deps: V8: cherry-pick 1cc12b278e22

Original commit message:

    [ic] Add StoreOwnIC_Slow

    This runtime function behaves like StoreDataPropertyInLiteral, except it
    can throw, since it's also used for defining public class fields. Unlike
    the literal use case, class field can end up throwing due to field
    initializers doing things like freezing the instance.

    Bug: chromium:1264828
    Change-Id: I3ea4d15ad9b906c26763f022c8e22b757fa80b6c
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3252558
    Commit-Queue: Igor Sheludko <ishell@chromium.org>
    Auto-Submit: Shu-yu Guo <syg@chromium.org>
    Reviewed-by: Igor Sheludko <ishell@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#77704}

Refs: https://github.com/v8/v8/commit/1cc12b278e22d9ad4f0154e4b9e63cbb707b4657

PR-URL: https://github.com/nodejs/node/pull/40907
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>

1 files changed, 15 insertions, 0 deletions

diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1264828.js b/deps/v8/test/mjsunit/regress/regress-crbug-1264828.js
new file mode 100644
index 0000000000..ce33cd6f8a
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1264828.js
@@ -0,0 +1,15 @@
+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-lazy-feedback-allocation
+
+{
+  class C {
+    x = Object.freeze(this);
+  }
+  // Call once to install slow handler.
+  assertThrows(() => { new C(); });
+  // Hit the slow handler.
+  assertThrows(() => { new C(); });
+}