)]}' { "log": [ { "commit": "1d17afafffbb434e04b2ee4bec7ca09989626341", "tree": "75e5191d8cee62adcc8a8e7343e0aa5272f3b116", "parents": [ "2ad1b92f41e8e86bc106b9b6095d575e16b99a48" ], "author": { "name": "v8-ci-autoroll-builder", "email": "v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com", "time": "Sat Aug 01 04:04:38 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Sat Aug 01 04:51:36 2026" }, "message": "Update V8 DEPS (trusted)\n\nRolling build: https://chromium.googlesource.com/chromium/src/build/+log/b772727..e7f0a97\n\nRolling third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/e051c66..9b72516\n\nRolling third_party/instrumented_libs: https://chromium.googlesource.com/chromium/third_party/instrumented_libraries/+log/e8cb570..d15c278\n\nRolling gcs:chromium-browser-clang/Linux_x64/clang: Linux_x64/clang-llvmorg-23-init-19482-g53d18800-1.tar.xz,e22e06c05fe1657f48f988b15804b8226e691addb00abba5b984a5c99ac98c42,59093892,1781627382446731..Linux_x64/clang-llvmorg-23-init-19482-g53d18800-2.tar.xz,94940b8da1c3e7fec9020a75cfc4e852922a4d163dab8957e691a36ae5d49f0b,59100444,1785366626567993\n\nRolling gcs:chromium-browser-clang/Linux_x64/clang-tidy: Linux_x64/clang-tidy-llvmorg-23-init-19482-g53d18800-1.tar.xz,96da04c2fff4e580ac81b840405edfa292108d0b593927a10750c0a1d8599c0a,14808648,1781627382496605..Linux_x64/clang-tidy-llvmorg-23-init-19482-g53d18800-2.tar.xz,355a938fd3ab277dee7b2df50264416a0ebbdfd101e4b6beb82cc176f0ae300d,14809560,1785366626548898\n\nRolling gcs:chromium-browser-clang/Linux_x64/clangd: Linux_x64/clangd-llvmorg-23-init-19482-g53d18800-1.tar.xz,1e6b6918bb270659ef517a3e8f80af8f371bc79a9d942241978db8faea22f152,15001372,1781627382490030..Linux_x64/clangd-llvmorg-23-init-19482-g53d18800-2.tar.xz,7eab6663df18976874c774eb2dee38f79287ac2dbdd336fcda2d955438fe131a,14988320,1785366626796669\n\nRolling gcs:chromium-browser-clang/Linux_x64/llvm-code-coverage: Linux_x64/llvm-code-coverage-llvmorg-23-init-19482-g53d18800-1.tar.xz,bb63e33c20329c344a9dfa958f3742b316c0b9dd602647190fb0037d8d53a7e6,2332356,1781627382888550..Linux_x64/llvm-code-coverage-llvmorg-23-init-19482-g53d18800-2.tar.xz,2cb5220dceb4be408c306537e83b323219ed0129cf3512fb4bbf49aa0c334b7f,2332356,1785366626986503\n\nRolling gcs:chromium-browser-clang/Linux_x64/llvmobjdump: Linux_x64/llvmobjdump-llvmorg-23-init-19482-g53d18800-1.tar.xz,e43b98bce71d58bbe1b456f7b62997c4d017cf8362a0367592428ac5a7512f41,5875704,1781627382574869..Linux_x64/llvmobjdump-llvmorg-23-init-19482-g53d18800-2.tar.xz,61ac1326d1fd10fe3527f1ca0ce78aa357923157442056eaa53a027931db986e,5873792,1785366626833938\n\nRolling gcs:chromium-browser-clang/Mac/clang: Mac/clang-llvmorg-23-init-19482-g53d18800-1.tar.xz,84b3934db2fb3c2e657d4a783a83ca6d2facaf598991490ae8ab712fcb03224b,56083264,1781627385112611..Mac/clang-llvmorg-23-init-19482-g53d18800-2.tar.xz,51350c8f6da5c92ab19b0b17a3cbc7762b960b29fd68530e9feb52eb5079ae19,56088216,1785366628543558\n\nRolling gcs:chromium-browser-clang/Mac/clang-mac-runtime-library: Mac/clang-mac-runtime-library-llvmorg-23-init-19482-g53d18800-1.tar.xz,5079e2ac3f0fa76e8b0218bf99a65a5439e8dcf6a750f886a355a66df34c69c1,1010816,1781627394919334..Mac/clang-mac-runtime-library-llvmorg-23-init-19482-g53d18800-2.tar.xz,0105a7a2e8e6f4b88b6414756a5bfaa04e3cb1e678d29e3df367752a203edb6a,1010844,1785366639043429\n\nRolling gcs:chromium-browser-clang/Mac/clang-tidy: Mac/clang-tidy-llvmorg-23-init-19482-g53d18800-1.tar.xz,1ca3dc160992d8c27765adaffcc8115aed34cdf7645a5354820e8c8b16b75dcd,14790996,1781627384977799..Mac/clang-tidy-llvmorg-23-init-19482-g53d18800-2.tar.xz,66d4a4b66e5ad9bee6b6235e9a8fee213afa4c321232e897881c8e4dcf752d61,14767916,1785366628634961\n\nRolling gcs:chromium-browser-clang/Mac/clangd: Mac/clangd-llvmorg-23-init-19482-g53d18800-1.tar.xz,4920275e6050dffbb81ba0210a627a61a20faa896aa50f5ecc2d765522790526,16720488,1781627385229783..Mac/clangd-llvmorg-23-init-19482-g53d18800-2.tar.xz,9866482056c17d3f5b4c13a693c6e7e8417c54e943cf00e58a82a51b65dfd183,16714728,1785366628706685\n\nRolling gcs:chromium-browser-clang/Mac/llvm-code-coverage: Mac/llvm-code-coverage-llvmorg-23-init-19482-g53d18800-1.tar.xz,07e8bf3354e0c086e420ab8f1f376e48c8b6207788cf30b56d1b0ad1fd4b0f12,2372720,1781627385661382..Mac/llvm-code-coverage-llvmorg-23-init-19482-g53d18800-2.tar.xz,baec5b697375914d0ec1a377f66a6ac3826aad0103de2d6258b8a88cf7dd5c02,2372468,1785366629000854\n\nRolling gcs:chromium-browser-clang/Mac/llvmobjdump: Mac/llvmobjdump-llvmorg-23-init-19482-g53d18800-1.tar.xz,9b286eecf04996dfa82cd1434bceb19612fa0754e4390649ba8dcd846dca9c1e,5797028,1781627385345493..Mac/llvmobjdump-llvmorg-23-init-19482-g53d18800-2.tar.xz,ab7600041b0db44338b42c55b7ed1224edc10c96283d71e53a373820be9e62f9,5790116,1785366628828288\n\nRolling gcs:chromium-browser-clang/Mac_arm64/clang: Mac_arm64/clang-llvmorg-23-init-19482-g53d18800-1.tar.xz,e96c5e31ddc2a6e841bcb0f7278ae82b3a581799904276e6f7673213c9748c27,47058068,1781627397208650..Mac_arm64/clang-llvmorg-23-init-19482-g53d18800-2.tar.xz,a9c5ab02bfdc07a6ad6c6711d884dccab1fdf52e05e71aa9328039cddaff3664,47045224,1785366640567652\n\nRolling gcs:chromium-browser-clang/Mac_arm64/clang-tidy: Mac_arm64/clang-tidy-llvmorg-23-init-19482-g53d18800-1.tar.xz,27eff49b49d393c903246d5e17ba620f62f493a8a39cb6dbdd2e3f5f06c592a2,12835944,1781627397575694..Mac_arm64/clang-tidy-llvmorg-23-init-19482-g53d18800-2.tar.xz,51eea196d67444cc33613791193acba52803e0b57cdcbecd8135b4578674145e,12837040,1785366640711645\n\nRolling gcs:chromium-browser-clang/Mac_arm64/clangd: Mac_arm64/clangd-llvmorg-23-init-19482-g53d18800-1.tar.xz,9519e51006f45a797a351b616d92bff319793ab976eeb59df60901d6181f3c18,13205948,1781627397237653..Mac_arm64/clangd-llvmorg-23-init-19482-g53d18800-2.tar.xz,2e9c4180eaf40a5ffd4f26bfcb2c8b7172de1ad06bb81e98cfbec466cd5eabf9,13199252,1785366640801569\n\nRolling gcs:chromium-browser-clang/Mac_arm64/llvm-code-coverage: Mac_arm64/llvm-code-coverage-llvmorg-23-init-19482-g53d18800-1.tar.xz,62084a5523a1c3b140166c2ed5a21bc110ceb65503f2759272a9f1feb00b503e,2000216,1781627397451117..Mac_arm64/llvm-code-coverage-llvmorg-23-init-19482-g53d18800-2.tar.xz,9a2a764f9f2dbb46eba03ed29a87bf55b580a1f7e562ba4002056cb28e2c5902,1999328,1785366641042033\n\nRolling gcs:chromium-browser-clang/Mac_arm64/llvmobjdump: Mac_arm64/llvmobjdump-llvmorg-23-init-19482-g53d18800-1.tar.xz,b6c6c0b1b4147ba4d51603713d3ed21f88ee2f506ff07fb432b3444f1d323295,5548680,1781627397409118..Mac_arm64/llvmobjdump-llvmorg-23-init-19482-g53d18800-2.tar.xz,39fad69229bd7f8b440809f74a711175f5f0ed3cc92c4d6f3652c0ca57e39c2e,5546692,1785366640876543\n\nRolling gcs:chromium-browser-clang/Win/clang: Win/clang-llvmorg-23-init-19482-g53d18800-1.tar.xz,9e3894b94d0d5e3d5904a559f590f12bd53aa5d1d9b6a902de2acb957825de46,51306328,1781627409675428..Win/clang-llvmorg-23-init-19482-g53d18800-2.tar.xz,0d42e6825a7b5cafb8b6d250e8aae3b9b1920f4cbc2fe4f5a8dd46154d95d25d,51315536,1785366653133084\n\nRolling gcs:chromium-browser-clang/Win/clang-tidy: Win/clang-tidy-llvmorg-23-init-19482-g53d18800-1.tar.xz,8fa52c3d1707e73d0689aaa3c8d3789f13e85526bef029d942baf44ed980b442,14867152,1781627409620988..Win/clang-tidy-llvmorg-23-init-19482-g53d18800-2.tar.xz,fbd7f3a0aa321c144542a3d97f702ae676306b837febfd7663a036929f8eb0d5,14855356,1785366653263211\n\nRolling gcs:chromium-browser-clang/Win/clang-win-runtime-library: Win/clang-win-runtime-library-llvmorg-23-init-19482-g53d18800-1.tar.xz,f925c30e1f63291662b2ad91103592208ecc4354f669c98a07e35360d2561a13,2623388,1781627419134531..Win/clang-win-runtime-library-llvmorg-23-init-19482-g53d18800-2.tar.xz,da5135a86ba5a585abc6dfb38c38803a14e9a83cd39ceaac85eedef50f193a1d,2622056,1785366663332782\n\nRolling gcs:chromium-browser-clang/Win/clangd: Win/clangd-llvmorg-23-init-19482-g53d18800-1.tar.xz,54042464918d992a19efed3a5f2a170e6fc2e4551884b4870650e3a3a6a03b41,15262064,1781627409708803..Win/clangd-llvmorg-23-init-19482-g53d18800-2.tar.xz,1e6d5c7e036b4740b7dabaca71e2e3e97a68477515ffc9faa10ba324781faa56,15260276,1785366653344899\n\nRolling gcs:chromium-browser-clang/Win/llvm-code-coverage: Win/llvm-code-coverage-llvmorg-23-init-19482-g53d18800-1.tar.xz,7c4fbafcf2741a036d1f4058fc31b52cb5b0951e617561fc3d51b7fbe0a3044b,2496336,1781627409916932..Win/llvm-code-coverage-llvmorg-23-init-19482-g53d18800-2.tar.xz,6d21c3aebf0238eb31dc8fe41c01f079dde57a06bf628cedca7ef94f4e9cbdcb,2494100,1785366653543218\n\nRolling gcs:chromium-browser-clang/Win/llvmobjdump: Win/llvmobjdump-llvmorg-23-init-19482-g53d18800-1.tar.xz,7ea19d03f21ef59d2e511af8d9cccff20ea72deb54923557173bb46a64244fa7,5934284,1781627409787893..Win/llvmobjdump-llvmorg-23-init-19482-g53d18800-2.tar.xz,ec5ac24513c7b650b27b638bc46c207b228072fd5cd7c45a86b988820c01ff95,5940460,1785366653406139\n\nRolling third_party/perfetto: https://chromium.googlesource.com/external/github.com/google/perfetto/+log/c4eb674..5774a41\n\nRolling third_party/rust: https://chromium.googlesource.com/chromium/src/third_party/rust/+log/2cf26fa..eac4bf4\n\nRolling gcs:chromium-browser-clang/0: Linux_x64/rust-toolchain-b998449636a48e2c4a362809085b600a0174e1f2-5-llvmorg-23-init-19482-g53d18800.tar.xz,1753392d6fe791a5ce743bfc70f45e151ee27bcccede516fb221b023f2c06a05,274786408,1783367871911099..Linux_x64/rust-toolchain-b998449636a48e2c4a362809085b600a0174e1f2-6-llvmorg-23-init-19482-g53d18800.tar.xz,fa341a74b1567fe57af21aa7bccbdf3c0ec3b704fbb01829763faa5292eb4ddd,274829308,1785459300476581\n\nRolling gcs:chromium-browser-clang/1: Mac/rust-toolchain-b998449636a48e2c4a362809085b600a0174e1f2-5-llvmorg-23-init-19482-g53d18800.tar.xz,6925151e70efd917156f3d50925c5bd416b9adf4ff42ca4bf73b4a6610d785d2,262413648,1783367875702343..Mac/rust-toolchain-b998449636a48e2c4a362809085b600a0174e1f2-6-llvmorg-23-init-19482-g53d18800.tar.xz,d256ca6d43eb8131d78cd908dbc8b07e59acb67902497de324c60b85a6d94635,262354296,1785459303542909\n\nRolling gcs:chromium-browser-clang/2: Mac_arm64/rust-toolchain-b998449636a48e2c4a362809085b600a0174e1f2-5-llvmorg-23-init-19482-g53d18800.tar.xz,1765d9be3b30726f5f5ad60d8bc50ee66501220bc942019782cf423de3f7114e,246837492,1783367879712419..Mac_arm64/rust-toolchain-b998449636a48e2c4a362809085b600a0174e1f2-6-llvmorg-23-init-19482-g53d18800.tar.xz,a23256540cd7c7c8668abdf4044f2ecc905881089a6b0ca6346a94a97887cc77,246808776,1785459306444750\n\nRolling gcs:chromium-browser-clang/3: Win/rust-toolchain-b998449636a48e2c4a362809085b600a0174e1f2-5-llvmorg-23-init-19482-g53d18800.tar.xz,dfa5db1cef7e75fd4d3ea5827f0c5eff3543d55d9d9982f806154e8d6b05950a,415992772,1783367883448269..Win/rust-toolchain-b998449636a48e2c4a362809085b600a0174e1f2-6-llvmorg-23-init-19482-g53d18800.tar.xz,57272886008b441fa229d2e9997b185fa5670bca7cf1f338a77a07d9bcc8eb49,416157244,1785459309430367\n\nRolling tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/93c4673..e8d2583\n\nRolling tools/rust: https://chromium.googlesource.com/chromium/src/tools/rust/+log/9c007b6..5c8a43d\n\nRoll created at https://cr-buildbucket.appspot.com/build/8674701705000649537\n\nChange-Id: Iccf7d75c1536b90d86f9026fe8b6dd725804f4e8\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8184346\nBot-Commit: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com \u003cv8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com\u003e\nCommit-Queue: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com \u003cv8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com\u003e\nCr-Commit-Position: refs/heads/main@{#108984}\n" }, { "commit": "2ad1b92f41e8e86bc106b9b6095d575e16b99a48", "tree": "7370647ab222d24ced1d038f33e8353f0ac4d8ea", "parents": [ "be7c12441c8baec279589b31ef8232727bc9a94c" ], "author": { "name": "v8-ci-autoroll-builder", "email": "v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com", "time": "Fri Jul 31 16:01:18 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Jul 31 17:01:43 2026" }, "message": "Update V8 DEPS (trusted)\n\nRolling build: https://chromium.googlesource.com/chromium/src/build/+log/8cfa312..b772727\n\nRolling buildtools/linux64: git_revision:4a060c55dcc5380837a8684949b74400e929b85e..git_revision:3fd3b0624d8cba16927853600130b2c33d4e7928\n\nRolling buildtools/mac: git_revision:4a060c55dcc5380837a8684949b74400e929b85e..git_revision:3fd3b0624d8cba16927853600130b2c33d4e7928\n\nRolling buildtools/win: git_revision:4a060c55dcc5380837a8684949b74400e929b85e..git_revision:3fd3b0624d8cba16927853600130b2c33d4e7928\n\nRolling third_party/catapult: https://chromium.googlesource.com/catapult/+log/b3849c5..e4d1a01\n\nRolling third_party/llvm-libc/src: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc/+log/1234eac..6622df0\n\nRolling third_party/partition_alloc: https://chromium.googlesource.com/chromium/src/base/allocator/partition_allocator/+log/ad56996..29013c8\n\nRolling third_party/perfetto: https://chromium.googlesource.com/external/github.com/google/perfetto/+log/63a118d..c4eb674\n\nRolling third_party/rust: https://chromium.googlesource.com/chromium/src/third_party/rust/+log/a7261f5..2cf26fa\n\nRoll created at https://cr-buildbucket.appspot.com/build/8674747003264689105\n\nChange-Id: I4c0f9102bdb506619e17f847a2d784a2575a8a35\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8179310\nCommit-Queue: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com \u003cv8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com\u003e\nBot-Commit: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com \u003cv8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com\u003e\nCr-Commit-Position: refs/heads/main@{#108983}\n" }, { "commit": "be7c12441c8baec279589b31ef8232727bc9a94c", "tree": "f37f18b4b42cfc504c7da245b8b52f4b3538c22f", "parents": [ "ab2cad06c8e209248ce0d2cf76e1f0d16aa51533" ], "author": { "name": "Junliang Yan", "email": "junyan1@ibm.com", "time": "Fri Jul 31 15:13:21 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Jul 31 16:10:00 2026" }, "message": "ppc64: Replace r0 with UseScratchRegisterScope in frame helpers\n\nReplace hardcoded r0 register usage with scratch registers acquired\nvia UseScratchRegisterScope in PushCommonFrame, PushStandardFrame,\nRestoreFrameStateForTailCall, and LeaveFrame.\n\nIT: 8\n\nChange-Id: I59cc4d68c9f48e7f03448558a6b1240c1a6cf3e7\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8181066\nCommit-Queue: John \u003cjunyan1@ibm.com\u003e\nReviewed-by: Milad Farazmand \u003cmfarazma@ibm.com\u003e\nCr-Commit-Position: refs/heads/main@{#108982}\n" }, { "commit": "ab2cad06c8e209248ce0d2cf76e1f0d16aa51533", "tree": "b2d1d0c24c59a83b7a331027368484cf04ef1420", "parents": [ "9b019eca14dde998e625b60610610fe0dd230595" ], "author": { "name": "Victor Gomes", "email": "victorgomes@chromium.org", "time": "Fri Jul 31 14:05:08 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Jul 31 15:34:56 2026" }, "message": "[turbofan] Disable additive safe integer feedback\n\nBug: 539350801\n\nChange-Id: I679b5120df2d736da823f7420b2432df31302d6c\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8174345\nAuto-Submit: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCommit-Queue: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nReviewed-by: Leszek Swirski \u003cleszeks@chromium.org\u003e\nCommit-Queue: Leszek Swirski \u003cleszeks@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108981}\n" }, { "commit": "9b019eca14dde998e625b60610610fe0dd230595", "tree": "13fa62aaf1b5553fbbacd9e1b44d284e78c22d22", "parents": [ "23b07facc450f6cfaea3f6cffe7aad5724dbf9a9" ], "author": { "name": "Matthias Liedtke", "email": "mliedtke@chromium.org", "time": "Fri Jul 31 11:38:03 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Jul 31 13:21:23 2026" }, "message": "[arm64] ISel: Fix VisitWordCompareZero for truncated inputs\n\nDifferently to all other architectures, the VisitWordCompareZero\nassumes that all optimizations can skip a preceding 64 -\u003e 32 bit\ntruncation and will truncate implicitly.\n\nThis fixes the wrong assumption for those cases where a 64 bit\ninstruction was emitted instead wrongly assuming that the 32 upper\nbits would\u0027ve been cleared.\n\nFixed: 540446645\nChange-Id: I4f6b56c8803615ad339880aa1dd7deab0d070396\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8176286\nCommit-Queue: Matthias Liedtke \u003cmliedtke@chromium.org\u003e\nReviewed-by: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108980}\n" }, { "commit": "23b07facc450f6cfaea3f6cffe7aad5724dbf9a9", "tree": "66bbc1ed63d61aa9454d43b8391ec5da0357c050", "parents": [ "383120c3acd389f21cae65add09b75230ee929d7" ], "author": { "name": "Milad Fa", "email": "mfarazma@ibm.com", "time": "Thu Jul 30 14:32:28 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Jul 31 12:50:05 2026" }, "message": "[gn] include -Wunnecessary-virtual-specifier on ppc64/s390x\n\nFlag is now supported by our llvm toolchain after upgarding\nto Clang 21.\n\nThis essentially revert this commit: http://crrev.com/c/7602379\n\nNO_IFTTT\u003dBUILD.bazel\n\nIT: 140\nChange-Id: I29e7828285a3f635adab67da5cded690aca2a79b\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8175186\nReviewed-by: Michael Achenbach \u003cmachenbach@chromium.org\u003e\nCommit-Queue: Milad Farazmand \u003cmfarazma@ibm.com\u003e\nCr-Commit-Position: refs/heads/main@{#108979}\n" }, { "commit": "383120c3acd389f21cae65add09b75230ee929d7", "tree": "680f99cff596467435c56fc7da7aa901043b0a39", "parents": [ "23e3e4a95e56953f7bcdf23b4dc64f524e22da36" ], "author": { "name": "Jakob Linke", "email": "jgruber@chromium.org", "time": "Thu Jul 30 13:39:51 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Jul 31 12:36:20 2026" }, "message": "[string] Fix UAF in TwoStringsToSlices with external strings\n\nTwoStringsToSlices converted s1 to a slice before converting s2. For an\nexternal s1 that slice is a raw pointer into the resource with no tagged\nowner (NewOffHeapConstSlice stores kZeroBitPattern), so it keeps nothing\nalive. Converting s2 can flatten it, and the allocation in\nStringSlowFlatten can collect s1 and dispose its resource, leaving the\nslice dangling for the subsequent search.\n\nFlatten both strings up front instead. Afterwards StringToSlice cannot\nallocate: its ConsString arm is the only allocating one, and the\nSlicedString/ThinString arms walk to parents that are already direct.\n\nFixed: 535000102\nChange-Id: Ic438a73fa3ae9f1fad36d4db01d298cc3252b595\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8176583\nAuto-Submit: Jakob Linke \u003cjgruber@chromium.org\u003e\nReviewed-by: Leszek Swirski \u003cleszeks@chromium.org\u003e\nCommit-Queue: Jakob Linke \u003cjgruber@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108978}\n" }, { "commit": "23e3e4a95e56953f7bcdf23b4dc64f524e22da36", "tree": "daaa5c6a5051e4c8ab484b67202fb488da3ce3ae", "parents": [ "678015ae439cc7ea46c60bba068bb6d388187d07" ], "author": { "name": "Victor Gomes", "email": "victorgomes@chromium.org", "time": "Fri Jul 31 07:43:17 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Jul 31 12:34:37 2026" }, "message": "[turbolev] Do not print the graph after an aborted Turbolev phase\n\nFixed: 540717862\nChange-Id: Idce883aca582154d901ba015c844cd60b7baf439\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8181988\nAuto-Submit: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nReviewed-by: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nCommit-Queue: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108977}\n" }, { "commit": "678015ae439cc7ea46c60bba068bb6d388187d07", "tree": "bf78ccf2a1b3e28483fb557eed9b3004c8fab775", "parents": [ "a777999ee48633dc5587b01440180753a09eac31" ], "author": { "name": "Olivier Flückiger", "email": "olivf@chromium.org", "time": "Fri Jul 31 10:57:40 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Jul 31 11:36:57 2026" }, "message": "[generator] Protect against cross-realm generator next inlining\n\nWhen Generator.prototype.next is inlined in Maglev or TurboFan, result\nobject allocations inside the generator function are suppressed and\nmaterialized within the calling compilation target realm. If a generator\nfrom a foreign realm is resumed in an optimized function, inlining\ncauses yielded IteratorResult objects to incorrectly inherit from the\ncaller\u0027s prototype rather than the generator\u0027s instantiation realm.\n\nThis change adds checks to ensure the map constructor of\nevery candidate generator map belongs to the current target native\ncontext.\n\nBug: 476989751\n\nTAG\u003dagy\nCONV\u003d58e3087b-723f-4627-a9ad-e7da3735e513\n\nChange-Id: Ia173175a32cffd44a821cc6329a926f56bb5e271\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8137546\nCommit-Queue: Olivier Flückiger \u003colivf@chromium.org\u003e\nAuto-Submit: Olivier Flückiger \u003colivf@chromium.org\u003e\nReviewed-by: Marja Hölttä \u003cmarja@chromium.org\u003e\nReviewed-by: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108976}\n" }, { "commit": "a777999ee48633dc5587b01440180753a09eac31", "tree": "4ac25bee37d3a6de47631bb2b5eb59a39210623e", "parents": [ "a26c375789bae81af7917472610906448af256f9" ], "author": { "name": "Leszek Swirski", "email": "leszeks@chromium.org", "time": "Fri Jul 17 13:31:42 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Jul 31 11:04:33 2026" }, "message": "[execution] Throw TypeError on re-entrant Atomics.wait calls\n\nEach Isolate owns a single per-isolate FutexWaitListNode instance\naccessed via isolate-\u003efutex_wait_list_node().\n\nWhen FutexEmulation::WaitSyncImpl unlocks the FutexWaitList mutex during\nisolate-\u003estack_guard()-\u003eHandleInterrupts(), re-entrant JS execution\n(e.g., via DevTools Runtime.evaluate on frozen workers) can call\nAtomics.wait again on the same thread.\n\nThis re-entrancy reuses the same singleton FutexWaitListNode,\ndouble-adding it to FutexWaitList and corrupting list pointers, leading\nto Use-After-Free.\n\nThis CL checks if node-\u003ewaiting_ is already true on entry to\nWaitSyncImpl, and throws a JS TypeError\n(MessageTemplate::kAtomicsOperationNotAllowed) to reject re-entrant\nsynchronous wait calls cleanly.\n\nBug: 532921336\nChange-Id: Id2d2eab9a7fb19f5ce15246692ac2c3693bdc2cb\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8086043\nCommit-Queue: Olivier Flückiger \u003colivf@chromium.org\u003e\nAuto-Submit: Leszek Swirski \u003cleszeks@chromium.org\u003e\nReviewed-by: Olivier Flückiger \u003colivf@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108975}\n" }, { "commit": "a26c375789bae81af7917472610906448af256f9", "tree": "90c45ac6861072b2e2f8151aa8cd0c0f1327a6c6", "parents": [ "ac72e04814eb0640638476dce461372769f1e348" ], "author": { "name": "Hannes Payer", "email": "hpayer@chromium.org", "time": "Fri Jul 31 10:22:03 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Jul 31 10:59:35 2026" }, "message": "[heap] Remove obsolete Tagging test from cctest\n\nRemoves TEST(Tagging) from test-heap.cc (cctest). The test was originally\nadded in 2008 to test V8\u0027s tagging scheme for Smi and Failure objects.\nWith Failure objects removed from V8 years ago, all meaningful heap and\ntagging checks were deleted, leaving only an alignment check and three\ntrivial IsSmi checks that do not require an Isolate or VM initialization\nand are already comprehensively covered by api/smi-tagging-unittest.cc.\n\nBUG\u003dnone\nTAG\u003dagy\n\nChange-Id: Iee2ff3d484bc564db91dd9921a4b932e5ef17d3e\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8158089\nReviewed-by: Michael Lippautz \u003cmlippautz@chromium.org\u003e\nCommit-Queue: Hannes Payer \u003chpayer@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108974}\n" }, { "commit": "ac72e04814eb0640638476dce461372769f1e348", "tree": "2bb9ae4e97a6386610cb686a0d0ae344b967abe0", "parents": [ "e9df6a25d616e1091b7dbaba6eb4b0ed18df748c" ], "author": { "name": "Hannes Payer", "email": "hpayer@chromium.org", "time": "Fri Jul 31 10:20:10 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Jul 31 10:52:32 2026" }, "message": "[heap] Move GlobalHandles test from cctest to unittests\n\nMigrates TEST(GlobalHandles) from test-heap.cc (cctest) to\nglobal-handles-unittest.cc (unittests), adding a new unit test\nStrongGlobalHandles.\n\nThis preserves direct coverage of internal GlobalHandles::Create,\nmultiple aliased strong global handles surviving a Minor GC (Scavenge),\nand explicit GlobalHandles::Destroy(location).\n\nBUG\u003dnone\nTAG\u003dagy\n\nChange-Id: Ieb38395dbb968a761ca49a661eed26c1dbe3c98a\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8171745\nReviewed-by: Michael Lippautz \u003cmlippautz@chromium.org\u003e\nCommit-Queue: Hannes Payer \u003chpayer@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108973}\n" }, { "commit": "e9df6a25d616e1091b7dbaba6eb4b0ed18df748c", "tree": "f0e29372db43e37198a7873da5de2104a71c3d4e", "parents": [ "a7cc642bb667fdb0ecaecad282a5dd1dee0233a9" ], "author": { "name": "Hannes Payer", "email": "hpayer@chromium.org", "time": "Wed Jul 29 14:21:41 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Jul 31 09:18:26 2026" }, "message": "[heap] Remove obsolete LocalHandles test from cctest\n\nRemoves TEST(LocalHandles) from test-heap.cc (cctest).\nAdded around 2008, the test was a 3-line smoke test verifying that\nallocating a String inside a standard v8::HandleScope works and can be\ndereferenced. In modern V8, \u0027LocalHandles\u0027 refers to thread-local\nhandles used by background threads, and the test\u0027s basic handle and\nstring creation are already comprehensively exercised across modern\nunittests like local-handles-unittest.cc and\ndirect-handles-unittest.cc.\n\nBUG\u003dnone\nTAG\u003dagy\nCONV\u003d948899c3-c18e-49c1-b7dd-8d70d556391e\n\nChange-Id: Idf45155b970655a70b12ef23cf84165f63175bf8\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8167020\nCommit-Queue: Hannes Payer \u003chpayer@chromium.org\u003e\nReviewed-by: Michael Lippautz \u003cmlippautz@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108972}\n" }, { "commit": "a7cc642bb667fdb0ecaecad282a5dd1dee0233a9", "tree": "c15330e362f897226f820985bd85c382e82be973", "parents": [ "29c913b8cb3790eb5c08e3cd8d7374648ebc13f3" ], "author": { "name": "Hannes Payer", "email": "hpayer@chromium.org", "time": "Wed Jul 29 13:40:00 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Jul 31 09:17:18 2026" }, "message": "[heap] Remove obsolete GarbageCollection test from cctest\n\nRemoves TEST(GarbageCollection) from test-heap.cc (cctest).\nThe test was originally added in 2008 as a basic smoke test checking\nthat properties on the global object survive a Minor GC (Scavenge).\nHalf of the test created an unrooted object without any assertion, and\nthe fundamental invariant that global object properties survive Minor\nGC is overwhelmingly covered across thousands of mjsunit tests and\nmodern unittests in heap-unittest.cc.\n\nBUG\u003dnone\nTAG\u003dagy\n\nChange-Id: Ia9b3e739714262aae2135aa0c607fdb84e5bcd5d\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8159450\nReviewed-by: Michael Lippautz \u003cmlippautz@chromium.org\u003e\nCommit-Queue: Hannes Payer \u003chpayer@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108971}\n" }, { "commit": "29c913b8cb3790eb5c08e3cd8d7374648ebc13f3", "tree": "17af76859513e1ef4c01273c8f9c86d7fa7b7b8e", "parents": [ "5cf5f3dd300246c1d7912e584ce0817ec83c4a3d" ], "author": { "name": "Hannes Payer", "email": "hpayer@chromium.org", "time": "Wed Jul 29 12:48:44 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Jul 31 09:16:10 2026" }, "message": "[heap] Move FindCodeForInnerPointer test from cctest to unittests\n\nMigrates the code inner-pointer resolution test\n(CheckGcSafeFindCodeForInnerPointer) from test-heap.cc (cctest) to\nheap-unittest.cc (unittests).\n\nDeletes the remainder of TEST(HeapObjects) and its unused helper\nfunctions (CheckOddball, CheckSmi, CheckNumber) from test-heap.cc,\nas those were redundant checks of basic Factory number/string creation\nand oddball ToString semantics already covered across existing unittests.\n\nBUG\u003dnone\nTAG\u003dagy\n\nChange-Id: I755adc7dbd90631a41edc700219c75f6351d0d74\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8158751\nReviewed-by: Michael Lippautz \u003cmlippautz@chromium.org\u003e\nCommit-Queue: Hannes Payer \u003chpayer@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108970}\n" }, { "commit": "5cf5f3dd300246c1d7912e584ce0817ec83c4a3d", "tree": "ef0b8cd0d584d569505648f6007ba587612a339f", "parents": [ "fcb07721e7332fcc841a97835273b50902770af8" ], "author": { "name": "Pan, Tao", "email": "tao.pan@intel.com", "time": "Fri Jul 24 08:01:30 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Jul 31 08:24:22 2026" }, "message": "[tiering] Don\u0027t reset to unoptimized code when a TurboFan job is aborted\n\nIn the abort path of FinalizeTurbofanCompilationJob (job state kFailed),\nthe function\u0027s code was being reset to the shared function info\u0027s code via\nUpdateCode(). For a non-OSR function that had already tiered up to Maglev,\nthis incorrectly demoted it back to unoptimized bytecode whenever a\nconcurrent TurboFan job failed or was aborted.\n\nChange-Id: I66158125a05be88dc3b77b875b0e963cf548006e\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7796316\nCommit-Queue: Pan, Tao \u003ctao.pan@intel.com\u003e\nReviewed-by: Olivier Flückiger \u003colivf@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108969}\n" }, { "commit": "fcb07721e7332fcc841a97835273b50902770af8", "tree": "aadb7ca7639cd3c0692028593ec5f376d77c9682", "parents": [ "89e5e1202cc419a33abca4eb8988ce58b442d445" ], "author": { "name": "Jakob Linke", "email": "jgruber@chromium.org", "time": "Fri Jul 31 07:28:30 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Jul 31 08:08:21 2026" }, "message": "[turboshaft] Fix localeCompare inline reading past an externalized\n\n.. string\n\nThe inlined localeCompare fast path skipped its SeqOneByteString check\nwhen an operand was an internalized string constant. The reasoning was\nthat internalized strings are never thinned. True, but not enough: an\ninternalized string can still be externalized in place. The map changes,\nthe object shrinks to 20 bytes, and String::length keeps its old value.\nCode compiled earlier does not know, and keeps reading characters out of\nthe object body. A 32-character constant read up to 24 bytes past the\nend.\n\nSo always check at runtime. There is no shape we can trust to hold,\nbecause the check exists precisely to catch the shape changing.\n\nDoing that naively would cost what the skip was buying, so check the map\npointer instead of loading the instance type out of the map. Under\nstatic roots the SeqOneByteString maps are a contiguous range, so this\nis a range compare plus one encoding-bit test, with no dependent load.\n\nThe set has three maps: sequential, internalized and shared one-byte.\nAccepting all three matters. A constant that is later internalized or\nshared in place lands on a sibling map with the same layout, and the\ninline can still read it. Comparing against a single map would bail\nthere, and since no deopt happens the code would keep bailing forever.\n\nWe still skip the whole inline for a constant whose map is outside the\nset, which no transition can enter.\n\nFixed: 537604528\nChange-Id: I0f7d2ea7b5b1e79854d9849f125f2a250103a2d2\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8159982\nCommit-Queue: Jakob Linke \u003cjgruber@chromium.org\u003e\nReviewed-by: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nAuto-Submit: Jakob Linke \u003cjgruber@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108968}\n" }, { "commit": "89e5e1202cc419a33abca4eb8988ce58b442d445", "tree": "e4bcfebbc16a56c4fd011d0b1ce1d079a007148d", "parents": [ "b78701acb2e27054da979a686c224164937c74e6" ], "author": { "name": "Darius Mercadier", "email": "dmercadier@chromium.org", "time": "Fri Jul 31 07:19:14 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Jul 31 08:00:12 2026" }, "message": "[maglev] Add diagnostic CHECKs in PreparePhiTaggings\n\nAdd 4 release-build diagnostic CHECKs in PreparePhiTaggings before\nlooking up a predecessor\u0027s snapshot in snapshots_.\nWhen an in-the-wild crash occurs during phi untagging, the line\nnumber in the stack trace will disambiguate which CFG or liveness\ninvariant was broken.\n\nTAG\u003dagy\nCONV\u003d6f3c4d85-d9f5-46ea-af2b-9f1eb3e67c53\n\nBug: 524725997\nChange-Id: I7b55517e58d3062c320a3725d0ee033cb9d8866f\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8175045\nCommit-Queue: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nAuto-Submit: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nReviewed-by: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108967}\n" }, { "commit": "b78701acb2e27054da979a686c224164937c74e6", "tree": "ef96b9ef9b46be0400e3166d64f51d2bc4577e1c", "parents": [ "d405ed7c7b8141bb435ed5cf651163fa32e0d11a" ], "author": { "name": "v8-ci-autoroll-builder", "email": "v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com", "time": "Fri Jul 31 04:04:13 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Fri Jul 31 04:48:11 2026" }, "message": "Update V8 DEPS (trusted)\n\nRolling build: https://chromium.googlesource.com/chromium/src/build/+log/bc30139..8cfa312\n\nRolling buildtools/linux64: git_revision:4c57ddcb664d8e432c4edbd864017e1d1cee709d..git_revision:4a060c55dcc5380837a8684949b74400e929b85e\n\nRolling buildtools/mac: git_revision:4c57ddcb664d8e432c4edbd864017e1d1cee709d..git_revision:4a060c55dcc5380837a8684949b74400e929b85e\n\nRolling buildtools/win: git_revision:4c57ddcb664d8e432c4edbd864017e1d1cee709d..git_revision:4a060c55dcc5380837a8684949b74400e929b85e\n\nRolling third_party/catapult: https://chromium.googlesource.com/catapult/+log/1653a52..b3849c5\n\nRolling third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/9f75599..e051c66\n\nRolling third_party/fuchsia-sdk/sdk: version:32.20260723.5.1..version:33.20260730.5.1\n\nRolling third_party/partition_alloc: https://chromium.googlesource.com/chromium/src/base/allocator/partition_allocator/+log/d7aeed1..ad56996\n\nRolling third_party/rust: https://chromium.googlesource.com/chromium/src/third_party/rust/+log/4262744..a7261f5\n\nRoll created at https://cr-buildbucket.appspot.com/build/8674792297936684849\n\nChange-Id: I55ee92ecd21bbf2e38e6e8f08b41237c2d057f3f\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8180421\nCommit-Queue: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com \u003cv8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com\u003e\nBot-Commit: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com \u003cv8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com\u003e\nCr-Commit-Position: refs/heads/main@{#108966}\n" }, { "commit": "d405ed7c7b8141bb435ed5cf651163fa32e0d11a", "tree": "0c09455896773b45f5e0aff5b5486a58a7c70f44", "parents": [ "f4a59ca0ef1286ac4eccda99a90fccf1aea1ac93" ], "author": { "name": "Paolo Severini", "email": "paolosev@microsoft.com", "time": "Tue Jul 28 18:47:44 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 19:11:28 2026" }, "message": "[wasm interpreter] Key WasmInterpreterThreadMap by (thread, isolate)\n\nWasmInterpreterThreadMap is process-global and keyed only by OS\nThreadId. On a cache hit, GetCurrentInterpreterThread(isolate) ignored\nts isolate argument and returned the cached WasmInterpreterThread as-is.\nThat is wrong when a single OS thread runs wasm for more than one\nisolate over time (the v8::Locker / Isolate::Scope multiplexing pattern\nthat Node-style embedders use): the second isolate reuses the first\nisolate\u0027s cached isolate_, reference_stack_ (a GlobalHandle in the\nfirst isolate\u0027s heap) and out-of-sandbox 32 MB stack_mem_, leading to\nmany issues.\n\nKey the map by std::pair\u003cint, Isolate*\u003e so each (thread, isolate) pair\ngets its own WasmInterpreterThread.\n\nAdd a WasmInterpreterThreadMapTest.PerIsolateThread unittest that\nverifies distinct threads per isolate, cache-hit stability, and that\ndisposing one isolate does not evict another\u0027s entry.\n\nBug: 530659181\nChange-Id: If8241f0e159fb206f017ce39cef6dc31eb84cfc5\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8164665\nReviewed-by: Daniel Lehmann \u003cdlehmann@chromium.org\u003e\nCommit-Queue: Paolo Severini \u003cpaolosev@microsoft.com\u003e\nCr-Commit-Position: refs/heads/main@{#108965}\n" }, { "commit": "f4a59ca0ef1286ac4eccda99a90fccf1aea1ac93", "tree": "5682f5c5938ba1c64af528d5117d6fb6f267dbde", "parents": [ "f52d2b16cd7d7f4efaff140a5a42bdf86efe82a1" ], "author": { "name": "v8-ci-autoroll-builder", "email": "v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 16:02:02 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 16:41:15 2026" }, "message": "Update V8 DEPS (trusted)\n\nRolling build: https://chromium.googlesource.com/chromium/src/build/+log/dce8345..bc30139\n\nRolling buildtools/linux64: git_revision:2998394993e31023c4a476c2344eab0e5fe00ef6..git_revision:4c57ddcb664d8e432c4edbd864017e1d1cee709d\n\nRolling buildtools/mac: git_revision:2998394993e31023c4a476c2344eab0e5fe00ef6..git_revision:4c57ddcb664d8e432c4edbd864017e1d1cee709d\n\nRolling buildtools/win: git_revision:2998394993e31023c4a476c2344eab0e5fe00ef6..git_revision:4c57ddcb664d8e432c4edbd864017e1d1cee709d\n\nRolling third_party/catapult: https://chromium.googlesource.com/catapult/+log/12c9a9a..1653a52\n\nRolling third_party/llvm-libc/src: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc/+log/9be848f..1234eac\n\nRolling third_party/partition_alloc: https://chromium.googlesource.com/chromium/src/base/allocator/partition_allocator/+log/f5fbe01..d7aeed1\n\nRolling third_party/perfetto: https://chromium.googlesource.com/external/github.com/google/perfetto/+log/1ba518a..63a118d\n\nRoll created at https://cr-buildbucket.appspot.com/build/8674837599788970209\n\nChange-Id: I61042b234982164415a6d66b70c72b1a183c330c\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8178164\nCommit-Queue: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com \u003cv8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com\u003e\nBot-Commit: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com \u003cv8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com\u003e\nCr-Commit-Position: refs/heads/main@{#108964}\n" }, { "commit": "f52d2b16cd7d7f4efaff140a5a42bdf86efe82a1", "tree": "c79c0da44caa557ad4ab685a8e7b179fb253d7fe", "parents": [ "ade6975ecaadbc3320467fb7d82e01c46946aade" ], "author": { "name": "Olivier Flückiger", "email": "olivf@chromium.org", "time": "Thu Jul 30 13:41:49 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 15:02:42 2026" }, "message": "[maglev][fuzzer] Fuzz --maglev-disable-builtin-reducers\n\nEnable --maglev-disable-builtin-reducers in clusterfuzz trial config,\nfoozzie, and ochang (num_fuzzer).\n\nTAG\u003dagy\nCONV\u003dc2f10d53-34b0-4a1f-b060-5a304e4e4fc6\n\nChange-Id: Ic7746d9ede64981113dbdf8021ac277ee4f8c7fd\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8174865\nCommit-Queue: Olivier Flückiger \u003colivf@chromium.org\u003e\nReviewed-by: Matthias Liedtke \u003cmliedtke@chromium.org\u003e\nAuto-Submit: Olivier Flückiger \u003colivf@chromium.org\u003e\nCommit-Queue: Matthias Liedtke \u003cmliedtke@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108963}\n" }, { "commit": "ade6975ecaadbc3320467fb7d82e01c46946aade", "tree": "fa82a65d019b5ee92d2cc176cabc59066c36edd5", "parents": [ "64b7406cb61f129399a9c3c81ef3b4b8a96e1066" ], "author": { "name": "Riya Amemiya", "email": "riyaamemiya@gmail.com", "time": "Thu Jul 30 12:39:08 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 13:38:27 2026" }, "message": "[array] Use atomic stores for Smi Array.prototype.fill during marking\n\nThe Smi bulk path used non-atomic MemsetTagged over live FixedArray\nslots, which races with concurrent marking\u0027s atomic loads of those\nslots under TSAN. While incremental marking is active, fill with\nRelaxed_MemsetTagged to match FixedArray::set; otherwise keep\nMemsetTagged so the non-marking hot path stays fast.\n\nBug: 540352782\nChange-Id: Ic03ca386381b93328f6835c42ab1250171a71953\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8171903\nReviewed-by: Olivier Flückiger \u003colivf@chromium.org\u003e\nCommit-Queue: Olivier Flückiger \u003colivf@chromium.org\u003e\nReviewed-by: Omer Katz \u003comerkatz@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108962}\n" }, { "commit": "64b7406cb61f129399a9c3c81ef3b4b8a96e1066", "tree": "833c215ee1dff73f8c9d92197f6c7db977f11ab7", "parents": [ "d445677d6ba28453e4160504d1e6dba2f201b8f2" ], "author": { "name": "Olivier Flückiger", "email": "olivf@chromium.org", "time": "Thu Jul 30 12:35:54 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 13:26:22 2026" }, "message": "[maglev] Add testing flag to disable eager builtin reducers in Maglev\n\nAdd --maglev-disable-builtin-reducers (default false), which can be\nenabled to bypass Maglev builtin reduction during eager graph construction\nwhile allowing post-inlining reduction in MaglevGraphOptimizer.\n\nWhen enabled:\n- Eager reducer methods in MaglevGraphBuilder are skipped.\n- CallKnownBuiltin marker nodes are still emitted for reducible builtins,\n allowing post-inlining builtin reduction in MaglevGraphOptimizer.\n\nTAG\u003dagy\nCONV\u003d200765ff-65fd-419d-a478-a2c2fcb517da\n\nChange-Id: If4c773cbc602d72a32629d6480b93fe89d156e18\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8175603\nCommit-Queue: Olivier Flückiger \u003colivf@chromium.org\u003e\nAuto-Submit: Olivier Flückiger \u003colivf@chromium.org\u003e\nReviewed-by: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108961}\n" }, { "commit": "d445677d6ba28453e4160504d1e6dba2f201b8f2", "tree": "883c3892ecb25117a49a13c3cd1e0aff7bfc4d25", "parents": [ "867fc2bbf6f79e8f932ffaab4efe168b49f958f9" ], "author": { "name": "Caio Lima", "email": "caiolima@igalia.com", "time": "Thu Jul 09 16:14:14 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 12:41:21 2026" }, "message": "Reland \"[defer-import-eval] Consider the whole SCC when checking sync readiness\"\n\nThis is a reland of commit 34dc83ecd63abcbc8f4ebfab536c52d2ee55ed19\n\nOriginal change\u0027s description:\n\u003e [defer-import-eval] Consider the whole SCC when checking sync readiness\n\u003e\n\u003e Touching a deferred namespace forces synchronous evaluation of the\n\u003e deferred module. To decide whether that is allowed,\n\u003e `ReadyForSyncExecution` and `GatherAsynchronousTransitiveDependencies`\n\u003e only inspected the status of each individual module. However, in a\n\u003e cycle containing top-level await, a module can already be kEvaluated\n\u003e while its cycle root is still kEvaluatingAsync. Both functions would\n\u003e then wrongly treat the dependency graph as settled: the deferred\n\u003e module was evaluated synchronously while its dependency\u0027s cycle was\n\u003e still waiting to finish, producing a pending (instead of fulfilled)\n\u003e evaluation promise and failing a check in\n\u003e JSDeferredModuleNamespace::EvaluateModuleSync.\n\u003e\n\u003e In this change we introduce `IsModuleSCCEvaluated`, which considers a\n\u003e module settled only when its cycle root reached kEvaluated (or\n\u003e kErrored), and use it in `ReadyForSyncExecution` and\n\u003e `GatherAsynchronousTransitiveDependencies`. Synchronous evaluation of\n\u003e the deferred module now only proceeds once the whole strongly-connected\n\u003e component has settled.\n\u003e\n\u003e This is the engine counterpart of the spec issue\n\u003e https://github.com/tc39/proposal-defer-import-eval/issues/84\n\u003e (assertion failure on EvaluateModuleSync), which is still open and\n\u003e will be discussed in the July 2026 plenary.\n\u003e\n\u003e The regression test asserts the module evaluation order: the async\n\u003e cycle {A, B} must fully settle before nsD.z triggers the deferred\n\u003e evaluation of D.\n\u003e\n\u003e In addition to that, this change includes the fix for the bug [1] by\n\u003e removing the early return on `GatherAsynchronousTransitiveDependencies`\n\u003e when `module.[[Status]]` is `kEvaluatingAsync`.\n\u003e\n\u003e [1] - https://issues.chromium.org/issues/530457806\n\u003e\n\u003e Fixed: 525234471\n\u003e Bug: 530457806\n\u003e Change-Id: Icabca55863160980366bda08553d189db863c915\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8039264\n\u003e Reviewed-by: Marja Hölttä \u003cmarja@chromium.org\u003e\n\u003e Reviewed-by: Olivier Flückiger \u003colivf@chromium.org\u003e\n\u003e Commit-Queue: Marja Hölttä \u003cmarja@chromium.org\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#108828}\n\nBug: 530457806\nChange-Id: I1d9e8756809942b5e5b65001d42d43cd57c3bec4\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8175723\nReviewed-by: Olivier Flückiger \u003colivf@chromium.org\u003e\nReviewed-by: Marja Hölttä \u003cmarja@chromium.org\u003e\nCommit-Queue: Caio Lima \u003ccaiolima@igalia.com\u003e\nCr-Commit-Position: refs/heads/main@{#108960}\n" }, { "commit": "867fc2bbf6f79e8f932ffaab4efe168b49f958f9", "tree": "0f187ebb49b486095b1f46a468b78da6af3fd2ce", "parents": [ "28f2a2a080943d4494b8d84cfd706f757181a3a1" ], "author": { "name": "Olivier Flückiger", "email": "olivf@chromium.org", "time": "Thu Jul 30 09:58:37 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 12:19:57 2026" }, "message": "[maglev][turbolev] Fix node adding with pending spliceand subgraphs\n\nIn AddInitializedNodeToGraph when active_subgraph_ !\u003d nullptr\n(currently building inside an active Subgraph), nodes should still\nbe added to current_block() of the active subgraph.\n\nOnly when active_subgraph_ \u003d\u003d nullptr (in the outer reducer after a\nsubgraph has finished) are newly emitted nodes routed to\npending_splice().exit-\u003enodes().\n\nFixed: 540521147\n\nTAG\u003dagy\nCONV\u003dcaa173d8-d90f-457a-ba3c-57eeefbf56e7\n\nChange-Id: Ife51b0fd2a25a44aa5b9d9649f46092fb07e39bd\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8174903\nCommit-Queue: Olivier Flückiger \u003colivf@chromium.org\u003e\nReviewed-by: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCommit-Queue: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nAuto-Submit: Olivier Flückiger \u003colivf@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108959}\n" }, { "commit": "28f2a2a080943d4494b8d84cfd706f757181a3a1", "tree": "9f8b300476fc7166218ea3d46bda089f236aab63", "parents": [ "34c9403ae49beed4c324d50d974ff6d8af7b983b" ], "author": { "name": "Darius Mercadier", "email": "dmercadier@chromium.org", "time": "Thu Jul 30 11:05:32 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 12:12:46 2026" }, "message": "[turbolev] Skip unreachable blocks during phi untagging\n\nThis was already fixed in Maglev ~1 month ago\n(https://crrev.com/c/7922431), but I forgot about Turbolev then.\n\nThis bug requires impossible situations to reach phi untagging (which\nare detected by phi untagging, which then inserts unconditional deopts\nand render some blocks unreachable), which is hard to create in\nTurbolev: in Maglev it\u0027s easy to make this happen with loops, but in\nTurbolev the non-eager MaglevGraphOptimizer will be able to detect\nmost (but not all) of these situations and prune dead blocks before\nPhi untagging is even reached.\n\nFixed: 533979617\nBug: 524725997\nChange-Id: If47a80bd33208b9549b32689b0d4ef0d57be2ab4\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8173724\nCommit-Queue: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nReviewed-by: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nAuto-Submit: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108958}\n" }, { "commit": "34c9403ae49beed4c324d50d974ff6d8af7b983b", "tree": "49804b0a03b1e3f51d61fd499136edccb0a2d116", "parents": [ "78921f9ba0d61cc2a0cb419cbcd693443e05404e" ], "author": { "name": "Victor Gomes", "email": "victorgomes@chromium.org", "time": "Thu Jul 30 10:37:21 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 12:09:48 2026" }, "message": "[maglev] Process CheckInt32IsSmi in KNA processor\n\nChange-Id: I4a85eb9ebd897f6167458f0cb976fc7acd25fa00\nBug: 424157317\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8173344\nReviewed-by: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nCommit-Queue: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108957}\n" }, { "commit": "78921f9ba0d61cc2a0cb419cbcd693443e05404e", "tree": "95a1254f81a0176a853c84431bca76d3c89bbd53", "parents": [ "d1761037274ddbd89f756c1a0e0b23c76cd5c05f" ], "author": { "name": "Victor Gomes", "email": "victorgomes@chromium.org", "time": "Thu Jul 30 09:52:21 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 11:33:13 2026" }, "message": "[maglev] Add CloneFastJSArray info\n\nChange-Id: Id37d1bc854d510cea8e301c46d0b04d7958697e4\nBug: 424157317\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8174485\nReviewed-by: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nAuto-Submit: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCommit-Queue: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108956}\n" }, { "commit": "d1761037274ddbd89f756c1a0e0b23c76cd5c05f", "tree": "088fa30bafad606df900c86459313f9dd6cfafa6", "parents": [ "443267f7ac4a4906be50f29115db625043fbae1a" ], "author": { "name": "Darius Mercadier", "email": "dmercadier@chromium.org", "time": "Thu Jul 30 10:00:15 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 10:58:27 2026" }, "message": "[compiler] Fix Turbolev escape analysis crash on single-block loops\n\nIn single basic-block loops where a candidate virtual object property is\nmutated, loop phis are registered in new_phis()[loop_header]. When the\nloop header is revisited, existing phis in old_phis_ are reused and\nre-registered into new_phis()[loop_header]. Because single-block loops\nhave no intervening basic blocks between PreProcessBasicBlock and\nPostProcessBasicBlock, old_phis_ is never cleared after phi reuse.\n\nWhen PostProcessBasicBlock executes, swapping old_phis_ into\n*prev_header_phis-\u003esecond swapped the non-empty old_phis_ back into\n*prev_header_phis-\u003esecond, violating the empty check.\n\nThis change moves *prev_header_phis-\u003esecond into old_phis_ and explicitly\nclears *prev_header_phis-\u003esecond, ensuring old_phis_ cleanly receives the\ncurrent iteration phis and *prev_header_phis-\u003esecond is left empty.\n\nCONV\u003d18027655-28fd-4e2d-8ebe-6ba9a3add43b\nTAG\u003dagy\n\nBug: 540324228\nChange-Id: I7a4108b85b553f2bf3c79078899dea910b38235a\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8174804\nReviewed-by: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nAuto-Submit: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nCommit-Queue: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108955}\n" }, { "commit": "443267f7ac4a4906be50f29115db625043fbae1a", "tree": "1d1ae1270bb559b277d2a903daeb80aff5cc28a2", "parents": [ "2a21c756031083b4abcd0e3077790d485e270e14" ], "author": { "name": "Jakob Linke", "email": "jgruber@chromium.org", "time": "Tue Jul 28 08:11:10 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 10:48:08 2026" }, "message": "[builtins] Fix OOB reads on string transition in toLowerCase and split\n\nBoth builtins unpack the subject, allocate, and then read the source\nthrough state captured before the allocation. With --shared-string-table\nthe source can be shared, in which case internalization defers the\ntransition to a GC, and that GC can run during the allocation:\nTransitionStrings thins the source, or swaps in an external resource, or\nfrees the resource of an external string internalized to a non-external\ncopy. Reading afterwards gives characters from an unrelated object, or\nfreed memory.\n\nThis is not a regression: StringToArray has taken its data pointer after\nthe allocation since 590a71551b2 (2018), which hoisted it there to fix a\nstale-pointer crash back when moving GC was the only hazard. Deferred\nstring transitions arrived in 2022 and invalidated that invariant, so\nthe ordering that was the fix is now the bug. Same story as the recent\ncluster in 692245fd4b3, 73524bc9d66, f52801f93d7 and c2bde2bd9d0.\n\nAdd ToDirectStringAssembler::BailIfTransitioned, which re-checks the\ndirect string\u0027s map against the one captured at TryToDirect, and use it\nat both sites.\n\njkummerow\u0027s 2018 TODO for a CSA DisallowGarbageCollection would turn\nthis whole class into a compile error.\n\nFixed: 533661183\nChange-Id: I9d7734cae3c3e0e00ff28ce1b3985fbbe257e20d\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8147019\nCommit-Queue: Leszek Swirski \u003cleszeks@chromium.org\u003e\nAuto-Submit: Jakob Linke \u003cjgruber@chromium.org\u003e\nReviewed-by: Leszek Swirski \u003cleszeks@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108954}\n" }, { "commit": "2a21c756031083b4abcd0e3077790d485e270e14", "tree": "b36d7fa36207a4bc5f9b94cd0e1f6c83cdbccc42", "parents": [ "b2cd34c02406ea7351bee3ea493e164e02cef64a" ], "author": { "name": "Leszek Swirski", "email": "leszeks@chromium.org", "time": "Wed Jul 29 15:43:31 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 10:14:52 2026" }, "message": "[parser] Use creation-time scope in VariableDeclarationParsingScope\n\nWhen parsing variable declarations that have destructuring, inner expressions within destructuring patterns can push child scopes (such as ClassScope) onto parser()-\u003escope(), e.g. `let [class x{...x}]`\n\nIf VariableDeclarationParsingScope::Declare uses parser()-\u003escope()\ndynamically at declaration time, variables from the outer binding\npattern are declared in the inner ClassScope instead of the outer scope\nwhere the VariableDeclarationParsingScope was created. This causes scope\npollution and name collision DCHECK failures when ClassScope later\ndeclares its internal class binding.\n\nThis CL fixes the issue by capturing scope_ \u003d parser-\u003escope() at\nconstruction time in VariableDeclarationParsingScope and passing scope_\nto DeclareVariable.\n\nTAG\u003dagy\nCONV\u003da1d36d0b-e7d9-488d-9a5b-3e7b1a1e5870\n\nFixed: 526380803\nChange-Id: Iedeb8d7f2fdb770b86afe84a058bb91ced246f16\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8167021\nAuto-Submit: Leszek Swirski \u003cleszeks@chromium.org\u003e\nCommit-Queue: Leszek Swirski \u003cleszeks@chromium.org\u003e\nReviewed-by: Olivier Flückiger \u003colivf@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108953}\n" }, { "commit": "b2cd34c02406ea7351bee3ea493e164e02cef64a", "tree": "32e65d42eed5ac8a70cae380509ca5970a4485f7", "parents": [ "c435df1a8c40a57bc4e3d6781f02cac68ee120aa" ], "author": { "name": "Jesse Wright", "email": "jmwright.045@gmail.com", "time": "Sun Jul 05 00:22:43 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 09:33:55 2026" }, "message": "[runtime] Fast-path Array.prototype.indexOf on dictionary elements\n\nArray.prototype.indexOf on a dictionary-elements receiver probes every\nindex in [fromIndex, length) via NumberDictionary::FindEntry, so it is\nO(length) even when the backing store holds only a handful of entries.\nThe built-in includes already avoids this: IncludesValueFastPath\niterates the dictionary\u0027s entries directly (O(entries)). indexOf had no\nequivalent, so e.g. a.indexOf(x) on a 3-entry array of length 1e6 costs\n~3.5ms per call.\n\nAdd DictionaryElementsAccessor::IndexOfValueFastPath, mirroring the\nincludes fast path. It iterates the NumberDictionary entries under a\nDisallowGarbageCollection scope, skips holes and out-of-range keys, and\ntracks the smallest in-range index whose value StrictEquals the search\nterm -- which is exactly indexOf\u0027s result, since indexOf skips holes\n(HasProperty gates the Get) and returns the lowest matching index. If a\ntraversed entry is an accessor the fast path bails to the existing slow\nloop, so getters are never observed out of order.\n\nSemantics are unchanged; only dictionary-elements receivers with no\naccessor elements take the new path. Measured on x64 (V8 15.2), a\n3-entry dictionary array of length 1e6:\n\n indexOf miss ~3.5ms -\u003e 50.1ns (~70000x)\n indexOf hit @1e6 ~3.5ms -\u003e 51.5ns\n indexOf hit @1000 3237.8ns -\u003e 48.8ns\n includes (control) 28.7ns -\u003e 28.4ns (unchanged)\n\nPacked fast-array indexOf is unchanged (within run-to-run noise). A new\nmjsunit test pins down smallest-index-wins, fromIndex, hole-skipping and\nthe accessor bail-out; the array-indexof, array-includes and es6 array\nsuites still pass (65/65).\n\nR\u003dishell@chromium.org, jkummerow@chromium.org\n\nCo-Authored-By: Claude Fable 5 \u003cnoreply@anthropic.com\u003e\nBug: none\nChange-Id: I7d052d7e40c6bc757fc761ded74341bb8f7e78b6\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8040565\nReviewed-by: Marja Hölttä \u003cmarja@chromium.org\u003e\nReviewed-by: Jakob Kummerow \u003cjkummerow@chromium.org\u003e\nCommit-Queue: Marja Hölttä \u003cmarja@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108952}\n" }, { "commit": "c435df1a8c40a57bc4e3d6781f02cac68ee120aa", "tree": "4e3fbf4c5a72d054885ea2d639bc33918eeb561f", "parents": [ "0616192af6309f2121f27ad735485db602c11fa6" ], "author": { "name": "Matthias Liedtke", "email": "mliedtke@chromium.org", "time": "Thu Jul 30 08:48:08 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 08:49:11 2026" }, "message": "Revert \"[sparkplug+] Add ConstantFromStringPrototype handler\"\n\nThis reverts commit b5486e5f94ee824eac1dad50b97e10eaeffb972d.\n\nReason for revert: Suspecting to break the Chromium roll as it\u0027s the\nonly meaningful change in that roll.\n\nFailure Link: https://ci.chromium.org/ui/p/chromium/builders/try/linux-rel/2813862/overview\nRoll: https://crrev.com/c/8172964\n\nOriginal change\u0027s description:\n\u003e [sparkplug+] Add ConstantFromStringPrototype handler\n\u003e\n\u003e Bug: chromium:429351411\n\u003e Change-Id: I4b2e8d2aa28285bab106c06175941fe88d296952\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8129309\n\u003e Reviewed-by: Leszek Swirski \u003cleszeks@chromium.org\u003e\n\u003e Commit-Queue: Xu, Hao A \u003chao.a.xu@intel.com\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#108948}\n\nBug: chromium:429351411\nNo-Presubmit: true\nNo-Tree-Checks: true\nNo-Try: true\nChange-Id: I13bd731c03f7830ac48b0f6d19dc7df2ac39b0af\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8174463\nAuto-Submit: Matthias Liedtke \u003cmliedtke@chromium.org\u003e\nOwners-Override: Matthias Liedtke \u003cmliedtke@chromium.org\u003e\nBot-Commit: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\nCommit-Queue: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\nCr-Commit-Position: refs/heads/main@{#108951}\n" }, { "commit": "0616192af6309f2121f27ad735485db602c11fa6", "tree": "952f1e9046a9f0981b8b2fa5dcd54698224d0ffd", "parents": [ "bdece242c255e323a465e4974e66408b09f99067" ], "author": { "name": "v8-ci-autoroll-builder", "email": "v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 05:04:33 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 06:02:04 2026" }, "message": "Update fuzztest (trusted)\n\nRolling third_party/fuzztest: https://chromium.googlesource.com/chromium/src/third_party/fuzztest/+log/256cb1f..cf07430\n\nRoll FuzzTest from a233d758c21f to 10f5fde7ee51 (2 revisions) (chromium-autoroll@skia-public.iam.gserviceaccount.com)\nhttps://chromium.googlesource.com/chromium/src/third_party/fuzztest/+/cf07430\n\nRolling third_party/fuzztest/src: https://chromium.googlesource.com/external/github.com/google/fuzztest/+log/a233d75..10f5fde\n\nNo public description (Daniel Lowengrub)\nhttps://chromium.googlesource.com/external/github.com/google/fuzztest/+/10f5fde\n\nSupport FUZZTEST_MAX_JOBS environment variable to cap parallel jobs. (Xinhao Yuan)\nhttps://chromium.googlesource.com/external/github.com/google/fuzztest/+/1a08395\n\nRoll created at https://cr-buildbucket.appspot.com/build/8674879123225803873\n\nCq-Include-Trybots: luci.v8.try:v8_linux64_asan_centipede_compile_dbg\nChange-Id: I0cf0eb779863d7ac796169ed69990218ccbb0d57\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8169904\nCommit-Queue: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com \u003cv8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com\u003e\nBot-Commit: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com \u003cv8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com\u003e\nCr-Commit-Position: refs/heads/main@{#108950}\n" }, { "commit": "bdece242c255e323a465e4974e66408b09f99067", "tree": "bf9c426a5b8ee0a17417bb497d7c8c8f18c67fe3", "parents": [ "b5486e5f94ee824eac1dad50b97e10eaeffb972d" ], "author": { "name": "v8-ci-autoroll-builder", "email": "v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 04:04:56 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 05:06:32 2026" }, "message": "Update V8 DEPS (trusted)\n\nRolling build: https://chromium.googlesource.com/chromium/src/build/+log/c0e141d..dce8345\n\nRolling third_party/abseil-cpp: https://chromium.googlesource.com/chromium/src/third_party/abseil-cpp/+log/4f387da..63f52bf\n\nRolling third_party/catapult: https://chromium.googlesource.com/catapult/+log/df28aef..12c9a9a\n\nRolling third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/9391999..9f75599\n\nRolling third_party/partition_alloc: https://chromium.googlesource.com/chromium/src/base/allocator/partition_allocator/+log/6abc77b..f5fbe01\n\nRolling third_party/perfetto: https://chromium.googlesource.com/external/github.com/google/perfetto/+log/3291902..1ba518a\n\nRolling third_party/rust: https://chromium.googlesource.com/chromium/src/third_party/rust/+log/fcc0ed0..4262744\n\nRolling tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/b8094de..93c4673\n\nRoll created at https://cr-buildbucket.appspot.com/build/8674882898173420689\n\nChange-Id: I7a1a2c6b38d579ed5a19b037769324e99faadc3e\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8172743\nBot-Commit: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com \u003cv8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com\u003e\nCommit-Queue: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com \u003cv8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com\u003e\nCr-Commit-Position: refs/heads/main@{#108949}\n" }, { "commit": "b5486e5f94ee824eac1dad50b97e10eaeffb972d", "tree": "eb92eebbb83a18d1869b65336a3982b5d257f6d6", "parents": [ "1354efb8397af5850b1fc2de53a5ea32d4afc74d" ], "author": { "name": "Hao Xu", "email": "hao.a.xu@intel.com", "time": "Wed Jul 29 11:12:06 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Thu Jul 30 02:57:43 2026" }, "message": "[sparkplug+] Add ConstantFromStringPrototype handler\n\nBug: chromium:429351411\nChange-Id: I4b2e8d2aa28285bab106c06175941fe88d296952\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8129309\nReviewed-by: Leszek Swirski \u003cleszeks@chromium.org\u003e\nCommit-Queue: Xu, Hao A \u003chao.a.xu@intel.com\u003e\nCr-Commit-Position: refs/heads/main@{#108948}\n" }, { "commit": "1354efb8397af5850b1fc2de53a5ea32d4afc74d", "tree": "4ca3a9c0e6397e684bddb7896b6444fe9f658eb0", "parents": [ "8062e88db3334f3f6a9cc2e33aaa38242a99049e" ], "author": { "name": "chromium-autoroll@skia-public.iam.gserviceaccount.com", "email": "chromium-autoroll@skia-public.iam.gserviceaccount.com", "time": "Wed Jul 29 21:06:27 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 22:15:08 2026" }, "message": "Roll agents from 559f135fc214 to 78cc65e41fda (1 revision)\n\nhttps://chromium.googlesource.com/chromium/agents.git/+log/559f135fc214..78cc65e41fda\n\nIf this roll has caused a breakage, revert this CL and stop the roller\nusing the controls here:\nhttps://autoroll.skia.org/r/agents-v8\nPlease CC browser-perf-engprod@google.com,faridzad@google.com,maximsheshukov@google.com on the revert to ensure that a human\nis aware of the problem.\n\nTo file a bug in agents: https://b.corp.google.com/issues/new?component\u003d1923111\u0026template\u003d2204026\nTo file a bug in V8: https://b.corp.google.com/issues/new?component\u003d1923111\u0026template\u003d2204026\n\nTo report a problem with the AutoRoller itself, please file a bug:\nhttps://issues.skia.org/issues/new?component\u003d1389291\u0026template\u003d1850622\n\nDocumentation for the AutoRoller is here:\nhttps://skia.googlesource.com/buildbot/+doc/main/autoroll/README.md\n\nBug: None\nTbr: faridzad@google.com,maximsheshukov@google.com\nChange-Id: I4c927ce1b4d379f5154503589f6a00eb2bf28cfa\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8168441\nBot-Commit: chromium-autoroll@skia-public.iam.gserviceaccount.com \u003cchromium-autoroll@skia-public.iam.gserviceaccount.com\u003e\nCommit-Queue: chromium-autoroll@skia-public.iam.gserviceaccount.com \u003cchromium-autoroll@skia-public.iam.gserviceaccount.com\u003e\nCr-Commit-Position: refs/heads/main@{#108947}\n" }, { "commit": "8062e88db3334f3f6a9cc2e33aaa38242a99049e", "tree": "ff3cb6db7c5b7ce26558ebe60fbf778fc28b6b26", "parents": [ "f97650e45f6c64993d9b5a3df82760acd3bc4480" ], "author": { "name": "Rezvan Mahdavi Hezaveh", "email": "rezvan@chromium.org", "time": "Wed Jul 29 20:15:11 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 21:29:05 2026" }, "message": "Revert \"[wasm] Fix nullptr deref in Liftoff debug side table coverage\"\n\nThis reverts commit f97650e45f6c64993d9b5a3df82760acd3bc4480.\n\nReason for revert: Failed on V8 Linux64-PKU bot\n\nFailure Link: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20-%20PKU/17871/overview\n\nOriginal change\u0027s description:\n\u003e [wasm] Fix nullptr deref in Liftoff debug side table coverage\n\u003e\n\u003e GenerateLiftoffDebugSideTable() compiles a frame purely to build the\n\u003e Liftoff debug side table; that code is never executed, so it passes\n\u003e nullptr for coverage_data. With --wasm-code-coverage the LiftoffCompiler\n\u003e constructor then dereferenced the null coverage_data and crashed. Skip\n\u003e emitting coverage instrumentation when coverage_data is null.\n\u003e\n\u003e Bug: 526163463\n\u003e Change-Id: Ibb2840a1e86491a2f06aa5c5407c3c6b2279d1ce\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8123980\n\u003e Reviewed-by: Clemens Backes \u003cclemensb@chromium.org\u003e\n\u003e Reviewed-by: Paolo Severini \u003cpaolosev@microsoft.com\u003e\n\u003e Commit-Queue: Tejas Vasisht \u003ctejasvasisht@microsoft.com\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#108945}\n\nBug: 526163463\nChange-Id: I88c461c7eed15536a75a463bdb305d8e1fd4eaa1\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8168480\nBot-Commit: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\nCommit-Queue: Rezvan Mahdavi Hezaveh \u003crezvan@chromium.org\u003e\nAuto-Submit: Rezvan Mahdavi Hezaveh \u003crezvan@chromium.org\u003e\nOwners-Override: Rezvan Mahdavi Hezaveh \u003crezvan@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108946}\n" }, { "commit": "f97650e45f6c64993d9b5a3df82760acd3bc4480", "tree": "36582a5da4bc0a5a0f98e21ecb98a86905fe55a7", "parents": [ "472802a3cac80de0cc0940fcfcb7c65146c2d58d" ], "author": { "name": "Tejas Vasisht", "email": "tejasvasisht@microsoft.com", "time": "Wed Jul 29 16:01:59 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 19:38:26 2026" }, "message": "[wasm] Fix nullptr deref in Liftoff debug side table coverage\n\nGenerateLiftoffDebugSideTable() compiles a frame purely to build the\nLiftoff debug side table; that code is never executed, so it passes\nnullptr for coverage_data. With --wasm-code-coverage the LiftoffCompiler\nconstructor then dereferenced the null coverage_data and crashed. Skip\nemitting coverage instrumentation when coverage_data is null.\n\nBug: 526163463\nChange-Id: Ibb2840a1e86491a2f06aa5c5407c3c6b2279d1ce\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8123980\nReviewed-by: Clemens Backes \u003cclemensb@chromium.org\u003e\nReviewed-by: Paolo Severini \u003cpaolosev@microsoft.com\u003e\nCommit-Queue: Tejas Vasisht \u003ctejasvasisht@microsoft.com\u003e\nCr-Commit-Position: refs/heads/main@{#108945}\n" }, { "commit": "472802a3cac80de0cc0940fcfcb7c65146c2d58d", "tree": "ff3cb6db7c5b7ce26558ebe60fbf778fc28b6b26", "parents": [ "752405a70a5c8696196c5c29b1349b439eb881fd" ], "author": { "name": "Olivier Flückiger", "email": "olivf@chromium.org", "time": "Wed Jul 29 11:40:47 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 18:21:46 2026" }, "message": "[debug] Allow %OptimizeOsr without %PrepareFunctionForOptimization\n\nSome OSR bugs are legitimately hard or impossible to trigger when we\nrequire the code to be in a function that has a feedback vector from the\nstart. Also, this is not a realistic limitation, since it is quite\nnormal for a function to trigger OSR without having a FBV when it is\nentered.\n\nBug: 539006995\nChange-Id: Icdf2e01fb7a583d6c0c734f0e4f2246590bff022\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8166263\nAuto-Submit: Olivier Flückiger \u003colivf@chromium.org\u003e\nReviewed-by: Marja Hölttä \u003cmarja@chromium.org\u003e\nCommit-Queue: Marja Hölttä \u003cmarja@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108944}\n" }, { "commit": "752405a70a5c8696196c5c29b1349b439eb881fd", "tree": "11d544338b621048d71bbeb5e64083cee52e9428", "parents": [ "661117b008f6951ee3a35a46a09ea01d57f5c9af" ], "author": { "name": "Jihyeon Jeong", "email": "smartphonewithbear@gmail.com", "time": "Tue Jul 28 13:38:37 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 17:41:17 2026" }, "message": "[sandbox] Prevent fixed-arity JSPI code in mismatched JDT entries\n\nWasmResume and WasmReject use fixed cleanup for the receiver and one\nexplicit argument. Record their fixed arity in generated Code metadata\nso JDT entries require matching trusted parameter counts.\n\nThese builtins have fixed code targets, so restore them to kCoreJSLazy\nand remove them from the JS trampoline allowlist.\n\nAdd a sandbox regression that combines genuine WasmResumeData with a\nzero-arity lazy donor entry and verifies that the JDT update is rejected.\n\nFixed: 537948358\nChange-Id: I5c6fc75922169ec400596319b380d43591bde225\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8160861\nReviewed-by: Jakob Kummerow \u003cjkummerow@chromium.org\u003e\nCommit-Queue: Jakob Kummerow \u003cjkummerow@chromium.org\u003e\nReviewed-by: Thibaud Michaud \u003cthibaudm@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108943}\n" }, { "commit": "661117b008f6951ee3a35a46a09ea01d57f5c9af", "tree": "d1f3af384ddda379bb93b14ae091ea502d1e4fc1", "parents": [ "9265f06e7fb33246a536c95d01cd5a3169b782d5" ], "author": { "name": "v8-ci-autoroll-builder", "email": "v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 16:02:25 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 17:07:54 2026" }, "message": "Update V8 DEPS (trusted)\n\nRolling buildtools/linux64: git_revision:fc56c7a0d0917f2b668714408ec22bd05736a9f5..git_revision:2998394993e31023c4a476c2344eab0e5fe00ef6\n\nRolling buildtools/mac: git_revision:fc56c7a0d0917f2b668714408ec22bd05736a9f5..git_revision:2998394993e31023c4a476c2344eab0e5fe00ef6\n\nRolling buildtools/win: git_revision:fc56c7a0d0917f2b668714408ec22bd05736a9f5..git_revision:2998394993e31023c4a476c2344eab0e5fe00ef6\n\nRolling third_party/abseil-cpp: https://chromium.googlesource.com/chromium/src/third_party/abseil-cpp/+log/7a87739..4f387da\n\nRolling third_party/catapult: https://chromium.googlesource.com/catapult/+log/91251ae..df28aef\n\nRolling third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/621cd2a..9391999\n\nRolling third_party/llvm-libc/src: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc/+log/539518b..9be848f\n\nRolling third_party/perfetto: https://chromium.googlesource.com/external/github.com/google/perfetto/+log/a1c97b9..3291902\n\nRolling third_party/rust: https://chromium.googlesource.com/chromium/src/third_party/rust/+log/afbc966..fcc0ed0\n\nRoll created at https://cr-buildbucket.appspot.com/build/8674928196595985105\n\nChange-Id: Ie620df9a116c79c5e42d9634e41a9857183fa12c\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8163653\nBot-Commit: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com \u003cv8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com\u003e\nCommit-Queue: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com \u003cv8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com\u003e\nCr-Commit-Position: refs/heads/main@{#108942}\n" }, { "commit": "9265f06e7fb33246a536c95d01cd5a3169b782d5", "tree": "66fe16ffdad5c22e0decd190ac11a275ef4f3af7", "parents": [ "eeafc895ddeb94f6cc128037d259655c38edbc93" ], "author": { "name": "Darius Mercadier", "email": "dmercadier@chromium.org", "time": "Wed Jul 29 15:09:49 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 16:20:18 2026" }, "message": "[deoptimizer] Make DeoptimizeFunction code parameter non-optional\n\nRemove the default value `\u003d {}` from the `code` parameter of\n`Deoptimizer::DeoptimizeFunction`. This prevents call sites from\naccidentally omitting `frame-\u003eLookupCode()` when deoptimizing from\na stack frame, eliminating the footgun that caused OSR stack\nframes to be missed when stepping in the debugger.