deps: patch V8 to 7.4.288.27

Refs: https://github.com/v8/v8/compare/7.4.288.21...7.4.288.27

PR-URL: https://github.com/nodejs/node/pull/27615
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>

8 files changed, 195 insertions, 10 deletions

diff --git a/deps/v8/test/cctest/cctest.status b/deps/v8/test/cctest/cctest.status
index 59d62d1ad3..7030b057bd 100644
--- a/deps/v8/test/cctest/cctest.status
+++ b/deps/v8/test/cctest/cctest.status
@@ -580,6 +580,14 @@
   'test-cpu-profiler/TickLinesBaseline': [SKIP],
   'test-cpu-profiler/TickLinesOptimized': [SKIP],
   'test-cpu-profiler/Inlining2': [SKIP],
+
+  # TODO(mythria): Code logging tests that currently fail with lazy feedback
+  # allocation. Fix logging to work without feedback vectors and enable these
+  # tests in lite_mode.
+  'test-log/ExternalCodeEventListenerWithInterpretedFramesNativeStack': [SKIP],
+  'test-log/LogInterpretedFramesNativeStack': [SKIP],
+  'test-log/LogInterpretedFramesNativeStackWithSerialization': [SKIP],
+  'test-serialize/CodeSerializerOnePlusOneWithInterpretedFramesNativeStack': [SKIP]
 }], # lite_mode
 
 ##############################################################################
@@ -618,6 +626,8 @@
   # --interpreted-frames-native-stack tests
   'test-log/ExternalCodeEventListenerWithInterpretedFramesNativeStack': [SKIP],
   'test-log/LogInterpretedFramesNativeStack': [SKIP],
+  'test-log/LogInterpretedFramesNativeStackWithSerialization': [SKIP],
+  'test-serialize/CodeSerializerOnePlusOneWithInterpretedFramesNativeStack': [SKIP],
 
   # Crashes on native arm.
   'test-macro-assembler-arm/ExtractLane': [PASS, ['arch == arm and not simulator_run', SKIP]],
diff --git a/deps/v8/test/cctest/test-log.cc b/deps/v8/test/cctest/test-log.cc
index 6057db75ee..d5770c856f 100644
--- a/deps/v8/test/cctest/test-log.cc
+++ b/deps/v8/test/cctest/test-log.cc
@@ -31,6 +31,7 @@
 #include <vector>
 #include "src/api-inl.h"
 #include "src/builtins/builtins.h"
+#include "src/compilation-cache.h"
 #include "src/log-utils.h"
 #include "src/log.h"
 #include "src/objects-inl.h"
@@ -659,6 +660,68 @@ TEST(LogInterpretedFramesNativeStack) {
   }
   isolate->Dispose();
 }
+
+TEST(LogInterpretedFramesNativeStackWithSerialization) {
+  SETUP_FLAGS();
+  i::FLAG_interpreted_frames_native_stack = true;
+  i::FLAG_always_opt = false;
+  v8::Isolate::CreateParams create_params;
+  create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
+
+  v8::ScriptCompiler::CachedData* cache = nullptr;
+
+  bool has_cache = cache != nullptr;
+  // NOTE(mmarchini): Runs the test two times. The first time it will compile
+  // our script and will create a code cache for it. The second time we'll
+  // deserialize the cache and check if our function was logged correctly.
+  // We disallow compilation on the second run to ensure we're loading from
+  // cache.
+  do {
+    v8::Isolate* isolate = v8::Isolate::New(create_params);
+
+    {
+      ScopedLoggerInitializer logger(saved_log, saved_prof, isolate);
+
+      has_cache = cache != nullptr;
+      v8::ScriptCompiler::CompileOptions options =
+          has_cache ? v8::ScriptCompiler::kConsumeCodeCache
+                    : v8::ScriptCompiler::kEagerCompile;
+
+      v8::HandleScope scope(isolate);
+      v8::Isolate::Scope isolate_scope(isolate);
+      v8::Local<v8::Context> context = v8::Context::New(isolate);
+      v8::Local<v8::String> source = v8_str(
+          "function eyecatcher() { return a * a; } return eyecatcher();");
+      v8::Local<v8::String> arg_str = v8_str("a");
+      v8::ScriptOrigin origin(v8_str("filename"));
+
+      i::DisallowCompilation* no_compile_expected =
+          has_cache ? new i::DisallowCompilation(
+                          reinterpret_cast<i::Isolate*>(isolate))
+                    : nullptr;
+
+      v8::ScriptCompiler::Source script_source(source, origin, cache);
+      v8::Local<v8::Function> fun =
+          v8::ScriptCompiler::CompileFunctionInContext(
+              context, &script_source, 1, &arg_str, 0, nullptr, options)
+              .ToLocalChecked();
+      if (has_cache) {
+        logger.StopLogging();
+        CHECK(logger.ContainsLine({"InterpretedFunction", "eyecatcher"}));
+      }
+      v8::Local<v8::Value> arg = v8_num(3);
+      v8::Local<v8::Value> result =
+          fun->Call(context, v8::Undefined(isolate), 1, &arg).ToLocalChecked();
+      CHECK_EQ(9, result->Int32Value(context).FromJust());
+      cache = v8::ScriptCompiler::CreateCodeCacheForFunction(fun);
+
+      if (no_compile_expected != nullptr) delete no_compile_expected;
+    }
+
+    isolate->Dispose();
+  } while (!has_cache);
+  delete cache;
+}
 #endif  // V8_TARGET_ARCH_ARM
 
