deps: update V8 to 6.5.254.31

PR-URL: https://github.com/nodejs/node/pull/18453
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Yang Guo <yangguo@chromium.org>
Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

7 files changed, 131 insertions, 0 deletions

diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-791810.js b/deps/v8/test/mjsunit/regress/wasm/regress-791810.js
new file mode 100644
index 0000000000..cd6c4e2728
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-791810.js
@@ -0,0 +1,21 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addFunction('test', kSig_i_i)
+    .addBody([
+      kExprGetLocal, 0x00,    // get_local 0
+      kExprBlock, kWasmStmt,  // block
+      kExprBr, 0x00,          // br depth=0
+      kExprEnd,               // end
+      kExprBlock, kWasmStmt,  // block
+      kExprBr, 0x00,          // br depth=0
+      kExprEnd,               // end
+      kExprBr, 0x00,          // br depth=0
+    ])
+    .exportFunc();
+builder.instantiate();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-793551.js b/deps/v8/test/mjsunit/regress/wasm/regress-793551.js
new file mode 100644
index 0000000000..8aa0241923
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-793551.js
@@ -0,0 +1,20 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addFunction('test', kSig_i_i)
+    .addBody([
+      // body:
+      kExprGetLocal, 0,      // get_local 0
+      kExprGetLocal, 0,      // get_local 0
+      kExprLoop, kWasmStmt,  // loop
+      kExprBr, 0,            // br depth=0
+      kExprEnd,              // end
+      kExprUnreachable,      // unreachable
+    ])
+    .exportFunc();
+builder.instantiate();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-797846.js b/deps/v8/test/mjsunit/regress/wasm/regress-797846.js
new file mode 100644
index 0000000000..6a4fd5c5f7
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-797846.js
@@ -0,0 +1,14 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+// We need a module with one valid function.
+const builder = new WasmModuleBuilder();
+builder.addFunction('test', kSig_v_v).addBody([]);
+
+const buffer = builder.toBuffer();
+assertPromiseResult(
+    WebAssembly.compile(buffer), _ => Realm.createAllowCrossRealmAccess());
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-800756.js b/deps/v8/test/mjsunit/regress/wasm/regress-800756.js
new file mode 100644
index 0000000000..2d29997cef
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-800756.js
@@ -0,0 +1,15 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(16, 32);
+builder.addFunction(undefined, kSig_i_iii).addBody([
+  kExprI32Const, 0,         // i32.const 0
+  kExprI32LoadMem8S, 0, 0,  // i32.load8_s offset=0 align=0
+  kExprI32Eqz,              // i32.eqz
+]);
+builder.instantiate();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-801850.js b/deps/v8/test/mjsunit/regress/wasm/regress-801850.js
new file mode 100644
index 0000000000..ad6ff4c432
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-801850.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+let module = new WebAssembly.Module(builder.toBuffer());
+var worker = new Worker('onmessage = function() {};');
+worker.postMessage(module)
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-802244.js b/deps/v8/test/mjsunit/regress/wasm/regress-802244.js
new file mode 100644
index 0000000000..0b8decb637
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-802244.js
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addFunction(undefined, kSig_v_iii).addBody([
+  kExprI32Const, 0x41,  // i32.const 0x41
+  kExprLoop, 0x7c,      // loop f64
+  kExprGetLocal, 0x00,  // get_local 0
+  kExprGetLocal, 0x01,  // get_local 1
+  kExprBrIf, 0x01,      // br_if depth=1
+  kExprGetLocal, 0x00,  // get_local 0
+  kExprI32Rol,          // i32.rol
+  kExprBrIf, 0x00,      // br_if depth=0
+  kExprUnreachable,     // unreachable
+  kExprEnd,             // end
+  kExprUnreachable,     // unreachable
+]);
+builder.instantiate();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-808980.js b/deps/v8/test/mjsunit/regress/wasm/regress-808980.js
new file mode 100644
index 0000000000..884572b895
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-808980.js
@@ -0,0 +1,28 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --throws
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+let kTableSize = 3;
+
+var builder = new WasmModuleBuilder();
+var sig_index1 = builder.addType(kSig_i_v);
+builder.addFunction('main', kSig_i_ii).addBody([
+    kExprGetLocal,
+    0,
+    kExprCallIndirect,
+    sig_index1,
+    kTableZero
+]).exportAs('main');
+builder.setFunctionTableBounds(kTableSize, kTableSize);
+var m1_bytes = builder.toBuffer();
+var m1 = new WebAssembly.Module(m1_bytes);
+
+var serialized_m1 = %SerializeWasmModule(m1);
+var m1_clone = %DeserializeWasmModule(serialized_m1, m1_bytes);
+var i1 = new WebAssembly.Instance(m1_clone);
+
+i1.exports.main(123123);