FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

deps: patch V8 to 10.7.193.16 · nodejs/node@3bfba6d · GitHub

/ node Public

Commit 3bfba6d

Browse files
targos
authored and
RafaelGSS
committed
deps: patch V8 to 10.7.193.16
Refs: v8/v8@10.7.193.13...10.7.193.16 PR-URL: #45023 Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Jiawen Geng <technicalcute@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
1 parent dbc696d commit 3bfba6d

7 files changed

Lines changed: 148 additions & 21 deletions

File tree

‎deps/v8/include/v8-version.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
#define V8_MAJOR_VERSION 10
1212
#define V8_MINOR_VERSION 7
1313
#define V8_BUILD_NUMBER 193
14-
#define V8_PATCH_LEVEL 13
14+
#define V8_PATCH_LEVEL 16
1515

1616
// Use 1 for candidates and 0 otherwise.
1717
// (Boolean macro values are not supported by all preprocessors.)

‎deps/v8/src/compiler/compilation-dependencies.cc‎

Lines changed: 44 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,8 @@ namespace compiler {
3434
V(Protector) \
3535
V(PrototypeProperty) \
3636
V(StableMap) \
37-
V(Transition)
37+
V(Transition) \
38+
V(ObjectSlotValue)
3839

3940
CompilationDependencies::CompilationDependencies(JSHeapBroker* broker,
4041
Zone* zone)
@@ -868,6 +869,42 @@ class ProtectorDependency final : public CompilationDependency {
868869
const PropertyCellRef cell_;
869870
};
870871

872+
// Check that an object slot will not change during compilation.
873+
class ObjectSlotValueDependency final : public CompilationDependency {
874+
public:
875+
explicit ObjectSlotValueDependency(const HeapObjectRef& object, int offset,
876+
const ObjectRef& value)
877+
: CompilationDependency(kObjectSlotValue),
878+
object_(object.object()),
879+
offset_(offset),
880+
value_(value.object()) {}
881+
882+
bool IsValid() const override {
883+
PtrComprCageBase cage_base = GetPtrComprCageBase(*object_);
884+
Object current_value =
885+
offset_ == HeapObject::kMapOffset
886+
? object_->map()
887+
: TaggedField<Object>::Relaxed_Load(cage_base, *object_, offset_);
888+
return *value_ == current_value;
889+
}
890+
void Install(PendingDependencies* deps) const override {}
891+
892+
private:
893+
size_t Hash() const override {
894+
return base::hash_combine(object_.address(), offset_, value_.address());
895+
}
896+
897+
bool Equals(const CompilationDependency* that) const override {
898+
const ObjectSlotValueDependency* const zat = that->AsObjectSlotValue();
899+
return object_->address() == zat->object_->address() &&
900+
offset_ == zat->offset_ && value_.address() == zat->value_.address();
901+
}
902+
903+
Handle<HeapObject> object_;
904+
int offset_;
905+
Handle<Object> value_;
906+
};
907+
871908
class ElementsKindDependency final : public CompilationDependency {
872909
public:
873910
ElementsKindDependency(const AllocationSiteRef& site, ElementsKind kind)
@@ -1120,6 +1157,12 @@ void CompilationDependencies::DependOnElementsKind(
11201157
}
11211158
}
11221159

1160+
void CompilationDependencies::DependOnObjectSlotValue(
1161+
const HeapObjectRef& object, int offset, const ObjectRef& value) {
1162+
RecordDependency(
1163+
zone_->New<ObjectSlotValueDependency>(object, offset, value));
1164+
}
1165+
11231166
void CompilationDependencies::DependOnOwnConstantElement(
11241167
const JSObjectRef& holder, uint32_t index, const ObjectRef& element) {
11251168
RecordDependency(

‎deps/v8/src/compiler/compilation-dependencies.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,10 @@ class V8_EXPORT_PRIVATE CompilationDependencies : public ZoneObject {
9393
// Record the assumption that {site}'s {ElementsKind} doesn't change.
9494
void DependOnElementsKind(const AllocationSiteRef& site);
9595

96+
// Check that an object slot will not change during compilation.
97+
void DependOnObjectSlotValue(const HeapObjectRef& object, int offset,
98+
const ObjectRef& value);
99+
96100
void DependOnOwnConstantElement(const JSObjectRef& holder, uint32_t index,
97101
const ObjectRef& element);
98102

‎deps/v8/src/compiler/js-create-lowering.cc‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1673,6 +1673,10 @@ base::Optional<Node*> JSCreateLowering::TryAllocateFastLiteral(
16731673

16741674
// Now that we hold the migration lock, get the current map.
16751675
MapRef boilerplate_map = boilerplate.map();
1676+
// Protect against concurrent changes to the boilerplate object by checking
1677+
// for an identical value at the end of the compilation.
1678+
dependencies()->DependOnObjectSlotValue(boilerplate, HeapObject::kMapOffset,
1679+
boilerplate_map);
16761680
{
16771681
base::Optional<MapRef> current_boilerplate_map =
16781682
boilerplate.map_direct_read();
@@ -1838,10 +1842,18 @@ base::Optional<Node*> JSCreateLowering::TryAllocateFastLiteralElements(
18381842
boilerplate.elements(kRelaxedLoad);
18391843
if (!maybe_boilerplate_elements.has_value()) return {};
18401844
FixedArrayBaseRef boilerplate_elements = maybe_boilerplate_elements.value();
1845+
// Protect against concurrent changes to the boilerplate object by checking
1846+
// for an identical value at the end of the compilation.
1847+
dependencies()->DependOnObjectSlotValue(
1848+
boilerplate, JSObject::kElementsOffset, boilerplate_elements);
18411849

18421850
// Empty or copy-on-write elements just store a constant.
18431851
int const elements_length = boilerplate_elements.length();
18441852
MapRef elements_map = boilerplate_elements.map();
1853+
// Protect against concurrent changes to the boilerplate object by checking
1854+
// for an identical value at the end of the compilation.
1855+
dependencies()->DependOnObjectSlotValue(boilerplate_elements,
1856+
HeapObject::kMapOffset, elements_map);
18451857
if (boilerplate_elements.length() == 0 || elements_map.IsFixedCowArrayMap()) {
18461858
if (allocation == AllocationType::kOld &&
18471859
!boilerplate.IsElementsTenured(boilerplate_elements)) {

‎deps/v8/src/execution/isolate.cc‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2797,13 +2797,15 @@ bool PromiseHasUserDefinedRejectHandlerInternal(Isolate* isolate,
27972797
Handle<PromiseCapability>::cast(promise_or_capability)->promise(),
27982798
isolate);
27992799
}
2800-
promise = Handle<JSPromise>::cast(promise_or_capability);
2801-
if (!reaction->reject_handler().IsUndefined(isolate)) {
2802-
Handle<JSReceiver> reject_handler(
2803-
JSReceiver::cast(reaction->reject_handler()), isolate);
2804-
if (PromiseIsRejectHandler(isolate, reject_handler)) return true;
2800+
if (promise_or_capability->IsJSPromise()) {
2801+
promise = Handle<JSPromise>::cast(promise_or_capability);
2802+
if (!reaction->reject_handler().IsUndefined(isolate)) {
2803+
Handle<JSReceiver> reject_handler(
2804+
JSReceiver::cast(reaction->reject_handler()), isolate);
2805+
if (PromiseIsRejectHandler(isolate, reject_handler)) return true;
2806+
}
2807+
if (isolate->PromiseHasUserDefinedRejectHandler(promise)) return true;
28052808
}
2806-
if (isolate->PromiseHasUserDefinedRejectHandler(promise)) return true;
28072809
}
28082810
current = handle(reaction->next(), isolate);
28092811
}

‎deps/v8/src/heap/concurrent-marking.cc‎

Lines changed: 66 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -65,21 +65,48 @@ class ConcurrentMarkingState final
6565
// Helper class for storing in-object slot addresses and values.
6666
class SlotSnapshot {
6767
public:
68-
SlotSnapshot() : number_of_slots_(0) {}
68+
SlotSnapshot()
69+
: number_of_object_slots_(0), number_of_external_pointer_slots_(0) {}
6970
SlotSnapshot(const SlotSnapshot&) = delete;
7071
SlotSnapshot& operator=(const SlotSnapshot&) = delete;
71-
int number_of_slots() const { return number_of_slots_; }
72-
ObjectSlot slot(int i) const { return snapshot_[i].first; }
73-
Object value(int i) const { return snapshot_[i].second; }
74-
void clear() { number_of_slots_ = 0; }
72+
int number_of_object_slots() const { return number_of_object_slots_; }
73+
int number_of_external_pointer_slots() const {
74+
return number_of_external_pointer_slots_;
75+
}
76+
ObjectSlot object_slot(int i) const { return object_snapshot_[i].first; }
77+
Object object_value(int i) const { return object_snapshot_[i].second; }
78+
ExternalPointerSlot external_pointer_slot(int i) const {
79+
return external_pointer_snapshot_[i].first;
80+
}
81+
ExternalPointerTag external_pointer_tag(int i) const {
82+
return external_pointer_snapshot_[i].second;
83+
}
84+
void clear() {
85+
number_of_object_slots_ = 0;
86+
number_of_external_pointer_slots_ = 0;
87+
}
7588
void add(ObjectSlot slot, Object value) {
76-
snapshot_[number_of_slots_++] = {slot, value};
89+
DCHECK_LT(number_of_object_slots_, kMaxObjectSlots);
90+
object_snapshot_[number_of_object_slots_++] = {slot, value};
91+
}
92+
void add(ExternalPointerSlot slot, ExternalPointerTag tag) {
93+
DCHECK_LT(number_of_external_pointer_slots_, kMaxExternalPointerSlots);
94+
external_pointer_snapshot_[number_of_external_pointer_slots_++] = {slot,
95+
tag};
7796
}
7897

7998
private:
80-
static const int kMaxSnapshotSize = JSObject::kMaxInstanceSize / kTaggedSize;
81-
int number_of_slots_;
82-
std::pair<ObjectSlot, Object> snapshot_[kMaxSnapshotSize];
99+
// Maximum number of pointer slots of objects we use snapshotting for.
100+
// ConsStrings can have 3 (Map + Left + Right) pointers.
101+
static constexpr int kMaxObjectSlots = 3;
102+
// Maximum number of external pointer slots of objects we use snapshotting
103+
// for. ExternalStrings can have 2 (resource + cached data) external pointers.
104+
static constexpr int kMaxExternalPointerSlots = 2;
105+
int number_of_object_slots_;
106+
int number_of_external_pointer_slots_;
107+
std::pair<ObjectSlot, Object> object_snapshot_[kMaxObjectSlots];
108+
std::pair<ExternalPointerSlot, ExternalPointerTag>
109+
external_pointer_snapshot_[kMaxExternalPointerSlots];
83110
};
84111

85112
class ConcurrentMarkingVisitorUtility {
@@ -111,9 +138,9 @@ class ConcurrentMarkingVisitorUtility {
111138
template <typename Visitor>
112139
static void VisitPointersInSnapshot(Visitor* visitor, HeapObject host,
113140
const SlotSnapshot& snapshot) {
114-
for (int i = 0; i < snapshot.number_of_slots(); i++) {
115-
ObjectSlot slot = snapshot.slot(i);
116-
Object object = snapshot.value(i);
141+
for (int i = 0; i < snapshot.number_of_object_slots(); i++) {
142+
ObjectSlot slot = snapshot.object_slot(i);
143+
Object object = snapshot.object_value(i);
117144
DCHECK(!HasWeakHeapObjectTag(object));
118145
if (!object.IsHeapObject()) continue;
119146
HeapObject heap_object = HeapObject::cast(object);
@@ -126,6 +153,16 @@ class ConcurrentMarkingVisitorUtility {
126153
}
127154
}
128155

