grpc 1.80.0 → 1.81.0

data/third_party/upb/upb/wire/encode.h

@@ -46,7 +46,8 @@ typedef enum {
   kUpb_EncodeStatus_OutOfMemory = 1,  // Arena alloc failed
   kUpb_EncodeStatus_MaxDepthExceeded = 2,
 
-  // kUpb_EncodeOption_CheckRequired failed but the parse otherwise succeeded.
+  // One or more required fields are missing. Only returned if
+  // kUpb_EncodeOption_CheckRequired is set.
   kUpb_EncodeStatus_MissingRequired = 3,
 } upb_EncodeStatus;
 // LINT.ThenChange(//depot/google3/third_party/protobuf/rust/upb.rs:encode_status)
@@ -55,15 +56,11 @@ UPB_INLINE uint32_t upb_EncodeOptions_MaxDepth(uint16_t depth) {
   return (uint32_t)depth << 16;
 }
 
-UPB_INLINE uint16_t upb_EncodeOptions_GetMaxDepth(uint32_t options) {
-  return options >> 16;
-}
-
 uint16_t upb_EncodeOptions_GetEffectiveMaxDepth(uint32_t options);
 
 // Enforce an upper bound on recursion depth.
 UPB_INLINE int upb_Encode_LimitDepth(uint32_t encode_options, uint32_t limit) {
-  uint32_t max_depth = upb_EncodeOptions_GetMaxDepth(encode_options);
+  uint32_t max_depth = upb_EncodeOptions_GetEffectiveMaxDepth(encode_options);
   if (max_depth > limit) max_depth = limit;
   return upb_EncodeOptions_MaxDepth(max_depth) | (encode_options & 0xffff);
 }

data/third_party/upb/upb/wire/eps_copy_input_stream.h

@@ -8,6 +8,7 @@
 #ifndef UPB_WIRE_EPS_COPY_INPUT_STREAM_H_
 #define UPB_WIRE_EPS_COPY_INPUT_STREAM_H_
 
+#include <stdint.h>
 #include <string.h>
 
 #include "upb/mem/arena.h"
@@ -24,16 +25,25 @@ extern "C" {
 // stream guarantees that after upb_EpsCopyInputStream_IsDone() is called,
 // the decoder can read this many bytes without performing another bounds
 // check.  The stream will copy into a patch buffer as necessary to guarantee
-// this invariant.
+// this invariant. Since tags can only be up to 5 bytes, and a max-length scalar
+// field can be 10 bytes, only 15 is required; but sizing up to 16 permits more
+// efficient fixed size copies.
 #define kUpb_EpsCopyInputStream_SlopBytes 16
 
 typedef struct {
   const char* end;        // Can read up to SlopBytes bytes beyond this.
   const char* limit_ptr;  // For bounds checks, = end + UPB_MIN(limit, 0)
   uintptr_t input_delta;  // Diff between the original input pointer and patch
-  int limit;   // Submessage limit relative to end
-  bool error;  // To distinguish between EOF and error.
+  const char* buffer_start;  // Pointer to the original input buffer
+  int limit;                 // Submessage limit relative to end
+  bool error;                // To distinguish between EOF and error.
   bool aliasing;
+#ifndef NDEBUG
+  int guaranteed_bytes;
+#endif
+  // Allocate double the size of what's required; this permits a fixed-size copy
+  // from the input buffer, regardless of how many bytes actually remain in the
+  // input buffer.
   char patch[kUpb_EpsCopyInputStream_SlopBytes * 2];
 } upb_EpsCopyInputStream;
 
@@ -50,12 +60,39 @@ typedef const char* upb_EpsCopyInputStream_BufferFlipCallback(
 typedef const char* upb_EpsCopyInputStream_IsDoneFallbackFunc(
     upb_EpsCopyInputStream* e, const char* ptr, int overrun);
 
+UPB_INLINE void UPB_PRIVATE(upb_EpsCopyInputStream_BoundsChecked)(
+    upb_EpsCopyInputStream* e) {
+#ifndef NDEBUG
+  e->guaranteed_bytes = kUpb_EpsCopyInputStream_SlopBytes;
+#endif
+}
+
+UPB_INLINE void UPB_PRIVATE(upb_EpsCopyInputStream_BoundsHit)(
+    upb_EpsCopyInputStream* e) {
+#ifndef NDEBUG
+  e->guaranteed_bytes = 0;
+#endif
+}
+
+// Signals the maximum number that the operation about to be performed may
+// consume.
+UPB_INLINE void UPB_PRIVATE(upb_EpsCopyInputStream_ConsumeBytes)(
+    upb_EpsCopyInputStream* e, int n) {
+#ifndef NDEBUG
+  if (e) {
+    UPB_ASSERT(e->guaranteed_bytes >= n);
+    e->guaranteed_bytes -= n;
+  }
+#endif
+}
+
 // Initializes a upb_EpsCopyInputStream using the contents of the buffer
 // [*ptr, size].  Updates `*ptr` as necessary to guarantee that at least
 // kUpb_EpsCopyInputStream_SlopBytes are available to read.
 UPB_INLINE void upb_EpsCopyInputStream_Init(upb_EpsCopyInputStream* e,
                                             const char** ptr, size_t size,
                                             bool enable_aliasing) {
+  e->buffer_start = *ptr;
   if (size <= kUpb_EpsCopyInputStream_SlopBytes) {
     memset(&e->patch, 0, 32);
     if (size) memcpy(&e->patch, *ptr, size);
@@ -71,6 +108,7 @@ UPB_INLINE void upb_EpsCopyInputStream_Init(upb_EpsCopyInputStream* e,
   e->aliasing = enable_aliasing;
   e->limit_ptr = e->end;
   e->error = false;
+  UPB_PRIVATE(upb_EpsCopyInputStream_BoundsChecked)(e);
 }
 
 typedef enum {
@@ -91,10 +129,13 @@ UPB_INLINE upb_IsDoneStatus upb_EpsCopyInputStream_IsDoneStatus(
     upb_EpsCopyInputStream* e, const char* ptr, int* overrun) {
   *overrun = ptr - e->end;
   if (UPB_LIKELY(ptr < e->limit_ptr)) {
+    UPB_PRIVATE(upb_EpsCopyInputStream_BoundsChecked)(e);
     return kUpb_IsDoneStatus_NotDone;
   } else if (UPB_LIKELY(*overrun == e->limit)) {
+    UPB_PRIVATE(upb_EpsCopyInputStream_BoundsHit)(e);
     return kUpb_IsDoneStatus_Done;
   } else {
+    UPB_PRIVATE(upb_EpsCopyInputStream_BoundsHit)(e);
     return kUpb_IsDoneStatus_NeedFallback;
   }
 }
@@ -112,11 +153,18 @@ UPB_INLINE bool upb_EpsCopyInputStream_IsDoneWithCallback(
   int overrun;
   switch (upb_EpsCopyInputStream_IsDoneStatus(e, *ptr, &overrun)) {
     case kUpb_IsDoneStatus_Done:
+      UPB_PRIVATE(upb_EpsCopyInputStream_BoundsHit)(e);
       return true;
     case kUpb_IsDoneStatus_NotDone:
+      UPB_PRIVATE(upb_EpsCopyInputStream_BoundsChecked)(e);
       return false;
     case kUpb_IsDoneStatus_NeedFallback:
       *ptr = func(e, *ptr, overrun);
+      if (*ptr) {
+        UPB_PRIVATE(upb_EpsCopyInputStream_BoundsChecked)(e);
+      } else {
+        UPB_PRIVATE(upb_EpsCopyInputStream_BoundsHit)(e);
+      }
       return *ptr == NULL;
   }
   UPB_UNREACHABLE();
@@ -159,7 +207,7 @@ UPB_INLINE size_t upb_EpsCopyInputStream_BytesAvailable(
 UPB_INLINE bool upb_EpsCopyInputStream_CheckSize(
     const upb_EpsCopyInputStream* e, const char* ptr, int size) {
   UPB_ASSERT(size >= 0);
-  return ptr - e->end + size <= e->limit;
+  return size <= e->limit - (ptr - e->end);
 }
 
 UPB_INLINE bool _upb_EpsCopyInputStream_CheckSizeAvailable(
@@ -230,7 +278,13 @@ UPB_INLINE bool upb_EpsCopyInputStream_AliasingAvailable(
 // be different if we are currently parsing out of the patch buffer.
 UPB_INLINE const char* upb_EpsCopyInputStream_GetInputPtr(
     upb_EpsCopyInputStream* e, const char* ptr) {
-  return (const char*)(((uintptr_t)ptr) + e->input_delta);
+  // This somewhat silly looking add-and-subtract behavior provides provenance
+  // from the original input buffer's pointer. After optimization it produces
+  // the same assembly as just casting `(uintptr_t)ptr+input_delta`
+  // https://godbolt.org/z/zosG88oPn
+  size_t position =
+      (uintptr_t)ptr + e->input_delta - (uintptr_t)e->buffer_start;
+  return e->buffer_start + position;
 }
 
 // Returns a pointer into an input buffer that corresponds to the parsing
@@ -357,7 +411,11 @@ UPB_INLINE const char* _upb_EpsCopyInputStream_IsDoneFallbackInline(
     e->limit_ptr = e->end + e->limit;
     UPB_ASSERT(ptr < e->limit_ptr);
     e->input_delta = (uintptr_t)old_end - (uintptr_t)new_start;
-    return callback(e, old_end, new_start);
+    const char* ret = callback(e, old_end, new_start);
+    if (ret) {
+      UPB_PRIVATE(upb_EpsCopyInputStream_BoundsChecked)(e);
+    }
+    return ret;
   } else {
     UPB_ASSERT(overrun > e->limit);
     e->error = true;

data/third_party/upb/upb/wire/internal/decoder.c

@@ -0,0 +1,43 @@
+// Protocol Buffers - Google's data interchange format
+// Copyright 2023 Google LLC.  All rights reserved.
+//
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file or at
+// https://developers.google.com/open-source/licenses/bsd
+
+#include "upb/wire/internal/decoder.h"
+
+#include "upb/message/internal/accessors.h"
+#include "upb/message/message.h"
+#include "upb/mini_table/message.h"
+#include "upb/wire/decode.h"
+#include "upb/wire/eps_copy_input_stream.h"
+
+// Must be last.
+#include "upb/port/def.inc"
+
+UPB_NOINLINE
+const char* _upb_Decoder_CheckRequired(upb_Decoder* d, const char* ptr,
+                                       const upb_Message* msg,
+                                       const upb_MiniTable* m) {
+  UPB_ASSERT(m->UPB_PRIVATE(required_count));
+  if (UPB_UNLIKELY(d->options & kUpb_DecodeOption_CheckRequired)) {
+    d->missing_required =
+        !UPB_PRIVATE(_upb_Message_IsInitializedShallow)(msg, m);
+  }
+  return ptr;
+}
+
+UPB_NORETURN void* _upb_Decoder_ErrorJmp(upb_Decoder* d,
+                                         upb_DecodeStatus status) {
+  UPB_ASSERT(status != kUpb_DecodeStatus_Ok);
+  d->status = status;
+  UPB_LONGJMP(d->err, 1);
+}
+
+UPB_NOINLINE
+const char* _upb_Decoder_IsDoneFallback(upb_EpsCopyInputStream* e,
+                                        const char* ptr, int overrun) {
+  return _upb_EpsCopyInputStream_IsDoneFallbackInline(
+      e, ptr, overrun, _upb_Decoder_BufferFlipCallback);
+}

data/third_party/upb/upb/wire/internal/decoder.h

@@ -13,10 +13,16 @@
 #ifndef UPB_WIRE_INTERNAL_DECODER_H_
 #define UPB_WIRE_INTERNAL_DECODER_H_
 
+#include <setjmp.h>
 #include <stddef.h>
+#include <stdint.h>
+#include <string.h>
 
+#include "upb/mem/arena.h"
 #include "upb/mem/internal/arena.h"
-#include "upb/message/internal/message.h"
+#include "upb/mini_table/extension_registry.h"
+#include "upb/mini_table/internal/message.h"
+#include "upb/mini_table/message.h"
 #include "upb/wire/decode.h"
 #include "upb/wire/eps_copy_input_stream.h"
 #include "utf8_range.h"
@@ -30,10 +36,11 @@ typedef struct upb_Decoder {
   upb_EpsCopyInputStream input;
   const upb_ExtensionRegistry* extreg;
   upb_Message* original_msg;  // Pointer to preserve data to
-  int depth;                 // Tracks recursion depth to bound stack usage.
+  int depth;                  // Tracks recursion depth to bound stack usage.
   uint32_t end_group;  // field number of END_GROUP tag, else DECODE_NOGROUP.
   uint16_t options;
   bool missing_required;
+  bool message_is_done;
   union {
     upb_Arena arena;
     void* foo[UPB_ARENA_SIZE_HACK];
@@ -44,19 +51,66 @@ typedef struct upb_Decoder {
 #ifndef NDEBUG
   const char* debug_tagstart;
   const char* debug_valstart;
+  char* trace_ptr;
+  char* trace_end;
 #endif
 } upb_Decoder;
 
-/* Error function that will abort decoding with longjmp(). We can't declare this
- * UPB_NORETURN, even though it is appropriate, because if we do then compilers
- * will "helpfully" refuse to tailcall to it
- * (see: https://stackoverflow.com/a/55657013), which will defeat a major goal
- * of our optimizations. That is also why we must declare it in a separate file,
- * otherwise the compiler will see that it calls longjmp() and deduce that it is
- * noreturn. */
-const char* _upb_FastDecoder_ErrorJmp(upb_Decoder* d, int status);
+UPB_INLINE const char* upb_Decoder_Init(upb_Decoder* d, const char* buf,
+                                        size_t size,
+                                        const upb_ExtensionRegistry* extreg,
+                                        int options, upb_Arena* arena,
+                                        char* trace_buf, size_t trace_size) {
+  upb_EpsCopyInputStream_Init(&d->input, &buf, size,
+                              options & kUpb_DecodeOption_AliasString);
+
+  d->extreg = extreg;
+  d->depth = upb_DecodeOptions_GetEffectiveMaxDepth(options);
+  d->end_group = DECODE_NOGROUP;
+  d->options = (uint16_t)options;
+  d->missing_required = false;
+  d->status = kUpb_DecodeStatus_Ok;
+  d->message_is_done = false;
+#ifndef NDEBUG
+  d->trace_ptr = trace_buf;
+  d->trace_end = UPB_PTRADD(trace_buf, trace_size);
+#endif
+  if (trace_buf) *trace_buf = 0;  // Null-terminate.
+
+  // Violating the encapsulation of the arena for performance reasons.
+  // This is a temporary arena that we swap into and swap out of when we are
+  // done.  The temporary arena only needs to be able to handle allocation,
+  // not fuse or free, so it does not need many of the members to be initialized
+  // (particularly parent_or_count).
+  UPB_PRIVATE(_upb_Arena_SwapIn)(&d->arena, arena);
+  return buf;
+}
+
+UPB_INLINE upb_DecodeStatus upb_Decoder_Destroy(upb_Decoder* d,
+                                                upb_Arena* arena) {
+  UPB_PRIVATE(_upb_Arena_SwapOut)(arena, &d->arena);
+  return d->status;
+}
 
-extern const uint8_t upb_utf8_offsets[];
+// Trace events are used to trace the progress of the decoder.
+// Events:
+//   'D'  Fast dispatch
+//   'F'  Field successfully parsed fast.
+//   '<'  Fallback to MiniTable parser.
+//   'M'  Field successfully parsed with MiniTable.
+//   'X'  Truncated -- trace buffer is full, further events were discarded.
+UPB_INLINE void _upb_Decoder_Trace(upb_Decoder* d, char event) {
+#ifndef NDEBUG
+  if (d->trace_ptr == NULL) return;
+  if (d->trace_ptr == d->trace_end - 1) {
+    d->trace_ptr[-1] = 'X';  // Truncated.
+    return;
+  }
+  d->trace_ptr[0] = event;
+  d->trace_ptr[1] = '\0';
+  d->trace_ptr++;
+#endif
+};
 
 UPB_INLINE
 bool _upb_Decoder_VerifyUtf8Inline(const char* ptr, int len) {
@@ -80,41 +134,25 @@ UPB_INLINE const upb_MiniTable* decode_totablep(intptr_t table) {
 const char* _upb_Decoder_IsDoneFallback(upb_EpsCopyInputStream* e,
                                         const char* ptr, int overrun);
 
+const char* _upb_Decoder_DecodeMessage(upb_Decoder* d, const char* ptr,
+                                       upb_Message* msg,
+                                       const upb_MiniTable* layout);
+
 UPB_INLINE bool _upb_Decoder_IsDone(upb_Decoder* d, const char** ptr) {
   return upb_EpsCopyInputStream_IsDoneWithCallback(
       &d->input, ptr, &_upb_Decoder_IsDoneFallback);
 }
 
+UPB_NORETURN void* _upb_Decoder_ErrorJmp(upb_Decoder* d,
+                                         upb_DecodeStatus status);
+
 UPB_INLINE const char* _upb_Decoder_BufferFlipCallback(
     upb_EpsCopyInputStream* e, const char* old_end, const char* new_start) {
   upb_Decoder* d = (upb_Decoder*)e;
-  if (!old_end) _upb_FastDecoder_ErrorJmp(d, kUpb_DecodeStatus_Malformed);
+  if (!old_end) _upb_Decoder_ErrorJmp(d, kUpb_DecodeStatus_Malformed);
   return new_start;
 }
 
-#if UPB_FASTTABLE
-UPB_INLINE
-const char* _upb_FastDecoder_TagDispatch(upb_Decoder* d, const char* ptr,
-                                         upb_Message* msg, intptr_t table,
-                                         uint64_t hasbits, uint64_t tag) {
-  const upb_MiniTable* table_p = decode_totablep(table);
-  uint8_t mask = table;
-  uint64_t data;
-  size_t idx = tag & mask;
-  UPB_ASSUME((idx & 7) == 0);
-  idx >>= 3;
-  data = table_p->UPB_PRIVATE(fasttable)[idx].field_data ^ tag;
-  UPB_MUSTTAIL return table_p->UPB_PRIVATE(fasttable)[idx].field_parser(
-      d, ptr, msg, table, hasbits, data);
-}
-#endif
-
-UPB_INLINE uint32_t _upb_FastDecoder_LoadTag(const char* ptr) {
-  uint16_t tag;
-  memcpy(&tag, ptr, 2);
-  return tag;
-}
-
 #include "upb/port/undef.inc"
 
 #endif /* UPB_WIRE_INTERNAL_DECODER_H_ */

data/third_party/upb/upb/wire/internal/reader.h

@@ -8,6 +8,11 @@
 #ifndef UPB_WIRE_INTERNAL_READER_H_
 #define UPB_WIRE_INTERNAL_READER_H_
 
+#include <stddef.h>
+#include <stdint.h>
+
+#include "upb/wire/eps_copy_input_stream.h"
+
 // Must be last.
 #include "upb/port/def.inc"
 
@@ -24,22 +29,36 @@ extern "C" {
 #endif
 
 UPB_PRIVATE(_upb_WireReader_LongVarint)
-UPB_PRIVATE(_upb_WireReader_ReadLongVarint)(const char* ptr, uint64_t val);
+UPB_PRIVATE(_upb_WireReader_ReadLongVarint32)(const char* ptr, uint32_t val);
+UPB_PRIVATE(_upb_WireReader_LongVarint)
+UPB_PRIVATE(_upb_WireReader_ReadLongVarint64)(const char* ptr, uint64_t val);
 
 UPB_FORCEINLINE const char* UPB_PRIVATE(_upb_WireReader_ReadVarint)(
-    const char* ptr, uint64_t* val, int maxlen, uint64_t maxval) {
-  uint64_t byte = (uint8_t)*ptr;
+    const char* ptr, uint64_t* val, upb_EpsCopyInputStream* stream) {
+  UPB_PRIVATE(upb_EpsCopyInputStream_ConsumeBytes)(stream, 10);
+  uint8_t byte = *ptr;
   if (UPB_LIKELY((byte & 0x80) == 0)) {
-    *val = (uint32_t)byte;
+    *val = byte;
     return ptr + 1;
   }
-  const char* start = ptr;
   UPB_PRIVATE(_upb_WireReader_LongVarint)
-  res = UPB_PRIVATE(_upb_WireReader_ReadLongVarint)(ptr, byte);
-  if (!res.ptr || (maxlen < 10 && res.ptr - start > maxlen) ||
-      res.val > maxval) {
-    return NULL;  // Malformed.
+  res = UPB_PRIVATE(_upb_WireReader_ReadLongVarint64)(ptr, byte);
+  if (UPB_UNLIKELY(!res.ptr)) return NULL;
+  *val = res.val;
+  return res.ptr;
+}
+
+UPB_FORCEINLINE const char* UPB_PRIVATE(_upb_WireReader_ReadTag)(
+    const char* ptr, uint32_t* val, upb_EpsCopyInputStream* stream) {
+  UPB_PRIVATE(upb_EpsCopyInputStream_ConsumeBytes)(stream, 5);
+  uint8_t byte = *ptr;
+  if (UPB_LIKELY((byte & 0x80) == 0)) {
+    *val = byte;
+    return ptr + 1;
   }
+  UPB_PRIVATE(_upb_WireReader_LongVarint)
+  res = UPB_PRIVATE(_upb_WireReader_ReadLongVarint32)(ptr, byte);
+  if (UPB_UNLIKELY(!res.ptr)) return NULL;
   *val = res.val;
   return res.ptr;
 }

data/third_party/upb/upb/wire/reader.c

@@ -17,7 +17,8 @@
 #include "upb/port/def.inc"
 
 UPB_NOINLINE UPB_PRIVATE(_upb_WireReader_LongVarint)
-    UPB_PRIVATE(_upb_WireReader_ReadLongVarint)(const char* ptr, uint64_t val) {
+    UPB_PRIVATE(_upb_WireReader_ReadLongVarint64)(const char* ptr,
+                                                  uint64_t val) {
   UPB_PRIVATE(_upb_WireReader_LongVarint) ret = {NULL, 0};
   uint64_t byte;
   for (int i = 1; i < 10; i++) {
@@ -32,6 +33,23 @@ UPB_NOINLINE UPB_PRIVATE(_upb_WireReader_LongVarint)
   return ret;
 }
 
+UPB_NOINLINE UPB_PRIVATE(_upb_WireReader_LongVarint)
+    UPB_PRIVATE(_upb_WireReader_ReadLongVarint32)(const char* ptr,
+                                                  uint32_t val) {
+  UPB_PRIVATE(_upb_WireReader_LongVarint) ret = {NULL, 0};
+  uint64_t byte;
+  for (int i = 1; i < 5; i++) {
+    byte = (uint8_t)ptr[i];
+    val += (byte - 1) << (i * 7);
+    if (!(byte & 0x80)) {
+      ret.ptr = ptr + i + 1;
+      ret.val = val;
+      return ret;
+    }
+  }
+  return ret;
+}
+
 const char* UPB_PRIVATE(_upb_WireReader_SkipGroup)(
     const char* ptr, uint32_t tag, int depth_limit,
     upb_EpsCopyInputStream* stream) {
@@ -39,7 +57,7 @@ const char* UPB_PRIVATE(_upb_WireReader_SkipGroup)(
   uint32_t end_group_tag = (tag & ~7ULL) | kUpb_WireType_EndGroup;
   while (!upb_EpsCopyInputStream_IsDone(stream, &ptr)) {
     uint32_t tag;
-    ptr = upb_WireReader_ReadTag(ptr, &tag);
+    ptr = upb_WireReader_ReadTag(ptr, &tag, stream);
     if (!ptr) return NULL;
     if (tag == end_group_tag) return ptr;
     ptr = _upb_WireReader_SkipValue(ptr, tag, depth_limit, stream);

data/third_party/upb/upb/wire/reader.h

@@ -8,6 +8,10 @@
 #ifndef UPB_WIRE_READER_H_
 #define UPB_WIRE_READER_H_
 
+#include <stddef.h>
+#include <stdint.h>
+#include <string.h>
+
 #include "upb/base/internal/endian.h"
 #include "upb/wire/eps_copy_input_stream.h"
 #include "upb/wire/internal/reader.h"
@@ -32,13 +36,9 @@ extern "C" {
 // REQUIRES: there must be at least 10 bytes of data available at `ptr`.
 // Bounds checks must be performed before calling this function, preferably
 // by calling upb_EpsCopyInputStream_IsDone().
-UPB_FORCEINLINE const char* upb_WireReader_ReadTag(const char* ptr,
-                                                   uint32_t* tag) {
-  uint64_t val;
-  ptr = UPB_PRIVATE(_upb_WireReader_ReadVarint)(ptr, &val, 5, UINT32_MAX);
-  if (!ptr) return NULL;
-  *tag = val;
-  return ptr;
+UPB_FORCEINLINE const char* upb_WireReader_ReadTag(
+    const char* ptr, uint32_t* tag, upb_EpsCopyInputStream* stream) {
+  return UPB_PRIVATE(_upb_WireReader_ReadTag)(ptr, tag, stream);
 }
 
 // Given a tag, returns the field number.
@@ -47,9 +47,9 @@ UPB_API_INLINE uint32_t upb_WireReader_GetFieldNumber(uint32_t tag);
 // Given a tag, returns the wire type.
 UPB_API_INLINE uint8_t upb_WireReader_GetWireType(uint32_t tag);
 
-UPB_INLINE const char* upb_WireReader_ReadVarint(const char* ptr,
-                                                 uint64_t* val) {
-  return UPB_PRIVATE(_upb_WireReader_ReadVarint)(ptr, val, 10, UINT64_MAX);
+UPB_INLINE const char* upb_WireReader_ReadVarint(
+    const char* ptr, uint64_t* val, upb_EpsCopyInputStream* stream) {
+  return UPB_PRIVATE(_upb_WireReader_ReadVarint)(ptr, val, stream);
 }
 
 // Skips data for a varint, returning a pointer past the end of the varint, or
@@ -58,9 +58,10 @@ UPB_INLINE const char* upb_WireReader_ReadVarint(const char* ptr,
 // REQUIRES: there must be at least 10 bytes of data available at `ptr`.
 // Bounds checks must be performed before calling this function, preferably
 // by calling upb_EpsCopyInputStream_IsDone().
-UPB_INLINE const char* upb_WireReader_SkipVarint(const char* ptr) {
+UPB_INLINE const char* upb_WireReader_SkipVarint(
+    const char* ptr, upb_EpsCopyInputStream* stream) {
   uint64_t val;
-  return upb_WireReader_ReadVarint(ptr, &val);
+  return upb_WireReader_ReadVarint(ptr, &val, stream);
 }
 
 // Reads a varint indicating the size of a delimited field into `size`, or
@@ -69,9 +70,10 @@ UPB_INLINE const char* upb_WireReader_SkipVarint(const char* ptr) {
 // REQUIRES: there must be at least 10 bytes of data available at `ptr`.
 // Bounds checks must be performed before calling this function, preferably
 // by calling upb_EpsCopyInputStream_IsDone().
-UPB_INLINE const char* upb_WireReader_ReadSize(const char* ptr, int* size) {
+UPB_INLINE const char* upb_WireReader_ReadSize(const char* ptr, int* size,
+                                               upb_EpsCopyInputStream* stream) {
   uint64_t size64;
-  ptr = upb_WireReader_ReadVarint(ptr, &size64);
+  ptr = upb_WireReader_ReadVarint(ptr, &size64, stream);
   if (!ptr || size64 >= INT32_MAX) return NULL;
   *size = size64;
   return ptr;
@@ -82,7 +84,9 @@ UPB_INLINE const char* upb_WireReader_ReadSize(const char* ptr, int* size) {
 // REQUIRES: there must be at least 4 bytes of data available at `ptr`.
 // Bounds checks must be performed before calling this function, preferably
 // by calling upb_EpsCopyInputStream_IsDone().
-UPB_INLINE const char* upb_WireReader_ReadFixed32(const char* ptr, void* val) {
+UPB_INLINE const char* upb_WireReader_ReadFixed32(
+    const char* ptr, void* val, upb_EpsCopyInputStream* stream) {
+  UPB_PRIVATE(upb_EpsCopyInputStream_ConsumeBytes)(stream, 4);
   uint32_t uval;
   memcpy(&uval, ptr, 4);
   uval = upb_BigEndian32(uval);
@@ -95,7 +99,9 @@ UPB_INLINE const char* upb_WireReader_ReadFixed32(const char* ptr, void* val) {
 // REQUIRES: there must be at least 4 bytes of data available at `ptr`.
 // Bounds checks must be performed before calling this function, preferably
 // by calling upb_EpsCopyInputStream_IsDone().
-UPB_INLINE const char* upb_WireReader_ReadFixed64(const char* ptr, void* val) {
+UPB_INLINE const char* upb_WireReader_ReadFixed64(
+    const char* ptr, void* val, upb_EpsCopyInputStream* stream) {
+  UPB_PRIVATE(upb_EpsCopyInputStream_ConsumeBytes)(stream, 8);
   uint64_t uval;
   memcpy(&uval, ptr, 8);
   uval = upb_BigEndian64(uval);
@@ -126,15 +132,19 @@ UPB_INLINE const char* _upb_WireReader_SkipValue(
     upb_EpsCopyInputStream* stream) {
   switch (upb_WireReader_GetWireType(tag)) {
     case kUpb_WireType_Varint:
-      return upb_WireReader_SkipVarint(ptr);
+      return upb_WireReader_SkipVarint(ptr, stream);
     case kUpb_WireType_32Bit:
+      UPB_PRIVATE(upb_EpsCopyInputStream_ConsumeBytes)(stream, 4);
       return ptr + 4;
     case kUpb_WireType_64Bit:
+      UPB_PRIVATE(upb_EpsCopyInputStream_ConsumeBytes)(stream, 8);
       return ptr + 8;
     case kUpb_WireType_Delimited: {
       int size;
-      ptr = upb_WireReader_ReadSize(ptr, &size);
-      if (!ptr) return NULL;
+      ptr = upb_WireReader_ReadSize(ptr, &size, stream);
+      if (!ptr || !upb_EpsCopyInputStream_CheckSize(stream, ptr, size)) {
+        return NULL;
+      }
       ptr += size;
       return ptr;
     }

