FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

deps: V8: cherry-pick d69c7937c99d · nodejs/node@23069c3 · GitHub

/ node Public

Commit 23069c3

Browse files
targos
committed
deps: V8: cherry-pick d69c7937c99d
Original commit message: [snapshot] Dont defer ByteArray when serializing JSTypedArray needs the base_pointer ByteArray immediately if it's on heap. JSTypedArray's base_pointer was initialized to Smi::uninitialized_deserialization_value at first when deserializing, and if base_pointer was deferred, we will mistakenly check JSTypedArray not on heap. Bug: v8:13149 Change-Id: I104c83ff9a2017de1c8071a9e116baa602f6977d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3813068 Reviewed-by: Jakob Linke <jgruber@chromium.org> Commit-Queue: 王澳 <wangao.james@bytedance.com> Cr-Commit-Position: refs/heads/main@{#82254} Refs: v8/v8@d69c793 PR-URL: #46425 Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
1 parent 1a499c5 commit 23069c3

3 files changed

Lines changed: 50 additions & 2 deletions

File tree

‎deps/v8/src/snapshot/deserializer.cc‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -427,6 +427,8 @@ void Deserializer<IsolateT>::PostProcessNewJSReceiver(
427427
reinterpret_cast<uint8_t*>(backing_store) + data_view.byte_offset());
428428
} else if (InstanceTypeChecker::IsJSTypedArray(instance_type)) {
429429
auto typed_array = JSTypedArray::cast(raw_obj);
430+
// Note: ByteArray objects must not be deferred s.t. they are
431+
// available here for is_on_heap(). See also: CanBeDeferred.
430432
// Fixup typed array pointers.
431433
if (typed_array.is_on_heap()) {
432434
typed_array.AddExternalPointerCompensationForDeserialization(
@@ -517,7 +519,10 @@ void Deserializer<IsolateT>::PostProcessNewObject(Handle<Map> map,
517519
// to |ObjectDeserializer::CommitPostProcessedObjects()|.
518520
new_allocation_sites_.push_back(Handle<AllocationSite>::cast(obj));
519521
} else {
520-
DCHECK(CanBeDeferred(*obj));
522+
// We dont defer ByteArray because JSTypedArray needs the base_pointer
523+
// ByteArray immediately if it's on heap.
524+
DCHECK(CanBeDeferred(*obj) ||
525+
InstanceTypeChecker::IsByteArray(instance_type));
521526
}
522527
}
523528
}

‎deps/v8/src/snapshot/serializer-deserializer.cc‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,10 +51,13 @@ bool SerializerDeserializer::CanBeDeferred(HeapObject o) {
5151
// 3. JS objects with embedder fields cannot be deferred because the
5252
// serialize/deserialize callbacks need the back reference immediately to
5353
// identify the object.
54+
// 4. ByteArray cannot be deferred as JSTypedArray needs the base_pointer
55+
// ByteArray immediately if it's on heap.
5456
// TODO(leszeks): Could we defer string serialization if forward references
5557
// were resolved after object post processing?
5658
return !o.IsMap() && !o.IsInternalizedString() &&
57-
!(o.IsJSObject() && JSObject::cast(o).GetEmbedderFieldCount() > 0);
59+
!(o.IsJSObject() && JSObject::cast(o).GetEmbedderFieldCount() > 0) &&
60+
!o.IsByteArray();
5861
}
5962

6063
void SerializerDeserializer::RestoreExternalReferenceRedirector(

‎deps/v8/test/cctest/test-serialize.cc‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4990,6 +4990,46 @@ UNINITIALIZED_TEST(SnapshotCreatorAnonClassWithKeep) {
49904990
delete[] blob.data;
49914991
}
49924992

4993+
UNINITIALIZED_TEST(SnapshotCreatorDontDeferByteArrayForTypedArray) {
4994+
DisableAlwaysOpt();
4995+
v8::StartupData blob;
4996+
{
4997+
v8::SnapshotCreator creator;
4998+
v8::Isolate* isolate = creator.GetIsolate();
4999+
{
5000+
v8::HandleScope handle_scope(isolate);
5001+
5002+
v8::Local<v8::Context> context = v8::Context::New(isolate);
5003+
v8::Context::Scope context_scope(context);
5004+
CompileRun(
5005+
"const z = new Uint8Array(1);\n"
5006+
"class A { \n"
5007+
" static x() { \n"
5008+
" } \n"
5009+
"} \n"
5010+
"class B extends A {} \n"
5011+
"B.foo = ''; \n"
5012+
"class C extends B {} \n"
5013+
"class D extends C {} \n"
5014+
"class E extends B {} \n"
5015+
"function F() {} \n"
5016+
"Object.setPrototypeOf(F, D); \n");
5017+
creator.SetDefaultContext(context);
5018+
}
5019+
5020+
blob =
5021+
creator.CreateBlob(v8::SnapshotCreator::FunctionCodeHandling::kClear);
5022+
CHECK(blob.raw_size > 0 && blob.data != nullptr);
5023+
}
5024+
{
5025+
SnapshotCreator creator(nullptr, &blob);
5026+
v8::Isolate* isolate = creator.GetIsolate();
5027+
v8::HandleScope scope(isolate);
5028+
USE(v8::Context::New(isolate));
5029+
}
5030+
delete[] blob.data;
5031+
}
5032+
49935033
class V8_NODISCARD DisableLazySourcePositionScope {
49945034
public:
49955035
DisableLazySourcePositionScope()

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL