GeezerVison is showing github.com — deps: patch V8 to 14.6.202.34 · nodejs/node@3dee18f
File treeExpand file treeCollapse file tree Open diff view settings test/mjsunit/maglev/regress
Expand file treeCollapse file tree Open diff view settings Collapse file Copy file name to clipboardExpand all lines: deps/v8/include/v8-version.h +1-1Lines changed: 1 addition & 1 deletion | Original file line number | Diff line number | Diff line change |
|---|
| 11 | 11 | #define V8_MAJOR_VERSION 14 | 12 | 12 | #define V8_MINOR_VERSION 6 | 13 | 13 | #define V8_BUILD_NUMBER 202 | 14 | | -#define V8_PATCH_LEVEL 33 | | 14 | +#define V8_PATCH_LEVEL 34 | 15 | 15 |
| 16 | 16 | // Use 1 for candidates and 0 otherwise. | 17 | 17 | // (Boolean macro values are not supported by all preprocessors.) | |
Collapse file Copy file name to clipboardExpand all lines: deps/v8/src/maglev/maglev-graph-builder.cc +10-3Lines changed: 10 additions & 3 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -4125,9 +4125,16 @@ ReduceResult MaglevGraphBuilder::BuildCheckSmi(ValueNode* object, | 4125 | 4125 | value_as_phi->SetUseRequires31BitValue(); | 4126 | 4126 | } | 4127 | 4127 | } | 4128 | | - // For constants, we may be able to skip the runtime check. | 4129 | | - if (std::optional<int32_t> constant_value = TryGetInt32Constant(object)) { | 4130 | | - if (Smi::IsValid(constant_value.value())) return object; | | 4128 | + // For non-tagged constants, we may be able to skip the runtime check: every | | 4129 | + // non-tagged arm of the switch below emits a value-range check, which is | | 4130 | + // exactly what `Smi::IsValid` proves. For tagged inputs the runtime check | | 4131 | + // (CheckSmi) is a tag-bit check, and value-equivalence (e.g. via the | | 4132 | + // checked_value alternative, which may hold a HeapNumber constant) does not | | 4133 | + // imply Smi tagging. | | 4134 | + if (object->value_representation() != ValueRepresentation::kTagged) { | | 4135 | + if (std::optional<int32_t> constant_value = TryGetInt32Constant(object)) { | | 4136 | + if (Smi::IsValid(constant_value.value())) return object; | | 4137 | + } | 4131 | 4138 | } | 4132 | 4139 | switch (object->value_representation()) { | 4133 | 4140 | case ValueRepresentation::kInt32: | |
Collapse file Copy file name to clipboard +31Lines changed: 31 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
| | 1 | +// Copyright 2026 the V8 project authors. All rights reserved. | | 2 | +// Use of this source code is governed by a BSD-style license that can be | | 3 | +// found in the LICENSE file. | | 4 | +// | | 5 | +// Flags: --allow-natives-syntax --maglev --expose-gc | | 6 | + | | 7 | +let f = new Float64Array(1); f[0] = 5; | | 8 | +let HN5 = f[0]; | | 9 | +globalThis.G = HN5; | | 10 | + | | 11 | +let obj = { smiField: 1 }; | | 12 | +obj.smiField = 2; | | 13 | +obj.smiField = 3; | | 14 | + | | 15 | +function sh(o, x, c) { if (c) o.smiField = x; } | | 16 | +function corrupt(o, x, c) { G = x; sh(o, x, c); } | | 17 | + | | 18 | +%PrepareFunctionForOptimization(sh); | | 19 | +%PrepareFunctionForOptimization(corrupt); | | 20 | +sh(obj, 5, true); | | 21 | +corrupt(obj, HN5, false); | | 22 | +corrupt(obj, HN5, false); | | 23 | +%OptimizeMaglevOnNextCall(sh); | | 24 | +%OptimizeMaglevOnNextCall(corrupt); | | 25 | + | | 26 | +// Trigger: HeapNumber(5.0) ends up in a kSmi-typed field without a Smi check. | | 27 | +corrupt(obj, HN5, true); | | 28 | + | | 29 | +// Force a write-barrier verification path by allocating. | | 30 | +gc(); | | 31 | +assertEquals(5, obj.smiField); |
Collapse file Copy file name to clipboard +26Lines changed: 26 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
| | 1 | +// Copyright 2026 the V8 project authors. All rights reserved. | | 2 | +// Use of this source code is governed by a BSD-style license that can be | | 3 | +// found in the LICENSE file. | | 4 | +// | | 5 | +// Flags: --fuzzing --expose-gc --allow-natives-syntax --disable-abortjs | | 6 | +// Flags: --disable-in-process-stack-traces | | 7 | + | | 8 | +let f64 = new Float64Array(1); | | 9 | +f64[0] = 1.0; | | 10 | +let hn = f64[0]; | | 11 | + | | 12 | +let script_var_1 = hn; | | 13 | +let script_var_2 = 1; | | 14 | +script_var_2 = 2; | | 15 | + | | 16 | +function foo(x) { | | 17 | + script_var_1 = x; | | 18 | + script_var_2 = x; | | 19 | +} | | 20 | + | | 21 | +%PrepareFunctionForOptimization(foo); | | 22 | +%OptimizeMaglevOnNextCall(foo); | | 23 | + | | 24 | +foo(hn); | | 25 | + | | 26 | +assertEquals(1, script_var_2); |
|