\n\nUpdate `Runtime_DeoptimizeFunction`, `Runtime_DeoptimizeNow`, and\n`Runtime_DeoptimizeFunctionOSR` in `src/runtime/runtime-test.cc` to\nexplicitly pass `function-\u003ecode(isolate)`.\n\nTAG\u003dagy\nCONV\u003d28d5fd78-5476-4ae1-ba1e-1a3831bb533c\n\nBug: 531297707\nChange-Id: Ib9e2128016ff30301dd71e795dace6cc29043346\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8167220\nAuto-Submit: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nCommit-Queue: Leszek Swirski \u003cleszeks@chromium.org\u003e\nReviewed-by: Leszek Swirski \u003cleszeks@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108941}\n" }, { "commit": "eeafc895ddeb94f6cc128037d259655c38edbc93", "tree": "810765c3438e6170e2ae9a1f8d9a069d97ef9a0f", "parents": [ "b226a101472c992ef4dea54e5af1b21d03038d95" ], "author": { "name": "Darius Mercadier", "email": "dmercadier@chromium.org", "time": "Tue Jul 28 15:49:04 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 15:36:42 2026" }, "message": "[debug] Deoptimize blackboxed OSR frames when stepping\n\nWhen stepping out (Debug::PrepareStep) or stepping on throw\n(Debug::PrepareStepOnThrow) across a blackboxed stack frame, V8 skips\nFloodWithOneShot for that function. Consequently, the only mechanism\nthat deoptimizes frames during stack unwinding is the explicit\nDeoptimizer::DeoptimizeFunction loop in PrepareStep and\nPrepareStepOnThrow.\n\nWhen DeoptimizeFunction is called without passing the frame\u0027s Code\nobject, it defaults to function-\u003ecode(isolate), which points to the\nfunction\u0027s default entrypoint code rather than any OSR machine code\nattached to the stack frame. As a result, blackboxed OSR frames are\nnever deoptimized, and subsequent calls from their catch or return\nblocks execute in optimized code without checking for step-in\nbreakpoints.\n\nPass frame-\u003eLookupCode() / js_frame-\u003eLookupCode() at both call sites\nso blackboxed OSR frames are correctly deoptimized to bytecode when\nstepping.\n\nTAG\u003dagy\nCONV\u003d978a8699-6f5a-469d-a61e-d8cbf7aa4c0d\n\nBug: 531297707\nChange-Id: I762465fa4492d7fb6715c6c955b22c38f248cfad\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8159283\nReviewed-by: Leszek Swirski \u003cleszeks@chromium.org\u003e\nCommit-Queue: Leszek Swirski \u003cleszeks@chromium.org\u003e\nAuto-Submit: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108940}\n" }, { "commit": "b226a101472c992ef4dea54e5af1b21d03038d95", "tree": "54f039b25e13a7d157169a50464290c5dbc556da", "parents": [ "8b9a7b4da8662608a10861ebf8f79899780d5797" ], "author": { "name": "Victor Gomes", "email": "victorgomes@chromium.org", "time": "Wed Jul 29 14:34:00 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 15:16:38 2026" }, "message": "[compiler][tsan] Suppress the racy constant field read in the broker\n\nThe no-concurrent-marking TSAN config deliberately keeps object field\nwrites non-atomic to expose main thread writes racing with background\ncompilation. This read is racy by design: the snapshot protocol keeps it\nin bounds and OwnConstantDataPropertyDependency revalidates the value on\nthe main thread, so a stale read only discards the compilation.\n\nFixed: 540205825\nChange-Id: I14082777ca4cbcfd18eb9bc9c6eb02f66989ab9e\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8158088\nCommit-Queue: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nReviewed-by: Leszek Swirski \u003cleszeks@chromium.org\u003e\nAuto-Submit: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCommit-Queue: Leszek Swirski \u003cleszeks@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108939}\n" }, { "commit": "8b9a7b4da8662608a10861ebf8f79899780d5797", "tree": "de265c7da336b2535e19946c1a9ad915dd3fccdd", "parents": [ "9066fa1adf1d4ee5746d22d142e1d14364bf0b9e" ], "author": { "name": "Erik Corry", "email": "erikcorry@chromium.org", "time": "Tue Jul 28 11:19:36 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 14:14:52 2026" }, "message": "[build] Fix cluster build and macro hygiene\n\nChange-Id: I696b72699eb327dd096478d8c403c1200c752d74\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8163882\nReviewed-by: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nCommit-Queue: Erik Corry \u003cerikcorry@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108938}\n" }, { "commit": "9066fa1adf1d4ee5746d22d142e1d14364bf0b9e", "tree": "3b204421c57d5658d7bc260be6dfdf2c8d8de1ea", "parents": [ "da1d3cf5cdcf5065d0ced0df867cf0270293e014" ], "author": { "name": "Milad Fa", "email": "mfarazma@ibm.com", "time": "Tue Jul 28 16:26:37 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 14:11:16 2026" }, "message": "S390 [wasm]: Fix wasm/atomics-memory64\n\nTwo separate issues were fixed to pass this test:\n- AddS64 was not correctly handling values bigger than 32 bits.\n- DataViews are used on the test itself to force little-endian\nordering.\n\nIT: 26\nChange-Id: Ia68a4137c632ec996966d0010e78459d274a9e4d\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8161042\nReviewed-by: Clemens Backes \u003cclemensb@chromium.org\u003e\nCommit-Queue: Milad Farazmand \u003cmfarazma@ibm.com\u003e\nCr-Commit-Position: refs/heads/main@{#108937}\n" }, { "commit": "da1d3cf5cdcf5065d0ced0df867cf0270293e014", "tree": "36fe527f492082d542df08b178a4ef5717868910", "parents": [ "ae05d54b7907534a2bc401119bdca03d24551a82" ], "author": { "name": "Andreas Haas", "email": "ahaas@chromium.org", "time": "Wed Jul 29 13:09:07 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 13:51:52 2026" }, "message": "[cleanup] Format BUILD.bazel with the Google formatting rules\n\nChange-Id: I9fa3aab1c3ac02d2072921bc1acd3321780f22fc\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8161872\nCommit-Queue: Andreas Haas \u003cahaas@chromium.org\u003e\nAuto-Submit: Andreas Haas \u003cahaas@chromium.org\u003e\nReviewed-by: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCommit-Queue: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108936}\n" }, { "commit": "ae05d54b7907534a2bc401119bdca03d24551a82", "tree": "854e2f5f0d2fa89acfb76ae8611416e21bacf281", "parents": [ "ef0c186ba5d1cc0a13a8b3e533257b907eab5b5c" ], "author": { "name": "Omer Katz", "email": "omerkatz@chromium.org", "time": "Tue Jul 28 09:00:11 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 12:31:09 2026" }, "message": "Remove Printf and PrintfNoPreserve from Arm64 MacroAssembler\n\nChange-Id: I9234729f19a7d482a1468feb2c4dc851a223fda5\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8163740\nReviewed-by: Leszek Swirski \u003cleszeks@chromium.org\u003e\nCommit-Queue: Omer Katz \u003comerkatz@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108935}\n" }, { "commit": "ef0c186ba5d1cc0a13a8b3e533257b907eab5b5c", "tree": "d8d095c7270c6cdec35a92d2b842bfcc6342ce63", "parents": [ "b80a7539b736c985e0fb9790ec76006f6f1d801f" ], "author": { "name": "Thibaud Michaud", "email": "thibaudm@chromium.org", "time": "Wed Jul 29 11:41:08 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 12:28:31 2026" }, "message": "[wasm] Fix unoptimized frame height for Liftoff deopt\n\nThe wasm_liftoff_frame_size returned by GetConservativeFrameSizeInBytes\nfor kLiftoffFunction frame states did not include parameter stack slots\nand the fixed frame header\n(CommonFrameConstants::kFixedFrameSizeAboveFp).\n\nThis caused CodeGenerator::GetStackCheckOffset() to under-estimate the\nstack space required during deoptimization, leading to stack limit\nassertion failures (CHECK_GT) when functions with many parameters\ndeoptimized near the stack limit.\n\nGetLiftoffFrameSize in turboshaft-graph-interface.cc now computes the\nexact total output frame size for Liftoff frames (including parameter\nstack slots and fixed frame headers) via IterateSignatureImpl.\n\nTAG\u003dagy\n\nBug: 540056465\nChange-Id: I6dbf337e74ea2fc34eca19f6b8a3156c5a8fbb16\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8156370\nCommit-Queue: Thibaud Michaud \u003cthibaudm@chromium.org\u003e\nReviewed-by: Matthias Liedtke \u003cmliedtke@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108934}\n" }, { "commit": "b80a7539b736c985e0fb9790ec76006f6f1d801f", "tree": "02ac1e926275a4773e6c151d35cbfe5444b433f0", "parents": [ "cb0a13d7ff2ec28ac783f216e734383bb84ecea5" ], "author": { "name": "Victor Gomes", "email": "victorgomes@chromium.org", "time": "Wed Jul 29 09:28:40 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 10:45:14 2026" }, "message": "[scopes] Check parameter semantics when reusing a cached ScopeInfo\n\nThe reuse check only compared scope type and context layout, so a cached\nScopeInfo describing non-simple parameters could be attached to a\nfunction that was compiled with simple parameters. The mapped arguments\npath then allocated a strict arguments object and installed the larger\nfast aliased arguments map on it.\n\nFixed: 536271629\nChange-Id: I625c3add35f8e9324ce3f54a5bf46ff4a7d69e86\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8159583\nAuto-Submit: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCommit-Queue: Leszek Swirski \u003cleszeks@chromium.org\u003e\nReviewed-by: Leszek Swirski \u003cleszeks@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108933}\n" }, { "commit": "cb0a13d7ff2ec28ac783f216e734383bb84ecea5", "tree": "4b47eed6bde9e60148caf89050149887a5430b02", "parents": [ "76119d63ecad2caf280df8ba65cdf7956904d5a8" ], "author": { "name": "Daniel Lehmann", "email": "dlehmann@chromium.org", "time": "Wed Jul 29 09:29:42 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 10:08:51 2026" }, "message": "[maglev] Mark ProcessWasmArgument as NotIdempotent\n\nmaglev::ProcessWasmArgument is an identity node carrying callsite-\nspecific eager deopt frame states (pre-call checkpoints used by\nTurbolev\u0027s Wasm-in-JS wrapper inlining).\n\nPreviously, ProcessWasmArgument participated in CSE by default as a\npure single-input value node. When a function performed multiple JS-to-\nWasm calls with identical argument expressions (e.g., `wasmFn(n-1, 0)`\nfollowed by `wasmFn(n-1, {})`), Maglev deduplicated the second call\u0027s\nProcessWasmArgument node to the first call\u0027s node. As a result, the\nsecond call inherited the first call\u0027s eager frame state and deopted\nto the wrong bytecode offset.\n\nMark ProcessWasmArgument with OpProperties::NotIdempotent() so that\nMaglev\u0027s reducer bypasses CSE and creates a distinct node with a\ncallsite-specific EagerDeoptInfo for every call argument.\n\nTAG\u003dagy\n\nBug: 539121142\nChange-Id: Idc796b7a50f19664b56718601109e457351c2741\nFixed: 539121142\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8164839\nReviewed-by: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nCommit-Queue: Daniel Lehmann \u003cdlehmann@chromium.org\u003e\nReviewed-by: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108932}\n" }, { "commit": "76119d63ecad2caf280df8ba65cdf7956904d5a8", "tree": "25b9f633663af102655e4f1865ed81219c248987", "parents": [ "174f933328752dd837018517f40b6e178f884c89" ], "author": { "name": "Victor Gomes", "email": "victorgomes@chromium.org", "time": "Wed Jul 29 09:19:05 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 10:00:00 2026" }, "message": "[maglev] Invalidate aliasing context slots in loop-header merge\n\nMergeForLoop kept a cached context-slot load when the loop\u0027s stores used\na different context node for the same slot offset, because\ncontext_slot_written is keyed by (context node, offset) and only records\nthe aliases that happened to be cached while the graph builder walked\nthe loop.\n\nDrive-by: rename ContextSlotLoadsAlias::kYes/kNone to kAlways/kNever.\n\nNO_IFTTT\u003dJust renaming ContextSlotLoadsAlias\n\nFixed: 538938804\nChange-Id: Icf6e369038fe6e2d7735900ddc90f07e4a88755d\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8153020\nCommit-Queue: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nAuto-Submit: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nReviewed-by: Olivier Flückiger \u003colivf@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108931}\n" }, { "commit": "174f933328752dd837018517f40b6e178f884c89", "tree": "d481ff8d575c243825b675708e701c3b12857686", "parents": [ "d8eccd72a547069db99a4c39d4617e99d51a4739" ], "author": { "name": "Olivier Flückiger", "email": "olivf@chromium.org", "time": "Wed Jul 29 08:40:51 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 09:23:31 2026" }, "message": "[maglev][turbolev] Route new nodes to pending splice exit in optimizer\n\nIn MaglevGraphOptimizer, when reducing an instruction, the reduction\nmay emit a Subgraph before emitting a replacement instruction.\n\nPreviously, AddInitializedNodeToGraph added newly emitted nodes to\ncurrent_block(), which is restored by ~Subgraph to the block before the\nsplice (saved_block_). When ApplyPendingSplice ran, the replacement\nbuiltin landed in the block before the subgraph, causing inverted\nscheduling.\n\nUpdate AddInitializedNodeToGraph to check HasPendingSplice(). When a\npending splice is active for the instruction being reduced, subsequent\nnodes are pushed into pending_splice().exit-\u003enodes() and owned by\npending_splice().exit to keep insertion order.\n\nFixed: 539006995\nTAG\u003dagy\nCONV\u003dcaa173d8-d90f-457a-ba3c-57eeefbf56e7\n\nChange-Id: I76243509a9ca04203104f3a36dc145e0b108222c\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8166261\nCommit-Queue: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nAuto-Submit: Olivier Flückiger \u003colivf@chromium.org\u003e\nReviewed-by: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCommit-Queue: Olivier Flückiger \u003colivf@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108930}\n" }, { "commit": "d8eccd72a547069db99a4c39d4617e99d51a4739", "tree": "c650c5af4b0983c37837e4dec5b8090894b7c290", "parents": [ "802fa126bbd28f49466b397adb0a7f038f31c8b9" ], "author": { "name": "v8-ci-autoroll-builder", "email": "v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com", "time": "Sun Jul 26 03:04:03 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 09:02:44 2026" }, "message": "[test262] Roll test262\n\nThis roll requires a manual review. See http://go/reviewed-rolls for guidance.\n\nhttps://chromium.googlesource.com/external/github.com/tc39/test262/+log/9e61c128..07dbcbca\n\nRoll created at https://cr-buildbucket.appspot.com/build/8675252835781972977\n\nno-export: true\n\nR\u003dolivf@chromium.org,rezvan@chromium.org\n\nBug: v8:7834\nChange-Id: I30923b37e8313355707c36882dc2c8e792c8c2b6\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8146780\nCommit-Queue: Olivier Flückiger \u003colivf@chromium.org\u003e\nReviewed-by: Olivier Flückiger \u003colivf@chromium.org\u003e\nReviewed-by: Rezvan Mahdavi Hezaveh \u003crezvan@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108929}\n" }, { "commit": "802fa126bbd28f49466b397adb0a7f038f31c8b9", "tree": "20e7adc369d114534e05f45c047d537163cf153f", "parents": [ "0f0b8f00c604ea7478bbc63b96e78cf5b6e7898f" ], "author": { "name": "Jakob Kummerow", "email": "jkummerow@chromium.org", "time": "Tue Jul 28 14:55:17 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 08:48:15 2026" }, "message": "[wasm-strings-utf8] Check max length for string-to-array\n\nIn the experimental \u0027encodeStringToUTF8Array\u0027 builtin, we forgot\nto check if the UTF-8 length of the provided string exceeds the\nmaximum allowed Wasm array length.\nNo regression test because it\u0027s currently unclear whether this\nfunction will ever ship, and the test would be slow.\n\nFixed: 539824383\nChange-Id: Ic6d419f8be50618eb889d0b48617e5d62266274f\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8163665\nAuto-Submit: Jakob Kummerow \u003cjkummerow@chromium.org\u003e\nReviewed-by: Matthias Liedtke \u003cmliedtke@chromium.org\u003e\nCommit-Queue: Matthias Liedtke \u003cmliedtke@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108928}\n" }, { "commit": "0f0b8f00c604ea7478bbc63b96e78cf5b6e7898f", "tree": "2ff5b3883a6f3bdd48d45335ea4a26372a060150", "parents": [ "41f8f972f93639071f5451904bf48bd3f5ffb894" ], "author": { "name": "Victor Gomes", "email": "victorgomes@chromium.org", "time": "Tue Jul 28 18:30:15 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 08:36:10 2026" }, "message": "[maglev] Use a Maglev-specific max bytecode size limit\n\nSharing TurboFan\u0027s 60KB max_optimized_bytecode_size terminally disabled\noptimization for JetStream2\u0027s octane-zlib hot function (64KB of\nbytecode), which previously ran on Maglev, regressing the benchmark by\n53%. Maglev compiles large functions cheaply and its frame size is\nbounded separately, so give it its own 512KB limit.\n\nFixed: 539489804\nChange-Id: I013cfa060088794951caa78f96e1814b72a39618\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8163763\nCommit-Queue: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nReviewed-by: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nCommit-Queue: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nAuto-Submit: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108927}\n" }, { "commit": "41f8f972f93639071f5451904bf48bd3f5ffb894", "tree": "66b4834400c23a4b7ab2fb41ba7a085fcbed281b", "parents": [ "3b61bd4be5228af37d362b8f734a23e02473a4d0" ], "author": { "name": "Victor Gomes", "email": "victorgomes@chromium.org", "time": "Tue Jul 28 17:33:30 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 08:16:14 2026" }, "message": "[test] Skip weakrefs/minor-gc-* for stress_concurrent_allocation\n\nUnder --stress-concurrent-allocation a background thread triggers a\nMark-Compact every few ms, which promotes a still-pinned WeakRef target\nout of new space, after which the minor GC the tests rely on can never\nreclaim it. The equivalent full-GC tests were already skipped here; the\nminor-gc-* family was added later and never listed.\n\nFixed: 539790085\nChange-Id: I25ea47d4d12a8bf1a4fb601f94ed473e6affb965\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8164821\nCommit-Queue: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nReviewed-by: Omer Katz \u003comerkatz@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108926}\n" }, { "commit": "3b61bd4be5228af37d362b8f734a23e02473a4d0", "tree": "5a188a27a44e86fd12e757cfa43304b6c5f7bd2a", "parents": [ "5846cc7d1745bb6aafb82c0ccb4548da6726defe" ], "author": { "name": "Victor Gomes", "email": "victorgomes@chromium.org", "time": "Tue Jul 28 17:32:17 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 07:50:02 2026" }, "message": "[maglev] Return failed background compilation jobs to the main thread\n\nDropping them on the background thread left tiering_in_progress set,\nwhich locks the function out of all further tiering.\n\nFixed: 538562119\nChange-Id: Id64c675f1fe7d4b7bfbc2c3de8c6122e5cdd3da2\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8153021\nReviewed-by: Jakob Linke \u003cjgruber@chromium.org\u003e\nAuto-Submit: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCommit-Queue: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108925}\n" }, { "commit": "5846cc7d1745bb6aafb82c0ccb4548da6726defe", "tree": "720f9cc3c46df705a7944254b13be721bee33e4b", "parents": [ "9204fc071752535c094a5ee2aa6a15d81783dd19" ], "author": { "name": "v8-ci-autoroll-builder", "email": "v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 04:04:48 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 07:10:56 2026" }, "message": "Update V8 DEPS (trusted)\n\nRolling build: https://chromium.googlesource.com/chromium/src/build/+log/b5e7e46..c0e141d\n\nRolling third_party/abseil-cpp: https://chromium.googlesource.com/chromium/src/third_party/abseil-cpp/+log/60a3e91..7a87739\n\nRolling third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/c0148d6..621cd2a\n\nRolling third_party/jsoncpp/source: https://chromium.googlesource.com/external/github.com/open-source-parsers/jsoncpp/+log/edc01ab..60de77f\n\nRolling third_party/libunwind/src: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/b2ff0e6..ec7ac63\n\nRolling third_party/partition_alloc: https://chromium.googlesource.com/chromium/src/base/allocator/partition_allocator/+log/43b48ec..6abc77b\n\nRolling third_party/perfetto: https://chromium.googlesource.com/external/github.com/google/perfetto/+log/502412d..a1c97b9\n\nRolling tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/b0de7e5..b8094de\n\nRoll created at https://cr-buildbucket.appspot.com/build/8674973494858230641\n\nChange-Id: I0659c9ccf83c16a2314aa13822eb9f1622ca63d3\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8163123\nCommit-Queue: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com \u003cv8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com\u003e\nBot-Commit: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com \u003cv8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com\u003e\nCr-Commit-Position: refs/heads/main@{#108924}\n" }, { "commit": "9204fc071752535c094a5ee2aa6a15d81783dd19", "tree": "0451c272e7c8360d263b3fa85e3a3b998962d40e", "parents": [ "86630d14610d2a872200210f437a042f711960ea" ], "author": { "name": "v8-ci-autoroll-builder", "email": "v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 05:04:13 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 07:09:51 2026" }, "message": "Update fuzztest (trusted)\n\nRolling third_party/fuzztest: https://chromium.googlesource.com/chromium/src/third_party/fuzztest/+log/029ee51..256cb1f\n\nRoll FuzzTest from 228ca7a9f682 to a233d758c21f (1 revision) (chromium-autoroll@skia-public.iam.gserviceaccount.com)\nhttps://chromium.googlesource.com/chromium/src/third_party/fuzztest/+/256cb1f\n\nRolling third_party/fuzztest/src: https://chromium.googlesource.com/external/github.com/google/fuzztest/+log/228ca7a..a233d75\n\nNo public description (Daniel Lowengrub)\nhttps://chromium.googlesource.com/external/github.com/google/fuzztest/+/a233d75\n\nRoll created at https://cr-buildbucket.appspot.com/build/8674969719718725105\n\nCq-Include-Trybots: luci.v8.try:v8_linux64_asan_centipede_compile_dbg\nChange-Id: I828ca895036dec3558d0f69e2fd41a671c0f1b55\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8162932\nBot-Commit: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com \u003cv8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com\u003e\nCommit-Queue: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com \u003cv8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com\u003e\nCr-Commit-Position: refs/heads/main@{#108923}\n" }, { "commit": "86630d14610d2a872200210f437a042f711960ea", "tree": "e14cf3a6b3785a4fe8a14c801744c4a73c8742d9", "parents": [ "66b7bf5e0ddc117ecfd04b8d79066fef3d9eaf2b" ], "author": { "name": "Liu Yu", "email": "liuyu@loongson.cn", "time": "Tue Jul 28 08:31:30 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 29 01:59:08 2026" }, "message": "[loong64][mips64][liftoff] Fix sp adjustment in PrepareTailCall\n\nWhen a return_call has a large difference in stack parameter counts\nbetween caller and callee, the immediate of the sp adjustment can exceed\nthe 12-bit range of addi.d. Use the Add_d macro instead, which falls\nback to li+add.d for large operands.\n\nFixed: 511274900\nChange-Id: I92d0a78770f7b28ec5adcf74af6a895d9c026bbd\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8163221\nReviewed-by: Zhao Jiazhong \u003czhaojiazhong-hf@loongson.cn\u003e\nCommit-Queue: Liu Yu \u003cliuyu@loongson.cn\u003e\nReviewed-by: Jakob Linke \u003cjgruber@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108922}\n" }, { "commit": "66b7bf5e0ddc117ecfd04b8d79066fef3d9eaf2b", "tree": "5e6cd33d3e062cd85f5429349b33c5351c78aea2", "parents": [ "bb57cf5b6dfc0bb5d7fd7efabc245e7765444e3f" ], "author": { "name": "Hannes Payer", "email": "hpayer@chromium.org", "time": "Mon Jul 27 18:20:36 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jul 28 20:11:29 2026" }, "message": "[heap] Remove obsolete TODO(hpayer) comments\n\nRemove TODO(hpayer) comments across heap and runtime that are no longer\nrelevant\n\nTAG\u003dagy\n\nChange-Id: If2fc891bff9705cad6a29b1c9a3914a9d72660b8\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8157799\nCommit-Queue: Hannes Payer \u003chpayer@chromium.org\u003e\nReviewed-by: Michael Lippautz \u003cmlippautz@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108921}\n" }, { "commit": "bb57cf5b6dfc0bb5d7fd7efabc245e7765444e3f", "tree": "e1405617acfae9b99ae817473e16eb9ba5e97c80", "parents": [ "545a79059c7422d81ac21bf2985e057d934dd69e" ], "author": { "name": "Hannes Payer", "email": "hpayer@chromium.org", "time": "Tue Jul 28 16:19:11 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jul 28 17:51:06 2026" }, "message": "[objects] Move ContextMaps test from cctest to unittests\n\nMigrates the ContextMaps test from test-heap.cc (cctest) to\nobjects/object-unittest.cc (unittests), leveraging\nTestWithNativeContext.\n\nThe unittest verifies the cached prototype maps stored in NativeContext\n(STRING_FUNCTION_PROTOTYPE_MAP_INDEX, REGEXP_PROTOTYPE_MAP_INDEX, and\nOBJECT_FUNCTION_PROTOTYPE_MAP_INDEX) match the actual prototype maps of\nString.prototype, RegExp.prototype, and Object.prototype.\n\nBUG\u003dnone\nTAG\u003dagy\n\nChange-Id: Iacaec45dfebe0f5e09c3dab74389c6e9ce9e5aa1\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8163664\nCommit-Queue: Hannes Payer \u003chpayer@chromium.org\u003e\nReviewed-by: Michael Lippautz \u003cmlippautz@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108920}\n" }, { "commit": "545a79059c7422d81ac21bf2985e057d934dd69e", "tree": "883396602a4ac5ebaea53b220a3ba11a21e2e742", "parents": [ "aa7ac40507210f25ded5f29ccf182f8dcc1a0fd6" ], "author": { "name": "v8-ci-autoroll-builder", "email": "v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com", "time": "Tue Jul 28 16:01:39 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jul 28 16:44:06 2026" }, "message": "Update V8 DEPS (trusted)\n\nRolling build: https://chromium.googlesource.com/chromium/src/build/+log/3541c27..b5e7e46\n\nRolling buildtools/linux64: git_revision:641ace93dd9560e75e7add0d08f77b446fbb3b78..git_revision:fc56c7a0d0917f2b668714408ec22bd05736a9f5\n\nRolling buildtools/mac: git_revision:641ace93dd9560e75e7add0d08f77b446fbb3b78..git_revision:fc56c7a0d0917f2b668714408ec22bd05736a9f5\n\nRolling buildtools/win: git_revision:641ace93dd9560e75e7add0d08f77b446fbb3b78..git_revision:fc56c7a0d0917f2b668714408ec22bd05736a9f5\n\nRolling third_party/abseil-cpp: https://chromium.googlesource.com/chromium/src/third_party/abseil-cpp/+log/e4a3f56..60a3e91\n\nRolling third_party/catapult: https://chromium.googlesource.com/catapult/+log/015082d..91251ae\n\nRolling third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/38c391f..c0148d6\n\nRolling third_party/llvm-libc/src: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc/+log/3ea89f4..539518b\n\nRolling third_party/partition_alloc: https://chromium.googlesource.com/chromium/src/base/allocator/partition_allocator/+log/0f047f3..43b48ec\n\nRolling third_party/perfetto: https://chromium.googlesource.com/external/github.com/google/perfetto/+log/40643eb..502412d\n\nRoll created at https://cr-buildbucket.appspot.com/build/8675018792662160305\n\nChange-Id: I1aba04e513db849953bc51ec1109776ec2928d36\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8164860\nCommit-Queue: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com \u003cv8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com\u003e\nBot-Commit: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com \u003cv8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com\u003e\nCr-Commit-Position: refs/heads/main@{#108919}\n" }, { "commit": "aa7ac40507210f25ded5f29ccf182f8dcc1a0fd6", "tree": "1efe9be2dc687cbd329d755b4a2f6f9d31121dc4", "parents": [ "23d6618512136c2e5921e3962f9878ff3501b34b" ], "author": { "name": "Darius Mercadier", "email": "dmercadier@chromium.org", "time": "Tue Jul 28 14:44:33 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jul 28 15:32:00 2026" }, "message": "[turbolev] escape analysis: patch cached phi inputs on out-loop revisit\n\nWhen an outer loop revisits a nested inner loop, the forward-edge\npredecessor blocks of the inner loop header re-execute in the new\nouter-loop iteration, producing updated ValueNodes.\n\nWhen reusing an existing Phi from old_phis_ in CreateSnapshotFor,\nwe now update any changed incoming predecessor inputs on the reused\nPhi. We do not trigger an immediate loop revisit when Phi inputs\nchange because Phis are treated as opaque inside the loop body during\nEscape Analysis.\n\nTAG\u003dagy\nCONV\u003d164d8343-60b3-48d0-bc07-10f32a108810\n\nBug: 538666333\nChange-Id: If8665b37f6794a86c5803acc5fb59bd79d1ec9cb\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8157407\nAuto-Submit: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nCommit-Queue: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nReviewed-by: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108918}\n" }, { "commit": "23d6618512136c2e5921e3962f9878ff3501b34b", "tree": "b2f32c1d41b6bbd8756a05a62fdc37da56e0ae5d", "parents": [ "3ddec25cb22a93e034da3c3183e73cdec6b3f02c" ], "author": { "name": "Hannes Payer", "email": "hpayer@chromium.org", "time": "Tue Jul 28 14:38:19 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jul 28 15:18:34 2026" }, "message": "[heap] Remove obsolete HeapMaps cctest\n\nThe HeapMaps cctest checks the instance type and instance size of 5\narbitrary read-only root maps. This verification is incomplete and\nredundant, as ReadOnlyRoots::VerifyTypes() systematically checks\ninstance types of all read-only roots in debug builds and\nroots-unittest.cc handles root verification in unittests.\n\nBUG\u003dnone\nTAG\u003dagy\n\nChange-Id: Iad5810ac3e03191320288c567185f1e54c6d2d9e\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8160004\nCommit-Queue: Hannes Payer \u003chpayer@chromium.org\u003e\nReviewed-by: Michael Lippautz \u003cmlippautz@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108917}\n" }, { "commit": "3ddec25cb22a93e034da3c3183e73cdec6b3f02c", "tree": "ad49ffd4622f117553a8ea9ffc254aec2af2b2d9", "parents": [ "1a058d2e035bf325c3baccc8f8f0ede5096c519f" ], "author": { "name": "Dan Carney", "email": "dcarney@chromium.org", "time": "Tue Jul 28 11:39:33 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jul 28 15:04:17 2026" }, "message": "[headers] Move Object number conversions out of objects-inl.h\n\nBug: 493505085\nChange-Id: Iab9e5e0fc3d78cb1d3eec86860d8bc2b9f444816\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8157201\nCommit-Queue: Dan Carney \u003cdcarney@chromium.org\u003e\nReviewed-by: Jakob Kummerow \u003cjkummerow@chromium.org\u003e\nReviewed-by: Leszek Swirski \u003cleszeks@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108916}\n" }, { "commit": "1a058d2e035bf325c3baccc8f8f0ede5096c519f", "tree": "dd659a0288469b873cf2f6d04562576a818d4f97", "parents": [ "c3ea7757b1906586207c05766e1070ea20266ea8" ], "author": { "name": "Victor Gomes", "email": "victorgomes@chromium.org", "time": "Tue Jul 28 14:19:03 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jul 28 14:59:04 2026" }, "message": "[maglev] Keep forward property facts in MergeForLoop without backedge witness\n\nThe forward predecessor dominates the loop body and LoopEffects\nsummarize every write in it, so a fact the loop provably cannot\nclobber stays valid even when the cached backedge KNA has no matching\nentry. This lets the KNA recompute processor keep loop-invariant\n[Elements] and named-property caches alive across loop headers, which\nthe graph optimizer then folds redundant loads against.\n\nBug: 517439598\n\nChange-Id: If7eaf8762f8dafa6e9e8bf680ca9fc8b5d476e77\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8137462\nReviewed-by: Olivier Flückiger \u003colivf@chromium.org\u003e\nCommit-Queue: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108915}\n" }, { "commit": "c3ea7757b1906586207c05766e1070ea20266ea8", "tree": "6ce48340462845ff10c4cf044092193755a2a598", "parents": [ "8b1fd5973ee98be22c8fb0b6d9165407dd28de32" ], "author": { "name": "Jakob Kummerow", "email": "jkummerow@chromium.org", "time": "Tue Jul 28 13:31:57 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jul 28 14:08:56 2026" }, "message": "[wasm] Fix integer overflow in deserializer\n\nFor sufficiently large x, `x*9/10` can overflow the intermediate\nresult. Switching to `size_t` would not help on 32-bit, so flip\nthe order of operations instead.\nBonus: increase strictness of CFI-related checking to catch this.\n\nFixed: 538378084\nChange-Id: Iae60310d567881601be643d2b79df9071111356b\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8159441\nAuto-Submit: Jakob Kummerow \u003cjkummerow@chromium.org\u003e\nCommit-Queue: Jakob Kummerow \u003cjkummerow@chromium.org\u003e\nReviewed-by: Daniel Lehmann \u003cdlehmann@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108914}\n" }, { "commit": "8b1fd5973ee98be22c8fb0b6d9165407dd28de32", "tree": "eb965557e6d0411701bf17fd7753ccc38787995f", "parents": [ "577d0cda2bb1d47a5132bef327371404e6fcde80" ], "author": { "name": "Darius Mercadier", "email": "dmercadier@chromium.org", "time": "Tue Jul 28 12:48:39 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jul 28 14:01:48 2026" }, "message": "[turbolev] Fix escape analysis loop revisit DCHECK\n\nWhen an allocation defined inside a loop stores a reference to an outer\nallocation and flows into a loop phi backedge, marking the inner\nallocation as escaped recursively marks the outer allocation as\nescaped. Because the outer allocation was defined outside the current\nloop, its escape correctly sets has_escaped_candidate on the loop\nstack so the loop is revisited.\n\nThis removes an overly restrictive DCHECK_IMPLIES (introduced\nrecently in https://crrev.com/c/8154581) in\nPatchLoopPhisBackedges that assumed marking an inner allocation could\nnever mark the current loop for revisit, overlooking transitive escape\ndependencies on outer allocations.