diff --git a/BUILD.bazel b/BUILD.bazel index bd4b45eb9a..857e1e2028 100644 --- a/BUILD.bazel +++ b/BUILD.bazel @@ -836,6 +836,7 @@ filegroup( "src/objects/template-objects.tq", "src/objects/templates.tq", "src/objects/torque-defined-classes.tq", + "src/objects/turbofan-types.tq", "test/torque/test-torque.tq", "third_party/v8/builtins/array-sort.tq", ] + select({ @@ -1707,6 +1708,8 @@ filegroup( "src/objects/transitions-inl.h", "src/objects/transitions.cc", "src/objects/transitions.h", + "src/objects/turbofan-types-inl.h", + "src/objects/turbofan-types.h", "src/objects/type-hints.cc", "src/objects/type-hints.h", "src/objects/value-serializer.cc", diff --git a/BUILD.gn b/BUILD.gn index 2038cbf4b7..c9f37a9551 100644 --- a/BUILD.gn +++ b/BUILD.gn @@ -1784,6 +1784,7 @@ torque_files = [ "src/objects/template-objects.tq", "src/objects/templates.tq", "src/objects/torque-defined-classes.tq", + "src/objects/turbofan-types.tq", "test/torque/test-torque.tq", "third_party/v8/builtins/array-sort.tq", ] @@ -3253,6 +3254,8 @@ v8_header_set("v8_internal_headers") { "src/objects/torque-defined-classes.h", "src/objects/transitions-inl.h", "src/objects/transitions.h", + "src/objects/turbofan-types-inl.h", + "src/objects/turbofan-types.h", "src/objects/type-hints.h", "src/objects/value-serializer.h", "src/objects/visitors-inl.h", diff --git a/src/builtins/base.tq b/src/builtins/base.tq index 7716d94288..3726207e1d 100644 --- a/src/builtins/base.tq +++ b/src/builtins/base.tq @@ -1168,7 +1168,7 @@ extern macro Int32Constant(constexpr int31): int31; extern macro Int32Constant(constexpr int32): int32; extern macro Int64Constant(constexpr int64): int64; extern macro Uint64Constant(constexpr uint64): uint64; -extern macro Float64Constant(constexpr int31): float64; +extern macro Float64Constant(constexpr int32): float64; extern macro Float64Constant(constexpr float64): float64; extern macro SmiConstant(constexpr int31): Smi; extern macro SmiConstant(constexpr Smi): Smi; @@ -1799,7 +1799,6 @@ macro Float64IsSomeInfinity(value: float64): bool { return value == (Convert(0) - V8_INFINITY); } -@export macro IsIntegerOrSomeInfinity(o: Object): bool { typeswitch (o) { case (Smi): { @@ -1817,20 +1816,6 @@ macro IsIntegerOrSomeInfinity(o: Object): bool { } } -builtin CheckNumberInRange(implicit context: Context)( - value: Number, min: Number, max: Number, nodeId: Smi): Undefined { - if (IsIntegerOrSomeInfinity(value) && min <= value && value <= max) { - return Undefined; - } else { - Print('Range type assertion failed! (value/min/max/nodeId)'); - Print(value); - Print(min); - Print(max); - Print(nodeId); - unreachable; - } -} - // Assert that the objects satisfy SameValue or are both the hole. builtin CheckSameObject(implicit context: Context)( lhs: Object, rhs: Object): Undefined { diff --git a/src/builtins/convert.tq b/src/builtins/convert.tq index 6a3c157db8..2a36badfb7 100644 --- a/src/builtins/convert.tq +++ b/src/builtins/convert.tq @@ -88,6 +88,9 @@ FromConstexpr(i: constexpr int31): uintptr { FromConstexpr(i: constexpr int31): float64 { return Float64Constant(i); } +FromConstexpr(i: constexpr int32): float64 { + return Float64Constant(i); +} FromConstexpr(i: constexpr float64): float64 { return Float64Constant(i); } diff --git a/src/builtins/number.tq b/src/builtins/number.tq index 777dd210d6..4136b9a693 100644 --- a/src/builtins/number.tq +++ b/src/builtins/number.tq @@ -75,6 +75,9 @@ macro NumberToStringSmi(x: int32, radix: int32): String labels Slow { if (!isNegative) { // Fast case where the result is a one character string. if (x < radix) { + if (x == 0) { + return ZeroStringConstant(); + } return StringFromSingleCharCode(ToCharCode(n)); } } else { diff --git a/src/compiler/add-type-assertions-reducer.cc b/src/compiler/add-type-assertions-reducer.cc index d555d518d2..03bf5819af 100644 --- a/src/compiler/add-type-assertions-reducer.cc +++ b/src/compiler/add-type-assertions-reducer.cc @@ -20,6 +20,9 @@ AddTypeAssertionsReducer::~AddTypeAssertionsReducer() = default; Reduction AddTypeAssertionsReducer::Reduce(Node* node) { if (node->opcode() == IrOpcode::kAssertType || + node->opcode() == IrOpcode::kAllocate || + node->opcode() == IrOpcode::kObjectState || + node->opcode() == IrOpcode::kObjectId || node->opcode() == IrOpcode::kPhi || !NodeProperties::IsTyped(node) || visited_.Get(node)) { return NoChange(); diff --git a/src/compiler/effect-control-linearizer.cc b/src/compiler/effect-control-linearizer.cc index 5edd1818f7..3e48a2a3ff 100644 --- a/src/compiler/effect-control-linearizer.cc +++ b/src/compiler/effect-control-linearizer.cc @@ -30,6 +30,7 @@ #include "src/objects/heap-number.h" #include "src/objects/oddball.h" #include "src/objects/ordered-hash-table.h" +#include "src/objects/turbofan-types.h" namespace v8 { namespace internal { @@ -6193,10 +6194,17 @@ Node* EffectControlLinearizer::LowerAssertType(Node* node) { Type type = OpParameter(node->op()); CHECK(type.CanBeAsserted()); Node* const input = node->InputAt(0); - Node* const min = __ NumberConstant(type.Min()); - Node* const max = __ NumberConstant(type.Max()); - CallBuiltin(Builtin::kCheckNumberInRange, node->op()->properties(), input, - min, max, __ SmiConstant(node->id())); + Node* allocated_type; + { + DCHECK(isolate()->CurrentLocalHeap()->is_main_thread()); + base::Optional unparked_scope; + if (isolate()->CurrentLocalHeap()->IsParked()) { + unparked_scope.emplace(isolate()->main_thread_local_isolate()); + } + allocated_type = __ HeapConstant(type.AllocateOnHeap(factory())); + } + CallBuiltin(Builtin::kCheckTurbofanType, node->op()->properties(), input, + allocated_type, __ SmiConstant(node->id())); return input; } diff --git a/src/compiler/typer.cc b/src/compiler/typer.cc index a9bc374552..de69655f11 100644 --- a/src/compiler/typer.cc +++ b/src/compiler/typer.cc @@ -1274,7 +1274,7 @@ Type Typer::Visitor::TypeJSCreateStringIterator(Node* node) { } Type Typer::Visitor::TypeJSCreateKeyValueArray(Node* node) { - return Type::OtherObject(); + return Type::Array(); } Type Typer::Visitor::TypeJSCreateObject(Node* node) { diff --git a/src/compiler/types.cc b/src/compiler/types.cc index d4c0f782b3..12686c6323 100644 --- a/src/compiler/types.cc +++ b/src/compiler/types.cc @@ -10,6 +10,7 @@ #include "src/handles/handles-inl.h" #include "src/objects/instance-type.h" #include "src/objects/objects-inl.h" +#include "src/objects/turbofan-types.h" #include "src/utils/ostreams.h" namespace v8 { @@ -1142,6 +1143,40 @@ std::ostream& operator<<(std::ostream& os, Type type) { return os; } +Handle Type::AllocateOnHeap(Factory* factory) { + DCHECK(CanBeAsserted()); + if (IsBitset()) { + return factory->NewTurbofanBitsetType(AsBitset(), AllocationType::kYoung); + } else if (IsUnion()) { + const UnionType* union_type = AsUnion(); + Handle result = union_type->Get(0).AllocateOnHeap(factory); + for (int i = 1; i < union_type->Length(); ++i) { + result = factory->NewTurbofanUnionType( + result, union_type->Get(i).AllocateOnHeap(factory), + AllocationType::kYoung); + } + return result; + } else if (IsHeapConstant()) { + return factory->NewTurbofanHeapConstantType(AsHeapConstant()->Value(), + AllocationType::kYoung); + } else if (IsOtherNumberConstant()) { + return factory->NewTurbofanOtherNumberConstantType( + AsOtherNumberConstant()->Value(), AllocationType::kYoung); + } else if (IsRange()) { + return factory->NewTurbofanRangeType(AsRange()->Min(), AsRange()->Max(), + AllocationType::kYoung); + } else { + // Other types are not supported for type assertions. + UNREACHABLE(); + } +} + +#define VERIFY_TORQUE_BITSET_AGREEMENT(Name, _) \ + STATIC_ASSERT(BitsetType::k##Name == TurbofanTypeBits::k##Name); +INTERNAL_BITSET_TYPE_LIST(VERIFY_TORQUE_BITSET_AGREEMENT) +PROPER_ATOMIC_BITSET_TYPE_LIST(VERIFY_TORQUE_BITSET_AGREEMENT) +#undef VERIFY_TORQUE_BITSET_AGREEMENT + } // namespace compiler } // namespace internal } // namespace v8 diff --git a/src/compiler/types.h b/src/compiler/types.h index ce18746f79..46129680c0 100644 --- a/src/compiler/types.h +++ b/src/compiler/types.h @@ -102,8 +102,7 @@ namespace compiler { V(OtherNumber, 1u << 4) \ V(OtherString, 1u << 5) \ -#define PROPER_BITSET_TYPE_LIST(V) \ - V(None, 0u) \ +#define PROPER_ATOMIC_BITSET_TYPE_LIST(V) \ V(Negative31, 1u << 6) \ V(Null, 1u << 7) \ V(Undefined, 1u << 8) \ @@ -131,7 +130,10 @@ namespace compiler { /* TODO(v8:10391): Remove this type once all ExternalPointer usages are */ \ /* sandbox-ready. */ \ V(SandboxedExternalPointer, 1u << 31) \ - \ + +#define PROPER_BITSET_TYPE_LIST(V) \ + V(None, 0u) \ + PROPER_ATOMIC_BITSET_TYPE_LIST(V) \ V(Signed31, kUnsigned30 | kNegative31) \ V(Signed32, kSigned31 | kOtherUnsigned31 | \ kOtherSigned32) \ @@ -416,9 +418,8 @@ class V8_EXPORT_PRIVATE Type { (Is(Type::PlainNumber()) && Min() == Max()); } - bool CanBeAsserted() const { - return IsRange() || (Is(Type::Integral32()) && !IsNone()); - } + bool CanBeAsserted() const { return Is(Type::NonInternal()); } + Handle AllocateOnHeap(Factory* factory); const HeapConstantType* AsHeapConstant() const; const OtherNumberConstantType* AsOtherNumberConstant() const; diff --git a/src/compiler/verifier.cc b/src/compiler/verifier.cc index b407834d92..4bae72c9e9 100644 --- a/src/compiler/verifier.cc +++ b/src/compiler/verifier.cc @@ -693,7 +693,7 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) { CheckTypeIs(node, Type::OtherObject()); break; case IrOpcode::kJSCreateKeyValueArray: - CheckTypeIs(node, Type::OtherObject()); + CheckTypeIs(node, Type::Array()); break; case IrOpcode::kJSCreateObject: CheckTypeIs(node, Type::OtherObject()); diff --git a/src/diagnostics/objects-debug.cc b/src/diagnostics/objects-debug.cc index 65e9310cec..07a7eaf987 100644 --- a/src/diagnostics/objects-debug.cc +++ b/src/diagnostics/objects-debug.cc @@ -33,6 +33,7 @@ #include "src/objects/js-array-inl.h" #include "src/objects/objects-inl.h" #include "src/objects/objects.h" +#include "src/objects/turbofan-types-inl.h" #include "src/roots/roots.h" #ifdef V8_INTL_SUPPORT #include "src/objects/js-break-iterator-inl.h" diff --git a/src/flags/flag-definitions.h b/src/flags/flag-definitions.h index 50cc8a25e7..e682abf7e4 100644 --- a/src/flags/flag-definitions.h +++ b/src/flags/flag-definitions.h @@ -549,6 +549,9 @@ DEFINE_NEG_IMPLICATION(jitless, interpreted_frames_native_stack) DEFINE_BOOL(assert_types, false, "generate runtime type assertions to test the typer") +// TODO(tebbi): Support allocating types from background thread. +DEFINE_NEG_IMPLICATION(assert_types, concurrent_recompilation) +DEFINE_NEG_IMPLICATION(assert_types, concurrent_inlining) DEFINE_BOOL(trace_compilation_dependencies, false, "trace code dependencies") // Depend on --trace-deopt-verbose for reporting dependency invalidations. diff --git a/src/heap/factory.cc b/src/heap/factory.cc index 2602f0a0d5..4c2bf7f322 100644 --- a/src/heap/factory.cc +++ b/src/heap/factory.cc @@ -3135,10 +3135,15 @@ Handle Factory::HeapNumberToString(Handle number, if (!cached->IsUndefined(isolate())) return Handle::cast(cached); } - char arr[kNumberToStringBufferSize]; - base::Vector buffer(arr, arraysize(arr)); - const char* string = DoubleToCString(value, buffer); - Handle result = CharToString(this, string, mode); + Handle result; + if (value == 0) { + result = zero_string(); + } else { + char arr[kNumberToStringBufferSize]; + base::Vector buffer(arr, arraysize(arr)); + const char* string = DoubleToCString(value, buffer); + result = CharToString(this, string, mode); + } if (mode != NumberCacheMode::kIgnore) { NumberToStringCacheSet(number, hash, result); } @@ -3152,10 +3157,15 @@ inline Handle Factory::SmiToString(Smi number, NumberCacheMode mode) { if (!cached->IsUndefined(isolate())) return Handle::cast(cached); } - char arr[kNumberToStringBufferSize]; - base::Vector buffer(arr, arraysize(arr)); - const char* string = IntToCString(number.value(), buffer); - Handle result = CharToString(this, string, mode); + Handle result; + if (number == Smi::zero()) { + result = zero_string(); + } else { + char arr[kNumberToStringBufferSize]; + base::Vector buffer(arr, arraysize(arr)); + const char* string = IntToCString(number.value(), buffer); + result = CharToString(this, string, mode); + } if (mode != NumberCacheMode::kIgnore) { NumberToStringCacheSet(handle(number, isolate()), hash, result); } diff --git a/src/heap/setup-heap-internal.cc b/src/heap/setup-heap-internal.cc index d54ea9c722..011fc5e53a 100644 --- a/src/heap/setup-heap-internal.cc +++ b/src/heap/setup-heap-internal.cc @@ -42,6 +42,7 @@ #include "src/objects/synthetic-module.h" #include "src/objects/template-objects-inl.h" #include "src/objects/torque-defined-classes-inl.h" +#include "src/objects/turbofan-types.h" #include "src/regexp/regexp.h" #if V8_ENABLE_WEBASSEMBLY diff --git a/src/objects/map.tq b/src/objects/map.tq index 2221684832..27b1197f77 100644 --- a/src/objects/map.tq +++ b/src/objects/map.tq @@ -52,6 +52,10 @@ extern class Map extends HeapObject { } } + macro IsUndetectable(): bool { + return this.bit_field.is_undetectable; + } + instance_size_in_words: uint8; inobject_properties_start_or_constructor_function_index: uint8; used_or_unused_instance_size_in_words: uint8; diff --git a/src/objects/objects-body-descriptors-inl.h b/src/objects/objects-body-descriptors-inl.h index 6307f7f03d..bd19aa231a 100644 --- a/src/objects/objects-body-descriptors-inl.h +++ b/src/objects/objects-body-descriptors-inl.h @@ -24,6 +24,7 @@ #include "src/objects/synthetic-module.h" #include "src/objects/torque-defined-classes-inl.h" #include "src/objects/transitions.h" +#include "src/objects/turbofan-types-inl.h" #if V8_ENABLE_WEBASSEMBLY #include "src/wasm/wasm-objects-inl.h" diff --git a/src/objects/string.tq b/src/objects/string.tq index 68c280de3a..4894147003 100644 --- a/src/objects/string.tq +++ b/src/objects/string.tq @@ -12,6 +12,10 @@ extern class String extends Name { Convert(this.map.instance_type)); } + macro IsNotInternalized(): bool { + return this.StringInstanceType().is_not_internalized; + } + const length: int32; } diff --git a/src/objects/turbofan-types-inl.h b/src/objects/turbofan-types-inl.h new file mode 100644 index 0000000000..0ac215fdeb --- /dev/null +++ b/src/objects/turbofan-types-inl.h @@ -0,0 +1,24 @@ +// Copyright 2021 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +#ifndef V8_OBJECTS_TURBOFAN_TYPES_INL_H_ +#define V8_OBJECTS_TURBOFAN_TYPES_INL_H_ + +#include "src/heap/heap-write-barrier.h" +#include "src/objects/turbofan-types.h" + +// Has to be the last include (doesn't have include guards): +#include "src/objects/object-macros.h" + +namespace v8 { +namespace internal { + +#include "torque-generated/src/objects/turbofan-types-tq-inl.inc" + +} // namespace internal +} // namespace v8 + +#include "src/objects/object-macros-undef.h" + +#endif // V8_OBJECTS_TURBOFAN_TYPES_INL_H_ diff --git a/src/objects/turbofan-types.h b/src/objects/turbofan-types.h new file mode 100644 index 0000000000..953b6950ab --- /dev/null +++ b/src/objects/turbofan-types.h @@ -0,0 +1,30 @@ +// Copyright 2021 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +#ifndef V8_OBJECTS_TURBOFAN_TYPES_H_ +#define V8_OBJECTS_TURBOFAN_TYPES_H_ + +#include "src/common/globals.h" +#include "src/objects/heap-object.h" +#include "torque-generated/bit-fields.h" + +// Has to be the last include (doesn't have include guards): +#include "src/objects/object-macros.h" + +namespace v8 { +namespace internal { + +#include "torque-generated/src/objects/turbofan-types-tq.inc" + +class TurbofanTypeBits { + public: + DEFINE_TORQUE_GENERATED_TURBOFAN_TYPE_BITS() +}; + +} // namespace internal +} // namespace v8 + +#include "src/objects/object-macros-undef.h" + +#endif // V8_OBJECTS_TURBOFAN_TYPES_H_ diff --git a/src/objects/turbofan-types.tq b/src/objects/turbofan-types.tq new file mode 100644 index 0000000000..d1e65854e6 --- /dev/null +++ b/src/objects/turbofan-types.tq @@ -0,0 +1,204 @@ +// Copyright 2021 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +#include "src/objects/turbofan-types.h" + +@export +@abstract +class TurbofanType extends HeapObject { +} + +bitfield struct TurbofanTypeBits extends uint32 { + _unused_padding_field_1: bool: 1 bit; + other_unsigned31: bool: 1 bit; + other_unsigned32: bool: 1 bit; + other_signed32: bool: 1 bit; + other_number: bool: 1 bit; + other_string: bool: 1 bit; + negative31: bool: 1 bit; + null: bool: 1 bit; + undefined: bool: 1 bit; + boolean: bool: 1 bit; + unsigned30: bool: 1 bit; + minus_zero: bool: 1 bit; + naN: bool: 1 bit; + symbol: bool: 1 bit; + internalized_string: bool: 1 bit; + _unused_padding_field_2: bool: 1 bit; + other_callable: bool: 1 bit; + other_object: bool: 1 bit; + other_undetectable: bool: 1 bit; + callable_proxy: bool: 1 bit; + other_proxy: bool: 1 bit; + function: bool: 1 bit; + bound_function: bool: 1 bit; + hole: bool: 1 bit; + other_internal: bool: 1 bit; + external_pointer: bool: 1 bit; + array: bool: 1 bit; + unsigned_big_int_63: bool: 1 bit; + other_unsigned_big_int_64: bool: 1 bit; + negative_big_int_63: bool: 1 bit; + other_big_int: bool: 1 bit; + sandboxed_external_pointer: bool: 1 bit; +} + +@export +class TurbofanBitsetType extends TurbofanType { + bitset: TurbofanTypeBits; +} + +@export +class TurbofanUnionType extends TurbofanType { + type1: TurbofanType; + type2: TurbofanType; +} + +@export +class TurbofanRangeType extends TurbofanType { + min: float64; + max: float64; +} + +@export +class TurbofanHeapConstantType extends TurbofanType { + constant: HeapObject; +} + +@export +class TurbofanOtherNumberConstantType extends TurbofanType { + constant: float64; +} + +macro IsMinusZero(x: float64): bool { + return x == 0 && 1 / x < 0; +} + +macro TestTurbofanBitsetType(value: Object, bitset: TurbofanTypeBits): bool { + typeswitch (value) { + case (value: Number): { + const valueF = Convert(value); + if (IsInteger(value)) { + if (IsMinusZero(valueF)) { + return bitset.minus_zero; + } else if (valueF < Convert(-0x80000000)) { + return bitset.other_number; + } else if (valueF < -0x40000000) { + return bitset.other_signed32; + } else if (valueF < 0) { + return bitset.negative31; + } else if (valueF < Convert(0x40000000)) { + return bitset.unsigned30; + } else if (valueF < 0x80000000) { + return bitset.other_unsigned31; + } else if (valueF <= 0xffffffff) { + return bitset.other_unsigned32; + } else { + return bitset.other_number; + } + } else if (Float64IsNaN(valueF)) { + return bitset.naN; + } else { + return bitset.other_number; + } + } + case (Null): { + return bitset.null; + } + case (Undefined): { + return bitset.undefined; + } + case (Boolean): { + return bitset.boolean; + } + case (Symbol): { + return bitset.symbol; + } + case (s: String): { + if (s.IsNotInternalized()) { + return bitset.other_string; + } else { + return bitset.internalized_string; + } + } + case (proxy: JSProxy): { + return Is(proxy) ? bitset.callable_proxy : bitset.other_proxy; + } + case (JSFunction): { + return bitset.function; + } + case (JSBoundFunction): { + return bitset.bound_function; + } + case (TheHole): { + return bitset.hole; + } + case (JSArray): { + return bitset.array; + } + case (BigInt): { + // TODO (tebbi): Distinguish different BigInt types. + return bitset.unsigned_big_int_63 | bitset.other_unsigned_big_int_64 | + bitset.negative_big_int_63 | bitset.other_big_int; + } + case (Callable): { + return bitset.other_callable; + } + case (object: JSObject): { + if (object.map.IsUndetectable()) { + return bitset.other_undetectable; + } else { + return bitset.other_object; + } + } + case (Object): { + return false; + } + } +} + +builtin TestTurbofanType(implicit context: Context)( + value: Object, expectedType: TurbofanType): Boolean { + typeswitch (expectedType) { + case (t: TurbofanBitsetType): { + return Convert(TestTurbofanBitsetType(value, t.bitset)); + } + case (t: TurbofanUnionType): { + return Convert( + TestTurbofanType(value, t.type1) == True || + TestTurbofanType(value, t.type2) == True); + } + case (t: TurbofanRangeType): { + const value = Cast(value) otherwise return False; + if (!IsIntegerOrSomeInfinity(value)) return False; + const valueF = Convert(value); + return Convert( + !IsMinusZero(valueF) && t.min <= valueF && valueF <= t.max); + } + case (t: TurbofanHeapConstantType): { + return Convert(TaggedEqual(value, t.constant)); + } + case (t: TurbofanOtherNumberConstantType): { + const value = + Convert(Cast(value) otherwise return False); + return Convert(value == t.constant); + } + case (TurbofanType): { + unreachable; + } + } +} + +builtin CheckTurbofanType(implicit context: Context)( + value: Object, expectedType: TurbofanType, nodeId: Smi): Undefined { + if (TestTurbofanType(value, expectedType) == True) { + return Undefined; + } + + Print('Type assertion failed! (value/expectedType/nodeId)'); + Print(value); + Print(expectedType); + Print(nodeId); + unreachable; +} diff --git a/src/runtime/runtime.cc b/src/runtime/runtime.cc index 3bcd41dfcb..555810aeee 100644 --- a/src/runtime/runtime.cc +++ b/src/runtime/runtime.cc @@ -222,8 +222,10 @@ bool Runtime::IsAllowListedForFuzzing(FunctionId id) { case Runtime::kGetOptimizationStatus: case Runtime::kHeapObjectVerify: case Runtime::kIsBeingInterpreted: - case Runtime::kVerifyType: return !FLAG_allow_natives_for_differential_fuzzing; + case Runtime::kVerifyType: + return !FLAG_allow_natives_for_differential_fuzzing && + !FLAG_concurrent_recompilation; case Runtime::kBaselineOsr: case Runtime::kCompileBaseline: return ENABLE_SPARKPLUG; diff --git a/src/torque/declarations.cc b/src/torque/declarations.cc index 2ff3680bcf..ed92004c92 100644 --- a/src/torque/declarations.cc +++ b/src/torque/declarations.cc @@ -202,9 +202,12 @@ Macro* Declarations::DeclareMacro( base::Optional external_assembler_name, const Signature& signature, base::Optional body, base::Optional op, bool is_user_defined) { - if (TryLookupMacro(name, signature.GetExplicitTypes())) { - ReportError("cannot redeclare macro ", name, - " with identical explicit parameters"); + if (Macro* existing_macro = + TryLookupMacro(name, signature.GetExplicitTypes())) { + if (existing_macro->ParentScope() == CurrentScope::Get()) { + ReportError("cannot redeclare macro ", name, + " with identical explicit parameters"); + } } Macro* macro; if (external_assembler_name) { diff --git a/src/torque/implementation-visitor.cc b/src/torque/implementation-visitor.cc index 7168faf5e3..198a0a4057 100644 --- a/src/torque/implementation-visitor.cc +++ b/src/torque/implementation-visitor.cc @@ -4205,13 +4205,16 @@ void CppClassGenerator::GenerateClass() { } void CppClassGenerator::GenerateClassCasts() { - cpp::Function f("cast"); + cpp::Class owner({cpp::TemplateParameter("D"), cpp::TemplateParameter("P")}, + gen_name_); + cpp::Function f(&owner, "cast"); f.SetFlags(cpp::Function::kV8Inline | cpp::Function::kStatic); f.SetReturnType("D"); f.AddParameter("Object", "object"); // V8_INLINE static D cast(Object) - f.PrintInlineDefinition(hdr_, [](std::ostream& stream) { + f.PrintDeclaration(hdr_); + f.PrintDefinition(inl_, [](std::ostream& stream) { stream << " return D(object.ptr());\n"; }); // V8_INLINE static D unchecked_cast(Object) @@ -4731,9 +4734,10 @@ void ImplementationVisitor::GenerateClassDefinitions( factory_impl << " HeapObject result =\n"; factory_impl << " factory()->AllocateRawWithImmortalMap(size, " "allocation_type, map);\n"; - factory_impl << " WriteBarrierMode write_barrier_mode =\n" - << " allocation_type == AllocationType::kYoung\n" - << " ? SKIP_WRITE_BARRIER : UPDATE_WRITE_BARRIER;\n"; + factory_impl << " WriteBarrierMode write_barrier_mode =\n" + << " allocation_type == AllocationType::kYoung\n" + << " ? SKIP_WRITE_BARRIER : UPDATE_WRITE_BARRIER;\n" + << " USE(write_barrier_mode);\n"; factory_impl << " " << type->HandlifiedCppTypeName() << " result_handle(" << type->name() << "::cast(result), factory()->isolate());\n"; @@ -5280,32 +5284,9 @@ void ImplementationVisitor::GenerateExportedMacrosAssembler( h_contents << "#include \"src/compiler/code-assembler.h\"\n"; h_contents << "#include \"src/execution/frames.h\"\n"; h_contents << "#include \"torque-generated/csa-types.h\"\n"; - cc_contents << "#include \"src/objects/fixed-array-inl.h\"\n"; - cc_contents << "#include \"src/objects/free-space.h\"\n"; - cc_contents << "#include \"src/objects/js-regexp-string-iterator.h\"\n"; - cc_contents << "#include \"src/objects/js-temporal-objects.h\"\n"; - cc_contents << "#include \"src/objects/js-weak-refs.h\"\n"; - cc_contents << "#include \"src/objects/ordered-hash-table.h\"\n"; - cc_contents << "#include \"src/objects/property-descriptor-object.h\"\n"; - cc_contents << "#include \"src/objects/stack-frame-info.h\"\n"; - cc_contents << "#include \"src/objects/swiss-name-dictionary.h\"\n"; - cc_contents << "#include \"src/objects/synthetic-module.h\"\n"; - cc_contents << "#include \"src/objects/template-objects.h\"\n"; - cc_contents << "#include \"src/objects/torque-defined-classes.h\"\n"; - { - IfDefScope intl_scope(cc_contents, "V8_INTL_SUPPORT"); - cc_contents << "#include \"src/objects/js-break-iterator.h\"\n"; - cc_contents << "#include \"src/objects/js-collator.h\"\n"; - cc_contents << "#include \"src/objects/js-date-time-format.h\"\n"; - cc_contents << "#include \"src/objects/js-display-names.h\"\n"; - cc_contents << "#include \"src/objects/js-list-format.h\"\n"; - cc_contents << "#include \"src/objects/js-locale.h\"\n"; - cc_contents << "#include \"src/objects/js-number-format.h\"\n"; - cc_contents << "#include \"src/objects/js-plural-rules.h\"\n"; - cc_contents << "#include \"src/objects/js-relative-time-format.h\"\n"; - cc_contents << "#include \"src/objects/js-segment-iterator.h\"\n"; - cc_contents << "#include \"src/objects/js-segmenter.h\"\n"; - cc_contents << "#include \"src/objects/js-segments.h\"\n"; + + for (const std::string& include_path : GlobalContext::CppIncludes()) { + cc_contents << "#include " << StringLiteralQuote(include_path) << "\n"; } cc_contents << "#include \"torque-generated/" << file_name << ".h\"\n"; diff --git a/src/torque/types.cc b/src/torque/types.cc index 9157268bcb..43bdef1203 100644 --- a/src/torque/types.cc +++ b/src/torque/types.cc @@ -1137,8 +1137,8 @@ std::tuple Field::GetFieldSizeInformation() const { return *optional; } Error("fields of type ", *name_and_type.type, " are not (yet) supported") - .Position(pos); - return std::make_tuple(0, "#no size"); + .Position(pos) + .Throw(); } size_t Type::AlignmentLog2() const { diff --git a/test/cctest/cctest.status b/test/cctest/cctest.status index 7719720323..7cae681feb 100644 --- a/test/cctest/cctest.status +++ b/test/cctest/cctest.status @@ -1241,4 +1241,18 @@ 'test-streaming-compilation/AsyncTestIncrementalCaching': [SKIP], 'test-streaming-compilation/SingleThreadedTestIncrementalCaching': [SKIP], }], + +############################################################################## +['variant == assert_types', { + # Type assertions add strong pointers, breaking these test. + 'test-heap/ObjectsInOptimizedCodeAreWeak': [SKIP], + 'test-heap/ObjectsInEagerlyDeoptimizedCodeAreWeak': [SKIP], + 'test-heap/NewSpaceObjectsInOptimizedCode': [SKIP], + 'test-heap/LeakNativeContextViaMapKeyed': [SKIP], + 'test-heap/CellsInOptimizedCodeAreWeak': [SKIP], + # Type assertions only work without concurrent compilation, but this test + # always triggers a concurrent compilation. + 'test-concurrent-shared-function-info/TestConcurrentSharedFunctionInfo': [SKIP], +}], # variant == assert_types + ] diff --git a/test/mjsunit/compiler/diamond-followedby-branch.js b/test/mjsunit/compiler/diamond-followedby-branch.js index 9772291280..06390565fb 100644 --- a/test/mjsunit/compiler/diamond-followedby-branch.js +++ b/test/mjsunit/compiler/diamond-followedby-branch.js @@ -2,7 +2,7 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax +// Flags: --allow-natives-syntax --no-assert-types // Check that the branch elimination replace the redundant branch condition with // a phi node, and then the branch is folded in EffectControlLinearizationPhase. diff --git a/test/mjsunit/compiler/number-ceil.js b/test/mjsunit/compiler/number-ceil.js index a82dd4cf34..f771d9116c 100644 --- a/test/mjsunit/compiler/number-ceil.js +++ b/test/mjsunit/compiler/number-ceil.js @@ -2,7 +2,7 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax --opt +// Flags: --allow-natives-syntax --opt --no-assert-types // Test that NumberCeil propagates kIdentifyZeros truncations. (function() { diff --git a/test/mjsunit/compiler/number-comparison-truncations.js b/test/mjsunit/compiler/number-comparison-truncations.js index a056d5a026..6a9ca3cebb 100644 --- a/test/mjsunit/compiler/number-comparison-truncations.js +++ b/test/mjsunit/compiler/number-comparison-truncations.js @@ -2,7 +2,7 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax --opt --turbo-inlining +// Flags: --allow-natives-syntax --opt --turbo-inlining --no-assert-types // Test that SpeculativeNumberEqual[SignedSmall] properly passes the // kIdentifyZeros truncation. diff --git a/test/mjsunit/compiler/number-floor.js b/test/mjsunit/compiler/number-floor.js index ede0730ada..7c96ffb14b 100644 --- a/test/mjsunit/compiler/number-floor.js +++ b/test/mjsunit/compiler/number-floor.js @@ -2,7 +2,7 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax --opt +// Flags: --allow-natives-syntax --opt --no-assert-types // Test that NumberFloor propagates kIdentifyZeros truncations. (function() { diff --git a/test/mjsunit/compiler/number-max.js b/test/mjsunit/compiler/number-max.js index 35a29faccf..883695c846 100644 --- a/test/mjsunit/compiler/number-max.js +++ b/test/mjsunit/compiler/number-max.js @@ -2,7 +2,7 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax --opt +// Flags: --allow-natives-syntax --opt --no-assert-types // Test that NumberMax properly passes the kIdentifyZeros truncation. (function() { diff --git a/test/mjsunit/compiler/number-min.js b/test/mjsunit/compiler/number-min.js index da66026df7..ae8c1d0e94 100644 --- a/test/mjsunit/compiler/number-min.js +++ b/test/mjsunit/compiler/number-min.js @@ -2,7 +2,7 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax --opt +// Flags: --allow-natives-syntax --opt --no-assert-types // Test that NumberMin properly passes the kIdentifyZeros truncation. (function() { diff --git a/test/mjsunit/compiler/number-modulus.js b/test/mjsunit/compiler/number-modulus.js index e8f86e7fda..6b6d1844d0 100644 --- a/test/mjsunit/compiler/number-modulus.js +++ b/test/mjsunit/compiler/number-modulus.js @@ -2,7 +2,7 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax --opt --noalways-opt +// Flags: --allow-natives-syntax --opt --no-always-opt --no-assert-types // Test that NumberModulus passes kIdentifiesZero to the diff --git a/test/mjsunit/compiler/number-round.js b/test/mjsunit/compiler/number-round.js index 4a9eb9acbf..60d24c86a2 100644 --- a/test/mjsunit/compiler/number-round.js +++ b/test/mjsunit/compiler/number-round.js @@ -2,7 +2,7 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax --opt +// Flags: --allow-natives-syntax --opt --no-assert-types // Test that NumberRound propagates kIdentifyZeros truncations. (function() { diff --git a/test/mjsunit/compiler/number-trunc.js b/test/mjsunit/compiler/number-trunc.js index 1cc005d558..01fb579271 100644 --- a/test/mjsunit/compiler/number-trunc.js +++ b/test/mjsunit/compiler/number-trunc.js @@ -2,7 +2,7 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax --opt +// Flags: --allow-natives-syntax --opt --no-assert-types // Test that NumberTrunc propagates kIdentifyZeros truncations. (function() { diff --git a/test/mjsunit/compiler/verify-type.js b/test/mjsunit/compiler/verify-type.js index 1389730334..f2b34474b0 100644 --- a/test/mjsunit/compiler/verify-type.js +++ b/test/mjsunit/compiler/verify-type.js @@ -2,7 +2,7 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax --no-stress-opt --no-always-opt +// Flags: --allow-natives-syntax --no-stress-opt --no-always-opt --no-concurrent-recompilation function foo(x) { return %VerifyType(x * x); diff --git a/test/mjsunit/getters-on-elements.js b/test/mjsunit/getters-on-elements.js index a8d2b9ea69..ced62ae447 100644 --- a/test/mjsunit/getters-on-elements.js +++ b/test/mjsunit/getters-on-elements.js @@ -25,7 +25,7 @@ // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -// Flags: --allow-natives-syntax --noalways-opt --opt +// Flags: --allow-natives-syntax --noalways-opt --opt --no-assert-types // It's nice to run this in other browsers too. var standalone = false; diff --git a/test/mjsunit/regress/regress-2132.js b/test/mjsunit/regress/regress-2132.js index 9df1c1ba44..cf432f872b 100644 --- a/test/mjsunit/regress/regress-2132.js +++ b/test/mjsunit/regress/regress-2132.js @@ -25,7 +25,7 @@ // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -// Flags: --allow-natives-syntax --opt --no-always-opt +// Flags: --allow-natives-syntax --opt --no-always-opt --no-assert-types function mul(x, y) { return (x * y) | 0; diff --git a/test/mjsunit/shift-for-integer-div.js b/test/mjsunit/shift-for-integer-div.js index 353f79bec8..992c7a1a03 100644 --- a/test/mjsunit/shift-for-integer-div.js +++ b/test/mjsunit/shift-for-integer-div.js @@ -25,7 +25,7 @@ // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -// Flags: --allow-natives-syntax --opt --no-always-opt +// Flags: --allow-natives-syntax --opt --no-always-opt --no-assert-types function divp4(x) { return x / 4; diff --git a/tools/testrunner/local/variants.py b/tools/testrunner/local/variants.py index cac6bcf341..3e739f2eeb 100644 --- a/tools/testrunner/local/variants.py +++ b/tools/testrunner/local/variants.py @@ -62,7 +62,8 @@ INCOMPATIBLE_FLAGS_PER_VARIANT = { "slow_path": ["--no-force-slow-path"], "stress_concurrent_allocation": ["--single-threaded-gc", "--predictable"], "stress_concurrent_inlining": ["--single-threaded", "--predictable", - "--turboprop", "--lazy-feedback-allocation"], + "--turboprop", "--lazy-feedback-allocation", + "--assert-types"], "turboprop": ["--stress_concurrent_inlining"], # The fast API tests initialize an embedder object that never needs to be # serialized to the snapshot, so we don't have a @@ -81,6 +82,7 @@ INCOMPATIBLE_FLAGS_PER_VARIANT = { # There is a negative implication: --perf-prof disables # --wasm-write-protect-code-memory. "wasm_write_protect_code": ["--perf-prof"], + "assert_types": ["--concurrent-recompilation", "--concurrent-inlining", "--stress_concurrent_inlining", "--no-assert-types"], } # Flags that lead to a contradiction under certain build variables. @@ -108,7 +110,7 @@ INCOMPATIBLE_FLAGS_PER_BUILD_VARIABLE = { # The conflicts might be directly contradictory flags or be caused by the # implications defined in flag-definitions.h. INCOMPATIBLE_FLAGS_PER_EXTRA_FLAG = { - "--concurrent-recompilation": ["--predictable"], + "--concurrent-recompilation": ["--predictable", "--assert-types"], "--gc-interval=*": ["--gc-interval=*"], "--optimize-for-size": ["--max-semi-space-size=*"], "--stress_concurrent_allocation": diff --git a/tools/v8heapconst.py b/tools/v8heapconst.py index 592f119b22..e8fbaa669d 100644 --- a/tools/v8heapconst.py +++ b/tools/v8heapconst.py @@ -110,53 +110,58 @@ INSTANCE_TYPES = { 146: "NATIVE_CONTEXT_TYPE", 147: "SCRIPT_CONTEXT_TYPE", 148: "WITH_CONTEXT_TYPE", - 149: "EXPORTED_SUB_CLASS_BASE_TYPE", - 150: "EXPORTED_SUB_CLASS_TYPE", - 151: "EXPORTED_SUB_CLASS2_TYPE", - 152: "SMALL_ORDERED_HASH_MAP_TYPE", - 153: "SMALL_ORDERED_HASH_SET_TYPE", - 154: "SMALL_ORDERED_NAME_DICTIONARY_TYPE", - 155: "DESCRIPTOR_ARRAY_TYPE", - 156: "STRONG_DESCRIPTOR_ARRAY_TYPE", - 157: "SOURCE_TEXT_MODULE_TYPE", - 158: "SYNTHETIC_MODULE_TYPE", - 159: "UNCOMPILED_DATA_WITH_PREPARSE_DATA_TYPE", - 160: "UNCOMPILED_DATA_WITHOUT_PREPARSE_DATA_TYPE", - 161: "WEAK_FIXED_ARRAY_TYPE", - 162: "TRANSITION_ARRAY_TYPE", - 163: "CALL_REF_DATA_TYPE", - 164: "CELL_TYPE", - 165: "CODE_TYPE", - 166: "CODE_DATA_CONTAINER_TYPE", - 167: "COVERAGE_INFO_TYPE", - 168: "EMBEDDER_DATA_ARRAY_TYPE", - 169: "FEEDBACK_METADATA_TYPE", - 170: "FEEDBACK_VECTOR_TYPE", - 171: "FILLER_TYPE", - 172: "FREE_SPACE_TYPE", - 173: "INTERNAL_CLASS_TYPE", - 174: "INTERNAL_CLASS_WITH_STRUCT_ELEMENTS_TYPE", - 175: "MAP_TYPE", - 176: "MEGA_DOM_HANDLER_TYPE", - 177: "ON_HEAP_BASIC_BLOCK_PROFILER_DATA_TYPE", - 178: "PREPARSE_DATA_TYPE", - 179: "PROPERTY_ARRAY_TYPE", - 180: "PROPERTY_CELL_TYPE", - 181: "SCOPE_INFO_TYPE", - 182: "SHARED_FUNCTION_INFO_TYPE", - 183: "SMI_BOX_TYPE", - 184: "SMI_PAIR_TYPE", - 185: "SORT_STATE_TYPE", - 186: "SWISS_NAME_DICTIONARY_TYPE", - 187: "WEAK_ARRAY_LIST_TYPE", - 188: "WEAK_CELL_TYPE", - 189: "WASM_ARRAY_TYPE", - 190: "WASM_STRUCT_TYPE", - 191: "JS_PROXY_TYPE", + 149: "TURBOFAN_BITSET_TYPE_TYPE", + 150: "TURBOFAN_HEAP_CONSTANT_TYPE_TYPE", + 151: "TURBOFAN_OTHER_NUMBER_CONSTANT_TYPE_TYPE", + 152: "TURBOFAN_RANGE_TYPE_TYPE", + 153: "TURBOFAN_UNION_TYPE_TYPE", + 154: "EXPORTED_SUB_CLASS_BASE_TYPE", + 155: "EXPORTED_SUB_CLASS_TYPE", + 156: "EXPORTED_SUB_CLASS2_TYPE", + 157: "SMALL_ORDERED_HASH_MAP_TYPE", + 158: "SMALL_ORDERED_HASH_SET_TYPE", + 159: "SMALL_ORDERED_NAME_DICTIONARY_TYPE", + 160: "DESCRIPTOR_ARRAY_TYPE", + 161: "STRONG_DESCRIPTOR_ARRAY_TYPE", + 162: "SOURCE_TEXT_MODULE_TYPE", + 163: "SYNTHETIC_MODULE_TYPE", + 164: "UNCOMPILED_DATA_WITH_PREPARSE_DATA_TYPE", + 165: "UNCOMPILED_DATA_WITHOUT_PREPARSE_DATA_TYPE", + 166: "WEAK_FIXED_ARRAY_TYPE", + 167: "TRANSITION_ARRAY_TYPE", + 168: "CALL_REF_DATA_TYPE", + 169: "CELL_TYPE", + 170: "CODE_TYPE", + 171: "CODE_DATA_CONTAINER_TYPE", + 172: "COVERAGE_INFO_TYPE", + 173: "EMBEDDER_DATA_ARRAY_TYPE", + 174: "FEEDBACK_METADATA_TYPE", + 175: "FEEDBACK_VECTOR_TYPE", + 176: "FILLER_TYPE", + 177: "FREE_SPACE_TYPE", + 178: "INTERNAL_CLASS_TYPE", + 179: "INTERNAL_CLASS_WITH_STRUCT_ELEMENTS_TYPE", + 180: "MAP_TYPE", + 181: "MEGA_DOM_HANDLER_TYPE", + 182: "ON_HEAP_BASIC_BLOCK_PROFILER_DATA_TYPE", + 183: "PREPARSE_DATA_TYPE", + 184: "PROPERTY_ARRAY_TYPE", + 185: "PROPERTY_CELL_TYPE", + 186: "SCOPE_INFO_TYPE", + 187: "SHARED_FUNCTION_INFO_TYPE", + 188: "SMI_BOX_TYPE", + 189: "SMI_PAIR_TYPE", + 190: "SORT_STATE_TYPE", + 191: "SWISS_NAME_DICTIONARY_TYPE", + 192: "WEAK_ARRAY_LIST_TYPE", + 193: "WEAK_CELL_TYPE", + 194: "WASM_ARRAY_TYPE", + 195: "WASM_STRUCT_TYPE", + 196: "JS_PROXY_TYPE", 1057: "JS_OBJECT_TYPE", - 192: "JS_GLOBAL_OBJECT_TYPE", - 193: "JS_GLOBAL_PROXY_TYPE", - 194: "JS_MODULE_NAMESPACE_TYPE", + 197: "JS_GLOBAL_OBJECT_TYPE", + 198: "JS_GLOBAL_PROXY_TYPE", + 199: "JS_MODULE_NAMESPACE_TYPE", 1040: "JS_SPECIAL_API_OBJECT_TYPE", 1041: "JS_PRIMITIVE_WRAPPER_TYPE", 1058: "JS_API_OBJECT_TYPE", @@ -250,16 +255,16 @@ INSTANCE_TYPES = { # List of known V8 maps. KNOWN_MAPS = { - ("read_only_space", 0x02119): (175, "MetaMap"), + ("read_only_space", 0x02119): (180, "MetaMap"), ("read_only_space", 0x02141): (67, "NullMap"), - ("read_only_space", 0x02169): (156, "StrongDescriptorArrayMap"), - ("read_only_space", 0x02191): (161, "WeakFixedArrayMap"), + ("read_only_space", 0x02169): (161, "StrongDescriptorArrayMap"), + ("read_only_space", 0x02191): (166, "WeakFixedArrayMap"), ("read_only_space", 0x021d1): (101, "EnumCacheMap"), ("read_only_space", 0x02205): (121, "FixedArrayMap"), ("read_only_space", 0x02251): (8, "OneByteInternalizedStringMap"), - ("read_only_space", 0x0229d): (172, "FreeSpaceMap"), - ("read_only_space", 0x022c5): (171, "OnePointerFillerMap"), - ("read_only_space", 0x022ed): (171, "TwoPointerFillerMap"), + ("read_only_space", 0x0229d): (177, "FreeSpaceMap"), + ("read_only_space", 0x022c5): (176, "OnePointerFillerMap"), + ("read_only_space", 0x022ed): (176, "TwoPointerFillerMap"), ("read_only_space", 0x02315): (67, "UninitializedMap"), ("read_only_space", 0x0238d): (67, "UndefinedMap"), ("read_only_space", 0x023d1): (66, "HeapNumberMap"), @@ -270,15 +275,15 @@ KNOWN_MAPS = { ("read_only_space", 0x02559): (122, "HashTableMap"), ("read_only_space", 0x02581): (64, "SymbolMap"), ("read_only_space", 0x025a9): (40, "OneByteStringMap"), - ("read_only_space", 0x025d1): (181, "ScopeInfoMap"), - ("read_only_space", 0x025f9): (182, "SharedFunctionInfoMap"), - ("read_only_space", 0x02621): (165, "CodeMap"), - ("read_only_space", 0x02649): (164, "CellMap"), - ("read_only_space", 0x02671): (180, "GlobalPropertyCellMap"), + ("read_only_space", 0x025d1): (186, "ScopeInfoMap"), + ("read_only_space", 0x025f9): (187, "SharedFunctionInfoMap"), + ("read_only_space", 0x02621): (170, "CodeMap"), + ("read_only_space", 0x02649): (169, "CellMap"), + ("read_only_space", 0x02671): (185, "GlobalPropertyCellMap"), ("read_only_space", 0x02699): (70, "ForeignMap"), - ("read_only_space", 0x026c1): (162, "TransitionArrayMap"), + ("read_only_space", 0x026c1): (167, "TransitionArrayMap"), ("read_only_space", 0x026e9): (45, "ThinOneByteStringMap"), - ("read_only_space", 0x02711): (170, "FeedbackVectorMap"), + ("read_only_space", 0x02711): (175, "FeedbackVectorMap"), ("read_only_space", 0x02749): (67, "ArgumentsMarkerMap"), ("read_only_space", 0x027a9): (67, "ExceptionMap"), ("read_only_space", 0x02805): (67, "TerminationExceptionMap"), @@ -286,17 +291,17 @@ KNOWN_MAPS = { ("read_only_space", 0x028cd): (67, "StaleRegisterMap"), ("read_only_space", 0x0292d): (133, "ScriptContextTableMap"), ("read_only_space", 0x02955): (131, "ClosureFeedbackCellArrayMap"), - ("read_only_space", 0x0297d): (169, "FeedbackMetadataArrayMap"), + ("read_only_space", 0x0297d): (174, "FeedbackMetadataArrayMap"), ("read_only_space", 0x029a5): (121, "ArrayListMap"), ("read_only_space", 0x029cd): (65, "BigIntMap"), ("read_only_space", 0x029f5): (132, "ObjectBoilerplateDescriptionMap"), ("read_only_space", 0x02a1d): (135, "BytecodeArrayMap"), - ("read_only_space", 0x02a45): (166, "CodeDataContainerMap"), - ("read_only_space", 0x02a6d): (167, "CoverageInfoMap"), + ("read_only_space", 0x02a45): (171, "CodeDataContainerMap"), + ("read_only_space", 0x02a6d): (172, "CoverageInfoMap"), ("read_only_space", 0x02a95): (136, "FixedDoubleArrayMap"), ("read_only_space", 0x02abd): (124, "GlobalDictionaryMap"), ("read_only_space", 0x02ae5): (102, "ManyClosuresCellMap"), - ("read_only_space", 0x02b0d): (176, "MegaDomHandlerMap"), + ("read_only_space", 0x02b0d): (181, "MegaDomHandlerMap"), ("read_only_space", 0x02b35): (121, "ModuleInfoMap"), ("read_only_space", 0x02b5d): (125, "NameDictionaryMap"), ("read_only_space", 0x02b85): (102, "NoClosuresCellMap"), @@ -305,27 +310,27 @@ KNOWN_MAPS = { ("read_only_space", 0x02bfd): (127, "OrderedHashMapMap"), ("read_only_space", 0x02c25): (128, "OrderedHashSetMap"), ("read_only_space", 0x02c4d): (129, "OrderedNameDictionaryMap"), - ("read_only_space", 0x02c75): (178, "PreparseDataMap"), - ("read_only_space", 0x02c9d): (179, "PropertyArrayMap"), + ("read_only_space", 0x02c75): (183, "PreparseDataMap"), + ("read_only_space", 0x02c9d): (184, "PropertyArrayMap"), ("read_only_space", 0x02cc5): (98, "SideEffectCallHandlerInfoMap"), ("read_only_space", 0x02ced): (98, "SideEffectFreeCallHandlerInfoMap"), ("read_only_space", 0x02d15): (98, "NextCallSideEffectFreeCallHandlerInfoMap"), ("read_only_space", 0x02d3d): (130, "SimpleNumberDictionaryMap"), - ("read_only_space", 0x02d65): (152, "SmallOrderedHashMapMap"), - ("read_only_space", 0x02d8d): (153, "SmallOrderedHashSetMap"), - ("read_only_space", 0x02db5): (154, "SmallOrderedNameDictionaryMap"), - ("read_only_space", 0x02ddd): (157, "SourceTextModuleMap"), - ("read_only_space", 0x02e05): (186, "SwissNameDictionaryMap"), - ("read_only_space", 0x02e2d): (158, "SyntheticModuleMap"), + ("read_only_space", 0x02d65): (157, "SmallOrderedHashMapMap"), + ("read_only_space", 0x02d8d): (158, "SmallOrderedHashSetMap"), + ("read_only_space", 0x02db5): (159, "SmallOrderedNameDictionaryMap"), + ("read_only_space", 0x02ddd): (162, "SourceTextModuleMap"), + ("read_only_space", 0x02e05): (191, "SwissNameDictionaryMap"), + ("read_only_space", 0x02e2d): (163, "SyntheticModuleMap"), ("read_only_space", 0x02e55): (72, "WasmCapiFunctionDataMap"), ("read_only_space", 0x02e7d): (73, "WasmExportedFunctionDataMap"), ("read_only_space", 0x02ea5): (74, "WasmJSFunctionDataMap"), ("read_only_space", 0x02ecd): (75, "WasmApiFunctionRefMap"), ("read_only_space", 0x02ef5): (76, "WasmTypeInfoMap"), - ("read_only_space", 0x02f1d): (187, "WeakArrayListMap"), + ("read_only_space", 0x02f1d): (192, "WeakArrayListMap"), ("read_only_space", 0x02f45): (123, "EphemeronHashTableMap"), - ("read_only_space", 0x02f6d): (168, "EmbedderDataArrayMap"), - ("read_only_space", 0x02f95): (188, "WeakCellMap"), + ("read_only_space", 0x02f6d): (173, "EmbedderDataArrayMap"), + ("read_only_space", 0x02f95): (193, "WeakCellMap"), ("read_only_space", 0x02fbd): (32, "StringMap"), ("read_only_space", 0x02fe5): (41, "ConsOneByteStringMap"), ("read_only_space", 0x0300d): (33, "ConsStringMap"), @@ -382,31 +387,36 @@ KNOWN_MAPS = { ("read_only_space", 0x06165): (119, "WasmExceptionTagMap"), ("read_only_space", 0x0618d): (120, "WasmIndirectFunctionTableMap"), ("read_only_space", 0x061b5): (138, "SloppyArgumentsElementsMap"), - ("read_only_space", 0x061dd): (155, "DescriptorArrayMap"), - ("read_only_space", 0x06205): (160, "UncompiledDataWithoutPreparseDataMap"), - ("read_only_space", 0x0622d): (159, "UncompiledDataWithPreparseDataMap"), - ("read_only_space", 0x06255): (177, "OnHeapBasicBlockProfilerDataMap"), - ("read_only_space", 0x0627d): (173, "InternalClassMap"), - ("read_only_space", 0x062a5): (184, "SmiPairMap"), - ("read_only_space", 0x062cd): (183, "SmiBoxMap"), - ("read_only_space", 0x062f5): (149, "ExportedSubClassBaseMap"), - ("read_only_space", 0x0631d): (150, "ExportedSubClassMap"), - ("read_only_space", 0x06345): (68, "AbstractInternalClassSubclass1Map"), - ("read_only_space", 0x0636d): (69, "AbstractInternalClassSubclass2Map"), - ("read_only_space", 0x06395): (137, "InternalClassWithSmiElementsMap"), - ("read_only_space", 0x063bd): (174, "InternalClassWithStructElementsMap"), - ("read_only_space", 0x063e5): (151, "ExportedSubClass2Map"), - ("read_only_space", 0x0640d): (185, "SortStateMap"), - ("read_only_space", 0x06435): (163, "CallRefDataMap"), - ("read_only_space", 0x0645d): (91, "AllocationSiteWithWeakNextMap"), - ("read_only_space", 0x06485): (91, "AllocationSiteWithoutWeakNextMap"), - ("read_only_space", 0x064ad): (82, "LoadHandler1Map"), - ("read_only_space", 0x064d5): (82, "LoadHandler2Map"), - ("read_only_space", 0x064fd): (82, "LoadHandler3Map"), - ("read_only_space", 0x06525): (83, "StoreHandler0Map"), - ("read_only_space", 0x0654d): (83, "StoreHandler1Map"), - ("read_only_space", 0x06575): (83, "StoreHandler2Map"), - ("read_only_space", 0x0659d): (83, "StoreHandler3Map"), + ("read_only_space", 0x061dd): (160, "DescriptorArrayMap"), + ("read_only_space", 0x06205): (165, "UncompiledDataWithoutPreparseDataMap"), + ("read_only_space", 0x0622d): (164, "UncompiledDataWithPreparseDataMap"), + ("read_only_space", 0x06255): (182, "OnHeapBasicBlockProfilerDataMap"), + ("read_only_space", 0x0627d): (149, "TurbofanBitsetTypeMap"), + ("read_only_space", 0x062a5): (153, "TurbofanUnionTypeMap"), + ("read_only_space", 0x062cd): (152, "TurbofanRangeTypeMap"), + ("read_only_space", 0x062f5): (150, "TurbofanHeapConstantTypeMap"), + ("read_only_space", 0x0631d): (151, "TurbofanOtherNumberConstantTypeMap"), + ("read_only_space", 0x06345): (178, "InternalClassMap"), + ("read_only_space", 0x0636d): (189, "SmiPairMap"), + ("read_only_space", 0x06395): (188, "SmiBoxMap"), + ("read_only_space", 0x063bd): (154, "ExportedSubClassBaseMap"), + ("read_only_space", 0x063e5): (155, "ExportedSubClassMap"), + ("read_only_space", 0x0640d): (68, "AbstractInternalClassSubclass1Map"), + ("read_only_space", 0x06435): (69, "AbstractInternalClassSubclass2Map"), + ("read_only_space", 0x0645d): (137, "InternalClassWithSmiElementsMap"), + ("read_only_space", 0x06485): (179, "InternalClassWithStructElementsMap"), + ("read_only_space", 0x064ad): (156, "ExportedSubClass2Map"), + ("read_only_space", 0x064d5): (190, "SortStateMap"), + ("read_only_space", 0x064fd): (168, "CallRefDataMap"), + ("read_only_space", 0x06525): (91, "AllocationSiteWithWeakNextMap"), + ("read_only_space", 0x0654d): (91, "AllocationSiteWithoutWeakNextMap"), + ("read_only_space", 0x06575): (82, "LoadHandler1Map"), + ("read_only_space", 0x0659d): (82, "LoadHandler2Map"), + ("read_only_space", 0x065c5): (82, "LoadHandler3Map"), + ("read_only_space", 0x065ed): (83, "StoreHandler0Map"), + ("read_only_space", 0x06615): (83, "StoreHandler1Map"), + ("read_only_space", 0x0663d): (83, "StoreHandler2Map"), + ("read_only_space", 0x06665): (83, "StoreHandler3Map"), ("map_space", 0x02119): (1057, "ExternalMap"), ("map_space", 0x02141): (2114, "JSMessageObjectMap"), }