Import Cobalt 20.master.0.234144

Includes the following patches:
  https://cobalt-review.googlesource.com/c/cobalt/+/5590
  by n1214.hwang@samsung.com

  https://cobalt-review.googlesource.com/c/cobalt/+/5530
  by errong.leng@samsung.com

  https://cobalt-review.googlesource.com/c/cobalt/+/5570
  by devin.cai@mediatek.com
diff --git a/src/v8/test/mjsunit/BUILD.gn b/src/v8/test/mjsunit/BUILD.gn
new file mode 100644
index 0000000..847565f
--- /dev/null
+++ b/src/v8/test/mjsunit/BUILD.gn
@@ -0,0 +1,27 @@
+# Copyright 2018 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+group("v8_mjsunit") {
+  testonly = true
+
+  data_deps = [
+    "../../:d8",
+    "../../tools/:v8_testrunner",
+  ]
+
+  data = [
+    "./",
+    "../../tools/codemap.js",
+    "../../tools/consarray.js",
+    "../../tools/csvparser.js",
+    "../../tools/logreader.js",
+    "../../tools/arguments.js",
+    "../../tools/profile.js",
+    "../../tools/profile_view.js",
+    "../../tools/profviz/composer.js",
+    "../../tools/splaytree.js",
+    "../../tools/tickprocessor.js",
+    "../../tools/dumpcpp.js",
+  ]
+}
diff --git a/src/v8/test/mjsunit/allocation-folding.js b/src/v8/test/mjsunit/allocation-folding.js
index fcf909d..ffb4bd0 100644
--- a/src/v8/test/mjsunit/allocation-folding.js
+++ b/src/v8/test/mjsunit/allocation-folding.js
@@ -38,6 +38,7 @@
   return elem2;
 }
 
+%PrepareFunctionForOptimization(f);
 f(); f(); f();
 %OptimizeFunctionOnNextCall(f);
 var result = f();
@@ -54,6 +55,7 @@
   return elem2;
 }
 
+%PrepareFunctionForOptimization(doubles);
 doubles(); doubles(); doubles();
 %OptimizeFunctionOnNextCall(doubles);
 result = doubles();
@@ -70,6 +72,7 @@
   return elem2;
 }
 
+%PrepareFunctionForOptimization(doubles_int);
 doubles_int(); doubles_int(); doubles_int();
 %OptimizeFunctionOnNextCall(doubles_int);
 result = doubles_int();
@@ -91,6 +94,7 @@
   return elem2;
 }
 
+%PrepareFunctionForOptimization(branch_int);
 branch_int(1); branch_int(1); branch_int(1);
 %OptimizeFunctionOnNextCall(branch_int);
 result = branch_int(1);
@@ -110,6 +114,7 @@
   return [ a1, a2, a3 ];
 }
 
+%PrepareFunctionForOptimization(boom);
 boom(); boom(); boom();
 %OptimizeFunctionOnNextCall(boom);
 boom();
diff --git a/src/v8/test/mjsunit/allocation-site-info.js b/src/v8/test/mjsunit/allocation-site-info.js
index 7a5f2c7..7a2a222 100644
--- a/src/v8/test/mjsunit/allocation-site-info.js
+++ b/src/v8/test/mjsunit/allocation-site-info.js
@@ -105,6 +105,8 @@
   return literal;
 }
 
+%PrepareFunctionForOptimization(get_standard_literal);
+
 // Case: [1,2,3] as allocation site
 obj = fastliteralcase(get_standard_literal(), 1);
 assertKind(elements_kind.fast_smi_only, obj);
@@ -258,6 +260,12 @@
 obj = newarraycase_list_smiobj(2);
 assertKind(elements_kind.fast, obj);
 
+// Perform a gc because without it the test below can experience an
+// allocation failure at an inconvenient point. Allocation mementos get
+// cleared on gc, and they can't deliver elements kind feedback when that
+// happens.
+gc();
+
 // Case: array constructor calls with out of date feedback.
 // The boilerplate should incorporate all feedback, but the input array
 // should be minimally transitioned based on immediate need.
@@ -315,6 +323,8 @@
   assertTrue(new type(1,2,3) instanceof type);
 }
 
+%PrepareFunctionForOptimization(instanceof_check);
+
 var realmBArray = Realm.eval(realmB, "Array");
 // Two calls with Array because ES6 instanceof desugars into a load of Array,
 // and load has a premonomorphic state.
@@ -348,10 +358,12 @@
 // Try to optimize again, but first clear all type feedback, and allow it
 // to be monomorphic on first call. Only after optimizing do we introduce
 // realmBArray. This should deopt the method.
+  %PrepareFunctionForOptimization(instanceof_check);
   %DeoptimizeFunction(instanceof_check);
   %ClearFunctionFeedback(instanceof_check);
 instanceof_check(Array);
 instanceof_check(Array);
+  %PrepareFunctionForOptimization(instanceof_check);
   %OptimizeFunctionOnNextCall(instanceof_check);
 instanceof_check(Array);
 assertOptimized(instanceof_check);
diff --git a/src/v8/test/mjsunit/apply.js b/src/v8/test/mjsunit/apply.js
index c52a23f..07639c9 100644
--- a/src/v8/test/mjsunit/apply.js
+++ b/src/v8/test/mjsunit/apply.js
@@ -110,6 +110,7 @@
 assertEquals("bar42foofishhorse", s.apply("bar", arr), "apply to string");
 
 function al() {
+  print(this);
   assertEquals(Object(345), this);
   return arguments.length + arguments[arguments.length - 1];
 }
diff --git a/src/v8/test/mjsunit/arguments-apply-deopt.js b/src/v8/test/mjsunit/arguments-apply-deopt.js
index b7251af..48d2966 100644
--- a/src/v8/test/mjsunit/arguments-apply-deopt.js
+++ b/src/v8/test/mjsunit/arguments-apply-deopt.js
@@ -36,6 +36,7 @@
   }
 
   var y = invoker(m, selfOf);
+  %PrepareFunctionForOptimization(y);
 
   function selfOf(c) {
     var sssss = c.self_;
@@ -67,6 +68,7 @@
     return f.apply(deopt(), arguments);
   };
 
+  %PrepareFunctionForOptimization(XXXXX);
   XXXXX();
   XXXXX();
   XXXXX();
diff --git a/src/v8/test/mjsunit/arguments-deopt.js b/src/v8/test/mjsunit/arguments-deopt.js
index 20e5f69..996249d 100644
--- a/src/v8/test/mjsunit/arguments-deopt.js
+++ b/src/v8/test/mjsunit/arguments-deopt.js
@@ -16,11 +16,13 @@
     return f.apply(null, arguments);
   }
 
+  %PrepareFunctionForOptimization(test1);
   assertEquals(test1(1, 2), 3);
   assertEquals(test1(1, 2, 3), 3);
 
   %OptimizeFunctionOnNextCall(test1);
   assertEquals(test1(1, 2), 3);
+  %PrepareFunctionForOptimization(test1);
   %OptimizeFunctionOnNextCall(test1);
   assertEquals(test1(1, 2, 3), 3);
 })();
@@ -35,11 +37,13 @@
     return f.apply(null, arguments);
   }
 
+  %PrepareFunctionForOptimization(test2);
   assertEquals(test2(1, 2), 3);
   assertEquals(test2(1, 2, 3), 3);
 
   %OptimizeFunctionOnNextCall(test2);
   assertEquals(test2(1, 2), 3);
+  %PrepareFunctionForOptimization(test2);
   %OptimizeFunctionOnNextCall(test2);
   assertEquals(test2(1, 2, 3), 3);
 })();
@@ -57,11 +61,13 @@
     return f.apply(null, arguments);
   }
 
+  %PrepareFunctionForOptimization(test3);
   assertEquals(test3(1, 2), 3);
   assertEquals(test3(1, 2, 3), 3);
 
   %OptimizeFunctionOnNextCall(test3);
   assertEquals(test3(11, 12), 23);
+  %PrepareFunctionForOptimization(test3);
   %OptimizeFunctionOnNextCall(test3);
   assertEquals(test3(11, 12, 13), 23);
 })();
@@ -80,11 +86,13 @@
   test4(1, 2);
   test4(3, 4, 5);
 
+  %PrepareFunctionForOptimization(test4);
   assertEquals(test4(1, 2), 6);
   assertEquals(test4(1, 2, 3), 6);
 
   %OptimizeFunctionOnNextCall(test4);
   assertEquals(test4(1, 2), 6);
+  %PrepareFunctionForOptimization(test4);
   %OptimizeFunctionOnNextCall(test4);
   assertEquals(test4(1, 2, 3), 6);
 })();
@@ -102,11 +110,13 @@
     return sum;
   };
 
+  %PrepareFunctionForOptimization(sum1);
   var args = []
   for (var i = 1; i < 30; ++i) {
     args.push(i);
     if (i%10 == 0) %OptimizeFunctionOnNextCall(sum1);
     assertEquals(i*(i+1)/2, sum1(...args));
+    if (i%10 == 0) %PrepareFunctionForOptimization(sum1);
   }
 })();
 
@@ -121,11 +131,13 @@
     return sum;
   };
 
+  %PrepareFunctionForOptimization(sum2);
   var args = []
   for (var i = 1; i < 30; ++i) {
     args.push(i);
     if (i%10 == 0) %OptimizeFunctionOnNextCall(sum2);
     assertEquals(i*(i+1)/2, sum2(...args));
+    if (i%10 == 0) %PrepareFunctionForOptimization(sum2);
   }
 })();
 
@@ -140,11 +152,13 @@
     return sum;
   };
 
+  %PrepareFunctionForOptimization(sum3);
   var args = []
   for (var i = 1; i < 30; ++i) {
     args.push(i);
     if (i%10 == 0) %OptimizeFunctionOnNextCall(sum3);
     assertEquals(i*(i+1)/2, sum3(...args));
+    if (i%10 == 0) %PrepareFunctionForOptimization(sum3);
   }
 })();
 
@@ -159,11 +173,13 @@
     return sum;
   };
 
+  %PrepareFunctionForOptimization(sum4);
   var args = []
   for (var i = 1; i < 30; ++i) {
     args.push(i);
     if (i%10 == 0) %OptimizeFunctionOnNextCall(sum4);
     assertEquals(i*(i+1)/2-1, sum4(...args));
+    if (i%10 == 0) %PrepareFunctionForOptimization(sum4);
   }
 })();
 
@@ -174,10 +190,12 @@
     return arguments[arguments.length-1];
   };
 
+  %PrepareFunctionForOptimization(read);
   var args = []
   for (var i = 1; i < 30; ++i) {
     args.push(i);
     if (i%10 == 0) %OptimizeFunctionOnNextCall(read);
     assertEquals(i, read(...args));
+    if (i%10 == 0) %PrepareFunctionForOptimization(read);
   }
 })();
diff --git a/src/v8/test/mjsunit/arguments.js b/src/v8/test/mjsunit/arguments.js
index ad12540..6f04115 100644
--- a/src/v8/test/mjsunit/arguments.js
+++ b/src/v8/test/mjsunit/arguments.js
@@ -366,3 +366,14 @@
   f7(1,2,3,4,5,6,7);
   f7(1,2,3,4,5,6,7,8);
 })();
+
+(function testArgumentsHole() {
+  function f(a) {
+    arguments[3] = 1;
+    return arguments[2];
+  };
+
+  assertEquals(undefined, f(1));
+  assertEquals(undefined, f(1));
+  assertEquals(undefined, f(1));
+})();
diff --git a/src/v8/test/mjsunit/array-bounds-check-removal.js b/src/v8/test/mjsunit/array-bounds-check-removal.js
index 17be095..f2625c4 100644
--- a/src/v8/test/mjsunit/array-bounds-check-removal.js
+++ b/src/v8/test/mjsunit/array-bounds-check-removal.js
@@ -45,6 +45,7 @@
   }
   return r;
 }
+%PrepareFunctionForOptimization(test_do_not_assert_on_non_int32);
 test_do_not_assert_on_non_int32(v,1);
 test_do_not_assert_on_non_int32(v,1);
 test_do_not_assert_on_non_int32(v,"a");
@@ -86,7 +87,7 @@
   }
 }
 
-
+%PrepareFunctionForOptimization(test_base);
 test_base(a, 1, true);
 test_base(a, 2, true);
 test_base(a, 1, false);
@@ -100,6 +101,7 @@
 // Test that we deopt on failed bounds checks.
 var dictionary_map_array = new Int32Array(128);
 test_base(dictionary_map_array, 5, true);
+%PrepareFunctionForOptimization(test_base);
 test_base(dictionary_map_array, 6, true);
 test_base(dictionary_map_array, 5, false);
 test_base(dictionary_map_array, 6, false);
@@ -109,6 +111,7 @@
 
 // Forget about the dictionary_map_array's map.
 %ClearFunctionFeedback(test_base);
+%PrepareFunctionForOptimization(test_base);
 
 test_base(a, 5, true);
 test_base(a, 6, true);
@@ -153,6 +156,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(test_minus);
 test_minus(5,true);
 test_minus(6,true);
 %OptimizeFunctionOnNextCall(test_minus);
@@ -168,6 +172,7 @@
   a[i + 9] = 0;
   a[i - 10] = 0;
 }
+%PrepareFunctionForOptimization(short_test);
 short_test(short_a, 50);
 short_test(short_a, 50);
 %OptimizeFunctionOnNextCall(short_test);
@@ -190,6 +195,7 @@
   result += a[index - 1];
   return result;
 }
+%PrepareFunctionForOptimization(test_phi);
 var result_phi = 0;
 result_phi = test_phi(data_phi, 3,  true);
 assertEquals(12, result_phi);
@@ -218,6 +224,7 @@
 
   return result;
 }
+%PrepareFunctionForOptimization(test_composition);
 var result_composition = 0;
 result_composition = test_composition(data_composition_long, 2);
 assertEquals(19, result_composition);
diff --git a/src/v8/test/mjsunit/array-constructor-feedback.js b/src/v8/test/mjsunit/array-constructor-feedback.js
index fb4ad5a..b3c6512 100644
--- a/src/v8/test/mjsunit/array-constructor-feedback.js
+++ b/src/v8/test/mjsunit/array-constructor-feedback.js
@@ -67,6 +67,7 @@
   function bar0(t) {
     return new t();
   }
+  %PrepareFunctionForOptimization(bar0);
   a = bar0(Array);
   a[0] = 3.5;
   b = bar0(Array);
@@ -77,7 +78,8 @@
   assertOptimized(bar0);
   // bar0 should deopt
   b = bar0(Object);
-  assertUnoptimized(bar0)
+  assertUnoptimized(bar0);
+  %PrepareFunctionForOptimization(bar0);
   // When it's re-optimized, we should call through the full stub
   bar0(Array);
   %OptimizeFunctionOnNextCall(bar0);
@@ -92,40 +94,6 @@
 })();
 
 
-// Test: Ensure that inlined array calls in crankshaft learn from deopts
-// based on the move to a dictionary for the array.
-(function() {
-  function bar(len) {
-    return new Array(len);
-  }
-  a = bar(10);
-  a[0] = "a string";
-  a = bar(10);
-  assertKind(elements_kind.fast, a);
-  %OptimizeFunctionOnNextCall(bar);
-  a = bar(10);
-  assertKind(elements_kind.fast, a);
-  assertOptimized(bar);
-  bar(10000);
-  assertOptimized(bar);
-
-  function barn(one, two, three) {
-    return new Array(one, two, three);
-  }
-
-  a = barn(1, 2, 3);
-  a[1] = "a string";
-  a = barn(1, 2, 3);
-  assertKind(elements_kind.fast, a);
-  %OptimizeFunctionOnNextCall(barn);
-  a = barn(1, 2, 3);
-  assertKind(elements_kind.fast, a);
-  assertOptimized(barn);
-  a = barn(1, "oops", 3);
-  assertOptimized(barn);
-})();
-
-
 // Test: When a method with array constructor is crankshafted, the type
 // feedback for elements kind is baked in. Verify that transitions don't
 // change it anymore
@@ -133,12 +101,12 @@
   function bar() {
     return new Array();
   }
+  %PrepareFunctionForOptimization(bar);
   a = bar();
   bar();
   %OptimizeFunctionOnNextCall(bar);
   b = bar();
   assertOptimized(bar);
-  %DebugPrint(3);
   b[0] = 3.5;
   c = bar();
   assertKind(elements_kind.fast_smi_only, c);
@@ -150,6 +118,7 @@
 // map for Array in that context will be used.
 (function() {
   function bar() { return new Array(); }
+  %PrepareFunctionForOptimization(bar);
   bar();
   bar();
   %OptimizeFunctionOnNextCall(bar);
@@ -157,7 +126,8 @@
   assertTrue(a instanceof Array);
 
   var contextB = Realm.create();
-  Realm.eval(contextB, "function bar2() { return new Array(); };");
+  Realm.eval(contextB,
+      "function bar2() { return new Array(); }; %PrepareFunctionForOptimization(bar2)");
   Realm.eval(contextB, "bar2(); bar2();");
   Realm.eval(contextB, "%OptimizeFunctionOnNextCall(bar2);");
   Realm.eval(contextB, "bar2();");
@@ -169,6 +139,7 @@
 // should deal with arguments that create holey arrays.
 (function() {
   function bar(len) { return new Array(len); }
+  %PrepareFunctionForOptimization(bar);
   bar(0);
   bar(0);
   %OptimizeFunctionOnNextCall(bar);
@@ -188,6 +159,7 @@
 // Test: Make sure that crankshaft continues with feedback for large arrays.
 (function() {
   function bar(len) { return new Array(len); }
+  %PrepareFunctionForOptimization(bar);
   var size = 100001;
   // Perform a gc, because we are allocating a very large array and if a gc
   // happens during the allocation we could lose our memento.
diff --git a/src/v8/test/mjsunit/array-constructor.js b/src/v8/test/mjsunit/array-constructor.js
index c9707b9..94f444c 100644
--- a/src/v8/test/mjsunit/array-constructor.js
+++ b/src/v8/test/mjsunit/array-constructor.js
@@ -1,29 +1,6 @@
 // Copyright 2008 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
 
 var loop_count = 5
 
@@ -84,26 +61,26 @@
   return a.join();
 }
 
-
-function testConstructOfSizeSize(n) {
-  var str = innerArrayLiteral(n);
-  var a = eval('[' + str + ']');
-  var b = eval('new Array(' + str + ')')
-  var c = eval('Array(' + str + ')')
-  assertEquals(n, a.length);
+function testConstruction(len, elements_str) {
+  var a = eval('[' + elements_str + ']');
+  var b = eval('new Array(' + elements_str + ')')
+  var c = eval('Array(' + elements_str + ')')
+  assertEquals(len, a.length);
   assertArrayEquals(a, b);
   assertArrayEquals(a, c);
 }
 
-
 for (var i = 0; i < loop_count; i++) {
-  // JSObject::kInitialMaxFastElementArray is 10000.
-  for (var j = 1000; j < 12000; j += 1000) {
-    testConstructOfSizeSize(j);
+  const N = 2000;
+  const literal = innerArrayLiteral(N);
+  let str = literal;
+  // JSObject::kInitialMaxFastElementArray is approximately 10000.
+  for (var j = N; j <= 12000; j += N) {
+    testConstruction(j, str);
+    str += ", " + literal;
   }
 }
 
-
 for (var i = 0; i < loop_count; i++) {
   assertArrayEquals(['xxx'], new Array('xxx'));
   assertArrayEquals(['xxx'], Array('xxx'));
diff --git a/src/v8/test/mjsunit/array-from-large-set.js b/src/v8/test/mjsunit/array-from-large-set.js
new file mode 100644
index 0000000..cff3b5a
--- /dev/null
+++ b/src/v8/test/mjsunit/array-from-large-set.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const n = 130000;
+
+{
+  let x = new Set();
+  for (let i = 0; i < n; ++i) x.add(i);
+  let a = Array.from(x);
+}
diff --git a/src/v8/test/mjsunit/array-functions-prototype-misc.js b/src/v8/test/mjsunit/array-functions-prototype-misc.js
index 7ff5d4f..0aff0a2 100644
--- a/src/v8/test/mjsunit/array-functions-prototype-misc.js
+++ b/src/v8/test/mjsunit/array-functions-prototype-misc.js
@@ -31,13 +31,8 @@
  * should work on other objects too, so we test that too.
  */
 
-var LARGE = 400000;
-var VERYLARGE = 4000000000;
-
-// Nicer for firefox 1.5.  Unless you uncomment the following two lines,
-// smjs will appear to hang on this file.
-//var LARGE = 40000;
-//var VERYLARGE = 40000;
+var LARGE = 40000;
+var VERYLARGE = 40000;
 
 var fourhundredth = LARGE/400;
 
@@ -45,7 +40,7 @@
 };
 
 for (var use_real_arrays = 0; use_real_arrays <= 1; use_real_arrays++) {
-  var poses = [0, 140, 20000, VERYLARGE];
+  var poses = [0, 140, 20000];
   var the_prototype;
   var new_function;
   var push_function;
@@ -175,20 +170,6 @@
       assertEquals("concat", join);
       join = ba.join('');
       assertEquals("catcon", join);
-
-      var sparse = [];
-      sparse[pos + 1000] = 'is ';
-      sparse[pos + 271828] = 'time ';
-      sparse[pos + 31415] = 'the ';
-      sparse[pos + 012260199] = 'all ';
-      sparse[-1] = 'foo';
-      sparse[pos + 22591927] = 'good ';
-      sparse[pos + 1618033] = 'for ';
-      sparse[pos + 91] = ': Now ';
-      sparse[pos + 86720199] = 'men.';
-      sparse.hest = 'fisk';
-
-      assertEquals("baz: Now is the time for all good men.", sparse.join(''));
     }
 
     a = new_function(pos);
@@ -252,19 +233,22 @@
     assertEquals("bar", a[2]);
 
     // Shift.
-    var baz = shift_function(a);
-    assertEquals("baz", baz);
-    assertEquals("boo", a[0]);
-    assertEquals(pos + 3, a.length);
-    assertEquals("foo", a[pos + 2]);
+    // Skip VERYLARGE arrays, as we removed sparse support for shift.
+    // Slice is also skipped, since it relies on the "shift" test to be run.
+    if (pos < VERYLARGE) {
+      var baz = shift_function(a);
+      assertEquals("baz", baz);
+      assertEquals("boo", a[0]);
+      assertEquals(pos + 3, a.length);
+      assertEquals("foo", a[pos + 2]);
 
-    // Slice.
-    var bar = slice_function(a, 1, 0);  // don't throw an exception please.
-    bar = slice_function(a, 1, 2);
-    assertEquals("bar", bar[0]);
-    assertEquals(1, bar.length);
-    assertEquals("bar", a[1]);
-
+      // Slice.
+      var bar = slice_function(a, 1, 0);  // don't throw an exception please.
+      bar = slice_function(a, 1, 2);
+      assertEquals("bar", bar[0]);
+      assertEquals(1, bar.length);
+      assertEquals("bar", a[1]);
+    }
   }
 }
 
diff --git a/src/v8/test/mjsunit/array-indexing-receiver.js b/src/v8/test/mjsunit/array-indexing-receiver.js
index ea8d02b..4c47a39 100644
--- a/src/v8/test/mjsunit/array-indexing-receiver.js
+++ b/src/v8/test/mjsunit/array-indexing-receiver.js
@@ -356,7 +356,7 @@
 
     Detached_Int8Array() {
       var array = new Int8Array(10);
-      %ArrayBufferNeuter(array.buffer);
+      %ArrayBufferDetach(array.buffer);
       assertEquals(Array.prototype.indexOf.call(array, 0), -1);
       assertEquals(Array.prototype.indexOf.call(array, 0, 10), -1);
     },
@@ -391,7 +391,7 @@
 
     Detached_Uint8Array() {
       var array = new Uint8Array(10);
-      %ArrayBufferNeuter(array.buffer);
+      %ArrayBufferDetach(array.buffer);
       assertEquals(Array.prototype.indexOf.call(array, 0), -1);
       assertEquals(Array.prototype.indexOf.call(array, 0, 10), -1);
     },
@@ -421,7 +421,7 @@
 
     Detached_Uint8ClampedArray() {
       var array = new Uint8ClampedArray(10);
-      %ArrayBufferNeuter(array.buffer);
+      %ArrayBufferDetach(array.buffer);
       assertEquals(Array.prototype.indexOf.call(array, 0), -1);
       assertEquals(Array.prototype.indexOf.call(array, 0, 10), -1);
     },
@@ -453,7 +453,7 @@
 
     Detached_Int16Array() {
       var array = new Int16Array(10);
-      %ArrayBufferNeuter(array.buffer);
+      %ArrayBufferDetach(array.buffer);
       assertEquals(Array.prototype.indexOf.call(array, 0), -1);
       assertEquals(Array.prototype.indexOf.call(array, 0, 10), -1);
     },
@@ -485,7 +485,7 @@
 
     Detached_Uint16Array() {
       var array = new Uint16Array(10);
-      %ArrayBufferNeuter(array.buffer);
+      %ArrayBufferDetach(array.buffer);
       assertEquals(Array.prototype.indexOf.call(array, 0), -1);
       assertEquals(Array.prototype.indexOf.call(array, 0, 10), -1);
     },
@@ -517,7 +517,7 @@
 
     Detached_Int32Array() {
       var array = new Int32Array(10);
-      %ArrayBufferNeuter(array.buffer);
+      %ArrayBufferDetach(array.buffer);
       assertEquals(Array.prototype.indexOf.call(array, 0), -1);
       assertEquals(Array.prototype.indexOf.call(array, 0, 10), -1);
     },
@@ -550,7 +550,7 @@
 
     Detached_Uint32Array() {
       var array = new Uint32Array(10);
-      %ArrayBufferNeuter(array.buffer);
+      %ArrayBufferDetach(array.buffer);
       assertEquals(Array.prototype.indexOf.call(array, 0), -1);
       assertEquals(Array.prototype.indexOf.call(array, 0, 10), -1);
     },
@@ -583,7 +583,7 @@
 
     Detached_Float32Array() {
       var array = new Float32Array(10);
-      %ArrayBufferNeuter(array.buffer);
+      %ArrayBufferDetach(array.buffer);
       assertEquals(Array.prototype.indexOf.call(array, 0), -1);
       assertEquals(Array.prototype.indexOf.call(array, 0, 10), -1);
     },
@@ -616,7 +616,7 @@
 
     Detached_Float64Array() {
       var array = new Float32Array(10);
-      %ArrayBufferNeuter(array.buffer);
+      %ArrayBufferDetach(array.buffer);
       assertEquals(Array.prototype.indexOf.call(array, 0), -1);
       assertEquals(Array.prototype.indexOf.call(array, 0, 10), -1);
     },
diff --git a/src/v8/test/mjsunit/array-iterator-prototype-next.js b/src/v8/test/mjsunit/array-iterator-prototype-next.js
new file mode 100644
index 0000000..d17bf27
--- /dev/null
+++ b/src/v8/test/mjsunit/array-iterator-prototype-next.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+/* Test behaviors when the prototype has elements */
+
+(function () {
+  var array = [,];
+
+  function next() {
+    return array[Symbol.iterator]().next();
+  }
+
+  assertEquals(next().value, undefined);
+
+  array.__proto__.push(5);
+  assertEquals(next().value, 5);
+})();
diff --git a/src/v8/test/mjsunit/array-join-element-tostring-prototype-side-effects.js b/src/v8/test/mjsunit/array-join-element-tostring-prototype-side-effects.js
new file mode 100644
index 0000000..a5ddebb
--- /dev/null
+++ b/src/v8/test/mjsunit/array-join-element-tostring-prototype-side-effects.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function ArrayPrototypeChanged() {
+  const el = {
+    toString() {
+      Array.prototype[1] = '2';
+      return '1';
+    }
+  };
+  const a = [el, ,3];
+  assertSame("123", a.join(''));
+})();
diff --git a/src/v8/test/mjsunit/array-join-element-tostring-side-effects.js b/src/v8/test/mjsunit/array-join-element-tostring-side-effects.js
new file mode 100644
index 0000000..1da72a7
--- /dev/null
+++ b/src/v8/test/mjsunit/array-join-element-tostring-side-effects.js
@@ -0,0 +1,152 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const MIN_DICTIONARY_INDEX = 8192;
+
+function ArrayTests() {
+  (function ToStringThrows() {
+    function TestError() {}
+
+    let callCount = 0;
+    const toStringThrows = {
+      toString() {
+        callCount++;
+        throw new TestError;
+      }
+    };
+    const a = [toStringThrows];
+    assertThrows(() => a.join(), TestError);
+    assertSame(1, callCount);
+
+    // Verifies cycle detection still works properly after thrown error.
+    a[0] = 1;
+    a[1] = 2;
+    assertSame('1,2', a.join());
+  })();
+
+  (function ArrayLengthIncreased() {
+    let callCount = 0;
+    const a = [
+      {
+        toString() {
+          callCount++;
+          a.push(2);
+          return '1';
+        }
+      }
+    ];
+    assertSame('1', a.join());
+    assertSame(1, callCount);
+    assertSame('1,2', a.join());
+  })();
+
+  (function ArrayLengthDecreased() {
+    let callCount = 0;
+    const a = [
+      {
+        toString() {
+          callCount++;
+          a.pop();
+          return '1';
+        }
+      },
+      '2'
+    ];
+    assertSame('1,', a.join());
+    assertSame(1, callCount);
+    assertSame('1', a.join());
+  })();
+
+  (function ElementsKindChangedToHoley() {
+    let callCount = 0;
+    const a = [
+      {
+        toString() {
+          callCount++;
+          a.length = 4;
+          a[1] = 777;
+          a[2] = 7.7;
+          return '1';
+        }
+      },
+      2,
+      3
+    ];
+    assertSame('1,777,7.7', a.join());
+    assertSame(1, callCount);
+    assertSame('1,777,7.7,', a.join());
+  })();
+
+  (function ElementsKindChangedToHoleyThroughDeletion() {
+    let callCount = 0;
+    const a = [
+      {
+        toString() {
+          callCount++;
+          delete a[1];
+          a[2] = 7.7;
+          return '1';
+        }
+      },
+      2,
+      3
+    ];
+    assertSame('1,,7.7', a.join());
+    assertSame(1, callCount);
+    assertSame('1,,7.7', a.join());
+  })();
+
+  (function NumberDictionaryChanged() {
+    let callCount = 0;
+    const a = [];
+    a[MIN_DICTIONARY_INDEX - 1] = {
+      toString() {
+        callCount++;
+        a[MIN_DICTIONARY_INDEX] = '2';
+        return '1';
+      }
+    };
+    a[MIN_DICTIONARY_INDEX] = 'NOPE';
+    assertTrue(%HasDictionaryElements(a));
+    assertSame('12', a.join(''));
+    assertSame(1, callCount);
+    assertSame('12', a.join(''));
+  })();
+
+  (function NumberDictionaryLengthChange() {
+    let callCount = 0;
+    const a = [];
+    a[MIN_DICTIONARY_INDEX - 1] = {
+      toString() {
+        callCount++;
+        a.length = MIN_DICTIONARY_INDEX;
+        return '1';
+      }
+    };
+    a[MIN_DICTIONARY_INDEX] = '2';
+    assertTrue(%HasDictionaryElements(a));
+    assertSame('1', a.join(''));
+    assertSame(1, callCount);
+    assertSame('1', a.join(''));
+  })();
+}
+
+(function NonArrayCycleDetection() {
+  const a = {
+    length: 3,
+    toString() { return Array.prototype.join.call(this); }
+  };
+  a[0] = '1';
+  a[1] = a;
+  a[2] = '3';
+  assertSame("1,,3", Array.prototype.join.call(a));
+});
+
+ArrayTests();
+
+%SetForceSlowPath(true);
+
+ArrayTests();
diff --git a/src/v8/test/mjsunit/array-join-index-getter-side-effects.js b/src/v8/test/mjsunit/array-join-index-getter-side-effects.js
new file mode 100644
index 0000000..4b84346
--- /dev/null
+++ b/src/v8/test/mjsunit/array-join-index-getter-side-effects.js
@@ -0,0 +1,108 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function Throws() {
+  function TestError() {}
+
+  let callCount = 0;
+  const a = [0, 1];
+  Object.defineProperty(a, '0', {
+    configurable: true,
+    get() {
+      callCount++;
+      throw new TestError();
+    }
+  });
+  assertTrue(%HasDictionaryElements(a));
+  assertThrows(() => a.join(), TestError);
+  assertSame(1, callCount);
+
+  // Verifies cycle detection still works properly after thrown error.
+  Object.defineProperty(a, '0', {
+    configurable: true,
+    get() {
+      callCount++;
+      return 777;
+    }
+  });
+  assertSame('777,1', a.join());
+  assertSame(2, callCount);
+})();
+
+(function ArrayLengthIncreased() {
+  let callCount = 0;
+  const a = [1];
+  Object.defineProperty(a, '0', {
+    configurable: true,
+    get() {
+      callCount++;
+      a.push(2);
+      return 9;
+    }
+  });
+  assertSame('9', a.join());
+  assertSame(1, callCount);
+
+  // Verifies cycle detection still works properly after continuation.
+  assertSame('9,2', a.join());
+  assertSame(2, callCount);
+})();
+
+(function ArrayLengthIncreasedWithHole() {
+  let callCount = 0;
+  const a = [1, , 2];
+  Object.defineProperty(a, '1', {
+    configurable: true,
+    get() {
+      callCount++;
+      a.push(3);
+    }
+  });
+  assertSame('1,,2', a.join());
+  assertSame(1, callCount);
+
+  // Verifies cycle detection still works properly after continuation.
+  assertSame('1,,2,3', a.join());
+  assertSame(2, callCount);
+})();
+
+(function ArrayLengthDecreased() {
+  let callCount = 0;
+  const a = [0, 1];
+  Object.defineProperty(a, '0', {
+    configurable: true,
+    get() {
+      callCount++;
+      a.length = 1;
+      return 9;
+    }
+  });
+  assertSame('9,', a.join());
+  assertSame(1, callCount);
+
+  // Verifies cycle detection still works properly after continuation.
+  assertSame('9', a.join());
+  assertSame(2, callCount);
+})();
+
+(function ElementsKindChangedToHoley() {
+  let callCount = 0;
+  const a = [0, 1];
+  Object.defineProperty(a, '0', {
+    configurable: true,
+    get() {
+      callCount++;
+      a.length = 3;
+      return 9;
+    }
+  });
+  assertSame('9,1', a.join());
+  assertSame(1, callCount);
+
+  // Verifies cycle detection still works properly after continuation.
+  assertSame('9,1,', a.join());
+  assertSame(2, callCount);
+})();
diff --git a/src/v8/test/mjsunit/array-join-invalid-string-length.js b/src/v8/test/mjsunit/array-join-invalid-string-length.js
new file mode 100644
index 0000000..cab8f00
--- /dev/null
+++ b/src/v8/test/mjsunit/array-join-invalid-string-length.js
@@ -0,0 +1,63 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function DictionaryStringRepeatFastPath() {
+  const a = new Array(%StringMaxLength());
+  assertTrue(%HasDictionaryElements(a));
+  const sep = '12';
+  assertThrows(() => a.join(sep), RangeError);
+
+  // Verifies cycle detection still works properly after thrown error.
+  assertThrows(() => a.join(sep), RangeError);
+
+  a.length = 3;
+  a[0] = 'a';
+  a[1] = 'b';
+  a[2] = 'c';
+  assertSame('a,b,c', a.join());
+})();
+
+(function SeparatorOverflow() {
+  const a = ['a',,,,,'b'];
+
+  const sep = ','.repeat(%StringMaxLength());
+  assertThrows(() => a.join(sep), RangeError);
+
+  // Verifies cycle detection still works properly after thrown error.
+  assertThrows(() => a.join(sep), RangeError);
+  assertSame('a,,,,,b', a.join());
+})();
+
+(function ElementOverflow() {
+  const el = ','.repeat(%StringMaxLength());
+  const a = [el, el, el, el, el];
+
+  assertThrows(() => a.join(), RangeError);
+
+  // Verifies cycle detection still works properly after thrown error.
+  assertThrows(() => a.join(), RangeError);
+  a[0] = 'a';
+  a[1] = 'b';
+  a[2] = 'c';
+  a[3] = 'd';
+  a[4] = 'e';
+  assertSame('a,b,c,d,e', a.join());
+})();
+
+(function ElementSeparatorOverflow() {
+  const el = ','.repeat(%StringMaxLength());
+  const a = [el, el, el, el];
+
+  assertThrows(() => a.join(el), RangeError);
+
+  // Verifies cycle detection still works properly after thrown error.
+  assertThrows(() => a.join(el), RangeError);
+  a[0] = 'a';
+  a[1] = 'b';
+  a[2] = 'c';
+  a[3] = 'd';
+  assertSame('a,b,c,d', a.join());
+})();
diff --git a/src/v8/test/mjsunit/array-join-nesting.js b/src/v8/test/mjsunit/array-join-nesting.js
new file mode 100644
index 0000000..d1e75fb
--- /dev/null
+++ b/src/v8/test/mjsunit/array-join-nesting.js
@@ -0,0 +1,16 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const DEPTH = 128;
+
+function makeNestedArray(depth, value) {
+  return depth > 0 ? [value, makeNestedArray(depth - 1, value)] : [value];
+}
+
+const array = makeNestedArray(DEPTH, 'a');
+const expected = 'a' + ',a'.repeat(DEPTH);
+assertSame(expected, array.join());
+
+// Verify cycle detection is still working.
+assertSame(expected, array.join());
diff --git a/src/v8/test/mjsunit/array-join-nonarray-length-getter-side-effects.js b/src/v8/test/mjsunit/array-join-nonarray-length-getter-side-effects.js
new file mode 100644
index 0000000..3f8d2aa
--- /dev/null
+++ b/src/v8/test/mjsunit/array-join-nonarray-length-getter-side-effects.js
@@ -0,0 +1,29 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function Throws() {
+  function TestError() {}
+
+  let callCount = 0;
+  const a = {
+    0: 1,
+    1: 2,
+    get length() {
+      callCount++;
+      throw new TestError();
+    }
+  };
+  assertThrows(() => Array.prototype.join.call(a), TestError);
+  assertSame(1, callCount);
+
+  // Verifies cycle detection still works properly after thrown error.
+  Object.defineProperty(a, 'length', {
+    get() {
+      callCount++;
+      return 2;
+    }
+  });
+  assertSame('1,2', Array.prototype.join.call(a));
+  assertSame(2, callCount);
+})();
diff --git a/src/v8/test/mjsunit/array-join-separator-tostring-side-effects.js b/src/v8/test/mjsunit/array-join-separator-tostring-side-effects.js
new file mode 100644
index 0000000..d9e8515
--- /dev/null
+++ b/src/v8/test/mjsunit/array-join-separator-tostring-side-effects.js
@@ -0,0 +1,197 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const MIN_DICTIONARY_INDEX = 8192;
+
+(function ToStringThrows() {
+  function TestError() {}
+
+  let callCount = 0;
+  const a = [1, 2];
+  assertThrows(() => a.join({
+    toString() {
+      callCount++;
+      throw new TestError;
+    }
+  }), TestError);
+  assertSame(1, callCount);
+
+  // Verifies cycle detection still works properly after thrown error.
+  assertSame('1,2', a.join());
+})();
+
+(function RecursiveJoinCall() {
+  const a = [1,2,3];
+  let callCount = 0;
+  const sep = {
+    toString() {
+      callCount++;
+      return a.join('-');
+    }
+  };
+  assertSame('11-2-321-2-33', a.join(sep));
+  assertSame(1, callCount);
+
+  // Verify cycle detection works properly after nested call
+  assertSame('1,2,3', a.join());
+})();
+
+
+(function ArrayLengthIncreased() {
+  const a = [1,2,3];
+  let callCount = 0;
+  assertSame('1,2,3', a.join({
+    toString() {
+      callCount++;
+      a.push(4);
+      return ',';
+    }
+  }));
+  assertSame(1, callCount);
+  assertSame('1,2,3,4', a.join());
+})();
+
+(function ArrayLengthDecreased() {
+  const a = [1,2,3];
+  let callCount = 0;
+  assertSame('1,2,', a.join({
+    toString() {
+      callCount++;
+      a.pop();
+      return ',';
+    }
+  }));
+  assertSame(1, callCount);
+  assertSame('1,2', a.join());
+})();
+
+(function ArrayEmptied() {
+  const a = [1,2,3];
+  let callCount = 0;
+  assertSame(',,', a.join({
+    toString() {
+      callCount++;
+      a.length = 0;
+      return ',';
+    }
+  }));
+  assertSame(1, callCount);
+})();
+
+(function NumberDictionaryEmptied() {
+  const a = [];
+  a[0] = 1;
+  a[MIN_DICTIONARY_INDEX] = 2;
+  assertTrue(%HasDictionaryElements(a));
+
+  let callCount = 0;
+  assertSame('-'.repeat(MIN_DICTIONARY_INDEX), a.join({
+    toString() {
+      callCount++;
+      a.length = 0;
+      return '-';
+    }
+  }));
+  assertSame(1, callCount);
+})();
+
+(function NumberDictionaryEmptiedEmptySeparator() {
+  const a = [];
+  a[0] = 1;
+  a[MIN_DICTIONARY_INDEX] = 2;
+  assertTrue(%HasDictionaryElements(a));
+
+  let callCount = 0;
+  assertSame(''.repeat(MIN_DICTIONARY_INDEX), a.join({
+    toString() {
+      callCount++;
+      a.length = 0;
+      return '';
+    }
+  }));
+  assertSame(1, callCount);
+})();
+
+(function ElementsKindSmiToDoubles() {
+  const a = [1,2,3];
+  let callCount = 0;
+  assertTrue(%HasSmiElements(a));
+  assertSame('1.5,2,3', a.join({
+    toString() {
+      callCount++;
+      a[0] = 1.5;
+      assertTrue(%HasDoubleElements(a));
+      return ',';
+    }
+  }));
+  assertSame(1, callCount);
+  assertSame('1.5,2,3', a.join());
+})();
+
+(function ElementsKindDoublesToObjects() {
+  const a = [1.5, 2.5, 3.5];
+  let callCount = 0;
+  assertTrue(%HasDoubleElements(a));
+  assertSame('one,2.5,3.5', a.join({
+    toString() {
+      callCount++;
+      a[0] = 'one';
+      assertTrue(%HasObjectElements(a));
+      return ',';
+    }
+  }));
+  assertSame(1, callCount);
+  assertSame('one,2.5,3.5', a.join());
+})();
+
+(function ArrayIsNoLongerFast() {
+  const a = [1,2,3];
+  let callCount = 0;
+  assertSame('666,2,3', a.join({
+    toString() {
+      callCount++;
+      Object.defineProperty(a, '0', {
+        get(){ return 666; }
+      });
+      return ',';
+    }
+  }));
+  assertSame(1, callCount);
+  assertSame('666,2,3', a.join());
+})();
+
+(function ArrayPrototypeUnset() {
+  const a = [1,2];
+  a.length = 3;
+  let callCount = 0;
+  assertSame('1,2,4', a.join({
+    toString() {
+      callCount++;
+      a.__proto__ = { '2': 4 };
+      return ',';
+    }
+  }));
+  assertSame(1, callCount);
+  a.__proto__ = Array.prototype;
+  assertSame('1,2,', a.join());
+})();
+
+(function ArrayPrototypeIsNoLongerFast() {
+  const a = [1,2,3];
+  let callCount = 0;
+  assertSame('1,2,777', a.join({
+    toString() {
+      callCount++;
+      a.pop();
+      Object.defineProperty(Array.prototype, '2', {
+        get(){ return 777; }
+      });
+      return ',';
+    }
+  }));
+  assertSame(1, callCount);
+  assertSame('1,2', a.join());
+})();
diff --git a/src/v8/test/mjsunit/array-join.js b/src/v8/test/mjsunit/array-join.js
index 0c949e7..1d5ab30 100644
--- a/src/v8/test/mjsunit/array-join.js
+++ b/src/v8/test/mjsunit/array-join.js
@@ -25,6 +25,17 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+assertSame(',', [null, undefined].join());
+assertSame('1.5,2.5', [1.5, 2.5].join());
+assertSame(',1.5,', [,1.5,,].join());
+
+var obj = {
+  toString() {
+    return 'a';
+  }
+};
+assertSame('1,1.5,a,', [1, 1.5, obj, ,].join());
+
 // Test that array join calls toString on subarrays.
 var a = [[1,2],3,4,[5,6]];
 assertEquals('1,2345,6', a.join(''));
@@ -82,9 +93,6 @@
 
 a = new Array(Math.pow(2,32) - 1);  // Max length.
 assertEquals("", a.join(""));
-a[123123123] = "o";
-a[1255215215] = "p";
-assertEquals("op", a.join(""));
 
 a = new Array(100001);
 for (var i = 0; i < a.length; i++) a[i] = undefined;
diff --git a/src/v8/test/mjsunit/array-lastindexof.js b/src/v8/test/mjsunit/array-lastindexof.js
index 785bd64..c31ad18 100644
--- a/src/v8/test/mjsunit/array-lastindexof.js
+++ b/src/v8/test/mjsunit/array-lastindexof.js
@@ -8,3 +8,76 @@
 assertThrows(() => {
   Array.prototype.lastIndexOf.call(undefined, 42);
 }, TypeError);
+
+/* Tests inspired by test262's
+  lastIndexOf/calls-only-has-on-prototype-after-length-zeroed.js */
+// Stateful fromIndex that tries to empty the array
+(function testFromIndex() {
+  var array = [5, undefined, 7];
+  var fromIndex = {
+    valueOf: function() {
+      array.length = 1;
+      return 2;
+    }
+  };
+  assertEquals(-1, array.lastIndexOf(undefined, fromIndex));
+
+  array = [5, undefined, 7];
+  assertEquals(0, array.lastIndexOf(5, fromIndex));
+})();
+
+// Stateful fromIndex and proxy as Prototype
+// Must test for [[HasProperty]] before [[Get]]
+var testHasProperty = function(value) {
+  var array = [5, undefined, 7];
+  var fromIndex = {
+    valueOf: function() {
+      array.length = 0;
+      return 2;
+    }
+  };
+
+  // Install a prototype that only has [[HasProperty]], and throws on [[Get]]
+  Object.setPrototypeOf(array,
+    new Proxy(Array.prototype, {
+                has: function(t, pk) { return pk in t; },
+                get: function () { throw new Error('[[Get]] trap called') },
+              }));
+
+  assertEquals(-1, Array.prototype.lastIndexOf.call(array, value, fromIndex));
+}
+
+testHasProperty(5);
+testHasProperty(undefined);
+
+// Test call order: [[HasProperty]] before [[Get]]
+var testHasPropertyThenGet = function(value) {
+  var array = [5, , 7];
+  var log = [];
+
+  // Install a prototype with only [[HasProperty]] and [[Get]]
+  Object.setPrototypeOf(array,
+    new Proxy(Array.prototype, {
+                has: function() { log.push("HasProperty"); return true; },
+                get: function() { log.push("Get"); },
+              }));
+  // The 2nd element (index 1) will trigger the calls to the prototype
+  Array.prototype.lastIndexOf.call(array, value);
+  assertEquals(["HasProperty", "Get"], log);
+}
+
+testHasPropertyThenGet(5);
+testHasPropertyThenGet(undefined);
+
+// Test for sparse Arrays
+/* This will not enter the fast path for sparse arrays, due to UseSparseVariant
+  excluding array elements with accessors */
+(function() {
+  var array = new Array(10000);
+  array[0] = 5; array[9999] = 7;
+
+  var count = 0;
+  Object.defineProperty(array.__proto__, 9998, { get: () => ++count });
+  Array.prototype.lastIndexOf.call(array, 0);
+  assertEquals(1,count);
+})();
diff --git a/src/v8/test/mjsunit/array-literal-feedback.js b/src/v8/test/mjsunit/array-literal-feedback.js
index b20cdd8..a54f37a 100644
--- a/src/v8/test/mjsunit/array-literal-feedback.js
+++ b/src/v8/test/mjsunit/array-literal-feedback.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --expose-gc --opt --no-always-opt
+// Flags: --allow-natives-syntax --expose-gc --opt --no-always-opt --deopt-every-n-times=0
 
 var elements_kind = {
   packed_smi               :  'packed smi elements',
@@ -62,8 +62,9 @@
 function get_literal(x) {
   var literal = [1, 2, x];
   return literal;
-}
+};
 
+%PrepareFunctionForOptimization(get_literal);
 get_literal(3);
 // It's important to store a from before we crankshaft get_literal, because
 // mementos won't be created from crankshafted code at all.
@@ -84,6 +85,7 @@
 assertUnoptimized(get_literal);
 
 // Optimize again
+%PrepareFunctionForOptimization(get_literal);
 get_literal(3);
 %OptimizeFunctionOnNextCall(get_literal);
 b = get_literal(3);
@@ -109,7 +111,8 @@
 (function changeOptimizedEmptyArrayKind() {
   function f() {
     return new Array();
-  }
+  };
+  %PrepareFunctionForOptimization(f);
   var a = f();
   assertKind('packed smi elements', a);
   a = f();
@@ -125,7 +128,8 @@
 (function changeOptimizedArrayLiteralKind() {
   function f() {
     return [1, 2];
-  }
+  };
+  %PrepareFunctionForOptimization(f);
   var a = f();
   assertKind('packed smi elements', a);
 
@@ -160,7 +164,8 @@
 (function changeOptimizedEmptyArrayLiteralKind() {
   function f() {
     return [];
-  }
+  };
+  %PrepareFunctionForOptimization(f);
   var a = f();
   assertKind('packed smi elements', a);
   assertFalse(isHoley(a));
@@ -190,7 +195,8 @@
     var literal = [];
     %HeapObjectVerify(literal);
     return literal;
-  }
+  };
+  %PrepareFunctionForOptimization(f);
   var a = f();
   assertKind('packed smi elements', a);
   assertFalse(isHoley(a));
diff --git a/src/v8/test/mjsunit/array-literal-transitions.js b/src/v8/test/mjsunit/array-literal-transitions.js
index 6366839..84fbc27 100644
--- a/src/v8/test/mjsunit/array-literal-transitions.js
+++ b/src/v8/test/mjsunit/array-literal-transitions.js
@@ -79,7 +79,9 @@
   assertEquals(2, f0[1]);
   assertEquals(1, f0[0]);
 }
+%PrepareFunctionForOptimization(array_literal_test);
 
+%PrepareFunctionForOptimization(array_literal_test);
 for (var i = 0; i < 3; i++) {
   array_literal_test();
 }
@@ -108,7 +110,9 @@
                [0, 1, 2, 3, 4, 5, 2.5, 2.5, 2.5, 2.5, 2.5, 2.5,
                 new Object(), new Object(), new Object(), new Object()]);
 }
+%PrepareFunctionForOptimization(test_large_literal);
 
+%PrepareFunctionForOptimization(test_large_literal);
 for (var i = 0; i < 3; i++) {
   test_large_literal();
 }
@@ -122,7 +126,9 @@
     return new Array();
   }
 }
+%PrepareFunctionForOptimization(deopt_array);
 
+%PrepareFunctionForOptimization(deopt_array);
 deopt_array(false);
 deopt_array(false);
 deopt_array(false);
@@ -139,7 +145,9 @@
 function deopt_array_literal_all_smis(a) {
   return [0, 1, a];
 }
+%PrepareFunctionForOptimization(deopt_array_literal_all_smis);
 
+%PrepareFunctionForOptimization(deopt_array_literal_all_smis);
 deopt_array_literal_all_smis(2);
 deopt_array_literal_all_smis(3);
 deopt_array_literal_all_smis(4);
@@ -164,7 +172,9 @@
 function deopt_array_literal_all_doubles(a) {
   return [0.5, 1, a];
 }
+%PrepareFunctionForOptimization(deopt_array_literal_all_doubles);
 
+%PrepareFunctionForOptimization(deopt_array_literal_all_doubles);
 deopt_array_literal_all_doubles(.5);
 deopt_array_literal_all_doubles(.5);
 deopt_array_literal_all_doubles(.5);
diff --git a/src/v8/test/mjsunit/array-methods-read-only-length.js b/src/v8/test/mjsunit/array-methods-read-only-length.js
index 7de580d..a6b3091 100644
--- a/src/v8/test/mjsunit/array-methods-read-only-length.js
+++ b/src/v8/test/mjsunit/array-methods-read-only-length.js
@@ -20,6 +20,7 @@
 
   if (mode == "fast properties") %ToFastProperties(a);
 
+  %PrepareFunctionForOptimization(push);
   check(push);
   check(push);
   check(push);
@@ -30,6 +31,7 @@
     a.unshift(3);
   }
 
+  %PrepareFunctionForOptimization(unshift);
   check(unshift);
   check(unshift);
   check(unshift);
@@ -40,6 +42,7 @@
     a.splice(0, 0, 3);
   }
 
+  %PrepareFunctionForOptimization(splice);
   check(splice);
   check(splice);
   check(splice);
@@ -65,6 +68,7 @@
     a.pop();
   }
 
+  %PrepareFunctionForOptimization(pop);
   check(pop);
   check(pop);
   check(pop);
@@ -75,6 +79,7 @@
     a.shift();
   }
 
+  %PrepareFunctionForOptimization(shift);
   check(shift);
   check(shift);
   check(shift);
@@ -85,6 +90,7 @@
     a.splice(0, 1);
   }
 
+  %PrepareFunctionForOptimization(splice);
   check(splice);
   check(splice);
   check(splice);
diff --git a/src/v8/test/mjsunit/array-natives-elements.js b/src/v8/test/mjsunit/array-natives-elements.js
index 8ab2148..0b38991 100644
--- a/src/v8/test/mjsunit/array-natives-elements.js
+++ b/src/v8/test/mjsunit/array-natives-elements.js
@@ -112,15 +112,19 @@
   assertEquals([2], a2.slice(1,2));
   a2 = [1.1,2,3];
   assertTrue(%HasDoubleElements(a2.slice()));
-  assertTrue(%HasDoubleElements(a2.slice(1)));
-  assertTrue(%HasDoubleElements(a2.slice(1, 2)));
+  assertTrue(%HasDoubleElements(a2.slice(1)) ||
+             %HasSmiElements(a2.slice(1)));
+  assertTrue(%HasDoubleElements(a2.slice(1, 2)) ||
+            %HasSmiElements(a2.slice(1, 2)));
   assertEquals([1.1,2,3], a2.slice());
   assertEquals([2,3], a2.slice(1));
   assertEquals([2], a2.slice(1,2));
   a2 = [{},2,3];
   assertTrue(%HasObjectElements(a2.slice()));
-  assertTrue(%HasObjectElements(a2.slice(1)));
-  assertTrue(%HasObjectElements(a2.slice(1, 2)));
+  assertTrue(%HasObjectElements(a2.slice(1)) ||
+             %HasSmiElements(a2.slice(1)));
+  assertTrue(%HasObjectElements(a2.slice(1, 2)) ||
+             %HasSmiElements(a2.slice(1, 2)));
   assertEquals([{},2,3], a2.slice());
   assertEquals([2,3], a2.slice(1));
   assertEquals([2], a2.slice(1,2));
@@ -301,6 +305,7 @@
   assertEquals([1.1,{},2,3], a4);
 }
 
+%PrepareFunctionForOptimization(array_natives_test);
 for (var i = 0; i < 3; i++) {
   array_natives_test();
 }
diff --git a/src/v8/test/mjsunit/array-non-smi-length.js b/src/v8/test/mjsunit/array-non-smi-length.js
index 11277af..346ce19 100644
--- a/src/v8/test/mjsunit/array-non-smi-length.js
+++ b/src/v8/test/mjsunit/array-non-smi-length.js
@@ -32,6 +32,8 @@
     return a.length+1;
   }
 
+  %PrepareFunctionForOptimization(f);
+
   var a = [];
   a.length = 0xFFFF;
   assertSame(0x10000, f(a));
diff --git a/src/v8/test/mjsunit/array-pop.js b/src/v8/test/mjsunit/array-pop.js
index 1777183..47e882f 100644
--- a/src/v8/test/mjsunit/array-pop.js
+++ b/src/v8/test/mjsunit/array-pop.js
@@ -131,6 +131,7 @@
     return v;
   }
 
+  %PrepareFunctionForOptimization(f);
   var a = [true, true, true, true]
   assertEquals(1, f(a, false));
   assertEquals(1, f(a, false));
diff --git a/src/v8/test/mjsunit/array-prototype-every.js b/src/v8/test/mjsunit/array-prototype-every.js
new file mode 100644
index 0000000..a9e415e
--- /dev/null
+++ b/src/v8/test/mjsunit/array-prototype-every.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/* Test behaviors when the prototype has elements */
+
+// every
+
+(function () {
+  var array = [,];
+
+  function every() {
+    return array.every(v => v > 0);
+  }
+
+  assertEquals(every(), true);
+
+  array.__proto__.push(-6);
+  assertEquals(every(), false);
+})();
diff --git a/src/v8/test/mjsunit/array-prototype-filter.js b/src/v8/test/mjsunit/array-prototype-filter.js
new file mode 100644
index 0000000..958df23
--- /dev/null
+++ b/src/v8/test/mjsunit/array-prototype-filter.js
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/* Test behaviors when the prototype has elements */
+
+// filter
+
+(function () {
+  var array = [,];
+
+  function filter() {
+    return array.filter(v => v > 0);
+  }
+
+  assertEquals(filter(), []);
+
+  array.__proto__.push(6);
+  var narr = filter();
+  assertNotEquals(Object.getOwnPropertyDescriptor(narr, 0), undefined);
+  assertEquals(narr, [6]);
+})();
diff --git a/src/v8/test/mjsunit/array-prototype-find.js b/src/v8/test/mjsunit/array-prototype-find.js
new file mode 100644
index 0000000..8847fdd
--- /dev/null
+++ b/src/v8/test/mjsunit/array-prototype-find.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/* Test behaviors when the prototype has elements */
+
+// find
+
+(function () {
+  var array = [,];
+
+  function find() {
+    return array.find(v => v > 0);
+  }
+
+  assertEquals(find(), undefined);
+
+  array.__proto__.push(6);
+  assertEquals(find(), 6);
+})();
diff --git a/src/v8/test/mjsunit/array-prototype-findindex.js b/src/v8/test/mjsunit/array-prototype-findindex.js
new file mode 100644
index 0000000..5d627ca
--- /dev/null
+++ b/src/v8/test/mjsunit/array-prototype-findindex.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/* Test behaviors when the prototype has elements */
+
+// findIndex
+
+(function () {
+  var array = [,];
+
+  function findIndex() {
+    return array.findIndex(v => v > 0);
+  }
+
+  assertEquals(findIndex(), -1);
+
+  array.__proto__.push(6);
+  assertEquals(findIndex(), 0);
+})();
diff --git a/src/v8/test/mjsunit/array-prototype-foreach.js b/src/v8/test/mjsunit/array-prototype-foreach.js
new file mode 100644
index 0000000..7f01d8e
--- /dev/null
+++ b/src/v8/test/mjsunit/array-prototype-foreach.js
@@ -0,0 +1,26 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/* Test behaviors when the prototype has elements */
+
+// forEach
+
+(function () {
+  var array = [,];
+
+  function increment(v, k, arr) { arr[k] = v + 1; }
+  function forEach() {
+    array.forEach(increment);
+  }
+
+  forEach();
+  assertEquals(array, [,]);
+
+  // behavior from the prototype
+  array.__proto__.push(5);
+  assertEquals(Object.getOwnPropertyDescriptor(array, 0), undefined);
+  forEach();
+  assertNotEquals(Object.getOwnPropertyDescriptor(array, 0), undefined);
+  assertEquals(array[0], 6);
+})();
diff --git a/src/v8/test/mjsunit/array-prototype-includes.js b/src/v8/test/mjsunit/array-prototype-includes.js
new file mode 100644
index 0000000..5c1d926
--- /dev/null
+++ b/src/v8/test/mjsunit/array-prototype-includes.js
@@ -0,0 +1,36 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/* Test behaviors when the prototype has elements */
+
+// includes
+
+(function() {
+  const iarr = [,3];
+
+  function includes(arr, val) {
+    return arr.includes(val);
+  }
+
+  assertFalse(includes(iarr, 2));
+  assertTrue(includes(iarr, 3));
+
+  iarr.__proto__ = [2];
+  assertTrue(includes(iarr, 2));
+})();
+
+// This pollutes the Array prototype, so we should not run more tests
+// in the same environment after this.
+(function () {
+  var array = [,];
+
+  function includes(val) {
+    return array.includes(val);
+  }
+
+  assertFalse(includes(6));
+
+  array.__proto__.push(6);
+  assertTrue(includes(6));
+})();
diff --git a/src/v8/test/mjsunit/array-prototype-indexof.js b/src/v8/test/mjsunit/array-prototype-indexof.js
new file mode 100644
index 0000000..ca639f4
--- /dev/null
+++ b/src/v8/test/mjsunit/array-prototype-indexof.js
@@ -0,0 +1,36 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// indexOf
+
+/* Test behaviors when the prototype has elements */
+
+(function() {
+  const iarr = [,3];
+
+  function indexOf(arr, val) {
+    return arr.indexOf(val);
+  }
+
+  assertEquals(-1, indexOf(iarr, 2));
+  assertEquals(1, indexOf(iarr, 3));
+
+  iarr.__proto__ = [2];
+  assertEquals(0, indexOf(iarr, 2));
+})();
+
+// This pollutes the Array prototype, so we should not run more tests
+// in the same environment after this.
+(function () {
+  var array = [,];
+
+  function indexOf(val) {
+    return array.indexOf(val);
+  }
+
+  assertEquals(indexOf(6), -1);
+
+  array.__proto__.push(6);
+  assertEquals(indexOf(6), 0);
+})();
diff --git a/src/v8/test/mjsunit/array-prototype-lastindexof.js b/src/v8/test/mjsunit/array-prototype-lastindexof.js
new file mode 100644
index 0000000..b034530
--- /dev/null
+++ b/src/v8/test/mjsunit/array-prototype-lastindexof.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/* Test behaviors when the prototype has elements */
+
+// lastIndexOf
+
+(function () {
+  var array = [,];
+
+  function lastIndexOf(val) {
+    return array.lastIndexOf(val);
+  }
+
+  assertEquals(lastIndexOf(6), -1);
+
+  array.__proto__.push(6);
+  assertEquals(lastIndexOf(6), 0);
+})();
diff --git a/src/v8/test/mjsunit/array-prototype-map.js b/src/v8/test/mjsunit/array-prototype-map.js
new file mode 100644
index 0000000..1ef6088
--- /dev/null
+++ b/src/v8/test/mjsunit/array-prototype-map.js
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/* Test behaviors when the prototype has elements */
+
+// map
+(function () {
+  var array = [,];
+
+  function map() {
+    return array.map(x => x + 1);
+  }
+
+  assertEquals(map(), [,]);
+
+  array.__proto__.push(5);
+  var narr = map();
+  assertNotEquals(Object.getOwnPropertyDescriptor(narr, 0), undefined);
+  assertEquals(narr[0], 6);
+})();
diff --git a/src/v8/test/mjsunit/array-prototype-pop.js b/src/v8/test/mjsunit/array-prototype-pop.js
new file mode 100644
index 0000000..730b982
--- /dev/null
+++ b/src/v8/test/mjsunit/array-prototype-pop.js
@@ -0,0 +1,29 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/* Test behaviors when the prototype has elements */
+
+// pop
+
+(function () {
+  var array = [,];
+
+  function pop() {
+    return array.pop();
+  }
+
+  assertEquals(pop(), undefined);
+})();
+
+
+(function () {
+  var array = [,];
+
+  function pop() {
+    return array.pop();
+  }
+
+  array.__proto__.push(6);
+  assertEquals(pop(), 6);
+})();
diff --git a/src/v8/test/mjsunit/array-prototype-reduce.js b/src/v8/test/mjsunit/array-prototype-reduce.js
new file mode 100644
index 0000000..593066f
--- /dev/null
+++ b/src/v8/test/mjsunit/array-prototype-reduce.js
@@ -0,0 +1,24 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/* Test behaviors when the prototype has elements */
+
+// reduce
+
+(function () {
+  var array = [, 3];
+
+  function accumulate (prev, cur, curIdx, arr) { arr[curIdx] = cur + prev; }
+  function reduce() {
+    array.reduce(accumulate);
+  }
+
+  reduce();
+  assertEquals(array, [,3]);
+
+  array.__proto__.push(3);
+  reduce();
+  assertEquals(array, [, 6]);
+  assertEquals(Object.getOwnPropertyDescriptor(array, 0), undefined);
+})();
diff --git a/src/v8/test/mjsunit/array-prototype-slice.js b/src/v8/test/mjsunit/array-prototype-slice.js
new file mode 100644
index 0000000..d4bcad2
--- /dev/null
+++ b/src/v8/test/mjsunit/array-prototype-slice.js
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/* Test behaviors when the prototype has elements */
+
+// slice
+(function () {
+  var array = [,];
+
+  function slice() {
+    return array.slice();
+  }
+
+  assertEquals(slice(), [,]);
+
+  array.__proto__.push(5);
+  var narr = slice();
+  assertNotEquals(Object.getOwnPropertyDescriptor(narr, 0), undefined);
+  assertEquals(narr[0], 5);
+})();
diff --git a/src/v8/test/mjsunit/array-prototype-some.js b/src/v8/test/mjsunit/array-prototype-some.js
new file mode 100644
index 0000000..2118444
--- /dev/null
+++ b/src/v8/test/mjsunit/array-prototype-some.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/* Test behaviors when the prototype has elements */
+
+// some
+
+(function () {
+  var array = [,];
+
+  function some() {
+    return array.some(v => v > 0);
+  }
+
+  assertEquals(some(), false);
+
+  array.__proto__.push(6);
+  assertEquals(some(), true);
+})();
diff --git a/src/v8/test/mjsunit/array-push.js b/src/v8/test/mjsunit/array-push.js
index ece3319..cb95c93 100644
--- a/src/v8/test/mjsunit/array-push.js
+++ b/src/v8/test/mjsunit/array-push.js
@@ -135,7 +135,7 @@
   function f(a, i) {
     a.push(i);
   }
-
+  %PrepareFunctionForOptimization(f);
   var a = [1,2,3];
   a.f = function() { return 10; }
   f(a, 4);
diff --git a/src/v8/test/mjsunit/array-push12.js b/src/v8/test/mjsunit/array-push12.js
index f4c15b4..93d59fd 100644
--- a/src/v8/test/mjsunit/array-push12.js
+++ b/src/v8/test/mjsunit/array-push12.js
@@ -17,6 +17,7 @@
   g();
 }
 
+%PrepareFunctionForOptimization(f);
 g();
 g();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/array-push3.js b/src/v8/test/mjsunit/array-push3.js
index 99bd857..e1f438b 100644
--- a/src/v8/test/mjsunit/array-push3.js
+++ b/src/v8/test/mjsunit/array-push3.js
@@ -8,8 +8,9 @@
 
 function push(array, value) {
   array.push(value);
-}
+};
 
+%PrepareFunctionForOptimization(push);
 push(array, 0);
 push(array, 1);
 push(array, 2);
diff --git a/src/v8/test/mjsunit/array-push4.js b/src/v8/test/mjsunit/array-push4.js
index 678873f..a206fda 100644
--- a/src/v8/test/mjsunit/array-push4.js
+++ b/src/v8/test/mjsunit/array-push4.js
@@ -42,6 +42,7 @@
 function push_wrapper_1(array, value) {
   array.push(value);
 }
+%PrepareFunctionForOptimization(push_wrapper_1);
 array = [];
 array.__proto__ = my_array_proto;
 push_wrapper_1(array, 100);
diff --git a/src/v8/test/mjsunit/array-push5.js b/src/v8/test/mjsunit/array-push5.js
index 9961ff9..88ebd3a 100644
--- a/src/v8/test/mjsunit/array-push5.js
+++ b/src/v8/test/mjsunit/array-push5.js
@@ -14,6 +14,7 @@
 function push_wrapper_2(array, value) {
   array.push(value);
 }
+%PrepareFunctionForOptimization(push_wrapper_2);
 array = [];
 array.__proto__ = my_array_proto;
 push_wrapper_2(array, 66);
diff --git a/src/v8/test/mjsunit/array-push6.js b/src/v8/test/mjsunit/array-push6.js
index 336b43d..bce9c54 100644
--- a/src/v8/test/mjsunit/array-push6.js
+++ b/src/v8/test/mjsunit/array-push6.js
@@ -8,6 +8,8 @@
   array.push(value);
 }
 
+%PrepareFunctionForOptimization(push_wrapper);
+
 // Test that optimization of Array.push() for non-Arrays works correctly.
 var object = { x : 8, length: 3 };
 object[18] = 5;
diff --git a/src/v8/test/mjsunit/array-push8.js b/src/v8/test/mjsunit/array-push8.js
index b1a8766..cd90573 100644
--- a/src/v8/test/mjsunit/array-push8.js
+++ b/src/v8/test/mjsunit/array-push8.js
@@ -7,9 +7,12 @@
 function push_wrapper(array, value) {
   array.push(value);
 }
+%PrepareFunctionForOptimization(push_wrapper);
+
 function pop_wrapper(array) {
   return array.pop();
 }
+%PrepareFunctionForOptimization(pop_wrapper);
 
 // Test the frzon arrays throw an exception if you try to push to them, both in
 // optimized and non-optimized code.
diff --git a/src/v8/test/mjsunit/array-push9.js b/src/v8/test/mjsunit/array-push9.js
index f1427f2..0bdcda1 100644
--- a/src/v8/test/mjsunit/array-push9.js
+++ b/src/v8/test/mjsunit/array-push9.js
@@ -10,6 +10,7 @@
   array.push(value);
 }
 
+%PrepareFunctionForOptimization(push);
 push(array, 0);
 push(array, 1);
 push(array, 2);
diff --git a/src/v8/test/mjsunit/array-reduce.js b/src/v8/test/mjsunit/array-reduce.js
index 171a40f..5d431b0 100644
--- a/src/v8/test/mjsunit/array-reduce.js
+++ b/src/v8/test/mjsunit/array-reduce.js
@@ -509,6 +509,13 @@
             [1, 2, 1, [1, 2], 3],
            ], arr, manipulator, 0);
 
+var arr = [1, 2, 3, 4];
+testReduce("reduceRight", "RightArrayManipulationShort", 7,
+           [[0, 4, 3, [1, 2, 3, 4], 4],
+            [4, 2, 1, [1, 2], 6],
+            [6, 1, 0, [1], 7],
+           ], arr, manipulator, 0);
+
 var arr = [1, 2, 3, 4, 5];
 testReduce("reduce", "ArrayManipulationLonger", 10,
            [[0, 1, 0, [1, 2, 3, 4, 5], 1],
@@ -564,7 +571,8 @@
   let f = (a,current) => a + current;
   let g = function(a) {
     return a.reduce(f);
-  }
+  };
+  %PrepareFunctionForOptimization(g);
   let a = [1,2,3,4,5,6,7,8,9,10];
   g(a); g(a);
   let total = g(a);
@@ -576,7 +584,8 @@
   let f = (a,current) => a + current;
   let g = function(a) {
     return a.reduce(f);
-  }
+  };
+  %PrepareFunctionForOptimization(g);
   let a = [1,2,3,4,5,6,7,8,9,10];
   g(a); g(a); g(a);
   %OptimizeFunctionOnNextCall(g);
@@ -589,7 +598,8 @@
   let f = (a,current) => { if (deopt) %DeoptimizeNow(); return a + current; };
   let g = function(a) {
     return a.reduce(f);
-  }
+  };
+  %PrepareFunctionForOptimization(g);
   let a = [1,2,3,4,5,6,7,8,9,10];
   g(a); g(a);
   let total = g(a);
@@ -607,7 +617,8 @@
   };
   let g = function(a) {
     return a.reduce(f);
-  }
+  };
+  %PrepareFunctionForOptimization(g);
   let a = [11,22,33,45,56,6,77,84,93,101];
   g(a); g(a);
   let total = g(a);
@@ -626,13 +637,78 @@
   };
   let g = function() {
     return array.reduce(f);
-  }
+  };
+  %PrepareFunctionForOptimization(g);
   g(); g();
   let total = g();
   %OptimizeFunctionOnNextCall(g);
   g();
   deopt = true;
   g();
+  %PrepareFunctionForOptimization(g);
+  deopt = false;
+  array = [11,22,33,45,56,6,77,84,93,101];
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  deopt = true;
+  assertEquals(total, g());
+})();
+
+(function OptimizedReduceEagerDeoptMiddleOfIterationHoley() {
+  let deopt = false;
+  let array = [, ,11,22,,33,45,56,,6,77,84,93,101,];
+  let f = (a,current) => {
+    if (current == 6 && deopt) {array[0] = 1.5; }
+    return a + current;
+  };
+  let g = function() {
+    return array.reduce(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  deopt = true;
+  g();
+  %PrepareFunctionForOptimization(g);
+  deopt = false;
+  array = [11,22,33,45,56,6,77,84,93,101];
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  deopt = true;
+  assertEquals(total, g());
+})();
+
+(function TriggerReduceRightPreLoopDeopt() {
+  function f(a) {
+    a.reduceRight((x) => { return x + 1 });
+  };
+  %PrepareFunctionForOptimization(f);
+  f([1,2,]);
+  f([1,2,]);
+  %OptimizeFunctionOnNextCall(f);
+  assertThrows(() => f([]), TypeError);
+})();
+
+(function OptimizedReduceRightEagerDeoptMiddleOfIterationHoley() {
+  let deopt = false;
+  let array = [, ,11,22,,33,45,56,,6,77,84,93,101,];
+  let f = (a,current) => {
+    if (current == 6 && deopt) {array[array.length-1] = 1.5; }
+    return a + current;
+  };
+  let g = function() {
+    return array.reduceRight(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  deopt = true;
+  g();
+  %PrepareFunctionForOptimization(g);
   deopt = false;
   array = [11,22,33,45,56,6,77,84,93,101];
   %OptimizeFunctionOnNextCall(g);
@@ -650,7 +726,8 @@
       return array.reduce(f);
     } catch (e) {
     }
-  }
+  };
+  %PrepareFunctionForOptimization(g);
   g(); g();
   let total = g();
   %OptimizeFunctionOnNextCall(g);
@@ -672,7 +749,8 @@
     } catch (e) {
       return null;
     }
-  }
+  };
+  %PrepareFunctionForOptimization(g);
   g(); g();
   let total = g();
   %OptimizeFunctionOnNextCall(g);
@@ -681,6 +759,7 @@
   done = true;
   assertEquals(null, g());
   done = false;
+  %PrepareFunctionForOptimization(g);
   g(); g();
   %OptimizeFunctionOnNextCall(g);
   g();
@@ -703,7 +782,8 @@
     } catch (e) {
       return null;
     }
-  }
+  };
+  %PrepareFunctionForOptimization(g);
   g(); g();
   let total = g();
   %OptimizeFunctionOnNextCall(g);
@@ -712,6 +792,7 @@
   done = true;
   assertEquals(null, g());
   done = false;
+  %PrepareFunctionForOptimization(g);
   g(); g();
   %OptimizeFunctionOnNextCall(g);
   g();
@@ -734,7 +815,8 @@
     } finally {
       if (done) return null;
     }
-  }
+  };
+  %PrepareFunctionForOptimization(g);
   g(); g();
   let total = g();
   %OptimizeFunctionOnNextCall(g);
@@ -743,6 +825,7 @@
   done = true;
   assertEquals(null, g());
   done = false;
+  %PrepareFunctionForOptimization(g);
   g(); g();
   %OptimizeFunctionOnNextCall(g);
   g();
@@ -766,7 +849,8 @@
     } finally {
       if (done) return null;
     }
-  }
+  };
+  %PrepareFunctionForOptimization(g);
   g(); g();
   let total = g();
   %OptimizeFunctionOnNextCall(g);
@@ -775,6 +859,7 @@
   done = true;
   assertEquals(null, g());
   done = false;
+  %PrepareFunctionForOptimization(g);
   g(); g();
   %OptimizeFunctionOnNextCall(g);
   g();
@@ -791,7 +876,8 @@
   let array = [1,2,3];
   let g = function() {
     return array.reduce(f);
-  }
+  };
+  %PrepareFunctionForOptimization(g);
   g(); g();
   let total = g();
   %OptimizeFunctionOnNextCall(g);
@@ -817,7 +903,8 @@
     } catch (e) {
       if (done) return null;
     }
-  }
+  };
+  %PrepareFunctionForOptimization(g);
   g(); g();
   let total = g();
   %OptimizeFunctionOnNextCall(g);
@@ -826,6 +913,7 @@
   done = true;
   assertEquals(null, g());
   done = false;
+  %PrepareFunctionForOptimization(g);
   g(); g();
   %OptimizeFunctionOnNextCall(g);
   g();
@@ -851,7 +939,8 @@
     } finally {
       if (done) return null;
     }
-  }
+  };
+  %PrepareFunctionForOptimization(g);
   g(); g();
   let total = g();
   %OptimizeFunctionOnNextCall(g);
@@ -860,6 +949,7 @@
   done = true;
   assertEquals(null, g());
   done = false;
+  %PrepareFunctionForOptimization(g);
   g(); g();
   %OptimizeFunctionOnNextCall(g);
   g();
@@ -874,7 +964,8 @@
   let g = function(a) {
     count = 0;
     return a.reduceRight(f);
-  }
+  };
+  %PrepareFunctionForOptimization(g);
   let a = [1,2,3,4,5,6,7,8,9,10];
   g(a); g(a);
   let total = g(a);
@@ -888,7 +979,8 @@
   let g = function(a) {
     count = 0;
     return a.reduceRight(f);
-  }
+  };
+  %PrepareFunctionForOptimization(g);
   let a = [1,2,3,4,5,6,7,8,9,10];
   g(a); g(a); g(a);
   %OptimizeFunctionOnNextCall(g);
@@ -901,7 +993,8 @@
   let f = (a,current) => { if (deopt) %DeoptimizeNow(); return a + current; };
   let g = function(a) {
     return a.reduceRight(f);
-  }
+  };
+  %PrepareFunctionForOptimization(g);
   let a = [1,2,3,4,5,6,7,8,9,10];
   g(a); g(a);
   let total = g(a);
@@ -919,7 +1012,8 @@
   };
   let g = function(a) {
     return a.reduceRight(f);
-  }
+  };
+  %PrepareFunctionForOptimization(g);
   let a = [11,22,33,45,56,6,77,84,93,101];
   g(a); g(a);
   let total = g(a);
@@ -938,13 +1032,15 @@
   };
   let g = function() {
     return array.reduceRight(f);
-  }
+  };
+  %PrepareFunctionForOptimization(g);
   g(); g();
   let total = g();
   %OptimizeFunctionOnNextCall(g);
   g();
   deopt = true;
   g();
+  %PrepareFunctionForOptimization(g);
   deopt = false;
   array = [11,22,33,45,56,6,77,84,93,101];
   %OptimizeFunctionOnNextCall(g);
@@ -962,7 +1058,8 @@
       return array.reduceRight(f);
     } catch (e) {
     }
-  }
+  };
+  %PrepareFunctionForOptimization(g);
   g(); g();
   let total = g();
   %OptimizeFunctionOnNextCall(g);
@@ -984,7 +1081,8 @@
     } catch (e) {
       return null;
     }
-  }
+  };
+  %PrepareFunctionForOptimization(g);
   g(); g();
   let total = g();
   %OptimizeFunctionOnNextCall(g);
@@ -993,6 +1091,7 @@
   done = true;
   assertEquals(null, g());
   done = false;
+  %PrepareFunctionForOptimization(g);
   g(); g();
   %OptimizeFunctionOnNextCall(g);
   g();
@@ -1015,7 +1114,8 @@
     } catch (e) {
       return null;
     }
-  }
+  };
+  %PrepareFunctionForOptimization(g);
   g(); g();
   let total = g();
   %OptimizeFunctionOnNextCall(g);
@@ -1024,6 +1124,7 @@
   done = true;
   assertEquals(null, g());
   done = false;
+  %PrepareFunctionForOptimization(g);
   g(); g();
   %OptimizeFunctionOnNextCall(g);
   g();
@@ -1046,7 +1147,8 @@
     } finally {
       if (done) return null;
     }
-  }
+  };
+  %PrepareFunctionForOptimization(g);
   g(); g();
   let total = g();
   %OptimizeFunctionOnNextCall(g);
@@ -1055,6 +1157,7 @@
   done = true;
   assertEquals(null, g());
   done = false;
+  %PrepareFunctionForOptimization(g);
   g(); g();
   %OptimizeFunctionOnNextCall(g);
   g();
@@ -1078,7 +1181,8 @@
     } finally {
       if (done) return null;
     }
-  }
+  };
+  %PrepareFunctionForOptimization(g);
   g(); g();
   let total = g();
   %OptimizeFunctionOnNextCall(g);
@@ -1087,6 +1191,7 @@
   done = true;
   assertEquals(null, g());
   done = false;
+  %PrepareFunctionForOptimization(g);
   g(); g();
   %OptimizeFunctionOnNextCall(g);
   g();
@@ -1103,7 +1208,8 @@
   let array = [1,2,3];
   let g = function() {
     return array.reduceRight(f);
-  }
+  };
+  %PrepareFunctionForOptimization(g);
   g(); g();
   let total = g();
   %OptimizeFunctionOnNextCall(g);
@@ -1129,7 +1235,8 @@
     } catch (e) {
       if (done) return null;
     }
-  }
+  };
+  %PrepareFunctionForOptimization(g);
   g(); g();
   let total = g();
   %OptimizeFunctionOnNextCall(g);
@@ -1138,6 +1245,7 @@
   done = true;
   assertEquals(null, g());
   done = false;
+  %PrepareFunctionForOptimization(g);
   g(); g();
   %OptimizeFunctionOnNextCall(g);
   g();
@@ -1163,7 +1271,8 @@
     } finally {
       if (done) return null;
     }
-  }
+  };
+  %PrepareFunctionForOptimization(g);
   g(); g();
   let total = g();
   %OptimizeFunctionOnNextCall(g);
@@ -1172,6 +1281,7 @@
   done = true;
   assertEquals(null, g());
   done = false;
+  %PrepareFunctionForOptimization(g);
   g(); g();
   %OptimizeFunctionOnNextCall(g);
   g();
@@ -1181,63 +1291,79 @@
 })();
 
 (function ReduceHoleyArrayWithDefaultAccumulator() {
-  var __v_12258 = new Array(10);
-  function __f_3253(a) {
-    let __f_3252 = function(accumulator, currentValue) {
+  var holey = new Array(10);
+  function reduce(a) {
+    let callback = function(accumulator, currentValue) {
       return currentValue;
-    }
-    return a.reduce(__f_3252, 13);
-  }
-  assertEquals(13, __f_3253(__v_12258));
-  assertEquals(13, __f_3253(__v_12258));
-  assertEquals(13, __f_3253(__v_12258));
-    %OptimizeFunctionOnNextCall(__f_3253);
-  assertEquals(13, __f_3253(__v_12258));
+    };
+    return a.reduce(callback, 13);
+  };
+  %PrepareFunctionForOptimization(reduce);
+  assertEquals(13, reduce(holey));
+  assertEquals(13, reduce(holey));
+  assertEquals(13, reduce(holey));
+  %OptimizeFunctionOnNextCall(reduce);
+  assertEquals(13, reduce(holey));
 })();
 
 (function ReduceRightHoleyArrayWithDefaultAccumulator() {
-  var __v_12258 = new Array(10);
-  function __f_3253(a) {
-    let __f_3252 = function(accumulator, currentValue) {
+  var holey = new Array(10);
+  function reduce(a) {
+    let callback = function(accumulator, currentValue) {
       return currentValue;
-    }
-    return a.reduceRight(__f_3252, 13);
-  }
-  assertEquals(13, __f_3253(__v_12258));
-  assertEquals(13, __f_3253(__v_12258));
-  assertEquals(13, __f_3253(__v_12258));
-  %OptimizeFunctionOnNextCall(__f_3253);
-  assertEquals(13, __f_3253(__v_12258));
+    };
+    return a.reduceRight(callback, 13);
+  };
+  %PrepareFunctionForOptimization(reduce);
+  assertEquals(13, reduce(holey));
+  assertEquals(13, reduce(holey));
+  assertEquals(13, reduce(holey));
+  %OptimizeFunctionOnNextCall(reduce);
+  assertEquals(13, reduce(holey));
 })();
 
 (function ReduceHoleyArrayOneElementWithDefaultAccumulator() {
-  var __v_12258 = new Array(10);
-  __v_12258[1] = 5;
-  function __f_3253(a) {
-    let __f_3252 = function(accumulator, currentValue) {
+  var holey = new Array(10);
+  holey[1] = 5;
+  function reduce(a) {
+    let callback = function(accumulator, currentValue) {
       return currentValue + accumulator;
-    }
-    return a.reduce(__f_3252, 13);
-  }
-  assertEquals(18, __f_3253(__v_12258));
-  assertEquals(18, __f_3253(__v_12258));
-  assertEquals(18, __f_3253(__v_12258));
-  %OptimizeFunctionOnNextCall(__f_3253);
-  assertEquals(18, __f_3253(__v_12258));
+    };
+    return a.reduce(callback, 13);
+  };
+  %PrepareFunctionForOptimization(reduce);
+  assertEquals(18, reduce(holey));
+  assertEquals(18, reduce(holey));
+  assertEquals(18, reduce(holey));
+  %OptimizeFunctionOnNextCall(reduce);
+  assertEquals(18, reduce(holey));
 })();
 
 (function ReduceRightHoleyArrayOneElementWithDefaultAccumulator() {
-  var __v_12258 = new Array(10);
-  __v_12258[1] = 5;
-  function __f_3253(a) {
-    let __f_3252 = function(accumulator, currentValue) {
+  var holey = new Array(10);
+  holey[1] = 5;
+  function reduce(a) {
+    let callback = function(accumulator, currentValue) {
       return currentValue + accumulator;
-    }
-    return a.reduceRight(__f_3252, 13);
-  }
-  assertEquals(18, __f_3253(__v_12258));
-  assertEquals(18, __f_3253(__v_12258));
-  assertEquals(18, __f_3253(__v_12258));
-  %OptimizeFunctionOnNextCall(__f_3253);
-  assertEquals(18, __f_3253(__v_12258));
+    };
+    return a.reduceRight(callback, 13);
+  };
+  %PrepareFunctionForOptimization(reduce);
+  assertEquals(18, reduce(holey));
+  assertEquals(18, reduce(holey));
+  assertEquals(18, reduce(holey));
+  %OptimizeFunctionOnNextCall(reduce);
+  assertEquals(18, reduce(holey));
+})();
+
+(function ReduceMixedHoleyArrays() {
+  function r(a) {
+    return a.reduce((acc, i) => {acc[0]});
+  };
+  %PrepareFunctionForOptimization(r);
+  r([[0]]);
+  r([[0]]);
+  r([0,,]);
+  %OptimizeFunctionOnNextCall(r);
+  r([,0,0]);
 })();
diff --git a/src/v8/test/mjsunit/array-reverse.js b/src/v8/test/mjsunit/array-reverse.js
new file mode 100644
index 0000000..11aeb60
--- /dev/null
+++ b/src/v8/test/mjsunit/array-reverse.js
@@ -0,0 +1,70 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertArrayEquals([], [].reverse());
+assertArrayEquals([8, 6, 4, 2], [2, 4, 6, 8].reverse());
+assertArrayEquals([0.8, 0.6, 0.4], [0.4, 0.6, 0.8].reverse());
+assertArrayEquals(["str4", "str3", "str2"], ["str2", "str3", "str4"].reverse());
+
+assertArrayEquals([4,3,,1], [1,,3,4].reverse());
+assertArrayEquals([4,,2,1], [1,2,,4].reverse());
+assertArrayEquals([5,,3,,1], [1,,3,,5].reverse());
+
+function TestReverseWithObject() {
+  let obj = { length: 5 };
+  obj[0] = "foo";
+  obj[3] = "bar";
+  Array.prototype.reverse.call(obj);
+
+  assertArrayEquals([,"bar",,,"foo"], obj);
+}
+TestReverseWithObject();
+
+function TestReverseWithPrototypeChain() {
+  let proto = { 0: "foo", 19: "bar" };
+  let obj = { length: 20, 5: "foobar", __proto__: proto };
+  Array.prototype.reverse.call(obj);
+
+  assertEquals("bar", obj[0]);
+  assertEquals("foobar", obj[14]);
+  assertEquals("foo", obj[19]);
+}
+TestReverseWithPrototypeChain();
+
+function TestReverseWithTypedArrays() {
+  const constructors = [
+    Uint8Array,
+    Int8Array,
+    Uint16Array,
+    Int16Array,
+    Uint32Array,
+    Int32Array,
+    Uint8ClampedArray,
+    Float32Array,
+    Float64Array
+  ];
+
+  for (const constructor of constructors) {
+    const array_odd = new constructor([1, 2, 3]);
+    Array.prototype.reverse.call(array_odd);
+    assertArrayEquals([3, 2, 1], array_odd, constructor);
+
+    const array_even = new constructor([1, 2, 3, 4]);
+    Array.prototype.reverse.call(array_even);
+    assertArrayEquals([4, 3, 2, 1], array_even, constructor);
+
+    // Array.prototype.reverse respects shadowing length on TypedArrays.
+    const array = new constructor([1, 2, 3, 4]);
+    Object.defineProperty(array, 'length', {value: 2});
+    Array.prototype.reverse.call(array);
+
+    assertArrayEquals([2, 1], array, constructor);
+
+    const array_shadowed_length = new constructor([1, 2]);
+    Object.defineProperty(array_shadowed_length, 'length', {value: 5});
+
+    assertThrows(() => Array.prototype.reverse.call(array_shadowed_length));
+  }
+}
+TestReverseWithTypedArrays();
diff --git a/src/v8/test/mjsunit/array-shift2.js b/src/v8/test/mjsunit/array-shift2.js
index 75233ff..46653ac 100644
--- a/src/v8/test/mjsunit/array-shift2.js
+++ b/src/v8/test/mjsunit/array-shift2.js
@@ -13,6 +13,7 @@
   return array;
 }
 
+%PrepareFunctionForOptimization(test);
 var result = test(["0",,2]);
 assertEquals(["element 1","element 1"], result);
 assertTrue(result.hasOwnProperty("0"));
diff --git a/src/v8/test/mjsunit/array-shift3.js b/src/v8/test/mjsunit/array-shift3.js
index 3a0afc5..199d76a 100644
--- a/src/v8/test/mjsunit/array-shift3.js
+++ b/src/v8/test/mjsunit/array-shift3.js
@@ -8,8 +8,9 @@
 function test(a) {
   a.shift();
   return a;
-}
-assertEquals(["element 1",{}], test([0,,{}]));
-assertEquals(["element 1",10], test([9,,10]));
+};
+%PrepareFunctionForOptimization(test);
+assertEquals(['element 1', {}], test([0, , {}]));
+assertEquals(['element 1', 10], test([9, , 10]));
 %OptimizeFunctionOnNextCall(test);
-assertEquals(["element 1",10], test([9,,10]));
+assertEquals(['element 1', 10], test([9, , 10]));
diff --git a/src/v8/test/mjsunit/array-shift4.js b/src/v8/test/mjsunit/array-shift4.js
index 5d28fd3..40378ae 100644
--- a/src/v8/test/mjsunit/array-shift4.js
+++ b/src/v8/test/mjsunit/array-shift4.js
@@ -17,6 +17,7 @@
   return a;
 }
 
+%PrepareFunctionForOptimization(doShift);
 doShift(makeArray());
 doShift(makeArray());
 %OptimizeFunctionOnNextCall(doShift);
diff --git a/src/v8/test/mjsunit/array-shift5.js b/src/v8/test/mjsunit/array-shift5.js
index a097e2f..ebf510d 100644
--- a/src/v8/test/mjsunit/array-shift5.js
+++ b/src/v8/test/mjsunit/array-shift5.js
@@ -5,61 +5,69 @@
 // Flags: --allow-natives-syntax
 
 (function() {
-  function doShift(a) { return a.shift(); }
+function doShift(a) {
+  return a.shift();
+};
+%PrepareFunctionForOptimization(doShift);
+function test() {
+  var a = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16];
+  assertEquals(0, doShift(a));
+  assertEquals([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16], a);
+}
 
-  function test() {
-    var a = [0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16];
-    assertEquals(0, doShift(a));
-    assertEquals([1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16], a);
-  }
-
-  test();
-  test();
-  %OptimizeFunctionOnNextCall(doShift);
-  test();
+test();
+test();
+%OptimizeFunctionOnNextCall(doShift);
+test();
 })();
 
 (function() {
-  function doShift(a) { return a.shift(); }
+function doShift(a) {
+  return a.shift();
+};
+%PrepareFunctionForOptimization(doShift);
+function test() {
+  var a = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16.1];
+  assertEquals(0, doShift(a));
+  assertEquals([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16.1], a);
+}
 
-  function test() {
-    var a = [0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16.1];
-    assertEquals(0, doShift(a));
-    assertEquals([1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16.1], a);
-  }
-
-  test();
-  test();
-  %OptimizeFunctionOnNextCall(doShift);
-  test();
+test();
+test();
+%OptimizeFunctionOnNextCall(doShift);
+test();
 })();
 
 (function() {
-  function doShift(a) { return a.shift(); }
+function doShift(a) {
+  return a.shift();
+};
+%PrepareFunctionForOptimization(doShift);
+function test() {
+  var a = [, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16.1];
+  assertEquals(undefined, doShift(a));
+  assertEquals([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16.1], a);
+}
 
-  function test() {
-    var a = [,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16.1];
-    assertEquals(undefined, doShift(a));
-    assertEquals([1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16.1], a);
-  }
-
-  test();
-  test();
-  %OptimizeFunctionOnNextCall(doShift);
-  test();
+test();
+test();
+%OptimizeFunctionOnNextCall(doShift);
+test();
 })();
 
 (function() {
-  function doShift(a) { return a.shift(); }
+function doShift(a) {
+  return a.shift();
+};
+%PrepareFunctionForOptimization(doShift);
+function test() {
+  var a = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, '16'];
+  assertEquals(0, doShift(a));
+  assertEquals([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, '16'], a);
+}
 
-  function test() {
-    var a = [0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,"16"];
-    assertEquals(0, doShift(a));
-    assertEquals([1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,"16"], a);
-  }
-
-  test();
-  test();
-  %OptimizeFunctionOnNextCall(doShift);
-  test();
+test();
+test();
+%OptimizeFunctionOnNextCall(doShift);
+test();
 })();
diff --git a/src/v8/test/mjsunit/array-sort.js b/src/v8/test/mjsunit/array-sort.js
index acc9611..d791cbe 100644
--- a/src/v8/test/mjsunit/array-sort.js
+++ b/src/v8/test/mjsunit/array-sort.js
@@ -1,29 +1,6 @@
 // Copyright 2010 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
 
 // Flags: --allow-natives-syntax
 
@@ -75,56 +52,6 @@
 
 TestNumberSort();
 
-function TestSmiLexicographicCompare() {
-
-  assertFalse(%_IsSmi(2147483648), 'Update test for >32 bit Smi');
-
-  // Collect a list of interesting Smis.
-  var seen = {};
-  var smis = [];
-  function add(x) {
-    if (x | 0 == x) {
-      x = x | 0;  // Canonicalizes to Smi if 32-bit signed and fits in Smi.
-    }
-    if (%_IsSmi(x) && !seen[x]) {
-      seen[x] = 1;
-      smis.push(x);
-    }
-  }
-  function addSigned(x) {
-    add(x);
-    add(-x);
-  }
-
-  var BIGGER_THAN_ANY_SMI = 10 * 1000 * 1000 * 1000;
-  for (var xb = 1; xb <= BIGGER_THAN_ANY_SMI; xb *= 10) {
-    for (var xf = 0; xf <= 9; xf++) {
-      for (var xo = -1; xo <= 1; xo++) {
-        addSigned(xb * xf + xo);
-      }
-    }
-  }
-
-  for (var yb = 1; yb <= BIGGER_THAN_ANY_SMI; yb *= 2) {
-    for (var yo = -2; yo <= 2; yo++) {
-      addSigned(yb + yo);
-    }
-  }
-
-  for (var i = 0; i < smis.length; i++) {
-    for (var j = 0; j < smis.length; j++) {
-      var x = smis[i];
-      var y = smis[j];
-      var lex = %SmiLexicographicCompare(x, y);
-      var expected = (x == y) ? 0 : ((x + "") < (y + "") ? -1 : 1);
-      assertEquals(lex, expected, x + " < " + y);
-    }
-  }
-}
-
-TestSmiLexicographicCompare();
-
-
 // Test lexicographical string sorting.
 function TestStringSort() {
   var a = [ "cc", "c", "aa", "a", "bb", "b", "ab", "ac" ];
@@ -200,9 +127,8 @@
   assertFalse(4 in obj, "objsort non-existing retained");
 }
 
+TestSparseNonArraySorting(1000);
 TestSparseNonArraySorting(5000);
-TestSparseNonArraySorting(500000);
-TestSparseNonArraySorting(Math.pow(2, 31) + 1);
 
 
 function TestArrayLongerLength(length) {
@@ -220,8 +146,7 @@
 TestArrayLongerLength(4);
 TestArrayLongerLength(10);
 TestArrayLongerLength(1000);
-TestArrayLongerLength(500000);
-TestArrayLongerLength(Math.pow(2,32) - 1);
+TestArrayLongerLength(5000);
 
 
 function TestNonArrayLongerLength(length) {
@@ -239,8 +164,7 @@
 TestNonArrayLongerLength(4);
 TestNonArrayLongerLength(10);
 TestNonArrayLongerLength(1000);
-TestNonArrayLongerLength(500000);
-TestNonArrayLongerLength(Math.pow(2,32) - 1);
+TestNonArrayLongerLength(5000);
 
 
 function TestNonArrayWithAccessors() {
@@ -281,7 +205,7 @@
   // expected (inherited) object: [undef1,...undefdepth,hole,1,...,depth,0,hole]
 
   Array.prototype.sort.call(obj, function(a,b) { return (b < a) - (a < b); });
-  // expected result: [0,1,...,depth,undef1,...,undefdepth,undef,hole]
+  // expected result: [0,1,...,depth,undef1,...,undefdepth,hole]
   var name = "SortInherit("+depth+")-";
 
   assertEquals(length, obj.length, name+"length");
@@ -289,11 +213,12 @@
     assertTrue(obj.hasOwnProperty(i), name + "hasvalue" + i);
     assertEquals(i, obj[i], name + "value" + i);
   }
-  for (var i = depth + 1; i <= depth * 2 + 1; i++) {
+  for (var i = depth + 1; i < depth * 2 + 1; i++) {
     assertEquals(undefined, obj[i], name + "undefined" + i);
     assertTrue(obj.hasOwnProperty(i), name + "hasundefined" + i);
   }
-  assertTrue(!obj.hasOwnProperty(depth * 2 + 2), name + "hashole");
+  assertFalse(obj.hasOwnProperty(depth * 2 + 1), name + "hashole")
+  assertFalse(obj.hasOwnProperty(depth * 2 + 2), name + "hashole");
 }
 
 TestInheritedElementSort(5);
@@ -321,9 +246,8 @@
     assertEquals(i, y[i], name + "value" + i);
   }
   for (var i = 10; i < length; i++) {
-    assertEquals(x.hasOwnProperty(i), y.hasOwnProperty(i),
-                 name + "hasundef" + i);
-    assertEquals(undefined, y[i], name+"undefined"+i);
+    assertFalse(y.hasOwnProperty(i), name + "noundef" + i);
+
     if (x.hasOwnProperty(i)) {
       assertTrue(0 == i % (2 * scale), name + "new_x" + i);
     }
@@ -376,14 +300,14 @@
   assertFalse(sorted.length in x, name + "haspost2");
   assertTrue(x.hasOwnProperty(10), name + "hasundefined10");
   assertEquals(undefined, x[10], name + "undefined10");
-  assertTrue(x.hasOwnProperty(100), name + "hasundefined100");
-  assertEquals(undefined, x[100], name + "undefined100");
-  assertTrue(x.hasOwnProperty(1000), name + "hasundefined1000");
-  assertEquals(undefined, x[1000], name + "undefined1000");
-  assertTrue(x.hasOwnProperty(2000), name + "hasundefined2000");
-  assertEquals(undefined, x[2000], name + "undefined2000");
-  assertTrue(x.hasOwnProperty(8000), name + "hasundefined8000");
-  assertEquals(undefined, x[8000], name + "undefined8000");
+  assertFalse(x.hasOwnProperty(100), name + "hasno100");
+  assertEquals("b2", x[100], "inherits100");
+  assertFalse(x.hasOwnProperty(1000), name + "hasno1000");
+  assertEquals("c2", x[1000], "inherits1000");
+  assertFalse(x.hasOwnProperty(2000), name + "hasno2000");
+  assertEquals(undefined, x[2000], "inherits2000");
+  assertFalse(x.hasOwnProperty(8000), name + "hasno8000");
+  assertEquals("d2", x[8000], "inherits8000");
   assertFalse(x.hasOwnProperty(12000), name + "has12000");
   assertEquals("XX", x[12000], name + "XX12000");
 }
@@ -503,6 +427,19 @@
 }
 TestSortOnNonExtensible();
 
+function TestSortOnTypedArray() {
+  var array = new Int8Array([10,9,8,7,6,5,4,3,2,1]);
+  Object.defineProperty(array, "length", {value: 5});
+  Array.prototype.sort.call(array);
+  assertEquals(array, new Int8Array([10,6,7,8,9,5,4,3,2,1]));
+
+  var array = new Int8Array([10,9,8,7,6,5,4,3,2,1]);
+  Object.defineProperty(array, "length", {value: 15});
+  Array.prototype.sort.call(array);
+  assertEquals(array, new Int8Array([1,10,2,3,4,5,6,7,8,9]));
+}
+TestSortOnTypedArray();
+
 
 // Test special prototypes
 (function testSortSpecialPrototypes() {
@@ -571,3 +508,243 @@
 assertThrows(() => {
   Array.prototype.sort.call(undefined);
 }, TypeError);
+
+// This test ensures that RemoveArrayHoles does not shadow indices in the
+// prototype chain. There are multiple code paths, we force both and check that
+// they have the same behavior.
+function TestPrototypeHoles() {
+  function test(forceGenericFallback) {
+    let proto2 = {
+      7: 27,
+    };
+
+    let proto1 = {
+      __proto__: proto2,
+      8: 18,
+      9: 19,
+    };
+
+    let xs = {
+      __proto__: proto1,
+      length: 10,
+      7: 7,
+      8: 8,
+      9: 9,
+    };
+
+    if (forceGenericFallback) {
+      Object.defineProperty(xs, "6", {
+        get: () => this.foo,
+        set: (val) => this.foo = val
+      });
+    }
+    xs[6] = 6;
+
+    Array.prototype.sort.call(xs, (a, b) => a - b);
+
+    assertEquals(10, xs.length);
+    assertEquals(6, xs[0]);
+    assertEquals(7, xs[1]);
+    assertEquals(8, xs[2]);
+    assertEquals(9, xs[3]);
+
+    // Index 7,8,9 will get the prototype values.
+    assertFalse(xs.hasOwnProperty(7));
+    assertEquals(27, xs[7]);
+
+    assertFalse(xs.hasOwnProperty(8));
+    assertEquals(18, xs[8]);
+
+    assertFalse(xs.hasOwnProperty(9));
+    assertEquals(19, xs[9]);
+  }
+
+  test(false);
+  // Expect a TypeError when trying to delete the accessor.
+  assertThrows(() => test(true), TypeError);
+}
+TestPrototypeHoles();
+
+// The following test ensures that [[Delete]] is called and it throws.
+function TestArrayWithAccessorThrowsOnDelete() {
+  let array = [5, 4, 1, /*hole*/, /*hole*/];
+
+  Object.defineProperty(array, '4', {
+    get: () => array.foo,
+    set: (val) => array.foo = val
+  });
+  assertThrows(() => array.sort((a, b) => a - b), TypeError);
+}
+TestArrayWithAccessorThrowsOnDelete();
+
+// The following test ensures that elements on the prototype are also copied
+// for JSArrays and not only JSObjects.
+function TestArrayPrototypeHasElements() {
+  let array = [1, 2, 3, 4, 5];
+  for (let i = 0; i < array.length; i++) {
+    delete array[i];
+    Object.prototype[i] = 42;
+  }
+
+  let comparator_called = false;
+  array.sort(function (a, b) {
+    if (a === 42 || b === 42) {
+      comparator_called = true;
+    }
+    return a - b;
+  });
+
+  assertTrue(comparator_called);
+}
+TestArrayPrototypeHasElements();
+
+// The following Tests make sure that there is no crash when the element kind
+// or the array length changes. Since comparison functions like this are not
+// consistent, we do not have to make sure that the array is actually sorted
+//
+// The assertions for the element kinds are not there to ensure that a specific
+// action causes a specific element kind change, but rather that we have most
+// of the transitions covered.
+
+function cmp_smaller(a, b) {
+  if (a < b) return -1;
+  if (b < a) return 1;
+  return 0;
+}
+
+function create_cmpfn(transformfn) {
+  let cmp_count = 0;
+  return (a, b) => {
+    ++cmp_count;
+    if (cmp_count == 2) {
+      transformfn();
+    }
+
+    return cmp_smaller(a, b);
+  }
+}
+
+function HasPackedSmi(xs) {
+  return %HasFastPackedElements(xs) && %HasSmiElements(xs);
+}
+
+function HasPackedDouble(xs) {
+  return %HasFastPackedElements(xs) && %HasDoubleElements(xs);
+}
+
+function HasPackedObject(xs) {
+  return %HasFastPackedElements(xs) && %HasObjectElements(xs);
+}
+
+function HasHoleySmi(xs) {
+  return %HasHoleyElements(xs) && %HasSmiElements(xs);
+}
+
+function HasHoleyDouble(xs) {
+  return %HasHoleyElements(xs) && %HasDoubleElements(xs);
+}
+
+function HasHoleyObject(xs) {
+  return %HasHoleyElements(xs) && %HasObjectElements(xs);
+}
+
+function TestSortCmpPackedSmiToPackedDouble() {
+  let xs = [2,1,4];
+
+  assertTrue(HasPackedSmi(xs));
+  xs.sort(create_cmpfn(() => xs[0] += 0.1));
+  assertTrue(HasPackedDouble(xs));
+}
+TestSortCmpPackedSmiToPackedDouble();
+
+function TestSortCmpPackedDoubleToPackedElement() {
+  let xs = [2.1, 1.2, 4.4];
+
+  assertTrue(HasPackedDouble(xs));
+  xs.sort(create_cmpfn(() => xs[0] = 'a'));
+  assertTrue(HasPackedObject(xs));
+}
+TestSortCmpPackedDoubleToPackedElement();
+
+function TestSortCmpPackedElementToDictionary() {
+  let xs = ['a', 'b', 'c'];
+
+  assertTrue(HasPackedObject(xs));
+  xs.sort(create_cmpfn(() => xs[%MaxSmi()] = 'd'));
+  assertTrue(%HasDictionaryElements(xs));
+}
+TestSortCmpPackedElementToDictionary();
+
+function TestSortCmpHoleySmiToHoleyDouble() {
+  let xs = [2, 1, 4];
+  xs[5] = 42;
+
+  assertTrue(HasHoleySmi(xs));
+  xs.sort(create_cmpfn(() => xs[0] += 0.1));
+  assertTrue(HasHoleyDouble(xs));
+}
+TestSortCmpHoleySmiToHoleyDouble();
+
+function TestSortCmpHoleyDoubleToHoleyElement() {
+  let xs = [2.1, 1.2, 4];
+  xs[5] = 42;
+
+  assertTrue(HasHoleyDouble(xs));
+  xs.sort(create_cmpfn(() => xs[0] = 'a'));
+  assertTrue(HasHoleyObject(xs));
+}
+TestSortCmpHoleyDoubleToHoleyElement();
+
+function TestSortCmpHoleyElementToDictionary() {
+  let xs = ['b', 'a', 'd'];
+  xs[5] = '42';
+
+  assertTrue(HasHoleyObject(xs));
+  xs.sort(create_cmpfn(() => xs[%MaxSmi()] = 'e'));
+  assertTrue(%HasDictionaryElements(xs));
+}
+TestSortCmpHoleyElementToDictionary();
+
+function TestSortCmpPackedSmiToHoleySmi() {
+  let xs = [2, 1, 4];
+
+  assertTrue(HasPackedSmi(xs));
+  xs.sort(create_cmpfn(() => xs[10] = 42));
+  assertTrue(HasHoleySmi(xs));
+}
+TestSortCmpPackedSmiToHoleySmi();
+
+function TestSortCmpPackedDoubleToHoleyDouble() {
+  let xs = [2.1, 1.2, 4];
+
+  assertTrue(HasPackedDouble(xs));
+  xs.sort(create_cmpfn(() => xs[10] = 42));
+  assertTrue(HasHoleyDouble(xs));
+}
+TestSortCmpPackedDoubleToHoleyDouble();
+
+function TestSortCmpPackedObjectToHoleyObject() {
+  let xs = ['b', 'a', 'd'];
+
+  assertTrue(HasPackedObject(xs));
+  xs.sort(create_cmpfn(() => xs[10] = '42'));
+  assertTrue(HasHoleyObject(xs));
+}
+TestSortCmpPackedObjectToHoleyObject();
+
+function TestSortCmpPackedChangesLength() {
+  let xs = [2, 1, 4];
+
+  assertTrue(HasPackedSmi(xs));
+  xs.sort(create_cmpfn(() => xs.length *= 2));
+  assertTrue(HasHoleySmi(xs));
+}
+TestSortCmpPackedChangesLength();
+
+function TestSortCmpPackedSetLengthToZero() {
+  let xs = [2, 1, 4, 3];
+
+  assertTrue(HasPackedSmi(xs));
+  xs.sort(create_cmpfn(() => xs.length = 0));
+  assertTrue(HasPackedSmi(xs));
+}
diff --git a/src/v8/test/mjsunit/array-splice.js b/src/v8/test/mjsunit/array-splice.js
index 75ff2d1..460172e 100644
--- a/src/v8/test/mjsunit/array-splice.js
+++ b/src/v8/test/mjsunit/array-splice.js
@@ -445,3 +445,21 @@
                 "array.hasOwnProperty(Math.pow(2, 32) - 2)");
   }
 })();
+
+// Verify that fast implementations aren't confused by empty DOUBLE element arrays
+(function() {
+
+  function foo(dontAddAnything) {
+    let a = [];
+    if (dontAddAnything === undefined) {
+      a[1] = 0.5;
+    }
+    return a.splice(0, 0, 3.5);
+  }
+
+  // Learn via allocation site tracking to create double arrays in foo().
+  foo();
+  foo();
+  // force splice to copy the input array.
+  foo(true);
+})();
diff --git a/src/v8/test/mjsunit/array-store-and-grow.js b/src/v8/test/mjsunit/array-store-and-grow.js
index ee831ad..d717c6d 100644
--- a/src/v8/test/mjsunit/array-store-and-grow.js
+++ b/src/v8/test/mjsunit/array-store-and-grow.js
@@ -197,6 +197,7 @@
     a[b] = c;
   }
 
+  %PrepareFunctionForOptimization(grow_store);
   a = new Array(1);
   grow_store(a,1,1);
   grow_store(a,2,1);
@@ -216,6 +217,7 @@
   function f(o, k, v) {
     o[k] = v;
   }
+  %PrepareFunctionForOptimization(f);
 
   a = [3.5];
   f(a, 1, "hi");  // DOUBLE packed array -> tagged packed grow
@@ -238,6 +240,7 @@
   function f(o, k, v) {
     o[k] = v;
   }
+  %PrepareFunctionForOptimization(f);
 
   a = [3.5];
   f(a, 0, "hi");  // DOUBLE packed array -> tagged packed grow
diff --git a/src/v8/test/mjsunit/array-tolocalestring.js b/src/v8/test/mjsunit/array-tolocalestring.js
new file mode 100644
index 0000000..a5f8569
--- /dev/null
+++ b/src/v8/test/mjsunit/array-tolocalestring.js
@@ -0,0 +1,72 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function CycleDetection() {
+  const arr = [
+    {
+      toLocaleString() {
+        return [1, arr];
+      }
+    }
+  ];
+  assertSame('1,', arr.toLocaleString());
+  assertSame('1,', arr.toLocaleString());
+})();
+
+(function ThrowsError(){
+  function TestError() {}
+  const arr = [];
+  const obj = {
+    toLocaleString(){
+      throw new TestError();
+    }
+  };
+  arr[0] = obj;
+  assertThrows(() => arr.toLocaleString(), TestError);
+
+  // Verifies cycle detection still works properly after thrown error.
+  arr[0] = {
+    toLocaleString() {
+      return 1;
+    }
+  };
+  assertSame('1', arr.toLocaleString());
+})();
+
+(function AccessThrowsError(){
+  function TestError() {}
+  const arr = [];
+  const obj = {
+    get toLocaleString(){
+      throw new TestError();
+    }
+  };
+  arr[0] = obj;
+  assertThrows(() => arr.toLocaleString(), TestError);
+
+  // Verifies cycle detection still works properly after thrown error.
+  arr[0] = {
+    toLocaleString() {
+      return 1;
+    }
+  };
+  assertSame('1', arr.toLocaleString());
+})();
+
+(function NotCallable(){
+  const arr = [];
+  const obj = {
+    toLocaleString: 7
+  }
+  arr[0] = obj;
+  assertThrows(() => arr.toLocaleString(), TypeError, '7 is not a function');
+
+  // Verifies cycle detection still works properly after thrown error.
+  arr[0] = {
+    toLocaleString() {
+      return 1;
+    }
+  };
+  assertSame('1', arr.toLocaleString());
+})();
diff --git a/src/v8/test/mjsunit/array-unshift.js b/src/v8/test/mjsunit/array-unshift.js
index 50aab4f..cbc8d40 100644
--- a/src/v8/test/mjsunit/array-unshift.js
+++ b/src/v8/test/mjsunit/array-unshift.js
@@ -190,15 +190,12 @@
 (function() {
   for (var i = 0; i < 7; i++) {
     try {
-      new Array(Math.pow(2, 32) - 3).unshift(1, 2, 3, 4, 5);
-      throw 'Should have thrown RangeError';
+      let obj = { length: 2 ** 53 - 3};
+      Array.prototype.unshift.call(obj, 1, 2, 3, 4, 5);
+      throw 'Should have thrown TypeError';
     } catch (e) {
-      assertTrue(e instanceof RangeError);
+      assertTrue(e instanceof TypeError);
     }
-
-    // Check smi boundary
-    var bigNum = (1 << 30) - 3;
-    assertEquals(bigNum + 7, new Array(bigNum).unshift(1, 2, 3, 4, 5, 6, 7));
   }
 })();
 
diff --git a/src/v8/test/mjsunit/arrow-with.js b/src/v8/test/mjsunit/arrow-with.js
new file mode 100644
index 0000000..a1f97af
--- /dev/null
+++ b/src/v8/test/mjsunit/arrow-with.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f() { with ({}) { return (()=>this)() } }
+var o = {}
+assertEquals(o, f.call(o))
diff --git a/src/v8/test/mjsunit/asm/asm-heap.js b/src/v8/test/mjsunit/asm/asm-heap.js
new file mode 100644
index 0000000..d0d190a
--- /dev/null
+++ b/src/v8/test/mjsunit/asm/asm-heap.js
@@ -0,0 +1,99 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax --expose-gc --mock-arraybuffer-allocator
+
+let gCounter = 1000;
+let gMinHeap = new ArrayBuffer(1 << 12);
+let gStdlib = {Uint8Array: Uint8Array};
+
+// The template of asm.js modules used in this test.
+function Template(stdlib, ffi, heap) {
+  "use asm";
+  var MEM8 = new stdlib.Uint8Array(heap);
+  function foo() { return VAL; }
+  return { foo: foo };
+}
+
+// Create a fresh module each time.
+function NewModule() {
+  // Use eval() to get a unique module each time.
+  let val = gCounter++;
+  let string = (Template + "; Template").replace("VAL", "" + val);
+//  print(string);
+  let module = eval(string);
+//  print(module);
+  module(gStdlib, {}, gMinHeap);
+  assertTrue(%IsAsmWasmCode(module));
+  return {module: module, val: val};
+}
+
+(function TestValid_PowerOfTwo() {
+  print("TestValid_PowerOfTwo...");
+  let r = NewModule();
+  for (let i = 12; i <= 24; i++) {
+    gc();  // Likely OOM otherwise.
+    let size = 1 << i;
+    print("  size=" + size);
+    let heap = new ArrayBuffer(size);
+    var instance = r.module(gStdlib, {}, heap);
+    assertTrue(%IsAsmWasmCode(r.module));
+    assertEquals(r.val, instance.foo());
+  }
+})();
+
+(function TestValid_Multiple() {
+  print("TestValid_Multiple...");
+  let r = NewModule();
+  for (let i = 1; i < 47; i += 7) {
+    gc();  // Likely OOM otherwise.
+    let size = i * (1 << 24);
+    print("  size=" + size);
+    let heap = new ArrayBuffer(size);
+    var instance = r.module(gStdlib, {}, heap);
+    assertTrue(%IsAsmWasmCode(r.module));
+    assertEquals(r.val, instance.foo());
+  }
+})();
+
+(function TestInvalid_TooSmall() {
+  print("TestInvalid_TooSmall...");
+  for (let i = 1; i < 12; i++) {
+    let size = 1 << i;
+    print("  size=" + size);
+    let r = NewModule();
+    let heap = new ArrayBuffer(size);
+    var instance = r.module(gStdlib, {}, heap);
+    assertFalse(%IsAsmWasmCode(r.module));
+    assertEquals(r.val, instance.foo());
+  }
+})();
+
+(function TestInValid_NonPowerOfTwo() {
+  print("TestInvalid_NonPowerOfTwo...");
+  for (let i = 12; i <= 24; i++) {
+    gc();  // Likely OOM otherwise.
+    let size = 1 + (1 << i);
+    print("  size=" + size);
+    let r = NewModule();
+    let heap = new ArrayBuffer(size);
+    var instance = r.module(gStdlib, {}, heap);
+    assertFalse(%IsAsmWasmCode(r.module));
+    assertEquals(r.val, instance.foo());
+  }
+})();
+
+(function TestInValid_NonMultiple() {
+  print("TestInvalid_NonMultiple...");
+  for (let i = (1 << 24); i < (1 << 25); i += (1 << 22)) {
+    gc();  // Likely OOM otherwise.
+    let size = i + (1 << 20);
+    print("  size=" + size);
+    let r = NewModule();
+    let heap = new ArrayBuffer(size);
+    var instance = r.module(gStdlib, {}, heap);
+    assertFalse(%IsAsmWasmCode(r.module));
+    assertEquals(r.val, instance.foo());
+  }
+})();
diff --git a/src/v8/test/mjsunit/asm/regress-913822.js b/src/v8/test/mjsunit/asm/regress-913822.js
new file mode 100644
index 0000000..d6ee746
--- /dev/null
+++ b/src/v8/test/mjsunit/asm/regress-913822.js
@@ -0,0 +1,25 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestNewlineInCPPComment() {
+  function Module() {
+    "use asm" // Crash by comment!
+    function f() {}
+    return f
+  }
+  Module();
+  assertTrue(%IsAsmWasmCode(Module));
+})();
+
+(function TestNewlineInCComment() {
+  function Module() {
+    "use asm" /* Crash by
+    comment! */ function f() {}
+    return f
+  }
+  Module();
+  assertTrue(%IsAsmWasmCode(Module));
+})();
diff --git a/src/v8/test/mjsunit/asm/regress-920076.js b/src/v8/test/mjsunit/asm/regress-920076.js
new file mode 100644
index 0000000..754b931
--- /dev/null
+++ b/src/v8/test/mjsunit/asm/regress-920076.js
@@ -0,0 +1,13 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Module() {
+  "use asm";
+  function f() {}
+  return f
+}
+eval("(" + Module.toString().replace(/;/, String.fromCharCode(8233)) + ")();");
+assertFalse(%IsAsmWasmCode(Module));  // Valid asm.js, but we reject Unicode.
diff --git a/src/v8/test/mjsunit/asm/regress-937650.js b/src/v8/test/mjsunit/asm/regress-937650.js
new file mode 100644
index 0000000..ca06df5
--- /dev/null
+++ b/src/v8/test/mjsunit/asm/regress-937650.js
@@ -0,0 +1,20 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Module(stdlib) {
+  "use asm";
+  var fround = stdlib.Math.fround;
+  // The below constant is outside the range of representable {float} values.
+  const infinity = fround(1.7976931348623157e+308);
+  function f() {
+    return infinity;
+  }
+  return { f: f };
+}
+
+var m = Module(this);
+assertEquals(Infinity, m.f());
+assertTrue(%IsAsmWasmCode(Module));
diff --git a/src/v8/test/mjsunit/asm/regress-9531.js b/src/v8/test/mjsunit/asm/regress-9531.js
new file mode 100644
index 0000000..f52e531
--- /dev/null
+++ b/src/v8/test/mjsunit/asm/regress-9531.js
@@ -0,0 +1,28 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+function Module(stdlib, ffi, buffer) {
+  "use asm";
+  var MEM8 = new stdlib.Uint8Array(buffer);
+  function foo() { return MEM8[0] | 0; }
+  return { foo: foo };
+}
+
+
+function RunOnce() {
+  let buffer = new ArrayBuffer(4096);
+  let ffi = {};
+  let stdlib = {Uint8Array: Uint8Array};
+  let module = Module(stdlib, ffi, buffer);
+  assertTrue(%IsAsmWasmCode(Module));
+  assertEquals(0, module.foo());
+}
+
+(function RunTest() {
+  for (let i = 0; i < 3000; i++) {
+    RunOnce();
+  }
+})();
diff --git a/src/v8/test/mjsunit/async-hooks/api-methods.js b/src/v8/test/mjsunit/async-hooks/api-methods.js
new file mode 100644
index 0000000..c013b7a
--- /dev/null
+++ b/src/v8/test/mjsunit/async-hooks/api-methods.js
@@ -0,0 +1,76 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-async-hooks
+
+// Check for invalid arguments handling
+(function() {
+  assertTrue(async_hooks.hasOwnProperty('createHook'),
+    'Async hooks missing createHook method');
+
+  assertThrows(() => async_hooks.createHook());
+  assertThrows(() => async_hooks.createHook(123));
+  assertThrows(() => async_hooks.createHook('str'));
+})();
+
+// Check for correct API methods
+(function() {
+  assertTrue(async_hooks.hasOwnProperty('executionAsyncId'),
+    'Async hooks missing executionAsyncId method');
+  assertTrue(async_hooks.hasOwnProperty('triggerAsyncId'),
+    'Async hooks missing triggerAsyncId method');
+
+  let ah = async_hooks.createHook({});
+  assertTrue(ah.hasOwnProperty('enable'), 'Async hooks missing enable method');
+  assertTrue(ah.hasOwnProperty('disable'),
+    'Async hooks missing disable method');
+})();
+
+// Check for correct enabling/disabling of async hooks
+(function() {
+  let storedPromise;
+  let ah = async_hooks.createHook({
+    init(asyncId, type, triggerAsyncId, resource) {
+      storedPromise = resource.promise || resource;
+    }
+  });
+  ah.enable();
+
+  let createdPromise = new Promise(function(resolve) {
+    resolve(42);
+  });
+  assertSame(storedPromise, createdPromise,
+    "Async hooks weren't enabled correctly");
+  ah.disable();
+  createdPromise = Promise.resolve(52);
+  assertNotSame(storedPromise, createdPromise,
+    "Async hooks weren't disabled correctly");
+  ah.enable();
+  createdPromise = Promise.resolve(62);
+  assertSame(storedPromise, createdPromise,
+    "Async hooks weren't enabled correctly");
+})();
diff --git a/src/v8/test/mjsunit/async-hooks/async-await-tree.js b/src/v8/test/mjsunit/async-hooks/async-await-tree.js
new file mode 100644
index 0000000..230c40e
--- /dev/null
+++ b/src/v8/test/mjsunit/async-hooks/async-await-tree.js
@@ -0,0 +1,74 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-async-hooks --harmony-await-optimization
+
+// Check for async/await asyncIds relation
+(function() {
+  let asyncIds = [], triggerIds = [];
+  let ah = async_hooks.createHook({
+    init(asyncId, type, triggerAsyncId, resource) {
+      if (type !== 'PROMISE') {
+        return;
+      }
+      asyncIds.push(asyncId);
+      triggerIds.push(triggerAsyncId);
+    },
+  });
+  ah.enable();
+
+  // Simplified version of Node.js util.promisify(setTimeout),
+  // but d8 ignores the timeout of setTimeout.
+  function sleep0() {
+    const promise = new Promise(function(resolve, reject) {
+      try {
+        setTimeout((err, ...values) => {
+          if (err) {
+            reject(err);
+          } else {
+            resolve(values[0]);
+          }
+        }, 0);
+      } catch (err) {
+        reject(err);
+      }
+    });
+    return promise;
+  }
+
+  async function foo() {
+    await sleep0();
+  }
+
+  assertPromiseResult(
+    foo().then(function() {
+      assertEquals(triggerIds[2], asyncIds[1]);
+      assertEquals(triggerIds[3], asyncIds[0]);
+      assertEquals(triggerIds[4], asyncIds[3]);
+      assertEquals(triggerIds[6], asyncIds[5]);
+    }));
+})();
diff --git a/src/v8/test/mjsunit/async-hooks/chained-promises.js b/src/v8/test/mjsunit/async-hooks/chained-promises.js
new file mode 100644
index 0000000..a2746dc
--- /dev/null
+++ b/src/v8/test/mjsunit/async-hooks/chained-promises.js
@@ -0,0 +1,52 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-async-hooks
+
+// Check for chained promises asyncIds relation
+(function() {
+  let asyncIds = [], triggerIds = [];
+  let ah = async_hooks.createHook({
+    init(asyncId, type, triggerAsyncId, resource) {
+      asyncIds.push(asyncId);
+      triggerIds.push(triggerAsyncId);
+    },
+  });
+  ah.enable();
+  let createdPromise = new Promise(function(resolve) {
+    resolve(42);
+  }).then(function() {
+    assertEquals(3, asyncIds.length, 'Exactly 3 promises should be inited');
+    assertEquals(3, triggerIds.length, 'Exactly 3 promises should be inited');
+    assertEquals(triggerIds[1], asyncIds[0],
+      "Parent promise asyncId doesn't correspond to child triggerAsyncId");
+  }).catch((err) => {
+    setTimeout(() => {
+      throw err;
+    }, 0);
+  });
+})();
diff --git a/src/v8/test/mjsunit/async-hooks/execution-order.js b/src/v8/test/mjsunit/async-hooks/execution-order.js
new file mode 100644
index 0000000..7eb055e
--- /dev/null
+++ b/src/v8/test/mjsunit/async-hooks/execution-order.js
@@ -0,0 +1,77 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-async-hooks
+
+// Check for correct execution of available hooks and asyncIds
+(function() {
+  let calledHooks = [];
+  let rootAsyncId = 0;
+
+  let ah = async_hooks.createHook({
+    init: function init(asyncId, type, triggerAsyncId, resource) {
+      if (type !== 'PROMISE') {
+        return;
+      }
+      if (triggerAsyncId === 0) {
+        rootAsyncId = asyncId;
+      }
+      calledHooks.push(['init', asyncId]);
+    },
+    promiseResolve: function promiseResolve(asyncId) {
+      calledHooks.push(['resolve', asyncId]);
+    },
+    before: function before(asyncId) {
+      calledHooks.push(['before', asyncId]);
+    },
+    after: function after(asyncId) {
+      calledHooks.push(['after', asyncId]);
+    },
+  });
+  ah.enable();
+
+  new Promise(function(resolve) {
+    resolve(42);
+  }).then(function() {
+    // [hook type, async Id]
+    const expectedHooks = [
+      ['init', rootAsyncId],  // the promise that we create initially
+      ['resolve', rootAsyncId],
+      ['init', rootAsyncId + 1],  // the chained promise with the assertions
+      ['init', rootAsyncId + 2],  // the chained promise from the catch block
+      ['before', rootAsyncId + 1],
+      // ['after', rootAsyncId + 1] will get called after the assertions
+    ];
+
+    assertArrayEquals(expectedHooks, calledHooks,
+      'Mismatch in async hooks execution order');
+  }).catch((err) => {
+    setTimeout(() => {
+      throw err;
+    }, 0);
+  });
+})();
diff --git a/src/v8/test/mjsunit/async-hooks/promises-async-await.js b/src/v8/test/mjsunit/async-hooks/promises-async-await.js
new file mode 100644
index 0000000..27148e7
--- /dev/null
+++ b/src/v8/test/mjsunit/async-hooks/promises-async-await.js
@@ -0,0 +1,74 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-async-hooks
+
+// Check for executionAsyncId/triggerAsyncId when chained promises and
+// async/await are combined
+(function() {
+  let p;
+  let outerExecutionAsyncId = -1, outerTriggerAsyncId = -1;
+
+  function inIrrelevantContext(resolve) {
+    resolve(42);
+  }
+
+  function inContext1(foo) {
+    foo();
+  }
+
+  function inContext2(foo) {
+    foo();
+  }
+
+  outerExecutionAsyncId = async_hooks.executionAsyncId();
+  outerTriggerAsyncId = async_hooks.triggerAsyncId();
+
+  inContext1(() => {
+    p = new Promise(resolve => {
+      assertEquals(outerExecutionAsyncId, async_hooks.executionAsyncId());
+      assertEquals(outerTriggerAsyncId, async_hooks.triggerAsyncId());
+      inIrrelevantContext(resolve);
+    }).then(() => {
+      assertNotEquals(outerExecutionAsyncId, async_hooks.executionAsyncId());
+      assertNotEquals(outerTriggerAsyncId, async_hooks.triggerAsyncId());
+    }).catch((err) => {
+      setTimeout(() => {
+        throw err;
+      }, 0);
+    });
+  });
+
+  inContext2(async () => {
+    assertEquals(outerExecutionAsyncId, async_hooks.executionAsyncId());
+    assertEquals(outerTriggerAsyncId, async_hooks.triggerAsyncId());
+    await p;
+    assertNotEquals(outerExecutionAsyncId, async_hooks.executionAsyncId());
+    assertNotEquals(outerTriggerAsyncId, async_hooks.triggerAsyncId());
+  });
+
+})();
diff --git a/src/v8/test/mjsunit/async-stack-traces-prepare-stacktrace-1.js b/src/v8/test/mjsunit/async-stack-traces-prepare-stacktrace-1.js
new file mode 100644
index 0000000..4248259
--- /dev/null
+++ b/src/v8/test/mjsunit/async-stack-traces-prepare-stacktrace-1.js
@@ -0,0 +1,31 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --async-stack-traces
+
+// Check that Error.prepareStackTrace doesn't expose strict
+// mode closures, even in the presence of async frames.
+Error.prepareStackTrace = (e, frames) => {
+  assertEquals(two, frames[0].getFunction());
+  assertEquals(two.name, frames[0].getFunctionName());
+  assertEquals(undefined, frames[1].getFunction());
+  assertEquals(one.name, frames[1].getFunctionName());
+  return frames;
+};
+
+async function one(x) {
+  "use strict";
+  return await two(x);
+}
+
+async function two(x) {
+  try {
+    x = await x;
+    throw new Error();
+  } catch (e) {
+    return e.stack;
+  }
+}
+
+one(1).catch(e => setTimeout(_ => {throw e}, 0));
diff --git a/src/v8/test/mjsunit/async-stack-traces-prepare-stacktrace-2.js b/src/v8/test/mjsunit/async-stack-traces-prepare-stacktrace-2.js
new file mode 100644
index 0000000..8126a83
--- /dev/null
+++ b/src/v8/test/mjsunit/async-stack-traces-prepare-stacktrace-2.js
@@ -0,0 +1,31 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --async-stack-traces
+
+// Check that Error.prepareStackTrace doesn't expose strict
+// mode closures, even in the presence of async frames.
+Error.prepareStackTrace = (e, frames) => {
+  assertEquals(undefined, frames[0].getFunction());
+  assertEquals(two.name, frames[0].getFunctionName());
+  assertEquals(undefined, frames[1].getFunction());
+  assertEquals(one.name, frames[1].getFunctionName());
+  return frames;
+};
+
+async function one(x) {
+  return await two(x);
+}
+
+async function two(x) {
+  "use strict";
+  try {
+    x = await x;
+    throw new Error();
+  } catch (e) {
+    return e.stack;
+  }
+}
+
+one(1).catch(e => setTimeout(_ => {throw e}, 0));
diff --git a/src/v8/test/mjsunit/async-stack-traces-prepare-stacktrace-3.js b/src/v8/test/mjsunit/async-stack-traces-prepare-stacktrace-3.js
new file mode 100644
index 0000000..429b0f6
--- /dev/null
+++ b/src/v8/test/mjsunit/async-stack-traces-prepare-stacktrace-3.js
@@ -0,0 +1,31 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --async-stack-traces
+
+// Check that Error.prepareStackTrace properly marks async frames.
+Error.prepareStackTrace = (e, frames) => {
+  assertEquals(two, frames[0].getFunction());
+  assertEquals(two.name, frames[0].getFunctionName());
+  assertFalse(frames[0].isAsync());
+  assertEquals(two, frames[1].getFunction());
+  assertEquals(one.name, frames[1].getFunctionName());
+  assertTrue(frames[1].isAsync());
+  return frames;
+};
+
+async function one(x) {
+  return await two(x);
+}
+
+async function two(x) {
+  try {
+    x = await x;
+    throw new Error();
+  } catch (e) {
+    return e.stack;
+  }
+}
+
+one(1).catch(e => setTimeout(_ => {throw e}, 0));
diff --git a/src/v8/test/mjsunit/async-stack-traces-prepare-stacktrace-4.js b/src/v8/test/mjsunit/async-stack-traces-prepare-stacktrace-4.js
new file mode 100644
index 0000000..a4484cd
--- /dev/null
+++ b/src/v8/test/mjsunit/async-stack-traces-prepare-stacktrace-4.js
@@ -0,0 +1,39 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --async-stack-traces
+
+// Check that Error.prepareStackTrace properly exposes async
+// stack frames and special Promise.all() stack frames.
+Error.prepareStackTrace = (e, frames) => {
+  assertEquals(two, frames[0].getFunction());
+  assertEquals(two.name, frames[0].getFunctionName());
+  assertEquals(null, frames[0].getPromiseIndex());
+  assertFalse(frames[0].isAsync());
+  assertEquals(Promise.all, frames[1].getFunction());
+  assertEquals(0, frames[1].getPromiseIndex());
+  assertTrue(frames[1].isAsync());
+  assertTrue(frames[1].isPromiseAll());
+  assertEquals(one, frames[2].getFunction());
+  assertEquals(one.name, frames[2].getFunctionName());
+  assertEquals(null, frames[2].getPromiseIndex());
+  assertTrue(frames[2].isAsync());
+  assertFalse(frames[2].isPromiseAll());
+  return frames;
+};
+
+async function one(x) {
+  return await Promise.all([two(x)]);
+}
+
+async function two(x) {
+  try {
+    x = await x;
+    throw new Error();
+  } catch (e) {
+    return e.stack;
+  }
+}
+
+one(1).catch(e => setTimeout(_ => {throw e}, 0));
diff --git a/src/v8/test/mjsunit/async-stack-traces-promise-all.js b/src/v8/test/mjsunit/async-stack-traces-promise-all.js
new file mode 100644
index 0000000..b677635
--- /dev/null
+++ b/src/v8/test/mjsunit/async-stack-traces-promise-all.js
@@ -0,0 +1,40 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --async-stack-traces
+
+// Basic test with Promise.all().
+(function() {
+  async function fine() { }
+
+  async function thrower() {
+    await fine();
+    throw new Error();
+  }
+
+  async function driver() {
+    await Promise.all([fine(), fine(), thrower(), thrower()]);
+  }
+
+  async function test(f) {
+    try {
+      await f();
+      assertUnreachable();
+    } catch (e) {
+      assertInstanceof(e, Error);
+      assertMatches(/Error.+at thrower.+at async Promise.all \(index 2\).+at async driver.+at async test/ms, e.stack);
+    }
+  }
+
+  assertPromiseResult((async () => {
+    %PrepareFunctionForOptimization(thrower);
+    %PrepareFunctionForOptimization(driver);
+    await test(driver);
+    await test(driver);
+    %OptimizeFunctionOnNextCall(thrower);
+    await test(driver);
+    %OptimizeFunctionOnNextCall(driver);
+    await test(driver);
+  })());
+})();
diff --git a/src/v8/test/mjsunit/async-stack-traces-realms.js b/src/v8/test/mjsunit/async-stack-traces-realms.js
new file mode 100644
index 0000000..9145b93
--- /dev/null
+++ b/src/v8/test/mjsunit/async-stack-traces-realms.js
@@ -0,0 +1,115 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --async-stack-traces
+
+// Basic test with an explicit throw.
+(function() {
+  const realm = Realm.createAllowCrossRealmAccess();
+
+  async function one(x) {
+    await two(x);
+  }
+
+  const two = Realm.eval(realm, `(async function two(x) {
+    await x;
+    throw new Error();
+  })`);
+
+  async function test(f) {
+    try {
+      await f(new Promise(resolve => setTimeout(resolve)));
+      assertUnreachable();
+    } catch (e) {
+      assertInstanceof(e, Realm.global(realm).Error);
+      assertMatches(/Error.+at two.+at async one.+at async test/ms, e.stack);
+    }
+  }
+
+  assertPromiseResult((async () => {
+    %PrepareFunctionForOptimization(one);
+    %PrepareFunctionForOptimization(two);
+    await test(one);
+    await test(one);
+    %OptimizeFunctionOnNextCall(two);
+    await test(one);
+    %OptimizeFunctionOnNextCall(one);
+    await test(one);
+    Realm.dispose(realm);
+  })());
+})();
+
+// Basic test with an implicit throw (via ToNumber on Symbol).
+(function() {
+  const realm = Realm.createAllowCrossRealmAccess();
+
+  async function one(x) {
+    return await two(x);
+  }
+
+  const two = Realm.eval(realm, `(async function two(x) {
+    await x;
+    return +Symbol();  // This will raise a TypeError.
+  })`);
+
+  async function test(f) {
+    try {
+      await f(new Promise(resolve => setTimeout(resolve)));
+      assertUnreachable();
+    } catch (e) {
+      assertInstanceof(e, Realm.global(realm).TypeError);
+      assertMatches(/TypeError.+at two.+at async one.+at async test/ms, e.stack);
+    }
+  }
+
+  assertPromiseResult((async() => {
+    %PrepareFunctionForOptimization(one);
+    %PrepareFunctionForOptimization(two);
+    await test(one);
+    await test(one);
+    %OptimizeFunctionOnNextCall(two);
+    await test(one);
+    %OptimizeFunctionOnNextCall(one);
+    await test(one);
+    Realm.dispose(realm);
+  })());
+})();
+
+// Basic test with async functions and promises chained via
+// Promise.prototype.then(), which should still work following
+// the generic chain upwards.
+(function() {
+  const realm = Realm.createAllowCrossRealmAccess();
+
+  async function one(x) {
+    return await two(x).then(x => x);
+  }
+
+  const two = Realm.eval(realm, `(async function two(x) {
+    await x.then(x => x);
+    throw new Error();
+  })`);
+
+  async function test(f) {
+    try {
+      await f(new Promise(resolve => setTimeout(resolve)));
+      assertUnreachable();
+    } catch (e) {
+      assertInstanceof(e, Realm.global(realm).Error);
+      assertMatches(/Error.+at two.+at async one.+at async test/ms, e.stack);
+    }
+  }
+
+  assertPromiseResult((async() => {
+    %PrepareFunctionForOptimization(one);
+    %PrepareFunctionForOptimization(two);
+    await test(one);
+    await test(one);
+    %OptimizeFunctionOnNextCall(two);
+    await test(one);
+    %OptimizeFunctionOnNextCall(one);
+    await test(one);
+    Realm.dispose(realm);
+  })());
+})();
diff --git a/src/v8/test/mjsunit/async-stack-traces.js b/src/v8/test/mjsunit/async-stack-traces.js
new file mode 100644
index 0000000..2932cfc
--- /dev/null
+++ b/src/v8/test/mjsunit/async-stack-traces.js
@@ -0,0 +1,319 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --async-stack-traces
+
+// Basic test with an explicit throw.
+(function() {
+  async function one(x) {
+    await two(x);
+  }
+
+  async function two(x) {
+    await x;
+    throw new Error();
+  }
+
+  async function test(f) {
+    try {
+      await f(1);
+      assertUnreachable();
+    } catch (e) {
+      assertInstanceof(e, Error);
+      assertMatches(/Error.+at two.+at async one.+at async test/ms, e.stack);
+    }
+  }
+
+  assertPromiseResult((async () => {
+    %PrepareFunctionForOptimization(one);
+    %PrepareFunctionForOptimization(two);
+    await test(one);
+    await test(one);
+    %OptimizeFunctionOnNextCall(two);
+    await test(one);
+    %OptimizeFunctionOnNextCall(one);
+    await test(one);
+  })());
+})();
+
+// Basic test with an implicit throw (via ToNumber on Symbol).
+(function() {
+  async function one(x) {
+    return await two(x);
+  }
+
+  async function two(x) {
+    await x;
+    return +x;  // This will raise a TypeError.
+  }
+
+  async function test(f) {
+    try {
+      await f(Symbol());
+      assertUnreachable();
+    } catch (e) {
+      assertInstanceof(e, TypeError);
+      assertMatches(/TypeError.+at two.+at async one.+at async test/ms, e.stack);
+    }
+  }
+
+  assertPromiseResult((async() => {
+    %PrepareFunctionForOptimization(one);
+    %PrepareFunctionForOptimization(two);
+    await test(one);
+    await test(one);
+    %OptimizeFunctionOnNextCall(two);
+    await test(one);
+    %OptimizeFunctionOnNextCall(one);
+    await test(one);
+  })());
+})();
+
+// Basic test with throw in inlined function.
+(function() {
+  function throwError() {
+    throw new Error();
+  }
+
+  async function one(x) {
+    return await two(x);
+  }
+
+  async function two(x) {
+    await x;
+    return throwError();
+  }
+
+  async function test(f) {
+    try {
+      await f(1);
+      assertUnreachable();
+    } catch (e) {
+      assertInstanceof(e, Error);
+      assertMatches(/Error.+at two.+at async one.+at async test/ms, e.stack);
+    }
+  }
+
+  assertPromiseResult((async() => {
+    %PrepareFunctionForOptimization(one);
+    %PrepareFunctionForOptimization(two);
+    await test(one);
+    await test(one);
+    %OptimizeFunctionOnNextCall(two);
+    await test(one);
+    %OptimizeFunctionOnNextCall(one);
+    await test(one);
+  })());
+})();
+
+// Basic test with async function inlined into sync function.
+(function() {
+  function callOne(x) {
+    return one(x);
+  }
+
+  function callTwo(x) {
+    return two(x);
+  }
+
+  async function one(x) {
+    return await callTwo(x);
+  }
+
+  async function two(x) {
+    await x;
+    throw new Error();
+  }
+
+  async function test(f) {
+    try {
+      await f(1);
+      assertUnreachable();
+    } catch (e) {
+      assertInstanceof(e, Error);
+      assertMatches(/Error.+at two.+at async one.+at async test/ms, e.stack);
+    }
+  }
+
+  assertPromiseResult((async() => {
+    %PrepareFunctionForOptimization(callOne);
+    %PrepareFunctionForOptimization(callTwo);
+    await test(callOne);
+    await test(callOne);
+    %OptimizeFunctionOnNextCall(callTwo);
+    await test(callOne);
+    %OptimizeFunctionOnNextCall(callOne);
+    await test(callOne);
+  })());
+})();
+
+// Basic test with async functions and promises chained via
+// Promise.prototype.then(), which should still work following
+// the generic chain upwards.
+(function() {
+  async function one(x) {
+    return await two(x).then(x => x);
+  }
+
+  async function two(x) {
+    await x.then(x => x);
+    throw new Error();
+  }
+
+  async function test(f) {
+    try {
+      await f(Promise.resolve(1));
+      assertUnreachable();
+    } catch (e) {
+      assertInstanceof(e, Error);
+      assertMatches(/Error.+at two.+at async one.+at async test/ms, e.stack);
+    }
+  }
+
+  assertPromiseResult((async() => {
+    %PrepareFunctionForOptimization(one);
+    %PrepareFunctionForOptimization(two);
+    await test(one);
+    await test(one);
+    %OptimizeFunctionOnNextCall(two);
+    await test(one);
+    %OptimizeFunctionOnNextCall(one);
+    await test(one);
+  })());
+})();
+
+// Basic test for async generators called from async
+// functions with an explicit throw.
+(function() {
+  async function one(x) {
+    for await (const y of two(x)) {}
+  }
+
+  async function* two(x) {
+    await x;
+    throw new Error();
+  }
+
+  async function test(f) {
+    try {
+      await f(1);
+      assertUnreachable();
+    } catch (e) {
+      assertInstanceof(e, Error);
+      assertMatches(/Error.+at two.+at async one.+at async test/ms, e.stack);
+    }
+  }
+
+  assertPromiseResult((async () => {
+    %PrepareFunctionForOptimization(one);
+    %PrepareFunctionForOptimization(two);
+    await test(one);
+    await test(one);
+    %OptimizeFunctionOnNextCall(two);
+    await test(one);
+    %OptimizeFunctionOnNextCall(one);
+    await test(one);
+  })());
+})();
+
+// Basic test for async functions called from async
+// generators with an explicit throw.
+(function() {
+  async function* one(x) {
+    await two(x);
+  }
+
+  async function two(x) {
+    await x;
+    throw new Error();
+  }
+
+  async function test(f) {
+    try {
+      for await (const x of f(1)) {}
+      assertUnreachable();
+    } catch (e) {
+      assertInstanceof(e, Error);
+      assertMatches(/Error.+at two.+at async one.+at async test/ms, e.stack);
+    }
+  }
+
+  assertPromiseResult((async () => {
+    %PrepareFunctionForOptimization(one);
+    %PrepareFunctionForOptimization(two);
+    await test(one);
+    await test(one);
+    %OptimizeFunctionOnNextCall(two);
+    await test(one);
+    %OptimizeFunctionOnNextCall(one);
+    await test(one);
+  })());
+})();
+
+// Basic test for async functions called from async
+// generators with an explicit throw (with yield).
+(function() {
+  async function* one(x) {
+    yield two(x);
+  }
+
+  async function two(x) {
+    await x;
+    throw new Error();
+  }
+
+  async function test(f) {
+    try {
+      for await (const x of f(1)) {}
+      assertUnreachable();
+    } catch (e) {
+      assertInstanceof(e, Error);
+      assertMatches(/Error.+at two.+at async one.+at async test/ms, e.stack);
+    }
+  }
+
+  assertPromiseResult((async () => {
+    %PrepareFunctionForOptimization(one);
+    %PrepareFunctionForOptimization(two);
+    await test(one);
+    await test(one);
+    %OptimizeFunctionOnNextCall(two);
+    await test(one);
+    %OptimizeFunctionOnNextCall(one);
+    await test(one);
+  })());
+})();
+
+// Basic test to check that we also follow initial
+// promise chains created via Promise#then().
+(function() {
+  async function one(p) {
+    return await p.then(two);
+  }
+
+  function two() {
+    throw new Error();
+  }
+
+  async function test(f) {
+    try {
+      await f(Promise.resolve());
+      assertUnreachable();
+    } catch (e) {
+      assertInstanceof(e, Error);
+      assertMatches(/Error.+at two.+at async one.+at async test/ms, e.stack);
+    }
+  }
+
+  assertPromiseResult((async () => {
+    %PrepareFunctionForOptimization(one);
+    %PrepareFunctionForOptimization(two);
+    await test(one);
+    await test(one);
+    %OptimizeFunctionOnNextCall(two);
+    await test(one);
+    %OptimizeFunctionOnNextCall(one);
+    await test(one);
+  })());
+})();
diff --git a/src/v8/test/mjsunit/bounds-checks-elimination.js b/src/v8/test/mjsunit/bounds-checks-elimination.js
index 622e791..e2073cc 100644
--- a/src/v8/test/mjsunit/bounds-checks-elimination.js
+++ b/src/v8/test/mjsunit/bounds-checks-elimination.js
@@ -8,6 +8,7 @@
 for (var i = 0; i < 9; i++) a[i] = i + 1;
 
 function test(f, arg1, arg2, expected) {
+  %PrepareFunctionForOptimization(f);
   assertEquals(expected, f(arg1));
   f(arg2);
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/closures.js b/src/v8/test/mjsunit/closures.js
index 5ce26ca..6f482e0 100644
--- a/src/v8/test/mjsunit/closures.js
+++ b/src/v8/test/mjsunit/closures.js
@@ -35,9 +35,10 @@
   function MyFunction() {
     var result = n * 2 + arguments.length;
     return result;
-  }
+  };
+  %PrepareFunctionForOptimization(MyFunction);
   for (var i = 0; i < 5; ++i) MyFunction();
-  %OptimizeFunctionOnNextCall(MyFunction)
+  %OptimizeFunctionOnNextCall(MyFunction);
   runner(MyFunction, n * 2);
 }
 
diff --git a/src/v8/test/mjsunit/code-comments.js b/src/v8/test/mjsunit/code-comments.js
new file mode 100644
index 0000000..7c013c1
--- /dev/null
+++ b/src/v8/test/mjsunit/code-comments.js
@@ -0,0 +1,26 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --code-comments --print-code
+
+(function simple_test() {
+  function fib(n) {
+    return n < 2 ? n : fib(n - 1) + fib(n - 2);
+  }
+
+  // Call a number of times to trigger optimization.
+  for (let i = 0; i < 100; ++i) {
+    fib(8);
+  }
+})();
+
+(function test_asm() {
+  function asm() {
+    'use asm';
+    function f() {}
+    return f;
+  }
+
+  var m = asm();
+})();
diff --git a/src/v8/test/mjsunit/code-coverage-ad-hoc.js b/src/v8/test/mjsunit/code-coverage-ad-hoc.js
index 75f513c..b6ae462 100644
--- a/src/v8/test/mjsunit/code-coverage-ad-hoc.js
+++ b/src/v8/test/mjsunit/code-coverage-ad-hoc.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --no-always-opt
+// Flags: --allow-natives-syntax --no-always-opt --no-stress-flush-bytecode
 // Files: test/mjsunit/code-coverage-utils.js
 
 // Test code coverage without explicitly activating it upfront.
@@ -57,3 +57,19 @@
 [{"start":0,"end":80,"count":1},
  {"start":0,"end":72,"count":1}]
 );
+
+TestCoverageNoGC(
+"https://crbug.com/927464",
+`
+!function f() {                           // 0000
+  function unused() { nop(); }            // 0100
+  nop();                                  // 0150
+}();                                      // 0200
+`,
+[{"start":0,"end":199,"count":1},
+ {"start":1,"end":151,"count":1}
+ // The unused function is unfortunately not marked as unused in best-effort
+ // code coverage, as the information about its source range is discarded
+ // entirely.
+]
+);
diff --git a/src/v8/test/mjsunit/code-coverage-block-noopt.js b/src/v8/test/mjsunit/code-coverage-block-noopt.js
index ef68e03..301a05a 100644
--- a/src/v8/test/mjsunit/code-coverage-block-noopt.js
+++ b/src/v8/test/mjsunit/code-coverage-block-noopt.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --no-always-opt
+// Flags: --allow-natives-syntax --no-always-opt --no-stress-flush-bytecode
 // Flags: --no-opt
 // Files: test/mjsunit/code-coverage-utils.js
 
@@ -13,10 +13,11 @@
 `
 function g() { if (true) nop(); }         // 0000
 function f() { g(); g(); }                // 0050
-f(); f(); %OptimizeFunctionOnNextCall(f); // 0100
-f(); f(); f(); f(); f(); f();             // 0150
+%PrepareFunctionForOptimization(f);       // 0100
+f(); f(); %OptimizeFunctionOnNextCall(f); // 0150
+f(); f(); f(); f(); f(); f();             // 0200
 `,
-[{"start":0,"end":199,"count":1},
+[{"start":0,"end":249,"count":1},
  {"start":0,"end":33,"count":16},
  {"start":50,"end":76,"count":8}]
 );
@@ -29,11 +30,12 @@
   function f(x) {                         // 0050
     if (x) { nop(); } else { nop(); }     // 0100
   }                                       // 0150
-  f(true); f(true);                       // 0200
-  %OptimizeFunctionOnNextCall(f);         // 0250
-  %DebugCollectCoverage();                // 0300
-  f(false);                               // 0350
-}();                                      // 0400
+  %PrepareFunctionForOptimization(f);     // 0200
+  f(true); f(true);                       // 0250
+  %OptimizeFunctionOnNextCall(f);         // 0300
+  %DebugCollectCoverage();                // 0350
+  f(false);                               // 0400
+}();                                      // 0450
 `,
 [{"start":52,"end":153,"count":1},
  {"start":111,"end":121,"count":0}]
diff --git a/src/v8/test/mjsunit/code-coverage-block-opt.js b/src/v8/test/mjsunit/code-coverage-block-opt.js
index e02775b..7c87dd4 100644
--- a/src/v8/test/mjsunit/code-coverage-block-opt.js
+++ b/src/v8/test/mjsunit/code-coverage-block-opt.js
@@ -3,8 +3,14 @@
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax --no-always-opt --opt
+// Flags: --no-stress-flush-bytecode --turbo-inlining
 // Files: test/mjsunit/code-coverage-utils.js
 
+if (isNeverOptimizeLiteMode()) {
+  print("Warning: skipping test that requires optimization in Lite mode.");
+  testRunner.quit(0);
+}
+
 %DebugToggleBlockCoverage(true);
 
 TestCoverage(
@@ -12,13 +18,13 @@
 `
 function g() { if (true) nop(); }         // 0000
 function f() { g(); g(); }                // 0050
-f(); f(); %OptimizeFunctionOnNextCall(f); // 0100
-f(); f(); f(); f(); f(); f();             // 0150
+%PrepareFunctionForOptimization(f);       // 0100
+f(); f(); %OptimizeFunctionOnNextCall(f); // 0150
+f(); f(); f(); f(); f(); f();             // 0200
 `,
-[{"start":0,"end":199,"count":1},
- {"start":0,"end":33,"count":4},   // TODO(jgruber): Invocation count is off.
- {"start":25,"end":32,"count":16},
- {"start":50,"end":76,"count":2}]  // TODO(jgruber): Invocation count is off.
+[{"start":0,"end":249,"count":1},
+ {"start":0,"end":33,"count":16},
+ {"start":50,"end":76,"count":8}]
 );
 
 // This test is tricky: it requires a non-toplevel, optimized function.
@@ -32,14 +38,15 @@
   function f(x) {                         // 0050
     if (x) { nop(); } else { nop(); }     // 0100
   }                                       // 0150
-  f(true); f(true);                       // 0200
-  %OptimizeFunctionOnNextCall(f);         // 0250
-  %DebugCollectCoverage();                // 0300
-  f(false);                               // 0350
-}();                                      // 0400
+  %PrepareFunctionForOptimization(f);     // 0200
+  f(true); f(true);                       // 0250
+  %OptimizeFunctionOnNextCall(f);         // 0300
+  %DebugCollectCoverage();                // 0350
+  f(false);                               // 0400
+}();                                      // 0450
 `,
-[{"start":52,"end":153,"count":0},
- {"start":121,"end":152,"count":1}]
+[{"start":52,"end":153,"count":1},
+ {"start":111,"end":121,"count":0}]
 );
 
 %DebugToggleBlockCoverage(false);
diff --git a/src/v8/test/mjsunit/code-coverage-block.js b/src/v8/test/mjsunit/code-coverage-block.js
index b9d00bc..c441342 100644
--- a/src/v8/test/mjsunit/code-coverage-block.js
+++ b/src/v8/test/mjsunit/code-coverage-block.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --no-always-opt
+// Flags: --allow-natives-syntax --no-always-opt --no-stress-flush-bytecode
 // Files: test/mjsunit/code-coverage-utils.js
 
 %DebugToggleBlockCoverage(true);
@@ -213,12 +213,11 @@
     nop();                                // 0100
   }                                       // 0150
 }();                                      // 0200
-%RunMicrotasks();                         // 0250
+%PerformMicrotaskCheckpoint();            // 0250
 `,
 [{"start":0,"end":299,"count":1},
- {"start":1,"end":201,"count":6},  // TODO(jgruber): Invocation count is off.
- {"start":83,"end":153,"count":4},
- {"start":153,"end":200,"count":1}]
+ {"start":1,"end":201,"count":1},
+ {"start":83,"end":153,"count":4}]
 );
 
 TestCoverage(
@@ -246,8 +245,7 @@
  {"start":224,"end":237,"count":12},
  {"start":273,"end":277,"count":0},
  {"start":412,"end":416,"count":12},
- {"start":462,"end":475,"count":12},
- {"start":620,"end":622,"count":0}]
+ {"start":462,"end":475,"count":12}]
 );
 
 TestCoverage(
@@ -354,11 +352,11 @@
 [{"start":0,"end":849,"count":1},
  {"start":1,"end":801,"count":1},
  {"start":67,"end":87,"count":0},
- {"start":219,"end":222,"count":0},
+ {"start":221,"end":222,"count":0},
  {"start":254,"end":274,"count":0},
- {"start":369,"end":372,"count":0},
- {"start":390,"end":404,"count":0},
- {"start":513,"end":554,"count":0}]
+ {"start":371,"end":372,"count":0},
+ {"start":403,"end":404,"count":0},
+ {"start":553,"end":554,"count":0}]
 );
 
 TestCoverage("try/catch/finally statements with early return",
@@ -375,11 +373,11 @@
 `,
 [{"start":0,"end":449,"count":1},
  {"start":1,"end":151,"count":1},
- {"start":67,"end":70,"count":0},
- {"start":89,"end":150,"count":0},
+ {"start":69,"end":70,"count":0},
+ {"start":91,"end":150,"count":0},
  {"start":201,"end":401,"count":1},
- {"start":267,"end":270,"count":0},
- {"start":319,"end":400,"count":0}]
+ {"start":269,"end":270,"count":0},
+ {"start":321,"end":400,"count":0}]
 );
 
 TestCoverage(
@@ -410,15 +408,15 @@
 `,
 [{"start":0,"end":1099,"count":1},
  {"start":1,"end":151,"count":1},
- {"start":67,"end":70,"count":0},
- {"start":89,"end":150,"count":0},
+ {"start":69,"end":70,"count":0},
+ {"start":91,"end":150,"count":0},
  {"start":201,"end":351,"count":1},
- {"start":284,"end":350,"count":0},
+ {"start":286,"end":350,"count":0},
  {"start":401,"end":701,"count":1},
- {"start":569,"end":700,"count":0},
- {"start":561,"end":568,"count":0},  // TODO(jgruber): Sorting.
+ {"start":603,"end":700,"count":0},
+ {"start":561,"end":568,"count":0},
  {"start":751,"end":1051,"count":1},
- {"start":817,"end":820,"count":0},
+ {"start":819,"end":820,"count":0},
  {"start":861,"end":1050,"count":0}]
 );
 
@@ -437,7 +435,7 @@
 [{"start":0,"end":399,"count":1},
  {"start":1,"end":351,"count":1},
  {"start":154,"end":204,"count":0},
- {"start":226,"end":303,"count":0}]
+ {"start":226,"end":350,"count":0}]
 );
 
 TestCoverage(
@@ -467,11 +465,7 @@
 [{"start":0,"end":999,"count":1},
  {"start":1,"end":951,"count":1},
  {"start":152,"end":202,"count":0},
- {"start":285,"end":353,"count":0},
- {"start":472,"end":503,"count":0},
- {"start":626,"end":653,"count":0},
- {"start":768,"end":803,"count":0},
- {"start":867,"end":869,"count":0}]
+ {"start":285,"end":353,"count":0}]
 );
 
 TestCoverage(
@@ -496,11 +490,8 @@
 [{"start":0,"end":749,"count":1},
  {"start":1,"end":701,"count":1},
  {"start":87,"end":153,"count":2},
- {"start":125,"end":153,"count":0},
  {"start":271,"end":403,"count":2},
- {"start":379,"end":403,"count":0},
- {"start":509,"end":653,"count":2},
- {"start":621,"end":653,"count":0}]
+ {"start":509,"end":653,"count":2}]
 );
 
 TestCoverage(
@@ -548,10 +539,25 @@
 it.next(); it.next();                     // 0250
 `,
 [{"start":0,"end":299,"count":1},
- {"start":11,"end":201,"count":3},
- {"start":64,"end":114,"count":1},
+ {"start":11,"end":201,"count":1},
  {"start":114,"end":121,"count":0},
- {"start":122,"end":129,"count":1},
+ {"start":129,"end":200,"count":0}]
+);
+
+TestCoverage(
+"yield expressions twice",
+`
+function* gen() {                         // 0000
+  yield nop();                            // 0050
+  yield nop() ? nop() : nop()             // 0100
+  return nop();                           // 0150
+};                                        // 0200
+{const it = gen(); it.next(); it.next();} // 0250
+{const it = gen(); it.next(); it.next();} // 0300
+`,
+[{"start":0,"end":349,"count":1},
+ {"start":0,"end":201,"count":2},
+ {"start":114,"end":121,"count":0},
  {"start":129,"end":200,"count":0}]
 );
 
@@ -570,9 +576,10 @@
 } catch (e) {}                            // 0450
 `,
 [{"start":0,"end":499,"count":1},
- {"start":12,"end":101,"count":3},
+ {"start":451,"end":452,"count":0},
+ {"start":12,"end":101,"count":1},
  {"start":60,"end":100,"count":0},
- {"start":264,"end":353,"count":3},
+ {"start":264,"end":353,"count":1},
  {"start":312,"end":352,"count":0}]
 );
 
@@ -589,9 +596,8 @@
 it.next(); it.return();                   // 0450
 `,
 [{"start":0,"end":449,"count":1},
- {"start":11,"end":351,"count":3},
+ {"start":11,"end":351,"count":1},
  {"start":112,"end":254,"count":0},
- {"start":254,"end":272,"count":1},
  {"start":272,"end":350,"count":0}]
 );
 
@@ -608,9 +614,8 @@
 it.next(); it.throw(42);                  // 0550
 `,
 [{"start":0,"end":449,"count":1},
- {"start":11,"end":351,"count":3},
+ {"start":11,"end":351,"count":1},
  {"start":112,"end":154,"count":0},
- {"start":154,"end":310,"count":1},
  {"start":310,"end":350,"count":0}]
 );
 
@@ -626,10 +631,8 @@
 it.next(); it.next(); it.next();          // 0300
 `,
 [{"start":0,"end":349,"count":1},
- {"start":11,"end":201,"count":7},
- {"start":65,"end":115,"count":1},
+ {"start":11,"end":201,"count":1},
  {"start":115,"end":122,"count":0},
- {"start":123,"end":130,"count":1},
  {"start":130,"end":200,"count":0}]
 );
 
@@ -648,9 +651,10 @@
 } catch (e) {}                            // 0450
 `,
 [{"start":0,"end":499,"count":1},
- {"start":12,"end":101,"count":3},
+ {"start":451,"end":452,"count":0},
+ {"start":12,"end":101,"count":1},
  {"start":65,"end":100,"count":0},
- {"start":264,"end":353,"count":3},
+ {"start":264,"end":353,"count":1},
  {"start":317,"end":352,"count":0}]
 );
 
@@ -662,11 +666,10 @@
   await 42;                               // 0100
 };                                        // 0150
 f();                                      // 0200
-%RunMicrotasks();                         // 0250
+%PerformMicrotaskCheckpoint();            // 0250
 `,
 [{"start":0,"end":299,"count":1},
- {"start":0,"end":151,"count":3},
- {"start":61,"end":150,"count":1}]
+ {"start":0,"end":151,"count":1}]
 );
 
 TestCoverage(
@@ -682,7 +685,8 @@
 [{"start":0,"end":299,"count":1},
  {"start":15,"end":20,"count":0},
  {"start":50,"end":151,"count":2},
- {"start":114,"end":118,"count":0}]);
+ {"start":114,"end":118,"count":0}]
+);
 
 TestCoverage(
 "LogicalOrExpression IsTest()",
@@ -711,7 +715,8 @@
 [{"start":0,"end":349,"count":1},
  {"start":16,"end":21,"count":0},
  {"start":50,"end":151,"count":2},
- {"start":114,"end":118,"count":0}]);
+ {"start":114,"end":118,"count":0}]
+);
 
 TestCoverage(
 "LogicalAndExpression IsTest()",
@@ -831,4 +836,220 @@
  {"start":423,"end":431,"count":0}
 ]);
 
+TestCoverage(
+"https://crbug.com/827530",
+`
+Util = {};                                // 0000
+Util.escape = function UtilEscape(str) {  // 0050
+  if (!str) {                             // 0100
+    return 'if';                          // 0150
+  } else {                                // 0200
+    return 'else';                        // 0250
+  }                                       // 0300
+};                                        // 0350
+Util.escape("foo.bar");                   // 0400
+`,
+[{"start":0,"end":449,"count":1},
+ {"start":64,"end":351,"count":1},
+ {"start":112,"end":203,"count":0}]
+);
+
+TestCoverage(
+"https://crbug.com/v8/8237",
+`
+!function() {                             // 0000
+  if (true)                               // 0050
+    while (false) return; else nop();     // 0100
+}();                                      // 0150
+!function() {                             // 0200
+  if (true) l0: { break l0; } else        // 0250
+    if (nop()) { }                        // 0300
+}();                                      // 0350
+!function() {                             // 0400
+  if (true) { if (false) { return; }      // 0450
+  } else if (nop()) { } }();              // 0500
+!function(){                              // 0550
+  if(true)while(false)return;else nop()   // 0600
+}();                                      // 0650
+!function(){                              // 0700
+  if(true) l0:{break l0}else if (nop()){} // 0750
+}();                                      // 0800
+!function(){                              // 0850
+  if(true){if(false){return}}else         // 0900
+    if(nop()){}                           // 0950
+}();                                      // 1000
+`,
+[{"start":0,"end":1049,"count":1},
+ {"start":1,"end":151,"count":1},
+ {"start":118,"end":137,"count":0},
+ {"start":201,"end":351,"count":1},
+ {"start":279,"end":318,"count":0},
+ {"start":401,"end":525,"count":1},
+ {"start":475,"end":486,"count":0},
+ {"start":503,"end":523,"count":0},
+ {"start":551,"end":651,"count":1},
+ {"start":622,"end":639,"count":0},
+ {"start":701,"end":801,"count":1},
+ {"start":774,"end":791,"count":0},
+ {"start":851,"end":1001,"count":1},
+ {"start":920,"end":928,"count":0},
+ {"start":929,"end":965,"count":0}]
+);
+
+TestCoverage(
+"terminal break statement",
+`
+while (true) {                            // 0000
+  const b = false                         // 0050
+  break                                   // 0100
+}                                         // 0150
+let stop = false                          // 0200
+while (true) {                            // 0250
+  if (stop) {                             // 0300
+    break                                 // 0350
+  }                                       // 0400
+  stop = true                             // 0450
+}                                         // 0500
+`,
+[{"start":0,"end":549,"count":1},
+ {"start":263,"end":501,"count":2},
+ {"start":312,"end":501,"count":1}]
+);
+
+TestCoverage(
+"terminal return statement",
+`
+function a () {                           // 0000
+  const b = false                         // 0050
+  return 1                                // 0100
+}                                         // 0150
+const b = (early) => {                    // 0200
+  if (early) {                            // 0250
+    return 2                              // 0300
+  }                                       // 0350
+  return 3                                // 0400
+}                                         // 0450
+const c = () => {                         // 0500
+  if (true) {                             // 0550
+    return                                // 0600
+  }                                       // 0650
+}                                         // 0700
+a(); b(false); b(true); c()               // 0750
+`,
+[{"start":0,"end":799,"count":1},
+ {"start":0,"end":151,"count":1},
+ {"start":210,"end":451,"count":2},
+ {"start":263,"end":450,"count":1},
+ {"start":510,"end":701,"count":1}]
+);
+
+TestCoverage(
+"terminal blocks",
+`
+function a () {                           // 0000
+  {                                       // 0050
+    return 'a'                            // 0100
+  }                                       // 0150
+}                                         // 0200
+function b () {                           // 0250
+  {                                       // 0300
+    {                                     // 0350
+      return 'b'                          // 0400
+    }                                     // 0450
+  }                                       // 0500
+}                                         // 0550
+a(); b()                                  // 0600
+`,
+[{"start":0,"end":649,"count":1},
+ {"start":0,"end":201,"count":1},
+ {"start":250,"end":551,"count":1}]
+);
+
+TestCoverage(
+"terminal if statements",
+`
+function a (branch) {                     // 0000
+  if (branch) {                           // 0050
+    return 'a'                            // 0100
+  } else {                                // 0150
+    return 'b'                            // 0200
+  }                                       // 0250
+}                                         // 0300
+function b (branch) {                     // 0350
+  if (branch) {                           // 0400
+    if (branch) {                         // 0450
+      return 'c'                          // 0500
+    }                                     // 0550
+  }                                       // 0600
+}                                         // 0650
+function c (branch) {                     // 0700
+  if (branch) {                           // 0750
+    return 'c'                            // 0800
+  } else {                                // 0850
+    return 'd'                            // 0900
+  }                                       // 0950
+}                                         // 1000
+function d (branch) {                     // 1050
+  if (branch) {                           // 1100
+    if (!branch) {                        // 1150
+      return 'e'                          // 1200
+    } else {                              // 1250
+      return 'f'                          // 1300
+    }                                     // 1350
+  } else {                                // 1400
+    // noop                               // 1450
+  }                                       // 1500
+}                                         // 1550
+a(true); a(false); b(true); b(false)      // 1600
+c(true); d(true);                         // 1650
+`,
+[{"start":0,"end":1699,"count":1},
+ {"start":0,"end":301,"count":2},
+ {"start":64,"end":253,"count":1},
+ {"start":350,"end":651,"count":2},
+ {"start":414,"end":603,"count":1},
+ {"start":700,"end":1001,"count":1},
+ {"start":853,"end":953,"count":0},
+ {"start":1050,"end":1551,"count":1},
+ {"start":1167,"end":1255,"count":0},
+ {"start":1403,"end":1503,"count":0}]
+);
+
+TestCoverage(
+"https://crbug.com/927464",
+`
+!function f() {                           // 0000
+  function unused() { nop(); }            // 0050
+  nop();                                  // 0100
+}();                                      // 0150
+`,
+[{"start":0,"end":199,"count":1},
+ {"start":1,"end":151,"count":1},
+ {"start":52,"end":80,"count":0}]
+);
+
+TestCoverage(
+"https://crbug.com/v8/8691",
+`
+function f(shouldThrow) {                 // 0000
+  if (shouldThrow) {                      // 0050
+    throw Error('threw')                  // 0100
+  }                                       // 0150
+}                                         // 0200
+try {                                     // 0250
+  f(true)                                 // 0300
+} catch (err) {                           // 0350
+                                          // 0400
+}                                         // 0450
+try {                                     // 0500
+  f(false)                                // 0550
+} catch (err) {}                          // 0600
+`,
+[{"start":0,"end":649,"count":1},
+ {"start":351,"end":352,"count":0},
+ {"start":602,"end":616,"count":0},
+ {"start":0,"end":201,"count":2},
+ {"start":69,"end":153,"count":1}]
+);
+
 %DebugToggleBlockCoverage(false);
diff --git a/src/v8/test/mjsunit/code-coverage-class-fields.js b/src/v8/test/mjsunit/code-coverage-class-fields.js
new file mode 100644
index 0000000..15b5478
--- /dev/null
+++ b/src/v8/test/mjsunit/code-coverage-class-fields.js
@@ -0,0 +1,174 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-always-opt --harmony-public-fields
+// Flags: --harmony-static-fields --no-stress-flush-bytecode
+// Files: test/mjsunit/code-coverage-utils.js
+
+%DebugToggleBlockCoverage(true);
+
+TestCoverage(
+"class with no fields",
+`
+class X {                                  // 000
+};                                         // 050
+`,
+[{"start":0,"end":99,"count":1}]
+);
+
+TestCoverage(
+"class that's not created",
+`
+class X {                                  // 000
+  x = function() { }                       // 050
+};                                         // 100
+`,
+[{"start":0,"end":149,"count":1},
+ {"start":52,"end":70,"count":0}]
+);
+
+TestCoverage(
+"class with field thats not called",
+`
+class X {                                  // 000
+  x = function() { }                       // 050
+};                                         // 100
+let x = new X();                           // 150
+`,
+[{"start":0,"end":199,"count":1},
+ {"start":52,"end":70,"count":1},
+ {"start":56,"end":70,"count":0}]
+);
+
+TestCoverage(
+"class field",
+`
+class X {                                  // 000
+  x = function() { }                       // 050
+};                                         // 100
+let x = new X();                           // 150
+x.x();                                     // 200
+`,
+[{"start":0,"end":249,"count":1},
+ {"start":52,"end":70,"count":1},
+ {"start":56,"end":70,"count":1}]
+);
+
+TestCoverage(
+"non contiguous class field",
+`
+class X {                                  // 000
+  x = function() { }                       // 050
+  foo() { }                                // 100
+  y = function() {}                        // 150
+};                                         // 200
+let x = new X();                           // 250
+x.x();                                     // 300
+x.y();                                     // 350
+`,
+[{"start":0,"end":399,"count":1},
+ {"start":52,"end":169,"count":1},
+ {"start":56,"end":70,"count":1},
+ {"start":102,"end":111,"count":0},
+ {"start":156,"end":169,"count":1}]
+);
+
+TestCoverage(
+"non contiguous class field thats called",
+`
+class X {                                  // 000
+  x = function() { }                       // 050
+  foo() { }                                // 100
+  y = function() {}                        // 150
+};                                         // 200
+let x = new X();                           // 250
+x.x();                                     // 300
+x.y();                                     // 350
+x.foo();                                   // 400
+`,
+[{"start":0,"end":449,"count":1},
+ {"start":52,"end":169,"count":1},
+ {"start":56,"end":70,"count":1},
+ {"start":102,"end":111,"count":1},
+ {"start":156,"end":169,"count":1}]
+);
+
+TestCoverage(
+"class with initializer iife",
+`
+class X {                                  // 000
+  x = (function() { })()                   // 050
+};                                         // 100
+let x = new X();                           // 150
+`,
+[{"start":0,"end":199,"count":1},
+ {"start":52,"end":74,"count":1},
+ {"start":57,"end":71,"count":1}]
+);
+
+TestCoverage(
+"class with computed field",
+`
+function f() {};                           // 000
+class X {                                  // 050
+  [f()] = (function() { })()               // 100
+};                                         // 150
+let x = new X();                           // 200
+`,
+[{"start":0,"end":249,"count":1},
+ {"start":0,"end":15,"count":1},
+ {"start":102,"end":128,"count":1},
+ {"start":111,"end":125,"count":1}]
+);
+
+TestCoverage(
+"static class field that's not called",
+`
+class X {                                  // 000
+  static x = function() { }                // 050
+};                                         // 100
+`,
+[{"start":0,"end":149,"count":1},
+ {"start":52,"end":77,"count":1},
+ {"start":63,"end":77,"count":0}]
+);
+
+TestCoverage(
+"static class field",
+`
+class X {                                  // 000
+  static x = function() { }                // 050
+};                                         // 100
+X.x();                                     // 150
+`,
+[{"start":0,"end":199,"count":1},
+ {"start":52,"end":77,"count":1},
+ {"start":63,"end":77,"count":1}]
+);
+
+TestCoverage(
+"static class field with iife",
+`
+class X {                                  // 000
+  static x = (function() { })()            // 050
+};                                         // 100
+`,
+[{"start":0,"end":149,"count":1},
+ {"start":52,"end":81,"count":1},
+ {"start":64,"end":78,"count":1}]
+);
+
+TestCoverage(
+"computed static class field",
+`
+function f() {}                            // 000
+class X {                                  // 050
+  static [f()] = (function() { })()        // 100
+};                                         // 150
+`,
+[{"start":0,"end":199,"count":1},
+ {"start":0,"end":15,"count":1},
+ {"start":102,"end":135,"count":1},
+ {"start":118,"end":132,"count":1}]
+);
diff --git a/src/v8/test/mjsunit/code-coverage-precise.js b/src/v8/test/mjsunit/code-coverage-precise.js
index c5569cf..3c70408 100644
--- a/src/v8/test/mjsunit/code-coverage-precise.js
+++ b/src/v8/test/mjsunit/code-coverage-precise.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --no-always-opt
+// Flags: --allow-natives-syntax --no-always-opt --no-stress-flush-bytecode
 // Flags: --no-stress-incremental-marking
 // Files: test/mjsunit/code-coverage-utils.js
 
@@ -50,4 +50,17 @@
 [{"start":0,"end":63,"count":1},{"start":41,"end":48,"count":5}]
 );
 
+TestCoverage(
+"https://crbug.com/927464",
+`
+!function f() {                           // 0000
+  function unused() { nop(); }            // 0100
+  nop();                                  // 0150
+}();                                      // 0200
+`,
+[{"start":0,"end":199,"count":1},
+ {"start":1,"end":151,"count":1},
+ {"start":52,"end":80,"count":0}]
+);
+
 %DebugTogglePreciseCoverage(false);
diff --git a/src/v8/test/mjsunit/code-coverage-utils.js b/src/v8/test/mjsunit/code-coverage-utils.js
index 009aa55..5783390 100644
--- a/src/v8/test/mjsunit/code-coverage-utils.js
+++ b/src/v8/test/mjsunit/code-coverage-utils.js
@@ -13,7 +13,7 @@
 !function() {
   function GetCoverage(source) {
     for (var script of %DebugCollectCoverage()) {
-      if (script.script.source == source) return script;
+      if (script.script === source) return script;
     }
     return undefined;
   };
diff --git a/src/v8/test/mjsunit/compare-known-objects-tostringtag.js b/src/v8/test/mjsunit/compare-known-objects-tostringtag.js
index 4eacc8a..b1749f0 100644
--- a/src/v8/test/mjsunit/compare-known-objects-tostringtag.js
+++ b/src/v8/test/mjsunit/compare-known-objects-tostringtag.js
@@ -47,6 +47,10 @@
 var obj1 = new O;
 var obj2 = new O;
 
+%PrepareFunctionForOptimization(le);
+%PrepareFunctionForOptimization(lt);
+%PrepareFunctionForOptimization(ge);
+%PrepareFunctionForOptimization(gt);
 assertTrue(%HaveSameMap(obj1, obj2));
 test(obj1, obj2);
 test(obj1, obj2);
diff --git a/src/v8/test/mjsunit/compare-objects.js b/src/v8/test/mjsunit/compare-objects.js
index fb31203..4cf1760 100644
--- a/src/v8/test/mjsunit/compare-objects.js
+++ b/src/v8/test/mjsunit/compare-objects.js
@@ -59,6 +59,7 @@
   assertEquals(lt(b, a), greater);
   assertEquals(gt(b, a), less);
 }
+%PrepareFunctionForOptimization(test);
 
 var obj1 = {toString: function() {return "1";}};
 var obj2 = {toString: function() {return "2";}};
@@ -88,6 +89,7 @@
 test(obj1, obj2, less, greater);
 test(obj1, obj2, less, greater);
 test(obj1, obj2, less, greater);
+%PrepareFunctionForOptimization(test);
 %OptimizeFunctionOnNextCall(test);
 test(obj1, obj2, less, greater);
 test(obj1, obj2, less, greater);
@@ -96,6 +98,7 @@
 var less = obj1 < obj2;
 var greater = obj1 > obj2;
 test(obj1, obj2, less, greater);
+%PrepareFunctionForOptimization(test);
 %OptimizeFunctionOnNextCall(test);
 test(obj1, obj2, less, greater);
 
diff --git a/src/v8/test/mjsunit/comparison-ops-and-undefined.js b/src/v8/test/mjsunit/comparison-ops-and-undefined.js
index 06db076..04bf13d 100644
--- a/src/v8/test/mjsunit/comparison-ops-and-undefined.js
+++ b/src/v8/test/mjsunit/comparison-ops-and-undefined.js
@@ -35,6 +35,7 @@
 }
 
 function test_helper_for_crankshaft(func, b1, b2, b3, b4) {
+  %PrepareFunctionForOptimization(func);
   assertEquals(b1, func(.5, .5));
   %OptimizeFunctionOnNextCall(func);
   assertEquals(b1, func(.5, .5));
diff --git a/src/v8/test/mjsunit/compiler-regress-787301.js b/src/v8/test/mjsunit/compiler-regress-787301.js
index 851e22a..343ae1e 100644
--- a/src/v8/test/mjsunit/compiler-regress-787301.js
+++ b/src/v8/test/mjsunit/compiler-regress-787301.js
@@ -13,6 +13,7 @@
         return arr.slice();
 }
 
+%PrepareFunctionForOptimization(opt);
 opt(false);
 opt(false);
 %OptimizeFunctionOnNextCall(opt);
diff --git a/src/v8/test/mjsunit/compiler/abstract-equal-receiver.js b/src/v8/test/mjsunit/compiler/abstract-equal-receiver.js
new file mode 100644
index 0000000..1388de7
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/abstract-equal-receiver.js
@@ -0,0 +1,187 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --noalways-opt
+
+// Known receivers abstract equality.
+(function() {
+  const a = {};
+  const b = {};
+
+  function foo() { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo());
+  assertFalse(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo());
+})();
+
+// Known receiver/null abstract equality.
+(function() {
+  const a = {};
+  const b = null;
+
+  function foo() { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo());
+  assertFalse(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo());
+})();
+
+// Known null/receiver abstract equality.
+(function() {
+  const a = null;
+  const b = {};
+
+  function foo() { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo());
+  assertFalse(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo());
+})();
+
+// Known receiver/undefined abstract equality.
+(function() {
+  const a = {};
+  const b = undefined;
+
+  function foo() { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo());
+  assertFalse(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo());
+})();
+
+// Known undefined/receiver abstract equality.
+(function() {
+  const a = undefined;
+  const b = {};
+
+  function foo() { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo());
+  assertFalse(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo());
+})();
+
+// Known receiver on one side strict equality.
+(function() {
+  const a = {};
+  const b = {};
+
+  function foo(a) { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+
+  // TurboFan bakes in feedback for the (unknown) left hand side.
+  assertFalse(foo(null));
+  assertUnoptimized(foo);
+})();
+
+// Known receiver on one side strict equality with null.
+(function() {
+  const a = null;
+  const b = {};
+
+  function foo(a) { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+
+  // TurboFan bakes in feedback for the (unknown) left hand side.
+  assertFalse(foo(1));
+  assertUnoptimized(foo);
+})();
+
+// Known receiver on one side strict equality with undefined.
+(function() {
+  const a = undefined;
+  const b = {};
+
+  function foo(a) { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+
+  // TurboFan bakes in feedback for the (unknown) left hand side.
+  assertFalse(foo(1));
+  assertUnoptimized(foo);
+})();
+
+// Known null on one side strict equality with receiver.
+(function() {
+  const a = {};
+  const b = null;
+
+  function foo(a) { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  assertTrue(foo(null));
+  assertTrue(foo(undefined));
+  assertOptimized(foo);
+
+  // TurboFan doesn't need to bake in feedback, since it sees the null.
+  assertFalse(foo(1));
+  assertOptimized(foo);
+})();
+
+// Known undefined on one side strict equality with receiver.
+(function() {
+  const a = {};
+  const b = undefined;
+
+  function foo(a) { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  assertTrue(foo(null));
+  assertTrue(foo(undefined));
+  assertOptimized(foo);
+
+  // TurboFan needs to bake in feedback, since undefined cannot
+  // be context specialized.
+  assertFalse(foo(1));
+  assertUnoptimized(foo);
+})();
diff --git a/src/v8/test/mjsunit/compiler/abstract-equal-symbol.js b/src/v8/test/mjsunit/compiler/abstract-equal-symbol.js
new file mode 100644
index 0000000..2a7c964
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/abstract-equal-symbol.js
@@ -0,0 +1,145 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --noalways-opt
+
+// Known symbols abstract equality.
+(function() {
+  const a = Symbol("a");
+  const b = Symbol("b");
+
+  function foo() { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo());
+  assertFalse(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo());
+})();
+
+// Known symbols abstract in-equality.
+(function() {
+  const a = Symbol("a");
+  const b = Symbol("b");
+
+  function foo() { return a != b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();
+
+// Known symbol on one side abstract equality.
+(function() {
+  const a = Symbol("a");
+  const b = Symbol("b");
+
+  function foo(a) { return a == b; }
+
+  // Warmup
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  assertOptimized(foo);
+
+  // Make optimized code bail out
+  assertFalse(foo("a"));
+  assertUnoptimized(foo);
+
+  // Make sure TurboFan learns the new feedback
+  %PrepareFunctionForOptimization(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo("a"));
+  assertOptimized(foo);
+})();
+
+// Known symbol on one side abstract in-equality.
+(function() {
+  const a = Symbol("a");
+  const b = Symbol("b");
+
+  function foo(a) { return a != b; }
+
+  // Warmup
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(b));
+  assertTrue(foo(a));
+  assertFalse(foo(b));
+  assertTrue(foo(a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(b));
+  assertTrue(foo(a));
+
+  // Make optimized code bail out
+  assertTrue(foo("a"));
+  assertUnoptimized(foo);
+
+  // Make sure TurboFan learns the new feedback
+  %PrepareFunctionForOptimization(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo("a"));
+  assertOptimized(foo);
+})();
+
+// Feedback based symbol abstract equality.
+(function() {
+  const a = Symbol("a");
+  const b = Symbol("b");
+
+  function foo(a, b) { return a == b; }
+
+  // Warmup
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(b, b));
+  assertFalse(foo(a, b));
+  assertTrue(foo(a, a));
+  assertFalse(foo(b, a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(a, a));
+  assertFalse(foo(b, a));
+
+  // Make optimized code bail out
+  assertFalse(foo("a", b));
+  assertUnoptimized(foo);
+
+  // Make sure TurboFan learns the new feedback
+  %PrepareFunctionForOptimization(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo("a", b));
+  assertOptimized(foo);
+})();
+
+// Feedback based symbol abstract in-equality.
+(function() {
+  const a = Symbol("a");
+  const b = Symbol("b");
+
+  function foo(a, b) { return a != b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(b, b));
+  assertTrue(foo(a, b));
+  assertFalse(foo(a, a));
+  assertTrue(foo(b, a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(a, a));
+  assertTrue(foo(b, a));
+
+  // Make optimized code bail out
+  assertTrue(foo("a", b));
+  assertUnoptimized(foo);
+
+  // Make sure TurboFan learns the new feedback
+  %PrepareFunctionForOptimization(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo("a", b));
+  assertOptimized(foo);
+})();
diff --git a/src/v8/test/mjsunit/compiler/abstract-equal-undetectable.js b/src/v8/test/mjsunit/compiler/abstract-equal-undetectable.js
new file mode 100644
index 0000000..ad866aa
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/abstract-equal-undetectable.js
@@ -0,0 +1,126 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --noalways-opt
+
+const undetectable = %GetUndetectable();
+
+// Known undetectable abstract equality.
+(function() {
+  const a = undetectable;
+  const b = {};
+
+  function foo() { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo());
+  assertFalse(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo());
+})();
+
+// Known undetectable/null abstract equality.
+(function() {
+  const a = undetectable;
+  const b = null;
+
+  function foo() { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();
+
+// Known undetectable/receiver abstract equality.
+(function() {
+  const a = null;
+  const b = undetectable;
+
+  function foo() { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();
+
+// Known undetectable/undefined abstract equality.
+(function() {
+  const a = undetectable;
+  const b = undefined;
+
+  function foo() { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();
+
+// Known undefined/undetectable abstract equality.
+(function() {
+  const a = undefined;
+  const b = undetectable;
+
+  function foo() { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();
+
+// Known undetectable on one side strict equality with receiver.
+(function() {
+  const a = {};
+  const b = undetectable;
+
+  function foo(a) { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+
+  // TurboFan doesn't need to bake in feedback, since it sees the undetectable.
+  assertFalse(foo(1));
+  assertOptimized(foo);
+})();
+
+// Unknown undetectable on one side strict equality with receiver.
+(function() {
+  const a = undetectable;
+  const b = {};
+
+  function foo(a, b) { return a == b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(b, b));
+  assertFalse(foo(a, b));
+  assertTrue(foo(a, a));
+  assertFalse(foo(b, a));
+  assertTrue(foo(a, null));
+  assertFalse(foo(b, null));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(b, b));
+  assertFalse(foo(a, b));
+  assertTrue(foo(a, a));
+  assertFalse(foo(b, a));
+  assertTrue(foo(a, null));
+  assertFalse(foo(b, null));
+  assertOptimized(foo);
+
+  // TurboFan bakes in feedback on the inputs.
+  assertFalse(foo(1));
+  assertUnoptimized(foo);
+})();
diff --git a/src/v8/test/mjsunit/compiler/accessor-exceptions1.js b/src/v8/test/mjsunit/compiler/accessor-exceptions1.js
index 716d229..42b2f11 100644
--- a/src/v8/test/mjsunit/compiler/accessor-exceptions1.js
+++ b/src/v8/test/mjsunit/compiler/accessor-exceptions1.js
@@ -15,6 +15,7 @@
   return x;
 }
 
+%PrepareFunctionForOptimization(foo);
 assertEquals(7, foo(o));
 assertEquals(7, foo(o));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/accessor-exceptions2.js b/src/v8/test/mjsunit/compiler/accessor-exceptions2.js
index ed6e3e2..2d784e6 100644
--- a/src/v8/test/mjsunit/compiler/accessor-exceptions2.js
+++ b/src/v8/test/mjsunit/compiler/accessor-exceptions2.js
@@ -15,6 +15,7 @@
   return x;
 }
 
+%PrepareFunctionForOptimization(foo);
 assertEquals(7, foo(o));
 assertEquals(7, foo(o));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/alloc-number.js b/src/v8/test/mjsunit/compiler/alloc-number.js
index 85c39de..cd062ca 100644
--- a/src/v8/test/mjsunit/compiler/alloc-number.js
+++ b/src/v8/test/mjsunit/compiler/alloc-number.js
@@ -1,39 +1,20 @@
 // Copyright 2010 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
 
+// Flags: --max-semi-space-size=1 --max-old-space-size=10
+
+// This test is specific to release builds. alloc-number-debug.js
+// has a fast version for debug builds.
 
 // Try to get a GC because of a heap number allocation while we
 // have live values (o) in a register.
 function f(o) {
   var x = 1.5;
   var y = 2.5;
-  for (var i = 1; i < 100000; i+=2) o.val = x + y + i;
+  for (var i = 1; i < 10000; i+=2) o.val = x + y + i;
   return o;
 }
 
 var o = { val: 0 };
-for (var i = 0; i < 100; i++) f(o);
+for (var i = 0; i < 10; i++) f(o);
diff --git a/src/v8/test/mjsunit/compiler/alloc-object-huge.js b/src/v8/test/mjsunit/compiler/alloc-object-huge.js
index 74b600c..1333b64 100644
--- a/src/v8/test/mjsunit/compiler/alloc-object-huge.js
+++ b/src/v8/test/mjsunit/compiler/alloc-object-huge.js
@@ -36,6 +36,7 @@
 function test() {
   return new huge();
 }
+%PrepareFunctionForOptimization(test);
 test();
 test();
 %OptimizeFunctionOnNextCall(test);
diff --git a/src/v8/test/mjsunit/compiler/alloc-object.js b/src/v8/test/mjsunit/compiler/alloc-object.js
index 8d19816..78e9c51 100644
--- a/src/v8/test/mjsunit/compiler/alloc-object.js
+++ b/src/v8/test/mjsunit/compiler/alloc-object.js
@@ -37,6 +37,7 @@
 
 function test(construct) {
   %DeoptimizeFunction(test);
+  %PrepareFunctionForOptimization(test_helper);
   test_helper(construct, 0, 0);
   test_helper(construct, 0, 0);
   %OptimizeFunctionOnNextCall(test_helper);
diff --git a/src/v8/test/mjsunit/compiler/arguments-object.js b/src/v8/test/mjsunit/compiler/arguments-object.js
new file mode 100644
index 0000000..4562c08
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/arguments-object.js
@@ -0,0 +1,171 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --noturbo-inlining
+
+// Ensure that arguments in sloppy mode function works
+// properly when called directly from optimized code.
+(function() {
+  function g() { return arguments; }
+  function f() { return g(1, 2, 3); }
+
+  %PrepareFunctionForOptimization(f);
+  assertEquals(g(1, 2, 3), f());
+  assertEquals(g(1, 2, 3), f());
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(g(1, 2, 3), f());
+  %PrepareFunctionForOptimization(g);
+  %OptimizeFunctionOnNextCall(g);
+  assertEquals(g(1, 2, 3), f());
+})();
+
+// Ensure that arguments in strict mode function works
+// properly when called directly from optimized code.
+(function() {
+  "use strict";
+  function g() { return arguments; }
+  function f() { return g(1, 2, 3); }
+
+  %PrepareFunctionForOptimization(f);
+  assertEquals(g(1, 2, 3), f());
+  assertEquals(g(1, 2, 3), f());
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(g(1, 2, 3), f());
+  %PrepareFunctionForOptimization(g);
+  %OptimizeFunctionOnNextCall(g);
+  assertEquals(g(1, 2, 3), f());
+})();
+
+// Ensure that arguments in sloppy mode function works
+// properly when called directly from optimized code,
+// and the access to "arguments" is hidden inside eval().
+(function() {
+  function g() { return eval("arguments"); }
+  function f() { return g(1, 2, 3); }
+
+  %PrepareFunctionForOptimization(f);
+  assertEquals(g(1, 2, 3), f());
+  assertEquals(g(1, 2, 3), f());
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(g(1, 2, 3), f());
+  %PrepareFunctionForOptimization(g);
+  %OptimizeFunctionOnNextCall(g);
+  assertEquals(g(1, 2, 3), f());
+})();
+
+// Ensure that arguments in strict mode function works
+// properly when called directly from optimized code,
+// and the access to "arguments" is hidden inside eval().
+(function() {
+  "use strict";
+  function g() { return eval("arguments"); }
+  function f() { return g(1, 2, 3); }
+
+  %PrepareFunctionForOptimization(f);
+  assertEquals(g(1, 2, 3), f());
+  assertEquals(g(1, 2, 3), f());
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(g(1, 2, 3), f());
+  %PrepareFunctionForOptimization(g);
+  assertEquals(g(1, 2, 3), f());
+  %OptimizeFunctionOnNextCall(g);
+  assertEquals(g(1, 2, 3), f());
+})();
+
+// Ensure that `Function.arguments` accessor does the
+// right thing in sloppy mode functions called directly
+// from optimized code.
+(function() {
+  function h() { return g.arguments; }
+  function g() { return h(); }
+  function f() { return g(1, 2, 3); }
+
+  %PrepareFunctionForOptimization(f);
+  assertEquals(g(1, 2, 3), f());
+  assertEquals(g(1, 2, 3), f());
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(g(1, 2, 3), f());
+  %PrepareFunctionForOptimization(g);
+  assertEquals(g(1, 2, 3), f());
+  %OptimizeFunctionOnNextCall(g);
+  assertEquals(g(1, 2, 3), f());
+})();
+(function() {
+  function h() { return g.arguments; }
+  function g() { return h(); }
+  function f() { "use strict"; return g(1, 2, 3); }
+
+  %PrepareFunctionForOptimization(f);
+  assertEquals(g(1, 2, 3), f());
+  assertEquals(g(1, 2, 3), f());
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(g(1, 2, 3), f());
+  %PrepareFunctionForOptimization(g);
+  assertEquals(g(1, 2, 3), f());
+  %OptimizeFunctionOnNextCall(g);
+  assertEquals(g(1, 2, 3), f());
+})();
+(function() {
+  function h() { "use strict"; return g.arguments; }
+  function g() { return h(); }
+  function f() { return g(1, 2, 3); }
+
+  %PrepareFunctionForOptimization(f);
+  assertEquals(g(1, 2, 3), f());
+  assertEquals(g(1, 2, 3), f());
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(g(1, 2, 3), f());
+  %PrepareFunctionForOptimization(g);
+  assertEquals(g(1, 2, 3), f());
+  %OptimizeFunctionOnNextCall(g);
+  assertEquals(g(1, 2, 3), f());
+})();
+(function() {
+  function h() { "use strict"; return g.arguments; }
+  function g() { return h(); }
+  function f() { "use strict"; return g(1, 2, 3); }
+
+  %PrepareFunctionForOptimization(f);
+  assertEquals(g(1, 2, 3), f());
+  assertEquals(g(1, 2, 3), f());
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(g(1, 2, 3), f());
+  %PrepareFunctionForOptimization(g);
+  assertEquals(g(1, 2, 3), f());
+  %OptimizeFunctionOnNextCall(g);
+  assertEquals(g(1, 2, 3), f());
+})();
+
+// Ensure that `Function.arguments` works properly in
+// combination with the `Function.caller` proper.
+(function() {
+  function h() { return h.caller.arguments; }
+  function g() { return h(); }
+  function f() { return g(1, 2, 3); }
+
+  %PrepareFunctionForOptimization(f);
+  assertEquals(g(1, 2, 3), f());
+  assertEquals(g(1, 2, 3), f());
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(g(1, 2, 3), f());
+  %PrepareFunctionForOptimization(g);
+  assertEquals(g(1, 2, 3), f());
+  %OptimizeFunctionOnNextCall(g);
+  assertEquals(g(1, 2, 3), f());
+})();
+(function() {
+  function h() { return h.caller.arguments; }
+  function g() { return h(); }
+  function f() { "use strict"; return g(1, 2, 3); }
+
+  %PrepareFunctionForOptimization(f);
+  assertEquals(g(1, 2, 3), f());
+  assertEquals(g(1, 2, 3), f());
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(g(1, 2, 3), f());
+  %PrepareFunctionForOptimization(g);
+  assertEquals(g(1, 2, 3), f());
+  %OptimizeFunctionOnNextCall(g);
+  assertEquals(g(1, 2, 3), f());
+})();
diff --git a/src/v8/test/mjsunit/compiler/array-access.js b/src/v8/test/mjsunit/compiler/array-access.js
index 65b3c99..99a6259 100644
--- a/src/v8/test/mjsunit/compiler/array-access.js
+++ b/src/v8/test/mjsunit/compiler/array-access.js
@@ -45,23 +45,43 @@
   return a[a[a[n]]];
 }
 
-function RunGetTests() {
-  var a = [2,0,1];
-  assertEquals(2, Get0(a));
+function RunGetTests(packed=true) {
+  if (packed) {
+    var a = [2,0,1];
+    assertEquals(2, Get0(a));
 
-  assertEquals(2, GetN(a, 0));
-  assertEquals(0, GetN(a, 1));
-  assertEquals(1, GetN(a, 2));
+    assertEquals(2, GetN(a, 0));
+    assertEquals(0, GetN(a, 1));
+    assertEquals(1, GetN(a, 2));
 
-  assertEquals(1, GetA0(a));
+    assertEquals(1, GetA0(a));
 
-  assertEquals(1, GetAN(a,0));
-  assertEquals(2, GetAN(a,1));
-  assertEquals(0, GetAN(a,2));
+    assertEquals(1, GetAN(a,0));
+    assertEquals(2, GetAN(a,1));
+    assertEquals(0, GetAN(a,2));
 
-  assertEquals(0, GetAAN(a,0));
-  assertEquals(1, GetAAN(a,1));
-  assertEquals(2, GetAAN(a,2));
+    assertEquals(0, GetAAN(a,0));
+    assertEquals(1, GetAAN(a,1));
+    assertEquals(2, GetAAN(a,2));
+  }
+  else {
+    var a = ['2','0','1'];
+    assertEquals('2', Get0(a));
+
+    assertEquals('2', GetN(a, 0));
+    assertEquals('0', GetN(a, 1));
+    assertEquals('1', GetN(a, 2));
+
+    assertEquals('1', GetA0(a));
+
+    assertEquals('1', GetAN(a,0));
+    assertEquals('2', GetAN(a,1));
+    assertEquals('0', GetAN(a,2));
+
+    assertEquals('0', GetAAN(a,0));
+    assertEquals('1', GetAAN(a,1));
+    assertEquals('2', GetAAN(a,2));
+  }
 }
 
 
@@ -81,29 +101,39 @@
   a[n] = x;
 }
 
-function RunSetTests(a) {
+function RunSetTests(a, packed=true) {
   Set07(a);
-  assertEquals(7, a[0]);
+  if (packed) {
+    assertEquals(7, a[0]);
+  }
   assertEquals(0, a[1]);
   assertEquals(0, a[2]);
 
   Set0V(a, 1);
-  assertEquals(1, a[0]);
+  if (packed) {
+    assertEquals(1, a[0]);
+  }
   assertEquals(0, a[1]);
   assertEquals(0, a[2]);
 
   SetN7(a, 2);
-  assertEquals(1, a[0]);
+  if (packed) {
+    assertEquals(1, a[0]);
+  }
   assertEquals(0, a[1]);
   assertEquals(7, a[2]);
 
   SetNX(a, 1, 5);
-  assertEquals(1, a[0]);
+  if (packed) {
+    assertEquals(1, a[0]);
+  }
   assertEquals(5, a[1]);
   assertEquals(7, a[2]);
 
   for (var i = 0; i < 3; i++) SetNX(a, i, 0);
-  assertEquals(0, a[0]);
+  if (packed) {
+    assertEquals(0, a[0]);
+  }
   assertEquals(0, a[1]);
   assertEquals(0, a[2]);
 }
@@ -130,3 +160,56 @@
 }
 
 RunArrayBoundsCheckTest();
+
+// Packed
+// Non-extensible
+a = Object.preventExtensions([0,0,0,'a']);
+o = Object.preventExtensions({0: 0, 1: 0, 2: 0});
+for (var i = 0; i < 1000; i++) {
+  RunGetTests();
+  RunGetTests(false);
+  RunSetTests(a);
+  RunSetTests(o);
+}
+
+// Sealed
+a = Object.seal([0,0,0,'a']);
+o = Object.seal({0: 0, 1: 0, 2: 0});
+for (var i = 0; i < 1000; i++) {
+  RunGetTests();
+  RunGetTests(false);
+  RunSetTests(a);
+  RunSetTests(o);
+}
+
+// Frozen
+a = Object.freeze([0,0,0,'a']);
+o = Object.freeze({0: 0, 1: 0, 2: 0});
+for (var i = 0; i < 1000; i++) {
+  RunGetTests();
+  RunGetTests(false);
+}
+
+// Holey
+// Non-extensible
+a = Object.preventExtensions([,0,0,'a']);
+for (var i = 0; i < 1000; i++) {
+  RunGetTests();
+  RunGetTests(false);
+  RunSetTests(a, false);
+}
+
+// Sealed
+a = Object.seal([,0,0,'a']);
+for (var i = 0; i < 1000; i++) {
+  RunGetTests();
+  RunGetTests(false);
+  RunSetTests(a, false);
+}
+
+// Frozen
+a = Object.freeze([,0,0,'a']);
+for (var i = 0; i < 1000; i++) {
+  RunGetTests();
+  RunGetTests(false);
+}
diff --git a/src/v8/test/mjsunit/compiler/array-buffer-is-view.js b/src/v8/test/mjsunit/compiler/array-buffer-is-view.js
new file mode 100644
index 0000000..f2e5c30
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/array-buffer-is-view.js
@@ -0,0 +1,66 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that ObjectIsArrayBufferView lowering works correctly
+// in EffectControlLinearizer in the case that the input is
+// known to be a HeapObject by TurboFan. For this we use the
+// simple trick with an object literal whose field `x` will
+// only ever contain HeapObjects and so the representation
+// tracking is going to pick it up.
+(function() {
+  function foo(x) {
+    return ArrayBuffer.isView({x}.x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(Symbol()));
+  assertFalse(foo("some string"));
+  assertFalse(foo(new Object()));
+  assertFalse(foo(new Array()));
+  assertFalse(foo(new ArrayBuffer(1)));
+  assertTrue(foo(new Int32Array(1)));
+  assertTrue(foo(new DataView(new ArrayBuffer(1))));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(Symbol()));
+  assertFalse(foo("some string"));
+  assertFalse(foo(new Object()));
+  assertFalse(foo(new Array()));
+  assertFalse(foo(new ArrayBuffer(1)));
+  assertTrue(foo(new Int32Array(1)));
+  assertTrue(foo(new DataView(new ArrayBuffer(1))));
+  assertOptimized(foo);
+})();
+
+// Test that ObjectIsArrayBufferView lowering works correctly
+// in EffectControlLinearizer in the case that the input is
+// some arbitrary tagged value.
+(function() {
+  function foo(x) {
+    return ArrayBuffer.isView(x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(1));
+  assertFalse(foo(1.1));
+  assertFalse(foo(Symbol()));
+  assertFalse(foo("some string"));
+  assertFalse(foo(new Object()));
+  assertFalse(foo(new Array()));
+  assertFalse(foo(new ArrayBuffer(1)));
+  assertTrue(foo(new Int32Array(1)));
+  assertTrue(foo(new DataView(new ArrayBuffer(1))));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(1));
+  assertFalse(foo(1.1));
+  assertFalse(foo(Symbol()));
+  assertFalse(foo("some string"));
+  assertFalse(foo(new Object()));
+  assertFalse(foo(new Array()));
+  assertFalse(foo(new ArrayBuffer(1)));
+  assertTrue(foo(new Int32Array(1)));
+  assertTrue(foo(new DataView(new ArrayBuffer(1))));
+  assertOptimized(foo);
+})();
diff --git a/src/v8/test/mjsunit/compiler/array-constructor.js b/src/v8/test/mjsunit/compiler/array-constructor.js
index eef2427..aafe639 100644
--- a/src/v8/test/mjsunit/compiler/array-constructor.js
+++ b/src/v8/test/mjsunit/compiler/array-constructor.js
@@ -8,6 +8,7 @@
 (() => {
   function foo(x) { return Array(!!x); }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals([true], foo(true));
   assertEquals([false], foo(false));
   %OptimizeFunctionOnNextCall(foo);
@@ -19,6 +20,7 @@
 (() => {
   function foo(x) { return new Array(!!x); }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals([true], foo(true));
   assertEquals([false], foo(false));
   %OptimizeFunctionOnNextCall(foo);
@@ -30,6 +32,7 @@
 (() => {
   function foo(x) { return Array("" + x); }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(["a"], foo("a"));
   assertEquals(["b"], foo("b"));
   %OptimizeFunctionOnNextCall(foo);
@@ -41,6 +44,7 @@
 (() => {
   function foo(x) { return new Array("" + x); }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(["a"], foo("a"));
   assertEquals(["b"], foo("b"));
   %OptimizeFunctionOnNextCall(foo);
@@ -52,6 +56,7 @@
 (() => {
   function foo() { return Array(2); }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(2, foo().length);
   assertEquals(2, foo().length);
   %OptimizeFunctionOnNextCall(foo);
@@ -62,6 +67,7 @@
 (() => {
   function foo() { return new Array(2); }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(2, foo().length);
   assertEquals(2, foo().length);
   %OptimizeFunctionOnNextCall(foo);
@@ -72,6 +78,7 @@
 (() => {
   function foo(x, y, z) { return Array(x, y, z); }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals([1, 2, 3], foo(1, 2, 3));
   assertEquals([1, 2, 3], foo(1, 2, 3));
   %OptimizeFunctionOnNextCall(foo);
@@ -82,6 +89,7 @@
 (() => {
   function foo(x, y, z) { return new Array(x, y, z); }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals([1, 2, 3], foo(1, 2, 3));
   assertEquals([1, 2, 3], foo(1, 2, 3));
   %OptimizeFunctionOnNextCall(foo);
@@ -92,9 +100,90 @@
 (() => {
   function foo(x) { try { return new Array(x) } catch (e) { return e } }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals([], foo(0));
   assertEquals([], foo(0));
   %OptimizeFunctionOnNextCall(foo);
   assertEquals([], foo(0));
   assertInstanceof(foo(-1), RangeError);
 })();
+
+// Packed
+// Test non-extensible Array call with multiple parameters.
+(() => {
+  function foo(x, y, z, t) { return Object.preventExtensions(new Array(x, y, z, t)); }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals([1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertEquals([1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertFalse(Object.isExtensible(foo(1,2,3, 'a')));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals([1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertFalse(Object.isExtensible(foo(1,2,3, 'a')));
+})();
+
+// Test sealed Array call with multiple parameters.
+(() => {
+  function foo(x, y, z, t) { return Object.seal(new Array(x, y, z, t)); }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals([1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertEquals([1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertTrue(Object.isSealed(foo(1,2,3, 'a')));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals([1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertTrue(Object.isSealed(foo(1,2,3, 'a')));
+})();
+
+// Test frozen Array call with multiple parameters.
+(() => {
+  function foo(x, y, z, t) { return Object.freeze(new Array(x, y, z, t)); }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals([1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertEquals([1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertTrue(Object.isFrozen(foo(1,2,3, 'a')));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals([1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertTrue(Object.isFrozen(foo(1,2,3, 'a')));
+})();
+
+// Holey
+// Test non-extensible Array call with multiple parameters.
+(() => {
+  function foo(x, y, z, t) { return Object.preventExtensions([, x, y, z, t]); }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals([, 1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertEquals([, 1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertFalse(Object.isExtensible(foo(1,2,3, 'a')));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals([, 1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertFalse(Object.isExtensible(foo(1,2,3, 'a')));
+})();
+
+// Test sealed Array call with multiple parameters.
+(() => {
+  function foo(x, y, z, t) { return Object.seal([, x, y, z, t]); }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals([, 1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertEquals([, 1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertTrue(Object.isSealed(foo(1,2,3, 'a')));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals([, 1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertTrue(Object.isSealed(foo(1,2,3, 'a')));
+})();
+
+// Test frozen Array call with multiple parameters.
+(() => {
+  function foo(x, y, z, t) { return Object.freeze([, x, y, z, t]); }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals([, 1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertEquals([, 1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertTrue(Object.isFrozen(foo(1,2,3, 'a')));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals([, 1, 2, 3, 'a'], foo(1, 2, 3, 'a'));
+  assertTrue(Object.isFrozen(foo(1,2,3, 'a')));
+})();
diff --git a/src/v8/test/mjsunit/compiler/array-every.js b/src/v8/test/mjsunit/compiler/array-every.js
new file mode 100644
index 0000000..66230c5
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/array-every.js
@@ -0,0 +1,69 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Basic loop peeling test case with Array.prototype.every().
+(function() {
+  function foo(a, o) {
+    return a.every(x => x === o.x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo([3, 3, 3], {x:3}));
+  assertFalse(foo([3, 3, 2], {x:3}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo([3, 3, 3], {x:3}));
+  assertFalse(foo([3, 3, 2], {x:3}));
+
+  // Packed
+  // Non-extensible array
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(Object.preventExtensions(['3', '3', '3']), {x:'3'}));
+  assertFalse(foo(Object.preventExtensions(['3', '3', '2']), {x:'3'}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(Object.preventExtensions(['3', '3', '3']), {x:'3'}));
+  assertFalse(foo(Object.preventExtensions(['3', '3', '2']), {x:'3'}));
+
+  // Sealed array
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(Object.seal(['3', '3', '3']), {x:'3'}));
+  assertFalse(foo(Object.seal(['3', '3', '2']), {x:'3'}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(Object.seal(['3', '3', '3']), {x:'3'}));
+  assertFalse(foo(Object.seal(['3', '3', '2']), {x:'3'}));
+
+  // Frozen array
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(Object.freeze(['3', '3', '3']), {x:'3'}));
+  assertFalse(foo(Object.freeze(['3', '3', '2']), {x:'3'}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(Object.freeze(['3', '3', '3']), {x:'3'}));
+  assertFalse(foo(Object.freeze(['3', '3', '2']), {x:'3'}));
+
+  // Holey
+  // Non-extensible array
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(Object.preventExtensions([, '3', '3', '3']), {x:'3'}));
+  assertFalse(foo(Object.preventExtensions([, '3', '3', '2']), {x:'3'}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(Object.preventExtensions([, '3', '3', '3']), {x:'3'}));
+  assertFalse(foo(Object.preventExtensions([, '3', '3', '2']), {x:'3'}));
+
+  // Sealed array
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(Object.seal([, '3', '3', '3']), {x:'3'}));
+  assertFalse(foo(Object.seal([, '3', '3', '2']), {x:'3'}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(Object.seal([, '3', '3', '3']), {x:'3'}));
+  assertFalse(foo(Object.seal([, '3', '3', '2']), {x:'3'}));
+
+  // Frozen array
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(Object.freeze([, '3', '3', '3']), {x:'3'}));
+  assertFalse(foo(Object.freeze([, '3', '3', '2']), {x:'3'}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(Object.freeze([, '3', '3', '3']), {x:'3'}));
+  assertFalse(foo(Object.freeze([, '3', '3', '2']), {x:'3'}));
+})();
diff --git a/src/v8/test/mjsunit/compiler/array-find.js b/src/v8/test/mjsunit/compiler/array-find.js
new file mode 100644
index 0000000..39404cc
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/array-find.js
@@ -0,0 +1,69 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Basic loop peeling test case with Array.prototype.find().
+(function() {
+  function foo(a, o) {
+    return a.find(x => x === o.x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(3, foo([1, 2, 3], {x:3}));
+  assertEquals(undefined, foo([0, 1, 2], {x:3}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo([1, 2, 3], {x:3}));
+  assertEquals(undefined, foo([0, 1, 2], {x:3}));
+
+  // Packed
+  // Non-extensible
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(3, foo(Object.preventExtensions(['1', 2, 3]), {x:3}));
+  assertEquals(undefined, foo(Object.preventExtensions(['0', 1, 2]), {x:3}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo(Object.preventExtensions(['1', 2, 3]), {x:3}));
+  assertEquals(undefined, foo(Object.preventExtensions(['0', 1, 2]), {x:3}));
+
+  // Sealed
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(3, foo(Object.seal(['1', 2, 3]), {x:3}));
+  assertEquals(undefined, foo(Object.seal(['0', 1, 2]), {x:3}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo(Object.seal(['1', 2, 3]), {x:3}));
+  assertEquals(undefined, foo(Object.seal(['0', 1, 2]), {x:3}));
+
+  // Frozen
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(3, foo(Object.freeze(['1', 2, 3]), {x:3}));
+  assertEquals(undefined, foo(Object.freeze(['0', 1, 2]), {x:3}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo(Object.freeze(['1', 2, 3]), {x:3}));
+  assertEquals(undefined, foo(Object.freeze(['0', 1, 2]), {x:3}));
+
+  // Holey
+  // Non-extensible
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(3, foo(Object.preventExtensions([, '1', 2, 3]), {x:3}));
+  assertEquals(undefined, foo(Object.preventExtensions([, '0', 1, 2]), {x:3}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo(Object.preventExtensions([, '1', 2, 3]), {x:3}));
+  assertEquals(undefined, foo(Object.preventExtensions([, '0', 1, 2]), {x:3}));
+
+  // Sealed
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(3, foo(Object.seal([, '1', 2, 3]), {x:3}));
+  assertEquals(undefined, foo(Object.seal([, '0', 1, 2]), {x:3}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo(Object.seal([, '1', 2, 3]), {x:3}));
+  assertEquals(undefined, foo(Object.seal([, '0', 1, 2]), {x:3}));
+
+  // Frozen
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(3, foo(Object.freeze([, 1, 2, 3]), {x:3}));
+  assertEquals(undefined, foo(Object.freeze([, 0, 1, 2]), {x:3}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo(Object.freeze([, 1, 2, 3]), {x:3}));
+  assertEquals(undefined, foo(Object.freeze([, 0, 1, 2]), {x:3}));
+})();
diff --git a/src/v8/test/mjsunit/compiler/array-findindex.js b/src/v8/test/mjsunit/compiler/array-findindex.js
new file mode 100644
index 0000000..6da94c1
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/array-findindex.js
@@ -0,0 +1,69 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Basic loop peeling test case with Array.prototype.findIndex().
+(function() {
+  function foo(a, o) {
+    return a.findIndex(x => x === o.x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(2, foo([1, 2, 3], {x:3}));
+  assertEquals(-1, foo([0, 1, 2], {x:3}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo([1, 2, 3], {x:3}));
+  assertEquals(-1, foo([0, 1, 2], {x:3}));
+
+  // Packed
+  // Non-extensible
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(2, foo(Object.preventExtensions(['1', 2, 3]), {x:3}));
+  assertEquals(-1, foo(Object.preventExtensions(['0', 1, 2]), {x:3}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(Object.preventExtensions(['1', 2, 3]), {x:3}));
+  assertEquals(-1, foo(Object.preventExtensions(['0', 1, 2]), {x:3}));
+
+  // Sealed
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(2, foo(Object.seal(['1', 2, 3]), {x:3}));
+  assertEquals(-1, foo(Object.seal(['0', 1, 2]), {x:3}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(Object.seal(['1', 2, 3]), {x:3}));
+  assertEquals(-1, foo(Object.seal(['0', 1, 2]), {x:3}));
+
+  // Frozen
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(2, foo(Object.freeze(['1', 2, 3]), {x:3}));
+  assertEquals(-1, foo(Object.freeze(['0', 1, 2]), {x:3}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(Object.freeze(['1', 2, 3]), {x:3}));
+  assertEquals(-1, foo(Object.freeze(['0', 1, 2]), {x:3}));
+
+  // Holey
+  // Non-extensible
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(3, foo(Object.preventExtensions([, '1', 2, 3]), {x:3}));
+  assertEquals(-1, foo(Object.preventExtensions([, '0', 1, 2]), {x:3}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo(Object.preventExtensions([, '1', 2, 3]), {x:3}));
+  assertEquals(-1, foo(Object.preventExtensions([, '0', 1, 2]), {x:3}));
+
+  // Sealed
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(3, foo(Object.seal([, '1', 2, 3]), {x:3}));
+  assertEquals(-1, foo(Object.seal([, '0', 1, 2]), {x:3}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo(Object.seal([, '1', 2, 3]), {x:3}));
+  assertEquals(-1, foo(Object.seal([, '0', 1, 2]), {x:3}));
+
+  // Frozen
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(3, foo(Object.freeze([, '1', 2, 3]), {x:3}));
+  assertEquals(-1, foo(Object.freeze([, '0', 1, 2]), {x:3}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo(Object.freeze([, '1', 2, 3]), {x:3}));
+  assertEquals(-1, foo(Object.freeze([, '0', 1, 2]), {x:3}));
+})();
diff --git a/src/v8/test/mjsunit/compiler/array-is-array.js b/src/v8/test/mjsunit/compiler/array-is-array.js
new file mode 100644
index 0000000..90785d9
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/array-is-array.js
@@ -0,0 +1,197 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Test JSObjectIsArray in JSTypedLowering for the case that the
+// input value is known to be an Array literal.
+(function() {
+  function foo() {
+    return Array.isArray([]);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();
+
+// Test JSObjectIsArray in JSTypedLowering for the case that the
+// input value is known to be a Proxy for an Array literal.
+(function() {
+  function foo() {
+    return Array.isArray(new Proxy([], {}));
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();
+
+// Test JSObjectIsArray in JSTypedLowering for the case that the
+// input value is known to be an Object literal.
+(function() {
+  function foo() {
+    return Array.isArray({});
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo());
+  assertFalse(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo());
+})();
+
+// Test JSObjectIsArray in JSTypedLowering for the case that the
+// input value is known to be a Proxy for an Object literal.
+(function() {
+  function foo() {
+    return Array.isArray(new Proxy({}, {}));
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo());
+  assertFalse(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo());
+})();
+
+// Test JSObjectIsArray in JSTypedLowering for the case that
+// TurboFan doesn't know anything about the input value.
+(function() {
+  function foo(x) {
+    return Array.isArray(x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo({}));
+  assertFalse(foo(new Proxy({}, {})));
+  assertTrue(foo([]));
+  assertTrue(foo(new Proxy([], {})));
+  assertThrows(() => {
+    const {proxy, revoke} = Proxy.revocable([], {});
+    revoke();
+    foo(proxy);
+  }, TypeError);
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo({}));
+  assertFalse(foo(new Proxy({}, {})));
+  assertTrue(foo([]));
+  assertTrue(foo(new Proxy([], {})));
+  assertThrows(() => {
+    const {proxy, revoke} = Proxy.revocable([], {});
+    revoke();
+    foo(proxy);
+  }, TypeError);
+})();
+
+// Test JSObjectIsArray in JSTypedLowering for the case that
+// we pass a revoked proxy and catch the exception locally.
+(function() {
+  function foo(x) {
+    const {proxy, revoke} = Proxy.revocable(x, {});
+    revoke();
+    try {
+      return Array.isArray(proxy);
+    } catch (e) {
+      return e;
+    }
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertInstanceof(foo([]), TypeError);
+  assertInstanceof(foo({}), TypeError);
+  %OptimizeFunctionOnNextCall(foo);
+  assertInstanceof(foo([]), TypeError);
+  assertInstanceof(foo({}), TypeError);
+})();
+
+// Packed
+// Test JSObjectIsArray in JSTypedLowering for the case that the
+// input value is known to be a non-extensible Array literal.
+(function() {
+  function foo() {
+    return Array.isArray(Object.preventExtensions([]));
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();
+
+// Test JSObjectIsArray in JSTypedLowering for the case that the
+// input value is known to be a sealed Array literal.
+(function() {
+  function foo() {
+    return Array.isArray(Object.seal([]));
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();
+
+// Test JSObjectIsArray in JSTypedLowering for the case that the
+// input value is known to be a frozen Array literal.
+(function() {
+  function foo() {
+    return Array.isArray(Object.freeze([]));
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();
+
+// Holey
+// Test JSObjectIsArray in JSTypedLowering for the case that the
+// input value is known to be a non-extensible Array literal.
+(function() {
+  function foo() {
+    return Array.isArray(Object.preventExtensions([,]));
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();
+
+// Test JSObjectIsArray in JSTypedLowering for the case that the
+// input value is known to be a sealed Array literal.
+(function() {
+  function foo() {
+    return Array.isArray(Object.seal([,]));
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();
+
+// Test JSObjectIsArray in JSTypedLowering for the case that the
+// input value is known to be a frozen Array literal.
+(function() {
+  function foo() {
+    return Array.isArray(Object.freeze([,]));
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();
diff --git a/src/v8/test/mjsunit/compiler/array-length.js b/src/v8/test/mjsunit/compiler/array-length.js
index 462a1e7..bc1ccf3 100644
--- a/src/v8/test/mjsunit/compiler/array-length.js
+++ b/src/v8/test/mjsunit/compiler/array-length.js
@@ -38,12 +38,54 @@
 var a0 = [];
 var a2 = [1,2];
 var a5 = [1,2,3,4,5];
-for (var i = 0; i < 5; i++) Test(a0, a2, a5);
-%OptimizeFunctionOnNextCall(ArrayLength);
-%OptimizeFunctionOnNextCall(Test);
-Test(a0, a2, a5);
-assertEquals("undefined", typeof(ArrayLength(0)));
-for (var i = 0; i < 5; i++) Test(a0, a2, a5);
-%OptimizeFunctionOnNextCall(Test);
-Test(a0, a2, a5);
-assertEquals(4, ArrayLength("hest"));
+
+function MainTest() {
+  %PrepareFunctionForOptimization(ArrayLength);
+  for (var i = 0; i < 5; i++) Test(a0, a2, a5);
+  %OptimizeFunctionOnNextCall(ArrayLength);
+  Test(a0, a2, a5);
+  %PrepareFunctionForOptimization(Test);
+  %OptimizeFunctionOnNextCall(Test);
+  Test(a0, a2, a5);
+  assertEquals("undefined", typeof(ArrayLength(0)));
+  %PrepareFunctionForOptimization(Test);
+  for (var i = 0; i < 5; i++) Test(a0, a2, a5);
+  %OptimizeFunctionOnNextCall(Test);
+  Test(a0, a2, a5);
+  assertEquals(4, ArrayLength("hest"));
+}
+MainTest();
+
+// Packed
+// Non-extensible, sealed, frozen
+a0 = Object.preventExtensions([]);
+a2 = Object.seal([1,'2']);
+a5 = Object.freeze([1,2,'3',4,5]);
+MainTest();
+
+a0 = Object.seal([]);
+a2 = Object.freeze([1,'2']);
+a5 = Object.preventExtensions([1,2,'3',4,5]);
+MainTest();
+
+a0 = Object.freeze([]);
+a2 = Object.preventExtensions([1,'2']);
+a5 = Object.seal([1,2,'3',4,5]);
+MainTest();
+
+// Holey
+// Non-extensible, sealed, frozen
+a0 = Object.preventExtensions([]);
+a2 = Object.seal([,'2']);
+a5 = Object.freeze([,2,'3',4,5]);
+MainTest();
+
+a0 = Object.seal([]);
+a2 = Object.freeze([,'2']);
+a5 = Object.preventExtensions([,2,'3',4,5]);
+MainTest();
+
+a0 = Object.freeze([]);
+a2 = Object.preventExtensions([,'2']);
+a5 = Object.seal([,2,3,4,5]);
+MainTest();
diff --git a/src/v8/test/mjsunit/compiler/array-multiple-receiver-maps.js b/src/v8/test/mjsunit/compiler/array-multiple-receiver-maps.js
index 2ef0cc3..1a50b8c 100644
--- a/src/v8/test/mjsunit/compiler/array-multiple-receiver-maps.js
+++ b/src/v8/test/mjsunit/compiler/array-multiple-receiver-maps.js
@@ -3,9 +3,12 @@
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax --opt --no-always-opt
+// Flags: --no-stress-background-compile --trace-opt --trace-deopt
 
-function runTest(f, message, mkICTraining, deoptArg) {
-  function test(f, message, ictraining, deoptArg) {
+let id = 0;
+
+function runTest(f, message, mkICTraining, deoptArg, speculationCheck) {
+  function test(f, message, ictraining, deoptArg, speculationCheck) {
     // Train the call ic to the maps.
     let t = ictraining;
 
@@ -17,6 +20,7 @@
     let t2 = t();
     let t3 = t();
 
+    %PrepareFunctionForOptimization(f);
     for (let a of t1) {
       f(a.arr, () => a.el);
     }
@@ -29,21 +33,31 @@
       // Make sure the optimized function can handle
       // all trained maps without deopt.
       for (let a of t3) {
+        message += " for args " + JSON.stringify(a) + " should have been optimized";
         f(a.arr, () => a.el);
-        message += " for args " + JSON.stringify(a);
-        assertOptimized(f, undefined, message + " should have been optimized");
+        assertOptimized(f, undefined, message);
       }
     } else {
       // Trigger deopt, causing no-speculation bit to be set.
       let a1 = deoptArg;
       let a2 = deoptArg;
+      let a3 = deoptArg;
       message += " for args " + JSON.stringify(a1);
-      f(a1.arr, () => a1.el);
-      assertUnoptimized(f, undefined, message + " should have been unoptimized");
+      message_unoptimized = message + " should have been unoptimized"
+      message_optimized = message + " should have been optimized"
+      f(a1.darr, () => a1.del);
+      assertUnoptimized(f, undefined, message_unoptimized);
+      if (speculationCheck) {
+        %PrepareFunctionForOptimization(f);
+        %OptimizeFunctionOnNextCall(f);
+        f(a2.darr, () => a2.del);
+        assertUnoptimized(f, undefined, message_unoptimized);
+      }
+      %PrepareFunctionForOptimization(f);
       %OptimizeFunctionOnNextCall(f);
       // No speculation should protect against further deopts.
-      f(a2.arr, () => a2.el);
-      assertOptimized(f, undefined,  message + " should have been optimized");
+      f(a3.darr, () => a3.del);
+      assertOptimized(f, undefined,  message_optimized);
     }
   }
 
@@ -56,17 +70,27 @@
   // Substitute parameters.
   testString = testString.replace(new RegExp("ictraining", 'g'), mkICTraining.toString());
   testString = testString.replace(new RegExp("deoptArg", 'g'),
-    deoptArg ? JSON.stringify(deoptArg) : "undefined");
+    deoptArg ? JSON.stringify(deoptArg).replace(/"/g,'') : "undefined");
+  testString = testString.replace(new RegExp("speculationCheck", 'g'),
+    speculationCheck ? JSON.stringify(deoptArg).replace(/"/g,'') : "undefined");
+
+  // Make field names unique to avoid learning of types.
+  id = id + 1;
+  testString = testString.replace(/[.]el/g, '.el' + id);
+  testString = testString.replace(/el:/g, 'el' + id + ':');
+  testString = testString.replace(/[.]arr/g, '.arr' + id);
+  testString = testString.replace(/arr:/g, 'arr' + id + ':');
+  testString = testString.replace(/[.]del/g, '.del' + id);
+  testString = testString.replace(/[.]darr/g, '.darr' + id);
 
   var modTest = new Function("message", testString);
-  //print(modTest);
   modTest(message);
 }
 
 let checks = {
   smiReceiver:
     { mkTrainingArguments : () => [{arr:[1], el:3}],
-      deoptingArguments   : [{arr:[0.1], el:1}, {arr:[{}], el:1}]
+      deoptingArguments   : [{darr:[0.1], del:1}, {darr:[{}], del:1}]
     },
   objectReceiver:
     { mkTrainingArguments : () => [{arr:[{}], el:0.1}],
@@ -74,30 +98,53 @@
     },
   multipleSmiReceivers:
     { mkTrainingArguments : () => { let b = [1]; b.x=3; return [{arr:[1], el:3}, {arr:b, el:3}] },
-      deoptingArguments : [{arr:[0.1], el:1}, {arr:[{}], el:1}]
+      deoptingArguments : [{darr:[0.1], del:1}, {darr:[{}], del:1}]
     },
   multipleSmiReceiversPackedUnpacked:
     { mkTrainingArguments : () => { let b = [1]; b[100] = 3; return [{arr:[1], el:3}, {arr:b, el:3}] },
-      deoptingArguments : [{arr:[0.1], el:1}, {arr:[{}], el:1}]
+      deoptingArguments : [{darr:[0.1], del:1}, {darr:[{}], del:1}]
     },
   multipleDoubleReceivers:
     { mkTrainingArguments : () => { let b = [0.1]; b.x=0.3; return [{arr:[0.1], el:0.3}, {arr:b, el:0.3}] },
-      deoptingArguments : [{arr:[{}], el:true}, {arr:[1], el:true}]
+      deoptingArguments : [{darr:[{}], del:true}, {darr:[1], del: 1}]
     },
   multipleDoubleReceiversPackedUnpacked:
     { mkTrainingArguments : () => { let b = [0.1]; b[100] = 0.3; return [{arr:[0.1], el:0.3}, {arr:b, el:0.3}] },
-      deoptingArguments : [{arr:[{}], el:true}, {arr:[1], el:true}]
+      deoptingArguments : [{darr:[{}], del:true}, {darr:[1], del: 1}]
     },
   multipleMixedReceivers:
-    { mkTrainingArguments : () => { let b = [0.1]; b.x=0.3; return [{arr:[1], el:0.3}, {arr:[{}], el:true}, {arr:b, el:0.3}] },
+    { mkTrainingArguments : () => { let b = [0.1]; b.x=0.3; return [{arr:[1], el:1}, {arr:[{}], el:true}, {arr:b, el:0.3}] },
       deoptingArguments : []
     },
   multipleMixedReceiversPackedUnpacked:
-    { mkTrainingArguments : () => { let b = [0.1]; b[100] = 0.3; return [{arr:[1], el:0.3}, {arr:[{}], el:true}, {arr:b, el:0.3}] },
+    { mkTrainingArguments : () => { let b = [0.1]; b[100] = 0.3; return [{arr:[1], el:1}, {arr:[{}], el:true}, {arr:b, el:0.3}] },
       deoptingArguments : []
     },
 };
 
+let no_speculation_checks = {
+  smiReceiver:
+    { mkTrainingArguments : () => [{arr:[1], el:3}],
+      deoptingArguments   : [{darr:[0.1], del:true}]
+    },
+  multipleSmiReceivers:
+    { mkTrainingArguments : () => { let b = [1]; b.x=3; return [{arr:[1], el:3}, {arr:[1], el:3}] },
+      deoptingArguments : [{darr:[0.1], del:true}]
+    },
+  multipleSmiReceiversPackedUnpacked:
+    { mkTrainingArguments : () => { let b = [1]; b[100] = 3; return [{arr:[1], el:3}, {arr:b, el:3}] },
+      deoptingArguments : [{darr:[0.1], del:true}]
+    },
+  multipleDoubleReceivers:
+    { mkTrainingArguments : () => { let b = [0.1]; b.x=0.3; return [{arr:[0.1], el:0.3}, {arr:b, el:0.3}] },
+      deoptingArguments : [{darr:[1], del:true}]
+    },
+  multipleDoubleReceiversPackedUnpacked:
+    { mkTrainingArguments : () => { let b = [0.1]; b[100] = 0.3; return [{arr:[0.1], el:0.3}, {arr:b, el:0.3}] },
+      deoptingArguments : [{darr:[1], del:true}]
+    },
+};
+
 const functions = {
   push_reliable: (a,g) => { let b = g(); return a.push(2, b); },
   push_unreliable: (a,g) => { return a.push(2, g()); },
@@ -107,15 +154,34 @@
   shift_unreliable: (a,g) => { return a.shift(2, g()); }
 }
 
+const push_functions = {
+  push_reliable: (a,g) => { let b = g(); return a.push(2, b); },
+  push_unreliable: (a,g) => { return a.push(2, g()); },
+}
+
 Object.keys(checks).forEach(
   key => {
     let check = checks[key];
 
     for (fnc in functions) {
-      runTest(functions[fnc], "test-reliable-" + key, check.mkTrainingArguments);
+      runTest(functions[fnc], "test-" + fnc + "-" + key, check.mkTrainingArguments);
       // Test each deopting arg separately.
       for (let deoptArg of check.deoptingArguments) {
-        runTest(functions[fnc], "testDeopt-reliable-" + key, check.mkTrainingArguments, deoptArg);
+        runTest(functions[fnc], "testDeopt-" + fnc + "-" + key, check.mkTrainingArguments, deoptArg);
+      }
+    }
+  }
+);
+
+Object.keys(no_speculation_checks).forEach(
+  key => {
+    let check = no_speculation_checks[key];
+
+    for (fnc in push_functions) {
+      runTest(functions[fnc], "test-spec-check-" + fnc + "-" + key, check.mkTrainingArguments);
+      // Test each deopting arg separately.
+      for (let deoptArg of check.deoptingArguments) {
+        runTest(functions[fnc], "testDeopt-spec-check-" + fnc + "-" + key, check.mkTrainingArguments, deoptArg, true);
       }
     }
   }
diff --git a/src/v8/test/mjsunit/compiler/array-push-1.js b/src/v8/test/mjsunit/compiler/array-push-1.js
index 58afd6f..3851745 100644
--- a/src/v8/test/mjsunit/compiler/array-push-1.js
+++ b/src/v8/test/mjsunit/compiler/array-push-1.js
@@ -10,6 +10,7 @@
     return a.push();
   }
 
+  %PrepareFunctionForOptimization(push0);
   assertEquals(0, push0([]));
   assertEquals(1, push0([1]));
   %OptimizeFunctionOnNextCall(push0);
@@ -19,6 +20,7 @@
     return a.push(1);
   }
 
+  %PrepareFunctionForOptimization(push1);
   assertEquals(1, push1([]));
   assertEquals(2, push1([1]));
   %OptimizeFunctionOnNextCall(push1);
@@ -28,6 +30,7 @@
     return a.push(1, 2);
   }
 
+  %PrepareFunctionForOptimization(push2);
   assertEquals(2, push2([]));
   assertEquals(3, push2([1]));
   %OptimizeFunctionOnNextCall(push2);
@@ -37,6 +40,7 @@
     return a.push(1, 2, 3);
   }
 
+  %PrepareFunctionForOptimization(push3);
   assertEquals(3, push3([]));
   assertEquals(4, push3([1]));
   %OptimizeFunctionOnNextCall(push3);
@@ -49,6 +53,7 @@
     return a.push();
   }
 
+  %PrepareFunctionForOptimization(push0);
   assertEquals(1, push0(new Array(1)));
   assertEquals(2, push0(new Array(2)));
   %OptimizeFunctionOnNextCall(push0);
@@ -58,6 +63,7 @@
     return a.push(1);
   }
 
+  %PrepareFunctionForOptimization(push1);
   assertEquals(2, push1(new Array(1)));
   assertEquals(3, push1(new Array(2)));
   %OptimizeFunctionOnNextCall(push1);
@@ -67,6 +73,7 @@
     return a.push(1, 2);
   }
 
+  %PrepareFunctionForOptimization(push2);
   assertEquals(3, push2(new Array(1)));
   assertEquals(4, push2(new Array(2)));
   %OptimizeFunctionOnNextCall(push2);
@@ -76,6 +83,7 @@
     return a.push(1, 2, 3);
   }
 
+  %PrepareFunctionForOptimization(push3);
   assertEquals(4, push3(new Array(1)));
   assertEquals(5, push3(new Array(2)));
   %OptimizeFunctionOnNextCall(push3);
@@ -88,6 +96,7 @@
     return a.push();
   }
 
+  %PrepareFunctionForOptimization(push0);
   assertEquals(1, push0([1.1]));
   assertEquals(2, push0([1.1, 2.2]));
   %OptimizeFunctionOnNextCall(push0);
@@ -97,6 +106,7 @@
     return a.push(1.1);
   }
 
+  %PrepareFunctionForOptimization(push1);
   assertEquals(2, push1([1.1]));
   assertEquals(3, push1([1.1, 2.2]));
   %OptimizeFunctionOnNextCall(push1);
@@ -106,6 +116,7 @@
     return a.push(1.1, 2.2);
   }
 
+  %PrepareFunctionForOptimization(push2);
   assertEquals(3, push2([1.1]));
   assertEquals(4, push2([1.1, 2.2]));
   %OptimizeFunctionOnNextCall(push2);
@@ -115,6 +126,7 @@
     return a.push(1.1, 2.2, 3.3);
   }
 
+  %PrepareFunctionForOptimization(push3);
   assertEquals(4, push3([1.1]));
   assertEquals(5, push3([1.1, 2.2]));
   %OptimizeFunctionOnNextCall(push3);
@@ -127,6 +139,7 @@
     return a.push();
   }
 
+  %PrepareFunctionForOptimization(push0);
   assertEquals(2, push0([, 1.1]));
   assertEquals(3, push0([, 1.1, 2.2]));
   %OptimizeFunctionOnNextCall(push0);
@@ -136,6 +149,7 @@
     return a.push(1.1);
   }
 
+  %PrepareFunctionForOptimization(push1);
   assertEquals(3, push1([, 1.1]));
   assertEquals(4, push1([, 1.1, 2.2]));
   %OptimizeFunctionOnNextCall(push1);
@@ -145,6 +159,7 @@
     return a.push(1.1, 2.2);
   }
 
+  %PrepareFunctionForOptimization(push2);
   assertEquals(4, push2([, 1.1]));
   assertEquals(5, push2([, 1.1, 2.2]));
   %OptimizeFunctionOnNextCall(push2);
@@ -154,6 +169,7 @@
     return a.push(1.1, 2.2, 3.3);
   }
 
+  %PrepareFunctionForOptimization(push3);
   assertEquals(5, push3([, 1.1]));
   assertEquals(6, push3([, 1.1, 2.2]));
   %OptimizeFunctionOnNextCall(push3);
@@ -166,6 +182,7 @@
     return a.push();
   }
 
+  %PrepareFunctionForOptimization(push0);
   assertEquals(1, push0(['1']));
   assertEquals(2, push0(['1', '2']));
   %OptimizeFunctionOnNextCall(push0);
@@ -175,6 +192,7 @@
     return a.push('1');
   }
 
+  %PrepareFunctionForOptimization(push1);
   assertEquals(2, push1(['1']));
   assertEquals(3, push1(['1', '2']));
   %OptimizeFunctionOnNextCall(push1);
@@ -184,6 +202,7 @@
     return a.push('1', '2');
   }
 
+  %PrepareFunctionForOptimization(push2);
   assertEquals(3, push2(['1']));
   assertEquals(4, push2(['1', '2']));
   %OptimizeFunctionOnNextCall(push2);
@@ -193,6 +212,7 @@
     return a.push('1', '2', '3');
   }
 
+  %PrepareFunctionForOptimization(push3);
   assertEquals(4, push3(['1']));
   assertEquals(5, push3(['1', '2']));
   %OptimizeFunctionOnNextCall(push3);
@@ -205,6 +225,7 @@
     return a.push();
   }
 
+  %PrepareFunctionForOptimization(push0);
   assertEquals(2, push0([, '1']));
   assertEquals(3, push0([, '1', '2']));
   %OptimizeFunctionOnNextCall(push0);
@@ -214,6 +235,7 @@
     return a.push('1');
   }
 
+  %PrepareFunctionForOptimization(push1);
   assertEquals(3, push1([, '1']));
   assertEquals(4, push1([, '1', '2']));
   %OptimizeFunctionOnNextCall(push1);
@@ -223,6 +245,7 @@
     return a.push('1', '2');
   }
 
+  %PrepareFunctionForOptimization(push2);
   assertEquals(4, push2([, '1']));
   assertEquals(5, push2([, '1', '2']));
   %OptimizeFunctionOnNextCall(push2);
@@ -232,6 +255,7 @@
     return a.push('1', '2', '3');
   }
 
