Skip to content

Commit 0fa09b4

Browse files
committed
deps: update V8 to 5.4.500.41
PR-URL: #9412 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
1 parent fb05e31 commit 0fa09b4

32 files changed

+357
-111
lines changed

deps/v8/include/v8-version.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
#define V8_MAJOR_VERSION 5
1212
#define V8_MINOR_VERSION 4
1313
#define V8_BUILD_NUMBER 500
14-
#define V8_PATCH_LEVEL 36
14+
#define V8_PATCH_LEVEL 41
1515

1616
// Use 1 for candidates and 0 otherwise.
1717
// (Boolean macro values are not supported by all preprocessors.)

deps/v8/src/bailout-reason.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -257,6 +257,7 @@ namespace internal {
257257
V(kUnexpectedReturnFromThrow, "Unexpectedly returned from a throw") \
258258
V(kUnsupportedSwitchStatement, "Unsupported switch statement") \
259259
V(kUnsupportedTaggedImmediate, "Unsupported tagged immediate") \
260+
V(kUnstableConstantTypeHeapObject, "Unstable constant-type heap object") \
260261
V(kVariableResolvedToWithContext, "Variable resolved to with context") \
261262
V(kWeShouldNotHaveAnEmptyLexicalContext, \
262263
"We should not have an empty lexical context") \

deps/v8/src/code-stubs.h

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1160,6 +1160,8 @@ class FastNewClosureStub : public TurboFanCodeStub {
11601160

11611161
class FastNewFunctionContextStub final : public TurboFanCodeStub {
11621162
public:
1163+
static const int kMaximumSlots = 0x8000;
1164+
11631165
explicit FastNewFunctionContextStub(Isolate* isolate)
11641166
: TurboFanCodeStub(isolate) {}
11651167

@@ -1169,6 +1171,11 @@ class FastNewFunctionContextStub final : public TurboFanCodeStub {
11691171
compiler::Node* context);
11701172

11711173
private:
1174+
// FastNewFunctionContextStub can only allocate closures which fit in the
1175+
// new space.
1176+
STATIC_ASSERT(((kMaximumSlots + Context::MIN_CONTEXT_SLOTS) * kPointerSize +
1177+
FixedArray::kHeaderSize) < Page::kMaxRegularHeapObjectSize);
1178+
11721179
DEFINE_CALL_INTERFACE_DESCRIPTOR(FastNewFunctionContext);
11731180
DEFINE_TURBOFAN_CODE_STUB(FastNewFunctionContext, TurboFanCodeStub);
11741181
};

deps/v8/src/compiler/js-generic-lowering.cc

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -444,9 +444,13 @@ void JSGenericLowering::LowerJSCreateFunctionContext(Node* node) {
444444
int const slot_count = OpParameter<int>(node->op());
445445
CallDescriptor::Flags flags = FrameStateFlagForCall(node);
446446

447-
Callable callable = CodeFactory::FastNewFunctionContext(isolate());
448-
node->InsertInput(zone(), 1, jsgraph()->Int32Constant(slot_count));
449-
ReplaceWithStubCall(node, callable, flags);
447+
if (slot_count <= FastNewFunctionContextStub::kMaximumSlots) {
448+
Callable callable = CodeFactory::FastNewFunctionContext(isolate());
449+
node->InsertInput(zone(), 1, jsgraph()->Int32Constant(slot_count));
450+
ReplaceWithStubCall(node, callable, flags);
451+
} else {
452+
ReplaceWithRuntimeCall(node, Runtime::kNewFunctionContext);
453+
}
450454
}
451455

452456

deps/v8/src/compiler/js-global-object-specialization.cc

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -181,13 +181,18 @@ Reduction JSGlobalObjectSpecialization::ReduceJSStoreGlobal(Node* node) {
181181
dependencies()->AssumePropertyCell(property_cell);
182182
Type* property_cell_value_type;
183183
if (property_cell_value->IsHeapObject()) {
184+
// We cannot do anything if the {property_cell_value}s map is no
185+
// longer stable.
186+
Handle<Map> property_cell_value_map(
187+
Handle<HeapObject>::cast(property_cell_value)->map(), isolate());
188+
if (!property_cell_value_map->is_stable()) return NoChange();
189+
dependencies()->AssumeMapStable(property_cell_value_map);
190+
184191
// Check that the {value} is a HeapObject.
185192
value = effect = graph()->NewNode(simplified()->CheckTaggedPointer(),
186193
value, effect, control);
187194

188195
// Check {value} map agains the {property_cell} map.
189-
Handle<Map> property_cell_value_map(
190-
Handle<HeapObject>::cast(property_cell_value)->map(), isolate());
191196
effect = graph()->NewNode(
192197
simplified()->CheckMaps(1), value,
193198
jsgraph()->HeapConstant(property_cell_value_map), effect, control);

deps/v8/src/compiler/simplified-lowering.cc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2977,7 +2977,7 @@ Node* SimplifiedLowering::Float64Sign(Node* const node) {
29772977
graph()->NewNode(
29782978
common()->Select(MachineRepresentation::kFloat64),
29792979
graph()->NewNode(machine()->Float64LessThan(), zero, input), one,
2980-
zero));
2980+
input));
29812981
}
29822982

