deps: update V8 to 6.7.288.43

PR-URL: https://github.com/nodejs/node/pull/19989
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matheus Marchini <matheus@sthima.com>
Reviewed-By: Gus Caplan <me@gus.host>
Reviewed-By: Myles Borins <myles.borins@gmail.com>

14 files changed, 413 insertions, 0 deletions

diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-7508.js b/deps/v8/test/mjsunit/regress/wasm/regress-7508.js
new file mode 100644
index 0000000000..7c07d2d7e3
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-7508.js
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addFunction(undefined, kSig_v_v).addLocals({i64_count: 1}).addBody([
+  kExprI64Const, 0xeb,     0xd7, 0xaf, 0xdf,
+  0xbe,          0xfd,     0xfa, 0xf5, 0x6b,  // i64.const
+  kExprI32Const, 0,                           // i32.const
+  kExprIf,       kWasmI32,                    // if i32
+  kExprI32Const, 0,                           // i32.const
+  kExprElse,                                  // else
+  kExprI32Const, 0,                           // i32.const
+  kExprEnd,                                   // end
+  kExprBrIf,     0,                           // br_if depth=0
+  kExprSetLocal, 0,                           // set_local 0
+]);
+builder.instantiate();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-7565.js b/deps/v8/test/mjsunit/regress/wasm/regress-7565.js
new file mode 100644
index 0000000000..055bfc0c59
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-7565.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+sig0 = makeSig([], [kWasmI32]);
+builder.addFunction(undefined, sig0).addLocals({i64_count: 1}).addBody([
+  kExprLoop, kWasmI32,                    // loop i32
+  kExprF32Const, 0x00, 0x00, 0x00, 0x00,  // f32.const 0      --> f32:0
+  kExprGetLocal, 0x00,                    // get_local 0      --> i64:0
+  kExprF32SConvertI64,                    // f32.sconvert/i64 --> f32:0
+  kExprF32Ge,                             // f32.ge           --> i32:1
+  kExprEnd,                               // end
+]);
+builder.addExport('main', 0);
+const module = builder.instantiate();
+assertEquals(1, module.exports.main());
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-7579.js b/deps/v8/test/mjsunit/regress/wasm/regress-7579.js
new file mode 100644
index 0000000000..40cf12317f
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-7579.js
@@ -0,0 +1,62 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+// Generate function 1 (out of 2).
+sig0 = makeSig([], [kWasmI32]);
+builder.addFunction(undefined, sig0)
+  .addBody([
+    kExprI64Const, 0xc8, 0xda, 0x9c, 0xbc, 0xf8, 0xf0, 0xe1, 0xc3, 0x87, 0x7f,
+    kExprLoop, kWasmF64,
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      kExprCallFunction, 0x01,
+      ...wasmF64Const(0),
+      kExprEnd,
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    kExprCallFunction, 0x01,
+    kExprI64Const, 0xb9, 0xf2, 0xe4, 0x01,
+    kExprI64LtS]);
+// Generate function 2 (out of 2).
+sig1 = makeSig(new Array(12).fill(kWasmF64), []);
+builder.addFunction(undefined, sig1).addBody([]);
+builder.addExport('main', 0);
+const instance = builder.instantiate();
+assertEquals(1, instance.exports.main());
+
+const builder2 = new WasmModuleBuilder();
+sig0 = makeSig([], [kWasmI32]);
+builder2.addFunction(undefined, sig0).addLocals({i64_count: 1}).addBody([
+  kExprLoop, kWasmI32,     // loop i32
+  kExprGetLocal, 0,        // get_local 3
+  kExprF32SConvertI64,     // f32.sconvert/i64
+  kExprI32ReinterpretF32,  // i32.reinterpret/f32
+  kExprEnd                 // end
+]);
+builder2.addExport('main', 0);
+const instance2 = builder2.instantiate();
+assertEquals(0, instance2.exports.main());
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-7582.js b/deps/v8/test/mjsunit/regress/wasm/regress-7582.js
new file mode 100644
index 0000000000..476a0e18e8
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-7582.js
@@ -0,0 +1,48 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addGlobal(kWasmI32, 1);
+sig0 = makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]);
+builder.addFunction(undefined, sig0)
+  .addBody([
+kExprF32Const, 0x01, 0x00, 0x00, 0x00,
+kExprF32Const, 0x00, 0x00, 0x00, 0x00,
+kExprF32Eq,  // --> i32:0
+kExprF32Const, 0xc9, 0xc9, 0x69, 0xc9,
+kExprF32Const, 0xc9, 0xc9, 0xc9, 0x00,
+kExprF32Eq,  // --> i32:0 i32:0
+kExprIf, kWasmF32,
+  kExprF32Const, 0x00, 0x00, 0x00, 0x00,
+kExprElse,   // @32
+  kExprF32Const, 0x00, 0x00, 0x00, 0x00,
+  kExprEnd,   // --> i32:0 f32:0
+kExprF32Const, 0xc9, 0x00, 0x00, 0x00,
+kExprF32Const, 0xc9, 0xc9, 0xc9, 0x00,
+kExprF32Const, 0xc9, 0xc9, 0xa0, 0x00, // --> i32:0 f32:0 f32 f32 f32
+kExprF32Eq,  // --> i32:0 f32:0 f32 i32:0
+kExprIf, kWasmF32,
+  kExprF32Const, 0x00, 0x00, 0x00, 0x00,
+kExprElse,
+  kExprF32Const, 0x00, 0x00, 0x00, 0x00,
+  kExprEnd,  // --> i32:0 f32:0 f32 f32:0
+kExprF32Eq,  // --> i32:0 f32:0 i32:0
+kExprIf, kWasmF32,
+  kExprF32Const, 0x00, 0x00, 0x00, 0x00,
+kExprElse,
+  kExprF32Const, 0x00, 0x00, 0x00, 0x00,
+  kExprEnd,   // --> i32:0 f32:0 f32:0
+kExprF32Const, 0xc9, 0xc9, 0xff, 0xff,  // --> i32:0 f32:0 f32:0 f32
+kExprF32Eq,  // --> i32:0 f32:0 i32:0
+kExprDrop,
+kExprDrop, // --> i32:0
+kExprI32Const, 1, // --> i32:0 i32:1
+kExprI32GeU,  // --> i32:0
+          ]);
+builder.addExport('main', 0);
+const instance = builder.instantiate();
+assertEquals(0, instance.exports.main(1, 2, 3));
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-769637.js b/deps/v8/test/mjsunit/regress/wasm/regress-769637.js
new file mode 100644
index 0000000000..c2e783014a
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-769637.js
@@ -0,0 +1,17 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+let builder = new WasmModuleBuilder();
+builder
+    .addMemory()
+    .addFunction("main", kSig_v_v)
+    .addBody([kExprI32Const, 4,
+              kExprI32Const, 8,
+              kExprI32StoreMem, 0, 16])
+    .exportAs("main");
+let instance = builder.instantiate();
+assertTraps(kTrapMemOutOfBounds, instance.exports.main);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-808848.js b/deps/v8/test/mjsunit/regress/wasm/regress-808848.js
new file mode 100644
index 0000000000..28c57ec340
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-808848.js
@@ -0,0 +1,67 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+// The number of locals must be greater than the constant defined here:
+// https://cs.chromium.org/chromium/src/v8/src/compiler/x64/code-generator-x64.cc?l=3146
+const kNumLocals = 128;
+
+function varuint32(val) {
+  let bytes = [];
+  for (let i = 0; i < 4; ++i) {
+    bytes.push(0x80 | ((val >> (7 * i)) & 0x7f));
+  }
+  bytes.push((val >> (7 * 4)) & 0x7f);
+  return bytes;
+}
+
+// Generate a function that calls the "get" import `kNumLocals` times, and
+// stores each result in a local, then calls the "call" import `kNumLocals`
+// times with the stored local values.
+//
+// The intention is to create a function that has a large stack frame.
+let body = [];
+
+for (let i = 0; i < kNumLocals; ++i) {
+  body.push(kExprCallFunction, 0, kExprSetLocal, ...varuint32(i));
+}
+
+for (let i = 0; i < kNumLocals; ++i) {
+  body.push(kExprGetLocal, ...varuint32(i), kExprCallFunction, 1);
+}
+
+let builder = new WasmModuleBuilder();
+builder.addImport('mod', 'get', kSig_i_v);
+builder.addImport('mod', 'call', kSig_v_i);
+builder.
+  addFunction('main', kSig_v_v).
+  addLocals({i32_count: kNumLocals}).
+  addBody(body).
+  exportAs('main');
+let m1_bytes = builder.toBuffer();
+let m1 = new WebAssembly.Module(m1_bytes);
+
+// Serialize the module and postMessage it to another thread.
+let serialized_m1 = %SerializeWasmModule(m1);
+
+let workerScript =
+  `onmessage = function(msg) {
+    let {serialized_m1, m1_bytes} = msg;
+
+    let m1_clone = %DeserializeWasmModule(serialized_m1, m1_bytes);
+    let imports = {mod: {get: () => 3, call: () => {}}};
+    let i2 = new WebAssembly.Instance(m1_clone, imports);
+    i2.exports.main();
+    postMessage('done');
+  }`;
+
+let worker = new Worker(workerScript);
+worker.postMessage({serialized_m1, m1_bytes});
+
+// Wait for worker to finish.
+print(worker.getMessage());
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-817380.js b/deps/v8/test/mjsunit/regress/wasm/regress-817380.js
new file mode 100644
index 0000000000..e6047ea231
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-817380.js
@@ -0,0 +1,25 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-lazy-compilation
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder1 = new WasmModuleBuilder();
+builder1.addFunction('mul', kSig_i_ii)
+    .addBody([kExprGetLocal, 0, kExprGetLocal, 1, kExprI32Mul])
+    .exportFunc();
+const mul = builder1.instantiate().exports.mul;
+const table = new WebAssembly.Table({
+  element: 'anyfunc',
+  initial: 10,
+});
+const builder2 = new WasmModuleBuilder();
+const mul_import = builder2.addImport('q', 'wasm_mul', kSig_i_ii);
+builder2.addImportedTable('q', 'table');
+const glob_import = builder2.addImportedGlobal('q', 'glob', kWasmI32);
+builder2.addFunctionTableInit(glob_import, true, [mul_import]);
+builder2.instantiate(
+    {q: {glob: 0, js_div: i => i, wasm_mul: mul, table: table}});
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-820802.js b/deps/v8/test/mjsunit/regress/wasm/regress-820802.js
new file mode 100644
index 0000000000..224a2260f5
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-820802.js
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(16, 32);
+builder.addGlobal(kWasmI32, 0);
+const sig0 = makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]);
+builder.addFunction(undefined, sig0).addBody([
+  kExprI32Const, 1,  // i32.const 1
+  kExprI32Const, 0,  // i32.const 0
+  kExprI32Const, 3,  // i32.const 3
+  kExprI32GeU,       // i32.ge_u
+  kExprI32Rol,       // i32.rol
+]);
+builder.addExport('main', 0);
+const instance = builder.instantiate();
+assertEquals(1, instance.exports.main());
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-824681.js b/deps/v8/test/mjsunit/regress/wasm/regress-824681.js
new file mode 100644
index 0000000000..18ca3d0b5d
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-824681.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+let chain = Promise.resolve();
+const builder = new WasmModuleBuilder();
+for (let i = 0; i < 50; ++i) {
+  builder.addFunction('fun' + i, kSig_i_v)
+      .addBody([...wasmI32Const(i)])
+      .exportFunc();
+}
+const buffer = builder.toBuffer();
+for (let i = 0; i < 100; ++i) {
+  chain = chain.then(() => WebAssembly.instantiate(buffer));
+}
+chain.then(({module, instance}) => instance.exports.fun1155())
+    .then(res => print('Result of executing fun1155: ' + res));
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-825087a.js b/deps/v8/test/mjsunit/regress/wasm/regress-825087a.js
new file mode 100644
index 0000000000..a1f9a1bea8
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-825087a.js
@@ -0,0 +1,9 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+PAGES = 10;
+memory = new WebAssembly.Memory({initial: PAGES});
+buffer = memory.buffer;
+memory.grow();
+WebAssembly.validate(buffer);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-825087b.js b/deps/v8/test/mjsunit/regress/wasm/regress-825087b.js
new file mode 100644
index 0000000000..699549d429
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-825087b.js
@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+PAGES = 10;
+memory = new WebAssembly.Memory({initial: PAGES});
+buffer = memory.buffer;
+buffer = new Uint8Array(buffer);
+memory.grow();
+WebAssembly.validate(buffer);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-827806.js b/deps/v8/test/mjsunit/regress/wasm/regress-827806.js
new file mode 100644
index 0000000000..c06e0fae96
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-827806.js
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+try {
+  (function () {
+    let m = new WasmModuleBuilder();
+    m.addFunction("sub", kSig_i_ii)
+    m.instantiate();
+  })();
+} catch (e) {
+  console.info("caught exception");
+  console.info(e);
+}
+for (let i = 0; i < 150; i++) {
+  var m = new WasmModuleBuilder();
+  m.addMemory(2);
+  m.instantiate();
+}
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-831463.js b/deps/v8/test/mjsunit/regress/wasm/regress-831463.js
new file mode 100644
index 0000000000..65d1213dd0
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-831463.js
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-interpret-all
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+const builder = new WasmModuleBuilder();
+const sig = builder.addType(kSig_i_i);
+builder.addFunction('call', kSig_i_v)
+    .addBody([
+      kExprI32Const, 0, kExprI32Const, 0, kExprCallIndirect, sig, kTableZero
+    ])
+    .exportAs('call');
+builder.addImportedTable('imp', 'table');
+const table = new WebAssembly.Table({element: 'anyfunc', initial: 1});
+const instance = builder.instantiate({imp: {table: table}});
+assertThrows(
+    () => instance.exports.call(), WebAssembly.RuntimeError,
+    /function signature mismatch/);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-834619.js b/deps/v8/test/mjsunit/regress/wasm/regress-834619.js
new file mode 100644
index 0000000000..5ddc9dd9c4
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-834619.js
@@ -0,0 +1,49 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-lazy-compilation
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function ExportedFunctionsImportedOrder() {
+  print(arguments.callee.name);
+
+  let i1 = (() => {
+    let builder = new WasmModuleBuilder();
+    builder.addFunction("f1", kSig_i_v)
+      .addBody(
+        [kExprI32Const, 1])
+      .exportFunc();
+    builder.addFunction("f2", kSig_i_v)
+      .addBody(
+        [kExprI32Const, 2])
+      .exportFunc();
+    return builder.instantiate();
+  })();
+
+  let i2 = (() => {
+    let builder = new WasmModuleBuilder();
+    builder.addImport("q", "f2", kSig_i_v);
+    builder.addImport("q", "f1", kSig_i_v);
+    builder.addFunction("main", kSig_i_i)
+      .addBody([
+        kExprGetLocal, 0,
+        kExprCallIndirect, 0, kTableZero
+      ])
+      .exportFunc();
+    builder.addFunctionTableInit(0, false, [0, 1, 1, 0]);
+
+    return builder.instantiate({q: {f2: i1.exports.f2, f1: i1.exports.f1}});
+  })();
+
+  print("--->calling 0");
+  assertEquals(2, i2.exports.main(0));
+  print("--->calling 1");
+  assertEquals(1, i2.exports.main(1));
+  print("--->calling 2");
+  assertEquals(1, i2.exports.main(2));
+  print("--->calling 3");
+  assertEquals(2, i2.exports.main(3));
+})();