Skip to content

Commit 8e33f20

Browse files
joyeecheungjoyeecheung
authored
Revert "deps: V8: cherry-pick 9ebca66a5740"
Reason for revert: broke test-snapshot-reproducible.js in dynamically linked builds in the CI. This reverts commit 4c730ae. PR-URL: #53582 Refs: #53579 Reviewed-By: Michaël Zasso <[email protected]> Reviewed-By: Moshe Atlow <[email protected]> Reviewed-By: Jiawen Geng <[email protected]> Reviewed-By: Chengzhong Wu <[email protected]> Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Stewart X Addison <[email protected]>
1 parent d7d9278 commit 8e33f20

File tree

58 files changed

+204
-71
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

58 files changed

+204
-71
lines changed

‎common.gypi

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@
3636

3737
# Reset this number to 0 on major V8 upgrades.
3838
# Increment by one for each non-official patch applied to deps/v8.
39-
'v8_embedder_string': '-node.16',
39+
'v8_embedder_string': '-node.15',
4040

4141
##### V8 defaults for Node.js #####
4242

‎deps/v8/src/api/api.cc

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8953,6 +8953,9 @@ std::unique_ptr<v8::BackingStore> v8::ArrayBuffer::NewBackingStore(
89538953
// static
89548954
std::unique_ptr<BackingStore> v8::ArrayBuffer::NewResizableBackingStore(
89558955
size_t byte_length, size_t max_byte_length) {
8956+
Utils::ApiCheck(i::v8_flags.harmony_rab_gsab,
8957+
"v8::ArrayBuffer::NewResizableBackingStore",
8958+
"Constructing resizable ArrayBuffers is not supported");
89568959
Utils::ApiCheck(byte_length <= max_byte_length,
89578960
"v8::ArrayBuffer::NewResizableBackingStore",
89588961
"Cannot construct resizable ArrayBuffer, byte_length must be "

‎deps/v8/src/builtins/builtins-arraybuffer.cc

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -134,16 +134,18 @@ BUILTIN(ArrayBufferConstructor) {
134134
}
135135

136136
Handle<Object> number_max_length;
137-
Handle<Object> max_length;
138-
Handle<Object> options = args.atOrUndefined(isolate, 2);
139-
ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
140-
isolate, max_length,
141-
JSObject::ReadFromOptionsBag(
142-
options, isolate->factory()->max_byte_length_string(), isolate));
137+
if (v8_flags.harmony_rab_gsab) {
138+
Handle<Object> max_length;
139+
Handle<Object> options = args.atOrUndefined(isolate, 2);
140+
ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
141+
isolate, max_length,
142+
JSObject::ReadFromOptionsBag(
143+
options, isolate->factory()->max_byte_length_string(), isolate));
143144

144-
if (!IsUndefined(*max_length, isolate)) {
145-
ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, number_max_length,
146-
Object::ToInteger(isolate, max_length));
145+
if (!IsUndefined(*max_length, isolate)) {
146+
ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
147+
isolate, number_max_length, Object::ToInteger(isolate, max_length));
148+
}
147149
}
148150
return ConstructBuffer(isolate, target, new_target, number_length,
149151
number_max_length, InitializedFlag::kZeroInitialized);

‎deps/v8/src/compiler/heap-refs.cc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1127,7 +1127,7 @@ bool MapRef::CanInlineElementAccess() const {
11271127
(Is64() || (kind != BIGINT64_ELEMENTS && kind != BIGUINT64_ELEMENTS))) {
11281128
return true;
11291129
}
1130-
if (IsRabGsabTypedArrayElementsKind(kind) &&
1130+
if (v8_flags.turbo_rab_gsab && IsRabGsabTypedArrayElementsKind(kind) &&
11311131
kind != RAB_GSAB_BIGUINT64_ELEMENTS &&
11321132
kind != RAB_GSAB_BIGINT64_ELEMENTS) {
11331133
return true;

‎deps/v8/src/compiler/js-call-reducer.cc

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7552,7 +7552,7 @@ Reduction JSCallReducer::ReduceArrayBufferViewByteLengthAccessor(
75527552
}
75537553
}
75547554

7555-
if (!maybe_rab_gsab) {
7555+
if (!v8_flags.harmony_rab_gsab || !maybe_rab_gsab) {
75567556
// We do not perform any change depending on this inference.
75577557
Reduction unused_reduction = inference.NoChange();
75587558
USE(unused_reduction);
@@ -7561,6 +7561,8 @@ Reduction JSCallReducer::ReduceArrayBufferViewByteLengthAccessor(
75617561
node, JS_TYPED_ARRAY_TYPE,
75627562
AccessBuilder::ForJSArrayBufferViewByteLength(),
75637563
Builtin::kTypedArrayPrototypeByteLength);
7564+
} else if (!v8_flags.turbo_rab_gsab) {
7565+
return inference.NoChange();
75647566
}
75657567

75667568
const CallParameters& p = CallParametersOf(node->op());
@@ -7611,14 +7613,16 @@ Reduction JSCallReducer::ReduceTypedArrayPrototypeLength(Node* node) {
76117613
if (IsRabGsabTypedArrayElementsKind(kind)) maybe_rab_gsab = true;
76127614
}
76137615

7614-
if (!maybe_rab_gsab) {
7616+
if (!v8_flags.harmony_rab_gsab || !maybe_rab_gsab) {
76157617
// We do not perform any change depending on this inference.
76167618
Reduction unused_reduction = inference.NoChange();
76177619
USE(unused_reduction);
76187620
// Call default implementation for non-rab/gsab TAs.
76197621
return ReduceArrayBufferViewAccessor(node, JS_TYPED_ARRAY_TYPE,
76207622
AccessBuilder::ForJSTypedArrayLength(),
76217623
Builtin::kTypedArrayPrototypeLength);
7624+
} else if (!v8_flags.turbo_rab_gsab) {
7625+
return inference.NoChange();
76227626
}
76237627

76247628
if (!inference.RelyOnMapsViaStability(dependencies())) {

‎deps/v8/src/compiler/js-native-context-specialization.cc

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3199,6 +3199,8 @@ JSNativeContextSpecialization::BuildElementAccess(
31993199
// TODO(bmeurer): We currently specialize based on elements kind. We should
32003200
// also be able to properly support strings and other JSObjects here.
32013201
ElementsKind elements_kind = access_info.elements_kind();
3202+
DCHECK_IMPLIES(IsRabGsabTypedArrayElementsKind(elements_kind),
3203+
v8_flags.turbo_rab_gsab);
32023204
ZoneVector<MapRef> const& receiver_maps =
32033205
access_info.lookup_start_object_maps();
32043206

@@ -3584,6 +3586,8 @@ JSNativeContextSpecialization::
35843586
KeyedAccessMode const& keyed_mode) {
35853587
DCHECK(IsTypedArrayElementsKind(elements_kind) ||
35863588
IsRabGsabTypedArrayElementsKind(elements_kind));
3589+
DCHECK_IMPLIES(IsRabGsabTypedArrayElementsKind(elements_kind),
3590+
v8_flags.turbo_rab_gsab);
35873591
// AccessMode::kDefine is not handled here. Optimization should be skipped by
35883592
// caller.
35893593
DCHECK(keyed_mode.access_mode() != AccessMode::kDefine);

‎deps/v8/src/flags/flag-definitions.h

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -280,6 +280,8 @@ DEFINE_BOOL(js_shipping, true, "enable all shipped JavaScript features")
280280
V(js_regexp_modifiers, "RegExp modifiers") \
281281
V(js_regexp_duplicate_named_groups, "RegExp duplicate named groups")
282282

283+
DEFINE_WEAK_IMPLICATION(harmony_rab_gsab_transfer, harmony_rab_gsab)
284+
283285
#ifdef V8_INTL_SUPPORT
284286
#define HARMONY_STAGED(V) HARMONY_STAGED_BASE(V)
285287
#define JAVASCRIPT_STAGED_FEATURES(V) JAVASCRIPT_STAGED_FEATURES_BASE(V)
@@ -291,8 +293,11 @@ DEFINE_BOOL(js_shipping, true, "enable all shipped JavaScript features")
291293
// Features that are shipping (turned on by default, but internal flag remains).
292294
#define HARMONY_SHIPPING_BASE(V) \
293295
V(harmony_import_assertions, "harmony import assertions") \
296+
V(harmony_rab_gsab, \
297+
"harmony ResizableArrayBuffer / GrowableSharedArrayBuffer") \
294298
V(harmony_regexp_unicode_sets, "harmony RegExp Unicode Sets") \
295299
V(harmony_json_parse_with_source, "harmony json parse with source") \
300+
V(harmony_rab_gsab_transfer, "harmony ArrayBuffer.transfer") \
296301
V(harmony_array_grouping, "harmony array grouping") \
297302
V(harmony_array_from_async, "harmony Array.fromAsync") \
298303
V(harmony_iterator_helpers, "JavaScript iterator helpers") \
@@ -1273,6 +1278,9 @@ DEFINE_BOOL_READONLY(turbo_rewrite_far_jumps, false,
12731278
"rewrite far to near jumps (ia32,x64)")
12741279
#endif
12751280

1281+
DEFINE_BOOL(
1282+
turbo_rab_gsab, true,
1283+
"optimize ResizableArrayBuffer / GrowableSharedArrayBuffer in TurboFan")
12761284
DEFINE_BOOL(
12771285
stress_gc_during_compilation, false,
12781286
"simulate GC/compiler thread race related to https://crbug.com/v8/8520")

‎deps/v8/src/heap/factory.cc

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3220,7 +3220,7 @@ Handle<JSArrayBuffer> Factory::NewJSArrayBuffer(
32203220
isolate()->native_context()->array_buffer_fun()->initial_map(),
32213221
isolate());
32223222
ResizableFlag resizable_by_js = ResizableFlag::kNotResizable;
3223-
if (backing_store->is_resizable_by_js()) {
3223+
if (v8_flags.harmony_rab_gsab && backing_store->is_resizable_by_js()) {
32243224
resizable_by_js = ResizableFlag::kResizable;
32253225
}
32263226
auto result =
@@ -3276,6 +3276,8 @@ MaybeHandle<JSArrayBuffer> Factory::NewJSArrayBufferAndBackingStore(
32763276

32773277
Handle<JSArrayBuffer> Factory::NewJSSharedArrayBuffer(
32783278
std::shared_ptr<BackingStore> backing_store) {
3279+
DCHECK_IMPLIES(backing_store->is_resizable_by_js(),
3280+
v8_flags.harmony_rab_gsab);
32793281
Handle<Map> map(
32803282
isolate()->native_context()->shared_array_buffer_fun()->initial_map(),
32813283
isolate());
@@ -3381,6 +3383,7 @@ Handle<JSTypedArray> Factory::NewJSTypedArray(
33813383
ElementsKind elements_kind;
33823384
JSTypedArray::ForFixedTypedArray(type, &element_size, &elements_kind);
33833385

3386+
CHECK_IMPLIES(is_length_tracking, v8_flags.harmony_rab_gsab);
33843387
const bool is_backed_by_rab =
33853388
buffer->is_resizable_by_js() && !buffer->is_shared();
33863389

@@ -3422,6 +3425,7 @@ Handle<JSTypedArray> Factory::NewJSTypedArray(
34223425
Handle<JSDataViewOrRabGsabDataView> Factory::NewJSDataViewOrRabGsabDataView(
34233426
DirectHandle<JSArrayBuffer> buffer, size_t byte_offset, size_t byte_length,
34243427
bool is_length_tracking) {
3428+
CHECK_IMPLIES(is_length_tracking, v8_flags.harmony_rab_gsab);
34253429
if (is_length_tracking) {
34263430
// Security: enforce the invariant that length-tracking DataViews have their
34273431
// byte_length set to 0.

