From 0c771c35fad1867d016d54dfdf018a219a4a0718 Mon Sep 17 00:00:00 2001
From: "Node.js GitHub Bot" <github-bot@iojs.org>
Date: Sun, 25 Aug 2024 00:32:18 +0000
Subject: [PATCH] deps: patch V8 to 12.8.374.22

Refs: https://github.com/v8/v8/compare/12.8.374.13...12.8.374.22

PR-URL: https://github.com/nodejs/node/pull/54435
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
---
 deps/v8/include/v8-version.h                  |   2 +-
 deps/v8/src/ast/scopes.cc                     |  22 +--
 deps/v8/src/codegen/compiler.cc               | 150 ++----------------
 deps/v8/src/compiler/operation-typer.cc       |   1 +
 deps/v8/src/flags/flag-definitions.h          |   1 -
 deps/v8/src/objects/js-date-time-format.cc    |   2 +-
 deps/v8/src/objects/scope-info.cc             |   3 +-
 .../v8/src/objects/shared-function-info-inl.h |  10 +-
 deps/v8/src/objects/shared-function-info.cc   |  11 --
 deps/v8/src/objects/shared-function-info.h    |   2 -
 .../v8/src/wasm/baseline/liftoff-assembler.cc |  35 +---
 deps/v8/src/wasm/baseline/liftoff-assembler.h |   6 +-
 deps/v8/src/wasm/baseline/liftoff-compiler.cc |   2 +-
 deps/v8/src/wasm/wasm-js.cc                   |   8 +-
 deps/v8/test/intl/regress-40855035.js         |   6 -
 deps/v8/test/mjsunit/wasm/stack-switching.js  |  21 +++
 16 files changed, 71 insertions(+), 211 deletions(-)
 delete mode 100644 deps/v8/test/intl/regress-40855035.js

diff --git a/deps/v8/include/v8-version.h b/deps/v8/include/v8-version.h
index e038daf0b24877..e8ca1b5b46fa72 100644
--- a/deps/v8/include/v8-version.h
+++ b/deps/v8/include/v8-version.h
@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 12
 #define V8_MINOR_VERSION 8
 #define V8_BUILD_NUMBER 374
-#define V8_PATCH_LEVEL 13
+#define V8_PATCH_LEVEL 22
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)
diff --git a/deps/v8/src/ast/scopes.cc b/deps/v8/src/ast/scopes.cc
index eef58fe37ec67f..d6f168e7258c48 100644
--- a/deps/v8/src/ast/scopes.cc
+++ b/deps/v8/src/ast/scopes.cc
@@ -2607,8 +2607,7 @@ void ModuleScope::AllocateModuleVariables() {
   }
 }
 
-// Needs to be kept in sync with ScopeInfo::UniqueIdInScript and
-// SharedFunctionInfo::UniqueIdInScript.
+// Needs to be kept in sync with ScopeInfo::UniqueIdInScript.
 int Scope::UniqueIdInScript() const {
   // Script scopes start "before" the script to avoid clashing with a scope that
   // starts on character 0.
@@ -2801,10 +2800,9 @@ void DeclarationScope::AllocateScopeInfos(ParseInfo* info,
     Tagged<ScopeInfo> outer = sfi->HasOuterScopeInfo()
                                   ? sfi->GetOuterScopeInfo()
                                   : Tagged<ScopeInfo>();
-    // Look at all inner functions whether they have scope infos that we should
-    // reuse. Also look at the compiled function itself, and reuse its function
-    // scope info if it exists.
-    for (int i = info->literal()->function_literal_id();
+    // Look at all the existing inner functions (they are numbered id+1 until
+    // max_id+1) to reattach their outer scope infos to corresponding scopes.
+    for (int i = info->literal()->function_literal_id() + 1;
          i < info->max_info_id() + 1; ++i) {
       Tagged<MaybeObject> maybe_info = infos->get(i);
       if (maybe_info.IsWeak()) {
@@ -2812,14 +2810,10 @@ void DeclarationScope::AllocateScopeInfos(ParseInfo* info,
         Tagged<ScopeInfo> scope_info;
         if (Is<SharedFunctionInfo>(info)) {
           Tagged<SharedFunctionInfo> sfi = Cast<SharedFunctionInfo>(info);
-          if (!sfi->scope_info()->IsEmpty() &&
-              sfi->scope_info()->HasContext()) {
-            scope_info = sfi->scope_info();
-          } else if (sfi->HasOuterScopeInfo()) {
-            scope_info = sfi->GetOuterScopeInfo();
-          } else {
-            continue;
-          }
+          // Reuse outer scope infos. Don't look at sfi->scope_info() because
+          // that might be empty if the sfi isn't compiled yet.
+          if (!sfi->HasOuterScopeInfo()) continue;
+          scope_info = sfi->GetOuterScopeInfo();
         } else {
           scope_info = Cast<ScopeInfo>(info);
         }
diff --git a/deps/v8/src/codegen/compiler.cc b/deps/v8/src/codegen/compiler.cc
index 2de8fe8ad32cb8..0a95368d3b904e 100644
--- a/deps/v8/src/codegen/compiler.cc
+++ b/deps/v8/src/codegen/compiler.cc
@@ -2022,39 +2022,18 @@ class ConstantPoolPointerForwarder {
   }
 
   void RecordScopeInfos(Tagged<MaybeObject> maybe_old_info) {
-    RecordScopeInfos(maybe_old_info.GetHeapObjectAssumeWeak());
-  }
-
-  // Record all scope infos relevant for a shared function info or scope info
-  // (recorded for eval).
-  void RecordScopeInfos(Tagged<HeapObject> info) {
     Tagged<ScopeInfo> scope_info;
+    Tagged<HeapObject> info = maybe_old_info.GetHeapObjectAssumeWeak();
     if (Is<SharedFunctionInfo>(info)) {
       Tagged<SharedFunctionInfo> old_sfi = Cast<SharedFunctionInfo>(info);
-      // Also record context-having own scope infos for SFIs.
-      if (!old_sfi->scope_info()->IsEmpty() &&
-          old_sfi->scope_info()->HasContext()) {
-        scope_info = old_sfi->scope_info();
-      } else if (old_sfi->HasOuterScopeInfo()) {
-        scope_info = old_sfi->GetOuterScopeInfo();
-      } else {
-        return;
-      }
+      if (!old_sfi->HasOuterScopeInfo()) return;
+      scope_info = old_sfi->GetOuterScopeInfo();
     } else {
       scope_info = Cast<ScopeInfo>(info);
     }
-
     while (true) {
-      auto it = scope_infos_to_update_.find(scope_info->UniqueIdInScript());
-      if (it != scope_infos_to_update_.end()) {
-        // Once we find an already recorded scope info, it need to match the one
-        // on the chain.
-        if (V8_UNLIKELY(*it->second != scope_info)) {
-          info->Print();
-          (*it->second)->Print();
-          scope_info->Print();
-          UNREACHABLE();
-        }
+      if (scope_infos_to_update_.find(scope_info->UniqueIdInScript()) !=
+          scope_infos_to_update_.end()) {
         return;
       }
       scope_infos_to_update_[scope_info->UniqueIdInScript()] =
@@ -2083,51 +2062,17 @@ class ConstantPoolPointerForwarder {
            !scope_infos_to_update_.empty();
   }
 
-  // Find an own scope info for the sfi based on the UniqueIdInScript that the
-  // own scope info would have. This works even if the SFI doesn't yet have a
-  // scope info attached by computing UniqueIdInScript from the SFI position.
-  //
-  // This should only directly be used for SFIs that already existed on the
-  // script. Their outer scope info will already be correct.
-  bool InstallOwnScopeInfo(Tagged<SharedFunctionInfo> sfi) {
-    auto it = scope_infos_to_update_.find(sfi->UniqueIdInScript());
-    if (it == scope_infos_to_update_.end()) return false;
-    sfi->SetScopeInfo(*it->second);
-    return true;
-  }
-
-  // Either replace the own scope info of the sfi, or the first outer scope info
-  // that was recorded.
-  //
-  // This has to be used for all newly created SFIs since their outer scope info
-  // also may need to be reattached.
-  void UpdateScopeInfo(Tagged<SharedFunctionInfo> sfi) {
-    // This should not be called on already existing SFIs. Their scope infos are
-    // already correct.
-    DCHECK_NE(MakeWeak(sfi),
-              old_script_->infos()->get(sfi->function_literal_id()));
-    if (InstallOwnScopeInfo(sfi)) return;
+  void UpdateOuterScopeInfo(Tagged<SharedFunctionInfo> sfi) {
     if (!sfi->HasOuterScopeInfo()) return;
-
-    Tagged<ScopeInfo> parent =
-        sfi->scope_info()->IsEmpty() ? Tagged<ScopeInfo>() : sfi->scope_info();
     Tagged<ScopeInfo> outer_info = sfi->GetOuterScopeInfo();
-
     auto it = scope_infos_to_update_.find(outer_info->UniqueIdInScript());
-    while (it == scope_infos_to_update_.end()) {
-      if (!outer_info->HasOuterScopeInfo()) return;
-      parent = outer_info;
-      outer_info = outer_info->OuterScopeInfo();
-      it = scope_infos_to_update_.find(outer_info->UniqueIdInScript());
-    }
+    if (it == scope_infos_to_update_.end()) return;
     if (outer_info == *it->second) return;
-
     VerifyScopeInfo(outer_info, *it->second);
-
-    if (parent.is_null()) {
-      sfi->set_raw_outer_scope_info_or_feedback_metadata(*it->second);
+    if (sfi->is_compiled()) {
+      sfi->scope_info()->set_outer_scope_info(*it->second);
     } else {
-      parent->set_outer_scope_info(*it->second);
+      sfi->set_raw_outer_scope_info_or_feedback_metadata(*it->second);
     }
   }
 
@@ -2309,16 +2254,6 @@ void BackgroundMergeTask::BeginMergeInBackground(
           new_compiled_data_for_cached_sfis_.push_back(
               {local_heap->NewPersistentHandle(old_sfi),
                local_heap->NewPersistentHandle(new_sfi)});
-          // Pick up existing scope infos from the old sfi. The new sfi will be
-          // copied over the old sfi later. This will ensure that we'll keep
-          // using the old sfis. This will also allow us check later whether new
-          // scope infos have appeared that need to be reused.
-          if (!old_sfi->scope_info()->IsEmpty()) {
-            new_sfi->SetScopeInfo(old_sfi->scope_info());
-          } else if (old_sfi->HasOuterScopeInfo()) {
-            new_sfi->scope_info()->set_outer_scope_info(
-                old_sfi->GetOuterScopeInfo());
-          }
           forwarder.AddBytecodeArray(new_sfi->GetBytecodeArray(isolate));
         }
       } else {
@@ -2343,23 +2278,13 @@ void BackgroundMergeTask::BeginMergeInBackground(
 
   if (forwarder.HasAnythingToForward()) {
     for (DirectHandle<SharedFunctionInfo> new_sfi : used_new_sfis_) {
-      forwarder.UpdateScopeInfo(*new_sfi);
-    }
-    for (const auto& new_compiled_data : new_compiled_data_for_cached_sfis_) {
-      // It's possible that new_compiled_data.cached_sfi had
-      // scope_info()->IsEmpty() while an inner function has scope info if the
-      // cached_sfi was recreated when an outer function was recompiled. If so,
-      // new_compiled_data.new_sfi does not have a reused scope info yet, and
-      // we'll have found it when we visited the inner function. Try to pick it
-      // up here.
-      forwarder.InstallOwnScopeInfo(*new_compiled_data.new_sfi);
+      forwarder.UpdateOuterScopeInfo(*new_sfi);
     }
     forwarder.IterateAndForwardPointers();
   }
   persistent_handles_ = local_heap->DetachPersistentHandles();
   state_ = kPendingForegroundWork;
 }
-
 Handle<SharedFunctionInfo> BackgroundMergeTask::CompleteMergeInForeground(
     Isolate* isolate, DirectHandle<Script> new_script) {
   DCHECK_EQ(state_, kPendingForegroundWork);
@@ -2370,8 +2295,8 @@ Handle<SharedFunctionInfo> BackgroundMergeTask::CompleteMergeInForeground(
       isolate, isolate->main_thread_local_heap(), old_script);
 
