FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

deps: patch V8 to 13.7.152.10 · nodejs/node@f77a96c · GitHub

/ node Public

Commit f77a96c

Browse files
nodejs-github-bot
authored
deps: patch V8 to 13.7.152.10
Refs: v8/v8@13.7.152.9...13.7.152.10 PR-URL: #58446 Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
1 parent a4c7c9f commit f77a96c

9 files changed

Lines changed: 126 additions & 5 deletions

File tree

‎deps/v8/include/v8-version.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
#define V8_MAJOR_VERSION 13
1212
#define V8_MINOR_VERSION 7
1313
#define V8_BUILD_NUMBER 152
14-
#define V8_PATCH_LEVEL 9
14+
#define V8_PATCH_LEVEL 10
1515

1616
// Use 1 for candidates and 0 otherwise.
1717
// (Boolean macro values are not supported by all preprocessors.)

‎deps/v8/src/compiler/turboshaft/late-load-elimination-reducer.cc‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -409,11 +409,17 @@ void LateLoadEliminationAnalyzer::ProcessStore(OpIndex op_idx,
409409
non_aliasing_objects_.Set(value, false);
410410
}
411411

412-
// If we just stored a map, invalidate the maps for this base.
412+
// If we just stored a map, invalidate all object_maps_.
413413
if (store.offset == HeapObject::kMapOffset && !store.index().valid()) {
414-
if (object_maps_.HasKeyFor(store.base())) {
415-
TRACE(">> Wiping map\n");
416-
object_maps_.Set(store.base(), MapMaskAndOr{});
414+
// TODO(dmercadier): can we only do this for objects that are potentially
415+
// aliasing with the `base` (based on their maps and the maps of `base`)?
416+
// Also, it might be worth to record a new map if this is actually a map
417+
// store.
418+
// TODO(dmercadier): do this only if `value` is a Constant with kind
419+
// kHeapObject, since all map stores should store a known constant maps.
420+
TRACE(">> Wiping all maps\n");
421+
for (auto it : object_maps_) {
422+
object_maps_.Set(it.second, MapMaskAndOr{});
417423
}
418424
}
419425
}

‎deps/v8/src/compiler/turboshaft/snapshot-table-opindex.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,9 @@ class SparseOpIndexSnapshotTable : public SnapshotTable<Value, KeyData> {
6060
return std::nullopt;
6161
}
6262

63+
auto begin() { return indices_to_keys_.begin(); }
64+
auto end() { return indices_to_keys_.end(); }
65+
6366
private:
6467
Key GetOrCreateKey(OpIndex idx) {
6568
auto it = indices_to_keys_.find(idx);

‎deps/v8/src/compiler/turboshaft/store-store-elimination-phase.cc‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,9 @@
1818
namespace v8::internal::compiler::turboshaft {
1919

2020
void StoreStoreEliminationPhase::Run(PipelineData* data, Zone* temp_zone) {
21+
UnparkedScopeIfNeeded unparked_scope(
22+
data->broker(), v8_flags.turboshaft_trace_load_elimination);
23+
2124
turboshaft::CopyingPhase<
2225
LoopStackCheckElisionReducer, StoreStoreEliminationReducer,
2326
LateLoadEliminationReducer, MachineOptimizationReducer,

‎deps/v8/src/flags/flag-definitions.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1610,6 +1610,8 @@ DEFINE_BOOL_READONLY(turboshaft_trace_emitted, false,
16101610
"trace emitted Turboshaft instructions")
16111611
DEFINE_BOOL_READONLY(turboshaft_trace_intermediate_reductions, false,
16121612
"trace intermediate Turboshaft reduction steps")
1613+
DEFINE_BOOL_READONLY(turboshaft_trace_load_elimination, false,
1614+
"trace Turboshaft's late load elimination")
16131615
#endif // DEBUG
16141616

16151617
DEFINE_BOOL(profile_guided_optimization, true, "profile guided optimization")

‎deps/v8/test/mjsunit/turboshaft/regress-417169470-1.js‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
// Copyright 2025 the V8 project authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style license that can be
3+
// found in the LICENSE file.
4+
//
5+
// Flags: --allow-natives-syntax --turbofan
6+
7+
function foo(a, b, c) {
8+
a.x = 42;
9+
b.y = 99; // Transitioning store
10+
c.x = 17;
11+
return a.x;
12+
}
13+
14+
// Using a constructor so that we don't go out of object when creating the .y
15+
// property in foo.
16+
function MyObject() { this.x = 27; }
17+
let o1 = new MyObject();
18+
let o2 = new MyObject();
19+
20+
%PrepareFunctionForOptimization(foo);
21+
assertEquals(17, foo(o1, o1, o1));
22+
23+
%OptimizeFunctionOnNextCall(foo);
24+
assertEquals(17, foo(o2, o2, o2));

‎deps/v8/test/mjsunit/turboshaft/regress-417169470-2.js‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
// Copyright 2025 the V8 project authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style license that can be
3+
// found in the LICENSE file.
4+
//
5+
// Flags: --allow-natives-syntax --turbofan
6+
7+
function foo(a, b, c) {
8+
a.x = 42;
9+
b.y = 99; // Transitioning store
10+
c.x = 17;
11+
return a.x;
12+
}
13+
14+
let o1 = { x : 27 };
15+
let o2 = { x : 27 };
16+
17+
%PrepareFunctionForOptimization(foo);
18+
assertEquals(17, foo(o1, o1, o1));
19+
20+
%OptimizeFunctionOnNextCall(foo);
21+
assertEquals(17, foo(o2, o2, o2));

‎deps/v8/test/mjsunit/turboshaft/regress-417169470-3.js‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
// Copyright 2025 the V8 project authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style license that can be
3+
// found in the LICENSE file.
4+
//
5+
// Flags: --allow-natives-syntax --turbofan
6+
7+
function foo(a, b, c) {
8+
a.x = 42;
9+
b.y = 99; // Transitioning store
10+
c.x = 17;
11+
return a.x;
12+
}
13+
14+
let o1 = { x : 27 };
15+
// If we add additional properties, we need to add at least 2 so that `b.y = 99`
16+
// doesn't end up at offset 12, because that's also the offset of .x (which is
17+
// in-object rather than out-of-object), and because we don't have map
18+
// information for backing stores in Late load elimination, we'll assume that
19+
// the store at b.y can alias with the a.x that was previously loaded.
20+
o1.unused1 = 12;
21+
o1.unused2 = 12;
22+
23+
let o2 = { x : 27 };
24+
o2.unused1 = 12;
25+
o2.unused2 = 12;
26+
27+
%PrepareFunctionForOptimization(foo);
28+
assertEquals(17, foo(o1, o1, o1));
29+
30+
%OptimizeFunctionOnNextCall(foo);
31+
assertEquals(17, foo(o2, o2, o2));

‎deps/v8/test/mjsunit/turboshaft/regress-417169470-4.js‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
// Copyright 2025 the V8 project authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style license that can be
3+
// found in the LICENSE file.
4+
//
5+
// Flags: --allow-natives-syntax --turbofan
6+
7+
function opt() {
8+
const nop = 0;
9+
const empty = {};
10+
const a = {p1: 42.42};
11+
12+
function foo(b) {
13+
nop;
14+
15+
a.p4 = 42;
16+
b.p2 = 42;
17+
b.p5 = empty;
18+
a.p6 = 41.414;
19+
}
20+
21+
a.p3 = 42;
22+
a.p4 = 42;
23+
24+
for (let i = 0; i < 300; i++) {
25+
foo(a);
26+
}
27+
}
28+
29+
opt();
30+
opt();
31+
opt();

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL