Adding upstream version 124.0.1.upstream/124.0.1

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

19 files changed, 552 insertions, 0 deletions

diff --git a/js/src/tests/test262/built-ins/RegExp/lookBehind/alternations.js b/js/src/tests/test262/built-ins/RegExp/lookBehind/alternations.js
new file mode 100644
index 0000000000..64c4247043
--- /dev/null
+++ b/js/src/tests/test262/built-ins/RegExp/lookBehind/alternations.js
@@ -0,0 +1,29 @@
+// Copyright (C) 2017 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-assertion
+description: Alternations are tried left to right, and we do not backtrack into a lookbehind.
+info: |
+  The production Assertion :: (?<=Disjunction) evaluates as follows:
+    1. Evaluate Disjunction with -1 as its direction argument to obtain a Matcher m.
+    2. Return an internal Matcher closure that takes two arguments, a State x and a Continuation
+        c, and performs the following steps:
+      a. Let d be a Continuation that always returns its State argument as a successful MatchResult.
+      b. Call m(x, d) and let r be its result.
+      c. If r is failure, return failure.
+      d. Let y be r's State.
+      e. Let cap be y's captures List.
+      f. Let xe be x's endIndex.
+      g. Let z be the State (xe, cap).
+      h. Call c(z) and return its result.
+features: [regexp-lookbehind]
+includes: [compareArray.js]
+---*/
+
+assert.compareArray("xabcd".match(/.*(?<=(..|...|....))(.*)/), ["xabcd", "cd", ""], "#1");
+assert.compareArray("xabcd".match(/.*(?<=(xx|...|....))(.*)/), ["xabcd", "bcd", ""], "#2");
+assert.compareArray("xxabcd".match(/.*(?<=(xx|...))(.*)/), ["xxabcd", "bcd", ""], "#3");
+assert.compareArray("xxabcd".match(/.*(?<=(xx|xxx))(.*)/), ["xxabcd", "xx", "abcd"], "#4");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/RegExp/lookBehind/back-references-to-captures.js b/js/src/tests/test262/built-ins/RegExp/lookBehind/back-references-to-captures.js
new file mode 100644
index 0000000000..0f1f853ecc
--- /dev/null
+++ b/js/src/tests/test262/built-ins/RegExp/lookBehind/back-references-to-captures.js
@@ -0,0 +1,31 @@
+// Copyright (C) 2017 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-assertion
+description: Back references to captures inside the lookbehind.
+info: |
+  The production Assertion :: (?<=Disjunction) evaluates as follows:
+    1. Evaluate Disjunction with -1 as its direction argument to obtain a Matcher m.
+    2. Return an internal Matcher closure that takes two arguments, a State x and a Continuation
+        c, and performs the following steps:
+      a. Let d be a Continuation that always returns its State argument as a successful MatchResult.
+      b. Call m(x, d) and let r be its result.
+      c. If r is failure, return failure.
+      d. Let y be r's State.
+      e. Let cap be y's captures List.
+      f. Let xe be x's endIndex.
+      g. Let z be the State (xe, cap).
+      h. Call c(z) and return its result.
+features: [regexp-lookbehind]
+includes: [compareArray.js]
+---*/
+
+assert.compareArray("abcCd".match(/(?<=\1(\w))d/i), ["d", "C"], "#1");
+assert.compareArray("abxxd".match(/(?<=\1([abx]))d/), ["d", "x"], "#2");
+assert.compareArray("ababc".match(/(?<=\1(\w+))c/), ["c", "ab"], "#3");
+assert.compareArray("ababbc".match(/(?<=\1(\w+))c/), ["c", "b"], "#4");
+assert.sameValue("ababdc".match(/(?<=\1(\w+))c/), null, "#5");
+assert.compareArray("ababc".match(/(?<=(\w+)\1)c/), ["c", "abab"], "#6");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/RegExp/lookBehind/back-references.js b/js/src/tests/test262/built-ins/RegExp/lookBehind/back-references.js
new file mode 100644
index 0000000000..f6a3f7c842
--- /dev/null
+++ b/js/src/tests/test262/built-ins/RegExp/lookBehind/back-references.js
@@ -0,0 +1,45 @@
+// Copyright (C) 2017 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-assertion
+description: Back references
+info: |
+  The production Assertion :: (?<=Disjunction) evaluates as follows:
+    1. Evaluate Disjunction with -1 as its direction argument to obtain a Matcher m.
+    2. Return an internal Matcher closure that takes two arguments, a State x and a Continuation
+        c, and performs the following steps:
+      a. Let d be a Continuation that always returns its State argument as a successful MatchResult.
+      b. Call m(x, d) and let r be its result.
+      c. If r is failure, return failure.
+      d. Let y be r's State.
+      e. Let cap be y's captures List.
+      f. Let xe be x's endIndex.
+      g. Let z be the State (xe, cap).
+      h. Call c(z) and return its result.
+features: [regexp-lookbehind]
+includes: [compareArray.js]
+---*/
+
+assert.compareArray("abb".match(/(.)(?<=(\1\1))/), ["b", "b", "bb"], "#1");
+assert.compareArray("abB".match(/(.)(?<=(\1\1))/i), ["B", "B", "bB"], "#2");
+assert.compareArray("aabAaBa".match(/((\w)\w)(?<=\1\2\1)/i), ["aB", "aB", "a"], "#3");
+assert.compareArray("aabAaBa".match(/(\w(\w))(?<=\1\2\1)/i), ["Ba", "Ba", "a"], "#4");
+assert.compareArray("abaBbAa".match(/(?=(\w))(?<=(\1))./i), ["b", "b", "B"], "#5");
+assert.compareArray("  'foo'  ".match(/(?<=(.))(\w+)(?=\1)/), ["foo", "'", "foo"], "#6");
+assert.compareArray("  \"foo\"  ".match(/(?<=(.))(\w+)(?=\1)/), ["foo", "\"", "foo"], "#7");
+assert.compareArray("abbb".match(/(.)(?<=\1\1\1)/), ["b", "b"], "#8");
+assert.compareArray("fababab".match(/(..)(?<=\1\1\1)/), ["ab", "ab"], "#9");
+
+assert.sameValue("  .foo\"  ".match(/(?<=(.))(\w+)(?=\1)/), null, "#10");
+assert.sameValue("ab".match(/(.)(?<=\1\1\1)/), null, "#11");
+assert.sameValue("abb".match(/(.)(?<=\1\1\1)/), null, "#12");
+assert.sameValue("ab".match(/(..)(?<=\1\1\1)/), null, "#13");
+assert.sameValue("abb".match(/(..)(?<=\1\1\1)/), null, "#14");
+assert.sameValue("aabb".match(/(..)(?<=\1\1\1)/), null, "#15");
+assert.sameValue("abab".match(/(..)(?<=\1\1\1)/), null, "#16");
+assert.sameValue("fabxbab".match(/(..)(?<=\1\1\1)/), null, "#17");
+assert.sameValue("faxabab".match(/(..)(?<=\1\1\1)/), null, "#18");
+
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/RegExp/lookBehind/browser.js b/js/src/tests/test262/built-ins/RegExp/lookBehind/browser.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/RegExp/lookBehind/browser.js
diff --git a/js/src/tests/test262/built-ins/RegExp/lookBehind/captures-negative.js b/js/src/tests/test262/built-ins/RegExp/lookBehind/captures-negative.js
new file mode 100644
index 0000000000..966d505910
--- /dev/null
+++ b/js/src/tests/test262/built-ins/RegExp/lookBehind/captures-negative.js
@@ -0,0 +1,27 @@
+// Copyright (C) 2017 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-assertion
+description: >
+  Captures inside negative lookbehind. (They never capture.)
+info: |
+  The production Assertion :: (?<=Disjunction) evaluates as follows:
+    1. Evaluate Disjunction with -1 as its direction argument to obtain a Matcher m.
+    2. Return an internal Matcher closure that takes two arguments, a State x and a Continuation
+        c, and performs the following steps:
+      a. Let d be a Continuation that always returns its State argument as a successful MatchResult.
+      b. Call m(x, d) and let r be its result.
+      c. If r is failure, return failure.
+      d. Let y be r's State.
+      e. Let cap be y's captures List.
+      f. Let xe be x's endIndex.
+      g. Let z be the State (xe, cap).
+      h. Call c(z) and return its result.
+features: [regexp-lookbehind]
+includes: [compareArray.js]
+---*/
+
+assert.compareArray("abcdef".match(/(?<!(^|[ab]))\w{2}/), ["de", undefined]);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/RegExp/lookBehind/captures.js b/js/src/tests/test262/built-ins/RegExp/lookBehind/captures.js
new file mode 100644
index 0000000000..7e72785dc3
--- /dev/null
+++ b/js/src/tests/test262/built-ins/RegExp/lookBehind/captures.js
@@ -0,0 +1,36 @@
+// Copyright (C) 2017 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-assertion
+description: >
+  Capturing matches
+info: |
+  The production Assertion :: (?<=Disjunction) evaluates as follows:
+    1. Evaluate Disjunction with -1 as its direction argument to obtain a Matcher m.
+    2. Return an internal Matcher closure that takes two arguments, a State x and a Continuation
+        c, and performs the following steps:
+      a. Let d be a Continuation that always returns its State argument as a successful MatchResult.
+      b. Call m(x, d) and let r be its result.
+      c. If r is failure, return failure.
+      d. Let y be r's State.
+      e. Let cap be y's captures List.
+      f. Let xe be x's endIndex.
+      g. Let z be the State (xe, cap).
+      h. Call c(z) and return its result.
+features: [regexp-lookbehind]
+includes: [compareArray.js]
+---*/
+
+var str = "abcdef";
+assert.compareArray(str.match(/(?<=(c))def/), ["def", "c"], "#1");
+assert.compareArray(str.match(/(?<=(\w{2}))def/), ["def", "bc"], "#2");
+assert.compareArray(str.match(/(?<=(\w(\w)))def/), ["def", "bc", "c"], "#3");
+assert.compareArray(str.match(/(?<=(\w){3})def/), ["def", "a"], "#4");
+assert.compareArray(str.match(/(?<=(bc)|(cd))./), ["d", "bc", undefined], "#5");
+assert.compareArray(str.match(/(?<=([ab]{1,2})\D|(abc))\w/), ["c", "a", undefined], "#6");
+assert.compareArray(str.match(/\D(?<=([ab]+))(\w)/), ["ab", "a", "b"], "#7");
+assert.compareArray(str.match(/(?<=b|c)\w/g), ["c", "d"], "#8");
+assert.compareArray(str.match(/(?<=[b-e])\w{2}/g), ["cd", "ef"], "#9");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/RegExp/lookBehind/do-not-backtrack.js b/js/src/tests/test262/built-ins/RegExp/lookBehind/do-not-backtrack.js
new file mode 100644
index 0000000000..ee44a50ea6
--- /dev/null
+++ b/js/src/tests/test262/built-ins/RegExp/lookBehind/do-not-backtrack.js
@@ -0,0 +1,27 @@
+// Copyright (C) 2017 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-assertion
+description: Do not backtrack into a lookbehind.
+info: |
+  The production Assertion :: (?<=Disjunction) evaluates as follows:
+    1. Evaluate Disjunction with -1 as its direction argument to obtain a Matcher m.
+    2. Return an internal Matcher closure that takes two arguments, a State x and a Continuation
+        c, and performs the following steps:
+      a. Let d be a Continuation that always returns its State argument as a successful MatchResult.
+      b. Call m(x, d) and let r be its result.
+      c. If r is failure, return failure.
+      d. Let y be r's State.
+      e. Let cap be y's captures List.
+      f. Let xe be x's endIndex.
+      g. Let z be the State (xe, cap).
+      h. Call c(z) and return its result.
+features: [regexp-lookbehind]
+---*/
+
+// The lookbehind captures "abc" so that \1 does not match. We do not backtrack
+// to capture only "bc" in the lookbehind.
+assert.sameValue("abcdbc".match(/(?<=([abc]+)).\1/), null);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/RegExp/lookBehind/greedy-loop.js b/js/src/tests/test262/built-ins/RegExp/lookBehind/greedy-loop.js
new file mode 100644
index 0000000000..bd8285a740
--- /dev/null
+++ b/js/src/tests/test262/built-ins/RegExp/lookBehind/greedy-loop.js
@@ -0,0 +1,28 @@
+// Copyright (C) 2017 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-assertion
+description: Greedy loop
+info: |
+  The production Assertion :: (?<=Disjunction) evaluates as follows:
+    1. Evaluate Disjunction with -1 as its direction argument to obtain a Matcher m.
