前 | |
[profiling] Add "o" to the code marker for osr'd code When profiling it can be very relevant to know whether a function instantiation is osr'd or not. This adds "o" to the code marker (displayed alongside the function name) if a function has been osr'd. Turbofanned, OSR: "o*" Maglevved, OSR: "o+" Change-Id: I2235acd38fb6b336d813ef26e589cc79aa7091a2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6905404 Commit-Queue: Jakob Linke <jgruber@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Jakob Linke <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#102181} | 9 个月前 | |
[profiling] Add "o" to the code marker for osr'd code When profiling it can be very relevant to know whether a function instantiation is osr'd or not. This adds "o" to the code marker (displayed alongside the function name) if a function has been osr'd. Turbofanned, OSR: "o*" Maglevved, OSR: "o+" Change-Id: I2235acd38fb6b336d813ef26e589cc79aa7091a2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6905404 Commit-Queue: Jakob Linke <jgruber@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Jakob Linke <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#102181} | 9 个月前 | |
[temporal] Add build flag for toggling temporal The Rust build doesn't yet work with Node, and we don't have a way of doing 3p Rust dependencies in Bazel. This lets us disable Temporal in those build environments for now. Bug: 42201538 Change-Id: If25693f3f73a4967e46007736e56512f651f9a35 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6514659 Reviewed-by: Shu-yu Guo <syg@chromium.org> Reviewed-by: Michael Achenbach <machenbach@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Auto-Submit: Manish Goregaokar <manishearth@google.com> Cr-Commit-Position: refs/heads/main@{#100138} | 1 年前 | |
Rename AllocationSite::DoNotInlineBit .. to SpeculationDisabledBit to better reflect its meaning. Array constructor inlining is *not* disabled, but speculating (e.g. on the elements kind) is. Change-Id: I6a8fd4858470ae1883206caae4f269b9882bce2f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7016610 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Jakob Linke <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#103014} | 8 个月前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[handles] Migration to direct handles, part 13 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, ast, builtins, codegen, compiler, debug, deoptimizer, execution, heap, ic, init, interpreter, json, maglev, objects, parsing, regexp, runtime, snapshot, strings, temporal, wasm, and in tests. Bug: 42203211 Change-Id: Icb4238ee9082865dae47dce025e529a1c3fdfc48 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6189992 Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Omer Katz <omerkatz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#98283} | 1 年前 | |
heap_dump_1 for jsvm TicketNo: AR20260205251565 Description: heap_dump_1 for jsvm Team:gitee Feature or Bugfix: Binary Source: sync from gitee PrivateCode(Yes/No):No Change-Id: I2c4bf8190cab99d9278a68c3c7f94092f0507054 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/558 Merged-by: public pjenkins Signed-off-by: huanghan18 <huanghan18@huawei.com> revert merge request: AR20260205251565 heap_dump_1 for jsvm 5fae5665635fc7a1b52e325454044501fafec68e This revert merge request !453 | 1 个月前 | |
[tagged] Start making Struct classes new layout Split Struct into Struct and StructLayout, for old- and new-layout class hierarchies, and port the following struct classes to new layout: * Tuple2: Trivial * AccessorPair: Trivial * ClassPositions: Trivial * AllocationMemento: Typed the allocation_site field as AllocationSite, as all setters set a valid value. * AllocationSite: Made field types stricter using Unions, and split off the optional weak_next field into a separate class. Also, made it inherit HeapObject directly instead of Struct, since it had a non-Struct layout descriptor due to int32 and custom weakness fields. Bug: 42202654 Change-Id: I39112f52376879027a1f35df84ed699131c481a6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6407498 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#99577} | 1 年前 | |
Merged: [api] Fix contextual accesses within detached context ... broken by https://crrev.com/c/7184979. The issue was that - for "contextual" accesses to JSGlobalObject properties V8 needs to provide respective JSGlobalProxy as the "holder" to the accessor/interceptor callbacks, - the "holder" was computed via JSGlobalObject::global_proxy() which in case of detached context might already be backed by another instance of JSGlobalObject. - as a result if an Api callback would try to access the detached global object via such "holder" it'd access wrong JSGlobalObject instance - it'd be the current one instead of original one. The fix is to create a new JSGlobalProxy instance during context detaching, wire it properly with the old JSGlobalObject instance and pass it as a "holder" value to Api callbacks. This other global proxy is stored in a new JSGlobalObject::global_proxy_for_api field. Thus, the detached global object gets new identity which can be observed only in accessor/interceptor callbacks as the "holder" will no longer be equal to any of the v8::Context::Global(). To summarize behavior changes related to Holder()->HolderV2() migration (avoid exposing JSGlobalObject through Api) for accessor/interceptors on the global object, previously we had the following: CHECK_NE(attached_context->Global(), info.Holder()); CHECK_NE(detached_context->Global(), info.Holder()); but now we'll have: CHECK_EQ(attached_context->Global(), info.HolderV2()); CHECK_NE(detached_context->Global(), info.HolderV2()); Additionally, this CL adds Realm.navigateSameOrigin(i) for testing. Bug: 464961493 Bug: 463593768 Bug: 333672197 Fixed: 466990858 (cherry picked from commit 32fd863235d5392b8333fc882e809677596c6848) Change-Id: I60c1c7bf882da5eee12c5090feaac3fca6e03300 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7245590 Commit-Queue: Igor Sheludko <ishell@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Auto-Submit: Igor Sheludko <ishell@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/branch-heads/14.4@{#14} Cr-Branched-From: 80acc26727d5a34e77dabeebe7c9213ec1bd4768-refs/heads/14.4.258@{#1} Cr-Branched-From: ce7e597e90f6df3fa4b6df224bc613b80c635450-refs/heads/main@{#104020} | 6 个月前 | |
[objects] Port AccessCheckInfo to StructLayout Port AccessCheckInfo to use the new StructLayout definition. This involves: - Changing Torque definition annotation to @cppObjectLayoutDefinition. - Updating C++ headers to inherit from StructLayout and defining fields using TaggedMember. - Implementing inline accessors using TaggedMember methods. - Updating body descriptors and printers/verifiers. Bug: 42202654 Change-Id: Ifb814149e7b232de5900e8c9467d34651b3fca98 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7203126 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103942} | 7 个月前 | |
[objects] Port AccessCheckInfo to StructLayout Port AccessCheckInfo to use the new StructLayout definition. This involves: - Changing Torque definition annotation to @cppObjectLayoutDefinition. - Updating C++ headers to inherit from StructLayout and defining fields using TaggedMember. - Implementing inline accessors using TaggedMember methods. - Updating body descriptors and printers/verifiers. Bug: 42202654 Change-Id: Ifb814149e7b232de5900e8c9467d34651b3fca98 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7203126 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103942} | 7 个月前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[tagged] Make FixedArray a HeapObjectLayout class Move TaggedArrayBase and all its subclasses to be C++ object definitions, inheriting from HeapObjectLayout. The TaggedArrayBase holds both the length/capacity and the elements, with subclasses not expected (or able) to hold extra fields -- the Shape can include an ExtraFields mixin class for subclasses that need extra fields (like ArrayList), which is injected using template magic between the length/capacity and elements. This requires some extensions to the C++ object layout capability: * Adding a TrustedObjectLayout for starting to port over TrustedObjects, since some TaggedArrays are trusted, * Fixing TaggedMember to work with non-main cages (also for trusted arrays), * More atomics support for TaggedMember, * Adding support for the ephemeron barrier to TaggedMember (in fact, I just made EphemeronHashTable call the write barrier directly instead of having a generic macro, it's a very special case and can be treated as such), * Making sure that HeapObjectLayout is non-movable/non-copyable, to catch issues where we were passing it by value due to *this, Bug: 42202654 Change-Id: I23df96ef2815c4592438137b4d7a77d496e1fe52 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5873241 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#96556} | 1 年前 | |
[tagged] Make FixedArray a HeapObjectLayout class Move TaggedArrayBase and all its subclasses to be C++ object definitions, inheriting from HeapObjectLayout. The TaggedArrayBase holds both the length/capacity and the elements, with subclasses not expected (or able) to hold extra fields -- the Shape can include an ExtraFields mixin class for subclasses that need extra fields (like ArrayList), which is injected using template magic between the length/capacity and elements. This requires some extensions to the C++ object layout capability: * Adding a TrustedObjectLayout for starting to port over TrustedObjects, since some TaggedArrays are trusted, * Fixing TaggedMember to work with non-main cages (also for trusted arrays), * More atomics support for TaggedMember, * Adding support for the ephemeron barrier to TaggedMember (in fact, I just made EphemeronHashTable call the write barrier directly instead of having a generic macro, it's a very special case and can be treated as such), * Making sure that HeapObjectLayout is non-movable/non-copyable, to catch issues where we were passing it by value due to *this, Bug: 42202654 Change-Id: I23df96ef2815c4592438137b4d7a77d496e1fe52 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5873241 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#96556} | 1 年前 | |
[heap] Use RetryCustomAllocate in an allocator retry loop Bug: 448848875 Change-Id: I4cb74838965ec450d894cc13c9aad6e423aabd79 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7200625 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org> Cr-Commit-Position: refs/heads/main@{#103943} | 7 个月前 | |
Backing stores instances are destroying during v8::Platform which runs after V8::Dispose(). Because V8::Dispose() has already destroyed the sandbox and its page_allocator any later attempts to access page_allocator from ~BackingStore results in use-after-free. Bug: 431816002 Change-Id: I11c0ebc2f73cad6063e71732e38dfd6b5fa5927d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6732773 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Dmitry Bezhetskov <dima00782@gmail.com> Cr-Commit-Position: refs/heads/main@{#101563} | 11 个月前 | |
[bigint]: Fix BigInt::Exponentiate error message when negative exponent Bug: v8:439515479 Change-Id: I9cfb8134701b51ba55347610e32cbbcbbd3887f2 Signed-off-by: Juan José Arboleda <soyjuanarbol@gmail.com> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6902712 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Jakob Linke <jgruber@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102147} | 9 个月前 | |
api: expose GetHash Expose value hashes in the public API and improve BigInt hashing since it will now be exposed. Change-Id: I5ab423fb304f9113eb752cb3cd6f4674f35e0197 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6269198 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: snek <snek@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#98732} | 1 年前 | |
[tagged-ptr] Make HeapNumber & BigInt layout classes This also allows us to drop PrimitiveHeapObjectLayout and make PrimitiveHeapObject a layout class. Two small drive-bys driven by this: * BigInt digits access is simplified, with the Digits class getting a bit more const correct. * Float64 field accesses (into mutable HeapNumber) are changed to be a ForHeapNumberValue FieldAccess with tweaks, rather than tweaking the previous FieldAccess. Bug: v8:12710 Change-Id: I8cbf8eecf323d154d67ea768be1f508047d68fb7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5148171 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#91930} | 2 年前 | |
Reland "[sandbox] Build foundation for bytecode verification" This is a reland of commit 4fc454962b371d3e5f94ba8d03f8268a66cf49df Gracefully handle non-initialized BytecodeWrapper in heap verification. Original change's description: > [sandbox] Build foundation for bytecode verification > > This CL creates the foundation for building bytecode verification and > enforcing that all bytecode is verified before use. It does not yet > implement any actual verification, which will be added in future CLs. > > Specifically, we introduce the BytecodeVerifier class that will be able > to verify bytecode in the future. Currently the verification is a no-op. > Then, we modify the BytecodeArray creation machinery to initially create > BytecodeArray objects in an unpublished state (see crrev.com/c/7172412) > and only make them accessible to the sandbox after verification. This > helps ensure that all bytecode is verified prior to use. > > Bug: 461681036 > Change-Id: I024db361f85d4aca24fae9cbd665d29b2b78fd64 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7169863 > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Commit-Queue: Samuel Groß <saelo@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#104003} Bug: 461681036 Change-Id: I1f0262132940a07249721b93b22b62627eb22191 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7209327 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#104007} | 7 个月前 | |
[interpreter] Improve bytecode disassembler output Pass the constant pool to the bytecode decoder, so that constants can be printed as part of the bytecode itself. Also improve printing of the new split index types. Change-Id: Ia65149765b03a8d2665810b1d377e5b497600d15 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7209311 Commit-Queue: Patrick Thier <pthier@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#104020} | 7 个月前 | |
Reland "[sandbox] Build foundation for bytecode verification" This is a reland of commit 4fc454962b371d3e5f94ba8d03f8268a66cf49df Gracefully handle non-initialized BytecodeWrapper in heap verification. Original change's description: > [sandbox] Build foundation for bytecode verification > > This CL creates the foundation for building bytecode verification and > enforcing that all bytecode is verified before use. It does not yet > implement any actual verification, which will be added in future CLs. > > Specifically, we introduce the BytecodeVerifier class that will be able > to verify bytecode in the future. Currently the verification is a no-op. > Then, we modify the BytecodeArray creation machinery to initially create > BytecodeArray objects in an unpublished state (see crrev.com/c/7172412) > and only make them accessible to the sandbox after verification. This > helps ensure that all bytecode is verified prior to use. > > Bug: 461681036 > Change-Id: I024db361f85d4aca24fae9cbd665d29b2b78fd64 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7169863 > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Commit-Queue: Samuel Groß <saelo@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#104003} Bug: 461681036 Change-Id: I1f0262132940a07249721b93b22b62627eb22191 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7209327 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#104007} | 7 个月前 | |
[sandbox] Move UncompiledData into trusted space A SharedFunctionInfo has a trusted_function_data and an untrusted_function_data field, only one of which can be active. It would be nice if the two fields could be merged into a single field to simplify things. For that, all referenced objects would need to be trusted objects in trusted space. With this CL, UncompiledData objects are now trusted objects to move towards that goal. In addition, with UncompiledData now in trusted space, there are no longer any transitions between trusted and untrusted data after initialization of an SFI. This furthermore simplifies a few things as the code now no longer needs to be able to deal with concurrent transitions between these fields. Bug: 354355045 Change-Id: I911456a5fd5b283ee91bc471c24762fa5edd857f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5739741 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#95385} | 1 年前 | |
[objects] Port CallSiteInfo to StructLayout Bug: 42202654 Change-Id: I218ba0d08cdce3d8d4d23fa595da22ae11718ec4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7181922 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103907} | 7 个月前 | |
Fix class member initializer reparsing logic Intertwined static / public member initializers can mix up ids, so unmix them. Bug: 458914193 Change-Id: If0708b56750a92e03eaa5530cfbff295c2acf630 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7203465 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Auto-Submit: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#103958} | 7 个月前 | |
[objects] Port CallSiteInfo to StructLayout Bug: 42202654 Change-Id: I218ba0d08cdce3d8d4d23fa595da22ae11718ec4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7181922 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103907} | 7 个月前 | |
[objects] Port CallSiteInfo to StructLayout Bug: 42202654 Change-Id: I218ba0d08cdce3d8d4d23fa595da22ae11718ec4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7181922 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103907} | 7 个月前 | |
Reland "Reland "[heap] Support selective conservative pinning"" This is a reland of commit 7359c53ebea5ba3f233db6a1dcd34955e6b92a1e. It combines the previous reland from crrev.com/6476185, a fix to crbug.com/414572999 that landed in crrev.com/c/6494607, and a fix to the gc mole issue that caused the last revert (https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64/61555/overview). Original change's description: > Reland "[heap] Support selective conservative pinning" > > This is a reland of commit d928064abcb929676fdee001b8a09fb4220fabc2 > > Original change's description: > > [heap] Support selective conservative pinning > > > > This CL introduces a ConservativePinningScope that can be used to > > enable conservative pinning in Scavenger and disable compaction with > > stack in the full GC. The scope also records the current frame pointer > > and only scans the stack starting from that frame. > > > > Bug: 379788114 > > Change-Id: Ic076d2c6c34e0c7808f354c94bdb4dc0295e9017 > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6425023 > > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > > Commit-Queue: Omer Katz <omerkatz@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#99820} > > Bug: 379788114 > Change-Id: I91ccc12e7d6a62e7ea8a955175617d5ea167086e > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6476185 > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Commit-Queue: Omer Katz <omerkatz@chromium.org> > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> > Cr-Commit-Position: refs/heads/main@{#99968} Bug: 379788114 Change-Id: Ifa28383efb5e96e6b713aae780a25493b4af6acd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6494597 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#100099} | 1 年前 | |
[debug] Only pass SourceLocation in debug in TurboShaft SourceLocation is almost only used for debug messages in TurboShaft, so pass it only in debug mode. Additionally, std::source_location (that it wraps) is a single pointer, so we can efficiently pass it by value rather than const ref. This reduces release build d8 by ~170kb, of which ~4kb is the by-value passing. Change-Id: Ia6b592f094dad0987b8a886bf16a7d3fe8611eb1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6888815 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102072} | 10 个月前 | |
[runtime] Allow Cell to contain weak values The Cell has got two groups for accessors - maybe_value and value. The former is for accessing MaybeObject value and the latter is for use cases when it's known that the value is not weak. This CL makes the cleared weak reference a value indicating a valid prototype validity cell value. This is a preparation for storing weak references in valid prototype validity cells. Bug: 424154602 Change-Id: I6acacc95769a922b399dd7dafd4e4d13e19f9e00 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6641901 Reviewed-by: Patrick Thier <pthier@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#100828} | 1 年前 | |
[runtime] Allow Cell to contain weak values The Cell has got two groups for accessors - maybe_value and value. The former is for accessing MaybeObject value and the latter is for use cases when it's known that the value is not weak. This CL makes the cleared weak reference a value indicating a valid prototype validity cell value. This is a preparation for storing weak references in valid prototype validity cells. Bug: 424154602 Change-Id: I6acacc95769a922b399dd7dafd4e4d13e19f9e00 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6641901 Reviewed-by: Patrick Thier <pthier@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#100828} | 1 年前 | |
[runtime] Allow Cell to contain weak values The Cell has got two groups for accessors - maybe_value and value. The former is for accessing MaybeObject value and the latter is for use cases when it's known that the value is not weak. This CL makes the cleared weak reference a value indicating a valid prototype validity cell value. This is a preparation for storing weak references in valid prototype validity cells. Bug: 424154602 Change-Id: I6acacc95769a922b399dd7dafd4e4d13e19f9e00 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6641901 Reviewed-by: Patrick Thier <pthier@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#100828} | 1 年前 | |
[tagged] Introduce TrustedPointerMember This helper class simplifies defining trusted pointer members in HeapObjectLayout subclasses. Bug: 42202654 Change-Id: I505f9f70a0128899d13a464eda15026f5a435cc0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7181920 Reviewed-by: Samuel Groß <saelo@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#103897} | 7 个月前 | |
[profiling] Add "o" to the code marker for osr'd code When profiling it can be very relevant to know whether a function instantiation is osr'd or not. This adds "o" to the code marker (displayed alongside the function name) if a function has been osr'd. Turbofanned, OSR: "o*" Maglevved, OSR: "o+" Change-Id: I2235acd38fb6b336d813ef26e589cc79aa7091a2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6905404 Commit-Queue: Jakob Linke <jgruber@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Jakob Linke <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#102181} | 9 个月前 | |
[sandbox] Remove kDefaultCodeEntrypointTag, pt.1 This is a step towards making code entrypoint tag verification strict. This CL - introduces kCodeEntrypointTagForTesting, - introduces CodeKind::FOR_TESTING_JS in addition to existing CodeKind::FOR_TESTING in order to assign them different code entrypoint tags (kJSEntrypointTag for the former and kCodeEntrypointTagForTesting for the latter), - add SBXCHECK for Code object's entrypoint tags when generating calls and tail calls to compile-time known Code objects, - introduce Linkage::GetCPPBuiltinCallDescriptor() - a CEntry call descriptor customized for CPP builtins, - replaces some of the kDefaultCodeEntrypointTag usages with correct tags, - fixes usages of entrypoint tags in various code generation unit tests. Drive-by: - assign proper descriptor for GenericJSToWasmInterpreterWrapper builtin, - make Builtins::CallInterfaceDescriptorFor() work for bytecode handlers, - make switches over CodeKind values case-complete. Bug: 435630464 Change-Id: I2e34666df5314b0cd4e604a4deaf74e2f0de6f1a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6976541 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102733} | 9 个月前 | |
[cleanup] Remove leaptiering ifdefs from tiering Bug: 42204201 Change-Id: I10d7765fd38e58c48633d0cc659dcf0c1918787a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6994660 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#102830} | 9 个月前 | |
[sandbox] Don't allow to use disabled builtins, pt.2 ... i.e. the ones that belong to features that are not currently enabled. This CL: - adds kDisabledBuiltinEntrypointTag, - adds Code::is_disabled_builtin() flag which is set during RO heap deserialization for disabled JS builtins, - disables builtins by using kDisabledBuiltinEntrypointTag for them instead of kJSEntrypointTag, - initializes preallocated dispatch table entries for disabled builtins with Illegal builtin's Code. Drive-by: - add TEST_WITH_FLAG macro for cctests which need to change flag values before initializing the Isolate, - fixed respective cctests. Bug: 435630464 Change-Id: Ibfd8f66ede06210e79184fde027331775c80634b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7003083 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#102936} | 8 个月前 | |
[isolate] Stronger types for compilation cache table Bug: 434179415, 42202654 Change-Id: I33ae056f499a19874fe9714110e9d29283fe4bb0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6845796 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101984} | 10 个月前 | |
[isolate] Stronger types for compilation cache table Bug: 434179415, 42202654 Change-Id: I33ae056f499a19874fe9714110e9d29283fe4bb0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6845796 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101984} | 10 个月前 | |
[isolate] Stronger types for compilation cache table Bug: 434179415, 42202654 Change-Id: I33ae056f499a19874fe9714110e9d29283fe4bb0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6845796 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101984} | 10 个月前 | |
[ptr-compr] Remove OnHeapAddress from Decompress Since we're using a global cage, we never need an OnHeapAddress for decompressing pointers. Remove this unused parameter. Change-Id: Ie14a7284c1e793c0b9e146a4e57f981a2985de27 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6481261 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#99866} | 1 年前 | |
Reland "[sandbox] Introduce ProtectedWeakFixedArray" This is a reland of commit f1d80a1d959e5d9c4ff9782b1f1b29123c953268 Original change's description: > [sandbox] Introduce ProtectedWeakFixedArray > > A new FixedArray variant that's allocated in trusted space and > contains weak pointers to other trusted objects (or Smis). > This CL just adds the infrastructure; the first user will follow soon. > > Bug: 336507783 > Change-Id: Iaaeb694b66fa3c4e7b8ad779aff3534d60d5c042 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6049260 > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> > Cr-Commit-Position: refs/heads/main@{#97457} Bug: 336507783 Change-Id: I5e0c71908333bf80959ac03cbc18db7d28334392 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6054230 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#97467} | 1 年前 | |
Merged: [contexts] Cleanup NativeContext::IsDetached() and friends In particular: - remove Isolate parameter from JSGlobalProxy::IsDetachedFrom() and IsDetached() methods, - add more efficient implementations of global_proxy() and global_object() accessors to NativeContext compared to generic ones in Context, - make Isolate::DetachGlobal() do nothing if the context is already detached. Bug: 466990858 (cherry picked from commit bdded6d6795a1fcf21ba9bdb31071f74b7436402) Change-Id: I659378a43a472bc49ca60e3b6bf5accebfc08b46 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7241452 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Auto-Submit: Igor Sheludko <ishell@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/branch-heads/14.4@{#12} Cr-Branched-From: 80acc26727d5a34e77dabeebe7c9213ec1bd4768-refs/heads/14.4.258@{#1} Cr-Branched-From: ce7e597e90f6df3fa4b6df224bc613b80c635450-refs/heads/main@{#104020} | 6 个月前 | |
Merged: [contexts] Cleanup NativeContext::IsDetached() and friends In particular: - remove Isolate parameter from JSGlobalProxy::IsDetachedFrom() and IsDetached() methods, - add more efficient implementations of global_proxy() and global_object() accessors to NativeContext compared to generic ones in Context, - make Isolate::DetachGlobal() do nothing if the context is already detached. Bug: 466990858 (cherry picked from commit bdded6d6795a1fcf21ba9bdb31071f74b7436402) Change-Id: I659378a43a472bc49ca60e3b6bf5accebfc08b46 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7241452 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Auto-Submit: Igor Sheludko <ishell@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/branch-heads/14.4@{#12} Cr-Branched-From: 80acc26727d5a34e77dabeebe7c9213ec1bd4768-refs/heads/14.4.258@{#1} Cr-Branched-From: ce7e597e90f6df3fa4b6df224bc613b80c635450-refs/heads/main@{#104020} | 6 个月前 | |
Merged: [contexts] Cleanup NativeContext::IsDetached() and friends In particular: - remove Isolate parameter from JSGlobalProxy::IsDetachedFrom() and IsDetached() methods, - add more efficient implementations of global_proxy() and global_object() accessors to NativeContext compared to generic ones in Context, - make Isolate::DetachGlobal() do nothing if the context is already detached. Bug: 466990858 (cherry picked from commit bdded6d6795a1fcf21ba9bdb31071f74b7436402) Change-Id: I659378a43a472bc49ca60e3b6bf5accebfc08b46 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7241452 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Auto-Submit: Igor Sheludko <ishell@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/branch-heads/14.4@{#12} Cr-Branched-From: 80acc26727d5a34e77dabeebe7c9213ec1bd4768-refs/heads/14.4.258@{#1} Cr-Branched-From: ce7e597e90f6df3fa4b6df224bc613b80c635450-refs/heads/main@{#104020} | 6 个月前 | |
[objects] Port Microtask and Promise classes to StructLayout This CL ports Microtask, PromiseReaction, PromiseCapability, and their subclasses to use the new StructLayout definition. This involves: - Changing Torque definition annotations to @cppObjectLayoutDefinition. - Updating C++ headers to inherit from StructLayout and defining fields using TaggedMember. - Implementing inline accessors using TaggedMember methods. - Updating body descriptors and printers/verifiers. - Updating call sites (mostly in builtins and code stub assembler) to use offsetof() or public accessors. - Refactoring verification logic to use a common MicrotaskVerify method. - Minor modification to format-torque.py to format generates expressions that are close to 80 characters. Bug: 42202654 Change-Id: Ie4b147decc918aa0270b10dee9d0e5c894e90076 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7181923 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103986} | 7 个月前 | |
Reland "[api] Introduce CppHeapExternal" This is a reland of c6c2d15dd468cfd8166967560f22eab9f2841c07 The unit tests were relying an on-stack handle to keep the test object alive after GC with StackState::kNoHeapPointers, which doesn't work with CSS. Instead, use a a GCed object with a TracedReference to the CppHeapExternal, and keep that GCed object alive with a Persistent as needed. Tests: https://ci.chromium.org/ui/p/v8/builders/try/v8_linux64_css_dbg/b8718488560320906769/overview Original change's description: > [api] Introduce CppHeapExternal > > CppHeapExternal is an on-heap version of External, allowing embedders to > store GarbageCollected objects in JS values that aren't exposed to > JavaScript, and therefore aren't associated with a particular Context. > > Unlike JS wrapper objects, this new type extends HeapObject rather than > JSObject since it is not exposed to JavaScript. To support this, the > existing Cpp heap pointer logic is being updated to support objects with > different layouts. The Cpp object is otherwise handled in the same way > as Object::Wrap and Object::Unwrap, including using CppHeapPointerTag > (we'll use distinct tags in Blink to separate these objects from > ScriptWrappable objects; see crrev.com/c/6350413). > > Bug: 380911428 > Change-Id: I8777f7ce5c5447437557111be064ea195eaba175 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6343961 > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Commit-Queue: Scott Haseley <shaseley@chromium.org> > Cr-Commit-Position: refs/heads/main@{#99676} Bug: 380911428 Change-Id: I6a5460b914a2435ea5ce74e11b12af044b71aae1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6434692 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Scott Haseley <shaseley@chromium.org> Cr-Commit-Position: refs/heads/main@{#99702} | 1 年前 | |
Reland "[api] Introduce CppHeapExternal" This is a reland of c6c2d15dd468cfd8166967560f22eab9f2841c07 The unit tests were relying an on-stack handle to keep the test object alive after GC with StackState::kNoHeapPointers, which doesn't work with CSS. Instead, use a a GCed object with a TracedReference to the CppHeapExternal, and keep that GCed object alive with a Persistent as needed. Tests: https://ci.chromium.org/ui/p/v8/builders/try/v8_linux64_css_dbg/b8718488560320906769/overview Original change's description: > [api] Introduce CppHeapExternal > > CppHeapExternal is an on-heap version of External, allowing embedders to > store GarbageCollected objects in JS values that aren't exposed to > JavaScript, and therefore aren't associated with a particular Context. > > Unlike JS wrapper objects, this new type extends HeapObject rather than > JSObject since it is not exposed to JavaScript. To support this, the > existing Cpp heap pointer logic is being updated to support objects with > different layouts. The Cpp object is otherwise handled in the same way > as Object::Wrap and Object::Unwrap, including using CppHeapPointerTag > (we'll use distinct tags in Blink to separate these objects from > ScriptWrappable objects; see crrev.com/c/6350413). > > Bug: 380911428 > Change-Id: I8777f7ce5c5447437557111be064ea195eaba175 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6343961 > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Commit-Queue: Scott Haseley <shaseley@chromium.org> > Cr-Commit-Position: refs/heads/main@{#99676} Bug: 380911428 Change-Id: I6a5460b914a2435ea5ce74e11b12af044b71aae1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6434692 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Scott Haseley <shaseley@chromium.org> Cr-Commit-Position: refs/heads/main@{#99702} | 1 年前 | |
Reland "[api] Introduce CppHeapExternal" This is a reland of c6c2d15dd468cfd8166967560f22eab9f2841c07 The unit tests were relying an on-stack handle to keep the test object alive after GC with StackState::kNoHeapPointers, which doesn't work with CSS. Instead, use a a GCed object with a TracedReference to the CppHeapExternal, and keep that GCed object alive with a Persistent as needed. Tests: https://ci.chromium.org/ui/p/v8/builders/try/v8_linux64_css_dbg/b8718488560320906769/overview Original change's description: > [api] Introduce CppHeapExternal > > CppHeapExternal is an on-heap version of External, allowing embedders to > store GarbageCollected objects in JS values that aren't exposed to > JavaScript, and therefore aren't associated with a particular Context. > > Unlike JS wrapper objects, this new type extends HeapObject rather than > JSObject since it is not exposed to JavaScript. To support this, the > existing Cpp heap pointer logic is being updated to support objects with > different layouts. The Cpp object is otherwise handled in the same way > as Object::Wrap and Object::Unwrap, including using CppHeapPointerTag > (we'll use distinct tags in Blink to separate these objects from > ScriptWrappable objects; see crrev.com/c/6350413). > > Bug: 380911428 > Change-Id: I8777f7ce5c5447437557111be064ea195eaba175 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6343961 > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Commit-Queue: Scott Haseley <shaseley@chromium.org> > Cr-Commit-Position: refs/heads/main@{#99676} Bug: 380911428 Change-Id: I6a5460b914a2435ea5ce74e11b12af044b71aae1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6434692 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Scott Haseley <shaseley@chromium.org> Cr-Commit-Position: refs/heads/main@{#99702} | 1 年前 | |
[cleanup] Delete test-only CppHeapPointerTable method The method WriteLazilyInitializedCppHeapPointerField<> got obsolete during a recent refactoring, and since then was only called in tests. With this CL, the new version of WriteLazilyInitializedCppHeapPointerField is used in the tests, and the obsolete version gets deleted. Change-Id: I79290034ea3cdf9bb360c843ad3767bd6b1861b3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7040944 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/main@{#103124} | 8 个月前 | |
[cleanup] Delete test-only CppHeapPointerTable method The method WriteLazilyInitializedCppHeapPointerField<> got obsolete during a recent refactoring, and since then was only called in tests. With this CL, the new version of WriteLazilyInitializedCppHeapPointerField is used in the tests, and the obsolete version gets deleted. Change-Id: I79290034ea3cdf9bb360c843ad3767bd6b1861b3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7040944 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/main@{#103124} | 8 个月前 | |
[tagged] Use new layout for DataHandler Make DataHandler extend HeapObjectLayout (and StructLayout). This supports DataHandler (and subclasses) variable size by adding a flexible array member for the data, rather than optional fields -- the accessors remain as before. Bug: 42202654 Change-Id: If5fd3ae7fc4f18a3122d848246d2e0e4cef30931 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6416142 Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#99608} | 1 年前 | |
[tagged] Use new layout for DataHandler Make DataHandler extend HeapObjectLayout (and StructLayout). This supports DataHandler (and subclasses) variable size by adding a flexible array member for the data, rather than optional fields -- the accessors remain as before. Bug: 42202654 Change-Id: If5fd3ae7fc4f18a3122d848246d2e0e4cef30931 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6416142 Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#99608} | 1 年前 | |
[tagged] Use new layout for DataHandler Make DataHandler extend HeapObjectLayout (and StructLayout). This supports DataHandler (and subclasses) variable size by adding a flexible array member for the data, rather than optional fields -- the accessors remain as before. Bug: 42202654 Change-Id: If5fd3ae7fc4f18a3122d848246d2e0e4cef30931 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6416142 Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#99608} | 1 年前 | |
[tagged] Introduce TrustedPointerMember This helper class simplifies defining trusted pointer members in HeapObjectLayout subclasses. Bug: 42202654 Change-Id: I505f9f70a0128899d13a464eda15026f5a435cc0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7181920 Reviewed-by: Samuel Groß <saelo@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#103897} | 7 个月前 | |
Avoid many HeapObject::GetIsolate calls Replace them by Isolate::Current. This change was created via this script: ag -l -- '->GetIsolate()' src/ | xargs -L1 sed -i -E 's/^(.*) = .*->GetIsolate\(\)/\1 = Isolate::Current()/g' followed by manual changes to undo large parts of the changes in src/inspector and src/d8 (which work on the public API need to be changed differently), and fix remaining issues (adding "i::" prefixes, using "v8::Isolate::GetCurrent()" instead of "i::Isolate::Current()" where needed etc). R=leszeks@chromium.org Bug: 396607238 Change-Id: If56423eb073ba726de7f5aa1b7eb2994d6fa5e4c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6495413 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#100093} | 1 年前 | |
Remove GetIsolate and GetHeap from never-read-only objects Those methods are guaranteed to always return the same as Isolate::Current() (since https://crrev.com/c/6458560), so we should use that directly. R=leszeks@chromium.org Bug: 396607238 Change-Id: I6b409115ba19cadf034b9f9591d65f0d3bcae9ff Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6582963 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#100470} | 1 年前 | |
[inspector] Trace async parent per v8::StackTrace. This fixes a long-standing inconsistency, where we'd capture synchronous stack traces as v8::StackTrace (on the V8 heap) at some point, and only associate the async stack trace when transforming this V8 internal object into a v8_inspector::V8StackTrace instance. These two events can happen at different points in time, and thus the async parent can differ (and no longer match the correct async parent at the time when the stack trace was captured). With this change we now use the previously introduced ID on v8::StackTrace instances to memorize the correct async parents in the v8_inspector::V8Debugger. The inspector is notified of any stack trace capturing via the AsyncEventDelegate interface, and at the point where a v8::StackTrace is turned into a v8_inspector::V8StackTrace or a v8_inspector::AsyncStackTrace, we look up the async parent based on the ID of the v8::StackTrace. This way, async parents are now always correctly matching the synchronous part of the stack trace reported from the inspector. The debugger will now eagerly create v8::StackTraces whenever an error object is created and the inspector is attached (and asking for detailed stack traces upon uncaught exceptions). Prior to this change we tried to delay the creation of the detailed stack trace for as long as possible, but that optimization is likely overkill, since in Chrome the inspector will almost always immediately ask for the detailed stack trace for every exception thrown. But if this turns out to be a performance problem in the real world (during debugging) we can always defer the creation of the v8::StackTrace object a bit more. Bug: 350426235 Change-Id: I4b299438ee38f04c4d8ef162e1a8c517e8d6ca0c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5882140 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Auto-Submit: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Simon Zünd <szuend@chromium.org> Cr-Commit-Position: refs/heads/main@{#96303} | 1 年前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
[wasm][deopt] Do not serialize uninitialized bytes The DeoptimizationLiteral contains a union of varying size, plus padding bytes after the kind_ field. Depending on the size of the union there is a varying amount of uninitialized bytes in those objects. We thus shouldn't memcpy them completely over into WasmCode and from there into serialized bytes. This was uncovered by MSan complaining when computing a hash over the serialized bytes: https://crrev.com/c/6998009 This CL implements proper serialization and deserialization of DeoptimizationLiteral, which has the added benefit that it saves some space for deoptimization data. R=mliedtke@chromium.org CC=jkummerow@chromium.org Change-Id: Ia4de88fd558cbed09533d05a3782d1ed8e04a7cb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6999754 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#102854} | 9 个月前 | |
[wasm][deopt] Do not serialize uninitialized bytes The DeoptimizationLiteral contains a union of varying size, plus padding bytes after the kind_ field. Depending on the size of the union there is a varying amount of uninitialized bytes in those objects. We thus shouldn't memcpy them completely over into WasmCode and from there into serialized bytes. This was uncovered by MSan complaining when computing a hash over the serialized bytes: https://crrev.com/c/6998009 This CL implements proper serialization and deserialization of DeoptimizationLiteral, which has the added benefit that it saves some space for deoptimization data. R=mliedtke@chromium.org CC=jkummerow@chromium.org Change-Id: Ia4de88fd558cbed09533d05a3782d1ed8e04a7cb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6999754 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#102854} | 9 个月前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
DependentCode: Make it obvious that groups are Smis Converting the group to Smi should avoid the barrier based on the type instead of manually skipping it. Change-Id: I24bd260edf689b90fba82fd74609c2b61973ba34 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7112298 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103473} | 7 个月前 | |
[cleanup] Add a union type for objects with dependent code Change-Id: I153a60a59ca2eac95b623b23ed2ff597b19087c0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7062939 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#103221} | 8 个月前 | |
[objects] Port EnumCache to StructLayout Port EnumCache to use the new StructLayout definition. This involves: - Changing Torque definition annotation to @cppObjectLayoutDefinition. - Updating C++ headers to inherit from StructLayout and defining fields using TaggedMember. - Implementing inline accessors using TaggedMember methods. - Updating body descriptors and printers/verifiers. - Updating call sites to use offsetof(). Bug: 42202654 Change-Id: I64164300b41f658128219e0561431ad760b4c3fd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7203124 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103948} | 7 个月前 | |
[objects] Port EnumCache to StructLayout Port EnumCache to use the new StructLayout definition. This involves: - Changing Torque definition annotation to @cppObjectLayoutDefinition. - Updating C++ headers to inherit from StructLayout and defining fields using TaggedMember. - Implementing inline accessors using TaggedMember methods. - Updating body descriptors and printers/verifiers. - Updating call sites to use offsetof(). Bug: 42202654 Change-Id: I64164300b41f658128219e0561431ad760b4c3fd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7203124 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103948} | 7 个月前 | |
[objects] Port EnumCache to StructLayout Port EnumCache to use the new StructLayout definition. This involves: - Changing Torque definition annotation to @cppObjectLayoutDefinition. - Updating C++ headers to inherit from StructLayout and defining fields using TaggedMember. - Implementing inline accessors using TaggedMember methods. - Updating body descriptors and printers/verifiers. - Updating call sites to use offsetof(). Bug: 42202654 Change-Id: I64164300b41f658128219e0561431ad760b4c3fd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7203124 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103948} | 7 个月前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
[objects] Throw if there are too many props for a dict We have a maximum enumeration index on NameDictionary, exceeding this will cause behavioural weirdness (e.g. invalid order due to wraparound). We can make NameDictionary::Add potentially throw instead. Bug: 42204488, 447004361 Change-Id: I8e27b6cec8d58dbfec49503fbcbd4c855d8ed060 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5191135 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102952} | 8 个月前 | |
[runtime] Avoid more GetIsolate calls Change-Id: I254361f035027acc61268152710e70f39fe430db Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6480174 Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#99848} | 1 年前 | |
Add operator<< overload for ElementsKind In addition to be "generally useful", this fixes a bug in --trace-turbo where the elements_kind was being interpreted as an unprintable character (like '\0', '\1` instead of 0, 1...). Change-Id: Ia9e4c6332a8b55de06c8338ad2168c753312f1ac Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6229815 Reviewed-by: Marja Hölttä <marja@chromium.org> Commit-Queue: Darius Mercadier <dmercadier@chromium.org> Auto-Submit: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#98493} | 1 年前 | |
[turboshaft] Implement a TYPESWITCH primitive for Turboshaft Drive-by: Significantly extended Turboshaft's ReducerTest to allow TS graphs to be compiled and executed by the tests. This is used for a typeswitch unittest. Drive-by: Rename a few CASE macros to avoid name collisions with the TYPESWITCH's CASE. Change-Id: I75178debcc0775e5b8887e4230012c347bdd6042 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6983292 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103051} | 8 个月前 | |
[v8] Fix CVE-491884710 CVE-470566252 CVE-484527367 CVE-483851888 CVE-495679730 CVE-487768771 CVE-496301615 CVE-486927780 TicketNo: DTS2026040900445 Description: [v8] Fix CVE Team:gitcode Feature or Bugfix: Binary Source: sync from gitcode PrivateCode(Yes/No):No Change-Id: I9cc86759f497b795aaa41f2cccab2efc3892eb26 Reviewed-by: j30014474,y00500721 Approved-by: y00500721 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/540 Merged-by: public pjenkins Signed-off-by: gaojunyu <gaojunyu2@h-partners.com> revert merge request: DTS2026012010158 [v8] Fix CVE 64df2ca2a94233d7fa209bb3244843ceb12235ca This revert merge request !452 | 1 个月前 | |
[v8] Fix CVE-491884710 CVE-470566252 CVE-484527367 CVE-483851888 CVE-495679730 CVE-487768771 CVE-496301615 CVE-486927780 TicketNo: DTS2026040900445 Description: [v8] Fix CVE Team:gitcode Feature or Bugfix: Binary Source: sync from gitcode PrivateCode(Yes/No):No Change-Id: I9cc86759f497b795aaa41f2cccab2efc3892eb26 Reviewed-by: j30014474,y00500721 Approved-by: y00500721 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/540 Merged-by: public pjenkins Signed-off-by: gaojunyu <gaojunyu2@h-partners.com> revert merge request: DTS2026012010158 [v8] Fix CVE 64df2ca2a94233d7fa209bb3244843ceb12235ca This revert merge request !452 | 1 个月前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[sandbox] Add ExternalPointerTable::DuplicateEntry The method is needed to grow the EmbedderDataArray without knowing the type tags for individual AlignedPointer entries. So far, all AlignedPointer entries used the same tag, but that should change to improve security. Bug: 433909571 Change-Id: I13f9d4fe0f36bab5961e646d8190bf7b49ff3a6f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6806035 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/main@{#101770} | 10 个月前 | |
[handles] Migration to direct handles, part 8 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, asmjs, builtins, codegen, compiler, date, debug, diagnostics, execution, heap, ic, init, interpreter, json, logging, objects, parsing, regexp, runtime, snapshot, strings, wasm. Bug: 42203211 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Change-Id: Ib35bb03997bb4a646c56674f834b952dffdeaf02 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6074945 Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#97624} | 1 年前 | |
[torque] Invert the default for @generateCppClass Since most Torque-defined extern classes use @generateCppClass, it makes more sense to instead annotate the small number that don't. This is part of the cleanup work that Nico recommended in [1]. Classes that still have to opt out: - Those that can be converted by https://crrev.com/c/3015666 - HeapObject: sort of special since it's the root of the inheritance hierarchy. Generated code would include two declarations that don't compile until HeapObject is defined: bool IsHeapObject_NonInline(HeapObject o); explicit TorqueGeneratedHeapObject( Address ptr, HeapObject::AllowInlineSmiStorage allow_smi); - SmallOrdered*: these classes use templates on the C++ side, which is not currently representable in Torque. - SwissNameDictionary: according to a comment, the Torque generation for this class is incorrect. I haven't investigated further. Drive-by fix: make the Torque formatter keep LF on Windows rather than writing CRLF. [1] https://docs.google.com/document/d/1q_gZLnXd4bGnCx3IUfbln46K3bSs9UHBGasy9McQtHI/edit# Bug: v8:8952 Change-Id: I1fbb5290f0c645842b84c53816c09bb3398206a5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3028721 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com> Cr-Commit-Position: refs/heads/master@{#75841} | 4 年前 | |
[api] Remove the generic type tag kEmbedderDataSlotPayloadTag V8 is moving to type-specific tags, so generic tags are not supposed to be used anymore. Bug: 433909571 Change-Id: Ib03517eff78fe436c9ffd8f5984dc033e03fb48c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6959211 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/main@{#102565} | 9 个月前 | |
[api] Add type tag parameters to apis writing EmbedderData We are working on replacing the generic type tag kEmbedderDataSlotPayloadTag with type-specific tags. With this CL, API methods that implicitly used kEmbedderDataSlotPayloadTag get a type tag. A new enum gets introduced in the API for the type tag parameter, so that the internal ExternalPointerTag enum does not get exposed. The embedder is expected to introduce their own enum as well, where the embedder type tags get organized. The embedder enum can then be cast to the API enum. Bug: 433909571 Change-Id: Ib74b57c10d3cf7b49b4e0e4f23b0b77e46a4fa23 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6836349 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/main@{#101855} | 10 个月前 | |
[cleanup] Remove leaptiering ifdefs from tiering Bug: 42204201 Change-Id: I10d7765fd38e58c48633d0cc659dcf0c1918787a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6994660 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#102830} | 9 个月前 | |
[cleanup] Remove leaptiering ifdefs from tiering Bug: 42204201 Change-Id: I10d7765fd38e58c48633d0cc659dcf0c1918787a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6994660 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#102830} | 9 个月前 | |
[roots] Fix read-only FeedbackCell with leaptiering off Make sure that FeedbackCell is the same size even when leaptiering is off. This is a workaround to fix deprecated non-leaptiering builds in combination with static roots. No-Tree-Checks: true Change-Id: Ia57d905c679ea38f6afc907498dc2189b63540ad Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6097640 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Olivier Flückiger <olivf@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#97827} | 1 年前 | |
Sparkplug+: support patchable baseline code A bytecode handler for an operation is often a generic handler that deal with different types of inputs. This make the baseline compiler to generate a call to a generic builtin for that operation. The generic builtin can deal with all types of inputs, but this makes the builtin very large and introduces a lot of branches to distinguish inputs' types, which hurts the performance. Sparkplug+ introduces some small and specific handlers to deal with one single type of input. For example, this CL introduces some small monomorphic handlers for builtin LoadIC to deal with one specific kind of IC. We will patch the baseline code to use these specific handlers on IC misses dynamically. Bug: chromium:429351411 Change-Id: I85f842ae4050eebbdd8d25d5e113deae743c95d0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6627216 Commit-Queue: Xu, Hao A <hao.a.xu@intel.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103495} | 7 个月前 | |
Sparkplug+: support patchable baseline code A bytecode handler for an operation is often a generic handler that deal with different types of inputs. This make the baseline compiler to generate a call to a generic builtin for that operation. The generic builtin can deal with all types of inputs, but this makes the builtin very large and introduces a lot of branches to distinguish inputs' types, which hurts the performance. Sparkplug+ introduces some small and specific handlers to deal with one single type of input. For example, this CL introduces some small monomorphic handlers for builtin LoadIC to deal with one specific kind of IC. We will patch the baseline code to use these specific handlers on IC misses dynamically. Bug: chromium:429351411 Change-Id: I85f842ae4050eebbdd8d25d5e113deae743c95d0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6627216 Commit-Queue: Xu, Hao A <hao.a.xu@intel.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103495} | 7 个月前 | |
Sparkplug+: support patchable baseline code A bytecode handler for an operation is often a generic handler that deal with different types of inputs. This make the baseline compiler to generate a call to a generic builtin for that operation. The generic builtin can deal with all types of inputs, but this makes the builtin very large and introduces a lot of branches to distinguish inputs' types, which hurts the performance. Sparkplug+ introduces some small and specific handlers to deal with one single type of input. For example, this CL introduces some small monomorphic handlers for builtin LoadIC to deal with one specific kind of IC. We will patch the baseline code to use these specific handlers on IC misses dynamically. Bug: chromium:429351411 Change-Id: I85f842ae4050eebbdd8d25d5e113deae743c95d0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6627216 Commit-Queue: Xu, Hao A <hao.a.xu@intel.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103495} | 7 个月前 | |
[cleanup] Remove leaptiering ifdefs from tiering Bug: 42204201 Change-Id: I10d7765fd38e58c48633d0cc659dcf0c1918787a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6994660 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#102830} | 9 个月前 | |
Always use acquire load in Map::instance_descriptors Fixed: 448026614, 448850682, 448566463 Change-Id: If1c3b88ee323809536749b3d8f544976d50720a0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7003014 Auto-Submit: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102912} | 8 个月前 | |
[tagged-ptr] Convert more Objects to Tagged<> Convert a large amount of Objects to Tagged<Object>, by using a clang tool to convert all variables and parameters to Tagged<>, and manually fixing up any build failures this caused. Bug: v8:12710 Change-Id: I2bfc90220fe92ebc6487b5cddbc4166164637a71 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4827204 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89750} | 2 年前 | |
[handles] Migration to direct handles, part 15 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, asmjs, codegen, debug, diagnostics, execution, handles, heap, ic, json, logging, objects, profiler, regexp, runtime, snapshot, wasm, and tests. Bug: 42203211 Change-Id: Ibd2ffc4fc239088de175011e90e8dc5cadba3236 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6218795 Reviewed-by: Omer Katz <omerkatz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#98501} | 1 年前 | |
[handles] Migration to direct handles, part 15 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, asmjs, codegen, debug, diagnostics, execution, handles, heap, ic, json, logging, objects, profiler, regexp, runtime, snapshot, wasm, and tests. Bug: 42203211 Change-Id: Ibd2ffc4fc239088de175011e90e8dc5cadba3236 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6218795 Reviewed-by: Omer Katz <omerkatz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#98501} | 1 年前 | |
[sandbox] Avoid using signed string lengths in ArrayPrototypeJoin ... (namely in JSArray::ArrayJoinConcatToSequentialString) and enable implicit sign conversion warnings for respective piece of code. Drive-by: as a step towards a world where implicit signed-unsigned conversions are not allowed: - added uint32_t accessors for FixedArrayBase's length and capacity: ulength() and ucapacity(), - change index argument type of FixedArray::get(..) to uint32_t, since negative values are not expected there anyway. Fixed: 449413023 Bug: 441221573 Change-Id: Ib8281db9f6c59a3252166026bc3dd2c2204351e5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7178443 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103874} | 7 个月前 | |
[heap] Add WriteBarrierModeScope This CL adds a new class WriteBarrierModeScope which we can use in debug builds to store the object the WriteBarrierMode was computed for by GetWriteBarrierModeForObject. We can use this additional information to strengthen the write barrier verification. In order to do so, this CL adds an additional WriteBarrierMode SKIP_WRITE_BARRIER_SCOPE. Any time this mode is used, the host object of the write barrier has to match the object stored in WriteBarrierModeScope. The split between SKIP_WRITE_BARRIER and SKIP_WRITE_BARRIER_SCOPED will also enable a follow-up CL to strength the write barrier verification where write barriers are removed statically. Bug: 437096305 Change-Id: Iaba6472e49c4ea34884f0707afd3309b984eaa54 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6839044 Reviewed-by: Anton Bikineev <bikineev@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#102006} | 10 个月前 | |
[sandbox] Avoid using signed string lengths in ArrayPrototypeJoin ... (namely in JSArray::ArrayJoinConcatToSequentialString) and enable implicit sign conversion warnings for respective piece of code. Drive-by: as a step towards a world where implicit signed-unsigned conversions are not allowed: - added uint32_t accessors for FixedArrayBase's length and capacity: ulength() and ucapacity(), - change index argument type of FixedArray::get(..) to uint32_t, since negative values are not expected there anyway. Fixed: 449413023 Bug: 441221573 Change-Id: Ib8281db9f6c59a3252166026bc3dd2c2204351e5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7178443 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103874} | 7 个月前 | |
Enable undefined double on bots and make it non-experimental Bug: 385155404 Change-Id: Ib0ee24769f515d70ac9f4f5b4d8ff989e74fe8a2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6939123 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102519} | 9 个月前 | |
Remove GetIsolateForSandbox(Tagged<HeapObject>) This already has a CHECK that it returns the same as GetCurrentIsolateForSandbox(), so use that instead. R=ishell@chromium.org Bug: 396607238 Change-Id: Ie0de59a49b15ec2a4abdf419e0689a430ee8a3be Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6586570 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#100516} | 1 年前 | |
[serializer] Promote ObjectTemplateInfo to RO space when possible This CL adds v8::ObjectTemplate::SealAndPrepareForPromotionToReadOnly() which is supposed to be called by embedder when the object template is ready and is not going to be modified. Additionally, support 3-way promo decisions for promotion to read only space. The third mode "match host" is supposed to indicate that decision depends on the outer object. This is useful for types such as ArrayList or JSExternalObject (AKA v8::External), when it's impossible to make a promo decision by looking just at object without knowing how it's used. Bug: 399393891 Fixed: 413385733 Change-Id: Ic99783ea69d293c5659c3a5d74cd7151d93ba54a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6416966 Auto-Submit: Igor Sheludko <ishell@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Jakob Linke <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#99991} | 1 年前 | |
[sandbox] Introduce TrustedForeign and TrustedManaged This introduces TrustedForeign and TrustedManaged, which behave like Foreign and Managed but store the raw pointer directly. As the name suggests, these objects live in trusted space where they are safe from manipulation. We will use TrustedManaged in Wasm to reference the wasm::NativeModule. As wasm::NativeModule manages the life time of the code itself, bad things will happen if an attacker manipulates the Managed and makes us de-allocate code which is still being executed. This CL does not introduce any uses of the new classes yet. R=jkummerow@chromium.org CC=saelo@chromium.org Bug: 349563054 Change-Id: Ieed48aba7079e9ce494b533f379fc1dd8c4ccd21 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5670368 Reviewed-by: Omer Katz <omerkatz@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#94773} | 1 年前 | |
Reapply "Check current isolate when accessing MemoryChunk metadata" The parallel jobs from ParallelWeakHandlesProcessor don't have the current isolate set up, so many checks fail. The fix adds the setting scopes. Bug: 430498032 Change-Id: I5bc90983123bf09eab8c21ac7704bb82367b82a1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6765067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Anton Bikineev <bikineev@chromium.org> Cr-Commit-Position: refs/heads/main@{#101492} | 11 个月前 | |
Reapply "Check current isolate when accessing MemoryChunk metadata" The parallel jobs from ParallelWeakHandlesProcessor don't have the current isolate set up, so many checks fail. The fix adds the setting scopes. Bug: 430498032 Change-Id: I5bc90983123bf09eab8c21ac7704bb82367b82a1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6765067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Anton Bikineev <bikineev@chromium.org> Cr-Commit-Position: refs/heads/main@{#101492} | 11 个月前 | |
[tagged] Make FreeSpace a HeapObjectLayout Bug: 42202654 Change-Id: I2c5d1a69d9bf0272b631e3fa7964026f3ccded11 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6596552 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#100564} | 1 年前 | |
Fix class member initializer reparsing logic Intertwined static / public member initializers can mix up ids, so unmix them. Bug: 458914193 Change-Id: If0708b56750a92e03eaa5530cfbff295c2acf630 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7203465 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Auto-Submit: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#103958} | 7 个月前 | |
[objects] Use function syntax kind enum instead of bits on SFI and ParseInfo - Rename FunctionLiteral::FunctionType to FunctionSyntaxKind. - Re-express IsWrappedBit, IsDeclarationBit, IsAnonymousExpressionBit, and IsNamedExpressionBit in SFI::flags as FunctionSyntaxKind. This frees up 1 bit in SFI::flags. - Re-express the analogous bits in ParseInfo as FunctionSyntaxKind. - Simplifies some logic in the back-and-forth passing of this info between SFI and ParseInfo. - Drive-by fix parsing class member initializations as kAccessorOrMethod. Bug: v8:9644 Change-Id: I6c165d5016d968f5057a32136385ddcdc4a46ef1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1767263 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Adam Klein <adamk@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/master@{#63388} | 6 年前 | |
[runtime] Fix HashTable capacity overflow detection ... to avoid hitting OOM. Fixed: 451657573 Change-Id: Id6997d6b8448a042b5fa0da492e9833a8ddc1bd9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7062174 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Auto-Submit: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103228} | 8 个月前 | |
[heap] Move more stuff from scavenger.h to scavenger.cc Only the bare minimum remains in scavenger.h now. The rest is moved to scavenger.cc. When possible, methods are moved to be free standing methods. In other cases, a wrapper class is used to facilitate friending it from other classes. BYPASS_LARGE_CHANGE_WARNING: Moving code around. Change-Id: Idabc3b9076a79008ff67ac7458e20c9d2a25a222 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7074875 Commit-Queue: Omer Katz <omerkatz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103325} | 8 个月前 | |
[turbofan] Handle undefined doubles in Turbofan Bug: 385155404 Change-Id: I10748715c9a5b4eaad422648b0954d407e931e36 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6172622 Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#100181} | 1 年前 | |
[maglev] Port HeapNumber to the new VirtualObject model Change-Id: Id31340b774ab5de5d54607add5a52232d3591dcd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6983284 Auto-Submit: Jakob Linke <jgruber@chromium.org> Commit-Queue: Jakob Linke <jgruber@chromium.org> Reviewed-by: Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/main@{#102777} | 9 个月前 | |
[tagged-ptr] Make HeapNumber & BigInt layout classes This also allows us to drop PrimitiveHeapObjectLayout and make PrimitiveHeapObject a layout class. Two small drive-bys driven by this: * BigInt digits access is simplified, with the Digits class getting a bit more const correct. * Float64 field accesses (into mutable HeapNumber) are changed to be a ForHeapNumberValue FieldAccess with tweaks, rather than tweaking the previous FieldAccess. Bug: v8:12710 Change-Id: I8cbf8eecf323d154d67ea768be1f508047d68fb7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5148171 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#91930} | 2 年前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
[tagged-ptr] Port Oddball to C++ definition Oddball and its subclasses are the first to be ported to be subclasses of HeapObjectLayout. This introduces several new concepts: * UnalignedDoubleMember for double fields with tagged alignment, * Using friends for allowlisted offsetof instead of kFieldOffset constants, * An ObjectTraits trait for defining the BodyDescriptor, * An OffsetsForDebug struct in the postmortem metadata generated file, so that something can be made a friend for offsetof there, * A ForHeapNumberOrOddballValue access builder, which bottlenecks the static assert that HeapNumber::value and Oddball::to_number_raw have the same offset, * New write barrier overloads which support passing in a HeapObjectLayout subclass + a pointer to a TaggedMember, * Various other specializations and overloads to make this work (notably, comparisons of raw HeapObjectLayout* vs Tagged<Foo>). Bug: v8:12710 Change-Id: Id0e58cccd7cd050b4e42449b9ce2ff6345ab9d61 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4872543 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#91159} | 2 年前 | |
[heap] Make hole maps readable even when unmapped Previously, all hole objects were placed inside a payload of the WasmNull object so that they would be fully unmapped, including their map pointer, making it a requirement to check them by value instead of by instance type. This is proving to be a difficult restriction to adhere to, particularly in optimized code (where reading the map is considered a somewhat operation and can be hoisted above hole checks). This patch refactors this by making each Hole object a large, page-minus-map-aligned object, with a readable map and its own unmappable payload. Since they are in their own area, we can revert the WasmNull to its previous single-payload layout, since it doesn't need to store the holes in its unmappable payload. We can also uncouple hole unmapping from Wasm being enabled. This unfortunately blows up the (virtual) size of the RO space, in particular requiring it to expand to multiple V8 pages. Bug: 434179415 Change-Id: Id64b1a3f1228e621590058661d33eca72604fe5f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7156717 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103929} | 7 个月前 | |
[heap] Make hole maps readable even when unmapped Previously, all hole objects were placed inside a payload of the WasmNull object so that they would be fully unmapped, including their map pointer, making it a requirement to check them by value instead of by instance type. This is proving to be a difficult restriction to adhere to, particularly in optimized code (where reading the map is considered a somewhat operation and can be hoisted above hole checks). This patch refactors this by making each Hole object a large, page-minus-map-aligned object, with a readable map and its own unmappable payload. Since they are in their own area, we can revert the WasmNull to its previous single-payload layout, since it doesn't need to store the holes in its unmappable payload. We can also uncouple hole unmapping from Wasm being enabled. This unfortunately blows up the (virtual) size of the RO space, in particular requiring it to expand to multiple V8 pages. Bug: 434179415 Change-Id: Id64b1a3f1228e621590058661d33eca72604fe5f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7156717 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103929} | 7 个月前 | |
[heap] Use static roots for IsFreeSpaceOrFiller - Bundle the corresponding maps together - Implement the check via range check on static roots Change-Id: Ie6c6683b3cab1192f0c556494c9f9a6c279b02ea Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6578312 Reviewed-by: Olivier Flückiger <olivf@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#100443} | 1 年前 | |
Reland "[hole] DCHECK that we don't access the hole map" This is a reland of commit 99f667c6c38669c0f4556e73553987b2da69b2ed Reland fixes: * Put the check behind a flag to make this incremental. * Only check the hole in left-trimming if we can do a value check. Original change's description: > [hole] DCHECK that we don't access the hole map > > Only ever check holes by value, never by map or instance type. This will > allow us to unmap the holes entirely, and use them only as sentinel > values. > > Bug: 434179415 > Change-Id: I3f1eca4049423f39fa10c8761460378d64a92ea3 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6845798 > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Cr-Commit-Position: refs/heads/main@{#102111} Bug: 434179415 Change-Id: Ifbebea894647608b9459dfabf948818909febc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6899264 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102123} | 10 个月前 | |
Reland "[contexts] Add ContextCells" This is a reland of commit 47d530ca25fb7176b9c218fa8df8991c7c6ee0e8 This adds a detached state to the ContextCell, used to synchronize with the background thread and invalidate the code before installation. This fixes the following scenario: 1. Background: Reads a ContextCell in kConst state. 2. Background: Reads the associated constant value. 3. Foreground: Replaces the cell with a new value, tries to deopt (no code exists yet) and discards ContextCell. 4. Background: Proceeds to generate code, embedding the stale constant value read in step 2. Original change's description: > [contexts] Add ContextCells > > This simplifies constant let and mutable numbers (int32/float64). > No need for extra side table. > > Bug: 408128754 > > Change-Id: I7b95844417a4855a8a5ee44dd78fdc3d3b33c45d > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6421909 > Commit-Queue: Victor Gomes <victorgomes@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Cr-Commit-Position: refs/heads/main@{#99736} Bug: 408128754 Change-Id: I46697b5bd1f5d955b6f8bdb5f2b4896a15629499 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6446414 Auto-Submit: Victor Gomes <victorgomes@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/main@{#99757} | 1 年前 | |
[heap] Split off trusted methods into TrustedHeapLayout This should make it easier for callers to see which calls can be trusted wrt to the V8 sandbox and which calls yield in untrusted data. Bug: 429538831 Change-Id: I4939d69665197e5de75ab5757edacc7f73c76745 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6889553 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#102070} | 10 个月前 | |
[heap] Remove uses of UNSAFE_SKIP_WRITE_BARRIER in C++ write barriers This CL removes usages of UNSAFE_SKIP_WRITE_BARRIER for C++ write barriers. We were using it only for avoiding write barriers on InstructionStream but we can now avoid this with the WriteBarrierModeScope. This CL uses that class to allow skipping the write barrier on that InstructionStream without UnsafeSkipWriteBarrier. Bug: 437096305 Change-Id: Iaeaf934c466a0033bbc8dfd04eeba93a35037ad5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7014096 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102990} | 8 个月前 | |
[heap] Remove uses of UNSAFE_SKIP_WRITE_BARRIER in C++ write barriers This CL removes usages of UNSAFE_SKIP_WRITE_BARRIER for C++ write barriers. We were using it only for avoiding write barriers on InstructionStream but we can now avoid this with the WriteBarrierModeScope. This CL uses that class to allow skipping the write barrier on that InstructionStream without UnsafeSkipWriteBarrier. Bug: 437096305 Change-Id: Iaeaf934c466a0033bbc8dfd04eeba93a35037ad5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7014096 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102990} | 8 个月前 | |
[runtime] Use NameToIndexHashTable in ScopeInfo - It changes ContextSlotIndex from static to non-static. - Updates ContextSlotIndex and ScriptContextTable::Lookup to use handles, since it is necessary for the NameToIndexHashTable::Add - Adds a NameToIndexHashTableLookup to CSA. - Renames LocalNamesIterator to LocalNamesRange and iterates the hashtable when local names are not inlined. Bug: v8:12315 Change-Id: I2c8c933002fe73f4def145bc207825823262d743 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3406751 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/main@{#78818} | 4 年前 | |
TicketNo:DTS2026040312077;DTS2026040207037;DTS2026040207036;DTS2026040135724;DTS2026040135722;DTS2026032818442;DTS2026032530470;DTS2026032530464;DTS2026031327981;DTS2026031222703;DTS2026031222694;DTS2026031222686;DTS2026031222671;DTS2026031222662;DTS2026031222654 Description:【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Team:v8 Feature or Bugfix:Bugfix Binary Source:No PrivateCode(Yes/No):No Change-Id: Iae84c8fcc36a25b1936ec0997008368f70096cd6 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/534 Merged-by: public pjenkins Signed-off-by: Marja Hölttä <marja@chromium.org> | 1 个月前 | |
TicketNo:DTS2026040312077;DTS2026040207037;DTS2026040207036;DTS2026040135724;DTS2026040135722;DTS2026032818442;DTS2026032530470;DTS2026032530464;DTS2026031327981;DTS2026031222703;DTS2026031222694;DTS2026031222686;DTS2026031222671;DTS2026031222662;DTS2026031222654 Description:【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Team:v8 Feature or Bugfix:Bugfix Binary Source:No PrivateCode(Yes/No):No Change-Id: Iae84c8fcc36a25b1936ec0997008368f70096cd6 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/534 Merged-by: public pjenkins Signed-off-by: Marja Hölttä <marja@chromium.org> | 1 个月前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[typed-array] Read length & elements kind once for copy When copying from one TypedArray to another, read off the elements kind only once, and calculate type and element size from that one read. Also, only ever use the length that was passed in, to avoid multiple reads of the length -- calculate the byte length locally from the given length, rather than by re-reading the length. Additionally, clean up handling of the destination type -- this should already be handled by the templating of the helper class being used, so we can define the destination type and size as constexpr (and just DCHECK that it matches the input). Finaly drive-by, remove the element type parameter from the helper classes, and infer it from the ElementsKind, so that it's known to always be consistent. Fixed: 436140742 Change-Id: I930cfdb06f524602b256d0ce2d8692b4f0ead343 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6871394 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101990} | 10 个月前 | |
[typed-array] Read length & elements kind once for copy When copying from one TypedArray to another, read off the elements kind only once, and calculate type and element size from that one read. Also, only ever use the length that was passed in, to avoid multiple reads of the length -- calculate the byte length locally from the given length, rather than by re-reading the length. Additionally, clean up handling of the destination type -- this should already be handled by the templating of the helper class being used, so we can define the destination type and size as constexpr (and just DCHECK that it matches the input). Finaly drive-by, remove the element type parameter from the helper classes, and infer it from the ElementsKind, so that it's known to always be consistent. Fixed: 436140742 Change-Id: I930cfdb06f524602b256d0ce2d8692b4f0ead343 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6871394 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101990} | 10 个月前 | |
[typed-array] Read length & elements kind once for copy When copying from one TypedArray to another, read off the elements kind only once, and calculate type and element size from that one read. Also, only ever use the length that was passed in, to avoid multiple reads of the length -- calculate the byte length locally from the given length, rather than by re-reading the length. Additionally, clean up handling of the destination type -- this should already be handled by the templating of the helper class being used, so we can define the destination type and size as constexpr (and just DCHECK that it matches the input). Finaly drive-by, remove the element type parameter from the helper classes, and infer it from the ElementsKind, so that it's known to always be consistent. Fixed: 436140742 Change-Id: I930cfdb06f524602b256d0ce2d8692b4f0ead343 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6871394 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101990} | 10 个月前 | |
[sandbox] Try 2: remove the TypedArray "length" field Fix 1: After https://chromium-review.googlesource.com/c/v8/v8/+/6276864 and https://chromium-review.googlesource.com/c/v8/v8/+/6574425, hot paths should use the custom TypedArrayLength operation (supported by Turbofan and Maglev), so it's ok to make these paths use the byte length instead. Fix 2: Use the known ElementsKind when computing the length for the element access bounds check. Bug: 40070746 Change-Id: Iae4997b97d02dd509357e9d323808fde9c0f14c2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6449886 Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Victor Gomes <victorgomes@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/main@{#100585} | 1 年前 | |
[runtime] Avoid more GetIsolate calls Change-Id: I254361f035027acc61268152710e70f39fe430db Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6480174 Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#99848} | 1 年前 | |
[sandbox] Avoid using signed string lengths in ArrayPrototypeJoin ... (namely in JSArray::ArrayJoinConcatToSequentialString) and enable implicit sign conversion warnings for respective piece of code. Drive-by: as a step towards a world where implicit signed-unsigned conversions are not allowed: - added uint32_t accessors for FixedArrayBase's length and capacity: ulength() and ucapacity(), - change index argument type of FixedArray::get(..) to uint32_t, since negative values are not expected there anyway. Fixed: 449413023 Bug: 441221573 Change-Id: Ib8281db9f6c59a3252166026bc3dd2c2204351e5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7178443 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103874} | 7 个月前 | |
Enable undefined double on bots and make it non-experimental Bug: 385155404 Change-Id: Ib0ee24769f515d70ac9f4f5b4d8ff989e74fe8a2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6939123 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102519} | 9 个月前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[shared-struct] Remove lockAsync and waitAsync APIs Remove lockAsync and waitAsync experimental APIs. These are not needed right now, they are listed as future work in the TC39 shared structs proposal. Bug: 42202493 Change-Id: I47b93e056c76d20fa3a943a841aeffc4ca5021c2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7139418 Reviewed-by: Olivier Flückiger <olivf@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Luis Pardo <lpardosixtos@microsoft.com> Cr-Commit-Position: refs/heads/main@{#103652} | 7 个月前 | |
[shared-struct] Remove lockAsync and waitAsync APIs Remove lockAsync and waitAsync experimental APIs. These are not needed right now, they are listed as future work in the TC39 shared structs proposal. Bug: 42202493 Change-Id: I47b93e056c76d20fa3a943a841aeffc4ca5021c2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7139418 Reviewed-by: Olivier Flückiger <olivf@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Luis Pardo <lpardosixtos@microsoft.com> Cr-Commit-Position: refs/heads/main@{#103652} | 7 个月前 | |
[shared-struct] Move WaiterQueueNode into JS JSSynchronizationPrimitive Currently the futex implementation for JSAtomicsMutex and JSAtomicsCondition uses an ExternalPointerHandle encoded in its uint32 state field while also keeping a reference in the isolate to handle the GC marking. This approach works, but prevent us from having more than one primitive waiting at a time in the same thread, which could happen in the upcoming async lock/wait implementation. This CL moves the ExternalPointerHandle out of the state field and into a regular field so it can be visited whenever its synchronization primitive is visited. Bug: v8:12547 Change-Id: I39958f503ce7f88d9cc461ad8b31e892f6b2e6f0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5274251 Reviewed-by: Omer Katz <omerkatz@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Shu-yu Guo <syg@chromium.org> Commit-Queue: Luis Fernando Pardo Sixtos <lpardosixtos@microsoft.com> Cr-Commit-Position: refs/heads/main@{#92594} | 2 年前 | |
TicketNo:DTS2026040312077;DTS2026040207037;DTS2026040207036;DTS2026040135724;DTS2026040135722;DTS2026032818442;DTS2026032530470;DTS2026032530464;DTS2026031327981;DTS2026031222703;DTS2026031222694;DTS2026031222686;DTS2026031222671;DTS2026031222662;DTS2026031222654 Description:【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Team:v8 Feature or Bugfix:Bugfix Binary Source:No PrivateCode(Yes/No):No Change-Id: Iae84c8fcc36a25b1936ec0997008368f70096cd6 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/534 Merged-by: public pjenkins Signed-off-by: Marja Hölttä <marja@chromium.org> | 1 个月前 | |
TicketNo:DTS2026040312077;DTS2026040207037;DTS2026040207036;DTS2026040135724;DTS2026040135722;DTS2026032818442;DTS2026032530470;DTS2026032530464;DTS2026031327981;DTS2026031222703;DTS2026031222694;DTS2026031222686;DTS2026031222671;DTS2026031222662;DTS2026031222654 Description:【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Team:v8 Feature or Bugfix:Bugfix Binary Source:No PrivateCode(Yes/No):No Change-Id: Iae84c8fcc36a25b1936ec0997008368f70096cd6 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/534 Merged-by: public pjenkins Signed-off-by: Marja Hölttä <marja@chromium.org> | 1 个月前 | |
TicketNo:DTS2026040312077;DTS2026040207037;DTS2026040207036;DTS2026040135724;DTS2026040135722;DTS2026032818442;DTS2026032530470;DTS2026032530464;DTS2026031327981;DTS2026031222703;DTS2026031222694;DTS2026031222686;DTS2026031222671;DTS2026031222662;DTS2026031222654 Description:【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Team:v8 Feature or Bugfix:Bugfix Binary Source:No PrivateCode(Yes/No):No Change-Id: Iae84c8fcc36a25b1936ec0997008368f70096cd6 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/534 Merged-by: public pjenkins Signed-off-by: Marja Hölttä <marja@chromium.org> | 1 个月前 | |
TicketNo:DTS2026040312077;DTS2026040207037;DTS2026040207036;DTS2026040135724;DTS2026040135722;DTS2026032818442;DTS2026032530470;DTS2026032530464;DTS2026031327981;DTS2026031222703;DTS2026031222694;DTS2026031222686;DTS2026031222671;DTS2026031222662;DTS2026031222654 Description:【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Team:v8 Feature or Bugfix:Bugfix Binary Source:No PrivateCode(Yes/No):No Change-Id: Iae84c8fcc36a25b1936ec0997008368f70096cd6 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/534 Merged-by: public pjenkins Signed-off-by: Marja Hölttä <marja@chromium.org> | 1 个月前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[intl] Fix intl402/*/prototype/resolvedOptions/resolved-*-unicode-extensions-and-options Bug: 423663304 Change-Id: Ie60ce521a6a9282a7757c2d82933398a6e53ce2a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7202716 Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Commit-Queue: Frank Tang <ftang@chromium.org> Cr-Commit-Position: refs/heads/main@{#103994} | 7 个月前 | |
Include guards should be at the top of files. For the include guard optimization to kick in the include guards should be the first thing in the file, not counting comments. In some cases the guard has been moved above a comment for consistency even though this does not matter. A couple of include guards have been renamed for uniqueness. git cl upload complained about some lint nits which have been fixed. Change-Id: Iaa208ea6557c36c84bc7bb77c787ba9feb7cf037 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6275067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98907} | 1 年前 | |
[torque] Invert the default for @generateCppClass Since most Torque-defined extern classes use @generateCppClass, it makes more sense to instead annotate the small number that don't. This is part of the cleanup work that Nico recommended in [1]. Classes that still have to opt out: - Those that can be converted by https://crrev.com/c/3015666 - HeapObject: sort of special since it's the root of the inheritance hierarchy. Generated code would include two declarations that don't compile until HeapObject is defined: bool IsHeapObject_NonInline(HeapObject o); explicit TorqueGeneratedHeapObject( Address ptr, HeapObject::AllowInlineSmiStorage allow_smi); - SmallOrdered*: these classes use templates on the C++ side, which is not currently representable in Torque. - SwissNameDictionary: according to a comment, the Torque generation for this class is incorrect. I haven't investigated further. Drive-by fix: make the Torque formatter keep LF on Windows rather than writing CRLF. [1] https://docs.google.com/document/d/1q_gZLnXd4bGnCx3IUfbln46K3bSs9UHBGasy9McQtHI/edit# Bug: v8:8952 Change-Id: I1fbb5290f0c645842b84c53816c09bb3398206a5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3028721 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com> Cr-Commit-Position: refs/heads/master@{#75841} | 4 年前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[tagged-ptr] Convert more Objects to Tagged<> Convert a large amount of Objects to Tagged<Object>, by using a clang tool to convert all variables and parameters to Tagged<>, and manually fixing up any build failures this caused. Bug: v8:12710 Change-Id: I2bfc90220fe92ebc6487b5cddbc4166164637a71 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4827204 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89750} | 2 年前 | |
[torque] Invert the default for @generateCppClass Since most Torque-defined extern classes use @generateCppClass, it makes more sense to instead annotate the small number that don't. This is part of the cleanup work that Nico recommended in [1]. Classes that still have to opt out: - Those that can be converted by https://crrev.com/c/3015666 - HeapObject: sort of special since it's the root of the inheritance hierarchy. Generated code would include two declarations that don't compile until HeapObject is defined: bool IsHeapObject_NonInline(HeapObject o); explicit TorqueGeneratedHeapObject( Address ptr, HeapObject::AllowInlineSmiStorage allow_smi); - SmallOrdered*: these classes use templates on the C++ side, which is not currently representable in Torque. - SwissNameDictionary: according to a comment, the Torque generation for this class is incorrect. I haven't investigated further. Drive-by fix: make the Torque formatter keep LF on Windows rather than writing CRLF. [1] https://docs.google.com/document/d/1q_gZLnXd4bGnCx3IUfbln46K3bSs9UHBGasy9McQtHI/edit# Bug: v8:8952 Change-Id: I1fbb5290f0c645842b84c53816c09bb3398206a5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3028721 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com> Cr-Commit-Position: refs/heads/master@{#75841} | 4 年前 | |
Use unsigned integers for HashTable size and capacity Until now, we used a (signed) int for the NumberOfElements() and Capacity() of a HashTable. Using signed integers for things like sizes is generally somewhat dangerous as it can for example lead to seemingly impossible integer overflows if the (32-bit) int is first promoted to a (64-bit) size_t, which is then increased further (e.g. through a multiplication with an element size). This is particularly problematic for the sandbox as the on-heap integer value is fully attacker-controlled. To avoid these problems, unsigned integer types should be used for values that represent object sizes or similar. This CL therefore switches HashTableBase to use uint32_t instead. Bug: 414831374 Change-Id: Iba3a8034b124a4452cb843f9b46b41def8dced7f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6540830 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#100269} | 1 年前 | |
[set-methods] Use transient type for backing table To better catch bugs for the backing table of JSSets from being changed by user code, use a transient witness type when accessing the backing table. Also fix stale uses of the table pointer in intersection, isDisjointFrom, and isSupersetOf. Bug: v8:13556 Change-Id: Icda30dd3cebd1038014b7f8bfedb544c1a35ddf5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5118456 Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#91524} | 2 年前 | |
[temporal] Implement Ch15 of Temporal https://tc39.es/proposal-temporal/#sec-temporal-intl Use 12 unused bits from the flags to remember which option was present in the optinos during the constructor so we can lazy create the SimpleDateFormat for Temporal during the format time. This avoid memory penalty and performance penalty on the Intl.DateTimeFormat when it is not used with Temporal (such as in (new Date()).toLocaleString(). If we resolve all format during constructor, we may cause performance problem and blow the memory for old (and most common) use cases. Bug: 401065166 Change-Id: I70b9f0d37a1cfbf00d80e382b594a6e7829c6fd3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6770445 Commit-Queue: Frank Tang <ftang@chromium.org> Reviewed-by: Manish Goregaokar <manishearth@google.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101584} | 11 个月前 | |
TicketNo:DTS2026040312077;DTS2026040207037;DTS2026040207036;DTS2026040135724;DTS2026040135722;DTS2026032818442;DTS2026032530470;DTS2026032530464;DTS2026031327981;DTS2026031222703;DTS2026031222694;DTS2026031222686;DTS2026031222671;DTS2026031222662;DTS2026031222654 Description:【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Team:v8 Feature or Bugfix:Bugfix Binary Source:No PrivateCode(Yes/No):No Change-Id: Iae84c8fcc36a25b1936ec0997008368f70096cd6 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/534 Merged-by: public pjenkins Signed-off-by: Marja Hölttä <marja@chromium.org> | 1 个月前 | |
[temporal] Implement Ch15 of Temporal https://tc39.es/proposal-temporal/#sec-temporal-intl Use 12 unused bits from the flags to remember which option was present in the optinos during the constructor so we can lazy create the SimpleDateFormat for Temporal during the format time. This avoid memory penalty and performance penalty on the Intl.DateTimeFormat when it is not used with Temporal (such as in (new Date()).toLocaleString(). If we resolve all format during constructor, we may cause performance problem and blow the memory for old (and most common) use cases. Bug: 401065166 Change-Id: I70b9f0d37a1cfbf00d80e382b594a6e7829c6fd3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6770445 Commit-Queue: Frank Tang <ftang@chromium.org> Reviewed-by: Manish Goregaokar <manishearth@google.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101584} | 11 个月前 | |
[temporal] Implement Ch15 of Temporal https://tc39.es/proposal-temporal/#sec-temporal-intl Use 12 unused bits from the flags to remember which option was present in the optinos during the constructor so we can lazy create the SimpleDateFormat for Temporal during the format time. This avoid memory penalty and performance penalty on the Intl.DateTimeFormat when it is not used with Temporal (such as in (new Date()).toLocaleString(). If we resolve all format during constructor, we may cause performance problem and blow the memory for old (and most common) use cases. Bug: 401065166 Change-Id: I70b9f0d37a1cfbf00d80e382b594a6e7829c6fd3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6770445 Commit-Queue: Frank Tang <ftang@chromium.org> Reviewed-by: Manish Goregaokar <manishearth@google.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101584} | 11 个月前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[temporal] Implement Ch15 of Temporal https://tc39.es/proposal-temporal/#sec-temporal-intl Use 12 unused bits from the flags to remember which option was present in the optinos during the constructor so we can lazy create the SimpleDateFormat for Temporal during the format time. This avoid memory penalty and performance penalty on the Intl.DateTimeFormat when it is not used with Temporal (such as in (new Date()).toLocaleString(). If we resolve all format during constructor, we may cause performance problem and blow the memory for old (and most common) use cases. Bug: 401065166 Change-Id: I70b9f0d37a1cfbf00d80e382b594a6e7829c6fd3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6770445 Commit-Queue: Frank Tang <ftang@chromium.org> Reviewed-by: Manish Goregaokar <manishearth@google.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101584} | 11 个月前 | |
[temporal] Implement Ch15 of Temporal https://tc39.es/proposal-temporal/#sec-temporal-intl Use 12 unused bits from the flags to remember which option was present in the optinos during the constructor so we can lazy create the SimpleDateFormat for Temporal during the format time. This avoid memory penalty and performance penalty on the Intl.DateTimeFormat when it is not used with Temporal (such as in (new Date()).toLocaleString(). If we resolve all format during constructor, we may cause performance problem and blow the memory for old (and most common) use cases. Bug: 401065166 Change-Id: I70b9f0d37a1cfbf00d80e382b594a6e7829c6fd3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6770445 Commit-Queue: Frank Tang <ftang@chromium.org> Reviewed-by: Manish Goregaokar <manishearth@google.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101584} | 11 个月前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[explicit-resource-management] Check for callability of dispose function We previously checked if Symbol.dispose or Symbol.asynDispose is a JSFunction but the correct check is its callability. This CL fixes this bug. Fix: 437612640 Change-Id: Ib17a3abd9507feb81d5056706e0fae067c41ecd6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6852104 Auto-Submit: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Reviewed-by: Olivier Flückiger <olivf@chromium.org> Commit-Queue: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#101905} | 10 个月前 | |
[hole] Add strict hole subtypes ... and make Hole a trivial HeapObjectLayout type. This required renaming Uninitialized and Exception to UninitializedHole and ExceptionHole (respectively), to avoid name conflicts. Bug: 434179415, 42202654 Change-Id: I78e4f85bc31a7ff9b1cbfca820307c649df49552 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6842396 Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#101882} | 10 个月前 | |
[explicit-resource-management] Fix rethrow message This CL fixes a bug where when rethrowing the sole error message in a block with resources to dispose, the message is not correctly preserved, causing no error message to be displayed in d8. Bug: 42203506 Change-Id: I22ca4c26800f37c741df14e72d424f81ffa83333 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6300617 Commit-Queue: Shu-yu Guo <syg@chromium.org> Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Cr-Commit-Position: refs/heads/main@{#98901} | 1 年前 | |
[explicit-resource-management] Fix variable names This CL changes the name of the boolean values in JSDisposableStackBase to correct format. This CL also fix passing the pending message to the runtime call to handle exceptions during disposal calls. Bug: 42203506, 42203814 Change-Id: I88d9ab5ed6a29bffdf9ef7bc5a05b8c1c050f4af Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6020627 Reviewed-by: Shu-yu Guo <syg@chromium.org> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Cr-Commit-Position: refs/heads/main@{#97194} | 1 年前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[intl] Fix intl402/*/prototype/resolvedOptions/resolved-*-unicode-extensions-and-options Bug: 423663304 Change-Id: Ie60ce521a6a9282a7757c2d82933398a6e53ce2a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7202716 Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Commit-Queue: Frank Tang <ftang@chromium.org> Cr-Commit-Position: refs/heads/main@{#103994} | 7 个月前 | |
[temporal] Implement Ch15 of Temporal https://tc39.es/proposal-temporal/#sec-temporal-intl Use 12 unused bits from the flags to remember which option was present in the optinos during the constructor so we can lazy create the SimpleDateFormat for Temporal during the format time. This avoid memory penalty and performance penalty on the Intl.DateTimeFormat when it is not used with Temporal (such as in (new Date()).toLocaleString(). If we resolve all format during constructor, we may cause performance problem and blow the memory for old (and most common) use cases. Bug: 401065166 Change-Id: I70b9f0d37a1cfbf00d80e382b594a6e7829c6fd3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6770445 Commit-Queue: Frank Tang <ftang@chromium.org> Reviewed-by: Manish Goregaokar <manishearth@google.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101584} | 11 个月前 | |
Sync the implementation of DurationFormat Spec text https://tc39.es/proposal-intl-duration-format/ Bug: v8:11660 Change-Id: I439281b29429e96b934b33486617da03b2ff29d1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5485577 Commit-Queue: Frank Tang <ftang@chromium.org> Reviewed-by: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#94450} | 2 年前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
[cleanup] remove V8_ENABLE_LEAPTIERING as it's always defined Change-Id: I63421cc19f96e4063178f1ad83b3215f0f2bbbea Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7100740 Reviewed-by: Olivier Flückiger <olivf@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Dan Carney <dcarney@chromium.org> Cr-Commit-Position: refs/heads/main@{#103430} | 8 个月前 | |
[cleanup] Remove leaptiering ifdefs from tiering Bug: 42204201 Change-Id: I10d7765fd38e58c48633d0cc659dcf0c1918787a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6994660 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#102830} | 9 个月前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
Async generators should rethrow when yielding a rejected promise This changes the behavior of yield in an async generator when it yields a rejected promise to use the rethrow instruction instead of the throw instruction. This prevents the debugger from breaking on the exception twice. Fixed: chromium:1406421 Change-Id: I2d340f06674594b9cfdaa9371807c96a1143ea08 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5237472 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Simon Zünd <szuend@chromium.org> Commit-Queue: Eric Leese <leese@chromium.org> Cr-Commit-Position: refs/heads/main@{#92027} | 2 年前 | |
[torque] Invert the default for @generateCppClass Since most Torque-defined extern classes use @generateCppClass, it makes more sense to instead annotate the small number that don't. This is part of the cleanup work that Nico recommended in [1]. Classes that still have to opt out: - Those that can be converted by https://crrev.com/c/3015666 - HeapObject: sort of special since it's the root of the inheritance hierarchy. Generated code would include two declarations that don't compile until HeapObject is defined: bool IsHeapObject_NonInline(HeapObject o); explicit TorqueGeneratedHeapObject( Address ptr, HeapObject::AllowInlineSmiStorage allow_smi); - SmallOrdered*: these classes use templates on the C++ side, which is not currently representable in Torque. - SwissNameDictionary: according to a comment, the Torque generation for this class is incorrect. I haven't investigated further. Drive-by fix: make the Torque formatter keep LF on Windows rather than writing CRLF. [1] https://docs.google.com/document/d/1q_gZLnXd4bGnCx3IUfbln46K3bSs9UHBGasy9McQtHI/edit# Bug: v8:8952 Change-Id: I1fbb5290f0c645842b84c53816c09bb3398206a5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3028721 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com> Cr-Commit-Position: refs/heads/master@{#75841} | 4 年前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[casting] Remove Foo::cast Replace Foo::cast with Cast<Foo>. This is, blessedly, the same number of characters, and allows us to remove the need to declare cast functions in every type (instead using instance-type based type checks for most things, and a few template specializations of CastTraits for the remainder). Bug: 345640551 Change-Id: Ic215e2d4519f3128457db8a828a73c18204714bd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5614630 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#94425} | 2 年前 | |
[iterator-helpers] throw when next() is null In this CL, the status of iterator is tracked in this value instead of next. So the next() will be unmodified and the code throws if it is null. Bug: 42203505 Fixed: 336839115 Change-Id: I0e84349e890432e9f673371c24c574603145e36c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5491439 Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Reviewed-by: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#93591} | 2 年前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[temporal] Implement Ch15 of Temporal https://tc39.es/proposal-temporal/#sec-temporal-intl Use 12 unused bits from the flags to remember which option was present in the optinos during the constructor so we can lazy create the SimpleDateFormat for Temporal during the format time. This avoid memory penalty and performance penalty on the Intl.DateTimeFormat when it is not used with Temporal (such as in (new Date()).toLocaleString(). If we resolve all format during constructor, we may cause performance problem and blow the memory for old (and most common) use cases. Bug: 401065166 Change-Id: I70b9f0d37a1cfbf00d80e382b594a6e7829c6fd3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6770445 Commit-Queue: Frank Tang <ftang@chromium.org> Reviewed-by: Manish Goregaokar <manishearth@google.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101584} | 11 个月前 | |
[temporal] Implement Ch15 of Temporal https://tc39.es/proposal-temporal/#sec-temporal-intl Use 12 unused bits from the flags to remember which option was present in the optinos during the constructor so we can lazy create the SimpleDateFormat for Temporal during the format time. This avoid memory penalty and performance penalty on the Intl.DateTimeFormat when it is not used with Temporal (such as in (new Date()).toLocaleString(). If we resolve all format during constructor, we may cause performance problem and blow the memory for old (and most common) use cases. Bug: 401065166 Change-Id: I70b9f0d37a1cfbf00d80e382b594a6e7829c6fd3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6770445 Commit-Queue: Frank Tang <ftang@chromium.org> Reviewed-by: Manish Goregaokar <manishearth@google.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101584} | 11 个月前 | |
[torque] Invert the default for @generateCppClass Since most Torque-defined extern classes use @generateCppClass, it makes more sense to instead annotate the small number that don't. This is part of the cleanup work that Nico recommended in [1]. Classes that still have to opt out: - Those that can be converted by https://crrev.com/c/3015666 - HeapObject: sort of special since it's the root of the inheritance hierarchy. Generated code would include two declarations that don't compile until HeapObject is defined: bool IsHeapObject_NonInline(HeapObject o); explicit TorqueGeneratedHeapObject( Address ptr, HeapObject::AllowInlineSmiStorage allow_smi); - SmallOrdered*: these classes use templates on the C++ side, which is not currently representable in Torque. - SwissNameDictionary: according to a comment, the Torque generation for this class is incorrect. I haven't investigated further. Drive-by fix: make the Torque formatter keep LF on Windows rather than writing CRLF. [1] https://docs.google.com/document/d/1q_gZLnXd4bGnCx3IUfbln46K3bSs9UHBGasy9McQtHI/edit# Bug: v8:8952 Change-Id: I1fbb5290f0c645842b84c53816c09bb3398206a5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3028721 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com> Cr-Commit-Position: refs/heads/master@{#75841} | 4 年前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[intl] Fix Locale minimize logic Bug: 42200451 Change-Id: I64e7b1daf380375a01040658a6af846c7b2578a9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7171066 Reviewed-by: Thibaud Michaud <thibaudm@chromium.org> Commit-Queue: Frank Tang <ftang@chromium.org> Cr-Commit-Position: refs/heads/main@{#103836} | 7 个月前 | |
[intl] add Intl.Locale.prototype get variants https://tc39.es/ecma402/#sec-Intl.Locale.prototype.variants Added to the spec by https://github.com/tc39/ecma402/pull/960 Test code added in https://github.com/tc39/test262/pull/4474/ feature https://chromestatus.com/feature/4709921706868736 I2P https://groups.google.com/a/chromium.org/g/blink-dev/c/NCT4pPJ_Uz8/m/G62K-m6CAgAJ Bug: 450083673 Change-Id: I49a4af9f9e75a18efb3b67f546f971d4c24e0bb0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7018878 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Olivier Flückiger <olivf@chromium.org> Commit-Queue: Frank Tang <ftang@chromium.org> Cr-Commit-Position: refs/heads/main@{#103188} | 8 个月前 | |
[torque] Invert the default for @generateCppClass Since most Torque-defined extern classes use @generateCppClass, it makes more sense to instead annotate the small number that don't. This is part of the cleanup work that Nico recommended in [1]. Classes that still have to opt out: - Those that can be converted by https://crrev.com/c/3015666 - HeapObject: sort of special since it's the root of the inheritance hierarchy. Generated code would include two declarations that don't compile until HeapObject is defined: bool IsHeapObject_NonInline(HeapObject o); explicit TorqueGeneratedHeapObject( Address ptr, HeapObject::AllowInlineSmiStorage allow_smi); - SmallOrdered*: these classes use templates on the C++ side, which is not currently representable in Torque. - SwissNameDictionary: according to a comment, the Torque generation for this class is incorrect. I haven't investigated further. Drive-by fix: make the Torque formatter keep LF on Windows rather than writing CRLF. [1] https://docs.google.com/document/d/1q_gZLnXd4bGnCx3IUfbln46K3bSs9UHBGasy9McQtHI/edit# Bug: v8:8952 Change-Id: I1fbb5290f0c645842b84c53816c09bb3398206a5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3028721 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com> Cr-Commit-Position: refs/heads/master@{#75841} | 4 年前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
[intl] Optimize NumberFormatv3 Remove internal slot of LocalizedNumberRangeFormatter in NumberFormat and PluralRules and converted from LocalizedNumberFormatter on the calls require it instead. Bug: chromium:1307699, chromium:1307698 Change-Id: I9be1b7dd1c931f273d845359ca4de1273ea837a8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3555261 Reviewed-by: Shu-yu Guo <syg@chromium.org> Commit-Queue: Frank Tang <ftang@chromium.org> Cr-Commit-Position: refs/heads/main@{#81078} | 3 年前 | |
Merged: [contexts] Cleanup NativeContext::IsDetached() and friends In particular: - remove Isolate parameter from JSGlobalProxy::IsDetachedFrom() and IsDetached() methods, - add more efficient implementations of global_proxy() and global_object() accessors to NativeContext compared to generic ones in Context, - make Isolate::DetachGlobal() do nothing if the context is already detached. Bug: 466990858 (cherry picked from commit bdded6d6795a1fcf21ba9bdb31071f74b7436402) Change-Id: I659378a43a472bc49ca60e3b6bf5accebfc08b46 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7241452 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Auto-Submit: Igor Sheludko <ishell@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/branch-heads/14.4@{#12} Cr-Branched-From: 80acc26727d5a34e77dabeebe7c9213ec1bd4768-refs/heads/14.4.258@{#1} Cr-Branched-From: ce7e597e90f6df3fa4b6df224bc613b80c635450-refs/heads/main@{#104020} | 6 个月前 | |
[v8] Fix CVE-491884710 CVE-470566252 CVE-484527367 CVE-483851888 CVE-495679730 CVE-487768771 CVE-496301615 CVE-486927780 TicketNo: DTS2026040900445 Description: [v8] Fix CVE Team:gitcode Feature or Bugfix: Binary Source: sync from gitcode PrivateCode(Yes/No):No Change-Id: I9cc86759f497b795aaa41f2cccab2efc3892eb26 Reviewed-by: j30014474,y00500721 Approved-by: y00500721 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/540 Merged-by: public pjenkins Signed-off-by: gaojunyu <gaojunyu2@h-partners.com> revert merge request: DTS2026012010158 [v8] Fix CVE 64df2ca2a94233d7fa209bb3244843ceb12235ca This revert merge request !452 | 1 个月前 | |
Merged: [contexts] Cleanup NativeContext::IsDetached() and friends In particular: - remove Isolate parameter from JSGlobalProxy::IsDetachedFrom() and IsDetached() methods, - add more efficient implementations of global_proxy() and global_object() accessors to NativeContext compared to generic ones in Context, - make Isolate::DetachGlobal() do nothing if the context is already detached. Bug: 466990858 (cherry picked from commit bdded6d6795a1fcf21ba9bdb31071f74b7436402) Change-Id: I659378a43a472bc49ca60e3b6bf5accebfc08b46 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7241452 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Auto-Submit: Igor Sheludko <ishell@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/branch-heads/14.4@{#12} Cr-Branched-From: 80acc26727d5a34e77dabeebe7c9213ec1bd4768-refs/heads/14.4.258@{#1} Cr-Branched-From: ce7e597e90f6df3fa4b6df224bc613b80c635450-refs/heads/main@{#104020} | 6 个月前 | |
Merged: [api] Fix contextual accesses within detached context ... broken by https://crrev.com/c/7184979. The issue was that - for "contextual" accesses to JSGlobalObject properties V8 needs to provide respective JSGlobalProxy as the "holder" to the accessor/interceptor callbacks, - the "holder" was computed via JSGlobalObject::global_proxy() which in case of detached context might already be backed by another instance of JSGlobalObject. - as a result if an Api callback would try to access the detached global object via such "holder" it'd access wrong JSGlobalObject instance - it'd be the current one instead of original one. The fix is to create a new JSGlobalProxy instance during context detaching, wire it properly with the old JSGlobalObject instance and pass it as a "holder" value to Api callbacks. This other global proxy is stored in a new JSGlobalObject::global_proxy_for_api field. Thus, the detached global object gets new identity which can be observed only in accessor/interceptor callbacks as the "holder" will no longer be equal to any of the v8::Context::Global(). To summarize behavior changes related to Holder()->HolderV2() migration (avoid exposing JSGlobalObject through Api) for accessor/interceptors on the global object, previously we had the following: CHECK_NE(attached_context->Global(), info.Holder()); CHECK_NE(detached_context->Global(), info.Holder()); but now we'll have: CHECK_EQ(attached_context->Global(), info.HolderV2()); CHECK_NE(detached_context->Global(), info.HolderV2()); Additionally, this CL adds Realm.navigateSameOrigin(i) for testing. Bug: 464961493 Bug: 463593768 Bug: 333672197 Fixed: 466990858 (cherry picked from commit 32fd863235d5392b8333fc882e809677596c6848) Change-Id: I60c1c7bf882da5eee12c5090feaac3fca6e03300 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7245590 Commit-Queue: Igor Sheludko <ishell@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Auto-Submit: Igor Sheludko <ishell@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/branch-heads/14.4@{#14} Cr-Branched-From: 80acc26727d5a34e77dabeebe7c9213ec1bd4768-refs/heads/14.4.258@{#1} Cr-Branched-From: ce7e597e90f6df3fa4b6df224bc613b80c635450-refs/heads/main@{#104020} | 6 个月前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[intl] Implement notation and compactDisplay for Intl.PluralRules To sync the implementation for the following 2 PRs https://github.com/tc39/ecma402/pull/989 and https://github.com/tc39/ecma402/pull/1019 PR 989, adding "notation", is already merged into ECMA402 in https://tc39.es/ecma402/#sec-intl.pluralrules https://tc39.es/ecma402/#sec-intl.pluralrules.prototype.select and https://tc39.es/ecma402/#sec-intl.pluralrules.prototype.resolvedoptions PR 1019 passed TC39 in 2025-Sept meeting and should be mereged into ECMA402 soon. Move some shared enum and code from anonymous namespace into Intl inside JSNumberFormat so code inside JSPluralRules can just reuse them. Also removed two function declaration inside Intl which no longer exist. Bug: 452130289 Change-Id: I47a68339802eaf8df31ccf99fd53a59c5c4f5370 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7047379 Commit-Queue: Frank Tang <ftang@chromium.org> Reviewed-by: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#103187} | 8 个月前 | |
[temporal] Implement Ch15 of Temporal https://tc39.es/proposal-temporal/#sec-temporal-intl Use 12 unused bits from the flags to remember which option was present in the optinos during the constructor so we can lazy create the SimpleDateFormat for Temporal during the format time. This avoid memory penalty and performance penalty on the Intl.DateTimeFormat when it is not used with Temporal (such as in (new Date()).toLocaleString(). If we resolve all format during constructor, we may cause performance problem and blow the memory for old (and most common) use cases. Bug: 401065166 Change-Id: I70b9f0d37a1cfbf00d80e382b594a6e7829c6fd3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6770445 Commit-Queue: Frank Tang <ftang@chromium.org> Reviewed-by: Manish Goregaokar <manishearth@google.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101584} | 11 个月前 | |
[intl] Optimize NumberFormatv3 Remove internal slot of LocalizedNumberRangeFormatter in NumberFormat and PluralRules and converted from LocalizedNumberFormatter on the calls require it instead. Bug: chromium:1307699, chromium:1307698 Change-Id: I9be1b7dd1c931f273d845359ca4de1273ea837a8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3555261 Reviewed-by: Shu-yu Guo <syg@chromium.org> Commit-Queue: Frank Tang <ftang@chromium.org> Cr-Commit-Position: refs/heads/main@{#81078} | 3 年前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[handles] Migration to direct handles, part 7 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, builtins, numbers, objects, runtime (primarily) and also: codegen, debug, execution, heap, ic, logging, wasm (secondarily). Bug: 42203211 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Change-Id: I4c2d7057d4f552fd83bb4cb606b777c7001fbcfe Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6048824 Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#97528} | 1 年前 | |
[promises, async stack traces] Increase width of JSPromise::async_task_id ... field from 22 to 27 bits. Bug: 340606663 Change-Id: Ia715a36a585f76f5243aa7473acd92ff8797d1d9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5836951 Auto-Submit: Igor Sheludko <ishell@chromium.org> Commit-Queue: Patrick Thier <pthier@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#95986} | 1 年前 | |
[proxy] Distinguish revocable Proxies Proxies created with the default "new Proxy" constructor are not revocable, and that property is useful for building fast paths for them. So this CL adds a field JSProxy::flags, which is used to annotate Proxies as revocable when applicable. (No actual fast paths are added in this patch.) Bug: 403372470 Change-Id: Ia240eaeadb80369b393a555d9de727ffd727f874 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6593533 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#100561} | 1 年前 | |
[proxy] Distinguish revocable Proxies Proxies created with the default "new Proxy" constructor are not revocable, and that property is useful for building fast paths for them. So this CL adds a field JSProxy::flags, which is used to annotate Proxies as revocable when applicable. (No actual fast paths are added in this patch.) Bug: 403372470 Change-Id: Ia240eaeadb80369b393a555d9de727ffd727f874 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6593533 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#100561} | 1 年前 | |
[proxy] Distinguish revocable Proxies Proxies created with the default "new Proxy" constructor are not revocable, and that property is useful for building fast paths for them. So this CL adds a field JSProxy::flags, which is used to annotate Proxies as revocable when applicable. (No actual fast paths are added in this patch.) Bug: 403372470 Change-Id: Ia240eaeadb80369b393a555d9de727ffd727f874 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6593533 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#100561} | 1 年前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
Revert "[string] Remove String::IsOneByteRepresentationUnderneath" This reverts commit e3f33e99674eab3881d2d65b82dfe436829bb831. Reason for revert: https://crbug.com/398999390 This only reverts the fist part of the CL (Removing IsOneByteRepresentation). Using static roots to determine one-byte representation from the map word alone is kept. Original change's description: > [string] Remove String::IsOneByteRepresentationUnderneath > > All string maps are split into one- and two-byte versions, and enforce > that their underlying string must have the same byte width (e.g. we > can't change byteness when externalizing). This means that the old > IsOneByteRepresentationUnderneath loop is no longer needed, as we > already know the byteness from the top. > > Remove this function, replacing with calls to IsOneByteRepresentation. > Additionally, we have some static roots hacks to determine one-byte > representation from the map word alone (without needing to dereference > the instance type), so use that too where possible. > > Change-Id: I662daa3cb217d04cbfd717da53ae1238a0bcddd0 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6011010 > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Patrick Thier <pthier@chromium.org> > Cr-Commit-Position: refs/heads/main@{#97099} DISABLE_SPELLCHECKER Fixed: 398999390 Change-Id: Iee7e88257cb0d23669bcd7571d57b613a413bc29 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6304799 Commit-Queue: Patrick Thier <pthier@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#98942} | 1 年前 | |
Reland "[handles] Migration to direct handles, part 12" This is a reland of commit 5fa54d85a10049a55ba2fa02bc05145ddee7d19a Original change's description: > [handles] Migration to direct handles, part 12 > > This CL migrates a large number of handles to direct handles. The > changes are only relevant for builds with v8_enable_direct_handle=true. > > Affected source directories: api, asmjs, ast, builtins, codegen, > compiler, d8, debug, deoptimizer, diagnostics, execution, extensions, > heap, ic, init, interpreter, json, maglev, objects, parsing, profiler, > regexp, runtime, snapshot, strings, wasm, and tests. > > Bug: 42203211 > Change-Id: I2334b3295e5780e8f52d0b13d1545dce29fcf81e > Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6181904 > Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> > Reviewed-by: Omer Katz <omerkatz@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Cr-Commit-Position: refs/heads/main@{#98240} Bug: 42203211 Change-Id: Ie21acd681c12e7212185d61a19bd858365650204 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6187462 Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#98249} | 1 年前 | |
[json-parse-with-source] Implement the JSON.parse source text ... access proposal. Bug: v8:12955 Change-Id: I339c4ee1849c67f85d7b975105a53a17d2b2360c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3911270 Commit-Queue: 王澳 <wangao.james@bytedance.com> Reviewed-by: Maya Lekova <mslekova@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/main@{#83586} | 3 年前 | |
[tagged] Introduce TrustedPointerMember This helper class simplifies defining trusted pointer members in HeapObjectLayout subclasses. Bug: 42202654 Change-Id: I505f9f70a0128899d13a464eda15026f5a435cc0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7181920 Reviewed-by: Samuel Groß <saelo@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#103897} | 7 个月前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[torque] generate C++ class definitions per Torque file This CL splits the class definitions per .tq file, to realize the following relationship: A class defined in src/objects/foo.tq has a C++ definition in src/objects/foo.h. Torque then generates: - torque-generated/src/objects/foo-tq.inc An include file (no proper header) to be included in src/objects/foo.h containing the Torque-generated C++ class definition. - torque-generated/src/objects/foo-tq-inl.inc An include file (no proper header) to be included in src/objects/foo-inl.h containing inline function definitions. - torque-generated/src/objects/foo-tq.cc A source file including src/objects/foo-inl.h that contains non-inline function definitions. Advantages of this approach: - Avoid big monolithic headers and preserve the work that went into splitting objects.h - Moving a definition to Torque keeps everything in the same place from a C++ viewpoint, including a fully Torque-generated C++ class definition. - The Torque-generated include files do not need to be independent headers, necessary includes or forward declarations can just be added to the headers that include them. Drive-by changes: A bunch of definitions and files had to be moved or created to realize a consistent 1:1 relationship between .tq files and C++ headers. Bug: v8:7793 TBR: hpayer@chromium.org Change-Id: I239a89a16d0bc856a8669d7c92aeafe24a7c7663 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2470571 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Seth Brenith <seth.brenith@microsoft.com> Cr-Commit-Position: refs/heads/master@{#70853} | 5 年前 | |
[torque] Invert the default for @generateCppClass Since most Torque-defined extern classes use @generateCppClass, it makes more sense to instead annotate the small number that don't. This is part of the cleanup work that Nico recommended in [1]. Classes that still have to opt out: - Those that can be converted by https://crrev.com/c/3015666 - HeapObject: sort of special since it's the root of the inheritance hierarchy. Generated code would include two declarations that don't compile until HeapObject is defined: bool IsHeapObject_NonInline(HeapObject o); explicit TorqueGeneratedHeapObject( Address ptr, HeapObject::AllowInlineSmiStorage allow_smi); - SmallOrdered*: these classes use templates on the C++ side, which is not currently representable in Torque. - SwissNameDictionary: according to a comment, the Torque generation for this class is incorrect. I haven't investigated further. Drive-by fix: make the Torque formatter keep LF on Windows rather than writing CRLF. [1] https://docs.google.com/document/d/1q_gZLnXd4bGnCx3IUfbln46K3bSs9UHBGasy9McQtHI/edit# Bug: v8:8952 Change-Id: I1fbb5290f0c645842b84c53816c09bb3398206a5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3028721 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com> Cr-Commit-Position: refs/heads/master@{#75841} | 4 年前 | |
[objects] Throw if there are too many props for a dict We have a maximum enumeration index on NameDictionary, exceeding this will cause behavioural weirdness (e.g. invalid order due to wraparound). We can make NameDictionary::Add potentially throw instead. Bug: 42204488, 447004361 Change-Id: I8e27b6cec8d58dbfec49503fbcbd4c855d8ed060 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5191135 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102952} | 8 个月前 | |
[regexp] Assemble from BC: Support fallback to linear engine Store if a RegExp can be executed with the linear engine in IrRegExpData bit_field and use this information to support fallback to the linear engine when assembling RegExp code from bytecode. Bug: 437003349 Change-Id: If2fcb6317f36903f00c989fce7450300c73e2fe5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6894612 Reviewed-by: Jakob Linke <jgruber@chromium.org> Commit-Queue: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#102146} | 9 个月前 | |
[regexp] Assemble from BC: Support fallback to linear engine Store if a RegExp can be executed with the linear engine in IrRegExpData bit_field and use this information to support fallback to the linear engine when assembling RegExp code from bytecode. Bug: 437003349 Change-Id: If2fcb6317f36903f00c989fce7450300c73e2fe5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6894612 Reviewed-by: Jakob Linke <jgruber@chromium.org> Commit-Queue: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#102146} | 9 个月前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[intl] Fix intl402/*/prototype/resolvedOptions/resolved-*-unicode-extensions-and-options Bug: 423663304 Change-Id: Ie60ce521a6a9282a7757c2d82933398a6e53ce2a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7202716 Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Commit-Queue: Frank Tang <ftang@chromium.org> Cr-Commit-Position: refs/heads/main@{#103994} | 7 个月前 | |
[temporal] Implement Ch15 of Temporal https://tc39.es/proposal-temporal/#sec-temporal-intl Use 12 unused bits from the flags to remember which option was present in the optinos during the constructor so we can lazy create the SimpleDateFormat for Temporal during the format time. This avoid memory penalty and performance penalty on the Intl.DateTimeFormat when it is not used with Temporal (such as in (new Date()).toLocaleString(). If we resolve all format during constructor, we may cause performance problem and blow the memory for old (and most common) use cases. Bug: 401065166 Change-Id: I70b9f0d37a1cfbf00d80e382b594a6e7829c6fd3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6770445 Commit-Queue: Frank Tang <ftang@chromium.org> Reviewed-by: Manish Goregaokar <manishearth@google.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101584} | 11 个月前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
TicketNo:DTS2026040312077;DTS2026040207037;DTS2026040207036;DTS2026040135724;DTS2026040135722;DTS2026032818442;DTS2026032530470;DTS2026032530464;DTS2026031327981;DTS2026031222703;DTS2026031222694;DTS2026031222686;DTS2026031222671;DTS2026031222662;DTS2026031222654 Description:【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Team:v8 Feature or Bugfix:Bugfix Binary Source:No PrivateCode(Yes/No):No Change-Id: Iae84c8fcc36a25b1936ec0997008368f70096cd6 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/534 Merged-by: public pjenkins Signed-off-by: Marja Hölttä <marja@chromium.org> | 1 个月前 | |
TicketNo:DTS2026040312077;DTS2026040207037;DTS2026040207036;DTS2026040135724;DTS2026040135722;DTS2026032818442;DTS2026032530470;DTS2026032530464;DTS2026031327981;DTS2026031222703;DTS2026031222694;DTS2026031222686;DTS2026031222671;DTS2026031222662;DTS2026031222654 Description:【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Team:v8 Feature or Bugfix:Bugfix Binary Source:No PrivateCode(Yes/No):No Change-Id: Iae84c8fcc36a25b1936ec0997008368f70096cd6 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/534 Merged-by: public pjenkins Signed-off-by: Marja Hölttä <marja@chromium.org> | 1 个月前 | |
TicketNo:DTS2026040312077;DTS2026040207037;DTS2026040207036;DTS2026040135724;DTS2026040135722;DTS2026032818442;DTS2026032530470;DTS2026032530464;DTS2026031327981;DTS2026031222703;DTS2026031222694;DTS2026031222686;DTS2026031222671;DTS2026031222662;DTS2026031222654 Description:【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Team:v8 Feature or Bugfix:Bugfix Binary Source:No PrivateCode(Yes/No):No Change-Id: Iae84c8fcc36a25b1936ec0997008368f70096cd6 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/534 Merged-by: public pjenkins Signed-off-by: Marja Hölttä <marja@chromium.org> | 1 个月前 | |
TicketNo:DTS2026040312077;DTS2026040207037;DTS2026040207036;DTS2026040135724;DTS2026040135722;DTS2026032818442;DTS2026032530470;DTS2026032530464;DTS2026031327981;DTS2026031222703;DTS2026031222694;DTS2026031222686;DTS2026031222671;DTS2026031222662;DTS2026031222654 Description:【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Team:v8 Feature or Bugfix:Bugfix Binary Source:No PrivateCode(Yes/No):No Change-Id: Iae84c8fcc36a25b1936ec0997008368f70096cd6 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/534 Merged-by: public pjenkins Signed-off-by: Marja Hölttä <marja@chromium.org> | 1 个月前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[temporal] Implement Ch15 of Temporal https://tc39.es/proposal-temporal/#sec-temporal-intl Use 12 unused bits from the flags to remember which option was present in the optinos during the constructor so we can lazy create the SimpleDateFormat for Temporal during the format time. This avoid memory penalty and performance penalty on the Intl.DateTimeFormat when it is not used with Temporal (such as in (new Date()).toLocaleString(). If we resolve all format during constructor, we may cause performance problem and blow the memory for old (and most common) use cases. Bug: 401065166 Change-Id: I70b9f0d37a1cfbf00d80e382b594a6e7829c6fd3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6770445 Commit-Queue: Frank Tang <ftang@chromium.org> Reviewed-by: Manish Goregaokar <manishearth@google.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101584} | 11 个月前 | |
[temporal] Implement Ch15 of Temporal https://tc39.es/proposal-temporal/#sec-temporal-intl Use 12 unused bits from the flags to remember which option was present in the optinos during the constructor so we can lazy create the SimpleDateFormat for Temporal during the format time. This avoid memory penalty and performance penalty on the Intl.DateTimeFormat when it is not used with Temporal (such as in (new Date()).toLocaleString(). If we resolve all format during constructor, we may cause performance problem and blow the memory for old (and most common) use cases. Bug: 401065166 Change-Id: I70b9f0d37a1cfbf00d80e382b594a6e7829c6fd3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6770445 Commit-Queue: Frank Tang <ftang@chromium.org> Reviewed-by: Manish Goregaokar <manishearth@google.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101584} | 11 个月前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
TicketNo:DTS2026040312077;DTS2026040207037;DTS2026040207036;DTS2026040135724;DTS2026040135722;DTS2026032818442;DTS2026032530470;DTS2026032530464;DTS2026031327981;DTS2026031222703;DTS2026031222694;DTS2026031222686;DTS2026031222671;DTS2026031222662;DTS2026031222654 Description:【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Team:v8 Feature or Bugfix:Bugfix Binary Source:No PrivateCode(Yes/No):No Change-Id: Iae84c8fcc36a25b1936ec0997008368f70096cd6 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/534 Merged-by: public pjenkins Signed-off-by: Marja Hölttä <marja@chromium.org> | 1 个月前 | |
TicketNo:DTS2026040312077;DTS2026040207037;DTS2026040207036;DTS2026040135724;DTS2026040135722;DTS2026032818442;DTS2026032530470;DTS2026032530464;DTS2026031327981;DTS2026031222703;DTS2026031222694;DTS2026031222686;DTS2026031222671;DTS2026031222662;DTS2026031222654 Description:【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Team:v8 Feature or Bugfix:Bugfix Binary Source:No PrivateCode(Yes/No):No Change-Id: Iae84c8fcc36a25b1936ec0997008368f70096cd6 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/534 Merged-by: public pjenkins Signed-off-by: Marja Hölttä <marja@chromium.org> | 1 个月前 | |
TicketNo:DTS2026040312077;DTS2026040207037;DTS2026040207036;DTS2026040135724;DTS2026040135722;DTS2026032818442;DTS2026032530470;DTS2026032530464;DTS2026031327981;DTS2026031222703;DTS2026031222694;DTS2026031222686;DTS2026031222671;DTS2026031222662;DTS2026031222654 Description:【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Team:v8 Feature or Bugfix:Bugfix Binary Source:No PrivateCode(Yes/No):No Change-Id: Iae84c8fcc36a25b1936ec0997008368f70096cd6 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/534 Merged-by: public pjenkins Signed-off-by: Marja Hölttä <marja@chromium.org> | 1 个月前 | |
TicketNo:DTS2026040312077;DTS2026040207037;DTS2026040207036;DTS2026040135724;DTS2026040135722;DTS2026032818442;DTS2026032530470;DTS2026032530464;DTS2026031327981;DTS2026031222703;DTS2026031222694;DTS2026031222686;DTS2026031222671;DTS2026031222662;DTS2026031222654 Description:【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Team:v8 Feature or Bugfix:Bugfix Binary Source:No PrivateCode(Yes/No):No Change-Id: Iae84c8fcc36a25b1936ec0997008368f70096cd6 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/534 Merged-by: public pjenkins Signed-off-by: Marja Hölttä <marja@chromium.org> | 1 个月前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[ShadowRealm] Make filenames consistent Make the file names consistent on "shadow-realm" (i.e. singular, with a dash). Bug: v8:11989 Change-Id: Id0a6f417fd9b53b9f7ddf9677da7396fa2481af6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3606392 Reviewed-by: Adam Klein <adamk@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#80164} | 4 年前 | |
Update V8 DEPS. Also manually reformat some files with the clang-format change. Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/e10cf1a..c8ec41b Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/c2e4795..113378f Rolling v8/buildtools/linux64: git_revision:7c8e511229f0fc06f6250367d51156bb6f578258..git_revision:48b013c9d9debc0f5fc1dd71a257b3c38c5acb43 Rolling v8/buildtools/third_party/libc++abi/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi/+log/518fd76..c7888dd Rolling v8/buildtools/third_party/libunwind/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/705543f..d8a4746 Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/88422dc..9ba02ee Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/dc8ca44..fccf35c Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/32e65ef..961141d Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/3c4a622..75625c6 Rolling v8/tools/luci-go: git_revision:6da0608e4fa8a3c6d1fa4f855485c0038b05bf72..git_revision:2aa3d7e5e8662c5193059a490f07b7d91331933e Rolling v8/tools/luci-go: git_revision:6da0608e4fa8a3c6d1fa4f855485c0038b05bf72..git_revision:2aa3d7e5e8662c5193059a490f07b7d91331933e R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com Change-Id: I00a09d42cf91f226c661e97915d5a95fff84b079 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3615245 Reviewed-by: Michael Achenbach <machenbach@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Owners-Override: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#80343} | 4 年前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[casting] Remove Foo::cast Replace Foo::cast with Cast<Foo>. This is, blessedly, the same number of characters, and allows us to remove the need to declare cast functions in every type (instead using instance-type based type checks for most things, and a few template specializations of CastTraits for the remainder). Bug: 345640551 Change-Id: Ic215e2d4519f3128457db8a828a73c18204714bd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5614630 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#94425} | 2 年前 | |
[shared-struct] Fix shared barrier for always shared objects Currently the shared value barrier manually fast paths instance types for objects that are always in the shared heap. This CL makes a common superclass, AlwaysSharedSpaceJSObject, and uses that for the fast path. Bug: chromium:1402920, v8:12547 Fixed: chromium:1402920 Change-Id: I84421802791a4dc72925341eeb0cfc5949b8938a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4134475 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/main@{#85192} | 3 年前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[objects] Introduce HashTable::TryNew() returning MaybeHandle ... and make HashTable::New() return Handle again. The former is supposed to be used for the cases where we can handle exceeding maximum capacity (it returns empty handle without throwing an exception) while the latter is for the cases where we can't or don't expect too big capacity values (it reports fatal OOM as before). This CL - partially reverts https://crrev.com/c/6843055 because crashing inside ToHandleChecked() upon exceeding maximum table capacity is not convenient compared to reporting a fatal OOM, - lays ground for gradual migration of OOM "invalid table size" crashes to throwing RangeError exception. Bug: 41433527 Bug: 437245082 Fixed: 438523768 Change-Id: I76e1d75af9e62392e2c6a8f3c8d6881f15fa0b33 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6850486 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#101916} | 10 个月前 | |
[handles] Migration to direct handles, part 13 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, ast, builtins, codegen, compiler, debug, deoptimizer, execution, heap, ic, init, interpreter, json, maglev, objects, parsing, regexp, runtime, snapshot, strings, temporal, wasm, and in tests. Bug: 42203211 Change-Id: Icb4238ee9082865dae47dce025e529a1c3fdfc48 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6189992 Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Omer Katz <omerkatz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#98283} | 1 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[temporal] Update DurationFormat-Temporal integration Bug: 401065166,428965344 Change-Id: I6a6a6964460396ea1808b5adb02f8f37f0ccd0d5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6761514 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Manish Goregaokar <manishearth@google.com> Cr-Commit-Position: refs/heads/main@{#101568} | 11 个月前 | |
[temporal] Update DurationFormat-Temporal integration Bug: 401065166,428965344 Change-Id: I6a6a6964460396ea1808b5adb02f8f37f0ccd0d5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6761514 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Manish Goregaokar <manishearth@google.com> Cr-Commit-Position: refs/heads/main@{#101568} | 11 个月前 | |
[temporal] Fill in Intl unimplementeds Left over unimplementeds in js-date-time-format.cc. Can be filled in now that we have most of Temporal implemented. Bug: 401065166 Change-Id: I6a6a6964692d34d735eac4b2cf3084f782058a7e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6681168 Commit-Queue: Manish Goregaokar <manishearth@google.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101081} | 1 年前 | |
[temporal] Use ToIntegerWithTruncation for time fields This was a typo. https://tc39.es/proposal-temporal/#table-temporal-calendar-fields-record-fields Bug: 401065166 Change-Id: I7db78a1c24cad3e6caa267cb5e1d06986a6a6964 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7126880 Commit-Queue: Manish Goregaokar <manishearth@google.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103579} | 7 个月前 | |
[temporal] Switch hoursInDay over to using a double Turns out that hoursInDay can have values like 23.5 Upstream change: https://github.com/boa-dev/temporal/pull/515 Bug: 401065166 Change-Id: I6a6a6964aaeb97924b2fa4ac28c84d8e28d30461 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6882335 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Manish Goregaokar <manishearth@google.com> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102032} | 10 个月前 | |
[temporal] Add native slots for ZonedDateTime This is like https://chromium-review.googlesource.com/c/v8/v8/+/6604681, except for ZonedDateTime (we didn't have the temporal_capi bindings for ZDT when that CL was made). This lets us remove a lot of the legacy torque-based code. I've tried to add stubs for some of the newer ZDT APIs but there's still more left. I'll do that in a separate CL. Bug: 401065166 Change-Id: I6a6a6964f369902008dd3a924dc688042cdc6444 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6634233 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Manish Goregaokar <manishearth@google.com> Cr-Commit-Position: refs/heads/main@{#100852} | 1 年前 | |
[temporal] zoneinfo64 support for Temporal Until now, we have been using temporal_rs' built in timezone data (via the jiff-tzdb crate). However, v8 already contains timezone data in the form of ICU4C's zoneinfo64.res file; we should not duplicate it. In enable-i18n mode, this loads the file using the ICU4C API for it (which, in most cases, returns a pointer to static memory). In non-i18n mode, I wrote a build script that generates a cpp file containing binary data. This needs temporal_rs >= 0.0.15, which is being worked on separately. Bug: 401065166 Change-Id: I6a6a696482b3969545899be5a50c0825ca4d4234 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6933690 Reviewed-by: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Manish Goregaokar <manishearth@google.com> Cr-Commit-Position: refs/heads/main@{#102427} | 9 个月前 | |
[temporal] zoneinfo64 support for Temporal Until now, we have been using temporal_rs' built in timezone data (via the jiff-tzdb crate). However, v8 already contains timezone data in the form of ICU4C's zoneinfo64.res file; we should not duplicate it. In enable-i18n mode, this loads the file using the ICU4C API for it (which, in most cases, returns a pointer to static memory). In non-i18n mode, I wrote a build script that generates a cpp file containing binary data. This needs temporal_rs >= 0.0.15, which is being worked on separately. Bug: 401065166 Change-Id: I6a6a696482b3969545899be5a50c0825ca4d4234 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6933690 Reviewed-by: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Manish Goregaokar <manishearth@google.com> Cr-Commit-Position: refs/heads/main@{#102427} | 9 个月前 | |
[heap] Use regular casts in weak object processing This CL undoes a bunch of previous CL that replaced casts and type checks with GC safe alternatives. These are no longer needed since weakness in Scavenger is disabled when using pinning. Bug: 340777103 Change-Id: Ia624ccc02d509908c4efd604f2fc01b075a911e2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7046057 Commit-Queue: Omer Katz <omerkatz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103155} | 8 个月前 | |
[heap] Explicitly skip write barriers during WeakCell processing This CL explicitly skips implicit write barriers during WeakCell processing in minor and major GCs, and relies on explicit barriers by the GC where/when needed. The CL also introduces SKIP_WRITE_BARRIER_FOR_GC that allows to disable write barriers during the GC atomic pause even if they would otherwise be needed. Bug: 340777103 Change-Id: Ie821744a66ed717b938f7cc56545505eb7928f12 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6990433 Auto-Submit: Omer Katz <omerkatz@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#102992} | 8 个月前 | |
heap_dump_1 for jsvm TicketNo: AR20260205251565 Description: heap_dump_1 for jsvm Team:gitee Feature or Bugfix: Binary Source: sync from gitee PrivateCode(Yes/No):No Change-Id: I2c4bf8190cab99d9278a68c3c7f94092f0507054 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/558 Merged-by: public pjenkins Signed-off-by: huanghan18 <huanghan18@huawei.com> revert merge request: AR20260205251565 heap_dump_1 for jsvm 5fae5665635fc7a1b52e325454044501fafec68e This revert merge request !453 | 1 个月前 | |
Revert "Reland "Bypass Torque for JSWeakRef"" This reverts commit e09236a1e130f02c8442c94806c11d15ea565c0f. Reason for revert: Not needed Bug: 42202654, 340777103 Original change's description: > Reland "Bypass Torque for JSWeakRef" > > This is a reland of commit ae35ee696de5494c8d6c4cf0aecf1003bf6d9f02 > > Original change's description: > > Bypass Torque for JSWeakRef > > > > Hardcode the JSWeakRef torque-like definitions in C++ to make adding a > > dedicated write barrier simpler. > > > > Bug: 42202654, 340777103 > > Change-Id: If5fc84890ed5cdff0711ed832ddbba601d944b97 > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6830452 > > Commit-Queue: Omer Katz <omerkatz@chromium.org> > > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#101836} > > Bug: 42202654, 340777103 > Change-Id: I4f5799bd83e207e5f3bca98a2bc83c339dfe92b1 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6836430 > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Commit-Queue: Omer Katz <omerkatz@chromium.org> > Cr-Commit-Position: refs/heads/main@{#101848} Bug: 42202654, 340777103 Change-Id: If57f7b72801d4d61cc4e0f1a4bc1533e4fe0c92e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6919647 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102319} | 9 个月前 | |
Revert "[api] Prepare for passing flags to Api callbacks in isolate slot" This reverts commit 41fc89c1675988305b257d68cc4ec9fa7e6df148. Reason for revert: causes perf regression https://crbug.com/462926099 Original change's description: > [api] Prepare for passing flags to Api callbacks in isolate slot > > This is a preliminary step towards removing kShouldThrowOnErrorIndex > slot from v8::PropertyCallbackInfo<T> and kNewTargetIndex slot from > v8::FunctionCallbackInfo<T> for non-constructor calls. > > Bug: 326505377, 455600234 > Change-Id: Icbe384815583844e73ac630372bc38c8dc220ada > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7185161 > Commit-Queue: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103887} Fixed: 462926099 Bug: 326505377, 455600234 Change-Id: Iae68f106e3a96d3adec8ad4aee9ab4c72e0b90a8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7203996 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#103997} | 7 个月前 | |
[runtime][ic][api] Pass proper holder to Api callbacks This is a follow-up to v8::PropertyCallbackInfo<T>::Holder() removal, this CL makes sure that the holder passed is never a hidden prototype and removes special handling of this case from implementation of v8::PropertyCallbackInfo<T>::HolderV2(). Drive-by: - in KeyAccumulator::FilterForEnumerableProperties() reuse the existing PropertyCallbackArguments object since it's the same for all callback calls, - fix crashes when calling %DebugPrint() with weak pointers, - fix LoadHandler::LoadInterceptorHolderIsLookupStartupObject() to make it load the holder from data handler when holder is a global object. Bug: 333672197 Change-Id: Ie83b126f52bd491eec7e217eb12f4a7507c11bc4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7184979 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#103883} | 7 个月前 | |
[objects] Port RegExpBoilerplateDescription to StructLayout Bug: 42202654 Change-Id: I1ff92ad9f1574eaf821873fd38d9229518435728 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7181921 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103899} | 7 个月前 | |
[objects] Introduce HashTable::TryNew() returning MaybeHandle ... and make HashTable::New() return Handle again. The former is supposed to be used for the cases where we can handle exceeding maximum capacity (it returns empty handle without throwing an exception) while the latter is for the cases where we can't or don't expect too big capacity values (it reports fatal OOM as before). This CL - partially reverts https://crrev.com/c/6843055 because crashing inside ToHandleChecked() upon exceeding maximum table capacity is not convenient compared to reporting a fatal OOM, - lays ground for gradual migration of OOM "invalid table size" crashes to throwing RangeError exception. Bug: 41433527 Bug: 437245082 Fixed: 438523768 Change-Id: I76e1d75af9e62392e2c6a8f3c8d6881f15fa0b33 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6850486 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#101916} | 10 个月前 | |
heap_dump_1 for jsvm TicketNo: AR20260205251565 Description: heap_dump_1 for jsvm Team:gitee Feature or Bugfix: Binary Source: sync from gitee PrivateCode(Yes/No):No Change-Id: I2c4bf8190cab99d9278a68c3c7f94092f0507054 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/558 Merged-by: public pjenkins Signed-off-by: huanghan18 <huanghan18@huawei.com> revert merge request: AR20260205251565 heap_dump_1 for jsvm 5fae5665635fc7a1b52e325454044501fafec68e This revert merge request !453 | 1 个月前 | |
[objects] Port RegExpBoilerplateDescription to StructLayout Bug: 42202654 Change-Id: I1ff92ad9f1574eaf821873fd38d9229518435728 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7181921 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103899} | 7 个月前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
Move relevant files to src/objects Code that is being moved primarily deal with layout of a JSObject, accessing properties and elements, and map transitions. NOTREECHECKS=true NOTRY=true Bug: v8:9247 Change-Id: Ibce5d5926ac4021c8d40c4dd109948775ce1da58 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1613994 Commit-Queue: Yang Guo <yangguo@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Clemens Hammacher <clemensh@chromium.org> Cr-Commit-Position: refs/heads/master@{#61638} | 7 年前 | |
[tagged-ptr] Move Name/String/Symbol to C++ layout Make Name/String/Symbol subclasses of HeapObjectLayout. This introduces: * Explicit pragmas forcing 4-byte packing of V8_OBJECT classes -- this was required for Name under no-pointer-compression builds, which has a tagged map ptr + int32 field and so would be padded at the end, for alignment of the map ptr. * A member type for external pointers * A differentiation in torque between CC and CCDebug macro lists, to avoid emitting C++ code for slice macros * An UncachedExternalString base class for ExternalString which doesn't have the resource data pointer * The use of flexible array members to represent variable length suffixes of classes (in particular, SeqString characters) * Helper macros for inner classes of object classes, which suppress the padding warnings Also, as a drive-by, accessors were changed to not use the cage_base, since this is available now as a global/thread local, and cleaned up various callers of these accessors to also not take a cage base or isolate if not neccessary. Bug: v8:12710 Change-Id: I15b6393d94e24f5a4fb5d7b363e88974ac1c33b4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5077926 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#91598} | 2 年前 | |
Merged: [api] Fix contextual accesses within detached context ... broken by https://crrev.com/c/7184979. The issue was that - for "contextual" accesses to JSGlobalObject properties V8 needs to provide respective JSGlobalProxy as the "holder" to the accessor/interceptor callbacks, - the "holder" was computed via JSGlobalObject::global_proxy() which in case of detached context might already be backed by another instance of JSGlobalObject. - as a result if an Api callback would try to access the detached global object via such "holder" it'd access wrong JSGlobalObject instance - it'd be the current one instead of original one. The fix is to create a new JSGlobalProxy instance during context detaching, wire it properly with the old JSGlobalObject instance and pass it as a "holder" value to Api callbacks. This other global proxy is stored in a new JSGlobalObject::global_proxy_for_api field. Thus, the detached global object gets new identity which can be observed only in accessor/interceptor callbacks as the "holder" will no longer be equal to any of the v8::Context::Global(). To summarize behavior changes related to Holder()->HolderV2() migration (avoid exposing JSGlobalObject through Api) for accessor/interceptors on the global object, previously we had the following: CHECK_NE(attached_context->Global(), info.Holder()); CHECK_NE(detached_context->Global(), info.Holder()); but now we'll have: CHECK_EQ(attached_context->Global(), info.HolderV2()); CHECK_NE(detached_context->Global(), info.HolderV2()); Additionally, this CL adds Realm.navigateSameOrigin(i) for testing. Bug: 464961493 Bug: 463593768 Bug: 333672197 Fixed: 466990858 (cherry picked from commit 32fd863235d5392b8333fc882e809677596c6848) Change-Id: I60c1c7bf882da5eee12c5090feaac3fca6e03300 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7245590 Commit-Queue: Igor Sheludko <ishell@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Auto-Submit: Igor Sheludko <ishell@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/branch-heads/14.4@{#14} Cr-Branched-From: 80acc26727d5a34e77dabeebe7c9213ec1bd4768-refs/heads/14.4.258@{#1} Cr-Branched-From: ce7e597e90f6df3fa4b6df224bc613b80c635450-refs/heads/main@{#104020} | 6 个月前 | |
Merged: [api] Fix contextual accesses within detached context ... broken by https://crrev.com/c/7184979. The issue was that - for "contextual" accesses to JSGlobalObject properties V8 needs to provide respective JSGlobalProxy as the "holder" to the accessor/interceptor callbacks, - the "holder" was computed via JSGlobalObject::global_proxy() which in case of detached context might already be backed by another instance of JSGlobalObject. - as a result if an Api callback would try to access the detached global object via such "holder" it'd access wrong JSGlobalObject instance - it'd be the current one instead of original one. The fix is to create a new JSGlobalProxy instance during context detaching, wire it properly with the old JSGlobalObject instance and pass it as a "holder" value to Api callbacks. This other global proxy is stored in a new JSGlobalObject::global_proxy_for_api field. Thus, the detached global object gets new identity which can be observed only in accessor/interceptor callbacks as the "holder" will no longer be equal to any of the v8::Context::Global(). To summarize behavior changes related to Holder()->HolderV2() migration (avoid exposing JSGlobalObject through Api) for accessor/interceptors on the global object, previously we had the following: CHECK_NE(attached_context->Global(), info.Holder()); CHECK_NE(detached_context->Global(), info.Holder()); but now we'll have: CHECK_EQ(attached_context->Global(), info.HolderV2()); CHECK_NE(detached_context->Global(), info.HolderV2()); Additionally, this CL adds Realm.navigateSameOrigin(i) for testing. Bug: 464961493 Bug: 463593768 Bug: 333672197 Fixed: 466990858 (cherry picked from commit 32fd863235d5392b8333fc882e809677596c6848) Change-Id: I60c1c7bf882da5eee12c5090feaac3fca6e03300 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7245590 Commit-Queue: Igor Sheludko <ishell@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Auto-Submit: Igor Sheludko <ishell@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/branch-heads/14.4@{#14} Cr-Branched-From: 80acc26727d5a34e77dabeebe7c9213ec1bd4768-refs/heads/14.4.258@{#1} Cr-Branched-From: ce7e597e90f6df3fa4b6df224bc613b80c635450-refs/heads/main@{#104020} | 6 个月前 | |
Merged: [api] Fix contextual accesses within detached context ... broken by https://crrev.com/c/7184979. The issue was that - for "contextual" accesses to JSGlobalObject properties V8 needs to provide respective JSGlobalProxy as the "holder" to the accessor/interceptor callbacks, - the "holder" was computed via JSGlobalObject::global_proxy() which in case of detached context might already be backed by another instance of JSGlobalObject. - as a result if an Api callback would try to access the detached global object via such "holder" it'd access wrong JSGlobalObject instance - it'd be the current one instead of original one. The fix is to create a new JSGlobalProxy instance during context detaching, wire it properly with the old JSGlobalObject instance and pass it as a "holder" value to Api callbacks. This other global proxy is stored in a new JSGlobalObject::global_proxy_for_api field. Thus, the detached global object gets new identity which can be observed only in accessor/interceptor callbacks as the "holder" will no longer be equal to any of the v8::Context::Global(). To summarize behavior changes related to Holder()->HolderV2() migration (avoid exposing JSGlobalObject through Api) for accessor/interceptors on the global object, previously we had the following: CHECK_NE(attached_context->Global(), info.Holder()); CHECK_NE(detached_context->Global(), info.Holder()); but now we'll have: CHECK_EQ(attached_context->Global(), info.HolderV2()); CHECK_NE(detached_context->Global(), info.HolderV2()); Additionally, this CL adds Realm.navigateSameOrigin(i) for testing. Bug: 464961493 Bug: 463593768 Bug: 333672197 Fixed: 466990858 (cherry picked from commit 32fd863235d5392b8333fc882e809677596c6848) Change-Id: I60c1c7bf882da5eee12c5090feaac3fca6e03300 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7245590 Commit-Queue: Igor Sheludko <ishell@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Auto-Submit: Igor Sheludko <ishell@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/branch-heads/14.4@{#14} Cr-Branched-From: 80acc26727d5a34e77dabeebe7c9213ec1bd4768-refs/heads/14.4.258@{#1} Cr-Branched-From: ce7e597e90f6df3fa4b6df224bc613b80c635450-refs/heads/main@{#104020} | 6 个月前 | |
[sandbox] Disallow implicit unchecked downcasts to trusted objects To soundify C++ types of trusted objects we want to prevent accidentally casting to a trusted object without checking. To that end we enforce the explicit choice of one of three possible casts. * The (existing) TryCast should be used when we already have a type check. This construct ensures that the cast is correct by construction, since the target variable is not assigned if it fails. * The (new) (Checked|Sbx)Cast combines a (SBX)CHECK with a Cast. Replaces SBXCHECK(Is<Foo>(x)); Tagged<Foo> f = Cast<Foo>(x). * The (new) TrustedCast corresponds to Cast on non-trusted objects. The "Trusted" prefix signifies that the correctness obligations are solely on the caller. It should not be used at all if possible. Typically reasonable usecases are: * Reading a field of a trusted object. We trust them to be untampered. * Reading a trusted pointer with a type-tagged handle. The handle ensures correctness. * A visitor where the down-cast is generated by a macro. There is little possiblity for future error and TryCast would be cumbersome and potentially slower. * Low-risk code like debugging, or highly-performance sensitive code where the check is enforced indirectly. DriveBy: Add CastExposedTrustedObjectByTag which ties together the type of a ExposedTrustedObject with its IndirectPointerTag. This prevents the two from getting out of sync. Bug: 435645639 Change-Id: Id283b109ab3e0c3a4503467771bc35f1857fa236 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6859421 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Olivier Flückiger <olivf@chromium.org> Auto-Submit: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#101943} | 10 个月前 | |
[gc] Expose ExternalMemoryAccounter publicly To replace AdjustAmountOfExternalAllocatedMemory. Bug: 42203776 Change-Id: Ib7bde62ce953832c5631a57a39000e849b9a6b89 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6015340 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org> Cr-Commit-Position: refs/heads/main@{#97427} | 1 年前 | |
TicketNo:DTS2026040312077;DTS2026040207037;DTS2026040207036;DTS2026040135724;DTS2026040135722;DTS2026032818442;DTS2026032530470;DTS2026032530464;DTS2026031327981;DTS2026031222703;DTS2026031222694;DTS2026031222686;DTS2026031222671;DTS2026031222662;DTS2026031222654 Description:【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Team:v8 Feature or Bugfix:Bugfix Binary Source:No PrivateCode(Yes/No):No Change-Id: Iae84c8fcc36a25b1936ec0997008368f70096cd6 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/534 Merged-by: public pjenkins Signed-off-by: Marja Hölttä <marja@chromium.org> | 1 个月前 | |
[wasm-custom-desc] Don't call .instance_descriptors() for Wasm maps Wasm maps with Custom Descriptors use the "instance descriptors" slot for storing their descriptor object, but its type is WasmStruct, not DescriptorArray, so we must be careful not to mix them up. This patch fixes the specific issue that the fuzzer found, and adds a DCHECK that flushed out another instance of the pattern in heap verification, and includes the results of a manual audit that found two more instances in object printing and heap snapshotting. Bug: 403372470 Change-Id: Ia50d2b941895f677058df77125cc0cc28d1f362a Fixed: 457106696 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7131198 Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#103645} | 7 个月前 | |
[map] Fix bad enum cache DCHECK Fix the documentation DCHECK that enum caches stay owned by the old map for the case when the enum cache is fully trimmed by GC. Fixed: 439479318 Change-Id: I6c228245f099c827f3b1b95a8c406751a5206ca8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6874883 Auto-Submit: Igor Sheludko <ishell@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101991} | 10 个月前 | |
[handles] Migration to direct handles, part 16 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, asmjs, baseline, builtins, codegen, compiler, debug, deoptimizer, execution, heap, ic, init, objects, regexp, runtime, snapshot, wasm, and tests. Bug: 42203211 Change-Id: I3adbfb4aa55ebabec86ef94e312d92c8514446a0 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6240033 Reviewed-by: Omer Katz <omerkatz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Cr-Commit-Position: refs/heads/main@{#98600} | 1 年前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
[wasm-custom-desc] Store immediate supertype on Map This patch overlays the Map::dependent_code slot, which is unused for Wasm objects, to store the immediate supertype RTT on maps for types with custom descriptors. That makes the supertype faster to access, which speeds up type checks. Bug: 403372470 Change-Id: I32a0d9c01140aa1571576be3e6030d8b23e121bf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7045131 Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Daniel Lehmann <dlehmann@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#103242} | 8 个月前 | |
[runtime] Introduce kClearedWeakValue and cleanup ClearedValue() It used to be important that the upper part of a non-Smi value is equal to respective cage base but since https://crrev.com/c/6402513 it's not the case anymore. This CL relaxes the DCHECK in CompressObject() to allow baseless cleared weak values. Although we can simply use kClearedWeakValue instead of ClearedValue() or ClearedTrustedValue() for manual clearing of certain weak fields, having these functions might still be useful to ensure that we don't accidentally mix up cleared weak references belonging to different cages. Bug: 424154602 Change-Id: I03a351c2c1615455c076cf73d38e592b75bdcd54 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6673894 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#101053} | 1 年前 | |
[runtime] Introduce kClearedWeakValue and cleanup ClearedValue() It used to be important that the upper part of a non-Smi value is equal to respective cage base but since https://crrev.com/c/6402513 it's not the case anymore. This CL relaxes the DCHECK in CompressObject() to allow baseless cleared weak values. Although we can simply use kClearedWeakValue instead of ClearedValue() or ClearedTrustedValue() for manual clearing of certain weak fields, having these functions might still be useful to ensure that we don't accidentally mix up cleared weak references belonging to different cages. Bug: 424154602 Change-Id: I03a351c2c1615455c076cf73d38e592b75bdcd54 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6673894 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#101053} | 1 年前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[map] Add Union types for Map fields Add appropriate Union types for Map fields, namely * prototype * prototype_validity_cell * prototype_info/raw_transitions This includes going down several rat holes: * Allowing various object macros to take either variadic or parenthesised types, since the text processing of macros splits the commas inside template angle brackets. - This also means amending gen-postmortem-metadata field type parsing to support this parens-aware comma splitting. * Some of these fields allow weak pointers, so we'd need WEAK_ACCESSORS etc. macros that support tighter typing than MaybeObject. In fact, the write barriers don't care if a field is weak or not, so we can get rid of the WEAK_ object field macros entirely and make all accessors use Maybe slots. - WriteBarrier::ForValue can be templated on the value type to make its GetHeapObject method appropriately efficient. * Cast/UncheckedCast/Is should work well for Union types, and across Tagged/Handle/MaybeHandle/DirectHandle/MaybeDirectHandle. We can change the Handle etc. customisation point to specialize Is and UncheckedCast, and make Cast implementations more uniform across the above wrapper types. - This also lets us introduce a uniform TryCast, which takes an output handle and returns a bool. This makes various checked conversions more obviously safe. * Making Map::prototype a JSPrototype (Union<JSReceiver, Null>) percolates through the runtime, including making JSFunction instance prototypes also be JSPrototype, as well as the PrototypeIterator. - This also found one case of slightly sketchy prototype setting in WebAssembly.Function.bind, which sets the bound function's prototype to a prototype read from the Function function. If there had been a way to set Function.prototype to a non-instance prototype, this would have written a primitive into a Map prototype field. Now it's changed to using function_prototype directly, which makes the type system happy and statically guarantees that this kind of confusion can't happen. Bug: 42202654 Change-Id: Iada231c7686371244836cb665fca8feaecfea5f6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5953134 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#96838} | 1 年前 | |
[torque] Get rid of @generatePrint annotation I'm trying to remove annotations and make behavior more consistent. For @generatePrint, there are two options: either generate printers for every extern class, or never generate printers for extern classes. This change implements the option of always generating printers. Classes that require custom printing can easily hide the generated printer by using DECL_PRINTER. This causes the generated file gen/torque-generated/objects-printer.cc to grow to 1600 lines, including many functions that are never used, but I think the consistency benefit outweighs a little more compilation time on one file. This change also removes custom printers in cases where the generated printer includes all of the same content. If folks would prefer the option to never generate printers, I'm open to doing that instead. I like the notion that generating more code could reduce the friction of adding new classes and thereby encourage people to define precise types rather than using FixedArrays, but the current implementation of generated printers is limited, and many printers have been customized to show the data that matters the most. Unlike verifiers and body descriptors, there are no correctness or safety concerns with hand-written printers. Some bugs showed up once we start generating printers for everything, and this change fixes them: - Printers incorrectly included ungettable fields like padding - Printers called getters which might be hidden by hand-written classes - The generated getter for Map::instance_type used ReadField<InstanceType>, which is not an arithmetic type since it's an enum One more tiny drive-by fix: added a missing newline in the printers for JSMap and JSSet. Bug: v8:7793 Change-Id: Ib9e9575fbcb57879935ff18bf4db49fe276d2966 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3172190 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com> Cr-Commit-Position: refs/heads/main@{#77152} | 4 年前 | |
[objects] Port Microtask and Promise classes to StructLayout This CL ports Microtask, PromiseReaction, PromiseCapability, and their subclasses to use the new StructLayout definition. This involves: - Changing Torque definition annotations to @cppObjectLayoutDefinition. - Updating C++ headers to inherit from StructLayout and defining fields using TaggedMember. - Implementing inline accessors using TaggedMember methods. - Updating body descriptors and printers/verifiers. - Updating call sites (mostly in builtins and code stub assembler) to use offsetof() or public accessors. - Refactoring verification logic to use a common MicrotaskVerify method. - Minor modification to format-torque.py to format generates expressions that are close to 80 characters. Bug: 42202654 Change-Id: Ie4b147decc918aa0270b10dee9d0e5c894e90076 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7181923 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103986} | 7 个月前 | |
[objects] Port Microtask and Promise classes to StructLayout This CL ports Microtask, PromiseReaction, PromiseCapability, and their subclasses to use the new StructLayout definition. This involves: - Changing Torque definition annotations to @cppObjectLayoutDefinition. - Updating C++ headers to inherit from StructLayout and defining fields using TaggedMember. - Implementing inline accessors using TaggedMember methods. - Updating body descriptors and printers/verifiers. - Updating call sites (mostly in builtins and code stub assembler) to use offsetof() or public accessors. - Refactoring verification logic to use a common MicrotaskVerify method. - Minor modification to format-torque.py to format generates expressions that are close to 80 characters. Bug: 42202654 Change-Id: Ie4b147decc918aa0270b10dee9d0e5c894e90076 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7181923 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103986} | 7 个月前 | |
[objects] Port Microtask and Promise classes to StructLayout This CL ports Microtask, PromiseReaction, PromiseCapability, and their subclasses to use the new StructLayout definition. This involves: - Changing Torque definition annotations to @cppObjectLayoutDefinition. - Updating C++ headers to inherit from StructLayout and defining fields using TaggedMember. - Implementing inline accessors using TaggedMember methods. - Updating body descriptors and printers/verifiers. - Updating call sites (mostly in builtins and code stub assembler) to use offsetof() or public accessors. - Refactoring verification logic to use a common MicrotaskVerify method. - Minor modification to format-torque.py to format generates expressions that are close to 80 characters. Bug: 42202654 Change-Id: Ie4b147decc918aa0270b10dee9d0e5c894e90076 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7181923 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103986} | 7 个月前 | |
[objects] Port ScriptOrModule to StructLayout Port ScriptOrModule to use the new StructLayout definition. This involves: - Changing Torque definition annotation to @cppObjectLayoutDefinition. - Updating C++ headers to inherit from StructLayout and defining fields using TaggedMember. - Implementing inline accessors using TaggedMember methods. - Updating body descriptors and printers/verifiers. Bug: 42202654 Change-Id: If6e4e4f75c42e9191269c01619aa7a8a22e0e31f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7203125 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103935} | 7 个月前 | |
[objects] improve module linked status DCHECKs Improve DCHECKs that requires a module to be linked. This includes kLinked, kEvaluated, kEvaluatingAsync, kErrored and the missing kEvaluating. kEvaluating can be found when a cyclic module is been evaluated synchronously. Refs: https://github.com/nodejs/node/pull/60111#issuecomment-3375399863 Change-Id: Ie0b9be22f2d3b8208571d8b419da3505b9f57b65 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7031498 Reviewed-by: Camillo Bruni <cbruni@chromium.org> Commit-Queue: Chengzhong Wu <cwu631@bloomberg.net> Cr-Commit-Position: refs/heads/main@{#103203} | 8 个月前 | |
heap_dump_1 for jsvm TicketNo: AR20260205251565 Description: heap_dump_1 for jsvm Team:gitee Feature or Bugfix: Binary Source: sync from gitee PrivateCode(Yes/No):No Change-Id: I2c4bf8190cab99d9278a68c3c7f94092f0507054 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/558 Merged-by: public pjenkins Signed-off-by: huanghan18 <huanghan18@huawei.com> revert merge request: AR20260205251565 heap_dump_1 for jsvm 5fae5665635fc7a1b52e325454044501fafec68e This revert merge request !453 | 1 个月前 | |
[objects] Port ScriptOrModule to StructLayout Port ScriptOrModule to use the new StructLayout definition. This involves: - Changing Torque definition annotation to @cppObjectLayoutDefinition. - Updating C++ headers to inherit from StructLayout and defining fields using TaggedMember. - Implementing inline accessors using TaggedMember methods. - Updating body descriptors and printers/verifiers. Bug: 42202654 Change-Id: If6e4e4f75c42e9191269c01619aa7a8a22e0e31f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7203125 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103935} | 7 个月前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
heap_dump_1 for jsvm TicketNo: AR20260205251565 Description: heap_dump_1 for jsvm Team:gitee Feature or Bugfix: Binary Source: sync from gitee PrivateCode(Yes/No):No Change-Id: I2c4bf8190cab99d9278a68c3c7f94092f0507054 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/558 Merged-by: public pjenkins Signed-off-by: huanghan18 <huanghan18@huawei.com> revert merge request: AR20260205251565 heap_dump_1 for jsvm 5fae5665635fc7a1b52e325454044501fafec68e This revert merge request !453 | 1 个月前 | |
[tagged-ptr] Move Name/String/Symbol to C++ layout Make Name/String/Symbol subclasses of HeapObjectLayout. This introduces: * Explicit pragmas forcing 4-byte packing of V8_OBJECT classes -- this was required for Name under no-pointer-compression builds, which has a tagged map ptr + int32 field and so would be padded at the end, for alignment of the map ptr. * A member type for external pointers * A differentiation in torque between CC and CCDebug macro lists, to avoid emitting C++ code for slice macros * An UncachedExternalString base class for ExternalString which doesn't have the resource data pointer * The use of flexible array members to represent variable length suffixes of classes (in particular, SeqString characters) * Helper macros for inner classes of object classes, which suppress the padding warnings Also, as a drive-by, accessors were changed to not use the cage_base, since this is available now as a global/thread local, and cleaned up various callers of these accessors to also not take a cage base or isolate if not neccessary. Bug: v8:12710 Change-Id: I15b6393d94e24f5a4fb5d7b363e88974ac1c33b4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5077926 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#91598} | 2 年前 | |
Rework memset methods - Remove the inline assembly snippets for stosl and friends as clang is able to generate better code. - Remove Uint32 and Address versions and instead just rely on the type being assignable. - Add a Relaxed atomic version for cases where we call this concurrently. Relying on the inline assembly meant that this was hidden from TSAN. Change-Id: I14d870378f7f5131408b757abab9e1569c87c49a Bug: 442989225 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6918971 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102359} | 9 个月前 | |
[runtime] Support raw double keys in DoubleStringCache This CL introduces explicit DoubleStringCache type. Bug: 409808503 Change-Id: Ic270d13b3e878dff7a49bbd298ab2b9bf9c5501f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6519779 Reviewed-by: Patrick Thier <pthier@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#100155} | 1 年前 | |
[runtime] Support raw double keys in DoubleStringCache This CL introduces explicit DoubleStringCache type. Bug: 409808503 Change-Id: Ic270d13b3e878dff7a49bbd298ab2b9bf9c5501f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6519779 Reviewed-by: Patrick Thier <pthier@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#100155} | 1 年前 | |
Reland "[sandbox][wasm] Un-expose dispatch_table_for_imports" This is a reland of commit 7a322570d2973af0abf7f3122eb0674334d3af0a Revert reason was a flake; relanding without modifications. Original change's description: > The WasmTrustedInstanceData's dispatch_table_for_imports reuses > the WasmDispatchTable class, but contrary to regular tables doesn't > expect any modifications to it after creation. To guard against > swapping attacks after in-sandbox corruption, which could cause > such unexpected modifications, this patch un-exposes that particular > dispatch table, making it unreachable from any in-sandbox object. Fixed: 452605803 Change-Id: I86e324ba268139276e6b0e774d7a5f2106807d33 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7105440 Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103436} | 8 个月前 | |
Remove GetIsolate and GetHeap from never-read-only objects Those methods are guaranteed to always return the same as Isolate::Current() (since https://crrev.com/c/6458560), so we should use that directly. R=leszeks@chromium.org Bug: 396607238 Change-Id: I6b409115ba19cadf034b9f9591d65f0d3bcae9ff Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6582963 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#100470} | 1 年前 | |
[tagged] Introduce TrustedPointerMember This helper class simplifies defining trusted pointer members in HeapObjectLayout subclasses. Bug: 42202654 Change-Id: I505f9f70a0128899d13a464eda15026f5a435cc0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7181920 Reviewed-by: Samuel Groß <saelo@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#103897} | 7 个月前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
[csa][codegen] Optimize IsStrong/IsWeakOrCleared The way to determine whether a MaybeObject is a strong or weak reference to the heap object is to check its lowest two bits. However, if the MaybeObject is known to not be a smi, that is, the lowest bit is known to be 1, we can check one bit instead. This allows Turbofan to select better instructions: x64: Before: movl r9,r11 andl r9,0x3 cmpb r9l,0x1 After: testb r11,0x2 arm64: Before: and w8, w7, #0x3 cmp w8, #0x1 (1) b.ne #+0x320 After: tbnz w7, #1, #+0x320 Change-Id: I03623183406ad7d920c96a752651e0116a22832e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3861310 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Hao A Xu <hao.a.xu@intel.com> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#83153} | 3 年前 | |
heap_dump_1 for jsvm TicketNo: AR20260205251565 Description: heap_dump_1 for jsvm Team:gitee Feature or Bugfix: Binary Source: sync from gitee PrivateCode(Yes/No):No Change-Id: I2c4bf8190cab99d9278a68c3c7f94092f0507054 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/558 Merged-by: public pjenkins Signed-off-by: huanghan18 <huanghan18@huawei.com> revert merge request: AR20260205251565 heap_dump_1 for jsvm 5fae5665635fc7a1b52e325454044501fafec68e This revert merge request !453 | 1 个月前 | |
[wasm] Store canonical signature on WasmInternalFunction We currently look up the signature from the module (using the stored function index) when we need it. In the case of imports this can easily go wrong though, since the stored function index is the import index, but the stored implicit_arg can be a WasmTrustedInstanceData (of the module that originally defined the function). In order to avoid confusion there, we now store the signature directly on the central WasmInternalFunction, and in turn remove the fields from WasmExportedFunctionData, WasmJSFunctionData, and WasmCapiFunctionData (which all link to an internal function anyway). R=jkummerow@chromium.org Bug: 432289371, 435582611 Change-Id: Ib7ddae0bd002c988d485b7d381df3b7a5c961a63 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6811187 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#102899} | 8 个月前 | |
[string] Use static roots for StringShape Refactor StringShape to store maps rather than instance types when static roots are enabled, and to use a dispatch helper (moved from String) rather than switch statements on representation_and_encoding. The various predicates on StringShape now dispatch to InstanceTypeChecker, which is overloaded on both InstanceType and Tagged<Map>. As part of this, re-order string maps slightly to make IsShared checks a bit more efficient; we may want to reorder them again though once all Internalized strings are also considered Shared. Bug: 411352143 Change-Id: Ida7859987c7907e1f73efe0eacbbdd1e228b58a4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6487993 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#99939} | 1 年前 | |
Merged: [contexts] Cleanup NativeContext::IsDetached() and friends In particular: - remove Isolate parameter from JSGlobalProxy::IsDetachedFrom() and IsDetached() methods, - add more efficient implementations of global_proxy() and global_object() accessors to NativeContext compared to generic ones in Context, - make Isolate::DetachGlobal() do nothing if the context is already detached. Bug: 466990858 (cherry picked from commit bdded6d6795a1fcf21ba9bdb31071f74b7436402) Change-Id: I659378a43a472bc49ca60e3b6bf5accebfc08b46 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7241452 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Auto-Submit: Igor Sheludko <ishell@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/branch-heads/14.4@{#12} Cr-Branched-From: 80acc26727d5a34e77dabeebe7c9213ec1bd4768-refs/heads/14.4.258@{#1} Cr-Branched-From: ce7e597e90f6df3fa4b6df224bc613b80c635450-refs/heads/main@{#104020} | 6 个月前 | |
Revert "[api] Prepare for passing flags to Api callbacks in isolate slot" This reverts commit 41fc89c1675988305b257d68cc4ec9fa7e6df148. Reason for revert: causes perf regression https://crbug.com/462926099 Original change's description: > [api] Prepare for passing flags to Api callbacks in isolate slot > > This is a preliminary step towards removing kShouldThrowOnErrorIndex > slot from v8::PropertyCallbackInfo<T> and kNewTargetIndex slot from > v8::FunctionCallbackInfo<T> for non-constructor calls. > > Bug: 326505377, 455600234 > Change-Id: Icbe384815583844e73ac630372bc38c8dc220ada > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7185161 > Commit-Queue: Igor Sheludko <ishell@chromium.org> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103887} Fixed: 462926099 Bug: 326505377, 455600234 Change-Id: Iae68f106e3a96d3adec8ad4aee9ab4c72e0b90a8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7203996 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#103997} | 7 个月前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[taggedptr] Fix Oddball BodyDescriptor Don't include the raw float64 number in the tagged pointers. Change-Id: I68f0edd6ff2a9232951c5b472eea77a5f393554b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6102547 Commit-Queue: Jakob Linke <jgruber@chromium.org> Reviewed-by: Jakob Linke <jgruber@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#97853} | 1 年前 | |
[tagged-ptr] Port Oddball to C++ definition Oddball and its subclasses are the first to be ported to be subclasses of HeapObjectLayout. This introduces several new concepts: * UnalignedDoubleMember for double fields with tagged alignment, * Using friends for allowlisted offsetof instead of kFieldOffset constants, * An ObjectTraits trait for defining the BodyDescriptor, * An OffsetsForDebug struct in the postmortem metadata generated file, so that something can be made a friend for offsetof there, * A ForHeapNumberOrOddballValue access builder, which bottlenecks the static assert that HeapNumber::value and Oddball::to_number_raw have the same offset, * New write barrier overloads which support passing in a HeapObjectLayout subclass + a pointer to a TaggedMember, * Various other specializations and overloads to make this work (notably, comparisons of raw HeapObjectLayout* vs Tagged<Foo>). Bug: v8:12710 Change-Id: Id0e58cccd7cd050b4e42449b9ce2ff6345ab9d61 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4872543 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#91159} | 2 年前 | |
[heap] Remove OffHeapFullPointerSlot The reason to have OffHeap- variants of compressed pointer slots is to remove the operator*, which would not work - it uses the location of the slot to work out the base of the pointer cage. However the operator* of a FullPointerSlot works just fine, even off-heap, because it doesn't need any cage base to decompress a pointer that is not compressed. We were not consistently using OffHeapFullPointerSlot anyway - VisitRoots was not using it even though roots are off-heap. Change-Id: I296385f7ee7022e8b9ad2a52770f458051f971ef Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7002994 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102954} | 8 个月前 | |
Check for missing inclusion of object-macros-undef.h And fix two place where we did not include object-macros.h and object-macros-undef.h in the right order or at all. R=jkummerow@chromium.org Change-Id: I9022a4a925251a1fee3583492769553f0cedd81e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6268384 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#98733} | 1 年前 | |
Replace uses of (MAYBE_)?{ASSIGN,MOVE}_RETURN_ON_EXCEPTION_VALUE Bug: 427539322 Change-Id: I6a6a6964da6f2cb220b246cb38db96ff93b1dff9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6669357 Reviewed-by: Jakob Linke <jgruber@chromium.org> Auto-Submit: Manish Goregaokar <manishearth@google.com> Commit-Queue: Jakob Linke <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#101207} | 11 个月前 | |
[temporal] Crash fixes for Temporal - Initialize to explicit nullptr - Initialize the error reporting string correctly - Handle null time zone transition case We now no longer crash anywhere in test262 built-ins/Temporal. Bug: 401065166 Change-Id: I6a6a6964dae37cdb96c2bc2752dd12a6ace54f82 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6702218 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Manish Goregaokar <manishearth@google.com> Commit-Queue: Manish Goregaokar <manishearth@google.com> Cr-Commit-Position: refs/heads/main@{#101269} | 11 个月前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
[handles] Migration to direct handles, part 15 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, asmjs, codegen, debug, diagnostics, execution, handles, heap, ic, json, logging, objects, profiler, regexp, runtime, snapshot, wasm, and tests. Bug: 42203211 Change-Id: Ibd2ffc4fc239088de175011e90e8dc5cadba3236 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6218795 Reviewed-by: Omer Katz <omerkatz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#98501} | 1 年前 | |
[tools] Make tq format work better with clang-format Change the preprocessing of tq files to look more like typescript, making it easier for clang-format to format them. * Turn macros, builtins etc. into functions. * Turn structs, shapes etc. into classes. * Turn implicit arguments into real arguments. * Turn @if into a real if. * Change all line annotations into line comments (clang-format doesn't support decorators it seems). * Use style options to avoid namespace indentation, instead of closing namespaces. Bug: chromium:1475672 Change-Id: I640bcd796936e41980c4cf98615992d217c0849e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4821812 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89678} | 2 年前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[casting] Remove Foo::cast Replace Foo::cast with Cast<Foo>. This is, blessedly, the same number of characters, and allows us to remove the need to declare cast functions in every type (instead using instance-type based type checks for most things, and a few template specializations of CastTraits for the remainder). Bug: 345640551 Change-Id: Ic215e2d4519f3128457db8a828a73c18204714bd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5614630 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#94425} | 2 年前 | |
[tagged-ptr] Port Oddball to C++ definition Oddball and its subclasses are the first to be ported to be subclasses of HeapObjectLayout. This introduces several new concepts: * UnalignedDoubleMember for double fields with tagged alignment, * Using friends for allowlisted offsetof instead of kFieldOffset constants, * An ObjectTraits trait for defining the BodyDescriptor, * An OffsetsForDebug struct in the postmortem metadata generated file, so that something can be made a friend for offsetof there, * A ForHeapNumberOrOddballValue access builder, which bottlenecks the static assert that HeapNumber::value and Oddball::to_number_raw have the same offset, * New write barrier overloads which support passing in a HeapObjectLayout subclass + a pointer to a TaggedMember, * Various other specializations and overloads to make this work (notably, comparisons of raw HeapObjectLayout* vs Tagged<Foo>). Bug: v8:12710 Change-Id: Id0e58cccd7cd050b4e42449b9ce2ff6345ab9d61 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4872543 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#91159} | 2 年前 | |
[objects] Port Microtask and Promise classes to StructLayout This CL ports Microtask, PromiseReaction, PromiseCapability, and their subclasses to use the new StructLayout definition. This involves: - Changing Torque definition annotations to @cppObjectLayoutDefinition. - Updating C++ headers to inherit from StructLayout and defining fields using TaggedMember. - Implementing inline accessors using TaggedMember methods. - Updating body descriptors and printers/verifiers. - Updating call sites (mostly in builtins and code stub assembler) to use offsetof() or public accessors. - Refactoring verification logic to use a common MicrotaskVerify method. - Minor modification to format-torque.py to format generates expressions that are close to 80 characters. Bug: 42202654 Change-Id: Ie4b147decc918aa0270b10dee9d0e5c894e90076 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7181923 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103986} | 7 个月前 | |
[objects] Port Microtask and Promise classes to StructLayout This CL ports Microtask, PromiseReaction, PromiseCapability, and their subclasses to use the new StructLayout definition. This involves: - Changing Torque definition annotations to @cppObjectLayoutDefinition. - Updating C++ headers to inherit from StructLayout and defining fields using TaggedMember. - Implementing inline accessors using TaggedMember methods. - Updating body descriptors and printers/verifiers. - Updating call sites (mostly in builtins and code stub assembler) to use offsetof() or public accessors. - Refactoring verification logic to use a common MicrotaskVerify method. - Minor modification to format-torque.py to format generates expressions that are close to 80 characters. Bug: 42202654 Change-Id: Ie4b147decc918aa0270b10dee9d0e5c894e90076 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7181923 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103986} | 7 个月前 | |
[objects] Port Microtask and Promise classes to StructLayout This CL ports Microtask, PromiseReaction, PromiseCapability, and their subclasses to use the new StructLayout definition. This involves: - Changing Torque definition annotations to @cppObjectLayoutDefinition. - Updating C++ headers to inherit from StructLayout and defining fields using TaggedMember. - Implementing inline accessors using TaggedMember methods. - Updating body descriptors and printers/verifiers. - Updating call sites (mostly in builtins and code stub assembler) to use offsetof() or public accessors. - Refactoring verification logic to use a common MicrotaskVerify method. - Minor modification to format-torque.py to format generates expressions that are close to 80 characters. Bug: 42202654 Change-Id: Ie4b147decc918aa0270b10dee9d0e5c894e90076 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7181923 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103986} | 7 个月前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[tagged] Introduce a Union type Add a variadic templated C++ union type similar to torque's unions, which encapsulates a value that is one of a limited set of V8 types. Tagged pointers to a Union type can be cast (casted?) to one of the types in the Union in order to access that value, or indeed to a sub-Union if necessary. Unions are connected to their types using the is_subtype type_trait, which is substantially expanded to keep working (in trivial cases) when its types are only forward declared. The sub-type relation for a Union and another type defines a partial order, as one would expect, where: 1. Union<T...> is a subtype of U if all T are subtypes of U 2. U is a subtype of Union<T...> if for any T, U is a subtype of T This type is used, initially, as follows: 1. Torque union types now generate a Union<...> instead of deferring to the parent class 2. C++ defines typedefs for Number, Numeric, JSPrimitive, JSAny, and JSCallable. Notably, Object is not (yet?) a Union of Smi and HeapObject, as we need to decide what to do with the static methods on the Object class. 3. Union<...> subsumes the UnionT<T,U> types in TNodes and Turboshaft. The bulk of the changes in this patch are propagations of types necessary to satisfy newly strict requirements of torque-generated functions (in particular, setters). There is also a partial progress on making Object::NumberValue take a Number rather than an Object, as a proof-of-concept for Number. Change-Id: I87868f65eba43a3b5cbda6c0bf5e16e62a8225c7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5600543 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#94373} | 2 年前 | |
Update V8 DEPS. Also manually reformat some files with the clang-format change. Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/e10cf1a..c8ec41b Rolling v8/buildtools: https://chromium.googlesource.com/chromium/src/buildtools/+log/c2e4795..113378f Rolling v8/buildtools/linux64: git_revision:7c8e511229f0fc06f6250367d51156bb6f578258..git_revision:48b013c9d9debc0f5fc1dd71a257b3c38c5acb43 Rolling v8/buildtools/third_party/libc++abi/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi/+log/518fd76..c7888dd Rolling v8/buildtools/third_party/libunwind/trunk: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/705543f..d8a4746 Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/88422dc..9ba02ee Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/dc8ca44..fccf35c Rolling v8/third_party/zlib: https://chromium.googlesource.com/chromium/src/third_party/zlib/+log/32e65ef..961141d Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/3c4a622..75625c6 Rolling v8/tools/luci-go: git_revision:6da0608e4fa8a3c6d1fa4f855485c0038b05bf72..git_revision:2aa3d7e5e8662c5193059a490f07b7d91331933e Rolling v8/tools/luci-go: git_revision:6da0608e4fa8a3c6d1fa4f855485c0038b05bf72..git_revision:2aa3d7e5e8662c5193059a490f07b7d91331933e R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com Change-Id: I00a09d42cf91f226c661e97915d5a95fff84b079 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3615245 Reviewed-by: Michael Achenbach <machenbach@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Owners-Override: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#80343} | 4 年前 | |
Remove GetIsolateFromWritableObject This method has a CHECK since a few months (https://crrev.com/c/6458560) that the returned isolate is the same as the "current" isolate according to TLS. Hence replace all uses by Isolate::Current(). Drive-by: Avoid printing the "isolate" in object printing; it's not a property of the object, but comes from TLS, so there's no point in printing this there. Drive-by 2: Some early returns to make the code shorter and reduce indentation. R=mlippautz@chromium.org Bug: 396607238 Change-Id: Ife1350c2369c740bdd60cf85ec4000329eebaaa6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6695012 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#101325} | 11 个月前 | |
[compiler] Optimize Date.prototype.getXXX() accessors ... in Maglev and TurboFan. This CL: - adds NoDateTimeConfigurationChangeProtector, - makes sure that JSDate's cached fields are always initialized, which make it possible to read cached fields directly without additional run-time checks. Drive-by: - move DateCache::stamp_ field to IsolateData (this removes one indirection on access and avoids potential issues with reallocated DateCache object), - make deserializer recompute cached fields after deserialization to match current date/time configuration which could have been different during snapshot creation, - simplify definition of alignment padding fields in ISOLATE_DATA_FIELDS by introducing PADDING_FIELD macro. Bug: 411352101 Change-Id: I69e25b1ce7e2c79f9aeee69e97192be62a08c2c0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6535917 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#100248} | 1 年前 | |
Reland "[contexts] Add ContextCells" This is a reland of commit 47d530ca25fb7176b9c218fa8df8991c7c6ee0e8 This adds a detached state to the ContextCell, used to synchronize with the background thread and invalidate the code before installation. This fixes the following scenario: 1. Background: Reads a ContextCell in kConst state. 2. Background: Reads the associated constant value. 3. Foreground: Replaces the cell with a new value, tries to deopt (no code exists yet) and discards ContextCell. 4. Background: Proceeds to generate code, embedding the stale constant value read in step 2. Original change's description: > [contexts] Add ContextCells > > This simplifies constant let and mutable numbers (int32/float64). > No need for extra side table. > > Bug: 408128754 > > Change-Id: I7b95844417a4855a8a5ee44dd78fdc3d3b33c45d > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6421909 > Commit-Queue: Victor Gomes <victorgomes@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Cr-Commit-Position: refs/heads/main@{#99736} Bug: 408128754 Change-Id: I46697b5bd1f5d955b6f8bdb5f2b4896a15629499 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6446414 Auto-Submit: Victor Gomes <victorgomes@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/main@{#99757} | 1 年前 | |
[objects] Convert Struct subclasses to HeapObjectLayout This CL ports TemplateObjectDescription, PropertyDescriptorObject, ArrayBoilerplateDescription, and ClassBoilerplate to use the new HeapObjectLayout definition. This involves: - Changing Torque definition annotations to @cppObjectLayoutDefinition. - Updating C++ headers to inherit from StructLayout and defining fields using TaggedMember. - Implementing inline accessors using TaggedMember methods. - Updating body descriptors and printers/verifiers. - Updating call sites (mostly in builtins and code stub assembler) to use offsetof() or public accessors. #ai-assisted Bug: 42202654 Change-Id: I1ca6ed69e4a20d3c9fd4343b84b23863c5558fae Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7177560 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103850} | 7 个月前 | |
[objects] Convert Struct subclasses to HeapObjectLayout This CL ports TemplateObjectDescription, PropertyDescriptorObject, ArrayBoilerplateDescription, and ClassBoilerplate to use the new HeapObjectLayout definition. This involves: - Changing Torque definition annotations to @cppObjectLayoutDefinition. - Updating C++ headers to inherit from StructLayout and defining fields using TaggedMember. - Implementing inline accessors using TaggedMember methods. - Updating body descriptors and printers/verifiers. - Updating call sites (mostly in builtins and code stub assembler) to use offsetof() or public accessors. #ai-assisted Bug: 42202654 Change-Id: I1ca6ed69e4a20d3c9fd4343b84b23863c5558fae Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7177560 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103850} | 7 个月前 | |
[objects] Convert Struct subclasses to HeapObjectLayout This CL ports TemplateObjectDescription, PropertyDescriptorObject, ArrayBoilerplateDescription, and ClassBoilerplate to use the new HeapObjectLayout definition. This involves: - Changing Torque definition annotations to @cppObjectLayoutDefinition. - Updating C++ headers to inherit from StructLayout and defining fields using TaggedMember. - Implementing inline accessors using TaggedMember methods. - Updating body descriptors and printers/verifiers. - Updating call sites (mostly in builtins and code stub assembler) to use offsetof() or public accessors. #ai-assisted Bug: 42202654 Change-Id: I1ca6ed69e4a20d3c9fd4343b84b23863c5558fae Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7177560 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103850} | 7 个月前 | |
Reland "[handles] Migration to direct handles, part 12" This is a reland of commit 5fa54d85a10049a55ba2fa02bc05145ddee7d19a Original change's description: > [handles] Migration to direct handles, part 12 > > This CL migrates a large number of handles to direct handles. The > changes are only relevant for builds with v8_enable_direct_handle=true. > > Affected source directories: api, asmjs, ast, builtins, codegen, > compiler, d8, debug, deoptimizer, diagnostics, execution, extensions, > heap, ic, init, interpreter, json, maglev, objects, parsing, profiler, > regexp, runtime, snapshot, strings, wasm, and tests. > > Bug: 42203211 > Change-Id: I2334b3295e5780e8f52d0b13d1545dce29fcf81e > Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6181904 > Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> > Reviewed-by: Omer Katz <omerkatz@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Cr-Commit-Position: refs/heads/main@{#98240} Bug: 42203211 Change-Id: Ie21acd681c12e7212185d61a19bd858365650204 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6187462 Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#98249} | 1 年前 | |
Reland "[handles] Migration to direct handles, part 12" This is a reland of commit 5fa54d85a10049a55ba2fa02bc05145ddee7d19a Original change's description: > [handles] Migration to direct handles, part 12 > > This CL migrates a large number of handles to direct handles. The > changes are only relevant for builds with v8_enable_direct_handle=true. > > Affected source directories: api, asmjs, ast, builtins, codegen, > compiler, d8, debug, deoptimizer, diagnostics, execution, extensions, > heap, ic, init, interpreter, json, maglev, objects, parsing, profiler, > regexp, runtime, snapshot, strings, wasm, and tests. > > Bug: 42203211 > Change-Id: I2334b3295e5780e8f52d0b13d1545dce29fcf81e > Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6181904 > Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> > Reviewed-by: Omer Katz <omerkatz@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Cr-Commit-Position: refs/heads/main@{#98240} Bug: 42203211 Change-Id: Ie21acd681c12e7212185d61a19bd858365650204 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6187462 Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#98249} | 1 年前 | |
[objects] Throw if there are too many props for a dict We have a maximum enumeration index on NameDictionary, exceeding this will cause behavioural weirdness (e.g. invalid order due to wraparound). We can make NameDictionary::Add potentially throw instead. Bug: 42204488, 447004361 Change-Id: I8e27b6cec8d58dbfec49503fbcbd4c855d8ed060 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5191135 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102952} | 8 个月前 | |
[handles] Migration to direct handles, part 7 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, builtins, numbers, objects, runtime (primarily) and also: codegen, debug, execution, heap, ic, logging, wasm (secondarily). Bug: 42203211 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Change-Id: I4c2d7057d4f552fd83bb4cb606b777c7001fbcfe Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6048824 Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#97528} | 1 年前 | |
[runtime] Don't bother sorting short DescriptorArrays ... and TransitionArrays for which we use linear search anyway. Drive-by: set DA's and TA's kMaxElementsForLinearSearch limit for runtime lookups to 32 to match previous CSA::Lookup<Array>(..) implementation. Bug: 455900157 Change-Id: Ie52e64d1fdada2d6c188e28857859726a414b56d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7090677 Auto-Submit: Igor Sheludko <ishell@chromium.org> Commit-Queue: Patrick Thier <pthier@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103387} | 8 个月前 | |
[runtime] Introduce kClearedWeakValue and cleanup ClearedValue() It used to be important that the upper part of a non-Smi value is equal to respective cage base but since https://crrev.com/c/6402513 it's not the case anymore. This CL relaxes the DCHECK in CompressObject() to allow baseless cleared weak values. Although we can simply use kClearedWeakValue instead of ClearedValue() or ClearedTrustedValue() for manual clearing of certain weak fields, having these functions might still be useful to ensure that we don't accidentally mix up cleared weak references belonging to different cages. Bug: 424154602 Change-Id: I03a351c2c1615455c076cf73d38e592b75bdcd54 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6673894 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#101053} | 1 年前 | |
[ic] Cache common load-non-existent handlers in PrototypeInfo This is possible because handlers for negative lookups don't depend that much on the receiver map. The only aspects that matter are 1) whether lookup on receiver is necessary, 2) whether access check is needed. We consider case (2) as a less often used one, so we cache "load non existent" handlers only for fast and slow receivers which don't require access checks. Drive-by: - don't treat fast prototype maps as transition handlers (they'll never be reused anyway), - make sure that Map::GetOrCreatePrototypeChainValidityCell() creates unique validity cell for prototype maps instead of using the one from the parent prototype, this avoids unnecessary invalidations of parent's validity cell, - replaced some MemoryChunk::UNREGISTERED usages back to PrototypeInfo::UNREGISTERED (this was accidentally changed as a part of earlier refactoring). Bug: 411351391 Change-Id: I664dd9f41f7bfbef979b0588648ce9307b6d53d0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6568550 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#100425} | 1 年前 | |
[ic] Cache common load-non-existent handlers in PrototypeInfo This is possible because handlers for negative lookups don't depend that much on the receiver map. The only aspects that matter are 1) whether lookup on receiver is necessary, 2) whether access check is needed. We consider case (2) as a less often used one, so we cache "load non existent" handlers only for fast and slow receivers which don't require access checks. Drive-by: - don't treat fast prototype maps as transition handlers (they'll never be reused anyway), - make sure that Map::GetOrCreatePrototypeChainValidityCell() creates unique validity cell for prototype maps instead of using the one from the parent prototype, this avoids unnecessary invalidations of parent's validity cell, - replaced some MemoryChunk::UNREGISTERED usages back to PrototypeInfo::UNREGISTERED (this was accidentally changed as a part of earlier refactoring). Bug: 411351391 Change-Id: I664dd9f41f7bfbef979b0588648ce9307b6d53d0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6568550 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#100425} | 1 年前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[handles] Migration to direct handles, part 7 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, builtins, numbers, objects, runtime (primarily) and also: codegen, debug, execution, heap, ic, logging, wasm (secondarily). Bug: 42203211 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Change-Id: I4c2d7057d4f552fd83bb4cb606b777c7001fbcfe Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6048824 Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#97528} | 1 年前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[handles] Migration to direct handles, part 15 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, asmjs, codegen, debug, diagnostics, execution, handles, heap, ic, json, logging, objects, profiler, regexp, runtime, snapshot, wasm, and tests. Bug: 42203211 Change-Id: Ibd2ffc4fc239088de175011e90e8dc5cadba3236 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6218795 Reviewed-by: Omer Katz <omerkatz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#98501} | 1 年前 | |
[handles] Migration to direct handles, part 15 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, asmjs, codegen, debug, diagnostics, execution, handles, heap, ic, json, logging, objects, profiler, regexp, runtime, snapshot, wasm, and tests. Bug: 42203211 Change-Id: Ibd2ffc4fc239088de175011e90e8dc5cadba3236 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6218795 Reviewed-by: Omer Katz <omerkatz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#98501} | 1 年前 | |
[tagged] Make FixedArray a HeapObjectLayout class Move TaggedArrayBase and all its subclasses to be C++ object definitions, inheriting from HeapObjectLayout. The TaggedArrayBase holds both the length/capacity and the elements, with subclasses not expected (or able) to hold extra fields -- the Shape can include an ExtraFields mixin class for subclasses that need extra fields (like ArrayList), which is injected using template magic between the length/capacity and elements. This requires some extensions to the C++ object layout capability: * Adding a TrustedObjectLayout for starting to port over TrustedObjects, since some TaggedArrays are trusted, * Fixing TaggedMember to work with non-main cages (also for trusted arrays), * More atomics support for TaggedMember, * Adding support for the ephemeron barrier to TaggedMember (in fact, I just made EphemeronHashTable call the write barrier directly instead of having a generic macro, it's a very special case and can be treated as such), * Making sure that HeapObjectLayout is non-movable/non-copyable, to catch issues where we were passing it by value due to *this, Bug: 42202654 Change-Id: I23df96ef2815c4592438137b4d7a77d496e1fe52 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5873241 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#96556} | 1 年前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
heap_dump_1 for jsvm TicketNo: AR20260205251565 Description: heap_dump_1 for jsvm Team:gitee Feature or Bugfix: Binary Source: sync from gitee PrivateCode(Yes/No):No Change-Id: I2c4bf8190cab99d9278a68c3c7f94092f0507054 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/558 Merged-by: public pjenkins Signed-off-by: huanghan18 <huanghan18@huawei.com> revert merge request: AR20260205251565 heap_dump_1 for jsvm 5fae5665635fc7a1b52e325454044501fafec68e This revert merge request !453 | 1 个月前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
Remove GetIsolate and GetHeap from never-read-only objects Those methods are guaranteed to always return the same as Isolate::Current() (since https://crrev.com/c/6458560), so we should use that directly. R=leszeks@chromium.org Bug: 396607238 Change-Id: I6b409115ba19cadf034b9f9591d65f0d3bcae9ff Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6582963 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#100470} | 1 年前 | |
Change isolate trace field from number to string IsolateId() is a uint64_t, which cannot convert to JS without precision loss. Beyond that, the way v8 serializes large uint64_t values seems to differ from how blink does, which results in the same isolate presenting as different values. That made it impossible to properly correlate these events for the same isolate. See associated bug for more. Bug: 447654178 Change-Id: I070a2a5532be63a6c77f237d8c96307970058132 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6991617 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Connor Clark <cjamcl@chromium.org> Reviewed-by: Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/main@{#102832} | 9 个月前 | |
Remove GetIsolate and GetHeap from never-read-only objects Those methods are guaranteed to always return the same as Isolate::Current() (since https://crrev.com/c/6458560), so we should use that directly. R=leszeks@chromium.org Bug: 396607238 Change-Id: I6b409115ba19cadf034b9f9591d65f0d3bcae9ff Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6582963 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#100470} | 1 年前 | |
[parser] Handle 'debugId' magic comment This CL adds debugId to the script object populated by the magic comment. Drive-by: Rename 'HandleSourceURLComments' to 'HandleDebugMagicComments'. R=leszeks@chromium.org Bug: 413177407 Change-Id: I02dca64dbd1eceae95180f80c04a218044b7dc19 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6491306 Commit-Queue: Simon Zünd <szuend@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#99905} | 1 年前 | |
TicketNo:DTS2026040312077;DTS2026040207037;DTS2026040207036;DTS2026040135724;DTS2026040135722;DTS2026032818442;DTS2026032530470;DTS2026032530464;DTS2026031327981;DTS2026031222703;DTS2026031222694;DTS2026031222686;DTS2026031222671;DTS2026031222662;DTS2026031222654 Description:【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Team:v8 Feature or Bugfix:Bugfix Binary Source:No PrivateCode(Yes/No):No Change-Id: Iae84c8fcc36a25b1936ec0997008368f70096cd6 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/534 Merged-by: public pjenkins Signed-off-by: Marja Hölttä <marja@chromium.org> | 1 个月前 | |
TicketNo:DTS2026040312077;DTS2026040207037;DTS2026040207036;DTS2026040135724;DTS2026040135722;DTS2026032818442;DTS2026032530470;DTS2026032530464;DTS2026031327981;DTS2026031222703;DTS2026031222694;DTS2026031222686;DTS2026031222671;DTS2026031222662;DTS2026031222654 Description:【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Team:v8 Feature or Bugfix:Bugfix Binary Source:No PrivateCode(Yes/No):No Change-Id: Iae84c8fcc36a25b1936ec0997008368f70096cd6 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/534 Merged-by: public pjenkins Signed-off-by: Marja Hölttä <marja@chromium.org> | 1 个月前 | |
[sandbox] Expand trusted object unpublishing mechanism This CL expands the "publishing" mechanism for trusted objects. Previously, we already had a special "unpublished" tag that could be used to make trusted objects inaccessible from within the sandbox. We now expand the machinery around this tag to allow objects to be allocated in an unpublished state and then be published later on. For that, we also fix a bug that previously allowed unpublished objects to still be accessed from inside the sandbox through the kUnknownIndirectPointerTag (used e.g. for the SFI). The new, more flexible unpublishing mechanism will be used in follow-up CLs to make bytecode inaccessible until it has been validated. Drive-By: rename init_self_indirect_pointer to InitAndPublish since this method does non-trivial work and so should probably be uppercased. Bug: 461681036 Change-Id: Iad0224beb89ef1bd625b5cdc51a77cef12642159 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7172412 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#103956} | 7 个月前 | |
[scope-info] Use Union type for SFI outer scope info Also, drive-by remove unnecessary Hole type from ScopeInfo's outer scope info (when there is no outer scope, the field doesn't exist at all). Bug: 434179415, 42202654 Change-Id: I79d219d63eaacf573111891164f442e48d2dc294 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6845655 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#101885} | 10 个月前 | |
[base64] Fix incorrect output for special cases This CL fixes two reported incorrect outputs: 1) result of fromBase64 when the array is filled with 255 and has the length more than 7, 2) result of fromBase64, toBase64 and setFromBase64 when the option is null. Bug: 42204568 Change-Id: Id1a394039e4e742644b7858b56d443241b9640f3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6691648 Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101168} | 11 个月前 | |
[base64] Add toHex and setFromHex paths for SharedArrayBuffers This CL, adds a path to make sure we have an atomic read in toHex and atomic write in setFromHex when the TypedArray is backed with a SharedArrayBuffer. Bug: 42204568 Change-Id: Ib62ac7e6c6c89cb76bf150056bc16fb1b67e2f0f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6485466 Reviewed-by: Shu-yu Guo <syg@chromium.org> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Cr-Commit-Position: refs/heads/main@{#99900} | 1 年前 | |
[heap][ptr-compr] Use Heap::CopyRange() instead of tight copy loops Also remove unused Factory::CopyFeedbackVector(). Bug: v8:7703 Change-Id: I75e16a55967e5970e4cbe3babae3a09d2a647313 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611542 Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#61512} | 7 年前 | |
[utils] Avoid min complexity for x64 CopyImpl() Don't use a minimum complexity for Copy*() methods as MemCopy itself offers the necessary fast paths. Drive-by: Move CopyTagged() to memcpy.h Change-Id: I93f6cad23be40a9288cce9b65a59abb485d58f77 Bug: 448409803 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6999934 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#102862} | 9 个月前 | |
[heap] Remove OffHeapFullPointerSlot The reason to have OffHeap- variants of compressed pointer slots is to remove the operator*, which would not work - it uses the location of the slot to work out the base of the pointer cage. However the operator* of a FullPointerSlot works just fine, even off-heap, because it doesn't need any cage base to decompress a pointer that is not compressed. We were not consistently using OffHeapFullPointerSlot anyway - VisitRoots was not using it even though roots are off-heap. Change-Id: I296385f7ee7022e8b9ad2a52770f458051f971ef Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7002994 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102954} | 8 个月前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[cleanup] Modernize std::*::value and ::type Mechanically replacing std::foo<X>::value with std::foo_v<X>, and the same for ::type -> _t. Change-Id: I543dda07ba4c95534cdcd51f1f438f2626be8273 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6491388 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#99940} | 1 年前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[top-level-await] align async modules rejection and fulfillment order This implements the spec change from [1]. This PR changes the order of rejections to match the same order that happens on fufillment case. It meansd that First the rejection goes to module where it happens and then it bubbles up to its acenstros. For detailed discussion and reasoning, check links in the PR[1]. [1] Spec PR: https://github.com/tc39/ecma262/pull/3695 [2] Test262 PR: https://github.com/tc39/test262/pull/4591 Bug: 433891576 Change-Id: I3b16e276ad0d6bd0c5a17f20f8db06d56b483883 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7169324 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Andy Wingo <wingo@igalia.com> Reviewed-by: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#104017} | 7 个月前 | |
[api] Add index-based module resolution in InstantiateModule() Add new InstantiateModule() overload that allows embedders to identify modules requests by index in the module requests array rather than using specifier and import attributes. When embedders want to fetch all the modules using information from module->GetModuleRequests() before calling InstantiateModule() instead of having to do the fetching inside the InstantiateModule() callback, they could just maintain a simple array of modules indexed by module request positions and look up the fetched the module by index in the new callback. Previously this has to be done by mapping from specifier and import attributes to module objects cached on the embedder side, leading to an overhead to hash the specifier and import attributes for each module request. Refs: https://github.com/nodejs/node/pull/59396 Bug: 435317398 Change-Id: Ie017d2f3ccc605e0f58aa423504b5fa5fdbcc633 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6804466 Commit-Queue: Joyee Cheung <joyee@igalia.com> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/main@{#102613} | 9 个月前 | |
[defer-import-eval] Parse import defer syntax Add support for import defer * as ns and import.defer syntax that is behind the runtime flag named --js-defer-import-eval. Deferred imports are marked as ModuleImportPhase::kDefer, that is going to be used on other parts of runtime to properly handle new deferred semantics. Only namespace imports can be marked as deferred. Design doc: https://docs.google.com/document/d/1DKss76uvFDEy3UHgc2Vtmy1hw5SNTCrEJqUF2aKATxQ Bug: 398218423 Change-Id: I552f6df5970ae45427b4be75a403625fb391cc6b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7017517 Reviewed-by: Olivier Flückiger <olivf@chromium.org> Commit-Queue: Joyee Cheung <joyee@igalia.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103314} | 8 个月前 | |
[tagged-ptr] Convert more Objects to Tagged<> Convert a large amount of Objects to Tagged<Object>, by using a clang tool to convert all variables and parameters to Tagged<>, and manually fixing up any build failures this caused. Bug: v8:12710 Change-Id: I2bfc90220fe92ebc6487b5cddbc4166164637a71 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4827204 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89750} | 2 年前 | |
[tagged-ptr] Convert more Objects to Tagged<> Convert a large amount of Objects to Tagged<Object>, by using a clang tool to convert all variables and parameters to Tagged<>, and manually fixing up any build failures this caused. Bug: v8:12710 Change-Id: I2bfc90220fe92ebc6487b5cddbc4166164637a71 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4827204 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89750} | 2 年前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
Rework memset methods - Remove the inline assembly snippets for stosl and friends as clang is able to generate better code. - Remove Uint32 and Address versions and instead just rely on the type being assignable. - Add a Relaxed atomic version for cases where we call this concurrently. Relying on the inline assembly meant that this was hidden from TSAN. Change-Id: I14d870378f7f5131408b757abab9e1569c87c49a Bug: 442989225 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6918971 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102359} | 9 个月前 | |
[base] Merge SpinningMutex back into Mutex They are now the same; beyond that we can't do ave THREAD_SAFETY_ANALYSIS on a bunch of previous SpinningMutex cases, so we'll need to propagate this into Mutex. Bug: 384940357 Change-Id: Ifbd4ffc4090738455036f32d9a5cf813b9f15781 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6244422 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#98597} | 1 年前 | |
Optimize utf8length for utf16 values Change-Id: I4d9546ab45264852f52361123e86fa3b38d79e45 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7142019 Reviewed-by: Anton Bikineev <bikineev@chromium.org> Reviewed-by: Erik Corry <erikcorry@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#103754} | 7 个月前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[collections] Alternative fix for supporting big WeakMaps The hashes stored in JSReceivers are maximally 20 bits. If a hash table is bigger than that, all items get clumped in the beginning. This CL distributes the probes more evenly in big hash tables. It's still not optimal (there will be empty space because of quadratic probing) but it's better than the previous solution. Side fix: "are we running out of capacity" computation in RehashObjectHashTableAndGCIfNeeded was too pessimistic (it added slack twice, first there and once in ComputeCapacity). The previous version https://chromium-review.googlesource.com/c/v8/v8/+/5961516 was applying the hash spreading logic to all HashTables, while it's only intended for EphemeronHashTable. This CL fixes that. Bug: 42207427, 375033082, 390568195 Change-Id: I78dd3f904554fbbe224e4406e79ccb86e7cd7516 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6187094 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/main@{#98303} | 1 年前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[strings] Support shared strings without a shared string table - Add --shared-strings to support shared strings without the shared string table. - Copy shared strings to the local heap on internalization.* - Shared strings never transition to ThinStrings.* Shared strings always have to perform a full StringTable lookup.* - Externalization of shared strings is not supported.* *) Applies only to shared strings without --shared-string-table. Drive-by: Remove unused ContextSerializer::ShouldBeInTheSharedObjectCache. Bug: 446981745 Change-Id: I8624f0cc1e3b89993c596afcde8b899fcbaa0b81 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7021469 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Patrick Thier <pthier@chromium.org> Reviewed-by: Jakob Linke <jgruber@chromium.org> Auto-Submit: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103013} | 8 个月前 | |
[runtime] Only use part of SlowEquals to internalize strings Change-Id: Icb199a135009606a47a22fe5559f709ec0cbfd77 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6983089 Auto-Submit: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Commit-Queue: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#102873} | 8 个月前 | |
[strings] Support shared strings without a shared string table - Add --shared-strings to support shared strings without the shared string table. - Copy shared strings to the local heap on internalization.* - Shared strings never transition to ThinStrings.* Shared strings always have to perform a full StringTable lookup.* - Externalization of shared strings is not supported.* *) Applies only to shared strings without --shared-string-table. Drive-by: Remove unused ContextSerializer::ShouldBeInTheSharedObjectCache. Bug: 446981745 Change-Id: I8624f0cc1e3b89993c596afcde8b899fcbaa0b81 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7021469 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Patrick Thier <pthier@chromium.org> Reviewed-by: Jakob Linke <jgruber@chromium.org> Auto-Submit: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103013} | 8 个月前 | |
heap_dump_1 for jsvm TicketNo: AR20260205251565 Description: heap_dump_1 for jsvm Team:gitee Feature or Bugfix: Binary Source: sync from gitee PrivateCode(Yes/No):No Change-Id: I2c4bf8190cab99d9278a68c3c7f94092f0507054 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/558 Merged-by: public pjenkins Signed-off-by: huanghan18 <huanghan18@huawei.com> revert merge request: AR20260205251565 heap_dump_1 for jsvm 5fae5665635fc7a1b52e325454044501fafec68e This revert merge request !453 | 1 个月前 | |
Revert "[string] Remove String::IsOneByteRepresentationUnderneath" This reverts commit e3f33e99674eab3881d2d65b82dfe436829bb831. Reason for revert: https://crbug.com/398999390 This only reverts the fist part of the CL (Removing IsOneByteRepresentation). Using static roots to determine one-byte representation from the map word alone is kept. Original change's description: > [string] Remove String::IsOneByteRepresentationUnderneath > > All string maps are split into one- and two-byte versions, and enforce > that their underlying string must have the same byte width (e.g. we > can't change byteness when externalizing). This means that the old > IsOneByteRepresentationUnderneath loop is no longer needed, as we > already know the byteness from the top. > > Remove this function, replacing with calls to IsOneByteRepresentation. > Additionally, we have some static roots hacks to determine one-byte > representation from the map word alone (without needing to dereference > the instance type), so use that too where possible. > > Change-Id: I662daa3cb217d04cbfd717da53ae1238a0bcddd0 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6011010 > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Patrick Thier <pthier@chromium.org> > Cr-Commit-Position: refs/heads/main@{#97099} DISABLE_SPELLCHECKER Fixed: 398999390 Change-Id: Iee7e88257cb0d23669bcd7571d57b613a413bc29 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6304799 Commit-Queue: Patrick Thier <pthier@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#98942} | 1 年前 | |
Remove GetIsolate and GetHeap from never-read-only objects Those methods are guaranteed to always return the same as Isolate::Current() (since https://crrev.com/c/6458560), so we should use that directly. R=leszeks@chromium.org Bug: 396607238 Change-Id: I6b409115ba19cadf034b9f9591d65f0d3bcae9ff Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6582963 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#100470} | 1 年前 | |
heap_dump_1 for jsvm TicketNo: AR20260205251565 Description: heap_dump_1 for jsvm Team:gitee Feature or Bugfix: Binary Source: sync from gitee PrivateCode(Yes/No):No Change-Id: I2c4bf8190cab99d9278a68c3c7f94092f0507054 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/558 Merged-by: public pjenkins Signed-off-by: huanghan18 <huanghan18@huawei.com> revert merge request: AR20260205251565 heap_dump_1 for jsvm 5fae5665635fc7a1b52e325454044501fafec68e This revert merge request !453 | 1 个月前 | |
[tagged] Remove struct torque definitions Since torque doesn't need the definitions, we can leave just the declarations for instance type definition purposes. Add a CSA helper for AccessorPair field loading to reduce the amount of changes needed. Bug: 42202654 Change-Id: Ie4956ff34fe0aa8a334af05e04609b856ce9aa23 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6422136 Commit-Queue: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#99607} | 1 年前 | |
[cleanup] Modernize std::*::value and ::type Mechanically replacing std::foo<X>::value with std::foo_v<X>, and the same for ::type -> _t. Change-Id: I543dda07ba4c95534cdcd51f1f438f2626be8273 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6491388 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#99940} | 1 年前 | |
[objects] Port Microtask and Promise classes to StructLayout This CL ports Microtask, PromiseReaction, PromiseCapability, and their subclasses to use the new StructLayout definition. This involves: - Changing Torque definition annotations to @cppObjectLayoutDefinition. - Updating C++ headers to inherit from StructLayout and defining fields using TaggedMember. - Implementing inline accessors using TaggedMember methods. - Updating body descriptors and printers/verifiers. - Updating call sites (mostly in builtins and code stub assembler) to use offsetof() or public accessors. - Refactoring verification logic to use a common MicrotaskVerify method. - Minor modification to format-torque.py to format generates expressions that are close to 80 characters. Bug: 42202654 Change-Id: Ie4b147decc918aa0270b10dee9d0e5c894e90076 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7181923 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103986} | 7 个月前 | |
Remove some uses of GetIsolateFromHeapObject Replace them by Heap::FromWritableHeapObject() if it's debug-only code anyway, and by Isolate::Current() if we use the isolate for allocating handles. The only remaining call sites of GetIsolateFromHeapObject are now - for object printing, - for debugging (calling PushParamsAndDie), and - in DCHECKs. R=leszeks@chromium.org Bug: 431584880 Change-Id: I4ab92015208e1d8781b4403feea9c4faf308a0ea Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6929208 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#102606} | 9 个月前 | |
[heap] Add WriteBarrierModeScope This CL adds a new class WriteBarrierModeScope which we can use in debug builds to store the object the WriteBarrierMode was computed for by GetWriteBarrierModeForObject. We can use this additional information to strengthen the write barrier verification. In order to do so, this CL adds an additional WriteBarrierMode SKIP_WRITE_BARRIER_SCOPE. Any time this mode is used, the host object of the write barrier has to match the object stored in WriteBarrierModeScope. The split between SKIP_WRITE_BARRIER and SKIP_WRITE_BARRIER_SCOPED will also enable a follow-up CL to strength the write barrier verification where write barriers are removed statically. Bug: 437096305 Change-Id: Iaba6472e49c4ea34884f0707afd3309b984eaa54 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6839044 Reviewed-by: Anton Bikineev <bikineev@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#102006} | 10 个月前 | |
[cleanup] Use constraints instead of enable_if Run the modernize-use-constraints clang-tidy pass over our code base, with a few post-hoc cleanups around forward declared functions. Change-Id: If6169ce66544d5bab85b1c1a047807859df77bff Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6088210 Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#97727} | 1 年前 | |
[csa] Enforce valid Label for non-computed hashes in LoadNameHash Remove the default argument for if_hash_not_computed in CodeStubAssembler::LoadNameHash() and ensure that passed arguments are not null. This prevents accidental misuse of LoadNameHash() when either the hash can be non-computed and that case needs to be dealt with by the caller, or the hash is guaranteed to be computed (in that case LoadNameHashAssumeComputed should be used). Bug: 447954816 Change-Id: I1ef0fd2b53de6a7c4aabf5e807457e63ba0a86b5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7020171 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Patrick Thier <pthier@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#103026} | 8 个月前 | |
[cleanup] Remove HeapObject::GetReadOnlyRoots since we look up globals and thread locals for it, so expose the free function, and use that instead. HeapObject: :GetReadOnlyRoots doesn't need a heap object pointer anymore, ReadOnlyHeap: :GetReadOnlyRoots getter with a global GetReadOnlyRoots Change-Id: I9e2c58d8b70df3997915c1a64c6a690431d373da Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6097289 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#97798} | 1 年前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
Remove GetIsolate and GetHeap from never-read-only objects Those methods are guaranteed to always return the same as Isolate::Current() (since https://crrev.com/c/6458560), so we should use that directly. R=leszeks@chromium.org Bug: 396607238 Change-Id: I6b409115ba19cadf034b9f9591d65f0d3bcae9ff Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6582963 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#100470} | 1 年前 | |
[torque] Invert the default for @generateCppClass Since most Torque-defined extern classes use @generateCppClass, it makes more sense to instead annotate the small number that don't. This is part of the cleanup work that Nico recommended in [1]. Classes that still have to opt out: - Those that can be converted by https://crrev.com/c/3015666 - HeapObject: sort of special since it's the root of the inheritance hierarchy. Generated code would include two declarations that don't compile until HeapObject is defined: bool IsHeapObject_NonInline(HeapObject o); explicit TorqueGeneratedHeapObject( Address ptr, HeapObject::AllowInlineSmiStorage allow_smi); - SmallOrdered*: these classes use templates on the C++ side, which is not currently representable in Torque. - SwissNameDictionary: according to a comment, the Torque generation for this class is incorrect. I haven't investigated further. Drive-by fix: make the Torque formatter keep LF on Windows rather than writing CRLF. [1] https://docs.google.com/document/d/1q_gZLnXd4bGnCx3IUfbln46K3bSs9UHBGasy9McQtHI/edit# Bug: v8:8952 Change-Id: I1fbb5290f0c645842b84c53816c09bb3398206a5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3028721 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com> Cr-Commit-Position: refs/heads/master@{#75841} | 4 年前 | |
[heap] Split off trusted methods into TrustedHeapLayout This should make it easier for callers to see which calls can be trusted wrt to the V8 sandbox and which calls yield in untrusted data. Bug: 429538831 Change-Id: I4939d69665197e5de75ab5757edacc7f73c76745 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6889553 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#102070} | 10 个月前 | |
[tagged] Make InterpreterData HeapObjectLayout Move InterpreterData to be a HeapObjectLayout class. This required adding support for ExposedTrustedObjectLayout, and protected member fields. Bug: 42202654 Change-Id: Ie1b86a246a0ccd2c0126a16af81250c0666753e8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6701774 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#101262} | 11 个月前 | |
[hole] Make IsAnyHole DCHECKs cheaper Rather than checking for Trusted/Code space in the IsAnyHole DCHECKs (which requires memory chunk access), just check for the right cage base. This should make these checks cheaper on debug builds. Bug: 434179415 Change-Id: Idd8c54dd78ccafc422bf7ca0b1f62699dae1795d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6897572 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#102137} | 10 个月前 | |
[heap] Split off trusted methods into TrustedHeapLayout This should make it easier for callers to see which calls can be trusted wrt to the V8 sandbox and which calls yield in untrusted data. Bug: 429538831 Change-Id: I4939d69665197e5de75ab5757edacc7f73c76745 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6889553 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#102070} | 10 个月前 | |
[hole] Make IsAnyHole DCHECKs cheaper Rather than checking for Trusted/Code space in the IsAnyHole DCHECKs (which requires memory chunk access), just check for the right cage base. This should make these checks cheaper on debug builds. Bug: 434179415 Change-Id: Idd8c54dd78ccafc422bf7ca0b1f62699dae1795d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6897572 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#102137} | 10 个月前 | |
[casting] Remove Foo::cast Replace Foo::cast with Cast<Foo>. This is, blessedly, the same number of characters, and allows us to remove the need to declare cast functions in every type (instead using instance-type based type checks for most things, and a few template specializations of CastTraits for the remainder). Bug: 345640551 Change-Id: Ic215e2d4519f3128457db8a828a73c18204714bd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5614630 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#94425} | 2 年前 | |
[ptr-compr] Remove OnHeapAddress from Decompress Since we're using a global cage, we never need an OnHeapAddress for decompressing pointers. Remove this unused parameter. Change-Id: Ie14a7284c1e793c0b9e146a4e57f981a2985de27 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6481261 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#99866} | 1 年前 | |
[tagged-ptr] Introduce MaybeWeak for MaybeObject Introduce MaybeWeak<T> as a weakness sentinel type, representing a value in a Tagged<>/Handle<>/TNode<> which can be weak. This fulfils the role of MaybeObject in a more generic way, and indeed MaybeObject becomes a typedef for MaybeWeak<Object>. The methods on MaybeObject and HeapObjectReference become free functions, or are removed entirely in favour of implicit conversions (after all, any strong ref is also a maybe weak ref). This requires a few new specializations of Tagged, and some additional conversion logic. This CL is designed to be minimally invasive, converting MaybeObject to Tagged<MaybeObject> but trying to use the typedef and TaggedImpl methods as much as possible to minimise non-trivial code changes. In the future, we'll want to add a distinct Weak<T> for definitely weak values, and have conversions from Tagged<MaybeWeak<T>> to Tagged<T> that don't erase the type. Bug: v8:12710 Change-Id: I1b5df70b3d2028d46a09ca2cd9bd894a3fd8cb27 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5268603 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#92409} | 2 年前 | |
[tagged] Make InterpreterData HeapObjectLayout Move InterpreterData to be a HeapObjectLayout class. This required adding support for ExposedTrustedObjectLayout, and protected member fields. Bug: 42202654 Change-Id: Ie1b86a246a0ccd2c0126a16af81250c0666753e8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6701774 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#101262} | 11 个月前 | |
[objects] Convert Struct subclasses to HeapObjectLayout This CL ports TemplateObjectDescription, PropertyDescriptorObject, ArrayBoilerplateDescription, and ClassBoilerplate to use the new HeapObjectLayout definition. This involves: - Changing Torque definition annotations to @cppObjectLayoutDefinition. - Updating C++ headers to inherit from StructLayout and defining fields using TaggedMember. - Implementing inline accessors using TaggedMember methods. - Updating body descriptors and printers/verifiers. - Updating call sites (mostly in builtins and code stub assembler) to use offsetof() or public accessors. #ai-assisted Bug: 42202654 Change-Id: I1ca6ed69e4a20d3c9fd4343b84b23863c5558fae Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7177560 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103850} | 7 个月前 | |
[objects] Introduce HashTable::TryNew() returning MaybeHandle ... and make HashTable::New() return Handle again. The former is supposed to be used for the cases where we can handle exceeding maximum capacity (it returns empty handle without throwing an exception) while the latter is for the cases where we can't or don't expect too big capacity values (it reports fatal OOM as before). This CL - partially reverts https://crrev.com/c/6843055 because crashing inside ToHandleChecked() upon exceeding maximum table capacity is not convenient compared to reporting a fatal OOM, - lays ground for gradual migration of OOM "invalid table size" crashes to throwing RangeError exception. Bug: 41433527 Bug: 437245082 Fixed: 438523768 Change-Id: I76e1d75af9e62392e2c6a8f3c8d6881f15fa0b33 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6850486 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#101916} | 10 个月前 | |
[objects] Convert Struct subclasses to HeapObjectLayout This CL ports TemplateObjectDescription, PropertyDescriptorObject, ArrayBoilerplateDescription, and ClassBoilerplate to use the new HeapObjectLayout definition. This involves: - Changing Torque definition annotations to @cppObjectLayoutDefinition. - Updating C++ headers to inherit from StructLayout and defining fields using TaggedMember. - Implementing inline accessors using TaggedMember methods. - Updating body descriptors and printers/verifiers. - Updating call sites (mostly in builtins and code stub assembler) to use offsetof() or public accessors. #ai-assisted Bug: 42202654 Change-Id: I1ca6ed69e4a20d3c9fd4343b84b23863c5558fae Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7177560 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103850} | 7 个月前 | |
[objects] Convert Struct subclasses to HeapObjectLayout This CL ports TemplateObjectDescription, PropertyDescriptorObject, ArrayBoilerplateDescription, and ClassBoilerplate to use the new HeapObjectLayout definition. This involves: - Changing Torque definition annotations to @cppObjectLayoutDefinition. - Updating C++ headers to inherit from StructLayout and defining fields using TaggedMember. - Implementing inline accessors using TaggedMember methods. - Updating body descriptors and printers/verifiers. - Updating call sites (mostly in builtins and code stub assembler) to use offsetof() or public accessors. #ai-assisted Bug: 42202654 Change-Id: I1ca6ed69e4a20d3c9fd4343b84b23863c5558fae Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7177560 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103850} | 7 个月前 | |
[runtime] Remove maybe_redirected_ prefix from callback field names Most of the redirection-related logic is now hidden under the hood, there's no need to remind about it. Bug: 455600234 Change-Id: I7155f08df175410eab7c6a52af53b9924730eb59 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7151018 Reviewed-by: Patrick Thier <pthier@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103708} | 7 个月前 | |
TicketNo:DTS2026040312077;DTS2026040207037;DTS2026040207036;DTS2026040135724;DTS2026040135722;DTS2026032818442;DTS2026032530470;DTS2026032530464;DTS2026031327981;DTS2026031222703;DTS2026031222694;DTS2026031222686;DTS2026031222671;DTS2026031222662;DTS2026031222654 Description:【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Team:v8 Feature or Bugfix:Bugfix Binary Source:No PrivateCode(Yes/No):No Change-Id: Iae84c8fcc36a25b1936ec0997008368f70096cd6 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/534 Merged-by: public pjenkins Signed-off-by: Marja Hölttä <marja@chromium.org> | 1 个月前 | |
TicketNo:DTS2026040312077;DTS2026040207037;DTS2026040207036;DTS2026040135724;DTS2026040135722;DTS2026032818442;DTS2026032530470;DTS2026032530464;DTS2026031327981;DTS2026031222703;DTS2026031222694;DTS2026031222686;DTS2026031222671;DTS2026031222662;DTS2026031222654 Description:【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Team:v8 Feature or Bugfix:Bugfix Binary Source:No PrivateCode(Yes/No):No Change-Id: Iae84c8fcc36a25b1936ec0997008368f70096cd6 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/534 Merged-by: public pjenkins Signed-off-by: Marja Hölttä <marja@chromium.org> | 1 个月前 | |
[runtime] Remove maybe_redirected_ prefix from callback field names Most of the redirection-related logic is now hidden under the hood, there's no need to remind about it. Bug: 455600234 Change-Id: I7155f08df175410eab7c6a52af53b9924730eb59 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7151018 Reviewed-by: Patrick Thier <pthier@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103708} | 7 个月前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
Include guards should be at the top of files. For the include guard optimization to kick in the include guards should be the first thing in the file, not counting comments. In some cases the guard has been moved above a comment for consistency even though this does not matter. A couple of include guards have been renamed for uniqueness. git cl upload complained about some lint nits which have been fixed. Change-Id: Iaa208ea6557c36c84bc7bb77c787ba9feb7cf037 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6275067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98907} | 1 年前 | |
[torque] generate C++ class definitions per Torque file This CL splits the class definitions per .tq file, to realize the following relationship: A class defined in src/objects/foo.tq has a C++ definition in src/objects/foo.h. Torque then generates: - torque-generated/src/objects/foo-tq.inc An include file (no proper header) to be included in src/objects/foo.h containing the Torque-generated C++ class definition. - torque-generated/src/objects/foo-tq-inl.inc An include file (no proper header) to be included in src/objects/foo-inl.h containing inline function definitions. - torque-generated/src/objects/foo-tq.cc A source file including src/objects/foo-inl.h that contains non-inline function definitions. Advantages of this approach: - Avoid big monolithic headers and preserve the work that went into splitting objects.h - Moving a definition to Torque keeps everything in the same place from a C++ viewpoint, including a fully Torque-generated C++ class definition. - The Torque-generated include files do not need to be independent headers, necessary includes or forward declarations can just be added to the headers that include them. Drive-by changes: A bunch of definitions and files had to be moved or created to realize a consistent 1:1 relationship between .tq files and C++ headers. Bug: v8:7793 TBR: hpayer@chromium.org Change-Id: I239a89a16d0bc856a8669d7c92aeafe24a7c7663 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2470571 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Seth Brenith <seth.brenith@microsoft.com> Cr-Commit-Position: refs/heads/master@{#70853} | 5 年前 | |
[runtime] Don't bother sorting short DescriptorArrays ... and TransitionArrays for which we use linear search anyway. Drive-by: set DA's and TA's kMaxElementsForLinearSearch limit for runtime lookups to 32 to match previous CSA::Lookup<Array>(..) implementation. Bug: 455900157 Change-Id: Ie52e64d1fdada2d6c188e28857859726a414b56d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7090677 Auto-Submit: Igor Sheludko <ishell@chromium.org> Commit-Queue: Patrick Thier <pthier@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103387} | 8 个月前 | |
[runtime] Don't bother sorting short DescriptorArrays ... and TransitionArrays for which we use linear search anyway. Drive-by: set DA's and TA's kMaxElementsForLinearSearch limit for runtime lookups to 32 to match previous CSA::Lookup<Array>(..) implementation. Bug: 455900157 Change-Id: Ie52e64d1fdada2d6c188e28857859726a414b56d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7090677 Auto-Submit: Igor Sheludko <ishell@chromium.org> Commit-Queue: Patrick Thier <pthier@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103387} | 8 个月前 | |
[runtime] Don't bother sorting short DescriptorArrays ... and TransitionArrays for which we use linear search anyway. Drive-by: set DA's and TA's kMaxElementsForLinearSearch limit for runtime lookups to 32 to match previous CSA::Lookup<Array>(..) implementation. Bug: 455900157 Change-Id: Ie52e64d1fdada2d6c188e28857859726a414b56d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7090677 Auto-Submit: Igor Sheludko <ishell@chromium.org> Commit-Queue: Patrick Thier <pthier@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103387} | 8 个月前 | |
[sandbox] Expand trusted object unpublishing mechanism This CL expands the "publishing" mechanism for trusted objects. Previously, we already had a special "unpublished" tag that could be used to make trusted objects inaccessible from within the sandbox. We now expand the machinery around this tag to allow objects to be allocated in an unpublished state and then be published later on. For that, we also fix a bug that previously allowed unpublished objects to still be accessed from inside the sandbox through the kUnknownIndirectPointerTag (used e.g. for the SFI). The new, more flexible unpublishing mechanism will be used in follow-up CLs to make bytecode inaccessible until it has been validated. Drive-By: rename init_self_indirect_pointer to InitAndPublish since this method does non-trivial work and so should probably be uppercased. Bug: 461681036 Change-Id: Iad0224beb89ef1bd625b5cdc51a77cef12642159 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7172412 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#103956} | 7 个月前 | |
[sandbox] Expand trusted object unpublishing mechanism This CL expands the "publishing" mechanism for trusted objects. Previously, we already had a special "unpublished" tag that could be used to make trusted objects inaccessible from within the sandbox. We now expand the machinery around this tag to allow objects to be allocated in an unpublished state and then be published later on. For that, we also fix a bug that previously allowed unpublished objects to still be accessed from inside the sandbox through the kUnknownIndirectPointerTag (used e.g. for the SFI). The new, more flexible unpublishing mechanism will be used in follow-up CLs to make bytecode inaccessible until it has been validated. Drive-By: rename init_self_indirect_pointer to InitAndPublish since this method does non-trivial work and so should probably be uppercased. Bug: 461681036 Change-Id: Iad0224beb89ef1bd625b5cdc51a77cef12642159 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7172412 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#103956} | 7 个月前 | |
[sandbox] Introduce TrustedPointer type in torque Previously, we needed constructs such as: @if(V8_ENABLE_SANDBOX) foo: IndirectPointer<Foo>; @ifnot(V8_ENABLE_SANDBOX) foo: Foo; Outside of torque, we simply call these "trusted pointers" (pointers to trusted objects that are indirect pointers if the sandbox is enabled, and otherwise regular tagged pointer). With this CL, we now have a TrustedPointer in torque (instead of the under-the-hood IndirectPointer type), so the above now simply becomes: foo: TrustedPointer<Foo>; Bug: 40069826 Change-Id: I727285c52ef0377f78641bf9f6f7b6b81443dfb9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5743494 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#95313} | 1 年前 | |
[sandbox] Expand trusted object unpublishing mechanism This CL expands the "publishing" mechanism for trusted objects. Previously, we already had a special "unpublished" tag that could be used to make trusted objects inaccessible from within the sandbox. We now expand the machinery around this tag to allow objects to be allocated in an unpublished state and then be published later on. For that, we also fix a bug that previously allowed unpublished objects to still be accessed from inside the sandbox through the kUnknownIndirectPointerTag (used e.g. for the SFI). The new, more flexible unpublishing mechanism will be used in follow-up CLs to make bytecode inaccessible until it has been validated. Drive-By: rename init_self_indirect_pointer to InitAndPublish since this method does non-trivial work and so should probably be uppercased. Bug: 461681036 Change-Id: Iad0224beb89ef1bd625b5cdc51a77cef12642159 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7172412 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#103956} | 7 个月前 | |
[tagged] Introduce TrustedPointerMember This helper class simplifies defining trusted pointer members in HeapObjectLayout subclasses. Bug: 42202654 Change-Id: I505f9f70a0128899d13a464eda15026f5a435cc0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7181920 Reviewed-by: Samuel Groß <saelo@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#103897} | 7 个月前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[tagged-ptr] Make accessors tagged Bug: v8:12710 Change-Id: I3d33e1f7d1550b46c5dddc4be212c965c6e2d0a4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4760786 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#89681} | 2 年前 | |
[turbofan] Add a TypeGuard if we know the object is a typed array This is needed for supporting the TypedArrayLength operation. Both RAB/GSAB and non-RAB/GSAB TAs will now be type TypedArray, but the TypeGuard is only required for cases where the relevant maps are non-RAB/GSAB TypedArrays, since for those we will use a TypedArrayLength custom operation. Bug: 388844115, 390465674 Fixed: 390465674 Change-Id: I1fb6e15aa8eb21f530f825aac67b9f9784f0dd93 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6212601 Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/main@{#98469} | 1 年前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[turboshaft] Basic TypedOptimization and new DeadCodeElimination This CL introduces typed optimizations for Turboshaft, which replaces all operations that produce a constant output (and don't have side effects) by the corresponding constant. In addition, a new pass for eliminating dead code is introduced that cannot only remove dead operations, but also rewrite branches that are not required into GotoOps. Drive-by: Introduce -0 as a "special value" for Float32Type and Float64Type to fix a few issues where 0 and -0 have been treated as identical. Bug: v8:12783 Change-Id: Ia1450ad7a9abb5d58c7d753596ed08a33a73184f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4110993 Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#85143} | 3 年前 | |
[turboshaft] Improve DebugPrint In particular, provide support for more types and allow an additional label to be passed as an optional argument. Bug: 348031042 Change-Id: Ia824da7924b32dbe479113046b63028f716b9f46 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6917702 Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Jakob Linke <jgruber@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#102352} | 9 个月前 | |
[maglev] Support null === string comparisons Bug: 421202289 Change-Id: I8070d133adb51dba770ab3bb91386624ad43c716 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6372503 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by: Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/main@{#100587} | 1 年前 | |
[maglev] Support null === string comparisons Bug: 421202289 Change-Id: I8070d133adb51dba770ab3bb91386624ad43c716 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6372503 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by: Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/main@{#100587} | 1 年前 | |
Reland "[hole] DCHECK that we don't access the hole map" This is a reland of commit 99f667c6c38669c0f4556e73553987b2da69b2ed Reland fixes: * Put the check behind a flag to make this incremental. * Only check the hole in left-trimming if we can do a value check. Original change's description: > [hole] DCHECK that we don't access the hole map > > Only ever check holes by value, never by map or instance type. This will > allow us to unmap the holes entirely, and use them only as sentinel > values. > > Bug: 434179415 > Change-Id: I3f1eca4049423f39fa10c8761460378d64a92ea3 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6845798 > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Cr-Commit-Position: refs/heads/main@{#102111} Bug: 434179415 Change-Id: Ifbebea894647608b9459dfabf948818909febc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6899264 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102123} | 10 个月前 | |
[wasm] Update ByteLength when rematerializing a GSAB Bug: 456131917 Change-Id: I2eeee41f3dadaadc7aa4250bdb223fd950fe093b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7181647 Commit-Queue: Deepti Gandluri <gdeepti@chromium.org> Reviewed-by: Thibaud Michaud <thibaudm@chromium.org> Cr-Commit-Position: refs/heads/main@{#103880} | 7 个月前 | |
[handles] Migration to direct handles, part 15 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, asmjs, codegen, debug, diagnostics, execution, handles, heap, ic, json, logging, objects, profiler, regexp, runtime, snapshot, wasm, and tests. Bug: 42203211 Change-Id: Ibd2ffc4fc239088de175011e90e8dc5cadba3236 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6218795 Reviewed-by: Omer Katz <omerkatz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#98501} | 1 年前 | |
[heap] Fix MinorMS without CSS Since https://crrev.com/c/6448975, which changed the flag used for conservative stack scanning (CSS) from a build flag to a run-time flag, the Minor Mark-and-Sweep garbage collector scans the stack conservatively while marking even if the flag is disabled. This CL fixes the issue. It also performs some minor cleaning-up related to the stack and stack visitors. Bug: 40096225 Bug: 41480448 Change-Id: I21006d5209f754d92bab314431f32329f90247af Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Cq-Include-Trybots: luci.v8.try:v8_linux64_minor_mc_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6842421 Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Cr-Commit-Position: refs/heads/main@{#101878} | 10 个月前 | |
[code] Add RelocInfo for JSDispatchHandle Allow embedding JSDispatchHandle directly in instruction streams, to allow (in followup work) calling functions via dispatch handle directly. Change-Id: I2f87e4648f7f8048235ee0d5ac2171eba941e9aa Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6063125 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#97549} | 1 年前 | |
[heap] Remove OffHeapFullPointerSlot The reason to have OffHeap- variants of compressed pointer slots is to remove the operator*, which would not work - it uses the location of the slot to work out the base of the pointer cage. However the operator* of a FullPointerSlot works just fine, even off-heap, because it doesn't need any cage base to decompress a pointer that is not compressed. We were not consistently using OffHeapFullPointerSlot anyway - VisitRoots was not using it even though roots are off-heap. Change-Id: I296385f7ee7022e8b9ad2a52770f458051f971ef Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7002994 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102954} | 8 个月前 | |
[shared-struct] Remove lockAsync and waitAsync APIs Remove lockAsync and waitAsync experimental APIs. These are not needed right now, they are listed as future work in the TC39 shared structs proposal. Bug: 42202493 Change-Id: I47b93e056c76d20fa3a943a841aeffc4ca5021c2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7139418 Reviewed-by: Olivier Flückiger <olivf@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Luis Pardo <lpardosixtos@microsoft.com> Cr-Commit-Position: refs/heads/main@{#103652} | 7 个月前 | |
[shared-struct] Remove lockAsync and waitAsync APIs Remove lockAsync and waitAsync experimental APIs. These are not needed right now, they are listed as future work in the TC39 shared structs proposal. Bug: 42202493 Change-Id: I47b93e056c76d20fa3a943a841aeffc4ca5021c2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7139418 Reviewed-by: Olivier Flückiger <olivf@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Luis Pardo <lpardosixtos@microsoft.com> Cr-Commit-Position: refs/heads/main@{#103652} | 7 个月前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 1 年前 | ||
| 1 年前 | ||
| 5 年前 | ||
| 10 个月前 | ||
| 9 个月前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 8 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 个月前 | ||
| 1 年前 | ||
| 6 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 11 个月前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 10 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 9 个月前 | ||
| 9 个月前 | ||
| 9 个月前 | ||
| 8 个月前 | ||
| 10 个月前 | ||
| 10 个月前 | ||
| 10 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 6 个月前 | ||
| 6 个月前 | ||
| 6 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 8 个月前 | ||
| 8 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 9 个月前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 8 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 8 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 8 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 年前 | ||
| 10 个月前 | ||
| 1 年前 | ||
| 4 年前 | ||
| 9 个月前 | ||
| 10 个月前 | ||
| 9 个月前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 9 个月前 | ||
| 8 个月前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 10 个月前 | ||
| 7 个月前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 11 个月前 | ||
| 11 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 6 年前 | ||
| 8 个月前 | ||
| 8 个月前 | ||
| 1 年前 | ||
| 9 个月前 | ||
| 2 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 2 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 10 个月前 | ||
| 1 年前 | ||
| 10 个月前 | ||
| 8 个月前 | ||
| 8 个月前 | ||
| 4 年前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 2 年前 | ||
| 10 个月前 | ||
| 10 个月前 | ||
| 10 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 2 年前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 4 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 4 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 11 个月前 | ||
| 1 个月前 | ||
| 11 个月前 | ||
| 11 个月前 | ||
| 1 年前 | ||
| 11 个月前 | ||
| 11 个月前 | ||
| 2 年前 | ||
| 10 个月前 | ||
| 10 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 11 个月前 | ||
| 2 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 8 个月前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 4 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 11 个月前 | ||
| 11 个月前 | ||
| 4 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 8 个月前 | ||
| 4 年前 | ||
| 1 年前 | ||
| 3 个月前 | ||
| 3 个月前 | ||
| 3 年前 | ||
| 6 个月前 | ||
| 1 个月前 | ||
| 6 个月前 | ||
| 6 个月前 | ||
| 1 年前 | ||
| 8 个月前 | ||
| 11 个月前 | ||
| 3 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 3 年前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 5 年前 | ||
| 4 年前 | ||
| 8 个月前 | ||
| 9 个月前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 11 个月前 | ||
| 2 年前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 年前 | ||
| 11 个月前 | ||
| 11 个月前 | ||
| 2 年前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 年前 | ||
| 4 年前 | ||
| 4 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 3 年前 | ||
| 1 年前 | ||
| 10 个月前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 11 个月前 | ||
| 11 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 10 个月前 | ||
| 1 年前 | ||
| 9 个月前 | ||
| 9 个月前 | ||
| 8 个月前 | ||
| 8 个月前 | ||
| 1 个月前 | ||
| 9 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 10 个月前 | ||
| 1 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 7 年前 | ||
| 2 年前 | ||
| 6 个月前 | ||
| 6 个月前 | ||
| 6 个月前 | ||
| 10 个月前 | ||
| 1 年前 | ||
| 1 个月前 | ||
| 7 个月前 | ||
| 10 个月前 | ||
| 1 年前 | ||
| 3 个月前 | ||
| 3 个月前 | ||
| 8 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 4 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 8 个月前 | ||
| 1 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 1 个月前 | ||
| 2 年前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 8 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 3 年前 | ||
| 1 个月前 | ||
| 8 个月前 | ||
| 1 年前 | ||
| 6 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 8 个月前 | ||
| 1 年前 | ||
| 11 个月前 | ||
| 11 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 4 年前 | ||
| 11 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 8 个月前 | ||
| 1 年前 | ||
| 8 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 3 个月前 | ||
| 1 个月前 | ||
| 3 个月前 | ||
| 3 个月前 | ||
| 1 年前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 7 个月前 | ||
| 10 个月前 | ||
| 11 个月前 | ||
| 1 年前 | ||
| 7 年前 | ||
| 9 个月前 | ||
| 8 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 9 个月前 | ||
| 8 个月前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 8 个月前 | ||
| 8 个月前 | ||
| 8 个月前 | ||
| 1 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 9 个月前 | ||
| 10 个月前 | ||
| 1 年前 | ||
| 8 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 4 年前 | ||
| 10 个月前 | ||
| 11 个月前 | ||
| 10 个月前 | ||
| 10 个月前 | ||
| 10 个月前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 11 个月前 | ||
| 7 个月前 | ||
| 10 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 5 年前 | ||
| 8 个月前 | ||
| 8 个月前 | ||
| 8 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 3 年前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 10 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 10 个月前 | ||
| 1 年前 | ||
| 8 个月前 | ||
| 7 个月前 | ||
| 7 个月前 |