Adding upstream version 124.0.1.upstream/124.0.1

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

52 files changed, 2428 insertions, 0 deletions

diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/browser.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/browser.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/browser.js
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/coerced-indexes.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/coerced-indexes.js
new file mode 100644
index 0000000000..f7ba55c725
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/coerced-indexes.js
@@ -0,0 +1,106 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Fills elements from coerced to Integer `start` and `end` values
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  %TypedArray%.prototype.fill is a distinct function that implements the same
+  algorithm as Array.prototype.fill as defined in 22.1.3.6 except that the this
+  object's [[ArrayLength]] internal slot is accessed in place of performing a
+  [[Get]] of "length". The implementation of the algorithm may be optimized with
+  the knowledge that the this value is an object that has a fixed length and
+  whose integer indexed properties are not sparse. However, such optimization
+  must not introduce any observable changes in the specified behaviour of the
+  algorithm.
+
+  ...
+
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  3. Let relativeStart be ? ToInteger(start).
+  4. If relativeStart < 0, let k be max((len + relativeStart), 0); else let k be
+  min(relativeStart, len).
+  5. If end is undefined, let relativeEnd be len; else let relativeEnd be ?
+  ToInteger(end).
+  ...
+includes: [compareArray.js, testBigIntTypedArray.js]
+features: [BigInt, TypedArray]
+---*/
+
+testWithBigIntTypedArrayConstructors(function(TA) {
+  assert(
+    compareArray(new TA([0n, 0n]).fill(1n, undefined), [1n, 1n]),
+    '`undefined` start coerced to 0'
+  );
+
+  assert(
+    compareArray(new TA([0n, 0n]).fill(1n, 0, undefined), [1n, 1n]),
+    'If end is undefined, let relativeEnd be len'
+  );
+
+  assert(
+    compareArray(new TA([0n, 0n]).fill(1n, null), [1n, 1n]),
+    '`null` start coerced to 0'
+  );
+
+  assert(
+    compareArray(new TA([0n, 0n]).fill(1n, 0, null), [0n, 0n]),
+    '`null` end coerced to 0'
+  );
+
+  assert(
+    compareArray(new TA([0n, 0n]).fill(1n, true), [0n, 1n]),
+    '`true` start coerced to 1'
+  );
+
+  assert(
+    compareArray(new TA([0n, 0n]).fill(1n, 0, true), [1n, 0n]),
+    '`true` end coerced to 1'
+  );
+
+  assert(
+    compareArray(new TA([0n, 0n]).fill(1n, false), [1n, 1n]),
+    '`false` start coerced to 0'
+  );
+
+  assert(
+    compareArray(new TA([0n, 0n]).fill(1n, 0, false), [0n, 0n]),
+    '`false` end coerced to 0'
+  );
+
+  assert(
+    compareArray(new TA([0n, 0n]).fill(1n, NaN), [1n, 1n]),
+    '`NaN` start coerced to 0'
+  );
+
+  assert(
+    compareArray(new TA([0n, 0n]).fill(1n, 0, NaN), [0n, 0n]),
+    '`NaN` end coerced to 0'
+  );
+
+  assert(
+    compareArray(new TA([0n, 0n]).fill(1n, '1'), [0n, 1n]),
+    'string start coerced'
+  );
+
+  assert(
+    compareArray(new TA([0n, 0n]).fill(1n, 0, '1'), [1n, 0n]),
+    'string end coerced'
+  );
+
+  assert(
+    compareArray(new TA([0n, 0n]).fill(1n, 1.5), [0n, 1n]),
+    'start as a float number coerced'
+  );
+
+  assert(
+    compareArray(new TA([0n, 0n]).fill(1n, 0, 1.5), [1n, 0n]),
+    'end as a float number coerced'
+  );
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/detached-buffer.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/detached-buffer.js
new file mode 100644
index 0000000000..0da0298fd6
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/detached-buffer.js
@@ -0,0 +1,36 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: Throws a TypeError if this has a detached buffer
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  This function is not generic. ValidateTypedArray is applied to the this value
+  prior to evaluating the algorithm. If its result is an abrupt completion that
+  exception is thrown instead of evaluating the algorithm.
+
+  22.2.3.5.1 Runtime Semantics: ValidateTypedArray ( O )
+
+  ...
+  5. If IsDetachedBuffer(buffer) is true, throw a TypeError exception.
+  ...
+includes: [testBigIntTypedArray.js, detachArrayBuffer.js]
+features: [BigInt, TypedArray]
+---*/
+
+var obj = {
+  valueOf: function() {
+    throw new Test262Error();
+  }
+};
+
+testWithBigIntTypedArrayConstructors(function(TA) {
+  var sample = new TA(1);
+  $DETACHBUFFER(sample.buffer);
+  assert.throws(TypeError, function() {
+    sample.fill(obj);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/fill-values-conversion-once.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/fill-values-conversion-once.js
new file mode 100644
index 0000000000..5a7302c362
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/fill-values-conversion-once.js
@@ -0,0 +1,30 @@
+// Copyright (C) 2017 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Fills all the elements with non numeric values values.
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  3. If O.[[TypedArrayName]] is "BigUint64Array" or "BigInt64Array",
+     let value be ? ToBigInt(value).
+  ...
+includes: [testBigIntTypedArray.js]
+features: [BigInt, TypedArray]
+---*/
+
+testWithBigIntTypedArrayConstructors(function(TA) {
+  var sample = new TA(2);
+
+  var n = 1n;
+  sample.fill({ valueOf() { return n++; } });
+
+  assert.sameValue(n, 2n, "additional unexpected ToBigInt() calls");
+  assert.sameValue(sample[0], 1n, "incorrect ToNumber result in index 0");
+  assert.sameValue(sample[1], 1n, "incorrect ToNumber result in index 1");
+});
+
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/fill-values-custom-start-and-end.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/fill-values-custom-start-and-end.js
new file mode 100644
index 0000000000..012c31fc29
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/fill-values-custom-start-and-end.js
@@ -0,0 +1,44 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Fills all the elements from a with a custom start and end indexes.
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  %TypedArray%.prototype.fill is a distinct function that implements the same
+  algorithm as Array.prototype.fill as defined in 22.1.3.6 except that the this
+  object's [[ArrayLength]] internal slot is accessed in place of performing a
+  [[Get]] of "length". The implementation of the algorithm may be optimized with
+  the knowledge that the this value is an object that has a fixed length and
+  whose integer indexed properties are not sparse. However, such optimization
+  must not introduce any observable changes in the specified behaviour of the
+  algorithm.
+
+  ...
+
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  3. Let relativeStart be ? ToInteger(start).
+  4. If relativeStart < 0, let k be max((len + relativeStart), 0); else let k be
+  min(relativeStart, len).
+  5. If end is undefined, let relativeEnd be len; else let relativeEnd be ?
+  ToInteger(end).
+  6. If relativeEnd < 0, let final be max((len + relativeEnd), 0); else let
+  final be min(relativeEnd, len).
+  ...
+includes: [compareArray.js, testBigIntTypedArray.js]
+features: [BigInt, TypedArray]
+---*/
+
+testWithBigIntTypedArrayConstructors(function(TA) {
+  assert(compareArray(new TA([0n, 0n, 0n]).fill(8n, 1, 2), [0n, 8n, 0n]));
+  assert(compareArray(new TA([0n, 0n, 0n, 0n, 0n]).fill(8n, -3, 4), [0n, 0n, 8n, 8n, 0n]));
+  assert(compareArray(new TA([0n, 0n, 0n, 0n, 0n]).fill(8n, -2, -1), [0n, 0n, 0n, 8n, 0n]));
+  assert(compareArray(new TA([0n, 0n, 0n, 0n, 0n]).fill(8n, -1, -3), [0n, 0n, 0n, 0n, 0n]));
+  assert(compareArray(new TA([0n, 0n, 0n, 0n, 0n]).fill(8n, 1, 3), [0n, 8n, 8n, 0n, 0n]));
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/fill-values-non-numeric-throw.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/fill-values-non-numeric-throw.js
new file mode 100644
index 0000000000..a50c36f53f
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/fill-values-non-numeric-throw.js
@@ -0,0 +1,69 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Fills all the elements with non numeric values values.
+info: |
+  %TypedArray%.prototype.fill ( value [ , start [ , end ] ] )
+
+  Let O be the this value.
+  Perform ? ValidateTypedArray(O).
+  Let len be O.[[ArrayLength]].
+  If O.[[ContentType]] is BigInt, set value to ? ToBigInt(value).
+  Otherwise, set value to ? ToNumber(value).
+  Let relativeStart be ? ToIntegerOrInfinity(start).
+  If relativeStart is -Infinity, let k be 0.
+  Else if relativeStart < 0, let k be max(len + relativeStart, 0).
+  Else, let k be min(relativeStart, len).
+  If end is undefined, let relativeEnd be len; else let relativeEnd be ? ToIntegerOrInfinity(end).
+  If relativeEnd is -Infinity, let final be 0.
+  Else if relativeEnd < 0, let final be max(len + relativeEnd, 0).
+  Else, let final be min(relativeEnd, len).
+  If IsDetachedBuffer(O.[[ViewedArrayBuffer]]) is true, throw a TypeError exception.
+  Repeat, while k < final,
+    Let Pk be ! ToString(F(k)).
+    Perform ! Set(O, Pk, value, true).
+    Set k to k + 1.
+  Return O.
+
+  IntegerIndexedElementSet ( O, index, value )
+
+  Assert: O is an Integer-Indexed exotic object.
+  If O.[[ContentType]] is BigInt, let numValue be ? ToBigInt(value).
+  Otherwise, let numValue be ? ToNumber(value).
+  Let buffer be O.[[ViewedArrayBuffer]].
+  If IsDetachedBuffer(buffer) is false and ! IsValidIntegerIndex(O, index) is true, then
+    Let offset be O.[[ByteOffset]].
+    Let arrayTypeName be the String value of O.[[TypedArrayName]].
+    Let elementSize be the Element Size value specified in Table 62 for arrayTypeName.
+    Let indexedPosition be (ℝ(index) × elementSize) + offset.
+    Let elementType be the Element Type value in Table 62 for arrayTypeName.
+    Perform SetValueInBuffer(buffer, indexedPosition, elementType, numValue, true, Unordered).
+  Return NormalCompletion(undefined).
+
+
+includes: [testBigIntTypedArray.js]
+features: [BigInt, TypedArray]
+---*/
+
+testWithBigIntTypedArrayConstructors(function(TA) {
+  var sample;
+
+  sample = new TA([42n]);
+
+  assert.throws(TypeError, function() {
+    sample.fill(undefined);
+  }, "abrupt completion from undefined");
+
+  assert.throws(TypeError, function() {
+    sample.fill(null);
+  }, "abrupt completion from null");
+
+  assert.throws(SyntaxError, function() {
+    sample.fill("nonsense");
+  }, "abrupt completion from string");
+
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/fill-values-non-numeric.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/fill-values-non-numeric.js
new file mode 100644
index 0000000000..7033d70ba7
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/fill-values-non-numeric.js
@@ -0,0 +1,85 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Fills all the elements with non numeric values values.
+info: |
+  %TypedArray%.prototype.fill ( value [ , start [ , end ] ] )
+
+  Let O be the this value.
+  Perform ? ValidateTypedArray(O).
+  Let len be O.[[ArrayLength]].
+  If O.[[ContentType]] is BigInt, set value to ? ToBigInt(value).
+  Otherwise, set value to ? ToNumber(value).
+  Let relativeStart be ? ToIntegerOrInfinity(start).
+  If relativeStart is -Infinity, let k be 0.
+  Else if relativeStart < 0, let k be max(len + relativeStart, 0).
+  Else, let k be min(relativeStart, len).
+  If end is undefined, let relativeEnd be len; else let relativeEnd be ? ToIntegerOrInfinity(end).
+  If relativeEnd is -Infinity, let final be 0.
+  Else if relativeEnd < 0, let final be max(len + relativeEnd, 0).
+  Else, let final be min(relativeEnd, len).
+  If IsDetachedBuffer(O.[[ViewedArrayBuffer]]) is true, throw a TypeError exception.
+  Repeat, while k < final,
+    Let Pk be ! ToString(F(k)).
+    Perform ! Set(O, Pk, value, true).
+    Set k to k + 1.
+  Return O.
+
+  IntegerIndexedElementSet ( O, index, value )
+
+  Assert: O is an Integer-Indexed exotic object.
+  If O.[[ContentType]] is BigInt, let numValue be ? ToBigInt(value).
+  Otherwise, let numValue be ? ToNumber(value).
+  Let buffer be O.[[ViewedArrayBuffer]].
+  If IsDetachedBuffer(buffer) is false and ! IsValidIntegerIndex(O, index) is true, then
+    Let offset be O.[[ByteOffset]].
+    Let arrayTypeName be the String value of O.[[TypedArrayName]].
+    Let elementSize be the Element Size value specified in Table 62 for arrayTypeName.
+    Let indexedPosition be (ℝ(index) × elementSize) + offset.
+    Let elementType be the Element Type value in Table 62 for arrayTypeName.
+    Perform SetValueInBuffer(buffer, indexedPosition, elementType, numValue, true, Unordered).
+  Return NormalCompletion(undefined).
+
+includes: [testBigIntTypedArray.js]
+features: [BigInt, TypedArray]
+---*/
+
+testWithBigIntTypedArrayConstructors(function(TA) {
+  var sample;
+
+  sample = new TA([42n]);
+  sample.fill(false);
+  assert.sameValue(sample[0], 0n, "false => 0");
+
+  sample = new TA([42n]);
+  sample.fill(true);
+  assert.sameValue(sample[0], 1n, "true => 1");
+
+  sample = new TA([42n]);
+  sample.fill("7");
+  assert.sameValue(sample[0], 7n, "string conversion");
+
+  sample = new TA([42n]);
+  sample.fill({
+    toString: function() {
+      return "1";
+    },
+    valueOf: function() {
+      return 7n;
+    }
+  });
+  assert.sameValue(sample[0], 7n, "object valueOf conversion before toString");
+
+  sample = new TA([42n]);
+  sample.fill({
+    toString: function() {
+      return "7";
+    }
+  });
+  assert.sameValue(sample[0], 7n, "object toString when valueOf is absent");
+
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/fill-values-relative-end.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/fill-values-relative-end.js
new file mode 100644
index 0000000000..00c0cee49f
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/fill-values-relative-end.js
@@ -0,0 +1,55 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Fills all the elements from a with a custom end index.
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  %TypedArray%.prototype.fill is a distinct function that implements the same
+  algorithm as Array.prototype.fill as defined in 22.1.3.6 except that the this
+  object's [[ArrayLength]] internal slot is accessed in place of performing a
+  [[Get]] of "length". The implementation of the algorithm may be optimized with
+  the knowledge that the this value is an object that has a fixed length and
+  whose integer indexed properties are not sparse. However, such optimization
+  must not introduce any observable changes in the specified behaviour of the
+  algorithm.
+
+  ...
+
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  5. If end is undefined, let relativeEnd be len; else let relativeEnd be ?
+  ToInteger(end).
+  6. If relativeEnd < 0, let final be max((len + relativeEnd), 0); else let
+  final be min(relativeEnd, len).
+  ...
+includes: [compareArray.js, testBigIntTypedArray.js]
+features: [BigInt, TypedArray]
+---*/
+
+testWithBigIntTypedArrayConstructors(function(TA) {
+  assert(
+    compareArray(new TA([0n, 0n, 0n]).fill(8n, 0, 1), [8n, 0n, 0n]),
+    "Fill elements from custom end position"
+  );
+
+  assert(
+    compareArray(new TA([0n, 0n, 0n]).fill(8n, 0, -1), [8n, 8n, 0n]),
+    "negative end sets final position to max((length + relativeEnd), 0)"
+  );
+
+  assert(
+    compareArray(new TA([0n, 0n, 0n]).fill(8n, 0, 5), [8n, 8n, 8n]),
+    "end position is never higher than of length"
+  );
+
+  assert(
+    compareArray(new TA([0n, 0n, 0n]).fill(8n, 0, -4), [0n, 0n, 0n]),
+    "end position is 0 when (len + relativeEnd) < 0"
+  );
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/fill-values-relative-start.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/fill-values-relative-start.js
new file mode 100644
index 0000000000..ec09940a0b
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/fill-values-relative-start.js
@@ -0,0 +1,53 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Fills all the elements from a with a custom start index.
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  %TypedArray%.prototype.fill is a distinct function that implements the same
+  algorithm as Array.prototype.fill as defined in 22.1.3.6 except that the this
+  object's [[ArrayLength]] internal slot is accessed in place of performing a
+  [[Get]] of "length". The implementation of the algorithm may be optimized with
+  the knowledge that the this value is an object that has a fixed length and
+  whose integer indexed properties are not sparse. However, such optimization
+  must not introduce any observable changes in the specified behaviour of the
+  algorithm.
+
+  ...
+
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  4. If relativeStart < 0, let k be max((len + relativeStart), 0); else let k be
+  min(relativeStart, len).
+  ...
+includes: [compareArray.js, testBigIntTypedArray.js]
+features: [BigInt, TypedArray]
+---*/
+
+testWithBigIntTypedArrayConstructors(function(TA) {
+  assert(
+    compareArray(new TA([0n, 0n, 0n]).fill(8n, 1), [0n, 8n, 8n]),
+    "Fill elements from custom start position"
+  );
+
+  assert(
+    compareArray(new TA([0n, 0n, 0n]).fill(8n, 4), [0n, 0n, 0n]),
+    "start position is never higher than length"
+  );
+
+  assert(
+    compareArray(new TA([0n, 0n, 0n]).fill(8n, -1), [0n, 0n, 8n]),
+    "start < 0 sets initial position to max((len + relativeStart), 0)"
+  );
+
+  assert(
+    compareArray(new TA([0n, 0n, 0n]).fill(8n, -5), [8n, 8n, 8n]),
+    "start position is 0 when (len + relativeStart) < 0"
+  );
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/fill-values-symbol-throws.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/fill-values-symbol-throws.js
new file mode 100644
index 0000000000..257b5d7017
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/fill-values-symbol-throws.js
@@ -0,0 +1,60 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Throws a TypeError if value is a Symbol
+info: |
+  %TypedArray%.prototype.fill ( value [ , start [ , end ] ] )
+
+  Let O be the this value.
+  Perform ? ValidateTypedArray(O).
+  Let len be O.[[ArrayLength]].
+  If O.[[ContentType]] is BigInt, set value to ? ToBigInt(value).
+  Otherwise, set value to ? ToNumber(value).
+  Let relativeStart be ? ToIntegerOrInfinity(start).
+  If relativeStart is -Infinity, let k be 0.
+  Else if relativeStart < 0, let k be max(len + relativeStart, 0).
+  Else, let k be min(relativeStart, len).
+  If end is undefined, let relativeEnd be len; else let relativeEnd be ? ToIntegerOrInfinity(end).
+  If relativeEnd is -Infinity, let final be 0.
+  Else if relativeEnd < 0, let final be max(len + relativeEnd, 0).
+  Else, let final be min(relativeEnd, len).
+  If IsDetachedBuffer(O.[[ViewedArrayBuffer]]) is true, throw a TypeError exception.
+  Repeat, while k < final,
+    Let Pk be ! ToString(F(k)).
+    Perform ! Set(O, Pk, value, true).
+    Set k to k + 1.
+  Return O.
+
+  IntegerIndexedElementSet ( O, index, value )
+
+  Assert: O is an Integer-Indexed exotic object.
+  If O.[[ContentType]] is BigInt, let numValue be ? ToBigInt(value).
+  Otherwise, let numValue be ? ToNumber(value).
+  Let buffer be O.[[ViewedArrayBuffer]].
+  If IsDetachedBuffer(buffer) is false and ! IsValidIntegerIndex(O, index) is true, then
+    Let offset be O.[[ByteOffset]].
+    Let arrayTypeName be the String value of O.[[TypedArrayName]].
+    Let elementSize be the Element Size value specified in Table 62 for arrayTypeName.
+    Let indexedPosition be (ℝ(index) × elementSize) + offset.
+    Let elementType be the Element Type value in Table 62 for arrayTypeName.
+    Perform SetValueInBuffer(buffer, indexedPosition, elementType, numValue, true, Unordered).
+  Return NormalCompletion(undefined).
+
+
+includes: [testBigIntTypedArray.js]
+features: [BigInt, Symbol, TypedArray]
+---*/
+
+var s = Symbol('1');
+
+testWithBigIntTypedArrayConstructors(function(TA) {
+  var sample = new TA(1);
+
+  assert.throws(TypeError, function() {
+    sample.fill(s);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/fill-values.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/fill-values.js
new file mode 100644
index 0000000000..96cde20493
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/fill-values.js
@@ -0,0 +1,46 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Fills all the elements with `value` from a default start and index.
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  %TypedArray%.prototype.fill is a distinct function that implements the same
+  algorithm as Array.prototype.fill as defined in 22.1.3.6 except that the this
+  object's [[ArrayLength]] internal slot is accessed in place of performing a
+  [[Get]] of "length". The implementation of the algorithm may be optimized with
+  the knowledge that the this value is an object that has a fixed length and
+  whose integer indexed properties are not sparse. However, such optimization
+  must not introduce any observable changes in the specified behaviour of the
+  algorithm.
+
+  ...
+
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  7. Repeat, while k < final
+    a. Let Pk be ! ToString(k).
+    b. Perform ? Set(O, Pk, value, true).
+includes: [compareArray.js, testBigIntTypedArray.js]
+features: [BigInt, TypedArray]
+---*/
+
+testWithBigIntTypedArrayConstructors(function(TA) {
+  assert(
+    compareArray(
+      new TA().fill(8n),
+      []
+    ),
+    "does not fill an empty instance"
+  );
+
+  assert(
+    compareArray(new TA([0n, 0n, 0n]).fill(8n), [8n, 8n, 8n]),
+    "Default start and end indexes are 0 and this.length"
+  );
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/get-length-ignores-length-prop.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/get-length-ignores-length-prop.js
new file mode 100644
index 0000000000..dec320a415
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/get-length-ignores-length-prop.js
@@ -0,0 +1,53 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Unreachable abrupt from Get(O, "length") as [[ArrayLength]] is returned.
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  %TypedArray%.prototype.fill is a distinct function that implements the same
+  algorithm as Array.prototype.fill as defined in 22.1.3.6 except that the this
+  object's [[ArrayLength]] internal slot is accessed in place of performing a
+  [[Get]] of "length". The implementation of the algorithm may be optimized with
+  the knowledge that the this value is an object that has a fixed length and
+  whose integer indexed properties are not sparse. However, such optimization
+  must not introduce any observable changes in the specified behaviour of the
+  algorithm.
+
+  ...
+
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  1. Let O be ? ToObject(this value).
+  2. Let len be ? ToLength(? Get(O, "length")).
+  ...
+includes: [testBigIntTypedArray.js]
+features: [BigInt, TypedArray]
+---*/
+
+Object.defineProperty(TypedArray.prototype, "length", {
+  get: function() {
+    throw new Test262Error();
+  }
+});
+
+testWithBigIntTypedArrayConstructors(function(TA) {
+  Object.defineProperty(TA.prototype, "length", {
+    get: function() {
+      throw new Test262Error();
+    }
+  });
+
+  var sample = new TA(1);
+  Object.defineProperty(sample, "length", {
+    get: function() {
+      throw new Test262Error();
+    }
+  });
+
+  assert.sameValue(sample.fill(1n, 0), sample);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/return-abrupt-from-end-as-symbol.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/return-abrupt-from-end-as-symbol.js
new file mode 100644
index 0000000000..6dac568fb4
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/return-abrupt-from-end-as-symbol.js
@@ -0,0 +1,40 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Return abrupt if end is a Symbol.
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  %TypedArray%.prototype.fill is a distinct function that implements the same
+  algorithm as Array.prototype.fill as defined in 22.1.3.6 except that the this
+  object's [[ArrayLength]] internal slot is accessed in place of performing a
+  [[Get]] of "length". The implementation of the algorithm may be optimized with
+  the knowledge that the this value is an object that has a fixed length and
+  whose integer indexed properties are not sparse. However, such optimization
+  must not introduce any observable changes in the specified behaviour of the
+  algorithm.
+
+  ...
+
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  5. If end is undefined, let relativeEnd be len; else let relativeEnd be ?
+  ToInteger(end).
+  ...
+includes: [testBigIntTypedArray.js]
+features: [BigInt, Symbol, TypedArray]
+---*/
+
+var end = Symbol(1);
+
+testWithBigIntTypedArrayConstructors(function(TA) {
+  var sample = new TA();
+  assert.throws(TypeError, function() {
+    sample.fill(1n, 0, end);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/return-abrupt-from-end.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/return-abrupt-from-end.js
new file mode 100644
index 0000000000..b329771ae3
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/return-abrupt-from-end.js
@@ -0,0 +1,44 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Return abrupt from ToInteger(end).
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  %TypedArray%.prototype.fill is a distinct function that implements the same
+  algorithm as Array.prototype.fill as defined in 22.1.3.6 except that the this
+  object's [[ArrayLength]] internal slot is accessed in place of performing a
+  [[Get]] of "length". The implementation of the algorithm may be optimized with
+  the knowledge that the this value is an object that has a fixed length and
+  whose integer indexed properties are not sparse. However, such optimization
+  must not introduce any observable changes in the specified behaviour of the
+  algorithm.
+
+  ...
+
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  5. If end is undefined, let relativeEnd be len; else let relativeEnd be ?
+  ToInteger(end).
+  ...
+includes: [testBigIntTypedArray.js]
+features: [BigInt, TypedArray]
+---*/
+
+var end = {
+  valueOf: function() {
+    throw new Test262Error();
+  }
+};
+
+testWithBigIntTypedArrayConstructors(function(TA) {
+  var sample = new TA();
+  assert.throws(Test262Error, function() {
+    sample.fill(1n, 0, end);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/return-abrupt-from-set-value.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/return-abrupt-from-set-value.js
new file mode 100644
index 0000000000..9f46b32318
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/return-abrupt-from-set-value.js
@@ -0,0 +1,63 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Returns abrupt from value set
+info: |
+  %TypedArray%.prototype.fill ( value [ , start [ , end ] ] )
+
+  Let O be the this value.
+  Perform ? ValidateTypedArray(O).
+  Let len be O.[[ArrayLength]].
+  If O.[[ContentType]] is BigInt, set value to ? ToBigInt(value).
+  Otherwise, set value to ? ToNumber(value).
+  Let relativeStart be ? ToIntegerOrInfinity(start).
+  If relativeStart is -Infinity, let k be 0.
+  Else if relativeStart < 0, let k be max(len + relativeStart, 0).
+  Else, let k be min(relativeStart, len).
+  If end is undefined, let relativeEnd be len; else let relativeEnd be ? ToIntegerOrInfinity(end).
+  If relativeEnd is -Infinity, let final be 0.
+  Else if relativeEnd < 0, let final be max(len + relativeEnd, 0).
+  Else, let final be min(relativeEnd, len).
+  If IsDetachedBuffer(O.[[ViewedArrayBuffer]]) is true, throw a TypeError exception.
+  Repeat, while k < final,
+    Let Pk be ! ToString(F(k)).
+    Perform ! Set(O, Pk, value, true).
+    Set k to k + 1.
+  Return O.
+
+  IntegerIndexedElementSet ( O, index, value )
+
+  Assert: O is an Integer-Indexed exotic object.
+  If O.[[ContentType]] is BigInt, let numValue be ? ToBigInt(value).
+  Otherwise, let numValue be ? ToNumber(value).
+  Let buffer be O.[[ViewedArrayBuffer]].
+  If IsDetachedBuffer(buffer) is false and ! IsValidIntegerIndex(O, index) is true, then
+    Let offset be O.[[ByteOffset]].
+    Let arrayTypeName be the String value of O.[[TypedArrayName]].
+    Let elementSize be the Element Size value specified in Table 62 for arrayTypeName.
+    Let indexedPosition be (ℝ(index) × elementSize) + offset.
+    Let elementType be the Element Type value in Table 62 for arrayTypeName.
+    Perform SetValueInBuffer(buffer, indexedPosition, elementType, numValue, true, Unordered).
+  Return NormalCompletion(undefined).
+
+
+includes: [testBigIntTypedArray.js]
+features: [BigInt, TypedArray]
+---*/
+
+testWithBigIntTypedArrayConstructors(function(TA) {
+  var sample = new TA([42n]);
+  var obj = {
+    valueOf: function() {
+      throw new Test262Error();
+    }
+  };
+
+  assert.throws(Test262Error, function() {
+    sample.fill(obj);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/return-abrupt-from-start-as-symbol.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/return-abrupt-from-start-as-symbol.js
new file mode 100644
index 0000000000..c1391a13dc
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/return-abrupt-from-start-as-symbol.js
@@ -0,0 +1,39 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Return abrupt from ToInteger(start) as a Symbol.
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  %TypedArray%.prototype.fill is a distinct function that implements the same
+  algorithm as Array.prototype.fill as defined in 22.1.3.6 except that the this
+  object's [[ArrayLength]] internal slot is accessed in place of performing a
+  [[Get]] of "length". The implementation of the algorithm may be optimized with
+  the knowledge that the this value is an object that has a fixed length and
+  whose integer indexed properties are not sparse. However, such optimization
+  must not introduce any observable changes in the specified behaviour of the
+  algorithm.
+
+  ...
+
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  3. Let relativeStart be ? ToInteger(start).
+  ...
+includes: [testBigIntTypedArray.js]
+features: [BigInt, Symbol, TypedArray]
+---*/
+
+var start = Symbol(1);
+
+testWithBigIntTypedArrayConstructors(function(TA) {
+  var sample = new TA();
+  assert.throws(TypeError, function() {
+    sample.fill(1n, start);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/return-abrupt-from-start.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/return-abrupt-from-start.js
new file mode 100644
index 0000000000..7e9f04c49e
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/return-abrupt-from-start.js
@@ -0,0 +1,43 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Return abrupt from ToInteger(start).
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  %TypedArray%.prototype.fill is a distinct function that implements the same
+  algorithm as Array.prototype.fill as defined in 22.1.3.6 except that the this
+  object's [[ArrayLength]] internal slot is accessed in place of performing a
+  [[Get]] of "length". The implementation of the algorithm may be optimized with
+  the knowledge that the this value is an object that has a fixed length and
+  whose integer indexed properties are not sparse. However, such optimization
+  must not introduce any observable changes in the specified behaviour of the
+  algorithm.
+
+  ...
+
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  3. Let relativeStart be ? ToInteger(start).
+  ...
+includes: [testBigIntTypedArray.js]
+features: [BigInt, TypedArray]
+---*/
+
+var start = {
+  valueOf: function() {
+    throw new Test262Error();
+  }
+};
+
+testWithBigIntTypedArrayConstructors(function(TA) {
+  var sample = new TA();
+  assert.throws(Test262Error, function() {
+    sample.fill(1n, start);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/return-abrupt-from-this-out-of-bounds.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/return-abrupt-from-this-out-of-bounds.js
new file mode 100644
index 0000000000..6d800ebd2d
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/return-abrupt-from-this-out-of-bounds.js
@@ -0,0 +1,62 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: Return abrupt when "this" value fails buffer boundary checks
+includes: [testBigIntTypedArray.js]
+features: [ArrayBuffer, BigInt, TypedArray, arrow-function, resizable-arraybuffer]
+---*/
+
+assert.sameValue(
+  typeof TypedArray.prototype.fill,
+  'function',
+  'implements TypedArray.prototype.fill'
+);
+
+assert.sameValue(
+  typeof ArrayBuffer.prototype.resize,
+  'function',
+  'implements ArrayBuffer.prototype.resize'
+);
+
+testWithBigIntTypedArrayConstructors(TA => {
+  var BPE = TA.BYTES_PER_ELEMENT;
+  var ab = new ArrayBuffer(BPE * 4, {maxByteLength: BPE * 5});
+  var array = new TA(ab, BPE, 2);
+
+  try {
+    ab.resize(BPE * 5);
+  } catch (_) {}
+
+  // no error following grow:
+  array.fill(0n);
+
+  try {
+    ab.resize(BPE * 3);
+  } catch (_) {}
+
+  // no error following shrink (within bounds):
+  array.fill(0n);
+
+  var expectedError;
+  try {
+    ab.resize(BPE * 2);
+    // If the preceding "resize" operation is successful, the typed array will
+    // be out out of bounds, so the subsequent prototype method should produce
+    // a TypeError due to the semantics of ValidateTypedArray.
+    expectedError = TypeError;
+  } catch (_) {
+    // The host is permitted to fail any "resize" operation at its own
+    // discretion. If that occurs, the fill operation should complete
+    // successfully.
+    expectedError = Test262Error;
+  }
+
+  assert.throws(expectedError, () => {
+    array.fill(0n);
+    throw new Test262Error('fill completed successfully');
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/return-this.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/return-this.js
new file mode 100644
index 0000000000..c9ab8f15d7
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/return-this.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Returns `this`.
+includes: [testBigIntTypedArray.js]
+features: [BigInt, TypedArray]
+---*/
+
+testWithBigIntTypedArrayConstructors(function(TA) {
+  var sample1 = new TA();
+  var result1 = sample1.fill(1n);
+
+  assert.sameValue(result1, sample1);
+
+  var sample2 = new TA(42);
+  var result2 = sample2.fill(7n);
+  assert.sameValue(result2, sample2);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/shell.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/shell.js
new file mode 100644
index 0000000000..90ee9c114d
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/BigInt/shell.js
@@ -0,0 +1,42 @@
+// GENERATED, DO NOT EDIT
+// file: testBigIntTypedArray.js
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+description: |
+    Collection of functions used to assert the correctness of BigInt TypedArray objects.
+defines:
+  - TypedArray
+  - testWithBigIntTypedArrayConstructors
+---*/
+
+/**
+ * The %TypedArray% intrinsic constructor function.
+ */
+var TypedArray = Object.getPrototypeOf(Int8Array);
+
+/**
+ * Calls the provided function for every typed array constructor.
+ *
+ * @param {typedArrayConstructorCallback} f - the function to call for each typed array constructor.
+ * @param {Array} selected - An optional Array with filtered typed arrays
+ */
+function testWithBigIntTypedArrayConstructors(f, selected) {
+  /**
+   * Array containing every BigInt typed array constructor.
+   */
+  var constructors = selected || [
+    BigInt64Array,
+    BigUint64Array
+  ];
+
+  for (var i = 0; i < constructors.length; ++i) {
+    var constructor = constructors[i];
+    try {
+      f(constructor);
+    } catch (e) {
+      e.message += " (Testing with " + constructor.name + ".)";
+      throw e;
+    }
+  }
+}
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/browser.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/browser.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/browser.js
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/coerced-end-detach.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/coerced-end-detach.js
new file mode 100644
index 0000000000..ccaa1ae6bd
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/coerced-end-detach.js
@@ -0,0 +1,30 @@
+// Copyright (C) 2020 Google. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Security Throws a TypeError if end coercion detaches the buffer
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  9. If relativeEnd < 0, let final be max((len + relativeEnd), 0); else let final be min(relativeEnd, len).
+  10. If IsDetachedBuffer(O.[[ViewedArrayBuffer]]) is true, throw a TypeError exception.
+ 
+includes: [testTypedArray.js, detachArrayBuffer.js]
+features: [TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var sample = new TA(10);
+
+  function detachAndReturnIndex(){
+    $DETACHBUFFER(sample.buffer);
+    return 10;
+  }
+
+  assert.throws(TypeError, function() {
+    sample.fill(0x77, 0, {valueOf: detachAndReturnIndex});
+  }, "Detachment when coercing end should throw TypeError");
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/coerced-indexes.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/coerced-indexes.js
new file mode 100644
index 0000000000..f2f78c3d39
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/coerced-indexes.js
@@ -0,0 +1,106 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Fills elements from coerced to Integer `start` and `end` values
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  %TypedArray%.prototype.fill is a distinct function that implements the same
+  algorithm as Array.prototype.fill as defined in 22.1.3.6 except that the this
+  object's [[ArrayLength]] internal slot is accessed in place of performing a
+  [[Get]] of "length". The implementation of the algorithm may be optimized with
+  the knowledge that the this value is an object that has a fixed length and
+  whose integer indexed properties are not sparse. However, such optimization
+  must not introduce any observable changes in the specified behaviour of the
+  algorithm.
+
+  ...
+
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  3. Let relativeStart be ? ToInteger(start).
+  4. If relativeStart < 0, let k be max((len + relativeStart), 0); else let k be
+  min(relativeStart, len).
+  5. If end is undefined, let relativeEnd be len; else let relativeEnd be ?
+  ToInteger(end).
+  ...
+includes: [compareArray.js, testTypedArray.js]
+features: [TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  assert(
+    compareArray(new TA([0, 0]).fill(1, undefined), [1, 1]),
+    '`undefined` start coerced to 0'
+  );
+
+  assert(
+    compareArray(new TA([0, 0]).fill(1, 0, undefined), [1, 1]),
+    'If end is undefined, let relativeEnd be len'
+  );
+
+  assert(
+    compareArray(new TA([0, 0]).fill(1, null), [1, 1]),
+    '`null` start coerced to 0'
+  );
+
+  assert(
+    compareArray(new TA([0, 0]).fill(1, 0, null), [0, 0]),
+    '`null` end coerced to 0'
+  );
+
+  assert(
+    compareArray(new TA([0, 0]).fill(1, true), [0, 1]),
+    '`true` start coerced to 1'
+  );
+
+  assert(
+    compareArray(new TA([0, 0]).fill(1, 0, true), [1, 0]),
+    '`true` end coerced to 1'
+  );
+
+  assert(
+    compareArray(new TA([0, 0]).fill(1, false), [1, 1]),
+    '`false` start coerced to 0'
+  );
+
+  assert(
+    compareArray(new TA([0, 0]).fill(1, 0, false), [0, 0]),
+    '`false` end coerced to 0'
+  );
+
+  assert(
+    compareArray(new TA([0, 0]).fill(1, NaN), [1, 1]),
+    '`NaN` start coerced to 0'
+  );
+
+  assert(
+    compareArray(new TA([0, 0]).fill(1, 0, NaN), [0, 0]),
+    '`NaN` end coerced to 0'
+  );
+
+  assert(
+    compareArray(new TA([0, 0]).fill(1, '1'), [0, 1]),
+    'string start coerced'
+  );
+
+  assert(
+    compareArray(new TA([0, 0]).fill(1, 0, '1'), [1, 0]),
+    'string end coerced'
+  );
+
+  assert(
+    compareArray(new TA([0, 0]).fill(1, 1.5), [0, 1]),
+    'start as a float number coerced'
+  );
+
+  assert(
+    compareArray(new TA([0, 0]).fill(1, 0, 1.5), [1, 0]),
+    'end as a float number coerced'
+  );
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/coerced-start-detach.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/coerced-start-detach.js
new file mode 100644
index 0000000000..63656210b1
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/coerced-start-detach.js
@@ -0,0 +1,31 @@
+// Copyright (C) 2020 Google. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Security Throws a TypeError if start coercion detaches the buffer
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  6. Let relativeStart be ? ToInteger(start).
+  ...
+  10. If IsDetachedBuffer(O.[[ViewedArrayBuffer]]) is true, throw a TypeError exception.
+ 
+includes: [testTypedArray.js, detachArrayBuffer.js]
+features: [TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var sample = new TA(10);
+
+  function detachAndReturnIndex(){
+    $DETACHBUFFER(sample.buffer);
+    return 0;
+  }
+
+  assert.throws(TypeError, function() {
+    sample.fill(0x77, {valueOf: detachAndReturnIndex}, 10);
+  }, "Detachment when coercing start should throw TypeError");
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/coerced-value-detach.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/coerced-value-detach.js
new file mode 100644
index 0000000000..cdfa9efd88
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/coerced-value-detach.js
@@ -0,0 +1,31 @@
+// Copyright (C) 2020 Google. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Security Throws a TypeError if value coercion detaches the buffer
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  5. Otherwise, set value to ? ToNumber(value).
+  ...
+  10. If IsDetachedBuffer(O.[[ViewedArrayBuffer]]) is true, throw a TypeError exception.
+ 
+includes: [testTypedArray.js, detachArrayBuffer.js]
+features: [TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var sample = new TA(10);
+
+  function detachAndReturnIndex(){
+    $DETACHBUFFER(sample.buffer);
+    return 0x77;
+  }
+
+  assert.throws(TypeError, function() {
+    sample.fill({valueOf: detachAndReturnIndex}, 0, 10);
+  }, "Detachment when coercing value should throw TypeError");
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/detached-buffer.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/detached-buffer.js
new file mode 100644
index 0000000000..e81231bc64
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/detached-buffer.js
@@ -0,0 +1,36 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: Throws a TypeError if this has a detached buffer
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  This function is not generic. ValidateTypedArray is applied to the this value
+  prior to evaluating the algorithm. If its result is an abrupt completion that
+  exception is thrown instead of evaluating the algorithm.
+
+  22.2.3.5.1 Runtime Semantics: ValidateTypedArray ( O )
+
+  ...
+  5. If IsDetachedBuffer(buffer) is true, throw a TypeError exception.
+  ...
+includes: [testTypedArray.js, detachArrayBuffer.js]
+features: [TypedArray]
+---*/
+
+var obj = {
+  valueOf: function() {
+    throw new Test262Error();
+  }
+};
+
+testWithTypedArrayConstructors(function(TA) {
+  var sample = new TA(1);
+  $DETACHBUFFER(sample.buffer);
+  assert.throws(TypeError, function() {
+    sample.fill(obj);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/fill-values-conversion-once.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/fill-values-conversion-once.js
new file mode 100644
index 0000000000..0abceac140
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/fill-values-conversion-once.js
@@ -0,0 +1,29 @@
+// Copyright (C) 2017 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Fills all the elements with non numeric values values.
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  3. Let _value_ be ? ToNumber(_value_).
+  ...
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var sample = new TA(2);
+
+  var n = 1;
+  sample.fill({ valueOf() { return n++; } });
+
+  assert.sameValue(n, 2, "additional unexpected ToNumber() calls");
+  assert.sameValue(sample[0], 1, "incorrect ToNumber result in index 0");
+  assert.sameValue(sample[1], 1, "incorrect ToNumber result in index 1");
+});
+
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/fill-values-conversion-operations-consistent-nan.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/fill-values-conversion-operations-consistent-nan.js
new file mode 100644
index 0000000000..0990868026
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/fill-values-conversion-operations-consistent-nan.js
@@ -0,0 +1,103 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  An implementation must always choose either the same encoding for each implementation distinguishable *NaN* value, or an implementation-defined canonical value.
+info: |
+  This test does not compare the actual byte values, instead it simply checks that
+  the value is some valid NaN encoding.
+
+  ---
+
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  %TypedArray%.prototype.fill is a distinct function that implements the same
+  algorithm as Array.prototype.fill as defined in 22.1.3.6 except that the this
+  object's [[ArrayLength]] internal slot is accessed in place of performing a
+  [[Get]] of "length". The implementation of the algorithm may be optimized with
+  the knowledge that the this value is an object that has a fixed length and
+  whose integer indexed properties are not sparse. However, such optimization
+  must not introduce any observable changes in the specified behaviour of the
+  algorithm.
+
+  ...
+
+  #sec-array.prototype.fill
+  Array.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  7. Repeat, while k < final
+    a. Let Pk be ! ToString(k).
+    b. Perform ? Set(O, Pk, value, true).
+  ...
+
+  #sec-setvalueinbuffer
+  SetValueInBuffer ( arrayBuffer, byteIndex, type, value [ ,
+  isLittleEndian ] )
+
+  8. Let rawBytes be NumberToRawBytes(type, value, isLittleEndian).
+
+  #sec-numbertorawbytes
+  NumberToRawBytes( type, value, isLittleEndian )
+
+  1. If type is "Float32", then
+     a. Set rawBytes to a List containing the 4 bytes that are the result
+        of converting value to IEEE 754-2008 binary32 format using “Round to
+        nearest, ties to even” rounding mode. If isLittleEndian is false, the
+        bytes are arranged in big endian order. Otherwise, the bytes are
+        arranged in little endian order. If value is NaN, rawValue may be set
+        to any implementation chosen IEEE 754-2008 binary64 format Not-a-Number
+        encoding. An implementation must always choose either the same encoding
+        for each implementation distinguishable *NaN* value, or an
+        implementation-defined canonical value.
+  2. Else, if type is "Float64", then
+     a. Set _rawBytes_ to a List containing the 8 bytes that are the IEEE
+        754-2008 binary64 format encoding of _value_. If _isLittleEndian_ is
+        *false*, the bytes are arranged in big endian order. Otherwise,
+        the bytes are arranged in little endian order. If _value_ is *NaN*,
+        _rawValue_ may be set to any implementation chosen IEEE 754-2008
+        binary64 format Not-a-Number encoding. An implementation must
+        always choose either the same encoding for each implementation
+        distinguishable *NaN* value, or an implementation-defined
+        canonical value.
+  ...
+
+  #sec-isnan-number
+
+  NOTE: A reliable way for ECMAScript code to test if a value X is a NaN is 
+  an expression of the form  X !== X. The result will be true if and only 
+  if X is a NaN.
+includes: [nans.js, testTypedArray.js]
+features: [TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(FA) {
+  var precision = floatTypedArrayConstructorPrecision(FA);
+  var samples = new FA(3);
+  var controls, idx, aNaN;
+
+  for (idx = 0; idx < NaNs.length; ++idx) {
+    aNaN = NaNs[idx];
+    controls = new Float32Array([aNaN, aNaN, aNaN]);
+
+    samples.fill(aNaN);
+
+    for (var i = 0; i < samples.length; i++) {
+      var sample = samples[i];
+      var control = controls[i];
+
+      assert(
+        samples[i] !== samples[i],
+        `samples (index=${idx}) produces a valid NaN (${precision} precision)`
+      );
+
+      assert(
+        controls[i] !== controls[i],
+        `controls (index=${idx}) produces a valid NaN (${precision} precision)`
+      );
+    }
+  }
+}, floatArrayConstructors);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/fill-values-conversion-operations.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/fill-values-conversion-operations.js
new file mode 100644
index 0000000000..c23bfe9b2b
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/fill-values-conversion-operations.js
@@ -0,0 +1,58 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Fills all the elements with non numeric values values.
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  %TypedArray%.prototype.fill is a distinct function that implements the same
+  algorithm as Array.prototype.fill as defined in 22.1.3.6 except that the this
+  object's [[ArrayLength]] internal slot is accessed in place of performing a
+  [[Get]] of "length". The implementation of the algorithm may be optimized with
+  the knowledge that the this value is an object that has a fixed length and
+  whose integer indexed properties are not sparse. However, such optimization
+  must not introduce any observable changes in the specified behaviour of the
+  algorithm.
+
+  ...
+
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  7. Repeat, while k < final
+    a. Let Pk be ! ToString(k).
+    b. Perform ? Set(O, Pk, value, true).
+  ...
+
+  24.1.1.6 SetValueInBuffer ( arrayBuffer, byteIndex, type, value [ ,
+  isLittleEndian ] )
+
+  ...
+  8. If type is "Float32", then
+    ...
+  9. Else, if type is "Float64", then
+    ...
+  10. Else,
+    ...
+    b. Let convOp be the abstract operation named in the Conversion Operation
+    column in Table 50 for Element Type type.
+    c. Let intValue be convOp(value).
+    d. If intValue ≥ 0, then
+      ...
+    e. Else,
+      ...
+includes: [byteConversionValues.js, testTypedArray.js]
+features: [TypedArray]
+---*/
+
+testTypedArrayConversions(byteConversionValues, function(TA, value, expected, initial) {
+  var sample = new TA([initial]);
+
+  sample.fill(value);
+
+  assert.sameValue(sample[0], expected, value + " converts to " + expected);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/fill-values-custom-start-and-end.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/fill-values-custom-start-and-end.js
new file mode 100644
index 0000000000..7f8d6dd51f
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/fill-values-custom-start-and-end.js
@@ -0,0 +1,44 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Fills all the elements from a with a custom start and end indexes.
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  %TypedArray%.prototype.fill is a distinct function that implements the same
+  algorithm as Array.prototype.fill as defined in 22.1.3.6 except that the this
+  object's [[ArrayLength]] internal slot is accessed in place of performing a
+  [[Get]] of "length". The implementation of the algorithm may be optimized with
+  the knowledge that the this value is an object that has a fixed length and
+  whose integer indexed properties are not sparse. However, such optimization
+  must not introduce any observable changes in the specified behaviour of the
+  algorithm.
+
+  ...
+
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  3. Let relativeStart be ? ToInteger(start).
+  4. If relativeStart < 0, let k be max((len + relativeStart), 0); else let k be
+  min(relativeStart, len).
+  5. If end is undefined, let relativeEnd be len; else let relativeEnd be ?
+  ToInteger(end).
+  6. If relativeEnd < 0, let final be max((len + relativeEnd), 0); else let
+  final be min(relativeEnd, len).
+  ...
+includes: [compareArray.js, testTypedArray.js]
+features: [TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  assert(compareArray(new TA([0, 0, 0]).fill(8, 1, 2), [0, 8, 0]));
+  assert(compareArray(new TA([0, 0, 0, 0, 0]).fill(8, -3, 4), [0, 0, 8, 8, 0]));
+  assert(compareArray(new TA([0, 0, 0, 0, 0]).fill(8, -2, -1), [0, 0, 0, 8, 0]));
+  assert(compareArray(new TA([0, 0, 0, 0, 0]).fill(8, -1, -3), [0, 0, 0, 0, 0]));
+  assert(compareArray(new TA([0, 0, 0, 0, 0]).fill(8, 1, 3), [0, 8, 8, 0, 0]));
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/fill-values-non-numeric.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/fill-values-non-numeric.js
new file mode 100644
index 0000000000..371f9bde5f
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/fill-values-non-numeric.js
@@ -0,0 +1,89 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Fills all the elements with non numeric values values.
+info: |
+  %TypedArray%.prototype.fill ( value [ , start [ , end ] ] )
+
+  Let O be the this value.
+  Perform ? ValidateTypedArray(O).
+  Let len be O.[[ArrayLength]].
+  If O.[[ContentType]] is BigInt, set value to ? ToBigInt(value).
+  Otherwise, set value to ? ToNumber(value).
+  Let relativeStart be ? ToIntegerOrInfinity(start).
+  If relativeStart is -Infinity, let k be 0.
+  Else if relativeStart < 0, let k be max(len + relativeStart, 0).
+  Else, let k be min(relativeStart, len).
+  If end is undefined, let relativeEnd be len; else let relativeEnd be ? ToIntegerOrInfinity(end).
+  If relativeEnd is -Infinity, let final be 0.
+  Else if relativeEnd < 0, let final be max(len + relativeEnd, 0).
+  Else, let final be min(relativeEnd, len).
+  If IsDetachedBuffer(O.[[ViewedArrayBuffer]]) is true, throw a TypeError exception.
+  Repeat, while k < final,
+    Let Pk be ! ToString(F(k)).
+    Perform ! Set(O, Pk, value, true).
+    Set k to k + 1.
+  Return O.
+
+  IntegerIndexedElementSet ( O, index, value )
+
+  Assert: O is an Integer-Indexed exotic object.
+  If O.[[ContentType]] is BigInt, let numValue be ? ToBigInt(value).
+  Otherwise, let numValue be ? ToNumber(value).
+  Let buffer be O.[[ViewedArrayBuffer]].
+  If IsDetachedBuffer(buffer) is false and ! IsValidIntegerIndex(O, index) is true, then
+    Let offset be O.[[ByteOffset]].
+    Let arrayTypeName be the String value of O.[[TypedArrayName]].
+    Let elementSize be the Element Size value specified in Table 62 for arrayTypeName.
+    Let indexedPosition be (ℝ(index) × elementSize) + offset.
+    Let elementType be the Element Type value in Table 62 for arrayTypeName.
+    Perform SetValueInBuffer(buffer, indexedPosition, elementType, numValue, true, Unordered).
+  Return NormalCompletion(undefined).
+
+
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var sample;
+
+  sample = new TA([42]);
+  sample.fill(null);
+  assert.sameValue(sample[0], 0, "null => 0");
+
+  sample = new TA([42]);
+  sample.fill(false);
+  assert.sameValue(sample[0], 0, "false => 0");
+
+  sample = new TA([42]);
+  sample.fill(true);
+  assert.sameValue(sample[0], 1, "true => 1");
+
+  sample = new TA([42]);
+  sample.fill("7");
+  assert.sameValue(sample[0], 7, "string conversion");
+
+  sample = new TA([42]);
+  sample.fill({
+    toString: function() {
+      return "1";
+    },
+    valueOf: function() {
+      return 7;
+    }
+  });
+  assert.sameValue(sample[0], 7, "object valueOf conversion before toString");
+
+  sample = new TA([42]);
+  sample.fill({
+    toString: function() {
+      return "7";
+    }
+  });
+  assert.sameValue(sample[0], 7, "object toString when valueOf is absent");
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/fill-values-relative-end.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/fill-values-relative-end.js
new file mode 100644
index 0000000000..086bf5d1b9
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/fill-values-relative-end.js
@@ -0,0 +1,55 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Fills all the elements from a with a custom end index.
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  %TypedArray%.prototype.fill is a distinct function that implements the same
+  algorithm as Array.prototype.fill as defined in 22.1.3.6 except that the this
+  object's [[ArrayLength]] internal slot is accessed in place of performing a
+  [[Get]] of "length". The implementation of the algorithm may be optimized with
+  the knowledge that the this value is an object that has a fixed length and
+  whose integer indexed properties are not sparse. However, such optimization
+  must not introduce any observable changes in the specified behaviour of the
+  algorithm.
+
+  ...
+
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  5. If end is undefined, let relativeEnd be len; else let relativeEnd be ?
+  ToInteger(end).
+  6. If relativeEnd < 0, let final be max((len + relativeEnd), 0); else let
+  final be min(relativeEnd, len).
+  ...
+includes: [compareArray.js, testTypedArray.js]
+features: [TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  assert(
+    compareArray(new TA([0, 0, 0]).fill(8, 0, 1), [8, 0, 0]),
+    "Fill elements from custom end position"
+  );
+
+  assert(
+    compareArray(new TA([0, 0, 0]).fill(8, 0, -1), [8, 8, 0]),
+    "negative end sets final position to max((length + relativeEnd), 0)"
+  );
+
+  assert(
+    compareArray(new TA([0, 0, 0]).fill(8, 0, 5), [8, 8, 8]),
+    "end position is never higher than of length"
+  );
+
+  assert(
+    compareArray(new TA([0, 0, 0]).fill(8, 0, -4), [0, 0, 0]),
+    "end position is 0 when (len + relativeEnd) < 0"
+  );
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/fill-values-relative-start.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/fill-values-relative-start.js
new file mode 100644
index 0000000000..d418285a8e
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/fill-values-relative-start.js
@@ -0,0 +1,53 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Fills all the elements from a with a custom start index.
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  %TypedArray%.prototype.fill is a distinct function that implements the same
+  algorithm as Array.prototype.fill as defined in 22.1.3.6 except that the this
+  object's [[ArrayLength]] internal slot is accessed in place of performing a
+  [[Get]] of "length". The implementation of the algorithm may be optimized with
+  the knowledge that the this value is an object that has a fixed length and
+  whose integer indexed properties are not sparse. However, such optimization
+  must not introduce any observable changes in the specified behaviour of the
+  algorithm.
+
+  ...
+
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  4. If relativeStart < 0, let k be max((len + relativeStart), 0); else let k be
+  min(relativeStart, len).
+  ...
+includes: [compareArray.js, testTypedArray.js]
+features: [TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  assert(
+    compareArray(new TA([0, 0, 0]).fill(8, 1), [0, 8, 8]),
+    "Fill elements from custom start position"
+  );
+
+  assert(
+    compareArray(new TA([0, 0, 0]).fill(8, 4), [0, 0, 0]),
+    "start position is never higher than length"
+  );
+
+  assert(
+    compareArray(new TA([0, 0, 0]).fill(8, -1), [0, 0, 8]),
+    "start < 0 sets initial position to max((len + relativeStart), 0)"
+  );
+
+  assert(
+    compareArray(new TA([0, 0, 0]).fill(8, -5), [8, 8, 8]),
+    "start position is 0 when (len + relativeStart) < 0"
+  );
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/fill-values-symbol-throws.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/fill-values-symbol-throws.js
new file mode 100644
index 0000000000..48bbe9c94e
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/fill-values-symbol-throws.js
@@ -0,0 +1,60 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Throws a TypeError if value is a Symbol
+info: |
+  %TypedArray%.prototype.fill ( value [ , start [ , end ] ] )
+
+  Let O be the this value.
+  Perform ? ValidateTypedArray(O).
+  Let len be O.[[ArrayLength]].
+  If O.[[ContentType]] is BigInt, set value to ? ToBigInt(value).
+  Otherwise, set value to ? ToNumber(value).
+  Let relativeStart be ? ToIntegerOrInfinity(start).
+  If relativeStart is -Infinity, let k be 0.
+  Else if relativeStart < 0, let k be max(len + relativeStart, 0).
+  Else, let k be min(relativeStart, len).
+  If end is undefined, let relativeEnd be len; else let relativeEnd be ? ToIntegerOrInfinity(end).
+  If relativeEnd is -Infinity, let final be 0.
+  Else if relativeEnd < 0, let final be max(len + relativeEnd, 0).
+  Else, let final be min(relativeEnd, len).
+  If IsDetachedBuffer(O.[[ViewedArrayBuffer]]) is true, throw a TypeError exception.
+  Repeat, while k < final,
+    Let Pk be ! ToString(F(k)).
+    Perform ! Set(O, Pk, value, true).
+    Set k to k + 1.
+  Return O.
+
+  IntegerIndexedElementSet ( O, index, value )
+
+  Assert: O is an Integer-Indexed exotic object.
+  If O.[[ContentType]] is BigInt, let numValue be ? ToBigInt(value).
+  Otherwise, let numValue be ? ToNumber(value).
+  Let buffer be O.[[ViewedArrayBuffer]].
+  If IsDetachedBuffer(buffer) is false and ! IsValidIntegerIndex(O, index) is true, then
+    Let offset be O.[[ByteOffset]].
+    Let arrayTypeName be the String value of O.[[TypedArrayName]].
+    Let elementSize be the Element Size value specified in Table 62 for arrayTypeName.
+    Let indexedPosition be (ℝ(index) × elementSize) + offset.
+    Let elementType be the Element Type value in Table 62 for arrayTypeName.
+    Perform SetValueInBuffer(buffer, indexedPosition, elementType, numValue, true, Unordered).
+  Return NormalCompletion(undefined).
+
+
+includes: [testTypedArray.js]
+features: [Symbol, TypedArray]
+---*/
+
+var s = Symbol('1');
+
+testWithTypedArrayConstructors(function(TA) {
+  var sample = new TA(1);
+
+  assert.throws(TypeError, function() {
+    sample.fill(s);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/fill-values.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/fill-values.js
new file mode 100644
index 0000000000..a3a4bad901
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/fill-values.js
@@ -0,0 +1,46 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Fills all the elements with `value` from a default start and index.
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  %TypedArray%.prototype.fill is a distinct function that implements the same
+  algorithm as Array.prototype.fill as defined in 22.1.3.6 except that the this
+  object's [[ArrayLength]] internal slot is accessed in place of performing a
+  [[Get]] of "length". The implementation of the algorithm may be optimized with
+  the knowledge that the this value is an object that has a fixed length and
+  whose integer indexed properties are not sparse. However, such optimization
+  must not introduce any observable changes in the specified behaviour of the
+  algorithm.
+
+  ...
+
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  7. Repeat, while k < final
+    a. Let Pk be ! ToString(k).
+    b. Perform ? Set(O, Pk, value, true).
+includes: [compareArray.js, testTypedArray.js]
+features: [TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  assert(
+    compareArray(
+      new TA().fill(8),
+      []
+    ),
+    "does not fill an empty instance"
+  );
+
+  assert(
+    compareArray(new TA([0, 0, 0]).fill(8), [8, 8, 8]),
+    "Default start and end indexes are 0 and this.length"
+  );
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/get-length-ignores-length-prop.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/get-length-ignores-length-prop.js
new file mode 100644
index 0000000000..bdd67a6212
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/get-length-ignores-length-prop.js
@@ -0,0 +1,53 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Unreachable abrupt from Get(O, "length") as [[ArrayLength]] is returned.
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  %TypedArray%.prototype.fill is a distinct function that implements the same
+  algorithm as Array.prototype.fill as defined in 22.1.3.6 except that the this
+  object's [[ArrayLength]] internal slot is accessed in place of performing a
+  [[Get]] of "length". The implementation of the algorithm may be optimized with
+  the knowledge that the this value is an object that has a fixed length and
+  whose integer indexed properties are not sparse. However, such optimization
+  must not introduce any observable changes in the specified behaviour of the
+  algorithm.
+
+  ...
+
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  1. Let O be ? ToObject(this value).
+  2. Let len be ? ToLength(? Get(O, "length")).
+  ...
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+Object.defineProperty(TypedArray.prototype, "length", {
+  get: function() {
+    throw new Test262Error();
+  }
+});
+
+testWithTypedArrayConstructors(function(TA) {
+  Object.defineProperty(TA.prototype, "length", {
+    get: function() {
+      throw new Test262Error();
+    }
+  });
+
+  var sample = new TA(1);
+  Object.defineProperty(sample, "length", {
+    get: function() {
+      throw new Test262Error();
+    }
+  });
+
+  assert.sameValue(sample.fill(1, 0), sample);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/invoked-as-func.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/invoked-as-func.js
new file mode 100644
index 0000000000..10b81cbf80
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/invoked-as-func.js
@@ -0,0 +1,31 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: Throws a TypeError exception when invoked as a function
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  This function is not generic. ValidateTypedArray is applied to the this value
+  prior to evaluating the algorithm. If its result is an abrupt completion that
+  exception is thrown instead of evaluating the algorithm.
+
+  22.2.3.5.1 Runtime Semantics: ValidateTypedArray ( O )
+
+  1. If Type(O) is not Object, throw a TypeError exception.
+  2. If O does not have a [[TypedArrayName]] internal slot, throw a TypeError
+  exception.
+  ...
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+var fill = TypedArray.prototype.fill;
+
+assert.sameValue(typeof fill, 'function');
+
+assert.throws(TypeError, function() {
+  fill();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/invoked-as-method.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/invoked-as-method.js
new file mode 100644
index 0000000000..2293f0644a
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/invoked-as-method.js
@@ -0,0 +1,31 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: Requires a [[TypedArrayName]] internal slot.
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  This function is not generic. ValidateTypedArray is applied to the this value
+  prior to evaluating the algorithm. If its result is an abrupt completion that
+  exception is thrown instead of evaluating the algorithm.
+
+  22.2.3.5.1 Runtime Semantics: ValidateTypedArray ( O )
+
+  1. If Type(O) is not Object, throw a TypeError exception.
+  2. If O does not have a [[TypedArrayName]] internal slot, throw a TypeError
+  exception.
+  ...
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+var TypedArrayPrototype = TypedArray.prototype;
+
+assert.sameValue(typeof TypedArrayPrototype.fill, 'function');
+
+assert.throws(TypeError, function() {
+  TypedArrayPrototype.fill();
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/length.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/length.js
new file mode 100644
index 0000000000..2106e754bc
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/length.js
@@ -0,0 +1,32 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  %TypedArray%.prototype.fill.length is 1.
+info: |
+  %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  17 ECMAScript Standard Built-in Objects:
+    Every built-in Function object, including constructors, has a length
+    property whose value is an integer. Unless otherwise specified, this
+    value is equal to the largest number of named arguments shown in the
+    subclause headings for the function description, including optional
+    parameters. However, rest parameters shown using the form “...name”
+    are not included in the default argument count.
+
+    Unless otherwise specified, the length property of a built-in Function
+    object has the attributes { [[Writable]]: false, [[Enumerable]]: false,
+    [[Configurable]]: true }.
+includes: [propertyHelper.js, testTypedArray.js]
+features: [TypedArray]
+---*/
+
+assert.sameValue(TypedArray.prototype.fill.length, 1);
+
+verifyNotEnumerable(TypedArray.prototype.fill, "length");
+verifyNotWritable(TypedArray.prototype.fill, "length");
+verifyConfigurable(TypedArray.prototype.fill, "length");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/name.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/name.js
new file mode 100644
index 0000000000..c1e6729cee
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/name.js
@@ -0,0 +1,29 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  %TypedArray%.prototype.fill.name is "fill".
+info: |
+  %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  17 ECMAScript Standard Built-in Objects:
+    Every built-in Function object, including constructors, that is not
+    identified as an anonymous function has a name property whose value
+    is a String.
+
+    Unless otherwise specified, the name property of a built-in Function
+    object, if it exists, has the attributes { [[Writable]]: false,
+    [[Enumerable]]: false, [[Configurable]]: true }.
+includes: [propertyHelper.js, testTypedArray.js]
+features: [TypedArray]
+---*/
+
+assert.sameValue(TypedArray.prototype.fill.name, "fill");
+
+verifyNotEnumerable(TypedArray.prototype.fill, "name");
+verifyNotWritable(TypedArray.prototype.fill, "name");
+verifyConfigurable(TypedArray.prototype.fill, "name");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/not-a-constructor.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/not-a-constructor.js
new file mode 100644
index 0000000000..984f6435ce
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/not-a-constructor.js
@@ -0,0 +1,35 @@
+// Copyright (C) 2020 Rick Waldron. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-ecmascript-standard-built-in-objects
+description: >
+  TypedArray.prototype.fill does not implement [[Construct]], is not new-able
+info: |
+  ECMAScript Function Objects
+
+  Built-in function objects that are not identified as constructors do not
+  implement the [[Construct]] internal method unless otherwise specified in
+  the description of a particular function.
+
+  sec-evaluatenew
+
+  ...
+  7. If IsConstructor(constructor) is false, throw a TypeError exception.
+  ...
+includes: [isConstructor.js, testTypedArray.js]
+features: [Reflect.construct, arrow-function, TypedArray]
+---*/
+
+assert.sameValue(
+  isConstructor(TypedArray.prototype.fill),
+  false,
+  'isConstructor(TypedArray.prototype.fill) must return false'
+);
+
+assert.throws(TypeError, () => {
+  let u8 = new Uint8Array(1); new u8.fill();
+}, '`let u8 = new Uint8Array(1); new u8.fill()` throws TypeError');
+
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/prop-desc.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/prop-desc.js
new file mode 100644
index 0000000000..b9de7e83b7
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/prop-desc.js
@@ -0,0 +1,21 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  "fill" property of TypedArrayPrototype
+info: |
+  ES6 section 17: Every other data property described in clauses 18 through 26
+  and in Annex B.2 has the attributes { [[Writable]]: true,
+  [[Enumerable]]: false, [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js, testTypedArray.js]
+features: [TypedArray]
+---*/
+
+var TypedArrayPrototype = TypedArray.prototype;
+
+verifyNotEnumerable(TypedArrayPrototype, 'fill');
+verifyWritable(TypedArrayPrototype, 'fill');
+verifyConfigurable(TypedArrayPrototype, 'fill');
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/return-abrupt-from-end-as-symbol.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/return-abrupt-from-end-as-symbol.js
new file mode 100644
index 0000000000..0c77c38dcd
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/return-abrupt-from-end-as-symbol.js
@@ -0,0 +1,40 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Return abrupt if end is a Symbol.
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  %TypedArray%.prototype.fill is a distinct function that implements the same
+  algorithm as Array.prototype.fill as defined in 22.1.3.6 except that the this
+  object's [[ArrayLength]] internal slot is accessed in place of performing a
+  [[Get]] of "length". The implementation of the algorithm may be optimized with
+  the knowledge that the this value is an object that has a fixed length and
+  whose integer indexed properties are not sparse. However, such optimization
+  must not introduce any observable changes in the specified behaviour of the
+  algorithm.
+
+  ...
+
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  5. If end is undefined, let relativeEnd be len; else let relativeEnd be ?
+  ToInteger(end).
+  ...
+includes: [testTypedArray.js]
+features: [Symbol, TypedArray]
+---*/
+
+var end = Symbol(1);
+
+testWithTypedArrayConstructors(function(TA) {
+  var sample = new TA();
+  assert.throws(TypeError, function() {
+    sample.fill(1, 0, end);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/return-abrupt-from-end.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/return-abrupt-from-end.js
new file mode 100644
index 0000000000..aa95620a25
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/return-abrupt-from-end.js
@@ -0,0 +1,44 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Return abrupt from ToInteger(end).
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  %TypedArray%.prototype.fill is a distinct function that implements the same
+  algorithm as Array.prototype.fill as defined in 22.1.3.6 except that the this
+  object's [[ArrayLength]] internal slot is accessed in place of performing a
+  [[Get]] of "length". The implementation of the algorithm may be optimized with
+  the knowledge that the this value is an object that has a fixed length and
+  whose integer indexed properties are not sparse. However, such optimization
+  must not introduce any observable changes in the specified behaviour of the
+  algorithm.
+
+  ...
+
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  5. If end is undefined, let relativeEnd be len; else let relativeEnd be ?
+  ToInteger(end).
+  ...
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+var end = {
+  valueOf: function() {
+    throw new Test262Error();
+  }
+};
+
+testWithTypedArrayConstructors(function(TA) {
+  var sample = new TA();
+  assert.throws(Test262Error, function() {
+    sample.fill(1, 0, end);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/return-abrupt-from-set-value.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/return-abrupt-from-set-value.js
new file mode 100644
index 0000000000..90d3c469ac
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/return-abrupt-from-set-value.js
@@ -0,0 +1,63 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Returns abrupt from value set
+info: |
+  %TypedArray%.prototype.fill ( value [ , start [ , end ] ] )
+
+  Let O be the this value.
+  Perform ? ValidateTypedArray(O).
+  Let len be O.[[ArrayLength]].
+  If O.[[ContentType]] is BigInt, set value to ? ToBigInt(value).
+  Otherwise, set value to ? ToNumber(value).
