diff --git a/common.gypi b/common.gypi index 5a240673eadb1a..b5b2d9b5fade2e 100644 --- a/common.gypi +++ b/common.gypi @@ -36,7 +36,7 @@ # Reset this number to 0 on major V8 upgrades. # Increment by one for each non-official patch applied to deps/v8. - 'v8_embedder_string': '-node.16', + 'v8_embedder_string': '-node.15', ##### V8 defaults for Node.js ##### diff --git a/deps/v8/src/api/api.cc b/deps/v8/src/api/api.cc index 28f0389258cc95..a7070c494c211b 100644 --- a/deps/v8/src/api/api.cc +++ b/deps/v8/src/api/api.cc @@ -8953,6 +8953,9 @@ std::unique_ptr v8::ArrayBuffer::NewBackingStore( // static std::unique_ptr v8::ArrayBuffer::NewResizableBackingStore( size_t byte_length, size_t max_byte_length) { + Utils::ApiCheck(i::v8_flags.harmony_rab_gsab, + "v8::ArrayBuffer::NewResizableBackingStore", + "Constructing resizable ArrayBuffers is not supported"); Utils::ApiCheck(byte_length <= max_byte_length, "v8::ArrayBuffer::NewResizableBackingStore", "Cannot construct resizable ArrayBuffer, byte_length must be " diff --git a/deps/v8/src/builtins/builtins-arraybuffer.cc b/deps/v8/src/builtins/builtins-arraybuffer.cc index 02e77b797a681b..fbaf98b4c75bd8 100644 --- a/deps/v8/src/builtins/builtins-arraybuffer.cc +++ b/deps/v8/src/builtins/builtins-arraybuffer.cc @@ -134,16 +134,18 @@ BUILTIN(ArrayBufferConstructor) { } Handle number_max_length; - Handle max_length; - Handle options = args.atOrUndefined(isolate, 2); - ASSIGN_RETURN_FAILURE_ON_EXCEPTION( - isolate, max_length, - JSObject::ReadFromOptionsBag( - options, isolate->factory()->max_byte_length_string(), isolate)); + if (v8_flags.harmony_rab_gsab) { + Handle max_length; + Handle options = args.atOrUndefined(isolate, 2); + ASSIGN_RETURN_FAILURE_ON_EXCEPTION( + isolate, max_length, + JSObject::ReadFromOptionsBag( + options, isolate->factory()->max_byte_length_string(), isolate)); - if (!IsUndefined(*max_length, isolate)) { - ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, number_max_length, - Object::ToInteger(isolate, max_length)); + if (!IsUndefined(*max_length, isolate)) { + ASSIGN_RETURN_FAILURE_ON_EXCEPTION( + isolate, number_max_length, Object::ToInteger(isolate, max_length)); + } } return ConstructBuffer(isolate, target, new_target, number_length, number_max_length, InitializedFlag::kZeroInitialized); diff --git a/deps/v8/src/compiler/heap-refs.cc b/deps/v8/src/compiler/heap-refs.cc index 14eeba9e7e2962..e31c586757b855 100644 --- a/deps/v8/src/compiler/heap-refs.cc +++ b/deps/v8/src/compiler/heap-refs.cc @@ -1127,7 +1127,7 @@ bool MapRef::CanInlineElementAccess() const { (Is64() || (kind != BIGINT64_ELEMENTS && kind != BIGUINT64_ELEMENTS))) { return true; } - if (IsRabGsabTypedArrayElementsKind(kind) && + if (v8_flags.turbo_rab_gsab && IsRabGsabTypedArrayElementsKind(kind) && kind != RAB_GSAB_BIGUINT64_ELEMENTS && kind != RAB_GSAB_BIGINT64_ELEMENTS) { return true; diff --git a/deps/v8/src/compiler/js-call-reducer.cc b/deps/v8/src/compiler/js-call-reducer.cc index 5e947298f995f1..87b31d6dfc01bc 100644 --- a/deps/v8/src/compiler/js-call-reducer.cc +++ b/deps/v8/src/compiler/js-call-reducer.cc @@ -7552,7 +7552,7 @@ Reduction JSCallReducer::ReduceArrayBufferViewByteLengthAccessor( } } - if (!maybe_rab_gsab) { + if (!v8_flags.harmony_rab_gsab || !maybe_rab_gsab) { // We do not perform any change depending on this inference. Reduction unused_reduction = inference.NoChange(); USE(unused_reduction); @@ -7561,6 +7561,8 @@ Reduction JSCallReducer::ReduceArrayBufferViewByteLengthAccessor( node, JS_TYPED_ARRAY_TYPE, AccessBuilder::ForJSArrayBufferViewByteLength(), Builtin::kTypedArrayPrototypeByteLength); + } else if (!v8_flags.turbo_rab_gsab) { + return inference.NoChange(); } const CallParameters& p = CallParametersOf(node->op()); @@ -7611,7 +7613,7 @@ Reduction JSCallReducer::ReduceTypedArrayPrototypeLength(Node* node) { if (IsRabGsabTypedArrayElementsKind(kind)) maybe_rab_gsab = true; } - if (!maybe_rab_gsab) { + if (!v8_flags.harmony_rab_gsab || !maybe_rab_gsab) { // We do not perform any change depending on this inference. Reduction unused_reduction = inference.NoChange(); USE(unused_reduction); @@ -7619,6 +7621,8 @@ Reduction JSCallReducer::ReduceTypedArrayPrototypeLength(Node* node) { return ReduceArrayBufferViewAccessor(node, JS_TYPED_ARRAY_TYPE, AccessBuilder::ForJSTypedArrayLength(), Builtin::kTypedArrayPrototypeLength); + } else if (!v8_flags.turbo_rab_gsab) { + return inference.NoChange(); } if (!inference.RelyOnMapsViaStability(dependencies())) { diff --git a/deps/v8/src/compiler/js-native-context-specialization.cc b/deps/v8/src/compiler/js-native-context-specialization.cc index 092d71be89a174..2066b3f101e8b9 100644 --- a/deps/v8/src/compiler/js-native-context-specialization.cc +++ b/deps/v8/src/compiler/js-native-context-specialization.cc @@ -3199,6 +3199,8 @@ JSNativeContextSpecialization::BuildElementAccess( // TODO(bmeurer): We currently specialize based on elements kind. We should // also be able to properly support strings and other JSObjects here. ElementsKind elements_kind = access_info.elements_kind(); + DCHECK_IMPLIES(IsRabGsabTypedArrayElementsKind(elements_kind), + v8_flags.turbo_rab_gsab); ZoneVector const& receiver_maps = access_info.lookup_start_object_maps(); @@ -3584,6 +3586,8 @@ JSNativeContextSpecialization:: KeyedAccessMode const& keyed_mode) { DCHECK(IsTypedArrayElementsKind(elements_kind) || IsRabGsabTypedArrayElementsKind(elements_kind)); + DCHECK_IMPLIES(IsRabGsabTypedArrayElementsKind(elements_kind), + v8_flags.turbo_rab_gsab); // AccessMode::kDefine