Adding upstream version 124.0.1.upstream/124.0.1

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

212 files changed, 6690 insertions, 0 deletions

diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/Symbol.species/browser.js b/js/src/tests/test262/built-ins/ArrayBuffer/Symbol.species/browser.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/Symbol.species/browser.js
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/Symbol.species/length.js b/js/src/tests/test262/built-ins/ArrayBuffer/Symbol.species/length.js
new file mode 100644
index 0000000000..3d44fa0cae
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/Symbol.species/length.js
@@ -0,0 +1,34 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-get-arraybuffer-@@species
+description: >
+  get ArrayBuffer [ @@species ].length is 0.
+info: |
+  get ArrayBuffer [ @@species ]
+
+  17 ECMAScript Standard Built-in Objects:
+    Every built-in Function object, including constructors, has a length
+    property whose value is an integer. Unless otherwise specified, this
+    value is equal to the largest number of named arguments shown in the
+    subclause headings for the function description, including optional
+    parameters. However, rest parameters shown using the form “...name”
+    are not included in the default argument count.
+
+    Unless otherwise specified, the length property of a built-in Function
+    object has the attributes { [[Writable]]: false, [[Enumerable]]: false,
+    [[Configurable]]: true }.
+includes: [propertyHelper.js]
+features: [Symbol.species]
+---*/
+
+var desc = Object.getOwnPropertyDescriptor(ArrayBuffer, Symbol.species);
+
+assert.sameValue(desc.get.length, 0);
+
+verifyNotEnumerable(desc.get, "length");
+verifyNotWritable(desc.get, "length");
+verifyConfigurable(desc.get, "length");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/Symbol.species/return-value.js b/js/src/tests/test262/built-ins/ArrayBuffer/Symbol.species/return-value.js
new file mode 100644
index 0000000000..607473f7b2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/Symbol.species/return-value.js
@@ -0,0 +1,16 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer-@@species
+description: Return value of @@species accessor method
+info: |
+    1. Return the this value.
+features: [Symbol.species]
+---*/
+
+var thisVal = {};
+var accessor = Object.getOwnPropertyDescriptor(ArrayBuffer, Symbol.species).get;
+
+assert.sameValue(accessor.call(thisVal), thisVal);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/Symbol.species/shell.js b/js/src/tests/test262/built-ins/ArrayBuffer/Symbol.species/shell.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/Symbol.species/shell.js
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/Symbol.species/symbol-species-name.js b/js/src/tests/test262/built-ins/ArrayBuffer/Symbol.species/symbol-species-name.js
new file mode 100644
index 0000000000..2d9d0eb3e8
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/Symbol.species/symbol-species-name.js
@@ -0,0 +1,27 @@
+// Copyright (C) 2015 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer-@@species
+description: >
+  ArrayBuffer[Symbol.species] accessor property get name
+info: |
+  24.1.3.3 get ArrayBuffer [ @@species ]
+
+  ...
+  The value of the name property of this function is "get [Symbol.species]".
+features: [Symbol.species]
+includes: [propertyHelper.js]
+---*/
+
+var descriptor = Object.getOwnPropertyDescriptor(ArrayBuffer, Symbol.species);
+
+assert.sameValue(
+  descriptor.get.name,
+  'get [Symbol.species]'
+);
+
+verifyNotEnumerable(descriptor.get, 'name');
+verifyNotWritable(descriptor.get, 'name');
+verifyConfigurable(descriptor.get, 'name');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/Symbol.species/symbol-species.js b/js/src/tests/test262/built-ins/ArrayBuffer/Symbol.species/symbol-species.js
new file mode 100644
index 0000000000..8c01389acb
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/Symbol.species/symbol-species.js
@@ -0,0 +1,23 @@
+// Copyright 2015 Cubane Canada, Inc.  All rights reserved.
+// See LICENSE for details.
+
+/*---
+info: |
+ ArrayBuffer has a property at `Symbol.species`
+esid: sec-get-arraybuffer-@@species
+author: Sam Mikes
+description: ArrayBuffer[Symbol.species] exists per spec
+features: [ArrayBuffer, Symbol.species]
+includes: [propertyHelper.js]
+---*/
+
+var desc = Object.getOwnPropertyDescriptor(ArrayBuffer, Symbol.species);
+
+assert.sameValue(desc.set, undefined);
+assert.sameValue(typeof desc.get, 'function');
+
+verifyNotWritable(ArrayBuffer, Symbol.species, Symbol.species);
+verifyNotEnumerable(ArrayBuffer, Symbol.species);
+verifyConfigurable(ArrayBuffer, Symbol.species);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/allocation-limit.js b/js/src/tests/test262/built-ins/ArrayBuffer/allocation-limit.js
new file mode 100644
index 0000000000..3f312139c8
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/allocation-limit.js
@@ -0,0 +1,33 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer-length
+description: >
+  Throws a RangeError if requested Data Block is too large.
+info: |
+  ArrayBuffer( length )
+
+  ...
+  6. Return AllocateArrayBuffer(NewTarget, byteLength).
+
+  6.2.6.1 CreateByteDataBlock(size)
+    ...
+    2. Let db be a new Data Block value consisting of size bytes. If it is
+       impossible to create such a Data Block, throw a RangeError exception.
+    ...
+---*/
+
+assert.throws(RangeError, function() {
+  // Allocating 7 PiB should fail with a RangeError.
+  // Math.pow(1024, 5) = 1125899906842624
+  new ArrayBuffer(7 * 1125899906842624);
+}, "`length` parameter is 7 PiB");
+
+assert.throws(RangeError, function() {
+  // Allocating almost 8 PiB should fail with a RangeError.
+  // Math.pow(2, 53) = 9007199254740992
+  new ArrayBuffer(9007199254740992 - 1);
+}, "`length` parameter is Math.pow(2, 53) - 1");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/browser.js b/js/src/tests/test262/built-ins/ArrayBuffer/browser.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/browser.js
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/data-allocation-after-object-creation.js b/js/src/tests/test262/built-ins/ArrayBuffer/data-allocation-after-object-creation.js
new file mode 100644
index 0000000000..503f46d016
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/data-allocation-after-object-creation.js
@@ -0,0 +1,40 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer-length
+description: >
+  The new ArrayBuffer instance is created prior to allocating the Data Block.
+info: |
+  ArrayBuffer( length )
+
+  ...
+  6. Return AllocateArrayBuffer(NewTarget, byteLength).
+
+  AllocateArrayBuffer( constructor, byteLength )
+    1. Let obj be OrdinaryCreateFromConstructor(constructor, "%ArrayBufferPrototype%",
+       «[[ArrayBufferData]], [[ArrayBufferByteLength]]» ).
+    2. ReturnIfAbrupt(obj).
+    ...
+    4. Let block be CreateByteDataBlock(byteLength).
+    5. ReturnIfAbrupt(block).
+    ...
+features: [Reflect.construct]
+---*/
+
+function DummyError() {}
+
+var newTarget = function() {}.bind(null);
+Object.defineProperty(newTarget, "prototype", {
+  get: function() {
+    throw new DummyError();
+  }
+});
+
+assert.throws(DummyError, function() {
+  // Allocating 7 PiB should fail with a RangeError.
+  // Math.pow(1024, 5) = 1125899906842624
+  Reflect.construct(ArrayBuffer, [7 * 1125899906842624], newTarget);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/init-zero.js b/js/src/tests/test262/built-ins/ArrayBuffer/init-zero.js
new file mode 100644
index 0000000000..9acfb446cb
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/init-zero.js
@@ -0,0 +1,36 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer-length
+description: All bytes are initialized to zero
+info: |
+    [...]
+    5. Return ? AllocateArrayBuffer(NewTarget, byteLength).
+
+    24.1.1.1 AllocateArrayBuffer
+
+    3. Let block be ? CreateByteDataBlock(byteLength).
+
+    6.2.6.1 CreateByteDataBlock
+
+    1. Assert: size≥0.
+    2. Let db be a new Data Block value consisting of size bytes. If it is
+       impossible to create such a Data Block, throw a RangeError exception.
+    3. Set all of the bytes of db to 0.
+    4. Return db. 
+features: [DataView]
+---*/
+
+var view = new DataView(new ArrayBuffer(9));
+
+assert.sameValue(view.getUint8(0), 0, 'index 0');
+assert.sameValue(view.getUint8(1), 0, 'index 1');
+assert.sameValue(view.getUint8(2), 0, 'index 2');
+assert.sameValue(view.getUint8(3), 0, 'index 3');
+assert.sameValue(view.getUint8(4), 0, 'index 4');
+assert.sameValue(view.getUint8(5), 0, 'index 5');
+assert.sameValue(view.getUint8(6), 0, 'index 6');
+assert.sameValue(view.getUint8(7), 0, 'index 7');
+assert.sameValue(view.getUint8(8), 0, 'index 8');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/is-a-constructor.js b/js/src/tests/test262/built-ins/ArrayBuffer/is-a-constructor.js
new file mode 100644
index 0000000000..565da68608
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/is-a-constructor.js
@@ -0,0 +1,26 @@
+// Copyright (C) 2020 Rick Waldron. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-ecmascript-standard-built-in-objects
+description: >
+  The ArrayBuffer constructor implements [[Construct]]
+info: |
+  IsConstructor ( argument )
+
+  The abstract operation IsConstructor takes argument argument (an ECMAScript language value).
+  It determines if argument is a function object with a [[Construct]] internal method.
+  It performs the following steps when called:
+
+  If Type(argument) is not Object, return false.
+  If argument has a [[Construct]] internal method, return true.
+  Return false.
+includes: [isConstructor.js]
+features: [Reflect.construct, ArrayBuffer]
+---*/
+
+assert.sameValue(isConstructor(ArrayBuffer), true, 'isConstructor(ArrayBuffer) must return true');
+new ArrayBuffer();
+  
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-has-no-viewedarraybuffer.js b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-has-no-viewedarraybuffer.js
new file mode 100644
index 0000000000..28138d45e3
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-has-no-viewedarraybuffer.js
@@ -0,0 +1,19 @@
+// Copyright (C) 2016 The V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.isview
+description: >
+  Return false if arg has no [[ViewedArrayBuffer]] internal slot.
+info: |
+  24.1.3.1 ArrayBuffer.isView ( arg )
+
+  1. If Type(arg) is not Object, return false.
+  2. If arg has a [[ViewedArrayBuffer]] internal slot, return true.
+  3. Return false.
+---*/
+
+assert.sameValue(ArrayBuffer.isView({}), false, "ordinary object");
+assert.sameValue(ArrayBuffer.isView([]), false, "Array");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-arraybuffer.js b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-arraybuffer.js
new file mode 100644
index 0000000000..2ca8a2d1ee
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-arraybuffer.js
@@ -0,0 +1,20 @@
+// Copyright (C) 2016 The V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.isview
+description: >
+  Return false from an instance of ArrayBuffer
+info: |
+  24.1.3.1 ArrayBuffer.isView ( arg )
+
+  1. If Type(arg) is not Object, return false.
+  2. If arg has a [[ViewedArrayBuffer]] internal slot, return true.
+  3. Return false.
+---*/
+
+var sample = new ArrayBuffer(1);
+
+assert.sameValue(ArrayBuffer.isView(sample), false);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-dataview-buffer.js b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-dataview-buffer.js
new file mode 100644
index 0000000000..2b59775a4b
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-dataview-buffer.js
@@ -0,0 +1,21 @@
+// Copyright (C) 2016 The V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.isview
+description: >
+  Return false from DataView's instance `.buffer`
+info: |
+  24.1.3.1 ArrayBuffer.isView ( arg )
+
+  1. If Type(arg) is not Object, return false.
+  2. If arg has a [[ViewedArrayBuffer]] internal slot, return true.
+  3. Return false.
+features: [DataView]
+---*/
+
+var sample = new DataView(new ArrayBuffer(1), 0, 0).buffer;
+
+assert.sameValue(ArrayBuffer.isView(sample), false);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-dataview-constructor.js b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-dataview-constructor.js
new file mode 100644
index 0000000000..1095947f70
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-dataview-constructor.js
@@ -0,0 +1,19 @@
+// Copyright (C) 2016 The V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.isview
+description: >
+  Return false if arg is the DataView constructor
+info: |
+  24.1.3.1 ArrayBuffer.isView ( arg )
+
+  1. If Type(arg) is not Object, return false.
+  2. If arg has a [[ViewedArrayBuffer]] internal slot, return true.
+  3. Return false.
+features: [DataView]
+---*/
+
+assert.sameValue(ArrayBuffer.isView(DataView), false, "DataView");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-dataview-subclass-instance.js b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-dataview-subclass-instance.js
new file mode 100644
index 0000000000..727e318f0d
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-dataview-subclass-instance.js
@@ -0,0 +1,23 @@
+// Copyright (C) 2016 The V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.isview
+description: >
+  Return true if arg is an instance from a subclass of DataView
+info: |
+  24.1.3.1 ArrayBuffer.isView ( arg )
+
+  1. If Type(arg) is not Object, return false.
+  2. If arg has a [[ViewedArrayBuffer]] internal slot, return true.
+  3. Return false.
+features: [class, DataView]
+---*/
+
+class DV extends DataView {}
+
+var sample = new DV(new ArrayBuffer(1), 0, 0);
+
+assert(ArrayBuffer.isView(sample));
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-dataview.js b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-dataview.js
new file mode 100644
index 0000000000..ab145cf6cf
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-dataview.js
@@ -0,0 +1,21 @@
+// Copyright (C) 2016 The V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.isview
+description: >
+  Return true if is an instance of DataView
+info: |
+  24.1.3.1 ArrayBuffer.isView ( arg )
+
+  1. If Type(arg) is not Object, return false.
+  2. If arg has a [[ViewedArrayBuffer]] internal slot, return true.
+  3. Return false.
+features: [DataView]
+---*/
+
+var sample = new DataView(new ArrayBuffer(1), 0, 0);
+
+assert.sameValue(ArrayBuffer.isView(sample), true);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-not-object.js b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-not-object.js
new file mode 100644
index 0000000000..3fc13f5b05
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-not-object.js
@@ -0,0 +1,20 @@
+// Copyright (C) 2016 The V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.isview
+description: >
+  Return false if arg is not Object
+info: |
+  24.1.3.1 ArrayBuffer.isView ( arg )
+
+  1. If Type(arg) is not Object, return false.
+  ...
+---*/
+
+assert.sameValue(ArrayBuffer.isView(null), false, "null");
+assert.sameValue(ArrayBuffer.isView(undefined), false, "undefined");
+assert.sameValue(ArrayBuffer.isView(1), false, "number");
+assert.sameValue(ArrayBuffer.isView(""), false, "string");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-typedarray-buffer.js b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-typedarray-buffer.js
new file mode 100644
index 0000000000..9e8918b388
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-typedarray-buffer.js
@@ -0,0 +1,24 @@
+// Copyright (C) 2016 The V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.isview
+description: >
+  Return false from TypedArray's instance `.buffer`
+info: |
+  24.1.3.1 ArrayBuffer.isView ( arg )
+
+  1. If Type(arg) is not Object, return false.
+  2. If arg has a [[ViewedArrayBuffer]] internal slot, return true.
+  3. Return false.
+features: [TypedArray]
+includes: [testTypedArray.js]
+---*/
+
+testWithTypedArrayConstructors(function(ctor) {
+  var sample = new ctor().buffer;
+
+  assert.sameValue(ArrayBuffer.isView(sample), false);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-typedarray-constructor.js b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-typedarray-constructor.js
new file mode 100644
index 0000000000..efd5d16984
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-typedarray-constructor.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 The V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.isview
+description: >
+  Return false if arg is a TypedArray constructor
+info: |
+  24.1.3.1 ArrayBuffer.isView ( arg )
+
+  1. If Type(arg) is not Object, return false.
+  2. If arg has a [[ViewedArrayBuffer]] internal slot, return true.
+  3. Return false.
+features: [TypedArray]
+includes: [testTypedArray.js]
+---*/
+
+testWithTypedArrayConstructors(function(ctor) {
+  assert.sameValue(ArrayBuffer.isView(ctor), false);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-typedarray-subclass-instance.js b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-typedarray-subclass-instance.js
new file mode 100644
index 0000000000..3d17140d0f
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-typedarray-subclass-instance.js
@@ -0,0 +1,26 @@
+// Copyright (C) 2016 The V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.isview
+description: >
+  Return true if arg is an instance from a subclass of TypedArray
+info: |
+  24.1.3.1 ArrayBuffer.isView ( arg )
+
+  1. If Type(arg) is not Object, return false.
+  2. If arg has a [[ViewedArrayBuffer]] internal slot, return true.
+  3. Return false.
+features: [class, TypedArray]
+includes: [testTypedArray.js]
+---*/
+
+testWithTypedArrayConstructors(function(ctor) {
+  class TA extends ctor {}
+
+  var sample = new TA();
+
+  assert(ArrayBuffer.isView(sample));
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-typedarray.js b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-typedarray.js
new file mode 100644
index 0000000000..78cbfbbf61
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-typedarray.js
@@ -0,0 +1,24 @@
+// Copyright (C) 2016 The V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.isview
+description: >
+  Return true if arg is an instance of TypedArray
+info: |
+  24.1.3.1 ArrayBuffer.isView ( arg )
+
+  1. If Type(arg) is not Object, return false.
+  2. If arg has a [[ViewedArrayBuffer]] internal slot, return true.
+  3. Return false.
+features: [TypedArray]
+includes: [testTypedArray.js]
+---*/
+
+testWithTypedArrayConstructors(function(ctor) {
+  var sample = new ctor();
+
+  assert.sameValue(ArrayBuffer.isView(sample), true);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/isView/browser.js b/js/src/tests/test262/built-ins/ArrayBuffer/isView/browser.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/isView/browser.js
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/isView/invoked-as-a-fn.js b/js/src/tests/test262/built-ins/ArrayBuffer/isView/invoked-as-a-fn.js
new file mode 100644
index 0000000000..e58a330cdb
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/isView/invoked-as-a-fn.js
@@ -0,0 +1,31 @@
+// Copyright (C) 2016 The V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.isview
+description: >
+  `isView` can be invoked as a function
+info: |
+  24.1.3.1 ArrayBuffer.isView ( arg )
+
+  1. If Type(arg) is not Object, return false.
+  2. If arg has a [[ViewedArrayBuffer]] internal slot, return true.
+  3. Return false.
+features: [TypedArray, DataView]
+includes: [testTypedArray.js]
+---*/
+
+var isView = ArrayBuffer.isView;
+
+testWithTypedArrayConstructors(function(ctor) {
+  var sample = new ctor();
+  assert.sameValue(isView(sample), true, "instance of TypedArray");
+});
+
+var dv = new DataView(new ArrayBuffer(1), 0, 0);
+assert.sameValue(isView(dv), true, "instance of DataView");
+
+assert.sameValue(isView(), false, "undefined arg");
+assert.sameValue(isView({}), false, "ordinary object");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/isView/length.js b/js/src/tests/test262/built-ins/ArrayBuffer/isView/length.js
new file mode 100644
index 0000000000..d74f5ab42d
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/isView/length.js
@@ -0,0 +1,31 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.isview
+description: >
+  ArrayBuffer.isView.length is 1.
+info: |
+  ArrayBuffer.isView ( arg )
+
+  17 ECMAScript Standard Built-in Objects:
+    Every built-in Function object, including constructors, has a length
+    property whose value is an integer. Unless otherwise specified, this
+    value is equal to the largest number of named arguments shown in the
+    subclause headings for the function description, including optional
+    parameters. However, rest parameters shown using the form “...name”
+    are not included in the default argument count.
+
+    Unless otherwise specified, the length property of a built-in Function
+    object has the attributes { [[Writable]]: false, [[Enumerable]]: false,
+    [[Configurable]]: true }.
+includes: [propertyHelper.js]
+---*/
+
+assert.sameValue(ArrayBuffer.isView.length, 1);
+
+verifyNotEnumerable(ArrayBuffer.isView, "length");
+verifyNotWritable(ArrayBuffer.isView, "length");
+verifyConfigurable(ArrayBuffer.isView, "length");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/isView/name.js b/js/src/tests/test262/built-ins/ArrayBuffer/isView/name.js
new file mode 100644
index 0000000000..e8ef8b04e5
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/isView/name.js
@@ -0,0 +1,28 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.isview
+description: >
+  ArrayBuffer.isView.name is "isView".
+info: |
+  ArrayBuffer.isView ( arg )
+
+  17 ECMAScript Standard Built-in Objects:
+    Every built-in Function object, including constructors, that is not
+    identified as an anonymous function has a name property whose value
+    is a String.
+
+    Unless otherwise specified, the name property of a built-in Function
+    object, if it exists, has the attributes { [[Writable]]: false,
+    [[Enumerable]]: false, [[Configurable]]: true }.
+includes: [propertyHelper.js]
+---*/
+
+assert.sameValue(ArrayBuffer.isView.name, "isView");
+
+verifyNotEnumerable(ArrayBuffer.isView, "name");
+verifyNotWritable(ArrayBuffer.isView, "name");
+verifyConfigurable(ArrayBuffer.isView, "name");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/isView/no-arg.js b/js/src/tests/test262/built-ins/ArrayBuffer/isView/no-arg.js
new file mode 100644
index 0000000000..c3b747b7bf
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/isView/no-arg.js
@@ -0,0 +1,17 @@
+// Copyright (C) 2016 The V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.isview
+description: >
+  Return false if isView is called with no arg
+info: |
+  24.1.3.1 ArrayBuffer.isView ( arg )
+
+  1. If Type(arg) is not Object, return false.
+  ...
+---*/
+
+assert.sameValue(ArrayBuffer.isView(), false);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/isView/not-a-constructor.js b/js/src/tests/test262/built-ins/ArrayBuffer/isView/not-a-constructor.js
new file mode 100644
index 0000000000..09f8d71685
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/isView/not-a-constructor.js
@@ -0,0 +1,31 @@
+// Copyright (C) 2020 Rick Waldron. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-ecmascript-standard-built-in-objects
+description: >
+  ArrayBuffer.isView does not implement [[Construct]], is not new-able
+info: |
+  ECMAScript Function Objects
+
+  Built-in function objects that are not identified as constructors do not
+  implement the [[Construct]] internal method unless otherwise specified in
+  the description of a particular function.
+
+  sec-evaluatenew
+
+  ...
+  7. If IsConstructor(constructor) is false, throw a TypeError exception.
+  ...
+includes: [isConstructor.js]
+features: [Reflect.construct, ArrayBuffer, arrow-function]
+---*/
+
+assert.sameValue(isConstructor(ArrayBuffer.isView), false, 'isConstructor(ArrayBuffer.isView) must return false');
+
+assert.throws(TypeError, () => {
+  new ArrayBuffer.isView();
+}, '`new ArrayBuffer.isView()` throws TypeError');
+
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/isView/prop-desc.js b/js/src/tests/test262/built-ins/ArrayBuffer/isView/prop-desc.js
new file mode 100644
index 0000000000..3eebf6ed54
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/isView/prop-desc.js
@@ -0,0 +1,19 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.isview
+description: >
+  "isView" property of ArrayBuffer
+info: |
+  ES6 section 17: Every other data property described in clauses 18 through 26
+  and in Annex B.2 has the attributes { [[Writable]]: true,
+  [[Enumerable]]: false, [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+verifyNotEnumerable(ArrayBuffer, "isView");
+verifyWritable(ArrayBuffer, "isView");
+verifyConfigurable(ArrayBuffer, "isView");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/isView/shell.js b/js/src/tests/test262/built-ins/ArrayBuffer/isView/shell.js
new file mode 100644
index 0000000000..05fecd6ef1
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/isView/shell.js
@@ -0,0 +1,161 @@
+// GENERATED, DO NOT EDIT
+// file: testTypedArray.js
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+description: |
+    Collection of functions used to assert the correctness of TypedArray objects.
+defines:
+  - floatArrayConstructors
+  - nonClampedIntArrayConstructors
+  - intArrayConstructors
+  - typedArrayConstructors
+  - TypedArray
+  - testWithTypedArrayConstructors
+  - nonAtomicsFriendlyTypedArrayConstructors
+  - testWithAtomicsFriendlyTypedArrayConstructors
+  - testWithNonAtomicsFriendlyTypedArrayConstructors
+  - testTypedArrayConversions
+---*/
+
+var floatArrayConstructors = [
+  Float64Array,
+  Float32Array
+];
+
+var nonClampedIntArrayConstructors = [
+  Int32Array,
+  Int16Array,
+  Int8Array,
+  Uint32Array,
+  Uint16Array,
+  Uint8Array
+];
+
+var intArrayConstructors = nonClampedIntArrayConstructors.concat([Uint8ClampedArray]);
+
+// Float16Array is a newer feature
+// adding it to this list unconditionally would cause implementations lacking it to fail every test which uses it
+if (typeof Float16Array !== 'undefined') {
+  floatArrayConstructors.push(Float16Array);
+}
+
+/**
+ * Array containing every non-bigint typed array constructor.
+ */
+
+var typedArrayConstructors = floatArrayConstructors.concat(intArrayConstructors);
+
+/**
+ * The %TypedArray% intrinsic constructor function.
+ */
+var TypedArray = Object.getPrototypeOf(Int8Array);
+
+/**
+ * Callback for testing a typed array constructor.
+ *
+ * @callback typedArrayConstructorCallback
+ * @param {Function} Constructor the constructor object to test with.
+ */
+
+/**
+ * Calls the provided function for every typed array constructor.
+ *
+ * @param {typedArrayConstructorCallback} f - the function to call for each typed array constructor.
+ * @param {Array} selected - An optional Array with filtered typed arrays
+ */
+function testWithTypedArrayConstructors(f, selected) {
+  var constructors = selected || typedArrayConstructors;
+  for (var i = 0; i < constructors.length; ++i) {
+    var constructor = constructors[i];
+    try {
+      f(constructor);
+    } catch (e) {
+      e.message += " (Testing with " + constructor.name + ".)";
+      throw e;
+    }
+  }
+}
+
+var nonAtomicsFriendlyTypedArrayConstructors = floatArrayConstructors.concat([Uint8ClampedArray]);
+/**
+ * Calls the provided function for every non-"Atomics Friendly" typed array constructor.
+ *
+ * @param {typedArrayConstructorCallback} f - the function to call for each typed array constructor.
+ * @param {Array} selected - An optional Array with filtered typed arrays
+ */
+function testWithNonAtomicsFriendlyTypedArrayConstructors(f) {
+  testWithTypedArrayConstructors(f, nonAtomicsFriendlyTypedArrayConstructors);
+}
+
+/**
+ * Calls the provided function for every "Atomics Friendly" typed array constructor.
+ *
+ * @param {typedArrayConstructorCallback} f - the function to call for each typed array constructor.
+ * @param {Array} selected - An optional Array with filtered typed arrays
+ */
+function testWithAtomicsFriendlyTypedArrayConstructors(f) {
+  testWithTypedArrayConstructors(f, [
+    Int32Array,
+    Int16Array,
+    Int8Array,
+    Uint32Array,
+    Uint16Array,
+    Uint8Array,
+  ]);
+}
+
+/**
+ * Helper for conversion operations on TypedArrays, the expected values
+ * properties are indexed in order to match the respective value for each
+ * TypedArray constructor
+ * @param  {Function} fn - the function to call for each constructor and value.
+ *                         will be called with the constructor, value, expected
+ *                         value, and a initial value that can be used to avoid
+ *                         a false positive with an equivalent expected value.
+ */
+function testTypedArrayConversions(byteConversionValues, fn) {
+  var values = byteConversionValues.values;
+  var expected = byteConversionValues.expected;
+
+  testWithTypedArrayConstructors(function(TA) {
+    var name = TA.name.slice(0, -5);
+
+    return values.forEach(function(value, index) {
+      var exp = expected[name][index];
+      var initial = 0;
+      if (exp === 0) {
+        initial = 1;
+      }
+      fn(TA, value, exp, initial);
+    });
+  });
+}
+
+/**
+ * Checks if the given argument is one of the float-based TypedArray constructors.
+ *
+ * @param {constructor} ctor - the value to check
+ * @returns {boolean}
+ */
+function isFloatTypedArrayConstructor(arg) {
+  return floatArrayConstructors.indexOf(arg) !== -1;
+}
+
+/**
+ * Determines the precision of the given float-based TypedArray constructor.
+ *
+ * @param {constructor} ctor - the value to check
+ * @returns {string} "half", "single", or "double" for Float16Array, Float32Array, and Float64Array respectively.
+ */
+function floatTypedArrayConstructorPrecision(FA) {
+  if (typeof Float16Array !== "undefined" && FA === Float16Array) {
+    return "half";
+  } else if (FA === Float32Array) {
+    return "single";
+  } else if (FA === Float64Array) {
+    return "double";
+  } else {
+    throw new Error("Malformed test - floatTypedArrayConstructorPrecision called with non-float TypedArray");
+  }
+}
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/length-is-absent.js b/js/src/tests/test262/built-ins/ArrayBuffer/length-is-absent.js
new file mode 100644
index 0000000000..e7774f79ba
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/length-is-absent.js
@@ -0,0 +1,20 @@
+// Copyright (C) 2016 The V8 Project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer-length
+description: >
+  Returns an empty instance if length is absent
+info: |
+  ArrayBuffer( length )
+
+  1. If NewTarget is undefined, throw a TypeError exception.
+  2. Let byteLength be ? ToIndex(length).
+  3. Return ? AllocateArrayBuffer(NewTarget, byteLength).
+---*/
+
+var buffer = new ArrayBuffer();
+
+assert.sameValue(buffer.byteLength, 0);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/length-is-too-large-throws.js b/js/src/tests/test262/built-ins/ArrayBuffer/length-is-too-large-throws.js
new file mode 100644
index 0000000000..8a18f0c134
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/length-is-too-large-throws.js
@@ -0,0 +1,33 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer-length
+description: >
+  Throws a RangeError if length >= 2 ** 53
+info: |
+  ArrayBuffer( length )
+
+  1. If NewTarget is undefined, throw a TypeError exception.
+  2. Let byteLength be ? ToIndex(length).
+
+  ToIndex( value )
+
+  1. If value is undefined, then
+    a. Let index be 0.
+  2. Else,
+    a. Let integerIndex be ? ToInteger(value).
+    b. If integerIndex < 0, throw a RangeError exception.
+  ...
+---*/
+
+assert.throws(RangeError, function() {
+  // Math.pow(2, 53) = 9007199254740992
+  new ArrayBuffer(9007199254740992);
+}, "`length` parameter is too large");
+
+assert.throws(RangeError, function() {
+  new ArrayBuffer(Infinity);
+}, "`length` parameter is positive Infinity");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/length.js b/js/src/tests/test262/built-ins/ArrayBuffer/length.js
new file mode 100644
index 0000000000..b1c3e096bb
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/length.js
@@ -0,0 +1,35 @@
+// Copyright (C) 2017 Rick Waldron. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer-constructor
+description: >
+  ArrayBuffer.length is 1.
+info: |
+  ArrayBuffer ( length )
+
+  ECMAScript Standard Built-in Objects:
+
+  Every built-in function object, including constructors, has a length
+  property whose value is an integer. Unless otherwise specified, this
+  value is equal to the largest number of named arguments shown in the
+  subclause headings for the function description. Optional parameters
+  (which are indicated with brackets: [ ]) or rest parameters (which
+  are shown using the form «...name») are not included in the default
+  argument count.
+
+  Unless otherwise specified, the length property of a built-in function
+  object has the attributes { [[Writable]]: false, [[Enumerable]]: false,
+  [[Configurable]]: true }.
+includes: [propertyHelper.js]
+features: [ArrayBuffer]
+---*/
+
+verifyProperty(ArrayBuffer, "length", {
+  value: 1,
+  enumerable: false,
+  writable: false,
+  configurable: true,
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/name.js b/js/src/tests/test262/built-ins/ArrayBuffer/name.js
new file mode 100644
index 0000000000..5fbc3c526b
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/name.js
@@ -0,0 +1,30 @@
+// Copyright (C) 2017 Rick Waldron. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer-constructor
+description: >
+  ArrayBuffer.name is "ArrayBuffer".
+info: |
+  17 ECMAScript Standard Built-in Objects:
+
+  Every built-in Function object, including constructors, that is not
+  identified as an anonymous function has a name property whose value is a
+  String.
+
+  Unless otherwise specified, the name property of a built-in Function object,
+  if it exists, has the attributes { [[Writable]]: false, [[Enumerable]]:
+  false, [[Configurable]]: true }.
+
+includes: [propertyHelper.js]
+---*/
+
+assert.sameValue(ArrayBuffer.name, "ArrayBuffer");
+
+verifyProperty(ArrayBuffer, "name", {
+  writable: false,
+  enumerable: false,
+  configurable: true,
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/negative-length-throws.js b/js/src/tests/test262/built-ins/ArrayBuffer/negative-length-throws.js
new file mode 100644
index 0000000000..4d999aabd7
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/negative-length-throws.js
@@ -0,0 +1,36 @@
+// Copyright (C) 2016 The V8 Project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer-length
+description: >
+  Throws a Range Error if length represents an integer < 0
+info: |
+  ArrayBuffer( length )
+
+  1. If NewTarget is undefined, throw a TypeError exception.
+  2. Let byteLength be ? ToIndex(length).
+
+  ToIndex( value )
+
+  1. If value is undefined, then
+    a. Let index be 0.
+  2. Else,
+    a. Let integerIndex be ? ToInteger(value).
+    b. If integerIndex < 0, throw a RangeError exception.
+  ...
+---*/
+
+assert.throws(RangeError, function() {
+  new ArrayBuffer(-1);
+});
+
+assert.throws(RangeError, function() {
+  new ArrayBuffer(-1.1);
+});
+
+assert.throws(RangeError, function() {
+  new ArrayBuffer(-Infinity);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/newtarget-prototype-is-not-object.js b/js/src/tests/test262/built-ins/ArrayBuffer/newtarget-prototype-is-not-object.js
new file mode 100644
index 0000000000..e637912801
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/newtarget-prototype-is-not-object.js
@@ -0,0 +1,50 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer-length
+description: >
+  [[Prototype]] defaults to %ArrayBufferPrototype% if NewTarget.prototype is not an object.
+info: |
+  ArrayBuffer( length )
+
+  ArrayBuffer called with argument length performs the following steps:
+
+  ...
+  6. Return AllocateArrayBuffer(NewTarget, byteLength).
+
+  AllocateArrayBuffer( constructor, byteLength )
+    1. Let obj be OrdinaryCreateFromConstructor(constructor, "%ArrayBufferPrototype%",
+       «[[ArrayBufferData]], [[ArrayBufferByteLength]]» ).
+    2. ReturnIfAbrupt(obj).
+    ...
+features: [Reflect.construct, Symbol]
+---*/
+
+function newTarget() {}
+
+newTarget.prototype = undefined;
+var arrayBuffer = Reflect.construct(ArrayBuffer, [1], newTarget);
+assert.sameValue(Object.getPrototypeOf(arrayBuffer), ArrayBuffer.prototype, "newTarget.prototype is undefined");
+
+newTarget.prototype = null;
+var arrayBuffer = Reflect.construct(ArrayBuffer, [2], newTarget);
+assert.sameValue(Object.getPrototypeOf(arrayBuffer), ArrayBuffer.prototype, "newTarget.prototype is null");
+
+newTarget.prototype = true;
+var arrayBuffer = Reflect.construct(ArrayBuffer, [3], newTarget);
+assert.sameValue(Object.getPrototypeOf(arrayBuffer), ArrayBuffer.prototype, "newTarget.prototype is a Boolean");
+
+newTarget.prototype = "";
+var arrayBuffer = Reflect.construct(ArrayBuffer, [4], newTarget);
+assert.sameValue(Object.getPrototypeOf(arrayBuffer), ArrayBuffer.prototype, "newTarget.prototype is a String");
+
+newTarget.prototype = Symbol();
+var arrayBuffer = Reflect.construct(ArrayBuffer, [5], newTarget);
+assert.sameValue(Object.getPrototypeOf(arrayBuffer), ArrayBuffer.prototype, "newTarget.prototype is a Symbol");
+
+newTarget.prototype = 1;
+var arrayBuffer = Reflect.construct(ArrayBuffer, [6], newTarget);
+assert.sameValue(Object.getPrototypeOf(arrayBuffer), ArrayBuffer.prototype, "newTarget.prototype is a Number");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/options-maxbytelength-diminuitive.js b/js/src/tests/test262/built-ins/ArrayBuffer/options-maxbytelength-diminuitive.js
new file mode 100644
index 0000000000..1ff9bba590
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/options-maxbytelength-diminuitive.js
@@ -0,0 +1,25 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer-constructor
+description: |
+  Invoked with an options object whose `maxByteLength` property is less than
+  the length.
+info: |
+  ArrayBuffer( length [ , options ] )
+
+  1. If NewTarget is undefined, throw a TypeError exception.
+  2. Let byteLength be ? ToIndex(length).
+  3. Let requestedMaxByteLength be ? GetArrayBufferMaxByteLengthOption(options).
+  4. If requestedMaxByteLength is empty, then
+     a. [...]
+  5. If byteLength > requestedMaxByteLength, throw a RangeError exception.
+features: [resizable-arraybuffer]
+---*/
+
+assert.throws(RangeError, function() {
+  new ArrayBuffer(1, {maxByteLength: 0});
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/options-maxbytelength-excessive.js b/js/src/tests/test262/built-ins/ArrayBuffer/options-maxbytelength-excessive.js
new file mode 100644
index 0000000000..36ffab90d3
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/options-maxbytelength-excessive.js
@@ -0,0 +1,31 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer-constructor
+description: |
+  Invoked with an options object whose `maxByteLength` property exceeds the
+  maximum length value
+info: |
+  ArrayBuffer( length [ , options ] )
+
+  1. If NewTarget is undefined, throw a TypeError exception.
+  2. Let byteLength be ? ToIndex(length).
+  3. Let requestedMaxByteLength be ? GetArrayBufferMaxByteLengthOption(options).
+  [...]
+
+  1.1.5 GetArrayBufferMaxByteLengthOption ( options )
+
+  1. If Type(options) is not Object, return empty.
+  2. Let maxByteLength be ? Get(options, "maxByteLength").
+  3. If maxByteLength is undefined, return empty.
+  4. Return ? ToIndex(maxByteLength).
+features: [resizable-arraybuffer]
+---*/
+
+assert.throws(RangeError, function() {
+  // Math.pow(2, 53) = 9007199254740992
+  new ArrayBuffer(0, { maxByteLength: 9007199254740992 });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/options-maxbytelength-negative.js b/js/src/tests/test262/built-ins/ArrayBuffer/options-maxbytelength-negative.js
new file mode 100644
index 0000000000..298c808b1b
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/options-maxbytelength-negative.js
@@ -0,0 +1,28 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer-constructor
+description: Invoked with an options object whose `maxByteLength` property is negative
+info: |
+  ArrayBuffer( length [ , options ] )
+
+  1. If NewTarget is undefined, throw a TypeError exception.
+  2. Let byteLength be ? ToIndex(length).
+  3. Let requestedMaxByteLength be ? GetArrayBufferMaxByteLengthOption(options).
+  [...]
+
+  1.1.5 GetArrayBufferMaxByteLengthOption ( options )
+
+  1. If Type(options) is not Object, return empty.
+  2. Let maxByteLength be ? Get(options, "maxByteLength").
+  3. If maxByteLength is undefined, return empty.
+  4. Return ? ToIndex(maxByteLength).
+features: [resizable-arraybuffer]
+---*/
+
+assert.throws(RangeError, function() {
+  new ArrayBuffer(0, { maxByteLength: -1 });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/options-maxbytelength-object.js b/js/src/tests/test262/built-ins/ArrayBuffer/options-maxbytelength-object.js
new file mode 100644
index 0000000000..94977dbcf1
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/options-maxbytelength-object.js
@@ -0,0 +1,48 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer-constructor
+description: |
+  Invoked with an options object whose `maxByteLength` property cannot be
+  coerced to a primitive value
+info: |
+  ArrayBuffer( length [ , options ] )
+
+  1. If NewTarget is undefined, throw a TypeError exception.
+  2. Let byteLength be ? ToIndex(length).
+  3. Let requestedMaxByteLength be ? GetArrayBufferMaxByteLengthOption(options).
+  [...]
+
+  1.1.5 GetArrayBufferMaxByteLengthOption ( options )
+
+  1. If Type(options) is not Object, return empty.
+  2. Let maxByteLength be ? Get(options, "maxByteLength").
+  3. If maxByteLength is undefined, return empty.
+  4. Return ? ToIndex(maxByteLength).
+features: [resizable-arraybuffer]
+---*/
+
+var log = [];
+var options = {
+  maxByteLength: {
+    toString: function() {
+      log.push('toString');
+      return {};
+    },
+    valueOf: function() {
+      log.push('valueOf');
+      return {};
+    }
+  }
+};
+
+assert.throws(TypeError, function() {
+  new ArrayBuffer(0, options);
+});
+
+assert.sameValue(log.length, 2);
+assert.sameValue(log[0], 'valueOf');
+assert.sameValue(log[1], 'toString');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/options-maxbytelength-poisoned.js b/js/src/tests/test262/built-ins/ArrayBuffer/options-maxbytelength-poisoned.js
new file mode 100644
index 0000000000..3d92742b1d
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/options-maxbytelength-poisoned.js
@@ -0,0 +1,32 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer-constructor
+description: Invoked with an options object whose `maxByteLength` property throws
+info: |
+  ArrayBuffer( length [ , options ] )
+
+  1. If NewTarget is undefined, throw a TypeError exception.
+  2. Let byteLength be ? ToIndex(length).
+  3. Let requestedMaxByteLength be ? GetArrayBufferMaxByteLengthOption(options).
+  [...]
+
+  1.1.5 GetArrayBufferMaxByteLengthOption ( options )
+
+  1. If Type(options) is not Object, return empty.
+  2. Let maxByteLength be ? Get(options, "maxByteLength").
+features: [resizable-arraybuffer]
+---*/
+
+var options = {
+  get maxByteLength() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  new ArrayBuffer(0, options);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/options-maxbytelength-undefined.js b/js/src/tests/test262/built-ins/ArrayBuffer/options-maxbytelength-undefined.js
new file mode 100644
index 0000000000..d11c8d52f1
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/options-maxbytelength-undefined.js
@@ -0,0 +1,27 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer-constructor
+description: Invoked with an options object whose `maxByteLength` property is undefined
+info: |
+  ArrayBuffer( length [ , options ] )
+
+  1. If NewTarget is undefined, throw a TypeError exception.
+  2. Let byteLength be ? ToIndex(length).
+  3. Let requestedMaxByteLength be ? GetArrayBufferMaxByteLengthOption(options).
+  4. If requestedMaxByteLength is empty, then
+     a. Return ? AllocateArrayBuffer(NewTarget, byteLength).
+
+  1.1.5 GetArrayBufferMaxByteLengthOption ( options )
+
+  1. If Type(options) is not Object, return empty.
+  2. Let maxByteLength be ? Get(options, "maxByteLength").
+  3. If maxByteLength is undefined, return empty.
+features: [resizable-arraybuffer]
+---*/
+
+assert.sameValue(new ArrayBuffer(0, {}).resizable, false);
+assert.sameValue(new ArrayBuffer(0, {maxByteLength: undefined}).resizable, false);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/options-non-object.js b/js/src/tests/test262/built-ins/ArrayBuffer/options-non-object.js
new file mode 100644
index 0000000000..03fb8616c3
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/options-non-object.js
@@ -0,0 +1,30 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer-constructor
+description: Invoked with a non-object value for options
+info: |
+  ArrayBuffer( length [ , options ] )
+
+  1. If NewTarget is undefined, throw a TypeError exception.
+  2. Let byteLength be ? ToIndex(length).
+  3. Let requestedMaxByteLength be ? GetArrayBufferMaxByteLengthOption(options).
+  4. If requestedMaxByteLength is empty, then
+     a. Return ? AllocateArrayBuffer(NewTarget, byteLength).
+
+  1.1.5 GetArrayBufferMaxByteLengthOption ( options )
+
+  1. If Type(options) is not Object, return empty.
+features: [resizable-arraybuffer]
+---*/
+
+assert.sameValue(new ArrayBuffer(0, null).resizable, false, 'null');
+assert.sameValue(new ArrayBuffer(0, true).resizable, false, 'boolean');
+assert.sameValue(new ArrayBuffer(0, Symbol(3)).resizable, false, 'symbol');
+assert.sameValue(new ArrayBuffer(0, 1n).resizable, false, 'bigint');
+assert.sameValue(new ArrayBuffer(0, 'string').resizable, false, 'string');
+assert.sameValue(new ArrayBuffer(0, 9).resizable, false, 'number');
+assert.sameValue(new ArrayBuffer(0, undefined).resizable, false, 'undefined');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prop-desc.js b/js/src/tests/test262/built-ins/ArrayBuffer/prop-desc.js
new file mode 100644
index 0000000000..ece781f43c
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prop-desc.js
@@ -0,0 +1,25 @@
+// Copyright (C) 2017 Rick Waldron. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer-constructor
+description: >
+  Property descriptor of ArrayBuffer
+info: |
+  17 ECMAScript Standard Built-in Objects:
+
+  Every other data property described in clauses 18 through 26 and in Annex B.2
+  has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+  [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+assert.sameValue(typeof ArrayBuffer, "function", "`typeof ArrayBuffer` is `'function'`");
+
+verifyProperty(this, "ArrayBuffer", {
+  writable: true,
+  enumerable: false,
+  configurable: true,
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/proto-from-ctor-realm.js b/js/src/tests/test262/built-ins/ArrayBuffer/proto-from-ctor-realm.js
new file mode 100644
index 0000000000..b92106f16e
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/proto-from-ctor-realm.js
@@ -0,0 +1,29 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer-length
+description: Default [[Prototype]] value derived from realm of the newTarget
+info: |
+    [...]
+    5. Return ? AllocateArrayBuffer(NewTarget, byteLength).
+
+    9.1.14 GetPrototypeFromConstructor
+
+    [...]
+    3. Let proto be ? Get(constructor, "prototype").
+    4. If Type(proto) is not Object, then
+       a. Let realm be ? GetFunctionRealm(constructor).
+       b. Let proto be realm's intrinsic object named intrinsicDefaultProto.
+    [...]
+features: [cross-realm, Reflect]
+---*/
+
+var other = $262.createRealm().global;
+var C = new other.Function();
+C.prototype = null;
+
+var o = Reflect.construct(ArrayBuffer, [], C);
+
+assert.sameValue(Object.getPrototypeOf(o), other.ArrayBuffer.prototype);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype-from-newtarget.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype-from-newtarget.js
new file mode 100644
index 0000000000..aa355473e1
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype-from-newtarget.js
@@ -0,0 +1,36 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer-length
+description: >
+  The [[Prototype]] internal slot is computed from NewTarget.
+info: |
+  ArrayBuffer( length )
+
+  ArrayBuffer called with argument length performs the following steps:
+
+  ...
+  6. Return AllocateArrayBuffer(NewTarget, byteLength).
+
+  AllocateArrayBuffer( constructor, byteLength )
+    1. Let obj be OrdinaryCreateFromConstructor(constructor, "%ArrayBufferPrototype%",
+       «[[ArrayBufferData]], [[ArrayBufferByteLength]]» ).
+    2. ReturnIfAbrupt(obj).
+    ...
+features: [Reflect.construct]
+---*/
+
+var arrayBuffer = Reflect.construct(ArrayBuffer, [8], Object);
+assert.sameValue(Object.getPrototypeOf(arrayBuffer), Object.prototype, "NewTarget is built-in Object constructor");
+
+var newTarget = function() {}.bind(null);
+Object.defineProperty(newTarget, "prototype", {
+  get: function() {
+    return Array.prototype;
+  }
+});
+var arrayBuffer = Reflect.construct(ArrayBuffer, [16], newTarget);
+assert.sameValue(Object.getPrototypeOf(arrayBuffer), Array.prototype, "NewTarget is BoundFunction with accessor");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/Symbol.toStringTag.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/Symbol.toStringTag.js
new file mode 100644
index 0000000000..ccd1dffcd4
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/Symbol.toStringTag.js
@@ -0,0 +1,23 @@
+// Copyright (C) 2015 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype-@@tostringtag
+description: >
+    `Symbol.toStringTag` property descriptor
+info: |
+    The initial value of the @@toStringTag property is the String value
+    "ArrayBuffer".
+
+    This property has the attributes { [[Writable]]: false, [[Enumerable]]:
+    false, [[Configurable]]: true }.
+includes: [propertyHelper.js]
+features: [Symbol.toStringTag]
+---*/
+
+assert.sameValue(ArrayBuffer.prototype[Symbol.toStringTag], 'ArrayBuffer');
+
+verifyNotEnumerable(ArrayBuffer.prototype, Symbol.toStringTag);
+verifyNotWritable(ArrayBuffer.prototype, Symbol.toStringTag);
+verifyConfigurable(ArrayBuffer.prototype, Symbol.toStringTag);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/browser.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/browser.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/browser.js
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/browser.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/browser.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/browser.js
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/detached-buffer.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/detached-buffer.js
new file mode 100644
index 0000000000..76d827aa5e
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/detached-buffer.js
@@ -0,0 +1,21 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.bytelength
+description: Returns 0 if the buffer is detached
+info: |
+  get ArrayBuffer.prototype.byteLength
+  ...
+  If IsDetachedBuffer(buffer) is true, return 0.
+  ...
+includes: [detachArrayBuffer.js]
+features: [align-detached-buffer-semantics-with-web-reality]
+---*/
+
+var ab = new ArrayBuffer(1);
+
+$DETACHBUFFER(ab);
+
+assert.sameValue(ab.byteLength, 0, 'The value of ab.byteLength is 0');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/invoked-as-accessor.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/invoked-as-accessor.js
new file mode 100644
index 0000000000..cb3a3093c2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/invoked-as-accessor.js
@@ -0,0 +1,20 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.bytelength
+description: Requires this value to have a [[ArrayBufferData]] internal slot
+info: |
+  24.1.4.1 get ArrayBuffer.prototype.byteLength
+
+  1. Let O be the this value.
+  2. If Type(O) is not Object, throw a TypeError exception.
+  3. If O does not have an [[ArrayBufferData]] internal slot, throw a TypeError
+  exception.
+  ...
+---*/
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.byteLength;
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/invoked-as-func.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/invoked-as-func.js
new file mode 100644
index 0000000000..e648dafa8a
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/invoked-as-func.js
@@ -0,0 +1,24 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.bytelength
+description: Throws a TypeError exception when invoked as a function
+info: |
+  24.1.4.1 get ArrayBuffer.prototype.byteLength
+
+  1. Let O be the this value.
+  2. If Type(O) is not Object, throw a TypeError exception.
+  3. If O does not have an [[ArrayBufferData]] internal slot, throw a TypeError
+  exception.
+  ...
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  ArrayBuffer.prototype, "byteLength"
+).get;
+
+assert.throws(TypeError, function() {
+  getter();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/length.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/length.js
new file mode 100644
index 0000000000..1fb8a5b7b1
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/length.js
@@ -0,0 +1,33 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-get-arraybuffer.prototype.bytelength
+description: >
+  get ArrayBuffer.prototype.byteLength.length is 0.
+info: |
+  get ArrayBuffer.prototype.byteLength
+
+  17 ECMAScript Standard Built-in Objects:
+    Every built-in Function object, including constructors, has a length
+    property whose value is an integer. Unless otherwise specified, this
+    value is equal to the largest number of named arguments shown in the
+    subclause headings for the function description, including optional
+    parameters. However, rest parameters shown using the form “...name”
+    are not included in the default argument count.
+
+    Unless otherwise specified, the length property of a built-in Function
+    object has the attributes { [[Writable]]: false, [[Enumerable]]: false,
+    [[Configurable]]: true }.
+includes: [propertyHelper.js]
+---*/
+
+var desc = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, "byteLength");
+
+assert.sameValue(desc.get.length, 0);
+
+verifyNotEnumerable(desc.get, "length");
+verifyNotWritable(desc.get, "length");
+verifyConfigurable(desc.get, "length");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/name.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/name.js
new file mode 100644
index 0000000000..adac94a271
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/name.js
@@ -0,0 +1,29 @@
+// Copyright (C) 2015 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.bytelength
+description: >
+  get ArrayBuffer.prototype.byteLength
+
+  17 ECMAScript Standard Built-in Objects
+
+  Functions that are specified as get or set accessor functions of built-in
+  properties have "get " or "set " prepended to the property name string.
+
+includes: [propertyHelper.js]
+---*/
+
+var descriptor = Object.getOwnPropertyDescriptor(
+  ArrayBuffer.prototype, 'byteLength'
+);
+
+assert.sameValue(
+  descriptor.get.name, 'get byteLength',
+  'The value of `descriptor.get.name` is `"get byteLength"`'
+);
+
+verifyNotEnumerable(descriptor.get, 'name');
+verifyNotWritable(descriptor.get, 'name');
+verifyConfigurable(descriptor.get, 'name');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/prop-desc.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/prop-desc.js
new file mode 100644
index 0000000000..488f9b3744
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/prop-desc.js
@@ -0,0 +1,24 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.bytelength
+description: >
+  "byteLength" property of ArrayBuffer.prototype
+info: |
+  ArrayBuffer.prototype.byteLength is an accessor property whose set accessor
+  function is undefined.
+
+  Section 17: Every accessor property described in clauses 18 through 26 and in
+  Annex B.2 has the attributes {[[Enumerable]]: false, [[Configurable]]: true }
+includes: [propertyHelper.js]
+---*/
+
+var desc = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, "byteLength");
+
+assert.sameValue(desc.set, undefined);
+assert.sameValue(typeof desc.get, "function");
+
+verifyNotEnumerable(ArrayBuffer.prototype, "byteLength");
+verifyConfigurable(ArrayBuffer.prototype, "byteLength");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/return-bytelength.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/return-bytelength.js
new file mode 100644
index 0000000000..96d5a9f3a0
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/return-bytelength.js
@@ -0,0 +1,20 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.bytelength
+description: Return value from [[ByteLength]] internal slot
+info: |
+  24.1.4.1 get ArrayBuffer.prototype.byteLength
+
+  ...
