Commit Graph

3474 Commits

Author SHA1 Message Date
Paolo Severini
1ef43e7ba9 [sandbox] Increase max size of ExternalPointerTable
Bug: v8:13640
Change-Id: I017a067d775c71977054b772ead8853e4df0cd51
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4159852
Reviewed-by: Samuel Groß <saelo@chromium.org>
Commit-Queue: Paolo Severini <paolosev@microsoft.com>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85249}
2023-01-12 12:31:10 +00:00
Dominik Inführ
7777e0321d [api] Deprecate memory savings mode
This mode was used for an experiment and isn't used anymore.
IsolateInBackgroundNotification() can be used to achieve the same
memory savings mode.

Bug: v8:13653
Change-Id: I4bc0b0bd7ceac43f22e16b234b9482af9fe03152
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4156054
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85239}
2023-01-12 09:14:01 +00:00
Michael Lippautz
24ca73004e cppgc: Implement slim write barrier
Introduces a slim write barrier for Oilpan behind
`cppgc_enable_slim_write_barrier` that is enabled by default. The slim
write barrier only performs a single approximate global check for
whether the write barrier is needed and delegates all other checks to
a slow path call. This is beneficial in configurations that do not need
many checks for the barrier overall, i.e., configurations without
young generation. Young generation is off by default which is why this
approach is beneficial.

On Speedometer the write barrier is hit 75M times with a fast bailout
of 99.3%. Progression on Speedometer2 is somewhere around 0.2-0.5%.

The resulting code embedded in another function is only 34 bytes
compared to 128 bytes before. See attached bug for detailed assembly
snippet.

Change-Id: I6869513186e7a26104c46f1f2ac2cfa855689f64
Bug: chromium:1406464
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4152488
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85232}
2023-01-11 18:54:57 +00:00
Clemens Backes
080e281820 Reland "[x64] Make {Assembler::GrowBuffer} preserve most registers"
This is a reland of commit 8fe57bf641.
We restrict the use of "preserve_most" to x64 and arm64 in
non-component builds for now.

Original change's description:
> [x64] Make {Assembler::GrowBuffer} preserve most registers
>
> This makes many callers of {GrowBuffer} a lot slimmer, by avoiding the
> need to push and pop all values in otherwise caller-saved registers.
> E.g. {emit_mov(Register, Operand)} was measured to be ~2x faster (from
> 2.3% of Liftoff compilation time to 1.2%).
>
> R=bikineev@chromium.org
> CC=dlehmann@chromium.org
>
> Bug: v8:13565
> Change-Id: I681747a491548adf1374187cd9f37520c153ef1a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4127230
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Anton Bikineev <bikineev@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#85147}

Bug: v8:13565
Change-Id: I273e222b423786fdc0338c7dfab3d95c8af6ff13
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4147788
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85231}
2023-01-11 17:53:05 +00:00
Leszek Swirski
b985e8d83b Revert "[x64] Make {Assembler::GrowBuffer} preserve most registers"
This reverts commit 8fe57bf641.

Reason for revert: Looks like preserve_most is too experimental after all: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20-%20shared/24208/overview

Original change's description:
> [x64] Make {Assembler::GrowBuffer} preserve most registers
>
> This makes many callers of {GrowBuffer} a lot slimmer, by avoiding the
> need to push and pop all values in otherwise caller-saved registers.
> E.g. {emit_mov(Register, Operand)} was measured to be ~2x faster (from
> 2.3% of Liftoff compilation time to 1.2%).
>
> R=​bikineev@chromium.org
> CC=​dlehmann@chromium.org
>
> Bug: v8:13565
> Change-Id: I681747a491548adf1374187cd9f37520c153ef1a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4127230
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Anton Bikineev <bikineev@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#85147}

Bug: v8:13565
Change-Id: I80207ab3cc84958c3c453e63cc4062a408e05a27
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4147787
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#85149}
2023-01-09 15:13:11 +00:00
Clemens Backes
8fe57bf641 [x64] Make {Assembler::GrowBuffer} preserve most registers
This makes many callers of {GrowBuffer} a lot slimmer, by avoiding the
need to push and pop all values in otherwise caller-saved registers.
E.g. {emit_mov(Register, Operand)} was measured to be ~2x faster (from
2.3% of Liftoff compilation time to 1.2%).