 TEST(ExternalCodeEventListener) {
diff --git a/deps/v8/test/cctest/test-serialize.cc b/deps/v8/test/cctest/test-serialize.cc
index 818505febc..8cd3bd1c06 100644
--- a/deps/v8/test/cctest/test-serialize.cc
+++ b/deps/v8/test/cctest/test-serialize.cc
@@ -1578,7 +1578,7 @@ static Handle<SharedFunctionInfo> CompileScriptAndProduceCache(
   return sfi;
 }
 
-void TestCodeSerializerOnePlusOneImpl() {
+void TestCodeSerializerOnePlusOneImpl(bool verify_builtins_count = true) {
   LocalContext context;
   Isolate* isolate = CcTest::i_isolate();
   isolate->compilation_cache()->Disable();  // Disable same-isolate code cache.
@@ -1622,13 +1622,23 @@ void TestCodeSerializerOnePlusOneImpl() {
       Execution::Call(isolate, copy_fun, global, 0, nullptr).ToHandleChecked();
   CHECK_EQ(2, Handle<Smi>::cast(copy_result)->value());
 
-  CHECK_EQ(builtins_count, CountBuiltins());
+  if (verify_builtins_count) CHECK_EQ(builtins_count, CountBuiltins());
 
   delete cache;
 }
 
 TEST(CodeSerializerOnePlusOne) { TestCodeSerializerOnePlusOneImpl(); }
 
+// See bug v8:9122
+#ifndef V8_TARGET_ARCH_ARM
+TEST(CodeSerializerOnePlusOneWithInterpretedFramesNativeStack) {
+  FLAG_interpreted_frames_native_stack = true;
+  // We pass false because this test will create IET copies (which are
+  // builtins).
+  TestCodeSerializerOnePlusOneImpl(false);
+}
+#endif
+
 TEST(CodeSerializerOnePlusOneWithDebugger) {
   v8::HandleScope scope(CcTest::isolate());
   static v8::debug::DebugDelegate dummy_delegate;
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-atomics64.cc b/deps/v8/test/cctest/wasm/test-run-wasm-atomics64.cc
index bbeafc9151..2d5d6a945c 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-atomics64.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-atomics64.cc
@@ -541,14 +541,23 @@ void RunNonConstIndexTest(ExecutionTier execution_tier, WasmOpcode wasm_op,
            static_cast<uint32_t>(r.builder().ReadMemory(&memory[0])));
 }
 
+// Test a set of Narrow operations
 #define TEST_OPERATION(Name)                                               \
-  WASM_EXEC_TEST(I64AtomicConstIndex##Name) {                              \
+  WASM_EXEC_TEST(I64AtomicConstIndex##Name##Narrow) {                      \
     RunNonConstIndexTest(execution_tier, kExprI64Atomic##Name##32U, Name); \
   }
 OPERATION_LIST(TEST_OPERATION)
 #undef TEST_OPERATION
 
