From 1de5512383d65bf999e621457350cdcefb165414 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C3=ABl=20Zasso?= Date: Wed, 11 Sep 2024 07:19:43 +0200 Subject: [PATCH] deps: V8: cherry-pick 217457d0a560 Original commit message: [set-methods] Handle SetLike with infinite size This CL adds a check for identifying SetLikes with infinite sizes in methods dependent on the size of `other`s. Bug: 351332634 Change-Id: I5c6d9c0cc7f3f5fae5cedc72a44bc21c917c84b8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5684652 Reviewed-by: Shu-yu Guo Commit-Queue: Rezvan Mahdavi Hezaveh Cr-Commit-Position: refs/heads/main@{#94897} Refs: https://github.com/v8/v8/commit/217457d0a560990b5ed41da9a5bfc0d224a0f060 PR-URL: https://github.com/nodejs/node/pull/54883 Reviewed-By: Antoine du Hamel Reviewed-By: Richard Lau --- common.gypi | 2 +- deps/v8/src/builtins/set-difference.tq | 3 +- deps/v8/src/builtins/set-intersection.tq | 3 +- deps/v8/src/builtins/set-is-disjoint-from.tq | 3 +- deps/v8/src/builtins/set-is-subset-of.tq | 3 +- deps/v8/src/builtins/set-is-superset-of.tq | 3 +- .../v8/test/mjsunit/harmony/set-difference.js | 41 ++++++++++++++++++- .../test/mjsunit/harmony/set-intersection.js | 37 +++++++++++++++++ .../mjsunit/harmony/set-is-disjoint-from.js | 34 +++++++++++++++ .../test/mjsunit/harmony/set-is-subset-of.js | 34 +++++++++++++++ .../mjsunit/harmony/set-is-superset-of.js | 34 +++++++++++++++ 11 files changed, 190 insertions(+), 7 deletions(-) diff --git a/common.gypi b/common.gypi index a97e77860e151f..b8db901423620c 100644 --- a/common.gypi +++ b/common.gypi @@ -36,7 +36,7 @@ # Reset this number to 0 on major V8 upgrades. # Increment by one for each non-official patch applied to deps/v8. - 'v8_embedder_string': '-node.19', + 'v8_embedder_string': '-node.20', ##### V8 defaults for Node.js ##### diff --git a/deps/v8/src/builtins/set-difference.tq b/deps/v8/src/builtins/set-difference.tq index 32529a3fb23a0b..e0df3b8b69ed15 100644 --- a/deps/v8/src/builtins/set-difference.tq +++ b/deps/v8/src/builtins/set-difference.tq @@ -85,7 +85,8 @@ transitioning javascript builtin SetPrototypeDifference( } } label SlowPath { // 6. If thisSize ≤ otherRec.[[Size]], then - if (thisSize <= Convert(otherRec.size)) { + if (otherRec.size == V8_INFINITY || + thisSize <= Convert(otherRec.size)) { // a. Let index be 0. let thisIter = collections::NewOrderedHashSetIterator(table.GetTable()); diff --git a/deps/v8/src/builtins/set-intersection.tq b/deps/v8/src/builtins/set-intersection.tq index a72026a6502873..017d72d3e6280d 100644 --- a/deps/v8/src/builtins/set-intersection.tq +++ b/deps/v8/src/builtins/set-intersection.tq @@ -81,7 +81,8 @@ transitioning javascript builtin SetPrototypeIntersection( } } label SlowPath { // 6. If thisSize ≤ otherRec.[[Size]], then - if (thisSize <= Convert(otherRec.size)) { + if (otherRec.size == V8_INFINITY || + thisSize <= Convert(otherRec.size)) { // a. Let index be 0. let thisIter = collections::NewOrderedHashSetIterator(table.GetTable()); diff --git a/deps/v8/src/builtins/set-is-disjoint-from.tq b/deps/v8/src/builtins/set-is-disjoint-from.tq index a43a5c85887f2b..62936ea0b741dd 100644 --- a/deps/v8/src/builtins/set-is-disjoint-from.tq +++ b/deps/v8/src/builtins/set-is-disjoint-from.tq @@ -73,7 +73,8 @@ transitioning javascript builtin SetPrototypeIsDisjointFrom( } } label SlowPath { // 5. If thisSize ≤ otherRec.