| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
CVE: 503553614 Signed-off-by: jiang-qunchao <jiangqunchao@huawei.com> | 14 天前 | |
Reland [wasm][turbolev] Put Wasm-in-JS inlining under turbolev_future flag Add a flag implication so that the inlining of JS-to-Wasm wrappers will be tested by our fuzzers. Also disable flag --turbolev-inline-js-wasm-wrappers in an inspector test that expects non-inlining behavior. Bug: 353475584 Change-Id: I3b976a822a078995b33f6c61d9180c47e629c15b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6965676 Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Commit-Queue: Paolo Severini <paolosev@microsoft.com> Cr-Commit-Position: refs/heads/main@{#102629} | 9 个月前 | |
[wasm][growable-stacks] Unstage growable stacks The feature seems too unstable at the moment, causing many fuzzer reports, flaky tests and external security reports, involving at least two different root causes. Temporarily downgrade it to experimental while we work on resolving the issues. Bug: 450597581,455053283,452079504,455600242,455600241,455832038 Change-Id: I88287234f104b731f9cd1c9354729794ec6fa584 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7101019 Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org> Reviewed-by: Thibaud Michaud <thibaudm@chromium.org> Cr-Commit-Position: refs/heads/main@{#103410} | 8 个月前 | |
[cdp] Add stackDepth parameter for HeapProfiler.startSampling The Sampling Heap Profiler already supports a stackDepth option internally, but the CDP method HeapProfiler.startSampling did not expose it. This CL adds support for passing stackDepth through CDP. Bug: 443840066 Change-Id: I18ccad126d75b49785a8fde37564be57ecc9c84c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6931850 Commit-Queue: Roman Dvornov <romandvornov@microsoft.com> Reviewed-by: Simon Zünd <szuend@chromium.org> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/main@{#102429} | 9 个月前 | |
CVE:516311623 Signed-off-by: jiang-qunchao <jiangqunchao@huawei.com> | 14 天前 | |
[ArkWeb][安全][自动提交] 修复 Chromium issue 517981277: Handle context destruction when adding binding within V8InspectorImpl::contex… Signed-off-by: silverbullet1412 <zhaoquanzhe1@h-partners.com> | 15 小时前 | |
[inspector] Don't create remote objects for non-shared 'Error' objects Since the page can install accessors on various 'Error' prototypes, its possible to leak information from cross-origin scripts (via the inspector remote object). This CL fixes this particular instance by not creating remote objects for Errors where the 'SharedCrossOrigin' bit is not set in the originating script. Note that to do this, we have to find the right script and get it's origin info. We can't go via the debugger agent as it has not necessarily been enabled and so the script map in the debugger agent could be empty. Drive-by: There is one more oddity we don't fully understand. The scriptId passed via V8Inspector is set to 0 if it matches the top-most frame. This CL reverts this logic in the inspector, but this might break some expectation in DevTools. R=bmeurer@chromium.org Fixed: 420885124 Change-Id: I3c1a7524349cdbadd6768f8c6bf5119d4b59369a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6606957 Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Simon Zünd <szuend@chromium.org> Cr-Commit-Position: refs/heads/main@{#100606} | 1 年前 | |
Exclude warning from targets This CL is part of number of CLs disabling -Wexit-time-destructorsin places where this warning is going off. This will allow having this warning enabled-by-default across the codebase, whilst documenting the places where corrections for this warning are necessary. Bug: chromium:40031409 Change-Id: Ia22d787ec01870f84403aaf1961a0e7d761ef76d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6804641 Commit-Queue: Claudio DeSouza <cdesouza@chromium.org> Reviewed-by: Victor Gomes <victorgomes@chromium.org> Reviewed-by: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/main@{#101772} | 11 个月前 | |
[d8][inspector][test] Fix pumping the message loop When pumping the message loop, we may trigger the execution of a non-nestable task (e.g., a stackless GC), which assumes that there are no handles on the current stack. With v8_enable_direct_local=true (which requires conservative stack scanning), violating this invariant may result in a crash. This CL fixes d8 and the inspector task runner, installing a scope to enforce scanning the stack in this case. It also fixes a unit test that was occasionally failing with conservative stack scanning. Bug: v8:13270 Change-Id: I48916866b7bd4ab235736073b66827e71d78feb8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5331539 Reviewed-by: Simon Zünd <szuend@chromium.org> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Cr-Commit-Position: refs/heads/main@{#92599} | 2 年前 | |
Add DIR_METADATA files to v8. Generate DIR_METADATA files and remove metadata from OWNERS files for v8. R=jkummerow@chromium.org, ochang@chromium.org, yangguo@chromium.org Bug: chromium:1113033 Change-Id: I82cbb62e438d82dbbc408e87120af39fa9da0afa Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2476680 Reviewed-by: Adam Klein <adamk@chromium.org> Reviewed-by: Maya Lekova <mslekova@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Yang Guo <yangguo@chromium.org> Commit-Queue: Edward Lesmes <ehmaldonado@chromium.org> Auto-Submit: Edward Lesmes <ehmaldonado@chromium.org> Cr-Commit-Position: refs/heads/master@{#70669} | 5 年前 | |
Add DIR_METADATA files to v8. Generate DIR_METADATA files and remove metadata from OWNERS files for v8. R=jkummerow@chromium.org, ochang@chromium.org, yangguo@chromium.org Bug: chromium:1113033 Change-Id: I82cbb62e438d82dbbc408e87120af39fa9da0afa Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2476680 Reviewed-by: Adam Klein <adamk@chromium.org> Reviewed-by: Maya Lekova <mslekova@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Yang Guo <yangguo@chromium.org> Commit-Queue: Edward Lesmes <ehmaldonado@chromium.org> Auto-Submit: Edward Lesmes <ehmaldonado@chromium.org> Cr-Commit-Position: refs/heads/master@{#70669} | 5 年前 | |
[inspector] Avoid unnecessary message copy in test harness "StringBuffer" is already an owning data structure. No need to make an extra copy. Bug: 326554286 Change-Id: I8813fa9d7981e11f5e164676d362268ece5917dd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5426197 Reviewed-by: Eric Leese <leese@chromium.org> Commit-Queue: Simon Zünd <szuend@chromium.org> Cr-Commit-Position: refs/heads/main@{#93186} | 2 年前 | |
[runtime] Improve class name inference for JSGlobalProxy ... by using a class name taken from the hidden prototype's constructor's template. This removes the need to return "global" as a JSGlobalProxy's class name in order to be able to handle it on Blink side. Drive-by: - make JSReceiver::class_name() return "Object" instead of "global", - fix a couple of inspector tests which relied upon this logic by explicitly setting globalThis[@@toStringTag] property to "global" in inspector tests harness. Bug: 445115229 Change-Id: I3f62ded94dda940e0229c4053e0241082399f55f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6950166 Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#102527} | 9 个月前 | |
[heap] Remove CSS build flag Where needed, the build flag is replaced by the runtime flag. For using CSS with direct handles, v8_enable_direct_handle = true should be added to the GN args. Bug: 41480448 Change-Id: If15cf6030e6e66a8dbfb057c95aa42355b4c95f2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6448975 Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Nikolaos Papaspyrou <nikolaos@chromium.org> Auto-Submit: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#99783} | 1 年前 | |
[test][inspector] Exit early on termination exception Do not call back into V8 after receiving a termination exception. The test case is convoluted, so this will just land as a quick one-line fix without a regression test. R=cbruni@chromium.org Fixed: 447412342 Change-Id: Ib182d3b2f778ef4f25feafcd0bc09ac59dcb908c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7036456 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/main@{#103116} | 8 个月前 | |
Add contextId to V8InspectorClient::consoleAPIMessage function. Currently we are unable to identify frame from which console message was send in V8InspectroClient. Having contextId we can find Frame and get more information for custom console messages in logs. Bug: 437026560 Change-Id: Ic390f9cab66b8894076cec472eeffc2a6e73a431 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6811579 Reviewed-by: Emanuel Ziegler <ecmziegler@chromium.org> Commit-Queue: Emanuel Ziegler <ecmziegler@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#102602} | 9 个月前 | |
[inspector] Refactor protocol-test.js This refactoring makes it easier to write advanced tests and gives full control over what's happening to the test code. It also forces description for every test. BUG=none Review-Url: https://codereview.chromium.org/2891213002 Cr-Commit-Position: refs/heads/master@{#45412} | 8 年前 | |
[inspector] Refactor protocol-test.js This refactoring makes it easier to write advanced tests and gives full control over what's happening to the test code. It also forces description for every test. BUG=none Review-Url: https://codereview.chromium.org/2891213002 Cr-Commit-Position: refs/heads/master@{#45412} | 8 年前 | |
[tests] Filter out non-existent methods in inspector tests Previously these would silently fail unless the caller checked the .error property of the return value. There are no tests that check iteractions with non-existent methods so this should always be an error at the test runner level, rather than relying on clients to check the error. 1. Fix the tests that accidentally call methods that don't exist. 2. Change the test runner so that it prints an error and ends the test. 3. Add a test that the test runner does #2. Bug: v8:10134 Change-Id: Idd619950a057290c565d58fba6db3ddbcaf2c5eb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2006093 Commit-Queue: Peter Marshall <petermarshall@chromium.org> Reviewed-by: Simon Zünd <szuend@chromium.org> Cr-Commit-Position: refs/heads/master@{#65835} | 6 年前 | |
[tests] Filter out non-existent methods in inspector tests Previously these would silently fail unless the caller checked the .error property of the return value. There are no tests that check iteractions with non-existent methods so this should always be an error at the test runner level, rather than relying on clients to check the error. 1. Fix the tests that accidentally call methods that don't exist. 2. Change the test runner so that it prints an error and ends the test. 3. Add a test that the test runner does #2. Bug: v8:10134 Change-Id: Idd619950a057290c565d58fba6db3ddbcaf2c5eb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2006093 Commit-Queue: Peter Marshall <petermarshall@chromium.org> Reviewed-by: Simon Zünd <szuend@chromium.org> Cr-Commit-Position: refs/heads/master@{#65835} | 6 年前 | |
[inspector] fold private methods into a list Previously we display the private methods alongside the fields, as how they are conceptualized by the specification, but this could clutter the UI if the instance being inspected has a long list of private methods which the user usually care less about. This patch folds the private methods found for an object into an internal list (which is an v8::Array with a null prototype, similar to how [[Scopes]] and [[Entries]] are implemented), so the user can fold and expand the list in the UI to have a better view of the object. Before: https://imgur.com/NaD3m4z After: https://imgur.com/7efKyAh Bug: chromium:1292102, chromium:1246904 Change-Id: If260807afd4dd50b1d15897ab8e8a93a4dcaef3e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4261416 Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Simon Zünd <szuend@chromium.org> Commit-Queue: Joyee Cheung <joyee@igalia.com> Cr-Commit-Position: refs/heads/main@{#86112} | 3 年前 | |
[inspector] Allow untrusted inspector sessions from protocol tests This CL adds a new "isFullyTrusted" argument to the "connectSession" test harness function. It defaults to "true" and is optional to be backwards compatible with existing tests and fuzzer corpus. R=dsv@chromium.org Bug: chromium:1469092 Change-Id: I9b8f70a7cf6eeb592797809b0608f94ea32718c3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4747080 Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Simon Zünd <szuend@chromium.org> Cr-Commit-Position: refs/heads/main@{#89366} | 2 年前 | |
[wasm] Remove an overly strict DCHECK Remove an overly strict DCHECK which helped to catch a few issues where we continued execution after an exception (including termination exceptions), but is unfortunately incompatible with first setting a return value (e.g. a promise) and then still executing some JS code which might trigger an exception. Fixing all those places to clear the return value on exception is not worth the hassle. In order to protect against accidentally passing the exception or termination_exception value to JS, we made the types more strict in https://crrev.com/c/6375484. R=jkummerow@chromium.org Fixed: 403308742 Change-Id: I3e7b90218756bb24fce346a9239b9d37423e704a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6402514 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/main@{#99546} | 1 年前 | |
[d8][inspector][test] Fix pumping the message loop When pumping the message loop, we may trigger the execution of a non-nestable task (e.g., a stackless GC), which assumes that there are no handles on the current stack. With v8_enable_direct_local=true (which requires conservative stack scanning), violating this invariant may result in a crash. This CL fixes d8 and the inspector task runner, installing a scope to enforce scanning the stack in this case. It also fixes a unit test that was occasionally failing with conservative stack scanning. Bug: v8:13270 Change-Id: I48916866b7bd4ab235736073b66827e71d78feb8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5331539 Reviewed-by: Simon Zünd <szuend@chromium.org> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Cr-Commit-Position: refs/heads/main@{#92599} | 2 年前 | |
[inspector] Don't create remote objects for non-shared 'Error' objects Since the page can install accessors on various 'Error' prototypes, its possible to leak information from cross-origin scripts (via the inspector remote object). This CL fixes this particular instance by not creating remote objects for Errors where the 'SharedCrossOrigin' bit is not set in the originating script. Note that to do this, we have to find the right script and get it's origin info. We can't go via the debugger agent as it has not necessarily been enabled and so the script map in the debugger agent could be empty. Drive-by: There is one more oddity we don't fully understand. The scriptId passed via V8Inspector is set to 0 if it matches the top-most frame. This CL reverts this logic in the inspector, but this might break some expectation in DevTools. R=bmeurer@chromium.org Fixed: 420885124 Change-Id: I3c1a7524349cdbadd6768f8c6bf5119d4b59369a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6606957 Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Simon Zünd <szuend@chromium.org> Cr-Commit-Position: refs/heads/main@{#100606} | 1 年前 | |
