deps: update V8 to 4.4.63.30

PR-URL: https://github.com/nodejs/node/pull/2482
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

2 files changed, 29 insertions, 0 deletions

diff --git a/deps/v8/test/cctest/test-api.cc b/deps/v8/test/cctest/test-api.cc
index 35e27c3118..145d9bc64d 100644
--- a/deps/v8/test/cctest/test-api.cc
+++ b/deps/v8/test/cctest/test-api.cc
@@ -15010,6 +15010,9 @@ TEST(TestIdleNotification) {
         (v8::base::TimeTicks::HighResolutionNow().ToInternalValue() /
          static_cast<double>(v8::base::Time::kMicrosecondsPerSecond)) +
         IdlePauseInSeconds);
+    if (CcTest::heap()->mark_compact_collector()->sweeping_in_progress()) {
+      CcTest::heap()->mark_compact_collector()->EnsureSweepingCompleted();
+    }
   }
   intptr_t final_size = CcTest::heap()->SizeOfObjects();
   CHECK(finished);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-513602.js b/deps/v8/test/mjsunit/regress/regress-crbug-513602.js
new file mode 100644
index 0000000000..ae0441cbc7
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-513602.js
@@ -0,0 +1,26 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function Parent() {}
+
+function Child() {}
+Child.prototype = new Parent();
+var child = new Child();
+
+function crash() {
+  return child.__proto__;
+}
+
+crash();
+crash();
+
+// Trigger a fast->slow->fast dance of Parent.prototype's map...
+Parent.prototype.__defineSetter__("foo", function() { print("A"); });
+Parent.prototype.__defineSetter__("foo", function() { print("B"); });
+// ...and collect more type feedback.
+crash();
+
+// Now modify the prototype chain. The right cell fails to get invalidated.
+delete Object.prototype.__proto__;
+crash();