When handling the 'end' opcode, there was a confusion with the value of
"unreachable". This DCHECK assumes the value of "unreachable" before
closing the scope, but was placed after the value is potentially updated
to reflect the state after the 'end' opcode.
R=clemensb@chromium.org
Bug: chromium:1251845
Change-Id: Iea526e6485fa705f6ff4077f54a53204cc70a926
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3190102
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77116}
The parser is organized in a somewhat tricky way s.t. it can be
hard to map the implementation back to the specified grammar.
In particular, the logic for CharacterClassEscape, ClassEscape,
and CharacterEscape was implemented twice - once inside a character
class, once outside.
This CL refactors related logic to have only a single implementation.
As a drive-by, fix one related inconsistency related to \k inside
a character class.
Fixed: v8:10602
Change-Id: I5858840159694fa6f8d1aa857027db80754e3dfd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3178966
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77114}
The intent of the RISC-V ISA is that 32-bit C values are stored sign extended in registers, even for unsigned types.
So we skip cctest case RunLoadStoreZeroExtend64/RunUnalignedLoadStoreZeroExtend64 due to sign extend uint32
Change-Id: Icfe727916b1c04aad5681902ec4782cc98906964
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3184560
Reviewed-by: Ji Qiu <qiuji@iscas.ac.cn>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Ji Qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#77112}
Several of the cctest/test-bytecode-generator/* tests used to rely
on the __COUNTER__ C++ compiler macro, which could cause spurious
test failures due to mismatched expectations when usages of that
macro were added or removed elsewhere in the code. This patch switches
to a custom, controllable static counter variable instead, to make
the tests' behaviors self-contained.
Bug: v8:12244
Change-Id: I4d875b6095e4ee4ef91933ab8c60c89054d1894a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3186836
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77111}
Port commit a0ace8a8a5
On mips64 and loong64, sign-extend the 32-bit value.
Change-Id: I058e3fcba94c25ad36ab1d751dea6bfc0558471a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3189854
Reviewed-by: Liu yu <liuyu@loongson.cn>
Commit-Queue: Liu yu <liuyu@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/main@{#77110}
Port e301d71ff5
[compiler] Teach InstructionScheduler about protected memory accesses
Port a0ace8a8a5
[wasm] Interpret table.grow result as 32 bit
Port [regexp] Fix UAF in RegExpMacroAssembler
Change-Id: Ieac5e4deae9c6bbf844788d927f5201b906495f6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3189213
Commit-Queue: Ji Qiu <qiuji@iscas.ac.cn>
Reviewed-by: Ji Qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#77108}
These tests test allocation failure and time out on TSAN.
Bug: v8:11852
Change-Id: I81e0af3ab8130c05488c6a117dd1c6ef12aba33b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3188071
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77104}
After the parameter processing, the arraybuffer may have been detached.
TypedArray copyWithin/fill should throw in that condition. TypedArray
includes should return false if the search element is not undefined.
Change-Id: If507d0efa1dafbe3dcefcd368e5ea27406bb3df8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3144315
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77103}
Bug: v8:7790
Change-Id: Ibf6e842c2bec780a9a52643494def8efbab92466
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3185920
Auto-Submit: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77102}
Prepare the Torque compiler to generate Kythe artifacts to be consumed
by CodeSearch.
Drive-by changes.
* Extend SourcePosition by an offset in the input string, as this is
required by the Kythe graph.
* Correctly set missing identifier positions in Declarations.
Bug: v8:12261
Change-Id: Ida0a4a562c99f58ab924ddde36f3146f3d3fd415
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3181102
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#77099}
Don't really have a good name for this inner TryCatch.
Bug: v8:12244
Change-Id: I4c1353bcd98e78e49d0354e285249302a8ee0dd8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3183522
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77097}
Activate argument count consistency (receiver is always included in
JS argument count) for arm and arm64.
Bug: v8:11112
Change-Id: I4b019721422a0a4653d59e81cde2f7d57708e625
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3186436
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Patrick Thier <pthier@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77089}
... an ObjectVisitor subclass that takes care of caching values of
both the main pointer compression cage base and code cage base
(when the external code space is enabled).
Drive-by: this CL also changes signature of
RelocInfo::target_object_no_host(...) to accept PtrComprCageBase
instead of Isolate*.
Bug: v8:11880
Change-Id: I3fbb382e0a0170e28542bc495d8fecfd24da8a07
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3182231
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77088}
1. Now there is no serializer/deserializer-specific buffer size limit.
2. Update AUTHORS
Ref: https://github.com/nodejs/node/issues/40059
Change-Id: Iad4c6d8f68a91ef21d3c404fb7945949e69ad9e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3170411
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77084}
.. by turning `masm_` into a unique_ptr s.t. it's freed after the
NoRootArrayScope which references it.
Fixed: chromium:1252620
Change-Id: I24580c5a96d76a973b2b083e7a76b95f93bb6068
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3185459
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77082}
When cloning objects using spread and update properties (e.g.
obj = {...o, x: 0}), we wrongly used the setter for the update argument
if one was set.
This CL changes the behaviour such that all arguments following the
spread are treated as dynamic arguments.
Bug: chromium:1251366
Change-Id: I76a6d02606dca0faa0a256f465834d85d3df4f6f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3178969
Commit-Queue: Patrick Thier <pthier@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77079}
Rolling v8/build: c4acc0e..32fc064
Rolling v8/buildtools/linux64: git_revision:69ec4fca1fa69ddadae13f9e6b7507efa0675263..git_revision:de86ec4176235871a7cb335756987e41246dae4a
Rolling v8/third_party/abseil-cpp: 4402489..a46a633
Rolling v8/third_party/aemu-linux-x64: 35rwW0ni0eziJ2doq4bSBym86edze8jHjf2fyZhjl8kC..y7X4kitLsRPSZc6ksrVllZRbH7mvEXlq9-4wOg7zR5cC
Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/3d49e1c..444aba8
Rolling v8/third_party/depot_tools: a6baf70..f35d350
Rolling v8/third_party/googletest/src: 159c9ad..e4717df
Rolling v8/third_party/zlib: 77c1323..dfa96e8
Rolling v8/tools/luci-go: git_revision:028cd41e0f4b2bec99d94c780caf2f978e09b182..git_revision:e9585787c808e21d6eaa2c7d7a928dbc19999172
Rolling v8/tools/luci-go: git_revision:028cd41e0f4b2bec99d94c780caf2f978e09b182..git_revision:e9585787c808e21d6eaa2c7d7a928dbc19999172
Rolling v8/tools/luci-go: git_revision:028cd41e0f4b2bec99d94c780caf2f978e09b182..git_revision:e9585787c808e21d6eaa2c7d7a928dbc19999172
TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com
Change-Id: I4ea1bfbd22da816afaf413bd6e86c63aa91d4a39
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3182608
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77068}
After https://crrev.com/c/3182223 gcc might throw the following
error during compilation:
```
error: variable 'is_on_heap' set but not used
```
Bug: v8:11749
Change-Id: I31a2bef4adb1bfcb2b35115b4dea6df80f84f681
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3183165
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#77067}
