Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix V8 5.4 for Node #1

Closed
targos opened this issue Aug 19, 2016 · 38 comments
Closed

Fix V8 5.4 for Node #1

targos opened this issue Aug 19, 2016 · 38 comments

Comments

@targos
Copy link
Owner

targos commented Aug 19, 2016

I don't want to pollute the node issue tracker that soon, so I'm opening a ticket here to track the issues that need to be solved on V8's side.

Here is a fresh CI run of targos/v8-5.4 as reference: https://ci.nodejs.org/job/node-test-commit/4668/

1. Compilation issue on BSD

Already fixed on my branch
See https://codereview.chromium.org/2251603004/

2. Compilation issue on SmartOS

See https://ci.nodejs.org/job/node-test-commit-smartos/3808/nodes=smartos14-32/console
I think it's due to the recent https://codereview.chromium.org/2248393002

3. Windows issue with mkpeephole

See https://ci.nodejs.org/job/node-compile-windows/3798/label=win-vcbt2015/console
@ofrobots: do you have any news about this?

4. FreeBSD issue with test-tick-processor

The process is probably crashing before the skip, at https://github.com/nodejs/node/blob/8ff3d61d8ba90fde01827643db3d87ee97f502e6/test/parallel/test-tick-processor.js#L21-L29
I don't understand what this test is doing so help would be much appreciated here.

Fixed with https://codereview.chromium.org/2268993002

Edit: new CI: https://ci.nodejs.org/job/node-test-commit/4686/

@matthewloring
Copy link

matthewloring commented Aug 19, 2016

cc @nodejs/v8

edit: Hmmm, looks like you cannot cc a team from the parent repository?

@targos
Copy link
Owner Author

targos commented Aug 19, 2016

cc @fhinkel and @bnoordhuis in case you're interested

@bnoordhuis
Copy link

bnoordhuis commented Aug 19, 2016

It's possible you need to add 'want_separate_host_toolset_mkpeephole%': 0 in common.gypi like we do for want_separate_host_toolset.

cc @misterdjules for the smartos build error.

@bnoordhuis
Copy link

bnoordhuis commented Aug 19, 2016

  1. FreeBSD issue with test-tick-processor

From looking at the stack trace, I suspect that the fix is this:

diff --git a/src/base/platform/semaphore.cc b/src/base/platform/semaphore.cc
index f6a518c..3713153 100644
--- a/src/base/platform/semaphore.cc
+++ b/src/base/platform/semaphore.cc
@@ -72,18 +72,18 @@ bool Semaphore::WaitFor(const TimeDelta& rel_time) {

 #elif V8_OS_POSIX

 Semaphore::Semaphore(int count) {
   // The sem_init() does not check for alignment of the native handle.
   // Unaligned native handle can later cause a failure in semaphore signal.
   // Check the alignment here to catch the failure earlier.
   // Context: crbug.com/605349.
-#if V8_OS_AIX
-  // On aix sem_t is of type int
+#if V8_OS_AIX || V8_OS_FREEBSD
+  // On AIX, sem_t is of type int. On FreeBSD, it's a struct of 32 bits fields.
   const uintptr_t kSemaphoreAlignmentMask = sizeof(int) - 1;
 #else
   const uintptr_t kSemaphoreAlignmentMask = sizeof(void*) - 1;
 #endif
   CHECK_EQ(
       0, reinterpret_cast<uintptr_t>(&native_handle_) &
       kSemaphoreAlignmentMask);
   DCHECK(count >= 0);

On freebsd, sem_t is a struct with a couple of uint32_t fields. It only needs dword alignment on 64 bits architectures, not the qword (pointer) alignment that the CHECK currently enforces.

@misterdjules
Copy link

Will look at this asap.

@matthewloring
Copy link

Based on @bnoordhuis' comment, it doesn't look like the tick processor failure is an issue in the code that the tick processor is testing but I'm happy to help out with any questions/work related to the test.

@misterdjules
Copy link

@targos

The following patch fixes the build issue on SmartOS:

diff --git a/deps/v8/src/base/debug/stack_trace_posix.cc b/deps/v8/src/base/debug/stack_trace_posix.cc
index cbd722d..45d1e8f 100644
--- a/deps/v8/src/base/debug/stack_trace_posix.cc
+++ b/deps/v8/src/base/debug/stack_trace_posix.cc
@@ -32,7 +32,9 @@
 #if V8_OS_MACOSX
 #include <AvailabilityMacros.h>
 #endif
-
+#if V8_OS_SOLARIS
+#include <execinfo.h>
+#endif
 #include "src/base/build_config.h"
 #include "src/base/free_deleter.h"
 #include "src/base/logging.h"

@ofrobots
Copy link

@targos sorry for the late reply, I was on vacation. From the new CI, it seems like that the common.gypi suggestion from @bnoordhuis didn't help. I will take a look at this today.

@targos
Copy link
Owner Author

targos commented Aug 23, 2016

@misterdjules thanks !

cc @mhart for the similar issue with https://ci.nodejs.org/job/node-test-commit-linux/4734/nodes=ubuntu1604_docker_alpine34-64/console
Do you know if there is a V8 macro applicable to this platform ?

@ofrobots
Copy link

@targos: I have submitted this CL for the mkpeephole issue on windows: https://codereview.chromium.org/2276733002.

@targos
Copy link
Owner Author

targos commented Aug 24, 2016

@ofrobots your fix seems to break the build on my local machine (Linux).

Running ./configure:

$ ./configure    
creating  ./icu_config.gypi
* Using ICU in deps/icu-small
creating  ./icu_config.gypi
{ 'target_defaults': { 'cflags': [],
                       'default_configuration': 'Release',
                       'defines': [],
                       'include_dirs': [],
                       'libraries': []},
  'variables': { 'asan': 0,
                 'debug_devtools': 'node',
                 'force_dynamic_crt': 0,
                 'gas_version': '2.26',
                 'host_arch': 'x64',
                 'icu_data_file': 'icudt57l.dat',
                 'icu_data_in': '../../deps/icu-small/source/data/in/icudt57l.dat',
                 'icu_endianness': 'l',
                 'icu_gyp_path': 'tools/icu/icu-generic.gyp',
                 'icu_locales': 'en,root',
                 'icu_path': 'deps/icu-small',
                 'icu_small': 'true',
                 'icu_ver_major': '57',
                 'node_byteorder': 'little',
                 'node_enable_d8': 'false',
                 'node_enable_v8_vtunejit': 'false',
                 'node_install_npm': 'true',
                 'node_module_version': 48,
                 'node_no_browser_globals': 'false',
                 'node_prefix': '/usr/local',
                 'node_release_urlbase': '',
                 'node_shared': 'false',
                 'node_shared_cares': 'false',
                 'node_shared_http_parser': 'false',
                 'node_shared_libuv': 'false',
                 'node_shared_openssl': 'false',
                 'node_shared_zlib': 'false',
                 'node_tag': '',
                 'node_use_bundled_v8': 'true',
                 'node_use_dtrace': 'false',
                 'node_use_etw': 'false',
                 'node_use_lttng': 'false',
                 'node_use_openssl': 'true',
                 'node_use_perfctr': 'false',
                 'node_use_v8_platform': 'true',
                 'openssl_fips': '',
                 'openssl_no_asm': 0,
                 'shlib_suffix': 'so.48',
                 'target_arch': 'x64',
                 'uv_parent_path': '/deps/uv/',
                 'uv_use_dtrace': 'false',
                 'v8_enable_gdbjit': 0,
                 'v8_enable_i18n_support': 1,
                 'v8_inspector': 'true',
                 'v8_no_strict_aliasing': 1,
                 'v8_optimized_debug': 0,
                 'v8_random_seed': 0,
                 'v8_use_snapshot': 'true',
                 'want_separate_host_toolset': 0}}
creating  ./config.gypi
creating  ./config.mk
gyp: Dependency '/home/mzasso/git/forks/node/deps/v8/src/v8.gyp:v8_libsampler#host' not found while trying to load target /home/mzasso/git/forks/node/deps/v8/src/v8.gyp:v8_base#host
Error running GYP

@ofrobots
Copy link

@targos: You still need want_separate_host_toolset_mkpeephole%': 0 in common.gypi as @bnoordhuis suggested above.

@targos
Copy link
Owner Author

targos commented Aug 24, 2016

@ofrobots I'm still seeing this error with 'want_separate_host_toolset_mkpeephole%': 0;

@ofrobots
Copy link

@targo: It seems that the variable definition in common.gypi is having no effect. Here's how I "fixed" it: ofrobots@b4ad793 on my branch. Today was my day off so I didn't have too much time to look into why common.gypi is not having an effect.

@targos
Copy link
Owner Author

targos commented Aug 25, 2016

OK thanks!

New CI: https://ci.nodejs.org/job/node-test-commit/4759/

@targos
Copy link
Owner Author

targos commented Aug 25, 2016

cc @ncopa for the Alpine issue

@targos
Copy link
Owner Author

targos commented Aug 26, 2016

cc @Starefossen / @jbergstroem

@jbergstroem
Copy link

Regarding alpine34; execinfo isn't provided by musl. Not sure what the correct path is here, but I recall seeing libunwind being available in the alpine ecosystem. Do we want a macro for that or should we find a simpler way?

@jbergstroem
Copy link

I guess the other option could be not making the assumption that linux equals glibc when checking defines, but if this is the only case it might be overkill.

@ncopa
Copy link

ncopa commented Aug 26, 2016

execinfo isn't provided by musl.

Correct, excinfo.h, backtrace and those are GNU extensions.

I guess the other option could be not making the assumption that linux equals glibc when checking defines

I think this would be the technically correct thing to do.

@targos
Copy link
Owner Author

targos commented Aug 29, 2016

@ofrobots it seems that the 5.4 branch does not include your fix from https://codereview.chromium.org/2276733002

@targos
Copy link
Owner Author

targos commented Aug 29, 2016

I guess the other option could be not making the assumption that linux equals glibc when checking defines

I think this would be the technically correct thing to do.

Should we escalate this issue to the V8 team or does anyone have a concrete way to fix it that we can submit to them ?

@jbergstroem
Copy link

@targos would v8 treat usage of backtrace_symbols/execinfo.h as required?

@targos
Copy link
Owner Author

targos commented Aug 29, 2016

@jbergstroem I don't know that, but I think not. I've been investigating a bit and here is what I found:

  • The code in stack_trace_posix.cc comes initially from Chromium. There are a lot of checks there about the presence of execinfo.h.
  • Alpine Linux has a floating patch on top of Chromium to make it work with musl.

I'm trying a fix here: nodejs@5cca3d2

@jbergstroem
Copy link

@targos good news. A patch similar to the one Alpine has should be good to go then. I'll start a new CI for alpine34.

@jbergstroem
Copy link

@jbergstroem
Copy link

@targos:

/home/iojs/build/workspace/node-test-commit-jbergstroem-alpine34/nodes/alpine34-x64/out/Release/obj.target/v8_libbase/deps/v8/src/base/debug/stack_trace.o: In function `v8::base::debug::StackTrace::ToString[abi:cxx11]() const':
stack_trace.cc:(.text._ZNK2v84base5debug10StackTrace8ToStringB5cxx11Ev+0x20e): undefined reference to `v8::base::debug::StackTrace::OutputToStream(std::ostream*) const'

Error looks straightforward.

@targos
Copy link
Owner Author

targos commented Aug 29, 2016

@ofrobots
Copy link

@targos It seems that the mkpeephole fix missed the branch cut-off. I have submitted a merge request to get the fix merged into 5.4: https://bugs.chromium.org/p/v8/issues/detail?id=5318.

targos added a commit that referenced this issue Apr 30, 2021
Original commit message:

    [bigint] Fix possibly-uninitialized leading digit on right shift

    (cherry picked from commit e82a3b4d47a93ab64f07d8c03e3cd17b6b961c3f)

    (cherry picked from commit 1162c460dee4218abd798b51b88926aef5c8bd61)

    No-Try: true
    No-Presubmit: true
    No-Tree-Checks: true
    Fixed: chromium:1151890
    Change-Id: I26f5c76494a9ff3f5a141f381e1c9a543e368571
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2561618
    Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
    Commit-Queue: Georg Neis <neis@chromium.org>
    Reviewed-by: Georg Neis <neis@chromium.org>
    Cr-Original-Original-Commit-Position: refs/heads/master@{#71422}
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565245
    Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
    Cr-Original-Commit-Position: refs/branch-heads/8.7@{nodejs#57}
    Cr-Original-Branched-From: 0d81cd72688512abcbe1601015baee390c484a6a-refs/heads/8.7.220@{#1}
    Cr-Original-Branched-From: 942c2ef85caef00fcf02517d049f05e9a3d4b440-refs/heads/master@{#70196}
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2624611
    Commit-Queue: Victor-Gabriel Savu <vsavu@google.com>
    Cr-Commit-Position: refs/branch-heads/8.6@{nodejs#54}
    Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
    Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}

Refs: v8/v8@412ac52

PR-URL: nodejs#38275
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>
targos added a commit that referenced this issue Apr 30, 2021
Original commit message:

    Merged: [wasm-simd] Fix loading fp pair registers

    We were incorrectly clearing the high reg from the list of regs to load.
    The intention was to prevent double (and incorrect) loading - loading
    128 bits from the low fp and the loading 128 bits from the high fp.
    But this violates the assumption that the two regs in a pair would be
    set or unset at the same time.

    The fix here is to introduce a new enum for register loads, a nop, which
    does nothing. The high fp of the fp pair will be tied to this nop, so as
    we iterate down the reglist, we load 128 bits using the low fp, then
    don't load anything for the high fp.

    Bug: chromium:1161654
    (cherry picked from commit 8c698702ced0de085aa91370d8cb44deab3fcf54)

    (cherry picked from commit ffd6ff5a61b9343ccc62e6c03b71a33682c6084d)

    Change-Id: Ib8134574b24f74f24ca9efd34b3444173296d8f1
    No-Try: true
    No-Presubmit: true
    No-Tree-Checks: true
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2619416
    Commit-Queue: Zhi An Ng <zhin@chromium.org>
    Reviewed-by: Clemens Backes <clemensb@chromium.org>
    Cr-Original-Commit-Position: refs/branch-heads/8.8@{nodejs#28}
    Cr-Original-Branched-From: 2dbcdc105b963ee2501c82139eef7e0603977ff0-refs/heads/8.8.278@{#1}
    Cr-Original-Branched-From: 366d30c99049b3f1c673f8a93deb9f879d0fa9f0-refs/heads/master@{#71094}
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2649176
    Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
    Commit-Queue: Achuith Bhandarkar <achuith@chromium.org>
    Cr-Commit-Position: refs/branch-heads/8.6@{nodejs#55}
    Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
    Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}

Refs: v8/v8@482e5c7

PR-URL: nodejs#38275
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>
targos added a commit that referenced this issue Apr 30, 2021
Original commit message:

    Merged: [deoptimizer] Stricter checks during deoptimization

    Revision: 506e893b812e03dbebe34b11d8aa9d4eb6869d89

    BUG=chromium:1161357
    NOTRY=true
    NOPRESUBMIT=true
    NOTREECHECKS=true
    R=​mythria@chromium.org

    (cherry picked from commit 44d052c19df0801fafdf2be54c899db65e79c67a)

    Change-Id: I97b69ae11d85bc0acd4a0c7bd28e1b692433de80
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2616219
    Reviewed-by: Mythri Alle <mythria@chromium.org>
    Commit-Queue: Georg Neis <neis@chromium.org>
    Cr-Original-Commit-Position: refs/branch-heads/8.8@{nodejs#23}
    Cr-Original-Branched-From: 2dbcdc105b963ee2501c82139eef7e0603977ff0-refs/heads/8.8.278@{#1}
    Cr-Original-Branched-From: 366d30c99049b3f1c673f8a93deb9f879d0fa9f0-refs/heads/master@{#71094}
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2649571
    Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
    Commit-Queue: Achuith Bhandarkar <achuith@chromium.org>
    Cr-Commit-Position: refs/branch-heads/8.6@{nodejs#56}
    Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
    Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}

Refs: v8/v8@ad2c5da

PR-URL: nodejs#38275
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>
targos added a commit that referenced this issue Apr 30, 2021
Original commit message:

    Merged: [liftoff][arm] Release temp registers after use

    The {ParallelRegisterMove} at the end of {AtomicLoad} might need a
    temporary scratch register for spilling values to the stack. Make sure
    that one is available by giving up the scratch register used for the
    address of the atomic access.

    TBR=​ahaas@chromium.org

    (cherry picked from commit 63166010061d2af4fef6a713d448ebf074a9d2cb)

    (cherry picked from commit 953f7a9dcb1425616e3be67fdfe6ef8d820f0daa)

    Bug: chromium:1153442
    Change-Id: Ie312b37857e226058581b300b5adb1f14476c155
    No-Try: true
    No-Presubmit: true
    No-Tree-Checks: true
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2584959
    Reviewed-by: Clemens Backes <clemensb@chromium.org>
    Commit-Queue: Clemens Backes <clemensb@chromium.org>
    Cr-Original-Commit-Position: refs/branch-heads/8.7@{nodejs#60}
    Cr-Original-Branched-From: 0d81cd72688512abcbe1601015baee390c484a6a-refs/heads/8.7.220@{#1}
    Cr-Original-Branched-From: 942c2ef85caef00fcf02517d049f05e9a3d4b440-refs/heads/master@{#70196}
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2656263
    Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
    Commit-Queue: Artem Sumaneev <asumaneev@google.com>
    Cr-Commit-Position: refs/branch-heads/8.6@{nodejs#58}
    Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
    Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}

Refs: v8/v8@5c6c99a

PR-URL: nodejs#38275
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>
targos added a commit that referenced this issue Apr 30, 2021
Original commit message:

    Merged: [interpreter] Store accumulator to callee after optional chain checks

    Revision: df98901c19ce17ca995ee6750379b0f004210d68

    BUG=chromium:1171954
    NOTRY=true
    NOPRESUBMIT=true
    NOTREECHECKS=true
    R=​rmcilroy@chromium.org

    (cherry picked from commit f309db52c2ccab8c9a04fcd236e89deb077061f9)

    Change-Id: If09e1503ca07b47a112362495ec0bb9d502118c9
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2674008
    Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
    Cr-Original-Commit-Position: refs/branch-heads/8.9@{nodejs#33}
    Cr-Original-Branched-From: 16b9bbbd581c25391981aa03180b76aa60463a3e-refs/heads/8.9.255@{#1}
    Cr-Original-Branched-From: d16a2a688498bd1c3e6a49edb25d8c4ca56232dc-refs/heads/master@{#72039}
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2706110
    Reviewed-by: Mythri Alle <mythria@chromium.org>
    Commit-Queue: Achuith Bhandarkar <achuith@chromium.org>
    Cr-Commit-Position: refs/branch-heads/8.6@{nodejs#62}
    Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
    Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}

Refs: v8/v8@e527ba4

PR-URL: nodejs#38275
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>
targos added a commit that referenced this issue Apr 30, 2021
Original commit message:

    Reland "[regexp] Hard-crash on invalid offsets in AdvanceCurrentPosition"

    This is a reland of 164cf80bbb0a6e091300bfc4cbbe70a6e6bd3e49

    The reland fixes UB (left-shift of negative integer type) with a
    static_cast<uint32_t>.

    Original change's description:
    > [regexp] Hard-crash on invalid offsets in AdvanceCurrentPosition
    >
    > Drive-by: Range checks in `Emit(byte, twenty_four_bits)` to ensure the
    > given packed bits actually fit into 24 bits.
    >
    > Bug: chromium:1166138
    > Change-Id: I2e711e6466bb48d7b9897f68dfe621d12bd92508
    > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2625877
    > Commit-Queue: Jakob Gruber <jgruber@chromium.org>
    > Commit-Queue: Leszek Swirski <leszeks@chromium.org>
    > Auto-Submit: Jakob Gruber <jgruber@chromium.org>
    > Reviewed-by: Leszek Swirski <leszeks@chromium.org>
    > Cr-Commit-Position: refs/heads/master@{#72064}

    (cherry picked from commit ff8d0f92d423774cf773b5b4fb48b6744971e27a)

    No-Try: true
    No-Presubmit: true
    No-Tree-Checks: true
    Tbr: leszeks@chromium.org
    Bug: chromium:1166138
    Change-Id: I514495e14bb99dfc9588fdb4a9f35d67d8d64acb
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2626663
    Reviewed-by: Jakob Gruber <jgruber@chromium.org>
    Commit-Queue: Jakob Gruber <jgruber@chromium.org>
    Cr-Original-Commit-Position: refs/heads/master@{#72088}
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2742954
    Reviewed-by: Jana Grill <janagrill@chromium.org>
    Commit-Queue: Victor-Gabriel Savu <vsavu@google.com>
    Cr-Commit-Position: refs/branch-heads/8.6@{nodejs#64}
    Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
    Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}

Refs: v8/v8@53c4d05

PR-URL: nodejs#38275
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>
targos added a commit that referenced this issue Apr 30, 2021
Original commit message:

    [macro-assembler] Avoid using the isolate in CallRecordWriteStub

    CallRecordWriteStub is used in a background compile thread for
    JS-to-Wasm wrapper compilation, so it should avoid accessing the
    isolate.
    Call the builtin using CallBuiltin which does not require a Handle<Code>
    object and instead gets the call target directly from the embedded data.

    R=​clemensb@chromium.org

    (cherry picked from commit 6b3994e8507b32dfb956329395dbe33a2a8fee14)

    No-Try: true
    No-Presubmit: true
    No-Tree-Checks: true
    Bug: chromium:1146813
    Change-Id: I4ee59084e4184f2e9039208e4e6db43482cefde6
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2593333
    Reviewed-by: Clemens Backes <clemensb@chromium.org>
    Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
    Cr-Original-Commit-Position: refs/heads/master@{#71785}
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2731535
    Commit-Queue: Victor-Gabriel Savu <vsavu@google.com>
    Reviewed-by: Jana Grill <janagrill@chromium.org>
    Cr-Commit-Position: refs/branch-heads/8.6@{nodejs#66}
    Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
    Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}

Refs: v8/v8@d2283ba

PR-URL: nodejs#38275
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>
targos added a commit that referenced this issue Apr 30, 2021
Original commit message:

    [macro-assembler] Avoid using the isolate in CallRecordWriteStub

    CallRecordWriteStub is used in a background compile thread for
    JS-to-Wasm wrapper compilation, so it should avoid accessing the
    isolate.
    Call the builtin using CallBuiltin which does not require a Handle<Code>
    object and instead gets the call target directly from the embedded data.

    R=​clemensb@chromium.org

    (cherry picked from commit 6b3994e8507b32dfb956329395dbe33a2a8fee14)

    No-Try: true
    No-Presubmit: true
    No-Tree-Checks: true
    Bug: chromium:1146813
    Change-Id: I4ee59084e4184f2e9039208e4e6db43482cefde6
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2593333
    Reviewed-by: Clemens Backes <clemensb@chromium.org>
    Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
    Cr-Original-Commit-Position: refs/heads/master@{#71785}
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2731535
    Commit-Queue: Victor-Gabriel Savu <vsavu@google.com>
    Reviewed-by: Jana Grill <janagrill@chromium.org>
    Cr-Commit-Position: refs/branch-heads/8.6@{nodejs#66}
    Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
    Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}

Refs: v8/v8@8130669

PR-URL: nodejs#38275
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>
targos added a commit that referenced this issue Apr 30, 2021
Original commit message:

    [M86 LTS] Disable failing tests

    Disable failing tests backported from ToT. No existing tests
    are disabled.

    No-Try: true
    No-Presubmit: true
    No-Tree-Checks: true
    Bug: None
    Change-Id: I94d2cd4827ce6fd1875c66912b4841a4a7c72ab3
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2764754
    Reviewed-by: Artem Sumaneev <asumaneev@google.com>
    Commit-Queue: Victor-Gabriel Savu <vsavu@google.com>
    Cr-Commit-Position: refs/branch-heads/8.6@{nodejs#70}
    Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
    Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}

Refs: v8/v8@5678ebe

PR-URL: nodejs#38275
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>
targos added a commit that referenced this issue Apr 30, 2021
Original commit message:

    Merged: [deoptimizer] Fix bug in OptimizedFrame::Summarize

    Revision: 3353a7d0b017146d543434be4036a81aaf7d25ae

    BUG=chromium:1182647
    NOTRY=true
    NOPRESUBMIT=true
    NOTREECHECKS=true
    R=​bmeurer@chromium.org

    (cherry picked from commit c0c96b768a7d3463b11403874549e6496529740d)

    Change-Id: I86abd6a3f34169be5f99aa9f54bb7bb3706fa85a
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2780300
    Reviewed-by: Georg Neis <neis@chromium.org>
    Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
    Commit-Queue: Georg Neis <neis@chromium.org>
    Cr-Original-Commit-Position: refs/branch-heads/8.9@{nodejs#49}
    Cr-Original-Branched-From: 16b9bbbd581c25391981aa03180b76aa60463a3e-refs/heads/8.9.255@{#1}
    Cr-Original-Branched-From: d16a2a688498bd1c3e6a49edb25d8c4ca56232dc-refs/heads/master@{#72039}
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2794427
    Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
    Commit-Queue: Artem Sumaneev <asumaneev@google.com>
    Cr-Commit-Position: refs/branch-heads/8.6@{nodejs#72}
    Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
    Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}

Refs: v8/v8@254c794

PR-URL: nodejs#38275
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>
targos added a commit that referenced this issue Apr 30, 2021
Original commit message:

    [LTS-M86][compiler][x64] Fix bug in InstructionSelector::ChangeInt32ToInt64

    (cherry picked from commit 02f84c745fc0cae5927a66dc4a3e81334e8f60a6)

    No-Try: true
    No-Presubmit: true
    No-Tree-Checks: true
    Bug: chromium:1196683
    Change-Id: Ib4ea738b47b64edc81450583be4c80a41698c3d1
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2820971
    Commit-Queue: Georg Neis <neis@chromium.org>
    Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
    Cr-Original-Commit-Position: refs/heads/master@{#73903}
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821959
    Commit-Queue: Jana Grill <janagrill@chromium.org>
    Reviewed-by: Georg Neis <neis@chromium.org>
    Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
    Cr-Commit-Position: refs/branch-heads/8.6@{nodejs#75}
    Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
    Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}

Refs: v8/v8@3066b7b

PR-URL: nodejs#38275
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>
targos added a commit that referenced this issue Apr 30, 2021
Original commit message:

    [LTS-M86][builtins] Harden Array.prototype.concat.

    Defence in depth patch to prevent JavaScript from executing
    from within IterateElements.

    R=​ishell@chromium.org
    R=​cbruni@chromium.org

    (cherry picked from commit 8284359ed0607e452a4dda2ce89811fb019b4aaa)

    No-Try: true
    No-Presubmit: true
    No-Tree-Checks: true
    Bug: chromium:1195977
    Change-Id: Ie59d468b73b94818cea986a3ded0804f6dddd10b
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2819941
    Reviewed-by: Camillo Bruni <cbruni@chromium.org>
    Reviewed-by: Igor Sheludko <ishell@chromium.org>
    Commit-Queue: Igor Sheludko <ishell@chromium.org>
    Cr-Original-Commit-Position: refs/heads/master@{#73898}
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821961
    Commit-Queue: Jana Grill <janagrill@chromium.org>
    Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
    Cr-Commit-Position: refs/branch-heads/8.6@{nodejs#76}
    Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
    Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}

Refs: v8/v8@1e35f64

PR-URL: nodejs#38275
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>
targos added a commit that referenced this issue Apr 30, 2021
Original commit message:

    [LTS-M86][builtins] Fix Array.prototype.concat with @@species

    (cherry picked from commit 7989e04979c3195e60a6814e8263063eb91f7b47)

    No-Try: true
    No-Presubmit: true
    No-Tree-Checks: true
    Bug: chromium:1195977
    Change-Id: I16843bce2e9f776abca0f2b943b898ab5e597e42
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2810787
    Reviewed-by: Camillo Bruni <cbruni@chromium.org>
    Commit-Queue: Igor Sheludko <ishell@chromium.org>
    Cr-Original-Commit-Position: refs/heads/master@{#73842}
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2823829
    Commit-Queue: Jana Grill <janagrill@chromium.org>
    Reviewed-by: Igor Sheludko <ishell@chromium.org>
    Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
    Cr-Commit-Position: refs/branch-heads/8.6@{nodejs#77}
    Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
    Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}

Refs: v8/v8@8ebd894

PR-URL: nodejs#38275
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>
targos added a commit that referenced this issue Apr 30, 2021
Original commit message:

    Merged: [runtime] Fix sorted order of DescriptorArray entries

    Revision: 518d67ad652fc24b7eb03e48bb342f952d4ccf74

    This is a reland of the previous merge which addresses the cctest link
    failure in component build mode.

