deps: update V8 to 5.6.326.55

PR-URL: https://github.com/nodejs/node/pull/10992
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

6 files changed, 893 insertions, 3 deletions

diff --git a/deps/v8/test/mjsunit/regress/wasm/loop-stack-check.js b/deps/v8/test/mjsunit/regress/wasm/loop-stack-check.js
new file mode 100644
index 0000000000..a76ad017d9
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/loop-stack-check.js
@@ -0,0 +1,19 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function() {
+  var builder = new WasmModuleBuilder();
+  builder.addFunction("foo", kSig_i_ii)
+    .addBody([
+        kExprLoop, 00,
+        kExprBrTable, 0xfb, 0xff, 0xff, 0xff,
+              ])
+              .exportFunc();
+  assertThrows(function() { builder.instantiate(); });
+})();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-02256b.js b/deps/v8/test/mjsunit/regress/wasm/regression-02256b.js
new file mode 100644
index 0000000000..032a02684b
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regression-02256b.js
@@ -0,0 +1,502 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --random-seed=891196975 --expose-gc --allow-natives-syntax
+// Flags: --gc-interval=207 --stress-compaction --validate-asm
+//
+// /v8/test/mjsunit/wasm/grow-memory.js
+// /v8/test/mjsunit/regress/regress-540.js
+// /v8/test/mjsunit/regress/wasm/regression-02862.js
+// /v8/test/mjsunit/regress/regress-2813.js
+// /v8/test/mjsunit/regress/regress-323845.js
+// Begin stripped down and modified version of mjsunit.js for easy minimization in CF.
+
+function MjsUnitAssertionError(message) {}
+MjsUnitAssertionError.prototype.toString = function() {
+    return this.message;
+};
+var assertSame;
+var assertEquals;
+var assertEqualsDelta;
+var assertArrayEquals;
+var assertPropertiesEqual;
+var assertToStringEquals;
+var assertTrue;
+var assertFalse;
+var triggerAssertFalse;
+var assertNull;
+var assertNotNull;
+var assertThrows;
+var assertDoesNotThrow;
+var assertInstanceof;
+var assertUnreachable;
+var assertOptimized;
+var assertUnoptimized;
+
+function classOf(object) {
+    var string = Object.prototype.toString.call(object);
+    return string.substring(8, string.length - 1);
+}
+
+function PrettyPrint(value) {
+    return "";
+}
+
+function PrettyPrintArrayElement(value, index, array) {
+    return "";
+}
+
+function fail(expectedText, found, name_opt) {}
+
+function deepObjectEquals(a, b) {
+    var aProps = Object.keys(a);
+    aProps.sort();
+    var bProps = Object.keys(b);
+    bProps.sort();
+    if (!deepEquals(aProps, bProps)) {
+        return false;
+    }
+    for (var i = 0; i < aProps.length; i++) {
+        if (!deepEquals(a[aProps[i]], b[aProps[i]])) {
+            return false;
+        }
+    }
+    return true;
+}
+
+function deepEquals(a, b) {
+    if (a === b) {
+        if (a === 0) return (1 / a) === (1 / b);
+        return true;
+    }
+    if (typeof a != typeof b) return false;
+    if (typeof a == "number") return isNaN(a) && isNaN(b);
+    if (typeof a !== "object" && typeof a !== "function") return false;
+    var objectClass = classOf(a);
+    if (objectClass !== classOf(b)) return false;
+    if (objectClass === "RegExp") {
+        return (a.toString() === b.toString());
+    }
+    if (objectClass === "Function") return false;
+    if (objectClass === "Array") {
+        var elementCount = 0;
+        if (a.length != b.length) {
+            return false;
+        }
+        for (var i = 0; i < a.length; i++) {
+            if (!deepEquals(a[i], b[i])) return false;
+        }
+        return true;
+    }
+    if (objectClass == "String" || objectClass == "Number" || objectClass == "Boolean" || objectClass == "Date") {
+        if (a.valueOf() !== b.valueOf()) return false;
+    }
+    return deepObjectEquals(a, b);
+}
+assertSame = function assertSame(expected, found, name_opt) {
+    if (found === expected) {
+        if (expected !== 0 || (1 / expected) == (1 / found)) return;
+    } else if ((expected !== expected) && (found !== found)) {
+        return;
+    }
+    fail(PrettyPrint(expected), found, name_opt);
+};
+assertEquals = function assertEquals(expected, found, name_opt) {
+    if (!deepEquals(found, expected)) {
+        fail(PrettyPrint(expected), found, name_opt);
+    }
+};
+assertEqualsDelta = function assertEqualsDelta(expected, found, delta, name_opt) {
