[v8-test262-automation] Changes from https://github.com/v8/v8.git at sha ac250b9b on Wed Nov 14 2018 18:59:57 GMT+0000 (Coordinated Universal Time)

implementation-contributed/v8/mjsunit/es6/classes.js

@@ -1161,3 +1161,95 @@ function testClassRestrictedProperties(C) {
     assertEquals(instance[key], value);
   }
 })();
+
+var b = 'b';
+
+(function TestOverwritingInstanceAccessors() {
+  var C, desc;
+  C = class {
+    [b]() { return 'B'; };
+    get b() { return 'get B'; };
+  };
+  desc = Object.getOwnPropertyDescriptor(C.prototype, 'b');
+  assertFalse(desc.enumerable);
+  assertTrue(desc.configurable);
+  assertEquals('get B', desc.get());
+  assertEquals(undefined, desc.set);
+
+  C = class {
+    [b]() { return 'B'; };
+    set b(v) { return 'set B'; };
+  };
+  desc = Object.getOwnPropertyDescriptor(C.prototype, 'b');
+  assertFalse(desc.enumerable);
+  assertTrue(desc.configurable);
+  assertEquals(undefined, desc.get);
+  assertEquals('set B', desc.set());
+
+  C = class {
+    set b(v) { return 'get B'; };
+    [b]() { return 'B'; };
+    get b() { return 'get B'; };
+  };
+  desc = Object.getOwnPropertyDescriptor(C.prototype, 'b');
+  assertFalse(desc.enumerable);
+  assertTrue(desc.configurable);
+  assertEquals('get B', desc.get());
+  assertEquals(undefined, desc.set);
+
+  C = class {
+    get b() { return 'get B'; };
+    [b]() { return 'B'; };
+    set b(v) { return 'set B'; };
+  };
+  desc = Object.getOwnPropertyDescriptor(C.prototype, 'b');
+  assertFalse(desc.enumerable);
+  assertTrue(desc.configurable);
+  assertEquals(undefined, desc.get);
+  assertEquals('set B', desc.set());
+})();
+
+(function TestOverwritingStaticAccessors() {
+  var C, desc;
+  C = class {
+    static [b]() { return 'B'; };
+    static get b() { return 'get B'; };
+  };
+  desc = Object.getOwnPropertyDescriptor(C, 'b');
+  assertFalse(desc.enumerable);
+  assertTrue(desc.configurable);
+  assertEquals('get B', desc.get());
+  assertEquals(undefined, desc.set);
+
+  C = class {
+    static [b]() { return 'B'; };
+    static set b(v) { return 'set B'; };
+  };
+  desc = Object.getOwnPropertyDescriptor(C, 'b');
+  assertFalse(desc.enumerable);
+  assertTrue(desc.configurable);
+  assertEquals(undefined, desc.get);
+  assertEquals('set B', desc.set());
+
+  C = class {
+    static set b(v) { return 'get B'; };
+    static [b]() { return 'B'; };
+    static get b() { return 'get B'; };
+  };
+  desc = Object.getOwnPropertyDescriptor(C, 'b');
+  assertFalse(desc.enumerable);
+  assertTrue(desc.configurable);
+  assertEquals('get B', desc.get());
+  assertEquals(undefined, desc.set);
+
+  C = class {
+    static get b() { return 'get B'; };
+    static [b]() { return 'B'; };
+    static set b(v) { return 'set B'; };
+  };
+  desc = Object.getOwnPropertyDescriptor(C, 'b');
+  assertFalse(desc.enumerable);
+  assertTrue(desc.configurable);
+  assertEquals(undefined, desc.get);
+  assertEquals('set B', desc.set());
+})();

implementation-contributed/v8/mjsunit/es6/typedarray.js

@@ -1022,3 +1022,29 @@ assertThrows(function LargeSourceArray() {
 
   a.set(v0);
 });
+
+function TestMapCustomSpeciesConstructor(constructor) {
+  const sample = new constructor([40, 42, 42]);
+  let result, ctorThis;
+
+  sample.constructor = {};
+  sample.constructor[Symbol.species] = function(count) {
+    result = arguments;
+    ctorThis = this;
+    return new constructor(count);
+  };
+
+  sample.map(function(v) { return v; });
+
+  assertSame(result.length, 1, "called with 1 argument");
+  assertSame(result[0], 3, "[0] is the new captured length");
+
+  assertTrue(
+    ctorThis instanceof sample.constructor[Symbol.species],
+    "`this` value in the @@species fn is an instance of the function itself"
+  );
+};
+
+for(i = 0; i < typedArrayConstructors.length; i++) {
+  TestPropertyTypeChecks(typedArrayConstructors[i]);
+}

implementation-contributed/v8/mjsunit/harmony/weakrefs/basics.js

@@ -232,6 +232,14 @@
   WeakFactory.prototype.makeRef.call(wf, {});
 })();
 
