Skip to content

Commit 008fb5f

Browse files
nodejs-github-botaduh95
nodejs-github-bot
authored and
aduh95
committed
deps: patch V8 to 12.9.202.28
Refs: v8/v8@12.9.202.26...12.9.202.28 PR-URL: #55371 Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
1 parent 8b28222 commit 008fb5f

File tree

6 files changed

+234
-2
lines changed

6 files changed

+234
-2
lines changed

‎deps/v8/include/v8-version.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
#define V8_MAJOR_VERSION 12
1212
#define V8_MINOR_VERSION 9
1313
#define V8_BUILD_NUMBER 202
14-
#define V8_PATCH_LEVEL 26
14+
#define V8_PATCH_LEVEL 28
1515

1616
// Use 1 for candidates and 0 otherwise.
1717
// (Boolean macro values are not supported by all preprocessors.)

‎deps/v8/src/compiler/access-info.cc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -925,6 +925,7 @@ PropertyAccessInfo AccessInfoFactory::ComputePropertyAccessInfo(
925925
return PropertyAccessInfo::NotFound(zone(), receiver_map, holder);
926926
}
927927

928+
CHECK(prototype.IsJSObject());
928929
holder = prototype.AsJSObject();
929930
map = map_prototype_map;
930931

‎deps/v8/src/compiler/heap-refs.cc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1689,6 +1689,7 @@ HolderLookupResult FunctionTemplateInfoRef::LookupHolderOfExpectedType(
16891689
if (!expected_receiver_type->IsTemplateFor(prototype.object()->map())) {
16901690
return not_found;
16911691
}
1692+
CHECK(prototype.IsJSObject());
16921693
return HolderLookupResult(CallOptimization::kHolderFound,
16931694
prototype.AsJSObject());
16941695
}

‎deps/v8/src/compiler/js-native-context-specialization.cc

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -881,7 +881,9 @@ JSNativeContextSpecialization::InferHasInPrototypeChain(
881881
// might be a different object each time, so it's much simpler to include
882882
// {prototype}. That does, however, mean that we must check {prototype}'s
883883
// map stability.
884-
if (!prototype.map(broker()).is_stable()) return kMayBeInPrototypeChain;
884+
if (!prototype.IsJSObject() || !prototype.map(broker()).is_stable()) {
885+
return kMayBeInPrototypeChain;
886+
}
885887
last_prototype = prototype.AsJSObject();
886888
}
887889
WhereToStart start = result == NodeProperties::kUnreliableMaps

‎deps/v8/src/execution/isolate.cc

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2650,6 +2650,13 @@ HandlerTable::CatchPrediction PredictExceptionFromBytecode(
26502650

26512651
HandlerTable::CatchPrediction PredictException(const FrameSummary& summary,
26522652
Isolate* isolate) {
2653+
if (!summary.IsJavaScript()) {
2654+
// This can happen when WASM is inlined by TurboFan. For now we ignore
2655+
// frames that are not JavaScript.
2656+
// TODO(https://crbug.com/349588762): We should also check Wasm code
2657+
// for exception handling.
2658+
return HandlerTable::UNCAUGHT;
2659+
}
26532660
PtrComprCageBase cage_base(isolate);
26542661
DirectHandle<AbstractCode> code = summary.AsJavaScript().abstract_code();
26552662
if (code->kind(cage_base) == CodeKind::BUILTIN) {

‎deps/v8/test/mjsunit/wasm/regress-367818758.js

Lines changed: 221 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,221 @@
1+
// Copyright 2024 the V8 project authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style license that can be
3+
// found in the LICENSE file.
4+
//
5+
// Flags: --allow-natives-syntax
6+
7+
var kWasmH0 = 0;
8+
var kWasmH1 = 0x61;
9+
var kWasmH2 = 0x73;
10+
var kWasmH3 = 0x6d;
11+
var kWasmV0 = 0x1;
12+
var kWasmV1 = 0;
13+
var kWasmV2 = 0;
14+
var kWasmV3 = 0;
15+
let kTypeSectionCode = 1; // Function signature declarations
16+
let kFunctionSectionCode = 3; // Function declarations
17+
let kExportSectionCode = 7; // Exports
18+
let kCodeSectionCode = 10; // Function code
19+
let kWasmFunctionTypeForm = 0x60;
20+
let kWasmStructTypeForm = 0x5f;
21+
let kNoSuperType = 0xFFFFFFFF;
22+
let kWasmI32 = 0x7f;
23+
let kWasmExternRef = -0x11;
24+
let kLeb128Mask = 0x7f;
25+
let kExternalFunction = 0;
26+
function makeSig(params, results) {
27+
return {params: params, results: results};
28+
}
29+
const kWasmOpcodes = {
30+
'End': 0x0b,
31+
'I32Const': 0x41,
32+
};
33+
function defineWasmOpcode(name, value) {
34+
Object.defineProperty(globalThis, name, {value: value});
35+
}
36+
for (let name in kWasmOpcodes) {
37+
defineWasmOpcode(`kExpr${name}`, kWasmOpcodes[name]);
38+
}
39+
const kPrefixOpcodes = {
40+
'GC': 0xfb,
41+
};
42+
for (let prefix in kPrefixOpcodes) {
43+
defineWasmOpcode(`k${prefix}Prefix`, kPrefixOpcodes[prefix]);
44+
}
45+
let kExprStructNew = 0x00;
46+
let kExprExternConvertAny = 0x1b;
47+
class Binary {
48+
constructor() {
49+
this.length = 0;
50+
this.buffer = new Uint8Array(8192);
51+
}
52+
trunc_buffer() {
53+
return new Uint8Array(this.buffer.buffer, 0, this.length);
54+
}
55+
emit_u8(val) {
56+
this.buffer[this.length++] = val;
57+
}
58+
emit_leb_u(val) {
59+
let v = val & 0xff;
60+
this.buffer[this.length++] = v;
61+
}
62+
emit_u32v(val) {
63+
this.emit_leb_u(val);
64+
}
65+
emit_bytes(data) {
66+
this.buffer.set(data, this.length);
67+
this.length += data.length;
68+
}
69+
emit_string(string) {
70+
let string_utf8 = string;
71+
this.emit_u32v(string_utf8.length);
72+
for (let i = 0; i < string_utf8.length; i++) {
73+
this.emit_u8(string_utf8.charCodeAt(i));
74+
}
75+
}
76+
emit_type(type) {
77+
this.emit_u8(type >= 0 ? type : type & kLeb128Mask);
78+
}
79+
emit_header() {
80+
this.emit_bytes([
81+
kWasmH0, kWasmH1, kWasmH2, kWasmH3, kWasmV0, kWasmV1, kWasmV2, kWasmV3
82+
]);
83+
}
84+
emit_section(section_code, content_generator) {
85+
this.emit_u8(section_code);
86+
const section = new Binary;
87+
content_generator(section);
88+
this.emit_u32v(section.length);
89+
this.emit_bytes(section.trunc_buffer());
90+
}
91+
}
92+
class WasmFunctionBuilder {
93+
constructor(module, name, type_index, arg_names) {
94+
this.module = module;
95+
this.name = name;
96+
this.type_index = type_index;
97+
}
98+
exportAs(name) {
99+
this.module.addExport(name, this.index);
100+
}
101+
exportFunc() {
102+
this.exportAs(this.name);
103+
return this;
104+
}
105+
addBody(body) {
106+
this.body = body.concat([kExprEnd]);
107+
}
108+
}
109+
function makeField(type, mutability) {
110+
return {type: type, mutability: mutability};
111+
}
112+
class WasmStruct {
113+
constructor(fields) {
114+
this.fields = fields;
115+
}
116+
}
117+
class WasmModuleBuilder {
118+
constructor() {
119+
this.types = [];
120+
this.exports = [];
121+
this.functions = [];
122+
}
123+
addType(type, supertype_idx = kNoSuperType, is_final = true,
124+
is_shared = false) {
125+
var type_copy = {params: type.params, results: type.results,
126+
is_final: is_final, is_shared: is_shared,
127+
supertype: supertype_idx};
128+
this.types.push(type_copy);
129+
return this.types.length - 1;
130+
}
131+
addStruct(fields = kNoSuperType = false, is_shared = false) {
132+
this.types.push(new WasmStruct(fields));
133+
}
134+
addFunction(name, type, arg_names) {
135+
let type_index =typeof type == 'number' ? type : this.addType(type);
136+
let func = new WasmFunctionBuilder(this, name, type_index);
137+
this.functions.push(func);
138+
return func;
139+
}
140+
addExport(name, index) {
141+
this.exports.push({name: name, kind: kExternalFunction, index: index});
142+
}
143+
toBuffer() {
144+
let binary = new Binary;
145+
let wasm = this;
146+
binary.emit_header();
147+
binary.emit_section(kTypeSectionCode, section => {
148+
let length_with_groups = wasm.types.length;
149+
section.emit_u32v(length_with_groups);
150+
for (let i = 0; i < wasm.types.length; i++) {
151+
let type = wasm.types[i];
152+
if (type instanceof WasmStruct) {
153+
section.emit_u8(kWasmStructTypeForm);
154+
section.emit_u32v(type.fields.length);
155+
for (let field of type.fields) {
156+
section.emit_type(field.type);
157+
section.emit_u8();
158+
}
159+
} else {
160+
section.emit_u8(kWasmFunctionTypeForm);
161+
section.emit_u32v();
162+
section.emit_u32v(type.results.length);
163+
for (let result of type.results) {
164+
section.emit_type(result);
165+
}
166+
}
167+
}
168+
});
169+
binary.emit_section(kFunctionSectionCode, section => {
170+
section.emit_u32v(wasm.functions.length);
171+
for (let func of wasm.functions) {
172+
section.emit_u32v(func.type_index);
173+
}
174+
});
175+
var exports_count = wasm.exports.length;
176+
binary.emit_section(kExportSectionCode, section => {
177+
section.emit_u32v(exports_count);
178+
for (let exp of wasm.exports) {
179+
section.emit_string(exp.name);
180+
section.emit_u8();
181+
section.emit_u32v();
182+
}
183+
});
184+
binary.emit_section(kCodeSectionCode, section => {
185+
section.emit_u32v(wasm.functions.length);
186+
for (let func of wasm.functions) {
187+
section.emit_u32v(func.body.length + 1);
188+
section.emit_u8(); // 0 locals.
189+
section.emit_bytes(func.body);
190+
}
191+
});
192+
return binary.trunc_buffer();
193+
}
194+
instantiate() {
195+
let module = this.toModule();
196+
let instance = new WebAssembly.Instance(module);
197+
return instance;
198+
}
199+
toModule() {
200+
return new WebAssembly.Module(this.toBuffer());
201+
}
202+
}
203+
let builder = new WasmModuleBuilder();
204+
let struct_type = builder.addStruct([makeField(kWasmI32)]);
205+
builder.addFunction('MakeStruct', makeSig([], [kWasmExternRef])).exportFunc()
206+
.addBody([kExprI32Const, 42, kGCPrefix, kExprStructNew, struct_type,
207+
kGCPrefix, kExprExternConvertAny]);
208+
let instance = builder.instantiate();
209+
let evil_wasm_object = instance.exports.MakeStruct();
210+
function evil_ctor(){
211+
}
212+
function evil_cast_jit(evil_o){
213+
global_collect_node_info = evil_o; // get nodeinfo from PropertyCellStore
214+
return evil_o instanceof evil_ctor;
215+
}
216+
evil_ctor.prototype = evil_wasm_object;
217+
%PrepareFunctionForOptimization(evil_cast_jit);
218+
evil_cast_jit(new evil_ctor());
219+
evil_cast_jit(new evil_ctor());
220+
%OptimizeFunctionOnNextCall(evil_cast_jit);
221+
evil_cast_jit();

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy