Skip to content

Commit e6125cd

Browse files
mmarchinicodebytere
mmarchini
authored and
codebytere
committed
deps: V8: backport f7771e5b0cc4
Original commit message: [runtime] Recompute enumeration indices of dictionaries upon bitfield overflow Otherwise we'll get weird semantics when enumerating objects after many deletes/reinserts. Bug: chromium:1033771 Change-Id: If0a459169c3794a30d9632d09e80da3cfcd4302c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1993966 Commit-Queue: Toon Verwaest <[email protected]> Reviewed-by: Jakob Kummerow <[email protected]> Reviewed-by: Victor Gomes <[email protected]> Cr-Commit-Position: refs/heads/master@{#65690} Refs: v8/v8@f7771e5 PR-URL: #31957 Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Jiawen Geng <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Myles Borins <[email protected]>
1 parent 8a2b62e commit e6125cd

File tree

8 files changed

+40
-39
lines changed

8 files changed

+40
-39
lines changed

‎common.gypi‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@
3939

4040
# Reset this number to 0 on major V8 upgrades.
4141
# Increment by one for each non-official patch applied to deps/v8.
42-
'v8_embedder_string': '-node.28',
42+
'v8_embedder_string': '-node.29',
4343

4444
##### V8 defaults for Node.js #####
4545

‎deps/v8/src/objects/dictionary-inl.h‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -61,13 +61,13 @@ BaseNameDictionary<Derived, Shape>::BaseNameDictionary(Address ptr)
6161
: Dictionary<Derived, Shape>(ptr) {}
6262

6363
template <typename Derived, typename Shape>
64-
void BaseNameDictionary<Derived, Shape>::SetNextEnumerationIndex(int index) {
65-
DCHECK_NE(0, index);
64+
void BaseNameDictionary<Derived, Shape>::set_next_enumeration_index(int index) {
65+
DCHECK_LT(0, index);
6666
this->set(kNextEnumerationIndexIndex, Smi::FromInt(index));
6767
}
6868

6969
template <typename Derived, typename Shape>
70-
int BaseNameDictionary<Derived, Shape>::NextEnumerationIndex() {
70+
int BaseNameDictionary<Derived, Shape>::next_enumeration_index() {
7171
return Smi::ToInt(this->get(kNextEnumerationIndexIndex));
7272
}
7373

‎deps/v8/src/objects/dictionary.h‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -120,10 +120,6 @@ class EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE) BaseNameDictionary
120120
static const int kObjectHashIndex = kNextEnumerationIndexIndex + 1;
121121
static const int kEntryValueIndex = 1;
122122

123-
// Accessors for next enumeration index.
124-
inline void SetNextEnumerationIndex(int index);
125-
inline int NextEnumerationIndex();
126-
127123
inline void SetHash(int hash);
128124
inline int Hash() const;
129125

@@ -138,6 +134,13 @@ class EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE) BaseNameDictionary
138134
V8_WARN_UNUSED_RESULT static ExceptionStatus CollectKeysTo(
139135
Handle<Derived> dictionary, KeyAccumulator* keys);
140136

137+
// Allocate the next enumeration index. Possibly updates all enumeration
138+
// indices in the table.
139+
static int NextEnumerationIndex(Isolate* isolate, Handle<Derived> dictionary);
140+
// Accessors for next enumeration index.
141+
inline int next_enumeration_index();
142+
inline void set_next_enumeration_index(int index);
143+
141144
// Return the key indices sorted by its enumeration index.
142145
static Handle<FixedArray> IterationIndices(Isolate* isolate,
143146
Handle<Derived> dictionary);
@@ -149,10 +152,6 @@ class EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE) BaseNameDictionary
149152
Handle<FixedArray> storage, KeyCollectionMode mode,
150153
KeyAccumulator* accumulator);
151154

