[v20.x] deps: cherry-pick V8 fixes for CVE-2023-3420 and others

common.gypi

@@ -36,7 +36,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.20',
+    'v8_embedder_string': '-node.25',
 
     ##### V8 defaults for Node.js #####
 

deps/v8/AUTHORS

@@ -172,6 +172,7 @@ Kyounga Ra <[email protected]>
 Loo Rong Jie <[email protected]>
 Lu Yahan <[email protected]>
 Luis Reis <[email protected]>
+Luke Albao <[email protected]>
 Luke Zarko <[email protected]>
 Ma Aiguo <[email protected]>
 Maciej Małecki <[email protected]>
@@ -239,6 +240,7 @@ Sakthipriyan Vairamani (thefourtheye) <[email protected]>
 Sander Mathijs van Veen <[email protected]>
 Sandro Santilli <[email protected]>
 Sanjoy Das <[email protected]>
+Sam James <[email protected]>
 Seo Sanghyeon <[email protected]>
 Shawn Anastasio <[email protected]>
 Shawn Presser <[email protected]>

deps/v8/src/compiler/js-operator.cc

@@ -1402,7 +1402,7 @@ const Operator* JSOperatorBuilder::CloneObject(FeedbackSource const& feedback,
 const Operator* JSOperatorBuilder::StackCheck(StackCheckKind kind) {
   return zone()->New<Operator1<StackCheckKind>>(  // --
       IrOpcode::kJSStackCheck,                    // opcode
-      Operator::kNoWrite,                         // properties
+      Operator::kNoProperties,                    // properties
       "JSStackCheck",                             // name
       0, 1, 1, 0, 1, 2,                           // counts
       kind);                                      // parameter

deps/v8/src/diagnostics/perf-jit.cc

@@ -42,6 +42,7 @@
 #include "src/codegen/assembler.h"
 #include "src/codegen/source-position-table.h"
 #include "src/diagnostics/eh-frame.h"
+#include "src/objects/code-kind.h"
 #include "src/objects/objects-inl.h"
 #include "src/objects/shared-function-info.h"
 #include "src/snapshot/embedded/embedded-data.h"
@@ -222,9 +223,7 @@ void LinuxPerfJitLogger::LogRecordedBuffer(
   DisallowGarbageCollection no_gc;
   if (v8_flags.perf_basic_prof_only_functions) {
     CodeKind code_kind = abstract_code.kind(isolate_);
-    if (code_kind != CodeKind::INTERPRETED_FUNCTION &&
-        code_kind != CodeKind::TURBOFAN && code_kind != CodeKind::MAGLEV &&
-        code_kind != CodeKind::BASELINE) {
+    if (!CodeKindIsJSFunction(code_kind)) {
       return;
     }
   }

deps/v8/src/execution/isolate.cc

@@ -5228,8 +5228,8 @@ MaybeHandle<FixedArray> Isolate::GetImportAssertionsFromArgument(
   for (int i = 0; i < assertion_keys->length(); i++) {
     Handle<String> assertion_key(String::cast(assertion_keys->get(i)), this);
     Handle<Object> assertion_value;
-    if (!JSReceiver::GetProperty(this, import_assertions_object_receiver,
-                                 assertion_key)
+    if (!Object::GetPropertyOrElement(this, import_assertions_object_receiver,
+                                      assertion_key)
              .ToHandle(&assertion_value)) {
       // This can happen if the property has a getter function that throws
       // an error.

deps/v8/src/heap/cppgc/stats-collector.h

@@ -8,6 +8,7 @@
 #include <stddef.h>
 #include <stdint.h>
 
+#include <algorithm>
 #include <atomic>
 #include <vector>
 

deps/v8/src/logging/log.cc

@@ -433,7 +433,7 @@ void LinuxPerfBasicLogger::LogRecordedBuffer(AbstractCode code,
   DisallowGarbageCollection no_gc;
   PtrComprCageBase cage_base(isolate_);
   if (v8_flags.perf_basic_prof_only_functions &&
-      CodeKindIsBuiltinOrJSFunction(code.kind(cage_base))) {
+      !CodeKindIsBuiltinOrJSFunction(code.kind(cage_base))) {
     return;
   }
 

deps/v8/src/objects/js-function.cc

@@ -676,6 +676,10 @@ void SetInstancePrototype(Isolate* isolate, Handle<JSFunction> function,
       // At that point, a new initial map is created and the prototype is put
       // into the initial map where it belongs.
       function->set_prototype_or_initial_map(*value, kReleaseStore);
+      if (value->IsJSObjectThatCanBeTrackedAsPrototype()) {
+        // Optimize as prototype to detach it from its transition tree.
+        JSObject::OptimizeAsPrototype(Handle<JSObject>::cast(value));
+      }
     } else {
       Handle<Map> new_map =
           Map::Copy(isolate, initial_map, "SetInstancePrototype");
@@ -801,8 +805,10 @@ void JSFunction::EnsureHasInitialMap(Handle<JSFunction> function) {
   Handle<HeapObject> prototype;
   if (function->has_instance_prototype()) {
     prototype = handle(function->instance_prototype(), isolate);
+    map->set_prototype(*prototype);
   } else {
     prototype = isolate->factory()->NewFunctionPrototype(function);
+    Map::SetPrototype(isolate, map, prototype);
   }
   DCHECK(map->has_fast_object_elements());
 

deps/v8/test/mjsunit/harmony/modules-import-assertions-dynamic-6.mjs

@@ -8,6 +8,11 @@ var life;
 import('modules-skip-1.json', { assert: { type: 'json', notARealAssertion: 'value' } }).then(
     namespace => life = namespace.default.life);
 
+var life2;
+import('modules-skip-1.json', { assert: { 0: 'value', type: 'json' } }).then(
+    namespace => life2 = namespace.default.life);
+
 %PerformMicrotaskCheckpoint();
 
 assertEquals(42, life);
+assertEquals(42, life2);