Upload Kmake

deps/v8/test/mjsunit/regress/asm/regress-1223839.js

@@ -0,0 +1,14 @@
+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --print-code
+
+function module(global, imports) {
+  'use asm';
+  var x = imports.fn;
+  function f() {}
+  return f;
+}
+
+module(this, {fn: i => i});

deps/v8/test/mjsunit/regress/asm/regress-1248677.js

@@ -0,0 +1,24 @@
+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function setup_proxy() {
+  // Mess with the prototype to get funky conversion behavior.
+  Function.prototype.__proto__ = new Proxy(setup_proxy, {
+    get: async (target, key) => {
+      console.log(key);
+    }
+  });
+}
+
+setup_proxy();
+
+function asm(global, imports) {
+  'use asm';
+  // Trigger proxy trap when looking up #toPrimitive:
+  var bar = +imports.bar;
+  function f() {}
+  return {f: f};
+}
+
+assertThrows(() => asm(undefined, {bar: setup_proxy}), TypeError);

deps/v8/test/mjsunit/regress/asm/regress-1252747.js

@@ -0,0 +1,27 @@
+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function print_stack(unsigned) {
+  print('stack:');
+  print((new Error()).stack);
+}
+
+function asm(global, env) {
+  'use asm';
+
+  var print_stack = env.print_stack;
+
+  function main() {
+    var count = 0;
+
+    while ((count | 0) < 10) {
+      print_stack(1);
+      count = count + 1 | 0;
+    }
+  }
+
+  return main;
+}
+
+asm({}, {'print_stack': print_stack})();

deps/v8/test/mjsunit/regress/asm/regress-13967.js

@@ -0,0 +1,45 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const initial = 2**16;
+const max = 4 * initial;
+
+const memory = new ArrayBuffer(initial, { maxByteLength: max } );
+
+const heap = memory;
+
+function builder(stdlib, foreign, heap) {
+  "use asm";
+
+  const mem = new stdlib.Float64Array(heap);
+
+  function add(x, y) {
+    x = +x;
+    y = +y;
+
+    mem[0] = +x;
+    mem[1] = +y;
+
+    return +mem[0] + +mem[1];
+  }
+
+  return {add: add};
+}
+// Check that the asm.js module can be instantiated in the asm.js pipeline.
+builder(globalThis, undefined, new ArrayBuffer(initial));
+assertTrue(%IsAsmWasmCode(builder));
+
+const asm_js_module = builder(globalThis, undefined, heap);
+
+memory.resize(8);
+
+// Memory access out of bounds should return NaN.
+assertEquals(NaN, asm_js_module.add(4, 56));
+
+memory.resize(16);
+const foo = new Float64Array(memory);
+
+assertEquals(0, foo[1]);

deps/v8/test/mjsunit/regress/asm/regress-1402270.js

@@ -0,0 +1,16 @@
+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function print_stack(unused_arg) {
+  console.trace();
+}
+function asm(_, imports) {
+  'use asm';
+  var print_stack = imports.print_stack;
+  function f() {
+      print_stack(1);
+  }
+  return f;
+}
+asm({}, {'print_stack': print_stack})();

deps/v8/test/mjsunit/regress/asm/regress-1410962.js

@@ -0,0 +1,33 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const memory = new WebAssembly.Memory({ initial: 1, maximum: 4 });
+
+const heap = memory.buffer;
+
+function builder(stdlib, foreign, heap) {
+  "use asm";
+
+  const mem = new stdlib.Float64Array(heap);
+
+  function add(x, y) {
+    x = +x;
+    y = +y;
+
+    return +mem[0] + +mem[1];
+  }
+
+  return {add: add};
+}
+
+// Check that the asm.js module can be instantiated in the asm.js pipeline.
+builder(globalThis, undefined, new ArrayBuffer(2 ** 16));
+assertTrue(%IsAsmWasmCode(builder));
+
+const asm_js_module = builder(globalThis, undefined, heap);
+
+// Should not throw.
+memory.grow(0);

deps/v8/test/mjsunit/regress/asm/regress-575364.js

@@ -0,0 +1,11 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+function f() {
+  "use asm";
+
+}
+assertFalse(%IsAsmWasmCode(f));

deps/v8/test/mjsunit/regress/asm/regress-592352.js

@@ -0,0 +1,20 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --validate-asm
+
+function __f_76() {
+  "use asm";
+  function __f_72() {
+    %OptimizeFunctionOnNextCall();
+  }
+  return {__f_72:__f_72};
+}
+
+try {
+  assertTrue(%IsAsmWasmCode(__f_76));
+  assertTrue(false);
+} catch (e) {
+  print("Caught: " + e);
+}

deps/v8/test/mjsunit/regress/asm/regress-599719.js

@@ -0,0 +1,25 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --validate-asm
+
+function __f_7() {
+    %DeoptimizeFunction(__f_5);
+}
+function __f_8(global, env) {
+  "use asm";
+  var __f_7 = env.__f_7;
+  function __f_9(i4, i5) {
+    i4 = i4 | 0;
+    i5 = i5 | 0;
+    __f_7();
+  }
+  return {__f_9: __f_9}
+}
+function __f_5() {
+  var __v_5 = __f_8({}, {'__f_7': __f_7});
+  assertTrue(%IsAsmWasmCode(__f_8));
+  __v_5.__f_9(0, 0, 0);
+}
+__f_5();

deps/v8/test/mjsunit/regress/asm/regress-599825.js

@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+function __f_97(stdlib, buffer) {
+  "use asm";
+  var __v_30 = new stdlib.Int32Array(buffer);
+  function __f_74() {
+    var __v_27 = 4;
+    __v_30[__v_27 >> __v_2] = ((__v_30[-1073741825]|-10) + 2) | 0;
+  }
+}
+var module = __f_97(this);
+assertFalse(%IsAsmWasmCode(__f_97));

deps/v8/test/mjsunit/regress/asm/regress-608630.js

@@ -0,0 +1,71 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+var __v_5 = {};
+var __v_35 = {};
+var __v_44 = {};
+var __v_43 = {};
+
+try {
+__v_1 = 1;
+__v_2 = {
+  get: function() { return function() {} },
+  has() { return true },
+  getOwnPropertyDescriptor: function() {
+    if (__v_1-- == 0) throw "please die";
+    return {value: function() {}, configurable: true};
+  }
+};
+__v_3 = new Proxy({}, __v_2);
+__v_30 = Object.create(__v_35);
+with (__v_5) { f() }
+} catch(e) { print("Caught: " + e); }
+
+function __f_1(asmfunc, expect) {
+  var __v_1 = asmfunc.toString();
+  var __v_2 = __v_1.replace(new RegExp("use asm"), "");
+  var __v_39 = {Math: Math};
+  var __v_4 = eval("(" + __v_2 + ")")(__v_3);
+  print("Testing " + asmfunc.name + " (js)...");
+  __v_44.valueOf = __v_43;
+  expect(__v_4);
+  print("Testing " + asmfunc.name + " (asm.js)...");
+  var __v_5 = asmfunc(__v_3);
+  expect(__v_5);
+  print("Testing " + asmfunc.name + " (wasm)...");
+  var module_func = eval(__v_1);
+  var __v_6 = module_func({}, __v_3);
+  assertTrue(%IsAsmWasmCode(module_func));
+  expect(__v_6);
+}
+function __f_2() {
+  "use asm";
+  function __f_3() { return 0; }
+  function __f_4() { return 1; }
+  function __f_5() { return 4; }
+  function __f_6() { return 64; }
+  function __f_7() { return 137; }
+  function __f_8() { return 128; }
+  function __f_9() { return -1; }
+  function __f_10() { return 1000; }
+  function __f_11() { return 2000000; }
+  function __f_12() { return 2147483647; }
+  return {__f_3: __f_3, __f_4: __f_4, __f_5: __f_5, __f_6: __f_6, __f_7: __f_7, __f_8: __f_8,
+          __f_9: __f_9, __f_10: __f_10, __f_11, __f_12: __f_12};
+}
+try {
+__f_1(__f_2, function(module) {
+  assertEquals(0, module.__f_3());
+  assertEquals(1, module.__f_4());
+  assertEquals(4, module.__f_5());
+  assertEquals(64, module.__f_6());
+  assertEquals(128, module.__f_8());
+  assertEquals(-1, module.__f_9());
+  assertEquals(1000, module.__f_10());
+  assertEquals(2000000, module.__f_11());
+  assertEquals(2147483647, module.__f_12());
+});
+} catch(e) { print("Caught: " + e); }

deps/v8/test/mjsunit/regress/asm/regress-613928.js

@@ -0,0 +1,19 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+(function __f_54() {
+  function __f_41(stdlib, __v_35) {
+    "use asm";
+    __v_35 = __v_35;
+    function __f_21(int_val, double_val) {
+      int_val = int_val|0;
+      double_val = +double_val;
+    }
+    return {__f_21:__f_21};
+  }
+  __f_41();
+  assertFalse(%IsAsmWasmCode(__f_41));
+})();

deps/v8/test/mjsunit/regress/asm/regress-617525.js

@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+function __f_14() {
+  "use asm";
+  function __f_15() { return 0; }
+  function __f_15() { return 137; }  // redeclared function
+  return {};
+}
+__f_14();
+assertFalse(%IsAsmWasmCode(__f_14));

deps/v8/test/mjsunit/regress/asm/regress-617526.js

@@ -0,0 +1,24 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+// Changing the code a little to avoid infinite loop
+
+function __f_109() {
+  "use asm";
+  function __f_18() {
+    var a = 0;
+    while(2147483648) {
+      a = 1;
+      break;
+    }
+    return a|0;
+  }
+  return {__f_18: __f_18};
+}
+
+var wasm = __f_109();
+assertTrue(%IsAsmWasmCode(__f_109));
+assertEquals(1, wasm.__f_18());

deps/v8/test/mjsunit/regress/asm/regress-617529.js

@@ -0,0 +1,17 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+function __f_71(stdlib, buffer) {
+  "use asm";
+  var __v_22 = new stdlib.Float64Array(buffer);
+  function __f_26() {
+    __v_22 = __v_22;
+  }
+  return {__f_26: __f_26};
+}
+
+__f_71(this);
+assertFalse(%IsAsmWasmCode(__f_71));

deps/v8/test/mjsunit/regress/asm/regress-6196.js

@@ -0,0 +1,31 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+function Module(stdlib, imports, buffer) {
+  "use asm";
+  function f(a,b,c) {
+    a = a | 0;
+    b = b | 0;
+    c = c | 0;
+    var x = 0;
+    x = funTable[a & 1](funTable[b & 1](c) | 0) | 0;
+    return x | 0;
+  }
+  function g(a) {
+    a = a | 0;
+    return (a + 23) | 0;
+  }
+  function h(a) {
+    a = a | 0;
+    return (a + 42) | 0;
+  }
+  var funTable = [ g, h ];
+  return f;
+}
+var f = Module(this);
+assertTrue(%IsWasmCode(f));
+assertTrue(%IsAsmWasmCode(Module));
+assertEquals(165, f(0, 1, 100));

deps/v8/test/mjsunit/regress/asm/regress-6298.js

@@ -0,0 +1,16 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Module(stdlib, imports, buffer) {
+  "use asm";
+  function f() {
+    return (281474976710655 * 1048575) | 0;
+  }
+  return { f:f };
+}
+var m = Module(this);
+assertEquals(-1048576, m.f());
+assertFalse(%IsAsmWasmCode(Module));

deps/v8/test/mjsunit/regress/asm/regress-6431.js

@@ -0,0 +1,32 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestImportSymbolValue() {
+  function Module(stdlib, foreign) {
+    "use asm";
+    var x = +foreign.x;
+    function f() {}
+    return { f:f };
+  }
+  var foreign = { x : Symbol("boom") };
+  assertThrows(() => Module(this, foreign));
+  assertFalse(%IsAsmWasmCode(Module));
+})();
+
+(function TestImportMutatingObject() {
+  function Module(stdlib, foreign) {
+    "use asm";
+    var x = +foreign.x;
+    var PI = stdlib.Math.PI;
+    function f() { return +(PI + x) }
+    return { f:f };
+  }
+  var stdlib = { Math : { PI : Math.PI } };
+  var foreign = { x : { valueOf : () => (stdlib.Math.PI = 23, 42) } };
+  var m = Module(stdlib, foreign);
+  assertFalse(%IsAsmWasmCode(Module));
+  assertEquals(65, m.f());
+})();

deps/v8/test/mjsunit/regress/asm/regress-6700.js

@@ -0,0 +1,92 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+let kMinHeapSize = 4096;
+
+(function TestLeftRight() {
+  function Module(stdlib, foreign, heap) {
+    "use asm";
+    var HEAP32 = new stdlib.Int32Array(heap);
+    function f(i) {
+      i = i | 0;
+      return HEAP32[i << 2 >> 2] | 0;
+    }
+    return { f:f }
+  }
+  var buffer = new ArrayBuffer(kMinHeapSize);
+  var module = new Module(this, {}, buffer);
+  assertTrue(%IsAsmWasmCode(Module));
+  new Int32Array(buffer)[42] = 23;
+  assertEquals(23, module.f(42));
+})();
+
+(function TestRightRight() {
+  function Module(stdlib, foreign, heap) {
+    "use asm";
+    var HEAP32 = new stdlib.Int32Array(heap);
+    function f(i) {
+      i = i | 0;
+      return HEAP32[i >> 2 >> 2] | 0;
+    }
+    return { f:f }
+  }
+  var buffer = new ArrayBuffer(kMinHeapSize);
+  var module = new Module(this, {}, buffer)
+  assertTrue(%IsAsmWasmCode(Module));
+  new Int32Array(buffer)[42 >> 4] = 23;
+  assertEquals(23, module.f(42));
+})();
+
+(function TestRightLeft() {
+  function Module(stdlib, foreign, heap) {
+    "use asm";
+    var HEAP32 = new stdlib.Int32Array(heap);
+    function f(i) {
+      i = i | 0;
+      return HEAP32[i >> 2 << 2] | 0;
+    }
+    return { f:f }
+  }
+  var buffer = new ArrayBuffer(kMinHeapSize);
+  var module = new Module(this, {}, buffer)
+  assertFalse(%IsAsmWasmCode(Module));
+  new Int32Array(buffer)[42 & 0xfc] = 23;
+  assertEquals(23, module.f(42));
+})();
+
+(function TestRightButNotImmediate() {
+  function Module(stdlib, foreign, heap) {
+    "use asm";
+    var HEAP32 = new stdlib.Int32Array(heap);
+    function f(i) {
+      i = i | 0;
+      return HEAP32[i >> 2 + 1] | 0;
+    }
+    return { f:f }
+  }
+  var buffer = new ArrayBuffer(kMinHeapSize);
+  var module = new Module(this, {}, buffer)
+  assertFalse(%IsAsmWasmCode(Module));
+  new Int32Array(buffer)[42 >> 3] = 23;
+  assertEquals(23, module.f(42));
+})();
+
+(function TestLeftOnly() {
+  function Module(stdlib, foreign, heap) {
+    "use asm";
+    var HEAP32 = new stdlib.Int32Array(heap);
+    function f(i) {
+      i = i | 0;
+      return HEAP32[i << 2] | 0;
+    }
+    return { f:f }
+  }
+  var buffer = new ArrayBuffer(kMinHeapSize);
+  var module = new Module(this, {}, buffer)
+  assertFalse(%IsAsmWasmCode(Module));
+  new Int32Array(buffer)[42 << 2] = 23;
+  assertEquals(23, module.f(42));
+})();

deps/v8/test/mjsunit/regress/asm/regress-673297.js

@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm
+
+function generateAsmJs() {
+  'use asm';
+  function fun() { fun(); }
+  return fun;
+}
+
+assertThrows(generateAsmJs(), RangeError);

deps/v8/test/mjsunit/regress/asm/regress-6838-1.js

@@ -0,0 +1,33 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestMathMaxOnLargeInt() {
+  function Module(stdlib) {
+    "use asm";
+    var max = stdlib.Math.max;
+    function f() {
+      return max(42,0xffffffff);
+    }
+    return f;
+  }
+  var f = Module(this);
+  assertEquals(0xffffffff, f());
+  assertFalse(%IsAsmWasmCode(Module));
+})();
+
+(function TestMathMinOnLargeInt() {
+  function Module(stdlib) {
+    "use asm";
+    var min = stdlib.Math.min;
+    function f() {
+      return min(42,0xffffffff);
+    }
+    return f;
+  }
+  var f = Module(this);
+  assertEquals(42, f());
+  assertFalse(%IsAsmWasmCode(Module));
+})();

deps/v8/test/mjsunit/regress/asm/regress-6838-2.js

@@ -0,0 +1,101 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestMathCeilReturningFloatish() {
+  function Module(stdlib) {
+    "use asm";
+    var ceil = stdlib.Math.ceil;
+    var fround = stdlib.Math.fround;
+    function f(a) {
+      a = fround(a);
+      return ceil(a);
+    }
+    return f;
+  }
+  var f = Module(this);
+  assertEquals(3, f(2.2));
+  assertFalse(%IsAsmWasmCode(Module));
+})();
+
+(function TestMathFloorReturningFloatish() {
+  function Module(stdlib) {
+    "use asm";
+    var floor = stdlib.Math.floor;
+    var fround = stdlib.Math.fround;
+    function f(a) {
+      a = fround(a);
+      return floor(a);
+    }
+    return f;
+  }
+  var f = Module(this);
+  assertEquals(2, f(2.2));
+  assertFalse(%IsAsmWasmCode(Module));
+})();
+
+(function TestMathSqrtReturningFloatish() {
+  function Module(stdlib) {
+    "use asm";
+    var sqrt = stdlib.Math.sqrt;
+    var fround = stdlib.Math.fround;
+    function f(a) {
+      a = fround(a);
+      return sqrt(a);
+    }
+    return f;
+  }
+  var f = Module(this);
+  assertEquals(Math.sqrt(Math.fround(2.2)), f(2.2));
+  assertFalse(%IsAsmWasmCode(Module));
+})();
+
+(function TestMathAbsReturningFloatish() {
+  function Module(stdlib) {
+    "use asm";
+    var abs = stdlib.Math.abs;
+    var fround = stdlib.Math.fround;
+    function f(a) {
+      a = fround(a);
+      return abs(a);
+    }
+    return f;
+  }
+  var f = Module(this);
+  assertEquals(Math.fround(2.2), f(-2.2));
+  assertFalse(%IsAsmWasmCode(Module));
+})();
+
+(function TestMathMinReturningFloat() {
+  function Module(stdlib) {
+    "use asm";
+    var min = stdlib.Math.min;
+    var fround = stdlib.Math.fround;
+    function f(a) {
+      a = fround(a);
+      return min(a, a);
+    }
+    return f;
+  }
+  var f = Module(this);
+  assertEquals(Math.fround(2.2), f(2.2));
+  assertTrue(%IsAsmWasmCode(Module));
+})();
+
+(function TestMathMaxReturningFloat() {
+  function Module(stdlib) {
+    "use asm";
+    var max = stdlib.Math.max;
+    var fround = stdlib.Math.fround;
+    function f(a) {
+      a = fround(a);
+      return max(a, a);
+    }
+    return f;
+  }
+  var f = Module(this);
+  assertEquals(Math.fround(2.2), f(2.2));
+  assertTrue(%IsAsmWasmCode(Module));
+})();

deps/v8/test/mjsunit/regress/asm/regress-6838-3.js

@@ -0,0 +1,39 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestMathAbsReturningUnsigned() {
+  function Module(stdlib) {
+    "use asm";
+    var abs=stdlib.Math.abs;
+    function f(a, b) {
+      a = a | 0;
+      b = b | 0;
+      return (abs(a >> 0) == (b >>> 0)) | 0;
+    }
+    return f;
+  }
+  var f = Module(this);
+  assertEquals(0, f(1, 2));
+  assertEquals(1, f(23, 23));
+  assertEquals(1, f(-42, 42));
+  assertEquals(1, f(-0x7fffffff, 0x7fffffff));
+  assertEquals(1, f(-0x80000000, 0x80000000));
+  assertTrue(%IsAsmWasmCode(Module));
+})();
+
+(function TestMathAbsOverflowSignedValue() {
+  function Module(stdlib) {
+    "use asm";
+    var abs=stdlib.Math.abs;
+    function f() {
+      return (abs(-0x80000000) > 0) | 0;
+    }
+    return f;
+  }
+  var f = Module(this);
+  assertEquals(1, f());
+  assertTrue(%IsAsmWasmCode(Module));
+})();

deps/v8/test/mjsunit/regress/asm/regress-6838-4.js

@@ -0,0 +1,79 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestMinusZeroIsDouble() {
+  function Module(stdlib) {
+    'use asm';
+    function f() {
+      var x = 0.;
+      x = 1. / +-0;
+      return +x;
+    }
+    return f;
+  }
+  var f = Module(this);
+  assertEquals(-Infinity, f());
+  assertTrue(%IsAsmWasmCode(Module));
+})();
+
+(function TestMinusZeroIsDoubleBracketed() {
+  function Module(stdlib) {
+    'use asm';
+    function f() {
+      var x = 0.;
+      x = 1. / (-0);
+      return +x;
+    }
+    return f;
+  }
+  var f = Module(this);
+  assertEquals(-Infinity, f());
+  assertTrue(%IsAsmWasmCode(Module));
+})();
+
+(function TestMinusZeroIsDoubleMultDouble1() {
+  function Module(stdlib) {
+    'use asm';
+    function f() {
+      var x = 0.;
+      x = 1. / (-0 * 1.0);
+      return +x;
+    }
+    return f;
+  }
+  var f = Module(this);
+  assertEquals(-Infinity, f());
+  assertTrue(%IsAsmWasmCode(Module));
+})();
+
+(function TestMinusZeroIsDoubleMultDouble2() {
+  function Module(stdlib) {
+    'use asm';
+    function f() {
+      var x = 0.;
+      x = 1. / (1.0 * -0);
+      return +x;
+    }
+    return f;
+  }
+  var f = Module(this);
+  assertEquals(-Infinity, f());
+  assertTrue(%IsAsmWasmCode(Module));
+})();
+
+(function TestMinusZeroIsDoubleMultInt() {
+  function Module(stdlib) {
+    'use asm';
+    function f() {
+      var x = 0.;
+      x = 1. / (-0 * 1);
+      return +x;
+    }
+    return f;
+  }
+  var f = Module(this);
+  assertFalse(%IsAsmWasmCode(Module));
+})();

deps/v8/test/mjsunit/regress/asm/regress-743622.js

@@ -0,0 +1,13 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm
+
+function Module(stdlib, foreign, heap) {
+  "use asm";
+  var a = stdlib.Math.PI;
+  function f() { return a }
+  return { f:f };
+}
+Module.length

deps/v8/test/mjsunit/regress/asm/regress-775710.js

@@ -0,0 +1,20 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+const kMaxLocals = 50000;
+const fn_template = '"use asm";\nfunction f() { LOCALS }\nreturn f;';
+for (var num_locals = kMaxLocals; num_locals < kMaxLocals + 2; ++num_locals) {
+  const fn_code = fn_template.replace(
+      'LOCALS',
+      Array(num_locals)
+          .fill()
+          .map((_, idx) => 'var l' + idx + ' = 0;')
+          .join('\n'));
+  const asm_fn = new Function(fn_code);
+  const f = asm_fn();
+  f();
+  assertEquals(num_locals <= kMaxLocals, %IsAsmWasmCode(asm_fn));
+}

deps/v8/test/mjsunit/regress/asm/regress-7893.js

@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+function Module(stdlib, imports, buffer) {
+  "use asm";
+  function f() {
+    var bar = 0;
+    return 0x1e+bar|0;
+  }
+  return f;
+}
+var f = Module(this);
+assertTrue(%IsWasmCode(f));
+assertTrue(%IsAsmWasmCode(Module));
+assertEquals(0x1e, f());

deps/v8/test/mjsunit/regress/asm/regress-8377.js

@@ -0,0 +1,24 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Module(global, env, buffer) {
+  "use asm";
+  function test1() {
+    var x = 0;
+    x = -1 / 1 | 0;
+    return x | 0;
+  }
+  function test2() {
+    var x = 0;
+    x = (-1 / 1) | 0;
+    return x | 0;
+  }
+  return { test1: test1, test2: test2 };
+};
+let module = Module(this);
+assertEquals(-1, module.test1());
+assertEquals(-1, module.test2());
+assertTrue(%IsAsmWasmCode(Module));

deps/v8/test/mjsunit/regress/asm/regress-8505.js

@@ -0,0 +1,203 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-math-intrinsics  --validate-asm --allow-natives-syntax
+
+d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
+
+function verbose(args) {
+  // print(...args);
+}
+
+//=============================================
+// Global count of failures
+//=============================================
+let numFailures = 0;
+
+function reportFailure(name, vals, m, w) {
+  print("  error: " + name + "(" + vals + ") == " + w + ", expected " + m);
+  numFailures++;
+}
+
+let global_imports = {Math: Math};
+
+let inputs = [
+  1 / 0,
+  -1 / 0,
+  0 / 0,
+  -2.70497e+38,
+  -1.4698e+37,
+  -1.22813e+35,
+  -1.34584e+34,
+  -1.0079e+32,
+  -6.49364e+26,
+  -3.06077e+25,
+  -1.46821e+25,
+  -1.17658e+23,
+  -1.9617e+22,
+  -2.7357e+20,
+  -9223372036854775808.0,  // INT64_MIN
+  -1.48708e+13,
+  -1.89633e+12,
+  -4.66622e+11,
+  -2.22581e+11,
+  -1.45381e+10,
+  -2147483904.0,  // First float32 after INT32_MIN
+  -2147483648.0,  // INT32_MIN
+  -2147483520.0,  // Last float32 before INT32_MIN
+  -1.3956e+09,
+  -1.32951e+09,
+  -1.30721e+09,
+  -1.19756e+09,
+  -9.26822e+08,
+  -5.09256e+07,
+  -964300.0,
+  -192446.0,
+  -28455.0,
+  -27194.0,
+  -20575.0,
+  -17069.0,
+  -9167.0,
+  -960.178,
+  -113.0,
+  -62.0,
+  -15.0,
+  -7.0,
+  -1.0,
+  -0.0256635,
+  -4.60374e-07,
+  -3.63759e-10,
+  -4.30175e-14,
+  -5.27385e-15,
+  -1.5707963267948966,
+  -1.48084e-15,
+  -2.220446049250313e-16,
+  -1.05755e-19,
+  -3.2995e-21,
+  -1.67354e-23,
+  -1.11885e-23,
+  -1.78506e-30,
+  -1.43718e-34,
+  -1.27126e-38,
+  -0.0,
+  3e-88,
+  -2e66,
+  0.0,
+  2e66,
+  1.17549e-38,
+  1.56657e-37,
+  4.08512e-29,
+  6.25073e-22,
+  4.1723e-13,
+  1.44343e-09,
+  1.5707963267948966,
+  5.27004e-08,
+  9.48298e-08,
+  5.57888e-07,
+  4.89988e-05,
+  0.244326,
+  1.0,
+  12.4895,
+  19.0,
+  47.0,
+  106.0,
+  538.324,
+  564.536,
+  819.124,
+  7048.0,
+  12611.0,
+  19878.0,
+  20309.0,
+  797056.0,
+  1.77219e+09,
+  2147483648.0,  // INT32_MAX + 1
+  4294967296.0,  // UINT32_MAX + 1
+  1.51116e+11,
+  4.18193e+13,
+  3.59167e+16,
+  9223372036854775808.0,   // INT64_MAX + 1
+  18446744073709551616.0,  // UINT64_MAX + 1
+  3.38211e+19,
+  2.67488e+20,
+  1.78831e+21,
+  9.20914e+21,
+  8.35654e+23,
+  1.4495e+24,
+  5.94015e+25,
+  4.43608e+30,
+  2.44502e+33,
+  1.38178e+37,
+  1.71306e+37,
+  3.31899e+38,
+  3.40282e+38,
+];
+
+function assertBinop(name, math_func, wasm_func) {
+  let inputs2 = [ 1, 0.5, -1, -0.5,  0, -0, 1/0, -1/0, 0/0 ];
+  for (val of inputs) {
+    verbose("  ", val);
+    for (val2 of inputs2) {
+      verbose("    ", val2);
+      let m = math_func(val, val2);
+      let w = wasm_func(val, val2);
+      if (!deepEquals(m, w)) reportFailure(name, [val, val2], m, w);
+      m = math_func(val2, val);
+      w = wasm_func(val2, val);
+      if (!deepEquals(m, w)) reportFailure(name, [val2, val], m, w);
+    }
+  }
+}
+
+let stdlib = this;
+function Module_pow(stdlib) {
+  "use asm";
+
+  var Stdlib = stdlib.Math.pow;
+
+  function pow(a, b) {
+    a = +a;
+    b = +b;
+    return +Stdlib(a, b);
+  }
+
+  return {pow: pow};
+}
+
+function wasmBinop(name, sig) {
+  var builder = new WasmModuleBuilder();
+
+  var sig_index = builder.addType(sig);
+  builder.addImport('Math', name, sig_index);
+  builder.addFunction('main', sig_index)
+      .addBody([
+        kExprLocalGet, 0,  // --
+        kExprLocalGet, 1,  // --
+        kExprCallFunction, 0
+      ])  // --
+      .exportAs('main');
+
+  return builder.instantiate(global_imports).exports.main;
+}
+
+function asmBinop(name) {
+  let instance = Module_pow(stdlib);
+  assertTrue(%IsAsmWasmCode(Module_pow));
+
+  let asm_func = instance[name];
+  if (typeof asm_func != "function") throw "asm[" + full_name + "] not found";
+  return asm_func;
+}
+
+(function TestF64() {
+  let name = 'pow';
+  let math_func = Math[name];
+
+  let wasm_func = wasmBinop(name, kSig_d_dd);
+  assertBinop("(f64)" + name, math_func, wasm_func);
+
+  let asm_func = asmBinop(name);
+  assertBinop("(f64)" + name, math_func, asm_func);
+})();
+
+assertEquals(0, numFailures);

deps/v8/test/mjsunit/regress/asm/regress-9022.js

@@ -0,0 +1,30 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+function Module(stdlib, ffi) {
+  "use asm";
+  var log = ffi.log;
+  function boom() {
+    while (1) {
+      label: {
+        break;
+      }
+      log(1);
+      break;
+    }
+    log(2);
+  }
+  return { boom: boom }
+}
+
+var log_value = 0;
+function log(i) {
+  log_value += i;
+}
+
+Module({}, { log: log }).boom();
+assertTrue(%IsAsmWasmCode(Module));
+assertEquals(2, log_value);

deps/v8/test/mjsunit/regress/asm/regress-crbug-1006592.js

@@ -0,0 +1,21 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Module(stdlib) {
+  "use asm";
+  var fround = stdlib.Math.fround;
+  function f(a, b) {
+    a = +a;
+    b = +b;
+    return fround(a, b);
+  }
+  return { f: f };
+}
+
+var m = Module(this);
+assertEquals(23, m.f(23));
+assertEquals(42, m.f(42, 65));
+assertFalse(%IsAsmWasmCode(Module));

deps/v8/test/mjsunit/regress/asm/regress-crbug-714971.js

@@ -0,0 +1,19 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Module(stdlib, foreign, heap) {
+  "use asm";
+  var a = new stdlib.Int16Array(heap);
+  function f() {
+    return a[23 >> -1];
+  }
+  return { f:f };
+}
+var b = new ArrayBuffer(1024);
+var m = Module(this, {}, b);
+new Int16Array(b)[0] = 42;
+assertEquals(42, m.f());
+assertFalse(%IsAsmWasmCode(Module));

deps/v8/test/mjsunit/regress/asm/regress-crbug-715455.js

@@ -0,0 +1,25 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function MODULE() {
+  "use asm";
+  function f() {
+    bogus_function_table[0 & LIMIT]();
+  }
+  return { f:f };
+}
+
+var bogus_function_table = [ Object ];
+var test_set = [ 0x3fffffff, 0x7fffffff, 0xffffffff ];
+for (var i = 0; i < test_set.length; ++i) {
+  bogus_function_table[i] = Object;
+  var src = MODULE.toString();
+  src = src.replace(/MODULE/g, "Module" + i);
+  src = src.replace(/LIMIT/g, test_set[i]);
+  var module = eval("(" + src + ")");
+  module(this).f();
+  assertFalse(%IsAsmWasmCode(module));
+}

deps/v8/test/mjsunit/regress/asm/regress-crbug-719384.js

@@ -0,0 +1,34 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestThrowingObserver() {
+  function Module(stdlib, foreign) {
+    "use asm";
+    var x = foreign.x | 0;
+    function f() {}
+    return { f:f };
+  }
+  var observer = { get x() { throw new Error() } };
+  assertThrows(() => Module(this, observer));
+  assertFalse(%IsAsmWasmCode(Module));
+})();
+
+(function TestMutatingObserver() {
+  function Module(stdlib, foreign) {
+    "use asm";
+    var x = +foreign.x;
+    var PI = stdlib.Math.PI;
+    function f() {
+      return +(PI + x);
+    }
+    return { f:f };
+  }
+  var stdlib = { Math : { PI : Math.PI } };
+  var observer = { get x() { stdlib.Math.PI = 23; return 42; } };
+  var m = Module(stdlib, observer);
+  assertFalse(%IsAsmWasmCode(Module));
+  assertEquals(65, m.f());
+})();

deps/v8/test/mjsunit/regress/asm/regress-crbug-721835.js

@@ -0,0 +1,31 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+(function TestValidationFailureInForStatement() {
+  function Module() {
+    "use asm"
+    function f() {
+      var a = 0;
+      for (a = b; 0; 0) {};
+      return 0;
+    }
+    return { f:f };
+  }
+  assertThrows(() => Module().f(), ReferenceError);
+  assertFalse(%IsAsmWasmCode(Module));
+})();
+
+(function TestForStatementInVoidFunction() {
+  function Module() {
+    "use asm"
+    function f() {
+      for (1; 0; 0) {};
+    }
+    return { f:f };
+  }
+  assertDoesNotThrow(() => Module().f());
+  assertTrue(%IsAsmWasmCode(Module));
+})();

deps/v8/test/mjsunit/regress/asm/regress-crbug-722348.js

@@ -0,0 +1,14 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Module(global, env) {
+  "use asm";
+  var unused_fun = env.fun;
+  function f() {}
+  return { f:f }
+}
+assertThrows(() => Module(), TypeError);
+assertFalse(%IsAsmWasmCode(Module));

deps/v8/test/mjsunit/regress/asm/regress-crbug-759327.js

@@ -0,0 +1,23 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+function Module(stdlib, env, heap) {
+  "use asm";
+  var MEM = new stdlib.Int32Array(heap);
+  function f() {
+    MEM[0] = 0;
+  }
+  return { f: f };
+}
+function instantiate() {
+  var buffer = new ArrayBuffer(4096);
+  Module(this, {}, buffer).f();
+  try {} finally {}
+  gc();
+  Module(this, {}, buffer).f();
+}
+instantiate();
+assertTrue(%IsAsmWasmCode(Module));

deps/v8/test/mjsunit/regress/asm/regress-crbug-771428.js

@@ -0,0 +1,24 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+function Module() {
+  "use asm";
+  function f(i) {
+    i = i | 0;
+    switch (i | 0) {
+      case 2:
+        // Exceeds value range.
+        i = 0x1ffffffff;
+        break;
+    }
+    return i | 0;
+  }
+  return f;
+}
+var f = Module();
+assertEquals(0, f(0));
+assertEquals(1, f(1));
+assertEquals(-1, f(2));
+assertFalse(%IsAsmWasmCode(Module));

deps/v8/test/mjsunit/regress/asm/regress-crbug-898974.js

@@ -0,0 +1,34 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Module(global, env, buffer) {
+  "use asm";
+  var HEAPF64 = new global.Float64Array(buffer);
+  var HEAPF32 = new global.Float32Array(buffer);
+  var Math_fround = global.Math.fround;
+  function main_d_f() {
+    HEAPF64[0] = Math_fround(+HEAPF64[0]);
+  }
+  function main_d_fq() {
+    HEAPF64[1] = HEAPF32[4096];
+  }
+  function main_f_dq() {
+    HEAPF32[4] = HEAPF64[4096];
+  }
+  return {main_d_f: main_d_f, main_d_fq: main_d_fq, main_f_dq: main_f_dq};
+};
+let buffer = new ArrayBuffer(4096);
+let module = Module(this, undefined, buffer);
+let view64 = new Float64Array(buffer);
+let view32 = new Float32Array(buffer);
+assertEquals(view64[0] = 2.3, view64[0]);
+module.main_d_f();
+module.main_d_fq();
+module.main_f_dq();
+assertTrue(%IsAsmWasmCode(Module));
+assertEquals(Math.fround(2.3), view64[0]);
+assertTrue(isNaN(view64[1]));
+assertTrue(isNaN(view32[4]));

deps/v8/test/mjsunit/regress/asm/regress-crbug-934138.js

@@ -0,0 +1,38 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestTrailingJunkAfterExport() {
+  function Module() {
+    "use asm";
+    function f() {}
+    return {f: f}
+    %kaboom;
+  }
+  assertThrows(() => Module(), ReferenceError);
+  assertFalse(%IsAsmWasmCode(Module));
+})();
+
+(function TestExportWithSemicolon() {
+  function Module() {
+    "use asm";
+    function f() {}
+    return {f: f};
+    // appreciate the semicolon
+  }
+  assertDoesNotThrow(() => Module());
+  assertTrue(%IsAsmWasmCode(Module));
+})();
+
+(function TestExportWithoutSemicolon() {
+  function Module() {
+    "use asm";
+    function f() {}
+    return {f: f}
+    // appreciate the nothingness
+  }
+  assertDoesNotThrow(() => Module());
+  assertTrue(%IsAsmWasmCode(Module));
+})();

