deps: update V8 to 6.4.388.40

PR-URL: https://github.com/nodejs/node/pull/17489
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com>

70 files changed, 385 insertions, 6 deletions

diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-02256.js b/deps/v8/test/mjsunit/regress/wasm/regress-02256.js
index 3b9b76b5a6..3b9b76b5a6 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-02256.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-02256.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-02256b.js b/deps/v8/test/mjsunit/regress/wasm/regress-02256b.js
index 120643896d..120643896d 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-02256b.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-02256b.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-02862.js b/deps/v8/test/mjsunit/regress/wasm/regress-02862.js
index 92ed1cd6c9..92ed1cd6c9 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-02862.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-02862.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-5531.js b/deps/v8/test/mjsunit/regress/wasm/regress-5531.js
index 1363f96264..1363f96264 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-5531.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-5531.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-5800.js b/deps/v8/test/mjsunit/regress/wasm/regress-5800.js
index 2e56da853d..2e56da853d 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-5800.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-5800.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-5884.js b/deps/v8/test/mjsunit/regress/wasm/regress-5884.js
index 8677f105ee..8677f105ee 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-5884.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-5884.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-6054.js b/deps/v8/test/mjsunit/regress/wasm/regress-6054.js
index 7b309b6f82..7b309b6f82 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-6054.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-6054.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-6164.js b/deps/v8/test/mjsunit/regress/wasm/regress-6164.js
index 3035ea5249..3035ea5249 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-6164.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-6164.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-643595.js b/deps/v8/test/mjsunit/regress/wasm/regress-643595.js
index 9da074b689..9da074b689 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-643595.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-643595.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-644682.js b/deps/v8/test/mjsunit/regress/wasm/regress-644682.js
index b58c0d9b10..b58c0d9b10 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-644682.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-644682.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-647649.js b/deps/v8/test/mjsunit/regress/wasm/regress-647649.js
index dc89ebd845..dc89ebd845 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-647649.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-647649.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-648079.js b/deps/v8/test/mjsunit/regress/wasm/regress-648079.js
index acc6146ef5..acc6146ef5 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-648079.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-648079.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-651961.js b/deps/v8/test/mjsunit/regress/wasm/regress-651961.js
index 30f6565d32..30f6565d32 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-651961.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-651961.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-654377.js b/deps/v8/test/mjsunit/regress/wasm/regress-654377.js
index 871da72114..871da72114 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-654377.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-654377.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-663994.js b/deps/v8/test/mjsunit/regress/wasm/regress-663994.js
index da3d7c7771..da3d7c7771 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-663994.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-663994.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-666741.js b/deps/v8/test/mjsunit/regress/wasm/regress-666741.js
index 9531fc8fd2..9531fc8fd2 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-666741.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-666741.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-667745.js b/deps/v8/test/mjsunit/regress/wasm/regress-667745.js
index 68c880303b..68c880303b 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-667745.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-667745.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-670683.js b/deps/v8/test/mjsunit/regress/wasm/regress-670683.js
index 7306e117f4..7306e117f4 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-670683.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-670683.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-674447.js b/deps/v8/test/mjsunit/regress/wasm/regress-674447.js
index 228b038334..228b038334 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-674447.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-674447.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-680938.js b/deps/v8/test/mjsunit/regress/wasm/regress-680938.js
index 75c8a457bb..75c8a457bb 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-680938.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-680938.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-684858.js b/deps/v8/test/mjsunit/regress/wasm/regress-684858.js
index bfef7fcc8e..bfef7fcc8e 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-684858.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-684858.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-688876.js b/deps/v8/test/mjsunit/regress/wasm/regress-688876.js
index 83bebbb802..83bebbb802 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-688876.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-688876.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-689450.js b/deps/v8/test/mjsunit/regress/wasm/regress-689450.js
index 9a4989c633..9a4989c633 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-689450.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-689450.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-6931.js b/deps/v8/test/mjsunit/regress/wasm/regress-6931.js
new file mode 100644
index 0000000000..364e95a680
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-6931.js
@@ -0,0 +1,30 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+
+// This test checks for accidental sign extension. The Wasm spec says we do
+// arbitrary precision unsigned arithmetic to compute the memory address,
+// meaning this test should do 0xfffffffc + 8, which is 0x100000004 and out of
+// bounds. However, if we interpret 0xfffffffc as -4, then the result is 4 and
+// succeeds erroneously.
+
+
+(function() {
+  let builder = new WasmModuleBuilder();
+  builder.addMemory(1, 1, false);
+  builder.addFunction('test', kSig_v_v)
+      .addBody([
+        kExprI32Const, 0x7c, // address = -4
+        kExprI32Const, 0,
+        kExprI32StoreMem, 0, 8, // align = 0, offset = 8
+      ])
+      .exportFunc();
+  let module = builder.instantiate();
+
+  assertTraps(kTrapMemOutOfBounds, module.exports.test);
+})();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-694433.js b/deps/v8/test/mjsunit/regress/wasm/regress-694433.js
new file mode 100644
index 0000000000..b63f390c62
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-694433.js
@@ -0,0 +1,14 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+var size = Math.floor(0xFFFFFFFF / 4) + 1;
+(function() {
+  // Note: On 32 bit, this throws in the Uint16Array constructor (size does not
+  // fit in a Smi). On 64 bit, it throws in WebAssembly.validate, because the
+  // size exceeds the internal module size limit.
+  assertThrows(() => WebAssembly.validate(new Uint16Array(size)), RangeError);
+})();
+gc();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-698587.js b/deps/v8/test/mjsunit/regress/wasm/regress-698587.js
index 8e0be882b4..8e0be882b4 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-698587.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-698587.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-699485.js b/deps/v8/test/mjsunit/regress/wasm/regress-699485.js
index 7f4560789e..7f4560789e 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-699485.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-699485.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-702460.js b/deps/v8/test/mjsunit/regress/wasm/regress-702460.js
index 73c01e13a0..73c01e13a0 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-702460.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-702460.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-702839.js b/deps/v8/test/mjsunit/regress/wasm/regress-702839.js
index 859d268d12..859d268d12 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-702839.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-702839.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-7033.js b/deps/v8/test/mjsunit/regress/wasm/regress-7033.js
new file mode 100644
index 0000000000..17d79c896f
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-7033.js
@@ -0,0 +1,20 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+builder.addFunction('test', kSig_i_iii)
+    .addBodyWithEnd([
+      kExprI32Const, 0x07,  // i32.const 7
+      kExprI32Const, 0x00,  // i32.const 0
+      kExprI32Const, 0x00,  // i32.const 0
+      kExprI32And,          // i32.and
+      kExprI32And,          // i32.and
+      kExprEnd,             // -
+    ])
+    .exportFunc();
+var module = builder.instantiate();
+assertEquals(0, module.exports.test());
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-7035.js b/deps/v8/test/mjsunit/regress/wasm/regress-7035.js
new file mode 100644
index 0000000000..cd69c7d1b4
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-7035.js
@@ -0,0 +1,31 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+builder.addFunction('test', kSig_i_iii)
+    .addBodyWithEnd([
+      kExprI32Const, 0x00,  // i32.const 0
+      kExprI32Const, 0x00,  // i32.const 0
+      kExprI32Add,          // i32.add -> 0
+      kExprI32Const, 0x00,  // i32.const 0
+      kExprI32Const, 0x00,  // i32.const 0
+      kExprI32Add,          // i32.add -> 0
+      kExprI32Add,          // i32.add -> 0
+      kExprI32Const, 0x01,  // i32.const 1
+      kExprI32Const, 0x00,  // i32.const 0
+      kExprI32Add,          // i32.add -> 1
+      kExprBlock,    0x7f,  // @39 i32
+      kExprI32Const, 0x00,  // i32.const 0
+      kExprBr,       0x00,  // depth=0
+      kExprEnd,             // @90
+      kExprI32Add,          // i32.add -> 1
+      kExprI32Add,          // i32.add -> 1
+      kExprEnd
+    ])
+    .exportFunc();
+var module = builder.instantiate();
+assertEquals(1, module.exports.test());
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-703568.js b/deps/v8/test/mjsunit/regress/wasm/regress-703568.js
index c7d716bffd..c7d716bffd 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-703568.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-703568.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-7049.js b/deps/v8/test/mjsunit/regress/wasm/regress-7049.js
new file mode 100644
index 0000000000..b9ad1a0be4
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-7049.js
@@ -0,0 +1,54 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+// Build two instances, instance 2 is interpreted, and calls instance 1 (via
+// C_WASM_ENTRY), instance 1 then calls JS, which triggers GC.
+
+let builder1 = new WasmModuleBuilder();
+
+function call_gc() {
+  print('Triggering GC.');
+  gc();
+  print('Survived GC.');
+}
+let func1_sig = makeSig(new Array(8).fill(kWasmI32), [kWasmI32]);
+let imp = builder1.addImport('q', 'gc', kSig_v_v);
+let func1 = builder1.addFunction('func1', func1_sig)
+                .addBody([
+                  kExprGetLocal, 0,  // -
+                  kExprCallFunction, imp
+                ])
+                .exportFunc();
+let instance1 = builder1.instantiate({q: {gc: call_gc}});
+
+let builder2 = new WasmModuleBuilder();
+
+let func1_imp = builder2.addImport('q', 'func1', func1_sig);
+let func2 = builder2.addFunction('func2', kSig_i_i)
+                .addBody([
+                  kExprGetLocal, 0,  // 1
+                  kExprGetLocal, 0,  // 2
+                  kExprGetLocal, 0,  // 3
+                  kExprGetLocal, 0,  // 4
+                  kExprGetLocal, 0,  // 5
+                  kExprGetLocal, 0,  // 6
+                  kExprGetLocal, 0,  // 7
+                  kExprGetLocal, 0,  // 8
+                  kExprCallFunction, func1_imp
+                ])
+                .exportFunc();
+
+let instance2 = builder2.instantiate({q: {func1: instance1.exports.func1}});
+
+%RedirectToWasmInterpreter(
+        instance2, parseInt(instance2.exports.func2.name));
+
+// Call with 1. This will be passed by the C_WASM_ENTRY via the stack, and the
+// GC will try to dereference it (before the bug fix).
+instance2.exports.func2(1);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-708714.js b/deps/v8/test/mjsunit/regress/wasm/regress-708714.js
index 10cd67ad8d..10cd67ad8d 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-708714.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-708714.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-710844.js b/deps/v8/test/mjsunit/regress/wasm/regress-710844.js
index a45e953574..a45e953574 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-710844.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-710844.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-711203.js b/deps/v8/test/mjsunit/regress/wasm/regress-711203.js
index 46f274a8b0..46f274a8b0 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-711203.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-711203.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-715216-a.js b/deps/v8/test/mjsunit/regress/wasm/regress-715216a.js
index 56253414c9..56253414c9 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-715216-a.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-715216a.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-715216-b.js b/deps/v8/test/mjsunit/regress/wasm/regress-715216b.js
index 0954f807dd..0954f807dd 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-715216-b.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-715216b.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-717056.js b/deps/v8/test/mjsunit/regress/wasm/regress-717056.js
index 534cf74eb7..534cf74eb7 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-717056.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-717056.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-717194.js b/deps/v8/test/mjsunit/regress/wasm/regress-717194.js
index 074b2e4bca..074b2e4bca 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-717194.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-717194.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-719175.js b/deps/v8/test/mjsunit/regress/wasm/regress-719175.js
index c6217b0b01..c6217b0b01 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-719175.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-719175.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-722445.js b/deps/v8/test/mjsunit/regress/wasm/regress-722445.js
index f6a96dc60d..f6a96dc60d 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-722445.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-722445.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-724846.js b/deps/v8/test/mjsunit/regress/wasm/regress-724846.js
index 628d58f294..628d58f294 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-724846.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-724846.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-724851.js b/deps/v8/test/mjsunit/regress/wasm/regress-724851.js
index 18834795d2..18834795d2 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-724851.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-724851.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-724972.js b/deps/v8/test/mjsunit/regress/wasm/regress-724972.js
index 2af403ce20..2af403ce20 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-724972.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-724972.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-727219.js b/deps/v8/test/mjsunit/regress/wasm/regress-727219.js
index af0d8725bc..af0d8725bc 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-727219.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-727219.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-727222.js b/deps/v8/test/mjsunit/regress/wasm/regress-727222.js
index 6b3f2faf5f..6b3f2faf5f 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-727222.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-727222.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-727560.js b/deps/v8/test/mjsunit/regress/wasm/regress-727560.js
index f92d879a2e..f92d879a2e 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-727560.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-727560.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-729991.js b/deps/v8/test/mjsunit/regress/wasm/regress-729991.js
index 85a9ae7231..85a9ae7231 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-729991.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-729991.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-731351.js b/deps/v8/test/mjsunit/regress/wasm/regress-731351.js
index 238223ac2c..238223ac2c 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-731351.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-731351.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-734108.js b/deps/v8/test/mjsunit/regress/wasm/regress-734108.js
index d8774f4a84..d8774f4a84 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-734108.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-734108.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-734246.js b/deps/v8/test/mjsunit/regress/wasm/regress-734246.js
index 57f98949f8..57f98949f8 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-734246.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-734246.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-734345.js b/deps/v8/test/mjsunit/regress/wasm/regress-734345.js
index f55a06288e..f55a06288e 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-734345.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-734345.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-736584.js b/deps/v8/test/mjsunit/regress/wasm/regress-736584.js
index 39f03c1072..39f03c1072 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-736584.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-736584.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-737069.js b/deps/v8/test/mjsunit/regress/wasm/regress-737069.js
index c68d10f06d..c68d10f06d 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-737069.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-737069.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-739768.js b/deps/v8/test/mjsunit/regress/wasm/regress-739768.js
index bcf3ceeca2..bcf3ceeca2 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-739768.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-739768.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-753496.js b/deps/v8/test/mjsunit/regress/wasm/regress-753496.js
index a056a9fd8e..a056a9fd8e 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-753496.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-753496.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-757217.js b/deps/v8/test/mjsunit/regress/wasm/regress-757217.js
index 218b090c45..218b090c45 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-757217.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-757217.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-763439.js b/deps/v8/test/mjsunit/regress/wasm/regress-763439.js
index 0f9d2b24d8..0f9d2b24d8 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-763439.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-763439.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-763697.js b/deps/v8/test/mjsunit/regress/wasm/regress-763697.js
index faf74e1cff..faf74e1cff 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-763697.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-763697.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-766003.js b/deps/v8/test/mjsunit/regress/wasm/regress-766003.js
new file mode 100644
index 0000000000..d8a1ea1ebf
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-766003.js
@@ -0,0 +1,17 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --wasm-interpret-all
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+ __v_6 = new WasmModuleBuilder();
+__v_6.addFunction('exp1', kSig_i_i).addBody([kExprUnreachable]).exportFunc();
+ __v_7 = new WasmModuleBuilder();
+ __v_7.addImport('__v_11', '__v_11', kSig_i_i);
+try {
+; } catch(e) {; }
+ __v_8 = __v_6.instantiate().exports.exp1;
+ __v_9 = __v_7.instantiate({__v_11: {__v_11: __v_8}}).exports.call_imp;
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-769846.js b/deps/v8/test/mjsunit/regress/wasm/regress-769846.js
index 297da84f5f..297da84f5f 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-769846.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-769846.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-771243.js b/deps/v8/test/mjsunit/regress/wasm/regress-771243.js
new file mode 100644
index 0000000000..e1581fcdd8
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-771243.js
@@ -0,0 +1,39 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --wasm-interpret-all
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+assertThrows(() => {
+ __v_29 = 0;
+function __f_1() {
+ __v_19 = new WasmModuleBuilder();
+  if (__v_25) {
+ __v_23 = __v_19.addImport('__v_24', '__v_30', __v_25);
+  }
+  if (__v_18) {
+ __v_19.addMemory();
+ __v_19.addFunction('load', kSig_i_i)
+        .addBody([ 0])
+        .exportFunc();
+  }
+ return __v_19;
+}
+ (function TestExternalCallBetweenTwoWasmModulesWithoutAndWithMemory() {
+ __v_21 = __f_1(__v_18 = false, __v_25 = kSig_i_i);
+ __v_21.addFunction('plus_one', kSig_i_i)
+      .addBody([
+        kExprGetLocal, 0,                   // -
+        kExprCallFunction, __v_29      ])
+      .exportFunc();
+ __v_32 =
+      __f_1(__v_18 = true, __v_25 = undefined);
+ __v_31 = __v_32.instantiate(); try { __v_32[__getRandomProperty()] = __v_0; delete __v_18[__getRandomProperty()]; delete __v_34[__getRandomProperty()]; } catch(e) {; };
+ __v_20 = __v_21.instantiate(
+      {__v_24: {__v_30: __v_31.exports.load}});
+ __v_20.exports.plus_one(); __v_33 = __v_43;
+})();
+});
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-772332.js b/deps/v8/test/mjsunit/regress/wasm/regress-772332.js
new file mode 100644
index 0000000000..56e6f2ceb8
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-772332.js
@@ -0,0 +1,33 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --wasm-interpret-all
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+assertThrows(() => {
+let __v_50315 = 0;
+function __f_15356(__v_50316, __v_50317) {
+  let __v_50318 = new WasmModuleBuilder();
+  if (__v_50317) {
+    let __v_50319 = __v_50318.addImport('import_module', 'other_module_fn', kSig_i_i);
+  }
+      __v_50318.addMemory();
+      __v_50318.addFunction('load', kSig_i_i).addBody([ 0, 0, 0]).exportFunc();
+  return __v_50318;
+}
+  (function __f_15357() {
+    let __v_50320 = __f_15356(__v_50350 = false, __v_50351 = kSig_i_i);
+      __v_50320.addFunction('plus_one', kSig_i_i).addBody([kExprGetLocal, 0, kExprCallFunction, __v_50315, kExprI32Const, kExprI32Add, kExprReturn]).exportFunc();
+    let __v_50321 = __f_15356();
+    let __v_50324 = __v_50321.instantiate();
+    let __v_50325 = __v_50320.instantiate({
+      import_module: {
+        other_module_fn: __v_50324.exports.load
+      }
+    });
+ __v_50325.exports.plus_one();
+  })();
+});
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-775366.js b/deps/v8/test/mjsunit/regress/wasm/regress-775366.js
new file mode 100644
index 0000000000..e8db923896
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-775366.js
@@ -0,0 +1,29 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+
+(function BadTypeSection() {
+  var data = bytes(
+    kWasmH0,
+    kWasmH1,
+    kWasmH2,
+    kWasmH3,
+
+    kWasmV0,
+    kWasmV1,
+    kWasmV2,
+    kWasmV3,
+
+    kTypeSectionCode,
+    5,
+    2,
+    0x60,
+    0,
+    0,
+    13
+  );
+
+  assertFalse(WebAssembly.validate(data));
+})();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-778917.js b/deps/v8/test/mjsunit/regress/wasm/regress-778917.js
new file mode 100644
index 0000000000..083f1d12e3
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-778917.js
@@ -0,0 +1,20 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --wasm-interpret-all
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+
+const builder = new WasmModuleBuilder();
+
+const index = builder.addFunction("huge_frame", kSig_v_v)
+    .addBody([kExprCallFunction, 0])
+  .addLocals({f64_count: 49555}).exportFunc().index;
+// We assume above that the function we added has index 0.
+assertEquals(0, index);
+
+const module = builder.instantiate();
+assertThrows(module.exports.huge_frame, RangeError);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-782280.js b/deps/v8/test/mjsunit/regress/wasm/regress-782280.js
new file mode 100644
index 0000000000..a94f061c2b
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-782280.js
@@ -0,0 +1,33 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+builder.addFunction('test', kSig_i_iii)
+    .addBodyWithEnd([
+      kExprI32Const, 0,          // 0
+      kExprI32Const, 0,          // 0, 0
+      kExprI32Add,               // 0 + 0 -> 0
+      kExprI32Const, 0,          // 0, 0
+      kExprI32Const, 0,          // 0, 0, 0
+      kExprI32Add,               // 0, 0 + 0 -> 0
+      kExprDrop,                 // 0
+      kExprDrop,                 // -
+      kExprI32Const, 0,          // 0
+      kExprI32Const, 0,          // 0, 0
+      kExprI32Add,               // 0 + 0 -> 0
+      kExprI32Const, 0,          // 0, 0
+      kExprI32Const, 1,          // 0, 0, 1
+      kExprI32Add,               // 0, 0 + 1 -> 1
+      kExprBlock,    kWasmStmt,  // 0, 1
+      kExprBr,       0,          // 0, 1
+      kExprEnd,                  // 0, 1
+      kExprI32Add,               // 0 + 1 -> 1
+      kExprEnd
+    ])
+    .exportFunc();
+var module = builder.instantiate();
+assertEquals(1, module.exports.test());
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-784050.js b/deps/v8/test/mjsunit/regress/wasm/regress-784050.js
new file mode 100644
index 0000000000..8f1a79002c
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-784050.js
@@ -0,0 +1,25 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+builder.addFunction('test', kSig_v_v)
+    .addBodyWithEnd([
+      kExprI32Const,    0x0,   // const 0
+      kExprI32Const,    0x0,   // const 0
+      kExprBrIf,        0x00,  // br depth=0
+      kExprLoop,        0x7f,  // loop i32
+      kExprBlock,       0x7f,  // block i32
+      kExprI32Const,    0x0,   // const 0
+      kExprBr,          0x00,  // br depth=0
+      kExprEnd,                // end
+      kExprBr,          0x00,  // br depth=0
+      kExprEnd,                // end
+      kExprUnreachable,        // unreachable
+      kExprEnd,                // end
+    ])
+    .exportFunc();
+builder.instantiate();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-789952.js b/deps/v8/test/mjsunit/regress/wasm/regress-789952.js
new file mode 100644
index 0000000000..f73d8dc471
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-789952.js
@@ -0,0 +1,40 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let module_size = 19;
+let string_len = 0x00fffff0 - module_size;
+
+print("Allocating backing store: " + (string_len + module_size));
+let backing = new ArrayBuffer(string_len + module_size);
+
+print("Allocating typed array buffer");
+let buffer = new Uint8Array(backing);
+
+print("Filling...");
+buffer.fill(0x41);
+
+print("Setting up array buffer");
+// Magic
+buffer.set([0x00, 0x61, 0x73, 0x6D], 0);
+// Version
+buffer.set([0x01, 0x00, 0x00, 0x00], 4);
+// kUnknownSection (0)
+buffer.set([0], 8);
+// Section length
+buffer.set([0x80, 0x80, 0x80, 0x80, 0x00],  9);
+// Name length
+let x = string_len + 1;
+let b1 = ((x >> 0) & 0x7F) | 0x80;
+let b2 = ((x >> 7) & 0x7F) | 0x80;
+let b3 = ((x >> 14) & 0x7F) | 0x80;
+let b4 = ((x >> 21) & 0x7F);
+//buffer.set([0xDE, 0xFF, 0xFF, 0x7F], 14);
+ buffer.set([b1, b2, b3, b4], 14);
+
+print("Parsing module...");
+let m = new WebAssembly.Module(buffer);
+
+print("Triggering!");
+let c = WebAssembly.Module.customSections(m, "A".repeat(string_len + 1));
+assertEquals(0, c.length);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-694433.js b/deps/v8/test/mjsunit/regress/wasm/regression-694433.js
deleted file mode 100644
index a260e20790..0000000000
--- a/deps/v8/test/mjsunit/regress/wasm/regression-694433.js
+++ /dev/null
@@ -1,6 +0,0 @@
-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-var size = 0x40000000;
-assertThrows(() => WebAssembly.validate(new Uint16Array(size)), RangeError);