deps: update V8 to 6.0.286.52

PR-URL: https://github.com/nodejs/node/pull/14004
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

28 files changed, 551 insertions, 90 deletions

diff --git a/deps/v8/test/mjsunit/es6/array-iterator-turbo.js b/deps/v8/test/mjsunit/es6/array-iterator-turbo.js
index def018eea2..c9182f89e0 100644
--- a/deps/v8/test/mjsunit/es6/array-iterator-turbo.js
+++ b/deps/v8/test/mjsunit/es6/array-iterator-turbo.js
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 // Flags: --turbo --turbo-escape --allow-natives-syntax --no-always-opt
-// Flags: --crankshaft --turbo-filter=*
+// Flags: --opt --turbo-filter=*
 
 "use strict";
 
@@ -43,13 +43,15 @@ let tests = {
           return sum;
       },
 
-      FAST_HOLEY_DOUBLE_ELEMENTS(array) {
+      // TODO(6587): Re-enable the below test case once we no longer deopt due
+      // to non-truncating uses of {CheckFloat64Hole} nodes.
+      /*FAST_HOLEY_DOUBLE_ELEMENTS(array) {
         let sum = 0.0;
         for (let x of array) {
           if (x) sum += x;
         }
         return sum;
-      }
+      }*/
     };
 
     let tests = {
@@ -84,12 +86,14 @@ let tests = {
         array2: [0.6, 0.4, 0.2],
         expected2: 1.2
       },
-      FAST_HOLEY_DOUBLE_ELEMENTS: {
+      // TODO(6587): Re-enable the below test case once we no longer deopt due
+      // to non-truncating uses of {CheckFloat64Hole} nodes.
+      /*FAST_HOLEY_DOUBLE_ELEMENTS: {
         array: [0.1, , 0.3, , 0.5, , 0.7, , 0.9, ,],
         expected: 2.5,
         array2: [0.1, , 0.3],
         expected2: 0.4
-      }
+      }*/
     };
 
     for (let key of Object.keys(runners)) {
@@ -102,29 +106,13 @@ let tests = {
       %OptimizeFunctionOnNextCall(fn);
       fn(array);
 
-      // TODO(bmeurer): FAST_HOLEY_DOUBLE_ELEMENTS maps generally deopt when
-      // a hole is encountered. Test should be fixed once that is corrected.
-      let expect_deopt = /HOLEY_DOUBLE/.test(key);
-
-      if (expect_deopt) {
-        assertUnoptimized(fn, '', key);
-      } else {
-        assertOptimized(fn, '', key);
-      }
+      assertOptimized(fn, '', key);
       assertEquals(expected, fn(array), key);
-      if (expect_deopt) {
-        assertUnoptimized(fn, '', key);
-      } else {
-        assertOptimized(fn, '', key);
-      }
+      assertOptimized(fn, '', key);
 
       // Check no deopt when another array with the same map is used
       assertTrue(%HaveSameMap(array, array2), key);
-      if (expect_deopt) {
-        assertUnoptimized(fn, '', key);
-      } else {
-        assertOptimized(fn, '', key);
-      }
+      assertOptimized(fn, '', key);
       assertEquals(expected2, fn(array2), key);
 
       // CheckMaps bailout
@@ -231,6 +219,10 @@ let tests = {
       let clone = new array.constructor(array);
       %ArrayBufferNeuter(clone.buffer);
       assertThrows(() => sum(clone), TypeError);
+
+      // Clear the slate for the next iteration.
+      %DeoptimizeFunction(sum);
+      %ClearFunctionFeedback(sum);
     }
   }
 };
diff --git a/deps/v8/test/mjsunit/es6/block-let-crankshaft-sloppy.js b/deps/v8/test/mjsunit/es6/block-let-crankshaft-sloppy.js
index d06153ed8a..5711ac270e 100644
--- a/deps/v8/test/mjsunit/es6/block-let-crankshaft-sloppy.js
+++ b/deps/v8/test/mjsunit/es6/block-let-crankshaft-sloppy.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --crankshaft
+// Flags: --allow-natives-syntax --opt
 
 // Check that the following functions are optimizable.
 var functions = [ f1, f2, f3, f4, f5, f6, f7, f8, f9, f10, f11, f12, f13, f14,
diff --git a/deps/v8/test/mjsunit/es6/block-let-crankshaft.js b/deps/v8/test/mjsunit/es6/block-let-crankshaft.js
index 99a8b52968..97de765c8a 100644
--- a/deps/v8/test/mjsunit/es6/block-let-crankshaft.js
+++ b/deps/v8/test/mjsunit/es6/block-let-crankshaft.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --crankshaft
+// Flags: --allow-natives-syntax --opt
 
 "use strict";
 
diff --git a/deps/v8/test/mjsunit/es6/block-scoping-sloppy.js b/deps/v8/test/mjsunit/es6/block-scoping-sloppy.js
index 29eadb17d1..d86eb0794f 100644
--- a/deps/v8/test/mjsunit/es6/block-scoping-sloppy.js
+++ b/deps/v8/test/mjsunit/es6/block-scoping-sloppy.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --crankshaft
+// Flags: --allow-natives-syntax --opt
 // Test functionality of block scopes.
 
 // Hoisting of var declarations.
diff --git a/deps/v8/test/mjsunit/es6/block-scoping.js b/deps/v8/test/mjsunit/es6/block-scoping.js
index ec13592977..9fa22cddc3 100644
--- a/deps/v8/test/mjsunit/es6/block-scoping.js
+++ b/deps/v8/test/mjsunit/es6/block-scoping.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --crankshaft
+// Flags: --allow-natives-syntax --opt
 // Test functionality of block scopes.
 
 "use strict";
diff --git a/deps/v8/test/mjsunit/es6/destructuring-assignment.js b/deps/v8/test/mjsunit/es6/destructuring-assignment.js
index df9bb0e8c6..579c87718b 100644
--- a/deps/v8/test/mjsunit/es6/destructuring-assignment.js
+++ b/deps/v8/test/mjsunit/es6/destructuring-assignment.js
@@ -478,3 +478,93 @@ assertEquals(oz, [1, 2, 3, 4, 5]);
     { firstLetter: "B", rest: ["p", "u", "p", "p", "y"] },
   ], log);
 })();
+
+(function testNewTarget() {
+  assertThrows("(function() { [...new.target] = []; })", SyntaxError);
+  assertThrows("(function() { [a] = [...new.target] = []; })", SyntaxError);
+  assertThrows("(function() { [new.target] = []; })", SyntaxError);
+  assertThrows("(function() { [a] = [new.target] = []; })", SyntaxError);
+  assertThrows("(function() { ({ a: new.target] = {a: 0}); })", SyntaxError);
+  assertThrows("(function() { ({ a } = { a: new.target } = {}); })",
+               SyntaxError);
+
+  function ReturnNewTarget1() {
+    var result;
+    [result = new.target] = [];
+    return result;
+  }
+
+  function ReturnNewTarget2() {
+    var result;
+    [result] = [new.target];
+    return result;
+  }
+
+  function ReturnNewTarget3() {
+    var result;
+    ({ result = new.target } = {});
+    return result;
+  }
+
+  function ReturnNewTarget4() {
+    var result;
+    ({ result } = { result: new.target });
+    return result;
+  }
+
+  function FakeNewTarget() {}
+  assertEquals(undefined, ReturnNewTarget1());
+  assertEquals(ReturnNewTarget1, new ReturnNewTarget1());
+  assertEquals(FakeNewTarget,
+               Reflect.construct(ReturnNewTarget1, [], FakeNewTarget));
+
+  assertEquals(undefined, ReturnNewTarget2());
+  assertEquals(ReturnNewTarget2, new ReturnNewTarget2());
+  assertEquals(FakeNewTarget,
+               Reflect.construct(ReturnNewTarget2, [], FakeNewTarget));
+
+  assertEquals(undefined, ReturnNewTarget3());
+  assertEquals(ReturnNewTarget3, new ReturnNewTarget3());
+  assertEquals(FakeNewTarget,
+               Reflect.construct(ReturnNewTarget3, [], FakeNewTarget));
+
+  assertEquals(undefined, ReturnNewTarget4());
+  assertEquals(ReturnNewTarget4, new ReturnNewTarget4());
+  assertEquals(FakeNewTarget,
+               Reflect.construct(ReturnNewTarget4, [], FakeNewTarget));
+})();
+
+(function testSuperCall() {
+  function ctor(body) {
+    return () => eval("(class extends Object { \n" +
+                      "  constructor() {\n" +
+                      body +
+                      "\n  }\n" +
+                      "})");
+  }
+  assertThrows(ctor("({ new: super() } = {})"), SyntaxError);
+  assertThrows(ctor("({ new: x } = { new: super() } = {})"), SyntaxError);
+  assertThrows(ctor("[super()] = []"), SyntaxError);
+  assertThrows(ctor("[x] = [super()] = []"), SyntaxError);
+  assertThrows(ctor("[...super()] = []"), SyntaxError);
+  assertThrows(ctor("[x] = [...super()] = []"), SyntaxError);
+
+  class Base { get foo() { return 1; } }
+  function ext(body) {
+    return eval("new (class extends Base {\n" +
+                "  constructor() {\n" +
+                body + ";\n" +
+                "  return { x: super.foo }" +
+                "\n  }\n" +
+                "})");
+  }
+  assertEquals(1, ext("let x; [x = super()] = []").x);
+  assertEquals(1, ext("let x, y; [y] = [x = super()] = []").x);
+  assertEquals(1, ext("let x; [x] = [super()]").x);
+  assertEquals(1, ext("let x, y; [y] = [x] = [super()]").x);
+
+  assertEquals(1, ext("let x; ({x = super()} = {})").x);
+  assertEquals(1, ext("let x, y; ({ x: y } = { x = super() } = {})").x);
+  assertEquals(1, ext("let x; ({x} = { x: super() })").x);
+  assertEquals(1, ext("let x, y; ({ x: y } = { x } = { x: super() })").x);
+})();
diff --git a/deps/v8/test/mjsunit/es6/regress/regress-6322.js b/deps/v8/test/mjsunit/es6/regress/regress-6322.js
new file mode 100644
index 0000000000..41f66171ed
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/regress/regress-6322.js
@@ -0,0 +1,6 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Crash with --verify-heap
+(function*() { for (let { a = class b { } } of [{}]) { } })().next();
diff --git a/deps/v8/test/mjsunit/es6/rest-params-lazy-parsing.js b/deps/v8/test/mjsunit/es6/rest-params-lazy-parsing.js
index c9b81661dc..271ddf3c4a 100644
--- a/deps/v8/test/mjsunit/es6/rest-params-lazy-parsing.js
+++ b/deps/v8/test/mjsunit/es6/rest-params-lazy-parsing.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --min-preparse-length=0
-
 function variadic(co, ...values) {
   var sum = 0;
   while (values.length) {
diff --git a/deps/v8/test/mjsunit/es6/string-replace.js b/deps/v8/test/mjsunit/es6/string-replace.js
index 0beb57a536..16cadc5369 100644
--- a/deps/v8/test/mjsunit/es6/string-replace.js
+++ b/deps/v8/test/mjsunit/es6/string-replace.js
@@ -3,7 +3,8 @@
 // found in the LICENSE file.
 
 var pattern = {
-  [Symbol.replace]: (string, newValue) => string + newValue
+  [Symbol.replace]: (string, newValue) => string + newValue,
+  toString: () => "c"
 };
 // Check object coercible fails.
 assertThrows(() => String.prototype.replace.call(null, pattern, "x"),
@@ -13,5 +14,8 @@ assertEquals("abcdex", "abcde".replace(pattern, "x"));
 // Non-callable override.
 pattern[Symbol.replace] = "dumdidum";
 assertThrows(() => "abcde".replace(pattern, "x"), TypeError);
+// Null override.
+pattern[Symbol.replace] = null;
+assertEquals("abXde", "abcde".replace(pattern, "X"));
 
 assertEquals("[Symbol.replace]", RegExp.prototype[Symbol.replace].name);
diff --git a/deps/v8/test/mjsunit/es6/string-split.js b/deps/v8/test/mjsunit/es6/string-split.js
index 8ca655cad9..c21f9d3d94 100644
--- a/deps/v8/test/mjsunit/es6/string-split.js
+++ b/deps/v8/test/mjsunit/es6/string-split.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-var pattern = {};
+var pattern = {toString: () => ""};
 var limit = { value: 3 };
 pattern[Symbol.split] = function(string, limit) {
   return string.length * limit.value;
@@ -15,5 +15,8 @@ assertEquals(15, "abcde".split(pattern, limit));
 // Non-callable override.
 pattern[Symbol.split] = "dumdidum";
 assertThrows(() => "abcde".split(pattern, limit), TypeError);
+// Null override.
+pattern[Symbol.split] = null;
+assertEquals(["a", "b", "c", "d", "e"], "abcde".split(pattern));
 
 assertEquals("[Symbol.split]", RegExp.prototype[Symbol.split].name);
diff --git a/deps/v8/test/mjsunit/es6/typedarray-construct-by-array-like-prototype-element-added.js b/deps/v8/test/mjsunit/es6/typedarray-construct-by-array-like-prototype-element-added.js
new file mode 100644
index 0000000000..edcba43b52
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/typedarray-construct-by-array-like-prototype-element-added.js
@@ -0,0 +1,32 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+  var arr = [0, 1, , 3];
+  Array.prototype[2] = 2;
+
+  var constructors = [
+    Uint8Array,
+    Int8Array,
+    Uint16Array,
+    Int16Array,
+    Uint32Array,
+    Int32Array,
+    Float32Array,
+    Float64Array,
+    Uint8ClampedArray
+  ];
+
+  for (var constr of constructors) {
+    var ta = new constr(arr);
+    assertArrayEquals([0, 1, 2, 3], ta);
+  }
+})();
+
+(function testTypedArrayConstructByArrayLikeInvalidArrayProtector() {
+  Array.prototype[2] = undefined;
+  load("test/mjsunit/es6/typedarray-construct-by-array-like.js");
+})();
diff --git a/deps/v8/test/mjsunit/es6/typedarray-construct-by-array-like.js b/deps/v8/test/mjsunit/es6/typedarray-construct-by-array-like.js
index 6f3e961a27..7d17812a8d 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-construct-by-array-like.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-construct-by-array-like.js
@@ -4,7 +4,11 @@
 
 // Flags: --allow-natives-syntax
 
-function TestConstructSmallObject(constr) {
+var tests = [];
+
+// Tests that will be called with each TypedArray constructor.
+
+tests.push(function TestConstructSmallObject(constr) {
   var myObject = { 0: 5, 1: 6, length: 2 };
 
   arr = new constr(myObject);
@@ -12,9 +16,9 @@ function TestConstructSmallObject(constr) {
   assertEquals(2, arr.length);
   assertEquals(5, arr[0]);
   assertEquals(6, arr[1]);
-};
+});
 
-function TestConstructLargeObject(constr) {
+tests.push(function TestConstructLargeObject(constr) {
   var myObject = {};
   const n = 128;
   for (var i = 0; i < n; i++) {
@@ -28,18 +32,18 @@ function TestConstructLargeObject(constr) {
   for (var i = 0; i < n; i++) {
     assertEquals(i, arr[i]);
   }
-}
+});
 
-function TestConstructFromArrayWithSideEffects(constr) {
+tests.push(function TestConstructFromArrayWithSideEffects(constr) {
   var arr = [{ valueOf() { arr[1] = 20; return 1; }}, 2];
 
   var ta = new constr(arr);
 
   assertEquals(1, ta[0]);
   assertEquals(2, ta[1]);
-}
+});
 
-function TestConstructFromArrayWithSideEffectsHoley(constr) {
+tests.push(function TestConstructFromArrayWithSideEffectsHoley(constr) {
   var arr = [{ valueOf() { arr[1] = 20; return 1; }}, 2, , 4];
 
   var ta = new constr(arr);
@@ -48,10 +52,75 @@ function TestConstructFromArrayWithSideEffectsHoley(constr) {
   assertEquals(2, ta[1]);
   // ta[2] will be the default value, but we aren't testing that here.
   assertEquals(4, ta[3]);
-}
+});
+
+tests.push(function TestConstructFromArrayHoleySmi(constr) {
+  var arr = [0, 1, , 3];
+
+  var ta = new constr(arr);
+
+  assertArrayEquals([0, 1, defaultValue(constr), 3], ta);
+});
+
+tests.push(function TestConstructFromArrayHoleyDouble(constr) {
+  var arr = [0.0, 1.0, , 3.0];
+
+  var ta = new constr(arr);
+
+  assertArrayEquals([0, 1, defaultValue(constr), 3], ta);
+});
+
+tests.push(function TestConstructFromArrayHoleySmiWithOtherPrototype(constr) {
+  var arr = [0, 1, , 3];
+  Object.setPrototypeOf(arr, { 2: 2 });
+
+  var ta = new constr(arr);
+
+  assertArrayEquals([0, 1, 2, 3], ta);
+});
 
+tests.push(function TestConstructFromArrayWithProxyPrototype(constr) {
+  var arr = [0, 1, , 3];
+  var proxy = new Proxy([], {
+    get: function(target, name) {
+      if (name === Symbol.iterator) return undefined;
+      if (name == 2) return 2;
+      return target[name];
+    }
+  });
+  Object.setPrototypeOf(arr, proxy);
 
-function TestConstructFromArray(constr) {
+  var ta = new constr(arr);
+
+  assertArrayEquals([0, 1, 2, 3], ta);
+});
+
+tests.push(function TestConstructFromArrayHoleySmiWithSubclass(constr) {
+  class SubArray extends Array {}
+  var arr = new SubArray(0, 1);
+  arr[3] = 3;
+
+  var ta = new constr(arr);
+
+  assertArrayEquals([0, 1, defaultValue(constr), 3], ta);
+});
+
+tests.push(function TestConstructFromArrayNoIteratorWithGetter(constr) {
+  var arr = [1, 2, 3];
+  arr[Symbol.iterator] = undefined;
+
+  Object.defineProperty(arr, "2", {
+    get() {
+      return 22;
+    }
+  });
+
+  var ta = new constr(arr);
+
+  assertArrayEquals([1, 2, 22], ta);
+});
+
+tests.push(function TestConstructFromArray(constr) {
   var n = 64;
   var jsArray = [];
   for (var i = 0; i < n; i++) {
@@ -64,9 +133,9 @@ function TestConstructFromArray(constr) {
   for (var i = 0; i < n; i++) {
     assertEquals(i, arr[i]);
   }
-}
+});
 
-function TestConstructFromTypedArray(constr) {
+tests.push(function TestConstructFromTypedArray(constr) {
   var n = 64;
   var ta = new constr(n);
   for (var i = 0; i < ta.length; i++) {
@@ -79,15 +148,55 @@ function TestConstructFromTypedArray(constr) {
   for (var i = 0; i < n; i++) {
     assertEquals(i, arr[i]);
   }
-}
+});
 
-function TestLengthIsMaxSmi(constr) {
+tests.push(function TestLengthIsMaxSmi(constr) {
   var myObject = { 0: 5, 1: 6, length: %_MaxSmi() + 1 };
 
   assertThrows(function() {
     new constr(myObject);
   }, RangeError);
-}
+});
+
+tests.push(function TestProxyHoleConverted(constr) {
+  var source = {0: 0, 2: 2, length: 3};
+  var proxy = new Proxy(source, {});
+
+  var converted = new constr(proxy);
+
+  assertArrayEquals([0, defaultValue(constr), 2], converted);
+});
+
+tests.push(function TestProxyToObjectValueOfCalled(constr) {
+  var thrower = { valueOf: function() { throw new TypeError(); } };
+  var source = {0: 0, 1: thrower, length: 2};
+  var proxy = new Proxy(source, {});
+
+  assertThrows(() => new constr(proxy), TypeError);
+});
+
+tests.push(function TestObjectValueOfCalled(constr) {
+  var thrower = { valueOf: function() { throw new TypeError(); } };
+
+  var obj = {0: 0, 1: thrower, length: 2};
+  assertThrows(() => new constr(obj), TypeError);
+});
+
+tests.push(function TestSmiPackedArray(constr) {
+  var ta = new constr([1, 2, 3, 4, 127]);
+
+  assertEquals(5 * constr.BYTES_PER_ELEMENT, ta.byteLength);
+  assertArrayEquals([1, 2, 3, 4, 127], ta);
+});
+
+tests.push(function TestOffsetIsUsed(constr) {
+  TestOffsetIsUsedRunner(constr, 4);
+  TestOffsetIsUsedRunner(constr, 16);
+  TestOffsetIsUsedRunner(constr, 32);
+  TestOffsetIsUsedRunner(constr, 128);
+});
+
+// Helpers for above tests.
 