    BUG=chromium:1133527
    NOTRY=true
    NOPRESUBMIT=true
    NOTREECHECKS=true
    R=verwaest@chromium.org

    Change-Id: Icbbc69fd5403fd0c2ab6d07d4340292b2b8c72b9
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2504264
    Reviewed-by: Toon Verwaest <verwaest@chromium.org>
    Cr-Commit-Position: refs/branch-heads/8.6@{nodejs#40}
    Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
    Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}

Refs: v8/v8@1a7d55a

PR-URL: nodejs#38275
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>
targos added a commit that referenced this issue Apr 30, 2021
Original commit message:

    Merged: [wasm][liftoff][ia32] Fix register allocation of CompareExchange

    The register that holds the {new_value} for the AtomicCompareExchange8U
    has to be a byte register on ia32. There was code to guarantee that, but
    after that code there was code that frees the {eax} register, and that
    code moved the {new_value} to a different register again. With this CL
    we first free {eax}, and then find a byte register for the {new_value}.

    R=​clemensb@chromium.org
    NOTRY=true
    NOPRESUBMIT=true
    NOTREECHECKS=true

    (cherry picked from commit 70a389ac8778064e470a95412d40e17f97898142)

    Bug: chromium:1140549
    Change-Id: I1679f3f9ab26c5416ea251c7925366ff43336d85
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2491031
    Reviewed-by: Clemens Backes <clemensb@chromium.org>
    Commit-Queue: Andreas Haas <ahaas@chromium.org>
    Cr-Original-Commit-Position: refs/heads/master@{#70721}
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2504512
    Cr-Commit-Position: refs/branch-heads/8.6@{nodejs#38}
    Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
    Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}

Refs: v8/v8@f44fcbf

PR-URL: nodejs#38275
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>
targos added a commit that referenced this issue Apr 30, 2021
Original commit message:

    Merged: [wasm][liftoff] Fix register usage for i64_addi

    The arm implementation made the assumption that the {lhs} and {dst}
    registers are either the same, or there is no overlap. This assumption
    does not hold.
    ia32 on the other hand has a lot of complicated logic (and unnecessary
    code generation) for different cases of overlap.

    This CL fixes the arm issue *and* simplifies the ia32 logic by making
    the arm assumption hold, and using it to eliminate special handling on
    ia32.

    R=​thibaudm@chromium.org

    (cherry picked from commit 89ca48c907e25ef94a135255092c4e150654c4fc)

    Bug: chromium:1146861
    Change-Id: I96c4985fb8ff710b98e009e457444fc8804bce58
    No-Try: true
    No-Presubmit: true
    No-Tree-Checks: true
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2584242
    Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
    Commit-Queue: Clemens Backes <clemensb@chromium.org>
    Cr-Commit-Position: refs/branch-heads/8.6@{nodejs#50}
    Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
    Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}

Refs: v8/v8@eddb823

PR-URL: nodejs#38275
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>
targos added a commit that referenced this issue Apr 30, 2021
Original commit message:

    M86-LTS: [compiler] Fix bug in RepresentationChanger::GetWord32RepresentationFor

    We have to respect the TypeCheckKind.

    (cherry picked from commit fd29e246f65a7cee130e72cd10f618f3b82af232)

    No-Try: true
    No-Presubmit: true
    No-Tree-Checks: true
    Bug: chromium:1195777
    Change-Id: If1eed719fef79b7c61d99c29ba869ddd7985c413
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2817791
    Commit-Queue: Georg Neis <neis@chromium.org>
    Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
    Cr-Original-Commit-Position: refs/heads/master@{#73909}
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2838235
    Owners-Override: Achuith Bhandarkar <achuith@chromium.org>
    Reviewed-by: Artem Sumaneev <asumaneev@google.com>
    Commit-Queue: Achuith Bhandarkar <achuith@chromium.org>
    Cr-Commit-Position: refs/branch-heads/8.6@{nodejs#79}
    Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
    Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}

Refs: v8/v8@bbc59d1

PR-URL: nodejs#38275
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>
targos added a commit that referenced this issue Apr 30, 2021
Original commit message:

    M86-LTS: [compiler] Fix a bug in VisitSpeculativeIntegerAdditiveOp

    (cherry picked from commit 9313c4ce3f32ad81df1c65becccec7e129181ce3)

    No-Try: true
    No-Presubmit: true
    No-Tree-Checks: true
    Bug: chromium:1199345
    Change-Id: I33bf71b33f43919fec4684054b5bf0a0787930ca
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2831478
    Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
    Commit-Queue: Georg Neis <neis@chromium.org>
    Cr-Original-Commit-Position: refs/heads/master@{#74008}
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2848412
    Commit-Queue: Artem Sumaneev <asumaneev@google.com>
    Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
    Cr-Commit-Position: refs/branch-heads/8.6@{nodejs#86}
    Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
    Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}

Refs: v8/v8@ab2340a
targos added a commit that referenced this issue Apr 30, 2021
Original commit message:

    M86-LTS: [compiler] Fix off-by-one error in kAdditiveSafeInteger

    (cherry picked from commit 798fbcb0a3e5a292fb775c37c19d9fe73bbac17c)

    No-Try: true
    No-Presubmit: true
    No-Tree-Checks: true
    Bug: chromium:1198705
    Change-Id: I6b3ad82754e1ca72701ce57f16c4f085f8c87f77
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2835705
    Auto-Submit: Georg Neis <neis@chromium.org>
    Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
    Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
    Cr-Original-Commit-Position: refs/heads/master@{#74033}
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2850708
    Commit-Queue: Artem Sumaneev <asumaneev@google.com>
    Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
    Cr-Commit-Position: refs/branch-heads/8.6@{nodejs#87}
    Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
    Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}

Refs: v8/v8@0024503
targos added a commit that referenced this issue May 5, 2021
Original commit message:

    M86-LTS: [compiler] Fix a bug in VisitSpeculativeIntegerAdditiveOp

    (cherry picked from commit 9313c4ce3f32ad81df1c65becccec7e129181ce3)

    No-Try: true
    No-Presubmit: true
    No-Tree-Checks: true
    Bug: chromium:1199345
    Change-Id: I33bf71b33f43919fec4684054b5bf0a0787930ca
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2831478
    Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
    Commit-Queue: Georg Neis <neis@chromium.org>
    Cr-Original-Commit-Position: refs/heads/master@{#74008}
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2848412
    Commit-Queue: Artem Sumaneev <asumaneev@google.com>
    Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
    Cr-Commit-Position: refs/branch-heads/8.6@{nodejs#86}
    Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
    Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}

Refs: v8/v8@ab2340a
targos added a commit that referenced this issue May 5, 2021
Original commit message:

    M86-LTS: [compiler] Fix off-by-one error in kAdditiveSafeInteger

    (cherry picked from commit 798fbcb0a3e5a292fb775c37c19d9fe73bbac17c)

    No-Try: true
    No-Presubmit: true
    No-Tree-Checks: true
    Bug: chromium:1198705
    Change-Id: I6b3ad82754e1ca72701ce57f16c4f085f8c87f77
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2835705
    Auto-Submit: Georg Neis <neis@chromium.org>
    Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
    Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
    Cr-Original-Commit-Position: refs/heads/master@{#74033}
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2850708
    Commit-Queue: Artem Sumaneev <asumaneev@google.com>
    Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
    Cr-Commit-Position: refs/branch-heads/8.6@{nodejs#87}
    Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
    Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}

Refs: v8/v8@0024503
targos added a commit that referenced this issue May 17, 2021
Original commit message:

    M86-LTS: [compiler] Fix a bug in VisitSpeculativeIntegerAdditiveOp

    (cherry picked from commit 9313c4ce3f32ad81df1c65becccec7e129181ce3)

    No-Try: true
    No-Presubmit: true
    No-Tree-Checks: true
    Bug: chromium:1199345
    Change-Id: I33bf71b33f43919fec4684054b5bf0a0787930ca
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2831478
    Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
    Commit-Queue: Georg Neis <neis@chromium.org>
    Cr-Original-Commit-Position: refs/heads/master@{#74008}
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2848412
    Commit-Queue: Artem Sumaneev <asumaneev@google.com>
    Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
    Cr-Commit-Position: refs/branch-heads/8.6@{nodejs#86}
    Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
    Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}

Refs: v8/v8@ab2340a

PR-URL: nodejs#38481
Reviewed-By: Richard Lau <rlau@redhat.com>
targos added a commit that referenced this issue May 17, 2021
Original commit message:

    M86-LTS: [compiler] Fix off-by-one error in kAdditiveSafeInteger

    (cherry picked from commit 798fbcb0a3e5a292fb775c37c19d9fe73bbac17c)

    No-Try: true
    No-Presubmit: true
    No-Tree-Checks: true
    Bug: chromium:1198705
    Change-Id: I6b3ad82754e1ca72701ce57f16c4f085f8c87f77
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2835705
    Auto-Submit: Georg Neis <neis@chromium.org>
    Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
    Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
    Cr-Original-Commit-Position: refs/heads/master@{#74033}
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2850708
    Commit-Queue: Artem Sumaneev <asumaneev@google.com>
    Reviewed-by: Victor-Gabriel Savu <vsavu@google.com>
    Cr-Commit-Position: refs/branch-heads/8.6@{nodejs#87}
    Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
    Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}

Refs: v8/v8@0024503

PR-URL: nodejs#38481
Reviewed-By: Richard Lau <rlau@redhat.com>
targos added a commit that referenced this issue Feb 14, 2023
Original commit message:

    [intl] Revert date formatting behavior change from ICU 72

    Replace U+202F with U+0020 after formatting date. This lets websites
    continue to work without any changes.

    This matches Firefox behavior, according to
    https://bugzilla.mozilla.org/show_bug.cgi?id=1806042#c17.

    (cherry picked from commit 90be99fab31c8299568e4114be1f0abd3741d615)

    Bug: chromium:1414292, chromium:1401829, chromium:1392814
    Change-Id: I1b2410fe45a5dc109628d8c44c24263edef7db3a
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4240359
    Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
    Commit-Queue: Adam Klein <adamk@chromium.org>
    Cr-Commit-Position: refs/branch-heads/11.0@{nodejs#31}
    Cr-Branched-From: 06097c6f0c5af54fd5d6965d37027efb72decd4f-refs/heads/11.0.226@{#1}
    Cr-Branched-From: 6bf3344f5d9940de1ab253f1817dcb99c641c9d3-refs/heads/main@{#84857}

Refs: v8/v8@b18fb9c
targos added a commit that referenced this issue Oct 7, 2023
Original commit message:

    Merged: [runtime] Set instance prototypes directly on maps

    Bug: chromium:1452137
    (cherry picked from commit c7c447735f762f6d6d0878e229371797845ef4ab)