R=bikineev@chromium.org
CC=dlehmann@chromium.org

Bug: v8:13565
Change-Id: I681747a491548adf1374187cd9f37520c153ef1a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4127230
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85147}
2023-01-09 14:33:52 +00:00
Vladimir Nechaev
ca3a939da8 [inspector] Provide more details about destroyed context
Runtime.executionContextCreated provides many details in
ExecutionContextDescription structure while
Runtime.executionContextDestroyed provides only executionContextId. This
information is insufficient for the clients that use uniqueContextId.

Bug: v8:12896
Change-Id: I31df0ed618dc1c8b55c7eba8f96eeaef2d4de6c8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3657439
Commit-Queue: Simon Zünd <szuend@chromium.org>
Auto-Submit: Vladimir Nechaev <nechaev@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85110}
2023-01-05 09:27:47 +00:00
gengjiawen
166fd2f38f [cppgc]: Fix build on msvc
Fixes compilation with msvc 2019 toolchain.

See: nodejs/node#37330 (comment)

Bug: v8:12661
Change-Id: I7cfd87a3dd531a2e4913d82b743fb8ecdfdb5ed8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3533019
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85087}
2023-01-04 10:12:56 +00:00
Michael Lippautz
a8a1805e12 [api, heap, handles] Remove deprecated EmbedderHeapTracer
This removes EmbedderHeapTracer from V8's API. Going forward
v8::TracedReference is only supported with using CppHeap (Oilpan).

Bug: v8:13207
Change-Id: I4e0efa94890ed147293b5df69fd7e0edad45abb5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4111546
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85061}
2023-01-02 15:17:40 +00:00
Vladimir Nechaev
28cb67cdec Runtime.callFunctionOn supports uniqueContextId
Bug: v8:13620
Change-Id: I802deb3325a5c8ac9e7e378d60be591af66e6fee
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4126215
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Vladimir Nechaev <nechaev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85027}
2022-12-28 10:45:28 +00:00
Olivier Flückiger
f6d85958e0 [static-roots] Use operator== in HeapObject::Is##Type
Replace SafeEquals with normal equals operator in `IsUndefined` and
friends. This will allow us to have more efficient checks with static
roots, since pointers do not need to be decompressed.

After this change calling Is##Type on CodeObjects is no longer possible.
This is ensured by dchecks in operator==. The change might reveal more
callers that need to be fixed.

Bug: v8:13466
Change-Id: I3353d10aebb7a192a77281c44e4159f0da336297
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4106849
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Auto-Submit: Olivier Flückiger <olivf@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84974}
2022-12-21 12:33:34 +00:00
Anton Bikineev
e29e64e729 unified-young-gen: Filter custom weak callbacks
Oilpan young generation currently remembers all weak callbacks to be
processed on each GC. This is needed to support UntracedMembers in the
old space. If the old object with UntracedMember (e.g.
ActiveScriptWrappableManager) holds a pointer to a young object, the
custom weak callback must be reexecuted on each minor GC, because the
custom callback is responsible for clearing UntracedMembers.

This is not necessary for weak containers. They hold WeakMembers, for
which we issue the regular write barrier. The CL distinguishes between
callbacks for weak containers and for custom objects. This aims to
speeds up weak processing, which currently may take >10ms.

Bug: v8:13475
Change-Id: I6964a6835dc84febddbefb5e2952d57f108d1232
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4080470
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84895}
2022-12-16 10:15:12 +00:00
Clemens Backes
4b451843fd [wasm] Deprecate CPU timings in metrics
We do not collect them any more since https://crrev.com/c/4078966
(landed in v11.0), so deprecate the fields now for v11.1.

R=mlippautz@chromium.org

Bug: v8:13565
Change-Id: I6b454cd6591c6489043002226f3c4fd19fdeb7e5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4079227
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84871}
2022-12-15 14:25:48 +00:00
V8 Autoroll
5b84df0b99 Version 11.1.0
Change-Id: I9250e6a62e5606197a3f08d886d1f1c8f28bbe1e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4108798
Commit-Queue: Lutz Vahl <vahl@chromium.org>
Reviewed-by: Lutz Vahl <vahl@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84861}
2022-12-15 10:26:39 +00:00
Shu-yu Guo
4757205b3c [rab/gsab,api] Add resizable BackingStore creation
This CL adds v8::ArrayBuffer::NewResizableBackingStore.

