deps: update V8 to 7.0.276.20

PR-URL: https://github.com/nodejs/node/pull/22754
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Refael Ackermann <refack@gmail.com>
Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

1 files changed, 32 insertions, 0 deletions

diff --git a/deps/v8/test/mjsunit/compiler/number-constructor-deopt.js b/deps/v8/test/mjsunit/compiler/number-constructor-deopt.js
new file mode 100644
index 0000000000..edffc9ec53
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/number-constructor-deopt.js
@@ -0,0 +1,32 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// This test writes {} to x to trigger lazy deopt
+// from inside the number constructor.
+var x = "5";
+var b = false;
+
+check = function() {
+  if (b) x = {};
+  return 0;
+}
+
+var obj = {};
+obj.valueOf = check;
+
+function f() {
+  try {
+    return x + Number(obj);
+  } catch(e) {
+    console.log(e.stack);
+  }
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+b = true;
+f();