Skip to content

Commit

Permalink
deps: patch V8 to 9.0.257.24
Browse files Browse the repository at this point in the history 
Refs: v8/v8@9.0.257.21...9.0.257.24

PR-URL: #38423
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
  • Loading branch information
@targos @jasnell
targos authored and jasnell committed Apr 28, 2021
1 parent 7919ced commit 8b60369
Show file tree
Hide file tree
Showing 5 changed files with 68 additions and 40 deletions.
2 changes: 1 addition & 1 deletion deps/v8/include/v8-version.h
View file
Expand Up @@ -11,7 +11,7 @@
#define V8_MAJOR_VERSION 9
#define V8_MINOR_VERSION 0
#define V8_BUILD_NUMBER 257
#define V8_PATCH_LEVEL 21
#define V8_PATCH_LEVEL 24

// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
Expand Down
35 changes: 23 additions & 12 deletions deps/v8/src/compiler/representation-change.cc
View file
Expand Up @@ -211,7 +211,10 @@ Node* RepresentationChanger::GetRepresentationFor(
return GetFloat32RepresentationFor(node, output_rep, output_type,
use_info.truncation());
case MachineRepresentation::kFloat64:
DCHECK_NE(TypeCheckKind::kBigInt, use_info.type_check());
DCHECK(use_info.type_check() == TypeCheckKind::kNone ||
use_info.type_check() == TypeCheckKind::kNumber ||
use_info.type_check() == TypeCheckKind::kNumberOrBoolean ||
use_info.type_check() == TypeCheckKind::kNumberOrOddball);
return GetFloat64RepresentationFor(node, output_rep, output_type,
use_node, use_info);
case MachineRepresentation::kBit:
Expand Down Expand Up @@ -727,15 +730,22 @@ Node* RepresentationChanger::GetFloat64RepresentationFor(
}
} else if (IsAnyTagged(output_rep)) {
if (output_type.Is(Type::Undefined())) {
if (use_info.type_check() == TypeCheckKind::kNumberOrBoolean) {
if (use_info.type_check() == TypeCheckKind::kNumberOrOddball ||
(use_info.type_check() == TypeCheckKind::kNone &&
use_info.truncation().TruncatesOddballAndBigIntToNumber())) {
return jsgraph()->Float64Constant(
std::numeric_limits<double>::quiet_NaN());
} else {
DCHECK(use_info.type_check() == TypeCheckKind::kNone ||
use_info.type_check() == TypeCheckKind::kNumber ||
use_info.type_check() == TypeCheckKind::kNumberOrBoolean);
Node* unreachable = InsertUnconditionalDeopt(
use_node, DeoptimizeReason::kNotANumberOrBoolean);
use_node, use_info.type_check() == TypeCheckKind::kNumber
? DeoptimizeReason::kNotANumber
: DeoptimizeReason::kNotANumberOrBoolean);
return jsgraph()->graph()->NewNode(
jsgraph()->common()->DeadValue(MachineRepresentation::kFloat64),
unreachable);
} else {
return jsgraph()->Float64Constant(
std::numeric_limits<double>::quiet_NaN());
}
} else if (output_rep == MachineRepresentation::kTaggedSigned) {
node = InsertChangeTaggedSignedToInt32(node);
Expand All @@ -747,12 +757,13 @@ Node* RepresentationChanger::GetFloat64RepresentationFor(
output_type.Is(Type::NumberOrHole())) {
// JavaScript 'null' is an Oddball that results in +0 when truncated to
// Number. In a context like -0 == null, which must evaluate to false,
// this truncation must not happen. For this reason we restrict this case
// to when either the user explicitly requested a float (and thus wants
// +0 if null is the input) or we know from the types that the input can
// only be Number | Hole. The latter is necessary to handle the operator
// CheckFloat64Hole. We did not put in the type (Number | Oddball \ Null)
// to discover more bugs related to this conversion via crashes.
// this truncation must not happen. For this reason we restrict this
// case to when either the user explicitly requested a float (and thus
// wants +0 if null is the input) or we know from the types that the
// input can only be Number | Hole. The latter is necessary to handle
// the operator CheckFloat64Hole. We did not put in the type (Number |
// Oddball \ Null) to discover more bugs related to this conversion via
// crashes.
op = simplified()->TruncateTaggedToFloat64();
} else if (use_info.type_check() == TypeCheckKind::kNumber ||
(use_info.type_check() == TypeCheckKind::kNumberOrOddball &&
Expand Down
68 changes: 42 additions & 26 deletions deps/v8/src/compiler/simplified-lowering.cc
View file
Expand Up @@ -1420,17 +1420,31 @@ class RepresentationSelector {
return jsgraph_->simplified();
}

void LowerToCheckedInt32Mul(Node* node, Truncation truncation,
Type input0_type, Type input1_type) {
// If one of the inputs is positive and/or truncation is being applied,
// there is no need to return -0.
CheckForMinusZeroMode mz_mode =
truncation.IdentifiesZeroAndMinusZero() ||
IsSomePositiveOrderedNumber(input0_type) ||
IsSomePositiveOrderedNumber(input1_type)
? CheckForMinusZeroMode::kDontCheckForMinusZero
: CheckForMinusZeroMode::kCheckForMinusZero;
ChangeOp(node, simplified()->CheckedInt32Mul(mz_mode));
template <Phase T>
void VisitForCheckedInt32Mul(Node* node, Truncation truncation,
Type input0_type, Type input1_type,
UseInfo input_use) {
DCHECK_EQ(node->opcode(), IrOpcode::kSpeculativeNumberMultiply);
// A -0 input is impossible or will cause a deopt.
DCHECK(BothInputsAre(node, Type::Signed32()) ||
!input_use.truncation().IdentifiesZeroAndMinusZero());

CheckForMinusZeroMode mz_mode;
Type restriction;
if (IsSomePositiveOrderedNumber(input0_type) ||
IsSomePositiveOrderedNumber(input1_type)) {
mz_mode = CheckForMinusZeroMode::kDontCheckForMinusZero;
restriction = Type::Signed32();
} else if (truncation.IdentifiesZeroAndMinusZero()) {
mz_mode = CheckForMinusZeroMode::kDontCheckForMinusZero;
restriction = Type::Signed32OrMinusZero();
} else {
mz_mode = CheckForMinusZeroMode::kCheckForMinusZero;
restriction = Type::Signed32();
}

VisitBinop<T>(node, input_use, MachineRepresentation::kWord32, restriction);
if (lower<T>()) ChangeOp(node, simplified()->CheckedInt32Mul(mz_mode));
}

void ChangeToInt32OverflowOp(Node* node) {
Expand Down Expand Up @@ -1618,12 +1632,22 @@ class RepresentationSelector {
VisitBinop<T>(node, lhs_use, rhs_use, MachineRepresentation::kWord32);
if (lower<T>()) DeferReplacement(node, lowering->Int32Mod(node));
} else if (BothInputsAre(node, Type::Unsigned32OrMinusZeroOrNaN())) {
Type const restriction =
truncation.IdentifiesZeroAndMinusZero() &&
TypeOf(node->InputAt(0)).Maybe(Type::MinusZero())
? Type::Unsigned32OrMinusZero()
: Type::Unsigned32();
VisitBinop<T>(node, lhs_use, rhs_use, MachineRepresentation::kWord32,
Type::Unsigned32());
restriction);
if (lower<T>()) ChangeToUint32OverflowOp(node);
} else {
Type const restriction =
truncation.IdentifiesZeroAndMinusZero() &&
TypeOf(node->InputAt(0)).Maybe(Type::MinusZero())
? Type::Signed32OrMinusZero()
: Type::Signed32();
VisitBinop<T>(node, lhs_use, rhs_use, MachineRepresentation::kWord32,
Type::Signed32());
restriction);
if (lower<T>()) ChangeToInt32OverflowOp(node);
}
return;
Expand Down Expand Up @@ -2254,22 +2278,16 @@ class RepresentationSelector {
if (BothInputsAre(node, Type::Signed32())) {
// If both inputs and feedback are int32, use the overflow op.
if (hint == NumberOperationHint::kSignedSmall) {
VisitBinop<T>(node, UseInfo::TruncatingWord32(),
MachineRepresentation::kWord32, Type::Signed32());
if (lower<T>()) {
LowerToCheckedInt32Mul(node, truncation, input0_type,
input1_type);
}
VisitForCheckedInt32Mul<T>(node, truncation, input0_type,
input1_type,
UseInfo::TruncatingWord32());
return;
}
}

if (hint == NumberOperationHint::kSignedSmall) {
VisitBinop<T>(node, CheckedUseInfoAsWord32FromHint(hint),
MachineRepresentation::kWord32, Type::Signed32());
if (lower<T>()) {
LowerToCheckedInt32Mul(node, truncation, input0_type, input1_type);
}
VisitForCheckedInt32Mul<T>(node, truncation, input0_type, input1_type,
CheckedUseInfoAsWord32FromHint(hint));
return;
}

Expand Down Expand Up @@ -4002,7 +4020,6 @@ template <>
void RepresentationSelector::SetOutput<RETYPE>(
Node* node, MachineRepresentation representation, Type restriction_type) {
NodeInfo* const info = GetInfo(node);
DCHECK(info->restriction_type().Is(restriction_type));
DCHECK(restriction_type.Is(info->restriction_type()));
info->set_output(representation);
}
Expand All @@ -4012,7 +4029,6 @@ void RepresentationSelector::SetOutput<LOWER>(
Node* node, MachineRepresentation representation, Type restriction_type) {
NodeInfo* const info = GetInfo(node);
DCHECK_EQ(info->representation(), representation);
DCHECK(info->restriction_type().Is(restriction_type));
DCHECK(restriction_type.Is(info->restriction_type()));
USE(info);
}
Expand Down
2 changes: 1 addition & 1 deletion deps/v8/src/compiler/type-cache.h
View file
Expand Up @@ -80,7 +80,7 @@ class V8_EXPORT_PRIVATE TypeCache final {
Type::Union(kPositiveIntegerOrMinusZero, Type::NaN(), zone());

Type const kAdditiveSafeInteger =
CreateRange(-4503599627370496.0, 4503599627370496.0);
CreateRange(-4503599627370495.0, 4503599627370495.0);
Type const kSafeInteger = CreateRange(-kMaxSafeInteger, kMaxSafeInteger);
Type const kAdditiveSafeIntegerOrMinusZero =
Type::Union(kAdditiveSafeInteger, Type::MinusZero(), zone());
Expand Down
1 change: 1 addition & 0 deletions deps/v8/src/deoptimizer/deoptimize-reason.h
View file
Expand Up @@ -44,6 +44,7 @@ namespace internal {
V(NotAJavaScriptObject, "not a JavaScript object") \
V(NotAJavaScriptObjectOrNullOrUndefined, \
"not a JavaScript object, Null or Undefined") \
V(NotANumber, "not a Number") \
V(NotANumberOrBoolean, "not a Number or Boolean") \
V(NotANumberOrOddball, "not a Number or Oddball") \
V(NotAnArrayIndex, "not an array index") \
Expand Down

0 comments on commit 8b60369

Please sign in to comment.