| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
Reland "[snapshot] Extract more files" This is a reland of 5c4b80566f9bc42b00621becae115def3a0f2d6b Original change's description: > [snapshot] Extract more files > > This moves: > > - ExternalReferenceEncoder to codegen/external-reference-encoder.h > - SerializerDeserializer to snapshot/serializer-deserializer.h > - Checksum() to snapshot/snapshot-utils.h > > serializer-common.h and .cc are removed. > > Tbr: clemensb@chromium.org,ulan@chromium.org > Bug: v8:10416 > Change-Id: I36a242dcc1ad8833374aa567f73e0d4a75632c58 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144118 > Commit-Queue: Jakob Gruber <jgruber@chromium.org> > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Reviewed-by: Clemens Backes <clemensb@chromium.org> > Reviewed-by: Dan Elphick <delphick@chromium.org> > Cr-Commit-Position: refs/heads/master@{#67281} Tbr: delphick@chromium.org,clemensb@chromium.org,ulan@chromium.org Bug: v8:10416 Change-Id: I6f6a1017435db185778ed931e1ddb13d8d5e920e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2157384 Reviewed-by: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Dan Elphick <delphick@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#67298} | 6 年前 | |
buganizer: fix component IDs in DIR_METADATA This only matches the old monorail components. Bug: 341800538 Change-Id: Id74fbdb3b9be0c858b77af84966c6c37adf78c5c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6025833 Reviewed-by: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Paul Semel <paulsemel@chromium.org> Commit-Queue: Paul Semel <paulsemel@chromium.org> Cr-Commit-Position: refs/heads/main@{#97252} | 1 年前 | |
[owners] Add olivf@ to snapshot No-Try: true Change-Id: Id9c04925f7837ee609066e3dc7ec4446353e95fd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5797115 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#95716} | 1 年前 | |
[builtins] Verify CanAllocate effects for builtins in Turboshaft/Maglev Bug: 42204439 Change-Id: If13d9f78ddcfb77ccc14749a534ac1711dac3754 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6372502 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#100113} | 1 年前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
[handles] Migration to direct handles, part 13 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, ast, builtins, codegen, compiler, debug, deoptimizer, execution, heap, ic, init, interpreter, json, maglev, objects, parsing, regexp, runtime, snapshot, strings, temporal, wasm, and in tests. Bug: 42203211 Change-Id: Icb4238ee9082865dae47dce025e529a1c3fdfc48 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6189992 Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Omer Katz <omerkatz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#98283} | 1 年前 | |
[handles] Migration to direct handles, part 11 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, ast, baseline, builtins, codegen, compiler, d8, debug, diagnostics, execution, heap, ic, maglev, objects, profiler, runtime, snapshot, wasm. Bug: 42203211 Change-Id: Id8512e84fca9ecbd85b157409b24e17296efd399 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6102545 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Cr-Commit-Position: refs/heads/main@{#97875} | 1 年前 | |
[handles] Migration to direct handles, part 8 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, asmjs, builtins, codegen, compiler, date, debug, diagnostics, execution, heap, ic, init, interpreter, json, logging, objects, parsing, regexp, runtime, snapshot, strings, wasm. Bug: 42203211 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Change-Id: Ib35bb03997bb4a646c56674f834b952dffdeaf02 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6074945 Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#97624} | 1 年前 | |
[snapshot] Handle multiple NativeContexts in context (de)serializer Do not serialize the "next_context_link" field in NativeContext to the snapshot as this field is only used for the weak list of all NativeContexts in that isolate. We were already doing this but only for the top/initial NativeContext. In the flakily failing test, we were actually serializing/deserializing multiple NativeContexts, because the test was using Realm.create() to create another NativeContext which was stored in a global variable of that initial NativeContext. In the deserializer we then use AddToWeakNativeContextList() to add the freshly created NativeContexts to the isolate's weak list of native contexts in PostProcessNewObject(). Previously this only happened for the top/initial NativeContext as well. Bug: 450135650 Change-Id: Ifbf426e3e1afef373820b5aa4410bc67e1b0e31c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7027312 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103088} | 8 个月前 | |
[strings] Support shared strings without a shared string table - Add --shared-strings to support shared strings without the shared string table. - Copy shared strings to the local heap on internalization.* - Shared strings never transition to ThinStrings.* Shared strings always have to perform a full StringTable lookup.* - Externalization of shared strings is not supported.* *) Applies only to shared strings without --shared-string-table. Drive-by: Remove unused ContextSerializer::ShouldBeInTheSharedObjectCache. Bug: 446981745 Change-Id: I8624f0cc1e3b89993c596afcde8b899fcbaa0b81 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7021469 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Patrick Thier <pthier@chromium.org> Reviewed-by: Jakob Linke <jgruber@chromium.org> Auto-Submit: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103013} | 8 个月前 | |
[sandbox] Expand trusted object unpublishing mechanism This CL expands the "publishing" mechanism for trusted objects. Previously, we already had a special "unpublished" tag that could be used to make trusted objects inaccessible from within the sandbox. We now expand the machinery around this tag to allow objects to be allocated in an unpublished state and then be published later on. For that, we also fix a bug that previously allowed unpublished objects to still be accessed from inside the sandbox through the kUnknownIndirectPointerTag (used e.g. for the SFI). The new, more flexible unpublishing mechanism will be used in follow-up CLs to make bytecode inaccessible until it has been validated. Drive-By: rename init_self_indirect_pointer to InitAndPublish since this method does non-trivial work and so should probably be uppercased. Bug: 461681036 Change-Id: Iad0224beb89ef1bd625b5cdc51a77cef12642159 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7172412 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#103956} | 7 个月前 | |
[runtime] Refactor macros defining redirected callback pointers ... and make InterceptorInfo::getter a redirected callback in order to prepare for calling it from native code. Bug: 455600234 Change-Id: I632649ba49a2afd85d9ef68e0564bd93835e188e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7146769 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103692} | 7 个月前 | |
[builtins] Verify CanAllocate effects for builtins in Turboshaft/Maglev Bug: 42204439 Change-Id: If13d9f78ddcfb77ccc14749a534ac1711dac3754 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6372502 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#100113} | 1 年前 | |
[tagged] Start making Struct classes new layout Split Struct into Struct and StructLayout, for old- and new-layout class hierarchies, and port the following struct classes to new layout: * Tuple2: Trivial * AccessorPair: Trivial * ClassPositions: Trivial * AllocationMemento: Typed the allocation_site field as AllocationSite, as all setters set a valid value. * AllocationSite: Made field types stricter using Unions, and split off the optional weak_next field into a separate class. Also, made it inherit HeapObject directly instead of Struct, since it had a non-Struct layout descriptor due to int32 and custom weakness fields. Bug: 42202654 Change-Id: I39112f52376879027a1f35df84ed699131c481a6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6407498 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#99577} | 1 年前 | |
[handles] Migration to direct handles, part 8 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, asmjs, builtins, codegen, compiler, date, debug, diagnostics, execution, heap, ic, init, interpreter, json, logging, objects, parsing, regexp, runtime, snapshot, strings, wasm. Bug: 42203211 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Change-Id: Ib35bb03997bb4a646c56674f834b952dffdeaf02 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6074945 Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#97624} | 1 年前 | |
[sandbox] Expand trusted object unpublishing mechanism This CL expands the "publishing" mechanism for trusted objects. Previously, we already had a special "unpublished" tag that could be used to make trusted objects inaccessible from within the sandbox. We now expand the machinery around this tag to allow objects to be allocated in an unpublished state and then be published later on. For that, we also fix a bug that previously allowed unpublished objects to still be accessed from inside the sandbox through the kUnknownIndirectPointerTag (used e.g. for the SFI). The new, more flexible unpublishing mechanism will be used in follow-up CLs to make bytecode inaccessible until it has been validated. Drive-By: rename init_self_indirect_pointer to InitAndPublish since this method does non-trivial work and so should probably be uppercased. Bug: 461681036 Change-Id: Iad0224beb89ef1bd625b5cdc51a77cef12642159 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7172412 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#103956} | 7 个月前 | |
