Merging upstream version 127.0.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

18 files changed, 185 insertions, 48 deletions

diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/Symbol.species/length.js b/js/src/tests/test262/built-ins/ArrayBuffer/Symbol.species/length.js
index 3d44fa0cae..1ce2f30b45 100644
--- a/js/src/tests/test262/built-ins/ArrayBuffer/Symbol.species/length.js
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/Symbol.species/length.js
@@ -25,10 +25,11 @@ features: [Symbol.species]
 
 var desc = Object.getOwnPropertyDescriptor(ArrayBuffer, Symbol.species);
 
-assert.sameValue(desc.get.length, 0);
-
-verifyNotEnumerable(desc.get, "length");
-verifyNotWritable(desc.get, "length");
-verifyConfigurable(desc.get, "length");
+verifyProperty(desc.get, "length", {
+  value: 0,
+  writable: false,
+  enumerable: false,
+  configurable: true
+});
 
 reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/Symbol.species/symbol-species-name.js b/js/src/tests/test262/built-ins/ArrayBuffer/Symbol.species/symbol-species-name.js
index 2d9d0eb3e8..a5ae191321 100644
--- a/js/src/tests/test262/built-ins/ArrayBuffer/Symbol.species/symbol-species-name.js
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/Symbol.species/symbol-species-name.js
@@ -15,13 +15,11 @@ includes: [propertyHelper.js]
 
 var descriptor = Object.getOwnPropertyDescriptor(ArrayBuffer, Symbol.species);
 
-assert.sameValue(
-  descriptor.get.name,
-  'get [Symbol.species]'
-);
-
-verifyNotEnumerable(descriptor.get, 'name');
-verifyNotWritable(descriptor.get, 'name');
-verifyConfigurable(descriptor.get, 'name');
+verifyProperty(descriptor.get, "name", {
+  value: "get [Symbol.species]",
+  writable: false,
+  enumerable: false,
+  configurable: true
+});
 
 reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-typedarray-buffer.js b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-typedarray-buffer.js
index 9e8918b388..c3d06668f0 100644
--- a/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-typedarray-buffer.js
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-typedarray-buffer.js
@@ -1,3 +1,4 @@
+// |reftest| shell-option(--enable-float16array)
 // Copyright (C) 2016 The V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-typedarray-constructor.js b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-typedarray-constructor.js
index efd5d16984..feee8c989c 100644
--- a/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-typedarray-constructor.js
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-typedarray-constructor.js
@@ -1,3 +1,4 @@
+// |reftest| shell-option(--enable-float16array)
 // Copyright (C) 2016 The V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-typedarray-subclass-instance.js b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-typedarray-subclass-instance.js
index 3d17140d0f..b43ea03666 100644
--- a/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-typedarray-subclass-instance.js
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-typedarray-subclass-instance.js
@@ -1,3 +1,4 @@
+// |reftest| shell-option(--enable-float16array)
 // Copyright (C) 2016 The V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-typedarray.js b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-typedarray.js
index 78cbfbbf61..91c4c3330b 100644
--- a/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-typedarray.js
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/isView/arg-is-typedarray.js
@@ -1,3 +1,4 @@
+// |reftest| shell-option(--enable-float16array)
 // Copyright (C) 2016 The V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/isView/invoked-as-a-fn.js b/js/src/tests/test262/built-ins/ArrayBuffer/isView/invoked-as-a-fn.js
index e58a330cdb..779ab1542a 100644
--- a/js/src/tests/test262/built-ins/ArrayBuffer/isView/invoked-as-a-fn.js
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/isView/invoked-as-a-fn.js
@@ -1,3 +1,4 @@
+// |reftest| shell-option(--enable-float16array)
 // Copyright (C) 2016 The V8 project authors. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/isView/length.js b/js/src/tests/test262/built-ins/ArrayBuffer/isView/length.js
index d74f5ab42d..560f2060f8 100644
--- a/js/src/tests/test262/built-ins/ArrayBuffer/isView/length.js
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/isView/length.js
@@ -22,10 +22,11 @@ info: |
 includes: [propertyHelper.js]
 ---*/
 
-assert.sameValue(ArrayBuffer.isView.length, 1);
-
-verifyNotEnumerable(ArrayBuffer.isView, "length");
-verifyNotWritable(ArrayBuffer.isView, "length");
-verifyConfigurable(ArrayBuffer.isView, "length");
+verifyProperty(ArrayBuffer.isView, "length", {
+  value: 1,
+  writable: false,
+  enumerable: false,
+  configurable: true
+});
 
 reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/isView/name.js b/js/src/tests/test262/built-ins/ArrayBuffer/isView/name.js
index e8ef8b04e5..aeecc5dbad 100644
--- a/js/src/tests/test262/built-ins/ArrayBuffer/isView/name.js
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/isView/name.js
@@ -19,10 +19,11 @@ info: |
 includes: [propertyHelper.js]
 ---*/
 