+  5. Let length be the value of O's [[ArrayBufferByteLength]] internal slot.
+  6. Return length.
+---*/
+
+var ab1 = new ArrayBuffer(0);
+assert.sameValue(ab1.byteLength, 0);
+
+var ab2 = new ArrayBuffer(42);
+assert.sameValue(ab2.byteLength, 42);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/shell.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/shell.js
new file mode 100644
index 0000000000..06f65290b8
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/shell.js
@@ -0,0 +1,18 @@
+// GENERATED, DO NOT EDIT
+// file: detachArrayBuffer.js
+// Copyright (C) 2016 the V8 project authors.  All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+description: |
+    A function used in the process of asserting correctness of TypedArray objects.
+
+    $262.detachArrayBuffer is defined by a host.
+defines: [$DETACHBUFFER]
+---*/
+
+function $DETACHBUFFER(buffer) {
+  if (!$262 || typeof $262.detachArrayBuffer !== "function") {
+    throw new Test262Error("No method available to detach an ArrayBuffer");
+  }
+  $262.detachArrayBuffer(buffer);
+}
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/this-has-no-typedarrayname-internal.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/this-has-no-typedarrayname-internal.js
new file mode 100644
index 0000000000..ed4a587af4
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/this-has-no-typedarrayname-internal.js
@@ -0,0 +1,41 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.bytelength
+description: >
+  Throws a TypeError exception when `this` does not have a [[ArrayBufferData]]
+  internal slot
+info: |
+  24.1.4.1 get ArrayBuffer.prototype.byteLength
+
+  1. Let O be the this value.
+  2. If Type(O) is not Object, throw a TypeError exception.
+  3. If O does not have an [[ArrayBufferData]] internal slot, throw a TypeError
+  exception.
+  ...
+features: [DataView, Int8Array]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  ArrayBuffer.prototype, "byteLength"
+).get;
+
+assert.throws(TypeError, function() {
+  getter.call({});
+});
+
+assert.throws(TypeError, function() {
+  getter.call([]);
+});
+
+var ta = new Int8Array(8);
+assert.throws(TypeError, function() {
+  getter.call(ta);
+});
+
+var dv = new DataView(new ArrayBuffer(8), 0);
+assert.throws(TypeError, function() {
+  getter.call(dv);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/this-is-not-object.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/this-is-not-object.js
new file mode 100644
index 0000000000..32bd46d07a
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/this-is-not-object.js
@@ -0,0 +1,48 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.bytelength
+description: Throws a TypeError exception when `this` is not Object
+info: |
+  24.1.4.1 get ArrayBuffer.prototype.byteLength
+
+  1. Let O be the this value.
+  2. If Type(O) is not Object, throw a TypeError exception.
+  ...
+features: [Symbol]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  ArrayBuffer.prototype, "byteLength"
+).get;
+
+assert.throws(TypeError, function() {
+  getter.call(undefined);
+}, "this is undefined");
+
+assert.throws(TypeError, function() {
+  getter.call(null);
+}, "this is null");
+
+assert.throws(TypeError, function() {
+  getter.call(42);
+}, "this is 42");
+
+assert.throws(TypeError, function() {
+  getter.call("1");
+}, "this is a string");
+
+assert.throws(TypeError, function() {
+  getter.call(true);
+}, "this is true");
+
+assert.throws(TypeError, function() {
+  getter.call(false);
+}, "this is false");
+
+var s = Symbol("s");
+assert.throws(TypeError, function() {
+  getter.call(s);
+}, "this is a Symbol");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/this-is-sharedarraybuffer.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/this-is-sharedarraybuffer.js
new file mode 100644
index 0000000000..3b91df8526
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/this-is-sharedarraybuffer.js
@@ -0,0 +1,27 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-get-arraybuffer.prototype.bytelength
+description: Throws a TypeError exception when `this` is a SharedArrayBuffer
+features: [align-detached-buffer-semantics-with-web-reality, SharedArrayBuffer]
+---*/
+
+var byteLength = Object.getOwnPropertyDescriptor(
+  ArrayBuffer.prototype, "byteLength"
+);
+
+var getter = byteLength.get;
+var sab = new SharedArrayBuffer(4);
+
+assert.throws(TypeError, function() {
+  getter.call(sab);
+}, "`this` cannot be a SharedArrayBuffer");
+
+assert.throws(TypeError, function() {
+  Object.defineProperties(sab, { byteLength });
+  sab.byteLength;
+}, "`this` cannot be a SharedArrayBuffer");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/constructor.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/constructor.js
new file mode 100644
index 0000000000..30d684e3c3
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/constructor.js
@@ -0,0 +1,25 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.constructor
+description: >
+  The `ArrayBuffer.prototype.constructor` property descriptor.
+info: |
+  The initial value of ArrayBuffer.prototype.constructor is the intrinsic
+  object %ArrayBuffer%.
+
+  17 ECMAScript Standard Built-in Objects:
+    Every other data property described in clauses 18 through 26 and in
+    Annex B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+assert.sameValue(ArrayBuffer.prototype.constructor, ArrayBuffer);
+
+verifyNotEnumerable(ArrayBuffer.prototype, "constructor");
+verifyWritable(ArrayBuffer.prototype, "constructor");
+verifyConfigurable(ArrayBuffer.prototype, "constructor");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/browser.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/browser.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/browser.js
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/detached-buffer-resizable.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/detached-buffer-resizable.js
new file mode 100644
index 0000000000..9be66d8e1b
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/detached-buffer-resizable.js
@@ -0,0 +1,39 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2023 Jordan Harband. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.detached
+description: Return a boolean indicating if the ArrayBuffer is detached
+info: |
+  get ArrayBuffer.prototype.detached
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. Return IsDetachedBuffer(O).
+includes: [detachArrayBuffer.js]
+features: [ArrayBuffer, arraybuffer-transfer, resizable-arraybuffer]
+---*/
+
+var ab1 = new ArrayBuffer(0, { maxByteLength: 0 });
+assert.sameValue(ab1.detached, false, 'Resizable ArrayBuffer with maxByteLength of 0 is not detached');
+
+$DETACHBUFFER(ab1);
+
+assert.sameValue(ab1.detached, true, 'Resizable ArrayBuffer with maxByteLength of 0 is now detached');
+
+var ab2 = new ArrayBuffer(0, { maxByteLength: 23 });
+assert.sameValue(ab2.detached, false, 'Resizable ArrayBuffer with maxByteLength of 23 is not detached');
+
+$DETACHBUFFER(ab2);
+
+assert.sameValue(ab2.detached, true, 'Resizable ArrayBuffer with maxByteLength of 23 is now detached');
+
+var ab3 = new ArrayBuffer(42, { maxByteLength: 42 });
+assert.sameValue(ab3.detached, false, 'Resizable ArrayBuffer with maxByteLength of 42 is not detached');
+
+$DETACHBUFFER(ab3);
+
+assert.sameValue(ab3.detached, true, 'Resizable ArrayBuffer with maxByteLength of 42 is now detached');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/detached-buffer.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/detached-buffer.js
new file mode 100644
index 0000000000..33327abfff
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/detached-buffer.js
@@ -0,0 +1,26 @@
+// Copyright (C) 2023 Jordan Harband. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.detached
+description: Returns true if the buffer is detached, else false
+info: |
+  get ArrayBuffer.prototype.detached
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. Return IsDetachedBuffer(O).
+
+includes: [detachArrayBuffer.js]
+features: [ArrayBuffer, arraybuffer-transfer]
+---*/
+
+var ab = new ArrayBuffer(1);
+
+assert.sameValue(ab.detached, false);
+
+$DETACHBUFFER(ab);
+
+assert.sameValue(ab.detached, true);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/invoked-as-accessor.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/invoked-as-accessor.js
new file mode 100644
index 0000000000..d38a9567c4
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/invoked-as-accessor.js
@@ -0,0 +1,21 @@
+// Copyright (C) 2023 Jordan Harband. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.detached
+description: Returns true if the buffer is detached, else false
+info: |
+  get ArrayBuffer.prototype.detached
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. Return IsDetachedBuffer(O).
+
+features: [ArrayBuffer, arraybuffer-transfer]
+---*/
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.detached;
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/invoked-as-func.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/invoked-as-func.js
new file mode 100644
index 0000000000..d4f400063f
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/invoked-as-func.js
@@ -0,0 +1,26 @@
+// Copyright (C) 2023 Jordan Harband. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.detached
+description: Returns true if the buffer is detached, else false
+info: |
+  get ArrayBuffer.prototype.detached
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+
+features: [ArrayBuffer, arraybuffer-transfer]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  ArrayBuffer.prototype, 'detached'
+).get;
+
+assert.sameValue(typeof getter, 'function');
+
+assert.throws(TypeError, function() {
+  getter();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/length.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/length.js
new file mode 100644
index 0000000000..f089a04de0
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/length.js
@@ -0,0 +1,35 @@
+// Copyright (C) 2023 Jordan Harband. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.detached
+description: >
+  get ArrayBuffer.prototype.detached.length is 0.
+info: |
+  get ArrayBuffer.prototype.detached
+
+  17 ECMAScript Standard Built-in Objects:
+    Every built-in Function object, including constructors, has a length
+    property whose value is an integer. Unless otherwise specified, this
+    value is equal to the largest number of named arguments shown in the
+    subclause headings for the function description, including optional
+    parameters. However, rest parameters shown using the form “...name”
+    are not included in the default argument count.
+
+    Unless otherwise specified, the length property of a built-in Function
+    object has the attributes { [[Writable]]: false, [[Enumerable]]: false,
+    [[Configurable]]: true }.
+
+includes: [propertyHelper.js]
+features: [ArrayBuffer, arraybuffer-transfer]
+---*/
+
+var desc = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, 'detached');
+
+verifyProperty(desc.get, 'length', {
+  value: 0,
+  enumerable: false,
+  writable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/name.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/name.js
new file mode 100644
index 0000000000..c2d603b724
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/name.js
@@ -0,0 +1,26 @@
+// Copyright (C) 2023 Jordan Harband. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.detached
+description: >
+  get ArrayBuffer.prototype.detached
+
+  17 ECMAScript Standard Built-in Objects
+
+  Functions that are specified as get or set accessor functions of built-in
+  properties have "get " or "set " prepended to the property name string.
+
+includes: [propertyHelper.js]
+features: [ArrayBuffer, arraybuffer-transfer]
+---*/
+
+var desc = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, 'detached');
+
+verifyProperty(desc.get, 'name', {
+  value: 'get detached',
+  enumerable: false,
+  writable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/prop-desc.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/prop-desc.js
new file mode 100644
index 0000000000..5753330672
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/prop-desc.js
@@ -0,0 +1,27 @@
+// Copyright (C) 2023 Jordan Harband. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.detached
+description: >
+  "detached" property of ArrayBuffer.prototype
+info: |
+  ArrayBuffer.prototype.detached is an accessor property whose set
+  accessor function is undefined.
+
+  Section 17: Every accessor property described in clauses 18 through 26 and in
+  Annex B.2 has the attributes {[[Enumerable]]: false, [[Configurable]]: true }
+includes: [propertyHelper.js]
+features: [ArrayBuffer, arraybuffer-transfer]
+---*/
+
+var desc = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, 'detached');
+
+assert.sameValue(desc.set, undefined);
+assert.sameValue(typeof desc.get, 'function');
+
+verifyProperty(ArrayBuffer.prototype, 'detached', {
+  enumerable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/shell.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/shell.js
new file mode 100644
index 0000000000..06f65290b8
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/shell.js
@@ -0,0 +1,18 @@
+// GENERATED, DO NOT EDIT
+// file: detachArrayBuffer.js
+// Copyright (C) 2016 the V8 project authors.  All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+description: |
+    A function used in the process of asserting correctness of TypedArray objects.
+
+    $262.detachArrayBuffer is defined by a host.
+defines: [$DETACHBUFFER]
+---*/
+
+function $DETACHBUFFER(buffer) {
+  if (!$262 || typeof $262.detachArrayBuffer !== "function") {
+    throw new Test262Error("No method available to detach an ArrayBuffer");
+  }
+  $262.detachArrayBuffer(buffer);
+}
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/this-has-no-arraybufferdata-internal.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/this-has-no-arraybufferdata-internal.js
new file mode 100644
index 0000000000..5ffc78577e
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/this-has-no-arraybufferdata-internal.js
@@ -0,0 +1,41 @@
+// Copyright (C) 2023 Jordan Harband. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.detached
+description: >
+  Throws a TypeError exception when `this` does not have a [[ArrayBufferData]]
+  internal slot
+info: |
+  get ArrayBuffer.prototype.detached
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [DataView, Int8Array, ArrayBuffer, arraybuffer-transfer]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  ArrayBuffer.prototype, "detached"
+).get;
+
+assert.sameValue(typeof getter, "function");
+
+assert.throws(TypeError, function() {
+  getter.call({});
+});
+
+assert.throws(TypeError, function() {
+  getter.call([]);
+});
+
+var ta = new Int8Array(8);
+assert.throws(TypeError, function() {
+  getter.call(ta);
+});
+
+var dv = new DataView(new ArrayBuffer(8), 0);
+assert.throws(TypeError, function() {
+  getter.call(dv);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/this-is-not-object.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/this-is-not-object.js
new file mode 100644
index 0000000000..f8da6131a0
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/this-is-not-object.js
@@ -0,0 +1,50 @@
+// Copyright (C) 2023 Jordan Harband. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.detached
+description: Throws a TypeError exception when `this` is not Object
+info: |
+  get ArrayBuffer.prototype.detached
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [Symbol, ArrayBuffer, arraybuffer-transfer]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  ArrayBuffer.prototype, "detached"
+).get;
+
+assert.sameValue(typeof getter, "function");
+
+assert.throws(TypeError, function() {
+  getter.call(undefined);
+}, "this is undefined");
+
+assert.throws(TypeError, function() {
+  getter.call(null);
+}, "this is null");
+
+assert.throws(TypeError, function() {
+  getter.call(42);
+}, "this is 42");
+
+assert.throws(TypeError, function() {
+  getter.call("1");
+}, "this is a string");
+
+assert.throws(TypeError, function() {
+  getter.call(true);
+}, "this is true");
+
+assert.throws(TypeError, function() {
+  getter.call(false);
+}, "this is false");
+
+var s = Symbol("s");
+assert.throws(TypeError, function() {
+  getter.call(s);
+}, "this is a Symbol");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/this-is-sharedarraybuffer-resizable.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/this-is-sharedarraybuffer-resizable.js
new file mode 100644
index 0000000000..fbe03fbc31
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/this-is-sharedarraybuffer-resizable.js
@@ -0,0 +1,30 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2023 Jordan Harband. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.detached
+description: Throws a TypeError exception when `this` is a resizable SharedArrayBuffer
+info: |
+  get ArrayBuffer.prototype.detached
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  [...]
+features: [SharedArrayBuffer, ArrayBuffer, arraybuffer-transfer]
+---*/
+
+var detached = Object.getOwnPropertyDescriptor(
+  ArrayBuffer.prototype, "detached"
+);
+
+var getter = detached.get;
+var sab = new SharedArrayBuffer(4);
+
+assert.sameValue(typeof getter, "function");
+
+assert.throws(TypeError, function() {
+  getter.call(sab);
+}, "`this` cannot be a SharedArrayBuffer");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/this-is-sharedarraybuffer.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/this-is-sharedarraybuffer.js
new file mode 100644
index 0000000000..c49c69dc33
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/detached/this-is-sharedarraybuffer.js
@@ -0,0 +1,30 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2023 Jordan Harband. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.detached
+description: Throws a TypeError exception when `this` is a SharedArrayBuffer
+info: |
+  get ArrayBuffer.prototype.detached
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  [...]
+features: [SharedArrayBuffer, ArrayBuffer, arraybuffer-transfer]
+---*/
+
+var detached = Object.getOwnPropertyDescriptor(
+  ArrayBuffer.prototype, "detached"
+);
+
+var getter = detached.get;
+var sab = new SharedArrayBuffer(4);
+
+assert.sameValue(typeof getter, "function");
+
+assert.throws(TypeError, function() {
+  getter.call(sab);
+}, "`this` cannot be a SharedArrayBuffer");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/browser.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/browser.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/browser.js
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/detached-buffer.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/detached-buffer.js
new file mode 100644
index 0000000000..7ea1001180
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/detached-buffer.js
@@ -0,0 +1,25 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.maxbytelength
+description: Returns 0 if the buffer is detached
+info: |
+  get ArrayBuffer.prototype.maxByteLength
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, return +0𝔽.
+  [...]
+includes: [detachArrayBuffer.js]
+features: [resizable-arraybuffer]
+---*/
+
+var ab = new ArrayBuffer(1);
+
+$DETACHBUFFER(ab);
+
+assert.sameValue(ab.maxByteLength, 0);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/invoked-as-accessor.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/invoked-as-accessor.js
new file mode 100644
index 0000000000..2908002700
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/invoked-as-accessor.js
@@ -0,0 +1,20 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.maxbytelength
+description: Requires this value to have a [[ArrayBufferData]] internal slot
+info: |
+  get ArrayBuffer.prototype.maxByteLength
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [resizable-arraybuffer]
+---*/
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.maxByteLength;
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/invoked-as-func.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/invoked-as-func.js
new file mode 100644
index 0000000000..08856d924d
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/invoked-as-func.js
@@ -0,0 +1,26 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.maxbytelength
+description: Throws a TypeError exception when invoked as a function
+info: |
+  get ArrayBuffer.prototype.maxByteLength
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [resizable-arraybuffer]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  ArrayBuffer.prototype, 'maxByteLength'
+).get;
+
+assert.sameValue(typeof getter, 'function');
+
+assert.throws(TypeError, function() {
+  getter();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/length.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/length.js
new file mode 100644
index 0000000000..64cd11ee97
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/length.js
@@ -0,0 +1,35 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.maxbytelength
+description: >
+  get ArrayBuffer.prototype.maxByteLength.length is 0.
+info: |
+  get ArrayBuffer.prototype.maxByteLength
+
+  17 ECMAScript Standard Built-in Objects:
+    Every built-in Function object, including constructors, has a length
+    property whose value is an integer. Unless otherwise specified, this
+    value is equal to the largest number of named arguments shown in the
+    subclause headings for the function description, including optional
+    parameters. However, rest parameters shown using the form “...name”
+    are not included in the default argument count.
+
+    Unless otherwise specified, the length property of a built-in Function
+    object has the attributes { [[Writable]]: false, [[Enumerable]]: false,
+    [[Configurable]]: true }.
+includes: [propertyHelper.js]
+features: [resizable-arraybuffer]
+---*/
+
+var desc = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, 'maxByteLength');
+
+verifyProperty(desc.get, 'length', {
+  value: 0,
+  enumerable: false,
+  writable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/name.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/name.js
new file mode 100644
index 0000000000..3c0d43cbe0
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/name.js
@@ -0,0 +1,27 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.maxbytelength
+description: >
+  get ArrayBuffer.prototype.maxByteLength
+
+  17 ECMAScript Standard Built-in Objects
+
+  Functions that are specified as get or set accessor functions of built-in
+  properties have "get " or "set " prepended to the property name string.
+
+includes: [propertyHelper.js]
+features: [resizable-arraybuffer]
+---*/
+
+var desc = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, 'maxByteLength');
+
+verifyProperty(desc.get, 'name', {
+  value: 'get maxByteLength',
+  enumerable: false,
+  writable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/prop-desc.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/prop-desc.js
new file mode 100644
index 0000000000..ee793198b4
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/prop-desc.js
@@ -0,0 +1,28 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.maxbytelength
+description: >
+  "maxByteLength" property of ArrayBuffer.prototype
+info: |
+  ArrayBuffer.prototype.maxByteLength is an accessor property whose set
+  accessor function is undefined.
+
+  Section 17: Every accessor property described in clauses 18 through 26 and in
+  Annex B.2 has the attributes {[[Enumerable]]: false, [[Configurable]]: true }
+includes: [propertyHelper.js]
+features: [resizable-arraybuffer]
+---*/
+
+var desc = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, 'maxByteLength');
+
+assert.sameValue(desc.set, undefined);
+assert.sameValue(typeof desc.get, 'function');
+
+verifyProperty(ArrayBuffer.prototype, 'maxByteLength', {
+  enumerable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/return-maxbytelength-non-resizable.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/return-maxbytelength-non-resizable.js
new file mode 100644
index 0000000000..7a28ba7d77
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/return-maxbytelength-non-resizable.js
@@ -0,0 +1,28 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.maxbytelength
+description: Return value from [[ArrayBufferByteLength]] internal slot
+info: |
+  24.1.4.1 get ArrayBuffer.prototype.maxByteLength
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, return +0𝔽.
+  5. If IsResizableArrayBuffer(O) is true, then
+     [...]
+  6. Else,
+     a. Let length be O.[[ArrayBufferByteLength]].
+  7. Return 𝔽(length).
+features: [resizable-arraybuffer]
+---*/
+
+var ab1 = new ArrayBuffer(0);
+assert.sameValue(ab1.maxByteLength, 0);
+
+var ab2 = new ArrayBuffer(42);
+assert.sameValue(ab2.maxByteLength, 42);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/return-maxbytelength-resizable.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/return-maxbytelength-resizable.js
new file mode 100644
index 0000000000..75f4988d51
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/return-maxbytelength-resizable.js
@@ -0,0 +1,31 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.maxbytelength
+description: Return value from [[ArrayBufferMaxByteLength]] internal slot
+info: |
+  24.1.4.1 get ArrayBuffer.prototype.maxByteLength
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, return +0𝔽.
+  5. If IsResizableArrayBuffer(O) is true, then
+     a. Let length be O.[[ArrayBufferMaxByteLength]].
+  6. Else,
+     [...]
+  7. Return 𝔽(length).
+features: [resizable-arraybuffer]
+---*/
+
+var ab1 = new ArrayBuffer(0, { maxByteLength: 0 });
+assert.sameValue(ab1.maxByteLength, 0);
+
+var ab2 = new ArrayBuffer(0, { maxByteLength: 23 });
+assert.sameValue(ab2.maxByteLength, 23);
+
+var ab3 = new ArrayBuffer(42, { maxByteLength: 42 });
+assert.sameValue(ab3.maxByteLength, 42);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/shell.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/shell.js
new file mode 100644
index 0000000000..06f65290b8
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/shell.js
@@ -0,0 +1,18 @@
+// GENERATED, DO NOT EDIT
+// file: detachArrayBuffer.js
+// Copyright (C) 2016 the V8 project authors.  All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+description: |
+    A function used in the process of asserting correctness of TypedArray objects.
+
+    $262.detachArrayBuffer is defined by a host.
+defines: [$DETACHBUFFER]
+---*/
+
+function $DETACHBUFFER(buffer) {
+  if (!$262 || typeof $262.detachArrayBuffer !== "function") {
+    throw new Test262Error("No method available to detach an ArrayBuffer");
+  }
+  $262.detachArrayBuffer(buffer);
+}
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/this-has-no-arraybufferdata-internal.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/this-has-no-arraybufferdata-internal.js
new file mode 100644
index 0000000000..0aad978d4d
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/this-has-no-arraybufferdata-internal.js
@@ -0,0 +1,42 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.maxbytelength
+description: >
+  Throws a TypeError exception when `this` does not have a [[ArrayBufferData]]
+  internal slot
+info: |
+  get ArrayBuffer.prototype.maxByteLength
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [DataView, Int8Array, resizable-arraybuffer]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  ArrayBuffer.prototype, "maxByteLength"
+).get;
+
+assert.sameValue(typeof getter, "function");
+
+assert.throws(TypeError, function() {
+  getter.call({});
+});
+
+assert.throws(TypeError, function() {
+  getter.call([]);
+});
+
+var ta = new Int8Array(8);
+assert.throws(TypeError, function() {
+  getter.call(ta);
+});
+
+var dv = new DataView(new ArrayBuffer(8), 0);
+assert.throws(TypeError, function() {
+  getter.call(dv);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/this-is-not-object.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/this-is-not-object.js
new file mode 100644
index 0000000000..3d55d55909
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/this-is-not-object.js
@@ -0,0 +1,51 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.maxbytelength
+description: Throws a TypeError exception when `this` is not Object
+info: |
+  get ArrayBuffer.prototype.maxByteLength
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [Symbol, resizable-arraybuffer]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  ArrayBuffer.prototype, "maxByteLength"
+).get;
+
+assert.sameValue(typeof getter, "function");
+
+assert.throws(TypeError, function() {
+  getter.call(undefined);
+}, "this is undefined");
+
+assert.throws(TypeError, function() {
+  getter.call(null);
+}, "this is null");
+
+assert.throws(TypeError, function() {
+  getter.call(42);
+}, "this is 42");
+
+assert.throws(TypeError, function() {
+  getter.call("1");
+}, "this is a string");
+
+assert.throws(TypeError, function() {
+  getter.call(true);
+}, "this is true");
+
+assert.throws(TypeError, function() {
+  getter.call(false);
+}, "this is false");
+
+var s = Symbol("s");
+assert.throws(TypeError, function() {
+  getter.call(s);
+}, "this is a Symbol");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/this-is-sharedarraybuffer.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/this-is-sharedarraybuffer.js
new file mode 100644
index 0000000000..84ec994985
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/maxByteLength/this-is-sharedarraybuffer.js
@@ -0,0 +1,36 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.maxbytelength
+description: Throws a TypeError exception when `this` is a SharedArrayBuffer
+info: |
+  get ArrayBuffer.prototype.maxByteLength
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  [...]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var maxByteLength = Object.getOwnPropertyDescriptor(
+  ArrayBuffer.prototype, "maxByteLength"
+);
+
+var getter = maxByteLength.get;
+var sab = new SharedArrayBuffer(4);
+
+assert.sameValue(typeof getter, "function");
+
+assert.throws(TypeError, function() {
+  getter.call(sab);
+}, "`this` cannot be a SharedArrayBuffer");
+
+Object.defineProperties(sab, { maxByteLength: maxByteLength });
+
+assert.throws(TypeError, function() {
+  sab.maxByteLength;
+}, "`this` cannot be a SharedArrayBuffer");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/browser.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/browser.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/browser.js
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/detached-buffer.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/detached-buffer.js
new file mode 100644
index 0000000000..ddc2643173
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/detached-buffer.js
@@ -0,0 +1,37 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.resizable
+description: Unaffected by buffer's attachedness
+info: |
+  get ArrayBuffer.prototype.resizable
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. Return IsResizableArrayBuffer(O).
+
+  IsResizableArrayBuffer ( arrayBuffer )
+
+  1. Assert: Type(arrayBuffer) is Object and arrayBuffer has an
+     [[ArrayBufferData]] internal slot.
+  2. If buffer has an [[ArrayBufferMaxByteLength]] internal slot, return true.
+  3. Return false.
+includes: [detachArrayBuffer.js]
+features: [resizable-arraybuffer]
+---*/
+
+var ab1 = new ArrayBuffer(1);
+
+$DETACHBUFFER(ab1);
+
+assert.sameValue(ab1.resizable, false);
+
+var ab2 = new ArrayBuffer(1, {maxByteLength: 1});
+
+$DETACHBUFFER(ab2);
+
+assert.sameValue(ab2.resizable, true);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/invoked-as-accessor.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/invoked-as-accessor.js
new file mode 100644
index 0000000000..c07a5d9e22
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/invoked-as-accessor.js
@@ -0,0 +1,20 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.resizable
+description: Requires this value to have a [[ArrayBufferData]] internal slot
+info: |
+  get ArrayBuffer.prototype.resizable
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [resizable-arraybuffer]
+---*/
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.resizable;
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/invoked-as-func.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/invoked-as-func.js
new file mode 100644
index 0000000000..0c960b4ea3
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/invoked-as-func.js
@@ -0,0 +1,26 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.resizable
+description: Throws a TypeError exception when invoked as a function
+info: |
+  get ArrayBuffer.prototype.resizable
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [resizable-arraybuffer]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  ArrayBuffer.prototype, 'resizable'
+).get;
+
+assert.sameValue(typeof getter, 'function');
+
+assert.throws(TypeError, function() {
+  getter();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/length.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/length.js
new file mode 100644
index 0000000000..17f160d642
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/length.js
@@ -0,0 +1,35 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.resizable
+description: >
+  get ArrayBuffer.prototype.resizable.length is 0.
+info: |
+  get ArrayBuffer.prototype.resizeable
+
+  17 ECMAScript Standard Built-in Objects:
+    Every built-in Function object, including constructors, has a length
+    property whose value is an integer. Unless otherwise specified, this
+    value is equal to the largest number of named arguments shown in the
+    subclause headings for the function description, including optional
+    parameters. However, rest parameters shown using the form “...name”
+    are not included in the default argument count.
+
+    Unless otherwise specified, the length property of a built-in Function
+    object has the attributes { [[Writable]]: false, [[Enumerable]]: false,
+    [[Configurable]]: true }.
+includes: [propertyHelper.js]
+features: [resizable-arraybuffer]
+---*/
+
+var desc = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, 'resizable');
+
+verifyProperty(desc.get, 'length', {
+  value: 0,
+  enumerable: false,
+  writable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/name.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/name.js
new file mode 100644
index 0000000000..7fc235ee7f
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/name.js
@@ -0,0 +1,27 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.resizable
+description: >
+  get ArrayBuffer.prototype.resizable
+
+  17 ECMAScript Standard Built-in Objects
+
+  Functions that are specified as get or set accessor functions of built-in
+  properties have "get " or "set " prepended to the property name string.
+
+includes: [propertyHelper.js]
+features: [resizable-arraybuffer]
+---*/
+
+var desc = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, 'resizable');
+
+verifyProperty(desc.get, 'name', {
+  value: 'get resizable',
+  enumerable: false,
+  writable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/prop-desc.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/prop-desc.js
new file mode 100644
index 0000000000..2363aac288
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/prop-desc.js
@@ -0,0 +1,28 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.resizable
+description: >
+  "resizable" property of ArrayBuffer.prototype
+info: |
+  ArrayBuffer.prototype.resizable is an accessor property whose set accessor
+  function is undefined.
+
+  Section 17: Every accessor property described in clauses 18 through 26 and in
+  Annex B.2 has the attributes {[[Enumerable]]: false, [[Configurable]]: true }
+includes: [propertyHelper.js]
+features: [resizable-arraybuffer]
+---*/
+
+var desc = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, 'resizable');
+
+assert.sameValue(desc.set, undefined);
+assert.sameValue(typeof desc.get, 'function');
+
+verifyProperty(ArrayBuffer.prototype, 'resizable', {
+  enumerable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/return-resizable.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/return-resizable.js
new file mode 100644
index 0000000000..7833c24306
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/return-resizable.js
@@ -0,0 +1,32 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.resizable
+description: Return value according to [[ArrayBufferMaxByteLength]] internal slot
+info: |
+  get ArrayBuffer.prototype.resizable
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. Return IsResizableArrayBuffer(O).
+
+  IsResizableArrayBuffer ( arrayBuffer )
+
+  1. Assert: Type(arrayBuffer) is Object and arrayBuffer has an
+     [[ArrayBufferData]] internal slot.
+  2. If buffer has an [[ArrayBufferMaxByteLength]] internal slot, return true.
+  3. Return false.
+features: [resizable-arraybuffer]
+---*/
+
+var ab1 = new ArrayBuffer(1);
+
+assert.sameValue(ab1.resizable, false);
+
+var ab2 = new ArrayBuffer(1, {maxByteLength: 1});
+
+assert.sameValue(ab2.resizable, true);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/shell.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/shell.js
new file mode 100644
index 0000000000..06f65290b8
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/shell.js
@@ -0,0 +1,18 @@
+// GENERATED, DO NOT EDIT
+// file: detachArrayBuffer.js
+// Copyright (C) 2016 the V8 project authors.  All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+description: |
+    A function used in the process of asserting correctness of TypedArray objects.
+
+    $262.detachArrayBuffer is defined by a host.
+defines: [$DETACHBUFFER]
+---*/
+
+function $DETACHBUFFER(buffer) {
+  if (!$262 || typeof $262.detachArrayBuffer !== "function") {
+    throw new Test262Error("No method available to detach an ArrayBuffer");
+  }
+  $262.detachArrayBuffer(buffer);
+}
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/this-has-no-arraybufferdata-internal.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/this-has-no-arraybufferdata-internal.js
new file mode 100644
index 0000000000..8994ca071a
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/this-has-no-arraybufferdata-internal.js
@@ -0,0 +1,42 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.resizable
+description: >
+  Throws a TypeError exception when `this` does not have a [[ArrayBufferData]]
+  internal slot
+info: |
+  get ArrayBuffer.prototype.resizable
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [DataView, Int8Array, resizable-arraybuffer]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  ArrayBuffer.prototype, "resizable"
+).get;
+
+assert.sameValue(typeof getter, "function");
+
+assert.throws(TypeError, function() {
+  getter.call({});
+});
+
+assert.throws(TypeError, function() {
+  getter.call([]);
+});
+
+var ta = new Int8Array(8);
+assert.throws(TypeError, function() {
+  getter.call(ta);
+});
+
+var dv = new DataView(new ArrayBuffer(8), 0);
+assert.throws(TypeError, function() {
+  getter.call(dv);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/this-is-not-object.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/this-is-not-object.js
new file mode 100644
index 0000000000..f28019bade
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/this-is-not-object.js
@@ -0,0 +1,51 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.resizable
+description: Throws a TypeError exception when `this` is not Object
+info: |
+  get ArrayBuffer.prototype.resizable
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [Symbol, resizable-arraybuffer]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  ArrayBuffer.prototype, "resizable"
+).get;
+
+assert.sameValue(typeof getter, "function");
+
+assert.throws(TypeError, function() {
+  getter.call(undefined);
+}, "this is undefined");
+
+assert.throws(TypeError, function() {
+  getter.call(null);
+}, "this is null");
+
+assert.throws(TypeError, function() {
+  getter.call(42);
+}, "this is 42");
+
+assert.throws(TypeError, function() {
+  getter.call("1");
+}, "this is a string");
+
+assert.throws(TypeError, function() {
+  getter.call(true);
+}, "this is true");
+
+assert.throws(TypeError, function() {
+  getter.call(false);
+}, "this is false");
+
+var s = Symbol("s");
+assert.throws(TypeError, function() {
+  getter.call(s);
+}, "this is a Symbol");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/this-is-sharedarraybuffer.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/this-is-sharedarraybuffer.js
new file mode 100644
index 0000000000..cb9e219929
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resizable/this-is-sharedarraybuffer.js
@@ -0,0 +1,36 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-arraybuffer.prototype.resizable
+description: Throws a TypeError exception when `this` is a SharedArrayBuffer
+info: |
+  get ArrayBuffer.prototype.resizable
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  [...]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var resizable = Object.getOwnPropertyDescriptor(
+  ArrayBuffer.prototype, "resizable"
+);
+
+var getter = resizable.get;
+var sab = new SharedArrayBuffer(4);
+
+assert.sameValue(typeof getter, "function");
+
+assert.throws(TypeError, function() {
+  getter.call(sab);
+}, "`this` cannot be a SharedArrayBuffer");
+
+Object.defineProperties(sab, { resizable: resizable });
+
+assert.throws(TypeError, function() {
+  sab.resizable;
+}, "`this` cannot be a SharedArrayBuffer");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/browser.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/browser.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/browser.js
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/descriptor.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/descriptor.js
new file mode 100644
index 0000000000..96e5f76fa0
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/descriptor.js
@@ -0,0 +1,25 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.resize
+description: >
+  ArrayBuffer.prototype.resize has default data property attributes.
+info: |
+  ArrayBuffer.prototype.resize ( newLength )
+
+  17 ECMAScript Standard Built-in Objects:
+    Every other data property described in clauses 18 through 26 and in
+    Annex B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+features: [resizable-arraybuffer]
+---*/
+
+verifyProperty(ArrayBuffer.prototype, 'resize', {
+  enumerable: false,
+  writable: true,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/extensible.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/extensible.js
new file mode 100644
index 0000000000..8c4323e6df
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/extensible.js
@@ -0,0 +1,18 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.resize
+description: ArrayBuffer.prototype.resize is extensible.
+info: |
+  ArrayBuffer.prototype.resize ( newLength )
+
+  17 ECMAScript Standard Built-in Objects:
+    Unless specified otherwise, the [[Extensible]] internal slot
+    of a built-in object initially has the value true.
+features: [resizable-arraybuffer]
+---*/
+
+assert(Object.isExtensible(ArrayBuffer.prototype.resize));
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/length.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/length.js
new file mode 100644
index 0000000000..25772a6f33
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/length.js
@@ -0,0 +1,33 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.resize
+description: >
+  ArrayBuffer.prototype.resize.length is 1.
+info: |
+  ArrayBuffer.prototype.resize ( newLength )
+
+  17 ECMAScript Standard Built-in Objects:
+    Every built-in Function object, including constructors, has a length
+    property whose value is an integer. Unless otherwise specified, this
+    value is equal to the largest number of named arguments shown in the
+    subclause headings for the function description, including optional
+    parameters. However, rest parameters shown using the form “...name”
+    are not included in the default argument count.
+
+    Unless otherwise specified, the length property of a built-in Function
+    object has the attributes { [[Writable]]: false, [[Enumerable]]: false,
+    [[Configurable]]: true }.
+includes: [propertyHelper.js]
+features: [resizable-arraybuffer]
+---*/
+
+verifyProperty(ArrayBuffer.prototype.resize, 'length', {
+  value: 1,
+  enumerable: false,
+  writable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/name.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/name.js
new file mode 100644
index 0000000000..c75828f521
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/name.js
@@ -0,0 +1,30 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.resize
+description: >
+  ArrayBuffer.prototype.resize.name is "resize".
+info: |
+  ArrayBuffer.prototype.resize ( newLength )
+
+  17 ECMAScript Standard Built-in Objects:
+    Every built-in Function object, including constructors, that is not
+    identified as an anonymous function has a name property whose value
+    is a String.
+
+    Unless otherwise specified, the name property of a built-in Function
+    object, if it exists, has the attributes { [[Writable]]: false,
+    [[Enumerable]]: false, [[Configurable]]: true }.
+features: [resizable-arraybuffer]
+includes: [propertyHelper.js]
+---*/
+
+verifyProperty(ArrayBuffer.prototype.resize, 'name', {
+  value: 'resize',
+  enumerable: false,
+  writable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/new-length-excessive.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/new-length-excessive.js
new file mode 100644
index 0000000000..81988067b5
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/new-length-excessive.js
@@ -0,0 +1,28 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.resize
+description: >
+  Throws a RangeError the newLength value is larger than the max byte length
+info: |
+  ArrayBuffer.prototype.resize ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, throw a TypeError exception.
+  5. Let newByteLength be ? ToIntegerOrInfinity(newLength).
+  6. If newByteLength < 0 or newByteLength > O.[[ArrayBufferMaxByteLength]],
+     throw a RangeError exception.
+  [...]
+features: [resizable-arraybuffer]
+---*/
+
+var ab = new ArrayBuffer(4, {maxByteLength: 4});
+
+assert.throws(RangeError, function() {
+  ab.resize(5);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/new-length-negative.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/new-length-negative.js
new file mode 100644
index 0000000000..e47ae27a03
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/new-length-negative.js
@@ -0,0 +1,28 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.resize
+description: >
+  Throws a RangeError the newLength value is less than zero
+info: |
+  ArrayBuffer.prototype.resize ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, throw a TypeError exception.
+  5. Let newByteLength be ? ToIntegerOrInfinity(newLength).
+  6. If newByteLength < 0 or newByteLength > O.[[ArrayBufferMaxByteLength]],
+     throw a RangeError exception.
+  [...]
+features: [resizable-arraybuffer]
+---*/
+
+var ab = new ArrayBuffer(4, {maxByteLength: 4});
+
+assert.throws(RangeError, function() {
+  ab.resize(-1);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/new-length-non-number.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/new-length-non-number.js
new file mode 100644
index 0000000000..db3059d21c
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/new-length-non-number.js
@@ -0,0 +1,40 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.resize
+description: Throws a TypeError if provided length cannot be coerced to a number
+info: |
+  ArrayBuffer.prototype.resize ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, throw a TypeError exception.
+  5. Let newByteLength be ? ToIntegerOrInfinity(newLength).
+  [...]
+features: [resizable-arraybuffer]
+---*/
+
+var log = [];
+var newLength = {
+  toString: function() {
+    log.push('toString');
+    return {};
+  },
+  valueOf: function() {
+    log.push('valueOf');
+    return {};
+  }
+};
+var ab = new ArrayBuffer(0, {maxByteLength: 4});
+
+assert.throws(TypeError, function() {
+  ab.resize(newLength);
+});
+
+assert.sameValue(log.length, 2);
+assert.sameValue(log[0], 'valueOf');
+assert.sameValue(log[1], 'toString');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/nonconstructor.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/nonconstructor.js
new file mode 100644
index 0000000000..d14b6ae15f
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/nonconstructor.js
@@ -0,0 +1,26 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.resize
+description: >
+  ArrayBuffer.prototype.resize is not a constructor function.
+info: |
+  ArrayBuffer.prototype.resize ( newLength )
+
+  17 ECMAScript Standard Built-in Objects:
+    Built-in function objects that are not identified as constructors do not
+    implement the [[Construct]] internal method unless otherwise specified
+    in the description of a particular function.
+includes: [isConstructor.js]
+features: [resizable-arraybuffer, Reflect.construct]
+---*/
+
+assert(!isConstructor(ArrayBuffer.prototype.resize), "ArrayBuffer.prototype.resize is not a constructor");
+
+var arrayBuffer = new ArrayBuffer(8);
+assert.throws(TypeError, function() {
+  new arrayBuffer.resize();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/resize-grow.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/resize-grow.js
new file mode 100644
index 0000000000..adb95fe528
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/resize-grow.js
@@ -0,0 +1,80 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.resize
+description: Behavior when attempting to grow a resizable array buffer
+info: |
+  ArrayBuffer.prototype.resize ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, throw a TypeError exception.
+  5. Let newByteLength be ? ToIntegerOrInfinity(newLength).
+  6. If newByteLength < 0 or newByteLength > O.[[ArrayBufferMaxByteLength]],
+     throw a RangeError exception.
+  7. Let hostHandled be ? HostResizeArrayBuffer(O, newByteLength).
+  [...]
+
+  HostResizeArrayBuffer ( buffer, newByteLength )
+
+  The implementation of HostResizeArrayBuffer must conform to the following
+  requirements:
+
+  - The abstract operation does not detach buffer.
+  - The abstract operation may complete normally or abruptly.
+  - If the abstract operation completes normally with handled,
+    buffer.[[ArrayBufferByteLength]] is newByteLength.
+  - The return value is either handled or unhandled.
+features: [resizable-arraybuffer]
+---*/
+
+var ab = new ArrayBuffer(4, {maxByteLength: 5});
+var caught = false;
+var result;
+
+// If the host chooses to throw as allowed by the specification, the observed
+// behavior will be identical to the case where `ArrayBuffer.prototype.resize`
+// has not been implemented. The following assertion prevents this test from
+// passing in runtimes which have not implemented the method.
+assert.sameValue(typeof ab.resize, 'function');
+
+try {
+  result = ab.resize(5);
+} catch (_) {
+  caught = true;
+}
+
+try {
+  ab.slice();
+} catch (_) {
+  throw new Test262Error('The ArrayBuffer under test was detached');
+}
+
+// One of the following three conditions must be met:
+//
+// - HostResizeArrayBuffer returns an abrupt completion
+// - HostResizeArrayBuffer handles the resize operation and conforms to the
+//   invarient regarding [[ArrayBufferByteLength]]
+// - HostResizeArrayBuffer does not handle the resize operation, and the
+//   `resize` method updates [[ArrayBufferByteLength]]
+//
+// The final two conditions are indistinguishable.
+assert(caught || ab.byteLength === 5, 'byteLength');
+
+// One of the following three conditions must be met:
+//
+// - HostResizeArrayBuffer returns an abrupt completion
+// - HostResizeArrayBuffer handles the resize operation, and the `resize`
+//   method returns early
+// - HostResizeArrayBuffer does not handle the resize operation, and the
+//   `resize` method executes its final steps
+//
+// All three conditions have the same effect on the value of `result`.
+assert.sameValue(result, undefined, 'normal completion value');
+
+// The contents of the ArrayBuffer are not guaranteed by the host-defined
+// abstract operation, so they are not asserted in this test.
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/resize-same-size-zero-explicit.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/resize-same-size-zero-explicit.js
new file mode 100644
index 0000000000..068735c98d
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/resize-same-size-zero-explicit.js
@@ -0,0 +1,81 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.resize
+description: >
+  Behavior when attempting to reset the size of a resizable array buffer to zero explicitly
+info: |
+  ArrayBuffer.prototype.resize ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, throw a TypeError exception.
+  5. Let newByteLength be ? ToIntegerOrInfinity(newLength).
+  6. If newByteLength < 0 or newByteLength > O.[[ArrayBufferMaxByteLength]],
+     throw a RangeError exception.
+  7. Let hostHandled be ? HostResizeArrayBuffer(O, newByteLength).
+  [...]
+
+  HostResizeArrayBuffer ( buffer, newByteLength )
+
+  The implementation of HostResizeArrayBuffer must conform to the following
+  requirements:
+
+  - The abstract operation does not detach buffer.
+  - The abstract operation may complete normally or abruptly.
+  - If the abstract operation completes normally with handled,
+    buffer.[[ArrayBufferByteLength]] is newByteLength.
+  - The return value is either handled or unhandled.
+features: [resizable-arraybuffer]
+---*/
+
+var ab = new ArrayBuffer(0, {maxByteLength: 0});
+var caught = false;
+var result;
+
+// If the host chooses to throw as allowed by the specification, the observed
+// behavior will be identical to the case where `ArrayBuffer.prototype.resize`
+// has not been implemented. The following assertion prevents this test from
+// passing in runtimes which have not implemented the method.
+assert.sameValue(typeof ab.resize, 'function');
+
+try {
+  result = ab.resize(0);
+} catch (_) {
+  caught = true;
+}
+
+try {
+  ab.slice();
+} catch (_) {
+  throw new Test262Error('The ArrayBuffer under test was detached');
+}
+
+// One of the following three conditions must be met:
+//
+// - HostResizeArrayBuffer returns an abrupt completion
+// - HostResizeArrayBuffer handles the resize operation and conforms to the
+//   invarient regarding [[ArrayBufferByteLength]]
+// - HostResizeArrayBuffer does not handle the resize operation, and the
+//   `resize` method updates [[ArrayBufferByteLength]]
+//
+// The final two conditions are indistinguishable.
+assert(caught || ab.byteLength === 0, 'byteLength');
+
+// One of the following three conditions must be met:
+//
+// - HostResizeArrayBuffer returns an abrupt completion
+// - HostResizeArrayBuffer handles the resize operation, and the `resize`
+//   method returns early
+// - HostResizeArrayBuffer does not handle the resize operation, and the
+//   `resize` method executes its final steps
+//
+// All three conditions have the same effect on the value of `result`.
+assert.sameValue(result, undefined, 'normal completion value');
+
+// The contents of the ArrayBuffer are not guaranteed by the host-defined
+// abstract operation, so they are not asserted in this test.
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/resize-same-size-zero-implicit.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/resize-same-size-zero-implicit.js
new file mode 100644
index 0000000000..cd78beba50
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/resize-same-size-zero-implicit.js
@@ -0,0 +1,81 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.resize
+description: >
+  Behavior when attempting to reset the size of a resizable array buffer to zero explicitly
+info: |
+  ArrayBuffer.prototype.resize ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, throw a TypeError exception.
+  5. Let newByteLength be ? ToIntegerOrInfinity(newLength).
+  6. If newByteLength < 0 or newByteLength > O.[[ArrayBufferMaxByteLength]],
+     throw a RangeError exception.
+  7. Let hostHandled be ? HostResizeArrayBuffer(O, newByteLength).
+  [...]
+
+  HostResizeArrayBuffer ( buffer, newByteLength )
+
+  The implementation of HostResizeArrayBuffer must conform to the following
+  requirements:
+
+  - The abstract operation does not detach buffer.
+  - The abstract operation may complete normally or abruptly.
+  - If the abstract operation completes normally with handled,
+    buffer.[[ArrayBufferByteLength]] is newByteLength.
+  - The return value is either handled or unhandled.
+features: [resizable-arraybuffer]
+---*/
+
+var ab = new ArrayBuffer(0, {maxByteLength: 0});
+var caught = false;
+var result;
+
+// If the host chooses to throw as allowed by the specification, the observed
+// behavior will be identical to the case where `ArrayBuffer.prototype.resize`
+// has not been implemented. The following assertion prevents this test from
+// passing in runtimes which have not implemented the method.
+assert.sameValue(typeof ab.resize, 'function');
+
+try {
+  result = ab.resize();
+} catch (_) {
+  caught = true;
+}
+
+try {
+  ab.slice();
+} catch (_) {
+  throw new Test262Error('The ArrayBuffer under test was detached');
+}
+
+// One of the following three conditions must be met:
+//
+// - HostResizeArrayBuffer returns an abrupt completion
+// - HostResizeArrayBuffer handles the resize operation and conforms to the
+//   invarient regarding [[ArrayBufferByteLength]]
+// - HostResizeArrayBuffer does not handle the resize operation, and the
+//   `resize` method updates [[ArrayBufferByteLength]]
+//
+// The final two conditions are indistinguishable.
+assert(caught || ab.byteLength === 0, 'byteLength');
+
+// One of the following three conditions must be met:
+//
+// - HostResizeArrayBuffer returns an abrupt completion
+// - HostResizeArrayBuffer handles the resize operation, and the `resize`
+//   method returns early
+// - HostResizeArrayBuffer does not handle the resize operation, and the
+//   `resize` method executes its final steps
+//
+// All three conditions have the same effect on the value of `result`.
+assert.sameValue(result, undefined, 'normal completion value');
+
+// The contents of the ArrayBuffer are not guaranteed by the host-defined
+// abstract operation, so they are not asserted in this test.
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/resize-same-size.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/resize-same-size.js
new file mode 100644
index 0000000000..8e9dbf37ff
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/resize-same-size.js
@@ -0,0 +1,81 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.resize
+description: >
+  Behavior when attempting to reset the size of a resizable array buffer
+info: |
+  ArrayBuffer.prototype.resize ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, throw a TypeError exception.
+  5. Let newByteLength be ? ToIntegerOrInfinity(newLength).
+  6. If newByteLength < 0 or newByteLength > O.[[ArrayBufferMaxByteLength]],
+     throw a RangeError exception.
+  7. Let hostHandled be ? HostResizeArrayBuffer(O, newByteLength).
+  [...]
+
+  HostResizeArrayBuffer ( buffer, newByteLength )
+
+  The implementation of HostResizeArrayBuffer must conform to the following
+  requirements:
+
+  - The abstract operation does not detach buffer.
+  - The abstract operation may complete normally or abruptly.
+  - If the abstract operation completes normally with handled,
+    buffer.[[ArrayBufferByteLength]] is newByteLength.
+  - The return value is either handled or unhandled.
+features: [resizable-arraybuffer]
+---*/
+
+var ab = new ArrayBuffer(4, {maxByteLength: 4});
+var caught = false;
+var result;
+
+// If the host chooses to throw as allowed by the specification, the observed
+// behavior will be identical to the case where `ArrayBuffer.prototype.resize`
+// has not been implemented. The following assertion prevents this test from
+// passing in runtimes which have not implemented the method.
+assert.sameValue(typeof ab.resize, 'function');
+
+try {
+  result = ab.resize(4);
+} catch (_) {
+  caught = true;
+}
+
+try {
+  ab.slice();
+} catch (_) {
+  throw new Test262Error('The ArrayBuffer under test was detached');
+}
+
+// One of the following three conditions must be met:
+//
+// - HostResizeArrayBuffer returns an abrupt completion
+// - HostResizeArrayBuffer handles the resize operation and conforms to the
+//   invarient regarding [[ArrayBufferByteLength]]
+// - HostResizeArrayBuffer does not handle the resize operation, and the
+//   `resize` method updates [[ArrayBufferByteLength]]
+//
+// The final two conditions are indistinguishable.
+assert(caught || ab.byteLength === 4, 'byteLength');
+
+// One of the following three conditions must be met:
+//
+// - HostResizeArrayBuffer returns an abrupt completion
+// - HostResizeArrayBuffer handles the resize operation, and the `resize`
+//   method returns early
+// - HostResizeArrayBuffer does not handle the resize operation, and the
+//   `resize` method executes its final steps
+//
+// All three conditions have the same effect on the value of `result`.
+assert.sameValue(result, undefined, 'normal completion value');
+
+// The contents of the ArrayBuffer are not guaranteed by the host-defined
+// abstract operation, so they are not asserted in this test.
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/resize-shrink-zero-explicit.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/resize-shrink-zero-explicit.js
new file mode 100644
index 0000000000..59f41980c8
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/resize-shrink-zero-explicit.js
@@ -0,0 +1,80 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.resize
+description: Behavior when attempting to shrink a resizable array buffer to zero explicitly
+info: |
+  ArrayBuffer.prototype.resize ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, throw a TypeError exception.
+  5. Let newByteLength be ? ToIntegerOrInfinity(newLength).
+  6. If newByteLength < 0 or newByteLength > O.[[ArrayBufferMaxByteLength]],
+     throw a RangeError exception.
+  7. Let hostHandled be ? HostResizeArrayBuffer(O, newByteLength).
+  [...]
+
+  HostResizeArrayBuffer ( buffer, newByteLength )
+
+  The implementation of HostResizeArrayBuffer must conform to the following
+  requirements:
+
+  - The abstract operation does not detach buffer.
+  - The abstract operation may complete normally or abruptly.
+  - If the abstract operation completes normally with handled,
+    buffer.[[ArrayBufferByteLength]] is newByteLength.
+  - The return value is either handled or unhandled.