+  %PrepareFunctionForOptimization(push3);
   assertEquals(5, push3([, '1']));
   assertEquals(6, push3([, '1', '2']));
   %OptimizeFunctionOnNextCall(push3);
diff --git a/src/v8/test/mjsunit/compiler/array-push-2.js b/src/v8/test/mjsunit/compiler/array-push-2.js
index cb18d71..a99e1d0 100644
--- a/src/v8/test/mjsunit/compiler/array-push-2.js
+++ b/src/v8/test/mjsunit/compiler/array-push-2.js
@@ -8,6 +8,7 @@
 (function() {
   const a = [];
   const foo = (x, y) => a.push(x, y);
+  %PrepareFunctionForOptimization(foo);
   foo(1, 2);
   foo(3, 4);
   %OptimizeFunctionOnNextCall(foo);
@@ -17,6 +18,7 @@
 (function() {
   const a = [];
   const foo = (x, y) => a.push(x, y);
+  %PrepareFunctionForOptimization(foo);
   foo(1, 2);
   foo(3, 4);
   %OptimizeFunctionOnNextCall(foo);
@@ -28,6 +30,7 @@
 (function() {
   const a = [];
   const foo = (x, y) => a.push(x, y);
+  %PrepareFunctionForOptimization(foo);
   foo(1, 2);
   foo(3, 4);
   %OptimizeFunctionOnNextCall(foo);
@@ -37,6 +40,7 @@
 (function() {
   const a = [];
   const foo = (x, y) => a.push(x, y);
+  %PrepareFunctionForOptimization(foo);
   foo(1, 2);
   foo(3, 4);
   %OptimizeFunctionOnNextCall(foo);
@@ -48,6 +52,7 @@
 (function() {
   const a = [0.5];
   const foo = (x, y) => a.push(x, y);
+  %PrepareFunctionForOptimization(foo);
   foo(1, 2);
   foo(3, 4);
   %OptimizeFunctionOnNextCall(foo);
@@ -57,6 +62,7 @@
 (function() {
   const a = [0.5];
   const foo = (x, y) => a.push(x, y);
+  %PrepareFunctionForOptimization(foo);
   foo(1, 2);
   foo(3, 4);
   %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/array-push-3.js b/src/v8/test/mjsunit/compiler/array-push-3.js
index f648eb9..3fa59d1 100644
--- a/src/v8/test/mjsunit/compiler/array-push-3.js
+++ b/src/v8/test/mjsunit/compiler/array-push-3.js
@@ -9,6 +9,7 @@
   const a = [];
   const bar = x => { a.push(x); return x; };
   const foo = x => a.push(bar(x), bar(x));
+  %PrepareFunctionForOptimization(foo);
   foo(1);
   foo(2);
   %OptimizeFunctionOnNextCall(foo);
@@ -22,6 +23,7 @@
   const a = [];
   const bar = x => { a.push(y); return x; }
   const foo = x => a.push(bar(x), bar(x));
+  %PrepareFunctionForOptimization(foo);
   foo(1);
   y = 2;
   foo(2);
@@ -38,6 +40,7 @@
   const a = [0.5];
   const bar = x => { a.push(y); return x; }
   const foo = x => a.push(bar(x), bar(x));
+  %PrepareFunctionForOptimization(foo);
   foo(1);
   y = 2;
   foo(2);
diff --git a/src/v8/test/mjsunit/compiler/array-slice-clone.js b/src/v8/test/mjsunit/compiler/array-slice-clone.js
new file mode 100644
index 0000000..fc002da
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/array-slice-clone.js
@@ -0,0 +1,482 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+
+// Test CloneFastJSArray inserted by JSCallReducer for Array.prototype.slice.
+// CloneFastJSArray produces COW arrays if the original array is COW.
+
+// Trigger JSCallReducer on slice() and slice(0)
+(function() {
+  const arr = [1,2,3,4,5];
+
+  function slice() {
+    return arr.slice();
+  }
+
+  function slice0() {
+    return arr.slice(0);
+  }
+
+  %PrepareFunctionForOptimization(slice0);
+  %PrepareFunctionForOptimization(slice);
+
+  assertEquals(arr, slice());
+  assertFalse(arr === slice());
+  assertEquals(slice(), slice0());
+  assertEquals(slice0(), slice());
+
+  %OptimizeFunctionOnNextCall(slice0);
+  assertEquals(slice(), slice0());
+  %OptimizeFunctionOnNextCall(slice);
+
+  assertEquals(slice(), slice0());
+  assertOptimized(slice); assertOptimized(slice0);
+})();
+
+// This will cause deopt of slice by a CheckMap installed by
+// JSNativeContextSpecialization::ReduceNamedAccess
+(function() {
+  const arr = [1,2,3,4,5];
+
+  function slice() {
+    return arr.slice();
+  }
+
+  %PrepareFunctionForOptimization(slice);
+
+  assertEquals(arr, slice());
+  assertEquals(slice(), arr);
+
+  %OptimizeFunctionOnNextCall(slice);
+  slice();
+
+  // Trigger deopt here
+  arr.push(7.2);
+  assertEquals(slice()[5], 7.2);
+})();
+
+// There should not be a deopt cycle.
+(function() {
+  const arr = [1,2,3,4,5];
+
+  function slice() {
+    return arr.slice();
+  }
+
+  %PrepareFunctionForOptimization(slice);
+
+  assertEquals(arr, slice());
+  assertEquals(slice(), arr);
+
+  %OptimizeFunctionOnNextCall(slice);
+  // Trigger opt
+  assertEquals(slice(), arr);
+
+  // Trigger deopt by CheckMap from JSNativeContextSpecialization
+  arr.push(7.2);
+  slice();
+
+  %PrepareFunctionForOptimization(slice);
+  %OptimizeFunctionOnNextCall(slice);
+  // Trigger opt again
+  slice();
+
+  // Should not deopt again
+  arr.push(8.2);
+  slice();
+  assertOptimized(slice);
+})();
+
+// JSCallReducer will not reduce because the species has been modified
+(function() {
+  const array = [3,4,5];
+
+  function slice(){
+    return array.slice();
+  }
+
+  class MyArray extends Array {};
+  array.constructor = MyArray;
+
+  %PrepareFunctionForOptimization(slice);
+
+  slice(); slice();
+
+  %OptimizeFunctionOnNextCall(slice);
+  var narr = slice();
+  assertInstanceof(narr, MyArray);
+})();
+
+(function() {
+  const array = [3,4,5];
+
+  function slice(){
+    return array.slice();
+  }
+
+  %PrepareFunctionForOptimization(slice);
+
+  slice(); slice();
+
+  %OptimizeFunctionOnNextCall(slice);
+
+  slice();
+
+  class MyArray extends Array {};
+  array.constructor = MyArray;
+  // deopt
+  var narr = slice();
+  // if not deopt, narr will be instanceof Array
+  assertTrue(narr instanceof MyArray);
+})();
+
+// JSCallReducer adds check for UnreliableReceiverMaps
+(function() {
+  const arr = [1,2,3,4,5];
+
+  function slice() {
+    return arr.slice();
+  }
+
+  %PrepareFunctionForOptimization(slice);
+
+  slice(); slice();
+  arr.foo = 6.2;
+
+  %OptimizeFunctionOnNextCall(slice);
+  // JSCallReducer will add check for UnreliableReceiverMaps
+  slice();
+
+  // Trigger deopt because of DependOnStableMaps
+  // installed by JSNativeContextSpecialization,
+  // but not the check installed by ReduceArrayPrototypeSlice itself
+  arr.bar = 7.2;
+
+  let narr = slice();
+  assertEquals(arr, narr);
+  assertEquals(narr.foo, undefined);
+  assertEquals(narr.bar, undefined);
+})();
+
+// Multiple maps
+(function() {
+  const iarr = [1,2,3];
+  const darr = [2.1, 3.3, 0.2];
+
+  function slice(arr) {
+    return arr.slice();
+  }
+
+  %PrepareFunctionForOptimization(slice);
+
+  slice(iarr); slice(darr);
+  slice(iarr); slice(darr);
+
+  %OptimizeFunctionOnNextCall(slice);
+  // The optimization works for both maps
+  assertEquals(iarr, slice(iarr));
+  assertEquals(darr, slice(darr));
+  assertOptimized(slice);
+})();
+
+// Tests for the branch of CanInlineArrayIteratingBuiltin
+
+// JSCallReducer will not reduce to CloneFastJSArray
+// if array's prototype is not JS_ARRAY_TYPE
+(function () {
+  class MyArray extends Array {
+    constructor() {
+      super();
+      this[6]= 6;
+    }
+  }
+  let array = new MyArray(3, 5, 4);
+
+  function slice() {
+    return array.slice();
+  }
+
+  %PrepareFunctionForOptimization(slice);
+
+  assertEquals(slice(),array);
+  slice();
+
+  %OptimizeFunctionOnNextCall(slice);
+  let narr = slice();
+  // here, slice supposes to call MyArray's constructor.
+  // If we optimize with CloneFastJSArray, Array's constructor is called instead.
+  assertEquals(narr[6], 6);
+  assertTrue(narr instanceof MyArray);
+})();
+
+// JSCallReducer will not reduce to CloneFastJSArray
+// if array's instance type is not JS_ARRAY_TYPE.
+// CloneFastJSArray does not work with non JS_ARRAY_TYPE.
+// Check : receiver_map->instance_type() == JS_ARRAY_TYPE
+(function () {
+  var x = {"0" : 0, "2": 2} ;
+  x.__proto__ = Array.prototype;
+
+  function slice() {
+    return x.slice();
+  }
+
+  %PrepareFunctionForOptimization(slice);
+
+  slice(); slice();
+
+  %OptimizeFunctionOnNextCall(slice);
+  assertEquals(slice(), []);
+})();
+
+// JSCallReducer will not reduce to CloneFastJSArray
+// since array is not Fast Elements Kind
+// Check : IsFastElementsKind(receiver_map->elements_kind())
+(function () {
+  var array = [3, 4, 5];
+
+  function slice() {
+    return array.slice();
+  }
+
+  %PrepareFunctionForOptimization(slice);
+
+  assertEquals(slice(),array);
+  slice();
+
+  // a sparse array switches to Dictionary Elements
+  array[9999] = 0;
+  %OptimizeFunctionOnNextCall(slice);
+  var narr = slice();
+  assertEquals(narr, array);
+})();
+
+(function () {
+  var array = [3, 4, 5];
+
+  function slice() {
+    return array.slice();
+  }
+
+  %PrepareFunctionForOptimization(slice);
+
+  assertEquals(slice(),array);
+  slice();
+
+  %OptimizeFunctionOnNextCall(slice);
+  slice();
+
+  // a sparse array switches to Dictionary Elements
+  array[9999] = 0;
+  // trigger deopt because map changes
+  assertEquals(slice(),array);
+})();
+
+// JSCallReducer will not reduce to CloneFastJSArray
+// if array is used as a prototype and has unstable map
+(function () {
+  var array = [3, 5, 4];
+
+  function slice(arr) {
+    return arr.slice();
+  }
+
+  %PrepareFunctionForOptimization(slice);
+
+  // make array's map is_prototype_map()
+  var x = {__proto__ : array};
+
+  assertEquals(slice(array),array);
+  slice(array);
+
+  // make array's map unstable
+  array.push(6.3);
+  slice(array);
+
+  %OptimizeFunctionOnNextCall(slice);
+
+  assertEquals(slice(array),array);
+})();
+
+// JSCallReducer will not reduce to CloneFastJSArray
+// if the Array prototype got some elements.
+// Check: isolate->IsNoElementsProtectorIntact()
+(function () {
+  var array = [, 6, 6];
+
+  function slice() {
+    return array.slice();
+  }
+
+  %PrepareFunctionForOptimization(slice);
+
+  assertEquals(slice(),array);
+  slice();
+
+  array.__proto__.push(6);
+
+  %OptimizeFunctionOnNextCall(slice);
+
+  // if we optimized, we would get [ , 6, 6]
+  // here, slice copies elements from both the object and the prototype
+  let narr = slice();
+  assertNotEquals(Object.getOwnPropertyDescriptor(narr,0), undefined);
+  assertEquals(narr, [6, 6, 6]);
+})();
+
+(function () {
+  var array = [, 6, 6];
+
+  function slice() {
+    return array.slice();
+  }
+
+  %PrepareFunctionForOptimization(slice);
+
+  assertEquals(slice(),array);
+  slice();
+
+  %OptimizeFunctionOnNextCall(slice);
+  slice();
+
+  // Deopt
+  array.__proto__.push(6);
+  let narr = slice();
+  assertNotEquals(Object.getOwnPropertyDescriptor(narr, 0), undefined);
+  assertEquals(narr[0], 6);
+})();
+
+// JSCallReducer will not reduce to CloneFastJSArray
+// if the Array prototype is not original
+// Check: isolate->IsAnyInitialArrayPrototype(receiver_prototype)
+(function () {
+  var array = [6, , 6];
+
+  function slice() {
+    return array.slice();
+  }
+
+  %PrepareFunctionForOptimization(slice);
+
+  assertEquals(slice(),array);
+  slice();
+
+  // change the prototype
+  array.__proto__ = [ , 6, ];
+
+  %OptimizeFunctionOnNextCall(slice);
+  let narr = slice();
+  // if optimized, we would get [6, , 6]
+  assertNotEquals(Object.getOwnPropertyDescriptor(narr, 1), undefined);
+  assertEquals(narr, [6,6,6]);
+})();
+
+(function () {
+  var array = [6, ,6];
+
+  function slice() {
+    return array.slice();
+  }
+
+  %PrepareFunctionForOptimization(slice);
+
+  assertEquals(slice(),array);
+  slice();
+
+  %OptimizeFunctionOnNextCall(slice);
+  slice();
+
+  // change the prototype
+  array.__proto__ = [,6,];
+  // deopt because of map changed
+  let narr = slice();
+
+  // if optimized, we would get [6, , 6]
+  assertNotEquals(Object.getOwnPropertyDescriptor(narr, 1), undefined);
+  assertEquals(narr, [6,6,6]);
+})();
+
+// Packed
+// Trigger JSCallReducer on slice() and slice(0)
+(function() {
+  // Non-extensible:
+  var arr = Object.preventExtensions([1,2,'a',4,5]);
+
+  function slice() {
+    return arr.slice();
+  }
+
+  function slice0() {
+    return arr.slice(0);
+  }
+
+  function test() {
+    %PrepareFunctionForOptimization(slice0);
+    %PrepareFunctionForOptimization(slice);
+
+    assertEquals(arr, slice());
+    assertFalse(arr === slice());
+    assertEquals(slice(), slice0());
+    assertEquals(slice0(), slice());
+
+    %OptimizeFunctionOnNextCall(slice0);
+    assertEquals(slice(), slice0());
+    %OptimizeFunctionOnNextCall(slice);
+
+    assertEquals(slice(), slice0());
+    assertOptimized(slice); assertOptimized(slice0);
+  }
+  test();
+
+  // Sealed
+  arr = Object.seal([1,2,'a',4,5]);
+  test();
+
+  // Frozen
+  arr = Object.freeze([1,2,'a',4,5]);
+  test();
+})();
+
+// Holey
+// Trigger JSCallReducer on slice() and slice(0)
+(function() {
+  // Non-extensible:
+  var arr = Object.preventExtensions([,1,2,'a',4,5]);
+
+  function slice() {
+    return arr.slice();
+  }
+
+  function slice0() {
+    return arr.slice(0);
+  }
+
+  function test() {
+    %PrepareFunctionForOptimization(slice0);
+    %PrepareFunctionForOptimization(slice);
+    assertEquals(arr, slice());
+    assertFalse(arr === slice());
+    assertEquals(slice(), slice0());
+    assertEquals(slice0(), slice());
+
+    %OptimizeFunctionOnNextCall(slice0);
+    assertEquals(slice(), slice0());
+    %OptimizeFunctionOnNextCall(slice);
+
+    assertEquals(slice(), slice0());
+    assertOptimized(slice0);
+    assertOptimized(slice);
+  }
+  test();
+
+  // Sealed
+  arr = Object.seal([,1,2,'a',4,5]);
+  test();
+
+  // Frozen
+  arr = Object.freeze([,1,2,'a',4,5]);
+  test();
+})();
diff --git a/src/v8/test/mjsunit/compiler/array-some.js b/src/v8/test/mjsunit/compiler/array-some.js
new file mode 100644
index 0000000..5411b17
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/array-some.js
@@ -0,0 +1,69 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Basic loop peeling test case with Array.prototype.some().
+(function() {
+  function foo(a, o) {
+    return a.some(x => x === o.x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo([1, 2, 3], {x:3}));
+  assertFalse(foo([0, 1, 2], {x:3}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo([1, 2, 3], {x:3}));
+  assertFalse(foo([0, 1, 2], {x:3}));
+
+  // Packed
+  // Non-extensible
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(Object.preventExtensions([1, 2, '3']), {x:'3'}));
+  assertFalse(foo(Object.preventExtensions([0, 1, '2']), {x:'3'}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(Object.preventExtensions([1, 2, '3']), {x:'3'}));
+  assertFalse(foo(Object.preventExtensions([0, 1, '2']), {x:'3'}));
+
+  // Sealed
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(Object.seal([1, 2, '3']), {x:'3'}));
+  assertFalse(foo(Object.seal([0, 1, '2']), {x:'3'}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(Object.seal([1, 2, '3']), {x:'3'}));
+  assertFalse(foo(Object.seal([0, 1, '2']), {x:'3'}));
+
+  // Frozen
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(Object.freeze([1, 2, '3']), {x:'3'}));
+  assertFalse(foo(Object.freeze([0, 1, '2']), {x:'3'}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(Object.freeze([1, 2, '3']), {x:'3'}));
+  assertFalse(foo(Object.freeze([0, 1, '2']), {x:'3'}));
+
+  // Holey
+  // Non-extensible
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(Object.preventExtensions([, 1, 2, '3']), {x:'3'}));
+  assertFalse(foo(Object.preventExtensions([, 0, 1, '2']), {x:'3'}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(Object.preventExtensions([, 1, 2, '3']), {x:'3'}));
+  assertFalse(foo(Object.preventExtensions([, 0, 1, '2']), {x:'3'}));
+
+  // Sealed
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(Object.seal([, 1, 2, '3']), {x:'3'}));
+  assertFalse(foo(Object.seal([, 0, 1, '2']), {x:'3'}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(Object.seal([, 1, 2, '3']), {x:'3'}));
+  assertFalse(foo(Object.seal([, 0, 1, '2']), {x:'3'}));
+
+  // Frozen
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(Object.freeze([, 1, 2, '3']), {x:'3'}));
+  assertFalse(foo(Object.freeze([, 0, 1, '2']), {x:'3'}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(Object.freeze([, 1, 2, '3']), {x:'3'}));
+  assertFalse(foo(Object.freeze([, 0, 1, '2']), {x:'3'}));
+})();
diff --git a/src/v8/test/mjsunit/compiler/array-species.js b/src/v8/test/mjsunit/compiler/array-species.js
new file mode 100644
index 0000000..37c14b5
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/array-species.js
@@ -0,0 +1,35 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Foo() {}
+
+function f() {
+  return [42].map(_ => 88);
+}
+
+let y;
+
+%PrepareFunctionForOptimization(f);
+
+y = f();
+assertFalse(y instanceof Foo);
+assertInstanceof(y, Array);
+
+y = f();
+assertFalse(y instanceof Foo);
+assertInstanceof(y, Array);
+
+%OptimizeFunctionOnNextCall(f);
+
+y = f();
+assertFalse(y instanceof Foo);
+assertInstanceof(y, Array);
+
+assertTrue(Reflect.defineProperty(Array, Symbol.species, {value: Foo}));
+
+y = f();
+assertInstanceof(y, Foo);
+assertFalse(y instanceof Array);
diff --git a/src/v8/test/mjsunit/compiler/array-subclass.js b/src/v8/test/mjsunit/compiler/array-subclass.js
index d20b669..5eb2667 100644
--- a/src/v8/test/mjsunit/compiler/array-subclass.js
+++ b/src/v8/test/mjsunit/compiler/array-subclass.js
@@ -10,13 +10,29 @@
 
   function foo() { return new A; }
 
-  assertInstanceof(foo(), A);
-  assertEquals(0, foo().length);
-  assertInstanceof(foo(), A);
-  assertEquals(0, foo().length);
-  %OptimizeFunctionOnNextCall(foo);
-  assertInstanceof(foo(), A);
-  assertEquals(0, foo().length);
+  function test(foo) {
+    %PrepareFunctionForOptimization(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(0, foo().length);
+    assertInstanceof(foo(), A);
+    assertEquals(0, foo().length);
+    %OptimizeFunctionOnNextCall(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(0, foo().length);
+  }
+  test(foo);
+
+  // Non-extensible
+  function fooPreventExtensions() { return Object.preventExtensions(foo()); }
+  test(fooPreventExtensions);
+
+  // Sealed
+  function fooSeal() { return Object.seal(foo()); }
+  test(fooSeal);
+
+  // Frozen
+  function fooFreeze() { return Object.freeze(foo()); }
+  test(fooFreeze);
 })();
 
 // Test Array subclass default constructor with small constant length.
@@ -26,13 +42,29 @@
 
   function foo() { return new A(L); }
 
-  assertInstanceof(foo(), A);
-  assertEquals(L, foo().length);
-  assertInstanceof(foo(), A);
-  assertEquals(L, foo().length);
-  %OptimizeFunctionOnNextCall(foo);
-  assertInstanceof(foo(), A);
-  assertEquals(L, foo().length);
+  function test(foo) {
+    %PrepareFunctionForOptimization(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(L, foo().length);
+    assertInstanceof(foo(), A);
+    assertEquals(L, foo().length);
+    %OptimizeFunctionOnNextCall(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(L, foo().length);
+  }
+  test(foo);
+
+  // Non-extensible
+  function fooPreventExtensions() { return Object.preventExtensions(foo()); }
+  test(fooPreventExtensions);
+
+  // Sealed
+  function fooSeal() { return Object.seal(foo()); }
+  test(fooSeal);
+
+  // Frozen
+  function fooFreeze() { return Object.freeze(foo()); }
+  test(fooFreeze);
 })();
 
 // Test Array subclass default constructor with large constant length.
@@ -42,13 +74,29 @@
 
   function foo() { return new A(L); }
 
-  assertInstanceof(foo(), A);
-  assertEquals(L, foo().length);
-  assertInstanceof(foo(), A);
-  assertEquals(L, foo().length);
-  %OptimizeFunctionOnNextCall(foo);
-  assertInstanceof(foo(), A);
-  assertEquals(L, foo().length);
+  function test(foo) {
+    %PrepareFunctionForOptimization(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(L, foo().length);
+    assertInstanceof(foo(), A);
+    assertEquals(L, foo().length);
+    %OptimizeFunctionOnNextCall(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(L, foo().length);
+  }
+  test(foo);
+
+  // Non-extensible
+  function fooPreventExtensions() { return Object.preventExtensions(foo()); }
+  test(fooPreventExtensions);
+
+  // Sealed
+  function fooSeal() { return Object.seal(foo()); }
+  test(fooSeal);
+
+  // Frozen
+  function fooFreeze() { return Object.freeze(foo()); }
+  test(fooFreeze);
 })();
 
 // Test Array subclass default constructor with known boolean.
@@ -57,16 +105,32 @@
 
   function foo() { return new A(true); }
 
-  assertInstanceof(foo(), A);
-  assertEquals(1, foo().length);
-  assertEquals(true, foo()[0]);
-  assertInstanceof(foo(), A);
-  assertEquals(1, foo().length);
-  assertEquals(true, foo()[0]);
-  %OptimizeFunctionOnNextCall(foo);
-  assertInstanceof(foo(), A);
-  assertEquals(1, foo().length);
-  assertEquals(true, foo()[0]);
+  function test(foo) {
+    %PrepareFunctionForOptimization(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(1, foo().length);
+    assertEquals(true, foo()[0]);
+    assertInstanceof(foo(), A);
+    assertEquals(1, foo().length);
+    assertEquals(true, foo()[0]);
+    %OptimizeFunctionOnNextCall(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(1, foo().length);
+    assertEquals(true, foo()[0]);
+  }
+  test(foo);
+
+  // Non-extensible
+  function fooPreventExtensions() { return Object.preventExtensions(foo()); }
+  test(fooPreventExtensions);
+
+  // Sealed
+  function fooSeal() { return Object.seal(foo()); }
+  test(fooSeal);
+
+  // Frozen
+  function fooFreeze() { return Object.freeze(foo()); }
+  test(fooFreeze);
 })();
 
 // Test Array subclass default constructor with known string.
@@ -75,16 +139,32 @@
 
   function foo() { return new A(""); }
 
-  assertInstanceof(foo(), A);
-  assertEquals(1, foo().length);
-  assertEquals("", foo()[0]);
-  assertInstanceof(foo(), A);
-  assertEquals(1, foo().length);
-  assertEquals("", foo()[0]);
-  %OptimizeFunctionOnNextCall(foo);
-  assertInstanceof(foo(), A);
-  assertEquals(1, foo().length);
-  assertEquals("", foo()[0]);
+  function test(foo) {
+    %PrepareFunctionForOptimization(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(1, foo().length);
+    assertEquals("", foo()[0]);
+    assertInstanceof(foo(), A);
+    assertEquals(1, foo().length);
+    assertEquals("", foo()[0]);
+    %OptimizeFunctionOnNextCall(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(1, foo().length);
+    assertEquals("", foo()[0]);
+  }
+  test(foo);
+
+  // Non-extensible
+  function fooPreventExtensions() { return Object.preventExtensions(foo()); }
+  test(fooPreventExtensions);
+
+  // Sealed
+  function fooSeal() { return Object.seal(foo()); }
+  test(fooSeal);
+
+  // Frozen
+  function fooFreeze() { return Object.freeze(foo()); }
+  test(fooFreeze);
 })();
 
 // Test Array subclass default constructor with known object.
@@ -94,17 +174,32 @@
 
   function foo() { return new A(O); }
 
-  assertInstanceof(foo(), A);
-  assertEquals(1, foo().length);
-  assertSame(O, foo()[0]);
-  assertInstanceof(foo(), A);
-  assertEquals(1, foo().length);
-  assertSame(O, foo()[0]);
-  %OptimizeFunctionOnNextCall(foo);
-  assertInstanceof(foo(), A);
-  assertEquals(1, foo().length);
-  assertSame(O, foo()[0]);
-})();
+  function test(foo) {
+    %PrepareFunctionForOptimization(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(1, foo().length);
+    assertSame(O, foo()[0]);
+    assertInstanceof(foo(), A);
+    assertEquals(1, foo().length);
+    assertSame(O, foo()[0]);
+    %OptimizeFunctionOnNextCall(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(1, foo().length);
+    assertSame(O, foo()[0]);
+  }
+  test(foo);
+
+  // Non-extensible
+  function fooPreventExtensions() { return Object.preventExtensions(foo()); }
+  test(fooPreventExtensions);
+
+  // Sealed
+  function fooSeal() { return Object.seal(foo()); }
+  test(fooSeal);
+
+  // Frozen
+  function fooFreeze() { return Object.freeze(foo()); }
+  test(fooFreeze);})();
 
 // Test Array subclass default constructor with known small integers.
 (function() {
@@ -112,17 +207,33 @@
 
   function foo() { return new A(1, 2, 3); }
 
-  assertInstanceof(foo(), A);
-  assertEquals(3, foo().length);
-  assertEquals(1, foo()[0]);
-  assertEquals(2, foo()[1]);
-  assertEquals(3, foo()[2]);
-  %OptimizeFunctionOnNextCall(foo);
-  assertInstanceof(foo(), A);
-  assertEquals(3, foo().length);
-  assertEquals(1, foo()[0]);
-  assertEquals(2, foo()[1]);
-  assertEquals(3, foo()[2]);
+  function test(foo) {
+    %PrepareFunctionForOptimization(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(3, foo().length);
+    assertEquals(1, foo()[0]);
+    assertEquals(2, foo()[1]);
+    assertEquals(3, foo()[2]);
+    %OptimizeFunctionOnNextCall(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(3, foo().length);
+    assertEquals(1, foo()[0]);
+    assertEquals(2, foo()[1]);
+    assertEquals(3, foo()[2]);
+  }
+  test(foo);
+
+  // Non-extensible
+  function fooPreventExtensions() { return Object.preventExtensions(foo()); }
+  test(fooPreventExtensions);
+
+  // Sealed
+  function fooSeal() { return Object.seal(foo()); }
+  test(fooSeal);
+
+  // Frozen
+  function fooFreeze() { return Object.freeze(foo()); }
+  test(fooFreeze);
 })();
 
 // Test Array subclass default constructor with known numbers.
@@ -131,17 +242,33 @@
 
   function foo() { return new A(1.1, 2.2, 3.3); }
 
-  assertInstanceof(foo(), A);
-  assertEquals(3, foo().length);
-  assertEquals(1.1, foo()[0]);
-  assertEquals(2.2, foo()[1]);
-  assertEquals(3.3, foo()[2]);
-  %OptimizeFunctionOnNextCall(foo);
-  assertInstanceof(foo(), A);
-  assertEquals(3, foo().length);
-  assertEquals(1.1, foo()[0]);
-  assertEquals(2.2, foo()[1]);
-  assertEquals(3.3, foo()[2]);
+  function test(foo) {
+    %PrepareFunctionForOptimization(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(3, foo().length);
+    assertEquals(1.1, foo()[0]);
+    assertEquals(2.2, foo()[1]);
+    assertEquals(3.3, foo()[2]);
+    %OptimizeFunctionOnNextCall(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(3, foo().length);
+    assertEquals(1.1, foo()[0]);
+    assertEquals(2.2, foo()[1]);
+    assertEquals(3.3, foo()[2]);
+  }
+  test(foo);
+
+  // Non-extensible
+  function fooPreventExtensions() { return Object.preventExtensions(foo()); }
+  test(fooPreventExtensions);
+
+  // Sealed
+  function fooSeal() { return Object.seal(foo()); }
+  test(fooSeal);
+
+  // Frozen
+  function fooFreeze() { return Object.freeze(foo()); }
+  test(fooFreeze);
 })();
 
 // Test Array subclass default constructor with known strings.
@@ -150,19 +277,35 @@
 
   function foo() { return new A("a", "b", "c", "d"); }
 
-  assertInstanceof(foo(), A);
-  assertEquals(4, foo().length);
-  assertEquals("a", foo()[0]);
-  assertEquals("b", foo()[1]);
-  assertEquals("c", foo()[2]);
-  assertEquals("d", foo()[3]);
-  %OptimizeFunctionOnNextCall(foo);
-  assertInstanceof(foo(), A);
-  assertEquals(4, foo().length);
-  assertEquals("a", foo()[0]);
-  assertEquals("b", foo()[1]);
-  assertEquals("c", foo()[2]);
-  assertEquals("d", foo()[3]);
+  function test(foo) {
+    %PrepareFunctionForOptimization(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(4, foo().length);
+    assertEquals("a", foo()[0]);
+    assertEquals("b", foo()[1]);
+    assertEquals("c", foo()[2]);
+    assertEquals("d", foo()[3]);
+    %OptimizeFunctionOnNextCall(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(4, foo().length);
+    assertEquals("a", foo()[0]);
+    assertEquals("b", foo()[1]);
+    assertEquals("c", foo()[2]);
+    assertEquals("d", foo()[3]);
+  }
+  test(foo);
+
+  // Non-extensible
+  function fooPreventExtensions() { return Object.preventExtensions(foo()); }
+  test(fooPreventExtensions);
+
+  // Sealed
+  function fooSeal() { return Object.seal(foo()); }
+  test(fooSeal);
+
+  // Frozen
+  function fooFreeze() { return Object.freeze(foo()); }
+  test(fooFreeze);
 })();
 
 // Test Array subclass constructor with no parameters.
@@ -176,17 +319,32 @@
 
   function foo() { return new A; }
 
-  assertInstanceof(foo(), A);
-  assertEquals(0, foo().length);
-  assertEquals(1, foo().bar);
-  assertInstanceof(foo(), A);
-  assertEquals(0, foo().length);
-  assertEquals(1, foo().bar);
-  %OptimizeFunctionOnNextCall(foo);
-  assertInstanceof(foo(), A);
-  assertEquals(0, foo().length);
-  assertEquals(1, foo().bar);
-})();
+  function test(foo) {
+    %PrepareFunctionForOptimization(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(0, foo().length);
+    assertEquals(1, foo().bar);
+    assertInstanceof(foo(), A);
+    assertEquals(0, foo().length);
+    assertEquals(1, foo().bar);
+    %OptimizeFunctionOnNextCall(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(0, foo().length);
+    assertEquals(1, foo().bar);
+  }
+  test(foo);
+
+  // Non-extensible
+  function fooPreventExtensions() { return Object.preventExtensions(foo()); }
+  test(fooPreventExtensions);
+
+  // Sealed
+  function fooSeal() { return Object.seal(foo()); }
+  test(fooSeal);
+
+  // Frozen
+  function fooFreeze() { return Object.freeze(foo()); }
+  test(fooFreeze);})();
 
 // Test Array subclass constructor with small constant length.
 (function() {
@@ -200,16 +358,32 @@
 
   function foo() { return new A(L); }
 
-  assertInstanceof(foo(), A);
-  assertEquals(L, foo().length);
-  assertEquals(1, foo().bar);
-  assertInstanceof(foo(), A);
-  assertEquals(L, foo().length);
-  assertEquals(1, foo().bar);
-  %OptimizeFunctionOnNextCall(foo);
-  assertInstanceof(foo(), A);
-  assertEquals(L, foo().length);
-  assertEquals(1, foo().bar);
+  function test(foo) {
+    %PrepareFunctionForOptimization(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(L, foo().length);
+    assertEquals(1, foo().bar);
+    assertInstanceof(foo(), A);
+    assertEquals(L, foo().length);
+    assertEquals(1, foo().bar);
+    %OptimizeFunctionOnNextCall(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(L, foo().length);
+    assertEquals(1, foo().bar);
+  }
+  test(foo);
+
+  // Non-extensible
+  function fooPreventExtensions() { return Object.preventExtensions(foo()); }
+  test(fooPreventExtensions);
+
+  // Sealed
+  function fooSeal() { return Object.seal(foo()); }
+  test(fooSeal);
+
+  // Frozen
+  function fooFreeze() { return Object.freeze(foo()); }
+  test(fooFreeze);
 })();
 
 // Test Array subclass constructor with large constant length.
@@ -224,16 +398,32 @@
 
   function foo() { return new A(L); }
 
-  assertInstanceof(foo(), A);
-  assertEquals(L, foo().length);
-  assertEquals(1, foo().bar);
-  assertInstanceof(foo(), A);
-  assertEquals(L, foo().length);
-  assertEquals(1, foo().bar);
-  %OptimizeFunctionOnNextCall(foo);
-  assertInstanceof(foo(), A);
-  assertEquals(L, foo().length);
-  assertEquals(1, foo().bar);
+  function test(foo) {
+    %PrepareFunctionForOptimization(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(L, foo().length);
+    assertEquals(1, foo().bar);
+    assertInstanceof(foo(), A);
+    assertEquals(L, foo().length);
+    assertEquals(1, foo().bar);
+    %OptimizeFunctionOnNextCall(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(L, foo().length);
+    assertEquals(1, foo().bar);
+  }
+  test(foo);
+
+  // Non-extensible
+  function fooPreventExtensions() { return Object.preventExtensions(foo()); }
+  test(fooPreventExtensions);
+
+  // Sealed
+  function fooSeal() { return Object.seal(foo()); }
+  test(fooSeal);
+
+  // Frozen
+  function fooFreeze() { return Object.freeze(foo()); }
+  test(fooFreeze);
 })();
 
 // Test Array subclass constructor with known boolean.
@@ -247,19 +437,35 @@
 
   function foo() { return new A(true); }
 
-  assertInstanceof(foo(), A);
-  assertEquals(1, foo().length);
-  assertEquals(true, foo()[0]);
-  assertEquals(1, foo().bar);
-  assertInstanceof(foo(), A);
-  assertEquals(1, foo().length);
-  assertEquals(true, foo()[0]);
-  assertEquals(1, foo().bar);
-  %OptimizeFunctionOnNextCall(foo);
-  assertInstanceof(foo(), A);
-  assertEquals(1, foo().length);
-  assertEquals(true, foo()[0]);
-  assertEquals(1, foo().bar);
+  function test(foo) {
+    %PrepareFunctionForOptimization(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(1, foo().length);
+    assertEquals(true, foo()[0]);
+    assertEquals(1, foo().bar);
+    assertInstanceof(foo(), A);
+    assertEquals(1, foo().length);
+    assertEquals(true, foo()[0]);
+    assertEquals(1, foo().bar);
+    %OptimizeFunctionOnNextCall(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(1, foo().length);
+    assertEquals(true, foo()[0]);
+    assertEquals(1, foo().bar);
+  }
+  test(foo);
+
+  // Non-extensible
+  function fooPreventExtensions() { return Object.preventExtensions(foo()); }
+  test(fooPreventExtensions);
+
+  // Sealed
+  function fooSeal() { return Object.seal(foo()); }
+  test(fooSeal);
+
+  // Frozen
+  function fooFreeze() { return Object.freeze(foo()); }
+  test(fooFreeze);
 })();
 
 // Test Array subclass constructor with known string.
@@ -273,19 +479,35 @@
 
   function foo() { return new A(""); }
 
-  assertInstanceof(foo(), A);
-  assertEquals(1, foo().length);
-  assertEquals("", foo()[0]);
-  assertEquals(1, foo().bar);
-  assertInstanceof(foo(), A);
-  assertEquals(1, foo().length);
-  assertEquals("", foo()[0]);
-  assertEquals(1, foo().bar);
-  %OptimizeFunctionOnNextCall(foo);
-  assertInstanceof(foo(), A);
-  assertEquals(1, foo().length);
-  assertEquals("", foo()[0]);
-  assertEquals(1, foo().bar);
+  function test(foo) {
+    %PrepareFunctionForOptimization(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(1, foo().length);
+    assertEquals("", foo()[0]);
+    assertEquals(1, foo().bar);
+    assertInstanceof(foo(), A);
+    assertEquals(1, foo().length);
+    assertEquals("", foo()[0]);
+    assertEquals(1, foo().bar);
+    %OptimizeFunctionOnNextCall(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(1, foo().length);
+    assertEquals("", foo()[0]);
+    assertEquals(1, foo().bar);
+  }
+  test(foo);
+
+  // Non-extensible
+  function fooPreventExtensions() { return Object.preventExtensions(foo()); }
+  test(fooPreventExtensions);
+
+  // Sealed
+  function fooSeal() { return Object.seal(foo()); }
+  test(fooSeal);
+
+  // Frozen
+  function fooFreeze() { return Object.freeze(foo()); }
+  test(fooFreeze);
 })();
 
 // Test Array subclass constructor with known object.
@@ -300,19 +522,35 @@
 
   function foo() { return new A(O); }
 
-  assertInstanceof(foo(), A);
-  assertEquals(1, foo().length);
-  assertSame(O, foo()[0]);
-  assertEquals(1, foo().bar);
-  assertInstanceof(foo(), A);
-  assertEquals(1, foo().length);
-  assertSame(O, foo()[0]);
-  assertEquals(1, foo().bar);
-  %OptimizeFunctionOnNextCall(foo);
-  assertInstanceof(foo(), A);
-  assertEquals(1, foo().length);
-  assertSame(O, foo()[0]);
-  assertEquals(1, foo().bar);
+  function test(foo) {
+    %PrepareFunctionForOptimization(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(1, foo().length);
+    assertSame(O, foo()[0]);
+    assertEquals(1, foo().bar);
+    assertInstanceof(foo(), A);
+    assertEquals(1, foo().length);
+    assertSame(O, foo()[0]);
+    assertEquals(1, foo().bar);
+    %OptimizeFunctionOnNextCall(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(1, foo().length);
+    assertSame(O, foo()[0]);
+    assertEquals(1, foo().bar);
+  }
+  test(foo);
+
+  // Non-extensible
+  function fooPreventExtensions() { return Object.preventExtensions(foo()); }
+  test(fooPreventExtensions);
+
+  // Sealed
+  function fooSeal() { return Object.seal(foo()); }
+  test(fooSeal);
+
+  // Frozen
+  function fooFreeze() { return Object.freeze(foo()); }
+  test(fooFreeze);
 })();
 
 // Test Array subclass constructor with known small integers.
@@ -326,19 +564,35 @@
 
   function foo() { return new A(1, 2, 3); }
 
-  assertInstanceof(foo(), A);
-  assertEquals(3, foo().length);
-  assertEquals(1, foo()[0]);
-  assertEquals(2, foo()[1]);
-  assertEquals(3, foo()[2]);
-  assertEquals(1, foo().bar);
-  %OptimizeFunctionOnNextCall(foo);
-  assertInstanceof(foo(), A);
-  assertEquals(3, foo().length);
-  assertEquals(1, foo()[0]);
-  assertEquals(2, foo()[1]);
-  assertEquals(3, foo()[2]);
-  assertEquals(1, foo().bar);
+  function test(foo) {
+    %PrepareFunctionForOptimization(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(3, foo().length);
+    assertEquals(1, foo()[0]);
+    assertEquals(2, foo()[1]);
+    assertEquals(3, foo()[2]);
+    assertEquals(1, foo().bar);
+    %OptimizeFunctionOnNextCall(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(3, foo().length);
+    assertEquals(1, foo()[0]);
+    assertEquals(2, foo()[1]);
+    assertEquals(3, foo()[2]);
+    assertEquals(1, foo().bar);
+  }
+  test(foo);
+
+  // Non-extensible
+  function fooPreventExtensions() { return Object.preventExtensions(foo()); }
+  test(fooPreventExtensions);
+
+  // Sealed
+  function fooSeal() { return Object.seal(foo()); }
+  test(fooSeal);
+
+  // Frozen
+  function fooFreeze() { return Object.freeze(foo()); }
+  test(fooFreeze);
 })();
 
 // Test Array subclass constructor with known numbers.
@@ -352,19 +606,35 @@
 
   function foo() { return new A(1.1, 2.2, 3.3); }
 
-  assertInstanceof(foo(), A);
-  assertEquals(3, foo().length);
-  assertEquals(1.1, foo()[0]);
-  assertEquals(2.2, foo()[1]);
-  assertEquals(3.3, foo()[2]);
-  assertEquals(1, foo().bar);
-  %OptimizeFunctionOnNextCall(foo);
-  assertInstanceof(foo(), A);
-  assertEquals(3, foo().length);
-  assertEquals(1.1, foo()[0]);
-  assertEquals(2.2, foo()[1]);
-  assertEquals(3.3, foo()[2]);
-  assertEquals(1, foo().bar);
+  function test(foo) {
+    %PrepareFunctionForOptimization(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(3, foo().length);
+    assertEquals(1.1, foo()[0]);
+    assertEquals(2.2, foo()[1]);
+    assertEquals(3.3, foo()[2]);
+    assertEquals(1, foo().bar);
+    %OptimizeFunctionOnNextCall(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(3, foo().length);
+    assertEquals(1.1, foo()[0]);
+    assertEquals(2.2, foo()[1]);
+    assertEquals(3.3, foo()[2]);
+    assertEquals(1, foo().bar);
+  }
+  test(foo);
+
+  // Non-extensible
+  function fooPreventExtensions() { return Object.preventExtensions(foo()); }
+  test(fooPreventExtensions);
+
+  // Sealed
+  function fooSeal() { return Object.seal(foo()); }
+  test(fooSeal);
+
+  // Frozen
+  function fooFreeze() { return Object.freeze(foo()); }
+  test(fooFreeze);
 })();
 
 // Test Array subclass constructor with known strings.
@@ -378,19 +648,35 @@
 
   function foo() { return new A("a", "b", "c", "d"); }
 
-  assertInstanceof(foo(), A);
-  assertEquals(4, foo().length);
-  assertEquals("a", foo()[0]);
-  assertEquals("b", foo()[1]);
-  assertEquals("c", foo()[2]);
-  assertEquals("d", foo()[3]);
-  assertEquals(1, foo().bar);
-  %OptimizeFunctionOnNextCall(foo);
-  assertInstanceof(foo(), A);
-  assertEquals(4, foo().length);
-  assertEquals("a", foo()[0]);
-  assertEquals("b", foo()[1]);
-  assertEquals("c", foo()[2]);
-  assertEquals("d", foo()[3]);
-  assertEquals(1, foo().bar);
+  function test(foo) {
+    %PrepareFunctionForOptimization(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(4, foo().length);
+    assertEquals("a", foo()[0]);
+    assertEquals("b", foo()[1]);
+    assertEquals("c", foo()[2]);
+    assertEquals("d", foo()[3]);
+    assertEquals(1, foo().bar);
+    %OptimizeFunctionOnNextCall(foo);
+    assertInstanceof(foo(), A);
+    assertEquals(4, foo().length);
+    assertEquals("a", foo()[0]);
+    assertEquals("b", foo()[1]);
+    assertEquals("c", foo()[2]);
+    assertEquals("d", foo()[3]);
+    assertEquals(1, foo().bar);
+  }
+  test(foo);
+
+  // Non-extensible
+  function fooPreventExtensions() { return Object.preventExtensions(foo()); }
+  test(fooPreventExtensions);
+
+  // Sealed
+  function fooSeal() { return Object.seal(foo()); }
+  test(fooSeal);
+
+  // Frozen
+  function fooFreeze() { return Object.freeze(foo()); }
+  test(fooFreeze);
 })();
diff --git a/src/v8/test/mjsunit/compiler/assignment-deopt.js b/src/v8/test/mjsunit/compiler/assignment-deopt.js
index 2b00625..175a344 100644
--- a/src/v8/test/mjsunit/compiler/assignment-deopt.js
+++ b/src/v8/test/mjsunit/compiler/assignment-deopt.js
@@ -42,6 +42,8 @@
 // Test deopt with count operation on named property.
 function assign2(p) { p.x += 1 }
 
+%PrepareFunctionForOptimization(assign2);
+
 o.x = "42";
 assign2(o);
 assertEquals("421", o.x);
@@ -60,6 +62,8 @@
 // Test deopt with count operation on keyed property.
 function assign3(a, b) { a[b] += 1; }
 
+%PrepareFunctionForOptimization(assign3);
+
 o = ["42"];
 assign3(o, 0);
 assertEquals("421", o[0]);
@@ -83,12 +87,14 @@
 for(var i = 0; i < 5; i++) {
   assign3(o, 0);
 }
+%PrepareFunctionForOptimization(assign3);
 %OptimizeFunctionOnNextCall(assign3);
 assign3(o, 0);
 assign3(o, 1);
 
 // Test bailout with count operation in a value context.
 function assign5(x,y) { return (x += 1) + y; }
+%PrepareFunctionForOptimization(assign5);
 for (var i = 0; i < 5; ++i) assertEquals(4, assign5(2, 1));
 %OptimizeFunctionOnNextCall(assign5);
 assertEquals(4, assign5(2, 1));
@@ -97,6 +103,7 @@
 assertEquals(4.1, assign5(2.1, 1));
 
 function assign7(o,y) { return (o.x += 1) + y; }
+%PrepareFunctionForOptimization(assign7);
 o = {x:0};
 for (var i = 0; i < 5; ++i) {
   o.x = 42;
@@ -112,6 +119,7 @@
 assertEquals(44.1, assign7(o, 1));
 
 function assign9(o,y) { return (o[0] += 1) + y; }
+%PrepareFunctionForOptimization(assign9);
 q = [0];
 for (var i = 0; i < 5; ++i) {
   q[0] = 42;
@@ -128,6 +136,7 @@
 
 // Test deopt because of a failed map check on the load.
 function assign10(p) { return p.x += 1 }
+%PrepareFunctionForOptimization(assign10);
 var g1 = {x:0};
 var g2 = {y:0, x:42};
 for (var i = 0; i < 5; ++i) {
@@ -148,6 +157,7 @@
 o = {x:0};
 var g3 = { valueOf: function() { o.y = "bar"; return 42; }};
 function assign11(p) { return p.x += 1; }
+%PrepareFunctionForOptimization(assign11);
 
 for (var i = 0; i < 5; i++) {
   o.x = "a";
@@ -165,6 +175,7 @@
 o = [0];
 var g4 = { valueOf: function() { o.y = "bar"; return 42; }};
 function assign12(p) { return p[0] += 1; }
+%PrepareFunctionForOptimization(assign12);
 
 for (var i = 0; i < 5; i++) {
   o[0] = "a";
diff --git a/src/v8/test/mjsunit/compiler/bigint-add-no-deopt-loop.js b/src/v8/test/mjsunit/compiler/bigint-add-no-deopt-loop.js
new file mode 100644
index 0000000..1390acc
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/bigint-add-no-deopt-loop.js
@@ -0,0 +1,36 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+
+const big = 2n ** BigInt((2 ** 30)-1);
+
+
+function testAdd(x, y) {
+  return x + y;
+}
+
+
+%PrepareFunctionForOptimization(testAdd);
+testAdd(3n, 7n);
+testAdd(17n, -54n);
+%OptimizeFunctionOnNextCall(testAdd);
+assertEquals(testAdd(6n, 2n), 8n);
+assertOptimized(testAdd);
+
+assertThrows(() => testAdd(big, big), RangeError);
+assertUnoptimized(testAdd);
+
+%PrepareFunctionForOptimization(testAdd);
+testAdd(30n, -50n);
+testAdd(23n, 5n);
+%OptimizeFunctionOnNextCall(testAdd);
+assertEquals(testAdd(-7n, -12n), -19n);
+assertOptimized(testAdd);
+
+assertThrows(() => testAdd(big, big), RangeError);
+assertOptimized(testAdd);
+assertThrows(() => testAdd(big, big), RangeError);
+assertOptimized(testAdd);
diff --git a/src/v8/test/mjsunit/compiler/bigint-add.js b/src/v8/test/mjsunit/compiler/bigint-add.js
new file mode 100644
index 0000000..0db3f49
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/bigint-add.js
@@ -0,0 +1,26 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+{
+  let a = 0n;
+  a = 3n;
+
+  function TestAdd() {
+    let sum = 0n;
+
+    for (let i = 0; i < 3; ++i) {
+      sum = a + sum;
+    }
+
+    return sum;
+  }
+
+  %PrepareFunctionForOptimization(TestAdd);
+  TestAdd();
+  TestAdd();
+  %OptimizeFunctionOnNextCall(TestAdd);
+  TestAdd();
+  TestAdd();
+}
diff --git a/src/v8/test/mjsunit/compiler/bigint-int64-lowered.js b/src/v8/test/mjsunit/compiler/bigint-int64-lowered.js
new file mode 100644
index 0000000..f669c17
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/bigint-int64-lowered.js
@@ -0,0 +1,82 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function TestAsUintN() {
+  assertEquals(0n, BigInt.asUintN(64, 0n));
+  assertEquals(0n, BigInt.asUintN(8, 0n));
+  assertEquals(0n, BigInt.asUintN(1, 0n));
+  assertEquals(0n, BigInt.asUintN(0, 0n));
+  assertEquals(0n, BigInt.asUintN(100, 0n));
+
+  assertEquals(123n, BigInt.asUintN(64, 123n));
+  assertEquals(123n, BigInt.asUintN(32, 123n));
+  assertEquals(123n, BigInt.asUintN(8, 123n));
+  assertEquals(59n, BigInt.asUintN(6, 123n));
+  assertEquals(27n, BigInt.asUintN(5, 123n));
+  assertEquals(11n, BigInt.asUintN(4, 123n));
+  assertEquals(1n, BigInt.asUintN(1, 123n));
+  assertEquals(0n, BigInt.asUintN(0, 123n));
+  assertEquals(123n, BigInt.asUintN(72, 123n));
+
+  assertEquals(BigInt("0xFFFFFFFFFFFFFF85"), BigInt.asUintN(64, -123n));
+  assertEquals(BigInt("0xFFFFFF85"), BigInt.asUintN(32, -123n));
+  assertEquals(BigInt("0x85"), BigInt.asUintN(8, -123n));
+  assertEquals(5n, BigInt.asUintN(6, -123n));
+  assertEquals(5n, BigInt.asUintN(5, -123n));
+  assertEquals(5n, BigInt.asUintN(4, -123n));
+  assertEquals(1n, BigInt.asUintN(1, -123n));
+  assertEquals(0n, BigInt.asUintN(0, -123n));
+  assertEquals(BigInt("0xFFFFFFFFFFFFFFFF85"), BigInt.asUintN(72, -123n));
+}
+
+function TestInt64LoweredOperations() {
+  assertEquals(0n, BigInt.asUintN(64, -0n));
+  assertEquals(0n, BigInt.asUintN(64, 15n + -15n));
+  assertEquals(0n, BigInt.asUintN(64, 0n + 0n));
+  assertEquals(14n, BigInt.asUintN(32, 8n + 6n));
+  assertEquals(813n, BigInt.asUintN(10, 1013n + -200n));
+  assertEquals(15n, BigInt.asUintN(4, -319n + 302n));
+
+  for (let i = 0; i < 2; ++i) {
+    let x = 32n; // x = 32n
+    if (i === 1) {
+      x = BigInt.asUintN(64, x + 3n); // x = 35n
+      const y = x + -8n + x; // x = 35n, y = 62n
+      x = BigInt.asUintN(6, y + x); // x = 33n, y = 62n
+      x = -9n + y + -x; // x = 20n
+      x = BigInt.asUintN(10000 * i, x); // x = 20n
+    } else {
+      x = x + 400n; // x = 432n
+      x = -144n + BigInt.asUintN(8, 500n) + x; // x = 532n
+    }
+    assertEquals(20n, BigInt.asUintN(8, x));
+  }
+
+  let x = 7n;
+  for (let i = 0; i < 10; ++i) {
+    x = x + 5n;
+  }
+  assertEquals(57n, BigInt.asUintN(8, x));
+
+  let y = 7n;
+  for(let i = 0; i < 10; ++i) {
+    y = BigInt.asUintN(4, y + 16n);
+  }
+  assertEquals(7n, y);
+}
+
+function OptimizeAndTest(fn) {
+  %PrepareFunctionForOptimization(fn);
+  fn();
+  fn();
+  %OptimizeFunctionOnNextCall(fn);
+  fn();
+  assertOptimized(fn);
+  fn();
+}
+
+OptimizeAndTest(TestAsUintN);
+OptimizeAndTest(TestInt64LoweredOperations);
diff --git a/src/v8/test/mjsunit/compiler/bigint-negate.js b/src/v8/test/mjsunit/compiler/bigint-negate.js
new file mode 100644
index 0000000..616f74c
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/bigint-negate.js
@@ -0,0 +1,26 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function TestNegate() {
+  assertEquals(0n, -0n);
+
+  const x = 15n;
+  assertEquals(-15n, -x);
+  assertEquals(15n, - -x);
+  assertEquals(30n, -(-x + -x));
+}
+
+function OptimizeAndTest(fn) {
+  %PrepareFunctionForOptimization(fn);
+  fn();
+  fn();
+  %OptimizeFunctionOnNextCall(fn);
+  fn();
+  assertOptimized(fn);
+  fn();
+}
+
+OptimizeAndTest(TestNegate);
diff --git a/src/v8/test/mjsunit/compiler/boolean-protototype.js b/src/v8/test/mjsunit/compiler/boolean-protototype.js
index 5e940d7..cc84eb8 100644
--- a/src/v8/test/mjsunit/compiler/boolean-protototype.js
+++ b/src/v8/test/mjsunit/compiler/boolean-protototype.js
@@ -7,6 +7,7 @@
 function test1(s) {
   return s.toString;
 }
+%PrepareFunctionForOptimization(test1);
 assertSame(test1(false), Boolean.prototype.toString);
 assertSame(test1(true), Boolean.prototype.toString);
 %OptimizeFunctionOnNextCall(test1);
@@ -16,6 +17,7 @@
 function test2(s) {
   return s.valueOf;
 }
+%PrepareFunctionForOptimization(test2);
 assertSame(test2(false), Boolean.prototype.valueOf);
 assertSame(test2(true), Boolean.prototype.valueOf);
 %OptimizeFunctionOnNextCall(test2);
@@ -26,6 +28,7 @@
 function test3(s) {
   return s["foo"];
 }
+%PrepareFunctionForOptimization(test3);
 assertEquals(test3(false), 42);
 assertEquals(test3(true), 42);
 %OptimizeFunctionOnNextCall(test3);
@@ -36,6 +39,7 @@
 function test4(s) {
   return s.bar();
 }
+%PrepareFunctionForOptimization(test4);
 assertEquals(test4(false), false);
 assertEquals(test4(true), true);
 %OptimizeFunctionOnNextCall(test4);
diff --git a/src/v8/test/mjsunit/compiler/capture-context.js b/src/v8/test/mjsunit/compiler/capture-context.js
index dae6c42..615f12e 100644
--- a/src/v8/test/mjsunit/compiler/capture-context.js
+++ b/src/v8/test/mjsunit/compiler/capture-context.js
@@ -12,5 +12,6 @@
 
 var baz = (function (s) { return foo(s) });
 
+%PrepareFunctionForOptimization(baz);
 %OptimizeFunctionOnNextCall(baz);
 assertEquals(42 + 12, baz(12));
diff --git a/src/v8/test/mjsunit/compiler/compare-map-elim.js b/src/v8/test/mjsunit/compiler/compare-map-elim.js
index 288d481..89d9cd8 100644
--- a/src/v8/test/mjsunit/compiler/compare-map-elim.js
+++ b/src/v8/test/mjsunit/compiler/compare-map-elim.js
@@ -38,6 +38,8 @@
   return z.f();
 }
 
+%PrepareFunctionForOptimization(x);
+
 x(a);
 x(b);
 x(a);
diff --git a/src/v8/test/mjsunit/compiler/compare-map-elim2.js b/src/v8/test/mjsunit/compiler/compare-map-elim2.js
index 0c0540c..cbe841b 100644
--- a/src/v8/test/mjsunit/compiler/compare-map-elim2.js
+++ b/src/v8/test/mjsunit/compiler/compare-map-elim2.js
@@ -33,6 +33,8 @@
     return { value: o.value };
   }
 
+  %PrepareFunctionForOptimization(foo);
+
   function Base() {
     this.v_ = 5;
   }
@@ -63,6 +65,8 @@
     return { value: o.value };
   }
 
+  %PrepareFunctionForOptimization(foo);
+
   function Base() {
     this.v_ = 5;
   }
@@ -97,6 +101,8 @@
     return { value: o.value(flag) };
   }
 
+  %PrepareFunctionForOptimization(foo);
+
   function Base() {
     this.v_ = 5;
   }
diff --git a/src/v8/test/mjsunit/compiler/compare-objeq-elim.js b/src/v8/test/mjsunit/compiler/compare-objeq-elim.js
index 4492df4..faace83 100644
--- a/src/v8/test/mjsunit/compiler/compare-objeq-elim.js
+++ b/src/v8/test/mjsunit/compiler/compare-objeq-elim.js
@@ -62,6 +62,8 @@
 %NeverOptimizeFunction(test);
 
 function test(f, a, b) {
+  %PrepareFunctionForOptimization(f);
+
   f(a, a);
   f(a, b);
   f(b, a);
diff --git a/src/v8/test/mjsunit/compiler/concurrent-invalidate-transition-map.js b/src/v8/test/mjsunit/compiler/concurrent-invalidate-transition-map.js
index 5d3c73b..50318b5 100644
--- a/src/v8/test/mjsunit/compiler/concurrent-invalidate-transition-map.js
+++ b/src/v8/test/mjsunit/compiler/concurrent-invalidate-transition-map.js
@@ -43,10 +43,10 @@
 
 function add_field(obj) {
   // Assign twice to make the field non-constant.
-  // TODO(ishell): update test once constant field tracking is done.
   obj.c = 0;
   obj.c = 3;
 }
+%PrepareFunctionForOptimization(add_field);
 var obj1 = new_object();
 var obj2 = new_object();
 add_field(obj1);
diff --git a/src/v8/test/mjsunit/compiler/concurrent-proto-change.js b/src/v8/test/mjsunit/compiler/concurrent-proto-change.js
index 0a016ac..df8d629 100644
--- a/src/v8/test/mjsunit/compiler/concurrent-proto-change.js
+++ b/src/v8/test/mjsunit/compiler/concurrent-proto-change.js
@@ -36,6 +36,8 @@
 
 function f(foo) { return foo.bar(); }
 
+%PrepareFunctionForOptimization(f);
+
 var o = {};
 o.__proto__ = { __proto__: { bar: function() { return 1; } } };
 
diff --git a/src/v8/test/mjsunit/compiler/constant-fold-add-static.js b/src/v8/test/mjsunit/compiler/constant-fold-add-static.js
new file mode 100644
index 0000000..e824cab
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/constant-fold-add-static.js
@@ -0,0 +1,17 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-assert-types
+
+// Check that constant-folding of arithmetic results in identical nodes.
+(function() {
+function foo(x) {
+  %TurbofanStaticAssert(1 * x == x + 0);
+};
+%PrepareFunctionForOptimization(foo);
+foo(121);
+foo(122);
+%OptimizeFunctionOnNextCall(foo);
+foo(123);
+})();
diff --git a/src/v8/test/mjsunit/compiler/constant-fold-cow-array.js b/src/v8/test/mjsunit/compiler/constant-fold-cow-array.js
index 1ab0226..0f88917 100644
--- a/src/v8/test/mjsunit/compiler/constant-fold-cow-array.js
+++ b/src/v8/test/mjsunit/compiler/constant-fold-cow-array.js
@@ -9,6 +9,7 @@
 (function() {
   const a = [1, 2, 3];
   const foo = () => a[0];
+  %PrepareFunctionForOptimization(foo);
   assertEquals(1, foo());
   assertEquals(1, foo());
   %OptimizeFunctionOnNextCall(foo);
@@ -24,6 +25,7 @@
 (function() {
   const a = [1, 2, 3];
   const foo = () => a[0];
+  %PrepareFunctionForOptimization(foo);
   assertEquals(1, foo());
   assertEquals(1, foo());
   %OptimizeFunctionOnNextCall(foo);
@@ -33,3 +35,89 @@
   assertEquals(42, foo());
   assertUnoptimized(foo);
 })();
+
+// Packed
+// Non-extensible
+(function() {
+  const a = Object.preventExtensions([1, 2, '3']);
+  const foo = () => a[0];
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo());
+  assertEquals(1, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo());
+  assertOptimized(foo);
+  a[0] = 42;
+  assertEquals(42, foo());
+})();
+
+// Sealed
+(function() {
+  const a = Object.seal([1, 2, '3']);
+  const foo = () => a[0];
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo());
+  assertEquals(1, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo());
+  assertOptimized(foo);
+  a[0] = 42;
+  assertEquals(42, foo());
+})();
+
+// Frozen
+(function() {
+  const a = Object.freeze([1, 2, '3']);
+  const foo = () => a[0];
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo());
+  assertEquals(1, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo());
+  assertOptimized(foo);
+  a[0] = 42;
+  assertEquals(1, foo());
+})();
+
+// Holey
+// Non-extensible
+(function() {
+  const a = Object.preventExtensions([1, 2, , '3']);
+  const foo = () => a[0];
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo());
+  assertEquals(1, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo());
+  assertOptimized(foo);
+  a[0] = 42;
+  assertEquals(42, foo());
+})();
+
+// Sealed
+(function() {
+  const a = Object.seal([1, 2, , '3']);
+  const foo = () => a[0];
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo());
+  assertEquals(1, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo());
+  assertOptimized(foo);
+  a[0] = 42;
+  assertEquals(42, foo());
+})();
+
+// Frozen
+(function() {
+  const a = Object.freeze([1, 2, , '3']);
+  const foo = () => a[0];
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo());
+  assertEquals(1, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo());
+  assertOptimized(foo);
+  a[0] = 42;
+  assertEquals(1, foo());
+})();
diff --git a/src/v8/test/mjsunit/compiler/constant-fold-tostring.js b/src/v8/test/mjsunit/compiler/constant-fold-tostring.js
index e9c6d91..e1a66a6 100644
--- a/src/v8/test/mjsunit/compiler/constant-fold-tostring.js
+++ b/src/v8/test/mjsunit/compiler/constant-fold-tostring.js
@@ -7,6 +7,7 @@
 // Check that constant-folding of ToString operations works properly for NaN.
 (function() {
   const foo = () => `${NaN}`;
+  %PrepareFunctionForOptimization(foo);
   assertEquals("NaN", foo());
   assertEquals("NaN", foo());
   %OptimizeFunctionOnNextCall(foo);
@@ -16,6 +17,7 @@
 // Check that constant-folding of ToString operations works properly for 0/-0.
 (function() {
   const foo = x => `${x ? 0 : -0}`;
+  %PrepareFunctionForOptimization(foo);
   assertEquals("0", foo(true));
   assertEquals("0", foo(false));
   assertEquals("0", foo(true));
diff --git a/src/v8/test/mjsunit/compiler/constructor-inlining.js b/src/v8/test/mjsunit/compiler/constructor-inlining.js
index 4ad426f..1064997 100644
--- a/src/v8/test/mjsunit/compiler/constructor-inlining.js
+++ b/src/v8/test/mjsunit/compiler/constructor-inlining.js
@@ -2,10 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-restrict-constructor-return --allow-natives-syntax --stress-inline
+// Flags: --allow-natives-syntax --stress-inline
 
-if (this.FLAG_harmony_restrict_constructor_return === undefined)
-  this.FLAG_harmony_restrict_constructor_return = true;
 var counter = 0;
 var deopt_at = -1;
 
@@ -65,17 +63,7 @@
 
   assertEquals(a, new Base(true, a));
   assertEquals(7, new Base(false, 7).x);
-  if (FLAG_harmony_restrict_constructor_return) {
-    // not using assertThrows to ensure proper inlining
-    try {
-      new Base(true, 5);
-      assertTrue(false);
-    } catch (e) {
-      if (!(e instanceof TypeError)) throw e;
-    }
-  } else {
-    assertEquals(5, new Base(true, 5).x);
-  }
+  assertEquals(5, new Base(true, 5).x);
 
   assertEquals(b, new Derived(true, a, b));
   assertEquals(a, new Derived(true, a, undefined));
@@ -87,28 +75,24 @@
   } catch (e) {
     if (!(e instanceof TypeError)) throw e;
   }
-  if (FLAG_harmony_restrict_constructor_return) {
-    try {
-      new Derived(true, 5, a)
-      assertTrue(false);
-    } catch (e) {
-      if (!(e instanceof TypeError)) throw e;
-    }
-  } else {
-    assertEquals(a, new Derived(true, 5, a));
-  }
+  assertEquals(a, new Derived(true, 5, a));
 
+  %PrepareFunctionForOptimization(Derived);
   %OptimizeFunctionOnNextCall(Derived);
   assertEquals(b, new DerivedDeoptCreate(true, a, b));
+  %PrepareFunctionForOptimization(Derived);
   %OptimizeFunctionOnNextCall(Derived);
   assertEquals(a, new DerivedDeoptCreate(true, a, undefined));
+  %PrepareFunctionForOptimization(Derived);
   %OptimizeFunctionOnNextCall(Derived);
   assertEquals(5, new DerivedDeoptCreate(false, 5, 7).x);
+  %PrepareFunctionForOptimization(Derived);
   %OptimizeFunctionOnNextCall(Derived);
   assertEquals(7, new DerivedDeoptCreate(false, 5, 7).y);
 }
 
 testConstructorInlining();
+%PrepareFunctionForOptimization(testConstructorInlining);
 %OptimizeFunctionOnNextCall(testConstructorInlining);
 testConstructorInlining();
 
@@ -116,6 +100,7 @@
 for(var i = 0; deopt_at < 0; ++i) {
   deopt_at = i;
   counter = 0;
+  %PrepareFunctionForOptimization(testConstructorInlining);
   %OptimizeFunctionOnNextCall(testConstructorInlining);
   testConstructorInlining();
   if (last !== undefined) {
diff --git a/src/v8/test/mjsunit/compiler/context-sensitivity.js b/src/v8/test/mjsunit/compiler/context-sensitivity.js
new file mode 100644
index 0000000..e404628
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/context-sensitivity.js
@@ -0,0 +1,577 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const object1 = {[Symbol.toPrimitive]() { return 1; }};
+const thrower = {[Symbol.toPrimitive]() { throw new Error(); }};
+
+// Test that JSAdd is not context-sensitive.
+(function() {
+  function bar(fn) {
+    return fn(1);
+  }
+
+  function foo(x) {
+    return bar(y => y + x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo(0));
+  assertEquals(2, foo(object1));
+  assertThrows(() => foo(thrower));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(0));
+  assertEquals(2, foo(object1));
+  assertThrows(() => foo(thrower));
+})();
+
+// Test that JSSubtract is not context-sensitive.
+(function() {
+  function bar(fn) {
+    return fn(1);
+  }
+
+  function foo(x) {
+    return bar(y => y - x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo(0));
+  assertEquals(0, foo(object1));
+  assertThrows(() => foo(thrower));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(0));
+  assertEquals(0, foo(object1));
+  assertThrows(() => foo(thrower));
+})();
+
+// Test that JSMultiply is not context-sensitive.
+(function() {
+  function bar(fn) {
+    return fn(1);
+  }
+
+  function foo(x) {
+    return bar(y => y * x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(object1));
+  assertThrows(() => foo(thrower));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(object1));
+  assertThrows(() => foo(thrower));
+})();
+
+// Test that JSDivide is not context-sensitive.
+(function() {
+  function bar(fn) {
+    return fn(1);
+  }
+
+  function foo(x) {
+    return bar(y => y / x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(object1));
+  assertThrows(() => foo(thrower));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(object1));
+  assertThrows(() => foo(thrower));
+})();
+
+// Test that JSModulus is not context-sensitive.
+(function() {
+  function bar(fn) {
+    return fn(1);
+  }
+
+  function foo(x) {
+    return bar(y => y % x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(1));
+  assertEquals(0, foo(object1));
+  assertThrows(() => foo(thrower));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(1));
+  assertEquals(0, foo(object1));
+  assertThrows(() => foo(thrower));
+})();
+
+// Test that JSExponentiate is not context-sensitive.
+(function() {
+  function bar(fn) {
+    return fn(1);
+  }
+
+  function foo(x) {
+    return bar(y => y ** x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(object1));
+  assertThrows(() => foo(thrower));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(object1));
+  assertThrows(() => foo(thrower));
+})();
+
+// Test that JSBitwiseOr is not context-sensitive.
+(function() {
+  function bar(fn) {
+    return fn(1);
+  }
+
+  function foo(x) {
+    return bar(y => y | x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(object1));
+  assertThrows(() => foo(thrower));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(object1));
+  assertThrows(() => foo(thrower));
+})();
+
+// Test that JSBitwiseAnd is not context-sensitive.
+(function() {
+  function bar(fn) {
+    return fn(1);
+  }
+
+  function foo(x) {
+    return bar(y => y & x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(object1));
+  assertThrows(() => foo(thrower));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(object1));
+  assertThrows(() => foo(thrower));
+})();
+
+// Test that JSBitwiseXor is not context-sensitive.
+(function() {
+  function bar(fn) {
+    return fn(1);
+  }
+
+  function foo(x) {
+    return bar(y => y ^ x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(1));
+  assertEquals(0, foo(object1));
+  assertThrows(() => foo(thrower));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(1));
+  assertEquals(0, foo(object1));
+  assertThrows(() => foo(thrower));
+})();
+
+// Test that JSShiftLeft is not context-sensitive.
+(function() {
+  function bar(fn) {
+    return fn(1);
+  }
+
+  function foo(x) {
+    return bar(y => y << x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(2, foo(1));
+  assertEquals(2, foo(object1));
+  assertThrows(() => foo(thrower));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(1));
+  assertEquals(2, foo(object1));
+  assertThrows(() => foo(thrower));
+})();
+
+// Test that JSShiftRight is not context-sensitive.
+(function() {
+  function bar(fn) {
+    return fn(1);
+  }
+
+  function foo(x) {
+    return bar(y => y >> x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(1));
+  assertEquals(0, foo(object1));
+  assertThrows(() => foo(thrower));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(1));
+  assertEquals(0, foo(object1));
+  assertThrows(() => foo(thrower));
+})();
+
+// Test that JSShiftRightLogical is not context-sensitive.
+(function() {
+  function bar(fn) {
+    return fn(1);
+  }
+
+  function foo(x) {
+    return bar(y => y >>> x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(1));
+  assertEquals(0, foo(object1));
+  assertThrows(() => foo(thrower));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(1));
+  assertEquals(0, foo(object1));
+  assertThrows(() => foo(thrower));
+})();
+
+// Test that JSEqual is not context-sensitive.
+(function() {
+  function bar(fn) {
+    return fn(1);
+  }
+
+  function foo(x) {
+    return bar(y => y == x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(0));
+  assertTrue(foo(object1));
+  assertThrows(() => foo(thrower));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(0));
+  assertTrue(foo(object1));
+  assertThrows(() => foo(thrower));
+})();
+
+// Test that JSLessThan is not context-sensitive.
+(function() {
+  function bar(fn) {
+    return fn(1);
+  }
+
+  function foo(x) {
+    return bar(y => y < x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(0));
+  assertFalse(foo(object1));
+  assertThrows(() => foo(thrower));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(0));
+  assertFalse(foo(object1));
+  assertThrows(() => foo(thrower));
+})();
+
+// Test that JSGreaterThan is not context-sensitive.
+(function() {
+  function bar(fn) {
+    return fn(1);
+  }
+
+  function foo(x) {
+    return bar(y => x > y);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(0));
+  assertFalse(foo(object1));
+  assertThrows(() => foo(thrower));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(0));
+  assertFalse(foo(object1));
+  assertThrows(() => foo(thrower));
+})();
+
+// Test that JSLessThanOrEqual is not context-sensitive.
+(function() {
+  function bar(fn) {
+    return fn(1);
+  }
+
+  function foo(x) {
+    return bar(y => y <= x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(0));
+  assertTrue(foo(object1));
+  assertThrows(() => foo(thrower));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(0));
+  assertTrue(foo(object1));
+  assertThrows(() => foo(thrower));
+})();
+
+// Test that JSGreaterThanOrEqual is not context-sensitive.
+(function() {
+  function bar(fn) {
+    return fn(1);
+  }
+
+  function foo(x) {
+    return bar(y => x >= y);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(0));
+  assertTrue(foo(object1));
+  assertThrows(() => foo(thrower));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(0));
+  assertTrue(foo(object1));
+  assertThrows(() => foo(thrower));
+})();
+
+// Test that JSInstanceOf is not context-sensitive.
+(function() {
+  function bar(fn) {
+    return fn({});
+  }
+
+  function foo(c) {
+    return bar(o => o instanceof c);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(Object));
+  assertFalse(foo(Array));
+  assertThrows(() => foo({[Symbol.hasInstance]() { throw new Error(); }}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(Object));
+  assertFalse(foo(Array));
+  assertThrows(() => foo({[Symbol.hasInstance]() { throw new Error(); }}));
+})();
+
+// Test that JSBitwiseNot is not context-sensitive.
+(function() {
+  function bar(fn) {
+    return fn();
+  }
+
+  function foo(x) {
+    return bar(() => ~x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(-1));
+  assertEquals(~1, foo(object1));
+  assertThrows(() => foo(thrower));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(-1));
+  assertEquals(~1, foo(object1));
+  assertThrows(() => foo(thrower));
+})();
+
+// Test that JSNegate is not context-sensitive.
+(function() {
+  function bar(fn) {
+    return fn();
+  }
+
+  function foo(x) {
+    return bar(() => -x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo(-1));
+  assertEquals(-1, foo(object1));
+  assertThrows(() => foo(thrower));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(-1));
+  assertEquals(-1, foo(object1));
+  assertThrows(() => foo(thrower));
+})();
+
+// Test that JSIncrement is not context-sensitive.
+(function() {
+  function bar(fn) {
+    return fn();
+  }
+
+  function foo(x) {
+    return bar(() => ++x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo(0));
+  assertEquals(2, foo(object1));
+  assertThrows(() => foo(thrower));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(0));
+  assertEquals(2, foo(object1));
+  assertThrows(() => foo(thrower));
+})();
+
+// Test that JSDecrement is not context-sensitive.
+(function() {
+  function bar(fn) {
+    return fn();
+  }
+
+  function foo(x) {
+    return bar(() => --x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo(2));
+  assertEquals(0, foo(object1));
+  assertThrows(() => foo(thrower));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(2));
+  assertEquals(0, foo(object1));
+  assertThrows(() => foo(thrower));
+})();
+
+// Test that JSCreateArguments[UnmappedArguments] is not context-sensitive.
+(function() {
+  function bar(fn) {
+    return fn();
+  }
+
+  function foo() {
+    "use strict";
+    return bar(() => arguments)[0];
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 2));
+  assertEquals(undefined, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 2));
+  assertEquals(undefined, foo());
+})();
+
+// Test that JSCreateArguments[RestParameters] is not context-sensitive.
+(function() {
+  function bar(fn) {
+    return fn();
+  }
+
+  function foo(...args) {
+    return bar(() => args)[0];
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 2));
+  assertEquals(undefined, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 2));
+  assertEquals(undefined, foo());
+})();
+
+// Test that JSLoadGlobal/JSStoreGlobal are not context-sensitive.
+(function(global) {
+  var actualValue = 'Some value';
+
+  Object.defineProperty(global, 'globalValue', {
+    configurable: true,
+    enumerable: true,
+    get: function() {
+      return actualValue;
+    },
+    set: function(v) {
+      actualValue = v;
+    }
+  });
+
+  function bar(fn) {
+    return fn();
+  }
+
+  function foo(v) {
+    return bar(() => {
+      const o = globalValue;
+      globalValue = v;
+      return o;
+    });
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals('Some value', foo('Another value'));
+  assertEquals('Another value', actualValue);
+  assertEquals('Another value', foo('Some value'));
+  assertEquals('Some value', actualValue);
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals('Some value', foo('Another value'));
+  assertEquals('Another value', actualValue);
+  assertEquals('Another value', foo('Some value'));
+  assertEquals('Some value', actualValue);
+})(this);
+
+// Test that for..in is not context-sensitive.
+(function() {
+  function bar(fn) {
+    return fn();
+  }
+
+  function foo(o) {
+    return bar(() => {
+      var s = "";
+      for (var k in o) { s += k; }
+      return s;
+    });
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals('abc', foo({a: 1, b: 2, c: 3}));
+  assertEquals('ab', foo(Object.create({a: 1, b: 2})));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals('abc', foo({a: 1, b: 2, c: 3}));
+  assertEquals("ab", foo(Object.create({a:1, b:2})));
+})();
+
+// Test that most generator operations are not context-sensitive.
+(function() {
+  function bar(fn) {
+    let s = undefined;
+    for (const x of fn()) {
+      if (s === undefined) s = x;
+      else s += x;
+    }
+    return s;
+  }
+
+  function foo(x, y, z) {
+    return bar(function*() {
+      yield x;
+      yield y;
+      yield z;
+    });
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(6, foo(1, 2, 3));
+  assertEquals("abc", foo("a", "b", "c"));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(6, foo(1, 2, 3));
+  assertEquals("abc", foo("a", "b", "c"));
+})();
diff --git a/src/v8/test/mjsunit/compiler/count-deopt.js b/src/v8/test/mjsunit/compiler/count-deopt.js
index 415dadc..c0977ca 100644
--- a/src/v8/test/mjsunit/compiler/count-deopt.js
+++ b/src/v8/test/mjsunit/compiler/count-deopt.js
@@ -42,6 +42,8 @@
 // Test deopt with count operation on named property.
 function inc2(p) { p.x++ }
 
+%PrepareFunctionForOptimization(inc2);
+
 o.x = "42";
 inc2(o);
 assertEquals(43, o.x);
@@ -60,6 +62,8 @@
 // Test deopt with count operation on keyed property.
 function inc3(a, b) { a[b]++; }
 
+%PrepareFunctionForOptimization(inc3);
+
 o = ["42"];
 inc3(o, 0);
 assertEquals(43, o[0]);
@@ -83,18 +87,21 @@
 for(var i = 0; i < 5; i++) {
   inc3(o, 0);
 }
+%PrepareFunctionForOptimization(inc3);
 %OptimizeFunctionOnNextCall(inc3);
 inc3(o, 0);
 inc3(o, 1);
 
 // Test bailout with count operation in a value context.
 function inc4(x,y) { return (x++) + y; }
+%PrepareFunctionForOptimization(inc4);
 for (var i = 0; i < 5; ++i) assertEquals(3, inc4(2, 1));
 %OptimizeFunctionOnNextCall(inc4);
 inc4(2, 1);
 assertEquals(3.1, inc4(2, 1.1));
 
 function inc5(x,y) { return (++x) + y; }
+%PrepareFunctionForOptimization(inc5);
 for (var i = 0; i < 5; ++i) assertEquals(4, inc5(2, 1));
 %OptimizeFunctionOnNextCall(inc5);
 assertEquals(4, inc5(2, 1));
@@ -102,6 +109,7 @@
 assertEquals(4.1, inc5(2.1, 1));
 
 function inc6(o,y) { return (o.x++) + y; }
+%PrepareFunctionForOptimization(inc6);
 o = {x:0};
 for (var i = 0; i < 5; ++i) {
   o.x = 42;
@@ -116,6 +124,7 @@
 assertEquals(43.1, inc6(o, 1));
 
 function inc7(o,y) { return (++o.x) + y; }
+%PrepareFunctionForOptimization(inc7);
 o = {x:0};
 for (var i = 0; i < 5; ++i) {
   o.x = 42;
@@ -130,6 +139,7 @@
 assertEquals(44.1, inc7(o, 1));
 
 function inc8(o,y) { return (o[0]++) + y; }
+%PrepareFunctionForOptimization(inc8);
 var q = [0];
 for (var i = 0; i < 5; ++i) {
   q[0] = 42;
@@ -144,6 +154,7 @@
 assertEquals(43.1, inc8(q, 1));
 
 function inc9(o,y) { return (++o[0]) + y; }
+%PrepareFunctionForOptimization(inc9);
 q = [0];
 for (var i = 0; i < 5; ++i) {
   q[0] = 42;
@@ -159,6 +170,7 @@
 
 // Test deopt because of a failed map check.
 function inc10(p) { return p.x++ }
+%PrepareFunctionForOptimization(inc10);
 var g1 = {x:0};
 var g2 = {y:0, x:42}
 for (var i = 0; i < 5; ++i) {
diff --git a/src/v8/test/mjsunit/compiler/dataview-constant.js b/src/v8/test/mjsunit/compiler/dataview-constant.js
new file mode 100644
index 0000000..5a93ca8
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/dataview-constant.js
@@ -0,0 +1,181 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Test DataView.prototype.getInt8()/setInt8() for constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setInt8(0, 42);
+  dv.setInt8(1, 24);
+
+  function foo(i) {
+    const x = dv.getInt8(i);
+    dv.setInt8(i, x+1);
+    return x;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(42, foo(0));
+  assertEquals(24, foo(1));
+  assertEquals(43, foo(0));
+  assertEquals(25, foo(1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(0));
+  assertEquals(26, foo(1));
+})();
+
+// Test DataView.prototype.getUint8()/setUint8() for constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setUint8(0, 42);
+  dv.setUint8(1, 24);
+
+  function foo(i) {
+    const x = dv.getUint8(i);
+    dv.setUint8(i, x+1);
+    return x;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(42, foo(0));
+  assertEquals(24, foo(1));
+  assertEquals(43, foo(0));
+  assertEquals(25, foo(1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(0));
+  assertEquals(26, foo(1));
+})();
+
+// Test DataView.prototype.getInt16()/setInt16() for constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setInt16(0, 42, true);
+  dv.setInt16(2, 24, true);
+
+  function foo(i) {
+    const x = dv.getInt16(i, true);
+    dv.setInt16(i, x+1, true);
+    return x;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(42, foo(0));
+  assertEquals(24, foo(2));
+  assertEquals(43, foo(0));
+  assertEquals(25, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(0));
+  assertEquals(26, foo(2));
+})();
+
+// Test DataView.prototype.getUint16()/setUint16() for constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setUint16(0, 42, true);
+  dv.setUint16(2, 24, true);
+
+  function foo(i) {
+    const x = dv.getUint16(i, true);
+    dv.setUint16(i, x+1, true);
+    return x;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(42, foo(0));
+  assertEquals(24, foo(2));
+  assertEquals(43, foo(0));
+  assertEquals(25, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(0));
+  assertEquals(26, foo(2));
+})();
+
+// Test DataView.prototype.getInt32()/setInt32() for constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setInt32(0, 42, true);
+  dv.setInt32(4, 24, true);
+
+  function foo(i) {
+    const x = dv.getInt32(i, true);
+    dv.setInt32(i, x+1, true);
+    return x;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(42, foo(0));
+  assertEquals(24, foo(4));
+  assertEquals(43, foo(0));
+  assertEquals(25, foo(4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(0));
+  assertEquals(26, foo(4));
+})();
+
+// Test DataView.prototype.getUint32()/setUint32() for constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setUint32(0, 42, true);
+  dv.setUint32(4, 24, true);
+
+  function foo(i) {
+    const x = dv.getUint32(i, true);
+    dv.setUint32(i, x+1, true);
+    return x;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(42, foo(0));
+  assertEquals(24, foo(4));
+  assertEquals(43, foo(0));
+  assertEquals(25, foo(4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(0));
+  assertEquals(26, foo(4));
+})();
+
+// Test DataView.prototype.getFloat32()/setFloat32() for constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setFloat32(0, 42, true);
+  dv.setFloat32(4, 24, true);
+
+  function foo(i) {
+    const x = dv.getFloat32(i, true);
+    dv.setFloat32(i, x+1, true);
+    return x;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(42, foo(0));
+  assertEquals(24, foo(4));
+  assertEquals(43, foo(0));
+  assertEquals(25, foo(4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(0));
+  assertEquals(26, foo(4));
+})();
+
+// Test DataView.prototype.getFloat64()/setFloat64() for constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setFloat64(0, 42, true);
+  dv.setFloat64(8, 24, true);
+
+  function foo(i) {
+    const x = dv.getFloat64(i, true);
+    dv.setFloat64(i, x+1, true);
+    return x;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(42, foo(0));
+  assertEquals(24, foo(8));
+  assertEquals(43, foo(0));
+  assertEquals(25, foo(8));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(0));
+  assertEquals(26, foo(8));
+})();
diff --git a/src/v8/test/mjsunit/compiler/dataview-deopt.js b/src/v8/test/mjsunit/compiler/dataview-deopt.js
new file mode 100644
index 0000000..3868fbb
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/dataview-deopt.js
@@ -0,0 +1,60 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt --no-stress-flush-bytecode
+
+// Check that there are no deopt loops for DataView methods.
+
+var buffer = new ArrayBuffer(64);
+var dataview = new DataView(buffer, 8, 24);
+
+// Check DataView getters.
+
+function readUint8(offset) {
+  return dataview.getUint8(offset);
+}
+
+function warmupRead(f) {
+  %PrepareFunctionForOptimization(f);
+  f(0);
+  f(1);
+  %OptimizeFunctionOnNextCall(f);
+  f(2);
+  f(3);
+}
+
+warmupRead(readUint8);
+assertOptimized(readUint8);
+readUint8(0.5); // Deopts.
+assertUnoptimized(readUint8);
+
+warmupRead(readUint8);
+assertOptimized(readUint8);
+readUint8(1.5); // Doesn't deopt because getUint8 didn't get inlined this time.
+assertOptimized(readUint8);
+
+// Check DataView setters.
+
+function writeUint8(offset, value) {
+  dataview.setUint8(offset, value);
+}
+
+function warmupWrite(f) {
+  %PrepareFunctionForOptimization(f);
+  f(0, 0);
+  f(0, 1);
+  %OptimizeFunctionOnNextCall(f);
+  f(0, 2);
+  f(0, 3);
+}
+
+warmupWrite(writeUint8);
+assertOptimized(writeUint8);
+writeUint8(0.5, 0); // Deopts.
+assertUnoptimized(writeUint8);
+
+warmupWrite(writeUint8);
+assertOptimized(writeUint8);
+writeUint8(1.5, 0); // Doesn't deopt.
+assertOptimized(writeUint8);
diff --git a/src/v8/test/mjsunit/compiler/dataview-get.js b/src/v8/test/mjsunit/compiler/dataview-get.js
new file mode 100644
index 0000000..6bfad2d
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/dataview-get.js
@@ -0,0 +1,187 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+var buffer = new ArrayBuffer(64);
+var dataview = new DataView(buffer, 8, 24);
+
+var values = [-1, 2, -3, 42];
+
+function readUint8(offset) {
+  return dataview.getUint8(offset);
+}
+
+function readInt8Handled(offset) {
+  try {
+    return dataview.getInt8(offset);
+  } catch (e) {
+    return e;
+  }
+}
+
+function readUint16(offset, little_endian) {
+  return dataview.getUint16(offset, little_endian);
+}
+
+function readInt16Handled(offset, little_endian) {
+  try {
+    return dataview.getInt16(offset, little_endian);
+  } catch (e) {
+    return e;
+  }
+}
+
+function readUint32(offset, little_endian) {
+  return dataview.getUint32(offset, little_endian);
+}
+
+function readInt32Handled(offset, little_endian) {
+  try {
+    return dataview.getInt32(offset, little_endian);
+  } catch (e) {
+    return e;
+  }
+}
+
+function readFloat32(offset, little_endian) {
+  return dataview.getFloat32(offset, little_endian);
+}
+
+function readFloat64(offset, little_endian) {
+  return dataview.getFloat64(offset, little_endian);
+}
+
+function warmup(f) {
+  %PrepareFunctionForOptimization(f);
+  f(0);
+  f(1);
+  %OptimizeFunctionOnNextCall(f);
+  f(2);
+  f(3);
+}
+
+// TurboFan valid getInt8.
+for (var i = 0; i < values.length; i++) {
+  dataview.setInt8(i, values[i]);
+}
+warmup(readInt8Handled);
+assertOptimized(readInt8Handled);
+assertEquals(values[0], readInt8Handled(0));
+assertEquals(values[1], readInt8Handled(1));
+assertEquals(values[2], readInt8Handled(2));
+assertEquals(values[3], readInt8Handled(3));
+
+// TurboFan valid getUint8.
+dataview.setUint32(4, 0xdeadbeef);
+warmup(readUint8);
+assertOptimized(readUint8);
+assertEquals(0xde, readUint8(4));
+assertEquals(0xad, readUint8(5));
+assertEquals(0xbe, readUint8(6));
+assertEquals(0xef, readUint8(7));
+
+// TurboFan valid getUint16.
+dataview.setUint16(8, 0xabcd);
+warmup(readUint16);
+assertOptimized(readUint16);
+assertEquals(0xabcd, readUint16(8));
+assertEquals(0xcdab, readUint16(8, true));
+
+// TurboFan valid getInt16.
+let b1 = -0x1234;
+dataview.setInt16(10, b1);
+warmup(readInt16Handled);
+assertOptimized(readInt16Handled);
+assertEquals(b1, readInt16Handled(10));
+dataview.setInt16(10, b1, true);
+assertEquals(b1, readInt16Handled(10, true));
+
+// TurboFan valid getUint32.
+dataview.setUint32(12, 0xabcdef12);
+warmup(readUint32);
+assertOptimized(readUint32);
+assertEquals(0xabcdef12, readUint32(12));
+assertEquals(0x12efcdab, readUint32(12, true));
+
+// TurboFan valid getInt32.
+let b2 = -0x12345678;
+dataview.setInt32(16, b2);
+warmup(readInt32Handled);
+assertOptimized(readInt32Handled);
+assertEquals(b2, readInt32Handled(16));
+dataview.setInt32(16, b2, true);
+assertEquals(b2, readInt32Handled(16, true));
+
+// TurboFan valid getFloat32.
+let b3 = Math.fround(Math.E); // Round Math.E to float32.
+dataview.setFloat32(16, b3);
+warmup(readFloat32);
+assertOptimized(readFloat32);
+assertEquals(b3, readFloat32(16));
+dataview.setFloat32(16, b3, true);
+assertEquals(b3, readFloat32(16, true));
+
+// TurboFan valid getFloat64.
+let b4 = Math.PI;
+dataview.setFloat64(16, b4);
+warmup(readFloat64);
+assertOptimized(readFloat64);
+assertEquals(b4, readFloat64(16));
+dataview.setFloat64(16, b4, true);
+assertEquals(b4, readFloat64(16, true));
+
+// TurboFan out of bounds reads deopt.
+assertOptimized(readInt8Handled);
+assertInstanceof(readInt8Handled(24), RangeError);
+assertUnoptimized(readInt8Handled);
+assertOptimized(readInt16Handled);
+assertInstanceof(readInt16Handled(23), RangeError);
+assertUnoptimized(readInt16Handled);
+assertOptimized(readInt32Handled);
+assertInstanceof(readInt32Handled(21), RangeError);
+assertUnoptimized(readInt32Handled);
+
+// Without exception handler.
+assertOptimized(readUint8);
+assertThrows(() => readUint8(24));
+assertUnoptimized(readUint8);
+assertOptimized(readFloat32);
+assertThrows(() => readFloat32(21));
+assertUnoptimized(readFloat32);
+assertOptimized(readFloat64);
+assertThrows(() => readFloat64(17));
+assertUnoptimized(readFloat64);
+
+// Negative Smi deopts.
+(function() {
+  function readInt8Handled(offset) {
+    try { return dataview.getInt8(offset); } catch (e) { return e; }
+  }
+  warmup(readInt8Handled);
+  assertOptimized(readInt8Handled);
+  assertInstanceof(readInt8Handled(-1), RangeError);
+  assertUnoptimized(readInt8Handled);
+})();
+
+// Non-Smi index deopts.
+(function() {
+  function readUint8(offset) { return dataview.getUint8(offset); }
+  warmup(readUint8);
+  assertOptimized(readUint8);
+  assertEquals(values[3], readUint8(3.14));
+  assertUnoptimized(readUint8);
+})();
+
+// TurboFan detached buffer deopts.
+(function() {
+  function readInt8Handled(offset) {
+    try { return dataview.getInt8(offset); } catch (e) { return e; }
+  }
+  warmup(readInt8Handled);
+  assertOptimized(readInt8Handled);
+  %ArrayBufferDetach(buffer);
+  assertInstanceof(readInt8Handled(0), TypeError);
+  assertUnoptimized(readInt8Handled);
+})();
diff --git a/src/v8/test/mjsunit/compiler/dataview-neutered.js b/src/v8/test/mjsunit/compiler/dataview-neutered.js
new file mode 100644
index 0000000..b5fe310
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/dataview-neutered.js
@@ -0,0 +1,408 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --noalways-opt --no-stress-flush-bytecode
+
+// Invalidate the detaching protector.
+%ArrayBufferDetach(new ArrayBuffer(1));
+
+// Check DataView.prototype.getInt8() optimization.
+(function() {
+  const ab = new ArrayBuffer(1);
+  const dv = new DataView(ab);
+
+  function foo(dv) {
+    return dv.getInt8(0);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(dv));
+  assertEquals(0, foo(dv));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(dv));
+  assertOptimized(foo);
+  %ArrayBufferDetach(ab);
+  assertThrows(() => foo(dv), TypeError);
+  assertUnoptimized(foo);
+  %PrepareFunctionForOptimization(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.getUint8() optimization.
+(function() {
+  const ab = new ArrayBuffer(1);
+  const dv = new DataView(ab);
+
+  function foo(dv) {
+    return dv.getUint8(0);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(dv));
+  assertEquals(0, foo(dv));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(dv));
+  assertOptimized(foo);
+  %ArrayBufferDetach(ab);
+  assertThrows(() => foo(dv), TypeError);
+  assertUnoptimized(foo);
+  %PrepareFunctionForOptimization(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.getInt16() optimization.
+(function() {
+  const ab = new ArrayBuffer(2);
+  const dv = new DataView(ab);
+
+  function foo(dv) {
+    return dv.getInt16(0, true);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(dv));
+  assertEquals(0, foo(dv));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(dv));
+  assertOptimized(foo);
+  %ArrayBufferDetach(ab);
+  assertThrows(() => foo(dv), TypeError);
+  assertUnoptimized(foo);
+  %PrepareFunctionForOptimization(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.getUint16() optimization.
+(function() {
+  const ab = new ArrayBuffer(2);
+  const dv = new DataView(ab);
+
+  function foo(dv) {
+    return dv.getUint16(0, true);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(dv));
+  assertEquals(0, foo(dv));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(dv));
+  assertOptimized(foo);
+  %ArrayBufferDetach(ab);
+  assertThrows(() => foo(dv), TypeError);
+  assertUnoptimized(foo);
+  %PrepareFunctionForOptimization(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.getInt32() optimization.
+(function() {
+  const ab = new ArrayBuffer(4);
+  const dv = new DataView(ab);
+
+  function foo(dv) {
+    return dv.getInt32(0, true);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(dv));
+  assertEquals(0, foo(dv));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(dv));
+  assertOptimized(foo);
+  %ArrayBufferDetach(ab);
+  assertThrows(() => foo(dv), TypeError);
+  assertUnoptimized(foo);
+  %PrepareFunctionForOptimization(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.getUint32() optimization.
+(function() {
+  const ab = new ArrayBuffer(4);
+  const dv = new DataView(ab);
+
+  function foo(dv) {
+    return dv.getUint32(0, true);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(dv));
+  assertEquals(0, foo(dv));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(dv));
+  assertOptimized(foo);
+  %ArrayBufferDetach(ab);
+  assertThrows(() => foo(dv), TypeError);
+  assertUnoptimized(foo);
+  %PrepareFunctionForOptimization(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.getFloat32() optimization.
+(function() {
+  const ab = new ArrayBuffer(4);
+  const dv = new DataView(ab);
+
+  function foo(dv) {
+    return dv.getFloat32(0, true);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(dv));
+  assertEquals(0, foo(dv));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(dv));
+  assertOptimized(foo);
+  %ArrayBufferDetach(ab);
+  assertThrows(() => foo(dv), TypeError);
+  assertUnoptimized(foo);
+  %PrepareFunctionForOptimization(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.getFloat64() optimization.
+(function() {
+  const ab = new ArrayBuffer(8);
+  const dv = new DataView(ab);
+
+  function foo(dv) {
+    return dv.getFloat64(0, true);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(dv));
+  assertEquals(0, foo(dv));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(dv));
+  assertOptimized(foo);
+  %ArrayBufferDetach(ab);
+  assertThrows(() => foo(dv), TypeError);
+  assertUnoptimized(foo);
+  %PrepareFunctionForOptimization(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.setInt8() optimization.
+(function() {
+  const ab = new ArrayBuffer(1);
+  const dv = new DataView(ab);
+
+  function foo(dv, x) {
+    return dv.setInt8(0, x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(undefined, foo(dv, 1));
+  assertEquals(1, dv.getInt8(0));
+  assertEquals(undefined, foo(dv, 2));
+  assertEquals(2, dv.getInt8(0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(undefined, foo(dv, 3));
+  assertOptimized(foo);
+  %ArrayBufferDetach(ab);
+  assertThrows(() => foo(dv, 4), TypeError);
+  assertUnoptimized(foo);
+  %PrepareFunctionForOptimization(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv, 5), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.setUint8() optimization.
+(function() {
+  const ab = new ArrayBuffer(1);
+  const dv = new DataView(ab);
+
+  function foo(dv, x) {
+    return dv.setUint8(0, x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(undefined, foo(dv, 1));
+  assertEquals(1, dv.getUint8(0));
+  assertEquals(undefined, foo(dv, 2));
+  assertEquals(2, dv.getUint8(0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(undefined, foo(dv, 3));
+  assertOptimized(foo);
+  %ArrayBufferDetach(ab);
+  assertThrows(() => foo(dv, 4), TypeError);
+  assertUnoptimized(foo);
+  %PrepareFunctionForOptimization(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv, 5), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.setInt16() optimization.
+(function() {
+  const ab = new ArrayBuffer(2);
+  const dv = new DataView(ab);
+
+  function foo(dv, x) {
+    return dv.setInt16(0, x, true);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(undefined, foo(dv, 1));
+  assertEquals(1, dv.getInt16(0, true));
+  assertEquals(undefined, foo(dv, 2));
+  assertEquals(2, dv.getInt16(0, true));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(undefined, foo(dv, 3));
+  assertOptimized(foo);
+  %ArrayBufferDetach(ab);
+  assertThrows(() => foo(dv, 4), TypeError);
+  assertUnoptimized(foo);
+  %PrepareFunctionForOptimization(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv, 5), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.setUint16() optimization.
+(function() {
+  const ab = new ArrayBuffer(2);
+  const dv = new DataView(ab);
+
+  function foo(dv, x) {
+    return dv.setUint16(0, x, true);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(undefined, foo(dv, 1));
+  assertEquals(1, dv.getUint16(0, true));
+  assertEquals(undefined, foo(dv, 2));
+  assertEquals(2, dv.getUint16(0, true));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(undefined, foo(dv, 3));
+  assertOptimized(foo);
+  %ArrayBufferDetach(ab);
+  assertThrows(() => foo(dv, 4), TypeError);
+  assertUnoptimized(foo);
+  %PrepareFunctionForOptimization(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv, 5), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.setInt32() optimization.
+(function() {
+  const ab = new ArrayBuffer(4);
+  const dv = new DataView(ab);
+
+  function foo(dv, x) {
+    return dv.setInt32(0, x, true);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(undefined, foo(dv, 1));
+  assertEquals(1, dv.getInt32(0, true));
+  assertEquals(undefined, foo(dv, 2));
+  assertEquals(2, dv.getInt32(0, true));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(undefined, foo(dv, 3));
+  assertOptimized(foo);
+  %ArrayBufferDetach(ab);
+  assertThrows(() => foo(dv, 4), TypeError);
+  assertUnoptimized(foo);
+  %PrepareFunctionForOptimization(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv, 5), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.setUint32() optimization.
+(function() {
+  const ab = new ArrayBuffer(4);
+  const dv = new DataView(ab);
+
+  function foo(dv, x) {
+    return dv.setUint32(0, x, true);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(undefined, foo(dv, 1));
+  assertEquals(1, dv.getUint32(0, true));
+  assertEquals(undefined, foo(dv, 2));
+  assertEquals(2, dv.getUint32(0, true));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(undefined, foo(dv, 3));
+  assertOptimized(foo);
+  %ArrayBufferDetach(ab);
+  assertThrows(() => foo(dv, 4), TypeError);
+  assertUnoptimized(foo);
+  %PrepareFunctionForOptimization(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv, 5), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.setFloat32() optimization.
+(function() {
+  const ab = new ArrayBuffer(4);
+  const dv = new DataView(ab);
+
+  function foo(dv, x) {
+    return dv.setFloat32(0, x, true);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(undefined, foo(dv, 1));
+  assertEquals(1, dv.getFloat32(0, true));
+  assertEquals(undefined, foo(dv, 2));
+  assertEquals(2, dv.getFloat32(0, true));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(undefined, foo(dv, 3));
+  assertOptimized(foo);
+  %ArrayBufferDetach(ab);
+  assertThrows(() => foo(dv, 4), TypeError);
+  assertUnoptimized(foo);
+  %PrepareFunctionForOptimization(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv, 5), TypeError);
+  assertOptimized(foo);
+})();
+
+// Check DataView.prototype.setFloat64() optimization.
+(function() {
+  const ab = new ArrayBuffer(8);
+  const dv = new DataView(ab);
+
+  function foo(dv, x) {
+    return dv.setFloat64(0, x, true);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(undefined, foo(dv, 1));
+  assertEquals(1, dv.getFloat64(0, true));
+  assertEquals(undefined, foo(dv, 2));
+  assertEquals(2, dv.getFloat64(0, true));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(undefined, foo(dv, 3));
+  assertOptimized(foo);
+  %ArrayBufferDetach(ab);
+  assertThrows(() => foo(dv, 4), TypeError);
+  assertUnoptimized(foo);
+  %PrepareFunctionForOptimization(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(dv, 5), TypeError);
+  assertOptimized(foo);
+})();
diff --git a/src/v8/test/mjsunit/compiler/dataview-nonconstant.js b/src/v8/test/mjsunit/compiler/dataview-nonconstant.js
new file mode 100644
index 0000000..7d05ea4
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/dataview-nonconstant.js
@@ -0,0 +1,181 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Test DataView.prototype.getInt8()/setInt8() for non-constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setInt8(0, 42);
+  dv.setInt8(1, 24);
+
+  function foo(dv, i) {
+    const x = dv.getInt8(i);
+    dv.setInt8(i, x+1);
+    return x;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(42, foo(dv, 0));
+  assertEquals(24, foo(dv, 1));
+  assertEquals(43, foo(dv, 0));
+  assertEquals(25, foo(dv, 1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(dv, 0));
+  assertEquals(26, foo(dv, 1));
+})();
+
+// Test DataView.prototype.getUint8()/setUint8() for non-constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setUint8(0, 42);
+  dv.setUint8(1, 24);
+
+  function foo(dv, i) {
+    const x = dv.getUint8(i);
+    dv.setUint8(i, x+1);
+    return x;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(42, foo(dv, 0));
+  assertEquals(24, foo(dv, 1));
+  assertEquals(43, foo(dv, 0));
+  assertEquals(25, foo(dv, 1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(dv, 0));
+  assertEquals(26, foo(dv, 1));
+})();
+
+// Test DataView.prototype.getInt16()/setInt16() for non-constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setInt16(0, 42, true);
+  dv.setInt16(2, 24, true);
+
+  function foo(dv, i) {
+    const x = dv.getInt16(i, true);
+    dv.setInt16(i, x+1, true);
+    return x;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(42, foo(dv, 0));
+  assertEquals(24, foo(dv, 2));
+  assertEquals(43, foo(dv, 0));
+  assertEquals(25, foo(dv, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(dv, 0));
+  assertEquals(26, foo(dv, 2));
+})();
+
+// Test DataView.prototype.getUint16()/setUint16() for non-constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setUint16(0, 42, true);
+  dv.setUint16(2, 24, true);
+
+  function foo(dv, i) {
+    const x = dv.getUint16(i, true);
+    dv.setUint16(i, x+1, true);
+    return x;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(42, foo(dv, 0));
+  assertEquals(24, foo(dv, 2));
+  assertEquals(43, foo(dv, 0));
+  assertEquals(25, foo(dv, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(dv, 0));
+  assertEquals(26, foo(dv, 2));
+})();
+
+// Test DataView.prototype.getInt32()/setInt32() for non-constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setInt32(0, 42, true);
+  dv.setInt32(4, 24, true);
+
+  function foo(dv, i) {
+    const x = dv.getInt32(i, true);
+    dv.setInt32(i, x+1, true);
+    return x;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(42, foo(dv, 0));
+  assertEquals(24, foo(dv, 4));
+  assertEquals(43, foo(dv, 0));
+  assertEquals(25, foo(dv, 4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(dv, 0));
+  assertEquals(26, foo(dv, 4));
+})();
+
+// Test DataView.prototype.getUint32()/setUint32() for non-constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setUint32(0, 42, true);
+  dv.setUint32(4, 24, true);
+
+  function foo(dv, i) {
+    const x = dv.getUint32(i, true);
+    dv.setUint32(i, x+1, true);
+    return x;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(42, foo(dv, 0));
+  assertEquals(24, foo(dv, 4));
+  assertEquals(43, foo(dv, 0));
+  assertEquals(25, foo(dv, 4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(dv, 0));
+  assertEquals(26, foo(dv, 4));
+})();
+
+// Test DataView.prototype.getFloat32()/setFloat32() for non-constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setFloat32(0, 42, true);
+  dv.setFloat32(4, 24, true);
+
+  function foo(dv, i) {
+    const x = dv.getFloat32(i, true);
+    dv.setFloat32(i, x+1, true);
+    return x;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(42, foo(dv, 0));
+  assertEquals(24, foo(dv, 4));
+  assertEquals(43, foo(dv, 0));
+  assertEquals(25, foo(dv, 4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(dv, 0));
+  assertEquals(26, foo(dv, 4));
+})();
+
+// Test DataView.prototype.getFloat64()/setFloat64() for non-constant DataViews.
+(function() {
+  const dv = new DataView(new ArrayBuffer(1024));
+  dv.setFloat64(0, 42, true);
+  dv.setFloat64(8, 24, true);
+
+  function foo(dv, i) {
+    const x = dv.getFloat64(i, true);
+    dv.setFloat64(i, x+1, true);
+    return x;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(42, foo(dv, 0));
+  assertEquals(24, foo(dv, 8));
+  assertEquals(43, foo(dv, 0));
+  assertEquals(25, foo(dv, 8));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(44, foo(dv, 0));
+  assertEquals(26, foo(dv, 8));
+})();
diff --git a/src/v8/test/mjsunit/compiler/dataview-set.js b/src/v8/test/mjsunit/compiler/dataview-set.js
new file mode 100644
index 0000000..8cd3bf1
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/dataview-set.js
@@ -0,0 +1,134 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+var buffer = new ArrayBuffer(64);
+var dataview = new DataView(buffer, 8, 24);
+
+function writeUint8(offset, value) {
+  dataview.setUint8(offset, value);
+}
+
+function writeInt8Handled(offset, value) {
+  try {
+    dataview.setInt8(offset, value);
+  } catch(e) {
+    return e;
+  }
+}
+
+function writeUint16(offset, value, little_endian) {
+  dataview.setUint16(offset, value, little_endian);
+}
+
+function writeInt16(offset, value, little_endian) {
+  dataview.setInt16(offset, value, little_endian);
+}
+
+function writeUint32(offset, value, little_endian) {
+  dataview.setUint32(offset, value, little_endian);
+}
+
+function writeInt32(offset, value, little_endian) {
+  dataview.setInt32(offset, value, little_endian);
+}
+
+function writeFloat32(offset, value, little_endian) {
+  dataview.setFloat32(offset, value, little_endian);
+}
+
+function writeFloat64(offset, value, little_endian) {
+  dataview.setFloat64(offset, value, little_endian);
+}
+
+function warmup(f) {
+  %PrepareFunctionForOptimization(f);
+  f(0, 0);
+  f(0, 1);
+  %OptimizeFunctionOnNextCall(f);
+  f(0, 2);
+  f(0, 3);
+}
+
+// TurboFan valid setUint8.
+warmup(writeUint8);
+assertOptimized(writeUint8);
+writeUint8(0, 0xde);
+writeUint8(1, 0xad);
+writeUint8(2, 0xbe);
+writeUint8(3, 0xef);
+assertEquals(0xdeadbeef, dataview.getUint32(0));
+
+// TurboFan valid setInt8.
+warmup(writeInt8Handled);
+assertOptimized(writeInt8Handled);
+writeInt8Handled(0, -34);
+writeInt8Handled(1, -83);
+writeInt8Handled(2, -66);
+writeInt8Handled(3, -17);
+assertEquals(0xdeadbeef, dataview.getUint32(0));
+
+// TurboFan valid setUint16.
+warmup(writeUint16);
+assertOptimized(writeUint16);
+writeUint16(0, 0xdead);
+writeUint16(2, 0xefbe, true);
+assertEquals(0xdeadbeef, dataview.getUint32(0));
+
+// TurboFan valid setInt16.
+warmup(writeInt16);
+assertOptimized(writeInt16);
+writeInt16(0, -8531);
+writeInt16(2, -4162, true);
+assertEquals(0xdeadbeef, dataview.getUint32(0));
+
+// TurboFan valid setUint32.
+warmup(writeUint32);
+assertOptimized(writeUint32);
+writeUint32(0, 0xdeadbeef);
+assertEquals(0xdeadbeef, dataview.getUint32(0));
+writeUint32(0, 0xefbeadde, true);
+assertEquals(0xdeadbeef, dataview.getUint32(0));
+
+// TurboFan valid setInt32.
+warmup(writeInt32);
+assertOptimized(writeInt32);
+writeInt32(0, -559038737);
+assertEquals(0xdeadbeef, dataview.getUint32(0));
+writeInt32(0, -272716322, true);
+assertEquals(0xdeadbeef, dataview.getUint32(0));
+
+// TurboFan valid setFloat32.
+let b3 = Math.fround(Math.E); // Round Math.E to float32.
+warmup(writeFloat32);
+assertOptimized(writeFloat32);
+writeFloat32(4, b3);
+assertEquals(b3, dataview.getFloat32(4));
+writeFloat32(4, b3, true);
+assertEquals(b3, dataview.getFloat32(4, true));
+
+// TurboFan valid setFloat64.
+let b4 = Math.PI;
+warmup(writeFloat64);
+assertOptimized(writeFloat64);
+writeFloat64(8, b4);
+assertEquals(b4, dataview.getFloat64(8));
+writeFloat64(8, b4, true);
+assertEquals(b4, dataview.getFloat64(8, true));
+
+// TurboFan out of bounds read, deopt.
+assertOptimized(writeInt8Handled);
+assertInstanceof(writeInt8Handled(24, 0), RangeError);
+assertUnoptimized(writeInt8Handled);
+
+// Without exception handler, deopt too.
+assertOptimized(writeUint8);
+assertThrows(() => writeUint8(24, 0));
+assertUnoptimized(writeUint8);
+
+// None of the stores wrote out of bounds.
+var bytes = new Uint8Array(buffer);
+for (var i = 0; i < 8; i++) assertEquals(0, bytes[i]);
+for (var i = 32; i < 64; i++) assertEquals(0, bytes[i]);
diff --git a/src/v8/test/mjsunit/compiler/dead-code6.js b/src/v8/test/mjsunit/compiler/dead-code6.js
index ec9b843..d36818f 100644
--- a/src/v8/test/mjsunit/compiler/dead-code6.js
+++ b/src/v8/test/mjsunit/compiler/dead-code6.js
@@ -57,16 +57,19 @@
     return a;
 }
 
+%PrepareFunctionForOptimization(dead1);
 assertTrue(dead1(33, 32) == 33);
 assertTrue(dead1(33, 32) == 33);
 %OptimizeFunctionOnNextCall(dead1);
 assertTrue(dead1(33, 32) == 33);
 
+%PrepareFunctionForOptimization(dead2);
 assertTrue(dead2(34, 11) == 34);
 assertTrue(dead2(34, 11) == 34);
 %OptimizeFunctionOnNextCall(dead2);
 assertTrue(dead2(34, 11) == 34);
 
+%PrepareFunctionForOptimization(dead3);
 assertTrue(dead3(35, 12) == 35);
 assertTrue(dead3(35, 12) == 35);
 %OptimizeFunctionOnNextCall(dead3);
diff --git a/src/v8/test/mjsunit/compiler/dead-loops-neg.js b/src/v8/test/mjsunit/compiler/dead-loops-neg.js
index dbf500b..67acd90 100644
--- a/src/v8/test/mjsunit/compiler/dead-loops-neg.js
+++ b/src/v8/test/mjsunit/compiler/dead-loops-neg.js
@@ -83,6 +83,7 @@
 
 for (var i = 0; i < no_params_loops.length; i++) {
   var f = no_params_loops[i];
+  %PrepareFunctionForOptimization(f);
   f();
   f();
   f();
@@ -92,6 +93,7 @@
 
 for (var i = 0; i < params_loops.length; i++) {
   var f = params_loops[i];
+  %PrepareFunctionForOptimization(f);
   f(3);
   f(7);
   f(11);
diff --git a/src/v8/test/mjsunit/compiler/dead-loops.js b/src/v8/test/mjsunit/compiler/dead-loops.js
index 2301b12..878f908 100644
--- a/src/v8/test/mjsunit/compiler/dead-loops.js
+++ b/src/v8/test/mjsunit/compiler/dead-loops.js
@@ -80,6 +80,7 @@
 
 for (var i = 0; i < loops.length; i++) {
   var f = loops[i];
+  %PrepareFunctionForOptimization(f);
   f();
   f();
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/dead-string-add-warm.js b/src/v8/test/mjsunit/compiler/dead-string-add-warm.js
index c211ebd..4abe641 100644
--- a/src/v8/test/mjsunit/compiler/dead-string-add-warm.js
+++ b/src/v8/test/mjsunit/compiler/dead-string-add-warm.js
@@ -68,9 +68,14 @@
   assertEquals("1", dead3("true", 0));
 }
 
+%PrepareFunctionForOptimization(dead1);
 run();
 run();
 %OptimizeFunctionOnNextCall(dead1);
+run();
+%PrepareFunctionForOptimization(dead2);
 %OptimizeFunctionOnNextCall(dead2);
+run();
+%PrepareFunctionForOptimization(dead3);
 %OptimizeFunctionOnNextCall(dead3);
 run();
diff --git a/src/v8/test/mjsunit/compiler/deopt-accessors1.js b/src/v8/test/mjsunit/compiler/deopt-accessors1.js
index 3589258..a1cbb88 100644
--- a/src/v8/test/mjsunit/compiler/deopt-accessors1.js
+++ b/src/v8/test/mjsunit/compiler/deopt-accessors1.js
@@ -21,6 +21,7 @@
   return o.x++;
 }
 
+%PrepareFunctionForOptimization(foo);
 assertEquals(1, foo(o));
 assertEquals(2, foo(o));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/deopt-accessors2.js b/src/v8/test/mjsunit/compiler/deopt-accessors2.js
index 74d4139..580d287 100644
--- a/src/v8/test/mjsunit/compiler/deopt-accessors2.js
+++ b/src/v8/test/mjsunit/compiler/deopt-accessors2.js
@@ -21,6 +21,7 @@
   return ++o.x;
 }
 
+%PrepareFunctionForOptimization(foo);
 assertEquals(2, foo(o));
 assertEquals(3, foo(o));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/deopt-accessors3.js b/src/v8/test/mjsunit/compiler/deopt-accessors3.js
index 035cf2b..33f7607 100644
--- a/src/v8/test/mjsunit/compiler/deopt-accessors3.js
+++ b/src/v8/test/mjsunit/compiler/deopt-accessors3.js
@@ -22,6 +22,7 @@
   return o[x]++;
 }
 
+%PrepareFunctionForOptimization(foo);
 assertEquals(1, foo(o));
 assertEquals(2, foo(o));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/deopt-accessors4.js b/src/v8/test/mjsunit/compiler/deopt-accessors4.js
index 5a8453f..2c2b98a 100644
--- a/src/v8/test/mjsunit/compiler/deopt-accessors4.js
+++ b/src/v8/test/mjsunit/compiler/deopt-accessors4.js
@@ -22,6 +22,7 @@
   return ++o[x];
 }
 
+%PrepareFunctionForOptimization(foo);
 assertEquals(2, foo(o));
 assertEquals(3, foo(o));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/deopt-accessors5.js b/src/v8/test/mjsunit/compiler/deopt-accessors5.js
index bf71585..2334c9b 100644
--- a/src/v8/test/mjsunit/compiler/deopt-accessors5.js
+++ b/src/v8/test/mjsunit/compiler/deopt-accessors5.js
@@ -17,6 +17,7 @@
   assertEquals(1, o.q = 1);
 }
 
+%PrepareFunctionForOptimization(test);
 test();
 test();
 %OptimizeFunctionOnNextCall(test);
diff --git a/src/v8/test/mjsunit/compiler/deopt-accessors6.js b/src/v8/test/mjsunit/compiler/deopt-accessors6.js
index 784123a..059402e 100644
--- a/src/v8/test/mjsunit/compiler/deopt-accessors6.js
+++ b/src/v8/test/mjsunit/compiler/deopt-accessors6.js
@@ -18,6 +18,7 @@
   assertEquals(1, o[q] = 1);
 }
 
+%PrepareFunctionForOptimization(test);
 test();
 test();
 %OptimizeFunctionOnNextCall(test);
diff --git a/src/v8/test/mjsunit/compiler/deopt-accessors7.js b/src/v8/test/mjsunit/compiler/deopt-accessors7.js
index 8c7d7a1..a40c9a5 100644
--- a/src/v8/test/mjsunit/compiler/deopt-accessors7.js
+++ b/src/v8/test/mjsunit/compiler/deopt-accessors7.js
@@ -21,6 +21,7 @@
   return bar(1, (o[x], 2), 3);
 }
 
+%PrepareFunctionForOptimization(foo);
 assertEquals(4, foo(o, "v"));
 assertEquals(4, foo(o, "v"));
 assertEquals(4, foo(o, "x"));
diff --git a/src/v8/test/mjsunit/compiler/deopt-args.js b/src/v8/test/mjsunit/compiler/deopt-args.js
index 17c397c..8673465 100644
--- a/src/v8/test/mjsunit/compiler/deopt-args.js
+++ b/src/v8/test/mjsunit/compiler/deopt-args.js
@@ -35,6 +35,7 @@
   return 42;
 }
 
+%PrepareFunctionForOptimization(g);
 var object = { };
 object.f = f;
 for (var i = 0; i < 5; i++) {
diff --git a/src/v8/test/mjsunit/compiler/deopt-array-builtins.js b/src/v8/test/mjsunit/compiler/deopt-array-builtins.js
index b737b17..68158e0 100644
--- a/src/v8/test/mjsunit/compiler/deopt-array-builtins.js
+++ b/src/v8/test/mjsunit/compiler/deopt-array-builtins.js
@@ -13,10 +13,12 @@
     function g() {
         [1,2,3].forEach(f);
     }
+    %PrepareFunctionForOptimization(g);
     g();
     g();
     %OptimizeFunctionOnNextCall(g);
     g();
+    %PrepareFunctionForOptimization(g);
     %OptimizeFunctionOnNextCall(g);
     g();
     assertOptimized(g);
@@ -31,10 +33,12 @@
     function g() {
         [1,2,3].find(f);
     }
+    %PrepareFunctionForOptimization(g);
     g();
     g();
     %OptimizeFunctionOnNextCall(g);
     g();
+    %PrepareFunctionForOptimization(g);
     %OptimizeFunctionOnNextCall(g);
     g();
     assertOptimized(g);
@@ -48,10 +52,12 @@
     function g() {
         [1,2,3].map(f);
     }
+    %PrepareFunctionForOptimization(g);
     g();
     g();
     %OptimizeFunctionOnNextCall(g);
     g();
+    %PrepareFunctionForOptimization(g);
     %OptimizeFunctionOnNextCall(g);
     g();
     assertOptimized(g);
@@ -65,10 +71,12 @@
     function g() {
         [1,2,3].filter(f);
     }
+    %PrepareFunctionForOptimization(g);
     g();
     g();
     %OptimizeFunctionOnNextCall(g);
     g();
+    %PrepareFunctionForOptimization(g);
     %OptimizeFunctionOnNextCall(g);
     g();
     assertOptimized(g);
@@ -84,10 +92,12 @@
     function g() {
         [1,2,3].forEach(f);
     }
+    %PrepareFunctionForOptimization(g);
     g();
     g();
     %OptimizeFunctionOnNextCall(g);
     g();
+    %PrepareFunctionForOptimization(g);
     %OptimizeFunctionOnNextCall(g);
     g();
     assertOptimized(g);
@@ -102,10 +112,12 @@
     function g() {
         [1,2,3].find(f);
     }
+    %PrepareFunctionForOptimization(g);
     g();
     g();
     %OptimizeFunctionOnNextCall(g);
     g();
+    %PrepareFunctionForOptimization(g);
     %OptimizeFunctionOnNextCall(g);
     g();
     assertOptimized(g);
@@ -119,10 +131,12 @@
     function g() {
         [1,2,3].map(f);
     }
+    %PrepareFunctionForOptimization(g);
     g();
     g();
     %OptimizeFunctionOnNextCall(g);
     g();
+    %PrepareFunctionForOptimization(g);
     %OptimizeFunctionOnNextCall(g);
     g();
     assertOptimized(g);
@@ -136,11 +150,13 @@
     function g() {
         [1,2,3].filter(f);
     }
+    %PrepareFunctionForOptimization(g);
     g();
     g();
     %OptimizeFunctionOnNextCall(g);
     g();
     g();
+    %PrepareFunctionForOptimization(g);
     %OptimizeFunctionOnNextCall(g);
     g();
     g();
diff --git a/src/v8/test/mjsunit/compiler/deopt-array-iterator-prototype-next.js b/src/v8/test/mjsunit/compiler/deopt-array-iterator-prototype-next.js
new file mode 100644
index 0000000..430bb80
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/deopt-array-iterator-prototype-next.js
@@ -0,0 +1,25 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+/* Test deopt behaviors when the prototype has elements */
+
+(function () {
+  var array = [,];
+
+  function next() {
+    return array[Symbol.iterator]().next();
+  }
+
+  %PrepareFunctionForOptimization(next);
+  assertEquals(next().value, undefined);
+  assertEquals(next().value, undefined);
+
+  %OptimizeFunctionOnNextCall(next);
+  assertEquals(next().value, undefined);
+
+  array.__proto__.push(5);
+  assertEquals(next().value, 5);
+})();
diff --git a/src/v8/test/mjsunit/compiler/deopt-array-prototype-every.js b/src/v8/test/mjsunit/compiler/deopt-array-prototype-every.js
new file mode 100644
index 0000000..693d75d
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/deopt-array-prototype-every.js
@@ -0,0 +1,27 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+/* Test deopt behaviors when the prototype has elements */
+
+// every
+
+(function () {
+  var array = [,];
+
+  function every() {
+    return array.every(v => v > 0);
+  }
+
+  %PrepareFunctionForOptimization(every);
+  every(); every();
+
+  %OptimizeFunctionOnNextCall(every);
+  assertEquals(every(), true);
+
+  array.__proto__.push(-6);
+  //deopt
+  assertEquals(every(), false);
+})();
diff --git a/src/v8/test/mjsunit/compiler/deopt-array-prototype-filter.js b/src/v8/test/mjsunit/compiler/deopt-array-prototype-filter.js
new file mode 100644
index 0000000..232a3c2
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/deopt-array-prototype-filter.js
@@ -0,0 +1,29 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+/* Test deopt behaviors when the prototype has elements */
+
+// filter
+
+(function () {
+  var array = [,];
+
+  function filter() {
+    return array.filter(v => v > 0);
+  }
+
+  %PrepareFunctionForOptimization(filter);
+  filter(); filter();
+
+  %OptimizeFunctionOnNextCall(filter);
+  assertEquals(filter(), []);
+
+  array.__proto__.push(6);
+  // deopt
+  var narr = filter();
+  assertNotEquals(Object.getOwnPropertyDescriptor(narr, 0), undefined);
+  assertEquals(narr, [6]);
+})();
diff --git a/src/v8/test/mjsunit/compiler/deopt-array-prototype-find.js b/src/v8/test/mjsunit/compiler/deopt-array-prototype-find.js
new file mode 100644
index 0000000..c12b977
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/deopt-array-prototype-find.js
@@ -0,0 +1,27 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+/* Test deopt behaviors when the prototype has elements */
+
+// find
+
+(function () {
+  var array = [,];
+
+  function find() {
+    return array.find(v => v > 0);
+  }
+
+  %PrepareFunctionForOptimization(find);
+  find(); find();
+
+  %OptimizeFunctionOnNextCall(find);
+  assertEquals(find(), undefined);
+
+  array.__proto__.push(6);
+  // deopt
+  assertEquals(find(), 6);
+})();
diff --git a/src/v8/test/mjsunit/compiler/deopt-array-prototype-findindex.js b/src/v8/test/mjsunit/compiler/deopt-array-prototype-findindex.js
new file mode 100644
index 0000000..893774f
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/deopt-array-prototype-findindex.js
@@ -0,0 +1,27 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+/* Test deopt behaviors when the prototype has elements */
+
+// findIndex
+
+(function () {
+  var array = [,];
+
+  function findIndex() {
+    return array.findIndex(v => v > 0);
+  }
+
+  %PrepareFunctionForOptimization(findIndex);
+  findIndex(); findIndex();
+
+  %OptimizeFunctionOnNextCall(findIndex);
+  assertEquals(findIndex(), -1);
+
+  array.__proto__.push(6);
+  // deopt
+  assertEquals(findIndex(), 0);
+})();
diff --git a/src/v8/test/mjsunit/compiler/deopt-array-prototype-foreach.js b/src/v8/test/mjsunit/compiler/deopt-array-prototype-foreach.js
new file mode 100644
index 0000000..1d0a808
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/deopt-array-prototype-foreach.js
@@ -0,0 +1,32 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+/* Test deopt behaviors when the prototype has elements */
+
+// forEach
+
+(function () {
+  var array = [,];
+
+  function increment (v, k, arr) { arr[k] = v + 1; }
+  function forEach() {
+    array.forEach(increment);
+  }
+  %PrepareFunctionForOptimization(forEach);
+  forEach(); forEach();
+
+  %OptimizeFunctionOnNextCall(forEach);
+
+  forEach();
+  assertEquals(array, [,]);
+
+  array.__proto__.push(5);
+  assertEquals(Object.getOwnPropertyDescriptor(array, 0), undefined);
+  // deopt
+  forEach();
+  assertNotEquals(Object.getOwnPropertyDescriptor(array, 0), undefined);
+  assertEquals(array[0], 6);  // this reads from the prototype
+})();
diff --git a/src/v8/test/mjsunit/compiler/deopt-array-prototype-includes.js b/src/v8/test/mjsunit/compiler/deopt-array-prototype-includes.js
new file mode 100644
index 0000000..5931840
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/deopt-array-prototype-includes.js
@@ -0,0 +1,108 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+/* Test deopt behaviors when the prototype has elements */
+
+// includes
+
+(function() {
+  const iarr = [0,1,2];
+  const darr = [0.0, 2.0, 3.3];
+
+  function includes(arr, val) {
+    return arr.includes(val);
+  }
+
+  %PrepareFunctionForOptimization(includes);
+  assertTrue(includes(iarr, 0)); assertTrue(includes(darr, 0));
+  assertTrue(includes(iarr, 2)); assertTrue(includes(darr, 2));
+
+  // JSCallReducer for includes not reduce because it only works with single map
+  %OptimizeFunctionOnNextCall(includes);
+
+  assertTrue(includes(iarr, 0));
+  assertTrue(includes(darr, 0));
+})();
+
+(function() {
+  const iarr = [0,1,2];
+
+  function includes(arr, val) {
+    return arr.includes(val);
+  }
+
+  %PrepareFunctionForOptimization(includes);
+  assertTrue(includes(iarr, 0));
+  assertTrue(includes(iarr, 2));
+
+  %OptimizeFunctionOnNextCall(includes);
+
+  assertTrue(includes(iarr, 0));
+
+  const darr = [0.0, 2.0, 3.3];
+  // deopt because of map change
+  assertTrue(includes(darr, 0));
+})();
+
+(function() {
+  const iarr = [,3];
+
+  function includes(arr, val) {
+    return arr.includes(val);
+  }
+
+  iarr.__proto__ = [2];
+
+  // get feedback
+  %PrepareFunctionForOptimization(includes);
+  assertFalse(includes(iarr, 0));
+  assertTrue(includes(iarr, 2));
+
+  %OptimizeFunctionOnNextCall(includes);
+
+  assertFalse(includes(iarr, 0));
+
+  assertTrue(includes(iarr, 2));
+})();
+
+(function() {
+  const iarr = [,3];
+
+  function includes(arr, val) {
+    return arr.includes(val);
+  }
+
+  %PrepareFunctionForOptimization(includes);
+  assertFalse(includes(iarr, 2));
+  assertTrue(includes(iarr, 3));
+
+  %OptimizeFunctionOnNextCall(includes);
+  assertFalse(includes(iarr, 2));
+
+  // deopt because of map change
+  iarr.__proto__ = [2];
+  assertTrue(includes(iarr, 2));
+})();
+
+// This pollutes the Array prototype, so we should not run more tests
+// in the same environment after this.
+(function () {
+  var array = [,];
+
+  function includes(val) {
+    return array.includes(val);
+  }
+
+  %PrepareFunctionForOptimization(includes);
+  includes(6); includes(6);
+
+  %OptimizeFunctionOnNextCall(includes);
+  assertFalse(includes(6));
+
+  array.__proto__.push(6);
+  // deopt because of no_elements_protector
+  assertTrue(includes(6));
+})();
diff --git a/src/v8/test/mjsunit/compiler/deopt-array-prototype-indexof.js b/src/v8/test/mjsunit/compiler/deopt-array-prototype-indexof.js
new file mode 100644
index 0000000..e5e2752
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/deopt-array-prototype-indexof.js
@@ -0,0 +1,109 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+/* Test deopt behaviors when the prototype has elements */
+
+// indexOf
+
+(function() {
+  const iarr = [0,1,2];
+  const darr = [0.0, 2.0, 3.3];
+
+  function indexOf(arr, val) {
+    return arr.indexOf(val);
+  }
+
+  %PrepareFunctionForOptimization(indexOf);
+  assertEquals(0, indexOf(iarr, 0));
+  assertEquals(0, indexOf(darr, 0));
+  assertEquals(2, indexOf(iarr, 2));
+  assertEquals(1, indexOf(darr, 2));
+
+  // JSCallReducer for indexOf will not reduce
+  // because it only works with single map
+  %OptimizeFunctionOnNextCall(indexOf);
+
+  assertEquals(0, indexOf(iarr, 0));
+  assertEquals(0, indexOf(darr, 0));
+})();
+
+(function() {
+  const iarr = [0,1,2];
+
+  function indexOf(arr, val) {
+    return arr.indexOf(val);
+  }
+
+  %PrepareFunctionForOptimization(indexOf);
+  assertEquals(0, indexOf(iarr, 0));
+  assertEquals(2, indexOf(iarr, 2));
+
+  %OptimizeFunctionOnNextCall(indexOf);
+
+  assertEquals(0, indexOf(iarr, 0));
+
+  const darr = [0.0, 2.0, 3.3];
+  // deopt because of map change
+  assertEquals(0, indexOf(darr, 0));
+})();
+
+(function() {
+  const iarr = [,3];
+
+  function indexOf(arr, val) {
+    return arr.indexOf(val);
+  }
+
+  %PrepareFunctionForOptimization(indexOf);
+  iarr.__proto__ = [2];
+  assertEquals(-1, indexOf(iarr, 0));
+  assertEquals(0, indexOf(iarr, 2));
+
+  %OptimizeFunctionOnNextCall(indexOf);
+
+  assertEquals(-1, indexOf(iarr, 0));
+
+  assertEquals(0, indexOf(iarr, 2));
+})();
+
+(function() {
+  const iarr = [,3];
+
+  function indexOf(arr, val) {
+    return arr.indexOf(val);
+  }
+
+  %PrepareFunctionForOptimization(indexOf);
+  assertEquals(-1, indexOf(iarr, 2));
+  assertEquals(1, indexOf(iarr, 3));
+
+  %OptimizeFunctionOnNextCall(indexOf);
+  assertEquals(-1, indexOf(iarr, 2));
+
+  // deopt because of map change
+  iarr.__proto__ = [2];
+  assertEquals(0, indexOf(iarr, 2));
+})();
+
+// This pollutes the Array prototype, so we should not run more tests
+// in the same environment after this.
+(function () {
+  var array = [,];
+
+  function indexOf(val) {
+    return array.indexOf(val);
+  }
+
+  %PrepareFunctionForOptimization(indexOf);
+  indexOf(6); indexOf(6);
+
+  %OptimizeFunctionOnNextCall(indexOf);
+  assertEquals(indexOf(6), -1);
+
+  array.__proto__.push(6);
+  // deopt because of no_elements_protector
+  assertEquals(indexOf(6), 0);
+})();
diff --git a/src/v8/test/mjsunit/compiler/deopt-array-prototype-lastindexof.js b/src/v8/test/mjsunit/compiler/deopt-array-prototype-lastindexof.js
new file mode 100644
index 0000000..0def5ef
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/deopt-array-prototype-lastindexof.js
@@ -0,0 +1,27 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+/* Test deopt behaviors when the prototype has elements */
+
+// lastIndexOf
+
+(function () {
+  var array = [,];
+
+  function lastIndexOf(val) {
+    return array.lastIndexOf(val);
+  }
+
+  %PrepareFunctionForOptimization(lastIndexOf);
+  lastIndexOf(6); lastIndexOf(6);
+
+  %OptimizeFunctionOnNextCall(lastIndexOf);
+  assertEquals(lastIndexOf(6), -1);
+
+  array.__proto__.push(6);
+  // deopt
+  assertEquals(lastIndexOf(6), 0);
+})();
diff --git a/src/v8/test/mjsunit/compiler/deopt-array-prototype-map.js b/src/v8/test/mjsunit/compiler/deopt-array-prototype-map.js
new file mode 100644
index 0000000..836df34
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/deopt-array-prototype-map.js
@@ -0,0 +1,30 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+/* Test deopt behaviors when the prototype has elements */
+
+// map
+
+(function () {
+  var array = [,];
+
+  function map() {
+    return array.map(x => x + 1);
+  }
+
+  %PrepareFunctionForOptimization(map);
+  map(); map();
+
+  %OptimizeFunctionOnNextCall(map);
+
+  assertEquals(map(), [,]);
+
+  array.__proto__.push(5);
+  // deopt
+  var narr = map();
+  assertNotEquals(Object.getOwnPropertyDescriptor(narr, 0), undefined);
+  assertEquals(narr[0], 6);
+})();
diff --git a/src/v8/test/mjsunit/compiler/deopt-array-prototype-pop.js b/src/v8/test/mjsunit/compiler/deopt-array-prototype-pop.js
new file mode 100644
index 0000000..aa578a0
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/deopt-array-prototype-pop.js
@@ -0,0 +1,28 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+/* Test behaviors when the prototype has elements */
+
+// pop
+
+(function () {
+  var array = [, , , ,];
+
+  function pop() {
+    return array.pop();
+  }
+
+  %PrepareFunctionForOptimization(pop);
+
+  assertEquals(pop(), undefined);
+  assertEquals(pop(), undefined);
+
+  %OptimizeFunctionOnNextCall(pop);
+  assertEquals(pop(), undefined);
+
+  array.__proto__.push(6);
+  assertEquals(pop(), 6);
+})();
diff --git a/src/v8/test/mjsunit/compiler/deopt-array-prototype-reduce.js b/src/v8/test/mjsunit/compiler/deopt-array-prototype-reduce.js
new file mode 100644
index 0000000..44a83ec
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/deopt-array-prototype-reduce.js
@@ -0,0 +1,32 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+/* Test deopt behaviors when the prototype has elements */
+
+// reduce
+
+(function () {
+  var array = [, 3];
+
+  function accumulate (prev, cur, curIdx, arr) { arr[curIdx] = cur + prev; }
+  function reduce() {
+    array.reduce(accumulate);
+  }
+
+  %PrepareFunctionForOptimization(reduce);
+  reduce(); reduce();
+
+  %OptimizeFunctionOnNextCall(reduce);
+
+  reduce();
+  assertEquals(array, [,3]);
+
+  array.__proto__.push(3);
+  // deopt
+  reduce();
+  assertEquals(array, [, 6]);
+  assertEquals(Object.getOwnPropertyDescriptor(array, 0), undefined);
+})();
diff --git a/src/v8/test/mjsunit/compiler/deopt-array-prototype-slice.js b/src/v8/test/mjsunit/compiler/deopt-array-prototype-slice.js
new file mode 100644
index 0000000..0e75f74
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/deopt-array-prototype-slice.js
@@ -0,0 +1,30 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+/* Test deopt behaviors when the prototype has elements */
+
+// slice
+
+(function () {
+  var array = [,];
+
+  function slice() {
+    return array.slice();
+  }
+
+  %PrepareFunctionForOptimization(slice);
+  slice(); slice();
+
+  %OptimizeFunctionOnNextCall(slice);
+
+  assertEquals(slice(), [,]);
+
+  array.__proto__.push(5);
+  // deopt
+  var narr = slice();
+  assertNotEquals(Object.getOwnPropertyDescriptor(narr, 0), undefined);
+  assertEquals(narr[0], 5);
+})();
diff --git a/src/v8/test/mjsunit/compiler/deopt-array-prototype-some.js b/src/v8/test/mjsunit/compiler/deopt-array-prototype-some.js
new file mode 100644
index 0000000..9636e94
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/deopt-array-prototype-some.js
@@ -0,0 +1,27 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+/* Test deopt behaviors when the prototype has elements */
+
+// some
+
+(function () {
+  var array = [,];
+
+  function some() {
+    return array.some(v => v > 0);
+  }
+
+  %PrepareFunctionForOptimization(some);
+  some(); some();
+
+  %OptimizeFunctionOnNextCall(some);
+  assertEquals(some(), false);
+
+  array.__proto__.push(6);
+  //deopt
+  assertEquals(some(), true);
+})();
diff --git a/src/v8/test/mjsunit/compiler/deopt-array-push.js b/src/v8/test/mjsunit/compiler/deopt-array-push.js
index e34d99a..d13538c 100644
--- a/src/v8/test/mjsunit/compiler/deopt-array-push.js
+++ b/src/v8/test/mjsunit/compiler/deopt-array-push.js
@@ -7,10 +7,12 @@
 (function test() {
   function foo(a) { a.push(a.length = 2); }
 
+  %PrepareFunctionForOptimization(foo);
   foo([1]);
   foo([1]);
   %OptimizeFunctionOnNextCall(foo);
   foo([1]);
+  %PrepareFunctionForOptimization(foo);
   %OptimizeFunctionOnNextCall(foo);
   foo([1]);
   assertOptimized(foo);
@@ -19,10 +21,12 @@
 (function testElementTypeCheckSmi() {
   function foo(a) { a.push('a'); }
 
+  %PrepareFunctionForOptimization(foo);
   foo([1]);
   foo([1]);
   %OptimizeFunctionOnNextCall(foo);
   foo([1]);
+  %PrepareFunctionForOptimization(foo);
   %OptimizeFunctionOnNextCall(foo);
   foo([1]);
   assertOptimized(foo);
@@ -31,10 +35,12 @@
 (function testElementTypeCheckDouble() {
   function foo(a) { a.push('a'); }
 
+  %PrepareFunctionForOptimization(foo);
   foo([0.3413312]);
   foo([0.3413312]);
   %OptimizeFunctionOnNextCall(foo);
   foo([0.3413312]);
+  %PrepareFunctionForOptimization(foo);
   %OptimizeFunctionOnNextCall(foo);
   foo([0.3413312]);
   assertOptimized(foo);
@@ -44,10 +50,12 @@
   %NeverOptimizeFunction(bar);
   function foo(a) { a.push(bar(a)); }
 
+  %PrepareFunctionForOptimization(foo);
   foo(["1"]);
   foo(["1"]);
   %OptimizeFunctionOnNextCall(foo);
   foo(["1"]);
+  %PrepareFunctionForOptimization(foo);
   %OptimizeFunctionOnNextCall(foo);
   foo(["1"]);
   assertOptimized(foo);
@@ -56,10 +64,12 @@
 (function test() {
   function foo(a) { a.push(a.length = 2); }
 
+  %PrepareFunctionForOptimization(foo);
   foo([0.34234]);
   foo([0.34234]);
   %OptimizeFunctionOnNextCall(foo);
   foo([0.34234]);
+  %PrepareFunctionForOptimization(foo);
   %OptimizeFunctionOnNextCall(foo);
   foo([0.34234]);
   assertOptimized(foo);
@@ -70,28 +80,47 @@
 
   function foo(a) { a.push(1); }
 
+  %PrepareFunctionForOptimization(foo);
   foo(new Array(N));
   foo(new Array(N));
   %OptimizeFunctionOnNextCall(foo);
   foo(new Array(N));
+  %PrepareFunctionForOptimization(foo);
   %OptimizeFunctionOnNextCall(foo);
   foo(new Array(N));
   assertOptimized(foo);
 })();
 
 (function test() {
-  function mkArray() {
-    const N = 128 * 1024;
+  // Conservative arrays lengths in slow and fast mode.
+  const kFastModeLength = 1024;
+  const kSlowModeLength = 512 * 1024;
+  function mkArray(length) {
     let a = [0.1];
-    a.length = N;
+    a.length = length;
     return a;
   }
   function foo(a) { a.push(0.23441233123); }
-  foo(mkArray());
-  foo(mkArray());
+
+
+  // 1. Optimize foo to handle fast mode arrays.
+  %PrepareFunctionForOptimization(foo);
+  foo(mkArray(kFastModeLength));
+  foo(mkArray(kFastModeLength));
   %OptimizeFunctionOnNextCall(foo);
-  foo(mkArray());
+  foo(mkArray(kFastModeLength));
+  assertOptimized(foo);
+
+  // Prepare foo to be re-optimized, ensuring it's bytecode / feedback vector
+  // doesn't get flushed after deoptimization.
+  %PrepareFunctionForOptimization(foo);
+
+  // 2. Given a slow mode array, foo will deopt.
+  foo(mkArray(kSlowModeLength));
+
+  // 3. Optimize foo again.
   %OptimizeFunctionOnNextCall(foo);
-  foo(mkArray());
+  foo(mkArray(kSlowModeLength));
+  // 4. It should stay optimized.
   assertOptimized(foo);
 })();
diff --git a/src/v8/test/mjsunit/compiler/deopt-bool.js b/src/v8/test/mjsunit/compiler/deopt-bool.js
index 13a4a97..2bd4d3e 100644
--- a/src/v8/test/mjsunit/compiler/deopt-bool.js
+++ b/src/v8/test/mjsunit/compiler/deopt-bool.js
@@ -15,6 +15,8 @@
   return passed;
 }
 
+%PrepareFunctionForOptimization(foo);
+
 assertTrue(foo(3, 4));
 assertTrue(foo(3, 4));
 assertFalse(foo(3.1, 4));
diff --git a/src/v8/test/mjsunit/compiler/deopt-bool2.js b/src/v8/test/mjsunit/compiler/deopt-bool2.js
index 4d1c41e..0967112 100644
--- a/src/v8/test/mjsunit/compiler/deopt-bool2.js
+++ b/src/v8/test/mjsunit/compiler/deopt-bool2.js
@@ -20,6 +20,8 @@
   return passed;
 }
 
+%PrepareFunctionForOptimization(foo);
+
 assertTrue(foo([0,1], [0,1]));
 assertTrue(foo([0,2], [0,2]));
 assertFalse(foo([0,2.25], [0,2.75]));
diff --git a/src/v8/test/mjsunit/compiler/deopt-closure.js b/src/v8/test/mjsunit/compiler/deopt-closure.js
index 2ce531f..ef2b500 100644
--- a/src/v8/test/mjsunit/compiler/deopt-closure.js
+++ b/src/v8/test/mjsunit/compiler/deopt-closure.js
@@ -12,6 +12,7 @@
     }
     return g();
   }
+  %PrepareFunctionForOptimization(f);
   assertEquals(24, f(23));
   assertEquals(43, f(42));
   %OptimizeFunctionOnNextCall(f);
@@ -26,6 +27,7 @@
     }
     return g();
   }
+  %PrepareFunctionForOptimization(f);
   assertEquals(24, f(23));
   assertEquals(43, f(42));
   %OptimizeFunctionOnNextCall(f);
@@ -40,6 +42,7 @@
     }
     return new g();
   }
+  %PrepareFunctionForOptimization(f);
   assertEquals({ val: 24 }, f(23));
   assertEquals({ val: 43 }, f(42));
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/deopt-during-eval-lookup.js b/src/v8/test/mjsunit/compiler/deopt-during-eval-lookup.js
index 1df04bb..786a460 100644
--- a/src/v8/test/mjsunit/compiler/deopt-during-eval-lookup.js
+++ b/src/v8/test/mjsunit/compiler/deopt-during-eval-lookup.js
@@ -43,5 +43,6 @@
   return eval("200");
 }
 
+%PrepareFunctionForOptimization(f);
 %OptimizeFunctionOnNextCall(f);
 assertEquals(100, f());
diff --git a/src/v8/test/mjsunit/compiler/deopt-eager-and-lazy.js b/src/v8/test/mjsunit/compiler/deopt-eager-and-lazy.js
index daea40a..cab060d 100644
--- a/src/v8/test/mjsunit/compiler/deopt-eager-and-lazy.js
+++ b/src/v8/test/mjsunit/compiler/deopt-eager-and-lazy.js
@@ -19,9 +19,12 @@
   return o.x;
 }
 
+%PrepareFunctionForOptimization(g);
 g({x : 1});
 g({x : 2});
 %OptimizeFunctionOnNextCall(g);
-%OptimizeFunctionOnNextCall(h);
 g({x : 3});
+%PrepareFunctionForOptimization(h);
+%OptimizeFunctionOnNextCall(h);
+g({x : 4});
 g({y : 1, x : 3});
diff --git a/src/v8/test/mjsunit/compiler/deopt-eager-var-mutation-ite.js b/src/v8/test/mjsunit/compiler/deopt-eager-var-mutation-ite.js
index 17ce86f..3b1698e 100644
--- a/src/v8/test/mjsunit/compiler/deopt-eager-var-mutation-ite.js
+++ b/src/v8/test/mjsunit/compiler/deopt-eager-var-mutation-ite.js
@@ -22,6 +22,7 @@
   } // It should trigger an eager deoptimization when b=true.
 }
 
+%PrepareFunctionForOptimization(f);
 f(false); f(false);
 %OptimizeFunctionOnNextCall(f);
 f(false);
diff --git a/src/v8/test/mjsunit/compiler/deopt-eager-with-freeze.js b/src/v8/test/mjsunit/compiler/deopt-eager-with-freeze.js
index 538176d..6596c85 100644
--- a/src/v8/test/mjsunit/compiler/deopt-eager-with-freeze.js
+++ b/src/v8/test/mjsunit/compiler/deopt-eager-with-freeze.js
@@ -12,6 +12,7 @@
   return obj.f;
 }
 
+%PrepareFunctionForOptimization(useObject);
 var o = {f: 1, g: 2}
 assertEquals(useObject(o), 2);
 assertEquals(useObject(o), 4);
diff --git a/src/v8/test/mjsunit/compiler/deopt-followed-by-gc.js b/src/v8/test/mjsunit/compiler/deopt-followed-by-gc.js
index a5ea622..fb49221 100644
--- a/src/v8/test/mjsunit/compiler/deopt-followed-by-gc.js
+++ b/src/v8/test/mjsunit/compiler/deopt-followed-by-gc.js
@@ -17,6 +17,7 @@
 }
 %NeverOptimizeFunction(deopt);
 
+%PrepareFunctionForOptimization(opt_me);
 opt_me();
 opt_me();
 %OptimizeFunctionOnNextCall(opt_me);
diff --git a/src/v8/test/mjsunit/compiler/deopt-inlined-from-call.js b/src/v8/test/mjsunit/compiler/deopt-inlined-from-call.js
index 8fa8af5..deff3e7 100644
--- a/src/v8/test/mjsunit/compiler/deopt-inlined-from-call.js
+++ b/src/v8/test/mjsunit/compiler/deopt-inlined-from-call.js
@@ -44,6 +44,7 @@
     return g([].f.call({}), deopt + 1, called);
   }
 
+  %PrepareFunctionForOptimization(f);
   called = f(0, called);
   called = f(0, called);
   %OptimizeFunctionOnNextCall(f);
@@ -65,6 +66,7 @@
     return [].pop.call(a1) + b.value;
   }
 
+  %PrepareFunctionForOptimization(f);
   assertEquals(7, f(obj));
   assertEquals(6, f(obj));
   %OptimizeFunctionOnNextCall(f);
@@ -84,6 +86,7 @@
     return [].shift.call(a2) + b.value;
   }
 
+  %PrepareFunctionForOptimization(f);
   assertEquals(4, f(obj));
   assertEquals(5, f(obj));
   %OptimizeFunctionOnNextCall(f);
@@ -102,6 +105,7 @@
     return [].push.call(a3, b.value);
   }
 
+  %PrepareFunctionForOptimization(f);
   assertEquals(5, f(obj));
   assertEquals(6, f(obj));
   %OptimizeFunctionOnNextCall(f);
@@ -121,6 +125,7 @@
     return [].indexOf.call(a4, b.value);
   }
 
+  %PrepareFunctionForOptimization(f);
   f(obj);
   f(obj);
   %OptimizeFunctionOnNextCall(f);
@@ -141,6 +146,7 @@
     return [].lastIndexOf.call(a5, b.value);
   }
 
+  %PrepareFunctionForOptimization(f);
   f(obj);
   f(obj);
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/deopt-inlined-smi.js b/src/v8/test/mjsunit/compiler/deopt-inlined-smi.js
index dda083e..9c0dc99 100644
--- a/src/v8/test/mjsunit/compiler/deopt-inlined-smi.js
+++ b/src/v8/test/mjsunit/compiler/deopt-inlined-smi.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --always-opt --always-inline-smi-code
+// Flags: --always-opt
 
 // Test deoptimization into inlined smi code.
 
diff --git a/src/v8/test/mjsunit/compiler/deopt-lazy-freeze.js b/src/v8/test/mjsunit/compiler/deopt-lazy-freeze.js
index 592fca8..b7cdd37 100644
--- a/src/v8/test/mjsunit/compiler/deopt-lazy-freeze.js
+++ b/src/v8/test/mjsunit/compiler/deopt-lazy-freeze.js
@@ -21,6 +21,7 @@
   return obj.f;
 }
 
+%PrepareFunctionForOptimization(setAndUseObject);
 assertEquals(setAndUseObject(), 2);
 assertEquals(setAndUseObject(), 4);
 %OptimizeFunctionOnNextCall(setAndUseObject);
diff --git a/src/v8/test/mjsunit/compiler/deopt-lazy-shape-mutation.js b/src/v8/test/mjsunit/compiler/deopt-lazy-shape-mutation.js
index df4878e..d9dc6d9 100644
--- a/src/v8/test/mjsunit/compiler/deopt-lazy-shape-mutation.js
+++ b/src/v8/test/mjsunit/compiler/deopt-lazy-shape-mutation.js
@@ -17,6 +17,7 @@
   return o.x;
 }
 
+%PrepareFunctionForOptimization(f);
 f(); f();
 %OptimizeFunctionOnNextCall(f);
 b = true;
diff --git a/src/v8/test/mjsunit/compiler/deopt-lazy-var-mutation.js b/src/v8/test/mjsunit/compiler/deopt-lazy-var-mutation.js
index 93886f2..17f3c39 100644
--- a/src/v8/test/mjsunit/compiler/deopt-lazy-var-mutation.js
+++ b/src/v8/test/mjsunit/compiler/deopt-lazy-var-mutation.js
@@ -19,6 +19,7 @@
 }
 
 var o = 1;
+%PrepareFunctionForOptimization(foo);
 assertEquals(foo(o), 2);
 assertEquals(foo(o), 2);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/deopt-many-lazy.js b/src/v8/test/mjsunit/compiler/deopt-many-lazy.js
index e8a0b04..1b24bfc 100644
--- a/src/v8/test/mjsunit/compiler/deopt-many-lazy.js
+++ b/src/v8/test/mjsunit/compiler/deopt-many-lazy.js
@@ -23,11 +23,19 @@
   %DeoptimizeFunction(a);
 }
 
+%PrepareFunctionForOptimization(f);
 f(); f();
+%OptimizeFunctionOnNextCall(f);
+f();
+%PrepareFunctionForOptimization(a);
 a(); a();
+%OptimizeFunctionOnNextCall(a);
+a();
 for(var i = 0; i < 5; i++) {
+  %PrepareFunctionForOptimization(f);
   %OptimizeFunctionOnNextCall(f);
-  %OptimizeFunctionOnNextCall(a);
   f();
+  %PrepareFunctionForOptimization(a);
+  %OptimizeFunctionOnNextCall(a);
   a();
 }
diff --git a/src/v8/test/mjsunit/compiler/deopt-materialize-accumulator.js b/src/v8/test/mjsunit/compiler/deopt-materialize-accumulator.js
index 0b19df8..493bd8e 100644
--- a/src/v8/test/mjsunit/compiler/deopt-materialize-accumulator.js
+++ b/src/v8/test/mjsunit/compiler/deopt-materialize-accumulator.js
@@ -36,6 +36,7 @@
   // accumulator holding an unboxed double which needs materialized.
   global = Math.sqrt(a);
 }
+%PrepareFunctionForOptimization(f);
 %OptimizeFunctionOnNextCall(f);
 f(0.25);
 assertEquals(0.5, global);
diff --git a/src/v8/test/mjsunit/compiler/deopt-now-lazy.js b/src/v8/test/mjsunit/compiler/deopt-now-lazy.js
index 6a86bca..b5d11ac 100644
--- a/src/v8/test/mjsunit/compiler/deopt-now-lazy.js
+++ b/src/v8/test/mjsunit/compiler/deopt-now-lazy.js
@@ -8,5 +8,6 @@
   %DeoptimizeNow();
 }
 
+%PrepareFunctionForOptimization(f);
 %OptimizeFunctionOnNextCall(f);
 f();
diff --git a/src/v8/test/mjsunit/compiler/deopt-numberoroddball-binop.js b/src/v8/test/mjsunit/compiler/deopt-numberoroddball-binop.js
index 6f19d45..7634474 100644
--- a/src/v8/test/mjsunit/compiler/deopt-numberoroddball-binop.js
+++ b/src/v8/test/mjsunit/compiler/deopt-numberoroddball-binop.js
@@ -7,6 +7,7 @@
 (function() {
   function foo(x, y) { return x << y; }
 
+  %PrepareFunctionForOptimization(foo);
   foo(1.1, 0.1);
   foo(0.1, 1.1);
   foo(true, false);
@@ -32,6 +33,7 @@
 (function() {
   function foo(x, y) { return x >> y; }
 
+  %PrepareFunctionForOptimization(foo);
   foo(1.1, 0.1);
   foo(0.1, 1.1);
   foo(true, false);
@@ -57,6 +59,7 @@
 (function() {
   function foo(x, y) { return x >>> y; }
 
+  %PrepareFunctionForOptimization(foo);
   foo(1.1, 0.1);
   foo(0.1, 1.1);
   foo(true, false);
@@ -82,6 +85,7 @@
 (function() {
   function foo(x, y) { return x ^ y; }
 
+  %PrepareFunctionForOptimization(foo);
   foo(1.1, 0.1);
   foo(0.1, 1.1);
   foo(true, false);
@@ -107,6 +111,7 @@
 (function() {
   function foo(x, y) { return x | y; }
 
+  %PrepareFunctionForOptimization(foo);
   foo(1.1, 0.1);
   foo(0.1, 1.1);
   foo(true, false);
@@ -132,6 +137,7 @@
 (function() {
   function foo(x, y) { return x & y; }
 
+  %PrepareFunctionForOptimization(foo);
   foo(1.1, 0.1);
   foo(0.1, 1.1);
   foo(true, false);
diff --git a/src/v8/test/mjsunit/compiler/deopt-simple-eager.js b/src/v8/test/mjsunit/compiler/deopt-simple-eager.js
index 9928647..9944b72 100644
--- a/src/v8/test/mjsunit/compiler/deopt-simple-eager.js
+++ b/src/v8/test/mjsunit/compiler/deopt-simple-eager.js
@@ -10,6 +10,7 @@
   return o.x;
 }
 
+%PrepareFunctionForOptimization(f);
 assertEquals(f({x : 2}), 2);
 assertEquals(f({x : 2}), 2);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/deopt-simple-lazy.js b/src/v8/test/mjsunit/compiler/deopt-simple-lazy.js
index e3721a3..e32fc2a 100644
--- a/src/v8/test/mjsunit/compiler/deopt-simple-lazy.js
+++ b/src/v8/test/mjsunit/compiler/deopt-simple-lazy.js
@@ -14,6 +14,7 @@
   %DeoptimizeFunction(f);
 }
 
+%PrepareFunctionForOptimization(f);
 f(); f();
 %OptimizeFunctionOnNextCall(f);
 f();
diff --git a/src/v8/test/mjsunit/compiler/deopt-simple-try-catch.js b/src/v8/test/mjsunit/compiler/deopt-simple-try-catch.js
index b0e382e..6a1ca40 100644
--- a/src/v8/test/mjsunit/compiler/deopt-simple-try-catch.js
+++ b/src/v8/test/mjsunit/compiler/deopt-simple-try-catch.js
@@ -22,6 +22,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(f);
 assertEquals(f(), 43);
 assertEquals(f(), 43);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/deopt-soft-simple.js b/src/v8/test/mjsunit/compiler/deopt-soft-simple.js
index eaa1e3c..a32f610 100644
--- a/src/v8/test/mjsunit/compiler/deopt-soft-simple.js
+++ b/src/v8/test/mjsunit/compiler/deopt-soft-simple.js
@@ -17,5 +17,6 @@
   return o.x;
 }
 
+%PrepareFunctionForOptimization(f);
 %OptimizeFunctionOnNextCall(f);
 f();
diff --git a/src/v8/test/mjsunit/compiler/deopt-string-outofbounds.js b/src/v8/test/mjsunit/compiler/deopt-string-outofbounds.js
index e5ec075..a7edbbc 100644
--- a/src/v8/test/mjsunit/compiler/deopt-string-outofbounds.js
+++ b/src/v8/test/mjsunit/compiler/deopt-string-outofbounds.js
@@ -9,10 +9,12 @@
 (function() {
   function foo() { return s[5]; }
 
+  %PrepareFunctionForOptimization(foo);
   foo();
   foo();
   %OptimizeFunctionOnNextCall(foo);
   foo();
+  %PrepareFunctionForOptimization(foo);
   %OptimizeFunctionOnNextCall(foo);
   foo();
   assertOptimized(foo);
@@ -21,10 +23,12 @@
 (function() {
   function foo(i) { return s[i]; }
 
+  %PrepareFunctionForOptimization(foo);
   foo(0);
   foo(1);
   %OptimizeFunctionOnNextCall(foo);
   foo(5);
+  %PrepareFunctionForOptimization(foo);
   %OptimizeFunctionOnNextCall(foo);
   foo(5);
   assertOptimized(foo);
@@ -33,10 +37,12 @@
 (function() {
   function foo(s) { return s[5]; }
 
+  %PrepareFunctionForOptimization(foo);
   foo(s);
   foo(s);
   %OptimizeFunctionOnNextCall(foo);
   foo(s);
+  %PrepareFunctionForOptimization(foo);
   %OptimizeFunctionOnNextCall(foo);
   foo(s);
   assertOptimized(foo);
@@ -45,10 +51,12 @@
 (function() {
   function foo(s, i) { return s[i]; }
 
+  %PrepareFunctionForOptimization(foo);
   foo(s, 0);
   foo(s, 1);
   %OptimizeFunctionOnNextCall(foo);
   foo(s, 5);
+  %PrepareFunctionForOptimization(foo);
   %OptimizeFunctionOnNextCall(foo);
   foo(s, 5);
   assertOptimized(foo);
diff --git a/src/v8/test/mjsunit/compiler/deopt-tonumber-binop.js b/src/v8/test/mjsunit/compiler/deopt-tonumber-binop.js
index c93ef9d..3af7078 100644
--- a/src/v8/test/mjsunit/compiler/deopt-tonumber-binop.js
+++ b/src/v8/test/mjsunit/compiler/deopt-tonumber-binop.js
@@ -25,6 +25,7 @@
   return "1";
 } };
 
+%PrepareFunctionForOptimization(f);
 counter = 0;
 assertEquals(1, f(deopt, o));
 assertEquals(2, counter);
@@ -34,6 +35,7 @@
 assertEquals(-1, f(o, deopt));
 assertEquals(2, counter);
 
+%PrepareFunctionForOptimization(f);
 %OptimizeFunctionOnNextCall(f);
 counter = 0;
 assertEquals(0, f(deopt, deopt));
diff --git a/src/v8/test/mjsunit/compiler/deopt-tonumber-compare.js b/src/v8/test/mjsunit/compiler/deopt-tonumber-compare.js
index 9a7e992..64b2f74 100644
--- a/src/v8/test/mjsunit/compiler/deopt-tonumber-compare.js
+++ b/src/v8/test/mjsunit/compiler/deopt-tonumber-compare.js
@@ -29,14 +29,16 @@
   };
 }
 
+%PrepareFunctionForOptimization(f);
 assertEquals(false, f(deopt(f)));
 assertEquals(1, counter);
 
-assertEquals(true, g(deopt(g)));
-assertEquals(2, counter);
-
 %OptimizeFunctionOnNextCall(f);
 assertEquals(false, f(deopt(f)));
+assertEquals(2, counter);
+
+%PrepareFunctionForOptimization(g);
+assertEquals(true, g(deopt(g)));
 assertEquals(3, counter);
 
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/compiler/deopt-tonumber-shift.js b/src/v8/test/mjsunit/compiler/deopt-tonumber-shift.js
index bb4d1d5..a4483e9 100644
--- a/src/v8/test/mjsunit/compiler/deopt-tonumber-shift.js
+++ b/src/v8/test/mjsunit/compiler/deopt-tonumber-shift.js
@@ -25,6 +25,7 @@
   return "1";
 } };
 
+%PrepareFunctionForOptimization(f);
 counter = 0;
 assertEquals(4, f(deopt, o));
 assertEquals(2, counter);
@@ -34,6 +35,7 @@
 assertEquals(4, f(o, deopt));
 assertEquals(2, counter);
 
+%PrepareFunctionForOptimization(f);
 %OptimizeFunctionOnNextCall(f);
 counter = 0;
 assertEquals(8, f(deopt, deopt));
diff --git a/src/v8/test/mjsunit/compiler/deopt-twice-on-call.js b/src/v8/test/mjsunit/compiler/deopt-twice-on-call.js
index f30b7d0..d591d9c 100644
--- a/src/v8/test/mjsunit/compiler/deopt-twice-on-call.js
+++ b/src/v8/test/mjsunit/compiler/deopt-twice-on-call.js
@@ -17,6 +17,7 @@
   %DeoptimizeFunction(f);
 }
 
+%PrepareFunctionForOptimization(f);
 f(); f();
 %OptimizeFunctionOnNextCall(f);
 f();
diff --git a/src/v8/test/mjsunit/compiler/deopt-twice.js b/src/v8/test/mjsunit/compiler/deopt-twice.js
index 1ec9c9f..929cca6 100644
--- a/src/v8/test/mjsunit/compiler/deopt-twice.js
+++ b/src/v8/test/mjsunit/compiler/deopt-twice.js
@@ -13,6 +13,7 @@
   %DeoptimizeFunction(f);
 }
 
+%PrepareFunctionForOptimization(f);
 f(); f();
 %OptimizeFunctionOnNextCall(f);
 f();
diff --git a/src/v8/test/mjsunit/compiler/deoptimize-lazy-weak.js b/src/v8/test/mjsunit/compiler/deoptimize-lazy-weak.js
index c774089..e698654 100644
--- a/src/v8/test/mjsunit/compiler/deoptimize-lazy-weak.js
+++ b/src/v8/test/mjsunit/compiler/deoptimize-lazy-weak.js
@@ -38,10 +38,14 @@
 }
 
 shouldDeopt = false;
+%PrepareFunctionForOptimization(dummy_opt);
 f();
 f();
-
-%OptimizeFunctionOnNextCall(f);
 %OptimizeFunctionOnNextCall(dummy_opt);
+f();
+%PrepareFunctionForOptimization(f);
+f();
+%OptimizeFunctionOnNextCall(f);
+
 shouldDeopt = true;
 assertEquals(2, f());
diff --git a/src/v8/test/mjsunit/compiler/division-by-constant.js b/src/v8/test/mjsunit/compiler/division-by-constant.js
index 212bdb2..b37d9f9 100644
--- a/src/v8/test/mjsunit/compiler/division-by-constant.js
+++ b/src/v8/test/mjsunit/compiler/division-by-constant.js
@@ -107,6 +107,7 @@
   var OptFun = new Function("dividend", construct(divisor));
 
   // Warm up type feedback.
+  %PrepareFunctionForOptimization(OptFun);
   OptFun(7);
   OptFun(11);
   %OptimizeFunctionOnNextCall(OptFun);
diff --git a/src/v8/test/mjsunit/compiler/dont-constant-fold-deopting-checks.js b/src/v8/test/mjsunit/compiler/dont-constant-fold-deopting-checks.js
index 02bd8d9..e211f7f 100644
--- a/src/v8/test/mjsunit/compiler/dont-constant-fold-deopting-checks.js
+++ b/src/v8/test/mjsunit/compiler/dont-constant-fold-deopting-checks.js
@@ -6,5 +6,6 @@
 
 function bar(a) { a[0](true); }
 function foo(a) { return bar(1); }
+%PrepareFunctionForOptimization(foo);
 %OptimizeFunctionOnNextCall(foo);
 assertThrows(function() {bar([foo])}, TypeError);
diff --git a/src/v8/test/mjsunit/compiler/dont-flush-code-marked-for-opt.js b/src/v8/test/mjsunit/compiler/dont-flush-code-marked-for-opt.js
new file mode 100644
index 0000000..1cfc0cf
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/dont-flush-code-marked-for-opt.js
@@ -0,0 +1,16 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --opt --allow-natives-syntax --expose-gc --flush-bytecode
+// Flags: --stress-flush-bytecode
+
+function foo(a) {}
+
+%PrepareFunctionForOptimization(foo);
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+gc();
+foo();
+assertOptimized(foo);
diff --git a/src/v8/test/mjsunit/compiler/double-array-to-global.js b/src/v8/test/mjsunit/compiler/double-array-to-global.js
index e221d90..4dc1c9b 100644
--- a/src/v8/test/mjsunit/compiler/double-array-to-global.js
+++ b/src/v8/test/mjsunit/compiler/double-array-to-global.js
@@ -11,6 +11,7 @@
     b = a[i];
   }
 }
+%PrepareFunctionForOptimization(foo);
 foo(a);
 foo(a);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/eager-deopt-simple.js b/src/v8/test/mjsunit/compiler/eager-deopt-simple.js
index 067400c..c7a39cb 100644
--- a/src/v8/test/mjsunit/compiler/eager-deopt-simple.js
+++ b/src/v8/test/mjsunit/compiler/eager-deopt-simple.js
@@ -12,6 +12,7 @@
   return g(1, (%_DeoptimizeNow(), 2), 3);
 }
 
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-1.js b/src/v8/test/mjsunit/compiler/escape-analysis-1.js
index f05040b..f1b53a5 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-1.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-1.js
@@ -36,6 +36,7 @@
   return f(1,2,3);
 }
 
+%PrepareFunctionForOptimization(g);
 assertEquals(3, g());
 assertEquals(3, g());
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-11.js b/src/v8/test/mjsunit/compiler/escape-analysis-11.js
index e922fc1..5a136ee 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-11.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-11.js
@@ -13,6 +13,7 @@
   g();
 }
 
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-12.js b/src/v8/test/mjsunit/compiler/escape-analysis-12.js
index 16029a0..d253d0d 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-12.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-12.js
@@ -11,6 +11,7 @@
   x.b = 1;
   0 <= y.b;
 }
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-13.js b/src/v8/test/mjsunit/compiler/escape-analysis-13.js
index 5f281aa..b3de53a 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-13.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-13.js
@@ -11,6 +11,7 @@
   assertEquals("a", x.a);
   assertEquals("b", x.b);
 }
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-15.js b/src/v8/test/mjsunit/compiler/escape-analysis-15.js
index 1960d74..510caa0 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-15.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-15.js
@@ -12,6 +12,7 @@
   o2.a = o1;
   if (i == 4) return o3;
 }
+%PrepareFunctionForOptimization(f);
 for (var i = 0; i < 100; ++i){
   f(i%5)
 }
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-16.js b/src/v8/test/mjsunit/compiler/escape-analysis-16.js
index 4cd9ae4..bda6f82 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-16.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-16.js
@@ -12,6 +12,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(foo);
 foo();
 foo();
 %OptimizeFunctionOnNextCall(foo)
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-17.js b/src/v8/test/mjsunit/compiler/escape-analysis-17.js
index 5709d47..aca0d32 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-17.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-17.js
@@ -21,6 +21,7 @@
   }
   return x;
 }
+%PrepareFunctionForOptimization(foo);
 foo();
 foo();
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-18.js b/src/v8/test/mjsunit/compiler/escape-analysis-18.js
index f2ff082..4971948 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-18.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-18.js
@@ -16,6 +16,7 @@
     return bar(array);
 }
 
+%PrepareFunctionForOptimization(foo);
 let array = [,.5,];
 foo(array);
 foo(array);
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-2.js b/src/v8/test/mjsunit/compiler/escape-analysis-2.js
index 49f440e..b62d7e2 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-2.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-2.js
@@ -38,6 +38,7 @@
   return f(a,1,2,3);
 }
 
+%PrepareFunctionForOptimization(g);
 assertEquals(4, g());
 assertEquals(4, g());
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-3.js b/src/v8/test/mjsunit/compiler/escape-analysis-3.js
index b92d1c3..193bf7c 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-3.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-3.js
@@ -37,6 +37,7 @@
   return arguments[f(1,2)];
 }
 
+%PrepareFunctionForOptimization(g);
 assertEquals(6, g(4,5,6));
 assertEquals(6, g(4,5,6));
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-4.js b/src/v8/test/mjsunit/compiler/escape-analysis-4.js
index ef9f95f..576f299 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-4.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-4.js
@@ -41,6 +41,7 @@
   return "" + f(1,2,3) + " " + h(4,5,6);
 }
 
+%PrepareFunctionForOptimization(g);
 assertEquals("3 [object Arguments]", g());
 assertEquals("3 [object Arguments]", g());
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-5.js b/src/v8/test/mjsunit/compiler/escape-analysis-5.js
index 54b5e82..69d0fdf 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-5.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-5.js
@@ -41,6 +41,7 @@
   assertEquals("[object Arguments]", ""+x)
 }
 
+%PrepareFunctionForOptimization(g);
 assertEquals(4, g(h));
 assertEquals(4, g(h));
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-6.js b/src/v8/test/mjsunit/compiler/escape-analysis-6.js
index c36e7d9..9d7ae92 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-6.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-6.js
@@ -41,6 +41,7 @@
   return x.length;
 }
 
+%PrepareFunctionForOptimization(g);
 assertEquals(5, g());
 assertEquals(5, g());
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-7.js b/src/v8/test/mjsunit/compiler/escape-analysis-7.js
index cfa30cb..581bdf2 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-7.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-7.js
@@ -43,6 +43,7 @@
   return o.x;
 }
 
+%PrepareFunctionForOptimization(g);
 assertEquals(5, g(true));
 assertEquals(7, g(false));
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-8.js b/src/v8/test/mjsunit/compiler/escape-analysis-8.js
index d9c6d25..77d0492 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-8.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-8.js
@@ -42,6 +42,7 @@
   return o.x;
 }
 
+%PrepareFunctionForOptimization(g);
 assertEquals(5, g());
 assertEquals(5, g());
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-9.js b/src/v8/test/mjsunit/compiler/escape-analysis-9.js
index 0b8f75c..4e0c487 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-9.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-9.js
@@ -43,6 +43,7 @@
   return o[0];
 }
 
+%PrepareFunctionForOptimization(g);
 assertEquals(7, g());
 assertEquals(7, g());
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-arguments.js b/src/v8/test/mjsunit/compiler/escape-analysis-arguments.js
index f520167..4659a39 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-arguments.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-arguments.js
@@ -52,6 +52,7 @@
     assertEquals(5, r.y.z);
   }
 
+  %PrepareFunctionForOptimization(f);
   f(); f(); f();
   %OptimizeFunctionOnNextCall(f);
   f();
@@ -81,6 +82,7 @@
     assertEquals(3, r.i.y.z);
   }
 
+  %PrepareFunctionForOptimization(f);
   f(); f(); f();
   %OptimizeFunctionOnNextCall(f);
   f();
@@ -113,9 +115,12 @@
     assertEquals(3, l.y.z)
   }
 
+  %PrepareFunctionForOptimization(f);
   f(); f(); f();
   %OptimizeFunctionOnNextCall(f);
-  f(); f();
+  f();
+  %PrepareFunctionForOptimization(f);
+  f();
   %OptimizeFunctionOnNextCall(f);
   f(); f();
 })();
@@ -147,10 +152,13 @@
     assertEquals(3, l.y.z)
   }
 
+  %PrepareFunctionForOptimization(f);
   %NeverOptimizeFunction(i);
   f(); f(); f();
   %OptimizeFunctionOnNextCall(f);
-  f(); f();
+  f();
+  %PrepareFunctionForOptimization(f);
+  f();
   %OptimizeFunctionOnNextCall(f);
   f(); f();
 })();
@@ -179,9 +187,67 @@
     assertEquals(7, k.t.u)
   }
 
+  %PrepareFunctionForOptimization(f);
   f(); f(); f();
   %OptimizeFunctionOnNextCall(f);
-  f(); f();
+  f();
+  %PrepareFunctionForOptimization(f);
+  f();
   %OptimizeFunctionOnNextCall(f);
   f(); f();
 })();
+
+// Test variable index access to strict arguments
+// with up to 2 elements.
+(function testArgumentsVariableIndexStrict() {
+  function g() {
+    "use strict";
+    var s = 0;
+    for (var i = 0; i < arguments.length; ++i) s += arguments[i];
+    return s;
+  }
+
+  function f(x, y) {
+    // (a) arguments[i] is dead code since arguments.length is 0.
+    const a = g();
+    // (b) arguments[i] always yields the first element.
+    const b = g(x);
+    // (c) arguments[i] can yield either x or y.
+    const c = g(x, y);
+    return a + b + c;
+  }
+
+  %PrepareFunctionForOptimization(f);
+  assertEquals(4, f(1, 2));
+  assertEquals(5, f(2, 1));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(4, f(1, 2));
+  assertEquals(5, f(2, 1));
+})();
+
+// Test variable index access to sloppy arguments
+// with up to 2 elements.
+(function testArgumentsVariableIndexSloppy() {
+  function g() {
+    var s = 0;
+    for (var i = 0; i < arguments.length; ++i) s += arguments[i];
+    return s;
+  }
+
+  function f(x, y) {
+    // (a) arguments[i] is dead code since arguments.length is 0.
+    const a = g();
+    // (b) arguments[i] always yields the first element.
+    const b = g(x);
+    // (c) arguments[i] can yield either x or y.
+    const c = g(x, y);
+    return a + b + c;
+  }
+
+  %PrepareFunctionForOptimization(f);
+  assertEquals(4, f(1, 2));
+  assertEquals(5, f(2, 1));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(4, f(1, 2));
+  assertEquals(5, f(2, 1));
+})();
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-array.js b/src/v8/test/mjsunit/compiler/escape-analysis-array.js
new file mode 100644
index 0000000..3696c7c
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-array.js
@@ -0,0 +1,34 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Test variable index access to array with 1 element.
+(function testOneElementArrayVariableIndex() {
+  function f(i) {
+    const a = new Array("first");
+    return a[i];
+  }
+
+  %PrepareFunctionForOptimization(f);
+  assertEquals("first", f(0));
+  assertEquals("first", f(0));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("first", f(0));
+})();
+
+// Test variable index access to array with 2 elements.
+(function testTwoElementArrayVariableIndex() {
+  function f(i) {
+    const a = new Array("first", "second");
+    return a[i];
+  }
+
+  %PrepareFunctionForOptimization(f);
+  assertEquals("first", f(0));
+  assertEquals("second", f(1));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("first", f(0));
+  assertEquals("second", f(1));
+})();
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-cycle.js b/src/v8/test/mjsunit/compiler/escape-analysis-cycle.js
index ee3a4a7..8a233c3 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-cycle.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-cycle.js
@@ -16,6 +16,7 @@
   return o.c.a.c.a.c.a.c.b;
 }
 
+%PrepareFunctionForOptimization(f);
 assertEquals(42, f());
 assertEquals(42, f());
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-deopt-1.js b/src/v8/test/mjsunit/compiler/escape-analysis-deopt-1.js
index 7337264..2570414 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-deopt-1.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-deopt-1.js
@@ -40,6 +40,7 @@
     assertEquals(2, o1[1]);
     assertEquals(3, o1[2]);
   }
+  %PrepareFunctionForOptimization(func);
   func(false);
   func(false);
   %OptimizeFunctionOnNextCall(func);
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-deopt-2.js b/src/v8/test/mjsunit/compiler/escape-analysis-deopt-2.js
index 306f3e7..5c0ac97 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-deopt-2.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-deopt-2.js
@@ -43,6 +43,7 @@
     assertEquals(4, o2[0]);
     assertEquals(o1, o2[1]);
   }
+  %PrepareFunctionForOptimization(func);
   func();
   func();
   %OptimizeFunctionOnNextCall(func);
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-deopt-3.js b/src/v8/test/mjsunit/compiler/escape-analysis-deopt-3.js
index 9999e53..e560f16 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-deopt-3.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-deopt-3.js
@@ -44,6 +44,7 @@
     assertEquals(4, o2[0]);
     assertEquals(o1, o2[1]);
   }
+  %PrepareFunctionForOptimization(func);
   func();
   func();
   %OptimizeFunctionOnNextCall(func);
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-deopt-4.js b/src/v8/test/mjsunit/compiler/escape-analysis-deopt-4.js
index c807657..99e4e5c 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-deopt-4.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-deopt-4.js
@@ -50,6 +50,7 @@
     assertEquals(o1, o2.a);
     assertEquals(4, o2.b);
   }
+  %PrepareFunctionForOptimization(func);
   func();
   func();
   %OptimizeFunctionOnNextCall(func);
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-deopt-5.js b/src/v8/test/mjsunit/compiler/escape-analysis-deopt-5.js
index e70f0b1..dde500f 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-deopt-5.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-deopt-5.js
@@ -35,6 +35,7 @@
   return x[0];
 }
 
+%PrepareFunctionForOptimization(f);
 assertEquals(f(), 23.1234);
 assertEquals(f(), 23.1234);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-deopt-6.js b/src/v8/test/mjsunit/compiler/escape-analysis-deopt-6.js
index 6a77628..da8aa37 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-deopt-6.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-deopt-6.js
@@ -10,6 +10,7 @@
   return a.length;
 }
 
+%PrepareFunctionForOptimization(f);
 assertEquals(3, f());
 assertEquals(3, f());
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-framestate-use-at-branchpoint.js b/src/v8/test/mjsunit/compiler/escape-analysis-framestate-use-at-branchpoint.js
index c86674e..cd6bfb0 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-framestate-use-at-branchpoint.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-framestate-use-at-branchpoint.js
@@ -13,6 +13,7 @@
  function bar() {i};
  return o.x;
 }
+%PrepareFunctionForOptimization(foo);
 foo();
 foo();
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-materialize.js b/src/v8/test/mjsunit/compiler/escape-analysis-materialize.js
index 6ad3a53..b0dd2d6 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-materialize.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-materialize.js
@@ -10,6 +10,7 @@
     %_DeoptimizeNow();
     return a.length;
   }
+  %PrepareFunctionForOptimization(f);
   assertEquals(3, f());
   assertEquals(3, f());
   %OptimizeFunctionOnNextCall(f);
@@ -22,6 +23,7 @@
     %_DeoptimizeNow();
     return fun.length;
   }
+  %PrepareFunctionForOptimization(g);
   assertEquals(2, g());
   assertEquals(2, g());
   %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-phi-type-2.js b/src/v8/test/mjsunit/compiler/escape-analysis-phi-type-2.js
index 2c2135b..a2d0936 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-phi-type-2.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-phi-type-2.js
@@ -29,6 +29,7 @@
   return o.a + 1;
 }
 
+%PrepareFunctionForOptimization(f);
 f(0,0);
 f(1,0);
 f(2,0);
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-phi-type.js b/src/v8/test/mjsunit/compiler/escape-analysis-phi-type.js
index 9d033b9..90adbe8 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-phi-type.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-phi-type.js
@@ -16,6 +16,7 @@
   return res;
 }
 
+%PrepareFunctionForOptimization(f);
 f(0);
 f(1);
 f(0);
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-replacement.js b/src/v8/test/mjsunit/compiler/escape-analysis-replacement.js
index ffe95e3..caa77a1 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-replacement.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-replacement.js
@@ -33,6 +33,7 @@
   return c.c;
 }
 
+%PrepareFunctionForOptimization(foo);
 foo(true);
 foo(false);
 foo(true);
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-representation.js b/src/v8/test/mjsunit/compiler/escape-analysis-representation.js
index e6cc9f1..7a7d122 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-representation.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-representation.js
@@ -50,6 +50,7 @@
   var deopt = { deopt:false };
 
   // Warm-up field tracking to a certain representation.
+  %PrepareFunctionForOptimization(access);
   access(value_track, value_track(), deopt);
   access(value_track, value_track(), deopt);
   %OptimizeFunctionOnNextCall(access);
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-rest-parameters.js b/src/v8/test/mjsunit/compiler/escape-analysis-rest-parameters.js
new file mode 100644
index 0000000..320465d
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-rest-parameters.js
@@ -0,0 +1,32 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Test variable index access to rest parameters
+// with up to 2 elements.
+(function testRestParametersVariableIndex() {
+  function g(...args) {
+    let s = 0;
+    for (let i = 0; i < args.length; ++i) s += args[i];
+    return s;
+  }
+
+  function f(x, y) {
+    // (a) args[i] is dead code since args.length is 0.
+    const a = g();
+    // (b) args[i] always yields the first element.
+    const b = g(x);
+    // (c) args[i] can yield either x or y.
+    const c = g(x, y);
+    return a + b + c;
+  }
+
+  %PrepareFunctionForOptimization(f);
+  assertEquals(4, f(1, 2));
+  assertEquals(5, f(2, 1));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(4, f(1, 2));
+  assertEquals(5, f(2, 1));
+})();
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-type-none-in-object-state.js b/src/v8/test/mjsunit/compiler/escape-analysis-type-none-in-object-state.js
index aee6485..1692e4a 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-type-none-in-object-state.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-type-none-in-object-state.js
@@ -18,6 +18,7 @@
   f(""+x);
 }
 
+%PrepareFunctionForOptimization(g);
 g("x"); g("x");
 %OptimizeFunctionOnNextCall(g);
 g("x");
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis-typeguard.js b/src/v8/test/mjsunit/compiler/escape-analysis-typeguard.js
index 8746a81..6d6cff1 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis-typeguard.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis-typeguard.js
@@ -15,6 +15,7 @@
   assertEquals(7, z.a);
 }
 
+%PrepareFunctionForOptimization(foo);
 foo();
 foo();
 foo();
diff --git a/src/v8/test/mjsunit/compiler/escape-analysis.js b/src/v8/test/mjsunit/compiler/escape-analysis.js
index 111ed63..6b4fc96 100644
--- a/src/v8/test/mjsunit/compiler/escape-analysis.js
+++ b/src/v8/test/mjsunit/compiler/escape-analysis.js
@@ -42,6 +42,7 @@
     }
     assertEquals(expected, object.a);
   }
+  %PrepareFunctionForOptimization(join);
   join(true, 1); join(true, 1);
   join(false, 2); join(false, 2);
   %OptimizeFunctionOnNextCall(join);
@@ -65,6 +66,7 @@
     assertEquals(45, object.a);
     assertEquals(23, object.b);
   }
+  %PrepareFunctionForOptimization(loop);
   loop(); loop();
   %OptimizeFunctionOnNextCall(loop);
   loop(); loop();
@@ -99,6 +101,7 @@
     assertEquals(54, object.b);
     assertEquals(23, object.c);
   }
+  %PrepareFunctionForOptimization(nested);
   nested(); nested();
   %OptimizeFunctionOnNextCall(nested);
   nested(); nested();
@@ -126,6 +129,7 @@
     assertEquals(3.0, o2.d.c);
     assertEquals(4.5, o2.e);
   }
+  %PrepareFunctionForOptimization(func);
   func(); func();
   %OptimizeFunctionOnNextCall(func);
   func(); func();
@@ -167,6 +171,7 @@
     assertEquals(5.9, o.e);
     assertEquals(6.7, o.g);
   }
+  %PrepareFunctionForOptimization(func);
   func(); func();
   %OptimizeFunctionOnNextCall(func);
   func(); func();
@@ -193,6 +198,7 @@
     x: { get:getter, set:setter },
     y: { get:getter, set:setter }
   });
+  %PrepareFunctionForOptimization(check);
   check(23, 42); check(23, 42);
   %OptimizeFunctionOnNextCall(check);
   check(23, 42); check(23, 42);
@@ -261,6 +267,7 @@
       return o.z;
     }
   }
+  %PrepareFunctionForOptimization(oob);
   assertEquals(3, oob(cons1, false));
   assertEquals(3, oob(cons1, false));
   assertEquals(7, oob(cons2, true));
@@ -295,6 +302,7 @@
     assertEquals(99, o1.x);
     assertEquals(99, o2.b.x);
   }
+  %PrepareFunctionForOptimization(deep);
   deep(); deep();
   %OptimizeFunctionOnNextCall(deep);
   deep(); deep();
@@ -333,6 +341,7 @@
     o3.b.x = 1;
     assertEquals(1, o1.x);
   }
+  %PrepareFunctionForOptimization(deep);
   deep(false); deep(false);
   %OptimizeFunctionOnNextCall(deep);
   deep(false); deep(false);
@@ -358,6 +367,7 @@
     assertEquals(3, r.x.y);
   }
 
+  %PrepareFunctionForOptimization(f);
   f(); f(); f();
   %OptimizeFunctionOnNextCall(f);
   f();
@@ -374,6 +384,7 @@
     assertEquals(111, l2.x.y);
   }
 
+  %PrepareFunctionForOptimization(f);
   f(); f(); f();
   %OptimizeFunctionOnNextCall(f);
   f();
@@ -392,6 +403,7 @@
     assertEquals(0, dummy.d);
   }
 
+  %PrepareFunctionForOptimization(f);
   f(); f(); f();
   %OptimizeFunctionOnNextCall(f);
   f();
@@ -410,6 +422,7 @@
     deopt.deopt
     assertEquals(x, o.x);
   }
+  %PrepareFunctionForOptimization(field);
   field(1); field(2);
   %OptimizeFunctionOnNextCall(field);
   field(3); field(4);
@@ -430,6 +443,7 @@
     deopt.deopt
     assertEquals(x, o.x);
   }
+  %PrepareFunctionForOptimization(field);
   field({}); field({});
   %OptimizeFunctionOnNextCall(field);
   field({}); field({});
diff --git a/src/v8/test/mjsunit/compiler/eval-introduced-closure.js b/src/v8/test/mjsunit/compiler/eval-introduced-closure.js
index 550c7c3..9b2d896 100644
--- a/src/v8/test/mjsunit/compiler/eval-introduced-closure.js
+++ b/src/v8/test/mjsunit/compiler/eval-introduced-closure.js
@@ -42,6 +42,7 @@
 }
 
 var eval_f = do_eval('(' + f + ')');
+%PrepareFunctionForOptimization(eval_f);
 for (var i = 0; i < 5; i++) assertEquals(27, eval_f());
 %OptimizeFunctionOnNextCall(eval_f);
 assertEquals(27, eval_f());
@@ -53,6 +54,7 @@
 }
 
 eval_f = do_eval_local('(' + f + ')');
+%PrepareFunctionForOptimization(eval_f);
 for (var i = 0; i < 5; i++) assertEquals(42, eval_f());
 %OptimizeFunctionOnNextCall(eval_f);
 assertEquals(42, eval_f());
@@ -65,6 +67,7 @@
 }
 
 eval_f = do_eval_with_other_eval_call('(' + f + ')');
+%PrepareFunctionForOptimization(eval_f);
 for (var i = 0; i < 5; i++) assertEquals(27, eval_f());
 %OptimizeFunctionOnNextCall(eval_f);
 assertEquals(27, eval_f());
@@ -72,6 +75,7 @@
 function test_non_strict_outer_eval() {
   function strict_eval(str) { "use strict"; return eval(str); }
   var eval_f = strict_eval('(' + f + ')');
+  %PrepareFunctionForOptimization(eval_f);
   for (var i = 0; i < 5; i++) assertEquals(27, eval_f());
   %OptimizeFunctionOnNextCall(eval_f);
   assertEquals(27, eval_f());
@@ -85,6 +89,7 @@
   "use strict";
   function strict_eval(str) { "use strict"; return eval(str); }
   var eval_f = strict_eval('(' + f + ')');
+  %PrepareFunctionForOptimization(eval_f);
   for (var i = 0; i < 5; i++) assertEquals(27, eval_f());
   %OptimizeFunctionOnNextCall(eval_f);
   assertEquals(27, eval_f());
diff --git a/src/v8/test/mjsunit/compiler/feedback-after-throw.js b/src/v8/test/mjsunit/compiler/feedback-after-throw.js
index 891e315..595d4c1 100644
--- a/src/v8/test/mjsunit/compiler/feedback-after-throw.js
+++ b/src/v8/test/mjsunit/compiler/feedback-after-throw.js
@@ -32,6 +32,7 @@
   return 1 > 5;
 };
 
+%PrepareFunctionForOptimization(foo);
 try { foo() } catch(e) {}
 try { foo() } catch(e) {}
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/field-representation-tracking.js b/src/v8/test/mjsunit/compiler/field-representation-tracking.js
new file mode 100644
index 0000000..7f03348
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/field-representation-tracking.js
@@ -0,0 +1,82 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --modify-field-representation-inplace
+// Flags: --no-always-opt --opt
+
+// Test that code embedding accesses to a Smi field gets properly
+// deoptimized if s->t field representation changes are done in-place.
+(function() {
+  function O(x) { this.x = x; }
+
+  function foo(o) { return o.x; }
+  %PrepareFunctionForOptimization(foo);
+  // We need to keep an instance around to make the GC stress testing work.
+  const o1 = new O(1);
+  foo(o1);
+  foo(new O(2));
+  %OptimizeFunctionOnNextCall(foo);
+  foo(new O(3));
+  assertOptimized(foo);
+
+  new O(null);
+  assertUnoptimized(foo);
+})();
+
+// Test that code embedding assignments to a Smi field gets properly
+// deoptimized if s->t field representation changes are done in-place.
+(function() {
+  function O(x) { this.x = x; }
+
+  function foo(o) { o.x = 0; }
+  %PrepareFunctionForOptimization(foo);
+  // We need to keep an instance around to make the GC stress testing work.
+  const o1 = new O(1);
+  foo(o1);
+  foo(new O(2));
+  %OptimizeFunctionOnNextCall(foo);
+  foo(new O(3));
+  assertOptimized(foo);
+
+  new O(null);
+  assertUnoptimized(foo);
+})();
+
+// Test that code embedding accesses to a HeapObject field gets properly
+// deoptimized if h->t field representation changes are done in-place.
+(function() {
+  function O(x) { this.x = x; }
+
+  function foo(o) { return o.x; }
+  %PrepareFunctionForOptimization(foo);
+  // We need to keep an instance around to make the GC stress testing work.
+  const onull = new O(null);
+  foo(onull);
+  foo(new O("Hello"));
+  %OptimizeFunctionOnNextCall(foo);
+  foo(new O({}));
+  assertOptimized(foo);
+
+  new O(1);
+  assertUnoptimized(foo);
+})();
+
+// Test that code embedding assignments to a Smi field gets properly
+// deoptimized if s->t field representation changes are done in-place.
+(function() {
+  function O(x) { this.x = x; }
+
+  function foo(o) { o.x = true; }
+  %PrepareFunctionForOptimization(foo);
+  // We need to keep an instance around to make the GC stress testing work.
+  const onull = new O(null);
+  foo(onull);
+  foo(new O("Hello"));
+  %OptimizeFunctionOnNextCall(foo);
+  foo(new O({}));
+  assertOptimized(foo);
+
+  new O(1);
+  assertUnoptimized(foo);
+})();
diff --git a/src/v8/test/mjsunit/compiler/for-in-1.js b/src/v8/test/mjsunit/compiler/for-in-1.js
index 80add89..f7cfa40 100644
--- a/src/v8/test/mjsunit/compiler/for-in-1.js
+++ b/src/v8/test/mjsunit/compiler/for-in-1.js
@@ -12,6 +12,7 @@
 }
 
 var a = [];
+%PrepareFunctionForOptimization(foo);
 assertEquals("", foo(a));
 assertEquals("", foo(a));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/for-in-2.js b/src/v8/test/mjsunit/compiler/for-in-2.js
index a586aff..d4b0397 100644
--- a/src/v8/test/mjsunit/compiler/for-in-2.js
+++ b/src/v8/test/mjsunit/compiler/for-in-2.js
@@ -12,6 +12,7 @@
 }
 
 var a = [];
+%PrepareFunctionForOptimization(foo);
 assertEquals("", foo(a));
 assertEquals("", foo(a));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/for-in-3.js b/src/v8/test/mjsunit/compiler/for-in-3.js
index 80f3fa5..0f43a75 100644
--- a/src/v8/test/mjsunit/compiler/for-in-3.js
+++ b/src/v8/test/mjsunit/compiler/for-in-3.js
@@ -12,6 +12,7 @@
 }
 
 var o = {};
+%PrepareFunctionForOptimization(foo);
 assertEquals("", foo(o));
 assertEquals("", foo(o));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/for-in-4.js b/src/v8/test/mjsunit/compiler/for-in-4.js
index d15c348..af5c0c8 100644
--- a/src/v8/test/mjsunit/compiler/for-in-4.js
+++ b/src/v8/test/mjsunit/compiler/for-in-4.js
@@ -12,6 +12,7 @@
 }
 
 var a = [];
+%PrepareFunctionForOptimization(foo);
 assertEquals("", foo(a));
 assertEquals("", foo(a));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/for-in-5.js b/src/v8/test/mjsunit/compiler/for-in-5.js
index 8f469ab..71c5d88 100644
--- a/src/v8/test/mjsunit/compiler/for-in-5.js
+++ b/src/v8/test/mjsunit/compiler/for-in-5.js
@@ -11,6 +11,7 @@
   return s;
 }
 var o = {a:1, b:2, c:3};
+%PrepareFunctionForOptimization(foo);
 assertEquals("abc", foo(o));
 assertEquals("abc", foo(o));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/function-apply.js b/src/v8/test/mjsunit/compiler/function-apply.js
index f9440de..70309ce 100644
--- a/src/v8/test/mjsunit/compiler/function-apply.js
+++ b/src/v8/test/mjsunit/compiler/function-apply.js
@@ -10,6 +10,7 @@
   function bar() { return this; }
   function foo() { return bar.apply(this, null); }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(42, foo.call(42));
   assertEquals(42, foo.call(42));
   %OptimizeFunctionOnNextCall(foo);
@@ -20,6 +21,7 @@
   function bar() { return this; }
   function foo() { return bar.apply(this, undefined); }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(42, foo.call(42));
   assertEquals(42, foo.call(42));
   %OptimizeFunctionOnNextCall(foo);
@@ -37,6 +39,7 @@
     }
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(1, foo());
   assertEquals(1, foo());
   %OptimizeFunctionOnNextCall(foo);
@@ -52,6 +55,7 @@
     }
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(1, foo());
   assertEquals(1, foo());
   %OptimizeFunctionOnNextCall(foo);
@@ -64,6 +68,7 @@
   function bar() { return this; }
   function foo() { return bar.apply(); }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(undefined, foo());
   assertEquals(undefined, foo());
   %OptimizeFunctionOnNextCall(foo);
@@ -74,6 +79,7 @@
   function bar() { return this; }
   function foo() { return bar.apply(this); }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(42, foo.call(42));
   assertEquals(42, foo.call(42));
   %OptimizeFunctionOnNextCall(foo);
@@ -84,6 +90,7 @@
   function bar() { return this; }
   function foo() { return bar.apply(this, arguments, this); }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(42, foo.call(42));
   assertEquals(42, foo.call(42));
   %OptimizeFunctionOnNextCall(foo);
@@ -100,6 +107,7 @@
     return Function.prototype.apply.call(undefined, this, dummy);
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertThrows(foo, TypeError);
   assertThrows(foo, TypeError);
   %OptimizeFunctionOnNextCall(foo);
@@ -114,6 +122,7 @@
     return Function.prototype.apply.call(null, this, dummy);
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertThrows(foo, TypeError);
   assertThrows(foo, TypeError);
   %OptimizeFunctionOnNextCall(foo);
@@ -128,6 +137,7 @@
     return Function.prototype.apply.call(null, this, dummy);
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertThrows(foo, TypeError);
   assertThrows(foo, TypeError);
   %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/function-bind.js b/src/v8/test/mjsunit/compiler/function-bind.js
index cc9451e..c760507 100644
--- a/src/v8/test/mjsunit/compiler/function-bind.js
+++ b/src/v8/test/mjsunit/compiler/function-bind.js
@@ -12,6 +12,7 @@
     return bar.bind(x);
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(0, foo(0)());
   assertEquals(1, foo(1)());
   %OptimizeFunctionOnNextCall(foo);
@@ -26,6 +27,7 @@
     return bar.bind(undefined, x);
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(0, foo(0)());
   assertEquals(1, foo(1)());
   %OptimizeFunctionOnNextCall(foo);
@@ -39,6 +41,7 @@
     return bar.bind(undefined, x);
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(0, foo(0)());
   assertEquals(1, foo(1)());
   %OptimizeFunctionOnNextCall(foo);
@@ -53,6 +56,7 @@
     return bar.bind(undefined, x, y);
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(0, foo(0, 0)());
   assertEquals(2, foo(1, 1)());
   %OptimizeFunctionOnNextCall(foo);
@@ -68,6 +72,7 @@
     return bar.bind(undefined, x, y);
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(0, foo(0, 0)());
   assertEquals(2, foo(1, 1)());
   %OptimizeFunctionOnNextCall(foo);
@@ -81,6 +86,7 @@
 
   function foo(g) { return bar(g.bind(null, 2)); }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(3, foo((x, y) => x + y));
   assertEquals(1, foo((x, y) => x - y));
   %OptimizeFunctionOnNextCall(foo);
@@ -93,6 +99,7 @@
 
   function foo(a) { return a.map(add.bind(null, 1)); }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals([1, 2, 3], foo([0, 1, 2]));
   assertEquals([2, 3, 4], foo([1, 2, 3]));
   %OptimizeFunctionOnNextCall(foo);
@@ -106,6 +113,7 @@
 
   function foo(inc) { return inc(1); }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(2, foo(inc));
   assertEquals(2, foo(inc));
   %OptimizeFunctionOnNextCall(foo);
@@ -118,6 +126,7 @@
 
   function foo() { return new B; }
 
+  %PrepareFunctionForOptimization(foo);
   assertInstanceof(foo(), A);
   assertInstanceof(foo(), B);
   %OptimizeFunctionOnNextCall(foo);
@@ -137,6 +146,7 @@
 
   function foo(z) { return new B(z); }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(1, foo(3).x);
   assertEquals(2, foo(3).y);
   assertEquals(3, foo(3).z);
@@ -154,6 +164,7 @@
     return new B;
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertInstanceof(foo(), A);
   assertInstanceof(foo(), A);
   %OptimizeFunctionOnNextCall(foo);
@@ -174,6 +185,7 @@
     return new B(z);
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(1, foo(3).x);
   assertEquals(2, foo(3).y);
   assertEquals(3, foo(3).z);
@@ -191,6 +203,7 @@
     return new B;
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertInstanceof(foo(B), A);
   assertInstanceof(foo(B), A);
   %OptimizeFunctionOnNextCall(foo);
@@ -211,6 +224,7 @@
     return new B(z);
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(1, foo(B, 3).x);
   assertEquals(2, foo(B, 3).y);
   assertEquals(3, foo(B, 3).z);
@@ -231,6 +245,7 @@
   };
   const B = C.__proto__ = A.bind(null, 1);
 
+  %PrepareFunctionForOptimization(C);
   assertInstanceof(new C(), A);
   assertInstanceof(new C(), B);
   assertInstanceof(new C(), C);
@@ -253,6 +268,7 @@
     return bar(B)
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertInstanceof(foo(B), A);
   assertInstanceof(foo(B), A);
   %OptimizeFunctionOnNextCall(foo);
@@ -276,6 +292,7 @@
     return bar(B, z);
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(1, foo(B, 3).x);
   assertEquals(2, foo(B, 3).y);
   assertEquals(3, foo(B, 3).z);
diff --git a/src/v8/test/mjsunit/compiler/function-caller.js b/src/v8/test/mjsunit/compiler/function-caller.js
index 1192e68..931e31f 100644
--- a/src/v8/test/mjsunit/compiler/function-caller.js
+++ b/src/v8/test/mjsunit/compiler/function-caller.js
@@ -18,6 +18,7 @@
     (function caller() { g() })();
   }
 
+  %PrepareFunctionForOptimization(f);
   f();
   f();
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/generator-jump-targets.js b/src/v8/test/mjsunit/compiler/generator-jump-targets.js
new file mode 100644
index 0000000..85251b5
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/generator-jump-targets.js
@@ -0,0 +1,21 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var gaga = 42;
+
+function* foo(x, b) {
+ if (b) return;
+ x.p;
+ while (true) {
+   gaga;
+   yield;
+ }
+}
+%PrepareFunctionForOptimization(foo);
+foo({p:42}, true);
+foo({p:42}, true);
+%OptimizeFunctionOnNextCall(foo);
+const g = foo({p:42}, false);
diff --git a/src/v8/test/mjsunit/compiler/global-delete.js b/src/v8/test/mjsunit/compiler/global-delete.js
index c32fda6..d87a597 100644
--- a/src/v8/test/mjsunit/compiler/global-delete.js
+++ b/src/v8/test/mjsunit/compiler/global-delete.js
@@ -5,6 +5,7 @@
 // Flags: --allow-natives-syntax
 
 function test(expected, f) {
+  %PrepareFunctionForOptimization(f);
   assertEquals(expected, f());
   assertEquals(expected, f());
   %OptimizeFunctionOnNextCall(f);
@@ -13,6 +14,7 @@
 }
 
 function testThrows(f) {
+  %PrepareFunctionForOptimization(f);
   assertThrows(f);
   assertThrows(f);
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/global-var-delete.js b/src/v8/test/mjsunit/compiler/global-var-delete.js
index a7ea9ea..bd9cf58 100644
--- a/src/v8/test/mjsunit/compiler/global-var-delete.js
+++ b/src/v8/test/mjsunit/compiler/global-var-delete.js
@@ -5,6 +5,7 @@
 // Flags: --allow-natives-syntax
 
 function test(expected, f) {
+  %PrepareFunctionForOptimization(f);
   assertEquals(expected, f());
   assertEquals(expected, f());
   %OptimizeFunctionOnNextCall(f);
@@ -13,6 +14,7 @@
 }
 
 function testThrows(f) {
+  %PrepareFunctionForOptimization(f);
   assertThrows(f);
   assertThrows(f);
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/increment-typefeedback.js b/src/v8/test/mjsunit/compiler/increment-typefeedback.js
index 53e5ed6..eeab425 100644
--- a/src/v8/test/mjsunit/compiler/increment-typefeedback.js
+++ b/src/v8/test/mjsunit/compiler/increment-typefeedback.js
@@ -32,6 +32,7 @@
   return x;
 }
 
+%PrepareFunctionForOptimization(f);
 f(0.5);
 f(0.5);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/inline-accessors1.js b/src/v8/test/mjsunit/compiler/inline-accessors1.js
index daa01ec..3cfbab5 100644
--- a/src/v8/test/mjsunit/compiler/inline-accessors1.js
+++ b/src/v8/test/mjsunit/compiler/inline-accessors1.js
@@ -20,6 +20,7 @@
     }
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(1, foo(o));
   assertEquals(1, foo(o));
   %OptimizeFunctionOnNextCall(foo);
@@ -43,6 +44,7 @@
     }
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(1, foo(o));
   assertEquals(1, foo(o));
   %OptimizeFunctionOnNextCall(foo);
@@ -70,6 +72,7 @@
     }
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(0, foo(o));
   assertEquals(0, foo(o));
   %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/inline-accessors2.js b/src/v8/test/mjsunit/compiler/inline-accessors2.js
index b3985bf..c13cf83 100644
--- a/src/v8/test/mjsunit/compiler/inline-accessors2.js
+++ b/src/v8/test/mjsunit/compiler/inline-accessors2.js
@@ -36,6 +36,7 @@
   forceDeopt = { deopt: 0 };
   accessorCallCount = 0;
 
+  %PrepareFunctionForOptimization(context);
   assertEquals(expected, context(obj));
   assertEquals(1, accessorCallCount);
 
@@ -194,6 +195,7 @@
   accessorCallCount = 0;
   setterArgument = value;
 
+  %PrepareFunctionForOptimization(context);
   assertEquals(expected, context(obj, value));
   assertEquals(value, setterValue);
   assertEquals(1, accessorCallCount);
diff --git a/src/v8/test/mjsunit/compiler/inline-arguments.js b/src/v8/test/mjsunit/compiler/inline-arguments.js
index 13f4a33..4ee823f 100644
--- a/src/v8/test/mjsunit/compiler/inline-arguments.js
+++ b/src/v8/test/mjsunit/compiler/inline-arguments.js
@@ -46,6 +46,7 @@
 };
 
 var a = new A();
+%PrepareFunctionForOptimization(a.Z);
 a.Z(4,5,6);
 a.Z(4,5,6);
 %OptimizeFunctionOnNextCall(a.Z);
@@ -75,6 +76,7 @@
   return F31(1);
 }
 
+%PrepareFunctionForOptimization(F4);
 F4(1);
 F4(1);
 F4(1);
@@ -108,6 +110,7 @@
     adapt4to2(1, 2, 3, 4);
   }
 
+  %PrepareFunctionForOptimization(test_adaptation);
   test_adaptation();
   test_adaptation();
   %OptimizeFunctionOnNextCall(test_adaptation);
@@ -146,6 +149,7 @@
 
 function test_toarr(toarr) {
   var marker = { x: 0 };
+  %PrepareFunctionForOptimization(toarr);
   assertArrayEquals([3, 2, 1], toarr(marker, 2, 4, 6));
   assertArrayEquals([3, 2, 1], toarr(marker, 2, 4, 6));
   %OptimizeFunctionOnNextCall(toarr);
@@ -175,7 +179,10 @@
     return inner(x, y);
   }
 
+  %PrepareFunctionForOptimization(outer);
   %OptimizeFunctionOnNextCall(outer);
+  assertEquals(2, outer(1, 2));
+  %PrepareFunctionForOptimization(inner);
   %OptimizeFunctionOnNextCall(inner);
   assertEquals(2, outer(1, 2));
 })();
@@ -197,6 +204,7 @@
     return inner(x, y);
   }
 
+  %PrepareFunctionForOptimization(outer);
   assertEquals(2, outer(1, 2));
   assertEquals(2, outer(1, 2));
   assertEquals(2, outer(1, 2));
@@ -242,6 +250,7 @@
       }
     }
 
+    %PrepareFunctionForOptimization(outer);
     for (var step = 0; step < 4; step++) {
       if (outerCount == 1) outer(10);
       if (outerCount == 2) outer(10, 11);
@@ -302,6 +311,7 @@
     );
   }
 
+  %PrepareFunctionForOptimization(outer);
   outer();
   outer();
   %OptimizeFunctionOnNextCall(outer);
diff --git a/src/v8/test/mjsunit/compiler/inline-arity-mismatch.js b/src/v8/test/mjsunit/compiler/inline-arity-mismatch.js
index 4a61fa3..1a942d9 100644
--- a/src/v8/test/mjsunit/compiler/inline-arity-mismatch.js
+++ b/src/v8/test/mjsunit/compiler/inline-arity-mismatch.js
@@ -48,13 +48,16 @@
 
 var o = {x: 2};
 
+%PrepareFunctionForOptimization(h1);
 assertEquals(4, h1(o, o));
 assertEquals(4, h1(o, o));
-assertEquals(4, h2(o, o));
-assertEquals(4, h2(o, o));
 %OptimizeFunctionOnNextCall(h1);
-%OptimizeFunctionOnNextCall(h2);
 assertEquals(4, h1(o, o));
+
+%PrepareFunctionForOptimization(h2);
+assertEquals(4, h2(o, o));
+assertEquals(4, h2(o, o));
+%OptimizeFunctionOnNextCall(h2);
 assertEquals(4, h2(o, o));
 
 var u = {y:0, x:1};
diff --git a/src/v8/test/mjsunit/compiler/inline-closures.js b/src/v8/test/mjsunit/compiler/inline-closures.js
index 69161e5..3ee7584 100644
--- a/src/v8/test/mjsunit/compiler/inline-closures.js
+++ b/src/v8/test/mjsunit/compiler/inline-closures.js
@@ -42,6 +42,7 @@
 object.g = mkClosure('h');
 object.h = mkClosure('x');
 
+%PrepareFunctionForOptimization(object.f);
 assertSame(1, object.f({value:1}));
 assertSame(2, object.f({value:2}));
 %OptimizeFunctionOnNextCall(object.f);
diff --git a/src/v8/test/mjsunit/compiler/inline-compare.js b/src/v8/test/mjsunit/compiler/inline-compare.js
index d97dce2..2d9c7a2 100644
--- a/src/v8/test/mjsunit/compiler/inline-compare.js
+++ b/src/v8/test/mjsunit/compiler/inline-compare.js
@@ -42,6 +42,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(TestInlineCompare);
 var o = {};
 o.f = function() { return 0 === 1; };
 for (var i = 0; i < 5; i++) TestInlineCompare(o);
diff --git a/src/v8/test/mjsunit/compiler/inline-construct.js b/src/v8/test/mjsunit/compiler/inline-construct.js
index 111c0f3..4c5c997 100644
--- a/src/v8/test/mjsunit/compiler/inline-construct.js
+++ b/src/v8/test/mjsunit/compiler/inline-construct.js
@@ -35,6 +35,7 @@
   var noDeopt = { deopt:0 };
   var forceDeopt = { /*empty*/ };
 
+  %PrepareFunctionForOptimization(closure);
   result = closure(constructor, 11, noDeopt, counter);
   assertEquals(11, result);
   assertEquals(1, counter.value);
@@ -119,6 +120,7 @@
   var obj = new c_too_many(a, b, c);
   return obj.x;
 }
+%PrepareFunctionForOptimization(f_too_many);
 assertEquals(23, f_too_many(11, 12, 1));
 assertEquals(42, f_too_many(23, 19, 1));
 %OptimizeFunctionOnNextCall(f_too_many);
@@ -135,6 +137,7 @@
   var obj = new c_too_few(a);
   return obj.x;
 }
+%PrepareFunctionForOptimization(f_too_few);
 assertEquals(12, f_too_few(11));
 assertEquals(24, f_too_few(23));
 %OptimizeFunctionOnNextCall(f_too_few);
diff --git a/src/v8/test/mjsunit/compiler/inline-context-deopt.js b/src/v8/test/mjsunit/compiler/inline-context-deopt.js
index ef134ad..4b20719 100644
--- a/src/v8/test/mjsunit/compiler/inline-context-deopt.js
+++ b/src/v8/test/mjsunit/compiler/inline-context-deopt.js
@@ -14,5 +14,6 @@
   return foo(s);
 }
 
+%PrepareFunctionForOptimization(bar);
 %OptimizeFunctionOnNextCall(bar);
 assertEquals(13, bar(1, 2));
diff --git a/src/v8/test/mjsunit/compiler/inline-context-slots.js b/src/v8/test/mjsunit/compiler/inline-context-slots.js
index d0e907b..a78d28e 100644
--- a/src/v8/test/mjsunit/compiler/inline-context-slots.js
+++ b/src/v8/test/mjsunit/compiler/inline-context-slots.js
@@ -43,6 +43,7 @@
     return this.max();
   }
   var f = new F();
+  %PrepareFunctionForOptimization(f.run);
   for (var i=0; i<5; i++) f.run();
   %OptimizeFunctionOnNextCall(f.run);
   assertEquals(10, f.run());
diff --git a/src/v8/test/mjsunit/compiler/inline-exception-1.js b/src/v8/test/mjsunit/compiler/inline-exception-1.js
index 8da6845..b8b650b 100644
--- a/src/v8/test/mjsunit/compiler/inline-exception-1.js
+++ b/src/v8/test/mjsunit/compiler/inline-exception-1.js
@@ -30,6 +30,7 @@
 }
 
 function resetOptAndAssertResultEquals(expected, f) {
+  %PrepareFunctionForOptimization(f);
   warmUp(f);
   resetState();
   // %DebugPrint(f);
@@ -39,6 +40,7 @@
 }
 
 function resetOptAndAssertThrowsWith(expected, f) {
+  %PrepareFunctionForOptimization(f);
   warmUp(f);
   resetState();
   // %DebugPrint(f);
diff --git a/src/v8/test/mjsunit/compiler/inline-exception-2.js b/src/v8/test/mjsunit/compiler/inline-exception-2.js
index 6dbc7a4..945be2d 100644
--- a/src/v8/test/mjsunit/compiler/inline-exception-2.js
+++ b/src/v8/test/mjsunit/compiler/inline-exception-2.js
@@ -30,6 +30,7 @@
 }
 
 function resetOptAndAssertResultEquals(expected, f) {
+  %PrepareFunctionForOptimization(f);
   warmUp(f);
   resetState();
   // %DebugPrint(f);
@@ -39,6 +40,7 @@
 }
 
 function resetOptAndAssertThrowsWith(expected, f) {
+  %PrepareFunctionForOptimization(f);
   warmUp(f);
   resetState();
   // %DebugPrint(f);
diff --git a/src/v8/test/mjsunit/compiler/inline-function-apply.js b/src/v8/test/mjsunit/compiler/inline-function-apply.js
index 12238e1..8ccb816 100644
--- a/src/v8/test/mjsunit/compiler/inline-function-apply.js
+++ b/src/v8/test/mjsunit/compiler/inline-function-apply.js
@@ -68,6 +68,7 @@
       return r;
     }
 
+    %PrepareFunctionForOptimization(A);
     assertEquals("ABC", A(1,2));
     assertEquals("ABC", A(1,2));
     %OptimizeFunctionOnNextCall(A);
diff --git a/src/v8/test/mjsunit/compiler/inline-global-access.js b/src/v8/test/mjsunit/compiler/inline-global-access.js
index b52652a..da6b25e 100644
--- a/src/v8/test/mjsunit/compiler/inline-global-access.js
+++ b/src/v8/test/mjsunit/compiler/inline-global-access.js
@@ -45,6 +45,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(TestInlineGlobalLoad);
 var o = {};
 o.f = function() { return GLOBAL; };
 for (var i = 0; i < 5; i++) TestInlineGlobalLoad(o);
diff --git a/src/v8/test/mjsunit/compiler/inline-literals.js b/src/v8/test/mjsunit/compiler/inline-literals.js
index 4487996..7718ae0 100644
--- a/src/v8/test/mjsunit/compiler/inline-literals.js
+++ b/src/v8/test/mjsunit/compiler/inline-literals.js
@@ -43,6 +43,7 @@
   assertEquals(expected, result, "TestArrayLiteral");
 }
 
+%PrepareFunctionForOptimization(TestArrayLiteral);
 TestArrayLiteral(1, 2, 3);
 TestArrayLiteral(1, 2, 3);
 %OptimizeFunctionOnNextCall(TestArrayLiteral);
@@ -63,6 +64,7 @@
   assertEquals(expected, result, "TestObjectLiteral");
 }
 
+%PrepareFunctionForOptimization(TestObjectLiteral);
 TestObjectLiteral(1, 2, 3);
 TestObjectLiteral(1, 2, 3);
 %OptimizeFunctionOnNextCall(TestObjectLiteral);
@@ -82,6 +84,7 @@
   assertEquals(expected, result, "TestRegExpLiteral");
 }
 
+%PrepareFunctionForOptimization(TestRegExpLiteral);
 TestRegExpLiteral("a-", "reg", "exp", "regexp-");
 TestRegExpLiteral("-b", "reg", "exp", "-expreg");
 %OptimizeFunctionOnNextCall(TestRegExpLiteral);
@@ -103,6 +106,7 @@
   assertEquals(expected, result, "TestFunctionLiteral");
 }
 
+%PrepareFunctionForOptimization(TestFunctionLiteral);
 TestFunctionLiteral(1, 2, 3, 6);
 TestFunctionLiteral(4, 5, 6, 15);
 %OptimizeFunctionOnNextCall(TestFunctionLiteral);
diff --git a/src/v8/test/mjsunit/compiler/inline-omit-arguments-deopt.js b/src/v8/test/mjsunit/compiler/inline-omit-arguments-deopt.js
index 65bfce7..8e909bf 100644
--- a/src/v8/test/mjsunit/compiler/inline-omit-arguments-deopt.js
+++ b/src/v8/test/mjsunit/compiler/inline-omit-arguments-deopt.js
@@ -15,5 +15,6 @@
   return foo.arguments.length == 1 && foo.arguments[0] == 11;
 }
 
+%PrepareFunctionForOptimization(bar);
 %OptimizeFunctionOnNextCall(bar);
 assertEquals(true, bar(12, 14));
diff --git a/src/v8/test/mjsunit/compiler/inline-omit-arguments-object.js b/src/v8/test/mjsunit/compiler/inline-omit-arguments-object.js
index 342b78c..2154a1b 100644
--- a/src/v8/test/mjsunit/compiler/inline-omit-arguments-object.js
+++ b/src/v8/test/mjsunit/compiler/inline-omit-arguments-object.js
@@ -10,5 +10,6 @@
   return args.length == 1 && args[0] == 11;
 }
 
+%PrepareFunctionForOptimization(foo);
 %OptimizeFunctionOnNextCall(foo);
 assertEquals(true, foo(11));
diff --git a/src/v8/test/mjsunit/compiler/inline-omit-arguments.js b/src/v8/test/mjsunit/compiler/inline-omit-arguments.js
index d72e453..9b14993 100644
--- a/src/v8/test/mjsunit/compiler/inline-omit-arguments.js
+++ b/src/v8/test/mjsunit/compiler/inline-omit-arguments.js
@@ -8,5 +8,6 @@
 function bar(s, t, u, v) { return x + s; }
 function foo(s, t) { return bar(s); }
 
+%PrepareFunctionForOptimization(foo);
 %OptimizeFunctionOnNextCall(foo);
 assertEquals(42 + 12, foo(12));
diff --git a/src/v8/test/mjsunit/compiler/inline-param.js b/src/v8/test/mjsunit/compiler/inline-param.js
index 8fa8008..6c46161 100644
--- a/src/v8/test/mjsunit/compiler/inline-param.js
+++ b/src/v8/test/mjsunit/compiler/inline-param.js
@@ -41,6 +41,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(TestInlineOneParam);
 var obj = {x:42};
 var o1 = {};
 o1.f = function(o) { return o.x; };
@@ -78,6 +79,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(TestInlineTwoParams);
 var o2 = {};
 o2.h = function(i, j) { return i < j; };
 for (var i = 0; i < 5; i++) TestInlineTwoParams(o2, 42);
diff --git a/src/v8/test/mjsunit/compiler/inline-surplus-arguments-deopt.js b/src/v8/test/mjsunit/compiler/inline-surplus-arguments-deopt.js
index dfbdd8d..190c686 100644
--- a/src/v8/test/mjsunit/compiler/inline-surplus-arguments-deopt.js
+++ b/src/v8/test/mjsunit/compiler/inline-surplus-arguments-deopt.js
@@ -16,5 +16,6 @@
          foo.arguments[2] == 15;
 }
 
+%PrepareFunctionForOptimization(bar);
 %OptimizeFunctionOnNextCall(bar);
 assertEquals(true, bar(12, 14));
diff --git a/src/v8/test/mjsunit/compiler/inline-surplus-arguments-object.js b/src/v8/test/mjsunit/compiler/inline-surplus-arguments-object.js
index fec77af..83bfbf5 100644
--- a/src/v8/test/mjsunit/compiler/inline-surplus-arguments-object.js
+++ b/src/v8/test/mjsunit/compiler/inline-surplus-arguments-object.js
@@ -13,5 +13,6 @@
          args[2] == 13;
 }
 
+%PrepareFunctionForOptimization(bar);
 %OptimizeFunctionOnNextCall(bar);
 assertEquals(true, bar(11, 12));
diff --git a/src/v8/test/mjsunit/compiler/inline-surplus-arguments.js b/src/v8/test/mjsunit/compiler/inline-surplus-arguments.js
index c912aca..b75c5df 100644
--- a/src/v8/test/mjsunit/compiler/inline-surplus-arguments.js
+++ b/src/v8/test/mjsunit/compiler/inline-surplus-arguments.js
@@ -8,5 +8,6 @@
 function foo(s) { return x + s; }
 function bar(s, t) { return foo(s, t, 13); }
 
+%PrepareFunctionForOptimization(bar);
 %OptimizeFunctionOnNextCall(bar);
 assertEquals(42 + 12, bar(12));
diff --git a/src/v8/test/mjsunit/compiler/inline-throw.js b/src/v8/test/mjsunit/compiler/inline-throw.js
index 099b9d3..a3e31ab 100644
--- a/src/v8/test/mjsunit/compiler/inline-throw.js
+++ b/src/v8/test/mjsunit/compiler/inline-throw.js
@@ -42,6 +42,7 @@
   return f(x);
 }
 
+%PrepareFunctionForOptimization(g);
 for (var i = 0; i < 5; i++) g(0);
 %OptimizeFunctionOnNextCall(g);
 assertEquals(true, g(0));
@@ -57,6 +58,7 @@
   return f(x) ? "yes" : "no";
 }
 
+%PrepareFunctionForOptimization(h);
 for (var i = 0; i < 5; i++) h(0);
 %OptimizeFunctionOnNextCall(h);
 assertEquals("yes", h(0));
diff --git a/src/v8/test/mjsunit/compiler/inline-two.js b/src/v8/test/mjsunit/compiler/inline-two.js
index 68372a9..2157109 100644
--- a/src/v8/test/mjsunit/compiler/inline-two.js
+++ b/src/v8/test/mjsunit/compiler/inline-two.js
@@ -41,6 +41,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(TestInlineX);
 var o2 = {};
 o2.size = function() { return 42; }
 o2.g = function() { return this.size(); };
@@ -64,6 +65,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(TestInlineX2);
 var obj = {}
 obj.foo = function() { return 42; }
 var o3 = {};
@@ -89,6 +91,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(TestInlineFG);
 var obj = {}
 obj.g = function() { return 42; }
 var o3 = {};
diff --git a/src/v8/test/mjsunit/compiler/inlined-array-pop-getter1.js b/src/v8/test/mjsunit/compiler/inlined-array-pop-getter1.js
index 8eb1c30..3dfcf03 100644
--- a/src/v8/test/mjsunit/compiler/inlined-array-pop-getter1.js
+++ b/src/v8/test/mjsunit/compiler/inlined-array-pop-getter1.js
@@ -10,6 +10,7 @@
 
 var a = new Array(4);
 
+%PrepareFunctionForOptimization(foo);
 assertEquals(undefined, foo(a));
 assertEquals(undefined, foo(a));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/inlined-array-pop-getter2.js b/src/v8/test/mjsunit/compiler/inlined-array-pop-getter2.js
index 8ae6426..78e2b53 100644
--- a/src/v8/test/mjsunit/compiler/inlined-array-pop-getter2.js
+++ b/src/v8/test/mjsunit/compiler/inlined-array-pop-getter2.js
@@ -15,6 +15,7 @@
 var o = {}
 o.__defineGetter__(0, function() { return 1; });
 
+%PrepareFunctionForOptimization(foo);
 assertEquals(undefined, foo(a));
 assertEquals(undefined, foo(a));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/inlined-array-pop-opt.js b/src/v8/test/mjsunit/compiler/inlined-array-pop-opt.js
index 08cbdbe..7fe6cd5 100644
--- a/src/v8/test/mjsunit/compiler/inlined-array-pop-opt.js
+++ b/src/v8/test/mjsunit/compiler/inlined-array-pop-opt.js
@@ -10,6 +10,7 @@
   var x = {};
   var a = [x,x,];
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(x, foo(a));
   assertEquals(x, foo(a));
   %OptimizeFunctionOnNextCall(foo);
@@ -23,6 +24,7 @@
   var x = 0;
   var a = [x,x,];
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(x, foo(a));
   assertEquals(x, foo(a));
   %OptimizeFunctionOnNextCall(foo);
@@ -36,6 +38,7 @@
   var x = 0;
   var a = [x,x,x];
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(x, foo(a));
   assertEquals(x, foo(a));
   %OptimizeFunctionOnNextCall(foo);
@@ -49,6 +52,7 @@
   var x = {};
   var a = [x,x,x];
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(x, foo(a));
   assertEquals(x, foo(a));
   %OptimizeFunctionOnNextCall(foo);
@@ -61,6 +65,7 @@
 
   var a = [,,];
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(undefined, foo(a));
   assertEquals(undefined, foo(a));
   %OptimizeFunctionOnNextCall(foo);
@@ -75,6 +80,7 @@
 
   var a = [1, 2, 3];
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(3, foo(a));
   assertEquals(2, foo(a));
   %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/inlined-call-mapcheck.js b/src/v8/test/mjsunit/compiler/inlined-call-mapcheck.js
index 1f7b2da..3a02e70 100644
--- a/src/v8/test/mjsunit/compiler/inlined-call-mapcheck.js
+++ b/src/v8/test/mjsunit/compiler/inlined-call-mapcheck.js
@@ -36,6 +36,7 @@
 
     function g() {}
 
+    %PrepareFunctionForOptimization(f);
     f(g);
     f(g);
     %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/inlined-call.js b/src/v8/test/mjsunit/compiler/inlined-call.js
index 772dcbe..0c8134a 100644
--- a/src/v8/test/mjsunit/compiler/inlined-call.js
+++ b/src/v8/test/mjsunit/compiler/inlined-call.js
@@ -69,6 +69,7 @@
   [].unshift.call(array, num);
 }
 
+%PrepareFunctionForOptimization(unshiftsArray);
 unshiftsArray(50);
 unshiftsArray(60);
 %OptimizeFunctionOnNextCall(unshiftsArray);
@@ -93,6 +94,7 @@
   [].fun.call();
 }
 
+%PrepareFunctionForOptimization(callNoArgs);
 callNoArgs();
 callNoArgs();
 assertEquals(this, funRecv);
@@ -109,6 +111,7 @@
   [].funStrict.call();
 }
 
+%PrepareFunctionForOptimization(callStrictNoArgs);
 callStrictNoArgs();
 callStrictNoArgs();
 assertEquals(undefined, funStrictRecv);
@@ -125,6 +128,7 @@
   [].manyArgs.call(0, 1, 2, 3, 4, 5);
 }
 
+%PrepareFunctionForOptimization(callManyArgs);
 callManyArgs();
 callManyArgs();
 %OptimizeFunctionOnNextCall(callManyArgs);
@@ -139,6 +143,7 @@
   [].manyArgsSloppy.call(null, 1, 2, 3, 4, 5);
 }
 
+%PrepareFunctionForOptimization(callManyArgsSloppy);
 callManyArgsSloppy();
 callManyArgsSloppy();
 %OptimizeFunctionOnNextCall(callManyArgsSloppy);
@@ -154,6 +159,7 @@
   return "".charCodeAt.call(str, 3);
 }
 
+%PrepareFunctionForOptimization(callBuiltinIndirectly);
 callBuiltinIndirectly();
 callBuiltinIndirectly();
 %OptimizeFunctionOnNextCall(callBuiltinIndirectly);
@@ -174,12 +180,14 @@
   return callInlineableBuiltinIndirectlyWhileInlined(num);
 }
 
+%PrepareFunctionForOptimization(callInlineableBuiltinIndirectlyWhileInlined);
 callInlineableBuiltinIndirectlyWhileInlined(1);
 callInlineableBuiltinIndirectlyWhileInlined(2);
 %OptimizeFunctionOnNextCall(callInlineableBuiltinIndirectlyWhileInlined);
 callInlineableBuiltinIndirectlyWhileInlined(3);
 assertOptimized(callInlineableBuiltinIndirectlyWhileInlined);
 
+%PrepareFunctionForOptimization(callInlined);
 callInlined(1);
 callInlined(2);
 %OptimizeFunctionOnNextCall(callInlined);
diff --git a/src/v8/test/mjsunit/compiler/instance-of-overridden-has-instance.js b/src/v8/test/mjsunit/compiler/instance-of-overridden-has-instance.js
new file mode 100644
index 0000000..c82fedf
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/instance-of-overridden-has-instance.js
@@ -0,0 +1,111 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function NonConstHasInstance() {
+  var C = {
+    [Symbol.hasInstance] : () => true
+  };
+
+  function f() {
+    return {} instanceof C;
+  }
+
+  %PrepareFunctionForOptimization(f);
+  assertTrue(f());
+  assertTrue(f());
+  %OptimizeFunctionOnNextCall(f);
+  assertTrue(f());
+  C[Symbol.hasInstance] = () => false;
+  assertFalse(f());
+})();
+
+(function NumberHasInstance() {
+  var C = {
+    [Symbol.hasInstance] : 0.1
+  };
+
+  function f(b, C) {
+    if (b) return {} instanceof C;
+    return false;
+  }
+
+  function g(b) {
+    return f(b, C);
+  }
+
+  %PrepareFunctionForOptimization(g);
+  assertFalse(f(true, Number));
+  assertFalse(f(true, Number));
+  assertFalse(g(false));
+  assertFalse(g(false));
+  %OptimizeFunctionOnNextCall(g);
+  assertThrows(() => g(true));
+})();
+
+(function NonFunctionHasInstance() {
+  var C = {
+    [Symbol.hasInstance] : {}
+  };
+
+  function f(b, C) {
+    if (b) return {} instanceof C;
+    return false;
+  }
+
+  function g(b) {
+    return f(b, C);
+  }
+
+  %PrepareFunctionForOptimization(g);
+  assertFalse(f(true, Number));
+  assertFalse(f(true, Number));
+  assertFalse(g(false));
+  assertFalse(g(false));
+  %OptimizeFunctionOnNextCall(g);
+  assertThrows(() => g(true));
+})();
+
+(function NonConstHasInstanceProto() {
+  var B = {
+    [Symbol.hasInstance]() { return true; }
+  };
+
+  var C = { __proto__ : B };
+
+  function f() {
+    return {} instanceof C;
+  }
+
+  %PrepareFunctionForOptimization(f);
+  assertTrue(f());
+  assertTrue(f());
+  %OptimizeFunctionOnNextCall(f);
+  assertTrue(f());
+  B[Symbol.hasInstance] = () => { return false; };
+  assertFalse(f());
+})();
+
+(function HasInstanceOverwriteOnProto() {
+  var A = {
+    [Symbol.hasInstance] : () => false
+  }
+
+  var B = { __proto__ : A };
+
+  var C = { __proto__ : B };
+
+  function f() {
+    return {} instanceof C;
+  }
+
+  %PrepareFunctionForOptimization(f);
+  assertFalse(f());
+  assertFalse(f());
+  %OptimizeFunctionOnNextCall(f);
+  assertFalse(f());
+  B[Symbol.hasInstance] = () => { return true; };
+  assertTrue(f());
+})();
diff --git a/src/v8/test/mjsunit/compiler/instanceof-opt1.js b/src/v8/test/mjsunit/compiler/instanceof-opt1.js
index 6ffdfc0..0549222 100644
--- a/src/v8/test/mjsunit/compiler/instanceof-opt1.js
+++ b/src/v8/test/mjsunit/compiler/instanceof-opt1.js
@@ -12,6 +12,7 @@
 // OrdinaryHasInstance call inside Function.prototype[@@hasInstance].
 function foo() { return 1 instanceof Foo; }
 
+%PrepareFunctionForOptimization(foo);
 assertEquals(false, foo());
 assertEquals(false, foo());
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/instanceof-opt2.js b/src/v8/test/mjsunit/compiler/instanceof-opt2.js
index 6f57faf..bddff35 100644
--- a/src/v8/test/mjsunit/compiler/instanceof-opt2.js
+++ b/src/v8/test/mjsunit/compiler/instanceof-opt2.js
@@ -10,6 +10,7 @@
 // OrdinaryHasInstance call inside Function.prototype[@@hasInstance].
 function foo() { return 1 instanceof Foo; }
 
+%PrepareFunctionForOptimization(foo);
 assertEquals(false, foo());
 assertEquals(false, foo());
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/instanceof-opt3.js b/src/v8/test/mjsunit/compiler/instanceof-opt3.js
index 3317d8a..439f39b 100644
--- a/src/v8/test/mjsunit/compiler/instanceof-opt3.js
+++ b/src/v8/test/mjsunit/compiler/instanceof-opt3.js
@@ -11,6 +11,7 @@
 // OrdinaryHasInstance call inside Function.prototype[@@hasInstance].
 function foo() { return 1 instanceof Foo; }
 
+%PrepareFunctionForOptimization(foo);
 assertEquals(false, foo());
 assertEquals(false, foo());
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/instanceof.js b/src/v8/test/mjsunit/compiler/instanceof.js
index 67127cf..ad0d2c1 100644
--- a/src/v8/test/mjsunit/compiler/instanceof.js
+++ b/src/v8/test/mjsunit/compiler/instanceof.js
@@ -42,6 +42,7 @@
 (function() {
   function foo(o) { return o instanceof A; }
 
+  %PrepareFunctionForOptimization(foo);
   assertTrue(foo(a));
   assertTrue(foo(a));
   assertTrue(foo(new A()));
@@ -59,6 +60,7 @@
     }
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertTrue(foo(a));
   assertTrue(foo(a));
   assertTrue(foo(new A()));
@@ -72,6 +74,7 @@
 (function() {
   function foo(o) { return o instanceof B; }
 
+  %PrepareFunctionForOptimization(foo);
   assertFalse(foo(a));
   assertFalse(foo(a));
   assertFalse(foo(new A()));
@@ -83,6 +86,7 @@
 (function() {
   function foo(o) { return o instanceof C; }
 
+  %PrepareFunctionForOptimization(foo);
   assertTrue(foo(a));
   assertTrue(foo(a));
   assertTrue(foo(new A()));
@@ -94,6 +98,7 @@
 (function() {
   function foo(o) { return o instanceof D; }
 
+  %PrepareFunctionForOptimization(foo);
   assertTrue(foo(a));
   assertTrue(foo(a));
   assertFalse(foo(new A()));
@@ -111,6 +116,7 @@
     }
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertFalse(foo(a));
   assertTrue(foo(new A()));
   %OptimizeFunctionOnNextCall(foo);
@@ -123,6 +129,7 @@
     return o instanceof F;
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertFalse(foo(a));
   assertFalse(foo(new A()));
   assertTrue(foo(new F()));
@@ -138,6 +145,7 @@
     return a instanceof A;
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertTrue(foo());
   assertTrue(foo());
   %OptimizeFunctionOnNextCall(foo);
@@ -155,6 +163,7 @@
   makeFoo();
   const foo = makeFoo();
 
