[v16.x] deps: V8: Fix incorrect from space committed size

common.gypi

@@ -36,7 +36,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.22',
+    'v8_embedder_string': '-node.24',
 
     ##### V8 defaults for Node.js #####
 

deps/v8/src/extensions/statistics-extension.cc

@@ -124,36 +124,41 @@ void StatisticsExtension::GetCounters(
 
   AddNumber64(args.GetIsolate(), result, heap->external_memory(),
               "amount_of_external_allocated_memory");
-  args.GetReturnValue().Set(result);
 
-  DisallowGarbageCollection no_gc;
-  HeapObjectIterator iterator(
-      reinterpret_cast<Isolate*>(args.GetIsolate())->heap());
   int reloc_info_total = 0;
   int source_position_table_total = 0;
-  for (HeapObject obj = iterator.Next(); !obj.is_null();
-       obj = iterator.Next()) {
-    Object maybe_source_positions;
-    if (obj.IsCode()) {
-      Code code = Code::cast(obj);
-      reloc_info_total += code.relocation_info().Size();
-      maybe_source_positions = code.source_position_table();
-    } else if (obj.IsBytecodeArray()) {
-      maybe_source_positions =
-          BytecodeArray::cast(obj).source_position_table(kAcquireLoad);
-    } else {
-      continue;
+  {
+    HeapObjectIterator iterator(
+        reinterpret_cast<Isolate*>(args.GetIsolate())->heap());
+    DCHECK(!AllowGarbageCollection::IsAllowed());
+    for (HeapObject obj = iterator.Next(); !obj.is_null();
+         obj = iterator.Next()) {
+      Object maybe_source_positions;
+      if (obj.IsCode()) {
+        Code code = Code::cast(obj);
+        reloc_info_total += code.relocation_info().Size();
+        // Baseline code doesn't have source positions since it uses
+        // interpreter code positions.
+        if (code.kind() == CodeKind::BASELINE) continue;
+        maybe_source_positions = code.source_position_table();
+      } else if (obj.IsBytecodeArray()) {
+        maybe_source_positions =
+            BytecodeArray::cast(obj).source_position_table(kAcquireLoad);
+      } else {
+        continue;
+      }
+      if (!maybe_source_positions.IsByteArray()) continue;
+      ByteArray source_positions = ByteArray::cast(maybe_source_positions);
+      if (source_positions.length() == 0) continue;
+      source_position_table_total += source_positions.Size();
     }
-    if (!maybe_source_positions.IsByteArray()) continue;
-    ByteArray source_positions = ByteArray::cast(maybe_source_positions);
-    if (source_positions.length() == 0) continue;
-    source_position_table_total += source_positions.Size();
   }
 
   AddNumber(args.GetIsolate(), result, reloc_info_total,
             "reloc_info_total_size");
   AddNumber(args.GetIsolate(), result, source_position_table_total,
             "source_position_table_total_size");
+  args.GetReturnValue().Set(result);
 }
 
 }  // namespace internal

deps/v8/src/flags/flag-definitions.h

@@ -1390,6 +1390,7 @@ DEFINE_STRING(expose_gc_as, nullptr,
 DEFINE_IMPLICATION(expose_gc_as, expose_gc)
 DEFINE_BOOL(expose_externalize_string, false,
             "expose externalize string extension")
+DEFINE_BOOL(expose_statistics, false, "expose statistics extension")
 DEFINE_BOOL(expose_trigger_failure, false, "expose trigger-failure extension")
 DEFINE_BOOL(expose_ignition_statistics, false,
             "expose ignition-statistics extension (requires building with "

deps/v8/src/heap/new-spaces.cc

@@ -54,6 +54,7 @@ bool SemiSpace::EnsureCurrentCapacity() {
     // Free all overallocated pages which are behind current_page.
     while (current_page) {
       MemoryChunk* next_current = current_page->list_node().next();
+      AccountUncommitted(Page::kPageSize);
       memory_chunk_list_.Remove(current_page);
       // Clear new space flags to avoid this page being treated as a new
       // space page that is potentially being swept.
@@ -74,6 +75,7 @@ bool SemiSpace::EnsureCurrentCapacity() {
               NOT_EXECUTABLE);
       if (current_page == nullptr) return false;
       DCHECK_NOT_NULL(current_page);
+      AccountCommitted(Page::kPageSize);
       memory_chunk_list_.PushBack(current_page);
       marking_state->ClearLiveness(current_page);
       current_page->SetFlags(first_page()->GetFlags(),
@@ -106,6 +108,7 @@ void SemiSpace::TearDown() {
 
 bool SemiSpace::Commit() {
   DCHECK(!IsCommitted());
+  DCHECK_EQ(CommittedMemory(), size_t(0));
   const int num_pages = static_cast<int>(target_capacity_ / Page::kPageSize);
   DCHECK(num_pages);
   for (int pages_added = 0; pages_added < num_pages; pages_added++) {
@@ -134,14 +137,19 @@ bool SemiSpace::Commit() {
 
 bool SemiSpace::Uncommit() {
   DCHECK(IsCommitted());
+  int actual_pages = 0;
   while (!memory_chunk_list_.Empty()) {
+    actual_pages++;
     MemoryChunk* chunk = memory_chunk_list_.front();
     memory_chunk_list_.Remove(chunk);
     heap()->memory_allocator()->Free<MemoryAllocator::kPooledAndQueue>(chunk);
   }
   current_page_ = nullptr;
   current_capacity_ = 0;
-  AccountUncommitted(target_capacity_);
+  size_t removed_page_size =
+      static_cast<size_t>(actual_pages * Page::kPageSize);
+  DCHECK_EQ(CommittedMemory(), removed_page_size);
+  AccountUncommitted(removed_page_size);
   heap()->memory_allocator()->unmapper()->FreeQueuedChunks();
   DCHECK(!IsCommitted());
   return true;
@@ -246,6 +254,7 @@ void SemiSpace::RemovePage(Page* page) {
     }
   }
   memory_chunk_list_.Remove(page);
+  AccountUncommitted(Page::kPageSize);
   for (size_t i = 0; i < ExternalBackingStoreType::kNumTypes; i++) {
     ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
     DecrementExternalBackingStoreBytes(t, page->ExternalBackingStoreBytes(t));
@@ -258,6 +267,7 @@ void SemiSpace::PrependPage(Page* page) {
   page->set_owner(this);
   memory_chunk_list_.PushFront(page);
   current_capacity_ += Page::kPageSize;
+  AccountCommitted(Page::kPageSize);
   for (size_t i = 0; i < ExternalBackingStoreType::kNumTypes; i++) {
     ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
     IncrementExternalBackingStoreBytes(t, page->ExternalBackingStoreBytes(t));
@@ -319,6 +329,7 @@ void SemiSpace::Verify() {
     external_backing_store_bytes[static_cast<ExternalBackingStoreType>(i)] = 0;
   }
 
+  int actual_pages = 0;
   for (Page* page : *this) {
     CHECK_EQ(page->owner(), this);
     CHECK(page->InNewSpace());
@@ -344,7 +355,11 @@ void SemiSpace::Verify() {
 
     CHECK_IMPLIES(page->list_node().prev(),
                   page->list_node().prev()->list_node().next() == page);
+
+    actual_pages++;
   }
+  CHECK_EQ(actual_pages * size_t(Page::kPageSize), CommittedMemory());
+
   for (int i = 0; i < kNumTypes; i++) {
     ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
     CHECK_EQ(external_backing_store_bytes[t], ExternalBackingStoreBytes(t));

deps/v8/src/init/bootstrapper.cc

@@ -5089,7 +5089,7 @@ bool Genesis::InstallExtensions(Isolate* isolate,
           InstallExtension(isolate, "v8/gc", &extension_states)) &&
          (!FLAG_expose_externalize_string ||
           InstallExtension(isolate, "v8/externalize", &extension_states)) &&
-         (!TracingFlags::is_gc_stats_enabled() ||
+         (!(FLAG_expose_statistics || TracingFlags::is_gc_stats_enabled()) ||
           InstallExtension(isolate, "v8/statistics", &extension_states)) &&
          (!FLAG_expose_trigger_failure ||
           InstallExtension(isolate, "v8/trigger-failure", &extension_states)) &&

deps/v8/test/mjsunit/regress/regress-12657.js

@@ -0,0 +1,11 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --gc-global --expose-statistics --max-semi-space-size=1
+
+const a = new Array();
+for (var i = 0; i < 50000; i++) {
+  a[i] = new Object();
+}
+assertTrue(getV8Statistics().new_space_commited_bytes <= 2 * 1024 * 1024);

deps/v8/test/mjsunit/statistics-extension.js

@@ -0,0 +1,12 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-statistics
+
+assertEquals(typeof getV8Statistics, 'function');
+var result = getV8Statistics();
+assertEquals(typeof result, 'object');
+for (let key of Object.keys(result)) {
+  assertEquals(typeof result[key], 'number');
+}