deps: V8: cherry-pick 7d5eb1df2a72

Backport the Maglev HeapNumber materialization fix to V8 13.6.
Emit a captured HeapNumber with its map and constant numeric value,
using the existing deoptimizer to allocate a fresh box. Reserve a
nonduplicatable object ID for each box. Keep the literal-number helper
for fixed double arrays and captured-object numeric values. No virtual
object slot traversal changes or prerequisite commits are needed.
This mirrors the existing V8 13.6 Turbolev map/value materialization.

Original commit message:

    [maglev] Materialize a fresh HeapNumber per deoptimization

    This matches what Turbolev graph builder already does to Maglev.

    Fixed: 547819997
    Change-Id: Iafc1185ef96db8816db36b295a3a4b7e528f9863
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8255554
    Reviewed-by: Leszek Swirski <leszeks@chromium.org>
    Commit-Queue: Victor Gomes <victorgomes@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#109347}

Refs: v8/v8@7d5eb1d
Refs: #66457
Refs: https://www.cve.org/CVERecord?id=CVE-2026-85045
Signed-off-by: inoway46 <inoueyuya416@gmail.com>
Assisted-by: Codex

Author: inoway46

common.gypi

@@ -42,7 +42,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.54',
+    'v8_embedder_string': '-node.55',
 
     ##### V8 defaults for Node.js #####
 

deps/v8/src/maglev/maglev-code-generator.cc

@@ -1466,6 +1466,11 @@ class MaglevFrameTranslationBuilder {
     return kNotDuplicated;
   }
 
+  int CreateUnduplicatableId() {
+    object_ids_.push_back(kNotDuplicated);
+    return kNotDuplicated;
+  }
+
   void BuildHeapNumber(Float64 number) {
     DirectHandle<Object> value =
         local_isolate_->factory()->NewHeapNumberFromBits<AllocationType::kOld>(
@@ -1535,11 +1540,12 @@ class MaglevFrameTranslationBuilder {
   void BuildVirtualObject(const VirtualObject* object,
                           const InputLocation*& input_location,
                           const VirtualObjectList& virtual_objects) {
-    if (object->type() == VirtualObject::kHeapNumber) {
-      return BuildHeapNumber(object->number());
-    }
+    // HeapNumbers may be mutable object fields; each materialization must
+    // create a fresh box, so they are never deduplicated.
     int dup_id =
-        GetDuplicatedId(reinterpret_cast<intptr_t>(object->allocation()));
+        object->type() == VirtualObject::kHeapNumber
+            ? CreateUnduplicatableId()
+            : GetDuplicatedId(reinterpret_cast<intptr_t>(object->allocation()));
     if (dup_id != kNotDuplicated) {
       translation_array_builder_->DuplicateObject(dup_id);
       object->ForEachNestedRuntimeInput(virtual_objects,
@@ -1548,8 +1554,11 @@ class MaglevFrameTranslationBuilder {
     }
     switch (object->type()) {
       case VirtualObject::kHeapNumber:
-        // Handled above.
-        UNREACHABLE();
+        translation_array_builder_->BeginCapturedObject(2);
+        translation_array_builder_->StoreLiteral(
+            GetDeoptLiteral(*object->map().object()));
+        BuildHeapNumber(object->number());
+        return;
       case VirtualObject::kConsString:
         return BuildConsString(object, input_location, virtual_objects);
       case VirtualObject::kFixedDoubleArray:
@@ -1699,7 +1708,7 @@ class MaglevFrameTranslationBuilder {
   IdentityMap<int, base::DefaultAllocationPolicy>* protected_deopt_literals_;
   IdentityMap<int, base::DefaultAllocationPolicy>* deopt_literals_;
 
-  static const int kNotDuplicated = -1;
+  static constexpr int kNotDuplicated = -1;
   std::vector<intptr_t> object_ids_;
 };
 

deps/v8/test/mjsunit/maglev/regress-547819997.js

@@ -0,0 +1,38 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev
+
+const boxes = [];
+
+// Never called during warm-up, so this call site has no feedback and Maglev
+// emits an unconditional deopt for it. The literal below is therefore only
+// used by deopt frames and gets elided by escape analysis.
+function sink(o) {
+  boxes.push(o);
+}
+
+function foo(depth, take) {
+  const o = {x: 1.5};
+  if (depth > 0) foo(depth - 1, take);
+  if (take) sink(o);
+}
+
+%PrepareFunctionForOptimization(foo);
+foo(3, false);
+foo(3, false);
+%OptimizeMaglevOnNextCall(foo);
+foo(3, false);
+
+// Deopts the innermost activation eagerly and the outer ones lazily, so every
+// activation materializes its own object.
+foo(3, true);
+
+assertEquals(4, boxes.length);
+for (let i = 0; i < boxes.length; i++) {
+  boxes[i].x = i;
+}
+for (let i = 0; i < boxes.length; i++) {
+  assertEquals(i, boxes[i].x);
+}