From 9b5180c4256330974e6d9f6158f2ca83887b0222 Mon Sep 17 00:00:00 2001 From: inoway46 Date: Wed, 14 Oct 2026 22:49:47 +0900 Subject: [PATCH] deps: V8: cherry-pick 497c2e6a2434 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Original commit message: [heap] Always decrement age in RetainMaps() When the prototype and constructor were already marked we did not age the map because of the assumption that this would only keep the transition tree alive. However, this does not hold because of the JSFunctions inside an AccessorPair in DescriptorArray. This can result in retaining maps indefinitely when not triggering memory reducing GCs. This CL therefore simplifies the code to always age maps instead. This is neutral on Speedometer and Jetstream. Bug: 571157135 Change-Id: I8fb633a0ec0c1d66e4596390ca48e1c7006c9cc2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8557820 Commit-Queue: Dominik Inführ Reviewed-by: Michael Lippautz Cr-Commit-Position: refs/heads/main@{#110622} Fixes: https://github.com/nodejs/node/issues/66490 Refs: https://github.com/v8/v8/commit/497c2e6a2434af02b44417b55b1576702922f5e9 Assisted-by: Codex Signed-off-by: inoway46 --- common.gypi | 2 +- deps/v8/src/heap/mark-compact.cc | 12 +----------- 2 files changed, 2 insertions(+), 12 deletions(-) diff --git a/common.gypi b/common.gypi index 39229ef58787..2967d1e63a48 100644 --- a/common.gypi +++ b/common.gypi @@ -44,7 +44,7 @@ # Reset this number to 0 on major V8 upgrades. # Increment by one for each non-official patch applied to deps/v8. - 'v8_embedder_string': '-node.39', + 'v8_embedder_string': '-node.40', ##### V8 defaults for Node.js ##### diff --git a/deps/v8/src/heap/mark-compact.cc b/deps/v8/src/heap/mark-compact.cc index 90bf197a8c76..adf8f97f3b54 100644 --- a/deps/v8/src/heap/mark-compact.cc +++ b/deps/v8/src/heap/mark-compact.cc @@ -2536,17 +2536,7 @@ void MarkCompactCollector::RetainMaps() { MarkingHelper::WorklistTarget::kRegular, map); } } - Tagged prototype = map->prototype(); - if (age > 0 && IsHeapObject(prototype) && - MarkingHelper::IsUnmarkedAndNotAlwaysLive( - heap_, marking_state_, Cast(prototype))) { - // The prototype is not marked, age the map. - new_age = age - 1; - } else { - // The prototype and the constructor are marked, this map keeps only - // transition tree alive, not JSObjects. Do not age the map. - new_age = age; - } + new_age = age > 0 ? age - 1 : 0; } else { new_age = v8_flags.retain_maps_for_n_gc; }