Adding upstream version 124.0.1.upstream/124.0.1

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

55 files changed, 2238 insertions, 0 deletions

diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/browser.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/browser.js
new file mode 100644
index 0000000000..e69de29bb2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/browser.js
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/bufferbyteoffset-throws-from-modulo-element-size-sab.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/bufferbyteoffset-throws-from-modulo-element-size-sab.js
new file mode 100644
index 0000000000..6cd11a7883
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/bufferbyteoffset-throws-from-modulo-element-size-sab.js
@@ -0,0 +1,41 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Throws a RangeError if bufferByteLength modulo elementSize ≠ 0
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+
+  Let elementSize be the Number value of the Element Size value in Table 56 for constructorName.*
+  ...
+  If length is either not present or undefined, then
+    a. If bufferByteLength modulo elementSize ≠ 0, throw a RangeError exception.
+  ...
+
+  * Int8Array, Uint8Array, Uint8ClampedArray all have element size 1, so will never fail.
+
+includes: [testTypedArray.js]
+features: [SharedArrayBuffer, TypedArray]
+---*/
+
+var buffer = new SharedArrayBuffer(1);
+
+testWithTypedArrayConstructors(function(TA) {
+  assert.throws(RangeError, function() {
+    new TA(buffer);
+  });
+
+  assert.throws(RangeError, function() {
+    new TA(buffer, 0, undefined);
+  });
+}, floatArrayConstructors.concat([ Int32Array, Int16Array, Uint32Array, Uint16Array ]));
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/bufferbyteoffset-throws-from-modulo-element-size.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/bufferbyteoffset-throws-from-modulo-element-size.js
new file mode 100644
index 0000000000..0b1f59d0b1
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/bufferbyteoffset-throws-from-modulo-element-size.js
@@ -0,0 +1,34 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Throws a RangeError if bufferByteLength modulo elementSize ≠ 0
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  13. If length is undefined, then
+    a. If bufferByteLength modulo elementSize ≠ 0, throw a RangeError exception.
+  ...
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+var buffer = new ArrayBuffer(1);
+
+testWithTypedArrayConstructors(function(TA) {
+  assert.throws(RangeError, function() {
+    new TA(buffer);
+  });
+
+  assert.throws(RangeError, function() {
+    new TA(buffer, 0, undefined);
+  });
+}, floatArrayConstructors.concat([ Int32Array, Int16Array, Uint32Array, Uint16Array ]));
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-is-negative-throws-sab.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-is-negative-throws-sab.js
new file mode 100644
index 0000000000..70d62315c1
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-is-negative-throws-sab.js
@@ -0,0 +1,35 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Throws a RangeError if ToInteger(byteOffset) is < 0
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  7. Let offset be ? ToInteger(byteOffset).
+  8. If offset < 0, throw a RangeError exception.
+  ...
+includes: [testTypedArray.js]
+features: [SharedArrayBuffer, TypedArray]
+---*/
+
+var buffer = new SharedArrayBuffer(8);
+
+testWithTypedArrayConstructors(function(TA) {
+  assert.throws(RangeError, function() {
+    new TA(buffer, -1);
+  });
+  assert.throws(RangeError, function() {
+    new TA(buffer, -Infinity);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-is-negative-throws.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-is-negative-throws.js
new file mode 100644
index 0000000000..996976385e
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-is-negative-throws.js
@@ -0,0 +1,33 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Throws a RangeError if ToInteger(byteOffset) is < 0
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  7. Let offset be ? ToInteger(byteOffset).
+  8. If offset < 0, throw a RangeError exception.
+  ...
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+var buffer = new ArrayBuffer(8);
+
+testWithTypedArrayConstructors(function(TA) {
+  assert.throws(RangeError, function() {
+    new TA(buffer, -1);
+  });
+  assert.throws(RangeError, function() {
+    new TA(buffer, -Infinity);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-is-negative-zero-sab.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-is-negative-zero-sab.js
new file mode 100644
index 0000000000..ecb8b39000
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-is-negative-zero-sab.js
@@ -0,0 +1,26 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: pending
+description: >
+  TypedArray's [[ByteOffset]] internal slot is always a positive number, test with negative zero.
+info: |
+  %TypedArray% ( buffer [ , byteOffset [ , length ] ] )
+
+  ...
+  6. Let offset be ? ToInteger(byteOffset).
+  7. If offset < 0, throw a RangeError exception.
+  8. If offset is -0, let offset be +0.
+  ...
+includes: [testTypedArray.js]
+features: [SharedArrayBuffer, TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TAConstructor) {
+  var typedArray = new TAConstructor(new SharedArrayBuffer(8), -0);
+  assert.sameValue(typedArray.byteOffset, +0);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-is-negative-zero.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-is-negative-zero.js
new file mode 100644
index 0000000000..cd8b786ccc
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-is-negative-zero.js
@@ -0,0 +1,25 @@
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: pending
+description: >
+  TypedArray's [[ByteOffset]] internal slot is always a positive number, test with negative zero.
+info: |
+  %TypedArray% ( buffer [ , byteOffset [ , length ] ] )
+
+  ...
+  6. Let offset be ? ToInteger(byteOffset).
+  7. If offset < 0, throw a RangeError exception.
+  8. If offset is -0, let offset be +0.
+  ...
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TAConstructor) {
+  var typedArray = new TAConstructor(new ArrayBuffer(8), -0);
+  assert.sameValue(typedArray.byteOffset, +0);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-is-symbol-throws-sab.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-is-symbol-throws-sab.js
new file mode 100644
index 0000000000..b7a509cb98
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-is-symbol-throws-sab.js
@@ -0,0 +1,32 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Return abrupt from parsing integer value from byteOffset as a symbol
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  7. Let offset be ? ToInteger(byteOffset).
+  ...
+includes: [testTypedArray.js]
+features: [Symbol, SharedArrayBuffer, TypedArray]
+---*/
+
+var byteOffset = Symbol("1");
+var buffer = new SharedArrayBuffer(8);
+
+testWithTypedArrayConstructors(function(TA) {
+  assert.throws(TypeError, function() {
+    new TA(buffer, byteOffset);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-is-symbol-throws.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-is-symbol-throws.js
new file mode 100644
index 0000000000..9423fc4d6c
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-is-symbol-throws.js
@@ -0,0 +1,30 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Return abrupt from parsing integer value from byteOffset as a symbol
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  7. Let offset be ? ToInteger(byteOffset).
+  ...
+includes: [testTypedArray.js]
+features: [Symbol, TypedArray]
+---*/
+
+var byteOffset = Symbol("1");
+var buffer = new ArrayBuffer(8);
+
+testWithTypedArrayConstructors(function(TA) {
+  assert.throws(TypeError, function() {
+    new TA(buffer, byteOffset);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-throws-from-modulo-element-size-sab.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-throws-from-modulo-element-size-sab.js
new file mode 100644
index 0000000000..148be420dd
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-throws-from-modulo-element-size-sab.js
@@ -0,0 +1,38 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Throws a RangeError if ToInteger(byteOffset) modulo elementSize is not 0
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+
+  Let elementSize be the Number value of the Element Size value in Table 56 for constructorName.*
+
+  ...
+  If offset modulo elementSize ≠ 0, throw a RangeError exception.
+  ...
+
+  * Int8Array, Uint8Array, Uint8ClampedArray all have element size 1, so will never fail.
+
+includes: [testTypedArray.js]
+features: [SharedArrayBuffer, TypedArray]
+---*/
+
+var buffer = new SharedArrayBuffer(8);
+
+testWithTypedArrayConstructors(function(TA) {
+  assert.throws(RangeError, function() {
+    new TA(buffer, 7);
+  });
+}, floatArrayConstructors.concat([ Int32Array, Int16Array, Uint32Array, Uint16Array ]));
+
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-throws-from-modulo-element-size.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-throws-from-modulo-element-size.js
new file mode 100644
index 0000000000..bd3005f74a
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-throws-from-modulo-element-size.js
@@ -0,0 +1,29 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Throws a RangeError if ToInteger(byteOffset) modulo elementSize is not 0
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  10. If offset modulo elementSize ≠ 0, throw a RangeError exception.
+  ...
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+var buffer = new ArrayBuffer(8);
+
+testWithTypedArrayConstructors(function(TA) {
+  assert.throws(RangeError, function() {
+    new TA(buffer, 7);
+  });
+}, floatArrayConstructors.concat([ Int32Array, Int16Array, Uint32Array, Uint16Array ]));
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-to-number-detachbuffer.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-to-number-detachbuffer.js
new file mode 100644
index 0000000000..627c8778ad
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-to-number-detachbuffer.js
@@ -0,0 +1,23 @@
+// Copyright (C) 2017 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: If TypedArray() is passed a detached buffer, throw
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  ...
+  9. If IsDetachedBuffer(buffer) is true, throw a TypeError exception.
+  ...
+includes: [testTypedArray.js, detachArrayBuffer.js]
+features: [TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var offset = TA.BYTES_PER_ELEMENT;
+  var buffer = new ArrayBuffer(3 * offset);
+  var byteOffset = { valueOf() { $DETACHBUFFER(buffer); return offset; } };
+  assert.throws(TypeError, () => new TA(buffer, byteOffset));
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-to-number-throws-sab.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-to-number-throws-sab.js
new file mode 100644
index 0000000000..5b3ec7591d
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-to-number-throws-sab.js
@@ -0,0 +1,36 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Return abrupt from parsing integer value from byteOffset
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  7. Let offset be ? ToInteger(byteOffset).
+  ...
+includes: [testTypedArray.js]
+features: [SharedArrayBuffer, TypedArray]
+---*/
+
+var buffer = new SharedArrayBuffer(8);
+var byteOffset = {
+  valueOf: function() {
+    throw new Test262Error();
+  }
+};
+
+testWithTypedArrayConstructors(function(TA) {
+  assert.throws(Test262Error, function() {
+    new TA(buffer, byteOffset);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-to-number-throws.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-to-number-throws.js
new file mode 100644
index 0000000000..47ff7ea095
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/byteoffset-to-number-throws.js
@@ -0,0 +1,34 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Return abrupt from parsing integer value from byteOffset
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  7. Let offset be ? ToInteger(byteOffset).
+  ...
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+var buffer = new ArrayBuffer(8);
+var byteOffset = {
+  valueOf: function() {
+    throw new Test262Error();
+  }
+};
+
+testWithTypedArrayConstructors(function(TA) {
+  assert.throws(Test262Error, function() {
+    new TA(buffer, byteOffset);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/custom-proto-access-throws-sab.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/custom-proto-access-throws-sab.js
new file mode 100644
index 0000000000..bccf102235
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/custom-proto-access-throws-sab.js
@@ -0,0 +1,51 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Return abrupt completion getting newTarget's prototype
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  4. Let O be ? AllocateTypedArray(constructorName, NewTarget,
+  %TypedArrayPrototype%).
+  ...
+
+  22.2.4.2.1 Runtime Semantics: AllocateTypedArray (constructorName, newTarget,
+  defaultProto [ , length ])
+
+  1. Let proto be ? GetPrototypeFromConstructor(newTarget, defaultProto).
+  ...
+
+  9.1.15 GetPrototypeFromConstructor ( constructor, intrinsicDefaultProto )
+
+  ...
+  3. Let proto be ? Get(constructor, "prototype").
+  ...
+includes: [testTypedArray.js]
+features: [Reflect, SharedArrayBuffer, TypedArray]
+---*/
+
+var buffer = new SharedArrayBuffer(8);
+
+var newTarget = function() {}.bind(null);
+Object.defineProperty(newTarget, "prototype", {
+  get() {
+    throw new Test262Error();
+  }
+});
+
+testWithTypedArrayConstructors(function(TA) {
+  assert.throws(Test262Error, function() {
+    Reflect.construct(TA, [buffer], newTarget);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/custom-proto-access-throws.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/custom-proto-access-throws.js
new file mode 100644
index 0000000000..3f43b72932
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/custom-proto-access-throws.js
@@ -0,0 +1,49 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Return abrupt completion getting newTarget's prototype
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  4. Let O be ? AllocateTypedArray(constructorName, NewTarget,
+  %TypedArrayPrototype%).
+  ...
+
+  22.2.4.2.1 Runtime Semantics: AllocateTypedArray (constructorName, newTarget,
+  defaultProto [ , length ])
+
+  1. Let proto be ? GetPrototypeFromConstructor(newTarget, defaultProto).
+  ...
+
+  9.1.15 GetPrototypeFromConstructor ( constructor, intrinsicDefaultProto )
+
+  ...
+  3. Let proto be ? Get(constructor, "prototype").
+  ...
+includes: [testTypedArray.js]
+features: [Reflect, TypedArray]
+---*/
+
+var buffer = new ArrayBuffer(8);
+
+var newTarget = function() {}.bind(null);
+Object.defineProperty(newTarget, "prototype", {
+  get() {
+    throw new Test262Error();
+  }
+});
+
+testWithTypedArrayConstructors(function(TA) {
+  assert.throws(Test262Error, function() {
+    Reflect.construct(TA, [buffer], newTarget);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/defined-length-and-offset-sab.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/defined-length-and-offset-sab.js
new file mode 100644
index 0000000000..56ecd2f44a
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/defined-length-and-offset-sab.js
@@ -0,0 +1,36 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Return new typedArray from defined length and offset
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+includes: [testTypedArray.js]
+features: [SharedArrayBuffer, TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var offset = TA.BYTES_PER_ELEMENT;
+  var buffer = new SharedArrayBuffer(3 * offset);
+
+  var ta1 = new TA(buffer, offset, 2);
+  assert.sameValue(ta1.length, 2, "ta1.length");
+  assert.sameValue(ta1.buffer, buffer, "ta1.buffer");
+  assert.sameValue(ta1.constructor, TA);
+  assert.sameValue(Object.getPrototypeOf(ta1), TA.prototype);
+
+  var ta2 = new TA(buffer, offset, 0);
+  assert.sameValue(ta2.length, 0, "ta2.length");
+  assert.sameValue(ta2.buffer, buffer, "ta2.buffer");
+  assert.sameValue(ta2.constructor, TA);
+  assert.sameValue(Object.getPrototypeOf(ta2), TA.prototype);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/defined-length-and-offset.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/defined-length-and-offset.js
new file mode 100644
index 0000000000..80e815cf61
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/defined-length-and-offset.js
@@ -0,0 +1,34 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Return new typedArray from defined length and offset
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var offset = TA.BYTES_PER_ELEMENT;
+  var buffer = new ArrayBuffer(3 * offset);
+
+  var ta1 = new TA(buffer, offset, 2);
+  assert.sameValue(ta1.length, 2, "ta1.length");
+  assert.sameValue(ta1.buffer, buffer, "ta1.buffer");
+  assert.sameValue(ta1.constructor, TA);
+  assert.sameValue(Object.getPrototypeOf(ta1), TA.prototype);
+
+  var ta2 = new TA(buffer, offset, 0);
+  assert.sameValue(ta2.length, 0, "ta2.length");
+  assert.sameValue(ta2.buffer, buffer, "ta2.buffer");
+  assert.sameValue(ta2.constructor, TA);
+  assert.sameValue(Object.getPrototypeOf(ta2), TA.prototype);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/defined-length-sab.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/defined-length-sab.js
new file mode 100644
index 0000000000..a729a9a231
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/defined-length-sab.js
@@ -0,0 +1,38 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Return new typedArray from defined length
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+includes: [testTypedArray.js]
+features: [SharedArrayBuffer, TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var bpe = TA.BYTES_PER_ELEMENT;
+  var length = 4;
+  var buffer = new SharedArrayBuffer(bpe * length * 4);
+
+  var ta1 = new TA(buffer, 0, length);
+  assert.sameValue(ta1.length, length);
+  assert.sameValue(ta1.buffer, buffer);
+  assert.sameValue(ta1.constructor, TA);
+  assert.sameValue(Object.getPrototypeOf(ta1), TA.prototype);
+
+  var ta2 = new TA(buffer, 0, 0);
+  assert.sameValue(ta2.length, 0);
+  assert.sameValue(ta2.buffer, buffer);
+  assert.sameValue(ta2.constructor, TA);
+  assert.sameValue(Object.getPrototypeOf(ta2), TA.prototype);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/defined-length.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/defined-length.js
new file mode 100644
index 0000000000..52abb61850
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/defined-length.js
@@ -0,0 +1,36 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Return new typedArray from defined length
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var bpe = TA.BYTES_PER_ELEMENT;
+  var length = 4;
+  var buffer = new ArrayBuffer(bpe * length * 4);
+
+  var ta1 = new TA(buffer, 0, length);
+  assert.sameValue(ta1.length, length);
+  assert.sameValue(ta1.buffer, buffer);
+  assert.sameValue(ta1.constructor, TA);
+  assert.sameValue(Object.getPrototypeOf(ta1), TA.prototype);
+
+  var ta2 = new TA(buffer, 0, 0);
+  assert.sameValue(ta2.length, 0);
+  assert.sameValue(ta2.buffer, buffer);
+  assert.sameValue(ta2.constructor, TA);
+  assert.sameValue(Object.getPrototypeOf(ta2), TA.prototype);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/defined-negative-length-sab.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/defined-negative-length-sab.js
new file mode 100644
index 0000000000..3e7a33df8a
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/defined-negative-length-sab.js
@@ -0,0 +1,32 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Throws RangeError for negative ToInteger(length)
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+includes: [testTypedArray.js]
+features: [SharedArrayBuffer, TypedArray]
+---*/
+
+var buffer = new SharedArrayBuffer(16);
+
+testWithTypedArrayConstructors(function(TA) {
+  assert.throws(RangeError, function() {
+    new TA(buffer, 0, -1);
+  });
+
+  assert.throws(RangeError, function() {
+    new TA(buffer, 0, -Infinity);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/defined-negative-length.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/defined-negative-length.js
new file mode 100644
index 0000000000..f795adabeb
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/defined-negative-length.js
@@ -0,0 +1,30 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Throws RangeError for negative ToInteger(length)
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+var buffer = new ArrayBuffer(16);
+
+testWithTypedArrayConstructors(function(TA) {
+  assert.throws(RangeError, function() {
+    new TA(buffer, 0, -1);
+  });
+
+  assert.throws(RangeError, function() {
+    new TA(buffer, 0, -Infinity);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/defined-offset-sab.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/defined-offset-sab.js
new file mode 100644
index 0000000000..3ad0730ddb
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/defined-offset-sab.js
@@ -0,0 +1,36 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Return new typedArray from defined offset
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+includes: [testTypedArray.js]
+features: [SharedArrayBuffer, TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var bpe = TA.BYTES_PER_ELEMENT;
+  var buffer = new SharedArrayBuffer(bpe * 4);
+
+  var ta1 = new TA(buffer, bpe * 2);
+  assert.sameValue(ta1.length, 2);
+  assert.sameValue(ta1.buffer, buffer);
+  assert.sameValue(ta1.constructor, TA);
+  assert.sameValue(Object.getPrototypeOf(ta1), TA.prototype);
+
+  var ta2 = new TA(buffer, 0);
+  assert.sameValue(ta2.length, 4);
+  assert.sameValue(ta2.buffer, buffer);
+  assert.sameValue(ta2.constructor, TA);
+  assert.sameValue(Object.getPrototypeOf(ta2), TA.prototype);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/defined-offset.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/defined-offset.js
new file mode 100644
index 0000000000..1c416c4a45
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/defined-offset.js
@@ -0,0 +1,34 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Return new typedArray from defined offset
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var bpe = TA.BYTES_PER_ELEMENT;
+  var buffer = new ArrayBuffer(bpe * 4);
+
+  var ta1 = new TA(buffer, bpe * 2);
+  assert.sameValue(ta1.length, 2);
+  assert.sameValue(ta1.buffer, buffer);
+  assert.sameValue(ta1.constructor, TA);
+  assert.sameValue(Object.getPrototypeOf(ta1), TA.prototype);
+
+  var ta2 = new TA(buffer, 0);
+  assert.sameValue(ta2.length, 4);
+  assert.sameValue(ta2.buffer, buffer);
+  assert.sameValue(ta2.constructor, TA);
+  assert.sameValue(Object.getPrototypeOf(ta2), TA.prototype);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/detachedbuffer.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/detachedbuffer.js
new file mode 100644
index 0000000000..15f2abe5e3
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/detachedbuffer.js
@@ -0,0 +1,23 @@
+// Copyright (C) 2017 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: If TypedArray() is passed a detached buffer, throw
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  ...
+  9. If IsDetachedBuffer(buffer) is true, throw a TypeError exception.
+  ...
+includes: [testTypedArray.js, detachArrayBuffer.js]
+features: [TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var offset = TA.BYTES_PER_ELEMENT;
+  var buffer = new ArrayBuffer(3 * offset);
+  $DETACHBUFFER(buffer);
+  assert.throws(TypeError, () => new TA(buffer));
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/excessive-length-throws-sab.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/excessive-length-throws-sab.js
new file mode 100644
index 0000000000..ee0b54e943
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/excessive-length-throws-sab.js
@@ -0,0 +1,35 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  If offset + newByteLength > bufferByteLength, throw a RangeError exception.
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  14. Else,
+    a. Let newLength be ? ToLength(length).
+    b. Let newByteLength be newLength × elementSize.
+    c. If offset+newByteLength > bufferByteLength, throw a RangeError exception.
+  ...
+includes: [testTypedArray.js]
+features: [SharedArrayBuffer, TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var bpe = TA.BYTES_PER_ELEMENT;
+  var buffer = new SharedArrayBuffer(bpe);
+
+  assert.throws(RangeError, function() {
+    new TA(buffer, 0, bpe * 2);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/excessive-length-throws.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/excessive-length-throws.js
new file mode 100644
index 0000000000..ab5836e944
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/excessive-length-throws.js
@@ -0,0 +1,33 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  If offset + newByteLength > bufferByteLength, throw a RangeError exception.
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  14. Else,
+    a. Let newLength be ? ToLength(length).
+    b. Let newByteLength be newLength × elementSize.
+    c. If offset+newByteLength > bufferByteLength, throw a RangeError exception.
+  ...
