12 files changed, 189 insertions, 9 deletions
diff --git a/deps/v8/test/mjsunit/es6/array-spread-holey.js b/deps/v8/test/mjsunit/es6/array-spread-holey.js
new file mode 100644
index 0000000000..7d95e51b29
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-spread-holey.js
@@ -0,0 +1,52 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Test spreading of holey arrays. Holes should be replaced with undefined.
+
+var a = [, 2];
+
+assertEquals([, 2], [...a]);
+assertTrue([...a].hasOwnProperty(0));
+assertTrue([2, ...a].hasOwnProperty(1));
+
+
+class MyArray1 extends Array {
+  constructor(a) {
+    super(...a);
+  }
+}
+var myarr1 = new MyArray1(a);
+assertEquals(undefined, myarr1[0]);
+assertTrue(myarr1.hasOwnProperty(0));
+
+
+class MyArray2 extends Array {
+  constructor(a) {
+    super(2, ...a);
+  }
+}
+var myarr2 = new MyArray2(a);
+assertEquals(undefined, myarr2[1]);
+assertTrue(myarr2.hasOwnProperty(1));
+
+function foo0() { return arguments.hasOwnProperty(0); }
+assertTrue(foo0(...a));
+
+function foo1() { return arguments.hasOwnProperty(1); }
+assertTrue(foo1(2, ...a));
+
+// This test pollutes the Array prototype. No more tests should be run in the
+// same instance after this.
+a.__proto__[0] = 1;
+var arr2 = [...a];
+assertEquals([1,2], arr2);
+assertTrue(arr2.hasOwnProperty(0));
+
+myarr1 = new MyArray1(a);
+assertEquals(1, myarr1[0]);
+assertTrue(myarr1.hasOwnProperty(0));
+
+var myarr2 = new MyArray2(a);
+assertEquals(1, myarr2[1]);
+assertTrue(myarr2.hasOwnProperty(1));
diff --git a/deps/v8/test/mjsunit/es6/proxy-function-tostring.js b/deps/v8/test/mjsunit/es6/proxy-function-tostring.js
index d859822df0..e151bf65b1 100644
--- a/deps/v8/test/mjsunit/es6/proxy-function-tostring.js
+++ b/deps/v8/test/mjsunit/es6/proxy-function-tostring.js
@@ -1,7 +1,6 @@
 // Copyright 2018 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
-//
-// Flags: --noharmony-function-tostring
 
-assertThrows(() => new Proxy(function() {}, {}).toString(), TypeError);
+assertEquals(new Proxy(function() {}, {}).toString(),
+             'function () { [native code] }');
diff --git a/deps/v8/test/mjsunit/es6/string-iterator2.js b/deps/v8/test/mjsunit/es6/string-iterator2.js
new file mode 100644
index 0000000000..6bfd51a815
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/string-iterator2.js
@@ -0,0 +1,26 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// Tests for spreading primitive strings.
+
+assertEquals([...''], []);
+
+var str = 'ott';
+assertEquals(['o', 't', 't'], [...str]);
+assertTrue(%StringIteratorProtector());
+
+str[Symbol.iterator] = {};
+// Symbol.iterator can't be set on primitive strings, so it shouldn't invalidate
+// the protector.
+assertTrue(%StringIteratorProtector());
+
+// This changes the String Iterator prototype. No more tests should be run after
+// this in the same instance.
+var iterator = str[Symbol.iterator]();
+iterator.__proto__.next = () => ({value : undefined, done : true});
+
+assertFalse(%StringIteratorProtector());
+assertEquals([], [...str]);
diff --git a/deps/v8/test/mjsunit/es6/string-iterator3.js b/deps/v8/test/mjsunit/es6/string-iterator3.js
new file mode 100644
index 0000000000..1b0e0273e5
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/string-iterator3.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// Tests for primitive strings.
+
+var str = 'ott';
+assertTrue(%StringIteratorProtector());
+assertEquals(['o', 't', 't'], [...str]);
+
+// This changes the String prototype. No more tests should be run after this in
+// the same instance.
+str.__proto__[Symbol.iterator] =
+    function() {
+      return {next : () => ({value : undefined, done : true})};
+    };
+assertFalse(%StringIteratorProtector());
+assertEquals([], [...str]);
diff --git a/deps/v8/test/mjsunit/es6/string-iterator4.js b/deps/v8/test/mjsunit/es6/string-iterator4.js
new file mode 100644
index 0000000000..48c6521d3b
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/string-iterator4.js
@@ -0,0 +1,30 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// Tests for wrapped strings.
+
+var str = new String('ott');
+assertTrue(%StringIteratorProtector());
+assertEquals(['o', 't', 't'], [...str]);
+
+function iterator_fn() {
+  return {next : () => ({value : undefined, done : true})};
+};
+
+str[Symbol.iterator] = iterator_fn;
+// This shouldn't invalidate the protector, because it doesn't support String
+// objects.
+assertTrue(%StringIteratorProtector());
+assertEquals([], [...str]);
+
+
+var str2 = new String('ott');
+assertEquals(['o', 't', 't'], [...str2]);
+// This changes the String prototype. No more tests should be run after this in
+// the same instance.
+str2.__proto__[Symbol.iterator] = iterator_fn;
+assertFalse(%StringIteratorProtector());
+assertEquals([], [...str2]);
diff --git a/deps/v8/test/mjsunit/es6/string-iterator5.js b/deps/v8/test/mjsunit/es6/string-iterator5.js
new file mode 100644
index 0000000000..ec9754a4bd
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/string-iterator5.js
@@ -0,0 +1,15 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Tests for primitive strings.
+
+var iterator = 'ott'[Symbol.iterator]();
+
+// These modifications shouldn't invalidate the String iterator protector.
+iterator.__proto__.fonts = {};
+assertTrue(%StringIteratorProtector());
+iterator.__proto__[0] = 0;
+assertTrue(%StringIteratorProtector());
diff --git a/deps/v8/test/mjsunit/es6/string-iterator6.js b/deps/v8/test/mjsunit/es6/string-iterator6.js
new file mode 100644
index 0000000000..d1cd1f31eb
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/string-iterator6.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+assertTrue(%StringIteratorProtector());
+
+delete 'ott'.__proto__[Symbol.iterator];
+
+assertFalse(%StringIteratorProtector());
diff --git a/deps/v8/test/mjsunit/es6/string-iterator7.js b/deps/v8/test/mjsunit/es6/string-iterator7.js
new file mode 100644
index 0000000000..387c6e81fc
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/string-iterator7.js
@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+assertTrue(%StringIteratorProtector());
+
+const p = ""[Symbol.iterator]().__proto__;
+let x = Object.create(p);
+x.next = 42;
+
+assertTrue(%StringIteratorProtector());
diff --git a/deps/v8/test/mjsunit/es6/string-iterator8.js b/deps/v8/test/mjsunit/es6/string-iterator8.js
new file mode 100644
index 0000000000..dbd4b7c46a
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/string-iterator8.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+assertTrue(%StringIteratorProtector());
+
+var proto = String.prototype;
+
+String.prototype = {};
+
+assertEquals(proto, String.prototype);
+assertTrue(%StringIteratorProtector());
diff --git a/deps/v8/test/mjsunit/es6/typedarray-construct-by-array-like.js b/deps/v8/test/mjsunit/es6/typedarray-construct-by-array-like.js
index 3b57f8f644..0a55fccf5c 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-construct-by-array-like.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-construct-by-array-like.js
@@ -212,7 +212,7 @@ tests.push(function TestFromTypedArraySpeciesNeutersBuffer(constr) {
 });
 
 tests.push(function TestLengthIsMaxSmi(constr) {
-  var myObject = { 0: 5, 1: 6, length: %_MaxSmi() + 1 };
+  var myObject = { 0: 5, 1: 6, length: %MaxSmi() + 1 };
 
   assertThrows(function() {
     new constr(myObject);
@@ -258,7 +258,7 @@ tests.push(function TestOffsetIsUsed(constr) {
 });
 
 tests.push(function TestLengthIsNonSmiNegativeNumber(constr) {
-  var ta = new constr({length: -%_MaxSmi() - 2});
+  var ta = new constr({length: -%MaxSmi() - 2});
 
   assertEquals(0, ta.length);
 });
diff --git a/deps/v8/test/mjsunit/es6/typedarray-construct-offset-not-smi.js b/deps/v8/test/mjsunit/es6/typedarray-construct-offset-not-smi.js
index 0a267bc64b..e6cbcc4201 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-construct-offset-not-smi.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-construct-offset-not-smi.js
@@ -5,7 +5,7 @@
 // Flags: --allow-natives-syntax --mock-arraybuffer-allocator
 
 (function TestBufferByteLengthNonSmi() {
-  var non_smi_byte_length = %_MaxSmi() + 1;
+  var non_smi_byte_length = %MaxSmi() + 1;
 
   var buffer = new ArrayBuffer(non_smi_byte_length);
 
@@ -20,7 +20,7 @@
 })();
 
 (function TestByteOffsetNonSmi() {
-  var non_smi_byte_length = %_MaxSmi() + 11;
+  var non_smi_byte_length = %MaxSmi() + 11;
 
   var buffer = new ArrayBuffer(non_smi_byte_length);
 
diff --git a/deps/v8/test/mjsunit/es6/typedarray-set-bytelength-not-smi.js b/deps/v8/test/mjsunit/es6/typedarray-set-bytelength-not-smi.js
index 1f842878dc..e4a8c2b626 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-set-bytelength-not-smi.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-set-bytelength-not-smi.js
@@ -5,13 +5,13 @@
 // Flags: --allow-natives-syntax --mock-arraybuffer-allocator
 
 (function TestBufferByteLengthNonSmi() {
-  const source_buffer_length = %_MaxSmi() + 1;
+  const source_buffer_length = %MaxSmi() + 1;
   const source_buffer = new ArrayBuffer(source_buffer_length);
   const source = new Uint16Array(source_buffer);
   assertEquals(source_buffer_length, source_buffer.byteLength);
   assertEquals(source_buffer_length / 2, source.length);
 
-  const target_buffer_length = %_MaxSmi() - 1;
+  const target_buffer_length = %MaxSmi() - 1;
   const target_buffer = new ArrayBuffer(target_buffer_length);
   const target = new Uint16Array(target_buffer);
   assertEquals(target_buffer_length, target_buffer.byteLength);