FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

deps: patch V8 to 14.3.127.14 · nodejs/node@8716146 · GitHub

/ node Public

Commit 8716146

Browse files
nodejs-github-bot
authored
deps: patch V8 to 14.3.127.14
Refs: v8/v8@14.3.127.12...14.3.127.14 PR-URL: #60743 Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
1 parent adb4043 commit 8716146

9 files changed

Lines changed: 116 additions & 28 deletions

‎deps/v8/include/v8-version.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
#define V8_MAJOR_VERSION 14
1212
#define V8_MINOR_VERSION 3
1313
#define V8_BUILD_NUMBER 127
14-
#define V8_PATCH_LEVEL 12
14+
#define V8_PATCH_LEVEL 14
1515

1616
// Use 1 for candidates and 0 otherwise.
1717
// (Boolean macro values are not supported by all preprocessors.)

‎deps/v8/src/compiler/access-builder.cc‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@
44

55
#include "src/compiler/access-builder.h"
66

7+
#include "src/codegen/machine-type.h"
8+
#include "src/compiler/property-access-builder.h"
79
#include "src/compiler/type-cache.h"
810
#include "src/handles/handles-inl.h"
911
#include "src/objects/arguments.h"
@@ -1097,12 +1099,16 @@ FieldAccess AccessBuilder::ForFeedbackVectorSlot(int index) {
10971099
}
10981100

10991101
// static
1100-
FieldAccess AccessBuilder::ForPropertyArraySlot(int index) {
1102+
FieldAccess AccessBuilder::ForPropertyArraySlot(int index,
1103+
Representation representation) {
11011104
int offset = PropertyArray::OffsetOfElementAt(index);
1102-
FieldAccess access = {kTaggedBase, offset,
1103-
Handle<Name>(), OptionalMapRef(),
1104-
Type::Any(), MachineType::AnyTagged(),
1105-
kFullWriteBarrier, "PropertyArraySlot"};
1105+
MachineType machine_type =
1106+
representation.IsHeapObject() || representation.IsDouble()
1107+
? MachineType::TaggedPointer()
1108+
: MachineType::AnyTagged();
1109+
FieldAccess access = {
1110+
kTaggedBase, offset, Handle<Name>(), OptionalMapRef(),
1111+
Type::Any(), machine_type, kFullWriteBarrier, "PropertyArraySlot"};
11061112
return access;
11071113
}
11081114

‎deps/v8/src/compiler/access-builder.h‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
#include "src/compiler/write-barrier-kind.h"
1212
#include "src/objects/elements-kind.h"
1313
#include "src/objects/js-objects.h"
14+
#include "src/objects/property-details.h"
1415

1516
namespace v8 {
1617
namespace internal {
@@ -323,7 +324,8 @@ class V8_EXPORT_PRIVATE AccessBuilder final
323324
static FieldAccess ForFeedbackVectorSlot(int index);
324325

325326
// Provides access to PropertyArray slots.
326-
static FieldAccess ForPropertyArraySlot(int index);
327+
static FieldAccess ForPropertyArraySlot(int index,
328+
Representation representation);
327329

328330
// Provides access to ScopeInfo flags.
329331
static FieldAccess ForScopeInfoFlags();

‎deps/v8/src/compiler/js-native-context-specialization.cc‎

Lines changed: 43 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@
3838
#include "src/objects/elements-kind.h"
3939
#include "src/objects/feedback-vector.h"
4040
#include "src/objects/heap-number.h"
41+
#include "src/objects/property-details.h"
4142
#include "src/objects/string.h"
4243

4344
namespace v8 {
@@ -4235,25 +4236,59 @@ Node* JSNativeContextSpecialization::BuildExtendPropertiesBackingStore(
42354236
// for intermediate states of chains of property additions. That makes
42364237
// it unclear what the best approach is here.
42374238
DCHECK_EQ(map.UnusedPropertyFields(), 0);
4238-
int length = map.NextFreePropertyIndex() - map.GetInObjectProperties();
4239+
int in_object_length = map.GetInObjectProperties();
4240+
int length = map.NextFreePropertyIndex() - in_object_length;
42394241
// Under normal circumstances, NextFreePropertyIndex() will always be larger
42404242
// than GetInObjectProperties(). However, an attacker able to corrupt heap
42414243
// memory can break this invariant, in which case we'll get confused here,
42424244
// potentially causing a sandbox violation. This CHECK defends against that.
42434245
SBXCHECK_GE(length, 0);
42444246
int new_length = length + JSObject::kFieldsAdded;
4247+
4248+
// Find the descriptor index corresponding to the first out-of-object
4249+
// property.
4250+
DescriptorArrayRef descs = map.instance_descriptors(broker());
4251+
InternalIndex first_out_of_object_descriptor(in_object_length);
4252+
InternalIndex number_of_descriptors(descs.object()->number_of_descriptors());
4253+
for (InternalIndex i(in_object_length); i < number_of_descriptors; ++i) {
4254+
PropertyDetails details = descs.GetPropertyDetails(i);
4255+
// Skip over non-field properties.
4256+
if (details.location() != PropertyLocation::kField) {
4257+
continue;
4258+
}
4259+
// Skip over in-object fields.
4260+
// TODO(leszeks): We could make this smarter, like a binary search.
4261+
if (details.field_index() < in_object_length) {
4262+
continue;
4263+
}
4264+
first_out_of_object_descriptor = i;
4265+
break;
4266+
}
4267+
42454268
// Collect the field values from the {properties}.
4246-
ZoneVector<Node*> values(zone());
4269+
ZoneVector<std::pair<Node*, Representation>> values(zone());
42474270
values.reserve(new_length);
4248-
for (int i = 0; i < length; ++i) {
4271+
4272+
// Walk the property descriptors alongside the property values, to make
4273+
// sure to get and store them with the right machine type.
4274+
InternalIndex descriptor = first_out_of_object_descriptor;
4275+
for (int i = 0; i < length; ++i, ++descriptor) {
4276+
PropertyDetails details = descs.GetPropertyDetails(descriptor);
4277+
while (details.location() != PropertyLocation::kField) {
4278+
++descriptor;
4279+
details = descs.GetPropertyDetails(descriptor);
4280+
}
4281+
DCHECK_EQ(i, details.field_index() - in_object_length);
42494282
Node* value = effect = graph()->NewNode(
4250-
simplified()->LoadField(AccessBuilder::ForFixedArraySlot(i)),
4283+
simplified()->LoadField(
4284+
AccessBuilder::ForPropertyArraySlot(i, details.representation())),
42514285
properties, effect, control);
4252-
values.push_back(value);
4286+
values.push_back({value, details.representation()});
42534287
}
42544288
// Initialize the new fields to undefined.
42554289
for (int i = 0; i < JSObject::kFieldsAdded; ++i) {
4256-
values.push_back(jsgraph()->UndefinedConstant());
4290+
values.push_back(
4291+
{jsgraph()->UndefinedConstant(), Representation::Tagged()});
42574292
}
42584293

42594294
// Compute new length and hash.
@@ -4291,7 +4326,8 @@ Node* JSNativeContextSpecialization::BuildExtendPropertiesBackingStore(
42914326
a.Store(AccessBuilder::ForMap(), jsgraph()->PropertyArrayMapConstant());
42924327
a.Store(AccessBuilder::ForPropertyArrayLengthAndHash(), new_length_and_hash);
42934328
for (int i = 0; i < new_length; ++i) {
4294-
a.Store(AccessBuilder::ForFixedArraySlot(i), values[i]);
4329+
a.Store(AccessBuilder::ForPropertyArraySlot(i, values[i].second),
4330+
values[i].first);
42954331
}
42964332
return a.Finish();
42974333
}

‎deps/v8/src/compiler/turboshaft/turbolev-early-lowering-reducer-inl.h‎

Lines changed: 40 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
#include "src/compiler/turboshaft/representations.h"
1515
#include "src/deoptimizer/deoptimize-reason.h"
1616
#include "src/objects/contexts.h"
17+
#include "src/objects/descriptor-array-inl.h"
1718
#include "src/objects/instance-type-inl.h"
1819

1920
namespace v8::internal::compiler::turboshaft {
@@ -325,8 +326,32 @@ class TurbolevEarlyLoweringReducer : public Next {
325326
}
326327

327328
V<PropertyArray> ExtendPropertiesBackingStore(
328-
V<PropertyArray> old_property_array, V<JSObject> object, int old_length,
329+
V<PropertyArray> old_property_array, V<JSObject> object,
330+
const compiler::MapRef& old_map, int old_length,
329331
V<FrameState> frame_state, const FeedbackSource& feedback) {
332+
int in_object_length = old_map.GetInObjectProperties();
333+
334+
// Find the descriptor index corresponding to the first out-of-object
335+
// property.
336+
DescriptorArrayRef descs = old_map.instance_descriptors(broker_);
337+
InternalIndex first_out_of_object_descriptor(in_object_length);
338+
InternalIndex number_of_descriptors(
339+
descs.object()->number_of_descriptors());
340+
for (InternalIndex i(in_object_length); i < number_of_descriptors; ++i) {
341+
PropertyDetails details = descs.GetPropertyDetails(i);
342+
// Skip over non-field properties.
343+
if (details.location() != PropertyLocation::kField) {
344+
continue;
345+
}
346+
// Skip over in-object fields.
347+
// TODO(leszeks): We could make this smarter, like a binary search.
348+
if (details.field_index() < in_object_length) {
349+
continue;
350+
}
351+
first_out_of_object_descriptor = i;
352+
break;
353+
}
354+
330355
// Allocate new PropertyArray.
331356
int new_length = old_length + JSObject::kFieldsAdded;
332357
Uninitialized<PropertyArray> new_property_array =
@@ -337,18 +362,28 @@ class TurbolevEarlyLoweringReducer : public Next {
337362
__ HeapConstant(factory_->property_array_map()));
338363

339364
// Copy existing properties over.
340-
for (int i = 0; i < old_length; i++) {
365+
InternalIndex descriptor = first_out_of_object_descriptor;
366+
for (int i = 0; i < old_length; ++i, ++descriptor) {
367+
PropertyDetails details = descs.GetPropertyDetails(descriptor);
368+
while (details.location() != PropertyLocation::kField) {
369+
++descriptor;
370+
details = descs.GetPropertyDetails(descriptor);
371+
}
372+
DCHECK_EQ(i, details.field_index() - in_object_length);
373+
Representation r = details.representation();
374+
341375
V<Object> old_value = __ template LoadField<Object>(
342-
old_property_array, AccessBuilder::ForPropertyArraySlot(i));
376+
old_property_array, AccessBuilder::ForPropertyArraySlot(i, r));
343377
__ InitializeField(new_property_array,
344-
AccessBuilder::ForPropertyArraySlot(i), old_value);
378+
AccessBuilder::ForPropertyArraySlot(i, r), old_value);
345379
}
346380

347381
// Initialize new properties to undefined.
348382
V<Undefined> undefined = __ HeapConstant(factory_->undefined_value());
349383
for (int i = 0; i < JSObject::kFieldsAdded; ++i) {
350384
__ InitializeField(new_property_array,
351-
AccessBuilder::ForPropertyArraySlot(old_length + i),
385+
AccessBuilder::ForPropertyArraySlot(
386+
old_length + i, Representation::Tagged()),
352387
undefined);
353388
}
354389

‎deps/v8/src/compiler/turboshaft/turbolev-graph-builder.cc‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2752,10 +2752,11 @@ class GraphBuildingNodeProcessor {
27522752
maglev::ProcessResult Process(maglev::ExtendPropertiesBackingStore* node,
27532753
const maglev::ProcessingState& state) {
27542754
GET_FRAME_STATE_MAYBE_ABORT(frame_state, node->eager_deopt_info());
2755-
SetMap(node, __ ExtendPropertiesBackingStore(
2756-
Map(node->property_array_input()),
2757-
Map(node->object_input()), node->old_length(), frame_state,
2758-
node->eager_deopt_info()->feedback_to_update()));
2755+
SetMap(node,
2756+
__ ExtendPropertiesBackingStore(
2757+
Map(node->property_array_input()), Map(node->object_input()),
2758+
node->old_map(), node->old_length(), frame_state,
2759+
node->eager_deopt_info()->feedback_to_update()));
27592760
return maglev::ProcessResult::kContinue;
27602761
}
27612762