is not handled here. Optimization should be skipped by // caller. DCHECK(keyed_mode.access_mode() != AccessMode::kDefine); diff --git a/deps/v8/src/flags/flag-definitions.h b/deps/v8/src/flags/flag-definitions.h index 0d50ac1522ef87..98a8f1d15d7ddd 100644 --- a/deps/v8/src/flags/flag-definitions.h +++ b/deps/v8/src/flags/flag-definitions.h @@ -280,6 +280,8 @@ DEFINE_BOOL(js_shipping, true, "enable all shipped JavaScript features") V(js_regexp_modifiers, "RegExp modifiers") \ V(js_regexp_duplicate_named_groups, "RegExp duplicate named groups") +DEFINE_WEAK_IMPLICATION(harmony_rab_gsab_transfer, harmony_rab_gsab) + #ifdef V8_INTL_SUPPORT #define HARMONY_STAGED(V) HARMONY_STAGED_BASE(V) #define JAVASCRIPT_STAGED_FEATURES(V) JAVASCRIPT_STAGED_FEATURES_BASE(V) @@ -291,8 +293,11 @@ DEFINE_BOOL(js_shipping, true, "enable all shipped JavaScript features") // Features that are shipping (turned on by default, but internal flag remains). #define HARMONY_SHIPPING_BASE(V) \ V(harmony_import_assertions, "harmony import assertions") \ + V(harmony_rab_gsab, \ + "harmony ResizableArrayBuffer / GrowableSharedArrayBuffer") \ V(harmony_regexp_unicode_sets, "harmony RegExp Unicode Sets") \ V(harmony_json_parse_with_source, "harmony json parse with source") \ + V(harmony_rab_gsab_transfer, "harmony ArrayBuffer.transfer") \ V(harmony_array_grouping, "harmony array grouping") \ V(harmony_array_from_async, "harmony Array.fromAsync") \ V(harmony_iterator_helpers, "JavaScript iterator helpers") \ @@ -1273,6 +1278,9 @@ DEFINE_BOOL_READONLY(turbo_rewrite_far_jumps, false, "rewrite far to near jumps (ia32,x64)") #endif +DEFINE_BOOL( + turbo_rab_gsab, true, + "optimize ResizableArrayBuffer / GrowableSharedArrayBuffer in TurboFan") DEFINE_BOOL( stress_gc_during_compilation, false, "simulate GC/compiler thread race related to https://crbug.com/v8/8520") diff --git a/deps/v8/src/heap/factory.cc b/deps/v8/src/heap/factory.cc index 8cb79e1f39ee6d..c92a325e1344c5 100644 --- a/deps/v8/src/heap/factory.cc +++ b/deps/v8/src/heap/factory.cc @@ -3220,7 +3220,7 @@ Handle Factory::NewJSArrayBuffer( isolate()->native_context()->array_buffer_fun()->initial_map(), isolate()); ResizableFlag resizable_by_js = ResizableFlag::kNotResizable; - if (backing_store->is_resizable_by_js()) { + if (v8_flags.harmony_rab_gsab && backing_store->is_resizable_by_js()) { resizable_by_js = ResizableFlag::kResizable; } auto result = @@ -3276,6 +3276,8 @@ MaybeHandle Factory::NewJSArrayBufferAndBackingStore( Handle Factory::NewJSSharedArrayBuffer( std::shared_ptr backing_store) { + DCHECK_IMPLIES(backing_store->is_resizable_by_js(), + v8_flags.harmony_rab_gsab); Handle map( isolate()->native_context()->shared_array_buffer_fun()->initial_map(), isolate()); @@ -3381,6 +3383,7 @@ Handle Factory::NewJSTypedArray( ElementsKind elements_kind; JSTypedArray::ForFixedTypedArray(type, &element_size, &elements_kind); + CHECK_IMPLIES(is_length_tracking, v8_flags.harmony_rab_gsab); const bool is_backed_by_rab = buffer->is_resizable_by_js() && !buffer->is_shared(); @@ -3422,6 +3425,7 @@ Handle Factory::NewJSTypedArray( Handle Factory::NewJSDataViewOrRabGsabDataView( DirectHandle buffer, size_t byte_offset, size_t byte_length, bool is_length_tracking) { + CHECK_IMPLIES(is_length_tracking, v8_flags.harmony_rab_gsab); if (is_length_tracking) { // Security: enforce the invariant that length-tracking DataViews have their // byte_length set to 0. diff --git a/deps/v8/src/init/bootstrapper.cc b/deps/v8/src/init/bootstrapper.cc index 647f38943a600e..fffda5a44af739 100644 --- a/deps/v8/src/init/bootstrapper.cc +++ b/deps/v8/src/init/bootstrapper.cc @@ -4054,25 +4054,6 @@ void Genesis::InitializeGlobal(Handle global_object, "arrayBufferConstructor_DoNotInitialize"), Builtin::kArrayBufferConstructor_DoNotInitialize, 1, false); native_context()->set_array_buffer_noinit_fun(*array_buffer_noinit_fun); - - Handle array_buffer_prototype( - JSObject::cast(array_buffer_fun->instance_prototype()), isolate_); - SimpleInstallGetter(isolate_, array_buffer_prototype, - factory->max_byte_length_string(), - Builtin::kArrayBufferPrototypeGetMaxByteLength, false); - SimpleInstallGetter(isolate_, array_buffer_prototype, - factory->resizable_string(), - Builtin::kArrayBufferPrototypeGetResizable, false); - SimpleInstallFunction(isolate_, array_buffer_prototype, "resize", - Builtin::kArrayBufferPrototypeResize, 1, true); - SimpleInstallFunction(isolate_, array_buffer_prototype, "transfer", - Builtin::kArrayBufferPrototypeTransfer, 0, false); - SimpleInstallFunction( - isolate_, array_buffer_prototype, "transferToFixedLength", - Builtin::kArrayBufferPrototypeTransferToFixedLength, 0, false); - SimpleInstallGetter(isolate_, array_buffer_prototype, - factory->detached_string(), - Builtin::kArrayBufferPrototypeGetDetached, false); } { // -- S h a r e d A r r a y B u f f e r @@ -4082,19 +4063,6 @@ void Genesis::InitializeGlobal(Handle global_object, InstallWithIntrinsicDefaultProto(isolate_, shared_array_buffer_fun, Context::SHARED_ARRAY_BUFFER_FUN_INDEX); InstallSpeciesGetter(isolate_, shared_array_buffer_fun); - - Handle