Upload Kmake

deps/v8/test/mjsunit/harmony/regress/regress-173361.js

@@ -0,0 +1,33 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --harmony
+
+const x = 7;
+
+function f() { const y = 8; }
+f();

deps/v8/test/mjsunit/harmony/regress/regress-352690887.js

@@ -0,0 +1,32 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let set = new Set([1, 2, 3]);
+
+let setLike = {
+  size: 0,
+  has() {
+    throw new Error("Unexpected call to |has| method");
+  },
+  keys() {
+    return {
+      get next() {
+        // Clear the set when getting the |next| method.
+        set.clear();
+
+        // And then add a single new key.
+        set.add(4);
+
+        return function() {
+          return {done: true};
+        };
+      }
+    };
+  },
+};
+
+// The result should consist of the single, newly added key.
+let result = set.union(setLike);
+const resultArray = Array.from(result);
+assertEquals(resultArray, [4]);

deps/v8/test/mjsunit/harmony/regress/regress-368503280.js

@@ -0,0 +1,7 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --js-staging
+const stack = this.AsyncDisposableStack;
+Reflect.construct(stack, [], Float64Array);

deps/v8/test/mjsunit/harmony/regress/regress-369010108.js

@@ -0,0 +1,22 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --js-staging
+
+function loop() {
+  try {
+    return loop();
+  } catch (e) {
+    return async_function();
+  }
+}
+assertThrowsAsync(loop(), RangeError);
+async function dispose_function() {
+  let stack = new AsyncDisposableStack();
+  stack.use();
+  await stack.disposeAsync();
+}
+async function async_function() {
+  await dispose_function();
+}

deps/v8/test/mjsunit/harmony/regress/regress-369652654.js

@@ -0,0 +1,14 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --ignore-unhandled-promises --stack-size=100 --js-staging
+
+async function loop() {
+  function disposal() {}
+  const stack = new AsyncDisposableStack();
+  stack[Symbol.dispose] = disposal;
+  stack.use(stack).disposeAsync();
+  return await loop();
+}
+assertThrowsAsync(loop(), RangeError);

deps/v8/test/mjsunit/harmony/regress/regress-379888466.js

@@ -0,0 +1,11 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --js-staging
+
+var using;
+
+if (true) {
+    using = () => { return 42; };
+}

deps/v8/test/mjsunit/harmony/regress/regress-380677637.js

@@ -0,0 +1,19 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --js-staging
+
+async function* generator() {}
+const resource = generator();
+
+function MyConstructor(executor) {
+  throw Error('Should not be called');
+}
+
+// When Promise.then() needs to create a new Promise object,
+// MyConstructor will be used as the constructor method to create the object.
+Object.defineProperty(Promise, Symbol.species, {'value': MyConstructor});
+
+// Trigger AsyncIteratorPrototypeAsyncDispose()
+resource[Symbol.asyncDispose]();

deps/v8/test/mjsunit/harmony/regress/regress-385406640.js

@@ -0,0 +1,20 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --js-staging
+
+for (let v0 = 0; v0 < 5; v0++) {
+    async function f1() {
+      await using v13 = {
+        [Symbol.asyncDispose]() {
+            throw RangeError();
+        },
+    };
+        await using v12 = {
+          [Symbol.asyncDispose]() {
+          },
+      };
+    }
+    assertThrowsAsync(f1().then(), RangeError);
+  }

deps/v8/test/mjsunit/harmony/regress/regress-402863536.js

@@ -0,0 +1,19 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --always-turbofan
+
+class C1 {
+  constructor() {
+    return globalThis;
+  }
+}
+class C2 extends C1 {
+  field = 'abc';
+}
+new C2();
+new C2();
+Object.seal(globalThis);
+
+assertThrows(() => new C2(), TypeError);

deps/v8/test/mjsunit/harmony/regress/regress-4696.js

@@ -0,0 +1,29 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function testSpreadIndex() {
+  var result = [...[17, 42]][1];
+  assertEquals(result, 42);
+})();
+
+(function testSpreadProperty() {
+  var result = [...[17, 42]].length;
+  assertEquals(result, 2);
+})();
+
+(function testSpreadMethodCall() {
+  var result = [...[17, 42]].join("+");
+  assertEquals(result, "17+42");
+})();
+
+(function testSpreadSavedMethodCall() {
+  var x = [...[17, 42]];
+  var method = x.join;
+  var result = method.call(x, "+");
+  assertEquals(result, "17+42");
+})();
+
+(function testSpreadAsTemplateTag() {
+  assertThrows(function() { [...[17, 42]] `foo`; }, TypeError)
+})();

deps/v8/test/mjsunit/harmony/regress/regress-6322.js

@@ -0,0 +1,7 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Crash with --verify-heap
+(async function() { for await (let { a = class b { } } of [{}]) { } })();
+(async function() { var a; for await ({ a = class b { } } of [{}]) { } })();

deps/v8/test/mjsunit/harmony/regress/regress-771470.js

@@ -0,0 +1,8 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --enable-slow-asserts
+
+async function* gen() { };
+gen.prototype = 1;

deps/v8/test/mjsunit/harmony/regress/regress-772649.js

@@ -0,0 +1,12 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+async function* gen([[notIterable]] = [null]) {}
+%PrepareFunctionForOptimization(gen);
+assertThrows(() => gen(), TypeError);
+assertThrows(() => gen(), TypeError);
+%OptimizeFunctionOnNextCall(gen);
+assertThrows(() => gen(), TypeError);

deps/v8/test/mjsunit/harmony/regress/regress-8808.js

@@ -0,0 +1,13 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(() => eval(`
+  class Foo {
+    #x = 1;
+    destructureX() {
+      const { #x: x } = this;
+      return x;
+    }
+  }
+`), SyntaxError);

deps/v8/test/mjsunit/harmony/regress/regress-897436.js

@@ -0,0 +1,12 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --enable-slow-asserts
+
+async function* gen() {
+  const alwaysPending = new Promise(() => {});
+  alwaysPending.then = "non-callable then";
+  yield alwaysPending;
+}
+gen().next();

deps/v8/test/mjsunit/harmony/regress/regress-912504.js

@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --always-turbofan --allow-natives-syntax
+
+function test() {
+  Object.fromEntries([[]]);
+  %DeoptimizeNow();
+}
+test();

deps/v8/test/mjsunit/harmony/regress/regress-952722.js

@@ -0,0 +1,12 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-lazy
+
+class A {
+  static #a = 1;
+  static b = class {
+    static get_A() { return val.#a; }
+  }
+}

deps/v8/test/mjsunit/harmony/regress/regress-crbug-1367133.js

@@ -0,0 +1,27 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --stress-concurrent-inlining
+
+(function TestArray() {
+  function doCall(a, method, ...args) { a[method](); }
+  function callOnArray(a) { doCall(a, 'with'); a.keys(); }
+
+  %PrepareFunctionForOptimization(callOnArray);
+  callOnArray([1]);
+  doCall({}, 'valueOf', "foo");
+  %OptimizeFunctionOnNextCall(callOnArray);
+  callOnArray([{},]);
+})();
+
+(function TestTypedArray() {
+  function doCall(a, method, ...args) { a[method](); }
+  function callOnArray(a) { doCall(a, 'with'); a.keys(); }
+
+  %PrepareFunctionForOptimization(callOnArray);
+  callOnArray(new Uint8Array(32));
+  doCall({}, 'valueOf', "foo");
+  %OptimizeFunctionOnNextCall(callOnArray);
+  callOnArray(new Float64Array(8));
+})();

deps/v8/test/mjsunit/harmony/regress/regress-crbug-1372500.js

@@ -0,0 +1,14 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+// Register an object in a FinalizationRegistry with a Symbol as the unregister
+// token.
+let fr = new FinalizationRegistry(function () {});
+(function register() {
+  fr.register({}, "holdings", Symbol('unregisterToken'));
+})();
+// The unregister token should be dead, trigger its collection.
+gc();

deps/v8/test/mjsunit/harmony/regress/regress-crbug-1381656.js

@@ -0,0 +1,13 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+// Returning arguments for a function with 1 parameter results in toSorted code
+// initially under-allocating a sorting worklist of length 1 (instead of
+// 2). This then results the worklist growing to length 17, with elements 2-16
+// being holes. The hole values should not be accessed.
+let args = (function(x) {
+  return arguments;
+})(1, 2);
+Array.prototype.toSorted.call(args);

deps/v8/test/mjsunit/harmony/regress/regress-crbug-1410963.js

@@ -0,0 +1,7 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+assertTrue(/[a-cB]/vi.test('b'));
+assertTrue(/[a-cB]/vi.test('B'));

deps/v8/test/mjsunit/harmony/regress/regress-crbug-1422812.js

@@ -0,0 +1,6 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+assertThrows(() => JSON.rawJSON(this), SyntaxError);

deps/v8/test/mjsunit/harmony/regress/regress-crbug-1423310.js

@@ -0,0 +1,12 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+const v2 = JSON.rawJSON(-2025014085);
+const o3 = {
+    "type": v2,
+    __proto__: v2,
+};
+const v6 = [o3];
+Reflect.apply(JSON.stringify, this, v6);

deps/v8/test/mjsunit/harmony/regress/regress-crbug-1444842.js

@@ -0,0 +1,13 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+
+let iter = Iterator.from({
+  next() {
+    return { value: 42, done: false };
+  }
+});
+function f() {}
+Object.defineProperty(iter, 100, { set: f });
+Object.defineProperty(iter, 100, { set: f });

deps/v8/test/mjsunit/harmony/regress/regress-crbug-1471048.js

@@ -0,0 +1,17 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+const firstSet = new Set();
+firstSet.add(42);
+
+const otherSet = new Set();
+
+const resultSet = new Set();
+resultSet.add(42);
+
+const resultArray = Array.from(resultSet);
+const differenceArray = Array.from(firstSet.difference(otherSet));
+
+assertEquals(resultArray, differenceArray);

deps/v8/test/mjsunit/harmony/regress/regress-crbug-1492391.js

@@ -0,0 +1,10 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const v1 = Array.fromAsync;
+const v2 = [-6.752893033403886];
+const o3 = {
+};
+Object.defineProperty(o3, "type", { configurable: true, enumerable: true, set: v1 });
+o3.type = v2;

deps/v8/test/mjsunit/harmony/regress/regress-crbug-1492700.js

@@ -0,0 +1,10 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const v1 = Array.fromAsync;
+function F2(a4) {
+    this.toJSON = a4;
+    JSON.stringify(this);
+}
+new F2(v1);

deps/v8/test/mjsunit/harmony/regress/regress-crbug-347528.js

@@ -0,0 +1,37 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --harmony
+
+"use strict";
+let unused_var = 1;
+function __f_12() { new Array(); }
+%PrepareFunctionForOptimization(__f_12);
+__f_12();
+__f_12();
+%OptimizeFunctionOnNextCall(__f_12);
+__f_12();

deps/v8/test/mjsunit/harmony/regress/regress-crbug-571149.js

@@ -0,0 +1,19 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+(function(a = 0){
+  var x;  // allocated in a var block, due to use of default parameter
+  (function() { return !x })();
+})();
+
+(function({a}){
+  var x;  // allocated in a var block, due to use of parameter destructuring
+  (function() { return !x })();
+})({});
+
+(function(...a){
+  var x;  // allocated in a var block, due to use of rest parameter
+  (function() { return !x })();
+})();

deps/v8/test/mjsunit/harmony/regress/regress-crbug-621111.js

@@ -0,0 +1,6 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(y = 1[1, [...[]]]) => 1;   // will core dump, if not fixed
+(y = 1[1, [...[]]]) => {};  // will core dump, if not fixed

deps/v8/test/mjsunit/harmony/regress/regress-crbug-621496.js

@@ -0,0 +1,7 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function testIllegalSpreadAsSingleArrowParameter() {
+  assertThrows("(...[42]) => 42)", SyntaxError)  // will core dump, if not fixed
+})();

deps/v8/test/mjsunit/harmony/regress/regress-typedarray-out-of-bounds.js

@@ -0,0 +1,10 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = new Int32Array(10);
+function f(a) { a["-1"] = 15; }
+for (var i = 0; i < 3; i++) {
+  f(a);
+}
+assertEquals(undefined, a[-1]);