Merge pull request #1815 from test262-automation/v8-test262-automation-export-ffefa2383

Import test changes from V8

implementation-contributed/curation_logs/v8.json

@@ -1,5 +1,5 @@
 {
-  "sourceRevisionAtLastExport": "7b32eb8c",
+  "sourceRevisionAtLastExport": "4ab8215e",
-  "targetRevisionAtLastExport": "ffefa2383",
+  "targetRevisionAtLastExport": "92143ed8c",
   "curatedFiles": {}
 }

implementation-contributed/v8/mjsunit/code-coverage-block.js

@@ -471,7 +471,7 @@ TestCoverage(
  {"start":472,"end":503,"count":0},
  {"start":626,"end":653,"count":0},
  {"start":768,"end":803,"count":0},
- {"start":867,"end":869,"count":0}]
+ {"start":867,"end":868,"count":0}]
 );
 
 TestCoverage(
@@ -847,7 +847,7 @@ Util.escape("foo.bar");                   // 0400
 [{"start":0,"end":449,"count":1},
  {"start":64,"end":351,"count":1},
  {"start":112,"end":203,"count":0},
- {"start":303,"end":350,"count":0}]
+ {"start":268,"end":350,"count":0}]
 );
 
 %DebugToggleBlockCoverage(false);

implementation-contributed/v8/mjsunit/compiler/number-abs.js

@@ -0,0 +1,76 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberAbs correctly deals with PositiveInteger \/ MinusZero
+// and turns the -0 into a 0.
+(function() {
+  function foo(x) {
+    x = Math.floor(x);
+    x = Math.max(x, -0);
+    return 1 / Math.abs(x);
+  }
+
+  assertEquals(Infinity, foo(-0));
+  assertEquals(Infinity, foo(-0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(Infinity, foo(-0));
+})();
+
+// Test that NumberAbs properly passes the kIdentifyZeros truncation
+// for Signed32 \/ MinusZero inputs.
+(function() {
+  function foo(x) {
+    return Math.abs(x * -2);
+  }
+
+  assertEquals(2, foo(-1));
+  assertEquals(4, foo(-2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(-1));
+  assertEquals(4, foo(-2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();
+
+// Test that NumberAbs properly passes the kIdentifyZeros truncation
+// for Unsigned32 \/ MinusZero inputs.
+(function() {
+  function foo(x) {
+    x = x | 0;
+    return Math.abs(Math.max(x * -2, 0));
+  }
+
+  assertEquals(2, foo(-1));
+  assertEquals(4, foo(-2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(-1));
+  assertEquals(4, foo(-2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();
+
+// Test that NumberAbs properly passes the kIdentifyZeros truncation
+// for OrderedNumber inputs.
+(function() {
+  function foo(x) {
+    x = x | 0;
+    return Math.abs(Math.min(x * -2, 2 ** 32));
+  }
+
+  assertEquals(2, foo(-1));
+  assertEquals(4, foo(-2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(-1));
+  assertEquals(4, foo(-2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();

implementation-contributed/v8/mjsunit/compiler/number-ceil.js

@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberCeil propagates kIdentifyZeros truncations.
+(function() {
+  function foo(x) {
+    return Math.abs(Math.ceil(x * -2));
+  }
+
+  assertEquals(2, foo(1));
+  assertEquals(4, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(1));
+  assertEquals(4, foo(2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();

