deps: patch V8 to 6.6.346.31

PR-URL: https://github.com/nodejs/node/pull/20603
Refs: https://github.com/v8/v8/compare/6.6.346.27...6.6.346.31
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Michaël Zasso <targos@protonmail.com>

17 files changed, 409 insertions, 38 deletions

diff --git a/deps/v8/include/v8-version.h b/deps/v8/include/v8-version.h
index 81f014cbd4..dac19fa621 100644
--- a/deps/v8/include/v8-version.h
+++ b/deps/v8/include/v8-version.h
@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 6
 #define V8_MINOR_VERSION 6
 #define V8_BUILD_NUMBER 346
-#define V8_PATCH_LEVEL 27
+#define V8_PATCH_LEVEL 31
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)
diff --git a/deps/v8/src/builtins/arm/builtins-arm.cc b/deps/v8/src/builtins/arm/builtins-arm.cc
index 1ea0bb733b..329fee575f 100644
--- a/deps/v8/src/builtins/arm/builtins-arm.cc
+++ b/deps/v8/src/builtins/arm/builtins-arm.cc
@@ -859,9 +859,13 @@ static void AdvanceBytecodeOffsetOrReturn(MacroAssembler* masm,
   Label process_bytecode, extra_wide;
   STATIC_ASSERT(0 == static_cast<int>(interpreter::Bytecode::kWide));
   STATIC_ASSERT(1 == static_cast<int>(interpreter::Bytecode::kExtraWide));
-  __ cmp(bytecode, Operand(0x1));
+  STATIC_ASSERT(2 == static_cast<int>(interpreter::Bytecode::kDebugBreakWide));
+  STATIC_ASSERT(3 ==
+                static_cast<int>(interpreter::Bytecode::kDebugBreakExtraWide));
+  __ cmp(bytecode, Operand(0x3));
   __ b(hi, &process_bytecode);
-  __ b(eq, &extra_wide);
+  __ tst(bytecode, Operand(0x1));
+  __ b(ne, &extra_wide);
 
   // Load the next bytecode and update table to the wide scaled table.
   __ add(bytecode_offset, bytecode_offset, Operand(1));
diff --git a/deps/v8/src/builtins/arm64/builtins-arm64.cc b/deps/v8/src/builtins/arm64/builtins-arm64.cc
index 54d2524d6e..f06969ec6b 100644
--- a/deps/v8/src/builtins/arm64/builtins-arm64.cc
+++ b/deps/v8/src/builtins/arm64/builtins-arm64.cc
@@ -952,9 +952,13 @@ static void AdvanceBytecodeOffsetOrReturn(MacroAssembler* masm,
   Label process_bytecode, extra_wide;
   STATIC_ASSERT(0 == static_cast<int>(interpreter::Bytecode::kWide));
   STATIC_ASSERT(1 == static_cast<int>(interpreter::Bytecode::kExtraWide));
-  __ Cmp(bytecode, Operand(0x1));
+  STATIC_ASSERT(2 == static_cast<int>(interpreter::Bytecode::kDebugBreakWide));
+  STATIC_ASSERT(3 ==
+                static_cast<int>(interpreter::Bytecode::kDebugBreakExtraWide));
+  __ Cmp(bytecode, Operand(0x3));
   __ B(hi, &process_bytecode);
-  __ B(eq, &extra_wide);
+  __ Tst(bytecode, Operand(0x1));
+  __ B(ne, &extra_wide);
 
   // Load the next bytecode and update table to the wide scaled table.
   __ Add(bytecode_offset, bytecode_offset, Operand(1));
diff --git a/deps/v8/src/builtins/builtins-promise-gen.cc b/deps/v8/src/builtins/builtins-promise-gen.cc
index d3ea3f82e2..032d0ef100 100644
--- a/deps/v8/src/builtins/builtins-promise-gen.cc
+++ b/deps/v8/src/builtins/builtins-promise-gen.cc
@@ -999,7 +999,7 @@ TF_BUILTIN(PromiseResolveThenableJob, PromiseBuiltinsAssembler) {
       // We need to reject the {thenable}.
       Node* const result = CallJS(
           CodeFactory::Call(isolate(), ConvertReceiverMode::kNullOrUndefined),
-          native_context, UndefinedConstant(), var_exception.value());
+          native_context, reject, UndefinedConstant(), var_exception.value());
       Return(result);
     }
   }
diff --git a/deps/v8/src/builtins/ia32/builtins-ia32.cc b/deps/v8/src/builtins/ia32/builtins-ia32.cc
index 3319dd0c51..5bc083f531 100644
--- a/deps/v8/src/builtins/ia32/builtins-ia32.cc
+++ b/deps/v8/src/builtins/ia32/builtins-ia32.cc
@@ -783,9 +783,13 @@ static void AdvanceBytecodeOffsetOrReturn(MacroAssembler* masm,
   Label process_bytecode, extra_wide;
   STATIC_ASSERT(0 == static_cast<int>(interpreter::Bytecode::kWide));
   STATIC_ASSERT(1 == static_cast<int>(interpreter::Bytecode::kExtraWide));
-  __ cmpb(bytecode, Immediate(0x1));
+  STATIC_ASSERT(2 == static_cast<int>(interpreter::Bytecode::kDebugBreakWide));
+  STATIC_ASSERT(3 ==
+                static_cast<int>(interpreter::Bytecode::kDebugBreakExtraWide));
+  __ cmpb(bytecode, Immediate(0x3));
   __ j(above, &process_bytecode, Label::kNear);
-  __ j(equal, &extra_wide, Label::kNear);
+  __ test(bytecode, Immediate(0x1));
+  __ j(not_equal, &extra_wide, Label::kNear);
 
   // Load the next bytecode and update table to the wide scaled table.
   __ inc(bytecode_offset);
diff --git a/deps/v8/src/builtins/mips/builtins-mips.cc b/deps/v8/src/builtins/mips/builtins-mips.cc
index e2d4421f86..0d42834612 100644
--- a/deps/v8/src/builtins/mips/builtins-mips.cc
+++ b/deps/v8/src/builtins/mips/builtins-mips.cc
@@ -840,8 +840,12 @@ static void AdvanceBytecodeOffsetOrReturn(MacroAssembler* masm,
   Label process_bytecode, extra_wide;
   STATIC_ASSERT(0 == static_cast<int>(interpreter::Bytecode::kWide));
   STATIC_ASSERT(1 == static_cast<int>(interpreter::Bytecode::kExtraWide));
-  __ Branch(&process_bytecode, hi, bytecode, Operand(1));
-  __ Branch(&extra_wide, eq, bytecode, Operand(1));
+  STATIC_ASSERT(2 == static_cast<int>(interpreter::Bytecode::kDebugBreakWide));
+  STATIC_ASSERT(3 ==
+                static_cast<int>(interpreter::Bytecode::kDebugBreakExtraWide));
+  __ Branch(&process_bytecode, hi, bytecode, Operand(3));
+  __ And(scratch2, bytecode, Operand(1));
+  __ Branch(&extra_wide, ne, scratch2, Operand(zero_reg));
 
   // Load the next bytecode and update table to the wide scaled table.
   __ Addu(bytecode_offset, bytecode_offset, Operand(1));
diff --git a/deps/v8/src/builtins/mips64/builtins-mips64.cc b/deps/v8/src/builtins/mips64/builtins-mips64.cc
index 80ac1fadb1..15fdfc3d7d 100644
--- a/deps/v8/src/builtins/mips64/builtins-mips64.cc
+++ b/deps/v8/src/builtins/mips64/builtins-mips64.cc
@@ -837,8 +837,12 @@ static void AdvanceBytecodeOffsetOrReturn(MacroAssembler* masm,
   Label process_bytecode, extra_wide;
   STATIC_ASSERT(0 == static_cast<int>(interpreter::Bytecode::kWide));
   STATIC_ASSERT(1 == static_cast<int>(interpreter::Bytecode::kExtraWide));
-  __ Branch(&process_bytecode, hi, bytecode, Operand(1));
-  __ Branch(&extra_wide, eq, bytecode, Operand(1));
+  STATIC_ASSERT(2 == static_cast<int>(interpreter::Bytecode::kDebugBreakWide));
+  STATIC_ASSERT(3 ==
+                static_cast<int>(interpreter::Bytecode::kDebugBreakExtraWide));
+  __ Branch(&process_bytecode, hi, bytecode, Operand(3));
+  __ And(scratch2, bytecode, Operand(1));
+  __ Branch(&extra_wide, ne, scratch2, Operand(zero_reg));
 
   // Load the next bytecode and update table to the wide scaled table.
   __ Daddu(bytecode_offset, bytecode_offset, Operand(1));
diff --git a/deps/v8/src/builtins/ppc/builtins-ppc.cc b/deps/v8/src/builtins/ppc/builtins-ppc.cc
index 7ae635b0c1..9206920d45 100644
--- a/deps/v8/src/builtins/ppc/builtins-ppc.cc
+++ b/deps/v8/src/builtins/ppc/builtins-ppc.cc
@@ -859,9 +859,13 @@ static void AdvanceBytecodeOffsetOrReturn(MacroAssembler* masm,
   Label process_bytecode, extra_wide;
   STATIC_ASSERT(0 == static_cast<int>(interpreter::Bytecode::kWide));
   STATIC_ASSERT(1 == static_cast<int>(interpreter::Bytecode::kExtraWide));
-  __ cmpi(bytecode, Operand(0x1));
+  STATIC_ASSERT(2 == static_cast<int>(interpreter::Bytecode::kDebugBreakWide));
+  STATIC_ASSERT(3 ==
+                static_cast<int>(interpreter::Bytecode::kDebugBreakExtraWide));
+  __ cmpi(bytecode, Operand(0x3));
   __ bgt(&process_bytecode);
-  __ beq(&extra_wide);
+  __ andi(r0, bytecode, Operand(0x1));
+  __ bne(&extra_wide, cr0);
 
   // Load the next bytecode and update table to the wide scaled table.
   __ addi(bytecode_offset, bytecode_offset, Operand(1));
diff --git a/deps/v8/src/builtins/s390/builtins-s390.cc b/deps/v8/src/builtins/s390/builtins-s390.cc
index 9d7bc3fb80..86239e0052 100644
--- a/deps/v8/src/builtins/s390/builtins-s390.cc
+++ b/deps/v8/src/builtins/s390/builtins-s390.cc
@@ -861,9 +861,13 @@ static void AdvanceBytecodeOffsetOrReturn(MacroAssembler* masm,
   Label process_bytecode, extra_wide;
   STATIC_ASSERT(0 == static_cast<int>(interpreter::Bytecode::kWide));
   STATIC_ASSERT(1 == static_cast<int>(interpreter::Bytecode::kExtraWide));
-  __ CmpP(bytecode, Operand(0x1));
+  STATIC_ASSERT(2 == static_cast<int>(interpreter::Bytecode::kDebugBreakWide));
+  STATIC_ASSERT(3 ==
+                static_cast<int>(interpreter::Bytecode::kDebugBreakExtraWide));
+  __ CmpP(bytecode, Operand(0x3));
   __ bgt(&process_bytecode);
-  __ beq(&extra_wide);
+  __ tmll(bytecode, Operand(0x1));
+  __ bne(&extra_wide);
 
   // Load the next bytecode and update table to the wide scaled table.
   __ AddP(bytecode_offset, bytecode_offset, Operand(1));
diff --git a/deps/v8/src/builtins/x64/builtins-x64.cc b/deps/v8/src/builtins/x64/builtins-x64.cc
index 898fe9c14c..ae7e0c151e 100644
--- a/deps/v8/src/builtins/x64/builtins-x64.cc
+++ b/deps/v8/src/builtins/x64/builtins-x64.cc
@@ -848,9 +848,13 @@ static void AdvanceBytecodeOffsetOrReturn(MacroAssembler* masm,
   Label process_bytecode, extra_wide;
   STATIC_ASSERT(0 == static_cast<int>(interpreter::Bytecode::kWide));
   STATIC_ASSERT(1 == static_cast<int>(interpreter::Bytecode::kExtraWide));
-  __ cmpb(bytecode, Immediate(0x1));
+  STATIC_ASSERT(2 == static_cast<int>(interpreter::Bytecode::kDebugBreakWide));
+  STATIC_ASSERT(3 ==
+                static_cast<int>(interpreter::Bytecode::kDebugBreakExtraWide));
+  __ cmpb(bytecode, Immediate(0x3));
   __ j(above, &process_bytecode, Label::kNear);
-  __ j(equal, &extra_wide, Label::kNear);
+  __ testb(bytecode, Immediate(0x1));
+  __ j(not_equal, &extra_wide, Label::kNear);
 