156+
template <typename Visitor>
157+
static void VisitExternalPointersInSnapshot(Visitor* visitor, HeapObject host,
158+
const SlotSnapshot& snapshot) {
159+
for (int i = 0; i < snapshot.number_of_external_pointer_slots(); i++) {
160+
ExternalPointerSlot slot = snapshot.external_pointer_slot(i);
161+
ExternalPointerTag tag = snapshot.external_pointer_tag(i);
162+
visitor->VisitExternalPointer(host, slot, tag);
163+
}
164+
}
165+
129166
template <typename Visitor, typename T>
130167
static int VisitFullyWithSnapshot(Visitor* visitor, Map map, T object) {
131168
using TBodyDescriptor = typename T::BodyDescriptor;
@@ -136,6 +173,8 @@ class ConcurrentMarkingVisitorUtility {
136173
if (!visitor->ShouldVisit(object)) return 0;
137174
ConcurrentMarkingVisitorUtility::VisitPointersInSnapshot(visitor, object,
138175
snapshot);
176+
ConcurrentMarkingVisitorUtility::VisitExternalPointersInSnapshot(
177+
visitor, object, snapshot);
139178
return size;
140179
}
141180

@@ -182,6 +221,11 @@ class ConcurrentMarkingVisitorUtility {
182221
UNREACHABLE();
183222
}
184223

224+
void VisitExternalPointer(HeapObject host, ExternalPointerSlot slot,
225+
ExternalPointerTag tag) override {
226+
slot_snapshot_->add(slot, tag);
227+
}
228+
185229
void VisitCodeTarget(Code host, RelocInfo* rinfo) final {
186230
// This should never happen, because snapshotting is performed only on
187231
// some String subclasses.
@@ -450,6 +494,16 @@ class ConcurrentMarkingVisitor final
450494
return SeqTwoByteString::SizeFor(object.length(kAcquireLoad));
451495
}
452496

497+
int VisitExternalOneByteString(Map map, ExternalOneByteString object) {
498+
return ConcurrentMarkingVisitorUtility::VisitFullyWithSnapshot(this, map,
499+
object);
500+
}
501+
502+
int VisitExternalTwoByteString(Map map, ExternalTwoByteString object) {
503+
return ConcurrentMarkingVisitorUtility::VisitFullyWithSnapshot(this, map,
504+
object);
505+
}
506+
453507
// Implements ephemeron semantics: Marks value if key is already reachable.
454508
// Returns true if value was actually marked.
455509
bool ProcessEphemeron(HeapObject key, HeapObject value) {

‎deps/v8/src/objects/string.cc‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -223,6 +223,14 @@ void String::MakeThin(IsolateT* isolate, String internalized) {
223223
Map target_map = ComputeThinStringMap(isolate, initial_shape,
224224
internalized.IsOneByteRepresentation());
225225
if (initial_shape.IsExternal()) {
226+
// Notify GC about the layout change before the transition to avoid
227+
// concurrent marking from observing any in-between state (e.g.
228+
// ExternalString map where the resource external pointer is overwritten
229+
// with a tagged pointer).
230+
// ExternalString -> ThinString transitions can only happen on the
231+
// main-thread.
232+
isolate->AsIsolate()->heap()->NotifyObjectLayoutChange(
233+
*this, no_gc, InvalidateRecordedSlots::kYes, ThinString::kSize);
226234
MigrateExternalString(isolate->AsIsolate(), *this, internalized);
227235
}
228236

@@ -231,7 +239,11 @@ void String::MakeThin(IsolateT* isolate, String internalized) {
231239
// ThinString.
232240
ThinString thin = ThinString::unchecked_cast(*this);
233241
thin.set_actual(internalized);
234-
set_map_safe_transition(target_map, kReleaseStore);
242+
if (initial_shape.IsExternal()) {
243+
set_map(target_map, kReleaseStore);
244+
} else {
245+
set_map_safe_transition(target_map, kReleaseStore);
246+
}
235247

236248
DCHECK_GE(old_size, ThinString::kSize);
237249
int size_delta = old_size - ThinString::kSize;

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL