Reland "[rab/gsab] Update to the new spec"

- Remove ResizableArrayBuffer / GrowableSharedArrayBuffer constructors,
use options bags
- Add AB.prototype.resizable and SAB.prototype.growable
- Update receiver checks in (S?)AB.prototype methods

Previous try: https://chromium-review.googlesource.com/c/v8/v8/+/3021174

Bug: v8:11111
Change-Id: Ib4e98aa987826fd01bfdcf7688310ec0665f33ca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3035770
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75803}

src/builtins/arraybuffer.tq

@@ -18,115 +18,103 @@ transitioning javascript builtin ArrayBufferPrototypeGetByteLength(
     ThrowTypeError(
         MessageTemplate::kIncompatibleMethodReceiver, functionName, receiver);
   }
-  // 4. If IsResizableArrayBuffer(O) is true, throw a TypeError exception.
-  if (IsResizableArrayBuffer(o)) {
-    ThrowTypeError(
-        MessageTemplate::kIncompatibleMethodReceiver, functionName, receiver);
-  }
-  // 5. If IsDetachedBuffer(O) is true, throw a TypeError exception.
-  // TODO(v8:4895): We don't actually throw here.
-  // 6. Let length be O.[[ArrayBufferByteLength]].
+  // 4. Let length be O.[[ArrayBufferByteLength]].
   const length = o.byte_length;
-  // 7. Return length.
+  // 5. Return length.
   return Convert<Number>(length);
 }
 
-// #sec-get-sharedarraybuffer.prototype.bytelength
-transitioning javascript builtin SharedArrayBufferPrototypeGetByteLength(
+// #sec-get-arraybuffer.prototype.maxbytelength
+transitioning javascript builtin ArrayBufferPrototypeGetMaxByteLength(
     js-implicit context: NativeContext, receiver: JSAny)(): Number {
   // 1. Let O be the this value.
   // 2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
-  const functionName = 'get SharedArrayBuffer.prototype.byteLength';
+  const functionName = 'get ArrayBuffer.prototype.maxByteLength';
   const o = Cast<JSArrayBuffer>(receiver) otherwise
   ThrowTypeError(
       MessageTemplate::kIncompatibleMethodReceiver, functionName, receiver);
-  // 3. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
-  if (!IsSharedArrayBuffer(o)) {
+  // 3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
+  if (IsSharedArrayBuffer(o)) {
     ThrowTypeError(
         MessageTemplate::kIncompatibleMethodReceiver, functionName, receiver);
   }
-  // 4. If IsResizableArrayBuffer(O) is true, throw a TypeError exception.
-  if (IsResizableArrayBuffer(o)) {
-    ThrowTypeError(
-        MessageTemplate::kIncompatibleMethodReceiver, functionName, receiver);
+  // 4. If IsDetachedBuffer(O) is true, return 0_F.
+  if (IsDetachedBuffer(o)) {
+    return 0;
   }
-  // 5. Let length be O.[[ArrayBufferByteLength]].
-  const length = o.byte_length;
-  // 6. Return length.
-  return Convert<Number>(length);
+  // 5. If IsResizableArrayBuffer(O) is true, then
+  //   a. Let length be O.[[ArrayBufferMaxByteLength]].
+  // 6. Else,
+  //   a. Let length be O.[[ArrayBufferByteLength]].
+  // 7. Return F(length);
+  assert(IsResizableArrayBuffer(o) || o.max_byte_length == o.byte_length);
+  return Convert<Number>(o.max_byte_length);
 }
 
-// #sec-get-resizablearraybuffer.prototype.bytelength
-transitioning javascript builtin ResizableArrayBufferPrototypeGetByteLength(
-    js-implicit context: NativeContext, receiver: JSAny)(): Number {
+// #sec-get-arraybuffer.prototype.resizable
+transitioning javascript builtin ArrayBufferPrototypeGetResizable(
+    js-implicit context: NativeContext, receiver: JSAny)(): Boolean {
   // 1. Let O be the this value.
-  // 2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
-  const functionName = 'get ResizableArrayBuffer.prototype.byteLength';
+  // 2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  const functionName = 'get ArrayBuffer.prototype.resizable';
   const o = Cast<JSArrayBuffer>(receiver) otherwise
   ThrowTypeError(
       MessageTemplate::kIncompatibleMethodReceiver, functionName, receiver);
-  if (!IsResizableArrayBuffer(o)) {
-    ThrowTypeError(
-        MessageTemplate::kIncompatibleMethodReceiver, functionName, receiver);
-  }
   // 3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
   if (IsSharedArrayBuffer(o)) {
     ThrowTypeError(
         MessageTemplate::kIncompatibleMethodReceiver, functionName, receiver);
   }
-  // 4. Let length be O.[[ArrayBufferByteLength]].
-  const length = o.byte_length;
-  // 5. Return length.
-  return Convert<Number>(length);
+  // 4. Return IsResizableArrayBuffer(O).
+  if (IsResizableArrayBuffer(o)) {
+    return True;
+  }
+  return False;
 }
 
-// #sec-get-resizablearraybuffer.prototype.maxbytelength
-transitioning javascript builtin ResizableArrayBufferPrototypeGetMaxByteLength(
+// #sec-get-growablesharedarraybuffer.prototype.maxbytelength
+transitioning javascript builtin
+SharedArrayBufferPrototypeGetMaxByteLength(
     js-implicit context: NativeContext, receiver: JSAny)(): Number {
   // 1. Let O be the this value.
-  // 2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
-  const functionName = 'get ResizableArrayBuffer.prototype.maxByteLength';
+  // 2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  const functionName = 'get SharedArrayBuffer.prototype.maxByteLength';
   const o = Cast<JSArrayBuffer>(receiver) otherwise
   ThrowTypeError(
       MessageTemplate::kIncompatibleMethodReceiver, functionName, receiver);
-  if (!IsResizableArrayBuffer(o)) {
-    ThrowTypeError(
-        MessageTemplate::kIncompatibleMethodReceiver, functionName, receiver);
-  }
-  // 3. If IsSharedArrayBuffer(O) is true, throw a TypeError exception.
-  if (IsSharedArrayBuffer(o)) {
+  // 3. If IsSharedArrayBuffer(O) is false, throw a TypeError exception.
+  if (!IsSharedArrayBuffer(o)) {
     ThrowTypeError(
         MessageTemplate::kIncompatibleMethodReceiver, functionName, receiver);
   }
-  // 4. Let length be O.[[ArrayBufferMaxByteLength]].
-  const length = o.max_byte_length;
-  // 5. Return length.
-  return Convert<Number>(length);
+  // 4. If IsResizableArrayBuffer(O) is true, then
+  //   a. Let length be O.[[ArrayBufferMaxByteLength]].
+  // 5. Else,
+  //   a. Let length be O.[[ArrayBufferByteLength]].
+  // 6. Return F(length);
+  assert(IsResizableArrayBuffer(o) || o.max_byte_length == o.byte_length);
+  return Convert<Number>(o.max_byte_length);
 }
 
-// #sec-get-growablesharedarraybuffer.prototype.maxbytelength
-transitioning javascript builtin
-GrowableSharedArrayBufferPrototypeGetMaxByteLength(
-    js-implicit context: NativeContext, receiver: JSAny)(): Number {
+// #sec-get-sharedarraybuffer.prototype.growable
+transitioning javascript builtin SharedArrayBufferPrototypeGetGrowable(
+    js-implicit context: NativeContext, receiver: JSAny)(): Boolean {
   // 1. Let O be the this value.
-  // 2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxByteLength]]).
-  const functionName = 'get GrowableSharedArrayBuffer.prototype.maxByteLength';
+  // 2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
+  const functionName = 'get SharedArrayBuffer.prototype.growable';
   const o = Cast<JSArrayBuffer>(receiver) otherwise
   ThrowTypeError(
       MessageTemplate::kIncompatibleMethodReceiver, functionName, receiver);
-  if (!IsResizableArrayBuffer(o)) {
-    ThrowTypeError(
-        MessageTemplate::kIncompatibleMethodReceiver, functionName, receiver);
-  }
   // 3. If IsSharedArrayBuffer(O) is false, throw a TypeError exception.
   if (!IsSharedArrayBuffer(o)) {
     ThrowTypeError(
         MessageTemplate::kIncompatibleMethodReceiver, functionName, receiver);
   }
-  // 4. Let length be O.[[ArrayBufferMaxByteLength]].
-  const length = o.max_byte_length;
-  // 5. Return length.
-  return Convert<Number>(length);
+  // 4. Return IsResizableArrayBuffer(O).
+  if (IsResizableArrayBuffer(o)) {
+    return True;
+  }
+  return False;
 }
 
 // #sec-arraybuffer.isview

src/builtins/builtins-arraybuffer.cc

@@ -50,16 +50,11 @@ bool RoundUpToPageSize(size_t byte_length, size_t page_size,
 Object ConstructBuffer(Isolate* isolate, Handle<JSFunction> target,
                        Handle<JSReceiver> new_target, Handle<Object> length,
                        Handle<Object> max_length, InitializedFlag initialized) {
-  SharedFlag shared =
-      (*target != target->native_context().array_buffer_fun() &&
-       *target != target->native_context().resizable_array_buffer_fun())
-          ? SharedFlag::kShared
-          : SharedFlag::kNotShared;
-  ResizableFlag resizable =
-      (*target == target->native_context().resizable_array_buffer_fun() ||
-       *target == target->native_context().growable_shared_array_buffer_fun())
-          ? ResizableFlag::kResizable
-          : ResizableFlag::kNotResizable;
+  SharedFlag shared = *target != target->native_context().array_buffer_fun()
+                          ? SharedFlag::kShared
+                          : SharedFlag::kNotShared;
+  ResizableFlag resizable = max_length.is_null() ? ResizableFlag::kNotResizable
+                                                 : ResizableFlag::kResizable;
   Handle<JSObject> result;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, result,
@@ -83,12 +78,9 @@ Object ConstructBuffer(Isolate* isolate, Handle<JSFunction> target,
   if (resizable == ResizableFlag::kNotResizable) {
     backing_store =
         BackingStore::Allocate(isolate, byte_length, shared, initialized);
+    max_byte_length = byte_length;
   } else {
-    Handle<Object> number_max_length;
-    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, number_max_length,
-                                       Object::ToInteger(isolate, max_length));
-
-    if (!TryNumberToSize(*number_max_length, &max_byte_length)) {
+    if (!TryNumberToSize(*max_length, &max_byte_length)) {
       THROW_NEW_ERROR_RETURN_FAILURE(
           isolate,
           NewRangeError(MessageTemplate::kInvalidArrayBufferMaxLength));
@@ -137,10 +129,7 @@ BUILTIN(ArrayBufferConstructor) {
   HandleScope scope(isolate);
   Handle<JSFunction> target = args.target();
   DCHECK(*target == target->native_context().array_buffer_fun() ||
-         *target == target->native_context().shared_array_buffer_fun() ||
-         *target == target->native_context().resizable_array_buffer_fun() ||
-         *target ==
-             target->native_context().growable_shared_array_buffer_fun());
+         *target == target->native_context().shared_array_buffer_fun());
   if (args.new_target()->IsUndefined(isolate)) {  // [[Call]]
     THROW_NEW_ERROR_RETURN_FAILURE(
         isolate, NewTypeError(MessageTemplate::kConstructorNotFunction,
@@ -158,9 +147,22 @@ BUILTIN(ArrayBufferConstructor) {
         isolate, NewRangeError(MessageTemplate::kInvalidArrayBufferLength));
   }
 
-  Handle<Object> max_length = args.atOrUndefined(isolate, 2);
-  return ConstructBuffer(isolate, target, new_target, number_length, max_length,
-                         InitializedFlag::kZeroInitialized);
+  Handle<Object> number_max_length;
+  if (FLAG_harmony_rab_gsab) {
+    Handle<Object> max_length;
+    Handle<Object> options = args.atOrUndefined(isolate, 2);
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+        isolate, max_length,
+        JSObject::ReadFromOptionsBag(
+            options, isolate->factory()->max_byte_length_string(), isolate));
+
+    if (!max_length->IsUndefined(isolate)) {
+      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+          isolate, number_max_length, Object::ToInteger(isolate, max_length));
+    }
+  }
+  return ConstructBuffer(isolate, target, new_target, number_length,
+                         number_max_length, InitializedFlag::kZeroInitialized);
 }
 
 // This is a helper to construct an ArrayBuffer with uinitialized memory.
@@ -462,45 +464,45 @@ static Object ResizeHelper(BuiltinArguments args, Isolate* isolate,
   return ReadOnlyRoots(isolate).undefined_value();
 }
 
-// ES #sec-get-growablesharedarraybuffer.prototype.bytelength
-// get GrowableSharedArrayBuffer.prototype.byteLength
-BUILTIN(GrowableSharedArrayBufferPrototypeGetByteLength) {
-  const char* const kMethodName =
-      "get GrowableSharedArrayBuffer.prototype.byteLength";
+// ES #sec-get-sharedarraybuffer.prototype.bytelength
+// get SharedArrayBuffer.prototype.byteLength
+BUILTIN(SharedArrayBufferPrototypeGetByteLength) {
+  const char* const kMethodName = "get SharedArrayBuffer.prototype.byteLength";
   HandleScope scope(isolate);
-
   // 1. Let O be the this value.
-  // 2. Perform ? RequireInternalSlot(O, [[ArrayBufferMaxLength]]).
+  // 2. Perform ? RequireInternalSlot(O, [[ArrayBufferData]]).
   CHECK_RECEIVER(JSArrayBuffer, array_buffer, kMethodName);
-  CHECK_RESIZABLE(true, array_buffer, kMethodName);
   // 3. If IsSharedArrayBuffer(O) is false, throw a TypeError exception.
   CHECK_SHARED(true, array_buffer, kMethodName);
 
   // 4. Let length be ArrayBufferByteLength(O, SeqCst).
+  size_t byte_length;
+  if (array_buffer->is_resizable()) {
+    // Invariant: byte_length for GSAB is 0 (it needs to be read from the
+    // BackingStore).
+    DCHECK_EQ(0, array_buffer->byte_length());
 
-  // Invariant: byte_length for GSAB is 0 (it needs to be read from the
-  // BackingStore).
-  DCHECK_EQ(0, array_buffer->byte_length());
-
-  size_t byte_length =
-      array_buffer->GetBackingStore()->byte_length(std::memory_order_seq_cst);
-
-  // 5. Return length.
+    byte_length =
+        array_buffer->GetBackingStore()->byte_length(std::memory_order_seq_cst);
+  } else {
+    byte_length = array_buffer->byte_length();
+  }
+  // 5. Return F(length).
   return *isolate->factory()->NewNumberFromSize(byte_length);
 }
 
-// ES #sec-resizablearraybuffer.prototype.resize
-// ResizableArrayBuffer.prototype.resize(new_size))
-BUILTIN(ResizableArrayBufferPrototypeResize) {
-  const char* const kMethodName = "ResizableArrayBuffer.prototype.resize";
+// ES #sec-arraybuffer.prototype.resize
+// ArrayBuffer.prototype.resize(new_size))
+BUILTIN(ArrayBufferPrototypeResize) {
+  const char* const kMethodName = "ArrayBuffer.prototype.resize";
   constexpr bool kIsShared = false;
   return ResizeHelper(args, isolate, kMethodName, kIsShared);
 }
 
-// ES #sec-growablesharedarraybuffer.prototype.grow
-// GrowableSharedArrayBuffer.prototype.grow(new_size))
-BUILTIN(GrowableSharedArrayBufferPrototypeGrow) {
-  const char* const kMethodName = "GrowableSharedArrayBuffer.prototype.grow";
+// ES #sec-sharedarraybuffer.prototype.grow
+// SharedArrayBuffer.prototype.grow(new_size))
+BUILTIN(SharedArrayBufferPrototypeGrow) {
+  const char* const kMethodName = "SharedArrayBuffer.prototype.grow";
   constexpr bool kIsShared = true;
   return ResizeHelper(args, isolate, kMethodName, kIsShared);
 }

src/builtins/builtins-definitions.h

@@ -394,6 +394,8 @@ namespace internal {
   CPP(ArrayBufferConstructor)                                                  \
   CPP(ArrayBufferConstructor_DoNotInitialize)                                  \
   CPP(ArrayBufferPrototypeSlice)                                               \
+  /* https://tc39.es/proposal-resizablearraybuffer/ */                         \
+  CPP(ArrayBufferPrototypeResize)                                              \
                                                                                \
   /* AsyncFunction */                                                          \
   TFS(AsyncFunctionEnter, kClosure, kReceiver)                                 \
@@ -799,11 +801,6 @@ namespace internal {
   ASM(RegExpInterpreterTrampoline, CCall)                                      \
   ASM(RegExpExperimentalTrampoline, CCall)                                     \
                                                                                \
-  /* ResizableArrayBuffer & GrowableSharedArrayBuffer */                       \
-  CPP(ResizableArrayBufferPrototypeResize)                                     \
-  CPP(GrowableSharedArrayBufferPrototypeGrow)                                  \
-  CPP(GrowableSharedArrayBufferPrototypeGetByteLength)                         \
-                                                                               \
   /* Set */                                                                    \
   TFJ(SetConstructor, kDontAdaptArgumentsSentinel)                             \
   TFJ(SetPrototypeHas, 1, kReceiver, kKey)                                     \
@@ -823,7 +820,11 @@ namespace internal {
   TFS(SetOrSetIteratorToList, kSource)                                         \
                                                                                \
   /* SharedArrayBuffer */                                                      \
+  CPP(SharedArrayBufferPrototypeGetByteLength)                                 \
   CPP(SharedArrayBufferPrototypeSlice)                                         \
+  /* https://tc39.es/proposal-resizablearraybuffer/ */                         \
+  CPP(SharedArrayBufferPrototypeGrow)                                          \
+                                                                               \
   TFJ(AtomicsLoad, 2, kReceiver, kArray, kIndex)                               \
   TFJ(AtomicsStore, 3, kReceiver, kArray, kIndex, kValue)                      \
   TFJ(AtomicsExchange, 3, kReceiver, kArray, kIndex, kValue)                   \

src/diagnostics/objects-printer.cc

@@ -1423,6 +1423,7 @@ void JSArrayBuffer::JSArrayBufferPrint(std::ostream& os) {
   JSObjectPrintHeader(os, *this, "JSArrayBuffer");
   os << "\n - backing_store: " << backing_store();
   os << "\n - byte_length: " << byte_length();
+  os << "\n - max_byte_length: " << max_byte_length();
   if (is_external()) os << "\n - external";
   if (is_detachable()) os << "\n - detachable";
   if (was_detached()) os << "\n - detached";

src/heap/factory.cc

@@ -2720,19 +2720,10 @@ MaybeHandle<JSArrayBuffer> Factory::NewJSArrayBufferAndBackingStore(
 
 Handle<JSArrayBuffer> Factory::NewJSSharedArrayBuffer(
     std::shared_ptr<BackingStore> backing_store) {
-  Handle<Map> map;
-  if (backing_store->is_resizable()) {
-    DCHECK(FLAG_harmony_rab_gsab);
-    map = Handle<Map>(isolate()
-                          ->native_context()
-                          ->growable_shared_array_buffer_fun()
-                          .initial_map(),
-                      isolate());
-  } else {
-    map = Handle<Map>(
-        isolate()->native_context()->shared_array_buffer_fun().initial_map(),
-        isolate());
-  }
+  DCHECK_IMPLIES(backing_store->is_resizable(), FLAG_harmony_rab_gsab);
+  Handle<Map> map(
+      isolate()->native_context()->shared_array_buffer_fun().initial_map(),
+      isolate());
   auto result = Handle<JSArrayBuffer>::cast(
       NewJSObjectFromMap(map, AllocationType::kYoung));
   ResizableFlag resizable = backing_store->is_resizable()

src/init/bootstrapper.cc

@@ -233,12 +233,7 @@ class Genesis {
 #undef DECLARE_FEATURE_INITIALIZATION
   void InitializeGlobal_regexp_linear_flag();
 
-  enum ArrayBufferKind {
-    ARRAY_BUFFER,
-    SHARED_ARRAY_BUFFER,
-    RESIZABLE_ARRAY_BUFFER,
-    GROWABLE_SHARED_ARRAY_BUFFER
-  };
+  enum ArrayBufferKind { ARRAY_BUFFER, SHARED_ARRAY_BUFFER };
   Handle<JSFunction> CreateArrayBuffer(Handle<String> name,
                                        ArrayBufferKind array_buffer_kind);
 
@@ -3283,25 +3278,6 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     InstallSpeciesGetter(isolate_, shared_array_buffer_fun);
   }
 
-  {  // R e s i z a b l e A r r a y B u f f e r
-    Handle<String> name = factory->ResizableArrayBuffer_string();
-    Handle<JSFunction> resizable_array_buffer_fun =
-        CreateArrayBuffer(name, RESIZABLE_ARRAY_BUFFER);
-    InstallWithIntrinsicDefaultProto(isolate_, resizable_array_buffer_fun,
-                                     Context::RESIZABLE_ARRAY_BUFFER_FUN_INDEX);
-    InstallSpeciesGetter(isolate_, resizable_array_buffer_fun);
-  }
-
-  {  // G r o w a b l e S h a r e d A r r a y B u f f e r
-    Handle<String> name = factory->GrowableSharedArrayBuffer_string();
-    Handle<JSFunction> growable_shared_array_buffer_fun =
-        CreateArrayBuffer(name, GROWABLE_SHARED_ARRAY_BUFFER);
-    InstallWithIntrinsicDefaultProto(
-        isolate_, growable_shared_array_buffer_fun,
-        Context::GROWABLE_SHARED_ARRAY_BUFFER_FUN_INDEX);
-    InstallSpeciesGetter(isolate_, growable_shared_array_buffer_fun);
-  }
-
   {  // -- A t o m i c s
     Handle<JSObject> atomics_object =
         factory->NewJSObject(isolate_->object_function(), AllocationType::kOld);
@@ -4557,6 +4533,35 @@ void Genesis::InitializeGlobal_harmony_relative_indexing_methods() {
   }
 }
 
+void Genesis::InitializeGlobal_harmony_rab_gsab() {
+  if (!FLAG_harmony_rab_gsab) return;
+  Handle<JSObject> array_buffer_prototype(
+      JSObject::cast(native_context()->array_buffer_fun().instance_prototype()),
+      isolate());
+  SimpleInstallGetter(isolate(), array_buffer_prototype,
+                      factory()->max_byte_length_string(),
+                      Builtin::kArrayBufferPrototypeGetMaxByteLength, false);
+  SimpleInstallGetter(isolate(), array_buffer_prototype,
+                      factory()->resizable_string(),
+                      Builtin::kArrayBufferPrototypeGetResizable, false);
+  SimpleInstallFunction(isolate(), array_buffer_prototype, "resize",
+                        Builtin::kArrayBufferPrototypeResize, 1, true);
+
+  Handle<JSObject> shared_array_buffer_prototype(
+      JSObject::cast(
+          native_context()->shared_array_buffer_fun().instance_prototype()),
+      isolate());
+  SimpleInstallGetter(isolate(), shared_array_buffer_prototype,
+                      factory()->max_byte_length_string(),
+                      Builtin::kSharedArrayBufferPrototypeGetMaxByteLength,
+                      false);
+  SimpleInstallGetter(isolate(), shared_array_buffer_prototype,
+                      factory()->growable_string(),
+                      Builtin::kSharedArrayBufferPrototypeGetGrowable, false);
+  SimpleInstallFunction(isolate(), shared_array_buffer_prototype, "grow",
+                        Builtin::kSharedArrayBufferPrototypeGrow, 1, true);
+}
+
 #ifdef V8_INTL_SUPPORT
 
 void Genesis::InitializeGlobal_harmony_intl_locale_info() {
@@ -4583,19 +4588,6 @@ void Genesis::InitializeGlobal_harmony_intl_locale_info() {
 
 #endif  // V8_INTL_SUPPORT
 
-void Genesis::InitializeGlobal_harmony_rab_gsab() {
-  if (!FLAG_harmony_rab_gsab) return;
-
-  Handle<JSGlobalObject> global(native_context()->global_object(), isolate());
-
-  JSObject::AddProperty(isolate_, global, "ResizableArrayBuffer",
-                        isolate()->resizable_array_buffer_fun(), DONT_ENUM);
-
-  JSObject::AddProperty(isolate_, global, "GrowableSharedArrayBuffer",
-                        isolate()->growable_shared_array_buffer_fun(),
-                        DONT_ENUM);
-}
-
 Handle<JSFunction> Genesis::CreateArrayBuffer(
     Handle<String> name, ArrayBufferKind array_buffer_kind) {
   // Create the %ArrayBufferPrototype%
@@ -4624,7 +4616,6 @@ Handle<JSFunction> Genesis::CreateArrayBuffer(
       // Install the "byteLength" getter on the {prototype}.
       SimpleInstallGetter(isolate(), prototype, factory()->byte_length_string(),
                           Builtin::kArrayBufferPrototypeGetByteLength, false);
-
       SimpleInstallFunction(isolate(), prototype, "slice",
                             Builtin::kArrayBufferPrototypeSlice, 2, true);
       break;
@@ -4634,32 +4625,9 @@ Handle<JSFunction> Genesis::CreateArrayBuffer(
       SimpleInstallGetter(isolate(), prototype, factory()->byte_length_string(),
                           Builtin::kSharedArrayBufferPrototypeGetByteLength,
                           false);
-
       SimpleInstallFunction(isolate(), prototype, "slice",
                             Builtin::kSharedArrayBufferPrototypeSlice, 2, true);
       break;
-    case RESIZABLE_ARRAY_BUFFER:
-      SimpleInstallGetter(isolate(), prototype, factory()->byte_length_string(),
-                          Builtin::kResizableArrayBufferPrototypeGetByteLength,
-                          false);
-      SimpleInstallGetter(
-          isolate(), prototype, factory()->max_byte_length_string(),
-          Builtin::kResizableArrayBufferPrototypeGetMaxByteLength, false);
-      SimpleInstallFunction(isolate(), prototype, "resize",
-                            Builtin::kResizableArrayBufferPrototypeResize, 1,
-                            true);
-      break;
-    case GROWABLE_SHARED_ARRAY_BUFFER:
-      SimpleInstallGetter(
-          isolate(), prototype, factory()->byte_length_string(),
-          Builtin::kGrowableSharedArrayBufferPrototypeGetByteLength, true);
-      SimpleInstallGetter(
-          isolate(), prototype, factory()->max_byte_length_string(),
-          Builtin::kGrowableSharedArrayBufferPrototypeGetMaxByteLength, false);
-      SimpleInstallFunction(isolate(), prototype, "grow",
-                            Builtin::kGrowableSharedArrayBufferPrototypeGrow, 1,
-                            true);
-      break;
   }
 
   return array_buffer_fun;

src/objects/contexts.h

@@ -132,8 +132,6 @@ enum ContextLookupFlags {
   V(GENERATOR_OBJECT_PROTOTYPE_MAP_INDEX, Map, generator_object_prototype_map) \
   V(ASYNC_GENERATOR_OBJECT_PROTOTYPE_MAP_INDEX, Map,                           \
     async_generator_object_prototype_map)                                      \
-  V(GROWABLE_SHARED_ARRAY_BUFFER_FUN_INDEX, JSFunction,                        \
-    growable_shared_array_buffer_fun)                                          \
   V(INITIAL_ARRAY_ITERATOR_MAP_INDEX, Map, initial_array_iterator_map)         \
   V(INITIAL_ARRAY_ITERATOR_PROTOTYPE_INDEX, JSObject,                          \
     initial_array_iterator_prototype)                                          \
@@ -245,7 +243,6 @@ enum ContextLookupFlags {
   V(REGEXP_SPLIT_FUNCTION_INDEX, JSFunction, regexp_split_function)            \
   V(INITIAL_REGEXP_STRING_ITERATOR_PROTOTYPE_MAP_INDEX, Map,                   \
     initial_regexp_string_iterator_prototype_map)                              \
-  V(RESIZABLE_ARRAY_BUFFER_FUN_INDEX, JSFunction, resizable_array_buffer_fun)  \
   V(SCRIPT_CONTEXT_TABLE_INDEX, ScriptContextTable, script_context_table)      \
   V(SCRIPT_EXECUTION_CALLBACK_INDEX, Object, script_execution_callback)        \
   V(SECURITY_TOKEN_INDEX, Object, security_token)                              \

src/objects/js-objects.cc

@@ -3954,6 +3954,17 @@ bool JSObject::IsExtensible(Handle<JSObject> object) {
   return object->map().is_extensible();
 }
 
+// static
+MaybeHandle<Object> JSObject::ReadFromOptionsBag(Handle<Object> options,
+                                                 Handle<String> option_name,
+                                                 Isolate* isolate) {
+  if (options->IsJSReceiver()) {
+    Handle<JSReceiver> js_options = Handle<JSReceiver>::cast(options);
+    return JSObject::GetProperty(isolate, js_options, option_name);
+  }
+  return MaybeHandle<Object>(isolate->factory()->undefined_value());
+}
+
 template <typename Dictionary>
 void JSObject::ApplyAttributesToDictionary(
     Isolate* isolate, ReadOnlyRoots roots, Handle<Dictionary> dictionary,

src/objects/js-objects.h

@@ -715,6 +715,10 @@ class JSObject : public TorqueGeneratedJSObject<JSObject, JSReceiver> {
 
   static bool IsExtensible(Handle<JSObject> object);
 
+  static MaybeHandle<Object> ReadFromOptionsBag(Handle<Object> options,
+                                                Handle<String> option_name,
+                                                Isolate* isolate);
+
   // Dispatched behavior.
   void JSObjectShortPrint(StringStream* accumulator);
   DECL_PRINTER(JSObject)

test/mjsunit/typedarray-growablesharedarraybuffer.js

@@ -22,8 +22,12 @@ const ctors = [
   MyUint8Array
 ];
 
+function CreateGrowableSharedArrayBuffer(byteLength, maxByteLength) {
+  return new SharedArrayBuffer(byteLength, {maxByteLength: maxByteLength});
+}
+
 (function TypedArrayPrototype() {
-  const gsab = new GrowableSharedArrayBuffer(40, 80);
+  const gsab = CreateGrowableSharedArrayBuffer(40, 80);
   const sab = new SharedArrayBuffer(80);
 
   for (let ctor of ctors) {
@@ -34,7 +38,7 @@ const ctors = [
 })();
 
 (function TypedArrayLengthAndByteLength() {
-  const gsab = new GrowableSharedArrayBuffer(40, 80);
+  const gsab = CreateGrowableSharedArrayBuffer(40, 80);
 
   for (let ctor of ctors) {
     const ta = new ctor(gsab, 0, 3);
@@ -77,7 +81,7 @@ const ctors = [
 })();
 
 (function ConstructInvalid() {
-  const gsab = new GrowableSharedArrayBuffer(40, 80);
+  const gsab = CreateGrowableSharedArrayBuffer(40, 80);
 
   for (let ctor of ctors) {
     // Length too big.
@@ -107,7 +111,7 @@ const ctors = [
 })();
 
 (function TypedArrayLengthWhenGrown1() {
-  const gsab = new GrowableSharedArrayBuffer(16, 40);
+  const gsab = CreateGrowableSharedArrayBuffer(16, 40);
 
   // Create TAs which cover the bytes 0-7.
   let tas_and_lengths = [];
@@ -138,7 +142,7 @@ const ctors = [
 
 // The previous test with offsets.
 (function TypedArrayLengthWhenGrown2() {
-  const gsab = new GrowableSharedArrayBuffer(20, 40);
+  const gsab = CreateGrowableSharedArrayBuffer(20, 40);
 
   // Create TAs which cover the bytes 8-15.
   let tas_and_lengths = [];
@@ -168,7 +172,7 @@ const ctors = [
 })();
 
 (function LengthTracking1() {
-  const gsab = new GrowableSharedArrayBuffer(16, 40);
+  const gsab = CreateGrowableSharedArrayBuffer(16, 40);
 
   let tas = [];
   for (let ctor of ctors) {
@@ -204,7 +208,7 @@ const ctors = [
 
 // The previous test with offsets.
 (function LengthTracking2() {
-  const gsab = new GrowableSharedArrayBuffer(16, 40);
+  const gsab = CreateGrowableSharedArrayBuffer(16, 40);
 
   const offset = 8;
   let tas = [];
@@ -245,7 +249,7 @@ const ctors = [
   }
   %EnsureFeedbackVectorForFunction(ReadElement2);
 
-  const gsab = new GrowableSharedArrayBuffer(16, 40);
+  const gsab = CreateGrowableSharedArrayBuffer(16, 40);
 
   const i8a = new Int8Array(gsab, 0, 4);
   for (let i = 0; i < 3; ++i) {
@@ -294,7 +298,7 @@ const ctors = [
   %EnsureFeedbackVectorForFunction(HasElement);
   %EnsureFeedbackVectorForFunction(WriteElement);
 
-  const gsab = new GrowableSharedArrayBuffer(16, 40);
+  const gsab = CreateGrowableSharedArrayBuffer(16, 40);
 
   const i8a = new Int8Array(gsab); // length-tracking
   assertEquals(16, i8a.length);
@@ -342,7 +346,7 @@ const ctors = [
 })();
 
 (function EnumerateElements() {
-  let gsab = new GrowableSharedArrayBuffer(100, 200);
+  let gsab = CreateGrowableSharedArrayBuffer(100, 200);
   for (let ctor of ctors) {
     const ta = new ctor(gsab, 0, 3);
     let keys = '';
@@ -374,7 +378,7 @@ const ctors = [
     const buffer_byte_length = no_elements * ctor.BYTES_PER_ELEMENT;
     // We can use the same GSAB for all the TAs below, since we won't modify it
     // after writing the initial values.
-    const gsab = new GrowableSharedArrayBuffer(buffer_byte_length,
+    const gsab = CreateGrowableSharedArrayBuffer(buffer_byte_length,
                                                2 * buffer_byte_length);
     const byte_offset = offset * ctor.BYTES_PER_ELEMENT;
 
@@ -423,7 +427,7 @@ const ctors = [
 
 // Helpers for iteration tests.
 function CreateGsab(buffer_byte_length, ctor) {
-  const gsab = new GrowableSharedArrayBuffer(buffer_byte_length,
+  const gsab = CreateGrowableSharedArrayBuffer(buffer_byte_length,
                                              2 * buffer_byte_length);
   // Write some data into the array.
   let ta_write = new ctor(gsab);

test/mjsunit/typedarray-resizablearraybuffer-detach.js

@@ -22,8 +22,12 @@ const ctors = [
   MyUint8Array
 ];
 
+function CreateResizableArrayBuffer(byteLength, maxByteLength) {
+  return new ArrayBuffer(byteLength, {maxByteLength: maxByteLength});
+}
+
 (function ConstructorThrowsIfBufferDetached() {
-  const rab = new ResizableArrayBuffer(40, 80);
+  const rab = CreateResizableArrayBuffer(40, 80);
   %ArrayBufferDetach(rab);
 
   for (let ctor of ctors) {
@@ -34,7 +38,7 @@ const ctors = [
 })();
 
 (function TypedArrayLengthAndByteLength() {
-  const rab = new ResizableArrayBuffer(40, 80);
+  const rab = CreateResizableArrayBuffer(40, 80);
 
   let tas = [];
   for (let ctor of ctors) {
@@ -53,7 +57,7 @@ const ctors = [
 })();
 
 (function AccessDetachedTypedArray() {
-  const rab = new ResizableArrayBuffer(16, 40);
+  const rab = CreateResizableArrayBuffer(16, 40);
 
   const i8a = new Int8Array(rab, 0, 4);
 
@@ -90,7 +94,7 @@ const ctors = [
   }
   %EnsureFeedbackVectorForFunction(ReadElement2);
 
-  const rab = new ResizableArrayBuffer(16, 40);
+  const rab = CreateResizableArrayBuffer(16, 40);
 
   const i8a = new Int8Array(rab, 0, 4);
   assertEquals(0, ReadElement2(i8a));
@@ -114,7 +118,7 @@ const ctors = [
   }
   %EnsureFeedbackVectorForFunction(WriteElement2);
 
-  const rab = new ResizableArrayBuffer(16, 40);
+  const rab = CreateResizableArrayBuffer(16, 40);
 
   const i8a = new Int8Array(rab, 0, 4);
   assertEquals(0, i8a[2]);

test/mjsunit/typedarray-resizablearraybuffer.js

@@ -22,8 +22,12 @@ const ctors = [
   MyUint8Array
 ];
 
+function CreateResizableArrayBuffer(byteLength, maxByteLength) {
+  return new ArrayBuffer(byteLength, {maxByteLength: maxByteLength});
+}
+
 (function TypedArrayPrototype() {
-  const rab = new ResizableArrayBuffer(40, 80);
+  const rab = CreateResizableArrayBuffer(40, 80);
   const ab = new ArrayBuffer(80);
 
   for (let ctor of ctors) {
@@ -34,7 +38,7 @@ const ctors = [
 })();
 
 (function TypedArrayLengthAndByteLength() {
-  const rab = new ResizableArrayBuffer(40, 80);
+  const rab = CreateResizableArrayBuffer(40, 80);
 
   for (let ctor of ctors) {
     const ta = new ctor(rab, 0, 3);
@@ -77,7 +81,7 @@ const ctors = [
 })();
 
 (function ConstructInvalid() {
-  const rab = new ResizableArrayBuffer(40, 80);
+  const rab = CreateResizableArrayBuffer(40, 80);
 
   for (let ctor of ctors) {
     // Length too big.
@@ -107,7 +111,7 @@ const ctors = [
 })();
 
 (function TypedArrayLengthWhenResizedOutOfBounds1() {
-  const rab = new ResizableArrayBuffer(16, 40);
+  const rab = CreateResizableArrayBuffer(16, 40);
 
   // Create TAs which cover the bytes 0-7.
   let tas_and_lengths = [];
@@ -146,7 +150,7 @@ const ctors = [
 
 // The previous test with offsets.
 (function TypedArrayLengthWhenResizedOutOfBounds2() {
-  const rab = new ResizableArrayBuffer(20, 40);
+  const rab = CreateResizableArrayBuffer(20, 40);
 
   // Create TAs which cover the bytes 8-15.
   let tas_and_lengths = [];
@@ -184,7 +188,7 @@ const ctors = [
 })();
 
 (function LengthTracking1() {
-  const rab = new ResizableArrayBuffer(16, 40);
+  const rab = CreateResizableArrayBuffer(16, 40);
 
   let tas = [];
   for (let ctor of ctors) {
@@ -246,7 +250,7 @@ const ctors = [
 
 // The previous test with offsets.
 (function LengthTracking2() {
-  const rab = new ResizableArrayBuffer(16, 40);
+  const rab = CreateResizableArrayBuffer(16, 40);
 
   const offset = 8;
   let tas = [];
@@ -322,7 +326,7 @@ const ctors = [
     if (ctor.BYTES_PER_ELEMENT != 1) {
       continue;
     }
-    const rab = new ResizableArrayBuffer(16, 40);
+    const rab = CreateResizableArrayBuffer(16, 40);
     const array = new ctor(rab, 0, 4);
 
     // Initial values
@@ -381,7 +385,7 @@ const ctors = [
     if (ctor.BYTES_PER_ELEMENT != 1) {
       continue;
     }
-    const rab = new ResizableArrayBuffer(16, 40);
+    const rab = CreateResizableArrayBuffer(16, 40);
     const array = new ctor(rab, 0, 4);
 
     // Within-bounds read
@@ -419,7 +423,7 @@ const ctors = [
   }
   %EnsureFeedbackVectorForFunction(ReadElement2);
 
-  const rab = new ResizableArrayBuffer(16, 40);
+  const rab = CreateResizableArrayBuffer(16, 40);
 
   const i8a = new Int8Array(rab, 0, 4);
   for (let i = 0; i < 3; ++i) {
@@ -469,7 +473,7 @@ const ctors = [
   }
   %EnsureFeedbackVectorForFunction(HasElement2);
 
-  const rab = new ResizableArrayBuffer(16, 40);
+  const rab = CreateResizableArrayBuffer(16, 40);
 
   const i8a = new Int8Array(rab, 0, 4);
 
@@ -505,7 +509,7 @@ const ctors = [
   }
   %EnsureFeedbackVectorForFunction(WriteElement2);
 
-  const rab = new ResizableArrayBuffer(16, 40);
+  const rab = CreateResizableArrayBuffer(16, 40);
 
   const i8a = new Int8Array(rab, 0, 4);
   assertEquals(0, i8a[2]);
@@ -554,7 +558,7 @@ const ctors = [
     return 2 in ta;
   }
 
-  const rab = new ResizableArrayBuffer(16, 40);
+  const rab = CreateResizableArrayBuffer(16, 40);
   const i8a = new Int8Array(rab, 0, 4);
   i8a.__proto__ = {2: 'wrong value'};
   i8a[2] = 10;
@@ -576,7 +580,7 @@ const ctors = [
   %EnsureFeedbackVectorForFunction(ReadElement2);
   %EnsureFeedbackVectorForFunction(HasElement2);
 
-  const rab = new ResizableArrayBuffer(16, 40);
+  const rab = CreateResizableArrayBuffer(16, 40);
   const i8a = new Int8Array(rab, 0, 4);
   i8a.__proto__ = {2: 'wrong value'};
   i8a[2] = 10;
@@ -593,7 +597,7 @@ const ctors = [
 })();
 
 (function EnumerateElements() {
-  let rab = new ResizableArrayBuffer(100, 200);
+  let rab = CreateResizableArrayBuffer(100, 200);
   for (let ctor of ctors) {
     const ta = new ctor(rab, 0, 3);
     let keys = '';
@@ -625,7 +629,7 @@ const ctors = [
     const buffer_byte_length = no_elements * ctor.BYTES_PER_ELEMENT;
     // We can use the same RAB for all the TAs below, since we won't modify it
     // after writing the initial values.
-    const rab = new ResizableArrayBuffer(buffer_byte_length,
+    const rab = CreateResizableArrayBuffer(buffer_byte_length,
                                          2 * buffer_byte_length);
     const byte_offset = offset * ctor.BYTES_PER_ELEMENT;
 
@@ -674,7 +678,7 @@ const ctors = [
 
 // Helpers for iteration tests.
 function CreateRab(buffer_byte_length, ctor) {
-  const rab = new ResizableArrayBuffer(buffer_byte_length,
+  const rab = CreateResizableArrayBuffer(buffer_byte_length,
                                        2 * buffer_byte_length);
   // Write some data into the array.
   let ta_write = new ctor(rab);

test/test262/test262.status

@@ -583,17 +583,13 @@
   'language/module-code/export-expname-binding-index': [FAIL],
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=11111
-  'built-ins/ArrayBuffer/options-maxbytelength-diminuitive': [FAIL],
-  'built-ins/ArrayBuffer/options-maxbytelength-excessive': [FAIL],
-  'built-ins/ArrayBuffer/options-maxbytelength-negative': [FAIL],
-  'built-ins/ArrayBuffer/options-maxbytelength-object': [FAIL],
-  'built-ins/ArrayBuffer/options-maxbytelength-poisoned': [FAIL],
-  'built-ins/ArrayBuffer/options-maxbytelength-undefined': [FAIL],
-  'built-ins/ArrayBuffer/options-non-object': [FAIL],
-  'built-ins/ArrayBuffer/prototype/maxByteLength/*': [FAIL],
-  'built-ins/ArrayBuffer/prototype/resizable/*': [FAIL],
-  'built-ins/ArrayBuffer/prototype/resize/*': [FAIL],
-  'built-ins/ArrayBuffer/prototype/resize/this-is-sharedarraybuffer': [PASS],
+  'built-ins/ArrayBuffer/prototype/resize/resize-grow': [FAIL],
+  'built-ins/ArrayBuffer/prototype/resize/resize-same-size': [FAIL],
+  'built-ins/ArrayBuffer/prototype/resize/resize-same-size-zero-explicit': [FAIL],
+  'built-ins/ArrayBuffer/prototype/resize/resize-same-size-zero-implicit': [FAIL],
+  'built-ins/ArrayBuffer/prototype/resize/resize-shrink': [FAIL],
+  'built-ins/ArrayBuffer/prototype/resize/resize-shrink-zero-explicit': [FAIL],
+  'built-ins/ArrayBuffer/prototype/resize/resize-shrink-zero-implicit': [FAIL],
   'built-ins/ArrayBuffer/prototype/transfer/*': [FAIL],
   'built-ins/ArrayBuffer/prototype/transfer/this-is-sharedarraybuffer': [PASS],
   'built-ins/DataView/prototype/byteLength/resizable-array-buffer-auto': [FAIL],
@@ -620,53 +616,36 @@
   'built-ins/DataView/prototype/setUint16/resizable-buffer': [FAIL],
   'built-ins/DataView/prototype/setUint32/resizable-buffer': [FAIL],
   'built-ins/DataView/prototype/setUint8/resizable-buffer': [FAIL],
-  'built-ins/SharedArrayBuffer/options-maxbytelength-diminuitive': [FAIL],
-  'built-ins/SharedArrayBuffer/options-maxbytelength-excessive': [FAIL],
-  'built-ins/SharedArrayBuffer/options-maxbytelength-negative': [FAIL],
-  'built-ins/SharedArrayBuffer/options-maxbytelength-object': [FAIL],
-  'built-ins/SharedArrayBuffer/options-maxbytelength-poisoned': [FAIL],
-  'built-ins/SharedArrayBuffer/options-maxbytelength-undefined': [FAIL],
-  'built-ins/SharedArrayBuffer/options-non-object': [FAIL],
-  'built-ins/SharedArrayBuffer/prototype/growable/*': [FAIL],
-  'built-ins/SharedArrayBuffer/prototype/grow/*': [FAIL],
-  'built-ins/SharedArrayBuffer/prototype/grow/this-is-sharedarraybuffer': [PASS],
-  'built-ins/SharedArrayBuffer/prototype/maxByteLength/*': [FAIL],
   'built-ins/TypedArrayConstructors/ctors/typedarray-arg/out-of-bounds-when-species-retrieved-different-type': [FAIL],
   'built-ins/TypedArrayConstructors/ctors/typedarray-arg/out-of-bounds-when-species-retrieved-same-type': [FAIL],
   'built-ins/TypedArrayConstructors/internals/HasProperty/resizable-array-buffer-auto': [FAIL],
   'built-ins/TypedArrayConstructors/internals/HasProperty/resizable-array-buffer-fixed': [FAIL],
   'built-ins/TypedArrayConstructors/internals/OwnPropertyKeys/integer-indexes-resizable-array-buffer-auto': [FAIL],
-  'built-ins/TypedArrayConstructors/internals/OwnPropertyKeys/integer-indexes-resizable-array-buffer-fixed': [FAIL],
   'built-ins/TypedArray/prototype/at/return-abrupt-from-this-out-of-bounds': [FAIL],
-  'built-ins/TypedArray/prototype/byteLength/resizable-array-buffer-auto': [FAIL],
-  'built-ins/TypedArray/prototype/byteLength/resizable-array-buffer-fixed': [FAIL],
   'built-ins/TypedArray/prototype/byteOffset/resizable-array-buffer-auto': [FAIL],
   'built-ins/TypedArray/prototype/byteOffset/resizable-array-buffer-fixed': [FAIL],
   'built-ins/TypedArray/prototype/copyWithin/return-abrupt-from-this-out-of-bounds': [FAIL],
   'built-ins/TypedArray/prototype/entries/return-abrupt-from-this-out-of-bounds': [FAIL],
-  'built-ins/TypedArray/prototype/every/return-abrupt-from-this-out-of-bounds': [FAIL],
-  'built-ins/TypedArray/prototype/fill/return-abrupt-from-this-out-of-bounds': [FAIL],
-  'built-ins/TypedArray/prototype/filter/return-abrupt-from-this-out-of-bounds': [FAIL],
-  'built-ins/TypedArray/prototype/findIndex/return-abrupt-from-this-out-of-bounds': [FAIL],
-  'built-ins/TypedArray/prototype/find/return-abrupt-from-this-out-of-bounds': [FAIL],
-  'built-ins/TypedArray/prototype/forEach/return-abrupt-from-this-out-of-bounds': [FAIL],
+  'built-ins/TypedArray/prototype/every/return-abrupt-from-this-out-of-bounds': [SKIP],
+  'built-ins/TypedArray/prototype/fill/return-abrupt-from-this-out-of-bounds': [SKIP],
+  'built-ins/TypedArray/prototype/filter/return-abrupt-from-this-out-of-bounds': [SKIP],
+  'built-ins/TypedArray/prototype/findIndex/return-abrupt-from-this-out-of-bounds': [SKIP],
+  'built-ins/TypedArray/prototype/find/return-abrupt-from-this-out-of-bounds': [SKIP],
+  'built-ins/TypedArray/prototype/forEach/return-abrupt-from-this-out-of-bounds': [SKIP],
   'built-ins/TypedArray/prototype/includes/return-abrupt-from-this-out-of-bounds': [FAIL],
   'built-ins/TypedArray/prototype/indexOf/return-abrupt-from-this-out-of-bounds': [FAIL],
-  'built-ins/TypedArray/prototype/join/return-abrupt-from-this-out-of-bounds': [FAIL],
+  'built-ins/TypedArray/prototype/join/return-abrupt-from-this-out-of-bounds': [SKIP],
   'built-ins/TypedArray/prototype/keys/return-abrupt-from-this-out-of-bounds': [FAIL],
   'built-ins/TypedArray/prototype/lastIndexOf/return-abrupt-from-this-out-of-bounds': [FAIL],
-  'built-ins/TypedArray/prototype/length/resizable-array-buffer-auto': [FAIL],
-  'built-ins/TypedArray/prototype/length/resizable-array-buffer-fixed': [FAIL],
   'built-ins/TypedArray/prototype/map/return-abrupt-from-this-out-of-bounds': [FAIL],
-  'built-ins/TypedArray/prototype/reduce/return-abrupt-from-this-out-of-bounds': [FAIL],
-  'built-ins/TypedArray/prototype/reduceRight/return-abrupt-from-this-out-of-bounds': [FAIL],
+  'built-ins/TypedArray/prototype/reduce/return-abrupt-from-this-out-of-bounds': [SKIP],
+  'built-ins/TypedArray/prototype/reduceRight/return-abrupt-from-this-out-of-bounds': [SKIP],
   'built-ins/TypedArray/prototype/reverse/return-abrupt-from-this-out-of-bounds': [FAIL],
-  'built-ins/TypedArray/prototype/set/typedarray-arg-set-values-same-buffer-same-type-resized': [FAIL],
   'built-ins/TypedArray/prototype/set/typedarray-arg-target-out-of-bounds': [FAIL],
   'built-ins/TypedArray/prototype/slice/return-abrupt-from-this-out-of-bounds': [FAIL],
-  'built-ins/TypedArray/prototype/some/return-abrupt-from-this-out-of-bounds': [FAIL],
+  'built-ins/TypedArray/prototype/some/return-abrupt-from-this-out-of-bounds': [SKIP],
   'built-ins/TypedArray/prototype/sort/return-abrupt-from-this-out-of-bounds': [FAIL],
-  'built-ins/TypedArray/prototype/toLocaleString/return-abrupt-from-this-out-of-bounds': [FAIL],
+  'built-ins/TypedArray/prototype/toLocaleString/return-abrupt-from-this-out-of-bounds': [SKIP],
   'built-ins/TypedArray/prototype/values/return-abrupt-from-this-out-of-bounds': [FAIL],
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=11544
@@ -728,6 +707,12 @@
   'harness/detachArrayBuffer': [SKIP],
   'harness/detachArrayBuffer-host-detachArrayBuffer': [SKIP],
 
+  # https://github.com/tc39/test262/issues/3038
+  'built-ins/SharedArrayBuffer/options-maxbytelength-undefined': [FAIL],
+  'built-ins/SharedArrayBuffer/options-non-object': [FAIL],
+  'built-ins/SharedArrayBuffer/prototype/growable/this-is-arraybuffer': [FAIL],
+  'built-ins/SharedArrayBuffer/prototype/maxByteLength/this-is-arraybuffer': [FAIL],
+
   ############################ SKIPPED TESTS #############################
 
   # These tests take a looong time to run.

test/test262/testcfg.py

@@ -58,6 +58,7 @@ FEATURE_FLAGS = {
   'import-assertions': '--harmony-import-assertions',
   'Object.hasOwn': '--harmony-object-has-own',
   'class-static-block': '--harmony-class-static-blocks',
+  'resizable-arraybuffer': '--harmony-rab-gsab',
 }
 
 SKIPPED_FEATURES = set([])

tools/v8heapconst.py

@@ -329,66 +329,66 @@ KNOWN_MAPS = {
   ("read_only_space", 0x03215): (67, "BasicBlockCountersMarkerMap"),
   ("read_only_space", 0x03259): (91, "ArrayBoilerplateDescriptionMap"),
   ("read_only_space", 0x03359): (104, "InterceptorInfoMap"),
-  ("read_only_space", 0x05691): (76, "PromiseFulfillReactionJobTaskMap"),
-  ("read_only_space", 0x056b9): (77, "PromiseRejectReactionJobTaskMap"),
-  ("read_only_space", 0x056e1): (78, "CallableTaskMap"),
-  ("read_only_space", 0x05709): (79, "CallbackTaskMap"),
-  ("read_only_space", 0x05731): (80, "PromiseResolveThenableJobTaskMap"),
-  ("read_only_space", 0x05759): (83, "FunctionTemplateInfoMap"),
-  ("read_only_space", 0x05781): (84, "ObjectTemplateInfoMap"),
-  ("read_only_space", 0x057a9): (85, "AccessCheckInfoMap"),
-  ("read_only_space", 0x057d1): (86, "AccessorInfoMap"),
-  ("read_only_space", 0x057f9): (87, "AccessorPairMap"),
-  ("read_only_space", 0x05821): (88, "AliasedArgumentsEntryMap"),
-  ("read_only_space", 0x05849): (89, "AllocationMementoMap"),
-  ("read_only_space", 0x05871): (92, "AsmWasmDataMap"),
-  ("read_only_space", 0x05899): (93, "AsyncGeneratorRequestMap"),
-  ("read_only_space", 0x058c1): (94, "BaselineDataMap"),
-  ("read_only_space", 0x058e9): (95, "BreakPointMap"),
-  ("read_only_space", 0x05911): (96, "BreakPointInfoMap"),
-  ("read_only_space", 0x05939): (97, "CachedTemplateObjectMap"),
-  ("read_only_space", 0x05961): (99, "ClassPositionsMap"),
-  ("read_only_space", 0x05989): (100, "DebugInfoMap"),
-  ("read_only_space", 0x059b1): (103, "FunctionTemplateRareDataMap"),
-  ("read_only_space", 0x059d9): (105, "InterpreterDataMap"),
-  ("read_only_space", 0x05a01): (106, "ModuleRequestMap"),
-  ("read_only_space", 0x05a29): (107, "PromiseCapabilityMap"),
-  ("read_only_space", 0x05a51): (108, "PromiseReactionMap"),
-  ("read_only_space", 0x05a79): (109, "PropertyDescriptorObjectMap"),
-  ("read_only_space", 0x05aa1): (110, "PrototypeInfoMap"),
-  ("read_only_space", 0x05ac9): (111, "RegExpBoilerplateDescriptionMap"),
-  ("read_only_space", 0x05af1): (112, "ScriptMap"),
-  ("read_only_space", 0x05b19): (113, "SourceTextModuleInfoEntryMap"),
-  ("read_only_space", 0x05b41): (114, "StackFrameInfoMap"),
-  ("read_only_space", 0x05b69): (115, "TemplateObjectDescriptionMap"),
-  ("read_only_space", 0x05b91): (116, "Tuple2Map"),
-  ("read_only_space", 0x05bb9): (117, "WasmExceptionTagMap"),
-  ("read_only_space", 0x05be1): (118, "WasmIndirectFunctionTableMap"),
-  ("read_only_space", 0x05c09): (136, "SloppyArgumentsElementsMap"),
-  ("read_only_space", 0x05c31): (153, "DescriptorArrayMap"),
-  ("read_only_space", 0x05c59): (158, "UncompiledDataWithoutPreparseDataMap"),
-  ("read_only_space", 0x05c81): (157, "UncompiledDataWithPreparseDataMap"),
-  ("read_only_space", 0x05ca9): (174, "OnHeapBasicBlockProfilerDataMap"),
-  ("read_only_space", 0x05cd1): (170, "InternalClassMap"),
-  ("read_only_space", 0x05cf9): (181, "SmiPairMap"),
-  ("read_only_space", 0x05d21): (180, "SmiBoxMap"),
-  ("read_only_space", 0x05d49): (147, "ExportedSubClassBaseMap"),
-  ("read_only_space", 0x05d71): (148, "ExportedSubClassMap"),
-  ("read_only_space", 0x05d99): (68, "AbstractInternalClassSubclass1Map"),
-  ("read_only_space", 0x05dc1): (69, "AbstractInternalClassSubclass2Map"),
-  ("read_only_space", 0x05de9): (135, "InternalClassWithSmiElementsMap"),
-  ("read_only_space", 0x05e11): (171, "InternalClassWithStructElementsMap"),
-  ("read_only_space", 0x05e39): (149, "ExportedSubClass2Map"),
-  ("read_only_space", 0x05e61): (182, "SortStateMap"),
-  ("read_only_space", 0x05e89): (90, "AllocationSiteWithWeakNextMap"),
-  ("read_only_space", 0x05eb1): (90, "AllocationSiteWithoutWeakNextMap"),
-  ("read_only_space", 0x05ed9): (81, "LoadHandler1Map"),
-  ("read_only_space", 0x05f01): (81, "LoadHandler2Map"),
-  ("read_only_space", 0x05f29): (81, "LoadHandler3Map"),
-  ("read_only_space", 0x05f51): (82, "StoreHandler0Map"),
-  ("read_only_space", 0x05f79): (82, "StoreHandler1Map"),
-  ("read_only_space", 0x05fa1): (82, "StoreHandler2Map"),
-  ("read_only_space", 0x05fc9): (82, "StoreHandler3Map"),
+  ("read_only_space", 0x05675): (76, "PromiseFulfillReactionJobTaskMap"),
+  ("read_only_space", 0x0569d): (77, "PromiseRejectReactionJobTaskMap"),
+  ("read_only_space", 0x056c5): (78, "CallableTaskMap"),
+  ("read_only_space", 0x056ed): (79, "CallbackTaskMap"),
+  ("read_only_space", 0x05715): (80, "PromiseResolveThenableJobTaskMap"),
+  ("read_only_space", 0x0573d): (83, "FunctionTemplateInfoMap"),
+  ("read_only_space", 0x05765): (84, "ObjectTemplateInfoMap"),
+  ("read_only_space", 0x0578d): (85, "AccessCheckInfoMap"),
+  ("read_only_space", 0x057b5): (86, "AccessorInfoMap"),
+  ("read_only_space", 0x057dd): (87, "AccessorPairMap"),
+  ("read_only_space", 0x05805): (88, "AliasedArgumentsEntryMap"),
+  ("read_only_space", 0x0582d): (89, "AllocationMementoMap"),
+  ("read_only_space", 0x05855): (92, "AsmWasmDataMap"),
+  ("read_only_space", 0x0587d): (93, "AsyncGeneratorRequestMap"),
+  ("read_only_space", 0x058a5): (94, "BaselineDataMap"),
+  ("read_only_space", 0x058cd): (95, "BreakPointMap"),
+  ("read_only_space", 0x058f5): (96, "BreakPointInfoMap"),
+  ("read_only_space", 0x0591d): (97, "CachedTemplateObjectMap"),
+  ("read_only_space", 0x05945): (99, "ClassPositionsMap"),
+  ("read_only_space", 0x0596d): (100, "DebugInfoMap"),
+  ("read_only_space", 0x05995): (103, "FunctionTemplateRareDataMap"),
+  ("read_only_space", 0x059bd): (105, "InterpreterDataMap"),
+  ("read_only_space", 0x059e5): (106, "ModuleRequestMap"),
+  ("read_only_space", 0x05a0d): (107, "PromiseCapabilityMap"),
+  ("read_only_space", 0x05a35): (108, "PromiseReactionMap"),
+  ("read_only_space", 0x05a5d): (109, "PropertyDescriptorObjectMap"),
+  ("read_only_space", 0x05a85): (110, "PrototypeInfoMap"),
+  ("read_only_space", 0x05aad): (111, "RegExpBoilerplateDescriptionMap"),
+  ("read_only_space", 0x05ad5): (112, "ScriptMap"),
+  ("read_only_space", 0x05afd): (113, "SourceTextModuleInfoEntryMap"),
+  ("read_only_space", 0x05b25): (114, "StackFrameInfoMap"),
+  ("read_only_space", 0x05b4d): (115, "TemplateObjectDescriptionMap"),
+  ("read_only_space", 0x05b75): (116, "Tuple2Map"),
+  ("read_only_space", 0x05b9d): (117, "WasmExceptionTagMap"),
+  ("read_only_space", 0x05bc5): (118, "WasmIndirectFunctionTableMap"),
+  ("read_only_space", 0x05bed): (136, "SloppyArgumentsElementsMap"),
+  ("read_only_space", 0x05c15): (153, "DescriptorArrayMap"),
+  ("read_only_space", 0x05c3d): (158, "UncompiledDataWithoutPreparseDataMap"),
+  ("read_only_space", 0x05c65): (157, "UncompiledDataWithPreparseDataMap"),
+  ("read_only_space", 0x05c8d): (174, "OnHeapBasicBlockProfilerDataMap"),
+  ("read_only_space", 0x05cb5): (170, "InternalClassMap"),
+  ("read_only_space", 0x05cdd): (181, "SmiPairMap"),
+  ("read_only_space", 0x05d05): (180, "SmiBoxMap"),
+  ("read_only_space", 0x05d2d): (147, "ExportedSubClassBaseMap"),
+  ("read_only_space", 0x05d55): (148, "ExportedSubClassMap"),
+  ("read_only_space", 0x05d7d): (68, "AbstractInternalClassSubclass1Map"),
+  ("read_only_space", 0x05da5): (69, "AbstractInternalClassSubclass2Map"),
+  ("read_only_space", 0x05dcd): (135, "InternalClassWithSmiElementsMap"),
+  ("read_only_space", 0x05df5): (171, "InternalClassWithStructElementsMap"),
+  ("read_only_space", 0x05e1d): (149, "ExportedSubClass2Map"),
+  ("read_only_space", 0x05e45): (182, "SortStateMap"),
+  ("read_only_space", 0x05e6d): (90, "AllocationSiteWithWeakNextMap"),
+  ("read_only_space", 0x05e95): (90, "AllocationSiteWithoutWeakNextMap"),
+  ("read_only_space", 0x05ebd): (81, "LoadHandler1Map"),
+  ("read_only_space", 0x05ee5): (81, "LoadHandler2Map"),
+  ("read_only_space", 0x05f0d): (81, "LoadHandler3Map"),
+  ("read_only_space", 0x05f35): (82, "StoreHandler0Map"),
+  ("read_only_space", 0x05f5d): (82, "StoreHandler1Map"),
+  ("read_only_space", 0x05f85): (82, "StoreHandler2Map"),
+  ("read_only_space", 0x05fad): (82, "StoreHandler3Map"),
   ("map_space", 0x02119): (1057, "ExternalMap"),
   ("map_space", 0x02141): (1098, "JSMessageObjectMap"),
 }