\n\nTAG\u003dagy\nCONV\u003d93c268e5-b52e-4f1c-9a77-ca68c190f6be\n\nBug: 529841774, 539464276\nChange-Id: Ia141537cbc54745446fd008313c0d1172a33d6f1\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8159445\nReviewed-by: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nAuto-Submit: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nCommit-Queue: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108913}\n" }, { "commit": "577d0cda2bb1d47a5132bef327371404e6fcde80", "tree": "c31634976fbae096fe7603f7ee3b87f2a87ce337", "parents": [ "2c3e7f7d4d65f274951d58eec078b2aacdfba58e" ], "author": { "name": "Liu Yu", "email": "liuyu@loongson.cn", "time": "Tue Jul 28 07:11:04 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jul 28 13:44:56 2026" }, "message": "[loong64][maglev] Zero-extend Int32 index in element address\n\nOn LoongArch64, 32-bit ALU results and Ld_w are sign-extended into the\n64-bit GPR. The FixedArray element-access helpers fed the raw Int32\nindex register directly into alsl.d, so an index with bit 31 set\nproduced an element address far below the array base instead of above\nit. The Int32 bounds check normalises only scratch copies and leaves the\noriginal index untouched.\n\nZero-extend the index with bstrpick.d before it participates in 64-bit\naddress computation in LoadTaggedFieldByIndex,\nLoad/StoreFixedArrayElement* and SetSlotAddressForFixedArray- Element.\nThis matches the effective behaviour on x64/arm64 where 32-bit register\nwrites architecturally zero-extend.\n\nAdd a loong64 MaglevAssembler unit test that exercises\nSetSlotAddressForFixedArrayElement with an Int32 index whose top bit is\nset and checks the resulting slot address.\n\nBug: 513340698\nChange-Id: I94b0902bc7f316d01353983e220774659d9bff53\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8153680\nReviewed-by: Zhao Jiazhong \u003czhaojiazhong-hf@loongson.cn\u003e\nCommit-Queue: Liu Yu \u003cliuyu@loongson.cn\u003e\nReviewed-by: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108912}\n" }, { "commit": "2c3e7f7d4d65f274951d58eec078b2aacdfba58e", "tree": "dc74d97189e60425650e3e73b78477bddbd2e3b5", "parents": [ "429577a9437e269d4bbb5d529458a1e74643c856" ], "author": { "name": "Jakob Kummerow", "email": "jkummerow@chromium.org", "time": "Tue Jul 28 10:51:35 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jul 28 13:00:39 2026" }, "message": "[arm64] Fix write barrier register aliasing\n\nUse `r1.Aliases(r2)` to handle W and X registers correctly.\n\nFixed: 530663440\nChange-Id: Ib17e8f186bbea17d2b845202399ce39d21dbf107\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8158501\nAuto-Submit: Jakob Kummerow \u003cjkummerow@chromium.org\u003e\nReviewed-by: Manos Koukoutos \u003cmanoskouk@chromium.org\u003e\nCommit-Queue: Manos Koukoutos \u003cmanoskouk@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108911}\n" }, { "commit": "429577a9437e269d4bbb5d529458a1e74643c856", "tree": "1fecc554c77f25247bc832177a8274cf72dc6b3f", "parents": [ "4648822e53ea6ebc216cae2037974f43723ca0a3" ], "author": { "name": "Darius Mercadier", "email": "dmercadier@chromium.org", "time": "Tue Jul 28 10:58:59 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jul 28 12:59:00 2026" }, "message": "[debug] Deoptimize OSR frames on debugger break and restart\n\nWhen Deoptimizer::DeoptimizeFunction is called without explicitly\npassing the target frame\u0027s Code object, it defaults to\nunction-\u003ecode(isolate), which points to the function\u0027s default\nentrypoint code (e.g. unoptimized bytecode, baseline code, or non-OSR\noptimized code) rather than the OSR machine code executing on the\nstack frame.\n\nTAG\u003dagy\nCONV\u003d978a8699-6f5a-469d-a61e-d8cbf7aa4c0d\n\nFixed: 539453394, 531297707\nChange-Id: Ibb577dfd2169e4d76517bb661410ff5609fb2ad5\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8159443\nAuto-Submit: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nCommit-Queue: Leszek Swirski \u003cleszeks@chromium.org\u003e\nReviewed-by: Leszek Swirski \u003cleszeks@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108910}\n" }, { "commit": "4648822e53ea6ebc216cae2037974f43723ca0a3", "tree": "15565131a1aebe0cef64c754af473ad21ae31dad", "parents": [ "39ccace02f12c476027175ac9d77de18949f354c" ], "author": { "name": "Marja Hölttä", "email": "marja@chromium.org", "time": "Tue Jul 28 12:16:33 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jul 28 12:55:08 2026" }, "message": "[*lev] Restore hacks around empty types\n\nUnfortunately it looks like we cannot detect empty types early in the\ngeneral case, without doing things like \"iterate the full KNA and check\nfor contradictions\".\n\nThis CL restores the hacks to avoid the \"should dead code have write\nbarriers\" problem.\n\nFixed: 538884561\nBug: 534277460\nChange-Id: I910e69ea8f95bbd622095b41f7520cd0fdd05406\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8158062\nReviewed-by: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCommit-Queue: Marja Hölttä \u003cmarja@chromium.org\u003e\nReviewed-by: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108909}\n" }, { "commit": "39ccace02f12c476027175ac9d77de18949f354c", "tree": "5a1ab0a9ddab55eb714fa0d5421c1eea28a2d661", "parents": [ "16d931dfef996397201c0615610f226283f0f824" ], "author": { "name": "Thibaud Michaud", "email": "thibaudm@chromium.org", "time": "Tue Jul 28 10:40:29 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jul 28 12:09:50 2026" }, "message": "[wasmfx] Increase stack pool capacity to 500MB\n\nAnd add a command line flag to control it.\n\nThe stack pool capacity was 4MB, which is only enough to hold 3 stacks\n(1MB per stack + metadata). This limit was very conservative and we did\nnot need more than that for JSPI. But with WasmFX, we expect more\nstack-heavy workloads, and this limit quickly becomes the bottleneck.\n\nWe can increase it significantly. The stacks are not reserved eagerly:\nonly applications that actually use many stacks will potentially fill\nit. And the stack pool is cleared by the GC on high memory pressure\nsignal.\n\nIf, despite that, we observe unfavorable cases where the pool keeps\nstacks alive unnecessarily and is responsible for additional OOMs, we\nmay refine the limit and/or cleanup strategy.\n\nR\u003djkummerow@chromium.org\n\nBug: 388533754\nChange-Id: I162ea4ddc49edbee0292c5c34e5648201c5e620e\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8159442\nReviewed-by: Jakob Kummerow \u003cjkummerow@chromium.org\u003e\nCommit-Queue: Thibaud Michaud \u003cthibaudm@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108908}\n" }, { "commit": "16d931dfef996397201c0615610f226283f0f824", "tree": "c2f254545489af5f468a4192ed33afa4dff9b30e", "parents": [ "2525210adc82244e401b44570593e9408d68b5c6" ], "author": { "name": "Michael Lippautz", "email": "mlippautz@chromium.org", "time": "Tue Jul 28 09:59:22 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jul 28 11:51:33 2026" }, "message": "[heap] Address old TODO wrt to cacheline size\n\nUse std::hardware_destructive_interference_size instead of plain\nvalue.\n\nChange-Id: I3c1b3b1882a6dcc9c26a7488da6f7bdc51c36e65\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8163742\nAuto-Submit: Michael Lippautz \u003cmlippautz@chromium.org\u003e\nCommit-Queue: Anton Bikineev \u003cbikineev@chromium.org\u003e\nReviewed-by: Anton Bikineev \u003cbikineev@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108907}\n" }, { "commit": "2525210adc82244e401b44570593e9408d68b5c6", "tree": "b2b06e8f666c3d4667c9bf5659e788d360335a8b", "parents": [ "1a8428bc6478820db43c3a08780097dcc3d8e6c3" ], "author": { "name": "V8 Autoroll", "email": "v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com", "time": "Tue Jul 28 10:13:41 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jul 28 10:55:25 2026" }, "message": "[version-auto-update] Version 15.3.0\n\nVersion incremented at https://cr-buildbucket.appspot.com/build/8675040814310978753\n\nChange-Id: I37de6726dccce3faf6906d3624e7c852a8160841\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8163861\nCommit-Queue: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com \u003cv8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com\u003e\nBot-Commit: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com \u003cv8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com\u003e\nCr-Commit-Position: refs/heads/main@{#108906}\n" }, { "commit": "1a8428bc6478820db43c3a08780097dcc3d8e6c3", "tree": "3c1058ed44ba524d8ff4cc7b758bb46d2daca904", "parents": [ "43f705962639bc6f3d70c71a5651061b9692e10f" ], "author": { "name": "Andreas Haas", "email": "ahaas@chromium.org", "time": "Tue Jul 28 09:11:36 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jul 28 10:46:12 2026" }, "message": "[wasm][turboshaft] Reload cached memory after fast API calls\n\nFast API calls can execute arbitrary JavaScript, which may grow the WebAssembly memory. If the memory is relocated during this growth, the cached memory base address used by Turboshaft becomes stale. This CL fixes the issue by reloading the cached memory after returning from a fast API call.\n\nBug: 535659723\nChange-Id: I276d8428138fda41c1c8c2475e1339e96c6ab224\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8163860\nCommit-Queue: Andreas Haas \u003cahaas@chromium.org\u003e\nReviewed-by: Daniel Lehmann \u003cdlehmann@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108905}\n" }, { "commit": "43f705962639bc6f3d70c71a5651061b9692e10f", "tree": "315166d3762946a219ac21cd9aae9a1ad2c6a5fd", "parents": [ "02a7c1b6d42083fbd2b256fd1f3ca3124227380e" ], "author": { "name": "Darius Mercadier", "email": "dmercadier@chromium.org", "time": "Mon Jul 27 12:51:36 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jul 28 09:09:36 2026" }, "message": "[turbolev] escape analysis: do not discard backedge snapshots\n\nIn the initial implementation of Escape Analysis, loops were revisited\nat most once, and discarding backedge snapshots was needed to ensure\nthat inner loops could be re-revisited when their outer loops where\nrevisited.\n\nSince then, we\u0027ve changed this behavior and loops can be visited\narbitrarily many times, so resetting the backedge snapshots doesn\u0027t\nmake sense anymore.\n\nAdditionally, we\u0027re now reusing old Phis from previous iterations,\nand if we clear the backedge snapshot, then we only end up with 2\npredecessors when merging but old Phis have 3 inputs, which creates an\nannoying mismatch.\n\nBug: 529841774\nChange-Id: I8c7a0164fb860731e3a08e6dc0475bcfbe79d88b\nFixed: 538666333\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8154060\nReviewed-by: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCommit-Queue: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nAuto-Submit: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108904}\n" }, { "commit": "02a7c1b6d42083fbd2b256fd1f3ca3124227380e", "tree": "fd247a6a2e26ec5e2f9d921d224bbbbf240d68b3", "parents": [ "e3b65b3fed9f2b1ec840201442ae13d04ae5a84d" ], "author": { "name": "Darius Mercadier", "email": "dmercadier@chromium.org", "time": "Mon Jul 27 14:51:34 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jul 28 08:59:45 2026" }, "message": "[turbolev] escape analysis: fix wrong DCHECK about loop revisits\n\nNote that it\u0027s important to revisit the current loop if backedge_alloc\nescapes. Consider for instance:\n\n LOOP:\n some_phi \u003d Phi(...)\n a \u003d LoadTaggedField(o, offset\u003d12)\n ...\n foo(some_phi)\n ...\n some_phi.backedge \u003d o\n\nIn this case, if we initially replaced LoadTaggedField with whatever\nvalue o[12] holded initially, then whatever we did with {a} is now\nwrong this {o} escapes through some_phi\u0027s backedge which is then\npassed to a function call to foo, which could easily mutate {o}\u0027s\nfields.\n\nBug: 529841774\nChange-Id: I5cf5fb7e60f1eb7ff919018965246c49bd74a655\nFixed: 539464276\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8154581\nAuto-Submit: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nReviewed-by: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCommit-Queue: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108903}\n" }, { "commit": "e3b65b3fed9f2b1ec840201442ae13d04ae5a84d", "tree": "4ad32c851da2b440d165473b11edff038966488f", "parents": [ "44315bf31d039031d6c23d3c99eee50ed3d08989" ], "author": { "name": "Leszek Swirski", "email": "leszeks@chromium.org", "time": "Fri Jul 17 14:39:43 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jul 28 07:59:57 2026" }, "message": "Reland \"[parser] Do not mark script-level const as maybe assigned\"\n\nThis is a reland of commit 92c9de53400372a5797781423026929fa5ad66f3\n\nNo reland changes, incorrect speculative revert.\n\nOriginal change\u0027s description:\n\u003e [parser] Do not mark script-level const as maybe assigned\n\u003e\n\u003e Top-level script scope variables are marked maybe assigned in\n\u003e Parser::PostProcessParseResult to account for lazily parsed top-level\n\u003e functions. However, const variables cannot be reassigned even across\n\u003e lazy functions, unless in REPL mode.\n\u003e\n\u003e Exclude VariableMode::kConst from SetMaybeAssigned() in script scope\n\u003e (unless in REPL mode). This enables Maglev and Turbolev to recognize\n\u003e script-level consts as unassigned/immutable, allowing constant-folding.\n\u003e\n\u003e TAG\u003dagy\n\u003e CONV\u003d6c2204b1-c38c-4ecc-b5e4-51ba4bacaf2f\n\u003e\n\u003e Change-Id: I3f611d4ad4cf377457e03eaf01f93dafcf08c7eb\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8086022\n\u003e Auto-Submit: Leszek Swirski \u003cleszeks@chromium.org\u003e\n\u003e Commit-Queue: Victor Gomes \u003cvictorgomes@chromium.org\u003e\n\u003e Reviewed-by: Victor Gomes \u003cvictorgomes@chromium.org\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#108734}\n\nChange-Id: Id86ae7c09a5e43e557e92ae1961403e296ab6d80\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8154959\nReviewed-by: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCommit-Queue: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nAuto-Submit: Leszek Swirski \u003cleszeks@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108902}\n" }, { "commit": "44315bf31d039031d6c23d3c99eee50ed3d08989", "tree": "3c0170ef15e741f694bb11bf1917537863bca595", "parents": [ "13d9e755e47218bb5369e8283389d42276b784aa" ], "author": { "name": "v8-ci-autoroll-builder", "email": "v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com", "time": "Tue Jul 28 05:04:28 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jul 28 05:44:54 2026" }, "message": "Update fuzztest (trusted)\n\nRolling third_party/fuzztest: https://chromium.googlesource.com/chromium/src/third_party/fuzztest/+log/cc30588..029ee51\n\nRoll FuzzTest from 239bf6cc1ffc to 228ca7a9f682 (1 revision) (chromium-autoroll@skia-public.iam.gserviceaccount.com)\nhttps://chromium.googlesource.com/chromium/src/third_party/fuzztest/+/029ee51\n\nRoll FuzzTest from 073bf2392bf1 to 239bf6cc1ffc (1 revision) (chromium-autoroll@skia-public.iam.gserviceaccount.com)\nhttps://chromium.googlesource.com/chromium/src/third_party/fuzztest/+/198da97\n\nRolling third_party/fuzztest/src: https://chromium.googlesource.com/external/github.com/google/fuzztest/+log/073bf23..228ca7a\n\nChange the runner interface to prepare the migration to the engine ABI. (Xinhao Yuan)\nhttps://chromium.googlesource.com/external/github.com/google/fuzztest/+/228ca7a\n\nNo public description (Daniel Lowengrub)\nhttps://chromium.googlesource.com/external/github.com/google/fuzztest/+/239bf6c\n\nRoll created at https://cr-buildbucket.appspot.com/build/8675060316729146033\n\nCq-Include-Trybots: luci.v8.try:v8_linux64_asan_centipede_compile_dbg\nChange-Id: Ib2a20669c7a4f01f0bb51f175ac29cce08e9dffd\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8161781\nBot-Commit: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com \u003cv8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com\u003e\nCommit-Queue: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com \u003cv8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com\u003e\nCr-Commit-Position: refs/heads/main@{#108901}\n" }, { "commit": "13d9e755e47218bb5369e8283389d42276b784aa", "tree": "e216923c2a4fc632be5d7003c4626fe1218db174", "parents": [ "45b697fc030f4f991d613aa9f1b0efe77832b6e7" ], "author": { "name": "v8-ci-autoroll-builder", "email": "v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com", "time": "Tue Jul 28 04:04:33 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jul 28 04:47:08 2026" }, "message": "Update V8 DEPS (trusted)\n\nRolling build: https://chromium.googlesource.com/chromium/src/build/+log/e04b5b2..3541c27\n\nRolling third_party/abseil-cpp: https://chromium.googlesource.com/chromium/src/third_party/abseil-cpp/+log/cd0a833..e4a3f56\n\nRolling third_party/catapult: https://chromium.googlesource.com/catapult/+log/d810008..015082d\n\nRolling third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/571fb81..38c391f\n\nRolling third_party/partition_alloc: https://chromium.googlesource.com/chromium/src/base/allocator/partition_allocator/+log/66df8ef..0f047f3\n\nRolling third_party/perfetto: https://chromium.googlesource.com/external/github.com/google/perfetto/+log/5d5fbe3..40643eb\n\nRolling tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/5cf0395..b0de7e5\n\nRoll created at https://cr-buildbucket.appspot.com/build/8675064092558371985\n\nChange-Id: Ifd7458d09ea2398abb31763f0f53729cae22516a\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8162220\nCommit-Queue: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com \u003cv8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com\u003e\nBot-Commit: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com \u003cv8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com\u003e\nCr-Commit-Position: refs/heads/main@{#108900}\n" }, { "commit": "45b697fc030f4f991d613aa9f1b0efe77832b6e7", "tree": "04ffac551d98cf721f85781453802be5ad0599dc", "parents": [ "ddb5cc0c54814096ec78df470301d23ddee05f8f" ], "author": { "name": "Fanchen Kong", "email": "fanchen.kong@intel.com", "time": "Tue Jul 21 05:28:48 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jul 28 01:56:35 2026" }, "message": "[AVX10] AVX10.1 feature detection\n\nAVX10 is enumerated as a platform feature through the CPUID interface:\nCPUID.(EAX\u003d0x7,ECX\u003d1).EDX[19] \u003d 1. The AVX10 version number is reported\nin CPUID.