deps: patch V8 to 15.6.75.50

deps/v8/include/v8-version.h

@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 15
 #define V8_MINOR_VERSION 6
 #define V8_BUILD_NUMBER 75
-#define V8_PATCH_LEVEL 33
+#define V8_PATCH_LEVEL 50
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)

deps/v8/src/ast/scopes.cc

@@ -118,9 +118,11 @@ Scope::Scope(Zone* zone, Scope* outer_scope, ScopeType scope_type)
   DCHECK(!is_script_scope());
   SetDefaults();
   set_language_mode(outer_scope->language_mode());
-  set_private_name_lookup_skips_outer_class(
-      outer_scope->is_class_scope() &&
-      outer_scope->AsClassScope()->IsParsingHeritage());
+  if (outer_scope->is_class_scope() &&
+      outer_scope->AsClassScope()->IsParsingHeritage()) {
+    set_private_name_lookup_skips_outer_class(true);
+    outer_scope->GetClosureScope()->RecordNeedsPrivateNameContextChainRecalc();
+  }
   outer_scope_->AddInnerScope(this);
 }
 
@@ -180,6 +182,9 @@ DeclarationScope::DeclarationScope(Zone* zone, Scope* outer_scope,
       params_(4, zone) {
   DCHECK(!is_script_scope());
   SetDefaults();
+  if (V8_UNLIKELY(private_name_lookup_skips_outer_class())) {
+    RecordNeedsPrivateNameContextChainRecalc();
+  }
 }
 
 ModuleScope::ModuleScope(DeclarationScope* script_scope,
@@ -305,18 +310,14 @@ DeclarationScope::DeclarationScope(Zone* zone, ScopeType scope_type,
     DCHECK(IsClassConstructor(function_kind()));
     set_class_scope_has_private_brand(true);
   }
+  if (V8_UNLIKELY(private_name_lookup_skips_outer_class())) {
+    RecordNeedsPrivateNameContextChainRecalc();
+  }
 }
 
 Scope::Scope(Zone* zone, const AstRawString* catch_variable_name,
              MaybeAssignedFlag maybe_assigned, Handle<ScopeInfo> scope_info)
-    : outer_scope_(nullptr),
-      variables_(zone),
-      scope_info_(scope_info),
-      scope_type_(CATCH_SCOPE) {
-  SetDefaults();
-#ifdef DEBUG
-  already_resolved_ = true;
-#endif
+    : Scope(zone, CATCH_SCOPE, nullptr, scope_info) {
   // Cache the catch variable, even though it's also available via the
   // scope_info, as the parser expects that a catch scope always has the catch
   // variable as first and only variable.
@@ -326,7 +327,6 @@ Scope::Scope(Zone* zone, const AstRawString* catch_variable_name,
               kCreatedInitialized, maybe_assigned, &was_added);
   DCHECK(was_added);
   AllocateHeapSlot(variable);
-  set_is_hoisted_in_context(scope_info->is_hoisted_in_context());
 }
 
 void DeclarationScope::SetDefaults() {
@@ -454,9 +454,14 @@ Scope* Scope::DeserializeScopeChain(
       eval_scope->set_start_position(position);
       eval_scope->set_end_position(position);
       eval_scope->set_eval_position(position);
-
       if (current_scope != nullptr) {
+        eval_scope->set_private_name_lookup_skips_outer_class(
+            current_scope->private_name_lookup_skips_outer_class());
+        current_scope->set_private_name_lookup_skips_outer_class(false);
         eval_scope->AddInnerScope(current_scope);
+      } else if (parse_info != nullptr) {
+        eval_scope->set_private_name_lookup_skips_outer_class(
+            parse_info->flags().private_name_lookup_skips_outer_class());
       }
       current_scope = eval_scope;
       if (innermost_scope == nullptr) innermost_scope = current_scope;
@@ -940,6 +945,7 @@ Scope* Scope::FinalizeBlockScope() {
       scope->outer_scope_ = outer_scope();
       if (private_name_lookup_skips_outer_class()) {
         scope->set_private_name_lookup_skips_outer_class(true);
+        scope->GetClosureScope()->RecordNeedsPrivateNameContextChainRecalc();
       }
       if (scope->is_function_scope()) {
         scope->set_is_hoisted_in_context(false);
@@ -997,12 +1003,14 @@ void Scope::Snapshot::Reparent(DeclarationScope* new_parent) {
     for (; inner_scope->sibling() != top_inner_scope_;
          inner_scope = inner_scope->sibling()) {
       inner_scope->outer_scope_ = new_parent;
+      inner_scope->set_private_name_lookup_skips_outer_class(false);
       if (inner_scope->inner_scope_calls_eval()) {
         new_parent->set_inner_scope_calls_eval(true);
       }
       DCHECK_NE(inner_scope, new_parent);
     }
     inner_scope->outer_scope_ = new_parent;
+    inner_scope->set_private_name_lookup_skips_outer_class(false);
     if (inner_scope->inner_scope_calls_eval()) {
       new_parent->set_inner_scope_calls_eval(true);
     }
@@ -1454,7 +1462,12 @@ bool DeclarationScope::AllocateVariables(ParseInfo* info) {
   }
 
   // Don't allocate variables of preparsed scopes.
-  if (!was_lazily_parsed()) AllocateVariablesRecursively();
+  if (!was_lazily_parsed()) {
+    AllocateVariablesRecursively();
+    if (needs_private_name_context_chain_recalc()) {
+      RecalcPrivateNameContextChain();
+    }
+  }
 
   return true;
 }
@@ -2924,10 +2937,6 @@ void DeclarationScope::AllocateScopeInfos(ParseInfo* parse_info,
     }
   }
 
-  if (scope->needs_private_name_context_chain_recalc()) {
-    scope->RecalcPrivateNameContextChain();
-  }
-
   Tagged<WeakFixedArray> infos = script->infos();
   std::unordered_map<int, Handle<ScopeInfo>> scope_infos_to_reuse;
   if (infos->ulength().value() != 0) {

deps/v8/src/ast/scopes.h

@@ -1512,6 +1512,7 @@ void Scope::RecordEvalCall() {
     GetDeclarationScope()->RecordDeclarationScopeEvalCall();
   }
   RecordInnerScopeEvalCall();
+  GetClosureScope()->RecordNeedsPrivateNameContextChainRecalc();
   // The eval contents might access "super" (if it's inside a function that
   // binds super).
   DeclarationScope* receiver_scope = GetReceiverScope();

deps/v8/src/codegen/arm64/assembler-arm64-inl.h

@@ -983,7 +983,7 @@ Instr Assembler::SF(Register rd) {
 }
 
 Instr Assembler::ImmAddSub(int imm) {
-  DCHECK(IsImmAddSub(imm));
+  CHECK(IsImmAddSub(imm));
   if (is_uint12(imm)) {  // No shift required.
     imm <<= ImmAddSub_offset;
   } else {

deps/v8/src/codegen/arm64/assembler-arm64.cc

@@ -4043,7 +4043,7 @@ void Assembler::AddSub(const Register& rd, const Register& rn,
   DCHECK(!operand.NeedsRelocation(this));
   if (operand.IsImmediate()) {
     int64_t immediate = operand.ImmediateValue();
-    DCHECK(IsImmAddSub(immediate));
+    CHECK(IsImmAddSub(immediate));
     Instr dest_reg = (S == SetFlags) ? Rd(rd) : RdSP(rd);
     Emit(SF(rd) | AddSubImmediateFixed | op | Flags(S) |
          ImmAddSub(static_cast<int>(immediate)) | dest_reg | RnSP(rn));

deps/v8/src/codegen/arm64/macro-assembler-arm64.cc

@@ -979,11 +979,11 @@ void MacroAssembler::LoadStoreMacroComplex(const CPURegister& rt,
     // Post-index beyond unscaled addressing range.
     DCHECK(!is_imm_unscaled);
     LoadStore(rt, MemOperand(addr.base()), op);
-    add(addr.base(), addr.base(), offset);
+    Add(addr.base(), addr.base(), offset);
   } else {
     // Pre-index beyond unscaled addressing range.
     DCHECK(!is_imm_unscaled && addr.IsPreIndex());
-    add(addr.base(), addr.base(), offset);
+    Add(addr.base(), addr.base(), offset);
     LoadStore(rt, MemOperand(addr.base()), op);
   }
 }

deps/v8/src/codegen/compiler.cc

@@ -3320,7 +3320,8 @@ MaybeDirectHandle<JSFunction> Compiler::GetFunctionFromEval(
     DirectHandle<SharedFunctionInfo> outer_info, DirectHandle<Context> context,
     LanguageMode language_mode, ParseRestriction restriction,
     int parameters_end_pos, int eval_position,
-    ParsingWhileDebugging parsing_while_debugging) {
+    ParsingWhileDebugging parsing_while_debugging,
+    bool private_name_lookup_skips_outer_class) {
   // The cache lookup key needs to be aware of the separation between the
   // parameters and the body to prevent this valid invocation:
   //   Function("", "function anonymous(\n/**/) {\n}");
@@ -3376,6 +3377,8 @@ MaybeDirectHandle<JSFunction> Compiler::GetFunctionFromEval(
         v8_flags.lazy_eval);
     flags.set_is_eval(true);
     flags.set_parsing_while_debugging(parsing_while_debugging);
+    flags.set_private_name_lookup_skips_outer_class(
+        private_name_lookup_skips_outer_class);
     DCHECK(!flags.is_module());
     flags.set_parse_restriction(restriction);
 

deps/v8/src/codegen/compiler.h

@@ -166,7 +166,8 @@ class V8_EXPORT_PRIVATE Compiler : public AllStatic {
                       ParseRestriction restriction, int parameters_end_pos,
                       int eval_position,
                       ParsingWhileDebugging parsing_while_debugging =
-                          ParsingWhileDebugging::kNo);
+                          ParsingWhileDebugging::kNo,
+                      bool private_name_lookup_skips_outer_class = false);
 
   // Create a function that results from wrapping |source| in a function,
   // with |arguments| being a list of parameters for that function.

deps/v8/src/compiler/backend/arm64/code-generator-arm64.cc

@@ -4674,7 +4674,7 @@ void CodeGenerator::Pop(InstructionOperand* dest, MachineRepresentation rep) {
 void CodeGenerator::PopTempStackSlots() {
   if (temp_slots_ > 0) {
     frame_access_state()->IncreaseSPDelta(-temp_slots_);
-    __ add(sp, sp, Operand(temp_slots_ * kSystemPointerSize));
+    __ Add(sp, sp, Operand(temp_slots_ * kSystemPointerSize));
     temp_slots_ = 0;
   }
 }

deps/v8/src/compiler/backend/code-generator.cc

@@ -1695,8 +1695,8 @@ void CodeGenerator::AddTranslationForOperand(Instruction* instr,
       default:
         UNREACHABLE();
     }
-    if (literal.object().equals(info()->closure()) &&
-        info()->function_context_specializing()) {
+    if (info()->function_context_specializing() &&
+        literal.IsObject(info()->closure())) {
       translations_.StoreJSFrameFunction();
     } else {
       int literal_id = DefineDeoptimizationLiteral(literal);

deps/v8/src/compiler/wasm-load-elimination.cc

@@ -84,7 +84,40 @@ Reduction WasmLoadElimination::UpdateState(Node* node,
 std::tuple<Node*, Node*> WasmLoadElimination::TruncateAndExtendOrType(
     Node* value, Node* effect, Node* control, wasm::ValueType field_type,
     bool is_signed) {
+  if (value->opcode() == IrOpcode::kDead ||
+      value->opcode() == IrOpcode::kDeadValue) {
+    return {dead(), dead()};
+  }
+
+  // The value might be untyped or have a non-Wasm type (e.g. Type::None() from
+  // DeadCodeElimination, or a JS node in case of Wasm inlined into JS). Without
+  // a concrete Wasm type we cannot verify representation compatibility.
+  if (!NodeProperties::IsTyped(value)) {
+    return {nullptr, nullptr};
+  }
+
+  Type value_type = NodeProperties::GetType(value);
+  if (!value_type.IsWasm()) {
+    return {nullptr, nullptr};
+  }
+
+  wasm::TypeInModule node_type = value_type.AsWasm();
+  if (node_type.type.is_top()) {
+    return {nullptr, nullptr};
+  }
+
+  wasm::ValueType unpacked_field_type = field_type.Unpacked();
+  if (node_type.type.is_uninhabited() ||
+      TypesUnrelated(node_type.type, unpacked_field_type, node_type.module)) {
+    // Uninhabited or unrelated types can occur as a result of unreachable code.
+    // Example: Storing a value x of type A in a struct, then casting the struct
+    // to a different struct type to then load type B from the same offset
+    // results in trying to replace the load with value x.
+    return {dead(), dead()};
+  }
+
   if (field_type == wasm::kWasmI8 || field_type == wasm::kWasmI16) {
+    DCHECK_EQ(node_type.type, wasm::kWasmI32);
     Node* ret = nullptr;
     if (is_signed) {
       int shift = 32 - 8 * field_type.value_kind_size();
@@ -98,30 +131,10 @@ std::tuple<Node*, Node*> WasmLoadElimination::TruncateAndExtendOrType(
                              jsgraph()->Int32Constant(mask));
     }
 
-    NodeProperties::SetType(ret, NodeProperties::GetType(value));
+    NodeProperties::SetType(ret, value_type);
     return {ret, effect};
   }
 
-  // The value might be untyped in case of wasm inlined into JS if the value
-  // comes from a JS node.
-  if (!NodeProperties::IsTyped(value)) {
-    return {value, effect};
-  }
-
-  Type value_type = NodeProperties::GetType(value);
-  if (!value_type.IsWasm()) {
-    return {value, effect};
-  }
-
-  wasm::TypeInModule node_type = value_type.AsWasm();
-
-  if (TypesUnrelated(node_type.type, field_type, node_type.module)) {
-    // Unrelated types can occur as a result of unreachable code.
-    // Example: Storing a value x of type A in a struct, then casting the struct
-    // to a different struct type to then load type B from the same offset
-    // results in trying to replace the load with value x.
-    return {dead(), dead()};
-  }
   if (!wasm::IsSubtypeOf(node_type.type, field_type, node_type.module)) {
     Type type = Type::Wasm({field_type, node_type.module}, graph()->zone());
     Node* ret =
@@ -233,10 +246,12 @@ Reduction WasmLoadElimination::ReduceWasmStructGet(Node* node) {
       node->Kill();
       return Replace(dead());
     }
-    ReplaceWithValue(node, std::get<0>(replacement), std::get<1>(replacement),
-                     control);
-    node->Kill();
-    return Replace(std::get<0>(replacement));
+    if (std::get<0>(replacement) != nullptr) {
+      ReplaceWithValue(node, std::get<0>(replacement), std::get<1>(replacement),
+                       control);
+      node->Kill();
+      return Replace(std::get<0>(replacement));
+    }
   }
 
   half_state = half_state->AddField(field_info.field_index, object, node);

deps/v8/src/compiler/wasm-load-elimination.h

@@ -138,7 +138,9 @@ class V8_EXPORT_PRIVATE WasmLoadElimination final
   AbstractState const* ComputeLoopState(Node* node,
                                         AbstractState const* state) const;
   // Returns the replacement value and effect for a load given an initial value
-  // node, after optional {TypeGuard}ing and i8/i16 adaptation to i32.
+  // node, after optional {TypeGuard}ing and i8/i16 adaptation to i32. Returns
+  // {dead(), dead()} if the types prove the load is unreachable, or
+  // {nullptr, nullptr} if replacement must be skipped.
   std::tuple<Node*, Node*> TruncateAndExtendOrType(Node* value, Node* effect,
                                                    Node* control,
                                                    wasm::ValueType field_type,

deps/v8/src/d8/d8.cc

@@ -4768,8 +4768,10 @@ Local<ObjectTemplate> Shell::CreateGlobalTemplate(Isolate* isolate) {
   global_template->Set(Symbol::GetToStringTag(isolate),
                        String::NewFromUtf8Literal(isolate, "global"));
   global_template->Set(isolate, "onerror", v8::Null(isolate));
-  global_template->Set(isolate, "version",
-                       FunctionTemplate::New(isolate, Version));
+  Local<FunctionTemplate> version_func_template =
+      FunctionTemplate::New(isolate, Version);
+  version_func_template->SetAcceptAnyReceiver(false);
+  global_template->Set(isolate, "version", version_func_template);
 
   global_template->Set(isolate, "print", FunctionTemplate::New(isolate, Print));
   global_template->Set(isolate, "printErr",