+    2. Return an internal Matcher closure that takes two arguments, a State x and a Continuation
+        c, and performs the following steps:
+      a. Let d be a Continuation that always returns its State argument as a successful MatchResult.
+      b. Call m(x, d) and let r be its result.
+      c. If r is failure, return failure.
+      d. Let y be r's State.
+      e. Let cap be y's captures List.
+      f. Let xe be x's endIndex.
+      g. Let z be the State (xe, cap).
+      h. Call c(z) and return its result.
+features: [regexp-lookbehind]
+includes: [compareArray.js]
+---*/
+
+assert.compareArray("abbbbbbc".match(/(?<=(b+))c/), ["c", "bbbbbb"], "#1");
+assert.compareArray("ab1234c".match(/(?<=(b\d+))c/), ["c", "b1234"], "#2");
+assert.compareArray("ab12b23b34c".match(/(?<=((?:b\d{2})+))c/), ["c", "b12b23b34"], "#3");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/RegExp/lookBehind/misc.js b/js/src/tests/test262/built-ins/RegExp/lookBehind/misc.js
new file mode 100644
index 0000000000..b925a5c49c
--- /dev/null
+++ b/js/src/tests/test262/built-ins/RegExp/lookBehind/misc.js
@@ -0,0 +1,39 @@
+// Copyright (C) 2017 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-assertion
+description: Misc RegExp lookbehind tests
+info: |
+  The production Assertion :: (?<=Disjunction) evaluates as follows:
+    1. Evaluate Disjunction with -1 as its direction argument to obtain a Matcher m.
+    2. Return an internal Matcher closure that takes two arguments, a State x and a Continuation
+        c, and performs the following steps:
+      a. Let d be a Continuation that always returns its State argument as a successful MatchResult.
+      b. Call m(x, d) and let r be its result.
+      c. If r is failure, return failure.
+      d. Let y be r's State.
+      e. Let cap be y's captures List.
+      f. Let xe be x's endIndex.
+      g. Let z be the State (xe, cap).
+      h. Call c(z) and return its result.
+features: [regexp-lookbehind]
+includes: [compareArray.js]
+---*/
+
+assert.sameValue("abcdef".match(/(?<=$abc)def/), null, "#1");
+assert.sameValue("fno".match(/^f.o(?<=foo)$/), null, "#2");
+assert.sameValue("foo".match(/^foo(?<!foo)$/), null, "#3");
+assert.sameValue("foo".match(/^f.o(?<!foo)$/), null, "#4");
+
+assert.compareArray("foo".match(/^foo(?<=foo)$/), ["foo"], "#5");
+assert.compareArray("foo".match(/^f.o(?<=foo)$/), ["foo"], "#6");
+assert.compareArray("fno".match(/^f.o(?<!foo)$/), ["fno"], "#7");
+assert.compareArray("foooo".match(/^foooo(?<=fo+)$/), ["foooo"], "#8");
+assert.compareArray("foooo".match(/^foooo(?<=fo*)$/), ["foooo"], "#9");
+assert.compareArray(/(abc\1)/.exec("abc"), ["abc", "abc"], "#10");
+assert.compareArray(/(abc\1)/.exec("abc\u1234"), ["abc", "abc"], "#11");
+assert.compareArray(/(abc\1)/i.exec("abc"), ["abc", "abc"], "#12");
+assert.compareArray(/(abc\1)/i.exec("abc\u1234"), ["abc", "abc"], "#13");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/RegExp/lookBehind/mutual-recursive.js b/js/src/tests/test262/built-ins/RegExp/lookBehind/mutual-recursive.js
new file mode 100644
index 0000000000..973e204082
--- /dev/null
+++ b/js/src/tests/test262/built-ins/RegExp/lookBehind/mutual-recursive.js
@@ -0,0 +1,29 @@
+// Copyright (C) 2017 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-assertion
+description: Mutual recursive capture/back references
+info: |
+  The production Assertion :: (?<=Disjunction) evaluates as follows:
+    1. Evaluate Disjunction with -1 as its direction argument to obtain a Matcher m.
+    2. Return an internal Matcher closure that takes two arguments, a State x and a Continuation
+        c, and performs the following steps:
+      a. Let d be a Continuation that always returns its State argument as a successful MatchResult.
+      b. Call m(x, d) and let r be its result.
+      c. If r is failure, return failure.
+      d. Let y be r's State.
+      e. Let cap be y's captures List.
+      f. Let xe be x's endIndex.
+      g. Let z be the State (xe, cap).
+      h. Call c(z) and return its result.
+features: [regexp-lookbehind]
+includes: [compareArray.js]
+---*/
+
+assert.compareArray(/(?<=a(.\2)b(\1)).{4}/.exec("aabcacbc"), ["cacb", "a", ""], "#1");
+assert.compareArray(/(?<=a(\2)b(..\1))b/.exec("aacbacb"), ["b", "ac", "ac"], "#2");
+assert.compareArray(/(?<=(?:\1b)(aa))./.exec("aabaax"), ["x", "aa"], "#3");
+assert.compareArray(/(?<=(?:\1|b)(aa))./.exec("aaaax"), ["x", "aa"], "#4");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/RegExp/lookBehind/negative.js b/js/src/tests/test262/built-ins/RegExp/lookBehind/negative.js
new file mode 100644
index 0000000000..68de46042b
--- /dev/null
+++ b/js/src/tests/test262/built-ins/RegExp/lookBehind/negative.js
@@ -0,0 +1,34 @@
+// Copyright (C) 2017 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-assertion
+description: RegExp negative lookbehind
+info: |
+  The production Assertion :: (?<!Disjunction) evaluates as follows:
+    1. Evaluate Disjunction with -1 as its direction argument to obtain a Matcher m.
+    2. Return an internal Matcher closure that takes two arguments, a State x and a
+        Continuation c, and performs the following steps:
+      a. Let d be a Continuation that always returns its State argument as a successful
+          MatchResult.
+      b. Call m(x, d) and let r be its result.
+      c. If r is not failure, return failure.
+      d. Call c(x) and return its result.
+features: [regexp-lookbehind]
+includes: [compareArray.js]
+---*/
+
+assert.compareArray("abcdef".match(/(?<!abc)\w\w\w/), ["abc"], "#1");
+assert.compareArray("abcdef".match(/(?<!a.c)\w\w\w/), ["abc"], "#2");
+assert.compareArray("abcdef".match(/(?<!a\wc)\w\w\w/), ["abc"], "#3");
+assert.compareArray("abcdef".match(/(?<!a[a-z])\w\w\w/), ["abc"], "#4");
+assert.compareArray("abcdef".match(/(?<!a[a-z]{2})\w\w\w/), ["abc"], "#5");
+assert.sameValue("abcdef".match(/(?<!abc)def/), null, "#6");
+assert.sameValue("abcdef".match(/(?<!a.c)def/), null, "#7");
+assert.sameValue("abcdef".match(/(?<!a\wc)def/), null, "#8");
+assert.sameValue("abcdef".match(/(?<!a[a-z][a-z])def/), null, "#9");
+assert.sameValue("abcdef".match(/(?<!a[a-z]{2})def/), null, "#10");
+assert.sameValue("abcdef".match(/(?<!a{1}b{1})cde/), null, "#11");
+assert.sameValue("abcdef".match(/(?<!a{1}[a-z]{2})def/), null, "#12");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/RegExp/lookBehind/nested-lookaround.js b/js/src/tests/test262/built-ins/RegExp/lookBehind/nested-lookaround.js
new file mode 100644
index 0000000000..0448085d35
--- /dev/null
+++ b/js/src/tests/test262/built-ins/RegExp/lookBehind/nested-lookaround.js
@@ -0,0 +1,31 @@
+// Copyright (C) 2017 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-assertion
+description: Nested lookaround
+info: |
+  The production Assertion :: (?<=Disjunction) evaluates as follows:
+    1. Evaluate Disjunction with -1 as its direction argument to obtain a Matcher m.
+    2. Return an internal Matcher closure that takes two arguments, a State x and a Continuation
+        c, and performs the following steps:
+      a. Let d be a Continuation that always returns its State argument as a successful MatchResult.
+      b. Call m(x, d) and let r be its result.
+      c. If r is failure, return failure.
+      d. Let y be r's State.
+      e. Let cap be y's captures List.
+      f. Let xe be x's endIndex.
+      g. Let z be the State (xe, cap).
+      h. Call c(z) and return its result.
+features: [regexp-lookbehind]
+includes: [compareArray.js]
+---*/
+
+assert.compareArray("abcdef".match(/(?<=ab(?=c)\wd)\w\w/), ["ef"], "#1");
+assert.compareArray("abcdef".match(/(?<=a(?=([^a]{2})d)\w{3})\w\w/), ["ef", "bc"], "#2");
+assert.compareArray("abcdef".match(/(?<=a(?=([bc]{2}(?<!a{2}))d)\w{3})\w\w/), ["ef", "bc"], "#3");
+assert.compareArray("faaao".match(/^faaao?(?<=^f[oa]+(?=o))/), ["faaa"], "#4");
+
+assert.sameValue("abcdef".match(/(?<=a(?=([bc]{2}(?<!a*))d)\w{3})\w\w/), null, "#5");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/RegExp/lookBehind/shell.js b/js/src/tests/test262/built-ins/RegExp/lookBehind/shell.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/RegExp/lookBehind/shell.js
diff --git a/js/src/tests/test262/built-ins/RegExp/lookBehind/simple-fixed-length.js b/js/src/tests/test262/built-ins/RegExp/lookBehind/simple-fixed-length.js
new file mode 100644
index 0000000000..6e9a3cd14a
--- /dev/null
+++ b/js/src/tests/test262/built-ins/RegExp/lookBehind/simple-fixed-length.js
@@ -0,0 +1,42 @@
+// Copyright (C) 2017 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-assertion
+description: Simple fixed-length matches
+info: |
+  The production Assertion :: (?<=Disjunction) evaluates as follows:
+    1. Evaluate Disjunction with -1 as its direction argument to obtain a Matcher m.
+    2. Return an internal Matcher closure that takes two arguments, a State x and a Continuation
+        c, and performs the following steps:
+      a. Let d be a Continuation that always returns its State argument as a successful MatchResult.
+      b. Call m(x, d) and let r be its result.
+      c. If r is failure, return failure.
+      d. Let y be r's State.
+      e. Let cap be y's captures List.
+      f. Let xe be x's endIndex.
+      g. Let z be the State (xe, cap).
+      h. Call c(z) and return its result.
+features: [regexp-lookbehind]
+includes: [compareArray.js]
+---*/
+
+assert.sameValue("b".match(/^.(?<=a)/), null, "#1");
+assert.sameValue("boo".match(/^f\w\w(?<=\woo)/), null, "#2");
+assert.sameValue("fao".match(/^f\w\w(?<=\woo)/), null, "#3");
+assert.sameValue("foa".match(/^f\w\w(?<=\woo)/), null, "#4");
+
+assert.compareArray("a".match(/^.(?<=a)/), ["a"], "#5");
+assert.compareArray("foo1".match(/^f..(?<=.oo)/), ["foo"], "#6");
+assert.compareArray("foo2".match(/^f\w\w(?<=\woo)/), ["foo"], "#7");
+assert.compareArray("abcdef".match(/(?<=abc)\w\w\w/), ["def"], "#8");
+assert.compareArray("abcdef".match(/(?<=a.c)\w\w\w/), ["def"], "#9");
+assert.compareArray("abcdef".match(/(?<=a\wc)\w\w\w/), ["def"], "#10");
+assert.compareArray("abcdef".match(/(?<=a[a-z])\w\w\w/), ["cde"], "#11");
+assert.compareArray("abcdef".match(/(?<=a[a-z][a-z])\w\w\w/), ["def"], "#12");
+assert.compareArray("abcdef".match(/(?<=a[a-z]{2})\w\w\w/), ["def"], "#13");
+assert.compareArray("abcdef".match(/(?<=a{1})\w\w\w/), ["bcd"], "#14");
+assert.compareArray("abcdef".match(/(?<=a{1}b{1})\w\w\w/), ["cde"], "#15");
+assert.compareArray("abcdef".match(/(?<=a{1}[a-z]{2})\w\w\w/), ["def"], "#16");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/RegExp/lookBehind/sliced-strings.js b/js/src/tests/test262/built-ins/RegExp/lookBehind/sliced-strings.js
new file mode 100644
index 0000000000..1e3b5f6367
--- /dev/null
+++ b/js/src/tests/test262/built-ins/RegExp/lookBehind/sliced-strings.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2017 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-assertion
+description: Sliced strings
+info: |
+  Rationale from https://github.com/tc39/test262/pull/999#discussion_r113807747
+
+  Since this test originates from V8, this targets V8's sliced strings, which are used for
+  substrings above a length of 13 characters. I wrote this test for exactly the reason
+  @littledan mentioned. That's why the variable name is called oob_subject. The underlying string
+  backing store extends beyond the actual boundary of the sliced string.