152-
// Ensure enough space for n additional elements.
153-
static Handle<Derived> EnsureCapacity(Isolate* isolate,
154-
Handle<Derived> dictionary, int n);
155-
156155
V8_WARN_UNUSED_RESULT static Handle<Derived> AddNoUpdateNextEnumerationIndex(
157156
Isolate* isolate, Handle<Derived> dictionary, Key key,
158157
Handle<Object> value, PropertyDetails details, int* entry_out = nullptr);

‎deps/v8/src/objects/hash-table.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -201,7 +201,7 @@ class EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE) HashTable
201201

202202
// Ensure enough space for n additional elements.
203203
V8_WARN_UNUSED_RESULT static Handle<Derived> EnsureCapacity(
204-
Isolate* isolate, Handle<Derived> table, int n,
204+
Isolate* isolate, Handle<Derived> table, int n = 1,
205205
AllocationType allocation = AllocationType::kYoung);
206206

207207
// Returns true if this table has sufficient capacity for adding n elements.

‎deps/v8/src/objects/js-objects.cc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2908,7 +2908,7 @@ void MigrateFastToSlow(Isolate* isolate, Handle<JSObject> object,
29082908
}
29092909

29102910
// Copy the next enumeration index from instance descriptor.
2911-
dictionary->SetNextEnumerationIndex(real_size + 1);
2911+
dictionary->set_next_enumeration_index(real_size + 1);
29122912

29132913
// From here on we cannot fail and we shouldn't GC anymore.
29142914
DisallowHeapAllocation no_allocation;

‎deps/v8/src/objects/literal-objects.cc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -363,7 +363,7 @@ class ObjectDescriptor {
363363

364364
void Finalize(Isolate* isolate) {
365365
if (HasDictionaryProperties()) {
366-
properties_dictionary_template_->SetNextEnumerationIndex(
366+
properties_dictionary_template_->set_next_enumeration_index(
367367
next_enumeration_index_);
368368
computed_properties_ = FixedArray::ShrinkOrEmpty(
369369
isolate, computed_properties_, current_computed_index_);

‎deps/v8/src/objects/lookup.cc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -634,8 +634,8 @@ void LookupIterator::PrepareTransitionToDataProperty(
634634
transition_ = cell;
635635
// Assign an enumeration index to the property and update
636636
// SetNextEnumerationIndex.
637-
int index = dictionary->NextEnumerationIndex();
638-
dictionary->SetNextEnumerationIndex(index + 1);
637+
int index = GlobalDictionary::NextEnumerationIndex(isolate_, dictionary);
638+
dictionary->set_next_enumeration_index(index + 1);
639639
property_details_ = PropertyDetails(
640640
kData, attributes, PropertyCellType::kUninitialized, index);
641641
PropertyCellType new_type =

‎deps/v8/src/objects/objects.cc‎

Lines changed: 24 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -6677,7 +6677,7 @@ void StringTable::EnsureCapacityForDeserialization(Isolate* isolate,
66776677
int expected) {
66786678
Handle<StringTable> table = isolate->factory()->string_table();
66796679
// We need a key instance for the virtual hash function.
6680-
table = StringTable::EnsureCapacity(isolate, table, expected);
6680+
table = EnsureCapacity(isolate, table, expected);
66816681
isolate->heap()->SetRootStringTable(*table);
66826682
}
66836683

@@ -6729,7 +6729,7 @@ Handle<String> StringTable::LookupKey(Isolate* isolate, StringTableKey* key) {
67296729

67306730
table = StringTable::CautiousShrink(isolate, table);
67316731
// Adding new string. Grow table if needed.
6732-
table = StringTable::EnsureCapacity(isolate, table, 1);
6732+
table = EnsureCapacity(isolate, table);
67336733
isolate->heap()->SetRootStringTable(*table);
67346734

67356735
return AddKeyNoResize(isolate, key);
@@ -6870,7 +6870,7 @@ Handle<StringSet> StringSet::New(Isolate* isolate) {
68706870
Handle<StringSet> StringSet::Add(Isolate* isolate, Handle<StringSet> stringset,
68716871
Handle<String> name) {
68726872
if (!stringset->Has(isolate, name)) {
6873-
stringset = EnsureCapacity(isolate, stringset, 1);
6873+
stringset = EnsureCapacity(isolate, stringset);
68746874
uint32_t hash = ShapeT::Hash(isolate, *name);
68756875
int entry = stringset->FindInsertionEntry(hash);
68766876
stringset->set(EntryToIndex(entry), *name);
@@ -6888,7 +6888,7 @@ Handle<ObjectHashSet> ObjectHashSet::Add(Isolate* isolate,
68886888
Handle<Object> key) {
68896889
int32_t hash = key->GetOrCreateHash(isolate).value();
68906890
if (!set->Has(isolate, key, hash)) {
6891-
set = EnsureCapacity(isolate, set, 1);
6891+
set = EnsureCapacity(isolate, set);
68926892
int entry = set->FindInsertionEntry(hash);
68936893
set->set(EntryToIndex(entry), *key);
68946894
set->ElementAdded();
@@ -7084,7 +7084,7 @@ Handle<CompilationCacheTable> CompilationCacheTable::PutScript(
70847084
src = String::Flatten(isolate, src);
70857085
StringSharedKey key(src, shared, language_mode, kNoSourcePosition);
70867086
Handle<Object> k = key.AsHandle(isolate);
7087-
cache = EnsureCapacity(isolate, cache, 1);
7087+
cache = EnsureCapacity(isolate, cache);
70887088
int entry = cache->FindInsertionEntry(key.Hash());
70897089
cache->set(EntryToIndex(entry), *k);
70907090
cache->set(EntryToIndex(entry) + 1, *value);
@@ -7116,7 +7116,7 @@ Handle<CompilationCacheTable> CompilationCacheTable::PutEval(
71167116
}
71177117
}
71187118

7119-
cache = EnsureCapacity(isolate, cache, 1);
7119+
cache = EnsureCapacity(isolate, cache);
71207120
int entry = cache->FindInsertionEntry(key.Hash());
71217121
Handle<Object> k =
71227122
isolate->factory()->NewNumber(static_cast<double>(key.Hash()));
@@ -7130,7 +7130,7 @@ Handle<CompilationCacheTable> CompilationCacheTable::PutRegExp(
71307130
Isolate* isolate, Handle<CompilationCacheTable> cache, Handle<String> src,
71317131
JSRegExp::Flags flags, Handle<FixedArray> value) {
71327132
RegExpKey key(src, flags);
7133-
cache = EnsureCapacity(isolate, cache, 1);
7133+
cache = EnsureCapacity(isolate, cache);
71347134
int entry = cache->FindInsertionEntry(key.Hash());
71357135
// We store the value in the key slot, and compare the search key
71367136
// to the stored value with a custon IsMatch function during lookups.
@@ -7192,15 +7192,16 @@ Handle<Derived> BaseNameDictionary<Derived, Shape>::New(
71927192
Handle<Derived> dict = Dictionary<Derived, Shape>::New(
71937193
isolate, at_least_space_for, allocation, capacity_option);
71947194
dict->SetHash(PropertyArray::kNoHashSentinel);
7195-
dict->SetNextEnumerationIndex(PropertyDetails::kInitialIndex);
7195+
dict->set_next_enumeration_index(PropertyDetails::kInitialIndex);
71967196
return dict;
71977197
}
71987198

71997199
template <typename Derived, typename Shape>
7200-
Handle<Derived> BaseNameDictionary<Derived, Shape>::EnsureCapacity(
7201-
Isolate* isolate, Handle<Derived> dictionary, int n) {
7202-
// Check whether there are enough enumeration indices to add n elements.
7203-
if (!PropertyDetails::IsValidIndex(dictionary->NextEnumerationIndex() + n)) {
7200+
int BaseNameDictionary<Derived, Shape>::NextEnumerationIndex(
7201+
Isolate* isolate, Handle<Derived> dictionary) {
7202+
int index = dictionary->next_enumeration_index();
7203+
// Check whether the next enumeration index is valid.
7204+
if (!PropertyDetails::IsValidIndex(index)) {
72047205
// If not, we generate new indices for the properties.
72057206
int length = dictionary->NumberOfElements();
72067207

@@ -7221,11 +7222,12 @@ Handle<Derived> BaseNameDictionary<Derived, Shape>::EnsureCapacity(
72217222
dictionary->DetailsAtPut(isolate, index, new_details);
72227223
}
72237224

7224-
// Set the next enumeration index.
7225-
dictionary->SetNextEnumerationIndex(PropertyDetails::kInitialIndex +
7226-
length);
7225+
index = PropertyDetails::kInitialIndex + length;
72277226
}
7228-
return HashTable<Derived, Shape>::EnsureCapacity(isolate, dictionary, n);
7227+
7228+
// Don't update the next enumeration index here, since we might be looking at
7229+
// an immutable empty dictionary.
7230+
return index;
72297231
}
72307232

72317233
template <typename Derived, typename Shape>
@@ -7274,13 +7276,13 @@ Handle<Derived> BaseNameDictionary<Derived, Shape>::Add(
72747276
DCHECK_EQ(0, details.dictionary_index());
72757277
// Assign an enumeration index to the property and update
72767278
// SetNextEnumerationIndex.
7277-
int index = dictionary->NextEnumerationIndex();
7279+
int index = Derived::NextEnumerationIndex(isolate, dictionary);
72787280
details = details.set_index(index);
72797281
dictionary = AddNoUpdateNextEnumerationIndex(isolate, dictionary, key, value,
72807282
details, entry_out);
72817283
// Update enumeration index here in order to avoid potential modification of
72827284
// the canonical empty dictionary which lives in read only space.
7283-
dictionary->SetNextEnumerationIndex(index + 1);
7285+
dictionary->set_next_enumeration_index(index + 1);
72847286
return dictionary;
72857287
}
72867288

@@ -7294,7 +7296,7 @@ Handle<Derived> Dictionary<Derived, Shape>::Add(Isolate* isolate,
72947296
// Valdate key is absent.
72957297
SLOW_DCHECK((dictionary->FindEntry(isolate, key) == Dictionary::kNotFound));
72967298
// Check whether the dictionary should be extended.
7297-
dictionary = Derived::EnsureCapacity(isolate, dictionary, 1);
7299+
dictionary = Derived::EnsureCapacity(isolate, dictionary);
72987300

72997301
// Compute the key object.
73007302
Handle<Object> k = Shape::AsHandle(isolate, key);
@@ -7644,7 +7646,7 @@ Handle<Derived> ObjectHashTableBase<Derived, Shape>::Put(Isolate* isolate,
76447646
}
76457647

76467648
// Check whether the hash table should be extended.
7647-
table = Derived::EnsureCapacity(isolate, table, 1);
7649+
table = Derived::EnsureCapacity(isolate, table);
76487650
table->AddEntry(table->FindInsertionEntry(hash), *key, *value);
76497651
return table;
76507652
}
@@ -7892,8 +7894,8 @@ Handle<PropertyCell> PropertyCell::PrepareForValue(
78927894
// Preserve the enumeration index unless the property was deleted or never
78937895
// initialized.
78947896
if (cell->value().IsTheHole(isolate)) {
7895-
index = dictionary->NextEnumerationIndex();
7896-
dictionary->SetNextEnumerationIndex(index + 1);
7897+
index = GlobalDictionary::NextEnumerationIndex(isolate, dictionary);
7898+
dictionary->set_next_enumeration_index(index + 1);
78977899
} else {
78987900
index = original_details.dictionary_index();
78997901
}

0 commit comments

Comments
 (0)