Upload Kmake

deps/v8/test/mjsunit/es7/regress/regress-5986.js

@@ -0,0 +1,31 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+var array = [1.7, 1.7, 1.7];
+var mutator = {
+  [Symbol.toPrimitive]() {
+    Object.defineProperties(
+        array, {0: {get() {}}, 1: {get() {}}, 2: {get() {}}});
+
+    return 0;
+  }
+};
+
+assertTrue(array.includes(undefined, mutator));
+
+function search(array, searchElement, startIndex) {
+  return array.includes(searchElement, startIndex);
+};
+%PrepareFunctionForOptimization(search);
+array = [1.7, 1.7, 1.7];
+var not_mutator = {
+  [Symbol.toPrimitive]() {
+    return 0;
+  }
+};
+assertFalse(search(array, undefined, not_mutator));
+assertFalse(search(array, undefined, not_mutator));
+%OptimizeFunctionOnNextCall(search);
+assertTrue(search(array, undefined, mutator));

deps/v8/test/mjsunit/es7/regress/regress-633883.js

@@ -0,0 +1,9 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+v5 = new Array();
+v17 = encodeURIComponent(v5);
+v19 = isFinite();
+v34 = new Array(v19);
+v47 = v34.includes(v17);

deps/v8/test/mjsunit/es7/regress/regress-634269.js

@@ -0,0 +1,7 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+__v_1 = new Uint8Array();
+Object.defineProperty(__v_1.__proto__, 'length', {value: 42});
+Array.prototype.includes.call(new Uint8Array(), 2);

deps/v8/test/mjsunit/es7/regress/regress-634273.js

@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --enable-slow-asserts
+
+array = new Array(undefined, undefined, undefined);
+Object.defineProperty(array, 0, {
+  get: function() {
+    array.push(undefined, undefined);
+  }
+});
+array[0x80000] = 1;
+result = array.includes(new WeakMap());

deps/v8/test/mjsunit/es7/regress/regress-634357.js

@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --enable-slow-asserts
+
+array = new Array({}, {}, {});
+Object.defineProperty(array, 1, {
+  get: function() {
+    array.length = 0;
+    array[0] = -2147483648;
+  }
+});
+result = array.includes(new Array());