The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/34b337fae6bc7c354ec76ada6e10e21e492492e4

commit 34b337fae6bc7c354ec76ada6e10e21e492492e4
Author: titzer <titzer@chromium.org>
Date: Thu Jan 19 13:23:56 2017

[wasm] Fix checking of unreachable code (clear stack after unreachable).

R=rossberg@chromium.org
BUG= chromium:682659 

Review-Url: https://codereview.chromium.org/2638383004
Cr-Commit-Position: refs/heads/master@{#42502}

[modify] https://crrev.com/34b337fae6bc7c354ec76ada6e10e21e492492e4/src/wasm/function-body-decoder.cc
[modify] https://crrev.com/34b337fae6bc7c354ec76ada6e10e21e492492e4/test/mjsunit/wasm/unreachable-validation.js

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/04434acbcea8012236fa1105076480336c00a089

commit 04434acbcea8012236fa1105076480336c00a089
Author: titzer <titzer@chromium.org>
Date: Fri Jan 20 14:32:38 2017

[wasm] Unreachability fix for br_table.

R=rossberg@chromium.org
BUG= chromium:682659 

Review-Url: https://codereview.chromium.org/2646093003
Cr-Commit-Position: refs/heads/master@{#42564}

[modify] https://crrev.com/04434acbcea8012236fa1105076480336c00a089/src/wasm/function-body-decoder.cc
[modify] https://crrev.com/04434acbcea8012236fa1105076480336c00a089/test/unittests/wasm/function-body-decoder-unittest.cc

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/a9b8a5675841a616870ee053419da5937eaf66ef

commit a9b8a5675841a616870ee053419da5937eaf66ef
Author: titzer <titzer@chromium.org>
Date: Thu Feb 02 23:06:21 2017

[wasm] Implement polymorphic checking, matching the reference interpreter.

R=rossberg@chromium.org, bradnelson@chromium.org
BUG= chromium:682659 

Review-Url: https://codereview.chromium.org/2670673002
Cr-Commit-Position: refs/heads/master@{#42904}

[modify] https://crrev.com/a9b8a5675841a616870ee053419da5937eaf66ef/src/wasm/function-body-decoder.cc
[modify] https://crrev.com/a9b8a5675841a616870ee053419da5937eaf66ef/src/wasm/wasm-opcodes.h
[modify] https://crrev.com/a9b8a5675841a616870ee053419da5937eaf66ef/test/cctest/wasm/test-run-wasm-simd-lowering.cc
[modify] https://crrev.com/a9b8a5675841a616870ee053419da5937eaf66ef/test/cctest/wasm/test-run-wasm-simd.cc
[modify] https://crrev.com/a9b8a5675841a616870ee053419da5937eaf66ef/test/cctest/wasm/test-run-wasm.cc
[modify] https://crrev.com/a9b8a5675841a616870ee053419da5937eaf66ef/test/cctest/wasm/test-wasm-breakpoints.cc
[modify] https://crrev.com/a9b8a5675841a616870ee053419da5937eaf66ef/test/mjsunit/wasm/unreachable-validation.js
[modify] https://crrev.com/a9b8a5675841a616870ee053419da5937eaf66ef/test/unittests/wasm/function-body-decoder-unittest.cc

Needs to be merged back to M57 when Binaryen catches up.

Your change meets the bar and is auto-approved for M57. Please go ahead and merge the CL to branch 2987 manually. Please contact milestone owner if you have questions.
Owners: amineer@(clank), cmasso@(bling), ketakid@(cros), govind@(desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

If possible, please merge your change to M57 branch 2987 before 5:00 PM PT today, Tuesday (02/07/17) so we can pick it up for tomorrow's Beta release. Thank you.

Removing the Merge tags for the moment as this depends on a fix to Binaryen (the primary WASM producer at the moment).

