FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

deps: patch V8 to 10.7.193.22 · nodejs/node@413bf9a · GitHub

/ node Public

Commit 413bf9a

Browse files
targos
authored and
ruyadorno
committed
deps: patch V8 to 10.7.193.22
Refs: v8/v8@10.7.193.20...10.7.193.22 PR-URL: #45460 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Jiawen Geng <technicalcute@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
1 parent 45b54ee commit 413bf9a

3 files changed

Lines changed: 49 additions & 53 deletions

File tree

‎deps/v8/include/v8-version.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
#define V8_MAJOR_VERSION 10
1212
#define V8_MINOR_VERSION 7
1313
#define V8_BUILD_NUMBER 193
14-
#define V8_PATCH_LEVEL 20
14+
#define V8_PATCH_LEVEL 22
1515

1616
// Use 1 for candidates and 0 otherwise.
1717
// (Boolean macro values are not supported by all preprocessors.)

‎deps/v8/src/compiler/effect-control-linearizer.cc‎

Lines changed: 25 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -5294,6 +5294,8 @@ Node* EffectControlLinearizer::LowerLoadFieldByIndex(Node* node) {
52945294

52955295
auto if_double = __ MakeDeferredLabel();
52965296
auto done = __ MakeLabel(MachineRepresentation::kTagged);
5297+
auto loaded_field = __ MakeLabel(MachineRepresentation::kTagged);
5298+
auto done_double = __ MakeLabel(MachineRepresentation::kFloat64);
52975299

52985300
// Check if field is a mutable double field.
52995301
__ GotoIfNot(__ IntPtrEqual(__ WordAnd(index, one), zero), &if_double);
@@ -5310,8 +5312,8 @@ Node* EffectControlLinearizer::LowerLoadFieldByIndex(Node* node) {
53105312
Node* offset =
53115313
__ IntAdd(__ WordShl(index, __ IntPtrConstant(kTaggedSizeLog2 - 1)),
53125314
__ IntPtrConstant(JSObject::kHeaderSize - kHeapObjectTag));
5313-
Node* result = __ Load(MachineType::AnyTagged(), object, offset);
5314-
__ Goto(&done, result);
5315+
Node* field = __ Load(MachineType::AnyTagged(), object, offset);
5316+
__ Goto(&loaded_field, field);
53155317
}
53165318

53175319
// The field is located in the properties backing store of {object}.
@@ -5325,18 +5327,15 @@ Node* EffectControlLinearizer::LowerLoadFieldByIndex(Node* node) {
53255327
__ IntPtrConstant(kTaggedSizeLog2 - 1)),
53265328
__ IntPtrConstant((FixedArray::kHeaderSize - kTaggedSize) -
53275329
kHeapObjectTag));
5328-
Node* result = __ Load(MachineType::AnyTagged(), properties, offset);
5329-
__ Goto(&done, result);
5330+
Node* field = __ Load(MachineType::AnyTagged(), properties, offset);
5331+
__ Goto(&loaded_field, field);
53305332
}
53315333
}
53325334

53335335
// The field is a Double field, either unboxed in the object on 64-bit
53345336
// architectures, or a mutable HeapNumber.
53355337
__ Bind(&if_double);
53365338
{
5337-
auto loaded_field = __ MakeLabel(MachineRepresentation::kTagged);
5338-
auto done_double = __ MakeLabel(MachineRepresentation::kFloat64);
5339-
53405339
index = __ WordSar(index, one);
53415340

53425341
// Check if field is in-object or out-of-object.
@@ -5364,27 +5363,27 @@ Node* EffectControlLinearizer::LowerLoadFieldByIndex(Node* node) {
53645363
Node* field = __ Load(MachineType::AnyTagged(), properties, offset);
53655364
__ Goto(&loaded_field, field);
53665365
}
5366+
}
53675367