29832983
Node* SimplifiedLowering::Int32Abs(Node* const node) {

deps/v8/src/compiler/typer.cc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1321,7 +1321,7 @@ Type* Typer::Visitor::JSCallFunctionTyper(Type* fun, Typer* t) {
13211321
case kMathTan:
13221322
return Type::Number();
13231323
case kMathSign:
1324-
return t->cache_.kMinusOneToOne;
1324+
return t->cache_.kMinusOneToOneOrMinusZeroOrNaN;
13251325
// Binary math functions.
13261326
case kMathAtan2:
13271327
case kMathPow:

deps/v8/src/crankshaft/arm/lithium-codegen-arm.cc

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -164,11 +164,17 @@ void LCodeGen::DoPrologue(LPrologue* instr) {
164164
__ CallRuntime(Runtime::kNewScriptContext);
165165
deopt_mode = Safepoint::kLazyDeopt;
166166
} else {
167-
FastNewFunctionContextStub stub(isolate());
168-
__ mov(FastNewFunctionContextDescriptor::SlotsRegister(), Operand(slots));
169-
__ CallStub(&stub);
170-
// Result of FastNewFunctionContextStub is always in new space.
171-
need_write_barrier = false;
167+
if (slots <= FastNewFunctionContextStub::kMaximumSlots) {
168+
FastNewFunctionContextStub stub(isolate());
169+
__ mov(FastNewFunctionContextDescriptor::SlotsRegister(),
170+
Operand(slots));
171+
__ CallStub(&stub);
172+
// Result of FastNewFunctionContextStub is always in new space.
173+
need_write_barrier = false;
174+
} else {
175+
__ push(r1);
176+
__ CallRuntime(Runtime::kNewFunctionContext);
177+
}
172178
}
173179
RecordSafepoint(deopt_mode);
174180

deps/v8/src/crankshaft/arm64/lithium-codegen-arm64.cc

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -595,11 +595,16 @@ void LCodeGen::DoPrologue(LPrologue* instr) {
595595
__ CallRuntime(Runtime::kNewScriptContext);
596596
deopt_mode = Safepoint::kLazyDeopt;
597597
} else {
598-
FastNewFunctionContextStub stub(isolate());
599-
__ Mov(FastNewFunctionContextDescriptor::SlotsRegister(), slots);
600-
__ CallStub(&stub);
601-
// Result of FastNewFunctionContextStub is always in new space.
602-
need_write_barrier = false;
598+
if (slots <= FastNewFunctionContextStub::kMaximumSlots) {
599+
FastNewFunctionContextStub stub(isolate());
600+
__ Mov(FastNewFunctionContextDescriptor::SlotsRegister(), slots);
601+
__ CallStub(&stub);
602+
// Result of FastNewFunctionContextStub is always in new space.
603+
need_write_barrier = false;
604+
} else {
605+
__ Push(x1);
606+
__ CallRuntime(Runtime::kNewFunctionContext);
607+
}
603608
}
604609
RecordSafepoint(deopt_mode);
605610
// Context is returned in x0. It replaces the context passed to us. It's

deps/v8/src/crankshaft/hydrogen.cc

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6899,11 +6899,19 @@ void HOptimizedGraphBuilder::HandleGlobalVariableAssignment(
68996899
access = access.WithRepresentation(Representation::Smi());
69006900
break;
69016901
case PropertyCellConstantType::kStableMap: {
6902-
// The map may no longer be stable, deopt if it's ever different from
6903-
// what is currently there, which will allow for restablization.
6904-
Handle<Map> map(HeapObject::cast(cell->value())->map());
6902+
// First check that the previous value of the {cell} still has the
6903+
// map that we are about to check the new {value} for. If not, then
6904+
// the stable map assumption was invalidated and we cannot continue
6905+
// with the optimized code.
6906+
Handle<HeapObject> cell_value(HeapObject::cast(cell->value()));
6907+
Handle<Map> cell_value_map(cell_value->map());
6908+
if (!cell_value_map->is_stable()) {
6909+
return Bailout(kUnstableConstantTypeHeapObject);
6910+
}
6911+
top_info()->dependencies()->AssumeMapStable(cell_value_map);
6912+
// Now check that the new {value} is a HeapObject with the same map.
69056913
Add<HCheckHeapObject>(value);
6906-
value = Add<HCheckMaps>(value, map);
6914+
value = Add<HCheckMaps>(value, cell_value_map);
69076915
access = access.WithRepresentation(Representation::HeapObject());
69086916
break;
69096917
}

0 commit comments

Comments
 (0)