GeezerVison is showing github.com — deps: V8: cherry-pick d69c7937c99d · nodejs/node@23069c3
File tree
Expand file treeCollapse file tree
Open diff view settings
Expand file treeCollapse file tree
Open diff view settings
Collapse file
Copy file name to clipboardExpand all lines: deps/v8/src/snapshot/deserializer.cc +6-1Lines changed: 6 additions & 1 deletion | Original file line number | Diff line number | Diff line change |
|---|
@@ -427,6 +427,8 @@ void Deserializer<IsolateT>::PostProcessNewJSReceiver( |
427 | 427 | reinterpret_cast<uint8_t*>(backing_store) + data_view.byte_offset()); |
428 | 428 | } else if (InstanceTypeChecker::IsJSTypedArray(instance_type)) { |
429 | 429 | auto typed_array = JSTypedArray::cast(raw_obj); |
| 430 | + // Note: ByteArray objects must not be deferred s.t. they are |
| 431 | + // available here for is_on_heap(). See also: CanBeDeferred. |
430 | 432 | // Fixup typed array pointers. |
431 | 433 | if (typed_array.is_on_heap()) { |
432 | 434 | typed_array.AddExternalPointerCompensationForDeserialization( |
@@ -517,7 +519,10 @@ void Deserializer<IsolateT>::PostProcessNewObject(Handle<Map> map, |
517 | 519 | // to |ObjectDeserializer::CommitPostProcessedObjects()|. |
518 | 520 | new_allocation_sites_. push_back(Handle<AllocationSite>:: cast(obj)); |
519 | 521 | } else { |
520 | | - DCHECK(CanBeDeferred(*obj)); |
| 522 | + // We dont defer ByteArray because JSTypedArray needs the base_pointer |
| 523 | + // ByteArray immediately if it's on heap. |
| 524 | + DCHECK(CanBeDeferred(*obj) || |
| 525 | + InstanceTypeChecker::IsByteArray(instance_type)); |
521 | 526 | } |
522 | 527 | } |
523 | 528 | } |
|
Collapse file
Copy file name to clipboardExpand all lines: deps/v8/src/snapshot/serializer-deserializer.cc +4-1Lines changed: 4 additions & 1 deletion | Original file line number | Diff line number | Diff line change |
|---|
@@ -51,10 +51,13 @@ bool SerializerDeserializer::CanBeDeferred(HeapObject o) { |
51 | 51 | // 3. JS objects with embedder fields cannot be deferred because the |
52 | 52 | // serialize/deserialize callbacks need the back reference immediately to |
53 | 53 | // identify the object. |
| 54 | + // 4. ByteArray cannot be deferred as JSTypedArray needs the base_pointer |
| 55 | + // ByteArray immediately if it's on heap. |
54 | 56 | // TODO(leszeks): Could we defer string serialization if forward references |
55 | 57 | // were resolved after object post processing? |
56 | 58 | return !o.IsMap() && !o.IsInternalizedString() && |
57 | | - !(o.IsJSObject() && JSObject::cast(o).GetEmbedderFieldCount() > 0); |
| 59 | + !(o.IsJSObject() && JSObject::cast(o).GetEmbedderFieldCount() > 0) && |
| 60 | + !o.IsByteArray(); |
58 | 61 | } |
59 | 62 |
|
60 | 63 | void SerializerDeserializer::RestoreExternalReferenceRedirector( |
|
Collapse file
Copy file name to clipboardExpand all lines: deps/v8/test/cctest/test-serialize.cc +40Lines changed: 40 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -4990,6 +4990,46 @@ UNINITIALIZED_TEST(SnapshotCreatorAnonClassWithKeep) { |
4990 | 4990 | delete[] blob.data; |
4991 | 4991 | } |
4992 | 4992 |
|
| 4993 | +UNINITIALIZED_TEST(SnapshotCreatorDontDeferByteArrayForTypedArray) { |
| 4994 | + DisableAlwaysOpt(); |
| 4995 | + v8::StartupData blob; |
| 4996 | + { |
| 4997 | + v8::SnapshotCreator creator; |
| 4998 | + v8::Isolate* isolate = creator.GetIsolate(); |
| 4999 | + { |
| 5000 | + v8::HandleScope handle_scope(isolate); |
| 5001 | + |
| 5002 | + v8::Local<v8::Context> context = v8::Context::New(isolate); |
| 5003 | + v8::Context::Scope context_scope(context); |
| 5004 | + CompileRun( |
| 5005 | + "const z = new Uint8Array(1);\n" |
| 5006 | + "class A { \n" |
| 5007 | + " static x() { \n" |
| 5008 | + " } \n" |
| 5009 | + "} \n" |
| 5010 | + "class B extends A {} \n" |
| 5011 | + "B.foo = ''; \n" |
| 5012 | + "class C extends B {} \n" |
| 5013 | + "class D extends C {} \n" |
| 5014 | + "class E extends B {} \n" |
| 5015 | + "function F() {} \n" |
| 5016 | + "Object.setPrototypeOf(F, D); \n"); |
| 5017 | + creator.SetDefaultContext(context); |
| 5018 | + } |
| 5019 | + |
| 5020 | + blob = |
| 5021 | + creator.CreateBlob(v8::SnapshotCreator::FunctionCodeHandling::kClear); |
| 5022 | + CHECK(blob.raw_size > 0 && blob.data != nullptr); |
| 5023 | + } |
| 5024 | + { |
| 5025 | + SnapshotCreator creator(nullptr, &blob); |
| 5026 | + v8::Isolate* isolate = creator.GetIsolate(); |
| 5027 | + v8::HandleScope scope(isolate); |
| 5028 | + USE(v8::Context::New(isolate)); |
| 5029 | + } |
| 5030 | + delete[] blob.data; |
| 5031 | +} |
| 5032 | + |
4993 | 5033 | class V8_NODISCARD DisableLazySourcePositionScope { |
4994 | 5034 | public: |
4995 | 5035 | DisableLazySourcePositionScope() |
|