This API is needed to support Mojo cross-process serialization of
resizable buffers. See https://chromium-review.googlesource.com/c/chromium/src/+/4086949

Bug: chromium:1396361, v8:11111
Change-Id: I1d3ad367f28015184fd80fd2f05a37a3659d3a66
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4093555
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84826}
2022-12-14 01:54:00 +00:00
Shu-yu Guo
08e95d81d5 [rab/gsab,api] Add v8::BackingStore::MaxByteLength
I originally thought MaxByteLength would only be needed for
v8::ArrayBuffer and v8::SharedArrayBuffer, but it is also needed on
v8::BackingStore.

In particular, blink uses Mojo to serialize ArrayBuffers' contents via
v8::BackingStore when doing cross-process postMessage.

Bug: chromium:1396361, v8:11111
Change-Id: I86d44829175ad760fb43294d386483a16044fc3b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4090708
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84767}
2022-12-09 22:45:18 +00:00
Anna Henningsen
ccddea063b [api] mark readonly usage of StartupData as const
This doesn’t have much practical effect, since the actual
byte contents referred to by `StartupData` are already marked
`const`, but adding the qualifier communicates more clearly
to users that V8 does not perform modifications on the object.

Practically speaking, this also allows for cases in which the
startup data is included as readonly data in the current executable
without requiring a `const_cast`.

Refs: https://github.com/nodejs/node/pull/45786#discussion_r1043489245
Change-Id: I53075ebb493c3617e470decb601b803f5294848d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4089203
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84764}
2022-12-09 16:58:44 +00:00
Clemens Backes
068536f109 [wasm] Remove thread timings (CPU time)
On Mac, we spend around 30% of lazy compile time in {ThreadTicks::Now}.
On Linux it's less severe, but still around 10%.
That's too much overhead for measurements that only show up in UKM, so
remove that.

The unused fields will be removed from the UKM events after the plumbing
on the chromium side has been removed.

R=ahaas@chromium.org, mlippautz@chromium.org
CC=​ecmziegler@chromium.org

Bug: v8:13565
Change-Id: I2dad88d899482801888940499d2d1761ff075578
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4078966
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84754}
2022-12-09 12:11:22 +00:00
Jaroslav Sevcik
f4fb8fc1f7 [inspector] Introduce debugger session stop API
We introduce V8InspectorSession::stop API to enable safe
detach from the session. In particular, after calling 'stop',
the session will leave any instrumentation pause it might
be in and disarm all its instrumentation breakpoints.

This is useful when the session disconnect request is registered
on V8 interrupt (so it is unsafe to disconnect at that point),
and the execution should first get to the message loop
where the disconnect can be handled safely.

Bug: chromium:1354043
Change-Id: I3caab12a21b123229835e8374efadc1f4c9954c2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4085143
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Kim-Anh Tran <kimanh@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84753}
2022-12-09 12:08:58 +00:00
Shu-yu Guo
90742c6040 [api] Add resizable getters to ArrayBuffer APIs
Adds v8::[Shared]ArrayBuffer::MaxByteLength and
v8::BackingStore::IsResizableByUserJavaScript.

This is needed for embedders who need to check if a buffer is resizable
by user JS, like blink, to check for the [AllowResizable] WebIDL
extended attribute.

Bug: v8:11111
Change-Id: Ie7e03979ef3884123df8a3eeb5c3516c4a6967c2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4082276
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84715}
2022-12-07 21:32:31 +00:00
Judith Hemp
8ef8a016dc Add V8StackFrame export
To be able to retrieve structured stacktrace information like the
functionName of single stack frames outsite of v8, this cl adds a
V8StackFrame class and a function to retrieve them from V8StacKFrames.

Bug: chromium:1393317
Change-Id: Idae150aeb03f7b65294c4c6a6979c298a569e6d2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4067040
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Judith Hemp <hempjudith@google.com>
Cr-Commit-Position: refs/heads/main@{#84676}
2022-12-06 09:40:43 +00:00
Igor Sheludko
b296ab30f7 [ptr-compr] Mark base() as V8_CONST
... which is an alias for __attribute__((const)) when it's available.

Bug: v8:7703
Change-Id: Ic585f48bc764ccf0c920ff82ba788cf1e88e0cdd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4076525
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84633}
2022-12-05 10:43:25 +00:00
Aapo Alasuutari
744570e583 [fastcall] Support external pointers in fast api calls
Bug: chromium:1052746

Change-Id: I3de37ca453b640b7f714e585848ccd068dd9ddbc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3957815
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Samuel Groß <saelo@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84597}
2022-12-01 14:19:33 +00:00
Mikhail Khokhlov
224cbd2179 [Tracing w/SDK] Replace TraceStateObserver with TrackEventSessionObserver
With v8_use_perfetto = true, tracing sessions are controlled by
Perfetto, not TraceLog. This can lead to inconsistencies, e.g.
TraceLog signalling trace start while V8's TrackEvent datasource
hasn't been initialized yet.

