| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
buganizer: fix component IDs in DIR_METADATA This only matches the old monorail components. Bug: 341800538 Change-Id: Id74fbdb3b9be0c858b77af84966c6c37adf78c5c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6025833 Reviewed-by: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Paul Semel <paulsemel@chromium.org> Commit-Queue: Paul Semel <paulsemel@chromium.org> Cr-Commit-Position: refs/heads/main@{#97252} | 1 年前 | |
Add DIR_METADATA files to v8. Generate DIR_METADATA files and remove metadata from OWNERS files for v8. R=jkummerow@chromium.org, ochang@chromium.org, yangguo@chromium.org Bug: chromium:1113033 Change-Id: I82cbb62e438d82dbbc408e87120af39fa9da0afa Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2476680 Reviewed-by: Adam Klein <adamk@chromium.org> Reviewed-by: Maya Lekova <mslekova@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Yang Guo <yangguo@chromium.org> Commit-Queue: Edward Lesmes <ehmaldonado@chromium.org> Auto-Submit: Edward Lesmes <ehmaldonado@chromium.org> Cr-Commit-Position: refs/heads/master@{#70669} | 5 年前 | |
[array] Clarify Array ctor speculation .. for single-arg, non-number calls. These are treated as Array(single_element_value) instead. Also, be more precise about semantics when the argument *is* a Number. Change-Id: I5a08718327759863e3414bae999697a690d10514 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7031559 Auto-Submit: Jakob Linke <jgruber@chromium.org> Commit-Queue: Jakob Linke <jgruber@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#103049} | 8 个月前 | |
Fix usage of GetBuffer Need to fix a few more spots after http://crrev.com/c/6582961 Bug: 396607238 Change-Id: Ib55129bcd114b9ac08d32720ae45a57e15e905f6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6578146 Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Milad Farazmand <mfarazma@redhat.com> Cr-Commit-Position: refs/heads/main@{#100475} | 1 年前 | |
[handles] Migration to direct handles, part 13 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, ast, builtins, codegen, compiler, debug, deoptimizer, execution, heap, ic, init, interpreter, json, maglev, objects, parsing, regexp, runtime, snapshot, strings, temporal, wasm, and in tests. Bug: 42203211 Change-Id: Icb4238ee9082865dae47dce025e529a1c3fdfc48 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6189992 Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Omer Katz <omerkatz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#98283} | 1 年前 | |
[builtins] Verify CanAllocate effects for builtins in Turboshaft/Maglev Bug: 42204439 Change-Id: If13d9f78ddcfb77ccc14749a534ac1711dac3754 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6372502 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#100113} | 1 年前 | |
[collections] Properly overwrite allocation failure exception ... thrown from OrderedHashTable::Allocate(..) when max capacity is exceeded. Drive-by: * use a more suitable generic message for exception thrown from the Allocate(..) function, * add mjsunit/lower_limits_mode/ folder for tests that should be run only in lower limits mode and moved respective tests there. Fixed: 405910175 Change-Id: Ib7c6f33bb29528b2216c02220d5de8097f14eb73 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6388619 Reviewed-by: Marja Hölttä <marja@chromium.org> Auto-Submit: Igor Sheludko <ishell@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#99442} | 1 年前 | |
Reland "[tiering] Uniformly treat deopts which don't invalidate code" This is a reland of commit f7c2751ff9e362b668f6c0fbbcf2df2fe68f1635 Fix: Move new fields to the end of the Deoptimizer to fix access on arm Drive-By: Cleanup DeoptInfo to not record/read unused data Original change's description: > [tiering] Uniformly treat deopts which don't invalidate code > > There are currently two situations where deopts don't invalidate code: > * deopt in osr code and the deopt is outside the loop > * deopt to be able to osr from maglev to turbofan > > We should ensure that the deoptimizer and NotifyDeoptimized (a runtime > function which runs after the deoptimizer is done) agree on when code > needs to be discarded and when not. > > Also, if code is not discarded, or if deopts don't affect the main code, > we shouldn't change the tiering state. > > Drive-By: > * Read DeoptInfo only once and cache it. > * Reset tiering state only once. > > Change-Id: If789b6bbcab55eccf76010585152b1593b72134e > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7036595 > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Commit-Queue: Toon Verwaest <verwaest@chromium.org> > Auto-Submit: Olivier Flückiger <olivf@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103114} Change-Id: Id86574b5a91588c8fcf12b29f49da5bb67ef74f9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7046222 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#103747} | 7 个月前 | |
Updates time functions in v8::Platform This adds the following: 1. CurrentClockTimeMilliseconds(), which returns the time in milliseconds (int64_t). 2. CurrentClockTimeMillisecondsHighResolution, which returns the time with microsecond accuracy (double). Both are implemented in terms of the existing CurrentClockTimeMillis. Chrome's implementation of CurrentClockTimeMillis has code to jitter the results. This code is expensive, and when ms accuracy is needed (case 1) only necessary a small fraction of the time. Adding CurrentClockTimeMilliseconds allows chrome to optimize this case. Bug: chromium:1414615 Change-Id: Ic47b503511bc633416d77843ce4bd45c76f99cc7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4246257 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Scott Violet <sky@chromium.org> Cr-Commit-Position: refs/heads/main@{#85869} | 3 年前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
[builtins] Verify CanAllocate effects for builtins in Turboshaft/Maglev Bug: 42204439 Change-Id: If13d9f78ddcfb77ccc14749a534ac1711dac3754 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6372502 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#100113} | 1 年前 | |
Remove last uses of GetIsolate and GetHeap This is the manual follow-up to the mostly automatic https://crrev.com/c/6495413. Those methods will be removed in a follow-up (https://crrev.com/c/6582963). Depending on what makes most sense, we either use Isolate::Current() directly, or store it in a variable that is reused multiple times, or we pass the isolate as a parameter. R=leszeks@chromium.org Bug: 396607238 Change-Id: I9366410849cd4fa39fb792db9bb2ad35dba86ffe Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6582961 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#100468} | 1 年前 | |
[handles] Migration to direct handles, part 8 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, asmjs, builtins, codegen, compiler, date, debug, diagnostics, execution, heap, ic, init, interpreter, json, logging, objects, parsing, regexp, runtime, snapshot, strings, wasm. Bug: 42203211 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Change-Id: Ib35bb03997bb4a646c56674f834b952dffdeaf02 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6074945 Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#97624} | 1 年前 | |
Throw TypeError with detailed error message The default behavior is to use the callable check in [[call]], which produces a "the identifier is not callable" message. Function.prototype.apply and Function.prototype.call produces "Uncaught TypeError: <ident> is not a function " and Reflect.apply() produces "TypeError: Function.prototype.apply was called on undefined, which is a undefined and not a function" differently. Therefore, check the callable of each call path and modify the error message template to include the method name and target, to produce an error message same with Reflect.apply(). Bug: 352528966 Change-Id: I47fffc0d9a69ca956ad3960e78e552b6d6fa0218 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5806138 Commit-Queue: Seokho Song <seokho@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102394} | 9 个月前 | |
Reland "Remove g_thread_in_wasm_code flag" This is a reland of commit 73288e18ba967b06e73cacd8f1659529915e3097 For ASan on Windows, we need more function to run without ASan instrumentation now. Original change's description: > Remove g_thread_in_wasm_code flag > > Keeping track of whether a thread is currently executing Wasm code or > not has become quite complex (see size of this change) and therefore a > maintenance burden. Furthermore, this feature now conflicts with future > V8 sandbox advancements as we want to forbid writes from sandboxed code > (which includes all Wasm code) to out-of-sandbox memory. As such, we can > no longer write to thread-local storage (where the flag was stored). > > This CL replaces the flag with a simpler guarding mechanism that ensures > that the trap handler is robust against nested faults and deadlocks. In > essence, we now set a thread-local flag (only) when entering the trap > handler or taking one of the locks used by it. If the flag is already > set when entering the trap handler, then we bail out immediately as it > means that we're either handling a nested fault (which we shouldn't) or > risk running into a deadlock because the current thread holds one of the > locks required by the trap handler. > > Bug: 350324877, 40192807 > Change-Id: Idb9fce83ac9b46ab04fd93d5bdbd8cb8c0722488 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6650680 > Reviewed-by: Clemens Backes <clemensb@chromium.org> > Reviewed-by: Mark Seaborn <mseaborn@chromium.org> > Commit-Queue: Samuel Groß <saelo@chromium.org> > Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Cr-Commit-Position: refs/heads/main@{#101213} Bug: 350324877, 40192807 Change-Id: I9c5a6b3820181129fa7ed4240831cfc1dbef1697 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6700520 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#101275} | 11 个月前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
[handles] Migration to direct handles, part 10 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, ast, builtins, codegen, compiler, d8, debug, deoptimizer, execution, extensions, heap, ic, init, json, logging, objects, parsing, profiler, regexp, runtime, snapshot, wasm. Bug: 42203211 Change-Id: I160d5a74aecc6533db51323f0b96ef057cb22426 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6091534 Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#97865} | 1 年前 | |
[js] Expose hole NaN via runtime functions Also move %GetHoleNaNUpper and %GetHoleNaNLower to the test macro so that they do something more useful than returning undefined when the --fuzzing flag is set. Bug: 457866804 Change-Id: Ia52b5bc0d19c3f59ae19247959d24780474d4b48 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7137442 Commit-Queue: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#103630} | 7 个月前 | |
[ic] Fix fast path in LoadIC's slow handler ... for the case when the lookup start object is a named interceptor (the interceptor callback should be called before the own property lookup). Bug: 455600234 Change-Id: Idb0384a48a7b08593a56682b1763231a7b974b21 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7128781 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Auto-Submit: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#103601} | 7 个月前 | |
[builtins] Verify CanAllocate effects for builtins in Turboshaft/Maglev Bug: 42204439 Change-Id: If13d9f78ddcfb77ccc14749a534ac1711dac3754 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6372502 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#100113} | 1 年前 | |
[handles] Migration to direct handles, part 11 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, ast, baseline, builtins, codegen, compiler, d8, debug, diagnostics, execution, heap, ic, maglev, objects, profiler, runtime, snapshot, wasm. Bug: 42203211 Change-Id: Id8512e84fca9ecbd85b157409b24e17296efd399 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6102545 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Cr-Commit-Position: refs/heads/main@{#97875} | 1 年前 | |
[handles] Migration to direct handles, part 8 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, asmjs, builtins, codegen, compiler, date, debug, diagnostics, execution, heap, ic, init, interpreter, json, logging, objects, parsing, regexp, runtime, snapshot, strings, wasm. Bug: 42203211 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Change-Id: Ib35bb03997bb4a646c56674f834b952dffdeaf02 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6074945 Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#97624} | 1 年前 | |
[regexp] Fix potential overflow on 32-bit builds In RegExpMatchGlobalAtom_OneCharPattern, if subject is allocated at a high address, it is possible that block + stride * max_count overflows on 32-bit builds on a 64-bit platform. Fix this by comparing stride * max_count against the remaining length. Fixed: 449767585 Change-Id: I6a7be4064f53a2282b98c6a1f342e1b646d29b71 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7021933 Auto-Submit: Patrick Thier <pthier@chromium.org> Reviewed-by: Jakob Linke <jgruber@chromium.org> Commit-Queue: Jakob Linke <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#103009} | 8 个月前 | |
[explicit-resource-management] Prevent assignment to await using vars This CL added the missing check to prevent assignments to variables declared with await using. Assignment to using variables were handled correctly. Fixed: 459312330 Change-Id: I424d3db8aa3d5e6bc52925acc28bae2acf712b6c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7137040 Reviewed-by: Olivier Flückiger <olivf@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Cr-Commit-Position: refs/heads/main@{#103678} | 7 个月前 | |