+  %PrepareFunctionForOptimization(foo);
   assertTrue(foo(new B));
   assertFalse(foo(new A));
   %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/instanceof2.js b/src/v8/test/mjsunit/compiler/instanceof2.js
new file mode 100644
index 0000000..3d5b904
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/instanceof2.js
@@ -0,0 +1,247 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+
+// Without instance creation:
+
+(function() {
+  function Goo() {};
+  const goo = {};
+
+  function IsGoo(x) {
+    return x instanceof Goo;
+  }
+
+  %PrepareFunctionForOptimization(IsGoo);
+  assertFalse(IsGoo(goo));
+  assertFalse(IsGoo(goo));
+  %OptimizeFunctionOnNextCall(IsGoo);
+  assertFalse(IsGoo(goo));
+})();
+
+(function() {
+  function Goo() {};
+  const goo = {};
+  Goo.prototype = Object.prototype;
+
+  function IsGoo(x) {
+    return x instanceof Goo;
+  }
+
+  %PrepareFunctionForOptimization(IsGoo);
+  assertTrue(IsGoo(goo));
+  assertTrue(IsGoo(goo));
+  %OptimizeFunctionOnNextCall(IsGoo);
+  assertTrue(IsGoo(goo));
+})();
+
+(function() {
+  function Goo() {};
+  const goo = {};
+  Goo.prototype = 42
+
+  function IsGoo(x) {
+    return x instanceof Goo;
+  }
+
+  %PrepareFunctionForOptimization(IsGoo);
+  assertThrows(_ => IsGoo(goo), TypeError);
+  assertThrows(_ => IsGoo(goo), TypeError);
+  %OptimizeFunctionOnNextCall(IsGoo);
+  assertThrows(_ => IsGoo(goo), TypeError);
+})();
+
+(function() {
+  function Goo() {};
+  const goo = {};
+
+  function IsGoo(x) {
+    return x instanceof Goo;
+  }
+
+  %PrepareFunctionForOptimization(IsGoo);
+  assertFalse(IsGoo(goo));
+  assertFalse(IsGoo(goo));
+  %OptimizeFunctionOnNextCall(IsGoo);
+  assertFalse(IsGoo(goo));
+  Goo.prototype = Object.prototype;
+  assertTrue(IsGoo(goo));
+})();
+
+(function() {
+  function Goo() {};
+  const goo = {};
+
+  function IsGoo(x) {
+    return x instanceof Goo;
+  }
+
+  %PrepareFunctionForOptimization(IsGoo);
+  assertFalse(IsGoo(goo));
+  assertFalse(IsGoo(goo));
+  %OptimizeFunctionOnNextCall(IsGoo);
+  assertFalse(IsGoo(goo));
+  Goo.prototype = 42;
+  assertThrows(_ => IsGoo(goo), TypeError);
+})();
+
+
+// With instance creation:
+
+(function() {
+  function Goo() {};
+  const goo = new Goo();
+
+  function IsGoo(x) {
+    return x instanceof Goo;
+  }
+
+  %PrepareFunctionForOptimization(IsGoo);
+  assertTrue(IsGoo(goo));
+  assertTrue(IsGoo(goo));
+  %OptimizeFunctionOnNextCall(IsGoo);
+  assertTrue(IsGoo(goo));
+})();
+
+(function() {
+  function Goo() {};
+  const goo = new Goo();
+  Goo.prototype = {};
+
+  function IsGoo(x) {
+    return x instanceof Goo;
+  }
+
+  %PrepareFunctionForOptimization(IsGoo);
+  assertFalse(IsGoo(goo));
+  assertFalse(IsGoo(goo));
+  %OptimizeFunctionOnNextCall(IsGoo);
+  assertFalse(IsGoo(goo));
+})();
+
+(function() {
+  function Goo() {};
+  const goo = new Goo();
+  Goo.prototype = 42;
+
+  function IsGoo(x) {
+    return x instanceof Goo;
+  }
+
+  %PrepareFunctionForOptimization(IsGoo);
+  assertThrows(_ => IsGoo(goo), TypeError);
+  assertThrows(_ => IsGoo(goo), TypeError);
+  %OptimizeFunctionOnNextCall(IsGoo);
+  assertThrows(_ => IsGoo(goo), TypeError);
+})();
+
+(function() {
+  function Goo() {};
+  const goo = new Goo();
+
+  function IsGoo(x) {
+    return x instanceof Goo;
+  }
+
+  %PrepareFunctionForOptimization(IsGoo);
+  assertTrue(IsGoo(goo));
+  assertTrue(IsGoo(goo));
+  %OptimizeFunctionOnNextCall(IsGoo);
+  assertTrue(IsGoo(goo));
+  Goo.prototype = {};
+  assertFalse(IsGoo(goo));
+})();
+
+(function() {
+  function Goo() {};
+  const goo = new Goo();
+
+  function IsGoo(x) {
+    return x instanceof Goo;
+  }
+
+  %PrepareFunctionForOptimization(IsGoo);
+  assertTrue(IsGoo(goo));
+  assertTrue(IsGoo(goo));
+  %OptimizeFunctionOnNextCall(IsGoo);
+  assertTrue(IsGoo(goo));
+  Goo.prototype = 42
+  assertThrows(_ => IsGoo(goo), TypeError);
+})();
+
+(function() {
+  function Goo() {};
+  Goo.prototype = 42;
+  const goo = new Goo();
+
+  function IsGoo(x) {
+    return x instanceof Goo;
+  }
+
+  %PrepareFunctionForOptimization(IsGoo);
+  assertThrows(_ => IsGoo(goo), TypeError);
+  assertThrows(_ => IsGoo(goo), TypeError);
+  %OptimizeFunctionOnNextCall(IsGoo);
+  assertThrows(_ => IsGoo(goo), TypeError);
+  Goo.prototype = {};
+  assertFalse(IsGoo(goo));
+})();
+
+(function() {
+  function Goo() {};
+  Goo.prototype = 42;
+  const goo = new Goo();
+  Goo.prototype = {};
+
+  function IsGoo(x) {
+    return x instanceof Goo;
+  }
+
+  %PrepareFunctionForOptimization(IsGoo);
+  assertFalse(IsGoo(goo));
+  assertFalse(IsGoo(goo));
+  %OptimizeFunctionOnNextCall(IsGoo);
+  assertFalse(IsGoo(goo));
+  Goo.prototype = Object.prototype;
+  assertTrue(IsGoo(goo));
+})();
+
+(function() {
+  function Goo() {};
+  Goo.prototype = {};
+  const goo = new Goo();
+  Goo.prototype = 42;
+
+  function IsGoo(x) {
+    return x instanceof Goo;
+  }
+
+  %PrepareFunctionForOptimization(IsGoo);
+  assertThrows(_ => IsGoo(goo), TypeError);
+  assertThrows(_ => IsGoo(goo), TypeError);
+  %OptimizeFunctionOnNextCall(IsGoo);
+  assertThrows(_ => IsGoo(goo), TypeError);
+  Goo.prototype = Object.prototype;
+  assertTrue(IsGoo(goo));
+})();
+
+(function() {
+  function Goo() {};
+  Goo.prototype = {};
+  const goo = new Goo();
+  Goo.prototype = {};
+
+  function IsGoo(x) {
+    return x instanceof Goo;
+  }
+
+  %PrepareFunctionForOptimization(IsGoo);
+  assertFalse(IsGoo(goo));
+  assertFalse(IsGoo(goo));
+  %OptimizeFunctionOnNextCall(IsGoo);
+  Goo.prototype = Object.prototype;
+  assertTrue(IsGoo(goo));
+})();
diff --git a/src/v8/test/mjsunit/compiler/instanceof3.js b/src/v8/test/mjsunit/compiler/instanceof3.js
new file mode 100644
index 0000000..085ad61
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/instanceof3.js
@@ -0,0 +1,247 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+
+// Without instance creation:
+
+(function() {
+  function* Goo() {};
+  const goo = {};
+
+  function IsGoo(x) {
+    return x instanceof Goo;
+  }
+
+  %PrepareFunctionForOptimization(IsGoo);
+  assertFalse(IsGoo(goo));
+  assertFalse(IsGoo(goo));
+  %OptimizeFunctionOnNextCall(IsGoo);
+  assertFalse(IsGoo(goo));
+})();
+
+(function() {
+  function* Goo() {};
+  const goo = {};
+  Goo.prototype = Object.prototype;
+
+  function IsGoo(x) {
+    return x instanceof Goo;
+  }
+
+  %PrepareFunctionForOptimization(IsGoo);
+  assertTrue(IsGoo(goo));
+  assertTrue(IsGoo(goo));
+  %OptimizeFunctionOnNextCall(IsGoo);
+  assertTrue(IsGoo(goo));
+})();
+
+(function() {
+  function* Goo() {};
+  const goo = {};
+  Goo.prototype = 42
+
+  function IsGoo(x) {
+    return x instanceof Goo;
+  }
+
+  %PrepareFunctionForOptimization(IsGoo);
+  assertThrows(_ => IsGoo(goo), TypeError);
+  assertThrows(_ => IsGoo(goo), TypeError);
+  %OptimizeFunctionOnNextCall(IsGoo);
+  assertThrows(_ => IsGoo(goo), TypeError);
+})();
+
+(function() {
+  function* Goo() {};
+  const goo = {};
+
+  function IsGoo(x) {
+    return x instanceof Goo;
+  }
+
+  %PrepareFunctionForOptimization(IsGoo);
+  assertFalse(IsGoo(goo));
+  assertFalse(IsGoo(goo));
+  %OptimizeFunctionOnNextCall(IsGoo);
+  assertFalse(IsGoo(goo));
+  Goo.prototype = Object.prototype;
+  assertTrue(IsGoo(goo));
+})();
+
+(function() {
+  function* Goo() {};
+  const goo = {};
+
+  function IsGoo(x) {
+    return x instanceof Goo;
+  }
+
+  %PrepareFunctionForOptimization(IsGoo);
+  assertFalse(IsGoo(goo));
+  assertFalse(IsGoo(goo));
+  %OptimizeFunctionOnNextCall(IsGoo);
+  assertFalse(IsGoo(goo));
+  Goo.prototype = 42;
+  assertThrows(_ => IsGoo(goo), TypeError);
+})();
+
+
+// With instance creation:
+
+(function() {
+  function* Goo() {};
+  const goo = Goo();
+
+  function IsGoo(x) {
+    return x instanceof Goo;
+  }
+
+  %PrepareFunctionForOptimization(IsGoo);
+  assertTrue(IsGoo(goo));
+  assertTrue(IsGoo(goo));
+  %OptimizeFunctionOnNextCall(IsGoo);
+  assertTrue(IsGoo(goo));
+})();
+
+(function() {
+  function* Goo() {};
+  const goo = Goo();
+  Goo.prototype = {};
+
+  function IsGoo(x) {
+    return x instanceof Goo;
+  }
+
+  %PrepareFunctionForOptimization(IsGoo);
+  assertFalse(IsGoo(goo));
+  assertFalse(IsGoo(goo));
+  %OptimizeFunctionOnNextCall(IsGoo);
+  assertFalse(IsGoo(goo));
+})();
+
+(function() {
+  function* Goo() {};
+  const goo = Goo();
+  Goo.prototype = 42;
+
+  function IsGoo(x) {
+    return x instanceof Goo;
+  }
+
+  %PrepareFunctionForOptimization(IsGoo);
+  assertThrows(_ => IsGoo(goo), TypeError);
+  assertThrows(_ => IsGoo(goo), TypeError);
+  %OptimizeFunctionOnNextCall(IsGoo);
+  assertThrows(_ => IsGoo(goo), TypeError);
+})();
+
+(function() {
+  function* Goo() {};
+  const goo = Goo();
+
+  function IsGoo(x) {
+    return x instanceof Goo;
+  }
+
+  %PrepareFunctionForOptimization(IsGoo);
+  assertTrue(IsGoo(goo));
+  assertTrue(IsGoo(goo));
+  %OptimizeFunctionOnNextCall(IsGoo);
+  assertTrue(IsGoo(goo));
+  Goo.prototype = {};
+  assertFalse(IsGoo(goo));
+})();
+
+(function() {
+  function* Goo() {};
+  const goo = Goo();
+
+  function IsGoo(x) {
+    return x instanceof Goo;
+  }
+
+  %PrepareFunctionForOptimization(IsGoo);
+  assertTrue(IsGoo(goo));
+  assertTrue(IsGoo(goo));
+  %OptimizeFunctionOnNextCall(IsGoo);
+  assertTrue(IsGoo(goo));
+  Goo.prototype = 42
+  assertThrows(_ => IsGoo(goo), TypeError);
+})();
+
+(function() {
+  function* Goo() {};
+  Goo.prototype = 42;
+  const goo = Goo();
+
+  function IsGoo(x) {
+    return x instanceof Goo;
+  }
+
+  %PrepareFunctionForOptimization(IsGoo);
+  assertThrows(_ => IsGoo(goo), TypeError);
+  assertThrows(_ => IsGoo(goo), TypeError);
+  %OptimizeFunctionOnNextCall(IsGoo);
+  assertThrows(_ => IsGoo(goo), TypeError);
+  Goo.prototype = {};
+  assertFalse(IsGoo(goo));
+})();
+
+(function() {
+  function* Goo() {};
+  Goo.prototype = 42;
+  const goo = Goo();
+  Goo.prototype = {};
+
+  function IsGoo(x) {
+    return x instanceof Goo;
+  }
+
+  %PrepareFunctionForOptimization(IsGoo);
+  assertFalse(IsGoo(goo));
+  assertFalse(IsGoo(goo));
+  %OptimizeFunctionOnNextCall(IsGoo);
+  assertFalse(IsGoo(goo));
+  Goo.prototype = Object.prototype;
+  assertTrue(IsGoo(goo));
+})();
+
+(function() {
+  function* Goo() {};
+  Goo.prototype = {};
+  const goo = Goo();
+  Goo.prototype = 42;
+
+  function IsGoo(x) {
+    return x instanceof Goo;
+  }
+
+  %PrepareFunctionForOptimization(IsGoo);
+  assertThrows(_ => IsGoo(goo), TypeError);
+  assertThrows(_ => IsGoo(goo), TypeError);
+  %OptimizeFunctionOnNextCall(IsGoo);
+  assertThrows(_ => IsGoo(goo), TypeError);
+  Goo.prototype = Object.prototype;
+  assertTrue(IsGoo(goo));
+})();
+
+(function() {
+  function* Goo() {};
+  Goo.prototype = {};
+  const goo = Goo();
+  Goo.prototype = {};
+
+  function IsGoo(x) {
+    return x instanceof Goo;
+  }
+
+  %PrepareFunctionForOptimization(IsGoo);
+  assertFalse(IsGoo(goo));
+  assertFalse(IsGoo(goo));
+  %OptimizeFunctionOnNextCall(IsGoo);
+  Goo.prototype = Object.prototype;
+  assertTrue(IsGoo(goo));
+})();
diff --git a/src/v8/test/mjsunit/compiler/int64.js b/src/v8/test/mjsunit/compiler/int64.js
new file mode 100644
index 0000000..a69df8d
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/int64.js
@@ -0,0 +1,139 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Test NumberAdd with PositiveSafeInteger -> PositiveSafeInteger (as Tagged).
+(function() {
+  function foo(x) {
+    const i = x ? 0xFFFFFFFF : 0;
+    return i + 1;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0x000000001, foo(false));
+  assertEquals(0x000000001, foo(false));
+  assertEquals(0x100000000, foo(true));
+  assertEquals(0x100000000, foo(true));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0x000000001, foo(false));
+  assertEquals(0x100000000, foo(true));
+})();
+
+// Test NumberAdd with SafeInteger -> SafeInteger (as Tagged).
+(function() {
+  function foo(x) {
+    const i = x ? 0xFFFFFFFF : -1;
+    return i + 1;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0x000000000, foo(false));
+  assertEquals(0x000000000, foo(false));
+  assertEquals(0x100000000, foo(true));
+  assertEquals(0x100000000, foo(true));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0x000000000, foo(false));
+  assertEquals(0x100000000, foo(true));
+})();
+
+// NumberAdd: Smi x Unsigned32 -> SafeInteger (as Float64).
+(function() {
+  const a = new Float64Array(1);
+
+  function foo(o) {
+    a[0] = o.x + 0xFFFFFFFF;
+    return a[0];
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0x0FFFFFFFF, foo({x:0}));
+  assertEquals(0x100000000, foo({x:1}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0x100000000, foo({x:1}));
+})();
+
+// NumberAdd: Smi x Unsigned32 -> SafeInteger (as TaggedSigned).
+(function() {
+  function foo(o) {
+    return {x: Math.floor((o.x + 11123456789) + -11123456788)}.x;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo({x:0}));
+  assertEquals(2, foo({x:1}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo({x:1}));
+})();
+
+// NumberSubtract: Unsigned32 x Unsigned32 -> SafeInteger (as Word32).
+(function() {
+  function foo(a, i) {
+    i = ((i >>> 0)) - 0xFFFFFFFF;
+    return a[i];
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo([1], 0xFFFFFFFF));
+  assertEquals(2, foo([2], 0xFFFFFFFF));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo([3], 0xFFFFFFFF));
+})();
+
+// Test that the Deoptimizer can handle Word64 properly.
+(function() {
+  function foo(b) {
+    const i = ((b >>> 0)) - 0xFFFFFFFF;
+    %DeoptimizeFunction(foo);
+    return i;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(0xFFFFFFFF));
+  assertEquals(0, foo(0xFFFFFFFF));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(0xFFFFFFFF));
+})();
+
+// Test checked Float32->Word64 conversions.
+(function() {
+  function foo(dv, i) {
+    i = dv.getFloat32(i, true);
+    return dv.getInt8(i, true);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  const dv = new DataView(new ArrayBuffer(10));
+  dv.setFloat32(0, 8, true);
+  dv.setFloat32(4, 9, true);
+  dv.setInt8(8, 42);
+  dv.setInt8(9, 24);
+
+  assertEquals(42, foo(dv, 0));
+  assertEquals(24, foo(dv, 4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(42, foo(dv, 0));
+  assertEquals(24, foo(dv, 4));
+})();
+
+// Test checked Float64->Word64 conversions.
+(function() {
+  function foo(dv, i) {
+    i = dv.getFloat64(i, true);
+    return dv.getInt8(i, true);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  const dv = new DataView(new ArrayBuffer(18));
+  dv.setFloat64(0, 16, true);
+  dv.setFloat64(8, 17, true);
+  dv.setInt8(16, 42);
+  dv.setInt8(17, 24);
+
+  assertEquals(42, foo(dv, 0));
+  assertEquals(24, foo(dv, 8));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(42, foo(dv, 0));
+  assertEquals(24, foo(dv, 8));
+})();
diff --git a/src/v8/test/mjsunit/compiler/integral32-add-sub.js b/src/v8/test/mjsunit/compiler/integral32-add-sub.js
index 16515d3..4704ba7 100644
--- a/src/v8/test/mjsunit/compiler/integral32-add-sub.js
+++ b/src/v8/test/mjsunit/compiler/integral32-add-sub.js
@@ -11,6 +11,7 @@
     return x + y;
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(-2147483648, foo(0));
   assertEquals(0, foo(2147483648));
   assertEquals(2147483647, foo(4294967295));
@@ -31,6 +32,7 @@
     return x - y;
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(-2147483648, foo(0));
   assertEquals(0, foo(2147483648));
   assertEquals(2147483647, foo(4294967295));
@@ -51,6 +53,7 @@
     return x + y;
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(2147483648, foo(0));
   assertEquals(0, foo(-2147483648));
   assertEquals(4294967295, foo(2147483647));
@@ -71,6 +74,7 @@
     return x - y;
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(2147483648, foo(0));
   assertEquals(0, foo(-2147483648));
   assertEquals(4294967295, foo(2147483647));
@@ -91,6 +95,7 @@
     return x + y;
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(2147483647, foo(2147483647));
   assertEquals(-2147483648, foo(-2147483648));
   assertEquals(0, foo(0));
@@ -111,6 +116,7 @@
     return y - z;
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(2147483647, foo(-1));
   assertEquals(2147483648, foo(0));
   assertEquals(2147483649, foo(1));
diff --git a/src/v8/test/mjsunit/compiler/keyed-load-on-string.js b/src/v8/test/mjsunit/compiler/keyed-load-on-string.js
new file mode 100644
index 0000000..e0cd397
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/keyed-load-on-string.js
@@ -0,0 +1,25 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var s = "hello";
+
+function foo() {
+  return s[4];
+};
+%PrepareFunctionForOptimization(foo);
+assertTrue('o' === foo());
+assertTrue("o" === foo());
+%OptimizeFunctionOnNextCall(foo);
+assertTrue("o" === foo());
+
+function bar() {
+  return s[5];
+};
+%PrepareFunctionForOptimization(bar);
+assertSame(undefined, bar());
+assertSame(undefined, bar());
+%OptimizeFunctionOnNextCall(bar);
+assertSame(undefined, bar());
diff --git a/src/v8/test/mjsunit/compiler/lazy-const-lookup.js b/src/v8/test/mjsunit/compiler/lazy-const-lookup.js
index ff4558e..ce147d7 100644
--- a/src/v8/test/mjsunit/compiler/lazy-const-lookup.js
+++ b/src/v8/test/mjsunit/compiler/lazy-const-lookup.js
@@ -32,6 +32,7 @@
   function inner() {
     return x;
   }
+  %PrepareFunctionForOptimization(inner);
   inner();
   %OptimizeFunctionOnNextCall(inner);
   inner();
diff --git a/src/v8/test/mjsunit/compiler/lazy-deopt-async-function-resolve.js b/src/v8/test/mjsunit/compiler/lazy-deopt-async-function-resolve.js
new file mode 100644
index 0000000..9b37c5c
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/lazy-deopt-async-function-resolve.js
@@ -0,0 +1,28 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Test that the lazy deoptimization point for JSAsyncFunctionResolve
+// works correctly, aka that we return the promise and not the result
+// of the JSResolvePromise operation.
+(function() {
+  async function foo(x) {
+    return x;
+  }
+
+  assertPromiseResult((async () => {
+    %PrepareFunctionForOptimization(foo);
+    await foo(1);
+    await foo(2);
+    %OptimizeFunctionOnNextCall(foo);
+    const p = new Proxy({}, {
+      get(...args) {
+        %DeoptimizeFunction(foo);
+        return Reflect.get(...args);
+      }
+    });
+    assertEquals(p, await foo(p));
+  })());
+})();
diff --git a/src/v8/test/mjsunit/compiler/lazy-deopt-in-literal.js b/src/v8/test/mjsunit/compiler/lazy-deopt-in-literal.js
index 0a1481c..16ed234 100644
--- a/src/v8/test/mjsunit/compiler/lazy-deopt-in-literal.js
+++ b/src/v8/test/mjsunit/compiler/lazy-deopt-in-literal.js
@@ -13,6 +13,7 @@
   return r[113];
 }
 
+%PrepareFunctionForOptimization(fun3);
 fun3();
 fun3();
 %OptimizeFunctionOnNextCall(fun3);
diff --git a/src/v8/test/mjsunit/compiler/literals-optimized.js b/src/v8/test/mjsunit/compiler/literals-optimized.js
index 049e21a..4e086e8 100644
--- a/src/v8/test/mjsunit/compiler/literals-optimized.js
+++ b/src/v8/test/mjsunit/compiler/literals-optimized.js
@@ -30,6 +30,7 @@
 // Test optimized versions of array and object literals.
 
 function TestOptimizedLiteral(create, verify) {
+  %PrepareFunctionForOptimization(create);
   verify(create(1, 2, 3), 1, 2, 3);
   verify(create(3, 5, 7), 3, 5, 7);
   %OptimizeFunctionOnNextCall(create);
diff --git a/src/v8/test/mjsunit/compiler/load-elimination-const-field.js b/src/v8/test/mjsunit/compiler/load-elimination-const-field.js
new file mode 100644
index 0000000..4d14252
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/load-elimination-const-field.js
@@ -0,0 +1,166 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Check that load elimination on const-marked fields works
+(function() {
+    function maybe_sideeffect(b) { return 42; }
+
+    %NeverOptimizeFunction(maybe_sideeffect);
+
+    class B {
+        constructor(x) {
+            this.value = x;
+        }
+    }
+    %EnsureFeedbackVectorForFunction(B);
+
+
+    function lit_const_smi() {
+        let b = { value: 123 };
+        maybe_sideeffect(b);
+        let v1 = b.value;
+        maybe_sideeffect(b);
+        let v2 = b.value;
+        %TurbofanStaticAssert(Object.is(v1, v2));
+        %TurbofanStaticAssert(Object.is(v2, 123));
+    }
+
+    %PrepareFunctionForOptimization(lit_const_smi);
+    lit_const_smi(); lit_const_smi();
+    %OptimizeFunctionOnNextCall(lit_const_smi); lit_const_smi();
+
+
+    function lit_const_object() {
+        let o = {x: 123};
+        let b = { value: o };
+        maybe_sideeffect(b);
+        let v1 = b.value;
+        maybe_sideeffect(b);
+        let v2 = b.value;
+        %TurbofanStaticAssert(Object.is(v1, v2));
+        %TurbofanStaticAssert(Object.is(v2, o));
+    }
+
+    %PrepareFunctionForOptimization(lit_const_object);
+    lit_const_object(); lit_const_object();
+    %OptimizeFunctionOnNextCall(lit_const_object); lit_const_object();
+
+
+    function lit_computed_smi(k) {
+        let kk = 2 * k;
+        let b = { value: kk };
+        maybe_sideeffect(b);
+        let v1 = b.value;
+        maybe_sideeffect(b);
+        let v2 = b.value;
+        %TurbofanStaticAssert(Object.is(v1, v2));
+        %TurbofanStaticAssert(Object.is(v2, kk));
+    }
+
+    %PrepareFunctionForOptimization(lit_computed_smi);
+    lit_computed_smi(1); lit_computed_smi(2);
+    %OptimizeFunctionOnNextCall(lit_computed_smi); lit_computed_smi(3);
+
+    // TODO(bmeurer): Fix const tracking for double fields in object literals
+    // lit_computed_smi(1.1); lit_computed_smi(2.2);
+    // %OptimizeFunctionOnNextCall(lit_computed_smi); lit_computed_smi(3.3);
+
+
+    function lit_param_object(k) {
+        let b = { value: k };
+        maybe_sideeffect(b);
+        let v1 = b.value;
+        maybe_sideeffect(b);
+        let v2 = b.value;
+        %TurbofanStaticAssert(Object.is(v1, v2));
+        %TurbofanStaticAssert(Object.is(v2, k));
+    }
+
+    %PrepareFunctionForOptimization(lit_param_object);
+    lit_param_object({x: 1}); lit_param_object({x: 2});
+    %OptimizeFunctionOnNextCall(lit_param_object); lit_param_object({x: 3});
+
+
+    function nested_lit_param(k) {
+        let b = { x: { value: k } };
+        maybe_sideeffect(b);
+        let v1 = b.x.value;
+        maybe_sideeffect(b);
+        let v2 = b.x.value;
+        %TurbofanStaticAssert(Object.is(v1, v2));
+        %TurbofanStaticAssert(Object.is(v2, k));
+    }
+
+    %PrepareFunctionForOptimization(nested_lit_param);
+    nested_lit_param(1); nested_lit_param(2);
+    %OptimizeFunctionOnNextCall(nested_lit_param); nested_lit_param(3);
+
+    // TODO(bmeurer): Fix const tracking for double fields in object literals
+    // nested_lit_param(1.1); nested_lit_param(2.2);
+    // %OptimizeFunctionOnNextCall(nested_lit_param); nested_lit_param(3.3);
+
+
+    function nested_lit_param_object(k) {
+        let b = { x: { value: k } };
+        maybe_sideeffect(b);
+        let v1 = b.x.value;
+        maybe_sideeffect(b);
+        let v2 = b.x.value;
+        %TurbofanStaticAssert(Object.is(v1, v2));
+        %TurbofanStaticAssert(Object.is(v2, k));
+    }
+
+    %PrepareFunctionForOptimization(nested_lit_param_object);
+    nested_lit_param_object({x: 1}); nested_lit_param_object({x: 2});
+    %OptimizeFunctionOnNextCall(nested_lit_param_object);
+    nested_lit_param_object({x: 3});
+
+
+    function inst_param(k) {
+        let b = new B(k);
+        maybe_sideeffect(b);
+        let v1 = b.value;
+        maybe_sideeffect(b);
+        let v2 = b.value;
+        %TurbofanStaticAssert(Object.is(v1, v2));
+        %TurbofanStaticAssert(Object.is(v2, k));
+    }
+
+    %EnsureFeedbackVectorForFunction(B);
+    %PrepareFunctionForOptimization(inst_param);
+    inst_param(1); inst_param(2);
+    %OptimizeFunctionOnNextCall(inst_param); inst_param(3);
+
+    // TODO(gsps): Reenable once we fully support const field information
+    //   tracking in the presence of pointer compression.
+    // inst_param(1.1); inst_param(2.2);
+    // %OptimizeFunctionOnNextCall(inst_param); inst_param(3.3);
+
+    %PrepareFunctionForOptimization(inst_param);
+    inst_param({x: 1}); inst_param({x: 2});
+    %OptimizeFunctionOnNextCall(inst_param); inst_param({x: 3});
+
+
+    function inst_computed(k) {
+        let kk = 2 * k;
+        let b = new B(kk);
+        maybe_sideeffect(b);
+        let v1 = b.value;
+        maybe_sideeffect(b);
+        let v2 = b.value;
+        %TurbofanStaticAssert(Object.is(v1, v2));
+        %TurbofanStaticAssert(Object.is(v2, kk));
+    }
+
+    %EnsureFeedbackVectorForFunction(B);
+    %PrepareFunctionForOptimization(inst_computed);
+    inst_computed(1); inst_computed(2);
+    %OptimizeFunctionOnNextCall(inst_computed); inst_computed(3);
+
+    %PrepareFunctionForOptimization(inst_computed);
+    inst_computed(1.1); inst_computed(2.2);
+    %OptimizeFunctionOnNextCall(inst_computed); inst_computed(3.3);
+})();
diff --git a/src/v8/test/mjsunit/compiler/load-elimination-global.js b/src/v8/test/mjsunit/compiler/load-elimination-global.js
index 9caaa9f..ed3cd70 100644
--- a/src/v8/test/mjsunit/compiler/load-elimination-global.js
+++ b/src/v8/test/mjsunit/compiler/load-elimination-global.js
@@ -171,6 +171,7 @@
 }
 
 function test(x, f) {
+  %PrepareFunctionForOptimization(f);
   X = true;
   assertEquals(x, f());
   assertEquals(x, f());
diff --git a/src/v8/test/mjsunit/compiler/load-elimination-osr.js b/src/v8/test/mjsunit/compiler/load-elimination-osr.js
index a57fe17..159c647 100644
--- a/src/v8/test/mjsunit/compiler/load-elimination-osr.js
+++ b/src/v8/test/mjsunit/compiler/load-elimination-osr.js
@@ -58,6 +58,7 @@
   return o.y;
 }
 
+%PrepareFunctionForOptimization(foo_hot);
 assertEquals(22, foo_hot(11, 1));
 assertEquals(24, foo_hot(12, 1));
 %OptimizeFunctionOnNextCall(foo_hot);
diff --git a/src/v8/test/mjsunit/compiler/load-elimination-params.js b/src/v8/test/mjsunit/compiler/load-elimination-params.js
index 13a4a85..cdf55b1 100644
--- a/src/v8/test/mjsunit/compiler/load-elimination-params.js
+++ b/src/v8/test/mjsunit/compiler/load-elimination-params.js
@@ -43,6 +43,8 @@
   return i + j + k + l;
 }
 
+%PrepareFunctionForOptimization(test_params1);
+
 assertEquals(14, test_params1(new B(3, 4), new B(4, 5)));
 assertEquals(110, test_params1(new B(11, 7), new B(44, 8)));
 
@@ -63,6 +65,8 @@
   return i + j + k + l;
 }
 
+%PrepareFunctionForOptimization(test_params2);
+
 assertEquals(14, test_params2(3, 4));
 assertEquals(110, test_params2(11, 44));
 
diff --git a/src/v8/test/mjsunit/compiler/load-elimination.js b/src/v8/test/mjsunit/compiler/load-elimination.js
index 9bf8564..b4b8a18 100644
--- a/src/v8/test/mjsunit/compiler/load-elimination.js
+++ b/src/v8/test/mjsunit/compiler/load-elimination.js
@@ -141,6 +141,7 @@
 }
 
 function test(x, f) {
+  %PrepareFunctionForOptimization(f);
   assertEquals(x, f());
   assertEquals(x, f());
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/manual-concurrent-recompile.js b/src/v8/test/mjsunit/compiler/manual-concurrent-recompile.js
index 19b4d2a..65ac39b 100644
--- a/src/v8/test/mjsunit/compiler/manual-concurrent-recompile.js
+++ b/src/v8/test/mjsunit/compiler/manual-concurrent-recompile.js
@@ -38,14 +38,14 @@
   var xx = x * x;
   var xxstr = xx.toString();
   return xxstr.length;
-}
-
+};
+%PrepareFunctionForOptimization(f);
 function g(x) {
   var xxx = Math.sqrt(x) | 0;
   var xxxstr = xxx.toString();
   return xxxstr.length;
-}
-
+};
+%PrepareFunctionForOptimization(g);
 function k(x) {
   return x * x;
 }
@@ -59,11 +59,11 @@
 %OptimizeFunctionOnNextCall(g, "concurrent");
 f(g(3));  // Kick off recompilation.
 
-assertUnoptimized(f, "no sync");  // Not yet optimized since recompilation
-assertUnoptimized(g, "no sync");  // is still blocked.
+assertUnoptimized(f, 'no sync');  // Not yet optimized since recompilation
+assertUnoptimized(g, 'no sync');  // is still blocked.
 
 // Let concurrent recompilation proceed.
 %UnblockConcurrentRecompilation();
 
-assertOptimized(f, "sync");  // Optimized once we sync with the
-assertOptimized(g, "sync");  // background thread.
+assertOptimized(f, 'sync');  // Optimized once we sync with the
+assertOptimized(g, 'sync');  // background thread.
diff --git a/src/v8/test/mjsunit/compiler/materialize-dictionary-properties.js b/src/v8/test/mjsunit/compiler/materialize-dictionary-properties.js
index 5838a83..bf2a092 100644
--- a/src/v8/test/mjsunit/compiler/materialize-dictionary-properties.js
+++ b/src/v8/test/mjsunit/compiler/materialize-dictionary-properties.js
@@ -12,6 +12,7 @@
   return o ? 1 : 0;
 }
 
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/materialize-mutable-heap-number.js b/src/v8/test/mjsunit/compiler/materialize-mutable-heap-number.js
index b6b99af..c8f85aa 100644
--- a/src/v8/test/mjsunit/compiler/materialize-mutable-heap-number.js
+++ b/src/v8/test/mjsunit/compiler/materialize-mutable-heap-number.js
@@ -16,6 +16,7 @@
   return o.x + 0.25;
 }
 
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/math-ceil.js b/src/v8/test/mjsunit/compiler/math-ceil.js
index f91348b..8caa184 100644
--- a/src/v8/test/mjsunit/compiler/math-ceil.js
+++ b/src/v8/test/mjsunit/compiler/math-ceil.js
@@ -14,6 +14,7 @@
     return Object.is(-0, Math.ceil(x));
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertFalse(foo(1.5));
   assertTrue(foo(0.5));
   %OptimizeFunctionOnNextCall(foo);
@@ -31,6 +32,7 @@
     return Object.is(NaN, Math.ceil(x));
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertFalse(foo(1.5));
   assertTrue(foo(NaN));
   %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/math-floor-global.js b/src/v8/test/mjsunit/compiler/math-floor-global.js
index 9ee649c..e5761e3 100644
--- a/src/v8/test/mjsunit/compiler/math-floor-global.js
+++ b/src/v8/test/mjsunit/compiler/math-floor-global.js
@@ -34,6 +34,7 @@
 function testFloor(expect, input) {
   var test = new Function('n',
                           '"' + (test_id++) + '";return flo(n)');
+  %PrepareFunctionForOptimization(test);
   assertEquals(expect, test(input));
   assertEquals(expect, test(input));
   assertEquals(expect, test(input));
@@ -59,6 +60,7 @@
   function ifloor(x) {
     return 1 / Math.floor(x);
   }
+  %PrepareFunctionForOptimization(ifloor);
   assertEquals(-Infinity, ifloor(-0));
   assertEquals(-Infinity, ifloor(-0));
   assertEquals(-Infinity, ifloor(-0));
@@ -155,6 +157,7 @@
   }
   return ret;
 }
+%PrepareFunctionForOptimization(floorsum);
 assertEquals(-0, floorsum(1, -0));
 %OptimizeFunctionOnNextCall(floorsum);
 // The optimized function will deopt.  Run it with enough iterations to try
diff --git a/src/v8/test/mjsunit/compiler/math-floor-local.js b/src/v8/test/mjsunit/compiler/math-floor-local.js
index 5ebe90b..7444363 100644
--- a/src/v8/test/mjsunit/compiler/math-floor-local.js
+++ b/src/v8/test/mjsunit/compiler/math-floor-local.js
@@ -34,6 +34,7 @@
   var test = new Function('n',
                           '"' + (test_id++) +
                           '";var f = Math.floor; return f(n)');
+  %PrepareFunctionForOptimization(test);
   assertEquals(expect, test(input));
   assertEquals(expect, test(input));
   assertEquals(expect, test(input));
@@ -59,6 +60,7 @@
   function ifloor(x) {
     return 1 / Math.floor(x);
   }
+  %PrepareFunctionForOptimization(ifloor);
   assertEquals(-Infinity, ifloor(-0));
   assertEquals(-Infinity, ifloor(-0));
   assertEquals(-Infinity, ifloor(-0));
@@ -155,6 +157,7 @@
   }
   return ret;
 }
+%PrepareFunctionForOptimization(floorsum);
 assertEquals(-0, floorsum(1, -0));
 %OptimizeFunctionOnNextCall(floorsum);
 // The optimized function will deopt.  Run it with enough iterations to try
diff --git a/src/v8/test/mjsunit/compiler/math-imul.js b/src/v8/test/mjsunit/compiler/math-imul.js
new file mode 100644
index 0000000..bb3d61a
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/math-imul.js
@@ -0,0 +1,83 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test Math.imul() with no inputs.
+(function() {
+  function foo() { return Math.imul(); }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo());
+  assertEquals(0, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo());
+})();
+
+// Test Math.imul() with only one input.
+(function() {
+  function foo(x) { return Math.imul(x); }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(1));
+  assertEquals(0, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(3));
+})();
+
+// Test Math.imul() with wrong types.
+(function() {
+  function foo(x, y) { return Math.imul(x, y); }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(null, 1));
+  assertEquals(0, foo(2, undefined));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(null, 1));
+  assertEquals(0, foo(2, undefined));
+  %PrepareFunctionForOptimization(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(null, 1));
+  assertEquals(0, foo(2, undefined));
+  assertOptimized(foo);
+})();
+
+// Test Math.imul() with signed integers (statically known).
+(function() {
+  function foo(x, y) { return Math.imul(x|0, y|0); }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo(1, 1));
+  assertEquals(2, foo(2, 1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(1, 1));
+  assertEquals(2, foo(2, 1));
+  assertOptimized(foo);
+})();
+
+// Test Math.imul() with unsigned integers (statically known).
+(function() {
+  function foo(x, y) { return Math.imul(x>>>0, y>>>0); }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo(1, 1));
+  assertEquals(2, foo(2, 1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(1, 1));
+  assertEquals(2, foo(2, 1));
+  assertOptimized(foo);
+})();
+
+// Test Math.imul() with floating-point numbers.
+(function() {
+  function foo(x, y) { return Math.imul(x, y); }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo(1.1, 1.1));
+  assertEquals(2, foo(2.1, 1.1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(1.1, 1.1));
+  assertEquals(2, foo(2.1, 1.1));
+  assertOptimized(foo);
+})();
diff --git a/src/v8/test/mjsunit/compiler/math-max.js b/src/v8/test/mjsunit/compiler/math-max.js
new file mode 100644
index 0000000..ce3d43d
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/math-max.js
@@ -0,0 +1,40 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Test the case where TurboFan can statically rule out -0 from the
+// Math.max type.
+(function() {
+  function foo(x) {
+    // Arrange x such that TurboFan infers type [-inf, inf] \/ MinusZero.
+    x = +x;
+    x = Math.round(x);
+    return Object.is(-0, Math.max(1, x))
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(-0));
+  assertFalse(foo(-1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(-0));
+  assertFalse(foo(-1));
+})();
+
+// Test the case where -0 is ruled out because it's strictly less than +0.
+(function() {
+  function foo(x) {
+    // Arrange x such that TurboFan infers type [-inf, inf] \/ MinusZero.
+    x = +x;
+    x = Math.round(x);
+    return Object.is(-0, Math.max(0, x))
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(-0));
+  assertFalse(foo(-1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(-0));
+  assertFalse(foo(-1));
+})();
diff --git a/src/v8/test/mjsunit/compiler/math-min.js b/src/v8/test/mjsunit/compiler/math-min.js
new file mode 100644
index 0000000..0fedb49
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/math-min.js
@@ -0,0 +1,40 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Test the case where TurboFan can statically rule out -0 from the
+// Math.min type.
+(function() {
+  function foo(x) {
+    // Arrange x such that TurboFan infers type [-inf, inf] \/ MinusZero.
+    x = +x;
+    x = Math.round(x);
+    return Object.is(-0, Math.min(-1, x))
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(-0));
+  assertFalse(foo(-1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(-0));
+  assertFalse(foo(-1));
+})();
+
+// Test the case where +0 is ruled out because it's strictly greater than -0.
+(function() {
+  function foo(x) {
+    // Arrange x such that TurboFan infers type [-inf, inf] \/ MinusZero.
+    x = +x;
+    x = Math.round(x);
+    return Object.is(+0, Math.min(-0, x))
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(-0));
+  assertFalse(foo(-1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(-0));
+  assertFalse(foo(-1));
+})();
diff --git a/src/v8/test/mjsunit/compiler/math-mul.js b/src/v8/test/mjsunit/compiler/math-mul.js
index a391b44..0ac620d 100644
--- a/src/v8/test/mjsunit/compiler/math-mul.js
+++ b/src/v8/test/mjsunit/compiler/math-mul.js
@@ -7,12 +7,14 @@
 // For TurboFan, make sure we can eliminate the -0 return value check
 // by recognizing a constant value.
 function gotaconstant(y) { return 15 * y; }
+%PrepareFunctionForOptimization(gotaconstant);
 assertEquals(45, gotaconstant(3));
 gotaconstant(3);
 %OptimizeFunctionOnNextCall(gotaconstant);
 gotaconstant(3);
 
 function gotaconstant_truncated(x, y) { return x * y | 0; }
+%PrepareFunctionForOptimization(gotaconstant_truncated);
 assertEquals(45, gotaconstant_truncated(3, 15));
 gotaconstant_truncated(3, 15);
 %OptimizeFunctionOnNextCall(gotaconstant_truncated);
@@ -20,6 +22,7 @@
 
 function test(x, y) { return x * y; }
 
+%PrepareFunctionForOptimization(test);
 assertEquals(12, test(3, 4));
 assertEquals(16, test(4, 4));
 
@@ -39,6 +42,7 @@
 // Verify that strength reduction will reduce the -0 check quite a bit
 // if we have a negative integer constant.
 function negtest(y) { return -3 * y; }
+%PrepareFunctionForOptimization(negtest);
 assertEquals(-12, negtest(4));
 assertEquals(-12, negtest(4));
 %OptimizeFunctionOnNextCall(negtest);
diff --git a/src/v8/test/mjsunit/compiler/math-round.js b/src/v8/test/mjsunit/compiler/math-round.js
index c42bf8f..c0715c9 100644
--- a/src/v8/test/mjsunit/compiler/math-round.js
+++ b/src/v8/test/mjsunit/compiler/math-round.js
@@ -14,6 +14,7 @@
     return Object.is(-0, Math.round(x));
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertFalse(foo(1.5));
   assertTrue(foo(0.5));
   %OptimizeFunctionOnNextCall(foo);
@@ -31,6 +32,7 @@
     return Object.is(NaN, Math.round(x));
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertFalse(foo(1.5));
   assertTrue(foo(NaN));
   %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/math-sign.js b/src/v8/test/mjsunit/compiler/math-sign.js
index 0fff098..8923f8d 100644
--- a/src/v8/test/mjsunit/compiler/math-sign.js
+++ b/src/v8/test/mjsunit/compiler/math-sign.js
@@ -9,6 +9,7 @@
   return Math.sign(i);
 }
 
+%PrepareFunctionForOptimization(signInt32);
 signInt32(0);
 signInt32(2);
 %OptimizeFunctionOnNextCall(signInt32);
@@ -27,6 +28,7 @@
   return Math.sign(+i);
 }
 
+%PrepareFunctionForOptimization(signFloat64);
 signFloat64(0.1);
 signFloat64(-0.1);
 %OptimizeFunctionOnNextCall(signFloat64);
diff --git a/src/v8/test/mjsunit/compiler/math-trunc.js b/src/v8/test/mjsunit/compiler/math-trunc.js
index e5cc523..955bd5f 100644
--- a/src/v8/test/mjsunit/compiler/math-trunc.js
+++ b/src/v8/test/mjsunit/compiler/math-trunc.js
@@ -14,6 +14,7 @@
     return Object.is(-0, Math.trunc(x));
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertFalse(foo(1.5));
   assertTrue(foo(0.5));
   %OptimizeFunctionOnNextCall(foo);
@@ -31,6 +32,7 @@
     return Object.is(NaN, Math.trunc(x));
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertFalse(foo(1.5));
   assertTrue(foo(NaN));
   %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/minus-zero.js b/src/v8/test/mjsunit/compiler/minus-zero.js
index 23639df..b984bb4 100644
--- a/src/v8/test/mjsunit/compiler/minus-zero.js
+++ b/src/v8/test/mjsunit/compiler/minus-zero.js
@@ -31,6 +31,7 @@
   return x + y;
 }
 
+%PrepareFunctionForOptimization(add);
 assertEquals(0, add(0, 0));
 assertEquals(0, add(0, 0));
 %OptimizeFunctionOnNextCall(add);
@@ -41,6 +42,7 @@
   assertEquals(-0, Math.sin(-0));
 }
 
+%PrepareFunctionForOptimization(testsin);
 testsin();
 testsin();
 %OptimizeFunctionOnNextCall(testsin);
@@ -51,6 +53,7 @@
   assertEquals(-0, Math.floor(-0));
 }
 
+%PrepareFunctionForOptimization(testfloor);
 testfloor();
 testfloor();
 %OptimizeFunctionOnNextCall(testfloor);
@@ -63,6 +66,7 @@
   return a + b;
 }
 
+%PrepareFunctionForOptimization(add);
 assertEquals(1, 1/add(double_one, 0));
 assertEquals(1, 1/add(0, double_one));
 %OptimizeFunctionOnNextCall(add);
diff --git a/src/v8/test/mjsunit/compiler/mul-div-52bit.js b/src/v8/test/mjsunit/compiler/mul-div-52bit.js
index 46a5d05..c74be69 100644
--- a/src/v8/test/mjsunit/compiler/mul-div-52bit.js
+++ b/src/v8/test/mjsunit/compiler/mul-div-52bit.js
@@ -46,6 +46,7 @@
 }
 
 function test(fn, a, b, sets) {
+  %PrepareFunctionForOptimization(fn);
   const expected = fn(a, b);
   fn(1, 2);
   fn(0, 0);
diff --git a/src/v8/test/mjsunit/compiler/multiply-add.js b/src/v8/test/mjsunit/compiler/multiply-add.js
index 2b4304e..faac945 100644
--- a/src/v8/test/mjsunit/compiler/multiply-add.js
+++ b/src/v8/test/mjsunit/compiler/multiply-add.js
@@ -40,6 +40,7 @@
   return a * b + c * d;
 }
 
+%PrepareFunctionForOptimization(f);
 assertEquals(5, f(1, 2, 3));
 assertEquals(5, f(1, 2, 3));
 %OptimizeFunctionOnNextCall(f);
@@ -47,23 +48,28 @@
 assertEquals("2foo", f(1, 2, "foo"));
 assertEquals(5.41, f(1.1, 2.1, 3.1));
 assertEquals(5.41, f(1.1, 2.1, 3.1));
+%PrepareFunctionForOptimization(f);
 %OptimizeFunctionOnNextCall(f);
 assertEquals(5.41, f(1.1, 2.1, 3.1));
 
+%PrepareFunctionForOptimization(g);
 assertEquals(7, g(1, 2, 3));
 assertEquals(7, g(1, 2, 3));
 %OptimizeFunctionOnNextCall(g);
 assertEquals(7, g(1, 2, 3));
 assertEquals(8.36, g(1.1, 2.2, 3.3));
 assertEquals(8.36, g(1.1, 2.2, 3.3));
+%PrepareFunctionForOptimization(g);
 %OptimizeFunctionOnNextCall(g);
 assertEquals(8.36, g(1.1, 2.2, 3.3));
 
+%PrepareFunctionForOptimization(h);
 assertEquals(14, h(1, 2, 3, 4));
 assertEquals(14, h(1, 2, 3, 4));
 %OptimizeFunctionOnNextCall(h);
 assertEquals(14, h(1, 2, 3, 4));
 assertEquals(15.02, h(1.1, 2.1, 3.1, 4.1));
 assertEquals(15.02, h(1.1, 2.1, 3.1, 4.1));
+%PrepareFunctionForOptimization(h);
 %OptimizeFunctionOnNextCall(h);
 assertEquals(15.02, h(1.1, 2.1, 3.1, 4.1));
diff --git a/src/v8/test/mjsunit/compiler/multiply-sub.js b/src/v8/test/mjsunit/compiler/multiply-sub.js
index 4793181..c9a803e 100644
--- a/src/v8/test/mjsunit/compiler/multiply-sub.js
+++ b/src/v8/test/mjsunit/compiler/multiply-sub.js
@@ -40,16 +40,19 @@
   return a * b - c * d;
 }
 
+%PrepareFunctionForOptimization(f);
 assertEquals(-5.41, f(1.1, 2.1, 3.1));
 assertEquals(-5.41, f(1.1, 2.1, 3.1));
 %OptimizeFunctionOnNextCall(f);
 assertEquals(-5.41, f(1.1, 2.1, 3.1));
 
+%PrepareFunctionForOptimization(g);
 assertEquals(8.36, g(2.2, 3.3, -1.1));
 assertEquals(8.36, g(2.2, 3.3, -1.1));
 %OptimizeFunctionOnNextCall(g);
 assertEquals(8.36, g(2.2, 3.3, -1.1));
 
+%PrepareFunctionForOptimization(h);
 assertEquals(-1.5, h(1.5, 3.0, 12, 0.5));
 assertEquals(-1.5, h(1.5, 3.0, 12, 0.5));
 %OptimizeFunctionOnNextCall(h);
diff --git a/src/v8/test/mjsunit/compiler/named-store.js b/src/v8/test/mjsunit/compiler/named-store.js
index 8d1306a..629f2f1 100644
--- a/src/v8/test/mjsunit/compiler/named-store.js
+++ b/src/v8/test/mjsunit/compiler/named-store.js
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --allow-natives-syntax
+
 function Foo(a, b) {
   var bname = "b";
   this["a"] = a;
@@ -26,6 +28,41 @@
 
 // stirngs
 for (var i = 0; i < 6; i++) {
-  var f = new Foo(i + "", (i + 2) + "");
-  assertEquals((i + "") + ((i + 2) + ""), f.x);
+  var f = new Foo(i + '', i + 2 + '');
+  assertEquals(i + '' + (i + 2 + ''), f.x);
+}
+
+
+{
+  function Global(i) {
+    this.bla = i;
+  };
+  %PrepareFunctionForOptimization(Global);
+  Global(0);
+  Global(1);
+  %OptimizeFunctionOnNextCall(Global);
+  Global(2);
+  assertEquals(bla, 2);
+}
+
+
+{
+  function access(obj) {
+    obj.bla = 42;
+  }
+  access({a: 0});
+  access({b: 0});
+  access({c: 0});
+  access({d: 0});
+  access({e: 0});
+  var global = this;
+  function foo() {
+    access(global);
+  };
+  %PrepareFunctionForOptimization(foo);
+  ;
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
 }
diff --git a/src/v8/test/mjsunit/compiler/native-context-specialization-hole-check.js b/src/v8/test/mjsunit/compiler/native-context-specialization-hole-check.js
index 1256f45..94b30db 100644
--- a/src/v8/test/mjsunit/compiler/native-context-specialization-hole-check.js
+++ b/src/v8/test/mjsunit/compiler/native-context-specialization-hole-check.js
@@ -25,7 +25,12 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --opt --no-always-opt
+// Flags: --allow-natives-syntax --opt --no-always-opt --turbo-inlining
+
+if (isNeverOptimizeLiteMode()) {
+  print("Warning: skipping test that requires optimization in Lite mode.");
+  testRunner.quit(0);
+}
 
 function f() {
   Array.prototype[10] = 2;
@@ -33,12 +38,14 @@
   arr[500] = 20;
   arr[10] = arr[50];
 }
+%EnsureFeedbackVectorForFunction(f);
 
 function g() {
   f();
 }
+%PrepareFunctionForOptimization(g);
 g();
 g();
 %OptimizeFunctionOnNextCall(g);
 g();
-assertTrue(%GetDeoptCount(g) > 0);
+assertUnoptimized(g);
diff --git a/src/v8/test/mjsunit/compiler/native-context-specialization-string-concat.js b/src/v8/test/mjsunit/compiler/native-context-specialization-string-concat.js
index 24fe4b1..0df3835 100644
--- a/src/v8/test/mjsunit/compiler/native-context-specialization-string-concat.js
+++ b/src/v8/test/mjsunit/compiler/native-context-specialization-string-concat.js
@@ -27,6 +27,7 @@
   d = '"' + foo + arg + bar + '"';
 }
 
+%PrepareFunctionForOptimization(test);
 test('boo');
 %OptimizeFunctionOnNextCall(test);
 test('baa');
diff --git a/src/v8/test/mjsunit/compiler/new-cons-string.js b/src/v8/test/mjsunit/compiler/new-cons-string.js
index 7f6da72..0d5470d 100644
--- a/src/v8/test/mjsunit/compiler/new-cons-string.js
+++ b/src/v8/test/mjsunit/compiler/new-cons-string.js
@@ -9,6 +9,7 @@
     return "abcdefghijklm" + s;
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertTrue(isOneByteString(foo("0")));
   assertTrue(isOneByteString(foo("0")));
   %OptimizeFunctionOnNextCall(foo);
@@ -20,6 +21,7 @@
     return s + "abcdefghijklm";
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertTrue(isOneByteString(foo("0")));
   assertTrue(isOneByteString(foo("0")));
   %OptimizeFunctionOnNextCall(foo);
@@ -31,6 +33,7 @@
     return "abcdefghijklm" + s;
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertFalse(isOneByteString(foo("\u1234")));
   assertFalse(isOneByteString(foo("\u1234")));
   %OptimizeFunctionOnNextCall(foo);
@@ -42,6 +45,7 @@
     return s + "abcdefghijklm";
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertFalse(isOneByteString(foo("\u1234")));
   assertFalse(isOneByteString(foo("\u1234")));
   %OptimizeFunctionOnNextCall(foo);
@@ -53,6 +57,7 @@
     return "abcdefghijkl\u1234" + s;
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertFalse(isOneByteString(foo("0")));
   assertFalse(isOneByteString(foo("0")));
   %OptimizeFunctionOnNextCall(foo);
@@ -64,6 +69,7 @@
     return s + "abcdefghijkl\u1234";
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertFalse(isOneByteString(foo("0")));
   assertFalse(isOneByteString(foo("0")));
   %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/number-abs.js b/src/v8/test/mjsunit/compiler/number-abs.js
new file mode 100644
index 0000000..8e97613
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/number-abs.js
@@ -0,0 +1,80 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberAbs correctly deals with PositiveInteger \/ MinusZero
+// and turns the -0 into a 0.
+(function() {
+  function foo(x) {
+    x = Math.floor(x);
+    x = Math.max(x, -0);
+    return 1 / Math.abs(x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(Infinity, foo(-0));
+  assertEquals(Infinity, foo(-0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(Infinity, foo(-0));
+})();
+
+// Test that NumberAbs properly passes the kIdentifyZeros truncation
+// for Signed32 \/ MinusZero inputs.
+(function() {
+  function foo(x) {
+    return Math.abs(x * -2);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(2, foo(-1));
+  assertEquals(4, foo(-2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(-1));
+  assertEquals(4, foo(-2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();
+
+// Test that NumberAbs properly passes the kIdentifyZeros truncation
+// for Unsigned32 \/ MinusZero inputs.
+(function() {
+  function foo(x) {
+    x = x | 0;
+    return Math.abs(Math.max(x * -2, 0));
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(2, foo(-1));
+  assertEquals(4, foo(-2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(-1));
+  assertEquals(4, foo(-2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();
+
+// Test that NumberAbs properly passes the kIdentifyZeros truncation
+// for OrderedNumber inputs.
+(function() {
+  function foo(x) {
+    x = x | 0;
+    return Math.abs(Math.min(x * -2, 2 ** 32));
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(2, foo(-1));
+  assertEquals(4, foo(-2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(-1));
+  assertEquals(4, foo(-2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();
diff --git a/src/v8/test/mjsunit/compiler/number-add.js b/src/v8/test/mjsunit/compiler/number-add.js
new file mode 100644
index 0000000..ba5ab17
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/number-add.js
@@ -0,0 +1,64 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// This tests that NumberAdd passes on the right truncations
+// even if it figures out during SimplifiedLowering that it
+// can indeed do a Word32 operation (based on the feedback
+// baked in for its inputs by other operators).
+(function() {
+  // We need a + with Number feedback to get to a NumberAdd
+  // during the typed lowering pass of TurboFan's frontend.
+  function foo(x, y) { return x + y; }
+  foo(0.1, 0.2);
+  foo(0.1, 0.2);
+
+  // Now we need to fool TurboFan to think that it has to
+  // perform the `foo(x,-1)` on Float64 values until the
+  // very last moment (after the RETYPE phase of the
+  // SimplifiedLowering) where it realizes that the inputs
+  // and outputs of the NumberAdd allow it perform the
+  // operation on Word32.
+  function bar(x) {
+    x = Math.trunc(foo(x - 1, 1));
+    return foo(x, -1);
+  }
+
+  %PrepareFunctionForOptimization(bar);
+  assertEquals(0, bar(1));
+  assertEquals(1, bar(2));
+  %OptimizeFunctionOnNextCall(bar);
+  assertEquals(2, bar(3));
+})();
+
+// This tests that SpeculativeNumberAdd can still lower to
+// Int32Add in SimplifiedLowering, which requires some magic
+// to make sure that SpeculativeNumberAdd survives to that
+// point, especially the JSTypedLowering needs to be unable
+// to tell that the inputs to SpeculativeNumberAdd are non
+// String primitives.
+(function() {
+  // We need a function that has a + with feedback Number or
+  // NumberOrOddball, but for whose inputs the JSTypedLowering
+  // cannot reduce it to NumberAdd (with SpeculativeToNumber
+  // conversions). We achieve this utilizing an object literal
+  // indirection here.
+  function baz(x) {
+    return {x}.x + x;
+  }
+  baz(null);
+  baz(undefined);
+
+  // Now we just need to truncate the result.
+  function foo(x) {
+    return baz(1) | 0;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(2, foo());
+  assertEquals(2, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo());
+})();
diff --git a/src/v8/test/mjsunit/compiler/number-ceil.js b/src/v8/test/mjsunit/compiler/number-ceil.js
new file mode 100644
index 0000000..a82dd4c
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/number-ceil.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberCeil propagates kIdentifyZeros truncations.
+(function() {
+  function foo(x) {
+    return Math.abs(Math.ceil(x * -2));
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(2, foo(1));
+  assertEquals(4, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(1));
+  assertEquals(4, foo(2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();
diff --git a/src/v8/test/mjsunit/compiler/number-comparison-truncations.js b/src/v8/test/mjsunit/compiler/number-comparison-truncations.js
new file mode 100644
index 0000000..f0df98a
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/number-comparison-truncations.js
@@ -0,0 +1,161 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --turbo-inlining
+
+// Test that SpeculativeNumberEqual[SignedSmall] properly passes the
+// kIdentifyZeros truncation.
+(function() {
+  function foo(x, y) {
+    if (x * y === 0) return 0;
+    return 1;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  assertOptimized(foo);
+  // Even if x*y produces -0 now, it should stay optimized.
+  assertEquals(0, foo(-3, 0));
+  assertEquals(0, foo(0, -3));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberEqual[Number] properly passes the
+// kIdentifyZeros truncation.
+(function() {
+  // Produce a SpeculativeNumberEqual with Number feedback.
+  function bar(x, y) { return x === y; }
+  %EnsureFeedbackVectorForFunction(bar);
+  bar(0.1, 0.5);
+  bar(-0, 100);
+
+  function foo(x, y) {
+    if (bar(x * y, 0)) return 0;
+    return 1;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  assertOptimized(foo);
+  // Even if x*y produces -0 now, it should stay optimized.
+  assertEquals(0, foo(-3, 0));
+  assertEquals(0, foo(0, -3));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberLessThan[SignedSmall] properly passes the
+// kIdentifyZeros truncation.
+(function() {
+  function foo(x, y) {
+    if (x * y < 0) return 0;
+    return 1;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(1, -1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(1, -1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  assertOptimized(foo);
+  // Even if x*y produces -0 now, it should stay optimized.
+  assertEquals(1, foo(-3, 0));
+  assertEquals(1, foo(0, -3));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberLessThan[Number] properly passes the
+// kIdentifyZeros truncation.
+(function() {
+  // Produce a SpeculativeNumberLessThan with Number feedback.
+  function bar(x, y) { return x < y; }
+  %EnsureFeedbackVectorForFunction(bar);
+  bar(0.1, 0.5);
+  bar(-0, 100);
+
+  function foo(x, y) {
+    if (bar(x * y, 0)) return 0;
+    return 1;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(1, -1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(1, -1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  assertOptimized(foo);
+  // Even if x*y produces -0 now, it should stay optimized.
+  assertEquals(1, foo(-3, 0));
+  assertEquals(1, foo(0, -3));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberLessThanOrEqual[SignedSmall] properly passes the
+// kIdentifyZeros truncation.
+(function() {
+  function foo(x, y) {
+    if (x * y <= 0) return 0;
+    return 1;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  assertOptimized(foo);
+  // Even if x*y produces -0 now, it should stay optimized.
+  assertEquals(0, foo(-3, 0));
+  assertEquals(0, foo(0, -3));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberLessThanOrEqual[Number] properly passes the
+// kIdentifyZeros truncation.
+(function() {
+  // Produce a SpeculativeNumberLessThanOrEqual with Number feedback.
+  function bar(x, y) { return x <= y; }
+  %EnsureFeedbackVectorForFunction(bar);
+  bar(0.1, 0.5);
+  bar(-0, 100);
+
+  function foo(x, y) {
+    if (bar(x * y, 0)) return 0;
+    return 1;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  assertOptimized(foo);
+  // Even if x*y produces -0 now, it should stay optimized.
+  assertEquals(0, foo(-3, 0));
+  assertEquals(0, foo(0, -3));
+  assertOptimized(foo);
+})();
diff --git a/src/v8/test/mjsunit/compiler/number-constructor-deopt.js b/src/v8/test/mjsunit/compiler/number-constructor-deopt.js
new file mode 100644
index 0000000..33a13bd
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/number-constructor-deopt.js
@@ -0,0 +1,33 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// This test writes {} to x to trigger lazy deopt
+// from inside the number constructor.
+var x = "5";
+var b = false;
+
+check = function() {
+  if (b) x = {};
+  return 0;
+}
+
+var obj = {};
+obj.valueOf = check;
+
+function f() {
+  try {
+    return x + Number(obj);
+  } catch(e) {
+    console.log(e.stack);
+  }
+}
+
+%PrepareFunctionForOptimization(f);
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+b = true;
+f();
diff --git a/src/v8/test/mjsunit/compiler/number-divide.js b/src/v8/test/mjsunit/compiler/number-divide.js
new file mode 100644
index 0000000..1c7710c
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/number-divide.js
@@ -0,0 +1,221 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --noalways-opt
+
+// Test that NumberDivide with Number feedback works if only in the
+// end SimplifiedLowering figures out that the inputs to this operation
+// are actually Unsigned32.
+(function() {
+  // We need a separately polluted % with NumberOrOddball feedback.
+  function bar(x) { return x / 2; }
+  bar(undefined);  // The % feedback is now NumberOrOddball.
+
+  // Now just use the gadget above in a way that only after RETYPE
+  // in SimplifiedLowering we find out that the `x` is actually in
+  // Unsigned32 range (based on taking the SignedSmall feedback on
+  // the + operator).
+  function foo(x) {
+    x = (x >>> 0) + 1;
+    return bar(x) | 0;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(2));
+  assertEquals(2, foo(3));
+  assertEquals(2, foo(4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(2));
+  assertEquals(2, foo(3));
+  assertEquals(2, foo(4));
+  assertOptimized(foo);
+})();
+
+// Test that NumberDivide with Number feedback works if only in the
+// end SimplifiedLowering figures out that the inputs to this operation
+// are actually Signed32.
+(function() {
+  // We need a separately polluted % with NumberOrOddball feedback.
+  function bar(x) { return x / 2; }
+  bar(undefined);  // The % feedback is now NumberOrOddball.
+
+  // Now just use the gadget above in a way that only after RETYPE
+  // in SimplifiedLowering we find out that the `x` is actually in
+  // Signed32 range (based on taking the SignedSmall feedback on
+  // the + operator).
+  function foo(x) {
+    x = (x | 0) + 1;
+    return bar(x) | 0;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(2));
+  assertEquals(2, foo(3));
+  assertEquals(2, foo(4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(2));
+  assertEquals(2, foo(3));
+  assertEquals(2, foo(4));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberDivide turns into CheckedInt32Div, and
+// that the "known power of two divisor" optimization works correctly.
+(function() {
+  function foo(x) { return (x | 0) / 2; }
+
+  // Warmup with proper int32 divisions.
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo(2));
+  assertEquals(2, foo(4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo(6));
+  assertOptimized(foo);
+
+  // Make optimized code fail.
+  assertEquals(0.5, foo(1));
+  assertUnoptimized(foo);
+
+  // Try again with the new feedback, and now it should stay optimized.
+  %PrepareFunctionForOptimization(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(4, foo(8));
+  assertOptimized(foo);
+  assertEquals(0.5, foo(1));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberDivide turns into CheckedInt32Div, and
+// that the optimized code properly bails out on "division by zero".
+(function() {
+  function foo(x, y) { return x / y; }
+
+  // Warmup with proper int32 divisions.
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(2, foo(4, 2));
+  assertEquals(2, foo(8, 4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(2, 2));
+  assertOptimized(foo);
+
+  // Make optimized code fail.
+  assertEquals(Infinity, foo(1, 0));
+  assertUnoptimized(foo);
+
+  // Try again with the new feedback, and now it should stay optimized.
+  %PrepareFunctionForOptimization(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(2, 1));
+  assertOptimized(foo);
+  assertEquals(Infinity, foo(1, 0));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberDivide turns into CheckedInt32Div, and
+// that the optimized code properly bails out on minus zero.
+(function() {
+  function foo(x, y) { return x / y; }
+
+  // Warmup with proper int32 divisions.
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(2, foo(4, 2));
+  assertEquals(2, foo(8, 4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(2, 2));
+  assertOptimized(foo);
+
+  // Make optimized code fail.
+  assertEquals(-0, foo(0, -1));
+  assertUnoptimized(foo);
+
+  // Try again with the new feedback, and now it should stay optimized.
+  %PrepareFunctionForOptimization(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(2, 1));
+  assertOptimized(foo);
+  assertEquals(-0, foo(0, -1));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberDivide turns into CheckedInt32Div, and
+// that the optimized code properly bails out if result is -kMinInt.
+(function() {
+  function foo(x, y) { return x / y; }
+
+  // Warmup with proper int32 divisions.
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(2, foo(4, 2));
+  assertEquals(2, foo(8, 4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(2, 2));
+  assertOptimized(foo);
+
+  // Make optimized code fail.
+  assertEquals(2147483648, foo(-2147483648, -1));
+  assertUnoptimized(foo);
+
+  // Try again with the new feedback, and now it should stay optimized.
+  %PrepareFunctionForOptimization(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(2, 1));
+  assertOptimized(foo);
+  assertEquals(2147483648, foo(-2147483648, -1));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberDivide turns into CheckedUint32Div, and
+// that the "known power of two divisor" optimization works correctly.
+(function() {
+  function foo(s) { return s.length / 2; }
+
+  // Warmup with proper uint32 divisions.
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo("ab".repeat(1)));
+  assertEquals(2, foo("ab".repeat(2)));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo("ab".repeat(3)));
+  assertOptimized(foo);
+
+  // Make optimized code fail.
+  assertEquals(0.5, foo("a"));
+  assertUnoptimized(foo);
+
+  // Try again with the new feedback, and now it should stay optimized.
+  %PrepareFunctionForOptimization(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(4, foo("ab".repeat(4)));
+  assertOptimized(foo);
+  assertEquals(0.5, foo("a"));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberDivide turns into CheckedUint32Div, and
+// that the optimized code properly bails out on "division by zero".
+(function() {
+  function foo(x, y) { return (x >>> 0) / (y >>> 0); }
+
+  // Warmup with proper uint32 divisions.
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(2, foo(4, 2));
+  assertEquals(2, foo(8, 4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(2, 2));
+  assertOptimized(foo);
+
+  // Make optimized code fail.
+  assertEquals(Infinity, foo(1, 0));
+  assertUnoptimized(foo);
+
+  // Try again with the new feedback, and now it should stay optimized.
+  %PrepareFunctionForOptimization(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(2, 1));
+  assertOptimized(foo);
+  assertEquals(Infinity, foo(1, 0));
+  assertOptimized(foo);
+})();
diff --git a/src/v8/test/mjsunit/compiler/number-floor.js b/src/v8/test/mjsunit/compiler/number-floor.js
new file mode 100644
index 0000000..ede0730
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/number-floor.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberFloor propagates kIdentifyZeros truncations.
+(function() {
+  function foo(x) {
+    return Math.abs(Math.floor(x * -2));
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(2, foo(1));
+  assertEquals(4, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(1));
+  assertEquals(4, foo(2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();
diff --git a/src/v8/test/mjsunit/compiler/number-isfinite-inl.js b/src/v8/test/mjsunit/compiler/number-isfinite-inl.js
new file mode 100644
index 0000000..54e6b2c
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/number-isfinite-inl.js
@@ -0,0 +1,56 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function test(f) {
+  assertTrue(Number.isFinite(0));
+  assertTrue(Number.isFinite(Number.MIN_VALUE));
+  assertTrue(Number.isFinite(Number.MAX_VALUE));
+  assertTrue(Number.isFinite(Number.MIN_SAFE_INTEGER));
+  assertTrue(Number.isFinite(Number.MIN_SAFE_INTEGER - 13));
+  assertTrue(Number.isFinite(Number.MAX_SAFE_INTEGER));
+  assertTrue(Number.isFinite(Number.MAX_SAFE_INTEGER + 23));
+  assertTrue(Number.isFinite(0));
+  assertTrue(Number.isFinite(-1));
+  assertTrue(Number.isFinite(123456));
+  assertFalse(Number.isFinite(Number.NaN));
+  assertFalse(Number.isFinite(Number.POSITIVE_INFINITY));
+  assertFalse(Number.isFinite(Number.NEGATIVE_INFINITY));
+  assertFalse(Number.isFinite(1 / 0));
+  assertFalse(Number.isFinite(-1 / 0));
+}
+
+%PrepareFunctionForOptimization(test);
+test();
+test();
+%OptimizeFunctionOnNextCall(test);
+test();
+
+
+function test2(f) {
+  assertFalse(Number.isFinite({}));
+  assertFalse(Number.isFinite("abc"));
+  assertTrue(Number.isFinite(0));
+  assertTrue(Number.isFinite(Number.MIN_VALUE));
+  assertTrue(Number.isFinite(Number.MAX_VALUE));
+  assertTrue(Number.isFinite(Number.MIN_SAFE_INTEGER));
+  assertTrue(Number.isFinite(Number.MIN_SAFE_INTEGER - 13));
+  assertTrue(Number.isFinite(Number.MAX_SAFE_INTEGER));
+  assertTrue(Number.isFinite(Number.MAX_SAFE_INTEGER + 23));
+  assertTrue(Number.isFinite(0));
+  assertTrue(Number.isFinite(-1));
+  assertTrue(Number.isFinite(123456));
+  assertFalse(Number.isFinite(Number.NaN));
+  assertFalse(Number.isFinite(Number.POSITIVE_INFINITY));
+  assertFalse(Number.isFinite(Number.NEGATIVE_INFINITY));
+  assertFalse(Number.isFinite(1 / 0));
+  assertFalse(Number.isFinite(-1 / 0));
+}
+
+%PrepareFunctionForOptimization(test2);
+test2();
+test2();
+%OptimizeFunctionOnNextCall(test2);
+test2();
diff --git a/src/v8/test/mjsunit/compiler/number-isfinite.js b/src/v8/test/mjsunit/compiler/number-isfinite.js
index 689e31c..b28be7a 100644
--- a/src/v8/test/mjsunit/compiler/number-isfinite.js
+++ b/src/v8/test/mjsunit/compiler/number-isfinite.js
@@ -12,6 +12,9 @@
   assertTrue(f(Number.MIN_SAFE_INTEGER - 13));
   assertTrue(f(Number.MAX_SAFE_INTEGER));
   assertTrue(f(Number.MAX_SAFE_INTEGER + 23));
+  assertTrue(f(0));
+  assertTrue(f(-1));
+  assertTrue(f(123456));
   assertFalse(f(Number.NaN));
   assertFalse(f(Number.POSITIVE_INFINITY));
   assertFalse(f(Number.NEGATIVE_INFINITY));
@@ -23,7 +26,39 @@
   return Number.isFinite(+x);
 }
 
+%PrepareFunctionForOptimization(f);
 test(f);
 test(f);
 %OptimizeFunctionOnNextCall(f);
 test(f);
+
+
+function test2(f) {
+  assertFalse(f({}));
+  assertFalse(f("abc"));
+  assertTrue(f(0));
+  assertTrue(f(Number.MIN_VALUE));
+  assertTrue(f(Number.MAX_VALUE));
+  assertTrue(f(Number.MIN_SAFE_INTEGER));
+  assertTrue(f(Number.MIN_SAFE_INTEGER - 13));
+  assertTrue(f(Number.MAX_SAFE_INTEGER));
+  assertTrue(f(Number.MAX_SAFE_INTEGER + 23));
+  assertTrue(f(0));
+  assertTrue(f(-1));
+  assertTrue(f(123456));
+  assertFalse(f(Number.NaN));
+  assertFalse(f(Number.POSITIVE_INFINITY));
+  assertFalse(f(Number.NEGATIVE_INFINITY));
+  assertFalse(f(1 / 0));
+  assertFalse(f(-1 / 0));
+}
+
+function f2(x) {
+  return Number.isFinite(x);
+}
+
+%PrepareFunctionForOptimization(f2);
+test2(f2);
+test2(f2);
+%OptimizeFunctionOnNextCall(f2);
+test2(f2);
diff --git a/src/v8/test/mjsunit/compiler/number-isinteger-inl.js b/src/v8/test/mjsunit/compiler/number-isinteger-inl.js
new file mode 100644
index 0000000..6f3bbd6
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/number-isinteger-inl.js
@@ -0,0 +1,56 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function test() {
+  assertTrue(Number.isInteger(0));
+  assertFalse(Number.isInteger(Number.MIN_VALUE));
+  assertTrue(Number.isInteger(Number.MAX_VALUE));
+  assertTrue(Number.isInteger(Number.MIN_SAFE_INTEGER));
+  assertTrue(Number.isInteger(Number.MIN_SAFE_INTEGER - 13));
+  assertTrue(Number.isInteger(Number.MAX_SAFE_INTEGER));
+  assertTrue(Number.isInteger(Number.MAX_SAFE_INTEGER + 23));
+  assertTrue(Number.isInteger(0));
+  assertTrue(Number.isInteger(-1));
+  assertTrue(Number.isInteger(123456));
+  assertFalse(Number.isInteger(Number.NaN));
+  assertFalse(Number.isInteger(Number.POSITIVE_INFINITY));
+  assertFalse(Number.isInteger(Number.NEGATIVE_INFINITY));
+  assertFalse(Number.isInteger(1 / 0));
+  assertFalse(Number.isInteger(-1 / 0));
+  assertFalse(Number.isInteger(Number.EPSILON));
+}
+
+%PrepareFunctionForOptimization(test);
+test();
+test();
+%OptimizeFunctionOnNextCall(test);
+test();
+
+
+function test2() {
+  assertTrue(Number.isInteger(0));
+  assertFalse(Number.isInteger(Number.MIN_VALUE));
+  assertTrue(Number.isInteger(Number.MAX_VALUE));
+  assertTrue(Number.isInteger(Number.MIN_SAFE_INTEGER));
+  assertTrue(Number.isInteger(Number.MIN_SAFE_INTEGER - 13));
+  assertTrue(Number.isInteger(Number.MAX_SAFE_INTEGER));
+  assertTrue(Number.isInteger(Number.MAX_SAFE_INTEGER + 23));
+  assertTrue(Number.isInteger(0));
+  assertTrue(Number.isInteger(-1));
+  assertTrue(Number.isInteger(123456));
+  assertFalse(Number.isInteger(Number.NaN));
+  assertFalse(Number.isInteger(Number.POSITIVE_INFINITY));
+  assertFalse(Number.isInteger(Number.NEGATIVE_INFINITY));
+  assertFalse(Number.isInteger(1 / 0));
+  assertFalse(Number.isInteger(-1 / 0));
+  assertFalse(Number.isInteger(Number.EPSILON));
+}
+
+%PrepareFunctionForOptimization(test2);
+test2();
+test2();
+%OptimizeFunctionOnNextCall(test2);
+test2();
diff --git a/src/v8/test/mjsunit/compiler/number-isinteger.js b/src/v8/test/mjsunit/compiler/number-isinteger.js
index 8999569..b3a45d9 100644
--- a/src/v8/test/mjsunit/compiler/number-isinteger.js
+++ b/src/v8/test/mjsunit/compiler/number-isinteger.js
@@ -12,6 +12,9 @@
   assertTrue(f(Number.MIN_SAFE_INTEGER - 13));
   assertTrue(f(Number.MAX_SAFE_INTEGER));
   assertTrue(f(Number.MAX_SAFE_INTEGER + 23));
+  assertTrue(f(0));
+  assertTrue(f(-1));
+  assertTrue(f(123456));
   assertFalse(f(Number.NaN));
   assertFalse(f(Number.POSITIVE_INFINITY));
   assertFalse(f(Number.NEGATIVE_INFINITY));
@@ -24,7 +27,38 @@
   return Number.isInteger(+x);
 }
 
+%PrepareFunctionForOptimization(f);
 test(f);
 test(f);
 %OptimizeFunctionOnNextCall(f);
 test(f);
+
+
+function test2(f) {
+  assertTrue(f(0));
+  assertFalse(f(Number.MIN_VALUE));
+  assertTrue(f(Number.MAX_VALUE));
+  assertTrue(f(Number.MIN_SAFE_INTEGER));
+  assertTrue(f(Number.MIN_SAFE_INTEGER - 13));
+  assertTrue(f(Number.MAX_SAFE_INTEGER));
+  assertTrue(f(Number.MAX_SAFE_INTEGER + 23));
+  assertTrue(f(0));
+  assertTrue(f(-1));
+  assertTrue(f(123456));
+  assertFalse(f(Number.NaN));
+  assertFalse(f(Number.POSITIVE_INFINITY));
+  assertFalse(f(Number.NEGATIVE_INFINITY));
+  assertFalse(f(1 / 0));
+  assertFalse(f(-1 / 0));
+  assertFalse(f(Number.EPSILON));
+}
+
+function f2(x) {
+  return Number.isInteger(x);
+}
+
+%PrepareFunctionForOptimization(f2);
+test2(f2);
+test2(f2);
+%OptimizeFunctionOnNextCall(f2);
+test2(f2);
diff --git a/src/v8/test/mjsunit/compiler/number-isnan.js b/src/v8/test/mjsunit/compiler/number-isnan.js
index fb6bb6d..aaa9acb 100644
--- a/src/v8/test/mjsunit/compiler/number-isnan.js
+++ b/src/v8/test/mjsunit/compiler/number-isnan.js
@@ -22,6 +22,7 @@
   return Number.isNaN(+x);
 }
 
+%PrepareFunctionForOptimization(f);
 test(f);
 test(f);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/number-issafeinteger.js b/src/v8/test/mjsunit/compiler/number-issafeinteger.js
index 192fb6c..26ac38e 100644
--- a/src/v8/test/mjsunit/compiler/number-issafeinteger.js
+++ b/src/v8/test/mjsunit/compiler/number-issafeinteger.js
@@ -40,11 +40,21 @@
   assertFalse(f(2 * near_lower - 7));
 }
 
-function f(x) {
-  return Number.isSafeInteger(+x);
-}
+// Check that the NumberIsSafeInteger simplified operator in
+// TurboFan does the right thing.
+function NumberIsSafeInteger(x) { return Number.isSafeInteger(+x); }
+%PrepareFunctionForOptimization(NumberIsSafeInteger);
+test(NumberIsSafeInteger);
+test(NumberIsSafeInteger);
+%OptimizeFunctionOnNextCall(NumberIsSafeInteger);
+test(NumberIsSafeInteger);
 
-test(f);
-test(f);
-%OptimizeFunctionOnNextCall(f);
-test(f);
+// Check that the ObjectIsSafeInteger simplified operator in
+// TurboFan does the right thing as well (i.e. when TurboFan
+// is not able to tell statically that the inputs are numbers).
+function ObjectIsSafeInteger(x) { return Number.isSafeInteger(x); }
+%PrepareFunctionForOptimization(ObjectIsSafeInteger);
+test(ObjectIsSafeInteger);
+test(ObjectIsSafeInteger);
+%OptimizeFunctionOnNextCall(ObjectIsSafeInteger);
+test(ObjectIsSafeInteger);
diff --git a/src/v8/test/mjsunit/compiler/number-max.js b/src/v8/test/mjsunit/compiler/number-max.js
new file mode 100644
index 0000000..35a29fa
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/number-max.js
@@ -0,0 +1,39 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberMax properly passes the kIdentifyZeros truncation.
+(function() {
+  function foo(x) {
+    if (Math.max(x * -2, 1) == 1) return 0;
+    return 1;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(2));
+  assertEquals(1, foo(-1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(2));
+  assertEquals(1, foo(-1));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();
+
+// Test that NumberMax properly handles 64-bit comparisons.
+(function() {
+  function foo(x) {
+    x = x|0;
+    return Math.max(x - 1, x + 1);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(-Math.pow(2, 31) + 1, foo(-Math.pow(2, 31)));
+  assertEquals(Math.pow(2, 31), foo(Math.pow(2, 31) - 1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(-Math.pow(2, 31) + 1, foo(-Math.pow(2, 31)));
+  assertEquals(Math.pow(2, 31), foo(Math.pow(2, 31) - 1));
+})();
diff --git a/src/v8/test/mjsunit/compiler/number-min.js b/src/v8/test/mjsunit/compiler/number-min.js
new file mode 100644
index 0000000..da66026
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/number-min.js
@@ -0,0 +1,39 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberMin properly passes the kIdentifyZeros truncation.
+(function() {
+  function foo(x) {
+    if (Math.min(x * -2, -1) == -2) return 0;
+    return 1;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(1));
+  assertEquals(1, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(1));
+  assertEquals(1, foo(2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(1, foo(0));
+  assertOptimized(foo);
+})();
+
+// Test that NumberMin properly handles 64-bit comparisons.
+(function() {
+  function foo(x) {
+    x = x|0;
+    return Math.min(x - 1, x + 1);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(-Math.pow(2, 31) - 1, foo(-Math.pow(2, 31)));
+  assertEquals(Math.pow(2, 31) - 2, foo(Math.pow(2, 31) - 1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(-Math.pow(2, 31) - 1, foo(-Math.pow(2, 31)));
+  assertEquals(Math.pow(2, 31) - 2, foo(Math.pow(2, 31) - 1));
+})();
diff --git a/src/v8/test/mjsunit/compiler/number-modulus.js b/src/v8/test/mjsunit/compiler/number-modulus.js
new file mode 100644
index 0000000..e8f86e7
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/number-modulus.js
@@ -0,0 +1,27 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --noalways-opt
+
+
+// Test that NumberModulus passes kIdentifiesZero to the
+// left hand side input when the result doesn't care about
+// 0 vs -0, even when the inputs are outside Signed32.
+(function() {
+  function foo(x) {
+    return (x * -2) % (2 ** 32) === 0;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(2));
+  assertFalse(foo(1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(2));
+  assertFalse(foo(1));
+
+  // Now `foo` should stay optimized even if `x * -2` would
+  // produce -0, aka when we pass a zero value for `x`.
+  assertTrue(foo(0));
+  assertOptimized(foo);
+})();
diff --git a/src/v8/test/mjsunit/compiler/number-multiply.js b/src/v8/test/mjsunit/compiler/number-multiply.js
new file mode 100644
index 0000000..07e1f84
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/number-multiply.js
@@ -0,0 +1,62 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test the extreme case where -0 is produced by rounding errors.
+(function() {
+  function bar(x) {
+    return 1e-308 * x;
+  }
+  bar(1);
+
+  function foo() {
+    return Object.is(-0, bar(-1e-308));
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();
+
+// Test that multiplication of integer by 0 produces the correct results.
+(function() {
+  function foo(x) {
+    return 0 * Math.round(x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(0.1));
+  assertEquals(-0, foo(-0.1));
+  assertEquals(NaN, foo(NaN));
+  assertEquals(NaN, foo(Infinity));
+  assertEquals(NaN, foo(-Infinity));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(0.1));
+  assertEquals(-0, foo(-0.1));
+  assertEquals(NaN, foo(NaN));
+  assertEquals(NaN, foo(Infinity));
+  assertEquals(NaN, foo(-Infinity));
+})();
+
+// Test that multiplication properly preserves -0 and NaN, and doesn't
+// cut it short incorrectly.
+(function() {
+  function foo(x, y) {
+    x = Math.sign(x);
+    y = Math.sign(y);
+    return Math.min(x * y, 0);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(1, 0));
+  assertEquals(-0, foo(1, -0));
+  assertEquals(NaN, foo(NaN, -0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(1, 0));
+  assertEquals(-0, foo(1, -0));
+  assertEquals(NaN, foo(NaN, -0));
+})();
diff --git a/src/v8/test/mjsunit/compiler/number-round.js b/src/v8/test/mjsunit/compiler/number-round.js
new file mode 100644
index 0000000..4a9eb9a
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/number-round.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberRound propagates kIdentifyZeros truncations.
+(function() {
+  function foo(x) {
+    return Math.abs(Math.round(x * -2));
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(2, foo(1));
+  assertEquals(4, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(1));
+  assertEquals(4, foo(2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();
diff --git a/src/v8/test/mjsunit/compiler/number-subtract.js b/src/v8/test/mjsunit/compiler/number-subtract.js
new file mode 100644
index 0000000..56f028c
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/number-subtract.js
@@ -0,0 +1,35 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// This tests that SpeculativeNumberSubtract can still lower to
+// Int32Sub in SimplifiedLowering, which requires some magic
+// to make sure that SpeculativeNumberSubtract survives to that
+// point, especially the JSTypedLowering needs to be unable
+// to tell that the inputs to SpeculativeNumberAdd are not
+// Number, Undefined, Null or Boolean.
+(function() {
+  // We need a function that has a - with feedback Number or
+  // NumberOrOddball, but for whose inputs the JSTypedLowering
+  // cannot reduce it to NumberSubtract (with SpeculativeToNumber
+  // conversions). We achieve this utilizing an object literal
+  // indirection here.
+  function baz(x) {
+    return {x}.x - x;
+  }
+  baz(null);
+  baz(undefined);
+
+  // Now we just need to truncate the result.
+  function foo(x) {
+    return baz(42) | 0;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo());
+  assertEquals(0, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo());
+})();
diff --git a/src/v8/test/mjsunit/compiler/number-toboolean.js b/src/v8/test/mjsunit/compiler/number-toboolean.js
new file mode 100644
index 0000000..372031c
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/number-toboolean.js
@@ -0,0 +1,47 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberToBoolean properly passes the kIdentifyZeros truncation
+// for Signed32 \/ MinusZero inputs.
+(function() {
+  function foo(x) {
+    if (x * -2) return 1;
+    return 0;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();
+
+
+// Test that NumberToBoolean properly passes the kIdentifyZeros truncation
+// for Unsigned32 \/ MinusZero inputs.
+(function() {
+  function foo(x) {
+    x = x | 0;
+    if (Math.max(x * -2, 0)) return 1;
+    return 0;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo(-1));
+  assertEquals(1, foo(-2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(-1));
+  assertEquals(1, foo(-2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();
diff --git a/src/v8/test/mjsunit/compiler/number-trunc.js b/src/v8/test/mjsunit/compiler/number-trunc.js
new file mode 100644
index 0000000..1cc005d
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/number-trunc.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberTrunc propagates kIdentifyZeros truncations.
+(function() {
+  function foo(x) {
+    return Math.abs(Math.trunc(x * -2));
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(2, foo(1));
+  assertEquals(4, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(1));
+  assertEquals(4, foo(2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();
diff --git a/src/v8/test/mjsunit/compiler/object-constructor.js b/src/v8/test/mjsunit/compiler/object-constructor.js
index 162416f..71e51ee 100644
--- a/src/v8/test/mjsunit/compiler/object-constructor.js
+++ b/src/v8/test/mjsunit/compiler/object-constructor.js
@@ -14,6 +14,7 @@
   function foo(a) {
     return Object(a.bar)();
   }
+  %PrepareFunctionForOptimization(foo);
   assertEquals(undefined, foo(new A));
   assertEquals(undefined, foo(new A));
   %OptimizeFunctionOnNextCall(foo);
@@ -25,6 +26,7 @@
   function foo() {
     return Object("a");
   }
+  %PrepareFunctionForOptimization(foo);
   assertEquals('object', typeof foo());
   assertEquals('object', typeof foo());
   %OptimizeFunctionOnNextCall(foo);
@@ -41,6 +43,7 @@
   function foo() {
     return new A(1, 2, 3);
   }
+  %PrepareFunctionForOptimization(foo);
   assertInstanceof(foo(), A);
   assertInstanceof(foo(), Object);
   assertInstanceof(foo(), A);
diff --git a/src/v8/test/mjsunit/compiler/object-create.js b/src/v8/test/mjsunit/compiler/object-create.js
new file mode 100644
index 0000000..253024a
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/object-create.js
@@ -0,0 +1,30 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestWithNullPrototype() {
+  function f() { return Object.create(null); }
+  %PrepareFunctionForOptimization(f);
+  f();
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(undefined, f().foo);
+})();
+
+(function TestWithCustomPrototype() {
+  const x = {foo: 42};  // This must be defined here for context specialization.
+  function f() { return Object.create(x); }
+  %PrepareFunctionForOptimization(f);
+  f();
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(42, f().foo);
+})();
+
+(function TestWithObjectPrototype() {
+  function f() { return Object.create(Object.prototype); }
+  %PrepareFunctionForOptimization(f);
+  f();
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("[object Object]", f().toString());
+})();
diff --git a/src/v8/test/mjsunit/compiler/object-getprototypeof.js b/src/v8/test/mjsunit/compiler/object-getprototypeof.js
index ac172db..8360a8d 100644
--- a/src/v8/test/mjsunit/compiler/object-getprototypeof.js
+++ b/src/v8/test/mjsunit/compiler/object-getprototypeof.js
@@ -9,6 +9,7 @@
 
 function foo() { return Object.getPrototypeOf(object); }
 
+%PrepareFunctionForOptimization(foo);
 assertSame(prototype, foo());
 assertSame(prototype, foo());
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/object-is.js b/src/v8/test/mjsunit/compiler/object-is.js
index f89b73e..0c49648 100644
--- a/src/v8/test/mjsunit/compiler/object-is.js
+++ b/src/v8/test/mjsunit/compiler/object-is.js
@@ -6,6 +6,7 @@
 