   // Load the next bytecode and update table to the wide scaled table.
   __ incl(bytecode_offset);
diff --git a/deps/v8/src/compiler/js-call-reducer.cc b/deps/v8/src/compiler/js-call-reducer.cc
index f229cdefed..417191c680 100644
--- a/deps/v8/src/compiler/js-call-reducer.cc
+++ b/deps/v8/src/compiler/js-call-reducer.cc
@@ -5135,6 +5135,7 @@ Reduction JSCallReducer::ReducePromisePrototypeThen(Node* node) {
   Node* context = NodeProperties::GetContextInput(node);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
+  Node* frame_state = NodeProperties::GetFrameStateInput(node);
 
   // Check that promises aren't being observed through (debug) hooks.
   if (!isolate()->IsPromiseHookProtectorIntact()) return NoChange();
@@ -5193,9 +5194,9 @@ Reduction JSCallReducer::ReducePromisePrototypeThen(Node* node) {
       graph()->NewNode(javascript()->CreatePromise(), context, effect);
 
   // Chain {result} onto {receiver}.
-  result = effect = graph()->NewNode(javascript()->PerformPromiseThen(),
-                                     receiver, on_fulfilled, on_rejected,
-                                     result, context, effect, control);
+  result = effect = graph()->NewNode(
+      javascript()->PerformPromiseThen(), receiver, on_fulfilled, on_rejected,
+      result, context, frame_state, effect, control);
   ReplaceWithValue(node, result, effect, control);
   return Replace(result);
 }
diff --git a/deps/v8/src/compiler/operator-properties.cc b/deps/v8/src/compiler/operator-properties.cc
index bd715df25e..673d643da0 100644
--- a/deps/v8/src/compiler/operator-properties.cc
+++ b/deps/v8/src/compiler/operator-properties.cc
@@ -118,6 +118,7 @@ bool OperatorProperties::HasFrameStateInput(const Operator* op) {
     case IrOpcode::kJSPromiseResolve:
     case IrOpcode::kJSRejectPromise:
     case IrOpcode::kJSResolvePromise:
+    case IrOpcode::kJSPerformPromiseThen:
       return true;
 