-assert.sameValue(ArrayBuffer.isView.name, "isView");
-
-verifyNotEnumerable(ArrayBuffer.isView, "name");
-verifyNotWritable(ArrayBuffer.isView, "name");
-verifyConfigurable(ArrayBuffer.isView, "name");
+verifyProperty(ArrayBuffer.isView, "name", {
+  value: "isView",
+  writable: false,
+  enumerable: false,
+  configurable: true
+});
 
 reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/isView/not-a-constructor.js b/js/src/tests/test262/built-ins/ArrayBuffer/isView/not-a-constructor.js
index 09f8d71685..5c99e23fc2 100644
--- a/js/src/tests/test262/built-ins/ArrayBuffer/isView/not-a-constructor.js
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/isView/not-a-constructor.js
@@ -25,7 +25,7 @@ assert.sameValue(isConstructor(ArrayBuffer.isView), false, 'isConstructor(ArrayB
 
 assert.throws(TypeError, () => {
   new ArrayBuffer.isView();
-}, '`new ArrayBuffer.isView()` throws TypeError');
+});
 
 
 reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/options-maxbytelength-allocation-limit.js b/js/src/tests/test262/built-ins/ArrayBuffer/options-maxbytelength-allocation-limit.js
new file mode 100644
index 0000000000..e9c5b221d9
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/options-maxbytelength-allocation-limit.js
@@ -0,0 +1,43 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2024 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer-length
+description: >
+  Throws a RangeError if the requested Data Block is too large.
+info: |
+  ArrayBuffer ( length [ , options ] )
+
+  ...
+  4. Return ? AllocateArrayBuffer(NewTarget, byteLength, requestedMaxByteLength).
+
+  AllocateArrayBuffer ( constructor, byteLength [ , maxByteLength ] )
+
+  ...
+  5. Let block be ? CreateByteDataBlock(byteLength).
+  ...
+
+  CreateByteDataBlock ( size )
+
+  ...
+  2. Let db be a new Data Block value consisting of size bytes. If it is
+     impossible to create such a Data Block, throw a RangeError exception.
+  ...
+
+features: [resizable-arraybuffer]
+---*/
+
+assert.throws(RangeError, function() {
+  // Allocating 7 PiB should fail with a RangeError.
+  // Math.pow(1024, 5) = 1125899906842624
+  new ArrayBuffer(0, {maxByteLength: 7 * 1125899906842624});
+}, "`maxByteLength` option is 7 PiB");
+
+assert.throws(RangeError, function() {
+  // Allocating almost 8 PiB should fail with a RangeError.
+  // Math.pow(2, 53) = 9007199254740992
+  new ArrayBuffer(0, {maxByteLength: 9007199254740992 - 1});
+}, "`maxByteLength` option is Math.pow(2, 53) - 1");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/options-maxbytelength-compared-before-object-creation.js b/js/src/tests/test262/built-ins/ArrayBuffer/options-maxbytelength-compared-before-object-creation.js
new file mode 100644
index 0000000000..d2fd5ff1f1
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/options-maxbytelength-compared-before-object-creation.js
@@ -0,0 +1,43 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2024 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer-length
+description: >
+  The byteLength argument is validated before OrdinaryCreateFromConstructor.
+info: |
+  ArrayBuffer ( length [ , options ] )
+
+  ...
+  4. Return ? AllocateArrayBuffer(NewTarget, byteLength, requestedMaxByteLength).
+
+  AllocateArrayBuffer ( constructor, byteLength [ , maxByteLength ] )
+
+  ...
+  3. If allocatingResizableBuffer is true, then
+    a. If byteLength > maxByteLength, throw a RangeError exception.
+  ...
+  4. Let obj be ? OrdinaryCreateFromConstructor(constructor, "%ArrayBuffer.prototype%", slots).
+  ...
+
+features: [resizable-arraybuffer, Reflect.construct]
+---*/
+
+let newTarget = Object.defineProperty(function(){}.bind(null), "prototype", {
+  get() {
+    throw new Test262Error();
+  }
+});
+
+assert.throws(RangeError, function() {
+  let byteLength = 10;
+  let options = {
+    maxByteLength: 0,
+  };
+
+  // Throws a RangeError, because `byteLength` is larger than `options.maxByteLength`.
+  Reflect.construct(ArrayBuffer, [byteLength, options], newTarget);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/options-maxbytelength-data-allocation-after-object-creation.js b/js/src/tests/test262/built-ins/ArrayBuffer/options-maxbytelength-data-allocation-after-object-creation.js
new file mode 100644
index 0000000000..4e36933b64
--- /dev/null
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/options-maxbytelength-data-allocation-after-object-creation.js
@@ -0,0 +1,44 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2024 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-arraybuffer-length
+description: >
+  The new ArrayBuffer instance is created prior to allocating the Data Block.
+info: |
+  ArrayBuffer ( length [ , options ] )
+
+  ...
+  4. Return ? AllocateArrayBuffer(NewTarget, byteLength, requestedMaxByteLength).
+
+  AllocateArrayBuffer ( constructor, byteLength [ , maxByteLength ] )
+
+  ...
+  4. Let obj be ? OrdinaryCreateFromConstructor(constructor, "%ArrayBuffer.prototype%", slots).
+  5. Let block be ? CreateByteDataBlock(byteLength).
+  ...
+
+features: [resizable-arraybuffer, Reflect.construct]
+---*/
+
+function DummyError() {}
+
+let newTarget = Object.defineProperty(function(){}.bind(null), "prototype", {
+  get() {
+    throw new DummyError();
+  }
+});
+
+assert.throws(DummyError, function() {
+  let byteLength = 0;
+  let options = {
+    maxByteLength: 7 * 1125899906842624
+  };
+
+  // Allocating 7 PiB should fail with a RangeError.
+  // Math.pow(1024, 5) = 1125899906842624
+  Reflect.construct(ArrayBuffer, [], newTarget);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/length.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/length.js
index 1fb8a5b7b1..a2cc47230a 100644
--- a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/length.js
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/length.js
@@ -24,10 +24,11 @@ includes: [propertyHelper.js]
 
 var desc = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, "byteLength");
 
-assert.sameValue(desc.get.length, 0);
-
-verifyNotEnumerable(desc.get, "length");
-verifyNotWritable(desc.get, "length");
-verifyConfigurable(desc.get, "length");
+verifyProperty(desc.get, "length", {
+  value: 0,
+  writable: false,
+  enumerable: false,
+  configurable: true
+});
 
 reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/name.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/name.js
index adac94a271..0ac174bcd0 100644
--- a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/name.js
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/byteLength/name.js
@@ -17,13 +17,11 @@ var descriptor = Object.getOwnPropertyDescriptor(
   ArrayBuffer.prototype, 'byteLength'
 );
 
-assert.sameValue(
-  descriptor.get.name, 'get byteLength',
-  'The value of `descriptor.get.name` is `"get byteLength"`'
-);
-
-verifyNotEnumerable(descriptor.get, 'name');
-verifyNotWritable(descriptor.get, 'name');
-verifyConfigurable(descriptor.get, 'name');
+verifyProperty(descriptor.get, "name", {
+  value: "get byteLength",
+  writable: false,
+  enumerable: false,
+  configurable: true
+});
 
 reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/length.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/length.js
index e2a15cec4a..2c1c8c198b 100644
--- a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/length.js
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/length.js
@@ -22,10 +22,11 @@ info: |
 includes: [propertyHelper.js]
 ---*/
 
-assert.sameValue(ArrayBuffer.prototype.slice.length, 2);
-
-verifyNotEnumerable(ArrayBuffer.prototype.slice, "length");
-verifyNotWritable(ArrayBuffer.prototype.slice, "length");
-verifyConfigurable(ArrayBuffer.prototype.slice, "length");
+verifyProperty(ArrayBuffer.prototype.slice, "length", {
+  value: 2,
+  writable: false,
+  enumerable: false,
+  configurable: true
+});
 
 reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/name.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/name.js
index f80ab724da..98df67d368 100644
--- a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/name.js
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/name.js
@@ -19,10 +19,11 @@ info: |
 includes: [propertyHelper.js]
 ---*/
 
-assert.sameValue(ArrayBuffer.prototype.slice.name, "slice");
-
-verifyNotEnumerable(ArrayBuffer.prototype.slice, "name");
-verifyNotWritable(ArrayBuffer.prototype.slice, "name");
-verifyConfigurable(ArrayBuffer.prototype.slice, "name");
+verifyProperty(ArrayBuffer.prototype.slice, "name", {
+  value: "slice",
+  writable: false,
+  enumerable: false,
+  configurable: true
+});
 
 reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/not-a-constructor.js b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/not-a-constructor.js
index 06ff78c2aa..306c5abdd6 100644
--- a/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/not-a-constructor.js
+++ b/js/src/tests/test262/built-ins/ArrayBuffer/prototype/slice/not-a-constructor.js
@@ -29,7 +29,7 @@ assert.sameValue(
 
 assert.throws(TypeError, () => {
   let ab = new ArrayBuffer(); new ab.slice();
-}, '`let ab = new ArrayBuffer(); new ab.slice()` throws TypeError');
+});
 
 
 reportCompare(0, 0);