deps: patch V8 to 7.4.288.17
Refs: https://github.com/v8/v8/compare/7.4.288.13...7.4.288.17 PR-URL: https://github.com/nodejs/node/pull/27066 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Refael Ackermann <refack@gmail.com>
This commit is contained in:
parent
c86883cfac
commit
c1d61f2b4b
2
deps/v8/include/v8-version.h
vendored
2
deps/v8/include/v8-version.h
vendored
@ -11,7 +11,7 @@
|
|||||||
#define V8_MAJOR_VERSION 7
|
#define V8_MAJOR_VERSION 7
|
||||||
#define V8_MINOR_VERSION 4
|
#define V8_MINOR_VERSION 4
|
||||||
#define V8_BUILD_NUMBER 288
|
#define V8_BUILD_NUMBER 288
|
||||||
#define V8_PATCH_LEVEL 13
|
#define V8_PATCH_LEVEL 17
|
||||||
|
|
||||||
// Use 1 for candidates and 0 otherwise.
|
// Use 1 for candidates and 0 otherwise.
|
||||||
// (Boolean macro values are not supported by all preprocessors.)
|
// (Boolean macro values are not supported by all preprocessors.)
|
||||||
|
2
deps/v8/src/builtins/array-map.tq
vendored
2
deps/v8/src/builtins/array-map.tq
vendored
@ -127,7 +127,7 @@ namespace array_map {
|
|||||||
for (let i: Smi = 0; i < validLength; i++) {
|
for (let i: Smi = 0; i < validLength; i++) {
|
||||||
typeswitch (this.fixedArray.objects[i]) {
|
typeswitch (this.fixedArray.objects[i]) {
|
||||||
case (n: Number): {
|
case (n: Number): {
|
||||||
elements.floats[i] = Float64SilenceNaN(Convert<float64>(n));
|
elements.floats[i] = Convert<float64>(n);
|
||||||
}
|
}
|
||||||
case (h: HeapObject): {
|
case (h: HeapObject): {
|
||||||
assert(h == Hole);
|
assert(h == Hole);
|
||||||
|
2
deps/v8/src/builtins/base.tq
vendored
2
deps/v8/src/builtins/base.tq
vendored
@ -1464,8 +1464,6 @@ operator '[]=' macro StoreFixedArrayDirect(a: FixedArray, i: Smi, v: Object) {
|
|||||||
|
|
||||||
extern operator '.instance_type' macro LoadMapInstanceType(Map): int32;
|
extern operator '.instance_type' macro LoadMapInstanceType(Map): int32;
|
||||||
|
|
||||||
extern macro Float64SilenceNaN(float64): float64;
|
|
||||||
|
|
||||||
extern macro GetNumberDictionaryNumberOfElements(NumberDictionary): Smi;
|
extern macro GetNumberDictionaryNumberOfElements(NumberDictionary): Smi;
|
||||||
extern macro GetIteratorMethod(implicit context: Context)(HeapObject): Object
|
extern macro GetIteratorMethod(implicit context: Context)(HeapObject): Object
|
||||||
labels IfIteratorUndefined;
|
labels IfIteratorUndefined;
|
||||||
|
13
deps/v8/src/code-stub-assembler.cc
vendored
13
deps/v8/src/code-stub-assembler.cc
vendored
@ -2827,7 +2827,9 @@ void CodeStubAssembler::StoreFixedDoubleArrayElement(
|
|||||||
ElementOffsetFromIndex(index_node, PACKED_DOUBLE_ELEMENTS, parameter_mode,
|
ElementOffsetFromIndex(index_node, PACKED_DOUBLE_ELEMENTS, parameter_mode,
|
||||||
FixedArray::kHeaderSize - kHeapObjectTag);
|
FixedArray::kHeaderSize - kHeapObjectTag);
|
||||||
MachineRepresentation rep = MachineRepresentation::kFloat64;
|
MachineRepresentation rep = MachineRepresentation::kFloat64;
|
||||||
StoreNoWriteBarrier(rep, object, offset, value);
|
// Make sure we do not store signalling NaNs into double arrays.
|
||||||
|
TNode<Float64T> value_silenced = Float64SilenceNaN(value);
|
||||||
|
StoreNoWriteBarrier(rep, object, offset, value_silenced);
|
||||||
}
|
}
|
||||||
|
|
||||||
void CodeStubAssembler::StoreFeedbackVectorSlot(Node* object,
|
void CodeStubAssembler::StoreFeedbackVectorSlot(Node* object,
|
||||||
@ -2981,7 +2983,9 @@ void CodeStubAssembler::TryStoreArrayElement(ElementsKind kind,
|
|||||||
} else if (IsDoubleElementsKind(kind)) {
|
} else if (IsDoubleElementsKind(kind)) {
|
||||||
GotoIfNotNumber(value, bailout);
|
GotoIfNotNumber(value, bailout);
|
||||||
}
|
}
|
||||||
if (IsDoubleElementsKind(kind)) value = ChangeNumberToFloat64(value);
|
if (IsDoubleElementsKind(kind)) {
|
||||||
|
value = ChangeNumberToFloat64(value);
|
||||||
|
}
|
||||||
StoreElement(elements, kind, index, value, mode);
|
StoreElement(elements, kind, index, value, mode);
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -10236,9 +10240,8 @@ void CodeStubAssembler::StoreElement(Node* elements, ElementsKind kind,
|
|||||||
StoreNoWriteBarrier(rep, elements, offset, value);
|
StoreNoWriteBarrier(rep, elements, offset, value);
|
||||||
return;
|
return;
|
||||||
} else if (IsDoubleElementsKind(kind)) {
|
} else if (IsDoubleElementsKind(kind)) {
|
||||||
// Make sure we do not store signalling NaNs into double arrays.
|
TNode<Float64T> value_float64 = UncheckedCast<Float64T>(value);
|
||||||
TNode<Float64T> value_silenced = Float64SilenceNaN(value);
|
StoreFixedDoubleArrayElement(CAST(elements), index, value_float64, mode);
|
||||||
StoreFixedDoubleArrayElement(CAST(elements), index, value_silenced, mode);
|
|
||||||
} else {
|
} else {
|
||||||
WriteBarrierMode barrier_mode =
|
WriteBarrierMode barrier_mode =
|
||||||
IsSmiElementsKind(kind) ? SKIP_WRITE_BARRIER : UPDATE_WRITE_BARRIER;
|
IsSmiElementsKind(kind) ? SKIP_WRITE_BARRIER : UPDATE_WRITE_BARRIER;
|
||||||
|
3
deps/v8/src/compiler/node-properties.cc
vendored
3
deps/v8/src/compiler/node-properties.cc
vendored
@ -412,7 +412,8 @@ NodeProperties::InferReceiverMapsResult NodeProperties::InferReceiverMaps(
|
|||||||
mnewtarget.Ref(broker).IsJSFunction()) {
|
mnewtarget.Ref(broker).IsJSFunction()) {
|
||||||
JSFunctionRef original_constructor =
|
JSFunctionRef original_constructor =
|
||||||
mnewtarget.Ref(broker).AsJSFunction();
|
mnewtarget.Ref(broker).AsJSFunction();
|
||||||
if (original_constructor.has_initial_map()) {
|
if (original_constructor.map().has_prototype_slot() &&
|
||||||
|
original_constructor.has_initial_map()) {
|
||||||
original_constructor.Serialize();
|
original_constructor.Serialize();
|
||||||
MapRef initial_map = original_constructor.initial_map();
|
MapRef initial_map = original_constructor.initial_map();
|
||||||
if (initial_map.GetConstructor().equals(mtarget.Ref(broker))) {
|
if (initial_map.GetConstructor().equals(mtarget.Ref(broker))) {
|
||||||
|
1
deps/v8/src/heap/mark-compact.cc
vendored
1
deps/v8/src/heap/mark-compact.cc
vendored
@ -1645,6 +1645,7 @@ void MarkCompactCollector::ProcessEphemeronsLinear() {
|
|||||||
// is necessary.
|
// is necessary.
|
||||||
|
|
||||||
work_to_do = !marking_worklist()->IsEmpty() ||
|
work_to_do = !marking_worklist()->IsEmpty() ||
|
||||||
|
!marking_worklist()->IsEmbedderEmpty() ||
|
||||||
!heap()->local_embedder_heap_tracer()->IsRemoteTracingDone();
|
!heap()->local_embedder_heap_tracer()->IsRemoteTracingDone();
|
||||||
CHECK(weak_objects_.discovered_ephemerons.IsEmpty());
|
CHECK(weak_objects_.discovered_ephemerons.IsEmpty());
|
||||||
}
|
}
|
||||||
|
10
deps/v8/src/regexp/regexp-utils.cc
vendored
10
deps/v8/src/regexp/regexp-utils.cc
vendored
@ -36,7 +36,7 @@ Handle<String> RegExpUtils::GenericCaptureGetter(
|
|||||||
|
|
||||||
namespace {
|
namespace {
|
||||||
|
|
||||||
V8_INLINE bool HasInitialRegExpMap(Isolate* isolate, Handle<JSReceiver> recv) {
|
V8_INLINE bool HasInitialRegExpMap(Isolate* isolate, JSReceiver recv) {
|
||||||
return recv->map() == isolate->regexp_function()->initial_map();
|
return recv->map() == isolate->regexp_function()->initial_map();
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -47,7 +47,7 @@ MaybeHandle<Object> RegExpUtils::SetLastIndex(Isolate* isolate,
|
|||||||
uint64_t value) {
|
uint64_t value) {
|
||||||
Handle<Object> value_as_object =
|
Handle<Object> value_as_object =
|
||||||
isolate->factory()->NewNumberFromInt64(value);
|
isolate->factory()->NewNumberFromInt64(value);
|
||||||
if (HasInitialRegExpMap(isolate, recv)) {
|
if (HasInitialRegExpMap(isolate, *recv)) {
|
||||||
JSRegExp::cast(*recv)->set_last_index(*value_as_object, SKIP_WRITE_BARRIER);
|
JSRegExp::cast(*recv)->set_last_index(*value_as_object, SKIP_WRITE_BARRIER);
|
||||||
return recv;
|
return recv;
|
||||||
} else {
|
} else {
|
||||||
@ -59,7 +59,7 @@ MaybeHandle<Object> RegExpUtils::SetLastIndex(Isolate* isolate,
|
|||||||
|
|
||||||
MaybeHandle<Object> RegExpUtils::GetLastIndex(Isolate* isolate,
|
MaybeHandle<Object> RegExpUtils::GetLastIndex(Isolate* isolate,
|
||||||
Handle<JSReceiver> recv) {
|
Handle<JSReceiver> recv) {
|
||||||
if (HasInitialRegExpMap(isolate, recv)) {
|
if (HasInitialRegExpMap(isolate, *recv)) {
|
||||||
return handle(JSRegExp::cast(*recv)->last_index(), isolate);
|
return handle(JSRegExp::cast(*recv)->last_index(), isolate);
|
||||||
} else {
|
} else {
|
||||||
return Object::GetProperty(isolate, recv,
|
return Object::GetProperty(isolate, recv,
|
||||||
@ -155,9 +155,7 @@ bool RegExpUtils::IsUnmodifiedRegExp(Isolate* isolate, Handle<Object> obj) {
|
|||||||
|
|
||||||
JSReceiver recv = JSReceiver::cast(*obj);
|
JSReceiver recv = JSReceiver::cast(*obj);
|
||||||
|
|
||||||
// Check the receiver's map.
|
if (!HasInitialRegExpMap(isolate, recv)) return false;
|
||||||
Handle<JSFunction> regexp_function = isolate->regexp_function();
|
|
||||||
if (recv->map() != regexp_function->initial_map()) return false;
|
|
||||||
|
|
||||||
// Check the receiver's prototype's map.
|
// Check the receiver's prototype's map.
|
||||||
Object proto = recv->map()->prototype();
|
Object proto = recv->map()->prototype();
|
||||||
|
44
deps/v8/src/runtime/runtime-regexp.cc
vendored
44
deps/v8/src/runtime/runtime-regexp.cc
vendored
@ -1250,10 +1250,9 @@ static Object SearchRegExpMultiple(Isolate* isolate, Handle<String> subject,
|
|||||||
// doesn't properly call the underlying exec method.
|
// doesn't properly call the underlying exec method.
|
||||||
V8_WARN_UNUSED_RESULT MaybeHandle<String> RegExpReplace(
|
V8_WARN_UNUSED_RESULT MaybeHandle<String> RegExpReplace(
|
||||||
Isolate* isolate, Handle<JSRegExp> regexp, Handle<String> string,
|
Isolate* isolate, Handle<JSRegExp> regexp, Handle<String> string,
|
||||||
Handle<Object> replace_obj) {
|
Handle<String> replace) {
|
||||||
// Functional fast-paths are dispatched directly by replace builtin.
|
// Functional fast-paths are dispatched directly by replace builtin.
|
||||||
DCHECK(RegExpUtils::IsUnmodifiedRegExp(isolate, regexp));
|
DCHECK(RegExpUtils::IsUnmodifiedRegExp(isolate, regexp));
|
||||||
DCHECK(!replace_obj->IsCallable());
|
|
||||||
|
|
||||||
Factory* factory = isolate->factory();
|
Factory* factory = isolate->factory();
|
||||||
|
|
||||||
@ -1261,9 +1260,6 @@ V8_WARN_UNUSED_RESULT MaybeHandle<String> RegExpReplace(
|
|||||||
const bool global = (flags & JSRegExp::kGlobal) != 0;
|
const bool global = (flags & JSRegExp::kGlobal) != 0;
|
||||||
const bool sticky = (flags & JSRegExp::kSticky) != 0;
|
const bool sticky = (flags & JSRegExp::kSticky) != 0;
|
||||||
|
|
||||||
Handle<String> replace;
|
|
||||||
ASSIGN_RETURN_ON_EXCEPTION(isolate, replace,
|
|
||||||
Object::ToString(isolate, replace_obj), String);
|
|
||||||
replace = String::Flatten(isolate, replace);
|
replace = String::Flatten(isolate, replace);
|
||||||
|
|
||||||
Handle<RegExpMatchInfo> last_match_info = isolate->regexp_last_match_info();
|
Handle<RegExpMatchInfo> last_match_info = isolate->regexp_last_match_info();
|
||||||
@ -1363,18 +1359,23 @@ RUNTIME_FUNCTION(Runtime_RegExpExecMultiple) {
|
|||||||
CONVERT_ARG_HANDLE_CHECKED(String, subject, 1);
|
CONVERT_ARG_HANDLE_CHECKED(String, subject, 1);
|
||||||
CONVERT_ARG_HANDLE_CHECKED(RegExpMatchInfo, last_match_info, 2);
|
CONVERT_ARG_HANDLE_CHECKED(RegExpMatchInfo, last_match_info, 2);
|
||||||
CONVERT_ARG_HANDLE_CHECKED(JSArray, result_array, 3);
|
CONVERT_ARG_HANDLE_CHECKED(JSArray, result_array, 3);
|
||||||
|
|
||||||
|
DCHECK(RegExpUtils::IsUnmodifiedRegExp(isolate, regexp));
|
||||||
CHECK(result_array->HasObjectElements());
|
CHECK(result_array->HasObjectElements());
|
||||||
|
|
||||||
subject = String::Flatten(isolate, subject);
|
subject = String::Flatten(isolate, subject);
|
||||||
CHECK(regexp->GetFlags() & JSRegExp::kGlobal);
|
CHECK(regexp->GetFlags() & JSRegExp::kGlobal);
|
||||||
|
|
||||||
|
Object result;
|
||||||
if (regexp->CaptureCount() == 0) {
|
if (regexp->CaptureCount() == 0) {
|
||||||
return SearchRegExpMultiple<false>(isolate, subject, regexp,
|
result = SearchRegExpMultiple<false>(isolate, subject, regexp,
|
||||||
last_match_info, result_array);
|
last_match_info, result_array);
|
||||||
} else {
|
} else {
|
||||||
return SearchRegExpMultiple<true>(isolate, subject, regexp, last_match_info,
|
result = SearchRegExpMultiple<true>(isolate, subject, regexp,
|
||||||
result_array);
|
last_match_info, result_array);
|
||||||
}
|
}
|
||||||
|
DCHECK(RegExpUtils::IsUnmodifiedRegExp(isolate, regexp));
|
||||||
|
return result;
|
||||||
}
|
}
|
||||||
|
|
||||||
RUNTIME_FUNCTION(Runtime_StringReplaceNonGlobalRegExpWithFunction) {
|
RUNTIME_FUNCTION(Runtime_StringReplaceNonGlobalRegExpWithFunction) {
|
||||||
@ -1691,24 +1692,27 @@ RUNTIME_FUNCTION(Runtime_RegExpReplace) {
|
|||||||
|
|
||||||
const bool functional_replace = replace_obj->IsCallable();
|
const bool functional_replace = replace_obj->IsCallable();
|
||||||
|
|
||||||
// Fast-path for unmodified JSRegExps (and non-functional replace).
|
|
||||||
if (RegExpUtils::IsUnmodifiedRegExp(isolate, recv)) {
|
|
||||||
// We should never get here with functional replace because unmodified
|
|
||||||
// regexp and functional replace should be fully handled in CSA code.
|
|
||||||
CHECK(!functional_replace);
|
|
||||||
RETURN_RESULT_OR_FAILURE(
|
|
||||||
isolate, RegExpReplace(isolate, Handle<JSRegExp>::cast(recv), string,
|
|
||||||
replace_obj));
|
|
||||||
}
|
|
||||||
|
|
||||||
const uint32_t length = string->length();
|
|
||||||
|
|
||||||
Handle<String> replace;
|
Handle<String> replace;
|
||||||
if (!functional_replace) {
|
if (!functional_replace) {
|
||||||
ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, replace,
|
ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, replace,
|
||||||
Object::ToString(isolate, replace_obj));
|
Object::ToString(isolate, replace_obj));
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// Fast-path for unmodified JSRegExps (and non-functional replace).
|
||||||
|
if (RegExpUtils::IsUnmodifiedRegExp(isolate, recv)) {
|
||||||
|
// We should never get here with functional replace because unmodified
|
||||||
|
// regexp and functional replace should be fully handled in CSA code.
|
||||||
|
CHECK(!functional_replace);
|
||||||
|
Handle<Object> result;
|
||||||
|
ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
|
||||||
|
isolate, result,
|
||||||
|
RegExpReplace(isolate, Handle<JSRegExp>::cast(recv), string, replace));
|
||||||
|
DCHECK(RegExpUtils::IsUnmodifiedRegExp(isolate, recv));
|
||||||
|
return *result;
|
||||||
|
}
|
||||||
|
|
||||||
|
const uint32_t length = string->length();
|
||||||
|
|
||||||
Handle<Object> global_obj;
|
Handle<Object> global_obj;
|
||||||
ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
|
ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
|
||||||
isolate, global_obj,
|
isolate, global_obj,
|
||||||
|
19
deps/v8/test/mjsunit/compiler/regress-939316.js
vendored
Normal file
19
deps/v8/test/mjsunit/compiler/regress-939316.js
vendored
Normal file
@ -0,0 +1,19 @@
|
|||||||
|
// Copyright 2019 the V8 project authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a BSD-style license that can be
|
||||||
|
// found in the LICENSE file.
