Merge pull request #1785 from test262-automation/v8-test262-automation-export-e69d65f39

Import test changes from V8

implementation-contributed/curation_logs/v8.json

@@ -1,5 +1,5 @@
 {
-  "sourceRevisionAtLastExport": "06354392",
+  "sourceRevisionAtLastExport": "1e6d9607",
-  "targetRevisionAtLastExport": "e69d65f39",
+  "targetRevisionAtLastExport": "eeae2a723",
   "curatedFiles": {}
 }

implementation-contributed/v8/mjsunit/compiler/abstract-equal-symbol.js

@@ -0,0 +1,135 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --noalways-opt
+
+// Known symbols abstract equality.
+(function() {
+  const a = Symbol("a");
+  const b = Symbol("b");
+
+  function foo() { return a == b; }
+
+  assertFalse(foo());
+  assertFalse(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo());
+})();
+
+// Known symbols abstract in-equality.
+(function() {
+  const a = Symbol("a");
+  const b = Symbol("b");
+
+  function foo() { return a != b; }
+
+  assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();
+
+// Known symbol on one side abstract equality.
+(function() {
+  const a = Symbol("a");
+  const b = Symbol("b");
+
+  function foo(a) { return a == b; }
+
+  // Warmup
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  assertOptimized(foo);
+
+  // Make optimized code bail out
+  assertFalse(foo("a"));
+  assertUnoptimized(foo);
+
+  // Make sure TurboFan learns the new feedback
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo("a"));
+  assertOptimized(foo);
+})();
+
+// Known symbol on one side abstract in-equality.
+(function() {
+  const a = Symbol("a");
+  const b = Symbol("b");
+
+  function foo(a) { return a != b; }
+
+  // Warmup
+  assertFalse(foo(b));
+  assertTrue(foo(a));
+  assertFalse(foo(b));
+  assertTrue(foo(a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(b));
+  assertTrue(foo(a));
+
+  // Make optimized code bail out
+  assertTrue(foo("a"));
+  assertUnoptimized(foo);
+
+  // Make sure TurboFan learns the new feedback
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo("a"));
+  assertOptimized(foo);
+})();
+
+// Feedback based symbol abstract equality.
+(function() {
+  const a = Symbol("a");
+  const b = Symbol("b");
+
+  function foo(a, b) { return a == b; }
+
+  // Warmup
+  assertTrue(foo(b, b));
+  assertFalse(foo(a, b));
+  assertTrue(foo(a, a));
+  assertFalse(foo(b, a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(a, a));
+  assertFalse(foo(b, a));
+
+  // Make optimized code bail out
+  assertFalse(foo("a", b));
+  assertUnoptimized(foo);
+
+  // Make sure TurboFan learns the new feedback
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo("a", b));
+  assertOptimized(foo);
+})();
+
+// Feedback based symbol abstract in-equality.
+(function() {
+  const a = Symbol("a");
+  const b = Symbol("b");
+
+  function foo(a, b) { return a != b; }
+
+  assertFalse(foo(b, b));
+  assertTrue(foo(a, b));
+  assertFalse(foo(a, a));
+  assertTrue(foo(b, a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(a, a));
+  assertTrue(foo(b, a));
+
+  // Make optimized code bail out
+  assertTrue(foo("a", b));
+  assertUnoptimized(foo);
+
+  // Make sure TurboFan learns the new feedback
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo("a", b));
+  assertOptimized(foo);
+})();

implementation-contributed/v8/mjsunit/compiler/array-buffer-is-view.js

@@ -0,0 +1,64 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that ObjectIsArrayBufferView lowering works correctly
+// in EffectControlLinearizer in the case that the input is
+// known to be a HeapObject by TurboFan. For this we use the
+// simple trick with an object literal whose field `x` will
+// only ever contain HeapObjects and so the representation
+// tracking is going to pick it up.
+(function() {
+  function foo(x) {
+    return ArrayBuffer.isView({x}.x);
+  }
+
+  assertFalse(foo(Symbol()));
+  assertFalse(foo("some string"));
+  assertFalse(foo(new Object()));
+  assertFalse(foo(new Array()));
+  assertFalse(foo(new ArrayBuffer(1)));
+  assertTrue(foo(new Int32Array(1)));
+  assertTrue(foo(new DataView(new ArrayBuffer(1))));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(Symbol()));
+  assertFalse(foo("some string"));
+  assertFalse(foo(new Object()));
+  assertFalse(foo(new Array()));
+  assertFalse(foo(new ArrayBuffer(1)));
+  assertTrue(foo(new Int32Array(1)));
+  assertTrue(foo(new DataView(new ArrayBuffer(1))));
+  assertOptimized(foo);
+})();
+
+// Test that ObjectIsArrayBufferView lowering works correctly
+// in EffectControlLinearizer in the case that the input is
+// some arbitrary tagged value.
+(function() {
+  function foo(x) {
+    return ArrayBuffer.isView(x);
+  }
+
+  assertFalse(foo(1));
+  assertFalse(foo(1.1));
+  assertFalse(foo(Symbol()));
+  assertFalse(foo("some string"));
+  assertFalse(foo(new Object()));
+  assertFalse(foo(new Array()));
+  assertFalse(foo(new ArrayBuffer(1)));
+  assertTrue(foo(new Int32Array(1)));
+  assertTrue(foo(new DataView(new ArrayBuffer(1))));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(1));
+  assertFalse(foo(1.1));
+  assertFalse(foo(Symbol()));
+  assertFalse(foo("some string"));
+  assertFalse(foo(new Object()));
+  assertFalse(foo(new Array()));
+  assertFalse(foo(new ArrayBuffer(1)));
+  assertTrue(foo(new Int32Array(1)));
+  assertTrue(foo(new DataView(new ArrayBuffer(1))));
+  assertOptimized(foo);
+})();

implementation-contributed/v8/mjsunit/compiler/array-is-array.js

@@ -0,0 +1,105 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Test JSObjectIsArray in JSTypedLowering for the case that the
+// input value is known to be an Array literal.
+(function() {
+  function foo() {
+    return Array.isArray([]);
+  }
+
+  assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();
+
+// Test JSObjectIsArray in JSTypedLowering for the case that the
+// input value is known to be a Proxy for an Array literal.
+(function() {
+  function foo() {
+    return Array.isArray(new Proxy([], {}));
+  }
+
+  assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();
+
+// Test JSObjectIsArray in JSTypedLowering for the case that the
+// input value is known to be an Object literal.
+(function() {
+  function foo() {
+    return Array.isArray({});
+  }
+
+  assertFalse(foo());
+  assertFalse(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo());
+})();
+
+// Test JSObjectIsArray in JSTypedLowering for the case that the
+// input value is known to be a Proxy for an Object literal.
+(function() {
+  function foo() {
+    return Array.isArray(new Proxy({}, {}));
+  }
+
+  assertFalse(foo());
+  assertFalse(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo());
+})();
+
+// Test JSObjectIsArray in JSTypedLowering for the case that
+// TurboFan doesn't know anything about the input value.
+(function() {
+  function foo(x) {
+    return Array.isArray(x);
+  }
+
+  assertFalse(foo({}));
+  assertFalse(foo(new Proxy({}, {})));
+  assertTrue(foo([]));
+  assertTrue(foo(new Proxy([], {})));
+  assertThrows(() => {
+    const {proxy, revoke} = Proxy.revocable([], {});
+    revoke();
+    foo(proxy);
+  }, TypeError);
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo({}));
+  assertFalse(foo(new Proxy({}, {})));
+  assertTrue(foo([]));
+  assertTrue(foo(new Proxy([], {})));
+  assertThrows(() => {
+    const {proxy, revoke} = Proxy.revocable([], {});
+    revoke();
+    foo(proxy);
+  }, TypeError);
+})();
+
+// Test JSObjectIsArray in JSTypedLowering for the case that
+// we pass a revoked proxy and catch the exception locally.
+(function() {
+  function foo(x) {
+    const {proxy, revoke} = Proxy.revocable(x, {});
+    revoke();
+    try {
+      return Array.isArray(proxy);
+    } catch (e) {
+      return e;
+    }
+  }
+
+  assertInstanceof(foo([]), TypeError);
+  assertInstanceof(foo({}), TypeError);
+  %OptimizeFunctionOnNextCall(foo);
+  assertInstanceof(foo([]), TypeError);
+  assertInstanceof(foo({}), TypeError);
+})();

implementation-contributed/v8/mjsunit/compiler/dataview-constant.js

@@ -0,0 +1,173 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Test DataView.prototype.getInt8()/setInt8() for constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setInt8(0, 42);
+  dv.setInt8(1, 24);
+
+  function foo(i) {
+    const x = dv.getInt8(i);
+    dv.setInt8(i, x+1);
+    return x;
+  }
+
+  assertEquals(42, foo(0));
+  assertEquals(24, foo(1));
+  assertEquals(43, foo(0));
+  assertEquals(25, foo(1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(0));
+  assertEquals(26, foo(1));
+})();
+
+// Test DataView.prototype.getUint8()/setUint8() for constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setUint8(0, 42);
+  dv.setUint8(1, 24);
+
+  function foo(i) {
+    const x = dv.getUint8(i);
+    dv.setUint8(i, x+1);
+    return x;
+  }
+
+  assertEquals(42, foo(0));
+  assertEquals(24, foo(1));
+  assertEquals(43, foo(0));
+  assertEquals(25, foo(1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(0));
+  assertEquals(26, foo(1));
+})();
+
+// Test DataView.prototype.getInt16()/setInt16() for constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setInt16(0, 42, true);
+  dv.setInt16(2, 24, true);
+
+  function foo(i) {
+    const x = dv.getInt16(i, true);
+    dv.setInt16(i, x+1, true);
+    return x;
+  }
+
+  assertEquals(42, foo(0));
+  assertEquals(24, foo(2));
+  assertEquals(43, foo(0));
+  assertEquals(25, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(0));
+  assertEquals(26, foo(2));
+})();
+
+// Test DataView.prototype.getUint16()/setUint16() for constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setUint16(0, 42, true);
+  dv.setUint16(2, 24, true);
+
+  function foo(i) {
+    const x = dv.getUint16(i, true);
+    dv.setUint16(i, x+1, true);
+    return x;
+  }
+
+  assertEquals(42, foo(0));
+  assertEquals(24, foo(2));
+  assertEquals(43, foo(0));
+  assertEquals(25, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(0));
+  assertEquals(26, foo(2));
+})();
+
+// Test DataView.prototype.getInt32()/setInt32() for constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setInt32(0, 42, true);
+  dv.setInt32(4, 24, true);
+
+  function foo(i) {
+    const x = dv.getInt32(i, true);
+    dv.setInt32(i, x+1, true);
+    return x;
+  }
+
+  assertEquals(42, foo(0));
+  assertEquals(24, foo(4));
+  assertEquals(43, foo(0));
+  assertEquals(25, foo(4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(0));
+  assertEquals(26, foo(4));
+})();
+
+// Test DataView.prototype.getUint32()/setUint32() for constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setUint32(0, 42, true);
+  dv.setUint32(4, 24, true);
+
+  function foo(i) {
+    const x = dv.getUint32(i, true);
+    dv.setUint32(i, x+1, true);
+    return x;
+  }
+
+  assertEquals(42, foo(0));
+  assertEquals(24, foo(4));
+  assertEquals(43, foo(0));
+  assertEquals(25, foo(4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(0));
+  assertEquals(26, foo(4));
+})();
+
+// Test DataView.prototype.getFloat32()/setFloat32() for constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setFloat32(0, 42, true);
+  dv.setFloat32(4, 24, true);
+
+  function foo(i) {
+    const x = dv.getFloat32(i, true);
+    dv.setFloat32(i, x+1, true);
+    return x;
+  }
+
+  assertEquals(42, foo(0));
+  assertEquals(24, foo(4));
+  assertEquals(43, foo(0));
+  assertEquals(25, foo(4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(0));
+  assertEquals(26, foo(4));
+})();
+
+// Test DataView.prototype.getFloat64()/setFloat64() for constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setFloat64(0, 42, true);
+  dv.setFloat64(8, 24, true);
+
+  function foo(i) {
+    const x = dv.getFloat64(i, true);
+    dv.setFloat64(i, x+1, true);
+    return x;
+  }
+
+  assertEquals(42, foo(0));
+  assertEquals(24, foo(8));
+  assertEquals(43, foo(0));
+  assertEquals(25, foo(8));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(0));
+  assertEquals(26, foo(8));
+})();

implementation-contributed/v8/mjsunit/compiler/dataview-neutered.js

@@ -0,0 +1,376 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --noalways-opt
+
+// Invalidate the neutering protector.
+%ArrayBufferNeuter(new ArrayBuffer(1));
+
+// Check DataView.prototype.getInt8() optimization.
+(function() {
+  const ab = new ArrayBuffer(1);
+  const dv = new DataView(ab);
+
+  function foo(dv) {
+    return dv.getInt8(0);
+  }
+
+  assertEquals(0, foo(dv));
+  assertEquals(0, foo(dv));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(dv));
+  assertOptimized(foo);
+  %ArrayBufferNeuter(ab);
+  assertThrows(() => foo(dv), TypeError);
+  assertUnoptimized(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.getUint8() optimization.
+(function() {
+  const ab = new ArrayBuffer(1);
+  const dv = new DataView(ab);
+
+  function foo(dv) {
+    return dv.getUint8(0);
+  }
+
+  assertEquals(0, foo(dv));
+  assertEquals(0, foo(dv));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(dv));
+  assertOptimized(foo);
+  %ArrayBufferNeuter(ab);
+  assertThrows(() => foo(dv), TypeError);
+  assertUnoptimized(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.getInt16() optimization.
+(function() {
+  const ab = new ArrayBuffer(2);
+  const dv = new DataView(ab);
+
+  function foo(dv) {
+    return dv.getInt16(0, true);
+  }
+
+  assertEquals(0, foo(dv));
+  assertEquals(0, foo(dv));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(dv));
+  assertOptimized(foo);
+  %ArrayBufferNeuter(ab);
+  assertThrows(() => foo(dv), TypeError);
+  assertUnoptimized(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.getUint16() optimization.
+(function() {
+  const ab = new ArrayBuffer(2);
+  const dv = new DataView(ab);
+
+  function foo(dv) {
+    return dv.getUint16(0, true);
+  }
+
+  assertEquals(0, foo(dv));
+  assertEquals(0, foo(dv));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(dv));
+  assertOptimized(foo);
+  %ArrayBufferNeuter(ab);
+  assertThrows(() => foo(dv), TypeError);
+  assertUnoptimized(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.getInt32() optimization.
+(function() {
+  const ab = new ArrayBuffer(4);
+  const dv = new DataView(ab);
+
+  function foo(dv) {
+    return dv.getInt32(0, true);
+  }
+
+  assertEquals(0, foo(dv));
+  assertEquals(0, foo(dv));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(dv));
+  assertOptimized(foo);
+  %ArrayBufferNeuter(ab);
+  assertThrows(() => foo(dv), TypeError);
+  assertUnoptimized(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.getUint32() optimization.
+(function() {
+  const ab = new ArrayBuffer(4);
+  const dv = new DataView(ab);
+
+  function foo(dv) {
+    return dv.getUint32(0, true);
+  }
+
+  assertEquals(0, foo(dv));
+  assertEquals(0, foo(dv));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(dv));
+  assertOptimized(foo);
+  %ArrayBufferNeuter(ab);
+  assertThrows(() => foo(dv), TypeError);
+  assertUnoptimized(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.getFloat32() optimization.
+(function() {
+  const ab = new ArrayBuffer(4);
+  const dv = new DataView(ab);
+
+  function foo(dv) {
+    return dv.getFloat32(0, true);
+  }
+
+  assertEquals(0, foo(dv));
+  assertEquals(0, foo(dv));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(dv));
+  assertOptimized(foo);
+  %ArrayBufferNeuter(ab);
+  assertThrows(() => foo(dv), TypeError);
+  assertUnoptimized(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.getFloat64() optimization.
+(function() {
+  const ab = new ArrayBuffer(8);
+  const dv = new DataView(ab);
+
+  function foo(dv) {
+    return dv.getFloat64(0, true);
+  }
+
+  assertEquals(0, foo(dv));
+  assertEquals(0, foo(dv));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(dv));
+  assertOptimized(foo);
+  %ArrayBufferNeuter(ab);
+  assertThrows(() => foo(dv), TypeError);
+  assertUnoptimized(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.setInt8() optimization.
+(function() {
+  const ab = new ArrayBuffer(1);
+  const dv = new DataView(ab);
+
+  function foo(dv, x) {
+    return dv.setInt8(0, x);
+  }
+
+  assertEquals(undefined, foo(dv, 1));
+  assertEquals(1, dv.getInt8(0));
+  assertEquals(undefined, foo(dv, 2));
+  assertEquals(2, dv.getInt8(0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(undefined, foo(dv, 3));
+  assertOptimized(foo);
+  %ArrayBufferNeuter(ab);
+  assertThrows(() => foo(dv, 4), TypeError);
+  assertUnoptimized(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv, 5), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.setUint8() optimization.
+(function() {
+  const ab = new ArrayBuffer(1);
+  const dv = new DataView(ab);
+
+  function foo(dv, x) {
+    return dv.setUint8(0, x);
+  }
+
+  assertEquals(undefined, foo(dv, 1));
+  assertEquals(1, dv.getUint8(0));
+  assertEquals(undefined, foo(dv, 2));
+  assertEquals(2, dv.getUint8(0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(undefined, foo(dv, 3));
+  assertOptimized(foo);
+  %ArrayBufferNeuter(ab);
+  assertThrows(() => foo(dv, 4), TypeError);
+  assertUnoptimized(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv, 5), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.setInt16() optimization.
+(function() {
+  const ab = new ArrayBuffer(2);
+  const dv = new DataView(ab);
+
+  function foo(dv, x) {
+    return dv.setInt16(0, x, true);
+  }
+
+  assertEquals(undefined, foo(dv, 1));
+  assertEquals(1, dv.getInt16(0, true));
+  assertEquals(undefined, foo(dv, 2));
+  assertEquals(2, dv.getInt16(0, true));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(undefined, foo(dv, 3));
+  assertOptimized(foo);
+  %ArrayBufferNeuter(ab);
+  assertThrows(() => foo(dv, 4), TypeError);
+  assertUnoptimized(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv, 5), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.setUint16() optimization.
+(function() {
+  const ab = new ArrayBuffer(2);
+  const dv = new DataView(ab);
+
+  function foo(dv, x) {
+    return dv.setUint16(0, x, true);
+  }
+
+  assertEquals(undefined, foo(dv, 1));
+  assertEquals(1, dv.getUint16(0, true));
+  assertEquals(undefined, foo(dv, 2));
+  assertEquals(2, dv.getUint16(0, true));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(undefined, foo(dv, 3));
+  assertOptimized(foo);
+  %ArrayBufferNeuter(ab);
+  assertThrows(() => foo(dv, 4), TypeError);
+  assertUnoptimized(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv, 5), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.setInt32() optimization.
+(function() {
+  const ab = new ArrayBuffer(4);
+  const dv = new DataView(ab);
+
+  function foo(dv, x) {
+    return dv.setInt32(0, x, true);
+  }
+
+  assertEquals(undefined, foo(dv, 1));
+  assertEquals(1, dv.getInt32(0, true));
+  assertEquals(undefined, foo(dv, 2));
+  assertEquals(2, dv.getInt32(0, true));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(undefined, foo(dv, 3));
+  assertOptimized(foo);
+  %ArrayBufferNeuter(ab);
+  assertThrows(() => foo(dv, 4), TypeError);
+  assertUnoptimized(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv, 5), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.setUint32() optimization.
+(function() {
+  const ab = new ArrayBuffer(4);
+  const dv = new DataView(ab);
+
+  function foo(dv, x) {
+    return dv.setUint32(0, x, true);
+  }
+
+  assertEquals(undefined, foo(dv, 1));
+  assertEquals(1, dv.getUint32(0, true));
+  assertEquals(undefined, foo(dv, 2));
+  assertEquals(2, dv.getUint32(0, true));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(undefined, foo(dv, 3));
+  assertOptimized(foo);
+  %ArrayBufferNeuter(ab);
+  assertThrows(() => foo(dv, 4), TypeError);
+  assertUnoptimized(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv, 5), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.setFloat32() optimization.
+(function() {
+  const ab = new ArrayBuffer(4);
+  const dv = new DataView(ab);
+
+  function foo(dv, x) {
+    return dv.setFloat32(0, x, true);
+  }
+
+  assertEquals(undefined, foo(dv, 1));
+  assertEquals(1, dv.getFloat32(0, true));
+  assertEquals(undefined, foo(dv, 2));
+  assertEquals(2, dv.getFloat32(0, true));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(undefined, foo(dv, 3));
+  assertOptimized(foo);
+  %ArrayBufferNeuter(ab);
+  assertThrows(() => foo(dv, 4), TypeError);
+  assertUnoptimized(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv, 5), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.setFloat64() optimization.
+(function() {
+  const ab = new ArrayBuffer(8);
+  const dv = new DataView(ab);
+
+  function foo(dv, x) {
+    return dv.setFloat64(0, x, true);
+  }
+
+  assertEquals(undefined, foo(dv, 1));
+  assertEquals(1, dv.getFloat64(0, true));
+  assertEquals(undefined, foo(dv, 2));
+  assertEquals(2, dv.getFloat64(0, true));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(undefined, foo(dv, 3));
+  assertOptimized(foo);
+  %ArrayBufferNeuter(ab);
+  assertThrows(() => foo(dv, 4), TypeError);
+  assertUnoptimized(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv, 5), TypeError);
+  assertOptimized(foo);
+})();

