diff --git a/common.gypi b/common.gypi index 8cf35e1ac1c71b..6281ebc6fca5e6 100644 --- a/common.gypi +++ b/common.gypi @@ -36,7 +36,7 @@ # Reset this number to 0 on major V8 upgrades. # Increment by one for each non-official patch applied to deps/v8. - 'v8_embedder_string': '-node.31', + 'v8_embedder_string': '-node.32', ##### V8 defaults for Node.js ##### diff --git a/deps/v8/src/compiler/js-inlining-heuristic.cc b/deps/v8/src/compiler/js-inlining-heuristic.cc index 1c2bf5bc0eafe6..aef85c5b48897d 100644 --- a/deps/v8/src/compiler/js-inlining-heuristic.cc +++ b/deps/v8/src/compiler/js-inlining-heuristic.cc @@ -259,10 +259,9 @@ void JSInliningHeuristic::Finalize() { Candidate candidate = *i; candidates_.erase(i); - // Make sure we don't try to inline dead candidate nodes. - if (candidate.node->IsDead()) { - continue; - } + // Ignore this candidate if it's no longer valid. + if (!IrOpcode::IsInlineeOpcode(candidate.node->opcode())) continue; + if (candidate.node->IsDead()) continue; // Make sure we have some extra budget left, so that any small functions // exposed by this function would be given a chance to inline. diff --git a/deps/v8/test/mjsunit/compiler/regress-1127319.js b/deps/v8/test/mjsunit/compiler/regress-1127319.js new file mode 100644 index 00000000000000..74d577bdd83e54 --- /dev/null +++ b/deps/v8/test/mjsunit/compiler/regress-1127319.js @@ -0,0 +1,40 @@ +// Copyright 2020 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --interrupt-budget=1024 + +function v1() { + const v4 = Reflect; + const v8 = [11.11]; + const v10 = {__proto__:1111, a:-1, c:RegExp, f:v8, d:1111, e:-1}; + const v12 = [11.11]; + function v13() {} + const v16 = {a:v13, b:v13, c:v13, d:v13, e:v13, f:v13, g:v13, h:v13, i:v13, j:v13}; +} + +function foo() { + let v22 = Number; + v22 = v1; + const v23 = false; + if (v23) { + v22 = Number; + } else { + function v24() { + const v28 = ".Cactus"[0]; + for (let v32 = 0; v32 < 7; v32++) {} + } + new Promise(v24); + try { + for (const v37 of v36) { + const v58 = [cactus,cactus,[] = cactus] = v117; + } + } catch(v119) { + } + } + v22(); +} + +for (let i = 0; i < 10; i++) { + foo(); +}