- Implement js-api changes for WebAssembly.Memory to accept a shared parameter
 - Update allocation to use SharedArrayBuffers

BUG=v8:6532

R=binji@chromium.org, bradnelson@chromium.org

Change-Id: I021491217568751b06fbd7b4b08b1dd88910e21d
Reviewed-on: https://chromium-review.googlesource.com/564058
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46543}

This is a reland of 5b44ba0e
Original change's description:
> (Reland) [parser] moved load property position after dot
> 
> Currently LdaNamedProperty bytecode for expressions like a.b has position before dot. This CL moves this location after dot.
> It's important for later removing of Nop bytecodes in expressions like a.b() where a is local variable, property call and property load should have the same position.
> 
> R=jgruber@chromium.org
> TBR=marja@chromium.org
> 
> Bug: v8:6425
> Change-Id: I05c21ca5e018da9c432c6bc963c7a96799336d1c
> Reviewed-on: https://chromium-review.googlesource.com/562879
> Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46484}

TBR=marja@chromium.org,jgruber@chromium.org
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng

Bug: v8:6425
Change-Id: I5eba5fe43ad31c5c781ffcc8c604cd9c98baa57e
Reviewed-on: https://chromium-review.googlesource.com/565907Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46542}

This Cl fixes a fundamental misunderstanding when Wasm memory
histograms were added. They were added using
HISTOGRAM_MEMORY_LIST(). This macro implements aggregating memory
histograms that handle cases memory cases that are not module
specific.

The fixed memory histograms are all module specific, and are simple
histograms.

In addition, it removes field is_sync from ModuleCompiler and
WasmCompilationUnit, since the field is no longer needed to make the
fixed memory histograms synchronous.

Bug: v8:6361
Change-Id: I696109b4fd1a4aadc87a6bdbbc4b7daefd58ea51
Reviewed-on: https://chromium-review.googlesource.com/565349Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Commit-Queue: Karl Schimpf <kschimpf@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46541}

Adds missing opcodes for exception handling for the function body decoder.
Also adds error messages if the exception handling construct is not yet
functional.

Note that the previous prototype for catch and throw have been marked
as not yet functional. This was done because it doesn't model
exceptions the way the proposal suggests. Rather, they implement a
hard-coded (c++ model) of exceptions.

Bug: v8:6577
Change-Id: Ife170b9f0cb2be91b11082e43c4795ce81a427dc
Reviewed-on: https://chromium-review.googlesource.com/564138Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Karl Schimpf <kschimpf@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46540}

Modifies V8 to be able to parse the exception section (defining
exception types), when the experimental_wasm_eh flag is true.

Bug: v8:6577
Change-Id: I5d8b3fddaf5b0dec6b14ddd0992f9fb883e8dc90
Reviewed-on: https://chromium-review.googlesource.com/561757
Commit-Queue: Karl Schimpf <kschimpf@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46539}

This improves the general Array constructor call performance (w/o
usable AllocationSite feedback) in TurboFan by ~2x, i.e. for example
invoking the Array constructor like this

  var a = Array.call(undefined, n);

instead of

  var a = Array(n);

such that the CallIC doesn't know that it's eventually calling the
Array constructor.

It also thus changes the single argument Array constructor to always
return holey arrays. Previously the single argument case for the Array
constructor was somehow trying to dynamically detect 0 and in that case
returned a packed array instead of a holey one. That adds quite a lot
of churn, and doesn't seem to be very useful, especially since this
might lead to unnecessary feedback pollution later.

R=mvstanton@chromium.org

Bug: v8:2229, v8:5269, v8:6399
Change-Id: I3d7cb9bd975ec0e491e3cdbcf1230185cfd1e3de
Reviewed-on: https://chromium-review.googlesource.com/565721Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46538}

It's already skipped (for slowness) in debug, asan, and msan builds.

TBR=machenbach@chromium.org

Change-Id: I1d7cb38d88e621f6d14344426bc5f931b1d6ffcd
Reviewed-on: https://chromium-review.googlesource.com/565741Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46537}

In https://chromium-review.googlesource.com/c/472247/, I avoided
running DesugarLexicalBindingsInForStatement() if there were no lexical
loop variables, the function was not resumable, and the variables are
not captured by eval or a function declaration.

I think it's now possible to limit this further, and only do the more
extensive desugaring if there's a function declaration / eval() call
in the loop body. `yield` and `await` are not an issue as those loop
variables are written to the register file and not lost.

This change just removes the `is_resumable()` condition. If it passes
tests, I think it's safe.

BUG=v8:4762, v8:5460, v8:6579

Change-Id: I92d0308ad9401c1338411bc9ae9021f978803d3a
Reviewed-on: https://chromium-review.googlesource.com/563587
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46536}

concurrent marking.

The function should use relaxed store similar to other JSObject setters.

BUG=chromium:694255

Change-Id: I032f0763a5f2420d120bce976533aa0007868b97
Reviewed-on: https://chromium-review.googlesource.com/565573Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46535}

This reverts commit 39e335c7.

Reason for revert: Breaks debug builds on Linux, especially mksnapshot fails now, i.e.:

FAILED: mksnapshot
python "../../build/toolchain/gcc_link_wrapper.py" --output="./mksnapshot" -- ../../third_party/llvm-build/Release+Asserts/bin/clang++ -pie -Wl,--fatal-warnings -fPIC -Wl,-z,noexecstack -Wl,-z,now -Wl,-z,relro -Wl,-z,defs -Wl,--no-as-needed -lpthread -Wl,--as-needed -fuse
-ld=gold -B../../third_party/binutils/Linux_x64/Release/bin -Wl,--threads -Wl,--thread-count=4 -Wl,--icf=all -m64 -Werror -Wl,--gdb-index --sysroot=../../build/linux/debian_jessie_amd64-sysroot -L../../build/linux/debian_jessie_amd64-sysroot/lib/x86_64-linux-gnu -Wl,-rpat
h-link=../../build/linux/debian_jessie_amd64-sysroot/lib/x86_64-linux-gnu -L../../build/linux/debian_jessie_amd64-sysroot/usr/lib/x86_64-linux-gnu -Wl,-rpath-link=../../build/linux/debian_jessie_amd64-sysroot/usr/lib/x86_64-linux-gnu -Wl,-rpath-link=. -Wl,--disable-new-dt
ags -rdynamic -nodefaultlibs -o "./mksnapshot" -Wl,--start-group @"./mksnapshot.rsp"  -Wl,--end-group   -ldl -lpthread -lrt -lc -lm -lgcc_s
../../src/elements.cc:3362: error: undefined reference to 'v8::internal::(anonymous namespace)::ElementsKindTraits<(v8::internal::ElementsKind)7>::Kind'
../../src/elements.cc:3362: error: undefined reference to 'v8::internal::(anonymous namespace)::ElementsKindTraits<(v8::internal::ElementsKind)8>::Kind'
../../src/elements.cc:3953: error: undefined reference to 'v8::internal::(anonymous namespace)::ElementsKindTraits<(v8::internal::ElementsKind)9>::Kind'
../../src/profiler/heap-snapshot-generator.cc:187: error: undefined reference to 'v8::internal::(anonymous namespace)::SnapshotSizeConstants<4ul>::kExpectedHeapGraphEdgeSize'
../../src/elements.cc:3953: error: undefined reference to 'v8::internal::(anonymous namespace)::ElementsKindTraits<(v8::internal::ElementsKind)10>::Kind'
../../src/profiler/heap-snapshot-generator.cc:198: error: undefined reference to 'v8::internal::(anonymous namespace)::SnapshotSizeConstants<4ul>::kExpectedHeapEntrySize'
../../src/profiler/heap-snapshot-generator.cc:199: error: undefined reference to 'v8::internal::(anonymous namespace)::SnapshotSizeConstants<8ul>::kExpectedHeapGraphEdgeSize'
../../src/profiler/heap-snapshot-generator.cc:200: error: undefined reference to 'v8::internal::(anonymous namespace)::SnapshotSizeConstants<8ul>::kExpectedHeapEntrySize'
clang: error: linker command failed with exit code 1 (use -v to see invocation)
ninja: build stopped: subcommand failed.

Original change's description:
> [base] Make USE a variadic template
> 
> This will allow for passing more than one variable. This is
> particularly interesting for calling a method on each type in a
> parameter pack, as in:
> 
> template<typename... T>
> void foo(T&&... ts) {
>   USE(do_something(ts)...);
> }
> 
> Drive-by fix: Allow to pass arbitrary types to USE, including
> references. This might prevent a copy for pass-by-value.
> 
> R=​ishell@chromium.org
> 
> Change-Id: I8f894d730bbcd195ed83705f98771994b4bc906f
> Reviewed-on: https://chromium-review.googlesource.com/565561
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46527}

TBR=clemensh@chromium.org,ishell@chromium.org

Change-Id: Ibd3f0529e7a3136c4bcac15443da3d9f8dde8510
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/565141Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46534}

The use of double variables to store bit patterns may lead to bit flips
when the stored bit pattern is a signaling NaN (sNaN). Operations on a
sNaN variable (even just returning the variable from a function) may
turn it into a quiet NaN (qNaN), flipping the signaling bit and
affecting the information stored in the variable.

We observed this behaviour on ia32 architectures and therefore in the
simulator builds for other platforms. The use of the wrapper class
Double should prevent this behaviour.

R=ahaas@chromium.org

Change-Id: Ibd1119924a59db771fd4c250689ad9c2a35fff75
Reviewed-on: https://chromium-review.googlesource.com/562771Reviewed-by: Jaideep Bajwa <bjaideep@ca.ibm.com>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Enrico Bacis <enricobacis@google.com>
Cr-Commit-Position: refs/heads/master@{#46533}

This unconditional check caused a lot of canary crashes and recently stable merges while not being necessary for security. For code health and maintenance of Turbofan, it should be sufficient if this is only triggered in Clusterfuzz.

Bug: chromium:726638
Change-Id: Ib58d9c18f89939164cae19223fda490addbce007
Reviewed-on: https://chromium-review.googlesource.com/557867Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46532}

Port https://chromium-review.googlesource.com/c/561015/.

Bug: v8:6048
Change-Id: I887ad0651674fb1c503bea19660199eb5ab3e9ba
Reviewed-on: https://chromium-review.googlesource.com/565568Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46531}

Bug: chromium:738865
Change-Id: Icb92b649ecd3d4ab4c60f35ffe0649a35fe8b3f6
Reviewed-on: https://chromium-review.googlesource.com/565285Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46530}

That is, change to use TimedHistogram (which functions properly on
background threads).

Bug: v8:6361
Change-Id: I821fb0afea97be422786778d576683f67667c31b
Reviewed-on: https://chromium-review.googlesource.com/559769
Commit-Queue: Karl Schimpf <kschimpf@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46529}

Change-Id: Iedd1ce0d790c0c1fd69b92657d6a9866f346cedd
Reviewed-on: https://chromium-review.googlesource.com/565563Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46528}

This will allow for passing more than one variable. This is
particularly interesting for calling a method on each type in a
parameter pack, as in:

template<typename... T>
void foo(T&&... ts) {
  USE(do_something(ts)...);
}

Drive-by fix: Allow to pass arbitrary types to USE, including
references. This might prevent a copy for pass-by-value.

R=ishell@chromium.org

Change-Id: I8f894d730bbcd195ed83705f98771994b4bc906f
Reviewed-on: https://chromium-review.googlesource.com/565561Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46527}

It doesn't actually matter if we have arguments to the call, we just ignore
them.

BUG=chromium:740037

Change-Id: I50600c3ee5902e7de6ac558833e3ed9cd1a9a28f
Reviewed-on: https://chromium-review.googlesource.com/565509Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46526}

Port 040fa06f
Port 659e8f7b

Bug: 
Change-Id: Ie08d65ff6647f8a15127a065e7224b5b5cec09a4
Reviewed-on: https://chromium-review.googlesource.com/558294
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46525}

Bug: 
Change-Id: I77915d33e427f00f42fb61ed0ba903e43d737180
Reviewed-on: https://chromium-review.googlesource.com/565417Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46524}

Pass --gerrit explicitly to be resiliant to possible rollbacks of the Gerrit
switch.

This'll also enforce using Gerrit on older release branches when using
the release tools for cherry-picking.

NOTRY=true
TBR=hablich@chromium.org

Bug: chromium:685318
Change-Id: If60784b4c804f38ca36649ac4b2e62209d7cf729
Reviewed-on: https://chromium-review.googlesource.com/565415Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46523}

This reverts commit bb881c88.

Reason for revert: nosnap debug:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/13930

Original change's description:
> Document RootIndexMap's requirement for immovable roots.
> 
> R=​mstarzinger@chromium.org
> 
> Change-Id: I27cf279c77204becc449221e1bcebeacbc275792
> Reviewed-on: https://chromium-review.googlesource.com/565281
> Commit-Queue: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46517}

TBR=yangguo@chromium.org,mstarzinger@chromium.org

Change-Id: Ifac3ec6192207bf2be8932408c37bea66bb435e8
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/565598Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46522}

The CL introducing optimizations in memory load/store helper,
https://chromium-review.googlesource.com/c/552119/, caused several
failures on r6 builders. The problem was in Sdc1 macro instruction where
address in at register was overwritten before being used. Also in debug
mode a DCHECK was failing because an incorrect type was used.

BUG=

Change-Id: If38f9dfbbe2e72dfce05c24f7b6019060ef28334
Reviewed-on: https://chromium-review.googlesource.com/565297Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Commit-Queue: Miran Karić <Miran.Karic@imgtec.com>
Cr-Commit-Position: refs/heads/master@{#46521}

Change-Id: Ib95ab0c5669fe344ff199cc6cad811e175bc8bb3
Reviewed-on: https://chromium-review.googlesource.com/565410Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Albert Mingkun Yang <albertnetymk@google.com>
Cr-Commit-Position: refs/heads/master@{#46520}

Bug: chromium:738865
Change-Id: I93721f535ecf8518bf0355e62d5848147460abc8
Reviewed-on: https://chromium-review.googlesource.com/565198Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46519}

BUG=chromium:740325
R=ahaas@chromium.org,mlippautz@chromium.org

Review-Url: https://codereview.chromium.org/2972353002
Cr-Commit-Position: refs/heads/master@{#46518}

R=mstarzinger@chromium.org

Change-Id: I27cf279c77204becc449221e1bcebeacbc275792
Reviewed-on: https://chromium-review.googlesource.com/565281
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46517}

This adds a convenience method for the common Smi to int conversion
pattern.

Bug: 
Change-Id: I7d7b171c36cfec5f6d10c60f1d9c3e06e3aed0fa
Reviewed-on: https://chromium-review.googlesource.com/563205
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Andreas Rossberg <rossberg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46516}

BUG=

Review-Url: https://codereview.chromium.org/2970443003
Cr-Commit-Position: refs/heads/master@{#46515}

Port https://chromium-review.googlesource.com/c/519267/.

R=bmeurer@chromium.org

Bug: v8:6048
Change-Id: Ic94a12b30967fd26ebfa0c6752475d0c013f81e4
Reviewed-on: https://chromium-review.googlesource.com/565400Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46514}

BUG=v8:1956
LOG=N
R=bmeurer@chromium.org

Change-Id: I190002227d3321df0f68e77f3b7b0a468446c493
Reviewed-on: https://chromium-review.googlesource.com/561011
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46513}

NOTRY=true

Bug: v8:6408
Change-Id: I9e70131158d837b735d398436a1da4b2e85daa67
Reviewed-on: https://chromium-review.googlesource.com/565398Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46512}

Rename builtins-proxy.cc to builtins-proxy-gen.cc.

Bug: v8:6557, v8:6567
Change-Id: I0e52a0c0c6c9b307c33bb18ec36079bdfd4a89ef
Reviewed-on: https://chromium-review.googlesource.com/565278
Commit-Queue: Maya Lekova <mslekova@google.com>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46511}

This introduces a new builtin (MapLookupHashIndex) and uses it
in Turbofan to compute Map.p.get and Map.p.has.

I have also refactored the existing CSA builtins for Map.p.get and 
Map.p.has to use the new builtin under the hood.

The code for the lookup has been also improved.
- Specialized lookups for smis, strings, heap numbers and everything else.
  - the advantage is that we can use fast equalities for the lookup.
  - strings can likely be optimized further if we care about the 
    internalized string fast case.
- Instead of a call to runtime to get the hash code, we now call C directly.

In the Turbofan implementation itself, there are no special optimizations yet.
The next step is to teach load elimination to reuse the indexes from
previous calls of MapLookupHashIndex. 

BUG=v8:6410

Change-Id: I0b1a70493eb031d444e51002f6b2cc1f30ea2b68
Reviewed-on: https://chromium-review.googlesource.com/560169Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46510}

RootCanBeTreatedAsConstant checks that the object is not in new space.
This check is not thread-safe and, moreover, makes no sense in Turbofan.

R=bmeurer@chromium.org

Bug: v8:6048
Change-Id: I6df682ceef1508c33d5f32bd0d5bf25828e8c88f
Reviewed-on: https://chromium-review.googlesource.com/565259
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46509}

R=clemensh@chromium.org
BUG=chromium:740199

Review-Url: https://codereview.chromium.org/2977543002
Cr-Commit-Position: refs/heads/master@{#46508}

Bug: v8:6211
Change-Id: Iab0e787e7d9abfb9f24cd77276e1c00cc2e165a7
Reviewed-on: https://chromium-review.googlesource.com/561456
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46507}

Change-Id: I7fd794342a13718059b47ea25c26d850ed2da509
Reviewed-on: https://chromium-review.googlesource.com/564189Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46506}

BUG=chromium:694255

Change-Id: Ib0403a2d406428d2cd7896521abb6e95c3841c1c
Reviewed-on: https://chromium-review.googlesource.com/563364
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46505}

An invalid I32V value as index could be used to get a valid
WasmFunction.

R=clemensh@chromium.org

Bug: chromium:735887
Change-Id: I5fbfa01fc3300d86a4a2ba9bcbb86fc02f231ef9
Reviewed-on: https://chromium-review.googlesource.com/561536Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46504}