deps: update V8 to 7.0.276.20

PR-URL: https://github.com/nodejs/node/pull/22754
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Refael Ackermann <refack@gmail.com>
Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

8 files changed, 238 insertions, 2 deletions

diff --git a/deps/v8/test/mjsunit/es6/array-fill-receiver.js b/deps/v8/test/mjsunit/es6/array-fill-receiver.js
new file mode 100644
index 0000000000..21d7a2ab03
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-fill-receiver.js
@@ -0,0 +1,118 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Ensure `Array.prototype.fill` functions correctly for numerous elements
+// kinds.
+
+// If no arguments are provided, call Array.p.fill without any arguments,
+// otherwise the test is allowed to specify what value to use to better control
+// ElementsKind transitions. From and to is provided by the harness.
+function callAndAssertFill(object, test_value, harness_value, from, to) {
+  let value = arguments.length > 2 ? test_value : harness_value;
+
+  Array.prototype.fill.call(object, value, from, to);
+
+  %HeapObjectVerify(object);
+  assertArrayHasValueInRange(object, value, from, to);
+}
+
+function assertArrayHasValueInRange(obj, value, from, to) {
+  for (let i = from; i < to; ++i) {
+    assertEquals(value, obj[i]);
+  }
+}
+
+// Tests are executed multiple times. Creating arrays using literal notation
+// will create COW-Arrays, which will propagate the most general ElementsKind
+// back to their allocation site.
+// pristineArray will always return a 🐄-Array with the ElementsKind we actually
+// want.
+let i = 0;
+function pristineArray(str) {
+  return eval(str + "//" + (i++));
+}
+
+let tests = {
+  ARRAY_PACKED_ELEMENTS(value, from, to) {
+    let array = pristineArray(
+        `["Some string", {}, /foobar/, "Another string", {}]`);
+    assertTrue(%HasObjectElements(array));
+    assertFalse(%HasHoleyElements(array));
+
+    callAndAssertFill(array, "42", ...arguments);
+  },
+
+  ARRAY_HOLEY_ELEMENTS(value, from, to) {
+    let array = pristineArray(`["Some string", , {}, , "Another string"]`);
+    assertTrue(%HasObjectElements(array));
+    assertTrue(%HasHoleyElements(array));
+
+    callAndAssertFill(array, "42", ...arguments);
+  },
+
+  ARRAY_PACKED_SMI_ELEMENTS(value, from, to) {
+    let array = pristineArray(`[0, -42, 5555, 23, 6]`);
+    assertTrue(%HasSmiElements(array));
+    assertFalse(%HasHoleyElements(array));
+
+    callAndAssertFill(array, 42, ...arguments);
+  },
+
+  ARRAY_HOLEY_SMI_ELEMENTS(value, from, to) {
+    let array = pristineArray(`[0, , 5555, , 6]`);
+    assertTrue(%HasSmiElements(array));
+    assertTrue(%HasHoleyElements(array));
+
+    callAndAssertFill(array, 42, ...arguments);
+  },
+
+  ARRAY_PACKED_DOUBLE_ELEMENTS(value, from, to) {
+    let array = pristineArray(`[3.14, 7.00001, NaN, -25.3333, 1.0]`);
+    assertTrue(%HasDoubleElements(array));
+    assertFalse(%HasHoleyElements(array));
+
+    callAndAssertFill(array, 42.42, ...arguments);
+  },
+
+  ARRAY_HOLEY_DOUBLE_ELEMENTS(value, from, to) {
+    let array = pristineArray(`[3.14, , , , 1.0]`);
+    assertTrue(%HasDoubleElements(array));
+    assertTrue(%HasHoleyElements(array));
+
+    callAndAssertFill(array, 42.42, ...arguments);
+  },
+
+  ARRAY_DICTIONARY_ELEMENTS(value, from, to) {
+    let array = pristineArray(`[0, , 2, 3, 4]`);
+    Object.defineProperty(array, 1, { get() { return this.foo; },
+                                      set(val) { this.foo = val; }});
+    assertTrue(%HasDictionaryElements(array));
+
+    callAndAssertFill(array, "42", ...arguments);
+  }
+
+  // TODO(szuend): Add additional tests receivers other than arrays
+  //               (Objects, TypedArrays, etc.).
+};
+
+function RunTest(test) {
+  test();
+  test(undefined);
+  test(undefined, 1);
+  test(undefined, 1, 4);
+}
+
+function RunTests(tests) {
+  Object.keys(tests).forEach(test => RunTest(tests[test]));
+}
+
+RunTests(tests);
+
+Array.prototype.__proto__ = {
+  __proto__: Array.prototype.__proto__
+};
+
+RunTests(tests);
diff --git a/deps/v8/test/mjsunit/es6/array-fill.js b/deps/v8/test/mjsunit/es6/array-fill.js
index ef316e8146..8ca41c7248 100644
--- a/deps/v8/test/mjsunit/es6/array-fill.js
+++ b/deps/v8/test/mjsunit/es6/array-fill.js
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --allow-natives-syntax
+
 assertEquals(1, Array.prototype.fill.length);
 