+features: [resizable-arraybuffer]
+---*/
+
+var ab = new ArrayBuffer(4, {maxByteLength: 4});
+var caught = false;
+var result;
+
+// If the host chooses to throw as allowed by the specification, the observed
+// behavior will be identical to the case where `ArrayBuffer.prototype.resize`
+// has not been implemented. The following assertion prevents this test from
+// passing in runtimes which have not implemented the method.
+assert.sameValue(typeof ab.resize, 'function');
+
+try {
+  result = ab.resize(0);
+} catch (_) {
+  caught = true;
+}
+
+try {
+  ab.slice();
+} catch (_) {
+  throw new Test262Error('The ArrayBuffer under test was detached');
+}
+
+// One of the following three conditions must be met:
+//
+// - HostResizeArrayBuffer returns an abrupt completion
+// - HostResizeArrayBuffer handles the resize operation and conforms to the
+//   invarient regarding [[ArrayBufferByteLength]]
+// - HostResizeArrayBuffer does not handle the resize operation, and the
+//   `resize` method updates [[ArrayBufferByteLength]]
+//
+// The final two conditions are indistinguishable.
+assert(caught || ab.byteLength === 0, 'byteLength');
+
+// One of the following three conditions must be met:
+//
+// - HostResizeArrayBuffer returns an abrupt completion
+// - HostResizeArrayBuffer handles the resize operation, and the `resize`
+//   method returns early
+// - HostResizeArrayBuffer does not handle the resize operation, and the
+//   `resize` method executes its final steps
+//
+// All three conditions have the same effect on the value of `result`.
+assert.sameValue(result, undefined, 'normal completion value');
+
+// The contents of the ArrayBuffer are not guaranteed by the host-defined
+// abstract operation, so they are not asserted in this test.
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/resize-shrink-zero-implicit.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/resize-shrink-zero-implicit.js
new file mode 100644
index 0000000000..c1b72f35fe
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/resize-shrink-zero-implicit.js
@@ -0,0 +1,80 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.resize
+description: Behavior when attempting to shrink a resizable array buffer to zero implicitly
+info: |
+  ArrayBuffer.prototype.resize ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, throw a TypeError exception.
+  5. Let newByteLength be ? ToIntegerOrInfinity(newLength).
+  6. If newByteLength < 0 or newByteLength > O.[[ArrayBufferMaxByteLength]],
+     throw a RangeError exception.
+  7. Let hostHandled be ? HostResizeArrayBuffer(O, newByteLength).
+  [...]
+
+  HostResizeArrayBuffer ( buffer, newByteLength )
+
+  The implementation of HostResizeArrayBuffer must conform to the following
+  requirements:
+
+  - The abstract operation does not detach buffer.
+  - The abstract operation may complete normally or abruptly.
+  - If the abstract operation completes normally with handled,
+    buffer.[[ArrayBufferByteLength]] is newByteLength.
+  - The return value is either handled or unhandled.
+features: [resizable-arraybuffer]
+---*/
+
+var ab = new ArrayBuffer(4, {maxByteLength: 4});
+var caught = false;
+var result;
+
+// If the host chooses to throw as allowed by the specification, the observed
+// behavior will be identical to the case where `ArrayBuffer.prototype.resize`
+// has not been implemented. The following assertion prevents this test from
+// passing in runtimes which have not implemented the method.
+assert.sameValue(typeof ab.resize, 'function');
+
+try {
+  result = ab.resize();
+} catch (_) {
+  caught = true;
+}
+
+try {
+  ab.slice();
+} catch (_) {
+  throw new Test262Error('The ArrayBuffer under test was detached');
+}
+
+// One of the following three conditions must be met:
+//
+// - HostResizeArrayBuffer returns an abrupt completion
+// - HostResizeArrayBuffer handles the resize operation and conforms to the
+//   invarient regarding [[ArrayBufferByteLength]]
+// - HostResizeArrayBuffer does not handle the resize operation, and the
+//   `resize` method updates [[ArrayBufferByteLength]]
+//
+// The final two conditions are indistinguishable.
+assert(caught || ab.byteLength === 0, 'byteLength');
+
+// One of the following three conditions must be met:
+//
+// - HostResizeArrayBuffer returns an abrupt completion
+// - HostResizeArrayBuffer handles the resize operation, and the `resize`
+//   method returns early
+// - HostResizeArrayBuffer does not handle the resize operation, and the
+//   `resize` method executes its final steps
+//
+// All three conditions have the same effect on the value of `result`.
+assert.sameValue(result, undefined, 'normal completion value');
+
+// The contents of the ArrayBuffer are not guaranteed by the host-defined
+// abstract operation, so they are not asserted in this test.
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/resize-shrink.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/resize-shrink.js
new file mode 100644
index 0000000000..5b9973934f
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/resize-shrink.js
@@ -0,0 +1,80 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.resize
+description: Behavior when attempting to shrink a resizable array buffer
+info: |
+  ArrayBuffer.prototype.resize ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, throw a TypeError exception.
+  5. Let newByteLength be ? ToIntegerOrInfinity(newLength).
+  6. If newByteLength < 0 or newByteLength > O.[[ArrayBufferMaxByteLength]],
+     throw a RangeError exception.
+  7. Let hostHandled be ? HostResizeArrayBuffer(O, newByteLength).
+  [...]
+
+  HostResizeArrayBuffer ( buffer, newByteLength )
+
+  The implementation of HostResizeArrayBuffer must conform to the following
+  requirements:
+
+  - The abstract operation does not detach buffer.
+  - The abstract operation may complete normally or abruptly.
+  - If the abstract operation completes normally with handled,
+    buffer.[[ArrayBufferByteLength]] is newByteLength.
+  - The return value is either handled or unhandled.
+features: [resizable-arraybuffer]
+---*/
+
+var ab = new ArrayBuffer(4, {maxByteLength: 4});
+var caught = false;
+var result;
+
+// If the host chooses to throw as allowed by the specification, the observed
+// behavior will be identical to the case where `ArrayBuffer.prototype.resize`
+// has not been implemented. The following assertion prevents this test from
+// passing in runtimes which have not implemented the method.
+assert.sameValue(typeof ab.resize, 'function');
+
+try {
+  result = ab.resize(3);
+} catch (_) {
+  caught = true;
+}
+
+try {
+  ab.slice();
+} catch (_) {
+  throw new Test262Error('The ArrayBuffer under test was detached');
+}
+
+// One of the following three conditions must be met:
+//
+// - HostResizeArrayBuffer returns an abrupt completion
+// - HostResizeArrayBuffer handles the resize operation and conforms to the
+//   invarient regarding [[ArrayBufferByteLength]]
+// - HostResizeArrayBuffer does not handle the resize operation, and the
+//   `resize` method updates [[ArrayBufferByteLength]]
+//
+// The final two conditions are indistinguishable.
+assert(caught || ab.byteLength === 3, 'byteLength');
+
+// One of the following three conditions must be met:
+//
+// - HostResizeArrayBuffer returns an abrupt completion
+// - HostResizeArrayBuffer handles the resize operation, and the `resize`
+//   method returns early
+// - HostResizeArrayBuffer does not handle the resize operation, and the
+//   `resize` method executes its final steps
+//
+// All three conditions have the same effect on the value of `result`.
+assert.sameValue(result, undefined, 'normal completion value');
+
+// The contents of the ArrayBuffer are not guaranteed by the host-defined
+// abstract operation, so they are not asserted in this test.
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/shell.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/shell.js
new file mode 100644
index 0000000000..06f65290b8
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/shell.js
@@ -0,0 +1,18 @@
+// GENERATED, DO NOT EDIT
+// file: detachArrayBuffer.js
+// Copyright (C) 2016 the V8 project authors.  All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+description: |
+    A function used in the process of asserting correctness of TypedArray objects.
+
+    $262.detachArrayBuffer is defined by a host.
+defines: [$DETACHBUFFER]
+---*/
+
+function $DETACHBUFFER(buffer) {
+  if (!$262 || typeof $262.detachArrayBuffer !== "function") {
+    throw new Test262Error("No method available to detach an ArrayBuffer");
+  }
+  $262.detachArrayBuffer(buffer);
+}
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/this-is-detached.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/this-is-detached.js
new file mode 100644
index 0000000000..c58f1d4217
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/this-is-detached.js
@@ -0,0 +1,30 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.resize
+description: >
+  Throws a TypeError if `this` does not have an [[ArrayBufferData]] internal slot.
+info: |
+  ArrayBuffer.prototype.resize ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, throw a TypeError exception.
+  [...]
+includes: [detachArrayBuffer.js]
+features: [resizable-arraybuffer]
+---*/
+
+assert.sameValue(typeof ArrayBuffer.prototype.resize, 'function');
+
+var ab = new ArrayBuffer(1);
+
+$DETACHBUFFER(ab);
+
+assert.throws(TypeError, function() {
+  ab.resize();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/this-is-not-arraybuffer-object.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/this-is-not-arraybuffer-object.js
new file mode 100644
index 0000000000..473e8c7d99
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/this-is-not-arraybuffer-object.js
@@ -0,0 +1,31 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.resize
+description: >
+  Throws a TypeError if `this` does not have an [[ArrayBufferData]] internal slot.
+info: |
+  ArrayBuffer.prototype.resize ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  [...]
+features: [resizable-arraybuffer]
+---*/
+
+assert.sameValue(typeof ArrayBuffer.prototype.resize, 'function');
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.resize();
+}, '`this` value is the ArrayBuffer prototype');
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.resize.call({});
+}, '`this` value is an object');
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.resize.call([]);
+}, '`this` value is an array');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/this-is-not-object.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/this-is-not-object.js
new file mode 100644
index 0000000000..28ceccfa4d
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/this-is-not-object.js
@@ -0,0 +1,47 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.resize
+description: Throws a TypeError if `this` valueis not an object.
+info: |
+  ArrayBuffer.prototype.resize ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  [...]
+features: [resizable-arraybuffer, Symbol, BigInt]
+---*/
+
+assert.sameValue(typeof ArrayBuffer.prototype.resize, "function");
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.resize.call(undefined);
+}, "`this` value is undefined");
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.resize.call(null);
+}, "`this` value is null");
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.resize.call(true);
+}, "`this` value is Boolean");
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.resize.call("");
+}, "`this` value is String");
+
+var symbol = Symbol();
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.resize.call(symbol);
+}, "`this` value is Symbol");
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.resize.call(1);
+}, "`this` value is Number");
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.resize.call(1n);
+}, "`this` value is bigint");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/this-is-not-resizable-arraybuffer-object.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/this-is-not-resizable-arraybuffer-object.js
new file mode 100644
index 0000000000..586ad2aec3
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/this-is-not-resizable-arraybuffer-object.js
@@ -0,0 +1,41 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.resize
+description: >
+  Throws a TypeError if `this` does not have an [[ArrayBufferMaxByteLength]] internal slot.
+info: |
+  ArrayBuffer.prototype.resize ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  [...]
+features: [resizable-arraybuffer]
+---*/
+
+var ab;
+
+assert.sameValue(typeof ArrayBuffer.prototype.resize, 'function');
+
+ab = new ArrayBuffer(4);
+assert.throws(TypeError, function() {
+  ab.resize(0);
+}, 'zero byte length');
+
+ab = new ArrayBuffer(4);
+assert.throws(TypeError, function() {
+  ab.resize(3);
+}, 'smaller byte length');
+
+ab = new ArrayBuffer(4);
+assert.throws(TypeError, function() {
+  ab.resize(4);
+}, 'same byte length');
+
+ab = new ArrayBuffer(4);
+assert.throws(TypeError, function() {
+  ab.resize(5);
+}, 'larger byte length');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/this-is-sharedarraybuffer.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/this-is-sharedarraybuffer.js
new file mode 100644
index 0000000000..48cb404b63
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/resize/this-is-sharedarraybuffer.js
@@ -0,0 +1,23 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.resize
+description: Throws a TypeError if `this` value is a SharedArrayBuffer
+info: |
+  ArrayBuffer.prototype.resize ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  [...]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var sab = new SharedArrayBuffer(0);
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.resize.call(sab);
+}, '`this` value cannot be a SharedArrayBuffer');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/shell.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/shell.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/shell.js
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/browser.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/browser.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/browser.js
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/context-is-not-arraybuffer-object.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/context-is-not-arraybuffer-object.js
new file mode 100644
index 0000000000..f8e6c77bbe
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/context-is-not-arraybuffer-object.js
@@ -0,0 +1,25 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  Throws a TypeError if `this` does not have an [[ArrayBufferData]] internal slot.
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  1. Let O be the this value.
+  2. If Type(O) is not Object, throw a TypeError exception.
+  3. If O does not have an [[ArrayBufferData]] internal slot, throw a TypeError exception.
+  ...
+---*/
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.slice.call({});
+}, "`this` value is Object");
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.slice.call([]);
+}, "`this` value is Array");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/context-is-not-object.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/context-is-not-object.js
new file mode 100644
index 0000000000..efa7513101
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/context-is-not-object.js
@@ -0,0 +1,41 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  Throws a TypeError if `this` is not an Object.
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  1. Let O be the this value.
+  2. If Type(O) is not Object, throw a TypeError exception.
+  ...
+features: [Symbol]
+---*/
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.slice.call(undefined);
+}, "`this` value is undefined");
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.slice.call(null);
+}, "`this` value is null");
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.slice.call(true);
+}, "`this` value is Boolean");
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.slice.call("");
+}, "`this` value is String");
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.slice.call(Symbol());
+}, "`this` value is Symbol");
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.slice.call(1);
+}, "`this` value is Number");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/descriptor.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/descriptor.js
new file mode 100644
index 0000000000..37458402c0
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/descriptor.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  ArrayBuffer.prototype.slice has default data property attributes.
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  17 ECMAScript Standard Built-in Objects:
+    Every other data property described in clauses 18 through 26 and in
+    Annex B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+verifyNotEnumerable(ArrayBuffer.prototype, "slice");
+verifyWritable(ArrayBuffer.prototype, "slice");
+verifyConfigurable(ArrayBuffer.prototype, "slice");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/end-default-if-absent.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/end-default-if-absent.js
new file mode 100644
index 0000000000..ef3396207d
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/end-default-if-absent.js
@@ -0,0 +1,23 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  The `end` index defaults to [[ArrayBufferByteLength]] if absent.
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  ...
+  9. If end is undefined, let relativeEnd be len; else let relativeEnd be ToInteger(end).
+  10. ReturnIfAbrupt(relativeEnd).
+  ...
+---*/
+
+var arrayBuffer = new ArrayBuffer(8);
+
+var start = 6;
+var result = arrayBuffer.slice(start);
+assert.sameValue(result.byteLength, 2);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/end-default-if-undefined.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/end-default-if-undefined.js
new file mode 100644
index 0000000000..0eb7b9abde
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/end-default-if-undefined.js
@@ -0,0 +1,24 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  The `end` index defaults to [[ArrayBufferByteLength]] if undefined.
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  ...
+  9. If end is undefined, let relativeEnd be len; else let relativeEnd be ToInteger(end).
+  10. ReturnIfAbrupt(relativeEnd).
+  ...
+---*/
+
+var arrayBuffer = new ArrayBuffer(8);
+
+var start = 6,
+  end = undefined;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 2);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/end-exceeds-length.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/end-exceeds-length.js
new file mode 100644
index 0000000000..11694c3aff
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/end-exceeds-length.js
@@ -0,0 +1,33 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  Large `end` index is clamped to [[ArrayBufferByteLength]].
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  ...
+  8. If relativeEnd < 0, let final be max((len + relativeEnd),0); else let final be min(relativeEnd, len).
+  ...
+---*/
+
+var arrayBuffer = new ArrayBuffer(8);
+
+var start = 1,
+  end = 12;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 7, "slice(1, 12)");
+
+var start = 2,
+  end = 0x100000000;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 6, "slice(2, 0x100000000)");
+
+var start = 3,
+  end = +Infinity;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 5, "slice(3, Infinity)");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/extensible.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/extensible.js
new file mode 100644
index 0000000000..1b0f423cf5
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/extensible.js
@@ -0,0 +1,18 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  ArrayBuffer.prototype.slice is extensible.
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  17 ECMAScript Standard Built-in Objects:
+    Unless specified otherwise, the [[Extensible]] internal slot
+    of a built-in object initially has the value true.
+---*/
+
+assert(Object.isExtensible(ArrayBuffer.prototype.slice));
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/length.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/length.js
new file mode 100644
index 0000000000..e2a15cec4a
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/length.js
@@ -0,0 +1,31 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  ArrayBuffer.prototype.slice.length is 2.
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  17 ECMAScript Standard Built-in Objects:
+    Every built-in Function object, including constructors, has a length
+    property whose value is an integer. Unless otherwise specified, this
+    value is equal to the largest number of named arguments shown in the
+    subclause headings for the function description, including optional
+    parameters. However, rest parameters shown using the form “...name”
+    are not included in the default argument count.
+
+    Unless otherwise specified, the length property of a built-in Function
+    object has the attributes { [[Writable]]: false, [[Enumerable]]: false,
+    [[Configurable]]: true }.
+includes: [propertyHelper.js]
+---*/
+
+assert.sameValue(ArrayBuffer.prototype.slice.length, 2);
+
+verifyNotEnumerable(ArrayBuffer.prototype.slice, "length");
+verifyNotWritable(ArrayBuffer.prototype.slice, "length");
+verifyConfigurable(ArrayBuffer.prototype.slice, "length");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/name.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/name.js
new file mode 100644
index 0000000000..f80ab724da
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/name.js
@@ -0,0 +1,28 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  ArrayBuffer.prototype.slice.name is "slice".
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  17 ECMAScript Standard Built-in Objects:
+    Every built-in Function object, including constructors, that is not
+    identified as an anonymous function has a name property whose value
+    is a String.
+
+    Unless otherwise specified, the name property of a built-in Function
+    object, if it exists, has the attributes { [[Writable]]: false,
+    [[Enumerable]]: false, [[Configurable]]: true }.
+includes: [propertyHelper.js]
+---*/
+
+assert.sameValue(ArrayBuffer.prototype.slice.name, "slice");
+
+verifyNotEnumerable(ArrayBuffer.prototype.slice, "name");
+verifyNotWritable(ArrayBuffer.prototype.slice, "name");
+verifyConfigurable(ArrayBuffer.prototype.slice, "name");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/negative-end.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/negative-end.js
new file mode 100644
index 0000000000..0fa6385871
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/negative-end.js
@@ -0,0 +1,33 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  Negative `end` index is relative to [[ArrayBufferByteLength]].
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  ...
+  8. If relativeEnd < 0, let final be max((len + relativeEnd),0); else let final be min(relativeEnd, len).
+  ...
+---*/
+
+var arrayBuffer = new ArrayBuffer(8);
+
+var start = 2,
+  end = -4;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 2, "slice(2, -4)");
+
+var start = 2,
+  end = -10;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 0, "slice(2, -10)");
+
+var start = 2,
+  end = -Infinity;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 0, "slice(2, -Infinity)");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/negative-start.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/negative-start.js
new file mode 100644
index 0000000000..6beac51f68
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/negative-start.js
@@ -0,0 +1,33 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  Negative `start` index is relative to [[ArrayBufferByteLength]].
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  ...
+  8. If relativeStart < 0, let first be max((len + relativeStart),0); else let first be min(relativeStart, len).
+  ...
+---*/
+
+var arrayBuffer = new ArrayBuffer(8);
+
+var start = -5,
+  end = 6;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 3, "slice(-5, 6)");
+
+var start = -12,
+  end = 6;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 6, "slice(-12, 6)");
+
+var start = -Infinity,
+  end = 6;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 6, "slice(-Infinity, 6)");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/nonconstructor.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/nonconstructor.js
new file mode 100644
index 0000000000..60466b1827
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/nonconstructor.js
@@ -0,0 +1,26 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  ArrayBuffer.prototype.slice is not a constructor function.
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  17 ECMAScript Standard Built-in Objects:
+    Built-in function objects that are not identified as constructors do not
+    implement the [[Construct]] internal method unless otherwise specified
+    in the description of a particular function.
+includes: [isConstructor.js]
+features: [Reflect.construct]
+---*/
+
+assert(!isConstructor(ArrayBuffer.prototype.slice), "ArrayBuffer.prototype.slice is not a constructor");
+
+var arrayBuffer = new ArrayBuffer(8);
+assert.throws(TypeError, function() {
+  new arrayBuffer.slice();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/not-a-constructor.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/not-a-constructor.js
new file mode 100644
index 0000000000..06ff78c2aa
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/not-a-constructor.js
@@ -0,0 +1,35 @@
+// Copyright (C) 2020 Rick Waldron. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-ecmascript-standard-built-in-objects
+description: >
+  ArrayBuffer.prototype.slice does not implement [[Construct]], is not new-able
+info: |
+  ECMAScript Function Objects
+
+  Built-in function objects that are not identified as constructors do not
+  implement the [[Construct]] internal method unless otherwise specified in
+  the description of a particular function.
+
+  sec-evaluatenew
+
+  ...
+  7. If IsConstructor(constructor) is false, throw a TypeError exception.
+  ...
+includes: [isConstructor.js]
+features: [Reflect.construct, ArrayBuffer, arrow-function]
+---*/
+
+assert.sameValue(
+  isConstructor(ArrayBuffer.prototype.slice),
+  false,
+  'isConstructor(ArrayBuffer.prototype.slice) must return false'
+);
+
+assert.throws(TypeError, () => {
+  let ab = new ArrayBuffer(); new ab.slice();
+}, '`let ab = new ArrayBuffer(); new ab.slice()` throws TypeError');
+
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/number-conversion.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/number-conversion.js
new file mode 100644
index 0000000000..4c32f6f171
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/number-conversion.js
@@ -0,0 +1,39 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  ToInteger(start) is called before ToInteger(end).
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  ...
+  6. Let relativeStart be ToInteger(start).
+  7. ReturnIfAbrupt(relativeStart).
+  ...
+  9. If end is undefined, let relativeEnd be len; else let relativeEnd be ToInteger(end).
+  10. ReturnIfAbrupt(relativeEnd).
+  ...
+---*/
+
+var arrayBuffer = new ArrayBuffer(8);
+
+var log = "";
+var start = {
+  valueOf: function() {
+    log += "start-";
+    return 0;
+  }
+};
+var end = {
+  valueOf: function() {
+    log += "end";
+    return 8;
+  }
+};
+
+arrayBuffer.slice(start, end);
+assert.sameValue(log, "start-end");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/shell.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/shell.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/shell.js
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-constructor-is-not-object.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-constructor-is-not-object.js
new file mode 100644
index 0000000000..c2e1c571c5
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-constructor-is-not-object.js
@@ -0,0 +1,47 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  Throws TypeError if `constructor` property is not an object.
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  ...
+  13. Let ctor be SpeciesConstructor(O, %ArrayBuffer%).
+  14. ReturnIfAbrupt(ctor).
+  ...
+
+  7.3.20 SpeciesConstructor ( O, defaultConstructor )
+    ...
+    2. Let C be Get(O, "constructor").
+    3. ReturnIfAbrupt(C).
+    4. If C is undefined, return defaultConstructor.
+    5. If Type(C) is not Object, throw a TypeError exception.
+    ...
+features: [Symbol]
+---*/
+
+var arrayBuffer = new ArrayBuffer(8);
+
+function callSlice() {
+  arrayBuffer.slice();
+}
+
+arrayBuffer.constructor = null;
+assert.throws(TypeError, callSlice, "`constructor` value is null");
+
+arrayBuffer.constructor = true;
+assert.throws(TypeError, callSlice, "`constructor` value is Boolean");
+
+arrayBuffer.constructor = "";
+assert.throws(TypeError, callSlice, "`constructor` value is String");
+
+arrayBuffer.constructor = Symbol();
+assert.throws(TypeError, callSlice, "`constructor` value is Symbol");
+
+arrayBuffer.constructor = 1;
+assert.throws(TypeError, callSlice, "`constructor` value is Number");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-constructor-is-undefined.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-constructor-is-undefined.js
new file mode 100644
index 0000000000..78cd3703aa
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-constructor-is-undefined.js
@@ -0,0 +1,30 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  Uses default constructor is `constructor` property is undefined.
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  ...
+  13. Let ctor be SpeciesConstructor(O, %ArrayBuffer%).
+  14. ReturnIfAbrupt(ctor).
+  ...
+
+  7.3.20 SpeciesConstructor ( O, defaultConstructor )
+    ...
+    2. Let C be Get(O, "constructor").
+    3. ReturnIfAbrupt(C).
+    4. If C is undefined, return defaultConstructor.
+    ...
+---*/
+
+var arrayBuffer = new ArrayBuffer(8);
+arrayBuffer.constructor = undefined;
+
+var result = arrayBuffer.slice();
+assert.sameValue(Object.getPrototypeOf(result), ArrayBuffer.prototype);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-is-not-constructor.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-is-not-constructor.js
new file mode 100644
index 0000000000..d8ff5ae6ab
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-is-not-constructor.js
@@ -0,0 +1,41 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  Throws a TypeError if species constructor is not a constructor function.
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  ...
+  13. Let ctor be SpeciesConstructor(O, %ArrayBuffer%).
+  14. ReturnIfAbrupt(ctor).
+  ...
+
+  7.3.20 SpeciesConstructor ( O, defaultConstructor )
+    ...
+    6. Let S be Get(C, @@species).
+    7. ReturnIfAbrupt(S).
+    ...
+    9. If IsConstructor(S) is true, return S.
+    10. Throw a TypeError exception.
+features: [Symbol.species]
+---*/
+
+var speciesConstructor = {};
+
+var arrayBuffer = new ArrayBuffer(8);
+arrayBuffer.constructor = speciesConstructor;
+
+function callSlice() {
+  arrayBuffer.slice();
+}
+
+speciesConstructor[Symbol.species] = {};
+assert.throws(TypeError, callSlice, "`constructor[Symbol.species]` value is Object");
+
+speciesConstructor[Symbol.species] = Function.prototype;
+assert.throws(TypeError, callSlice, "`constructor[Symbol.species]` value is Function.prototype");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-is-not-object.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-is-not-object.js
new file mode 100644
index 0000000000..c92ac96a62
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-is-not-object.js
@@ -0,0 +1,47 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  Throws a TypeError if species constructor is not an object.
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  ...
+  13. Let ctor be SpeciesConstructor(O, %ArrayBuffer%).
+  14. ReturnIfAbrupt(ctor).
+  ...
+
+  7.3.20 SpeciesConstructor ( O, defaultConstructor )
+    ...
+    6. Let S be Get(C, @@species).
+    7. ReturnIfAbrupt(S).
+    8. If S is either undefined or null, return defaultConstructor.
+    9. If IsConstructor(S) is true, return S.
+    10. Throw a TypeError exception.
+features: [Symbol.species]
+---*/
+
+var speciesConstructor = {};
+
+var arrayBuffer = new ArrayBuffer(8);
+arrayBuffer.constructor = speciesConstructor;
+
+function callSlice() {
+  arrayBuffer.slice();
+}
+
+speciesConstructor[Symbol.species] = true;
+assert.throws(TypeError, callSlice, "`constructor[Symbol.species]` value is Boolean");
+
+speciesConstructor[Symbol.species] = "";
+assert.throws(TypeError, callSlice, "`constructor[Symbol.species]` value is String");
+
+speciesConstructor[Symbol.species] = Symbol();
+assert.throws(TypeError, callSlice, "`constructor[Symbol.species]` value is Symbol");
+
+speciesConstructor[Symbol.species] = 1;
+assert.throws(TypeError, callSlice, "`constructor[Symbol.species]` value is Number");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-is-null.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-is-null.js
new file mode 100644
index 0000000000..6a78b21fb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-is-null.js
@@ -0,0 +1,34 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  Uses default constructor is species constructor is null.
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  ...
+  13. Let ctor be SpeciesConstructor(O, %ArrayBuffer%).
+  14. ReturnIfAbrupt(ctor).
+  ...
+
+  7.3.20 SpeciesConstructor ( O, defaultConstructor )
+    ...
+    6. Let S be Get(C, @@species).
+    7. ReturnIfAbrupt(S).
+    8. If S is either undefined or null, return defaultConstructor.
+    ...
+features: [Symbol.species]
+---*/
+
+var speciesConstructor = {};
+speciesConstructor[Symbol.species] = null;
+
+var arrayBuffer = new ArrayBuffer(8);
+arrayBuffer.constructor = speciesConstructor;
+
+var result = arrayBuffer.slice();
+assert.sameValue(Object.getPrototypeOf(result), ArrayBuffer.prototype);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-is-undefined.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-is-undefined.js
new file mode 100644
index 0000000000..402ae770e0
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-is-undefined.js
@@ -0,0 +1,34 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  Uses default constructor is species constructor is undefined.
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  ...
+  13. Let ctor be SpeciesConstructor(O, %ArrayBuffer%).
+  14. ReturnIfAbrupt(ctor).
+  ...
+
+  7.3.20 SpeciesConstructor ( O, defaultConstructor )
+    ...
+    6. Let S be Get(C, @@species).
+    7. ReturnIfAbrupt(S).
+    8. If S is either undefined or null, return defaultConstructor.
+    ...
+features: [Symbol.species]
+---*/
+
+var speciesConstructor = {};
+speciesConstructor[Symbol.species] = undefined;
+
+var arrayBuffer = new ArrayBuffer(8);
+arrayBuffer.constructor = speciesConstructor;
+
+var result = arrayBuffer.slice();
+assert.sameValue(Object.getPrototypeOf(result), ArrayBuffer.prototype);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-returns-larger-arraybuffer.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-returns-larger-arraybuffer.js
new file mode 100644
index 0000000000..b2bdfc1fd1
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-returns-larger-arraybuffer.js
@@ -0,0 +1,33 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  Does not throw TypeError if new ArrayBuffer is too large.
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  ...
+  13. Let ctor be SpeciesConstructor(O, %ArrayBuffer%).
+  14. ReturnIfAbrupt(ctor).
+  15. Let new be Construct(ctor, «newLen»).
+  16. ReturnIfAbrupt(new).
+  ...
+  20. If the value of new’s [[ArrayBufferByteLength]] internal slot < newLen, throw a TypeError exception.
+  ...
+features: [Symbol.species]
+---*/
+
+var speciesConstructor = {};
+speciesConstructor[Symbol.species] = function(length) {
+  return new ArrayBuffer(10);
+};
+
+var arrayBuffer = new ArrayBuffer(8);
+arrayBuffer.constructor = speciesConstructor;
+
+var result = arrayBuffer.slice();
+assert.sameValue(result.byteLength, 10);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-returns-not-arraybuffer.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-returns-not-arraybuffer.js
new file mode 100644
index 0000000000..6c5db7aa73
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-returns-not-arraybuffer.js
@@ -0,0 +1,33 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  Throws a TypeError if new object is not an ArrayBuffer instance.
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  ...
+  13. Let ctor be SpeciesConstructor(O, %ArrayBuffer%).
+  14. ReturnIfAbrupt(ctor).
+  15. Let new be Construct(ctor, «newLen»).
+  16. ReturnIfAbrupt(new).
+  17. If new does not have an [[ArrayBufferData]] internal slot, throw a TypeError exception.
+  ...
+features: [Symbol.species]
+---*/
+
+var speciesConstructor = {};
+speciesConstructor[Symbol.species] = function(length) {
+  return {};
+};
+
+var arrayBuffer = new ArrayBuffer(8);
+arrayBuffer.constructor = speciesConstructor;
+
+assert.throws(TypeError, function() {
+  arrayBuffer.slice();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-returns-same-arraybuffer.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-returns-same-arraybuffer.js
new file mode 100644
index 0000000000..19c42b3b34
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-returns-same-arraybuffer.js
@@ -0,0 +1,35 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  Throws a TypeError if species constructor returns `this` value.
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  1. Let O be the this value.
+  ...
+  13. Let ctor be SpeciesConstructor(O, %ArrayBuffer%).
+  14. ReturnIfAbrupt(ctor).
+  15. Let new be Construct(ctor, «newLen»).
+  16. ReturnIfAbrupt(new).
+  ...
+  19. If SameValue(new, O) is true, throw a TypeError exception.
+  ...
+features: [Symbol.species]
+---*/
+
+var speciesConstructor = {};
+speciesConstructor[Symbol.species] = function(length) {
+  return arrayBuffer;
+};
+
+var arrayBuffer = new ArrayBuffer(8);
+arrayBuffer.constructor = speciesConstructor;
+
+assert.throws(TypeError, function() {
+  arrayBuffer.slice();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-returns-smaller-arraybuffer.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-returns-smaller-arraybuffer.js
new file mode 100644
index 0000000000..16bf932716
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species-returns-smaller-arraybuffer.js
@@ -0,0 +1,34 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  Throws a TypeError if new ArrayBuffer is too small.
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  ...
+  13. Let ctor be SpeciesConstructor(O, %ArrayBuffer%).
+  14. ReturnIfAbrupt(ctor).
+  15. Let new be Construct(ctor, «newLen»).
+  16. ReturnIfAbrupt(new).
+  ...
+  20. If the value of new’s [[ArrayBufferByteLength]] internal slot < newLen, throw a TypeError exception.
+  ...
+features: [Symbol.species]
+---*/
+
+var speciesConstructor = {};
+speciesConstructor[Symbol.species] = function(length) {
+  return new ArrayBuffer(4);
+};
+
+var arrayBuffer = new ArrayBuffer(8);
+arrayBuffer.constructor = speciesConstructor;
+
+assert.throws(TypeError, function() {
+  arrayBuffer.slice();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species.js
new file mode 100644
index 0000000000..13e8f1ce65
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/species.js
@@ -0,0 +1,34 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  New ArrayBuffer instance is created from SpeciesConstructor.
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  ...
+  13. Let ctor be SpeciesConstructor(O, %ArrayBuffer%).
+  14. ReturnIfAbrupt(ctor).
+  15. Let new be Construct(ctor, «newLen»).
+  16. ReturnIfAbrupt(new).
+  ...
+  26. Return new.
+features: [Symbol.species]
+---*/
+
+var resultBuffer;
+
+var speciesConstructor = {};
+speciesConstructor[Symbol.species] = function(length) {
+  return resultBuffer = new ArrayBuffer(length);
+};
+
+var arrayBuffer = new ArrayBuffer(8);
+arrayBuffer.constructor = speciesConstructor;
+
+var result = arrayBuffer.slice();
+assert.sameValue(result, resultBuffer);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/start-default-if-absent.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/start-default-if-absent.js
new file mode 100644
index 0000000000..b90f347020
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/start-default-if-absent.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  The `start` index defaults to 0 if absent.
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  ...
+  6. Let relativeStart be ToInteger(start).
+  7. ReturnIfAbrupt(relativeStart).
+  ...
+---*/
+
+var arrayBuffer = new ArrayBuffer(8);
+
+var result = arrayBuffer.slice();
+assert.sameValue(result.byteLength, 8);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/start-default-if-undefined.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/start-default-if-undefined.js
new file mode 100644
index 0000000000..a45e5bd325
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/start-default-if-undefined.js
@@ -0,0 +1,24 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  The `start` index defaults to 0 if undefined.
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  ...
+  6. Let relativeStart be ToInteger(start).
+  7. ReturnIfAbrupt(relativeStart).
+  ...
+---*/
+
+var arrayBuffer = new ArrayBuffer(8);
+
+var start = undefined,
+  end = 6;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 6);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/start-exceeds-end.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/start-exceeds-end.js
new file mode 100644
index 0000000000..30ad862191
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/start-exceeds-end.js
@@ -0,0 +1,23 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  Returns zero-length buffer if `start` index exceeds `end` index.
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  ...
+  12. Let newLen be max(final-first,0).
+  ...
+---*/
+
+var arrayBuffer = new ArrayBuffer(8);
+
+var start = 5,
+  end = 4;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 0);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/start-exceeds-length.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/start-exceeds-length.js
new file mode 100644
index 0000000000..7d09edc0e5
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/start-exceeds-length.js
@@ -0,0 +1,33 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  Large `start` index is clamped to [[ArrayBufferByteLength]].
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  ...
+  8. If relativeStart < 0, let first be max((len + relativeStart),0); else let first be min(relativeStart, len).
+  ...
+---*/
+
+var arrayBuffer = new ArrayBuffer(8);
+
+var start = 10,
+  end = 8;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 0, "slice(10, 8)");
+
+var start = 0x100000000,
+  end = 7;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 0, "slice(0x100000000, 7)");
+
+var start = +Infinity,
+  end = 6;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 0, "slice(+Infinity, 6)");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/this-is-sharedarraybuffer.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/this-is-sharedarraybuffer.js
new file mode 100644
index 0000000000..4fb55facb0
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/this-is-sharedarraybuffer.js
@@ -0,0 +1,17 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  Throws a TypeError if `this` is a SharedArrayBuffer
+features: [SharedArrayBuffer]
+---*/
+
+assert.throws(TypeError, function() {
+  var sab = new SharedArrayBuffer(0);
+  ArrayBuffer.prototype.slice.call(sab);
+}, "`this` value cannot be a SharedArrayBuffer");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/tointeger-conversion-end.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/tointeger-conversion-end.js
new file mode 100644
index 0000000000..2694658e8a
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/tointeger-conversion-end.js
@@ -0,0 +1,29 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  The `end` index parameter is converted to an integral numeric value.
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  ...
+  9. If end is undefined, let relativeEnd be len; else let relativeEnd be ToInteger(end).
+  10. ReturnIfAbrupt(relativeEnd).
+  ...
+---*/
+
+var arrayBuffer = new ArrayBuffer(8);
+
+var start = 0,
+  end = 4.5;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 4, "slice(0, 4.5)");
+
+var start = 0,
+  end = NaN;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 0, "slice(0, NaN)");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/tointeger-conversion-start.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/tointeger-conversion-start.js
new file mode 100644
index 0000000000..0b13d6efa7
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/tointeger-conversion-start.js
@@ -0,0 +1,29 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer.prototype.slice
+description: >
+  The `start` index parameter is converted to an integral numeric value.
+info: |
+  ArrayBuffer.prototype.slice ( start, end )
+
+  ...
+  6. Let relativeStart be ToInteger(start).
+  7. ReturnIfAbrupt(relativeStart).
+  ...
+---*/
+
+var arrayBuffer = new ArrayBuffer(8);
+
+var start = 4.5,
+  end = 8;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 4, "slice(4.5, 8)");
+
+var start = NaN,
+  end = 8;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 8, "slice(NaN, 8)");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/browser.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/browser.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/browser.js
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/descriptor.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/descriptor.js
new file mode 100644
index 0000000000..dbe4cb2b97
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/descriptor.js
@@ -0,0 +1,24 @@
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfer
+description: >
+  ArrayBuffer.prototype.transfer has default data property attributes.
+info: |
+  ArrayBuffer.prototype.transfer ( [ newLength ] )
+
+  17 ECMAScript Standard Built-in Objects:
+    Every other data property described in clauses 18 through 26 and in
+    Annex B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+features: [arraybuffer-transfer]
+---*/
+
+verifyProperty(ArrayBuffer.prototype, 'transfer', {
+  enumerable: false,
+  writable: true,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/extensible.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/extensible.js
new file mode 100644
index 0000000000..27902e9fe6
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/extensible.js
@@ -0,0 +1,17 @@
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfer
+description: ArrayBuffer.prototype.transfer is extensible.
+info: |
+  ArrayBuffer.prototype.transfer ( [ newLength ] )
+
+  17 ECMAScript Standard Built-in Objects:
+    Unless specified otherwise, the [[Extensible]] internal slot
+    of a built-in object initially has the value true.
+features: [arraybuffer-transfer]
+---*/
+
+assert(Object.isExtensible(ArrayBuffer.prototype.transfer));
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-fixed-to-larger-no-resizable.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-fixed-to-larger-no-resizable.js
new file mode 100644
index 0000000000..0d8c738b8c
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-fixed-to-larger-no-resizable.js
@@ -0,0 +1,59 @@
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfer
+description: Transfering from a fixed-size ArrayBuffer into a larger ArrayBuffer
+info: |
+  ArrayBuffer.prototype.transfer ( [ newLength ] )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, throw a TypeError exception.
+  5. If newLength is undefined, let newByteLength be
+     O.[[ArrayBufferByteLength]].
+  6. Else, let newByteLength be ? ToIntegerOrInfinity(newLength).
+  7. Let new be ? Construct(%ArrayBuffer%, « 𝔽(newByteLength) »).
+  8. NOTE: This method returns a fixed-length ArrayBuffer.
+  9. Let copyLength be min(newByteLength, O.[[ArrayBufferByteLength]]).
+  10. Let fromBlock be O.[[ArrayBufferData]].
+  11. Let toBlock be new.[[ArrayBufferData]].
+  12. Perform CopyDataBlockBytes(toBlock, 0, fromBlock, 0, copyLength).
+  13. NOTE: Neither creation of the new Data Block nor copying from the old
+      Data Block are observable. Implementations reserve the right to implement
+      this method as a zero-copy move or a realloc.
+  14. Perform ! DetachArrayBuffer(O).
+  15. Return new.
+features: [arraybuffer-transfer]
+---*/
+
+// NOTE: This file is a copy of "from-fixed-to-larger.js" with the resizable
+// ArrayBuffer parts removed, so it can run in implementations which don't yet
+// support the "resizable-arraybuffer" feature.
+
+var source = new ArrayBuffer(4);
+
+var sourceArray = new Uint8Array(source);
+sourceArray[0] = 1;
+sourceArray[1] = 2;
+sourceArray[2] = 3;
+sourceArray[3] = 4;
+
+var dest = source.transfer(5);
+
+assert.sameValue(source.byteLength, 0, 'source.byteLength');
+assert.throws(TypeError, function() {
+  source.slice();
+});
+
+assert.sameValue(dest.byteLength, 5, 'dest.byteLength');
+
+var destArray = new Uint8Array(dest);
+
+assert.sameValue(destArray[0], 1, 'destArray[0]');
+assert.sameValue(destArray[1], 2, 'destArray[1]');
+assert.sameValue(destArray[2], 3, 'destArray[2]');
+assert.sameValue(destArray[3], 4, 'destArray[3]');
+assert.sameValue(destArray[4], 0, 'destArray[4]');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-fixed-to-larger.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-fixed-to-larger.js
new file mode 100644
index 0000000000..5c834d1573
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-fixed-to-larger.js
@@ -0,0 +1,58 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfer
+description: Transfering from a fixed-size ArrayBuffer into a larger ArrayBuffer
+info: |
+  ArrayBuffer.prototype.transfer ( [ newLength ] )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, throw a TypeError exception.
+  5. If newLength is undefined, let newByteLength be
+     O.[[ArrayBufferByteLength]].
+  6. Else, let newByteLength be ? ToIntegerOrInfinity(newLength).
+  7. Let new be ? Construct(%ArrayBuffer%, « 𝔽(newByteLength) »).
+  8. NOTE: This method returns a fixed-length ArrayBuffer.
+  9. Let copyLength be min(newByteLength, O.[[ArrayBufferByteLength]]).
+  10. Let fromBlock be O.[[ArrayBufferData]].
+  11. Let toBlock be new.[[ArrayBufferData]].
+  12. Perform CopyDataBlockBytes(toBlock, 0, fromBlock, 0, copyLength).
+  13. NOTE: Neither creation of the new Data Block nor copying from the old
+      Data Block are observable. Implementations reserve the right to implement
+      this method as a zero-copy move or a realloc.
+  14. Perform ! DetachArrayBuffer(O).
+  15. Return new.
+features: [resizable-arraybuffer, arraybuffer-transfer]
+---*/
+
+var source = new ArrayBuffer(4);
+
+var sourceArray = new Uint8Array(source);
+sourceArray[0] = 1;
+sourceArray[1] = 2;
+sourceArray[2] = 3;
+sourceArray[3] = 4;
+
+var dest = source.transfer(5);
+
+assert.sameValue(source.byteLength, 0, 'source.byteLength');
+assert.throws(TypeError, function() {
+  source.slice();
+});
+
+assert.sameValue(dest.resizable, false, 'dest.resizable');
+assert.sameValue(dest.byteLength, 5, 'dest.byteLength');
+assert.sameValue(dest.maxByteLength, 5, 'dest.maxByteLength');
+
+var destArray = new Uint8Array(dest);
+
+assert.sameValue(destArray[0], 1, 'destArray[0]');
+assert.sameValue(destArray[1], 2, 'destArray[1]');
+assert.sameValue(destArray[2], 3, 'destArray[2]');
+assert.sameValue(destArray[3], 4, 'destArray[3]');
+assert.sameValue(destArray[4], 0, 'destArray[4]');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-fixed-to-same-no-resizable.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-fixed-to-same-no-resizable.js
new file mode 100644
index 0000000000..bd33a2575b
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-fixed-to-same-no-resizable.js
@@ -0,0 +1,60 @@
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfer
+description: |
+  Transfering from a fixed-size ArrayBuffer into an ArrayBuffer with the same
+  byte length
+info: |
+  ArrayBuffer.prototype.transfer ( [ newLength ] )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, throw a TypeError exception.
+  5. If newLength is undefined, let newByteLength be
+     O.[[ArrayBufferByteLength]].
+  6. Else, let newByteLength be ? ToIntegerOrInfinity(newLength).
+  7. Let new be ? Construct(%ArrayBuffer%, « 𝔽(newByteLength) »).
+  8. NOTE: This method returns a fixed-length ArrayBuffer.
+  9. Let copyLength be min(newByteLength, O.[[ArrayBufferByteLength]]).
+  10. Let fromBlock be O.[[ArrayBufferData]].
+  11. Let toBlock be new.[[ArrayBufferData]].
+  12. Perform CopyDataBlockBytes(toBlock, 0, fromBlock, 0, copyLength).
+  13. NOTE: Neither creation of the new Data Block nor copying from the old
+      Data Block are observable. Implementations reserve the right to implement
+      this method as a zero-copy move or a realloc.
+  14. Perform ! DetachArrayBuffer(O).
+  15. Return new.
+features: [arraybuffer-transfer]
+---*/
+
+// NOTE: This file is a copy of "from-fixed-to-same.js" with the resizable
+// ArrayBuffer parts removed, so it can run in implementations which don't yet
+// support the "resizable-arraybuffer" feature.
+
+var source = new ArrayBuffer(4);
+
+var sourceArray = new Uint8Array(source);
+sourceArray[0] = 1;
+sourceArray[1] = 2;
+sourceArray[2] = 3;
+sourceArray[3] = 4;
+
+var dest = source.transfer();
+
+assert.sameValue(source.byteLength, 0, 'source.byteLength');
+assert.throws(TypeError, function() {
+  source.slice();
+});
+
+assert.sameValue(dest.byteLength, 4, 'dest.byteLength');
+
+var destArray = new Uint8Array(dest);
+
+assert.sameValue(destArray[0], 1, 'destArray[0]');
+assert.sameValue(destArray[1], 2, 'destArray[1]');
+assert.sameValue(destArray[2], 3, 'destArray[2]');
+assert.sameValue(destArray[3], 4, 'destArray[3]');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-fixed-to-same.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-fixed-to-same.js
new file mode 100644
index 0000000000..f988fd3346
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-fixed-to-same.js
@@ -0,0 +1,59 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfer
+description: |
+  Transfering from a fixed-size ArrayBuffer into an ArrayBuffer with the same
+  byte length
+info: |
+  ArrayBuffer.prototype.transfer ( [ newLength ] )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, throw a TypeError exception.
+  5. If newLength is undefined, let newByteLength be
+     O.[[ArrayBufferByteLength]].
+  6. Else, let newByteLength be ? ToIntegerOrInfinity(newLength).
+  7. Let new be ? Construct(%ArrayBuffer%, « 𝔽(newByteLength) »).
+  8. NOTE: This method returns a fixed-length ArrayBuffer.
+  9. Let copyLength be min(newByteLength, O.[[ArrayBufferByteLength]]).
+  10. Let fromBlock be O.[[ArrayBufferData]].
+  11. Let toBlock be new.[[ArrayBufferData]].
+  12. Perform CopyDataBlockBytes(toBlock, 0, fromBlock, 0, copyLength).
+  13. NOTE: Neither creation of the new Data Block nor copying from the old
+      Data Block are observable. Implementations reserve the right to implement
+      this method as a zero-copy move or a realloc.
+  14. Perform ! DetachArrayBuffer(O).
+  15. Return new.
+features: [resizable-arraybuffer, arraybuffer-transfer]
+---*/
+
+var source = new ArrayBuffer(4);
+
+var sourceArray = new Uint8Array(source);
+sourceArray[0] = 1;
+sourceArray[1] = 2;
+sourceArray[2] = 3;
+sourceArray[3] = 4;
+
+var dest = source.transfer();
+
+assert.sameValue(source.byteLength, 0, 'source.byteLength');
+assert.throws(TypeError, function() {
+  source.slice();
+});
+
+assert.sameValue(dest.resizable, false, 'dest.resizable');
+assert.sameValue(dest.byteLength, 4, 'dest.byteLength');
+assert.sameValue(dest.maxByteLength, 4, 'dest.maxByteLength');
+
+var destArray = new Uint8Array(dest);
+
+assert.sameValue(destArray[0], 1, 'destArray[0]');
+assert.sameValue(destArray[1], 2, 'destArray[1]');
+assert.sameValue(destArray[2], 3, 'destArray[2]');
+assert.sameValue(destArray[3], 4, 'destArray[3]');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-fixed-to-smaller-no-resizable.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-fixed-to-smaller-no-resizable.js
new file mode 100644
index 0000000000..8dac703e5d
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-fixed-to-smaller-no-resizable.js
@@ -0,0 +1,57 @@
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfer
+description: Transfering from a fixed-size ArrayBuffer into a smaller ArrayBuffer
+info: |
+  ArrayBuffer.prototype.transfer ( [ newLength ] )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, throw a TypeError exception.
+  5. If newLength is undefined, let newByteLength be
+     O.[[ArrayBufferByteLength]].
+  6. Else, let newByteLength be ? ToIntegerOrInfinity(newLength).
+  7. Let new be ? Construct(%ArrayBuffer%, « 𝔽(newByteLength) »).
+  8. NOTE: This method returns a fixed-length ArrayBuffer.
+  9. Let copyLength be min(newByteLength, O.[[ArrayBufferByteLength]]).
+  10. Let fromBlock be O.[[ArrayBufferData]].
+  11. Let toBlock be new.[[ArrayBufferData]].
+  12. Perform CopyDataBlockBytes(toBlock, 0, fromBlock, 0, copyLength).
+  13. NOTE: Neither creation of the new Data Block nor copying from the old
+      Data Block are observable. Implementations reserve the right to implement
+      this method as a zero-copy move or a realloc.
+  14. Perform ! DetachArrayBuffer(O).
+  15. Return new.
+features: [arraybuffer-transfer]
+---*/
+
+// NOTE: This file is a copy of "from-fixed-to-smaller.js" with the resizable
+// ArrayBuffer parts removed, so it can run in implementations which don't yet
+// support the "resizable-arraybuffer" feature.
+
+var source = new ArrayBuffer(4);
+
+var sourceArray = new Uint8Array(source);
+sourceArray[0] = 1;
+sourceArray[1] = 2;
+sourceArray[2] = 3;
+sourceArray[3] = 4;
+
+var dest = source.transfer(3);
+
+assert.sameValue(source.byteLength, 0, 'source.byteLength');
+assert.throws(TypeError, function() {
+  source.slice();
+});
+
+assert.sameValue(dest.byteLength, 3, 'dest.byteLength');
+
+var destArray = new Uint8Array(dest);
+
+assert.sameValue(destArray[0], 1, 'destArray[0]');
+assert.sameValue(destArray[1], 2, 'destArray[1]');
+assert.sameValue(destArray[2], 3, 'destArray[2]');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-fixed-to-smaller.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-fixed-to-smaller.js
new file mode 100644
index 0000000000..2380c0a1c5
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-fixed-to-smaller.js
@@ -0,0 +1,56 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfer
+description: Transfering from a fixed-size ArrayBuffer into a smaller ArrayBuffer
+info: |
+  ArrayBuffer.prototype.transfer ( [ newLength ] )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, throw a TypeError exception.
+  5. If newLength is undefined, let newByteLength be
+     O.[[ArrayBufferByteLength]].
+  6. Else, let newByteLength be ? ToIntegerOrInfinity(newLength).
+  7. Let new be ? Construct(%ArrayBuffer%, « 𝔽(newByteLength) »).
+  8. NOTE: This method returns a fixed-length ArrayBuffer.
+  9. Let copyLength be min(newByteLength, O.[[ArrayBufferByteLength]]).
+  10. Let fromBlock be O.[[ArrayBufferData]].
+  11. Let toBlock be new.[[ArrayBufferData]].
+  12. Perform CopyDataBlockBytes(toBlock, 0, fromBlock, 0, copyLength).
+  13. NOTE: Neither creation of the new Data Block nor copying from the old
+      Data Block are observable. Implementations reserve the right to implement
+      this method as a zero-copy move or a realloc.
+  14. Perform ! DetachArrayBuffer(O).
+  15. Return new.
+features: [resizable-arraybuffer, arraybuffer-transfer]
+---*/
+
+var source = new ArrayBuffer(4);
+
+var sourceArray = new Uint8Array(source);
+sourceArray[0] = 1;
+sourceArray[1] = 2;
+sourceArray[2] = 3;
+sourceArray[3] = 4;
+
+var dest = source.transfer(3);
+
+assert.sameValue(source.byteLength, 0, 'source.byteLength');
+assert.throws(TypeError, function() {
+  source.slice();
+});
+
+assert.sameValue(dest.resizable, false, 'dest.resizable');
+assert.sameValue(dest.byteLength, 3, 'dest.byteLength');
+assert.sameValue(dest.maxByteLength, 3, 'dest.maxByteLength');
+
+var destArray = new Uint8Array(dest);
+
+assert.sameValue(destArray[0], 1, 'destArray[0]');
+assert.sameValue(destArray[1], 2, 'destArray[1]');
+assert.sameValue(destArray[2], 3, 'destArray[2]');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-fixed-to-zero-no-resizable.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-fixed-to-zero-no-resizable.js
new file mode 100644
index 0000000000..268c991a47
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-fixed-to-zero-no-resizable.js
@@ -0,0 +1,51 @@
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfer
+description: Transfering from a fixed-size ArrayBuffer into a zero-length ArrayBuffer
+info: |
+  ArrayBuffer.prototype.transfer ( [ newLength ] )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, throw a TypeError exception.
+  5. If newLength is undefined, let newByteLength be
+     O.[[ArrayBufferByteLength]].
+  6. Else, let newByteLength be ? ToIntegerOrInfinity(newLength).
+  7. Let new be ? Construct(%ArrayBuffer%, « 𝔽(newByteLength) »).
+  8. NOTE: This method returns a fixed-length ArrayBuffer.
+  9. Let copyLength be min(newByteLength, O.[[ArrayBufferByteLength]]).
+  10. Let fromBlock be O.[[ArrayBufferData]].
+  11. Let toBlock be new.[[ArrayBufferData]].
+  12. Perform CopyDataBlockBytes(toBlock, 0, fromBlock, 0, copyLength).
+  13. NOTE: Neither creation of the new Data Block nor copying from the old
+      Data Block are observable. Implementations reserve the right to implement
+      this method as a zero-copy move or a realloc.
+  14. Perform ! DetachArrayBuffer(O).
+  15. Return new.
+features: [arraybuffer-transfer]
+---*/
+
+// NOTE: This file is a copy of "from-fixed-to-zero.js" with the resizable
+// ArrayBuffer parts removed, so it can run in implementations which don't yet
+// support the "resizable-arraybuffer" feature.
+
+var source = new ArrayBuffer(4);
+
+var sourceArray = new Uint8Array(source);
+sourceArray[0] = 1;
+sourceArray[1] = 2;
+sourceArray[2] = 3;
+sourceArray[3] = 4;
+
+var dest = source.transfer(0);
+
+assert.sameValue(source.byteLength, 0, 'source.byteLength');
+assert.throws(TypeError, function() {
+  source.slice();
+});
+
+assert.sameValue(dest.byteLength, 0, 'dest.byteLength');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-fixed-to-zero.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-fixed-to-zero.js
new file mode 100644
index 0000000000..a76368596d
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-fixed-to-zero.js
@@ -0,0 +1,50 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfer
+description: Transfering from a fixed-size ArrayBuffer into a zero-length ArrayBuffer
+info: |
+  ArrayBuffer.prototype.transfer ( [ newLength ] )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, throw a TypeError exception.
+  5. If newLength is undefined, let newByteLength be
+     O.[[ArrayBufferByteLength]].
+  6. Else, let newByteLength be ? ToIntegerOrInfinity(newLength).
+  7. Let new be ? Construct(%ArrayBuffer%, « 𝔽(newByteLength) »).
+  8. NOTE: This method returns a fixed-length ArrayBuffer.
+  9. Let copyLength be min(newByteLength, O.[[ArrayBufferByteLength]]).
+  10. Let fromBlock be O.[[ArrayBufferData]].
+  11. Let toBlock be new.[[ArrayBufferData]].
+  12. Perform CopyDataBlockBytes(toBlock, 0, fromBlock, 0, copyLength).
+  13. NOTE: Neither creation of the new Data Block nor copying from the old
+      Data Block are observable. Implementations reserve the right to implement
+      this method as a zero-copy move or a realloc.
+  14. Perform ! DetachArrayBuffer(O).
+  15. Return new.
+features: [resizable-arraybuffer, arraybuffer-transfer]
+---*/
+
+var source = new ArrayBuffer(4);
+
+var sourceArray = new Uint8Array(source);
+sourceArray[0] = 1;
+sourceArray[1] = 2;
+sourceArray[2] = 3;
+sourceArray[3] = 4;
+
+var dest = source.transfer(0);
+
+assert.sameValue(source.byteLength, 0, 'source.byteLength');
+assert.throws(TypeError, function() {
+  source.slice();
+});
+
+assert.sameValue(dest.resizable, false, 'dest.resizable');
+assert.sameValue(dest.byteLength, 0, 'dest.byteLength');
+assert.sameValue(dest.maxByteLength, 0, 'dest.maxByteLength');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-resizable-to-larger.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-resizable-to-larger.js
new file mode 100644
index 0000000000..07f564471a
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-resizable-to-larger.js
@@ -0,0 +1,58 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfer
+description: Transfering from a resizable ArrayBuffer into a larger ArrayBuffer
+info: |
+  ArrayBuffer.prototype.transfer ( [ newLength ] )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, throw a TypeError exception.
+  5. If newLength is undefined, let newByteLength be
+     O.[[ArrayBufferByteLength]].
+  6. Else, let newByteLength be ? ToIntegerOrInfinity(newLength).
+  7. Let new be ? Construct(%ArrayBuffer%, « 𝔽(newByteLength) »).
+  8. NOTE: This method returns a fixed-length ArrayBuffer.
+  9. Let copyLength be min(newByteLength, O.[[ArrayBufferByteLength]]).
+  10. Let fromBlock be O.[[ArrayBufferData]].
+  11. Let toBlock be new.[[ArrayBufferData]].
+  12. Perform CopyDataBlockBytes(toBlock, 0, fromBlock, 0, copyLength).
+  13. NOTE: Neither creation of the new Data Block nor copying from the old
+      Data Block are observable. Implementations reserve the right to implement
+      this method as a zero-copy move or a realloc.
+  14. Perform ! DetachArrayBuffer(O).
+  15. Return new.
+features: [resizable-arraybuffer, arraybuffer-transfer]
+---*/
+
+var source = new ArrayBuffer(4, { maxByteLength: 8 });
+
+var sourceArray = new Uint8Array(source);
+sourceArray[0] = 1;
+sourceArray[1] = 2;
+sourceArray[2] = 3;
+sourceArray[3] = 4;
+
+var dest = source.transfer(5);
+
+assert.sameValue(source.byteLength, 0, 'source.byteLength');
+assert.throws(TypeError, function() {
+  source.slice();
+});
+
+assert.sameValue(dest.resizable, true, 'dest.resizable');
+assert.sameValue(dest.byteLength, 5, 'dest.byteLength');
+assert.sameValue(dest.maxByteLength, 8, 'dest.maxByteLength');
+
+var destArray = new Uint8Array(dest);
+
+assert.sameValue(destArray[0], 1, 'destArray[0]');
+assert.sameValue(destArray[1], 2, 'destArray[1]');
+assert.sameValue(destArray[2], 3, 'destArray[2]');
+assert.sameValue(destArray[3], 4, 'destArray[3]');
+assert.sameValue(destArray[4], 0, 'destArray[4]');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-resizable-to-same.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-resizable-to-same.js
new file mode 100644
index 0000000000..af94449217
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-resizable-to-same.js
@@ -0,0 +1,59 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfer
+description: |
+  Transfering from a resizable ArrayBuffer into an ArrayBuffer with the same
+  byte length
+info: |
+  ArrayBuffer.prototype.transfer ( [ newLength ] )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, throw a TypeError exception.
+  5. If newLength is undefined, let newByteLength be
+     O.[[ArrayBufferByteLength]].
+  6. Else, let newByteLength be ? ToIntegerOrInfinity(newLength).
+  7. Let new be ? Construct(%ArrayBuffer%, « 𝔽(newByteLength) »).
+  8. NOTE: This method returns a fixed-length ArrayBuffer.
+  9. Let copyLength be min(newByteLength, O.[[ArrayBufferByteLength]]).
+  10. Let fromBlock be O.[[ArrayBufferData]].
+  11. Let toBlock be new.[[ArrayBufferData]].
+  12. Perform CopyDataBlockBytes(toBlock, 0, fromBlock, 0, copyLength).
+  13. NOTE: Neither creation of the new Data Block nor copying from the old
+      Data Block are observable. Implementations reserve the right to implement
+      this method as a zero-copy move or a realloc.
+  14. Perform ! DetachArrayBuffer(O).
+  15. Return new.
+features: [resizable-arraybuffer, arraybuffer-transfer]
+---*/
+
+var source = new ArrayBuffer(4, { maxByteLength: 8 });
+
+var sourceArray = new Uint8Array(source);
+sourceArray[0] = 1;
+sourceArray[1] = 2;
+sourceArray[2] = 3;
+sourceArray[3] = 4;
+
+var dest = source.transfer();
+
+assert.sameValue(source.byteLength, 0, 'source.byteLength');
+assert.throws(TypeError, function() {
+  source.slice();
+});
+
+assert.sameValue(dest.resizable, true, 'dest.resizable');
+assert.sameValue(dest.byteLength, 4, 'dest.byteLength');
+assert.sameValue(dest.maxByteLength, 8, 'dest.maxByteLength');
+
+var destArray = new Uint8Array(dest);
+
+assert.sameValue(destArray[0], 1, 'destArray[0]');
+assert.sameValue(destArray[1], 2, 'destArray[1]');
+assert.sameValue(destArray[2], 3, 'destArray[2]');
+assert.sameValue(destArray[3], 4, 'destArray[3]');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-resizable-to-smaller.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-resizable-to-smaller.js
new file mode 100644
index 0000000000..14a6259778
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-resizable-to-smaller.js
@@ -0,0 +1,56 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfer
+description: Transfering from a resizable ArrayBuffer into a smaller ArrayBuffer
+info: |
+  ArrayBuffer.prototype.transfer ( [ newLength ] )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, throw a TypeError exception.
+  5. If newLength is undefined, let newByteLength be
+     O.[[ArrayBufferByteLength]].
+  6. Else, let newByteLength be ? ToIntegerOrInfinity(newLength).
+  7. Let new be ? Construct(%ArrayBuffer%, « 𝔽(newByteLength) »).
+  8. NOTE: This method returns a fixed-length ArrayBuffer.
+  9. Let copyLength be min(newByteLength, O.[[ArrayBufferByteLength]]).
+  10. Let fromBlock be O.[[ArrayBufferData]].
+  11. Let toBlock be new.[[ArrayBufferData]].
+  12. Perform CopyDataBlockBytes(toBlock, 0, fromBlock, 0, copyLength).
+  13. NOTE: Neither creation of the new Data Block nor copying from the old
+      Data Block are observable. Implementations reserve the right to implement
+      this method as a zero-copy move or a realloc.
+  14. Perform ! DetachArrayBuffer(O).
+  15. Return new.
+features: [resizable-arraybuffer, arraybuffer-transfer]
+---*/
+
+var source = new ArrayBuffer(4, { maxByteLength: 8 });
+
+var sourceArray = new Uint8Array(source);
+sourceArray[0] = 1;
+sourceArray[1] = 2;
+sourceArray[2] = 3;
+sourceArray[3] = 4;
+
+var dest = source.transfer(3);
+
+assert.sameValue(source.byteLength, 0, 'source.byteLength');
+assert.throws(TypeError, function() {
+  source.slice();
+});
+
+assert.sameValue(dest.resizable, true, 'dest.resizable');
+assert.sameValue(dest.byteLength, 3, 'dest.byteLength');
+assert.sameValue(dest.maxByteLength, 8, 'dest.maxByteLength');
+
+var destArray = new Uint8Array(dest);
+
+assert.sameValue(destArray[0], 1, 'destArray[0]');
+assert.sameValue(destArray[1], 2, 'destArray[1]');
+assert.sameValue(destArray[2], 3, 'destArray[2]');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-resizable-to-zero.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-resizable-to-zero.js
new file mode 100644
index 0000000000..a0371b009c
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/from-resizable-to-zero.js
@@ -0,0 +1,50 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfer
+description: Transfering from a resizable ArrayBuffer into a zero-length ArrayBuffer
+info: |
+  ArrayBuffer.prototype.transfer ( [ newLength ] )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, throw a TypeError exception.
+  5. If newLength is undefined, let newByteLength be
+     O.[[ArrayBufferByteLength]].
+  6. Else, let newByteLength be ? ToIntegerOrInfinity(newLength).
+  7. Let new be ? Construct(%ArrayBuffer%, « 𝔽(newByteLength) »).
+  8. NOTE: This method returns a fixed-length ArrayBuffer.
+  9. Let copyLength be min(newByteLength, O.[[ArrayBufferByteLength]]).
+  10. Let fromBlock be O.[[ArrayBufferData]].
+  11. Let toBlock be new.[[ArrayBufferData]].
+  12. Perform CopyDataBlockBytes(toBlock, 0, fromBlock, 0, copyLength).
+  13. NOTE: Neither creation of the new Data Block nor copying from the old
+      Data Block are observable. Implementations reserve the right to implement
+      this method as a zero-copy move or a realloc.
+  14. Perform ! DetachArrayBuffer(O).
+  15. Return new.
+features: [resizable-arraybuffer, arraybuffer-transfer]
+---*/
+
+var source = new ArrayBuffer(4, { maxByteLength: 8 });
+
+var sourceArray = new Uint8Array(source);
+sourceArray[0] = 1;
+sourceArray[1] = 2;
+sourceArray[2] = 3;
+sourceArray[3] = 4;
+
+var dest = source.transfer(0);
+
+assert.sameValue(source.byteLength, 0, 'source.byteLength');
+assert.throws(TypeError, function() {
+  source.slice();
+});
+
+assert.sameValue(dest.resizable, true, 'dest.resizable');
+assert.sameValue(dest.byteLength, 0, 'dest.byteLength');
+assert.sameValue(dest.maxByteLength, 8, 'dest.maxByteLength');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/length.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/length.js
new file mode 100644
index 0000000000..b7c9e8eedb
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/length.js
@@ -0,0 +1,32 @@
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfer
+description: >
+  ArrayBuffer.prototype.transfer.length is 0.
+info: |
+  ArrayBuffer.prototype.transfer ( [ newLength ] )
+
+  17 ECMAScript Standard Built-in Objects:
+    Every built-in Function object, including constructors, has a length
+    property whose value is an integer. Unless otherwise specified, this
+    value is equal to the largest number of named arguments shown in the
+    subclause headings for the function description, including optional
+    parameters. However, rest parameters shown using the form “...name”
+    are not included in the default argument count.
+
+    Unless otherwise specified, the length property of a built-in Function
+    object has the attributes { [[Writable]]: false, [[Enumerable]]: false,
+    [[Configurable]]: true }.
+includes: [propertyHelper.js]
+features: [arraybuffer-transfer]
+---*/
+
+verifyProperty(ArrayBuffer.prototype.transfer, 'length', {
+  value: 0,
+  enumerable: false,
+  writable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/name.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/name.js
new file mode 100644
index 0000000000..b4c20b07ca
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/name.js
@@ -0,0 +1,29 @@
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfer
+description: >
+  ArrayBuffer.prototype.transfer.name is "transfer".
+info: |
+  ArrayBuffer.prototype.transfer ( [ newLength ] )
+
+  17 ECMAScript Standard Built-in Objects:
+    Every built-in Function object, including constructors, that is not
+    identified as an anonymous function has a name property whose value
+    is a String.
+
+    Unless otherwise specified, the name property of a built-in Function
+    object, if it exists, has the attributes { [[Writable]]: false,
+    [[Enumerable]]: false, [[Configurable]]: true }.
+features: [arraybuffer-transfer]
+includes: [propertyHelper.js]
+---*/
+
+verifyProperty(ArrayBuffer.prototype.transfer, 'name', {
+  value: 'transfer',
+  enumerable: false,
+  writable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/new-length-excessive.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/new-length-excessive.js
new file mode 100644
index 0000000000..d7debd55bf
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/new-length-excessive.js
@@ -0,0 +1,18 @@
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfer
+description: >
+  Throws a RangeError if the newLength is larger than 2^53 - 1 due to clamping
+  in ToIndex.
+features: [arraybuffer-transfer]
+---*/
+
+var ab = new ArrayBuffer(0);
+
+assert.throws(RangeError, function() {
+  // Math.pow(2, 53) = 9007199254740992
+  ab.transfer(9007199254740992);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/new-length-non-number.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/new-length-non-number.js
new file mode 100644
index 0000000000..b5f1de6bf1
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/new-length-non-number.js
@@ -0,0 +1,41 @@
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfer
+description: Throws a TypeError if provided length cannot be coerced to a number
+info: |
+  ArrayBuffer.prototype.transfer ( [ newLength ] )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, throw a TypeError exception.
+  5. If newLength is undefined, let newByteLength be
+     O.[[ArrayBufferByteLength]].
+  6. Else, let newByteLength be ? ToIntegerOrInfinity(newLength).
+  [...]
+features: [arraybuffer-transfer]
+---*/
+
+var log = [];
+var newLength = {
+  toString: function() {
+    log.push('toString');
+    return {};
+  },
+  valueOf: function() {
+    log.push('valueOf');
+    return {};
+  }
+};
+var ab = new ArrayBuffer(0);
+
+assert.throws(TypeError, function() {
+  ab.transfer(newLength);
+});
+
+assert.sameValue(log.length, 2);
+assert.sameValue(log[0], 'valueOf');
+assert.sameValue(log[1], 'toString');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/nonconstructor.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/nonconstructor.js
new file mode 100644
index 0000000000..5d5be42b03
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/nonconstructor.js
@@ -0,0 +1,25 @@
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfer
+description: >
+  ArrayBuffer.prototype.transfer is not a constructor function.
+info: |
+  ArrayBuffer.prototype.transfer ( [ newLength ] )
+
+  17 ECMAScript Standard Built-in Objects:
+    Built-in function objects that are not identified as constructors do not
+    implement the [[Construct]] internal method unless otherwise specified
+    in the description of a particular function.
+includes: [isConstructor.js]
+features: [arraybuffer-transfer, Reflect.construct]
+---*/
+
+assert(!isConstructor(ArrayBuffer.prototype.transfer), "ArrayBuffer.prototype.transfer is not a constructor");
+
+var arrayBuffer = new ArrayBuffer(8);
+assert.throws(TypeError, function() {
+  new arrayBuffer.transfer();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/shell.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/shell.js
new file mode 100644
index 0000000000..06f65290b8
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/shell.js
@@ -0,0 +1,18 @@
+// GENERATED, DO NOT EDIT
+// file: detachArrayBuffer.js
+// Copyright (C) 2016 the V8 project authors.  All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+description: |
+    A function used in the process of asserting correctness of TypedArray objects.
+
+    $262.detachArrayBuffer is defined by a host.
+defines: [$DETACHBUFFER]
+---*/
+
+function $DETACHBUFFER(buffer) {
+  if (!$262 || typeof $262.detachArrayBuffer !== "function") {
+    throw new Test262Error("No method available to detach an ArrayBuffer");
+  }
+  $262.detachArrayBuffer(buffer);
+}
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/this-is-detached.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/this-is-detached.js
new file mode 100644
index 0000000000..9241993b84
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/this-is-detached.js
@@ -0,0 +1,29 @@
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfer
+description: >
+  Throws a TypeError if `this` does not have an [[ArrayBufferData]] internal slot.
+info: |
+  ArrayBuffer.prototype.transfer ( [ newLength ] )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, throw a TypeError exception.
+  [...]
+includes: [detachArrayBuffer.js]
+features: [arraybuffer-transfer]
+---*/
+
+assert.sameValue(typeof ArrayBuffer.prototype.transfer, 'function');
+
+var ab = new ArrayBuffer(1);
+
+$DETACHBUFFER(ab);
+
+assert.throws(TypeError, function() {
+  ab.transfer();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/this-is-not-arraybuffer-object.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/this-is-not-arraybuffer-object.js
new file mode 100644
index 0000000000..44d49bfba1
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/this-is-not-arraybuffer-object.js
@@ -0,0 +1,30 @@
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfer
+description: >
+  Throws a TypeError if `this` does not have an [[ArrayBufferData]] internal slot.
+info: |
+  ArrayBuffer.prototype.transfer ( [ newLength ] )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [arraybuffer-transfer]
+---*/
+
+assert.sameValue(typeof ArrayBuffer.prototype.transfer, 'function');
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.transfer();
+}, '`this` value is the ArrayBuffer prototype');
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.transfer.call({});
+}, '`this` value is an object');
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.transfer.call([]);
+}, '`this` value is an array');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/this-is-not-object.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/this-is-not-object.js
new file mode 100644
index 0000000000..25fdb9bc17
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/this-is-not-object.js
@@ -0,0 +1,46 @@
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfer
+description: Throws a TypeError if `this` valueis not an object.
+info: |
+  ArrayBuffer.prototype.transfer ( [ newLength ] )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [arraybuffer-transfer, Symbol, BigInt]
+---*/
+
+assert.sameValue(typeof ArrayBuffer.prototype.transfer, "function");
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.transfer.call(undefined);
+}, "`this` value is undefined");
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.transfer.call(null);
+}, "`this` value is null");
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.transfer.call(true);
+}, "`this` value is Boolean");
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.transfer.call("");
+}, "`this` value is String");
+
+var symbol = Symbol();
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.transfer.call(symbol);
+}, "`this` value is Symbol");
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.transfer.call(1);
+}, "`this` value is Number");
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.transfer.call(1n);
+}, "`this` value is bigint");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/this-is-sharedarraybuffer.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/this-is-sharedarraybuffer.js
new file mode 100644
index 0000000000..0667cf9aa1
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transfer/this-is-sharedarraybuffer.js
@@ -0,0 +1,23 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfer
+description: Throws a TypeError if `this` value is a SharedArrayBuffer
+info: |
+  ArrayBuffer.prototype.transfer ( [ newLength ] )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  [...]
+features: [SharedArrayBuffer, arraybuffer-transfer]
+---*/
+
+var sab = new SharedArrayBuffer(0);
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.transfer.call(sab);
+}, '`this` value cannot be a SharedArrayBuffer');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/browser.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/browser.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/browser.js
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/descriptor.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/descriptor.js
new file mode 100644
index 0000000000..98ea7bf8e7
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/descriptor.js
@@ -0,0 +1,25 @@
+// Copyright (C) 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfertofixedlength
+description: >
+  ArrayBuffer.prototype.transferToFixedLength has default data property
+  attributes.
+info: |
+  ArrayBuffer.prototype.transferToFixedLength ( [ newLength ] )
+
+  17 ECMAScript Standard Built-in Objects:
+    Every other data property described in clauses 18 through 26 and in
+    Annex B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+features: [arraybuffer-transfer]
+---*/
+
+verifyProperty(ArrayBuffer.prototype, 'transferToFixedLength', {
+  enumerable: false,
+  writable: true,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/extensible.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/extensible.js
new file mode 100644
index 0000000000..8e9f984f5d
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/extensible.js
@@ -0,0 +1,17 @@
+// Copyright (C) 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfertofixedlength
+description: ArrayBuffer.prototype.transferToFixedLength is extensible.
+info: |
+  ArrayBuffer.prototype.transferToFixedLength ( [ newLength ] )
+
+  17 ECMAScript Standard Built-in Objects:
+    Unless specified otherwise, the [[Extensible]] internal slot
+    of a built-in object initially has the value true.
+features: [arraybuffer-transfer]
+---*/
+
+assert(Object.isExtensible(ArrayBuffer.prototype.transferToFixedLength));
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-fixed-to-larger-no-resizable.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-fixed-to-larger-no-resizable.js
new file mode 100644
index 0000000000..d5fb6934da
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-fixed-to-larger-no-resizable.js
@@ -0,0 +1,38 @@
+// Copyright (C) 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfertofixedlength
+description: Transfering from a fixed-size ArrayBuffer into a larger ArrayBuffer
+features: [arraybuffer-transfer]
+---*/
+
+// NOTE: This file is a copy of "from-fixed-to-larger.js" with the resizable
+// ArrayBuffer parts removed, so it can run in implementations which don't yet
+// support the "resizable-arraybuffer" feature.
+
+var source = new ArrayBuffer(4);
+
+var sourceArray = new Uint8Array(source);
+sourceArray[0] = 1;
+sourceArray[1] = 2;
+sourceArray[2] = 3;
+sourceArray[3] = 4;
+
+var dest = source.transferToFixedLength(5);
+
+assert.sameValue(source.byteLength, 0, 'source.byteLength');
+assert.throws(TypeError, function() {
+  source.slice();
+});
+
+assert.sameValue(dest.byteLength, 5, 'dest.byteLength');
+
+var destArray = new Uint8Array(dest);
+
+assert.sameValue(destArray[0], 1, 'destArray[0]');
+assert.sameValue(destArray[1], 2, 'destArray[1]');
+assert.sameValue(destArray[2], 3, 'destArray[2]');
+assert.sameValue(destArray[3], 4, 'destArray[3]');
+assert.sameValue(destArray[4], 0, 'destArray[4]');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-fixed-to-larger.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-fixed-to-larger.js
new file mode 100644
index 0000000000..eaec319603
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-fixed-to-larger.js
@@ -0,0 +1,37 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfertofixedlength
+description: Transfering from a fixed-size ArrayBuffer into a larger ArrayBuffer
+features: [resizable-arraybuffer, arraybuffer-transfer]
+---*/
+
+var source = new ArrayBuffer(4);
+
+var sourceArray = new Uint8Array(source);
+sourceArray[0] = 1;
+sourceArray[1] = 2;
+sourceArray[2] = 3;
+sourceArray[3] = 4;
+
+var dest = source.transferToFixedLength(5);
+
+assert.sameValue(source.byteLength, 0, 'source.byteLength');
+assert.throws(TypeError, function() {
+  source.slice();
+});
+
+assert.sameValue(dest.resizable, false, 'dest.resizable');
+assert.sameValue(dest.byteLength, 5, 'dest.byteLength');
+assert.sameValue(dest.maxByteLength, 5, 'dest.maxByteLength');
+
+var destArray = new Uint8Array(dest);
+
+assert.sameValue(destArray[0], 1, 'destArray[0]');
+assert.sameValue(destArray[1], 2, 'destArray[1]');
+assert.sameValue(destArray[2], 3, 'destArray[2]');
+assert.sameValue(destArray[3], 4, 'destArray[3]');
+assert.sameValue(destArray[4], 0, 'destArray[4]');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-fixed-to-same-no-resizable.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-fixed-to-same-no-resizable.js
new file mode 100644
index 0000000000..a0a1437f06
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-fixed-to-same-no-resizable.js
@@ -0,0 +1,39 @@
+// Copyright (C) 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfertofixedlength
+description: |
+  Transfering from a fixed-size ArrayBuffer into an ArrayBuffer with the same
+  byte length
+features: [arraybuffer-transfer]
+---*/
+
+// NOTE: This file is a copy of "from-fixed-to-same.js" with the resizable
+// ArrayBuffer parts removed, so it can run in implementations which don't yet
+// support the "resizable-arraybuffer" feature.
