deps: update V8 to 7.3.492.25

PR-URL: https://github.com/nodejs/node/pull/25852
Reviewed-By: Ujjwal Sharma <usharma1998@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com>

2 files changed, 37 insertions, 9 deletions

diff --git a/deps/v8/test/mjsunit/es7/array-includes-receiver.js b/deps/v8/test/mjsunit/es7/array-includes-receiver.js
index edeae88631..91916aad54 100644
--- a/deps/v8/test/mjsunit/es7/array-includes-receiver.js
+++ b/deps/v8/test/mjsunit/es7/array-includes-receiver.js
@@ -356,7 +356,7 @@ var kTests = {
 
     Detached_Int8Array() {
       var array = new Int8Array(10);
-      %ArrayBufferNeuter(array.buffer);
+      %ArrayBufferDetach(array.buffer);
       assertFalse(Array.prototype.includes.call(array, 0));
       assertFalse(Array.prototype.includes.call(array, 0, 10));
     },
@@ -391,7 +391,7 @@ var kTests = {
 
     Detached_Uint8Array() {
       var array = new Uint8Array(10);
-      %ArrayBufferNeuter(array.buffer);
+      %ArrayBufferDetach(array.buffer);
       assertFalse(Array.prototype.includes.call(array, 0));
       assertFalse(Array.prototype.includes.call(array, 0, 10));
     },
@@ -421,7 +421,7 @@ var kTests = {
 
     Detached_Uint8ClampedArray() {
       var array = new Uint8ClampedArray(10);
-      %ArrayBufferNeuter(array.buffer);
+      %ArrayBufferDetach(array.buffer);
       assertFalse(Array.prototype.includes.call(array, 0));
       assertFalse(Array.prototype.includes.call(array, 0, 10));
     },
@@ -453,7 +453,7 @@ var kTests = {
 
     Detached_Int16Array() {
       var array = new Int16Array(10);
-      %ArrayBufferNeuter(array.buffer);
+      %ArrayBufferDetach(array.buffer);
       assertFalse(Array.prototype.includes.call(array, 0));
       assertFalse(Array.prototype.includes.call(array, 0, 10));
     },
@@ -485,7 +485,7 @@ var kTests = {
 
     Detached_Uint16Array() {
       var array = new Uint16Array(10);
-      %ArrayBufferNeuter(array.buffer);
+      %ArrayBufferDetach(array.buffer);
       assertFalse(Array.prototype.includes.call(array, 0));
       assertFalse(Array.prototype.includes.call(array, 0, 10));
     },
@@ -517,7 +517,7 @@ var kTests = {
 
     Detached_Int32Array() {
       var array = new Int32Array(10);
-      %ArrayBufferNeuter(array.buffer);
+      %ArrayBufferDetach(array.buffer);
       assertFalse(Array.prototype.includes.call(array, 0));
       assertFalse(Array.prototype.includes.call(array, 0, 10));
     },
@@ -550,7 +550,7 @@ var kTests = {
 
     Detached_Uint32Array() {
       var array = new Uint32Array(10);
-      %ArrayBufferNeuter(array.buffer);
+      %ArrayBufferDetach(array.buffer);
       assertFalse(Array.prototype.includes.call(array, 0));
       assertFalse(Array.prototype.includes.call(array, 0, 10));
     },
@@ -583,7 +583,7 @@ var kTests = {
 
     Detached_Float32Array() {
       var array = new Float32Array(10);
-      %ArrayBufferNeuter(array.buffer);
+      %ArrayBufferDetach(array.buffer);
       assertFalse(Array.prototype.includes.call(array, 0));
       assertFalse(Array.prototype.includes.call(array, 0, 10));
     },
@@ -616,7 +616,7 @@ var kTests = {
 
     Detached_Float64Array() {
       var array = new Float32Array(10);
-      %ArrayBufferNeuter(array.buffer);
+      %ArrayBufferDetach(array.buffer);
       assertFalse(Array.prototype.includes.call(array, 0));
       assertFalse(Array.prototype.includes.call(array, 0, 10));
     },
diff --git a/deps/v8/test/mjsunit/es7/array-includes.js b/deps/v8/test/mjsunit/es7/array-includes.js
index 4170a1cf31..ac0f34106a 100644
--- a/deps/v8/test/mjsunit/es7/array-includes.js
+++ b/deps/v8/test/mjsunit/es7/array-includes.js
@@ -630,6 +630,34 @@
 })();
 
 
+// Array.prototype.includes accesses out-of-bounds if length is changed late.
+(function () {
+  let arr = [1, 2, 3];
+  assertTrue(arr.includes(undefined, {
+    toString: function () {
+      arr.length = 0;
+      return 0;
+    }
+  }));
+
+  arr = [1, 2, 3];
+  assertFalse(arr.includes(undefined, {
+    toString: function () {
+      arr.length = 0;
+      return 10;
+    }
+  }));
+
+  arr = [1, 2, 3];
+  assertFalse(arr.includes(4, {
+    toString: function () {
+      arr.push(4);
+      return 0;
+    }
+  }));
+})();
+
+
 // Array.prototype.includes should use the SameValueZero algorithm to compare
 (function() {
   assertTrue([1, 2, 3].includes(2));