From b415a93cf78b0f0f8b25b4a23f43cda09ca60de3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C3=ABl=20Zasso?= <targos@protonmail.com>
Date: Thu, 8 Mar 2018 10:19:35 +0100
Subject: [PATCH 1/2] deps: allow disabling V8 untrusted code mitigations

Add a GYP flag similar to the one defined in BUILD.gn.
---
 common.gypi                    | 2 +-
 deps/v8/gypfiles/features.gypi | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/common.gypi b/common.gypi
index a3aeff7e03d480..b2fa7874c26897 100644
--- a/common.gypi
+++ b/common.gypi
@@ -27,7 +27,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.4',
+    'v8_embedder_string': '-node.5',
 
     # Enable disassembler for `--print-code` v8 options
     'v8_enable_disassembler': 1,
diff --git a/deps/v8/gypfiles/features.gypi b/deps/v8/gypfiles/features.gypi
index d285ee21da579f..8c99b4f0866ce0 100644
--- a/deps/v8/gypfiles/features.gypi
+++ b/deps/v8/gypfiles/features.gypi
@@ -89,6 +89,9 @@
 
     # Controls the threshold for on-heap/off-heap Typed Arrays.
     'v8_typed_array_max_size_in_heap%': 64,
+
+    # Enable mitigations for executing untrusted code.
+    'v8_untrusted_code_mitigations%': 'true',
   },
   'target_defaults': {
     'conditions': [
@@ -143,6 +146,9 @@
       ['v8_enable_concurrent_marking==1', {
         'defines': ['V8_CONCURRENT_MARKING',],
       }],
+      ['v8_untrusted_code_mitigations=="false"', {
+        'defines': ['DISABLE_UNTRUSTED_CODE_MITIGATIONS',],
+      }],
     ],  # conditions
     'configurations': {
       'DebugBaseCommon': {

From df2a9074d665b5b625ed3558f184339847c3dcff Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C3=ABl=20Zasso?= <targos@protonmail.com>
Date: Thu, 8 Mar 2018 10:24:43 +0100
Subject: [PATCH 2/2] build: disable V8 untrusted code mitigations

Refs: https://github.com/v8/v8/wiki/Untrusted-code-mitigations
---
 common.gypi                                    |  4 ++++
 .../test-v8-untrusted-code-mitigations.js      | 18 ++++++++++++++++++
 2 files changed, 22 insertions(+)
 create mode 100644 test/parallel/test-v8-untrusted-code-mitigations.js

diff --git a/common.gypi b/common.gypi
index b2fa7874c26897..2d2bc4f5d5664e 100644
--- a/common.gypi
+++ b/common.gypi
@@ -35,6 +35,10 @@
     # Don't bake anything extra into the snapshot.
     'v8_use_external_startup_data%': 0,
 
+    # Disable V8 untrusted code mitigations.
+    # See https://github.com/v8/v8/wiki/Untrusted-code-mitigations
+    'v8_untrusted_code_mitigations': 'false',
+
     # Some STL containers (e.g. std::vector) do not preserve ABI compatibility
     # between debug and non-debug mode.
     'disable_glibcxx_debug': 1,
diff --git a/test/parallel/test-v8-untrusted-code-mitigations.js b/test/parallel/test-v8-untrusted-code-mitigations.js
new file mode 100644
index 00000000000000..c9d89cd5a66e18
--- /dev/null
+++ b/test/parallel/test-v8-untrusted-code-mitigations.js
@@ -0,0 +1,18 @@
+'use strict';
+
+require('../common');
+const assert = require('assert');
+const { execFileSync } = require('child_process');
+
+// This test checks that untrusted code mitigations in V8 are disabled
+// by default.
+
+const v8Options = execFileSync(process.execPath, ['--v8-options']).toString();
+
+const untrustedFlag = v8Options.indexOf('--untrusted-code-mitigations');
+assert.notStrictEqual(untrustedFlag, -1);
+
+const nextFlag = v8Options.indexOf('--', untrustedFlag + 2);
+const slice = v8Options.substring(untrustedFlag, nextFlag);
+
+assert(slice.match(/type: bool  default: false/));