+(function TestCleanupSomeWithoutWeakFactory() {
+  assertThrows(() => WeakFactory.prototype.cleanupSome.call({}), TypeError);
+  // Does not throw:
+  let wf = new WeakFactory(() => {});
+  let rv = WeakFactory.prototype.cleanupSome.call(wf);
+  assertEquals(undefined, rv);
+})();
+
 (function TestDerefWithoutWeakRef() {
   let wf = new WeakFactory(() => {});
   let wc = wf.makeCell({});

implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-cleared-weakcell.js

@@ -0,0 +1,35 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+
+let cleanup_count = 0;
+let cleanup_cells = [];
+let cleanup = function(iter) {
+  for (wc of iter) {
+    cleanup_cells.push(wc);
+  }
+  ++cleanup_count;
+}
+
+let wf = new WeakFactory(cleanup);
+let weak_cell;
+(function() {
+  let o = {};
+  weak_cell = wf.makeCell(o);
+
+  // cleanupSome won't do anything since there are no dirty WeakCells.
+  wf.cleanupSome();
+  assertEquals(0, cleanup_count);
+})();
+
+// GC will detect the WeakCell as dirty.
+gc();
+
+// Clear the WeakCell just before we would've called cleanupSome.
+weak_cell.clear();
+
+wf.cleanupSome();
+
+assertEquals(0, cleanup_count);

implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-dereffed-and-cleared-weakref.js

@@ -0,0 +1,51 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking --allow-natives-syntax
+
+let cleanup_count = 0;
+let cleanup_cells = [];
+let cleanup = function(iter) {
+  for (wc of iter) {
+    cleanup_cells.push(wc);
+  }
+  ++cleanup_count;
+}
+
+let o = {};
+let wf = new WeakFactory(cleanup);
+let weak_ref;
+(function() {
+  weak_ref = wf.makeRef(o);
+
+  // cleanupSome won't do anything since there are no dirty WeakCells.
+  wf.cleanupSome();
+  assertEquals(0, cleanup_count);
+})();
+
+// Clear the KeepDuringJob set.
+%RunMicrotasks();
+
+weak_ref.deref();
+o = null;
+
+// The WeakRef is not detected as dirty, since the KeepDuringJob set keeps the
+// target object alive.
+gc();
+
+wf.cleanupSome();
+assertEquals(0, cleanup_count);
+
+%RunMicrotasks();
+// Next turn.
+
+// This GC detects the WeakRef as dirty.
+gc();
+
+// Clear the WeakRef just before we would've called cleanupSome.
+weak_ref.clear();
+
+wf.cleanupSome();
+
+assertEquals(0, cleanup_count);

implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-dereffed-weakref.js

@@ -0,0 +1,57 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking --allow-natives-syntax
+
+let cleanup_count = 0;
+let cleanup_cells = [];
+let cleanup = function(iter) {
+  for (wc of iter) {
+    cleanup_cells.push(wc);
+  }
+  ++cleanup_count;
+}
+
+let o = {};
+let wf = new WeakFactory(cleanup);
+let weak_ref;
+(function() {
+  weak_ref = wf.makeRef(o);
+
+  // cleanupSome won't do anything since there are no dirty WeakCells.
+  wf.cleanupSome();
+  assertEquals(0, cleanup_count);
+})();
+
+// Clear the KeepDuringJob set.
+%RunMicrotasks();
+
+weak_ref.deref();
+o = null;
+
+// The WeakRef is not detected as dirty, since the KeepDuringJob set keeps the
+// target object alive.
+gc();
+
+wf.cleanupSome();
+assertEquals(0, cleanup_count);
+
+%RunMicrotasks();
+// Next turn.
+
+// Now the WeakRef can be cleared.
+gc();
+wf.cleanupSome();
+
+assertEquals(1, cleanup_count);
+assertEquals(1, cleanup_cells.length);
+assertEquals(weak_ref, cleanup_cells[0]);
+
+// The cleanup task is not executed again since all WeakCells have been
+// processed.
+
+%RunMicrotasks();
+// Next turn.
+
+assertEquals(1, cleanup_count);

implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-weakcell.js

@@ -0,0 +1,33 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+
+let cleanup_count = 0;
+let cleanup_cells = [];
+let cleanup = function(iter) {
+  for (wc of iter) {
+    cleanup_cells.push(wc);
+  }
+  ++cleanup_count;
+}
+
+let wf = new WeakFactory(cleanup);
+let weak_cell;
+(function() {
+  let o = {};
+  weak_cell = wf.makeCell(o);
+
+  // cleanupSome won't do anything since there are no dirty WeakCells.
+  wf.cleanupSome();
+  assertEquals(0, cleanup_count);
+})();
+
+// GC will detect the WeakCell as dirty.
+gc();
+
+wf.cleanupSome();
+assertEquals(1, cleanup_count);
+assertEquals(1, cleanup_cells.length);
+assertEquals(weak_cell, cleanup_cells[0]);

implementation-contributed/v8/mjsunit/harmony/weakrefs/cleanupsome-weakref.js

@@ -0,0 +1,43 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking --allow-natives-syntax
+
+let cleanup_count = 0;
+let cleanup_cells = [];
+let cleanup = function(iter) {
+  for (wc of iter) {
+    cleanup_cells.push(wc);
+  }
+  ++cleanup_count;
+}
+
+let wf = new WeakFactory(cleanup);
+let weak_ref;
+(function() {
+  let o = {};
+  weak_ref = wf.makeRef(o);
+
+  // cleanupSome won't do anything since there are no dirty WeakCells.
+  wf.cleanupSome();
+  assertEquals(0, cleanup_count);
+})();
+
+// The WeakRef is not detected as dirty, since the KeepDuringJob set keeps the
+// target object alive.
+gc();
+
+wf.cleanupSome();
+assertEquals(0, cleanup_count);
+
+%RunMicrotasks();
+// Next turn.
+
+// Now the WeakRef can be cleared.
+gc();
+wf.cleanupSome();
+
+assertEquals(1, cleanup_count);
+assertEquals(1, cleanup_cells.length);
+assertEquals(weak_ref, cleanup_cells[0]);

implementation-contributed/v8/mjsunit/mjsunit.status

@@ -717,10 +717,14 @@
   'compiler/native-context-specialization-hole-check': [PASS, FAIL],
   'elements-transition-hoisting': [PASS, FAIL],
   'es6/collections-constructor-custom-iterator': [PASS, FAIL],
+  'harmony/weakrefs/clear-clears-factory-pointer': [PASS, FAIL],
   'keyed-load-with-symbol-key': [PASS, FAIL],
   'object-seal': [PASS, FAIL],
   'regress/regress-3709': [PASS, FAIL],
+  'regress/regress-385565': [PASS, FAIL],
   'regress/regress-6948': [PASS, FAIL],
+  'regress/regress-7014-1': [PASS, FAIL],
+  'regress/regress-7014-2': [PASS, FAIL],
   'regress/regress-7510': [PASS, FAIL],
   'regress/regress-crbug-882233-2': [PASS, FAIL],
   'regress/regress-trap-allocation-memento': [PASS, FAIL],

implementation-contributed/v8/mjsunit/regexp-override-exec.js

@@ -0,0 +1,19 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var s = "baa";
+
+assertEquals(1, s.search(/a/));
+assertEquals(["aa"], s.match(/a./));
+assertEquals(["b", "", ""], s.split(/a/));
+
+let o = { index : 3, 0 : "x" };
+
+RegExp.prototype.exec = () => { return o; }
+assertEquals(3, s.search(/a/));
+assertEquals(o, s.match(/a./));
+assertEquals("baar", s.replace(/a./, "r"));
+
+RegExp.prototype.exec = () => { return null; }
+assertEquals(["baa"], s.split(/a/));

implementation-contributed/v8/mjsunit/regexp-override-symbol-match-all.js

@@ -0,0 +1,12 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-string-matchall
+
+var s = "baa";
+
+assertEquals([["b"]], [...s.matchAll(/./)]);
+
+RegExp.prototype[Symbol.matchAll] = () => 42;
+assertEquals(42, s.matchAll(/a./));

implementation-contributed/v8/mjsunit/regexp-override-symbol-match.js

@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var s = "baa";
+
+assertEquals(["aa"], s.match(/a./));
+
+RegExp.prototype[Symbol.match] = () => 42;
+assertEquals(42, s.match(/a./));

implementation-contributed/v8/mjsunit/regexp-override-symbol-replace.js

@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var s = "baa";
+
+assertEquals("bca", s.replace(/a/, "c"));
+
+RegExp.prototype[Symbol.replace] = () => 42;
+assertEquals(42, s.replace(/a./));

implementation-contributed/v8/mjsunit/regexp-override-symbol-search.js

@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var s = "baa";
+
+assertEquals(1, s.search(/a/));
+
+RegExp.prototype[Symbol.search] = () => 42;
+assertEquals(42, s.search(/a/));

implementation-contributed/v8/mjsunit/regexp-override-symbol-split.js

@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var s = "baa";
+
+assertEquals(["b", "", ""], s.split(/a/));
+
+RegExp.prototype[Symbol.split] = () => 42;
+assertEquals(42, s.split(/a./));

implementation-contributed/v8/mjsunit/regress/regress-8449.js

@@ -0,0 +1,25 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+{
+  const x = [, 1];
+  x.__proto__ = [42];
+  const y = [...x];
+  assertEquals([42, 1], y);
+  assertTrue(y.hasOwnProperty(0));
+}
+
+{
+  const x = [, 1];
+  x.__proto__ = [42];
+  assertEquals(42, x[Symbol.iterator]().next().value);
+}
+
+{
+  const array_prototype = [].__proto__;
+  array_prototype[0] = 42;
+  const x = [, 1];
+  assertEquals(42, x[Symbol.iterator]().next().value);
+  delete array_prototype[0];
+}

implementation-contributed/v8/mjsunit/regress/regress-904417.js

@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar(o) {
+  return o.hello, Object.getPrototypeOf(o);
+}
+
+var y = { __proto__: {}, hello: 44 };
+var z = { hello: 45 };
+
+bar(y);
+bar(z);
+bar(y);
+%OptimizeFunctionOnNextCall(bar);
+bar(y);

implementation-contributed/v8/mjsunit/regress/regress-904707.js

@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+delete Float64Array.prototype.__proto__[Symbol.iterator];
+
+let a = new Float64Array(9);
+Object.defineProperty(a, "length", {
+  get: function () { %ArrayBufferNeuter(a.buffer); return 6; }
+});
+
+Float64Array.from(a);

implementation-contributed/v8/mjsunit/regress/regress-crbug-900674.js

@@ -0,0 +1,12 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  let val = Promise.resolve().then();
+}
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();

implementation-contributed/v8/mjsunit/regress/regress-crbug-902672.js

@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = this;
+var b = {};
+a.length = 4294967296; // 2 ^ 32 (max array length + 1)
+assertThrows(() => Array.prototype.join.call(a,b), TypeError);

implementation-contributed/v8/test262/test262.status

@@ -625,13 +625,6 @@
   'built-ins/Atomics/wait/cannot-suspend-throws': [SKIP],
   'built-ins/Atomics/wait/undefined-index-defaults-to-zero': [SKIP],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=6890#c12
-  'built-ins/RegExp/prototype/Symbol.matchAll/isregexp-called-once': [FAIL],
-  'built-ins/RegExp/prototype/Symbol.matchAll/species-constructor': [FAIL],
-  'built-ins/RegExp/prototype/Symbol.matchAll/species-regexp-get-global-throws': [FAIL],
-  'built-ins/RegExp/prototype/Symbol.matchAll/species-regexp-get-unicode-throws': [FAIL],
-  'built-ins/String/prototype/matchAll/regexp-prototype-has-no-matchAll': [FAIL],
-
   # https://bugs.chromium.org/p/v8/issues/detail?id=8258
   'intl402/Locale/constructor-options-language-valid-undefined': [FAIL],
   'intl402/Locale/constructor-options-throwing-getters': [FAIL],