deps: update V8 to 6.5.254.31

PR-URL: https://github.com/nodejs/node/pull/18453
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Yang Guo <yangguo@chromium.org>
Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

11 files changed, 138 insertions, 38 deletions

diff --git a/deps/v8/test/mjsunit/es6/array-find.js b/deps/v8/test/mjsunit/es6/array-find.js
index 5f6ba4226b..9fed027c8f 100644
--- a/deps/v8/test/mjsunit/es6/array-find.js
+++ b/deps/v8/test/mjsunit/es6/array-find.js
@@ -234,6 +234,40 @@ assertEquals(22, a.find(function(val) { return 22 === val; }), undefined);
 
 
 //
+// Test predicate is called for missing properties
+//
+(function() {
+  const obj = {
+    "0": 0,
+    "2": 2,
+    length: 3
+  };
+  const received = [];
+  const predicate = (v) => { received.push(v); return false; };
+  const found = Array.prototype.find.call(obj, predicate);
+  assertEquals(undefined, found);
+  assertArrayEquals([0, undefined, 2], received);
+})();
+
+
+//
+// Test predicate modifying array prototype
+//
+(function() {
+  const a = [0, , 2];
+  const received = [];
+  const predicate = (v) => {
+    a.__proto__ = null;
+    received.push(v);
+    return false;
+  };
+  const found = Array.prototype.find.call(a, predicate);
+  assertEquals(undefined, found);
+  assertArrayEquals([0, undefined, 2], received);
+})();
+
+
+//
 // Test thisArg
 //
 (function() {
diff --git a/deps/v8/test/mjsunit/es6/array-findindex.js b/deps/v8/test/mjsunit/es6/array-findindex.js
index 716eb4e0db..d335c15108 100644
--- a/deps/v8/test/mjsunit/es6/array-findindex.js
+++ b/deps/v8/test/mjsunit/es6/array-findindex.js
@@ -234,6 +234,40 @@ assertEquals(3, a.findIndex(function(val) { return 24 === val; }));
 
 
 //
+// Test predicate is called for missing properties
+//
+(function() {
+  const obj = {
+    "0": 0,
+    "2": 2,
+    length: 3
+  };
+  const received = [];
+  const predicate = (v) => { received.push(v); return false; };
+  const found = Array.prototype.findIndex.call(obj, predicate);
+  assertEquals(-1, found);
+  assertArrayEquals([0, undefined, 2], received);
+})();
+
+
+//
+// Test predicate modifying array prototype
+//
+(function() {
+  const a = [0, , 2];
+  const received = [];
+  const predicate = (v) => {
+    a.__proto__ = null;
+    received.push(v);
+    return false;
+  };
+  const found = Array.prototype.findIndex.call(a, predicate);
+  assertEquals(-1, found);
+  assertArrayEquals([0, undefined, 2], received);
+})();
+
+
+//
 // Test thisArg
 //
 (function() {
diff --git a/deps/v8/test/mjsunit/es6/array-iterator-turbo.js b/deps/v8/test/mjsunit/es6/array-iterator-turbo.js
index 3a159b6337..489a53dbc7 100644
--- a/deps/v8/test/mjsunit/es6/array-iterator-turbo.js
+++ b/deps/v8/test/mjsunit/es6/array-iterator-turbo.js
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 // Flags: --turbo-escape --allow-natives-syntax --no-always-opt
-// Flags: --opt --turbo-filter=*
+// Flags: --opt --turbo-filter=* --no-force-slow-path
 
 "use strict";
 
diff --git a/deps/v8/test/mjsunit/es6/call-with-spread-modify-next.js b/deps/v8/test/mjsunit/es6/call-with-spread-modify-next.js
index d22a1eaec0..3cae94ff9d 100644
--- a/deps/v8/test/mjsunit/es6/call-with-spread-modify-next.js
+++ b/deps/v8/test/mjsunit/es6/call-with-spread-modify-next.js
@@ -37,6 +37,8 @@
 
   var r2 = testMax(1, 2);
 
-  assertEquals(3, called);
+  // .next() is only loaded once during the iteration prologue (see
+  // https://github.com/tc39/ecma262/pull/988/ and v8:6861)
+  assertEquals(1, called);
   assertEquals(2, r2);
 })();
diff --git a/deps/v8/test/mjsunit/es6/computed-property-names-object-literals-methods.js b/deps/v8/test/mjsunit/es6/computed-property-names-object-literals-methods.js
index 36afbe2ced..24a357258a 100644
--- a/deps/v8/test/mjsunit/es6/computed-property-names-object-literals-methods.js
+++ b/deps/v8/test/mjsunit/es6/computed-property-names-object-literals-methods.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-async-iteration
-
 function ID(x) {
   return x;
 }
diff --git a/deps/v8/test/mjsunit/es6/destructuring-assignment.js b/deps/v8/test/mjsunit/es6/destructuring-assignment.js
index 579c87718b..dee7a0b16d 100644
--- a/deps/v8/test/mjsunit/es6/destructuring-assignment.js
+++ b/deps/v8/test/mjsunit/es6/destructuring-assignment.js
@@ -513,25 +513,31 @@ assertEquals(oz, [1, 2, 3, 4, 5]);
   }
 
   function FakeNewTarget() {}
-  assertEquals(undefined, ReturnNewTarget1());
-  assertEquals(ReturnNewTarget1, new ReturnNewTarget1());
-  assertEquals(FakeNewTarget,
-               Reflect.construct(ReturnNewTarget1, [], FakeNewTarget));
-
-  assertEquals(undefined, ReturnNewTarget2());
-  assertEquals(ReturnNewTarget2, new ReturnNewTarget2());
-  assertEquals(FakeNewTarget,
-               Reflect.construct(ReturnNewTarget2, [], FakeNewTarget));
-
-  assertEquals(undefined, ReturnNewTarget3());
-  assertEquals(ReturnNewTarget3, new ReturnNewTarget3());
-  assertEquals(FakeNewTarget,
-               Reflect.construct(ReturnNewTarget3, [], FakeNewTarget));
-
-  assertEquals(undefined, ReturnNewTarget4());
-  assertEquals(ReturnNewTarget4, new ReturnNewTarget4());
-  assertEquals(FakeNewTarget,
-               Reflect.construct(ReturnNewTarget4, [], FakeNewTarget));
+
+  function construct() {
+    assertEquals(undefined, ReturnNewTarget1());
+    assertEquals(ReturnNewTarget1, new ReturnNewTarget1());
+    assertEquals(FakeNewTarget,
+                 Reflect.construct(ReturnNewTarget1, [], FakeNewTarget));
+
+    assertEquals(undefined, ReturnNewTarget2());
+    assertEquals(ReturnNewTarget2, new ReturnNewTarget2());
+    assertEquals(FakeNewTarget,
+                 Reflect.construct(ReturnNewTarget2, [], FakeNewTarget));
+
+    assertEquals(undefined, ReturnNewTarget3());
+    assertEquals(ReturnNewTarget3, new ReturnNewTarget3());
+    assertEquals(FakeNewTarget,
+                 Reflect.construct(ReturnNewTarget3, [], FakeNewTarget));
+
+    assertEquals(undefined, ReturnNewTarget4());
+    assertEquals(ReturnNewTarget4, new ReturnNewTarget4());
+    assertEquals(FakeNewTarget,
+                 Reflect.construct(ReturnNewTarget4, [], FakeNewTarget));
+  }
+  construct();
+  FakeNewTarget.prototype = 1;
+  construct();
 })();
 
 (function testSuperCall() {
diff --git a/deps/v8/test/mjsunit/es6/iteration-semantics.js b/deps/v8/test/mjsunit/es6/iteration-semantics.js
index 558fb837e7..40037be6f5 100644
--- a/deps/v8/test/mjsunit/es6/iteration-semantics.js
+++ b/deps/v8/test/mjsunit/es6/iteration-semantics.js
@@ -220,13 +220,11 @@ assertThrows('fold(sum, 0, unreachable({}))', TypeError);
 assertThrows('fold(sum, 0, unreachable(false))', TypeError);
 assertThrows('fold(sum, 0, unreachable(37))', TypeError);
 
-// "next" is looked up each time.
-assertThrows('fold(sum, 0, remove_next_after(integers_until(10), 5))',
-             TypeError);
-// It is not called at any other time.
+// "next" is looked up only once during the iteration prologue (see
+// https://github.com/tc39/ecma262/pull/988)
+assertEquals(45, fold(sum, 0, remove_next_after(integers_until(10), 5)));
 assertEquals(45,
              fold(sum, 0, remove_next_after(integers_until(10), 10)));
-// It is not looked up too many times.
 assertEquals(45,
              fold(sum, 0, poison_next_after(integers_until(10), 10)));
 
diff --git a/deps/v8/test/mjsunit/es6/reflect-construct.js b/deps/v8/test/mjsunit/es6/reflect-construct.js
index 03e8397a9b..34b6f27373 100644
--- a/deps/v8/test/mjsunit/es6/reflect-construct.js
+++ b/deps/v8/test/mjsunit/es6/reflect-construct.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
-// Flags: --allow-unsafe-function-constructor --harmony-async-iteration
+// Flags: --allow-unsafe-function-constructor
 
 
 (function testReflectConstructArity() {
diff --git a/deps/v8/test/mjsunit/es6/spread-call.js b/deps/v8/test/mjsunit/es6/spread-call.js
index cdedd990c8..7403e0726e 100644
--- a/deps/v8/test/mjsunit/es6/spread-call.js
+++ b/deps/v8/test/mjsunit/es6/spread-call.js
@@ -376,6 +376,11 @@ testSpreadCallsStrict();
   a[3] = 4;
   var called = 0;
 
