deps: patch V8 to 15.6.75.22

deps/v8/include/v8-version.h

@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 15
 #define V8_MINOR_VERSION 6
 #define V8_BUILD_NUMBER 75
-#define V8_PATCH_LEVEL 13
+#define V8_PATCH_LEVEL 22
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)

deps/v8/src/ast/scopes.cc

@@ -345,6 +345,7 @@ void DeclarationScope::SetDefaults() {
                            is_module_scope());
   set_needs_private_name_context_chain_recalc(false);
   set_class_scope_has_private_brand(false);
+  set_class_initializer_allows_await(false);
   receiver_ = nullptr;
   new_target_ = nullptr;
   function_ = nullptr;
@@ -1575,7 +1576,8 @@ bool Scope::NeedsScopeInfo() const {
 }
 
 bool Scope::ShouldBanArguments() {
-  return GetReceiverScope()->should_ban_arguments();
+  return GetReceiverScope()->should_ban_arguments() &&
+         !GetClosureScope()->from_scope_info();
 }
 
 DeclarationScope* Scope::GetReceiverScope() {

deps/v8/src/ast/scopes.h

@@ -1387,6 +1387,13 @@ class V8_EXPORT_PRIVATE DeclarationScope : public Scope {
     return ClassScopeHasPrivateBrandField::decode(flags_);
   }
 
+  bool class_initializer_allows_await() const {
+    return ClassInitializerAllowsAwaitField::decode(flags_);
+  }
+  void set_class_initializer_allows_await(bool value) {
+    flags_ = ClassInitializerAllowsAwaitField::update(flags_, value);
+  }
+
  private:
   V8_INLINE void AllocateParameter(Variable* var, int index);
 
@@ -1430,6 +1437,8 @@ class V8_EXPORT_PRIVATE DeclarationScope : public Scope {
       HasThisDeclarationField::Next<bool, 1>;
   using ClassScopeHasPrivateBrandField =
       NeedsPrivateNameContextChainRecalcField::Next<bool, 1>;
+  using ClassInitializerAllowsAwaitField =
+      ClassScopeHasPrivateBrandField::Next<bool, 1>;
 
 #if DEBUG
   bool is_being_lazily_parsed_;

deps/v8/src/codegen/compiler.cc

@@ -2852,8 +2852,8 @@ void BackgroundDeserializeTask::Run() {
   LocalHandleScope handle_scope(&isolate);
 
   DirectHandle<SharedFunctionInfo> inner_result;
-  off_thread_data_ =
-      CodeSerializer::StartDeserializeOffThread(&isolate, &cached_data_);
+  CodeSerializer::StartDeserializeOffThread(&isolate, &cached_data_,
+                                            &off_thread_data_);
   if (v8_flags.enable_slow_asserts && off_thread_data_.HasResult()) {
 #ifdef ENABLE_SLOW_DCHECKS
     MergeAssumptionChecker checker(&isolate, false);
@@ -2866,6 +2866,11 @@ void BackgroundDeserializeTask::SourceTextAvailable(
     Isolate* isolate, Handle<String> source_text,
     const ScriptDetails& script_details) {
   DCHECK_EQ(isolate, isolate_for_local_isolate_);
+  if (!CodeSerializer::NotifySourceTextAvailable(isolate, &off_thread_data_,
+                                                 &cached_data_, source_text,
+                                                 script_details)) {
+    return;
+  }
   LanguageMode language_mode = construct_language_mode(v8_flags.use_strict);
   background_merge_task_.SetUpOnMainThread(isolate, source_text, script_details,
                                            language_mode);

deps/v8/src/codegen/compiler.h

@@ -719,7 +719,7 @@ class V8_EXPORT_PRIVATE BackgroundDeserializeTask {
  private:
   Isolate* isolate_for_local_isolate_;
   AlignedCachedData cached_data_;
-  CodeSerializer::OffThreadDeserializeData off_thread_data_;
+  OffThreadDeserializeData off_thread_data_;
   BackgroundMergeTask background_merge_task_;
   TimedHistogram* timer_;
   int64_t background_time_in_microseconds_ = 0;

deps/v8/src/compiler/common-operator.cc

@@ -515,6 +515,32 @@ const ExitMachineGraphParameters& ExitMachineGraphParametersOf(
   return OpParameter<ExitMachineGraphParameters>(op);
 }
 
+#if V8_ENABLE_SANDBOX
+size_t hash_value(const LoadTrustedPointerParameters& params) {
+  return base::hash_combine(params.offset, params.tag);
+}
+
+V8_EXPORT_PRIVATE std::ostream& operator<<(
+    std::ostream& os, LoadTrustedPointerParameters params) {
+  return os << "offset=" << params.offset << ", tag.first=" << params.tag.first
+            << ", tag.last=" << params.tag.last;
+}
+
+class LoadTrustedPointerOperator final
+    : public Operator1<LoadTrustedPointerParameters> {
+ public:
+  LoadTrustedPointerOperator(int offset, IndirectPointerTagRange tag)
+      : Operator1<LoadTrustedPointerParameters>(
+            IrOpcode::kLoadTrustedPointer, Operator::kEliminatable,
+            "LoadTrustedPointer", 1, 1, 1, 1, 1, 0, {offset, tag}) {}
+};
+
+const Operator* CommonOperatorBuilder::LoadTrustedPointer(
+    int offset, IndirectPointerTagRange tag) {
+  return zone_->New<LoadTrustedPointerOperator>(offset, tag);
+}
+#endif  // V8_ENABLE_SANDBOX
+
 #define COMMON_CACHED_OP_LIST(V)                          \
   V(Plug, Operator::kNoProperties, 0, 0, 0, 1, 0, 0)      \
   V(Dead, Operator::kFoldable, 0, 0, 0, 1, 1, 1)          \

deps/v8/src/compiler/common-operator.h

@@ -538,6 +538,20 @@ V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream& os,
 V8_EXPORT_PRIVATE const ExitMachineGraphParameters&
 ExitMachineGraphParametersOf(const Operator* op) V8_WARN_UNUSED_RESULT;
 
+#if V8_ENABLE_SANDBOX
+struct LoadTrustedPointerParameters {
+  int offset;
+  IndirectPointerTagRange tag;
+
+  bool operator==(const LoadTrustedPointerParameters&) const = default;
+};
+
+size_t hash_value(const LoadTrustedPointerParameters& params);
+
+V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream& os,
+                                           LoadTrustedPointerParameters params);
+#endif  // V8_ENABLE_SANDBOX
+
 // Interface for building common operators that can be used at any level of IR,
 // including JavaScript, mid-level, and low-level.
 class V8_EXPORT_PRIVATE CommonOperatorBuilder final
@@ -616,6 +630,9 @@ class V8_EXPORT_PRIVATE CommonOperatorBuilder final
   const Operator* HeapConstant(const Handle<HeapObject>&);
   const Operator* CompressedHeapConstant(const Handle<HeapObject>&);
   const Operator* TrustedHeapConstant(const Handle<HeapObject>&);
+#if V8_ENABLE_SANDBOX
+  const Operator* LoadTrustedPointer(int offset, IndirectPointerTagRange tag);
+#endif
   const Operator* ObjectId(uint32_t);
 
   const Operator* RelocatableInt32Constant(int32_t value,

deps/v8/src/compiler/opcodes.h

@@ -85,15 +85,16 @@
   V(EnterMachineGraph)      \
   V(ExitMachineGraph)
 
-#define COMMON_OP_LIST(V)      \
-  CONSTANT_OP_LIST(V)          \
-  INNER_OP_LIST(V)             \
-  V(Unreachable)               \
-  V(DeadValue)                 \
-  V(Dead)                      \
-  V(Plug)                      \
-  V(SLVerifierHint)            \
-  V(MajorGCForCompilerTesting) \
+#define COMMON_OP_LIST(V)           \
+  CONSTANT_OP_LIST(V)               \
+  INNER_OP_LIST(V)                  \
+  V(Unreachable)                    \
+  V(DeadValue)                      \
+  V(Dead)                           \
+  V(Plug)                           \
+  V(SLVerifierHint)                 \
+  V(MajorGCForCompilerTesting)      \
+  IF_SANDBOX(V, LoadTrustedPointer) \
   V(StaticAssert)
 
 // Opcodes for JavaScript operators.

deps/v8/src/compiler/simplified-lowering-verifier.cc

@@ -504,6 +504,7 @@ void SimplifiedLoweringVerifier::VisitNode(Node* node,
       CASE(Dead)
       CASE(Plug)
       CASE(MajorGCForCompilerTesting)
+      IF_SANDBOX(CASE, LoadTrustedPointer)
       CASE(StaticAssert)
       // Simplified change operators
       CASE(ChangeTaggedSignedToInt32)

deps/v8/src/compiler/turbofan-typer.cc

@@ -1297,6 +1297,9 @@ Type Typer::Visitor::TypeMajorGCForCompilerTesting(Node* node) {
   UNREACHABLE();
 }
 Type Typer::Visitor::TypeStaticAssert(Node* node) { UNREACHABLE(); }
+#if V8_ENABLE_SANDBOX
+Type Typer::Visitor::TypeLoadTrustedPointer(Node* node) { UNREACHABLE(); }
+#endif
 Type Typer::Visitor::TypeSLVerifierHint(Node* node) { UNREACHABLE(); }
 