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var bpe = TA.BYTES_PER_ELEMENT;
+  var buffer = new ArrayBuffer(bpe);
+
+  assert.throws(RangeError, function() {
+    new TA(buffer, 0, bpe * 2);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/excessive-offset-throws-resizable-ab.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/excessive-offset-throws-resizable-ab.js
new file mode 100644
index 0000000000..0095a54485
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/excessive-offset-throws-resizable-ab.js
@@ -0,0 +1,25 @@
+// |reftest| shell-option(--enable-arraybuffer-resizable) skip-if(!ArrayBuffer.prototype.resize||!xulRuntime.shell) -- resizable-arraybuffer is not enabled unconditionally, requires shell-options
+// Copyright (C) 2021 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Throws a RangeError for resizable ArrayBuffers when offset > byteLength
+includes: [testTypedArray.js]
+features: [TypedArray, resizable-arraybuffer]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var BPE = TA.BYTES_PER_ELEMENT;
+  var buffer = new ArrayBuffer(BPE, {maxByteLength: BPE});
+
+  assert.throws(RangeError, function() {
+    new TA(buffer, BPE * 2);
+  });
+
+  assert.throws(RangeError, function() {
+    new TA(buffer, BPE * 2, undefined);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/excessive-offset-throws-sab.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/excessive-offset-throws-sab.js
new file mode 100644
index 0000000000..bba14855bf
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/excessive-offset-throws-sab.js
@@ -0,0 +1,39 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Throws a RangeError if bufferByteLength - ToInteger(byteOffset) < 0
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  13. If length is undefined, then
+    a. If bufferByteLength modulo elementSize ≠ 0, throw a RangeError exception.
+    b. Let newByteLength be bufferByteLength - offset.
+    c. If newByteLength < 0, throw a RangeError exception.
+  ...
+includes: [testTypedArray.js]
+features: [SharedArrayBuffer, TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var bpe = TA.BYTES_PER_ELEMENT;
+  var buffer = new SharedArrayBuffer(bpe);
+
+  assert.throws(RangeError, function() {
+    new TA(buffer, bpe * 2);
+  });
+
+  assert.throws(RangeError, function() {
+    new TA(buffer, bpe * 2, undefined);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/excessive-offset-throws.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/excessive-offset-throws.js
new file mode 100644
index 0000000000..17d39e4ea5
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/excessive-offset-throws.js
@@ -0,0 +1,37 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Throws a RangeError if bufferByteLength - ToInteger(byteOffset) < 0
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  13. If length is undefined, then
+    a. If bufferByteLength modulo elementSize ≠ 0, throw a RangeError exception.
+    b. Let newByteLength be bufferByteLength - offset.
+    c. If newByteLength < 0, throw a RangeError exception.
+  ...
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var bpe = TA.BYTES_PER_ELEMENT;
+  var buffer = new ArrayBuffer(bpe);
+
+  assert.throws(RangeError, function() {
+    new TA(buffer, bpe * 2);
+  });
+
+  assert.throws(RangeError, function() {
+    new TA(buffer, bpe * 2, undefined);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/invoked-with-undefined-newtarget-sab.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/invoked-with-undefined-newtarget-sab.js
new file mode 100644
index 0000000000..d08a6e8f7f
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/invoked-with-undefined-newtarget-sab.js
@@ -0,0 +1,30 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Throws a TypeError if NewTarget is undefined.
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  2. If NewTarget is undefined, throw a TypeError exception.
+  ...
+includes: [testTypedArray.js]
+features: [SharedArrayBuffer, TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var buffer = new SharedArrayBuffer(4);
+  assert.throws(TypeError, function() {
+    TA(buffer);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/invoked-with-undefined-newtarget.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/invoked-with-undefined-newtarget.js
new file mode 100644
index 0000000000..7b8abeb3aa
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/invoked-with-undefined-newtarget.js
@@ -0,0 +1,28 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Throws a TypeError if NewTarget is undefined.
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  2. If NewTarget is undefined, throw a TypeError exception.
+  ...
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var buffer = new ArrayBuffer(4);
+  assert.throws(TypeError, function() {
+    TA(buffer);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/is-referenced-sab.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/is-referenced-sab.js
new file mode 100644
index 0000000000..a7c268a073
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/is-referenced-sab.js
@@ -0,0 +1,36 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Reuse buffer argument instead of making a new clone
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  15. Set O's [[ViewedArrayBuffer]] internal slot to buffer.
+  ...
+includes: [testTypedArray.js]
+features: [SharedArrayBuffer, TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var bpe = TA.BYTES_PER_ELEMENT;
+
+  var buffer = new SharedArrayBuffer(bpe);
+
+  var ta1 = new TA(buffer);
+  var ta2 = new TA(buffer);
+
+  assert.sameValue(ta1.buffer, buffer);
+  assert.sameValue(ta2.buffer, buffer);
+  assert.sameValue(ta1.buffer, ta2.buffer);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/is-referenced.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/is-referenced.js
new file mode 100644
index 0000000000..9a7ad5ac4e
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/is-referenced.js
@@ -0,0 +1,34 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Reuse buffer argument instead of making a new clone
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  15. Set O's [[ViewedArrayBuffer]] internal slot to buffer.
+  ...
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var bpe = TA.BYTES_PER_ELEMENT;
+
+  var buffer = new ArrayBuffer(bpe);
+
+  var ta1 = new TA(buffer);
+  var ta2 = new TA(buffer);
+
+  assert.sameValue(ta1.buffer, buffer);
+  assert.sameValue(ta2.buffer, buffer);
+  assert.sameValue(ta1.buffer, ta2.buffer);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/length-access-throws-sab.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/length-access-throws-sab.js
new file mode 100644
index 0000000000..e22085c72a
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/length-access-throws-sab.js
@@ -0,0 +1,37 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Returns abrupt from ToLength(length)
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  14. Else,
+    a. Let newLength be ? ToLength(length).
+  ...
+includes: [testTypedArray.js]
+features: [SharedArrayBuffer, TypedArray]
+---*/
+
+var buffer = new SharedArrayBuffer(8);
+var len = {
+  valueOf() {
+    throw new Test262Error();
+  }
+};
+
+testWithTypedArrayConstructors(function(TA) {
+  assert.throws(Test262Error, function() {
+    new TA(buffer, 0, len);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/length-access-throws.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/length-access-throws.js
new file mode 100644
index 0000000000..c05d709abc
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/length-access-throws.js
@@ -0,0 +1,35 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Returns abrupt from ToLength(length)
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  14. Else,
+    a. Let newLength be ? ToLength(length).
+  ...
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+var buffer = new ArrayBuffer(8);
+var len = {
+  valueOf() {
+    throw new Test262Error();
+  }
+};
+
+testWithTypedArrayConstructors(function(TA) {
+  assert.throws(Test262Error, function() {
+    new TA(buffer, 0, len);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/length-is-symbol-throws-sab.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/length-is-symbol-throws-sab.js
new file mode 100644
index 0000000000..61cc16a0cb
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/length-is-symbol-throws-sab.js
@@ -0,0 +1,33 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Throws a TypeError if length is a Symbol
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  14. Else,
+    a. Let newLength be ? ToLength(length).
+  ...
+includes: [testTypedArray.js]
+features: [Symbol, SharedArrayBuffer, TypedArray]
+---*/
+
+var buffer = new SharedArrayBuffer(8);
+var s = Symbol("1");
+
+testWithTypedArrayConstructors(function(TA) {
+  assert.throws(TypeError, function() {
+    new TA(buffer, 0, s);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/length-is-symbol-throws.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/length-is-symbol-throws.js
new file mode 100644
index 0000000000..f04940f4ee
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/length-is-symbol-throws.js
@@ -0,0 +1,31 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Throws a TypeError if length is a Symbol
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  14. Else,
+    a. Let newLength be ? ToLength(length).
+  ...
+includes: [testTypedArray.js]
+features: [Symbol, TypedArray]
+---*/
+
+var buffer = new ArrayBuffer(8);
+var s = Symbol("1");
+
+testWithTypedArrayConstructors(function(TA) {
+  assert.throws(TypeError, function() {
+    new TA(buffer, 0, s);
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/length-to-number-detachbuffer.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/length-to-number-detachbuffer.js
new file mode 100644
index 0000000000..47ff17be0e
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/length-to-number-detachbuffer.js
@@ -0,0 +1,23 @@
+// Copyright (C) 2017 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: If TypedArray() is passed a detached buffer, throw
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  ...
+  9. If IsDetachedBuffer(buffer) is true, throw a TypeError exception.
