deps: V8: backport da20a197a7f9

Original commit message:

    [builtins] Make Promise resolvers not keep resolved Promises alive

    Currently a Promise's resolve/reject functions unconditionally hold the
    Promise, plus a separate bit to track whether the Promise has been
    resolved. Instead, hold a single field with Promise|Undefined.

    This allows GC'ing a resolved Promise even if its resolvers are still
    alive.

    R=olivf@chromium.org

    Fixed: 42213031
    Change-Id: Ice645dbabb79e63dfcac8ae843cad95439d7a1f1
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7646250
    Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
    Commit-Queue: Kevin Gibbons <bakkot@gmail.com>
    Reviewed-by: Olivier Flückiger <olivf@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#108183}

Refs: v8/v8@da20a19
Co-authored-by: Kevin Gibbons <bakkot@gmail.com>

Author: bakkot

common.gypi

@@ -40,7 +40,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.23',
+    'v8_embedder_string': '-node.24',
 
     ##### V8 defaults for Node.js #####
 

deps/v8/src/builtins/builtins-promise.h

@@ -13,11 +13,9 @@ namespace internal {
 class PromiseBuiltins {
  public:
   enum PromiseResolvingFunctionContextSlot {
-    // The promise which resolve/reject callbacks fulfill.
-    kPromiseSlot = Context::MIN_CONTEXT_SLOTS,
-
-    // Whether the callback was already invoked.
-    kAlreadyResolvedSlot,
+    // The promise which resolve/reject callbacks fulfill, or Undefined
+    // if already resolved.
+    kPromiseIfNotResolvedSlot = Context::MIN_CONTEXT_SLOTS,
 
     // Whether to trigger a debug event or not. Used in catch
     // prediction.

deps/v8/src/builtins/promise-abstract-operations.tq

@@ -265,8 +265,8 @@ const kPromiseCapabilitySize:
 type PromiseResolvingFunctionContext extends FunctionContext;
 extern enum PromiseResolvingFunctionContextSlot extends intptr
     constexpr 'PromiseBuiltins::PromiseResolvingFunctionContextSlot' {
-  kPromiseSlot: Slot<PromiseResolvingFunctionContext, JSPromise>,
-  kAlreadyResolvedSlot: Slot<PromiseResolvingFunctionContext, Boolean>,
+  kPromiseIfNotResolvedSlot:
+      Slot<PromiseResolvingFunctionContext, JSPromise|Undefined>,
   kDebugEventSlot: Slot<PromiseResolvingFunctionContext, Boolean>,
   kPromiseContextLength
 }
@@ -390,25 +390,29 @@ transitioning builtin NewPromiseCapability(
 transitioning javascript builtin PromiseCapabilityDefaultReject(
     js-implicit context: Context, receiver: JSAny)(reason: JSAny): JSAny {
   const context = %RawDownCast<PromiseResolvingFunctionContext>(context);
-  // 2. Let promise be F.[[Promise]].
-  const promise =
-      *ContextSlot(context, PromiseResolvingFunctionContextSlot::kPromiseSlot);
-
-  // 3. Let alreadyResolved be F.[[AlreadyResolved]].
-  const alreadyResolved = *ContextSlot(
-      context, PromiseResolvingFunctionContextSlot::kAlreadyResolvedSlot);
-
-  // 4. If alreadyResolved.[[Value]] is true, return undefined.
-  if (alreadyResolved == True) {
-    return Undefined;
+  // 2. Let promise be promiseOrEmpty.[[Value]].
+  const promiseOrEmpty =
+      *ContextSlot(
+      context, PromiseResolvingFunctionContextSlot::kPromiseIfNotResolvedSlot);
+
+  // 1. If promiseOrEmpty.[[Value]] is ~empty~, return undefined.
+  let promise: JSPromise;
+  typeswitch (promiseOrEmpty) {
+    case (Undefined): {
+      return Undefined;
+    }
+    case (p: JSPromise): {
+      promise = p;
+    }
   }
 
-  // 5. Set alreadyResolved.[[Value]] to true.
+  // 3. Set promiseOrEmpty.[[Value]] to ~empty~.
   *ContextSlot(
-      context, PromiseResolvingFunctionContextSlot::kAlreadyResolvedSlot) =
-      True;
+      context, PromiseResolvingFunctionContextSlot::kPromiseIfNotResolvedSlot) =
+      Undefined;
 
-  // 6. Return RejectPromise(promise, reason).
+  // 4. Perform RejectPromise(promise, reason).
+  // 5. Return undefined.
   const debugEvent = *ContextSlot(
       context, PromiseResolvingFunctionContextSlot::kDebugEventSlot);
   return RejectPromise(promise, reason, debugEvent);
@@ -418,23 +422,26 @@ transitioning javascript builtin PromiseCapabilityDefaultReject(
 transitioning javascript builtin PromiseCapabilityDefaultResolve(
     js-implicit context: Context, receiver: JSAny)(resolution: JSAny): JSAny {
   const context = %RawDownCast<PromiseResolvingFunctionContext>(context);
-  // 2. Let promise be F.[[Promise]].
-  const promise: JSPromise =
-      *ContextSlot(context, PromiseResolvingFunctionContextSlot::kPromiseSlot);
-
-  // 3. Let alreadyResolved be F.[[AlreadyResolved]].
-  const alreadyResolved: Boolean = *ContextSlot(
-      context, PromiseResolvingFunctionContextSlot::kAlreadyResolvedSlot);
-
-  // 4. If alreadyResolved.[[Value]] is true, return undefined.
-  if (alreadyResolved == True) {
-    return Undefined;
+  // 2. Let promise be promiseOrEmpty.[[Value]].
+  const promiseOrEmpty =
+      *ContextSlot(
+      context, PromiseResolvingFunctionContextSlot::kPromiseIfNotResolvedSlot);
+
+  // 1. If promiseOrEmpty.[[Value]] is ~empty~, return undefined.
+  let promise: JSPromise;
+  typeswitch (promiseOrEmpty) {
+    case (Undefined): {
+      return Undefined;
+    }
+    case (p: JSPromise): {
+      promise = p;
+    }
   }
 
-  // 5. Set alreadyResolved.[[Value]] to true.
+  // 3. Set promiseOrEmpty.[[Value]] to ~empty~.
   *ContextSlot(
-      context, PromiseResolvingFunctionContextSlot::kAlreadyResolvedSlot) =
-      True;
+      context, PromiseResolvingFunctionContextSlot::kPromiseIfNotResolvedSlot) =
+      Undefined;
 
   // The rest of the logic (and the catch prediction) is
   // encapsulated in the dedicated ResolvePromise builtin.

deps/v8/src/builtins/promise-all.tq

@@ -63,17 +63,14 @@ macro CreatePromiseResolvingFunctionsContext(
           nativeContext,
           PromiseResolvingFunctionContextSlot::kPromiseContextLength));
   InitContextSlot(
-      resolveContext, PromiseResolvingFunctionContextSlot::kPromiseSlot,
-      promise);
-  InitContextSlot(
-      resolveContext, PromiseResolvingFunctionContextSlot::kAlreadyResolvedSlot,
-      False);
+      resolveContext,
+      PromiseResolvingFunctionContextSlot::kPromiseIfNotResolvedSlot, promise);
   InitContextSlot(
       resolveContext, PromiseResolvingFunctionContextSlot::kDebugEventSlot,
       debugEvent);
   static_assert(
       PromiseResolvingFunctionContextSlot::kPromiseContextLength ==
-      ContextSlot::MIN_CONTEXT_SLOTS + 3);
+      ContextSlot::MIN_CONTEXT_SLOTS + 2);
   return resolveContext;
 }
 

deps/v8/src/compiler/js-call-reducer.cc

@@ -2543,10 +2543,8 @@ TNode<Object> PromiseBuiltinReducerAssembler::ReducePromiseConstructor(
   // Allocate a promise context for the closures below.
   TNode<Context> promise_context = CreateFunctionContext(
       native_context, context, PromiseBuiltins::kPromiseContextLength);
-  StoreContextNoCellSlot(promise_context, PromiseBuiltins::kPromiseSlot,
-                         promise);
-  StoreContextNoCellSlot(promise_context, PromiseBuiltins::kAlreadyResolvedSlot,
-                         FalseConstant());
+  StoreContextNoCellSlot(promise_context,
+                         PromiseBuiltins::kPromiseIfNotResolvedSlot, promise);
   StoreContextNoCellSlot(promise_context, PromiseBuiltins::kDebugEventSlot,
                          TrueConstant());
 

deps/v8/src/execution/isolate.cc

@@ -1253,9 +1253,12 @@ void CaptureAsyncStackTrace(Isolate* isolate, DirectHandle<JSPromise> promise,
       DirectHandle<JSFunction> function(
           Cast<JSFunction>(reaction->fulfill_handler()), isolate);
       DirectHandle<Context> context(function->context(), isolate);
-      promise = direct_handle(
-          Cast<JSPromise>(context->GetNoCell(PromiseBuiltins::kPromiseSlot)),
-          isolate);
+      Tagged<Object> promise_or_undefined =
+          context->GetNoCell(PromiseBuiltins::kPromiseIfNotResolvedSlot);
+      if (!TryCast(direct_handle(promise_or_undefined, isolate), &promise)) {
+        DCHECK(IsUndefined(promise_or_undefined));
+        return;
+      }
     } else {
       // We have some generic promise chain here, so try to
       // continue with the chained promise on the reaction

deps/v8/test/cctest/test-code-stub-assembler.cc

@@ -3037,7 +3037,8 @@ TEST(CreatePromiseResolvingFunctionsContext) {
   DirectHandle<Context> context_js = Cast<Context>(result);
   CHECK_EQ(isolate->root(RootIndex::kEmptyScopeInfo), context_js->scope_info());
   CHECK_EQ(*isolate->native_context(), context_js->native_context());
-  CHECK(IsJSPromise(context_js->GetNoCell(PromiseBuiltins::kPromiseSlot)));
+  CHECK(IsJSPromise(
+      context_js->GetNoCell(PromiseBuiltins::kPromiseIfNotResolvedSlot)));
   CHECK_EQ(ReadOnlyRoots(isolate).false_value(),
            context_js->GetNoCell(PromiseBuiltins::kDebugEventSlot));
 }
@@ -3246,7 +3247,8 @@ TEST(NewPromiseCapability) {
       CHECK_EQ(*isolate->native_context(), callback_context->native_context());
       CHECK_EQ(PromiseBuiltins::kPromiseContextLength,
                callback_context->length());
-      CHECK_EQ(callback_context->GetNoCell(PromiseBuiltins::kPromiseSlot),
+      CHECK_EQ(callback_context->GetNoCell(
+                   PromiseBuiltins::kPromiseIfNotResolvedSlot),
                result->promise());
     }
   }

deps/v8/test/mjsunit/regress/regress-crbug-42213031.js

@@ -0,0 +1,26 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+const pending = new Promise(() => {});
+
+(async function () {
+  let wr;
+
+  await (async function () {
+    const payload = { };
+    wr = new WeakRef(payload);
+    const resolved = Promise.resolve(payload);
+    // The pending Promise should not prevent GC of the race Promise once the race settles.
+    await Promise.race([pending, resolved]);
+  })();
+
+  await gc({ type: 'major', execution: 'async' });
+
+  assertEquals(undefined, wr.deref());
+})().catch((e) => {
+  console.error(e);
+  quit(1);
+});