+
+var source = new ArrayBuffer(4);
+
+var sourceArray = new Uint8Array(source);
+sourceArray[0] = 1;
+sourceArray[1] = 2;
+sourceArray[2] = 3;
+sourceArray[3] = 4;
+
+var dest = source.transferToFixedLength();
+
+assert.sameValue(source.byteLength, 0, 'source.byteLength');
+assert.throws(TypeError, function() {
+  source.slice();
+});
+
+assert.sameValue(dest.byteLength, 4, 'dest.byteLength');
+
+var destArray = new Uint8Array(dest);
+
+assert.sameValue(destArray[0], 1, 'destArray[0]');
+assert.sameValue(destArray[1], 2, 'destArray[1]');
+assert.sameValue(destArray[2], 3, 'destArray[2]');
+assert.sameValue(destArray[3], 4, 'destArray[3]');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-fixed-to-same.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-fixed-to-same.js
new file mode 100644
index 0000000000..bab2d2ac67
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-fixed-to-same.js
@@ -0,0 +1,38 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfertofixedlength
+description: |
+  Transfering from a fixed-size ArrayBuffer into an ArrayBuffer with the same
+  byte length
+features: [resizable-arraybuffer, arraybuffer-transfer]
+---*/
+
+var source = new ArrayBuffer(4);
+
+var sourceArray = new Uint8Array(source);
+sourceArray[0] = 1;
+sourceArray[1] = 2;
+sourceArray[2] = 3;
+sourceArray[3] = 4;
+
+var dest = source.transferToFixedLength();
+
+assert.sameValue(source.byteLength, 0, 'source.byteLength');
+assert.throws(TypeError, function() {
+  source.slice();
+});
+
+assert.sameValue(dest.resizable, false, 'dest.resizable');
+assert.sameValue(dest.byteLength, 4, 'dest.byteLength');
+assert.sameValue(dest.maxByteLength, 4, 'dest.maxByteLength');
+
+var destArray = new Uint8Array(dest);
+
+assert.sameValue(destArray[0], 1, 'destArray[0]');
+assert.sameValue(destArray[1], 2, 'destArray[1]');
+assert.sameValue(destArray[2], 3, 'destArray[2]');
+assert.sameValue(destArray[3], 4, 'destArray[3]');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-fixed-to-smaller-no-resizable.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-fixed-to-smaller-no-resizable.js
new file mode 100644
index 0000000000..3b55875f19
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-fixed-to-smaller-no-resizable.js
@@ -0,0 +1,36 @@
+// Copyright (C) 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfertofixedlength
+description: Transfering from a fixed-size ArrayBuffer into a smaller ArrayBuffer
+features: [arraybuffer-transfer]
+---*/
+
+// NOTE: This file is a copy of "from-fixed-to-samller.js" with the resizable
+// ArrayBuffer parts removed, so it can run in implementations which don't yet
+// support the "resizable-arraybuffer" feature.
+
+var source = new ArrayBuffer(4);
+
+var sourceArray = new Uint8Array(source);
+sourceArray[0] = 1;
+sourceArray[1] = 2;
+sourceArray[2] = 3;
+sourceArray[3] = 4;
+
+var dest = source.transferToFixedLength(3);
+
+assert.sameValue(source.byteLength, 0, 'source.byteLength');
+assert.throws(TypeError, function() {
+  source.slice();
+});
+
+assert.sameValue(dest.byteLength, 3, 'dest.byteLength');
+
+var destArray = new Uint8Array(dest);
+
+assert.sameValue(destArray[0], 1, 'destArray[0]');
+assert.sameValue(destArray[1], 2, 'destArray[1]');
+assert.sameValue(destArray[2], 3, 'destArray[2]');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-fixed-to-smaller.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-fixed-to-smaller.js
new file mode 100644
index 0000000000..b04213166a
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-fixed-to-smaller.js
@@ -0,0 +1,35 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfertofixedlength
+description: Transfering from a fixed-size ArrayBuffer into a smaller ArrayBuffer
+features: [resizable-arraybuffer, arraybuffer-transfer]
+---*/
+
+var source = new ArrayBuffer(4);
+
+var sourceArray = new Uint8Array(source);
+sourceArray[0] = 1;
+sourceArray[1] = 2;
+sourceArray[2] = 3;
+sourceArray[3] = 4;
+
+var dest = source.transferToFixedLength(3);
+
+assert.sameValue(source.byteLength, 0, 'source.byteLength');
+assert.throws(TypeError, function() {
+  source.slice();
+});
+
+assert.sameValue(dest.resizable, false, 'dest.resizable');
+assert.sameValue(dest.byteLength, 3, 'dest.byteLength');
+assert.sameValue(dest.maxByteLength, 3, 'dest.maxByteLength');
+
+var destArray = new Uint8Array(dest);
+
+assert.sameValue(destArray[0], 1, 'destArray[0]');
+assert.sameValue(destArray[1], 2, 'destArray[1]');
+assert.sameValue(destArray[2], 3, 'destArray[2]');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-fixed-to-zero-no-resizable.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-fixed-to-zero-no-resizable.js
new file mode 100644
index 0000000000..8ba75e74da
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-fixed-to-zero-no-resizable.js
@@ -0,0 +1,30 @@
+// Copyright (C) 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfertofixedlength
+description: Transfering from a fixed-size ArrayBuffer into a zero-length ArrayBuffer
+features: [arraybuffer-transfer]
+---*/
+
+// NOTE: This file is a copy of "from-fixed-to-zero.js" with the resizable
+// ArrayBuffer parts removed, so it can run in implementations which don't yet
+// support the "resizable-arraybuffer" feature.
+
+var source = new ArrayBuffer(4);
+
+var sourceArray = new Uint8Array(source);
+sourceArray[0] = 1;
+sourceArray[1] = 2;
+sourceArray[2] = 3;
+sourceArray[3] = 4;
+
+var dest = source.transferToFixedLength(0);
+
+assert.sameValue(source.byteLength, 0, 'source.byteLength');
+assert.throws(TypeError, function() {
+  source.slice();
+});
+
+assert.sameValue(dest.byteLength, 0, 'dest.byteLength');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-fixed-to-zero.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-fixed-to-zero.js
new file mode 100644
index 0000000000..1a94a1c569
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-fixed-to-zero.js
@@ -0,0 +1,29 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfertofixedlength
+description: Transfering from a fixed-size ArrayBuffer into a zero-length ArrayBuffer
+features: [resizable-arraybuffer, arraybuffer-transfer]
+---*/
+
+var source = new ArrayBuffer(4);
+
+var sourceArray = new Uint8Array(source);
+sourceArray[0] = 1;
+sourceArray[1] = 2;
+sourceArray[2] = 3;
+sourceArray[3] = 4;
+
+var dest = source.transferToFixedLength(0);
+
+assert.sameValue(source.byteLength, 0, 'source.byteLength');
+assert.throws(TypeError, function() {
+  source.slice();
+});
+
+assert.sameValue(dest.resizable, false, 'dest.resizable');
+assert.sameValue(dest.byteLength, 0, 'dest.byteLength');
+assert.sameValue(dest.maxByteLength, 0, 'dest.maxByteLength');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-resizable-to-larger.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-resizable-to-larger.js
new file mode 100644
index 0000000000..7ddcab88d9
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-resizable-to-larger.js
@@ -0,0 +1,37 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfertofixedlength
+description: Transfering from a resizable ArrayBuffer into a larger ArrayBuffer
+features: [resizable-arraybuffer, arraybuffer-transfer]
+---*/
+
+var source = new ArrayBuffer(4, { maxByteLength: 8 });
+
+var sourceArray = new Uint8Array(source);
+sourceArray[0] = 1;
+sourceArray[1] = 2;
+sourceArray[2] = 3;
+sourceArray[3] = 4;
+
+var dest = source.transferToFixedLength(5);
+
+assert.sameValue(source.byteLength, 0, 'source.byteLength');
+assert.throws(TypeError, function() {
+  source.slice();
+});
+
+assert.sameValue(dest.resizable, false, 'dest.resizable');
+assert.sameValue(dest.byteLength, 5, 'dest.byteLength');
+assert.sameValue(dest.maxByteLength, 5, 'dest.maxByteLength');
+
+var destArray = new Uint8Array(dest);
+
+assert.sameValue(destArray[0], 1, 'destArray[0]');
+assert.sameValue(destArray[1], 2, 'destArray[1]');
+assert.sameValue(destArray[2], 3, 'destArray[2]');
+assert.sameValue(destArray[3], 4, 'destArray[3]');
+assert.sameValue(destArray[4], 0, 'destArray[4]');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-resizable-to-same.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-resizable-to-same.js
new file mode 100644
index 0000000000..3f3375ca43
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-resizable-to-same.js
@@ -0,0 +1,38 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfertofixedlength
+description: |
+  Transfering from a resizable ArrayBuffer into an ArrayBuffer with the same
+  byte length
+features: [resizable-arraybuffer, arraybuffer-transfer]
+---*/
+
+var source = new ArrayBuffer(4, { maxByteLength: 8 });
+
+var sourceArray = new Uint8Array(source);
+sourceArray[0] = 1;
+sourceArray[1] = 2;
+sourceArray[2] = 3;
+sourceArray[3] = 4;
+
+var dest = source.transferToFixedLength();
+
+assert.sameValue(source.byteLength, 0, 'source.byteLength');
+assert.throws(TypeError, function() {
+  source.slice();
+});
+
+assert.sameValue(dest.resizable, false, 'dest.resizable');
+assert.sameValue(dest.byteLength, 4, 'dest.byteLength');
+assert.sameValue(dest.maxByteLength, 4, 'dest.maxByteLength');
+
+var destArray = new Uint8Array(dest);
+
+assert.sameValue(destArray[0], 1, 'destArray[0]');
+assert.sameValue(destArray[1], 2, 'destArray[1]');
+assert.sameValue(destArray[2], 3, 'destArray[2]');
+assert.sameValue(destArray[3], 4, 'destArray[3]');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-resizable-to-smaller.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-resizable-to-smaller.js
new file mode 100644
index 0000000000..0dcf25379e
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-resizable-to-smaller.js
@@ -0,0 +1,35 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfertofixedlength
+description: Transfering from a resizable ArrayBuffer into a smaller ArrayBuffer
+features: [resizable-arraybuffer, arraybuffer-transfer]
+---*/
+
+var source = new ArrayBuffer(4, { maxByteLength: 8 });
+
+var sourceArray = new Uint8Array(source);
+sourceArray[0] = 1;
+sourceArray[1] = 2;
+sourceArray[2] = 3;
+sourceArray[3] = 4;
+
+var dest = source.transferToFixedLength(3);
+
+assert.sameValue(source.byteLength, 0, 'source.byteLength');
+assert.throws(TypeError, function() {
+  source.slice();
+});
+
+assert.sameValue(dest.resizable, false, 'dest.resizable');
+assert.sameValue(dest.byteLength, 3, 'dest.byteLength');
+assert.sameValue(dest.maxByteLength, 3, 'dest.maxByteLength');
+
+var destArray = new Uint8Array(dest);
+
+assert.sameValue(destArray[0], 1, 'destArray[0]');
+assert.sameValue(destArray[1], 2, 'destArray[1]');
+assert.sameValue(destArray[2], 3, 'destArray[2]');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-resizable-to-zero.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-resizable-to-zero.js
new file mode 100644
index 0000000000..abc270bbde
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/from-resizable-to-zero.js
@@ -0,0 +1,29 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfertofixedlength
+description: Transfering from a resizable ArrayBuffer into a zero-length ArrayBuffer
+features: [resizable-arraybuffer, arraybuffer-transfer]
+---*/
+
+var source = new ArrayBuffer(4, { maxByteLength: 8 });
+
+var sourceArray = new Uint8Array(source);
+sourceArray[0] = 1;
+sourceArray[1] = 2;
+sourceArray[2] = 3;
+sourceArray[3] = 4;
+
+var dest = source.transferToFixedLength(0);
+
+assert.sameValue(source.byteLength, 0, 'source.byteLength');
+assert.throws(TypeError, function() {
+  source.slice();
+});
+
+assert.sameValue(dest.resizable, false, 'dest.resizable');
+assert.sameValue(dest.byteLength, 0, 'dest.byteLength');
+assert.sameValue(dest.maxByteLength, 0, 'dest.maxByteLength');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/length.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/length.js
new file mode 100644
index 0000000000..8cdf8b1c7d
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/length.js
@@ -0,0 +1,32 @@
+// Copyright (C) 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfertofixedlength
+description: >
+  ArrayBuffer.prototype.transferToFixedLength.length is 0.
+info: |
+  ArrayBuffer.prototype.transferToFixedLength ( [ newLength ] )
+
+  17 ECMAScript Standard Built-in Objects:
+    Every built-in Function object, including constructors, has a length
+    property whose value is an integer. Unless otherwise specified, this
+    value is equal to the largest number of named arguments shown in the
+    subclause headings for the function description, including optional
+    parameters. However, rest parameters shown using the form “...name”
+    are not included in the default argument count.
+
+    Unless otherwise specified, the length property of a built-in Function
+    object has the attributes { [[Writable]]: false, [[Enumerable]]: false,
+    [[Configurable]]: true }.
+includes: [propertyHelper.js]
+features: [arraybuffer-transfer]
+---*/
+
+verifyProperty(ArrayBuffer.prototype.transferToFixedLength, 'length', {
+  value: 0,
+  enumerable: false,
+  writable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/name.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/name.js
new file mode 100644
index 0000000000..f98e9c18ee
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/name.js
@@ -0,0 +1,29 @@
+// Copyright (C) 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfertofixedlength
+description: >
+  ArrayBuffer.prototype.transferToFixedLength.name is "transfer".
+info: |
+  ArrayBuffer.prototype.transferToFixedLength ( [ newLength ] )
+
+  17 ECMAScript Standard Built-in Objects:
+    Every built-in Function object, including constructors, that is not
+    identified as an anonymous function has a name property whose value
+    is a String.
+
+    Unless otherwise specified, the name property of a built-in Function
+    object, if it exists, has the attributes { [[Writable]]: false,
+    [[Enumerable]]: false, [[Configurable]]: true }.
+features: [arraybuffer-transfer]
+includes: [propertyHelper.js]
+---*/
+
+verifyProperty(ArrayBuffer.prototype.transferToFixedLength, 'name', {
+  value: 'transferToFixedLength',
+  enumerable: false,
+  writable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/new-length-excessive.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/new-length-excessive.js
new file mode 100644
index 0000000000..cb679f2279
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/new-length-excessive.js
@@ -0,0 +1,18 @@
+// Copyright (C) 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfertofixedlength
+description: >
+  Throws a RangeError if the newLength is larger than 2^53 - 1 due to clamping
+  in ToIndex.
+features: [arraybuffer-transfer]
+---*/
+
+var ab = new ArrayBuffer(0);
+
+assert.throws(RangeError, function() {
+  // Math.pow(2, 53) = 9007199254740992
+  ab.transferToFixedLength(9007199254740992);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/new-length-non-number.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/new-length-non-number.js
new file mode 100644
index 0000000000..e7213ede44
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/new-length-non-number.js
@@ -0,0 +1,41 @@
+// Copyright (C) 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfertofixedlength
+description: Throws a TypeError if provided length cannot be coerced to a number
+info: |
+  ArrayBuffer.prototype.transferToFixedLength ( [ newLength ] )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, throw a TypeError exception.
+  5. If newLength is undefined, let newByteLength be
+     O.[[ArrayBufferByteLength]].
+  6. Else, let newByteLength be ? ToIntegerOrInfinity(newLength).
+  [...]
+features: [arraybuffer-transfer]
+---*/
+
+var log = [];
+var newLength = {
+  toString: function() {
+    log.push('toString');
+    return {};
+  },
+  valueOf: function() {
+    log.push('valueOf');
+    return {};
+  }
+};
+var ab = new ArrayBuffer(0);
+
+assert.throws(TypeError, function() {
+  ab.transferToFixedLength(newLength);
+});
+
+assert.sameValue(log.length, 2);
+assert.sameValue(log[0], 'valueOf');
+assert.sameValue(log[1], 'toString');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/nonconstructor.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/nonconstructor.js
new file mode 100644
index 0000000000..9462ff4f9c
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/nonconstructor.js
@@ -0,0 +1,25 @@
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfertofixedlength
+description: >
+  ArrayBuffer.prototype.transferToFixedLength is not a constructor function.
+info: |
+  ArrayBuffer.prototype.transferToFixedLength ( [ newLength ] )
+
+  17 ECMAScript Standard Built-in Objects:
+    Built-in function objects that are not identified as constructors do not
+    implement the [[Construct]] internal method unless otherwise specified
+    in the description of a particular function.
+includes: [isConstructor.js]
+features: [arraybuffer-transfer, Reflect.construct]
+---*/
+
+assert(!isConstructor(ArrayBuffer.prototype.transferToFixedLength), "ArrayBuffer.prototype.transferToFixedLength is not a constructor");
+
+var arrayBuffer = new ArrayBuffer(8);
+assert.throws(TypeError, function() {
+  new arrayBuffer.transfer();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/shell.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/shell.js
new file mode 100644
index 0000000000..06f65290b8
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/shell.js
@@ -0,0 +1,18 @@
+// GENERATED, DO NOT EDIT
+// file: detachArrayBuffer.js
+// Copyright (C) 2016 the V8 project authors.  All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+description: |
+    A function used in the process of asserting correctness of TypedArray objects.
+
+    $262.detachArrayBuffer is defined by a host.
+defines: [$DETACHBUFFER]
+---*/
+
+function $DETACHBUFFER(buffer) {
+  if (!$262 || typeof $262.detachArrayBuffer !== "function") {
+    throw new Test262Error("No method available to detach an ArrayBuffer");
+  }
+  $262.detachArrayBuffer(buffer);
+}
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/this-is-detached.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/this-is-detached.js
new file mode 100644
index 0000000000..e44cde171d
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/this-is-detached.js
@@ -0,0 +1,29 @@
+// Copyright (C) 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfertofixedlength
+description: >
+  Throws a TypeError if `this` does not have an [[ArrayBufferData]] internal slot.
+info: |
+  ArrayBuffer.prototype.transferToFixedLength ( [ newLength ] )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  4. If IsDetachedBuffer(O) is true, throw a TypeError exception.
+  [...]
+includes: [detachArrayBuffer.js]
+features: [arraybuffer-transfer]
+---*/
+
+assert.sameValue(typeof ArrayBuffer.prototype.transferToFixedLength, 'function');
+
+var ab = new ArrayBuffer(1);
+
+$DETACHBUFFER(ab);
+
+assert.throws(TypeError, function() {
+  ab.transferToFixedLength();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/this-is-not-arraybuffer-object.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/this-is-not-arraybuffer-object.js
new file mode 100644
index 0000000000..5a43ac3796
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/this-is-not-arraybuffer-object.js
@@ -0,0 +1,30 @@
+// Copyright (C) 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfertofixedlength
+description: >
+  Throws a TypeError if `this` does not have an [[ArrayBufferData]] internal slot.
+info: |
+  ArrayBuffer.prototype.transferToFixedLength ( [ newLength ] )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [arraybuffer-transfer]
+---*/
+
+assert.sameValue(typeof ArrayBuffer.prototype.transferToFixedLength, 'function');
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.transferToFixedLength();
+}, '`this` value is the ArrayBuffer prototype');
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.transferToFixedLength.call({});
+}, '`this` value is an object');
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.transferToFixedLength.call([]);
+}, '`this` value is an array');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/this-is-not-object.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/this-is-not-object.js
new file mode 100644
index 0000000000..bc44b513c0
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/this-is-not-object.js
@@ -0,0 +1,46 @@
+// Copyright (C) 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfertofixedlength
+description: Throws a TypeError if `this` valueis not an object.
+info: |
+  ArrayBuffer.prototype.transferToFixedLength ( [ newLength ] )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [arraybuffer-transfer, Symbol, BigInt]
+---*/
+
+assert.sameValue(typeof ArrayBuffer.prototype.transferToFixedLength, "function");
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.transferToFixedLength.call(undefined);
+}, "`this` value is undefined");
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.transferToFixedLength.call(null);
+}, "`this` value is null");
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.transferToFixedLength.call(true);
+}, "`this` value is Boolean");
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.transferToFixedLength.call("");
+}, "`this` value is String");
+
+var symbol = Symbol();
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.transferToFixedLength.call(symbol);
+}, "`this` value is Symbol");
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.transferToFixedLength.call(1);
+}, "`this` value is Number");
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.transferToFixedLength.call(1n);
+}, "`this` value is bigint");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/this-is-sharedarraybuffer.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/this-is-sharedarraybuffer.js
new file mode 100644
index 0000000000..d75573dd99
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/transferToFixedLength/this-is-sharedarraybuffer.js
@@ -0,0 +1,23 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-arraybuffer.prototype.transfertofixedlength
+description: Throws a TypeError if `this` value is a SharedArrayBuffer
+info: |
+  ArrayBuffer.prototype.transferToFixedLength ( [ newLength ] )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  [...]
+features: [SharedArrayBuffer, arraybuffer-transfer]
+---*/
+
+var sab = new SharedArrayBuffer(0);
+
+assert.throws(TypeError, function() {
+  ArrayBuffer.prototype.transferToFixedLength.call(sab);
+}, '`this` value cannot be a SharedArrayBuffer');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/return-abrupt-from-length-symbol.js b/js/src/tests/test262/built-ins/ArrayBuffer/return-abrupt-from-length-symbol.js
new file mode 100644
index 0000000000..6de5372429
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/return-abrupt-from-length-symbol.js
@@ -0,0 +1,23 @@
+// Copyright (C) 2016 The V8 Project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer-length
+description: >
+  Throws a TypeError if length is a symbol
+info: |
+  ArrayBuffer( length )
+
+  1. If NewTarget is undefined, throw a TypeError exception.
+  2. Let byteLength be ? ToIndex(length).
+  ...
+features: [Symbol]
+---*/
+
+var s = Symbol();
+
+assert.throws(TypeError, function() {
+  new ArrayBuffer(s);
+}, "`length` parameter is a Symbol");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/return-abrupt-from-length.js b/js/src/tests/test262/built-ins/ArrayBuffer/return-abrupt-from-length.js
new file mode 100644
index 0000000000..30fc6db18d
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/return-abrupt-from-length.js
@@ -0,0 +1,26 @@
+// Copyright (C) 2016 The V8 Project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer-length
+description: >
+  Return abrupt from ToIndex(length)
+info: |
+  ArrayBuffer( length )
+
+  1. If NewTarget is undefined, throw a TypeError exception.
+  2. Let byteLength be ? ToIndex(length).
+  ...
+---*/
+
+var len = {
+  valueOf: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  new ArrayBuffer(len);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/shell.js b/js/src/tests/test262/built-ins/ArrayBuffer/shell.js
new file mode 100644
index 0000000000..eda1477282
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/shell.js
@@ -0,0 +1,24 @@
+// GENERATED, DO NOT EDIT
+// file: isConstructor.js
+// Copyright (C) 2017 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: |
+    Test if a given function is a constructor function.
+defines: [isConstructor]
+features: [Reflect.construct]
+---*/
+
+function isConstructor(f) {
+    if (typeof f !== "function") {
+      throw new Test262Error("isConstructor invoked with a non-function value");
+    }
+
+    try {
+        Reflect.construct(function(){}, [], f);
+    } catch (e) {
+        return false;
+    }
+    return true;
+}
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/toindex-length.js b/js/src/tests/test262/built-ins/ArrayBuffer/toindex-length.js
new file mode 100644
index 0000000000..5e165c3df9
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/toindex-length.js
@@ -0,0 +1,89 @@
+// Copyright (C) 2016 The V8 Project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer-length
+description: >
+  The `length` parameter is converted to a value numeric index value.
+info: |
+  ArrayBuffer( length )
+
+  1. If NewTarget is undefined, throw a TypeError exception.
+  2. Let byteLength be ? ToIndex(length).
+  3. Return ? AllocateArrayBuffer(NewTarget, byteLength).
+
+  ToIndex( value )
+
+  1. If value is undefined, then
+    a. Let index be 0.
+  2. Else,
+    a. Let integerIndex be ? ToInteger(value).
+    b. If integerIndex < 0, throw a RangeError exception.
+    c. Let index be ! ToLength(integerIndex).
+    d. If SameValueZero(integerIndex, index) is false, throw a RangeError exception.
+  3. Return index.
+---*/
+
+var obj1 = {
+  valueOf: function() {
+    return 42;
+  }
+};
+
+var obj2 = {
+  toString: function() {
+    return 42;
+  }
+};
+
+var buffer;
+
+buffer = new ArrayBuffer(obj1);
+assert.sameValue(buffer.byteLength, 42, "object's valueOf");
+
+buffer = new ArrayBuffer(obj2);
+assert.sameValue(buffer.byteLength, 42, "object's toString");
+
+buffer = new ArrayBuffer("");
+assert.sameValue(buffer.byteLength, 0, "the Empty string");
+
+buffer = new ArrayBuffer("0");
+assert.sameValue(buffer.byteLength, 0, "string '0'");
+
+buffer = new ArrayBuffer("1");
+assert.sameValue(buffer.byteLength, 1, "string '1'");
+
+buffer = new ArrayBuffer(true);
+assert.sameValue(buffer.byteLength, 1, "true");
+
+buffer = new ArrayBuffer(false);
+assert.sameValue(buffer.byteLength, 0, "false");
+
+buffer = new ArrayBuffer(NaN);
+assert.sameValue(buffer.byteLength, 0, "NaN");
+
+buffer = new ArrayBuffer(null);
+assert.sameValue(buffer.byteLength, 0, "null");
+
+buffer = new ArrayBuffer(undefined);
+assert.sameValue(buffer.byteLength, 0, "undefined");
+
+buffer = new ArrayBuffer(0.1);
+assert.sameValue(buffer.byteLength, 0, "0.1");
+
+buffer = new ArrayBuffer(0.9);
+assert.sameValue(buffer.byteLength, 0, "0.9");
+
+buffer = new ArrayBuffer(1.1);
+assert.sameValue(buffer.byteLength, 1, "1.1");
+
+buffer = new ArrayBuffer(1.9);
+assert.sameValue(buffer.byteLength, 1, "1.9");
+
+buffer = new ArrayBuffer(-0.1);
+assert.sameValue(buffer.byteLength, 0, "-0.1");
+
+buffer = new ArrayBuffer(-0.99999);
+assert.sameValue(buffer.byteLength, 0, "-0.99999");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/undefined-newtarget-throws.js b/js/src/tests/test262/built-ins/ArrayBuffer/undefined-newtarget-throws.js
new file mode 100644
index 0000000000..0d9ee14f28
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/undefined-newtarget-throws.js
@@ -0,0 +1,25 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer-length
+description: >
+  Throws a TypeError if ArrayBuffer is called as a function.
+info: |
+  ArrayBuffer( length )
+
+  ArrayBuffer called with argument length performs the following steps:
+
+  1. If NewTarget is undefined, throw a TypeError exception.
+  ...
+---*/
+
+assert.throws(TypeError, function() {
+  ArrayBuffer();
+});
+
+assert.throws(TypeError, function() {
+  ArrayBuffer(10);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/zero-length.js b/js/src/tests/test262/built-ins/ArrayBuffer/zero-length.js
new file mode 100644
index 0000000000..12e5183af2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/zero-length.js
@@ -0,0 +1,25 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer-length
+description: >
+  The `length` parameter can be zero.
+info: |
+  ArrayBuffer( length )
+
+  ...
+  2. Let numberLength be ToNumber(length).
+  3. Let byteLength be ToLength(numberLength).
+  4. ReturnIfAbrupt(byteLength).
+  5. If SameValueZero(numberLength, byteLength) is false, throw a RangeError exception.
+  ...
+---*/
+
+var positiveZero = new ArrayBuffer(+0);
+assert.sameValue(positiveZero.byteLength, 0);
+
+var negativeZero = new ArrayBuffer(-0);
+assert.sameValue(negativeZero.byteLength, 0);
+
+reportCompare(0, 0);