Merge pull request #711 from bocoup/audit2016-section-21-regexp

Improve coverage for section 21: RegExp

test/built-ins/RegExp/lastIndex.js

@@ -0,0 +1,33 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-regexp-pattern-flags
+es6id: 21.2.3.1
+description: Initial state of the `lastIndex` property
+info: |
+  [...]
+  7. Let O be ? RegExpAlloc(newTarget).
+  8. Return ? RegExpInitialize(O, P, F).
+
+  21.2.3.2.2 Runtime Semantics: RegExpInitialize
+
+  [...]
+  12. Perform ? Set(obj, "lastIndex", 0, true).
+  [...]
+
+  21.2.3.2.1 Runtime Semantics: RegExpAlloc
+
+  [...]
+  2. Perform ! DefinePropertyOrThrow(obj, "lastIndex", PropertyDescriptor
+     {[[Writable]]: true, [[Enumerable]]: false, [[Configurable]]: false}).
+  [...]
+includes: [propertyHelper.js]
+---*/
+
+var re = new RegExp('');
+
+assert.sameValue(re.lastIndex, 0);
+
+verifyNotEnumerable(re, 'lastIndex');
+verifyWritable(re, 'lastIndex');
+verifyNotConfigurable(re, 'lastIndex');

test/built-ins/RegExp/prototype/global/15.10.7.2-1.js

@@ -1,12 +0,0 @@
-// Copyright (c) 2012 Ecma International.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-es5id: 15.10.7.2-1
-description: RegExp.prototype.global is a non-generic accessor property
----*/
-
-
-assert.throws(TypeError, function() {
-    RegExp.prototype.global;
-});

test/built-ins/RegExp/prototype/global/this-val-invalid-obj.js

@@ -0,0 +1,27 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-regexp.prototype.global
+es6id: 21.2.5.4
+description: A TypeError is thrown when the "this" value is an invalid Object
+info: |
+  1. Let R be the this value.
+  2. If Type(R) is not Object, throw a TypeError exception.
+  3. If R does not have an [[OriginalFlags]] internal slot, then
+     a. If SameValue(R, %RegExpPrototype%) is true, return undefined.
+     b. Otherwise, throw a TypeError exception.
+---*/
+
+var get = Object.getOwnPropertyDescriptor(RegExp.prototype, 'global').get;
+
+assert.throws(TypeError, function() {
+  get.call({});
+}, 'ordinary object');
+
+assert.throws(TypeError, function() {
+  get.call([]);
+}, 'array exotic object');
+
+assert.throws(TypeError, function() {
+  get.call(arguments);
+}, 'arguments object');

test/built-ins/RegExp/prototype/global/this-val-non-obj.js

@@ -0,0 +1,38 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-regexp.prototype.global
+es6id: 21.2.5.4
+description: A TypeError is thrown when the "this" value is not an Object
+info: |
+  1. Let R be the this value.
+  2. If Type(R) is not Object, throw a TypeError exception.
+features: [Symbol]
+---*/
+
+var get = Object.getOwnPropertyDescriptor(RegExp.prototype, 'global').get;
+var symbol = Symbol();
+
+assert.throws(TypeError, function() {
+  get.call(undefined);
+}, 'undefined');
+
+assert.throws(TypeError, function() {
+  get.call(null);
+}, 'null');
+
+assert.throws(TypeError, function() {
+  get.call(3);
+}, 'number');
+
+assert.throws(TypeError, function() {
+  get.call('string');
+}, 'string');
+
+assert.throws(TypeError, function() {
+  get.call(true);
+}, 'boolean');
+
+assert.throws(TypeError, function() {
+  get.call(symbol);
+}, 'symbol');

test/built-ins/RegExp/prototype/global/this-val-regexp-prototype.js

@@ -0,0 +1,17 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-regexp.prototype.global
+description: >
+  Return value of `undefined` when the "this" value is the RegExp prototype
+  object
+info: |
+  1. Let R be the this value.
+  2. If Type(R) is not Object, throw a TypeError exception.
+  3. If R does not have an [[OriginalFlags]] internal slot, then
+     a. If SameValue(R, %RegExpPrototype%) is true, return undefined.
+---*/
+
+var get = Object.getOwnPropertyDescriptor(RegExp.prototype, 'global').get;
+
+assert.sameValue(get.call(RegExp.prototype), undefined);

