From d6ae50ff9610921239c35f5d26198325f8854dde Mon Sep 17 00:00:00 2001
From: Ray Wang <ray@isrc.iscas.ac.cn>
Date: Fri, 19 Nov 2021 21:14:47 +0800
Subject: [PATCH] deps: V8: cherry-pick 7ae0b77628f6
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Original commit message:

    [interpreter] Stop jump-table optimizing switch stms when spread overflows

    Bug: v8:12389
    Change-Id: I53c728ab0c8ba38c7dd96c7e1089f771ba44b9f0
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3289227
    Reviewed-by: Leszek Swirski <leszeks@chromium.org>
    Commit-Queue: Leszek Swirski <leszeks@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#77995}

Refs: https://github.com/v8/v8/commit/7ae0b77628f6b7ef5b38658bec82fd57115dfaf3

PR-URL: https://github.com/nodejs/node/pull/40882
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 common.gypi                                   |  2 +-
 deps/v8/src/interpreter/bytecode-generator.cc | 33 ++++++++++++-------
 2 files changed, 23 insertions(+), 12 deletions(-)

diff --git a/common.gypi b/common.gypi
index 1e5919afbe8c5e..23f55440c7e76a 100644
--- a/common.gypi
+++ b/common.gypi
@@ -36,7 +36,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.10',
+    'v8_embedder_string': '-node.11',
 
     ##### V8 defaults for Node.js #####
 
diff --git a/deps/v8/src/interpreter/bytecode-generator.cc b/deps/v8/src/interpreter/bytecode-generator.cc
index f82a71202c06df..ff5d342f3d1679 100644
--- a/deps/v8/src/interpreter/bytecode-generator.cc
+++ b/deps/v8/src/interpreter/bytecode-generator.cc
@@ -1889,17 +1889,28 @@ bool IsSwitchOptimizable(SwitchStatement* stmt, SwitchInfo* info) {
   }
 
   // GCC also jump-table optimizes switch statements with 6 cases or more.
-  if (!(static_cast<int>(info->covered_cases.size()) >=
-            FLAG_switch_table_min_cases &&
-        IsSpreadAcceptable(info->MaxCase() - info->MinCase(),
-                           cases->length()))) {
-    // Invariant- covered_cases has all cases and only cases that will go in the
-    // jump table.
-    info->covered_cases.clear();
-    return false;
-  } else {
-    return true;
-  }
+  if (static_cast<int>(info->covered_cases.size()) >=
+      FLAG_switch_table_min_cases) {
+    // Due to case spread will be used as the size of jump-table,
+    // we need to check if it doesn't overflow by casting its
+    // min and max bounds to int64_t, and calculate if the difference is less
+    // than or equal to INT_MAX.
+    int64_t min = static_cast<int64_t>(info->MinCase());
+    int64_t max = static_cast<int64_t>(info->MaxCase());
+    int64_t spread = max - min + 1;
+
+    DCHECK_GT(spread, 0);
+
+    // Check if casted spread is acceptable and doesn't overflow.
+    if (spread <= INT_MAX &&
+        IsSpreadAcceptable(static_cast<int>(spread), cases->length())) {
+      return true;
+    }
+  }
+  // Invariant- covered_cases has all cases and only cases that will go in the
+  // jump table.
+  info->covered_cases.clear();
+  return false;
 }
 
 }  // namespace