diff --git a/implementation-contributed/v8/mjsunit/es6/classes.js b/implementation-contributed/v8/mjsunit/es6/classes.js
index b0f44db92b6daa6ea217025a2293bd2b42e0dfd0..fa85faf44ef8b07205b26c8fb3152d2df990b5b4 100644
--- a/implementation-contributed/v8/mjsunit/es6/classes.js
+++ b/implementation-contributed/v8/mjsunit/es6/classes.js
@@ -1161,3 +1161,95 @@ function testClassRestrictedProperties(C) {
assertEquals(instance[key], value);
}
})();
+
+var b = 'b';
+
+(function TestOverwritingInstanceAccessors() {
+ var C, desc;
+ C = class {
+ [b]() { return 'B'; };
+ get b() { return 'get B'; };
+ };
+ desc = Object.getOwnPropertyDescriptor(C.prototype, 'b');
+ assertFalse(desc.enumerable);
+ assertTrue(desc.configurable);
+ assertEquals('get B', desc.get());
+ assertEquals(undefined, desc.set);
+
+ C = class {
+ [b]() { return 'B'; };
+ set b(v) { return 'set B'; };
+ };
+ desc = Object.getOwnPropertyDescriptor(C.prototype, 'b');
+ assertFalse(desc.enumerable);
+ assertTrue(desc.configurable);
+ assertEquals(undefined, desc.get);
+ assertEquals('set B', desc.set());
+
+ C = class {
+ set b(v) { return 'get B'; };
+ [b]() { return 'B'; };
+ get b() { return 'get B'; };
+ };
+ desc = Object.getOwnPropertyDescriptor(C.prototype, 'b');
+ assertFalse(desc.enumerable);
+ assertTrue(desc.configurable);
+ assertEquals('get B', desc.get());
+ assertEquals(undefined, desc.set);
+
+ C = class {
+ get b() { return 'get B'; };
+ [b]() { return 'B'; };
+ set b(v) { return 'set B'; };
+ };
+ desc = Object.getOwnPropertyDescriptor(C.prototype, 'b');
+ assertFalse(desc.enumerable);
+ assertTrue(desc.configurable);
+ assertEquals(undefined, desc.get);
+ assertEquals('set B', desc.set());
+})();
+
+(function TestOverwritingStaticAccessors() {
+ var C, desc;
+ C = class {
+ static [b]() { return 'B'; };
+ static get b() { return 'get B'; };
+ };
+ desc = Object.getOwnPropertyDescriptor(C, 'b');
+ assertFalse(desc.enumerable);
+ assertTrue(desc.configurable);
+ assertEquals('get B', desc.get());
+ assertEquals(undefined, desc.set);
+
+ C = class {
+ static [b]() { return 'B'; };
+ static set b(v) { return 'set B'; };
+ };
+ desc = Object.getOwnPropertyDescriptor(C, 'b');
+ assertFalse(desc.enumerable);
+ assertTrue(desc.configurable);
+ assertEquals(undefined, desc.get);
+ assertEquals('set B', desc.set());
+
+ C = class {
+ static set b(v) { return 'get B'; };
+ static [b]() { return 'B'; };
+ static get b() { return 'get B'; };
+ };
+ desc = Object.getOwnPropertyDescriptor(C, 'b');
+ assertFalse(desc.enumerable);
+ assertTrue(desc.configurable);
+ assertEquals('get B', desc.get());
+ assertEquals(undefined, desc.set);
+
+ C = class {
+ static get b() { return 'get B'; };
+ static [b]() { return 'B'; };
+ static set b(v) { return 'set B'; };
+ };
+ desc = Object.getOwnPropertyDescriptor(C, 'b');
+ assertFalse(desc.enumerable);
+ assertTrue(desc.configurable);
+ assertEquals(undefined, desc.get);
+ assertEquals('set B', desc.set());
+})();
diff --git a/implementation-contributed/v8/mjsunit/es6/typedarray.js b/implementation-contributed/v8/mjsunit/es6/typedarray.js
index 02bd91c1e568747a20616f43d1cc7c099a347813..61653dce882529c1a45eedfc2c75bc8013c30150 100644
--- a/implementation-contributed/v8/mjsunit/es6/typedarray.js
+++ b/implementation-contributed/v8/mjsunit/es6/typedarray.js
@@ -1022,3 +1022,29 @@ assertThrows(function LargeSourceArray() {
a.set(v0);
});
+
+function TestMapCustomSpeciesConstructor(constructor) {
+ const sample = new constructor([40, 42, 42]);
+ let result, ctorThis;
+
+ sample.constructor = {};
+ sample.constructor[Symbol.species] = function(count) {
+ result = arguments;
+ ctorThis = this;
+ return new constructor(count);
+ };
+
+ sample.map(function(v) { return v; });
+
+ assertSame(result.length, 1, "called with 1 argument");
+ assertSame(result[0], 3, "[0] is the new captured length");
+
+ assertTrue(
+ ctorThis instanceof sample.constructor[Symbol.species],
+ "`this` value in the @@species fn is an instance of the function itself"
+ );
+};
+
+for(i = 0; i < typedArrayConstructors.length; i++) {
+ TestPropertyTypeChecks(typedArrayConstructors[i]);
+}
diff --git a/implementation-contributed/v8/mjsunit/harmony/weakrefs/basics.js b/implementation-contributed/v8/mjsunit/harmony/weakrefs/basics.js
index 2e4894b1841116c70b14047b41b8ad7a5d68c8ab..8696e770e6e5d09c905077a6d652ecdd8cd784d8 100644
--- a/implementation-contributed/v8/mjsunit/harmony/weakrefs/basics.js
+++ b/implementation-contributed/v8/mjsunit/harmony/weakrefs/basics.js
@@ -232,6 +232,14 @@
WeakFactory.prototype.makeRef.call(wf, {});
})();
+(function TestCleanupSomeWithoutWeakFactory() {
+ assertThrows(() => WeakFactory.prototype.cleanupSome.call({}), TypeError);
+ // Does not throw:
+ let wf = new WeakFactory(() => {});
+ let rv = WeakFactory.prototype.cleanupSome.call(wf);
+ assertEquals(undefined, rv);
+})();
+
(function TestDerefWithoutWeakRef() {
let wf = new WeakFactory(() => {});
let wc = wf.makeCell({});
diff --git a/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-cleared-weakcell.js b/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-cleared-weakcell.js
new file mode 100644
index 0000000000000000000000000000000000000000..631f43c0124b16cf0d589adf582d377dd44efe8c
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-cleared-weakcell.js
@@ -0,0 +1,35 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+
+let cleanup_count = 0;
+let cleanup_cells = [];
+let cleanup = function(iter) {
+ for (wc of iter) {
+ cleanup_cells.push(wc);
+ }
+ ++cleanup_count;
+}
+
+let wf = new WeakFactory(cleanup);
+let weak_cell;
+(function() {
+ let o = {};
+ weak_cell = wf.makeCell(o);
+
+ // cleanupSome won't do anything since there are no dirty WeakCells.
+ wf.cleanupSome();
+ assertEquals(0, cleanup_count);
+})();
+
+// GC will detect the WeakCell as dirty.
+gc();
+
+// Clear the WeakCell just before we would've called cleanupSome.
+weak_cell.clear();
+
+wf.cleanupSome();
+
+assertEquals(0, cleanup_count);
diff --git a/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-dereffed-and-cleared-weakref.js b/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-dereffed-and-cleared-weakref.js
new file mode 100644
index 0000000000000000000000000000000000000000..a7105771b30a6542ecf6b3fddf4d80a14e552763
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-dereffed-and-cleared-weakref.js
@@ -0,0 +1,51 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking --allow-natives-syntax
+
+let cleanup_count = 0;
+let cleanup_cells = [];
+let cleanup = function(iter) {
+ for (wc of iter) {
+ cleanup_cells.push(wc);
+ }
+ ++cleanup_count;
+}
+
+let o = {};
+let wf = new WeakFactory(cleanup);
+let weak_ref;
+(function() {
+ weak_ref = wf.makeRef(o);
+
+ // cleanupSome won't do anything since there are no dirty WeakCells.
+ wf.cleanupSome();
+ assertEquals(0, cleanup_count);
+})();
+
+// Clear the KeepDuringJob set.
+%RunMicrotasks();
+
+weak_ref.deref();
+o = null;
+
+// The WeakRef is not detected as dirty, since the KeepDuringJob set keeps the
+// target object alive.
+gc();
+
+wf.cleanupSome();
+assertEquals(0, cleanup_count);
+
+%RunMicrotasks();
+// Next turn.
+
+// This GC detects the WeakRef as dirty.
+gc();
+
+// Clear the WeakRef just before we would've called cleanupSome.
+weak_ref.clear();
+
+wf.cleanupSome();
+
+assertEquals(0, cleanup_count);
diff --git a/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-dereffed-weakref.js b/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-dereffed-weakref.js
new file mode 100644
index 0000000000000000000000000000000000000000..fb113bef0d7bd9bd216e1ab34b653cf002cfa9f1
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-dereffed-weakref.js
@@ -0,0 +1,57 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking --allow-natives-syntax
+
+let cleanup_count = 0;
+let cleanup_cells = [];
+let cleanup = function(iter) {
+ for (wc of iter) {
+ cleanup_cells.push(wc);
+ }
+ ++cleanup_count;
+}
+
+let o = {};
+let wf = new WeakFactory(cleanup);
+let weak_ref;
+(function() {
+ weak_ref = wf.makeRef(o);
+
+ // cleanupSome won't do anything since there are no dirty WeakCells.
+ wf.cleanupSome();
+ assertEquals(0, cleanup_count);
+})();
+
+// Clear the KeepDuringJob set.
+%RunMicrotasks();
+
+weak_ref.deref();
+o = null;
+
+// The WeakRef is not detected as dirty, since the KeepDuringJob set keeps the
+// target object alive.
+gc();
+
+wf.cleanupSome();
+assertEquals(0, cleanup_count);
+
+%RunMicrotasks();
+// Next turn.
+
+// Now the WeakRef can be cleared.
+gc();
+wf.cleanupSome();
+
+assertEquals(1, cleanup_count);
+assertEquals(1, cleanup_cells.length);
+assertEquals(weak_ref, cleanup_cells[0]);
+
+// The cleanup task is not executed again since all WeakCells have been
+// processed.
+
+%RunMicrotasks();
+// Next turn.
+
+assertEquals(1, cleanup_count);
diff --git a/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-weakcell.js b/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-weakcell.js
new file mode 100644
index 0000000000000000000000000000000000000000..84a946d3902f6d69287713cf8b5b3b35c9ad6685
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-weakcell.js
@@ -0,0 +1,33 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+
+let cleanup_count = 0;
+let cleanup_cells = [];
+let cleanup = function(iter) {
+ for (wc of iter) {
+ cleanup_cells.push(wc);
+ }
+ ++cleanup_count;
+}
+
+let wf = new WeakFactory(cleanup);
+let weak_cell;
+(function() {
+ let o = {};
+ weak_cell = wf.makeCell(o);
+
+ // cleanupSome won't do anything since there are no dirty WeakCells.
+ wf.cleanupSome();
+ assertEquals(0, cleanup_count);
+})();
+
+// GC will detect the WeakCell as dirty.
+gc();
+
+wf.cleanupSome();
+assertEquals(1, cleanup_count);
+assertEquals(1, cleanup_cells.length);
+assertEquals(weak_cell, cleanup_cells[0]);
diff --git a/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-weakref.js b/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-weakref.js
new file mode 100644
index 0000000000000000000000000000000000000000..ab1e7ebe193d0737d2815889491d3eb45a063f86
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-weakref.js
@@ -0,0 +1,43 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking --allow-natives-syntax
+
+let cleanup_count = 0;
+let cleanup_cells = [];
+let cleanup = function(iter) {
+ for (wc of iter) {
+ cleanup_cells.push(wc);
+ }
+ ++cleanup_count;
+}
+
+let wf = new WeakFactory(cleanup);
+let weak_ref;
+(function() {
+ let o = {};
+ weak_ref = wf.makeRef(o);
+
+ // cleanupSome won't do anything since there are no dirty WeakCells.
+ wf.cleanupSome();
+ assertEquals(0, cleanup_count);
+})();
+
+// The WeakRef is not detected as dirty, since the KeepDuringJob set keeps the
+// target object alive.
+gc();
+
+wf.cleanupSome();
+assertEquals(0, cleanup_count);
+
+%RunMicrotasks();
+// Next turn.
+
+// Now the WeakRef can be cleared.
+gc();
+wf.cleanupSome();
+
+assertEquals(1, cleanup_count);
+assertEquals(1, cleanup_cells.length);
+assertEquals(weak_ref, cleanup_cells[0]);
diff --git a/implementation-contributed/v8/mjsunit/mjsunit.status b/implementation-contributed/v8/mjsunit/mjsunit.status
index e279bc8b508419e3a0373ad817e8ca2398982102..3cf13502060c188b34400793054f630ed186a8e9 100644
--- a/implementation-contributed/v8/mjsunit/mjsunit.status
+++ b/implementation-contributed/v8/mjsunit/mjsunit.status
@@ -717,10 +717,14 @@
'compiler/native-context-specialization-hole-check': [PASS, FAIL],
'elements-transition-hoisting': [PASS, FAIL],
'es6/collections-constructor-custom-iterator': [PASS, FAIL],
+ 'harmony/weakrefs/clear-clears-factory-pointer': [PASS, FAIL],
'keyed-load-with-symbol-key': [PASS, FAIL],
'object-seal': [PASS, FAIL],
'regress/regress-3709': [PASS, FAIL],
+ 'regress/regress-385565': [PASS, FAIL],
'regress/regress-6948': [PASS, FAIL],
+ 'regress/regress-7014-1': [PASS, FAIL],
+ 'regress/regress-7014-2': [PASS, FAIL],
'regress/regress-7510': [PASS, FAIL],
'regress/regress-crbug-882233-2': [PASS, FAIL],
'regress/regress-trap-allocation-memento': [PASS, FAIL],
diff --git a/implementation-contributed/v8/mjsunit/regexp-override-exec.js b/implementation-contributed/v8/mjsunit/regexp-override-exec.js
new file mode 100644
index 0000000000000000000000000000000000000000..66dbf1349f5a61264b5c242df3d65192459e0a59
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regexp-override-exec.js
@@ -0,0 +1,19 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var s = "baa";
+
+assertEquals(1, s.search(/a/));
+assertEquals(["aa"], s.match(/a./));
+assertEquals(["b", "", ""], s.split(/a/));
+
+let o = { index : 3, 0 : "x" };
+
+RegExp.prototype.exec = () => { return o; }
+assertEquals(3, s.search(/a/));
+assertEquals(o, s.match(/a./));
+assertEquals("baar", s.replace(/a./, "r"));
+
+RegExp.prototype.exec = () => { return null; }
+assertEquals(["baa"], s.split(/a/));
diff --git a/implementation-contributed/v8/mjsunit/regexp-override-symbol-match-all.js b/implementation-contributed/v8/mjsunit/regexp-override-symbol-match-all.js
new file mode 100644
index 0000000000000000000000000000000000000000..b5b99f232d96881693354b951365fe6cf4b4b75c
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regexp-override-symbol-match-all.js
@@ -0,0 +1,12 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-string-matchall
+
+var s = "baa";
+
+assertEquals([["b"]], [...s.matchAll(/./)]);
+
+RegExp.prototype[Symbol.matchAll] = () => 42;
+assertEquals(42, s.matchAll(/a./));
diff --git a/implementation-contributed/v8/mjsunit/regexp-override-symbol-match.js b/implementation-contributed/v8/mjsunit/regexp-override-symbol-match.js
new file mode 100644
index 0000000000000000000000000000000000000000..da9b6f5aff1bfe5c5c233c8a8fd59263fb7f69ee
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regexp-override-symbol-match.js
@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var s = "baa";
+
+assertEquals(["aa"], s.match(/a./));
+
+RegExp.prototype[Symbol.match] = () => 42;
+assertEquals(42, s.match(/a./));
diff --git a/implementation-contributed/v8/mjsunit/regexp-override-symbol-replace.js b/implementation-contributed/v8/mjsunit/regexp-override-symbol-replace.js
new file mode 100644
index 0000000000000000000000000000000000000000..8f3e5c1620c72f942fba6f3f0db64ba90f7698c6
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regexp-override-symbol-replace.js
@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var s = "baa";
+
+assertEquals("bca", s.replace(/a/, "c"));
+
+RegExp.prototype[Symbol.replace] = () => 42;
+assertEquals(42, s.replace(/a./));
diff --git a/implementation-contributed/v8/mjsunit/regexp-override-symbol-search.js b/implementation-contributed/v8/mjsunit/regexp-override-symbol-search.js
new file mode 100644
index 0000000000000000000000000000000000000000..2daf25a65a746b339b4c26def1f031816c3ba9ac
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regexp-override-symbol-search.js
@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var s = "baa";
+
+assertEquals(1, s.search(/a/));
+
+RegExp.prototype[Symbol.search] = () => 42;
+assertEquals(42, s.search(/a/));
diff --git a/implementation-contributed/v8/mjsunit/regexp-override-symbol-split.js b/implementation-contributed/v8/mjsunit/regexp-override-symbol-split.js
new file mode 100644
index 0000000000000000000000000000000000000000..f5d35b1862d0de00000112d974b083b77a26bc3e
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regexp-override-symbol-split.js
@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var s = "baa";
+
+assertEquals(["b", "", ""], s.split(/a/));
+
+RegExp.prototype[Symbol.split] = () => 42;
+assertEquals(42, s.split(/a./));
diff --git a/implementation-contributed/v8/mjsunit/regress/regress-8449.js b/implementation-contributed/v8/mjsunit/regress/regress-8449.js
new file mode 100644
index 0000000000000000000000000000000000000000..32fa82aa6e9617b11418b84bf436a83675688af5
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regress/regress-8449.js
@@ -0,0 +1,25 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+{
+ const x = [, 1];
+ x.__proto__ = [42];
+ const y = [...x];
+ assertEquals([42, 1], y);
+ assertTrue(y.hasOwnProperty(0));
+}
+
+{
+ const x = [, 1];
+ x.__proto__ = [42];
+ assertEquals(42, x[Symbol.iterator]().next().value);
+}
+
+{
+ const array_prototype = [].__proto__;
+ array_prototype[0] = 42;
+ const x = [, 1];
+ assertEquals(42, x[Symbol.iterator]().next().value);
+ delete array_prototype[0];
+}
diff --git a/implementation-contributed/v8/mjsunit/regress/regress-904417.js b/implementation-contributed/v8/mjsunit/regress/regress-904417.js
new file mode 100644
index 0000000000000000000000000000000000000000..dc469cca0845c1654efd7d30375f38bed08081c3
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regress/regress-904417.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar(o) {
+ return o.hello, Object.getPrototypeOf(o);
+}
+
+var y = { __proto__: {}, hello: 44 };
+var z = { hello: 45 };
+
+bar(y);
+bar(z);
+bar(y);
+%OptimizeFunctionOnNextCall(bar);
+bar(y);
diff --git a/implementation-contributed/v8/mjsunit/regress/regress-904707.js b/implementation-contributed/v8/mjsunit/regress/regress-904707.js
new file mode 100644
index 0000000000000000000000000000000000000000..8ff8c3a0f2a347720cea8ea026feda6db465c3ef
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regress/regress-904707.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+delete Float64Array.prototype.__proto__[Symbol.iterator];
+
+let a = new Float64Array(9);
+Object.defineProperty(a, "length", {
+ get: function () { %ArrayBufferNeuter(a.buffer); return 6; }
+});
+
+Float64Array.from(a);
diff --git a/implementation-contributed/v8/mjsunit/regress/regress-crbug-900674.js b/implementation-contributed/v8/mjsunit/regress/regress-crbug-900674.js
new file mode 100644
index 0000000000000000000000000000000000000000..7549b36a4e7cb569b1a27784187811f85ff3a6e2
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regress/regress-crbug-900674.js
@@ -0,0 +1,12 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+ let val = Promise.resolve().then();
+}
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/implementation-contributed/v8/mjsunit/regress/regress-crbug-902672.js b/implementation-contributed/v8/mjsunit/regress/regress-crbug-902672.js
new file mode 100644
index 0000000000000000000000000000000000000000..4073b554e9179150b06b8170ad261932e923073d
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regress/regress-crbug-902672.js
@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = this;
+var b = {};
+a.length = 4294967296; // 2 ^ 32 (max array length + 1)
+assertThrows(() => Array.prototype.join.call(a,b), TypeError);
diff --git a/implementation-contributed/v8/test262/test262.status b/implementation-contributed/v8/test262/test262.status
index 3762d2ae78824363aa131d5b10b0ec5ffe6803ed..93c8cec7bd24a40f9c424fb03af8a0eaca1bf3ca 100644
--- a/implementation-contributed/v8/test262/test262.status
+++ b/implementation-contributed/v8/test262/test262.status
@@ -625,13 +625,6 @@
'built-ins/Atomics/wait/cannot-suspend-throws': [SKIP],
'built-ins/Atomics/wait/undefined-index-defaults-to-zero': [SKIP],
- # https://bugs.chromium.org/p/v8/issues/detail?id=6890#c12
- 'built-ins/RegExp/prototype/Symbol.matchAll/isregexp-called-once': [FAIL],
- 'built-ins/RegExp/prototype/Symbol.matchAll/species-constructor': [FAIL],
- 'built-ins/RegExp/prototype/Symbol.matchAll/species-regexp-get-global-throws': [FAIL],
- 'built-ins/RegExp/prototype/Symbol.matchAll/species-regexp-get-unicode-throws': [FAIL],
- 'built-ins/String/prototype/matchAll/regexp-prototype-has-no-matchAll': [FAIL],
-
# https://bugs.chromium.org/p/v8/issues/detail?id=8258
'intl402/Locale/constructor-options-language-valid-undefined': [FAIL],
'intl402/Locale/constructor-options-throwing-getters': [FAIL],