test/built-ins/RegExp/prototype/ignoreCase/15.10.7.3-1.js

@@ -1,12 +0,0 @@
-// Copyright (c) 2012 Ecma International.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-es5id: 15.10.7.3-1
-description: RegExp.prototype.ignoreCase is a non-generic accessor property
----*/
-
-
-assert.throws(TypeError, function() {
-    RegExp.prototype.ignoreCase;
-});

test/built-ins/RegExp/prototype/ignoreCase/this-val-invalid-obj.js

@@ -0,0 +1,27 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-regexp.prototype.ignorecase
+es6id: 21.2.5.5
+description: A TypeError is thrown when the "this" value is an invalid Object
+info: |
+  1. Let R be the this value.
+  2. If Type(R) is not Object, throw a TypeError exception.
+  3. If R does not have an [[OriginalFlags]] internal slot, then
+     a. If SameValue(R, %RegExpPrototype%) is true, return undefined.
+     b. Otherwise, throw a TypeError exception.
+---*/
+
+var get = Object.getOwnPropertyDescriptor(RegExp.prototype, 'ignoreCase').get;
+
+assert.throws(TypeError, function() {
+  get.call({});
+}, 'ordinary object');
+
+assert.throws(TypeError, function() {
+  get.call([]);
+}, 'array exotic object');
+
+assert.throws(TypeError, function() {
+  get.call(arguments);
+}, 'arguments object');

test/built-ins/RegExp/prototype/ignoreCase/this-val-non-obj.js

@@ -0,0 +1,38 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-regexp.prototype.ignorecase
+es6id: 21.2.5.5
+description: A TypeError is thrown when the "this" value is not an Object
+info: |
+  1. Let R be the this value.
+  2. If Type(R) is not Object, throw a TypeError exception.
+features: [Symbol]
+---*/
+
+var get = Object.getOwnPropertyDescriptor(RegExp.prototype, 'ignoreCase').get;
+var symbol = Symbol();
+
+assert.throws(TypeError, function() {
+  get.call(undefined);
+}, 'undefined');
+
+assert.throws(TypeError, function() {
+  get.call(null);
+}, 'null');
+
+assert.throws(TypeError, function() {
+  get.call(3);
+}, 'number');
+
+assert.throws(TypeError, function() {
+  get.call('string');
+}, 'string');
+
+assert.throws(TypeError, function() {
+  get.call(true);
+}, 'boolean');
+
+assert.throws(TypeError, function() {
+  get.call(symbol);
+}, 'symbol');

test/built-ins/RegExp/prototype/ignoreCase/this-val-regexp-prototype.js

@@ -0,0 +1,17 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-regexp.prototype.ignorecase
+description: >
+  Return value of `undefined` when the "this" value is the RegExp prototype
+  object
+info: |
+  1. Let R be the this value.
+  2. If Type(R) is not Object, throw a TypeError exception.
+  3. If R does not have an [[OriginalFlags]] internal slot, then
+     a. If SameValue(R, %RegExpPrototype%) is true, return undefined.
+---*/
+
+var get = Object.getOwnPropertyDescriptor(RegExp.prototype, 'ignoreCase').get;
+
+assert.sameValue(get.call(RegExp.prototype), undefined);

test/built-ins/RegExp/prototype/lastIndex/15.10.7.5-1.js

@@ -1,9 +0,0 @@
-// Copyright (c) 2012 Ecma International.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-es5id: 15.10.7.5-1
-description: RegExp.prototype.lastIndex is of type Undefined
----*/
-
-assert.sameValue(typeof(RegExp.prototype.lastIndex), 'undefined', 'typeof(RegExp.prototype.lastIndex)');

test/built-ins/RegExp/prototype/lastIndex/15.10.7.5-2.js

@@ -1,11 +0,0 @@
-// Copyright (c) 2012 Ecma International.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-es5id: 15.10.7.5-2
-description: RegExp.prototype.lastIndex is not present
----*/
-
-  var d = Object.getOwnPropertyDescriptor(RegExp.prototype, 'lastIndex');
-
-assert.sameValue(d, undefined, 'd');

test/built-ins/RegExp/prototype/lastIndex/S15.10.7.5_A8.js

@@ -1,32 +0,0 @@
-// Copyright 2009 the Sputnik authors.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-info: The RegExp instance lastIndex property has the attribute DontEnum
-es5id: 15.10.7.5_A8
-description: >
-    Checking if enumerating the lastIndex property of RegExp instance
-    fails
----*/
-
-var __re = new RegExp("A?B");
-
-//CHECK#0
-if (__re.hasOwnProperty('lastIndex') !== true) {
-  $ERROR('#0: __re = new RegExp("A?B"); __re.hasOwnProperty(\'lastIndex\') === true');
-}
-
- //CHECK#1
-if (__re.propertyIsEnumerable('lastIndex') !== false) {
-  $ERROR('#1: __re = new RegExp("A?B"); __re.propertyIsEnumerable(\'lastIndex\') === false');
-}
-
- //CHECK#2
-var count = 0
-for (var p in __re){
-  if (p==="lastIndex") count++   
-}
-
-if (count !== 0) {
-  $ERROR('#2: count = 0; __re = new RegExp("A?B"); for (p in __re){ if (p==="lastIndex") count++; } count === 0. Actual: ' + (count));
-}

test/built-ins/RegExp/prototype/lastIndex/S15.10.7.5_A9.js

@@ -1,33 +0,0 @@
-// Copyright 2009 the Sputnik authors.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-info: The RegExp instance lastIndex property has the attribute DontDelete
-es5id: 15.10.7.5_A9
-description: Checking if deleting the lastIndex property fails
-includes: [propertyHelper.js]
----*/
-
-var __re = new RegExp;
-
-//CHECK#0
-if (__re.hasOwnProperty('lastIndex') !== true) {
-  $ERROR('#0: __re = new RegExp; __re.hasOwnProperty(\'lastIndex\') === true');
-}
-
-verifyNotConfigurable(__re, "lastIndex");
-
-//CHECK#1
-try {
-  if ((delete __re.lastIndex) !== false) {
-    $ERROR('#1: __re = new RegExp; (delete __re.lastIndex) === false');
-  }
-} catch (e) {
-  if (e instanceof Test262Error) throw e;
-  assert(e instanceof TypeError);
-}
-
-//CHECK#2
-if (__re.hasOwnProperty('lastIndex') !== true) {
-  $ERROR('#2: __re = new RegExp;delete __re.lastIndex === true; __re.hasOwnProperty(\'lastIndex\') === true');
-}

test/built-ins/RegExp/prototype/multiline/15.10.7.4-1.js

@@ -1,12 +0,0 @@
-// Copyright (c) 2012 Ecma International.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-es5id: 15.10.7.4-1
-description: RegExp.prototype.multiline is a non-generic accessor property
----*/
-
-
-assert.throws(TypeError, function() {
-    RegExp.prototype.multiline;
-});

test/built-ins/RegExp/prototype/multiline/this-val-invalid-obj.js

@@ -0,0 +1,27 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-regexp.prototype.multiline
+es6id: 21.2.5.7
+description: A TypeError is thrown when the "this" value is an invalid Object
+info: |
+  1. Let R be the this value.
+  2. If Type(R) is not Object, throw a TypeError exception.
+  3. If R does not have an [[OriginalFlags]] internal slot, then
+     a. If SameValue(R, %RegExpPrototype%) is true, return undefined.
+     b. Otherwise, throw a TypeError exception.
+---*/
+
+var get = Object.getOwnPropertyDescriptor(RegExp.prototype, 'multiline').get;
+
+assert.throws(TypeError, function() {
+  get.call({});
+}, 'ordinary object');
+
+assert.throws(TypeError, function() {
+  get.call([]);
+}, 'array exotic object');
+
+assert.throws(TypeError, function() {
+  get.call(arguments);
+}, 'arguments object');

test/built-ins/RegExp/prototype/multiline/this-val-non-obj.js

@@ -0,0 +1,38 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-regexp.prototype.multiline
+es6id: 21.2.5.7
+description: A TypeError is thrown when the "this" value is not an Object
+info: |
+  1. Let R be the this value.
+  2. If Type(R) is not Object, throw a TypeError exception.
+features: [Symbol]
+---*/
+
+var get = Object.getOwnPropertyDescriptor(RegExp.prototype, 'multiline').get;
+var symbol = Symbol();
+
+assert.throws(TypeError, function() {
+  get.call(undefined);
+}, 'undefined');
+
+assert.throws(TypeError, function() {
+  get.call(null);
+}, 'null');
+
+assert.throws(TypeError, function() {
+  get.call(3);
+}, 'number');
+
+assert.throws(TypeError, function() {
+  get.call('string');
+}, 'string');
+
+assert.throws(TypeError, function() {
+  get.call(true);
+}, 'boolean');
+
+assert.throws(TypeError, function() {
+  get.call(symbol);
+}, 'symbol');

test/built-ins/RegExp/prototype/multiline/this-val-regexp-prototype.js

@@ -0,0 +1,17 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-regexp.prototype.multiline
+description: >
+  Return value of `undefined` when the "this" value is the RegExp prototype
+  object
+info: |
+  1. Let R be the this value.
+  2. If Type(R) is not Object, throw a TypeError exception.
+  3. If R does not have an [[OriginalFlags]] internal slot, then
+     a. If SameValue(R, %RegExpPrototype%) is true, return undefined.
+---*/
+
+var get = Object.getOwnPropertyDescriptor(RegExp.prototype, 'multiline').get;
+
+assert.sameValue(get.call(RegExp.prototype), undefined);

test/built-ins/RegExp/prototype/no-regexp-matcher.js

@@ -0,0 +1,23 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-properties-of-the-regexp-prototype-object
+es6id: 21.2.5
+description: >
+  The RegExp prototype object does not have a [[RegExpMatcher]] internal slot
+info: |
+  The RegExp prototype object is an ordinary object. It is not a RegExp
+  instance and does not have a [[RegExpMatcher]] internal slot or any of the
+  other internal slots of RegExp instance objects.
+
+  21.2.5.2 RegExp.prototype.exec
+
+  1. Let R be the this value.
+  2. If Type(R) is not Object, throw a TypeError exception.
+  3. If R does not have a [[RegExpMatcher]] internal slot, throw a TypeError
+     exception.
+---*/
+
+assert.throws(TypeError, function() {
+  RegExp.prototype.exec('');
+});

test/built-ins/RegExp/prototype/source/15.10.7.1-1.js

@@ -1,12 +0,0 @@
-// Copyright (c) 2012 Ecma International.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-es5id: 15.10.7.1-1
-description: RegExp.prototype.source is a non-generic accessor property
----*/
-
-
-assert.throws(TypeError, function() {
-    RegExp.prototype.source;
-});

test/built-ins/RegExp/prototype/source/this-val-invalid-obj.js

@@ -0,0 +1,27 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-regexp.prototype.source
+es6id: 21.2.5.10
+description: A TypeError is thrown when the "this" value is an invalid Object
+info: |
+  1. Let R be the this value.
+  2. If Type(R) is not Object, throw a TypeError exception.
+  3. If R does not have an [[OriginalFlags]] internal slot, then
+     a. If SameValue(R, %RegExpPrototype%) is true, return "(?:)".
+     b. Otherwise, throw a TypeError exception.
+---*/
+
+var get = Object.getOwnPropertyDescriptor(RegExp.prototype, 'source').get;
+
+assert.throws(TypeError, function() {
+  get.call({});
+}, 'ordinary object');
+
+assert.throws(TypeError, function() {
+  get.call([]);
+}, 'array exotic object');
+
+assert.throws(TypeError, function() {
+  get.call(arguments);
+}, 'arguments object');

test/built-ins/RegExp/prototype/source/this-val-non-obj.js

@@ -0,0 +1,38 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-regexp.prototype.source
+es6id: 21.2.5.10
+description: A TypeError is thrown when the "this" value is not an Object
+info: |
+  1. Let R be the this value.
+  2. If Type(R) is not Object, throw a TypeError exception.
+features: [Symbol]
+---*/
+
+var get = Object.getOwnPropertyDescriptor(RegExp.prototype, 'source').get;
+var symbol = Symbol();
+
+assert.throws(TypeError, function() {
+  get.call(undefined);
+}, 'undefined');
+
+assert.throws(TypeError, function() {
+  get.call(null);
+}, 'null');
+
+assert.throws(TypeError, function() {
+  get.call(3);
+}, 'number');
+
+assert.throws(TypeError, function() {
+  get.call('string');
+}, 'string');
+
+assert.throws(TypeError, function() {
+  get.call(true);
+}, 'boolean');
+
+assert.throws(TypeError, function() {
+  get.call(symbol);
+}, 'symbol');

test/built-ins/RegExp/prototype/source/this-val-regexp-prototype.js

@@ -0,0 +1,17 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-regexp.prototype.source
+description: >
+  Return value of `undefined` when the "this" value is the RegExp prototype
+  object
+info: |
+  1. Let R be the this value.
+  2. If Type(R) is not Object, throw a TypeError exception.
+  3. If R does not have an [[OriginalFlags]] internal slot, then
+     a. If SameValue(R, %RegExpPrototype%) is true, return "(?:)".
+---*/
+
+var get = Object.getOwnPropertyDescriptor(RegExp.prototype, 'source').get;
+
+assert.sameValue(get.call(RegExp.prototype), '(?:)');

test/built-ins/RegExp/prototype/source/value-empty.js

@@ -0,0 +1,25 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-regexp.prototype.source
+es6id: 21.2.5.10
+description: >
+  Return value can be used to create an equivalent RegExp when the
+  [[OriginalSource]] internal slot is the empty string
+
+  21.2.3.2.4 Runtime Semantics: EscapeRegExpPattern
+
+  [...] the internal procedure that would result from evaluating S as a
+  Pattern[~U] (Pattern[+U] if F contains "u") must behave identically to the
+  internal procedure given by the constructed object's [[RegExpMatcher]]
+  internal slot.
+info: |
+  [...]
+  5. Let src be R.[[OriginalSource]].
+  6. Let flags be R.[[OriginalFlags]].
+  7. Return EscapeRegExpPattern(src, flags).
+---*/
+
+var re = eval('/' + new RegExp('').source + '/');
+
+assert.sameValue(re.test(''), true);

test/built-ins/RegExp/prototype/source/value-line-terminator.js

@@ -0,0 +1,29 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-regexp.prototype.source
+es6id: 21.2.5.10
+description: >
+  Return value can be used to create an equivalent RegExp when the
+  [[OriginalSource]] internal slot contains a LineTerminator
+info: |
+  [...]
+  5. Let src be R.[[OriginalSource]].
+  6. Let flags be R.[[OriginalFlags]].
+  7. Return EscapeRegExpPattern(src, flags).
+
+  21.2.3.2.4 Runtime Semantics: EscapeRegExpPattern
+
+  [...] the internal procedure that would result from evaluating S as a
+  Pattern[~U] (Pattern[+U] if F contains "u") must behave identically to the
+  internal procedure given by the constructed object's [[RegExpMatcher]]
+  internal slot.
+---*/
+
+var re = eval('/' + new RegExp('\n').source + '/');
+
+assert.sameValue(re.test('\n'), true, 'input: "\\n"');
+assert.sameValue(re.test('_\n_'), true, 'input: "_\\n_"');
+assert.sameValue(re.test('\\n'), false, 'input: "\\\\n"');
+assert.sameValue(re.test('\r'), false, 'input: "\\r"');
+assert.sameValue(re.test('n'), false, 'input: "n"');

test/built-ins/RegExp/prototype/source/value-u.js

@@ -0,0 +1,33 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-regexp.prototype.source
+es6id: 21.2.5.10
+description: >
+  Return value can be used to create an equivalent RegExp when the
+  [[OriginalFlags]] internal slot contains the `u` flag
+info: |
+  [...]
+  5. Let src be R.[[OriginalSource]].
+  6. Let flags be R.[[OriginalFlags]].
+  7. Return EscapeRegExpPattern(src, flags).
+
+  21.2.3.2.4 Runtime Semantics: EscapeRegExpPattern
+
+  [...] the internal procedure that would result from evaluating S as a
+  Pattern[~U] (Pattern[+U] if F contains "u") must behave identically to the
+  internal procedure given by the constructed object's [[RegExpMatcher]]
+  internal slot.
+---*/
+
+var re;
+
+re = eval('/' + /\ud834\udf06/u.source + '/u');
+
+assert.sameValue(re.test('\ud834\udf06'), true);
+assert.sameValue(re.test('𝌆'), true);
+
+re = eval('/' + /\u{1d306}/u.source + '/u');
+
+assert.sameValue(re.test('\ud834\udf06'), true);
+assert.sameValue(re.test('𝌆'), true);

test/built-ins/RegExp/prototype/source/value.js

@@ -0,0 +1,35 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-regexp.prototype.source
+es6id: 21.2.5.10
+description: Return value can be used to create an equivalent RegExp
+info: |
+  [...]
+  5. Let src be R.[[OriginalSource]].
+  6. Let flags be R.[[OriginalFlags]].
+  7. Return EscapeRegExpPattern(src, flags).
+
+  21.2.3.2.4 Runtime Semantics: EscapeRegExpPattern
+
+  [...] the internal procedure that would result from evaluating S as a
+  Pattern[~U] (Pattern[+U] if F contains "u") must behave identically to the
+  internal procedure given by the constructed object's [[RegExpMatcher]]
+  internal slot.
+---*/
+
+var re = eval('/' + /ab{2,4}c$/.source + '/');
+
+assert(re.test('abbc'), 'input: abbc');
+assert(re.test('abbbc'), 'input: abbbc');
+assert(re.test('abbbbc'), 'input: abbbbc');
+assert(re.test('xabbc'), 'input: xabbc');
+assert(re.test('xabbbc'), 'input: xabbbc');
+assert(re.test('xabbbbc'), 'input: xabbbbc');
+
+assert.sameValue(re.test('ac'), false, 'input: ac');
+assert.sameValue(re.test('abc'), false, 'input: abc');
+assert.sameValue(re.test('abbcx'), false, 'input: abbcx');
+assert.sameValue(re.test('bbc'), false, 'input: bbc');
+assert.sameValue(re.test('abb'), false, 'input: abb');
+assert.sameValue(re.test('abbbbbc'), false, 'input: abbbbbc');

test/built-ins/RegExp/prototype/sticky/this-val-invalid-obj.js

@@ -17,4 +17,12 @@ var sticky = Object.getOwnPropertyDescriptor(RegExp.prototype, 'sticky').get;
 
 assert.throws(TypeError, function() {
   sticky.call({});
-});
+}, 'ordinary object');
+
+assert.throws(TypeError, function() {
+  sticky.call([]);
+}, 'array exotic object');
+
+assert.throws(TypeError, function() {
+  sticky.call(arguments);
+}, 'arguments object');

test/built-ins/RegExp/prototype/sticky/this-val-regexp-prototype.js

@@ -0,0 +1,17 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-regexp.prototype.sticky
+description: >
+  Return value of `undefined` when the "this" value is the RegExp prototype
+  object
+info: |
+  1. Let R be the this value.
+  2. If Type(R) is not Object, throw a TypeError exception.
+  3. If R does not have an [[OriginalFlags]] internal slot, then
+     a. If SameValue(R, %RegExpPrototype%) is true, return undefined.
+---*/
+
+var get = Object.getOwnPropertyDescriptor(RegExp.prototype, 'sticky').get;
+
+assert.sameValue(get.call(RegExp.prototype), undefined);

test/built-ins/RegExp/prototype/unicode/this-val-invalid-obj.js

@@ -17,4 +17,12 @@ var unicode = Object.getOwnPropertyDescriptor(RegExp.prototype, 'unicode').get;
 
 assert.throws(TypeError, function() {
   unicode.call({});
-});
+}, 'ordinary object');
+
+assert.throws(TypeError, function() {
+  unicode.call([]);
+}, 'array exotic object');
+
+assert.throws(TypeError, function() {
+  unicode.call(arguments);
+}, 'arguments object');

test/built-ins/RegExp/prototype/unicode/this-val-regexp-prototype.js

@@ -0,0 +1,17 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-regexp.prototype.unicode
+description: >
+  Return value of `undefined` when the "this" value is the RegExp prototype
+  object
+info: |
+  1. Let R be the this value.
+  2. If Type(R) is not Object, throw a TypeError exception.
+  3. If R does not have an [[OriginalFlags]] internal slot, then
+     a. If SameValue(R, %RegExpPrototype%) is true, return undefined.
+---*/
+
+var get = Object.getOwnPropertyDescriptor(RegExp.prototype, 'unicode').get;
+
+assert.sameValue(get.call(RegExp.prototype), undefined);

test/language/literals/regexp/lastIndex.js

@@ -0,0 +1,37 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-regular-expression-literals-runtime-semantics-evaluation
+es6id: 12.2.8.2
+description: Initial state of the `lastIndex` property
+info: |
+  [...]
+  3. Return RegExpCreate(pattern, flags).
+
+  21.2.3.2.3 Runtime Semantics: RegExpCreate
+
+  1. Let obj be ? RegExpAlloc(%RegExp%).
+  2. Return ? RegExpInitialize(obj, P, F). 
+
+  21.2.3.2.2 Runtime Semantics: RegExpInitialize
+
+  [...]
+  12. Perform ? Set(obj, "lastIndex", 0, true).
+  [...]
+
+  21.2.3.2.1 Runtime Semantics: RegExpAlloc
+
+  [...]
+  2. Perform ! DefinePropertyOrThrow(obj, "lastIndex", PropertyDescriptor
+     {[[Writable]]: true, [[Enumerable]]: false, [[Configurable]]: false}).
+  [...]
+includes: [propertyHelper.js]
+---*/
+
+var re = /./;
+
+assert.sameValue(re.lastIndex, 0);
+
+verifyNotEnumerable(re, 'lastIndex');
+verifyWritable(re, 'lastIndex');
+verifyNotConfigurable(re, 'lastIndex');

test/language/literals/regexp/u-unicode-esc-bounds.js

@@ -13,4 +13,4 @@ info: >
 negative: SyntaxError
 ---*/
 
-/\u{ff0000}/u;
+/\u{110000}/u;

test/language/literals/regexp/y-assertion-start.js

@@ -0,0 +1,46 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-assertion
+es6id: 21.2.2.6
+description: The `y` flag has no effect on the `^` assertion
+info: >
+  Even when the y flag is used with a pattern, ^ always matches only at the
+  beginning of Input, or (if Multiline is true) at the beginning of a line.
+---*/
+
+var re;
+
+re = /^a/y;
+
+re.lastIndex = 0;
+assert.sameValue(
+  re.test('a'), true, 'positive: beginning of input (without `m`)'
+);
+
+re.lastIndex = 1;
+assert.sameValue(
+  re.test(' a'), false, 'negative: within a line (without `m`)'
+);
+
+re.lastIndex = 1;
+assert.sameValue(
+  re.test('\na'), false, 'negative: beginning of line (without `m`)'
+);
+
+re = /^a/my;
+
+re.lastIndex = 0;
+assert.sameValue(
+  re.test('a'), true, 'positive: beginning of input (with `m`)'
+);
+
+re.lastIndex = 1;
+assert.sameValue(
+  re.test(' a'), false, 'negative: within a line (with `m`)'
+);
+
+re.lastIndex = 1;
+assert.sameValue(
+  re.test('\na'), true, 'positive: beginning of line (with `m`)'
+);