+  Let relativeStart be ? ToIntegerOrInfinity(start).
+  If relativeStart is -Infinity, let k be 0.
+  Else if relativeStart < 0, let k be max(len + relativeStart, 0).
+  Else, let k be min(relativeStart, len).
+  If end is undefined, let relativeEnd be len; else let relativeEnd be ? ToIntegerOrInfinity(end).
+  If relativeEnd is -Infinity, let final be 0.
+  Else if relativeEnd < 0, let final be max(len + relativeEnd, 0).
+  Else, let final be min(relativeEnd, len).
+  If IsDetachedBuffer(O.[[ViewedArrayBuffer]]) is true, throw a TypeError exception.
+  Repeat, while k < final,
+    Let Pk be ! ToString(F(k)).
+    Perform ! Set(O, Pk, value, true).
+    Set k to k + 1.
+  Return O.
+
+  IntegerIndexedElementSet ( O, index, value )
+
+  Assert: O is an Integer-Indexed exotic object.
+  If O.[[ContentType]] is BigInt, let numValue be ? ToBigInt(value).
+  Otherwise, let numValue be ? ToNumber(value).
+  Let buffer be O.[[ViewedArrayBuffer]].
+  If IsDetachedBuffer(buffer) is false and ! IsValidIntegerIndex(O, index) is true, then
+    Let offset be O.[[ByteOffset]].
+    Let arrayTypeName be the String value of O.[[TypedArrayName]].
+    Let elementSize be the Element Size value specified in Table 62 for arrayTypeName.
+    Let indexedPosition be (ℝ(index) × elementSize) + offset.
+    Let elementType be the Element Type value in Table 62 for arrayTypeName.
+    Perform SetValueInBuffer(buffer, indexedPosition, elementType, numValue, true, Unordered).
+  Return NormalCompletion(undefined).
+
+
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var sample = new TA([42]);
+  var obj = {
+    valueOf: function() {
+      throw new Test262Error();
+    }
+  };
+
+  assert.throws(Test262Error, function() {
+    sample.fill(obj);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/return-abrupt-from-start-as-symbol.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/return-abrupt-from-start-as-symbol.js
new file mode 100644
index 0000000000..2a94acc7e4
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/return-abrupt-from-start-as-symbol.js
@@ -0,0 +1,39 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Return abrupt from ToInteger(start) as a Symbol.
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  %TypedArray%.prototype.fill is a distinct function that implements the same
+  algorithm as Array.prototype.fill as defined in 22.1.3.6 except that the this
+  object's [[ArrayLength]] internal slot is accessed in place of performing a
+  [[Get]] of "length". The implementation of the algorithm may be optimized with
+  the knowledge that the this value is an object that has a fixed length and
+  whose integer indexed properties are not sparse. However, such optimization
+  must not introduce any observable changes in the specified behaviour of the
+  algorithm.
+
+  ...
+
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  3. Let relativeStart be ? ToInteger(start).
+  ...
+includes: [testTypedArray.js]
+features: [Symbol, TypedArray]
+---*/
+
+var start = Symbol(1);
+
+testWithTypedArrayConstructors(function(TA) {
+  var sample = new TA();
+  assert.throws(TypeError, function() {
+    sample.fill(1, start);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/return-abrupt-from-start.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/return-abrupt-from-start.js
new file mode 100644
index 0000000000..e7016c9159
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/return-abrupt-from-start.js
@@ -0,0 +1,43 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Return abrupt from ToInteger(start).
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  %TypedArray%.prototype.fill is a distinct function that implements the same
+  algorithm as Array.prototype.fill as defined in 22.1.3.6 except that the this
+  object's [[ArrayLength]] internal slot is accessed in place of performing a
+  [[Get]] of "length". The implementation of the algorithm may be optimized with
+  the knowledge that the this value is an object that has a fixed length and
+  whose integer indexed properties are not sparse. However, such optimization
+  must not introduce any observable changes in the specified behaviour of the
+  algorithm.
+
+  ...
+
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  3. Let relativeStart be ? ToInteger(start).
+  ...
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+var start = {
+  valueOf: function() {
+    throw new Test262Error();
+  }
+};
+
+testWithTypedArrayConstructors(function(TA) {
+  var sample = new TA();
+  assert.throws(Test262Error, function() {
+    sample.fill(1, start);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/return-abrupt-from-this-out-of-bounds.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/return-abrupt-from-this-out-of-bounds.js
new file mode 100644
index 0000000000..2f1fec95a1
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/return-abrupt-from-this-out-of-bounds.js
@@ -0,0 +1,62 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: Return abrupt when "this" value fails buffer boundary checks
+includes: [testTypedArray.js]
+features: [TypedArray, resizable-arraybuffer]
+---*/
+
+assert.sameValue(
+  typeof TypedArray.prototype.fill,
+  'function',
+  'implements TypedArray.prototype.fill'
+);
+
+assert.sameValue(
+  typeof ArrayBuffer.prototype.resize,
+  'function',
+  'implements ArrayBuffer.prototype.resize'
+);
+
+testWithTypedArrayConstructors(TA => {
+  var BPE = TA.BYTES_PER_ELEMENT;
+  var ab = new ArrayBuffer(BPE * 4, {maxByteLength: BPE * 5});
+  var array = new TA(ab, BPE, 2);
+
+  try {
+    ab.resize(BPE * 5);
+  } catch (_) {}
+
+  // no error following grow:
+  array.fill(0);
+
+  try {
+    ab.resize(BPE * 3);
+  } catch (_) {}
+
+  // no error following shrink (within bounds):
+  array.fill(0);
+
+  var expectedError;
+  try {
+    ab.resize(BPE * 2);
+    // If the preceding "resize" operation is successful, the typed array will
+    // be out out of bounds, so the subsequent prototype method should produce
+    // a TypeError due to the semantics of ValidateTypedArray.
+    expectedError = TypeError;
+  } catch (_) {
+    // The host is permitted to fail any "resize" operation at its own
+    // discretion. If that occurs, the fill operation should complete
+    // successfully.
+    expectedError = Test262Error;
+  }
+
+  assert.throws(expectedError, () => {
+    array.fill(0);
+    throw new Test262Error('fill completed successfully');
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/return-this.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/return-this.js
new file mode 100644
index 0000000000..afba1718ac
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/return-this.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Returns `this`.
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var sample1 = new TA();
+  var result1 = sample1.fill(1);
+
+  assert.sameValue(result1, sample1);
+
+  var sample2 = new TA(42);
+  var result2 = sample2.fill(7);
+  assert.sameValue(result2, sample2);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/shell.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/shell.js
new file mode 100644
index 0000000000..eda1477282
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/shell.js
@@ -0,0 +1,24 @@
+// GENERATED, DO NOT EDIT
+// file: isConstructor.js
+// Copyright (C) 2017 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: |
+    Test if a given function is a constructor function.
+defines: [isConstructor]
+features: [Reflect.construct]
+---*/
+
+function isConstructor(f) {
+    if (typeof f !== "function") {
+      throw new Test262Error("isConstructor invoked with a non-function value");
+    }
+
+    try {
+        Reflect.construct(function(){}, [], f);
+    } catch (e) {
+        return false;
+    }
+    return true;
+}
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/this-is-not-object.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/this-is-not-object.js
new file mode 100644
index 0000000000..17d8f004c5
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/this-is-not-object.js
@@ -0,0 +1,52 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: Throws a TypeError exception when `this` is not Object
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  This function is not generic. ValidateTypedArray is applied to the this value
+  prior to evaluating the algorithm. If its result is an abrupt completion that
+  exception is thrown instead of evaluating the algorithm.
+
+  22.2.3.5.1 Runtime Semantics: ValidateTypedArray ( O )
+
+  1. If Type(O) is not Object, throw a TypeError exception.
+  ...
+includes: [testTypedArray.js]
+features: [Symbol, TypedArray]
+---*/
+
+var fill = TypedArray.prototype.fill;
+
+assert.throws(TypeError, function() {
+  fill.call(undefined, 0);
+}, "this is undefined");
+
+assert.throws(TypeError, function() {
+  fill.call(null, 0);
+}, "this is null");
+
+assert.throws(TypeError, function() {
+  fill.call(42, 0);
+}, "this is 42");
+
+assert.throws(TypeError, function() {
+  fill.call("1", 0);
+}, "this is a string");
+
+assert.throws(TypeError, function() {
+  fill.call(true, 0);
+}, "this is true");
+
+assert.throws(TypeError, function() {
+  fill.call(false, 0);
+}, "this is false");
+
+var s = Symbol("s");
+assert.throws(TypeError, function() {
+  fill.call(s, 0);
+}, "this is a Symbol");
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArray/prototype/fill/this-is-not-typedarray-instance.js b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/this-is-not-typedarray-instance.js
new file mode 100644
index 0000000000..4568ee60c1
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArray/prototype/fill/this-is-not-typedarray-instance.js
@@ -0,0 +1,44 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-%typedarray%.prototype.fill
+description: >
+  Throws a TypeError exception when `this` is not a TypedArray instance
+info: |
+  22.2.3.8 %TypedArray%.prototype.fill (value [ , start [ , end ] ] )
+
+  This function is not generic. ValidateTypedArray is applied to the this value
+  prior to evaluating the algorithm. If its result is an abrupt completion that
+  exception is thrown instead of evaluating the algorithm.
+
+  22.2.3.5.1 Runtime Semantics: ValidateTypedArray ( O )
+
+  1. If Type(O) is not Object, throw a TypeError exception.
+  2. If O does not have a [[TypedArrayName]] internal slot, throw a TypeError
+  exception.
+  ...
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+var fill = TypedArray.prototype.fill;
+
+assert.throws(TypeError, function() {
+  fill.call({}, 0);
+}, "this is an Object");
+
+assert.throws(TypeError, function() {
+  fill.call([], 0);
+}, "this is an Array");
+
+var ab = new ArrayBuffer(8);
+assert.throws(TypeError, function() {
+  fill.call(ab, 0);
+}, "this is an ArrayBuffer instance");
+
+var dv = new DataView(new ArrayBuffer(8), 0, 1);
+assert.throws(TypeError, function() {
+  fill.call(dv, 0);
+}, "this is a DataView instance");
+
+reportCompare(0, 0);