[[Size]], then - if (thisSize <= Convert(otherRec.size)) { + if (otherRec.size == V8_INFINITY || + thisSize <= Convert(otherRec.size)) { // a. Let index be 0. let thisIter = collections::NewOrderedHashSetIterator(table.GetTable()); diff --git a/deps/v8/src/builtins/set-is-subset-of.tq b/deps/v8/src/builtins/set-is-subset-of.tq index 890e4bf04d8941..b7096ca823f679 100644 --- a/deps/v8/src/builtins/set-is-subset-of.tq +++ b/deps/v8/src/builtins/set-is-subset-of.tq @@ -25,7 +25,8 @@ transitioning javascript builtin SetPrototypeIsSubsetOf( const thisSize = table.LoadSize(); // 5. If thisSize > otherRec.[[Size]], return false. - if (thisSize > Convert(otherRec.size)) { + if (!(otherRec.size == V8_INFINITY) && + thisSize > Convert(otherRec.size)) { return False; } diff --git a/deps/v8/src/builtins/set-is-superset-of.tq b/deps/v8/src/builtins/set-is-superset-of.tq index c7b9173b06c434..a95aea1496cb02 100644 --- a/deps/v8/src/builtins/set-is-superset-of.tq +++ b/deps/v8/src/builtins/set-is-superset-of.tq @@ -26,7 +26,8 @@ transitioning javascript builtin SetPrototypeIsSupersetOf( const thisSize = table.LoadSize(); // 5. If thisSize < otherRec.[[Size]], return false. - if (thisSize < Convert(otherRec.size)) { + if (otherRec.size == V8_INFINITY || + thisSize < Convert(otherRec.size)) { return False; } diff --git a/deps/v8/test/mjsunit/harmony/set-difference.js b/deps/v8/test/mjsunit/harmony/set-difference.js index 9afa182cf54216..59c1d541928e44 100644 --- a/deps/v8/test/mjsunit/harmony/set-difference.js +++ b/deps/v8/test/mjsunit/harmony/set-difference.js @@ -305,4 +305,43 @@ assertThrows(() => { new Set().difference(setLike); }, RangeError, "'-1' is an invalid size"); -})() +})(); + +(function TestDifferenceSetLikeWithInfiniteSize() { + let setLike = { + size: Infinity, + has(v) { + return true; + }, + keys() { + throw new Error('Unexpected call to |keys| method'); + }, + }; + + const firstSet = new Set(); + firstSet.add(42); + firstSet.add(43); + + const resultSet = new Set(); + + const resultArray = Array.from(resultSet); + const differenceArray = Array.from(firstSet.difference(setLike)); + + assertEquals(resultArray, differenceArray); +})(); + +(function TestDifferenceSetLikeWithNegativeInfiniteSize() { + let setLike = { + size: -Infinity, + has(v) { + return true; + }, + keys() { + throw new Error('Unexpected call to |keys| method'); + }, + }; + + assertThrows(() => { + new Set().difference(setLike); + }, RangeError, '\'-Infinity\' is an invalid size'); +})(); diff --git a/deps/v8/test/mjsunit/harmony/set-intersection.js b/deps/v8/test/mjsunit/harmony/set-intersection.js index 77d0a8cdd7255f..8ac5e137e1778c 100644 --- a/deps/v8/test/mjsunit/harmony/set-intersection.js +++ b/deps/v8/test/mjsunit/harmony/set-intersection.js @@ -281,3 +281,40 @@ assertEquals([43], Array.from(firstSet.intersection(evil))); })(); + +(function TestIntersectionSetLikeWithInfiniteSize() { + let setLike = { + size: Infinity, + has(v) { + return true; + }, + keys() { + throw new Error('Unexpected call to |keys| method'); + }, + }; + + const firstSet = new Set(); + firstSet.add(42); + firstSet.add(43); + + const resultArray = [42, 43]; + const intersectionArray = Array.from(firstSet.intersection(setLike)); + + assertEquals(resultArray, intersectionArray); +})(); + +(function TestIntersectionSetLikeWithNegativeInfiniteSize() { + let setLike = { + size: -Infinity, + has(v) { + return true; + }, + keys() { + throw new Error('Unexpected call to |keys| method'); + }, + }; + + assertThrows(() => { + new Set().intersection(setLike); + }, RangeError, '\'-Infinity\' is an invalid size'); +})(); diff --git a/deps/v8/test/mjsunit/harmony/set-is-disjoint-from.js b/deps/v8/test/mjsunit/harmony/set-is-disjoint-from.js index f89365a6a6dfeb..33b53a2620a416 100644 --- a/deps/v8/test/mjsunit/harmony/set-is-disjoint-from.js +++ b/deps/v8/test/mjsunit/harmony/set-is-disjoint-from.js @@ -216,3 +216,37 @@ assertFalse(firstSet.isDisjointFrom(evil)); })(); + +(function TestIsDisjointFromSetLikeWithInfiniteSize() { + let setLike = { + size: Infinity, + has(v) { + return true; + }, + keys() { + throw new Error('Unexpected call to |keys| method'); + }, + }; + + const firstSet = new Set(); + firstSet.add(42); + firstSet.add(43); + + assertEquals(firstSet.isDisjointFrom(setLike), false); +})(); + +(function TestIsDisjointFromSetLikeWithNegativeInfiniteSize() { + let setLike = { + size: -Infinity, + has(v) { + return true; + }, + keys() { + throw new Error('Unexpected call to |keys| method'); + }, + }; + + assertThrows(() => { + new Set().isDisjointFrom(setLike); + }, RangeError, '\'-Infinity\' is an invalid size'); +})(); diff --git a/deps/v8/test/mjsunit/harmony/set-is-subset-of.js b/deps/v8/test/mjsunit/harmony/set-is-subset-of.js index 5f1e41c7ef3fb6..01c48ccff6c8ed 100644 --- a/deps/v8/test/mjsunit/harmony/set-is-subset-of.js +++ b/deps/v8/test/mjsunit/harmony/set-is-subset-of.js @@ -266,3 +266,37 @@ assertEquals(firstSet.isSubsetOf(setLike), true); })(); + +(function TestIsSubsetOfSetLikeWithInfiniteSize() { + let setLike = { + size: Infinity, + has(v) { + return true; + }, + keys() { + throw new Error('Unexpected call to |keys| method'); + }, + }; + + const firstSet = new Set(); + firstSet.add(42); + firstSet.add(43); + + assertEquals(firstSet.isSubsetOf(setLike), true); +})(); + +(function TestIsSubsetOfSetLikeWithNegativeInfiniteSize() { + let setLike = { + size: -Infinity, + has(v) { + return true; + }, + keys() { + throw new Error('Unexpected call to |keys| method'); + }, + }; + + assertThrows(() => { + new Set().isSubsetOf(setLike); + }, RangeError, '\'-Infinity\' is an invalid size'); +})(); diff --git a/deps/v8/test/mjsunit/harmony/set-is-superset-of.js b/deps/v8/test/mjsunit/harmony/set-is-superset-of.js index 17f6418ffcaf6f..91ca8e535e9fd7 100644 --- a/deps/v8/test/mjsunit/harmony/set-is-superset-of.js +++ b/deps/v8/test/mjsunit/harmony/set-is-superset-of.js @@ -245,3 +245,37 @@ assertTrue(firstSet.isSupersetOf(evil)); })(); + +(function TestIsSupersetOfSetLikeWithInfiniteSize() { + let setLike = { + size: Infinity, + has(v) { + return true; + }, + keys() { + throw new Error('Unexpected call to |keys| method'); + }, + }; + + const firstSet = new Set(); + firstSet.add(42); + firstSet.add(43); + + assertEquals(firstSet.isSupersetOf(setLike), false); +})(); + +(function TestIsSupersetOfSetLikeWithNegativeInfiniteSize() { + let setLike = { + size: -Infinity, + has(v) { + return true; + }, + keys() { + throw new Error('Unexpected call to |keys| method'); + }, + }; + + assertThrows(() => { + new Set().isSupersetOf(setLike); + }, RangeError, '\'-Infinity\' is an invalid size'); +})();