deps: update V8 to 7.7.299.4

PR-URL: https://github.com/nodejs/node/pull/28918
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>

1 files changed, 9 insertions, 7 deletions

diff --git a/deps/v8/src/builtins/builtins-api.cc b/deps/v8/src/builtins/builtins-api.cc
index 7ee879ab51..0c30e52154 100644
--- a/deps/v8/src/builtins/builtins-api.cc
+++ b/deps/v8/src/builtins/builtins-api.cc
@@ -32,14 +32,16 @@ JSReceiver GetCompatibleReceiver(Isolate* isolate, FunctionTemplateInfo info,
   JSObject js_obj_receiver = JSObject::cast(receiver);
   FunctionTemplateInfo signature = FunctionTemplateInfo::cast(recv_type);
 
-  // Check the receiver. Fast path for receivers with no hidden prototypes.
+  // Check the receiver.
   if (signature.IsTemplateFor(js_obj_receiver)) return receiver;
-  if (!js_obj_receiver.map().has_hidden_prototype()) return JSReceiver();
-  for (PrototypeIterator iter(isolate, js_obj_receiver, kStartAtPrototype,
-                              PrototypeIterator::END_AT_NON_HIDDEN);
-       !iter.IsAtEnd(); iter.Advance()) {
-    JSObject current = iter.GetCurrent<JSObject>();
-    if (signature.IsTemplateFor(current)) return current;
+
+  // The JSGlobalProxy might have a hidden prototype.
+  if (V8_UNLIKELY(js_obj_receiver.IsJSGlobalProxy())) {
+    HeapObject prototype = js_obj_receiver.map().prototype();
+    if (!prototype.IsNull(isolate)) {
+      JSObject js_obj_prototype = JSObject::cast(prototype);
+      if (signature.IsTemplateFor(js_obj_prototype)) return js_obj_prototype;
+    }
   }
   return JSReceiver();
 }