 assertArrayEquals([].fill(8), []);
@@ -28,3 +30,98 @@ assertArrayEquals(Object.freeze([1, 2, 3]).fill(0, 0, 0), [1, 2, 3]);
 assertThrows('Object.freeze([0]).fill()', TypeError);
 assertThrows('Array.prototype.fill.call(null)', TypeError);
 assertThrows('Array.prototype.fill.call(undefined)', TypeError);
+
+function TestFillObjectWithAccessors() {
+  const kLength = 5;
+
+  let log = [];
+
+  let object = {
+    length: kLength,
+    get 1() {
+      log.push("get 1");
+      return this.foo;
+    },
+
+    set 1(val) {
+      log.push("set 1 " + val);
+      this.foo = val;
+    }
+  };
+
+  Array.prototype.fill.call(object, 42);
+
+  %HeapObjectVerify(object);
+  assertEquals(kLength, object.length);
+  assertArrayEquals(["set 1 42"], log);
+
+  for (let i = 0; i < kLength; ++i) {
+    assertEquals(42, object[i]);
+  }
+}
+TestFillObjectWithAccessors();
+
+function TestFillObjectWithMaxNumberLength() {
+  const kMaxSafeInt = 2 ** 53 - 1;
+  let object = {};
+  object.length = kMaxSafeInt;
+
+  Array.prototype.fill.call(object, 42, 2 ** 53 - 4);
+
+  %HeapObjectVerify(object);
+  assertEquals(kMaxSafeInt, object.length);
+  assertEquals(42, object[kMaxSafeInt - 3]);
+  assertEquals(42, object[kMaxSafeInt - 2]);
+  assertEquals(42, object[kMaxSafeInt - 1]);
+}
+TestFillObjectWithMaxNumberLength();
+
+function TestFillObjectWithPrototypeAccessors() {
+  const kLength = 5;
+  let log = [];
+  let proto = {
+    get 1() {
+      log.push("get 0");
+      return this.foo;
+    },
+
+    set 1(val) {
+      log.push("set 1 " + val);
+      this.foo = val;
+    }
+  };
+
+  let object = { __proto__: proto, 0:0, 2:2, length: kLength};
+
+  Array.prototype.fill.call(object, "42");
+
+  %HeapObjectVerify(object);
+  assertEquals(kLength, object.length);
+  assertArrayEquals(["set 1 42"], log);
+  assertTrue(object.hasOwnProperty(0));
+  assertFalse(object.hasOwnProperty(1));
+  assertTrue(object.hasOwnProperty(2));
+  assertTrue(object.hasOwnProperty(3));
+  assertTrue(object.hasOwnProperty(4));
+
+  for (let i = 0; i < kLength; ++i) {
+    assertEquals("42", object[i]);
+  }
+}
+TestFillObjectWithPrototypeAccessors();
+
+function TestFillSealedObject() {
+  let object = { length: 42 };
+  Object.seal(object);
+
+  assertThrows(() => Array.prototype.fill.call(object), TypeError);
+}
+TestFillSealedObject();
+
+function TestFillFrozenObject() {
+  let object = { length: 42 };
+  Object.freeze(object);
+
+  assertThrows(() => Array.prototype.fill.call(object), TypeError);
+}
+TestFillFrozenObject();
diff --git a/deps/v8/test/mjsunit/es6/array-iterator.js b/deps/v8/test/mjsunit/es6/array-iterator.js
index b143c8c034..62485dfc2c 100644
--- a/deps/v8/test/mjsunit/es6/array-iterator.js
+++ b/deps/v8/test/mjsunit/es6/array-iterator.js
@@ -252,3 +252,16 @@ function TestNonOwnSlots() {
   }, TypeError);
 }
 TestNonOwnSlots();
+
+function TestForDictionaryArray() {
+  var array = [];
+  array[1024] = 'c';
+  assertTrue(%HasDictionaryElements(array));
+  var iterator = array[Symbol.iterator]();
+  for (var i = 0; i < 1024; ++i) {
+    assertIteratorResult(void 0, false, iterator.next());
+  }
+  assertIteratorResult('c', false, iterator.next());
+  assertIteratorResult(void 0, true, iterator.next());
+}
+TestForDictionaryArray();
diff --git a/deps/v8/test/mjsunit/es6/math-log2-log10.js b/deps/v8/test/mjsunit/es6/math-log2-log10.js
index ea17a79daf..eeacee927b 100644
--- a/deps/v8/test/mjsunit/es6/math-log2-log10.js
+++ b/deps/v8/test/mjsunit/es6/math-log2-log10.js
@@ -44,7 +44,9 @@
 for (var i = -310; i <= 308; i += 0.5) {
   assertEquals(i, Math.log10(Math.pow(10, i)));
   // Square roots are tested below.
-  if (i != -0.5 && i != 0.5) assertEquals(i, Math.log2(Math.pow(2, i)));
+  if (i != -0.5 && i != 0.5 ) {
+    assertEqualsDelta(i, Math.log2(Math.pow(2, i)), Number.EPSILON);
+  }
 }
 
 // Test denormals.
diff --git a/deps/v8/test/mjsunit/es6/promise-all-overflow-1.js b/deps/v8/test/mjsunit/es6/promise-all-overflow-1.js
index e86edbbc27..1a1cb4b61b 100644
--- a/deps/v8/test/mjsunit/es6/promise-all-overflow-1.js
+++ b/deps/v8/test/mjsunit/es6/promise-all-overflow-1.js
@@ -4,6 +4,8 @@
 
 // Flags: --allow-natives-syntax
 
+load('test/mjsunit/test-async.js');
+
 // Make sure we properly throw a RangeError when overflowing the maximum
 // number of elements for Promise.all, which is capped at 2^21 bits right
 // now, since we store the indices as identity hash on the resolve element
diff --git a/deps/v8/test/mjsunit/es6/promise-all-overflow-2.js b/deps/v8/test/mjsunit/es6/promise-all-overflow-2.js
index ece2c5b9b9..61d0bd9ce5 100644
--- a/deps/v8/test/mjsunit/es6/promise-all-overflow-2.js
+++ b/deps/v8/test/mjsunit/es6/promise-all-overflow-2.js
@@ -4,6 +4,8 @@
 
 // Flags: --allow-natives-syntax
 
+load('test/mjsunit/test-async.js');
+
 // Test that pre-allocation of the result array works even if it needs to be
 // allocated in large object space.
 const a = new Array(64 * 1024);
diff --git a/deps/v8/test/mjsunit/es6/promise-all.js b/deps/v8/test/mjsunit/es6/promise-all.js
index c60d3069a6..3a0980d425 100644
--- a/deps/v8/test/mjsunit/es6/promise-all.js
+++ b/deps/v8/test/mjsunit/es6/promise-all.js
@@ -4,6 +4,8 @@
 
 // Flags: --allow-natives-syntax
 
+load('test/mjsunit/test-async.js');
+
 // We store the index in the hash code field of the Promise.all resolve
 // element closures, so make sure we properly handle the cases where this
 // magical field turns into a PropertyArray later.
diff --git a/deps/v8/test/mjsunit/es6/proxies.js b/deps/v8/test/mjsunit/es6/proxies.js
index f67f9df41e..fc59b346b7 100644
--- a/deps/v8/test/mjsunit/es6/proxies.js
+++ b/deps/v8/test/mjsunit/es6/proxies.js
@@ -55,7 +55,7 @@ function TestWithFunctionProxy(test, x, y, z) {
 (function TestProxyProperties() {
   assertEquals(2, Proxy.length);
   assertEquals(Function.__proto__, Proxy.__proto__);
-  assertEquals(null, Proxy.prototype);
+  assertEquals(undefined, Proxy.prototype);
   assertEquals(undefined, Object.getOwnPropertyDescriptor(Proxy, "arguments"));
   assertThrows(() => Proxy.arguments, TypeError);
   assertEquals(undefined, Object.getOwnPropertyDescriptor(Proxy, "caller"));