FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

deps: cherry-pick 6cb999b97b from V8 upstream · nodejs/node@785a9e5 · GitHub

/ node Public

Commit 785a9e5

Browse files
isheludko
authored and
addaleax
committed
deps: cherry-pick 6cb999b97b from V8 upstream
Original commit message: Properly handle loads from global interceptor via prototype chain. ... when receiver is in dictionary mode. Bug: v8:6490 Change-Id: Ic5a8d214adcc4efd4cb163cbc6b351c4e6b596af Reviewed-on: https://chromium-review.googlesource.com/559548 Reviewed-by: Camillo Bruni <cbruni@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#46428} Ref: https://chromium.googlesource.com/v8/v8.git/+/6cb999b97b7953ebfd4aabf2e1f62bf405f21c69 Fixes: #13804 PR-URL: #14188 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
1 parent c34ae48 commit 785a9e5

5 files changed

Lines changed: 60 additions & 6 deletions

File tree

‎deps/v8/include/v8-version.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
#define V8_MAJOR_VERSION 5
1212
#define V8_MINOR_VERSION 9
1313
#define V8_BUILD_NUMBER 211
14-
#define V8_PATCH_LEVEL 37
14+
#define V8_PATCH_LEVEL 38
1515

1616
// Use 1 for candidates and 0 otherwise.
1717
// (Boolean macro values are not supported by all preprocessors.)

‎deps/v8/src/ic/handler-configuration-inl.h‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,11 @@
1313
namespace v8 {
1414
namespace internal {
1515

16+
// Decodes kind from Smi-handler.
17+
LoadHandler::Kind LoadHandler::GetHandlerKind(Smi* smi_handler) {
18+
return KindBits::decode(smi_handler->value());
19+
}
20+
1621
Handle<Smi> LoadHandler::LoadNormal(Isolate* isolate) {
1722
int config = KindBits::encode(kNormal);
1823
return handle(Smi::FromInt(config), isolate);

‎deps/v8/src/ic/handler-configuration.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,9 @@ class LoadHandler {
9090
static const int kHolderCellIndex = 2;
9191
static const int kFirstPrototypeIndex = 3;
9292

93+
// Decodes kind from Smi-handler.
94+
static inline Kind GetHandlerKind(Smi* smi_handler);
95+
9396
// Creates a Smi-handler for loading a property from a slow object.
9497
static inline Handle<Smi> LoadNormal(Isolate* isolate);
9598

‎deps/v8/src/ic/ic.cc‎

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -868,10 +868,15 @@ int GetPrototypeCheckCount(Isolate* isolate, Handle<Map> receiver_map,
868868
Handle<FixedArray>(), 0);
869869
}
870870

871+
enum class HolderCellRequest {
872+
kGlobalPropertyCell,
873+
kHolder,
874+
};
875+
871876
Handle<WeakCell> HolderCell(Isolate* isolate, Handle<JSObject> holder,
872-
Handle<Name> name, Handle<Smi> smi_handler) {
873-
if (holder->IsJSGlobalObject() &&
874-
*smi_handler != *LoadHandler::LoadInterceptor(isolate)) {
877+
Handle<Name> name, HolderCellRequest request) {
878+
if (request == HolderCellRequest::kGlobalPropertyCell) {
879+
DCHECK(holder->IsJSGlobalObject());
875880
Handle<JSGlobalObject> global = Handle<JSGlobalObject>::cast(holder);
876881
GlobalDictionary* dict = global->global_dictionary();
877882
int number = dict->FindEntry(name);
@@ -908,8 +913,14 @@ Handle<Object> LoadIC::LoadFromPrototype(Handle<Map> receiver_map,
908913
Map::GetOrCreatePrototypeChainValidityCell(receiver_map, isolate());
909914
DCHECK(!validity_cell.is_null());
910915

911-
Handle<WeakCell> holder_cell =
912-
HolderCell(isolate(), holder, name, smi_handler);
916+
// LoadIC dispatcher expects PropertyCell as a "holder" in case of kGlobal
917+
// handler kind.
918+
HolderCellRequest request =
919+
LoadHandler::GetHandlerKind(*smi_handler) == LoadHandler::kGlobal
920+
? HolderCellRequest::kGlobalPropertyCell
921+
: HolderCellRequest::kHolder;
922+
923+
Handle<WeakCell> holder_cell = HolderCell(isolate(), holder, name, request);
913924

914925
if (checks_count == 0) {
915926
return isolate()->factory()->NewTuple3(holder_cell, smi_handler,

‎deps/v8/test/cctest/test-api-interceptors.cc‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1383,6 +1383,41 @@ THREADED_TEST(InterceptorLoadGlobalICGlobalWithInterceptor) {
13831383
CHECK(value->BooleanValue(context.local()).FromJust());
13841384
}
13851385

1386+
// Test load of a non-existing global through prototype chain when a global
1387+
// object has an interceptor.
1388+
THREADED_TEST(InterceptorLoadICGlobalWithInterceptor) {
1389+
i::FLAG_allow_natives_syntax = true;
1390+
v8::Isolate* isolate = CcTest::isolate();
1391+
v8::HandleScope scope(isolate);
1392+
v8::Local<v8::ObjectTemplate> templ_global = v8::ObjectTemplate::New(isolate);
1393+
templ_global->SetHandler(v8::NamedPropertyHandlerConfiguration(
1394+
GenericInterceptorGetter, GenericInterceptorSetter));
1395+
1396+
LocalContext context(nullptr, templ_global);
1397+
i::Handle<i::JSReceiver> global_proxy =
1398+
v8::Utils::OpenHandle<Object, i::JSReceiver>(context->Global());
1399+
CHECK(global_proxy->IsJSGlobalProxy());
1400+
i::Handle<i::JSGlobalObject> global(
1401+
i::JSGlobalObject::cast(global_proxy->map()->prototype()));
1402+
CHECK(global->map()->has_named_interceptor());
1403+
1404+
ExpectInt32(
1405+
"(function() {"
1406+
" var f = function(obj) { "
1407+
" return obj.foo;"
1408+
" };"
1409+
" var obj = { __proto__: this, _str_foo: 42 };"
1410+
" for (var i = 0; i < 1500; i++) obj['p' + i] = 0;"
1411+
" /* Ensure that |obj| is in dictionary mode. */"
1412+
" if (%HasFastProperties(obj)) return -1;"
1413+
" for (var i = 0; i < 3; i++) {"
1414+
" f(obj);"
1415+
" };"
1416+
" return f(obj);"
1417+
"})();",
1418+
42);
1419+
}
1420+
13861421
static void InterceptorLoadICGetter0(
13871422
Local<Name> name, const v8::PropertyCallbackInfo<v8::Value>& info) {
13881423
ApiTestFuzzer::Fuzz();

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL