Skip to content

Commit cf1f1de

Browse files
MylesBorinsMylesBorins
committed
deps: patch V8 to 7.9.317.23
Refs: v8/v8@7.9.317.20...7.9.317.23 PR-URL: #30560 Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Jiawen Geng <[email protected]>
1 parent 03b5c46 commit cf1f1de

9 files changed

Lines changed: 85 additions & 7 deletions

File tree

‎deps/v8/include/v8-version.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
#define V8_MAJOR_VERSION 7
1212
#define V8_MINOR_VERSION 9
1313
#define V8_BUILD_NUMBER 317
14-
#define V8_PATCH_LEVEL 20
14+
#define V8_PATCH_LEVEL 23
1515

1616
// Use 1 for candidates and 0 otherwise.
1717
// (Boolean macro values are not supported by all preprocessors.)

‎deps/v8/src/execution/isolate.cc‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4274,9 +4274,8 @@ void Isolate::AddDetachedContext(Handle<Context> context) {
42744274
HandleScope scope(this);
42754275
Handle<WeakArrayList> detached_contexts = factory()->detached_contexts();
42764276
detached_contexts = WeakArrayList::AddToEnd(
4277-
this, detached_contexts, MaybeObjectHandle(Smi::kZero, this));
4278-
detached_contexts = WeakArrayList::AddToEnd(this, detached_contexts,
4279-
MaybeObjectHandle::Weak(context));
4277+
this, detached_contexts, MaybeObjectHandle(Smi::kZero, this),
4278+
MaybeObjectHandle::Weak(context));
42804279
heap()->set_detached_contexts(*detached_contexts);
42814280
}
42824281

‎deps/v8/src/objects/backing-store.cc‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -605,8 +605,14 @@ std::shared_ptr<BackingStore> GlobalBackingStoreRegistry::Lookup(
605605
return std::shared_ptr<BackingStore>();
606606
}
607607
auto backing_store = result->second.lock();
608-
DCHECK_EQ(buffer_start, backing_store->buffer_start());
609-
DCHECK_EQ(length, backing_store->byte_length());
608+
CHECK_EQ(buffer_start, backing_store->buffer_start());
609+
if (backing_store->is_wasm_memory()) {
610+
// Grow calls to shared WebAssembly threads can be triggered from different
611+
// workers, length equality cannot be guaranteed here.
612+
CHECK_LE(length, backing_store->byte_length());
613+
} else {
614+
CHECK_EQ(length, backing_store->byte_length());
615+
}
610616
return backing_store;
611617
}
612618

‎deps/v8/src/objects/fixed-array.h‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -338,6 +338,12 @@ class WeakArrayList : public HeapObject {
338338
Isolate* isolate, Handle<WeakArrayList> array,
339339
const MaybeObjectHandle& value);
340340

341+
// A version that adds to elements. This ensures that the elements are
342+
// inserted atomically w.r.t GC.
343+
V8_EXPORT_PRIVATE static Handle<WeakArrayList> AddToEnd(
344+
Isolate* isolate, Handle<WeakArrayList> array,
345+
const MaybeObjectHandle& value1, const MaybeObjectHandle& value2);
346+
341347
inline MaybeObject Get(int index) const;
342348
inline MaybeObject Get(Isolate* isolate, int index) const;
343349

‎deps/v8/src/objects/objects.cc‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3951,6 +3951,20 @@ Handle<WeakArrayList> WeakArrayList::AddToEnd(Isolate* isolate,
39513951
return array;
39523952
}
39533953

3954+
Handle<WeakArrayList> WeakArrayList::AddToEnd(Isolate* isolate,
3955+
Handle<WeakArrayList> array,
3956+
const MaybeObjectHandle& value1,
3957+
const MaybeObjectHandle& value2) {
3958+
int length = array->length();
3959+
array = EnsureSpace(isolate, array, length + 2);
3960+
// Reload length; GC might have removed elements from the array.
3961+
length = array->length();
3962+
array->Set(length, *value1);
3963+
array->Set(length + 1, *value2);
3964+
array->set_length(length + 2);
3965+
return array;
3966+
}
3967+
39543968
bool WeakArrayList::IsFull() { return length() == capacity(); }
39553969

39563970
// static

‎deps/v8/src/wasm/wasm-objects.cc‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1375,7 +1375,12 @@ int32_t WasmMemoryObject::Grow(Isolate* isolate,
13751375
new_pages);
13761376
// Broadcasting the update should update this memory object too.
13771377
CHECK_NE(*old_buffer, memory_object->array_buffer());
1378-
CHECK_EQ(new_byte_length, memory_object->array_buffer().byte_length());
1378+
// This is a less than check, as it is not guaranteed that the SAB
1379+
// length here will be equal to the stashed length above as calls to
1380+
// grow the same memory object can come in from different workers.
1381+
// It is also possible that a call to Grow was in progress when
1382+
// handling this call.
1383+
CHECK_LE(new_byte_length, memory_object->array_buffer().byte_length());
13791384
return static_cast<int32_t>(old_pages); // success
13801385
}
13811386
}

‎deps/v8/test/mjsunit/mjsunit.status‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -930,6 +930,9 @@
930930
# Deadlocks on predictable platform (https://crbug.com/v8/9760).
931931
'wasm/async-compile': [SKIP],
932932
'wasm/streaming-compile': [SKIP],
933+
934+
# Race between postMessage and wasm memory.grow. (https://crbug.com/1010272).
935+
'regress/wasm/regress-1010272': [SKIP],
933936
}], # 'predictable == True'
934937

935938
##############################################################################

‎deps/v8/test/mjsunit/regress/regress-1016703.js‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
// Copyright 2019 the V8 project authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style license that can be
3+
// found in the LICENSE file.
4+
5+
// Flags: --expose-gc
6+
7+
let realms = [];
8+
for (let i = 0; i < 4; i++) {
9+
realms.push(Realm.createAllowCrossRealmAccess());
10+
}
11+
12+
for (let i = 0; i < 4; i++) {
13+
Realm.detachGlobal(realms[i]);
14+
gc();
15+
}

‎deps/v8/test/mjsunit/regress/wasm/regress-1010272.js‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
// Copyright 2019 the V8 project authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style license that can be
3+
// found in the LICENSE file.
4+
5+
// Flags: --wasm-grow-shared-memory --experimental-wasm-threads
6+
7+
const kNumWorkers = 100;
8+
const kNumMessages = 50;
9+
10+
function AllocMemory(initial, maximum = initial) {
11+
return new WebAssembly.Memory({initial : initial, maximum : maximum, shared : true});
12+
}
13+
14+
(function RunTest() {
15+
let worker = [];
16+
for (let w = 0; w < kNumWorkers; w++) {
17+
worker[w] = new Worker(
18+
`onmessage =
19+
function(msg) {
20+
msg.memory.grow(1);
21+
}`, {type : 'string'});
22+
}
23+
24+
for (let i = 0; i < kNumMessages; i++) {
25+
let memory = AllocMemory(1, 128);
26+
for (let w = 0; w < kNumWorkers; w++) {
27+
worker[w].postMessage({memory : memory});
28+
}
29+
}
30+
})();

0 commit comments

Comments
 (0)