FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

deps: V8: cherry-pick 1cc12b278e22 · nodejs/node@696ce7d · GitHub

/ node Public

Commit 696ce7d

Browse files
targos
committed
deps: V8: cherry-pick 1cc12b278e22
Original commit message: [ic] Add StoreOwnIC_Slow This runtime function behaves like StoreDataPropertyInLiteral, except it can throw, since it's also used for defining public class fields. Unlike the literal use case, class field can end up throwing due to field initializers doing things like freezing the instance. Bug: chromium:1264828 Change-Id: I3ea4d15ad9b906c26763f022c8e22b757fa80b6c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3252558 Commit-Queue: Igor Sheludko <ishell@chromium.org> Auto-Submit: Shu-yu Guo <syg@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/main@{#77704} Refs: v8/v8@1cc12b2 PR-URL: #40907 Reviewed-By: Jiawen Geng <technicalcute@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com>
1 parent 91cf835 commit 696ce7d

5 files changed

Lines changed: 47 additions & 7 deletions

File tree

‎common.gypi‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@
3636

3737
# Reset this number to 0 on major V8 upgrades.
3838
# Increment by one for each non-official patch applied to deps/v8.
39-
'v8_embedder_string': '-node.10',
39+
'v8_embedder_string': '-node.11',
4040

4141
##### V8 defaults for Node.js #####
4242

‎deps/v8/src/ic/accessor-assembler.cc‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1296,13 +1296,16 @@ void AccessorAssembler::HandleStoreICHandlerCase(
12961296
if (ic_mode == ICMode::kGlobalIC) {
12971297
TailCallRuntime(Runtime::kStoreGlobalIC_Slow, p->context(), p->value(),
12981298
p->slot(), p->vector(), p->receiver(), p->name());
1299-
} else if (p->IsStoreOwn()) {
1300-
TailCallRuntime(Runtime::kStoreDataPropertyInLiteral, p->context(),
1301-
p->receiver(), p->name(), p->value());
13021299
} else {
1303-
TailCallRuntime(p->IsDefineOwn() ? Runtime::kKeyedDefineOwnIC_Slow
1304-
: Runtime::kKeyedStoreIC_Slow,
1305-
p->context(), p->value(), p->receiver(), p->name());
1300+
Runtime::FunctionId id;
1301+
if (p->IsStoreOwn()) {
1302+
id = Runtime::kStoreOwnIC_Slow;
1303+
} else if (p->IsDefineOwn()) {
1304+
id = Runtime::kKeyedDefineOwnIC_Slow;
1305+
} else {
1306+
id = Runtime::kKeyedStoreIC_Slow;
1307+
}
1308+
TailCallRuntime(id, p->context(), p->value(), p->receiver(), p->name());
13061309
}
13071310
}
13081311
}

‎deps/v8/src/ic/ic.cc‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2751,6 +2751,27 @@ RUNTIME_FUNCTION(Runtime_StoreOwnIC_Miss) {
27512751
RETURN_RESULT_OR_FAILURE(isolate, ic.Store(receiver, key, value));
27522752
}
27532753

2754+
RUNTIME_FUNCTION(Runtime_StoreOwnIC_Slow) {
2755+
HandleScope scope(isolate);
2756+
DCHECK_EQ(3, args.length());
2757+
2758+
Handle<Object> value = args.at(0);
2759+
Handle<Object> object = args.at(1);
2760+
Handle<Object> key = args.at(2);
2761+
2762+
// Unlike DefineOwn, StoreOwn doesn't handle private fields and is used for
2763+
// defining data properties in object literals and defining public class
2764+
// fields.
2765+
DCHECK(!key->IsSymbol() || !Symbol::cast(*key).is_private_name());
2766+
2767+
PropertyKey lookup_key(isolate, key);
2768+
LookupIterator it(isolate, object, lookup_key, LookupIterator::OWN);
2769+
MAYBE_RETURN(JSObject::DefineOwnPropertyIgnoreAttributes(
2770+
&it, value, NONE, Nothing<ShouldThrow>()),
2771+
ReadOnlyRoots(isolate).exception());
2772+
return *value;
2773+
}
2774+
27542775
RUNTIME_FUNCTION(Runtime_StoreGlobalIC_Miss) {
27552776
HandleScope scope(isolate);
27562777
DCHECK_EQ(4, args.length());

‎deps/v8/src/runtime/runtime.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -638,6 +638,7 @@ namespace internal {
638638
F(KeyedStoreIC_Miss, 5, 1) \
639639
F(KeyedDefineOwnIC_Miss, 5, 1) \
640640
F(StoreInArrayLiteralIC_Miss, 5, 1) \
641+
F(StoreOwnIC_Slow, 3, 1) \
641642
F(KeyedStoreIC_Slow, 3, 1) \
642643
F(KeyedDefineOwnIC_Slow, 3, 1) \
643644
F(LoadElementWithInterceptor, 2, 1) \

‎deps/v8/test/mjsunit/regress/regress-crbug-1264828.js‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
// Copyright 2021 the V8 project authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style license that can be
3+
// found in the LICENSE file.
4+
5+
// Flags: --no-lazy-feedback-allocation
6+
7+
{
8+
class C {
9+
x = Object.freeze(this);
10+
}
11+
// Call once to install slow handler.
12+
assertThrows(() => { new C(); });
13+
// Hit the slow handler.
14+
assertThrows(() => { new C(); });
15+
}

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL