# Conflicts:
#include/v8-cppgc.h
(reverted v8 changes, keeping our fix. again, doesn't resolve msvc build issues.
this does not fix the issue properly. xref: 4c7c7d1a)
#src/codegen/cpu-features.h
(...did something change?)
#src/flags/flag-definitions.h
(xref: 053e54e7)
#src/heap/safepoint.cc
[-] (USE AFTER FREE) quick hack: removing a mutex guard on shared RemoveClient to temporarily mitigate a crash on deinit
well, this is fucking dumb. i think someone at google also figured out this can lead to crashing. their solution: remove the mutex with a call to AssertActive.
considering my issue was related to a dead context with everything else alive, i dont want to find out what that AssertActive is doing. reverting v8 change.
#src/objects/fixed-array-inl.h
who cares
Building Chromium with full Perfetto SDK included increases build time
significantly. We can reduce this overhead by including only those
parts that are required. See b/266913150 for context.
Change-Id: I0cde5cb7df7b6151ec686e993488d8467c416fac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4212390
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Mikhail Khokhlov <khokhlov@google.com>
Cr-Commit-Position: refs/heads/main@{#85603}
... in particular, for keyed loads that have names in the feedback.
Also make InstanceType printing more robust against invalid instance
types.
Change-Id: Ib4bef4646c3a18643291d0bb517ef3470b7497cf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4213911
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85602}
Add a CheckValueEqualsString node which compares strings by contents,
not just by reference, to avoid deopt loops from comparing
uninternalized to internalized strings in name-feedback keyed loads.
Bug: v8:7700
Change-Id: If64e54e6e4a4c89824e6ab1f3f3cf3b4a25f2a51
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4212405
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85601}
This reverts commit 77d08fcde5.
Reason for revert: compile failures on Arm64 bots https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Arm64%20-%20builder/24010/overview
Original change's description:
> [static-roots] Use static map range checks instead of instance types
>
> Some instance types, or type ranges, corresponds to a range of pointers
> in the static read only roots table. Instead of loading the instance
> type of a map it can therefore be beneficial to compare the map itself
> against this range.
>
> This CL adds:
>
> * Add infrastructure to compute and output a mapping of
> `(instance_type_first, instance_type_last) ->
> (map_ptr_first, map_ptr_last)` for interesting ranges.
> * Extend InstanceTypeChecker to use these ranges.
>
> For single instance types that map onto a range of maps it is not
> obvious which check is faster. Checking the map range saves a load,
> whereas checking the instance type saves an additional jump.
>
> Bug: v8:13466
> Change-Id: I670fc10fad9920645c0ce0d976ae7e7a13a86e60
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4188379
> Reviewed-by: Jakob Linke <jgruber@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Olivier Flückiger <olivf@chromium.org>
> Auto-Submit: Olivier Flückiger <olivf@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#85599}
Bug: v8:13466
Change-Id: I88afb05948d934d15f8512bcd37d56429aac23a6
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4214812
Auto-Submit: Deepti Gandluri <gdeepti@chromium.org>
Owners-Override: Deepti Gandluri <gdeepti@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#85600}
Some instance types, or type ranges, corresponds to a range of pointers
in the static read only roots table. Instead of loading the instance
type of a map it can therefore be beneficial to compare the map itself
against this range.
This CL adds:
* Add infrastructure to compute and output a mapping of
`(instance_type_first, instance_type_last) ->
(map_ptr_first, map_ptr_last)` for interesting ranges.
* Extend InstanceTypeChecker to use these ranges.
For single instance types that map onto a range of maps it is not
obvious which check is faster. Checking the map range saves a load,
whereas checking the instance type saves an additional jump.
Bug: v8:13466
Change-Id: I670fc10fad9920645c0ce0d976ae7e7a13a86e60
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4188379
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Olivier Flückiger <olivf@chromium.org>
Auto-Submit: Olivier Flückiger <olivf@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85599}
This is a follow-up to https://crrev.com/c/4204032 which allowed
wrapper inlining for the nullable externref type.
Bug: v8:7748
Change-Id: I5a82c37b7cf0cfcbcacbe399f8b3119176c3bba4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4212394
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85598}
In particular, {CountTrailingZeros} can skip a dynamic check if it knows
that the input is not zero.
R=ahaas@chromium.org
Bug: v8:13565, v8:13673
Change-Id: I46d4fea2952d22f57b0695f5db690d6fefd7c1ad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4212401
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85597}
The GC doesn't handle interrupts at this level and all callbacks that
would execute user code are invoked before entering the marker.
Bug: v8:12612
Change-Id: I13c7dab1f69c51d1dbe66721b3422d8ebf48c1c0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4212398
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85595}
Drive-by refactoring: Make it evident that currently we upload additional files only for Android platform.
