GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — deps: patch V8 to 11.8.172.15 · nodejs/node@571f7ef

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

deps/v8
- include
  - v8-version.h
- src
  - compiler
    - js-call-reducer.cc
  - ic
    - ic.cc
- test/mjsunit/compiler
  - regress-crbug-1486342.js

Expand file treeCollapse file tree

Open diff view settings

Collapse file

`‎deps/v8/include/v8-version.h‎`

Copy file name to clipboardExpand all lines: deps/v8/include/v8-version.h

+1-1Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -11,7 +11,7 @@`
`11`	`11`	`#define V8_MAJOR_VERSION 11`
`12`	`12`	`#define V8_MINOR_VERSION 8`
`13`	`13`	`#define V8_BUILD_NUMBER 172`
`14`		`-#define V8_PATCH_LEVEL 13`
	`14`	`+#define V8_PATCH_LEVEL 15`
`15`	`15`
`16`	`16`	`// Use 1 for candidates and 0 otherwise.`
`17`	`17`	`// (Boolean macro values are not supported by all preprocessors.)`

Collapse file

`‎deps/v8/src/compiler/js-call-reducer.cc‎`

Copy file name to clipboardExpand all lines: deps/v8/src/compiler/js-call-reducer.cc

+4-1Lines changed: 4 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -6381,8 +6381,11 @@ Reduction JSCallReducer::ReduceArrayIterator(Node* node,`
`6381`	`6381`	`}`
`6382`	`6382`	`}`
`6383`	`6383`
	`6384`	`+ // JSCreateArrayIterator doesn't have control output, so we bypass the old`
	`6385`	`+ // JSCall node on the control chain.`
	`6386`	`+ ReplaceWithValue(node, node, node, control);`
	`6387`	`+`
`6384`	`6388`	`// Morph the {node} into a JSCreateArrayIterator with the given {kind}.`
`6385`		`- RelaxControls(node);`
`6386`	`6389`	`node->ReplaceInput(0, receiver);`
`6387`	`6390`	`node->ReplaceInput(1, context);`
`6388`	`6391`	`node->ReplaceInput(2, effect);`

Collapse file

`‎deps/v8/src/ic/ic.cc‎`

Copy file name to clipboardExpand all lines: deps/v8/src/ic/ic.cc

+9-5Lines changed: 9 additions & 5 deletions

Original file line number	Diff line number	Diff line change
`@@ -3185,18 +3185,22 @@ bool CanFastCloneObjectWithDifferentMaps(Handle<Map> source_map,`
`3185`	`3185`	`Handle<Map> target_map,`
`3186`	`3186`	`Isolate* isolate) {`
`3187`	`3187`	`DisallowGarbageCollection no_gc;`
`3188`		`- // TODO(olivf): Add support for non JS_OBJECT_TYPE source maps. The reason for`
`3189`		`- // this restriction is that the IC does not initialize the target object and`
`3190`		`- // instead relies on copying the source objects bytes. Thus they need to have`
`3191`		`- // the same binary layout.`
	`3188`	`+ // Ensure source and target have identical binary represenation of properties`
	`3189`	`+ // and elements as the IC relies on copying the raw bytes. This also excludes`
	`3190`	`+ // cases with non-enumerable properties or accessors on the source object.`
`3192`	`3191`	`if (source_map->instance_type() != JS_OBJECT_TYPE \|\|`
`3193`	`3192`	`target_map->instance_type() != JS_OBJECT_TYPE \|\|`
`3194`	`3193`	`!source_map->OnlyHasSimpleProperties() \|\|`
`3195`		`- !target_map->OnlyHasSimpleProperties()) {`
	`3194`	`+ !target_map->OnlyHasSimpleProperties() \|\|`
	`3195`	`+ source_map->elements_kind() != target_map->elements_kind() \|\|`
	`3196`	`+ !source_map->has_fast_elements()) {`
`3196`	`3197`	`return false;`
`3197`	`3198`	`}`
`3198`	`3199`	`// Check that the source inobject properties are big enough to initialize all`
`3199`	`3200`	`// target slots, but not too big to fit.`
	`3201`	`+ // TODO(olivf): This restriction (and the same restriction on the backing`
	`3202`	`+ // store) could be lifted by properly initializing the target object instead`
	`3203`	`+ // of relying on copying empty slots.`
`3200`	`3204`	`int source_inobj_properties = source_map->GetInObjectProperties();`
`3201`	`3205`	`int target_inobj_properties = target_map->GetInObjectProperties();`
`3202`	`3206`	`int source_used_inobj_properties =`

Collapse file

`‎deps/v8/test/mjsunit/compiler/regress-crbug-1486342.js‎`

Copy file name to clipboard

+25Lines changed: 25 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,25 @@`
	`1`	`+// Copyright 2023 the V8 project authors. All rights reserved.`
	`2`	`+// Use of this source code is governed by a BSD-style license that can be`
	`3`	`+// found in the LICENSE file.`
	`4`	`+`
	`5`	`+// Flags: --allow-natives-syntax --jit-fuzzing`
	`6`	`+`
	`7`	`+const o13 = {`
	`8`	`+ "maxByteLength": 5368789,`
	`9`	`+};`
	`10`	`+const v14 = new ArrayBuffer(129, o13);`
	`11`	`+const v16 = new Uint16Array(v14);`
	`12`	`+`
	`13`	`+function f3(param) {`
	`14`	`+ for (let i = 0; i < 5; i++) {`
	`15`	`+ try {"resize".includes(v14); } catch (e) {}`
	`16`	`+ v14.resize(3.0, ..."resize", ...v16);`
	`17`	`+ }`
	`18`	`+`
	`19`	`+ let f = function() { return param; }`
	`20`	`+}`
	`21`	`+`
	`22`	`+%PrepareFunctionForOptimization(f3);`
	`23`	`+f3();`
	`24`	`+%OptimizeFunctionOnNextCall(f3);`
	`25`	`+f3();`

0 commit comments

Comments

0 (0)

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.