Adding upstream version 124.0.1.upstream/124.0.1

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

90 files changed, 2270 insertions, 0 deletions

diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/Symbol.toStringTag.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/Symbol.toStringTag.js
new file mode 100644
index 0000000000..07c7d5453e
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/Symbol.toStringTag.js
@@ -0,0 +1,24 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+description: >
+    `Symbol.toStringTag` property descriptor
+info: |
+    The initial value of the @@toStringTag property is the String value
+    "SharedArrayBuffer".
+
+    This property has the attributes { [[Writable]]: false, [[Enumerable]]:
+    false, [[Configurable]]: true }.
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer, Symbol.toStringTag]
+---*/
+
+assert.sameValue(SharedArrayBuffer.prototype[Symbol.toStringTag], 'SharedArrayBuffer');
+
+verifyNotEnumerable(SharedArrayBuffer.prototype, Symbol.toStringTag);
+verifyNotWritable(SharedArrayBuffer.prototype, Symbol.toStringTag);
+verifyConfigurable(SharedArrayBuffer.prototype, Symbol.toStringTag);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/browser.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/browser.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/browser.js
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/browser.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/browser.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/browser.js
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/invoked-as-accessor.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/invoked-as-accessor.js
new file mode 100644
index 0000000000..1276245d2d
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/invoked-as-accessor.js
@@ -0,0 +1,15 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: Requires this value to have a [[ArrayBufferData]] internal slot
+features: [SharedArrayBuffer]
+---*/
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.byteLength;
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/invoked-as-func.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/invoked-as-func.js
new file mode 100644
index 0000000000..111c1f4cb7
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/invoked-as-func.js
@@ -0,0 +1,18 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+description: Throws a TypeError exception when invoked as a function
+features: [SharedArrayBuffer]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  SharedArrayBuffer.prototype, "byteLength"
+).get;
+
+assert.throws(TypeError, function() {
+  getter();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/length.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/length.js
new file mode 100644
index 0000000000..22a944cb3c
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/length.js
@@ -0,0 +1,21 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  get SharedArrayBuffer.prototype.byteLength.length is 0.
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer]
+---*/
+
+var desc = Object.getOwnPropertyDescriptor(SharedArrayBuffer.prototype, "byteLength");
+
+assert.sameValue(desc.get.length, 0);
+
+verifyNotEnumerable(desc.get, "length");
+verifyNotWritable(desc.get, "length");
+verifyConfigurable(desc.get, "length");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/name.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/name.js
new file mode 100644
index 0000000000..28dff46979
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/name.js
@@ -0,0 +1,26 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+description: >
+  get SharedArrayBuffer.prototype.byteLength
+
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer]
+---*/
+
+var descriptor = Object.getOwnPropertyDescriptor(
+  SharedArrayBuffer.prototype, 'byteLength'
+);
+
+assert.sameValue(
+  descriptor.get.name, 'get byteLength',
+  'The value of `descriptor.get.name` is `"get byteLength"`'
+);
+
+verifyNotEnumerable(descriptor.get, 'name');
+verifyNotWritable(descriptor.get, 'name');
+verifyConfigurable(descriptor.get, 'name');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/prop-desc.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/prop-desc.js
new file mode 100644
index 0000000000..9f9d334e62
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/prop-desc.js
@@ -0,0 +1,20 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+description: >
+  "byteLength" property of SharedArrayBuffer.prototype
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer]
+---*/
+
+var desc = Object.getOwnPropertyDescriptor(SharedArrayBuffer.prototype, "byteLength");
+
+assert.sameValue(desc.set, undefined);
+assert.sameValue(typeof desc.get, "function");
+
+verifyNotEnumerable(SharedArrayBuffer.prototype, "byteLength");
+verifyConfigurable(SharedArrayBuffer.prototype, "byteLength");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/return-bytelength.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/return-bytelength.js
new file mode 100644
index 0000000000..05a95c91fe
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/return-bytelength.js
@@ -0,0 +1,16 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+description: Return value from [[ByteLength]] internal slot
+features: [SharedArrayBuffer]
+---*/
+
+var ab1 = new SharedArrayBuffer(0);
+assert.sameValue(ab1.byteLength, 0);
+
+var ab2 = new SharedArrayBuffer(42);
+assert.sameValue(ab2.byteLength, 42);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/shell.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/shell.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/shell.js
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/this-has-no-typedarrayname-internal.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/this-has-no-typedarrayname-internal.js
new file mode 100644
index 0000000000..2052be2229
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/this-has-no-typedarrayname-internal.js
@@ -0,0 +1,34 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+description: >
+  Throws a TypeError exception when `this` does not have a [[ArrayBufferData]]
+  internal slot
+features: [SharedArrayBuffer, DataView, Int8Array]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  SharedArrayBuffer.prototype, "byteLength"
+).get;
+
+assert.throws(TypeError, function() {
+  getter.call({});
+});
+
+assert.throws(TypeError, function() {
+  getter.call([]);
+});
+
+var ta = new Int8Array(new SharedArrayBuffer(8));
+assert.throws(TypeError, function() {
+  getter.call(ta);
+});
+
+var dv = new DataView(new SharedArrayBuffer(8), 0);
+assert.throws(TypeError, function() {
+  getter.call(dv);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/this-is-arraybuffer.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/this-is-arraybuffer.js
new file mode 100644
index 0000000000..a5868b3427
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/this-is-arraybuffer.js
@@ -0,0 +1,20 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-get-sharedarraybuffer.prototype.bytelength
+description: Throws a TypeError exception when `this` is an ArrayBuffer
+features: [SharedArrayBuffer]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  SharedArrayBuffer.prototype, "byteLength"
+).get;
+
+assert.throws(TypeError, function() {
+  var ab = new ArrayBuffer(4);
+  getter.call(ab);
+}, "`this` cannot be an ArrayBuffer");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/this-is-not-object.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/this-is-not-object.js
new file mode 100644
index 0000000000..5e7fa4e32b
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/this-is-not-object.js
@@ -0,0 +1,43 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+description: Throws a TypeError exception when `this` is not Object
+features: [SharedArrayBuffer, Symbol]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  SharedArrayBuffer.prototype, "byteLength"
+).get;
+
+assert.throws(TypeError, function() {
+  getter.call(undefined);
+}, "this is undefined");
+
+assert.throws(TypeError, function() {
+  getter.call(null);
+}, "this is null");
+
+assert.throws(TypeError, function() {
+  getter.call(42);
+}, "this is 42");
+
+assert.throws(TypeError, function() {
+  getter.call("1");
+}, "this is a string");
+
+assert.throws(TypeError, function() {
+  getter.call(true);
+}, "this is true");
+
+assert.throws(TypeError, function() {
+  getter.call(false);
+}, "this is false");
+
+var s = Symbol("s");
+assert.throws(TypeError, function() {
+  getter.call(s);
+}, "this is a Symbol");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/constructor.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/constructor.js
new file mode 100644
index 0000000000..6d776dcd28
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/constructor.js
@@ -0,0 +1,19 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  The `SharedArrayBuffer.prototype.constructor` property descriptor.
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer]
+---*/
+
+assert.sameValue(SharedArrayBuffer.prototype.constructor, SharedArrayBuffer);
+
+verifyNotEnumerable(SharedArrayBuffer.prototype, "constructor");
+verifyWritable(SharedArrayBuffer.prototype, "constructor");
+verifyConfigurable(SharedArrayBuffer.prototype, "constructor");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/browser.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/browser.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/browser.js
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/descriptor.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/descriptor.js
new file mode 100644
index 0000000000..30a04e7720
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/descriptor.js
@@ -0,0 +1,25 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: >
+  SharedArrayBuffer.prototype.grow has default data property attributes.
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  17 ECMAScript Standard Built-in Objects:
+    Every other data property described in clauses 18 through 26 and in
+    Annex B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+verifyProperty(SharedArrayBuffer.prototype, 'grow', {
+  enumerable: false,
+  writable: true,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/extensible.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/extensible.js
new file mode 100644
index 0000000000..ac92e75332
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/extensible.js
@@ -0,0 +1,18 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: SharedArrayBuffer.prototype.grow is extensible.
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  17 ECMAScript Standard Built-in Objects:
+    Unless specified otherwise, the [[Extensible]] internal slot
+    of a built-in object initially has the value true.
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+assert(Object.isExtensible(SharedArrayBuffer.prototype.grow));
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/grow-larger-size.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/grow-larger-size.js
new file mode 100644
index 0000000000..750a5896e3
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/grow-larger-size.js
@@ -0,0 +1,50 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: >
+  Behavior when attempting to grow a growable array buffer to a larger size
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  3. If IsSharedArrayBuffer(O) is false throw a TypeError exception.
+  4. Let newByteLength be ? ToIntegerOrInfinity(newLength).
+  5. Let hostHandled be ? HostGrowSharedArrayBuffer(O, newByteLength).
+  6. If hostHandled is handled, return undefined.
+  [...]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var sab = new SharedArrayBuffer(4, {maxByteLength: 5});
+var result;
+
+// If the host chooses to throw as allowed by the specification, the observed
+// behavior will be identical to the case where
+// `SharedArrayBuffer.prototype.grow` has not been implemented. The following
+// assertion prevents this test from passing in runtimes which have not
+// implemented the method.
+assert.sameValue(typeof sab.grow, 'function');
+
+try {
+  result = ab.grow(5);
+} catch (_) {}
+
+// One of the following three conditions must be met:
+//
+// - HostGrowSharedArrayBuffer returns an abrupt completion
+// - HostGrowSharedArrayBuffer handles the grow operation, and the `grow`
+//   method returns early
+// - HostGrowSharedArrayBuffer does not handle the grow operation, and the
+//   `grow` method executes its final steps
+//
+// All three conditions have the same effect on the value of `result`.
+assert.sameValue(result, undefined, 'normal completion value');
+
+// Neither the length nor the contents of the SharedArrayBuffer are guaranteed
+// by the host-defined abstract operation, so they are not asserted in this
+// test.
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/grow-same-size.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/grow-same-size.js
new file mode 100644
index 0000000000..2e610ac491
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/grow-same-size.js
@@ -0,0 +1,50 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: >
+  Behavior when attempting to grow a growable array buffer to its current size
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  3. If IsSharedArrayBuffer(O) is false throw a TypeError exception.
+  4. Let newByteLength be ? ToIntegerOrInfinity(newLength).
+  5. Let hostHandled be ? HostGrowSharedArrayBuffer(O, newByteLength).
+  6. If hostHandled is handled, return undefined.
+  [...]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var sab = new SharedArrayBuffer(4, {maxByteLength: 5});
+var result;
+
+// If the host chooses to throw as allowed by the specification, the observed
+// behavior will be identical to the case where
+// `SharedArrayBuffer.prototype.grow` has not been implemented. The following
+// assertion prevents this test from passing in runtimes which have not
+// implemented the method.
+assert.sameValue(typeof sab.grow, 'function');
+
+try {
+  result = ab.grow(4);
+} catch (_) {}
+
+// One of the following three conditions must be met:
+//
+// - HostGrowSharedArrayBuffer returns an abrupt completion
+// - HostGrowSharedArrayBuffer handles the grow operation, and the `grow`
+//   method returns early
+// - HostGrowSharedArrayBuffer does not handle the grow operation, and the
+//   `grow` method executes its final steps
+//
+// All three conditions have the same effect on the value of `result`.
+assert.sameValue(result, undefined, 'normal completion value');
+
+// Neither the length nor the contents of the SharedArrayBuffer are guaranteed
+// by the host-defined abstract operation, so they are not asserted in this
+// test.
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/grow-smaller-size.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/grow-smaller-size.js
new file mode 100644
index 0000000000..c85c7d61cf
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/grow-smaller-size.js
@@ -0,0 +1,50 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: >
+  Behavior when attempting to grow a growable array buffer to a smaller size
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  3. If IsSharedArrayBuffer(O) is false throw a TypeError exception.
+  4. Let newByteLength be ? ToIntegerOrInfinity(newLength).
+  5. Let hostHandled be ? HostGrowSharedArrayBuffer(O, newByteLength).
+  6. If hostHandled is handled, return undefined.
+  [...]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var sab = new SharedArrayBuffer(4, {maxByteLength: 5});
+var result;
+
+// If the host chooses to throw as allowed by the specification, the observed
+// behavior will be identical to the case where
+// `SharedArrayBuffer.prototype.grow` has not been implemented. The following
+// assertion prevents this test from passing in runtimes which have not
+// implemented the method.
+assert.sameValue(typeof sab.grow, 'function');
+
+try {
+  result = ab.grow(3);
+} catch (_) {}
+
+// One of the following three conditions must be met:
+//
+// - HostGrowSharedArrayBuffer returns an abrupt completion
+// - HostGrowSharedArrayBuffer handles the grow operation, and the `grow`
+//   method returns early
+// - HostGrowSharedArrayBuffer does not handle the grow operation, and the
+//   `grow` method executes its final steps
+//
+// All three conditions have the same effect on the value of `result`.
+assert.sameValue(result, undefined, 'normal completion value');
+
+// Neither the length nor the contents of the SharedArrayBuffer are guaranteed
+// by the host-defined abstract operation, so they are not asserted in this
+// test.
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/length.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/length.js
new file mode 100644
index 0000000000..2540dec1c6
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/length.js
@@ -0,0 +1,33 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: >
+  SharedArrayBuffer.prototype.grow.length is 1.
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  17 ECMAScript Standard Built-in Objects:
+    Every built-in Function object, including constructors, has a length
+    property whose value is an integer. Unless otherwise specified, this
+    value is equal to the largest number of named arguments shown in the
+    subclause headings for the function description, including optional
+    parameters. However, rest parameters shown using the form “...name”
+    are not included in the default argument count.
+
+    Unless otherwise specified, the length property of a built-in Function
+    object has the attributes { [[Writable]]: false, [[Enumerable]]: false,
+    [[Configurable]]: true }.
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+verifyProperty(SharedArrayBuffer.prototype.grow, 'length', {
+  value: 1,
+  enumerable: false,
+  writable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/name.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/name.js
new file mode 100644
index 0000000000..1442bdde0a
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/name.js
@@ -0,0 +1,30 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: >
+  SharedArrayBuffer.prototype.grow.name is "grow".
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  17 ECMAScript Standard Built-in Objects:
+    Every built-in Function object, including constructors, that is not
+    identified as an anonymous function has a name property whose value
+    is a String.
+
+    Unless otherwise specified, the name property of a built-in Function
+    object, if it exists, has the attributes { [[Writable]]: false,
+    [[Enumerable]]: false, [[Configurable]]: true }.
+features: [SharedArrayBuffer, resizable-arraybuffer]
+includes: [propertyHelper.js]
+---*/
+
+verifyProperty(SharedArrayBuffer.prototype.grow, 'name', {
+  value: 'grow',
+  enumerable: false,
+  writable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/new-length-excessive.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/new-length-excessive.js
new file mode 100644
index 0000000000..eff3d1ff50
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/new-length-excessive.js
@@ -0,0 +1,27 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: >
+  Throws a RangeError the newLength value is larger than the max byte length
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  3. If IsSharedArrayBuffer(O) is false, throw a TypeError exception.
+  4. Let newByteLength be ? ToIntegerOrInfinity(newLength).
+  5. If newByteLength < 0 or newByteLength > O.[[ArrayBufferMaxByteLength]],
+     throw a RangeError exception.
+  [...]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var ab = new SharedArrayBuffer(4, {maxByteLength: 4});
+
+assert.throws(RangeError, function() {
+  ab.grow(5);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/new-length-negative.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/new-length-negative.js
new file mode 100644
index 0000000000..6eef109cd4
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/new-length-negative.js
@@ -0,0 +1,27 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: >
+  Throws a RangeError the newLength value is less than zero
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  3. If IsSharedArrayBuffer(O) is false, throw a TypeError exception.
+  4. Let newByteLength be ? ToIntegerOrInfinity(newLength).
+  5. If newByteLength < 0 or newByteLength > O.[[ArrayBufferMaxByteLength]],
+     throw a RangeError exception.
+  [...]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var ab = new SharedArrayBuffer(4, {maxByteLength: 4});
+
+assert.throws(RangeError, function() {
+  ab.grow(-1);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/new-length-non-number.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/new-length-non-number.js
new file mode 100644
index 0000000000..be5009f23c
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/new-length-non-number.js
@@ -0,0 +1,39 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: Throws a TypeError if provided length cannot be coerced to a number
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  3. If IsSharedArrayBuffer(O) is false, throw a TypeError exception.
+  4. Let newByteLength be ? ToIntegerOrInfinity(newLength).
+  [...]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var log = [];
+var newLength = {
+  toString: function() {
+    log.push('toString');
+    return {};
+  },
+  valueOf: function() {
+    log.push('valueOf');
+    return {};
+  }
+};
+var ab = new SharedArrayBuffer(0, {maxByteLength: 4});
+
+assert.throws(TypeError, function() {
+  ab.grow(newLength);
+});
+
+assert.sameValue(log.length, 2);
+assert.sameValue(log[0], 'valueOf');
+assert.sameValue(log[1], 'toString');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/nonconstructor.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/nonconstructor.js
new file mode 100644
index 0000000000..cd4d59085a
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/nonconstructor.js
@@ -0,0 +1,26 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: >
+  SharedArrayBuffer.prototype.grow is not a constructor function.
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  17 ECMAScript Standard Built-in Objects:
+    Built-in function objects that are not identified as constructors do not
+    implement the [[Construct]] internal method unless otherwise specified
+    in the description of a particular function.
+includes: [isConstructor.js]
+features: [SharedArrayBuffer, resizable-arraybuffer, Reflect.construct]
+---*/
+
+assert(!isConstructor(SharedArrayBuffer.prototype.grow), "SharedArrayBuffer.prototype.grow is not a constructor");
+
+var arrayBuffer = new SharedArrayBuffer(8);
+assert.throws(TypeError, function() {
+  new arrayBuffer.grow();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/shell.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/shell.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/shell.js
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/this-is-not-arraybuffer-object.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/this-is-not-arraybuffer-object.js
new file mode 100644
index 0000000000..7c92420ddc
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/this-is-not-arraybuffer-object.js
@@ -0,0 +1,31 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: >
+  Throws a TypeError if `this` does not have an [[ArrayBufferData]] internal slot.
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  [...]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+assert.sameValue(typeof SharedArrayBuffer.prototype.grow, 'function');
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.grow();
+}, '`this` value is the SharedArrayBuffer prototype');
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.grow.call({});
+}, '`this` value is an object');
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.grow.call([]);
+}, '`this` value is an array');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/this-is-not-object.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/this-is-not-object.js
new file mode 100644
index 0000000000..4419d23dc0
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/this-is-not-object.js
@@ -0,0 +1,47 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: Throws a TypeError if `this` valueis not an object.
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  [...]
+features: [BigInt, SharedArrayBuffer, Symbol, resizable-arraybuffer]
+---*/
+
+assert.sameValue(typeof SharedArrayBuffer.prototype.grow, "function");
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.grow.call(undefined);
+}, "`this` value is undefined");
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.grow.call(null);
+}, "`this` value is null");
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.grow.call(true);
+}, "`this` value is Boolean");
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.grow.call("");
+}, "`this` value is String");
+
+var symbol = Symbol();
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.grow.call(symbol);
+}, "`this` value is Symbol");
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.grow.call(1);
+}, "`this` value is Number");
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.grow.call(1n);
+}, "`this` value is bigint");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/this-is-not-resizable-arraybuffer-object.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/this-is-not-resizable-arraybuffer-object.js
new file mode 100644
index 0000000000..2fd55596ad
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/this-is-not-resizable-arraybuffer-object.js
@@ -0,0 +1,41 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: >
+  Throws a TypeError if `this` does not have an [[ArrayBufferMaxByteLength]] internal slot.
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  [...]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var ab;
+
+assert.sameValue(typeof SharedArrayBuffer.prototype.grow, 'function');
+
+ab = new SharedArrayBuffer(4);
+assert.throws(TypeError, function() {
+  ab.grow(0);
+}, 'zero byte length');
+
+ab = new SharedArrayBuffer(4);
+assert.throws(TypeError, function() {
+  ab.grow(3);
+}, 'smaller byte length');
+
+ab = new SharedArrayBuffer(4);
+assert.throws(TypeError, function() {
+  ab.grow(4);
+}, 'same byte length');
+
+ab = new SharedArrayBuffer(4);
+assert.throws(TypeError, function() {
+  ab.grow(5);
+}, 'larger byte length');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/this-is-sharedarraybuffer.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/this-is-sharedarraybuffer.js
new file mode 100644
index 0000000000..ccfddacf8e
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/this-is-sharedarraybuffer.js
@@ -0,0 +1,23 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: Throws a TypeError if `this` value is an ArrayBuffer
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  3. If IsSharedArrayBuffer(O) is false, throw a TypeError exception.
+  [...]
+features: [ArrayBuffer, SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var ab = new ArrayBuffer(0);
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.grow.call(ab);
+}, '`this` value cannot be an ArrayBuffer');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/browser.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/browser.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/browser.js
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/invoked-as-accessor.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/invoked-as-accessor.js
new file mode 100644
index 0000000000..78925bfeab
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/invoked-as-accessor.js
@@ -0,0 +1,20 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.growable
+description: Requires this value to have a [[ArrayBufferData]] internal slot
+info: |
+  get SharedArrayBuffer.prototype.growable
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.growable;
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/invoked-as-func.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/invoked-as-func.js
new file mode 100644
index 0000000000..ac07935237
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/invoked-as-func.js
@@ -0,0 +1,26 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.growable
+description: Throws a TypeError exception when invoked as a function
+info: |
+  get SharedArrayBuffer.prototype.growable
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  SharedArrayBuffer.prototype, 'growable'
+).get;
+
+assert.sameValue(typeof getter, 'function');
+
+assert.throws(TypeError, function() {
+  getter();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/length.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/length.js
new file mode 100644
index 0000000000..b46a2ead01
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/length.js
@@ -0,0 +1,35 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.growable
+description: >
+  get SharedArrayBuffer.prototype.growable.length is 0.
+info: |
+  get SharedArrayBuffer.prototype.resizeable
+
+  17 ECMAScript Standard Built-in Objects:
+    Every built-in Function object, including constructors, has a length
+    property whose value is an integer. Unless otherwise specified, this
+    value is equal to the largest number of named arguments shown in the
+    subclause headings for the function description, including optional
+    parameters. However, rest parameters shown using the form “...name”
+    are not included in the default argument count.
+
+    Unless otherwise specified, the length property of a built-in Function
+    object has the attributes { [[Writable]]: false, [[Enumerable]]: false,
+    [[Configurable]]: true }.
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var desc = Object.getOwnPropertyDescriptor(SharedArrayBuffer.prototype, 'growable');
+
+verifyProperty(desc.get, 'length', {
+  value: 0,
+  enumerable: false,
+  writable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/name.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/name.js
new file mode 100644
index 0000000000..6b24f06a2e
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/name.js
@@ -0,0 +1,27 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.growable
+description: >
+  get SharedArrayBuffer.prototype.growable
+
+  17 ECMAScript Standard Built-in Objects
+
+  Functions that are specified as get or set accessor functions of built-in
+  properties have "get " or "set " prepended to the property name string.
+
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var desc = Object.getOwnPropertyDescriptor(SharedArrayBuffer.prototype, 'growable');
+
+verifyProperty(desc.get, 'name', {
+  value: 'get growable',
+  enumerable: false,
+  writable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/prop-desc.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/prop-desc.js
new file mode 100644
index 0000000000..d48198652c
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/prop-desc.js
@@ -0,0 +1,28 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.growable
+description: >
+  "growable" property of SharedArrayBuffer.prototype
+info: |
+  SharedArrayBuffer.prototype.growable is an accessor property whose set accessor
+  function is undefined.
+
+  Section 17: Every accessor property described in clauses 18 through 26 and in
+  Annex B.2 has the attributes {[[Enumerable]]: false, [[Configurable]]: true }
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var desc = Object.getOwnPropertyDescriptor(SharedArrayBuffer.prototype, 'growable');
+
+assert.sameValue(desc.set, undefined);
+assert.sameValue(typeof desc.get, 'function');
+
+verifyProperty(SharedArrayBuffer.prototype, 'growable', {
+  enumerable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/return-growable.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/return-growable.js
new file mode 100644
index 0000000000..b97ea9633e
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/return-growable.js
@@ -0,0 +1,32 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.growable
+description: Return value according to [[ArrayBufferMaxByteLength]] internal slot
+info: |
+  get SharedArrayBuffer.prototype.growable
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is false, throw a TypeError exception.
+  4. Return IsResizableArrayBuffer(O).
+
+  IsResizableArrayBuffer ( arrayBuffer )
+
+  1. Assert: Type(arrayBuffer) is Object and arrayBuffer has an
+     [[ArrayBufferData]] internal slot.
+  2. If buffer has an [[ArrayBufferMaxByteLength]] internal slot, return true.
+  3. Return false.
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var sab1 = new SharedArrayBuffer(1);
+
+assert.sameValue(sab1.growable, false);
+
+var sab2 = new SharedArrayBuffer(1, {maxByteLength: 1});
+
+assert.sameValue(sab2.growable, true);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/shell.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/shell.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/shell.js
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/this-has-no-arraybufferdata-internal.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/this-has-no-arraybufferdata-internal.js
new file mode 100644
index 0000000000..b6e12d3c48
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/this-has-no-arraybufferdata-internal.js
@@ -0,0 +1,42 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.growable
+description: >
+  Throws a TypeError exception when `this` does not have a [[ArrayBufferData]]
+  internal slot
+info: |
+  get SharedArrayBuffer.prototype.growable
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [DataView, SharedArrayBuffer, TypedArray, resizable-arraybuffer]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  SharedArrayBuffer.prototype, "growable"
+).get;
+
+assert.sameValue(typeof getter, "function");
+
+assert.throws(TypeError, function() {
+  getter.call({});
+});
+
+assert.throws(TypeError, function() {
+  getter.call([]);
+});
+
+var ta = new Int8Array(8);
+assert.throws(TypeError, function() {
+  getter.call(ta);
+});
+
+var dv = new DataView(new SharedArrayBuffer(8), 0);
+assert.throws(TypeError, function() {
+  getter.call(dv);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/this-is-arraybuffer.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/this-is-arraybuffer.js
new file mode 100644
index 0000000000..3beac38f44
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/this-is-arraybuffer.js
@@ -0,0 +1,36 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.growable
+description: Throws a TypeError exception when `this` is an ArrayBuffer
+info: |
+  get SharedArrayBuffer.prototype.growable
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is false, throw a TypeError exception.
+  [...]
+features: [ArrayBuffer, SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var growable = Object.getOwnPropertyDescriptor(
+  SharedArrayBuffer.prototype, "growable"
+);
+
+var getter = growable.get;
+var ab = new ArrayBuffer(4);
+
+assert.sameValue(typeof getter, "function");
+
+assert.throws(TypeError, function() {
+  getter.call(ab);
+}, "`this` cannot be an ArrayBuffer");
+
+Object.defineProperties(ab, { growable: growable });
+
+assert.throws(TypeError, function() {
+  ab.growable;
+}, "`this` cannot be an ArrayBuffer");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/this-is-not-object.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/this-is-not-object.js
new file mode 100644
index 0000000000..01a6c81599
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/this-is-not-object.js
@@ -0,0 +1,51 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.growable
+description: Throws a TypeError exception when `this` is not Object
+info: |
+  get SharedArrayBuffer.prototype.growable
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [SharedArrayBuffer, Symbol, resizable-arraybuffer]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  SharedArrayBuffer.prototype, "growable"
+).get;
+
+assert.sameValue(typeof getter, "function");
+
+assert.throws(TypeError, function() {
+  getter.call(undefined);
+}, "this is undefined");
+
+assert.throws(TypeError, function() {
+  getter.call(null);
+}, "this is null");
+
+assert.throws(TypeError, function() {
+  getter.call(42);
+}, "this is 42");
+
+assert.throws(TypeError, function() {
+  getter.call("1");
+}, "this is a string");
+
+assert.throws(TypeError, function() {
+  getter.call(true);
+}, "this is true");
+
+assert.throws(TypeError, function() {
+  getter.call(false);
+}, "this is false");
+
+var s = Symbol("s");
+assert.throws(TypeError, function() {
+  getter.call(s);
+}, "this is a Symbol");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/browser.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/browser.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/browser.js
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/invoked-as-accessor.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/invoked-as-accessor.js
new file mode 100644
index 0000000000..0b22216e79
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/invoked-as-accessor.js
@@ -0,0 +1,20 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.maxbytelength
+description: Requires this value to have a [[ArrayBufferData]] internal slot
+info: |
+  get SharedArrayBuffer.prototype.maxByteLength
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.maxByteLength;
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/invoked-as-func.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/invoked-as-func.js
new file mode 100644
index 0000000000..38eb846de2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/invoked-as-func.js
@@ -0,0 +1,26 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.maxbytelength
+description: Throws a TypeError exception when invoked as a function
+info: |
+  get SharedArrayBuffer.prototype.maxByteLength
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  SharedArrayBuffer.prototype, 'maxByteLength'
+).get;
+
+assert.sameValue(typeof getter, 'function');
+
+assert.throws(TypeError, function() {
+  getter();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/length.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/length.js
new file mode 100644
index 0000000000..1b1805503a
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/length.js
@@ -0,0 +1,35 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.maxbytelength
+description: >
+  get SharedArrayBuffer.prototype.maxByteLength.length is 0.
+info: |
+  get SharedArrayBuffer.prototype.maxByteLength
+
+  17 ECMAScript Standard Built-in Objects:
+    Every built-in Function object, including constructors, has a length
+    property whose value is an integer. Unless otherwise specified, this
+    value is equal to the largest number of named arguments shown in the
+    subclause headings for the function description, including optional
+    parameters. However, rest parameters shown using the form “...name”
+    are not included in the default argument count.
+
+    Unless otherwise specified, the length property of a built-in Function
+    object has the attributes { [[Writable]]: false, [[Enumerable]]: false,
+    [[Configurable]]: true }.
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var desc = Object.getOwnPropertyDescriptor(SharedArrayBuffer.prototype, 'maxByteLength');
+
+verifyProperty(desc.get, 'length', {
+  value: 0,
+  enumerable: false,
+  writable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/name.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/name.js
new file mode 100644
index 0000000000..3f46170c78
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/name.js
@@ -0,0 +1,27 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.maxbytelength
+description: >
+  get SharedArrayBuffer.prototype.maxByteLength
+
+  17 ECMAScript Standard Built-in Objects
+
+  Functions that are specified as get or set accessor functions of built-in
+  properties have "get " or "set " prepended to the property name string.
+
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var desc = Object.getOwnPropertyDescriptor(SharedArrayBuffer.prototype, 'maxByteLength');
+
+verifyProperty(desc.get, 'name', {
+  value: 'get maxByteLength',
+  enumerable: false,
+  writable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/prop-desc.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/prop-desc.js
new file mode 100644
index 0000000000..db0579a73a
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/prop-desc.js
@@ -0,0 +1,28 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.maxbytelength
+description: >
+  "maxByteLength" property of SharedArrayBuffer.prototype
+info: |
+  SharedArrayBuffer.prototype.maxByteLength is an accessor property whose set
+  accessor function is undefined.
+
+  Section 17: Every accessor property described in clauses 18 through 26 and in
+  Annex B.2 has the attributes {[[Enumerable]]: false, [[Configurable]]: true }
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var desc = Object.getOwnPropertyDescriptor(SharedArrayBuffer.prototype, 'maxByteLength');
+
+assert.sameValue(desc.set, undefined);
+assert.sameValue(typeof desc.get, 'function');
+
+verifyProperty(SharedArrayBuffer.prototype, 'maxByteLength', {
+  enumerable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/return-maxbytelength-growable.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/return-maxbytelength-growable.js
new file mode 100644
index 0000000000..5611749493
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/return-maxbytelength-growable.js
@@ -0,0 +1,30 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.maxbytelength
+description: Return value from [[ArrayBufferMaxByteLength]] internal slot
+info: |
+  24.1.4.1 get SharedArrayBuffer.prototype.maxByteLength
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is false, throw a TypeError exception.
+  4. If IsResizableArrayBuffer(O) is true, then
+     a. Let length be O.[[ArrayBufferMaxByteLength]].
+  5. Else,
+     [...]
+  6. Return 𝔽(length).
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var ab1 = new SharedArrayBuffer(0, { maxByteLength: 0 });
+assert.sameValue(ab1.maxByteLength, 0);
+
+var ab2 = new SharedArrayBuffer(0, { maxByteLength: 23 });
+assert.sameValue(ab2.maxByteLength, 23);
+
+var ab3 = new SharedArrayBuffer(42, { maxByteLength: 42 });
+assert.sameValue(ab3.maxByteLength, 42);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/return-maxbytelength-non-growable.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/return-maxbytelength-non-growable.js
new file mode 100644
index 0000000000..2058871ceb
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/return-maxbytelength-non-growable.js
@@ -0,0 +1,27 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.maxbytelength
+description: Return value from [[ArrayBufferByteLength]] internal slot
+info: |
+  24.1.4.1 get SharedArrayBuffer.prototype.maxByteLength
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is false, throw a TypeError exception.
+  4. If IsResizableArrayBuffer(O) is true, then
+     [...]
+  5. Else,
+     a. Let length be O.[[ArrayBufferByteLength]].
+  6. Return 𝔽(length).
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var ab1 = new SharedArrayBuffer(0);
+assert.sameValue(ab1.maxByteLength, 0);
+
+var ab2 = new SharedArrayBuffer(42);
+assert.sameValue(ab2.maxByteLength, 42);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/shell.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/shell.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/shell.js
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/this-has-no-arraybufferdata-internal.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/this-has-no-arraybufferdata-internal.js
new file mode 100644
index 0000000000..f5e1ba097f
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/this-has-no-arraybufferdata-internal.js
@@ -0,0 +1,42 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.maxbytelength
+description: >
+  Throws a TypeError exception when `this` does not have a [[ArrayBufferData]]
+  internal slot
+info: |
+  get SharedArrayBuffer.prototype.maxByteLength
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [DataView, SharedArrayBuffer, TypedArray, resizable-arraybuffer]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  SharedArrayBuffer.prototype, "maxByteLength"
+).get;
+
+assert.sameValue(typeof getter, "function");
+
+assert.throws(TypeError, function() {
+  getter.call({});
+});
+
+assert.throws(TypeError, function() {
+  getter.call([]);
+});
+
+var ta = new Int8Array(8);
+assert.throws(TypeError, function() {
+  getter.call(ta);
+});
+
+var dv = new DataView(new SharedArrayBuffer(8), 0);
+assert.throws(TypeError, function() {
+  getter.call(dv);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/this-is-arraybuffer.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/this-is-arraybuffer.js
new file mode 100644
index 0000000000..2be9136851
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/this-is-arraybuffer.js
@@ -0,0 +1,36 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.maxbytelength
+description: Throws a TypeError exception when `this` is an ArrayBuffer
+info: |
+  get SharedArrayBuffer.prototype.maxByteLength
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is false, throw a TypeError exception.
+  [...]
+features: [ArrayBuffer, SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var maxByteLength = Object.getOwnPropertyDescriptor(
+  SharedArrayBuffer.prototype, "maxByteLength"
+);
+
+var getter = maxByteLength.get;
+var ab = new ArrayBuffer(4);
+
+assert.sameValue(typeof getter, "function");
+
+assert.throws(TypeError, function() {
+  getter.call(ab);
+}, "`this` cannot be an ArrayBuffer");
+
+Object.defineProperties(ab, { maxByteLength: maxByteLength });
+
+assert.throws(TypeError, function() {
+  ab.maxByteLength;
+}, "`this` cannot be an ArrayBuffer");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/this-is-not-object.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/this-is-not-object.js
new file mode 100644
index 0000000000..a34d19371d
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/this-is-not-object.js
@@ -0,0 +1,51 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.maxbytelength
+description: Throws a TypeError exception when `this` is not Object
+info: |
+  get SharedArrayBuffer.prototype.maxByteLength
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [SharedArrayBuffer, Symbol, resizable-arraybuffer]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  SharedArrayBuffer.prototype, "maxByteLength"
+).get;
+
+assert.sameValue(typeof getter, "function");
+
+assert.throws(TypeError, function() {
+  getter.call(undefined);
+}, "this is undefined");
+
+assert.throws(TypeError, function() {
+  getter.call(null);
+}, "this is null");
+
+assert.throws(TypeError, function() {
+  getter.call(42);
+}, "this is 42");
+
+assert.throws(TypeError, function() {
+  getter.call("1");
+}, "this is a string");
+
+assert.throws(TypeError, function() {
+  getter.call(true);
+}, "this is true");
+
+assert.throws(TypeError, function() {
+  getter.call(false);
+}, "this is false");
+
+var s = Symbol("s");
+assert.throws(TypeError, function() {
+  getter.call(s);
+}, "this is a Symbol");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/prop-desc.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/prop-desc.js
new file mode 100644
index 0000000000..d930563d65
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/prop-desc.js
@@ -0,0 +1,20 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2021 Leo Balter. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype
+description: Property descriptor of the 'prototype' property
+info: |
+  This property has the attributes { [[Writable]]: false, [[Enumerable]]:
+  false, [[Configurable]]: false }.
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer]
+---*/
+
+verifyProperty(SharedArrayBuffer, 'prototype', {
+    enumerable: false,
+    writable: false,
+    configurable: false
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/shell.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/shell.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/shell.js
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/browser.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/browser.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/browser.js
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/context-is-not-arraybuffer-object.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/context-is-not-arraybuffer-object.js
new file mode 100644
index 0000000000..036d367651
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/context-is-not-arraybuffer-object.js
@@ -0,0 +1,20 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Throws a TypeError if `this` does not have an [[ArrayBufferData]] internal slot.
+features: [SharedArrayBuffer]
+---*/
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.slice.call({});
+}, "`this` value is Object");
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.slice.call([]);
+}, "`this` value is Array");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/context-is-not-object.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/context-is-not-object.js
new file mode 100644
index 0000000000..e2a9c2bf2f
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/context-is-not-object.js
@@ -0,0 +1,38 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Throws a TypeError if `this` is not an Object.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+features: [SharedArrayBuffer, Symbol]
+---*/
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.slice.call(undefined);
+}, "`this` value is undefined");
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.slice.call(null);
+}, "`this` value is null");
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.slice.call(true);
+}, "`this` value is Boolean");
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.slice.call("");
+}, "`this` value is String");
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.slice.call(Symbol());
+}, "`this` value is Symbol");
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.slice.call(1);
+}, "`this` value is Number");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/descriptor.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/descriptor.js
new file mode 100644
index 0000000000..112e905d30
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/descriptor.js
@@ -0,0 +1,24 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  SharedArrayBuffer.prototype.slice has default data property attributes.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+  17 ECMAScript Standard Built-in Objects:
+    Every other data property described in clauses 18 through 26 and in
+    Annex B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer]
+---*/
+
+verifyNotEnumerable(SharedArrayBuffer.prototype, "slice");
+verifyWritable(SharedArrayBuffer.prototype, "slice");
+verifyConfigurable(SharedArrayBuffer.prototype, "slice");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/end-default-if-absent.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/end-default-if-absent.js
new file mode 100644
index 0000000000..cfacf942a7
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/end-default-if-absent.js
@@ -0,0 +1,21 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  The `end` index defaults to [[ArrayBufferByteLength]] if absent.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer]
+---*/
+
+var arrayBuffer = new SharedArrayBuffer(8);
+
+var start = 6;
+var result = arrayBuffer.slice(start);
+assert.sameValue(result.byteLength, 2);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/end-default-if-undefined.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/end-default-if-undefined.js
new file mode 100644
index 0000000000..0ad7b81343
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/end-default-if-undefined.js
@@ -0,0 +1,22 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  The `end` index defaults to [[ArrayBufferByteLength]] if undefined.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer]
+---*/
+
+var arrayBuffer = new SharedArrayBuffer(8);
+
+var start = 6,
+  end = undefined;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 2);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/end-exceeds-length.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/end-exceeds-length.js
new file mode 100644
index 0000000000..d4c01867c6
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/end-exceeds-length.js
@@ -0,0 +1,32 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Large `end` index is clamped to [[ArrayBufferByteLength]].
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer]
+---*/
+
+var arrayBuffer = new SharedArrayBuffer(8);
+
+var start = 1,
+  end = 12;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 7, "slice(1, 12)");
+
+var start = 2,
+  end = 0x100000000;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 6, "slice(2, 0x100000000)");
+
+var start = 3,
+  end = +Infinity;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 5, "slice(3, Infinity)");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/extensible.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/extensible.js
new file mode 100644
index 0000000000..ad6dc3b3f7
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/extensible.js
@@ -0,0 +1,20 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  SharedArrayBuffer.prototype.slice is extensible.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+  17 ECMAScript Standard Built-in Objects:
+    Unless specified otherwise, the [[Extensible]] internal slot
+    of a built-in object initially has the value true.
+features: [SharedArrayBuffer]
+---*/
+
+assert(Object.isExtensible(SharedArrayBuffer.prototype.slice));
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/length.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/length.js
new file mode 100644
index 0000000000..6760427fb6
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/length.js
@@ -0,0 +1,33 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  SharedArrayBuffer.prototype.slice.length is 2.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+  17 ECMAScript Standard Built-in Objects:
+    Every built-in Function object, including constructors, has a length
+    property whose value is an integer. Unless otherwise specified, this
+    value is equal to the largest number of named arguments shown in the
+    subclause headings for the function description, including optional
+    parameters. However, rest parameters shown using the form “...name”
+    are not included in the default argument count.
+
+    Unless otherwise specified, the length property of a built-in Function
+    object has the attributes { [[Writable]]: false, [[Enumerable]]: false,
+    [[Configurable]]: true }.
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer]
+---*/
+
+assert.sameValue(SharedArrayBuffer.prototype.slice.length, 2);
+
+verifyNotEnumerable(SharedArrayBuffer.prototype.slice, "length");
+verifyNotWritable(SharedArrayBuffer.prototype.slice, "length");
+verifyConfigurable(SharedArrayBuffer.prototype.slice, "length");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/name.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/name.js
new file mode 100644
index 0000000000..a3407d4b8a
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/name.js
@@ -0,0 +1,30 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  SharedArrayBuffer.prototype.slice.name is "slice".
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+  17 ECMAScript Standard Built-in Objects:
+    Every built-in Function object, including constructors, that is not
+    identified as an anonymous function has a name property whose value
+    is a String.
+
+    Unless otherwise specified, the name property of a built-in Function
+    object, if it exists, has the attributes { [[Writable]]: false,
+    [[Enumerable]]: false, [[Configurable]]: true }.
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer]
+---*/
+
+assert.sameValue(SharedArrayBuffer.prototype.slice.name, "slice");
+
+verifyNotEnumerable(SharedArrayBuffer.prototype.slice, "name");
+verifyNotWritable(SharedArrayBuffer.prototype.slice, "name");
+verifyConfigurable(SharedArrayBuffer.prototype.slice, "name");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/negative-end.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/negative-end.js
new file mode 100644
index 0000000000..2e2b4bf7d7
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/negative-end.js
@@ -0,0 +1,32 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Negative `end` index is relative to [[ArrayBufferByteLength]].
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer]
+---*/
+
+var arrayBuffer = new SharedArrayBuffer(8);
+
+var start = 2,
+  end = -4;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 2, "slice(2, -4)");
+
+var start = 2,
+  end = -10;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 0, "slice(2, -10)");
+
+var start = 2,
+  end = -Infinity;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 0, "slice(2, -Infinity)");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/negative-start.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/negative-start.js
new file mode 100644
index 0000000000..ed7213976b
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/negative-start.js
@@ -0,0 +1,32 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Negative `start` index is relative to [[ArrayBufferByteLength]].
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer]
+---*/
+
+var arrayBuffer = new SharedArrayBuffer(8);
+
+var start = -5,
+  end = 6;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 3, "slice(-5, 6)");
+
+var start = -12,
+  end = 6;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 6, "slice(-12, 6)");
+
+var start = -Infinity,
+  end = 6;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 6, "slice(-Infinity, 6)");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/nonconstructor.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/nonconstructor.js
new file mode 100644
index 0000000000..a4c32ebea2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/nonconstructor.js
@@ -0,0 +1,27 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  SharedArrayBuffer.prototype.slice is not a constructor function.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+  17 ECMAScript Standard Built-in Objects:
+    Built-in function objects that are not identified as constructors do not
+    implement the [[Construct]] internal method unless otherwise specified
+    in the description of a particular function.
+includes: [isConstructor.js]
+features: [SharedArrayBuffer, Reflect.construct]
+---*/
+
+assert(!isConstructor(SharedArrayBuffer.prototype.slice), "SharedArrayBuffer.prototype.slice is not a constructor");
+
+var arrayBuffer = new SharedArrayBuffer(8);
+assert.throws(TypeError, function() {
+  new arrayBuffer.slice();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/not-a-constructor.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/not-a-constructor.js
new file mode 100644
index 0000000000..49713162b8
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/not-a-constructor.js
@@ -0,0 +1,36 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2020 Rick Waldron. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-ecmascript-standard-built-in-objects
+description: >
+  SharedArrayBuffer.prototype.slice does not implement [[Construct]], is not new-able
+info: |
+  ECMAScript Function Objects
+
+  Built-in function objects that are not identified as constructors do not
+  implement the [[Construct]] internal method unless otherwise specified in
+  the description of a particular function.
+
+  sec-evaluatenew
+
+  ...
+  7. If IsConstructor(constructor) is false, throw a TypeError exception.
+  ...
+includes: [isConstructor.js]
+features: [Reflect.construct, SharedArrayBuffer, arrow-function]
+---*/
+
+assert.sameValue(
+  isConstructor(SharedArrayBuffer.prototype.slice),
+  false,
+  'isConstructor(SharedArrayBuffer.prototype.slice) must return false'
+);
+
+assert.throws(TypeError, () => {
+  let sab = new SharedArrayBuffer(1); new sab.slice();
+}, '`let sab = new SharedArrayBuffer(1); new sab.slice()` throws TypeError');
+
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/number-conversion.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/number-conversion.js
new file mode 100644
index 0000000000..6882f49f2f
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/number-conversion.js
@@ -0,0 +1,34 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  ToInteger(start) is called before ToInteger(end).
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer]
+---*/
+
+var arrayBuffer = new SharedArrayBuffer(8);
+
+var log = "";
+var start = {
+  valueOf: function() {
+    log += "start-";
+    return 0;
+  }
+};
+var end = {
+  valueOf: function() {
+    log += "end";
+    return 8;
+  }
+};
+
+arrayBuffer.slice(start, end);
+assert.sameValue(log, "start-end");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/shell.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/shell.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/shell.js
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-constructor-is-not-object.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-constructor-is-not-object.js
new file mode 100644
index 0000000000..cf1dc0d9eb
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-constructor-is-not-object.js
@@ -0,0 +1,36 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Throws TypeError if `constructor` property is not an object.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer, Symbol]
+---*/
+
+var arrayBuffer = new SharedArrayBuffer(8);
+
+function callSlice() {
+  arrayBuffer.slice();
+}
+
+arrayBuffer.constructor = null;
+assert.throws(TypeError, callSlice, "`constructor` value is null");
+
+arrayBuffer.constructor = true;
+assert.throws(TypeError, callSlice, "`constructor` value is Boolean");
+
+arrayBuffer.constructor = "";
+assert.throws(TypeError, callSlice, "`constructor` value is String");
+
+arrayBuffer.constructor = Symbol();
+assert.throws(TypeError, callSlice, "`constructor` value is Symbol");
+
+arrayBuffer.constructor = 1;
+assert.throws(TypeError, callSlice, "`constructor` value is Number");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-constructor-is-undefined.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-constructor-is-undefined.js
new file mode 100644
index 0000000000..1192bdcd6f
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-constructor-is-undefined.js
@@ -0,0 +1,20 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Uses default constructor is `constructor` property is undefined.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+features: [SharedArrayBuffer]
+---*/
+
+var arrayBuffer = new SharedArrayBuffer(8);
+arrayBuffer.constructor = undefined;
+
+var result = arrayBuffer.slice();
+assert.sameValue(Object.getPrototypeOf(result), SharedArrayBuffer.prototype);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-is-not-constructor.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-is-not-constructor.js
new file mode 100644
index 0000000000..ada1f4d270
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-is-not-constructor.js
@@ -0,0 +1,30 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Throws a TypeError if species constructor is not a constructor function.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer, Symbol.species]
+---*/
+
+var speciesConstructor = {};
+
+var arrayBuffer = new SharedArrayBuffer(8);
+arrayBuffer.constructor = speciesConstructor;
+
+function callSlice() {
+  arrayBuffer.slice();
+}
+
+speciesConstructor[Symbol.species] = {};
+assert.throws(TypeError, callSlice, "`constructor[Symbol.species]` value is Object");
+
+speciesConstructor[Symbol.species] = Function.prototype;
+assert.throws(TypeError, callSlice, "`constructor[Symbol.species]` value is Function.prototype");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-is-not-object.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-is-not-object.js
new file mode 100644
index 0000000000..559c5c8eb3
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-is-not-object.js
@@ -0,0 +1,36 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Throws a TypeError if species constructor is not an object.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer, Symbol.species]
+---*/
+
+var speciesConstructor = {};
+
+var arrayBuffer = new SharedArrayBuffer(8);
+arrayBuffer.constructor = speciesConstructor;
+
+function callSlice() {
+  arrayBuffer.slice();
+}
+
+speciesConstructor[Symbol.species] = true;
+assert.throws(TypeError, callSlice, "`constructor[Symbol.species]` value is Boolean");
+
+speciesConstructor[Symbol.species] = "";
+assert.throws(TypeError, callSlice, "`constructor[Symbol.species]` value is String");
+
+speciesConstructor[Symbol.species] = Symbol();
+assert.throws(TypeError, callSlice, "`constructor[Symbol.species]` value is Symbol");
+
+speciesConstructor[Symbol.species] = 1;
+assert.throws(TypeError, callSlice, "`constructor[Symbol.species]` value is Number");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-is-null.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-is-null.js
new file mode 100644
index 0000000000..5cfc458fe2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-is-null.js
@@ -0,0 +1,24 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Uses default constructor is species constructor is null.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer, Symbol.species]
+---*/
+
+var speciesConstructor = {};
+speciesConstructor[Symbol.species] = null;
+
+var arrayBuffer = new SharedArrayBuffer(8);
+arrayBuffer.constructor = speciesConstructor;
+
+var result = arrayBuffer.slice();
+assert.sameValue(Object.getPrototypeOf(result), SharedArrayBuffer.prototype);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-is-undefined.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-is-undefined.js
new file mode 100644
index 0000000000..022787b1f5
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-is-undefined.js
@@ -0,0 +1,24 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Uses default constructor is species constructor is undefined.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer, Symbol.species]
+---*/
+
+var speciesConstructor = {};
+speciesConstructor[Symbol.species] = undefined;
+
+var arrayBuffer = new SharedArrayBuffer(8);
+arrayBuffer.constructor = speciesConstructor;
+
+var result = arrayBuffer.slice();
+assert.sameValue(Object.getPrototypeOf(result), SharedArrayBuffer.prototype);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-returns-larger-arraybuffer.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-returns-larger-arraybuffer.js
new file mode 100644
index 0000000000..3a08654715
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-returns-larger-arraybuffer.js
@@ -0,0 +1,26 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Does not throw TypeError if new SharedArrayBuffer is too large.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer, Symbol.species]
+---*/
+
+var speciesConstructor = {};
+speciesConstructor[Symbol.species] = function(length) {
+  return new SharedArrayBuffer(10);
+};
+
+var arrayBuffer = new SharedArrayBuffer(8);
+arrayBuffer.constructor = speciesConstructor;
+
+var result = arrayBuffer.slice();
+assert.sameValue(result.byteLength, 10);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-returns-not-arraybuffer.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-returns-not-arraybuffer.js
new file mode 100644
index 0000000000..4e979ddbff
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-returns-not-arraybuffer.js
@@ -0,0 +1,27 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Throws a TypeError if new object is not an SharedArrayBuffer instance.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer, Symbol.species]
+---*/
+
+var speciesConstructor = {};
+speciesConstructor[Symbol.species] = function(length) {
+  return {};
+};
+
+var arrayBuffer = new SharedArrayBuffer(8);
+arrayBuffer.constructor = speciesConstructor;
+
+assert.throws(TypeError, function() {
+  arrayBuffer.slice();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-returns-same-arraybuffer.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-returns-same-arraybuffer.js
new file mode 100644
index 0000000000..8a95e32219
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-returns-same-arraybuffer.js
@@ -0,0 +1,27 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Throws a TypeError if species constructor returns `this` value.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer, Symbol.species]
+---*/
+
+var speciesConstructor = {};
+speciesConstructor[Symbol.species] = function(length) {
+  return arrayBuffer;
+};
+
+var arrayBuffer = new SharedArrayBuffer(8);
+arrayBuffer.constructor = speciesConstructor;
+
+assert.throws(TypeError, function() {
+  arrayBuffer.slice();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-returns-smaller-arraybuffer.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-returns-smaller-arraybuffer.js
new file mode 100644
index 0000000000..3ad6af8903
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-returns-smaller-arraybuffer.js
@@ -0,0 +1,27 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Throws a TypeError if new SharedArrayBuffer is too small.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer, Symbol.species]
+---*/
+
+var speciesConstructor = {};
+speciesConstructor[Symbol.species] = function(length) {
+  return new SharedArrayBuffer(4);
+};
+
+var arrayBuffer = new SharedArrayBuffer(8);
+arrayBuffer.constructor = speciesConstructor;
+
+assert.throws(TypeError, function() {
+  arrayBuffer.slice();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species.js
new file mode 100644
index 0000000000..6bda23c55b
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species.js
@@ -0,0 +1,28 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  New SharedArrayBuffer instance is created from SpeciesConstructor.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer, Symbol.species]
+---*/
+
+var resultBuffer;
+
+var speciesConstructor = {};
+speciesConstructor[Symbol.species] = function(length) {
+  return resultBuffer = new SharedArrayBuffer(length);
+};
+
+var arrayBuffer = new SharedArrayBuffer(8);
+arrayBuffer.constructor = speciesConstructor;
+
+var result = arrayBuffer.slice();
+assert.sameValue(result, resultBuffer);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/start-default-if-absent.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/start-default-if-absent.js
new file mode 100644
index 0000000000..e559667926
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/start-default-if-absent.js
@@ -0,0 +1,20 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  The `start` index defaults to 0 if absent.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer]
+---*/
+
+var arrayBuffer = new SharedArrayBuffer(8);
+
+var result = arrayBuffer.slice();
+assert.sameValue(result.byteLength, 8);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/start-default-if-undefined.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/start-default-if-undefined.js
new file mode 100644
index 0000000000..7ffa5a541f
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/start-default-if-undefined.js
@@ -0,0 +1,21 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  The `start` index defaults to 0 if undefined.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+features: [SharedArrayBuffer]
+---*/
+
+var arrayBuffer = new SharedArrayBuffer(8);
+
+var start = undefined,
+  end = 6;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 6);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/start-exceeds-end.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/start-exceeds-end.js
new file mode 100644
index 0000000000..533d4efc9a
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/start-exceeds-end.js
@@ -0,0 +1,22 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Returns zero-length buffer if `start` index exceeds `end` index.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer]
+---*/
+
+var arrayBuffer = new SharedArrayBuffer(8);
+
+var start = 5,
+  end = 4;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 0);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/start-exceeds-length.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/start-exceeds-length.js
new file mode 100644
index 0000000000..30b3e9ece3
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/start-exceeds-length.js
@@ -0,0 +1,26 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Large `start` index is clamped to [[ArrayBufferByteLength]].
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+features: [SharedArrayBuffer]
+---*/
+
+var arrayBuffer = new SharedArrayBuffer(8);
+var result;
+
+result = arrayBuffer.slice(10, 8);
+assert.sameValue(result.byteLength, 0, "slice(10, 8)");
+
+result = arrayBuffer.slice(0x100000000, 7);
+assert.sameValue(result.byteLength, 0, "slice(0x100000000, 7)");
+
+result = arrayBuffer.slice(+Infinity, 6);
+assert.sameValue(result.byteLength, 0, "slice(+Infinity, 6)");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/this-is-arraybuffer.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/this-is-arraybuffer.js
new file mode 100644
index 0000000000..ebe64e1ba9
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/this-is-arraybuffer.js
@@ -0,0 +1,17 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-sharedarraybuffer.prototype.slice
+description: >
+  Throws a TypeError if `this` is an ArrayBuffer
+features: [ArrayBuffer, SharedArrayBuffer]
+---*/
+
+assert.throws(TypeError, function() {
+  var ab = new ArrayBuffer(0);
+  SharedArrayBuffer.prototype.slice.call(ab);
+}, "`this` value cannot be an ArrayBuffer");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/tointeger-conversion-end.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/tointeger-conversion-end.js
new file mode 100644
index 0000000000..0f6cf12bd5
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/tointeger-conversion-end.js
@@ -0,0 +1,23 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  The `end` index parameter is converted to an integral numeric value.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+features: [SharedArrayBuffer]
+---*/
+
+var arrayBuffer = new SharedArrayBuffer(8);
+var result;
+
+result = arrayBuffer.slice(0, 4.5);
+assert.sameValue(result.byteLength, 4, "slice(0, 4.5)");
+
+result = arrayBuffer.slice(0, NaN);
+assert.sameValue(result.byteLength, 0, "slice(0, NaN)");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/tointeger-conversion-start.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/tointeger-conversion-start.js
new file mode 100644
index 0000000000..3291405e41
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/tointeger-conversion-start.js
@@ -0,0 +1,23 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  The `start` index parameter is converted to an integral numeric value.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+features: [SharedArrayBuffer]
+---*/
+
+var arrayBuffer = new SharedArrayBuffer(8);
+var result;
+
+result = arrayBuffer.slice(4.5, 8);
+assert.sameValue(result.byteLength, 4, "slice(4.5, 8)");
+
+result = arrayBuffer.slice(NaN, 8);
+assert.sameValue(result.byteLength, 8, "slice(NaN, 8)");
+
+reportCompare(0, 0);