Bug: v8:13686
Cq-Include-Trybots: luci.v8.try:v8_android_arm64_n5x_rel
Change-Id: I8081c1185d6a92dfdcef82e697e301f3e7838dc1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4205916
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Liviu Rau <liviurau@google.com>
Cr-Commit-Position: refs/heads/main@{#85592}
We should not mix Baseline vs Maglev ScratchScope. x14 is considered
an extra-scratch register in arm64 for Baseline, but not for Maglev,
which has a more comprehensive way to allocate extra scratches.
Bug: v8:7700, chromium:1410970
Change-Id: Ia7eb77ff7fffc3c91d572931aa2ea001c90c1ffc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4212388
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85590}
In JavaSCript implementations that supports ECMA-402,
`Array.prototype.toLocaleString()` must invoke the `toLocaleString` method of
each non-undefined, non-null elements witch exactly two (2) arguments.
See: https://tc39.es/ecma402/#sup-array.prototype.toLocaleString step 6.c.i.
V8 appears to provide no arguments when locale is undefined and to not provide options when options is undefined.
Bug: v8:13564
Change-Id: I655917210554d20d2eaebe2ac333421dd5d157ef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4184564
Reviewed-by: Nikolaos Papaspyrou <nikolaos@chromium.org>
Auto-Submit: Juan José <soyjuanarbol@gmail.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85588}
.. similar to the way the build works in BUILD.gn:
- When TF is enabled, TF is compiled into both v8_library("v8") and
v8_binary("mksnapshot").
- When disabled, TF is compiled into mksnapshot, but not
v8_library("v8").
This required splitting torque-generated files into (object)
definitions and initializers; definitions are always included,
initializers only in mksnapshot.
Bug: v8:13629
Change-Id: I987f02ad809cce3b922e3b0568d9695b16776e26
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4196117
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85587}
This means TurboFan might not see what Maglev did, and it might make
different decisions, but if we deopt we'll learn in Ignition anyway and
won't make the same mistake later. At the same time this avoids a lot of
unnecessary operations that impact tight loops.
Bug: v8:7700
Change-Id: I6fada2ed0218b0b97fc8c9d9ba10fb2218cd71d4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4200631
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85585}
Script::IsSubjectToDebugging() returns true for "Normal" and
"WebAssembly" scripts. This is exactly when we want to notify the
debug delegate. We can remove the round-about way this is currently
checked.
R=pfaffe@chromium.org
Bug: None
Change-Id: I1d3b2560043cebffb8eb3db68f58bf0a137abe06
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4208947
Reviewed-by: Philip Pfaffe <pfaffe@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85584}
- Remove camel-case Code accessors like InstructionStream since
they only make sense on Code (where we have to distinguish between
embedded builtins and other Code).
- Remove the prefix from 'raw_'-prefixed accessors since it was
intended to clearly disambiguate from the camel-case accessors and
is now no longer needed.
- Remove various dead functions.
- Update comments.
Bug: v8:13654
Change-Id: Ife51e4aef502fc30ab1526c205a49e5620be96f7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4205925
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85580}
.. which no longer makes sense in today's code base. This was originally
introduced to distinguish Code objects containing the actual instruction
stream (= all non-builtin Code objects) from Code objects only
containing a trampoline with a `jmp` to the .text section (= where
instruction streams for embedded builtins are located).
Today, trampoline code no longer exists; rename the predicate to
`has_instruction_stream`, where
has_instruction_stream == !is_off_heap_trampoline
Bug: v8:13654
Fixed: v8:13698
Change-Id: I78be1cee2e045c1944486b8a54a03eb9d1ce0c27
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4205921
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85579}
The cleanup is in practice only needed when heap verification is active.
In all other cases it can be delayed until the next full GC.
Bug: v8:12612
Change-Id: Ic31e1011d6377c2df255554eae56bd9eed40744a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4208928
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85578}
Port commit 76a817e03a
Also, rename the enum variable in FFlagsMask from kOverflow to kFPUOverflow to avoid redefinition due to the commit 949bd4467d.
Change-Id: I83e42d4cb0cf48d678719572adb008ef101b23e7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4204830
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Reviewed-by: ji qiu <qiuji.odyssey@gmail.com>
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#85577}
The load of the {second_string} field should only be
4 Byte size. In case of the object being at a page
boundary, the wrong load can trigger a segmentation
fault.
In all other cases, a wrongly loaded value will just
result in a deferred runtime call.
Bug: chromium:1411533
Change-Id: Icd22f6baa4a9625ebfced69f3b7a601adf795a5c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4208936
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85576}
Rolling v8/build: ddbdf3a..e0df145
Rolling v8/buildtools: 7a0617e..295c6e5
Rolling v8/buildtools/linux64: git_revision:629f6be82956987c7ac10faf2acf0534b1667fa2..git_revision:84c8431f3e03cc6226c59dd49637c15ea31169a1
Rolling v8/buildtools/third_party/libc++/trunk: b93c728..59bae40
Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/5ba838f..5a468cc
Rolling v8/third_party/depot_tools: 94b0eb1..3d072ab
Rolling v8/third_party/fuchsia-sdk/sdk: version:11.20230129.3.1..version:11.20230131.1.1
Rolling v8/tools/clang: 527cfbb..44e5e39
Change-Id: I7e12e35e78b1b7528c64560f3a30b407e0296b9d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4210695
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#85575}
After this commit:
ce2cded47e
The Isolate object for the current thread is stored in `g_current_isolate_` using `thread_local` instead of using `isolate_key_`.
Bug: v8:13394
Change-Id: I9ac1054cb7beea49c69a9990147321b68a1b80f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4211050
Commit-Queue: Choongwoo Han <choongwoo.han@microsoft.com>
Reviewed-by: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#85574}
Added a flag to implemet Array.fromAsync behind it,
and added a builtin in builtin-array.cc for the implementation
of the feature.
Bug: v8:13321
Change-Id: I5498f5bbc4616594efdcf9be8f74dd46afe7a0b7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4204827
Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85573}
Per the WebIDL specification, objects that are namespaces must have the
their class string value set to their identifier name [1]. Since per
spec, console is defined as a namespace [2], console's class string must
be "console".
However, since the console object in Chromium/v8 is directly implemented
inside of v8, it doesn't adhere to the WebIDL binding norms. Its
implementation manually had its @@toStringTag set to "Object", which is
incorrect. This CL corrects it to "console" and adjusts test
expectations accordingly.
Unfortunately, this CL will have web-exposed changes to Chromium that
are not tested anywhere, specifically because console's implementation
of namespace did not adhere to the WebIDL spec. Separately,
https://crrev.com/c/4193348 fixes Chromium's web-exposed tests and
stable test expectations, to manually treat console as a namespace
(despite its broken implementation) so that the global interface listing
tests properly enumerate attributes/methods on the console object.
Once this CL lands, those expectations will need to be changed.
The motivation for this change is to ensure that all console attributes
and methods are properly accounted for in the usual Blink webexposed
stable tests that are owned by the Blink API OWNERs. This is because
recently, v8 shipped a new console method (createTask()) that entirely
bypassed the Chromium launch process:
https://www.chromium.org/blink/launching-features/, because no files
needed to be approved by Blink API OWNERs.
[1]: https://webidl.spec.whatwg.org/#ref-for-dfn-class-string%E2%91%A8
[2]: https://console.spec.whatwg.org/#console-namespace
Change-Id: I0bbd05242fc815945cce40c65d74995950d64115
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4193308
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Dominic Farolino <dom@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85572}
This reverts commit 9901a04144.
Reason for revert: Crashes on the CFI bots https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20-%20cfi/38573/overview
Original change's description:
> [heap] Move the likeliest case of GcSafeTryFindCodeForInnerPointer up
>
> It's much more likely to find the code object in CODE_SPACE than in LO
> space (or the THIRD_PARTY_HEAP). Also, remove an obsolete and misleading
> comment.
>
> Bug: v8:13654
> Change-Id: Ia6c2a28a8eb5b0fb3f5951a9018fac0c0683a96e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4205914
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Jakob Linke <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#85564}
Bug: v8:13654
Change-Id: Id2941c5b98289fdcc30efb47172d266bfd43de0e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4210628
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Owners-Override: Deepti Gandluri <gdeepti@chromium.org>
Auto-Submit: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85571}
Shared objects have fixed layout (i.e. immutable maps) and start off
sealed. Ordinary JS objects allow writable properties to be redefined to
be non-writable. This violates the fixed layout invariant and needs to
be disallowed.
Also contains a drive-by fix removing
@highestInstanceTypeWithinParentClassRange, which is unneeded.
Bug: chromium:1407595, v8:12547
Change-Id: I0257fa19f59ccfaaf0e07cb42aeedd71e132d21a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4190525
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85570}
Forcibly enable jitless mode since we do not have access to executable
code pages. This will also disables wasm.
Do not enable JSCVT based on the compiler since older iPhones may not
have the JSVCT instruction. This will eventually need to be done
dynamically.
Use the host toolchain when compiling on M1 Macbooks for iOS devices.
Ensure we use 16k alignment for pages.
Bug: chromium:1411704
Change-Id: I0019a2fc7b645b96ae105504d915cd0c3e3eafdf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4206250
Commit-Queue: Dave Tapuska <dtapuska@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85569}
The flag is currently poorly tested and we are unlikely to
use the OutOfLinePrologue in its current form.