implementation-contributed/v8/mjsunit/compiler/number-comparison-truncations.js

@@ -0,0 +1,152 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that SpeculativeNumberEqual[SignedSmall] properly passes the
+// kIdentifyZeros truncation.
+(function() {
+  function foo(x, y) {
+    if (x * y === 0) return 0;
+    return 1;
+  }
+
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  assertOptimized(foo);
+  // Even if x*y produces -0 now, it should stay optimized.
+  assertEquals(0, foo(-3, 0));
+  assertEquals(0, foo(0, -3));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberEqual[Number] properly passes the
+// kIdentifyZeros truncation.
+(function() {
+  // Produce a SpeculativeNumberEqual with Number feedback.
+  function bar(x, y) { return x === y; }
+  bar(0.1, 0.5);
+  bar(-0, 100);
+
+  function foo(x, y) {
+    if (bar(x * y, 0)) return 0;
+    return 1;
+  }
+
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  assertOptimized(foo);
+  // Even if x*y produces -0 now, it should stay optimized.
+  assertEquals(0, foo(-3, 0));
+  assertEquals(0, foo(0, -3));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberLessThan[SignedSmall] properly passes the
+// kIdentifyZeros truncation.
+(function() {
+  function foo(x, y) {
+    if (x * y < 0) return 0;
+    return 1;
+  }
+
+  assertEquals(0, foo(1, -1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(1, -1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  assertOptimized(foo);
+  // Even if x*y produces -0 now, it should stay optimized.
+  assertEquals(1, foo(-3, 0));
+  assertEquals(1, foo(0, -3));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberLessThan[Number] properly passes the
+// kIdentifyZeros truncation.
+(function() {
+  // Produce a SpeculativeNumberLessThan with Number feedback.
+  function bar(x, y) { return x < y; }
+  bar(0.1, 0.5);
+  bar(-0, 100);
+
+  function foo(x, y) {
+    if (bar(x * y, 0)) return 0;
+    return 1;
+  }
+
+  assertEquals(0, foo(1, -1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(1, -1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  assertOptimized(foo);
+  // Even if x*y produces -0 now, it should stay optimized.
+  assertEquals(1, foo(-3, 0));
+  assertEquals(1, foo(0, -3));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberLessThanOrEqual[SignedSmall] properly passes the
+// kIdentifyZeros truncation.
+(function() {
+  function foo(x, y) {
+    if (x * y <= 0) return 0;
+    return 1;
+  }
+
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  assertOptimized(foo);
+  // Even if x*y produces -0 now, it should stay optimized.
+  assertEquals(0, foo(-3, 0));
+  assertEquals(0, foo(0, -3));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberLessThanOrEqual[Number] properly passes the
+// kIdentifyZeros truncation.
+(function() {
+  // Produce a SpeculativeNumberLessThanOrEqual with Number feedback.
+  function bar(x, y) { return x <= y; }
+  bar(0.1, 0.5);
+  bar(-0, 100);
+
+  function foo(x, y) {
+    if (bar(x * y, 0)) return 0;
+    return 1;
+  }
+
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  assertOptimized(foo);
+  // Even if x*y produces -0 now, it should stay optimized.
+  assertEquals(0, foo(-3, 0));
+  assertEquals(0, foo(0, -3));
+  assertOptimized(foo);
+})();

implementation-contributed/v8/mjsunit/compiler/number-floor.js

@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberFloor propagates kIdentifyZeros truncations.
+(function() {
+  function foo(x) {
+    return Math.abs(Math.floor(x * -2));
+  }
+
+  assertEquals(2, foo(1));
+  assertEquals(4, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(1));
+  assertEquals(4, foo(2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();

implementation-contributed/v8/mjsunit/compiler/number-max.js

@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberMax properly passes the kIdentifyZeros truncation.
+(function() {
+  function foo(x) {
+    if (Math.max(x * -2, 1) == 1) return 0;
+    return 1;
+  }
+
+  assertEquals(0, foo(2));
+  assertEquals(1, foo(-1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(2));
+  assertEquals(1, foo(-1));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();

implementation-contributed/v8/mjsunit/compiler/number-min.js

@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberMin properly passes the kIdentifyZeros truncation.
+(function() {
+  function foo(x) {
+    if (Math.min(x * -2, -1) == -2) return 0;
+    return 1;
+  }
+
+  assertEquals(0, foo(1));
+  assertEquals(1, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(1));
+  assertEquals(1, foo(2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(1, foo(0));
+  assertOptimized(foo);
+})();

implementation-contributed/v8/mjsunit/compiler/number-modulus.js

@@ -123,3 +123,34 @@
   assertEquals(1, foo(4));
   assertOptimized(foo);
 })();
+
+// Test that NumberModulus works in the case where TurboFan
+// can infer that the output is Signed32 \/ MinusZero, and
+// there's a truncation on the result that identifies zeros
+// (via the SpeculativeNumberEqual).
+(function() {
+  // We need a separately polluted % with NumberOrOddball feedback.
+  function bar(x) { return x % 2; }
+  bar(undefined);  // The % feedback is now NumberOrOddball.
+
+  // Now we just use the gadget above on an `x` that is known
+  // to be in Signed32 range and compare it to 0, which passes
+  // a truncation that identifies zeros.
+  function foo(x) {
+    if (bar(x | 0) == 0) return 0;
+    return 1;
+  }
+
+  assertEquals(0, foo(2));
+  assertEquals(1, foo(1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(2));
+  assertEquals(1, foo(1));
+  assertOptimized(foo);
+
+  // Now `foo` should stay optimized even if `x % 2` would
+  // produce -0, aka when we pass a negative value for `x`.
+  assertEquals(0, foo(-2));
+  assertEquals(1, foo(-1));
+  assertOptimized(foo);
+})();

implementation-contributed/v8/mjsunit/compiler/number-toboolean.js

@@ -0,0 +1,45 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberToBoolean properly passes the kIdentifyZeros truncation
+// for Signed32 \/ MinusZero inputs.
+(function() {
+  function foo(x) {
+    if (x * -2) return 1;
+    return 0;
+  }
+
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();
+
+
+// Test that NumberToBoolean properly passes the kIdentifyZeros truncation
+// for Unsigned32 \/ MinusZero inputs.
+(function() {
+  function foo(x) {
+    x = x | 0;
+    if (Math.max(x * -2, 0)) return 1;
+    return 0;
+  }
+
+  assertEquals(1, foo(-1));
+  assertEquals(1, foo(-2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(-1));
+  assertEquals(1, foo(-2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();

implementation-contributed/v8/mjsunit/compiler/number-trunc.js

@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberTrunc propagates kIdentifyZeros truncations.
+(function() {
+  function foo(x) {
+    return Math.abs(Math.trunc(x * -2));
+  }
+
+  assertEquals(2, foo(1));
+  assertEquals(4, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(1));
+  assertEquals(4, foo(2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();

implementation-contributed/v8/mjsunit/compiler/regress-7121.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --harmony-bigint
+// Flags: --allow-natives-syntax
 
 function foo() { %_ToLength(42n) }
 assertThrows(foo, TypeError);

implementation-contributed/v8/mjsunit/compiler/regress-890620.js

@@ -0,0 +1,25 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = 42;
+
+function g(n) {
+  while (n > 0) {
+    a = new Array(n);
+    n--;
+  }
+}
+
+g(1);
+
+function f() {
+  g();
+}
+
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
+assertEquals(1, a.length);

implementation-contributed/v8/mjsunit/compiler/typed-array-constructor.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --harmony-bigint
+// Flags: --allow-natives-syntax
 
 const limit = %MaxSmi() + 1;
 

implementation-contributed/v8/mjsunit/es6/proxy-function-tostring.js

@@ -1,7 +1,6 @@
 // Copyright 2018 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
-//
-// Flags: --noharmony-function-tostring
 
-assertThrows(() => new Proxy(function() {}, {}).toString(), TypeError);
+assertEquals(new Proxy(function() {}, {}).toString(),
+             'function () { [native code] }');

implementation-contributed/v8/mjsunit/es6/string-iterator2.js

@@ -0,0 +1,24 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// Tests for primitive strings.
+
+var str = 'ott';
+assertEquals(['o', 't', 't'], [...str]);
+assertTrue(%StringIteratorProtector());
+
+str[Symbol.iterator] = {};
+// Symbol.iterator can't be set on primitive strings, so it shouldn't invalidate
+// the protector.
+assertTrue(%StringIteratorProtector());
+
+// This changes the String Iterator prototype. No more tests should be run after
+// this in the same instance.
+var iterator = str[Symbol.iterator]();
+iterator.__proto__.next = () => ({value : undefined, done : true});
+
+assertFalse(%StringIteratorProtector());
+assertEquals([], [...str]);

implementation-contributed/v8/mjsunit/es6/string-iterator3.js

@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// Tests for primitive strings.
+
+var str = 'ott';
+assertTrue(%StringIteratorProtector());
+assertEquals(['o', 't', 't'], [...str]);
+
+// This changes the String prototype. No more tests should be run after this in
+// the same instance.
+str.__proto__[Symbol.iterator] =
+    function() {
+      return {next : () => ({value : undefined, done : true})};
+    };
+assertFalse(%StringIteratorProtector());
+assertEquals([], [...str]);

