| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
[handles] Migration to direct handles, part 15 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, asmjs, codegen, debug, diagnostics, execution, handles, heap, ic, json, logging, objects, profiler, regexp, runtime, snapshot, wasm, and tests. Bug: 42203211 Change-Id: Ibd2ffc4fc239088de175011e90e8dc5cadba3236 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6218795 Reviewed-by: Omer Katz <omerkatz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#98501} | 1 年前 | |
[handles] Migration to direct handles, part 16 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, asmjs, baseline, builtins, codegen, compiler, debug, deoptimizer, execution, heap, ic, init, objects, regexp, runtime, snapshot, wasm, and tests. Bug: 42203211 Change-Id: I3adbfb4aa55ebabec86ef94e312d92c8514446a0 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6240033 Reviewed-by: Omer Katz <omerkatz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Cr-Commit-Position: refs/heads/main@{#98600} | 1 年前 | |
[handles] Use direct handles in MapsAndHandlers This CL migrates the MapsAndHandlers data structure (used as an intermediate data in the communication between IC and FeedbackNexus) to use direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Bug: 42203211 Change-Id: I1e1bb524ee5fc8f9ea52aab163e508b7a770800d Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6305341 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#99071} | 1 年前 | |
[cleanup] Replace some usages of base version with std version This CL includes replacing base::Optional with std::optional, base::nullopt with std::nullopt, and base::make_optional with std::make_optional. It also includes suppressing some cpplint warnings. This CL covers many different folders such as //test, //tools, //src/json, //src/logging, //src/maglev, //src/numbers, etc. Bug: chromium:355676041, chromium:355003178 Change-Id: I4156128d25c5cf01f17fd7866b03e4c6cfc2cd30 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5755047 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Ho Cheung <hocheung@chromium.org> Cr-Commit-Position: refs/heads/main@{#95437} | 1 年前 | |
[handles] Migration to direct handles, part 16 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, asmjs, baseline, builtins, codegen, compiler, debug, deoptimizer, execution, heap, ic, init, objects, regexp, runtime, snapshot, wasm, and tests. Bug: 42203211 Change-Id: I3adbfb4aa55ebabec86ef94e312d92c8514446a0 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6240033 Reviewed-by: Omer Katz <omerkatz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Cr-Commit-Position: refs/heads/main@{#98600} | 1 年前 | |
[roots] Remove ReadOnlyRoots Handle getters ReadOnlyRoots can be initialized with either an Isolate/Heap, or a ReadOnlyHeap. These have separate tables of roots; one is the per-Isolate RootsTable, the other is an array of values in the ReadOnlyHeap object which is a copy/cache of the root values. If ReadOnlyRoots is initialized with a ReadOnlyHeap (e.g. with the GetReadOnlyRoots() getter), then handles created by it won't be legitimate root handles, but will be handles into this ReadOnlyHeap cache. This would mean that they fail handle identity checks like IsRootHandle. Instead, we should only allow getting Tagged values from ReadOnlyRoots, and anything that wants a ReadOnlyRoot Handle should read it via the roots table (in practice, this means via the existing accessors on Factory). Change-Id: I6322a1c7baf3bbc0dc159b984467874b436bf379 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6106570 Commit-Queue: Igor Sheludko <ishell@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#97862} | 1 年前 | |
[string] Use an unsigned integer for String::length With the sandbox, it is assumed that an attacker can corrupt heap memory, and therefore String objects and in particular their lengths. If the string lengths is represented as a signed integer (as it used to be before this CL), there is some risk of signed integer comparisons when operating on them as an attacker could turn the length into a negative value. See https://crbug.com/327473424 for an example. This CL now converts the length to a uint32_t to better defend against such issues. Bug: 369748453 Change-Id: Ife1fc2a1e2c23ff022dee1c5e315650c95057aa3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5332375 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#96599} | 1 年前 | |
[handles] Migration to direct handles, part 8 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, asmjs, builtins, codegen, compiler, date, debug, diagnostics, execution, heap, ic, init, interpreter, json, logging, objects, parsing, regexp, runtime, snapshot, strings, wasm. Bug: 42203211 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Change-Id: Ib35bb03997bb4a646c56674f834b952dffdeaf02 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6074945 Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#97624} | 1 年前 | |
[heap] Use task with kUserVisible priority instead of idle task This CL switches from idle tasks to kUserVisible tasks for "context disposal" GCs. @etiennep thankfully notices that this can improve JS score quite a bit. As we have no guarantee when this task will be run after being scheduled, we use gc_count() to only trigger a GC if no GC has been performed in-between. For idle tasks we limit this based on time, the task had to run within two frames (=16ms*2). Unlike idle tasks the regular tasks don't get a deadline, instead we use a hard coded limit of 5ms. In addition to the previous condition, we only perform the GC if the estimated time for it is less than 5ms. This CL improves JS2 by about +0.7%, JS3 by about +0.2%. Bug: 460477160 Change-Id: I9d084d59dca53a57d5cb6e81f26c122f037f15f7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6734023 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#104016} | 7 个月前 | |
[handles] Migration to direct handles, part 16 This CL migrates a large number of handles to direct handles. The changes are only relevant for builds with v8_enable_direct_handle=true. Affected source directories: api, asmjs, baseline, builtins, codegen, compiler, debug, deoptimizer, execution, heap, ic, init, objects, regexp, runtime, snapshot, wasm, and tests. Bug: 42203211 Change-Id: I3adbfb4aa55ebabec86ef94e312d92c8514446a0 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6240033 Reviewed-by: Omer Katz <omerkatz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> Cr-Commit-Position: refs/heads/main@{#98600} | 1 年前 | |
[flag] Remove --always-turbofan Bug: 431974094 Change-Id: Ia86d64cf626db0977299f8ec105f86ee4f385e7c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6781181 Reviewed-by: Marja Hölttä <marja@chromium.org> Auto-Submit: Victor Gomes <victorgomes@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#101612} | 11 个月前 | |
[api] Remove deprecated v8::Object::GetPrototype() ... and migrate last internal usages to GetPrototypeV2(). Bug: 333672197 Change-Id: I7c082cd8cbca8175dbe10701604ce94b21971077 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6993209 Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#102823} | 9 个月前 | |
Reland "[handles] Migration to direct handles, part 12" This is a reland of commit 5fa54d85a10049a55ba2fa02bc05145ddee7d19a Original change's description: > [handles] Migration to direct handles, part 12 > > This CL migrates a large number of handles to direct handles. The > changes are only relevant for builds with v8_enable_direct_handle=true. > > Affected source directories: api, asmjs, ast, builtins, codegen, > compiler, d8, debug, deoptimizer, diagnostics, execution, extensions, > heap, ic, init, interpreter, json, maglev, objects, parsing, profiler, > regexp, runtime, snapshot, strings, wasm, and tests. > > Bug: 42203211 > Change-Id: I2334b3295e5780e8f52d0b13d1545dce29fcf81e > Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6181904 > Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org> > Reviewed-by: Omer Katz <omerkatz@chromium.org> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org> > Cr-Commit-Position: refs/heads/main@{#98240} Bug: 42203211 Change-Id: Ie21acd681c12e7212185d61a19bd858365650204 Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6187462 Reviewed-by: Omer Katz <omerkatz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Nikolaos Papaspyrou <nikolaos@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Omer Katz <omerkatz@chromium.org> Cr-Commit-Position: refs/heads/main@{#98249} | 1 年前 | |
Further separate the two purposes of GetStringOption GetStringOption has two overloads: one which fetches a string (and tells you if it succeeded), and one which matches a string option against a set of values. The first overload does double-duty: it also checks membership in a list of options if provided, but doesn't if it is empty. This is inefficient: the match-string-option path ends up iterating through options twice, and furthermore the callers that use the fetch-string-option path end up converting to a std::string anyway. In the medium term these should probably be called GetStringOption and MatchStringOption. Bug: 415359720 Change-Id: I6a6a69646d7bedcb2a45748c16d27d6eab751f08 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6685912 Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> Commit-Queue: Manish Goregaokar <manishearth@google.com> Cr-Commit-Position: refs/heads/main@{#101146} | 1 年前 | |
[test] Fix managed unittest We should not access a managed in isolate 1 after entering isolate 2. This will prevent replacing GetIsolateForSandbox by GetCurrentIsolateForSandbox, and fails the check introduced in https://crrev.com/c/6276459. R=jkummerow@chromium.org Bug: 396607238 Change-Id: I855c1a001fbe2093383fad5f5d6c5279f5dccc98 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6286166 Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#98838} | 1 年前 | |
[api] Remove unused context parameter from FixedArray::Get Remove an unused parameter and mark the old method for deprecation. R=mlippautz@chromium.org Bug: 454827127 Change-Id: I1f3a3feac2d926e57c6feb16ce8c1fafdd9a243e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7141498 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/main@{#103675} | 7 个月前 | |
Fix class member initializer reparsing logic Intertwined static / public member initializers can mix up ids, so unmix them. Bug: 458914193 Change-Id: If0708b56750a92e03eaa5530cfbff295c2acf630 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7203465 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Auto-Submit: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#103958} | 7 个月前 | |
[test] Remove message expectation from ExceedMaxEnumerationIndex Official builds strip CHECK messages, making this fail on those builders. No-Tree-Checks: true Change-Id: Ia63f2275189b06346802a07584af35b3fd9f89b4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6951335 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#102507} | 9 个月前 | |
[test] Move cctest/test-representation to unittests ... /objects/representation-unittest. Bug: v8:12781 Change-Id: I3ae39df619ac6920c5ff722ed481bed20b5a5c6d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3612669 Commit-Queue: 王澳 <wangao.james@bytedance.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#80557} | 4 年前 | |
[hole] Remove unneeded hole value checks Undo a bunch of work which added by-value hole checks. Originally we wanted to make holes fully unmapped, including their map pointer, so that potential hole values would have to be checked by pointer value rather than map checks. This turned out to be tricky, partially because the optimizing compiler could hoist map reads above hole checks, and partially because the extra hole value checks ended up with performance regressions. In https://crrev.com/c/7156717 we switched to keeping the holes' maps mapped with an unmapped payload after the map (very similar approach to the WasmNull). This means that all those hole checks we added are now unnecessary, since they were already covered by the existing map-based checks. We can also remove the --assert-hole-checked-by-value flag and fuzzing, since this is no longer an invariant we want to preserve. Bug: 434179415 Change-Id: I9399498d89592127e4291b8acffee83a3ba70052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7206087 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#103982} | 7 个月前 | |
Remove unused code in swiss-hash-table-helpers.h. This code looks like it was copied over of Abseil. However, parts of it are not used anywhere, aside from their own unit tests, so delete them. The unused functions are: - MatchEmptyOrDeleted() - CountLeadingEmptyOrDeleted() - ConvertSpecialToEmptyAndFullToDeleted() In turn, _mm_cmpgt_epi8_fixed() is also unused and can be deleted. Bug: v8:11388 Change-Id: I35b84600690e6f044a1d5ab4bf41e7f67fb76d87 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3965230 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Lei Zhang <thestig@chromium.org> Cr-Commit-Position: refs/heads/main@{#83892} | 3 年前 | |
[tagged-ptr] Make Object methods static Turn obj->Foo() into Object::Foo(obj) for Object methods. This allows operations on Smis without dereferencing. Bug: v8:12710 Change-Id: I6b0cf8b914647c0058bb5b15e47b917714ef4b7f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4732912 Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#89283} | 2 年前 | |