Your change meets the bar and is auto-approved for M57. Please go ahead and merge the CL to branch 2987 manually. Please contact milestone owner if you have questions.
Owners: amineer@(clank), cmasso@(bling), ketakid@(cros), govind@(desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This CL also should be merged in with this change: https://codereview.chromium.org/2696813002/

If possible, could you please merge your change to M57 branch 2987 by 5:00 PM PT tomorrow, Wednesday (02/22) so we can pick it up for this week beta release. 
Thank you.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/ede65fea09b5f584856ddf3921a7bcdba00d0f3f

commit ede65fea09b5f584856ddf3921a7bcdba00d0f3f
Author: titzer <titzer@chromium.org>
Date: Wed Feb 22 15:49:04 2017

Merged: Squashed multiple commits.

This CL merges together all changes necessary to implement the correct
unreachability handling in the V8 WebAssembly validation.

Merged: [wasm][asm.js] Fix incorrect stack depth in some returns.
Revision: 8cee1e7e17a58262b76b7fe48c2318eb2efca609

Merged: [wasm] Add a more exhaustive test for unreachable code validation.
Revision: 097e1ac6c74992b47aedee4cd3c98475438a38e1

Merged: [wasm] Some simplifications in function-body-decoder.cc.
Revision: aa3cd2cd0745266fe98a5fc1304a889de431bcea

Merged: [wasm] Fix checking of unreachable code (clear stack after unreachable).
Revision: 34b337fae6bc7c354ec76ada6e10e21e492492e4

Merged: [wasm] Unreachability fix for br_table.
Revision: 04434acbcea8012236fa1105076480336c00a089

Merged: [wasm] Implement polymorphic checking, matching the reference interpreter.
Revision: a9b8a5675841a616870ee053419da5937eaf66ef

Merged: [wasm] Inspect right control frames for unreachable flag
Revision: e2b83fbbfdf403903d3b4e5bd9276d38151789c3

BUG=None,chromium:682659,chromium:682659,chromium:682659
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=rossberg@chromium.org

Review-Url: https://codereview.chromium.org/2707203003
Cr-Commit-Position: refs/branch-heads/5.7@{#126}
Cr-Branched-From: 975e9a320b6eaf9f12280c35df98e013beb8f041-refs/heads/5.7.492@{#1}
Cr-Branched-From: 8d76f0e3465a84bbf0bceab114900fbe75844e1f-refs/heads/master@{#42426}

[modify] https://crrev.com/ede65fea09b5f584856ddf3921a7bcdba00d0f3f/src/asmjs/asm-wasm-builder.cc
[modify] https://crrev.com/ede65fea09b5f584856ddf3921a7bcdba00d0f3f/src/wasm/function-body-decoder.cc
[modify] https://crrev.com/ede65fea09b5f584856ddf3921a7bcdba00d0f3f/src/wasm/wasm-opcodes.h
[modify] https://crrev.com/ede65fea09b5f584856ddf3921a7bcdba00d0f3f/test/cctest/wasm/test-run-wasm-simd-lowering.cc
[modify] https://crrev.com/ede65fea09b5f584856ddf3921a7bcdba00d0f3f/test/cctest/wasm/test-run-wasm-simd.cc
[modify] https://crrev.com/ede65fea09b5f584856ddf3921a7bcdba00d0f3f/test/cctest/wasm/test-run-wasm.cc
[modify] https://crrev.com/ede65fea09b5f584856ddf3921a7bcdba00d0f3f/test/mjsunit/regress/wasm/regression-667745.js
[modify] https://crrev.com/ede65fea09b5f584856ddf3921a7bcdba00d0f3f/test/mjsunit/wasm/function-names.js
[modify] https://crrev.com/ede65fea09b5f584856ddf3921a7bcdba00d0f3f/test/mjsunit/wasm/globals.js
[add] https://crrev.com/ede65fea09b5f584856ddf3921a7bcdba00d0f3f/test/mjsunit/wasm/unreachable-validation.js
[modify] https://crrev.com/ede65fea09b5f584856ddf3921a7bcdba00d0f3f/test/mjsunit/wasm/wasm-module-builder.js
[modify] https://crrev.com/ede65fea09b5f584856ddf3921a7bcdba00d0f3f/test/unittests/wasm/function-body-decoder-unittest.cc

This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

 Issue v8:6001  has been merged into this issue.

Per comment #16, this is already merged to M57. If nothing is pending for M57, please remove "Merge-Approved-57" label. Thank you.