From bb9647dd4ba5a9d887cc6db91b51db48ac330549 Mon Sep 17 00:00:00 2001
From: test262-automation <test262-automation@bocoup.com>
Date: Fri, 16 Nov 2018 19:00:53 +0000
Subject: [PATCH] [v8-test262-automation] Changes from
 https://github.com/v8/v8.git at sha 3a8c8082 on Fri Nov 16 2018 19:00:23
 GMT+0000 (Coordinated Universal Time)

---
 .../v8/intl/regress-903566.js                 |  32 ++++++
 .../instance-of-overridden-has-instance.js    | 106 ++++++++++++++++++
 .../v8/mjsunit/harmony/bigint/misc.js         |   8 ++
 .../v8/mjsunit/regress/regress-905587.js      |   5 +
 .../v8/mjsunit/regress/regress-905907.js      |  10 ++
 .../mjsunit/regress/regress-crbug-905457.js   |  49 ++++++++
 .../v8/mjsunit/regress/wasm/regress-894307.js |  16 +++
 .../v8/test262/test262.status                 |  56 +++++++++
 8 files changed, 282 insertions(+)
 create mode 100644 implementation-contributed/v8/intl/regress-903566.js
 create mode 100644 implementation-contributed/v8/mjsunit/compiler/instance-of-overridden-has-instance.js
 create mode 100644 implementation-contributed/v8/mjsunit/harmony/bigint/misc.js
 create mode 100644 implementation-contributed/v8/mjsunit/regress/regress-905587.js
 create mode 100644 implementation-contributed/v8/mjsunit/regress/regress-905907.js
 create mode 100644 implementation-contributed/v8/mjsunit/regress/regress-crbug-905457.js
 create mode 100644 implementation-contributed/v8/mjsunit/regress/wasm/regress-894307.js

diff --git a/implementation-contributed/v8/intl/regress-903566.js b/implementation-contributed/v8/intl/regress-903566.js
new file mode 100644
index 0000000000..9346fa63a8
--- /dev/null
+++ b/implementation-contributed/v8/intl/regress-903566.js
@@ -0,0 +1,32 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+// Flags:  --allow-natives-syntax
+
+assertDoesNotThrow(()=>(new Intl.ListFormat()).format());
+// Intl.getCanonicalLocales() will create a HOLEY_ELEMENTS array
+assertDoesNotThrow(()=>(new Intl.ListFormat()).format(Intl.getCanonicalLocales()));
+assertDoesNotThrow(()=>(new Intl.ListFormat()).format(Intl.getCanonicalLocales(["en","fr"])));
+
+let arr = ["a","b","c"];
+
+// Test under no HasHoleyElements();
+assertFalse(%HasHoleyElements(arr));
+assertDoesNotThrow(()=>(new Intl.ListFormat()).format(arr));
+for (var i = 0; i < 10000; i++) {
+  arr.push("xx");
+}
+assertFalse(%HasHoleyElements(arr));
+assertDoesNotThrow(()=>(new Intl.ListFormat()).format(arr));
+
+// Test under HasHoleyElements();
+arr[arr.length + 10] = "x";
+assertTrue(%HasHoleyElements(arr));
+assertFalse(%HasDictionaryElements(arr));
+assertThrows(()=>(new Intl.ListFormat()).format(arr), TypeError);
+
+// Test it work under HasDictionaryElements();
+arr = ["a","b","c"];
+arr[arr.length + 100000] = "x";
+assertTrue(%HasDictionaryElements(arr));
+assertThrows(()=>(new Intl.ListFormat()).format(arr), TypeError);
diff --git a/implementation-contributed/v8/mjsunit/compiler/instance-of-overridden-has-instance.js b/implementation-contributed/v8/mjsunit/compiler/instance-of-overridden-has-instance.js
new file mode 100644
index 0000000000..49c8899e69
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/compiler/instance-of-overridden-has-instance.js
@@ -0,0 +1,106 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function NonConstHasInstance() {
+  var C = {
+    [Symbol.hasInstance] : () => true
+  };
+
+  function f() {
+    return {} instanceof C;
+  }
+
+  assertTrue(f());
+  assertTrue(f());
