deps: update V8 to 6.0.286.52

PR-URL: https://github.com/nodejs/node/pull/14004
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

12 files changed, 242 insertions, 57 deletions

diff --git a/deps/v8/test/mjsunit/wasm/asm-wasm-expr.js b/deps/v8/test/mjsunit/wasm/asm-wasm-expr.js
index 3b20826fe7..ac42759788 100644
--- a/deps/v8/test/mjsunit/wasm/asm-wasm-expr.js
+++ b/deps/v8/test/mjsunit/wasm/asm-wasm-expr.js
@@ -23,7 +23,7 @@ const assign_in_stmt = [
   "do { S } while (=)",
 ];
 const assign_in_expr = [
-  "i32_func(=)",
+  "i32_func(=) | 0",
   "(=) ? E : E",
   "E ? (=) : E",
   "E ? E : (=)",
@@ -108,9 +108,6 @@ function DoTheTests(expr, assign, stmt) {
     e = e.replace(/S/g, stmt);
     var str = main.toString().replace("FUNC_BODY", "return (" + e + ") | 0;");
     var asm_source = MODULE_TEMPLATE.toString().replace("FUNC_DECL", str);
-    // TODO(titzer): a verbosity API for these kinds of tests?
-    //    print(asm_source);
-
     doTest(asm_source, "(" + test + ") " + e);
   }
 
@@ -123,8 +120,6 @@ function DoTheTests(expr, assign, stmt) {
     e = e.replace(/S/g, stmt);
     var str = main.toString().replace("FUNC_BODY",  e + "; return 0;");
     var asm_source = MODULE_TEMPLATE.toString().replace("FUNC_DECL", str);
-//    print(asm_source);
-
     doTest(asm_source, "(" + test + ") " + e);
   }
 
@@ -134,9 +129,8 @@ function DoTheTests(expr, assign, stmt) {
     var js_module = eval("(" + nonasm_source + ")")(stdlib, {}, buffer);
     expect(js_module);
 
-    var asmfunc = eval("(" + asm_source + ")");
-
     print("Testing ASMJS: " + orig);
+    var asmfunc = eval("(" + asm_source + ")");
     var asm_module = asmfunc(stdlib, {}, buffer);
     assertTrue(%IsAsmWasmCode(asmfunc));
     expect(asm_module);
diff --git a/deps/v8/test/mjsunit/wasm/asm-wasm.js b/deps/v8/test/mjsunit/wasm/asm-wasm.js
index a5d04ce4fe..9d7a807bc9 100644
--- a/deps/v8/test/mjsunit/wasm/asm-wasm.js
+++ b/deps/v8/test/mjsunit/wasm/asm-wasm.js
@@ -549,7 +549,6 @@ function TestHeapAccessIntTypes() {
     assertValidAsm(module_decl);
     assertEquals(7, module.caller());
     assertEquals(7, memory_view[2]);
-    assertEquals(7, module_decl(stdlib).caller());
     assertValidAsm(module_decl);
   }
 }
@@ -1227,8 +1226,9 @@ TestForeignVariables();
     return {load: load, iload: iload, store: store, storeb: storeb};
   }
 
+  var memory = new ArrayBuffer(1024);
   var module_decl = eval('(' + TestByteHeapAccessCompat.toString() + ')');
-  var m = module_decl(stdlib);
+  var m = module_decl(stdlib, null, memory);
   assertValidAsm(module_decl);
   m.store(0, 20);
   m.store(4, 21);
diff --git a/deps/v8/test/mjsunit/wasm/async-compile.js b/deps/v8/test/mjsunit/wasm/async-compile.js
index 135e39a9d8..b95930aa5a 100644
--- a/deps/v8/test/mjsunit/wasm/async-compile.js
+++ b/deps/v8/test/mjsunit/wasm/async-compile.js
@@ -7,43 +7,66 @@
 load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
-let ok_buffer = (() => {
-  var builder = new WasmModuleBuilder();
-  builder.addFunction("f", kSig_i_v)
-    .addBody([kExprI32Const, 42])
-    .exportAs("f");
-  return builder.toBuffer();
-})();
-
-// The OK buffer validates and can be made into a module.
-assertTrue(WebAssembly.validate(ok_buffer));
-let ok_module = new WebAssembly.Module(ok_buffer);
-assertTrue(ok_module instanceof WebAssembly.Module);
-
-// The bad buffer does not validate and cannot be made into a module.
-let bad_buffer = new ArrayBuffer(0);
-assertFalse(WebAssembly.validate(bad_buffer));
-assertThrows(() => new WebAssembly.Module(bad_buffer), WebAssembly.CompileError);
-
-function checkModule(module) {
-  assertTrue(module instanceof WebAssembly.Module);
+function assertCompiles(buffer) {
+  return assertPromiseResult(
+      WebAssembly.compile(buffer),
+      module => assertTrue(module instanceof WebAssembly.Module),
+      ex => assertUnreachable);
 }
 
-function checkCompileError(ex) {
-  assertTrue(ex instanceof WebAssembly.CompileError);
+function assertCompileError(buffer) {
+  return assertPromiseResult(
+      WebAssembly.compile(buffer), module => assertUnreachable,
+      ex => assertTrue(ex instanceof WebAssembly.CompileError));
 }
 
-let kNumCompiles = 3;
+assertPromiseResult(async function basicCompile() {
+  let ok_buffer = (() => {
+    var builder = new WasmModuleBuilder();
+    builder.addFunction('f', kSig_i_v)
+        .addBody([kExprI32Const, 42])
+        .exportAs('f');
+    return builder.toBuffer();
+  })();
 
-// Three compilations of the OK module should succeed.
-for (var i = 0; i < kNumCompiles; i++) {
-  assertPromiseResult(WebAssembly.compile(ok_buffer), checkModule,
-              (ex) => assertUnreachable);
-}
+  // The OK buffer validates and can be made into a module.
+  assertTrue(WebAssembly.validate(ok_buffer));
+  let ok_module = new WebAssembly.Module(ok_buffer);
+  assertTrue(ok_module instanceof WebAssembly.Module);
 
-// Three compilations of the bad module should fail.
-for (var i = 0; i < kNumCompiles; i++) {
-  assertPromiseResult(WebAssembly.compile(bad_buffer),
-              (module) => assertUnreachable,
-              checkCompileError);
-}
+  // The bad buffer does not validate and cannot be made into a module.
+  let bad_buffer = new ArrayBuffer(0);
+  assertFalse(WebAssembly.validate(bad_buffer));
+  assertThrows(
+      () => new WebAssembly.Module(bad_buffer), WebAssembly.CompileError);
+
+  let kNumCompiles = 3;
+
+  // Three compilations of the OK module should succeed.
+  for (var i = 0; i < kNumCompiles; i++) {
+    await assertCompiles(ok_buffer);
+  }
+
+  // Three compilations of the bad module should fail.
+  for (var i = 0; i < kNumCompiles; i++) {
+    await assertCompileError(bad_buffer);
+  }
+}());
+
+assertPromiseResult(async function badFunctionInTheMiddle() {
+  // We had an error where an exception was generated by a background task and
+  // later thrown in a foreground task. The handle to the exception died
+  // inbetween, since the HandleScope was left.
+  // This test reproduced that error.
+  let builder = new WasmModuleBuilder();
+  let sig = builder.addType(kSig_i_v);
+  for (var i = 0; i < 10; ++i) {
+    builder.addFunction('a' + i, sig).addBody([kExprI32Const, 42]);
+  }
+  builder.addFunction('bad', sig).addBody([]);
+  for (var i = 0; i < 10; ++i) {
+    builder.addFunction('b' + i, sig).addBody([kExprI32Const, 42]);
+  }
+  let buffer = builder.toBuffer();
+  await assertCompileError(buffer);
+}());
diff --git a/deps/v8/test/mjsunit/wasm/compilation-limits.js b/deps/v8/test/mjsunit/wasm/compilation-limits.js
index 1a4fa0a8ea..2cc38bdfea 100644
--- a/deps/v8/test/mjsunit/wasm/compilation-limits.js
+++ b/deps/v8/test/mjsunit/wasm/compilation-limits.js
@@ -106,8 +106,4 @@ async function TestAll() {
   await FailAsyncInstantiate();
 }
 
-%IncrementWaitCount();
-TestAll().then(
-  () => { %DecrementWaitCount(); },
-  () => { %DecrementWaitCount(); }
-);
+assertPromiseResult(TestAll());
diff --git a/deps/v8/test/mjsunit/wasm/gc-buffer.js b/deps/v8/test/mjsunit/wasm/gc-buffer.js
index 6bcf299d8b..f187d7dabe 100644
--- a/deps/v8/test/mjsunit/wasm/gc-buffer.js
+++ b/deps/v8/test/mjsunit/wasm/gc-buffer.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-wasm  --stress-gc --expose-gc
+// Flags: --expose-wasm --gc-interval=500 --stress-compaction --expose-gc
 
 load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
diff --git a/deps/v8/test/mjsunit/wasm/gc-stress.js b/deps/v8/test/mjsunit/wasm/gc-stress.js
index 2bf2f758d6..a6c408d3db 100644
--- a/deps/v8/test/mjsunit/wasm/gc-stress.js
+++ b/deps/v8/test/mjsunit/wasm/gc-stress.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-wasm  --stress-gc
+// Flags: --expose-wasm --gc-interval=500 --stress-compaction
 
