| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
[wasm][compilation-hints] Write compilation hints to stdout and file We generate the compilation-hints sections from a module, based on collected feedback, behind a couple of new flags. Namely: - We generate the compilation-priority section based on whether a function was compiled and/or marked for tierup. We always generate a 0 compilation priority if the function was compiled, and a 0 optimization priority if it was also marked for tierup. Note that we do not actually tier up in this configuration. - We generate the instruction-frequencies and call-targets sections based on collected liftoff feedback. The flag --wasm-generate-compilation-hints writes a proper wasm module to a file, containing only the new sections. The flag --trace-wasm-generate-compilation-hints emits a textual representation of these sections to stdout. Bug: 405952385 Change-Id: Ibb89123966c4ed3ced77fcefd028f535495f2b30 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7157372 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#103947} | 7 个月前 | |
[wasm-custom-desc] Add struct.new_desc and struct.new_default_desc to replace struct.new and struct.new_default, respectively, for allocating described types. Validate that struct.new_desc and struct.new_default_desc cannot be used to allocate non-described types. In the future we will also validate that they must be used to allocate described types, but to allow for a graceful update period, that validation is commented out for now. The corresponding proposal PR is https://github.com/WebAssembly/custom-descriptors/pull/85. Bug: 403372470 Change-Id: I399164ac38bdf7cbb930e14ee90bca1bb8c5873e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7171646 Commit-Queue: Thomas Lively <tlively@google.com> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#103858} | 7 个月前 | |
[v8] Fix CVE-498095290 495751197 497404188 TicketNo: DTS2026041307131 Description: [v8] Fix CVE Team:gitcode Feature or Bugfix: Binary Source: sync from gitcode PrivateCode(Yes/No):No Change-Id: I0685a6966e3fe17da7b8bb20d56b9699d170e9ba Reviewed-by: z30069899,y00500721 Approved-by: y00500721 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/552 Merged-by: public pjenkins Signed-off-by: gaojunyu <gaojunyu2@h-partners.com> revert merge request: DTS2026041307131 [v8] CVE-498095290 495751197 497404188 8ac5be1238b0a137cdb8cbe2561e68832faedf46 This revert merge request !454 | 1 个月前 | |
[wasm] Argument flags for fast calls are not supported Bug: 455711115 Change-Id: I9192706f32be0f13c739229fa3259dea8432e1b0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7089595 Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Commit-Queue: Andreas Haas <ahaas@google.com> Cr-Commit-Position: refs/heads/main@{#103388} | 8 个月前 | |
buganizer: fix component IDs in DIR_METADATA This only matches the old monorail components. Bug: 341800538 Change-Id: Id74fbdb3b9be0c858b77af84966c6c37adf78c5c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6025833 Reviewed-by: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Paul Semel <paulsemel@chromium.org> Commit-Queue: Paul Semel <paulsemel@chromium.org> Cr-Commit-Position: refs/heads/main@{#97252} | 1 年前 | |
[OWNERS] Make Daniel Lehmann a wasm owner These owner entries were still missing. Change-Id: I75c3956de1e153882d5670b1dd2871c62522e980 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4670253 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org> Auto-Submit: Matthias Liedtke <mliedtke@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#89625} | 2 年前 | |
[wasm] Wasm code coverage: Add BasicBlockCalculator Spec: https://docs.google.com/document/d/1NaD50lRija9DxHfb8X_rRlJ8EriqG_R20GM9E8Xf9ig/edit?pli=1&tab=t.0 This is the first in a series of CLs to add support for WebAssembly code coverage in V8. This initial CL adds code for a BasicBlockCalculator, which divides the code of a Wasm function in a sequence of basic blocks. This will be later used to add coverage instrumentation in Liftoff and Turbofan/Turboshaft. Bug: 354020953 Change-Id: Ieccec6ccb612a25b5007f284031b995e6044486c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6518896 Commit-Queue: Paolo Severini <paolosev@microsoft.com> Reviewed-by: Daniel Lehmann <dlehmann@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#100384} | 1 年前 | |
[wasm] Wasm code coverage: Add BasicBlockCalculator Spec: https://docs.google.com/document/d/1NaD50lRija9DxHfb8X_rRlJ8EriqG_R20GM9E8Xf9ig/edit?pli=1&tab=t.0 This is the first in a series of CLs to add support for WebAssembly code coverage in V8. This initial CL adds code for a BasicBlockCalculator, which divides the code of a Wasm function in a sequence of basic blocks. This will be later used to add coverage instrumentation in Liftoff and Turbofan/Turboshaft. Bug: 354020953 Change-Id: Ieccec6ccb612a25b5007f284031b995e6044486c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6518896 Commit-Queue: Paolo Severini <paolosev@microsoft.com> Reviewed-by: Daniel Lehmann <dlehmann@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#100384} | 1 年前 | |
[wasm] Branch hinting: more test coverage This adds more unit tests for invalid entries in the branch hints section, and a stress mode that generates random branch hints. The latter is activated with --stress-branch-hinting or --fuzzing. Drive-by cleanup: drop the "WasmBranchHint" enum, convert hints to V8's standard "BranchHint" right away. Bug: 373151164 Change-Id: I4f218d52eb123fb0944078fa6e54df7235bda50e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6308778 Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#98998} | 1 年前 | |
[v8] Fix CVE-498095290 495751197 497404188 TicketNo: DTS2026041307131 Description: [v8] Fix CVE Team:gitcode Feature or Bugfix: Binary Source: sync from gitcode PrivateCode(Yes/No):No Change-Id: I0685a6966e3fe17da7b8bb20d56b9699d170e9ba Reviewed-by: z30069899,y00500721 Approved-by: y00500721 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/552 Merged-by: public pjenkins Signed-off-by: gaojunyu <gaojunyu2@h-partners.com> revert merge request: DTS2026041307131 [v8] CVE-498095290 495751197 497404188 8ac5be1238b0a137cdb8cbe2561e68832faedf46 This revert merge request !454 | 1 个月前 | |
Include guards should be at the top of files. For the include guard optimization to kick in the include guards should be the first thing in the file, not counting comments. In some cases the guard has been moved above a comment for consistency even though this does not matter. A couple of include guards have been renamed for uniqueness. git cl upload complained about some lint nits which have been fixed. Change-Id: Iaa208ea6557c36c84bc7bb77c787ba9feb7cf037 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6275067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98907} | 1 年前 | |
[wasm-custom-desc] Store immediate supertype on Map This patch overlays the Map::dependent_code slot, which is unused for Wasm objects, to store the immediate supertype RTT on maps for types with custom descriptors. That makes the supertype faster to access, which speeds up type checks. Bug: 403372470 Change-Id: I32a0d9c01140aa1571576be3e6030d8b23e121bf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7045131 Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Daniel Lehmann <dlehmann@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#103242} | 8 个月前 | |
[wasm-custom-desc] Store immediate supertype on Map This patch overlays the Map::dependent_code slot, which is unused for Wasm objects, to store the immediate supertype RTT on maps for types with custom descriptors. That makes the supertype faster to access, which speeds up type checks. Bug: 403372470 Change-Id: I32a0d9c01140aa1571576be3e6030d8b23e121bf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7045131 Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Daniel Lehmann <dlehmann@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#103242} | 8 个月前 | |
[pku] unify wasm::CodeSpaceWriteScope with rwx scope Turn wasm_memory_protection_keys into memory_protection_keys and make the wasm::CodeSpaceWriteScope a simple wrapper around the rwx scope. Change-Id: Ie76b6880f2c754d0d3475af9b1761935d755fad4 Bug: v8:13355 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4568330 Commit-Queue: Stephen Röttger <sroettger@google.com> Reviewed-by: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#87931} | 3 年前 | |
Include guards should be at the top of files. For the include guard optimization to kick in the include guards should be the first thing in the file, not counting comments. In some cases the guard has been moved above a comment for consistency even though this does not matter. A couple of include guards have been renamed for uniqueness. git cl upload complained about some lint nits which have been fixed. Change-Id: Iaa208ea6557c36c84bc7bb77c787ba9feb7cf037 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6275067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98907} | 1 年前 | |
[wasm] Wasm code coverage: Support Liftoff Spec: https://docs.google.com/document/d/1NaD50lRija9DxHfb8X_rRlJ8EriqG_R20GM9E8Xf9ig/edit?pli=1&tab=t.0 This is the 2nd in a series of CLs to add support for WebAssembly code coverage in V8. This CL adds coverage instrumentation to Liftoff-compiled code. Bug: 354020953 Change-Id: Ib370f729fabe012148bd8ea955ff65d6934f8f4f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6541895 Reviewed-by: Jakob Linke <jgruber@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Reviewed-by: Daniel Lehmann <dlehmann@chromium.org> Commit-Queue: Paolo Severini <paolosev@microsoft.com> Cr-Commit-Position: refs/heads/main@{#100667} | 1 年前 | |