This CL removes the TraceStateObserver interface and replaces its
uses with perfetto::TrackEventSessionObserver which correctly tracks
Perfetto tracing sessions start and end.

See also crrev.com/c/4066184 for the corresponding Chrome change.

Bug: chromium:1006766
Change-Id: I94b2189c8b28aec8b17ec8fc1246e27c904e4ee9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4062038
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Mikhail Khokhlov <khokhlov@google.com>
Cr-Commit-Position: refs/heads/main@{#84590}
2022-12-01 11:18:24 +00:00
Divy Srivastava
bc831f8ba3 [fastcall] Implement support for onebyte string arguments
This CL adds one byte string specialization support for fast API call arguments.
It introduces a kOneByteString variant to CTypeInfo.

We see a ~6x improvement in Deno's TextEncoder#encode microbenchmark.
Rendered results: https://divy-v8-patches.deno.dev/

Bug: chromium:1052746
Change-Id: I47c3a9e101cd18ddc6ad58f627db3a34231b60f7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4036884
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84552}
2022-11-29 17:03:45 +00:00
Samuel Groß
8ca9f77d0f [sandbox] Sandboxify JSArrayBuffer::extension external pointer
Bug: chromium:1335043
Change-Id: Id8e6883fc652b144f6380ff09b1c18e777e041c2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3706626
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84544}
2022-11-29 15:46:23 +00:00
Qifan Pan
2301870e75 [turboshaft] Implement SignedMulOverflow64
This CL implements SignedMulOverflow64 to enable constant folding
of 64-bit SignedMul in machine optimization reducer.

Bug: chromium:1392928, v8:9407
Change-Id: I3a46198b2e2a0b59ca33f5a333fb8ea3d8f89340
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4055684
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Qifan Pan <panq@google.com>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84495}
2022-11-25 15:44:06 +00:00
Samuel Groß
06aaa9625f Remove support for unsandboxed ExternalPointers
Now that the external pointer sandboxing rollout has completed, the
machinery to support unsandboxed external pointers is no longer needed.

Bug: v8:10391
Change-Id: I5cec4b9bfca41a7db670b93d984f3cfc5a2adbfa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4034166
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84360}
2022-11-18 14:29:54 +00:00
Dominik Inführ
a59ca18634 [builtins, heap] Implement shared barrier for JS write barrier
This CL invokes Heap::SetIsMarkingFlag for all client isolates to
force the RecordWrite builtin into the marking barrier code path. That
way the RecordWrite builtin can run the marking barrier for objects
in the shared heap even when incremental marking in the that
particular client isolate isn't enabled at the moment.

The marking barrier then splits code path for shared vs. local
objects. Without a shared heap or when running on the shared space
isolate we know without checking page headers that all objects are
local. For client isolates it will also check whether incremental
marking is enabled for that particular space.

Bug: v8:13267
Change-Id: Iaa98d25c4c855769f95ee0ddf5540fb0ada55574
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4020176
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84339}
2022-11-17 17:48:47 +00:00
Andrey Kosyakov
aa684004d0 DevTools: use a barrier to sync runIfWaitingForDebugger from multiple sessions
This introduces a barrier that ensures that
`V8InspectorClient::runIfWaitingForDebugger()` is only invoked once all
sessions that requested a paused have invoked runIfWaitingForDebugger.

Downstream change: https://chromium-review.googlesource.com/c/chromium/src/+/3977348

Bug: chromium:1352175
Change-Id: I9049c2de6da8e690ad4312cd6cb799619125bb62
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3976353
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Andrey Kosyakov <caseq@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84191}
2022-11-10 20:23:01 +00:00
Yuki Shiino
dbc6e56580 api: Expose %MapIteratorPrototype% and %SetIteratorPrototype%
In order to allow Blink (and potentially other embedders) to
implement Web IDL maplike and setlike in a more spec-conformant
way, exposes %MapIteratorPrototype% and %SetIteratorPrototype%.