[api] Rename args => info in function and property callbacks This matches the actual type better: - FunctionCallbackInfo<T> - PropertyCallbackInfo<T> Change-Id: I43d33f5a4e487a2b0f2194da253535494d51cb91 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4370018 Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/main@{#86705} | 3 年前 | |
[test] Use pathlib in test framework This turns all paths in the test frameworks and all its suite implementations from strings into pathlib paths. This makes the framework more future-proof, simplifies a lot of code and enhances readability. It comes with the risk of introducing new bugs. This is lowered using an experimental test comparison script: https://crrev.com/c/4648372. Some detailed changes: - The "path" of a test case is now a pathlib path (also in cases where the path doesn't correspond to a location on the file system). This path is always relative to the test root. - The "name" of a test case is the posix string of that path used in status files and at the command line. - All other paths are absolute. - We use some more wrapping with Path() than absolutely necessary. Reducing such a wrapping where it's not needed is a micro-optimization and the potential by introducing a bug by forgetting one is worse. - Some modules are not happy with pathlib objects, hence a few explicit str() conversions are added. Thoughts on risk: - The highest risk is that due to the newly introduced logic, some test cases are silently filtered and not run now. We'll manually compare runs before and after this change. - Each test attempted to run will either pass or fail, failures won't be silent. E.g. a wrong path passed to the cctest executable is flagged as a failure. - Wrongly constructed paths to JS test cases lead to failures (tested several manually). Other failure types: - Some string path not turned into pathlib: Will typically fail when calling any pathlib function. - Some pathlib object treated as a string: Will typically raise an exception, e.g. using in-operator. - Logic bugs in pathlib functions behaving differently than anticipated, e.g. with_suffix(): Will typically result in wrong paths, resulting in errors reading a test case. Though worst case could be silent ignoring. Cq-Include-Trybots: luci.v8.try:v8_numfuzz_dbg Cq-Include-Trybots: luci.v8.try:v8_numfuzz_rel Cq-Include-Trybots: luci.v8.try:v8_numfuzz_tsan_rel Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel Cq-Include-Trybots: luci.v8.try:v8_android_arm64_n5x_rel Cq-Include-Trybots: luci.v8.try:v8_linux64_msan_rel Cq-Include-Trybots: luci.v8.try:v8_linux64_ubsan_rel Cq-Include-Trybots: luci.v8.try:v8_android_arm64_n5x_rel Bug: chromium:1132088 Change-Id: Ifc94feb292174935db969dcf5d174d2eedcf3dfd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4538761 Reviewed-by: Liviu Rau <liviurau@google.com> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/main@{#88502} | 2 年前 | |
[sandbox][api] Use new String::Write* APIs In https://crrev.com/c/5975682 we introduced new version of the String::Write* APIs. In this CL, all users of the old API in V8 are converted to the new API. Bug: 373485796, 376071292 Change-Id: Ia2ec193c266322bb627ebfa9acdd642f87bb6286 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5979449 Commit-Queue: Samuel Groß <saelo@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#97172} | 1 年前 | |
[inspector] Avoid unnecessary message copy in test harness "StringBuffer" is already an owning data structure. No need to make an extra copy. Bug: 326554286 Change-Id: I8813fa9d7981e11f5e164676d362268ece5917dd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5426197 Reviewed-by: Eric Leese <leese@chromium.org> Commit-Queue: Simon Zünd <szuend@chromium.org> Cr-Commit-Position: refs/heads/main@{#93186} | 2 年前 | |
[testing][wasm] Inspector: Print 'null' for empty table entries The wrapper obects for the debugger displayed e.g. in dev tools contain a proper null value already. Note: This only affects the printing of wasm tables in the test. Change-Id: I3c2e9580b0a3983b66b9c3e2e16e5a2b322a9ff7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4020261 Auto-Submit: Matthias Liedtke <mliedtke@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#84201} | 3 年前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 14 天前 | ||
| 9 个月前 | ||
| 8 个月前 | ||
| 9 个月前 | ||
| 14 天前 | ||
| 15 小时前 | ||
| 1 年前 | ||
| 11 个月前 | ||
| 2 年前 | ||
| 5 年前 | ||
| 5 年前 | ||
| 2 年前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 8 个月前 | ||
| 9 个月前 | ||
| 8 年前 | ||
| 8 年前 | ||
| 6 年前 | ||
| 6 年前 | ||
| 3 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 3 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 3 年前 |