deps: V8: cherry-pick 821fb3883a8e

targos · targos · commit c8e15cd2c68a · 2021-02-11T19:10:01.000+01:00
Original commit message: [serializer] avoid deferring objects with embedder fields JS objects with embedder fields cannot be deferred because the serialize/deserialize callbacks need the back reference immediately to identify the object. Refs: nodejs/node-v8#175 Bug: v8:11146 Change-Id: I4292f2ab0041f7b0779620437ed26905c194cd9b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2531195 Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Joyee Cheung <joyee@igalia.com> Cr-Commit-Position: refs/heads/master@{#71134} Refs: v8/v8@821fb38 PR-URL: #35700 Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Jiawen Geng <technicalcute@gmail.com> Reviewed-By: Shelley Vohr <codebytere@gmail.com>
diff --git a/common.gypi b/common.gypi
@@ -36,7 +36,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.9',
+    'v8_embedder_string': '-node.10',
 
     ##### V8 defaults for Node.js #####
 
diff --git a/deps/v8/src/snapshot/serializer-deserializer.cc b/deps/v8/src/snapshot/serializer-deserializer.cc
@@ -30,13 +30,18 @@ void SerializerDeserializer::Iterate(Isolate* isolate, RootVisitor* visitor) {
 }
 
 bool SerializerDeserializer::CanBeDeferred(HeapObject o) {
-  // Maps cannot be deferred as objects are expected to have a valid map
-  // immediately. Internalized strings cannot be deferred as they might be
+  // 1. Maps cannot be deferred as objects are expected to have a valid map
+  // immediately.
+  // 2. Internalized strings cannot be deferred as they might be
   // converted to thin strings during post processing, at which point forward
   // references to the now-thin string will already have been written.
+  // 3. JS objects with embedder fields cannot be deferred because the
+  // serialize/deserialize callbacks need the back reference immediately to
+  // identify the object.
   // TODO(leszeks): Could we defer string serialization if forward references
   // were resolved after object post processing?
-  return !o.IsMap() && !o.IsInternalizedString();
+  return !o.IsMap() && !o.IsInternalizedString() &&
+         !(o.IsJSObject() && JSObject::cast(o).GetEmbedderFieldCount() > 0);
 }
 
 void SerializerDeserializer::RestoreExternalReferenceRedirector(
