deps: V8: cherry-pick 5f4413194480

Original commit message:

    [promises] Change context promise hooks to Callable

    The previously added perf-context Promise-hooks take a v8::Function as
    arguments. However, the builtin code was only accepting JSFunctions
    which causes cast errors.

    Drive-by-fix: Directly pass nativeContext in more places.

    Bug: chromium:1201465
    Change-Id: Ic8bed11253a1f18a84e71eb9ea809b1ec1c3f428
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2850162
    Reviewed-by: Jakob Gruber <jgruber@chromium.org>
    Commit-Queue: Camillo Bruni <cbruni@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#74223}

Refs: https://github.com/v8/v8/commit/5f44131944800f16c4dc6768acb67561e3746384

PR-URL: https://github.com/nodejs/node/pull/38273
Backport-PR-URL: https://github.com/nodejs/node/pull/38991
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Mary Marchini <oss@mmarchini.me>

4 files changed, 26 insertions, 17 deletions

diff --git a/deps/v8/src/builtins/promise-misc.tq b/deps/v8/src/builtins/promise-misc.tq
index 50e2c8f0de1..0eae717b3fc 100644
--- a/deps/v8/src/builtins/promise-misc.tq
+++ b/deps/v8/src/builtins/promise-misc.tq
@@ -104,9 +104,7 @@ transitioning macro RunContextPromiseHookInit(implicit context: Context)(
     promise: JSPromise, parent: Object) {
   const maybeHook = *NativeContextSlot(
       ContextSlot::PROMISE_HOOK_INIT_FUNCTION_INDEX);
-  if (IsUndefined(maybeHook)) return;
-
-  const hook = Cast<JSFunction>(maybeHook) otherwise unreachable;
+  const hook = Cast<Callable>(maybeHook) otherwise return;
   const parentObject = Is<JSPromise>(parent) ? Cast<JSPromise>(parent)
       otherwise unreachable: Undefined;
 
@@ -165,13 +163,11 @@ transitioning macro RunContextPromiseHookAfter(implicit context: Context)(
 }
 
 transitioning macro RunContextPromiseHook(implicit context: Context)(
-    slot: Slot<NativeContext, Undefined|JSFunction>,
+    slot: Slot<NativeContext, Undefined|Callable>,
     promiseOrCapability: JSPromise|PromiseCapability|Undefined, flags: uint32) {
   if (!IsContextPromiseHookEnabled(flags)) return;
   const maybeHook = *NativeContextSlot(slot);
-  if (IsUndefined(maybeHook)) return;
-
-  const hook = Cast<JSFunction>(maybeHook) otherwise unreachable;
+  const hook = Cast<Callable>(maybeHook) otherwise return;
 
   let promise: JSPromise;
   typeswitch (promiseOrCapability) {
diff --git a/deps/v8/src/builtins/promise-resolve.tq b/deps/v8/src/builtins/promise-resolve.tq
index 3125054e87a..fa3d19411fc 100644
--- a/deps/v8/src/builtins/promise-resolve.tq
+++ b/deps/v8/src/builtins/promise-resolve.tq
@@ -30,7 +30,8 @@ transitioning builtin
 PromiseResolve(implicit context: Context)(
     constructor: JSReceiver, value: JSAny): JSAny {
   const nativeContext = LoadNativeContext(context);
-  const promiseFun = *NativeContextSlot(ContextSlot::PROMISE_FUNCTION_INDEX);
+  const promiseFun = *NativeContextSlot(
+      nativeContext, ContextSlot::PROMISE_FUNCTION_INDEX);
   try {
     // Check if {value} is a JSPromise.
     const value = Cast<JSPromise>(value) otherwise NeedToAllocate;
@@ -40,7 +41,8 @@ PromiseResolve(implicit context: Context)(
     // intact, as that guards the lookup path for "constructor" on
     // JSPromise instances which have the (initial) Promise.prototype.
     const promisePrototype =
-        *NativeContextSlot(ContextSlot::PROMISE_PROTOTYPE_INDEX);
+        *NativeContextSlot(
+        nativeContext, ContextSlot::PROMISE_PROTOTYPE_INDEX);
     // Check that Torque load elimination works.
     static_assert(nativeContext == LoadNativeContext(context));
     if (value.map.prototype != promisePrototype) {
@@ -139,7 +141,8 @@ ResolvePromise(implicit context: Context)(
       assert(IsJSReceiverMap(resolutionMap));
       assert(!IsPromiseThenProtectorCellInvalid());
       if (resolutionMap ==
-          *NativeContextSlot(ContextSlot::ITERATOR_RESULT_MAP_INDEX)) {
+          *NativeContextSlot(
+              nativeContext, ContextSlot::ITERATOR_RESULT_MAP_INDEX)) {
         return FulfillPromise(promise, resolution);
       } else {
         goto Slow;
@@ -147,10 +150,11 @@ ResolvePromise(implicit context: Context)(
     }
 
     const promisePrototype =
-        *NativeContextSlot(ContextSlot::PROMISE_PROTOTYPE_INDEX);
+        *NativeContextSlot(
+        nativeContext, ContextSlot::PROMISE_PROTOTYPE_INDEX);
     if (resolutionMap.prototype == promisePrototype) {
       // The {resolution} is a native Promise in this case.
-      then = *NativeContextSlot(ContextSlot::PROMISE_THEN_INDEX);
+      then = *NativeContextSlot(nativeContext, ContextSlot::PROMISE_THEN_INDEX);
       // Check that Torque load elimination works.
       static_assert(nativeContext == LoadNativeContext(context));
       goto Enqueue;
diff --git a/deps/v8/src/objects/contexts.tq b/deps/v8/src/objects/contexts.tq
index ff427629abe..28ea1300ee0 100644
--- a/deps/v8/src/objects/contexts.tq
+++ b/deps/v8/src/objects/contexts.tq
@@ -124,11 +124,10 @@ extern enum ContextSlot extends intptr constexpr 'Context::Field' {
   PROMISE_PROTOTYPE_INDEX: Slot<NativeContext, JSObject>,
   STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX: Slot<NativeContext, Map>,
 
-  PROMISE_HOOK_INIT_FUNCTION_INDEX: Slot<NativeContext, Undefined|JSFunction>,
-  PROMISE_HOOK_BEFORE_FUNCTION_INDEX: Slot<NativeContext, Undefined|JSFunction>,
-  PROMISE_HOOK_AFTER_FUNCTION_INDEX: Slot<NativeContext, Undefined|JSFunction>,
-  PROMISE_HOOK_RESOLVE_FUNCTION_INDEX:
-      Slot<NativeContext, Undefined|JSFunction>,
+  PROMISE_HOOK_INIT_FUNCTION_INDEX: Slot<NativeContext, Undefined|Callable>,
+  PROMISE_HOOK_BEFORE_FUNCTION_INDEX: Slot<NativeContext, Undefined|Callable>,
+  PROMISE_HOOK_AFTER_FUNCTION_INDEX: Slot<NativeContext, Undefined|Callable>,
+  PROMISE_HOOK_RESOLVE_FUNCTION_INDEX: Slot<NativeContext, Undefined|Callable>,
 
   CONTINUATION_PRESERVED_EMBEDDER_DATA_INDEX: Slot<NativeContext, HeapObject>,
 
diff --git a/deps/v8/test/mjsunit/promise-hooks.js b/deps/v8/test/mjsunit/promise-hooks.js
index db7041a8f5d..bf51777dcec 100644
--- a/deps/v8/test/mjsunit/promise-hooks.js
+++ b/deps/v8/test/mjsunit/promise-hooks.js
@@ -252,3 +252,13 @@ exceptions();
   }
   __f_16(async () => { await Promise.resolve()});
 })();
+
+(function boundFunction() {
+  function hook() {};
+  const bound = hook.bind(this);
+  d8.promise.setHooks(bound, bound, bound, bound);
+  Promise.resolve();
+  Promise.reject();
+  %PerformMicrotaskCheckpoint();
+  d8.promise.setHooks();
+})();