shared_array_buffer_prototype( - JSObject::cast(shared_array_buffer_fun->instance_prototype()), - isolate_); - SimpleInstallGetter(isolate_, shared_array_buffer_prototype, - factory->max_byte_length_string(), - Builtin::kSharedArrayBufferPrototypeGetMaxByteLength, - false); - SimpleInstallGetter(isolate_, shared_array_buffer_prototype, - factory->growable_string(), - Builtin::kSharedArrayBufferPrototypeGetGrowable, false); - SimpleInstallFunction(isolate_, shared_array_buffer_prototype, "grow", - Builtin::kSharedArrayBufferPrototypeGrow, 1, true); } { // -- A t o m i c s @@ -5332,6 +5300,7 @@ void Genesis::InitializeConsole(Handle extras_binding) { EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_import_assertions) EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_import_attributes) +EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_rab_gsab_transfer) EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(js_regexp_modifiers) EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(js_regexp_duplicate_named_groups) @@ -5799,6 +5768,46 @@ void Genesis::InitializeGlobal_regexp_linear_flag() { native_context()->set_regexp_prototype_map(regexp_prototype->map()); } +void Genesis::InitializeGlobal_harmony_rab_gsab() { + if (!v8_flags.harmony_rab_gsab) return; + Handle array_buffer_prototype( + JSObject::cast( + native_context()->array_buffer_fun()->instance_prototype()), + isolate()); + SimpleInstallGetter(isolate(), array_buffer_prototype, + factory()->max_byte_length_string(), + Builtin::kArrayBufferPrototypeGetMaxByteLength, false); + SimpleInstallGetter(isolate(), array_buffer_prototype, + factory()->resizable_string(), + Builtin::kArrayBufferPrototypeGetResizable, false); + SimpleInstallFunction(isolate(), array_buffer_prototype, "resize", + Builtin::kArrayBufferPrototypeResize, 1, true); + if (v8_flags.harmony_rab_gsab_transfer) { + SimpleInstallFunction(isolate(), array_buffer_prototype, "transfer", + Builtin::kArrayBufferPrototypeTransfer, 0, false); + SimpleInstallFunction( + isolate(), array_buffer_prototype, "transferToFixedLength", + Builtin::kArrayBufferPrototypeTransferToFixedLength, 0, false); + SimpleInstallGetter(isolate(), array_buffer_prototype, + factory()->detached_string(), + Builtin::kArrayBufferPrototypeGetDetached, false); + } + + Handle shared_array_buffer_prototype( + JSObject::cast( + native_context()->shared_array_buffer_fun()->instance_prototype()), + isolate()); + SimpleInstallGetter(isolate(), shared_array_buffer_prototype, + factory()->max_byte_length_string(), + Builtin::kSharedArrayBufferPrototypeGetMaxByteLength, + false); + SimpleInstallGetter(isolate(), shared_array_buffer_prototype, + factory()->growable_string(), + Builtin::kSharedArrayBufferPrototypeGetGrowable, false); + SimpleInstallFunction(isolate(), shared_array_buffer_prototype, "grow", + Builtin::kSharedArrayBufferPrototypeGrow, 1, true); +} + void Genesis::InitializeGlobal_harmony_temporal() { if (!v8_flags.harmony_temporal) return; diff --git a/deps/v8/src/objects/js-array-buffer.cc b/deps/v8/src/objects/js-array-buffer.cc index 2c439e5255740d..76c6b570bb65ce 100644 --- a/deps/v8/src/objects/js-array-buffer.cc +++ b/deps/v8/src/objects/js-array-buffer.cc @@ -177,6 +177,7 @@ size_t JSArrayBuffer::GsabByteLength(Isolate* isolate, Address raw_array_buffer) { // TODO(v8:11111): Cache the last seen length in JSArrayBuffer and use it // in bounds checks to minimize the need for calling this function. + DCHECK(v8_flags.harmony_rab_gsab); DisallowGarbageCollection no_gc; DisallowJavascriptExecution no_js(isolate); Tagged buffer = @@ -404,6 +405,7 @@ size_t JSTypedArray::LengthTrackingGsabBackedTypedArrayLength( Isolate* isolate, Address raw_array) { // TODO(v8:11111): Cache the last seen length in JSArrayBuffer and use it // in bounds checks to minimize the need for calling this function. + DCHECK(v8_flags.harmony_rab_gsab); DisallowGarbageCollection no_gc; DisallowJavascriptExecution no_js(isolate); Tagged array = JSTypedArray::cast(Tagged(raw_array)); diff --git a/deps/v8/src/objects/value-serializer.cc b/deps/v8/src/objects/value-serializer.cc index 4198d288c4a1b7..1c8f2fa9122e46 100644 --- a/deps/v8/src/objects/value-serializer.cc +++ b/deps/v8/src/objects/value-serializer.cc @@ -1009,6 +1009,7 @@ Maybe ValueSerializer::WriteJSArrayBufferView( ArrayBufferViewTag tag = ArrayBufferViewTag::kInt8Array; if (IsJSTypedArray(view)) { if (JSTypedArray::cast(view)->IsOutOfBounds()) { + DCHECK(v8_flags.harmony_rab_gsab); return ThrowDataCloneError(MessageTemplate::kDataCloneError, handle(view, isolate_)); } @@ -1024,6 +1025,7 @@ Maybe ValueSerializer::WriteJSArrayBufferView( DCHECK(IsJSDataViewOrRabGsabDataView(view)); if (IsJSRabGsabDataView(view) && JSRabGsabDataView::cast(view)->IsOutOfBounds()) { + DCHECK(v8_flags.harmony_rab_gsab); return ThrowDataCloneError(MessageTemplate::kDataCloneError, handle(view, isolate_)); } @@ -2103,6 +2105,13 @@ MaybeHandle ValueDeserializer::ReadJSArrayBuffer( if (byte_length > max_byte_length) { return MaybeHandle(); } + if (!v8_flags.harmony_rab_gsab) { + // Disable resizability. This ensures that no resizable buffers are + // created in a version which has the harmony_rab_gsab turned off, even if + // such a version is reading data containing resizable buffers from disk. + is_resizable = false; + max_byte_length = byte_length; + } } if (byte_length > static_cast(end_ - position_)) { return MaybeHandle(); @@ -2224,6 +2233,16 @@ bool ValueDeserializer::ValidateJSArrayBufferViewFlags( // TODO(marja): When the version number is bumped the next time, check that // serialized_flags doesn't contain spurious 1-bits. + if (!v8_flags.harmony_rab_gsab) { + // Disable