+    assertTrue(Math.abs(expected - found) <= delta, name_opt);
+};
+assertArrayEquals = function assertArrayEquals(expected, found, name_opt) {
+    var start = "";
+    if (name_opt) {
+        start = name_opt + " - ";
+    }
+    assertEquals(expected.length, found.length, start + "array length");
+    if (expected.length == found.length) {
+        for (var i = 0; i < expected.length; ++i) {
+            assertEquals(expected[i], found[i], start + "array element at index " + i);
+        }
+    }
+};
+assertPropertiesEqual = function assertPropertiesEqual(expected, found, name_opt) {
+    if (!deepObjectEquals(expected, found)) {
+        fail(expected, found, name_opt);
+    }
+};
+assertToStringEquals = function assertToStringEquals(expected, found, name_opt) {
+    if (expected != String(found)) {
+        fail(expected, found, name_opt);
+    }
+};
+assertTrue = function assertTrue(value, name_opt) {
+    assertEquals(true, value, name_opt);
+};
+assertFalse = function assertFalse(value, name_opt) {
+    assertEquals(false, value, name_opt);
+};
+assertNull = function assertNull(value, name_opt) {
+    if (value !== null) {
+        fail("null", value, name_opt);
+    }
+};
+assertNotNull = function assertNotNull(value, name_opt) {
+    if (value === null) {
+        fail("not null", value, name_opt);
+    }
+};
+assertThrows = function assertThrows(code, type_opt, cause_opt) {
+    var threwException = true;
+    try {
+        if (typeof code == 'function') {
+            code();
+        } else {
+            eval(code);
+        }
+        threwException = false;
+    } catch (e) {
+        if (typeof type_opt == 'function') {
+            assertInstanceof(e, type_opt);
+        }
+        if (arguments.length >= 3) {
+            assertEquals(e.type, cause_opt);
+        }
+        return;
+    }
+};
+assertInstanceof = function assertInstanceof(obj, type) {
+    if (!(obj instanceof type)) {
+        var actualTypeName = null;
+        var actualConstructor = Object.getPrototypeOf(obj).constructor;
+        if (typeof actualConstructor == "function") {
+            actualTypeName = actualConstructor.name || String(actualConstructor);
+        }
+        fail("Object <" + PrettyPrint(obj) + "> is not an instance of <" + (type.name || type) + ">" + (actualTypeName ? " but of < " + actualTypeName + ">" : ""));
+    }
+};
+assertDoesNotThrow = function assertDoesNotThrow(code, name_opt) {
+    try {
+        if (typeof code == 'function') {
+            code();
+        } else {
+            eval(code);
+        }
+    } catch (e) {
+        fail("threw an exception: ", e.message || e, name_opt);
+    }
+};
+assertUnreachable = function assertUnreachable(name_opt) {
+    var message = "Fail" + "ure: unreachable";
+    if (name_opt) {
+        message += " - " + name_opt;
+    }
+};
+var OptimizationStatus = function() {}
+assertUnoptimized = function assertUnoptimized(fun, sync_opt, name_opt) {
+    if (sync_opt === undefined) sync_opt = "";
+    assertTrue(OptimizationStatus(fun, sync_opt) != 1, name_opt);
+}
+assertOptimized = function assertOptimized(fun, sync_opt, name_opt) {
+    if (sync_opt === undefined) sync_opt = "";
+    assertTrue(OptimizationStatus(fun, sync_opt) != 2, name_opt);
+}
+triggerAssertFalse = function() {}
+try {
+    console.log;
+    print = console.log;
+    alert = console.log;
+} catch (e) {}
+
+function runNearStackLimit(f) {
+    function t() {
+        try {
+            t();
+        } catch (e) {
+            f();
+        }
+    };
+    try {
+        t();
+    } catch (e) {}
+}
+
+function quit() {}
+
+function nop() {}
+try {
+    gc;
+} catch (e) {
+    gc = nop;
+}
+
+function getRandomProperty(v, rand) {
+    var properties = Object.getOwnPropertyNames(v);
+    var proto = Object.getPrototypeOf(v);
+    if (proto) {
+        properties = properties.concat(Object.getOwnPropertyNames(proto));
+    }
+    if (properties.includes("constructor") && v.constructor.hasOwnProperty("__proto__")) {
+        properties = properties.concat(Object.getOwnPropertyNames(v.constructor.__proto__));
+    }
+    if (properties.length == 0) {
+        return "0";
+    }
+    return properties[rand % properties.length];
+}
+// End stripped down and modified version of mjsunit.js.
+
+var __v_0 = {};
+var __v_1 = {};
+var __v_2 = {};
+var __v_3 = {};
+var __v_4 = -1073741824;
+var __v_5 = {};
+var __v_6 = 1;
+var __v_7 = 1073741823;
+var __v_8 = {};
+var __v_9 = {};
+var __v_10 = 4294967295;
+var __v_11 = this;
+var __v_12 = {};
+var __v_13 = {};
+
+
+function __f_18(__f_17, y) {
+    eval(__f_17);
+    return y();
+}
+try {
+    var __v_17 = __f_18("function y() { return 1; }", function() {
+        return 0;
+    })
+    assertEquals(1, __v_17);
+    gc();
+    __v_17 =
+        (function(__f_17) {
+            function __f_17() {
+                return 3;
+            }
+            return __f_17();
+        })(function() {
+            return 2;
+        });
+    assertEquals(3, __v_17);
+    __v_17 =
+        (function(__f_17) {
+            function __f_17() {
+                return 5;
+            }
+            return arguments[0]();
+        })(function() {
+            return -1073741825;
+        });
+    assertEquals(5, __v_17);
+} catch (e) {
+    print("Caught: " + e);
+}
+
+function __f_27() {}
+try {
+    var __v_24 = {};
+    var __v_21 = {};
+    var __v_22 = {};
+    var __v_20 = {};
+    __v_58 = {
+        instantiateModuleFromAsm: function(text, ffi, heap) {
+            var __v_21 = eval('(' + text + ')');
+            if (__f_27()) {
+                throw "validate failure";
+            }
+            var __v_20 = __v_21();
+            if (__f_27()) {
+                throw "bad module args";
+            }
+        }
+    };
+    __f_21 = function __f_21() {
+        if (found === expected) {
+            if (1 / expected) return;
+        } else if ((expected !== expected) && (found !== found)) {
+            return;
+        };
+    };
+    __f_28 = function __f_28() {
+        if (!__f_23()) {
+            __f_125(__f_69(), found, name_opt);
+        }
+    };
+    __f_24 = function __f_24(code, type_opt, cause_opt) {
+        var __v_24 = true;
+        try {
+            if (typeof code == 'function') {
+                code();
+            } else {
+                eval();
+            }
+            __v_24 = false;
+        } catch (e) {
+            if (typeof type_opt == 'function') {
+                __f_22();
+            }
+            if (arguments.length >= 3) {
+                __f_28();
+            }
+            return;
+        }
+    };
+    __f_22 = function __f_22() {
+        if (obj instanceof type) {
+            obj.constructor;
+            if (typeof __v_57 == "function") {;
+            };
+        }
+    };
+    try {
+        __f_28();
+        __v_82.__p_750895751 = __v_82[getRandomProperty()];
+    } catch (e) {
+        "Caught: " + e;
+    }
+    __f_19();
+    gc();
+    __f_19(19, __f_24);
+    __f_19();
+    __f_19();
+    __f_24(function() {
+        __v_58.instantiateModuleFromAsm(__f_28.toString()).__f_20();
+    });
+} catch (e) {
+    print("Caught: " + e);
+}
+
+function __f_19() {
+    "use asm";
+
+    function __f_20() {}
+    return {
+        __f_20: __f_20
+    };
+}
+try {
+    __f_19();
+    __f_19();
+    __f_19();
+} catch (e) {
+    print("Caught: " + e);
+}
+
+function __f_29() {}
+try {
+    __f_19();
+    try {
+        __f_19();
+        gc();
+        __f_25();
+    } catch (e) {
+        "Caught: " + e;
+    }
+    __f_19();
+    __f_19();
+    __f_19();
+} catch (e) {
+    print("Caught: " + e);
+}
+
+function __f_23() {
+    "use asm";
+
+    function __f_20() {}
+    return {
+        __f_20: __f_20
+    };
+}
+try {
+    __f_19();
+    __f_19();
+    __f_19();
+    __f_19();
+    gc();
+    __f_19();
+    __f_19();
+    __f_19();
+} catch (e) {
+    print("Caught: " + e);
+}
+
+function __f_26(stdlib) {
+    "use asm";
+    var __v_2 = new stdlib.Int32Array();
+    __v_22[4294967295] | 14 + 1 | 14;
+    return {
+        __f_20: __f_20
+    };
+}
+
+function __f_25() {
+    var __v_19 = new ArrayBuffer();
+    var __v_23 = new Int32Array(__v_19);
+    var module = __v_58.instantiateModuleFromAsm(__f_26.toString());
+    __f_28();
+    gc();
+}
+try {
+    (function() {})();
+    (function() {})();
+    try {
+        (function() {
+            __v_23.__defineGetter__(getRandomProperty(__v_23, 580179357), function() {
+                gc();
+                return __f_25(__v_23);
+            });
+            var __v_23 = 0x87654321;
+            __v_19.__f_89();
+        })();
+    } catch (e) {;
+    }
+} catch (e) {
+    print("Caught: " + e);
+}
+
+function __f_30(x) {
+    var __v_30 = x + 1;
+    var __v_31 = x + 2;
+    if (x != 0) {
+        if (x > 0 & x < 100) {
+            return __v_30;
+        }
+    }
+    return 0;
+}
+try {
+    assertEquals(0, __f_30(0));
+    assertEquals(0, __f_30(0));
+    %OptimizeFunctionOnNextCall(__f_30);
+    assertEquals(3, __f_30(2));
+} catch (e) {
+    print("Caught: " + e);
+}
+
+function __f_31() {
+    __f_32.arguments;
+}
+
+function __f_32(x) {
+    __f_31();
+}
+
+function __f_33() {
+    __f_32({});
+}
+try {
+    __f_33();
+    __f_33();
+    __f_33();
+    %OptimizeFunctionOnNextCall(__f_33);
+    __f_33();
+    gc();
+} catch (e) {
+    print("Caught: " + e);
+}
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-5531.js b/deps/v8/test/mjsunit/regress/wasm/regression-5531.js
new file mode 100644
index 0000000000..9c1c092519
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regression-5531.js
@@ -0,0 +1,22 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function() {
+  var builder = new WasmModuleBuilder();
+  builder.addMemory(1, 1, false);
+  builder.addFunction("foo", kSig_i_v)
+    .addBody([
+              kExprI32Const, 0x00,
+      kExprI8Const, 0xcb,
+      kExprI8Const, 0xff,
+      kExprBrTable, 0xcb, 0xcb, 0xcb, 0x00, 0x00, 0xcb, 0x00 // entries=1238475
+              ])
+              .exportFunc();
+  assertThrows(function() { builder.instantiate(); });
+})();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-648079.js b/deps/v8/test/mjsunit/regress/wasm/regression-648079.js
new file mode 100644
index 0000000000..e9d14175e4
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regression-648079.js
@@ -0,0 +1,324 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function() {
+"use asm";
+var builder = new WasmModuleBuilder();
+builder.addFunction("regression_648079", kSig_s_v)
+  .addBody([
+    // locals:
+    0x00,
+    // body:
+    kExprI64RemU,
+    kExprI64Ctz,
+    kExprI64LeU,
+    kExprUnreachable,
+    kExprUnreachable,
+    kExprUnreachable,
+    kExprUnreachable,
+    kExprI64Ctz,
+    kExprI64Ne,
+    kExprI64ShrS,
+    kExprI64GtS,
+    kExprI64RemU,
+    kExprUnreachable,
+    kExprI64RemU,
+    kExprI32Eqz,
+    kExprI64LeU,
+    kExprDrop,
+    kExprF32Add,
+    kExprI64Ior,
+    kExprF32CopySign,
+    kExprI64Ne,
+    kExprI64GeS,
+    kExprUnreachable,
+    kExprF32Trunc,
+    kExprF32Trunc,
+    kExprUnreachable,
+    kExprIf, 10,   // @32
+      kExprBlock, 00,   // @34
+        kExprBr,   // depth=109
+        kExprI64Shl,
+        kExprI64LeU,
+        kExprI64GeS,
+        kExprI64Clz,
+        kExprF32Min,
+        kExprF32Eq,
+        kExprF32Trunc,
+        kExprF32Trunc,
+        kExprF32Trunc,
+        kExprUnreachable,
+        kExprI32Const,
+        kExprUnreachable,
+        kExprBr,   // depth=101
+        kExprF32Div,
+        kExprI64GtU,
+        kExprI64GeS,
+        kExprI64Clz,
+        kExprSelect,
+        kExprI64GtS,
+        kExprI64RemU,
+        kExprI64LeU,
+        kExprI64Shl,
+        kExprI64Ctz,
+        kExprLoop, 01,   // @63 i32
+        kExprElse,   // @65
+          kExprI64LeU,
+          kExprI64RemU,
+          kExprI64Ne,
+          kExprI64GeS,
+          kExprI32Const,
+          kExprI64GtS,
+          kExprI64LoadMem32U,
+          kExprI64Clz,
+          kExprI64Shl,
+          kExprI64Ne,
+          kExprI64ShrS,
+          kExprI64GtS,
+          kExprI64DivU,
+          kExprI64Ne,
+          kExprI64GtS,
+          kExprI64Ne,
+          kExprI64Popcnt,
+          kExprI64DivU,
+          kExprI64DivU,
+          kExprSelect,
+          kExprI64Ctz,
+          kExprI64Popcnt,
+          kExprI64RemU,
+          kExprI64Clz,
+          kExprF64Sub,
+          kExprF32Trunc,
+          kExprF32Trunc,
+          kExprI64RemU,
+          kExprI64Ctz,
+          kExprI64LeU,
+          kExprUnreachable,
+          kExprUnreachable,
+          kExprUnreachable,
+          kExprBrIf,   // depth=116
+          kExprF32Min,
+          kExprI64GtU,
+          kExprBlock, 01,   // @107 i32
+            kExprTeeLocal,
+            kExprBlock, 01,   // @111 i32
+              kExprBlock, 01,   // @113 i32
+                kExprBlock, 01,   // @115 i32
+                  kExprBlock, 01,   // @117 i32
+                    kExprBlock, 01,   // @119 i32
+                      kExprBlock, 01,   // @121 i32
+                        kExprBlock, 01,   // @123 i32
+                          kExprBlock, 88,   // @125
+                            kExprF32Trunc,
+                            kExprF32Trunc,
+                            kExprF32Trunc,
+                            kExprUnreachable,
+                            kExprLoop, 40,   // @131
+                              kExprUnreachable,
+                              kExprUnreachable,
+                              kExprI32Add,
+                              kExprBlock, 05,   // @136
+                                kExprUnreachable,
+                                kExprIf, 02,   // @139 i64
+                                  kExprBlock, 01,   // @141 i32
+                                    kExprBrIf,   // depth=16
+                                    kExprLoop, 00,   // @145
+                                      kExprUnreachable,
+                                      kExprUnreachable,
+                                      kExprReturn,
+                                      kExprUnreachable,
+                                      kExprUnreachable,
+                                      kExprUnreachable,
+                                      kExprI64LoadMem16U,
+                                      kExprUnreachable,
+                                      kExprUnreachable,
+                                      kExprUnreachable,
+                                      kExprUnreachable,
+                                      kExprUnreachable,
+                                      kExprNop,
+                                      kExprBr,   // depth=1
+                                    kExprElse,   // @164
+                                      kExprF32Trunc,
+                                      kExprI32Add,
+                                      kExprCallIndirect,   // sig #1
+                                      kExprUnreachable,
+                                      kExprUnreachable,
+                                      kExprUnreachable,
+                                      kExprBlock, 00,   // @172
+                                        kExprI64RemU,
+                                        kExprI64Ctz,
+                                        kExprI64LeU,
+                                        kExprUnreachable,
+                                        kExprUnreachable,
+                                        kExprUnreachable,
+                                        kExprUnreachable,
+                                        kExprUnreachable,
+                                        kExprDrop,
+                                        kExprI64Popcnt,
+                                        kExprF32Min,
+                                        kExprUnreachable,
+                                        kExprF64Sub,
+                                        kExprI32Const,
+                                        kExprUnreachable,
+                                        kExprGetLocal,
+                                        kExprI64LoadMem32U,
+                                        kExprUnreachable,
+                                        kExprI64RemU,
+                                        kExprI32Eqz,
+                                        kExprI64LeU,
+                                        kExprDrop,
+                                        kExprF32Add,
+                                        kExprI64Ior,
+                                        kExprF32CopySign,
+                                        kExprI64Ne,
+                                        kExprI64GeS,
+                                        kExprUnreachable,
+                                        kExprF32Trunc,
+                                        kExprF32Trunc,
+                                        kExprUnreachable,
+                                        kExprIf, 10,   // @216
+                                          kExprBlock, 00,   // @218
+                                            kExprBr,   // depth=109
+                                            kExprI64Shl,
+                                            kExprI64LeU,
+                                            kExprI64GeS,
+                                            kExprI64Clz,
+                                            kExprF32Min,
+                                            kExprF32Eq,
+                                            kExprF32Trunc,
+                                            kExprF32Trunc,
+                                            kExprF32Trunc,
+                                            kExprUnreachable,
+                                            kExprF64Min,
+                                            kExprI32Const,
+                                            kExprBr,   // depth=101
+                                            kExprF32Div,
+                                            kExprI64GtU,
+                                            kExprI64GeS,
+                                            kExprI64Clz,
+                                            kExprI64Popcnt,
+                                            kExprF64Lt,
+                                            kExprF32Trunc,
+                                            kExprF32Trunc,
+                                            kExprF32Trunc,
+                                            kExprUnreachable,
+                                            kExprLoop, 01,   // @247 i32
+                                            kExprElse,   // @249
+                                              kExprI64LeU,
+                                              kExprI64RemU,
+                                              kExprI64Ne,
+                                              kExprI64GeS,
+                                              kExprI32Const,
+                                              kExprBlock, 01,   // @256 i32
+                                                kExprBlock, 01,   // @258 i32
+                                                  kExprBlock, 01,   // @260 i32
+                                                    kExprBlock, 01,   // @262 i32
+                                                      kExprBlock, 01,   // @264 i32
+                                                        kExprF32Ge,
+                                                        kExprF32Trunc,
+                                                        kExprF32Trunc,
+                                                        kExprF32Trunc,
+                                                        kExprUnreachable,
+                                                        kExprLoop, 40,   // @271
+                                                          kExprUnreachable,
+                                                          kExprUnreachable,
+                                                          kExprI32Add,
+                                                          kExprBlock, 01,   // @276 i32
+                                                            kExprUnreachable,
+                                                            kExprIf, 02,   // @279 i64
+                                                              kExprBlock, 00,   // @281
+                                                                kExprBrIf,   // depth=16
+                                                                kExprLoop, 00,   // @285
+                                                                  kExprUnreachable,
+                                                                  kExprUnreachable,
+                                                                  kExprReturn,
+                                                                  kExprUnreachable,
+                                                                  kExprUnreachable,
+                                                                  kExprUnreachable,
+                                                                  kExprI64LoadMem16U,
+                                                                  kExprUnreachable,
+                                                                  kExprUnreachable,
+                                                                  kExprUnreachable,
+                                                                  kExprUnreachable,
+                                                                  kExprUnreachable,
+                                                                  kExprNop,
+                                                                  kExprBr,   // depth=1
+                                                                kExprElse,   // @304
+                                                                  kExprF32Trunc,
+                                                                  kExprI32Add,
+                                                                  kExprCallIndirect,   // sig #1
+                                                                  kExprUnreachable,
+                                                                  kExprUnreachable,
+                                                                  kExprUnreachable,
+                                                                  kExprBlock, 00,   // @312
+                                                                    kExprI64RemU,
+                                                                    kExprI64Ctz,
+                                                                    kExprI64LeU,
+                                                                    kExprUnreachable,
+                                                                    kExprUnreachable,
+                                                                    kExprUnreachable,
+                                                                    kExprDrop,
+                                                                    kExprI64Popcnt,
+                                                                    kExprF32Min,
+                                                                    kExprUnreachable,
+                                                                    kExprF64Sub,
+                                                                    kExprI32Const,
+                                                                    kExprUnreachable,
+                                                                    kExprGetLocal,
+                                                                    kExprI64LoadMem32U,
+                                                                    kExprUnreachable,
+                                                                    kExprUnreachable,
+                                                                    kExprNop,
+                                                                    kExprBr,   // depth=1
+                                                                  kExprElse,   // @348
+                                                                    kExprF32Trunc,
+                                                                    kExprI32Add,
+                                                                    kExprCallIndirect,   // sig #1
+                                                                    kExprUnreachable,
+                                                                    kExprUnreachable,
+                                                                    kExprUnreachable,
+                                                                    kExprBlock, 00,   // @356
+                                                                    kExprI64RemU,
+                                                                    kExprI64Ctz,
+                                                                    kExprI64LeU,
+                                                                    kExprUnreachable,
+                                                                    kExprUnreachable,
+                                                                    kExprUnreachable,
+                                                                    kExprDrop,
+                                                                    kExprI64Popcnt,
+                                                                    kExprF32Min,
+                                                                    kExprUnreachable,
+                                                                    kExprF64Sub,
+                                                                    kExprI32Const,
+                                                                    kExprUnreachable,
+                                                                    kExprGetLocal,
+                                                                    kExprI64LoadMem32U,
+                                                                    kExprF64Min,
+                                                                    kExprF64Min,
+                                                                    kExprF64Min,
+                                                                    kExprF64Min,
+                                                                    kExprF64Min,
+                                                                    kExprF32Trunc,
+                                                                    kExprF32Trunc,
+                                                                    kExprF32Trunc,
+                                                                    kExprUnreachable,
+                                                                    kExprF64Min,
+                                                                    kExprF64Min,
+                                                                    kExprF64Min,
+                                                                    kExprF64Min,
+                                                                    kExprF64Min,
+                                                                    kExprF64Min,
+                                                                    kExprF64Min,
+                                                                    kExprF64Min,
+                                                                    kExprF64Min,
+                                                                    kExprF64Min,
+            ])
+            .exportFunc();
+assertThrows(function() { builder.instantiate(); });
+})();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-651961.js b/deps/v8/test/mjsunit/regress/wasm/regression-651961.js
index abdec98358..30f6565d32 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regression-651961.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regression-651961.js
@@ -9,12 +9,12 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
 
 (function() {
   var builder = new WasmModuleBuilder();
-  builder.addMemory(1, 1, false);
+  builder.addMemory(1, 32, false);
   builder.addFunction("foo", kSig_i_v)
     .addBody([
-              kExprMemorySize,
+              kExprMemorySize, kMemoryZero,
               kExprI32Const, 0x10,
-              kExprGrowMemory,
+              kExprGrowMemory, kMemoryZero,
               kExprI32Mul,
               ])
               .exportFunc();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regression-654377.js b/deps/v8/test/mjsunit/regress/wasm/regression-654377.js
new file mode 100644
index 0000000000..871da72114
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regression-654377.js
@@ -0,0 +1,23 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function() {
+  var builder = new WasmModuleBuilder();
+  builder.addMemory(1, 1, false);
+  builder.addFunction("foo", kSig_i_v)
+    .addBody([
+              kExprI32Const, 00,
+              kExprMemorySize,
+              kExprBrIf, 00,
+              kExprMemorySize,
+              kExprBr, 0xe7, 0xd2, 0xf2, 0xff, 0x1d
+              ])
+              .exportFunc();
+  assertThrows(function() { builder.instantiate(); });
+})();