 load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
diff --git a/deps/v8/test/mjsunit/wasm/huge-memory.js b/deps/v8/test/mjsunit/wasm/huge-memory.js
new file mode 100644
index 0000000000..9719ad4a28
--- /dev/null
+++ b/deps/v8/test/mjsunit/wasm/huge-memory.js
@@ -0,0 +1,76 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-max-mem-pages=49152
+
+// This test makes sure things don't break once we support >2GB wasm memories.
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+function testHugeMemory() {
+  var builder = new WasmModuleBuilder();
+
+  const num_pages = 49152;  // 3GB
+
+  builder.addMemory(num_pages, num_pages, true);
+  builder.addFunction("geti", kSig_i_ii)
+    .addBody([
+      kExprGetLocal, 0,
+      kExprGetLocal, 1,
+      kExprI32Mul,
+      kExprI32LoadMem, 0, 0,
+    ])
+    .exportFunc();
+
+  var module = builder.instantiate();
+  const geti = module.exports.geti;
+
+  print("In bounds");
+  assertEquals(0, geti(2500, 1 << 20));
+  print("Out of bounds");
+  assertTraps(kTrapMemOutOfBounds, () => geti(3500, 1 << 20));
+}
+testHugeMemory();
+
+function testHugeMemoryConstInBounds() {
+  var builder = new WasmModuleBuilder();
+
+  const num_pages = 49152;  // 3GB
+
+  builder.addMemory(num_pages, num_pages, true);
+  builder.addFunction("geti", kSig_i_v)
+    .addBody([
+      kExprI32Const, 0x80, 0x80, 0x80, 0x80, 0x7A, // 0xA0000000, 2.5GB
+      kExprI32LoadMem, 0, 0,
+    ])
+    .exportFunc();
+
+  var module = builder.instantiate();
+  const geti = module.exports.geti;
+
+  print("In bounds");
+  assertEquals(0, geti());
+}
+testHugeMemoryConstInBounds();
+
+function testHugeMemoryConstOutOfBounds() {
+  var builder = new WasmModuleBuilder();
+
+  const num_pages = 49152;  // 3GB
+
+  builder.addMemory(num_pages, num_pages, true);
+  builder.addFunction("geti", kSig_i_v)
+    .addBody([
+      kExprI32Const, 0x80, 0x80, 0x80, 0x80, 0x7E, // 0xE0000000, 3.5GB
+      kExprI32LoadMem, 0, 0,
+    ])
+    .exportFunc();
+
+  var module = builder.instantiate();
+  const geti = module.exports.geti;
+
+  print("Out of bounds");
+  assertTraps(kTrapMemOutOfBounds, geti);
+}
+testHugeMemoryConstOutOfBounds();
diff --git a/deps/v8/test/mjsunit/wasm/indirect-tables.js b/deps/v8/test/mjsunit/wasm/indirect-tables.js
index 7583d05968..9bc646e2f0 100644
--- a/deps/v8/test/mjsunit/wasm/indirect-tables.js
+++ b/deps/v8/test/mjsunit/wasm/indirect-tables.js
@@ -523,3 +523,34 @@ function js_div(a, b) { return (a / b) | 0; }
   // Try to grow past imported maximum
   assertThrows(() => table.grow(21));
 })();
+
+(function InitImportedTableSignatureMismatch() {
+  // instance0 exports a function table and a main function which indirectly
+  // calls a function from the table.
+  let builder0 = new WasmModuleBuilder();
+  let sig_index = builder0.addType(kSig_i_v);
+  builder0.addFunction('main', kSig_i_i)
+      .addBody([
+        kExprGetLocal, 0,  // -
+        kExprCallIndirect, sig_index, kTableZero
+      ])
+      .exportAs('main');
+  builder0.setFunctionTableLength(3);
+  builder0.addExportOfKind('table', kExternalTable);
+  let module0 = new WebAssembly.Module(builder0.toBuffer());
+  let instance0 = new WebAssembly.Instance(module0);
+
+  // instance1 imports the table and adds a function to it.
+  let builder1 = new WasmModuleBuilder();
+  builder1.addFunction('f', kSig_i_i).addBody([kExprGetLocal, 0]);
+  builder1.addImportedTable('z', 'table');
+  builder1.addFunctionTableInit(0, false, [0], true);
+  let module1 = new WebAssembly.Module(builder1.toBuffer());
+  let instance1 =
+      new WebAssembly.Instance(module1, {z: {table: instance0.exports.table}});
+
+  // Calling the main method on instance0 should fail, because the signature of
+  // the added function does not match.
+  assertThrows(
+      () => instance0.exports.main(0), WebAssembly.RuntimeError);
+})();
diff --git a/deps/v8/test/mjsunit/wasm/instantiate-module-basic.js b/deps/v8/test/mjsunit/wasm/instantiate-module-basic.js
index e876a7997f..d2489f3e89 100644
--- a/deps/v8/test/mjsunit/wasm/instantiate-module-basic.js
+++ b/deps/v8/test/mjsunit/wasm/instantiate-module-basic.js
@@ -70,7 +70,7 @@ function CheckInstance(instance) {
 
   print('async instantiate...');
   let instance_promise = WebAssembly.instantiate(buffer);
-  assertPromiseResult(instance_promise, CheckInstance);
+  assertPromiseResult(instance_promise, pair => CheckInstance(pair.instance));
 })();
 
 // Check that validate works correctly for a module.
diff --git a/deps/v8/test/mjsunit/wasm/instantiate-run-basic.js b/deps/v8/test/mjsunit/wasm/instantiate-run-basic.js
index e9e9a9ac48..b0016ec9aa 100644
--- a/deps/v8/test/mjsunit/wasm/instantiate-run-basic.js
+++ b/deps/v8/test/mjsunit/wasm/instantiate-run-basic.js
@@ -2,19 +2,33 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-wasm
+// Flags: --allow-natives-syntax
 
 load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
-(function BasicTest() {
-  var kReturnValue = 15;
+const kReturnValue = 15;
+
+function getBuilder() {
   var builder = new WasmModuleBuilder();
 
   builder.addFunction("main", kSig_i_i)
     .addBody([kExprI32Const, kReturnValue])
     .exportFunc();
+  return builder;
+}
 
+(function BasicTest() {
+  var builder = getBuilder();
   var main = builder.instantiate().exports.main;
   assertEquals(kReturnValue, main());
 })();
+
+(function AsyncTest() {
+  var builder = getBuilder();
+  var buffer = builder.toBuffer();
+  assertPromiseResult(
+    WebAssembly.instantiate(buffer)
+      .then(pair => pair.instance.exports.main(), assertUnreachable)
+      .then(result => assertEquals(kReturnValue, result), assertUnreachable));
+})();
diff --git a/deps/v8/test/mjsunit/wasm/js-api.js b/deps/v8/test/mjsunit/wasm/js-api.js
index 689a0adbc4..0f6b0816be 100644
--- a/deps/v8/test/mjsunit/wasm/js-api.js
+++ b/deps/v8/test/mjsunit/wasm/js-api.js
@@ -713,7 +713,6 @@ function assertCompileError(args, err, msg) {
   var error = null;
   assertPromiseResult(compile(...args), unexpectedSuccess, error => {
     assertTrue(error instanceof err);
-    assertTrue(Boolean(error.stack.match('js-api.js')));
     // TODO  assertTrue(Boolean(error.message.match(msg)));
   });
 }
@@ -760,7 +759,6 @@ function assertInstantiateError(args, err, msg) {
   var error = null;
   assertPromiseResult(instantiate(...args), unexpectedSuccess, error => {
     assertTrue(error instanceof err);
-    assertTrue(Boolean(error.stack.match('js-api.js')));
     // TODO assertTrue(Boolean(error.message.match(msg)));
   });
 }
diff --git a/deps/v8/test/mjsunit/wasm/wasm-api-overloading.js b/deps/v8/test/mjsunit/wasm/wasm-api-overloading.js
new file mode 100644
index 0000000000..37320e54ce
--- /dev/null
+++ b/deps/v8/test/mjsunit/wasm/wasm-api-overloading.js
@@ -0,0 +1,53 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+%ResetWasmOverloads();
+let buffer = (() => {
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("f", kSig_i_v)
+    .addBody([kExprI32Const, 42])
+    .exportAs("f");
+  return builder.toBuffer();
+})();
+
+var module = new WebAssembly.Module(buffer);
+var wrapper = [module];
+
+assertPromiseResult(
+  WebAssembly.instantiateStreaming(wrapper),
+  assertUnreachable,
+  e => assertTrue(e instanceof TypeError));
+
+assertPromiseResult(
+  WebAssembly.compileStreaming(wrapper),
+  assertUnreachable,
+  e => assertTrue(e instanceof TypeError));
+
+assertPromiseResult(
+  (() => {
+    %SetWasmCompileFromPromiseOverload();
+    return WebAssembly.compileStreaming(wrapper);
+  })(),
+  module => {
+    assertTrue(module instanceof WebAssembly.Module);
+      %ResetWasmOverloads();
+  },
+  assertUnreachable);
+
+assertPromiseResult(
+  (() => {
+    %SetWasmCompileFromPromiseOverload();
+    return WebAssembly.instantiateStreaming(wrapper);
+  })(),
+  pair => {
+    assertTrue(pair.instance instanceof WebAssembly.Instance);
+    assertTrue(pair.module instanceof WebAssembly.Module);
+    %ResetWasmOverloads();
+  },
+  assertUnreachable);