45d4d220d2
We move js-to-wasm wrappers to a WeakFixedArray in the isolate, indexed by their canonical type index. This ensures that they are reused across instances, and get GC'd when no longer needed. We also remove eager compilation of wrappers. This CL fixes some issues that were caused by out-of-bounds accesses to wrapper arrays attached to module objects. Bug: chromium:1363859, chromium:1363895 Change-Id: Idec0925e775f51fdfa7cd380379b0d1798295a0c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3893860 Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Cr-Commit-Position: refs/heads/main@{#83275} |
||
---|---|---|
.. | ||
benchmarks | ||
bigint | ||
cctest | ||
common | ||
debugger | ||
debugging | ||
fuzzer | ||
fuzzilli | ||
inspector | ||
intl | ||
js-perf-test | ||
memory | ||
message | ||
mjsunit | ||
mkgrokdump | ||
mozilla | ||
test262 | ||
torque | ||
unittests | ||
wasm-api-tests | ||
wasm-js | ||
wasm-spec-tests | ||
webkit | ||
BUILD.gn | ||
OWNERS |