    Change-Id: I611c41f942e2e51f3c4b4f1d119c18410617188e
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4637888
    Commit-Queue: Igor Sheludko <ishell@chromium.org>
    Auto-Submit: Igor Sheludko <ishell@chromium.org>
    Commit-Queue: Toon Verwaest <verwaest@chromium.org>
    Reviewed-by: Toon Verwaest <verwaest@chromium.org>
    Cr-Commit-Position: refs/branch-heads/11.4@{nodejs#47}
    Cr-Branched-From: 8a8a1e7086dacc426965d3875914efa66663c431-refs/heads/11.4.183@{#1}
    Cr-Branched-From: 5483d8e816e0bbce865cbbc3fa0ab357e6330bab-refs/heads/main@{#87241}

Refs: v8/v8@a1efa53
targos added a commit that referenced this issue Oct 7, 2023
Original commit message:

    Merged: [compiler] StackCheck can have side effects

    Bug: chromium:1452137
    (cherry picked from commit e548943e473b020fdc1de6e5543ca31b24d8b7f9)

    Change-Id: Ibd7c9b02efd12341b452e4c34a635a58a817649f
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4637129
    Reviewed-by: Toon Verwaest <verwaest@chromium.org>
    Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
    Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
    Commit-Queue: Toon Verwaest <verwaest@chromium.org>
    Cr-Commit-Position: refs/branch-heads/11.4@{nodejs#49}
    Cr-Branched-From: 8a8a1e7086dacc426965d3875914efa66663c431-refs/heads/11.4.183@{#1}
    Cr-Branched-From: 5483d8e816e0bbce865cbbc3fa0ab357e6330bab-refs/heads/main@{#87241}

Refs: v8/v8@840650f
targos added a commit that referenced this issue Nov 12, 2023
Original commit message:

    Merged: [runtime] Set instance prototypes directly on maps

    Bug: chromium:1452137
    (cherry picked from commit c7c447735f762f6d6d0878e229371797845ef4ab)

    Change-Id: I611c41f942e2e51f3c4b4f1d119c18410617188e
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4637888
    Commit-Queue: Igor Sheludko <ishell@chromium.org>
    Auto-Submit: Igor Sheludko <ishell@chromium.org>
    Commit-Queue: Toon Verwaest <verwaest@chromium.org>
    Reviewed-by: Toon Verwaest <verwaest@chromium.org>
    Cr-Commit-Position: refs/branch-heads/11.4@{nodejs#47}
    Cr-Branched-From: 8a8a1e7086dacc426965d3875914efa66663c431-refs/heads/11.4.183@{#1}
    Cr-Branched-From: 5483d8e816e0bbce865cbbc3fa0ab357e6330bab-refs/heads/main@{#87241}

Refs: v8/v8@a1efa53
targos added a commit that referenced this issue Nov 12, 2023
Original commit message:

    Merged: [compiler] StackCheck can have side effects

    Bug: chromium:1452137
    (cherry picked from commit e548943e473b020fdc1de6e5543ca31b24d8b7f9)

    Change-Id: Ibd7c9b02efd12341b452e4c34a635a58a817649f
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4637129
    Reviewed-by: Toon Verwaest <verwaest@chromium.org>
    Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
    Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
    Commit-Queue: Toon Verwaest <verwaest@chromium.org>
    Cr-Commit-Position: refs/branch-heads/11.4@{nodejs#49}
    Cr-Branched-From: 8a8a1e7086dacc426965d3875914efa66663c431-refs/heads/11.4.183@{#1}
    Cr-Branched-From: 5483d8e816e0bbce865cbbc3fa0ab357e6330bab-refs/heads/main@{#87241}

Refs: v8/v8@840650f
targos added a commit that referenced this issue Dec 13, 2023
Original commit message:

    Merged: [runtime] Set instance prototypes directly on maps

    Bug: chromium:1452137
    (cherry picked from commit c7c447735f762f6d6d0878e229371797845ef4ab)

    Change-Id: I611c41f942e2e51f3c4b4f1d119c18410617188e
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4637888
    Commit-Queue: Igor Sheludko <ishell@chromium.org>
    Auto-Submit: Igor Sheludko <ishell@chromium.org>
    Commit-Queue: Toon Verwaest <verwaest@chromium.org>
    Reviewed-by: Toon Verwaest <verwaest@chromium.org>
    Cr-Commit-Position: refs/branch-heads/11.4@{nodejs#47}
    Cr-Branched-From: 8a8a1e7086dacc426965d3875914efa66663c431-refs/heads/11.4.183@{#1}
    Cr-Branched-From: 5483d8e816e0bbce865cbbc3fa0ab357e6330bab-refs/heads/main@{#87241}

Refs: v8/v8@a1efa53
PR-URL: nodejs#50077
Refs: nodejs/nodejs-dependency-vuln-assessments#151
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
targos added a commit that referenced this issue Dec 13, 2023
Original commit message:

    Merged: [compiler] StackCheck can have side effects

    Bug: chromium:1452137
    (cherry picked from commit e548943e473b020fdc1de6e5543ca31b24d8b7f9)

    Change-Id: Ibd7c9b02efd12341b452e4c34a635a58a817649f
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4637129
    Reviewed-by: Toon Verwaest <verwaest@chromium.org>
    Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
    Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
    Commit-Queue: Toon Verwaest <verwaest@chromium.org>
    Cr-Commit-Position: refs/branch-heads/11.4@{nodejs#49}
    Cr-Branched-From: 8a8a1e7086dacc426965d3875914efa66663c431-refs/heads/11.4.183@{#1}
    Cr-Branched-From: 5483d8e816e0bbce865cbbc3fa0ab357e6330bab-refs/heads/main@{#87241}

Refs: v8/v8@840650f
PR-URL: nodejs#50077
Refs: nodejs/nodejs-dependency-vuln-assessments#151
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Richard Lau <rlau@redhat.com>
This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

8 participants