deps: update V8 to 5.9.211.32

PR-URL: https://github.com/nodejs/node/pull/13263
Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>

14 files changed, 564 insertions, 22 deletions

diff --git a/deps/v8/test/mjsunit/es6/array-iterator-turbo.js b/deps/v8/test/mjsunit/es6/array-iterator-turbo.js
index 39c46575a6..def018eea2 100644
--- a/deps/v8/test/mjsunit/es6/array-iterator-turbo.js
+++ b/deps/v8/test/mjsunit/es6/array-iterator-turbo.js
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 // Flags: --turbo --turbo-escape --allow-natives-syntax --no-always-opt
+// Flags: --crankshaft --turbo-filter=*
 
 "use strict";
 
diff --git a/deps/v8/test/mjsunit/es6/classes.js b/deps/v8/test/mjsunit/es6/classes.js
index 816d113263..f8a1499aef 100644
--- a/deps/v8/test/mjsunit/es6/classes.js
+++ b/deps/v8/test/mjsunit/es6/classes.js
@@ -628,7 +628,7 @@ function assertAccessorDescriptor(object, name) {
 (function TestConstructorCall(){
   var realmIndex = Realm.create();
   var otherTypeError = Realm.eval(realmIndex, "TypeError");
-  var A = Realm.eval(realmIndex, '"use strict"; class A {}');
+  var A = Realm.eval(realmIndex, '"use strict"; class A {}; A');
   var instance = new A();
   var constructor = instance.constructor;
   var otherTypeError = Realm.eval(realmIndex, 'TypeError');
diff --git a/deps/v8/test/mjsunit/es6/completion.js b/deps/v8/test/mjsunit/es6/completion.js
index 9d84a90406..b9d93f41c0 100644
--- a/deps/v8/test/mjsunit/es6/completion.js
+++ b/deps/v8/test/mjsunit/es6/completion.js
@@ -8,6 +8,16 @@ function assertUndef(x) {
 }
 
 
+// ClassDeclaration
+
+assertUndef(eval('class C {}'));
+assertUndef(eval('class C {m() {}}'));
+assertUndef(eval('class C extends null {}'));
+assertEquals(42, eval('42; class C {}'));
+assertEquals(42, eval('42; class C {m() {}}'));
+assertEquals(42, eval('42; class C extends null {}'));
+
+
 // IfStatement [13.6.7]
 