resizability. This ensures that no resizable buffers are + // created in a version which has the harmony_rab_gsab turned off, even if + // such a version is reading data containing resizable buffers from disk. + is_length_tracking = false; + is_backed_by_rab = false; + // The resizability of the buffer was already disabled. + CHECK(!buffer->is_resizable_by_js()); + } + if (is_backed_by_rab || is_length_tracking) { if (!buffer->is_resizable_by_js()) { return false; diff --git a/deps/v8/test/cctest/test-api-array-buffer.cc b/deps/v8/test/cctest/test-api-array-buffer.cc index 87f7017f103a3a..975bb6e1b0d9d3 100644 --- a/deps/v8/test/cctest/test-api-array-buffer.cc +++ b/deps/v8/test/cctest/test-api-array-buffer.cc @@ -455,6 +455,8 @@ THREADED_TEST(ArrayBuffer_NewBackingStore) { } THREADED_TEST(ArrayBuffer_NewResizableBackingStore) { + FLAG_SCOPE(harmony_rab_gsab); + LocalContext env; v8::Isolate* isolate = env->GetIsolate(); v8::HandleScope handle_scope(isolate); @@ -829,6 +831,8 @@ TEST(BackingStore_ReallocateShared) { } TEST(ArrayBuffer_Resizable) { + FLAG_SCOPE(harmony_rab_gsab); + LocalContext env; v8::Isolate* isolate = env->GetIsolate(); v8::HandleScope handle_scope(isolate); @@ -850,6 +854,8 @@ TEST(ArrayBuffer_Resizable) { } TEST(ArrayBuffer_FixedLength) { + FLAG_SCOPE(harmony_rab_gsab); + LocalContext env; v8::Isolate* isolate = env->GetIsolate(); v8::HandleScope handle_scope(isolate); diff --git a/deps/v8/test/mjsunit/compiler/typedarray-resizablearraybuffer.js b/deps/v8/test/mjsunit/compiler/typedarray-resizablearraybuffer.js index da14f3aa878d38..4e96062e6d979e 100644 --- a/deps/v8/test/mjsunit/compiler/typedarray-resizablearraybuffer.js +++ b/deps/v8/test/mjsunit/compiler/typedarray-resizablearraybuffer.js @@ -2,7 +2,8 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax --turbofan --no-always-turbofan +// Flags: --harmony-rab-gsab --allow-natives-syntax --turbofan +// Flags: --no-always-turbofan --turbo-rab-gsab // Flags: --js-float16array "use strict"; diff --git a/deps/v8/test/mjsunit/dataview-growablesharedarraybuffer.js b/deps/v8/test/mjsunit/dataview-growablesharedarraybuffer.js index 6b7fc665a9efd1..afa47dce19e69e 100644 --- a/deps/v8/test/mjsunit/dataview-growablesharedarraybuffer.js +++ b/deps/v8/test/mjsunit/dataview-growablesharedarraybuffer.js @@ -2,7 +2,8 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax --js-float16array +// Flags: --harmony-rab-gsab --allow-natives-syntax +// Flags: --js-float16array "use strict"; diff --git a/deps/v8/test/mjsunit/dataview-resizablearraybuffer-detach.js b/deps/v8/test/mjsunit/dataview-resizablearraybuffer-detach.js index 55eb267aecc935..9024c0c2784f85 100644 --- a/deps/v8/test/mjsunit/dataview-resizablearraybuffer-detach.js +++ b/deps/v8/test/mjsunit/dataview-resizablearraybuffer-detach.js @@ -2,7 +2,8 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax --js-float16array +// Flags: --harmony-rab-gsab --allow-natives-syntax +// Flags: --js-float16array "use strict"; diff --git a/deps/v8/test/mjsunit/dataview-resizablearraybuffer.js b/deps/v8/test/mjsunit/dataview-resizablearraybuffer.js index 213a74c8835268..c47fc0628caf98 100644 --- a/deps/v8/test/mjsunit/dataview-resizablearraybuffer.js +++ b/deps/v8/test/mjsunit/dataview-resizablearraybuffer.js @@ -2,7 +2,8 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax --js-float16array +// Flags: --harmony-rab-gsab --allow-natives-syntax +// Flags: --js-float16array "use strict"; diff --git a/deps/v8/test/mjsunit/harmony/arraybuffer-transfer.js b/deps/v8/test/mjsunit/harmony/arraybuffer-transfer.js index cf4e0956d8566b..15932f4dd96b12 100644 --- a/deps/v8/test/mjsunit/harmony/arraybuffer-transfer.js +++ b/deps/v8/test/mjsunit/harmony/arraybuffer-transfer.js @@ -2,7 +2,7 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax +// Flags: --harmony-rab-gsab --harmony-rab-gsab-transfer --allow-natives-syntax function TestTransfer(method) { assertEquals(0, ArrayBuffer.prototype[method].length); diff --git a/deps/v8/test/mjsunit/harmony/typed-array-to-sorted.js b/deps/v8/test/mjsunit/harmony/typed-array-to-sorted.js index 87654d23115470..3f47c701b528d2 100644 --- a/deps/v8/test/mjsunit/harmony/typed-array-to-sorted.js +++ b/deps/v8/test/mjsunit/harmony/typed-array-to-sorted.js @@ -2,7 +2,9 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax --js-float16array +// Flags: --harmony-rab-gsab +// Flags: --allow-natives-syntax +// Flags: --js-float16array d8.file.execute('test/mjsunit/typedarray-helpers.js'); diff --git a/deps/v8/test/mjsunit/harmony/typedarray-to-reversed.js b/deps/v8/test/mjsunit/harmony/typedarray-to-reversed.js index 41254bf795b2f4..c97798d47c2262 100644 --- a/deps/v8/test/mjsunit/harmony/typedarray-to-reversed.js +++ b/deps/v8/test/mjsunit/harmony/typedarray-to-reversed.js @@ -2,7 +2,9 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax --js-float16array +// Flags: --harmony-rab-gsab +// Flags: --allow-natives-syntax +// Flags: --js-float16array d8.file.execute('test/mjsunit/typedarray-helpers.js'); diff --git a/deps/v8/test/mjsunit/harmony/typedarray-tostringtag.js b/deps/v8/test/mjsunit/harmony/typedarray-tostringtag.js index e5cf0b15688500..5eecc025215fcb 100644 --- a/deps/v8/test/mjsunit/harmony/typedarray-tostringtag.js +++ b/deps/v8/test/mjsunit/harmony/typedarray-tostringtag.js @@ -2,6 +2,7 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. +// Flags: --harmony-rab-gsab // Flags: --js-float16array d8.file.execute('test/mjsunit/typedarray-helpers.js'); diff --git a/deps/v8/test/mjsunit/harmony/typedarray-with.js b/deps/v8/test/mjsunit/harmony/typedarray-with.js index 9743fc2ad517fd..86019e018335cf 100644 --- a/deps/v8/test/mjsunit/harmony/typedarray-with.js +++ b/deps/v8/test/mjsunit/harmony/typedarray-with.js @@ -2,7 +2,9 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax --js-float16array +// Flags: --harmony-rab-gsab +// Flags: --allow-natives-syntax +// Flags: --js-float16array "use strict"; diff --git a/deps/v8/test/mjsunit/maglev/regress-1406456.js b/deps/v8/test/mjsunit/maglev/regress-1406456.js index df87ad080e69bc..5c6edf3e71a86f 100644 --- a/deps/v8/test/mjsunit/maglev/regress-1406456.js +++ b/deps/v8/test/mjsunit/maglev/regress-1406456.js @@ -2,7 +2,7 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. // -// Flags: --allow-natives-syntax --maglev +// Flags: --allow-natives-syntax --maglev --harmony-rab-gsab function foo() { const buffer = new SharedArrayBuffer(1395, { diff --git a/deps/v8/test/mjsunit/maglev/typedarray-resizablearraybuffer.js b/deps/v8/test/mjsunit/maglev/typedarray-resizablearraybuffer.js index 720a2f4d8c6bf8..2d3000ce0c7ee0 100644 --- a/deps/v8/test/mjsunit/maglev/typedarray-resizablearraybuffer.js +++ b/deps/v8/test/mjsunit/maglev/typedarray-resizablearraybuffer.js @@ -2,7 +2,9 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax --maglev --no-always-turbofan --js-float16array +// Flags: --harmony-rab-gsab --allow-natives-syntax --maglev +// Flags: --no-always-turbofan --turbo-rab-gsab +// Flags: --js-float16array "use strict"; diff --git a/deps/v8/test/mjsunit/rab-gsab-transfer-to-worker.js b/deps/v8/test/mjsunit/rab-gsab-transfer-to-worker.js index 0b4406acb0005b..ef27d1947a8df6 100644 --- a/deps/v8/test/mjsunit/rab-gsab-transfer-to-worker.js +++ b/deps/v8/test/mjsunit/rab-gsab-transfer-to-worker.js @@ -2,6 +2,8 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. +// Flags: --harmony-rab-gsab + (function TransferArrayBuffer() { function workerCode() { onmessage = function(msg) { diff --git a/deps/v8/test/mjsunit/rab-gsab-valueserializer.js b/deps/v8/test/mjsunit/rab-gsab-valueserializer.js index 971b3fddda5b04..f523648095f250 100644 --- a/deps/v8/test/mjsunit/rab-gsab-valueserializer.js +++ b/deps/v8/test/mjsunit/rab-gsab-valueserializer.js @@ -2,6 +2,8 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. +// Flags: --harmony-rab-gsab + "use strict"; (function FlagMismatch() { diff --git a/deps/v8/test/mjsunit/regress-1358505.js b/deps/v8/test/mjsunit/regress-1358505.js index 2ac457f036a108..8ac8c423ea1808 100644 --- a/deps/v8/test/mjsunit/regress-1358505.js +++ b/deps/v8/test/mjsunit/regress-1358505.js @@ -2,7 +2,7 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax +// Flags: --allow-natives-syntax --harmony-rab-gsab (function Test_OOB() { function f() { diff --git a/deps/v8/test/mjsunit/regress-crbug-1321980.js b/deps/v8/test/mjsunit/regress-crbug-1321980.js index b326e260eb73ca..0e65f5c15fe8ed 100644 --- a/deps/v8/test/mjsunit/regress-crbug-1321980.js +++ b/deps/v8/test/mjsunit/regress-crbug-1321980.js @@ -2,6 +2,8 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. +// Flags: --harmony-rab-gsab + try { // We're only testing these don't crash. It's platform-dependent which of them throw. new ArrayBuffer(1, {maxByteLength: 2147483647}); diff --git a/deps/v8/test/mjsunit/regress-crbug-1359991.js b/deps/v8/test/mjsunit/regress-crbug-1359991.js index b3939003190720..a64241dd0c6b1e 100644 --- a/deps/v8/test/mjsunit/regress-crbug-1359991.js +++ b/deps/v8/test/mjsunit/regress-crbug-1359991.js @@ -2,6 +2,8 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. +// Flags: --harmony-rab-gsab + "use strict"; const rab = new ArrayBuffer(1744, {"maxByteLength": 4000}); diff --git a/deps/v8/test/mjsunit/regress/regress-1380398.js b/deps/v8/test/mjsunit/regress/regress-1380398.js index f33ee6140e1ae9..a6f07ba0985783 100644 --- a/deps/v8/test/mjsunit/regress/regress-1380398.js +++ b/deps/v8/test/mjsunit/regress/regress-1380398.js @@ -2,7 +2,7 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax --turbofan +// Flags: --allow-natives-syntax --turbofan --harmony-rab-gsab function test() { const ab = new ArrayBuffer(2996, { maxByteLength: 8588995 }); diff --git a/deps/v8/test/mjsunit/regress/regress-1393942.js b/deps/v8/test/mjsunit/regress/regress-1393942.js index de8ea3406f92b4..724f17aaed1700 100644 --- a/deps/v8/test/mjsunit/regress/regress-1393942.js +++ b/deps/v8/test/mjsunit/regress/regress-1393942.js @@ -2,7 +2,7 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. // -// Flags: --allow-natives-syntax +// Flags: --harmony-rab-gsab --allow-natives-syntax const gsab = new SharedArrayBuffer(4,{"maxByteLength":8}); const u16arr = new Uint16Array(gsab); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1306929.js b/deps/v8/test/mjsunit/regress/regress-crbug-1306929.js index 17194f08b64bc4..35a1be73ed92ed 100644 --- a/deps/v8/test/mjsunit/regress/regress-crbug-1306929.js +++ b/deps/v8/test/mjsunit/regress/regress-crbug-1306929.js @@ -2,6 +2,8 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. +// Flags: --harmony-rab-gsab + const gsab = new SharedArrayBuffer(1024, {maxByteLength: 11337}); const ta = new Float64Array(gsab); Object.defineProperty(ta, 0, {}); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1307310.js b/deps/v8/test/mjsunit/regress/regress-crbug-1307310.js index 0963fa8b77e469..7a6325d1f043b8 100644 --- a/deps/v8/test/mjsunit/regress/regress-crbug-1307310.js +++ b/deps/v8/test/mjsunit/regress/regress-crbug-1307310.js @@ -1,6 +1,8 @@ // Copyright 2022 the V8 project authors. All rights reserved. // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. +// +// Flags: --harmony-rab-gsab const gsab = new SharedArrayBuffer(4, { maxByteLength: 8 diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1347721.js b/deps/v8/test/mjsunit/regress/regress-crbug-1347721.js index 437ab329943c62..77ebee539919a5 100644 --- a/deps/v8/test/mjsunit/regress/regress-crbug-1347721.js +++ b/deps/v8/test/mjsunit/regress/regress-crbug-1347721.js @@ -2,6 +2,8 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. +// Flags: --harmony-rab-gsab + for (let i = 0; i < 1000; i++) { const rab = new ArrayBuffer(1632, {"maxByteLength": 4096}); const ta1 = new Uint32Array(rab); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1347722.js b/deps/v8/test/mjsunit/regress/regress-crbug-1347722.js index cd0095445261cf..64b21130d0f7a1 100644 --- a/deps/v8/test/mjsunit/regress/regress-crbug-1347722.js +++ b/deps/v8/test/mjsunit/regress/regress-crbug-1347722.js @@ -2,6 +2,8 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. +// Flags: --harmony-rab-gsab + const proxy = new Proxy(Int16Array, {"get": () => { throw 'lol'; }}); const rab = new ArrayBuffer(1632, {"maxByteLength": 4096}); try { diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1362487.js b/deps/v8/test/mjsunit/regress/regress-crbug-1362487.js index 7532c80353ef66..388df981588898 100644 --- a/deps/v8/test/mjsunit/regress/regress-crbug-1362487.js +++ b/deps/v8/test/mjsunit/regress/regress-crbug-1362487.js @@ -2,6 +2,8 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. +// Flags: --harmony-rab-gsab + const rab1 = new ArrayBuffer(2000, {'maxByteLength': 4000}); class MyInt8Array extends Int8Array { constructor() { diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1377840.js b/deps/v8/test/mjsunit/regress/regress-crbug-1377840.js index 1b4be3f6046ac8..72666b9b743368 100644 --- a/deps/v8/test/mjsunit/regress/regress-crbug-1377840.js +++ b/deps/v8/test/mjsunit/regress/regress-crbug-1377840.js @@ -2,6 +2,8 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. +// Flags: --harmony-rab-gsab + const rab = new ArrayBuffer(3782, {maxByteLength: 4096}); const u16a = new Int16Array(rab); rab.resize(0); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1381064.js b/deps/v8/test/mjsunit/regress/regress-crbug-1381064.js index 454e8c0ce7cc21..e9368361f06fb4 100644 --- a/deps/v8/test/mjsunit/regress/regress-crbug-1381064.js +++ b/deps/v8/test/mjsunit/regress/regress-crbug-1381064.js @@ -2,6 +2,8 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. +// Flags: --harmony-rab-gsab + (function NonBigIntRegressionTest() { const rab = new ArrayBuffer(1050, {"maxByteLength": 2000}); const ta = new Uint8ClampedArray(rab); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1384474-variant2.js b/deps/v8/test/mjsunit/regress/regress-crbug-1384474-variant2.js index 197afe03cfd1e3..3076ffdfc7be20 100644 --- a/deps/v8/test/mjsunit/regress/regress-crbug-1384474-variant2.js +++ b/deps/v8/test/mjsunit/regress/regress-crbug-1384474-variant2.js @@ -2,6 +2,8 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. +// Flags: --harmony-rab-gsab + const rab1 = new ArrayBuffer(4, {"maxByteLength": 100}); const ta = new Int8Array(rab1); const rab2 = new ArrayBuffer(10, {"maxByteLength": 20}); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1384474-variant3.js b/deps/v8/test/mjsunit/regress/regress-crbug-1384474-variant3.js index 31c22523d5c2b7..54e7254193b9ce 100644 --- a/deps/v8/test/mjsunit/regress/regress-crbug-1384474-variant3.js +++ b/deps/v8/test/mjsunit/regress/regress-crbug-1384474-variant3.js @@ -2,6 +2,8 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. +// Flags: --harmony-rab-gsab + const rab1 = new ArrayBuffer(4, {"maxByteLength": 100}); const ta = new Int8Array(rab1); const rab2 = new ArrayBuffer(10, {"maxByteLength": 20}); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1384474.js b/deps/v8/test/mjsunit/regress/regress-crbug-1384474.js index 8ce9f696127e68..e64237e9c86501 100644 --- a/deps/v8/test/mjsunit/regress/regress-crbug-1384474.js +++ b/deps/v8/test/mjsunit/regress/regress-crbug-1384474.js @@ -2,6 +2,8 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. +// Flags: --harmony-rab-gsab + const ta = new Int8Array(4); const rab = new ArrayBuffer(10, {"maxByteLength": 20}); const lengthTracking = new Int8Array(rab); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1392577.js b/deps/v8/test/mjsunit/regress/regress-crbug-1392577.js index bc52e45dfc2013..97f08bec0839b7 100644 --- a/deps/v8/test/mjsunit/regress/regress-crbug-1392577.js +++ b/deps/v8/test/mjsunit/regress/regress-crbug-1392577.js @@ -2,6 +2,8 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. +// Flags: --harmony-rab-gsab + const rab = new ArrayBuffer(50, {"maxByteLength": 100}); const ta = new Int8Array(rab); const start = {}; diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1393375.js b/deps/v8/test/mjsunit/regress/regress-crbug-1393375.js index 7976b1cca7af37..aa300cf35cfd7d 100644 --- a/deps/v8/test/mjsunit/regress/regress-crbug-1393375.js +++ b/deps/v8/test/mjsunit/regress/regress-crbug-1393375.js @@ -2,6 +2,8 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. +// Flags: --harmony-rab-gsab + const rab = new ArrayBuffer(50, {"maxByteLength": 100}); const ta = new Int8Array(rab); const evil = {}; diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1399799.js b/deps/v8/test/mjsunit/regress/regress-crbug-1399799.js index 1247302b1e2ac9..70fdcea09eb808 100644 --- a/deps/v8/test/mjsunit/regress/regress-crbug-1399799.js +++ b/deps/v8/test/mjsunit/regress/regress-crbug-1399799.js @@ -1,8 +1,8 @@ // Copyright 2022 the V8 project authors. All rights reserved. // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. - -// Flags: --allow-natives-syntax +// +// Flags: --harmony-rab-gsab --allow-natives-syntax const ab = new ArrayBuffer(3000); const ta = new Uint16Array(ab); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1402139.js b/deps/v8/test/mjsunit/regress/regress-crbug-1402139.js index d4cc07f5c5fb01..ce2ca5eef5af24 100644 --- a/deps/v8/test/mjsunit/regress/regress-crbug-1402139.js +++ b/deps/v8/test/mjsunit/regress/regress-crbug-1402139.js @@ -1,6 +1,8 @@ // Copyright 2022 the V8 project authors. All rights reserved. // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. +// +// Flags: --harmony-rab-gsab const rab = new ArrayBuffer(363, {"maxByteLength": 1000}); const ta = new Uint8Array(rab); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1412001.js b/deps/v8/test/mjsunit/regress/regress-crbug-1412001.js index dd91d3dcf9c839..c40d0559dcf811 100644 --- a/deps/v8/test/mjsunit/regress/regress-crbug-1412001.js +++ b/deps/v8/test/mjsunit/regress/regress-crbug-1412001.js @@ -1,8 +1,8 @@ // Copyright 2023 the V8 project authors. All rights reserved. // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. - -// Flags: --allow-natives-syntax +// +// Flags: --harmony-rab-gsab --allow-natives-syntax --turbo-rab-gsab const ab = new ArrayBuffer(100, {maxByteLength: 200}); var dv = new DataView(ab, 0, 8); // "var" is important diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1454650.js b/deps/v8/test/mjsunit/regress/regress-crbug-1454650.js index 1ee497b78d7d6f..6294d7b49b1765 100644 --- a/deps/v8/test/mjsunit/regress/regress-crbug-1454650.js +++ b/deps/v8/test/mjsunit/regress/regress-crbug-1454650.js @@ -2,6 +2,8 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. +// Flags: --harmony-rab-gsab + const gsab = new SharedArrayBuffer(100, {maxByteLength: 200}); const ta = new Int8Array(1); class c extends Int8Array { diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1459172.js b/deps/v8/test/mjsunit/regress/regress-crbug-1459172.js index c3a8b414424ee9..00dd4124049320 100644 --- a/deps/v8/test/mjsunit/regress/regress-crbug-1459172.js +++ b/deps/v8/test/mjsunit/regress/regress-crbug-1459172.js @@ -2,6 +2,8 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. +// Flags: --harmony-rab-gsab + { const rab = new ArrayBuffer(1, {maxByteLength: 2}); const ta = new Int8Array(rab, 0, 1); diff --git a/deps/v8/test/mjsunit/resizablearraybuffer-growablesharedarraybuffer.js b/deps/v8/test/mjsunit/resizablearraybuffer-growablesharedarraybuffer.js index a75079ac1a5b6a..d5f99c5d9ea158 100644 --- a/deps/v8/test/mjsunit/resizablearraybuffer-growablesharedarraybuffer.js +++ b/deps/v8/test/mjsunit/resizablearraybuffer-growablesharedarraybuffer.js @@ -2,7 +2,8 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax --js-float16array +// Flags: --harmony-rab-gsab --allow-natives-syntax +// Flags: --js-float16array "use strict"; diff --git a/deps/v8/test/mjsunit/typedarray-growablesharedarraybuffer-array-methods.js b/deps/v8/test/mjsunit/typedarray-growablesharedarraybuffer-array-methods.js index 079ef5932a29a7..83976decbf1608 100644 --- a/deps/v8/test/mjsunit/typedarray-growablesharedarraybuffer-array-methods.js +++ b/deps/v8/test/mjsunit/typedarray-growablesharedarraybuffer-array-methods.js @@ -2,7 +2,8 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax --js-float16array +// Flags: --harmony-rab-gsab --allow-natives-syntax +// Flags: --js-float16array 'use strict'; diff --git a/deps/v8/test/mjsunit/typedarray-growablesharedarraybuffer-atomics.js b/deps/v8/test/mjsunit/typedarray-growablesharedarraybuffer-atomics.js index 96daf3ca4500b8..0516e70e7d6004 100644 --- a/deps/v8/test/mjsunit/typedarray-growablesharedarraybuffer-atomics.js +++ b/deps/v8/test/mjsunit/typedarray-growablesharedarraybuffer-atomics.js @@ -2,7 +2,8 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax --js-float16array +// Flags: --harmony-rab-gsab --allow-natives-syntax +// Flags: --js-float16array "use strict"; diff --git a/deps/v8/test/mjsunit/typedarray-growablesharedarraybuffer.js b/deps/v8/test/mjsunit/typedarray-growablesharedarraybuffer.js index 14922468aa3d6c..ea896ecd254015 100644 --- a/deps/v8/test/mjsunit/typedarray-growablesharedarraybuffer.js +++ b/deps/v8/test/mjsunit/typedarray-growablesharedarraybuffer.js @@ -2,7 +2,8 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax --harmony-array-find-last --js-float16array +// Flags: --harmony-rab-gsab --allow-natives-syntax --harmony-array-find-last +// Flags: --js-float16array "use strict"; diff --git a/deps/v8/test/mjsunit/typedarray-resizablearraybuffer-array-methods.js b/deps/v8/test/mjsunit/typedarray-resizablearraybuffer-array-methods.js index 717519bb701069..8c03583e6ea1e7 100644 --- a/deps/v8/test/mjsunit/typedarray-resizablearraybuffer-array-methods.js +++ b/deps/v8/test/mjsunit/typedarray-resizablearraybuffer-array-methods.js @@ -2,7 +2,8 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax --js-float16array +// Flags: --harmony-rab-gsab --allow-natives-syntax +// Flags: --js-float16array 'use strict'; diff --git a/deps/v8/test/mjsunit/typedarray-resizablearraybuffer-atomics.js b/deps/v8/test/mjsunit/typedarray-resizablearraybuffer-atomics.js index 9a5a37fdd0c424..62c0321d588370 100644 --- a/deps/v8/test/mjsunit/typedarray-resizablearraybuffer-atomics.js +++ b/deps/v8/test/mjsunit/typedarray-resizablearraybuffer-atomics.js @@ -2,7 +2,8 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax --js-float16array +// Flags: --harmony-rab-gsab --allow-natives-syntax +// Flags: --js-float16array "use strict"; diff --git a/deps/v8/test/mjsunit/typedarray-resizablearraybuffer-detach.js b/deps/v8/test/mjsunit/typedarray-resizablearraybuffer-detach.js index 48c790ab560536..9489d961e84bc6 100644 --- a/deps/v8/test/mjsunit/typedarray-resizablearraybuffer-detach.js +++ b/deps/v8/test/mjsunit/typedarray-resizablearraybuffer-detach.js @@ -2,7 +2,8 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax --js-float16array +// Flags: --harmony-rab-gsab --allow-natives-syntax --harmony-array-find-last +// Flags: --js-float16array "use strict"; diff --git a/deps/v8/test/mjsunit/typedarray-resizablearraybuffer.js b/deps/v8/test/mjsunit/typedarray-resizablearraybuffer.js index ddd0313ba664d4..69ad5647cf44a7 100644 --- a/deps/v8/test/mjsunit/typedarray-resizablearraybuffer.js +++ b/deps/v8/test/mjsunit/typedarray-resizablearraybuffer.js @@ -2,7 +2,9 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. -// Flags: --allow-natives-syntax --harmony-array-find-last --js-float16array +// Flags: --harmony-rab-gsab --allow-natives-syntax +// Flags: --harmony-array-find-last +// Flags: --js-float16array "use strict"; diff --git a/deps/v8/test/mjsunit/wasm/resizablearraybuffer-growablesharedarraybuffer-wasm.js b/deps/v8/test/mjsunit/wasm/resizablearraybuffer-growablesharedarraybuffer-wasm.js index fa8a411bd870d8..9c545e966d2570 100644 --- a/deps/v8/test/mjsunit/wasm/resizablearraybuffer-growablesharedarraybuffer-wasm.js +++ b/deps/v8/test/mjsunit/wasm/resizablearraybuffer-growablesharedarraybuffer-wasm.js @@ -2,6 +2,8 @@ // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. +// Flags: --harmony-rab-gsab + (function TestMemoryBufferNotResizable() { const m = new WebAssembly.Memory({ initial: 128 diff --git a/deps/v8/test/test262/testcfg.py b/deps/v8/test/test262/testcfg.py index ec4fad84078075..403e867739bbfe 100644 --- a/deps/v8/test/test262/testcfg.py +++ b/deps/v8/test/test262/testcfg.py @@ -48,6 +48,7 @@ 'host-gc-required': '--expose-gc-as=v8GC', 'IsHTMLDDA': '--allow-natives-syntax', 'import-assertions': '--harmony-import-assertions', + 'resizable-arraybuffer': '--harmony-rab-gsab-transfer', 'Temporal': '--harmony-temporal', 'array-find-from-last': '--harmony-array-find-last', 'ShadowRealm': '--harmony-shadow-realm', @@ -55,6 +56,7 @@ 'array-grouping': '--harmony-array-grouping', 'String.prototype.isWellFormed': '--harmony-string-is-well-formed', 'String.prototype.toWellFormed': '--harmony-string-is-well-formed', + 'arraybuffer-transfer': '--harmony-rab-gsab-transfer', 'json-parse-with-source': '--harmony-json-parse-with-source', 'iterator-helpers': '--harmony-iterator-helpers', 'set-methods': '--harmony-set-methods', diff --git a/deps/v8/test/unittests/objects/value-serializer-unittest.cc b/deps/v8/test/unittests/objects/value-serializer-unittest.cc index 9962490c2b93eb..0f5ce4c21e0783 100644 --- a/deps/v8/test/unittests/objects/value-serializer-unittest.cc +++ b/deps/v8/test/unittests/objects/value-serializer-unittest.cc @@ -1936,6 +1936,7 @@ TEST_F(ValueSerializerTest, RoundTripArrayBuffer) { } TEST_F(ValueSerializerTest, RoundTripResizableArrayBuffer) { + FLAG_SCOPE(harmony_rab_gsab); Local value = RoundTripTest("new ArrayBuffer(100, {maxByteLength: 200})"); ASSERT_TRUE(value->IsArrayBuffer()); @@ -1981,6 +1982,7 @@ TEST_F(ValueSerializerTest, DecodeInvalidArrayBuffer) { } TEST_F(ValueSerializerTest, DecodeInvalidResizableArrayBuffer) { + FLAG_SCOPE(harmony_rab_gsab); // Enough bytes available after reading the length, but not anymore when // reading the max byte length. InvalidDecodeTest({0xFF, 0x09, 0x7E, 0x2, 0x10, 0x00}); @@ -2134,6 +2136,7 @@ TEST_F(ValueSerializerTest, RoundTripTypedArray) { } TEST_F(ValueSerializerTest, RoundTripRabBackedLengthTrackingTypedArray) { + FLAG_SCOPE(harmony_rab_gsab); FLAG_SCOPE(js_float16array); // Check that the right type comes out the other side for every kind of typed // array. @@ -2159,6 +2162,7 @@ TEST_F(ValueSerializerTest, RoundTripRabBackedLengthTrackingTypedArray) { } TEST_F(ValueSerializerTest, RoundTripRabBackedNonLengthTrackingTypedArray) { + FLAG_SCOPE(harmony_rab_gsab); FLAG_SCOPE(js_float16array); // Check that the right type comes out the other side for every kind of typed // array. @@ -2535,6 +2539,8 @@ TEST_F(ValueSerializerTest, DecodeDataView) { } TEST_F(ValueSerializerTest, RoundTripRabBackedDataView) { + FLAG_SCOPE(harmony_rab_gsab); + Local value = RoundTripTest( "new DataView(new ArrayBuffer(4, {maxByteLength: 8}), 1, 2)"); ASSERT_TRUE(value->IsDataView()); @@ -2551,6 +2557,8 @@ TEST_F(ValueSerializerTest, RoundTripRabBackedDataView) { } TEST_F(ValueSerializerTest, RoundTripRabBackedLengthTrackingDataView) { + FLAG_SCOPE(harmony_rab_gsab); + Local value = RoundTripTest("new DataView(new ArrayBuffer(4, {maxByteLength: 8}), 1)"); ASSERT_TRUE(value->IsDataView());