[v8-test262-automation] Updated curation log with latest revision sha's from export and changed files.

sourceRevisionAtLastExport: 7b32eb8c targetRevisionAtLastExport: ffefa2383

implementation-contributed/curation_logs/v8.json

@@ -1,5 +1,5 @@
 {
-  "sourceRevisionAtLastExport": "7b32eb8c",
-  "targetRevisionAtLastExport": "ffefa2383",
+  "sourceRevisionAtLastExport": "4ab8215e",
+  "targetRevisionAtLastExport": "92143ed8c",
   "curatedFiles": {}
 }

implementation-contributed/v8/mjsunit/code-coverage-block.js

@@ -471,7 +471,7 @@ TestCoverage(
  {"start":472,"end":503,"count":0},
  {"start":626,"end":653,"count":0},
  {"start":768,"end":803,"count":0},
- {"start":867,"end":869,"count":0}]
+ {"start":867,"end":868,"count":0}]
 );
 
 TestCoverage(
@@ -847,7 +847,7 @@ Util.escape("foo.bar");                   // 0400
 [{"start":0,"end":449,"count":1},
  {"start":64,"end":351,"count":1},
  {"start":112,"end":203,"count":0},
- {"start":303,"end":350,"count":0}]
+ {"start":268,"end":350,"count":0}]
 );
 
 %DebugToggleBlockCoverage(false);

implementation-contributed/v8/mjsunit/compiler/number-ceil.js

@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberCeil propagates kIdentifyZeros truncations.
+(function() {
+  function foo(x) {
+    return Math.abs(Math.ceil(x * -2));
+  }
+
+  assertEquals(2, foo(1));
+  assertEquals(4, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(1));
+  assertEquals(4, foo(2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();

implementation-contributed/v8/mjsunit/compiler/number-comparison-truncations.js

@@ -0,0 +1,152 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that SpeculativeNumberEqual[SignedSmall] properly passes the
+// kIdentifyZeros truncation.
+(function() {
+  function foo(x, y) {
+    if (x * y === 0) return 0;
+    return 1;
+  }
+
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  assertOptimized(foo);
+  // Even if x*y produces -0 now, it should stay optimized.
+  assertEquals(0, foo(-3, 0));
+  assertEquals(0, foo(0, -3));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberEqual[Number] properly passes the
+// kIdentifyZeros truncation.
+(function() {
+  // Produce a SpeculativeNumberEqual with Number feedback.
+  function bar(x, y) { return x === y; }
+  bar(0.1, 0.5);
+  bar(-0, 100);
+
+  function foo(x, y) {
+    if (bar(x * y, 0)) return 0;
+    return 1;
+  }
+
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  assertOptimized(foo);
+  // Even if x*y produces -0 now, it should stay optimized.
+  assertEquals(0, foo(-3, 0));
+  assertEquals(0, foo(0, -3));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberLessThan[SignedSmall] properly passes the
+// kIdentifyZeros truncation.
+(function() {
+  function foo(x, y) {
+    if (x * y < 0) return 0;
+    return 1;
+  }
+
+  assertEquals(0, foo(1, -1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(1, -1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  assertOptimized(foo);
+  // Even if x*y produces -0 now, it should stay optimized.
+  assertEquals(1, foo(-3, 0));
+  assertEquals(1, foo(0, -3));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberLessThan[Number] properly passes the
+// kIdentifyZeros truncation.
+(function() {
+  // Produce a SpeculativeNumberLessThan with Number feedback.
+  function bar(x, y) { return x < y; }
+  bar(0.1, 0.5);
+  bar(-0, 100);
+
+  function foo(x, y) {
+    if (bar(x * y, 0)) return 0;
+    return 1;
+  }
+
+  assertEquals(0, foo(1, -1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(1, -1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  assertOptimized(foo);
+  // Even if x*y produces -0 now, it should stay optimized.
+  assertEquals(1, foo(-3, 0));
+  assertEquals(1, foo(0, -3));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberLessThanOrEqual[SignedSmall] properly passes the
+// kIdentifyZeros truncation.
+(function() {
+  function foo(x, y) {
+    if (x * y <= 0) return 0;
+    return 1;
+  }
+
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  assertOptimized(foo);
+  // Even if x*y produces -0 now, it should stay optimized.
+  assertEquals(0, foo(-3, 0));
+  assertEquals(0, foo(0, -3));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberLessThanOrEqual[Number] properly passes the
+// kIdentifyZeros truncation.
+(function() {
+  // Produce a SpeculativeNumberLessThanOrEqual with Number feedback.
+  function bar(x, y) { return x <= y; }
+  bar(0.1, 0.5);
+  bar(-0, 100);
+
+  function foo(x, y) {
+    if (bar(x * y, 0)) return 0;
+    return 1;
+  }
+
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  assertOptimized(foo);
+  // Even if x*y produces -0 now, it should stay optimized.
+  assertEquals(0, foo(-3, 0));
+  assertEquals(0, foo(0, -3));
+  assertOptimized(foo);
+})();