 assertUndef(eval('42; if (true) ; else 0;'));  // ES5: 42
diff --git a/deps/v8/test/mjsunit/es6/generator-let-asi.js b/deps/v8/test/mjsunit/es6/generator-let-asi.js
new file mode 100644
index 0000000000..c806783aa6
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/generator-let-asi.js
@@ -0,0 +1,14 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var let = 0;
+function* generator() {
+  let
+  yield 0;
+}
+
+let it = generator();
+let {value, done} = it.next();
+assertEquals(0, value);
+assertEquals(false, done);
diff --git a/deps/v8/test/mjsunit/es6/global-proto-proxy.js b/deps/v8/test/mjsunit/es6/global-proto-proxy.js
new file mode 100644
index 0000000000..8de1a7ae0d
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/global-proto-proxy.js
@@ -0,0 +1,41 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var global = this;
+;(function () {
+  var calledDelete = false;
+  var calledGet = false;
+  var calledHas = false;
+  var calledSet = false;
+  var target = {};
+  var assertEquals = global.assertEquals;
+  var proxy = new Proxy(target, {
+    has(target, property) {
+      calledHas = true;
+      return Reflect.has(target, property);
+    },
+    get(target, property, receiver) {
+      calledGet = true;
+      return Reflect.get(target, property, receiver);
+    },
+    set(targer, property, value, receiver) {
+      calledSet = true;
+      return Reflect.set(target, property, value, receiver);
+    },
+    delete(target, property, receiver) {
+      calledDelete = true;
+      return Reflect.delete(target, property, receiver);
+    }
+  });
+  Object.setPrototypeOf(global, proxy);
+  getGlobal;
+  assertTrue(calledGet);
+  makeGlobal = 2;
+  assertTrue(calledSet);
+  "findGlobal" in global;
+  assertTrue(calledHas);
+  var deletedOwn = delete makeGlobal;
+  assertTrue(deletedOwn);
+  assertEquals(void 0, makeGlobal);
+})();
diff --git a/deps/v8/test/mjsunit/es6/regress/regress-6098.js b/deps/v8/test/mjsunit/es6/regress/regress-6098.js
new file mode 100644
index 0000000000..993f254d0f
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/regress/regress-6098.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const fn = (c) => {
+  let d = [1, 2], x = [3, 4],
+      e = null,
+      f = null;
+  0 < c.getIn(['a']) ? [e, f] = d : [e, f] = x;
+  return [e, f];
+};
+
+assertEquals([3, 4], fn({ getIn(x) { return false; } }));
+assertEquals([1, 2], fn({ getIn(x) { return true; } }));
diff --git a/deps/v8/test/mjsunit/es6/typedarray-construct-by-array-like.js b/deps/v8/test/mjsunit/es6/typedarray-construct-by-array-like.js
new file mode 100644
index 0000000000..6f3e961a27
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/typedarray-construct-by-array-like.js
@@ -0,0 +1,138 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function TestConstructSmallObject(constr) {
+  var myObject = { 0: 5, 1: 6, length: 2 };
+
+  arr = new constr(myObject);
+
+  assertEquals(2, arr.length);
+  assertEquals(5, arr[0]);
+  assertEquals(6, arr[1]);
+};
+
+function TestConstructLargeObject(constr) {
+  var myObject = {};
+  const n = 128;
+  for (var i = 0; i < n; i++) {
+    myObject[i] = i;
+  }
+  myObject.length = n;
+
+  arr = new constr(myObject);
+
+  assertEquals(n, arr.length);
+  for (var i = 0; i < n; i++) {
+    assertEquals(i, arr[i]);
+  }
+}
+
+function TestConstructFromArrayWithSideEffects(constr) {
+  var arr = [{ valueOf() { arr[1] = 20; return 1; }}, 2];
+
+  var ta = new constr(arr);
+
+  assertEquals(1, ta[0]);
+  assertEquals(2, ta[1]);
+}
+
+function TestConstructFromArrayWithSideEffectsHoley(constr) {
+  var arr = [{ valueOf() { arr[1] = 20; return 1; }}, 2, , 4];
+
+  var ta = new constr(arr);
+
+  assertEquals(1, ta[0]);
+  assertEquals(2, ta[1]);
+  // ta[2] will be the default value, but we aren't testing that here.
+  assertEquals(4, ta[3]);
+}
+
+
+function TestConstructFromArray(constr) {
+  var n = 64;
+  var jsArray = [];
+  for (var i = 0; i < n; i++) {
+    jsArray[i] = i;
+  }
+
+  var arr = new constr(jsArray);
+
+  assertEquals(n, arr.length);
+  for (var i = 0; i < n; i++) {
+    assertEquals(i, arr[i]);
+  }
+}
+
+function TestConstructFromTypedArray(constr) {
+  var n = 64;
+  var ta = new constr(n);
+  for (var i = 0; i < ta.length; i++) {
+    ta[i] = i;
+  }
+
+  var arr = new constr(ta);
+
+  assertEquals(n, arr.length);
+  for (var i = 0; i < n; i++) {
+    assertEquals(i, arr[i]);
+  }
+}
+
+function TestLengthIsMaxSmi(constr) {
+  var myObject = { 0: 5, 1: 6, length: %_MaxSmi() + 1 };
+
+  assertThrows(function() {
+    new constr(myObject);
+  }, RangeError);
+}
+
+function TestOffsetIsUsedRunner(constr, n) {
+  var buffer = new ArrayBuffer(constr.BYTES_PER_ELEMENT * n);
+
+  var whole_ta = new constr(buffer);
+  assertEquals(n, whole_ta.length);
+  for (var i = 0; i < whole_ta.length; i++) {
+    whole_ta[i] = i;
+  }
+
+  var half_ta = new constr(buffer, constr.BYTES_PER_ELEMENT * n / 2);
+  assertEquals(n / 2, half_ta.length);
+
+  var arr = new constr(half_ta);
+
+  assertEquals(n / 2, arr.length);
+  for (var i = 0; i < arr.length; i++) {
+    assertEquals(n / 2 + i, arr[i]);
+  }
+}
+
+function TestOffsetIsUsed(constr, n) {
+  TestOffsetIsUsedRunner(constr, 4);
+  TestOffsetIsUsedRunner(constr, 16);
+  TestOffsetIsUsedRunner(constr, 32);
+  TestOffsetIsUsedRunner(constr, 128);
+}
+
+Test(TestConstructSmallObject);
+Test(TestConstructLargeObject);
+Test(TestConstructFromArrayWithSideEffects);
+Test(TestConstructFromArrayWithSideEffectsHoley);
+Test(TestConstructFromArray);
+Test(TestConstructFromTypedArray);
+Test(TestLengthIsMaxSmi);
+Test(TestOffsetIsUsed);
+
+function Test(func) {
+  func(Uint8Array);
+  func(Int8Array);
+  func(Uint16Array);
+  func(Int16Array);
+  func(Uint32Array);
+  func(Int32Array);
+  func(Float32Array);
+  func(Float64Array);
+  func(Uint8ClampedArray);
+}
diff --git a/deps/v8/test/mjsunit/es6/typedarray-construct-by-buffer-ordering.js b/deps/v8/test/mjsunit/es6/typedarray-construct-by-buffer-ordering.js
new file mode 100644
index 0000000000..bd70f1901d
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/typedarray-construct-by-buffer-ordering.js
@@ -0,0 +1,81 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function TestThrowBeforeLengthToPrimitive() {
+  // From 22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] ), check
+  // that step 7:
+  //    If offset modulo elementSize ≠ 0, throw a RangeError exception.
+  // happens before step 11:
+  //    Let newLength be ? ToIndex(length).
+  var expected = ["offset.toPrimitive"];
+  var actual = [];
+  var offset = {};
+  offset[Symbol.toPrimitive] = function() {
+    actual.push("offset.toPrimitive");
+    return 1;
+  };
+
+  var length = {};
+  length[Symbol.toPrimitive] = function() {
+    actual.push("length.toPrimitive");
+    return 1;
+  };
+
+  var buffer = new ArrayBuffer(16);
+
+  assertThrows(function() {
+    new Uint32Array(buffer, offset, length)
+  }, RangeError);
+  assertEquals(expected, actual);
+})();
+
+(function TestConstructByBufferToPrimitiveOrdering() {
+  var expected = ["offset.toPrimitive", "length.toPrimitive"];
+  var actual = [];
+  var offset = {};
+  offset[Symbol.toPrimitive] = function() {
+    actual.push("offset.toPrimitive");
+    return 1;
+  };
+
+  var length = {};
+  length[Symbol.toPrimitive] = function() {
+    actual.push("length.toPrimitive");
+    return 1;
+  };
+
+  var buffer = new ArrayBuffer(16);
+  var arr = new Uint8Array(buffer, offset, length);
+
+  assertEquals(expected, actual);
+  assertEquals(1, arr.length);
+})();
+
+(function TestByteOffsetToIndexThrowsForNegative() {
+  var buffer = new ArrayBuffer(16);
+  assertThrows(function() {
+    new Uint8Array(buffer, -1);
+  }, RangeError);
+})();
+
+(function TestByArrayLikeObservableOrdering() {
+  var expected = [
+    'proxy.Symbol(Symbol.iterator)', 'proxy.length', 'proxy.0', 'proxy.1',
+    'proxy.2'
+  ];
+  var actual = [];
+
+  var a = [1, 2, 3];
+  var proxy = new Proxy(a, {
+    get: function(target, name) {
+      actual.push("proxy." + name.toString());
+      if (name === Symbol.iterator) return undefined;
+      return target[name];
+    }
+  });
+  var arr = new Uint8Array(proxy);
+
+  assertEquals(a.length, arr.length);
+  assertEquals(expected, actual);
+})();
diff --git a/deps/v8/test/mjsunit/es6/typedarray-construct-offset-not-smi.js b/deps/v8/test/mjsunit/es6/typedarray-construct-offset-not-smi.js
new file mode 100644
index 0000000000..27beb762dc
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/typedarray-construct-offset-not-smi.js
@@ -0,0 +1,58 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestBufferByteLengthNonSmi() {
+  var non_smi_byte_length = %_MaxSmi() + 1;
+
+  try {
+    var buffer = new ArrayBuffer(non_smi_byte_length);
+  } catch (e) {
+    // The ArrayBuffer allocation can fail on 32-bit archs, so no need to try to
+    // construct the typed array.
+    return;
+  }
+  var arr = new Uint16Array(buffer);
+
+  assertEquals(non_smi_byte_length, arr.byteLength);
+  assertEquals(non_smi_byte_length / 2, arr.length);
+
+  arr = new Uint32Array(buffer);
+  assertEquals(non_smi_byte_length, arr.byteLength);
+  assertEquals(non_smi_byte_length / 4, arr.length);
+})();
+
+(function TestByteOffsetNonSmi() {
+  var non_smi_byte_length = %_MaxSmi() + 11;
+  try {
+    var buffer = new ArrayBuffer(non_smi_byte_length);
+  } catch (e) {
+    // The ArrayBuffer allocation can fail on 32-bit archs, so no need to try to
+    // construct the typed array.
+    return;
+  }
+  print(buffer.byteLength);
+  var whole = new Uint16Array(buffer);
+  whole[non_smi_byte_length / 2 - 1] = 1;
+  whole[non_smi_byte_length / 2 - 2] = 2;
+  whole[non_smi_byte_length / 2 - 3] = 3;
+  whole[non_smi_byte_length / 2 - 4] = 4;
+  whole[non_smi_byte_length / 2 - 5] = 5;
+
+  assertEquals(non_smi_byte_length / 2, whole.length);
+  assertEquals(1, whole[non_smi_byte_length / 2 - 1]);
+
+  var arr = new Uint16Array(buffer, non_smi_byte_length - 10, 5);
+
+  assertEquals(non_smi_byte_length, arr.buffer.byteLength);
+  assertEquals(10, arr.byteLength);
+  assertEquals(5, arr.length);
+
+  assertEquals(5, arr[0]);
+  assertEquals(4, arr[1]);
+  assertEquals(3, arr[2]);
+  assertEquals(2, arr[3]);
+  assertEquals(1, arr[4]);
+})();
diff --git a/deps/v8/test/mjsunit/es6/typedarray-every.js b/deps/v8/test/mjsunit/es6/typedarray-every.js
index 22132f32b1..4ceee5f3aa 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-every.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-every.js
@@ -98,6 +98,20 @@ function TestTypedArrayForEach(constructor) {
   CheckTypedArrayIsNeutered(a);
   assertEquals(undefined, a[0]);
 
+  // Calling array.buffer midway can change the backing store.
+  a = new constructor(5);
+  a[0] = 42;
+  result = a.every(function (n, index, array) {
+    assertSame(a, array);
+    if (index == 2) {
+      (new constructor(array.buffer))[(index + 1) % 5] = 42;
+    } else {
+      a[(index+1)%5] = 42
+    }
+    return n == 42;
+  });
+  assertEquals(true, result);
+
   // The method must work for typed arrays created from ArrayBuffer.
   // The length of the ArrayBuffer is chosen so it is a multiple of
   // all lengths of the typed array items.
diff --git a/deps/v8/test/mjsunit/es6/typedarray-fill.js b/deps/v8/test/mjsunit/es6/typedarray-fill.js
index 2c612016f6..260e5ab08a 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-fill.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-fill.js
@@ -2,44 +2,96 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-var typedArrayConstructors = [
+var intArrayConstructors = [
   Uint8Array,
   Int8Array,
   Uint16Array,
   Int16Array,
   Uint32Array,
   Int32Array,
-  Uint8ClampedArray,
+  Uint8ClampedArray
+];
+
+var floatArrayConstructors = [
   Float32Array,
-  Float64Array];
+  Float64Array
+];
+
+var typedArrayConstructors = [...intArrayConstructors, ...floatArrayConstructors];
 
 for (var constructor of typedArrayConstructors) {
   assertEquals(1, constructor.prototype.fill.length);
 
-  assertArrayEquals(new constructor([]).fill(8), []);
-  assertArrayEquals(new constructor([0, 0, 0, 0, 0]).fill(8), [8, 8, 8, 8, 8]);
-  assertArrayEquals(new constructor([0, 0, 0, 0, 0]).fill(8, 1), [0, 8, 8, 8, 8]);
-  assertArrayEquals(new constructor([0, 0, 0, 0, 0]).fill(8, 10), [0, 0, 0, 0, 0]);
-  assertArrayEquals(new constructor([0, 0, 0, 0, 0]).fill(8, -5), [8, 8, 8, 8, 8]);
-  assertArrayEquals(new constructor([0, 0, 0, 0, 0]).fill(8, 1, 4), [0, 8, 8, 8, 0]);
-  assertArrayEquals(new constructor([0, 0, 0, 0, 0]).fill(8, 1, -1), [0, 8, 8, 8, 0]);
-  assertArrayEquals(new constructor([0, 0, 0, 0, 0]).fill(8, 1, 42), [0, 8, 8, 8, 8]);
-  assertArrayEquals(new constructor([0, 0, 0, 0, 0]).fill(8, -3, 42), [0, 0, 8, 8, 8]);
-  assertArrayEquals(new constructor([0, 0, 0, 0, 0]).fill(8, -3, 4), [0, 0, 8, 8, 0]);
-  assertArrayEquals(new constructor([0, 0, 0, 0, 0]).fill(8, -2, -1), [0, 0, 0, 8, 0]);
-  assertArrayEquals(new constructor([0, 0, 0, 0, 0]).fill(8, -1, -3), [0, 0, 0, 0, 0]);
-  assertArrayEquals(new constructor([0, 0, 0, 0, 0]).fill(8, 0, 4), [8, 8, 8, 8, 0]);
+  assertArrayEquals([], new constructor([]).fill(8));
+  assertArrayEquals([8, 8, 8, 8, 8], new constructor([0, 0, 0, 0, 0]).fill(8));
+  assertArrayEquals([0, 8, 8, 8, 8], new constructor([0, 0, 0, 0, 0]).fill(8, 1));
+  assertArrayEquals([0, 0, 0, 0, 0], new constructor([0, 0, 0, 0, 0]).fill(8, 10));
+  assertArrayEquals([8, 8, 8, 8, 8], new constructor([0, 0, 0, 0, 0]).fill(8, -5));
+  assertArrayEquals([0, 8, 8, 8, 0], new constructor([0, 0, 0, 0, 0]).fill(8, 1, 4));
+  assertArrayEquals([0, 8, 8, 8, 0], new constructor([0, 0, 0, 0, 0]).fill(8, 1, -1));
+  assertArrayEquals([0, 8, 8, 8, 8], new constructor([0, 0, 0, 0, 0]).fill(8, 1, 42));
+  assertArrayEquals([0, 0, 8, 8, 8], new constructor([0, 0, 0, 0, 0]).fill(8, -3, 42));
+  assertArrayEquals([0, 0, 8, 8, 0], new constructor([0, 0, 0, 0, 0]).fill(8, -3, 4));
+  assertArrayEquals([0, 0, 0, 8, 0], new constructor([0, 0, 0, 0, 0]).fill(8, -2, -1));
+  assertArrayEquals([0, 0, 0, 0, 0], new constructor([0, 0, 0, 0, 0]).fill(8, -1, -3));
+  assertArrayEquals([8, 8, 8, 8, 0], new constructor([0, 0, 0, 0, 0]).fill(8, 0, 4));
+
+  assertArrayEquals([0, 0, 0, 0, 0], new constructor([0, 0, 0, 0, 0]).fill(8, Infinity));
+  assertArrayEquals([8, 8, 8, 8, 8], new constructor([0, 0, 0, 0, 0]).fill(8, -Infinity));
+  assertArrayEquals([8, 8, 8, 8, 8], new constructor([0, 0, 0, 0, 0]).fill(8, 0, Infinity));
+  assertArrayEquals([0, 0, 0, 0, 0], new constructor([0, 0, 0, 0, 0]).fill(8, 0, -Infinity));
 
   // Test exceptions
   assertThrows('constructor.prototype.fill.call(null)', TypeError);
   assertThrows('constructor.prototype.fill.call(undefined)', TypeError);
   assertThrows('constructor.prototype.fill.call([])', TypeError);
 
+  assertArrayEquals([0, 0, 0, 0, 0], new constructor([0, 0, 0, 0, 0]).fill(false));
+  assertArrayEquals([1, 1, 1, 1, 1], new constructor([0, 0, 0, 0, 0]).fill(true));
+  assertArrayEquals([0, 0, 0, 0, 0], new constructor([0, 0, 0, 0, 0]).fill(null));
+  assertArrayEquals([8, 8, 8, 8, 8], new constructor([0, 0, 0, 0, 0]).fill("8"));
+
+  // Test ToNumber
+  var n = 1;
+  assertArrayEquals([1, 1], new constructor(2).fill({ valueOf() { return n++; } }));
+  assertEquals(2, n);
+  var s = [];
+  var p = new Proxy({}, { get(t,k) { s.push(k.toString()); return Reflect.get(t,k)} });
+  new constructor(3).fill(p);
+  assertEquals(["Symbol(Symbol.toPrimitive)", "valueOf", "toString", "Symbol(Symbol.toStringTag)"], s);
+
   // Shadowing length doesn't affect fill, unlike Array.prototype.fill
   var a = new constructor([2, 2]);
   Object.defineProperty(a, 'length', {value: 1});
   a.fill(3);
-  assertArrayEquals([a[0], a[1]], [3, 3]);
+  assertArrayEquals([3, 3], [a[0], a[1]]);
   Array.prototype.fill.call(a, 4);
-  assertArrayEquals([a[0], a[1]], [4, 3]);
+  assertArrayEquals([4, 3], [a[0], a[1]]);
 }
+
+for (var constructor of intArrayConstructors) {
+  assertArrayEquals([0, 0, 0, 0, 0], new constructor([0, 0, 0, 0, 0]).fill(undefined));
+  assertArrayEquals([0, 0, 0, 0, 0], new constructor([0, 0, 0, 0, 0]).fill());
+  assertArrayEquals([0, 0, 0, 0, 0], new constructor([0, 0, 0, 0, 0]).fill("abcd"));
+}
+
+for (var constructor of floatArrayConstructors) {
+  assertArrayEquals([NaN, NaN, NaN, NaN, NaN], new constructor([0, 0, 0, 0, 0]).fill(undefined));
+  assertArrayEquals([NaN, NaN, NaN, NaN, NaN], new constructor([0, 0, 0, 0, 0]).fill());
+  assertArrayEquals([NaN, NaN, NaN, NaN, NaN], new constructor([0, 0, 0, 0, 0]).fill("abcd"));
+}
+
+// Clamping
+assertArrayEquals([0, 0, 0, 0, 0], new Uint8ClampedArray([0, 0, 0, 0, 0]).fill(-10));
+assertArrayEquals([255, 255, 255, 255, 255], new Uint8ClampedArray([0, 0, 0, 0, 0]).fill(1000));
+
+assertArrayEquals([1, 1, 1, 1, 1], new Uint8ClampedArray([0, 0, 0, 0, 0]).fill(0.50001));
+assertArrayEquals([0, 0, 0, 0, 0], new Uint8ClampedArray([0, 0, 0, 0, 0]).fill(0.50000));
+assertArrayEquals([0, 0, 0, 0, 0], new Uint8ClampedArray([0, 0, 0, 0, 0]).fill(0.49999));
+// Check round half to even
+assertArrayEquals([2, 2, 2, 2, 2], new Uint8ClampedArray([0, 0, 0, 0, 0]).fill(1.50000));
+assertArrayEquals([2, 2, 2, 2, 2], new Uint8ClampedArray([0, 0, 0, 0, 0]).fill(2.50000));
+assertArrayEquals([3, 3, 3, 3, 3], new Uint8ClampedArray([0, 0, 0, 0, 0]).fill(2.50001));
+// Check infinity clamping.
+assertArrayEquals([0, 0, 0, 0, 0], new Uint8ClampedArray([0, 0, 0, 0, 0]).fill(-Infinity));
+assertArrayEquals([255, 255, 255, 255, 255], new Uint8ClampedArray([0, 0, 0, 0, 0]).fill(Infinity));
diff --git a/deps/v8/test/mjsunit/es6/typedarray-indexing.js b/deps/v8/test/mjsunit/es6/typedarray-indexing.js
index 44472e3eb3..1c439f9dda 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-indexing.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-indexing.js
@@ -42,6 +42,16 @@ for (var constructor of typedArrayConstructors) {
   Object.defineProperty(array, 'length', {value: 1});
   assertEquals(array.indexOf(2), 1);
 
+  // Index of infinite value
+  array = new constructor([NaN, 2, 3, +Infinity, -Infinity, 5, 6]);
+  if (constructor == Float32Array || constructor == Float64Array) {
+    assertEquals(3, array.indexOf(Infinity));
+    assertEquals(4, array.indexOf(-Infinity));
+  } else {
+    assertEquals(-1, array.indexOf(Infinity));
+    assertEquals(-1, array.indexOf(-Infinity));
+  }
+  assertEquals(-1, array.indexOf(NaN));
 
   // ----------------------------------------------------------------------
   // %TypedArray%.prototype.lastIndexOf.
@@ -68,4 +78,15 @@ for (var constructor of typedArrayConstructors) {
   Object.defineProperty(array, 'length', {value: 1});
   assertEquals(array.lastIndexOf(2), 10);
   delete array.length;
+
+  // Index of infinite value
+  array = new constructor([NaN, 2, 3, +Infinity, -Infinity, 5, 6]);
+  if (constructor == Float32Array || constructor == Float64Array) {
+    assertEquals(3, array.lastIndexOf(Infinity));
+    assertEquals(4, array.lastIndexOf(-Infinity));
+  } else {
+    assertEquals(-1, array.lastIndexOf(Infinity));
+    assertEquals(-1, array.lastIndexOf(-Infinity));
+  }
+  assertEquals(-1, array.lastIndexOf(NaN));
 }
diff --git a/deps/v8/test/mjsunit/es6/typedarray-slice.js b/deps/v8/test/mjsunit/es6/typedarray-slice.js
index ddd021a8fa..cddc5bbdec 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-slice.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-slice.js
@@ -57,9 +57,7 @@ for (var constructor of typedArrayConstructors) {
   assertEquals(7, array.slice(0, 100).length);
 
   // Does not permit being called on other types
-  assertThrows(function () {
-    constructor.prototype.slice.call([], 0, 0);
-  }, TypeError);
+  assertThrows(() => constructor.prototype.slice.call([], 0, 0), TypeError);
 
   // Check that elements are copied properly in slice
   array = new constructor([1, 2, 3, 4]);
@@ -68,4 +66,71 @@ for (var constructor of typedArrayConstructors) {
   assertEquals(2, slice[0]);
   assertEquals(3, slice[1]);
   assertTrue(slice instanceof constructor);
+
+  // Check that the species array must be a typed array
+  class MyTypedArray extends constructor {
+    static get[Symbol.species]() {
+      return Array;
+    }
+  }
+  var arr = new MyTypedArray([-1.0, 0, 1.1, 255, 256]);
+  assertThrows(() => arr.slice(), TypeError);
+}
+
+// Check that the result array is properly created by checking species
+for (var constructor1 of typedArrayConstructors) {
+  for (var constructor2 of typedArrayConstructors) {
+    testCustomSubclass(constructor1, constructor2);
+    testSpeciesConstructor(constructor1, constructor2);
+  }
+}
+
+function testSpeciesConstructor(cons1, cons2) {
+  var ta = new cons1([1, 2, 3, 4, 5, 6]);
+  ta.constructor = {
+    [Symbol.species]: cons2
+  };
+  assertArrayEquals([4, 5, 6], ta.slice(3));
+}
+
+function testCustomSubclass(superClass, speciesClass) {
+  // Simple subclass that has another TypedArray as species
+  class CustomTypedArray extends superClass {
+    static get[Symbol.species]() {
+      return speciesClass;
+    }
+  }
+  // 16 entries.
+  let exampleArray = [-1.0, 0, 1.1, 255, 256, 0xFFFFFFFF, 2**50, NaN];
+  let customArray = new CustomTypedArray(exampleArray);
+  let basicArray = new superClass(exampleArray);
+  assertEquals(new speciesClass(basicArray), customArray.slice(),
+               superClass.name + ' -> ' + speciesClass.name);
+
+  // Custom constructor with shared buffer.
+  exampleArray =  new Array(64).fill(0).map((v,i) => i);
+  let filledBuffer = new Uint8Array(exampleArray).buffer;
+  // Create a view for the begining of the buffer.
+  let customArray2 = new superClass(filledBuffer, 0, 3);
+  customArray2.constructor = {
+    [Symbol.species]: function(length) {
+      let bytes_per_element = speciesClass.BYTES_PER_ELEMENT;
+      // Reuse the same buffer for the custom species constructor.
+      // Skip the first BYTES_PER_ELEMENT bytes of the buffer.
+      return new speciesClass(filledBuffer, bytes_per_element, length);
+    }
+  };
+  // Since slice is defined iteratively, the species created new array uses the
+  // same underlying buffer shifted by one element. Hence the first value is
+  // copied over and over again.
+  let convertedCopy = Array.from(customArray2);
+  let firstValue = convertedCopy[0];
+  assertEquals(firstValue, customArray2[0]);
+  let sliceResult = customArray2.slice();
+  if (superClass == speciesClass) {
+    assertEquals(new Array(3).fill(firstValue), Array.from(customArray2));
+    assertEquals(new Array(3).fill(firstValue), Array.from(sliceResult));
+  }
+  assertEquals(3, customArray2.length);
+  assertEquals(3, sliceResult.length);
 }
diff --git a/deps/v8/test/mjsunit/es6/typedarray.js b/deps/v8/test/mjsunit/es6/typedarray.js
index ca68db96c9..a483e551a9 100644
--- a/deps/v8/test/mjsunit/es6/typedarray.js
+++ b/deps/v8/test/mjsunit/es6/typedarray.js
@@ -259,6 +259,8 @@ function TestTypedArray(constr, elementSize, typicalElement) {
 
   assertThrows(function() { new constr(Symbol()); }, TypeError);
 
+  assertThrows(function() { new constr(-1); }, RangeError);
+
   var jsArray = [];
   for (i = 0; i < 30; i++) {
     jsArray.push(typicalElement);
@@ -822,3 +824,34 @@ function TestNonConfigurableProperties(constructor) {
 for(i = 0; i < typedArrayConstructors.length; i++) {
   TestNonConfigurableProperties(typedArrayConstructors[i]);
 }
+
+(function TestInitialization() {
+  for (var i = 0; i <= 128; i++) {
+    var arr = new Uint8Array(i);
+    for (var j = 0; j < i; j++) {
+      assertEquals(0, arr[j]);
+    }
+  }
+})();
+
+(function TestBufferLengthTooLong() {
+  try {
+    var buf = new ArrayBuffer(2147483648);
+  } catch (e) {
+    // The ArrayBuffer allocation fails on 32-bit archs, so no need to try to
+    // construct the typed array.
+    return;
+  }
+  assertThrows(function() {
+    new Int8Array(buf);
+  }, RangeError);
+})();
+
+(function TestByteLengthErrorMessage() {
+  try {
+    new Uint32Array(new ArrayBuffer(17));
+  } catch (e) {
+    assertEquals("byte length of Uint32Array should be a multiple of 4",
+                 e.message);
+  }
+})();