deps: update V8 to 5.8.283.38

PR-URL: https://github.com/nodejs/node/pull/12784
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>

18 files changed, 627 insertions, 35 deletions

diff --git a/deps/v8/test/mjsunit/es6/array-iterator-turbo.js b/deps/v8/test/mjsunit/es6/array-iterator-turbo.js
index c1b8d32072..39c46575a6 100644
--- a/deps/v8/test/mjsunit/es6/array-iterator-turbo.js
+++ b/deps/v8/test/mjsunit/es6/array-iterator-turbo.js
@@ -2,25 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --turbo --turbo-escape --allow-natives-syntax
+// Flags: --turbo --turbo-escape --allow-natives-syntax --no-always-opt
 
 "use strict";
 
-const kDeoptimized = 2;
-const kTurbofanned = 7;
-const kInterpreted = 8;
-
-function GetOptimizationStatus(fn) {
-  let status = %GetOptimizationStatus(fn);
-  switch (status) {
-  case kInterpreted: // Treat interpreted frames as unoptimized
-    status = kDeoptimized;
-    break;
-  }
-
-  return status;
-}
-
 let global = this;
 let tests = {
   FastElementsKind() {
@@ -118,15 +103,27 @@ let tests = {
 
       // TODO(bmeurer): FAST_HOLEY_DOUBLE_ELEMENTS maps generally deopt when
       // a hole is encountered. Test should be fixed once that is corrected.
-      let status = /HOLEY_DOUBLE/.test(key) ? kDeoptimized : kTurbofanned;
+      let expect_deopt = /HOLEY_DOUBLE/.test(key);
 
-      assertEquals(status, GetOptimizationStatus(fn), key);
+      if (expect_deopt) {
+        assertUnoptimized(fn, '', key);
+      } else {
+        assertOptimized(fn, '', key);
+      }
       assertEquals(expected, fn(array), key);
-      assertEquals(status, GetOptimizationStatus(fn), key);
+      if (expect_deopt) {
+        assertUnoptimized(fn, '', key);
+      } else {
+        assertOptimized(fn, '', key);
+      }
 
-      // Check no deopt when another arra with the same map is used
+      // Check no deopt when another array with the same map is used
       assertTrue(%HaveSameMap(array, array2), key);
-      assertEquals(status, GetOptimizationStatus(fn), key);
+      if (expect_deopt) {
+        assertUnoptimized(fn, '', key);
+      } else {
+        assertOptimized(fn, '', key);
+      }
       assertEquals(expected2, fn(array2), key);
 
       // CheckMaps bailout
@@ -134,7 +131,7 @@ let tests = {
           [1, 2, 3], 2, { enumerable: false, configurable: false,
                           get() { return 7; } });
       fn(newArray);
-      assertEquals(kDeoptimized, GetOptimizationStatus(fn), key);
+      assertUnoptimized(fn, '', key);
     }
   },
 
@@ -222,12 +219,12 @@ let tests = {
       %OptimizeFunctionOnNextCall(sum);
       assertEquals(expected, sum(array), key);
 
-      assertEquals(kTurbofanned, GetOptimizationStatus(sum), key);
+      assertOptimized(sum, '', key);
 
       // Not deoptimized when called on typed array of same type / map
       assertTrue(%HaveSameMap(array, array2));
       assertEquals(expected2, sum(array2), key);
-      assertEquals(kTurbofanned, GetOptimizationStatus(sum), key);
+      assertOptimized(sum, '', key);
 
       // Throw when detached
       let clone = new array.constructor(array);
diff --git a/deps/v8/test/mjsunit/es6/block-let-crankshaft-sloppy.js b/deps/v8/test/mjsunit/es6/block-let-crankshaft-sloppy.js
index b5e81f7850..d06153ed8a 100644
--- a/deps/v8/test/mjsunit/es6/block-let-crankshaft-sloppy.js
+++ b/deps/v8/test/mjsunit/es6/block-let-crankshaft-sloppy.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --crankshaft
 
 // Check that the following functions are optimizable.
 var functions = [ f1, f2, f3, f4, f5, f6, f7, f8, f9, f10, f11, f12, f13, f14,
@@ -478,5 +478,5 @@ for (var i=0; i<10; i++) {
 f(12);
 g(12);
 
-assertTrue(%GetOptimizationStatus(f) != 2);
-assertTrue(%GetOptimizationStatus(g) != 2);
+assertOptimized(f);
+assertOptimized(g);
diff --git a/deps/v8/test/mjsunit/es6/block-let-crankshaft.js b/deps/v8/test/mjsunit/es6/block-let-crankshaft.js
index 9cfdf847fc..99a8b52968 100644
--- a/deps/v8/test/mjsunit/es6/block-let-crankshaft.js
+++ b/deps/v8/test/mjsunit/es6/block-let-crankshaft.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --crankshaft
 
 "use strict";
 
@@ -480,5 +480,5 @@ for (var i=0; i<10; i++) {
 f(12);
 g(12);
 
-assertTrue(%GetOptimizationStatus(f) != 2);
-assertTrue(%GetOptimizationStatus(g) != 2);
+assertOptimized(f);
+assertOptimized(g);
diff --git a/deps/v8/test/mjsunit/es6/block-scoping-sloppy.js b/deps/v8/test/mjsunit/es6/block-scoping-sloppy.js
index f5c5a6326b..29eadb17d1 100644
--- a/deps/v8/test/mjsunit/es6/block-scoping-sloppy.js
+++ b/deps/v8/test/mjsunit/es6/block-scoping-sloppy.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --crankshaft
 // Test functionality of block scopes.
 
 // Hoisting of var declarations.
@@ -40,7 +40,7 @@ function f1() {
 for (var j = 0; j < 5; ++j) f1();
 %OptimizeFunctionOnNextCall(f1);
 f1();
-assertTrue(%GetOptimizationStatus(f1) != 2);
+assertOptimized(f1);
 
 // Dynamic lookup in and through block contexts.
 function f2(one) {
diff --git a/deps/v8/test/mjsunit/es6/block-scoping.js b/deps/v8/test/mjsunit/es6/block-scoping.js
index 0308edde96..ec13592977 100644
--- a/deps/v8/test/mjsunit/es6/block-scoping.js
+++ b/deps/v8/test/mjsunit/es6/block-scoping.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --crankshaft
 // Test functionality of block scopes.
 
 "use strict";
@@ -42,7 +42,7 @@ function f1() {
 for (var j = 0; j < 5; ++j) f1();
 %OptimizeFunctionOnNextCall(f1);
 f1();
-assertTrue(%GetOptimizationStatus(f1) != 2);
+assertOptimized(f1);
 
 // Dynamic lookup in and through block contexts.
 function f2(one) {
diff --git a/deps/v8/test/mjsunit/es6/call-with-spread-modify-array-iterator.js b/deps/v8/test/mjsunit/es6/call-with-spread-modify-array-iterator.js
new file mode 100644
index 0000000000..a68e2960f6
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/call-with-spread-modify-array-iterator.js
@@ -0,0 +1,37 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function modifyArrayIterator() {
+  'use strict';
+
+  function maxWithZero(...args) {
+    return Math.max(0, ...args);
+  }
+
+  function testMax(x, y) {
+    return maxWithZero(x, y);
+  }
+
+  testMax(1, 2);
+  testMax(1, 2);
+  % OptimizeFunctionOnNextCall(testMax);
+  var r = testMax(1, 2);
+
+  assertEquals(2, r);
+
+  Object.defineProperty(Array.prototype, Symbol.iterator, {
+    value: function*
+        () {
+          yield 3;
+          yield 4;
+        },
+    configurable: true
+  });
+
+  var r2 = testMax(1, 2);
+
+  assertEquals(4, r2);
+})();
diff --git a/deps/v8/test/mjsunit/es6/call-with-spread-modify-next.js b/deps/v8/test/mjsunit/es6/call-with-spread-modify-next.js
new file mode 100644
index 0000000000..d206a14d35
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/call-with-spread-modify-next.js
@@ -0,0 +1,42 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function modifyNext() {
+  'use strict';
+
+  var a = [];
+  var ai = a[Symbol.iterator]();
+
+  var original_next = ai.__proto__['next'];
+
+  function maxWithZero(...args) {
+    return Math.max(0, ...args);
+  }
+
+  function testMax(x, y) {
+    return maxWithZero(x, y);
+  }
+
+  testMax(1, 2);
+  testMax(1, 2);
+  % OptimizeFunctionOnNextCall(testMax);
+  var r = testMax(1, 2);
+
+  assertEquals(2, r);
+
+  var called = 0;
+  Object.defineProperty(ai.__proto__, 'next', {
+    get: function() {
+      called++;
+      return original_next;
+    }
+  });
+
+  var r2 = testMax(1, 2);
+
+  assertEquals(3, called);
+  assertEquals(2, r2);
+})();
diff --git a/deps/v8/test/mjsunit/es6/call-with-spread.js b/deps/v8/test/mjsunit/es6/call-with-spread.js
new file mode 100644
index 0000000000..e372e416d0
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/call-with-spread.js
@@ -0,0 +1,113 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+  'use strict';
+
+  function testBaselineAndOpt(func) {
+    func(-1, -2);
+    func(-1, -2);
+    % OptimizeFunctionOnNextCall(func);
+    return func(-1, -2);
+  }
+
+  // Rest parameters
+
+  function RestMax(...args) {
+    return Math.max(...args);
+  }
+
+  var r = testBaselineAndOpt(function(x, y) {
+    return RestMax(x, y);
+  });
+  assertEquals(r, -1);
+
+  function RestMaxWithZero(...args) {
+    return Math.max(0, ...args);
+  }
+
+  var r = testBaselineAndOpt(function(x, y) {
+    return RestMaxWithZero(x, y);
+  });
+  assertEquals(r, 0);
+
+  function RestMaxOneArg(x, ...args) {
+    return Math.max(-10, ...args);
+  }
+
+  r = testBaselineAndOpt(function(x, y) {
+    return RestMaxOneArg(x, y);
+  });
+  assertEquals(r, -2);
+
+  // Strict Arguments Object
+
+  function ArgumentsMax() {
+    return Math.max(...arguments);
+  }
+
+  var r = testBaselineAndOpt(function(x, y) {
+    return ArgumentsMax(x, y);
+  });
+  assertEquals(r, -1);
+
+  function ArgumentsMaxWithZero() {
+    return Math.max(0, ...arguments);
+  }
+
+  var r = testBaselineAndOpt(function(x, y) {
+    return ArgumentsMaxWithZero(x, y);
+  });
+  assertEquals(r, 0);
+
+  function ArgumentsMaxOneArg(x) {
+    return Math.max(-10, ...arguments);
+  }
+
+  var r = testBaselineAndOpt(function(x, y) {
+    return ArgumentsMaxOneArg(x, y);
+  });
+  assertEquals(r, -1);
+
+})();
+
+(function() {
+  function testBaselineAndOpt(func) {
+    func(-1, -2);
+    func(-1, -2);
+    % OptimizeFunctionOnNextCall(func);
+    return func(-1, -2);
+  }
+
+  // Sloppy Arguments Object
+
+  function ArgumentsMax() {
+    return Math.max(...arguments);
+  }
+
+  var r = testBaselineAndOpt(function(x, y) {
+    return ArgumentsMax(x, y);
+  });
+  assertEquals(r, -1);
+
+  function ArgumentsMaxWithZero() {
+    return Math.max(0, ...arguments);
+  }
+
+  var r = testBaselineAndOpt(function(x, y) {
+    return ArgumentsMaxWithZero(x, y);
+  });
+  assertEquals(r, 0);
+
+  function ArgumentsMaxOneArg(x) {
+    return Math.max(-10, ...arguments);
+  }
+
+  var r = testBaselineAndOpt(function(x, y) {
+    return ArgumentsMaxOneArg(x, y);
+  });
+  assertEquals(r, -1);
+})();
diff --git a/deps/v8/test/mjsunit/es6/promises.js b/deps/v8/test/mjsunit/es6/promises.js
index 0af7a882e7..6e20d684ff 100644
--- a/deps/v8/test/mjsunit/es6/promises.js
+++ b/deps/v8/test/mjsunit/es6/promises.js
@@ -34,6 +34,9 @@ var defineProperty = Object.defineProperty;
 var numberPrototype = Number.prototype;
 var symbolIterator = Symbol.iterator;
 
+function assertUnreachable() {
+  %AbortJS("Failure: unreachable");
+}
 
 (function() {
   // Test before clearing global (fails otherwise)
@@ -982,7 +985,7 @@ function assertAsyncDone(iteration) {
   var promise = new Promise(function(res) { resolve = res; });
   resolve({ then() { thenCalled = true; throw new Error(); } });
   assertLater(function() { return thenCalled; }, "resolve-with-thenable");
-});
+})();
 
 (function() {
   var calledWith;
diff --git a/deps/v8/test/mjsunit/es6/reflect-construct.js b/deps/v8/test/mjsunit/es6/reflect-construct.js
index 4661b4093b..9de5158005 100644
--- a/deps/v8/test/mjsunit/es6/reflect-construct.js
+++ b/deps/v8/test/mjsunit/es6/reflect-construct.js
@@ -17,6 +17,30 @@
 })();
 
 
+(function testReflectConstructArg1NonConstructor() {
+  try {
+    Reflect.construct(() => {}, []);
+  } catch (e) {
+    assertInstanceof(e, TypeError);
+    assertEquals("() => {} is not a constructor", e.message);
+    return;
+  }
+  assertUnreachable("Exception expected");
+})();
+
+
+(function testReflectConstructArg3NonConstructor() {
+  try {
+    Reflect.construct(function() {}, [], () => {});
+  } catch (e) {
+    assertInstanceof(e, TypeError);
+    assertEquals("() => {} is not a constructor", e.message);
+    return;
+  }
+  assertUnreachable("Exception expected");
+})();
+
+
 (function testReflectConstructBasic() {
   function Constructor() { "use strict"; }
   assertInstanceof(Reflect.construct(Constructor, []), Constructor);
diff --git a/deps/v8/test/mjsunit/es6/regress/regress-5929-1.js b/deps/v8/test/mjsunit/es6/regress/regress-5929-1.js
new file mode 100644
index 0000000000..94e143fa77
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/regress/regress-5929-1.js
@@ -0,0 +1,14 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var buf = new ArrayBuffer(0x10000);
+var arr = new Uint8Array(buf).fill(55);
+var tmp = {};
+tmp[Symbol.toPrimitive] = function () {
+  %ArrayBufferNeuter(arr.buffer);
+  return 50;
+}
+arr.copyWithin(tmp);
diff --git a/deps/v8/test/mjsunit/es6/spread-call-new-class.js b/deps/v8/test/mjsunit/es6/spread-call-new-class.js
index de88cff5d1..9ec8660918 100644
--- a/deps/v8/test/mjsunit/es6/spread-call-new-class.js
+++ b/deps/v8/test/mjsunit/es6/spread-call-new-class.js
@@ -88,3 +88,82 @@
   assertEquals(["extra", 1, 2, 3], c.baseArgs);
   assertEquals([1, 2, 3], c.childArgs);
 })();
+
+(function testArgumentsObjectStrict() {
+  "use strict";
+  class Base {
+    constructor(...args) {
+      this.baseArgs = args;
+    }
+    method() { return this.baseArgs; }
+  }
+
+  class Child extends Base {
+    constructor() {
+      super(...arguments);
+      this.childArgs = arguments;
+    }
+  }
+
+  class Child2 extends Base {
+    constructor() {
+      super("extra", ...arguments);
+      this.childArgs = arguments;
+    }
+  }
+
+  var c = new Child(...[1, 2, 3]);
+  assertInstanceof(c, Child);
+  assertInstanceof(c, Base);
+  assertEquals([1, 2, 3], c.method());
+  assertEquals([1, 2, 3], c.baseArgs);
+  assertFalse(Array.__proto__ === c.childArgs.__proto__);
+  assertEquals([1, 2, 3], Array.prototype.slice.call(c.childArgs));
+
+  c = new Child2(...[1, 2, 3]);
+  assertInstanceof(c, Child2);
+  assertInstanceof(c, Base);
+  assertEquals(["extra", 1, 2, 3], c.method());
+  assertEquals(["extra", 1, 2, 3], c.baseArgs);
+  assertFalse(Array.__proto__ === c.childArgs.__proto__);
+  assertEquals([1, 2, 3], Array.prototype.slice.call(c.childArgs));
+})();
+
+(function testArgumentsObjectSloppy() {
+  class Base {
+    constructor(...args) {
+      this.baseArgs = args;
+    }
+    method() { return this.baseArgs; }
+  }
+
+  class Child extends Base {
+    constructor() {
+      super(...arguments);
+      this.childArgs = arguments;
+    }
+  }
+
+  class Child2 extends Base {
+    constructor() {
+      super("extra", ...arguments);
+      this.childArgs = arguments;
+    }
+  }
+
+  var c = new Child(...[1, 2, 3]);
+  assertInstanceof(c, Child);
+  assertInstanceof(c, Base);
+  assertEquals([1, 2, 3], c.method());
+  assertEquals([1, 2, 3], c.baseArgs);
+  assertFalse(Array.__proto__ === c.childArgs.__proto__);
+  assertEquals([1, 2, 3], Array.prototype.slice.call(c.childArgs));
+
+  c = new Child2(...[1, 2, 3]);
+  assertInstanceof(c, Child2);
+  assertInstanceof(c, Base);
+  assertEquals(["extra", 1, 2, 3], c.method());
+  assertEquals(["extra", 1, 2, 3], c.baseArgs);
+  assertFalse(Array.__proto__ === c.childArgs.__proto__);
+  assertEquals([1, 2, 3], Array.prototype.slice.call(c.childArgs));
+})();
diff --git a/deps/v8/test/mjsunit/es6/spread-call.js b/deps/v8/test/mjsunit/es6/spread-call.js
index de38f129cd..33d55a815f 100644
--- a/deps/v8/test/mjsunit/es6/spread-call.js
+++ b/deps/v8/test/mjsunit/es6/spread-call.js
@@ -49,6 +49,9 @@
     return sum;
   }
 
+  assertThrows(function() {
+    sum(...0);
+  }, TypeError);
   assertEquals(void 0, sum(...""));
   assertEquals(void 0, sum(...[]));
   assertEquals(void 0, sum(...new Set));
@@ -201,6 +204,9 @@
     return sum;
   }
 
+  assertThrows(function() {
+    sum(...0);
+  }, TypeError);
   assertEquals(void 0, sum(...""));
   assertEquals(void 0, sum(...[]));
   assertEquals(void 0, sum(...new Set));
diff --git a/deps/v8/test/mjsunit/es6/super-with-spread-modify-array-iterator.js b/deps/v8/test/mjsunit/es6/super-with-spread-modify-array-iterator.js
new file mode 100644
index 0000000000..70ce9ca159
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/super-with-spread-modify-array-iterator.js
@@ -0,0 +1,51 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function modifyArrayIterator() {
+  'use strict';
+
+  class Point {
+    constructor(x, y) {
+      this.x = x;
+      this.y = y;
+    }
+  }
+
+  class RestPoint extends Point {
+    constructor(...args) {
+      super(...args);
+    }
+  }
+
+  function testRestPoint(x, y) {
+    return new RestPoint(x, y);
+  }
+  testRestPoint(1, 2);
+  testRestPoint(1, 2);
+  % OptimizeFunctionOnNextCall(testRestPoint);
+  var r = testRestPoint(1, 2);
+
+  assertInstanceof(r, RestPoint);
+  assertInstanceof(r, Point);
+  assertEquals(1, r.x);
+  assertEquals(2, r.y);
+
+  Object.defineProperty(Array.prototype, Symbol.iterator, {
+    value: function*
+        () {
+          yield 3;
+          yield 4;
+        },
+    configurable: true
+  });
+
+  var r2 = testRestPoint(1, 2);
+
+  assertInstanceof(r2, RestPoint);
+  assertInstanceof(r2, Point);
+  assertEquals(3, r2.x);
+  assertEquals(4, r2.y);
+})();
diff --git a/deps/v8/test/mjsunit/es6/super-with-spread-modify-next.js b/deps/v8/test/mjsunit/es6/super-with-spread-modify-next.js
new file mode 100644
index 0000000000..8ae0d6c589
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/super-with-spread-modify-next.js
@@ -0,0 +1,56 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function modifyNext() {
+  'use strict';
+
+  class Point {
+    constructor(x, y) {
+      this.x = x;
+      this.y = y;
+    }
+  }
+
+  class ArgumentsPoint extends Point {
+    constructor() {
+      super(...arguments);
+    }
+  }
+
+  var a = [];
+  var ai = a[Symbol.iterator]();
+
+  var original_next = ai.__proto__['next'];
+
+  function testArgumentsPoint(x, y) {
+    return new ArgumentsPoint(x, y);
+  }
+  testArgumentsPoint(1, 2);
+  testArgumentsPoint(1, 2);
+  % OptimizeFunctionOnNextCall(testArgumentsPoint);
+  var r = testArgumentsPoint(1, 2);
+
+  assertInstanceof(r, ArgumentsPoint);
+  assertInstanceof(r, Point);
+  assertEquals(r.x, 1);
+  assertEquals(r.y, 2);
+
+  var called = 0;
+  Object.defineProperty(ai.__proto__, 'next', {
+    get: function() {
+      called++;
+      return original_next;
+    }
+  });
+
+  var r2 = testArgumentsPoint(1, 2);
+
+  assertEquals(3, called);
+  assertInstanceof(r2, ArgumentsPoint);
+  assertInstanceof(r2, Point);
+  assertEquals(r2.x, 1);
+  assertEquals(r2.y, 2);
+})();
diff --git a/deps/v8/test/mjsunit/es6/super-with-spread.js b/deps/v8/test/mjsunit/es6/super-with-spread.js
new file mode 100644
index 0000000000..260704f7a4
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/super-with-spread.js
@@ -0,0 +1,88 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+  'use strict';
+
+  class Point {
+    constructor(x, y) {
+      this.x = x;
+      this.y = y;
+    }
+  }
+
+  function testBaselineAndOpt(func) {
+    func(1, 2);
+    func(1, 2);
+    % OptimizeFunctionOnNextCall(func);
+    return func(1, 2);
+  }
+
+  class RestPoint extends Point {
+    constructor(...args) {
+      super(...args);
+    }
+  }
+  var r = testBaselineAndOpt(function(x, y) {
+    return new RestPoint(x, y);
+  });
+  assertInstanceof(r, RestPoint);
+  assertInstanceof(r, Point);
+  assertEquals(r.x, 1);
+  assertEquals(r.y, 2);
+
+  class RestExtraPoint extends Point {
+    constructor(...args) {
+      super(-1, 0, ...args);
+    }
+  }
+  r = testBaselineAndOpt(function(x, y) {
+    return new RestExtraPoint(x, y);
+  });
+  assertInstanceof(r, RestExtraPoint);
+  assertInstanceof(r, Point);
+  assertEquals(r.x, -1);
+  assertEquals(r.y, 0);
+
+  class ArgumentsPoint extends Point {
+    constructor() {
+      super(...arguments);
+    }
+  }
+  r = testBaselineAndOpt(function(x, y) {
+    return new ArgumentsPoint(x, y);
+  });
+  assertInstanceof(r, ArgumentsPoint);
+  assertInstanceof(r, Point);
+  assertEquals(r.x, 1);
+  assertEquals(r.y, 2);
+
+  class ArgumentsExtraPoint extends Point {
+    constructor() {
+      super(1, 2, ...arguments);
+    }
+  }
+  r = testBaselineAndOpt(function(x, y) {
+    return new ArgumentsExtraPoint(x, y);
+  });
+  assertInstanceof(r, ArgumentsExtraPoint);
+  assertInstanceof(r, Point);
+  assertEquals(r.x, 1);
+  assertEquals(r.y, 2);
+
+  class LiteralPoint extends Point {
+    constructor() {
+      super(...[3, 4]);
+    }
+  }
+  r = testBaselineAndOpt(function(x, y) {
+    return new LiteralPoint(x, y);
+  });
+  assertInstanceof(r, LiteralPoint);
+  assertInstanceof(r, Point);
+  assertEquals(r.x, 3);
+  assertEquals(r.y, 4);
+})();
diff --git a/deps/v8/test/mjsunit/es6/typedarray-copywithin.js b/deps/v8/test/mjsunit/es6/typedarray-copywithin.js
index ad5a0df563..1e63508393 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-copywithin.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-copywithin.js
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --allow-natives-syntax
+
 var typedArrayConstructors = [
   Uint8Array,
   Int8Array,
@@ -171,3 +173,75 @@ CheckEachTypedArray(function copyWithinNullEnd(constructor) {
   assertArrayEquals([1, 2, 3, 4, 5],
                     new constructor([1, 2, 3, 4, 5]).copyWithin(0, 3, null));
 });
+
+
+CheckEachTypedArray(function copyWithinMinusInfinityTarget(constructor) {
+  var arr = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
+  var expected = [6, 7, 8, 9, 10, 6, 7, 8, 9, 10];
+
+  assertArrayEquals(expected, arr.copyWithin(-Infinity, 5));
+  assertEquals(10, arr.length);
+});
+
+
+CheckEachTypedArray(function copyWithinPositiveInfinityTarget(constructor) {
+  var arr = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
+  var expected = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
+
+  assertArrayEquals(expected, arr.copyWithin(+Infinity, 5));
+  assertEquals(10, arr.length);
+});
+
+
+CheckEachTypedArray(function copyWithinMinusInfinityStart(constructor) {
+  var arr = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
+  var expected = [1, 2, 3, 4, 5, 1, 2, 3, 4, 5];
+
+  assertArrayEquals(expected, arr.copyWithin(5, -Infinity));
+  assertEquals(10, arr.length);
+});
+
+
+CheckEachTypedArray(function copyWithinPositiveInfinityStart(constructor) {
+  var arr = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
+  var expected = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
+
+  assertArrayEquals(expected, arr.copyWithin(5, +Infinity));
+  assertEquals(10, arr.length);
+});
+
+
+CheckEachTypedArray(function copyWithinMinusInfinityEnd(constructor) {
+  var arr = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
+  var expected = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
+
+  assertArrayEquals(expected, arr.copyWithin(5, 0, -Infinity));
+  assertEquals(10, arr.length);
+});
+
+
+CheckEachTypedArray(function copyWithinPositiveInfinityEnd(constructor) {
+var arr = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
+  var expected = [1, 2, 3, 4, 5, 1, 2, 3, 4, 5];
+
+  assertArrayEquals(expected, arr.copyWithin(5, 0, +Infinity));
+  assertEquals(10, arr.length);
+});
+
+CheckEachTypedArray(function parametersNotCalledIfDetached(constructor) {
+  var tmp = {
+    [Symbol.toPrimitive]() {
+      assertUnreachable("Parameter should not be processed when " +
+                        "array.[[ViewedArrayBuffer]] is neutered.");
+      return 0;
+    }
+  };
+
+  var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
+  %ArrayBufferNeuter(array.buffer);
+
+  // TODO(caitp): this should throw due to being invoked on a TypedArray with a
+  // detached buffer (per v8:4648).
+  array.copyWithin(tmp, tmp, tmp);
+  assertEquals(0, array.length, "array.[[ViewedArrayBuffer]] is detached");
+});
diff --git a/deps/v8/test/mjsunit/es6/typedarray-sort.js b/deps/v8/test/mjsunit/es6/typedarray-sort.js
index 4fb8469075..9051a775d0 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-sort.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-sort.js
@@ -52,4 +52,12 @@ for (var constructor of typedArrayConstructors) {
   assertEquals(a.length, 1);
   // Method doesn't work on other objects
   assertThrows(function() { a.sort.call([]); }, TypeError);
+
+  // Do not touch elements out of byte offset
+  var buf = new ArrayBuffer(constructor.BYTES_PER_ELEMENT * 3);
+  var a = new constructor(buf, constructor.BYTES_PER_ELEMENT);
+  var b = new constructor(buf);
+  b[0] = 3; b[1] = 2; b[2] = 1;
+  a.sort();
+  assertArrayLikeEquals(a, [1, 2], constructor);
 }