Skip to content

Commit 05f41cd

Browse files
targostargos
committed
deps: patch V8 to 9.0.257.19
Refs: v8/v8@9.0.257.17...9.0.257.19 PR-URL: #38270 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com>
1 parent 29faf0f commit 05f41cd

8 files changed

Lines changed: 139 additions & 17 deletions

File tree

‎deps/v8/AUTHORS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,7 @@ Ben Newman <ben@meteor.com>
6969
Ben Noordhuis <info@bnoordhuis.nl>
7070
Benjamin Tan <demoneaux@gmail.com>
7171
Bert Belder <bertbelder@gmail.com>
72+
Brendon Tiszka <btiszka@gmail.com>
7273
Brice Dobry <brice.dobry@futurewei.com>
7374
Burcu Dogan <burcujdogan@gmail.com>
7475
Caitlin Potter <caitpotter88@gmail.com>

‎deps/v8/include/v8-version.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
#defineV8_MAJOR_VERSION 9
1212
#defineV8_MINOR_VERSION 0
1313
#defineV8_BUILD_NUMBER 257
14-
#defineV8_PATCH_LEVEL17
14+
#defineV8_PATCH_LEVEL19
1515

1616
// Use 1 for candidates and 0 otherwise.
1717
// (Boolean macro values are not supported by all preprocessors.)

‎deps/v8/src/builtins/builtins-array.cc‎

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -650,11 +650,14 @@ class ArrayConcatVisitor {
650650
index_offset_(0u),
651651
bit_field_(FastElementsField::encode(fast_elements) |
652652
ExceedsLimitField::encode(false) |
653-
IsFixedArrayField::encode(storage->IsFixedArray()) |
653+
IsFixedArrayField::encode(storage->IsFixedArray(isolate)) |
654654
HasSimpleElementsField::encode(
655-
storage->IsFixedArray() ||
656-
!storage->map().IsCustomElementsReceiverMap())) {
657-
DCHECK(!(this->fast_elements() && !is_fixed_array()));
655+
storage->IsFixedArray(isolate) ||
656+
// Don't take fast path for storages that might have
657+
// side effects when storing to them.
658+
(!storage->map(isolate).IsCustomElementsReceiverMap() &&
659+
!storage->IsJSTypedArray(isolate)))) {
660+
DCHECK_IMPLIES(this->fast_elements(), is_fixed_array());
658661
}
659662

660663
~ArrayConcatVisitor() { clear_storage(); }
@@ -1065,8 +1068,8 @@ bool IterateElements(Isolate* isolate, Handle<JSReceiver> receiver,
10651068
returnIterateElementsSlow(isolate, receiver, length, visitor);
10661069
}
10671070

1068-
if (!HasOnlySimpleElements(isolate, *receiver) ||
1069-
!visitor->has_simple_elements()) {
1071+
if (!visitor->has_simple_elements() ||
1072+
!HasOnlySimpleElements(isolate, *receiver)) {
10701073
returnIterateElementsSlow(isolate, receiver, length, visitor);
10711074
}
10721075
Handle<JSObject> array = Handle<JSObject>::cast(receiver);
@@ -1082,6 +1085,9 @@ bool IterateElements(Isolate* isolate, Handle<JSReceiver> receiver,
10821085
caseHOLEY_SEALED_ELEMENTS:
10831086
caseHOLEY_NONEXTENSIBLE_ELEMENTS:
10841087
caseHOLEY_ELEMENTS: {
1088+
// Disallow execution so the cached elements won't change mid execution.
1089+
DisallowJavascriptExecution no_js(isolate);
1090+
10851091
// Run through the elements FixedArray and use HasElement and GetElement
10861092
// to check the prototype for missing elements.
10871093
Handle<FixedArray> elements(FixedArray::cast(array->elements()), isolate);
@@ -1108,6 +1114,9 @@ bool IterateElements(Isolate* isolate, Handle<JSReceiver> receiver,
11081114
}
11091115
caseHOLEY_DOUBLE_ELEMENTS:
11101116
casePACKED_DOUBLE_ELEMENTS: {
1117+
// Disallow execution so the cached elements won't change mid execution.
1118+
DisallowJavascriptExecution no_js(isolate);
1119+
11111120
// Empty array is FixedArray but not FixedDoubleArray.
11121121
if (length == 0) break;
11131122
// Run through the elements FixedArray and use HasElement and GetElement
@@ -1144,6 +1153,9 @@ bool IterateElements(Isolate* isolate, Handle<JSReceiver> receiver,
11441153
}
11451154

11461155
caseDICTIONARY_ELEMENTS: {
1156+
// Disallow execution so the cached dictionary won't change mid execution.
1157+
DisallowJavascriptExecution no_js(isolate);
1158+
11471159
Handle<NumberDictionary> dict(array->element_dictionary(), isolate);
11481160
std::vector<uint32_t> indices;
11491161
indices.reserve(dict->Capacity() / 2);

