AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity
14de33a440
v8/test/mjsunit/maglev
History
Leszek Swirski 503b56efdf [maglev] Check maps in TryBuildFastInstanceOf 
Add a map check for the RHS of instanceof checks (i.e. the class) when
loading its hasInstance method. We were previously confirming the value
of the RHS, to make sure that it's a constant, but not considering the
case that the map of that class could change (e.g. because of a
prototype change or field definition).

Bug: v8:7700
Change-Id: Ia2923b99dd0524670bebcc57e4c0c209f8835d04
Fixed: chromium:1407959
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4173568
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85336}
2023-01-17 12:13:38 +00:00
..
regress [maglev] Check maps in TryBuildFastInstanceOf 2023-01-17 12:13:38 +00:00
00.js [maglev] Basic tiering to Maglev 2022-03-02 13:35:32 +00:00
01.js [maglev] Basic tiering to Maglev 2022-03-02 13:35:32 +00:00
02.js [maglev] Basic tiering to Maglev 2022-03-02 13:35:32 +00:00
03.js [maglev] Basic tiering to Maglev 2022-03-02 13:35:32 +00:00
04.js [maglev] Basic tiering to Maglev 2022-03-02 13:35:32 +00:00
05.js [maglev] Basic tiering to Maglev 2022-03-02 13:35:32 +00:00
06.js [maglev] Basic tiering to Maglev 2022-03-02 13:35:32 +00:00
07.js [maglev] Basic tiering to Maglev 2022-03-02 13:35:32 +00:00
08.js [maglev] Basic tiering to Maglev 2022-03-02 13:35:32 +00:00
09.js [maglev] Basic tiering to Maglev 2022-03-02 13:35:32 +00:00
10.js [maglev] Basic tiering to Maglev 2022-03-02 13:35:32 +00:00
11.js [maglev] Basic tiering to Maglev 2022-03-02 13:35:32 +00:00
12.js [maglev] Basic tiering to Maglev 2022-03-02 13:35:32 +00:00
13.js [maglev] Basic tiering to Maglev 2022-03-02 13:35:32 +00:00
14.js [maglev] Basic tiering to Maglev 2022-03-02 13:35:32 +00:00
15.js [maglev] Basic tiering to Maglev 2022-03-02 13:35:32 +00:00
16.js [maglev] Basic tiering to Maglev 2022-03-02 13:35:32 +00:00
17.js [maglev] Implement StoreField 2022-03-08 15:09:53 +00:00
18.js [cleanup] Remove --stress-opt remnants 2022-08-31 08:37:44 +00:00
19.js [maglev] CompactInterpreterFrameState fixes 2022-03-29 13:59:48 +00:00
add-number.js [cleanup] Remove --stress-opt remnants 2022-08-31 08:37:44 +00:00
add-smi.js [cleanup] Remove --stress-opt remnants 2022-08-31 08:37:44 +00:00
argument-over-under-application.js [maglev] Fix over application return stack cleanup 2022-03-29 10:39:28 +00:00
call-js-runtime.js [cleanup] Remove --stress-opt remnants 2022-08-31 08:37:44 +00:00
call-runtime-for-pair.js [cleanup] Remove --stress-opt remnants 2022-08-31 08:37:44 +00:00
constant-in-proto-proxy-after-holder.js [maglev] Depend on stable protos up to validity cell 2022-09-05 10:12:04 +00:00
destructuring-assignment-with-exclude-properties.js [cleanup] Remove --stress-opt remnants 2022-08-31 08:37:44 +00:00
eager-deopt-in-inline.js [cleanup] Remove --stress-opt remnants 2022-08-31 08:37:44 +00:00
exceptions.js [maglev] Emit Int32->Smi checks eagerly 2022-11-11 16:11:16 +00:00
get-template-object.js [cleanup] Remove --stress-opt remnants 2022-08-31 08:37:44 +00:00
inner-function.js [cleanup] Remove --stress-opt remnants 2022-08-31 08:37:44 +00:00
int32_constants_in_phi.js [maglev] Tag Int32Constant in Phi boundaries 2022-10-31 14:30:41 +00:00
int32-branch.js [cleanup] Remove --stress-opt remnants 2022-08-31 08:37:44 +00:00
lazy-deopt-with-onstack-activation.js [flags] Rename --opt to --turbofan 2022-05-03 12:10:30 +00:00
lazy-deopt-without-onstack-activation.js [flags] Rename --opt to --turbofan 2022-05-03 12:10:30 +00:00
lda-global-inside-typeof.js [cleanup] Remove --stress-opt remnants 2022-08-31 08:37:44 +00:00
lda-global.js [cleanup] Remove --stress-opt remnants 2022-08-31 08:37:44 +00:00
lda-module-variable-import.mjs [cleanup] Remove --stress-opt remnants 2022-08-31 08:37:44 +00:00
lda-module-variable.mjs [cleanup] Remove --stress-opt remnants 2022-08-31 08:37:44 +00:00
literals.js [cleanup] Remove --stress-opt remnants 2022-08-31 08:37:44 +00:00
load-named.js [cleanup] Remove --stress-opt remnants 2022-08-31 08:37:44 +00:00
lots-of-args.js [maglev][arm64] Fix scratch register shortage on funs with many args 2022-12-28 14:02:51 +00:00
lots-of-registers.js [cleanup] Remove --stress-opt remnants 2022-08-31 08:37:44 +00:00
mutable-context-access.js [cleanup] Remove --stress-opt remnants 2022-08-31 08:37:44 +00:00
negate.js [maglev] Fix negate 0 with smi feedback 2022-12-22 16:36:23 +00:00
omit-default-ctors-array-iterator.js [maglev] Omit calling default ctors 2022-09-28 11:02:44 +00:00
omit-default-ctors.js [maglev] Omit calling default ctors 2022-09-28 11:02:44 +00:00
osr-from-ml-to-tf.js [maglev] Fix osr-from-ml-to-tf flake again 2022-09-01 08:03:22 +00:00
osr-to-tf.js [maglev] Don't trigger TF OSR before TF 2022-10-11 13:21:48 +00:00
regress-1403324.js [maglev] Fix reuse of property load for unstable maps 2022-12-23 15:14:57 +00:00
regress-1405092.js [maglev] Fix ProtoApply with spread call 2023-01-09 09:31:45 +00:00
regress-1406456.js [maglev] Fix CheckJSDataViewBounds clobbered argument 2023-01-11 14:42:46 +00:00
regress-1407606.js [maglev] Fix visiting stack in StackGuard call 2023-01-17 10:27:40 +00:00
resumable.js [maglev] Drop values flowing into resumable loops 2022-12-19 18:52:19 +00:00
set-pending-message.js [cleanup] Remove --stress-opt remnants 2022-08-31 08:37:44 +00:00
shift-right-logical-smi.js Reland "[maglev] Deopt on overflow in >>>" 2022-09-08 09:16:46 +00:00
shift-right-logical.js Reland "[maglev] Deopt on overflow in >>>" 2022-09-08 09:16:46 +00:00
shift-right-smi.js Reland "[maglev] Deopt on overflow in >>>" 2022-09-08 09:16:46 +00:00
shift-right.js Reland "[maglev] Deopt on overflow in >>>" 2022-09-08 09:16:46 +00:00
simple-inlining.js [cleanup] Remove --stress-opt remnants 2022-08-31 08:37:44 +00:00
spill-double.js [cleanup] Remove --stress-opt remnants 2022-08-31 08:37:44 +00:00
sta-module-variable.mjs [cleanup] Remove --stress-opt remnants 2022-08-31 08:37:44 +00:00
string-at.js [maglev] Add fast path for strings in element access 2022-10-17 14:45:35 +00:00
string-compare.js [cleanup] Remove --stress-opt remnants 2022-08-31 08:37:44 +00:00
super-ic.js [cleanup] Remove --stress-opt remnants 2022-08-31 08:37:44 +00:00
throw-in-cstr.js [maglev] Fix exception phi for receiver in constructors 2022-10-13 13:46:18 +00:00
tier-to-ml-to-tf.js [cleanup] Remove --stress-opt remnants 2022-08-31 08:37:44 +00:00
typedarray-resizablearraybuffer.js [maglev] Consider DataView/TypedArray backed by RAB and GSAB 2023-01-10 10:51:07 +00:00
undefined-or-null-branch.js [cleanup] Remove --stress-opt remnants 2022-08-31 08:37:44 +00:00
unstable-map-transition.js [maglev] Stable maps can become stale after a side effect 2022-10-26 09:39:59 +00:00