-WASM_EXEC_TEST(I64AtomicNonConstIndexCompareExchange) {
+// Test a set of Regular operations
+#define TEST_OPERATION(Name)                                          \
+  WASM_EXEC_TEST(I64AtomicConstIndex##Name) {                         \
+    RunNonConstIndexTest(execution_tier, kExprI64Atomic##Name, Name); \
+  }
+OPERATION_LIST(TEST_OPERATION)
+#undef TEST_OPERATION
+
+WASM_EXEC_TEST(I64AtomicNonConstIndexCompareExchangeNarrow) {
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint32_t, uint64_t, uint64_t> r(execution_tier);
   uint64_t* memory =
@@ -567,6 +576,25 @@ WASM_EXEC_TEST(I64AtomicNonConstIndexCompareExchange) {
            static_cast<uint16_t>(r.builder().ReadMemory(&memory[0])));
 }
 
+WASM_EXEC_TEST(I64AtomicNonConstIndexCompareExchange) {
+  EXPERIMENTAL_FLAG_SCOPE(threads);
+  WasmRunner<uint32_t, uint64_t, uint64_t> r(execution_tier);
+  uint64_t* memory =
+      r.builder().AddMemoryElems<uint64_t>(kWasmPageSize / sizeof(uint64_t));
+  r.builder().SetHasSharedMemory();
+
+  BUILD(r, WASM_I32_CONVERT_I64(WASM_ATOMICS_TERNARY_OP(
+               kExprI64AtomicCompareExchange,
+               WASM_I64_EQ(WASM_I64V(1), WASM_I64V(0)), WASM_GET_LOCAL(0),
+               WASM_GET_LOCAL(1), MachineRepresentation::kWord16)));
+
+  uint64_t initial = 4444333322221111, local = 0x9999888877776666;
+  r.builder().WriteMemory(&memory[0], initial);
+  CHECK_EQ(static_cast<uint32_t>(initial), r.Call(initial, local));
+  CHECK_EQ(CompareExchange(initial, initial, local),
+           r.builder().ReadMemory(&memory[0]));
+}
+
 WASM_EXEC_TEST(I64AtomicNonConstIndexLoad8U) {
   EXPERIMENTAL_FLAG_SCOPE(threads);
   WasmRunner<uint32_t> r(execution_tier);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-944865.js b/deps/v8/test/mjsunit/regress/regress-crbug-944865.js
new file mode 100644
index 0000000000..06c8919a5d
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-944865.js
@@ -0,0 +1,15 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  const r = {e: NaN, g: undefined, c: undefined};
+  const u = {__proto__: {}, e: new  Set(), g: 0, c: undefined};
+  return r;
+}
+foo();
+%OptimizeFunctionOnNextCall(foo);
+const o = foo();
+Object.defineProperty(o, 'c', {value: 42});
diff --git a/deps/v8/test/unittests/background-compile-task-unittest.cc b/deps/v8/test/unittests/background-compile-task-unittest.cc
index 2577a974fe..e1f050c9aa 100644
--- a/deps/v8/test/unittests/background-compile-task-unittest.cc
+++ b/deps/v8/test/unittests/background-compile-task-unittest.cc
@@ -36,11 +36,11 @@ class BackgroundCompileTaskTest : public TestWithNativeContext {
   static void SetUpTestCase() {
     CHECK_NULL(save_flags_);
     save_flags_ = new SaveFlags();
-    TestWithNativeContext ::SetUpTestCase();
+    TestWithNativeContext::SetUpTestCase();
   }
 
   static void TearDownTestCase() {
-    TestWithNativeContext ::TearDownTestCase();
+    TestWithNativeContext::TearDownTestCase();
     CHECK_NOT_NULL(save_flags_);
     delete save_flags_;
     save_flags_ = nullptr;
diff --git a/deps/v8/test/unittests/compiler-dispatcher/compiler-dispatcher-unittest.cc b/deps/v8/test/unittests/compiler-dispatcher/compiler-dispatcher-unittest.cc
index 1bad7fed10..312b5cdb25 100644
--- a/deps/v8/test/unittests/compiler-dispatcher/compiler-dispatcher-unittest.cc
+++ b/deps/v8/test/unittests/compiler-dispatcher/compiler-dispatcher-unittest.cc
@@ -59,11 +59,11 @@ class CompilerDispatcherTest : public TestWithNativeContext {
 
   static void SetUpTestCase() {
     CompilerDispatcherTestFlags::SetFlagsForTest();
-    TestWithNativeContext ::SetUpTestCase();
+    TestWithNativeContext::SetUpTestCase();
   }
 
   static void TearDownTestCase() {
-    TestWithNativeContext ::TearDownTestCase();
+    TestWithNativeContext::TearDownTestCase();
     CompilerDispatcherTestFlags::RestoreFlags();
   }
 
diff --git a/deps/v8/test/unittests/microtask-queue-unittest.cc b/deps/v8/test/unittests/microtask-queue-unittest.cc
index f39a1558c6..3df0b2be17 100644
--- a/deps/v8/test/unittests/microtask-queue-unittest.cc
+++ b/deps/v8/test/unittests/microtask-queue-unittest.cc
@@ -32,17 +32,34 @@ void RunStdFunction(void* data) {
 template <typename TMixin>
 class WithFinalizationGroupMixin : public TMixin {
  public:
-  WithFinalizationGroupMixin() {
+  WithFinalizationGroupMixin() = default;
+  ~WithFinalizationGroupMixin() override = default;
+
+  static void SetUpTestCase() {
+    CHECK_NULL(save_flags_);
+    save_flags_ = new SaveFlags();
     FLAG_harmony_weak_refs = true;
     FLAG_expose_gc = true;
+    FLAG_allow_natives_syntax = true;
+    TMixin::SetUpTestCase();
+  }
+
+  static void TearDownTestCase() {
+    TMixin::TearDownTestCase();
+    CHECK_NOT_NULL(save_flags_);
+    delete save_flags_;
+    save_flags_ = nullptr;
   }
 
  private:
-  SaveFlags save_flags_;
+  static SaveFlags* save_flags_;
 
   DISALLOW_COPY_AND_ASSIGN(WithFinalizationGroupMixin);
 };
 
+template <typename TMixin>
+SaveFlags* WithFinalizationGroupMixin<TMixin>::save_flags_ = nullptr;
+
 using TestWithNativeContextAndFinalizationGroup =  //
     WithInternalIsolateMixin<                      //
         WithContextMixin<                          //
@@ -498,5 +515,47 @@ TEST_F(MicrotaskQueueTest, DetachGlobal_HandlerContext) {
           .FromJust());
 }
 
+TEST_F(MicrotaskQueueTest, DetachGlobal_InactiveHandler) {
+  Local<v8::Context> sub_context = v8::Context::New(v8_isolate());
+  Utils::OpenHandle(*sub_context)
+      ->native_context()
+      ->set_microtask_queue(microtask_queue());
+
+  Handle<JSArray> result;
+  Handle<JSFunction> stale_handler;
+  Handle<JSPromise> stale_promise;
+  {
+    v8::Context::Scope scope(sub_context);
+    result = RunJS<JSArray>("var result = [false, false]; result");
+    stale_handler = RunJS<JSFunction>("() => { result[0] = true; }");
+    stale_promise = RunJS<JSPromise>(
+        "var stale_promise = new Promise(()=>{});"
+        "stale_promise");
+    RunJS("stale_promise.then(() => { result [1] = true; });");
+  }
+  sub_context->DetachGlobal();
+  sub_context.Clear();
+
+  // The context of |stale_handler| and |stale_promise| is detached at this
+  // point.
+  // Ensure that resolution handling for |stale_handler| is cancelled without
+  // crash. Also, the resolution of |stale_promise| is also cancelled.
+
+  SetGlobalProperty("stale_handler", Utils::ToLocal(stale_handler));
+  RunJS("%EnqueueMicrotask(stale_handler)");
+
+  v8_isolate()->EnqueueMicrotask(Utils::ToLocal(stale_handler));
+
+  JSPromise::Fulfill(
+      stale_promise,
+      handle(ReadOnlyRoots(isolate()).undefined_value(), isolate()));
+
+  microtask_queue()->RunMicrotasks(isolate());
+  EXPECT_TRUE(
+      Object::GetElement(isolate(), result, 0).ToHandleChecked()->IsFalse());
+  EXPECT_TRUE(
+      Object::GetElement(isolate(), result, 1).ToHandleChecked()->IsFalse());
+}
+
 }  // namespace internal
 }  // namespace v8