Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit baefd4d

Browse filesBrowse files
nodejs-github-botnodejs-github-bot
authored
deps: patch V8 to 14.2.231.17
Refs: v8/v8@14.2.231.16...14.2.231.17 PR-URL: #60647 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
1 parent 33f982e commit baefd4d
Copy full SHA for baefd4d

5 files changed

+79-4Lines changed: 79 additions & 4 deletions

File tree

Expand file treeCollapse file tree
Open diff view settings
Filter options
Expand file treeCollapse file tree
Open diff view settings
Collapse file

‎deps/v8/include/v8-version.h‎

Copy file name to clipboardExpand all lines: deps/v8/include/v8-version.h
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
#define V8_MAJOR_VERSION 14
1212
#define V8_MINOR_VERSION 2
1313
#define V8_BUILD_NUMBER 231
14-
#define V8_PATCH_LEVEL 16
14+
#define V8_PATCH_LEVEL 17
1515

1616
// Use 1 for candidates and 0 otherwise.
1717
// (Boolean macro values are not supported by all preprocessors.)
Collapse file

‎deps/v8/src/maglev/maglev-graph-builder.cc‎

Copy file name to clipboardExpand all lines: deps/v8/src/maglev/maglev-graph-builder.cc
+14-3Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4531,9 +4531,20 @@ ValueNode* MaglevGraphBuilder::ConvertForField(ValueNode* value,
45314531
AllocationType allocation_type) {
45324532
switch (desc.type) {
45334533
case vobj::FieldType::kTagged: {
4534-
if (value->Is<Float64Constant>() &&
4535-
!NodeTypeIs(GetType(value), NodeType::kSmi)) {
4536-
// Note that NodeType::kSmi MUST go through GetTaggedValue for proper
4534+
// Subtle: we don't use `NodeTypeIs(...)` since the predicate must NOT
4535+
// be true for NodeType::kNone.
4536+
// TODO(jgruber): NodeType::kNone should never reach here.
4537+
if (GetType(value) == NodeType::kSmi) {
4538+
// TODO(jgruber): This is needed because HoleyFloat64ToTagged does not
4539+
// canonicalize smis by default in GetTaggedValue. We rely on
4540+
// canonicalization though in TryReduceConstructArrayConstructor.
4541+
// We should make this more robust.
4542+
MaybeReduceResult res = GetSmiValue(value);
4543+
CHECK(res.IsDoneWithValue());
4544+
return res.value();
4545+
}
4546+
if (value->Is<Float64Constant>()) {
4547+
// Note that NodeType::kSmi MUST go through GetSmiValue for proper
45374548
// canonicalization. If we see a Float64Constant with type kSmi, it has
45384549
// passed BuildCheckSmi, i.e. the runtime value is guaranteed to be
45394550
// convertible to smi (we would have deoptimized otherwise).
Collapse file

‎deps/v8/test/mjsunit/regress/regress-454485895.js‎

Copy file name to clipboard
+25Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
// Copyright 2025 the V8 project authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style license that can be
3+
// found in the LICENSE file.
4+
//
5+
// Flags: --allow-natives-syntax --maglev
6+
7+
// HOLEY_DOUBLE_ELEMENTS.
8+
const arr = [1, , , , , 1.1];
9+
10+
function opt_me() {
11+
for (let i = 0; i < 5; i++) {
12+
const ele = arr[i];
13+
const arr2 = Array(ele, i);
14+
function inner() {
15+
arr2.join();
16+
arr.__proto__ = ele;
17+
}
18+
inner();
19+
}
20+
}
21+
22+
%PrepareFunctionForOptimization(opt_me);
23+
opt_me();
24+
%OptimizeMaglevOnNextCall(opt_me);
25+
opt_me();
Collapse file

‎deps/v8/test/mjsunit/regress/regress-454861480.js‎

Copy file name to clipboard
+20Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
// Copyright 2025 the V8 project authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style license that can be
3+
// found in the LICENSE file.
4+
//
5+
// Flags: --allow-natives-syntax --maglev
6+
7+
function f0() {
8+
try {
9+
([f0,f0]).forEach(undefined);
10+
class C4 {
11+
[undefined];
12+
}
13+
} catch(e5) {
14+
}
15+
return f0;
16+
}
17+
const v6 = %PrepareFunctionForOptimization(f0);
18+
f0();
19+
const v8 = %OptimizeMaglevOnNextCall(f0);
20+
f0();
Collapse file

‎deps/v8/test/mjsunit/regress/regress-454943951.js‎

Copy file name to clipboard
+19Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
// Copyright 2025 the V8 project authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style license that can be
3+
// found in the LICENSE file.
4+
//
5+
// Flags: --allow-natives-syntax
6+
7+
function* __f_0(__v_1) {
8+
for (let __v_2 = 0; __v_2 < __v_1; __v_2++) {
9+
for (let __v_3 = 0; __v_3 < __v_1; __v_3++) {
10+
Math.acos(false);
11+
yield __v_2 * 10 + __v_3;
12+
}
13+
}
14+
}
15+
%PrepareFunctionForOptimization(__f_0);
16+
let __v_0 = __f_0(4);
17+
__v_0.next().value;
18+
%OptimizeFunctionOnNextCall(__f_0);
19+
__v_0 = __f_0();

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.