deps: update V8 to 6.5.254.31

PR-URL: https://github.com/nodejs/node/pull/18453
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Yang Guo <yangguo@chromium.org>
Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

15 files changed, 649 insertions, 3 deletions

diff --git a/deps/v8/test/mjsunit/compiler/array-multiple-receiver-maps.js b/deps/v8/test/mjsunit/compiler/array-multiple-receiver-maps.js
new file mode 100644
index 0000000000..2ef0cc3a01
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/array-multiple-receiver-maps.js
@@ -0,0 +1,122 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+function runTest(f, message, mkICTraining, deoptArg) {
+  function test(f, message, ictraining, deoptArg) {
+    // Train the call ic to the maps.
+    let t = ictraining;
+
+    // We put the training data into local variables
+    // to ensure their maps are kepts alive. If the
+    // maps die, gc *may* deoptimize {f}, which makes
+    // the test flaky.
+    let t1 = t();
+    let t2 = t();
+    let t3 = t();
+
+    for (let a of t1) {
+      f(a.arr, () => a.el);
+    }
+    for (let a of t2) {
+      f(a.arr, () => a.el);
+    }
+    %OptimizeFunctionOnNextCall(f);
+    message += " trained with" + JSON.stringify(t());
+    if (deoptArg == undefined) {
+      // Make sure the optimized function can handle
+      // all trained maps without deopt.
+      for (let a of t3) {
+        f(a.arr, () => a.el);
+        message += " for args " + JSON.stringify(a);
+        assertOptimized(f, undefined, message + " should have been optimized");
+      }
+    } else {
+      // Trigger deopt, causing no-speculation bit to be set.
+      let a1 = deoptArg;
+      let a2 = deoptArg;
+      message += " for args " + JSON.stringify(a1);
+      f(a1.arr, () => a1.el);
+      assertUnoptimized(f, undefined, message + " should have been unoptimized");
+      %OptimizeFunctionOnNextCall(f);
+      // No speculation should protect against further deopts.
+      f(a2.arr, () => a2.el);
+      assertOptimized(f, undefined,  message + " should have been optimized");
+    }
+  }
+
+  // Get function as a string.
+  var testString = test.toString();
+  // Remove the function header..
+  testString = testString.replace(new RegExp("[^\n]*"), "let f = " + f.toString() + ";");
+  // ..and trailing '}'.
+  testString = testString.replace(new RegExp("[^\n]*$"), "");
+  // Substitute parameters.
+  testString = testString.replace(new RegExp("ictraining", 'g'), mkICTraining.toString());
+  testString = testString.replace(new RegExp("deoptArg", 'g'),
+    deoptArg ? JSON.stringify(deoptArg) : "undefined");
+
+  var modTest = new Function("message", testString);
+  //print(modTest);
+  modTest(message);
+}
+
+let checks = {
+  smiReceiver:
+    { mkTrainingArguments : () => [{arr:[1], el:3}],
+      deoptingArguments   : [{arr:[0.1], el:1}, {arr:[{}], el:1}]
+    },
+  objectReceiver:
+    { mkTrainingArguments : () => [{arr:[{}], el:0.1}],
+      deoptingArguments : []
+    },
+  multipleSmiReceivers:
+    { mkTrainingArguments : () => { let b = [1]; b.x=3; return [{arr:[1], el:3}, {arr:b, el:3}] },
+      deoptingArguments : [{arr:[0.1], el:1}, {arr:[{}], el:1}]
+    },
+  multipleSmiReceiversPackedUnpacked:
+    { mkTrainingArguments : () => { let b = [1]; b[100] = 3; return [{arr:[1], el:3}, {arr:b, el:3}] },
+      deoptingArguments : [{arr:[0.1], el:1}, {arr:[{}], el:1}]
+    },
+  multipleDoubleReceivers:
+    { mkTrainingArguments : () => { let b = [0.1]; b.x=0.3; return [{arr:[0.1], el:0.3}, {arr:b, el:0.3}] },
+      deoptingArguments : [{arr:[{}], el:true}, {arr:[1], el:true}]
+    },
+  multipleDoubleReceiversPackedUnpacked:
+    { mkTrainingArguments : () => { let b = [0.1]; b[100] = 0.3; return [{arr:[0.1], el:0.3}, {arr:b, el:0.3}] },
+      deoptingArguments : [{arr:[{}], el:true}, {arr:[1], el:true}]
+    },
+  multipleMixedReceivers:
+    { mkTrainingArguments : () => { let b = [0.1]; b.x=0.3; return [{arr:[1], el:0.3}, {arr:[{}], el:true}, {arr:b, el:0.3}] },
+      deoptingArguments : []
+    },
+  multipleMixedReceiversPackedUnpacked:
+    { mkTrainingArguments : () => { let b = [0.1]; b[100] = 0.3; return [{arr:[1], el:0.3}, {arr:[{}], el:true}, {arr:b, el:0.3}] },
+      deoptingArguments : []
+    },
+};
+
+const functions = {
+  push_reliable: (a,g) => { let b = g(); return a.push(2, b); },
+  push_unreliable: (a,g) => { return a.push(2, g()); },
+  pop_reliable: (a,g) => { let b = g(); return a.pop(2, b); },
+  pop_unreliable: (a,g) => { return a.pop(2, g()); },
+  shift_reliable: (a,g) => { let b = g(); return a.shift(2, b); },
+  shift_unreliable: (a,g) => { return a.shift(2, g()); }
+}
+
+Object.keys(checks).forEach(
+  key => {
+    let check = checks[key];
+
+    for (fnc in functions) {
+      runTest(functions[fnc], "test-reliable-" + key, check.mkTrainingArguments);
+      // Test each deopting arg separately.
+      for (let deoptArg of check.deoptingArguments) {
+        runTest(functions[fnc], "testDeopt-reliable-" + key, check.mkTrainingArguments, deoptArg);
+      }
+    }
+  }
+);
diff --git a/deps/v8/test/mjsunit/compiler/deopt-array-builtins.js b/deps/v8/test/mjsunit/compiler/deopt-array-builtins.js
new file mode 100644
index 0000000000..b737b17ed0
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/deopt-array-builtins.js
@@ -0,0 +1,148 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+/* Test MapCheck behavior */
+
+(function testForEachMapCheck() {
+    function f(v,n,o) {
+        Object.freeze(o);
+    }
+    function g() {
+        [1,2,3].forEach(f);
+    }
+    g();
+    g();
+    %OptimizeFunctionOnNextCall(g);
+    g();
+    %OptimizeFunctionOnNextCall(g);
+    g();
+    assertOptimized(g);
+})();
+
+
+(function testFindMapCheck() {
+    function f(v,n,o) {
+        Object.freeze(o);
+        return false;
+    }
+    function g() {
+        [1,2,3].find(f);
+    }
+    g();
+    g();
+    %OptimizeFunctionOnNextCall(g);
+    g();
+    %OptimizeFunctionOnNextCall(g);
+    g();
+    assertOptimized(g);
+})();
+
+(function testMapMapCheck() {
+    function f(v,n,o) {
+        Object.freeze(o);
+        return false;
+    }
+    function g() {
+        [1,2,3].map(f);
+    }
+    g();
+    g();
+    %OptimizeFunctionOnNextCall(g);
+    g();
+    %OptimizeFunctionOnNextCall(g);
+    g();
+    assertOptimized(g);
+})();
+
