Skip to content

Commit 54b5ec9

Browse files
deps: patch V8 to 12.9.202.26
Refs: v8/v8@12.9.202.19...12.9.202.26 PR-URL: #55161 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Jiawen Geng <technicalcute@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
1 parent 755b897 commit 54b5ec9

15 files changed

+176
-36
lines changed

deps/v8/include/v8-version.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
#define V8_MAJOR_VERSION 12
1212
#define V8_MINOR_VERSION 9
1313
#define V8_BUILD_NUMBER 202
14-
#define V8_PATCH_LEVEL 19
14+
#define V8_PATCH_LEVEL 26
1515

1616
// Use 1 for candidates and 0 otherwise.
1717
// (Boolean macro values are not supported by all preprocessors.)

deps/v8/src/flags/flag-definitions.h

+4-3
Original file line numberDiff line numberDiff line change
@@ -566,8 +566,8 @@ DEFINE_BOOL(maglev_inlining, true,
566566
"enable inlining in the maglev optimizing compiler")
567567
DEFINE_BOOL(maglev_loop_peeling, true,
568568
"enable loop peeling in the maglev optimizing compiler")
569-
DEFINE_BOOL(maglev_optimistic_peeled_loops, true,
570-
"enable aggressive optimizations for loops (loop SPeeling) in the "
569+
DEFINE_BOOL(maglev_optimistic_peeled_loops, false,
570+
"enable speculation on loop state using peeling as fallback in the "
571571
"maglev optimizing compiler")
572572
DEFINE_INT(maglev_loop_peeling_max_size, 200,
573573
"max loop size for loop peeling in the maglev optimizing compiler")
@@ -582,6 +582,7 @@ DEFINE_BOOL(maglev_destroy_on_background, true,
582582
DEFINE_BOOL(maglev_inline_api_calls, false,
583583
"Inline CallApiCallback builtin into generated code")
584584
DEFINE_EXPERIMENTAL_FEATURE(maglev_licm, "loop invariant code motion")
585+
DEFINE_WEAK_IMPLICATION(maglev_future, maglev_optimistic_peeled_loops)
585586
DEFINE_WEAK_IMPLICATION(maglev_future, maglev_speculative_hoist_phi_untagging)
586587
DEFINE_WEAK_IMPLICATION(maglev_future, maglev_inline_api_calls)
587588
DEFINE_WEAK_IMPLICATION(maglev_future, maglev_escape_analysis)
@@ -2499,7 +2500,7 @@ DEFINE_BOOL_READONLY(fast_map_update, false,
24992500
DEFINE_INT(max_valid_polymorphic_map_count, 4,
25002501
"maximum number of valid maps to track in POLYMORPHIC state")
25012502
DEFINE_BOOL(
2502-
clone_object_sidestep_transitions, true,
2503+
clone_object_sidestep_transitions, false,
25032504
"support sidestep transitions for dependency tracking object clone maps")
25042505
DEFINE_WEAK_IMPLICATION(future, clone_object_sidestep_transitions)
25052506

deps/v8/src/maglev/maglev-graph-builder.cc

+20-7
Original file line numberDiff line numberDiff line change
@@ -1370,7 +1370,14 @@ DeoptFrame MaglevGraphBuilder::GetDeoptFrameForLazyDeoptHelper(
13701370
current_source_position_, GetParentDeoptFrame());
13711371
ret.frame_state()->ForEachValue(
13721372
*compilation_unit_, [this](ValueNode* node, interpreter::Register reg) {
1373-
AddDeoptUse(node);
1373+
// Receiver and closure values have to be materialized, even if
1374+
// they don't otherwise escape.
1375+
if (reg == interpreter::Register::receiver() ||
1376+
reg == interpreter::Register::function_closure()) {
1377+
node->add_use();
1378+
} else {
1379+
AddDeoptUse(node);
1380+
}
13741381
});
13751382
AddDeoptUse(ret.closure());
13761383
return ret;
@@ -6965,15 +6972,21 @@ void MaglevGraphBuilder::VisitDeletePropertySloppy() {
69656972

69666973
void MaglevGraphBuilder::VisitGetSuperConstructor() {
69676974
ValueNode* active_function = GetAccumulator();
6968-
ValueNode* map_proto;
6975+
// TODO(victorgomes): Maybe BuildLoadTaggedField should support constants
6976+
// instead.
69696977
if (compiler::OptionalHeapObjectRef constant =
69706978
TryGetConstant(active_function)) {
6971-
map_proto = GetConstant(constant->map(broker()).prototype(broker()));
6972-
} else {
6973-
ValueNode* map =
6974-
BuildLoadTaggedField(active_function, HeapObject::kMapOffset);
6975-
map_proto = BuildLoadTaggedField(map, Map::kPrototypeOffset);
6979+
compiler::MapRef map = constant->map(broker());
6980+
if (map.is_stable()) {
6981+
broker()->dependencies()->DependOnStableMap(map);
6982+
ValueNode* map_proto = GetConstant(map.prototype(broker()));
6983+
StoreRegister(iterator_.GetRegisterOperand(0), map_proto);
6984+
return;
6985+
}
69766986
}
6987+
ValueNode* map =
6988+
BuildLoadTaggedField(active_function, HeapObject::kMapOffset);
6989+
ValueNode* map_proto = BuildLoadTaggedField(map, Map::kPrototypeOffset);
69776990
StoreRegister(iterator_.GetRegisterOperand(0), map_proto);
69786991
}
69796992

deps/v8/src/parsing/parser-base.h

+28-13
Original file line numberDiff line numberDiff line change
@@ -620,26 +620,32 @@ class ParserBase {
620620
return instance_members_scope != nullptr;
621621
}
622622

623-
DeclarationScope* EnsureStaticElementsScope(ParserBase* parser,
624-
int beg_pos) {
623+
DeclarationScope* EnsureStaticElementsScope(ParserBase* parser, int beg_pos,
624+
int info_id) {
625625
if (!has_static_elements()) {
626626
static_elements_scope = parser->NewFunctionScope(
627627
FunctionKind::kClassStaticInitializerFunction);
628628
static_elements_scope->SetLanguageMode(LanguageMode::kStrict);
629629
static_elements_scope->set_start_position(beg_pos);
630-
static_elements_function_id = parser->GetNextInfoId();
630+
static_elements_function_id = info_id;
631+
// Actually consume the id. The id that was passed in might be an
632+
// earlier id in case of computed property names.
633+
parser->GetNextInfoId();
631634
}
632635
return static_elements_scope;
633636
}
634637

635638
DeclarationScope* EnsureInstanceMembersScope(ParserBase* parser,
636-
int beg_pos) {
639+
int beg_pos, int info_id) {
637640
if (!has_instance_members()) {
638641
instance_members_scope = parser->NewFunctionScope(
639642
FunctionKind::kClassMembersInitializerFunction);
640643
instance_members_scope->SetLanguageMode(LanguageMode::kStrict);
641644
instance_members_scope->set_start_position(beg_pos);
642-
instance_members_function_id = parser->GetNextInfoId();
645+
instance_members_function_id = info_id;
646+
// Actually consume the id. The id that was passed in might be an
647+
// earlier id in case of computed property names.
648+
parser->GetNextInfoId();
643649
}
644650
return instance_members_scope;
645651
}
@@ -1321,7 +1327,7 @@ class ParserBase {
13211327
ParseFunctionFlags flags, bool is_static,
13221328
bool* has_seen_constructor);
13231329
ExpressionT ParseMemberInitializer(ClassInfo* class_info, int beg_pos,
1324-
bool is_static);
1330+
int info_id, bool is_static);
13251331
BlockT ParseClassStaticBlock(ClassInfo* class_info);
13261332
ObjectLiteralPropertyT ParseObjectPropertyDefinition(
13271333
ParsePropertyInfo* prop_info, bool* has_seen_proto);
@@ -2624,6 +2630,8 @@ ParserBase<Impl>::ParseClassPropertyDefinition(ClassInfo* class_info,
26242630
DCHECK_NOT_NULL(class_info);
26252631
DCHECK_EQ(prop_info->position, PropertyPosition::kClassLiteral);
26262632

2633+
int next_info_id = PeekNextInfoId();
2634+
26272635
Token::Value name_token = peek();
26282636
int property_beg_pos = peek_position();
26292637
int name_token_position = property_beg_pos;
@@ -2667,12 +2675,18 @@ ParserBase<Impl>::ParseClassPropertyDefinition(ClassInfo* class_info,
26672675
// field.
26682676
DCHECK_IMPLIES(prop_info->is_computed_name, !prop_info->is_private);
26692677

2670-
if (!prop_info->is_computed_name) {
2678+
if (prop_info->is_computed_name) {
2679+
if (!has_error() && next_info_id != PeekNextInfoId() &&
2680+
!(prop_info->is_static ? class_info->has_static_elements()
2681+
: class_info->has_instance_members())) {
2682+
impl()->ReindexComputedMemberName(name_expression);
2683+
}
2684+
} else {
26712685
CheckClassFieldName(prop_info->name, prop_info->is_static);
26722686
}
26732687

2674-
ExpressionT value = ParseMemberInitializer(class_info, property_beg_pos,
2675-
prop_info->is_static);
2688+
ExpressionT value = ParseMemberInitializer(
2689+
class_info, property_beg_pos, next_info_id, prop_info->is_static);
26762690
ExpectSemicolon();
26772691

26782692
ClassLiteralPropertyT result;
@@ -2786,11 +2800,12 @@ ParserBase<Impl>::ParseClassPropertyDefinition(ClassInfo* class_info,
27862800

27872801
template <typename Impl>
27882802
typename ParserBase<Impl>::ExpressionT ParserBase<Impl>::ParseMemberInitializer(
2789-
ClassInfo* class_info, int beg_pos, bool is_static) {
2803+
ClassInfo* class_info, int beg_pos, int info_id, bool is_static) {
27902804
FunctionParsingScope body_parsing_scope(impl());
27912805
DeclarationScope* initializer_scope =
2792-
is_static ? class_info->EnsureStaticElementsScope(this, beg_pos)
2793-
: class_info->EnsureInstanceMembersScope(this, beg_pos);
2806+
is_static
2807+
? class_info->EnsureStaticElementsScope(this, beg_pos, info_id)
2808+
: class_info->EnsureInstanceMembersScope(this, beg_pos, info_id);
27942809

27952810
if (Check(Token::kAssign)) {
27962811
FunctionState initializer_state(&function_state_, &scope_,
@@ -2811,7 +2826,7 @@ typename ParserBase<Impl>::BlockT ParserBase<Impl>::ParseClassStaticBlock(
28112826
Consume(Token::kStatic);
28122827

28132828
DeclarationScope* initializer_scope =
2814-
class_info->EnsureStaticElementsScope(this, position());
2829+
class_info->EnsureStaticElementsScope(this, position(), PeekNextInfoId());
28152830

28162831
FunctionState initializer_state(&function_state_, &scope_, initializer_scope);
28172832
FunctionParsingScope body_parsing_scope(impl());

deps/v8/src/parsing/parser.cc

+7
Original file line numberDiff line numberDiff line change
@@ -2735,6 +2735,13 @@ void Parser::ReindexArrowFunctionFormalParameters(
27352735
}
27362736
}
27372737

2738+
void Parser::ReindexComputedMemberName(Expression* computed_name) {
2739+
// Make space for the member initializer function above the computed property
2740+
// name.
2741+
AstFunctionLiteralIdReindexer reindexer(stack_limit_, 1);
2742+
reindexer.Reindex(computed_name);
2743+
}
2744+
27382745
void Parser::PrepareGeneratorVariables() {
27392746
// Calling a generator returns a generator object. That object is stored
27402747
// in a temporary variable, a definition that is used by "yield"

deps/v8/src/parsing/parser.h

+1
Original file line numberDiff line numberDiff line change
@@ -894,6 +894,7 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
894894
}
895895

896896
void ReindexArrowFunctionFormalParameters(ParserFormalParameters* parameters);
897+
void ReindexComputedMemberName(Expression* computed_name);
897898
void DeclareArrowFunctionFormalParameters(
898899
ParserFormalParameters* parameters, Expression* params,
899900
const Scanner::Location& params_loc);

deps/v8/src/parsing/preparser.h

+2
Original file line numberDiff line numberDiff line change
@@ -1556,6 +1556,8 @@ class PreParser : public ParserBase<PreParser> {
15561556

15571557
V8_INLINE void ReindexArrowFunctionFormalParameters(
15581558
PreParserFormalParameters* parameters) {}
1559+
V8_INLINE void ReindexComputedMemberName(
1560+
const PreParserExpression& expression) {}
15591561
V8_INLINE void DeclareFormalParameters(
15601562
const PreParserFormalParameters* parameters) {
15611563
if (!parameters->is_simple) parameters->scope->SetHasNonSimpleParameters();

deps/v8/src/wasm/graph-builder-interface.cc

+2-1
Original file line numberDiff line numberDiff line change
@@ -1206,14 +1206,15 @@ class WasmGraphBuildingInterface {
12061206

12071207
void BrOnNonNull(FullDecoder* decoder, const Value& ref_object, Value* result,
12081208
uint32_t depth, bool /* drop_null_on_fallthrough */) {
1209-
result->node = ref_object.node;
12101209
SsaEnv* false_env = ssa_env_;
12111210
SsaEnv* true_env = Split(decoder->zone(), false_env);
12121211
false_env->SetNotMerged();
12131212
std::tie(false_env->control, true_env->control) =
12141213
builder_->BrOnNull(ref_object.node, ref_object.type);
12151214
builder_->SetControl(false_env->control);
12161215
ScopedSsaEnv scoped_env(this, true_env);
1216+
// Make sure the TypeGuard has the right Control dependency.
1217+
SetAndTypeNode(result, builder_->TypeGuard(ref_object.node, result->type));
12171218
BrOrRet(decoder, depth);
12181219
}
12191220

deps/v8/src/wasm/streaming-decoder.cc

+16
Original file line numberDiff line numberDiff line change
@@ -294,6 +294,10 @@ void AsyncStreamingDecoder::Finish(bool can_use_compiled_module) {
294294
if (!full_wire_bytes_.back().empty()) {
295295
size_t total_length = 0;
296296
for (auto& bytes : full_wire_bytes_) total_length += bytes.size();
297+
if (ok()) {
298+
// {DecodeSectionLength} enforces this with graceful error reporting.
299+
CHECK_LE(total_length, max_module_size());
300+
}
297301
auto all_bytes = base::OwnedVector<uint8_t>::NewForOverwrite(total_length);
298302
uint8_t* ptr = all_bytes.begin();
299303
for (auto& bytes : full_wire_bytes_) {
@@ -627,6 +631,18 @@ std::unique_ptr<AsyncStreamingDecoder::DecodingState>
627631
AsyncStreamingDecoder::DecodeSectionLength::NextWithValue(
628632
AsyncStreamingDecoder* streaming) {
629633
TRACE_STREAMING("DecodeSectionLength(%zu)\n", value_);
634+
// Check if this section fits into the overall module length limit.
635+
// Note: {this->module_offset_} is the position of the section ID byte,
636+
// {streaming->module_offset_} is the start of the section's payload (i.e.
637+
// right after the just-decoded section length varint).
638+
// The latter can already exceed the max module size, when the previous
639+
// section barely fit into it, and this new section's ID or length crossed
640+
// the threshold.
641+
uint32_t payload_start = streaming->module_offset();
642+
size_t max_size = max_module_size();
643+
if (payload_start > max_size || max_size - payload_start < value_) {
644+
return streaming->ToErrorState();
645+
}
630646
SectionBuffer* buf =
631647
streaming->CreateNewBuffer(module_offset_, section_id_, value_,
632648
buffer().SubVector(0, bytes_consumed_));

deps/v8/src/wasm/wasm-engine.cc

+4-3
Original file line numberDiff line numberDiff line change
@@ -2016,10 +2016,11 @@ uint32_t max_table_init_entries() {
20162016

20172017
// {max_module_size} is declared in wasm-limits.h.
20182018
size_t max_module_size() {
2019-
// Clamp the value of --wasm-max-module-size between 16 and just below 2GB.
2019+
// Clamp the value of --wasm-max-module-size between 16 and the maximum
2020+
// that the implementation supports.
20202021
constexpr size_t kMin = 16;
2021-
constexpr size_t kMax = RoundDown<kSystemPointerSize>(size_t{kMaxInt});
2022-
static_assert(kMin <= kV8MaxWasmModuleSize && kV8MaxWasmModuleSize <= kMax);
2022+
constexpr size_t kMax = kV8MaxWasmModuleSize;
2023+
static_assert(kMin <= kV8MaxWasmModuleSize);
20232024
return std::clamp(v8_flags.wasm_max_module_size.value(), kMin, kMax);
20242025
}
20252026

deps/v8/src/wasm/wasm-js.cc

+14-8
Original file line numberDiff line numberDiff line change
@@ -202,8 +202,8 @@ GET_FIRST_ARGUMENT_AS(Tag)
202202
#undef GET_FIRST_ARGUMENT_AS
203203

204204
i::wasm::ModuleWireBytes GetFirstArgumentAsBytes(
205-
const v8::FunctionCallbackInfo<v8::Value>& info, ErrorThrower* thrower,
206-
bool* is_shared) {
205+
const v8::FunctionCallbackInfo<v8::Value>& info, size_t max_length,
206+
ErrorThrower* thrower, bool* is_shared) {
207207
DCHECK(i::ValidateCallbackInfo(info));
208208
const uint8_t* start = nullptr;
209209
size_t length = 0;
@@ -234,7 +234,6 @@ i::wasm::ModuleWireBytes GetFirstArgumentAsBytes(
234234
if (length == 0) {
235235
thrower->CompileError("BufferSource argument is empty");
236236
}
237-
size_t max_length = i::wasm::max_module_size();
238237
if (length > max_length) {
239238
// The spec requires a CompileError for implementation-defined limits, see
240239
// https://webassembly.github.io/spec/js-api/index.html#limits.
@@ -637,7 +636,8 @@ void WebAssemblyCompileImpl(const v8::FunctionCallbackInfo<v8::Value>& info) {
637636
new AsyncCompilationResolver(isolate, context, promise_resolver));
638637

639638
bool is_shared = false;
640-
auto bytes = GetFirstArgumentAsBytes(info, &thrower, &is_shared);
639+
auto bytes = GetFirstArgumentAsBytes(info, i::wasm::max_module_size(),
640+
&thrower, &is_shared);
641641
if (thrower.error()) {
642642
resolver->OnCompilationFailed(thrower.Reify());
643643
return;
@@ -669,8 +669,11 @@ void WasmStreamingCallbackForTesting(
669669
v8::WasmStreaming::Unpack(info.GetIsolate(), info.Data());
670670

671671
bool is_shared = false;
672+
// We don't check the buffer length up front, to allow d8 to test that the
673+
// streaming decoder implementation handles overly large inputs correctly.
674+
size_t unlimited = std::numeric_limits<size_t>::max();
672675
i::wasm::ModuleWireBytes bytes =
673-
GetFirstArgumentAsBytes(info, &thrower, &is_shared);
676+
GetFirstArgumentAsBytes(info, unlimited, &thrower, &is_shared);
674677
if (thrower.error()) {
675678
streaming->Abort(Utils::ToLocal(thrower.Reify()));
676679
return;
@@ -771,7 +774,8 @@ void WebAssemblyValidateImpl(const v8::FunctionCallbackInfo<v8::Value>& info) {
771774
ErrorThrower thrower(i_isolate, "WebAssembly.validate()");
772775

773776
bool is_shared = false;
774-
auto bytes = GetFirstArgumentAsBytes(info, &thrower, &is_shared);
777+
auto bytes = GetFirstArgumentAsBytes(info, i::wasm::max_module_size(),
778+
&thrower, &is_shared);
775779

776780
v8::ReturnValue<v8::Value> return_value = info.GetReturnValue();
777781

@@ -850,7 +854,8 @@ void WebAssemblyModuleImpl(const v8::FunctionCallbackInfo<v8::Value>& info) {
850854
}
851855

852856
bool is_shared = false;
853-
auto bytes = GetFirstArgumentAsBytes(info, &thrower, &is_shared);
857+
auto bytes = GetFirstArgumentAsBytes(info, i::wasm::max_module_size(),
858+
&thrower, &is_shared);
854859

855860
if (thrower.error()) {
856861
return;
@@ -1168,7 +1173,8 @@ void WebAssemblyInstantiateImpl(
11681173
}
11691174

11701175
bool is_shared = false;
1171-
auto bytes = GetFirstArgumentAsBytes(info, &thrower, &is_shared);
1176+
auto bytes = GetFirstArgumentAsBytes(info, i::wasm::max_module_size(),
1177+
&thrower, &is_shared);
11721178
if (thrower.error()) {
11731179
resolver->OnInstantiationFailed(thrower.Reify());
11741180
return;
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
// Copyright 2024 the V8 project authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style license that can be
3+
// found in the LICENSE file.
4+
//
5+
// Flags: --allow-natives-syntax --no-lazy-feedback-allocation
6+
7+
class C extends Array {
8+
constructor() {
9+
(() => (() => super())())();
10+
}
11+
}
12+
%PrepareFunctionForOptimization(C);
13+
new C();
14+
new C();
15+
%OptimizeFunctionOnNextCall(C);
16+
new C();
17+
C.__proto__ = [1];
18+
assertThrows(() => { new C() }, TypeError);
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
// Copyright 2024 the V8 project authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style license that can be
3+
// found in the LICENSE file.
4+
5+
try {
6+
new class {
7+
static [function(){}] = [].trigger_error();
8+
}
9+
} catch (e) {}
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
// Copyright 2024 the V8 project authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style license that can be
3+
// found in the LICENSE file.
4+
5+
assertThrows(`new class {
6+
static [{aaa(){}];
7+
};`);

0 commit comments

Comments
 (0)