deps: update V8 to 7.6.303.28

PR-URL: https://github.com/nodejs/node/pull/28016
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Refael Ackermann (רפאל פלחי) <refack@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>

8 files changed, 171 insertions, 0 deletions

diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-834619.js b/deps/v8/test/mjsunit/regress/wasm/regress-834619.js
index cfa6e7bb3b..1062d5547a 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-834619.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-834619.js
@@ -26,6 +26,7 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
     let builder = new WasmModuleBuilder();
     builder.addImport("q", "f2", kSig_i_v);
     builder.addImport("q", "f1", kSig_i_v);
+    builder.addTable(kWasmAnyFunc, 4);
     builder.addFunction("main", kSig_i_i)
       .addBody([
         kExprGetLocal, 0,
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-9017.js b/deps/v8/test/mjsunit/regress/wasm/regress-9017.js
new file mode 100644
index 0000000000..7a8930a146
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-9017.js
@@ -0,0 +1,38 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --liftoff --nowasm-tier-up
+//
+// This test is intended to make Liftoff generate code that uses a very large
+// stack frame, and then try to call another function (which would write to the
+// stack pointer location). On Windows, large frames need extra code to touch
+// every page in order, because the OS only leaves a small guard area for the
+// stack, and trying to access past that area, even into memory that was
+// intentionally reserved for this thread's stack, will crash the program.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+
+var func_idx = builder.addFunction('helper', kSig_i_v)
+    .addLocals({i32_count: 1})
+    .addBody([
+        kExprI32Const, 0x01,
+    ]).index;
+
+var large_function_body = [];
+const num_temporaries = 16 * 1024;
+for (let i = 0; i < num_temporaries; ++i) {
+  large_function_body.push(kExprCallFunction, func_idx);
+}
+for (let i = 1; i < num_temporaries; ++i) {
+  large_function_body.push(kExprI32Add);
+}
+
+builder.addFunction('test', kSig_i_v)
+    .addBody(large_function_body)
+    .exportFunc();
+var module = builder.instantiate();
+
+assertEquals(num_temporaries, module.exports.test());
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-952342.js b/deps/v8/test/mjsunit/regress/wasm/regress-952342.js
new file mode 100644
index 0000000000..eb81f5a9c6
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-952342.js
@@ -0,0 +1,18 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const memory = new WebAssembly.Memory({initial: 1});
+
+let builder = new WasmModuleBuilder();
+builder.addImportedMemory("imports", "mem", 1);
+builder.addFunction("copy", kSig_v_iii)
+       .addBody([kExprGetLocal, 0, // dst
+                 kExprGetLocal, 1, // src
+                 kExprGetLocal, 2, // size
+                 kNumericPrefix, kExprMemoryCopy, 0, 0]).exportAs("copy");
+let instance = builder.instantiate({imports: {mem: memory}});
+memory.grow(1);
+instance.exports.copy(0, kPageSize, 11);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-956771.js b/deps/v8/test/mjsunit/regress/wasm/regress-956771.js
new file mode 100644
index 0000000000..3fac6c871b
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-956771.js
@@ -0,0 +1,28 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-lazy-compilation
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function testLazyModuleAsyncCompilation() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("some", kSig_i_ii)
+  assertPromiseResult(WebAssembly.compile(builder.toBuffer())
+    .then(assertUnreachable,
+          error => assertEquals("WebAssembly.compile(): function body must " +
+                                "end with \"end\" opcode @+26",
+                                error.message)));
+})();
+
+(function testLazyModuleSyncCompilation() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("some", kSig_i_ii)
+  assertThrows(() => builder.toModule(),
+               WebAssembly.CompileError,
+               "WebAssembly.Module(): Compiling function #0:\"some\" failed: " +
+               "function body must end with \"end\" opcode @+26");
+})();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-956771b.js b/deps/v8/test/mjsunit/regress/wasm/regress-956771b.js
new file mode 100644
index 0000000000..1c819cb49d
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-956771b.js
@@ -0,0 +1,19 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-lazy-compilation --wasm-test-streaming
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function testLazyModuleStreamingCompilation() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("some", kSig_i_ii);
+  let bytes = builder.toBuffer();
+  assertPromiseResult(WebAssembly.compileStreaming(Promise.resolve(bytes))
+    .then(assertUnreachable,
+          error => assertEquals("WebAssembly.compileStreaming(): function " +
+                                "body must end with \"end\" opcode @+26",
+                                error.message)));
+})();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-957405.js b/deps/v8/test/mjsunit/regress/wasm/regress-957405.js
new file mode 100644
index 0000000000..a83104297e
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-957405.js
@@ -0,0 +1,20 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const memory = new WebAssembly.Memory({initial: 1});
+
+let builder = new WasmModuleBuilder();
+builder.addImportedMemory("imports", "mem");
+builder.addFunction("fill", kSig_v_iii)
+       .addBody([kExprGetLocal, 0, // dst
+                 kExprGetLocal, 1, // value
+                 kExprGetLocal, 2, // size
+                 kNumericPrefix, kExprMemoryFill, 0]).exportAs("fill");
+let instance = builder.instantiate({imports: {mem: memory}});
+memory.grow(1);
+assertTraps(
+    kTrapMemOutOfBounds,
+    () => instance.exports.fill(kPageSize + 1, 123, kPageSize));
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-961129.js b/deps/v8/test/mjsunit/regress/wasm/regress-961129.js
new file mode 100644
index 0000000000..7a4903a66a
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-961129.js
@@ -0,0 +1,18 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+%EnableCodeLoggingForTesting();
+
+function module() {
+  "use asm";
+  function f() {
+    var i = 4;
+    return i | 0;
+  }
+  return {f: f};
+}
+
+module().f();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-964607.js b/deps/v8/test/mjsunit/regress/wasm/regress-964607.js
new file mode 100644
index 0000000000..0a6d7628c6
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-964607.js
@@ -0,0 +1,29 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --experimental-wasm-anyref
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+let builder = new WasmModuleBuilder();
+
+builder.addImportedTable('ffi', 't1', 5, 5, kWasmAnyFunc);
+builder.addImportedTable('ffi', 't2', 9, 9, kWasmAnyFunc);
+
+builder.addFunction('foo', kSig_v_v).addBody([]).exportFunc();
+
+let module = builder.toModule();
+let table1 =
+    new WebAssembly.Table({element: 'anyfunc', initial: 5, maximum: 5});
+
+let table2 =
+    new WebAssembly.Table({element: 'anyfunc', initial: 9, maximum: 9});
+
+let instance =
+    new WebAssembly.Instance(module, {ffi: {t1: table1, t2: table2}});
+let table3 =
+    new WebAssembly.Table({element: 'anyfunc', initial: 9, maximum: 9});
+
+table3.set(8, instance.exports.foo);
+new WebAssembly.Instance(module, {ffi: {t1: table1, t2: table3}});