Bug: chromium:1354546
Change-Id: Ife97c4d99168779e56ce95fc774692a125bf6ea5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4005924
Commit-Queue: Yuki Shiino <yukishiino@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84185}
2022-11-10 15:50:48 +00:00
V8 Autoroll
d7f28a4369 Version 11.0.0
Change-Id: I14a24e13142a46674c652b6bf804e87fe6a8c4f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4016898
Commit-Queue: Lutz Vahl <vahl@chromium.org>
Reviewed-by: Lutz Vahl <vahl@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84167}
2022-11-10 10:04:59 +00:00
Benedikt Meurer
97924c16ff [inspector] Allow to break only on caught exceptions.
This introduces a new "caught" case for Debugger.setPauseOnExceptions,
which instructs the V8 Debugger to only break on exceptions that are
predicted as caught. Previously it wasn't possible to express this with
Chrome DevTools Protocol.

Bug: chromium:1324920, chromium:1346231
Change-Id: I507cfb6058148b2e238b8f66e9720ab68cb81575
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4013330
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Kim-Anh Tran <kimanh@chromium.org>
Reviewed-by: Kim-Anh Tran <kimanh@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84137}
2022-11-09 07:44:28 +00:00
Michael Lippautz
b5485fd81f [handles] TracedHandles: Rely on AllocateAtLeast()
Use AllocateAtLeast() to create a TracedNodeBlock. In todays Blink
this increases capacity from 256 to 284, reducing memory and
preserving the fast path longer.

Limit capacity to '1' for ASAN builds to flush out UAFs.

Bug: v8:13372
Change-Id: Iaa0ca940b59ed58015fcb768b851e6054ac7e152
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3999730
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84131}
2022-11-08 18:40:37 +00:00
Michael Lippautz
9d3d4ffacb [cppgc-js] Reuse stack object from V8
Reuse the stack object that V8 maintains via ThreadLocalTop for
CppHeap.  This allows CppHeap to be migrated across threads, similar
to Isolate, when used with Locker.

Bug: v8:13207
Change-Id: I4c865f4eeb79257ed720cf46e42b27589fcf555e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4013799
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84126}
2022-11-08 16:47:47 +00:00
Michael Lippautz
b28d72b5ef cppgc: Use default page allocator when no allocator is provided
Use the `PageAllocator` that is generated/provided via
`cppgc::InitializePlatform()`.

Bug: v8:13442
Change-Id: I7f3a83ae3fe9000b430ab085929f98646585164f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4000486
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84083}
2022-11-07 10:43:03 +00:00
Adam Klein
76ae4f56df [cleanup] Remove Wasm exception-handling runtime flag
It's been enabled by default since Chromium M95.

Also removes duplicate setup code for WebAssembly.Tag JS API
from WasmJs::InstallConditionalFeatures, since we're guaranteed
to set it up via the non-conditional WasmJs::Install.

Bug: v8:8091
Change-Id: Ic500feb655ad4fc0703ed226504847ca6d940537
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3996810
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84074}
2022-11-04 22:50:50 +00:00
Michael Lippautz
25d19e6031 cppgc: Prevent using HeapHandle by value
HeapHandle is an opaque handle that refers to the internal
implementation of the heap and as such should never be used by value.

Bug: v8:13429
Change-Id: I1c369911adfc623fe2c32f06b985a5d8accc0e55
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4000485
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84034}
2022-11-03 11:02:35 +00:00
Dominik Inführ
6eb8316e7a [execution] Report first old space page as CrashKey
Maps are now in old space, so start to report the first page in old
space now.

Bug: v8:12578
Change-Id: Icf08c9074558a2d47bb9f1f8df72cec9668d2b4e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3986087
Auto-Submit: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84002}
2022-11-02 08:26:30 +00:00
Andreu Botella
9df5ef70ff Add an v8::ArrayBuffer::WasDetached method to the C++ API
V8's C++ API does not give a way to tell whether an ArrayBuffer has
been detached from the `v8::ArrayBuffer` class. In fact, as far as can
be told from the C++ API without running JS code, detached
ArrayBuffers behave the same as zero-sized ArrayBuffers and there is
no way to observe the difference. However, this difference can be
observed in JS because constructing a TypedArray from a detached
ArrayBuffer will throw.

This change adds a `WasDetached` method to the `v8::ArrayBuffer` class
to give embedders access to this information without having to run JS
code.

Bug: v8:13159
Change-Id: I2bb1e380cee1cecd31f6d48ec3d9f28c03a8a673
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3810345
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83963}
2022-10-27 20:04:25 +00:00
Dave Tapuska
b6969920f4 [execution] Add ability to set the microtask queue for the context.
It is important that the Context's microtask queue matches what the
embedder thinks it is. Android WebView has some interop functionality
where the Agent changes but the context must not be cleared. Ensuring the microtask queue for the context matches the Agent by adding a
setter that the embedder can call.

