deps: update V8 to 6.3.292.46

PR-URL: https://github.com/nodejs/node/pull/16271
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Myles Borins <myles.borins@gmail.com>

5 files changed, 70 insertions, 31 deletions

diff --git a/deps/v8/src/asmjs/asm-js.cc b/deps/v8/src/asmjs/asm-js.cc
index 2017bf6f3e..97da2c2af2 100644
--- a/deps/v8/src/asmjs/asm-js.cc
+++ b/deps/v8/src/asmjs/asm-js.cc
@@ -21,11 +21,11 @@
 #include "src/parsing/scanner-character-streams.h"
 #include "src/parsing/scanner.h"
 
+#include "src/wasm/module-compiler.h"
 #include "src/wasm/module-decoder.h"
 #include "src/wasm/wasm-js.h"
 #include "src/wasm/wasm-module-builder.h"
-#include "src/wasm/wasm-module.h"
-#include "src/wasm/wasm-objects.h"
+#include "src/wasm/wasm-objects-inl.h"
 #include "src/wasm/wasm-result.h"
 
 namespace v8 {
@@ -248,8 +248,7 @@ CompilationJob::Status AsmJsCompilationJob::ExecuteJobImpl() {
     allow_deref.emplace();
 
     DCHECK(!compilation_info()->isolate()->has_pending_exception());
-    ReportCompilationFailure(compilation_info()->script(),
-                             parser.failure_location(),
+    ReportCompilationFailure(parse_info()->script(), parser.failure_location(),
                              parser.failure_message());
     return FAILED;
   }
@@ -268,6 +267,21 @@ CompilationJob::Status AsmJsCompilationJob::ExecuteJobImpl() {
       ->asm_wasm_translation_peak_memory_bytes()
       ->AddSample(static_cast<int>(translate_zone_size));
   translate_time_ = translate_timer.Elapsed().InMillisecondsF();
+  int module_size = compilation_info()->literal()->end_position() -
+                    compilation_info()->literal()->start_position();
+  compilation_info()->isolate()->counters()->asm_module_size_bytes()->AddSample(
+      module_size);
+  int64_t translate_time_micro = translate_timer.Elapsed().InMicroseconds();
+  int translation_throughput =
+      translate_time_micro != 0
+          ? static_cast<int>(static_cast<int64_t>(module_size) /
+                             translate_time_micro)
+          : 0;
+  compilation_info()
+      ->isolate()
+      ->counters()
+      ->asm_wasm_translation_throughput()
+      ->AddSample(translation_throughput);
   if (FLAG_trace_asm_parser) {
     PrintF(
         "[asm.js translation successful: time=%0.3fms, "
@@ -291,7 +305,7 @@ CompilationJob::Status AsmJsCompilationJob::FinalizeJobImpl() {
       SyncCompileTranslatedAsmJs(
           compilation_info()->isolate(), &thrower,
           wasm::ModuleWireBytes(module_->begin(), module_->end()),
-          compilation_info()->script(),
+          parse_info()->script(),
           Vector<const byte>(asm_offsets_->begin(), asm_offsets_->size()))
           .ToHandleChecked();
   DCHECK(!thrower.error());
@@ -307,7 +321,7 @@ CompilationJob::Status AsmJsCompilationJob::FinalizeJobImpl() {
   compilation_info()->SetCode(
       BUILTIN_CODE(compilation_info()->isolate(), InstantiateAsmJs));
 
-  ReportCompilationSuccess(compilation_info()->script(),
+  ReportCompilationSuccess(parse_info()->script(),
                            compilation_info()->literal()->position(),
                            translate_time_, compile_time_, module_->size());
   return SUCCEEDED;
diff --git a/deps/v8/src/asmjs/asm-parser.cc b/deps/v8/src/asmjs/asm-parser.cc
index b5d852fbe4..d0eb1050f6 100644
--- a/deps/v8/src/asmjs/asm-parser.cc
+++ b/deps/v8/src/asmjs/asm-parser.cc
@@ -12,8 +12,9 @@
 #include "src/asmjs/asm-js.h"
 #include "src/asmjs/asm-types.h"
 #include "src/base/optional.h"
-#include "src/objects-inl.h"  // TODO(mstarzinger): Temporary cycle breaker.
+#include "src/flags.h"
 #include "src/parsing/scanner.h"
+#include "src/wasm/wasm-limits.h"
 #include "src/wasm/wasm-opcodes.h"
 
 namespace v8 {
@@ -103,13 +104,15 @@ void AsmJsParser::InitializeStdlibTypes() {
   stdlib_dqdq2d_->AsFunctionType()->AddArgument(dq);
 
   auto* f = AsmType::Float();
+  auto* fh = AsmType::Floatish();
   auto* fq = AsmType::FloatQ();
-  stdlib_fq2f_ = AsmType::Function(zone(), f);
-  stdlib_fq2f_->AsFunctionType()->AddArgument(fq);
+  auto* fq2fh = AsmType::Function(zone(), fh);
+  fq2fh->AsFunctionType()->AddArgument(fq);
 
   auto* s = AsmType::Signed();
-  auto* s2s = AsmType::Function(zone(), s);
-  s2s->AsFunctionType()->AddArgument(s);
+  auto* u = AsmType::Unsigned();
+  auto* s2u = AsmType::Function(zone(), u);
+  s2u->AsFunctionType()->AddArgument(s);
 
   auto* i = AsmType::Int();
   stdlib_i2s_ = AsmType::Function(zone_, s);
@@ -119,24 +122,36 @@ void AsmJsParser::InitializeStdlibTypes() {
   stdlib_ii2s_->AsFunctionType()->AddArgument(i);
   stdlib_ii2s_->AsFunctionType()->AddArgument(i);
 
+  // The signatures in "9 Standard Library" of the spec draft are outdated and
+  // have been superseded with the following by an errata:
+  //  - Math.min/max : (signed, signed...) -> signed
+  //                   (double, double...) -> double
+  //                   (float, float...) -> float
   auto* minmax_d = AsmType::MinMaxType(zone(), d, d);
-  // *VIOLATION* The float variant is not part of the spec, but firefox accepts
-  // it.
   auto* minmax_f = AsmType::MinMaxType(zone(), f, f);
-  auto* minmax_i = AsmType::MinMaxType(zone(), s, i);
+  auto* minmax_s = AsmType::MinMaxType(zone(), s, s);
   stdlib_minmax_ = AsmType::OverloadedFunction(zone());
-  stdlib_minmax_->AsOverloadedFunctionType()->AddOverload(minmax_i);
+  stdlib_minmax_->AsOverloadedFunctionType()->AddOverload(minmax_s);
   stdlib_minmax_->AsOverloadedFunctionType()->AddOverload(minmax_f);
   stdlib_minmax_->AsOverloadedFunctionType()->AddOverload(minmax_d);
 
+  // The signatures in "9 Standard Library" of the spec draft are outdated and
+  // have been superseded with the following by an errata:
+  //  - Math.abs : (signed) -> unsigned
+  //               (double?) -> double
+  //               (float?) -> floatish
   stdlib_abs_ = AsmType::OverloadedFunction(zone());
-  stdlib_abs_->AsOverloadedFunctionType()->AddOverload(s2s);
+  stdlib_abs_->AsOverloadedFunctionType()->AddOverload(s2u);
   stdlib_abs_->AsOverloadedFunctionType()->AddOverload(stdlib_dq2d_);
-  stdlib_abs_->AsOverloadedFunctionType()->AddOverload(stdlib_fq2f_);
+  stdlib_abs_->AsOverloadedFunctionType()->AddOverload(fq2fh);
 
+  // The signatures in "9 Standard Library" of the spec draft are outdated and
+  // have been superseded with the following by an errata:
+  //  - Math.ceil/floor/sqrt : (double?) -> double
+  //                           (float?) -> floatish
   stdlib_ceil_like_ = AsmType::OverloadedFunction(zone());
   stdlib_ceil_like_->AsOverloadedFunctionType()->AddOverload(stdlib_dq2d_);
-  stdlib_ceil_like_->AsOverloadedFunctionType()->AddOverload(stdlib_fq2f_);
+  stdlib_ceil_like_->AsOverloadedFunctionType()->AddOverload(fq2fh);
 
   stdlib_fround_ = AsmType::FroundType(zone());
 }
@@ -767,6 +782,11 @@ void AsmJsParser::ValidateFunction() {
     current_function_builder_->AddLocal(kWasmI32);
   }
 
+  // Check against limit on number of local variables.
+  if (locals.size() + function_temp_locals_used_ > kV8MaxWasmFunctionLocals) {
+    FAIL("Number of local variables exceeds internal limit");
+  }
+
   // End function
   current_function_builder_->Emit(kExprEnd);
 
@@ -852,6 +872,7 @@ void AsmJsParser::ValidateFunctionParams(ZoneVector<AsmType*>* params) {
 // 6.4 ValidateFunction - locals
 void AsmJsParser::ValidateFunctionLocals(size_t param_count,
                                          ZoneVector<ValueType>* locals) {
+  DCHECK(locals->empty());
   // Local Variables.
   while (Peek(TOK(var))) {
     scanner_.EnterLocalScope();
@@ -2200,12 +2221,18 @@ AsmType* AsmJsParser::ValidateCall() {
     } else if (callable->CanBeInvokedWith(AsmType::Float(),
                                           param_specific_types)) {
       return_type = AsmType::Float();
+    } else if (callable->CanBeInvokedWith(AsmType::Floatish(),
+                                          param_specific_types)) {
+      return_type = AsmType::Floatish();
     } else if (callable->CanBeInvokedWith(AsmType::Double(),
                                           param_specific_types)) {
       return_type = AsmType::Double();
     } else if (callable->CanBeInvokedWith(AsmType::Signed(),
                                           param_specific_types)) {
       return_type = AsmType::Signed();
+    } else if (callable->CanBeInvokedWith(AsmType::Unsigned(),
+                                          param_specific_types)) {
+      return_type = AsmType::Unsigned();
     } else {
       FAILn("Function use doesn't match definition");
     }
@@ -2248,7 +2275,7 @@ AsmType* AsmJsParser::ValidateCall() {
               current_function_builder_->Emit(kExprF32Max);
             }
           }
-        } else if (param_specific_types[0]->IsA(AsmType::Int())) {
+        } else if (param_specific_types[0]->IsA(AsmType::Signed())) {
           TemporaryVariableScope tmp_x(this);
           TemporaryVariableScope tmp_y(this);
           for (size_t i = 1; i < param_specific_types.size(); ++i) {
@@ -2275,14 +2302,13 @@ AsmType* AsmJsParser::ValidateCall() {
         if (param_specific_types[0]->IsA(AsmType::Signed())) {
           TemporaryVariableScope tmp(this);
           current_function_builder_->EmitTeeLocal(tmp.get());
-          current_function_builder_->Emit(kExprI32Clz);
-          current_function_builder_->EmitWithU8(kExprIf, kLocalI32);
           current_function_builder_->EmitGetLocal(tmp.get());
-          current_function_builder_->Emit(kExprElse);
-          current_function_builder_->EmitI32Const(0);
+          current_function_builder_->EmitI32Const(31);
+          current_function_builder_->Emit(kExprI32ShrS);
+          current_function_builder_->EmitTeeLocal(tmp.get());
+          current_function_builder_->Emit(kExprI32Xor);
           current_function_builder_->EmitGetLocal(tmp.get());
           current_function_builder_->Emit(kExprI32Sub);
-          current_function_builder_->Emit(kExprEnd);
         } else if (param_specific_types[0]->IsA(AsmType::DoubleQ())) {
           current_function_builder_->Emit(kExprF64Abs);
         } else if (param_specific_types[0]->IsA(AsmType::FloatQ())) {
@@ -2293,12 +2319,9 @@ AsmType* AsmJsParser::ValidateCall() {
         break;
 
       case VarKind::kMathFround:
-        if (param_specific_types[0]->IsA(AsmType::DoubleQ())) {
-          current_function_builder_->Emit(kExprF32ConvertF64);
-        } else {
-          DCHECK(param_specific_types[0]->IsA(AsmType::FloatQ()));
-        }
-        break;
+        // NOTE: Handled in {AsmJsParser::CallExpression} specially and treated
+        // as a coercion to "float" type. Cannot be reached as a call here.
+        UNREACHABLE();
 
       default:
         UNREACHABLE();
diff --git a/deps/v8/src/asmjs/asm-parser.h b/deps/v8/src/asmjs/asm-parser.h
index 1b0539ee38..bddb8c62e9 100644
--- a/deps/v8/src/asmjs/asm-parser.h
+++ b/deps/v8/src/asmjs/asm-parser.h
@@ -183,7 +183,6 @@ class AsmJsParser {
   // Types used for stdlib function and their set up.
   AsmType* stdlib_dq2d_;
   AsmType* stdlib_dqdq2d_;
-  AsmType* stdlib_fq2f_;
   AsmType* stdlib_i2s_;
   AsmType* stdlib_ii2s_;
   AsmType* stdlib_minmax_;
diff --git a/deps/v8/src/asmjs/asm-scanner.cc b/deps/v8/src/asmjs/asm-scanner.cc
index 5d2c8b1fd1..fe9cabf9d6 100644
--- a/deps/v8/src/asmjs/asm-scanner.cc
+++ b/deps/v8/src/asmjs/asm-scanner.cc
@@ -203,6 +203,7 @@ std::string AsmJsScanner::Name(token_t token) const {
     SPECIAL_TOKEN_LIST(V)
     default:
       break;
+#undef V
   }
   UNREACHABLE();
 }
diff --git a/deps/v8/src/asmjs/switch-logic.cc b/deps/v8/src/asmjs/switch-logic.cc
index 93544da9b4..e12b3a33f1 100644
--- a/deps/v8/src/asmjs/switch-logic.cc
+++ b/deps/v8/src/asmjs/switch-logic.cc
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include <algorithm>
+
 #include "src/asmjs/switch-logic.h"
 
 namespace v8 {