deps: update V8 to 7.4.288.13

PR-URL: https://github.com/nodejs/node/pull/26685
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Refael Ackermann <refack@gmail.com>

1 files changed, 44 insertions, 4 deletions

diff --git a/deps/v8/src/compiler/js-heap-broker.h b/deps/v8/src/compiler/js-heap-broker.h
index 0108575013..4b87d81ea1 100644
--- a/deps/v8/src/compiler/js-heap-broker.h
+++ b/deps/v8/src/compiler/js-heap-broker.h
@@ -8,11 +8,14 @@
 #include "src/base/compiler-specific.h"
 #include "src/base/optional.h"
 #include "src/compiler/refs-map.h"
+#include "src/feedback-vector.h"
+#include "src/function-kind.h"
 #include "src/globals.h"
 #include "src/handles.h"
 #include "src/objects.h"
 #include "src/objects/builtin-function-id.h"
 #include "src/objects/instance-type.h"
+#include "src/ostreams.h"
 #include "src/zone/zone-containers.h"
 
 namespace v8 {
@@ -119,7 +122,7 @@ class ObjectRef {
   bool IsNullOrUndefined() const;
 
   bool BooleanValue() const;
-  double OddballToNumber() const;
+  Maybe<double> OddballToNumber() const;
 
   Isolate* isolate() const;
 
@@ -230,11 +233,13 @@ class JSFunctionRef : public JSObjectRef {
   using JSObjectRef::JSObjectRef;
   Handle<JSFunction> object() const;
 
+  bool has_feedback_vector() const;
   bool has_initial_map() const;
   bool has_prototype() const;
   bool PrototypeRequiresRuntimeLookup() const;
 
   void Serialize();
+  bool IsSerializedForCompilation() const;
 
   // The following are available only after calling Serialize().
   ObjectRef prototype() const;
@@ -242,6 +247,7 @@ class JSFunctionRef : public JSObjectRef {
   ContextRef context() const;
   NativeContextRef native_context() const;
   SharedFunctionInfoRef shared() const;
+  FeedbackVectorRef feedback_vector() const;
   int InitialMapInstanceSizeWithMinSlack() const;
 };
 
@@ -521,7 +527,8 @@ class ScopeInfoRef : public HeapObjectRef {
   V(bool, HasBuiltinId)                     \
   V(BuiltinFunctionId, builtin_function_id) \
   V(bool, construct_as_builtin)             \
-  V(bool, HasBytecodeArray)
+  V(bool, HasBytecodeArray)                 \
+  V(bool, is_safe_to_skip_arguments_adaptor)
 
 class SharedFunctionInfoRef : public HeapObjectRef {
  public:
@@ -609,9 +616,18 @@ class InternalizedStringRef : public StringRef {
   static const uint32_t kNotAnArrayIndex = -1;  // 2^32-1 is not a valid index.
 };
 
+struct ProcessedFeedback {
+  ZoneVector<Handle<Map>> receiver_maps;
+  ZoneVector<std::pair<Handle<Map>, Handle<Map>>> transitions;
+
+  explicit ProcessedFeedback(Zone* zone)
+      : receiver_maps(zone), transitions(zone) {}
+};
+
 class V8_EXPORT_PRIVATE JSHeapBroker : public NON_EXPORTED_BASE(ZoneObject) {
  public:
   JSHeapBroker(Isolate* isolate, Zone* broker_zone);
+
   void SetNativeContextRef();
   void SerializeStandardObjects();
 
@@ -638,8 +654,10 @@ class V8_EXPORT_PRIVATE JSHeapBroker : public NON_EXPORTED_BASE(ZoneObject) {
   // %ObjectPrototype%.
   bool IsArrayOrObjectPrototype(const JSObjectRef& object) const;
 
-  std::ostream& Trace() const;
+  bool HasFeedback(FeedbackNexus const& nexus) const;
+  ProcessedFeedback& GetOrCreateFeedback(FeedbackNexus const& nexus);
 
+  std::ostream& Trace();
   void IncrementTracingIndentation();
   void DecrementTracingIndentation();
 
@@ -651,6 +669,18 @@ class V8_EXPORT_PRIVATE JSHeapBroker : public NON_EXPORTED_BASE(ZoneObject) {
   void SerializeShareableObjects();
   void CollectArrayAndObjectPrototypes();
 
+  struct FeedbackNexusHash {
+    size_t operator()(FeedbackNexus const& nexus) const {
+      return base::hash_combine(nexus.vector_handle().location(), nexus.slot());
+    }
+  };
+  struct FeedbackNexusEqual {
+    bool operator()(FeedbackNexus const& lhs, FeedbackNexus const& rhs) const {
+      return lhs.vector_handle().equals(rhs.vector_handle()) &&
+             lhs.slot() == rhs.slot();
+    }
+  };
+
   Isolate* const isolate_;
   Zone* const broker_zone_;
   Zone* current_zone_;
@@ -659,10 +689,13 @@ class V8_EXPORT_PRIVATE JSHeapBroker : public NON_EXPORTED_BASE(ZoneObject) {
   ZoneUnorderedSet<Handle<JSObject>, Handle<JSObject>::hash,
                    Handle<JSObject>::equal_to>
       array_and_object_prototypes_;
-
   BrokerMode mode_ = kDisabled;
+  StdoutStream trace_out_;
   unsigned trace_indentation_ = 0;
   PerIsolateCompilerCache* compiler_cache_;
+  ZoneUnorderedMap<FeedbackNexus, ProcessedFeedback, FeedbackNexusHash,
+                   FeedbackNexusEqual>
+      feedback_;
 
   static const size_t kMinimalRefsBucketCount = 8;     // must be power of 2
   static const size_t kInitialRefsBucketCount = 1024;  // must be power of 2
@@ -679,6 +712,13 @@ class Reduction;
 Reduction NoChangeBecauseOfMissingData(JSHeapBroker* broker,
                                        const char* function, int line);
 
+// Miscellaneous definitions that should be moved elsewhere once concurrent
+// compilation is finished.
+bool CanInlineElementAccess(Handle<Map> map);
+void ProcessFeedbackMapsForElementAccess(Isolate* isolate,
+                                         MapHandles const& maps,
+                                         ProcessedFeedback* processed);
+
 #define TRACE_BROKER(broker, x)                               \
   do {                                                        \
     if (FLAG_trace_heap_broker) broker->Trace() << x << '\n'; \