implementation-contributed/v8/mjsunit/es6/string-iterator4.js

@@ -0,0 +1,30 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// Tests for wrapped strings.
+
+var str = new String('ott');
+assertTrue(%StringIteratorProtector());
+assertEquals(['o', 't', 't'], [...str]);
+
+function iterator_fn() {
+  return {next : () => ({value : undefined, done : true})};
+};
+
+str[Symbol.iterator] = iterator_fn;
+// This shouldn't invalidate the protector, because it doesn't support String
+// objects.
+assertTrue(%StringIteratorProtector());
+assertEquals([], [...str]);
+
+
+var str2 = new String('ott');
+assertEquals(['o', 't', 't'], [...str2]);
+// This changes the String prototype. No more tests should be run after this in
+// the same instance.
+str2.__proto__[Symbol.iterator] = iterator_fn;
+assertFalse(%StringIteratorProtector());
+assertEquals([], [...str2]);

implementation-contributed/v8/mjsunit/es6/string-iterator5.js

@@ -0,0 +1,15 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Tests for primitive strings.
+
+var iterator = 'ott'[Symbol.iterator]();
+
+// These modifications shouldn't invalidate the String iterator protector.
+iterator.__proto__.fonts = {};
+assertTrue(%StringIteratorProtector());
+iterator.__proto__[0] = 0;
+assertTrue(%StringIteratorProtector());

implementation-contributed/v8/mjsunit/es6/string-iterator6.js

@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+assertTrue(%StringIteratorProtector());
+
+delete 'ott'.__proto__[Symbol.iterator];
+
+assertFalse(%StringIteratorProtector());

implementation-contributed/v8/mjsunit/es6/string-iterator7.js

@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+assertTrue(%StringIteratorProtector());
+
+const p = ""[Symbol.iterator]().__proto__;
+let x = Object.create(p);
+x.next = 42;
+
+assertTrue(%StringIteratorProtector());

implementation-contributed/v8/mjsunit/es6/string-iterator8.js

@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+assertTrue(%StringIteratorProtector());
+
+var proto = String.prototype;
+
+String.prototype = {};
+
+assertEquals(proto, String.prototype);
+assertTrue(%StringIteratorProtector());

implementation-contributed/v8/mjsunit/harmony/bigint/add.js

@@ -4,8 +4,6 @@
 
 // Generated by tools/bigint-tester.py.
 
-// Flags: --harmony-bigint
-
 var data = [{
   a: -0xc4043e2c4cc49e4d6870103ce7c2ff2d512bf4b1b67553ba410db514ee0af8888ad6cfn,
   b: 0x2aae86de73ff479133a657a40d26e8dcf192019c7421836615ec34978bad93n,

implementation-contributed/v8/mjsunit/harmony/bigint/and.js

@@ -4,8 +4,6 @@
 
 // Generated by tools/bigint-tester.py.
 
-// Flags: --harmony-bigint
-
 var data = [{
   a: 0x9252b94f220ded0c18706998886397699c5a25527575dn,
   b: -0x286817ba2e8fd8n,

implementation-contributed/v8/mjsunit/harmony/bigint/as-int-n.js

@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-bigint
-
 // BigInt.asIntN
 {
   assertEquals(2, BigInt.asIntN.length);

implementation-contributed/v8/mjsunit/harmony/bigint/basics.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --harmony-bigint
+// Flags: --allow-natives-syntax
 
 'use strict'
 

implementation-contributed/v8/mjsunit/harmony/bigint/comparisons.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --harmony-bigint
+// Flags: --allow-natives-syntax
 
 'use strict'
 

implementation-contributed/v8/mjsunit/harmony/bigint/dataview.js

@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-bigint
-
 var buffer = new ArrayBuffer(64);
 var dataview = new DataView(buffer, 8, 24);
 var bytes = new Uint8Array(buffer);

implementation-contributed/v8/mjsunit/harmony/bigint/dec.js

@@ -4,8 +4,6 @@
 
 // Generated by tools/bigint-tester.py.
 
-// Flags: --harmony-bigint
-
 var data = [{
   a: 0x26ffcdbd233a53e7ca4612f2b02e1f2c1d885c3177e7n,
   r: 0x26ffcdbd233a53e7ca4612f2b02e1f2c1d885c3177e6n

implementation-contributed/v8/mjsunit/harmony/bigint/div.js

@@ -4,8 +4,6 @@
 
 // Generated by tools/bigint-tester.py.
 
-// Flags: --harmony-bigint
-
 var data = [{
   a: -0x1e0f357314bac34227333c0c2086430dae88cb538f161174888591n,
   b: 0x390n,

implementation-contributed/v8/mjsunit/harmony/bigint/exp.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --harmony-bigint
+// Flags: --allow-natives-syntax
 
 assertEquals(1n, (-1n) ** 0n);
 assertEquals(-1n, (-1n) ** 1n);

implementation-contributed/v8/mjsunit/harmony/bigint/inc.js

@@ -4,8 +4,6 @@
 
 // Generated by tools/bigint-tester.py.
 
-// Flags: --harmony-bigint
-
 var data = [{
   a: 0xb3df90n,
   r: 0xb3df91n

implementation-contributed/v8/mjsunit/harmony/bigint/json.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --harmony-bigint
+// Flags: --allow-natives-syntax
 
 'use strict'
 

implementation-contributed/v8/mjsunit/harmony/bigint/mod.js

@@ -4,8 +4,6 @@
 
 // Generated by tools/bigint-tester.py.
 
-// Flags: --harmony-bigint
-
 var data = [{
   a: 0xaed3c714bb42a73d708bcf1dc9a9deebadc913ef42bac6a6178a60n,
   b: -0xf3d6bd1c059b79n,

implementation-contributed/v8/mjsunit/harmony/bigint/mul.js

@@ -4,8 +4,6 @@
 
 // Generated by tools/bigint-tester.py.
 
-// Flags: --harmony-bigint
-
 var data = [{
   a: 0x2bf1f236c2df29f7c99be052dfe1b69ae158d777fea487af889f6259f472c0n,
   b: -0xae0090dfn,

implementation-contributed/v8/mjsunit/harmony/bigint/neg.js

@@ -4,8 +4,6 @@
 
 // Generated by tools/bigint-tester.py.
 
-// Flags: --harmony-bigint
-
 var data = [{
   a: 0xcn,
   r: -0xcn

implementation-contributed/v8/mjsunit/harmony/bigint/not.js

@@ -4,8 +4,6 @@
 
 // Generated by tools/bigint-tester.py.
 
-// Flags: --harmony-bigint
-
 var data = [{
   a: 0x9f0305cd75e4n,
   r: -0x9f0305cd75e5n

implementation-contributed/v8/mjsunit/harmony/bigint/or.js

@@ -4,8 +4,6 @@
 
 // Generated by tools/bigint-tester.py.
 
-// Flags: --harmony-bigint
-
 var data = [{
   a: 0x77a87n,
   b: 0xde08e7433fb9584911b8cb4bc7eed802299b4489fc635974d063847da4e8b461df5dn,

implementation-contributed/v8/mjsunit/harmony/bigint/regress-tonumbercode.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --harmony-bigint
+// Flags: --allow-natives-syntax
 
 function f(x, b) {
     if (b) return Math.trunc(+(x))

implementation-contributed/v8/mjsunit/harmony/bigint/regressions.js

@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-bigint
-
 var a = 5n;
 var b = a / -1n;
 assertEquals(5n, a);

implementation-contributed/v8/mjsunit/harmony/bigint/sar.js

@@ -4,8 +4,6 @@
 
 // Generated by tools/bigint-tester.py.
 
-// Flags: --harmony-bigint
-
 var data = [{
   a: 0x211a34fn,
   b: 0xa6n,

implementation-contributed/v8/mjsunit/harmony/bigint/shl.js

@@ -4,8 +4,6 @@
 
 // Generated by tools/bigint-tester.py.
 
-// Flags: --harmony-bigint
-
 var data = [{
   a: -0xe813d76adc0a177778c0c232c595e8572b783210f4a7009d7c1787n,
   b: 0x9en,

implementation-contributed/v8/mjsunit/harmony/bigint/sub.js

@@ -4,8 +4,6 @@
 
 // Generated by tools/bigint-tester.py.
 
-// Flags: --harmony-bigint
-
 var data = [{
   a: 0xc4fd438551d58edn,
   b: 0x91b42ee55a50d974an,

implementation-contributed/v8/mjsunit/harmony/bigint/tonumber.js

@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-bigint
-
 function Check(bigint, number_string) {
   var number = Number(bigint);
   if (number_string.substring(0, 2) === "0x") {

implementation-contributed/v8/mjsunit/harmony/bigint/turbo.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --harmony-bigint
+// Flags: --allow-natives-syntax
 
 'use strict'
 

implementation-contributed/v8/mjsunit/harmony/bigint/typedarray.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-bigint --allow-natives-syntax
+// Flags: --allow-natives-syntax
 
 var intarray = new BigInt64Array(8);
 var uintarray = new BigUint64Array(8);

implementation-contributed/v8/mjsunit/harmony/bigint/xor.js

@@ -4,8 +4,6 @@
 
 // Generated by tools/bigint-tester.py.
 
-// Flags: --harmony-bigint
-
 var data = [{
   a: -0x46505bec40d461c595b5e4be178b7d00n,
   b: -0x9170e5437d4e3ec7c0971e2c6d3bbbd2929ff108ea4ee64f7a91aa367fn,

implementation-contributed/v8/mjsunit/harmony/bigintarray-keyedstore-tobigint.js

@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-bigint
-
 let TypedArrayConstructors = [
   BigUint64Array,
   BigInt64Array,

implementation-contributed/v8/mjsunit/harmony/function-tostring.js

@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-function-tostring
-
 var prefix = "/*before*/";
 var suffix = "/*after*/";
 

implementation-contributed/v8/mjsunit/regress/regress-707066.js

@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
-// Flags: --harmony-function-tostring
-
 // There was a bug in CreateDynamicFunction where a stack overflow
 // situation caused an assertion failure.
 

implementation-contributed/v8/mjsunit/regress/regress-8237.js

@@ -0,0 +1,57 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-always-opt
+// Files: test/mjsunit/code-coverage-utils.js
+
+%DebugToggleBlockCoverage(true);
+
+TestCoverage(
+"Repro for the bug",
+`
+function lib (n) {                        // 0000
+  if (n >= 0) {                           // 0050
+    if (n < 0) {                          // 0100
+      return;                             // 0150
+    }                                     // 0200
+  } else if (foo()) {                     // 0250
+  }                                       // 0300
+}                                         // 0350
+function foo () {                         // 0400
+  console.log('foo')                      // 0450
+  return false                            // 0500
+}                                         // 0550
+lib(1)                                    // 0600
+`,
+[{"start":0,"end":649,"count":1},
+{"start":0,"end":351,"count":1},
+{"start":115,"end":205,"count":0},
+{"start":253,"end":303,"count":0},
+{"start":400,"end":551,"count":0}]
+);
+
+TestCoverage(
+"Variant with omitted brackets",
+`
+function lib (n) {                        // 0000
+  if (n >= 0) {                           // 0050
+    if (n < 0)                            // 0100
+      return;                             // 0150
+  }                                       // 0200
+  else if (foo());                        // 0250
+}                                         // 0300
+function foo () {                         // 0350
+  console.log('foo')                      // 0400
+  return false                            // 0450
+}                                         // 0500
+lib(1)                                    // 0550
+`,
+[{"start":0,"end":599,"count":1},
+{"start":0,"end":301,"count":1},
+{"start":156,"end":163,"count":0},
+{"start":203,"end":268,"count":0},
+{"start":350,"end":501,"count":0}]
+);
+
+%DebugToggleBlockCoverage(false);

implementation-contributed/v8/mjsunit/regress/regress-890553.js

@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var s = "function __f_9(func, testName) {" +
+  "var __v_0 = function __f_10(__v_14, __v_14) {" +
+  "  return __v_16;" +
+  "}; " +
+"}"
+assertThrows(function() { eval(s); });

implementation-contributed/v8/mjsunit/regress/regress-crbug-890243.js

@@ -0,0 +1,27 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// We need a SpeculativeNumberAdd with Number feedback.
+function bar(x) { return x + x; }
+bar(0.1);
+
+// We also need an indirection via an object field such
+// that only after escape analysis TurboFan can figure
+// out that the value `y` is actually a Number in the
+// safe integer range.
+function baz(y) { return {y}; }
+baz(null); baz(0);
+
+// Now we can put all of that together to get a kRepBit
+// use of a kWord64 value (on 64-bit architectures).
+function foo(o) {
+  return !baz(bar(o.x)).y;
+}
+
+assertFalse(foo({x:1}));
+assertFalse(foo({x:1}));
+%OptimizeFunctionOnNextCall(foo);
+assertFalse(foo({x:1}));

implementation-contributed/v8/mjsunit/string-trim.js

@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-string-trimming
-
 assertEquals('trim',      String.prototype.trim.name);
 assertEquals('trimStart', String.prototype.trimStart.name);
 assertEquals('trimStart', String.prototype.trimLeft.name);

implementation-contributed/v8/test262/test262.status

@@ -364,9 +364,6 @@
   'language/global-code/script-decl-func-err-non-configurable': [FAIL],
   'language/global-code/script-decl-var-collision': [FAIL],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=4958
-  'built-ins/Function/prototype/toString/*': ['--harmony-function-tostring'],
-
   # https://bugs.chromium.org/p/v8/issues/detail?id=5116
   'built-ins/TypedArray/prototype/fill/fill-values-conversion-operations-consistent-nan': [PASS, FAIL],
 
@@ -564,26 +561,36 @@
   'intl402/Collator/ignore-invalid-unicode-ext-values': [SKIP],
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=7684
+  'intl402/Locale/constructor-non-iana-canon': [FAIL],
+  'intl402/Locale/constructor-options-language-valid': [FAIL],
+  'intl402/Locale/constructor-parse-twice': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=8246
+  'intl402/Locale/constructor-tag': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=8244
   'intl402/Locale/constructor-getter-order': [FAIL],
   'intl402/Locale/constructor-locale-object': [FAIL],
-  'intl402/Locale/constructor-non-iana-canon': [FAIL],
   'intl402/Locale/constructor-options-language-grandfathered': [FAIL],
   'intl402/Locale/constructor-options-language-invalid': [FAIL],
-  'intl402/Locale/constructor-options-language-valid': [FAIL],
   'intl402/Locale/constructor-options-region-invalid': [FAIL],
   'intl402/Locale/constructor-options-region-valid': [FAIL],
   'intl402/Locale/constructor-options-script-invalid': [FAIL],
   'intl402/Locale/constructor-options-script-valid': [FAIL],
-  'intl402/Locale/constructor-parse-twice': [FAIL],
-  'intl402/Locale/constructor-tag': [FAIL],
   'intl402/Locale/constructor-unicode-ext-invalid': [FAIL],
-  'intl402/Locale/extensions-grandfathered': [FAIL],
-  'intl402/Locale/extensions-private': [FAIL],
   'intl402/Locale/getters': [FAIL],
-  'intl402/Locale/getters-grandfathered': [FAIL],
-  'intl402/Locale/getters-privateuse': [FAIL],
   'intl402/Locale/invalid-tag-throws': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=8243
+  'intl402/Locale/extensions-private': [FAIL],
+  'intl402/Locale/getters-privateuse': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=8236
   'intl402/Locale/likely-subtags': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=8242
+  'intl402/Locale/extensions-grandfathered': [FAIL],
+  'intl402/Locale/getters-grandfathered': [FAIL],
   'intl402/Locale/likely-subtags-grandfathered': [FAIL],
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=6705

implementation-contributed/v8/test262/testcfg.py

@@ -42,7 +42,6 @@ from testrunner.outproc import test262
 
 # TODO(littledan): move the flag mapping into the status file
 FEATURE_FLAGS = {
-  'BigInt': '--harmony-bigint',
   'class-fields-public': '--harmony-public-fields',
   'class-static-fields-public': '--harmony-class-fields',
   'Array.prototype.flat': '--harmony-array-flat',