implementation-contributed/v8/mjsunit/compiler/number-floor.js

@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberFloor propagates kIdentifyZeros truncations.
+(function() {
+  function foo(x) {
+    return Math.abs(Math.floor(x * -2));
+  }
+
+  assertEquals(2, foo(1));
+  assertEquals(4, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(1));
+  assertEquals(4, foo(2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();

implementation-contributed/v8/mjsunit/compiler/number-max.js

@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberMax properly passes the kIdentifyZeros truncation.
+(function() {
+  function foo(x) {
+    if (Math.max(x * -2, 1) == 1) return 0;
+    return 1;
+  }
+
+  assertEquals(0, foo(2));
+  assertEquals(1, foo(-1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(2));
+  assertEquals(1, foo(-1));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();

implementation-contributed/v8/mjsunit/compiler/number-min.js

@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberMin properly passes the kIdentifyZeros truncation.
+(function() {
+  function foo(x) {
+    if (Math.min(x * -2, -1) == -2) return 0;
+    return 1;
+  }
+
+  assertEquals(0, foo(1));
+  assertEquals(1, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(1));
+  assertEquals(1, foo(2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(1, foo(0));
+  assertOptimized(foo);
+})();

implementation-contributed/v8/mjsunit/compiler/number-toboolean.js

@@ -0,0 +1,45 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberToBoolean properly passes the kIdentifyZeros truncation
+// for Signed32 \/ MinusZero inputs.
+(function() {
+  function foo(x) {
+    if (x * -2) return 1;
+    return 0;
+  }
+
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();
+
+
+// Test that NumberToBoolean properly passes the kIdentifyZeros truncation
+// for Unsigned32 \/ MinusZero inputs.
+(function() {
+  function foo(x) {
+    x = x | 0;
+    if (Math.max(x * -2, 0)) return 1;
+    return 0;
+  }
+
+  assertEquals(1, foo(-1));
+  assertEquals(1, foo(-2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(-1));
+  assertEquals(1, foo(-2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();

implementation-contributed/v8/mjsunit/compiler/number-trunc.js

@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberTrunc propagates kIdentifyZeros truncations.
+(function() {
+  function foo(x) {
+    return Math.abs(Math.trunc(x * -2));
+  }
+
+  assertEquals(2, foo(1));
+  assertEquals(4, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(1));
+  assertEquals(4, foo(2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();

implementation-contributed/v8/mjsunit/compiler/regress-890620.js

@@ -0,0 +1,25 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = 42;
+
+function g(n) {
+  while (n > 0) {
+    a = new Array(n);
+    n--;
+  }
+}
+
+g(1);
+
+function f() {
+  g();
+}
+
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
+assertEquals(1, a.length);

implementation-contributed/v8/mjsunit/es6/string-iterator2.js

@@ -0,0 +1,24 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// Tests for primitive strings.
+
+var str = 'ott';
+assertEquals(['o', 't', 't'], [...str]);
+assertTrue(%StringIteratorProtector());
+
+str[Symbol.iterator] = {};
+// Symbol.iterator can't be set on primitive strings, so it shouldn't invalidate
+// the protector.
+assertTrue(%StringIteratorProtector());
+
+// This changes the String Iterator prototype. No more tests should be run after
+// this in the same instance.
+var iterator = str[Symbol.iterator]();
+iterator.__proto__.next = () => ({value : undefined, done : true});
+
+assertFalse(%StringIteratorProtector());
+assertEquals([], [...str]);

implementation-contributed/v8/mjsunit/es6/string-iterator3.js

@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// Tests for primitive strings.
+
+var str = 'ott';
+assertTrue(%StringIteratorProtector());
+assertEquals(['o', 't', 't'], [...str]);
+
+// This changes the String prototype. No more tests should be run after this in
+// the same instance.
+str.__proto__[Symbol.iterator] =
+    function() {
+      return {next : () => ({value : undefined, done : true})};
+    };
+assertFalse(%StringIteratorProtector());
+assertEquals([], [...str]);

implementation-contributed/v8/mjsunit/es6/string-iterator4.js

@@ -0,0 +1,30 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// Tests for wrapped strings.
+
+var str = new String('ott');
+assertTrue(%StringIteratorProtector());
+assertEquals(['o', 't', 't'], [...str]);
+
+function iterator_fn() {
+  return {next : () => ({value : undefined, done : true})};
+};
+
+str[Symbol.iterator] = iterator_fn;
+// This shouldn't invalidate the protector, because it doesn't support String
+// objects.
+assertTrue(%StringIteratorProtector());
+assertEquals([], [...str]);
+
+
+var str2 = new String('ott');
+assertEquals(['o', 't', 't'], [...str2]);
+// This changes the String prototype. No more tests should be run after this in
+// the same instance.
+str2.__proto__[Symbol.iterator] = iterator_fn;
+assertFalse(%StringIteratorProtector());
+assertEquals([], [...str2]);

implementation-contributed/v8/mjsunit/es6/string-iterator5.js

@@ -0,0 +1,15 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Tests for primitive strings.
+
+var iterator = 'ott'[Symbol.iterator]();
+
+// These modifications shouldn't invalidate the String iterator protector.
+iterator.__proto__.fonts = {};
+assertTrue(%StringIteratorProtector());
+iterator.__proto__[0] = 0;
+assertTrue(%StringIteratorProtector());

implementation-contributed/v8/mjsunit/es6/string-iterator6.js

@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+assertTrue(%StringIteratorProtector());
+
+delete 'ott'.__proto__[Symbol.iterator];
+
+assertFalse(%StringIteratorProtector());

implementation-contributed/v8/mjsunit/es6/string-iterator7.js

@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+assertTrue(%StringIteratorProtector());
+
+const p = ""[Symbol.iterator]().__proto__;
+let x = Object.create(p);
+x.next = 42;
+
+assertTrue(%StringIteratorProtector());

implementation-contributed/v8/mjsunit/es6/string-iterator8.js

@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+assertTrue(%StringIteratorProtector());
+
+var proto = String.prototype;
+
+String.prototype = {};
+
+assertEquals(proto, String.prototype);
+assertTrue(%StringIteratorProtector());

implementation-contributed/v8/mjsunit/regress/regress-8237.js

@@ -0,0 +1,57 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-always-opt
+// Files: test/mjsunit/code-coverage-utils.js
+
+%DebugToggleBlockCoverage(true);
+
+TestCoverage(
+"Repro for the bug",
+`
+function lib (n) {                        // 0000
+  if (n >= 0) {                           // 0050
+    if (n < 0) {                          // 0100
+      return;                             // 0150
+    }                                     // 0200
+  } else if (foo()) {                     // 0250
+  }                                       // 0300
+}                                         // 0350
+function foo () {                         // 0400
+  console.log('foo')                      // 0450
+  return false                            // 0500
+}                                         // 0550
+lib(1)                                    // 0600
+`,
+[{"start":0,"end":649,"count":1},
+{"start":0,"end":351,"count":1},
+{"start":115,"end":205,"count":0},
+{"start":253,"end":303,"count":0},
+{"start":400,"end":551,"count":0}]
+);
+
+TestCoverage(
+"Variant with omitted brackets",
+`
+function lib (n) {                        // 0000
+  if (n >= 0) {                           // 0050
+    if (n < 0)                            // 0100
+      return;                             // 0150
+  }                                       // 0200
+  else if (foo());                        // 0250
+}                                         // 0300
+function foo () {                         // 0350
+  console.log('foo')                      // 0400
+  return false                            // 0450
+}                                         // 0500
+lib(1)                                    // 0550
+`,
+[{"start":0,"end":599,"count":1},
+{"start":0,"end":301,"count":1},
+{"start":156,"end":163,"count":0},
+{"start":203,"end":268,"count":0},
+{"start":350,"end":501,"count":0}]
+);
+
+%DebugToggleBlockCoverage(false);

implementation-contributed/v8/mjsunit/regress/regress-890553.js

@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var s = "function __f_9(func, testName) {" +
+  "var __v_0 = function __f_10(__v_14, __v_14) {" +
+  "  return __v_16;" +
+  "}; " +
+"}"
+assertThrows(function() { eval(s); });

implementation-contributed/v8/mjsunit/regress/regress-crbug-890243.js

@@ -0,0 +1,27 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// We need a SpeculativeNumberAdd with Number feedback.
+function bar(x) { return x + x; }
+bar(0.1);
+
+// We also need an indirection via an object field such
+// that only after escape analysis TurboFan can figure
+// out that the value `y` is actually a Number in the
+// safe integer range.
+function baz(y) { return {y}; }
+baz(null); baz(0);
+
+// Now we can put all of that together to get a kRepBit
+// use of a kWord64 value (on 64-bit architectures).
+function foo(o) {
+  return !baz(bar(o.x)).y;
+}
+
+assertFalse(foo({x:1}));
+assertFalse(foo({x:1}));
+%OptimizeFunctionOnNextCall(foo);
+assertFalse(foo({x:1}));

implementation-contributed/v8/test262/test262.status

@@ -364,9 +364,6 @@
   'language/global-code/script-decl-func-err-non-configurable': [FAIL],
   'language/global-code/script-decl-var-collision': [FAIL],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=4958
-  'built-ins/Function/prototype/toString/*': ['--harmony-function-tostring'],
-
   # https://bugs.chromium.org/p/v8/issues/detail?id=5116
   'built-ins/TypedArray/prototype/fill/fill-values-conversion-operations-consistent-nan': [PASS, FAIL],
 
@@ -564,26 +561,36 @@
   'intl402/Collator/ignore-invalid-unicode-ext-values': [SKIP],
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=7684
+  'intl402/Locale/constructor-non-iana-canon': [FAIL],
+  'intl402/Locale/constructor-options-language-valid': [FAIL],
+  'intl402/Locale/constructor-parse-twice': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=8246
+  'intl402/Locale/constructor-tag': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=8244
   'intl402/Locale/constructor-getter-order': [FAIL],
   'intl402/Locale/constructor-locale-object': [FAIL],
-  'intl402/Locale/constructor-non-iana-canon': [FAIL],
   'intl402/Locale/constructor-options-language-grandfathered': [FAIL],
   'intl402/Locale/constructor-options-language-invalid': [FAIL],
-  'intl402/Locale/constructor-options-language-valid': [FAIL],
   'intl402/Locale/constructor-options-region-invalid': [FAIL],
   'intl402/Locale/constructor-options-region-valid': [FAIL],
   'intl402/Locale/constructor-options-script-invalid': [FAIL],
   'intl402/Locale/constructor-options-script-valid': [FAIL],
-  'intl402/Locale/constructor-parse-twice': [FAIL],
-  'intl402/Locale/constructor-tag': [FAIL],
   'intl402/Locale/constructor-unicode-ext-invalid': [FAIL],
-  'intl402/Locale/extensions-grandfathered': [FAIL],
-  'intl402/Locale/extensions-private': [FAIL],
   'intl402/Locale/getters': [FAIL],
-  'intl402/Locale/getters-grandfathered': [FAIL],
-  'intl402/Locale/getters-privateuse': [FAIL],
   'intl402/Locale/invalid-tag-throws': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=8243
+  'intl402/Locale/extensions-private': [FAIL],
+  'intl402/Locale/getters-privateuse': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=8236
   'intl402/Locale/likely-subtags': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=8242
+  'intl402/Locale/extensions-grandfathered': [FAIL],
+  'intl402/Locale/getters-grandfathered': [FAIL],
   'intl402/Locale/likely-subtags-grandfathered': [FAIL],
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=6705