Reland: [snapshot] Always use memcpy-based serialization for RO space This is a reland of crrev.com/c/4543306. It fixes an invalid use of AllocateNextPageAt when V8_SHARED_RO_HEAP was unset (in which case AllocateNextPageAt cannot guarantee a fixed page location). The reland changes the condition to be based on V8_STATIC_ROOTS instead, which itself is derived from (and requires) pointer compression and a shared RO heap. V8's snapshot now has two serialization methods: 1) serialization through depth-first object iteration, and 2) serialization through linear space iteration in which objects are visited in the same order as they occur in memory. Most serializers, notably for the isolate- and context snapshots, still use 1). The read-only snapshot was switched to 2) for static-roots builds a while ago, and this CL switches it over for all remaining build configs as well. The main motivation is that code caches depend on a specific RO space layout, and thus RO space layout must not change when code caching is involved. Method 2) guarantees this. As a side benefit, this again unifies RO space serialization mechanisms, and gets rid of the ro object cache. Memcpy-based deserialization: 1. copies the raw memory layout over in a first pass, 2. relocates tagged pointers in a second pass (if needed, see kRelocateSegment), and 3. does final custom patchups (e.g. setting Code::instruction_start) in a final pass (PostProcessNewObjects). Bug: v8:13789 Change-Id: If8d8a063f49795fe2e9ffe0b0c0a066e4c0e8083 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4608330 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Jakob Linke <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#88251} | 3 年前 | |
[snapshot] Fix serialization of v8::External v8::External is getting refactored to allow type-specific pointer tags, i.e. that not all pointers stored within a v8::External have the same tag. For the serialization and deserialization of v8::External this means that the pointer tags have to be written to the serialization format as well. Change-Id: I509bb8bf62ce8624435273c6690be34fa72b2f9f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6983087 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by: Jakob Linke <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#102845} | 9 个月前 | |
[heap] Make hole maps readable even when unmapped Previously, all hole objects were placed inside a payload of the WasmNull object so that they would be fully unmapped, including their map pointer, making it a requirement to check them by value instead of by instance type. This is proving to be a difficult restriction to adhere to, particularly in optimized code (where reading the map is considered a somewhat operation and can be hoisted above hole checks). This patch refactors this by making each Hole object a large, page-minus-map-aligned object, with a readable map and its own unmappable payload. Since they are in their own area, we can revert the WasmNull to its previous single-payload layout, since it doesn't need to store the holes in its unmappable payload. We can also uncouple hole unmapping from Wasm being enabled. This unfortunately blows up the (virtual) size of the RO space, in particular requiring it to expand to multiple V8 pages. Bug: 434179415 Change-Id: Id64b1a3f1228e621590058661d33eca72604fe5f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7156717 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103929} | 7 个月前 | |
Reland: [snapshot] Always use memcpy-based serialization for RO space This is a reland of crrev.com/c/4543306. It fixes an invalid use of AllocateNextPageAt when V8_SHARED_RO_HEAP was unset (in which case AllocateNextPageAt cannot guarantee a fixed page location). The reland changes the condition to be based on V8_STATIC_ROOTS instead, which itself is derived from (and requires) pointer compression and a shared RO heap. V8's snapshot now has two serialization methods: 1) serialization through depth-first object iteration, and 2) serialization through linear space iteration in which objects are visited in the same order as they occur in memory. Most serializers, notably for the isolate- and context snapshots, still use 1). The read-only snapshot was switched to 2) for static-roots builds a while ago, and this CL switches it over for all remaining build configs as well. The main motivation is that code caches depend on a specific RO space layout, and thus RO space layout must not change when code caching is involved. Method 2) guarantees this. As a side benefit, this again unifies RO space serialization mechanisms, and gets rid of the ro object cache. Memcpy-based deserialization: 1. copies the raw memory layout over in a first pass, 2. relocates tagged pointers in a second pass (if needed, see kRelocateSegment), and 3. does final custom patchups (e.g. setting Code::instruction_start) in a final pass (PostProcessNewObjects). Bug: v8:13789 Change-Id: If8d8a063f49795fe2e9ffe0b0c0a066e4c0e8083 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4608330 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Jakob Linke <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#88251} | 3 年前 | |
[handles] Migration to direct handles, part 2 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: asmjs, builtins, compiler-dispatcher, heap, json, numbers, regexp, runtime, snapshot, strings. Bug: 42203211 Change-Id: Id0e6e17a1ef45e3a98905db927c4836e9a640ccf Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5604486 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#94332} | 2 年前 | |