BUG=chromium:961186

Change-Id: Id99644fbfc84b8a1676162261444c02d07b238a1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3976350
Commit-Queue: Dave Tapuska <dtapuska@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83937}
2022-10-26 16:40:21 +00:00
Zequan Wu
91ffb88d4e Mark Data constructor deleted.
Because Data's ctor is not defined, debug info optimization will
generate empty debug info for it. Adding standalone_debug attribute for
it to have complete debug info for this class.

Bug: 
Change-Id: I0ca023518b1f5142a63686ba5a41007ac067c1f2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3963719
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Zequan Wu <zequanwu@google.com>
Auto-Submit: Zequan Wu <zequanwu@google.com>
Cr-Commit-Position: refs/heads/main@{#83915}
2022-10-25 23:02:10 +00:00
Juan José Arboleda
69ad9552b2 [profiler] add Serialize to v8::CpuProfile
Support JSON serialization in `v8::CpuProfile`

Bug: v8:13291
Change-Id: I638cf2c1f7acba9c5b8a2932d84c9882d968c90d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905128
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83901}
2022-10-25 10:49:04 +00:00
Michael Lippautz
c23bc72c83 [handles] Split off traced handles from regular global handles
v8::TracedReference and their underlying traced handles are not
actually phantom references but have been historically represented as
such. This patch splits off their backing implementaton into
`TracedHandles`.

As a drive-by, re-organize the free list to rely on indices instead of
pointers, saving a full word for each node. In additon, the setup also
allows for freeing fully empty node blocks after GCs.

Allocation/free of nodes is also organized in a way that avoids
jumping between handles/blocks/nodes for accounting purposes.

Removing CRTP in GlobalHandle internals is left for a follow up.

Bug: v8:13372
Change-Id: Ib55aa9ba71202d5918b486c161fe6f747d31c719
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3966952
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83872}
2022-10-24 10:04:08 +00:00
Adam Klein
9e55d25735 [cleanup] Remove Wasm SIMD flag & deprecate embedder-enabling API
It's been enabled by default since Chrome 91.

Bug: v8:6020
Change-Id: Id26b7fb0b7dffe19a88a6f0071dd59203b06415a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3957636
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83862}
2022-10-22 00:47:42 +00:00
Marja Hölttä
724e7ce174 [arraybuffers, api] Implement [[ArrayBufferDetachKey]] support
Bug: chromium:1344595
Change-Id: Ic1075361b92c776789ce2fbf1e105dea174f3a2f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3925936
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83847}
2022-10-21 12:55:18 +00:00
Benedikt Meurer
b2892b5f24 [inspector] Add [[WeakRefTarget]] internal property.
This adds a new [[WeakRefTarget]] internal property to
`Runtime.getProperties` results for `JSWeakRef` results
(also included in the preview), which will be used by
DevTools to show the target of the weak reference without
having to explicitly call `deref()` on them. As part of
this we also have (temporary) strong references to the
target, slightly changing behavior, but that's consistent
with how DevTools deals with `JSWeakMap` and `JSWeakSet`.

Bug: chromium:1267690
Change-Id: I2a9ef9261996fcdee20fbd0fc728d11208c82459
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3970598
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83844}
2022-10-21 12:14:52 +00:00
Adam Klein
e144483823 [api] Add documentation for v8::Platform::GetPageAllocator
Change-Id: I5760687fa9e8a7512d3946704f51f321ffa3676b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3963718
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83827}
2022-10-20 16:32:42 +00:00
Shu-yu Guo
ce2cded47e [cleanup] Use thread_local in Isolate
Bug: v8:13394
Change-Id: I599c0ca8c863be981d89ba8334e42833ea4fee82
Cq-Include-Trybots: luci.chromium.try:linux-rel
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3963712
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83814}
2022-10-20 08:32:38 +00:00
Dave Tapuska
2f0384871f [execution] Pass microtask queue from Context to MicrotasksScope
With a unique microtask queue possibly per context we need to pass
the microtask queue for the MicrotasksScope otherwise the default one
for the isolate will be used.

BUG=chromium:961186

Change-Id: Ib085f08e20185c69760aeea335d673d9c4c72999
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3950216
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Dave Tapuska <dtapuska@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83803}
2022-10-19 14:56:37 +00:00