From 7df6ae12f6f7411cb11a4ec860492993da44e4b7 Mon Sep 17 00:00:00 2001
From: test262-automation <test262-automation@bocoup.com>
Date: Tue, 23 Oct 2018 18:47:44 +0000
Subject: [PATCH] [v8-test262-automation] Changes from
 https://github.com/v8/v8.git at sha 0039b340 on Tue Oct 23 2018 18:47:14
 GMT+0000 (Coordinated Universal Time)

---
 .../segment-iterator-ownPropertyDescriptor.js | 39 +++++++++++-
 .../array-join-invalid-string-length.js       | 63 +++++++++++++++++++
 .../v8/mjsunit/array-natives-elements.js      | 12 ++--
 .../v8/mjsunit/code-coverage-block-opt.js     |  5 ++
 ...ative-context-specialization-hole-check.js |  5 ++
 .../v8/mjsunit/d8/d8-arguments.js             |  7 +++
 .../v8/mjsunit/d8/d8-no-arguments.js          |  5 ++
 .../v8/mjsunit/harmony/weakrefs/basics.js     | 25 ++++++--
 .../harmony/weakrefs/clear-after-cleanup.js   | 46 ++++++++++++++
 .../harmony/weakrefs/clear-before-cleanup.js  | 40 ++++++++++++
 .../harmony/weakrefs/clear-called-twice.js    | 39 ++++++++++++
 .../weakrefs/clear-clears-factory-pointer.js  | 49 +++++++++++++++
 .../harmony/weakrefs/clear-inside-cleanup1.js | 41 ++++++++++++
 .../harmony/weakrefs/clear-inside-cleanup2.js | 40 ++++++++++++
 .../harmony/weakrefs/clear-inside-cleanup3.js | 41 ++++++++++++
 .../harmony/weakrefs/clear-inside-cleanup4.js | 48 ++++++++++++++
 .../clear-when-cleanup-already-scheduled.js   | 36 +++++++++++
 .../v8/mjsunit/messages.js                    |  4 ++
 .../v8/mjsunit/mjsunit.js                     | 15 +++++
 .../v8/mjsunit/mjsunit.status                 | 13 ++--
 .../v8/mjsunit/regress/regress-2618.js        |  6 +-
 .../v8/mjsunit/regress/regress-2989.js        |  7 ++-
 .../v8/mjsunit/regress/regress-778668.js      | 17 ++++-
 .../v8/mjsunit/regress/regress-8241.js        |  6 ++
 .../v8/mjsunit/regress/regress-897366.js      | 15 +++++
 .../v8/mjsunit/regress/regress-897815.js      | 16 +++++
 .../mjsunit/regress/regress-crbug-781116-1.js |  1 -
 .../mjsunit/regress/regress-crbug-781116-2.js |  1 -
 .../mjsunit/regress/regress-crbug-897098.js   |  8 +++
 .../mjsunit/regress/regress-crbug-897404.js   | 20 ++++++
 .../mjsunit/regress/regress-crbug-897406.js   | 14 +++++
 .../mjsunit/regress/regress-crbug-897514.js   | 26 ++++++++
 .../mjsunit/shared-function-tier-up-turbo.js  |  4 ++
 .../v8/test262/test262.status                 |  4 --
 34 files changed, 693 insertions(+), 25 deletions(-)
 create mode 100644 implementation-contributed/v8/mjsunit/array-join-invalid-string-length.js
 create mode 100644 implementation-contributed/v8/mjsunit/d8/d8-arguments.js
 create mode 100644 implementation-contributed/v8/mjsunit/d8/d8-no-arguments.js
 create mode 100644 implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-after-cleanup.js
 create mode 100644 implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-before-cleanup.js
 create mode 100644 implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-called-twice.js
 create mode 100644 implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-clears-factory-pointer.js
 create mode 100644 implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-inside-cleanup1.js
 create mode 100644 implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-inside-cleanup2.js
 create mode 100644 implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-inside-cleanup3.js
 create mode 100644 implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-inside-cleanup4.js
 create mode 100644 implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-when-cleanup-already-scheduled.js
 create mode 100644 implementation-contributed/v8/mjsunit/regress/regress-8241.js
 create mode 100644 implementation-contributed/v8/mjsunit/regress/regress-897366.js
 create mode 100644 implementation-contributed/v8/mjsunit/regress/regress-897815.js
 create mode 100644 implementation-contributed/v8/mjsunit/regress/regress-crbug-897098.js
 create mode 100644 implementation-contributed/v8/mjsunit/regress/regress-crbug-897404.js
 create mode 100644 implementation-contributed/v8/mjsunit/regress/regress-crbug-897406.js
 create mode 100644 implementation-contributed/v8/mjsunit/regress/regress-crbug-897514.js

diff --git a/implementation-contributed/v8/intl/segmenter/segment-iterator-ownPropertyDescriptor.js b/implementation-contributed/v8/intl/segmenter/segment-iterator-ownPropertyDescriptor.js
index e9630060a4..7409382a99 100644
--- a/implementation-contributed/v8/intl/segmenter/segment-iterator-ownPropertyDescriptor.js
+++ b/implementation-contributed/v8/intl/segmenter/segment-iterator-ownPropertyDescriptor.js
@@ -29,10 +29,47 @@ for (let func of ["segment", "resolvedOptions"]) {
   assertTrue(descriptor.configurable);
 }
 
-let prototype = Object.getPrototypeOf(seg.segment('text'));
+let segmentIterator = seg.segment('text');
+let prototype = Object.getPrototypeOf(segmentIterator);
 for (let func of ["next", "following", "preceding"]) {
   let descriptor = Object.getOwnPropertyDescriptor(prototype, func);
   assertTrue(descriptor.writable);
   assertFalse(descriptor.enumerable);
   assertTrue(descriptor.configurable);
 }
+
+function checkGetterProperty(prototype, property) {
+  let desc = Object.getOwnPropertyDescriptor(prototype, property);
+  assertEquals(`get ${property}`, desc.get.name);
+  assertEquals('function', typeof desc.get)
+  assertEquals(undefined, desc.set);
+  assertFalse(desc.enumerable);
+  assertTrue(desc.configurable);
+}
+
+// Test the descriptor is correct for properties.
+checkGetterProperty(prototype, 'position');
+checkGetterProperty(prototype, 'breakType');
+
+// Test the SegmentIteratorPrototype methods are called with same
+// receiver and won't throw.
+assertDoesNotThrow(() => prototype.next.call(segmentIterator));
+assertDoesNotThrow(() => prototype.following.call(segmentIterator));
+assertDoesNotThrow(() => prototype.preceding.call(segmentIterator));
+
+// Test the SegmentIteratorPrototype methods are called with a different
+// receiver and correctly throw.
+var otherReceivers = [
+    1, 123.45, undefined, null, "string", true, false,
+    Intl, Intl.Segmenter, Intl.Segmenter.prototype,
+    prototype,
+    new Intl.Segmenter(),
+    new Intl.Collator(),
+    new Intl.DateTimeFormat(),
+    new Intl.NumberFormat(),
+];
+for (let rec of otherReceivers) {
+   assertThrows(() => prototype.next.call(rec), TypeError);
+   assertThrows(() => prototype.following.call(rec), TypeError);
+   assertThrows(() => prototype.preceding.call(rec), TypeError);
+}
diff --git a/implementation-contributed/v8/mjsunit/array-join-invalid-string-length.js b/implementation-contributed/v8/mjsunit/array-join-invalid-string-length.js
new file mode 100644
index 0000000000..cab8f00bd4
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/array-join-invalid-string-length.js
@@ -0,0 +1,63 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function DictionaryStringRepeatFastPath() {
+  const a = new Array(%StringMaxLength());
+  assertTrue(%HasDictionaryElements(a));
+  const sep = '12';
+  assertThrows(() => a.join(sep), RangeError);
+
+  // Verifies cycle detection still works properly after thrown error.
+  assertThrows(() => a.join(sep), RangeError);
+
+  a.length = 3;
+  a[0] = 'a';
+  a[1] = 'b';
+  a[2] = 'c';
+  assertSame('a,b,c', a.join());
+})();
+
+(function SeparatorOverflow() {
+  const a = ['a',,,,,'b'];
+
+  const sep = ','.repeat(%StringMaxLength());
+  assertThrows(() => a.join(sep), RangeError);
+
+  // Verifies cycle detection still works properly after thrown error.
+  assertThrows(() => a.join(sep), RangeError);
+  assertSame('a,,,,,b', a.join());
+})();
+
+(function ElementOverflow() {
+  const el = ','.repeat(%StringMaxLength());
+  const a = [el, el, el, el, el];
+
+  assertThrows(() => a.join(), RangeError);
+
+  // Verifies cycle detection still works properly after thrown error.
+  assertThrows(() => a.join(), RangeError);
+  a[0] = 'a';
+  a[1] = 'b';
+  a[2] = 'c';
+  a[3] = 'd';
+  a[4] = 'e';
+  assertSame('a,b,c,d,e', a.join());
+})();
+
+(function ElementSeparatorOverflow() {
+  const el = ','.repeat(%StringMaxLength());
+  const a = [el, el, el, el];
+
+  assertThrows(() => a.join(el), RangeError);
+
+  // Verifies cycle detection still works properly after thrown error.
+  assertThrows(() => a.join(el), RangeError);
+  a[0] = 'a';
+  a[1] = 'b';
+  a[2] = 'c';
+  a[3] = 'd';
+  assertSame('a,b,c,d', a.join());
+})();
diff --git a/implementation-contributed/v8/mjsunit/array-natives-elements.js b/implementation-contributed/v8/mjsunit/array-natives-elements.js
index 8ab2148b91..aa3bea49d0 100644
--- a/implementation-contributed/v8/mjsunit/array-natives-elements.js
+++ b/implementation-contributed/v8/mjsunit/array-natives-elements.js
@@ -112,15 +112,19 @@ function array_natives_test() {
   assertEquals([2], a2.slice(1,2));
   a2 = [1.1,2,3];
   assertTrue(%HasDoubleElements(a2.slice()));
-  assertTrue(%HasDoubleElements(a2.slice(1)));
-  assertTrue(%HasDoubleElements(a2.slice(1, 2)));
+  assertTrue(%HasDoubleElements(a2.slice(1)) ||
+             %HasSmiElements(a2.slice(1)));
+  assertTrue(%HasDoubleElements(a2.slice(1, 2)) ||
+            %HasSmiElements(a2.slice(1, 2)));
   assertEquals([1.1,2,3], a2.slice());
   assertEquals([2,3], a2.slice(1));
   assertEquals([2], a2.slice(1,2));
   a2 = [{},2,3];
   assertTrue(%HasObjectElements(a2.slice()));
-  assertTrue(%HasObjectElements(a2.slice(1)));
-  assertTrue(%HasObjectElements(a2.slice(1, 2)));
+  assertTrue(%HasObjectElements(a2.slice(1)) ||
+             %HasSmiElements(a2.slice(1)));
+  assertTrue(%HasObjectElements(a2.slice(1, 2)) ||
+             %HasSmiElements(a2.slice(1, 2)));
   assertEquals([{},2,3], a2.slice());
   assertEquals([2,3], a2.slice(1));
   assertEquals([2], a2.slice(1,2));
diff --git a/implementation-contributed/v8/mjsunit/code-coverage-block-opt.js b/implementation-contributed/v8/mjsunit/code-coverage-block-opt.js
index e02775bd45..3031e8913a 100644
--- a/implementation-contributed/v8/mjsunit/code-coverage-block-opt.js
+++ b/implementation-contributed/v8/mjsunit/code-coverage-block-opt.js
@@ -5,6 +5,11 @@
 // Flags: --allow-natives-syntax --no-always-opt --opt
 // Files: test/mjsunit/code-coverage-utils.js
 
+if (isNeverOptimizeLiteMode()) {
+  print("Warning: skipping test that requires optimization in Lite mode.");
+  quit(0);
+}
+
 %DebugToggleBlockCoverage(true);
 
 TestCoverage(
diff --git a/implementation-contributed/v8/mjsunit/compiler/native-context-specialization-hole-check.js b/implementation-contributed/v8/mjsunit/compiler/native-context-specialization-hole-check.js
index 1256f453eb..7f4db56483 100644
--- a/implementation-contributed/v8/mjsunit/compiler/native-context-specialization-hole-check.js
+++ b/implementation-contributed/v8/mjsunit/compiler/native-context-specialization-hole-check.js
@@ -27,6 +27,11 @@
 
 // Flags: --allow-natives-syntax --opt --no-always-opt
 
+if (isNeverOptimizeLiteMode()) {
+  print("Warning: skipping test that requires optimization in Lite mode.");
+  quit(0);
+}
+
 function f() {
   Array.prototype[10] = 2;
   var arr = new Array();
diff --git a/implementation-contributed/v8/mjsunit/d8/d8-arguments.js b/implementation-contributed/v8/mjsunit/d8/d8-arguments.js
new file mode 100644
index 0000000000..5e44ea0e6e
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/d8/d8-arguments.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: -- 1 2 3
+
+assertEquals(["1", "2", "3"], arguments);
diff --git a/implementation-contributed/v8/mjsunit/d8/d8-no-arguments.js b/implementation-contributed/v8/mjsunit/d8/d8-no-arguments.js
new file mode 100644
index 0000000000..9427de72ab
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/d8/d8-no-arguments.js
@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals(undefined, Object.getOwnPropertyDescriptor(this, "arguments"));
diff --git a/implementation-contributed/v8/mjsunit/harmony/weakrefs/basics.js b/implementation-contributed/v8/mjsunit/harmony/weakrefs/basics.js
index 3402bbec2e..bfc05d1457 100644
--- a/implementation-contributed/v8/mjsunit/harmony/weakrefs/basics.js
+++ b/implementation-contributed/v8/mjsunit/harmony/weakrefs/basics.js
@@ -32,11 +32,17 @@
   assertNotSame(wc.__proto__, Object.prototype);
   assertSame(wc.__proto__.__proto__, Object.prototype);
   assertEquals(wc.holdings, undefined);
-  let desc = Object.getOwnPropertyDescriptor(wc.__proto__, "holdings");
-  assertEquals(true, desc.configurable);
-  assertEquals(false, desc.enumerable);
-  assertEquals("function", typeof desc.get);
-  assertEquals(undefined, desc.set);
+
+  let holdings_desc = Object.getOwnPropertyDescriptor(wc.__proto__, "holdings");
+  assertEquals(true, holdings_desc.configurable);
+  assertEquals(false, holdings_desc.enumerable);
+  assertEquals("function", typeof holdings_desc.get);
+  assertEquals(undefined, holdings_desc.set);
+
+  let clear_desc = Object.getOwnPropertyDescriptor(wc.__proto__, "clear");
+  assertEquals(true, clear_desc.configurable);
+  assertEquals(false, clear_desc.enumerable);
+  assertEquals("function", typeof clear_desc.value);
 })();
 
 (function TestMakeCellWithHoldings() {
@@ -112,3 +118,12 @@
   // Does not throw:
   holdings_getter.call(wc);
 })();
+
+(function TestClearWithoutWeakCell() {
+  let wf = new WeakFactory();
+  let wc = wf.makeCell({});
+  let clear = Object.getOwnPropertyDescriptor(wc.__proto__, "clear").value;
+  assertThrows(() => clear.call({}), TypeError);
+  // Does not throw:
+  clear.call(wc);
+})();
diff --git a/implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-after-cleanup.js b/implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-after-cleanup.js
new file mode 100644
index 0000000000..d118ff868c
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-after-cleanup.js
@@ -0,0 +1,46 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc
+
+let cleanup_call_count = 0;
+let cleanup_weak_cell_count = 0;
+let cleanup = function(iter) {
+  for (wc of iter) {
+    assertSame(wc, weak_cell);
+    ++cleanup_weak_cell_count;
+  }
+  ++cleanup_call_count;
+}
+
+let wf = new WeakFactory(cleanup);
+// Create an object and a WeakCell pointing to it. The object needs to be inside
+// a closure so that we can reliably kill them!
+let weak_cell;
+
+(function() {
+  let object = {};
+  weak_cell = wf.makeCell(object);
+
+  // object goes out of scope.
+})();
+
+// This GC will discover dirty WeakCells and schedule cleanup.
+gc();
+assertEquals(0, cleanup_call_count);
+
+// Assert that the cleanup function was called and iterated the WeakCell.
+let timeout_func = function() {
+  assertEquals(1, cleanup_call_count);
+  assertEquals(1, cleanup_weak_cell_count);
+
+  // Clear an already iterated over WeakCell.
+  weak_cell.clear();
+
+  // Assert that it didn't do anything.
+  setTimeout(() => { assertEquals(1, cleanup_call_count); }, 0);
+  setTimeout(() => { assertEquals(1, cleanup_weak_cell_count); }, 0);
+}
+
+setTimeout(timeout_func, 0);
diff --git a/implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-before-cleanup.js b/implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-before-cleanup.js
new file mode 100644
index 0000000000..7c03372a8b
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-before-cleanup.js
@@ -0,0 +1,40 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc
+
+let cleanup_call_count = 0;
+let cleanup = function(iter) {
+  ++cleanup_call_count;
+}
+
+let wf = new WeakFactory(cleanup);
+// Create an object and a WeakCell pointing to it. The object needs to be inside
+// a closure so that we can reliably kill them!
+let weak_cell;
+
+(function() {
+  let object = {};
+  weak_cell = wf.makeCell(object, "my holdings");
+
+  // Clear the WeakCell before the GC has a chance to discover it.
+  let return_value = weak_cell.clear();
+  assertEquals(undefined, return_value);
+
+  // Assert holdings got cleared too.
+  assertEquals(undefined, weak_cell.holdings);
+
+  // object goes out of scope.
+})();
+
+// This GC will discover dirty WeakCells.
+gc();
+assertEquals(0, cleanup_call_count);
+
+// Assert that the cleanup function won't be called, since the WeakCell was cleared.
+let timeout_func = function() {
+  assertEquals(0, cleanup_call_count);
+}
+
+setTimeout(timeout_func, 0);
diff --git a/implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-called-twice.js b/implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-called-twice.js
new file mode 100644
index 0000000000..9b0e623778
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-called-twice.js
@@ -0,0 +1,39 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc
+
+let cleanup_call_count = 0;
+let cleanup = function(iter) {
+  ++cleanup_call_count;
+}
+
+let wf = new WeakFactory(cleanup);
+// Create an object and a WeakCell pointing to it. The object needs to be inside
+// a closure so that we can reliably kill them!
+let weak_cell;
+
+(function() {
+  let object = {};
+  weak_cell = wf.makeCell(object);
+
+  // Clear the WeakCell before the GC has a chance to discover it.
+  weak_cell.clear();
+
+  // Call clear again (just to assert we handle this gracefully).
+  weak_cell.clear();
+
+  // object goes out of scope.
+})();
+
+// This GC will discover dirty WeakCells.
+gc();
+assertEquals(0, cleanup_call_count);
+
+// Assert that the cleanup function won't be called, since the WeakCell was cleared.
+let timeout_func = function() {
+  assertEquals(0, cleanup_call_count);
+}
+
+setTimeout(timeout_func, 0);
diff --git a/implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-clears-factory-pointer.js b/implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-clears-factory-pointer.js
new file mode 100644
index 0000000000..fb4075d6f3
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-clears-factory-pointer.js
@@ -0,0 +1,49 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc
+
+// Test that WeakCell.prototype.clear() also clears the WeakFactory pointer of
+// WeakCell. The only way to observe this is to assert that the WeakCell no
+// longer keeps its WeakFactory alive after clear() has been called.
+
+let weak_cell;
+let weak_cell_pointing_to_factory;
+
+let cleanup1_call_count = 0;
+let cleanup2_call_count = 0;
+
+let cleanup1 = function() {
+  ++cleanup1_call_count;
+}
+
+let cleanup2 = function() {
+  ++cleanup2_call_count;
+}
+
+let wf1 = new WeakFactory(cleanup1);
+
+(function(){
+  let wf2 = new WeakFactory(cleanup2);
+
+  (function() {
+    let object = {};
+    weak_cell = wf2.makeCell(object);
+    // object goes out of scope.
+  })();
+
+  weak_cell_pointing_to_factory = wf1.makeCell(wf2);
+  // wf goes out of scope
+})();
+
+weak_cell.clear();
+gc();
+
+// Assert that weak_cell_pointing_to_factory now got cleared.
+let timeout_func = function() {
+  assertEquals(1, cleanup1_call_count);
+  assertEquals(0, cleanup2_call_count);
+}
+
+setTimeout(timeout_func, 0);
diff --git a/implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-inside-cleanup1.js b/implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-inside-cleanup1.js
new file mode 100644
index 0000000000..1313e76586
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-inside-cleanup1.js
@@ -0,0 +1,41 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc
+
+let cleanup_call_count = 0;
+let cleanup_weak_cell_count = 0;
+let cleanup = function(iter) {
+  // Clear the WeakCell before we've iterated through it.
+  weak_cell.clear();
+
+  for (wc of iter) {
+    ++cleanup_weak_cell_count;
+  }
+  ++cleanup_call_count;
+}
+
+let wf = new WeakFactory(cleanup);
+// Create an object and a WeakCell pointing to it. The object needs to be inside
+// a closure so that we can reliably kill them!
+let weak_cell;
+
+(function() {
+  let object = {};
+  weak_cell = wf.makeCell(object);
+
+  // object goes out of scope.
+})();
+
+// This GC will discover dirty WeakCells and schedule cleanup.
+gc();
+assertEquals(0, cleanup_call_count);
+
+// Assert that the cleanup function was called, but didn't iterate any weak cells.
+let timeout_func = function() {
+  assertEquals(1, cleanup_call_count);
+  assertEquals(0, cleanup_weak_cell_count);
+}
+
+setTimeout(timeout_func, 0);
diff --git a/implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-inside-cleanup2.js b/implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-inside-cleanup2.js
new file mode 100644
index 0000000000..32a208c22c
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-inside-cleanup2.js
@@ -0,0 +1,40 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc
+
+let cleanup_call_count = 0;
+let cleanup_weak_cell_count = 0;
+let cleanup = function(iter) {
+  for (wc of iter) {
+    assertSame(wc, weak_cell);
+    wc.clear();
+    ++cleanup_weak_cell_count;
+  }
+  ++cleanup_call_count;
+}
+
+let wf = new WeakFactory(cleanup);
+// Create an object and a WeakCell pointing to it. The object needs to be inside
+// a closure so that we can reliably kill them!
+let weak_cell;
+
+(function() {
+  let object = {};
+  weak_cell = wf.makeCell(object);
+
+  // object goes out of scope.
+})();
+
+// This GC will discover dirty WeakCells and schedule cleanup.
+gc();
+assertEquals(0, cleanup_call_count);
+
+// Assert that the cleanup function was called and iterated the WeakCell.
+let timeout_func = function() {
+  assertEquals(1, cleanup_call_count);
+  assertEquals(1, cleanup_weak_cell_count);
+}
+
+setTimeout(timeout_func, 0);
diff --git a/implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-inside-cleanup3.js b/implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-inside-cleanup3.js
new file mode 100644
index 0000000000..79717f07c0
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-inside-cleanup3.js
@@ -0,0 +1,41 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc
+
+let cleanup_call_count = 0;
+let cleanup_weak_cell_count = 0;
+let cleanup = function(iter) {
+  for (wc of iter) {
+    assertSame(wc, weak_cell);
+    ++cleanup_weak_cell_count;
+  }
+  // Clear an already iterated over WeakCell.
+  weak_cell.clear();
+  ++cleanup_call_count;
+}
+
+let wf = new WeakFactory(cleanup);
+// Create an object and a WeakCell pointing to it. The object needs to be inside
+// a closure so that we can reliably kill them!
+let weak_cell;
+
+(function() {
+  let object = {};
+  weak_cell = wf.makeCell(object);
+
+  // object goes out of scope.
+})();
+
+// This GC will discover dirty WeakCells and schedule cleanup.
+gc();
+assertEquals(0, cleanup_call_count);
+
+// Assert that the cleanup function was called and iterated the WeakCell.
+let timeout_func = function() {
+  assertEquals(1, cleanup_call_count);
+  assertEquals(1, cleanup_weak_cell_count);
+}
+
+setTimeout(timeout_func, 0);
diff --git a/implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-inside-cleanup4.js b/implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-inside-cleanup4.js
new file mode 100644
index 0000000000..b1df0ec7fc
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-inside-cleanup4.js
@@ -0,0 +1,48 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc
+
+let cleanup_call_count = 0;
+let cleanup_weak_cell_count = 0;
+let cleanup = function(iter) {
+  for (wc of iter) {
+    // See which WeakCell we're iterating over and clear the other one.
+    if (wc == weak_cell1) {
+      weak_cell2.clear();
+    } else {
+      assertSame(wc, weak_cell2);
+      weak_cell1.clear();
+    }
+    ++cleanup_weak_cell_count;
+  }
+  ++cleanup_call_count;
+}
+
+let wf = new WeakFactory(cleanup);
+// Create an object and a WeakCell pointing to it. The object needs to be inside
+// a closure so that we can reliably kill them!
+let weak_cell1;
+let weak_cell2;
+
+(function() {
+  let object1 = {};
+  weak_cell1 = wf.makeCell(object1);
+  let object2 = {};
+  weak_cell2 = wf.makeCell(object2);
+
+  // object1 and object2 go out of scope.
+})();
+
+// This GC will discover dirty WeakCells and schedule cleanup.
+gc();
+assertEquals(0, cleanup_call_count);
+
+// Assert that the cleanup function was called and iterated one WeakCell (but not the other one).
+let timeout_func = function() {
+  assertEquals(1, cleanup_call_count);
+  assertEquals(1, cleanup_weak_cell_count);
+}
+
+setTimeout(timeout_func, 0);
diff --git a/implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-when-cleanup-already-scheduled.js b/implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-when-cleanup-already-scheduled.js
new file mode 100644
index 0000000000..36f7e404cd
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/harmony/weakrefs/clear-when-cleanup-already-scheduled.js
@@ -0,0 +1,36 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc
+
+let cleanup_call_count = 0;
+let cleanup = function(iter) {
+  ++cleanup_call_count;
+}
+
+let wf = new WeakFactory(cleanup);
+// Create an object and a WeakCell pointing to it. The object needs to be inside
+// a closure so that we can reliably kill them!
+let weak_cell;
+
+(function() {
+  let object = {};
+  weak_cell = wf.makeCell(object);
+
+  // object goes out of scope.
+})();
+
+// This GC will discover dirty WeakCells and schedule cleanup.
+gc();
+assertEquals(0, cleanup_call_count);
+
+// Clear the WeakCell before cleanup has ran.
+weak_cell.clear();
+
+// Assert that the cleanup function won't be called, since the WeakCell was cleared.
+let timeout_func = function() {
+  assertEquals(0, cleanup_call_count);
+}
+
+setTimeout(timeout_func, 0);
diff --git a/implementation-contributed/v8/mjsunit/messages.js b/implementation-contributed/v8/mjsunit/messages.js
index 1dd9a05879..b80e5abf23 100644
--- a/implementation-contributed/v8/mjsunit/messages.js
+++ b/implementation-contributed/v8/mjsunit/messages.js
@@ -570,6 +570,10 @@ test(function() {
   "a".repeat(1 << 30);
 }, "Invalid string length", RangeError);
 
+test(function() {
+  new Array(1 << 30).join();
+}, "Invalid string length", RangeError);
+
 // kNormalizationForm
 test(function() {
   "".normalize("ABC");
diff --git a/implementation-contributed/v8/mjsunit/mjsunit.js b/implementation-contributed/v8/mjsunit/mjsunit.js
index 59923a4247..41f2caee7a 100644
--- a/implementation-contributed/v8/mjsunit/mjsunit.js
+++ b/implementation-contributed/v8/mjsunit/mjsunit.js
@@ -166,8 +166,12 @@ var V8OptimizationStatus = {
   kOptimizingConcurrently: 1 << 9,
   kIsExecuting: 1 << 10,
   kTopmostFrameIsTurboFanned: 1 << 11,
+  kLiteMode: 1 << 12,
 };
 
+// Returns true if --lite-mode is on and we can't ever turn on optimization.
+var isNeverOptimizeLiteMode;
+
 // Returns true if --no-opt mode is on.
 var isNeverOptimize;
 
@@ -653,6 +657,12 @@ var prettyPrinted;
       fun, sync_opt, name_opt, skip_if_maybe_deopted = true) {
     if (sync_opt === undefined) sync_opt = "";
     var opt_status = OptimizationStatus(fun, sync_opt);
+    // Tests that use assertOptimized() do not make sense for Lite mode where
+    // optimization is always disabled, explicitly exit the test with a warning.
+    if (opt_status & V8OptimizationStatus.kLiteMode) {
+      print("Warning: Test uses assertOptimized in Lite mode, skipping test.");
+      quit(0);
+    }
     // Tests that use assertOptimized() do not make sense if --no-opt
     // option is provided. Such tests must add --opt to flags comment.
     assertFalse((opt_status & V8OptimizationStatus.kNeverOptimize) !== 0,
@@ -668,6 +678,11 @@ var prettyPrinted;
     assertTrue((opt_status & V8OptimizationStatus.kOptimized) !== 0, name_opt);
   }
 
+  isNeverOptimizeLiteMode = function isNeverOptimizeLiteMode() {
+    var opt_status = OptimizationStatus(undefined, "");
+    return (opt_status & V8OptimizationStatus.kLiteMode) !== 0;
+  }
+
   isNeverOptimize = function isNeverOptimize() {
     var opt_status = OptimizationStatus(undefined, "");
     return (opt_status & V8OptimizationStatus.kNeverOptimize) !== 0;
diff --git a/implementation-contributed/v8/mjsunit/mjsunit.status b/implementation-contributed/v8/mjsunit/mjsunit.status
index 9642793ed3..4c961b1480 100644
--- a/implementation-contributed/v8/mjsunit/mjsunit.status
+++ b/implementation-contributed/v8/mjsunit/mjsunit.status
@@ -145,7 +145,7 @@
   'regress/regress-634-debug': [PASS, ['mode == release', SKIP]],
 
   # BUG(v8:2989).
-  'regress/regress-2989': [FAIL, NO_VARIANTS],
+  'regress/regress-2989': [FAIL, NO_VARIANTS, ['lite_mode == True', SKIP]],
 
   # This test variant makes only sense on arm.
   'math-floor-of-div-nosudiv': [PASS, SLOW, ['arch not in [arm, arm64, android_arm, android_arm64]', SKIP]],
@@ -176,6 +176,8 @@
   'wasm/embenchen/*': [PASS, SLOW],
   'wasm/grow-memory': [PASS, SLOW],
   'wasm/unreachable-validation': [PASS, SLOW],
+  'wasm/atomics-stress': [PASS, SLOW, NO_VARIANTS, ['mode != release', SKIP], ['(arch == arm or arch == arm64) and simulator_run', SKIP]],
+  'wasm/atomics64-stress': [PASS, SLOW, NO_VARIANTS, ['mode != release', SKIP], ['(arch == arm or arch == arm64) and simulator_run', SKIP]],
   'wasm/compare-exchange-stress': [PASS, SLOW, NO_VARIANTS],
   'wasm/compare-exchange64-stress': [PASS, SLOW, NO_VARIANTS],
 
@@ -227,11 +229,6 @@
 
   # BUG(v8:8169)
   'external-backing-store-gc': [SKIP],
-
-  # BUG(v8:8332)
-  'wasm/atomics-stress': [SKIP],
-  # BUG(v8:8331)
-  'wasm/atomics64-stress': [SKIP],
 }],  # ALWAYS
 
 ['novfp3 == True', {
@@ -663,6 +660,7 @@
 ['system == macos', {
   # BUG(v8:5333)
   'big-object-literal': [SKIP],
+  'harmony/weakrefs/basics': [SKIP],
 }],  # 'system == macos'
 
 ##############################################################################
@@ -759,6 +757,9 @@
   'd8/enable-tracing': [SKIP],
   # Relies on async compilation which requires background tasks.
   'wasm/streaming-error-position': [SKIP],
+  # Intentionally non-deterministic using shared arraybuffers.
+  'wasm/atomics-stress': [SKIP],
+  'wasm/atomics64-stress': [SKIP],
 }],  # 'predictable == True'
 
 ##############################################################################
diff --git a/implementation-contributed/v8/mjsunit/regress/regress-2618.js b/implementation-contributed/v8/mjsunit/regress/regress-2618.js
index 8e539fffa4..9feb911c81 100644
--- a/implementation-contributed/v8/mjsunit/regress/regress-2618.js
+++ b/implementation-contributed/v8/mjsunit/regress/regress-2618.js
@@ -28,7 +28,11 @@
 // Flags: --use-osr --allow-natives-syntax --ignition-osr --opt
 // Flags: --no-always-opt
 
-// Can't OSR with always-opt.
+// Can't OSR with always-opt or in Lite mode.
+if (isNeverOptimizeLiteMode()) {
+  print("Warning: skipping test that requires optimization in Lite mode.");
+  quit(0);
+}
 assertFalse(isAlwaysOptimize());
 
 function f() {
diff --git a/implementation-contributed/v8/mjsunit/regress/regress-2989.js b/implementation-contributed/v8/mjsunit/regress/regress-2989.js
index 49c4a1cb03..d11e352105 100644
--- a/implementation-contributed/v8/mjsunit/regress/regress-2989.js
+++ b/implementation-contributed/v8/mjsunit/regress/regress-2989.js
@@ -21,7 +21,12 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 // SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --opt
+
+if (isNeverOptimizeLiteMode()) {
+  print("Warning: skipping test that requires optimization in Lite mode.");
+  quit(0);
+}
 
 (function ArgumentsObjectChange() {
   function f(x) {
diff --git a/implementation-contributed/v8/mjsunit/regress/regress-778668.js b/implementation-contributed/v8/mjsunit/regress/regress-778668.js
index cb6a359fd9..93bde12222 100644
--- a/implementation-contributed/v8/mjsunit/regress/regress-778668.js
+++ b/implementation-contributed/v8/mjsunit/regress/regress-778668.js
@@ -2,6 +2,22 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+(function () {
+  function f() {
+    arguments.length = -5;
+    Array.prototype.slice.call(arguments);
+  }
+  f('a')
+})();
+
+(function () {
+  function f() {
+    arguments.length = 2.3;
+    Array.prototype.slice.call(arguments);
+  }
+  f('a')
+})();
+
 (function () {
   function f( __v_59960) {
     arguments.length = -5;
@@ -13,7 +29,6 @@
 (function () {
   function f( __v_59960) {
     arguments.length = 2.3;
-    print(arguments.length);
     Array.prototype.slice.call(arguments);
   }
   f('a')
diff --git a/implementation-contributed/v8/mjsunit/regress/regress-8241.js b/implementation-contributed/v8/mjsunit/regress/regress-8241.js
new file mode 100644
index 0000000000..fb9d5475cb
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regress/regress-8241.js
@@ -0,0 +1,6 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f(x) { }
+f(x=>x, [x,y] = [1,2]);
diff --git a/implementation-contributed/v8/mjsunit/regress/regress-897366.js b/implementation-contributed/v8/mjsunit/regress/regress-897366.js
new file mode 100644
index 0000000000..990e21590e
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regress/regress-897366.js
@@ -0,0 +1,15 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --gc-interval=100
+
+let xs = [];
+for (let i = 0; i < 205; ++i) {
+  xs.push(i);
+}
+xs.sort((a, b) => {
+  xs.shift();
+  xs[xs.length] = -246;
+  return a - b;
+});
diff --git a/implementation-contributed/v8/mjsunit/regress/regress-897815.js b/implementation-contributed/v8/mjsunit/regress/regress-897815.js
new file mode 100644
index 0000000000..40a8c5e1ef
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regress/regress-897815.js
@@ -0,0 +1,16 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function __f_19350() {
+  function __f_19351() {
+    function __f_19352() {
+    }
+  }
+  try {
+    __f_19350();
+  } catch (e) {}
+    %OptimizeFunctionOnNextCall(__f_19351)
+})();
diff --git a/implementation-contributed/v8/mjsunit/regress/regress-crbug-781116-1.js b/implementation-contributed/v8/mjsunit/regress/regress-crbug-781116-1.js
index 83af7a8b98..fb3f7da54e 100644
--- a/implementation-contributed/v8/mjsunit/regress/regress-crbug-781116-1.js
+++ b/implementation-contributed/v8/mjsunit/regress/regress-crbug-781116-1.js
@@ -9,7 +9,6 @@ function baz(obj, store) {
 }
 function bar(store) {
   baz(Array.prototype, store);
-  baz(this.arguments, true);
 }
 bar(false);
 bar(false);
diff --git a/implementation-contributed/v8/mjsunit/regress/regress-crbug-781116-2.js b/implementation-contributed/v8/mjsunit/regress/regress-crbug-781116-2.js
index f8ffbe8ff5..0af8d6f1a8 100644
--- a/implementation-contributed/v8/mjsunit/regress/regress-crbug-781116-2.js
+++ b/implementation-contributed/v8/mjsunit/regress/regress-crbug-781116-2.js
@@ -9,7 +9,6 @@ function baz(obj, store) {
 }
 function bar(store) {
   baz(Object.prototype, store);
-  baz(this.arguments, true);
 }
 bar(false);
 bar(false);
diff --git a/implementation-contributed/v8/mjsunit/regress/regress-crbug-897098.js b/implementation-contributed/v8/mjsunit/regress/regress-crbug-897098.js
new file mode 100644
index 0000000000..fe11aa17f6
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regress/regress-crbug-897098.js
@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const arr = [1.1,2.2,3.3];
+arr.pop();
+const start = {toString: function() {arr.pop();}}
+arr.includes(0, start);
diff --git a/implementation-contributed/v8/mjsunit/regress/regress-crbug-897404.js b/implementation-contributed/v8/mjsunit/regress/regress-crbug-897404.js
new file mode 100644
index 0000000000..992c5d56cd
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regress/regress-crbug-897404.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function TestError() {}
+
+// Force slow, generic assess path that will always allocate a temporary fixed
+// array.
+String.prototype.__defineGetter__(0, function() { });
+
+const a = new Array(2**32 - 1);
+
+// Force early exit to avoid an unreasonably long test.
+a[0] = {
+  toString() { throw new TestError(); }
+};
+
+// Verify join throws test error and does not fail due to asserts (Negative
+// length fixed array allocation).
+assertThrows(() => a.join(), TestError);
diff --git a/implementation-contributed/v8/mjsunit/regress/regress-crbug-897406.js b/implementation-contributed/v8/mjsunit/regress/regress-crbug-897406.js
new file mode 100644
index 0000000000..62eeeebbef
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regress/regress-crbug-897406.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --async-stack-traces --expose-async-hooks
+
+async_hooks.createHook({
+  after() { throw new Error(); }
+}).enable();
+
+(async function() {
+  await 1;
+  await 1;
+})();
diff --git a/implementation-contributed/v8/mjsunit/regress/regress-crbug-897514.js b/implementation-contributed/v8/mjsunit/regress/regress-crbug-897514.js
new file mode 100644
index 0000000000..822a6bcf5e
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/regress/regress-crbug-897514.js
@@ -0,0 +1,26 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Create transtion => 'get a'.
+let o = {};
+Object.defineProperty(o, 'a', {
+    enumerable: true,
+    configurable: true,
+    get: function() { return 7 }
+});
+
+function spread(o) {
+  let result = { ...o };
+  %HeapObjectVerify(result);
+  return result;
+}
+
+for (let i = 0; i<3; i++) {
+  spread([]);
+  // Use different transition => 'a'.
+  spread({ a:0 });
+  spread("abc");
+}
diff --git a/implementation-contributed/v8/mjsunit/shared-function-tier-up-turbo.js b/implementation-contributed/v8/mjsunit/shared-function-tier-up-turbo.js
index f8e9117785..0d23b4f843 100644
--- a/implementation-contributed/v8/mjsunit/shared-function-tier-up-turbo.js
+++ b/implementation-contributed/v8/mjsunit/shared-function-tier-up-turbo.js
@@ -6,6 +6,10 @@
 // Flags: --opt --no-always-opt --turbo-filter=*
 
 // If we are always or never optimizing it is useless.
+if (isNeverOptimizeLiteMode()) {
+  print("Warning: skipping test that requires optimization in Lite mode.");
+  quit(0);
+}
 assertFalse(isAlwaysOptimize());
 assertFalse(isNeverOptimize());
 
diff --git a/implementation-contributed/v8/test262/test262.status b/implementation-contributed/v8/test262/test262.status
index 47965aa50c..27dd32bac0 100644
--- a/implementation-contributed/v8/test262/test262.status
+++ b/implementation-contributed/v8/test262/test262.status
@@ -518,10 +518,6 @@
   'annexB/language/statements/for-await-of/iterator-close-return-emulates-undefined-throws-when-called': [FAIL],
   'annexB/language/statements/for-of/iterator-close-return-emulates-undefined-throws-when-called': [FAIL],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=7186
-  'language/statements/class/fields-indirect-eval-err-contains-arguments': [FAIL],
-  'language/expressions/class/fields-indirect-eval-err-contains-arguments': [FAIL],
-
   # https://bugs.chromium.org/p/v8/issues/detail?id=7468
   'language/statements/class/privatename-not-valid-earlyerr-script-8': [FAIL],