VV8 LUCI CQ[hole] Remove unneeded hole value checks
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
third_party: Move utf8-decoder - Move src/third_party/utf8-decoder to third_party/utf8-decoder - Sort data deps in tools/gcmole/BUILD.gn Bug: 383356859 Change-Id: I1a49d55a337d9c524b2d07b6510c98714b23f0f8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6088200 Reviewed-by: Marja Hölttä <marja@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#97760} | 1 年前 | |
buganizer: fix component IDs in DIR_METADATA This only matches the old monorail components. Bug: 341800538 Change-Id: Id74fbdb3b9be0c858b77af84966c6c37adf78c5c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6025833 Reviewed-by: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Paul Semel <paulsemel@chromium.org> Commit-Queue: Paul Semel <paulsemel@chromium.org> Cr-Commit-Position: refs/heads/main@{#97252} | 1 年前 | |
[owners] Add pthier to owners of src/strings No-Try: true Change-Id: I69eb98a178666ff44ae236aba886c9af10ce352d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7172481 Auto-Submit: Patrick Thier <pthier@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#103816} | 7 个月前 | |
[sandbox] Fix implicit signed-unsigned conversions in Intl code This CL introduces START_PROHIBIT_SIGN_CONVERSION and END_PROHIBIT_SIGN_CONVERSION for prohibiting implicit conversions between signed and unsigned integer types. Drive-by: fix flags for regress-379418918.js which started to fail because of enabled heap verification. Fixed: 440589876 Bug: 440589880 Bug: 441221573 Change-Id: Iafa1476b0a28925c086eafc3c4eed1dde9aca9eb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6884672 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#102058} | 10 个月前 | |
Reland "[base] Move most of src/numbers into base" This is a reland of 9701d4a420000cfd76b125ff42eeb6e592a7ac21 with a small fix for some code landed in between the dry-run and submission. Original change's description: > [base] Move most of src/numbers into base > > Moves all but conversions.*, hash-seed-inl.h and math-random.* into > base, in preparation for moving the parts of conversions that don't > access HeapObjects. > > Also moves uc16 and uc32 out of commons/globals.h into base/strings.h. > > Bug: v8:11917 > Change-Id: Ife359148bb0961a63833aff40d26331454b6afb6 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2979595 > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> > Reviewed-by: Clemens Backes <clemensb@chromium.org> > Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> > Auto-Submit: Dan Elphick <delphick@chromium.org> > Cr-Commit-Position: refs/heads/master@{#75354} Bug: v8:11917 Change-Id: Ie1ec9032fe56646a7c7303185cecc70fce5694ae Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2982607 Reviewed-by: Clemens Backes <clemensb@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Dan Elphick <delphick@chromium.org> Cr-Commit-Position: refs/heads/master@{#75368} | 4 年前 | |
[sandbox] Fix implicit signed-unsigned conversions in Intl code This CL introduces START_PROHIBIT_SIGN_CONVERSION and END_PROHIBIT_SIGN_CONVERSION for prohibiting implicit conversions between signed and unsigned integer types. Drive-by: fix flags for regress-379418918.js which started to fail because of enabled heap verification. Fixed: 440589876 Bug: 440589880 Bug: 441221573 Change-Id: Iafa1476b0a28925c086eafc3c4eed1dde9aca9eb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6884672 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#102058} | 10 个月前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
Revert "[string] Remove String::IsOneByteRepresentationUnderneath" This reverts commit e3f33e99674eab3881d2d65b82dfe436829bb831. Reason for revert: https://crbug.com/398999390 This only reverts the fist part of the CL (Removing IsOneByteRepresentation). Using static roots to determine one-byte representation from the map word alone is kept. Original change's description: > [string] Remove String::IsOneByteRepresentationUnderneath > > All string maps are split into one- and two-byte versions, and enforce > that their underlying string must have the same byte width (e.g. we > can't change byteness when externalizing). This means that the old > IsOneByteRepresentationUnderneath loop is no longer needed, as we > already know the byteness from the top. > > Remove this function, replacing with calls to IsOneByteRepresentation. > Additionally, we have some static roots hacks to determine one-byte > representation from the map word alone (without needing to dereference > the instance type), so use that too where possible. > > Change-Id: I662daa3cb217d04cbfd717da53ae1238a0bcddd0 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6011010 > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Reviewed-by: Patrick Thier <pthier@chromium.org> > Cr-Commit-Position: refs/heads/main@{#97099} DISABLE_SPELLCHECKER Fixed: 398999390 Change-Id: Iee7e88257cb0d23669bcd7571d57b613a413bc29 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6304799 Commit-Queue: Patrick Thier <pthier@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#98942} | 1 年前 | |
[cleanup] Remove dead string builder code R=jkummerow@chromium.org Change-Id: I99583d4bd5b0a314695bafc75d844f83c96f2878 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6157743 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/main@{#97985} | 1 年前 | |
[intl] Check if string is already Uppercase There's no need to copy the string contents into a newly allocated string if we'll return the original string anyway Change-Id: I756fa0a519c203c340665edb40f6ea9c4617499c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6403374 Auto-Submit: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#99536} | 1 年前 | |
[intl] Check if string is already Uppercase There's no need to copy the string contents into a newly allocated string if we'll return the original string anyway Change-Id: I756fa0a519c203c340665edb40f6ea9c4617499c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6403374 Auto-Submit: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#99536} | 1 年前 | |
implement rapidhash secret generation Bug: 409717082 Change-Id: I471f33d66de32002f744aeba534c1d34f71e27d2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6733490 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: snek <snek@chromium.org> Cr-Commit-Position: refs/heads/main@{#101499} | 11 个月前 | |
implement rapidhash secret generation Bug: 409717082 Change-Id: I471f33d66de32002f744aeba534c1d34f71e27d2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6733490 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: snek <snek@chromium.org> Cr-Commit-Position: refs/heads/main@{#101499} | 11 个月前 | |
implement rapidhash secret generation Bug: 409717082 Change-Id: I471f33d66de32002f744aeba534c1d34f71e27d2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6733490 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: snek <snek@chromium.org> Cr-Commit-Position: refs/heads/main@{#101499} | 11 个月前 | |
[tagged-ptr] Use Tagged in Factory, and fwd decl more Bug: v8:12710 Change-Id: I4af0e008ac9b76932affa1918e024f431cfd2344 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4683630 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#88992} | 2 年前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
[base] Support non-trivial element types for SmallVector This CL allows non-trivially constructible and destructible types to be used as element types for base::SmallVector. In addition, the CL: - Refactors methods resize_no_init and resize_and_init into a pair of overloaded resize methods. Similarly to their STL equivalents, the behaviour (initialization or not) depends on the element type and the presence of an initial value, not on the name. - Adds extensive unit tests. - Removes the special instance of base::trivially_destructible for direct handles, which was used only for allowing their use in small vectors. The motivation for this CL was that small vectors of direct handles did not properly count such handles, in debug builds. Change-Id: I5c059c0f9498531877573e7979383b8a7a63b0a3 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6298363 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Anton Bikineev <bikineev@chromium.org> Cr-Commit-Position: refs/heads/main@{#99070} | 1 年前 | |
third_party: Move utf8-decoder - Move src/third_party/utf8-decoder to third_party/utf8-decoder - Sort data deps in tools/gcmole/BUILD.gn Bug: 383356859 Change-Id: I1a49d55a337d9c524b2d07b6510c98714b23f0f8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6088200 Reviewed-by: Marja Hölttä <marja@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#97760} | 1 年前 | |
[string] Use an unsigned integer for String::length With the sandbox, it is assumed that an attacker can corrupt heap memory, and therefore String objects and in particular their lengths. If the string lengths is represented as a signed integer (as it used to be before this CL), there is some risk of signed integer comparisons when operating on them as an attacker could turn the length into a negative value. See https://crbug.com/327473424 for an example. This CL now converts the length to a uint32_t to better defend against such issues. Bug: 369748453 Change-Id: Ife1fc2a1e2c23ff022dee1c5e315650c95057aa3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5332375 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#96599} | 1 年前 | |
Reland "use highway to check and copy leading ascii" This is a reland of commit a3e84e5f01540cec142f4d4f41f1921373c220e5 Original change's description: > use highway to check and copy leading ascii > > Change-Id: I065532aeeee95273821aa1f25b5ffc5c5c23cbf1 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7172479 > Reviewed-by: Patrick Thier <pthier@chromium.org> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Commit-Queue: Dan Carney <dcarney@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103820} Change-Id: I43b4ad18817eb52b701e112d2d0a5f685374ae1f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7184338 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Commit-Queue: Dan Carney <dcarney@chromium.org> Cr-Commit-Position: refs/heads/main@{#103865} | 7 个月前 | |
Reland "use highway to check and copy leading ascii" This is a reland of commit a3e84e5f01540cec142f4d4f41f1921373c220e5 Original change's description: > use highway to check and copy leading ascii > > Change-Id: I065532aeeee95273821aa1f25b5ffc5c5c23cbf1 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7172479 > Reviewed-by: Patrick Thier <pthier@chromium.org> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Commit-Queue: Dan Carney <dcarney@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103820} Change-Id: I43b4ad18817eb52b701e112d2d0a5f685374ae1f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7184338 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Commit-Queue: Dan Carney <dcarney@chromium.org> Cr-Commit-Position: refs/heads/main@{#103865} | 7 个月前 | |
Reland "use highway to check and copy leading ascii" This is a reland of commit a3e84e5f01540cec142f4d4f41f1921373c220e5 Original change's description: > use highway to check and copy leading ascii > > Change-Id: I065532aeeee95273821aa1f25b5ffc5c5c23cbf1 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7172479 > Reviewed-by: Patrick Thier <pthier@chromium.org> > Reviewed-by: Toon Verwaest <verwaest@chromium.org> > Commit-Queue: Dan Carney <dcarney@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103820} Change-Id: I43b4ad18817eb52b701e112d2d0a5f685374ae1f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7184338 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Patrick Thier <pthier@chromium.org> Commit-Queue: Dan Carney <dcarney@chromium.org> Cr-Commit-Position: refs/heads/main@{#103865} | 7 个月前 | |
[strings] Prevent OOM crash in URI encoding The std::vector used as a buffer in EncodeURI can fail to allocate when encoding very large strings. This ends up OOMing and crashing the process. This patch replaces the std::vector with a custom ResizableBuffer that handles allocation failures gracefully. This allows the builtin to stop processing and throw a InvalidStringLengthError instead of crashing. Since this is a new failure mode, additionally do some cleanup of the encode method to use a non-allocating helper which returns a status. Bug: 459950607 Change-Id: I8d580832297b2c16c8b651c2f691e916c56d6390 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7156424 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#103788} | 7 个月前 | |
[handles] Migration to direct handles, part 13 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, ast, builtins, codegen, compiler, debug, deoptimizer, execution, heap, ic, init, interpreter, json, maglev, objects, parsing, regexp, runtime, snapshot, strings, temporal, wasm, and in tests. Bug: 42203211 Change-Id: Icb4238ee9082865dae47dce025e529a1c3fdfc48 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6189992 Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Omer Katz <omerkatz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#98283} | 1 年前 |