Repository navigation
Commit 0fc3c6b
committed
deps: V8: cherry-pick 7d5eb1df2a72
Backport the Maglev HeapNumber materialization fix to V8 14.6.
Use the existing offset constants and virtual-object slot traversal.
Original commit message:
[maglev] Materialize a fresh HeapNumber per deoptimization
This matches what Turbolev graph builder already does to Maglev.
Fixed: 547819997
Change-Id: Iafc1185ef96db8816db36b295a3a4b7e528f9863
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8255554
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#109347}
Refs: v8/v8@7d5eb1d
Refs: #66457
Refs: https://www.cve.org/CVERecord?id=CVE-2026-85045
Signed-off-by: inoway46 <inoueyuya416@gmail.com>
Assisted-by: Codex1 parent 41e9ab9 commit 0fc3c6b
4 files changed
Lines changed: 57 additions & 25 deletions
File tree
- deps/v8
- src/maglev
- test/mjsunit/maglev
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
44 | 44 | | |
45 | 45 | | |
46 | 46 | | |
47 | | - | |
| 47 | + | |
48 | 48 | | |
49 | 49 | | |
50 | 50 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1499 | 1499 | | |
1500 | 1500 | | |
1501 | 1501 | | |
1502 | | - | |
1503 | | - | |
1504 | | - | |
1505 | | - | |
1506 | | - | |
1507 | | - | |
1508 | | - | |
1509 | | - | |
1510 | | - | |
1511 | | - | |
1512 | | - | |
| 1502 | + | |
| 1503 | + | |
| 1504 | + | |
1513 | 1505 | | |
1514 | 1506 | | |
1515 | 1507 | | |
| |||
1564 | 1556 | | |
1565 | 1557 | | |
1566 | 1558 | | |
1567 | | - | |
1568 | | - | |
1569 | | - | |
1570 | | - | |
| 1559 | + | |
| 1560 | + | |
| 1561 | + | |
| 1562 | + | |
| 1563 | + | |
| 1564 | + | |
1571 | 1565 | | |
1572 | | - | |
| 1566 | + | |
| 1567 | + | |
| 1568 | + | |
1573 | 1569 | | |
1574 | 1570 | | |
1575 | 1571 | | |
| |||
1708 | 1704 | | |
1709 | 1705 | | |
1710 | 1706 | | |
1711 | | - | |
| 1707 | + | |
1712 | 1708 | | |
1713 | 1709 | | |
1714 | 1710 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
5622 | 5622 | | |
5623 | 5623 | | |
5624 | 5624 | | |
5625 | | - | |
5626 | | - | |
5627 | | - | |
5628 | | - | |
5629 | | - | |
| 5625 | + | |
| 5626 | + | |
| 5627 | + | |
5630 | 5628 | | |
5631 | 5629 | | |
5632 | 5630 | | |
| |||
5917 | 5915 | | |
5918 | 5916 | | |
5919 | 5917 | | |
5920 | | - | |
5921 | | - | |
| 5918 | + | |
| 5919 | + | |
5922 | 5920 | | |
5923 | 5921 | | |
5924 | 5922 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
| 1 | + | |
| 2 | + | |
| 3 | + | |
| 4 | + | |
| 5 | + | |
| 6 | + | |
| 7 | + | |
| 8 | + | |
| 9 | + | |
| 10 | + | |
| 11 | + | |
| 12 | + | |
| 13 | + | |
| 14 | + | |
| 15 | + | |
| 16 | + | |
| 17 | + | |
| 18 | + | |
| 19 | + | |
| 20 | + | |
| 21 | + | |
| 22 | + | |
| 23 | + | |
| 24 | + | |
| 25 | + | |
| 26 | + | |
| 27 | + | |
| 28 | + | |
| 29 | + | |
| 30 | + | |
| 31 | + | |
| 32 | + | |
| 33 | + | |
| 34 | + | |
| 35 | + | |
| 36 | + | |
| 37 | + | |
| 38 | + | |
0 commit comments