From 48a865b5436f2ae27bdba0625f8a3890fa592be2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C3=ABl=20Zasso?= Date: Tue, 29 Jun 2021 20:35:31 +0200 Subject: [PATCH] deps: patch V8 to 9.1.269.38 Refs: https://github.com/v8/v8/compare/9.1.269.36...9.1.269.38 Fixes: https://github.com/nodejs/node/issues/37553 --- deps/v8/include/v8-version.h | 2 +- deps/v8/src/heap/heap.cc | 4 +++ deps/v8/src/heap/heap.h | 2 ++ deps/v8/src/json/json-parser.cc | 5 +++ deps/v8/src/wasm/wasm-js.cc | 59 ++++++++++++++++++++++----------- 5 files changed, 52 insertions(+), 20 deletions(-) diff --git a/deps/v8/include/v8-version.h b/deps/v8/include/v8-version.h index 747b33f6da13e6..4bdb66b2bf6847 100644 --- a/deps/v8/include/v8-version.h +++ b/deps/v8/include/v8-version.h @@ -11,7 +11,7 @@ #define V8_MAJOR_VERSION 9 #define V8_MINOR_VERSION 1 #define V8_BUILD_NUMBER 269 -#define V8_PATCH_LEVEL 36 +#define V8_PATCH_LEVEL 38 // Use 1 for candidates and 0 otherwise. // (Boolean macro values are not supported by all preprocessors.) diff --git a/deps/v8/src/heap/heap.cc b/deps/v8/src/heap/heap.cc index 409855bb55d56e..d117d6c50e7207 100644 --- a/deps/v8/src/heap/heap.cc +++ b/deps/v8/src/heap/heap.cc @@ -2129,6 +2129,10 @@ void Heap::CompleteSweepingYoung(GarbageCollector collector) { array_buffer_sweeper()->EnsureFinished(); } +void Heap::EnsureSweepingCompleted() { + mark_compact_collector()->EnsureSweepingCompleted(); +} + void Heap::UpdateCurrentEpoch(GarbageCollector collector) { if (IsYoungGenerationCollector(collector)) { epoch_young_ = next_epoch(); diff --git a/deps/v8/src/heap/heap.h b/deps/v8/src/heap/heap.h index 25b8f5964e054f..429f8864be7adb 100644 --- a/deps/v8/src/heap/heap.h +++ b/deps/v8/src/heap/heap.h @@ -1074,6 +1074,8 @@ class Heap { void CompleteSweepingFull(); void CompleteSweepingYoung(GarbageCollector collector); + void EnsureSweepingCompleted(); + IncrementalMarking* incremental_marking() { return incremental_marking_.get(); } diff --git a/deps/v8/src/json/json-parser.cc b/deps/v8/src/json/json-parser.cc index a85d2af94bfabc..ccea49e89fa372 100644 --- a/deps/v8/src/json/json-parser.cc +++ b/deps/v8/src/json/json-parser.cc @@ -620,6 +620,11 @@ Handle JsonParser::BuildJsonObject( DCHECK_EQ(mutable_double_address, end); } #endif + // Before setting the length of mutable_double_buffer back to zero, we + // must ensure that the sweeper is not running or has already swept the + // object's page. Otherwise the GC can add the contents of + // mutable_double_buffer to the free list. + isolate()->heap()->EnsureSweepingCompleted(); mutable_double_buffer->set_length(0); } } diff --git a/deps/v8/src/wasm/wasm-js.cc b/deps/v8/src/wasm/wasm-js.cc index bc9c5557eb20f1..7f1d8e261fffdf 100644 --- a/deps/v8/src/wasm/wasm-js.cc +++ b/deps/v8/src/wasm/wasm-js.cc @@ -2318,28 +2318,49 @@ void WasmJs::InstallConditionalFeatures(Isolate* isolate, Handle global = handle(context->global_object(), isolate); MaybeHandle maybe_webassembly = JSObject::GetProperty(isolate, global, "WebAssembly"); - Handle webassembly = - Handle::cast(maybe_webassembly.ToHandleChecked()); + Handle webassembly_obj; + if (!maybe_webassembly.ToHandle(&webassembly_obj)) { + // There is not {WebAssembly} object. We just return without adding the + // {Exception} constructor. + return; + } + if (!webassembly_obj->IsJSObject()) { + // The {WebAssembly} object is invalid. As we cannot add the {Exception} + // constructor, we just return. + return; + } + Handle webassembly = Handle::cast(webassembly_obj); // Setup Exception Handle exception_name = v8_str(isolate, "Exception"); - if (!JSObject::HasProperty(webassembly, exception_name).FromMaybe(true)) { - Handle exception_constructor = - CreateFunc(isolate, exception_name, WebAssemblyException, true, - SideEffectType::kHasSideEffect); - exception_constructor->shared().set_length(1); - JSObject::AddProperty(isolate, webassembly, exception_name, - exception_constructor, DONT_ENUM); - // Install the constructor on the context. - context->set_wasm_exception_constructor(*exception_constructor); - SetDummyInstanceTemplate(isolate, exception_constructor); - JSFunction::EnsureHasInitialMap(exception_constructor); - Handle exception_proto( - JSObject::cast(exception_constructor->instance_prototype()), isolate); - Handle exception_map = isolate->factory()->NewMap( - i::WASM_EXCEPTION_OBJECT_TYPE, WasmExceptionObject::kHeaderSize); - JSFunction::SetInitialMap(isolate, exception_constructor, exception_map, - exception_proto); + + if (JSObject::HasOwnProperty(webassembly, exception_name).FromMaybe(true)) { + // The {Exception} constructor already exists, there is nothing more to + // do. + return; + } + + bool has_prototype = true; + Handle exception_constructor = + CreateFunc(isolate, exception_name, WebAssemblyException, has_prototype, + SideEffectType::kHasNoSideEffect); + exception_constructor->shared().set_length(1); + auto result = Object::SetProperty( + isolate, webassembly, exception_name, exception_constructor, + StoreOrigin::kNamed, Just(ShouldThrow::kDontThrow)); + if (result.is_null()) { + // Setting the {Exception} constructor failed. We just bail out. + return; } + // Install the constructor on the context. + context->set_wasm_exception_constructor(*exception_constructor); + SetDummyInstanceTemplate(isolate, exception_constructor); + JSFunction::EnsureHasInitialMap(exception_constructor); + Handle exception_proto( + JSObject::cast(exception_constructor->instance_prototype()), isolate); + Handle exception_map = isolate->factory()->NewMap( + i::WASM_EXCEPTION_OBJECT_TYPE, WasmExceptionObject::kHeaderSize); + JSFunction::SetInitialMap(isolate, exception_constructor, exception_map, + exception_proto); } } #undef ASSIGN