+features: [regexp-lookbehind]
+---*/
+
+var oob_subject = "abcdefghijklmnabcdefghijklmn".slice(14);
+assert.sameValue(oob_subject.match(/(?=(abcdefghijklmn))(?<=\1)a/i), null, "");
+assert.sameValue(oob_subject.match(/(?=(abcdefghijklmn))(?<=\1)a/), null, "");
+assert.sameValue("abcdefgabcdefg".slice(1).match(/(?=(abcdefg))(?<=\1)/), null, "");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/RegExp/lookBehind/start-of-line.js b/js/src/tests/test262/built-ins/RegExp/lookBehind/start-of-line.js
new file mode 100644
index 0000000000..de7c2bc762
--- /dev/null
+++ b/js/src/tests/test262/built-ins/RegExp/lookBehind/start-of-line.js
@@ -0,0 +1,43 @@
+// Copyright (C) 2017 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-assertion
+description: Start of line matches
+info: |
+  The production Assertion :: (?<=Disjunction) evaluates as follows:
+    1. Evaluate Disjunction with -1 as its direction argument to obtain a Matcher m.
+    2. Return an internal Matcher closure that takes two arguments, a State x and a Continuation
+        c, and performs the following steps:
+      a. Let d be a Continuation that always returns its State argument as a successful MatchResult.
+      b. Call m(x, d) and let r be its result.
+      c. If r is failure, return failure.
+      d. Let y be r's State.
+      e. Let cap be y's captures List.
+      f. Let xe be x's endIndex.
+      g. Let z be the State (xe, cap).
+      h. Call c(z) and return its result.
+features: [regexp-lookbehind]
+includes: [compareArray.js]
+---*/
+
+assert.sameValue("abcdef".match(/(?<=^[^a-c]{3})def/), null, "#1");
+assert.sameValue("foooo".match(/"^foooo(?<=^o+)$/), null, "#2");
+assert.sameValue("foooo".match(/"^foooo(?<=^o*)$/), null, "#3");
+
+assert.compareArray("abcdef".match(/(?<=^abc)def/), ["def"], "#4");
+assert.compareArray("abcdef".match(/(?<=^[a-c]{3})def/), ["def"], "#5");
+assert.compareArray("xyz\nabcdef".match(/(?<=^[a-c]{3})def/m), ["def"], "#6");
+assert.compareArray("ab\ncd\nefg".match(/(?<=^)\w+/gm), ["ab", "cd", "efg"], "#7");
+assert.compareArray("ab\ncd\nefg".match(/\w+(?<=$)/gm), ["ab", "cd", "efg"], "#8");
+assert.compareArray("ab\ncd\nefg".match(/(?<=^)\w+(?<=$)/gm), ["ab", "cd", "efg"], "#9");
+
+assert.compareArray("foo".match(/^foo(?<=^fo+)$/), ["foo"], "#10");
+assert.compareArray("foooo".match(/^foooo(?<=^fo*)/), ["foooo"], "#11");
+assert.compareArray("foo".match(/^(f)oo(?<=^\1o+)$/), ["foo", "f"], "#12");
+assert.compareArray("foo".match(/^(f)oo(?<=^\1o+)$/i), ["foo", "f"], "#13");
+assert.compareArray("foo\u1234".match(/^(f)oo(?<=^\1o+).$/i), ["foo\u1234", "f"], "#14");
+assert.compareArray("abcdefdef".match(/(?<=^\w+)def/), ["def"], "#15");
+assert.compareArray("abcdefdef".match(/(?<=^\w+)def/g), ["def", "def"], "#16");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/RegExp/lookBehind/sticky.js b/js/src/tests/test262/built-ins/RegExp/lookBehind/sticky.js
new file mode 100644
index 0000000000..a7e83a0e2e
--- /dev/null
+++ b/js/src/tests/test262/built-ins/RegExp/lookBehind/sticky.js
@@ -0,0 +1,32 @@
+// Copyright (C) 2017 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-assertion
+description: Sticky
+info: |
+  The production Assertion :: (?<=Disjunction) evaluates as follows:
+    1. Evaluate Disjunction with -1 as its direction argument to obtain a Matcher m.