5368-
__ Bind(&loaded_field);
5369-
{
5370-
Node* field = loaded_field.PhiAt(0);
5371-
// We may have transitioned in-place away from double, so check that
5372-
// this is a HeapNumber -- otherwise the load is fine and we don't need
5373-
// to copy anything anyway.
5374-
__ GotoIf(ObjectIsSmi(field), &done, field);
5375-
Node* field_map = __ LoadField(AccessBuilder::ForMap(), field);
5376-
__ GotoIfNot(__ TaggedEqual(field_map, __ HeapNumberMapConstant()), &done,
5377-
field);
5378-
5379-
Node* value = __ LoadField(AccessBuilder::ForHeapNumberValue(), field);
5380-
__ Goto(&done_double, value);
5381-
}
5368+
__ Bind(&loaded_field);
5369+
{
5370+
Node* field = loaded_field.PhiAt(0);
5371+
// We may have transitioned in-place away from double, so check that
5372+
// this is a HeapNumber -- otherwise the load is fine and we don't need
5373+
// to copy anything anyway.
5374+
__ GotoIf(ObjectIsSmi(field), &done, field);
5375+
Node* field_map = __ LoadField(AccessBuilder::ForMap(), field);
5376+
__ GotoIfNot(__ TaggedEqual(field_map, __ HeapNumberMapConstant()), &done,
5377+
field);
53825378

5383-
__ Bind(&done_double);
5384-
{
5385-
Node* result = AllocateHeapNumberWithValue(done_double.PhiAt(0));
5386-
__ Goto(&done, result);
5387-
}
5379+
Node* value = __ LoadField(AccessBuilder::ForHeapNumberValue(), field);
5380+
__ Goto(&done_double, value);
5381+
}
5382+
5383+
__ Bind(&done_double);
5384+
{
5385+
Node* result = AllocateHeapNumberWithValue(done_double.PhiAt(0));
5386+
__ Goto(&done, result);
53885387
}
53895388

53905389
__ Bind(&done);

‎deps/v8/src/compiler/js-call-reducer.cc‎

Lines changed: 23 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -710,9 +710,8 @@ class IteratingArrayBuiltinReducerAssembler : public JSCallReducerAssembler {
710710
MapInference* inference, const bool has_stability_dependency,
711711
ElementsKind kind, const SharedFunctionInfoRef& shared,
712712
const NativeContextRef& native_context, ArrayEverySomeVariant variant);
713-
TNode<Object> ReduceArrayPrototypeAt(ZoneVector<ElementsKind> kinds,
714-
bool needs_fallback_builtin_call,
715-
Node* receiver_kind);
713+
TNode<Object> ReduceArrayPrototypeAt(ZoneVector<const MapRef*> kinds,
714+
bool needs_fallback_builtin_call);
716715
TNode<Object> ReduceArrayPrototypeIndexOfIncludes(
717716
ElementsKind kind, ArrayIndexOfIncludesVariant variant);
718717

@@ -1323,24 +1322,26 @@ TNode<String> JSCallReducerAssembler::ReduceStringPrototypeSlice() {
13231322
}
13241323

13251324
TNode<Object> IteratingArrayBuiltinReducerAssembler::ReduceArrayPrototypeAt(
1326-
ZoneVector<ElementsKind> kinds, bool needs_fallback_builtin_call,
1327-
Node* receiver_kind) {
1325+
ZoneVector<const MapRef*> maps, bool needs_fallback_builtin_call) {
13281326
TNode<JSArray> receiver = ReceiverInputAs<JSArray>();
13291327
TNode<Object> index = ArgumentOrZero(0);
13301328

13311329
TNode<Number> index_num = CheckSmi(index);
13321330
TNode<FixedArrayBase> elements = LoadElements(receiver);
13331331

1332+
TNode<Map> receiver_map =
1333+
TNode<Map>::UncheckedCast(LoadField(AccessBuilder::ForMap(), receiver));
1334+
13341335
auto out = MakeLabel(MachineRepresentation::kTagged);
13351336

1336-
for (ElementsKind kind : kinds) {
1337+
for (const MapRef* map : maps) {
1338+
DCHECK(map->supports_fast_array_iteration());
13371339
auto correct_map_label = MakeLabel(), wrong_map_label = MakeLabel();
1338-
Branch(NumberEqual(TNode<Number>::UncheckedCast(receiver_kind),
1339-
NumberConstant(kind)),
1340-
&correct_map_label, &wrong_map_label);
1340+
TNode<Boolean> is_map_equal = ReferenceEqual(receiver_map, Constant(*map));
1341+
Branch(is_map_equal, &correct_map_label, &wrong_map_label);
13411342
Bind(&correct_map_label);
13421343

1343-
TNode<Number> length = LoadJSArrayLength(receiver, kind);
1344+
TNode<Number> length = LoadJSArrayLength(receiver, map->elements_kind());
13441345

13451346
// If index is less than 0, then subtract from length.
13461347
TNode<Boolean> cond = NumberLessThan(index_num, ZeroConstant());
@@ -1359,15 +1360,16 @@ TNode<Object> IteratingArrayBuiltinReducerAssembler::ReduceArrayPrototypeAt(
13591360

13601361
// Retrieving element at index.
13611362
TNode<Object> element = LoadElement<Object>(
1362-
AccessBuilder::ForFixedArrayElement(kind), elements, real_index_num);
1363-
if (IsHoleyElementsKind(kind)) {
1363+
AccessBuilder::ForFixedArrayElement(map->elements_kind()), elements,
1364+
real_index_num);
1365+
if (IsHoleyElementsKind(map->elements_kind())) {
13641366
// This case is needed in particular for HOLEY_DOUBLE_ELEMENTS: raw
13651367
// doubles are stored in the FixedDoubleArray, and need to be converted to
13661368
// HeapNumber or to Smi so that this function can return an Object. The
13671369
// automatic converstion performed by
13681370
// RepresentationChanger::GetTaggedRepresentationFor does not handle
13691371
// holes, so we convert manually a potential hole here.
1370-
element = TryConvertHoleToUndefined(element, kind);
1372+
element = TryConvertHoleToUndefined(element, map->elements_kind());
13711373
}
13721374
Goto(&out, element);
13731375

@@ -5633,25 +5635,22 @@ Reduction JSCallReducer::ReduceArrayPrototypeAt(Node* node) {
56335635
MapInference inference(broker(), receiver, effect);
56345636
if (!inference.HaveMaps()) return NoChange();
56355637

5636-
// Collecting kinds
5637-
ZoneVector<ElementsKind> kinds(broker()->zone());
5638+
// Collecting maps, and checking if a fallback builtin call will be required
5639+
// (it is required if at least one map doesn't support fast array iteration).
5640+
ZoneVector<const MapRef*> maps(broker()->zone());
56385641
bool needs_fallback_builtin_call = false;
56395642
for (const MapRef& map : inference.GetMaps()) {
56405643
if (map.supports_fast_array_iteration()) {
5641-
ElementsKind kind = map.elements_kind();
5642-
// Checking that |kind| isn't already in |kinds|. Using std::find should
5643-
// be fast enough since |kinds| can contain at most 4 items.
5644-
if (std::find(kinds.begin(), kinds.end(), kind) == kinds.end()) {
5645-
kinds.push_back(kind);
5646-
}
5644+
maps.push_back(&map);
56475645
} else {
56485646
needs_fallback_builtin_call = true;
56495647
}
56505648
}
5649+
56515650
inference.RelyOnMapsPreferStability(dependencies(), jsgraph(), &effect,
56525651
control, p.feedback());
56535652

5654-
if (kinds.empty()) {
5653+
if (maps.empty()) {
56555654
// No map in the feedback supports fast iteration. Keeping the builtin call.
56565655
return NoChange();
56575656
}
@@ -5660,13 +5659,11 @@ Reduction JSCallReducer::ReduceArrayPrototypeAt(Node* node) {
56605659
return NoChange();
56615660
}
56625661

5663-
Node* receiver_kind = LoadReceiverElementsKind(receiver, &effect, control);
5664-
56655662
IteratingArrayBuiltinReducerAssembler a(this, node);
56665663
a.InitializeEffectControl(effect, control);
56675664

5668-
TNode<Object> subgraph = a.ReduceArrayPrototypeAt(
5669-
kinds, needs_fallback_builtin_call, receiver_kind);
5665+
TNode<Object> subgraph =
5666+
a.ReduceArrayPrototypeAt(maps, needs_fallback_builtin_call);
56705667
return ReplaceWithSubgraph(&a, subgraph);
56715668
}
56725669

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL