deps: patch V8 to 7.9.317.25

Refs: v8/v8@7.9.317.23...7.9.317.25 PR-URL: #30679 Reviewed-By: Michaël Zasso <[email protected]> Reviewed-By: Jiawen Geng <[email protected]> Reviewed-By: Colin Ihrig <[email protected]>

Author: MylesBorins

deps/v8/include/v8-version.h

@@ -11,7 +11,7 @@
 #defineV8_MAJOR_VERSION 7
 #defineV8_MINOR_VERSION 9
 #defineV8_BUILD_NUMBER 317
-#defineV8_PATCH_LEVEL23
+#defineV8_PATCH_LEVEL25
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)

deps/v8/src/builtins/builtins-wasm-gen.cc

@@ -121,18 +121,19 @@ TF_BUILTIN(WasmAtomicNotify, WasmBuiltinsAssembler){
  TNode<Code> centry = LoadCEntryFromInstance(instance);
 
  TNode<Code> target = LoadBuiltinFromFrame(Builtins::kAllocateHeapNumber);
+ TNode<Object> context = LoadContextFromInstance(instance);
 
 // TODO(aseemgarg): Use SMIs if possible for address and count
  TNode<HeapNumber> address_heap = UncheckedCast<HeapNumber>(
-CallStub(AllocateHeapNumberDescriptor(), target, NoContextConstant()));
+CallStub(AllocateHeapNumberDescriptor(), target, context));
 StoreHeapNumberValue(address_heap, ChangeUint32ToFloat64(address));
 
  TNode<HeapNumber> count_heap = UncheckedCast<HeapNumber>(
-CallStub(AllocateHeapNumberDescriptor(), target, NoContextConstant()));
+CallStub(AllocateHeapNumberDescriptor(), target, context));
 StoreHeapNumberValue(count_heap, ChangeUint32ToFloat64(count));
 
  TNode<Smi> result_smi = UncheckedCast<Smi>(CallRuntimeWithCEntry(
- Runtime::kWasmAtomicNotify, centry, NoContextConstant(), instance,
+ Runtime::kWasmAtomicNotify, centry, context, instance,
  address_heap, count_heap));
 ReturnRaw(SmiToInt32(result_smi));
 }
@@ -149,23 +150,24 @@ TF_BUILTIN(WasmI32AtomicWait, WasmBuiltinsAssembler){
  TNode<Code> centry = LoadCEntryFromInstance(instance);
 
  TNode<Code> target = LoadBuiltinFromFrame(Builtins::kAllocateHeapNumber);
+ TNode<Object> context = LoadContextFromInstance(instance);
 
 // TODO(aseemgarg): Use SMIs if possible for address and expected_value
  TNode<HeapNumber> address_heap = UncheckedCast<HeapNumber>(
-CallStub(AllocateHeapNumberDescriptor(), target, NoContextConstant()));
+CallStub(AllocateHeapNumberDescriptor(), target, context));
 StoreHeapNumberValue(address_heap, ChangeUint32ToFloat64(address));
 
  TNode<HeapNumber> expected_value_heap = UncheckedCast<HeapNumber>(
-CallStub(AllocateHeapNumberDescriptor(), target, NoContextConstant()));
+CallStub(AllocateHeapNumberDescriptor(), target, context));
 StoreHeapNumberValue(expected_value_heap,
 ChangeInt32ToFloat64(expected_value));
 
  TNode<HeapNumber> timeout_heap = UncheckedCast<HeapNumber>(
-CallStub(AllocateHeapNumberDescriptor(), target, NoContextConstant()));
+CallStub(AllocateHeapNumberDescriptor(), target, context));
 StoreHeapNumberValue(timeout_heap, timeout);
 
  TNode<Smi> result_smi = UncheckedCast<Smi>(CallRuntimeWithCEntry(
- Runtime::kWasmI32AtomicWait, centry, NoContextConstant(), instance,
+ Runtime::kWasmI32AtomicWait, centry, context, instance,
  address_heap, expected_value_heap, timeout_heap));
 ReturnRaw(SmiToInt32(result_smi));
 }
@@ -184,28 +186,29 @@ TF_BUILTIN(WasmI64AtomicWait, WasmBuiltinsAssembler){
  TNode<Code> centry = LoadCEntryFromInstance(instance);
 
  TNode<Code> target = LoadBuiltinFromFrame(Builtins::kAllocateHeapNumber);
+ TNode<Object> context = LoadContextFromInstance(instance);
 
 // TODO(aseemgarg): Use SMIs if possible for address and expected_value
  TNode<HeapNumber> address_heap = UncheckedCast<HeapNumber>(
-CallStub(AllocateHeapNumberDescriptor(), target, NoContextConstant()));
+CallStub(AllocateHeapNumberDescriptor(), target, context));
 StoreHeapNumberValue(address_heap, ChangeUint32ToFloat64(address));
 
  TNode<HeapNumber> expected_value_high_heap = UncheckedCast<HeapNumber>(
-CallStub(AllocateHeapNumberDescriptor(), target, NoContextConstant()));
+CallStub(AllocateHeapNumberDescriptor(), target, context));
 StoreHeapNumberValue(expected_value_high_heap,
 ChangeUint32ToFloat64(expected_value_high));
 
  TNode<HeapNumber> expected_value_low_heap = UncheckedCast<HeapNumber>(
-CallStub(AllocateHeapNumberDescriptor(), target, NoContextConstant()));
+CallStub(AllocateHeapNumberDescriptor(), target, context));
 StoreHeapNumberValue(expected_value_low_heap,
 ChangeUint32ToFloat64(expected_value_low));
 
  TNode<HeapNumber> timeout_heap = UncheckedCast<HeapNumber>(
-CallStub(AllocateHeapNumberDescriptor(), target, NoContextConstant()));
+CallStub(AllocateHeapNumberDescriptor(), target, context));
 StoreHeapNumberValue(timeout_heap, timeout);
 
  TNode<Smi> result_smi = UncheckedCast<Smi>(CallRuntimeWithCEntry(
- Runtime::kWasmI64AtomicWait, centry, NoContextConstant(), instance,
+ Runtime::kWasmI64AtomicWait, centry, context, instance,
  address_heap, expected_value_high_heap, expected_value_low_heap,
  timeout_heap));
 ReturnRaw(SmiToInt32(result_smi));

deps/v8/src/compiler/heap-refs.h

@@ -389,6 +389,7 @@ class ContextRef : public HeapObjectRef{
 V(JSFunction, object_function) \
 V(JSFunction, promise_function) \
 V(JSFunction, promise_then) \
+V(JSFunction, regexp_function) \
 V(JSFunction, string_function) \
 V(JSFunction, symbol_function) \
 V(JSGlobalObject, global_object) \

deps/v8/src/compiler/js-call-reducer.cc

@@ -7098,11 +7098,14 @@ Reduction JSCallReducer::ReduceRegExpPrototypeTest(Node* node){
  Node* control = NodeProperties::GetControlInput(node);
  Node* regexp = NodeProperties::GetValueInput(node, 1);
 
+// Only the initial JSRegExp map is valid here, since the following lastIndex
+// check as well as the lowered builtin call rely on a known location of the
+// lastIndex field.
+ Handle<Map> regexp_initial_map =
+native_context().regexp_function().initial_map().object();
+
  MapInference inference(broker(), regexp, effect);
-if (!inference.HaveMaps() ||
- !inference.AllOfInstanceTypes(InstanceTypeChecker::IsJSRegExp)){
-return inference.NoChange();
- }
+if (!inference.Is(regexp_initial_map)) return inference.NoChange();
  MapHandles const& regexp_maps = inference.GetMaps();
 
  ZoneVector<PropertyAccessInfo> access_infos(graph()->zone());

deps/v8/src/compiler/map-inference.cc

@@ -91,6 +91,13 @@ MapHandles const& MapInference::GetMaps(){
 return maps_;
 }
 
+boolMapInference::Is(Handle<Map> expected_map){
+if (!HaveMaps()) returnfalse;
+const MapHandles& maps = GetMaps();
+if (maps.size() != 1) returnfalse;
+return maps[0].equals(expected_map);
+}
+
 voidMapInference::InsertMapChecks(JSGraph* jsgraph, Node** effect,
  Node* control,
 const FeedbackSource& feedback){

deps/v8/src/compiler/map-inference.h

@@ -55,6 +55,7 @@ class MapInference{
  V8_WARN_UNUSED_RESULT MapHandles const& GetMaps();
  V8_WARN_UNUSED_RESULT boolAllOfInstanceTypes(
  std::function<bool(InstanceType)> f);
+ V8_WARN_UNUSED_RESULT boolIs(Handle<Map> expected_map);
 
 // These methods provide a guard.
 //

deps/v8/test/mjsunit/regress/regress-crbug-1024758.js

@@ -0,0 +1,37 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+functionf(){
+returnr.test("abc");
+}
+
+functionto_dict(o){
+r.a=42;
+r.b=42;
+deleter.a;
+}
+
+functionto_fast(o){
+constobj={};
+constobj2={};
+deleteo.a;
+obj.__proto__=o;
+obj[0]=1;
+obj.__proto__=obj2;
+deleteobj[0];
+returno;
+}
+
+// Shrink the instance size by first transitioning to dictionary properties,
+// then back to fast properties.
+constr=/./;
+to_dict(r);
+to_fast(r);
+
+%PrepareFunctionForOptimization(f);
+assertTrue(f());
+%OptimizeFunctionOnNextCall(f);
+assertTrue(f());