[gtest] Clean up single-arg testing::Invoke()s Not needed and deprecated [0]. This CL should be a no-op. [0]: https://chromium.googlesource.com/external/github.com/google/googletest.git/+/a05c0915074bcd1b82f232e081da9bb6c205c28d/googlemock/include/gmock/gmock-actions.h#2046 Bug: chromium:439838457 Change-Id: I95fcdefb5e6a529f43312403319c1aa10b5ec5fb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6941574 Auto-Submit: Jonathan Lee <jonathanjlee@google.com> Reviewed-by: Marja Hölttä <marja@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Marja Hölttä <marja@chromium.org> Cr-Commit-Position: refs/heads/main@{#102454} | 9 个月前 | |
[cleanup] Replace some usages of base version with std version This CL includes replacing base::Optional with std::optional, base::nullopt with std::nullopt, and base::make_optional with std::make_optional. It also includes suppressing some cpplint warnings. This CL covers many different folders such as //test, //tools, //src/json, //src/logging, //src/maglev, //src/numbers, etc. Bug: chromium:355676041, chromium:355003178 Change-Id: I4156128d25c5cf01f17fd7866b03e4c6cfc2cd30 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5755047 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Ho Cheung <hocheung@chromium.org> Cr-Commit-Position: refs/heads/main@{#95437} | 1 年前 | |
[runtime] Introduce kClearedWeakValue and cleanup ClearedValue() It used to be important that the upper part of a non-Smi value is equal to respective cage base but since https://crrev.com/c/6402513 it's not the case anymore. This CL relaxes the DCHECK in CompressObject() to allow baseless cleared weak values. Although we can simply use kClearedWeakValue instead of ClearedValue() or ClearedTrustedValue() for manual clearing of certain weak fields, having these functions might still be useful to ensure that we don't accidentally mix up cleared weak references belonging to different cages. Bug: 424154602 Change-Id: I03a351c2c1615455c076cf73d38e592b75bdcd54 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6673894 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#101053} | 1 年前 | |
[heap] Use task with kUserVisible priority instead of idle task This CL switches from idle tasks to kUserVisible tasks for "context disposal" GCs. @etiennep thankfully notices that this can improve JS score quite a bit. As we have no guarantee when this task will be run after being scheduled, we use gc_count() to only trigger a GC if no GC has been performed in-between. For idle tasks we limit this based on time, the task had to run within two frames (=16ms*2). Unlike idle tasks the regular tasks don't get a deadline, instead we use a hard coded limit of 5ms. In addition to the previous condition, we only perform the GC if the estimated time for it is less than 5ms. This CL improves JS2 by about +0.7%, JS3 by about +0.2%. Bug: 460477160 Change-Id: I9d084d59dca53a57d5cb6e81f26c122f037f15f7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6734023 Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#104016} | 7 个月前 | |
[objects] Introduce HashTable::TryNew() returning MaybeHandle ... and make HashTable::New() return Handle again. The former is supposed to be used for the cases where we can handle exceeding maximum capacity (it returns empty handle without throwing an exception) while the latter is for the cases where we can't or don't expect too big capacity values (it reports fatal OOM as before). This CL - partially reverts https://crrev.com/c/6843055 because crashing inside ToHandleChecked() upon exceeding maximum table capacity is not convenient compared to reporting a fatal OOM, - lays ground for gradual migration of OOM "invalid table size" crashes to throwing RangeError exception. Bug: 41433527 Bug: 437245082 Fixed: 438523768 Change-Id: I76e1d75af9e62392e2c6a8f3c8d6881f15fa0b33 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6850486 Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Reviewed-by: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#101916} | 10 个月前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 11 个月前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 7 个月前 | ||
| 9 个月前 | ||
| 4 年前 | ||
| 7 个月前 | ||
| 3 年前 | ||
| 2 年前 | ||
| 9 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 7 个月前 | ||
| 10 个月前 |