From 90cbd48a65654edc4cc97afa606efa76fddbbe8e Mon Sep 17 00:00:00 2001
From: test262-automation <test262-automation@bocoup.com>
Date: Wed, 14 Nov 2018 19:00:33 +0000
Subject: [PATCH] [v8-test262-automation] Changes from
https://github.com/v8/v8.git at sha ac250b9b on Wed Nov 14 2018 18:59:57
GMT+0000 (Coordinated Universal Time)
---
.../v8/mjsunit/es6/classes.js | 92 +++++++++++++++++++
.../v8/mjsunit/es6/typedarray.js | 26 ++++++
.../v8/mjsunit/harmony/weakrefs/basics.js | 8 ++
.../weakrefs/cleanupsome-cleared-weakcell.js | 35 +++++++
...leanupsome-dereffed-and-cleared-weakref.js | 51 ++++++++++
.../weakrefs/cleanupsome-dereffed-weakref.js | 57 ++++++++++++
.../harmony/weakrefs/cleanupsome-weakcell.js | 33 +++++++
.../harmony/weakrefs/cleanupsome-weakref.js | 43 +++++++++
.../v8/mjsunit/mjsunit.status | 4 +
.../v8/mjsunit/regexp-override-exec.js | 19 ++++
.../regexp-override-symbol-match-all.js | 12 +++
.../mjsunit/regexp-override-symbol-match.js | 10 ++
.../mjsunit/regexp-override-symbol-replace.js | 10 ++
.../mjsunit/regexp-override-symbol-search.js | 10 ++
.../mjsunit/regexp-override-symbol-split.js | 10 ++
.../v8/mjsunit/regress/regress-8449.js | 25 +++++
.../v8/mjsunit/regress/regress-904417.js | 18 ++++
.../v8/mjsunit/regress/regress-904707.js | 14 +++
.../mjsunit/regress/regress-crbug-900674.js | 12 +++
.../mjsunit/regress/regress-crbug-902672.js | 8 ++
.../v8/test262/test262.status | 7 --
21 files changed, 497 insertions(+), 7 deletions(-)
create mode 100644 implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-cleared-weakcell.js
create mode 100644 implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-dereffed-and-cleared-weakref.js
create mode 100644 implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-dereffed-weakref.js
create mode 100644 implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-weakcell.js
create mode 100644 implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-weakref.js
create mode 100644 implementation-contributed/v8/mjsunit/regexp-override-exec.js
create mode 100644 implementation-contributed/v8/mjsunit/regexp-override-symbol-match-all.js
create mode 100644 implementation-contributed/v8/mjsunit/regexp-override-symbol-match.js
create mode 100644 implementation-contributed/v8/mjsunit/regexp-override-symbol-replace.js
create mode 100644 implementation-contributed/v8/mjsunit/regexp-override-symbol-search.js
create mode 100644 implementation-contributed/v8/mjsunit/regexp-override-symbol-split.js
create mode 100644 implementation-contributed/v8/mjsunit/regress/regress-8449.js
create mode 100644 implementation-contributed/v8/mjsunit/regress/regress-904417.js
create mode 100644 implementation-contributed/v8/mjsunit/regress/regress-904707.js
create mode 100644 implementation-contributed/v8/mjsunit/regress/regress-crbug-900674.js
create mode 100644 implementation-contributed/v8/mjsunit/regress/regress-crbug-902672.js
diff --git a/implementation-contributed/v8/mjsunit/es6/classes.js b/implementation-contributed/v8/mjsunit/es6/classes.js
index b0f44db92b..fa85faf44e 100644
--- a/implementation-contributed/v8/mjsunit/es6/classes.js
+++ b/implementation-contributed/v8/mjsunit/es6/classes.js
@@ -1161,3 +1161,95 @@ function testClassRestrictedProperties(C) {
assertEquals(instance[key], value);
}
})();
+
+var b = 'b';
+
+(function TestOverwritingInstanceAccessors() {
+ var C, desc;
+ C = class {
+ [b]() { return 'B'; };
+ get b() { return 'get B'; };
+ };
+ desc = Object.getOwnPropertyDescriptor(C.prototype, 'b');
+ assertFalse(desc.enumerable);
+ assertTrue(desc.configurable);
+ assertEquals('get B', desc.get());
+ assertEquals(undefined, desc.set);
+
+ C = class {
+ [b]() { return 'B'; };
+ set b(v) { return 'set B'; };
+ };
+ desc = Object.getOwnPropertyDescriptor(C.prototype, 'b');
+ assertFalse(desc.enumerable);
+ assertTrue(desc.configurable);
+ assertEquals(undefined, desc.get);
+ assertEquals('set B', desc.set());
+
+ C = class {
+ set b(v) { return 'get B'; };
+ [b]() { return 'B'; };
+ get b() { return 'get B'; };
+ };
+ desc = Object.getOwnPropertyDescriptor(C.prototype, 'b');
+ assertFalse(desc.enumerable);
+ assertTrue(desc.configurable);
+ assertEquals('get B', desc.get());
+ assertEquals(undefined, desc.set);
+
+ C = class {
+ get b() { return 'get B'; };
+ [b]() { return 'B'; };
+ set b(v) { return 'set B'; };
+ };
+ desc = Object.getOwnPropertyDescriptor(C.prototype, 'b');
+ assertFalse(desc.enumerable);
+ assertTrue(desc.configurable);
+ assertEquals(undefined, desc.get);
+ assertEquals('set B', desc.set());
+})();
+
+(function TestOverwritingStaticAccessors() {
+ var C, desc;
+ C = class {
+ static [b]() { return 'B'; };
+ static get b() { return 'get B'; };
+ };
+ desc = Object.getOwnPropertyDescriptor(C, 'b');
+ assertFalse(desc.enumerable);
+ assertTrue(desc.configurable);
+ assertEquals('get B', desc.get());
+ assertEquals(undefined, desc.set);
+
+ C = class {
+ static [b]() { return 'B'; };
+ static set b(v) { return 'set B'; };
+ };
+ desc = Object.getOwnPropertyDescriptor(C, 'b');
+ assertFalse(desc.enumerable);
+ assertTrue(desc.configurable);
+ assertEquals(undefined, desc.get);
+ assertEquals('set B', desc.set());
+
+ C = class {
+ static set b(v) { return 'get B'; };
+ static [b]() { return 'B'; };
+ static get b() { return 'get B'; };
+ };
+ desc = Object.getOwnPropertyDescriptor(C, 'b');
+ assertFalse(desc.enumerable);
+ assertTrue(desc.configurable);
+ assertEquals('get B', desc.get());
+ assertEquals(undefined, desc.set);
+
+ C = class {
+ static get b() { return 'get B'; };
+ static [b]() { return 'B'; };
+ static set b(v) { return 'set B'; };
+ };
+ desc = Object.getOwnPropertyDescriptor(C, 'b');
+ assertFalse(desc.enumerable);
+ assertTrue(desc.configurable);
+ assertEquals(undefined, desc.get);
+ assertEquals('set B', desc.set());
+})();
diff --git a/implementation-contributed/v8/mjsunit/es6/typedarray.js b/implementation-contributed/v8/mjsunit/es6/typedarray.js
index 02bd91c1e5..61653dce88 100644
--- a/implementation-contributed/v8/mjsunit/es6/typedarray.js
+++ b/implementation-contributed/v8/mjsunit/es6/typedarray.js
@@ -1022,3 +1022,29 @@ assertThrows(function LargeSourceArray() {
a.set(v0);
});
+
+function TestMapCustomSpeciesConstructor(constructor) {
+ const sample = new constructor([40, 42, 42]);
+ let result, ctorThis;
+
+ sample.constructor = {};
+ sample.constructor[Symbol.species] = function(count) {
+ result = arguments;
+ ctorThis = this;
+ return new constructor(count);
+ };
+
+ sample.map(function(v) { return v; });
+
+ assertSame(result.length, 1, "called with 1 argument");
+ assertSame(result[0], 3, "[0] is the new captured length");
+
+ assertTrue(
+ ctorThis instanceof sample.constructor[Symbol.species],
+ "`this` value in the @@species fn is an instance of the function itself"
+ );
+};
+
+for(i = 0; i < typedArrayConstructors.length; i++) {
+ TestPropertyTypeChecks(typedArrayConstructors[i]);
+}
diff --git a/implementation-contributed/v8/mjsunit/harmony/weakrefs/basics.js b/implementation-contributed/v8/mjsunit/harmony/weakrefs/basics.js
index 2e4894b184..8696e770e6 100644
--- a/implementation-contributed/v8/mjsunit/harmony/weakrefs/basics.js
+++ b/implementation-contributed/v8/mjsunit/harmony/weakrefs/basics.js
@@ -232,6 +232,14 @@
WeakFactory.prototype.makeRef.call(wf, {});
})();
+(function TestCleanupSomeWithoutWeakFactory() {
+ assertThrows(() => WeakFactory.prototype.cleanupSome.call({}), TypeError);
+ // Does not throw:
+ let wf = new WeakFactory(() => {});
+ let rv = WeakFactory.prototype.cleanupSome.call(wf);
+ assertEquals(undefined, rv);
+})();
+
(function TestDerefWithoutWeakRef() {
let wf = new WeakFactory(() => {});
let wc = wf.makeCell({});
diff --git a/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-cleared-weakcell.js b/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-cleared-weakcell.js
new file mode 100644
index 0000000000..631f43c012
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-cleared-weakcell.js
@@ -0,0 +1,35 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+
+let cleanup_count = 0;
+let cleanup_cells = [];
+let cleanup = function(iter) {
+ for (wc of iter) {
+ cleanup_cells.push(wc);
+ }
+ ++cleanup_count;
+}
+
+let wf = new WeakFactory(cleanup);
+let weak_cell;
+(function() {
+ let o = {};
+ weak_cell = wf.makeCell(o);
+
+ // cleanupSome won't do anything since there are no dirty WeakCells.
+ wf.cleanupSome();
+ assertEquals(0, cleanup_count);
+})();
+
+// GC will detect the WeakCell as dirty.
+gc();
+
+// Clear the WeakCell just before we would've called cleanupSome.
+weak_cell.clear();
+
+wf.cleanupSome();
+
+assertEquals(0, cleanup_count);
diff --git a/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-dereffed-and-cleared-weakref.js b/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-dereffed-and-cleared-weakref.js
new file mode 100644
index 0000000000..a7105771b3
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-dereffed-and-cleared-weakref.js
@@ -0,0 +1,51 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking --allow-natives-syntax
+
+let cleanup_count = 0;
+let cleanup_cells = [];
+let cleanup = function(iter) {
+ for (wc of iter) {
+ cleanup_cells.push(wc);
+ }
+ ++cleanup_count;
+}
+
+let o = {};
+let wf = new WeakFactory(cleanup);
+let weak_ref;
+(function() {
+ weak_ref = wf.makeRef(o);
+
+ // cleanupSome won't do anything since there are no dirty WeakCells.
+ wf.cleanupSome();
+ assertEquals(0, cleanup_count);
+})();
+
+// Clear the KeepDuringJob set.
+%RunMicrotasks();
+
+weak_ref.deref();
+o = null;
+
+// The WeakRef is not detected as dirty, since the KeepDuringJob set keeps the
+// target object alive.
+gc();
+
+wf.cleanupSome();
+assertEquals(0, cleanup_count);
+
+%RunMicrotasks();
+// Next turn.
+
+// This GC detects the WeakRef as dirty.
+gc();
+
+// Clear the WeakRef just before we would've called cleanupSome.
+weak_ref.clear();
+
+wf.cleanupSome();
+
+assertEquals(0, cleanup_count);
diff --git a/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-dereffed-weakref.js b/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-dereffed-weakref.js
new file mode 100644
index 0000000000..fb113bef0d
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-dereffed-weakref.js
@@ -0,0 +1,57 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking --allow-natives-syntax
+
+let cleanup_count = 0;
+let cleanup_cells = [];
+let cleanup = function(iter) {
+ for (wc of iter) {
+ cleanup_cells.push(wc);
+ }
+ ++cleanup_count;
+}
+
+let o = {};
+let wf = new WeakFactory(cleanup);
+let weak_ref;
+(function() {
+ weak_ref = wf.makeRef(o);
+
+ // cleanupSome won't do anything since there are no dirty WeakCells.
+ wf.cleanupSome();
+ assertEquals(0, cleanup_count);
+})();
+
+// Clear the KeepDuringJob set.
+%RunMicrotasks();
+
+weak_ref.deref();
+o = null;
+
+// The WeakRef is not detected as dirty, since the KeepDuringJob set keeps the
+// target object alive.
+gc();
+
+wf.cleanupSome();
+assertEquals(0, cleanup_count);
+
+%RunMicrotasks();
+// Next turn.
+
+// Now the WeakRef can be cleared.
+gc();
+wf.cleanupSome();
+
+assertEquals(1, cleanup_count);
+assertEquals(1, cleanup_cells.length);
+assertEquals(weak_ref, cleanup_cells[0]);
+
+// The cleanup task is not executed again since all WeakCells have been
+// processed.
+
+%RunMicrotasks();
+// Next turn.
+
+assertEquals(1, cleanup_count);
diff --git a/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-weakcell.js b/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-weakcell.js
new file mode 100644
index 0000000000..84a946d390
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-weakcell.js
@@ -0,0 +1,33 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+
+let cleanup_count = 0;
+let cleanup_cells = [];
+let cleanup = function(iter) {
+ for (wc of iter) {
+ cleanup_cells.push(wc);
+ }
+ ++cleanup_count;
+}
+
+let wf = new WeakFactory(cleanup);
+let weak_cell;
+(function() {
+ let o = {};
+ weak_cell = wf.makeCell(o);
+
+ // cleanupSome won't do anything since there are no dirty WeakCells.
+ wf.cleanupSome();
+ assertEquals(0, cleanup_count);
+})();
+
+// GC will detect the WeakCell as dirty.
+gc();
+
+wf.cleanupSome();
+assertEquals(1, cleanup_count);
+assertEquals(1, cleanup_cells.length);
+assertEquals(weak_cell, cleanup_cells[0]);
diff --git a/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-weakref.js b/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-weakref.js
new file mode 100644
index 0000000000..ab1e7ebe19
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-weakref.js
@@ -0,0 +1,43 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking --allow-natives-syntax
+
+let cleanup_count = 0;
+let cleanup_cells = [];
+let cleanup = function(iter) {
+ for (wc of iter) {
+ cleanup_cells.push(wc);
+ }
+ ++cleanup_count;
+}
+
+let wf = new WeakFactory(cleanup);
+let weak_ref;
+(function() {
+ let o = {};
+ weak_ref = wf.makeRef(o);
+
+ // cleanupSome won't do anything since there are no dirty WeakCells.
+ wf.cleanupSome();
+ assertEquals(0, cleanup_count);
+})();
+
+// The WeakRef is not detected as dirty, since the KeepDuringJob set keeps the
+// target object alive.
+gc();
+
+wf.cleanupSome();
+assertEquals(0, cleanup_count);
+
+%RunMicrotasks();
+// Next turn.
+
+// Now the WeakRef can be cleared.
+gc();
+wf.cleanupSome();
+
+assertEquals(1, cleanup_count);
+assertEquals(1, cleanup_cells.length);
+assertEquals(weak_ref, cleanup_cells[0]);
diff --git a/implementation-contributed/v8/mjsunit/mjsunit.status b/implementation-contributed/v8/mjsunit/mjsunit.status
index e279bc8b50..3cf1350206 100644
--- a/implementation-contributed/v8/mjsunit/mjsunit.status
+++ b/implementation-contributed/v8/mjsunit/mjsunit.status
@@ -717,10 +717,14 @@
'compiler/native-context-specialization-hole-check': [PASS, FAIL],
'elements-transition-hoisting': [PASS, FAIL],
'es6/collections-constructor-custom-iterator': [PASS, FAIL],
+ 'harmony/weakrefs/clear-clears-factory-pointer': [PASS, FAIL],
'keyed-load-with-symbol-key': [PASS, FAIL],
'object-seal': [PASS, FAIL],
'regress/regress-3709': [PASS, FAIL],
+ 'regress/regress-385565': [PASS, FAIL],
'regress/regress-6948': [PASS, FAIL],
+ 'regress/regress-7014-1': [PASS, FAIL],
+ 'regress/regress-7014-2': [PASS, FAIL],
'regress/regress-7510': [PASS, FAIL],
'regress/regress-crbug-882233-2': [PASS, FAIL],
'regress/regress-trap-allocation-memento': [PASS, FAIL],
diff --git a/implementation-contributed/v8/mjsunit/regexp-override-exec.js b/implementation-contributed/v8/mjsunit/regexp-override-exec.js
new file mode 100644
index 0000000000..66dbf1349f
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regexp-override-exec.js
@@ -0,0 +1,19 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var s = "baa";
+
+assertEquals(1, s.search(/a/));
+assertEquals(["aa"], s.match(/a./));
+assertEquals(["b", "", ""], s.split(/a/));
+
+let o = { index : 3, 0 : "x" };
+
+RegExp.prototype.exec = () => { return o; }
+assertEquals(3, s.search(/a/));
+assertEquals(o, s.match(/a./));
+assertEquals("baar", s.replace(/a./, "r"));
+
+RegExp.prototype.exec = () => { return null; }
+assertEquals(["baa"], s.split(/a/));
diff --git a/implementation-contributed/v8/mjsunit/regexp-override-symbol-match-all.js b/implementation-contributed/v8/mjsunit/regexp-override-symbol-match-all.js
new file mode 100644
index 0000000000..b5b99f232d
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regexp-override-symbol-match-all.js
@@ -0,0 +1,12 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-string-matchall
+
+var s = "baa";
+
+assertEquals([["b"]], [...s.matchAll(/./)]);
+
+RegExp.prototype[Symbol.matchAll] = () => 42;
+assertEquals(42, s.matchAll(/a./));
diff --git a/implementation-contributed/v8/mjsunit/regexp-override-symbol-match.js b/implementation-contributed/v8/mjsunit/regexp-override-symbol-match.js
new file mode 100644
index 0000000000..da9b6f5aff
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regexp-override-symbol-match.js
@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var s = "baa";
+
+assertEquals(["aa"], s.match(/a./));
+
+RegExp.prototype[Symbol.match] = () => 42;
+assertEquals(42, s.match(/a./));
diff --git a/implementation-contributed/v8/mjsunit/regexp-override-symbol-replace.js b/implementation-contributed/v8/mjsunit/regexp-override-symbol-replace.js
new file mode 100644
index 0000000000..8f3e5c1620
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regexp-override-symbol-replace.js
@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var s = "baa";
+
+assertEquals("bca", s.replace(/a/, "c"));
+
+RegExp.prototype[Symbol.replace] = () => 42;
+assertEquals(42, s.replace(/a./));
diff --git a/implementation-contributed/v8/mjsunit/regexp-override-symbol-search.js b/implementation-contributed/v8/mjsunit/regexp-override-symbol-search.js
new file mode 100644
index 0000000000..2daf25a65a
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regexp-override-symbol-search.js
@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var s = "baa";
+
+assertEquals(1, s.search(/a/));
+
+RegExp.prototype[Symbol.search] = () => 42;
+assertEquals(42, s.search(/a/));
diff --git a/implementation-contributed/v8/mjsunit/regexp-override-symbol-split.js b/implementation-contributed/v8/mjsunit/regexp-override-symbol-split.js
new file mode 100644
index 0000000000..f5d35b1862
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regexp-override-symbol-split.js
@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var s = "baa";
+
+assertEquals(["b", "", ""], s.split(/a/));
+
+RegExp.prototype[Symbol.split] = () => 42;
+assertEquals(42, s.split(/a./));
diff --git a/implementation-contributed/v8/mjsunit/regress/regress-8449.js b/implementation-contributed/v8/mjsunit/regress/regress-8449.js
new file mode 100644
index 0000000000..32fa82aa6e
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regress/regress-8449.js
@@ -0,0 +1,25 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+{
+ const x = [, 1];
+ x.__proto__ = [42];
+ const y = [...x];
+ assertEquals([42, 1], y);
+ assertTrue(y.hasOwnProperty(0));
+}
+
+{
+ const x = [, 1];
+ x.__proto__ = [42];
+ assertEquals(42, x[Symbol.iterator]().next().value);
+}
+
+{
+ const array_prototype = [].__proto__;
+ array_prototype[0] = 42;
+ const x = [, 1];
+ assertEquals(42, x[Symbol.iterator]().next().value);
+ delete array_prototype[0];
+}
diff --git a/implementation-contributed/v8/mjsunit/regress/regress-904417.js b/implementation-contributed/v8/mjsunit/regress/regress-904417.js
new file mode 100644
index 0000000000..dc469cca08
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regress/regress-904417.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar(o) {
+ return o.hello, Object.getPrototypeOf(o);
+}
+
+var y = { __proto__: {}, hello: 44 };
+var z = { hello: 45 };
+
+bar(y);
+bar(z);
+bar(y);
+%OptimizeFunctionOnNextCall(bar);
+bar(y);
diff --git a/implementation-contributed/v8/mjsunit/regress/regress-904707.js b/implementation-contributed/v8/mjsunit/regress/regress-904707.js
new file mode 100644
index 0000000000..8ff8c3a0f2
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regress/regress-904707.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+delete Float64Array.prototype.__proto__[Symbol.iterator];
+
+let a = new Float64Array(9);
+Object.defineProperty(a, "length", {
+ get: function () { %ArrayBufferNeuter(a.buffer); return 6; }
+});
+
+Float64Array.from(a);
diff --git a/implementation-contributed/v8/mjsunit/regress/regress-crbug-900674.js b/implementation-contributed/v8/mjsunit/regress/regress-crbug-900674.js
new file mode 100644
index 0000000000..7549b36a4e
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regress/regress-crbug-900674.js
@@ -0,0 +1,12 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+ let val = Promise.resolve().then();
+}
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/implementation-contributed/v8/mjsunit/regress/regress-crbug-902672.js b/implementation-contributed/v8/mjsunit/regress/regress-crbug-902672.js
new file mode 100644
index 0000000000..4073b554e9
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regress/regress-crbug-902672.js
@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = this;
+var b = {};
+a.length = 4294967296; // 2 ^ 32 (max array length + 1)
+assertThrows(() => Array.prototype.join.call(a,b), TypeError);
diff --git a/implementation-contributed/v8/test262/test262.status b/implementation-contributed/v8/test262/test262.status
index 3762d2ae78..93c8cec7bd 100644
--- a/implementation-contributed/v8/test262/test262.status
+++ b/implementation-contributed/v8/test262/test262.status
@@ -625,13 +625,6 @@
'built-ins/Atomics/wait/cannot-suspend-throws': [SKIP],
'built-ins/Atomics/wait/undefined-index-defaults-to-zero': [SKIP],
- # https://bugs.chromium.org/p/v8/issues/detail?id=6890#c12
- 'built-ins/RegExp/prototype/Symbol.matchAll/isregexp-called-once': [FAIL],
- 'built-ins/RegExp/prototype/Symbol.matchAll/species-constructor': [FAIL],
- 'built-ins/RegExp/prototype/Symbol.matchAll/species-regexp-get-global-throws': [FAIL],
- 'built-ins/RegExp/prototype/Symbol.matchAll/species-regexp-get-unicode-throws': [FAIL],
- 'built-ins/String/prototype/matchAll/regexp-prototype-has-no-matchAll': [FAIL],
-
# https://bugs.chromium.org/p/v8/issues/detail?id=8258
'intl402/Locale/constructor-options-language-valid-undefined': [FAIL],
'intl402/Locale/constructor-options-throwing-getters': [FAIL],
--
GitLab