deps: patch V8 to 11.8.172.16

targos · targos · commit 0e3b631fcc18 · 2023-10-19T17:21:43.000+02:00
Refs: v8/v8@11.8.172.15...11.8.172.16
diff --git a/deps/v8/include/v8-version.h b/deps/v8/include/v8-version.h
@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 11
 #define V8_MINOR_VERSION 8
 #define V8_BUILD_NUMBER 172
-#define V8_PATCH_LEVEL 15
+#define V8_PATCH_LEVEL 16
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)
diff --git a/deps/v8/src/objects/js-function.cc b/deps/v8/src/objects/js-function.cc
@@ -1083,13 +1083,13 @@ MaybeHandle<Map> JSFunction::GetDerivedMap(Isolate* isolate,
                                          isolate);
     prototype = handle(realm_constructor->prototype(), isolate);
   }
-  CHECK(IsJSReceiver(*prototype));
-  DCHECK_EQ(constructor_initial_map->constructor_or_back_pointer(),
-            *constructor);
 
-  Handle<Map> map = Map::TransitionToDerivedMap(
-      isolate, constructor_initial_map, Handle<HeapObject>::cast(prototype));
-  DCHECK_EQ(map->constructor_or_back_pointer(), *constructor);
+  Handle<Map> map = Map::CopyInitialMap(isolate, constructor_initial_map);
+  map->set_new_target_is_base(false);
+  CHECK(IsJSReceiver(*prototype));
+  if (map->prototype() != *prototype)
+    Map::SetPrototype(isolate, map, Handle<HeapObject>::cast(prototype));
+  map->SetConstructor(*constructor);
   return map;
 }
 
diff --git a/deps/v8/src/objects/map.cc b/deps/v8/src/objects/map.cc
@@ -2344,31 +2344,13 @@ void Map::StartInobjectSlackTracking() {
 
 Handle<Map> Map::TransitionToPrototype(Isolate* isolate, Handle<Map> map,
                                        Handle<HeapObject> prototype) {
-  Handle<Map> new_map = TransitionsAccessor::GetPrototypeTransition(
-      isolate, map, prototype, map->new_target_is_base());
+  Handle<Map> new_map =
+      TransitionsAccessor::GetPrototypeTransition(isolate, map, prototype);
   if (new_map.is_null()) {
     new_map = Copy(isolate, map, "TransitionToPrototype");
     TransitionsAccessor::PutPrototypeTransition(isolate, map, prototype,
                                                 new_map);
-    if (*prototype != map->prototype()) {
-      Map::SetPrototype(isolate, new_map, prototype);
-    }
-  }
-  return new_map;
-}
-
-Handle<Map> Map::TransitionToDerivedMap(Isolate* isolate, Handle<Map> map,
-                                        Handle<HeapObject> prototype) {
-  Handle<Map> new_map = TransitionsAccessor::GetPrototypeTransition(
-      isolate, map, prototype, /* new_target_is_base */ false);
-  if (new_map.is_null()) {
-    new_map = CopyInitialMap(isolate, map);
-    TransitionsAccessor::PutPrototypeTransition(isolate, map, prototype,
-                                                new_map);
-    if (*prototype != map->prototype()) {
-      Map::SetPrototype(isolate, new_map, prototype);
-    }
-    new_map->set_new_target_is_base(false);
+    Map::SetPrototype(isolate, new_map, prototype);
   }
   return new_map;
 }
diff --git a/deps/v8/src/objects/map.h b/deps/v8/src/objects/map.h
@@ -863,9 +863,6 @@ class Map : public TorqueGeneratedMap<Map, HeapObject> {
   V8_EXPORT_PRIVATE static Handle<Map> TransitionToPrototype(
       Isolate* isolate, Handle<Map> map, Handle<HeapObject> prototype);
 
-  V8_EXPORT_PRIVATE static Handle<Map> TransitionToDerivedMap(
-      Isolate* isolate, Handle<Map> map, Handle<HeapObject> prototype);
-
   static Handle<Map> TransitionToImmutableProto(Isolate* isolate,
                                                 Handle<Map> map);
 
diff --git a/deps/v8/src/objects/transitions.cc b/deps/v8/src/objects/transitions.cc
@@ -443,8 +443,7 @@ void TransitionsAccessor::PutPrototypeTransition(Isolate* isolate,
 
 // static
 Handle<Map> TransitionsAccessor::GetPrototypeTransition(
-    Isolate* isolate, Handle<Map> map, Handle<Object> prototype_handle,
-    bool new_target_is_base) {
+    Isolate* isolate, Handle<Map> map, Handle<Object> prototype_handle) {
   DisallowGarbageCollection no_gc;
   Object prototype = *prototype_handle;
   Tagged<WeakFixedArray> cache = GetPrototypeTransitions(isolate, map);
@@ -456,8 +455,7 @@ Handle<Map> TransitionsAccessor::GetPrototypeTransition(
     Tagged<HeapObject> heap_object;
     if (target.GetHeapObjectIfWeak(&heap_object)) {
       Tagged<Map> target_map = Map::cast(heap_object);
-      if (target_map->prototype() == prototype &&
-          target_map->new_target_is_base() == new_target_is_base) {
+      if (target_map->prototype() == prototype) {
         return handle(target_map, isolate);
       }
     }
diff --git a/deps/v8/src/objects/transitions.h b/deps/v8/src/objects/transitions.h
@@ -124,20 +124,19 @@ class V8_EXPORT_PRIVATE TransitionsAccessor {
   }
 
   // ===== PROTOTYPE TRANSITIONS =====
-  // When you set the prototype of an object using the __proto__ accessor, or if
-  // an unrelated new.target is passed to a constructor you need a new map for
-  // the object (the prototype is stored in the map).  In order not to multiply
-  // maps unnecessarily we store these as transitions in the original map.  That
-  // way we can transition to the same map if the same prototype is set, rather
-  // than creating a new map every time.  The transitions are in the form of a
-  // map where the keys are prototype objects and the values are the maps they
-  // transition to. PutPrototypeTransition can trigger GC.
+  // When you set the prototype of an object using the __proto__ accessor you
+  // need a new map for the object (the prototype is stored in the map).  In
+  // order not to multiply maps unnecessarily we store these as transitions in
+  // the original map.  That way we can transition to the same map if the same
+  // prototype is set, rather than creating a new map every time.  The
+  // transitions are in the form of a map where the keys are prototype objects
+  // and the values are the maps they transition to.
+  // PutPrototypeTransition can trigger GC.
   static void PutPrototypeTransition(Isolate* isolate, Handle<Map>,
                                      Handle<Object> prototype,
                                      Handle<Map> target_map);
   static Handle<Map> GetPrototypeTransition(Isolate* isolate, Handle<Map> map,
-                                            Handle<Object> prototype,
-                                            bool new_target_is_base);
+                                            Handle<Object> prototype);
 
   // During the first-time Map::Update and Map::TryUpdate, the migration target
   // map could be cached in the raw_transitions slot of the old map that is
diff --git a/deps/v8/test/mjsunit/regress/regress-reflect-construct.js b/deps/v8/test/mjsunit/regress/regress-reflect-construct.js