deps/v8/test/mjsunit/regress/asm/regress-crbug-969368.js

@@ -0,0 +1,19 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Module() {
+  'use asm';
+  function f() {}
+  function g() {
+    var x = 0.0;
+    table[x & 3]();
+  }
+  var table = [f, f, f, f];
+  return { g: g };
+}
+var m = Module();
+assertDoesNotThrow(m.g);
+assertFalse(%IsAsmWasmCode(Module));

deps/v8/test/mjsunit/regress/asm/regress-crbug-976934.js

@@ -0,0 +1,22 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Module(stdlib, imports, heap) {
+  "use asm";
+
+  var fround = stdlib.Math.fround;
+
+  function f() {
+    var x = fround(-1.7976931348623157e+308);
+    return fround(x);
+  }
+
+  return { f: f };
+}
+
+var m = Module(this);
+assertEquals(-Infinity, m.f());
+assertTrue(%IsAsmWasmCode(Module));

deps/v8/test/mjsunit/regress/asm/regress-wasm-crbug-599413.js

@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+function __f_100() {
+  "use asm";
+  function __f_76() {
+    var __v_39 = 0;
+    outer: while (1) {
+      while (__v_39 == 4294967295) {
+      }
+    }
+  }
+  return {__f_76: __f_76};
+}
+assertFalse(%IsAsmWasmCode(__f_100));

deps/v8/test/mjsunit/regress/asm/regress-wasm-crbug-618602.js

@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+function __f_1() {
+  'use asm';
+  function __f_3() {
+    var __v_11 = 1, __v_10 = 0, __v_12 = 0;
+    __v_12 = (__v_10 | 12) % 4294967295 | -1073741824;
+  }
+  return { __f_3: __f_3 };
+}
+assertFalse(%IsAsmWasmCode(__f_1));

deps/v8/test/mjsunit/regress/async-generator-is-awaiting.js

@@ -0,0 +1,43 @@
+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Async generator builtins that suspend the generator set the is_awaiting bit
+// to 1 before awaiting. This is cleared when resumed. This tests that the bit
+// is set after the await operation successfully completes (i.e. returns the
+// Promise), since it can throw, and that thrown exception can be caught by
+// script. Otherwise the is_awaiting bit won't be cleared.
+
+// This makes `await new Promise(() => {})` throw.
+Object.defineProperty(Promise.prototype, 'constructor', {
+  get() { throw 42; }
+});
+
+// AsyncGeneratorAwait
+{
+  async function *f() {
+    try {
+      await new Promise(() => {});
+    } catch (e) {
+    }
+  }
+
+  f().next();
+}
+
+// AsyncGeneratorYield
+{
+  async function *f() {
+    try {
+      yield new Promise(() => {});
+    } catch (e) {
+    }
+  }
+
+  f().next();
+}
+
+// AsyncGeneratorReturn isn't affected because it's not possible, in script, to
+// catch an error thrown by a return resumption. It'll be caught by the
+// synthetic try-catch around the whole body of the async generator, which will
+// correctly reset the is_awaiting bit.

deps/v8/test/mjsunit/regress/binop-in-effect-context-deopt.js

@@ -0,0 +1,70 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+(function BinopInEffectContextDeoptAndOsr() {
+  function f(a, deopt, osr) {
+    var result = (a + 10, "result");
+    var dummy = deopt + 0;
+    for (var i = 0; osr && i < 2; i++) {
+      %PrepareFunctionForOptimization(f);
+      %OptimizeOsr();
+    }
+    return result;
+  }
+
+  %PrepareFunctionForOptimization(f);
+  assertEquals("result", f(true, 3, false));
+  assertEquals("result", f(true, 3, false));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("result", f(true, "foo", true));
+})();
+
+
+(function BinopInEffectContextLazyDeopt() {
+  function deopt_f() {
+    %DeoptimizeFunction(f);
+    return "dummy";
+  }
+
+  function h() {
+    return { toString : deopt_f };
+  }
+
+  function g(x) {
+  }
+
+  function f() {
+    return g(void(h() + ""));
+  };
+  %PrepareFunctionForOptimization(f);
+
+  f();
+  %OptimizeFunctionOnNextCall(f);
+  f();
+})();

deps/v8/test/mjsunit/regress/bitops-register-alias.js

@@ -0,0 +1,31 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that the code generator can cope with left and right being in
+// the same register for bitops.
+function f() { for (var i = 10; i < 100; i++) { return i | i; } }
+assertEquals(10, f());

deps/v8/test/mjsunit/regress/call-function-in-effect-context-deopt.js

@@ -0,0 +1,45 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f(deopt, osr) {
+  var result = "result";
+  %Call(function() {}, 0, 0);
+  var dummy = deopt + 0;
+  for (var i = 0; osr && i < 2; i++) {
+    %PrepareFunctionForOptimization(f);
+    %OptimizeOsr();
+  }
+  return result;
+}
+
+%PrepareFunctionForOptimization(f);
+assertEquals("result", f(3, false));
+assertEquals("result", f(3, false));
+%OptimizeFunctionOnNextCall(f);
+assertEquals("result", f("foo", true));

deps/v8/test/mjsunit/regress/clear-keyed-call.js

@@ -0,0 +1,40 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc --allow-natives-syntax
+
+function f(a) {
+  a[0](1);
+}
+
+f([function(a) { return a; }]);
+f([function(a) { return a; }]);
+f([function(a) { return a; }]);
+%NotifyContextDisposed();
+gc();
+gc();
+gc();

deps/v8/test/mjsunit/regress/compare-map-elim1.js

@@ -0,0 +1,57 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --check-elimination
+
+
+function foo(o) {
+  return o.foo1;
+};
+%PrepareFunctionForOptimization(foo);
+function getter() {
+  return this.x + this.z + foo2(this);
+}
+
+function foo2(o) {
+  return o.a;
+}
+
+var o1 = {z: 0, x: 1};
+var o2 = {z: 0, a: 1.5, x: 1};
+var o3 = {z: 0, a: 1.5};
+Object.defineProperty(o1, 'foo1', {get: getter});
+Object.defineProperty(o2, 'foo1', {get: getter});
+
+foo(o1);
+foo(o1);
+foo(o2);
+%ClearFunctionFeedback(foo2);
+foo2(o2);
+foo2(o2);
+foo2(o3);
+%OptimizeFunctionOnNextCall(foo);
+foo(o1);

deps/v8/test/mjsunit/regress/comparison-in-effect-context-deopt.js

@@ -0,0 +1,47 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function lazyDeopt() {
+  %DeoptimizeFunction(test);
+  return "deopt";
+}
+
+var x = {toString: lazyDeopt};
+
+function g(x) {
+  return "result";
+}
+
+function test(x) {
+  return g(void (x == ''));
+};
+%PrepareFunctionForOptimization(test);
+test(x);
+%OptimizeFunctionOnNextCall(test);
+assertEquals("result", test(x));

deps/v8/test/mjsunit/regress/consolidated-holey-load.js

@@ -0,0 +1,40 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function foo(array) {
+  return array[0];
+};
+%PrepareFunctionForOptimization(foo);
+var a = [1, 2, , 4];  // Holey Smi elements.
+var b = ['abcd', 0];  // Fast elements.
+foo(b);  // Observe fast elements first, or the IC will transition without
+foo(a);  // going polymorphic.
+%OptimizeFunctionOnNextCall(foo);
+var c = [, 0];
+assertEquals(undefined, foo(c));  // Elided hole check will leak the hole.

