deps: patch V8 to 15.6.75.22

Refs: v8/v8@15.6.75.13...15.6.75.22

Author: nodejs-github-bot

deps/v8/include/v8-version.h

@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 15
 #define V8_MINOR_VERSION 6
 #define V8_BUILD_NUMBER 75
-#define V8_PATCH_LEVEL 13
+#define V8_PATCH_LEVEL 22
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)

deps/v8/src/ast/scopes.cc

@@ -345,6 +345,7 @@ void DeclarationScope::SetDefaults() {
                            is_module_scope());
   set_needs_private_name_context_chain_recalc(false);
   set_class_scope_has_private_brand(false);
+  set_class_initializer_allows_await(false);
   receiver_ = nullptr;
   new_target_ = nullptr;
   function_ = nullptr;
@@ -1575,7 +1576,8 @@ bool Scope::NeedsScopeInfo() const {
 }
 
 bool Scope::ShouldBanArguments() {
-  return GetReceiverScope()->should_ban_arguments();
+  return GetReceiverScope()->should_ban_arguments() &&
+         !GetClosureScope()->from_scope_info();
 }
 
 DeclarationScope* Scope::GetReceiverScope() {

deps/v8/src/ast/scopes.h

@@ -1387,6 +1387,13 @@ class V8_EXPORT_PRIVATE DeclarationScope : public Scope {
     return ClassScopeHasPrivateBrandField::decode(flags_);
   }
 
+  bool class_initializer_allows_await() const {
+    return ClassInitializerAllowsAwaitField::decode(flags_);
+  }
+  void set_class_initializer_allows_await(bool value) {
+    flags_ = ClassInitializerAllowsAwaitField::update(flags_, value);
+  }
+
  private:
   V8_INLINE void AllocateParameter(Variable* var, int index);
 
@@ -1430,6 +1437,8 @@ class V8_EXPORT_PRIVATE DeclarationScope : public Scope {
       HasThisDeclarationField::Next<bool, 1>;
   using ClassScopeHasPrivateBrandField =
       NeedsPrivateNameContextChainRecalcField::Next<bool, 1>;
+  using ClassInitializerAllowsAwaitField =
+      ClassScopeHasPrivateBrandField::Next<bool, 1>;
 
 #if DEBUG
   bool is_being_lazily_parsed_;

deps/v8/src/codegen/compiler.cc

@@ -2852,8 +2852,8 @@ void BackgroundDeserializeTask::Run() {
   LocalHandleScope handle_scope(&isolate);
 
   DirectHandle<SharedFunctionInfo> inner_result;
-  off_thread_data_ =
-      CodeSerializer::StartDeserializeOffThread(&isolate, &cached_data_);
+  CodeSerializer::StartDeserializeOffThread(&isolate, &cached_data_,
+                                            &off_thread_data_);
   if (v8_flags.enable_slow_asserts && off_thread_data_.HasResult()) {
 #ifdef ENABLE_SLOW_DCHECKS
     MergeAssumptionChecker checker(&isolate, false);
@@ -2866,6 +2866,11 @@ void BackgroundDeserializeTask::SourceTextAvailable(
     Isolate* isolate, Handle<String> source_text,
     const ScriptDetails& script_details) {
   DCHECK_EQ(isolate, isolate_for_local_isolate_);
+  if (!CodeSerializer::NotifySourceTextAvailable(isolate, &off_thread_data_,
+                                                 &cached_data_, source_text,
+                                                 script_details)) {
+    return;
+  }
   LanguageMode language_mode = construct_language_mode(v8_flags.use_strict);
   background_merge_task_.SetUpOnMainThread(isolate, source_text, script_details,
                                            language_mode);

deps/v8/src/codegen/compiler.h

@@ -719,7 +719,7 @@ class V8_EXPORT_PRIVATE BackgroundDeserializeTask {
  private:
   Isolate* isolate_for_local_isolate_;
   AlignedCachedData cached_data_;
-  CodeSerializer::OffThreadDeserializeData off_thread_data_;
+  OffThreadDeserializeData off_thread_data_;
   BackgroundMergeTask background_merge_task_;
   TimedHistogram* timer_;
   int64_t background_time_in_microseconds_ = 0;

deps/v8/src/compiler/common-operator.cc

@@ -515,6 +515,32 @@ const ExitMachineGraphParameters& ExitMachineGraphParametersOf(
   return OpParameter<ExitMachineGraphParameters>(op);
 }
 
+#if V8_ENABLE_SANDBOX
+size_t hash_value(const LoadTrustedPointerParameters& params) {
+  return base::hash_combine(params.offset, params.tag);
+}
+
+V8_EXPORT_PRIVATE std::ostream& operator<<(
+    std::ostream& os, LoadTrustedPointerParameters params) {
+  return os << "offset=" << params.offset << ", tag.first=" << params.tag.first
+            << ", tag.last=" << params.tag.last;
+}
+
+class LoadTrustedPointerOperator final
+    : public Operator1<LoadTrustedPointerParameters> {
+ public:
+  LoadTrustedPointerOperator(int offset, IndirectPointerTagRange tag)
+      : Operator1<LoadTrustedPointerParameters>(
+            IrOpcode::kLoadTrustedPointer, Operator::kEliminatable,
+            "LoadTrustedPointer", 1, 1, 1, 1, 1, 0, {offset, tag}) {}
+};
+
+const Operator* CommonOperatorBuilder::LoadTrustedPointer(
+    int offset, IndirectPointerTagRange tag) {
+  return zone_->New<LoadTrustedPointerOperator>(offset, tag);
+}
+#endif  // V8_ENABLE_SANDBOX
+
 #define COMMON_CACHED_OP_LIST(V)                          \
   V(Plug, Operator::kNoProperties, 0, 0, 0, 1, 0, 0)      \
   V(Dead, Operator::kFoldable, 0, 0, 0, 1, 1, 1)          \

deps/v8/src/compiler/common-operator.h

@@ -538,6 +538,20 @@ V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream& os,
 V8_EXPORT_PRIVATE const ExitMachineGraphParameters&
 ExitMachineGraphParametersOf(const Operator* op) V8_WARN_UNUSED_RESULT;
 
+#if V8_ENABLE_SANDBOX
+struct LoadTrustedPointerParameters {
+  int offset;
+  IndirectPointerTagRange tag;
+
+  bool operator==(const LoadTrustedPointerParameters&) const = default;
+};
+
+size_t hash_value(const LoadTrustedPointerParameters& params);
+
+V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream& os,
+                                           LoadTrustedPointerParameters params);
+#endif  // V8_ENABLE_SANDBOX
+
 // Interface for building common operators that can be used at any level of IR,
 // including JavaScript, mid-level, and low-level.
 class V8_EXPORT_PRIVATE CommonOperatorBuilder final
@@ -616,6 +630,9 @@ class V8_EXPORT_PRIVATE CommonOperatorBuilder final
   const Operator* HeapConstant(const Handle<HeapObject>&);
   const Operator* CompressedHeapConstant(const Handle<HeapObject>&);
   const Operator* TrustedHeapConstant(const Handle<HeapObject>&);
+#if V8_ENABLE_SANDBOX
+  const Operator* LoadTrustedPointer(int offset, IndirectPointerTagRange tag);
+#endif
   const Operator* ObjectId(uint32_t);
 
   const Operator* RelocatableInt32Constant(int32_t value,

deps/v8/src/compiler/opcodes.h

@@ -85,15 +85,16 @@
   V(EnterMachineGraph)      \
   V(ExitMachineGraph)
 
-#define COMMON_OP_LIST(V)      \
-  CONSTANT_OP_LIST(V)          \
-  INNER_OP_LIST(V)             \
-  V(Unreachable)               \
-  V(DeadValue)                 \
-  V(Dead)                      \
-  V(Plug)                      \
-  V(SLVerifierHint)            \
-  V(MajorGCForCompilerTesting) \
+#define COMMON_OP_LIST(V)           \
+  CONSTANT_OP_LIST(V)               \
+  INNER_OP_LIST(V)                  \
+  V(Unreachable)                    \
+  V(DeadValue)                      \
+  V(Dead)                           \
+  V(Plug)                           \
+  V(SLVerifierHint)                 \
+  V(MajorGCForCompilerTesting)      \
+  IF_SANDBOX(V, LoadTrustedPointer) \
   V(StaticAssert)
 
 // Opcodes for JavaScript operators.

deps/v8/src/compiler/simplified-lowering-verifier.cc

@@ -504,6 +504,7 @@ void SimplifiedLoweringVerifier::VisitNode(Node* node,
       CASE(Dead)
       CASE(Plug)
       CASE(MajorGCForCompilerTesting)
+      IF_SANDBOX(CASE, LoadTrustedPointer)
       CASE(StaticAssert)
       // Simplified change operators
       CASE(ChangeTaggedSignedToInt32)

deps/v8/src/compiler/turbofan-typer.cc

@@ -1297,6 +1297,9 @@ Type Typer::Visitor::TypeMajorGCForCompilerTesting(Node* node) {
   UNREACHABLE();
 }
 Type Typer::Visitor::TypeStaticAssert(Node* node) { UNREACHABLE(); }
+#if V8_ENABLE_SANDBOX
+Type Typer::Visitor::TypeLoadTrustedPointer(Node* node) { UNREACHABLE(); }
+#endif
 Type Typer::Visitor::TypeSLVerifierHint(Node* node) { UNREACHABLE(); }
 
 // JS comparison operators.