Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 05f41cd

Browse filesBrowse files
targostargos
committed
deps: patch V8 to 9.0.257.19
Refs: v8/v8@9.0.257.17...9.0.257.19 PR-URL: #38270 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com>
1 parent 29faf0f commit 05f41cd
Copy full SHA for 05f41cd

File tree

Expand file treeCollapse file tree

8 files changed

+139
-17
lines changed
Open diff view settings
Filter options
Expand file treeCollapse file tree

8 files changed

+139
-17
lines changed
Open diff view settings
Collapse file

‎deps/v8/AUTHORS‎

Copy file name to clipboardExpand all lines: deps/v8/AUTHORS
+1Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,7 @@ Ben Newman <ben@meteor.com>
6969
Ben Noordhuis <info@bnoordhuis.nl>
7070
Benjamin Tan <demoneaux@gmail.com>
7171
Bert Belder <bertbelder@gmail.com>
72+
Brendon Tiszka <btiszka@gmail.com>
7273
Brice Dobry <brice.dobry@futurewei.com>
7374
Burcu Dogan <burcujdogan@gmail.com>
7475
Caitlin Potter <caitpotter88@gmail.com>
Collapse file

‎deps/v8/include/v8-version.h‎

Copy file name to clipboardExpand all lines: deps/v8/include/v8-version.h
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
#define V8_MAJOR_VERSION 9
1212
#define V8_MINOR_VERSION 0
1313
#define V8_BUILD_NUMBER 257
14-
#define V8_PATCH_LEVEL 17
14+
#define V8_PATCH_LEVEL 19
1515

1616
// Use 1 for candidates and 0 otherwise.
1717
// (Boolean macro values are not supported by all preprocessors.)
Collapse file

‎deps/v8/src/builtins/builtins-array.cc‎

Copy file name to clipboardExpand all lines: deps/v8/src/builtins/builtins-array.cc
+18-6Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -650,11 +650,14 @@ class ArrayConcatVisitor {
650650
index_offset_(0u),
651651
bit_field_(FastElementsField::encode(fast_elements) |
652652
ExceedsLimitField::encode(false) |
653-
IsFixedArrayField::encode(storage->IsFixedArray()) |
653+
IsFixedArrayField::encode(storage->IsFixedArray(isolate)) |
654654
HasSimpleElementsField::encode(
655-
storage->IsFixedArray() ||
656-
!storage->map().IsCustomElementsReceiverMap())) {
657-
DCHECK(!(this->fast_elements() && !is_fixed_array()));
655+
storage->IsFixedArray(isolate) ||
656+
// Don't take fast path for storages that might have
657+
// side effects when storing to them.
658+
(!storage->map(isolate).IsCustomElementsReceiverMap() &&
659+
!storage->IsJSTypedArray(isolate)))) {
660+
DCHECK_IMPLIES(this->fast_elements(), is_fixed_array());
658661
}
659662

660663
~ArrayConcatVisitor() { clear_storage(); }
@@ -1065,8 +1068,8 @@ bool IterateElements(Isolate* isolate, Handle<JSReceiver> receiver,
10651068
return IterateElementsSlow(isolate, receiver, length, visitor);
10661069
}
10671070

1068-
if (!HasOnlySimpleElements(isolate, *receiver) ||
1069-
!visitor->has_simple_elements()) {
1071+
if (!visitor->has_simple_elements() ||
1072+
!HasOnlySimpleElements(isolate, *receiver)) {
10701073
return IterateElementsSlow(isolate, receiver, length, visitor);
10711074
}
10721075
Handle<JSObject> array = Handle<JSObject>::cast(receiver);
@@ -1082,6 +1085,9 @@ bool IterateElements(Isolate* isolate, Handle<JSReceiver> receiver,
10821085
case HOLEY_SEALED_ELEMENTS:
10831086
case HOLEY_NONEXTENSIBLE_ELEMENTS:
10841087
case HOLEY_ELEMENTS: {
1088+
// Disallow execution so the cached elements won't change mid execution.
1089+
DisallowJavascriptExecution no_js(isolate);
1090+
10851091
// Run through the elements FixedArray and use HasElement and GetElement
10861092
// to check the prototype for missing elements.
10871093
Handle<FixedArray> elements(FixedArray::cast(array->elements()), isolate);
@@ -1108,6 +1114,9 @@ bool IterateElements(Isolate* isolate, Handle<JSReceiver> receiver,
11081114
}
11091115
case HOLEY_DOUBLE_ELEMENTS:
11101116
case PACKED_DOUBLE_ELEMENTS: {
1117+
// Disallow execution so the cached elements won't change mid execution.
1118+
DisallowJavascriptExecution no_js(isolate);
1119+
11111120
// Empty array is FixedArray but not FixedDoubleArray.
11121121
if (length == 0) break;
11131122
// Run through the elements FixedArray and use HasElement and GetElement
@@ -1144,6 +1153,9 @@ bool IterateElements(Isolate* isolate, Handle<JSReceiver> receiver,
11441153
}
11451154

11461155
case DICTIONARY_ELEMENTS: {
1156+
// Disallow execution so the cached dictionary won't change mid execution.
1157+
DisallowJavascriptExecution no_js(isolate);
1158+
11471159
Handle<NumberDictionary> dict(array->element_dictionary(), isolate);
11481160
std::vector<uint32_t> indices;
11491161
indices.reserve(dict->Capacity() / 2);
Collapse file

‎deps/v8/src/compiler/representation-change.cc‎

Copy file name to clipboardExpand all lines: deps/v8/src/compiler/representation-change.cc
+4-4Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -949,10 +949,10 @@ Node* RepresentationChanger::GetWord32RepresentationFor(
949949
return node;
950950
} else if (output_rep == MachineRepresentation::kWord64) {
951951
if (output_type.Is(Type::Signed32()) ||
952-
output_type.Is(Type::Unsigned32())) {
953-
op = machine()->TruncateInt64ToInt32();
954-
} else if (output_type.Is(cache_->kSafeInteger) &&
955-
use_info.truncation().IsUsedAsWord32()) {
952+
(output_type.Is(Type::Unsigned32()) &&
953+
use_info.type_check() == TypeCheckKind::kNone) ||
954+
(output_type.Is(cache_->kSafeInteger) &&
955+
use_info.truncation().IsUsedAsWord32())) {
956956
op = machine()->TruncateInt64ToInt32();
957957
} else if (use_info.type_check() == TypeCheckKind::kSignedSmall ||
958958
use_info.type_check() == TypeCheckKind::kSigned32 ||
Collapse file

‎deps/v8/src/objects/fixed-array-inl.h‎

Copy file name to clipboardExpand all lines: deps/v8/src/objects/fixed-array-inl.h
+4-2Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -368,15 +368,15 @@ int Search(T* array, Name name, int valid_entries, int* out_insertion_index,
368368
double FixedDoubleArray::get_scalar(int index) {
369369
DCHECK(map() != GetReadOnlyRoots().fixed_cow_array_map() &&
370370
map() != GetReadOnlyRoots().fixed_array_map());
371-
DCHECK(index >= 0 && index < this->length());
371+
DCHECK_LT(static_cast<unsigned>(index), static_cast<unsigned>(length()));
372372
DCHECK(!is_the_hole(index));
373373
return ReadField<double>(kHeaderSize + index * kDoubleSize);
374374
}
375375

376376
uint64_t FixedDoubleArray::get_representation(int index) {
377377
DCHECK(map() != GetReadOnlyRoots().fixed_cow_array_map() &&
378378
map() != GetReadOnlyRoots().fixed_array_map());
379-
DCHECK(index >= 0 && index < this->length());
379+
DCHECK_LT(static_cast<unsigned>(index), static_cast<unsigned>(length()));
380380
int offset = kHeaderSize + index * kDoubleSize;
381381
// Bug(v8:8875): Doubles may be unaligned.
382382
return base::ReadUnalignedValue<uint64_t>(field_address(offset));
@@ -394,6 +394,7 @@ Handle<Object> FixedDoubleArray::get(FixedDoubleArray array, int index,
394394
void FixedDoubleArray::set(int index, double value) {
395395
DCHECK(map() != GetReadOnlyRoots().fixed_cow_array_map() &&
396396
map() != GetReadOnlyRoots().fixed_array_map());
397+
DCHECK_LT(static_cast<unsigned>(index), static_cast<unsigned>(length()));
397398
int offset = kHeaderSize + index * kDoubleSize;
398399
if (std::isnan(value)) {
399400
WriteField<double>(offset, std::numeric_limits<double>::quiet_NaN());
@@ -410,6 +411,7 @@ void FixedDoubleArray::set_the_hole(Isolate* isolate, int index) {
410411
void FixedDoubleArray::set_the_hole(int index) {
411412
DCHECK(map() != GetReadOnlyRoots().fixed_cow_array_map() &&
412413
map() != GetReadOnlyRoots().fixed_array_map());
414+
DCHECK_LT(static_cast<unsigned>(index), static_cast<unsigned>(length()));
413415
int offset = kHeaderSize + index * kDoubleSize;
414416
base::WriteUnalignedValue<uint64_t>(field_address(offset), kHoleNanInt64);
415417
}
Collapse file

‎deps/v8/src/objects/map-updater.cc‎

Copy file name to clipboardExpand all lines: deps/v8/src/objects/map-updater.cc
+13-4Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -139,11 +139,20 @@ Handle<Map> MapUpdater::ReconfigureToDataField(InternalIndex descriptor,
139139
if (old_details.constness() == PropertyConstness::kConst &&
140140
old_details.location() == kField &&
141141
old_details.attributes() != new_attributes_) {
142+
// Ensure we'll be updating constness of the up-to-date version of old_map_.
143+
Handle<Map> old_map = Map::Update(isolate_, old_map_);
144+
PropertyDetails details =
145+
old_map->instance_descriptors(kRelaxedLoad).GetDetails(descriptor);
142146
Handle<FieldType> field_type(
143-
old_descriptors_->GetFieldType(modified_descriptor_), isolate_);
144-
Map::GeneralizeField(isolate_, old_map_, descriptor,
145-
PropertyConstness::kMutable,
146-
old_details.representation(), field_type);
147+
old_map->instance_descriptors(kRelaxedLoad).GetFieldType(descriptor),
148+
isolate_);
149+
Map::GeneralizeField(isolate_, old_map, descriptor,
150+
PropertyConstness::kMutable, details.representation(),
151+
field_type);
152+
DCHECK_EQ(PropertyConstness::kMutable,
153+
old_map->instance_descriptors(kRelaxedLoad)
154+
.GetDetails(descriptor)
155+
.constness());
147156
// The old_map_'s property must become mutable.
148157
// Note, that the {old_map_} and {old_descriptors_} are not expected to be
149158
// updated by the generalization if the map is already deprecated.
Collapse file

‎deps/v8/test/mjsunit/compiler/regress-1195777.js‎

Copy file name to clipboard
+62Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
// Copyright 2021 the V8 project authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style license that can be
3+
// found in the LICENSE file.
4+
5+
// Flags: --allow-natives-syntax
6+
7+
8+
(function() {
9+
function foo(b) {
10+
let y = (new Date(42)).getMilliseconds();
11+
let x = -1;
12+
if (b) x = 0xFFFF_FFFF;
13+
return y < Math.max(1 << y, x, 1 + y);
14+
}
15+
assertTrue(foo(true));
16+
%PrepareFunctionForOptimization(foo);
17+
assertTrue(foo(false));
18+
%OptimizeFunctionOnNextCall(foo);
19+
assertTrue(foo(true));
20+
})();
21+
22+
23+
(function() {
24+
function foo(b) {
25+
let x = 0;
26+
if (b) x = -1;
27+
return x == Math.max(-1, x >>> Infinity);
28+
}
29+
assertFalse(foo(true));
30+
%PrepareFunctionForOptimization(foo);
31+
assertTrue(foo(false));
32+
%OptimizeFunctionOnNextCall(foo);
33+
assertFalse(foo(true));
34+
})();
35+
36+
37+
(function() {
38+
function foo(b) {
39+
let x = -1;
40+
if (b) x = 0xFFFF_FFFF;
41+
return -1 < Math.max(0, x, -1);
42+
}
43+
assertTrue(foo(true));
44+
%PrepareFunctionForOptimization(foo);
45+
assertTrue(foo(false));
46+
%OptimizeFunctionOnNextCall(foo);
47+
assertTrue(foo(true));
48+
})();
49+
50+
51+
(function() {
52+
function foo(b) {
53+
let x = 0x7FFF_FFFF;
54+
if (b) x = 0;
55+
return 0 < (Math.max(-5 >>> x, -5) % -5);
56+
}
57+
assertTrue(foo(true));
58+
%PrepareFunctionForOptimization(foo);
59+
assertTrue(foo(false));
60+
%OptimizeFunctionOnNextCall(foo);
61+
assertTrue(foo(true));
62+
})();
Collapse file

‎deps/v8/test/mjsunit/regress/regress-crbug-1195331.js‎

Copy file name to clipboard
+36Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
// Copyright 2021 the V8 project authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style license that can be
3+
// found in the LICENSE file.
4+
5+
// Flags: --allow-natives-syntax
6+
7+
let o1 = { a: 1, b: 0 };
8+
let o2 = { a: 2, b: 0 };
9+
assertTrue(%HaveSameMap(o1, o2));
10+
assertTrue(%HasOwnConstDataProperty(o1, "a"));
11+
assertTrue(%HasOwnConstDataProperty(o1, "b"));
12+
13+
Object.defineProperty(o1, "b", {
14+
value: 4.2, enumerable: true, configurable: true, writable: true,
15+
});
16+
assertFalse(%HaveSameMap(o1, o2));
17+
assertTrue(%HasOwnConstDataProperty(o1, "a"));
18+
assertFalse(%HasOwnConstDataProperty(o1, "b"));
19+
assertTrue(%HasOwnConstDataProperty(o2, "a"));
20+
assertTrue(%HasOwnConstDataProperty(o2, "b"));
21+
22+
let o3 = { a: "foo", b: 0 };
23+
assertFalse(%HaveSameMap(o2, o3));
24+
assertTrue(%HasOwnConstDataProperty(o3, "a"));
25+
assertFalse(%HasOwnConstDataProperty(o3, "b"));
26+
27+
Object.defineProperty(o2, "a", {
28+
value:2, enumerable: false, configurable: true, writable: true,
29+
});
30+
assertFalse(%HasOwnConstDataProperty(o1, "a"));
31+
assertFalse(%HasOwnConstDataProperty(o1, "b"));
32+
assertFalse(%HasOwnConstDataProperty(o3, "a"));
33+
assertFalse(%HasOwnConstDataProperty(o3, "b"));
34+
35+
assertFalse(%HasOwnConstDataProperty(o2, "a"));
36+
assertTrue(%HasOwnConstDataProperty(o2, "b"));

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.