deps: V8: fix bug in InternalPerformPromiseThen

ofrobots · rvagg · commit efe28b858103 · 2018-08-16T11:38:51.000+10:00
This fix never landed upstream as it was not longer relevant to active V8 branches for Chromium. Original commit message: [turbofan] Fix bug in InternalPerformPromiseThen Bug: chromium:831170 Change-Id: I1022fc360aafdfd392d6781eb50afc87a18096fd PR-URL: #21426 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
diff --git a/deps/v8/include/v8-version.h b/deps/v8/include/v8-version.h
@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 6
 #define V8_MINOR_VERSION 2
 #define V8_BUILD_NUMBER 414
-#define V8_PATCH_LEVEL 59
+#define V8_PATCH_LEVEL 60
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)
diff --git a/deps/v8/src/builtins/builtins-promise-gen.cc b/deps/v8/src/builtins/builtins-promise-gen.cc
@@ -509,8 +509,8 @@ Node* PromiseBuiltinsAssembler::InternalPerformPromiseThen(
 BIND(&if_existingcallbacks);
 {
 Label if_singlecallback(this), if_multiplecallbacks(this);
- BranchIfJSObject(existing_deferred_promise, &if_singlecallback,
- &if_multiplecallbacks);
+ Branch(HasInstanceType(existing_deferred_promise, FIXED_ARRAY_TYPE),
+ &if_multiplecallbacks, &if_singlecallback);
 
 BIND(&if_singlecallback);
 {
diff --git a/deps/v8/test/mjsunit/compiler/promise-proxy-callback.js b/deps/v8/test/mjsunit/compiler/promise-proxy-callback.js
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+class MyPromise extends Promise {
+ static get [Symbol.species]() {
+ return function(f) {
+ console.log("foo")
+ var a = new Promise(f);
+ return new Proxy(new Function(),{})
+ }
+ }
+}
+var p1 = new Promise(function(resolve, reject) {});
+p1.__proto__ = MyPromise.prototype;
+p1.then();
+p1.then();
+
+for (var i = 0; i < 0x20000; i++) {
+ new String()
+}

-Original file line number
+Diff line change
 #defineV8_MAJOR_VERSION 6
 #defineV8_MINOR_VERSION 2
 #defineV8_BUILD_NUMBER 414
 -#defineV8_PATCH_LEVEL59
 +#defineV8_PATCH_LEVEL60
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)
Original file line number	Diff line number	Diff line change
`@@ -509,8 +509,8 @@ Node* PromiseBuiltinsAssembler::InternalPerformPromiseThen(`
`509`	`509`	`BIND(&if_existingcallbacks);`
`510`	`510`	`{`
`511`	`511`	`Label if_singlecallback(this), if_multiplecallbacks(this);`
`512`		`-BranchIfJSObject(existing_deferred_promise, &if_singlecallback,`
`513`		`-&if_multiplecallbacks);`
	`512`	`+Branch(HasInstanceType(existing_deferred_promise, FIXED_ARRAY_TYPE),`
	`513`	`+ &if_multiplecallbacks, &if_singlecallback);`
`514`	`514`
`515`	`515`	`BIND(&if_singlecallback);`
`516`	`516`	`{`
-Original file line number
+Diff line change
@@ @@ -0,0 +1,21 @@ @@
 +// Copyright 2018 the V8 project authors. All rights reserved.
 +// Use of this source code is governed by a BSD-style license that can be
 +// found in the LICENSE file.
++
 +classMyPromiseextendsPromise{
 +staticget[Symbol.species](){
 +returnfunction(f){
 +console.log("foo")
 +vara=newPromise(f);
 +returnnewProxy(newFunction(),{})
 +}
 +}
 +}
 +varp1=newPromise(function(resolve,reject){});
 +p1.__proto__=MyPromise.prototype;
 +p1.then();
 +p1.then();
++
 +for(vari=0;i<0x20000;i++){
 +newString()
 +}