deps: update V8 to 8.3.110.9

PR-URL: https://github.com/nodejs/node/pull/32831
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

1 files changed, 17 insertions, 7 deletions

diff --git a/deps/v8/src/compiler/js-inlining.cc b/deps/v8/src/compiler/js-inlining.cc
index 60c7626067..16a6fb2f0f 100644
--- a/deps/v8/src/compiler/js-inlining.cc
+++ b/deps/v8/src/compiler/js-inlining.cc
@@ -8,6 +8,7 @@
 #include "src/codegen/compiler.h"
 #include "src/codegen/optimized-compilation-info.h"
 #include "src/codegen/tick-counter.h"
+#include "src/compiler/access-builder.h"
 #include "src/compiler/all-nodes.h"
 #include "src/compiler/bytecode-graph-builder.h"
 #include "src/compiler/common-operator.h"
@@ -317,13 +318,11 @@ base::Optional<SharedFunctionInfoRef> JSInliner::DetermineCallTarget(
   //  - JSConstruct(JSCreateClosure[shared](context), args..., new.target)
   if (match.IsJSCreateClosure()) {
     CreateClosureParameters const& p = CreateClosureParametersOf(match.op());
-
-    // TODO(turbofan): We might consider to eagerly create the feedback vector
-    // in such a case (in {DetermineCallContext} below) eventually.
     FeedbackCellRef cell(broker(), p.feedback_cell());
-    if (!cell.value().IsFeedbackVector()) return base::nullopt;
-
-    return SharedFunctionInfoRef(broker(), p.shared_info());
+    return cell.shared_function_info();
+  } else if (match.IsCheckClosure()) {
+    FeedbackCellRef cell(broker(), FeedbackCellOf(match.op()));
+    return cell.shared_function_info();
   }
 
   return base::nullopt;
@@ -354,11 +353,22 @@ FeedbackVectorRef JSInliner::DetermineCallContext(Node* node,
 
     // Load the feedback vector of the target by looking up its vector cell at
     // the instantiation site (we only decide to inline if it's populated).
-    FeedbackCellRef cell(FeedbackCellRef(broker(), p.feedback_cell()));
+    FeedbackCellRef cell(broker(), p.feedback_cell());
 
     // The inlinee uses the locally provided context at instantiation.
     *context_out = NodeProperties::GetContextInput(match.node());
     return cell.value().AsFeedbackVector();
+  } else if (match.IsCheckClosure()) {
+    FeedbackCellRef cell(broker(), FeedbackCellOf(match.op()));
+
+    Node* effect = NodeProperties::GetEffectInput(node);
+    Node* control = NodeProperties::GetControlInput(node);
+    *context_out = effect = graph()->NewNode(
+        simplified()->LoadField(AccessBuilder::ForJSFunctionContext()),
+        match.node(), effect, control);
+    NodeProperties::ReplaceEffectInput(node, effect);
+
+    return cell.value().AsFeedbackVector();
   }
 
   // Must succeed.