deps/v8/test/mjsunit/regress/cross-script-vars.js

@@ -0,0 +1,574 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function PrintDesc(desc, s) {
+  var json;
+  if (desc) {
+    json = JSON.stringify(desc);
+  } else {
+    json = "<no such property>";
+  }
+  if (s === undefined) {
+    print(json);
+  } else {
+    print(s + ": " + json);
+  }
+}
+
+
+var counters;
+var test_realm;
+var cfg;
+
+
+function GetDescriptor() {
+  var code = 'Object.getOwnPropertyDescriptor(global, "x")';
+  var desc = Realm.eval(test_realm, code);
+//  PrintDesc(desc);
+  return desc;
+}
+
+function SetUp() {
+  counters = {};
+  Realm.shared = {counters: counters};
+  test_realm = Realm.create();
+  Realm.eval(test_realm, 'var global = Realm.global(Realm.current());');
+  print("=====================");
+  print("Test realm: " + test_realm);
+  assertEquals(undefined, GetDescriptor());
+}
+
+function TearDown() {
+  Realm.dispose(test_realm);
+  print("OK");
+}
+
+
+function AddStrict(code, cfg) {
+  return cfg.strict ? '"use strict"; ' + code : code;
+}
+
+function ForceMutablePropertyCellType() {
+  Realm.eval(test_realm, 'global.x = {}; global.x = undefined;');
+}
+
+function DeclareVar() {
+  var code = 'var x;';
+  return Realm.eval(test_realm, AddStrict(code, cfg));
+}
+
+function DefineVar(v) {
+  var code = 'var x = ' + v;
+  return Realm.eval(test_realm, AddStrict(code, cfg));
+}
+
+function DefineLoadVar() {
+  var name = 'LoadVar_' + test_realm;
+  var code =
+      'var x;' +
+      'function ' + name + '() {' +
+      '  return x;' +
+      '};'
+  return Realm.eval(test_realm, AddStrict(code, cfg));
+}
+
+function LoadVar() {
+  var name = 'LoadVar_' + test_realm;
+  var code = (cfg.optimize ? '%PrepareFunctionForOptimization(' + name + ');' : '') +
+      (cfg.optimize ? '%OptimizeFunctionOnNextCall(' + name + ');' : '') +
+      name + '();';
+  return Realm.eval(test_realm, AddStrict(code, cfg));
+}
+
+function DefineStoreVar() {
+  var name = 'StoreVar_' + test_realm;
+  var code = 'var g = (Function("return this"))();' +
+      'var x;' +
+      'function ' + name + '(v) {' +
+      '  return x = v;' +
+      '};';
+  return Realm.eval(test_realm, AddStrict(code, cfg));
+}
+
+function StoreVar(v) {
+  var name = 'StoreVar_' + test_realm;
+  var code = (cfg.optimize ? '%PrepareFunctionForOptimization(' + name + ');' : '') +
+      (cfg.optimize ? '%OptimizeFunctionOnNextCall(' + name + ');' : '') +
+      name + '(' + v + ');';
+  return Realm.eval(test_realm, AddStrict(code, cfg));
+}
+
+// It does 13 iterations which results in 27 loads
+// and 14 stores.
+function LoadStoreLoop() {
+  var code = 'for(var x = 0; x < 13; x++);';
+  return Realm.eval(test_realm, AddStrict(code, cfg));
+}
+
+function DefineRWDataProperty() {
+  var code =
+      'Object.defineProperty(global, "x", { ' +
+      '  value: 42, ' +
+      '  writable: true, ' +
+      '  enumerable: true, ' +
+      '  configurable: true ' +
+      '});';
+  return Realm.eval(test_realm, AddStrict(code, cfg));
+}
+
+function DefineRODataProperty() {
+  var code =
+      'Object.defineProperty(global, "x", { ' +
+      '  value: 42, ' +
+      '  writable: false, ' +
+      '  enumerable: true, ' +
+      '  configurable: true ' +
+      '});';
+  return Realm.eval(test_realm, AddStrict(code, cfg));
+}
+
+function SetX_(v) {
+  var code =
+      'global.x_ = ' + v + '; ';
+  return Realm.eval(test_realm, code);
+}
+
+function DefineRWAccessorProperty() {
+  var code =
+      'Object.defineProperty(global, "x", {' +
+      '  get: function() { Realm.shared.counters.get_count++; return this.x_; },' +
+      '  set: function(v) { Realm.shared.counters.set_count++; this.x_ = v; },' +
+      '  enumerable: true, configurable: true' +
+      '});';
+  counters.get_count = 0;
+  counters.set_count = 0;
+  return Realm.eval(test_realm, AddStrict(code, cfg));
+}
+
+function DefineROAccessorProperty() {
+  var code =
+      'Object.defineProperty(global, "x", {' +
+      '  get: function() { Realm.shared.counters.get_count++; return this.x_; },' +
+      '  enumerable: true, configurable: true' +
+      '});';
+  counters.get_count = 0;
+  counters.set_count = 0;
+  return Realm.eval(test_realm, AddStrict(code, cfg));
+}
+
+
+function testSuite(opt_cfg) {
+  //
+  // Non strict.
+  //
+
+  (function() {
+    SetUp();
+    cfg = {optimize: opt_cfg.optimize, strict: false};
+    DeclareVar();
+    DefineLoadVar();
+    DefineStoreVar();
+    assertEquals(undefined, LoadVar());
+    assertEquals(false, GetDescriptor().configurable);
+
+    // Force property cell type to kMutable.
+    DefineVar(undefined);
+    DefineVar(153);
+    assertEquals(false, GetDescriptor().configurable);
+
+    assertEquals(153, LoadVar());
+    assertEquals(113, StoreVar(113));
+    assertEquals(113, LoadVar());
+    LoadStoreLoop();
+    assertEquals(13, LoadVar());
+    TearDown();
+  })();
+
+
+  (function() {
+    SetUp();
+    cfg = {optimize: opt_cfg.optimize, strict: false};
+    ForceMutablePropertyCellType();
+    DefineLoadVar();
+    DefineStoreVar();
+    DefineRWDataProperty();
+    assertEquals(42, LoadVar());
+    assertEquals(true, GetDescriptor().configurable);
+
+    DefineVar(153);
+    assertEquals(true, GetDescriptor().configurable);
+
+    assertEquals(153, LoadVar());
+    assertEquals(113, StoreVar(113));
+    assertEquals(113, LoadVar());
+    LoadStoreLoop();
+    assertEquals(13, LoadVar());
+
+    // Now reconfigure to accessor.
+    DefineRWAccessorProperty();
+    assertEquals(undefined, GetDescriptor().value);
+    assertEquals(true, GetDescriptor().configurable);
+    assertEquals(0, counters.get_count);
+    assertEquals(0, counters.set_count);
+
+    assertEquals(undefined, LoadVar());
+    assertEquals(1, counters.get_count);
+    assertEquals(0, counters.set_count);
+
+    LoadStoreLoop();
+    assertEquals(28, counters.get_count);
+    assertEquals(14, counters.set_count);
+
+    assertEquals(13, LoadVar());
+    assertEquals(29, counters.get_count);
+    assertEquals(14, counters.set_count);
+
+    TearDown();
+  })();
+
+
+  (function() {
+    SetUp();
+    cfg = {optimize: opt_cfg.optimize, strict: false};
+    ForceMutablePropertyCellType();
+    DefineLoadVar();
+    DefineStoreVar();
+    DefineRODataProperty();
+    assertEquals(42, LoadVar());
+    assertEquals(true, GetDescriptor().configurable);
+
+    DefineVar(153);
+
+    assertEquals(42, LoadVar());
+    assertEquals(113, StoreVar(113));
+    assertEquals(42, LoadVar());
+    LoadStoreLoop();
+    assertEquals(42, LoadVar());
+
+    // Now reconfigure to accessor property.
+    DefineRWAccessorProperty();
+    assertEquals(undefined, GetDescriptor().value);
+    assertEquals(true, GetDescriptor().configurable);
+    assertEquals(0, counters.get_count);
+    assertEquals(0, counters.set_count);
+
+    assertEquals(undefined, LoadVar());
+    assertEquals(1, counters.get_count);
+    assertEquals(0, counters.set_count);
+
+    LoadStoreLoop();
+    assertEquals(28, counters.get_count);
+    assertEquals(14, counters.set_count);
+
+    assertEquals(13, LoadVar());
+    assertEquals(29, counters.get_count);
+    assertEquals(14, counters.set_count);
+
+    TearDown();
+  })();
+
+
+  (function() {
+    SetUp();
+    cfg = {optimize: opt_cfg.optimize, strict: false};
+    ForceMutablePropertyCellType();
+    DefineLoadVar();
+    DefineStoreVar();
+    DefineRWAccessorProperty();
+    assertEquals(0, counters.get_count);
+    assertEquals(0, counters.set_count);
+    assertEquals(true, GetDescriptor().configurable);
+
+    assertEquals(undefined, LoadVar());
+    assertEquals(1, counters.get_count);
+    assertEquals(0, counters.set_count);
+
+    DefineVar(153);
+    assertEquals(true, GetDescriptor().configurable);
+    assertEquals(1, counters.get_count);
+    assertEquals(1, counters.set_count);
+
+    assertEquals(153, LoadVar());
+    assertEquals(2, counters.get_count);
+    assertEquals(1, counters.set_count);
+
+    assertEquals(113, StoreVar(113));
+    assertEquals(2, counters.get_count);
+    assertEquals(2, counters.set_count);
+
+    assertEquals(113, LoadVar());
+    assertEquals(3, counters.get_count);
+    assertEquals(2, counters.set_count);
+
+    LoadStoreLoop();
+    assertEquals(30, counters.get_count);
+    assertEquals(16, counters.set_count);
+
+    assertEquals(13, LoadVar());
+    assertEquals(31, counters.get_count);
+    assertEquals(16, counters.set_count);
+
+    // Now reconfigure to data property.
+    DefineRWDataProperty();
+    assertEquals(42, GetDescriptor().value);
+    assertEquals(42, LoadVar());
+    assertEquals(113, StoreVar(113));
+    assertEquals(31, counters.get_count);
+    assertEquals(16, counters.set_count);
+
+    TearDown();
+  })();
+
+
+  (function() {
+    SetUp();
+    cfg = {optimize: opt_cfg.optimize, strict: false};
+    ForceMutablePropertyCellType();
+    DefineLoadVar();
+    DefineStoreVar();
+    DefineROAccessorProperty();
+    assertEquals(0, counters.get_count);
+    assertEquals(0, counters.set_count);
+    assertEquals(true, GetDescriptor().configurable);
+
+    assertEquals(undefined, LoadVar());
+    assertEquals(1, counters.get_count);
+    assertEquals(0, counters.set_count);
+
+    SetX_(42);
+    assertEquals(42, LoadVar());
+    assertEquals(2, counters.get_count);
+    assertEquals(0, counters.set_count);
+
+    DefineVar(153);
+    assertEquals(true, GetDescriptor().configurable);
+    assertEquals(2, counters.get_count);
+    assertEquals(0, counters.set_count);
+
+    assertEquals(42, LoadVar());
+    assertEquals(3, counters.get_count);
+    assertEquals(0, counters.set_count);
+
+    assertEquals(113, StoreVar(113));
+    assertEquals(3, counters.get_count);
+    assertEquals(0, counters.set_count);
+
+    assertEquals(42, LoadVar());
+    assertEquals(4, counters.get_count);
+    assertEquals(0, counters.set_count);
+
+    LoadStoreLoop();
+    assertEquals(5, counters.get_count);
+    assertEquals(0, counters.set_count);
+
+    assertEquals(42, LoadVar());
+    assertEquals(6, counters.get_count);
+    assertEquals(0, counters.set_count);
+
+    // Now reconfigure to data property.
+    DefineRWDataProperty();
+    assertEquals(42, GetDescriptor().value);
+    assertEquals(42, LoadVar());
+    assertEquals(113, StoreVar(113));
+    assertEquals(6, counters.get_count);
+    assertEquals(0, counters.set_count);
+
+    TearDown();
+  })();
+
+
+  //
+  // Strict.
+  //
+
+  (function() {
+    SetUp();
+    cfg = {optimize: opt_cfg.optimize, strict: true};
+    DeclareVar();
+    DefineLoadVar();
+    DefineStoreVar();
+    assertEquals(undefined, LoadVar());
+    assertEquals(false, GetDescriptor().configurable);
+
+    // Force property cell type to kMutable.
+    DefineVar(undefined);
+    DefineVar(153);
+    assertEquals(false, GetDescriptor().configurable);
+
+    assertEquals(153, LoadVar());
+    assertEquals(113, StoreVar(113));
+    assertEquals(113, LoadVar());
+    LoadStoreLoop();
+    assertEquals(13, LoadVar());
+    TearDown();
+  })();
+
+
+  (function() {
+    SetUp();
+    cfg = {optimize: opt_cfg.optimize, strict: true};
+    ForceMutablePropertyCellType();
+    DefineLoadVar();
+    DefineStoreVar();
+    DefineRWDataProperty();
+    assertEquals(42, LoadVar());
+    assertEquals(true, GetDescriptor().configurable);
+
+    DefineVar(153);
+    assertEquals(true, GetDescriptor().configurable);
+
+    assertEquals(153, LoadVar());
+    assertEquals(113, StoreVar(113));
+    assertEquals(113, LoadVar());
+    LoadStoreLoop();
+    assertEquals(13, LoadVar());
+    TearDown();
+  })();
+
+
+  (function() {
+    SetUp();
+    cfg = {optimize: opt_cfg.optimize, strict: true};
+    ForceMutablePropertyCellType();
+    DefineLoadVar();
+    DefineStoreVar();
+    DefineRWDataProperty();
+    assertEquals(true, GetDescriptor().configurable);
+    assertEquals(true, GetDescriptor().writable);
+    assertEquals(113, StoreVar(113));
+
+    DefineRODataProperty();
+    assertEquals(true, GetDescriptor().configurable);
+    assertEquals(false, GetDescriptor().writable);
+
+    assertEquals(42, LoadVar());
+    assertEquals(true, GetDescriptor().configurable);
+    assertThrows('DefineVar(153)');
+    assertEquals(42, LoadVar());
+    assertThrows('StoreVar(113)');
+    assertThrows('StoreVar(113)');
+    assertEquals(42, LoadVar());
+    assertThrows('StoreVar(42)');
+    assertEquals(42, LoadVar());
+    assertThrows('LoadStoreLoop()');
+    assertEquals(42, LoadVar());
+    TearDown();
+  })();
+
+
+  (function() {
+    SetUp();
+    cfg = {optimize: opt_cfg.optimize, strict: true};
+    ForceMutablePropertyCellType();
+    DefineLoadVar();
+    DefineStoreVar();
+    DefineRWAccessorProperty();
+    assertEquals(0, counters.get_count);
+    assertEquals(0, counters.set_count);
+    assertEquals(true, GetDescriptor().configurable);
+
+    assertEquals(undefined, LoadVar());
+    assertEquals(1, counters.get_count);
+    assertEquals(0, counters.set_count);
+
+    DefineVar(153);
+    assertEquals(true, GetDescriptor().configurable);
+    assertEquals(1, counters.get_count);
+    assertEquals(1, counters.set_count);
+
+    assertEquals(153, LoadVar());
+    assertEquals(2, counters.get_count);
+    assertEquals(1, counters.set_count);
+
+    assertEquals(113, StoreVar(113));
+    assertEquals(2, counters.get_count);
+    assertEquals(2, counters.set_count);
+
+    assertEquals(113, LoadVar());
+    assertEquals(3, counters.get_count);
+    assertEquals(2, counters.set_count);
+
+    LoadStoreLoop();
+    assertEquals(30, counters.get_count);
+    assertEquals(16, counters.set_count);
+
+    assertEquals(13, LoadVar());
+    assertEquals(31, counters.get_count);
+    assertEquals(16, counters.set_count);
+
+    // Now reconfigure to data property.
+    DefineRWDataProperty();
+    assertEquals(42, GetDescriptor().value);
+    assertEquals(42, LoadVar());
+    assertEquals(113, StoreVar(113));
+    assertEquals(31, counters.get_count);
+    assertEquals(16, counters.set_count);
+
+    TearDown();
+  })();
+
+
+  (function() {
+    SetUp();
+    cfg = {optimize: opt_cfg.optimize, strict: true};
+    ForceMutablePropertyCellType();
+    DefineLoadVar();
+    DefineStoreVar();
+    DefineROAccessorProperty();
+    assertEquals(0, counters.get_count);
+    assertEquals(0, counters.set_count);
+    assertEquals(true, GetDescriptor().configurable);
+
+    assertEquals(undefined, LoadVar());
+    assertEquals(1, counters.get_count);
+    assertEquals(0, counters.set_count);
+
+    SetX_(42);
+    assertEquals(42, LoadVar());
+    assertEquals(2, counters.get_count);
+    assertEquals(0, counters.set_count);
+
+    assertThrows('DefineVar(153)');
+    assertEquals(true, GetDescriptor().configurable);
+    assertEquals(2, counters.get_count);
+    assertEquals(0, counters.set_count);
+
+    assertEquals(42, LoadVar());
+    assertEquals(3, counters.get_count);
+    assertEquals(0, counters.set_count);
+
+    assertThrows('StoreVar(113)');
+    assertEquals(3, counters.get_count);
+    assertEquals(0, counters.set_count);
+
+    assertEquals(42, LoadVar());
+    assertEquals(4, counters.get_count);
+    assertEquals(0, counters.set_count);
+
+    assertThrows('LoadStoreLoop()');
+    assertEquals(4, counters.get_count);
+    assertEquals(0, counters.set_count);
+
+    assertEquals(42, LoadVar());
+    assertEquals(5, counters.get_count);
+    assertEquals(0, counters.set_count);
+
+    // Now reconfigure to data property.
+    DefineRWDataProperty();
+    assertEquals(42, GetDescriptor().value);
+    assertEquals(42, LoadVar());
+    assertEquals(113, StoreVar(113));
+    assertEquals(5, counters.get_count);
+    assertEquals(0, counters.set_count);
+
+    TearDown();
+  })();
+
+}  // testSuite
+
+
+testSuite({optimize: false});
+testSuite({optimize: true});

deps/v8/test/mjsunit/regress/d8-readbuffer.js

@@ -0,0 +1,40 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that reading a file actually returns the file's contents.
+
+// Env: TEST_FILE_NAME
+assertEquals("string", typeof TEST_FILE_NAME);
+
+var a = new Uint8Array(readbuffer(TEST_FILE_NAME));
+
+// First line of this file.
+var expected = "// Copyright 2014 the V8 project authors. All rights reserved.";
+
+for (var i = 0; i < expected.length; i++) {
+  assertEquals(expected.charCodeAt(i), a[i]);
+}

deps/v8/test/mjsunit/regress/external-and-normal-array-polymorphism.js

@@ -0,0 +1,48 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function store_generator(compare) {
+  return function(a,i,v) {
+    a[i] = v;
+    assertEquals(compare, a[i]);
+    assertEquals(compare, a[i]);
+  }
+}
+
+f = store_generator(5);
+a = [0,0,0];
+f(a,0,5);
+a = [0,0,0];
+f(a,1,5);
+a = [0,0,0];
+f(a,2,5);
+
+f = store_generator(5.5);
+a = new Float32Array(5);
+f(a,0,5.5);
+f(a,1,5.5);
+f(a,2,5.5);

deps/v8/test/mjsunit/regress/get-array-keys-oob.js

@@ -0,0 +1,6 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Array.prototype[10000000] = 1;
+Array(1000).join();

deps/v8/test/mjsunit/regress/internalized-string-not-equal.js

@@ -0,0 +1,41 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// A bug in r15773, when masks for internalized string and string types
+// were reorganized.
+function equal(o1, o2) {
+  return o1 == o2;
+};
+%PrepareFunctionForOptimization(equal);
+var a = 'abc';
+var b = "abc";
+equal(a, b);
+equal(a, b);
+%OptimizeFunctionOnNextCall(equal);
+assertTrue(equal(1.3, 1.3));

deps/v8/test/mjsunit/regress/json-stringifier-emptyhandle.js

@@ -0,0 +1,44 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+function explode() {
+  var array = [1,2,3];
+
+  Object.defineProperty(array, 4, {
+    get: function () { throw "dynamite"; },
+  });
+
+  JSON.stringify(array);
+}
+
+try {
+  explode();
+  assertUnreachable();
+} catch(e) {
+  assertEquals("dynamite", e);
+}

deps/v8/test/mjsunit/regress/large-indices.js

@@ -0,0 +1,139 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// crbug.com/1026974
+(function() {
+  function store(obj, key) {
+    obj[key] = 10;
+  }
+  %PrepareFunctionForOptimization(store);
+  for (let i = 0; i < 3; i++) {
+    let obj = {}
+    store(obj, 1152921506754330624);
+    assertEquals(["1152921506754330600"], Object.keys(obj));
+  }
+})();
+(function() {
+  function store(obj, key) {
+    obj[key] = 10;
+  }
+  %PrepareFunctionForOptimization(store);
+  for (let i = 0; i < 3; i++) {
+    let obj2 = new Int32Array(0);
+    store(obj2, 1152921506754330624);
+    assertEquals([], Object.keys(obj2));
+    store(obj2, "1152921506754330624");
+    assertEquals(["1152921506754330624"], Object.keys(obj2));
+  }
+})();
+
+// crbug.com/1026729
+(function() {
+  let key = 0xFFFFFFFF;
+  let object = {};
+  assertFalse(object.hasOwnProperty(key));
+  let proxy = new Proxy({}, {});
+  assertFalse(proxy.hasOwnProperty(key));
+})();
+
+// crbug.com/1026909
+(function() {
+  function load(obj, key) {
+    return obj[key];
+  }
+  %PrepareFunctionForOptimization(load);
+  const array = new Float64Array();
+  assertEquals(undefined, load(array, 'monomorphic'));
+  assertEquals(undefined, load(array, '4294967296'));
+})();
+
+// crbug.com/1026856
+(function() {
+  let key = 0xFFFFFFFF;
+  let receiver = new Int32Array();
+  var value = {};
+  var target = {};
+  Reflect.set(target, key, value, receiver);
+})();
+
+// crbug.com/1028213
+(function() {
+  function load(obj, key) {
+    return obj[key];
+  }
+  %PrepareFunctionForOptimization(load);
+  let obj = function() {};
+  obj.__proto__ = new Int8Array(1);
+  let key = Object(4294967297);
+  for (let i = 0; i < 3; i++) {
+    load(obj, key);
+  }
+})();
+(function() {
+  function load(obj, key) {
+    return obj[key];
+  }
+  %PrepareFunctionForOptimization(load);
+  let obj = new String("abc");
+  obj.__proto__ = new Int8Array(1);
+  let key = Object(4294967297);
+  for (let i = 0; i < 3; i++) {
+    load(obj, key);
+  }
+})();
+
+// crbug.com/1027461#c12
+(function() {
+  let arr = new Int32Array(2);
+  Object.defineProperty(arr, "foo", {get:function() { this.valueOf = 1; }});
+  arr[9007199254740991] = 1;
+  Object.values(arr);
+
+  let obj = [1, 2, 3];
+  Object.defineProperty(obj, 2, {get:function() { this.valueOf = 1; }});
+  obj[9007199254740991] = 1;
+  Object.values(obj);
+})();
+
+// crbug.com/1027461#c18
+(function() {
+  const v7 = Object(1);
+  v7[4294967297] = 1;
+  const v8 = Object.assign({}, v7);
+})();
+
+// crbug.com/1029369
+(function () {
+  let obj = {};
+  function AddProperty(o, k) {
+    Object.defineProperty(o, k, {});
+    if (!o.hasOwnProperty(k)) throw "Bug!";
+  }
+  AddProperty(obj, "1");  // Force dictionary-mode elements.
+  AddProperty(obj, 4294967295);
+})();
+
+// crbug.com/1029338
+(function() {
+  var __v_11 = {};
+  __v_11.__defineGetter__(4294967295, function () {});
+  __v_12 = Object.entries(__v_11);
+})();
+
+// crbug.com/1031175
+(function() {
+  var key = 4294967295;
+  var obj = {
+    boom() {
+      super[key]++;
+    },
+    bang() {
+      super["4294967295"]++;
+    }
+  }
+  obj.boom();
+  obj.bang();
+})();

deps/v8/test/mjsunit/regress/math-min.js

@@ -0,0 +1,66 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = new Float64Array(4);
+a[2] *= -1;
+a[3] *= -1;
+assertEquals(0, a[0]);
+assertEquals(0, a[1]);
+assertEquals(-0, a[2]);
+assertEquals(-0, a[3]);
+
+function f1() {
+  var z = a[0];
+  // Same register.
+  assertEquals(0, Math.min(z, z));
+};
+%PrepareFunctionForOptimization(f1);
+function f2() {
+  // Different registers.
+  assertEquals(0, Math.min(a[0], a[1]));
+};
+%PrepareFunctionForOptimization(f2);
+function f3() {
+  // Zero and minus zero.
+  assertEquals(-0, Math.min(a[1], a[2]));
+};
+%PrepareFunctionForOptimization(f3);
+function f4() {
+  // Zero and minus zero, reversed order.
+  assertEquals(-0, Math.min(a[2], a[1]));
+};
+%PrepareFunctionForOptimization(f4);
+function f5() {
+  // Minus zero, same register.
+  var m_z = a[2];
+  assertEquals(-0, Math.min(m_z, m_z));
+};
+%PrepareFunctionForOptimization(f5);
+function f6() {
+  // Minus zero, different registers.
+  assertEquals(-0, Math.min(a[2], a[3]));
+};
+%PrepareFunctionForOptimization(f6);
+for (var i = 0; i < 3; i++) {
+  f1();
+  f2();
+  f3();
+  f4();
+  f5();
+  f6();
+}
+%OptimizeFunctionOnNextCall(f1);
+%OptimizeFunctionOnNextCall(f2);
+%OptimizeFunctionOnNextCall(f3);
+%OptimizeFunctionOnNextCall(f4);
+%OptimizeFunctionOnNextCall(f5);
+%OptimizeFunctionOnNextCall(f6);
+f1();
+f2();
+f3();
+f4();
+f5();
+f6();

deps/v8/test/mjsunit/regress/modules-skip-regress-797581-1.js

@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export default ()

deps/v8/test/mjsunit/regress/modules-skip-regress-797581-2.js

@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export default (...)

deps/v8/test/mjsunit/regress/modules-skip-regress-797581-3.js

@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export default (a, ...b)

deps/v8/test/mjsunit/regress/modules-skip-regress-797581-4.js

@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export default 1, 2;

deps/v8/test/mjsunit/regress/modules-skip-regress-797581-5.js

@@ -0,0 +1,6 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let x;
+export default x = 0;

deps/v8/test/mjsunit/regress/nativeerror-tostring.js

@@ -0,0 +1,11 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+[
+  EvalError, RangeError, ReferenceError,
+  SyntaxError, TypeError, URIError,
+].forEach((NativeError) => {
+  assertFalse(NativeError.prototype.hasOwnProperty('toString'));
+  assertEquals(NativeError.prototype.toString, Error.prototype.toString);
+});

deps/v8/test/mjsunit/regress/negative_lookup.js

@@ -0,0 +1,65 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function s(v) {
+  v.x = 1;
+}
+
+function c(p) {
+  return {__proto__: p};
+}
+
+var p = {};
+
+// Make p the last prototype in the chain.
+p.__proto__ = null;
+
+var o1 = c(p);
+var o2 = c(p);
+var o3 = c(p);
+var o4 = c(p);
+
+// Make y go to slow mode.
+// Do this after using p as prototype, since using an object as prototype kicks
+// it back into fast mode.
+p.y = 1;
+delete p.y;
+
+// Initialize the store IC.
+s(o1);
+s(o2);
+
+// Do something with x in slow-mode p.
+Object.defineProperty(p, "x", { writable: false, value: 5 });
+
+// Verify that directly setting x fails.
+o3.x = 10;
+assertEquals(5, o3.x);
+
+// Verify that setting x through the IC fails.
+s(o4);
+assertEquals(5, o4.x);

deps/v8/test/mjsunit/regress/number-named-call-deopt.js

@@ -0,0 +1,43 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f(x, deopt, osr) {
+  var res = "result";
+  void x.toString(10, deopt + 0);
+  if (osr)
+    for (var i = 0; i < 100000; i++) {
+    }
+  return res;
+};
+%PrepareFunctionForOptimization(f);
+f(4, 0, false);
+f(4, 0, false);
+f(4, 0, false);
+%OptimizeFunctionOnNextCall(f);
+assertEquals("result", f(4, "deopt", true));

deps/v8/test/mjsunit/regress/poly_count_operation.js

@@ -0,0 +1,162 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var o1 = {x:1};
+var o2 = {};
+var deopt_getter = false;
+var deopt_setter = false;
+
+function f_mono(o) {
+  return 5 + o.x++;
+}
+%PrepareFunctionForOptimization(f_mono);
+
+var to_deopt = f_mono;
+
+var v = 1;
+var g = 0;
+var s = 0;
+
+Object.defineProperty(o2, "x",
+    {get:function() {
+       g++;
+       if (deopt_getter) {
+         deopt_getter = false;
+         %DeoptimizeFunction(to_deopt);
+       }
+       return v;
+     },
+     set:function(new_v) {
+       v = new_v;
+       s++;
+       if (deopt_setter) {
+         deopt_setter = false;
+         %DeoptimizeFunction(to_deopt);
+       }
+     }});
+
+assertEquals(6, f_mono(o2));
+assertEquals(1, g);
+assertEquals(1, s);
+assertEquals(7, f_mono(o2));
+assertEquals(2, g);
+assertEquals(2, s);
+%OptimizeFunctionOnNextCall(f_mono);
+deopt_setter = true;
+assertEquals(8, f_mono(o2));
+assertEquals(3, g);
+assertEquals(3, s);
+
+function f_poly(o) {
+  return 5 + o.x++;
+}
+%PrepareFunctionForOptimization(f_poly);
+
+v = 1;
+to_deopt = f_poly;
+
+f_poly(o1);
+f_poly(o1);
+assertEquals(6, f_poly(o2));
+assertEquals(4, g);
+assertEquals(4, s);
+assertEquals(7, f_poly(o2));
+assertEquals(5, g);
+assertEquals(5, s);
+%OptimizeFunctionOnNextCall(f_poly);
+deopt_setter = true;
+assertEquals(8, f_poly(o2));
+assertEquals(6, g);
+assertEquals(6, s);
+
+%PrepareFunctionForOptimization(f_poly);
+%OptimizeFunctionOnNextCall(f_poly);
+v = undefined;
+assertEquals(NaN, f_poly(o2));
+assertEquals(7, g);
+assertEquals(7, s);
+
+function f_pre(o) {
+  return 5 + ++o.x;
+}
+%PrepareFunctionForOptimization(f_pre);
+
+v = 1;
+to_deopt = f_pre;
+
+f_pre(o1);
+f_pre(o1);
+assertEquals(7, f_pre(o2));
+assertEquals(8, g);
+assertEquals(8, s);
+assertEquals(8, f_pre(o2));
+assertEquals(9, g);
+assertEquals(9, s);
+%OptimizeFunctionOnNextCall(f_pre);
+deopt_setter = true;
+assertEquals(9, f_pre(o2));
+assertEquals(10, g);
+assertEquals(10, s);
+
+%PrepareFunctionForOptimization(f_pre);
+%OptimizeFunctionOnNextCall(f_pre);
+v = undefined;
+assertEquals(NaN, f_pre(o2));
+assertEquals(11, g);
+assertEquals(11, s);
+
+
+function f_get(o) {
+  return 5 + o.x++;
+}
+%PrepareFunctionForOptimization(f_get);
+
+v = 1;
+to_deopt = f_get;
+
+f_get(o1);
+f_get(o1);
+assertEquals(6, f_get(o2));
+assertEquals(12, g);
+assertEquals(12, s);
+assertEquals(7, f_get(o2));
+assertEquals(13, g);
+assertEquals(13, s);
+%OptimizeFunctionOnNextCall(f_get);
+deopt_getter = true;
+assertEquals(8, f_get(o2));
+assertEquals(14, g);
+assertEquals(14, s);
+
+%PrepareFunctionForOptimization(f_get);
+%OptimizeFunctionOnNextCall(f_get);
+v = undefined;
+assertEquals(NaN, f_get(o2));
+assertEquals(15, g);
+assertEquals(15, s);

deps/v8/test/mjsunit/regress/polymorphic-accessor-test-context.js

@@ -0,0 +1,37 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function t1() {
+  return this instanceof t1;
+}
+function t2() {
+  return this instanceof t2;
+}
+
+var o1 = new function() {}();
+Object.defineProperty(o1, 't', {
+  get: function() {
+    return this instanceof o1.constructor;
+  }
+});
+var o2 = new function() {}();
+Object.defineProperty(o2, 't', {
+  get: function() {
+    return this instanceof o1.constructor;
+  }
+});
+var o3 = new function() {}();
+o3.t = true;
+
+function f(o) {
+  return 1 + (o.t ? 1 : 2);
+};
+%PrepareFunctionForOptimization(f);
+f(o1);
+f(o1);
+f(o2);
+%OptimizeFunctionOnNextCall(f);
+f(o3);

deps/v8/test/mjsunit/regress/post-increment-close-context.js

@@ -0,0 +1,43 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var foo = {bar: -2};
+function crash() {
+  return !foo.bar++;
+};
+%PrepareFunctionForOptimization(crash);
+assertFalse(crash());
+assertEquals(-1, foo.bar);
+%OptimizeFunctionOnNextCall(crash);
+assertFalse(crash());
+assertEquals(0, foo.bar);
+assertTrue(crash());
+assertEquals(1, foo.bar);
+assertFalse(crash());
+assertEquals(2, foo.bar);

deps/v8/test/mjsunit/regress/property-descriptor-to-object.js

@@ -0,0 +1,8 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var o = { prop: 1 };
+Object.prototype.value = 0;
+var d = Object.getOwnPropertyDescriptor(o, "prop");
+assertEquals(1, d.value);

deps/v8/test/mjsunit/regress/proto-transition-regress.js

@@ -0,0 +1,72 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+// Check proto transitions are applied first
+(function() {
+  var p = {};
+
+  var x1 = {};
+  x1.a = 1;
+  x1.__proto__ = p;
+
+  var x2 = {};
+  x2.__proto__ = p;
+  x2.a = 1;
+
+  assertTrue(%HaveSameMap(x1, x2));
+})();
+
+// Check proto transitions can be undone
+(function() {
+  var x1 = {};
+  x1.a = 1;
+
+  var x2 = {};
+  x2.a = 1;
+  x2.__proto__ = {};
+  x2.__proto__ = x1.__proto__;
+
+  assertTrue(%HaveSameMap(x1, x2));
+})();
+
+
+// Checks that intermediate maps don't die after proto transitions
+(function() {
+  function foo() {}
+  function goo() {}
+  var p = new goo();
+
+  function test() {
+    var o = new foo();
+    o.middle = 2;
+    o.__proto__ = p;
+    return o;
+  }
+
+  var a = test();
+  gc();gc();gc();
+  var b = test();
+  assertTrue(%HaveSameMap(a,b));
+})();
+
+// Checks if slack tracking on derived maps updates actual root map
+(function() {
+  function bla(a,b){}
+  pro = new Proxy({},{});
+  var co = function(){}
+  co.prototype = new Proxy({}, {get(target, property) {return 1}});
+
+  Reflect.construct(bla, [], co);
+  Reflect.construct(bla, [], co);
+  Reflect.construct(bla, [], co);
+  Reflect.construct(bla, [], co);
+  Reflect.construct(bla, [], co);
+  Reflect.construct(bla, [], co);
+  Reflect.construct(bla, [], co);
+
+  var x = new bla();
+  x.__proto__ = co.prototype;
+})();

deps/v8/test/mjsunit/regress/readonly1.js

@@ -0,0 +1,71 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function s(v) {
+  v.x = 1;
+}
+
+function s_strict(v) {
+  "use strict";
+  v.x = 1;
+}
+
+function c(p) {
+  return {__proto__: p};
+}
+
+var p = {};
+
+var o1 = c(p);
+var o2 = c(p);
+var o3 = c(p);
+var o4 = c(p);
+
+// Make p go slow.
+// Do this after using p as prototype, since using an object as prototype kicks
+// it back into fast mode.
+p.y = 1;
+delete p.y;
+p.x = 5;
+
+// Initialize the store IC.
+s(o1);
+s(o2);
+s_strict(o1);
+s_strict(o2);
+
+// Make x non-writable.
+Object.defineProperty(p, "x", { writable: false });
+
+// Verify that direct setting fails.
+o3.x = 20;
+assertEquals(5, o3.x);
+
+// Verify that setting through the IC fails.
+s(o4);
+assertEquals(5, o4.x);
+assertThrows("s_strict(o4);", TypeError);

deps/v8/test/mjsunit/regress/readonly2.js

@@ -0,0 +1,62 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+Object.defineProperty(this, "x", { writable:true });
+
+function s(v) {
+  v.x = 1;
+}
+
+function s_strict(v) {
+  "use strict";
+  v.x = 1;
+}
+
+function c(p) {
+  return {__proto__: p};
+}
+
+var o1 = c(this);
+var o2 = c(this);
+
+// Initialize the store IC.
+s(c(this));
+s(c(this));
+s_strict(c(this));
+s_strict(c(this));
+
+// Make x non-writable.
+Object.defineProperty(this, "x", { writable:false, value:5 });
+
+// Verify that direct setting fails.
+o1.x = 20;
+assertEquals(5, o1.x);
+
+// Verify that setting through the IC fails.
+s(o2);
+assertEquals(5, o2.x);
+assertThrows("s_strict(o2);", TypeError);

deps/v8/test/mjsunit/regress/readonly3.js

@@ -0,0 +1,65 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+this.x = 0;
+
+var p = {};
+Object.defineProperty(p, "x", {writable:false, value:5});
+this.__proto__ = p;
+
+function s(v) {
+  v.x = 1;
+}
+
+function s_strict(v) {
+  "use strict";
+  v.x = 1;
+}
+
+function c(p) {
+  return {__proto__: p};
+}
+
+var o1 = c(this);
+var o2 = c(this);
+
+// Initialize the store IC.
+s(c(this));
+s(c(this));
+s_strict(c(this));
+s_strict(c(this));
+
+delete this.x;
+
+// Verify that direct setting fails.
+o1.x = 20;
+assertEquals(5, o1.x);
+
+// Verify that setting through the IC fails.
+s(o2);
+assertEquals(5, o2.x);
+assertThrows("s_strict(o2);", TypeError);

deps/v8/test/mjsunit/regress/readonly4.js

@@ -0,0 +1,74 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var slow = {};
+var p = {};
+
+slow.__proto__ = p;
+slow.x = 10;
+slow.y = 10;
+Object.defineProperty(p, "x", {writable:false, value:5});
+
+function c(p) {
+  return {__proto__: p};
+}
+
+function s(v) {
+  return v.x = 1;
+}
+
+function s_strict(v) {
+  "use strict";
+  v.x = 1;
+}
+
+var o1 = c(slow);
+var o2 = c(slow);
+var o1_strict = c(slow);
+var o2_strict = c(slow);
+var o3 = c(slow);
+var o4 = c(slow);
+
+// Make s slow.
+// Do this after using slow as prototype, since using an object as prototype
+// kicks it back into fast mode.
+delete slow.y;
+
+s(o1);
+s(o2);
+s_strict(o1_strict);
+s_strict(o2_strict);
+
+delete slow.x;
+// Directly setting x should fail.
+o3.x = 20
+assertEquals(5, o3.x);
+
+// Setting x through IC should fail.
+s(o4);
+assertEquals(5, o4.x);
+assertThrows("s_strict(o4);", TypeError);

deps/v8/test/mjsunit/regress/readonly5.js

@@ -0,0 +1,68 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+this.__proto__ = null;
+this.x = 10;
+delete this.x;
+
+function s(v) {
+  return v.x = 1;
+}
+
+function s_strict(v) {
+  "use strict";
+  return v.x = 1;
+}
+
+function c() {
+  var o = {__proto__:this};
+  return o;
+}
+
+var o1 = c();
+var o2 = c();
+var o1_strict = c();
+var o2_strict = c();
+var o3 = c();
+var o4 = c();
+
+// Initialize the store IC.
+s(o1);
+s(o2);
+s_strict(o1_strict);
+s_strict(o2_strict);
+
+Object.defineProperty(this, "x", {writable:false, configurable:true});
+
+// Verify that directly setting x fails.
+o3.x = 1;
+assertEquals(undefined, o3.x);
+
+// Verify that setting x through the IC fails.
+assertThrows("s_strict(o4)", TypeError);
+s(o4);
+assertEquals(undefined, o4.x);

deps/v8/test/mjsunit/regress/redeclaration-error-types.js

@@ -0,0 +1,145 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+function doTest(scripts, expectedError) {
+  var realm = Realm.create();
+
+  for (var i = 0; i < scripts.length - 1; i++) {
+    Realm.eval(realm, scripts[i]);
+  }
+  assertThrows(function() {
+    Realm.eval(realm, scripts[scripts.length - 1]);
+  }, Realm.eval(realm, expectedError));
+
+  Realm.dispose(realm);
+}
+
+var tests = [
+  {
+    // ES#sec-globaldeclarationinstantiation 5.a:
+    // If envRec.HasVarDeclaration(name) is true, throw a SyntaxError
+    // exception.
+    scripts: [
+      "var a;",
+      "let a;",
+    ],
+    expectedError: "SyntaxError",
+  },
+  {
+    // ES#sec-globaldeclarationinstantiation 6.a:
+    // If envRec.HasLexicalDeclaration(name) is true, throw a SyntaxError
+    // exception.
+    scripts: [
+      "let a;",
+      "var a;",
+    ],
+    expectedError: "SyntaxError",
+  },
+  {
+    // ES#sec-globaldeclarationinstantiation 5.b:
+    // If envRec.HasLexicalDeclaration(name) is true, throw a SyntaxError
+    // exception.
+    scripts: [
+      "let a;",
+      "let a;",
+    ],
+    expectedError: "SyntaxError",
+  },
+  {
+    // ES#sec-evaldeclarationinstantiation 5.a.i.1:
+    // If varEnvRec.HasLexicalDeclaration(name) is true, throw a SyntaxError
+    // exception.
+    scripts: [
+      'let a; eval("var a;");',
+    ],
+    expectedError: "SyntaxError",
+  },
+  {
+    // ES#sec-evaldeclarationinstantiation 5.a.i.1:
+    // If varEnvRec.HasLexicalDeclaration(name) is true, throw a SyntaxError
+    // exception.
+    scripts: [
+      'let a; eval("function a() {}");',
+    ],
+    expectedError: "SyntaxError",
+  },
+  {
+    // ES#sec-evaldeclarationinstantiation 5.d.ii.2.a.i:
+    // Throw a SyntaxError exception.
+    scripts: [
+      '(function() { let a; eval("var a;"); })();',
+    ],
+    expectedError: "SyntaxError",
+  },
+  {
+    // ES#sec-evaldeclarationinstantiation 5.d.ii.2.a.i:
+    // Throw a SyntaxError exception.
+    scripts: [
+      '(function() { let a; eval("function a() {}"); })();',
+    ],
+    expectedError: "SyntaxError",
+  },
+  {
+    // ES#sec-globaldeclarationinstantiation 5.d:
+    // If hasRestrictedGlobal is true, throw a SyntaxError exception.
+    scripts: [
+      'let NaN;',
+    ],
+    expectedError: "SyntaxError",
+  },
+  {
+    // ES#sec-globaldeclarationinstantiation 5.d:
+    // If hasRestrictedGlobal is true, throw a SyntaxError exception.
+    scripts: [
+      'function NaN() {}',
+    ],
+    expectedError: "SyntaxError",
+  },
+
+  {
+    // ES#sec-evaldeclarationinstantiation 8.a.iv.1.b:
+    // If fnDefinable is false, throw a TypeError exception.
+    scripts: [
+      'eval("function NaN() {}");',
+    ],
+    expectedError: "TypeError",
+  },
+  {
+    // ES#sec-evaldeclarationinstantiation 8.a.iv.1.b:
+    // If fnDefinable is false, throw a TypeError exception.
+    scripts: [
+      `
+        let a;
+        try {
+          eval("function a() {}");
+        } catch (e) {}
+        eval("function NaN() {}");
+      `,
+    ],
+    expectedError: "TypeError",
+  },
+  {
+    // ES#sec-evaldeclarationinstantiation 8.a.iv.1.b:
+    // If fnDefinable is false, throw a TypeError exception.
+    scripts: [
+      `
+        eval("
+          function f() {
+            function b() {
+              (0, eval)('function NaN() {}');
+            }
+            b();
+          }
+          f();
+        ");
+      `.replace(/"/g, '`'),
+    ],
+    expectedError: "TypeError",
+  },
+];
+
+tests.forEach(function(test) {
+  doTest(test.scripts, test.expectedError);
+});

deps/v8/test/mjsunit/regress/regress-1000635.js

@@ -0,0 +1,15 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --stress-compaction --detailed-error-stack-trace --gc-interval=6
+
+function add(a, b) {
+  throw new Error();
+}
+for (let i = 0; i < 100; ++i) {
+  try {
+    add(1, 2);
+  } catch (e) {
+  }
+}

deps/v8/test/mjsunit/regress/regress-1002827.js

@@ -0,0 +1,13 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+var PI = new Proxy(this, {
+  get() {
+      PI();
+  }
+});
+
+assertThrows(() => new gc(PI, {}), TypeError);

deps/v8/test/mjsunit/regress/regress-1003730.js

@@ -0,0 +1,25 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+function bar(error) {
+  try {
+    throw "didn't throw TypeError";
+  } catch (err) {
+    error instanceof error, "didn't throw " + error.prototype.name;
+  }
+}
+function foo(param) {
+  bar(TypeError);
+}
+try {
+  bar();
+} catch (e) {}
+%PrepareFunctionForOptimization(foo);
+try {
+  foo();
+} catch (e) {}
+%OptimizeFunctionOnNextCall(foo);
+foo();

deps/v8/test/mjsunit/regress/regress-1003919.js

@@ -0,0 +1,20 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Define an object with a getter and a proxy as it's prototype.
+var obj = {foo: 'bar'};
+Object.defineProperty(obj, 'foo', {
+  get: function () {
+  }
+});
+obj.__proto__ = new Proxy([], {});
+
+// Get key from a function to avoid the property access turning into a
+// named property access.
+function getKey() {
+  return 'values'
+}
+
+// Keyed access to update obj's values property.
+obj[getKey()] = 1;

deps/v8/test/mjsunit/regress/regress-100409.js

@@ -0,0 +1,54 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function outer() {
+  var val = 0;
+
+  function foo() {
+    val = 0;
+    val;
+    var z = false;
+    var y = true;
+    if (!z) {
+      while (z = !z) {
+        if (y) val++;
+      }
+    }
+    return val++;
+  };
+  %PrepareFunctionForOptimization(foo);
+  return foo;
+}
+
+var foo = outer();
+
+assertEquals(1, foo());
+assertEquals(1, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(1, foo());

deps/v8/test/mjsunit/regress/regress-1004912.js

@@ -0,0 +1,12 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var key = {
+  toString() {
+    return Symbol();
+  }
+};
+
+var obj = {};
+obj[key];

deps/v8/test/mjsunit/regress/regress-1005400.js

@@ -0,0 +1,23 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function foo(a, key) {
+  a[key];
+}
+
+let obj = {};
+let count = 0;
+
+var key_obj = {
+  toString: function() {
+    count++;
+    // Force string to be internalized during keyed lookup.
+    return 'foo' + count;
+  }
+};
+
+foo(obj, key_obj);
+
+// We should only call toString once.
+assertEquals(count, 1);

deps/v8/test/mjsunit/regress/regress-1006629.js

@@ -0,0 +1,10 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const workerScript = `
+  onmessage = function() {
+  };`;
+const worker = new Worker(workerScript, {type: 'string'});
+const i32a = new Int32Array( new SharedArrayBuffer() );
+worker.postMessage([i32a.buffer]);

deps/v8/test/mjsunit/regress/regress-1006640.js

@@ -0,0 +1,20 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+function main() {
+  const v2 = [1337,1337,1337,1337,1337];
+  function v9() {
+      const v15 = {get:RegExp};
+      Object.defineProperty(v2,501,v15);
+      const v18 = RegExp();
+      const v19 = 1337 instanceof v18;
+  }
+  const v30 = {defineProperty:Function,get:v9,getPrototypeOf:Object};
+  const v32 = new Proxy(ArrayBuffer,v30);
+  const v34 = gc(v32);
+}
+
+assertThrows(() => main(), TypeError);

deps/v8/test/mjsunit/regress/regress-1006670.js

@@ -0,0 +1,5 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(() => /(a?;?){4000000}/.exec("a"), RangeError);

deps/v8/test/mjsunit/regress/regress-100702.js

@@ -0,0 +1,44 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test for correct handling of non-object receiver values
+// passed to built-in array functions.
+
+String.prototype.isThatMe = function () {
+  assertFalse(this === str);
+};
+
+var str = "abc";
+str.isThatMe();
+str.isThatMe.call(str);
+
+var arr = [1];
+arr.forEach("".isThatMe, str);
+arr.filter("".isThatMe, str);
+arr.some("".isThatMe, str);
+arr.every("".isThatMe, str);
+arr.map("".isThatMe, str);

deps/v8/test/mjsunit/regress/regress-1008414.js

@@ -0,0 +1,14 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --throws
+
+(function bar() {
+  (function foo(
+      x = new class B extends A(eval) { }
+    ) {
+        eval();
+    })();
+  eval();
+})()

deps/v8/test/mjsunit/regress/regress-1011980.js

@@ -0,0 +1,22 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+let hex_b = 0x0b;
+let hex_d = 0x0d;
+let hex_20 = 0x20;
+let hex_52 = 0x52;
+let hex_fe = 0xfe;
+
+function f(a) {
+  let unused = [ a / 8, ...[ ...[ ...[], a / 8, ...[ 7, hex_fe, a, 0, 0, hex_20,
+    6, hex_52, hex_d, 0, hex_b], 0, hex_b], hex_b]];
+}
+
+%PrepareFunctionForOptimization(f)
+f(64)
+f(64);
+%OptimizeFunctionOnNextCall(f);
+f(64);

deps/v8/test/mjsunit/regress/regress-10138.js

@@ -0,0 +1,19 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file
+
+// Flags: --allow-natives-syntax --interpreted-frames-native-stack
+
+function f() {
+  g();
+}
+
+function g() {
+  %DeoptimizeFunction(f);
+  %DeoptimizeFunction(f);
+}
+
+%PrepareFunctionForOptimization(f);
+f(); f();
+%OptimizeFunctionOnNextCall(f);
+f();

deps/v8/test/mjsunit/regress/regress-1015.js

@@ -0,0 +1,66 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=1015
+
+// Object and array literals should be created using DefineOwnProperty, and
+// therefore not hit setters in the prototype.
+
+function mkFail(message) {
+  return function () { assertUnreachable(message); }
+}
+
+Object.defineProperty(Object.prototype, "foo",
+                      {get: mkFail("oget"), set: mkFail("oset")});
+Object.defineProperty(Array.prototype, "2",
+                      {get: mkFail("aget"), set: mkFail("aset")});
+
+function inFunction() {
+  for (var i = 0; i < 10; i++) {
+    // in loop.
+    var ja = JSON.parse('[1,2,3,4]');
+    var jo = JSON.parse('{"bar": 10, "foo": 20}')
+    var jop = JSON.parse('{"bar": 10, "__proto__": { }, "foo": 20}')
+    var a = [1,2,3,4];
+    var o = { bar: 10, foo: 20 };
+    var op = { __proto__: { set bar(v) { assertUnreachable("bset"); } },
+               bar: 10 };
+  }
+}
+
+for (var i = 0; i < 10; i++) {
+  // In global scope.
+  var ja = JSON.parse('[1,2,3,4]');
+  var jo = JSON.parse('{"bar": 10, "foo": 20}')
+  var jop = JSON.parse('{"bar": 10, "__proto__": { }, "foo": 20}')
+  var a = [1,2,3,4];
+  var o = { bar: 10, foo: 20 };
+  var op = { __proto__: { set bar(v) { assertUnreachable("bset"); } },
+             bar: 10 };
+  // In function scope.
+  inFunction();
+}

deps/v8/test/mjsunit/regress/regress-1016450.js

@@ -0,0 +1,31 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbofan --no-always-turbofan
+
+let g = 0;
+
+function f(x) {
+  let y = BigInt.asUintN(64, 15n);
+  // Introduce a side effect to force the construction of a FrameState that
+  // captures the value of y.
+  g = 42;
+  try {
+    return x + y;
+  } catch(_) {
+    return y;
+  }
+}
+
+
+%PrepareFunctionForOptimization(f);
+assertEquals(16n, f(1n));
+assertEquals(17n, f(2n));
+%OptimizeFunctionOnNextCall(f);
+assertEquals(16n, f(1n));
+assertOptimized(f);
+assertEquals(15n, f(0));
+if (%Is64Bit()) {
+  assertUnoptimized(f);
+}

deps/v8/test/mjsunit/regress/regress-1016703.js

@@ -0,0 +1,15 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+let realms = [];
+for (let i = 0; i < 4; i++) {
+  realms.push(Realm.createAllowCrossRealmAccess());
+}
+
+for (let i = 0; i < 4; i++) {
+  Realm.detachGlobal(realms[i]);
+  gc();
+}

deps/v8/test/mjsunit/regress/regress-1017.js

@@ -0,0 +1,35 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=1017
+
+// 32 ASCII-characters followed by a non-ASCII character.
+// This causes an internal buffer to first expand to 64 bytes, then expand the
+// 32 ASCII characters to 64 bytes of UC16 characters, leaving no room
+// to store the 33rd character. This fails an ASSERT in debug mode.
+
+assertEquals(33, "12345678901234567890123456789012\u2028".length);

deps/v8/test/mjsunit/regress/regress-1018592.js

@@ -0,0 +1,6 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const re = /()()()()(?<aaaab>)1/;
+"111a1a".replace(re, () => {}) ;

deps/v8/test/mjsunit/regress/regress-1018871.js

@@ -0,0 +1,14 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var v_this = this;
+function f() {
+  var obj = {y: 0};
+  var proxy = new Proxy(obj, {
+    has() { y; },
+  });
+  Object.setPrototypeOf(v_this, proxy);
+  x;
+}
+assertThrows(f, RangeError);