Upload Kmake

deps/v8/test/mjsunit/es9/regress/regress-866229.js

@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var obj = { length: 1, 0: "spread" };
+obj[Symbol.toStringTag] = "foo";
+obj[Symbol.hasInstance] = function() { return true; }
+obj[Symbol.isConcatSpreadable] = true;
+
+var obj2 = { ...obj };
+
+// Crash if fast result map bitfield is not set correctly, if verifying heap
+%HeapObjectVerify(obj2);
+
+// Ensure correct result for some well-known symbols
+assertEquals("[object foo]", Object.prototype.toString.call(obj2));
+assertTrue(Uint8Array instanceof obj2);
+assertEquals(["spread"], [].concat(obj2));

deps/v8/test/mjsunit/es9/regress/regress-866282.js

@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Runtime_ObjectCloneIC_Slow() source argument must be a HeapObject handle,
+// because undefined/null are allowed.
+function spread(o) { return { ...o }; }
+
+// Transition to MEGAMORPHIC
+assertEquals({}, spread(new function C1() {}));
+assertEquals({}, spread(new function C2() {}));
+assertEquals({}, spread(new function C3() {}));
+assertEquals({}, spread(new function C4() {}));
+assertEquals({}, spread(new function C5() {}));
+
+// Trigger Runtime_ObjectCloneIC_Slow() with a non-JSReceiver.
+assertEquals({}, spread(undefined));

deps/v8/test/mjsunit/es9/regress/regress-866357.js

@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Check that we do appropriate used/unused field accounting
+var p = Promise.resolve();
+var then = p.then = () => {};
+
+function spread() { return { ...p }; }
+
+%PrepareFunctionForOptimization(spread);
+assertEquals({ then }, spread());
+assertEquals({ then }, spread());
+assertEquals({ then }, spread());
+%OptimizeFunctionOnNextCall(spread);
+assertEquals({ then }, spread());

deps/v8/test/mjsunit/es9/regress/regress-866727.js

@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Check that IfException/IfSuccess rewiring works in JSInliner
+function test() {
+  var spread = function(value) { return { ...value }; }
+  try {
+    assertEquals({}, spread());
+  } catch (e) {}
+};
+
+%PrepareFunctionForOptimization(test);
+test();
+test();
+test();
+%OptimizeFunctionOnNextCall(test);
+test();

deps/v8/test/mjsunit/es9/regress/regress-866861.js

@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Check that property constness for out-of-object fields is valid
+var o = {};
+var toString = o.toString = function() {};
+try {
+assertEquals({ toString }, o = { ...o });
+} catch (e) {}
+o.toString = [];

deps/v8/test/mjsunit/es9/regress/regress-867958.js

@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Check that encountering deprecated Maps does not cause CloneObjectIC to
+// crash.
+var obj1 = { x: 1 };
+var obj2 = { x: 2 }; // same map
+obj2.x = null; // deprecate map
+
+function f() { return { ...obj1 } };
+assertEquals({ x: 1 }, f()); // missed, object migrated to cached new map
+assertEquals({ x: 1 }, f()); // monomorphic cache-hit

deps/v8/test/mjsunit/es9/regress/regress-869342.js

@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+function spread(o) { return { ...o }; }
+
+(function setupPolymorphicFeedback() {
+  function C1() { this.p0 = 1; }
+  function C2() { this.p1 = 2; this.p2 = 3; }
+  assertEquals({ p0: 1 }, spread(new C1));
+  assertEquals({ p1: 2, p2: 3 }, spread(new C2));
+})();
+
+gc(); // Clobber cached map in feedback[0], and check that we don't crash
+function C3() { this.p0 = 3; }
+assertEquals({ p0: 3 }, spread(new C3));

deps/v8/test/mjsunit/es9/regress/regress-902965.js

@@ -0,0 +1,12 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Previously, spreading in-object properties would always treat double fields
+// as tagged, potentially dereferencing a Float64.
+function inobjectDouble() {
+  "use strict";
+  this.x = -3.9;
+}
+const instance = new inobjectDouble();
+const clone = { ...instance, };

deps/v8/test/mjsunit/es9/regress/regress-903070.js

@@ -0,0 +1,15 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function clone(src) {
+  return { ...src };
+}
+
+function inobjectDoubles() {
+  "use strict";
+  this.p0 = -6400510997704731;
+}
+
+// Check that unboxed double is not treated as tagged
+assertEquals({ p0: -6400510997704731 }, clone(new inobjectDoubles()));

deps/v8/test/mjsunit/es9/regress/regress-904167.js

@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Previously, spreading in-object properties would always treat double fields
+// as tagged, potentially dereferencing a Float64.
+
+// Ensure that we don't fail an assert from --verify-heap when cloning a
+// HeapNumber in the CloneObjectIC handler case.
+var src, clone;
+for (var i = 0; i < 40000; i++) {
+    src = { ...i, x: -9007199254740991 };
+    clone = { ...src };
+}