From 3ea8cc68ad7b4e9161d5f932e6913a55d23e05ea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C3=ABl=20Zasso?= <targos@protonmail.com>
Date: Tue, 22 Oct 2019 16:03:19 +0200
Subject: [PATCH] deps: V8: cherry-pick c721203

Original commit message:

    Add missing null condition in Proxy GetPrototypeof

    Bug: v8:9781
    Change-Id: I1f82a828f103cc2aa3f9553214f6b4867ffc3b17
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1829897
    Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
    Reviewed-by: Georg Neis <neis@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#64049}

Refs: https://github.com/v8/v8/commit/c721203615afea24cd6bef5b4850c20c68e0e43a
Fixes: https://github.com/nodejs/node/issues/29730

PR-URL: https://github.com/nodejs/node/pull/30065
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Gus Caplan <me@gus.host>
Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
---
 common.gypi                                    |  2 +-
 deps/v8/src/builtins/proxy-get-prototype-of.tq |  2 +-
 deps/v8/test/mjsunit/regress/regress-9781.js   | 11 +++++++++++
 3 files changed, 13 insertions(+), 2 deletions(-)
 create mode 100644 deps/v8/test/mjsunit/regress/regress-9781.js

diff --git a/common.gypi b/common.gypi
index 570a7f6d101144..ca0a986bc4f8f4 100644
--- a/common.gypi
+++ b/common.gypi
@@ -38,7 +38,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.13',
+    'v8_embedder_string': '-node.14',
 
     ##### V8 defaults for Node.js #####
 
diff --git a/deps/v8/src/builtins/proxy-get-prototype-of.tq b/deps/v8/src/builtins/proxy-get-prototype-of.tq
index 2418eaf4230cb3..5dc185dc177523 100644
--- a/deps/v8/src/builtins/proxy-get-prototype-of.tq
+++ b/deps/v8/src/builtins/proxy-get-prototype-of.tq
@@ -33,7 +33,7 @@ namespace proxy {
 
       // 8. If Type(handlerProto) is neither Object nor Null, throw a TypeError
       // exception.
-      if (!Is<JSReceiver>(handlerProto)) {
+      if (!Is<JSReceiver>(handlerProto) && handlerProto != Null) {
         goto ThrowProxyGetPrototypeOfInvalid;
       }
 
diff --git a/deps/v8/test/mjsunit/regress/regress-9781.js b/deps/v8/test/mjsunit/regress/regress-9781.js
new file mode 100644
index 00000000000000..6d3e3162d39c27
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-9781.js
@@ -0,0 +1,11 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var proto = Object.getPrototypeOf(new Proxy(Object.create(null), {
+  getPrototypeOf(target) {
+    return Reflect.getPrototypeOf(target);
+  }
+} ));
+
+assertEquals(proto, null);