Skip to content

Commit

Permalink
deps: patch V8 to 9.0.257.21
Browse files Browse the repository at this point in the history
Refs: v8/v8@9.0.257.19...9.0.257.21

PR-URL: #38333
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Jiawen Geng <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: James M Snell <[email protected]>
  • Loading branch information
targos authored and jasnell committed Apr 26, 2021
1 parent 00b6fee commit 3b86138
Show file tree
Hide file tree
Showing 3 changed files with 33 additions and 13 deletions.
2 changes: 1 addition & 1 deletion deps/v8/include/v8-version.h
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
#define V8_MAJOR_VERSION 9
#define V8_MINOR_VERSION 0
#define V8_BUILD_NUMBER 257
#define V8_PATCH_LEVEL 19
#define V8_PATCH_LEVEL 21

// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
Expand Down
33 changes: 24 additions & 9 deletions deps/v8/src/compiler/js-call-reducer.cc
Original file line number Diff line number Diff line change
Expand Up @@ -5380,24 +5380,31 @@ Reduction JSCallReducer::ReduceArrayPrototypePop(Node* node) {
}

// Compute the new {length}.
length = graph()->NewNode(simplified()->NumberSubtract(), length,
jsgraph()->OneConstant());
Node* new_length = graph()->NewNode(simplified()->NumberSubtract(),
length, jsgraph()->OneConstant());

// This extra check exists solely to break an exploitation technique
// that abuses typer mismatches.
new_length = efalse = graph()->NewNode(
simplified()->CheckBounds(p.feedback(),
CheckBoundsFlag::kAbortOnOutOfBounds),
new_length, length, efalse, if_false);

// Store the new {length} to the {receiver}.
efalse = graph()->NewNode(
simplified()->StoreField(AccessBuilder::ForJSArrayLength(kind)),
receiver, length, efalse, if_false);
receiver, new_length, efalse, if_false);

// Load the last entry from the {elements}.
vfalse = efalse = graph()->NewNode(
simplified()->LoadElement(AccessBuilder::ForFixedArrayElement(kind)),
elements, length, efalse, if_false);
elements, new_length, efalse, if_false);

// Store a hole to the element we just removed from the {receiver}.
efalse = graph()->NewNode(
simplified()->StoreElement(
AccessBuilder::ForFixedArrayElement(GetHoleyElementsKind(kind))),
elements, length, jsgraph()->TheHoleConstant(), efalse, if_false);
elements, new_length, jsgraph()->TheHoleConstant(), efalse, if_false);
}

control = graph()->NewNode(common()->Merge(2), if_true, if_false);
Expand Down Expand Up @@ -5573,19 +5580,27 @@ Reduction JSCallReducer::ReduceArrayPrototypeShift(Node* node) {
}

// Compute the new {length}.
length = graph()->NewNode(simplified()->NumberSubtract(), length,
jsgraph()->OneConstant());
Node* new_length = graph()->NewNode(simplified()->NumberSubtract(),
length, jsgraph()->OneConstant());

// This extra check exists solely to break an exploitation technique
// that abuses typer mismatches.
new_length = etrue1 = graph()->NewNode(
simplified()->CheckBounds(p.feedback(),
CheckBoundsFlag::kAbortOnOutOfBounds),
new_length, length, etrue1, if_true1);

// Store the new {length} to the {receiver}.
etrue1 = graph()->NewNode(
simplified()->StoreField(AccessBuilder::ForJSArrayLength(kind)),
receiver, length, etrue1, if_true1);
receiver, new_length, etrue1, if_true1);

// Store a hole to the element we just removed from the {receiver}.
etrue1 = graph()->NewNode(
simplified()->StoreElement(AccessBuilder::ForFixedArrayElement(
GetHoleyElementsKind(kind))),
elements, length, jsgraph()->TheHoleConstant(), etrue1, if_true1);
elements, new_length, jsgraph()->TheHoleConstant(), etrue1,
if_true1);
}

Node* if_false1 = graph()->NewNode(common()->IfFalse(), branch1);
Expand Down
11 changes: 8 additions & 3 deletions deps/v8/src/compiler/simplified-lowering.cc
Original file line number Diff line number Diff line change
Expand Up @@ -1474,10 +1474,15 @@ class RepresentationSelector {
Type right_feedback_type = TypeOf(node->InputAt(1));

// Using Signed32 as restriction type amounts to promising there won't be
// signed overflow. This is incompatible with relying on a Word32
// truncation in order to skip the overflow check.
// signed overflow. This is incompatible with relying on a Word32 truncation
// in order to skip the overflow check. Similarly, we must not drop -0 from
// the result type unless we deopt for -0 inputs.
Type const restriction =
truncation.IsUsedAsWord32() ? Type::Any() : Type::Signed32();
truncation.IsUsedAsWord32()
? Type::Any()
: (truncation.identify_zeros() == kIdentifyZeros)
? Type::Signed32OrMinusZero()
: Type::Signed32();

// Handle the case when no int32 checks on inputs are necessary (but
// an overflow check is needed on the output). Note that we do not
Expand Down

0 comments on commit 3b86138

Please sign in to comment.