From fd299d74081efee93243cc3918f152e0ee8914f7 Mon Sep 17 00:00:00 2001
From: test262-automation <test262-automation@bocoup.com>
Date: Tue, 27 Nov 2018 19:08:20 +0000
Subject: [PATCH] [v8-test262-automation] Changes from
https://github.com/v8/v8.git at sha a8673918 on Tue Nov 27 2018 19:07:42
GMT+0000 (Coordinated Universal Time)
---
implementation-contributed/v8/mjsunit/date.js | 10 ++++++++++
.../v8/mjsunit/es9/regress/regress-904167.js | 14 ++++++++++++++
.../v8/mjsunit/mjsunit.status | 2 ++
.../v8/mjsunit/regress/regress-crbug-90771.js | 15 +++++++++++++++
.../v8/test262/test262.status | 3 ---
5 files changed, 41 insertions(+), 3 deletions(-)
create mode 100644 implementation-contributed/v8/mjsunit/es9/regress/regress-904167.js
create mode 100644 implementation-contributed/v8/mjsunit/regress/regress-crbug-90771.js
diff --git a/implementation-contributed/v8/mjsunit/date.js b/implementation-contributed/v8/mjsunit/date.js
index d847ce1e44..2b12e8d2f6 100644
--- a/implementation-contributed/v8/mjsunit/date.js
+++ b/implementation-contributed/v8/mjsunit/date.js
@@ -358,3 +358,13 @@ delete Date.prototype.getUTCMilliseconds;
assertTrue(delete Date.prototype.toString);
assertTrue('[object Date]' !== Date());
})();
+
+// Test minimum and maximum date range according to ES6 section 20.3.1.1:
+// "The actual range of times supported by ECMAScript Date objects is slightly
+// smaller: exactly -100,000,000 days to 100,000,000 days measured relative to
+// midnight at the beginning of 01 January, 1970 UTC. This gives a range of
+// 8,640,000,000,000,000 milliseconds to either side of 01 January, 1970 UTC."
+assertEquals(-8640000000000000, Date.parse("-271821-04-20T00:00:00.000Z"));
+assertEquals(8640000000000000, Date.parse("+275760-09-13T00:00:00.000Z"));
+assertTrue(isNaN(Date.parse("-271821-04-19T00:00:00.000Z")));
+assertTrue(isNaN(Date.parse("+275760-09-14T00:00:00.000Z")));
diff --git a/implementation-contributed/v8/mjsunit/es9/regress/regress-904167.js b/implementation-contributed/v8/mjsunit/es9/regress/regress-904167.js
new file mode 100644
index 0000000000..8986972a8f
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es9/regress/regress-904167.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Previously, spreading in-object properties would always treat double fields
+// as tagged, potentially dereferencing a Float64.
+
+// Ensure that we don't fail an assert from --verify-heap when cloning a
+// MutableHeapNumber in the CloneObjectIC handler case.
+var src, clone;
+for (var i = 0; i < 40000; i++) {
+ src = { ...i, x: -9007199254740991 };
+ clone = { ...src };
+}
diff --git a/implementation-contributed/v8/mjsunit/mjsunit.status b/implementation-contributed/v8/mjsunit/mjsunit.status
index 57633127dd..79701a1525 100644
--- a/implementation-contributed/v8/mjsunit/mjsunit.status
+++ b/implementation-contributed/v8/mjsunit/mjsunit.status
@@ -717,10 +717,12 @@
# Tests that fail some assertions due to checking internal state sensitive
# to GC. We mark PASS,FAIL to not skip those tests on the endurance fuzzer.
'array-literal-feedback': [PASS, FAIL],
+ 'compiler/dataview-neutered': [PASS, FAIL],
'compiler/native-context-specialization-hole-check': [PASS, FAIL],
'elements-transition-hoisting': [PASS, FAIL],
'es6/collections-constructor-custom-iterator': [PASS, FAIL],
'harmony/weakrefs/clear-clears-factory-pointer': [PASS, FAIL],
+ 'ignition/throw-if-not-hole': [PASS, FAIL],
'keyed-load-with-symbol-key': [PASS, FAIL],
'object-seal': [PASS, FAIL],
'regress/regress-3709': [PASS, FAIL],
diff --git a/implementation-contributed/v8/mjsunit/regress/regress-crbug-90771.js b/implementation-contributed/v8/mjsunit/regress/regress-crbug-90771.js
new file mode 100644
index 0000000000..b541ff8cc2
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regress/regress-crbug-90771.js
@@ -0,0 +1,15 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+// Flags: --allow-natives-syntax
+function target() {};
+
+for (let key of Object.getOwnPropertyNames(this)) {
+ try {
+ let newTarget = this[key];
+ let arg = target;
+ Reflect.construct(target, arg, newTarget);
+ } catch {}
+}
diff --git a/implementation-contributed/v8/test262/test262.status b/implementation-contributed/v8/test262/test262.status
index cff892bbec..26acc12570 100644
--- a/implementation-contributed/v8/test262/test262.status
+++ b/implementation-contributed/v8/test262/test262.status
@@ -651,9 +651,6 @@
# https://bugs.chromium.org/p/v8/issues/detail?id=6705
'built-ins/Object/assign/strings-and-symbol-order': [FAIL],
- # https://bugs.chromium.org/p/v8/issues/detail?id=7781
- 'built-ins/Date/parse/time-value-maximum-range': [FAIL],
-
# https://bugs.chromium.org/p/v8/issues/detail?id=7831
'language/statements/generators/generator-created-after-decl-inst': [FAIL],
'language/expressions/generators/generator-created-after-decl-inst': [FAIL],
--
GitLab