|
||||||
|
|
||||||
|
// Flags: --allow-natives-syntax
|
||||||
|
|
||||||
|
function f(arg) {
|
||||||
|
const o = Reflect.construct(Object, arguments, Proxy);
|
||||||
|
o.foo = arg;
|
||||||
|
}
|
||||||
|
|
||||||
|
function g(i) {
|
||||||
|
f(i);
|
||||||
|
}
|
||||||
|
|
||||||
|
g(0);
|
||||||
|
g(1);
|
||||||
|
%OptimizeFunctionOnNextCall(g);
|
||||||
|
g(2);
|
38
deps/v8/test/mjsunit/regress/regress-crbug-944435.js
vendored
Normal file
38
deps/v8/test/mjsunit/regress/regress-crbug-944435.js
vendored
Normal file
@ -0,0 +1,38 @@
|
|||||||
|
// Copyright 2019 the V8 project authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a BSD-style license that can be
|
||||||
|
// found in the LICENSE file.
|
||||||
|
|
||||||
|
// Flags: --verify-heap --expose-gc
|
||||||
|
|
||||||
|
function foo( ) {
|
||||||
|
return [
|
||||||
|
0,
|
||||||
|
1,
|
||||||
|
2,
|
||||||
|
3,
|
||||||
|
4,
|
||||||
|
5,
|
||||||
|
6,
|
||||||
|
7,
|
||||||
|
8,
|
||||||
|
9,
|
||||||
|
10,
|
||||||
|
0x1000000,
|
||||||
|
0x40000000,
|
||||||
|
12,
|
||||||
|
60,
|
||||||
|
100,
|
||||||
|
1000 * 60 * 60 * 24].map(Math.asin);
|
||||||
|
}
|
||||||
|
|
||||||
|
let b = [];
|
||||||
|
b.constructor = {};
|
||||||
|
b.constructor[Symbol.species] = function() {};
|
||||||
|
|
||||||
|
let a = [];
|
||||||
|
for (let i = 0; i < 10; i++) {
|
||||||
|
a.push(foo());
|
||||||
|
gc();
|
||||||
|
gc();
|
||||||
|
gc();
|
||||||
|
}
|
19
deps/v8/test/mjsunit/regress/regress-crbug-944971.js
vendored
Normal file
19
deps/v8/test/mjsunit/regress/regress-crbug-944971.js
vendored
Normal file
@ -0,0 +1,19 @@
|
|||||||
|
// Copyright 2019 the V8 project authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a BSD-style license that can be
|
||||||
|
// found in the LICENSE file.
|
||||||
|
|
||||||
|
let re = /x/y;
|
||||||
|
let cnt = 0;
|
||||||
|
let str = re[Symbol.replace]("x", {
|
||||||
|
toString: () => {
|
||||||
|
cnt++;
|
||||||
|
if (cnt == 2) {
|
||||||
|
re.lastIndex = {valueOf: () => {
|
||||||
|
re.x = 42;
|
||||||
|
return 0;
|
||||||
|
}};
|
||||||
|
}
|
||||||
|
return 'y$';
|
||||||
|
}
|
||||||
|
});
|
||||||
|
assertEquals("y$", str);
|
@ -275,8 +275,7 @@ namespace array {
|
|||||||
const object = UnsafeCast<JSObject>(sortState.receiver);
|
const object = UnsafeCast<JSObject>(sortState.receiver);
|
||||||
const elements = UnsafeCast<FixedDoubleArray>(object.elements);
|
const elements = UnsafeCast<FixedDoubleArray>(object.elements);
|
||||||
const heapVal = UnsafeCast<HeapNumber>(value);
|
const heapVal = UnsafeCast<HeapNumber>(value);
|
||||||
// Make sure we do not store signalling NaNs into double arrays.
|
const val = Convert<float64>(heapVal);
|
||||||
const val = Float64SilenceNaN(Convert<float64>(heapVal));
|
|
||||||
StoreFixedDoubleArrayElementSmi(elements, index, val);
|
StoreFixedDoubleArrayElementSmi(elements, index, val);
|
||||||
return kSuccess;
|
return kSuccess;
|
||||||
}
|
}
|
||||||
|
Loading…
x
Reference in New Issue
Block a user