deps: patch V8 to 7.4.288.18

Refs: https://github.com/v8/v8/compare/7.4.288.17...7.4.288.18

PR-URL: https://github.com/nodejs/node/pull/27066
Refs: https://github.com/v8/v8/compare/7.4.288.13...7.4.288.17
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Refael Ackermann <refack@gmail.com>

3 files changed, 27 insertions, 4 deletions

diff --git a/deps/v8/include/v8-version.h b/deps/v8/include/v8-version.h
index 7e869065a23..e5641f118ae 100644
--- a/deps/v8/include/v8-version.h
+++ b/deps/v8/include/v8-version.h
@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 7
 #define V8_MINOR_VERSION 4
 #define V8_BUILD_NUMBER 288
-#define V8_PATCH_LEVEL 17
+#define V8_PATCH_LEVEL 18
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)
diff --git a/deps/v8/src/compiler/typed-optimization.cc b/deps/v8/src/compiler/typed-optimization.cc
index 9b0df88da3b..a555d7f63be 100644
--- a/deps/v8/src/compiler/typed-optimization.cc
+++ b/deps/v8/src/compiler/typed-optimization.cc
@@ -727,7 +727,7 @@ Reduction TypedOptimization::ReduceSpeculativeNumberAdd(Node* node) {
     Node* const value =
         graph()->NewNode(simplified()->NumberAdd(), toNum_lhs, toNum_rhs);
     ReplaceWithValue(node, value);
-    return Replace(node);
+    return Replace(value);
   }
   return NoChange();
 }
@@ -796,7 +796,7 @@ Reduction TypedOptimization::ReduceSpeculativeNumberBinop(Node* node) {
         NumberOpFromSpeculativeNumberOp(simplified(), node->op()), toNum_lhs,
         toNum_rhs);
     ReplaceWithValue(node, value);
-    return Replace(node);
+    return Replace(value);
   }
   return NoChange();
 }
@@ -811,7 +811,7 @@ Reduction TypedOptimization::ReduceSpeculativeNumberComparison(Node* node) {
     Node* const value = graph()->NewNode(
         NumberOpFromSpeculativeNumberOp(simplified(), node->op()), lhs, rhs);
     ReplaceWithValue(node, value);
-    return Replace(node);
+    return Replace(value);
   }
   return NoChange();
 }
diff --git a/deps/v8/test/mjsunit/compiler/regress-945644.js b/deps/v8/test/mjsunit/compiler/regress-945644.js
new file mode 100644
index 00000000000..2cb8839d862
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-945644.js
@@ -0,0 +1,23 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(v5,v6) {
+  const v16 = [1337,1337,-765470.5051836492];
+  let v19 = 0;
+  do {
+    const v20 = v19 + 1;
+    const v22 = Math.fround(v20);
+    v19 = v22;
+    const v23 = [v20, v22];
+    function v24() { v20; v22; }
+    const v33 = v16.indexOf(v19);
+  } while (v19 < 6);
+}
+
+f();
+Array.prototype.push(8);
+%OptimizeFunctionOnNextCall(f);
+f();