From 1e8be82fd3582c6952f06c66c56e33f67f1d8b59 Mon Sep 17 00:00:00 2001
From: Mike Stanton <mvstanton@chromium.org>
Date: Mon, 17 Sep 2018 12:44:38 +0200
Subject: [PATCH] deps: fix Array.prototype.forEach on v8 6.8

This applies a variant of v8/v8@e1163c14f7e4fef2c549 to V8 6.8.

Original commit message:

    [Builtins] Array.prototype.forEach perf regression on dictionaries

    An unnecessary call to ToString() on the array index caused trips to
    the runtime. The fix also includes performance micro-benchmarks so
    we'll have a harder time regressing this case in future.

    TBR=tebbi@chromium.org

    Bug: v8:8112
    Change-Id: I781e8b1bbe2eb56db961cf33b0dca8523868b83d
    Reviewed-on: https://chromium-review.googlesource.com/1213207
    Commit-Queue: Michael Stanton <mvstanton@chromium.org>
    Reviewed-by: Michael Stanton <mvstanton@chromium.org>
    Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#55733}

Refs: https://github.com/v8/v8/commit/e1163c14f7e4fef2c5499888fc8d1542f662a71a
Fixes: https://github.com/nodejs/node/issues/22859
---
 common.gypi                   |  2 +-
 deps/v8/src/builtins/array.tq | 15 ++++++++-------
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/common.gypi b/common.gypi
index e9e05049dbb265..39afdc4d95a28d 100644
--- a/common.gypi
+++ b/common.gypi
@@ -29,7 +29,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.28',
+    'v8_embedder_string': '-node.29',
 
     # Enable disassembler for `--print-code` v8 options
     'v8_enable_disassembler': 1,
diff --git a/deps/v8/src/builtins/array.tq b/deps/v8/src/builtins/array.tq
index 69aea57f5a9846..e882f052c6e775 100644
--- a/deps/v8/src/builtins/array.tq
+++ b/deps/v8/src/builtins/array.tq
@@ -300,20 +300,21 @@ module array {
 
   macro ArrayForEachTorqueContinuation(
       context: Context, o: Object, len: Number, callbackfn: Callable,
-      thisArg: Object, initial_k: Smi): Object {
+      thisArg: Object, initial_k: Number): Object {
     // 5. Let k be 0.
     // 6. Repeat, while k < len
-    for (let k: Smi = initial_k; k < len; k = k + 1) {
+    for (let k: Number = initial_k; k < len; k = k + 1) {
       // 6a. Let Pk be ! ToString(k).
-      let pK: String = ToString_Inline(context, k);
+      // k is guaranteed to be a positive integer, hence ToString is
+      // side-effect free and HasProperty/GetProperty do the conversion inline.
 
       // 6b. Let kPresent be ? HasProperty(O, Pk).
-      let kPresent: Oddball = HasPropertyObject(o, pK, context, kHasProperty);
+      let kPresent: Oddball = HasPropertyObject(o, k, context, kHasProperty);
 
       // 6c. If kPresent is true, then
       if (kPresent == True) {
         // 6c. i. Let kValue be ? Get(O, Pk).
-        let kValue: Object = GetProperty(context, o, pK);
+        let kValue: Object = GetProperty(context, o, k);
 
         // 6c. ii. Perform ? Call(callbackfn, T, <kValue, k, O>).
         Call(context, callbackfn, thisArg, kValue, k, o);
@@ -346,7 +347,7 @@ module array {
       to: Object): Object {
     try {
       let callbackfn: Callable = cast<Callable>(callback) otherwise Unexpected;
-      let k: Smi = cast<Smi>(initialK) otherwise Unexpected;
+      let k: Number = cast<Number>(initialK) otherwise Unexpected;
       let number_length: Number = cast<Number>(length) otherwise Unexpected;
 
       return ArrayForEachTorqueContinuation(
@@ -446,7 +447,7 @@ module array {
       let thisArg: Object = arguments.length > 1 ? arguments[1] : Undefined;
 
       // Special cases.
-      let k: Smi = 0;
+      let k: Number = 0;
       try {
         return FastArrayForEach(context, o, len, callbackfn, thisArg)
         otherwise Bailout;