Skip to content

Commit 4f1a48b

Browse files
hashseedhashseed
committed
Update V8 to 006240292e
1 parent 6495f72 commit 4f1a48b

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

57 files changed

+701
-686
lines changed

‎deps/v8/src/builtins/builtins-api.cc

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -118,7 +118,8 @@ MUST_USE_RESULT MaybeHandle<Object> HandleApiCallHelper(
118118
}
119119
// Rebox the result.
120120
result->VerifyApiCallResultType();
121-
if (!is_construct || result->IsJSObject()) return handle(*result, isolate);
121+
if (!is_construct || result->IsJSReceiver())
122+
return handle(*result, isolate);
122123
}
123124

124125
return js_receiver;

‎deps/v8/src/builtins/builtins-forin-gen.cc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ std::tuple<Node*, Node*, Node*> ForInBuiltinsAssembler::EmitForInPrepare(
5252
GotoIf(WordEqual(enum_length, SmiConstant(0)), nothing_to_iterate);
5353
Node* descriptors = LoadMapDescriptors(map);
5454
Node* cache_offset =
55-
LoadObjectField(descriptors, DescriptorArray::kEnumCacheOffset);
55+
LoadObjectField(descriptors, DescriptorArray::kEnumCacheBridgeOffset);
5656
Node* enum_cache = LoadObjectField(
5757
cache_offset, DescriptorArray::kEnumCacheBridgeCacheOffset);
5858

‎deps/v8/src/builtins/builtins-handler-gen.cc

Lines changed: 2 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -129,21 +129,8 @@ TF_BUILTIN(LoadIC_FunctionPrototype, CodeStubAssembler) {
129129
Node* vector = Parameter(Descriptor::kVector);
130130
Node* context = Parameter(Descriptor::kContext);
131131

132-
Label miss(this);
133-
134-
Node* proto_or_map =
135-
LoadObjectField(receiver, JSFunction::kPrototypeOrInitialMapOffset);
136-
GotoIf(IsTheHole(proto_or_map), &miss);
137-
138-
VARIABLE(var_result, MachineRepresentation::kTagged, proto_or_map);
139-
Label done(this, &var_result);
140-
GotoIfNot(IsMap(proto_or_map), &done);
141-
142-
var_result.Bind(LoadMapPrototype(proto_or_map));
143-
Goto(&done);
144-
145-
BIND(&done);
146-
Return(var_result.value());
132+
Label miss(this, Label::kDeferred);
133+
Return(LoadJSFunctionPrototype(receiver, &miss));
147134

148135
BIND(&miss);
149136
TailCallRuntime(Runtime::kLoadIC_Miss, context, receiver, name, slot, vector);

‎deps/v8/src/code-stub-assembler.cc

Lines changed: 97 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1430,6 +1430,27 @@ Node* CodeStubAssembler::LoadJSArrayElementsMap(ElementsKind kind,
14301430
return LoadContextElement(native_context, Context::ArrayMapIndex(kind));
14311431
}
14321432

1433+
Node* CodeStubAssembler::LoadJSFunctionPrototype(Node* function,
1434+
Label* if_bailout) {
1435+
CSA_ASSERT(this, TaggedIsNotSmi(function));
1436+
CSA_ASSERT(this, IsJSFunction(function));
1437+
CSA_ASSERT(this, IsClearWord32(LoadMapBitField(LoadMap(function)),
1438+
1 << Map::kHasNonInstancePrototype));
1439+
Node* proto_or_map =
1440+
LoadObjectField(function, JSFunction::kPrototypeOrInitialMapOffset);
1441+
GotoIf(IsTheHole(proto_or_map), if_bailout);
1442+
1443+
VARIABLE(var_result, MachineRepresentation::kTagged, proto_or_map);
1444+
Label done(this, &var_result);
1445+
GotoIfNot(IsMap(proto_or_map), &done);
1446+
1447+
var_result.Bind(LoadMapPrototype(proto_or_map));
1448+
Goto(&done);
1449+
1450+
BIND(&done);
1451+
return var_result.value();
1452+
}
1453+
14331454
Node* CodeStubAssembler::StoreHeapNumberValue(Node* object, Node* value) {
14341455
return StoreObjectFieldNoWriteBarrier(object, HeapNumber::kValueOffset, value,
14351456
MachineRepresentation::kFloat64);
@@ -3159,12 +3180,28 @@ Node* CodeStubAssembler::IsMap(Node* map) {
31593180
return HasInstanceType(map, MAP_TYPE);
31603181
}
31613182

3162-
Node* CodeStubAssembler::IsJSValue(Node* map) {
3163-
return HasInstanceType(map, JS_VALUE_TYPE);
3183+
Node* CodeStubAssembler::IsJSValueInstanceType(Node* instance_type) {
3184+
return Word32Equal(instance_type, Int32Constant(JS_VALUE_TYPE));
3185+
}
3186+
3187+
Node* CodeStubAssembler::IsJSValue(Node* object) {
3188+
return IsJSValueMap(LoadMap(object));
3189+
}
3190+
3191+
Node* CodeStubAssembler::IsJSValueMap(Node* map) {
3192+
return IsJSValueInstanceType(LoadMapInstanceType(map));
3193+
}
3194+
3195+
Node* CodeStubAssembler::IsJSArrayInstanceType(Node* instance_type) {
3196+
return Word32Equal(instance_type, Int32Constant(JS_ARRAY_TYPE));
31643197
}
31653198

31663199
Node* CodeStubAssembler::IsJSArray(Node* object) {
3167-
return HasInstanceType(object, JS_ARRAY_TYPE);
3200+
return IsJSArrayMap(LoadMap(object));
3201+
}
3202+
3203+
Node* CodeStubAssembler::IsJSArrayMap(Node* map) {
3204+
return IsJSArrayInstanceType(LoadMapInstanceType(map));
31683205
}
31693206

31703207
Node* CodeStubAssembler::IsWeakCell(Node* object) {
@@ -3238,8 +3275,16 @@ Node* CodeStubAssembler::IsUnseededNumberDictionary(Node* object) {
32383275
LoadRoot(Heap::kUnseededNumberDictionaryMapRootIndex));
32393276
}
32403277

3278+
Node* CodeStubAssembler::IsJSFunctionInstanceType(Node* instance_type) {
3279+
return Word32Equal(instance_type, Int32Constant(JS_FUNCTION_TYPE));
3280+
}
3281+
32413282
Node* CodeStubAssembler::IsJSFunction(Node* object) {
3242-
return HasInstanceType(object, JS_FUNCTION_TYPE);
3283+
return IsJSFunctionMap(LoadMap(object));
3284+
}
3285+
3286+
Node* CodeStubAssembler::IsJSFunctionMap(Node* map) {
3287+
return IsJSFunctionInstanceType(LoadMapInstanceType(map));
32433288
}
32443289

32453290
Node* CodeStubAssembler::IsJSTypedArray(Node* object) {
@@ -5374,16 +5419,56 @@ Node* CodeStubAssembler::CallGetterIfAccessor(Node* value, Node* details,
53745419
// AccessorInfo case.
53755420
BIND(&if_accessor_info);
53765421
{
5377-
// TODO(ishell): Consider doing this for the Function.prototype and the
5378-
// String.length accessor infos as well.
5422+
Node* accessor_info = value;
53795423
CSA_ASSERT(this, IsAccessorInfo(value));
53805424
CSA_ASSERT(this, TaggedIsNotSmi(receiver));
5381-
GotoIfNot(IsJSArray(receiver), if_bailout);
5382-
// The only AccessorInfo on JSArray is the "length" property.
5383-
CSA_ASSERT(this, IsLengthString(
5384-
LoadObjectField(value, AccessorInfo::kNameOffset)));
5385-
var_value.Bind(LoadJSArrayLength(receiver));
5386-
Goto(&done);
5425+
Label if_array(this), if_function(this), if_value(this);
5426+
5427+
// Dispatch based on {receiver} instance type.
5428+
Node* receiver_map = LoadMap(receiver);
5429+
Node* receiver_instance_type = LoadMapInstanceType(receiver_map);
5430+
GotoIf(IsJSArrayInstanceType(receiver_instance_type), &if_array);
5431+
GotoIf(IsJSFunctionInstanceType(receiver_instance_type), &if_function);
5432+
Branch(IsJSValueInstanceType(receiver_instance_type), &if_value,
5433+
if_bailout);
5434+
5435+
// JSArray AccessorInfo case.
5436+
BIND(&if_array);
5437+
{
5438+
// The only AccessorInfo on JSArray is the "length" property.
5439+
CSA_ASSERT(this, IsLengthString(LoadObjectField(
5440+
accessor_info, AccessorInfo::kNameOffset)));
5441+
var_value.Bind(LoadJSArrayLength(receiver));
5442+
Goto(&done);
5443+
}
5444+
5445+
// JSFunction AccessorInfo case.
5446+
BIND(&if_function);
5447+
{
5448+
// We only deal with the "prototype" accessor on JSFunction here.
5449+
GotoIfNot(IsPrototypeString(
5450+
LoadObjectField(accessor_info, AccessorInfo::kNameOffset)),
5451+
if_bailout);
5452+
GotoIf(IsSetWord32(LoadMapBitField(receiver_map),
5453+
1 << Map::kHasNonInstancePrototype),
5454+
if_bailout);
5455+
var_value.Bind(LoadJSFunctionPrototype(receiver, if_bailout));
5456+
Goto(&done);
5457+
}
5458+
5459+
// JSValue AccessorInfo case.
5460+
BIND(&if_value);
5461+
{
5462+
// We only deal with the "length" accessor on JSValue string wrappers.
5463+
GotoIfNot(IsLengthString(
5464+
LoadObjectField(accessor_info, AccessorInfo::kNameOffset)),
5465+
if_bailout);
5466+
Node* receiver_value = LoadJSValueValue(receiver);
5467+
GotoIfNot(TaggedIsNotSmi(receiver_value), if_bailout);
5468+
GotoIfNot(IsString(receiver_value), if_bailout);
5469+
var_value.Bind(LoadStringLength(receiver_value));
5470+
Goto(&done);
5471+
}
53875472
}
53885473

53895474
BIND(&done);

‎deps/v8/src/code-stub-assembler.h

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ enum class PrimitiveType { kBoolean, kNumber, kString, kSymbol };
2929
V(CodeMap, CodeMap) \
3030
V(empty_string, EmptyString) \
3131
V(length_string, LengthString) \
32+
V(prototype_string, PrototypeString) \
3233
V(EmptyFixedArray, EmptyFixedArray) \
3334
V(FalseValue, False) \
3435
V(FixedArrayMap, FixedArrayMap) \
@@ -466,6 +467,9 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
466467

467468
Node* LoadJSArrayElementsMap(ElementsKind kind, Node* native_context);
468469

470+
// Load the "prototype" property of a JSFunction.
471+
Node* LoadJSFunctionPrototype(Node* function, Label* if_bailout);
472+
469473
// Store the floating point value of a HeapNumber.
470474
Node* StoreHeapNumberValue(Node* object, Node* value);
471475
// Store a field to an object on the heap.
@@ -751,16 +755,22 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
751755
Node* IsName(Node* object);
752756
Node* IsSymbol(Node* object);
753757
Node* IsPrivateSymbol(Node* object);
758+
Node* IsJSValueInstanceType(Node* instance_type);
754759
Node* IsJSValue(Node* object);
760+
Node* IsJSValueMap(Node* map);
761+
Node* IsJSArrayInstanceType(Node* instance_type);
755762
Node* IsJSArray(Node* object);
763+
Node* IsJSArrayMap(Node* object);
756764
Node* IsNativeContext(Node* object);
757765
Node* IsWeakCell(Node* object);
758766
Node* IsFixedDoubleArray(Node* object);
759767
Node* IsHashTable(Node* object);
760768
Node* IsDictionary(Node* object);
761769
Node* IsUnseededNumberDictionary(Node* object);
762770
Node* IsConstructorMap(Node* map);
771+
Node* IsJSFunctionInstanceType(Node* instance_type);
763772
Node* IsJSFunction(Node* object);
773+
Node* IsJSFunctionMap(Node* object);
764774
Node* IsJSTypedArray(Node* object);
765775
Node* IsJSArrayBuffer(Node* object);
766776
Node* IsFixedTypedArray(Node* object);

‎deps/v8/src/compiler/access-builder.cc

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -412,9 +412,9 @@ FieldAccess AccessBuilder::ForFixedTypedArrayBaseExternalPointer() {
412412
}
413413

414414
// static
415-
FieldAccess AccessBuilder::ForDescriptorArrayEnumCache() {
415+
FieldAccess AccessBuilder::ForDescriptorArrayEnumCacheBridge() {
416416
FieldAccess access = {
417-
kTaggedBase, DescriptorArray::kEnumCacheOffset,
417+
kTaggedBase, DescriptorArray::kEnumCacheBridgeOffset,
418418
Handle<Name>(), MaybeHandle<Map>(),
419419
Type::OtherInternal(), MachineType::TaggedPointer(),
420420
kPointerWriteBarrier};

‎deps/v8/src/compiler/access-builder.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -140,8 +140,8 @@ class V8_EXPORT_PRIVATE AccessBuilder final
140140
// Provides access to FixedTypedArrayBase::external_pointer() field.
141141
static FieldAccess ForFixedTypedArrayBaseExternalPointer();
142142

143-
// Provides access to DescriptorArray::enum_cache() field.
144-
static FieldAccess ForDescriptorArrayEnumCache();
143+
// Provides access to DescriptorArray::enum_cache_bridge() field.
144+
static FieldAccess ForDescriptorArrayEnumCacheBridge();
145145

146146
// Provides access to DescriptorArray::enum_cache_bridge_cache() field.
147147
static FieldAccess ForDescriptorArrayEnumCacheBridgeCache();

‎deps/v8/src/compiler/ast-graph-builder.cc

Lines changed: 3 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -3016,8 +3016,9 @@ void AstGraphBuilder::Environment::PrepareForOsrEntry() {
30163016
// Set the control and effect to the OSR loop entry.
30173017
Node* osr_loop_entry = graph->NewNode(builder_->common()->OsrLoopEntry(),
30183018
graph->start(), graph->start());
3019+
Node* effect = osr_loop_entry;
30193020
UpdateControlDependency(osr_loop_entry);
3020-
UpdateEffectDependency(osr_loop_entry);
3021+
UpdateEffectDependency(effect);
30213022

30223023
// Set OSR values.
30233024
for (int i = 0; i < size; ++i) {
@@ -3030,30 +3031,11 @@ void AstGraphBuilder::Environment::PrepareForOsrEntry() {
30303031
builder_->common()->OsrValue(Linkage::kOsrContextSpillSlotIndex);
30313032
contexts()->back() = graph->NewNode(op_inner, osr_loop_entry);
30323033

3033-
// Create a checkpoint.
3034-
Node* frame_state = Checkpoint(builder_->info()->osr_ast_id());
3035-
Node* checkpoint = graph->NewNode(common()->Checkpoint(), frame_state,
3036-
osr_loop_entry, osr_loop_entry);
3037-
UpdateEffectDependency(checkpoint);
3038-
3039-
// Create the OSR guard nodes.
3040-
const Operator* guard_op =
3041-
builder_->info()->is_deoptimization_enabled()
3042-
? builder_->common()->OsrGuard(OsrGuardType::kUninitialized)
3043-
: builder_->common()->OsrGuard(OsrGuardType::kAny);
3044-
Node* effect = checkpoint;
3045-
for (int i = 0; i < size; ++i) {
3046-
values()->at(i) = effect =
3047-
graph->NewNode(guard_op, values()->at(i), effect, osr_loop_entry);
3048-
}
3049-
contexts()->back() = effect =
3050-
graph->NewNode(guard_op, contexts()->back(), effect, osr_loop_entry);
3051-
30523034
// The innermost context is the OSR value, and the outer contexts are
30533035
// reconstructed by dynamically walking up the context chain.
30543036
const Operator* load_op =
30553037
builder_->javascript()->LoadContext(0, Context::PREVIOUS_INDEX, true);
3056-
Node* osr_context = effect = contexts()->back();
3038+
Node* osr_context = contexts()->back();
30573039
int last = static_cast<int>(contexts()->size() - 1);
30583040
for (int i = last - 1; i >= 0; i--) {
30593041
osr_context = effect = graph->NewNode(load_op, osr_context, effect);

‎deps/v8/src/compiler/bytecode-graph-builder.cc

Lines changed: 0 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -318,24 +318,6 @@ void BytecodeGraphBuilder::Environment::PrepareForOsrEntry() {
318318
if (i >= accumulator_base()) idx = Linkage::kOsrAccumulatorRegisterIndex;
319319
values()->at(i) = graph()->NewNode(common()->OsrValue(idx), entry);
320320
}
321-
322-
BailoutId loop_id(builder_->bytecode_iterator().current_offset());
323-
Node* frame_state =
324-
Checkpoint(loop_id, OutputFrameStateCombine::Ignore(), false, nullptr);
325-
Node* checkpoint =
326-
graph()->NewNode(common()->Checkpoint(), frame_state, entry, entry);
327-
UpdateEffectDependency(checkpoint);
328-
329-
// Create the OSR guard nodes.
330-
const Operator* guard_op = common()->OsrGuard(OsrGuardType::kUninitialized);
331-
Node* effect = checkpoint;
332-
for (int i = 0; i < size; i++) {
333-
values()->at(i) = effect =
334-
graph()->NewNode(guard_op, values()->at(i), effect, entry);
335-
}
336-
Node* context = effect = graph()->NewNode(guard_op, Context(), effect, entry);
337-
SetContext(context);
338-
UpdateEffectDependency(effect);
339321
}
340322

341323
bool BytecodeGraphBuilder::Environment::StateValuesRequireUpdate(

‎deps/v8/src/compiler/common-operator.cc

Lines changed: 0 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -307,26 +307,6 @@ int OsrValueIndexOf(Operator const* op) {
307307
return OpParameter<int>(op);
308308
}
309309

310-
size_t hash_value(OsrGuardType type) { return static_cast<size_t>(type); }
311-
312-
std::ostream& operator<<(std::ostream& os, OsrGuardType type) {
313-
switch (type) {
314-
case OsrGuardType::kUninitialized:
315-
return os << "Uninitialized";
316-
case OsrGuardType::kSignedSmall:
317-
return os << "SignedSmall";
318-
case OsrGuardType::kAny:
319-
return os << "Any";
320-
}
321-
UNREACHABLE();
322-
return os;
323-
}
324-
325-
OsrGuardType OsrGuardTypeOf(Operator const* op) {
326-
DCHECK_EQ(IrOpcode::kOsrGuard, op->opcode());
327-
return OpParameter<OsrGuardType>(op);
328-
}
329-
330310
SparseInputMask SparseInputMaskOf(Operator const* op) {
331311
DCHECK(op->opcode() == IrOpcode::kStateValues ||
332312
op->opcode() == IrOpcode::kTypedStateValues);
@@ -1010,14 +990,6 @@ const Operator* CommonOperatorBuilder::OsrValue(int index) {
1010990
index); // parameter
1011991
}
1012992

1013-
const Operator* CommonOperatorBuilder::OsrGuard(OsrGuardType type) {
1014-
return new (zone()) Operator1<OsrGuardType>( // --
1015-
IrOpcode::kOsrGuard, Operator::kNoThrow, // opcode
1016-
"OsrGuard", // name
1017-
1, 1, 1, 1, 1, 0, // counts
1018-
type); // parameter
1019-
}
1020-
1021993
const Operator* CommonOperatorBuilder::Int32Constant(int32_t value) {
1022994
return new (zone()) Operator1<int32_t>( // --
1023995
IrOpcode::kInt32Constant, Operator::kPure, // opcode

‎deps/v8/src/compiler/common-operator.h

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -287,11 +287,6 @@ Type* TypeGuardTypeOf(Operator const*) WARN_UNUSED_RESULT;
287287

288288
int OsrValueIndexOf(Operator const*);
289289

290-
enum class OsrGuardType { kUninitialized, kSignedSmall, kAny };
291-
size_t hash_value(OsrGuardType type);
292-
std::ostream& operator<<(std::ostream&, OsrGuardType);
293-
OsrGuardType OsrGuardTypeOf(Operator const*);
294-
295290
SparseInputMask SparseInputMaskOf(Operator const*);
296291

297292
ZoneVector<MachineType> const* MachineTypesOf(Operator const*)
@@ -337,7 +332,6 @@ class V8_EXPORT_PRIVATE CommonOperatorBuilder final
337332
const Operator* OsrNormalEntry();
338333
const Operator* OsrLoopEntry();
339334
const Operator* OsrValue(int index);
340-
const Operator* OsrGuard(OsrGuardType type);
341335

342336
const Operator* Int32Constant(int32_t);
343337
const Operator* Int64Constant(int64_t);

0 commit comments

Comments
 (0)