 function TestOffsetIsUsedRunner(constr, n) {
   var buffer = new ArrayBuffer(constr.BYTES_PER_ELEMENT * n);
@@ -109,21 +218,13 @@ function TestOffsetIsUsedRunner(constr, n) {
   }
 }
 
-function TestOffsetIsUsed(constr, n) {
-  TestOffsetIsUsedRunner(constr, 4);
-  TestOffsetIsUsedRunner(constr, 16);
-  TestOffsetIsUsedRunner(constr, 32);
-  TestOffsetIsUsedRunner(constr, 128);
+function defaultValue(constr) {
+  if (constr == Float32Array || constr == Float64Array) return NaN;
+  return 0;
 }
 
-Test(TestConstructSmallObject);
-Test(TestConstructLargeObject);
-Test(TestConstructFromArrayWithSideEffects);
-Test(TestConstructFromArrayWithSideEffectsHoley);
-Test(TestConstructFromArray);
-Test(TestConstructFromTypedArray);
-Test(TestLengthIsMaxSmi);
-Test(TestOffsetIsUsed);
+tests.forEach(f => Test(f));
+
 
 function Test(func) {
   func(Uint8Array);
@@ -136,3 +237,43 @@ function Test(func) {
   func(Float64Array);
   func(Uint8ClampedArray);
 }
+
+// Other, standalone tests.
+
+(function TestUint8ClampedIsNotBitCopied() {
+  var arr = new Int8Array([-1.0, 0, 1.1, 255, 256]);
+  assertArrayEquals([-1, 0, 1, -1, 0], arr);
+  var expected = new Uint8ClampedArray([0, 0, 1, 0, 0]);
+
+  var converted = new Uint8ClampedArray(arr);
+
+  assertArrayEquals([0, 0, 1, 0, 0], converted);
+})();
+
+(function TestInt8ArrayCopying() {
+  var source = new Uint8Array([0, 1, 127, 128, 255, 256]);
+  assertArrayEquals([0, 1, 127, 128, 255, 0], source);
+
+  var converted = new Int8Array(source);
+
+  assertArrayEquals([0, 1, 127, -128, -1, 0], converted);
+})();
+
+(function TestInt16ArrayCopying() {
+  var source = new Uint16Array([0, 1, 32767, 32768, 65535, 65536]);
+  assertArrayEquals([0, 1, 32767, 32768, 65535, 0], source);
+
+  var converted = new Int16Array(source);
+
+  assertArrayEquals([0, 1, 32767, -32768, -1, 0], converted);
+})();
+
+(function TestInt32ArrayCopying() {
+  var source =
+      new Uint32Array([0, 1, 2147483647, 2147483648, 4294967295, 4294967296]);
+  assertArrayEquals([0, 1, 2147483647, 2147483648, 4294967295, 0], source);
+
+  var converted = new Int32Array(source);
+
+  assertArrayEquals([0, 1, 2147483647, -2147483648, -1, 0], converted);
+})();
diff --git a/deps/v8/test/mjsunit/es6/typedarray-construct-offset-not-smi.js b/deps/v8/test/mjsunit/es6/typedarray-construct-offset-not-smi.js
index 27beb762dc..0a267bc64b 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-construct-offset-not-smi.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-construct-offset-not-smi.js
@@ -2,18 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --mock-arraybuffer-allocator
 
 (function TestBufferByteLengthNonSmi() {
   var non_smi_byte_length = %_MaxSmi() + 1;
 
-  try {
-    var buffer = new ArrayBuffer(non_smi_byte_length);
-  } catch (e) {
-    // The ArrayBuffer allocation can fail on 32-bit archs, so no need to try to
-    // construct the typed array.
-    return;
-  }
+  var buffer = new ArrayBuffer(non_smi_byte_length);
+
   var arr = new Uint16Array(buffer);
 
   assertEquals(non_smi_byte_length, arr.byteLength);
@@ -26,33 +21,17 @@
 
 (function TestByteOffsetNonSmi() {
   var non_smi_byte_length = %_MaxSmi() + 11;
-  try {
-    var buffer = new ArrayBuffer(non_smi_byte_length);
-  } catch (e) {
-    // The ArrayBuffer allocation can fail on 32-bit archs, so no need to try to
-    // construct the typed array.
-    return;
-  }
-  print(buffer.byteLength);
+
+  var buffer = new ArrayBuffer(non_smi_byte_length);
+
   var whole = new Uint16Array(buffer);
-  whole[non_smi_byte_length / 2 - 1] = 1;
-  whole[non_smi_byte_length / 2 - 2] = 2;
-  whole[non_smi_byte_length / 2 - 3] = 3;
-  whole[non_smi_byte_length / 2 - 4] = 4;
-  whole[non_smi_byte_length / 2 - 5] = 5;
 
+  assertEquals(non_smi_byte_length, whole.byteLength);
   assertEquals(non_smi_byte_length / 2, whole.length);
-  assertEquals(1, whole[non_smi_byte_length / 2 - 1]);
 
   var arr = new Uint16Array(buffer, non_smi_byte_length - 10, 5);
 
   assertEquals(non_smi_byte_length, arr.buffer.byteLength);
   assertEquals(10, arr.byteLength);
   assertEquals(5, arr.length);
-
-  assertEquals(5, arr[0]);
-  assertEquals(4, arr[1]);
-  assertEquals(3, arr[2]);
-  assertEquals(2, arr[3]);
-  assertEquals(1, arr[4]);
 })();
diff --git a/deps/v8/test/mjsunit/es6/typedarray-copywithin.js b/deps/v8/test/mjsunit/es6/typedarray-copywithin.js
index 1e63508393..c52a38625b 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-copywithin.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-copywithin.js
@@ -240,8 +240,6 @@ CheckEachTypedArray(function parametersNotCalledIfDetached(constructor) {
   var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
   %ArrayBufferNeuter(array.buffer);
 
-  // TODO(caitp): this should throw due to being invoked on a TypedArray with a
-  // detached buffer (per v8:4648).
-  array.copyWithin(tmp, tmp, tmp);
+  assertThrows(() => array.copyWithin(tmp, tmp, tmp), TypeError);
   assertEquals(0, array.length, "array.[[ViewedArrayBuffer]] is detached");
 });
diff --git a/deps/v8/test/mjsunit/es6/typedarray-every.js b/deps/v8/test/mjsunit/es6/typedarray-every.js
index 4ceee5f3aa..a3498f5786 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-every.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-every.js
@@ -159,6 +159,11 @@ function TestTypedArrayForEach(constructor) {
   assertEquals(Array.prototype.every.call(a,
       function(elt) { x += elt; return true; }), true);
   assertEquals(x, 4);
+
+  // Detached Operation
+  var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
+  %ArrayBufferNeuter(array.buffer);
+  assertThrows(() => array.every(() => true), TypeError);
 }
 
 for (i = 0; i < typedArrayConstructors.length; i++) {
diff --git a/deps/v8/test/mjsunit/es6/typedarray-fill.js b/deps/v8/test/mjsunit/es6/typedarray-fill.js
index 260e5ab08a..9ed220373b 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-fill.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-fill.js
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --allow-natives-syntax
+
 var intArrayConstructors = [
   Uint8Array,
   Int8Array,
@@ -67,6 +69,18 @@ for (var constructor of typedArrayConstructors) {
   assertArrayEquals([3, 3], [a[0], a[1]]);
   Array.prototype.fill.call(a, 4);
   assertArrayEquals([4, 3], [a[0], a[1]]);
+
+  // Detached Operation
+  var tmp = {
+    [Symbol.toPrimitive]() {
+      assertUnreachable("Parameter should not be processed when " +
+                        "array.[[ViewedArrayBuffer]] is neutered.");
+      return 0;
+    }
+  };
+  var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
+  %ArrayBufferNeuter(array.buffer);
+  assertThrows(() => array.fill(tmp), TypeError);
 }
 
 for (var constructor of intArrayConstructors) {
diff --git a/deps/v8/test/mjsunit/es6/typedarray-find.js b/deps/v8/test/mjsunit/es6/typedarray-find.js
index 69ceedc8b5..6f646e5c80 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-find.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-find.js
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --allow-natives-syntax
+
 var typedArrayConstructors = [
   Uint8Array,
   Int8Array,
@@ -184,4 +186,17 @@ assertEquals(Array.prototype.find.call(a,
     function(elt) { x += elt; return false; }), undefined);
 assertEquals(x, 4);
 
+// Detached Operation
+var tmp = {
+  [Symbol.toPrimitive]() {
+    assertUnreachable("Parameter should not be processed when " +
+                      "array.[[ViewedArrayBuffer]] is neutered.");
+    return 0;
+  }
+};
+
+var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
+%ArrayBufferNeuter(array.buffer);
+
+assertThrows(() => array.find(tmp), TypeError);
 }
diff --git a/deps/v8/test/mjsunit/es6/typedarray-findindex.js b/deps/v8/test/mjsunit/es6/typedarray-findindex.js
index 51c439203d..7447395e77 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-findindex.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-findindex.js
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --allow-natives-syntax
+
 var typedArrayConstructors = [
   Uint8Array,
   Int8Array,
@@ -184,4 +186,15 @@ assertEquals(Array.prototype.findIndex.call(a,
     function(elt) { x += elt; return false; }), -1);
 assertEquals(x, 4);
 
+// Detached Operation
+  var tmp = {
+    [Symbol.toPrimitive]() {
+      assertUnreachable("Parameter should not be processed when " +
+                        "array.[[ViewedArrayBuffer]] is neutered.");
+      return 0;
+    }
+  };
+  var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
+  %ArrayBufferNeuter(array.buffer);
+  assertThrows(() => array.findIndex(tmp), TypeError);
 }
diff --git a/deps/v8/test/mjsunit/es6/typedarray-foreach.js b/deps/v8/test/mjsunit/es6/typedarray-foreach.js
index b9789805f6..7a846b1ac7 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-foreach.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-foreach.js
@@ -148,6 +148,11 @@ function TestTypedArrayForEach(constructor) {
   assertEquals(Array.prototype.forEach.call(a,
       function(elt) { x += elt; }), undefined);
   assertEquals(x, 4);
+
+  // Detached Operation
+  var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
+  %ArrayBufferNeuter(array.buffer);
+  assertThrows(() => array.forEach(() => true), TypeError);
 }
 
 for (i = 0; i < typedArrayConstructors.length; i++) {
diff --git a/deps/v8/test/mjsunit/es6/typedarray-indexing.js b/deps/v8/test/mjsunit/es6/typedarray-indexing.js
index 1c439f9dda..d12a1570c2 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-indexing.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-indexing.js
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --allow-natives-syntax
+
 var typedArrayConstructors = [
   Uint8Array,
   Int8Array,
@@ -14,6 +16,14 @@ var typedArrayConstructors = [
   Float64Array
 ];
 
+var tmp = {
+  [Symbol.toPrimitive]() {
+    assertUnreachable("Parameter should not be processed when " +
+                      "array.[[ViewedArrayBuffer]] is neutered.");
+    return 0;
+  }
+};
+
 for (var constructor of typedArrayConstructors) {
   var array = new constructor([1, 2, 3, 1, 2, 3, 1, 2, 3, 1, 2, 3]);
 
@@ -53,6 +63,11 @@ for (var constructor of typedArrayConstructors) {
   }
   assertEquals(-1, array.indexOf(NaN));
 
+  // Detached Operation
+  var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
+  %ArrayBufferNeuter(array.buffer);
+  assertThrows(() => array.indexOf(tmp), TypeError);
+
   // ----------------------------------------------------------------------
   // %TypedArray%.prototype.lastIndexOf.
   // ----------------------------------------------------------------------
@@ -89,4 +104,9 @@ for (var constructor of typedArrayConstructors) {
     assertEquals(-1, array.lastIndexOf(-Infinity));
   }
   assertEquals(-1, array.lastIndexOf(NaN));
+
+  // Detached Operation
+  var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
+  %ArrayBufferNeuter(array.buffer);
+  assertThrows(() => array.lastIndexOf(tmp), TypeError);
 }
diff --git a/deps/v8/test/mjsunit/es6/typedarray-iteration.js b/deps/v8/test/mjsunit/es6/typedarray-iteration.js
index 9560cbc5df..b423ed0f04 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-iteration.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-iteration.js
@@ -4,6 +4,8 @@
 
 // Tests for standard TypedArray array iteration functions.
 
+// Flags: --allow-natives-syntax
+
 var typedArrayConstructors = [
   Uint8Array,
   Int8Array,
@@ -77,6 +79,11 @@ for (var constructor of typedArrayConstructors) {
     assertArrayLikeEquals([2], a.filter(function(elt) {
       return elt == 2;
     }), constructor);
+
+    // Detached Operation
+    var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
+    %ArrayBufferNeuter(array.buffer);
+    assertThrows(() => array.filter(() => false), TypeError);
   })();
 
   (function TypedArrayMapTest() {
@@ -130,6 +137,11 @@ for (var constructor of typedArrayConstructors) {
         return NaN;
       }), constructor);
     }
+
+    // Detached Operation
+    var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
+    %ArrayBufferNeuter(array.buffer);
+    assertThrows(() => array.map((v) => v), TypeError);
   })();
 
   //
@@ -189,6 +201,11 @@ for (var constructor of typedArrayConstructors) {
     assertEquals(false, Array.prototype.some.call(a, function(elt) {
       return elt == 2;
     }));
+
+    // Detached Operation
+    var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
+    %ArrayBufferNeuter(array.buffer);
+    assertThrows(() => array.some((v) => false), TypeError);
   })();
 
 }
diff --git a/deps/v8/test/mjsunit/es6/typedarray-map.js b/deps/v8/test/mjsunit/es6/typedarray-map.js
new file mode 100644
index 0000000000..54b535fd30
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/typedarray-map.js
@@ -0,0 +1,49 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var typedArrayConstructors = [
+  Uint8Array,
+  Int8Array,
+  Uint16Array,
+  Int16Array,
+  Uint32Array,
+  Int32Array,
+  Uint8ClampedArray,
+  Float32Array,
+  Float64Array];
+
+function TestTypedArrayMap(constructor) {
+  assertEquals(1, constructor.prototype.map.length);
+
+  var target;
+
+  class EscapingArray extends constructor {
+    constructor(...args) {
+      super(...args);
+      target = this;
+    }
+  }
+
+  class DetachingArray extends constructor {
+    static get [Symbol.species]() {
+      return EscapingArray;
+    }
+  }
+
+  assertThrows(function(){
+    new DetachingArray(5).map(function(v,i,a){
+      print(i);
+      if (i == 1) {
+        %ArrayBufferNeuter(target.buffer);
+      }
+    })
+  }, TypeError);
+
+}
+
+for (i = 0; i < typedArrayConstructors.length; i++) {
+  TestTypedArrayMap(typedArrayConstructors[i]);
+}
diff --git a/deps/v8/test/mjsunit/es6/typedarray-reduce.js b/deps/v8/test/mjsunit/es6/typedarray-reduce.js
index 1fddeca0bc..ba5d7f7a20 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-reduce.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-reduce.js
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --allow-natives-syntax
+
 var typedArrayConstructors = [
   Uint8Array,
   Int8Array,
@@ -247,4 +249,18 @@ for (var constructor of typedArrayConstructors) {
 
   assertEquals(1, constructor.prototype.reduce.length);
   assertEquals(1, constructor.prototype.reduceRight.length);
+
+  // Detached Operation
+  var tmp = {
+    [Symbol.toPrimitive]() {
+      assertUnreachable("Parameter should not be processed when " +
+                        "array.[[ViewedArrayBuffer]] is neutered.");
+      return 0;
+    }
+  };
+
+  var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
+  %ArrayBufferNeuter(array.buffer);
+  assertThrows(() => array.reduce(sum, tmp), TypeError);
+  assertThrows(() => array.reduceRight(sum, tmp), TypeError);
 }
diff --git a/deps/v8/test/mjsunit/es6/typedarray-reverse.js b/deps/v8/test/mjsunit/es6/typedarray-reverse.js
index f32813e155..bfeb227c5c 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-reverse.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-reverse.js
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --allow-natives-syntax
+
 function ArrayMaker(x) {
   return x;
 }
@@ -51,4 +53,11 @@ for (var constructor of arrayConstructors) {
   }
 
   assertEquals(0, a.reverse.length);
+
+  // Detached Operation
+  if (constructor != ArrayMaker) {
+    var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
+    %ArrayBufferNeuter(array.buffer);
+    assertThrows(() => array.reverse(), TypeError);
+  }
 }
diff --git a/deps/v8/test/mjsunit/es6/typedarray-slice.js b/deps/v8/test/mjsunit/es6/typedarray-slice.js
index cddc5bbdec..4fa3b9f21f 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-slice.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-slice.js
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --allow-natives-syntax
+
 var typedArrayConstructors = [
   Uint8Array,
   Int8Array,
@@ -67,6 +69,18 @@ for (var constructor of typedArrayConstructors) {
   assertEquals(3, slice[1]);
   assertTrue(slice instanceof constructor);
 
+  // Detached Operation
+  var tmp = {
+    [Symbol.toPrimitive]() {
+      assertUnreachable("Parameter should not be processed when " +
+                        "array.[[ViewedArrayBuffer]] is neutered.");
+      return 0;
+    }
+  };
+  var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
+  %ArrayBufferNeuter(array.buffer);
+  assertThrows(() => array.slice(tmp, tmp), TypeError);
+
   // Check that the species array must be a typed array
   class MyTypedArray extends constructor {
     static get[Symbol.species]() {
diff --git a/deps/v8/test/mjsunit/es6/typedarray-sort.js b/deps/v8/test/mjsunit/es6/typedarray-sort.js
index 9051a775d0..b69009b22d 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-sort.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-sort.js
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --allow-natives-syntax
+
 var typedArrayConstructors = [
   Uint8Array,
   Int8Array,
@@ -60,4 +62,9 @@ for (var constructor of typedArrayConstructors) {
   b[0] = 3; b[1] = 2; b[2] = 1;
   a.sort();
   assertArrayLikeEquals(a, [1, 2], constructor);
+
+  // Detached Operation
+  var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
+  %ArrayBufferNeuter(array.buffer);
+  assertThrows(() => array.sort(), TypeError);
 }
diff --git a/deps/v8/test/mjsunit/es6/typedarray-tostring.js b/deps/v8/test/mjsunit/es6/typedarray-tostring.js
index 9d49cb1cc9..a1fa9c7665 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-tostring.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-tostring.js
@@ -5,6 +5,8 @@
 // Array's toString should call the object's own join method, if one exists and
 // is callable. Otherwise, just use the original Object.toString function.
 
+// Flags: --allow-natives-syntax
+
 var typedArrayConstructors = [
   Uint8Array,
   Int8Array,
@@ -96,4 +98,11 @@ for (var constructor of typedArrayConstructors) {
 
     Number.prototype.toLocaleString = NumberToLocaleString;
   })();
+
+  // Detached Operation
+  var array = new constructor([1, 2, 3]);
+  %ArrayBufferNeuter(array.buffer);
+  assertThrows(() => array.join(), TypeError);
+  assertThrows(() => array.toLocalString(), TypeError);
+  assertThrows(() => array.toString(), TypeError);
 }
diff --git a/deps/v8/test/mjsunit/es6/typedarray.js b/deps/v8/test/mjsunit/es6/typedarray.js
index a483e551a9..dcfc9caa30 100644
--- a/deps/v8/test/mjsunit/es6/typedarray.js
+++ b/deps/v8/test/mjsunit/es6/typedarray.js
@@ -496,6 +496,16 @@ function TestTypedArraySet() {
     }
   }
 
+  a = new Uint32Array();
+  a.set('');
+  assertEquals(0, a.length);
+
+  assertThrows(() => a.set('abc'), RangeError);
+
+  a = new Uint8Array(3);
+  a.set('123');
+  assertArrayEquals([1, 2, 3], a);
+
   var a11 = new Int16Array([1, 2, 3, 4, 0, -1])
   var a12 = new Uint16Array(15)
   a12.set(a11, 3)
@@ -579,6 +589,21 @@ function TestTypedArraySet() {
   assertThrows(function() { a.set(0, 1); }, TypeError);
 
   assertEquals(1, a.set.length);
+
+  // Shared buffer that does not overlap.
+  var buf = new ArrayBuffer(32);
+  var a101 = new Int8Array(buf, 0, 16);
+  var b101 = new Uint8Array(buf, 16);
+  b101[0] = 42;
+  a101.set(b101);
+  assertArrayPrefix([42], a101);
+
+  buf = new ArrayBuffer(32);
+  var a101 = new Int8Array(buf, 0, 16);
+  var b101 = new Uint8Array(buf, 16);
+  a101[0] = 42;
+  b101.set(a101);
+  assertArrayPrefix([42], b101);
 }
 
 TestTypedArraySet();