Bug: v8:7700, chromium:1411153
Change-Id: Ifd5867910d79fbdeaebb4c21f7070f806d78052c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4208932
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85568}
Optimize Sweeper::StartSWeeperTasks a bit by
1) Skip SnapshotPageSet when possible and only get a lock for shared
heap.
2) Retain ConcurrentSweepers for the lifecycle of Sweeper.
Bug: v8:12612
Change-Id: Id30f07e346d42c99ae6b0ab1336a95c65ee7cb15
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4203383
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85567}
This reverts commit 596e56868d.
Reason for revert: Breaks JetStream2 on perf bots.
Original change's description:
> [turboshaft] Implement structural optimization reducer
>
> This CL adds a new Turboshaft reducer that is suitable for changing the
> graph in a way that doesn't reduce individual operations, rather changes
> the structure of the graph. The first such reduction we support is
> transforming if-else cascades that check if a given value is equal to
> any constant from a given set into a switch with cases corresponding to
> the constants in the set.
>
> Bug: v8:12783
> Change-Id: Iee1e5581a334c3dc255d673d2178f76706e6dae2
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4106752
> Commit-Queue: Maya Lekova <mslekova@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#85561}
Bug: v8:12783
Change-Id: Ic9ded7f4e18258346f547600cb541b2fa094fb8d
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4210088
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85566}
This enables an optimization for JavaScript which is currently only
enabled for WebAssembly. Clusterfuzz found problems on a previous try to
enable this (see https://crbug.com/1356461), but a fix
(https://crrev.com/c/4197349) landed in the meantime which might have
fixed things.
Any resulting crashes or other issues will have to be fixed before the
v11.2 branch cut, otherwise we will have to revert this CL.
R=jkummerow@chromium.org
Bug: v8:13581
Change-Id: I139804e53285803d7f2178893c86b520c96a8eb0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4205923
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85565}
It's much more likely to find the code object in CODE_SPACE than in LO
space (or the THIRD_PARTY_HEAP). Also, remove an obsolete and misleading
comment.
Bug: v8:13654
Change-Id: Ia6c2a28a8eb5b0fb3f5951a9018fac0c0683a96e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4205914
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85564}
Calling EnsureFinished could sweep array buffers without first making
sure that promoted page iteration is done.
Bug: chromium:1411076
Change-Id: Ic6cb9b13af0851f40c8720f046602a7739aa0efa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4205922
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85563}
.. and replace it by base::Optional<Code>. It's no longer needed, now
that Code and InstructionStream cases are merged.
This was trickier than it sounds at first, because:
- CodeLookupResult (CLR) was used during the MARK_COMPACT GC phase and
thus had to observe subtle semantics in the presence of
forwarding pointers.
- CLR implicitly contained a Code object for off_heap_trampolines
and an InstructionStream object for everything else. These implicit
behaviors threaded through elsewhere, e.g. in the
inner-pointer-to-code cache which relies on the fact that the
underlying object pointer does not move until GC completes and
the cache is flushed.
- Semantics of the dual-object {Code,InstructionStream} are generally
very subtle during GC.
This CL attempts to make all this more explicit by introducing a
GcSafeCode wrapper type which must be used in code that is affected
by semantics described above. The GcSafeCode type exposes only methods
that are safe to call during MARK_COMPACT.
Drive-by:
- Rename the Heap::GcSafeFoo function family s.t. a 'GcSafe' prefix
means that the function can be used during GC and returns
GcSafeCode objects; and 'TryFind' vs. 'Find' returns a
base::Optional<Foo> vs. just Foo.
Bug: v8:13654
Change-Id: I410b5539ea1b584b823bce2dafd8d1328eedc039
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4203385
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85562}
This CL adds a new Turboshaft reducer that is suitable for changing the
graph in a way that doesn't reduce individual operations, rather changes
the structure of the graph. The first such reduction we support is
transforming if-else cascades that check if a given value is equal to
any constant from a given set into a switch with cases corresponding to
the constants in the set.
Bug: v8:12783
Change-Id: Iee1e5581a334c3dc255d673d2178f76706e6dae2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4106752
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85561}
MinorMC only promotes whole pages, but doesn't move any objects. Thus
there is no need to update specific pointers. The update pointers phase
in practice only filters for objects that were promoted.
Since marking anyway needs to filter the remembered set (because slot
may be overwritten), we can just filter the remembered set once there
instead of doing it twice (i.e. end of evacuation and the following
marking phase).
Updating the external strings table remains as is since it is used by
heap verification as well.
Bug: v8:12612
Change-Id: I7e36e8acb886852087d303eceec4276f5349b272
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4205907
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85558}
In memory reducing GCs, promoted page iteration is not delayed and thus
pretenuring feedback is available earlier.
Bug: chromium:1411113
Change-Id: I3140b0bbcb9bfa537def5faac9ddd07183668498
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4204030
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85557}
