Adding upstream version 124.0.1.upstream/124.0.1

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

115 files changed, 3099 insertions, 0 deletions

diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/allocation-limit.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/allocation-limit.js
new file mode 100644
index 0000000000..92f06f5b80
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/allocation-limit.js
@@ -0,0 +1,37 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-sharedarraybuffer-length
+description: >
+  Throws a RangeError if requested Data Block is too large.
+info: |
+  SharedArrayBuffer( length )
+
+  ...
+  3. Return AllocateSharedArrayBuffer(NewTarget, byteLength).
+
+  6.2.7.2 CreateSharedByteDataBlock(size)
+    ...
+    2. Let db be a new Shared Data Block value consisting of size
+       bytes. If it is impossible to create such a Shared Data Block,
+       throw a RangeError exception.
+    ...
+features: [SharedArrayBuffer]
+---*/
+
+assert.throws(RangeError, function() {
+  // Allocating 7 PiB should fail with a RangeError.
+  // Math.pow(1024, 5) = 1125899906842624
+  new SharedArrayBuffer(7 * 1125899906842624);
+}, "`length` parameter is 7 PiB");
+
+assert.throws(RangeError, function() {
+  // Allocating almost 8 PiB should fail with a RangeError.
+  // Math.pow(2, 53) = 9007199254740992
+  new SharedArrayBuffer(9007199254740992 - 1);
+}, "`length` parameter is Math.pow(2, 53) - 1");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/browser.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/browser.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/browser.js
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/data-allocation-after-object-creation.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/data-allocation-after-object-creation.js
new file mode 100644
index 0000000000..3161137b22
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/data-allocation-after-object-creation.js
@@ -0,0 +1,40 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-sharedarraybuffer-length
+description: >
+  The new SharedArrayBuffer instance is created prior to allocating the Data Block.
+info: |
+  SharedArrayBuffer( length )
+
+  ...
+  3. Return AllocateSharedArrayBuffer(NewTarget, byteLength).
+
+  AllocateSharedArrayBuffer( constructor, byteLength )
+    1. Let obj be ? OrdinaryCreateFromConstructor(constructor, "%SharedArrayBufferPrototype%",
+       «[[ArrayBufferData]], [[ArrayBufferByteLength]]» ).
+    ...
+    3. Let block be ? CreateByteDataBlock(byteLength).
+    ...
+features: [SharedArrayBuffer, Reflect.construct]
+---*/
+
+function DummyError() {}
+
+var newTarget = function() {}.bind(null);
+Object.defineProperty(newTarget, "prototype", {
+  get: function() {
+    throw new DummyError();
+  }
+});
+
+assert.throws(DummyError, function() {
+  // Allocating 7 PiB should fail with a RangeError.
+  // Math.pow(1024, 5) = 1125899906842624
+  Reflect.construct(SharedArrayBuffer, [7 * 1125899906842624], newTarget);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/init-zero.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/init-zero.js
new file mode 100644
index 0000000000..3146abeecf
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/init-zero.js
@@ -0,0 +1,24 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-createsharedbytedatablock
+description: All bytes are initialized to zero
+features: [SharedArrayBuffer, DataView]
+---*/
+
+var view = new DataView(new SharedArrayBuffer(9));
+
+assert.sameValue(view.getUint8(0), 0, 'index 0');
+assert.sameValue(view.getUint8(1), 0, 'index 1');
+assert.sameValue(view.getUint8(2), 0, 'index 2');
+assert.sameValue(view.getUint8(3), 0, 'index 3');
+assert.sameValue(view.getUint8(4), 0, 'index 4');
+assert.sameValue(view.getUint8(5), 0, 'index 5');
+assert.sameValue(view.getUint8(6), 0, 'index 6');
+assert.sameValue(view.getUint8(7), 0, 'index 7');
+assert.sameValue(view.getUint8(8), 0, 'index 8');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/is-a-constructor.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/is-a-constructor.js
new file mode 100644
index 0000000000..bc1517a0e4
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/is-a-constructor.js
@@ -0,0 +1,27 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2020 Rick Waldron. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-ecmascript-standard-built-in-objects
+description: >
+  The SharedArrayBuffer constructor implements [[Construct]]
+info: |
+  IsConstructor ( argument )
+
+  The abstract operation IsConstructor takes argument argument (an ECMAScript language value).
+  It determines if argument is a function object with a [[Construct]] internal method.
+  It performs the following steps when called:
+
+  If Type(argument) is not Object, return false.
+  If argument has a [[Construct]] internal method, return true.
+  Return false.
+includes: [isConstructor.js]
+features: [Reflect.construct, SharedArrayBuffer]
+---*/
+
+assert.sameValue(isConstructor(SharedArrayBuffer), true, 'isConstructor(SharedArrayBuffer) must return true');
+new SharedArrayBuffer(1);
+  
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/length-is-absent.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/length-is-absent.js
new file mode 100644
index 0000000000..c525346f55
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/length-is-absent.js
@@ -0,0 +1,23 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 The V8 Project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-sharedarraybuffer-length
+description: >
+  Returns an empty instance if length is absent
+info: |
+  SharedArrayBuffer( length )
+
+  1. If NewTarget is undefined, throw a TypeError exception.
+  2. Let byteLength be ? ToIndex(length).
+  3. Return ? AllocateSharedArrayBuffer(NewTarget, byteLength).
+features: [SharedArrayBuffer]
+---*/
+
+var buffer = new SharedArrayBuffer();
+
+assert.sameValue(buffer.byteLength, 0);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/length-is-too-large-throws.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/length-is-too-large-throws.js
new file mode 100644
index 0000000000..3b9b1dc32e
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/length-is-too-large-throws.js
@@ -0,0 +1,36 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-sharedarraybuffer-length
+description: >
+  Throws a RangeError if length >= 2 ** 53
+info: |
+  SharedArrayBuffer( length )
+
+  1. If NewTarget is undefined, throw a TypeError exception.
+  2. Let byteLength be ? ToIndex(length).
+
+  ToIndex( value )
+
+  1. If value is undefined, then
+    a. Let index be 0.
+  2. Else,
+    a. Let integerIndex be ? ToInteger(value).
+    b. If integerIndex < 0, throw a RangeError exception.
+  ...
+features: [SharedArrayBuffer]
+---*/
+
+assert.throws(RangeError, function() {
+  // Math.pow(2, 53) = 9007199254740992
+  new SharedArrayBuffer(9007199254740992);
+}, "`length` parameter is too large");
+
+assert.throws(RangeError, function() {
+  new SharedArrayBuffer(Infinity);
+}, "`length` parameter is positive Infinity");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/length.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/length.js
new file mode 100644
index 0000000000..f757eb9ff0
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/length.js
@@ -0,0 +1,36 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2018 Leo Balter. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-sharedarraybuffer-constructor
+description: >
+  SharedArrayBuffer.length is 1.
+info: |
+  SharedArrayBuffer( length )
+
+  ECMAScript Standard Built-in Objects:
+
+  Every built-in function object, including constructors, has a length
+  property whose value is an integer. Unless otherwise specified, this
+  value is equal to the largest number of named arguments shown in the
+  subclause headings for the function description. Optional parameters
+  (which are indicated with brackets: [ ]) or rest parameters (which
+  are shown using the form «...name») are not included in the default
+  argument count.
+
+  Unless otherwise specified, the length property of a built-in function
+  object has the attributes { [[Writable]]: false, [[Enumerable]]: false,
+  [[Configurable]]: true }.
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer]
+---*/
+
+verifyProperty(SharedArrayBuffer, "length", {
+  value: 1,
+  enumerable: false,
+  writable: false,
+  configurable: true,
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/negative-length-throws.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/negative-length-throws.js
new file mode 100644
index 0000000000..37464e9ec5
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/negative-length-throws.js
@@ -0,0 +1,39 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 The V8 Project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-sharedarraybuffer-length
+description: >
+  Throws a Range Error if length represents an integer < 0
+info: |
+  SharedArrayBuffer( length )
+
+  1. If NewTarget is undefined, throw a TypeError exception.
+  2. Let byteLength be ? ToIndex(length).
+
+  ToIndex( value )
+
+  1. If value is undefined, then
+    a. Let index be 0.
+  2. Else,
+    a. Let integerIndex be ? ToInteger(value).
+    b. If integerIndex < 0, throw a RangeError exception.
+  ...
+features: [SharedArrayBuffer]
+---*/
+
+assert.throws(RangeError, function() {
+  new SharedArrayBuffer(-1);
+});
+
+assert.throws(RangeError, function() {
+  new SharedArrayBuffer(-1.1);
+});
+
+assert.throws(RangeError, function() {
+  new SharedArrayBuffer(-Infinity);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/newtarget-prototype-is-not-object.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/newtarget-prototype-is-not-object.js
new file mode 100644
index 0000000000..2bbe595669
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/newtarget-prototype-is-not-object.js
@@ -0,0 +1,51 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Foundation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-sharedarraybuffer-length
+description: >
+  [[Prototype]] defaults to %SharedArrayBufferPrototype% if NewTarget.prototype is not an object.
+info: |
+  SharedArrayBuffer( length )
+
+  SharedArrayBuffer called with argument length performs the following steps:
+
+  ...
+  3. Return AllocateSharedArrayBuffer(NewTarget, byteLength).
+
+  AllocateSharedArrayBuffer( constructor, byteLength )
+    1. Let obj be ? OrdinaryCreateFromConstructor(constructor, "%SharedArrayBufferPrototype%",
+       «[[ArrayBufferData]], [[ArrayBufferByteLength]]» ).
+    ...
+features: [SharedArrayBuffer, Symbol, Reflect.construct]
+---*/
+
+function newTarget() {}
+
+newTarget.prototype = undefined;
+var arrayBuffer = Reflect.construct(SharedArrayBuffer, [1], newTarget);
+assert.sameValue(Object.getPrototypeOf(arrayBuffer), SharedArrayBuffer.prototype, "newTarget.prototype is undefined");
+
+newTarget.prototype = null;
+var arrayBuffer = Reflect.construct(SharedArrayBuffer, [2], newTarget);
+assert.sameValue(Object.getPrototypeOf(arrayBuffer), SharedArrayBuffer.prototype, "newTarget.prototype is null");
+
+newTarget.prototype = true;
+var arrayBuffer = Reflect.construct(SharedArrayBuffer, [3], newTarget);
+assert.sameValue(Object.getPrototypeOf(arrayBuffer), SharedArrayBuffer.prototype, "newTarget.prototype is a Boolean");
+
+newTarget.prototype = "";
+var arrayBuffer = Reflect.construct(SharedArrayBuffer, [4], newTarget);
+assert.sameValue(Object.getPrototypeOf(arrayBuffer), SharedArrayBuffer.prototype, "newTarget.prototype is a String");
+
+newTarget.prototype = Symbol();
+var arrayBuffer = Reflect.construct(SharedArrayBuffer, [5], newTarget);
+assert.sameValue(Object.getPrototypeOf(arrayBuffer), SharedArrayBuffer.prototype, "newTarget.prototype is a Symbol");
+
+newTarget.prototype = 1;
+var arrayBuffer = Reflect.construct(SharedArrayBuffer, [6], newTarget);
+assert.sameValue(Object.getPrototypeOf(arrayBuffer), SharedArrayBuffer.prototype, "newTarget.prototype is a Number");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/options-maxbytelength-diminuitive.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/options-maxbytelength-diminuitive.js
new file mode 100644
index 0000000000..bbfb7f100b
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/options-maxbytelength-diminuitive.js
@@ -0,0 +1,25 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer-constructor
+description: |
+  Invoked with an options object whose `maxByteLength` property is less than
+  the length.
+info: |
+  SharedArrayBuffer( length [ , options ] )
+
+  1. If NewTarget is undefined, throw a TypeError exception.
+  2. Let byteLength be ? ToIndex(length).
+  3. Let requestedMaxByteLength be ? GetArrayBufferMaxByteLengthOption(options).
+  4. If requestedMaxByteLength is empty, then
+     a. [...]
+  5. If byteLength > requestedMaxByteLength, throw a RangeError exception.
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+assert.throws(RangeError, function() {
+  new SharedArrayBuffer(1, {maxByteLength: 0});
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/options-maxbytelength-excessive.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/options-maxbytelength-excessive.js
new file mode 100644
index 0000000000..200a5aedfb
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/options-maxbytelength-excessive.js
@@ -0,0 +1,31 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer-constructor
+description: |
+  Invoked with an options object whose `maxByteLength` property exceeds the
+  maximum length value
+info: |
+  SharedArrayBuffer( length [ , options ] )
+
+  1. If NewTarget is undefined, throw a TypeError exception.
+  2. Let byteLength be ? ToIndex(length).
+  3. Let requestedMaxByteLength be ? GetArrayBufferMaxByteLengthOption(options).
+  [...]
+
+  1.1.5 GetArrayBufferMaxByteLengthOption ( options )
+
+  1. If Type(options) is not Object, return empty.
+  2. Let maxByteLength be ? Get(options, "maxByteLength").
+  3. If maxByteLength is undefined, return empty.
+  4. Return ? ToIndex(maxByteLength).
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+assert.throws(RangeError, function() {
+  // Math.pow(2, 53) = 9007199254740992
+  new SharedArrayBuffer(0, { maxByteLength: 9007199254740992 });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/options-maxbytelength-negative.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/options-maxbytelength-negative.js
new file mode 100644
index 0000000000..dfc7087461
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/options-maxbytelength-negative.js
@@ -0,0 +1,28 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer-constructor
+description: Invoked with an options object whose `maxByteLength` property is negative
+info: |
+  SharedArrayBuffer( length [ , options ] )
+
+  1. If NewTarget is undefined, throw a TypeError exception.
+  2. Let byteLength be ? ToIndex(length).
+  3. Let requestedMaxByteLength be ? GetArrayBufferMaxByteLengthOption(options).
+  [...]
+
+  1.1.5 GetArrayBufferMaxByteLengthOption ( options )
+
+  1. If Type(options) is not Object, return empty.
+  2. Let maxByteLength be ? Get(options, "maxByteLength").
+  3. If maxByteLength is undefined, return empty.
+  4. Return ? ToIndex(maxByteLength).
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+assert.throws(RangeError, function() {
+  new SharedArrayBuffer(0, { maxByteLength: -1 });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/options-maxbytelength-object.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/options-maxbytelength-object.js
new file mode 100644
index 0000000000..1028f99a99
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/options-maxbytelength-object.js
@@ -0,0 +1,48 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer-constructor
+description: |
+  Invoked with an options object whose `maxByteLength` property cannot be
+  coerced to a primitive value
+info: |
+  SharedArrayBuffer( length [ , options ] )
+
+  1. If NewTarget is undefined, throw a TypeError exception.
+  2. Let byteLength be ? ToIndex(length).
+  3. Let requestedMaxByteLength be ? GetArrayBufferMaxByteLengthOption(options).
+  [...]
+
+  1.1.5 GetArrayBufferMaxByteLengthOption ( options )
+
+  1. If Type(options) is not Object, return empty.
+  2. Let maxByteLength be ? Get(options, "maxByteLength").
+  3. If maxByteLength is undefined, return empty.
+  4. Return ? ToIndex(maxByteLength).
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var log = [];
+var options = {
+  maxByteLength: {
+    toString: function() {
+      log.push('toString');
+      return {};
+    },
+    valueOf: function() {
+      log.push('valueOf');
+      return {};
+    }
+  }
+};
+
+assert.throws(TypeError, function() {
+  new SharedArrayBuffer(0, options);
+});
+
+assert.sameValue(log.length, 2);
+assert.sameValue(log[0], 'valueOf');
+assert.sameValue(log[1], 'toString');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/options-maxbytelength-poisoned.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/options-maxbytelength-poisoned.js
new file mode 100644
index 0000000000..5b887d1772
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/options-maxbytelength-poisoned.js
@@ -0,0 +1,32 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer-constructor
+description: Invoked with an options object whose `maxByteLength` property throws
+info: |
+  SharedArrayBuffer( length [ , options ] )
+
+  1. If NewTarget is undefined, throw a TypeError exception.
+  2. Let byteLength be ? ToIndex(length).
+  3. Let requestedMaxByteLength be ? GetArrayBufferMaxByteLengthOption(options).
+  [...]
+
+  1.1.5 GetArrayBufferMaxByteLengthOption ( options )
+
+  1. If Type(options) is not Object, return empty.
+  2. Let maxByteLength be ? Get(options, "maxByteLength").
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var options = {
+  get maxByteLength() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  new SharedArrayBuffer(0, options);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/options-maxbytelength-undefined.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/options-maxbytelength-undefined.js
new file mode 100644
index 0000000000..8dc6596107
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/options-maxbytelength-undefined.js
@@ -0,0 +1,27 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer-constructor
+description: Invoked with an options object whose `maxByteLength` property is undefined
+info: |
+  SharedArrayBuffer( length [ , options ] )
+
+  1. If NewTarget is undefined, throw a TypeError exception.
+  2. Let byteLength be ? ToIndex(length).
+  3. Let requestedMaxByteLength be ? GetArrayBufferMaxByteLengthOption(options).
+  4. If requestedMaxByteLength is empty, then
+     a. Return ? AllocateSharedArrayBuffer(NewTarget, byteLength).
+
+  1.1.5 GetArrayBufferMaxByteLengthOption ( options )
+
+  1. If Type(options) is not Object, return empty.
+  2. Let maxByteLength be ? Get(options, "maxByteLength").
+  3. If maxByteLength is undefined, return empty.
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+assert.sameValue(new SharedArrayBuffer(0, {}).growable, false);
+assert.sameValue(new SharedArrayBuffer(0, {maxByteLength: undefined}).growable, false);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/options-non-object.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/options-non-object.js
new file mode 100644
index 0000000000..651cef75ba
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/options-non-object.js
@@ -0,0 +1,30 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer-constructor
+description: Invoked with a non-object value for options
+info: |
+  SharedArrayBuffer( length [ , options ] )
+
+  1. If NewTarget is undefined, throw a TypeError exception.
+  2. Let byteLength be ? ToIndex(length).
+  3. Let requestedMaxByteLength be ? GetArrayBufferMaxByteLengthOption(options).
+  4. If requestedMaxByteLength is empty, then
+     a. Return ? AllocateArrayBuffer(NewTarget, byteLength).
+
+  1.1.5 GetArrayBufferMaxByteLengthOption ( options )
+
+  1. If Type(options) is not Object, return empty.
+features: [BigInt, SharedArrayBuffer, Symbol, resizable-arraybuffer]
+---*/
+
+assert.sameValue(new SharedArrayBuffer(0, null).growable, false, 'null');
+assert.sameValue(new SharedArrayBuffer(0, true).growable, false, 'boolean');
+assert.sameValue(new SharedArrayBuffer(0, Symbol(3)).growable, false, 'symbol');
+assert.sameValue(new SharedArrayBuffer(0, 1n).growable, false, 'bigint');
+assert.sameValue(new SharedArrayBuffer(0, 'string').growable, false, 'string');
+assert.sameValue(new SharedArrayBuffer(0, 9).growable, false, 'number');
+assert.sameValue(new SharedArrayBuffer(0, undefined).growable, false, 'undefined');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js
new file mode 100644
index 0000000000..6dcabdf374
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js
@@ -0,0 +1,32 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-sharedarraybuffer-length
+description: Default [[Prototype]] value derived from realm of the newTarget
+info: |
+    [...]
+    3. Return ? AllocateSharedArrayBuffer(NewTarget, byteLength).
+
+    9.1.14 GetPrototypeFromConstructor
+
+    [...]
+    3. Let proto be ? Get(constructor, "prototype").
+    4. If Type(proto) is not Object, then
+       a. Let realm be ? GetFunctionRealm(constructor).
+       b. Let proto be realm's intrinsic object named intrinsicDefaultProto.
+    [...]
+features: [SharedArrayBuffer, cross-realm, Reflect]
+---*/
+
+var other = $262.createRealm().global;
+var C = new other.Function();
+C.prototype = null;
+
+var o = Reflect.construct(SharedArrayBuffer, [], C);
+
+assert.sameValue(Object.getPrototypeOf(o), other.SharedArrayBuffer.prototype);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype-from-newtarget.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype-from-newtarget.js
new file mode 100644
index 0000000000..dc84cfbf1c
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype-from-newtarget.js
@@ -0,0 +1,37 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-sharedarraybuffer-length
+description: >
+  The [[Prototype]] internal slot is computed from NewTarget.
+info: |
+  SharedArrayBuffer( length )
+
+  SharedArrayBuffer called with argument length performs the following steps:
+
+  ...
+  3. Return AllocateSharedArrayBuffer(NewTarget, byteLength).
+
+  AllocateSharedArrayBuffer( constructor, byteLength )
+    1. Let obj be ? OrdinaryCreateFromConstructor(constructor, "%SharedArrayBufferPrototype%",
+       «[[ArrayBufferData]], [[ArrayBufferByteLength]]» ).
+    ...
+features: [Reflect, Reflect.construct, SharedArrayBuffer]
+---*/
+
+var arrayBuffer = Reflect.construct(SharedArrayBuffer, [8], Object);
+assert.sameValue(Object.getPrototypeOf(arrayBuffer), Object.prototype, "NewTarget is built-in Object constructor");
+
+var newTarget = function() {}.bind(null);
+Object.defineProperty(newTarget, "prototype", {
+  get: function() {
+    return Array.prototype;
+  }
+});
+var arrayBuffer = Reflect.construct(SharedArrayBuffer, [16], newTarget);
+assert.sameValue(Object.getPrototypeOf(arrayBuffer), Array.prototype, "NewTarget is BoundFunction with accessor");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/Symbol.toStringTag.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/Symbol.toStringTag.js
new file mode 100644
index 0000000000..07c7d5453e
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/Symbol.toStringTag.js
@@ -0,0 +1,24 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+description: >
+    `Symbol.toStringTag` property descriptor
+info: |
+    The initial value of the @@toStringTag property is the String value
+    "SharedArrayBuffer".
