8.4.371.13

bnoordhuis · Jun 9, 2020 · 9284a16 · 9284a16
1 parent c7fca06
commit 9284a16
Show file tree

Hide file tree

Showing 5 changed files with 19 additions and 5 deletions.
diff --git a/update_v8.json b/update_v8.json
@@ -1,7 +1,7 @@
 [
   {
     "url": "https://chromium.googlesource.com/v8/v8.git",
-    "commit": "fb3f7eaf9cef9d843f1cdeb96cb028fdd45371ee",
+    "commit": "8f633624af9608d36a67abe30a44b5ebb7bad932",
     "/* comment */": "Dependency v8 must be first.",
     "branch": "branch-heads/8.4",
     "path": "v8"

diff --git a/v8/include/v8-version.h b/v8/include/v8-version.h
@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 8
 #define V8_MINOR_VERSION 4
 #define V8_BUILD_NUMBER 371
-#define V8_PATCH_LEVEL 11
+#define V8_PATCH_LEVEL 13
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)

diff --git a/v8/src/builtins/builtins-string-gen.cc b/v8/src/builtins/builtins-string-gen.cc
@@ -1635,6 +1635,12 @@ TNode<JSArray> StringBuiltinsAssembler::StringToArray(
 
     ToDirectStringAssembler to_direct(state(), subject_string);
     to_direct.TryToDirect(&call_runtime);
+
+    // The extracted direct string may be two-byte even though the wrapping
+    // string is one-byte.
+    GotoIfNot(IsOneByteStringInstanceType(to_direct.instance_type()),
+              &call_runtime);
+
     TNode<FixedArray> elements = CAST(AllocateFixedArray(
         PACKED_ELEMENTS, length, AllocationFlag::kAllowLargeObjectAllocation));
     // Don't allocate anything while {string_data} is live!

diff --git a/v8/src/compiler/simd-scalar-lowering.cc b/v8/src/compiler/simd-scalar-lowering.cc
@@ -1635,8 +1635,16 @@ void SimdScalarLowering::LowerNode(Node* node) {
     case IrOpcode::kS1x16AllTrue: {
       DCHECK_EQ(1, node->InputCount());
       SimdType input_rep_type = ReplacementType(node->InputAt(0));
+      Node** rep;
+      // If the input is a SIMD float, bitcast it to a SIMD int of the same
+      // shape, because the comparisons below use Word32.
+      if (input_rep_type == SimdType::kFloat32x4) {
+        // TODO(v8:9418): f64x2 lowering is not implemented yet.
+        rep = GetReplacementsWithType(node->InputAt(0), SimdType::kInt32x4);
+      } else {
+        rep = GetReplacements(node->InputAt(0));
+      }
       int input_num_lanes = NumLanes(input_rep_type);
-      Node** rep = GetReplacements(node->InputAt(0));
       Node** rep_node = zone()->NewArray<Node*>(num_lanes);
       Node* true_node = mcgraph_->Int32Constant(1);
       Node* false_node = mcgraph_->Int32Constant(0);

diff --git a/v8/test/mjsunit/regress/wasm/regress-1081030.js b/v8/test/mjsunit/regress/wasm/regress-1081030.js
@@ -13,9 +13,9 @@ builder.addFunction(undefined, 0 /* sig */).addBodyWithEnd([
   // signature: i_iii
   // body:
   kExprF32Const, 0xf8, 0xf8, 0xf8, 0xf8,
-  kSimdPrefix, kExprF32x4Splat,         // i8x16.splat
+  kSimdPrefix, kExprF32x4Splat,         // f32x4.splat
   kExprF32Const, 0xf8, 0xf8, 0xf8, 0xf8,
-  kSimdPrefix, kExprF32x4Splat,         // i8x16.splat
+  kSimdPrefix, kExprF32x4Splat,         // f32x4.splat
   kSimdPrefix, kExprF32x4Min, 0x01,     // f32x4.min
   kSimdPrefix, kExprS1x4AnyTrue, 0x01,  // s1x4.any_true
   kExprEnd,                             // end @16