+    2. Return an internal Matcher closure that takes two arguments, a State x and a Continuation
+        c, and performs the following steps:
+      a. Let d be a Continuation that always returns its State argument as a successful MatchResult.
+      b. Call m(x, d) and let r be its result.
+      c. If r is failure, return failure.
+      d. Let y be r's State.
+      e. Let cap be y's captures List.
+      f. Let xe be x's endIndex.
+      g. Let z be the State (xe, cap).
+      h. Call c(z) and return its result.
+features: [regexp-lookbehind]
+includes: [compareArray.js]
+---*/
+
+var re1 = /(?<=^(\w+))def/g;
+assert.compareArray(re1.exec("abcdefdef"), ["def", "abc"], "#1");
+assert.compareArray(re1.exec("abcdefdef"), ["def", "abcdef"], "#2");
+
+var re2 = /\Bdef/g;
+assert.compareArray(re2.exec("abcdefdef"), ["def"], "#3");
+assert.compareArray(re2.exec("abcdefdef"), ["def"], "#4");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/RegExp/lookBehind/variable-length.js b/js/src/tests/test262/built-ins/RegExp/lookBehind/variable-length.js
new file mode 100644
index 0000000000..fcfa84a164
--- /dev/null
+++ b/js/src/tests/test262/built-ins/RegExp/lookBehind/variable-length.js
@@ -0,0 +1,27 @@
+// Copyright (C) 2017 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-assertion
+description: Variable-length matches
+info: |
+  The production Assertion :: (?<=Disjunction) evaluates as follows:
+    1. Evaluate Disjunction with -1 as its direction argument to obtain a Matcher m.
+    2. Return an internal Matcher closure that takes two arguments, a State x and a Continuation
+        c, and performs the following steps:
+      a. Let d be a Continuation that always returns its State argument as a successful MatchResult.
+      b. Call m(x, d) and let r be its result.
+      c. If r is failure, return failure.
+      d. Let y be r's State.
+      e. Let cap be y's captures List.
+      f. Let xe be x's endIndex.
+      g. Let z be the State (xe, cap).
+      h. Call c(z) and return its result.
+features: [regexp-lookbehind]
+includes: [compareArray.js]
+---*/
+
+assert.compareArray("abcdef".match(/(?<=[a|b|c]*)[^a|b|c]{3}/), ["def"], "#1");
+assert.compareArray("abcdef".match(/(?<=\w*)[^a|b|c]{3}/), ["def"], "#2");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/RegExp/lookBehind/word-boundary.js b/js/src/tests/test262/built-ins/RegExp/lookBehind/word-boundary.js
new file mode 100644
index 0000000000..7e91b52e07
--- /dev/null
+++ b/js/src/tests/test262/built-ins/RegExp/lookBehind/word-boundary.js
@@ -0,0 +1,30 @@
+// Copyright (C) 2017 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-assertion
+description: Word boundary
+info: |
+  The production Assertion :: (?<=Disjunction) evaluates as follows:
+    1. Evaluate Disjunction with -1 as its direction argument to obtain a Matcher m.
+    2. Return an internal Matcher closure that takes two arguments, a State x and a Continuation
+        c, and performs the following steps:
+      a. Let d be a Continuation that always returns its State argument as a successful MatchResult.
+      b. Call m(x, d) and let r be its result.
+      c. If r is failure, return failure.
+      d. Let y be r's State.
+      e. Let cap be y's captures List.
+      f. Let xe be x's endIndex.
+      g. Let z be the State (xe, cap).
+      h. Call c(z) and return its result.
+features: [regexp-lookbehind]
+includes: [compareArray.js]
+---*/
+
+// Word boundary matches.
+assert.compareArray("abc def".match(/(?<=\b)[d-f]{3}/), ["def"], "#1");
+assert.compareArray("ab cdef".match(/(?<=\B)\w{3}/), ["def"], "#2");
+assert.compareArray("ab cdef".match(/(?<=\B)(?<=c(?<=\w))\w{3}/), ["def"], "#3");
+assert.sameValue("abcdef".match(/(?<=\b)[d-f]{3}/), null, "#4");
+
+reportCompare(0, 0);