+  ...
+includes: [testTypedArray.js, detachArrayBuffer.js]
+features: [TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var offset = TA.BYTES_PER_ELEMENT;
+  var buffer = new ArrayBuffer(3 * offset);
+  var length = { valueOf() { $DETACHBUFFER(buffer); return 1; } };
+  assert.throws(TypeError, () => new TA(buffer, 0, length));
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/new-instance-extensibility-sab.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/new-instance-extensibility-sab.js
new file mode 100644
index 0000000000..be15fb3873
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/new-instance-extensibility-sab.js
@@ -0,0 +1,41 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  The new typedArray instance from a buffer argument is extensible
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  ...
+  4. Let O be ? AllocateTypedArray(constructorName, NewTarget,
+  "%TypedArrayPrototype%").
+  ...
+
+  22.2.4.2.1 Runtime Semantics: AllocateTypedArray (constructorName, newTarget,
+  defaultProto [ , length ])
+
+  ...
+  2. Let obj be IntegerIndexedObjectCreate(proto, « [[ViewedArrayBuffer]],
+  [[TypedArrayName]], [[ByteLength]], [[ByteOffset]], [[ArrayLength]] »).
+  ...
+
+  9.4.5.7 IntegerIndexedObjectCreate (prototype, internalSlotsList)
+
+  ...
+  11. Set the [[Extensible]] internal slot of A to true.
+  ...
+includes: [testTypedArray.js]
+features: [SharedArrayBuffer, TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var buffer = new SharedArrayBuffer(8);
+  var sample = new TA(buffer);
+
+  assert(Object.isExtensible(sample));
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/new-instance-extensibility.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/new-instance-extensibility.js
new file mode 100644
index 0000000000..14be0cdec5
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/new-instance-extensibility.js
@@ -0,0 +1,39 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  The new typedArray instance from a buffer argument is extensible
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  ...
+  4. Let O be ? AllocateTypedArray(constructorName, NewTarget,
+  "%TypedArrayPrototype%").
+  ...
+
+  22.2.4.2.1 Runtime Semantics: AllocateTypedArray (constructorName, newTarget,
+  defaultProto [ , length ])
+
+  ...
+  2. Let obj be IntegerIndexedObjectCreate(proto, « [[ViewedArrayBuffer]],
+  [[TypedArrayName]], [[ByteLength]], [[ByteOffset]], [[ArrayLength]] »).
+  ...
+
+  9.4.5.7 IntegerIndexedObjectCreate (prototype, internalSlotsList)
+
+  ...
+  11. Set the [[Extensible]] internal slot of A to true.
+  ...
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var buffer = new ArrayBuffer(8);
+  var sample = new TA(buffer);
+
+  assert(Object.isExtensible(sample));
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/proto-from-ctor-realm-sab.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/proto-from-ctor-realm-sab.js
new file mode 100644
index 0000000000..1da9bed6a2
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/proto-from-ctor-realm-sab.js
@@ -0,0 +1,41 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: Default [[Prototype]] value derived from realm of the newTarget
+info: |
+    [...]
+    4. Let O be ? AllocateTypedArray(constructorName, NewTarget,
+       "%TypedArrayPrototype%").
+    [...]
+
+    22.2.4.2.1 Runtime Semantics: AllocateTypedArray
+
+    1. Let proto be ? GetPrototypeFromConstructor(newTarget, defaultProto).
+    [...]
+
+    9.1.14 GetPrototypeFromConstructor
+
+    [...]
+    3. Let proto be ? Get(constructor, "prototype").
+    4. If Type(proto) is not Object, then
+       a. Let realm be ? GetFunctionRealm(constructor).
+       b. Let proto be realm's intrinsic object named intrinsicDefaultProto.
+    5. Return proto.
+includes: [testTypedArray.js]
+features: [cross-realm, SharedArrayBuffer, Reflect, TypedArray]
+---*/
+
+var other = $262.createRealm().global;
+var C = new other.Function();
+C.prototype = null;
+
+testWithTypedArrayConstructors(function(TA) {
+  var ta = Reflect.construct(TA, [new SharedArrayBuffer(8)], C);
+
+  assert.sameValue(Object.getPrototypeOf(ta), other[TA.name].prototype);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/proto-from-ctor-realm.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/proto-from-ctor-realm.js
new file mode 100644
index 0000000000..300629cadc
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/proto-from-ctor-realm.js
@@ -0,0 +1,39 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: Default [[Prototype]] value derived from realm of the newTarget
+info: |
+    [...]
+    4. Let O be ? AllocateTypedArray(constructorName, NewTarget,
+       "%TypedArrayPrototype%").
+    [...]
+
+    22.2.4.2.1 Runtime Semantics: AllocateTypedArray
+
+    1. Let proto be ? GetPrototypeFromConstructor(newTarget, defaultProto).
+    [...]
+
+    9.1.14 GetPrototypeFromConstructor
+
+    [...]
+    3. Let proto be ? Get(constructor, "prototype").
+    4. If Type(proto) is not Object, then
+       a. Let realm be ? GetFunctionRealm(constructor).
+       b. Let proto be realm's intrinsic object named intrinsicDefaultProto.
+    5. Return proto.
+includes: [testTypedArray.js]
+features: [cross-realm, Reflect, TypedArray]
+---*/
+
+var other = $262.createRealm().global;
+var C = new other.Function();
+C.prototype = null;
+
+testWithTypedArrayConstructors(function(TA) {
+  var ta = Reflect.construct(TA, [new ArrayBuffer(8)], C);
+
+  assert.sameValue(Object.getPrototypeOf(ta), other[TA.name].prototype);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/returns-new-instance-sab.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/returns-new-instance-sab.js
new file mode 100644
index 0000000000..17ea189089
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/returns-new-instance-sab.js
@@ -0,0 +1,37 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Return new typedArray from undefined offset and length
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+includes: [testTypedArray.js]
+features: [SharedArrayBuffer, TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var bpe = TA.BYTES_PER_ELEMENT;
+
+  var buffer1 = new SharedArrayBuffer(bpe * 4);
+  var ta1 = new TA(buffer1);
+  assert.sameValue(ta1.length, 4);
+  assert.sameValue(ta1.buffer, buffer1);
+  assert.sameValue(ta1.constructor, TA);
+  assert.sameValue(Object.getPrototypeOf(ta1), TA.prototype);
+
+  var buffer2 = new SharedArrayBuffer(0);
+  var ta2 = new TA(buffer2);
+  assert.sameValue(ta2.length, 0);
+  assert.sameValue(ta2.buffer, buffer2);
+  assert.sameValue(ta2.constructor, TA);
+  assert.sameValue(Object.getPrototypeOf(ta2), TA.prototype);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/returns-new-instance.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/returns-new-instance.js
new file mode 100644
index 0000000000..46bb08e0ec
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/returns-new-instance.js
@@ -0,0 +1,35 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Return new typedArray from undefined offset and length
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+testWithTypedArrayConstructors(function(TA) {
+  var bpe = TA.BYTES_PER_ELEMENT;
+
+  var buffer1 = new ArrayBuffer(bpe * 4);
+  var ta1 = new TA(buffer1);
+  assert.sameValue(ta1.length, 4);
+  assert.sameValue(ta1.buffer, buffer1);
+  assert.sameValue(ta1.constructor, TA);
+  assert.sameValue(Object.getPrototypeOf(ta1), TA.prototype);
+
+  var buffer2 = new ArrayBuffer(0);
+  var ta2 = new TA(buffer2);
+  assert.sameValue(ta2.length, 0);
+  assert.sameValue(ta2.buffer, buffer2);
+  assert.sameValue(ta2.constructor, TA);
+  assert.sameValue(Object.getPrototypeOf(ta2), TA.prototype);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/shell.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/shell.js
new file mode 100644
index 0000000000..7b3c9f20d6
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/shell.js
@@ -0,0 +1,179 @@
+// GENERATED, DO NOT EDIT
+// file: detachArrayBuffer.js
+// Copyright (C) 2016 the V8 project authors.  All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+description: |
+    A function used in the process of asserting correctness of TypedArray objects.
