[v8-test262-automation] Changes from https://github.com/v8/v8.git at sha 44b1b245 on Sat Dec 15 2018 19:17:33 GMT+0000 (Coordinated Universal Time)

implementation-contributed/v8/intl/intl.status

@@ -29,9 +29,6 @@
 [ALWAYS, {
   # TODO(jochen): The following test is flaky.
   'overrides/caching': [PASS, FAIL],
-
-  # https://crbug.com/v8/8469
-  'regress-8469': [FAIL],
 }],  # ALWAYS
 
 ['variant == no_wasm_traps', {

implementation-contributed/v8/mjsunit/code-coverage-ad-hoc.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --no-always-opt
+// Flags: --allow-natives-syntax --no-always-opt --no-stress-flush-bytecode
 // Files: test/mjsunit/code-coverage-utils.js
 
 // Test code coverage without explicitly activating it upfront.

implementation-contributed/v8/mjsunit/code-coverage-block-noopt.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --no-always-opt
+// Flags: --allow-natives-syntax --no-always-opt --no-stress-flush-bytecode
 // Flags: --no-opt
 // Files: test/mjsunit/code-coverage-utils.js
 

implementation-contributed/v8/mjsunit/code-coverage-block-opt.js

@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax --no-always-opt --opt
+// Flags: --no-stress-flush-bytecode
 // Files: test/mjsunit/code-coverage-utils.js
 
 if (isNeverOptimizeLiteMode()) {

implementation-contributed/v8/mjsunit/code-coverage-class-fields.js

@@ -2,7 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --no-always-opt --harmony-public-fields --harmony-static-fields
+// Flags: --allow-natives-syntax --no-always-opt --harmony-public-fields
+// Flags: --harmony-static-fields --no-stress-flush-bytecode
 // Files: test/mjsunit/code-coverage-utils.js
 
 %DebugToggleBlockCoverage(true);

implementation-contributed/v8/mjsunit/code-coverage-precise.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --no-always-opt
+// Flags: --allow-natives-syntax --no-always-opt --no-stress-flush-bytecode
 // Flags: --no-stress-incremental-marking
 // Files: test/mjsunit/code-coverage-utils.js
 

implementation-contributed/v8/mjsunit/compiler/dataview-get.js

@@ -173,14 +173,14 @@ assertUnoptimized(readFloat64);
   assertUnoptimized(readUint8);
 })();
 
-// TurboFan neutered buffer deopts.
+// TurboFan detached buffer deopts.
 (function() {
   function readInt8Handled(offset) {
     try { return dataview.getInt8(offset); } catch (e) { return e; }
   }
   warmup(readInt8Handled);
   assertOptimized(readInt8Handled);
-  %ArrayBufferNeuter(buffer);
+  %ArrayBufferDetach(buffer);
   assertInstanceof(readInt8Handled(0), TypeError);
   assertUnoptimized(readInt8Handled);
 })();

implementation-contributed/v8/mjsunit/es6/array-iterator-detached.js

@@ -11,13 +11,13 @@ function Baseline() {
   assertEquals(0, it.next().value);
   assertEquals(1, it.next().value);
   assertEquals(2, it.next().value);
-  %ArrayBufferNeuter(array.buffer);
+  %ArrayBufferDetach(array.buffer);
   it.next();
 };
 %NeverOptimizeFunction(Baseline);
 
 assertThrows(Baseline, TypeError,
-    "Cannot perform Array Iterator.prototype.next on a detached ArrayBuffer");
+    "Cannot perform Array Iterator.prototype.next on a neutered ArrayBuffer");
 
 function Turbo(count = 10000) {
   let array = Array(10000);
@@ -32,7 +32,7 @@ function Turbo(count = 10000) {
   for (let i = 0; i < count; ++i) {
     let result = it.next();
     if (result.value === 255) {
-      %ArrayBufferNeuter(array.buffer);
+      %ArrayBufferDetach(array.buffer);
     }
     sum += result.value;
   }
@@ -44,4 +44,4 @@ Turbo(10);
 %OptimizeFunctionOnNextCall(Turbo);
 
