deps: patch V8 to 7.7.299.10

Refs: v8/v8@7.7.299.8...7.7.299.10 PR-URL: #29472 Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Jiawen Geng <technicalcute@gmail.com>

Author: Hakerh400

deps/v8/include/v8-version.h

@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 7
 #define V8_MINOR_VERSION 7
 #define V8_BUILD_NUMBER 299
-#define V8_PATCH_LEVEL 8
+#define V8_PATCH_LEVEL 10
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)

deps/v8/src/builtins/base.tq

@@ -336,10 +336,16 @@ macro NewJSObject(implicit context: Context)(): JSObject {
  };
 }
 
+extern macro HasPrototypeSlot(JSFunction): bool;
+
 macro GetDerivedMap(implicit context: Context)(
  target: JSFunction, newTarget: JSReceiver): Map {
  try {
  const constructor = Cast<JSFunction>(newTarget) otherwise SlowPath;
+ if (!HasPrototypeSlot(constructor)) {
+ goto SlowPath;
+ }
+ assert(IsConstructor(constructor));
  const map =
  Cast<Map>(constructor.prototype_or_initial_map) otherwise SlowPath;
  if (LoadConstructorOrBackPointer(map) != target) {

deps/v8/src/codegen/code-stub-assembler.cc

@@ -2622,6 +2622,11 @@ TNode<BoolT> CodeStubAssembler::IsGeneratorFunction(
  Int32Constant(FunctionKind::kConciseGeneratorMethod))));
 }
 
+TNode<BoolT> CodeStubAssembler::HasPrototypeSlot(TNode<JSFunction> function) {
+ return TNode<BoolT>::UncheckedCast(IsSetWord32<Map::HasPrototypeSlotBit>(
+ LoadMapBitField(LoadMap(function))));
+}
+
 TNode<BoolT> CodeStubAssembler::HasPrototypeProperty(TNode<JSFunction> function,
  TNode<Map> map) {
  // (has_prototype_slot() && IsConstructor()) ||

deps/v8/src/codegen/code-stub-assembler.h

@@ -1272,6 +1272,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
  TNode<Map> LoadJSArrayElementsMap(SloppyTNode<Int32T> kind,
  SloppyTNode<Context> native_context);
 
+ TNode<BoolT> HasPrototypeSlot(TNode<JSFunction> function);
  TNode<BoolT> IsGeneratorFunction(TNode<JSFunction> function);
  TNode<BoolT> HasPrototypeProperty(TNode<JSFunction> function, TNode<Map> map);
  void GotoIfPrototypeRequiresRuntimeLookup(TNode<JSFunction> function,

deps/v8/src/compiler/js-native-context-specialization.cc

@@ -1060,7 +1060,8 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess(
  Node* control = NodeProperties::GetControlInput(node);
 
  ZoneVector<PropertyAccessInfo> access_infos(zone());
- AccessInfoFactory access_info_factory(broker(), dependencies(), zone());
+ AccessInfoFactory access_info_factory(broker(), dependencies(),
+ graph()->zone());
  if (!access_info_factory.FinalizePropertyAccessInfos(
  feedback.access_infos(), access_mode, &access_infos)) {
  return NoChange();
@@ -1765,7 +1766,7 @@ Reduction JSNativeContextSpecialization::ReducePropertyAccess(
  if (name.has_value()) {
  ZoneVector<PropertyAccessInfo> access_infos(zone());
  AccessInfoFactory access_info_factory(broker(), dependencies(),
- zone());
+ graph()->zone());
  access_info_factory.ComputePropertyAccessInfos(
  receiver_maps, name->object(), access_mode, &access_infos);
  processed = new (zone()) NamedAccessFeedback(*name, access_infos);

deps/v8/src/regexp/regexp-compiler.cc

@@ -1970,9 +1970,11 @@ void ChoiceNode::GetQuickCheckDetails(QuickCheckDetails* details,
  }
 }
 
+namespace {
+
 // Check for [0-9A-Z_a-z].
-static void EmitWordCheck(RegExpMacroAssembler* assembler, Label* word,
-  Label* non_word, bool fall_through_on_word) {
+void EmitWordCheck(RegExpMacroAssembler* assembler, Label* word,
+ Label* non_word, bool fall_through_on_word) {
  if (assembler->CheckSpecialCharacterClass(
  fall_through_on_word ? 'w' : 'W',
  fall_through_on_word ? non_word : word)) {
@@ -1994,24 +1996,37 @@ static void EmitWordCheck(RegExpMacroAssembler* assembler, Label* word,
 
 // Emit the code to check for a ^ in multiline mode (1-character lookbehind
 // that matches newline or the start of input).
-static void EmitHat(RegExpCompiler* compiler, RegExpNode* on_success,
- Trace* trace) {
+void EmitHat(RegExpCompiler* compiler, RegExpNode* on_success, Trace* trace) {
  RegExpMacroAssembler* assembler = compiler->macro_assembler();
- // We will be loading the previous character into the current character
- // register.
+
+ // We will load the previous character into the current character register.
  Trace new_trace(*trace);
  new_trace.InvalidateCurrentCharacter();
 
+ // A positive (> 0) cp_offset means we've already successfully matched a
+ // non-empty-width part of the pattern, and thus cannot be at or before the
+ // start of the subject string. We can thus skip both at-start and
+ // bounds-checks when loading the one-character lookbehind.
+ const bool may_be_at_or_before_subject_string_start =
+ new_trace.cp_offset() <= 0;
+
  Label ok;
- if (new_trace.cp_offset() == 0) {
- // The start of input counts as a newline in this context, so skip to
- // ok if we are at the start.
- assembler->CheckAtStart(&ok);
+ if (may_be_at_or_before_subject_string_start) {
+ // The start of input counts as a newline in this context, so skip to ok if
+ // we are at the start.
+ // TODO(jgruber): It would be less awkward to use CheckAtStart here, but
+ // that currently does not support a non-zero cp_offset.
+ Label not_at_start;
+ assembler->CheckNotAtStart(new_trace.cp_offset(), &not_at_start);
+ assembler->GoTo(&ok);
+ assembler->Bind(&not_at_start);
  }
- // We already checked that we are not at the start of input so it must be
- // OK to load the previous character.
+
+ // If we've already checked that we are not at the start of input, it's okay
+ // to load the previous character without bounds checks.
+ const bool can_skip_bounds_check = !may_be_at_or_before_subject_string_start;
  assembler->LoadCurrentCharacter(new_trace.cp_offset() - 1,
- new_trace.backtrack(), false);
+ new_trace.backtrack(), can_skip_bounds_check);
  if (!assembler->CheckSpecialCharacterClass('n', new_trace.backtrack())) {
  // Newline means \n, \r, 0x2028 or 0x2029.
  if (!compiler->one_byte()) {
@@ -2024,6 +2039,8 @@ static void EmitHat(RegExpCompiler* compiler, RegExpNode* on_success,
  on_success->Emit(compiler, &new_trace);
 }
 
+} // namespace
+
 // Emit the code to handle \b and \B (word-boundary or non-word-boundary).
 void AssertionNode::EmitBoundaryCheck(RegExpCompiler* compiler, Trace* trace) {
  RegExpMacroAssembler* assembler = compiler->macro_assembler();
@@ -2080,21 +2097,35 @@ void AssertionNode::BacktrackIfPrevious(
  Trace new_trace(*trace);
  new_trace.InvalidateCurrentCharacter();
 
- Label fall_through, dummy;
-
+ Label fall_through;
  Label* non_word = backtrack_if_previous == kIsNonWord ? new_trace.backtrack()
  : &fall_through;
  Label* word = backtrack_if_previous == kIsNonWord ? &fall_through
  : new_trace.backtrack();
 
- if (new_trace.cp_offset() == 0) {
+ // A positive (> 0) cp_offset means we've already successfully matched a
+ // non-empty-width part of the pattern, and thus cannot be at or before the
+ // start of the subject string. We can thus skip both at-start and
+ // bounds-checks when loading the one-character lookbehind.
+ const bool may_be_at_or_before_subject_string_start =
+ new_trace.cp_offset() <= 0;
+
+ if (may_be_at_or_before_subject_string_start) {
  // The start of input counts as a non-word character, so the question is
  // decided if we are at the start.
- assembler->CheckAtStart(non_word);
- }
- // We already checked that we are not at the start of input so it must be
- // OK to load the previous character.
- assembler->LoadCurrentCharacter(new_trace.cp_offset() - 1, &dummy, false);
+ // TODO(jgruber): It would be less awkward to use CheckAtStart here, but
+ // that currently does not support a non-zero cp_offset.
+ Label not_at_start;
+ assembler->CheckNotAtStart(new_trace.cp_offset(), &not_at_start);
+ assembler->GoTo(non_word);
+ assembler->Bind(&not_at_start);
+ }
+
+ // If we've already checked that we are not at the start of input, it's okay
+ // to load the previous character without bounds checks.
+ const bool can_skip_bounds_check = !may_be_at_or_before_subject_string_start;
+ assembler->LoadCurrentCharacter(new_trace.cp_offset() - 1, non_word,
+ can_skip_bounds_check);
  EmitWordCheck(assembler, word, non_word, backtrack_if_previous == kIsNonWord);
 
  assembler->Bind(&fall_through);

deps/v8/test/mjsunit/regress/regress-996391.js

@@ -0,0 +1,9 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --regexp-interpret-all
+
+assertArrayEquals(["o"], /.(?<!^.)/m.exec("foobar"));
+assertArrayEquals(["o"], /.(?<!\b.)/m.exec("foobar"));
+assertArrayEquals(["f"], /.(?<!\B.)/m.exec("foobar"));