deps: update V8 to 5.4.500.43

PR-URL: #9697
Reviewed-By: Ben Noordhuis <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Anna Henningsen <[email protected]>

Author: targos

deps/v8/include/v8-version.h

@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 5
 #define V8_MINOR_VERSION 4
 #define V8_BUILD_NUMBER 500
-#define V8_PATCH_LEVEL 41
+#define V8_PATCH_LEVEL 43
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)

deps/v8/src/debug/debug.cc

@@ -1701,6 +1701,11 @@ MaybeHandle<Object> Debug::PromiseHasUserDefinedRejectHandler(
 
 
 void Debug::OnException(Handle<Object> exception, Handle<Object> promise) {
+  // We cannot generate debug events when JS execution is disallowed.
+  // TODO(5530): Reenable debug events within DisallowJSScopes once relevant
+  // code (MakeExceptionEvent and ProcessDebugEvent) have been moved to C++.
+  if (!AllowJavascriptExecution::IsAllowed(isolate_)) return;
+
   Isolate::CatchType catch_type = isolate_->PredictExceptionCatcher();
 
   // Don't notify listener of exceptions that are internal to a desugaring.

deps/v8/src/lookup.cc

@@ -308,6 +308,11 @@ void LookupIterator::PrepareTransitionToDataProperty(
     PropertyAttributes attributes, Object::StoreFromKeyed store_mode) {
   DCHECK(receiver.is_identical_to(GetStoreTarget()));
   if (state_ == TRANSITION) return;
+
+  if (!IsElement() && name()->IsPrivate()) {
+    attributes = static_cast<PropertyAttributes>(attributes | DONT_ENUM);
+  }
+
   DCHECK(state_ != LookupIterator::ACCESSOR ||
          (GetAccessors()->IsAccessorInfo() &&
           AccessorInfo::cast(*GetAccessors())->is_special_data_property()));
@@ -447,6 +452,9 @@ void LookupIterator::TransitionToAccessorProperty(
   // handled via a trap. Adding properties to primitive values is not
   // observable.
   Handle<JSObject> receiver = GetStoreTarget();
+  if (!IsElement() && name()->IsPrivate()) {
+    attributes = static_cast<PropertyAttributes>(attributes | DONT_ENUM);
+  }
 
   if (!IsElement() && !receiver->map()->is_dictionary_map()) {
     Handle<Map> old_map(receiver->map(), isolate_);

deps/v8/src/property.h

@@ -36,6 +36,7 @@ class Descriptor BASE_EMBEDDED {
 
   void Init(Handle<Name> key, Handle<Object> value, PropertyDetails details) {
     DCHECK(key->IsUniqueName());
+    DCHECK_IMPLIES(key->IsPrivate(), !details.IsEnumerable());
     key_ = key;
     value_ = value;
     details_ = details;
@@ -44,6 +45,7 @@ class Descriptor BASE_EMBEDDED {
   Descriptor(Handle<Name> key, Handle<Object> value, PropertyDetails details)
       : key_(key), value_(value), details_(details) {
     DCHECK(key->IsUniqueName());
+    DCHECK_IMPLIES(key->IsPrivate(), !details_.IsEnumerable());
   }
 
   Descriptor(Handle<Name> key, Handle<Object> value,
@@ -53,6 +55,7 @@ class Descriptor BASE_EMBEDDED {
         value_(value),
         details_(attributes, type, representation, field_index) {
     DCHECK(key->IsUniqueName());
+    DCHECK_IMPLIES(key->IsPrivate(), !details_.IsEnumerable());
   }
 
   friend class DescriptorArray;

deps/v8/test/debugger/debug/regress/regress-662674.js

@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stack-size=100
+
+Debug = debug.Debug
+
+function overflow() {
+  return overflow();
+}
+
+Debug.setBreakOnException();
+assertThrows(overflow, RangeError);

deps/v8/test/mjsunit/harmony/private.js

@@ -278,8 +278,8 @@ function TestKeyDescriptor(obj) {
     assertEquals(i|0, desc.value)
     assertTrue(desc.configurable)
     assertEquals(i % 2 == 0, desc.writable)
-    assertEquals(i % 2 == 0, desc.enumerable)
-    assertEquals(i % 2 == 0,
+    assertEquals(false, desc.enumerable)
+    assertEquals(false,
         Object.prototype.propertyIsEnumerable.call(obj, symbols[i]))
   }
 }

deps/v8/test/mjsunit/regress/regress-private-enumerable.js

@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+class A {}
+class B {}
+Object.assign(B, A);
+assertEquals("class B {}", B.toString());