Skip to content

Commit ba09b53

Browse files
schuayinoway46
authored and
aduh95
committed
deps: V8: backport c3553509f460
Original commit message: [compiler] Thread-safe IsArrayOrObjectPrototype Bug: 467311868 Change-Id: I574aa62d859030545e6a52d693a61e570381e557 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7460949 Reviewed-by: Leszek Swirski <[email protected]> Commit-Queue: Jakob Linke <[email protected]> Cr-Commit-Position: refs/heads/main@{#104707} Refs: v8/v8@c355350 Co-authored-by: inoway46 <[email protected]> PR-URL: #66089 Fixes: #66053 Reviewed-By: Antoine du Hamel <[email protected]>
1 parent 9ce8ef4 commit ba09b53

8 files changed

Lines changed: 46 additions & 37 deletions

File tree

‎common.gypi‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@
4242

4343
# Reset this number to 0 on major V8 upgrades.
4444
# Increment by one for each non-official patch applied to deps/v8.
45-
'v8_embedder_string': '-node.55',
45+
'v8_embedder_string': '-node.56',
4646

4747
##### V8 defaults for Node.js #####
4848

‎deps/v8/src/compiler/heap-refs.cc‎

Lines changed: 36 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -839,34 +839,33 @@ InstanceType HeapObjectData::GetMapInstanceType() const {
839839

840840
namespace {
841841

842-
bool IsReadOnlyLengthDescriptor(Isolate* isolate,
843-
DirectHandle<Map> jsarray_map) {
844-
DCHECK(!jsarray_map->is_dictionary_map());
845-
Tagged<DescriptorArray> descriptors =
846-
jsarray_map->instance_descriptors(isolate, kRelaxedLoad);
842+
bool IsReadOnlyLengthDescriptor(JSHeapBroker* broker, MapRef jsarray_map) {
843+
DCHECK(!jsarray_map.is_dictionary_map());
844+
DescriptorArrayRef descriptors = jsarray_map.instance_descriptors(broker);
847845
static_assert(
848846
JSArray::kLengthOffset == JSObject::kHeaderSize,
849847
"The length should be the first property on the descriptor array");
850848
InternalIndex offset(0);
851-
return descriptors->GetDetails(offset).IsReadOnly();
849+
return descriptors.GetPropertyDetails(offset).IsReadOnly();
852850
}
853851

854852
// Important: this predicate does not check Protectors::IsNoElementsIntact. The
855853
// compiler checks protectors through the compilation dependency mechanism; it
856854
// doesn't make sense to do that here as part of every MapData construction.
857855
// Callers *must* take care to take the correct dependency themselves.
858-
bool SupportsFastArrayIteration(JSHeapBroker* broker, DirectHandle<Map> map) {
859-
return map->instance_type() == JS_ARRAY_TYPE &&
860-
IsFastElementsKind(map->elements_kind()) &&
861-
IsJSArray(map->prototype()) &&
862-
broker->IsArrayOrObjectPrototype(broker->CanonicalPersistentHandle(
863-
Cast<JSArray>(map->prototype())));
856+
bool SupportsFastArrayIteration(JSHeapBroker* broker, MapRef map) {
857+
if (map.instance_type() != JS_ARRAY_TYPE ||
858+
!IsFastElementsKind(map.elements_kind())) {
859+
return false;
860+
}
861+
HeapObjectRef prototype = map.prototype(broker);
862+
return prototype.IsJSArray() &&
863+
prototype.AsJSArray().IsArrayOrObjectPrototype(broker);
864864
}
865865

866-
bool SupportsFastArrayResize(JSHeapBroker* broker, DirectHandle<Map> map) {
867-
return SupportsFastArrayIteration(broker, map) && map->is_extensible() &&
868-
!map->is_dictionary_map() &&
869-
!IsReadOnlyLengthDescriptor(broker->isolate(), map);
866+
bool SupportsFastArrayResize(JSHeapBroker* broker, MapRef map) {
867+
return SupportsFastArrayIteration(broker, map) && map.is_extensible() &&
868+
!map.is_dictionary_map() && !IsReadOnlyLengthDescriptor(broker, map);
870869
}
871870

872871
} // namespace
@@ -1248,11 +1247,11 @@ bool MapRef::PrototypesElementsDoNotHaveAccessorsOrThrow(
12481247
}
12491248

12501249
bool MapRef::supports_fast_array_iteration(JSHeapBroker* broker) const {
1251-
return SupportsFastArrayIteration(broker, object());
1250+
return SupportsFastArrayIteration(broker, *this);
12521251
}
12531252

12541253
bool MapRef::supports_fast_array_resize(JSHeapBroker* broker) const {
1255-
return SupportsFastArrayResize(broker, object());
1254+
return SupportsFastArrayResize(broker, *this);
12561255
}
12571256

12581257
namespace {
@@ -1624,6 +1623,7 @@ HEAP_ACCESSOR_B(Map, bit_field3, NumberOfOwnDescriptors,
16241623
Map::Bits3::NumberOfOwnDescriptorsBits)
16251624
HEAP_ACCESSOR_B(Map, bit_field3, is_migration_target,
16261625
Map::Bits3::IsMigrationTargetBit)
1626+
BIMODAL_ACCESSOR_B(Map, bit_field3, is_extensible, Map::Bits3::IsExtensibleBit)
16271627
BIMODAL_ACCESSOR_B(Map, bit_field3, construction_counter,
16281628
Map::Bits3::ConstructionCounterBits)
16291629
HEAP_ACCESSOR_B(Map, bit_field, has_prototype_slot,
@@ -1805,6 +1805,11 @@ ObjectRef MapRef::GetConstructor(JSHeapBroker* broker) const {
18051805
return MakeRefAssumeMemoryFence(broker, object()->GetConstructor());
18061806
}
18071807

1808+
NativeContextRef MapRef::native_context(JSHeapBroker* broker) const {
1809+
// Immutable after initialization.
1810+
return MakeRefAssumeMemoryFence(broker, object()->native_context());
1811+
}
1812+
18081813
HeapObjectRef MapRef::GetBackPointer(JSHeapBroker* broker) const {
18091814
// Immutable after initialization.
18101815
return MakeRefAssumeMemoryFence(broker,
@@ -2459,6 +2464,19 @@ OptionalMapRef JSObjectRef::GetObjectCreateMap(JSHeapBroker* broker) const {
24592464
maybe_object_create_map.GetHeapObjectAssumeWeak(), kAssumeMemoryFence));
24602465
}
24612466

2467+
bool JSObjectRef::IsArrayOrObjectPrototype(JSHeapBroker* broker) const {
2468+
MapRef map = this->map(broker);
2469+
if (map.instance_type() == JS_OBJECT_PROTOTYPE_TYPE) return true;
2470+
// Keep in sync with Isolate::IsInCreationContext:
2471+
MapRef metamap = map.map(broker);
2472+
// Filter out native-context independent objects.
2473+
if (*metamap.object() == ReadOnlyRoots(broker->isolate()).meta_map())
2474+
return false;
2475+
OptionalNativeContextRef native_context = metamap.native_context(broker);
2476+
if (!native_context.has_value()) return false;
2477+
return native_context->initial_array_prototype(broker).equals(*this);
2478+
}
2479+
24622480
bool PropertyCellRef::Cache(JSHeapBroker* broker) const {
24632481
if (data_->should_access_heap()) return true;
24642482
CHECK(broker->mode() == JSHeapBroker::kSerializing ||

‎deps/v8/src/compiler/heap-refs.h‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -623,6 +623,10 @@ class JSObjectRef : public JSReceiverRef {
623623
bool IsElementsTenured(FixedArrayBaseRef elements);
624624

625625
OptionalMapRef GetObjectCreateMap(JSHeapBroker* broker) const;
626+
627+
// Check if this object is its creation context's %ArrayPrototype% or
628+
// %ObjectPrototype%.
629+
bool IsArrayOrObjectPrototype(JSHeapBroker* broker) const;
626630
};
627631

628632
class JSDataViewRef : public JSObjectRef {
@@ -899,6 +903,7 @@ class V8_EXPORT_PRIVATE MapRef : public HeapObjectRef {
899903
bool has_indexed_interceptor() const;
900904
int construction_counter() const;
901905
bool is_migration_target() const;
906+
bool is_extensible() const;
902907
bool supports_fast_array_iteration(JSHeapBroker* broker) const;
903908
bool supports_fast_array_resize(JSHeapBroker* broker) const;
904909
bool is_abandoned_prototype_map() const;
@@ -940,6 +945,7 @@ class V8_EXPORT_PRIVATE MapRef : public HeapObjectRef {
940945

941946
MapRef FindRootMap(JSHeapBroker* broker) const;
942947
ObjectRef GetConstructor(JSHeapBroker* broker) const;
948+
NativeContextRef native_context(JSHeapBroker* broker) const;
943949
};
944950

945951
struct HolderLookupResult {

‎deps/v8/src/compiler/js-heap-broker.cc‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -131,16 +131,6 @@ StringRef JSHeapBroker::GetTypedArrayStringTag(ElementsKind kind) {
131131
}
132132
}
133133

134-
bool JSHeapBroker::IsArrayOrObjectPrototype(JSObjectRef object) const {
135-
return IsArrayOrObjectPrototype(object.object());
136-
}
137-
138-
bool JSHeapBroker::IsArrayOrObjectPrototype(Handle<JSObject> object) const {
139-
return isolate()->IsInCreationContext(
140-
*object, Context::INITIAL_ARRAY_PROTOTYPE_INDEX) ||
141-
object->map(isolate_)->instance_type() == JS_OBJECT_PROTOTYPE_TYPE;
142-
}
143-
144134
ObjectData* JSHeapBroker::TryGetOrCreateData(Tagged<Object> object,
145135
GetOrCreateDataFlags flags) {
146136
return TryGetOrCreateData(CanonicalPersistentHandle(object), flags);

‎deps/v8/src/compiler/js-heap-broker.h‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -192,11 +192,6 @@ class V8_EXPORT_PRIVATE JSHeapBroker {
192192
ObjectData* TryGetOrCreateData(Tagged<Object> object,
193193
GetOrCreateDataFlags flags = {});
194194

195-
// Check if {object} is any native context's %ArrayPrototype% or
196-
// %ObjectPrototype%.
197-
bool IsArrayOrObjectPrototype(JSObjectRef object) const;
198-
bool IsArrayOrObjectPrototype(Handle<JSObject> object) const;
199-
200195
bool HasFeedback(FeedbackSource const& source) const;
201196
void SetFeedback(FeedbackSource const& source,
202197
ProcessedFeedback const* feedback);

‎deps/v8/src/compiler/js-native-context-specialization.cc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4245,7 +4245,7 @@ bool JSNativeContextSpecialization::CanTreatHoleAsUndefined(
42454245
for (MapRef receiver_map : receiver_maps) {
42464246
ObjectRef receiver_prototype = receiver_map.prototype(broker());
42474247
if (!receiver_prototype.IsJSObject() ||
4248-
!broker()->IsArrayOrObjectPrototype(receiver_prototype.AsJSObject())) {
4248+
!receiver_prototype.AsJSObject().IsArrayOrObjectPrototype(broker())) {
42494249
return false;
42504250
}
42514251
}

‎deps/v8/src/compiler/node-properties.cc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -417,7 +417,7 @@ NodeProperties::InferMapsResult NodeProperties::InferMapsUnsafe(
417417
// TODO(bmeurer): This can be removed once the Array.prototype and
418418
// Object.prototype have NO_ELEMENTS elements kind.
419419
if (!ref.IsJSObject() ||
420-
!broker->IsArrayOrObjectPrototype(ref.AsJSObject())) {
420+
!ref.AsJSObject().IsArrayOrObjectPrototype(broker)) {
421421
if (ref.map(broker).is_stable()) {
422422
// The {receiver_map} is only reliable when we install a stability
423423
// code dependency.

‎deps/v8/src/maglev/maglev-graph-builder.cc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5594,7 +5594,7 @@ bool MaglevGraphBuilder::CanTreatHoleAsUndefined(
55945594
for (compiler::MapRef receiver_map : receiver_maps) {
55955595
compiler::ObjectRef receiver_prototype = receiver_map.prototype(broker());
55965596
if (!receiver_prototype.IsJSObject() ||
5597-
!broker()->IsArrayOrObjectPrototype(receiver_prototype.AsJSObject())) {
5597+
!receiver_prototype.AsJSObject().IsArrayOrObjectPrototype(broker())) {
55985598
return false;
55995599
}
56005600
}

0 commit comments

Comments
 (0)