[v14.x] deps: V8: cherry-pick 81181a8ad80a

Original commit message: [JSON] Fix GC issue in BuildJsonObject We must ensure that the sweeper is not running or has already swept mutable_double_buffer. Otherwise the GC can add it to the free list. Bug: v8:11837 Change-Id: Ifd9cf15f1c94f664fd6489c70bb38b59730cdd78 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2928181 Commit-Queue: Victor Gomes <victorgomes@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/master@{#74859} Refs: v8/v8@81181a8

Author: thomasmichaelwallace

common.gypi

@@ -36,7 +36,7 @@
 
  # Reset this number to 0 on major V8 upgrades.
  # Increment by one for each non-official patch applied to deps/v8.
- 'v8_embedder_string': '-node.72',
+ 'v8_embedder_string': '-node.73',
 
  ##### V8 defaults for Node.js #####
 

deps/v8/src/heap/heap.cc

@@ -3347,6 +3347,10 @@ void Heap::MakeHeapIterable() {
  mark_compact_collector()->EnsureSweepingCompleted();
 }
 
+void Heap::EnsureSweepingCompleted() {
+ mark_compact_collector()->EnsureSweepingCompleted();
+}
+
 namespace {
 
 double ComputeMutatorUtilizationImpl(double mutator_speed, double gc_speed) {

deps/v8/src/heap/heap.h

@@ -1001,6 +1001,8 @@ class Heap {
  Reservation* reservations, const std::vector<HeapObject>& large_objects,
  const std::vector<Address>& maps);
 
+ void EnsureSweepingCompleted();
+
  IncrementalMarking* incremental_marking() {
  return incremental_marking_.get();
  }

deps/v8/src/json/json-parser.cc

@@ -633,6 +633,11 @@ Handle<Object> JsonParser<Char>::BuildJsonObject(
  DCHECK_EQ(mutable_double_address, end);
  }
 #endif
+ // Before setting the length of mutable_double_buffer back to zero, we
+ // must ensure that the sweeper is not running or has already swept the
+ // object's page. Otherwise the GC can add the contents of
+ // mutable_double_buffer to the free list.
+ isolate()->heap()->EnsureSweepingCompleted();
  mutable_double_buffer->set_length(0);
  }
  }