[wasm] Add concept of delayed counter updates When starting module compilation in the background we do not have access to an isolate yet. For finishing compilation, we will later have that, though. So this CL refactors how the NativeModule and the WasmImportWrapperCache (via the WasmCodeAllocator) do counter updates. Instead of storing a shared pointer to one isolate's counters (which could become stale, in particular for the import wrapper cache), we do store outstanding counter updates in a separate data structure and publish them the next time we have access to an isolate. R=jkummerow@chromium.org Bug: 446885278 Change-Id: I56644e5798cbd9171dd02f0bc84b94f922f145bc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6983283 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#102855} | 9 个月前 | |
[wasm][compilation-hints] Write compilation hints to stdout and file We generate the compilation-hints sections from a module, based on collected feedback, behind a couple of new flags. Namely: - We generate the compilation-priority section based on whether a function was compiled and/or marked for tierup. We always generate a 0 compilation priority if the function was compiled, and a 0 optimization priority if it was also marked for tierup. Note that we do not actually tier up in this configuration. - We generate the instruction-frequencies and call-targets sections based on collected liftoff feedback. The flag --wasm-generate-compilation-hints writes a proper wasm module to a file, containing only the new sections. The flag --trace-wasm-generate-compilation-hints emits a textual representation of these sections to stdout. Bug: 405952385 Change-Id: Ibb89123966c4ed3ced77fcefd028f535495f2b30 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7157372 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#103947} | 7 个月前 | |
[wasm][compilation-hints] Write compilation hints to stdout and file We generate the compilation-hints sections from a module, based on collected feedback, behind a couple of new flags. Namely: - We generate the compilation-priority section based on whether a function was compiled and/or marked for tierup. We always generate a 0 compilation priority if the function was compiled, and a 0 optimization priority if it was also marked for tierup. Note that we do not actually tier up in this configuration. - We generate the instruction-frequencies and call-targets sections based on collected liftoff feedback. The flag --wasm-generate-compilation-hints writes a proper wasm module to a file, containing only the new sections. The flag --trace-wasm-generate-compilation-hints emits a textual representation of these sections to stdout. Bug: 405952385 Change-Id: Ibb89123966c4ed3ced77fcefd028f535495f2b30 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7157372 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#103947} | 7 个月前 | |
[wasm-custom-desc] Exact function imports We previously changed ref.func to produce an inexact type when its input is an imported function, because importing allows subtypes. That regresses modularity though, because it makes imported functions less optimizable than functions defined in the module. The solution is to introduce a new kind of import: exact function. Providing a value whose actual type is a subtype of an exact import is disallowed. Bug: 403372470 Change-Id: I1c631140acfcf09a6cbbd5dd37079470600c9435 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7124024 Reviewed-by: Daniel Lehmann <dlehmann@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#103650} | 7 个月前 | |
[wasm-custom-desc] Apply custom section ("direct" approach) This patch implements an alternative approach to the declarative custom section that refers to globals and functions directly and manages prototypes implicitly rather than relying on imported DescriptorOptions and exported functions. Bug: 403372470 Change-Id: I35c1e95a5d70a8f60b90f98e4cfcf512f1b66ae2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6512811 Reviewed-by: Manos Koukoutos <manoskouk@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#100083} | 1 年前 | |
[wasm] ValueType refactoring This changes how we use the bits in the ValueType bit field to store some additional coarse-grained information about the referenced type. The motivation is that this lets us implement subtyping, type union, and type intersection much more efficiently. Bug: 393143505 Change-Id: Ifb49e21c9c8138baa9eabdcdd97dc0541f870510 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6288535 Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#98948} | 1 年前 | |
[wasm] ValueType refactoring This changes how we use the bits in the ValueType bit field to store some additional coarse-grained information about the referenced type. The motivation is that this lets us implement subtyping, type union, and type intersection much more efficiently. Bug: 393143505 Change-Id: Ifb49e21c9c8138baa9eabdcdd97dc0541f870510 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6288535 Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#98948} | 1 年前 | |
[wasm][cleanup] Stop using base::Vector::length() Replacing it with Vector::size() where that makes sense. Bug: 393395932 Change-Id: I419ecca01bb52997fc48bcf6b4dfd54440f7f597 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7146164 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#103679} | 7 个月前 | |
[wasmfx] Implement tag parameters and returns Pass the tag arguments and returns via a stack buffer. The buffer is immediately unpacked by the receiving stack and never used again, so we don't need to visit the tagged slots within that buffer. The pointer to the buffer is passed as an extra argument to the stack switching builtins, and forwarded to the target stack. On the receiving end: - The suspend builtin returns the pointer received from the resume builtin, - The resume handler uses a new pseudo-instruction to materialize the buffer in a fixed register, similar to how we materialize the exception or the continuation object. Arguments and return values in the initial func ref are not supported yet. R=jkummerow@chromium.org Bug: 388533754 Change-Id: I0618b5f41e3ac9981c7d5e2c1214f3ec87300757 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7170116 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Cr-Commit-Position: refs/heads/main@{#103917} | 7 个月前 | |
[wasm][cleanup] Remove decoder BooleanValidationTag In the end, it doesn't end up saving code size in a d8 release build, since all remaining uses of it were in unittests or off-by-default features. It still simplifies the code a little. Bug: 359385818 Change-Id: Ie00dab39ac7621da689247622c49bd1aab65ca1c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5804803 Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Daniel Lehmann <dlehmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#95764} | 1 年前 | |
[wasm] Modernize comparison operators for C++20 This removes a few redundant operator!= (C++20 will rewrite a != b into !(a == b) automatically), and uses defaulted comparisons where it makes sense. R=jkummerow@chromium.org Change-Id: I9c103f56e07389cd462eb1ac9b3e6e7258903ad5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6352237 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#99252} | 1 年前 | |
[wasm] Use designated initialization for LiftoffOptions Remove the setter logic and use standard C++ designated initialization (C++20) instead. R=jkummerow@chromium.org Change-Id: I977001937467766cf8747da4ab326f26527d436b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7021156 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#103033} | 8 个月前 | |
[wasmfx] Emit effect handler tables Record effect handlers after a call if needed. A single effect handler maps the call code offset and the module-relative tag index to the corresponding handler block. At the end, save the vector of handlers in the WasmCode object. Bug: 388533754 Change-Id: If1b266db72fce0a81032f470a43d4abccf2b82e4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7011735 Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Cr-Commit-Position: refs/heads/main@{#103118} | 8 个月前 | |
[wasm][compilation-hints] Additional error tracing ... behind a new tracing flag. Bug: 405952385 Change-Id: If1bc1ce63387b1509b450a1e83f3cbdfd0b7fc0a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7201214 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#103953} | 7 个月前 | |
[riscv][wasm] Make non-far jump table entry patching atomic Before this change, the writes would be atomic, but the reader would be allowed to fetch and execute the two instructions separately. This meant that it was possible to execute the unpatched 'auipc' instruction, but the patched 'jalr' instruction - thus leading to jumps into the middle of nowhere. This fixes the flaky crashing in the wasm-spec-tests/return_call test. Change-Id: Ic1b5da7add15760ea890ad0ef340c18e5bfe40e3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6943610 Commit-Queue: Kasper Lund <kasperl@rivosinc.com> Reviewed-by: Florian Loitsch <floitsch@rivosinc.com> Reviewed-by: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#102448} | 9 个月前 | |
[riscv][wasm] Make non-far jump table entry patching atomic Before this change, the writes would be atomic, but the reader would be allowed to fetch and execute the two instructions separately. This meant that it was possible to execute the unpatched 'auipc' instruction, but the patched 'jalr' instruction - thus leading to jumps into the middle of nowhere. This fixes the flaky crashing in the wasm-spec-tests/return_call test. Change-Id: Ic1b5da7add15760ea890ad0ef340c18e5bfe40e3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6943610 Commit-Queue: Kasper Lund <kasperl@rivosinc.com> Reviewed-by: Florian Loitsch <floitsch@rivosinc.com> Reviewed-by: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#102448} | 9 个月前 | |
