v8: backport 22116dd6c884c026225e56dd8e442a660193e729

[laverdet]

This is a backport for v8 commit 22116dd6 which fixes v8 issue #7857. The issue does not affect core nodejs but does affect my native npm module isolated-vm. Essentially v8 will segfault if you try to create a startup snapshot of an isolate that contains a closure.

The snapshot crash as it pertains to isolated-vm was originally reported on superfly/fly#101.

The bug was introduced in v8 commit 6bd1d3c2, landed in v8 version 6.7.247, which made its way onto nodejs v10.2.0.

The fix landed in v8 version 6.9.186 will probably never see the light of day on the v10x branch of nodejs, which leads me to this PR :)

The patch applied cleanly with no conflicts.

Refs: https://github.com/v8/v8/commit/22116dd6c884c026225e56dd8e442a660193e729

Original commit message:

    [snapshot] fix resetting function code.

    Unconditionally setting the JSFunction code to that of the SFI
    may skip initializing the feedback vector.

    [email protected]

    Bug: v8:7857
    Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
    Change-Id: I65d4bf32493be4cade2eaf3d665d44f93e80f809
    Reviewed-on: https://chromium-review.googlesource.com/1107618
    Commit-Queue: Yang Guo <[email protected]>
    Reviewed-by: Leszek Swirski <[email protected]>
    Cr-Commit-Position: refs/heads/master@{#53881}

Checklist

• make -j4 test (UNIX), or vcbuild test (Windows) passes
• commit message follows commit guidelines

[mscdex]

I believe the v8_embedder_string variable in common.gypi needs to be incremented any time we float patches on top of V8.

[mscdex]

/cc @nodejs/v8-update

[laverdet]

Thanks, I went ahead and updated the PR.

[targos]

@laverdet Could you please retarget this PR to the master branch (and change the embedder string accordingly)? We are still at V8 6.8 there and that version is going to be backported to v10.x.

Also, the first line of the commit message is a bit too long and should start with "deps".
May I suggest: deps: cherry-pick 22116dd from upstream V8? (we use "backport" when manual changes were necessary because of conflicts, otherwise it's "cherry-pick").

[laverdet]

@targos alright, I've made those changes.

[targos]

Thanks

[targos]

CI: https://ci.nodejs.org/job/node-test-pull-request/16115/
V8 CI: https://ci.nodejs.org/job/node-test-commit-v8-linux/1560/

[targos]

I rebased the PR on top of master.
New CI: https://ci.nodejs.org/job/node-test-pull-request/16992/
V8: https://ci.nodejs.org/job/node-test-commit-v8-linux/1648/

[targos]

The V8 test fails at compile time:

Edit: sorry, wrong PR.

[targos]

Fixed V8 CI: https://ci.nodejs.org/job/node-test-commit-v8-linux/1654/
Edit: rebuild: https://ci.nodejs.org/job/node-test-commit-v8-linux/1659/

[targos]

Landed in 0d3da39