implementation-contributed/v8/mjsunit/compiler/dataview-nonconstant.js

@@ -0,0 +1,173 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Test DataView.prototype.getInt8()/setInt8() for non-constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setInt8(0, 42);
+  dv.setInt8(1, 24);
+
+  function foo(dv, i) {
+    const x = dv.getInt8(i);
+    dv.setInt8(i, x+1);
+    return x;
+  }
+
+  assertEquals(42, foo(dv, 0));
+  assertEquals(24, foo(dv, 1));
+  assertEquals(43, foo(dv, 0));
+  assertEquals(25, foo(dv, 1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(dv, 0));
+  assertEquals(26, foo(dv, 1));
+})();
+
+// Test DataView.prototype.getUint8()/setUint8() for non-constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setUint8(0, 42);
+  dv.setUint8(1, 24);
+
+  function foo(dv, i) {
+    const x = dv.getUint8(i);
+    dv.setUint8(i, x+1);
+    return x;
+  }
+
+  assertEquals(42, foo(dv, 0));
+  assertEquals(24, foo(dv, 1));
+  assertEquals(43, foo(dv, 0));
+  assertEquals(25, foo(dv, 1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(dv, 0));
+  assertEquals(26, foo(dv, 1));
+})();
+
+// Test DataView.prototype.getInt16()/setInt16() for non-constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setInt16(0, 42, true);
+  dv.setInt16(2, 24, true);
+
+  function foo(dv, i) {
+    const x = dv.getInt16(i, true);
+    dv.setInt16(i, x+1, true);
+    return x;
+  }
+
+  assertEquals(42, foo(dv, 0));
+  assertEquals(24, foo(dv, 2));
+  assertEquals(43, foo(dv, 0));
+  assertEquals(25, foo(dv, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(dv, 0));
+  assertEquals(26, foo(dv, 2));
+})();
+
+// Test DataView.prototype.getUint16()/setUint16() for non-constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setUint16(0, 42, true);
+  dv.setUint16(2, 24, true);
+
+  function foo(dv, i) {
+    const x = dv.getUint16(i, true);
+    dv.setUint16(i, x+1, true);
+    return x;
+  }
+
+  assertEquals(42, foo(dv, 0));
+  assertEquals(24, foo(dv, 2));
+  assertEquals(43, foo(dv, 0));
+  assertEquals(25, foo(dv, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(dv, 0));
+  assertEquals(26, foo(dv, 2));
+})();
+
+// Test DataView.prototype.getInt32()/setInt32() for non-constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setInt32(0, 42, true);
+  dv.setInt32(4, 24, true);
+
+  function foo(dv, i) {
+    const x = dv.getInt32(i, true);
+    dv.setInt32(i, x+1, true);
+    return x;
+  }
+
+  assertEquals(42, foo(dv, 0));
+  assertEquals(24, foo(dv, 4));
+  assertEquals(43, foo(dv, 0));
+  assertEquals(25, foo(dv, 4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(dv, 0));
+  assertEquals(26, foo(dv, 4));
+})();
+
+// Test DataView.prototype.getUint32()/setUint32() for non-constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setUint32(0, 42, true);
+  dv.setUint32(4, 24, true);
+
+  function foo(dv, i) {
+    const x = dv.getUint32(i, true);
+    dv.setUint32(i, x+1, true);
+    return x;
+  }
+
+  assertEquals(42, foo(dv, 0));
+  assertEquals(24, foo(dv, 4));
+  assertEquals(43, foo(dv, 0));
+  assertEquals(25, foo(dv, 4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(dv, 0));
+  assertEquals(26, foo(dv, 4));
+})();
+
+// Test DataView.prototype.getFloat32()/setFloat32() for non-constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setFloat32(0, 42, true);
+  dv.setFloat32(4, 24, true);
+
+  function foo(dv, i) {
+    const x = dv.getFloat32(i, true);
+    dv.setFloat32(i, x+1, true);
+    return x;
+  }
+
+  assertEquals(42, foo(dv, 0));
+  assertEquals(24, foo(dv, 4));
+  assertEquals(43, foo(dv, 0));
+  assertEquals(25, foo(dv, 4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(dv, 0));
+  assertEquals(26, foo(dv, 4));
+})();
+
+// Test DataView.prototype.getFloat64()/setFloat64() for non-constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setFloat64(0, 42, true);
+  dv.setFloat64(8, 24, true);
+
+  function foo(dv, i) {
+    const x = dv.getFloat64(i, true);
+    dv.setFloat64(i, x+1, true);
+    return x;
+  }
+
+  assertEquals(42, foo(dv, 0));
+  assertEquals(24, foo(dv, 8));
+  assertEquals(43, foo(dv, 0));
+  assertEquals(25, foo(dv, 8));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(dv, 0));
+  assertEquals(26, foo(dv, 8));
+})();

implementation-contributed/v8/mjsunit/compiler/math-imul.js

@@ -0,0 +1,76 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test Math.imul() with no inputs.
+(function() {
+  function foo() { return Math.imul(); }
+
+  assertEquals(0, foo());
+  assertEquals(0, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo());
+})();
+
+// Test Math.imul() with only one input.
+(function() {
+  function foo(x) { return Math.imul(x); }
+
+  assertEquals(0, foo(1));
+  assertEquals(0, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(3));
+})();
+
+// Test Math.imul() with wrong types.
+(function() {
+  function foo(x, y) { return Math.imul(x, y); }
+
+  assertEquals(0, foo(null, 1));
+  assertEquals(0, foo(2, undefined));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(null, 1));
+  assertEquals(0, foo(2, undefined));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(null, 1));
+  assertEquals(0, foo(2, undefined));
+  assertOptimized(foo);
+})();
+
+// Test Math.imul() with signed integers (statically known).
+(function() {
+  function foo(x, y) { return Math.imul(x|0, y|0); }
+
+  assertEquals(1, foo(1, 1));
+  assertEquals(2, foo(2, 1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(1, 1));
+  assertEquals(2, foo(2, 1));
+  assertOptimized(foo);
+})();
+
+// Test Math.imul() with unsigned integers (statically known).
+(function() {
+  function foo(x, y) { return Math.imul(x>>>0, y>>>0); }
+
+  assertEquals(1, foo(1, 1));
+  assertEquals(2, foo(2, 1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(1, 1));
+  assertEquals(2, foo(2, 1));
+  assertOptimized(foo);
+})();
+
+// Test Math.imul() with floating-point numbers.
+(function() {
+  function foo(x, y) { return Math.imul(x, y); }
+
+  assertEquals(1, foo(1.1, 1.1));
+  assertEquals(2, foo(2.1, 1.1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(1.1, 1.1));
+  assertEquals(2, foo(2.1, 1.1));
+  assertOptimized(foo);
+})();

implementation-contributed/v8/mjsunit/compiler/number-add.js

@@ -31,3 +31,32 @@
   %OptimizeFunctionOnNextCall(bar);
   assertEquals(2, bar(3));
 })();
+
+// This tests that SpeculativeNumberAdd can still lower to
+// Int32Add in SimplifiedLowering, which requires some magic
+// to make sure that SpeculativeNumberAdd survives to that
+// point, especially the JSTypedLowering needs to be unable
+// to tell that the inputs to SpeculativeNumberAdd are non
+// String primitives.
+(function() {
+  // We need a function that has a + with feedback Number or
+  // NumberOrOddball, but for whose inputs the JSTypedLowering
+  // cannot reduce it to NumberAdd (with SpeculativeToNumber
+  // conversions). We achieve this utilizing an object literal
+  // indirection here.
+  function baz(x) {
+    return {x}.x + x;
+  }
+  baz(null);
+  baz(undefined);
+
+  // Now we just need to truncate the result.
+  function foo(x) {
+    return baz(1) | 0;
+  }
+
+  assertEquals(2, foo());
+  assertEquals(2, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo());
+})();

implementation-contributed/v8/mjsunit/compiler/number-divide.js

@@ -0,0 +1,207 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --noalways-opt
+
+// Test that NumberDivide with Number feedback works if only in the
+// end SimplifiedLowering figures out that the inputs to this operation
+// are actually Unsigned32.
+(function() {
+  // We need a separately polluted % with NumberOrOddball feedback.
+  function bar(x) { return x / 2; }
+  bar(undefined);  // The % feedback is now NumberOrOddball.
+
+  // Now just use the gadget above in a way that only after RETYPE
+  // in SimplifiedLowering we find out that the `x` is actually in
+  // Unsigned32 range (based on taking the SignedSmall feedback on
+  // the + operator).
+  function foo(x) {
+    x = (x >>> 0) + 1;
+    return bar(x) | 0;
+  }
+
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(2));
+  assertEquals(2, foo(3));
+  assertEquals(2, foo(4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(2));
+  assertEquals(2, foo(3));
+  assertEquals(2, foo(4));
+  assertOptimized(foo);
+})();
+
+// Test that NumberDivide with Number feedback works if only in the
+// end SimplifiedLowering figures out that the inputs to this operation
+// are actually Signed32.
+(function() {
+  // We need a separately polluted % with NumberOrOddball feedback.
+  function bar(x) { return x / 2; }
+  bar(undefined);  // The % feedback is now NumberOrOddball.
+
+  // Now just use the gadget above in a way that only after RETYPE
+  // in SimplifiedLowering we find out that the `x` is actually in
+  // Signed32 range (based on taking the SignedSmall feedback on
+  // the + operator).
+  function foo(x) {
+    x = (x | 0) + 1;
+    return bar(x) | 0;
+  }
+
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(2));
+  assertEquals(2, foo(3));
+  assertEquals(2, foo(4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(2));
+  assertEquals(2, foo(3));
+  assertEquals(2, foo(4));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberDivide turns into CheckedInt32Div, and
+// that the "known power of two divisor" optimization works correctly.
+(function() {
+  function foo(x) { return (x | 0) / 2; }
+
+  // Warmup with proper int32 divisions.
+  assertEquals(1, foo(2));
+  assertEquals(2, foo(4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo(6));
+  assertOptimized(foo);
+
+  // Make optimized code fail.
+  assertEquals(0.5, foo(1));
+  assertUnoptimized(foo);
+
+  // Try again with the new feedback, and now it should stay optimized.
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(4, foo(8));
+  assertOptimized(foo);
+  assertEquals(0.5, foo(1));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberDivide turns into CheckedInt32Div, and
+// that the optimized code properly bails out on "division by zero".
+(function() {
+  function foo(x, y) { return x / y; }
+
+  // Warmup with proper int32 divisions.
+  assertEquals(2, foo(4, 2));
+  assertEquals(2, foo(8, 4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(2, 2));
+  assertOptimized(foo);
+
+  // Make optimized code fail.
+  assertEquals(Infinity, foo(1, 0));
+  assertUnoptimized(foo);
+
+  // Try again with the new feedback, and now it should stay optimized.
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(2, 1));
+  assertOptimized(foo);
+  assertEquals(Infinity, foo(1, 0));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberDivide turns into CheckedInt32Div, and
+// that the optimized code properly bails out on minus zero.
+(function() {
+  function foo(x, y) { return x / y; }
+
+  // Warmup with proper int32 divisions.
+  assertEquals(2, foo(4, 2));
+  assertEquals(2, foo(8, 4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(2, 2));
+  assertOptimized(foo);
+
+  // Make optimized code fail.
+  assertEquals(-0, foo(0, -1));
+  assertUnoptimized(foo);
+
+  // Try again with the new feedback, and now it should stay optimized.
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(2, 1));
+  assertOptimized(foo);
+  assertEquals(-0, foo(0, -1));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberDivide turns into CheckedInt32Div, and
+// that the optimized code properly bails out if result is -kMinInt.
+(function() {
+  function foo(x, y) { return x / y; }
+
+  // Warmup with proper int32 divisions.
+  assertEquals(2, foo(4, 2));
+  assertEquals(2, foo(8, 4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(2, 2));
+  assertOptimized(foo);
+
+  // Make optimized code fail.
+  assertEquals(2147483648, foo(-2147483648, -1));
+  assertUnoptimized(foo);
+
+  // Try again with the new feedback, and now it should stay optimized.
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(2, 1));
+  assertOptimized(foo);
+  assertEquals(2147483648, foo(-2147483648, -1));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberDivide turns into CheckedUint32Div, and
+// that the "known power of two divisor" optimization works correctly.
+(function() {
+  function foo(s) { return s.length / 2; }
+
+  // Warmup with proper uint32 divisions.
+  assertEquals(1, foo("ab".repeat(1)));
+  assertEquals(2, foo("ab".repeat(2)));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo("ab".repeat(3)));
+  assertOptimized(foo);
+
+  // Make optimized code fail.
+  assertEquals(0.5, foo("a"));
+  assertUnoptimized(foo);
+
+  // Try again with the new feedback, and now it should stay optimized.
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(4, foo("ab".repeat(4)));
+  assertOptimized(foo);
+  assertEquals(0.5, foo("a"));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberDivide turns into CheckedUint32Div, and
+// that the optimized code properly bails out on "division by zero".
+(function() {
+  function foo(x, y) { return (x >>> 0) / (y >>> 0); }
+
+  // Warmup with proper uint32 divisions.
+  assertEquals(2, foo(4, 2));
+  assertEquals(2, foo(8, 4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(2, 2));
+  assertOptimized(foo);
+
+  // Make optimized code fail.
+  assertEquals(Infinity, foo(1, 0));
+  assertUnoptimized(foo);
+
+  // Try again with the new feedback, and now it should stay optimized.
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(2, 1));
+  assertOptimized(foo);
+  assertEquals(Infinity, foo(1, 0));
+  assertOptimized(foo);
+})();

implementation-contributed/v8/mjsunit/compiler/number-issafeinteger.js

@@ -40,11 +40,19 @@ function test(f) {
   assertFalse(f(2 * near_lower - 7));
 }
 
-function f(x) {
+// Check that the NumberIsSafeInteger simplified operator in
-  return Number.isSafeInteger(+x);
+// TurboFan does the right thing.
-}
+function NumberIsSafeInteger(x) { return Number.isSafeInteger(+x); }
+test(NumberIsSafeInteger);
+test(NumberIsSafeInteger);
+%OptimizeFunctionOnNextCall(NumberIsSafeInteger);
+test(NumberIsSafeInteger);
 
-test(f);
+// Check that the ObjectIsSafeInteger simplified operator in
-test(f);
+// TurboFan does the right thing as well (i.e. when TurboFan
-%OptimizeFunctionOnNextCall(f);
+// is not able to tell statically that the inputs are numbers).
-test(f);
+function ObjectIsSafeInteger(x) { return Number.isSafeInteger(x); }
+test(ObjectIsSafeInteger);
+test(ObjectIsSafeInteger);
+%OptimizeFunctionOnNextCall(ObjectIsSafeInteger);
+test(ObjectIsSafeInteger);

implementation-contributed/v8/mjsunit/compiler/number-modulus.js

@@ -0,0 +1,125 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberModulus with Number feedback works if only in the
+// end SimplifiedLowering figures out that the inputs to this operation
+// are actually Unsigned32.
+(function() {
+  // We need a separately polluted % with NumberOrOddball feedback.
+  function bar(x) { return x % 2; }
+  bar(undefined);  // The % feedback is now NumberOrOddball.
+
+  // Now just use the gadget above in a way that only after RETYPE
+  // in SimplifiedLowering we find out that the `x` is actually in
+  // Unsigned32 range (based on taking the SignedSmall feedback on
+  // the + operator).
+  function foo(x) {
+    x = (x >>> 0) + 1;
+    return bar(x) | 0;
+  }
+
+  assertEquals(0, foo(1));
+  assertEquals(1, foo(2));
+  assertEquals(0, foo(3));
+  assertEquals(1, foo(4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(1));
+  assertEquals(1, foo(2));
+  assertEquals(0, foo(3));
+  assertEquals(1, foo(4));
+  assertOptimized(foo);
+})();
+
+// Test that NumberModulus with Number feedback works if only in the
+// end SimplifiedLowering figures out that the inputs to this operation
+// are actually Signed32.
+(function() {
+  // We need a separately polluted % with NumberOrOddball feedback.
+  function bar(x) { return x % 2; }
+  bar(undefined);  // The % feedback is now NumberOrOddball.
+
+  // Now just use the gadget above in a way that only after RETYPE
+  // in SimplifiedLowering we find out that the `x` is actually in
+  // Signed32 range (based on taking the SignedSmall feedback on
+  // the + operator).
+  function foo(x) {
+    x = (x | 0) + 1;
+    return bar(x) | 0;
+  }
+
+  assertEquals(0, foo(1));
+  assertEquals(1, foo(2));
+  assertEquals(0, foo(3));
+  assertEquals(1, foo(4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(1));
+  assertEquals(1, foo(2));
+  assertEquals(0, foo(3));
+  assertEquals(1, foo(4));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberModulus with Number feedback works if
+// only in the end SimplifiedLowering figures out that the inputs to
+// this operation are actually Unsigned32.
+(function() {
+  // We need to use an object literal here to make sure that the
+  // SpeculativeNumberModulus is not turned into a NumberModulus
+  // early during JSTypedLowering.
+  function bar(x) { return {x}.x % 2; }
+  bar(undefined);  // The % feedback is now NumberOrOddball.
+
+  // Now just use the gadget above in a way that only after RETYPE
+  // in SimplifiedLowering we find out that the `x` is actually in
+  // Unsigned32 range (based on taking the SignedSmall feedback on
+  // the + operator).
+  function foo(x) {
+    x = (x >>> 0) + 1;
+    return bar(x) | 0;
+  }
+
+  assertEquals(0, foo(1));
+  assertEquals(1, foo(2));
+  assertEquals(0, foo(3));
+  assertEquals(1, foo(4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(1));
+  assertEquals(1, foo(2));
+  assertEquals(0, foo(3));
+  assertEquals(1, foo(4));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberModulus with Number feedback works if
+// only in the end SimplifiedLowering figures out that the inputs to
+// this operation are actually Signed32.
+(function() {
+  // We need to use an object literal here to make sure that the
+  // SpeculativeNumberModulus is not turned into a NumberModulus
+  // early during JSTypedLowering.
+  function bar(x) { return {x}.x % 2; }
+  bar(undefined);  // The % feedback is now NumberOrOddball.
+
+  // Now just use the gadget above in a way that only after RETYPE
+  // in SimplifiedLowering we find out that the `x` is actually in
+  // Signed32 range (based on taking the SignedSmall feedback on
+  // the + operator).
+  function foo(x) {
+    x = (x | 0) + 1;
+    return bar(x) | 0;
+  }
+
+  assertEquals(0, foo(1));
+  assertEquals(1, foo(2));
+  assertEquals(0, foo(3));
+  assertEquals(1, foo(4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(1));
+  assertEquals(1, foo(2));
+  assertEquals(0, foo(3));
+  assertEquals(1, foo(4));
+  assertOptimized(foo);
+})();

