FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

deps: patch V8 to 6.8.275.30 · nodejs/node@611f423 · GitHub

/ node Public

Commit 611f423

Browse files
targos
committed
deps: patch V8 to 6.8.275.30
Refs: v8/v8@6.8.275.24...6.8.275.30 PR-URL: #22125 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com>
1 parent f86ca89 commit 611f423

5 files changed

Lines changed: 38 additions & 11 deletions

File tree

‎deps/v8/include/v8-version.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
#define V8_MAJOR_VERSION 6
1212
#define V8_MINOR_VERSION 8
1313
#define V8_BUILD_NUMBER 275
14-
#define V8_PATCH_LEVEL 24
14+
#define V8_PATCH_LEVEL 30
1515

1616
// Use 1 for candidates and 0 otherwise.
1717
// (Boolean macro values are not supported by all preprocessors.)

‎deps/v8/src/code-stub-assembler.cc‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8816,13 +8816,14 @@ void CodeStubAssembler::EmitBigTypedArrayElementStore(
88168816
TNode<JSTypedArray> object, TNode<FixedTypedArrayBase> elements,
88178817
TNode<IntPtrT> intptr_key, TNode<Object> value, TNode<Context> context,
88188818
Label* opt_if_neutered) {
8819+
TNode<BigInt> bigint_value = ToBigInt(context, value);
8820+
88198821
if (opt_if_neutered != nullptr) {
8820-
// Check if buffer has been neutered.
8822+
// Check if buffer has been neutered. Must happen after {ToBigInt}!
88218823
Node* buffer = LoadObjectField(object, JSArrayBufferView::kBufferOffset);
88228824
GotoIf(IsDetachedBuffer(buffer), opt_if_neutered);
88238825
}
88248826

8825-
TNode<BigInt> bigint_value = ToBigInt(context, value);
88268827
TNode<RawPtrT> backing_store = LoadFixedTypedArrayBackingStore(elements);
88278828
TNode<IntPtrT> offset = ElementOffsetFromIndex(intptr_key, BIGINT64_ELEMENTS,
88288829
INTPTR_PARAMETERS, 0);

‎deps/v8/src/compiler/ppc/code-generator-ppc.cc‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1053,11 +1053,13 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
10531053
case kArchPrepareTailCall:
10541054
AssemblePrepareTailCall();
10551055
break;
1056-
case kArchComment: {
1057-
Address comment_string = i.InputExternalReference(0).address();
1058-
__ RecordComment(reinterpret_cast<const char*>(comment_string));
1056+
case kArchComment:
1057+
#ifdef V8_TARGET_ARCH_PPC64
1058+
__ RecordComment(reinterpret_cast<const char*>(i.InputInt64(0)));
1059+
#else
1060+
__ RecordComment(reinterpret_cast<const char*>(i.InputInt32(0)));
1061+
#endif
10591062
break;
1060-
}
10611063
case kArchCallCFunction: {
10621064
int const num_parameters = MiscField::decode(instr->opcode());
10631065
if (instr->InputAt(0)->IsImmediate()) {

‎deps/v8/src/compiler/s390/code-generator-s390.cc‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1357,11 +1357,13 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
13571357
ArchOpcode opcode = ArchOpcodeField::decode(instr->opcode());
13581358

13591359
switch (opcode) {
1360-
case kArchComment: {
1361-
Address comment_string = i.InputExternalReference(0).address();
1362-
__ RecordComment(reinterpret_cast<const char*>(comment_string));
1360+
case kArchComment:
1361+
#ifdef V8_TARGET_ARCH_S390X
1362+
__ RecordComment(reinterpret_cast<const char*>(i.InputInt64(0)));
1363+
#else
1364+
__ RecordComment(reinterpret_cast<const char*>(i.InputInt32(0)));
1365+
#endif
13631366
break;
1364-
}
13651367
case kArchCallCodeObject: {
13661368
if (HasRegisterInput(instr, 0)) {
13671369
__ AddP(ip, i.InputRegister(0),

‎deps/v8/test/mjsunit/regress/regress-crbug-867776.js‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
// Copyright 2018 the V8 project authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style license that can be
3+
// found in the LICENSE file.
4+
5+
// Flags: --allow-natives-syntax --expose-gc
6+
7+
for (var i = 0; i < 3; i++) {
8+
var array = new BigInt64Array(200);
9+
10+
function evil_callback() {
11+
%ArrayBufferNeuter(array.buffer);
12+
gc();
13+
return 1094795585n;
14+
}
15+
16+
var evil_object = {valueOf: evil_callback};
17+
var root;
18+
try {
19+
root = BigInt64Array.of.call(function() { return array }, evil_object);
20+
} catch(e) {}
21+
gc();
22+
}

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL