deps: update V8 to 6.9.427.22

PR-URL: https://github.com/nodejs/node/pull/21983
Reviewed-By: Refael Ackermann <refack@gmail.com>
Reviewed-By: Gus Caplan <me@gus.host>
Reviewed-By: Ujjwal Sharma <usharma1998@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

9 files changed, 254 insertions, 19 deletions

diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-7785.js b/deps/v8/test/mjsunit/regress/wasm/regress-7785.js
new file mode 100644
index 0000000000..12d7e6b5da
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-7785.js
@@ -0,0 +1,44 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --experimental-wasm-anyref
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function testAnyRefNull() {
+  const builder = new WasmModuleBuilder();
+  builder.addFunction('main', kSig_r_v)
+      .addBody([kExprRefNull])
+      .exportFunc();
+
+  var wire_bytes = builder.toBuffer();
+  var module = new WebAssembly.Module(wire_bytes);
+  var buffer = %SerializeWasmModule(module);
+  module = %DeserializeWasmModule(buffer, wire_bytes);
+  var instance = new WebAssembly.Instance(module);
+
+  assertEquals(null, instance.exports.main());
+})();
+
+(function testAnyRefIsNull() {
+  const builder = new WasmModuleBuilder();
+  builder.addFunction('main', kSig_i_r)
+      .addBody([kExprGetLocal, 0, kExprRefIsNull])
+      .exportFunc();
+
+  var wire_bytes = builder.toBuffer();
+  var module = new WebAssembly.Module(wire_bytes);
+  var buffer = %SerializeWasmModule(module);
+  module = %DeserializeWasmModule(buffer, wire_bytes);
+  var instance = new WebAssembly.Instance(module);
+
+  assertEquals(0, instance.exports.main({'hello' : 'world'}));
+  assertEquals(0, instance.exports.main(1234));
+  assertEquals(0, instance.exports.main(0));
+  assertEquals(0, instance.exports.main(123.4));
+  assertEquals(0, instance.exports.main(undefined));
+  assertEquals(1, instance.exports.main(null));
+  assertEquals(0, instance.exports.main(print));
+})();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-7914.js b/deps/v8/test/mjsunit/regress/wasm/regress-7914.js
new file mode 100644
index 0000000000..731005a872
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-7914.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(16, 32, false);
+builder.addFunction('main', kSig_i_v)
+    .addBody([
+      ...wasmI32Const(10000),  // i32.const 10000
+      kExprGrowMemory, 0,      // grow_memory --> -1
+      kExprI32Popcnt,          // i32.popcnt  --> 32
+    ])
+    .exportFunc();
+const instance = builder.instantiate();
+assertEquals(32, instance.exports.main());
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-799952.js b/deps/v8/test/mjsunit/regress/wasm/regress-799952.js
new file mode 100644
index 0000000000..17371343e4
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-799952.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var sentinel = {};
+Object.defineProperty(Promise, Symbol.species, {
+  value: function(f) {
+    f(function() {}, function() {})
+    return sentinel;
+  }
+});
+
+// According to the WebAssembly JavaScript API spec, WebAssembly.instantiate is
+// using the initial value of the Promise constructor. Specifically it ignores
+// the Promise species constructor installed above.
+var promise = WebAssembly.instantiate(new ArrayBuffer());
+assertInstanceof(promise, Promise);
+assertNotSame(promise, sentinel);
+
+// All further uses of the returned Promise, like using Promise.prototype.then,
+// will respect the Promise species constructor installed above however.
+var monkey = promise.then(r => { print(r) }, e => { print(e) });
+assertSame(monkey, sentinel);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-808848.js b/deps/v8/test/mjsunit/regress/wasm/regress-808848.js
index 28c57ec340..69423b954d 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-808848.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-808848.js
@@ -49,16 +49,16 @@ let m1 = new WebAssembly.Module(m1_bytes);
 // Serialize the module and postMessage it to another thread.
 let serialized_m1 = %SerializeWasmModule(m1);
 
-let workerScript =
-  `onmessage = function(msg) {
-    let {serialized_m1, m1_bytes} = msg;
+let worker_onmessage = function(msg) {
+  let {serialized_m1, m1_bytes} = msg;
 
-    let m1_clone = %DeserializeWasmModule(serialized_m1, m1_bytes);
-    let imports = {mod: {get: () => 3, call: () => {}}};
-    let i2 = new WebAssembly.Instance(m1_clone, imports);
-    i2.exports.main();
-    postMessage('done');
-  }`;
+  let m1_clone = %DeserializeWasmModule(serialized_m1, m1_bytes);
+  let imports = {mod: {get: () => 3, call: () => {}}};
+  let i2 = new WebAssembly.Instance(m1_clone, imports);
+  i2.exports.main();
+  postMessage('done');
+}
+let workerScript = "onmessage = " + worker_onmessage.toString();
 
 let worker = new Worker(workerScript);
 worker.postMessage({serialized_m1, m1_bytes});
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-837417.js b/deps/v8/test/mjsunit/regress/wasm/regress-837417.js
index 572139fac5..9dcc299ecf 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-837417.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-837417.js
@@ -8,16 +8,11 @@ load('test/mjsunit/wasm/wasm-module-builder.js');
 const builder = new WasmModuleBuilder();
 builder.addMemory(16, 32);
 builder.addFunction("test", kSig_i_v).addBody([
-  kExprI32Const, 12,         // i32.const 0
+  kExprI32Const, 12,         // i32.const 12
 ]);
 
-WebAssembly.Module.prototype.then = resolve => resolve(
-    String.fromCharCode(null, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41));
+WebAssembly.Module.prototype.then = resolve => {
+  assertUnreachable();
+};
 
-// WebAssembly.instantiate should not actually throw a TypeError in this case.
-// However, this is a workaround for
-assertPromiseResult(
-    WebAssembly.instantiate(builder.toBuffer()), assertUnreachable,
-    exception => {
-      assertInstanceof(exception, TypeError);
-    });
+WebAssembly.instantiate(builder.toBuffer());
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-853453.js b/deps/v8/test/mjsunit/regress/wasm/regress-853453.js
new file mode 100644
index 0000000000..fcf5f67885
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-853453.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-threads
+
+assertThrows(() => new WebAssembly.Module(
+    new Uint8Array([
+      0x00, 0x61, 0x73, 0x6d,     // wasm magic
+      0x01, 0x00, 0x00, 0x00,     // wasm version
+      0x04,                       // section code
+      0x04,                       // section length
+      /* Section: Table */
+      0x01,                       // table count
+      0x70,                       // table type
+      0x03,                       // resizable limits flags
+      0x00])),
+    WebAssembly.CompileError);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-854011.js b/deps/v8/test/mjsunit/regress/wasm/regress-854011.js
new file mode 100644
index 0000000000..11863368f3
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-854011.js
@@ -0,0 +1,47 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addFunction('main', kSig_d_d)
+    .addBody([
+      // Call with param 0 (converted to i64), to fill the stack with non-zero
+      // values.
+      kExprGetLocal, 0, kExprI64SConvertF64,  // arg 0
+      kExprGetLocal, 0, kExprI64SConvertF64,  // arg 1
+      kExprGetLocal, 0, kExprI64SConvertF64,  // arg 2
+      kExprGetLocal, 0, kExprI64SConvertF64,  // arg 3
+      kExprGetLocal, 0, kExprI64SConvertF64,  // arg 4
+      kExprGetLocal, 0, kExprI64SConvertF64,  // arg 5
+      kExprGetLocal, 0, kExprI64SConvertF64,  // arg 6
+      kExprGetLocal, 0, kExprI64SConvertF64,  // arg 7
+      kExprCallFunction, 1,                   // call #1
+      // Now call with 0 constants.
+      // The bug was that they were written out as i32 values, thus the upper 32
+      // bit were the previous values on that stack memory.
+      kExprI64Const, 0,      // i64.const 0  [0]
+      kExprI64Const, 0,      // i64.const 0  [1]
+      kExprI64Const, 0,      // i64.const 0  [2]
+      kExprI64Const, 0,      // i64.const 0  [3]
+      kExprI64Const, 0,      // i64.const 0  [4]
+      kExprI64Const, 0,      // i64.const 0  [5]
+      kExprI64Const, 0,      // i64.const 0  [6]
+      kExprI64Const, 0,      // i64.const 0  [7]
+      kExprCallFunction, 1,  // call #1
+      // Return the sum of the two returned values.
+      kExprF64Add
+    ])
+    .exportFunc();
+builder.addFunction(undefined, makeSig(new Array(8).fill(kWasmI64), [kWasmF64]))
+    .addBody([
+      kExprGetLocal, 7,     // get_local 7 (last parameter)
+      kExprF64SConvertI64,  // f64.convert_s/i64
+    ]);
+const instance = builder.instantiate();
+const big_num_1 = 2 ** 48;
+const big_num_2 = 2 ** 56 / 3;
+assertEquals(big_num_1, instance.exports.main(big_num_1));
+assertEquals(big_num_2, instance.exports.main(big_num_2));
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-854050.js b/deps/v8/test/mjsunit/regress/wasm/regress-854050.js
new file mode 100644
index 0000000000..e2146ca365
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-854050.js
@@ -0,0 +1,28 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addFunction(undefined, makeSig([kWasmI32, kWasmF32], []))
+    .addLocals({i32_count: 7})
+    .addBody([
+      kExprGetLocal,    0,          // get_local
+      kExprI32Const,    0,          // i32.const 0
+      kExprIf,          kWasmStmt,  // if
+      kExprUnreachable,             // unreachable
+      kExprEnd,                     // end if
+      kExprGetLocal,    4,          // get_local
+      kExprTeeLocal,    8,          // tee_local
+      kExprBrIf,        0,          // br_if depth=0
+      kExprTeeLocal,    7,          // tee_local
+      kExprTeeLocal,    0,          // tee_local
+      kExprTeeLocal,    2,          // tee_local
+      kExprTeeLocal,    8,          // tee_local
+      kExprDrop,                    // drop
+      kExprLoop,        kWasmStmt,  // loop
+      kExprEnd,                     // end loop
+    ]);
+builder.instantiate();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-864509.js b/deps/v8/test/mjsunit/regress/wasm/regress-864509.js
new file mode 100644
index 0000000000..822c06750a
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-864509.js
@@ -0,0 +1,62 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --liftoff --no-wasm-tier-up --no-future --wasm-tier-mask-for-testing=2
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(1, 1);
+// First function is Liftoff. The first parameter is used as memory offset.
+builder.addFunction(undefined, kSig_v_i).addBody([
+  kExprGetLocal, 0,        // get_local 0
+  kExprI32Const, 0,        // i32.const 0
+  kExprI32StoreMem, 0, 0,  // i32.store offset=0
+]);
+// Second function is Turbofan. It loads the sixth parameter from the stack
+// into a register for the first argument. Even though it's a 32-bit value, it
+// is loaded as 64-bit value on x64.
+builder.addFunction(undefined, makeSig(new Array(6).fill(kWasmI32), []))
+    .addBody([
+      kExprGetLocal, 5,     // get_local 5
+      kExprCallFunction, 0  // call 0
+    ]);
+// The third function is Liftoff again. A value is spilled on the stack as i32,
+// then used as a call argument, passed via the stack. The full 64-bit are
+// copied on the stack, even though just 32-bit were written before. Hence, the
+// stack slot is not zero-extended.
+const gen_i32_code = [
+  kExprTeeLocal, 0,  // tee_local 0
+  kExprGetLocal, 0,  // get_local 0
+  kExprI32Const, 1,  // i32.const 1
+  kExprI32Add        // i32.add     --> 2nd param
+];
+builder.addFunction(undefined, kSig_v_v).addLocals({i32_count: 1}).addBody([
+  // Generate six values on the stack, then six more to force the other six on
+  // the stack.
+  ...wasmI32Const(0),    // i32.const 0
+  ...wasmI32Const(1),    // i32.const 1
+  kExprI32Add,           // i32.add --> 1st param
+  ...gen_i32_code,       // --> 2nd param
+  ...gen_i32_code,       // --> 3rd param
+  ...gen_i32_code,       // --> 4th param
+  ...gen_i32_code,       // --> 5th param
+  ...gen_i32_code,       // --> 6th param
+  ...gen_i32_code,       // --> garbage
+  ...gen_i32_code,       // --> garbage
+  ...gen_i32_code,       // --> garbage
+  ...gen_i32_code,       // --> garbage
+  ...gen_i32_code,       // --> garbage
+  ...gen_i32_code,       // --> garbage
+  kExprDrop,             // drop garbage
+  kExprDrop,             // drop garbage
+  kExprDrop,             // drop garbage
+  kExprDrop,             // drop garbage
+  kExprDrop,             // drop garbage
+  kExprDrop,             // drop garbage
+  kExprCallFunction,  1  // call 1
+]).exportAs('three');
+const instance = builder.instantiate();
+instance.exports.three();