+  %OptimizeFunctionOnNextCall(f);
+  assertTrue(f());
+  C[Symbol.hasInstance] = () => false;
+  assertFalse(f());
+})();
+
+(function NumberHasInstance() {
+  var C = {
+    [Symbol.hasInstance] : 0.1
+  };
+
+  function f(b, C) {
+    if (b) return {} instanceof C;
+    return false;
+  }
+
+  function g(b) {
+    return f(b, C);
+  }
+
+  assertFalse(f(true, Number));
+  assertFalse(f(true, Number));
+  assertFalse(g(false));
+  assertFalse(g(false));
+  %OptimizeFunctionOnNextCall(g);
+  assertThrows(() => g(true));
+})();
+
+(function NonFunctionHasInstance() {
+  var C = {
+    [Symbol.hasInstance] : {}
+  };
+
+  function f(b, C) {
+    if (b) return {} instanceof C;
+    return false;
+  }
+
+  function g(b) {
+    return f(b, C);
+  }
+
+  assertFalse(f(true, Number));
+  assertFalse(f(true, Number));
+  assertFalse(g(false));
+  assertFalse(g(false));
+  %OptimizeFunctionOnNextCall(g);
+  assertThrows(() => g(true));
+})();
+
+(function NonConstHasInstanceProto() {
+  var B = {
+    [Symbol.hasInstance]() { return true; }
+  };
+
+  var C = { __proto__ : B };
+
+  function f() {
+    return {} instanceof C;
+  }
+
+  assertTrue(f());
+  assertTrue(f());
+  %OptimizeFunctionOnNextCall(f);
+  assertTrue(f());
+  B[Symbol.hasInstance] = () => { return false; };
+  assertFalse(f());
+})();
+
+(function HasInstanceOverwriteOnProto() {
+  var A = {
+    [Symbol.hasInstance] : () => false
+  }
+
+  var B = { __proto__ : A };
+
+  var C = { __proto__ : B };
+
+  function f() {
+    return {} instanceof C;
+  }
+
+  assertFalse(f());
+  assertFalse(f());
+  %OptimizeFunctionOnNextCall(f);
+  assertFalse(f());
+  B[Symbol.hasInstance] = () => { return true; };
+  assertTrue(f());
+})();
diff --git a/implementation-contributed/v8/mjsunit/harmony/bigint/misc.js b/implementation-contributed/v8/mjsunit/harmony/bigint/misc.js
new file mode 100644
index 0000000000..1a11547353
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/harmony/bigint/misc.js
@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Create BigInt in large object space for which MakeImmutable reduces the
+// length.
+const x = 2n ** (2n ** 22n);
+assertEquals(1n, x - (x - 1n));
diff --git a/implementation-contributed/v8/mjsunit/regress/regress-905587.js b/implementation-contributed/v8/mjsunit/regress/regress-905587.js
new file mode 100644
index 0000000000..297846d02b
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regress/regress-905587.js
@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("function test() { '\\u`''\\u' }", SyntaxError)
diff --git a/implementation-contributed/v8/mjsunit/regress/regress-905907.js b/implementation-contributed/v8/mjsunit/regress/regress-905907.js
new file mode 100644
index 0000000000..06bbb51f56
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regress/regress-905907.js
@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var g = function f(a = 3) {
+  var context_allocated = undefined;
+  function inner() { f(); f(context_allocated) };
+  inner();
+};
+assertThrows("g()", RangeError);
diff --git a/implementation-contributed/v8/mjsunit/regress/regress-crbug-905457.js b/implementation-contributed/v8/mjsunit/regress/regress-crbug-905457.js
new file mode 100644
index 0000000000..3a97a87520
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regress/regress-crbug-905457.js
@@ -0,0 +1,49 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+  function foo(x) {
+    return Math.abs(Math.min(+x, 0));
+  }
+
+  assertEquals(NaN, foo());
+  assertEquals(NaN, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(NaN, foo());
+})();
+
+(function() {
+  function foo(x) {
+    return Math.abs(Math.min(-x, 0));
+  }
+
+  assertEquals(NaN, foo());
+  assertEquals(NaN, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(NaN, foo());
+})();
+
+(function() {
+  function foo(x) {
+    return Math.abs(Math.max(0, +x));
+  }
+
+  assertEquals(NaN, foo());
+  assertEquals(NaN, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(NaN, foo());
+})();
+
+(function() {
+  function foo(x) {
+    return Math.abs(Math.max(0, -x));
+  }
+
+  assertEquals(NaN, foo());
+  assertEquals(NaN, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(NaN, foo());
+})();
diff --git a/implementation-contributed/v8/mjsunit/regress/wasm/regress-894307.js b/implementation-contributed/v8/mjsunit/regress/wasm/regress-894307.js
new file mode 100644
index 0000000000..5aef9eba86
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regress/wasm/regress-894307.js
@@ -0,0 +1,16 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+const sig = makeSig([kWasmI32, kWasmI64, kWasmI64], [kWasmI64]);
+builder.addFunction(undefined, sig)
+  .addBody([
+    kExprGetLocal, 2,
+    kExprGetLocal, 1,
+    kExprI64Shl,
+]);
+builder.instantiate();
diff --git a/implementation-contributed/v8/test262/test262.status b/implementation-contributed/v8/test262/test262.status
index 93c8cec7bd..708542fcbb 100644
--- a/implementation-contributed/v8/test262/test262.status
+++ b/implementation-contributed/v8/test262/test262.status
@@ -328,6 +328,62 @@
   'language/literals/regexp/invalid-optional-negative-lookbehind': [FAIL],
   'language/literals/regexp/invalid-range-lookbehind': [FAIL],
   'language/literals/regexp/invalid-range-negative-lookbehind': [FAIL],
+  'language/literals/regexp/named-groups/invalid-dangling-groupname': [FAIL],
+  'language/literals/regexp/named-groups/invalid-dangling-groupname-2': [FAIL],
+  'language/literals/regexp/named-groups/invalid-dangling-groupname-2-u': [FAIL],
+  'language/literals/regexp/named-groups/invalid-dangling-groupname-3': [FAIL],
+  'language/literals/regexp/named-groups/invalid-dangling-groupname-3-u': [FAIL],
+  'language/literals/regexp/named-groups/invalid-dangling-groupname-4': [FAIL],
+  'language/literals/regexp/named-groups/invalid-dangling-groupname-4-u': [FAIL],
+  'language/literals/regexp/named-groups/invalid-dangling-groupname-5': [FAIL],
+  'language/literals/regexp/named-groups/invalid-dangling-groupname-u': [FAIL],
+  'language/literals/regexp/named-groups/invalid-dangling-groupname-without-group-u': [FAIL],
+  'language/literals/regexp/named-groups/invalid-duplicate-groupspecifier': [FAIL],
+  'language/literals/regexp/named-groups/invalid-duplicate-groupspecifier-2': [FAIL],
+  'language/literals/regexp/named-groups/invalid-duplicate-groupspecifier-2-u': [FAIL],
+  'language/literals/regexp/named-groups/invalid-duplicate-groupspecifier-u': [FAIL],
+  'language/literals/regexp/named-groups/invalid-empty-groupspecifier': [FAIL],
+  'language/literals/regexp/named-groups/invalid-empty-groupspecifier-u': [FAIL],
+  'language/literals/regexp/named-groups/invalid-identity-escape-in-capture-u': [FAIL],
+  'language/literals/regexp/named-groups/invalid-incomplete-groupname': [FAIL],
+  'language/literals/regexp/named-groups/invalid-incomplete-groupname-2': [FAIL],
+  'language/literals/regexp/named-groups/invalid-incomplete-groupname-2-u': [FAIL],
+  'language/literals/regexp/named-groups/invalid-incomplete-groupname-3': [FAIL],
+  'language/literals/regexp/named-groups/invalid-incomplete-groupname-3-u': [FAIL],
+  'language/literals/regexp/named-groups/invalid-incomplete-groupname-4': [FAIL],
+  'language/literals/regexp/named-groups/invalid-incomplete-groupname-5': [FAIL],
+  'language/literals/regexp/named-groups/invalid-incomplete-groupname-6': [FAIL],
+  'language/literals/regexp/named-groups/invalid-incomplete-groupname-u': [FAIL],
+  'language/literals/regexp/named-groups/invalid-incomplete-groupname-without-group-2-u': [FAIL],
+  'language/literals/regexp/named-groups/invalid-incomplete-groupname-without-group-3-u': [FAIL],
+  'language/literals/regexp/named-groups/invalid-incomplete-groupname-without-group-u': [FAIL],
+  'language/literals/regexp/named-groups/invalid-non-id-continue-groupspecifier': [FAIL],
+  'language/literals/regexp/named-groups/invalid-non-id-continue-groupspecifier-4': [FAIL],
+  'language/literals/regexp/named-groups/invalid-non-id-continue-groupspecifier-4-u': [FAIL],
+  'language/literals/regexp/named-groups/invalid-non-id-start-groupspecifier': [FAIL],
+  'language/literals/regexp/named-groups/invalid-non-id-start-groupspecifier-2': [FAIL],
+  'language/literals/regexp/named-groups/invalid-non-id-start-groupspecifier-2-u': [FAIL],
+  'language/literals/regexp/named-groups/invalid-non-id-start-groupspecifier-3': [FAIL],
+  'language/literals/regexp/named-groups/invalid-non-id-start-groupspecifier-4': [FAIL],
+  'language/literals/regexp/named-groups/invalid-non-id-start-groupspecifier-4-u': [FAIL],
+  'language/literals/regexp/named-groups/invalid-non-id-start-groupspecifier-5': [FAIL],
+  'language/literals/regexp/named-groups/invalid-non-id-start-groupspecifier-5-u': [FAIL],
+  'language/literals/regexp/named-groups/invalid-non-id-start-groupspecifier-6': [FAIL],
+  'language/literals/regexp/named-groups/invalid-non-id-start-groupspecifier-7': [FAIL],
+  'language/literals/regexp/named-groups/invalid-non-id-start-groupspecifier-8': [FAIL],
+  'language/literals/regexp/named-groups/invalid-non-id-start-groupspecifier-8-u': [FAIL],
+  'language/literals/regexp/named-groups/invalid-non-id-start-groupspecifier-9-u': [FAIL],
+  'language/literals/regexp/named-groups/invalid-non-id-start-groupspecifier-u': [FAIL],
+  'language/literals/regexp/named-groups/invalid-numeric-groupspecifier': [FAIL],
+  'language/literals/regexp/named-groups/invalid-numeric-groupspecifier-u': [FAIL],
+  'language/literals/regexp/named-groups/invalid-punctuator-starting-groupspecifier': [FAIL],
+  'language/literals/regexp/named-groups/invalid-punctuator-starting-groupspecifier-u': [FAIL],
+  'language/literals/regexp/named-groups/invalid-punctuator-within-groupspecifier': [FAIL],
+  'language/literals/regexp/named-groups/invalid-punctuator-within-groupspecifier-u': [FAIL],
+  'language/literals/regexp/named-groups/invalid-u-escape-in-groupspecifier': [FAIL],
+  'language/literals/regexp/named-groups/invalid-u-escape-in-groupspecifier-2': [FAIL],
+  'language/literals/regexp/named-groups/invalid-unterminated-groupspecifier': [FAIL],
+  'language/literals/regexp/named-groups/invalid-unterminated-groupspecifier-u': [FAIL],
   'language/literals/regexp/u-dec-esc': [FAIL],
   'language/literals/regexp/u-invalid-class-escape': [FAIL],
   'language/literals/regexp/u-invalid-extended-pattern-char': [FAIL],
-- 
GitLab