Skip to content

Commit 47626c5

Browse files
targostargos
committed
deps: patch V8 to 9.0.257.24
Refs: v8/v8@9.0.257.21...9.0.257.24 PR-URL: #38423 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
1 parent fcac2e0 commit 47626c5

File tree

5 files changed

+68
-40
lines changed

5 files changed

+68
-40
lines changed

‎deps/v8/include/v8-version.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
#define V8_MAJOR_VERSION 9
1212
#define V8_MINOR_VERSION 0
1313
#define V8_BUILD_NUMBER 257
14-
#define V8_PATCH_LEVEL 21
14+
#define V8_PATCH_LEVEL 24
1515

1616
// Use 1 for candidates and 0 otherwise.
1717
// (Boolean macro values are not supported by all preprocessors.)

‎deps/v8/src/compiler/representation-change.cc‎

Lines changed: 23 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -211,7 +211,10 @@ Node* RepresentationChanger::GetRepresentationFor(
211211
return GetFloat32RepresentationFor(node, output_rep, output_type,
212212
use_info.truncation());
213213
case MachineRepresentation::kFloat64:
214-
DCHECK_NE(TypeCheckKind::kBigInt, use_info.type_check());
214+
DCHECK(use_info.type_check() == TypeCheckKind::kNone ||
215+
use_info.type_check() == TypeCheckKind::kNumber ||
216+
use_info.type_check() == TypeCheckKind::kNumberOrBoolean ||
217+
use_info.type_check() == TypeCheckKind::kNumberOrOddball);
215218
return GetFloat64RepresentationFor(node, output_rep, output_type,
216219
use_node, use_info);
217220
case MachineRepresentation::kBit:
@@ -727,15 +730,22 @@ Node* RepresentationChanger::GetFloat64RepresentationFor(
727730
}
728731
} else if (IsAnyTagged(output_rep)) {
729732
if (output_type.Is(Type::Undefined())) {
730-
if (use_info.type_check() == TypeCheckKind::kNumberOrBoolean) {
733+
if (use_info.type_check() == TypeCheckKind::kNumberOrOddball ||
734+
(use_info.type_check() == TypeCheckKind::kNone &&
735+
use_info.truncation().TruncatesOddballAndBigIntToNumber())) {
736+
return jsgraph()->Float64Constant(
737+
std::numeric_limits<double>::quiet_NaN());
738+
} else {
739+
DCHECK(use_info.type_check() == TypeCheckKind::kNone ||
740+
use_info.type_check() == TypeCheckKind::kNumber ||
741+
use_info.type_check() == TypeCheckKind::kNumberOrBoolean);
731742
Node* unreachable = InsertUnconditionalDeopt(
732-
use_node, DeoptimizeReason::kNotANumberOrBoolean);
743+
use_node, use_info.type_check() == TypeCheckKind::kNumber
744+
? DeoptimizeReason::kNotANumber
745+
: DeoptimizeReason::kNotANumberOrBoolean);
733746
return jsgraph()->graph()->NewNode(
734747
jsgraph()->common()->DeadValue(MachineRepresentation::kFloat64),
735748
unreachable);
736-
} else {
737-
return jsgraph()->Float64Constant(
738-
std::numeric_limits<double>::quiet_NaN());
739749
}
740750
} else if (output_rep == MachineRepresentation::kTaggedSigned) {
741751
node = InsertChangeTaggedSignedToInt32(node);
@@ -747,12 +757,13 @@ Node* RepresentationChanger::GetFloat64RepresentationFor(
747757
output_type.Is(Type::NumberOrHole())) {
748758
// JavaScript 'null' is an Oddball that results in +0 when truncated to
749759
// Number. In a context like -0 == null, which must evaluate to false,
750-
// this truncation must not happen. For this reason we restrict this case
751-
// to when either the user explicitly requested a float (and thus wants
752-
// +0 if null is the input) or we know from the types that the input can
753-
// only be Number | Hole. The latter is necessary to handle the operator
754-
// CheckFloat64Hole. We did not put in the type (Number | Oddball \ Null)
755-
// to discover more bugs related to this conversion via crashes.
760+
// this truncation must not happen. For this reason we restrict this
761+
// case to when either the user explicitly requested a float (and thus
762+
// wants +0 if null is the input) or we know from the types that the
763+
// input can only be Number | Hole. The latter is necessary to handle
764+
// the operator CheckFloat64Hole. We did not put in the type (Number |
765+
// Oddball \ Null) to discover more bugs related to this conversion via
766+
// crashes.
756767
op = simplified()->TruncateTaggedToFloat64();
757768
} else if (use_info.type_check() == TypeCheckKind::kNumber ||
758769
(use_info.type_check() == TypeCheckKind::kNumberOrOddball &&