+
+    $262.detachArrayBuffer is defined by a host.
+defines: [$DETACHBUFFER]
+---*/
+
+function $DETACHBUFFER(buffer) {
+  if (!$262 || typeof $262.detachArrayBuffer !== "function") {
+    throw new Test262Error("No method available to detach an ArrayBuffer");
+  }
+  $262.detachArrayBuffer(buffer);
+}
+
+// file: testTypedArray.js
+// Copyright (C) 2015 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+description: |
+    Collection of functions used to assert the correctness of TypedArray objects.
+defines:
+  - floatArrayConstructors
+  - nonClampedIntArrayConstructors
+  - intArrayConstructors
+  - typedArrayConstructors
+  - TypedArray
+  - testWithTypedArrayConstructors
+  - nonAtomicsFriendlyTypedArrayConstructors
+  - testWithAtomicsFriendlyTypedArrayConstructors
+  - testWithNonAtomicsFriendlyTypedArrayConstructors
+  - testTypedArrayConversions
+---*/
+
+var floatArrayConstructors = [
+  Float64Array,
+  Float32Array
+];
+
+var nonClampedIntArrayConstructors = [
+  Int32Array,
+  Int16Array,
+  Int8Array,
+  Uint32Array,
+  Uint16Array,
+  Uint8Array
+];
+
+var intArrayConstructors = nonClampedIntArrayConstructors.concat([Uint8ClampedArray]);
+
+// Float16Array is a newer feature
+// adding it to this list unconditionally would cause implementations lacking it to fail every test which uses it
+if (typeof Float16Array !== 'undefined') {
+  floatArrayConstructors.push(Float16Array);
+}
+
+/**
+ * Array containing every non-bigint typed array constructor.
+ */
+
+var typedArrayConstructors = floatArrayConstructors.concat(intArrayConstructors);
+
+/**
+ * The %TypedArray% intrinsic constructor function.
+ */
+var TypedArray = Object.getPrototypeOf(Int8Array);
+
+/**
+ * Callback for testing a typed array constructor.
+ *
+ * @callback typedArrayConstructorCallback
+ * @param {Function} Constructor the constructor object to test with.
+ */
+
+/**
+ * Calls the provided function for every typed array constructor.
+ *
+ * @param {typedArrayConstructorCallback} f - the function to call for each typed array constructor.
+ * @param {Array} selected - An optional Array with filtered typed arrays
+ */
+function testWithTypedArrayConstructors(f, selected) {
+  var constructors = selected || typedArrayConstructors;
+  for (var i = 0; i < constructors.length; ++i) {
+    var constructor = constructors[i];
+    try {
+      f(constructor);
+    } catch (e) {
+      e.message += " (Testing with " + constructor.name + ".)";
+      throw e;
+    }
+  }
+}
+
+var nonAtomicsFriendlyTypedArrayConstructors = floatArrayConstructors.concat([Uint8ClampedArray]);
+/**
+ * Calls the provided function for every non-"Atomics Friendly" typed array constructor.
+ *
+ * @param {typedArrayConstructorCallback} f - the function to call for each typed array constructor.
+ * @param {Array} selected - An optional Array with filtered typed arrays
+ */
+function testWithNonAtomicsFriendlyTypedArrayConstructors(f) {
+  testWithTypedArrayConstructors(f, nonAtomicsFriendlyTypedArrayConstructors);
+}
+
+/**
+ * Calls the provided function for every "Atomics Friendly" typed array constructor.
+ *
+ * @param {typedArrayConstructorCallback} f - the function to call for each typed array constructor.
+ * @param {Array} selected - An optional Array with filtered typed arrays
+ */
+function testWithAtomicsFriendlyTypedArrayConstructors(f) {
+  testWithTypedArrayConstructors(f, [
+    Int32Array,
+    Int16Array,
+    Int8Array,
+    Uint32Array,
+    Uint16Array,
+    Uint8Array,
+  ]);
+}
+
+/**
+ * Helper for conversion operations on TypedArrays, the expected values
+ * properties are indexed in order to match the respective value for each
+ * TypedArray constructor
+ * @param  {Function} fn - the function to call for each constructor and value.
+ *                         will be called with the constructor, value, expected
+ *                         value, and a initial value that can be used to avoid
+ *                         a false positive with an equivalent expected value.
+ */
+function testTypedArrayConversions(byteConversionValues, fn) {
+  var values = byteConversionValues.values;
+  var expected = byteConversionValues.expected;
+
+  testWithTypedArrayConstructors(function(TA) {
+    var name = TA.name.slice(0, -5);
+
+    return values.forEach(function(value, index) {
+      var exp = expected[name][index];
+      var initial = 0;
+      if (exp === 0) {
+        initial = 1;
+      }
+      fn(TA, value, exp, initial);
+    });
+  });
+}
+
+/**
+ * Checks if the given argument is one of the float-based TypedArray constructors.
+ *
+ * @param {constructor} ctor - the value to check
+ * @returns {boolean}
+ */
+function isFloatTypedArrayConstructor(arg) {
+  return floatArrayConstructors.indexOf(arg) !== -1;
+}
+
+/**
+ * Determines the precision of the given float-based TypedArray constructor.
+ *
+ * @param {constructor} ctor - the value to check
+ * @returns {string} "half", "single", or "double" for Float16Array, Float32Array, and Float64Array respectively.
+ */
+function floatTypedArrayConstructorPrecision(FA) {
+  if (typeof Float16Array !== "undefined" && FA === Float16Array) {
+    return "half";
+  } else if (FA === Float32Array) {
+    return "single";
+  } else if (FA === Float64Array) {
+    return "double";
+  } else {
+    throw new Error("Malformed test - floatTypedArrayConstructorPrecision called with non-float TypedArray");
+  }
+}
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/toindex-bytelength-sab.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/toindex-bytelength-sab.js
new file mode 100644
index 0000000000..f95a6366a1
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/toindex-bytelength-sab.js
@@ -0,0 +1,76 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  ToIndex(length) operations
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  11. If length is either not present or undefined, then
+    ...
+  12. Else,
+    a. Let newLength be ? ToIndex(length).
+  ...
+includes: [testTypedArray.js]
+features: [SharedArrayBuffer, TypedArray]
+---*/
+
+var buffer = new SharedArrayBuffer(16);
+
+var obj1 = {
+  valueOf: function() {
+    return 1;
+  }
+};
+
+var obj2 = {
+  toString: function() {
+    return 1;
+  }
+};
+
+var items = [
+  [-0, 0, "-0"],
+  [obj1, 1, "object's valueOf"],
+  [obj2, 1, "object's toString"],
+  ["", 0, "the Empty string"],
+  ["0", 0, "string '0'"],
+  ["1", 1, "string '1'"],
+  [false, 0, "false"],
+  [true, 1, "true"],
+  [NaN, 0, "NaN"],
+  [null, 0, "null"],
+  [0.1, 0, "0.1"],
+  [0.9, 0, "0.9"],
+  [1.1, 1, "1.1"],
+  [1.9, 1, "1.9"],
+  [-0.1, 0, "-0.1"],
+  [-0.99999, 0, "-0.99999"]
+];
+
+testWithTypedArrayConstructors(function(TA) {
+  items.forEach(function(item) {
+    var len = item[0];
+    var expected = item[1];
+    var name = item[2];
+
+    var typedArray = new TA(buffer, 0, len);
+    assert.sameValue(typedArray.length, expected, name + " length");
+    assert.sameValue(typedArray.constructor, TA, name + " constructor");
+    assert.sameValue(
+      Object.getPrototypeOf(typedArray),
+      TA.prototype,
+      name + " prototype"
+    );
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/toindex-bytelength.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/toindex-bytelength.js
new file mode 100644
index 0000000000..062330df84
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/toindex-bytelength.js
@@ -0,0 +1,74 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  ToIndex(length) operations
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  11. If length is either not present or undefined, then
+    ...
+  12. Else,
+    a. Let newLength be ? ToIndex(length).
+  ...
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+var buffer = new ArrayBuffer(16);
+
+var obj1 = {
+  valueOf: function() {
+    return 1;
+  }
+};
+
+var obj2 = {
+  toString: function() {
+    return 1;
+  }
+};
+
+var items = [
+  [-0, 0, "-0"],
+  [obj1, 1, "object's valueOf"],
+  [obj2, 1, "object's toString"],
+  ["", 0, "the Empty string"],
+  ["0", 0, "string '0'"],
+  ["1", 1, "string '1'"],
+  [false, 0, "false"],
+  [true, 1, "true"],
+  [NaN, 0, "NaN"],
+  [null, 0, "null"],
+  [0.1, 0, "0.1"],
+  [0.9, 0, "0.9"],
+  [1.1, 1, "1.1"],
+  [1.9, 1, "1.9"],
+  [-0.1, 0, "-0.1"],
+  [-0.99999, 0, "-0.99999"]
+];
+
+testWithTypedArrayConstructors(function(TA) {
+  items.forEach(function(item) {
+    var len = item[0];
+    var expected = item[1];
+    var name = item[2];
+
+    var typedArray = new TA(buffer, 0, len);
+    assert.sameValue(typedArray.length, expected, name + " length");
+    assert.sameValue(typedArray.constructor, TA, name + " constructor");
+    assert.sameValue(
+      Object.getPrototypeOf(typedArray),
+      TA.prototype,
+      name + " prototype"
+    );
+  });
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/toindex-byteoffset-sab.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/toindex-byteoffset-sab.js
new file mode 100644
index 0000000000..8ba2f41b9c
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/toindex-byteoffset-sab.js
@@ -0,0 +1,90 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  ToIndex(byteOffset) operations
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  7. Let offset be ? ToIndex(byteOffset).
+  8. If offset modulo elementSize ≠ 0, throw a RangeError exception.
+  ...
+includes: [testTypedArray.js]
+features: [SharedArrayBuffer, TypedArray]
+---*/
+
+var buffer = new SharedArrayBuffer(16);
+
+var obj1 = {
+  valueOf: function() {
+    return 8;
+  }
+};
+
+var obj2 = {
+  toString: function() {
+    return 8;
+  }
+};
+
+var items = [
+  [-0, 0, "-0"],
+  [obj1, 8, "object's valueOf"],
+  [obj2, 8, "object's toString"],
+  ["", 0, "the Empty string"],
+  ["0", 0, "string '0'"],
+  ["8", 8, "string '8'"],
+  [false, 0, "false"],
+  [NaN, 0, "NaN"],
+  [null, 0, "null"],
+  [undefined, 0, "undefined"],
+  [0.1, 0, "0.1"],
+  [0.9, 0, "0.9"],
+  [8.1, 8, "8.1"],
+  [8.9, 8, "8.9"],
+  [-0.1, 0, "-0.1"],
+  [-0.99999, 0, "-0.99999"]
+];
+
+testWithTypedArrayConstructors(function(TA) {
+  items.forEach(function(item) {
+    var offset = item[0];
+    var expected = item[1];
+    var name = item[2];
+
+    var typedArray = new TA(buffer, offset);
+    assert.sameValue(typedArray.byteOffset, expected, name + " byteOffset");
+    assert.sameValue(typedArray.constructor, TA, name + " constructor");
+    assert.sameValue(
+      Object.getPrototypeOf(typedArray),
+      TA.prototype,
+      name + " prototype"
+    );
+  });
+
+  // Testing `true`. See step 8
+  if (TA.BYTES_PER_ELEMENT === 1) {
+    var typedArray = new TA(buffer, true);
+    assert.sameValue(typedArray.byteOffset, 1, "true => 1 byteOffset");
+    assert.sameValue(typedArray.constructor, TA, "true => 1 constructor");
+    assert.sameValue(
+      Object.getPrototypeOf(typedArray),
+      TA.prototype,
+      "true => 1 prototype"
+    );
+  } else {
+    assert.throws(RangeError, function() {
+      new TA(buffer, true);
+    }, "1 modulo elementSize ≠ 0, throws a RangeError");
+  }
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/toindex-byteoffset.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/toindex-byteoffset.js
new file mode 100644
index 0000000000..66a3629446
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/toindex-byteoffset.js
@@ -0,0 +1,88 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  ToIndex(byteOffset) operations
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  7. Let offset be ? ToIndex(byteOffset).
+  8. If offset modulo elementSize ≠ 0, throw a RangeError exception.
+  ...
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+var buffer = new ArrayBuffer(16);
+
+var obj1 = {
+  valueOf: function() {
+    return 8;
+  }
+};
+
+var obj2 = {
+  toString: function() {
+    return 8;
+  }
+};
+
+var items = [
+  [-0, 0, "-0"],
+  [obj1, 8, "object's valueOf"],
+  [obj2, 8, "object's toString"],
+  ["", 0, "the Empty string"],
+  ["0", 0, "string '0'"],
+  ["8", 8, "string '8'"],
+  [false, 0, "false"],
+  [NaN, 0, "NaN"],
+  [null, 0, "null"],
+  [undefined, 0, "undefined"],
+  [0.1, 0, "0.1"],
+  [0.9, 0, "0.9"],
+  [8.1, 8, "8.1"],
+  [8.9, 8, "8.9"],
+  [-0.1, 0, "-0.1"],
+  [-0.99999, 0, "-0.99999"]
+];
+
+testWithTypedArrayConstructors(function(TA) {
+  items.forEach(function(item) {
+    var offset = item[0];
+    var expected = item[1];
+    var name = item[2];
+
+    var typedArray = new TA(buffer, offset);
+    assert.sameValue(typedArray.byteOffset, expected, name + " byteOffset");
+    assert.sameValue(typedArray.constructor, TA, name + " constructor");
+    assert.sameValue(
+      Object.getPrototypeOf(typedArray),
+      TA.prototype,
+      name + " prototype"
+    );
+  });
+
+  // Testing `true`. See step 8
+  if (TA.BYTES_PER_ELEMENT === 1) {
+    var typedArray = new TA(buffer, true);
+    assert.sameValue(typedArray.byteOffset, 1, "true => 1 byteOffset");
+    assert.sameValue(typedArray.constructor, TA, "true => 1 constructor");
+    assert.sameValue(
+      Object.getPrototypeOf(typedArray),
+      TA.prototype,
+      "true => 1 prototype"
+    );
+  } else {
+    assert.throws(RangeError, function() {
+      new TA(buffer, true);
+    }, "1 modulo elementSize ≠ 0, throws a RangeError");
+  }
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/typedarray-backed-by-sharedarraybuffer.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/typedarray-backed-by-sharedarraybuffer.js
new file mode 100644
index 0000000000..2ba3df217a
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/typedarray-backed-by-sharedarraybuffer.js
@@ -0,0 +1,26 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-typedarray-typedarray
+description: >
+  Passing a SharedArrayBuffer-backed TypedArray to a TypedArray constructor
+  produces an ArrayBuffer-backed TypedArray.