Include guards should be at the top of files. For the include guard optimization to kick in the include guards should be the first thing in the file, not counting comments. In some cases the guard has been moved above a comment for consistency even though this does not matter. A couple of include guards have been renamed for uniqueness. git cl upload complained about some lint nits which have been fixed. Change-Id: Iaa208ea6557c36c84bc7bb77c787ba9feb7cf037 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6275067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98907} | 1 年前 | |
[wasm-custom-desc] Encode and decode exact types Bug: 403372470 Change-Id: Ibd21b6503252d04e44a36f1d764eb70922c39253 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6383579 Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#99417} | 1 年前 | |
Include guards should be at the top of files. For the include guard optimization to kick in the include guards should be the first thing in the file, not counting comments. In some cases the guard has been moved above a comment for consistency even though this does not matter. A couple of include guards have been renamed for uniqueness. git cl upload complained about some lint nits which have been fixed. Change-Id: Iaa208ea6557c36c84bc7bb77c787ba9feb7cf037 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6275067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98907} | 1 年前 | |
[wasm] Avoid wire bytes copy on deserialization The DeserializeNativeModule always (when preconditions were met) created a copy of the passed wire bytes. The caller often already has an owned copy though, so the additional copy is unnecessary. This CL thus removes the copy in DeserializeNativeModule and takes over the owned copy from the caller. What complicates this is that ownership of the owned copy must remain with the caller when deserialization fails. So we pass a non-const reference to the owned vector, and ownership is only *conditionally* transferred (when deserialization succeeded). R=jkummerow@chromium.org Change-Id: I21d88c7caa9e3531550ace331e9e44be9cb38b88 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7185804 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#103987} | 7 个月前 | |
[wasm][compilation-hints] Write compilation hints to stdout and file We generate the compilation-hints sections from a module, based on collected feedback, behind a couple of new flags. Namely: - We generate the compilation-priority section based on whether a function was compiled and/or marked for tierup. We always generate a 0 compilation priority if the function was compiled, and a 0 optimization priority if it was also marked for tierup. Note that we do not actually tier up in this configuration. - We generate the instruction-frequencies and call-targets sections based on collected liftoff feedback. The flag --wasm-generate-compilation-hints writes a proper wasm module to a file, containing only the new sections. The flag --trace-wasm-generate-compilation-hints emits a textual representation of these sections to stdout. Bug: 405952385 Change-Id: Ibb89123966c4ed3ced77fcefd028f535495f2b30 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7157372 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#103947} | 7 个月前 | |
[wasm][compilation-hints] Additional error tracing ... behind a new tracing flag. Bug: 405952385 Change-Id: If1bc1ce63387b1509b450a1e83f3cbdfd0b7fc0a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7201214 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#103953} | 7 个月前 | |
[wasm] Add isolate-specific info to AsyncCompileJob later This CL adds an AsyncCompileJob::IsolateSpecificInfo struct which is only populated later (after initialization, potentially after passing bytes to the AsyncCompileJob, but before finishing the async compilation). This will be used for the new API for source phase imports where the isolate, context etc are only known later in the pipeline, after the embedder finished (streaming) background compilation from a foreground task. The main change is that counter updates and the UKM metrics event for decoding need to be delayed until we get hold of an isolate. R=jkummerow@chromium.org Bug: 446885278 Change-Id: I29683a5fd404d6112d1f2daa3ca4b68608eaed15 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7157255 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#103859} | 7 个月前 | |
[wasm] Add isolate-specific info to AsyncCompileJob later This CL adds an AsyncCompileJob::IsolateSpecificInfo struct which is only populated later (after initialization, potentially after passing bytes to the AsyncCompileJob, but before finishing the async compilation). This will be used for the new API for source phase imports where the isolate, context etc are only known later in the pipeline, after the embedder finished (streaming) background compilation from a foreground task. The main change is that counter updates and the UKM metrics event for decoding need to be delayed until we get hold of an isolate. R=jkummerow@chromium.org Bug: 446885278 Change-Id: I29683a5fd404d6112d1f2daa3ca4b68608eaed15 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7157255 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#103859} | 7 个月前 | |
[v8] Fix CVE-498095290 495751197 497404188 TicketNo: DTS2026041307131 Description: [v8] Fix CVE Team:gitcode Feature or Bugfix: Binary Source: sync from gitcode PrivateCode(Yes/No):No Change-Id: I0685a6966e3fe17da7b8bb20d56b9699d170e9ba Reviewed-by: z30069899,y00500721 Approved-by: y00500721 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/552 Merged-by: public pjenkins Signed-off-by: gaojunyu <gaojunyu2@h-partners.com> revert merge request: DTS2026041307131 [v8] CVE-498095290 495751197 497404188 8ac5be1238b0a137cdb8cbe2561e68832faedf46 This revert merge request !454 | 1 个月前 | |
[wasm] Simplify signatures in module-instantiate.cc This refactoring does not change behavior. It simplifies a few signatures by moving things from callers to callees, and prepares the implementation of exact imports. Bug: 403372470 Change-Id: Iab831c608e6f29c3a3264c5dde918577f85a6f92 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7124718 Reviewed-by: Daniel Lehmann <dlehmann@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#103594} | 7 个月前 | |
[wasm-custom-desc] Exact function imports We previously changed ref.func to produce an inexact type when its input is an imported function, because importing allows subtypes. That regresses modularity though, because it makes imported functions less optimizable than functions defined in the module. The solution is to introduce a new kind of import: exact function. Providing a value whose actual type is a subtype of an exact import is disallowed. Bug: 403372470 Change-Id: I1c631140acfcf09a6cbbd5dd37079470600c9435 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7124024 Reviewed-by: Daniel Lehmann <dlehmann@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#103650} | 7 个月前 | |
Include guards should be at the top of files. For the include guard optimization to kick in the include guards should be the first thing in the file, not counting comments. In some cases the guard has been moved above a comment for consistency even though this does not matter. A couple of include guards have been renamed for uniqueness. git cl upload complained about some lint nits which have been fixed. Change-Id: Iaa208ea6557c36c84bc7bb77c787ba9feb7cf037 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6275067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98907} | 1 年前 | |
Include guards should be at the top of files. For the include guard optimization to kick in the include guards should be the first thing in the file, not counting comments. In some cases the guard has been moved above a comment for consistency even though this does not matter. A couple of include guards have been renamed for uniqueness. git cl upload complained about some lint nits which have been fixed. Change-Id: Iaa208ea6557c36c84bc7bb77c787ba9feb7cf037 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6275067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98907} | 1 年前 | |
[base] Merge SpinningMutex back into Mutex They are now the same; beyond that we can't do ave THREAD_SAFETY_ANALYSIS on a bunch of previous SpinningMutex cases, so we'll need to propagate this into Mutex. Bug: 384940357 Change-Id: Ifbd4ffc4090738455036f32d9a5cf813b9f15781 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6244422 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#98597} | 1 年前 | |
Include guards should be at the top of files. For the include guard optimization to kick in the include guards should be the first thing in the file, not counting comments. In some cases the guard has been moved above a comment for consistency even though this does not matter. A couple of include guards have been renamed for uniqueness. git cl upload complained about some lint nits which have been fixed. Change-Id: Iaa208ea6557c36c84bc7bb77c787ba9feb7cf037 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6275067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98907} | 1 年前 | |
Include guards should be at the top of files. For the include guard optimization to kick in the include guards should be the first thing in the file, not counting comments. In some cases the guard has been moved above a comment for consistency even though this does not matter. A couple of include guards have been renamed for uniqueness. git cl upload complained about some lint nits which have been fixed. Change-Id: Iaa208ea6557c36c84bc7bb77c787ba9feb7cf037 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6275067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98907} | 1 年前 | |