[tagged-ptr] Convert more Objects to Tagged<> Convert a large amount of Objects to Tagged<Object>, by using a clang tool to convert all variables and parameters to Tagged<>, and manually fixing up any build failures this caused. Bug: v8:12710 Change-Id: I2bfc90220fe92ebc6487b5cddbc4166164637a71 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4827204 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89750} | 2 年前 | |
[tagged-ptr] Convert more Objects to Tagged<> Convert a large amount of Objects to Tagged<Object>, by using a clang tool to convert all variables and parameters to Tagged<>, and manually fixing up any build failures this caused. Bug: v8:12710 Change-Id: I2bfc90220fe92ebc6487b5cddbc4166164637a71 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4827204 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89750} | 2 年前 | |
[runtime] Refactor macros defining redirected callback pointers ... and make InterceptorInfo::getter a redirected callback in order to prepare for calling it from native code. Bug: 455600234 Change-Id: I632649ba49a2afd85d9ef68e0564bd93835e188e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7146769 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103692} | 7 个月前 | |
[runtime] Refactor macros defining redirected callback pointers ... and make InterceptorInfo::getter a redirected callback in order to prepare for calling it from native code. Bug: 455600234 Change-Id: I632649ba49a2afd85d9ef68e0564bd93835e188e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7146769 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103692} | 7 个月前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
[snapshot] Handle multiple NativeContexts in context (de)serializer Do not serialize the "next_context_link" field in NativeContext to the snapshot as this field is only used for the weak list of all NativeContexts in that isolate. We were already doing this but only for the top/initial NativeContext. In the flakily failing test, we were actually serializing/deserializing multiple NativeContexts, because the test was using Realm.create() to create another NativeContext which was stored in a global variable of that initial NativeContext. In the deserializer we then use AddToWeakNativeContextList() to add the freshly created NativeContexts to the isolate's weak list of native contexts in PostProcessNewObject(). Previously this only happened for the top/initial NativeContext as well. Bug: 450135650 Change-Id: Ifbf426e3e1afef373820b5aa4410bc67e1b0e31c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7027312 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103088} | 8 个月前 | |
Reland^2: [heap] Add --shared-heap flag This is a reland of commit 8bdd3bd85935315607a2bfc4da8ab79922258d6a This CL fixes a DCHECK failure in JSFunctionVerify() when creating handles during heap verification for a shared GC. The issue here is that the shared space isolate thread runs verification for the client isolates. And client isolates are generally parked during the safepoint. This CL addresses this by using the AllowHandleUsageOnAllThreads scope before verifying client heaps. Original change's description: > Reland "[heap] Add --shared-heap flag" > > This is a reland of commit 4d2d8eecac7a636516c2b597bf3ff53738c80bc8 > > This reland makes SharedHeapDeserializer dependent on > OwnsStringTables(). That way the deserializer still deserializes > into the string table for client isolates without > --shared-string-table. > > Original change's description: > > [heap] Add --shared-heap flag > > > > This CL adds a new flag --shared-heap, which allows us to enable the > > shared heap without also enabling the shared string table or the > > shared structs. This will be useful for investigating > > "time-to-global-safepoint" metrics. > > > > Bug: 372493838 > > Change-Id: I023e7ac0565cdff2fcc02adc2bd10e975fe15971 > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5975436 > > Reviewed-by: Patrick Thier <pthier@chromium.org> > > Reviewed-by: Victor Gomes <victorgomes@chromium.org> > > Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> > > Cr-Commit-Position: refs/heads/main@{#96877} > > Bug: 372493838 > Change-Id: I012b3a2f655bf52e577236eb112f88db109140cf > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5999917 > Reviewed-by: Shu-yu Guo <syg@chromium.org> > Reviewed-by: Patrick Thier <pthier@chromium.org> > Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> > Cr-Commit-Position: refs/heads/main@{#97041} Bug: 372493838 Change-Id: I88e195278e033bfdc381a9a65c1ba58b8e923f6a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6001834 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/main@{#97059} | 1 年前 | |
Remove some unused includes (3) Mostly src/codegen, src/compiler, src/snapshot, src/utils. Bug: v8:13006 Change-Id: I2fb31acc749a7376e6f2a7424ed2e67ff479d971 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3749178 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#81575} | 3 年前 | |
