diff --git a/deps/v8/include/v8-version.h b/deps/v8/include/v8-version.h index 8c333c3e1ce79d..adac5911c86284 100644 --- a/deps/v8/include/v8-version.h +++ b/deps/v8/include/v8-version.h @@ -11,7 +11,7 @@ #define V8_MAJOR_VERSION 7 #define V8_MINOR_VERSION 7 #define V8_BUILD_NUMBER 299 -#define V8_PATCH_LEVEL 8 +#define V8_PATCH_LEVEL 10 // Use 1 for candidates and 0 otherwise. // (Boolean macro values are not supported by all preprocessors.) diff --git a/deps/v8/src/builtins/base.tq b/deps/v8/src/builtins/base.tq index 4aa1d578374898..07af1f441f8060 100644 --- a/deps/v8/src/builtins/base.tq +++ b/deps/v8/src/builtins/base.tq @@ -336,10 +336,16 @@ macro NewJSObject(implicit context: Context)(): JSObject { }; } +extern macro HasPrototypeSlot(JSFunction): bool; + macro GetDerivedMap(implicit context: Context)( target: JSFunction, newTarget: JSReceiver): Map { try { const constructor = Cast(newTarget) otherwise SlowPath; + if (!HasPrototypeSlot(constructor)) { + goto SlowPath; + } + assert(IsConstructor(constructor)); const map = Cast(constructor.prototype_or_initial_map) otherwise SlowPath; if (LoadConstructorOrBackPointer(map) != target) { diff --git a/deps/v8/src/codegen/code-stub-assembler.cc b/deps/v8/src/codegen/code-stub-assembler.cc index 390746c27dcd8f..e4f35ddcc88472 100644 --- a/deps/v8/src/codegen/code-stub-assembler.cc +++ b/deps/v8/src/codegen/code-stub-assembler.cc @@ -2622,6 +2622,11 @@ TNode CodeStubAssembler::IsGeneratorFunction( Int32Constant(FunctionKind::kConciseGeneratorMethod)))); } +TNode CodeStubAssembler::HasPrototypeSlot(TNode function) { + return TNode::UncheckedCast(IsSetWord32( + LoadMapBitField(LoadMap(function)))); +} + TNode CodeStubAssembler::HasPrototypeProperty(TNode function, TNode map) { // (has_prototype_slot() && IsConstructor()) || diff --git a/deps/v8/src/codegen/code-stub-assembler.h b/deps/v8/src/codegen/code-stub-assembler.h index 00a84c39265650..47abd027490679 100644 --- a/deps/v8/src/codegen/code-stub-assembler.h +++ b/deps/v8/src/codegen/code-stub-assembler.h @@ -1272,6 +1272,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler TNode LoadJSArrayElementsMap(SloppyTNode kind, SloppyTNode native_context); + TNode HasPrototypeSlot(TNode function); TNode IsGeneratorFunction(TNode function); TNode HasPrototypeProperty(TNode function, TNode map); void GotoIfPrototypeRequiresRuntimeLookup(TNode function, diff --git a/deps/v8/src/compiler/js-native-context-specialization.cc b/deps/v8/src/compiler/js-native-context-specialization.cc index 7d742a5f326f10..8f7552baa18458 100644 --- a/deps/v8/src/compiler/js-native-context-specialization.cc +++ b/deps/v8/src/compiler/js-native-context-specialization.cc @@ -1060,7 +1060,8 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess( Node* control = NodeProperties::GetControlInput(node); ZoneVector access_infos(zone()); - AccessInfoFactory access_info_factory(broker(), dependencies(), zone()); + AccessInfoFactory access_info_factory(broker(), dependencies(), + graph()->zone()); if (!access_info_factory.FinalizePropertyAccessInfos( feedback.access_infos(), access_mode, &access_infos)) { return NoChange(); @@ -1765,7 +1766,7 @@ Reduction JSNativeContextSpecialization::ReducePropertyAccess( if (name.has_value()) { ZoneVector access_infos(zone()); AccessInfoFactory access_info_factory(broker(), dependencies(), - zone()); + graph()->zone()); access_info_factory.ComputePropertyAccessInfos( receiver_maps, name->object(), access_mode, &access_infos); processed = new (zone()) NamedAccessFeedback(*name, access_infos); diff --git a/deps/v8/src/regexp/regexp-compiler.cc b/deps/v8/src/regexp/regexp-compiler.cc index c643f988c0f66b..c70bbc3e4a56d3 100644 --- a/deps/v8/src/regexp/regexp-compiler.cc +++ b/deps/v8/src/regexp/regexp-compiler.cc @@ -1970,9 +1970,11 @@ void ChoiceNode::GetQuickCheckDetails(QuickCheckDetails* details, } } +namespace { + // Check for [0-9A-Z_a-z]. -static void EmitWordCheck(RegExpMacroAssembler* assembler, Label* word, - Label* non_word, bool fall_through_on_word) { +void EmitWordCheck(RegExpMacroAssembler* assembler, Label* word, + Label* non_word, bool fall_through_on_word) { if (assembler->CheckSpecialCharacterClass( fall_through_on_word ? 'w' : 'W', fall_through_on_word ? non_word : word)) { @@ -1994,24 +1996,37 @@ static void EmitWordCheck(RegExpMacroAssembler* assembler, Label* word, // Emit the code to check for a ^ in multiline mode (1-character lookbehind // that matches newline or the start of input). -static void EmitHat(RegExpCompiler* compiler, RegExpNode* on_success, - Trace* trace) { +void EmitHat(RegExpCompiler* compiler, RegExpNode* on_success, Trace* trace) { RegExpMacroAssembler* assembler = compiler->macro_assembler(); - // We will be loading the previous character into the current character - // register. + + // We will load the previous character into the current character register. Trace new_trace(*trace); new_trace.InvalidateCurrentCharacter(); + // A positive (> 0) cp_offset means we've already successfully matched a + // non-empty-width part of the pattern, and thus cannot be at or before the + // start of the subject string. We can thus skip both at-start and + // bounds-checks when loading the one-character lookbehind. + const bool may_be_at_or_before_subject_string_start = + new_trace.cp_offset() <= 0; + Label ok; - if (new_trace.cp_offset() == 0) { - // The start of input counts as a newline in this context, so skip to - // ok if we are at the start. - assembler->CheckAtStart(&ok); + if (may_be_at_or_before_subject_string_start) { + // The start of input counts as a newline in this context, so skip to ok if + // we are at the start. + // TODO(jgruber): It would be less awkward to use CheckAtStart here, but + // that currently does not support a non-zero cp_offset. + Label not_at_start; + assembler->CheckNotAtStart(new_trace.cp_offset(), ¬_at_start); + assembler->GoTo(&ok); + assembler->Bind(¬_at_start); } - // We already checked that we are not at the start of input so it must be - // OK to load the previous character. + + // If we've already checked that we are not at the start of input, it's okay + // to load the previous character without bounds checks. + const bool can_skip_bounds_check = !may_be_at_or_before_subject_string_start; assembler->LoadCurrentCharacter(new_trace.cp_offset() - 1, - new_trace.backtrack(), false); + new_trace.backtrack(), can_skip_bounds_check); if (!assembler->CheckSpecialCharacterClass('n', new_trace.backtrack())) { // Newline means \n, \r, 0x2028 or 0x2029. if (!compiler->one_byte()) { @@ -2024,6 +2039,8 @@ static void EmitHat(RegExpCompiler* compiler, RegExpNode* on_success, on_success->Emit(compiler, &new_trace); } +} // namespace + // Emit the code to handle \b and \B (word-boundary or non-word-boundary). void AssertionNode::EmitBoundaryCheck(RegExpCompiler* compiler, Trace* trace) { RegExpMacroAssembler* assembler = compiler->macro_assembler(); @@ -2080,21 +2097,35 @@ void AssertionNode::BacktrackIfPrevious( Trace new_trace(*trace); new_trace.InvalidateCurrentCharacter(); - Label fall_through, dummy; - + Label fall_through; Label* non_word = backtrack_if_previous == kIsNonWord ? new_trace.backtrack() : &fall_through; Label* word = backtrack_if_previous == kIsNonWord ? &fall_through : new_trace.backtrack(); - if (new_trace.cp_offset() == 0) { + // A positive (> 0) cp_offset means we've already successfully matched a + // non-empty-width part of the pattern, and thus cannot be at or before the + // start of the subject string. We can thus skip both at-start and + // bounds-checks when loading the one-character lookbehind. + const bool may_be_at_or_before_subject_string_start = + new_trace.cp_offset() <= 0; + + if (may_be_at_or_before_subject_string_start) { // The start of input counts as a non-word character, so the question is // decided if we are at the start. - assembler->CheckAtStart(non_word); - } - // We already checked that we are not at the start of input so it must be - // OK to load the previous character. - assembler->LoadCurrentCharacter(new_trace.cp_offset() - 1, &dummy, false); + // TODO(jgruber): It would be less awkward to use CheckAtStart here, but + // that currently does not support a non-zero cp_offset. + Label not_at_start; + assembler->CheckNotAtStart(new_trace.cp_offset(), ¬_at_start); + assembler->GoTo(non_word); + assembler->Bind(¬_at_start); + } + + // If we've already checked that we are not at the start of input, it's okay + // to load the previous character without bounds checks. + const bool can_skip_bounds_check = !may_be_at_or_before_subject_string_start; + assembler->LoadCurrentCharacter(new_trace.cp_offset() - 1, non_word, + can_skip_bounds_check); EmitWordCheck(assembler, word, non_word, backtrack_if_previous == kIsNonWord); assembler->Bind(&fall_through); diff --git a/deps/v8/test/mjsunit/regress/regress-996391.js b/deps/v8/test/mjsunit/regress/regress-996391.js new file mode 100644 index 00000000000000..2c0b76be8a0c6a --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-996391.js @@ -0,0 +1,9 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax --regexp-interpret-all + +assertArrayEquals(["o"], /.(?