+
+    This property has the attributes { [[Writable]]: false, [[Enumerable]]:
+    false, [[Configurable]]: true }.
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer, Symbol.toStringTag]
+---*/
+
+assert.sameValue(SharedArrayBuffer.prototype[Symbol.toStringTag], 'SharedArrayBuffer');
+
+verifyNotEnumerable(SharedArrayBuffer.prototype, Symbol.toStringTag);
+verifyNotWritable(SharedArrayBuffer.prototype, Symbol.toStringTag);
+verifyConfigurable(SharedArrayBuffer.prototype, Symbol.toStringTag);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/browser.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/browser.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/browser.js
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/browser.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/browser.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/browser.js
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/invoked-as-accessor.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/invoked-as-accessor.js
new file mode 100644
index 0000000000..1276245d2d
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/invoked-as-accessor.js
@@ -0,0 +1,15 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: Requires this value to have a [[ArrayBufferData]] internal slot
+features: [SharedArrayBuffer]
+---*/
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.byteLength;
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/invoked-as-func.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/invoked-as-func.js
new file mode 100644
index 0000000000..111c1f4cb7
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/invoked-as-func.js
@@ -0,0 +1,18 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+description: Throws a TypeError exception when invoked as a function
+features: [SharedArrayBuffer]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  SharedArrayBuffer.prototype, "byteLength"
+).get;
+
+assert.throws(TypeError, function() {
+  getter();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/length.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/length.js
new file mode 100644
index 0000000000..22a944cb3c
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/length.js
@@ -0,0 +1,21 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  get SharedArrayBuffer.prototype.byteLength.length is 0.
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer]
+---*/
+
+var desc = Object.getOwnPropertyDescriptor(SharedArrayBuffer.prototype, "byteLength");
+
+assert.sameValue(desc.get.length, 0);
+
+verifyNotEnumerable(desc.get, "length");
+verifyNotWritable(desc.get, "length");
+verifyConfigurable(desc.get, "length");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/name.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/name.js
new file mode 100644
index 0000000000..28dff46979
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/name.js
@@ -0,0 +1,26 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+description: >
+  get SharedArrayBuffer.prototype.byteLength
+
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer]
+---*/
+
+var descriptor = Object.getOwnPropertyDescriptor(
+  SharedArrayBuffer.prototype, 'byteLength'
+);
+
+assert.sameValue(
+  descriptor.get.name, 'get byteLength',
+  'The value of `descriptor.get.name` is `"get byteLength"`'
+);
+
+verifyNotEnumerable(descriptor.get, 'name');
+verifyNotWritable(descriptor.get, 'name');
+verifyConfigurable(descriptor.get, 'name');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/prop-desc.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/prop-desc.js
new file mode 100644
index 0000000000..9f9d334e62
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/prop-desc.js
@@ -0,0 +1,20 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+description: >
+  "byteLength" property of SharedArrayBuffer.prototype
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer]
+---*/
+
+var desc = Object.getOwnPropertyDescriptor(SharedArrayBuffer.prototype, "byteLength");
+
+assert.sameValue(desc.set, undefined);
+assert.sameValue(typeof desc.get, "function");
+
+verifyNotEnumerable(SharedArrayBuffer.prototype, "byteLength");
+verifyConfigurable(SharedArrayBuffer.prototype, "byteLength");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/return-bytelength.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/return-bytelength.js
new file mode 100644
index 0000000000..05a95c91fe
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/return-bytelength.js
@@ -0,0 +1,16 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+description: Return value from [[ByteLength]] internal slot
+features: [SharedArrayBuffer]
+---*/
+
+var ab1 = new SharedArrayBuffer(0);
+assert.sameValue(ab1.byteLength, 0);
+
+var ab2 = new SharedArrayBuffer(42);
+assert.sameValue(ab2.byteLength, 42);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/shell.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/shell.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/shell.js
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/this-has-no-typedarrayname-internal.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/this-has-no-typedarrayname-internal.js
new file mode 100644
index 0000000000..2052be2229
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/this-has-no-typedarrayname-internal.js
@@ -0,0 +1,34 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+description: >
+  Throws a TypeError exception when `this` does not have a [[ArrayBufferData]]
+  internal slot
+features: [SharedArrayBuffer, DataView, Int8Array]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  SharedArrayBuffer.prototype, "byteLength"
+).get;
+
+assert.throws(TypeError, function() {
+  getter.call({});
+});
+
+assert.throws(TypeError, function() {
+  getter.call([]);
+});
+
+var ta = new Int8Array(new SharedArrayBuffer(8));
+assert.throws(TypeError, function() {
+  getter.call(ta);
+});
+
+var dv = new DataView(new SharedArrayBuffer(8), 0);
+assert.throws(TypeError, function() {
+  getter.call(dv);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/this-is-arraybuffer.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/this-is-arraybuffer.js
new file mode 100644
index 0000000000..a5868b3427
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/this-is-arraybuffer.js
@@ -0,0 +1,20 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-get-sharedarraybuffer.prototype.bytelength
+description: Throws a TypeError exception when `this` is an ArrayBuffer
+features: [SharedArrayBuffer]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  SharedArrayBuffer.prototype, "byteLength"
+).get;
+
+assert.throws(TypeError, function() {
+  var ab = new ArrayBuffer(4);
+  getter.call(ab);
+}, "`this` cannot be an ArrayBuffer");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/this-is-not-object.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/this-is-not-object.js
new file mode 100644
index 0000000000..5e7fa4e32b
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/byteLength/this-is-not-object.js
@@ -0,0 +1,43 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+description: Throws a TypeError exception when `this` is not Object
+features: [SharedArrayBuffer, Symbol]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  SharedArrayBuffer.prototype, "byteLength"
+).get;
+
+assert.throws(TypeError, function() {
+  getter.call(undefined);
+}, "this is undefined");
+
+assert.throws(TypeError, function() {
+  getter.call(null);
+}, "this is null");
+
+assert.throws(TypeError, function() {
+  getter.call(42);
+}, "this is 42");
+
+assert.throws(TypeError, function() {
+  getter.call("1");
+}, "this is a string");
+
+assert.throws(TypeError, function() {
+  getter.call(true);
+}, "this is true");
+
+assert.throws(TypeError, function() {
+  getter.call(false);
+}, "this is false");
+
+var s = Symbol("s");
+assert.throws(TypeError, function() {
+  getter.call(s);
+}, "this is a Symbol");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/constructor.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/constructor.js
new file mode 100644
index 0000000000..6d776dcd28
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/constructor.js
@@ -0,0 +1,19 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  The `SharedArrayBuffer.prototype.constructor` property descriptor.
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer]
+---*/
+
+assert.sameValue(SharedArrayBuffer.prototype.constructor, SharedArrayBuffer);
+
+verifyNotEnumerable(SharedArrayBuffer.prototype, "constructor");
+verifyWritable(SharedArrayBuffer.prototype, "constructor");
+verifyConfigurable(SharedArrayBuffer.prototype, "constructor");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/browser.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/browser.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/browser.js
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/descriptor.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/descriptor.js
new file mode 100644
index 0000000000..30a04e7720
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/descriptor.js
@@ -0,0 +1,25 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: >
+  SharedArrayBuffer.prototype.grow has default data property attributes.
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  17 ECMAScript Standard Built-in Objects:
+    Every other data property described in clauses 18 through 26 and in
+    Annex B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+verifyProperty(SharedArrayBuffer.prototype, 'grow', {
+  enumerable: false,
+  writable: true,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/extensible.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/extensible.js
new file mode 100644
index 0000000000..ac92e75332
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/extensible.js
@@ -0,0 +1,18 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: SharedArrayBuffer.prototype.grow is extensible.
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  17 ECMAScript Standard Built-in Objects:
+    Unless specified otherwise, the [[Extensible]] internal slot
+    of a built-in object initially has the value true.
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+assert(Object.isExtensible(SharedArrayBuffer.prototype.grow));
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/grow-larger-size.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/grow-larger-size.js
new file mode 100644
index 0000000000..750a5896e3
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/grow-larger-size.js
@@ -0,0 +1,50 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: >
+  Behavior when attempting to grow a growable array buffer to a larger size
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  3. If IsSharedArrayBuffer(O) is false throw a TypeError exception.
+  4. Let newByteLength be ? ToIntegerOrInfinity(newLength).
+  5. Let hostHandled be ? HostGrowSharedArrayBuffer(O, newByteLength).
+  6. If hostHandled is handled, return undefined.
+  [...]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var sab = new SharedArrayBuffer(4, {maxByteLength: 5});
+var result;
+
+// If the host chooses to throw as allowed by the specification, the observed
+// behavior will be identical to the case where
+// `SharedArrayBuffer.prototype.grow` has not been implemented. The following
+// assertion prevents this test from passing in runtimes which have not
+// implemented the method.
+assert.sameValue(typeof sab.grow, 'function');
+
+try {
+  result = ab.grow(5);
+} catch (_) {}
+
+// One of the following three conditions must be met:
+//
+// - HostGrowSharedArrayBuffer returns an abrupt completion
+// - HostGrowSharedArrayBuffer handles the grow operation, and the `grow`
+//   method returns early
+// - HostGrowSharedArrayBuffer does not handle the grow operation, and the
+//   `grow` method executes its final steps
+//
+// All three conditions have the same effect on the value of `result`.
+assert.sameValue(result, undefined, 'normal completion value');
+
+// Neither the length nor the contents of the SharedArrayBuffer are guaranteed
+// by the host-defined abstract operation, so they are not asserted in this
+// test.
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/grow-same-size.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/grow-same-size.js
new file mode 100644
index 0000000000..2e610ac491
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/grow-same-size.js
@@ -0,0 +1,50 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: >
+  Behavior when attempting to grow a growable array buffer to its current size
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  3. If IsSharedArrayBuffer(O) is false throw a TypeError exception.
+  4. Let newByteLength be ? ToIntegerOrInfinity(newLength).
+  5. Let hostHandled be ? HostGrowSharedArrayBuffer(O, newByteLength).
+  6. If hostHandled is handled, return undefined.
+  [...]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var sab = new SharedArrayBuffer(4, {maxByteLength: 5});
+var result;
+
+// If the host chooses to throw as allowed by the specification, the observed
+// behavior will be identical to the case where
+// `SharedArrayBuffer.prototype.grow` has not been implemented. The following
+// assertion prevents this test from passing in runtimes which have not
+// implemented the method.
+assert.sameValue(typeof sab.grow, 'function');
+
+try {
+  result = ab.grow(4);
+} catch (_) {}
+
+// One of the following three conditions must be met:
+//
+// - HostGrowSharedArrayBuffer returns an abrupt completion
+// - HostGrowSharedArrayBuffer handles the grow operation, and the `grow`
+//   method returns early
+// - HostGrowSharedArrayBuffer does not handle the grow operation, and the
+//   `grow` method executes its final steps
+//
+// All three conditions have the same effect on the value of `result`.
+assert.sameValue(result, undefined, 'normal completion value');
+
+// Neither the length nor the contents of the SharedArrayBuffer are guaranteed
+// by the host-defined abstract operation, so they are not asserted in this
+// test.