[heap] Remove OffHeapFullPointerSlot The reason to have OffHeap- variants of compressed pointer slots is to remove the operator*, which would not work - it uses the location of the slot to work out the base of the pointer cage. However the operator* of a FullPointerSlot works just fine, even off-heap, because it doesn't need any cage base to decompress a pointer that is not compressed. We were not consistently using OffHeapFullPointerSlot anyway - VisitRoots was not using it even though roots are off-heap. Change-Id: I296385f7ee7022e8b9ad2a52770f458051f971ef Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7002994 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#102954} | 8 个月前 | |
[tagged-ptr] Convert more Objects to Tagged<> Convert a large amount of Objects to Tagged<Object>, by using a clang tool to convert all variables and parameters to Tagged<>, and manually fixing up any build failures this caused. Bug: v8:12710 Change-Id: I2bfc90220fe92ebc6487b5cddbc4166164637a71 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4827204 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89750} | 2 年前 | |
Restrict bit_cast Using bit_cast on pointers does not accomplish anything useful, and obscures what might be incorrect behavior. Do not allow base::bit_cast to be misused in that way. Port the checks present in https://crrev.com/c/5094596 to this repo's version of bit_cast. A previous version of this CL was landed in https://crrev.com/c/5116901 but had to be reverted because it didn’t compile with GCC 9. This version of the CL has been fixed to work with that release. Bug: chromium:1506769 Change-Id: I9177f47ef37263d7b361d1b8dd9bc6b1bb33d118 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5122432 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Avi Drissman <avi@chromium.org> Cr-Commit-Position: refs/heads/main@{#91526} | 2 年前 | |
[snapshot] Use uint8_t instead of byte Byte is an alias for the standard uint8_t type (defined in src/common/globals.h). For readability, avoid the alias and use the uint8_t directly. R=jgruber@chromium.org Change-Id: I23c1216c4d87ac1fac9a66aa85d5228b8681ba8f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4518776 Reviewed-by: Jakob Linke <jgruber@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#87581} | 3 年前 | |
[snapshot] Use uint8_t instead of byte Byte is an alias for the standard uint8_t type (defined in src/common/globals.h). For readability, avoid the alias and use the uint8_t directly. R=jgruber@chromium.org Change-Id: I23c1216c4d87ac1fac9a66aa85d5228b8681ba8f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4518776 Reviewed-by: Jakob Linke <jgruber@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#87581} | 3 年前 | |
[snapshot] Use uint8_t instead of byte Byte is an alias for the standard uint8_t type (defined in src/common/globals.h). For readability, avoid the alias and use the uint8_t directly. R=jgruber@chromium.org Change-Id: I23c1216c4d87ac1fac9a66aa85d5228b8681ba8f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4518776 Reviewed-by: Jakob Linke <jgruber@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#87581} | 3 年前 | |
[snapshot] Reduce startup snapshot checksum check overhead Avoid calculating the checksum on every snapshot deserialization. - Desktop: by default only in release - Android: once per process Most snapshot corruptions happen on android devices but there we also have the highest overhead from calculating the checksum. Findings doc: https://docs.google.com/document/d/e/2PACX-1vQWdJjrZpTL5VjbP_LHH-qQj-9vcmuLez93WPZhoacJT2bTXfCAdJpbexfJWP9jrAI5ek_416uZE6_W/pub Bug: v8:12195 Change-Id: Ic7f2f45a9e8ade31c3774a7b659d9c30769e2b44 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3583983 Reviewed-by: Jakob Linke <jgruber@chromium.org> Commit-Queue: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/main@{#80260} | 4 年前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
[snapshot] Split PutInt into PutUint32 and PutUint30 .. to clarify behavior. PutUint30 (previously called PutInt) serializes a 30-bit integer with run-length encoding. The new method PutUint32 serializes verbatim and is thus suitable for serializing e.g. compressed pointers. Bug: v8:13789 Change-Id: I3fbd9c92408aeac9176be1e42811a61eda7f360f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4661660 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Jakob Linke <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#88637} | 2 年前 | |
[snapshot] Add RO deserialization time graph .. and split it out from the isolate deserialization time graph. Previously, the DeserializationTimeIsolate metric measured everything inside Isolate::Init, i.e. RO deserialization, isolate deserialization, and various isolate setup code. With this change, DeserializationTimeIsolate measures only isolate deserialization, and DeserializationTimeReadOnly measures only RO space deserialization. Bug: v8:13789 Change-Id: I83762fa34b46c8cd6819f309f845b6b0dcedcde8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4840339 Auto-Submit: Jakob Linke <jgruber@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#89808} | 2 年前 | |
[snapshot] Use uint8_t instead of byte Byte is an alias for the standard uint8_t type (defined in src/common/globals.h). For readability, avoid the alias and use the uint8_t directly. R=jgruber@chromium.org Change-Id: I23c1216c4d87ac1fac9a66aa85d5228b8681ba8f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4518776 Reviewed-by: Jakob Linke <jgruber@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#87581} | 3 年前 | |
[snapshot] Use uint8_t instead of byte Byte is an alias for the standard uint8_t type (defined in src/common/globals.h). For readability, avoid the alias and use the uint8_t directly. R=jgruber@chromium.org Change-Id: I23c1216c4d87ac1fac9a66aa85d5228b8681ba8f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4518776 Reviewed-by: Jakob Linke <jgruber@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#87581} | 3 年前 | |
[sandbox] Disallow implicit unchecked downcasts to trusted objects To soundify C++ types of trusted objects we want to prevent accidentally casting to a trusted object without checking. To that end we enforce the explicit choice of one of three possible casts. * The (existing) TryCast should be used when we already have a type check. This construct ensures that the cast is correct by construction, since the target variable is not assigned if it fails. * The (new) (Checked|Sbx)Cast combines a (SBX)CHECK with a Cast. Replaces SBXCHECK(Is<Foo>(x)); Tagged<Foo> f = Cast<Foo>(x). * The (new) TrustedCast corresponds to Cast on non-trusted objects. The "Trusted" prefix signifies that the correctness obligations are solely on the caller. It should not be used at all if possible. Typically reasonable usecases are: * Reading a field of a trusted object. We trust them to be untampered. * Reading a trusted pointer with a type-tagged handle. The handle ensures correctness. * A visitor where the down-cast is generated by a macro. There is little possiblity for future error and TryCast would be cumbersome and potentially slower. * Low-risk code like debugging, or highly-performance sensitive code where the check is enforced indirectly. DriveBy: Add CastExposedTrustedObjectByTag which ties together the type of a ExposedTrustedObject with its IndirectPointerTag. This prevents the two from getting out of sync. Bug: 435645639 Change-Id: Id283b109ab3e0c3a4503467771bc35f1857fa236 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6859421 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Olivier Flückiger <olivf@chromium.org> Auto-Submit: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#101943} | 10 个月前 | |
Reland "[handles] Migration to direct handles, part 12" This is a reland of commit 5fa54d85a10049a55ba2fa02bc05145ddee7d19a Original change's description: > [handles] Migration to direct handles, part 12 > > This CL migrates a large number of handles to direct handles. The > changes are only relevant for builds with v8_enable_direct_handle=true. > > Affected source directories: api, asmjs, ast, builtins, codegen, > compiler, d8, debug, deoptimizer, diagnostics, execution, extensions, > heap, ic, init, interpreter, json, maglev, objects, parsing, profiler, > regexp, runtime, snapshot, strings, wasm, and tests. > > Bug: 42203211 > Change-Id: I2334b3295e5780e8f52d0b13d1545dce29fcf81e > Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6181904 > Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> > Reviewed-by: Omer Katz <omerkatz@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Cr-Commit-Position: refs/heads/main@{#98240} Bug: 42203211 Change-Id: Ie21acd681c12e7212185d61a19bd858365650204 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6187462 Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#98249} | 1 年前 | |
[builtin] Support builtin pgo for gearbox Bug: 420782518 Change-Id: I6605673d7992cffce4882ece73573d7ffc067f12 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6636637 Reviewed-by: Jakob Linke <jgruber@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101321} | 11 个月前 | |
[builtins-pgo] Reorder builtins based on builtins PGO profile This CL does not enable the builtins reordering yet, it's guarded by v8_enable_builtins_reordering gn flag. Change-Id: Id90b198af4565e584c83702571719dffafcf91fb Bug: v8:13938 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4216393 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Wenqin Yang <wenqin.yang@intel.com> Reviewed-by: Jakob Linke <jgruber@chromium.org> Cr-Commit-Position: refs/heads/main@{#89048} | 2 年前 | |
[runtime] Refactor macros defining redirected callback pointers ... and make InterceptorInfo::getter a redirected callback in order to prepare for calling it from native code. Bug: 455600234 Change-Id: I632649ba49a2afd85d9ef68e0564bd93835e188e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7146769 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103692} | 7 个月前 | |
[snapshot] Disable ICF in mksnapshot Identical code folding can cause external references to be de-duplicated (e.g. merging memcpy and memmove). This is ok, as long as the same functions are folded both in the serializing and deserializing binaries. If the serializing binary merges two functions that the deserializing binary didn't, then the snapshot deserialization will get the wrong function reference. This can happen due to whole program optimization of the snapshot serializing binary. We can prevent this by disabling ICF for snapshot generation, ensuring that there are no duplicate references when generating the snapshot. It's ok for the mismatch to be in the opposite direction, i.e. for the deserializing binary to have merged functions that the serializing binary didn't, so this is a safe operation and doesn't affect the shipped binary. This also adds a small section to the start of the startup snapshot which lists all duplicate external reference table entries. The deserialization verifies that duplicates stayed duplicated. This allows us to support some duplication in the serializing binary as long as there is matching duplication in the deserializing binary -- this will be the case, for example, if the serializing and deserializing binary is the same (e.g. in tests, or in node with --binary-snapshot). Bug: chromium:41321762, chromiun:327245456 Change-Id: If19584d19307bec5ea4d8b6a511151593d101988 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5447267 Reviewed-by: Anton Bikineev <bikineev@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#93396} | 2 年前 | |
[runtime] Refactor macros defining redirected callback pointers ... and make InterceptorInfo::getter a redirected callback in order to prepare for calling it from native code. Bug: 455600234 Change-Id: I632649ba49a2afd85d9ef68e0564bd93835e188e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7146769 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103692} | 7 个月前 | |
[runtime] Refactor macros defining redirected callback pointers ... and make InterceptorInfo::getter a redirected callback in order to prepare for calling it from native code. Bug: 455600234 Change-Id: I632649ba49a2afd85d9ef68e0564bd93835e188e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7146769 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103692} | 7 个月前 | |
[heap] Make hole maps readable even when unmapped Previously, all hole objects were placed inside a payload of the WasmNull object so that they would be fully unmapped, including their map pointer, making it a requirement to check them by value instead of by instance type. This is proving to be a difficult restriction to adhere to, particularly in optimized code (where reading the map is considered a somewhat operation and can be hoisted above hole checks). This patch refactors this by making each Hole object a large, page-minus-map-aligned object, with a readable map and its own unmappable payload. Since they are in their own area, we can revert the WasmNull to its previous single-payload layout, since it doesn't need to store the holes in its unmappable payload. We can also uncouple hole unmapping from Wasm being enabled. This unfortunately blows up the (virtual) size of the RO space, in particular requiring it to expand to multiple V8 pages. Bug: 434179415 Change-Id: Id64b1a3f1228e621590058661d33eca72604fe5f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7156717 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103929} | 7 个月前 | |
[static-roots] Static map range for more instance types Add some more instance types which correspond to static map ranges. In particular convert all the Is...String family of checks. Needed some re-arranging of string maps to work. Also, this CL removes earlier attempts at automatically computing static map ranges. None of these ranges of interest appear by accident and if we want them, the list has to be curated manually anyway. The mapping is stable thus automatically re-computing it yields few benefit and it's easier to just confirm at build time that everything is still as expected. With that, we move the automatically generated mappings from the generated static-roots.h to the instance-type-inl.h file. Also the verification is hugely simplified by just checking that the two variants (going via instance type vs. via map ptr) agree. Drive-by: Speed up Map::GetInstanceTypeMap and fix an issue in CSA where some maps are not recognized as roots in the code generator since we were not using the canonical handles from ReadOnlyRoots. Bug: v8:13466 Change-Id: I518b54dfb372f22d06983ccfe34800387e04e819 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4249541 Reviewed-by: Jakob Linke <jgruber@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Auto-Submit: Olivier Flückiger <olivf@chromium.org> Commit-Queue: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#86028} | 3 年前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 3 个月前 | ||
| 6 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 3 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 8 个月前 | ||
| 8 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 3 年前 | ||
| 9 个月前 | ||
| 7 个月前 | ||
| 3 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 8 个月前 | ||
| 1 年前 | ||
| 3 年前 | ||
| 8 个月前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 3 年前 | ||
| 3 年前 | ||
| 3 年前 | ||
| 4 年前 | ||
| 3 个月前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 3 年前 | ||
| 3 年前 | ||
| 10 个月前 | ||
| 1 年前 | ||
| 11 个月前 | ||
| 2 年前 | ||
| 7 个月前 | ||
| 2 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 3 年前 |