(EAX\u003d0x24,ECX\u003d0).EBX[7:0], and the AVX10.1 baseline requires\nthat version to be \u003e\u003d 1. The vector-length bits\nCPUID.(EAX\u003d0x24,ECX\u003d0).EBX[18:16] should read 111b.\n\nAVX10.1 also requires saving of Opmask, ZMM_Hi256, and Hi16_ZMM state\n(in addition to SSE and AVX). This is gated by OSHasAVX10Support.\n\nTo enable the AVX10.1 build, set gn arg v8_enable_avx10_1 \u003d true. It can\nthen be toggled at runtime with --enable-avx10-1 (disabled by default).\n\nNO_IFTTT\u003dexperimental x86 ISA opt-in flag; not modeled in the Bazel\nbuild, consistent with v8_enable_apx_f.\n\nBug: 536954139\nChange-Id: I84827d9d9e0e8f72d3e447222fe7caaa8d9b3a96\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8128485\nReviewed-by: Jakob Kummerow \u003cjkummerow@chromium.org\u003e\nReviewed-by: Leszek Swirski \u003cleszeks@chromium.org\u003e\nCommit-Queue: Kong, Fanchen \u003cfanchen.kong@intel.com\u003e\nCr-Commit-Position: refs/heads/main@{#108899}\n" }, { "commit": "ddb5cc0c54814096ec78df470301d23ddee05f8f", "tree": "58182edadf62423a3e298427498e9dd91fe862e5", "parents": [ "bdd78620214a77e8372f1d876d61a1a2bff482a7" ], "author": { "name": "Michael Lippautz", "email": "mlippautz@chromium.org", "time": "Mon Jul 27 17:33:44 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Jul 27 18:30:25 2026" }, "message": "[heap,sandbox] Fix race condition in EPT evacuation\n\nFix a race that may happen in the corrupted scenarios where handles\ncan be duplicated.\n\nTAG\u003dagy\nCONV\u003dd38c4950-3968-45ca-ab2f-6d29bcc31fe4\n\nBug: 534092070\nChange-Id: I071273ed46aed67f74b894578f8d16eb80688cfc\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8138101\nReviewed-by: Omer Katz \u003comerkatz@chromium.org\u003e\nCommit-Queue: Michael Lippautz \u003cmlippautz@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108898}\n" }, { "commit": "bdd78620214a77e8372f1d876d61a1a2bff482a7", "tree": "c03ed7224ad66f3a8d996e07b75fe029dd91e5c2", "parents": [ "da4571bfc2d9b0aca228c1fd3902d86f35713525" ], "author": { "name": "Thomas Lively", "email": "tlively@google.com", "time": "Fri Jul 24 14:36:50 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Jul 27 17:23:44 2026" }, "message": "[wasm] Add kWasmGCAllocation use counter\n\nThis use counter will track uses of Wasm modules that contain Wasm GC\nallocation instructions. This is meant to differentiate use of Wasm GC\ngenerated from Wasm GC toolchains from incidental use of Wasm GC, e.g.\nPython\u0027s use of `ref.test` to optimize some call sequences.\n\nChange-Id: I25ab71e55415f00b77e18e8e995ba515c3bfb089\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8142164\nReviewed-by: Michael Lippautz \u003cmlippautz@chromium.org\u003e\nReviewed-by: Jakob Kummerow \u003cjkummerow@chromium.org\u003e\nAuto-Submit: Thomas Lively \u003ctlively@google.com\u003e\nCommit-Queue: Michael Lippautz \u003cmlippautz@chromium.org\u003e\nReviewed-by: Matthias Liedtke \u003cmliedtke@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108897}\n" }, { "commit": "da4571bfc2d9b0aca228c1fd3902d86f35713525", "tree": "a1f67f5c74155429a58e4de03b2f58ea22cd79d3", "parents": [ "367aac8d410bcc18ce02852daa6b4b7a829e3b9b" ], "author": { "name": "v8-ci-autoroll-builder", "email": "v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com", "time": "Mon Jul 27 16:01:57 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Jul 27 16:59:49 2026" }, "message": "Update V8 DEPS (trusted)\n\nRolling build: https://chromium.googlesource.com/chromium/src/build/+log/fab0ea1..e04b5b2\n\nRolling third_party/abseil-cpp: https://chromium.googlesource.com/chromium/src/third_party/abseil-cpp/+log/ff6e8ce..cd0a833\n\nRolling third_party/catapult: https://chromium.googlesource.com/catapult/+log/7451318..d810008\n\nRolling third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/f394ab2..571fb81\n\nRolling third_party/libunwind/src: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind/+log/1fd4558..b2ff0e6\n\nRolling third_party/llvm-libc/src: https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc/+log/75ae50c..3ea89f4\n\nRolling third_party/perfetto: https://chromium.googlesource.com/external/github.com/google/perfetto/+log/bd153cb..5d5fbe3\n\nRolling third_party/siso/cipd: git_revision:78c72819a5567e09f4b3083b04c6b15d11bb345b..git_revision:7bc9a0bfe050ef97e1712ff61c6f11952799e951\n\nRolling tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/56a7ab3..5cf0395\n\nRoll created at https://cr-buildbucket.appspot.com/build/8675109387222243521\n\nChange-Id: Ie516e22e5632a4edf2a03285f97cb9ee2a5151ae\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8153825\nCommit-Queue: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com \u003cv8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com\u003e\nBot-Commit: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com \u003cv8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com\u003e\nCr-Commit-Position: refs/heads/main@{#108896}\n" }, { "commit": "367aac8d410bcc18ce02852daa6b4b7a829e3b9b", "tree": "7eca7a426dc81546f94823dedbf24dbfb755a0d1", "parents": [ "0e6ea09ef6f15ebd7f78555c0648c8b632ce3013" ], "author": { "name": "Olivier Flückiger", "email": "olivf@chromium.org", "time": "Mon Jul 27 13:18:35 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Jul 27 14:39:38 2026" }, "message": "[maglev] Promote NumberOrOddball conversions conditionally in KNA\n\nDuring KNA recomputation (RecomputeKnownNodeAspectsProcessor),\nmacro-based registrations for safe checked and unsafe conversions\nblindly set canonical float64 alternatives regardless of whether\noddballs were possible. Because NumberOrOddball-\u003eFloat64 conversions\nlose oddball identity (converting null to 0.0 or undefined to NaN),\npromoting them on oddball-capable nodes violates core type semantics\nand caused late optimizers to replace checked conversions with\nsilenced conversions, triggering CheckMaglevType assertions at\nruntime when array holes returned undefined.\n\nThis change replaces generic macro registrations for checked and\nholey Float64 conversions in RecomputeKnownNodeAspectsProcessor with\nexplicit handlers that promote them to canonical float64_alternative\nif and only if KNA has statically proven the input type is strictly\nkNumber without oddball possibilities, matching initial graph\nbuilding invariants.\n\nFixed: 539110933\n\nTAG\u003dagy\nCONV\u003d6b5224b5-f8c9-481c-8d21-466f295b256a\n\nChange-Id: I05f1d9c34b09baef43ef3bd17027bca4f5070e6b\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8154580\nCommit-Queue: Olivier Flückiger \u003colivf@chromium.org\u003e\nAuto-Submit: Olivier Flückiger \u003colivf@chromium.org\u003e\nReviewed-by: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108895}\n" }, { "commit": "0e6ea09ef6f15ebd7f78555c0648c8b632ce3013", "tree": "83aab743f41406e26082d08fbc5a1539eb496bf1", "parents": [ "71e8f28b5ace9d56bff5e3b3292117e4673d0aef" ], "author": { "name": "Victor Gomes", "email": "victorgomes@chromium.org", "time": "Mon Jul 27 13:37:01 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Jul 27 14:25:08 2026" }, "message": "[maglev] Cache LoadFixedArrayElement results in KnownNodeAspects\n\nTrack (elements, index) -\u003e LoadFixedArrayElement in a KNA side table so\nidentical reads dedupe across writes that provably cannot mutate an\nexisting FixedArray payload: double-array stores hit a different\ninstance type, and elements-kind transitions write the object\u0027s\nmap/elements fields or copy into a freshly allocated backing store.\nEvery other write clears the cache. Unifying the reloaded object also\nlets the existing named-property cache fold its redundant length load\nand bounds check.\n\nBug: 517439598\n\nChange-Id: I0e683659f323b04c19653e35aaa77fc22ae1a93e\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8138197\nReviewed-by: Olivier Flückiger \u003colivf@chromium.org\u003e\nAuto-Submit: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCommit-Queue: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108894}\n" }, { "commit": "71e8f28b5ace9d56bff5e3b3292117e4673d0aef", "tree": "6693ee0e9b68fd048450528777c6de47fa0e9d6b", "parents": [ "33041f5d64827d670be346dcaa1e0ba62c95ed58" ], "author": { "name": "chromium-autoroll@skia-public.iam.gserviceaccount.com", "email": "chromium-autoroll@skia-public.iam.gserviceaccount.com", "time": "Mon Jul 27 13:18:09 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Jul 27 13:57:38 2026" }, "message": "Roll agents from dd4dfa767086 to 559f135fc214 (1 revision)\n\nhttps://chromium.googlesource.com/chromium/agents.git/+log/dd4dfa767086..559f135fc214\n\nIf this roll has caused a breakage, revert this CL and stop the roller\nusing the controls here:\nhttps://autoroll.skia.org/r/agents-v8\nPlease CC browser-perf-engprod@google.com,faridzad@google.com,viktarzinkou@google.com on the revert to ensure that a human\nis aware of the problem.\n\nTo file a bug in agents: https://b.corp.google.com/issues/new?component\u003d1923111\u0026template\u003d2204026\nTo file a bug in V8: https://b.corp.google.com/issues/new?component\u003d1923111\u0026template\u003d2204026\n\nTo report a problem with the AutoRoller itself, please file a bug:\nhttps://issues.skia.org/issues/new?component\u003d1389291\u0026template\u003d1850622\n\nDocumentation for the AutoRoller is here:\nhttps://skia.googlesource.com/buildbot/+doc/main/autoroll/README.md\n\nBug: None\nTbr: faridzad@google.com,viktarzinkou@google.com\nChange-Id: I638fef56405e15b8e8b5fede58b95a07dc55757e\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8151800\nBot-Commit: chromium-autoroll@skia-public.iam.gserviceaccount.com \u003cchromium-autoroll@skia-public.iam.gserviceaccount.com\u003e\nCommit-Queue: chromium-autoroll@skia-public.iam.gserviceaccount.com \u003cchromium-autoroll@skia-public.iam.gserviceaccount.com\u003e\nCr-Commit-Position: refs/heads/main@{#108893}\n" }, { "commit": "33041f5d64827d670be346dcaa1e0ba62c95ed58", "tree": "6c531657ac7ffdf4fa951e730928b040bc22e807", "parents": [ "e5865866709fc78703caf3da0b41d06fc575e0e8" ], "author": { "name": "Victor Gomes", "email": "victorgomes@chromium.org", "time": "Mon Jul 27 07:01:48 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Jul 27 13:09:03 2026" }, "message": "[maglev] Do not elide a map check that still has to reject Smis\n\nFixed: 539072493\nChange-Id: I1042895adbf161fc59448f0e14a8d26378835dc6\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8153019\nReviewed-by: Marja Hölttä \u003cmarja@chromium.org\u003e\nAuto-Submit: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCommit-Queue: Marja Hölttä \u003cmarja@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108892}\n" }, { "commit": "e5865866709fc78703caf3da0b41d06fc575e0e8", "tree": "54571faef31d645c0157b59f60b7ccaa5aa40d24", "parents": [ "73b4712d0facc7f8fe888abefd5a5cbdec159ba5" ], "author": { "name": "Darius Mercadier", "email": "dmercadier@chromium.org", "time": "Mon Jul 27 11:52:04 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Jul 27 12:32:45 2026" }, "message": "[turbolev] Escape Analysis: invalidate new phis\u0027 backedges if needed\n\nFixed: 538652950\nBug: 529841774\nChange-Id: Ifd1304251a1a6e5db52a7fd720952a200358123d\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8153461\nAuto-Submit: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nCommit-Queue: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nReviewed-by: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nCommit-Queue: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108891}\n" }, { "commit": "73b4712d0facc7f8fe888abefd5a5cbdec159ba5", "tree": "e0874a903730c33b9ed34dd763c686ddb7d64314", "parents": [ "af1ff307151ed2bbb8b3cfdf1abe6f1aa6b5a998" ], "author": { "name": "Darius Mercadier", "email": "dmercadier@chromium.org", "time": "Wed Jul 22 10:57:52 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Jul 27 12:13:33 2026" }, "message": "[debug] Deoptimize topmost optimized frame on debugger break\n\nWhen the debugger pauses, it can execute arbitrary JS (e.g. via\nevaluation or inspector listeners). This JS can modify heap state,\nsuch as detaching ArrayBuffers.\n\nIf the execution stack contains optimized frames, they might be using\nload-eliminated values (like backing store pointers or array lengths)\nthat are now invalidated by the heap modifications.\n\nTo prevent use-after-free or out-of-bounds accesses when resuming,\ndeoptimize the topmost optimized JS frame when handling a debug break.\nWe only need to deoptimize the topmost frame because any caller frames\nare at a call site, which acts as a memory serialization barrier,\nforcing them to reload all heap state upon return anyway.\n\nTAG\u003dagy\nCONV\u003dbe1ec857-0c4b-479c-ba1b-e84d8741da83\n\nBug: 531297707\nChange-Id: I5e46963660eaa228a68422490e7495ec6f0d9f8a\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8131283\nAuto-Submit: Darius Mercadier \u003cdmercadier@chromium.org\u003e\nCommit-Queue: Leszek Swirski \u003cleszeks@chromium.org\u003e\nReviewed-by: Leszek Swirski \u003cleszeks@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108890}\n" }, { "commit": "af1ff307151ed2bbb8b3cfdf1abe6f1aa6b5a998", "tree": "257a205107b16cb358c9164f8f0d7e04fd46c2f0", "parents": [ "c5bca4e9bfc30b6c931eba832d49261f3cda3afd" ], "author": { "name": "Pierre Langlois", "email": "pierre.langlois@arm.com", "time": "Fri Jul 24 16:23:17 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Jul 27 11:08:49 2026" }, "message": "[arm64] Add a CPU::GetInstance() fast path to suspend tag checks\n\nSimilarly to Chrome and PartitionAlloc\u0027s CPU::GetInstanceNoAllocation()\nmethod.\n\nChange-Id: I418d6706c73c6e41681a0cc0da4b61c7aeb4f00a\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8138754\nReviewed-by: Michael Lippautz \u003cmlippautz@chromium.org\u003e\nCommit-Queue: Pierre Langlois \u003cpierre.langlois@arm.com\u003e\nCr-Commit-Position: refs/heads/main@{#108889}\n" }, { "commit": "c5bca4e9bfc30b6c931eba832d49261f3cda3afd", "tree": "5271722e923d9f1a7a92a066e59391e8cfc6c759", "parents": [ "115b643b94f8b0a8d9236f60ea56662bcbc071a4" ], "author": { "name": "Jakob Linke", "email": "jgruber@chromium.org", "time": "Mon Jul 27 06:00:40 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Jul 27 10:54:32 2026" }, "message": "[test] Name the tracing test\u0027s output so it is gitignored\n\nd8/regress-506689382 writes its trace into the source tree and nothing\nremoves it, so the file shows up as untracked after every run.\n\nIts sibling d8/enable-tracing has the same behavior but is invisible\nbecause its output, v8_trace.json, happens to match the v8_trace*.json\nrule in .gitignore. regress-506689382-v8-trace.json does not: it is\nprefixed and spells \"v8-trace\" with a hyphen.\n\nRename the output to v8_trace_506689382.json, which matches the existing\nrule and keeps one convention for these files.\n\nChange-Id: Id8f92a3fc892d91e65f282a9bb284c69edc11e39\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8152699\nCommit-Queue: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nReviewed-by: Victor Gomes \u003cvictorgomes@chromium.org\u003e\nAuto-Submit: Jakob Linke \u003cjgruber@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108888}\n" }, { "commit": "115b643b94f8b0a8d9236f60ea56662bcbc071a4", "tree": "35288a39c7247cc5777f10c1322fe90d2402482b", "parents": [ "e09f2260713e41fae9058975abbe2b184c47468d" ], "author": { "name": "Benedikt Meurer", "email": "bmeurer@chromium.org", "time": "Mon Jul 27 08:04:42 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Jul 27 10:48:08 2026" }, "message": "Remove myself from two OWNERS files.\n\nAlso add szuend@ instead of myself as owner for the profiler.\n\nBug: none\nChange-Id: I738a0afbbf013b416b82d50adc677562eea5f034\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8153279\nReviewed-by: Leszek Swirski \u003cleszeks@chromium.org\u003e\nAuto-Submit: Benedikt Meurer \u003cbmeurer@chromium.org\u003e\nCommit-Queue: Leszek Swirski \u003cleszeks@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108887}\n" }, { "commit": "e09f2260713e41fae9058975abbe2b184c47468d", "tree": "dbfce391d596d46484b3864aedc47e65a52b1bd6", "parents": [ "0830ec3668f4d9525a0a070ed4a7c84cfe380533" ], "author": { "name": "Michael Achenbach", "email": "machenbach@chromium.org", "time": "Mon Jul 27 10:13:50 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Jul 27 10:24:44 2026" }, "message": "[test] Skip slow tests on validate_generated_code variant\n\nNo-Try: true\nBug: 523128533\nChange-Id: I3dca9769e449ca137efe052e75f391d0b424dffe\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8151760\nReviewed-by: Matthias Liedtke \u003cmliedtke@chromium.org\u003e\nCommit-Queue: Matthias Liedtke \u003cmliedtke@chromium.org\u003e\nAuto-Submit: Michael Achenbach \u003cmachenbach@chromium.org\u003e\nReviewed-by: Omer Katz \u003comerkatz@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108886}\n" }, { "commit": "0830ec3668f4d9525a0a070ed4a7c84cfe380533", "tree": "dacfe0db422cc124e9ff92865e113e59379369fd", "parents": [ "77b32f91b9d3af53e2893fcd0f3feb6ba144e2fb" ], "author": { "name": "Matthias Liedtke", "email": "mliedtke@chromium.org", "time": "Thu Jul 23 13:15:11 2026" }, "committer": { "name": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "v8-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Jul 27 09:50:21 2026" }, "message": "[wasm] Fix load offset for null check of funcrefs\n\nA wasm function reference is an instance of WasmFuncRef, not\nWasmInternalFunction.\n\nFixed: 537709595\nChange-Id: I6f6e4de33347e0d2188608a2ff13059516e8d6d1\nReviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8138064\nCommit-Queue: Matthias Liedtke \u003cmliedtke@chromium.org\u003e\nReviewed-by: Manos Koukoutos \u003cmanoskouk@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#108885}\n" } ], "next": "77b32f91b9d3af53e2893fcd0f3feb6ba144e2fb" }