data/third_party/upb/upb/wire/writer.h

@@ -0,0 +1,20 @@
+#ifndef GOOGLE_UPB_UPB_WIRE_WRITER_H__
+#define GOOGLE_UPB_UPB_WIRE_WRITER_H__
+
+#include <stdint.h>
+
+// Must be last.
+#include "upb/port/def.inc"
+
+UPB_FORCEINLINE uint32_t
+UPB_PRIVATE(upb_WireWriter_VarintUnusedSizeFromLeadingZeros64)(uint64_t clz) {
+  // Calculate how many bytes of the possible 10 bytes we will *not* encode,
+  // because they are part of a zero prefix. For the number 300, it would use 2
+  // bytes encoded, so the number of bytes to skip would be 8. Adding 7 to the
+  // clz input ensures that we're rounding up.
+  return (((uint32_t)clz + 7) * 9) >> 6;
+}
+
+#include "upb/port/undef.inc"
+
+#endif  // GOOGLE_UPB_UPB_WIRE_WRITER_H__

data/third_party/utf8_range/utf8_range.c

@@ -22,25 +22,25 @@
 #include <string.h>
 
 #if defined(__GNUC__)
-#define FORCE_INLINE_ATTR __attribute__((always_inline))
+#define FORCE_INLINE_ATTR __attribute__((always_inline)) inline
 #elif defined(_MSC_VER)
 #define FORCE_INLINE_ATTR __forceinline
 #else
-#define FORCE_INLINE_ATTR
+#define FORCE_INLINE_ATTR inline
 #endif
 
-static FORCE_INLINE_ATTR inline uint64_t utf8_range_UnalignedLoad64(
+static FORCE_INLINE_ATTR uint64_t utf8_range_UnalignedLoad64(
     const void* p) {
   uint64_t t;
   memcpy(&t, p, sizeof t);
   return t;
 }
 
-static FORCE_INLINE_ATTR inline int utf8_range_AsciiIsAscii(unsigned char c) {
+static FORCE_INLINE_ATTR int utf8_range_AsciiIsAscii(unsigned char c) {
   return c < 128;
 }
 
-static FORCE_INLINE_ATTR inline int utf8_range_IsTrailByteOk(const char c) {
+static FORCE_INLINE_ATTR int utf8_range_IsTrailByteOk(const char c) {
   return (int8_t)(c) <= (int8_t)(0xBF);
 }
 
@@ -175,7 +175,7 @@ static inline const char* utf8_range_SkipAscii(const char* data,
 #include "utf8_range_neon.inc"
 #endif
 
-static FORCE_INLINE_ATTR inline size_t utf8_range_Validate(
+static FORCE_INLINE_ATTR size_t utf8_range_Validate(
     const char* data, size_t len, int return_position) {
   if (len == 0) return 1 - return_position;
   // Save buffer start address for later use

data/third_party/utf8_range/utf8_range_neon.inc

@@ -6,7 +6,7 @@
  * straightforward.
  */
 
-static FORCE_INLINE_ATTR inline size_t utf8_range_ValidateUTF8Simd(
+static FORCE_INLINE_ATTR size_t utf8_range_ValidateUTF8Simd(
     const char* data_original, const char* data, const char* end,
     int return_position) {
   const uint8x16_t first_len_tbl = {

data/third_party/utf8_range/utf8_range_sse.inc

@@ -2,7 +2,7 @@
 #include <smmintrin.h>
 #include <tmmintrin.h>
 
-static FORCE_INLINE_ATTR inline size_t utf8_range_ValidateUTF8Simd(
+static FORCE_INLINE_ATTR size_t utf8_range_ValidateUTF8Simd(
     const char* data_original, const char* data, const char* end,
     int return_position) {
   /* This code checks that utf-8 ranges are structurally valid 16 bytes at once