‎deps/v8/src/compiler/representation-change.cc‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -949,10 +949,10 @@ Node* RepresentationChanger::GetWord32RepresentationFor(
949949
return node;
950950
} elseif (output_rep == MachineRepresentation::kWord64) {
951951
if (output_type.Is(Type::Signed32()) ||
952-
output_type.Is(Type::Unsigned32())) {
953-
op = machine()->TruncateInt64ToInt32();
954-
} elseif (output_type.Is(cache_->kSafeInteger) &&
955-
use_info.truncation().IsUsedAsWord32()) {
952+
(output_type.Is(Type::Unsigned32()) &&
953+
use_info.type_check() == TypeCheckKind::kNone) ||
954+
(output_type.Is(cache_->kSafeInteger) &&
955+
use_info.truncation().IsUsedAsWord32())) {
956956
op = machine()->TruncateInt64ToInt32();
957957
} elseif (use_info.type_check() == TypeCheckKind::kSignedSmall ||
958958
use_info.type_check() == TypeCheckKind::kSigned32 ||

‎deps/v8/src/objects/fixed-array-inl.h‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -368,15 +368,15 @@ int Search(T* array, Name name, int valid_entries, int* out_insertion_index,
368368
doubleFixedDoubleArray::get_scalar(int index) {
369369
DCHECK(map() != GetReadOnlyRoots().fixed_cow_array_map() &&
370370
map() != GetReadOnlyRoots().fixed_array_map());
371-
DCHECK(index >= 0 && index < this->length());
371+
DCHECK_LT(static_cast<unsigned>(index), static_cast<unsigned>(length()));
372372
DCHECK(!is_the_hole(index));
373373
return ReadField<double>(kHeaderSize + index * kDoubleSize);
374374
}
375375

376376
uint64_tFixedDoubleArray::get_representation(int index) {
377377
DCHECK(map() != GetReadOnlyRoots().fixed_cow_array_map() &&
378378
map() != GetReadOnlyRoots().fixed_array_map());
379-
DCHECK(index >= 0 && index < this->length());
379+
DCHECK_LT(static_cast<unsigned>(index), static_cast<unsigned>(length()));
380380
int offset = kHeaderSize + index * kDoubleSize;
381381
// Bug(v8:8875): Doubles may be unaligned.
382382
return base::ReadUnalignedValue<uint64_t>(field_address(offset));
@@ -394,6 +394,7 @@ Handle<Object> FixedDoubleArray::get(FixedDoubleArray array, int index,
394394
voidFixedDoubleArray::set(int index, double value) {
395395
DCHECK(map() != GetReadOnlyRoots().fixed_cow_array_map() &&
396396
map() != GetReadOnlyRoots().fixed_array_map());
397+
DCHECK_LT(static_cast<unsigned>(index), static_cast<unsigned>(length()));
397398
int offset = kHeaderSize + index * kDoubleSize;
398399
if (std::isnan(value)) {
399400
WriteField<double>(offset, std::numeric_limits<double>::quiet_NaN());
@@ -410,6 +411,7 @@ void FixedDoubleArray::set_the_hole(Isolate* isolate, int index) {
410411
voidFixedDoubleArray::set_the_hole(int index) {
411412
DCHECK(map() != GetReadOnlyRoots().fixed_cow_array_map() &&
412413
map() != GetReadOnlyRoots().fixed_array_map());
414+
DCHECK_LT(static_cast<unsigned>(index), static_cast<unsigned>(length()));
413415
int offset = kHeaderSize + index * kDoubleSize;
414416
base::WriteUnalignedValue<uint64_t>(field_address(offset), kHoleNanInt64);
415417
}

‎deps/v8/src/objects/map-updater.cc‎

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -139,11 +139,20 @@ Handle<Map> MapUpdater::ReconfigureToDataField(InternalIndex descriptor,
139139
if (old_details.constness() == PropertyConstness::kConst &&
140140
old_details.location() == kField &&
141141
old_details.attributes() != new_attributes_) {
142+
// Ensure we'll be updating constness of the up-to-date version of old_map_.
143+
Handle<Map> old_map = Map::Update(isolate_, old_map_);
144+
PropertyDetails details =
145+
old_map->instance_descriptors(kRelaxedLoad).GetDetails(descriptor);
142146
Handle<FieldType> field_type(
143-
old_descriptors_->GetFieldType(modified_descriptor_), isolate_);
144-
Map::GeneralizeField(isolate_, old_map_, descriptor,
145-
PropertyConstness::kMutable,
146-
old_details.representation(), field_type);
147+
old_map->instance_descriptors(kRelaxedLoad).GetFieldType(descriptor),
148+
isolate_);
149+
Map::GeneralizeField(isolate_, old_map, descriptor,
150+
PropertyConstness::kMutable, details.representation(),
151+
field_type);
152+
DCHECK_EQ(PropertyConstness::kMutable,
153+
old_map->instance_descriptors(kRelaxedLoad)
154+
.GetDetails(descriptor)
155+
.constness());
147156
// The old_map_'s property must become mutable.
148157
// Note, that the {old_map_} and {old_descriptors_} are not expected to be
149158
// updated by the generalization if the map is already deprecated.

‎deps/v8/test/mjsunit/compiler/regress-1195777.js‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
// Copyright 2021 the V8 project authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style license that can be
3+
// found in the LICENSE file.
4+
5+
// Flags: --allow-natives-syntax
6+
7+
8+
(function(){
9+
functionfoo(b){
10+
lety=(newDate(42)).getMilliseconds();
11+
letx=-1;
12+
if(b)x=0xFFFF_FFFF;
13+
returny<Math.max(1<<y,x,1+y);
14+
}
15+
assertTrue(foo(true));
16+
%PrepareFunctionForOptimization(foo);
17+
assertTrue(foo(false));
18+
%OptimizeFunctionOnNextCall(foo);
19+
assertTrue(foo(true));
20+
})();
21+
22+
23+
(function(){
24+
functionfoo(b){
25+
letx=0;
26+
if(b)x=-1;
27+
returnx==Math.max(-1,x>>>Infinity);
28+
}
29+
assertFalse(foo(true));
30+
%PrepareFunctionForOptimization(foo);
31+
assertTrue(foo(false));
32+
%OptimizeFunctionOnNextCall(foo);
33+
assertFalse(foo(true));
34+
})();
35+
36+
37+
(function(){
38+
functionfoo(b){
39+
letx=-1;
40+
if(b)x=0xFFFF_FFFF;
41+
return-1<Math.max(0,x,-1);
42+
}
43+
assertTrue(foo(true));
44+
%PrepareFunctionForOptimization(foo);
45+
assertTrue(foo(false));
46+
%OptimizeFunctionOnNextCall(foo);
47+
assertTrue(foo(true));
48+
})();
49+
50+
51+
(function(){
52+
functionfoo(b){
53+
letx=0x7FFF_FFFF;
54+
if(b)x=0;
55+
return0<(Math.max(-5>>>x,-5)%-5);
56+
}
57+
assertTrue(foo(true));
58+
%PrepareFunctionForOptimization(foo);
59+
assertTrue(foo(false));
60+
%OptimizeFunctionOnNextCall(foo);
61+
assertTrue(foo(true));
62+
})();

‎deps/v8/test/mjsunit/regress/regress-crbug-1195331.js‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
// Copyright 2021 the V8 project authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style license that can be
3+
// found in the LICENSE file.
4+
5+
// Flags: --allow-natives-syntax
6+
7+
leto1={a: 1,b: 0};
8+
leto2={a: 2,b: 0};
9+
assertTrue(%HaveSameMap(o1,o2));
10+
assertTrue(%HasOwnConstDataProperty(o1,"a"));
11+
assertTrue(%HasOwnConstDataProperty(o1,"b"));
12+
13+
Object.defineProperty(o1,"b",{
14+
value: 4.2,enumerable: true,configurable: true,writable: true,
15+
});
16+
assertFalse(%HaveSameMap(o1,o2));
17+
assertTrue(%HasOwnConstDataProperty(o1,"a"));
18+
assertFalse(%HasOwnConstDataProperty(o1,"b"));
19+
assertTrue(%HasOwnConstDataProperty(o2,"a"));
20+
assertTrue(%HasOwnConstDataProperty(o2,"b"));
21+
22+
leto3={a: "foo",b: 0};
23+
assertFalse(%HaveSameMap(o2,o3));
24+
assertTrue(%HasOwnConstDataProperty(o3,"a"));
25+
assertFalse(%HasOwnConstDataProperty(o3,"b"));
26+
27+
Object.defineProperty(o2,"a",{
28+
value:2,enumerable: false,configurable: true,writable: true,
29+
});
30+
assertFalse(%HasOwnConstDataProperty(o1,"a"));
31+
assertFalse(%HasOwnConstDataProperty(o1,"b"));
32+
assertFalse(%HasOwnConstDataProperty(o3,"a"));
33+
assertFalse(%HasOwnConstDataProperty(o3,"b"));
34+
35+
assertFalse(%HasOwnConstDataProperty(o2,"a"));
36+
assertTrue(%HasOwnConstDataProperty(o2,"b"));

0 commit comments

Comments
 (0)