1berry/nodejs
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

deps: patch V8 to 10.7.193.22

Browse Source 
Refs: https://github.com/v8/v8/compare/10.7.193.20...10.7.193.22
PR-URL: https://github.com/nodejs/node/pull/45460
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
This commit is contained in:
Michaël Zasso 2022-11-16 17:56:12 +01:00 committed by GitHub
parent 767574938d
commit 8f9dc2732e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 48 additions and 52 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
deps/v8/include/v8-version.h vendored
View File

@ -11,7 +11,7 @@
#define V8_MAJOR_VERSION 10 #define V8_MAJOR_VERSION 10
#define V8_MINOR_VERSION 7 #define V8_MINOR_VERSION 7
#define V8_BUILD_NUMBER 193 #define V8_BUILD_NUMBER 193
#define V8_PATCH_LEVEL 20 #define V8_PATCH_LEVEL 22
// Use 1 for candidates and 0 otherwise. // Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.) // (Boolean macro values are not supported by all preprocessors.)

49
deps/v8/src/compiler/effect-control-linearizer.cc vendored
View File

@ -5294,6 +5294,8 @@ Node* EffectControlLinearizer::LowerLoadFieldByIndex(Node* node) {
auto if_double = __ MakeDeferredLabel(); auto if_double = __ MakeDeferredLabel();
auto done = __ MakeLabel(MachineRepresentation::kTagged); auto done = __ MakeLabel(MachineRepresentation::kTagged);
auto loaded_field = __ MakeLabel(MachineRepresentation::kTagged);
auto done_double = __ MakeLabel(MachineRepresentation::kFloat64);
// Check if field is a mutable double field. // Check if field is a mutable double field.
__ GotoIfNot(__ IntPtrEqual(__ WordAnd(index, one), zero), &if_double); __ GotoIfNot(__ IntPtrEqual(__ WordAnd(index, one), zero), &if_double);
@ -5310,8 +5312,8 @@ Node* EffectControlLinearizer::LowerLoadFieldByIndex(Node* node) {
Node* offset = Node* offset =
__ IntAdd(__ WordShl(index, __ IntPtrConstant(kTaggedSizeLog2 - 1)), __ IntAdd(__ WordShl(index, __ IntPtrConstant(kTaggedSizeLog2 - 1)),
__ IntPtrConstant(JSObject::kHeaderSize - kHeapObjectTag)); __ IntPtrConstant(JSObject::kHeaderSize - kHeapObjectTag));
Node* result = __ Load(MachineType::AnyTagged(), object, offset); Node* field = __ Load(MachineType::AnyTagged(), object, offset);
__ Goto(&done, result); __ Goto(&loaded_field, field);
} }
// The field is located in the properties backing store of {object}. // The field is located in the properties backing store of {object}.
@ -5325,8 +5327,8 @@ Node* EffectControlLinearizer::LowerLoadFieldByIndex(Node* node) {
__ IntPtrConstant(kTaggedSizeLog2 - 1)), __ IntPtrConstant(kTaggedSizeLog2 - 1)),
__ IntPtrConstant((FixedArray::kHeaderSize - kTaggedSize) - __ IntPtrConstant((FixedArray::kHeaderSize - kTaggedSize) -
kHeapObjectTag)); kHeapObjectTag));
Node* result = __ Load(MachineType::AnyTagged(), properties, offset); Node* field = __ Load(MachineType::AnyTagged(), properties, offset);
__ Goto(&done, result); __ Goto(&loaded_field, field);
} }
} }
@ -5334,9 +5336,6 @@ Node* EffectControlLinearizer::LowerLoadFieldByIndex(Node* node) {
// architectures, or a mutable HeapNumber. // architectures, or a mutable HeapNumber.
__ Bind(&if_double); __ Bind(&if_double);
{ {
auto loaded_field = __ MakeLabel(MachineRepresentation::kTagged);
auto done_double = __ MakeLabel(MachineRepresentation::kFloat64);
index = __ WordSar(index, one); index = __ WordSar(index, one);
// Check if field is in-object or out-of-object. // Check if field is in-object or out-of-object.
@ -5364,27 +5363,27 @@ Node* EffectControlLinearizer::LowerLoadFieldByIndex(Node* node) {
Node* field = __ Load(MachineType::AnyTagged(), properties, offset); Node* field = __ Load(MachineType::AnyTagged(), properties, offset);
__ Goto(&loaded_field, field); __ Goto(&loaded_field, field);
} }
}
__ Bind(&loaded_field); __ Bind(&loaded_field);
{ {
Node* field = loaded_field.PhiAt(0); Node* field = loaded_field.PhiAt(0);
// We may have transitioned in-place away from double, so check that // We may have transitioned in-place away from double, so check that
// this is a HeapNumber -- otherwise the load is fine and we don't need // this is a HeapNumber -- otherwise the load is fine and we don't need
// to copy anything anyway. // to copy anything anyway.
__ GotoIf(ObjectIsSmi(field), &done, field); __ GotoIf(ObjectIsSmi(field), &done, field);
Node* field_map = __ LoadField(AccessBuilder::ForMap(), field); Node* field_map = __ LoadField(AccessBuilder::ForMap(), field);
__ GotoIfNot(__ TaggedEqual(field_map, __ HeapNumberMapConstant()), &done, __ GotoIfNot(__ TaggedEqual(field_map, __ HeapNumberMapConstant()), &done,
field); field);
Node* value = __ LoadField(AccessBuilder::ForHeapNumberValue(), field); Node* value = __ LoadField(AccessBuilder::ForHeapNumberValue(), field);
__ Goto(&done_double, value); __ Goto(&done_double, value);
} }
__ Bind(&done_double); __ Bind(&done_double);
{ {
Node* result = AllocateHeapNumberWithValue(done_double.PhiAt(0)); Node* result = AllocateHeapNumberWithValue(done_double.PhiAt(0));
__ Goto(&done, result); __ Goto(&done, result);
}
} }
__ Bind(&done); __ Bind(&done);

49
deps/v8/src/compiler/js-call-reducer.cc vendored
View File

@ -710,9 +710,8 @@ class IteratingArrayBuiltinReducerAssembler : public JSCallReducerAssembler {
MapInference* inference, const bool has_stability_dependency, MapInference* inference, const bool has_stability_dependency,
ElementsKind kind, const SharedFunctionInfoRef& shared, ElementsKind kind, const SharedFunctionInfoRef& shared,
const NativeContextRef& native_context, ArrayEverySomeVariant variant); const NativeContextRef& native_context, ArrayEverySomeVariant variant);
TNode<Object> ReduceArrayPrototypeAt(ZoneVector<ElementsKind> kinds, TNode<Object> ReduceArrayPrototypeAt(ZoneVector<const MapRef*> kinds,
bool needs_fallback_builtin_call, bool needs_fallback_builtin_call);
Node* receiver_kind);
TNode<Object> ReduceArrayPrototypeIndexOfIncludes( TNode<Object> ReduceArrayPrototypeIndexOfIncludes(
ElementsKind kind, ArrayIndexOfIncludesVariant variant); ElementsKind kind, ArrayIndexOfIncludesVariant variant);
@ -1323,24 +1322,26 @@ TNode<String> JSCallReducerAssembler::ReduceStringPrototypeSlice() {
} }
TNode<Object> IteratingArrayBuiltinReducerAssembler::ReduceArrayPrototypeAt( TNode<Object> IteratingArrayBuiltinReducerAssembler::ReduceArrayPrototypeAt(
ZoneVector<ElementsKind> kinds, bool needs_fallback_builtin_call, ZoneVector<const MapRef*> maps, bool needs_fallback_builtin_call) {
Node* receiver_kind) {
TNode<JSArray> receiver = ReceiverInputAs<JSArray>(); TNode<JSArray> receiver = ReceiverInputAs<JSArray>();
TNode<Object> index = ArgumentOrZero(0); TNode<Object> index = ArgumentOrZero(0);
TNode<Number> index_num = CheckSmi(index); TNode<Number> index_num = CheckSmi(index);
TNode<FixedArrayBase> elements = LoadElements(receiver); TNode<FixedArrayBase> elements = LoadElements(receiver);
TNode<Map> receiver_map =
TNode<Map>::UncheckedCast(LoadField(AccessBuilder::ForMap(), receiver));
auto out = MakeLabel(MachineRepresentation::kTagged); auto out = MakeLabel(MachineRepresentation::kTagged);
for (ElementsKind kind : kinds) { for (const MapRef* map : maps) {
DCHECK(map->supports_fast_array_iteration());
auto correct_map_label = MakeLabel(), wrong_map_label = MakeLabel(); auto correct_map_label = MakeLabel(), wrong_map_label = MakeLabel();
Branch(NumberEqual(TNode<Number>::UncheckedCast(receiver_kind), TNode<Boolean> is_map_equal = ReferenceEqual(receiver_map, Constant(*map));
NumberConstant(kind)), Branch(is_map_equal, &correct_map_label, &wrong_map_label);
&correct_map_label, &wrong_map_label);
Bind(&correct_map_label); Bind(&correct_map_label);
TNode<Number> length = LoadJSArrayLength(receiver, kind); TNode<Number> length = LoadJSArrayLength(receiver, map->elements_kind());
// If index is less than 0, then subtract from length. // If index is less than 0, then subtract from length.
TNode<Boolean> cond = NumberLessThan(index_num, ZeroConstant()); TNode<Boolean> cond = NumberLessThan(index_num, ZeroConstant());
@ -1359,15 +1360,16 @@ TNode<Object> IteratingArrayBuiltinReducerAssembler::ReduceArrayPrototypeAt(
// Retrieving element at index. // Retrieving element at index.
TNode<Object> element = LoadElement<Object>( TNode<Object> element = LoadElement<Object>(
AccessBuilder::ForFixedArrayElement(kind), elements, real_index_num); AccessBuilder::ForFixedArrayElement(map->elements_kind()), elements,
if (IsHoleyElementsKind(kind)) { real_index_num);
if (IsHoleyElementsKind(map->elements_kind())) {
// This case is needed in particular for HOLEY_DOUBLE_ELEMENTS: raw // This case is needed in particular for HOLEY_DOUBLE_ELEMENTS: raw
// doubles are stored in the FixedDoubleArray, and need to be converted to // doubles are stored in the FixedDoubleArray, and need to be converted to
// HeapNumber or to Smi so that this function can return an Object. The // HeapNumber or to Smi so that this function can return an Object. The
// automatic converstion performed by // automatic converstion performed by
// RepresentationChanger::GetTaggedRepresentationFor does not handle // RepresentationChanger::GetTaggedRepresentationFor does not handle
// holes, so we convert manually a potential hole here. // holes, so we convert manually a potential hole here.
element = TryConvertHoleToUndefined(element, kind); element = TryConvertHoleToUndefined(element, map->elements_kind());
} }
Goto(&out, element); Goto(&out, element);
@ -5633,25 +5635,22 @@ Reduction JSCallReducer::ReduceArrayPrototypeAt(Node* node) {
MapInference inference(broker(), receiver, effect); MapInference inference(broker(), receiver, effect);
if (!inference.HaveMaps()) return NoChange(); if (!inference.HaveMaps()) return NoChange();
// Collecting kinds // Collecting maps, and checking if a fallback builtin call will be required
ZoneVector<ElementsKind> kinds(broker()->zone()); // (it is required if at least one map doesn't support fast array iteration).
ZoneVector<const MapRef*> maps(broker()->zone());
bool needs_fallback_builtin_call = false; bool needs_fallback_builtin_call = false;
for (const MapRef& map : inference.GetMaps()) { for (const MapRef& map : inference.GetMaps()) {
if (map.supports_fast_array_iteration()) { if (map.supports_fast_array_iteration()) {
ElementsKind kind = map.elements_kind(); maps.push_back(&map);
// Checking that |kind| isn't already in |kinds|. Using std::find should
// be fast enough since |kinds| can contain at most 4 items.
if (std::find(kinds.begin(), kinds.end(), kind) == kinds.end()) {
kinds.push_back(kind);
}
} else { } else {
needs_fallback_builtin_call = true; needs_fallback_builtin_call = true;
} }
} }
inference.RelyOnMapsPreferStability(dependencies(), jsgraph(), &effect, inference.RelyOnMapsPreferStability(dependencies(), jsgraph(), &effect,
control, p.feedback()); control, p.feedback());
if (kinds.empty()) { if (maps.empty()) {
// No map in the feedback supports fast iteration. Keeping the builtin call. // No map in the feedback supports fast iteration. Keeping the builtin call.
return NoChange(); return NoChange();
} }
@ -5660,13 +5659,11 @@ Reduction JSCallReducer::ReduceArrayPrototypeAt(Node* node) {
return NoChange(); return NoChange();
} }
Node* receiver_kind = LoadReceiverElementsKind(receiver, &effect, control);
IteratingArrayBuiltinReducerAssembler a(this, node); IteratingArrayBuiltinReducerAssembler a(this, node);
a.InitializeEffectControl(effect, control); a.InitializeEffectControl(effect, control);
TNode<Object> subgraph = a.ReduceArrayPrototypeAt( TNode<Object> subgraph =
kinds, needs_fallback_builtin_call, receiver_kind); a.ReduceArrayPrototypeAt(maps, needs_fallback_builtin_call);
return ReplaceWithSubgraph(&a, subgraph); return ReplaceWithSubgraph(&a, subgraph);
} }