Skip to content

Commit 763cfa9

Browse files
committed
deps: patch V8 to 11.8.172.6
Refs: v8/v8@11.8.172.3...11.8.172.6
1 parent a3b7184 commit 763cfa9

File tree

6 files changed

+53
-7
lines changed

6 files changed

+53
-7
lines changed

deps/v8/include/v8-version.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
#define V8_MAJOR_VERSION 11
1212
#define V8_MINOR_VERSION 8
1313
#define V8_BUILD_NUMBER 172
14-
#define V8_PATCH_LEVEL 3
14+
#define V8_PATCH_LEVEL 6
1515

1616
// Use 1 for candidates and 0 otherwise.
1717
// (Boolean macro values are not supported by all preprocessors.)

deps/v8/src/builtins/promise-any.tq

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -105,9 +105,10 @@ transitioning javascript builtin PromiseAnyRejectElementClosure(
105105
const index = Signed(ChangeUint32ToWord(identityHash)) - 1;
106106

107107
// 6. Let errors be F.[[Errors]].
108-
let errors = *ContextSlot(
108+
let errorsRef:&FixedArray = ContextSlot(
109109
context,
110110
PromiseAnyRejectElementContextSlots::kPromiseAnyRejectElementErrorsSlot);
111+
let errors = *errorsRef;
111112

112113
// 7. Let promiseCapability be F.[[Capability]].
113114

@@ -133,10 +134,7 @@ transitioning javascript builtin PromiseAnyRejectElementClosure(
133134
IntPtrMax(SmiUntag(remainingElementsCount) - 1, index + 1);
134135
if (newCapacity > errors.length_intptr) deferred {
135136
errors = ExtractFixedArray(errors, 0, errors.length_intptr, newCapacity);
136-
*ContextSlot(
137-
context,
138-
PromiseAnyRejectElementContextSlots::
139-
kPromiseAnyRejectElementErrorsSlot) = errors;
137+
*errorsRef = errors;
140138
}
141139
errors.objects[index] = value;
142140

@@ -154,6 +152,10 @@ transitioning javascript builtin PromiseAnyRejectElementClosure(
154152

155153
// b. Set error.[[AggregateErrors]] to errors.
156154
const error = ConstructAggregateError(errors);
155+
156+
// After this point, errors escapes to user code. Clear the slot.
157+
*errorsRef = kEmptyFixedArray;
158+
157159
// c. Return ? Call(promiseCapability.[[Reject]], undefined, « error »).
158160
const capability = *ContextSlot(
159161
context,

deps/v8/src/json/json-stringifier.cc

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -836,6 +836,10 @@ JsonStringifier::Result JsonStringifier::Serialize_(Handle<Object> object,
836836
if (deferred_string_key) SerializeDeferredKey(comma, key);
837837
return SerializeJSArray(Handle<JSArray>::cast(object), key);
838838
case JS_PRIMITIVE_WRAPPER_TYPE:
839+
if (!need_stack_) {
840+
need_stack_ = true;
841+
return NEED_STACK;
842+
}
839843
if (deferred_string_key) SerializeDeferredKey(comma, key);
840844
return SerializeJSPrimitiveWrapper(
841845
Handle<JSPrimitiveWrapper>::cast(object), key);

deps/v8/src/maglev/maglev-graph-builder.cc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5633,7 +5633,7 @@ ReduceResult MaglevGraphBuilder::TryReduceArrayForEach(
56335633
// before the call.
56345634
if (receiver_info_after_call &&
56355635
receiver_info_after_call->possible_maps_are_known()) {
5636-
recheck_maps_after_call = receiver_maps_before_loop.contains(
5636+
recheck_maps_after_call = !receiver_maps_before_loop.contains(
56375637
receiver_info_after_call->possible_maps());
56385638
}
56395639
}

deps/v8/test/mjsunit/json2.js

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -195,3 +195,23 @@ var o = {};
195195
o.somespecialproperty = 10;
196196
o["\x19"] = 10;
197197
assertThrows("JSON.parse('{\"somespecialproperty\":100, \"\x19\":10}')");
198+
199+
let exception_count = 0;
200+
function foo(v) {
201+
try {
202+
v["set-i32"];
203+
} catch (e) {
204+
exception_count++;
205+
}
206+
try {
207+
JSON.stringify(v);
208+
} catch (e) {}
209+
}
210+
let obj1 = Object('2');
211+
obj1.__proto__ = { toString: function () {} };
212+
Object.defineProperty(obj1, "toString", {value: foo});
213+
%EnsureFeedbackVectorForFunction(foo);
214+
foo(obj1);
215+
assertEquals(1, exception_count);
216+
foo({obj1, b: { toJSON: function () {} }});
217+
assertEquals(2, exception_count);
Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
// Copyright 2022 the V8 project authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style license that can be
3+
// found in the LICENSE file.
4+
//
5+
// Flags: --allow-natives-syntax --maglev --no-lazy-feedback-allocation
6+
7+
function f(e, i, a) {
8+
a[65535] = 42;
9+
a.e = a;
10+
}
11+
function foo() {
12+
const a = [1,2];
13+
a.e = 42;
14+
a.forEach(f);
15+
}
16+
17+
%PrepareFunctionForOptimization(foo);
18+
foo();
19+
%OptimizeMaglevOnNextCall(foo);
20+
foo();

0 commit comments

Comments
 (0)