deps: patch V8 to 9.0.257.21

Refs: v8/v8@9.0.257.19...9.0.257.21 PR-URL: #38333 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Jiawen Geng <technicalcute@gmail.com> Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: James M Snell <jasnell@gmail.com>

Author: targos

deps/v8/include/v8-version.h

@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 9
 #define V8_MINOR_VERSION 0
 #define V8_BUILD_NUMBER 257
-#define V8_PATCH_LEVEL 19
+#define V8_PATCH_LEVEL 21
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)

deps/v8/src/compiler/js-call-reducer.cc

@@ -5380,24 +5380,31 @@ Reduction JSCallReducer::ReduceArrayPrototypePop(Node* node) {
  }
 
  // Compute the new {length}.
- length = graph()->NewNode(simplified()->NumberSubtract(), length,
- jsgraph()->OneConstant());
+ Node* new_length = graph()->NewNode(simplified()->NumberSubtract(),
+ length, jsgraph()->OneConstant());
+
+ // This extra check exists solely to break an exploitation technique
+ // that abuses typer mismatches.
+ new_length = efalse = graph()->NewNode(
+ simplified()->CheckBounds(p.feedback(),
+ CheckBoundsFlag::kAbortOnOutOfBounds),
+ new_length, length, efalse, if_false);
 
  // Store the new {length} to the {receiver}.
  efalse = graph()->NewNode(
  simplified()->StoreField(AccessBuilder::ForJSArrayLength(kind)),
- receiver, length, efalse, if_false);
+ receiver, new_length, efalse, if_false);
 
  // Load the last entry from the {elements}.
  vfalse = efalse = graph()->NewNode(
  simplified()->LoadElement(AccessBuilder::ForFixedArrayElement(kind)),
- elements, length, efalse, if_false);
+ elements, new_length, efalse, if_false);
 
  // Store a hole to the element we just removed from the {receiver}.
  efalse = graph()->NewNode(
  simplified()->StoreElement(
  AccessBuilder::ForFixedArrayElement(GetHoleyElementsKind(kind))),
- elements, length, jsgraph()->TheHoleConstant(), efalse, if_false);
+ elements, new_length, jsgraph()->TheHoleConstant(), efalse, if_false);
  }
 
  control = graph()->NewNode(common()->Merge(2), if_true, if_false);
@@ -5573,19 +5580,27 @@ Reduction JSCallReducer::ReduceArrayPrototypeShift(Node* node) {
  }
 
  // Compute the new {length}.
- length = graph()->NewNode(simplified()->NumberSubtract(), length,
- jsgraph()->OneConstant());
+ Node* new_length = graph()->NewNode(simplified()->NumberSubtract(),
+ length, jsgraph()->OneConstant());
+
+ // This extra check exists solely to break an exploitation technique
+ // that abuses typer mismatches.
+ new_length = etrue1 = graph()->NewNode(
+ simplified()->CheckBounds(p.feedback(),
+ CheckBoundsFlag::kAbortOnOutOfBounds),
+ new_length, length, etrue1, if_true1);
 
  // Store the new {length} to the {receiver}.
  etrue1 = graph()->NewNode(
  simplified()->StoreField(AccessBuilder::ForJSArrayLength(kind)),
- receiver, length, etrue1, if_true1);
+ receiver, new_length, etrue1, if_true1);
 
  // Store a hole to the element we just removed from the {receiver}.
  etrue1 = graph()->NewNode(
  simplified()->StoreElement(AccessBuilder::ForFixedArrayElement(
  GetHoleyElementsKind(kind))),
- elements, length, jsgraph()->TheHoleConstant(), etrue1, if_true1);
+ elements, new_length, jsgraph()->TheHoleConstant(), etrue1,
+ if_true1);
  }
 
  Node* if_false1 = graph()->NewNode(common()->IfFalse(), branch1);

deps/v8/src/compiler/simplified-lowering.cc

@@ -1474,10 +1474,15 @@ class RepresentationSelector {
  Type right_feedback_type = TypeOf(node->InputAt(1));
 
  // Using Signed32 as restriction type amounts to promising there won't be
- // signed overflow. This is incompatible with relying on a Word32
- // truncation in order to skip the overflow check.
+ // signed overflow. This is incompatible with relying on a Word32 truncation
+ // in order to skip the overflow check. Similarly, we must not drop -0 from
+ // the result type unless we deopt for -0 inputs.
  Type const restriction =
- truncation.IsUsedAsWord32() ? Type::Any() : Type::Signed32();
+ truncation.IsUsedAsWord32()
+ ? Type::Any()
+ : (truncation.identify_zeros() == kIdentifyZeros)
+ ? Type::Signed32OrMinusZero()
+ : Type::Signed32();
 
  // Handle the case when no int32 checks on inputs are necessary (but
  // an overflow check is needed on the output). Note that we do not