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/grow-smaller-size.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/grow-smaller-size.js
new file mode 100644
index 0000000000..c85c7d61cf
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/grow-smaller-size.js
@@ -0,0 +1,50 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: >
+  Behavior when attempting to grow a growable array buffer to a smaller size
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  3. If IsSharedArrayBuffer(O) is false throw a TypeError exception.
+  4. Let newByteLength be ? ToIntegerOrInfinity(newLength).
+  5. Let hostHandled be ? HostGrowSharedArrayBuffer(O, newByteLength).
+  6. If hostHandled is handled, return undefined.
+  [...]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var sab = new SharedArrayBuffer(4, {maxByteLength: 5});
+var result;
+
+// If the host chooses to throw as allowed by the specification, the observed
+// behavior will be identical to the case where
+// `SharedArrayBuffer.prototype.grow` has not been implemented. The following
+// assertion prevents this test from passing in runtimes which have not
+// implemented the method.
+assert.sameValue(typeof sab.grow, 'function');
+
+try {
+  result = ab.grow(3);
+} catch (_) {}
+
+// One of the following three conditions must be met:
+//
+// - HostGrowSharedArrayBuffer returns an abrupt completion
+// - HostGrowSharedArrayBuffer handles the grow operation, and the `grow`
+//   method returns early
+// - HostGrowSharedArrayBuffer does not handle the grow operation, and the
+//   `grow` method executes its final steps
+//
+// All three conditions have the same effect on the value of `result`.
+assert.sameValue(result, undefined, 'normal completion value');
+
+// Neither the length nor the contents of the SharedArrayBuffer are guaranteed
+// by the host-defined abstract operation, so they are not asserted in this
+// test.
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/length.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/length.js
new file mode 100644
index 0000000000..2540dec1c6
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/length.js
@@ -0,0 +1,33 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: >
+  SharedArrayBuffer.prototype.grow.length is 1.
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  17 ECMAScript Standard Built-in Objects:
+    Every built-in Function object, including constructors, has a length
+    property whose value is an integer. Unless otherwise specified, this
+    value is equal to the largest number of named arguments shown in the
+    subclause headings for the function description, including optional
+    parameters. However, rest parameters shown using the form “...name”
+    are not included in the default argument count.
+
+    Unless otherwise specified, the length property of a built-in Function
+    object has the attributes { [[Writable]]: false, [[Enumerable]]: false,
+    [[Configurable]]: true }.
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+verifyProperty(SharedArrayBuffer.prototype.grow, 'length', {
+  value: 1,
+  enumerable: false,
+  writable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/name.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/name.js
new file mode 100644
index 0000000000..1442bdde0a
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/name.js
@@ -0,0 +1,30 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: >
+  SharedArrayBuffer.prototype.grow.name is "grow".
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  17 ECMAScript Standard Built-in Objects:
+    Every built-in Function object, including constructors, that is not
+    identified as an anonymous function has a name property whose value
+    is a String.
+
+    Unless otherwise specified, the name property of a built-in Function
+    object, if it exists, has the attributes { [[Writable]]: false,
+    [[Enumerable]]: false, [[Configurable]]: true }.
+features: [SharedArrayBuffer, resizable-arraybuffer]
+includes: [propertyHelper.js]
+---*/
+
+verifyProperty(SharedArrayBuffer.prototype.grow, 'name', {
+  value: 'grow',
+  enumerable: false,
+  writable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/new-length-excessive.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/new-length-excessive.js
new file mode 100644
index 0000000000..eff3d1ff50
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/new-length-excessive.js
@@ -0,0 +1,27 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: >
+  Throws a RangeError the newLength value is larger than the max byte length
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  3. If IsSharedArrayBuffer(O) is false, throw a TypeError exception.
+  4. Let newByteLength be ? ToIntegerOrInfinity(newLength).
+  5. If newByteLength < 0 or newByteLength > O.[[ArrayBufferMaxByteLength]],
+     throw a RangeError exception.
+  [...]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var ab = new SharedArrayBuffer(4, {maxByteLength: 4});
+
+assert.throws(RangeError, function() {
+  ab.grow(5);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/new-length-negative.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/new-length-negative.js
new file mode 100644
index 0000000000..6eef109cd4
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/new-length-negative.js
@@ -0,0 +1,27 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: >
+  Throws a RangeError the newLength value is less than zero
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  3. If IsSharedArrayBuffer(O) is false, throw a TypeError exception.
+  4. Let newByteLength be ? ToIntegerOrInfinity(newLength).
+  5. If newByteLength < 0 or newByteLength > O.[[ArrayBufferMaxByteLength]],
+     throw a RangeError exception.
+  [...]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var ab = new SharedArrayBuffer(4, {maxByteLength: 4});
+
+assert.throws(RangeError, function() {
+  ab.grow(-1);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/new-length-non-number.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/new-length-non-number.js
new file mode 100644
index 0000000000..be5009f23c
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/new-length-non-number.js
@@ -0,0 +1,39 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: Throws a TypeError if provided length cannot be coerced to a number
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  3. If IsSharedArrayBuffer(O) is false, throw a TypeError exception.
+  4. Let newByteLength be ? ToIntegerOrInfinity(newLength).
+  [...]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var log = [];
+var newLength = {
+  toString: function() {
+    log.push('toString');
+    return {};
+  },
+  valueOf: function() {
+    log.push('valueOf');
+    return {};
+  }
+};
+var ab = new SharedArrayBuffer(0, {maxByteLength: 4});
+
+assert.throws(TypeError, function() {
+  ab.grow(newLength);
+});
+
+assert.sameValue(log.length, 2);
+assert.sameValue(log[0], 'valueOf');
+assert.sameValue(log[1], 'toString');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/nonconstructor.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/nonconstructor.js
new file mode 100644
index 0000000000..cd4d59085a
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/nonconstructor.js
@@ -0,0 +1,26 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: >
+  SharedArrayBuffer.prototype.grow is not a constructor function.
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  17 ECMAScript Standard Built-in Objects:
+    Built-in function objects that are not identified as constructors do not
+    implement the [[Construct]] internal method unless otherwise specified
+    in the description of a particular function.
+includes: [isConstructor.js]
+features: [SharedArrayBuffer, resizable-arraybuffer, Reflect.construct]
+---*/
+
+assert(!isConstructor(SharedArrayBuffer.prototype.grow), "SharedArrayBuffer.prototype.grow is not a constructor");
+
+var arrayBuffer = new SharedArrayBuffer(8);
+assert.throws(TypeError, function() {
+  new arrayBuffer.grow();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/shell.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/shell.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/shell.js
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/this-is-not-arraybuffer-object.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/this-is-not-arraybuffer-object.js
new file mode 100644
index 0000000000..7c92420ddc
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/this-is-not-arraybuffer-object.js
@@ -0,0 +1,31 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: >
+  Throws a TypeError if `this` does not have an [[ArrayBufferData]] internal slot.
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  [...]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+assert.sameValue(typeof SharedArrayBuffer.prototype.grow, 'function');
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.grow();
+}, '`this` value is the SharedArrayBuffer prototype');
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.grow.call({});
+}, '`this` value is an object');
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.grow.call([]);
+}, '`this` value is an array');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/this-is-not-object.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/this-is-not-object.js
new file mode 100644
index 0000000000..4419d23dc0
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/this-is-not-object.js
@@ -0,0 +1,47 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: Throws a TypeError if `this` valueis not an object.
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  [...]
+features: [BigInt, SharedArrayBuffer, Symbol, resizable-arraybuffer]
+---*/
+
+assert.sameValue(typeof SharedArrayBuffer.prototype.grow, "function");
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.grow.call(undefined);
+}, "`this` value is undefined");
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.grow.call(null);
+}, "`this` value is null");
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.grow.call(true);
+}, "`this` value is Boolean");
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.grow.call("");
+}, "`this` value is String");
+
+var symbol = Symbol();
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.grow.call(symbol);
+}, "`this` value is Symbol");
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.grow.call(1);
+}, "`this` value is Number");
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.grow.call(1n);
+}, "`this` value is bigint");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/this-is-not-resizable-arraybuffer-object.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/this-is-not-resizable-arraybuffer-object.js
new file mode 100644
index 0000000000..2fd55596ad
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/this-is-not-resizable-arraybuffer-object.js
@@ -0,0 +1,41 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: >
+  Throws a TypeError if `this` does not have an [[ArrayBufferMaxByteLength]] internal slot.
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  [...]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var ab;
+
+assert.sameValue(typeof SharedArrayBuffer.prototype.grow, 'function');
+
+ab = new SharedArrayBuffer(4);
+assert.throws(TypeError, function() {
+  ab.grow(0);
+}, 'zero byte length');
+
+ab = new SharedArrayBuffer(4);
+assert.throws(TypeError, function() {
+  ab.grow(3);
+}, 'smaller byte length');
+
+ab = new SharedArrayBuffer(4);
+assert.throws(TypeError, function() {
+  ab.grow(4);
+}, 'same byte length');
+
+ab = new SharedArrayBuffer(4);
+assert.throws(TypeError, function() {
+  ab.grow(5);
+}, 'larger byte length');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/this-is-sharedarraybuffer.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/this-is-sharedarraybuffer.js
new file mode 100644
index 0000000000..ccfddacf8e
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/grow/this-is-sharedarraybuffer.js
@@ -0,0 +1,23 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype.grow
+description: Throws a TypeError if `this` value is an ArrayBuffer
+info: |
+  SharedArrayBuffer.prototype.grow ( newLength )
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
+  3. If IsSharedArrayBuffer(O) is false, throw a TypeError exception.
+  [...]
+features: [ArrayBuffer, SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var ab = new ArrayBuffer(0);
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.grow.call(ab);
+}, '`this` value cannot be an ArrayBuffer');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/browser.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/browser.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/browser.js
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/invoked-as-accessor.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/invoked-as-accessor.js
new file mode 100644
index 0000000000..78925bfeab
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/invoked-as-accessor.js
@@ -0,0 +1,20 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.growable
+description: Requires this value to have a [[ArrayBufferData]] internal slot
+info: |
+  get SharedArrayBuffer.prototype.growable
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.growable;
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/invoked-as-func.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/invoked-as-func.js
new file mode 100644
index 0000000000..ac07935237
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/invoked-as-func.js
@@ -0,0 +1,26 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.growable
+description: Throws a TypeError exception when invoked as a function
+info: |
+  get SharedArrayBuffer.prototype.growable
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  SharedArrayBuffer.prototype, 'growable'
+).get;
+
+assert.sameValue(typeof getter, 'function');
+
+assert.throws(TypeError, function() {
+  getter();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/length.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/length.js
new file mode 100644
index 0000000000..b46a2ead01
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/length.js
@@ -0,0 +1,35 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.growable
+description: >
+  get SharedArrayBuffer.prototype.growable.length is 0.
+info: |
+  get SharedArrayBuffer.prototype.resizeable
+
+  17 ECMAScript Standard Built-in Objects:
+    Every built-in Function object, including constructors, has a length
+    property whose value is an integer. Unless otherwise specified, this
+    value is equal to the largest number of named arguments shown in the
+    subclause headings for the function description, including optional
+    parameters. However, rest parameters shown using the form “...name”
+    are not included in the default argument count.
+
+    Unless otherwise specified, the length property of a built-in Function
+    object has the attributes { [[Writable]]: false, [[Enumerable]]: false,
+    [[Configurable]]: true }.
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var desc = Object.getOwnPropertyDescriptor(SharedArrayBuffer.prototype, 'growable');
+
+verifyProperty(desc.get, 'length', {
+  value: 0,
+  enumerable: false,
+  writable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/name.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/name.js
new file mode 100644
index 0000000000..6b24f06a2e
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/name.js
@@ -0,0 +1,27 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.growable
+description: >
+  get SharedArrayBuffer.prototype.growable
+
+  17 ECMAScript Standard Built-in Objects
+
+  Functions that are specified as get or set accessor functions of built-in
+  properties have "get " or "set " prepended to the property name string.
+
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var desc = Object.getOwnPropertyDescriptor(SharedArrayBuffer.prototype, 'growable');
+
+verifyProperty(desc.get, 'name', {
+  value: 'get growable',
+  enumerable: false,
+  writable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/prop-desc.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/prop-desc.js
new file mode 100644
index 0000000000..d48198652c
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/prop-desc.js
@@ -0,0 +1,28 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.growable
+description: >
+  "growable" property of SharedArrayBuffer.prototype
+info: |
+  SharedArrayBuffer.prototype.growable is an accessor property whose set accessor
+  function is undefined.
+
+  Section 17: Every accessor property described in clauses 18 through 26 and in
+  Annex B.2 has the attributes {[[Enumerable]]: false, [[Configurable]]: true }
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var desc = Object.getOwnPropertyDescriptor(SharedArrayBuffer.prototype, 'growable');
+
+assert.sameValue(desc.set, undefined);
+assert.sameValue(typeof desc.get, 'function');
+
+verifyProperty(SharedArrayBuffer.prototype, 'growable', {
+  enumerable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/return-growable.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/return-growable.js
new file mode 100644
index 0000000000..b97ea9633e
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/return-growable.js
@@ -0,0 +1,32 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.growable
+description: Return value according to [[ArrayBufferMaxByteLength]] internal slot
+info: |
+  get SharedArrayBuffer.prototype.growable
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is false, throw a TypeError exception.
+  4. Return IsResizableArrayBuffer(O).
+
+  IsResizableArrayBuffer ( arrayBuffer )
+
+  1. Assert: Type(arrayBuffer) is Object and arrayBuffer has an
+     [[ArrayBufferData]] internal slot.
+  2. If buffer has an [[ArrayBufferMaxByteLength]] internal slot, return true.
+  3. Return false.
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var sab1 = new SharedArrayBuffer(1);
+
+assert.sameValue(sab1.growable, false);
+
+var sab2 = new SharedArrayBuffer(1, {maxByteLength: 1});
+
+assert.sameValue(sab2.growable, true);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/shell.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/shell.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/shell.js
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/this-has-no-arraybufferdata-internal.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/this-has-no-arraybufferdata-internal.js
new file mode 100644
index 0000000000..b6e12d3c48
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/this-has-no-arraybufferdata-internal.js
@@ -0,0 +1,42 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.growable
+description: >
+  Throws a TypeError exception when `this` does not have a [[ArrayBufferData]]
+  internal slot
+info: |
+  get SharedArrayBuffer.prototype.growable
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [DataView, SharedArrayBuffer, TypedArray, resizable-arraybuffer]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  SharedArrayBuffer.prototype, "growable"
+).get;
+
+assert.sameValue(typeof getter, "function");
+
+assert.throws(TypeError, function() {
+  getter.call({});
+});
+
+assert.throws(TypeError, function() {
+  getter.call([]);
+});
+
+var ta = new Int8Array(8);
+assert.throws(TypeError, function() {
+  getter.call(ta);
+});
+
+var dv = new DataView(new SharedArrayBuffer(8), 0);
+assert.throws(TypeError, function() {
+  getter.call(dv);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/this-is-arraybuffer.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/this-is-arraybuffer.js
new file mode 100644
index 0000000000..3beac38f44
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/this-is-arraybuffer.js
@@ -0,0 +1,36 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.growable
+description: Throws a TypeError exception when `this` is an ArrayBuffer
+info: |
+  get SharedArrayBuffer.prototype.growable
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is false, throw a TypeError exception.
+  [...]
+features: [ArrayBuffer, SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var growable = Object.getOwnPropertyDescriptor(
+  SharedArrayBuffer.prototype, "growable"
+);
+
+var getter = growable.get;
+var ab = new ArrayBuffer(4);
+
+assert.sameValue(typeof getter, "function");
+
+assert.throws(TypeError, function() {
+  getter.call(ab);
+}, "`this` cannot be an ArrayBuffer");
+
+Object.defineProperties(ab, { growable: growable });
+
+assert.throws(TypeError, function() {
+  ab.growable;
+}, "`this` cannot be an ArrayBuffer");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/this-is-not-object.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/this-is-not-object.js
new file mode 100644
index 0000000000..01a6c81599
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/growable/this-is-not-object.js
@@ -0,0 +1,51 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.growable
+description: Throws a TypeError exception when `this` is not Object
+info: |
+  get SharedArrayBuffer.prototype.growable
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [SharedArrayBuffer, Symbol, resizable-arraybuffer]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  SharedArrayBuffer.prototype, "growable"
+).get;
+
+assert.sameValue(typeof getter, "function");
+
+assert.throws(TypeError, function() {
+  getter.call(undefined);
+}, "this is undefined");
+
+assert.throws(TypeError, function() {
+  getter.call(null);
+}, "this is null");
+
+assert.throws(TypeError, function() {
+  getter.call(42);
+}, "this is 42");
+
+assert.throws(TypeError, function() {
+  getter.call("1");
+}, "this is a string");
+
+assert.throws(TypeError, function() {
+  getter.call(true);
+}, "this is true");
+
+assert.throws(TypeError, function() {
+  getter.call(false);
+}, "this is false");
+
+var s = Symbol("s");
+assert.throws(TypeError, function() {
+  getter.call(s);
+}, "this is a Symbol");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/browser.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/browser.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/browser.js
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/invoked-as-accessor.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/invoked-as-accessor.js
new file mode 100644
index 0000000000..0b22216e79
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/invoked-as-accessor.js
@@ -0,0 +1,20 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.maxbytelength
+description: Requires this value to have a [[ArrayBufferData]] internal slot
+info: |
+  get SharedArrayBuffer.prototype.maxByteLength
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.maxByteLength;
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/invoked-as-func.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/invoked-as-func.js
new file mode 100644
index 0000000000..38eb846de2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/invoked-as-func.js
@@ -0,0 +1,26 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.maxbytelength
+description: Throws a TypeError exception when invoked as a function
+info: |
+  get SharedArrayBuffer.prototype.maxByteLength
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  SharedArrayBuffer.prototype, 'maxByteLength'
+).get;
+
+assert.sameValue(typeof getter, 'function');
+
+assert.throws(TypeError, function() {
+  getter();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/length.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/length.js
new file mode 100644
index 0000000000..1b1805503a
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/length.js
@@ -0,0 +1,35 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.maxbytelength
+description: >
+  get SharedArrayBuffer.prototype.maxByteLength.length is 0.
+info: |
+  get SharedArrayBuffer.prototype.maxByteLength
+
+  17 ECMAScript Standard Built-in Objects:
+    Every built-in Function object, including constructors, has a length
+    property whose value is an integer. Unless otherwise specified, this
+    value is equal to the largest number of named arguments shown in the
+    subclause headings for the function description, including optional
+    parameters. However, rest parameters shown using the form “...name”
+    are not included in the default argument count.
+
+    Unless otherwise specified, the length property of a built-in Function
+    object has the attributes { [[Writable]]: false, [[Enumerable]]: false,
+    [[Configurable]]: true }.
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var desc = Object.getOwnPropertyDescriptor(SharedArrayBuffer.prototype, 'maxByteLength');
+
+verifyProperty(desc.get, 'length', {
+  value: 0,
+  enumerable: false,
+  writable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/name.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/name.js
new file mode 100644
index 0000000000..3f46170c78
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/name.js
@@ -0,0 +1,27 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.maxbytelength
+description: >
+  get SharedArrayBuffer.prototype.maxByteLength
+
+  17 ECMAScript Standard Built-in Objects
+
+  Functions that are specified as get or set accessor functions of built-in
+  properties have "get " or "set " prepended to the property name string.
+
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var desc = Object.getOwnPropertyDescriptor(SharedArrayBuffer.prototype, 'maxByteLength');
+
+verifyProperty(desc.get, 'name', {
+  value: 'get maxByteLength',
+  enumerable: false,
+  writable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/prop-desc.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/prop-desc.js
new file mode 100644
index 0000000000..db0579a73a
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/prop-desc.js
@@ -0,0 +1,28 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.maxbytelength
+description: >
+  "maxByteLength" property of SharedArrayBuffer.prototype
+info: |
+  SharedArrayBuffer.prototype.maxByteLength is an accessor property whose set
+  accessor function is undefined.
+
+  Section 17: Every accessor property described in clauses 18 through 26 and in
+  Annex B.2 has the attributes {[[Enumerable]]: false, [[Configurable]]: true }
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var desc = Object.getOwnPropertyDescriptor(SharedArrayBuffer.prototype, 'maxByteLength');
+
+assert.sameValue(desc.set, undefined);
+assert.sameValue(typeof desc.get, 'function');
+
+verifyProperty(SharedArrayBuffer.prototype, 'maxByteLength', {
+  enumerable: false,
+  configurable: true
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/return-maxbytelength-growable.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/return-maxbytelength-growable.js
new file mode 100644
index 0000000000..5611749493
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/return-maxbytelength-growable.js
@@ -0,0 +1,30 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.maxbytelength
+description: Return value from [[ArrayBufferMaxByteLength]] internal slot
+info: |
+  24.1.4.1 get SharedArrayBuffer.prototype.maxByteLength
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is false, throw a TypeError exception.
+  4. If IsResizableArrayBuffer(O) is true, then
+     a. Let length be O.[[ArrayBufferMaxByteLength]].
+  5. Else,
+     [...]
+  6. Return 𝔽(length).
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var ab1 = new SharedArrayBuffer(0, { maxByteLength: 0 });
+assert.sameValue(ab1.maxByteLength, 0);
+
+var ab2 = new SharedArrayBuffer(0, { maxByteLength: 23 });
+assert.sameValue(ab2.maxByteLength, 23);
+
+var ab3 = new SharedArrayBuffer(42, { maxByteLength: 42 });
+assert.sameValue(ab3.maxByteLength, 42);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/return-maxbytelength-non-growable.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/return-maxbytelength-non-growable.js
new file mode 100644
index 0000000000..2058871ceb
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/return-maxbytelength-non-growable.js
@@ -0,0 +1,27 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.maxbytelength
+description: Return value from [[ArrayBufferByteLength]] internal slot
+info: |
+  24.1.4.1 get SharedArrayBuffer.prototype.maxByteLength
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is false, throw a TypeError exception.