+  // .next method is only accessed during iteration prologue (see
+  // https://github.com/tc39/ecma262/pull/988)
+  let ArrayIteratorPrototype = Array.prototype[Symbol.iterator]().__proto__;
+  let ArrayIteratorPrototypeNextDescriptor =
+      Object.getOwnPropertyDescriptor(ArrayIteratorPrototype, 'next');
   Object.defineProperty(Array.prototype, 2, {
     get: function() {
       var ai = a[Symbol.iterator]();
@@ -384,7 +389,8 @@ testSpreadCallsStrict();
         get: function() {
           called++;
           return original_next;
-        }
+        },
+        configurable: true
       });
       return 3;
     },
@@ -392,8 +398,10 @@ testSpreadCallsStrict();
   });
 
   assertEquals(10, sum(...a));
-  assertEquals(2, called);
+  assertEquals(0, called);
 
+  Object.defineProperty(ArrayIteratorPrototype, 'next',
+                        ArrayIteratorPrototypeNextDescriptor);
   Object.defineProperty(Array.prototype, 2, {});
 })();
 
@@ -430,9 +438,9 @@ testSpreadCallsStrict();
 
   countArgs(...a);
 
-  // should be called 4 times; 3 for the values, 1 for the final
-  // {value: undefined, done: true} pair
-  assertEquals(4, called);
+  // .next method is only accessed during iteration prologue (see
+  // https://github.com/tc39/ecma262/pull/988)
+  assertEquals(1, called);
 })();
 
 (function testArrayIteratorPrototypeModified() {
diff --git a/deps/v8/test/mjsunit/es6/super-with-spread-modify-next.js b/deps/v8/test/mjsunit/es6/super-with-spread-modify-next.js
index 299917dbf1..cd7798b8d1 100644
--- a/deps/v8/test/mjsunit/es6/super-with-spread-modify-next.js
+++ b/deps/v8/test/mjsunit/es6/super-with-spread-modify-next.js
@@ -48,7 +48,9 @@
 
   var r2 = testArgumentsPoint(1, 2);
 
-  assertEquals(3, called);
+  // .next() is only loaded once during the iteration prologue (see
+  // https://github.com/tc39/ecma262/pull/988/ and v8:6861)
+  assertEquals(1, called);
   assertInstanceof(r2, ArgumentsPoint);
   assertInstanceof(r2, Point);
   assertEquals(r2.x, 1);
diff --git a/deps/v8/test/mjsunit/es6/typedarray.js b/deps/v8/test/mjsunit/es6/typedarray.js
index 93d92097cd..02bd91c1e5 100644
--- a/deps/v8/test/mjsunit/es6/typedarray.js
+++ b/deps/v8/test/mjsunit/es6/typedarray.js
@@ -341,16 +341,30 @@ function TestTypedArray(constr, elementSize, typicalElement) {
 
   // Modified %ArrayIteratorPrototype%.next() method is honoured (v8:5699)
   const ArrayIteratorPrototype = Object.getPrototypeOf([][Symbol.iterator]());
+  const ArrayIteratorPrototypeNextDescriptor =
+      Object.getOwnPropertyDescriptor(ArrayIteratorPrototype, 'next');
   const ArrayIteratorPrototypeNext = ArrayIteratorPrototype.next;
   ArrayIteratorPrototype.next = function() {
     return { done: true };
   };
   genArr = new constr([1, 2, 3]);
   assertEquals(0, genArr.length);
+
   ArrayIteratorPrototype.next = ArrayIteratorPrototypeNext;
 
-  // Modified %ArrayIteratorPrototype%.next() during iteration is honoured as
-  // well.
+  // Modified %ArrayIteratorPrototype%.next() is only loaded during the iterator
+  // prologue.
+  let nextMethod = ArrayIteratorPrototypeNext;
+  let getNextCount = 0;
+  Object.defineProperty(ArrayIteratorPrototype, 'next', {
+    get() {
+      getNextCount++;
+      return nextMethod;
+    },
+    set(v) { nextMethod = v; },
+    configurable: true
+  });
+
   genArr = new constr(Object.defineProperty([1, , 3], 1, {
     get() {
       ArrayIteratorPrototype.next = function() {
@@ -359,9 +373,13 @@ function TestTypedArray(constr, elementSize, typicalElement) {
       return 2;
     }
   }));
-  assertEquals(2, genArr.length);
+  Object.defineProperty(ArrayIteratorPrototype, 'next',
+                        ArrayIteratorPrototypeNextDescriptor);
+  assertEquals(1, getNextCount);
+  assertEquals(3, genArr.length);
   assertEquals(1, genArr[0]);
   assertEquals(2, genArr[1]);
+  assertEquals(3, genArr[2]);
   ArrayIteratorPrototype.next = ArrayIteratorPrototypeNext;
 }