deps: update V8 to 7.0.276.20

PR-URL: https://github.com/nodejs/node/pull/22754
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Refael Ackermann <refack@gmail.com>
Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

4 files changed, 112 insertions, 1 deletions

diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-776677.js b/deps/v8/test/mjsunit/regress/wasm/regress-776677.js
index 1b2357dcf2..87bf8fac7e 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-776677.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-776677.js
@@ -16,7 +16,7 @@ function module(stdlib,foreign,buffer) {
 
 var global = {Uint32Array:Uint32Array};
 var env = {};
-memory = new WebAssembly.Memory({initial:200});
+memory = new WebAssembly.Memory({initial:128});
 var buffer = memory.buffer;
 evil_f = module(global,env,buffer);
 
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-8059.js b/deps/v8/test/mjsunit/regress/wasm/regress-8059.js
new file mode 100644
index 0000000000..5c421c4ee4
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-8059.js
@@ -0,0 +1,42 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-wasm-disable-structured-cloning
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function TestPostModule() {
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("add", kSig_i_ii)
+    .addBody([kExprGetLocal, 0, kExprGetLocal, 1, kExprI32Add])
+    .exportFunc();
+
+  let module = builder.toModule();
+
+  let workerScript = `
+    onmessage = function(module) {
+      try {
+        let instance = new WebAssembly.Instance(module);
+        let result = instance.exports.add(40, 2);
+        postMessage(result);
+      } catch(e) {
+        postMessage('ERROR: ' + e);
+      }
+    }
+  `;
+
+  let realm = Realm.create();
+  Realm.shared = { m:module, s:workerScript };
+
+  let realmScript = `
+    let worker = new Worker(Realm.shared.s);
+    worker.postMessage(Realm.shared.m);
+    let message = worker.getMessage();
+    worker.terminate();
+    message;
+  `;
+  let message = Realm.eval(realm, realmScript);
+  assertEquals(42, message);
+})();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-873600.js b/deps/v8/test/mjsunit/regress/wasm/regress-873600.js
new file mode 100644
index 0000000000..b3f2d739a2
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-873600.js
@@ -0,0 +1,50 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function DoTest() {
+
+  var stdlib = this;
+  try {
+    var buffer = new ArrayBuffer((2097120) * 1024);
+  } catch (e) {
+    // Out of memory: soft pass because 2GiB is actually a lot!
+    print("OOM: soft pass");
+    return;
+  }
+  var foreign = {}
+
+  var m = (function Module(stdlib, foreign, heap) {
+    "use asm";
+    var MEM16 = new stdlib.Int16Array(heap);
+    function load(i) {
+      i = i|0;
+      i = MEM16[i >> 1]|0;
+      return i | 0;
+    }
+    function store(i, v) {
+      i = i|0;
+      v = v|0;
+      MEM16[i >> 1] = v;
+    }
+    function load8(i) {
+      i = i|0;
+      i = MEM16[i + 8 >> 1]|0;
+      return i | 0;
+    }
+    function store8(i, v) {
+      i = i|0;
+      v = v|0;
+      MEM16[i + 8 >> 1] = v;
+    }
+    return { load: load, store: store, load8: load8, store8: store8 };
+  })(stdlib, foreign, buffer);
+
+  assertEquals(0, m.load(-8));
+  assertEquals(0, m.load8(-16));
+  m.store(2014, 2, 30, 1, 0);
+  assertEquals(0, m.load8(-8));
+  m.store8(-8, 99);
+  assertEquals(99, m.load(0));
+  assertEquals(99, m.load8(-8));
+})();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-875556.js b/deps/v8/test/mjsunit/regress/wasm/regress-875556.js
new file mode 100644
index 0000000000..e1ea426f87
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-875556.js
@@ -0,0 +1,19 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+// Flags: --expose-wasm --experimental-wasm-mv
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function() {
+  const builder = new WasmModuleBuilder();
+  // Generate function 1 (out of 2).
+  sig1 = makeSig([kWasmI32], []);
+  builder.addFunction("main", sig1).addBodyWithEnd([
+    // signature: v_i
+    // body:
+    kExprBlock,
+  ]);
+  assertThrows(function() { builder.instantiate(); }, WebAssembly.CompileError);
+})();