+  4. If IsResizableArrayBuffer(O) is true, then
+     [...]
+  5. Else,
+     a. Let length be O.[[ArrayBufferByteLength]].
+  6. Return 𝔽(length).
+features: [SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var ab1 = new SharedArrayBuffer(0);
+assert.sameValue(ab1.maxByteLength, 0);
+
+var ab2 = new SharedArrayBuffer(42);
+assert.sameValue(ab2.maxByteLength, 42);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/shell.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/shell.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/shell.js
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/this-has-no-arraybufferdata-internal.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/this-has-no-arraybufferdata-internal.js
new file mode 100644
index 0000000000..f5e1ba097f
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/this-has-no-arraybufferdata-internal.js
@@ -0,0 +1,42 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.maxbytelength
+description: >
+  Throws a TypeError exception when `this` does not have a [[ArrayBufferData]]
+  internal slot
+info: |
+  get SharedArrayBuffer.prototype.maxByteLength
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [DataView, SharedArrayBuffer, TypedArray, resizable-arraybuffer]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  SharedArrayBuffer.prototype, "maxByteLength"
+).get;
+
+assert.sameValue(typeof getter, "function");
+
+assert.throws(TypeError, function() {
+  getter.call({});
+});
+
+assert.throws(TypeError, function() {
+  getter.call([]);
+});
+
+var ta = new Int8Array(8);
+assert.throws(TypeError, function() {
+  getter.call(ta);
+});
+
+var dv = new DataView(new SharedArrayBuffer(8), 0);
+assert.throws(TypeError, function() {
+  getter.call(dv);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/this-is-arraybuffer.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/this-is-arraybuffer.js
new file mode 100644
index 0000000000..2be9136851
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/this-is-arraybuffer.js
@@ -0,0 +1,36 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.maxbytelength
+description: Throws a TypeError exception when `this` is an ArrayBuffer
+info: |
+  get SharedArrayBuffer.prototype.maxByteLength
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  3. If IsSharedArrayBuffer(O) is false, throw a TypeError exception.
+  [...]
+features: [ArrayBuffer, SharedArrayBuffer, resizable-arraybuffer]
+---*/
+
+var maxByteLength = Object.getOwnPropertyDescriptor(
+  SharedArrayBuffer.prototype, "maxByteLength"
+);
+
+var getter = maxByteLength.get;
+var ab = new ArrayBuffer(4);
+
+assert.sameValue(typeof getter, "function");
+
+assert.throws(TypeError, function() {
+  getter.call(ab);
+}, "`this` cannot be an ArrayBuffer");
+
+Object.defineProperties(ab, { maxByteLength: maxByteLength });
+
+assert.throws(TypeError, function() {
+  ab.maxByteLength;
+}, "`this` cannot be an ArrayBuffer");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/this-is-not-object.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/this-is-not-object.js
new file mode 100644
index 0000000000..a34d19371d
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/maxByteLength/this-is-not-object.js
@@ -0,0 +1,51 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!this.hasOwnProperty('SharedArrayBuffer')||!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- SharedArrayBuffer,resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-get-sharedarraybuffer.prototype.maxbytelength
+description: Throws a TypeError exception when `this` is not Object
+info: |
+  get SharedArrayBuffer.prototype.maxByteLength
+
+  1. Let O be the this value.
+  2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  [...]
+features: [SharedArrayBuffer, Symbol, resizable-arraybuffer]
+---*/
+
+var getter = Object.getOwnPropertyDescriptor(
+  SharedArrayBuffer.prototype, "maxByteLength"
+).get;
+
+assert.sameValue(typeof getter, "function");
+
+assert.throws(TypeError, function() {
+  getter.call(undefined);
+}, "this is undefined");
+
+assert.throws(TypeError, function() {
+  getter.call(null);
+}, "this is null");
+
+assert.throws(TypeError, function() {
+  getter.call(42);
+}, "this is 42");
+
+assert.throws(TypeError, function() {
+  getter.call("1");
+}, "this is a string");
+
+assert.throws(TypeError, function() {
+  getter.call(true);
+}, "this is true");
+
+assert.throws(TypeError, function() {
+  getter.call(false);
+}, "this is false");
+
+var s = Symbol("s");
+assert.throws(TypeError, function() {
+  getter.call(s);
+}, "this is a Symbol");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/prop-desc.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/prop-desc.js
new file mode 100644
index 0000000000..d930563d65
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/prop-desc.js
@@ -0,0 +1,20 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2021 Leo Balter. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-sharedarraybuffer.prototype
+description: Property descriptor of the 'prototype' property
+info: |
+  This property has the attributes { [[Writable]]: false, [[Enumerable]]:
+  false, [[Configurable]]: false }.
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer]
+---*/
+
+verifyProperty(SharedArrayBuffer, 'prototype', {
+    enumerable: false,
+    writable: false,
+    configurable: false
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/shell.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/shell.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/shell.js
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/browser.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/browser.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/browser.js
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/context-is-not-arraybuffer-object.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/context-is-not-arraybuffer-object.js
new file mode 100644
index 0000000000..036d367651
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/context-is-not-arraybuffer-object.js
@@ -0,0 +1,20 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Throws a TypeError if `this` does not have an [[ArrayBufferData]] internal slot.
+features: [SharedArrayBuffer]
+---*/
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.slice.call({});
+}, "`this` value is Object");
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.slice.call([]);
+}, "`this` value is Array");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/context-is-not-object.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/context-is-not-object.js
new file mode 100644
index 0000000000..e2a9c2bf2f
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/context-is-not-object.js
@@ -0,0 +1,38 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Throws a TypeError if `this` is not an Object.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+features: [SharedArrayBuffer, Symbol]
+---*/
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.slice.call(undefined);
+}, "`this` value is undefined");
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.slice.call(null);
+}, "`this` value is null");
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.slice.call(true);
+}, "`this` value is Boolean");
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.slice.call("");
+}, "`this` value is String");
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.slice.call(Symbol());
+}, "`this` value is Symbol");
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer.prototype.slice.call(1);
+}, "`this` value is Number");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/descriptor.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/descriptor.js
new file mode 100644
index 0000000000..112e905d30
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/descriptor.js
@@ -0,0 +1,24 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  SharedArrayBuffer.prototype.slice has default data property attributes.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+  17 ECMAScript Standard Built-in Objects:
+    Every other data property described in clauses 18 through 26 and in
+    Annex B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer]
+---*/
+
+verifyNotEnumerable(SharedArrayBuffer.prototype, "slice");
+verifyWritable(SharedArrayBuffer.prototype, "slice");
+verifyConfigurable(SharedArrayBuffer.prototype, "slice");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/end-default-if-absent.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/end-default-if-absent.js
new file mode 100644
index 0000000000..cfacf942a7
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/end-default-if-absent.js
@@ -0,0 +1,21 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  The `end` index defaults to [[ArrayBufferByteLength]] if absent.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer]
+---*/
+
+var arrayBuffer = new SharedArrayBuffer(8);
+
+var start = 6;
+var result = arrayBuffer.slice(start);
+assert.sameValue(result.byteLength, 2);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/end-default-if-undefined.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/end-default-if-undefined.js
new file mode 100644
index 0000000000..0ad7b81343
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/end-default-if-undefined.js
@@ -0,0 +1,22 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  The `end` index defaults to [[ArrayBufferByteLength]] if undefined.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer]
+---*/
+
+var arrayBuffer = new SharedArrayBuffer(8);
+
+var start = 6,
+  end = undefined;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 2);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/end-exceeds-length.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/end-exceeds-length.js
new file mode 100644
index 0000000000..d4c01867c6
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/end-exceeds-length.js
@@ -0,0 +1,32 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Large `end` index is clamped to [[ArrayBufferByteLength]].
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer]
+---*/
+
+var arrayBuffer = new SharedArrayBuffer(8);
+
+var start = 1,
+  end = 12;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 7, "slice(1, 12)");
+
+var start = 2,
+  end = 0x100000000;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 6, "slice(2, 0x100000000)");
+
+var start = 3,
+  end = +Infinity;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 5, "slice(3, Infinity)");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/extensible.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/extensible.js
new file mode 100644
index 0000000000..ad6dc3b3f7
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/extensible.js
@@ -0,0 +1,20 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  SharedArrayBuffer.prototype.slice is extensible.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+  17 ECMAScript Standard Built-in Objects:
+    Unless specified otherwise, the [[Extensible]] internal slot
+    of a built-in object initially has the value true.
+features: [SharedArrayBuffer]
+---*/
+
+assert(Object.isExtensible(SharedArrayBuffer.prototype.slice));
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/length.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/length.js
new file mode 100644
index 0000000000..6760427fb6
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/length.js
@@ -0,0 +1,33 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  SharedArrayBuffer.prototype.slice.length is 2.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+  17 ECMAScript Standard Built-in Objects:
+    Every built-in Function object, including constructors, has a length
+    property whose value is an integer. Unless otherwise specified, this
+    value is equal to the largest number of named arguments shown in the
+    subclause headings for the function description, including optional
+    parameters. However, rest parameters shown using the form “...name”
+    are not included in the default argument count.
+
+    Unless otherwise specified, the length property of a built-in Function
+    object has the attributes { [[Writable]]: false, [[Enumerable]]: false,
+    [[Configurable]]: true }.
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer]
+---*/
+
+assert.sameValue(SharedArrayBuffer.prototype.slice.length, 2);
+
+verifyNotEnumerable(SharedArrayBuffer.prototype.slice, "length");
+verifyNotWritable(SharedArrayBuffer.prototype.slice, "length");
+verifyConfigurable(SharedArrayBuffer.prototype.slice, "length");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/name.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/name.js
new file mode 100644
index 0000000000..a3407d4b8a
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/name.js
@@ -0,0 +1,30 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  SharedArrayBuffer.prototype.slice.name is "slice".
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+  17 ECMAScript Standard Built-in Objects:
+    Every built-in Function object, including constructors, that is not
+    identified as an anonymous function has a name property whose value
+    is a String.
+
+    Unless otherwise specified, the name property of a built-in Function
+    object, if it exists, has the attributes { [[Writable]]: false,
+    [[Enumerable]]: false, [[Configurable]]: true }.
+includes: [propertyHelper.js]
+features: [SharedArrayBuffer]
+---*/
+
+assert.sameValue(SharedArrayBuffer.prototype.slice.name, "slice");
+
+verifyNotEnumerable(SharedArrayBuffer.prototype.slice, "name");
+verifyNotWritable(SharedArrayBuffer.prototype.slice, "name");
+verifyConfigurable(SharedArrayBuffer.prototype.slice, "name");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/negative-end.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/negative-end.js
new file mode 100644
index 0000000000..2e2b4bf7d7
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/negative-end.js
@@ -0,0 +1,32 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Negative `end` index is relative to [[ArrayBufferByteLength]].
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer]
+---*/
+
+var arrayBuffer = new SharedArrayBuffer(8);
+
+var start = 2,
+  end = -4;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 2, "slice(2, -4)");
+
+var start = 2,
+  end = -10;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 0, "slice(2, -10)");
+
+var start = 2,
+  end = -Infinity;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 0, "slice(2, -Infinity)");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/negative-start.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/negative-start.js
new file mode 100644
index 0000000000..ed7213976b
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/negative-start.js
@@ -0,0 +1,32 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Negative `start` index is relative to [[ArrayBufferByteLength]].
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer]
+---*/
+
+var arrayBuffer = new SharedArrayBuffer(8);
+
+var start = -5,
+  end = 6;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 3, "slice(-5, 6)");
+
+var start = -12,
+  end = 6;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 6, "slice(-12, 6)");
+
+var start = -Infinity,
+  end = 6;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 6, "slice(-Infinity, 6)");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/nonconstructor.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/nonconstructor.js
new file mode 100644
index 0000000000..a4c32ebea2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/nonconstructor.js
@@ -0,0 +1,27 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  SharedArrayBuffer.prototype.slice is not a constructor function.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+  17 ECMAScript Standard Built-in Objects:
+    Built-in function objects that are not identified as constructors do not
+    implement the [[Construct]] internal method unless otherwise specified
+    in the description of a particular function.
+includes: [isConstructor.js]
+features: [SharedArrayBuffer, Reflect.construct]
+---*/
+
+assert(!isConstructor(SharedArrayBuffer.prototype.slice), "SharedArrayBuffer.prototype.slice is not a constructor");
+
+var arrayBuffer = new SharedArrayBuffer(8);
+assert.throws(TypeError, function() {
+  new arrayBuffer.slice();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/not-a-constructor.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/not-a-constructor.js
new file mode 100644
index 0000000000..49713162b8
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/not-a-constructor.js
@@ -0,0 +1,36 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2020 Rick Waldron. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-ecmascript-standard-built-in-objects
+description: >
+  SharedArrayBuffer.prototype.slice does not implement [[Construct]], is not new-able
+info: |
+  ECMAScript Function Objects
+
+  Built-in function objects that are not identified as constructors do not
+  implement the [[Construct]] internal method unless otherwise specified in
+  the description of a particular function.
+
+  sec-evaluatenew
+
+  ...
+  7. If IsConstructor(constructor) is false, throw a TypeError exception.
+  ...
+includes: [isConstructor.js]
+features: [Reflect.construct, SharedArrayBuffer, arrow-function]
+---*/
+
+assert.sameValue(
+  isConstructor(SharedArrayBuffer.prototype.slice),
+  false,
+  'isConstructor(SharedArrayBuffer.prototype.slice) must return false'
+);
+
+assert.throws(TypeError, () => {
+  let sab = new SharedArrayBuffer(1); new sab.slice();
+}, '`let sab = new SharedArrayBuffer(1); new sab.slice()` throws TypeError');
+
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/number-conversion.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/number-conversion.js
new file mode 100644
index 0000000000..6882f49f2f
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/number-conversion.js
@@ -0,0 +1,34 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  ToInteger(start) is called before ToInteger(end).
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer]
+---*/
+
+var arrayBuffer = new SharedArrayBuffer(8);
+
+var log = "";
+var start = {
+  valueOf: function() {
+    log += "start-";
+    return 0;
+  }
+};
+var end = {
+  valueOf: function() {
+    log += "end";
+    return 8;
+  }
+};
+
+arrayBuffer.slice(start, end);
+assert.sameValue(log, "start-end");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/shell.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/shell.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/shell.js
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-constructor-is-not-object.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-constructor-is-not-object.js
new file mode 100644
index 0000000000..cf1dc0d9eb
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-constructor-is-not-object.js
@@ -0,0 +1,36 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Throws TypeError if `constructor` property is not an object.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer, Symbol]
+---*/
+
+var arrayBuffer = new SharedArrayBuffer(8);
+
+function callSlice() {
+  arrayBuffer.slice();
+}
+
+arrayBuffer.constructor = null;
+assert.throws(TypeError, callSlice, "`constructor` value is null");
+
+arrayBuffer.constructor = true;
+assert.throws(TypeError, callSlice, "`constructor` value is Boolean");
+
+arrayBuffer.constructor = "";
+assert.throws(TypeError, callSlice, "`constructor` value is String");
+
+arrayBuffer.constructor = Symbol();
+assert.throws(TypeError, callSlice, "`constructor` value is Symbol");
+
+arrayBuffer.constructor = 1;
+assert.throws(TypeError, callSlice, "`constructor` value is Number");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-constructor-is-undefined.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-constructor-is-undefined.js
new file mode 100644
index 0000000000..1192bdcd6f
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-constructor-is-undefined.js
@@ -0,0 +1,20 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Uses default constructor is `constructor` property is undefined.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+features: [SharedArrayBuffer]
+---*/
+
+var arrayBuffer = new SharedArrayBuffer(8);
+arrayBuffer.constructor = undefined;
+
+var result = arrayBuffer.slice();
+assert.sameValue(Object.getPrototypeOf(result), SharedArrayBuffer.prototype);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-is-not-constructor.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-is-not-constructor.js
new file mode 100644
index 0000000000..ada1f4d270
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-is-not-constructor.js
@@ -0,0 +1,30 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Throws a TypeError if species constructor is not a constructor function.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer, Symbol.species]
+---*/
+
+var speciesConstructor = {};
+
+var arrayBuffer = new SharedArrayBuffer(8);
+arrayBuffer.constructor = speciesConstructor;
+
+function callSlice() {
+  arrayBuffer.slice();
+}
+
+speciesConstructor[Symbol.species] = {};
+assert.throws(TypeError, callSlice, "`constructor[Symbol.species]` value is Object");
+
+speciesConstructor[Symbol.species] = Function.prototype;
+assert.throws(TypeError, callSlice, "`constructor[Symbol.species]` value is Function.prototype");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-is-not-object.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-is-not-object.js
new file mode 100644
index 0000000000..559c5c8eb3
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-is-not-object.js
@@ -0,0 +1,36 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Throws a TypeError if species constructor is not an object.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer, Symbol.species]
+---*/
+
+var speciesConstructor = {};
+
+var arrayBuffer = new SharedArrayBuffer(8);
+arrayBuffer.constructor = speciesConstructor;
+
+function callSlice() {
+  arrayBuffer.slice();
+}
+
+speciesConstructor[Symbol.species] = true;
+assert.throws(TypeError, callSlice, "`constructor[Symbol.species]` value is Boolean");
+
+speciesConstructor[Symbol.species] = "";
+assert.throws(TypeError, callSlice, "`constructor[Symbol.species]` value is String");
+
+speciesConstructor[Symbol.species] = Symbol();
+assert.throws(TypeError, callSlice, "`constructor[Symbol.species]` value is Symbol");
+
+speciesConstructor[Symbol.species] = 1;
+assert.throws(TypeError, callSlice, "`constructor[Symbol.species]` value is Number");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-is-null.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-is-null.js
new file mode 100644
index 0000000000..5cfc458fe2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-is-null.js
@@ -0,0 +1,24 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Uses default constructor is species constructor is null.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer, Symbol.species]
+---*/
+
+var speciesConstructor = {};
+speciesConstructor[Symbol.species] = null;
+
+var arrayBuffer = new SharedArrayBuffer(8);
+arrayBuffer.constructor = speciesConstructor;
+
+var result = arrayBuffer.slice();
+assert.sameValue(Object.getPrototypeOf(result), SharedArrayBuffer.prototype);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-is-undefined.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-is-undefined.js
new file mode 100644
index 0000000000..022787b1f5
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-is-undefined.js
@@ -0,0 +1,24 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Uses default constructor is species constructor is undefined.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer, Symbol.species]
+---*/
+
+var speciesConstructor = {};
+speciesConstructor[Symbol.species] = undefined;
+
+var arrayBuffer = new SharedArrayBuffer(8);
+arrayBuffer.constructor = speciesConstructor;
+
+var result = arrayBuffer.slice();
+assert.sameValue(Object.getPrototypeOf(result), SharedArrayBuffer.prototype);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-returns-larger-arraybuffer.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-returns-larger-arraybuffer.js
new file mode 100644
index 0000000000..3a08654715
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-returns-larger-arraybuffer.js
@@ -0,0 +1,26 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Does not throw TypeError if new SharedArrayBuffer is too large.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer, Symbol.species]
+---*/
+
+var speciesConstructor = {};
+speciesConstructor[Symbol.species] = function(length) {
+  return new SharedArrayBuffer(10);
+};
+
+var arrayBuffer = new SharedArrayBuffer(8);
+arrayBuffer.constructor = speciesConstructor;
+
+var result = arrayBuffer.slice();
+assert.sameValue(result.byteLength, 10);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-returns-not-arraybuffer.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-returns-not-arraybuffer.js
new file mode 100644
index 0000000000..4e979ddbff
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-returns-not-arraybuffer.js
@@ -0,0 +1,27 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Throws a TypeError if new object is not an SharedArrayBuffer instance.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer, Symbol.species]
+---*/
+
+var speciesConstructor = {};
+speciesConstructor[Symbol.species] = function(length) {
+  return {};
+};
+
+var arrayBuffer = new SharedArrayBuffer(8);
+arrayBuffer.constructor = speciesConstructor;
+
+assert.throws(TypeError, function() {
+  arrayBuffer.slice();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-returns-same-arraybuffer.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-returns-same-arraybuffer.js
new file mode 100644
index 0000000000..8a95e32219
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-returns-same-arraybuffer.js
@@ -0,0 +1,27 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Throws a TypeError if species constructor returns `this` value.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer, Symbol.species]
+---*/
+
+var speciesConstructor = {};
+speciesConstructor[Symbol.species] = function(length) {
+  return arrayBuffer;
+};
+
+var arrayBuffer = new SharedArrayBuffer(8);
+arrayBuffer.constructor = speciesConstructor;
+
+assert.throws(TypeError, function() {
+  arrayBuffer.slice();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-returns-smaller-arraybuffer.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-returns-smaller-arraybuffer.js
new file mode 100644
index 0000000000..3ad6af8903
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species-returns-smaller-arraybuffer.js
@@ -0,0 +1,27 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Throws a TypeError if new SharedArrayBuffer is too small.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer, Symbol.species]
+---*/
+
+var speciesConstructor = {};
+speciesConstructor[Symbol.species] = function(length) {
+  return new SharedArrayBuffer(4);
+};
+
+var arrayBuffer = new SharedArrayBuffer(8);
+arrayBuffer.constructor = speciesConstructor;
+
+assert.throws(TypeError, function() {
+  arrayBuffer.slice();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species.js
new file mode 100644
index 0000000000..6bda23c55b
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/species.js
@@ -0,0 +1,28 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  New SharedArrayBuffer instance is created from SpeciesConstructor.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer, Symbol.species]
+---*/
+
+var resultBuffer;
+
+var speciesConstructor = {};
+speciesConstructor[Symbol.species] = function(length) {
+  return resultBuffer = new SharedArrayBuffer(length);
+};
+
+var arrayBuffer = new SharedArrayBuffer(8);
+arrayBuffer.constructor = speciesConstructor;
+
+var result = arrayBuffer.slice();
+assert.sameValue(result, resultBuffer);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/start-default-if-absent.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/start-default-if-absent.js
new file mode 100644
index 0000000000..e559667926
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/start-default-if-absent.js
@@ -0,0 +1,20 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  The `start` index defaults to 0 if absent.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer]
+---*/
+
+var arrayBuffer = new SharedArrayBuffer(8);
+
+var result = arrayBuffer.slice();
+assert.sameValue(result.byteLength, 8);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/start-default-if-undefined.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/start-default-if-undefined.js
new file mode 100644
index 0000000000..7ffa5a541f
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/start-default-if-undefined.js
@@ -0,0 +1,21 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  The `start` index defaults to 0 if undefined.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+features: [SharedArrayBuffer]
+---*/
+
+var arrayBuffer = new SharedArrayBuffer(8);
+
+var start = undefined,
+  end = 6;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 6);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/start-exceeds-end.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/start-exceeds-end.js
new file mode 100644
index 0000000000..533d4efc9a
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/start-exceeds-end.js
@@ -0,0 +1,22 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Returns zero-length buffer if `start` index exceeds `end` index.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+
+features: [SharedArrayBuffer]
+---*/
+
+var arrayBuffer = new SharedArrayBuffer(8);
+
+var start = 5,
+  end = 4;
+var result = arrayBuffer.slice(start, end);
+assert.sameValue(result.byteLength, 0);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/start-exceeds-length.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/start-exceeds-length.js
new file mode 100644
index 0000000000..30b3e9ece3
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/start-exceeds-length.js
@@ -0,0 +1,26 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Large `start` index is clamped to [[ArrayBufferByteLength]].
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+features: [SharedArrayBuffer]
+---*/
+
+var arrayBuffer = new SharedArrayBuffer(8);
+var result;
+
+result = arrayBuffer.slice(10, 8);
+assert.sameValue(result.byteLength, 0, "slice(10, 8)");
+
+result = arrayBuffer.slice(0x100000000, 7);
+assert.sameValue(result.byteLength, 0, "slice(0x100000000, 7)");
+
+result = arrayBuffer.slice(+Infinity, 6);
+assert.sameValue(result.byteLength, 0, "slice(+Infinity, 6)");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/this-is-arraybuffer.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/this-is-arraybuffer.js
new file mode 100644
index 0000000000..ebe64e1ba9
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/this-is-arraybuffer.js
@@ -0,0 +1,17 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-sharedarraybuffer.prototype.slice
+description: >
+  Throws a TypeError if `this` is an ArrayBuffer
+features: [ArrayBuffer, SharedArrayBuffer]
+---*/
+
+assert.throws(TypeError, function() {
+  var ab = new ArrayBuffer(0);
+  SharedArrayBuffer.prototype.slice.call(ab);
+}, "`this` value cannot be an ArrayBuffer");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/tointeger-conversion-end.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/tointeger-conversion-end.js
new file mode 100644
index 0000000000..0f6cf12bd5
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/tointeger-conversion-end.js
@@ -0,0 +1,23 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  The `end` index parameter is converted to an integral numeric value.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+features: [SharedArrayBuffer]
+---*/
+
+var arrayBuffer = new SharedArrayBuffer(8);
+var result;
+
+result = arrayBuffer.slice(0, 4.5);
+assert.sameValue(result.byteLength, 4, "slice(0, 4.5)");
+
+result = arrayBuffer.slice(0, NaN);
+assert.sameValue(result.byteLength, 0, "slice(0, NaN)");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/tointeger-conversion-start.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/tointeger-conversion-start.js
new file mode 100644
index 0000000000..3291405e41
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/prototype/slice/tointeger-conversion-start.js
@@ -0,0 +1,23 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  The `start` index parameter is converted to an integral numeric value.
+info: |
+  SharedArrayBuffer.prototype.slice ( start, end )
+features: [SharedArrayBuffer]
+---*/
+
+var arrayBuffer = new SharedArrayBuffer(8);
+var result;
+
+result = arrayBuffer.slice(4.5, 8);
+assert.sameValue(result.byteLength, 4, "slice(4.5, 8)");
+
+result = arrayBuffer.slice(NaN, 8);
+assert.sameValue(result.byteLength, 8, "slice(NaN, 8)");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/return-abrupt-from-length-symbol.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/return-abrupt-from-length-symbol.js
new file mode 100644
index 0000000000..6ab9ef3291
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/return-abrupt-from-length-symbol.js
@@ -0,0 +1,25 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 The V8 Project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-sharedarraybuffer-length
+description: >
+  Throws a TypeError if length is a symbol
+info: |
+  SharedArrayBuffer( length )
+
+  1. If NewTarget is undefined, throw a TypeError exception.
+  2. Let byteLength be ? ToIndex(length).
+  ...
+features: [SharedArrayBuffer, Symbol]
+---*/
+
+var s = Symbol();
+
+assert.throws(TypeError, function() {
+  new SharedArrayBuffer(s);
+}, "`length` parameter is a Symbol");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/return-abrupt-from-length.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/return-abrupt-from-length.js
new file mode 100644
index 0000000000..031e86c8f0
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/return-abrupt-from-length.js
@@ -0,0 +1,29 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 The V8 Project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-sharedarraybuffer-length
+description: >
+  Return abrupt from ToIndex(length)
+info: |
+  SharedArrayBuffer( length )
+
+  1. If NewTarget is undefined, throw a TypeError exception.
+  2. Let byteLength be ? ToIndex(length).
+  ...
+features: [SharedArrayBuffer]
+---*/
+
+var len = {
+  valueOf: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  new SharedArrayBuffer(len);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/shell.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/shell.js
new file mode 100644
index 0000000000..eda1477282
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/shell.js
@@ -0,0 +1,24 @@
+// GENERATED, DO NOT EDIT
+// file: isConstructor.js
+// Copyright (C) 2017 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: |
+    Test if a given function is a constructor function.
+defines: [isConstructor]
+features: [Reflect.construct]
+---*/
+
+function isConstructor(f) {
+    if (typeof f !== "function") {
+      throw new Test262Error("isConstructor invoked with a non-function value");
+    }
+
+    try {
+        Reflect.construct(function(){}, [], f);
+    } catch (e) {
+        return false;
+    }
+    return true;
+}
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/toindex-length.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/toindex-length.js
new file mode 100644
index 0000000000..6b861c78c4
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/toindex-length.js
@@ -0,0 +1,92 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 The V8 Project authors. All rights reserved.
+// Copyright (C) 2016 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-sharedarraybuffer-length
+description: >
+  The `length` parameter is converted to a value numeric index value.
+info: |
+  SharedArrayBuffer( length )
+
+  1. If NewTarget is undefined, throw a TypeError exception.
+  2. Let byteLength be ? ToIndex(length).
+  3. Return ? AllocateSharedArrayBuffer(NewTarget, byteLength).
+
+  ToIndex( value )
+
+  1. If value is undefined, then
+    a. Let index be 0.
+  2. Else,
+    a. Let integerIndex be ? ToInteger(value).
+    b. If integerIndex < 0, throw a RangeError exception.
+    c. Let index be ! ToLength(integerIndex).
+    d. If SameValueZero(integerIndex, index) is false, throw a RangeError exception.
+  3. Return index.
+features: [SharedArrayBuffer]
+---*/
+
+var obj1 = {
+  valueOf: function() {
+    return 42;
+  }
+};
+
+var obj2 = {
+  toString: function() {
+    return 42;
+  }
+};
+
+var buffer;
+
+buffer = new SharedArrayBuffer(obj1);
+assert.sameValue(buffer.byteLength, 42, "object's valueOf");
+
+buffer = new SharedArrayBuffer(obj2);
+assert.sameValue(buffer.byteLength, 42, "object's toString");
+
+buffer = new SharedArrayBuffer("");
+assert.sameValue(buffer.byteLength, 0, "the Empty string");
+
+buffer = new SharedArrayBuffer("0");
+assert.sameValue(buffer.byteLength, 0, "string '0'");
+
+buffer = new SharedArrayBuffer("1");
+assert.sameValue(buffer.byteLength, 1, "string '1'");
+
+buffer = new SharedArrayBuffer(true);
+assert.sameValue(buffer.byteLength, 1, "true");
+
+buffer = new SharedArrayBuffer(false);
+assert.sameValue(buffer.byteLength, 0, "false");
+
+buffer = new SharedArrayBuffer(NaN);
+assert.sameValue(buffer.byteLength, 0, "NaN");
+
+buffer = new SharedArrayBuffer(null);
+assert.sameValue(buffer.byteLength, 0, "null");
+
+buffer = new SharedArrayBuffer(undefined);
+assert.sameValue(buffer.byteLength, 0, "undefined");
+
+buffer = new SharedArrayBuffer(0.1);
+assert.sameValue(buffer.byteLength, 0, "0.1");
+
+buffer = new SharedArrayBuffer(0.9);
+assert.sameValue(buffer.byteLength, 0, "0.9");
+
+buffer = new SharedArrayBuffer(1.1);
+assert.sameValue(buffer.byteLength, 1, "1.1");
+
+buffer = new SharedArrayBuffer(1.9);
+assert.sameValue(buffer.byteLength, 1, "1.9");
+
+buffer = new SharedArrayBuffer(-0.1);
+assert.sameValue(buffer.byteLength, 0, "-0.1");
+
+buffer = new SharedArrayBuffer(-0.99999);
+assert.sameValue(buffer.byteLength, 0, "-0.99999");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/undefined-newtarget-throws.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/undefined-newtarget-throws.js
new file mode 100644
index 0000000000..666f23bc49
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/undefined-newtarget-throws.js
@@ -0,0 +1,28 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-sharedarraybuffer-length
+description: >
+  Throws a TypeError if SharedArrayBuffer is called as a function.
+info: |
+  SharedArrayBuffer( length )
+
+  SharedArrayBuffer called with argument length performs the following steps:
+
+  1. If NewTarget is undefined, throw a TypeError exception.
+  ...
+features: [SharedArrayBuffer]
+---*/
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer();
+});
+
+assert.throws(TypeError, function() {
+  SharedArrayBuffer(10);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/SharedArrayBuffer/zero-length.js b/js/src/tests/test262/built-ins/SharedArrayBuffer/zero-length.js
new file mode 100644
index 0000000000..7d36e21369
--- /dev/null
+++ b/js/src/tests/test262/built-ins/SharedArrayBuffer/zero-length.js
@@ -0,0 +1,28 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-sharedarraybuffer-length
+description: >
+  The `length` parameter can be zero.
+info: |
+  SharedArrayBuffer( length )
+
+  ...
+  2. Let numberLength be ToNumber(length).
+  3. Let byteLength be ToLength(numberLength).
+  4. ReturnIfAbrupt(byteLength).
+  5. If SameValueZero(numberLength, byteLength) is false, throw a RangeError exception.
+  ...
+features: [SharedArrayBuffer]
+---*/
+
+var positiveZero = new SharedArrayBuffer(+0);
+assert.sameValue(positiveZero.byteLength, 0);
+
+var negativeZero = new SharedArrayBuffer(-0);
+assert.sameValue(negativeZero.byteLength, 0);
+
+reportCompare(0, 0);