‎deps/v8/src/compiler/simplified-lowering.cc‎

Lines changed: 42 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1420,17 +1420,31 @@ class RepresentationSelector {
14201420
return jsgraph_->simplified();
14211421
}
14221422

1423-
void LowerToCheckedInt32Mul(Node* node, Truncation truncation,
1424-
Type input0_type, Type input1_type) {
1425-
// If one of the inputs is positive and/or truncation is being applied,
1426-
// there is no need to return -0.
1427-
CheckForMinusZeroMode mz_mode =
1428-
truncation.IdentifiesZeroAndMinusZero() ||
1429-
IsSomePositiveOrderedNumber(input0_type) ||
1430-
IsSomePositiveOrderedNumber(input1_type)
1431-
? CheckForMinusZeroMode::kDontCheckForMinusZero
1432-
: CheckForMinusZeroMode::kCheckForMinusZero;
1433-
ChangeOp(node, simplified()->CheckedInt32Mul(mz_mode));
1423+
template <Phase T>
1424+
void VisitForCheckedInt32Mul(Node* node, Truncation truncation,
1425+
Type input0_type, Type input1_type,
1426+
UseInfo input_use) {
1427+
DCHECK_EQ(node->opcode(), IrOpcode::kSpeculativeNumberMultiply);
1428+
// A -0 input is impossible or will cause a deopt.
1429+
DCHECK(BothInputsAre(node, Type::Signed32()) ||
1430+
!input_use.truncation().IdentifiesZeroAndMinusZero());
1431+
1432+
CheckForMinusZeroMode mz_mode;
1433+
Type restriction;
1434+
if (IsSomePositiveOrderedNumber(input0_type) ||
1435+
IsSomePositiveOrderedNumber(input1_type)) {
1436+
mz_mode = CheckForMinusZeroMode::kDontCheckForMinusZero;
1437+
restriction = Type::Signed32();
1438+
} else if (truncation.IdentifiesZeroAndMinusZero()) {
1439+
mz_mode = CheckForMinusZeroMode::kDontCheckForMinusZero;
1440+
restriction = Type::Signed32OrMinusZero();
1441+
} else {
1442+
mz_mode = CheckForMinusZeroMode::kCheckForMinusZero;
1443+
restriction = Type::Signed32();
1444+
}
1445+
1446+
VisitBinop<T>(node, input_use, MachineRepresentation::kWord32, restriction);
1447+
if (lower<T>()) ChangeOp(node, simplified()->CheckedInt32Mul(mz_mode));
14341448
}
14351449