[arm64][wasm] Add 8x8 Deinterleave using UZP Two UZP/UZP2 instructions can be chained to extract every fourth element in a shuffle, from a different offset for each combination. Change-Id: Ifd8960d7df935a09f435cb6bd431717586c6ecb3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7165874 Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Sam Parker-Haynes <sam.parker@arm.com> Commit-Queue: Sam Parker-Haynes <sam.parker@arm.com> Cr-Commit-Position: refs/heads/main@{#103803} | 7 个月前 | |
[arm64][wasm] Add 8x8 Deinterleave using UZP Two UZP/UZP2 instructions can be chained to extract every fourth element in a shuffle, from a different offset for each combination. Change-Id: Ifd8960d7df935a09f435cb6bd431717586c6ecb3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7165874 Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Sam Parker-Haynes <sam.parker@arm.com> Commit-Queue: Sam Parker-Haynes <sam.parker@arm.com> Cr-Commit-Position: refs/heads/main@{#103803} | 7 个月前 | |
[wasmfx] Visit active stack's func ref and cont Wasm's StackMemory holds two references: the current cont ref associated with the stack, and the func ref that is called when the stack is resumed for the first time. These objects are visited as roots in StackMemory::Iterate, but this function was only called on inactive stacks. Also call it on the active stack to ensure that we visit these special stack roots. R=jkummerow@chromium.org Fixed: 455832038 Change-Id: I9147058c06305ec42385a5781ec8604271fc4289 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7146381 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Cr-Commit-Position: refs/heads/main@{#103699} | 7 个月前 | |
[wasmfx] Visit active stack's func ref and cont Wasm's StackMemory holds two references: the current cont ref associated with the stack, and the func ref that is called when the stack is resumed for the first time. These objects are visited as roots in StackMemory::Iterate, but this function was only called on inactive stacks. Also call it on the active stack to ensure that we visit these special stack roots. R=jkummerow@chromium.org Fixed: 455832038 Change-Id: I9147058c06305ec42385a5781ec8604271fc4289 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7146381 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Cr-Commit-Position: refs/heads/main@{#103699} | 7 个月前 | |
Include guards should be at the top of files. For the include guard optimization to kick in the include guards should be the first thing in the file, not counting comments. In some cases the guard has been moved above a comment for consistency even though this does not matter. A couple of include guards have been renamed for uniqueness. git cl upload complained about some lint nits which have been fixed. Change-Id: Iaa208ea6557c36c84bc7bb77c787ba9feb7cf037 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6275067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98907} | 1 年前 | |
[wasm][streaming] Allow more bytes after discard Similar to Finish after discard, we also need to allow more bytes after discard. R=jkummerow@chromium.org Bug: 464036985 Change-Id: I4c19481bac820502c56324410b5c7ac5975a701a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7207402 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#103996} | 7 个月前 | |
[wasm] Avoid wire bytes copy on deserialization The DeserializeNativeModule always (when preconditions were met) created a copy of the passed wire bytes. The caller often already has an owned copy though, so the additional copy is unnecessary. This CL thus removes the copy in DeserializeNativeModule and takes over the owned copy from the caller. What complicates this is that ownership of the owned copy must remain with the caller when deserialization fails. So we pass a non-const reference to the owned vector, and ownership is only *conditionally* transferred (when deserialization succeeded). R=jkummerow@chromium.org Change-Id: I21d88c7caa9e3531550ace331e9e44be9cb38b88 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7185804 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#103987} | 7 个月前 | |
[wasm-custom-desc] JS Interop: fix bugs related to "statics" Install static methods/accessors on the right constructor. Don't skip parents when no statics are requested. Initialize class member fields before reading them. Bonus fix: print offsets correctly in wami. Bug: 403372470 Change-Id: I2be1fff1397b3e304bbd5d3736156f8c48969ee0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6862792 Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Daniel Lehmann <dlehmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#101935} | 10 个月前 | |
Include guards should be at the top of files. For the include guard optimization to kick in the include guards should be the first thing in the file, not counting comments. In some cases the guard has been moved above a comment for consistency even though this does not matter. A couple of include guards have been renamed for uniqueness. git cl upload complained about some lint nits which have been fixed. Change-Id: Iaa208ea6557c36c84bc7bb77c787ba9feb7cf037 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6275067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98907} | 1 年前 | |
[wasm-custom-desc] Drop outdated approaches Recent evolution of the proposal suggests that the "Modular" and "Direct" approaches we prototyped earlier will not make it to standardization, so this patch drops their implementation. The replacement is importing "wasm:js-prototypes" "configureAll", and calling that from the start function. Bug: 403372470 Change-Id: Icdc057eac8c59dc9150a77628edc6e5b1342482d Fixed: 444775587 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6948145 Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Daniel Lehmann <dlehmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#102478} | 9 个月前 | |
[wasm] Avoid wire bytes copy on deserialization The DeserializeNativeModule always (when preconditions were met) created a copy of the passed wire bytes. The caller often already has an owned copy though, so the additional copy is unnecessary. This CL thus removes the copy in DeserializeNativeModule and takes over the owned copy from the caller. What complicates this is that ownership of the owned copy must remain with the caller when deserialization fails. So we pass a non-const reference to the owned vector, and ownership is only *conditionally* transferred (when deserialization succeeded). R=jkummerow@chromium.org Change-Id: I21d88c7caa9e3531550ace331e9e44be9cb38b88 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7185804 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#103987} | 7 个月前 | |
Reland "[sandbox][wasm] Un-expose dispatch_table_for_imports" This is a reland of commit 7a322570d2973af0abf7f3122eb0674334d3af0a Revert reason was a flake; relanding without modifications. Original change's description: > The WasmTrustedInstanceData's dispatch_table_for_imports reuses > the WasmDispatchTable class, but contrary to regular tables doesn't > expect any modifications to it after creation. To guard against > swapping attacks after in-sandbox corruption, which could cause > such unexpected modifications, this patch un-exposes that particular > dispatch table, making it unreachable from any in-sandbox object. Fixed: 452605803 Change-Id: I86e324ba268139276e6b0e774d7a5f2106807d33 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7105440 Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103436} | 8 个月前 | |
[wasm][compilation-hints] Additional error tracing ... behind a new tracing flag. Bug: 405952385 Change-Id: If1bc1ce63387b1509b450a1e83f3cbdfd0b7fc0a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7201214 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#103953} | 7 个月前 | |
[wasm] Refactor templatized Wasm wrapper builder Follow-up after https://crrev.com/c/6827999. Bug: 353475584 Change-Id: I3615a6ac8618880b6f300663b4934bce6c6b22a3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6828760 Reviewed-by: Daniel Lehmann <dlehmann@chromium.org> Reviewed-by: Thibaud Michaud <thibaudm@chromium.org> Commit-Queue: Paolo Severini <paolosev@microsoft.com> Cr-Commit-Position: refs/heads/main@{#101884} | 10 个月前 | |
[wasm] Store index on CanonicalSig Extend the CanonicalSig class to contain the canonical type index. This allows to pass or store the signature in more places instead of the index, and avoids some linear searches for the index of a given signature (FindIndex_Slow). R=dlehmann@chromium.org CC=jkummerow@chromium.org Bug: 397489547 Change-Id: Ie55869a96314f63aa185cfacbbcf1e1af1b27026 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6895241 Reviewed-by: Daniel Lehmann <dlehmann@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#102103} | 10 个月前 | |
[wasm][cleanup] Stop using HeapType::Representation That enum has been deprecated for a long time, this CL replaces all uses of it with its replacements (mostly "GenericKind"). This is, in particular, a prerequisite for increasing the maximum number of canonical type indices. Bug: 452635472, 42203975 Change-Id: Ia4c0d6b5f35c330e8f8f3b81a69d02b32e23e063 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7054524 Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103219} | 8 个月前 | |
Include guards should be at the top of files. For the include guard optimization to kick in the include guards should be the first thing in the file, not counting comments. In some cases the guard has been moved above a comment for consistency even though this does not matter. A couple of include guards have been renamed for uniqueness. git cl upload complained about some lint nits which have been fixed. Change-Id: Iaa208ea6557c36c84bc7bb77c787ba9feb7cf037 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6275067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98907} | 1 年前 | |
Reland "[wasm] Differentiate the stack guard on loop back edges" This is a reland of commit 5868db33ba95544a8945bfc6f478cb79de0cf641 Changed in reland: when we only handle no-heap-write interrupt requests, we should only check for such requests. Original review: crrev.com/c/7036471 Change-Id: I745216818096640672d3b75c230e6235b166d4c0 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7062937 Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#103226} | 8 个月前 | |
[wasm] Wasm code coverage: Support Turbofan/turboshaft Spec: https://docs.google.com/document/d/1NaD50lRija9DxHfb8X_rRlJ8EriqG_R20GM9E8Xf9ig/edit?pli=1&tab=t.0 This is the 4th in a series of CLs to add support for WebAssembly code coverage in V8. This CL adds coverage instrumentation to Turbofan-compiled code. Bug: 354020953 Change-Id: I7e395cf48de66c139bea84611b00e802d50ab199 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6623972 Reviewed-by: Daniel Lehmann <dlehmann@chromium.org> Commit-Queue: Paolo Severini <paolosev@microsoft.com> Cr-Commit-Position: refs/heads/main@{#100873} | 1 年前 | |
[wasm][cleanup] Stop using base::Vector::length() Replacing it with Vector::size() where that makes sense. Bug: 393395932 Change-Id: I419ecca01bb52997fc48bcf6b4dfd54440f7f597 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7146164 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#103679} | 7 个月前 | |
[wasm][cleanup] Stop using base::Vector::length() Replacing it with Vector::size() where that makes sense. Bug: 393395932 Change-Id: I419ecca01bb52997fc48bcf6b4dfd54440f7f597 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7146164 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#103679} | 7 个月前 | |
[wasm] update WasmCodePointer via WritableJitAllocation The WritableJitAllocation already unlocks the memory for writing in WasmImportWrapperCache::AddWrapper. Use it to update the WasmCodePointer for the newly compiled wrapper. Bug: 412553113 Change-Id: Ib68b3b0e0983fffbf3c27b213bf9ad6f84daded9 Cq-Include-Trybots: luci.v8.try:v8_linux64_pku_dbg,v8_linux64_pku_rel Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6533079 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Stephen Röttger <sroettger@google.com> Cr-Commit-Position: refs/heads/main@{#100267} | 1 年前 | |
[base] Merge SpinningMutex back into Mutex They are now the same; beyond that we can't do ave THREAD_SAFETY_ANALYSIS on a bunch of previous SpinningMutex cases, so we'll need to propagate this into Mutex. Bug: 384940357 Change-Id: Ifbd4ffc4090738455036f32d9a5cf813b9f15781 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6244422 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#98597} | 1 年前 | |
[wasm] update WasmCodePointer via WritableJitAllocation The WritableJitAllocation already unlocks the memory for writing in WasmImportWrapperCache::AddWrapper. Use it to update the WasmCodePointer for the newly compiled wrapper. Bug: 412553113 Change-Id: Ib68b3b0e0983fffbf3c27b213bf9ad6f84daded9 Cq-Include-Trybots: luci.v8.try:v8_linux64_pku_dbg,v8_linux64_pku_rel Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6533079 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Stephen Röttger <sroettger@google.com> Cr-Commit-Position: refs/heads/main@{#100267} | 1 年前 | |
[wasm][compilation-hints] Write compilation hints to stdout and file We generate the compilation-hints sections from a module, based on collected feedback, behind a couple of new flags. Namely: - We generate the compilation-priority section based on whether a function was compiled and/or marked for tierup. We always generate a 0 compilation priority if the function was compiled, and a 0 optimization priority if it was also marked for tierup. Note that we do not actually tier up in this configuration. - We generate the instruction-frequencies and call-targets sections based on collected liftoff feedback. The flag --wasm-generate-compilation-hints writes a proper wasm module to a file, containing only the new sections. The flag --trace-wasm-generate-compilation-hints emits a textual representation of these sections to stdout. Bug: 405952385 Change-Id: Ibb89123966c4ed3ced77fcefd028f535495f2b30 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7157372 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#103947} | 7 个月前 | |
[wasm] Use designated initialization for LiftoffOptions Remove the setter logic and use standard C++ designated initialization (C++20) instead. R=jkummerow@chromium.org Change-Id: I977001937467766cf8747da4ab326f26527d436b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7021156 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#103033} | 8 个月前 | |
[wasm] Modernize comparison operators for C++20 This removes a few redundant operator!= (C++20 will rewrite a != b into !(a == b) automatically), and uses defaulted comparisons where it makes sense. R=jkummerow@chromium.org Change-Id: I9c103f56e07389cd462eb1ac9b3e6e7258903ad5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6352237 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#99252} | 1 年前 | |
[wasm][deopt] Do not serialize uninitialized bytes The DeoptimizationLiteral contains a union of varying size, plus padding bytes after the kind_ field. Depending on the size of the union there is a varying amount of uninitialized bytes in those objects. We thus shouldn't memcpy them completely over into WasmCode and from there into serialized bytes. This was uncovered by MSan complaining when computing a hash over the serialized bytes: https://crrev.com/c/6998009 This CL implements proper serialization and deserialization of DeoptimizationLiteral, which has the added benefit that it saves some space for deoptimization data. R=mliedtke@chromium.org CC=jkummerow@chromium.org Change-Id: Ia4de88fd558cbed09533d05a3782d1ed8e04a7cb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6999754 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#102854} | 9 个月前 | |
[wasm][deopt] Do not serialize uninitialized bytes The DeoptimizationLiteral contains a union of varying size, plus padding bytes after the kind_ field. Depending on the size of the union there is a varying amount of uninitialized bytes in those objects. We thus shouldn't memcpy them completely over into WasmCode and from there into serialized bytes. This was uncovered by MSan complaining when computing a hash over the serialized bytes: https://crrev.com/c/6998009 This CL implements proper serialization and deserialization of DeoptimizationLiteral, which has the added benefit that it saves some space for deoptimization data. R=mliedtke@chromium.org CC=jkummerow@chromium.org Change-Id: Ia4de88fd558cbed09533d05a3782d1ed8e04a7cb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6999754 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Cr-Commit-Position: refs/heads/main@{#102854} | 9 个月前 | |
Include guards should be at the top of files. For the include guard optimization to kick in the include guards should be the first thing in the file, not counting comments. In some cases the guard has been moved above a comment for consistency even though this does not matter. A couple of include guards have been renamed for uniqueness. git cl upload complained about some lint nits which have been fixed. Change-Id: Iaa208ea6557c36c84bc7bb77c787ba9feb7cf037 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6275067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98907} | 1 年前 | |
[wasm-custom-desc] Exact function imports We previously changed ref.func to produce an inexact type when its input is an imported function, because importing allows subtypes. That regresses modularity though, because it makes imported functions less optimizable than functions defined in the module. The solution is to introduce a new kind of import: exact function. Providing a value whose actual type is a subtype of an exact import is disallowed. Bug: 403372470 Change-Id: I1c631140acfcf09a6cbbd5dd37079470600c9435 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7124024 Reviewed-by: Daniel Lehmann <dlehmann@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#103650} | 7 个月前 | |
Include guards should be at the top of files. For the include guard optimization to kick in the include guards should be the first thing in the file, not counting comments. In some cases the guard has been moved above a comment for consistency even though this does not matter. A couple of include guards have been renamed for uniqueness. git cl upload complained about some lint nits which have been fixed. Change-Id: Iaa208ea6557c36c84bc7bb77c787ba9feb7cf037 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6275067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98907} | 1 年前 | |
Merged: [wasm] Fix deleting compile jobs per context Flip a condition: We want to delete all jobs which *do* match the context. Plus a simplification in DeleteCompileJobsOnIsolate which does not change semantics. R=jkummerow@chromium.org (cherry picked from commit 3d3e6a10b59f7fb7b53bec1a419c907c1051a455) Bug: 466758185 Fixed: 468996868 Change-Id: Iaa296bb1c152190fe5adccab758774b87c299596 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7260276 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/branch-heads/14.4@{#22} Cr-Branched-From: 80acc26727d5a34e77dabeebe7c9213ec1bd4768-refs/heads/14.4.258@{#1} Cr-Branched-From: ce7e597e90f6df3fa4b6df224bc613b80c635450-refs/heads/main@{#104020} | 6 个月前 | |
[wasm] Add isolate-specific info to AsyncCompileJob later This CL adds an AsyncCompileJob::IsolateSpecificInfo struct which is only populated later (after initialization, potentially after passing bytes to the AsyncCompileJob, but before finishing the async compilation). This will be used for the new API for source phase imports where the isolate, context etc are only known later in the pipeline, after the embedder finished (streaming) background compilation from a foreground task. The main change is that counter updates and the UKM metrics event for decoding need to be delayed until we get hold of an isolate. R=jkummerow@chromium.org Bug: 446885278 Change-Id: I29683a5fd404d6112d1f2daa3ca4b68608eaed15 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7157255 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#103859} | 7 个月前 | |
[wasm-custom-desc] New WasmExportWrapperCache This replaces the cache we use for JS-to-Wasm wrappers, which so far was a WeakFixedArray indexed by canonical type index, with a weak hash map: still based on a WeakFixedArray, but indexing like a HashTable (open addressing, quadratic probing). The intention is twofold: (1) Save memory. We expect that there may be tens of thousands of canonical types, but only a small minority of them will get compiled js-to-wasm wrappers. (2) Support more than one wrapper per type index for an upcoming new feature: exported Wasm functions will gain a configurable ability to pass the JS-side receiver as the first Wasm-side parameter, rather than ignoring it as they did so far. That behavior will need to be baked into the compiled wrappers. Bug: 403372470 Change-Id: I524761b4e1cfdd32113812d03488b446c9a4ba88 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6491348 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#99941} | 1 年前 | |
Revert "[wasm-gc] Bump kMaxCanonicalTypes to 2M" This reverts commit 3bd862a178c6f8ff6607fae981158c2c4f15105e. Reason for revert: need to migrate legacy code first, otherwise this causes bugs. Bug: 42203975 Fixed: 452635472 No-Presubmit: true No-Tree-Checks: true No-Try: true Change-Id: I9683bac07ae55ee610c7f4516dfe13f349e9bc5a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7053329 Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#103180} | 8 个月前 | |
TicketNo:DTS2026040312077;DTS2026040207037;DTS2026040207036;DTS2026040135724;DTS2026040135722;DTS2026032818442;DTS2026032530470;DTS2026032530464;DTS2026031327981;DTS2026031222703;DTS2026031222694;DTS2026031222686;DTS2026031222671;DTS2026031222662;DTS2026031222654 Description:【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Team:v8 Feature or Bugfix:Bugfix Binary Source:No PrivateCode(Yes/No):No Change-Id: Iae84c8fcc36a25b1936ec0997008368f70096cd6 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/534 Merged-by: public pjenkins Signed-off-by: Marja Hölttä <marja@chromium.org> | 1 个月前 | |
TicketNo:DTS2026040312077;DTS2026040207037;DTS2026040207036;DTS2026040135724;DTS2026040135722;DTS2026032818442;DTS2026032530470;DTS2026032530464;DTS2026031327981;DTS2026031222703;DTS2026031222694;DTS2026031222686;DTS2026031222671;DTS2026031222662;DTS2026031222654 Description:【CVE-2026-4450】【487746373】【490642836】【CVE-2026-4457】【488803413】[CVE-2026-4461][490558172][489159859][481749436][491191100][492077213][496629079][472181383][480442279][481295170][485784597][474402856][483220222] Team:v8 Feature or Bugfix:Bugfix Binary Source:No PrivateCode(Yes/No):No Change-Id: Iae84c8fcc36a25b1936ec0997008368f70096cd6 Reviewed-by: y00500721 Approved-by: w00518651 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/534 Merged-by: public pjenkins Signed-off-by: Marja Hölttä <marja@chromium.org> | 1 个月前 | |
[wasm] Enable Wasm RAB/GSAB integration on by default Bug: 42202693 Change-Id: I54ab77d07f458819245d10849516d59a9bee8aff Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7182265 Reviewed-by: Thibaud Michaud <thibaudm@chromium.org> Commit-Queue: Deepti Gandluri <gdeepti@chromium.org> Cr-Commit-Position: refs/heads/main@{#103884} | 7 个月前 | |
[JSPI][Drumbrake] Disabling JSPI for Wasm Interpreter and Sync This PR disables the JSPI integration when running in wasm interpreter (jitless mode). JSPI recently removed the flags required to be enabled, which broke the previous disabling of this feature for drumbrake. In this CL we also disable customs descriptors for Wasm Drumbrake. Include in this CL build fixes in Drumbrake fuzzers from filename change. Bug: None Change-Id: I975a8387af03245d47df11b1f94591eabc8fae0b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7121798 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Emmanuel Romero Ruiz <emromero@microsoft.com> Cr-Commit-Position: refs/heads/main@{#103545} | 7 个月前 | |
[wasm] Serialize compile time imports in header This will give us the nice property that deserialization never fails if the header matches (under the assumption that embedders provide valid serialized bytes, which we have to assume anyway). Also drop one test which passed truncated serialized bytes; that's not something the API supports. R=jkummerow@chromium.org Change-Id: I46d6e8df0ac52e5a595364d0d860a944823560e3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7185803 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#103957} | 7 个月前 | |
[wasmfx] Emit effect handler tables Record effect handlers after a call if needed. A single effect handler maps the call code offset and the module-relative tag index to the corresponding handler block. At the end, save the vector of handlers in the WasmCode object. Bug: 388533754 Change-Id: If1b266db72fce0a81032f470a43d4abccf2b82e4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7011735 Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Cr-Commit-Position: refs/heads/main@{#103118} | 8 个月前 | |
[wasm] Remove explicit initialization of WasmImportWrapperCache By just default-allocating the WasmCodeAllocator, it will reserve the first code space when the first import wrapper is added. This changes two things: 1) Instead of reserving 32kB initially, the WasmCodeAllocator will reserve a single page only (assuming the wrapper code fit within one page). So we might need to allocate 1-2 more code spaces if many wrappers are compiled in one process. 2) We do not have an isolate to trigger GC when allocation fails. This is unlikely to increase the number of OOMs, since a) we only had an isolate for the first 32k reservation, and not for code spaces added later, and b) import wrappers are rather small compared to actual Wasm code, so it's unlikely that we run out of memory when compiling import wrappers. If we *do* see an increase in OOM, we could still pass the isolate to WasmImportWrapperCache::ModificationScope::AddWrapper (all callers have an isolate), and pass it on through WasmCodeAllocator::AllocateForWrapper to WasmCodeAllocator::AllocateForCodeInRegion, where we can trigger a GC when a code space reservation fails. We will leave that option for later though. R=jkummerow@chromium.org Bug: 446885278 Change-Id: Iea819f25171a1eebedaca093fc6f63340a69000f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6988709 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#102869} | 8 个月前 | |
[wasm-custom-desc] Add struct.new_desc and struct.new_default_desc to replace struct.new and struct.new_default, respectively, for allocating described types. Validate that struct.new_desc and struct.new_default_desc cannot be used to allocate non-described types. In the future we will also validate that they must be used to allocate described types, but to allow for a graceful update period, that validation is commented out for now. The corresponding proposal PR is https://github.com/WebAssembly/custom-descriptors/pull/85. Bug: 403372470 Change-Id: I399164ac38bdf7cbb930e14ee90bca1bb8c5873e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7171646 Commit-Queue: Thomas Lively <tlively@google.com> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#103858} | 7 个月前 | |
[v8] Fix CVE-498095290 495751197 497404188 TicketNo: DTS2026041307131 Description: [v8] Fix CVE Team:gitcode Feature or Bugfix: Binary Source: sync from gitcode PrivateCode(Yes/No):No Change-Id: I0685a6966e3fe17da7b8bb20d56b9699d170e9ba Reviewed-by: z30069899,y00500721 Approved-by: y00500721 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/552 Merged-by: public pjenkins Signed-off-by: gaojunyu <gaojunyu2@h-partners.com> revert merge request: DTS2026041307131 [v8] CVE-498095290 495751197 497404188 8ac5be1238b0a137cdb8cbe2561e68832faedf46 This revert merge request !454 | 1 个月前 | |
Reland "[d8][wasm] Fix deserialization with differing compile time imports" This is a reland of commit 8798d80ac021050913b2cfa26f6e8ad0cf19f5ee. PS2 skips the new test in the isolates variant. Original change's description: > [d8][wasm] Fix deserialization with differing compile time imports > > Add another argument to d8.wasm.deserializeModule to specify compile > time imports. This matches how deserialization is typically triggered > via streaming compilation. > If compile time imports do not match, deserialization fails with an > exception. > > The logic to parse compile time imports is now exposed via the WasmJs > class. > > Drive-by: Pass enabled features to DeserializeNativeModule instead of > querying them from the isolate; the caller (in production) often already > got hold of the enabled features. In tests, we can just pass > WasmEnabledFeatures::All(). > > R=jkummerow@chromium.org > > Bug: 449010912 > Change-Id: I82370e02e6bb0a734cc77a1d0678bdab878387c1 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7032220 > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> > Commit-Queue: Clemens Backes <clemensb@chromium.org> > Cr-Commit-Position: refs/heads/main@{#103068} Bug: 449010912 Change-Id: I580f303cd1ff38dc2880646a7f339f6e1c817509 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7036091 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#103083} | 8 个月前 | |
[wasm] Remove two unused limit constants kV8MaxWasmStringSize was introduced together with all other limits in 2016 (https://codereview.chromium.org/2551463002), but was never used. kV8MaxWasmExceptionTypes was introduced in 2017 (https://crrev.com/c/561757) but also dead since its introduction. R=jkummerow@chromium.org Change-Id: I73453f7f496b1eea6e28e8202b2e73afa0690535 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7021835 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#103021} | 8 个月前 | |
Include guards should be at the top of files. For the include guard optimization to kick in the include guards should be the first thing in the file, not counting comments. In some cases the guard has been moved above a comment for consistency even though this does not matter. A couple of include guards have been renamed for uniqueness. git cl upload complained about some lint nits which have been fixed. Change-Id: Iaa208ea6557c36c84bc7bb77c787ba9feb7cf037 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6275067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98907} | 1 年前 | |
[wasm-custom-desc] Add struct.new_desc and struct.new_default_desc to replace struct.new and struct.new_default, respectively, for allocating described types. Validate that struct.new_desc and struct.new_default_desc cannot be used to allocate non-described types. In the future we will also validate that they must be used to allocate described types, but to allow for a graceful update period, that validation is commented out for now. The corresponding proposal PR is https://github.com/WebAssembly/custom-descriptors/pull/85. Bug: 403372470 Change-Id: I399164ac38bdf7cbb930e14ee90bca1bb8c5873e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7171646 Commit-Queue: Thomas Lively <tlively@google.com> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#103858} | 7 个月前 | |
[wasm-custom-desc] Add struct.new_desc and struct.new_default_desc to replace struct.new and struct.new_default, respectively, for allocating described types. Validate that struct.new_desc and struct.new_default_desc cannot be used to allocate non-described types. In the future we will also validate that they must be used to allocate described types, but to allow for a graceful update period, that validation is commented out for now. The corresponding proposal PR is https://github.com/WebAssembly/custom-descriptors/pull/85. Bug: 403372470 Change-Id: I399164ac38bdf7cbb930e14ee90bca1bb8c5873e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7171646 Commit-Queue: Thomas Lively <tlively@google.com> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#103858} | 7 个月前 | |
use explicit v8::String namespace in internal code This otherwise does not compile with clangcl 18.1 on Windows because it would be inferred as v8::internal::String Refs: https://github.com/nodejs/node/pull/56959 Change-Id: Ia14e2a5c2a730772a64e1c31019d0144d4eeb78f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6271543 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Joyee Cheung <joyee@igalia.com> Cr-Commit-Position: refs/heads/main@{#98734} | 1 年前 | |
Include guards should be at the top of files. For the include guard optimization to kick in the include guards should be the first thing in the file, not counting comments. In some cases the guard has been moved above a comment for consistency even though this does not matter. A couple of include guards have been renamed for uniqueness. git cl upload complained about some lint nits which have been fixed. Change-Id: Iaa208ea6557c36c84bc7bb77c787ba9feb7cf037 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6275067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98907} | 1 年前 | |
[wasm][compilation-hints] Write compilation hints to stdout and file We generate the compilation-hints sections from a module, based on collected feedback, behind a couple of new flags. Namely: - We generate the compilation-priority section based on whether a function was compiled and/or marked for tierup. We always generate a 0 compilation priority if the function was compiled, and a 0 optimization priority if it was also marked for tierup. Note that we do not actually tier up in this configuration. - We generate the instruction-frequencies and call-targets sections based on collected liftoff feedback. The flag --wasm-generate-compilation-hints writes a proper wasm module to a file, containing only the new sections. The flag --trace-wasm-generate-compilation-hints emits a textual representation of these sections to stdout. Bug: 405952385 Change-Id: Ibb89123966c4ed3ced77fcefd028f535495f2b30 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7157372 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#103947} | 7 个月前 | |
[wasm][compilation-hints] Write compilation hints to stdout and file We generate the compilation-hints sections from a module, based on collected feedback, behind a couple of new flags. Namely: - We generate the compilation-priority section based on whether a function was compiled and/or marked for tierup. We always generate a 0 compilation priority if the function was compiled, and a 0 optimization priority if it was also marked for tierup. Note that we do not actually tier up in this configuration. - We generate the instruction-frequencies and call-targets sections based on collected liftoff feedback. The flag --wasm-generate-compilation-hints writes a proper wasm module to a file, containing only the new sections. The flag --trace-wasm-generate-compilation-hints emits a textual representation of these sections to stdout. Bug: 405952385 Change-Id: Ibb89123966c4ed3ced77fcefd028f535495f2b30 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7157372 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#103947} | 7 个月前 | |
[v8] Fix CVE-498095290 495751197 497404188 TicketNo: DTS2026041307131 Description: [v8] Fix CVE Team:gitcode Feature or Bugfix: Binary Source: sync from gitcode PrivateCode(Yes/No):No Change-Id: I0685a6966e3fe17da7b8bb20d56b9699d170e9ba Reviewed-by: z30069899,y00500721 Approved-by: y00500721 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/552 Merged-by: public pjenkins Signed-off-by: gaojunyu <gaojunyu2@h-partners.com> revert merge request: DTS2026041307131 [v8] CVE-498095290 495751197 497404188 8ac5be1238b0a137cdb8cbe2561e68832faedf46 This revert merge request !454 | 1 个月前 | |
[v8] Fix CVE-498095290 495751197 497404188 TicketNo: DTS2026041307131 Description: [v8] Fix CVE Team:gitcode Feature or Bugfix: Binary Source: sync from gitcode PrivateCode(Yes/No):No Change-Id: I0685a6966e3fe17da7b8bb20d56b9699d170e9ba Reviewed-by: z30069899,y00500721 Approved-by: y00500721 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/552 Merged-by: public pjenkins Signed-off-by: gaojunyu <gaojunyu2@h-partners.com> revert merge request: DTS2026041307131 [v8] CVE-498095290 495751197 497404188 8ac5be1238b0a137cdb8cbe2561e68832faedf46 This revert merge request !454 | 1 个月前 | |
[v8] Fix CVE-498095290 495751197 497404188 TicketNo: DTS2026041307131 Description: [v8] Fix CVE Team:gitcode Feature or Bugfix: Binary Source: sync from gitcode PrivateCode(Yes/No):No Change-Id: I0685a6966e3fe17da7b8bb20d56b9699d170e9ba Reviewed-by: z30069899,y00500721 Approved-by: y00500721 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/552 Merged-by: public pjenkins Signed-off-by: gaojunyu <gaojunyu2@h-partners.com> revert merge request: DTS2026041307131 [v8] CVE-498095290 495751197 497404188 8ac5be1238b0a137cdb8cbe2561e68832faedf46 This revert merge request !454 | 1 个月前 | |
[v8] Fix CVE-498095290 495751197 497404188 TicketNo: DTS2026041307131 Description: [v8] Fix CVE Team:gitcode Feature or Bugfix: Binary Source: sync from gitcode PrivateCode(Yes/No):No Change-Id: I0685a6966e3fe17da7b8bb20d56b9699d170e9ba Reviewed-by: z30069899,y00500721 Approved-by: y00500721 Merged-on: https://open.codehub.huawei.com/OpenSourceCenter_CR/openharmony-tpc/chromium_v8/-/change_requests/552 Merged-by: public pjenkins Signed-off-by: gaojunyu <gaojunyu2@h-partners.com> revert merge request: DTS2026041307131 [v8] CVE-498095290 495751197 497404188 8ac5be1238b0a137cdb8cbe2561e68832faedf46 This revert merge request !454 | 1 个月前 | |
[cleanup] Fix inl header includes We have many inl headers which either do not include their non-inl header, or are including other headers first. Both can lead to compile errors because definitions of inline functions might not be visible in inl headers. This CL adds a script to fix those includes, and runs it over the whole code base. R=leszeks@chromium.org Change-Id: I1b7b04c59e5a5b89308512bfc40729f7ec4afc38 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6387805 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99453} | 1 年前 | |
[wasm][cleanup] Drop kCanonicalI32 etc aliases They are the same as kWasmI32 etc now anyway. This CL does not change behavior or performance. Change-Id: I5528ae4b8e9f029e2710db3d358cc3284472f4bd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6333549 Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Commit-Queue: Matthias Liedtke <mliedtke@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#99100} | 1 年前 | |
[wasm-custom-desc] Add struct.new_desc and struct.new_default_desc to replace struct.new and struct.new_default, respectively, for allocating described types. Validate that struct.new_desc and struct.new_default_desc cannot be used to allocate non-described types. In the future we will also validate that they must be used to allocate described types, but to allow for a graceful update period, that validation is commented out for now. The corresponding proposal PR is https://github.com/WebAssembly/custom-descriptors/pull/85. Bug: 403372470 Change-Id: I399164ac38bdf7cbb930e14ee90bca1bb8c5873e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7171646 Commit-Queue: Thomas Lively <tlively@google.com> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#103858} | 7 个月前 | |
[wasm] Use JSAny for stricter type checks We had issues with leaking the termination exception to JS when taking a pending exception from the isolate and setting it as the promise rejection value. This CL makes the C++ types more strict by requiring JSAny for the error reason instead of Object. This requires a cast at callers which do not already have a static subtype of JSAny, and thus makes it more obvious that certain types (like holes) have to be excluded. R=jkummerow@chromium.org Bug: 403308742 Change-Id: Ic764f9db4e6979174eedd5cd1f1e43bb9df32ab4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6375484 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#99360} | 1 年前 | |
[cleanup] Modernize std::*::value and ::type Mechanically replacing std::foo<X>::value with std::foo_v<X>, and the same for ::type -> _t. Change-Id: I543dda07ba4c95534cdcd51f1f438f2626be8273 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6491388 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#99940} | 1 年前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
2026.03.30 arkweb_144代码蓝黄同步 Signed-off-by: jiujiaoxiaogula <sujiahao10@huawei.com> Change-Id: I00194d339064f999dedfc211cd5af5501cbed0fb | 3 个月前 | |
[wasm][cleanup] Stop using HeapType::Representation That enum has been deprecated for a long time, this CL replaces all uses of it with its replacements (mostly "GenericKind"). This is, in particular, a prerequisite for increasing the maximum number of canonical type indices. Bug: 452635472, 42203975 Change-Id: Ia4c0d6b5f35c330e8f8f3b81a69d02b32e23e063 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7054524 Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103219} | 8 个月前 | |
[wasm][cleanup] Stop using HeapType::Representation That enum has been deprecated for a long time, this CL replaces all uses of it with its replacements (mostly "GenericKind"). This is, in particular, a prerequisite for increasing the maximum number of canonical type indices. Bug: 452635472, 42203975 Change-Id: Ia4c0d6b5f35c330e8f8f3b81a69d02b32e23e063 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7054524 Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Cr-Commit-Position: refs/heads/main@{#103219} | 8 个月前 | |
Include guards should be at the top of files. For the include guard optimization to kick in the include guards should be the first thing in the file, not counting comments. In some cases the guard has been moved above a comment for consistency even though this does not matter. A couple of include guards have been renamed for uniqueness. git cl upload complained about some lint nits which have been fixed. Change-Id: Iaa208ea6557c36c84bc7bb77c787ba9feb7cf037 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6275067 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Erik Corry <erikcorry@chromium.org> Cr-Commit-Position: refs/heads/main@{#98907} | 1 年前 | |
[wasm] Add differential fuzzing for tables Compare Wasm tables from reference and non-reference runs for differential fuzzing. Bug: 436219201 Change-Id: I4be2d2ed7fbb04f15903a8311a62ddc02ac6996b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6943373 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Auto-Submit: Nikolas Kaipel <nikolaskaipel@google.com> Cr-Commit-Position: refs/heads/main@{#102770} | 9 个月前 | |
[wasm][fuzzer] compare global and memory traces for differential fuzzing Compare and print the differences in the memory and global traces. The purpose is to assist in finding the specific instructions that caused the differences that were detected by the differential fuzzing. Bug: 436219201 Change-Id: If162278462d2a509864e7f2643f71a57a49b755b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6943430 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Commit-Queue: Nikolas Kaipel <nikolaskaipel@google.com> Cr-Commit-Position: refs/heads/main@{#102746} | 9 个月前 | |
Fix print of type kS128 on big endian platforms Current implementation prints the value in reverse on little endian platforms but in native order on big endian which is causing failures on big endian after this CL: http://crrev.com/c/6827702 This CL makes kS128 print in native order much like other data types. Change-Id: If062327b3e69dec2b77b7e6d56e2a3f830a85b91 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6842017 Commit-Queue: Milad Farazmand <mfarazma@ibm.com> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#101873} | 10 个月前 | |
[wasm-custom-desc] New design for prototype setup This implements an initial version of the new design for installing methods on prototypes that has recently been discussed in the CG: calling a compile-time import from the start function with several arrays containing required data. Bug: 403372470 Change-Id: Ia16c070a2773b433805b8d95763b2cdd4a6048f7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6760393 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#101478} | 11 个月前 | |
[wasm-custom-desc] New design for prototype setup This implements an initial version of the new design for installing methods on prototypes that has recently been discussed in the CG: calling a compile-time import from the start function with several arrays containing required data. Bug: 403372470 Change-Id: Ia16c070a2773b433805b8d95763b2cdd4a6048f7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6760393 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#101478} | 11 个月前 | |
[wasm][turboshaft] Fix Wasm-in-JS inlining of void functions Creating a JS undefined as a result of a Wasm function call with zero return values is already done by the wrapper, so the body inlining should simply produce an invalid value. To make the possible result states a bit more clear, I introduce a new tagged union for the result of the body inlining: failed, successful but with void result, successful with single return value. Note that the mixed wrapper inlining in the Turbofan frontend already took care to never read this result of the call (and instead produces a JS undefined for each use), so this unnecessary value was never consumed. The new wrapper inlining in Turbolev/Turboshaft also correctly ignored this result. Fixed: 462045796 Change-Id: Iee5b50376559f9914da658f548733b4b44904e8a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7177861 Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Commit-Queue: Daniel Lehmann <dlehmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#103949} | 7 个月前 | |
[turboshaft] Embed AssemblerOpInterface into reducer stack The Assembler no longer inherits directly from both, the ReducerStack and the AssemblerOpInterface, but the latter is part of the former's class hierarchy. This allows reducers to overwrite assembler functions (e.g. builtin reducers can provide a CallBuiltin that doesn't require a FrameState argument). Furthermore: Remove the additional layer of TS-abstraction in the Assembler setup that we introduced when we tried to make the Turboshaft architecture IR independent. NO_IFTTT=Only changed class name inside a comment. Bug: 348031042 Change-Id: If8b9b27a9655102b7c85353a8511482297c7c451 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7167247 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#103808} | 7 个月前 | |
[wasm][turboshaft] Fix Wasm-in-JS inlining of void functions Creating a JS undefined as a result of a Wasm function call with zero return values is already done by the wrapper, so the body inlining should simply produce an invalid value. To make the possible result states a bit more clear, I introduce a new tagged union for the result of the body inlining: failed, successful but with void result, successful with single return value. Note that the mixed wrapper inlining in the Turbofan frontend already took care to never read this result of the call (and instead produces a JS undefined for each use), so this unnecessary value was never consumed. The new wrapper inlining in Turbolev/Turboshaft also correctly ignored this result. Fixed: 462045796 Change-Id: Iee5b50376559f9914da658f548733b4b44904e8a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7177861 Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Commit-Queue: Daniel Lehmann <dlehmann@chromium.org> Cr-Commit-Position: refs/heads/main@{#103949} | 7 个月前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 7 个月前 | ||
| 7 个月前 | ||
| 1 个月前 | ||
| 8 个月前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 个月前 | ||
| 1 年前 | ||
| 8 个月前 | ||
| 8 个月前 | ||
| 3 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 9 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 8 个月前 | ||
| 8 个月前 | ||
| 7 个月前 | ||
| 9 个月前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 1 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 10 个月前 | ||
| 1 年前 | ||
| 9 个月前 | ||
| 7 个月前 | ||
| 8 个月前 | ||
| 7 个月前 | ||
| 10 个月前 | ||
| 10 个月前 | ||
| 8 个月前 | ||
| 1 年前 | ||
| 8 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 8 个月前 | ||
| 1 年前 | ||
| 9 个月前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 6 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 8 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 8 个月前 | ||
| 8 个月前 | ||
| 7 个月前 | ||
| 1 个月前 | ||
| 8 个月前 | ||
| 8 个月前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 3 个月前 | ||
| 3 个月前 | ||
| 8 个月前 | ||
| 8 个月前 | ||
| 1 年前 | ||
| 9 个月前 | ||
| 9 个月前 | ||
| 10 个月前 | ||
| 11 个月前 | ||
| 11 个月前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 7 个月前 |