‎deps/v8/src/interpreter/interpreter-generator.cc‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2517,7 +2517,9 @@ IGNITION_HANDLER(SwitchOnSmiNoFeedback, InterpreterAssembler) {
25172517
GotoIf(IntPtrGreaterThanOrEqual(case_value, table_length), &fall_through);
25182518

25192519
TNode<WordT> entry = IntPtrAdd(table_start, case_value);
2520-
TNode<IntPtrT> relative_jump = LoadAndUntagConstantPoolEntry(entry);
2520+
TNode<Object> constant_entry = LoadConstantPoolEntry(entry);
2521+
CSA_SBXCHECK(this, TaggedIsSmi(constant_entry));
2522+
TNode<IntPtrT> relative_jump = SmiUntag(CAST(constant_entry));
25212523
Jump(relative_jump);
25222524

25232525
BIND(&fall_through);
@@ -3437,7 +3439,9 @@ IGNITION_HANDLER(SwitchOnGeneratorState, InterpreterAssembler) {
34373439
USE(table_length); // SBXCHECK is a DCHECK when the sandbox is disabled.
34383440

34393441
TNode<WordT> entry = IntPtrAdd(table_start, case_value);
3440-
TNode<IntPtrT> relative_jump = LoadAndUntagConstantPoolEntry(entry);
3442+
TNode<Object> constant_entry = LoadConstantPoolEntry(entry);
3443+
CSA_SBXCHECK(this, TaggedIsSmi(constant_entry));
3444+
TNode<IntPtrT> relative_jump = SmiUntag(CAST(constant_entry));
34413445
Jump(relative_jump);
34423446

34433447
BIND(&fallthrough);

‎deps/v8/src/maglev/maglev-graph-builder.cc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5225,7 +5225,7 @@ ReduceResult MaglevGraphBuilder::BuildExtendPropertiesBackingStore(
52255225
// potentially causing a sandbox violation. This CHECK defends against that.
52265226
SBXCHECK_GE(length, 0);
52275227
return AddNewNode<ExtendPropertiesBackingStore>({property_array, receiver},
5228-
length);
5228+
map, length);
52295229
}
52305230

52315231
MaybeReduceResult MaglevGraphBuilder::TryBuildStoreField(

‎deps/v8/src/maglev/maglev-ir.h‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9441,8 +9441,10 @@ class ExtendPropertiesBackingStore
94419441
using Base = FixedInputValueNodeT<2, ExtendPropertiesBackingStore>;
94429442

94439443
public:
9444-
explicit ExtendPropertiesBackingStore(uint64_t bitfield, int old_length)
9445-
: Base(bitfield), old_length_(old_length) {}
9444+
explicit ExtendPropertiesBackingStore(uint64_t bitfield,
9445+
const compiler::MapRef& old_map,
9446+
int old_length)
9447+
: Base(bitfield), old_map_(old_map), old_length_(old_length) {}
94469448

94479449
static constexpr OpProperties kProperties =
94489450
OpProperties::CanAllocate() | OpProperties::CanRead() |
@@ -9462,9 +9464,11 @@ class ExtendPropertiesBackingStore
94629464
void GenerateCode(MaglevAssembler*, const ProcessingState&);
94639465
void PrintParams(std::ostream&) const;
94649466

9467+
const compiler::MapRef& old_map() const { return old_map_; }
94659468
int old_length() const { return old_length_; }
94669469

94679470
private:
9471+
const compiler::MapRef old_map_;
94689472
const int old_length_;
94699473
};
94709474

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL