Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 8716146

Browse filesBrowse files
nodejs-github-botnodejs-github-bot
authored
deps: patch V8 to 14.3.127.14
Refs: v8/v8@14.3.127.12...14.3.127.14 PR-URL: #60743 Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
1 parent adb4043 commit 8716146
Copy full SHA for 8716146

9 files changed

+116-28Lines changed: 116 additions & 28 deletions
Expand file treeCollapse file tree
Open diff view settings
Collapse file

‎deps/v8/include/v8-version.h‎

Copy file name to clipboardExpand all lines: deps/v8/include/v8-version.h
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
#define V8_MAJOR_VERSION 14
1212
#define V8_MINOR_VERSION 3
1313
#define V8_BUILD_NUMBER 127
14-
#define V8_PATCH_LEVEL 12
14+
#define V8_PATCH_LEVEL 14
1515

1616
// Use 1 for candidates and 0 otherwise.
1717
// (Boolean macro values are not supported by all preprocessors.)
Collapse file

‎deps/v8/src/compiler/access-builder.cc‎

Copy file name to clipboardExpand all lines: deps/v8/src/compiler/access-builder.cc
+11-5Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@
44

55
#include "src/compiler/access-builder.h"
66

7+
#include "src/codegen/machine-type.h"
8+
#include "src/compiler/property-access-builder.h"
79
#include "src/compiler/type-cache.h"
810
#include "src/handles/handles-inl.h"
911
#include "src/objects/arguments.h"
@@ -1097,12 +1099,16 @@ FieldAccess AccessBuilder::ForFeedbackVectorSlot(int index) {
10971099
}
10981100

10991101
// static
1100-
FieldAccess AccessBuilder::ForPropertyArraySlot(int index) {
1102+
FieldAccess AccessBuilder::ForPropertyArraySlot(int index,
1103+
Representation representation) {
11011104
int offset = PropertyArray::OffsetOfElementAt(index);
1102-
FieldAccess access = {kTaggedBase, offset,
1103-
Handle<Name>(), OptionalMapRef(),
1104-
Type::Any(), MachineType::AnyTagged(),
1105-
kFullWriteBarrier, "PropertyArraySlot"};
1105+
MachineType machine_type =
1106+
representation.IsHeapObject() || representation.IsDouble()
1107+
? MachineType::TaggedPointer()
1108+
: MachineType::AnyTagged();
1109+
FieldAccess access = {
1110+
kTaggedBase, offset, Handle<Name>(), OptionalMapRef(),
1111+
Type::Any(), machine_type, kFullWriteBarrier, "PropertyArraySlot"};
11061112
return access;
11071113
}
11081114

Collapse file

‎deps/v8/src/compiler/access-builder.h‎

Copy file name to clipboardExpand all lines: deps/v8/src/compiler/access-builder.h
+3-1Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
#include "src/compiler/write-barrier-kind.h"
1212
#include "src/objects/elements-kind.h"
1313
#include "src/objects/js-objects.h"
14+
#include "src/objects/property-details.h"
1415

1516
namespace v8 {
1617
namespace internal {
@@ -323,7 +324,8 @@ class V8_EXPORT_PRIVATE AccessBuilder final
323324
static FieldAccess ForFeedbackVectorSlot(int index);
324325

325326
// Provides access to PropertyArray slots.
326-
static FieldAccess ForPropertyArraySlot(int index);
327+
static FieldAccess ForPropertyArraySlot(int index,
328+
Representation representation);
327329

328330
// Provides access to ScopeInfo flags.
329331
static FieldAccess ForScopeInfoFlags();
Collapse file

‎deps/v8/src/compiler/js-native-context-specialization.cc‎

Copy file name to clipboardExpand all lines: deps/v8/src/compiler/js-native-context-specialization.cc
+43-7Lines changed: 43 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@
3838
#include "src/objects/elements-kind.h"
3939
#include "src/objects/feedback-vector.h"
4040
#include "src/objects/heap-number.h"
41+
#include "src/objects/property-details.h"
4142
#include "src/objects/string.h"
4243

4344
namespace v8 {
@@ -4235,25 +4236,59 @@ Node* JSNativeContextSpecialization::BuildExtendPropertiesBackingStore(
42354236
// for intermediate states of chains of property additions. That makes
42364237
// it unclear what the best approach is here.
42374238
DCHECK_EQ(map.UnusedPropertyFields(), 0);
4238-
int length = map.NextFreePropertyIndex() - map.GetInObjectProperties();
4239+
int in_object_length = map.GetInObjectProperties();
4240+
int length = map.NextFreePropertyIndex() - in_object_length;
42394241
// Under normal circumstances, NextFreePropertyIndex() will always be larger
42404242
// than GetInObjectProperties(). However, an attacker able to corrupt heap
42414243
// memory can break this invariant, in which case we'll get confused here,
42424244
// potentially causing a sandbox violation. This CHECK defends against that.
42434245
SBXCHECK_GE(length, 0);
42444246
int new_length = length + JSObject::kFieldsAdded;
4247+
4248+
// Find the descriptor index corresponding to the first out-of-object
4249+
// property.
4250+
DescriptorArrayRef descs = map.instance_descriptors(broker());
4251+
InternalIndex first_out_of_object_descriptor(in_object_length);
4252+
InternalIndex number_of_descriptors(descs.object()->number_of_descriptors());
4253+
for (InternalIndex i(in_object_length); i < number_of_descriptors; ++i) {
4254+
PropertyDetails details = descs.GetPropertyDetails(i);
4255+
// Skip over non-field properties.
4256+
if (details.location() != PropertyLocation::kField) {
4257+
continue;
4258+
}
4259+
// Skip over in-object fields.
4260+
// TODO(leszeks): We could make this smarter, like a binary search.
4261+
if (details.field_index() < in_object_length) {
4262+
continue;
4263+
}
4264+
first_out_of_object_descriptor = i;
4265+
break;
4266+
}
4267+
42454268
// Collect the field values from the {properties}.
4246-
ZoneVector<Node*> values(zone());
4269+
ZoneVector<std::pair<Node*, Representation>> values(zone());
42474270
values.reserve(new_length);
4248-
for (int i = 0; i < length; ++i) {
4271+
4272+
// Walk the property descriptors alongside the property values, to make
4273+
// sure to get and store them with the right machine type.
4274+
InternalIndex descriptor = first_out_of_object_descriptor;
4275+
for (int i = 0; i < length; ++i, ++descriptor) {
4276+
PropertyDetails details = descs.GetPropertyDetails(descriptor);
4277+
while (details.location() != PropertyLocation::kField) {
4278+
++descriptor;
4279+
details = descs.GetPropertyDetails(descriptor);
4280+
}
4281+
DCHECK_EQ(i, details.field_index() - in_object_length);
42494282
Node* value = effect = graph()->NewNode(
4250-
simplified()->LoadField(AccessBuilder::ForFixedArraySlot(i)),
4283+
simplified()->LoadField(
4284+
AccessBuilder::ForPropertyArraySlot(i, details.representation())),
42514285
properties, effect, control);
4252-
values.push_back(value);
4286+
values.push_back({value, details.representation()});
42534287
}
42544288
// Initialize the new fields to undefined.
42554289
for (int i = 0; i < JSObject::kFieldsAdded; ++i) {
4256-
values.push_back(jsgraph()->UndefinedConstant());
4290+
values.push_back(
4291+
{jsgraph()->UndefinedConstant(), Representation::Tagged()});
42574292
}
42584293

42594294
// Compute new length and hash.
@@ -4291,7 +4326,8 @@ Node* JSNativeContextSpecialization::BuildExtendPropertiesBackingStore(
42914326
a.Store(AccessBuilder::ForMap(), jsgraph()->PropertyArrayMapConstant());
42924327
a.Store(AccessBuilder::ForPropertyArrayLengthAndHash(), new_length_and_hash);
42934328
for (int i = 0; i < new_length; ++i) {
4294-
a.Store(AccessBuilder::ForFixedArraySlot(i), values[i]);
4329+
a.Store(AccessBuilder::ForPropertyArraySlot(i, values[i].second),
4330+
values[i].first);
42954331
}
42964332
return a.Finish();
42974333
}
Collapse file

‎deps/v8/src/compiler/turboshaft/turbolev-early-lowering-reducer-inl.h‎

Copy file name to clipboardExpand all lines: deps/v8/src/compiler/turboshaft/turbolev-early-lowering-reducer-inl.h
+40-5Lines changed: 40 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
#include "src/compiler/turboshaft/representations.h"
1515
#include "src/deoptimizer/deoptimize-reason.h"
1616
#include "src/objects/contexts.h"
17+
#include "src/objects/descriptor-array-inl.h"
1718
#include "src/objects/instance-type-inl.h"
1819

1920
namespace v8::internal::compiler::turboshaft {
@@ -325,8 +326,32 @@ class TurbolevEarlyLoweringReducer : public Next {
325326
}
326327

327328
V<PropertyArray> ExtendPropertiesBackingStore(
328-
V<PropertyArray> old_property_array, V<JSObject> object, int old_length,
329+
V<PropertyArray> old_property_array, V<JSObject> object,
330+
const compiler::MapRef& old_map, int old_length,
329331
V<FrameState> frame_state, const FeedbackSource& feedback) {
332+
int in_object_length = old_map.GetInObjectProperties();
333+
334+
// Find the descriptor index corresponding to the first out-of-object
335+
// property.
336+
DescriptorArrayRef descs = old_map.instance_descriptors(broker_);
337+
InternalIndex first_out_of_object_descriptor(in_object_length);
338+
InternalIndex number_of_descriptors(
339+
descs.object()->number_of_descriptors());
340+
for (InternalIndex i(in_object_length); i < number_of_descriptors; ++i) {
341+
PropertyDetails details = descs.GetPropertyDetails(i);
342+
// Skip over non-field properties.
343+
if (details.location() != PropertyLocation::kField) {
344+
continue;
345+
}
346+
// Skip over in-object fields.
347+
// TODO(leszeks): We could make this smarter, like a binary search.
348+
if (details.field_index() < in_object_length) {
349+
continue;
350+
}
351+
first_out_of_object_descriptor = i;
352+
break;
353+
}
354+
330355
// Allocate new PropertyArray.
331356
int new_length = old_length + JSObject::kFieldsAdded;
332357
Uninitialized<PropertyArray> new_property_array =
@@ -337,18 +362,28 @@ class TurbolevEarlyLoweringReducer : public Next {
337362
__ HeapConstant(factory_->property_array_map()));
338363

339364
// Copy existing properties over.
340-
for (int i = 0; i < old_length; i++) {
365+
InternalIndex descriptor = first_out_of_object_descriptor;
366+
for (int i = 0; i < old_length; ++i, ++descriptor) {
367+
PropertyDetails details = descs.GetPropertyDetails(descriptor);
368+
while (details.location() != PropertyLocation::kField) {
369+
++descriptor;
370+
details = descs.GetPropertyDetails(descriptor);
371+
}
372+
DCHECK_EQ(i, details.field_index() - in_object_length);
373+
Representation r = details.representation();
374+
341375
V<Object> old_value = __ template LoadField<Object>(
342-
old_property_array, AccessBuilder::ForPropertyArraySlot(i));
376+
old_property_array, AccessBuilder::ForPropertyArraySlot(i, r));
343377
__ InitializeField(new_property_array,
344-
AccessBuilder::ForPropertyArraySlot(i), old_value);
378+
AccessBuilder::ForPropertyArraySlot(i, r), old_value);
345379
}
346380

347381
// Initialize new properties to undefined.
348382
V<Undefined> undefined = __ HeapConstant(factory_->undefined_value());
349383
for (int i = 0; i < JSObject::kFieldsAdded; ++i) {
350384
__ InitializeField(new_property_array,
351-
AccessBuilder::ForPropertyArraySlot(old_length + i),
385+
AccessBuilder::ForPropertyArraySlot(
386+
old_length + i, Representation::Tagged()),
352387
undefined);
353388
}
354389

Collapse file

‎deps/v8/src/compiler/turboshaft/turbolev-graph-builder.cc‎

Copy file name to clipboardExpand all lines: deps/v8/src/compiler/turboshaft/turbolev-graph-builder.cc
+5-4Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2752,10 +2752,11 @@ class GraphBuildingNodeProcessor {
27522752
maglev::ProcessResult Process(maglev::ExtendPropertiesBackingStore* node,
27532753
const maglev::ProcessingState& state) {
27542754
GET_FRAME_STATE_MAYBE_ABORT(frame_state, node->eager_deopt_info());
2755-
SetMap(node, __ ExtendPropertiesBackingStore(
2756-
Map(node->property_array_input()),
2757-
Map(node->object_input()), node->old_length(), frame_state,
2758-
node->eager_deopt_info()->feedback_to_update()));
2755+
SetMap(node,
2756+
__ ExtendPropertiesBackingStore(
2757+
Map(node->property_array_input()), Map(node->object_input()),
2758+
node->old_map(), node->old_length(), frame_state,
2759+
node->eager_deopt_info()->feedback_to_update()));
27592760
return maglev::ProcessResult::kContinue;
27602761
}
27612762

Collapse file

‎deps/v8/src/interpreter/interpreter-generator.cc‎

Copy file name to clipboardExpand all lines: deps/v8/src/interpreter/interpreter-generator.cc
+6-2Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2517,7 +2517,9 @@ IGNITION_HANDLER(SwitchOnSmiNoFeedback, InterpreterAssembler) {
25172517
GotoIf(IntPtrGreaterThanOrEqual(case_value, table_length), &fall_through);
25182518

25192519
TNode<WordT> entry = IntPtrAdd(table_start, case_value);
2520-
TNode<IntPtrT> relative_jump = LoadAndUntagConstantPoolEntry(entry);
2520+
TNode<Object> constant_entry = LoadConstantPoolEntry(entry);
2521+
CSA_SBXCHECK(this, TaggedIsSmi(constant_entry));
2522+
TNode<IntPtrT> relative_jump = SmiUntag(CAST(constant_entry));
25212523
Jump(relative_jump);
25222524

25232525
BIND(&fall_through);
@@ -3437,7 +3439,9 @@ IGNITION_HANDLER(SwitchOnGeneratorState, InterpreterAssembler) {
34373439
USE(table_length); // SBXCHECK is a DCHECK when the sandbox is disabled.
34383440

34393441
TNode<WordT> entry = IntPtrAdd(table_start, case_value);
3440-
TNode<IntPtrT> relative_jump = LoadAndUntagConstantPoolEntry(entry);
3442+
TNode<Object> constant_entry = LoadConstantPoolEntry(entry);
3443+
CSA_SBXCHECK(this, TaggedIsSmi(constant_entry));
3444+
TNode<IntPtrT> relative_jump = SmiUntag(CAST(constant_entry));
34413445
Jump(relative_jump);
34423446

34433447
BIND(&fallthrough);
Collapse file

‎deps/v8/src/maglev/maglev-graph-builder.cc‎

Copy file name to clipboardExpand all lines: deps/v8/src/maglev/maglev-graph-builder.cc
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5225,7 +5225,7 @@ ReduceResult MaglevGraphBuilder::BuildExtendPropertiesBackingStore(
52255225
// potentially causing a sandbox violation. This CHECK defends against that.
52265226
SBXCHECK_GE(length, 0);
52275227
return AddNewNode<ExtendPropertiesBackingStore>({property_array, receiver},
5228-
length);
5228+
map, length);
52295229
}
52305230

52315231
MaybeReduceResult MaglevGraphBuilder::TryBuildStoreField(
Collapse file

‎deps/v8/src/maglev/maglev-ir.h‎

Copy file name to clipboardExpand all lines: deps/v8/src/maglev/maglev-ir.h
+6-2Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9441,8 +9441,10 @@ class ExtendPropertiesBackingStore
94419441
using Base = FixedInputValueNodeT<2, ExtendPropertiesBackingStore>;
94429442

94439443
public:
9444-
explicit ExtendPropertiesBackingStore(uint64_t bitfield, int old_length)
9445-
: Base(bitfield), old_length_(old_length) {}
9444+
explicit ExtendPropertiesBackingStore(uint64_t bitfield,
9445+
const compiler::MapRef& old_map,
9446+
int old_length)
9447+
: Base(bitfield), old_map_(old_map), old_length_(old_length) {}
94469448

94479449
static constexpr OpProperties kProperties =
94489450
OpProperties::CanAllocate() | OpProperties::CanRead() |
@@ -9462,9 +9464,11 @@ class ExtendPropertiesBackingStore
94629464
void GenerateCode(MaglevAssembler*, const ProcessingState&);
94639465
void PrintParams(std::ostream&) const;
94649466

9467+
const compiler::MapRef& old_map() const { return old_map_; }
94659468
int old_length() const { return old_length_; }
94669469

94679470
private:
9471+
const compiler::MapRef old_map_;
94689472
const int old_length_;
94699473
};
94709474

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.