From 37e60b37bf0c095a875e6fb52b7ab0bc57c9c6b8 Mon Sep 17 00:00:00 2001
From: Myles Borins <mylesborins@google.com>
Date: Sun, 18 Mar 2018 16:47:02 -0400
Subject: [PATCH] deps: patch V8 to 6.5.254.41

Refs: https://github.com/v8/v8/compare/6.5.254.40...6.5.254.41
---
 deps/v8/include/v8-version.h                  |  2 +-
 deps/v8/src/compiler/escape-analysis.cc       |  4 +---
 .../mjsunit/compiler/escape-analysis-18.js    | 23 +++++++++++++++++++
 3 files changed, 25 insertions(+), 4 deletions(-)
 create mode 100644 deps/v8/test/mjsunit/compiler/escape-analysis-18.js

diff --git a/deps/v8/include/v8-version.h b/deps/v8/include/v8-version.h
index 133ee1f3f1ba76..dbc6b6af8c038f 100644
--- a/deps/v8/include/v8-version.h
+++ b/deps/v8/include/v8-version.h
@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 6
 #define V8_MINOR_VERSION 5
 #define V8_BUILD_NUMBER 254
-#define V8_PATCH_LEVEL 40
+#define V8_PATCH_LEVEL 41
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)
diff --git a/deps/v8/src/compiler/escape-analysis.cc b/deps/v8/src/compiler/escape-analysis.cc
index 4b773136a929a3..984c5133968421 100644
--- a/deps/v8/src/compiler/escape-analysis.cc
+++ b/deps/v8/src/compiler/escape-analysis.cc
@@ -623,9 +623,7 @@ void ReduceNode(const Operator* op, EscapeAnalysisTracker::Scope* current,
       break;
     }
     case IrOpcode::kTypeGuard: {
-      // The type-guard is re-introduced in the final reducer if the types
-      // don't match.
-      current->SetReplacement(current->ValueInput(0));
+      current->SetVirtualObject(current->ValueInput(0));
       break;
     }
     case IrOpcode::kReferenceEqual: {
diff --git a/deps/v8/test/mjsunit/compiler/escape-analysis-18.js b/deps/v8/test/mjsunit/compiler/escape-analysis-18.js
new file mode 100644
index 00000000000000..f2ff08299fe9d8
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/escape-analysis-18.js
@@ -0,0 +1,23 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-escape
+
+function bar(arr) {
+    var x = 0;
+    arr.forEach(function(el) {
+        x = el;
+    });
+    return x;
+}
+
+function foo(array) {
+    return bar(array);
+}
+
+let array = [,.5,];
+foo(array);
+foo(array);
+%OptimizeFunctionOnNextCall(foo);
+foo(array);