   for (const auto& new_compiled_data : new_compiled_data_for_cached_sfis_) {
-    Tagged<SharedFunctionInfo> sfi = *new_compiled_data.cached_sfi;
-    if (!sfi->is_compiled() && new_compiled_data.new_sfi->is_compiled()) {
+    if (!new_compiled_data.cached_sfi->is_compiled() &&
+        new_compiled_data.new_sfi->is_compiled()) {
       // Updating existing DebugInfos is not supported, but we don't expect
       // uncompiled SharedFunctionInfos to contain DebugInfos.
       DCHECK(!new_compiled_data.cached_sfi->HasDebugInfo(isolate));
@@ -2381,7 +2306,8 @@ Handle<SharedFunctionInfo> BackgroundMergeTask::CompleteMergeInForeground(
       // cached_sfi to new_sfi, and then copy every field using CopyFrom.
       new_compiled_data.new_sfi->set_script(
           new_compiled_data.cached_sfi->script(kAcquireLoad), kReleaseStore);
-      sfi->CopyFrom(*new_compiled_data.new_sfi, isolate);
+      new_compiled_data.cached_sfi->CopyFrom(*new_compiled_data.new_sfi,
+                                             isolate);
     }
   }
 
@@ -2410,17 +2336,12 @@ Handle<SharedFunctionInfo> BackgroundMergeTask::CompleteMergeInForeground(
   // pools is required.
   if (forwarder.HasAnythingToForward()) {
     for (DirectHandle<SharedFunctionInfo> new_sfi : used_new_sfis_) {
-      forwarder.UpdateScopeInfo(*new_sfi);
+      forwarder.UpdateOuterScopeInfo(*new_sfi);
       if (new_sfi->HasBytecodeArray(isolate)) {
         forwarder.AddBytecodeArray(new_sfi->GetBytecodeArray(isolate));
       }
     }
     for (const auto& new_compiled_data : new_compiled_data_for_cached_sfis_) {
-      // It's possible that cached_sfi wasn't compiled, but an inner function
-      // existed that didn't exist when be background merged. In that case, pick
-      // up the relevant scope infos.
-      Tagged<SharedFunctionInfo> sfi = *new_compiled_data.cached_sfi;
-      forwarder.InstallOwnScopeInfo(sfi);
       if (new_compiled_data.cached_sfi->HasBytecodeArray(isolate)) {
         forwarder.AddBytecodeArray(
             new_compiled_data.cached_sfi->GetBytecodeArray(isolate));
@@ -2443,45 +2364,6 @@ Handle<SharedFunctionInfo> BackgroundMergeTask::CompleteMergeInForeground(
     SharedFunctionInfo::EnsureSourcePositionsAvailable(isolate, result);
   }
 
-  if (v8_flags.verify_code_merge) {
-    // Check that there aren't any duplicate scope infos. Every scope/context
-    // should correspond to at most one scope info.
-    std::unordered_map<int, Tagged<ScopeInfo>> scope_infos;
-    for (int i = 0; i < old_script->infos()->length(); i++) {
-      Tagged<ScopeInfo> scope_info;
-      if (!old_script->infos()->get(i).IsWeak()) continue;
-      Tagged<HeapObject> info =
-          old_script->infos()->get(i).GetHeapObjectAssumeWeak();
-      if (Is<SharedFunctionInfo>(info)) {
-        Tagged<SharedFunctionInfo> old_sfi = Cast<SharedFunctionInfo>(info);
-        if (!old_sfi->scope_info()->IsEmpty()) {
-          scope_info = old_sfi->scope_info();
-        } else if (old_sfi->HasOuterScopeInfo()) {
-          scope_info = old_sfi->GetOuterScopeInfo();
-        } else {
-          continue;
-        }
-      } else {
-        scope_info = Cast<ScopeInfo>(info);
-      }
-      while (true) {
-        auto it = scope_infos.find(scope_info->UniqueIdInScript());
-        if (it != scope_infos.end()) {
-          if (*it->second != scope_info) {
-            old_script->infos()->get(i).GetHeapObjectAssumeWeak()->Print();
-            (*it->second)->Print();
-            scope_info->Print();
-            UNREACHABLE();
-          }
-          break;
-        }
-        scope_infos[scope_info->UniqueIdInScript()] = scope_info;
-        if (!scope_info->HasOuterScopeInfo()) break;
-        scope_info = scope_info->OuterScopeInfo();
-      }
-    }
-  }
-
   return handle_scope.CloseAndEscape(result);
 }
 
diff --git a/deps/v8/src/compiler/operation-typer.cc b/deps/v8/src/compiler/operation-typer.cc
index 11d83ba7a052f8..832e26ce25522a 100644
--- a/deps/v8/src/compiler/operation-typer.cc
+++ b/deps/v8/src/compiler/operation-typer.cc
@@ -1259,6 +1259,7 @@ Type JSType(Type type) {
 }  // namespace
 
 Type OperationTyper::SameValue(Type lhs, Type rhs) {
+  if (lhs.IsNone() || rhs.IsNone()) return Type::None();
   if (!JSType(lhs).Maybe(JSType(rhs))) return singleton_false();
   if (lhs.Is(Type::NaN())) {
     if (rhs.Is(Type::NaN())) return singleton_true();
diff --git a/deps/v8/src/flags/flag-definitions.h b/deps/v8/src/flags/flag-definitions.h
index cdb5444f30c997..f8f0feaaef6565 100644
--- a/deps/v8/src/flags/flag-definitions.h
+++ b/deps/v8/src/flags/flag-definitions.h
@@ -2217,7 +2217,6 @@ DEFINE_BOOL(
     merge_background_deserialized_script_with_compilation_cache, true,
     "After deserializing code cache data on a background thread, merge it into "
     "an existing Script if one is found in the Isolate compilation cache")
-DEFINE_BOOL(verify_code_merge, false, "Verify scope infos after merge")
 DEFINE_BOOL(
     embedder_instance_types, false,
     "enable type checks based on instance types provided by the embedder")
diff --git a/deps/v8/src/objects/js-date-time-format.cc b/deps/v8/src/objects/js-date-time-format.cc
index 7b215d826516fd..25fbb3b2053fc4 100644
--- a/deps/v8/src/objects/js-date-time-format.cc
+++ b/deps/v8/src/objects/js-date-time-format.cc
@@ -1845,7 +1845,7 @@ std::unique_ptr<icu::SimpleDateFormat> CreateICUDateFormat(
   // has to be discussed. Revisit once the spec is clarified/revised.
   icu::UnicodeString pattern;
   UErrorCode status = U_ZERO_ERROR;
-  pattern = generator->getBestPattern(skeleton, UDATPG_MATCH_ALL_FIELDS_LENGTH,
+  pattern = generator->getBestPattern(skeleton, UDATPG_MATCH_HOUR_FIELD_LENGTH,
                                       status);
   pattern = ReplaceHourCycleInPattern(pattern, hc);
   DCHECK(U_SUCCESS(status));
diff --git a/deps/v8/src/objects/scope-info.cc b/deps/v8/src/objects/scope-info.cc
index 41c8ec797f4295..95c9e2a2bf4b3d 100644
--- a/deps/v8/src/objects/scope-info.cc
+++ b/deps/v8/src/objects/scope-info.cc
@@ -726,8 +726,7 @@ int ScopeInfo::ContextLength() const {
          (function_name_context_slot ? 1 : 0);
 }
 
-// Needs to be kept in sync with Scope::UniqueIdInScript and
-// SharedFunctionInfo::UniqueIdInScript.
+// Needs to be kept in sync with Scope::UniqueIdInScript.
 int ScopeInfo::UniqueIdInScript() const {
   // Script scopes start "before" the script to avoid clashing with a scope that
   // starts on character 0.
diff --git a/deps/v8/src/objects/shared-function-info-inl.h b/deps/v8/src/objects/shared-function-info-inl.h
index ba3bd5000e87f3..b777731f8e14a0 100644
--- a/deps/v8/src/objects/shared-function-info-inl.h
+++ b/deps/v8/src/objects/shared-function-info-inl.h
@@ -613,11 +613,11 @@ DEF_GETTER(SharedFunctionInfo, outer_scope_info, Tagged<HeapObject>) {
 
 bool SharedFunctionInfo::HasOuterScopeInfo() const {
   Tagged<ScopeInfo> outer_info;
-  Tagged<ScopeInfo> info = scope_info(kAcquireLoad);
-  if (info->IsEmpty()) {
+  if (!is_compiled()) {
     if (!IsScopeInfo(outer_scope_info())) return false;
     outer_info = Cast<ScopeInfo>(outer_scope_info());
   } else {
+    Tagged<ScopeInfo> info = scope_info(kAcquireLoad);
     if (!info->HasOuterScopeInfo()) return false;
     outer_info = info->OuterScopeInfo();
   }
@@ -626,9 +626,8 @@ bool SharedFunctionInfo::HasOuterScopeInfo() const {
 
 Tagged<ScopeInfo> SharedFunctionInfo::GetOuterScopeInfo() const {
   DCHECK(HasOuterScopeInfo());
-  Tagged<ScopeInfo> info = scope_info(kAcquireLoad);
-  if (info->IsEmpty()) return Cast<ScopeInfo>(outer_scope_info());
-  return info->OuterScopeInfo();
+  if (!is_compiled()) return Cast<ScopeInfo>(outer_scope_info());
+  return scope_info(kAcquireLoad)->OuterScopeInfo();
 }
 
 void SharedFunctionInfo::set_outer_scope_info(Tagged<HeapObject> value,
@@ -636,7 +635,6 @@ void SharedFunctionInfo::set_outer_scope_info(Tagged<HeapObject> value,
   DCHECK(!is_compiled());
   DCHECK(IsTheHole(raw_outer_scope_info_or_feedback_metadata()));
   DCHECK(IsScopeInfo(value) || IsTheHole(value));
-  DCHECK(scope_info()->IsEmpty());
   set_raw_outer_scope_info_or_feedback_metadata(value, mode);
 }
 
diff --git a/deps/v8/src/objects/shared-function-info.cc b/deps/v8/src/objects/shared-function-info.cc
index 60470d23c192f2..bbc9d3cd950446 100644
--- a/deps/v8/src/objects/shared-function-info.cc
+++ b/deps/v8/src/objects/shared-function-info.cc
@@ -265,17 +265,6 @@ bool SharedFunctionInfo::HasDebugInfo(Isolate* isolate) const {
   return isolate->debug()->HasDebugInfo(*this);
 }
 
-// Needs to be kept in sync with Scope::UniqueIdInScript and
-// ScopeInfo::UniqueIdInScript.
-int SharedFunctionInfo::UniqueIdInScript() const {
-  // Script scopes start "before" the script to avoid clashing with a scope that
-  // starts on character 0.
-  if (function_literal_id() == kFunctionLiteralIdTopLevel) return -1;
-  // Default constructors have the same start position as their parent class
-  // scope. Use the next char position to distinguish this scope.
-  return StartPosition() + IsDefaultConstructor(kind());
-}
-
 Tagged<DebugInfo> SharedFunctionInfo::GetDebugInfo(Isolate* isolate) const {
   return isolate->debug()->TryGetDebugInfo(*this).value();
 }
diff --git a/deps/v8/src/objects/shared-function-info.h b/deps/v8/src/objects/shared-function-info.h
index 8cd9532234bf37..b8d6a915b4adca 100644
--- a/deps/v8/src/objects/shared-function-info.h
+++ b/deps/v8/src/objects/shared-function-info.h
@@ -597,8 +597,6 @@ class SharedFunctionInfo
 
   inline FunctionKind kind() const;
 
-  int UniqueIdInScript() const;
-
   // Defines the index in a native context of closure's map instantiated using
   // this shared function info.
   DECL_INT_ACCESSORS(function_map_index)
diff --git a/deps/v8/src/wasm/baseline/liftoff-assembler.cc b/deps/v8/src/wasm/baseline/liftoff-assembler.cc
index bee21dfbaaaf45..52e9cfe7c56247 100644
--- a/deps/v8/src/wasm/baseline/liftoff-assembler.cc
+++ b/deps/v8/src/wasm/baseline/liftoff-assembler.cc
@@ -424,29 +424,10 @@ void LiftoffAssembler::DropExceptionValueAtOffset(int offset) {
   cache_state_.stack_state.pop_back();
 }
 
-void LiftoffAssembler::PrepareLoopArgs(int num) {
-  for (int i = 0; i < num; ++i) {
-    VarState& slot = cache_state_.stack_state.end()[-1 - i];
-    if (slot.is_stack()) continue;
-    RegClass rc = reg_class_for(slot.kind());
-    if (slot.is_reg()) {
-      if (cache_state_.get_use_count(slot.reg()) > 1) {
-        // If the register is used more than once, we cannot use it for the
-        // merge. Move it to an unused register instead.
-        LiftoffRegList pinned;
-        pinned.set(slot.reg());
-        LiftoffRegister dst_reg = GetUnusedRegister(rc, pinned);
-        Move(dst_reg, slot.reg(), slot.kind());
-        cache_state_.dec_used(slot.reg());
-        cache_state_.inc_used(dst_reg);
-        slot.MakeRegister(dst_reg);
-      }
-      continue;
-    }
-    LiftoffRegister reg = GetUnusedRegister(rc, {});
-    LoadConstant(reg, slot.constant());
-    slot.MakeRegister(reg);
-    cache_state_.inc_used(reg);
+void LiftoffAssembler::SpillLoopArgs(int num) {
+  for (VarState& slot :
+       base::VectorOf(cache_state_.stack_state.end() - num, num)) {
+    Spill(&slot);
   }
 }
 
@@ -664,14 +645,14 @@ void LiftoffAssembler::Spill(VarState* slot) {
 }
 
 void LiftoffAssembler::SpillLocals() {
-  for (uint32_t i = 0; i < num_locals_; ++i) {
-    Spill(&cache_state_.stack_state[i]);
+  for (VarState& local_slot :
+       base::VectorOf(cache_state_.stack_state.data(), num_locals_)) {
+    Spill(&local_slot);
   }
 }
 
 void LiftoffAssembler::SpillAllRegisters() {
-  for (uint32_t i = 0, e = cache_state_.stack_height(); i < e; ++i) {
-    auto& slot = cache_state_.stack_state[i];
+  for (VarState& slot : cache_state_.stack_state) {
     if (!slot.is_reg()) continue;
     Spill(slot.offset(), slot.reg(), slot.kind());
     slot.MakeStack();
diff --git a/deps/v8/src/wasm/baseline/liftoff-assembler.h b/deps/v8/src/wasm/baseline/liftoff-assembler.h
index 54da02b77918fa..9b109846b50116 100644
--- a/deps/v8/src/wasm/baseline/liftoff-assembler.h
+++ b/deps/v8/src/wasm/baseline/liftoff-assembler.h
@@ -477,9 +477,9 @@ class LiftoffAssembler : public MacroAssembler {
   // the bottom of the stack.
   void DropExceptionValueAtOffset(int offset);
 
-  // Ensure that the loop inputs are either in a register or spilled to the
-  // stack, so that we can merge different values on the back-edge.
-  void PrepareLoopArgs(int num);
+  // Spill all loop inputs to the stack to free registers and to ensure that we
+  // can merge different values on the back-edge.
+  void SpillLoopArgs(int num);
 
   V8_INLINE static int NextSpillOffset(ValueKind kind, int top_spill_offset);
   V8_INLINE int NextSpillOffset(ValueKind kind);
diff --git a/deps/v8/src/wasm/baseline/liftoff-compiler.cc b/deps/v8/src/wasm/baseline/liftoff-compiler.cc
index 87ddcef9b08616..250426abf8de46 100644
--- a/deps/v8/src/wasm/baseline/liftoff-compiler.cc
+++ b/deps/v8/src/wasm/baseline/liftoff-compiler.cc
@@ -1392,7 +1392,7 @@ class LiftoffCompiler {
     // pre-analysis of the function.
     __ SpillLocals();
 
-    __ PrepareLoopArgs(loop->start_merge.arity);
+    __ SpillLoopArgs(loop->start_merge.arity);
 
     // Loop labels bind at the beginning of the block.
     __ bind(loop->label.get());
diff --git a/deps/v8/src/wasm/wasm-js.cc b/deps/v8/src/wasm/wasm-js.cc
index 94f1ae69104f4d..2ed1cdc10678a7 100644
--- a/deps/v8/src/wasm/wasm-js.cc
+++ b/deps/v8/src/wasm/wasm-js.cc
@@ -2453,9 +2453,13 @@ void WebAssemblyPromising(const v8::FunctionCallbackInfo<v8::Value>& info) {
   i::DirectHandle<i::WasmExportedFunctionData> data(
       wasm_exported_function->shared()->wasm_exported_function_data(),
       i_isolate);
+  if (data->instance_data()->module_object()->is_asm_js()) {
+    thrower.TypeError("Argument 0 must be a WebAssembly exported function");
+    return;
+  }
   bool with_suspender_param = false;
-  i::Handle<i::JSFunction> result = NewPromisingWasmExportedFunction(
-      i_isolate, data, thrower, with_suspender_param);
+  i::Handle<i::JSFunction> result =
+      NewPromisingWasmExportedFunction(i_isolate, data, thrower, with_suspender_param);
   info.GetReturnValue().Set(Utils::ToLocal(i::Cast<i::JSObject>(result)));
   return;
 }
diff --git a/deps/v8/test/intl/regress-40855035.js b/deps/v8/test/intl/regress-40855035.js
deleted file mode 100644
index 26a1e2954d2337..00000000000000
--- a/deps/v8/test/intl/regress-40855035.js
+++ /dev/null
@@ -1,6 +0,0 @@
-// Copyright 2024 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-const formatter = new Intl.DateTimeFormat('en-us',{minute: '2-digit'})
-assertEquals("02", formatter.format(new Date(2024, 6, 21, 3, 2, 0)));
diff --git a/deps/v8/test/mjsunit/wasm/stack-switching.js b/deps/v8/test/mjsunit/wasm/stack-switching.js
index 1056c8560006f3..a04ae4abee652a 100644
--- a/deps/v8/test/mjsunit/wasm/stack-switching.js
+++ b/deps/v8/test/mjsunit/wasm/stack-switching.js
@@ -99,6 +99,27 @@ d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
   let wrapper = ToPromising(instance.exports.test);
 })();
 
+(function TestInvalidWrappers() {
+  print(arguments.callee.name);
+  assertThrows(() => WebAssembly.promising({}), TypeError,
+      /Argument 0 must be a function/);
+  assertThrows(() => WebAssembly.promising(() => {}), TypeError,
+      /Argument 0 must be a WebAssembly exported function/);
+  assertThrows(() => WebAssembly.Suspending(() => {}), TypeError,
+      /WebAssembly.Suspending must be invoked with 'new'/);
+  assertThrows(() => new WebAssembly.Suspending({}), TypeError,
+      /Argument 0 must be a function/);
+  function asmModule() {
+    "use asm";
+    function x(v) {
+      v = v | 0;
+    }
+    return x;
+  }
+  assertThrows(() => WebAssembly.promising(asmModule()), TypeError,
+      /Argument 0 must be a WebAssembly exported function/);
+})();
+
 (function TestStackSwitchNoSuspend() {
   print(arguments.callee.name);
   let builder = new WasmModuleBuilder();