+(function testFilterMapCheck() {
+    function f(v,n,o) {
+        Object.freeze(o);
+        return true;
+    }
+    function g() {
+        [1,2,3].filter(f);
+    }
+    g();
+    g();
+    %OptimizeFunctionOnNextCall(g);
+    g();
+    %OptimizeFunctionOnNextCall(g);
+    g();
+    assertOptimized(g);
+})();
+
+
+/* Test CheckBounds behavior */
+
+(function testForEachCheckBounds() {
+    function f(v,n,o) {
+        o.length=2;
+    }
+    function g() {
+        [1,2,3].forEach(f);
+    }
+    g();
+    g();
+    %OptimizeFunctionOnNextCall(g);
+    g();
+    %OptimizeFunctionOnNextCall(g);
+    g();
+    assertOptimized(g);
+})();
+
+
+(function testFindCheckBounds() {
+    function f(v,n,o) {
+        o.length=2;
+        return false;
+    }
+    function g() {
+        [1,2,3].find(f);
+    }
+    g();
+    g();
+    %OptimizeFunctionOnNextCall(g);
+    g();
+    %OptimizeFunctionOnNextCall(g);
+    g();
+    assertOptimized(g);
+})();
+
+(function testMapCheckBounds() {
+    function f(v,n,o) {
+        o.length=2;
+        return false;
+    }
+    function g() {
+        [1,2,3].map(f);
+    }
+    g();
+    g();
+    %OptimizeFunctionOnNextCall(g);
+    g();
+    %OptimizeFunctionOnNextCall(g);
+    g();
+    assertOptimized(g);
+})();
+
+(function testFilterCheckBounds() {
+    function f(v,n,o) {
+        o.length = 2;
+        return true;
+    }
+    function g() {
+        [1,2,3].filter(f);
+    }
+    g();
+    g();
+    %OptimizeFunctionOnNextCall(g);
+    g();
+    g();
+    %OptimizeFunctionOnNextCall(g);
+    g();
+    g();
+    assertOptimized(g);
+})();
diff --git a/deps/v8/test/mjsunit/compiler/deopt-array-push.js b/deps/v8/test/mjsunit/compiler/deopt-array-push.js
new file mode 100644
index 0000000000..e34d99a325
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/deopt-array-push.js
@@ -0,0 +1,97 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+(function test() {
+  function foo(a) { a.push(a.length = 2); }
+
+  foo([1]);
+  foo([1]);
+  %OptimizeFunctionOnNextCall(foo);
+  foo([1]);
+  %OptimizeFunctionOnNextCall(foo);
+  foo([1]);
+  assertOptimized(foo);
+})();
+
+(function testElementTypeCheckSmi() {
+  function foo(a) { a.push('a'); }
+
+  foo([1]);
+  foo([1]);
+  %OptimizeFunctionOnNextCall(foo);
+  foo([1]);
+  %OptimizeFunctionOnNextCall(foo);
+  foo([1]);
+  assertOptimized(foo);
+})();
+
+(function testElementTypeCheckDouble() {
+  function foo(a) { a.push('a'); }
+
+  foo([0.3413312]);
+  foo([0.3413312]);
+  %OptimizeFunctionOnNextCall(foo);
+  foo([0.3413312]);
+  %OptimizeFunctionOnNextCall(foo);
+  foo([0.3413312]);
+  assertOptimized(foo);
+})();
+(function test() {
+  function bar(a) { a.x = 2 };
+  %NeverOptimizeFunction(bar);
+  function foo(a) { a.push(bar(a)); }
+
+  foo(["1"]);
+  foo(["1"]);
+  %OptimizeFunctionOnNextCall(foo);
+  foo(["1"]);
+  %OptimizeFunctionOnNextCall(foo);
+  foo(["1"]);
+  assertOptimized(foo);
+})();
+
+(function test() {
+  function foo(a) { a.push(a.length = 2); }
+
+  foo([0.34234]);
+  foo([0.34234]);
+  %OptimizeFunctionOnNextCall(foo);
+  foo([0.34234]);
+  %OptimizeFunctionOnNextCall(foo);
+  foo([0.34234]);
+  assertOptimized(foo);
+})();
+
+(function test() {
+  const N = 128 * 1024;
+
+  function foo(a) { a.push(1); }
+
+  foo(new Array(N));
+  foo(new Array(N));
+  %OptimizeFunctionOnNextCall(foo);
+  foo(new Array(N));
+  %OptimizeFunctionOnNextCall(foo);
+  foo(new Array(N));
+  assertOptimized(foo);
+})();
+
+(function test() {
+  function mkArray() {
+    const N = 128 * 1024;
+    let a = [0.1];
+    a.length = N;
+    return a;
+  }
+  function foo(a) { a.push(0.23441233123); }
+  foo(mkArray());
+  foo(mkArray());
+  %OptimizeFunctionOnNextCall(foo);
+  foo(mkArray());
+  %OptimizeFunctionOnNextCall(foo);
+  foo(mkArray());
+  assertOptimized(foo);
+})();
diff --git a/deps/v8/test/mjsunit/compiler/escape-analysis-13.js b/deps/v8/test/mjsunit/compiler/escape-analysis-13.js
index fca4da618e..5f281aaaa4 100644
--- a/deps/v8/test/mjsunit/compiler/escape-analysis-13.js
+++ b/deps/v8/test/mjsunit/compiler/escape-analysis-13.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --turbo-escape --turbo-experimental
+// Flags: --allow-natives-syntax --turbo-escape
 
 function f() {
   var x = {};
diff --git a/deps/v8/test/mjsunit/compiler/escape-analysis-15.js b/deps/v8/test/mjsunit/compiler/escape-analysis-15.js
index 4f9a40ad5c..1960d74892 100644
--- a/deps/v8/test/mjsunit/compiler/escape-analysis-15.js
+++ b/deps/v8/test/mjsunit/compiler/escape-analysis-15.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --turbo-escape --turbo-experimental --no-turbo-load-elimination
+// Flags: --allow-natives-syntax --turbo-escape --no-turbo-load-elimination
 
 function f(i) {
   var o1 = {a: 1, b: 2};
diff --git a/deps/v8/test/mjsunit/compiler/escape-analysis-phi-type.js b/deps/v8/test/mjsunit/compiler/escape-analysis-phi-type.js
index 806b09b3de..9d033b9640 100644
--- a/deps/v8/test/mjsunit/compiler/escape-analysis-phi-type.js
+++ b/deps/v8/test/mjsunit/compiler/escape-analysis-phi-type.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --turbo-escape --turbo-experimental --no-turbo-loop-peeling
+// Flags: --allow-natives-syntax --turbo-escape --no-turbo-loop-peeling
 
 function f(x) {
   var o = {a : 0};
diff --git a/deps/v8/test/mjsunit/compiler/materialize-dictionary-properties.js b/deps/v8/test/mjsunit/compiler/materialize-dictionary-properties.js
new file mode 100644
index 0000000000..5838a83979
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/materialize-dictionary-properties.js
@@ -0,0 +1,18 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+  // Create a non-escaping object.
+  var o = Object.create(null);
+  %DeoptimizeNow();
+  // Keep it alive.
+  return o ? 1 : 0;
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+assertEquals(1, f());
diff --git a/deps/v8/test/mjsunit/compiler/materialize-mutable-heap-number.js b/deps/v8/test/mjsunit/compiler/materialize-mutable-heap-number.js
new file mode 100644
index 0000000000..b6b99afcf4
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/materialize-mutable-heap-number.js
@@ -0,0 +1,22 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function C() {}
+%CompleteInobjectSlackTracking(new C());
+
+function f() {
+  // Create a non-escaping object.
+  var o = new C();
+  // Add an out-of-object double property.
+  o.x = 0.5;
+  %DeoptimizeNow();
+  return o.x + 0.25;
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+assertEquals(0.75, f());
diff --git a/deps/v8/test/mjsunit/compiler/new-cons-string.js b/deps/v8/test/mjsunit/compiler/new-cons-string.js
new file mode 100644
index 0000000000..7f6da7262a
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/new-cons-string.js
@@ -0,0 +1,71 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-externalize-string
+
+(function() {
+  function foo(s) {
+    return "abcdefghijklm" + s;
+  }
+
+  assertTrue(isOneByteString(foo("0")));
+  assertTrue(isOneByteString(foo("0")));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(isOneByteString(foo("0")));
+})();
+
+(function() {
+  function foo(s) {
+    return s + "abcdefghijklm";
+  }
+
+  assertTrue(isOneByteString(foo("0")));
+  assertTrue(isOneByteString(foo("0")));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(isOneByteString(foo("0")));
+})();
+
+(function() {
+  function foo(s) {
+    return "abcdefghijklm" + s;
+  }
+
+  assertFalse(isOneByteString(foo("\u1234")));
+  assertFalse(isOneByteString(foo("\u1234")));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(isOneByteString(foo("\u1234")));
+})();
+
+(function() {
+  function foo(s) {
+    return s + "abcdefghijklm";
+  }
+
+  assertFalse(isOneByteString(foo("\u1234")));
+  assertFalse(isOneByteString(foo("\u1234")));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(isOneByteString(foo("\u1234")));
+})();
+
+(function() {
+  function foo(s) {
+    return "abcdefghijkl\u1234" + s;
+  }
+
+  assertFalse(isOneByteString(foo("0")));
+  assertFalse(isOneByteString(foo("0")));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(isOneByteString(foo("0")));
+})();
+
+(function() {
+  function foo(s) {
+    return s + "abcdefghijkl\u1234";
+  }
+
+  assertFalse(isOneByteString(foo("0")));
+  assertFalse(isOneByteString(foo("0")));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(isOneByteString(foo("0")));
+})();
diff --git a/deps/v8/test/mjsunit/compiler/regress-786521.js b/deps/v8/test/mjsunit/compiler/regress-786521.js
new file mode 100644
index 0000000000..2b161270ed
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-786521.js
@@ -0,0 +1,23 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Provoke type None as result of a SpeculativeNumberMultiply to
+// ensure that Turbofan can handle this.
+
+function inlined(b, x) {
+  if (b) {
+    x * 2 * 2
+  }
+}
+
+inlined(true, 1);
+inlined(true, 2);
+inlined(false, 1);
+
+function foo(b) { inlined(b, "") }
+foo(false); foo(false);
+%OptimizeFunctionOnNextCall(foo);
+foo(true);
diff --git a/deps/v8/test/mjsunit/compiler/regress-793863.js b/deps/v8/test/mjsunit/compiler/regress-793863.js
new file mode 100644
index 0000000000..883805dff6
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-793863.js
@@ -0,0 +1,12 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(a) {
+  return arguments[0];
+}
+
+%OptimizeFunctionOnNextCall(f);
+assertEquals(undefined, f());
diff --git a/deps/v8/test/mjsunit/compiler/regress-796041.js b/deps/v8/test/mjsunit/compiler/regress-796041.js
new file mode 100644
index 0000000000..e2c2e11c0b
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-796041.js
@@ -0,0 +1,35 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+'use strict';
+
+function f(abort, n, a, b) {
+  if (abort) return;
+  var x = a ? true : "" + a;
+  if (!a) {
+    var dead = n + 1 + 1;
+    if(!b) {
+      x = dead;
+    }
+    if (x) {
+      x = false;
+    }
+    if (b) {
+      x = false;
+    }
+  }
+  return x + 1;
+}
+f(false, 5); f(false, 6); f(false, 7); f(false, 8);
+
+function g(abort, a, b) {
+  return f(abort, "abc", a, b);
+}
+
+g(true); g(true); g(true); g(true);
+
+%OptimizeFunctionOnNextCall(g);
+g(false);
diff --git a/deps/v8/test/mjsunit/compiler/regress-797596.js b/deps/v8/test/mjsunit/compiler/regress-797596.js
new file mode 100644
index 0000000000..4e3594bdb1
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-797596.js
@@ -0,0 +1,30 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --allow-natives-syntax
+var notCallable;
+function inferReceiverMapsInDeadCode() {
+  var obj = { func() {} };
+  gc();
+  function wrappedCode() { try { code(); } catch (e) {} }
+  function code() {
+    obj.a;
+    try {
+      Object.defineProperty(obj, "func", { get() {} });
+    } catch (neverCaught) {}
+    for (var i = 0; i < 1; i++) {
+      try {
+        notCallable(arguments[i]);
+      } catch (alwaysCaught) {}
+    }
+  }
+  wrappedCode();
+  try {
+    %OptimizeFunctionOnNextCall(wrappedCode);
+    wrappedCode();
+  } catch (e) {}
+}
+inferReceiverMapsInDeadCode();
+inferReceiverMapsInDeadCode();
+inferReceiverMapsInDeadCode();
diff --git a/deps/v8/test/mjsunit/compiler/regress-801097.js b/deps/v8/test/mjsunit/compiler/regress-801097.js
new file mode 100644
index 0000000000..d488ce4deb
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-801097.js
@@ -0,0 +1,19 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function GetFunction() {
+  var source = "return ((dividend | 0) / ((";
+  for (var i = 0; i < 0x8000; i++) {
+    source += "a,"
+  }
+  source += "a) | 0)) | 0";
+  return Function("dividend", source);
+}
+
+var func = GetFunction();
+assertThrows("func();");
+%OptimizeFunctionOnNextCall(func);
+assertThrows("func()");
diff --git a/deps/v8/test/mjsunit/compiler/varargs.js b/deps/v8/test/mjsunit/compiler/varargs.js
new file mode 100644
index 0000000000..ae636dc0f7
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/varargs.js
@@ -0,0 +1,49 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+x = "a";
+
+function test_varargs(...args) {
+  var sum = this.x;
+  for (i in args) {
+    sum += "," + args[i];
+  }
+  return sum;
+}
+
+assertEquals("a", test_varargs());
+assertEquals("a,b", test_varargs("b"));
+assertEquals("a,b,c", test_varargs("b", "c"));
+assertEquals("a,b,c,d", test_varargs("b", "c", "d"));
+assertEquals("a,b,c,d,e", test_varargs("b", "c", "d", "e"));
+
+function forward_varargs(...args) {
+  return test_varargs(...args);
+}
+
+assertEquals("a", forward_varargs());
+assertEquals("a,b", forward_varargs("b"));
+assertEquals("a,b,c", forward_varargs("b", "c"));
+assertEquals("a,b,c,d", forward_varargs("b", "c", "d"));
+assertEquals("a,b,c,d,e", forward_varargs("b", "c", "d", "e"));
+
+function forward_varargs_one_arg(x, ...args) {
+  return test_varargs(x, ...args);
+}
+
+assertEquals("a,undefined", forward_varargs_one_arg());
+assertEquals("a,b", forward_varargs_one_arg("b"));
+assertEquals("a,b,c", forward_varargs_one_arg("b", "c"));
+assertEquals("a,b,c,d", forward_varargs_one_arg("b", "c", "d"));
+assertEquals("a,b,c,d,e", forward_varargs_one_arg("b", "c", "d", "e"));
+
+function forward_varargs_two_args(x, y, ...args) {
+  return test_varargs(x, y, ...args);
+}
+
+assertEquals("a,undefined,undefined", forward_varargs_two_args());
+assertEquals("a,b,undefined", forward_varargs_two_args("b"));
+assertEquals("a,b,c", forward_varargs_two_args("b", "c"));
+assertEquals("a,b,c,d", forward_varargs_two_args("b", "c", "d"));
+assertEquals("a,b,c,d,e", forward_varargs_two_args("b", "c", "d", "e"));