diff options
| author | Myles Borins <mylesborins@google.com> | 2019-11-27 03:25:05 -0500 |
|---|---|---|
| committer | Anna Henningsen <anna@addaleax.net> | 2019-11-30 01:26:32 +0100 |
| commit | ea2668d2db76beda812631d73fbcd164aee5fe02 (patch) | |
| tree | 5e755edc6a93fedfb4638955d13ee02cb15816f0 /deps/v8/src/compiler | |
| parent | 08a40e20087ad0ba9ad5ee03a2c07a336b3cc5de (diff) | |
| download | node-new-ea2668d2db76beda812631d73fbcd164aee5fe02.tar.gz | |
deps: patch V8 to 7.9.317.25
Refs: https://github.com/v8/v8/compare/7.9.317.23...7.9.317.25
PR-URL: https://github.com/nodejs/node/pull/30679
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Diffstat (limited to 'deps/v8/src/compiler')
| -rw-r--r-- | deps/v8/src/compiler/heap-refs.h | 1 | ||||
| -rw-r--r-- | deps/v8/src/compiler/js-call-reducer.cc | 11 | ||||
| -rw-r--r-- | deps/v8/src/compiler/map-inference.cc | 7 | ||||
| -rw-r--r-- | deps/v8/src/compiler/map-inference.h | 1 |
4 files changed, 16 insertions, 4 deletions
diff --git a/deps/v8/src/compiler/heap-refs.h b/deps/v8/src/compiler/heap-refs.h index c6322ebe69..f08e49832e 100644 --- a/deps/v8/src/compiler/heap-refs.h +++ b/deps/v8/src/compiler/heap-refs.h @@ -389,6 +389,7 @@ class ContextRef : public HeapObjectRef { V(JSFunction, object_function) \ V(JSFunction, promise_function) \ V(JSFunction, promise_then) \ + V(JSFunction, regexp_function) \ V(JSFunction, string_function) \ V(JSFunction, symbol_function) \ V(JSGlobalObject, global_object) \ diff --git a/deps/v8/src/compiler/js-call-reducer.cc b/deps/v8/src/compiler/js-call-reducer.cc index d400fa2673..b86b1e6baf 100644 --- a/deps/v8/src/compiler/js-call-reducer.cc +++ b/deps/v8/src/compiler/js-call-reducer.cc @@ -7098,11 +7098,14 @@ Reduction JSCallReducer::ReduceRegExpPrototypeTest(Node* node) { Node* control = NodeProperties::GetControlInput(node); Node* regexp = NodeProperties::GetValueInput(node, 1); + // Only the initial JSRegExp map is valid here, since the following lastIndex + // check as well as the lowered builtin call rely on a known location of the + // lastIndex field. + Handle<Map> regexp_initial_map = + native_context().regexp_function().initial_map().object(); + MapInference inference(broker(), regexp, effect); - if (!inference.HaveMaps() || - !inference.AllOfInstanceTypes(InstanceTypeChecker::IsJSRegExp)) { - return inference.NoChange(); - } + if (!inference.Is(regexp_initial_map)) return inference.NoChange(); MapHandles const& regexp_maps = inference.GetMaps(); ZoneVector<PropertyAccessInfo> access_infos(graph()->zone()); diff --git a/deps/v8/src/compiler/map-inference.cc b/deps/v8/src/compiler/map-inference.cc index 1e2434f4ae..6ce036aa0b 100644 --- a/deps/v8/src/compiler/map-inference.cc +++ b/deps/v8/src/compiler/map-inference.cc @@ -91,6 +91,13 @@ MapHandles const& MapInference::GetMaps() { return maps_; } +bool MapInference::Is(Handle<Map> expected_map) { + if (!HaveMaps()) return false; + const MapHandles& maps = GetMaps(); + if (maps.size() != 1) return false; + return maps[0].equals(expected_map); +} + void MapInference::InsertMapChecks(JSGraph* jsgraph, Node** effect, Node* control, const FeedbackSource& feedback) { diff --git a/deps/v8/src/compiler/map-inference.h b/deps/v8/src/compiler/map-inference.h index acba2eb0f2..498b6bc15e 100644 --- a/deps/v8/src/compiler/map-inference.h +++ b/deps/v8/src/compiler/map-inference.h @@ -55,6 +55,7 @@ class MapInference { V8_WARN_UNUSED_RESULT MapHandles const& GetMaps(); V8_WARN_UNUSED_RESULT bool AllOfInstanceTypes( std::function<bool(InstanceType)> f); + V8_WARN_UNUSED_RESULT bool Is(Handle<Map> expected_map); // These methods provide a guard. // |