     default:
diff --git a/deps/v8/src/interpreter/bytecodes.h b/deps/v8/src/interpreter/bytecodes.h
index 293c0562e9..be31f27c76 100644
--- a/deps/v8/src/interpreter/bytecodes.h
+++ b/deps/v8/src/interpreter/bytecodes.h
@@ -28,6 +28,23 @@ namespace interpreter {
   V(Wide, AccumulatorUse::kNone)                                               \
   V(ExtraWide, AccumulatorUse::kNone)                                          \
                                                                                \
+  /* Debug Breakpoints - one for each possible size of unscaled bytecodes */   \
+  /* and one for each operand widening prefix bytecode                    */   \
+  V(DebugBreakWide, AccumulatorUse::kReadWrite)                                \
+  V(DebugBreakExtraWide, AccumulatorUse::kReadWrite)                           \
+  V(DebugBreak0, AccumulatorUse::kReadWrite)                                   \
+  V(DebugBreak1, AccumulatorUse::kReadWrite, OperandType::kReg)                \
+  V(DebugBreak2, AccumulatorUse::kReadWrite, OperandType::kReg,                \
+    OperandType::kReg)                                                         \
+  V(DebugBreak3, AccumulatorUse::kReadWrite, OperandType::kReg,                \
+    OperandType::kReg, OperandType::kReg)                                      \
+  V(DebugBreak4, AccumulatorUse::kReadWrite, OperandType::kReg,                \
+    OperandType::kReg, OperandType::kReg, OperandType::kReg)                   \
+  V(DebugBreak5, AccumulatorUse::kReadWrite, OperandType::kRuntimeId,          \
+    OperandType::kReg, OperandType::kReg)                                      \
+  V(DebugBreak6, AccumulatorUse::kReadWrite, OperandType::kRuntimeId,          \
+    OperandType::kReg, OperandType::kReg, OperandType::kReg)                   \
+                                                                               \
   /* Loading the accumulator */                                                \
   V(LdaZero, AccumulatorUse::kWrite)                                           \
   V(LdaSmi, AccumulatorUse::kWrite, OperandType::kImm)                         \
@@ -325,23 +342,6 @@ namespace interpreter {
   /* Debugger */                                                               \
   V(Debugger, AccumulatorUse::kNone)                                           \
                                                                                \
-  /* Debug Breakpoints - one for each possible size of unscaled bytecodes */   \
-  /* and one for each operand widening prefix bytecode                    */   \
-  V(DebugBreak0, AccumulatorUse::kReadWrite)                                   \
-  V(DebugBreak1, AccumulatorUse::kReadWrite, OperandType::kReg)                \
-  V(DebugBreak2, AccumulatorUse::kReadWrite, OperandType::kReg,                \
-    OperandType::kReg)                                                         \
-  V(DebugBreak3, AccumulatorUse::kReadWrite, OperandType::kReg,                \
-    OperandType::kReg, OperandType::kReg)                                      \
-  V(DebugBreak4, AccumulatorUse::kReadWrite, OperandType::kReg,                \
-    OperandType::kReg, OperandType::kReg, OperandType::kReg)                   \
-  V(DebugBreak5, AccumulatorUse::kReadWrite, OperandType::kRuntimeId,          \
-    OperandType::kReg, OperandType::kReg)                                      \
-  V(DebugBreak6, AccumulatorUse::kReadWrite, OperandType::kRuntimeId,          \
-    OperandType::kReg, OperandType::kReg, OperandType::kReg)                   \
-  V(DebugBreakWide, AccumulatorUse::kReadWrite)                                \
-  V(DebugBreakExtraWide, AccumulatorUse::kReadWrite)                           \
-                                                                               \
   /* Block Coverage */                                                         \
   V(IncBlockCounter, AccumulatorUse::kNone, OperandType::kIdx)                 \
                                                                                \
diff --git a/deps/v8/test/cctest/test-api.cc b/deps/v8/test/cctest/test-api.cc
index 40ba60ffb3..5d4c260752 100644
--- a/deps/v8/test/cctest/test-api.cc
+++ b/deps/v8/test/cctest/test-api.cc
@@ -17641,6 +17641,35 @@ TEST(PromiseRejectCallback) {
   CHECK_EQ(7, promise_reject_msg_column_number);
 }
 
+void PromiseRejectCallbackConstructError(
+    v8::PromiseRejectMessage reject_message) {
+  v8::Local<v8::Context> context = CcTest::isolate()->GetCurrentContext();
+  CHECK_EQ(v8::Promise::PromiseState::kRejected,
+           reject_message.GetPromise()->State());
+  USE(v8::Script::Compile(context, v8_str("new Error('test')"))
+          .ToLocalChecked()
+          ->Run(context));
+}
+
+TEST(PromiseRejectCallbackConstructError) {
+  i::FLAG_allow_natives_syntax = true;
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  v8::HandleScope scope(isolate);
+
+  isolate->SetPromiseRejectCallback(PromiseRejectCallbackConstructError);
+
+  ResetPromiseStates();
+  CompileRun(
+      "function f(p) {"
+      "    p.catch(() => {});"
+      "}"
+      "f(Promise.reject());"
+      "f(Promise.reject());"
+      "%OptimizeFunctionOnNextCall(f);"
+      "let p = Promise.reject();"
+      "f(p);");
+}
 
 void AnalyzeStackOfEvalWithSourceURL(
     const v8::FunctionCallbackInfo<v8::Value>& args) {
diff --git a/deps/v8/test/debugger/regress/regress-crbug-835973.js b/deps/v8/test/debugger/regress/regress-crbug-835973.js
new file mode 100644
index 0000000000..c2df20c94a
--- /dev/null
+++ b/deps/v8/test/debugger/regress/regress-crbug-835973.js
@@ -0,0 +1,289 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Test that stepping works correctly with bytecode scaling prefix.
+class MyClass { f(p) { this.x += p; } };
+
+let obj = new MyClass();
+
+function foo() {
+  obj.f(0);
+  obj.f(1);
+  obj.f(2);
+  obj.f(3);
+  obj.f(4);
+  obj.f(5);
+  obj.f(6);
+  obj.f(7);
+  obj.f(8);
+  obj.f(9);
+  obj.f(10);
+  obj.f(11);
+  obj.f(12);
+  obj.f(13);
+  obj.f(14);
+  obj.f(15);
+  obj.f(16);
+  obj.f(17);
+  obj.f(18);
+  obj.f(19);
+  obj.f(20);
+  obj.f(21);
+  obj.f(22);
+  obj.f(23);
+  obj.f(24);
+  obj.f(25);
+  obj.f(26);
+  obj.f(27);
+  obj.f(28);
+  obj.f(29);
+  obj.f(30);
+  obj.f(31);
+  obj.f(32);
+  obj.f(33);
+  obj.f(34);
+  obj.f(35);
+  obj.f(36);
+  obj.f(37);
+  obj.f(38);
+  obj.f(39);
+  obj.f(40);
+  obj.f(41);
+  obj.f(42);
+  obj.f(43);
+  obj.f(44);
+  obj.f(45);
+  obj.f(46);
+  obj.f(47);
+  obj.f(48);
+  obj.f(49);
+  obj.f(50);
+  obj.f(51);
+  obj.f(52);
+  obj.f(53);
+  obj.f(54);
+  obj.f(55);
+  obj.f(56);
+  obj.f(57);
+  obj.f(58);
+  obj.f(59);
+  obj.f(60);
+  obj.f(61);
+  obj.f(62);
+  obj.f(63);
+  obj.f(64);
+  obj.f(65);
+  obj.f(66);
+  obj.f(67);
+  obj.f(68);
+  obj.f(69);
+  obj.f(70);
+  obj.f(71);
+  obj.f(72);
+  obj.f(73);
+  obj.f(74);
+  obj.f(75);
+  obj.f(76);
+  obj.f(77);
+  obj.f(78);
+  obj.f(79);
+  obj.f(80);
+  obj.f(81);
+  obj.f(82);
+  obj.f(83);
+  obj.f(84);
+  obj.f(85);
+  obj.f(86);
+  obj.f(87);
+  obj.f(88);
+  obj.f(89);
+  obj.f(90);
+  obj.f(91);
+  obj.f(92);
+  obj.f(93);
+  obj.f(94);
+  obj.f(95);
+  obj.f(96);
+  obj.f(97);
+  obj.f(98);
+  obj.f(99);
+  obj.f(100);
+  obj.f(101);
+  obj.f(102);
+  obj.f(103);
+  obj.f(104);
+  obj.f(105);
+  obj.f(106);
+  obj.f(107);
+  obj.f(108);
+  obj.f(109);
+  obj.f(110);
+  obj.f(111);
+  obj.f(112);
+  obj.f(113);
+  obj.f(114);
+  obj.f(115);
+  obj.f(116);
+  obj.f(117);
+  obj.f(118);
+  obj.f(119);
+  obj.f(120);
+  obj.f(121);
+  obj.f(122);
+  obj.f(123);
+  obj.f(124);
+  obj.f(125);
+  obj.f(126);
+  obj.f(127);
+  obj.f(128);
+  obj.f(129);
+  obj.f(130);
+  obj.f(131);
+  obj.f(132);
+  obj.f(133);
+  obj.f(134);
+  obj.f(135);
+  obj.f(136);
+  obj.f(137);
+  obj.f(138);
+  obj.f(139);
+  obj.f(140);
+  obj.f(141);
+  obj.f(142);
+  obj.f(143);
+  obj.f(144);
+  obj.f(145);
+  obj.f(146);
+  obj.f(147);
+  obj.f(148);
+  obj.f(149);
+  obj.f(150);
+  obj.f(151);
+  obj.f(152);
+  obj.f(153);
+  obj.f(154);
+  obj.f(155);
+  obj.f(156);
+  obj.f(157);
+  obj.f(158);
+  obj.f(159);
+  obj.f(160);
+  obj.f(161);
+  obj.f(162);
+  obj.f(163);
+  obj.f(164);
+  obj.f(165);
+  obj.f(166);
+  obj.f(167);
+  obj.f(168);
+  obj.f(169);
+  obj.f(170);
+  obj.f(171);
+  obj.f(172);
+  obj.f(173);
+  obj.f(174);
+  obj.f(175);
+  obj.f(176);
+  obj.f(177);
+  obj.f(178);
+  obj.f(179);
+  obj.f(180);
+  obj.f(181);
+  obj.f(182);
+  obj.f(183);
+  obj.f(184);
+  obj.f(185);
+  obj.f(186);
+  obj.f(187);
+  obj.f(188);
+  obj.f(189);
+  obj.f(190);
+  obj.f(191);
+  obj.f(192);
+  obj.f(193);
+  obj.f(194);
+  obj.f(195);
+  obj.f(196);
+  obj.f(197);
+  obj.f(198);
+  obj.f(199);
+  obj.f(200);
+  obj.f(201);
+  obj.f(202);
+  obj.f(203);
+  obj.f(204);
+  obj.f(205);
+  obj.f(206);
+  obj.f(207);
+  obj.f(208);
+  obj.f(209);
+  obj.f(210);
+  obj.f(211);
+  obj.f(212);
+  obj.f(213);
+  obj.f(214);
+  obj.f(215);
+  obj.f(216);
+  obj.f(217);
+  obj.f(218);
+  obj.f(219);
+  obj.f(220);
+  obj.f(221);
+  obj.f(222);
+  obj.f(223);
+  obj.f(224);
+  obj.f(225);
+  obj.f(226);
+  obj.f(227);
+  obj.f(228);
+  obj.f(229);
+  obj.f(230);
+  obj.f(231);
+  obj.f(232);
+  obj.f(233);
+  obj.f(234);
+  obj.f(235);
+  obj.f(236);
+  obj.f(237);
+  obj.f(238);
+  obj.f(239);
+  obj.f(240);
+  obj.f(241);
+  obj.f(242);
+  obj.f(243);
+  obj.f(244);
+  obj.f(245);
+  obj.f(246);
+  obj.f(247);
+  obj.f(248);
+  obj.f(249);
+  obj.f(250);
+  obj.f(251);
+  obj.f(252);
+  obj.f(253);
+  obj.f(254);
+  obj.f(255);
+  debugger;
+  obj.f(256);
+  obj.f(257);
+  obj.f(258);
+  obj.f(259);
+}
+
+let break_count = 0;
+
+function listener(event, exec_state, event_data, data) {
+  if (event != debug.Debug.DebugEvent.Break) return;
+  try {
+    exec_state.prepareStep(debug.Debug.StepAction.StepNext);
+    break_count++;
+  } catch {
+    %AbortJS("unexpected exception");
+  }
+}
+
+debug.Debug.setListener(listener);
+foo();
+debug.Debug.setListener(null);
+assertEquals(7, break_count);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-830565.js b/deps/v8/test/mjsunit/regress/regress-crbug-830565.js
new file mode 100644
index 0000000000..ee2c3bdaca
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-830565.js
@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+testAsync(assert => {
+  assert.plan(1);
+  const error = new TypeError('Throwing');
+  Promise.resolve({ then(resolve, reject) {
+    throw error;
+  }}).then(v => {
+    assert.unreachable();
+  }, e => {
+    assert.equals(error, e);
+  });
+});
diff --git a/deps/v8/test/webkit/fast/js/Promise-resolve-with-then-exception-expected.txt b/deps/v8/test/webkit/fast/js/Promise-resolve-with-then-exception-expected.txt
index 8b44ae59b5..7c2a301dc3 100644
--- a/deps/v8/test/webkit/fast/js/Promise-resolve-with-then-exception-expected.txt
+++ b/deps/v8/test/webkit/fast/js/Promise-resolve-with-then-exception-expected.txt
@@ -3,6 +3,8 @@ Test whether Promise treats thenable correctly.
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 The promise is already rejected now.
+PASS rejected
+PASS result is "hello"
 PASS successfullyParsed is true
 
 TEST COMPLETE