deps: patch V8 to 9.0.257.17

Refs: v8/v8@9.0.257.16...9.0.257.17 PR-URL: #38237 Reviewed-By: Rich Trott <[email protected]> Reviewed-By: Beth Griggs <[email protected]> Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: James M Snell <[email protected]>

Author: targos

deps/v8/include/v8-version.h

@@ -11,7 +11,7 @@
 #defineV8_MAJOR_VERSION 9
 #defineV8_MINOR_VERSION 0
 #defineV8_BUILD_NUMBER 257
-#defineV8_PATCH_LEVEL16
+#defineV8_PATCH_LEVEL17
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)

deps/v8/src/compiler/backend/x64/instruction-selector-x64.cc

@@ -1396,7 +1396,9 @@ void InstructionSelector::VisitChangeInt32ToInt64(Node* node){
  opcode = load_rep.IsSigned() ? kX64Movsxwq : kX64Movzxwq;
 break;
 case MachineRepresentation::kWord32:
- opcode = load_rep.IsSigned() ? kX64Movsxlq : kX64Movl;
+// ChangeInt32ToInt64 must interpret its input as a _signed_ 32-bit
+// integer, so here we must sign-extend the loaded value in any case.
+ opcode = kX64Movsxlq;
 break;
 default:
 UNREACHABLE();

deps/v8/test/mjsunit/compiler/regress-1196683.js

@@ -0,0 +1,56 @@
+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+
+(function(){
+constarr=newUint32Array([2**31]);
+functionfoo(){
+return(arr[0]^0)+1;
+}
+%PrepareFunctionForOptimization(foo);
+assertEquals(-(2**31)+1,foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(-(2**31)+1,foo());
+});
+
+
+// The remaining tests already passed without the bugfix.
+
+
+(function(){
+constarr=newUint16Array([2**15]);
+functionfoo(){
+return(arr[0]^0)+1;
+}
+%PrepareFunctionForOptimization(foo);
+assertEquals(2**15+1,foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(2**15+1,foo());
+})();
+
+
+(function(){
+constarr=newUint8Array([2**7]);
+functionfoo(){
+return(arr[0]^0)+1;
+}
+%PrepareFunctionForOptimization(foo);
+assertEquals(2**7+1,foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(2**7+1,foo());
+})();
+
+
+(function(){
+constarr=newInt32Array([-(2**31)]);
+functionfoo(){
+return(arr[0]>>>0)+1;
+}
+%PrepareFunctionForOptimization(foo);
+assertEquals(2**31+1,foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(2**31+1,foo());
+})();