14361450
void ChangeToInt32OverflowOp(Node* node) {
@@ -1618,12 +1632,22 @@ class RepresentationSelector {
16181632
VisitBinop<T>(node, lhs_use, rhs_use, MachineRepresentation::kWord32);
16191633
if (lower<T>()) DeferReplacement(node, lowering->Int32Mod(node));
16201634
} else if (BothInputsAre(node, Type::Unsigned32OrMinusZeroOrNaN())) {
1635+
Type const restriction =
1636+
truncation.IdentifiesZeroAndMinusZero() &&
1637+
TypeOf(node->InputAt(0)).Maybe(Type::MinusZero())
1638+
? Type::Unsigned32OrMinusZero()
1639+
: Type::Unsigned32();
16211640
VisitBinop<T>(node, lhs_use, rhs_use, MachineRepresentation::kWord32,
1622-
Type::Unsigned32());
1641+
restriction);
16231642
if (lower<T>()) ChangeToUint32OverflowOp(node);
16241643
} else {
1644+
Type const restriction =
1645+
truncation.IdentifiesZeroAndMinusZero() &&
1646+
TypeOf(node->InputAt(0)).Maybe(Type::MinusZero())
1647+
? Type::Signed32OrMinusZero()
1648+
: Type::Signed32();
16251649
VisitBinop<T>(node, lhs_use, rhs_use, MachineRepresentation::kWord32,
1626-
Type::Signed32());
1650+
restriction);
16271651
if (lower<T>()) ChangeToInt32OverflowOp(node);
16281652
}
16291653
return;
@@ -2254,22 +2278,16 @@ class RepresentationSelector {
22542278
if (BothInputsAre(node, Type::Signed32())) {
22552279
// If both inputs and feedback are int32, use the overflow op.
22562280
if (hint == NumberOperationHint::kSignedSmall) {
2257-
VisitBinop<T>(node, UseInfo::TruncatingWord32(),
2258-
MachineRepresentation::kWord32, Type::Signed32());
2259-
if (lower<T>()) {
2260-
LowerToCheckedInt32Mul(node, truncation, input0_type,
2261-
input1_type);
2262-
}
2281+
VisitForCheckedInt32Mul<T>(node, truncation, input0_type,
2282+
input1_type,
2283+
UseInfo::TruncatingWord32());
22632284
return;
22642285
}
22652286
}
22662287

22672288
if (hint == NumberOperationHint::kSignedSmall) {
2268-
VisitBinop<T>(node, CheckedUseInfoAsWord32FromHint(hint),
2269-
MachineRepresentation::kWord32, Type::Signed32());
2270-
if (lower<T>()) {
2271-
LowerToCheckedInt32Mul(node, truncation, input0_type, input1_type);
2272-
}
2289+
VisitForCheckedInt32Mul<T>(node, truncation, input0_type, input1_type,
2290+
CheckedUseInfoAsWord32FromHint(hint));
22732291
return;
22742292
}
22752293

@@ -4002,7 +4020,6 @@ template <>
40024020
void RepresentationSelector::SetOutput<RETYPE>(
40034021
Node* node, MachineRepresentation representation, Type restriction_type) {
40044022
NodeInfo* const info = GetInfo(node);
4005-
DCHECK(info->restriction_type().Is(restriction_type));
40064023
DCHECK(restriction_type.Is(info->restriction_type()));
40074024
info->set_output(representation);
40084025
}
@@ -4012,7 +4029,6 @@ void RepresentationSelector::SetOutput<LOWER>(
40124029
Node* node, MachineRepresentation representation, Type restriction_type) {
40134030
NodeInfo* const info = GetInfo(node);
40144031
DCHECK_EQ(info->representation(), representation);
4015-
DCHECK(info->restriction_type().Is(restriction_type));
40164032
DCHECK(restriction_type.Is(info->restriction_type()));
40174033
USE(info);
40184034
}

‎deps/v8/src/compiler/type-cache.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ class V8_EXPORT_PRIVATE TypeCache final {
8080
Type::Union(kPositiveIntegerOrMinusZero, Type::NaN(), zone());
8181

8282
Type const kAdditiveSafeInteger =
83-
CreateRange(-4503599627370496.0, 4503599627370496.0);
83+
CreateRange(-4503599627370495.0, 4503599627370495.0);
8484
Type const kSafeInteger = CreateRange(-kMaxSafeInteger, kMaxSafeInteger);
8585
Type const kAdditiveSafeIntegerOrMinusZero =
8686
Type::Union(kAdditiveSafeInteger, Type::MinusZero(), zone());

‎deps/v8/src/deoptimizer/deoptimize-reason.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ namespace internal {
4444
V(NotAJavaScriptObject, "not a JavaScript object") \
4545
V(NotAJavaScriptObjectOrNullOrUndefined, \
4646
"not a JavaScript object, Null or Undefined") \
47+
V(NotANumber, "not a Number") \
4748
V(NotANumberOrBoolean, "not a Number or Boolean") \
4849
V(NotANumberOrOddball, "not a Number or Oddball") \
4950
V(NotAnArrayIndex, "not an array index") \

0 commit comments

Comments
 (0)