Reland "[handles] Migration to direct handles, part 12" This is a reland of commit 5fa54d85a10049a55ba2fa02bc05145ddee7d19a Original change's description: > [handles] Migration to direct handles, part 12 > > This CL migrates a large number of handles to direct handles. The > changes are only relevant for builds with v8_enable_direct_handle=true. > > Affected source directories: api, asmjs, ast, builtins, codegen, > compiler, d8, debug, deoptimizer, diagnostics, execution, extensions, > heap, ic, init, interpreter, json, maglev, objects, parsing, profiler, > regexp, runtime, snapshot, strings, wasm, and tests. > > Bug: 42203211 > Change-Id: I2334b3295e5780e8f52d0b13d1545dce29fcf81e > Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6181904 > Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> > Reviewed-by: Omer Katz <omerkatz@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Cr-Commit-Position: refs/heads/main@{#98240} Bug: 42203211 Change-Id: Ie21acd681c12e7212185d61a19bd858365650204 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6187462 Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#98249} | 1 年前 | |
[objects] Introduce HashTable::TryNew() returning MaybeHandle ... and make HashTable::New() return Handle again. The former is supposed to be used for the cases where we can handle exceeding maximum capacity (it returns empty handle without throwing an exception) while the latter is for the cases where we can't or don't expect too big capacity values (it reports fatal OOM as before). This CL - partially reverts https://crrev.com/c/6843055 because crashing inside ToHandleChecked() upon exceeding maximum table capacity is not convenient compared to reporting a fatal OOM, - lays ground for gradual migration of OOM "invalid table size" crashes to throwing RangeError exception. Bug: 41433527 Bug: 437245082 Fixed: 438523768 Change-Id: I76e1d75af9e62392e2c6a8f3c8d6881f15fa0b33 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6850486 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#101916} | 10 个月前 | |
[builtins] Verify CanAllocate effects for builtins in Turboshaft/Maglev Bug: 42204439 Change-Id: If13d9f78ddcfb77ccc14749a534ac1711dac3754 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6372502 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#100113} | 1 年前 | |
[wasm][compilation-hints] Write compilation hints to stdout and file We generate the compilation-hints sections from a module, based on collected feedback, behind a couple of new flags. Namely: - We generate the compilation-priority section based on whether a function was compiled and/or marked for tierup. We always generate a 0 compilation priority if the function was compiled, and a 0 optimization priority if it was also marked for tierup. Note that we do not actually tier up in this configuration. - We generate the instruction-frequencies and call-targets sections based on collected liftoff feedback. The flag --wasm-generate-compilation-hints writes a proper wasm module to a file, containing only the new sections. The flag --trace-wasm-generate-compilation-hints emits a textual representation of these sections to stdout. Bug: 405952385 Change-Id: Ibb89123966c4ed3ced77fcefd028f535495f2b30 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7157372 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#103947} | 7 个月前 | |
Reland^2 "Embedding feedback in BytecodeArray for StrictEqual" This is a reland of commit e295f1f18da01c386eda73f535fb67a56c004d88 Original change's description: > Reland "Embedding feedback in BytecodeArray for StrictEqual" > > This is a reland of commit f0fed41e48b1966e3e565ae278d018da538ef123 > > Original change's description: > > Embedding feedback in BytecodeArray for StrictEqual > > > > This CL removes the feedback vector slot for StrictEqual and stores its feedback values directly in the BytecodeArray. Optimized compilers will now access the type feedback from the BytecodeArray. > > > > Before: > > 75 04 00 TestEqualStrict a1, [0] > > > > After: > > 75 04 00 00 TestEqualStrict a1, #0 > > > > This change saves moemory by reducing FeedbackVector size, and is part of the Sparkplug+ optimization effort. > > > > Bug: chromium:429351411 > > Change-Id: I24390811c12755b0a19beaefe2b0319d75ceaf6c > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6986847 > > Reviewed-by: Xu, Hao A <hao.a.xu@intel.com> > > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#103656} > > Bug: chromium:429351411 > Change-Id: I77286b0e9c65f8a9e257a2125adab7f68fe09aec > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7148333 > Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> > Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103800} Bug: chromium:429351411 Change-Id: I5020c9dffbed90ff207520728b13cf0dbcfb5903 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7197099 Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Wei, Yuheng <yuheng.wei@intel.com> Cr-Commit-Position: refs/heads/main@{#103962} | 7 个月前 | |
[interpreter] Improve bytecode disassembler output Pass the constant pool to the bytecode decoder, so that constants can be printed as part of the bytecode itself. Also improve printing of the new split index types. Change-Id: Ia65149765b03a8d2665810b1d377e5b497600d15 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7209311 Commit-Queue: Patrick Thier <pthier@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#104020} | 7 个月前 | |
[rab/gsab] Handle GSABs growing during sorting gracefully The previous sandbox hardening ( https://chromium-review.googlesource.com/c/v8/v8/+/6268383 ) was not correct; it didn't handle the case that the GSAB is grown by a background thread gracefully. The easiest fix is to avoid reading the length again and figure out how many elements we need to sort based on the byte_length we already read. Bug: 385775375 Change-Id: I70f0b051ffad61f1f80cd50f0dbdbd0fa7ab1287 Fixed: 439522866 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6918956 Reviewed-by: Anton Bikineev <bikineev@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/main@{#102346} | 9 个月前 | |
Reland "Remove g_thread_in_wasm_code flag" This is a reland of commit 73288e18ba967b06e73cacd8f1659529915e3097 For ASan on Windows, we need more function to run without ASan instrumentation now. Original change's description: > Remove g_thread_in_wasm_code flag > > Keeping track of whether a thread is currently executing Wasm code or > not has become quite complex (see size of this change) and therefore a > maintenance burden. Furthermore, this feature now conflicts with future > V8 sandbox advancements as we want to forbid writes from sandboxed code > (which includes all Wasm code) to out-of-sandbox memory. As such, we can > no longer write to thread-local storage (where the flag was stored). > > This CL replaces the flag with a simpler guarding mechanism that ensures > that the trap handler is robust against nested faults and deadlocks. In > essence, we now set a thread-local flag (only) when entering the trap > handler or taking one of the locks used by it. If the flag is already > set when entering the trap handler, then we bail out immediately as it > means that we're either handling a nested fault (which we shouldn't) or > risk running into a deadlock because the current thread holds one of the > locks required by the trap handler. > > Bug: 350324877, 40192807 > Change-Id: Idb9fce83ac9b46ab04fd93d5bdbd8cb8c0722488 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6650680 > Reviewed-by: Clemens Backes <clemensb@chromium.org> > Reviewed-by: Mark Seaborn <mseaborn@chromium.org> > Commit-Queue: Samuel Groß <saelo@chromium.org> > Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Cr-Commit-Position: refs/heads/main@{#101213} Bug: 350324877, 40192807 Change-Id: I9c5a6b3820181129fa7ed4240831cfc1dbef1697 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6700520 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#101275} | 11 个月前 | |
[v8] Fix CVE-498095290 495751197 497404188 TicketNo: DTS2026041307131 Description: [v8] Fix CVE Team:gitcode Feature or Bugfix: Binary Source: sync from gitcode PrivateCode(Yes/No):No Change-Id: I0685a6966e3fe17da7b8bb20d56b9699d170e9ba Reviewed-by: z30069899,y00500721 Approved-by: y00500721 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/552 Merged-by: public pjenkins Signed-off-by: gaojunyu <gaojunyu2@h-partners.com> revert merge request: DTS2026041307131 [v8] CVE-498095290 495751197 497404188 8ac5be1238b0a137cdb8cbe2561e68832faedf46 This revert merge request !454 | 1 个月前 | |
[handles] Migration to direct handles, part 8 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, asmjs, builtins, codegen, compiler, date, debug, diagnostics, execution, heap, ic, init, interpreter, json, logging, objects, parsing, regexp, runtime, snapshot, strings, wasm. Bug: 42203211 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Change-Id: Ib35bb03997bb4a646c56674f834b952dffdeaf02 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6074945 Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#97624} | 1 年前 | |
[js] Expose string-related 'natives' runtime functions for fuzzing These will make it easier to create cons, sliced, thin and internalized strings for fuzzers. Bug: 455552707 Change-Id: I610ff8ed02ffbc1bd8ab1774d883c46146302c2d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7137292 Commit-Queue: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Victor Gomes <victorgomes@chromium.org> Auto-Submit: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#103647} | 7 个月前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 1 年前 | ||
| 5 年前 | ||
| 8 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 3 年前 | ||
| 3 个月前 | ||
| 3 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 9 个月前 | ||
| 11 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 8 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 10 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 9 个月前 | ||
| 11 个月前 | ||
| 1 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 3 个月前 |