+includes: [testTypedArray.js]
+features: [SharedArrayBuffer, TypedArray]
+---*/
+
+var sab = new SharedArrayBuffer(4);
+var int_views = [Int8Array, Uint8Array, Int16Array, Uint16Array, Int32Array, Uint32Array];
+
+testWithTypedArrayConstructors(function(View1) {
+  var ta1 = new View1(sab);
+  testWithTypedArrayConstructors(function(View2) {
+    var ta2 = new View2(ta1);
+    assert.sameValue(ta2.buffer.constructor, ArrayBuffer,
+                     "TypedArray of SharedArrayBuffer-backed TypedArray is ArrayBuffer-backed");
+  }, int_views);
+}, int_views);
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/use-custom-proto-if-object-sab.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/use-custom-proto-if-object-sab.js
new file mode 100644
index 0000000000..1b67197f02
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/use-custom-proto-if-object-sab.js
@@ -0,0 +1,52 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Use prototype from new target if it's an Object
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  4. Let O be ? AllocateTypedArray(constructorName, NewTarget,
+  %TypedArrayPrototype%).
+  ...
+
+  22.2.4.2.1 Runtime Semantics: AllocateTypedArray (constructorName, newTarget,
+  defaultProto [ , length ])
+
+  1. Let proto be ? GetPrototypeFromConstructor(newTarget, defaultProto).
+  2. Let obj be IntegerIndexedObjectCreate (proto, «[[ViewedArrayBuffer]],
+  [[TypedArrayName]], [[ByteLength]], [[ByteOffset]], [[ArrayLength]]» ).
+  ...
+
+  9.4.5.7 IntegerIndexedObjectCreate (prototype, internalSlotsList)
+
+  ...
+  10. Set the [[Prototype]] internal slot of A to prototype.
+  ...
+  12. Return A.
+includes: [testTypedArray.js]
+features: [SharedArrayBuffer, Reflect, TypedArray]
+---*/
+
+var buffer = new SharedArrayBuffer(8);
+
+function newTarget() {}
+var proto = {};
+newTarget.prototype = proto;
+
+testWithTypedArrayConstructors(function(TA) {
+  var ta = Reflect.construct(TA, [buffer], newTarget);
+
+  assert.sameValue(ta.constructor, Object);
+  assert.sameValue(Object.getPrototypeOf(ta), proto);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/use-custom-proto-if-object.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/use-custom-proto-if-object.js
new file mode 100644
index 0000000000..aad34833ca
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/use-custom-proto-if-object.js
@@ -0,0 +1,50 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Use prototype from new target if it's an Object
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  4. Let O be ? AllocateTypedArray(constructorName, NewTarget,
+  %TypedArrayPrototype%).
+  ...
+
+  22.2.4.2.1 Runtime Semantics: AllocateTypedArray (constructorName, newTarget,
+  defaultProto [ , length ])
+
+  1. Let proto be ? GetPrototypeFromConstructor(newTarget, defaultProto).
+  2. Let obj be IntegerIndexedObjectCreate (proto, «[[ViewedArrayBuffer]],
+  [[TypedArrayName]], [[ByteLength]], [[ByteOffset]], [[ArrayLength]]» ).
+  ...
+
+  9.4.5.7 IntegerIndexedObjectCreate (prototype, internalSlotsList)
+
+  ...
+  10. Set the [[Prototype]] internal slot of A to prototype.
+  ...
+  12. Return A.
+includes: [testTypedArray.js]
+features: [Reflect, TypedArray]
+---*/
+
+var buffer = new ArrayBuffer(8);
+
+function newTarget() {}
+var proto = {};
+newTarget.prototype = proto;
+
+testWithTypedArrayConstructors(function(TA) {
+  var ta = Reflect.construct(TA, [buffer], newTarget);
+
+  assert.sameValue(ta.constructor, Object);
+  assert.sameValue(Object.getPrototypeOf(ta), proto);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/use-default-proto-if-custom-proto-is-not-object-sab.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/use-default-proto-if-custom-proto-is-not-object-sab.js
new file mode 100644
index 0000000000..21086e7a26
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/use-default-proto-if-custom-proto-is-not-object-sab.js
@@ -0,0 +1,51 @@
+// |reftest| skip-if(!this.hasOwnProperty('SharedArrayBuffer')) -- SharedArrayBuffer is not enabled unconditionally
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Use prototype from %TypedArray% if newTarget's prototype is not an Object
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  4. Let O be ? AllocateTypedArray(constructorName, NewTarget,
+  %TypedArrayPrototype%).
+  ...
+
+  22.2.4.2.1 Runtime Semantics: AllocateTypedArray (constructorName, newTarget,
+  defaultProto [ , length ])
+
+  1. Let proto be ? GetPrototypeFromConstructor(newTarget, defaultProto).
+  2. Let obj be IntegerIndexedObjectCreate (proto, «[[ViewedArrayBuffer]],
+  [[TypedArrayName]], [[ByteLength]], [[ByteOffset]], [[ArrayLength]]» ).
+  ...
+
+  9.4.5.7 IntegerIndexedObjectCreate (prototype, internalSlotsList)
+
+  ...
+  10. Set the [[Prototype]] internal slot of A to prototype.
+  ...
+  12. Return A.
+includes: [testTypedArray.js]
+features: [SharedArrayBuffer, TypedArray]
+---*/
+
+var buffer = new SharedArrayBuffer(8);
+
+function newTarget() {}
+newTarget.prototype = null;
+
+testWithTypedArrayConstructors(function(TA) {
+  var ta = Reflect.construct(TA, [buffer], newTarget);
+
+  assert.sameValue(ta.constructor, TA);
+  assert.sameValue(Object.getPrototypeOf(ta), TA.prototype);
+});
+
+reportCompare(0, 0);
diff --git a/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/use-default-proto-if-custom-proto-is-not-object.js b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/use-default-proto-if-custom-proto-is-not-object.js
new file mode 100644
index 0000000000..dfef9bdf32
--- /dev/null
+++ b/js/src/tests/test262/built-ins/TypedArrayConstructors/ctors/buffer-arg/use-default-proto-if-custom-proto-is-not-object.js
@@ -0,0 +1,49 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-typedarray-buffer-byteoffset-length
+description: >
+  Use prototype from %TypedArray% if newTarget's prototype is not an Object
+info: |
+  22.2.4.5 TypedArray ( buffer [ , byteOffset [ , length ] ] )
+
+  This description applies only if the TypedArray function is called with at
+  least one argument and the Type of the first argument is Object and that
+  object has an [[ArrayBufferData]] internal slot.
+
+  ...
+  4. Let O be ? AllocateTypedArray(constructorName, NewTarget,
+  %TypedArrayPrototype%).
+  ...
+
+  22.2.4.2.1 Runtime Semantics: AllocateTypedArray (constructorName, newTarget,
+  defaultProto [ , length ])
+
+  1. Let proto be ? GetPrototypeFromConstructor(newTarget, defaultProto).
+  2. Let obj be IntegerIndexedObjectCreate (proto, «[[ViewedArrayBuffer]],
+  [[TypedArrayName]], [[ByteLength]], [[ByteOffset]], [[ArrayLength]]» ).
+  ...
+
+  9.4.5.7 IntegerIndexedObjectCreate (prototype, internalSlotsList)
+
+  ...
+  10. Set the [[Prototype]] internal slot of A to prototype.
+  ...
+  12. Return A.
+includes: [testTypedArray.js]
+features: [TypedArray]
+---*/
+
+var buffer = new ArrayBuffer(8);
+
+function newTarget() {}
+newTarget.prototype = null;
+
+testWithTypedArrayConstructors(function(TA) {
+  var ta = Reflect.construct(TA, [buffer], newTarget);
+
+  assert.sameValue(ta.constructor, TA);
+  assert.sameValue(Object.getPrototypeOf(ta), TA.prototype);
+});
+
+reportCompare(0, 0);