Upload Kmake

deps/v8/test/mjsunit/es6/regress/regress-2034.js

@@ -0,0 +1,44 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var key = {};
+var map = new WeakMap;
+Object.preventExtensions(key);
+
+// Try querying using frozen key.
+assertFalse(map.has(key));
+assertSame(undefined, map.get(key));
+
+// Try adding using frozen key.
+map.set(key, 1);
+assertTrue(map.has(key));
+assertSame(1, map.get(key));
+
+// Try deleting using frozen key.
+map.delete(key, 1);
+assertFalse(map.has(key));
+assertSame(undefined, map.get(key));

deps/v8/test/mjsunit/es6/regress/regress-2156.js

@@ -0,0 +1,39 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var key1 = {};
+var key2 = {};
+var map = new WeakMap;
+
+// Adding hidden properties preserves map sharing. Putting the key into
+// a WeakMap will cause the first hidden property to be added.
+assertTrue(%HaveSameMap(key1, key2));
+map.set(key1, 1);
+map.set(key2, 2);
+assertTrue(%HaveSameMap(key1, key2));

deps/v8/test/mjsunit/es6/regress/regress-2186.js

@@ -0,0 +1,47 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function heapify(i) {
+  return 2.0 * (i / 2);
+}
+heapify(1);
+
+var ONE = 1;
+var ANOTHER_ONE = heapify(ONE);
+assertSame(ONE, ANOTHER_ONE);
+assertEquals("number", typeof ONE);
+assertEquals("number", typeof ANOTHER_ONE);
+
+var set = new Set;
+set.add(ONE);
+assertTrue(set.has(ONE));
+assertTrue(set.has(ANOTHER_ONE));
+
+var map = new Map;
+map.set(ONE, 23);
+assertSame(23, map.get(ONE));
+assertSame(23, map.get(ANOTHER_ONE));

deps/v8/test/mjsunit/es6/regress/regress-2219.js

@@ -0,0 +1,32 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc
+
+var p = new Proxy({}, {getOwnPropertyDescriptor: function() { gc() }});
+var o = Object.create(p);
+assertSame(23, o.x = 23);

deps/v8/test/mjsunit/es6/regress/regress-2225.js

@@ -0,0 +1,74 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var proxy_has_x = false;
+var proxy = new Proxy({}, {
+  get(t, key, receiver) {
+    assertSame('x', key);
+    if (proxy_has_x) { return 19 }
+    return 8;
+  }
+});
+
+// Test __lookupGetter__/__lookupSetter__ with proxy.
+assertSame(undefined, Object.prototype.__lookupGetter__.call(proxy, 'foo'));
+assertSame(undefined, Object.prototype.__lookupSetter__.call(proxy, 'bar'));
+assertSame(undefined, Object.prototype.__lookupGetter__.call(proxy, '123'));
+assertSame(undefined, Object.prototype.__lookupSetter__.call(proxy, '456'));
+
+// Test __lookupGetter__/__lookupSetter__ with proxy in prototype chain.
+var object = Object.create(proxy);
+assertSame(undefined, Object.prototype.__lookupGetter__.call(object, 'foo'));
+assertSame(undefined, Object.prototype.__lookupSetter__.call(object, 'bar'));
+assertSame(undefined, Object.prototype.__lookupGetter__.call(object, '123'));
+assertSame(undefined, Object.prototype.__lookupSetter__.call(object, '456'));
+
+// Test inline constructors with proxy as prototype.
+function F() { this.x = 42 }
+F.prototype = proxy;
+var instance = new F();
+
+proxy_has_x = false;
+assertSame(42, instance.x);
+delete instance.x;
+assertSame(8, instance.x);
+
+proxy_has_x = true;
+assertSame(19, instance.x);
+
+// Test inline constructors with proxy in prototype chain.
+function G() { this.x = 42; }
+G.prototype.__proto__ = proxy;
+instance = new G();
+
+proxy_has_x = false;
+assertSame(42, instance.x);
+delete instance.x;
+assertSame(8, instance.x);
+
+proxy_has_x = true;
+assertSame(19, instance.x);

deps/v8/test/mjsunit/es6/regress/regress-2243.js

@@ -0,0 +1,29 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertThrows("'use strict'; (function f() { f = 123; })()", TypeError);
+assertThrows("(function f() { 'use strict'; f = 123; })()", TypeError);

deps/v8/test/mjsunit/es6/regress/regress-2322.js

@@ -0,0 +1,34 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+"use strict";
+
+assertThrows("'use strict'; for (let x in x);", ReferenceError);
+
+let s;
+for (let pppp in {}) {};
+assertThrows(function() { pppp = true }, ReferenceError);

deps/v8/test/mjsunit/es6/regress/regress-2506.js

@@ -0,0 +1,76 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+'use strict';
+
+// Top-level code
+let s = 0;
+let f = [undefined, undefined, undefined]
+for (const x of [1,2,3]) {
+  s += x;
+  f[x-1] = function() { return x; }
+}
+assertEquals(6, s);
+assertEquals(1, f[0]());
+assertEquals(2, f[1]());
+assertEquals(3, f[2]());
+
+let x = 1;
+s = 0;
+for (const z of [x, x+1, x+2]) {
+  s += z;
+}
+assertEquals(6, s);
+
+s = 0;
+var q = 1;
+for (const x of [q, q+1, q+2]) {
+  s += x;
+}
+assertEquals(6, s);
+
+let z = 1;
+s = 0;
+for (const x = 1; z < 2; z++) {
+  s += x + z;
+}
+assertEquals(2, s);
+
+
+s = "";
+for (const x in [1,2,3]) {
+  s += x;
+}
+assertEquals("012", s);
+
+assertThrows("'use strict'; for (const x in [1,2,3]) { x++ }", TypeError);
+
+// Function scope
+(function() {
+  let s = 0;
+  for (const x of [1,2,3]) {
+    s += x;
+  }
+  assertEquals(6, s);
+
+  let x = 1;
+  s = 0;
+  for (const q of [x, x+1, x+2]) {
+    s += q;
+  }
+  assertEquals(6, s);
+
+  s = 0;
+  var q = 1;
+  for (const x of [q, q+1, q+2]) {
+    s += x;
+  }
+  assertEquals(6, s);
+
+  s = "";
+  for (const x in [1,2,3]) {
+    s += x;
+  }
+  assertEquals("012", s);
+}());

deps/v8/test/mjsunit/es6/regress/regress-2681.js

@@ -0,0 +1,48 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc --noincremental-marking
+
+// Check that we are not flushing code for generators.
+
+function flush_all_code() {
+  // Each GC ages code, and currently 6 gcs will flush all code.
+  for (var i = 0; i < 10; i++) gc();
+}
+
+function* g() {
+  yield 1;
+  yield 2;
+}
+
+var o = g();
+assertEquals({ value: 1, done: false }, o.next());
+
+flush_all_code();
+
+assertEquals({ value: 2, done: false }, o.next());
+assertEquals({ value: undefined, done: true }, o.next());

deps/v8/test/mjsunit/es6/regress/regress-2691.js

@@ -0,0 +1,32 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Check that yield* on non-objects raises a TypeError.
+
+assertThrows('(function*() { yield* 10 })().next()', TypeError);
+assertThrows('(function*() { yield* {} })().next()', TypeError);
+assertThrows('(function*() { yield* undefined })().next()', TypeError);

deps/v8/test/mjsunit/es6/regress/regress-2829.js

@@ -0,0 +1,51 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+(function test1() {
+  var wm1 = new WeakMap();
+  wm1.set(Object.prototype, 23);
+  assertTrue(wm1.has(Object.prototype));
+  Object.freeze(Object.prototype);
+
+  var wm2 = new WeakMap();
+  var o = {};
+  wm2.set(o, 42);
+  assertEquals(42, wm2.get(o));
+})();
+
+(function test2() {
+  var wm1 = new WeakMap();
+  var o1 = {};
+  wm1.set(o1, 23);
+  assertTrue(wm1.has(o1));
+  Object.freeze(o1);
+
+  var wm2 = new WeakMap();
+  var o2 = Object.create(o1);
+  wm2.set(o2, 42);
+  assertEquals(42, wm2.get(o2));
+})();

deps/v8/test/mjsunit/es6/regress/regress-2858.js

@@ -0,0 +1,25 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+"use strict";
+
+function f() {
+    var y = 1;
+    var q1;
+    var q;
+    var z = new Error();
+    try {
+        throw z;
+    } catch (y) {
+      assertTrue(z === y);
+      q1 = function() { return y; }
+      var y = 15;
+      q = function() { return y; }
+      assertSame(15, y);
+    }
+    assertSame(1, y);
+    assertSame(15, q1());
+    assertSame(15, q());
+}
+
+f();

deps/v8/test/mjsunit/es6/regress/regress-3426.js

@@ -0,0 +1,5 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("(function() { 'use strict'; { let f; var f; } })", SyntaxError);

deps/v8/test/mjsunit/es6/regress/regress-347906.js

@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  return Math.clz32(12.34);
+}
+
+%PrepareFunctionForOptimization(foo);
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();

deps/v8/test/mjsunit/es6/regress/regress-3501.js

@@ -0,0 +1,9 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// See: http://code.google.com/p/v8/issues/detail?id=3501
+
+"use strict";
+let lift = f => (x, k) => k (f (x));
+lift(isNaN);

deps/v8/test/mjsunit/es6/regress/regress-3683.js

@@ -0,0 +1,82 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+
+// Simplest case
+var count = 0;
+for (let x = 0; x < 10;) {
+  x++;
+  count++;
+  continue;
+}
+assertEquals(10, count);
+
+// Labeled
+count = 0;
+label: for (let x = 0; x < 10;) {
+  while (true) {
+    x++;
+    count++;
+    continue label;
+  }
+}
+assertEquals(10, count);
+
+// Simple and labeled
+count = 0;
+label: for (let x = 0; x < 10;) {
+  x++;
+  count++;
+  continue label;
+}
+assertEquals(10, count);
+
+// Shadowing loop variable in same scope as continue
+count = 0;
+for (let x = 0; x < 10;) {
+  x++;
+  count++;
+  {
+    let x = "hello";
+    continue;
+  }
+}
+assertEquals(10, count);
+
+// Nested let-bound for loops, inner continue
+count = 0;
+for (let x = 0; x < 10;) {
+  x++;
+  for (let y = 0; y < 2;) {
+    y++;
+    count++;
+    continue;
+  }
+}
+assertEquals(20, count);
+
+// Nested let-bound for loops, outer continue
+count = 0;
+for (let x = 0; x < 10;) {
+  x++;
+  for (let y = 0; y < 2;) {
+    y++;
+    count++;
+  }
+  continue;
+}
+assertEquals(20, count);
+
+// Nested let-bound for loops, labeled continue
+count = 0;
+outer: for (let x = 0; x < 10;) {
+  x++;
+  for (let y = 0; y < 2;) {
+    y++;
+    count++;
+    if (y == 2) continue outer;
+  }
+}
+assertEquals(20, count);

deps/v8/test/mjsunit/es6/regress/regress-3741.js

@@ -0,0 +1,27 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+'use strict';
+function f24(deopt) {
+  let x = 1;
+  {
+    let x = 2;
+    {
+      let x = 3;
+      assertEquals(3, x);
+    }
+    deopt + 1;
+    assertEquals(2, x);
+  }
+  assertEquals(1, x);
+}
+
+
+%PrepareFunctionForOptimization(f24);
+for (var j = 0; j < 10; ++j) {
+  f24(12);
+}
+%OptimizeFunctionOnNextCall(f24);
+f24({});

deps/v8/test/mjsunit/es6/regress/regress-3902.js

@@ -0,0 +1,15 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function* g() {}
+assertTrue(Object.getOwnPropertyDescriptor(g.__proto__, "constructor").configurable);
+assertTrue(Object.getOwnPropertyDescriptor(g.prototype.__proto__, "constructor").configurable);
+
+function FakeGeneratorFunctionConstructor() {}
+Object.defineProperty(g.__proto__, "constructor", {value: FakeGeneratorFunctionConstructor});
+assertSame(g.__proto__.constructor, FakeGeneratorFunctionConstructor);
+
+function FakeGeneratorObjectConstructor() {}
+Object.defineProperty(g.prototype.__proto__, "constructor", {value: FakeGeneratorObjectConstructor});
+assertSame(g.prototype.__proto__.constructor, FakeGeneratorObjectConstructor);

deps/v8/test/mjsunit/es6/regress/regress-3938.js

@@ -0,0 +1,8 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+'use strict';
+
+assertThrows(function() { for (const i = 0; ; i++) {} }, TypeError);
+assertThrows("'use strict'; for (const i = 0; ; i++) {}", TypeError);

deps/v8/test/mjsunit/es6/regress/regress-4056.js

@@ -0,0 +1,10 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function strictFunctionArrowEval(s) {
+  "use strict";
+  return (()=>eval(s))();
+};
+
+assertEquals(strictFunctionArrowEval("42"), 42)

deps/v8/test/mjsunit/es6/regress/regress-4097.js

@@ -0,0 +1,37 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function StoreToSuper () {
+  "use strict";
+  class A {
+    s() {
+      super.bla = 10;
+    }
+  };
+
+  let a = new A();
+  (new A).s.call(a);
+  assertEquals(10, a.bla);
+  assertThrows(function() { (new A).s.call(undefined); }, TypeError);
+  assertThrows(function() { (new A).s.call(42); }, TypeError);
+  assertThrows(function() { (new A).s.call(null); }, TypeError);
+  assertThrows(function() { (new A).s.call("abc"); }, TypeError);
+})();
+
+
+(function LoadFromSuper () {
+  "use strict";
+  class A {
+    s() {
+      return super.bla;
+    }
+  };
+
+  let a = new A();
+  assertSame(undefined, (new A).s.call(a));
+  assertSame(undefined, (new A).s.call(undefined));
+  assertSame(undefined, (new A).s.call(42));
+  assertSame(undefined, (new A).s.call(null));
+  assertSame(undefined, (new A).s.call("abc"));
+})();

deps/v8/test/mjsunit/es6/regress/regress-4160.js

@@ -0,0 +1,31 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function(x) {
+  (function(x) {
+    var boom = (() => eval(x));
+    %PrepareFunctionForOptimization(boom);
+    assertEquals(23, boom());
+    assertEquals(23, boom());
+    %OptimizeFunctionOnNextCall(boom);
+    assertEquals(23, boom());
+    assertEquals("23", x);
+  })("23");
+  assertEquals("42", x);
+})("42");
+
+(function(x) {
+  (function(x) {
+    var boom = (() => (eval("var x = 66"), x));
+    %PrepareFunctionForOptimization(boom);
+    assertEquals(66, boom());
+    assertEquals(66, boom());
+    %OptimizeFunctionOnNextCall(boom);
+    assertEquals(66, boom());
+    assertEquals("23", x);
+  })("23");
+  assertEquals("42", x);
+})("42");

deps/v8/test/mjsunit/es6/regress/regress-4211.js

@@ -0,0 +1,10 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("()=>{}()", SyntaxError);
+assertThrows("x=>{}()", SyntaxError);
+assertThrows("(...x)=>{}()", SyntaxError);
+assertThrows("(x)=>{}()", SyntaxError);
+assertThrows("(x,y)=>{}()", SyntaxError);
+assertThrows("(x,y,...z)=>{}()", SyntaxError);

deps/v8/test/mjsunit/es6/regress/regress-4298.js

@@ -0,0 +1,6 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var arr = [1, 2, ...[3]];
+assertEquals([1, 2, 3], arr);

deps/v8/test/mjsunit/es6/regress/regress-4395-global-eval.js

@@ -0,0 +1,6 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+((x, y = eval('x')) => assertEquals(42, y))(42);
+((x, {y = eval('x')}) => assertEquals(42, y))(42, {});

deps/v8/test/mjsunit/es6/regress/regress-4395.js

@@ -0,0 +1,102 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function testExpressionTypes() {
+  "use strict";
+  ((x, y = x) => assertEquals(42, y))(42);
+
+  ((x, y = (x)) => assertEquals(42, y))(42);
+  ((x, y = `${x}`) => assertEquals("42", y))(42);
+  ((x, y = x = x + 1) => assertEquals(43, y))(42);
+  ((x, y = x()) => assertEquals(42, y))(() => 42);
+  ((x, y = new x()) => assertEquals(42, y.z))(function() { this.z = 42 });
+  ((x, y = -x) => assertEquals(-42, y))(42);
+  ((x, y = ++x) => assertEquals(43, y))(42);
+  ((x, y = x === 42) => assertTrue(y))(42);
+  ((x, y = (x == 42 ? x : 0)) => assertEquals(42, y))(42);
+
+  ((x, y = function() { return x }) => assertEquals(42, y()))(42);
+  ((x, y = () => x) => assertEquals(42, y()))(42);
+
+  // Literals
+  ((x, y = {z: x}) => assertEquals(42, y.z))(42);
+  ((x, y = {[x]: x}) => assertEquals(42, y[42]))(42);
+  ((x, y = [x]) => assertEquals(42, y[0]))(42);
+  ((x, y = [...x]) => assertEquals(42, y[0]))([42]);
+
+  ((x, y = class {
+    static [x]() { return x }
+  }) => assertEquals(42, y[42]()))(42);
+  ((x, y = (new class {
+    z() { return x }
+  })) => assertEquals(42, y.z()))(42);
+
+  ((x, y = (new class Y {
+    static [x]() { return x }
+    z() { return Y[42]() }
+  })) => assertEquals(42, y.z()))(42);
+
+  ((x, y = (new class {
+    constructor() { this.z = x }
+  })) => assertEquals(42, y.z))(42);
+  ((x, y = (new class Y {
+    constructor() { this.z = x }
+  })) => assertEquals(42, y.z))(42);
+
+  ((x, y = (new class extends x {
+  })) => assertEquals(42, y.z()))(class { z() { return 42 } });
+
+  // Defaults inside destructuring
+  ((x, {y = x}) => assertEquals(42, y))(42, {});
+  ((x, [y = x]) => assertEquals(42, y))(42, []);
+})();
+
+
+(function testMultiScopeCapture() {
+  "use strict";
+  var x = 1;
+  {
+    let y = 2;
+    ((x, y, a = x, b = y) => {
+      assertEquals(3, x);
+      assertEquals(3, a);
+      assertEquals(4, y);
+      assertEquals(4, b);
+    })(3, 4);
+  }
+})();
+
+
+(function testSuper() {
+  "use strict";
+  class A {
+    x() { return 42; }
+  }
+
+  class B extends A {
+    y() {
+      ((q = super.x()) => assertEquals(42, q))();
+    }
+  }
+
+  new B().y();
+
+  class C {
+    constructor() { return { prop: 42 } }
+  }
+
+  class D extends C{
+    constructor() {
+      ((q = super()) => assertEquals(42, q.prop))();
+    }
+  }
+
+  new D();
+})();
+
+
+(function testScopeFlags() {
+  ((x, y = eval('x')) => assertEquals(42, y))(42);
+  ((x, {y = eval('x')}) => assertEquals(42, y))(42, {});
+})();

deps/v8/test/mjsunit/es6/regress/regress-4400.js

@@ -0,0 +1,6 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function borked(a = [], b = {}, c) {}
+borked();

deps/v8/test/mjsunit/es6/regress/regress-4417.js

@@ -0,0 +1,10 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var arr = [1, 2, 3];
+assertEquals({arr: [1, 2, 3]}, {arr: [...arr]});
+assertEquals([[1, 2, 3]], [[...arr]]);
+
+assertEquals({arr: [6, 5, [1, 2, 3]]}, {arr: [6, 5, [...arr]]});
+assertEquals([8, 7, [6, 5, [1, 2, 3]]], [8, 7, [6, 5, [...arr]]]);

deps/v8/test/mjsunit/es6/regress/regress-4466.js

@@ -0,0 +1,26 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+
+class Parent {
+  parentMethod(x, y) {
+    assertEquals(42, x);
+    assertEquals('hello world', y);
+  }
+}
+
+class Child extends Parent {
+  method(x) {
+    let outer = (y) => {
+      let inner = () => {
+        super.parentMethod(x, y);
+      };
+      inner();
+    };
+    outer('hello world');
+  }
+}
+
+new Child().method(42);

deps/v8/test/mjsunit/es6/regress/regress-4482.js

@@ -0,0 +1,7 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals("function", (function f() { f = 42; return typeof f })());
+assertEquals("function",
+             (function* g() { g = 42; yield typeof g })().next().value);

deps/v8/test/mjsunit/es6/regress/regress-4522.js

@@ -0,0 +1,19 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+
+class C {
+  foo() {
+    return 42;
+  }
+}
+
+class D extends C {
+  foo() {
+    return (() => eval("super.foo()"))();
+  }
+}
+
+assertEquals(42, new D().foo());

deps/v8/test/mjsunit/es6/regress/regress-455141.js

@@ -0,0 +1,15 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --no-lazy
+"use strict";
+class Base {
+}
+class Subclass extends Base {
+  constructor() {
+      this.prp1 = 3;
+  }
+}
+function __f_1(){
+}

deps/v8/test/mjsunit/es6/regress/regress-4585.js

@@ -0,0 +1,14 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(`for(const { method() {} } = this) {}`, SyntaxError);
+assertThrows(`var { method() {} } = this;`, SyntaxError);
+assertThrows(`for(const { *method() {} } = this) {}`, SyntaxError);
+assertThrows(`var { *method() {} } = this;`, SyntaxError);
+assertThrows(`for(var { get foo() {} } = this) {}`, SyntaxError);
+assertThrows(`for(var { set foo() {} } = this) {}`, SyntaxError);
+
+// Still OK in other objects
+for (var { name = "" + { toString() { return "test" } } } in { a: 1}) break;
+assertEquals(name, "test");

deps/v8/test/mjsunit/es6/regress/regress-474783.js

@@ -0,0 +1,24 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+"use strict";
+class Base {
+}
+class Subclass extends Base {
+  constructor(a,b,c) {
+    arguments[1];
+  }
+}
+assertThrows(function() { Subclass(); }, TypeError);
+assertThrows(function() { Subclass(1); }, TypeError);
+assertThrows(function() { Subclass(1, 2); }, TypeError);
+assertThrows(function() { Subclass(1, 2, 3); }, TypeError);
+assertThrows(function() { Subclass(1, 2, 3, 4); }, TypeError);
+
+assertThrows(function() { Subclass.call(); }, TypeError);
+assertThrows(function() { Subclass.call({}); }, TypeError);
+assertThrows(function() { Subclass.call({}, 1); }, TypeError);
+assertThrows(function() { Subclass.call({}, 1, 2); }, TypeError);
+assertThrows(function() { Subclass.call({}, 1, 2, 3, 4); }, TypeError);

deps/v8/test/mjsunit/es6/regress/regress-4759.js

@@ -0,0 +1,23 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function iterable(done) {
+  return {
+    [Symbol.iterator]: function() {
+      return {
+        next: function() {
+          if (done) return { done: true };
+          done = true;
+          return { value: 42, done: false };
+        }
+      }
+    }
+  }
+}
+
+var [...result] = iterable(true);
+assertEquals([], result);
+
+var [...result] = iterable(false);
+assertEquals([42], result);

deps/v8/test/mjsunit/es6/regress/regress-508074.js

@@ -0,0 +1,26 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var f = (a, b, ...c) => {
+  print(a);
+  print(b);
+  print(c);
+  assertEquals(6, a);
+  assertEquals(5, b);
+  assertEquals([4, 3, 2, 1], c);
+};
+
+function g() {
+  f(6, 5, 4, 3, 2, 1);
+};
+
+%PrepareFunctionForOptimization(g);
+g();
+g();
+g();
+
+%OptimizeFunctionOnNextCall(g);
+g();

deps/v8/test/mjsunit/es6/regress/regress-513474.js

@@ -0,0 +1,5 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function(...a) { function f() { eval() } })();

deps/v8/test/mjsunit/es6/regress/regress-517455.js

@@ -0,0 +1,6 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f({x = ""}) { eval(x) }
+f({})

deps/v8/test/mjsunit/es6/regress/regress-5337.js

@@ -0,0 +1,39 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function testNestedSpreadsInPatterns() {
+  (function () {
+    var [...[...x]] = [42, 17];
+    assertArrayEquals([42, 17], x);
+  })();
+  (function () {
+    let [...[...x]] = [42, 17];
+    assertArrayEquals([42, 17], x);
+  })();
+  (function () {
+    const [...[...x]] = [42, 17];
+    assertArrayEquals([42, 17], x);
+  })();
+  (function () {
+    var x; [...[...x]] = [42, 17];
+    assertArrayEquals([42, 17], x);
+  })();
+
+  function f1([...[...x]] = [42, 17]) { return x; }
+  assertArrayEquals([42, 17], f1());
+  assertArrayEquals([1, 2, 3], f1([1, 2, 3]));
+
+  var f2 = function ([...[...x]] = [42, 17]) { return x; }
+  assertArrayEquals([42, 17], f2());
+  assertArrayEquals([1, 2, 3], f2([1, 2, 3]));
+
+  // The following two were failing in debug mode, until v8:5337 was fixed.
+  var f3 = ([...[...x]] = [42, 17]) => { return x; };
+  assertArrayEquals([42, 17], f3());
+  assertArrayEquals([1, 2, 3], f3([1, 2, 3]));
+
+  var f4 = ([...[...x]] = [42, 17]) => x;
+  assertArrayEquals([42, 17], f4());
+  assertArrayEquals([1, 2, 3], f4([1, 2, 3]));
+})();

deps/v8/test/mjsunit/es6/regress/regress-5598.js

@@ -0,0 +1,17 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --turbo-escape --allow-natives-syntax
+
+function fn(a) {
+  var [b] = a;
+  return b;
+}
+
+%PrepareFunctionForOptimization(fn);
+fn('a');
+fn('a');
+%OptimizeFunctionOnNextCall(fn);
+
+fn('a');

deps/v8/test/mjsunit/es6/regress/regress-576662.js

@@ -0,0 +1,9 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// https://code.google.com/p/chromium/issues/detail?id=576662 (simplified)
+
+Realm.create();
+this.__proto__ = new Proxy({},{});
+assertThrows(() => Realm.eval(1, "Realm.global(0).bla = 1"));

deps/v8/test/mjsunit/es6/regress/regress-5929-1.js

@@ -0,0 +1,16 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var buf = new ArrayBuffer(0x10000);
+var arr = new Uint8Array(buf).fill(55);
+var tmp = {};
+tmp[Symbol.toPrimitive] = function () {
+  %ArrayBufferDetach(arr.buffer);
+  return 50;
+}
+assertThrows(function() {
+  arr.copyWithin(tmp);
+}, TypeError);

deps/v8/test/mjsunit/es6/regress/regress-594084.js

@@ -0,0 +1,9 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+(function() {
+  function CRASH(defaultParameter =
+      (function() { function functionDeclaration() { return 0; } }())) {
+  }
+})();

deps/v8/test/mjsunit/es6/regress/regress-6098.js

@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const fn = (c) => {
+  let d = [1, 2], x = [3, 4],
+      e = null,
+      f = null;
+  0 < c.getIn(['a']) ? [e, f] = d : [e, f] = x;
+  return [e, f];
+};
+
+assertEquals([3, 4], fn({ getIn(x) { return false; } }));
+assertEquals([1, 2], fn({ getIn(x) { return true; } }));

deps/v8/test/mjsunit/es6/regress/regress-6322.js

@@ -0,0 +1,11 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Crash with --verify-heap
+(function*() { for (let { a = class b { } } of [{}]) { } })().next();
+(function() { for (let { a = class b { } } of [{}]) { } })();
+(function() { var a; for ({ a = class b { } } of [{}]) { } })();
+
+(function() { for (let [a = class b { } ] = [[]]; ;) break; })();
+(function() { var a; for ([a = class b { } ] = [[]]; ;) break; })();

deps/v8/test/mjsunit/es6/regress/regress-650172.js

@@ -0,0 +1,6 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var iterator = [].entries().__proto__.__proto__[Symbol.iterator];
+print(1/iterator(-1E-300));

deps/v8/test/mjsunit/es6/regress/regress-660925.js

@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let array = new Array(0xFFFFFFFF);
+let it = array.keys();
+assertEquals({ value: 0, done: false }, it.next());
+
+it = array.entries();
+assertEquals({ value: [0, undefined], done: false }, it.next());
+
+it = array[Symbol.iterator]();
+assertEquals({ value: undefined, done: false }, it.next());

deps/v8/test/mjsunit/es6/regress/regress-666622.js

@@ -0,0 +1,41 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function iterateArray() {
+  var array = new Array();
+  var it = array.entries();
+  it.next();
+}
+
+function iterateTypedArray() {
+  var array = new Uint8Array();
+  var it = array.entries();
+  it.next();
+}
+
+function testArray() {
+  iterateArray();
+  try {
+  } catch (e) {
+  }
+}
+%PrepareFunctionForOptimization(testArray);
+testArray();
+testArray();
+%OptimizeFunctionOnNextCall(testArray);
+testArray();
+
+function testTypedArray() {
+  iterateTypedArray();
+  try {
+  } catch (e) {
+  }
+}
+%PrepareFunctionForOptimization(testTypedArray);
+testTypedArray();
+testTypedArray();
+%OptimizeFunctionOnNextCall(testTypedArray);
+testTypedArray();

deps/v8/test/mjsunit/es6/regress/regress-7706.js

@@ -0,0 +1,40 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function toString(o) {
+  %ToFastProperties(o.__proto__);
+  return Object.prototype.toString.call(o);
+}
+
+class TestNumber extends Number {}
+TestNumber.prototype[Symbol.toStringTag] = "TestNumber";
+assertEquals("[object TestNumber]", toString(new TestNumber), "Try #1");
+assertEquals("[object TestNumber]", toString(new TestNumber), "Try #2");
+
+class TestBoolean extends Boolean {}
+TestBoolean.prototype[Symbol.toStringTag] = "TestBoolean";
+assertEquals("[object TestBoolean]", toString(new TestBoolean), "Try #1");
+assertEquals("[object TestBoolean]", toString(new TestBoolean), "Try #2");
+
+class TestString extends String {}
+TestString.prototype[Symbol.toStringTag] = "TestString";
+assertEquals("[object TestString]", toString(new TestString), "Try #1");
+assertEquals("[object TestString]", toString(new TestString), "Try #2");
+
+class base {}
+class TestBigInt extends base {}
+TestBigInt.prototype[Symbol.toStringTag] = 'TestBigInt';
+var b = new TestBigInt();
+b.__proto__.__proto__ = BigInt.prototype;
+assertEquals("[object TestBigInt]", toString(b), "Try #1");
+assertEquals("[object TestBigInt]", toString(b), "Try #2");
+
+class TestSymbol extends base {}
+TestSymbol.prototype[Symbol.toStringTag] = 'TestSymbol';
+var sym = new TestSymbol();
+sym.__proto__.__proto__ = Symbol.prototype;
+assertEquals("[object TestSymbol]", toString(sym), "Try #1");
+assertEquals("[object TestSymbol]", toString(sym), "Try #2");

deps/v8/test/mjsunit/es6/regress/regress-777182.js

@@ -0,0 +1,9 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --enable-slow-asserts
+
+var __v_65159 = [1.3];
+__v_65159.length = 0;
+new Int8Array(10).set(__v_65159);

deps/v8/test/mjsunit/es6/regress/regress-9234.js

@@ -0,0 +1,35 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function returnFalsishStrict() {
+  "use strict";
+
+  function trySet(o) {
+    o["bla"] = 0;
+  }
+
+  var proxy = new Proxy({}, {});
+  var proxy2 = new Proxy({}, { set() { return ""; } });
+
+  trySet(proxy);
+  trySet(proxy);
+  assertThrows(() => trySet(proxy2), TypeError);
+})();
+
+(function privateSymbolStrict() {
+  "use strict";
+  var proxy = new Proxy({}, {});
+  var proxy2 = new Proxy({a: 1}, { set() { return true; } });
+
+  function trySet(o) {
+    var symbol = o == proxy2 ? %CreatePrivateSymbol("private"): 1;
+    o[symbol] = 0;
+  }
+
+  trySet(proxy);
+  trySet(proxy);
+  assertThrows(() => trySet(proxy2), TypeError);
+})();

deps/v8/test/mjsunit/es6/regress/regress-arrow-duplicate-params.js

@@ -0,0 +1,5 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("(x, x, y) => 10;", SyntaxError);

deps/v8/test/mjsunit/es6/regress/regress-cr372788.js

@@ -0,0 +1,45 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var x = 0;
+var y = 0;
+
+var thenable = { then: function(f) { x++; f(); } };
+
+for (var i = 0; i < 3; ++i) {
+  Promise.resolve(thenable).then(function() { x++; y++; });
+}
+assertEquals(0, x);
+
+(function check() {
+  Promise.resolve().then(function() {
+    // Delay check until all handlers have run.
+    if (y < 3) check(); else assertEquals(6, x);
+  }).catch(function(e) { %AbortJS("FAILURE: " + e) });
+})();

deps/v8/test/mjsunit/es6/regress/regress-cr493566.js

@@ -0,0 +1,102 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var global = this;
+
+(function TestGlobalReceiver() {
+  class A {
+    s(value) {
+      super.bla = value;
+    }
+  }
+  var a = new A();
+  a.s(9);
+  assertEquals(undefined, global.bla);
+  assertEquals(9, a.bla);
+
+  a = new A();
+  a.s.call(global, 10);
+  assertEquals(10, global.bla);
+  assertEquals(undefined, a.bla);
+})();
+
+
+(function TestProxyProto() {
+  var calls = 0;
+  var handler = {
+    set(t, p, v, r) {
+      calls++;
+      return Reflect.set(t, p, v, r);
+    },
+    getPropertyDescriptor(target, name) {
+      calls += 10;
+      return undefined;
+    }
+  };
+  var target = {};
+  var proxy = new Proxy(target, handler);
+  var object = {
+    __proto__: proxy,
+    setX(v) {
+      super.x = v;
+    },
+    setSymbol(sym, v) {
+      super[sym] = v;
+    }
+  };
+
+  object.setX(1);
+  assertEquals(1, object.x);
+  assertEquals(1, Object.getOwnPropertyDescriptor(object, 'x').value);
+  assertEquals(1, calls);
+
+  calls = 0;
+  object.setX.call(proxy, 2);
+  assertEquals(2, target.x);
+  assertEquals(1, Object.getOwnPropertyDescriptor(object, 'x').value);
+  assertEquals(1, calls);
+
+  var sym = Symbol();
+  calls = 0;
+  object.setSymbol.call(global, sym, 2);
+  assertEquals(2, Object.getOwnPropertyDescriptor(global, sym).value);
+  // We currently do not invoke proxy traps for symbols
+  assertEquals(1, calls);
+});
+
+
+(function TestProxyReceiver() {
+  var object = {
+    setY(v) {
+      super.y = v;
+    }
+  };
+
+  var calls = 0;
+  var target = {target:1};
+  var handler = {
+    getOwnPropertyDescriptor(t, name) {
+      calls++;
+    },
+    defineProperty(t, name, desc) {
+      calls += 10;
+      t[name] = desc.value;
+      return true;
+    },
+    set(target, name, value) {
+      assertUnreachable();
+    }
+  };
+  var proxy = new Proxy(target, handler);
+
+  assertEquals(undefined, object.y);
+  object.setY(10);
+  assertEquals(10, object.y);
+
+  // Change the receiver to the proxy, but the set is called on the global.
+  object.setY.call(proxy, 3);
+  assertEquals(3, target.y);
+  assertEquals(11, calls);
+})();

deps/v8/test/mjsunit/es6/regress/regress-cr512574.js

@@ -0,0 +1,7 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f({}) {
+  for (var v in []);
+};

deps/v8/test/mjsunit/es6/regress/regress-cr895860.js

@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function() {
+  var s = "f";
+
+  // 2^18 length, enough to ensure an array (of pointers) bigger than 500KB.
+  for (var i = 0; i < 18; i++) {
+    s += s;
+  }
+
+  var ss = [...s];
+})();

deps/v8/test/mjsunit/es6/regress/regress-crbug-1516321.js

@@ -0,0 +1,17 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --jit-fuzzing
+class C extends class {}
+{
+  constructor() {
+    for (let i = 0; i < 5; i++) {
+      const x = new Uint32Array(246);
+      let [...y] = x;
+      return {};
+      function f() {}
+    }
+  }
+}
+new C();

deps/v8/test/mjsunit/es6/regress/regress-crbug-1516861.js

@@ -0,0 +1,15 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function F0() {
+}
+class C2 extends F0 {
+    constructor() {
+        for (let v7 = 0; v7 < 5; v7++) {
+            return undefined;
+        }
+        super();
+    }
+}
+assertThrows(() => new C2(), ReferenceError);

deps/v8/test/mjsunit/es6/regress/regress-crbug-248025.js

@@ -0,0 +1,38 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Filler long enough to trigger lazy parsing.
+var filler = "//" + new Array(1024).join('x');
+
+// Test that the pre-parser does not crash when the expected contextual
+// keyword as part if a 'for' statement is not and identifier.
+try {
+  eval(filler + "\nfunction f() { for (x : y) { } }");
+  throw "not reached";
+} catch (e) {
+  if (!(e instanceof SyntaxError)) throw e;
+}

deps/v8/test/mjsunit/es6/regress/regress-crbug-346141.js

@@ -0,0 +1,9 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var s = Symbol()
+var o = {}
+o[s] = 2
+o[""] = 3
+Object.getOwnPropertySymbols(o)

deps/v8/test/mjsunit/es6/regress/regress-crbug-448730.js

@@ -0,0 +1,15 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar() {}
+bar({ a: new Proxy({}, {}) });
+function foo(x) { x.a.b == ""; }
+var x = {a: {b: "" }};
+%PrepareFunctionForOptimization(foo);
+foo(x);
+foo(x);
+%OptimizeFunctionOnNextCall(foo);
+foo(x);

deps/v8/test/mjsunit/es6/regress/regress-crbug-461520.js

@@ -0,0 +1,18 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var fuse = 1;
+
+var handler = {
+  get: function() { return function() {} },
+  has() { return true },
+  getOwnPropertyDescriptor: function() {
+    if (fuse-- == 0) throw "please die";
+    return {value: function() {}, configurable: true};
+  }
+};
+
+var p = new Proxy({}, handler);
+var o = Object.create(p);
+with (o) { f() }

deps/v8/test/mjsunit/es6/regress/regress-crbug-465671-null.js

@@ -0,0 +1,14 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This used to trigger a segfault because of NULL being accessed.
+function f() {
+  var a = [10];
+  try {
+    f();
+  } catch(e) {
+    a.map((v) => v + 1);
+  }
+}
+f();

deps/v8/test/mjsunit/es6/regress/regress-crbug-465671.js

@@ -0,0 +1,14 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This used to trigger crash because of an unhandled stack overflow.
+function f() {
+  var a = [10];
+  try {
+    f();
+  } catch(e) {
+    a.map(v => v + 1);
+  }
+}
+f();

deps/v8/test/mjsunit/es6/regress/regress-crbug-820596.js

@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --print-ast
+
+var x;
+`Crashes if OOB read with --print-ast ${x}`;

deps/v8/test/mjsunit/es6/regress/regress-crbug-837939.js

@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Create a double elements array.
+const iterable = [123.123];
+assertTrue(%HasDoubleElements(iterable))
+
+iterable.length = 0;
+assertTrue(%HasDoubleElements(iterable))
+
+// Should not throw here.
+let map = new Map(iterable);
+assertEquals(0, map.size);
+new WeakMap(iterable); // WeakMap does not have a size

deps/v8/test/mjsunit/es6/regress/regress-inlined-new-target.js

@@ -0,0 +1,14 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function g() { return { val: new.target }; }
+function f() { return (new g()).val; }
+
+%PrepareFunctionForOptimization(f);
+assertEquals(g, f());
+assertEquals(g, f());
+%OptimizeFunctionOnNextCall(f);
+assertEquals(g, f());

deps/v8/test/mjsunit/es6/regress/regress-lookup-transition.js

@@ -0,0 +1,14 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+var proxy = new Proxy({}, { getOwnPropertyDescriptor:function() {
+  gc();
+}});
+
+function f() { this.x = 23; }
+f.prototype = proxy;
+new f();
+new f();

deps/v8/test/mjsunit/es6/regress/regress-new-target-context.js

@@ -0,0 +1,25 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Test access of the new.target value in functions that also allocate local
+// function contexts of varying sizes, making sure the value is not clobbered.
+
+function makeFun(n) {
+  var source = "(function f" + n + "() { ";
+  for (var i = 0; i < n; ++i) source += "var v" + i + "; ";
+  source += "(function() { 0 ";
+  for (var i = 0; i < n; ++i) source += "+ v" + i + " ";
+  source += "})(); return { value: new.target }; })";
+  return eval(source);
+}
+
+// Exercise fast case.
+var a = makeFun(4);
+assertEquals(a, new a().value);
+assertEquals(undefined, a().value);
+
+// Exercise slow case.
+var b = makeFun(128);
+assertEquals(b, new b().value);
+assertEquals(undefined, b().value);