deps: patch V8 to undefined

Refs: v8/v8@15.5.35.20...15.5.35.22

Author: nodejs-github-bot

deps/v8/include/v8-version.h

@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 15
 #define V8_MINOR_VERSION 5
 #define V8_BUILD_NUMBER 35
-#define V8_PATCH_LEVEL 20
+#define V8_PATCH_LEVEL 22
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)

deps/v8/src/maglev/maglev-code-gen-state.h

@@ -5,6 +5,8 @@
 #ifndef V8_MAGLEV_MAGLEV_CODE_GEN_STATE_H_
 #define V8_MAGLEV_MAGLEV_CODE_GEN_STATE_H_
 
+#include <unordered_set>
+
 #include "src/codegen/assembler.h"
 #include "src/codegen/label.h"
 #include "src/codegen/machine-type.h"
@@ -132,6 +134,15 @@ class MaglevCodeGenState {
 
   inline BasicBlock* RealJumpTarget(BasicBlock* block);
 
+  using RetainedObjects =
+      std::unordered_set<Handle<HeapObject>, Handle<HeapObject>::hash,
+                         Handle<HeapObject>::equal_to>;
+  void Retain(Handle<HeapObject> heap_object) {
+    retained_objects_.insert(heap_object);
+  }
+
+  const RetainedObjects& retained_objects() const { return retained_objects_; }
+
  private:
   MaglevCompilationInfo* const compilation_info_;
   MaglevSafepointTableBuilder* const safepoint_table_builder_;
@@ -143,6 +154,8 @@ class MaglevCodeGenState {
   std::vector<LazyDeoptInfo*> lazy_deopts_;
   std::vector<NodeBase*> handlers_;
 
+  RetainedObjects retained_objects_;
+
   int untagged_slots_ = 0;
   int tagged_slots_ = 0;
   uint32_t max_deopted_stack_size_ = kMaxUInt32;

deps/v8/src/maglev/maglev-code-generator.cc

@@ -1882,6 +1882,7 @@ bool MaglevCodeGenerator::EmitCode() {
   EmitDeferredCode();
   if (!EmitDeopts()) return false;
   EmitExceptionHandlerTrampolines();
+  EmitRetainedObjects();
   __ FinishCode();
 
   code_gen_succeeded_ = true;
@@ -2031,6 +2032,21 @@ void MaglevCodeGenerator::EmitExceptionHandlerTrampolines() {
 #endif
 }
 
+void MaglevCodeGenerator::EmitRetainedObjects() {
+  if (code_gen_state_.retained_objects().empty()) return;
+
+  // This code is never executed; it's just for inserting weak embedded objects
+  // into the code.
+  __ RecordComment("-- Retained objects");
+  __ Trap();
+
+  MaglevAssembler::TemporaryRegisterScope temps(masm());
+  Register scratch = temps.AcquireScratch();
+  for (Handle<HeapObject> heap_object : code_gen_state_.retained_objects()) {
+    __ Move(scratch, heap_object);
+  }
+}
+
 void MaglevCodeGenerator::EmitMetadata() {
   // Final alignment before starting on the metadata section.
   masm()->Align(InstructionStream::kMetadataAlignment);

deps/v8/src/maglev/maglev-code-generator.h

@@ -41,6 +41,7 @@ class MaglevCodeGenerator final {
   void EmitDeferredCode();
   V8_NODISCARD bool EmitDeopts();
   void EmitExceptionHandlerTrampolines();
+  void EmitRetainedObjects();
   void EmitMetadata();
   void RecordInlinedFunctions();
 

deps/v8/src/maglev/maglev-ir.cc

@@ -8162,6 +8162,18 @@ void GenerateTypedArrayLoadFromDataPointer(MaglevAssembler* masm,
   }
 }
 
+void RetainConstantTypedArrayBuffer(MaglevAssembler* masm,
+                                    compiler::JSTypedArrayRef typed_array) {
+  // The constant typed array comes from a constant-folded source (property
+  // cell, const field, ...) which holds it strongly, and the code depends on
+  // that source not changing. So the buffer behind the embedded data pointer
+  // cannot die while this code is valid. Embed the buffer anyway as defense in
+  // depth: with this weak reference, the code is deoptimized when the buffer
+  // dies.
+  masm->code_gen_state()->Retain(
+      typed_array.buffer(masm->compilation_info()->broker()).object());
+}
+
 template <typename ResultReg>
 void GenerateTypedArrayLoad(MaglevAssembler* masm, Register object,
                             Register index, ResultReg result_reg,
@@ -8189,6 +8201,8 @@ void GenerateConstantTypedArrayLoad(MaglevAssembler* masm,
                                     compiler::JSTypedArrayRef typed_array,
                                     Register index, ResultReg result_reg,
                                     ElementsKind kind) {
+  RetainConstantTypedArrayBuffer(masm, typed_array);
+
   MaglevAssembler::TemporaryRegisterScope temps(masm);
   Register data_pointer = temps.Acquire();
   __ Move(data_pointer, reinterpret_cast<intptr_t>(typed_array.data_ptr()));
@@ -8250,6 +8264,8 @@ void GenerateConstantTypedArrayStore(MaglevAssembler* masm,
                                      compiler::JSTypedArrayRef typed_array,
                                      Register index, ValueReg value,
                                      ElementsKind elements_kind) {
+  RetainConstantTypedArrayBuffer(masm, typed_array);
+
   MaglevAssembler::TemporaryRegisterScope temps(masm);
   Register data_pointer = temps.Acquire();
 

deps/v8/src/objects/js-objects.cc

@@ -478,6 +478,9 @@ Maybe<bool> JSReceiver::SetOrCopyDataProperties(
     InstanceType target_instance_type = target->map()->instance_type();
     if (InstanceTypeChecker::IsJSObject(target_instance_type) &&
         !InstanceTypeChecker::IsJSGlobalProxy(target_instance_type) &&
+        // Exclude remote objects (they don't have local properties anyway).
+        !(InstanceTypeChecker::IsJSSpecialApiObject(target_instance_type) &&
+          !target->GetCreationContext().has_value()) &&
         !InstanceTypeChecker::IsAlwaysSharedSpaceJSObject(
             target_instance_type)) {
       // Convert to slow properties if we're guaranteed to overflow the number

deps/v8/src/objects/map.cc

@@ -1378,8 +1378,10 @@ Handle<Map> Map::Normalize(Isolate* isolate, DirectHandle<Map> fast_map,
   }
   DirectHandle<NormalizedMapCache> cache;
   if (use_cache) {
+    Tagged<Object> maybe_native_context = meta_map->native_context_or_null();
+    DCHECK(!IsNull(maybe_native_context));
     Tagged<Object> normalized_map_cache =
-        meta_map->native_context()->normalized_map_cache();
+        Cast<NativeContext>(maybe_native_context)->normalized_map_cache();
     use_cache = !IsUndefined(normalized_map_cache);
     if (use_cache) {
       cache = Cast<NormalizedMapCache>(

deps/v8/test/unittests/api/remote-object-unittest.cc

@@ -101,5 +101,29 @@ TEST_F(RemoteObjectTest, TypeOfRemoteObject) {
   EXPECT_STREQ("object", *result);
 }
 
+TEST_F(RemoteObjectTest, NormalizeRemoteObject) {
+  Local<FunctionTemplate> constructor_template =
+      FunctionTemplate::New(isolate(), Constructor);
+  constructor_template->InstanceTemplate()->SetAccessCheckCallbackAndHandler(
+      AccessCheck, NamedPropertyHandlerConfiguration(NamedGetter),
+      IndexedPropertyHandlerConfiguration());
+
+  Local<Object> remote_object =
+      constructor_template->NewRemoteInstance().ToLocalChecked();
+
+  Local<Context> context = Context::New(isolate());
+  Context::Scope context_scope(context);
+
+  context->Global()
+      ->Set(context, String::NewFromUtf8Literal(isolate(), "remoteObj"),
+            remote_object)
+      .Check();
+
+  TryRunJS(
+      "const src = {};"
+      "for (let i = 0; i < 1200; i++) src['p' + i] = 1;"
+      "try { Object.assign(remoteObj, src); } catch (e) {}");
+}
+
 }  // namespace remote_object_unittest
 }  // namespace v8