From 413bf9ad39230b1273dce50d4d8cf52b6afc05c2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C3=ABl=20Zasso?= Date: Wed, 16 Nov 2022 17:56:12 +0100 Subject: [PATCH] deps: patch V8 to 10.7.193.22 Refs: https://github.com/v8/v8/compare/10.7.193.20...10.7.193.22 PR-URL: https://github.com/nodejs/node/pull/45460 Reviewed-By: Antoine du Hamel Reviewed-By: Jiawen Geng Reviewed-By: Yagiz Nizipli --- deps/v8/include/v8-version.h | 2 +- .../src/compiler/effect-control-linearizer.cc | 51 +++++++++---------- deps/v8/src/compiler/js-call-reducer.cc | 49 +++++++++--------- 3 files changed, 49 insertions(+), 53 deletions(-) diff --git a/deps/v8/include/v8-version.h b/deps/v8/include/v8-version.h index d521b624637dab..4061987dc1161f 100644 --- a/deps/v8/include/v8-version.h +++ b/deps/v8/include/v8-version.h @@ -11,7 +11,7 @@ #define V8_MAJOR_VERSION 10 #define V8_MINOR_VERSION 7 #define V8_BUILD_NUMBER 193 -#define V8_PATCH_LEVEL 20 +#define V8_PATCH_LEVEL 22 // Use 1 for candidates and 0 otherwise. // (Boolean macro values are not supported by all preprocessors.) diff --git a/deps/v8/src/compiler/effect-control-linearizer.cc b/deps/v8/src/compiler/effect-control-linearizer.cc index d2495727506707..a4d4e2d18d6a3e 100644 --- a/deps/v8/src/compiler/effect-control-linearizer.cc +++ b/deps/v8/src/compiler/effect-control-linearizer.cc @@ -5294,6 +5294,8 @@ Node* EffectControlLinearizer::LowerLoadFieldByIndex(Node* node) { auto if_double = __ MakeDeferredLabel(); auto done = __ MakeLabel(MachineRepresentation::kTagged); + auto loaded_field = __ MakeLabel(MachineRepresentation::kTagged); + auto done_double = __ MakeLabel(MachineRepresentation::kFloat64); // Check if field is a mutable double field. __ GotoIfNot(__ IntPtrEqual(__ WordAnd(index, one), zero), &if_double); @@ -5310,8 +5312,8 @@ Node* EffectControlLinearizer::LowerLoadFieldByIndex(Node* node) { Node* offset = __ IntAdd(__ WordShl(index, __ IntPtrConstant(kTaggedSizeLog2 - 1)), __ IntPtrConstant(JSObject::kHeaderSize - kHeapObjectTag)); - Node* result = __ Load(MachineType::AnyTagged(), object, offset); - __ Goto(&done, result); + Node* field = __ Load(MachineType::AnyTagged(), object, offset); + __ Goto(&loaded_field, field); } // The field is located in the properties backing store of {object}. @@ -5325,8 +5327,8 @@ Node* EffectControlLinearizer::LowerLoadFieldByIndex(Node* node) { __ IntPtrConstant(kTaggedSizeLog2 - 1)), __ IntPtrConstant((FixedArray::kHeaderSize - kTaggedSize) - kHeapObjectTag)); - Node* result = __ Load(MachineType::AnyTagged(), properties, offset); - __ Goto(&done, result); + Node* field = __ Load(MachineType::AnyTagged(), properties, offset); + __ Goto(&loaded_field, field); } } @@ -5334,9 +5336,6 @@ Node* EffectControlLinearizer::LowerLoadFieldByIndex(Node* node) { // architectures, or a mutable HeapNumber. __ Bind(&if_double); { - auto loaded_field = __ MakeLabel(MachineRepresentation::kTagged); - auto done_double = __ MakeLabel(MachineRepresentation::kFloat64); - index = __ WordSar(index, one); // Check if field is in-object or out-of-object. @@ -5364,27 +5363,27 @@ Node* EffectControlLinearizer::LowerLoadFieldByIndex(Node* node) { Node* field = __ Load(MachineType::AnyTagged(), properties, offset); __ Goto(&loaded_field, field); } + } - __ Bind(&loaded_field); - { - Node* field = loaded_field.PhiAt(0); - // We may have transitioned in-place away from double, so check that - // this is a HeapNumber -- otherwise the load is fine and we don't need - // to copy anything anyway. - __ GotoIf(ObjectIsSmi(field), &done, field); - Node* field_map = __ LoadField(AccessBuilder::ForMap(), field); - __ GotoIfNot(__ TaggedEqual(field_map, __ HeapNumberMapConstant()), &done, - field); - - Node* value = __ LoadField(AccessBuilder::ForHeapNumberValue(), field); - __ Goto(&done_double, value); - } + __ Bind(&loaded_field); + { + Node* field = loaded_field.PhiAt(0); + // We may have transitioned in-place away from double, so check that + // this is a HeapNumber -- otherwise the load is fine and we don't need + // to copy anything anyway. + __ GotoIf(ObjectIsSmi(field), &done, field); + Node* field_map = __ LoadField(AccessBuilder::ForMap(), field); + __ GotoIfNot(__ TaggedEqual(field_map, __ HeapNumberMapConstant()), &done, + field); - __ Bind(&done_double); - { - Node* result = AllocateHeapNumberWithValue(done_double.PhiAt(0)); - __ Goto(&done, result); - } + Node* value = __ LoadField(AccessBuilder::ForHeapNumberValue(), field); + __ Goto(&done_double, value); + } + + __ Bind(&done_double); + { + Node* result = AllocateHeapNumberWithValue(done_double.PhiAt(0)); + __ Goto(&done, result); } __ Bind(&done); diff --git a/deps/v8/src/compiler/js-call-reducer.cc b/deps/v8/src/compiler/js-call-reducer.cc index 4825cbb72f2347..35220fa28496e0 100644 --- a/deps/v8/src/compiler/js-call-reducer.cc +++ b/deps/v8/src/compiler/js-call-reducer.cc @@ -710,9 +710,8 @@ class IteratingArrayBuiltinReducerAssembler : public JSCallReducerAssembler { MapInference* inference, const bool has_stability_dependency, ElementsKind kind, const SharedFunctionInfoRef& shared, const NativeContextRef& native_context, ArrayEverySomeVariant variant); - TNode ReduceArrayPrototypeAt(ZoneVector kinds, - bool needs_fallback_builtin_call, - Node* receiver_kind); + TNode ReduceArrayPrototypeAt(ZoneVector kinds, + bool needs_fallback_builtin_call); TNode ReduceArrayPrototypeIndexOfIncludes( ElementsKind kind, ArrayIndexOfIncludesVariant variant); @@ -1323,24 +1322,26 @@ TNode JSCallReducerAssembler::ReduceStringPrototypeSlice() { } TNode IteratingArrayBuiltinReducerAssembler::ReduceArrayPrototypeAt( - ZoneVector kinds, bool needs_fallback_builtin_call, - Node* receiver_kind) { + ZoneVector maps, bool needs_fallback_builtin_call) { TNode receiver = ReceiverInputAs(); TNode index = ArgumentOrZero(0); TNode index_num = CheckSmi(index); TNode elements = LoadElements(receiver); + TNode receiver_map = + TNode::UncheckedCast(LoadField(AccessBuilder::ForMap(), receiver)); + auto out = MakeLabel(MachineRepresentation::kTagged); - for (ElementsKind kind : kinds) { + for (const MapRef* map : maps) { + DCHECK(map->supports_fast_array_iteration()); auto correct_map_label = MakeLabel(), wrong_map_label = MakeLabel(); - Branch(NumberEqual(TNode::UncheckedCast(receiver_kind), - NumberConstant(kind)), - &correct_map_label, &wrong_map_label); + TNode is_map_equal = ReferenceEqual(receiver_map, Constant(*map)); + Branch(is_map_equal, &correct_map_label, &wrong_map_label); Bind(&correct_map_label); - TNode length = LoadJSArrayLength(receiver, kind); + TNode length = LoadJSArrayLength(receiver, map->elements_kind()); // If index is less than 0, then subtract from length. TNode cond = NumberLessThan(index_num, ZeroConstant()); @@ -1359,15 +1360,16 @@ TNode IteratingArrayBuiltinReducerAssembler::ReduceArrayPrototypeAt( // Retrieving element at index. TNode element = LoadElement( - AccessBuilder::ForFixedArrayElement(kind), elements, real_index_num); - if (IsHoleyElementsKind(kind)) { + AccessBuilder::ForFixedArrayElement(map->elements_kind()), elements, + real_index_num); + if (IsHoleyElementsKind(map->elements_kind())) { // This case is needed in particular for HOLEY_DOUBLE_ELEMENTS: raw // doubles are stored in the FixedDoubleArray, and need to be converted to // HeapNumber or to Smi so that this function can return an Object. The // automatic converstion performed by // RepresentationChanger::GetTaggedRepresentationFor does not handle // holes, so we convert manually a potential hole here. - element = TryConvertHoleToUndefined(element, kind); + element = TryConvertHoleToUndefined(element, map->elements_kind()); } Goto(&out, element); @@ -5633,25 +5635,22 @@ Reduction JSCallReducer::ReduceArrayPrototypeAt(Node* node) { MapInference inference(broker(), receiver, effect); if (!inference.HaveMaps()) return NoChange(); - // Collecting kinds - ZoneVector kinds(broker()->zone()); + // Collecting maps, and checking if a fallback builtin call will be required + // (it is required if at least one map doesn't support fast array iteration). + ZoneVector maps(broker()->zone()); bool needs_fallback_builtin_call = false; for (const MapRef& map : inference.GetMaps()) { if (map.supports_fast_array_iteration()) { - ElementsKind kind = map.elements_kind(); - // Checking that |kind| isn't already in |kinds|. Using std::find should - // be fast enough since |kinds| can contain at most 4 items. - if (std::find(kinds.begin(), kinds.end(), kind) == kinds.end()) { - kinds.push_back(kind); - } + maps.push_back(&map); } else { needs_fallback_builtin_call = true; } } + inference.RelyOnMapsPreferStability(dependencies(), jsgraph(), &effect, control, p.feedback()); - if (kinds.empty()) { + if (maps.empty()) { // No map in the feedback supports fast iteration. Keeping the builtin call. return NoChange(); } @@ -5660,13 +5659,11 @@ Reduction JSCallReducer::ReduceArrayPrototypeAt(Node* node) { return NoChange(); } - Node* receiver_kind = LoadReceiverElementsKind(receiver, &effect, control); - IteratingArrayBuiltinReducerAssembler a(this, node); a.InitializeEffectControl(effect, control); - TNode subgraph = a.ReduceArrayPrototypeAt( - kinds, needs_fallback_builtin_call, receiver_kind); + TNode subgraph = + a.ReduceArrayPrototypeAt(maps, needs_fallback_builtin_call); return ReplaceWithSubgraph(&a, subgraph); }