‎deps/v8/src/init/bootstrapper.cc

Lines changed: 41 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -4054,25 +4054,6 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
40544054
"arrayBufferConstructor_DoNotInitialize"),
40554055
Builtin::kArrayBufferConstructor_DoNotInitialize, 1, false);
40564056
native_context()->set_array_buffer_noinit_fun(*array_buffer_noinit_fun);
4057-
4058-
Handle<JSObject> array_buffer_prototype(
4059-
JSObject::cast(array_buffer_fun->instance_prototype()), isolate_);
4060-
SimpleInstallGetter(isolate_, array_buffer_prototype,
4061-
factory->max_byte_length_string(),
4062-
Builtin::kArrayBufferPrototypeGetMaxByteLength, false);
4063-
SimpleInstallGetter(isolate_, array_buffer_prototype,
4064-
factory->resizable_string(),
4065-
Builtin::kArrayBufferPrototypeGetResizable, false);
4066-
SimpleInstallFunction(isolate_, array_buffer_prototype, "resize",
4067-
Builtin::kArrayBufferPrototypeResize, 1, true);
4068-
SimpleInstallFunction(isolate_, array_buffer_prototype, "transfer",
4069-
Builtin::kArrayBufferPrototypeTransfer, 0, false);
4070-
SimpleInstallFunction(
4071-
isolate_, array_buffer_prototype, "transferToFixedLength",
4072-
Builtin::kArrayBufferPrototypeTransferToFixedLength, 0, false);
4073-
SimpleInstallGetter(isolate_, array_buffer_prototype,
4074-
factory->detached_string(),
4075-
Builtin::kArrayBufferPrototypeGetDetached, false);
40764057
}
40774058

40784059
{ // -- S h a r e d A r r a y B u f f e r
@@ -4082,19 +4063,6 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
40824063
InstallWithIntrinsicDefaultProto(isolate_, shared_array_buffer_fun,
40834064
Context::SHARED_ARRAY_BUFFER_FUN_INDEX);
40844065
InstallSpeciesGetter(isolate_, shared_array_buffer_fun);
4085-
4086-
Handle<JSObject> shared_array_buffer_prototype(
4087-
JSObject::cast(shared_array_buffer_fun->instance_prototype()),
4088-
isolate_);
4089-
SimpleInstallGetter(isolate_, shared_array_buffer_prototype,
4090-
factory->max_byte_length_string(),
4091-
Builtin::kSharedArrayBufferPrototypeGetMaxByteLength,
4092-
false);
4093-
SimpleInstallGetter(isolate_, shared_array_buffer_prototype,
4094-
factory->growable_string(),
4095-
Builtin::kSharedArrayBufferPrototypeGetGrowable, false);
4096-
SimpleInstallFunction(isolate_, shared_array_buffer_prototype, "grow",
4097-
Builtin::kSharedArrayBufferPrototypeGrow, 1, true);
40984066
}
40994067

41004068
{ // -- A t o m i c s
@@ -5332,6 +5300,7 @@ void Genesis::InitializeConsole(Handle<JSObject> extras_binding) {
53325300

53335301
EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_import_assertions)
53345302
EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_import_attributes)
5303+
EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_rab_gsab_transfer)
53355304
EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(js_regexp_modifiers)
53365305
EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(js_regexp_duplicate_named_groups)
53375306

@@ -5799,6 +5768,46 @@ void Genesis::InitializeGlobal_regexp_linear_flag() {
57995768
native_context()->set_regexp_prototype_map(regexp_prototype->map());
58005769
}
58015770

5771+
void Genesis::InitializeGlobal_harmony_rab_gsab() {
5772+
if (!v8_flags.harmony_rab_gsab) return;
5773+
Handle<JSObject> array_buffer_prototype(
5774+
JSObject::cast(
5775+
native_context()->array_buffer_fun()->instance_prototype()),
5776+
isolate());
5777+
SimpleInstallGetter(isolate(), array_buffer_prototype,
5778+
factory()->max_byte_length_string(),
5779+
Builtin::kArrayBufferPrototypeGetMaxByteLength, false);
5780+
SimpleInstallGetter(isolate(), array_buffer_prototype,
5781+
factory()->resizable_string(),
5782+
Builtin::kArrayBufferPrototypeGetResizable, false);
5783+
SimpleInstallFunction(isolate(), array_buffer_prototype, "resize",
5784+
Builtin::kArrayBufferPrototypeResize, 1, true);
5785+
if (v8_flags.harmony_rab_gsab_transfer) {
5786+
SimpleInstallFunction(isolate(), array_buffer_prototype, "transfer",
5787+
Builtin::kArrayBufferPrototypeTransfer, 0, false);
5788+
SimpleInstallFunction(
5789+
isolate(), array_buffer_prototype, "transferToFixedLength",
5790+
Builtin::kArrayBufferPrototypeTransferToFixedLength, 0, false);
5791+
SimpleInstallGetter(isolate(), array_buffer_prototype,
5792+
factory()->detached_string(),
5793+
Builtin::kArrayBufferPrototypeGetDetached, false);
5794+
}
5795+
5796+
Handle<JSObject> shared_array_buffer_prototype(
5797+
JSObject::cast(
5798+
native_context()->shared_array_buffer_fun()->instance_prototype()),
5799+
isolate());
5800+
SimpleInstallGetter(isolate(), shared_array_buffer_prototype,
5801+
factory()->max_byte_length_string(),
5802+
Builtin::kSharedArrayBufferPrototypeGetMaxByteLength,
5803+
false);
5804+
SimpleInstallGetter(isolate(), shared_array_buffer_prototype,
5805+
factory()->growable_string(),
5806+
Builtin::kSharedArrayBufferPrototypeGetGrowable, false);
5807+
SimpleInstallFunction(isolate(), shared_array_buffer_prototype, "grow",
5808+
Builtin::kSharedArrayBufferPrototypeGrow, 1, true);
5809+
}
5810+
58025811
void Genesis::InitializeGlobal_harmony_temporal() {
58035812
if (!v8_flags.harmony_temporal) return;
58045813

‎deps/v8/src/objects/js-array-buffer.cc

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -177,6 +177,7 @@ size_t JSArrayBuffer::GsabByteLength(Isolate* isolate,
177177
Address raw_array_buffer) {
178178
// TODO(v8:11111): Cache the last seen length in JSArrayBuffer and use it
179179
// in bounds checks to minimize the need for calling this function.
180+
DCHECK(v8_flags.harmony_rab_gsab);
180181
DisallowGarbageCollection no_gc;
181182
DisallowJavascriptExecution no_js(isolate);
182183
Tagged<JSArrayBuffer> buffer =
@@ -404,6 +405,7 @@ size_t JSTypedArray::LengthTrackingGsabBackedTypedArrayLength(
404405
Isolate* isolate, Address raw_array) {
405406
// TODO(v8:11111): Cache the last seen length in JSArrayBuffer and use it
406407
// in bounds checks to minimize the need for calling this function.
408+
DCHECK(v8_flags.harmony_rab_gsab);
407409
DisallowGarbageCollection no_gc;
408410
DisallowJavascriptExecution no_js(isolate);
409411
Tagged<JSTypedArray> array = JSTypedArray::cast(Tagged<Object>(raw_array));

‎deps/v8/src/objects/value-serializer.cc

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1009,6 +1009,7 @@ Maybe<bool> ValueSerializer::WriteJSArrayBufferView(
10091009
ArrayBufferViewTag tag = ArrayBufferViewTag::kInt8Array;
10101010
if (IsJSTypedArray(view)) {
10111011
if (JSTypedArray::cast(view)->IsOutOfBounds()) {
1012+
DCHECK(v8_flags.harmony_rab_gsab);
10121013
return ThrowDataCloneError(MessageTemplate::kDataCloneError,
10131014
handle(view, isolate_));
10141015
}
@@ -1024,6 +1025,7 @@ Maybe<bool> ValueSerializer::WriteJSArrayBufferView(
10241025
DCHECK(IsJSDataViewOrRabGsabDataView(view));
10251026
if (IsJSRabGsabDataView(view) &&
10261027
JSRabGsabDataView::cast(view)->IsOutOfBounds()) {
1028+
DCHECK(v8_flags.harmony_rab_gsab);
10271029
return ThrowDataCloneError(MessageTemplate::kDataCloneError,
10281030
handle(view, isolate_));
10291031
}
@@ -2103,6 +2105,13 @@ MaybeHandle<JSArrayBuffer> ValueDeserializer::ReadJSArrayBuffer(
21032105
if (byte_length > max_byte_length) {
21042106
return MaybeHandle<JSArrayBuffer>();
21052107
}
2108+
if (!v8_flags.harmony_rab_gsab) {
2109+
// Disable resizability. This ensures that no resizable buffers are
2110+
// created in a version which has the harmony_rab_gsab turned off, even if
2111+
// such a version is reading data containing resizable buffers from disk.
2112+
is_resizable = false;
2113+
max_byte_length = byte_length;
2114+
}
21062115
}
21072116
if (byte_length > static_cast<size_t>(end_ - position_)) {
21082117
return MaybeHandle<JSArrayBuffer>();
@@ -2224,6 +2233,16 @@ bool ValueDeserializer::ValidateJSArrayBufferViewFlags(
22242233
// TODO(marja): When the version number is bumped the next time, check that
22252234
// serialized_flags doesn't contain spurious 1-bits.
22262235

2236+
if (!v8_flags.harmony_rab_gsab) {
2237+
// Disable resizability. This ensures that no resizable buffers are
2238+
// created in a version which has the harmony_rab_gsab turned off, even if
2239+
// such a version is reading data containing resizable buffers from disk.
2240+
is_length_tracking = false;
2241+
is_backed_by_rab = false;
2242+
// The resizability of the buffer was already disabled.
2243+
CHECK(!buffer->is_resizable_by_js());
2244+
}
2245+
22272246
if (is_backed_by_rab || is_length_tracking) {
22282247
if (!buffer->is_resizable_by_js()) {
22292248
return false;

‎deps/v8/test/cctest/test-api-array-buffer.cc

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -455,6 +455,8 @@ THREADED_TEST(ArrayBuffer_NewBackingStore) {
455455
}
456456

457457
THREADED_TEST(ArrayBuffer_NewResizableBackingStore) {
458+
FLAG_SCOPE(harmony_rab_gsab);
459+
458460
LocalContext env;
459461
v8::Isolate* isolate = env->GetIsolate();
460462
v8::HandleScope handle_scope(isolate);
@@ -829,6 +831,8 @@ TEST(BackingStore_ReallocateShared) {
829831
}
830832

831833
TEST(ArrayBuffer_Resizable) {
834+
FLAG_SCOPE(harmony_rab_gsab);
835+
832836
LocalContext env;
833837
v8::Isolate* isolate = env->GetIsolate();
834838
v8::HandleScope handle_scope(isolate);
@@ -850,6 +854,8 @@ TEST(ArrayBuffer_Resizable) {
850854
}
851855

852856
TEST(ArrayBuffer_FixedLength) {
857+
FLAG_SCOPE(harmony_rab_gsab);
858+
853859
LocalContext env;
854860
v8::Isolate* isolate = env->GetIsolate();
855861
v8::HandleScope handle_scope(isolate);

‎deps/v8/test/mjsunit/compiler/typedarray-resizablearraybuffer.js

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@
22
// Use of this source code is governed by a BSD-style license that can be
33
// found in the LICENSE file.
44

5-
// Flags: --allow-natives-syntax --turbofan --no-always-turbofan
5+
// Flags: --harmony-rab-gsab --allow-natives-syntax --turbofan
6+
// Flags: --no-always-turbofan --turbo-rab-gsab
67
// Flags: --js-float16array
78

89
"use strict";

‎deps/v8/test/mjsunit/dataview-growablesharedarraybuffer.js

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@
22
// Use of this source code is governed by a BSD-style license that can be
33
// found in the LICENSE file.
44

5-
// Flags: --allow-natives-syntax --js-float16array
5+
// Flags: --harmony-rab-gsab --allow-natives-syntax
6+
// Flags: --js-float16array
67

78
"use strict";
89

‎deps/v8/test/mjsunit/dataview-resizablearraybuffer-detach.js

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@
22
// Use of this source code is governed by a BSD-style license that can be
33
// found in the LICENSE file.
44

5-
// Flags: --allow-natives-syntax --js-float16array
5+
// Flags: --harmony-rab-gsab --allow-natives-syntax
6+
// Flags: --js-float16array
67

78
"use strict";
89

0 commit comments

Comments
 (0)