implementation-contributed/v8/mjsunit/compiler/number-subtract.js

@@ -0,0 +1,34 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// This tests that SpeculativeNumberSubtract can still lower to
+// Int32Sub in SimplifiedLowering, which requires some magic
+// to make sure that SpeculativeNumberSubtract survives to that
+// point, especially the JSTypedLowering needs to be unable
+// to tell that the inputs to SpeculativeNumberAdd are not
+// Number, Undefined, Null or Boolean.
+(function() {
+  // We need a function that has a - with feedback Number or
+  // NumberOrOddball, but for whose inputs the JSTypedLowering
+  // cannot reduce it to NumberSubtract (with SpeculativeToNumber
+  // conversions). We achieve this utilizing an object literal
+  // indirection here.
+  function baz(x) {
+    return {x}.x - x;
+  }
+  baz(null);
+  baz(undefined);
+
+  // Now we just need to truncate the result.
+  function foo(x) {
+    return baz(42) | 0;
+  }
+
+  assertEquals(0, foo());
+  assertEquals(0, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo());
+})();

implementation-contributed/v8/mjsunit/compiler/redundancy-elimination.js

@@ -0,0 +1,134 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Test the RedundancyElimination::ReduceSpeculativeNumberOperation()
+// TurboFan optimization for the case of SpeculativeNumberAdd with
+// Number feedback.
+(function() {
+  function bar(i) {
+    return ++i;
+  }
+  bar(0.1);
+
+  function foo(a, i) {
+    const x = a[i];
+    const y = a[bar(i)];
+    return x + y;
+  }
+
+  assertEquals(3, foo([1, 2], 0));
+  assertEquals(3, foo([1, 2], 0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo([1, 2], 0));
+})();
+
+// Test the RedundancyElimination::ReduceSpeculativeNumberOperation()
+// TurboFan optimization for the case of SpeculativeNumberAdd with
+// NumberOrOddball feedback.
+(function() {
+  function bar(i) {
+    return ++i;
+  }
+  assertEquals(NaN, bar(undefined));
+
+  function foo(a, i) {
+    const x = a[i];
+    const y = a[bar(i)];
+    return x + y;
+  }
+
+  assertEquals(3, foo([1, 2], 0));
+  assertEquals(3, foo([1, 2], 0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo([1, 2], 0));
+})();
+
+// Test the RedundancyElimination::ReduceSpeculativeNumberOperation()
+// TurboFan optimization for the case of SpeculativeNumberSubtract with
+// Number feedback.
+(function() {
+  function bar(i) {
+    return --i;
+  }
+  assertEquals(-0.9, bar(0.1));
+
+  function foo(a, i) {
+    const x = a[i];
+    const y = a[bar(i)];
+    return x + y;
+  }
+
+  assertEquals(3, foo([1, 2], 1));
+  assertEquals(3, foo([1, 2], 1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo([1, 2], 1));
+})();
+
+// Test the RedundancyElimination::ReduceSpeculativeNumberOperation()
+// TurboFan optimization for the case of SpeculativeNumberSubtract with
+// NumberOrOddball feedback.
+(function() {
+  function bar(i) {
+    return --i;
+  }
+  assertEquals(NaN, bar(undefined));
+
+  function foo(a, i) {
+    const x = a[i];
+    const y = a[bar(i)];
+    return x + y;
+  }
+
+  assertEquals(3, foo([1, 2], 1));
+  assertEquals(3, foo([1, 2], 1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo([1, 2], 1));
+})();
+
+// Test the RedundancyElimination::ReduceSpeculativeNumberOperation()
+// TurboFan optimization for the case of SpeculativeToNumber.
+(function() {
+  function foo(a, i) {
+    const x = a[i];
+    const y = i++;
+    return x + y;
+  }
+
+  assertEquals(1, foo([1, 2], 0));
+  assertEquals(1, foo([1, 2], 0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo([1, 2], 0));
+})();
+
+// Test the RedundancyElimination::ReduceSpeculativeNumberOperation()
+// TurboFan optimization for the case of SpeculativeSafeIntegerAdd.
+(function() {
+  function foo(a, i) {
+    const x = a[i];
+    const y = a[++i];
+    return x + y;
+  }
+
+  assertEquals(3, foo([1, 2], 0));
+  assertEquals(3, foo([1, 2], 0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo([1, 2], 0));
+})();
+
+// Test the RedundancyElimination::ReduceSpeculativeNumberOperation()
+// TurboFan optimization for the case of SpeculativeSafeIntegerSubtract.
+(function() {
+  function foo(a, i) {
+    const x = a[i];
+    const y = a[--i];
+    return x + y;
+  }
+
+  assertEquals(3, foo([1, 2], 1));
+  assertEquals(3, foo([1, 2], 1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo([1, 2], 1));
+})();

implementation-contributed/v8/mjsunit/d8/d8-worker-script.js

@@ -0,0 +1,39 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Verify that the Worker constrcutor by default treats its first argument
+// as the filename of a script load and run.
+
+// Resources: test/mjsunit/d8/d8-worker-script.txt
+
+if (this.Worker) {
+  var w = new Worker('test/mjsunit/d8/d8-worker-script.txt');
+  assertEquals("Starting worker", w.getMessage());
+  w.postMessage("");
+  assertEquals("DONE", w.getMessage());
+  w.terminate();
+}

implementation-contributed/v8/mjsunit/d8/d8-worker-script.txt

@@ -0,0 +1,8 @@
+// Worker script used by d8-worker-script.js.
+// This file is named `.txt` to prevent it being treated as a test itself.
+
+onmessage = function(m) {
+  postMessage('DONE');
+}
+
+postMessage('Starting worker');

implementation-contributed/v8/mjsunit/d8/d8-worker-sharedarraybuffer.js

@@ -45,7 +45,7 @@ if (this.Worker) {
         Atomics.store(ta, 0, 100);
       };`;
 
-    var w = new Worker(workerScript);
+    var w = new Worker(workerScript, {type: 'string'});
 
     var sab = new SharedArrayBuffer(16);
     var ta = new Uint32Array(sab);
@@ -84,7 +84,7 @@ if (this.Worker) {
     var id;
     var workers = [];
     for (id = 0; id < 4; ++id) {
-      workers[id] = new Worker(workerScript);
+      workers[id] = new Worker(workerScript, {type: 'string'});
       workers[id].postMessage({sab: sab, id: id});
     }
 

implementation-contributed/v8/mjsunit/d8/d8-worker-spawn-worker.js

@@ -27,14 +27,14 @@
 
 if (this.Worker) {
   var workerScript =
-    `var w = new Worker('postMessage(42)');
+    `var w = new Worker('postMessage(42)', {type: 'string'});
      onmessage = function(parentMsg) {
        w.postMessage(parentMsg);
        var childMsg = w.getMessage();
        postMessage(childMsg);
      };`;
 
-  var w = new Worker(workerScript);
+  var w = new Worker(workerScript, {type: 'string'});
   w.postMessage(9);
   assertEquals(42, w.getMessage());
 }

implementation-contributed/v8/mjsunit/d8/d8-worker.js

@@ -97,7 +97,21 @@ if (this.Worker) {
     return ab;
   }
 
-  var w = new Worker(workerScript);
+  assertThrows(function() {
+    // Second arg must be 'options' object
+    new Worker(workerScript, 123);
+  });
+
+  assertThrows(function() {
+    new Worker('test/mjsunit/d8/d8-worker.js', {type: 'invalid'});
+  });
+
+  assertThrows(function() {
+    // worker type defaults to 'classic' which tries to load from file
+    new Worker(workerScript);
+  });
+
+  var w = new Worker(workerScript, {type: 'string'});
 
   assertEquals("Starting worker", w.getMessage());
 
@@ -140,6 +154,12 @@ if (this.Worker) {
   w.postMessage(ab2, [ab2]);
   assertEquals(0, ab2.byteLength);  // ArrayBuffer should be neutered.
 
+  // Attempting to transfer the same ArrayBuffer twice should throw.
+  assertThrows(function() {
+    var ab3 = createArrayBuffer(4);
+    w.postMessage(ab3, [ab3, ab3]);
+  });
+
   assertEquals("undefined", typeof foo);
 
   // Read a message from the worker.
@@ -150,7 +170,7 @@ if (this.Worker) {
 
   // Make sure that the main thread doesn't block forever in getMessage() if
   // the worker dies without posting a message.
-  var w2 = new Worker('');
+  var w2 = new Worker('', {type: 'string'});
   var msg = w2.getMessage();
   assertEquals(undefined, msg);
 }

implementation-contributed/v8/mjsunit/harmony/atomics-notify.js

@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --harmony-sharedarraybuffer
+
+// This test needs to be killed if we remove Atomics.wake.
+assertNotSame(Atomics.wake, Atomics.notify);

implementation-contributed/v8/mjsunit/harmony/atomics-value-check.js

@@ -12,7 +12,7 @@ var workerScript =
       `onmessage=function(msg) {
          postMessage(0);
        };`;
-var worker = new Worker(workerScript);
+var worker = new Worker(workerScript, {type: 'string'});
 
 var value_obj = {
   valueOf: function() {worker.postMessage({sab:sab}, [sta.buffer]);

implementation-contributed/v8/mjsunit/harmony/bigint/comparisons.js

@@ -297,18 +297,6 @@ const six = BigInt(6);
   assertTrue(Reflect.defineProperty(obj, 'foo', {value: zero}));
   assertTrue(Reflect.defineProperty(obj, 'foo', {value: another_zero}));
   assertFalse(Reflect.defineProperty(obj, 'foo', {value: one}));
-}{
-  assertTrue(%SameValue(zero, zero));
-  assertTrue(%SameValue(zero, another_zero));
-
-  assertFalse(%SameValue(zero, +0));
-  assertFalse(%SameValue(zero, -0));
-
-  assertFalse(%SameValue(+0, zero));
-  assertFalse(%SameValue(-0, zero));
-
-  assertTrue(%SameValue(one, one));
-  assertTrue(%SameValue(one, another_one));
 }
 
 // SameValueZero
@@ -351,18 +339,6 @@ const six = BigInt(6);
 
   assertTrue(new Map([[one, 42]]).has(one));
   assertTrue(new Map([[one, 42]]).has(another_one));
-}{
-  assertTrue(%SameValueZero(zero, zero));
-  assertTrue(%SameValueZero(zero, another_zero));
-
-  assertFalse(%SameValueZero(zero, +0));
-  assertFalse(%SameValueZero(zero, -0));
-
-  assertFalse(%SameValueZero(+0, zero));
-  assertFalse(%SameValueZero(-0, zero));
-
-  assertTrue(%SameValueZero(one, one));
-  assertTrue(%SameValueZero(one, another_one));
 }
 
 // Abstract comparison

implementation-contributed/v8/mjsunit/harmony/futex.js

@@ -133,7 +133,7 @@ if (this.Worker) {
          postMessage(result);
        };`;
 
-    var worker = new Worker(workerScript);
+    var worker = new Worker(workerScript, {type: 'string'});
     worker.postMessage({sab: sab, offset: offset});
 
     // Spin until the worker is waiting on the futex.
@@ -143,7 +143,7 @@ if (this.Worker) {
     assertEquals("ok", worker.getMessage());
     worker.terminate();
 
-    var worker2 = new Worker(workerScript);
+    var worker2 = new Worker(workerScript, {type: 'string'});
     var offset = 8;
     var i32a2 = new Int32Array(sab, offset);
     worker2.postMessage({sab: sab, offset: offset});
@@ -156,7 +156,7 @@ if (this.Worker) {
 
     // Futex should work when index and buffer views are different, but
     // the real address is the same.
-    var worker3 = new Worker(workerScript);
+    var worker3 = new Worker(workerScript, {type: 'string'});
     i32a2 = new Int32Array(sab, 4);
     worker3.postMessage({sab: sab, offset: 8});
 
@@ -205,7 +205,7 @@ if (this.Worker) {
     var id;
     var workers = [];
     for (id = 0; id < 4; id++) {
-      workers[id] = new Worker(workerScript);
+      workers[id] = new Worker(workerScript, {type: 'string'});
       workers[id].postMessage({sab: sab, id: id});
     }
 

implementation-contributed/v8/mjsunit/harmony/regexp-property-sequence.js

@@ -9,13 +9,13 @@ assertDoesNotThrow("/\\p{Emoji_Flag_Sequence}/u");
 assertTrue(/\p{Emoji_Flag_Sequence}/u.test("\u{1F1E9}\u{1F1EA}"));
 
 assertDoesNotThrow("/\\p{Emoji_Keycap_Sequence}/u");
-assertTrue(/\p{Emoji_Keycap_Sequence}/u.test("\u0023\ufe0f\u20e3"));
+assertTrue(/\p{Emoji_Keycap_Sequence}/u.test("\u0023\uFE0F\u20E3"));
 
 assertDoesNotThrow("/\\p{Emoji_Keycap_Sequence}/u");
-assertFalse(/\p{Emoji_Keycap_Sequence}/u.test("\u0022\ufe0f\u20e3"));
+assertFalse(/\p{Emoji_Keycap_Sequence}/u.test("\u0022\uFE0F\u20E3"));
 
 assertDoesNotThrow("/\\p{Emoji_Modifier_Sequence}/u");
-assertTrue(/\p{Emoji_Modifier_Sequence}/u.test("\u26f9\u{1f3ff}"));
+assertTrue(/\p{Emoji_Modifier_Sequence}/u.test("\u26F9\u{1F3FF}"));
 
 assertDoesNotThrow("/\\p{Emoji_ZWJ_Sequence}/u");
 assertTrue(/\p{Emoji_ZWJ_Sequence}/u.test("\u{1F468}\u{200D}\u{1F467}"));
@@ -27,10 +27,34 @@ assertTrue(/\p{Emoji_Flag_Sequence}/.test("\\p{Emoji_Flag_Sequence}"));
 
 // Negated and/or inside a character class.
 assertThrows("/\\P{Emoji_Flag_Sequence}/u");
+assertThrows("/\\P{Emoji_Keycap_Sequence}/u");
+assertThrows("/\\P{Emoji_Modifier_Sequence}/u");
+assertThrows("/\\P{Emoji_Tag_Sequence}/u");
+assertThrows("/\\P{Emoji_ZWJ_Sequence}/u");
+
 assertThrows("/[\\p{Emoji_Flag_Sequence}]/u");
+assertThrows("/[\\p{Emoji_Keycap_Sequence}]/u");
+assertThrows("/[\\p{Emoji_Modifier_Sequence}]/u");
+assertThrows("/[\\p{Emoji_Tag_Sequence}]/u");
+assertThrows("/[\\p{Emoji_ZWJ_Sequence}]/u");
+
 assertThrows("/[\\P{Emoji_Flag_Sequence}]/u");
+assertThrows("/[\\P{Emoji_Keycap_Sequence}]/u");
+assertThrows("/[\\P{Emoji_Modifier_Sequence}]/u");
+assertThrows("/[\\P{Emoji_Tag_Sequence}]/u");
+assertThrows("/[\\P{Emoji_ZWJ_Sequence}]/u");
+
 assertThrows("/[\\w\\p{Emoji_Flag_Sequence}]/u");
+assertThrows("/[\\w\\p{Emoji_Keycap_Sequence}]/u");
+assertThrows("/[\\w\\p{Emoji_Modifier_Sequence}]/u");
+assertThrows("/[\\w\\p{Emoji_Tag_Sequence}]/u");
+assertThrows("/[\\w\\p{Emoji_ZWJ_Sequence}]/u");
+
 assertThrows("/[\\w\\P{Emoji_Flag_Sequence}]/u");
+assertThrows("/[\\w\\P{Emoji_Keycap_Sequence}]/u");
+assertThrows("/[\\w\\P{Emoji_Modifier_Sequence}]/u");
+assertThrows("/[\\w\\P{Emoji_Tag_Sequence}]/u");
+assertThrows("/[\\w\\P{Emoji_ZWJ_Sequence}]/u");
 
 // Two regional indicators, but not a country.
 assertFalse(/\p{Emoji_Flag_Sequence}/u.test("\u{1F1E6}\u{1F1E6}"));
@@ -42,16 +66,23 @@ assertFalse(/\p{Emoji_ZWJ_Sequence}/u.test("\u{1F467}\u{200D}\u{1F468}"));
 assertEquals(
     ["country flag: \u{1F1E6}\u{1F1F9}"],
     /Country Flag: \p{Emoji_Flag_Sequence}/iu.exec(
-        "this is an example of a country flag: \u{1F1E6}\u{1F1F9} is Austra"));
+        "this is an example of a country flag: \u{1F1E6}\u{1F1F9} is Austria"));
 assertEquals(
     ["country flag: \u{1F1E6}\u{1F1F9}", "\u{1F1E6}\u{1F1F9}"],
     /Country Flag: (\p{Emoji_Flag_Sequence})/iu.exec(
-        "this is an example of a country flag: \u{1F1E6}\u{1F1F9} is Austra"));
+        "this is an example of a country flag: \u{1F1E6}\u{1F1F9} is Austria"));
 assertEquals(
     ["country flag: \u{1F1E6}\u{1F1F9}"],
     /Country Flag: ..(?<=\p{Emoji_Flag_Sequence})/iu.exec(
-        "this is an example of a country flag: \u{1F1E6}\u{1F1F9} is Austra"));
+        "this is an example of a country flag: \u{1F1E6}\u{1F1F9} is Austria"));
 assertEquals(
     ["flag: \u{1F1E6}\u{1F1F9}", "\u{1F1E6}\u{1F1F9}"],
     /Flag: ..(?<=(\p{Emoji_Flag_Sequence})|\p{Emoji_Keycap_Sequence})/iu.exec(
-        "this is an example of a country flag: \u{1F1E6}\u{1F1F9} is Austra"));
+        "this is an example of a country flag: \u{1F1E6}\u{1F1F9} is Austria"));
+
+// Partial sequences.
+assertFalse(/\p{Emoji_Flag_Sequence}/u.test("\u{1F1E6}_"));
+assertFalse(/\p{Emoji_Keycap_Sequence}/u.test("2\uFE0F_"));
+assertFalse(/\p{Emoji_Modifier_Sequence}/u.test("\u261D_"));
+assertFalse(/\p{Emoji_Tag_Sequence}/u.test("\u{1F3F4}\u{E0067}\u{E0062}\u{E0065}\u{E006E}\u{E0067}_"));
+assertFalse(/\p{Emoji_ZWJ_Sequence}/u.test("\u{1F468}\u200D\u2764\uFE0F\u200D_"));

implementation-contributed/v8/mjsunit/harmony/to-number.js

@@ -5,47 +5,34 @@
 // Flags: --allow-natives-syntax
 
 assertEquals(1, %ToNumber(1));
-assertEquals(1, %_ToNumber(1));
 
 assertEquals(.5, %ToNumber(.5));
-assertEquals(.5, %_ToNumber(.5));
 
 assertEquals(0, %ToNumber(null));
-assertEquals(0, %_ToNumber(null));
 
 assertEquals(1, %ToNumber(true));
-assertEquals(1, %_ToNumber(true));
 
 assertEquals(0, %ToNumber(false));
-assertEquals(0, %_ToNumber(false));
 
 assertEquals(NaN, %ToNumber(undefined));
-assertEquals(NaN, %_ToNumber(undefined));
 
 assertEquals(-1, %ToNumber("-1"));
-assertEquals(-1, %_ToNumber("-1"));
 assertEquals(123, %ToNumber("123"));
-assertEquals(123, %_ToNumber("123"));
 assertEquals(NaN, %ToNumber("random text"));
-assertEquals(NaN, %_ToNumber("random text"));
 
 assertThrows(function() { %ToNumber(Symbol.toPrimitive) }, TypeError);
-assertThrows(function() { %_ToNumber(Symbol.toPrimitive) }, TypeError);
 
 var a = { toString: function() { return 54321 }};
 assertEquals(54321, %ToNumber(a));
-assertEquals(54321, %_ToNumber(a));
 
 var b = { valueOf: function() { return 42 }};
 assertEquals(42, %ToNumber(b));
-assertEquals(42, %_ToNumber(b));
 
 var c = {
   toString: function() { return "x"},
   valueOf: function() { return 123 }
 };
 assertEquals(123, %ToNumber(c));
-assertEquals(123, %_ToNumber(c));
 
 var d = {
   [Symbol.toPrimitive]: function(hint) {
@@ -54,8 +41,6 @@ var d = {
   }
 };
 assertEquals(987654321, %ToNumber(d));
-assertEquals(987654321, %_ToNumber(d));
 
 var e = new Date(0);
 assertEquals(0, %ToNumber(e));
-assertEquals(0, %_ToNumber(e));

implementation-contributed/v8/mjsunit/harmony/to-primitive.js

@@ -1,54 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax
-
-assertEquals(1, %ToPrimitive(1));
-assertEquals(1, %ToPrimitive_Number(1));
-
-assertEquals(.5, %ToPrimitive(.5));
-assertEquals(.5, %ToPrimitive_Number(.5));
-
-assertEquals(null, %ToPrimitive(null));
-assertEquals(null, %ToPrimitive_Number(null));
-
-assertEquals(true, %ToPrimitive(true));
-assertEquals(true, %ToPrimitive_Number(true));
-
-assertEquals(false, %ToPrimitive(false));
-assertEquals(false, %ToPrimitive_Number(false));
-
-assertEquals(undefined, %ToPrimitive(undefined));
-assertEquals(undefined, %ToPrimitive_Number(undefined));
-
-assertEquals("random text", %ToPrimitive("random text"));
-assertEquals("random text", %ToPrimitive_Number("random text"));
-
-assertEquals(Symbol.toPrimitive, %ToPrimitive(Symbol.toPrimitive));
-assertEquals(Symbol.toPrimitive, %ToPrimitive_Number(Symbol.toPrimitive));
-
-var a = { toString: function() { return "xyz" }};
-assertEquals("xyz", %ToPrimitive(a));
-assertEquals("xyz", %ToPrimitive_Number(a));
-
-var b = { valueOf: function() { return 42 }};
-assertEquals(42, %ToPrimitive(b));
-assertEquals(42, %ToPrimitive_Number(b));
-
-var c = {
-  toString: function() { return "x"},
-  valueOf: function() { return 123 }
-};
-assertEquals(123, %ToPrimitive(c));
-assertEquals(123, %ToPrimitive_Number(c));
-
-var d = {
-  [Symbol.toPrimitive]: function(hint) { return hint }
-};
-assertEquals("default", %ToPrimitive(d));
-assertEquals("number", %ToPrimitive_Number(d));
-
-var e = new Date(0);
-assertEquals(e.toString(), %ToPrimitive(e));
-assertEquals(0, %ToPrimitive_Number(e));

implementation-contributed/v8/mjsunit/ignition/regress-616064.js

@@ -13,7 +13,7 @@ function foo() {
       return Worker.__f_0(-2147483648, __f_0);
     };
 
-    var __v_9 = new Worker('');
+    var __v_9 = new Worker('', {type: 'string'});
     __f_1 = {s: Math.s, __f_1: true};
   }
 }

implementation-contributed/v8/mjsunit/json.js

@@ -375,32 +375,30 @@ var o = { toString: function() { return "42"; } };
 assertEquals(42, JSON.parse(o));
 
 
-for (var i = 0; i < 65536; i++) {
+for (var i = 0x0000; i <= 0xFFFF; i++) {
   var string = String.fromCharCode(i);
   var encoded = JSON.stringify(string);
-  var expected = "uninitialized";
+  var expected = 'uninitialized';
   // Following the ES5 specification of the abstraction function Quote.
   if (string == '"' || string == '\\') {
     // Step 2.a
     expected = '\\' + string;
-  } else if ("\b\t\n\r\f".indexOf(string) >= 0) {
+  } else if ("\b\t\n\r\f".includes(string)) {
     // Step 2.b
     if (string == '\b') expected = '\\b';
     else if (string == '\t') expected = '\\t';
     else if (string == '\n') expected = '\\n';
     else if (string == '\f') expected = '\\f';
     else if (string == '\r') expected = '\\r';
-  } else if (i < 32) {
+  } else if (i < 0x20) {
     // Step 2.c
-    if (i < 16) {
+    expected = '\\u' + i.toString(16).padStart(4, '0');
-      expected = "\\u000" + i.toString(16);
+    // TODO(mathias): Add i >= 0xD800 && i <= 0xDFFF case once
-    } else {
+    // --harmony-json-stringify is enabled by default.
-      expected = "\\u00" + i.toString(16);
-    }
   } else {
     expected = string;
   }
-  assertEquals('"' + expected + '"', encoded, "Codepoint " + i);
+  assertEquals('"' + expected + '"', encoded, "code point " + i);
 }
 
 

implementation-contributed/v8/mjsunit/mjsunit.js

@@ -64,6 +64,9 @@ var assertNotSame;
 // and the properties of non-Array objects).
 var assertEquals;
 
+// Deep equality predicate used by assertEquals.
+var deepEquals;
+
 // Expected and found values are not identical primitive values or functions
 // or similarly structured objects (checking internal properties
 // of, e.g., Number and Date objects, the elements of arrays
@@ -183,6 +186,9 @@ var isTurboFanned;
 // Monkey-patchable all-purpose failure handler.
 var failWithMessage;
 
+// Returns the formatted failure text.  Used by test-async.js.
+var formatFailureText;
+
 // Returns a pretty-printed string representation of the passed value.
 var prettyPrinted;
 
@@ -297,7 +303,7 @@ var prettyPrinted;
     throw new MjsUnitAssertionError(message);
   }
 
-  function formatFailureText(expectedText, found, name_opt) {
+  formatFailureText = function(expectedText, found, name_opt) {
     var message = "Fail" + "ure";
     if (name_opt) {
       // Fix this when we ditch the old test runner.
@@ -335,7 +341,7 @@ var prettyPrinted;
   }
 
 
-  function deepEquals(a, b) {
+  deepEquals = function deepEquals(a, b) {
     if (a === b) {
       // Check for -0.
       if (a === 0) return (1 / a) === (1 / b);

implementation-contributed/v8/mjsunit/regress/regress-4271.js

@@ -17,7 +17,7 @@ if (this.Worker) {
   });
 
   // Don't throw for real worker
-  var worker = new Worker('');
+  var worker = new Worker('', {type: 'string'});
   worker.getMessage();
   worker.postMessage({});
   worker.terminate();

implementation-contributed/v8/mjsunit/regress/regress-4279.js

@@ -4,7 +4,7 @@
 
 if (this.Worker && this.quit) {
   try {
-      new Function(new Worker("55"));
+      new Function(new Worker("55"), {type: 'string'});
   } catch(err) {}
 
   quit();

implementation-contributed/v8/mjsunit/regress/regress-821368.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-const worker = new Worker("onmessage = function(){}");
+const worker = new Worker("onmessage = function(){}", {type: 'string'});
 const buffer = new ArrayBuffer();
 worker.postMessage(buffer, [buffer]);
 try {

implementation-contributed/v8/mjsunit/regress/regress-crbug-503578.js

@@ -8,7 +8,7 @@ if (this.Worker) {
     var __v_5 = new Uint32Array(__v_1);
     return __v_5;
   }
-  var __v_6 = new Worker('onmessage = function() {}');
+  var __v_6 = new Worker('onmessage = function() {}', {type: 'string'});
   var __v_3 = __f_0(16);
   __v_6.postMessage(__v_3);
 }

implementation-contributed/v8/mjsunit/regress/regress-crbug-503698.js

@@ -5,5 +5,5 @@
 // Flags: --invoke-weak-callbacks
 
 if (this.Worker) {
-  var __v_6 = new Worker('');
+  var __v_6 = new Worker('', {type: 'string'});
 }

implementation-contributed/v8/mjsunit/regress/regress-crbug-503968.js

@@ -8,6 +8,6 @@ if (this.Worker) {
     this.l = [new __f_0, new __f_0];
   }
   __v_6 = new __f_1;
-  var __v_9 = new Worker('');
+  var __v_9 = new Worker('', {type: 'string'});
   __v_9.postMessage(__v_6);
 }

implementation-contributed/v8/mjsunit/regress/regress-crbug-503991.js

@@ -4,6 +4,6 @@
 
 if (this.Worker) {
   __v_3 = "";
-  var __v_6 = new Worker('');
+  var __v_6 = new Worker('', {type: 'string'});
   __v_6.postMessage(__v_3);
 }

implementation-contributed/v8/mjsunit/regress/regress-crbug-504136.js

@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 if (this.Worker) {
-  var __v_10 = new Worker('');
+  var __v_10 = new Worker('', {type: 'string'});
   __v_10.terminate();
  __v_10.getMessage();
 }

implementation-contributed/v8/mjsunit/regress/regress-crbug-504727.js

@@ -5,5 +5,5 @@
 // Flags: --no-test
 
 if (this.Worker) {
-  var __v_2 = new Worker('');
+  var __v_2 = new Worker('', {type: 'string'});
 }

implementation-contributed/v8/mjsunit/regress/regress-crbug-504729.js

@@ -5,5 +5,5 @@
 if (this.Worker) {
   Function.prototype.toString = "foo";
   function __f_7() {}
-  assertThrows(function() { var __v_5 = new Worker(__f_7.toString()); });
+  assertThrows(function() { var __v_5 = new Worker(__f_7.toString(), {type: 'string'}) });
 }

implementation-contributed/v8/mjsunit/regress/regress-crbug-505778.js

@@ -3,6 +3,6 @@
 // found in the LICENSE file.
 
 if (this.Worker) {
-  var __v_7 = new Worker('onmessage = function() {}');
+  var __v_7 = new Worker('onmessage = function() {}', {type: 'string'});
   __v_7.postMessage("");
 }

implementation-contributed/v8/mjsunit/regress/regress-crbug-506549.js

@@ -5,6 +5,6 @@
 if (this.Worker) {
   var __v_5 = {};
   __v_5.__defineGetter__('byteLength', function() {foo();});
-  var __v_8 = new Worker('onmessage = function() {};');
+  var __v_8 = new Worker('onmessage = function() {};', {type: 'string'});
   assertThrows(function() { __v_8.postMessage(__v_5); });
 }

implementation-contributed/v8/mjsunit/regress/regress-crbug-511880.js

@@ -4,10 +4,10 @@
 
 if (this.Worker) {
   var __v_8 =
-    `var __v_9 = new Worker('postMessage(42)');
+    `var __v_9 = new Worker('postMessage(42)', {type: 'string'});
      onmessage = function(parentMsg) {
        __v_9.postMessage(parentMsg);
      };`;
-  var __v_9 = new Worker(__v_8);
+  var __v_9 = new Worker(__v_8, {type: 'string'});
   __v_9.postMessage(9);
 }

implementation-contributed/v8/mjsunit/regress/regress-crbug-514081.js

@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 if (this.Worker) {
-  var __v_7 = new Worker('onmessage = function() {};');
+  var __v_7 = new Worker('onmessage = function() {};', {type: 'string'});
   var e;
   var ab = new ArrayBuffer(2 * 1000 * 1000);
   try {

implementation-contributed/v8/mjsunit/regress/regress-crbug-518747.js

@@ -4,6 +4,6 @@
 
 if (this.Worker) {
   Worker.prototype = 12;
-  var __v_6 = new Worker('');
+  var __v_6 = new Worker('', {type: 'string'});
   __v_6.postMessage([]);
 }

implementation-contributed/v8/mjsunit/regress/regress-crbug-522496.js

@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 if (this.Worker) {
-  var worker = new Worker("onmessage = function(){}");
+  var worker = new Worker("onmessage = function(){}", {type: 'string'});
   var buf = new ArrayBuffer();
   worker.postMessage(buf, [buf]);
 }

implementation-contributed/v8/mjsunit/regress/regress-crbug-687063.js

@@ -0,0 +1,31 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Collect the actual properties looked up on the Proxy.
+const actual = [];
+
+// Perform a relational comparison with a Proxy on the right hand
+// side and a Symbol which cannot be turned into a Number on the
+// left hand side.
+function foo() {
+  actual.length = 0;
+  const lhs = Symbol();
+  const rhs = new Proxy({}, {
+    get: function(target, property, receiver) {
+      actual.push(property);
+      return undefined;
+    }
+  });
+  return lhs < rhs;
+}
+
+assertThrows(foo, TypeError);
+assertEquals([Symbol.toPrimitive, 'valueOf', 'toString'], actual);
+assertThrows(foo, TypeError);
+assertEquals([Symbol.toPrimitive, 'valueOf', 'toString'], actual);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(foo, TypeError);
+assertEquals([Symbol.toPrimitive, 'valueOf', 'toString'], actual);

implementation-contributed/v8/mjsunit/regress/regress-crbug-722871.js

@@ -7,7 +7,7 @@ let workers = [];
 let runningWorkers = 0;
 
 function startWorker(script) {
-  let worker = new Worker(script);
+  let worker = new Worker(script, {type: 'string'});
   worker.done = false;
   worker.idx = workers.length;
   workers.push(worker);

implementation-contributed/v8/mjsunit/regress/regress-crbug-887891.js

@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --verify-heap
+
+const l = 1000000000;
+const a = [];
+function foo() { var x = new Int32Array(l); }
+try { foo(); } catch (e) { }

implementation-contributed/v8/mjsunit/regress/wasm/regress-801850.js

@@ -7,5 +7,5 @@ load('test/mjsunit/wasm/wasm-module-builder.js');
 
 var builder = new WasmModuleBuilder();
 let module = new WebAssembly.Module(builder.toBuffer());
-var worker = new Worker('onmessage = function() {};');
+var worker = new Worker('onmessage = function() {};', {type: 'string'});
 worker.postMessage(module)

implementation-contributed/v8/mjsunit/regress/wasm/regress-803427.js

@@ -9,5 +9,5 @@ load('test/mjsunit/wasm/wasm-module-builder.js');
 
 var builder = new WasmModuleBuilder();
 let module = new WebAssembly.Module(builder.toBuffer());
-var worker = new Worker('onmessage = function() {};');
+var worker = new Worker('onmessage = function() {};', {type: 'string'});
 worker.postMessage(module)

implementation-contributed/v8/mjsunit/regress/wasm/regress-8059.js

@@ -31,7 +31,7 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
   Realm.shared = { m:module, s:workerScript };
 
   let realmScript = `
-    let worker = new Worker(Realm.shared.s);
+    let worker = new Worker(Realm.shared.s, {type: 'string'});
     worker.postMessage(Realm.shared.m);
     let message = worker.getMessage();
     worker.terminate();

implementation-contributed/v8/mjsunit/regress/wasm/regress-808012.js

@@ -10,5 +10,5 @@ load('test/mjsunit/wasm/wasm-module-builder.js');
 const builder = new WasmModuleBuilder();
 builder.addFunction('test', kSig_i_i).addBody([kExprUnreachable]);
 let module = new WebAssembly.Module(builder.toBuffer());
-var worker = new Worker('onmessage = function() {};');
+var worker = new Worker('onmessage = function() {};', {type: 'string'});
 worker.postMessage(module);

implementation-contributed/v8/mjsunit/regress/wasm/regress-808848.js

@@ -60,7 +60,7 @@ let worker_onmessage = function(msg) {
 }
 let workerScript = "onmessage = " + worker_onmessage.toString();
 
-let worker = new Worker(workerScript);
+let worker = new Worker(workerScript, {type: 'string'});
 worker.postMessage({serialized_m1, m1_bytes});
 
 // Wait for worker to finish.

implementation-contributed/v8/mjsunit/samevalue.js

@@ -32,8 +32,11 @@
 var obj1 = {x: 10, y: 11, z: "test"};
 var obj2 = {x: 10, y: 11, z: "test"};
 
+// Object.is() uses the SameValue algorithm.
 var sameValue = Object.is;
-var sameValueZero = function(x, y) { return %SameValueZero(x, y); }
+
+// Set#has() uses the SameValueZero algorithm.
+var sameValueZero = (x, y) => new Set([x]).has(y);
 
 // Calls SameValue and SameValueZero and checks that their results match.
 function sameValueBoth(a, b) {

implementation-contributed/v8/mjsunit/test-async.js

@@ -53,7 +53,7 @@ var testAsync;
 
     equals(expected, found, name_opt) {
       this.actualAsserts_++;
-      if (expected !== found) {
+      if (!deepEquals(expected, found)) {
         this.fail(prettyPrinted(expected), found, name_opt);
       }
     }

implementation-contributed/v8/test262/harness-agent.js

@@ -76,7 +76,7 @@ var agent = {
     if (i32a === null) {
       i32a = new Int32Array(new SharedArrayBuffer(256));
     }
-    var w = new Worker(workerScript(script));
+    var w = new Worker(workerScript(script), {type: 'string'});
     w.index = workers.length;
     w.postMessage({kind: 'start', i32a: i32a, index: w.index});
     workers.push(w);