 // JS comparison operators.

deps/v8/src/compiler/turboshaft/graph-builder.cc

@@ -1434,6 +1434,14 @@ OpIndex GraphBuilder::Process(
       return __ Load(Map(node->InputAt(0)), Map(node->InputAt(1)),
                      LoadOp::Kind::Trapping(), loaded_rep);
     }
+#if V8_ENABLE_SANDBOX
+    case IrOpcode::kLoadTrustedPointer: {
+      auto params = OpParameter<LoadTrustedPointerParameters>(op);
+      return __ LoadTrustedPointer(Map(node->InputAt(0)),
+                                   LoadOp::Kind::TaggedBase(), params.tag,
+                                   params.offset + kHeapObjectTag);
+    }
+#endif
 
     case IrOpcode::kStore:
     case IrOpcode::kUnalignedStore: {

deps/v8/src/compiler/verifier.cc

@@ -653,6 +653,11 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kExitMachineGraph:
       CheckValueInputIs(node, 0, Type::Machine());
       break;
+#if V8_ENABLE_SANDBOX
+    case IrOpcode::kLoadTrustedPointer:
+      // TODO(manoskouk): what are the constraints here?
+      break;
+#endif
 
     // JavaScript operators
     // --------------------

deps/v8/src/compiler/wasm-graph-assembler.cc

@@ -242,55 +242,6 @@ Node* WasmGraphAssembler::BuildDecodeSandboxedExternalPointer(
 #endif  // V8_ENABLE_SANDBOX
 }
 
-Node* WasmGraphAssembler::BuildDecodeTrustedPointer(
-    Node* handle, IndirectPointerTagRange tag_range) {
-#if V8_ENABLE_SANDBOX
-  Node* index = Word32Shr(handle, Int32Constant(kTrustedPointerHandleShift));
-  Node* offset = ChangeUint32ToUint64(
-      Word32Shl(index, Int32Constant(kTrustedPointerTableEntrySizeLog2)));
-  Node* table = Load(MachineType::Pointer(), LoadRootRegister(),
-                     IsolateData::trusted_pointer_table_offset() +
-                         Internals::kExternalEntityTableBasePointerOffset);
-  Node* decoded_ptr = Load(MachineType::Pointer(), table, offset);
-
-  if (IsFastIndirectPointerTagRange(tag_range)) {
-    uint64_t mask = ComputeUntaggingMaskForFastIndirectPointerTag(tag_range);
-    decoded_ptr = WordAnd(decoded_ptr, IntPtrConstant(mask));
-  } else {
-    Node* tag =
-        WordShr(decoded_ptr, IntPtrConstant(kTrustedPointerTableTagShift));
-
-    auto ok = MakeLabel();
-    if (tag_range.Size() == 1) {
-      // The common and simple case: we expect exactly one tag.
-      Node* expected_tag = IntPtrConstant(tag_range.first);
-      GotoIf(WordEqual(tag, expected_tag), &ok, BranchHint::kTrue);
-      RuntimeAbort(AbortReason::kIndirectPointerTagMismatch);
-      Goto(&ok);  // Unreachable, but needed for graph coherency.
-    } else {
-      // Range check.
-      Node* diff = IntPtrSub(tag, IntPtrConstant(tag_range.first));
-      GotoIf(Uint64LessThanOrEqual(
-                 diff, IntPtrConstant(tag_range.last - tag_range.first)),
-             &ok, BranchHint::kTrue);
-      RuntimeAbort(AbortReason::kIndirectPointerTagMismatch);
-      Goto(&ok);  // Unreachable, but needed for graph coherency.
-    }
-
-    Bind(&ok);
-    decoded_ptr =
-        WordAnd(decoded_ptr, IntPtrConstant(kTrustedPointerTablePayloadMask));
-  }
-
-  // We have to change the type of the result value to Tagged, so if the value
-  // gets spilled on the stack, it will get processed by the GC.
-  decoded_ptr = BitcastWordToTagged(decoded_ptr);
-  return decoded_ptr;
-#else
-  UNREACHABLE();
-#endif  // V8_ENABLE_SANDBOX
-}
-
 Node* WasmGraphAssembler::BuildLoadExternalPointerFromObject(
     Node* object, int field_offset, ExternalPointerTagRange tag_range,
     Node* isolate_root) {
@@ -408,38 +359,14 @@ Node* WasmGraphAssembler::LoadByteArrayElement(Node* byte_array,
   return LoadFromObject(type, byte_array, offset);
 }
 
-Node* WasmGraphAssembler::LoadImmutableTrustedPointerFromObject(
-    Node* object, int field_offset, IndirectPointerTagRange tag) {
-  Node* offset = IntPtrConstant(field_offset);
-#ifdef V8_ENABLE_SANDBOX
-  Node* handle = LoadImmutableFromObject(MachineType::Uint32(), object, offset);
-  return BuildDecodeTrustedPointer(handle, tag);
-#else
-  return LoadImmutableFromObject(MachineType::TaggedPointer(), object, offset);
-#endif
-}
-
 Node* WasmGraphAssembler::LoadTrustedPointerFromObject(
     Node* object, int field_offset, IndirectPointerTagRange tag) {
-  Node* offset = IntPtrConstant(field_offset);
 #ifdef V8_ENABLE_SANDBOX
-  Node* handle = LoadFromObject(MachineType::Uint32(), object, offset);
-  return BuildDecodeTrustedPointer(handle, tag);
+  return AddNode(graph()->NewNode(common_.LoadTrustedPointer(field_offset, tag),
+                                  object, effect(), control()));
 #else
-  return LoadFromObject(MachineType::TaggedPointer(), object, offset);
-#endif
-}
-
-std::pair<Node*, Node*>
-WasmGraphAssembler::LoadTrustedPointerFromObjectTrapOnNull(
-    Node* object, int field_offset, IndirectPointerTagRange tag) {
   Node* offset = IntPtrConstant(field_offset);
-#ifdef V8_ENABLE_SANDBOX
-  Node* handle = LoadTrapOnNull(MachineType::Uint32(), object, offset);
-  return {handle, BuildDecodeTrustedPointer(handle, tag)};
-#else
-  Node* value = LoadTrapOnNull(MachineType::TaggedPointer(), object, offset);
-  return {value, value};
+  return LoadFromObject(MachineType::TaggedPointer(), object, offset);
 #endif
 }
 
@@ -465,7 +392,7 @@ Node* WasmGraphAssembler::LoadContextNoCellFromJSFunction(Node* js_function) {
 
 Node* WasmGraphAssembler::LoadFunctionDataFromJSFunction(Node* js_function) {
   Node* shared = LoadSharedFunctionInfo(js_function);
-  return LoadImmutableTrustedPointerFromObject(
+  return LoadTrustedPointerFromObject(
       shared,
       offsetof(SharedFunctionInfo, trusted_function_data_) - kHeapObjectTag,
       kWasmExportedFunctionDataIndirectPointerTag);
@@ -624,7 +551,7 @@ Node* WasmGraphAssembler::StringPrepareForGetCodeunit(Node* string) {
 
 Node* WasmGraphAssembler::LoadTrustedDataFromInstanceObject(
     Node* instance_object) {
-  return LoadImmutableTrustedPointerFromObject(
+  return LoadTrustedPointerFromObject(
       instance_object,
       offsetof(WasmInstanceObject, trusted_data_) - kHeapObjectTag,
       kWasmTrustedInstanceDataIndirectPointerTag);

deps/v8/src/compiler/wasm-graph-assembler.h

@@ -28,7 +28,8 @@ class WasmGraphAssembler : public GraphAssembler {
  public:
   WasmGraphAssembler(MachineGraph* mcgraph, Zone* zone)
       : GraphAssembler(mcgraph, zone, BranchSemantics::kMachine),
-        simplified_(zone) {}
+        simplified_(zone),
+        common_(zone) {}
 
   // While CallBuiltin() translates to a direct call to the address of the
   // builtin, CallBuiltinThroughJumptable instead jumps to a slot in a jump
@@ -177,15 +178,8 @@ class WasmGraphAssembler : public GraphAssembler {
                                            ExternalPointerTagRange tag_range,
                                            Node* isolate_root);
 
-  Node* LoadImmutableTrustedPointerFromObject(Node* object, int offset,
-                                              IndirectPointerTagRange tag);
   Node* LoadTrustedPointerFromObject(Node* object, int offset,
                                      IndirectPointerTagRange tag);
-  // Returns the load node (where the source position for the trap needs to be
-  // set by the caller) and the result.
-  std::pair<Node*, Node*> LoadTrustedPointerFromObjectTrapOnNull(
-      Node* object, int offset, IndirectPointerTagRange tag);
-  Node* BuildDecodeTrustedPointer(Node* handle, IndirectPointerTagRange tag);
 
   Node* IsSmi(Node* object);
 
@@ -345,6 +339,7 @@ class WasmGraphAssembler : public GraphAssembler {
   }
 
   SimplifiedOperatorBuilder simplified_;
+  CommonOperatorBuilder common_;
 };
 
 }  // namespace compiler