 assertThrows(Turbo, TypeError,
-    "Cannot perform Array Iterator.prototype.next on a detached ArrayBuffer");
+    "Cannot perform Array Iterator.prototype.next on a neutered ArrayBuffer");

implementation-contributed/v8/mjsunit/es6/array-iterator-turbo.js

@@ -217,7 +217,7 @@ let tests = {
 
       // Throw when detached
       let clone = new array.constructor(array);
-      %ArrayBufferNeuter(clone.buffer);
+      %ArrayBufferDetach(clone.buffer);
       assertThrows(() => sum(clone), TypeError);
 
       // Clear the slate for the next iteration.

implementation-contributed/v8/mjsunit/es6/regress/regress-5929-1.js

@@ -8,7 +8,7 @@ var buf = new ArrayBuffer(0x10000);
 var arr = new Uint8Array(buf).fill(55);
 var tmp = {};
 tmp[Symbol.toPrimitive] = function () {
-  %ArrayBufferNeuter(arr.buffer);
+  %ArrayBufferDetach(arr.buffer);
   return 50;
 }
 arr.copyWithin(tmp);

implementation-contributed/v8/mjsunit/es6/typedarray-copywithin.js

@@ -232,13 +232,13 @@ CheckEachTypedArray(function parametersNotCalledIfDetached(constructor) {
   var tmp = {
     [Symbol.toPrimitive]() {
       assertUnreachable("Parameter should not be processed when " +
-                        "array.[[ViewedArrayBuffer]] is neutered.");
+                        "array.[[ViewedArrayBuffer]] is detached.");
       return 0;
     }
   };
 
   var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
-  %ArrayBufferNeuter(array.buffer);
+  %ArrayBufferDetach(array.buffer);
 
   assertThrows(() => array.copyWithin(tmp, tmp, tmp), TypeError);
   assertEquals(0, array.length, "array.[[ViewedArrayBuffer]] is detached");

implementation-contributed/v8/mjsunit/es6/typedarray-every.js

@@ -15,7 +15,7 @@ var typedArrayConstructors = [
   Float32Array,
   Float64Array];
 
-function CheckTypedArrayIsNeutered(array) {
+function CheckTypedArrayIsDetached(array) {
   assertEquals(0, array.byteLength);
   assertEquals(0, array.byteOffset);
   assertEquals(0, array.length);
@@ -81,21 +81,21 @@ function TestTypedArrayForEach(constructor) {
   CheckWrapping(3.14, Number);
   CheckWrapping({}, Object);
 
-  // Neutering the buffer backing the typed array mid-way should
+  // Detaching the buffer backing the typed array mid-way should
   // still make .forEach() finish, and the array should keep being
-  // empty after neutering it.
+  // empty after detaching it.
   count = 0;
   a = new constructor(3);
   result = a.every(function (n, index, array) {
-    assertFalse(array[index] === undefined);  // don't get here if neutered
-    if (count > 0) %ArrayBufferNeuter(array.buffer);
+    assertFalse(array[index] === undefined);  // don't get here if detached
+    if (count > 0) %ArrayBufferDetach(array.buffer);
     array[index] = n + 1;
     count++;
     return count > 1 ? array[index] === undefined : true;
   });
   assertEquals(2, count);
   assertEquals(true, result);
-  CheckTypedArrayIsNeutered(a);
+  CheckTypedArrayIsDetached(a);
   assertEquals(undefined, a[0]);
 
   // Calling array.buffer midway can change the backing store.
@@ -161,7 +161,7 @@ function TestTypedArrayForEach(constructor) {
 
   // Detached Operation
   var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
-  %ArrayBufferNeuter(array.buffer);
+  %ArrayBufferDetach(array.buffer);
   assertThrows(() => array.every(() => true), TypeError);
 }
 

implementation-contributed/v8/mjsunit/es6/typedarray-fill.js

@@ -74,12 +74,12 @@ for (var constructor of typedArrayConstructors) {
   var tmp = {
     [Symbol.toPrimitive]() {
       assertUnreachable("Parameter should not be processed when " +
-                        "array.[[ViewedArrayBuffer]] is neutered.");
+                        "array.[[ViewedArrayBuffer]] is detached.");
       return 0;
     }
   };
   var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
-  %ArrayBufferNeuter(array.buffer);
+  %ArrayBufferDetach(array.buffer);
   assertThrows(() => array.fill(tmp), TypeError);
 }
 

implementation-contributed/v8/mjsunit/es6/typedarray-filter.js

@@ -21,7 +21,7 @@ function TestTypedArrayFilter(constructor) {
   // Throw type error if source array is detached while executing a callback
   let ta1 = new constructor(10);
   assertThrows(() =>
-    ta1.filter(() => %ArrayBufferNeuter(ta1.buffer))
+    ta1.filter(() => %ArrayBufferDetach(ta1.buffer))
   , TypeError);
 
   // A new typed array should be created after finishing callbacks

implementation-contributed/v8/mjsunit/es6/typedarray-find.js

@@ -190,13 +190,13 @@ assertEquals(x, 4);
 var tmp = {
   [Symbol.toPrimitive]() {
     assertUnreachable("Parameter should not be processed when " +
-                      "array.[[ViewedArrayBuffer]] is neutered.");
+                      "array.[[ViewedArrayBuffer]] is detached.");
     return 0;
   }
 };
 
 var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
-%ArrayBufferNeuter(array.buffer);
+%ArrayBufferDetach(array.buffer);
 
 assertThrows(() => array.find(tmp), TypeError);
 }

implementation-contributed/v8/mjsunit/es6/typedarray-findindex.js

@@ -190,11 +190,11 @@ assertEquals(x, 4);
   var tmp = {
     [Symbol.toPrimitive]() {
       assertUnreachable("Parameter should not be processed when " +
-                        "array.[[ViewedArrayBuffer]] is neutered.");
+                        "array.[[ViewedArrayBuffer]] is detached.");
       return 0;
     }
   };
   var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
-  %ArrayBufferNeuter(array.buffer);
+  %ArrayBufferDetach(array.buffer);
   assertThrows(() => array.findIndex(tmp), TypeError);
 }

implementation-contributed/v8/mjsunit/es6/typedarray-foreach.js

@@ -15,7 +15,7 @@ var typedArrayConstructors = [
   Float32Array,
   Float64Array];
 
-function CheckTypedArrayIsNeutered(array) {
+function CheckTypedArrayIsDetached(array) {
   assertEquals(0, array.byteLength);
   assertEquals(0, array.byteOffset);
   assertEquals(0, array.length);
@@ -84,7 +84,7 @@ function TestTypedArrayForEach(constructor) {
   assertEquals(43, a[0]);
   assertEquals(42, a[1]);
 
-  // Neutering the buffer backing the typed array mid-way should
+  // Detaching the buffer backing the typed array mid-way should
   // still make .forEach() finish, but exiting early due to the missing
   // elements, and the array should keep being empty after detaching it.
   // TODO(dehrenberg): According to the ES6 spec, accessing or testing
@@ -94,12 +94,12 @@ function TestTypedArrayForEach(constructor) {
   a = new constructor(3);
   count = 0;
   a.forEach(function (n, index, array) {
-    if (count > 0) %ArrayBufferNeuter(array.buffer);
+    if (count > 0) %ArrayBufferDetach(array.buffer);
     array[index] = n + 1;
     count++;
   });
   assertEquals(2, count);
-  CheckTypedArrayIsNeutered(a);
+  CheckTypedArrayIsDetached(a);
   assertEquals(undefined, a[0]);
 
   // The method must work for typed arrays created from ArrayBuffer.
@@ -150,7 +150,7 @@ function TestTypedArrayForEach(constructor) {
 
   // Detached Operation
   var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
-  %ArrayBufferNeuter(array.buffer);
+  %ArrayBufferDetach(array.buffer);
   assertThrows(() => array.forEach(() => true), TypeError);
 }
 

implementation-contributed/v8/mjsunit/es6/typedarray-from-detached-typedarray.js

@@ -18,6 +18,6 @@ var typedArrayConstructors = [
 
 for (constructor of typedArrayConstructors) {
   var ta = new constructor(10);
-  %ArrayBufferNeuter(ta.buffer);
+  %ArrayBufferDetach(ta.buffer);
   assertThrows(() => constructor.from(ta), TypeError);
 }

implementation-contributed/v8/mjsunit/es6/typedarray-from.js

@@ -208,7 +208,7 @@ for (var constructor of typedArrayConstructors) {
 
   let ta2 = new constructor(3).fill(1);
   Object.defineProperty(ta2, "length", {get: function() {
-    %ArrayBufferNeuter(ta2.buffer);
+    %ArrayBufferDetach(ta2.buffer);
     return 6;
   }});
   assertArrayLikeEquals(constructor.from(ta2), [d, d, d, d, d, d], constructor);

implementation-contributed/v8/mjsunit/es6/typedarray-indexing.js

@@ -19,7 +19,7 @@ var typedArrayConstructors = [
 var tmp = {
   [Symbol.toPrimitive]() {
     assertUnreachable("Parameter should not be processed when " +
-                      "array.[[ViewedArrayBuffer]] is neutered.");
+                      "array.[[ViewedArrayBuffer]] is detached.");
     return 0;
   }
 };
@@ -65,7 +65,7 @@ for (var constructor of typedArrayConstructors) {
 
   // Detached Operation
   var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
-  %ArrayBufferNeuter(array.buffer);
+  %ArrayBufferDetach(array.buffer);
   assertThrows(() => array.indexOf(tmp), TypeError);
 
   // ----------------------------------------------------------------------
@@ -107,6 +107,6 @@ for (var constructor of typedArrayConstructors) {
 
   // Detached Operation
   var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
-  %ArrayBufferNeuter(array.buffer);
+  %ArrayBufferDetach(array.buffer);
   assertThrows(() => array.lastIndexOf(tmp), TypeError);
 }

implementation-contributed/v8/mjsunit/es6/typedarray-iteration.js

@@ -82,7 +82,7 @@ for (var constructor of typedArrayConstructors) {
 
     // Detached Operation
     var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
-    %ArrayBufferNeuter(array.buffer);
+    %ArrayBufferDetach(array.buffer);
     assertThrows(() => array.filter(() => false), TypeError);
   })();
 
@@ -140,7 +140,7 @@ for (var constructor of typedArrayConstructors) {
 
     // Detached Operation
     var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
-    %ArrayBufferNeuter(array.buffer);
+    %ArrayBufferDetach(array.buffer);
     assertThrows(() => array.map((v) => v), TypeError);
   })();
 
@@ -204,7 +204,7 @@ for (var constructor of typedArrayConstructors) {
 
     // Detached Operation
     var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
-    %ArrayBufferNeuter(array.buffer);
+    %ArrayBufferDetach(array.buffer);
     assertThrows(() => array.some((v) => false), TypeError);
   })();
 

implementation-contributed/v8/mjsunit/es6/typedarray-map.js

@@ -37,7 +37,7 @@ function TestTypedArrayMap(constructor) {
     new DetachingArray(5).map(function(v,i,a){
       print(i);
       if (i == 1) {
-        %ArrayBufferNeuter(target.buffer);
+        %ArrayBufferDetach(target.buffer);
       }
     })
   }, TypeError);

implementation-contributed/v8/mjsunit/es6/typedarray-reverse.js

@@ -57,7 +57,7 @@ for (var constructor of arrayConstructors) {
   // Detached Operation
   if (constructor != ArrayMaker) {
     var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
-    %ArrayBufferNeuter(array.buffer);
+    %ArrayBufferDetach(array.buffer);
     assertThrows(() => array.reverse(), TypeError);
   }
 }

implementation-contributed/v8/mjsunit/es6/typedarray-slice.js

@@ -73,12 +73,12 @@ for (var constructor of typedArrayConstructors) {
   var tmp = {
     [Symbol.toPrimitive]() {
       assertUnreachable("Parameter should not be processed when " +
-                        "array.[[ViewedArrayBuffer]] is neutered.");
+                        "array.[[ViewedArrayBuffer]] is detached.");
       return 0;
     }
   };
   var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
-  %ArrayBufferNeuter(array.buffer);
+  %ArrayBufferDetach(array.buffer);
   assertThrows(() => array.slice(tmp, tmp), TypeError);
 
   // Check that the species array must be a typed array

implementation-contributed/v8/mjsunit/es6/typedarray-sort.js

@@ -65,7 +65,7 @@ for (var constructor of typedArrayConstructors) {
 
   // Detached Operation
   var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
-  %ArrayBufferNeuter(array.buffer);
+  %ArrayBufferDetach(array.buffer);
   assertThrows(() => array.sort(), TypeError);
 }
 

implementation-contributed/v8/mjsunit/es6/typedarray-tostring.js

@@ -101,7 +101,7 @@ for (var constructor of typedArrayConstructors) {
 
   // Detached Operation
   var array = new constructor([1, 2, 3]);
-  %ArrayBufferNeuter(array.buffer);
+  %ArrayBufferDetach(array.buffer);
   assertThrows(() => array.join(), TypeError);
   assertThrows(() => array.toLocalString(), TypeError);
   assertThrows(() => array.toString(), TypeError);

implementation-contributed/v8/mjsunit/harmony/weakrefs/factory-scheduled-for-cleanup-multiple-times.js

@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 // Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+// Flags: --no-stress-flush-bytecode
 
 let cleanup0_call_count = 0;
 let cleanup0_weak_cell_count = 0;

implementation-contributed/v8/mjsunit/neuter-twice.js

@@ -5,5 +5,5 @@
 // Flags: --allow-natives-syntax
 
 var ab = new ArrayBuffer(100);
-%ArrayBufferNeuter(ab);
-%ArrayBufferNeuter(ab);
+%ArrayBufferDetach(ab);
+%ArrayBufferDetach(ab);

implementation-contributed/v8/mjsunit/regress/regress-353004.js

@@ -8,7 +8,7 @@ var buffer1 = new ArrayBuffer(100 * 1024);
 
 assertThrows(function() {
   var array1 = new Uint8Array(buffer1, {valueOf : function() {
-    %ArrayBufferNeuter(buffer1);
+    %ArrayBufferDetach(buffer1);
     return 0;
   }});
 }, TypeError);
@@ -17,7 +17,7 @@ var buffer2 = new ArrayBuffer(100 * 1024);
 
 assertThrows(function() {
   var array2 = new Uint8Array(buffer2, 0, {valueOf : function() {
-      %ArrayBufferNeuter(buffer2);
+      %ArrayBufferDetach(buffer2);
       return 100 * 1024;
   }});
 }, TypeError);
@@ -30,7 +30,7 @@ assertThrows(() =>
       return 0;
     }}, {valueOf : function() {
       convertedLength = true;
-      %ArrayBufferNeuter(buffer1);
+      %ArrayBufferDetach(buffer1);
       return 0;
   }}), TypeError);
 assertTrue(convertedOffset);
@@ -38,7 +38,7 @@ assertTrue(convertedLength);
 
 var buffer3 = new ArrayBuffer(100 * 1024 * 1024);
 var dataView1 = new DataView(buffer3, {valueOf : function() {
-  %ArrayBufferNeuter(buffer3);
+  %ArrayBufferDetach(buffer3);
   return 0;
 }});
 
@@ -47,7 +47,7 @@ assertEquals(0, dataView1.byteLength);
 var buffer4 = new ArrayBuffer(100 * 1024);
 assertThrows(function() {
   var dataView2 = new DataView(buffer4, 0, {valueOf : function() {
-    %ArrayBufferNeuter(buffer4);
+    %ArrayBufferDetach(buffer4);
     return 100 * 1024 * 1024;
   }});
 }, RangeError);
@@ -56,7 +56,7 @@ assertThrows(function() {
 var buffer5 = new ArrayBuffer(100 * 1024);
 assertThrows(function() {
   buffer5.slice({valueOf : function() {
-    %ArrayBufferNeuter(buffer5);
+    %ArrayBufferDetach(buffer5);
     return 0;
   }}, 100 * 1024 * 1024);
 }, TypeError);
@@ -65,7 +65,7 @@ assertThrows(function() {
 var buffer7 = new ArrayBuffer(100 * 1024 * 1024);
 assertThrows(function() {
   buffer7.slice(0, {valueOf : function() {
-    %ArrayBufferNeuter(buffer7);
+    %ArrayBufferDetach(buffer7);
     return 100 * 1024 * 1024;
   }});
 }, TypeError);
@@ -74,7 +74,7 @@ var buffer9 = new ArrayBuffer(1024);
 var array9 = new Uint8Array(buffer9);
 assertThrows(() =>
   array9.subarray({valueOf : function() {
-    %ArrayBufferNeuter(buffer9);
+    %ArrayBufferDetach(buffer9);
     return 0;
   }}, 1024), TypeError);
 assertEquals(0, array9.length);
@@ -83,7 +83,7 @@ var buffer11 = new ArrayBuffer(1024);
 var array11 = new Uint8Array(buffer11);
 assertThrows(() =>
   array11.subarray(0, {valueOf : function() {
-    %ArrayBufferNeuter(buffer11);
+    %ArrayBufferDetach(buffer11);
     return 1024;
   }}), TypeError);
 assertEquals(0, array11.length);

implementation-contributed/v8/mjsunit/regress/regress-4964.js

@@ -4,19 +4,19 @@
 
 // Flags: --allow-natives-syntax
 
-// Neutered source
+// Detached source
 var ab = new ArrayBuffer(10);
-ab.constructor = { get [Symbol.species]() { %ArrayBufferNeuter(ab); return ArrayBuffer; } };
+ab.constructor = { get [Symbol.species]() { %ArrayBufferDetach(ab); return ArrayBuffer; } };
 assertThrows(() => ab.slice(0), TypeError);
 
-// Neutered target
-class NeuteredArrayBuffer extends ArrayBuffer {
+// Detached target
+class DetachedArrayBuffer extends ArrayBuffer {
   constructor(...args) {
     super(...args);
-    %ArrayBufferNeuter(this);
+    %ArrayBufferDetach(this);
   }
 }
 
 var ab2 = new ArrayBuffer(10);
-ab2.constructor = NeuteredArrayBuffer;
+ab2.constructor = DetachedArrayBuffer;
 assertThrows(() => ab2.slice(0), TypeError);

implementation-contributed/v8/mjsunit/regress/regress-6288.js

@@ -4,10 +4,7 @@
 
 // Environment Variables: LC_ALL=pt-BR.UTF8
 
-// The data files packaged with d8 currently have Brazillian Portuguese
-// DateTimeFormat but not Collation
-
 if (this.Intl) {
-  assertEquals('pt', Intl.Collator().resolvedOptions().locale);
+  assertEquals('pt-BR', Intl.Collator().resolvedOptions().locale);
   assertEquals('pt-BR', Intl.DateTimeFormat().resolvedOptions().locale);
 }

implementation-contributed/v8/mjsunit/regress/regress-707410.js

@@ -5,5 +5,5 @@
 // Flags: --allow-natives-syntax
 
 var a = new Uint8Array(1024*1024);
-%ArrayBufferNeuter(a.buffer);
+%ArrayBufferDetach(a.buffer);
 assertThrows(() => new Uint8Array(a));

implementation-contributed/v8/mjsunit/regress/regress-840106.js

@@ -8,7 +8,7 @@ var buffer = new ArrayBuffer(1024 * 1024);
 buffer.constructor = {
   [Symbol.species]: new Proxy(function() {}, {
     get: _ => {
-      %ArrayBufferNeuter(buffer);
+      %ArrayBufferDetach(buffer);
     }
   })
 };

implementation-contributed/v8/mjsunit/regress/regress-904707.js

@@ -8,7 +8,7 @@ delete Float64Array.prototype.__proto__[Symbol.iterator];
 
 let a = new Float64Array(9);
 Object.defineProperty(a, "length", {
-  get: function () { %ArrayBufferNeuter(a.buffer); return 6; }
+  get: function () { %ArrayBufferDetach(a.buffer); return 6; }
 });
 
 Float64Array.from(a);

implementation-contributed/v8/mjsunit/regress/regress-crbug-691323.js

@@ -7,7 +7,7 @@ var buffer = new ArrayBuffer(0x100);
 var array = new Uint8Array(buffer).fill(55);
 var tmp = {};
 tmp[Symbol.toPrimitive] = function () {
-  %ArrayBufferNeuter(array.buffer)
+  %ArrayBufferDetach(array.buffer)
   return 0;
 };
 
@@ -18,7 +18,7 @@ buffer = new ArrayBuffer(0x100);
 array = new Uint8Array(buffer).fill(55);
 tmp = {};
 tmp[Symbol.toPrimitive] = function () {
-  %ArrayBufferNeuter(array.buffer)
+  %ArrayBufferDetach(array.buffer)
   return 0;
 };
 
@@ -29,7 +29,7 @@ buffer = new ArrayBuffer(0x100);
 array = new Uint8Array(buffer).fill(55);
 tmp = {};
 tmp[Symbol.toPrimitive] = function () {
-  %ArrayBufferNeuter(array.buffer)
+  %ArrayBufferDetach(array.buffer)
   return 0;
 };
 assertEquals(true, Array.prototype.includes.call(array, undefined, tmp));

implementation-contributed/v8/mjsunit/regress/regress-crbug-867776.js

@@ -8,7 +8,7 @@ for (var i = 0; i < 3; i++) {
   var array = new BigInt64Array(200);
 
   function evil_callback() {
-    %ArrayBufferNeuter(array.buffer);
+    %ArrayBufferDetach(array.buffer);
     gc();
     return 1094795585n;
   }

implementation-contributed/v8/mjsunit/regress/wasm/regress-680938.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-var v17 = {};
-var v32 = {};
+var v17 = 42;
+var v32 = { initial: 1 };
 v39 = new WebAssembly.Memory(v32);
 v49 = v39.grow(v17);

implementation-contributed/v8/mjsunit/regress/wasm/regress-736584.js

@@ -7,7 +7,7 @@
 load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
-let mem = new WebAssembly.Memory({});
+let mem = new WebAssembly.Memory({initial: 0});
 let builder = new WasmModuleBuilder();
 builder.addImportedMemory("mod", "imported_mem");
 builder.addFunction('mem_size', kSig_i_v)

implementation-contributed/v8/mjsunit/regress/wasm/regress-816226.js

@@ -2,4 +2,4 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-(new Int8Array((new WebAssembly.Memory({})).buffer)).buffer;
+(new Int8Array((new WebAssembly.Memory({initial: 0})).buffer)).buffer;

implementation-contributed/v8/mjsunit/samevalue.js

@@ -26,7 +26,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 
-// Flags: --expose-natives-as natives --allow-natives-syntax
+// Flags: --allow-natives-syntax
 // Test the SameValue and SameValueZero internal methods.
 
 var obj1 = {x: 10, y: 11, z: "test"};

implementation-contributed/v8/test262/detachArrayBuffer.js

@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 function $DETACHBUFFER(buffer) {
-  %ArrayBufferNeuter(buffer);
+  %ArrayBufferDetach(buffer);
 }
 
 $262.detachArrayBuffer = $DETACHBUFFER;

implementation-contributed/v8/test262/testcfg.py

@@ -87,15 +87,23 @@ class VariantsGenerator(testsuite.VariantsGenerator):
   def gen(self, test):
     flags_set = self._get_flags_set(test)
     test_record = test.test_record
-    for n, variant in enumerate(self._get_variants(test)):
-      flags = flags_set[variant][0]
-      if 'noStrict' in test_record:
-        yield (variant, flags, str(n))
-      elif 'onlyStrict' in test_record:
-        yield (variant, flags + ['--use-strict'], 'strict-%d' % n)
-      else:
-        yield (variant, flags, str(n))
-        yield (variant, flags + ['--use-strict'], 'strict-%d' % n)
+
+    # Add a reverse test ensuring that FAIL_PHASE_ONLY is only used for tests
+    # that actually fail to throw an exception at wrong phase.
+    phase_variants = ['']
+    if test.fail_phase_only:
+      phase_variants.append('-fail-phase-reverse')
+
+    for phase_var in phase_variants:
+      for n, variant in enumerate(self._get_variants(test)):
+        flags = flags_set[variant][0]
+        if 'noStrict' in test_record:
+          yield (variant, flags, str(n) + phase_var)
+        elif 'onlyStrict' in test_record:
+          yield (variant, flags + ['--use-strict'], 'strict-%d' % n + phase_var)
+        else:
+          yield (variant, flags, str(n))
+          yield (variant, flags + ['--use-strict'], 'strict-%d' % n + phase_var)
 
 
 class TestSuite(testsuite.TestSuite):
@@ -169,13 +177,34 @@ class TestCase(testcase.D8TestCase):
           .get('type', None)
     )
 
+    # We disallow combining FAIL_PHASE_ONLY with any other fail outcome types.
+    # Outcome parsing logic in the base class converts all outcomes specified in
+    # the status file into either FAIL, CRASH or PASS, thus we do not need to
+    # handle FAIL_OK, FAIL_SLOPPY and various other outcomes.
+    if self.fail_phase_only:
+      assert (
+          statusfile.FAIL not in self.expected_outcomes and
+          statusfile.CRASH not in self.expected_outcomes), self.name
+
+  @property
+  def fail_phase_only(self):
+    # The FAIL_PHASE_ONLY is defined in tools/testrunner/local/statusfile.py and
+    # can be used in status files to mark tests that throw an exception at wrong
+    # phase, e.g. SyntaxError is thrown at execution phase instead of parsing
+    # phase. See https://crbug.com/v8/8467 for more details.
+    return statusfile.FAIL_PHASE_ONLY in self._statusfile_outcomes
+
+  @property
+  def _fail_phase_reverse(self):
+    return 'fail-phase-reverse' in self.procid
+
   def _get_files_params(self):
     return (
         list(self.suite.harness) +
         ([os.path.join(self.suite.root, "harness-agent.js")]
          if self.path.startswith('built-ins/Atomics') else []) +
         ([os.path.join(self.suite.root, "harness-adapt-donotevaluate.js")]
-         if self.fail_phase_only else []) +
+         if self.fail_phase_only and not self._fail_phase_reverse else []) +
         self._get_includes() +
         (["--module"] if "module" in self.test_record else []) +
         [self._get_source_path()]
@@ -213,7 +242,12 @@ class TestCase(testcase.D8TestCase):
   def output_proc(self):
     if self._expected_exception is not None:
       return test262.ExceptionOutProc(self.expected_outcomes,
-                                      self._expected_exception)
+                                      self._expected_exception,
+                                      self._fail_phase_reverse)
+    else:
+      # We only support fail phase reverse on tests that expect an exception.
+      assert not self._fail_phase_reverse
+
     if self.expected_outcomes == outproc.OUTCOMES_PASS:
       return test262.PASS_NO_EXCEPTION
     return test262.NoExceptionOutProc(self.expected_outcomes)

implementation-contributed/v8/wasm-js/wasm-js.status

@@ -6,9 +6,7 @@
 [ALWAYS, {
   # https://bugs.chromium.org/p/v8/issues/detail?id=8319
   'memory/grow': [FAIL],
-  'memory/constructor': [FAIL],
   'table/grow': [FAIL],
-  'table/constructor': [FAIL],
   'table/get-set': [FAIL],
   'module/customSections': [FAIL],
   'global/constructor': [FAIL],