 (function() {
   function foo(o) { return Object.is(o, -0); }
+  %PrepareFunctionForOptimization(foo);
   assertTrue(foo(-0));
   assertFalse(foo(0));
   assertFalse(foo(NaN));
@@ -23,6 +24,7 @@
 
 (function() {
   function foo(o) { return Object.is(-0, o); }
+  %PrepareFunctionForOptimization(foo);
   assertTrue(foo(-0));
   assertFalse(foo(0));
   assertFalse(foo(NaN));
@@ -40,6 +42,7 @@
 
 (function() {
   function foo(o) { return Object.is(+o, -0); }
+  %PrepareFunctionForOptimization(foo);
   assertTrue(foo(-0));
   assertFalse(foo(0));
   assertFalse(foo(NaN));
@@ -51,6 +54,7 @@
 
 (function() {
   function foo(o) { return Object.is(-0, +o); }
+  %PrepareFunctionForOptimization(foo);
   assertTrue(foo(-0));
   assertFalse(foo(0));
   assertFalse(foo(NaN));
@@ -62,6 +66,7 @@
 
 (function() {
   function foo(o) { return Object.is(o, NaN); }
+  %PrepareFunctionForOptimization(foo);
   assertFalse(foo(-0));
   assertFalse(foo(0));
   assertTrue(foo(NaN));
@@ -79,6 +84,7 @@
 
 (function() {
   function foo(o) { return Object.is(NaN, o); }
+  %PrepareFunctionForOptimization(foo);
   assertFalse(foo(-0));
   assertFalse(foo(0));
   assertTrue(foo(NaN));
@@ -96,6 +102,7 @@
 
 (function() {
   function foo(o) { return Object.is(+o, NaN); }
+  %PrepareFunctionForOptimization(foo);
   assertFalse(foo(-0));
   assertFalse(foo(0));
   assertTrue(foo(NaN));
@@ -107,6 +114,7 @@
 
 (function() {
   function foo(o) { return Object.is(NaN, +o); }
+  %PrepareFunctionForOptimization(foo);
   assertFalse(foo(-0));
   assertFalse(foo(0));
   assertTrue(foo(NaN));
@@ -118,6 +126,7 @@
 
 (function() {
   function foo(o) { return Object.is(`${o}`, "foo"); }
+  %PrepareFunctionForOptimization(foo);
   assertFalse(foo("bar"));
   assertTrue(foo("foo"));
   %OptimizeFunctionOnNextCall(foo);
@@ -127,6 +136,7 @@
 
 (function() {
   function foo(o) { return Object.is(String(o), "foo"); }
+  %PrepareFunctionForOptimization(foo);
   assertFalse(foo("bar"));
   assertTrue(foo("foo"));
   %OptimizeFunctionOnNextCall(foo);
@@ -136,6 +146,7 @@
 
 (function() {
   function foo(o) { return Object.is(o, o); }
+  %PrepareFunctionForOptimization(foo);
   assertTrue(foo(-0));
   assertTrue(foo(0));
   assertTrue(foo(NaN));
@@ -153,6 +164,7 @@
 
 (function() {
   function foo(o) { return Object.is(o|0, 0); }
+  %PrepareFunctionForOptimization(foo);
   assertTrue(foo(0));
   assertTrue(foo(-0));
   assertTrue(foo(NaN));
@@ -167,8 +179,39 @@
 (function() {
   const s = Symbol();
   function foo() { return Object.is(s, Symbol()); }
+  %PrepareFunctionForOptimization(foo);
   assertFalse(foo());
   assertFalse(foo());
   %OptimizeFunctionOnNextCall(foo);
   assertFalse(foo());
 })();
+
+(function() {
+  function foo(a, b) { return Object.is(+a, +b); }
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(1, 2));
+  assertFalse(foo(0, -0));
+  assertFalse(foo(-0, 0));
+  assertFalse(foo(-0, 1));
+  assertFalse(foo(-0, 1));
+  assertFalse(foo(-Infinity, Infinity));
+  assertTrue(foo(0, 0));
+  assertTrue(foo(0.1, 0.1));
+  assertTrue(foo(Infinity, Infinity));
+  assertTrue(foo(-0, -0));
+  assertTrue(foo(NaN, NaN));
+  assertFalse(foo(Infinity, NaN));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(1, 2));
+  assertFalse(foo(0, -0));
+  assertFalse(foo(-0, 0));
+  assertFalse(foo(-0, 1));
+  assertFalse(foo(-0, 1));
+  assertFalse(foo(-Infinity, Infinity));
+  assertTrue(foo(0, 0));
+  assertTrue(foo(0.1, 0.1));
+  assertTrue(foo(Infinity, Infinity));
+  assertTrue(foo(-0, -0));
+  assertTrue(foo(NaN, NaN));
+  assertFalse(foo(Infinity, NaN));
+})();
diff --git a/src/v8/test/mjsunit/compiler/object-isprototypeof.js b/src/v8/test/mjsunit/compiler/object-isprototypeof.js
index 284a438..d8e3c3e 100644
--- a/src/v8/test/mjsunit/compiler/object-isprototypeof.js
+++ b/src/v8/test/mjsunit/compiler/object-isprototypeof.js
@@ -8,6 +8,7 @@
 (function() {
   function foo(x, y) { return Object.prototype.isPrototypeOf.call(x, y); }
 
+  %PrepareFunctionForOptimization(foo);
   assertThrows(() => foo(null, {}));
   assertThrows(() => foo(undefined, {}));
   assertThrows(() => foo(null, []));
@@ -43,6 +44,7 @@
 
   function foo(x) { return A.prototype.isPrototypeOf(x); }
 
+  %PrepareFunctionForOptimization(foo);
   assertFalse(foo(0));
   assertFalse(foo(""));
   assertFalse(foo(null));
@@ -74,6 +76,7 @@
 
   function foo() { return A.prototype.isPrototypeOf(0); }
 
+  %PrepareFunctionForOptimization(foo);
   assertFalse(foo());
   assertFalse(foo());
   %OptimizeFunctionOnNextCall(foo);
@@ -86,6 +89,7 @@
 
   function foo() { return A.prototype.isPrototypeOf(null); }
 
+  %PrepareFunctionForOptimization(foo);
   assertFalse(foo());
   assertFalse(foo());
   %OptimizeFunctionOnNextCall(foo);
@@ -98,6 +102,7 @@
 
   function foo() { return A.prototype.isPrototypeOf(undefined); }
 
+  %PrepareFunctionForOptimization(foo);
   assertFalse(foo());
   assertFalse(foo());
   %OptimizeFunctionOnNextCall(foo);
@@ -112,6 +117,7 @@
 
   function foo() { return A.prototype.isPrototypeOf(a); }
 
+  %PrepareFunctionForOptimization(foo);
   assertTrue(foo());
   assertTrue(foo());
   %OptimizeFunctionOnNextCall(foo);
@@ -124,6 +130,7 @@
 
   function foo() { return A.prototype.isPrototypeOf(a); }
 
+  %PrepareFunctionForOptimization(foo);
   assertFalse(foo());
   assertFalse(foo());
   %OptimizeFunctionOnNextCall(foo);
@@ -136,6 +143,7 @@
 
   function foo() { return Array.prototype.isPrototypeOf(a); }
 
+  %PrepareFunctionForOptimization(foo);
   assertTrue(foo());
   assertTrue(foo());
   %OptimizeFunctionOnNextCall(foo);
@@ -146,6 +154,7 @@
 
   function foo() { return Object.prototype.isPrototypeOf(a); }
 
+  %PrepareFunctionForOptimization(foo);
   assertTrue(foo());
   assertTrue(foo());
   %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/opt-next-call-turbo.js b/src/v8/test/mjsunit/compiler/opt-next-call-turbo.js
index eb8df4b..843b197 100644
--- a/src/v8/test/mjsunit/compiler/opt-next-call-turbo.js
+++ b/src/v8/test/mjsunit/compiler/opt-next-call-turbo.js
@@ -8,6 +8,7 @@
   with ({ value:"fooed" }) { return value; }
 }
 
+%PrepareFunctionForOptimization(foo);
 %OptimizeFunctionOnNextCall(foo);
 assertEquals("fooed", foo());
 assertOptimized(foo);
@@ -16,6 +17,7 @@
   with ({ value:"bared" }) { return value; }
 }
 
+%PrepareFunctionForOptimization(bar);
 assertEquals("bared", bar());
 %OptimizeFunctionOnNextCall(bar);
 assertEquals("bared", bar());
diff --git a/src/v8/test/mjsunit/compiler/opt-next-call.js b/src/v8/test/mjsunit/compiler/opt-next-call.js
index 2878efe..2e92dba 100644
--- a/src/v8/test/mjsunit/compiler/opt-next-call.js
+++ b/src/v8/test/mjsunit/compiler/opt-next-call.js
@@ -8,6 +8,7 @@
   return "fooed";
 }
 
+%PrepareFunctionForOptimization(foo);
 %OptimizeFunctionOnNextCall(foo);
 assertEquals("fooed", foo());
 assertOptimized(foo);
@@ -16,6 +17,7 @@
   return "bared";
 }
 
+%PrepareFunctionForOptimization(bar);
 assertEquals("bared", bar());
 %OptimizeFunctionOnNextCall(bar);
 assertEquals("bared", bar());
diff --git a/src/v8/test/mjsunit/compiler/optimize-bitnot.js b/src/v8/test/mjsunit/compiler/optimize-bitnot.js
index 28315a4..e129f8c 100644
--- a/src/v8/test/mjsunit/compiler/optimize-bitnot.js
+++ b/src/v8/test/mjsunit/compiler/optimize-bitnot.js
@@ -31,6 +31,7 @@
   return ~~x;
 }
 
+%PrepareFunctionForOptimization(f);
 f(42);
 f(42);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/optimized-closures.js b/src/v8/test/mjsunit/compiler/optimized-closures.js
index 499e4d5..48d7816 100644
--- a/src/v8/test/mjsunit/compiler/optimized-closures.js
+++ b/src/v8/test/mjsunit/compiler/optimized-closures.js
@@ -40,7 +40,8 @@
         return 42;
       }
       return x + y + h(y);
-    }
+    };
+    %PrepareFunctionForOptimization(g);
     g(0);
     %OptimizeFunctionOnNextCall(g);
     a[i] = g(i);
diff --git a/src/v8/test/mjsunit/compiler/optimized-float32array-length.js b/src/v8/test/mjsunit/compiler/optimized-float32array-length.js
index 6e08e4a..5144e68 100644
--- a/src/v8/test/mjsunit/compiler/optimized-float32array-length.js
+++ b/src/v8/test/mjsunit/compiler/optimized-float32array-length.js
@@ -6,6 +6,7 @@
 
 var a = new Float32Array(1);
 function len(a) { return a.length; }
+%PrepareFunctionForOptimization(len);
 assertEquals(1, len(a));
 assertEquals(1, len(a));
 %OptimizeFunctionOnNextCall(len);
diff --git a/src/v8/test/mjsunit/compiler/optimized-float64array-length.js b/src/v8/test/mjsunit/compiler/optimized-float64array-length.js
index 7d48d09..116a624 100644
--- a/src/v8/test/mjsunit/compiler/optimized-float64array-length.js
+++ b/src/v8/test/mjsunit/compiler/optimized-float64array-length.js
@@ -6,6 +6,7 @@
 
 var a = new Float64Array(1);
 function len(a) { return a.length; }
+%PrepareFunctionForOptimization(len);
 assertEquals(1, len(a));
 assertEquals(1, len(a));
 %OptimizeFunctionOnNextCall(len);
diff --git a/src/v8/test/mjsunit/compiler/optimized-for-in.js b/src/v8/test/mjsunit/compiler/optimized-for-in.js
index ca17ee6..e3a0bb0 100644
--- a/src/v8/test/mjsunit/compiler/optimized-for-in.js
+++ b/src/v8/test/mjsunit/compiler/optimized-for-in.js
@@ -174,6 +174,7 @@
 
 
 function tryFunction(result, mkT, f) {
+  %PrepareFunctionForOptimization(f);
   var d = {deopt: false};
   assertEquals(result, f(mkT(), d));
   assertEquals(result, f(mkT(), d));
@@ -265,9 +266,11 @@
       }
       r += x;
     }
+    %PrepareFunctionForOptimization(osr_inner);
   }
   return r;
 }
+%PrepareFunctionForOptimization(osr_inner);
 
 function osr_outer(t, osr_after) {
   var r = 1;
@@ -280,6 +283,7 @@
   }
   return r;
 }
+%PrepareFunctionForOptimization(osr_outer);
 
 function osr_outer_and_deopt(t, osr_after) {
   var r = 1;
@@ -289,6 +293,7 @@
   }
   return r;
 }
+%PrepareFunctionForOptimization(osr_outer_and_deopt);
 
 function test_osr() {
   with ({}) {}  // Disable optimizations of this function.
diff --git a/src/v8/test/mjsunit/compiler/optimized-function-calls.js b/src/v8/test/mjsunit/compiler/optimized-function-calls.js
index c3e69d7..8f04538 100644
--- a/src/v8/test/mjsunit/compiler/optimized-function-calls.js
+++ b/src/v8/test/mjsunit/compiler/optimized-function-calls.js
@@ -48,6 +48,7 @@
 function call_f(o) {
   return o.f();
 }
+%PrepareFunctionForOptimization(call_f);
 for (var i = 0; i < 5; i++) call_f(object);
 %OptimizeFunctionOnNextCall(call_f);
 call_f(object);
diff --git a/src/v8/test/mjsunit/compiler/optimized-instanceof-1.js b/src/v8/test/mjsunit/compiler/optimized-instanceof-1.js
index 242b4be..76e7c86 100644
--- a/src/v8/test/mjsunit/compiler/optimized-instanceof-1.js
+++ b/src/v8/test/mjsunit/compiler/optimized-instanceof-1.js
@@ -13,5 +13,6 @@
 Object.setPrototypeOf(F, proto);
 
 function foo(x) { return x instanceof F };
+%PrepareFunctionForOptimization(foo);
 %OptimizeFunctionOnNextCall(foo);
 assertTrue(foo(1));
diff --git a/src/v8/test/mjsunit/compiler/optimized-instanceof-2.js b/src/v8/test/mjsunit/compiler/optimized-instanceof-2.js
index 38a35b7..603f2d5 100644
--- a/src/v8/test/mjsunit/compiler/optimized-instanceof-2.js
+++ b/src/v8/test/mjsunit/compiler/optimized-instanceof-2.js
@@ -8,6 +8,7 @@
 var f = new F
 
 function foo(x) { return x instanceof F };
+%PrepareFunctionForOptimization(foo);
 %OptimizeFunctionOnNextCall(foo);
 assertFalse(foo(1));
 
diff --git a/src/v8/test/mjsunit/compiler/optimized-int32array-length.js b/src/v8/test/mjsunit/compiler/optimized-int32array-length.js
index 00bf8d1..ba27f1d 100644
--- a/src/v8/test/mjsunit/compiler/optimized-int32array-length.js
+++ b/src/v8/test/mjsunit/compiler/optimized-int32array-length.js
@@ -6,6 +6,7 @@
 
 var a = new Int32Array(1);
 function len(a) { return a.length; }
+%PrepareFunctionForOptimization(len);
 assertEquals(1, len(a));
 assertEquals(1, len(a));
 %OptimizeFunctionOnNextCall(len);
diff --git a/src/v8/test/mjsunit/compiler/optimized-uint32array-length.js b/src/v8/test/mjsunit/compiler/optimized-uint32array-length.js
index 3a88ed7..3d2f432 100644
--- a/src/v8/test/mjsunit/compiler/optimized-uint32array-length.js
+++ b/src/v8/test/mjsunit/compiler/optimized-uint32array-length.js
@@ -6,6 +6,7 @@
 
 var a = new Uint32Array(1);
 function len(a) { return a.length; }
+%PrepareFunctionForOptimization(len);
 assertEquals(1, len(a));
 assertEquals(1, len(a));
 %OptimizeFunctionOnNextCall(len);
diff --git a/src/v8/test/mjsunit/compiler/optimized-with.js b/src/v8/test/mjsunit/compiler/optimized-with.js
index 9bc8713..dc03519 100644
--- a/src/v8/test/mjsunit/compiler/optimized-with.js
+++ b/src/v8/test/mjsunit/compiler/optimized-with.js
@@ -13,6 +13,7 @@
       return e
     }
   }
+  %PrepareFunctionForOptimization(f);
   assertEquals(23, f({ x:23 }));
   assertEquals(42, f({ x:42 }));
   assertInstanceof(f(null), TypeError);
diff --git a/src/v8/test/mjsunit/compiler/osr-alignment.js b/src/v8/test/mjsunit/compiler/osr-alignment.js
index f815e71..97a6535 100644
--- a/src/v8/test/mjsunit/compiler/osr-alignment.js
+++ b/src/v8/test/mjsunit/compiler/osr-alignment.js
@@ -66,6 +66,7 @@
 function test1() {
   var j = 11;
   for (var i = 0; i < 2; i++) {
+    %PrepareFunctionForOptimization(f1);
     assertEquals(509500, f1());
   }
 }
@@ -73,6 +74,7 @@
 function test2() {
   for (var i = 0; i < 2; i++) {
     var j = 11, k = 12;
+    %PrepareFunctionForOptimization(f2);
     assertEquals(509500, f2());
   }
 }
@@ -80,6 +82,7 @@
 function test3() {
   for (var i = 0; i < 2; i++) {
     var j = 11, k = 13, m = 14;
+    %PrepareFunctionForOptimization(f3);
     assertEquals(509500, f3());
   }
 }
diff --git a/src/v8/test/mjsunit/compiler/osr-arguments.js b/src/v8/test/mjsunit/compiler/osr-arguments.js
index 14a769f..68e5fea 100644
--- a/src/v8/test/mjsunit/compiler/osr-arguments.js
+++ b/src/v8/test/mjsunit/compiler/osr-arguments.js
@@ -13,5 +13,6 @@
   return sum;
 }
 
+%PrepareFunctionForOptimization(f1);
 let result = f1(1, 1, 2, 3);
 assertEquals(7000, result);
diff --git a/src/v8/test/mjsunit/compiler/osr-array-len.js b/src/v8/test/mjsunit/compiler/osr-array-len.js
index aaee860..2a1386d 100644
--- a/src/v8/test/mjsunit/compiler/osr-array-len.js
+++ b/src/v8/test/mjsunit/compiler/osr-array-len.js
@@ -12,11 +12,14 @@
     %OptimizeOsr();
     line[0] = n;
     n--;
+    %PrepareFunctionForOptimization(fastaRandom);
   }
 }
 
 print("---BEGIN 1");
+%PrepareFunctionForOptimization(fastaRandom);
 assertEquals(undefined, fastaRandom(6, null));
 print("---BEGIN 2");
+%PrepareFunctionForOptimization(fastaRandom);
 assertEquals(undefined, fastaRandom(6, null));
 print("---END");
diff --git a/src/v8/test/mjsunit/compiler/osr-assert.js b/src/v8/test/mjsunit/compiler/osr-assert.js
index 94b901f..5a0ff2e 100644
--- a/src/v8/test/mjsunit/compiler/osr-assert.js
+++ b/src/v8/test/mjsunit/compiler/osr-assert.js
@@ -25,17 +25,21 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --use-osr
+// Flags: --use-osr --allow-natives-syntax
 
 function f(x, b, c) {
-  var outer = 1000000;
+  var outer = 10;
   var a = 1;
   while (outer > 0) {
     a = a + 5;
     assertEquals(b + 1, c);
     outer--;
+    if (outer === 5) {
+      %OptimizeOsr();
+    }
   }
   return a + 4;
 }
 
-assertEquals(5000005, f(5, "122", "1221"));
+%PrepareFunctionForOptimization(f);
+assertEquals(55, f(5, "122", "1221"));
diff --git a/src/v8/test/mjsunit/compiler/osr-block-scope-func.js b/src/v8/test/mjsunit/compiler/osr-block-scope-func.js
index 7c41f54..c7107c7 100644
--- a/src/v8/test/mjsunit/compiler/osr-block-scope-func.js
+++ b/src/v8/test/mjsunit/compiler/osr-block-scope-func.js
@@ -22,6 +22,9 @@
   return result;
 }
 
+%PrepareFunctionForOptimization(foo);
 assertEquals(4950, foo()());
+%PrepareFunctionForOptimization(foo);
 assertEquals(4950, foo()());
+%PrepareFunctionForOptimization(foo);
 assertEquals(4950, foo()());
diff --git a/src/v8/test/mjsunit/compiler/osr-block-scope-id.js b/src/v8/test/mjsunit/compiler/osr-block-scope-id.js
index bcc7cdd..2d7f558 100644
--- a/src/v8/test/mjsunit/compiler/osr-block-scope-id.js
+++ b/src/v8/test/mjsunit/compiler/osr-block-scope-id.js
@@ -24,9 +24,11 @@
   result.push(out);
   return result;
 }
+%PrepareFunctionForOptimization(foo);
 
 
 function check() {
+  %PrepareFunctionForOptimization(foo);
   var r = foo();
   assertEquals(45, r.pop());
   for (var i = 9; i >= 0; i--) {
diff --git a/src/v8/test/mjsunit/compiler/osr-block-scope.js b/src/v8/test/mjsunit/compiler/osr-block-scope.js
index c60f8af..cb4a290 100644
--- a/src/v8/test/mjsunit/compiler/osr-block-scope.js
+++ b/src/v8/test/mjsunit/compiler/osr-block-scope.js
@@ -14,13 +14,21 @@
     body = body + "}"
   }
 
-  return body.replace(new RegExp("function " + name + "\\(\\) {"),
-                      "function " + name + "_" + x + "() {\n" + header);
+  // Replace function name
+  var new_func = body.replace(new RegExp("function " + name + "\\(\\) {"),
+                  "function " + name + "_" + x + "() {\n" + header);
+
+  // Replace PrepareForOptimize
+  return new_func.replace(new RegExp("%PrepareFunctionForOptimization\\(" + name + "\\);"),
+                  "%PrepareFunctionForOptimization(" + name + "_" + x + ");");
 }
 
 function test(expected, func, depth) {
+  %PrepareFunctionForOptimization(func);
   assertEquals(expected, func());
+  %PrepareFunctionForOptimization(func);
   assertEquals(expected, func());
+  %PrepareFunctionForOptimization(func);
   assertEquals(expected, func());
 
   var orig = func.toString();
@@ -29,8 +37,11 @@
     var body = nest(orig, name, depth);
     func = eval("(" + body + ")");
 
+    %PrepareFunctionForOptimization(func);
     assertEquals(expected, func());
+    %PrepareFunctionForOptimization(func);
     assertEquals(expected, func());
+    %PrepareFunctionForOptimization(func);
     assertEquals(expected, func());
   }
 }
@@ -42,11 +53,13 @@
     for (var i = 0; i < 10; i++) {
       %OptimizeOsr();
       sum += i;
+      %PrepareFunctionForOptimization(foo);
     }
     result = sum;
   }
   return result;
 }
+%PrepareFunctionForOptimization(foo);
 
 test(45, foo);
 
@@ -55,9 +68,11 @@
   for (var i = 0; i < 10; i++) {
     %OptimizeOsr();
     sum += i;
+    %PrepareFunctionForOptimization(bar);
   }
   return sum;
 }
+%PrepareFunctionForOptimization(bar);
 
 test(45, bar);
 
@@ -71,6 +86,7 @@
     return sum;
   }
 }
+%PrepareFunctionForOptimization(bon);
 
 test(45, bon);
 
@@ -83,10 +99,12 @@
       %OptimizeOsr();
       sum = i;
       i = i + 1 | 0;
+      %PrepareFunctionForOptimization(row);
     }
   }
   return 11;
 }
+%PrepareFunctionForOptimization(row);
 
 test(7, row);
 
@@ -95,9 +113,11 @@
   while (i < 2) {
     %OptimizeOsr();
     i++;
+    %PrepareFunctionForOptimization(nub);
   }
   return i;
 }
+%PrepareFunctionForOptimization(nub);
 
 test(2, nub);
 
@@ -109,8 +129,10 @@
     %OptimizeOsr();
     i++;
     result = x;
+    %PrepareFunctionForOptimization(kub);
   }
   return result;
 }
+%PrepareFunctionForOptimization(kub);
 
 test(1, kub);
diff --git a/src/v8/test/mjsunit/compiler/osr-for-let.js b/src/v8/test/mjsunit/compiler/osr-for-let.js
index b8cef78..024097b 100644
--- a/src/v8/test/mjsunit/compiler/osr-for-let.js
+++ b/src/v8/test/mjsunit/compiler/osr-for-let.js
@@ -7,8 +7,11 @@
 "use strict";
 
 function test(expected, func) {
+  %PrepareFunctionForOptimization(func);
   assertEquals(expected, func());
+  %PrepareFunctionForOptimization(func);
   assertEquals(expected, func());
+  %PrepareFunctionForOptimization(func);
   assertEquals(expected, func());
 }
 
@@ -24,12 +27,14 @@
   }
   return result;
 }
+%PrepareFunctionForOptimization(bar);
 
 test(4005, bar);
 
 function baz() {
   let sum = 0;
   for (let i = 0; i < 2; i++) {
+    %PrepareFunctionForOptimization(baz);
     sum = 2;
     %OptimizeOsr();
   }
@@ -41,6 +46,7 @@
 function qux() {
   var result = 0;
   for (let i = 0; i < 2; i++) {
+    %PrepareFunctionForOptimization(qux);
     result = i;
     %OptimizeOsr();
   }
@@ -53,6 +59,7 @@
   var result = 0;
   for (let i = 0; i < 2; i++) {
     {
+      %PrepareFunctionForOptimization(nux);
       let sum = i;
       %OptimizeOsr();
       result = sum;
@@ -78,5 +85,6 @@
   }
   return result;
 }
+%PrepareFunctionForOptimization(blo);
 
 test(4005, blo());
diff --git a/src/v8/test/mjsunit/compiler/osr-forin-nested.js b/src/v8/test/mjsunit/compiler/osr-forin-nested.js
index dd81089..a079457 100644
--- a/src/v8/test/mjsunit/compiler/osr-forin-nested.js
+++ b/src/v8/test/mjsunit/compiler/osr-forin-nested.js
@@ -14,10 +14,12 @@
   for (var x in t) {
     for (var i = 0; i < 2; i++) {
       %OptimizeOsr();
+      %PrepareFunctionForOptimization(foo);
     }
   }
   return 5;
 }
+%PrepareFunctionForOptimization(foo);
 
 test(5, foo, {x:20});
 
@@ -27,9 +29,11 @@
     for (var i = 0; i < 2; i++) {
       %OptimizeOsr();
       sum += t[x];
+      %PrepareFunctionForOptimization(bar);
     }
   }
   return sum;
 }
+%PrepareFunctionForOptimization(bar);
 
 test(62, bar, {x:20,y:11});
diff --git a/src/v8/test/mjsunit/compiler/osr-forin.js b/src/v8/test/mjsunit/compiler/osr-forin.js
index b45d200..2cc3ae2 100644
--- a/src/v8/test/mjsunit/compiler/osr-forin.js
+++ b/src/v8/test/mjsunit/compiler/osr-forin.js
@@ -16,11 +16,27 @@
   return sum;
 }
 
-var a = new Array(10000);
-for (var i = 0; i < 10000; i++) {
-  a[i] = (i * 999) % 77;
-}
+function test(a) {
+  for (var i = 0; i < 10000; i++) {
+    a[i] = (i * 999) % 77;
+  }
 
-for (var i = 0; i < 3; i++) {
-  assertEquals(480270, f(a));
+  for (var i = 0; i < 3; i++) {
+    console.log(f(a));
+    assertEquals(480270, f(a));
+  }
 }
+var a = new Array(10000);
+test(a);
+
+// Non-extensible
+var b =  Object.preventExtensions(a);
+test(b);
+
+// Sealed
+var c =  Object.seal(a);
+test(c);
+
+// Frozen
+var d =  Object.freeze(a);
+test(d);
diff --git a/src/v8/test/mjsunit/compiler/osr-forof.js b/src/v8/test/mjsunit/compiler/osr-forof.js
index ce7b24d..3481c95 100644
--- a/src/v8/test/mjsunit/compiler/osr-forof.js
+++ b/src/v8/test/mjsunit/compiler/osr-forof.js
@@ -15,15 +15,6 @@
   return sum;
 }
 
-var a = new Array(10000);
-for (var i = 0; i < 10000; i++) {
-  a[i] = (i * 999) % 77;
-}
-
-for (var i = 0; i < 3; i++) {
-  assertEquals(480270, f(wrap(a)));
-}
-
 function wrap(array) {
   var iterable = {};
   var i = 0;
@@ -33,3 +24,28 @@
   iterable[Symbol.iterator] = function() { return { next:next }; };
   return iterable;
 }
+
+function test(a) {
+  for (var i = 0; i < 10000; i++) {
+    a[i] = (i * 999) % 77;
+  }
+
+  for (var i = 0; i < 3; i++) {
+    assertEquals(480270, f(wrap(a)));
+  }
+}
+
+var a = new Array(10000);
+test(a);
+
+// Non-extensible
+var b =  Object.preventExtensions(a);
+test(b);
+
+// Sealed
+var c =  Object.seal(a);
+test(c);
+
+// Frozen
+var d =  Object.freeze(a);
+test(d);
diff --git a/src/v8/test/mjsunit/compiler/osr-infinite.js b/src/v8/test/mjsunit/compiler/osr-infinite.js
index 24c7add..51b3a3e 100644
--- a/src/v8/test/mjsunit/compiler/osr-infinite.js
+++ b/src/v8/test/mjsunit/compiler/osr-infinite.js
@@ -11,6 +11,7 @@
   if (x == 5)  %OptimizeOsr(1);
   if (x == 10) throw "terminate";
 }
+%PrepareFunctionForOptimization(thrower);
 
 %NeverOptimizeFunction(thrower);  // Don't want to inline the thrower.
 %NeverOptimizeFunction(test);     // Don't want to inline the func into test.
@@ -18,6 +19,7 @@
 function test(func) {
   for (var i = 0; i < 3; i++) {
     global_counter = 0;
+    %PrepareFunctionForOptimization(func);
     assertThrows(func);
   }
 }
@@ -25,18 +27,22 @@
 function n1() {
   while (true) thrower();
 }
+%PrepareFunctionForOptimization(n1);
 
 function n2() {
   while (true) while (true) thrower();
 }
+%PrepareFunctionForOptimization(n2);
 
 function n3() {
   while (true) while (true) while (true) thrower();
 }
+%PrepareFunctionForOptimization(n3);
 
 function n4() {
   while (true) while (true) while (true) while (true) thrower();
 }
+%PrepareFunctionForOptimization(n4);
 
 function b1(a) {
   while (true) {
@@ -44,6 +50,7 @@
     if (a) break
   }
 }
+%PrepareFunctionForOptimization(b1);
 
 
 function b2(a) {
@@ -54,6 +61,7 @@
     }
   }
 }
+%PrepareFunctionForOptimization(b2);
 
 
 function b3(a) {
@@ -67,6 +75,7 @@
     }
   }
 }
+%PrepareFunctionForOptimization(b3);
 
 
 test(n1);
diff --git a/src/v8/test/mjsunit/compiler/osr-labeled.js b/src/v8/test/mjsunit/compiler/osr-labeled.js
index 1384e9a..d566cd9 100644
--- a/src/v8/test/mjsunit/compiler/osr-labeled.js
+++ b/src/v8/test/mjsunit/compiler/osr-labeled.js
@@ -8,6 +8,7 @@
   var sum = 0;
   A: for (var i = 0; i < 5; i++) {
     B: for (var j = 0; j < 5; j++) {
+         %PrepareFunctionForOptimization(foo);
       C: for (var k = 0; k < 10; k++) {
         if (k === 5) %OptimizeOsr();
         if (k === 6) break B;
@@ -17,14 +18,16 @@
   }
   return sum;
 }
-
+%PrepareFunctionForOptimization(foo);
 assertEquals(30, foo());
+%PrepareFunctionForOptimization(foo);
 assertEquals(30, foo());
 
 function bar(a) {
   var sum = 0;
   A: for (var i = 0; i < 5; i++) {
     B: for (var j = 0; j < 5; j++) {
+         %PrepareFunctionForOptimization(bar);
       C: for (var k = 0; k < 10; k++) {
         sum++;
         %OptimizeOsr();
@@ -36,12 +39,17 @@
   }
   return sum;
 }
-
+%PrepareFunctionForOptimization(bar);
 assertEquals(1, bar(1));
+%PrepareFunctionForOptimization(bar);
 assertEquals(1, bar(1));
 
+%PrepareFunctionForOptimization(bar);
 assertEquals(5, bar(2));
+%PrepareFunctionForOptimization(bar);
 assertEquals(5, bar(2));
 
+%PrepareFunctionForOptimization(bar);
 assertEquals(25, bar(3));
+%PrepareFunctionForOptimization(bar);
 assertEquals(25, bar(3));
diff --git a/src/v8/test/mjsunit/compiler/osr-literals-adapted.js b/src/v8/test/mjsunit/compiler/osr-literals-adapted.js
index 4d1798c..f1f3174 100644
--- a/src/v8/test/mjsunit/compiler/osr-literals-adapted.js
+++ b/src/v8/test/mjsunit/compiler/osr-literals-adapted.js
@@ -8,37 +8,47 @@
   function f0() {
     for (var i = 0; i < 3; i = i + 1 | 0) {
       %OptimizeOsr();
+      %PrepareFunctionForOptimization(f0);
     }
     return {blah: i};
   }
+  %PrepareFunctionForOptimization(f0);
 
   function f1(a) {
     for (var i = 0; i < 3; i = i + 1 | 0) {
       %OptimizeOsr();
+      %PrepareFunctionForOptimization(f1);
     }
     return {blah: i};
   }
+  %PrepareFunctionForOptimization(f1);
 
   function f2(a,b) {
     for (var i = 0; i < 3; i = i + 1 | 0) {
       %OptimizeOsr();
+      %PrepareFunctionForOptimization(f2);
     }
     return {blah: i};
   }
+  %PrepareFunctionForOptimization(f2);
 
   function f3(a,b,c) {
     for (var i = 0; i < 3; i = i + 1 | 0) {
       %OptimizeOsr();
+      %PrepareFunctionForOptimization(f3);
     }
     return {blah: i};
   }
+  %PrepareFunctionForOptimization(f3);
 
   function f4(a,b,c,d) {
     for (var i = 0; i < 3; i = i + 1 | 0) {
       %OptimizeOsr();
+      %PrepareFunctionForOptimization(f4);
     }
     return {blah: i};
   }
+  %PrepareFunctionForOptimization(f4);
 
   function bar() {
     assertEquals(3, f0().blah);
diff --git a/src/v8/test/mjsunit/compiler/osr-literals.js b/src/v8/test/mjsunit/compiler/osr-literals.js
index f2051dc..9d609f1 100644
--- a/src/v8/test/mjsunit/compiler/osr-literals.js
+++ b/src/v8/test/mjsunit/compiler/osr-literals.js
@@ -8,37 +8,47 @@
   function f0() {
     for (var i = 0; i < 3; i = i + 1 | 0) {
       %OptimizeOsr();
+      %PrepareFunctionForOptimization(f0);
     }
     return {blah: i};
   }
+  %PrepareFunctionForOptimization(f0);
 
   function f1(a) {
     for (var i = 0; i < 3; i = i + 1 | 0) {
       %OptimizeOsr();
+      %PrepareFunctionForOptimization(f1);
     }
     return {blah: i};
   }
+  %PrepareFunctionForOptimization(f1);
 
   function f2(a,b) {
     for (var i = 0; i < 3; i = i + 1 | 0) {
       %OptimizeOsr();
+      %PrepareFunctionForOptimization(f2);
     }
     return {blah: i};
   }
+  %PrepareFunctionForOptimization(f2);
 
   function f3(a,b,c) {
     for (var i = 0; i < 3; i = i + 1 | 0) {
       %OptimizeOsr();
+      %PrepareFunctionForOptimization(f3);
     }
     return {blah: i};
   }
+  %PrepareFunctionForOptimization(f3);
 
   function f4(a,b,c,d) {
     for (var i = 0; i < 3; i = i + 1 | 0) {
       %OptimizeOsr();
+      %PrepareFunctionForOptimization(f4);
     }
     return {blah: i};
   }
+  %PrepareFunctionForOptimization(f4);
 
   function bar() {
     assertEquals(3, f0().blah);
diff --git a/src/v8/test/mjsunit/compiler/osr-manual1.js b/src/v8/test/mjsunit/compiler/osr-manual1.js
index c3db796..e98d84c 100644
--- a/src/v8/test/mjsunit/compiler/osr-manual1.js
+++ b/src/v8/test/mjsunit/compiler/osr-manual1.js
@@ -9,7 +9,7 @@
 function gen(w) {  // defeat compiler cache.
  var num = counter++;
   var Z = [ "", "", "", ];
-  Z[w] = "%OptimizeOsr()";
+  Z[w] = "%OptimizeOsr(); %PrepareFunctionForOptimization(f" + num + ")";
   var src =
     "function f" + num + "(a,b,c) {" +
     "  var x = 0;" +
@@ -22,10 +22,12 @@
     "} f" + num;
   return eval(src);
 }
+%PrepareFunctionForOptimization(gen);
 
 function check(x,a,b,c) {
   for (var i = 0; i < 3; i++) {
     var f = gen(i);
+    %PrepareFunctionForOptimization(f);
     assertEquals(x, f(a, b, c));
   }
 }
diff --git a/src/v8/test/mjsunit/compiler/osr-manual2.js b/src/v8/test/mjsunit/compiler/osr-manual2.js
index de7ec24..f4a8a66 100644
--- a/src/v8/test/mjsunit/compiler/osr-manual2.js
+++ b/src/v8/test/mjsunit/compiler/osr-manual2.js
@@ -9,7 +9,7 @@
 function gen(w) {  // defeat compiler cache.
  var num = counter++;
   var Z = [ "", "", "", ];
-  Z[w] = "%OptimizeOsr()";
+  Z[w] = "%OptimizeOsr(); %PrepareFunctionForOptimization(f" + num + ")";
   var src =
     "function f" + num + "(a,b,c) {" +
     "  var x = 0;" +
@@ -26,6 +26,7 @@
 function check(x,a,b,c) {
   for (var i = 0; i < 3; i++) {
     var f = gen(i);
+    %PrepareFunctionForOptimization(f);
     assertEquals(x, f(a, b, c));
   }
 }
diff --git a/src/v8/test/mjsunit/compiler/osr-maze1.js b/src/v8/test/mjsunit/compiler/osr-maze1.js
index da17282..b2b105d 100644
--- a/src/v8/test/mjsunit/compiler/osr-maze1.js
+++ b/src/v8/test/mjsunit/compiler/osr-maze1.js
@@ -8,35 +8,44 @@
   var count = 0;
   var sum = 11;
   var i = 35;
+  %PrepareFunctionForOptimization(bar);
   while (i-- > 33) {
     if (count++ == goal) %OptimizeOsr();
     sum = sum + i;
   }
+  %PrepareFunctionForOptimization(bar);
   while (i-- > 31) {
     if (count++ == goal) %OptimizeOsr();
     j = 9;
+    %PrepareFunctionForOptimization(bar);
     while (j-- > 7) {
       if (count++ == goal) %OptimizeOsr();
       sum = sum + j * 3;
     }
+    %PrepareFunctionForOptimization(bar);
     while (j-- > 5) {
       if (count++ == goal) %OptimizeOsr();
       sum = sum + j * 5;
     }
   }
   while (i-- > 29) {
+    %PrepareFunctionForOptimization(bar);
     if (count++ == goal) %OptimizeOsr();
     while (j-- > 3) {
       var k = 10;
+      %PrepareFunctionForOptimization(bar);
       if (count++ == goal) %OptimizeOsr();
       while (k-- > 8) {
+        %PrepareFunctionForOptimization(bar);
         if (count++ == goal) %OptimizeOsr();
         sum = sum + k * 11;
       }
     }
     while (j-- > 1) {
+      %PrepareFunctionForOptimization(bar);
       if (count++ == goal) %OptimizeOsr();
       while (k-- > 6) {
+        %PrepareFunctionForOptimization(bar);
         if (count++ == goal) %OptimizeOsr();
         sum = sum + j * 13;
       }
@@ -44,6 +53,7 @@
   }
   return sum;
 }
+%PrepareFunctionForOptimization(bar);
 
 for (var i = 0; i < 13; i++) {
   %DeoptimizeFunction(bar);
diff --git a/src/v8/test/mjsunit/compiler/osr-maze2.js b/src/v8/test/mjsunit/compiler/osr-maze2.js
index 1fc1cd2..1dbefe1 100644
--- a/src/v8/test/mjsunit/compiler/osr-maze2.js
+++ b/src/v8/test/mjsunit/compiler/osr-maze2.js
@@ -51,7 +51,7 @@
   body = body.replace(new RegExp("bar"), "bar" + i);
   for (var j = 1; j < 10; j++) {
     var r = new RegExp("LOOP" + j + "\\(\\);");
-    if (i == j) body = body.replace(r, "%OptimizeOsr();");
+    if (i == j) body = body.replace(r, "%OptimizeOsr(); %PrepareFunctionForOptimization(bar" + i +");");
     else body = body.replace(r, "");
   }
   return eval("(" + body + ")");
@@ -59,5 +59,6 @@
 
 for (var i = 1; i < 10; i++) {
   var f = gen(i);
+  %PrepareFunctionForOptimization(f);
   assertEquals(1979, f());
 }
diff --git a/src/v8/test/mjsunit/compiler/osr-nested.js b/src/v8/test/mjsunit/compiler/osr-nested.js
index 4bdb082..9775f65 100644
--- a/src/v8/test/mjsunit/compiler/osr-nested.js
+++ b/src/v8/test/mjsunit/compiler/osr-nested.js
@@ -25,22 +25,25 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --use-osr
+// Flags: --use-osr --allow-natives-syntax
 
 function f() {
   var sum = 0;
   for (var i = 0; i < 10; i++) {
-    for (var j = 0; j < 100000; j++) {
+    %PrepareFunctionForOptimization(f);
+    for (var j = 0; j < 10; j++) {
       var x = i + 2;
       var y = x + 5;
       var z = y + 3;
       sum += z;
+      if (j == 5) %OptimizeOsr();
     }
   }
   return sum;
 }
+%PrepareFunctionForOptimization(f);
 
 
-assertEquals(14500000, f());
-assertEquals(14500000, f());
-assertEquals(14500000, f());
+assertEquals(1450, f());
+assertEquals(1450, f());
+assertEquals(1450, f());
diff --git a/src/v8/test/mjsunit/compiler/osr-nested2b.js b/src/v8/test/mjsunit/compiler/osr-nested2b.js
index 1808811..390979d 100644
--- a/src/v8/test/mjsunit/compiler/osr-nested2b.js
+++ b/src/v8/test/mjsunit/compiler/osr-nested2b.js
@@ -19,7 +19,7 @@
   return sum;
 }
 
-
+%PrepareFunctionForOptimization(f);
 assertEquals(15000, f());
 assertEquals(15000, f());
 assertEquals(15000, f());
diff --git a/src/v8/test/mjsunit/compiler/osr-one.js b/src/v8/test/mjsunit/compiler/osr-one.js
index 2c27192..3b38715 100644
--- a/src/v8/test/mjsunit/compiler/osr-one.js
+++ b/src/v8/test/mjsunit/compiler/osr-one.js
@@ -1,40 +1,21 @@
 // Copyright 2013 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
 
-// Flags: --use-osr
+// Flags: --use-osr --allow-natives-syntax
 
 function f(x) {
   var sum = 0;
-  var count = 10000000;
+  var count = 10;
   while (count > 0) {
     sum += x;
     count--;
+    if (count == 5) {
+      %OptimizeOsr();
+    }
   }
   return sum;
 }
+%PrepareFunctionForOptimization(f);
 
-assertEquals(50000000, f(5));
+assertEquals(50, f(5));
diff --git a/src/v8/test/mjsunit/compiler/osr-regex-id.js b/src/v8/test/mjsunit/compiler/osr-regex-id.js
index e0b4dad..243a780 100644
--- a/src/v8/test/mjsunit/compiler/osr-regex-id.js
+++ b/src/v8/test/mjsunit/compiler/osr-regex-id.js
@@ -10,41 +10,52 @@
   var r = /\0/;
   for (var i = 0; i < 10; i++) {
     if (a) %OptimizeOsr();
+    %PrepareFunctionForOptimization(foo);
   }
   return r;
 }
+%PrepareFunctionForOptimization(foo);
 
 function bar(a) {
   for (var i = 0; i < 10; i++) {
     if (a) %OptimizeOsr();
+    %PrepareFunctionForOptimization(bar);
     var r = /\0/;
   }
   return r;
 }
+%PrepareFunctionForOptimization(bar);
 
 function baz(a) {
   for (var i = 0; i < 10; i++) {
     if (a) %OptimizeOsr();
+    %PrepareFunctionForOptimization(baz);
   }
   return /\0/;
 }
+%PrepareFunctionForOptimization(baz);
 
 function qux(a) {
   for (var i = 0; i < 10; i++) {
     if (i > 5 && a) {
       %OptimizeOsr();
+      %PrepareFunctionForOptimization(qux);
     } else {
       var r = /\0/;
     }
   }
   return r;
 }
+%PrepareFunctionForOptimization(qux);
 
 function test(f) {
   // Test the reference equality of regex's created in OSR'd function.
   var x = f(false);
+  %PrepareFunctionForOptimization(f);
   assertEquals(x, f(true));
+  %PrepareFunctionForOptimization(f);
   assertEquals(x, f(true));
+  %PrepareFunctionForOptimization(f);
   assertEquals(x, f(true));
 }
 
diff --git a/src/v8/test/mjsunit/compiler/osr-sar.js b/src/v8/test/mjsunit/compiler/osr-sar.js
index 02684f0..66e8809 100644
--- a/src/v8/test/mjsunit/compiler/osr-sar.js
+++ b/src/v8/test/mjsunit/compiler/osr-sar.js
@@ -39,6 +39,7 @@
   }
 
   var K3 = 0x80000000;
+  %PrepareFunctionForOptimization(SarShr);
   assertEquals(-2, SarShr(K3 | 0));
   assertEquals(-2, SarShr(K3 | 0));
   %OptimizeFunctionOnNextCall(SarShr);
diff --git a/src/v8/test/mjsunit/compiler/osr-simple.js b/src/v8/test/mjsunit/compiler/osr-simple.js
index ddbc5f8..c26cfe3 100644
--- a/src/v8/test/mjsunit/compiler/osr-simple.js
+++ b/src/v8/test/mjsunit/compiler/osr-simple.js
@@ -18,5 +18,6 @@
 
 
 for (var i = 0; i < 2; i++) {
+  %PrepareFunctionForOptimization(f);
   assertEquals(509500, f());
 }
diff --git a/src/v8/test/mjsunit/compiler/osr-top1.js b/src/v8/test/mjsunit/compiler/osr-top1.js
index 742b71d..6f0fac6 100644
--- a/src/v8/test/mjsunit/compiler/osr-top1.js
+++ b/src/v8/test/mjsunit/compiler/osr-top1.js
@@ -4,13 +4,17 @@
 
 // Flags: --use-osr --allow-natives-syntax
 
-var sum = 0;
-for (var i = 0; i < 10000; i++) {
-  if (i == 100) %OptimizeOsr();
-  var x = i + 2;
-  var y = x + 5;
-  var z = y + 3;
-  sum += z;
-}
+function f() {
+  var sum = 0;
+  for (var i = 0; i < 10000; i++) {
+    if (i == 100) %OptimizeOsr();
+    var x = i + 2;
+    var y = x + 5;
+    var z = y + 3;
+    sum += z;
+  }
 
-assertEquals(50095000, sum);
+  assertEquals(50095000, sum);
+}
+%PrepareFunctionForOptimization(f);
+f();
diff --git a/src/v8/test/mjsunit/compiler/osr-top2.js b/src/v8/test/mjsunit/compiler/osr-top2.js
index a15aa15..8bf7fc0 100644
--- a/src/v8/test/mjsunit/compiler/osr-top2.js
+++ b/src/v8/test/mjsunit/compiler/osr-top2.js
@@ -4,16 +4,21 @@
 
 // Flags: --use-osr --allow-natives-syntax
 
-for (var j = 0; j < 3; j++) {
-  var sum = 0;
-  for (var i = 0; i < 1000; i++) {
-    if (i == 100) %OptimizeOsr();
-    var x = i + 2;
-    var y = x + 5;
-    var z = y + 3;
-    sum += z;
+function f() {
+  for (var j = 0; j < 3; j++) {
+    var sum = 0;
+    for (var i = 0; i < 1000; i++) {
+      if (i == 100) %OptimizeOsr();
+      var x = i + 2;
+      var y = x + 5;
+      var z = y + 3;
+      sum += z;
+    }
+    assertEquals(509500, sum);
+    %PrepareFunctionForOptimization(f);
   }
+
   assertEquals(509500, sum);
 }
-
-assertEquals(509500, sum);
+%PrepareFunctionForOptimization(f);
+f();
diff --git a/src/v8/test/mjsunit/compiler/osr-top3.js b/src/v8/test/mjsunit/compiler/osr-top3.js
index 4c4a364..3bf89e2 100644
--- a/src/v8/test/mjsunit/compiler/osr-top3.js
+++ b/src/v8/test/mjsunit/compiler/osr-top3.js
@@ -4,19 +4,24 @@
 
 // Flags: --use-osr --allow-natives-syntax
 
-for (var k = 0; k < 2; k++) {
-  for (var j = 0; j < 3; j++) {
-    var sum = 0;
-    for (var i = 0; i < 1000; i++) {
-      if (i == 100) %OptimizeOsr();
-      var x = i + 2;
-      var y = x + 5;
-      var z = y + 3;
-      sum += z;
+function f() {
+  for (var k = 0; k < 2; k++) {
+    for (var j = 0; j < 3; j++) {
+      var sum = 0;
+      for (var i = 0; i < 1000; i++) {
+        if (i == 100) %OptimizeOsr();
+        var x = i + 2;
+        var y = x + 5;
+        var z = y + 3;
+        sum += z;
+      }
+      assertEquals(509500, sum);
+      %PrepareFunctionForOptimization(f);
     }
     assertEquals(509500, sum);
   }
+
   assertEquals(509500, sum);
 }
-
-assertEquals(509500, sum);
+%PrepareFunctionForOptimization(f);
+f();
diff --git a/src/v8/test/mjsunit/compiler/osr-try-catch.js b/src/v8/test/mjsunit/compiler/osr-try-catch.js
index 9924e88..d641a4e 100644
--- a/src/v8/test/mjsunit/compiler/osr-try-catch.js
+++ b/src/v8/test/mjsunit/compiler/osr-try-catch.js
@@ -16,9 +16,11 @@
     catch(e) {}
     for (var b = 0; b < 1; b++) {
       %OptimizeOsr();
+      %PrepareFunctionForOptimization(SingleLoop);
     }
   }
 }
+%PrepareFunctionForOptimization(SingleLoop);
 
 
 // These function could also fail if the exception handlers are not updated at
@@ -36,8 +38,10 @@
 
     if (a == 1) break;
     a++;
+    %PrepareFunctionForOptimization(EmptyBody);
   }
 }
+%PrepareFunctionForOptimization(EmptyBody);
 
 function NestedLoops() {
   for (var a = 0; a < 2; a++) {
@@ -50,8 +54,10 @@
       if (b == 1) break;
       b++;
     }
+    %PrepareFunctionForOptimization(NestedLoops);
   }
 }
+%PrepareFunctionForOptimization(NestedLoops);
 
 
 SingleLoop();
diff --git a/src/v8/test/mjsunit/compiler/osr-two.js b/src/v8/test/mjsunit/compiler/osr-two.js
index 8ac4c2c..6469c1a 100644
--- a/src/v8/test/mjsunit/compiler/osr-two.js
+++ b/src/v8/test/mjsunit/compiler/osr-two.js
@@ -1,44 +1,26 @@
 // Copyright 2013 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
 
-// Flags: --use-osr
+// Flags: --use-osr --allow-natives-syntax
 
 function f(x) {
   var sum = 0;
-  var outer = 100;
+  var outer = 10;
   while (outer > 0) {
-    var inner = 100000;
+    var inner = 10;
     while (inner > 0) {
       sum += x;
       inner--;
+      if (inner == 5) {
+        %OptimizeOsr();
+      }
     }
     outer--;
+    %PrepareFunctionForOptimization(f);
   }
   return sum;
 }
+%PrepareFunctionForOptimization(f);
 
-assertEquals(50000000, f(5));
+assertEquals(500, f(5));
diff --git a/src/v8/test/mjsunit/compiler/osr-while-let.js b/src/v8/test/mjsunit/compiler/osr-while-let.js
index 11ebc4b..eefde50 100644
--- a/src/v8/test/mjsunit/compiler/osr-while-let.js
+++ b/src/v8/test/mjsunit/compiler/osr-while-let.js
@@ -26,6 +26,7 @@
       for (; flag == 1; (flag = 0, temp_x = x)) {
         if (x < 2) {
           result = x; %OptimizeOsr();
+          %PrepareFunctionForOptimization(foo);
         } else {
           break outer;
         }
@@ -35,6 +36,7 @@
   }
   return result;
 }
+%PrepareFunctionForOptimization(foo);
 
 test(1, foo);
 
@@ -47,6 +49,7 @@
       let y = x;
       for (var i = 0; i < 5; i++) {
         %OptimizeOsr();
+        %PrepareFunctionForOptimization(smo);
         if (i) break outer;
         else result = y;
       }
@@ -54,5 +57,6 @@
   }
   return result;
 }
+%PrepareFunctionForOptimization(smo);
 
 test(11, smo);
diff --git a/src/v8/test/mjsunit/compiler/phi-representations.js b/src/v8/test/mjsunit/compiler/phi-representations.js
index 6d11bb0..5598d7c 100644
--- a/src/v8/test/mjsunit/compiler/phi-representations.js
+++ b/src/v8/test/mjsunit/compiler/phi-representations.js
@@ -36,6 +36,7 @@
   return (r - r);
 }
 
+%PrepareFunctionForOptimization(ar);
 assertEquals(0, ar());
 assertEquals(0, ar());
 %OptimizeFunctionOnNextCall(ar);
@@ -50,6 +51,7 @@
   return (r - r);
 }
 
+%PrepareFunctionForOptimization(ar2);
 assertEquals(0, ar2());
 assertEquals(0, ar2());
 %OptimizeFunctionOnNextCall(ar2);
diff --git a/src/v8/test/mjsunit/compiler/pic.js b/src/v8/test/mjsunit/compiler/pic.js
index f5b136c..e85e6ef 100644
--- a/src/v8/test/mjsunit/compiler/pic.js
+++ b/src/v8/test/mjsunit/compiler/pic.js
@@ -47,6 +47,8 @@
   assertEquals(99, CallF(o));
 }
 
+%PrepareFunctionForOptimization(Test);
+
 // Create a bunch of objects with different layouts.
 var o1 = { x: 0, y: 1 };
 var o2 = { y: 1, x: 0 };
diff --git a/src/v8/test/mjsunit/compiler/polymorphic-symbols.js b/src/v8/test/mjsunit/compiler/polymorphic-symbols.js
index e954d50..72d42c3 100644
--- a/src/v8/test/mjsunit/compiler/polymorphic-symbols.js
+++ b/src/v8/test/mjsunit/compiler/polymorphic-symbols.js
@@ -13,6 +13,7 @@
     {[symbol]: 3, d: 4}
   ];
   function foo(o) { return o[symbol]; }
+  %PrepareFunctionForOptimization(foo);
   for (let i = 0; i < OBJS.length; ++i) {
     assertEquals(i, foo(OBJS[i]));
     assertEquals(i, foo(OBJS[i]));
@@ -33,6 +34,7 @@
     {[symbol]: 3, d: 4}
   ];
   function foo(o) { o[symbol] = o; }
+  %PrepareFunctionForOptimization(foo);
   for (let i = 0; i < OBJS.length; ++i) {
     foo(OBJS[i]);
     foo(OBJS[i]);
diff --git a/src/v8/test/mjsunit/compiler/promise-capability-default-closures.js b/src/v8/test/mjsunit/compiler/promise-capability-default-closures.js
new file mode 100644
index 0000000..3208e54
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/promise-capability-default-closures.js
@@ -0,0 +1,51 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+  var resolve, value;
+  (new Promise(r => resolve = r)).then(v => value = v);
+  function foo() { resolve(1); }
+  %PrepareFunctionForOptimization(foo);
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+  setTimeout(_ => assertEquals(1, value));
+})();
+
+(function() {
+  var reject, value;
+  (new Promise((_, r) => reject = r)).catch(v => value = v);
+  function foo() { reject(1); }
+  %PrepareFunctionForOptimization(foo);
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+  setTimeout(_ => assertEquals(1, value));
+})();
+
+(function() {
+  var value;
+  function foo(x) { return new Promise((resolve, reject) => resolve(x)); }
+  %PrepareFunctionForOptimization(foo);
+  foo(1);
+  foo(1);
+  %OptimizeFunctionOnNextCall(foo);
+  foo(1).then(v => value = v);
+  setTimeout(_ => assertEquals(1, value));
+})();
+
+(function() {
+  var value;
+  function foo(x) { return new Promise((resolve, reject) => reject(x)); }
+  %PrepareFunctionForOptimization(foo);
+  foo(1);
+  foo(1);
+  %OptimizeFunctionOnNextCall(foo);
+  foo(1).catch(v => value = v);
+  setTimeout(_ => assertEquals(1, value));
+})();
diff --git a/src/v8/test/mjsunit/compiler/promise-constructor.js b/src/v8/test/mjsunit/compiler/promise-constructor.js
new file mode 100644
index 0000000..ab2d720
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/promise-constructor.js
@@ -0,0 +1,235 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --experimental-inline-promise-constructor
+
+// We have to patch mjsunit because normal assertion failures just throw
+// exceptions which are swallowed in a then clause.
+failWithMessage = (msg) => %AbortJS(msg);
+
+// Don't crash.
+(function() {
+  function foo() {
+    let resolve, reject, promise;
+    promise = new Promise((a, b) => { resolve = a; reject = b; });
+
+    return {resolve, reject, promise};
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+})();
+
+// Check that when executor is non-callable, the constructor throws.
+(function() {
+  function foo() {
+    return new Promise(1);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertThrows(foo, TypeError);
+  assertThrows(foo, TypeError);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(foo, TypeError);
+})();
+
+// Check that when the promise constructor throws because the executor is
+// non-callable, the stack contains 'new Promise'.
+(function() {
+  function foo() {
+    return new Promise(1);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  let threw;
+  try {
+    threw = false;
+    foo();
+  } catch (e) {
+    threw = true;
+    assertContains('new Promise', e.stack);
+  } finally {
+    assertTrue(threw);
+  }
+  try {
+    threw = false;
+    foo();
+  } catch (e) {
+    threw = true;
+    assertContains('new Promise', e.stack);
+  } finally {
+    assertTrue(threw);
+  }
+
+  %OptimizeFunctionOnNextCall(foo);
+  try {
+    threw = false;
+    foo();
+  } catch (e) {
+    threw = true;
+    assertContains('new Promise', e.stack);
+  } finally {
+    assertTrue(threw);
+  }
+})();
+
+// Check that when executor throws, the promise is rejected.
+(function() {
+  function foo() {
+    return new Promise((a, b) => { throw new Error(); });
+  }
+  %PrepareFunctionForOptimization(foo);
+
+  function bar(i) {
+    let error = null;
+    foo().then(_ => error = 1, e => error = e);
+    setTimeout(_ => assertInstanceof(error, Error));
+    if (i == 1) %OptimizeFunctionOnNextCall(foo);
+    if (i > 0) setTimeout(bar.bind(null, i - 1));
+    }
+  bar(3);
+})();
+
+// Check that when executor causes lazy deoptimization of the inlined
+// constructor, we return the promise value and not the return value of the
+// executor function itself.
+(function() {
+  function foo() {
+    let p;
+    try {
+      p = new Promise((a, b) => { %DeoptimizeFunction(foo); });
+    } catch (e) {
+      // Nothing should throw
+      assertUnreachable();
+    }
+    assertInstanceof(p, Promise);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+})();
+
+// The same as above, except that the executor function also creates a promise
+// and both executor functions cause a lazy deopt of the calling function.
+(function() {
+  function executor(a, b) {
+    %DeoptimizeFunction(foo);
+    let p = new Promise((a, b) => { %DeoptimizeFunction(executor); });
+  }
+  function foo() {
+    let p;
+    try {
+      p = new Promise(executor);
+    } catch (e) {
+      // Nothing should throw
+      assertUnreachable();
+    }
+    assertInstanceof(p, Promise);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+})();
+
+// Check that when the executor causes lazy deoptimization of the inlined
+// constructor, and then throws, the deopt continuation catches and then calls
+// the reject function instead of propagating the exception.
+(function() {
+  function foo() {
+    let p;
+    try {
+      p = new Promise((a, b) => {
+        %DeoptimizeFunction(foo);
+        throw new Error();
+      });
+    } catch (e) {
+      // The promise constructor should catch the exception and reject the
+      // promise instead.
+      assertUnreachable();
+    }
+    assertInstanceof(p, Promise);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+})();
+
+
+// Check that when the promise constructor is marked for lazy deoptimization
+// from below, but not immediatelly deoptimized, and then throws, the deopt continuation
+// catches and calls the reject function instead of propagating the exception.
+(function() {
+  function foo() {
+    let p;
+    try {
+      p = new Promise((resolve, reject) => { bar(); resolve()});
+    } catch (e) {
+       // The promise constructor should catch the exception and reject the
+      // promise instead.
+      assertUnreachable();
+    }
+    assertInstanceof(p, Promise);
+  }
+
+  function bar() {
+    %DeoptimizeFunction(foo);
+    throw new Error();
+  }
+  %NeverOptimizeFunction(bar);
+
+  %PrepareFunctionForOptimization(foo);
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+})();
+
+// Test when the executor is not inlined.
+(function() {
+  let resolve, reject, promise;
+  function bar(a, b) {
+    resolve = a; reject = b;
+    throw new Error();
+  }
+  function foo() {
+    promise = new Promise(bar);
+  }
+  %PrepareFunctionForOptimization(foo);
+  foo();
+  foo();
+  %NeverOptimizeFunction(bar);
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+})();
+
+// Test that the stack trace contains 'new Promise'
+(function() {
+  let resolve, reject, promise;
+  function bar(a, b) {
+    resolve = a; reject = b;
+    let stack = new Error().stack;
+    assertContains("new Promise", stack);
+    throw new Error();
+  }
+  function foo() {
+    promise = new Promise(bar);
+  }
+  %PrepareFunctionForOptimization(foo);
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+})();
diff --git a/src/v8/test/mjsunit/compiler/promise-prototype-catch-custom-then-1.js b/src/v8/test/mjsunit/compiler/promise-prototype-catch-custom-then-1.js
new file mode 100644
index 0000000..5dcacc4
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/promise-prototype-catch-custom-then-1.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(p) { return p.catch(x => x); }
+
+const a = Promise.resolve(1);
+
+%PrepareFunctionForOptimization(foo);
+foo(a);
+foo(a);
+%OptimizeFunctionOnNextCall(foo);
+foo(a);
+
+let custom_then_called = false;
+a.__proto__.then = function() { custom_then_called = true; }
+foo(a);
+assertTrue(custom_then_called);
diff --git a/src/v8/test/mjsunit/compiler/promise-prototype-catch-custom-then-2.js b/src/v8/test/mjsunit/compiler/promise-prototype-catch-custom-then-2.js
new file mode 100644
index 0000000..3281c69
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/promise-prototype-catch-custom-then-2.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(p) { return p.catch(x => x); }
+
+const a = Promise.resolve(1);
+
+%PrepareFunctionForOptimization(foo);
+foo(a);
+foo(a);
+%OptimizeFunctionOnNextCall(foo);
+foo(a);
+
+let custom_then_called = false;
+a.then = function() { custom_then_called = true; }
+foo(a);
+assertTrue(custom_then_called);
diff --git a/src/v8/test/mjsunit/compiler/promise-prototype-catch-subclass.js b/src/v8/test/mjsunit/compiler/promise-prototype-catch-subclass.js
new file mode 100644
index 0000000..2d37f2b
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/promise-prototype-catch-subclass.js
@@ -0,0 +1,28 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+let custom_then_called = false;
+
+function foo(p) {
+  custom_then_called = false;
+  p.catch(x => x);
+  return custom_then_called;
+}
+
+class MyPromise extends Promise {
+  then(onFulfilled, onRejected) {
+    custom_then_called = true;
+    return super.then(onFulfilled, onRejected);
+  }
+}
+
+const a = MyPromise.resolve(1);
+
+%PrepareFunctionForOptimization(foo);
+assertTrue(foo(a));
+assertTrue(foo(a));
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo(a));
diff --git a/src/v8/test/mjsunit/compiler/promise-prototype-catch.js b/src/v8/test/mjsunit/compiler/promise-prototype-catch.js
new file mode 100644
index 0000000..5d8080b
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/promise-prototype-catch.js
@@ -0,0 +1,32 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+  function foo(p) { return p.catch(); }
+  %PrepareFunctionForOptimization(foo);
+  foo(Promise.resolve(1));
+  foo(Promise.resolve(1));
+  %OptimizeFunctionOnNextCall(foo);
+  foo(Promise.resolve(1));
+})();
+
+(function() {
+  function foo(p) { return p.catch(foo); }
+  %PrepareFunctionForOptimization(foo);
+  foo(Promise.resolve(1));
+  foo(Promise.resolve(1));
+  %OptimizeFunctionOnNextCall(foo);
+  foo(Promise.resolve(1));
+})();
+
+(function() {
+  function foo(p) { return p.catch(foo, undefined); }
+  %PrepareFunctionForOptimization(foo);
+  foo(Promise.resolve(1));
+  foo(Promise.resolve(1));
+  %OptimizeFunctionOnNextCall(foo);
+  foo(Promise.resolve(1));
+})();
diff --git a/src/v8/test/mjsunit/compiler/promise-prototype-finally-custom-then-1.js b/src/v8/test/mjsunit/compiler/promise-prototype-finally-custom-then-1.js
new file mode 100644
index 0000000..ff469d4
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/promise-prototype-finally-custom-then-1.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(p) { return p.finally(x => x); }
+
+const a = Promise.resolve(1);
+
+%PrepareFunctionForOptimization(foo);
+foo(a);
+foo(a);
+%OptimizeFunctionOnNextCall(foo);
+foo(a);
+
+let custom_then_called = false;
+a.__proto__.then = function() { custom_then_called = true; }
+foo(a);
+assertTrue(custom_then_called);
diff --git a/src/v8/test/mjsunit/compiler/promise-prototype-finally-custom-then-2.js b/src/v8/test/mjsunit/compiler/promise-prototype-finally-custom-then-2.js
new file mode 100644
index 0000000..493539e
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/promise-prototype-finally-custom-then-2.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(p) { return p.finally(x => x); }
+
+const a = Promise.resolve(1);
+
+%PrepareFunctionForOptimization(foo);
+foo(a);
+foo(a);
+%OptimizeFunctionOnNextCall(foo);
+foo(a);
+
+let custom_then_called = false;
+a.then = function() { custom_then_called = true; }
+foo(a);
+assertTrue(custom_then_called);
diff --git a/src/v8/test/mjsunit/compiler/promise-prototype-finally-subclass.js b/src/v8/test/mjsunit/compiler/promise-prototype-finally-subclass.js
new file mode 100644
index 0000000..7a1fd9c
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/promise-prototype-finally-subclass.js
@@ -0,0 +1,28 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+let custom_then_called = false;
+
+function foo(p) {
+  custom_then_called = false;
+  p.finally(x => x);
+  return custom_then_called;
+}
+
+class MyPromise extends Promise {
+  then(onFulfilled, onRejected) {
+    custom_then_called = true;
+    return super.then(onFulfilled, onRejected);
+  }
+}
+
+const a = MyPromise.resolve(1);
+
+%PrepareFunctionForOptimization(foo);
+assertTrue(foo(a));
+assertTrue(foo(a));
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo(a));
diff --git a/src/v8/test/mjsunit/compiler/promise-prototype-finally.js b/src/v8/test/mjsunit/compiler/promise-prototype-finally.js
new file mode 100644
index 0000000..64af086
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/promise-prototype-finally.js
@@ -0,0 +1,45 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+  const p = Promise.resolve(1);
+  function foo(p) { return p.finally(); }
+  %PrepareFunctionForOptimization(foo);
+  foo(p);
+  foo(p);
+  %OptimizeFunctionOnNextCall(foo);
+  foo(p);
+})();
+
+(function() {
+  const p = Promise.resolve(1);
+  function foo(p) { return p.finally(x => x); }
+  %PrepareFunctionForOptimization(foo);
+  foo(p);
+  foo(p);
+  %OptimizeFunctionOnNextCall(foo);
+  foo(p);
+})();
+
+(function() {
+  const p = Promise.resolve(1);
+  function foo(p, f) { return p.finally(f); }
+  %PrepareFunctionForOptimization(foo);
+  foo(p, x => x);
+  foo(p, x => x);
+  %OptimizeFunctionOnNextCall(foo);
+  foo(p, x => x);
+})();
+
+(function() {
+  const p = Promise.resolve(1);
+  function foo(p, f) { return p.finally(f).finally(f); }
+  %PrepareFunctionForOptimization(foo);
+  foo(p, x => x);
+  foo(p, x => x);
+  %OptimizeFunctionOnNextCall(foo);
+  foo(p, x => x);
+})();
diff --git a/src/v8/test/mjsunit/compiler/promise-prototype-then.js b/src/v8/test/mjsunit/compiler/promise-prototype-then.js
new file mode 100644
index 0000000..3df2353
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/promise-prototype-then.js
@@ -0,0 +1,55 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+  const p = Promise.resolve(1);
+  function foo(p) { return p.then(); }
+  %PrepareFunctionForOptimization(foo);
+  foo(p);
+  foo(p);
+  %OptimizeFunctionOnNextCall(foo);
+  foo(p);
+})();
+
+(function() {
+  const p = Promise.resolve(1);
+  function foo(p) { return p.then(x => x); }
+  %PrepareFunctionForOptimization(foo);
+  foo(p);
+  foo(p);
+  %OptimizeFunctionOnNextCall(foo);
+  foo(p);
+})();
+
+(function() {
+  const p = Promise.resolve(1);
+  function foo(p) { return p.then(x => x, y => y); }
+  %PrepareFunctionForOptimization(foo);
+  foo(p);
+  foo(p);
+  %OptimizeFunctionOnNextCall(foo);
+  foo(p);
+})();
+
+(function() {
+  const p = Promise.resolve(1);
+  function foo(p, f) { return p.then(f, f); }
+  %PrepareFunctionForOptimization(foo);
+  foo(p, x => x);
+  foo(p, x => x);
+  %OptimizeFunctionOnNextCall(foo);
+  foo(p, x => x);
+})();
+
+(function() {
+  const p = Promise.resolve(1);
+  function foo(p, f) { return p.then(f, f).then(f, f); }
+  %PrepareFunctionForOptimization(foo);
+  foo(p, x => x);
+  foo(p, x => x);
+  %OptimizeFunctionOnNextCall(foo);
+  foo(p, x => x);
+})();
diff --git a/src/v8/test/mjsunit/compiler/promise-resolve-stable-maps.js b/src/v8/test/mjsunit/compiler/promise-resolve-stable-maps.js
new file mode 100644
index 0000000..f01dcaf
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/promise-resolve-stable-maps.js
@@ -0,0 +1,63 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --noalways-opt
+
+// Test that JSResolvePromise takes a proper stability dependency
+// on the resolutions map if the infer receiver maps are unreliable
+// (as is the case for HeapConstants).
+(function() {
+  // We need an object literal which gets a stable map initially.
+  function makeObjectWithStableMap() {
+    return {a:1, b:1, c:1};
+  }
+  const a = makeObjectWithStableMap();
+
+  function foo() {
+    return Promise.resolve(a);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertInstanceof(foo(), Promise);
+  assertInstanceof(foo(), Promise);
+  %OptimizeFunctionOnNextCall(foo);
+  assertInstanceof(foo(), Promise);
+  assertOptimized(foo);
+
+  // Now invalidate the stability of a's map.
+  const b = makeObjectWithStableMap();
+  b.d = 1;
+
+  // This should deoptimize foo.
+  assertUnoptimized(foo);
+})();
+
+// Same test with async functions.
+(function() {
+  // We need an object literal which gets a stable map initially,
+  // it needs to be different from the above, otherwise the map
+  // is already not stable when we get here.
+  function makeObjectWithStableMap() {
+    return {x:1, y:1};
+  }
+  const a = makeObjectWithStableMap();
+
+  async function foo() {
+    return a;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertInstanceof(foo(), Promise);
+  assertInstanceof(foo(), Promise);
+  %OptimizeFunctionOnNextCall(foo);
+  assertInstanceof(foo(), Promise);
+  assertOptimized(foo);
+
+  // Now invalidate the stability of a's map.
+  const b = makeObjectWithStableMap();
+  b.z = 1;
+
+  // This should deoptimize foo.
+  assertUnoptimized(foo);
+})();
diff --git a/src/v8/test/mjsunit/compiler/promise-resolve.js b/src/v8/test/mjsunit/compiler/promise-resolve.js
new file mode 100644
index 0000000..5ac84db
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/promise-resolve.js
@@ -0,0 +1,131 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function assertFulfilledWith(expected, thenable) {
+  assertPromiseResult(thenable, v => assertEquals(expected, v));
+}
+
+(function() {
+  function foo() { return Promise.resolve(); }
+  %PrepareFunctionForOptimization(foo);
+  assertFulfilledWith(undefined, foo());
+  assertFulfilledWith(undefined, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertFulfilledWith(undefined, foo());
+})();
+
+(function() {
+  function foo(x) { return Promise.resolve(x); }
+  %PrepareFunctionForOptimization(foo);
+  assertFulfilledWith(3, foo(3));
+  assertFulfilledWith(3, foo(3));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFulfilledWith(3, foo(3));
+})();
+
+(function() {
+  function foo(x, y) { return Promise.resolve(x, y); }
+  %PrepareFunctionForOptimization(foo);
+  assertFulfilledWith(1, foo(1, 0));
+  assertFulfilledWith(2, foo(2, 1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFulfilledWith(3, foo(3, 2));
+})();
+
+(function() {
+  function foo(x) { return Promise.resolve({x}); }
+  %PrepareFunctionForOptimization(foo);
+  assertFulfilledWith({x:1}, foo(1));
+  assertFulfilledWith({x:2}, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFulfilledWith({x:3}, foo(3));
+})();
+
+(function() {
+  function foo(x) { return Promise.resolve(Promise.resolve(x)); }
+  %PrepareFunctionForOptimization(foo);
+  assertFulfilledWith(null, foo(null));
+  assertFulfilledWith('a', foo('a'));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFulfilledWith(42, foo(42));
+})();
+
+(function() {
+  const thenable = new class Thenable {
+    then(fulfill, reject) {
+      fulfill(1);
+    }
+  };
+  function foo() { return Promise.resolve(thenable); }
+  %PrepareFunctionForOptimization(foo);
+  assertFulfilledWith(1, foo());
+  assertFulfilledWith(1, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertFulfilledWith(1, foo());
+})();
+
+(function() {
+  const MyPromise = class MyPromise extends Promise {};
+
+  (function() {
+    function foo() { return MyPromise.resolve(); }
+    %PrepareFunctionForOptimization(foo);
+    assertFulfilledWith(undefined, foo());
+    assertFulfilledWith(undefined, foo());
+    %OptimizeFunctionOnNextCall(foo);
+    assertFulfilledWith(undefined, foo());
+  })();
+
+  (function() {
+    function foo(x) { return MyPromise.resolve(x); }
+    %PrepareFunctionForOptimization(foo);
+    assertFulfilledWith(3, foo(3));
+    assertFulfilledWith(3, foo(3));
+    %OptimizeFunctionOnNextCall(foo);
+    assertFulfilledWith(3, foo(3));
+  })();
+
+  (function() {
+    function foo(x, y) { return MyPromise.resolve(x, y); }
+    %PrepareFunctionForOptimization(foo);
+    assertFulfilledWith(1, foo(1, 0));
+    assertFulfilledWith(2, foo(2, 1));
+    %OptimizeFunctionOnNextCall(foo);
+    assertFulfilledWith(3, foo(3, 2));
+  })();
+
+  (function() {
+    function foo(x) { return MyPromise.resolve({x}); }
+    %PrepareFunctionForOptimization(foo);
+    assertFulfilledWith({x:1}, foo(1));
+    assertFulfilledWith({x:2}, foo(2));
+    %OptimizeFunctionOnNextCall(foo);
+    assertFulfilledWith({x:3}, foo(3));
+  })();
+
+  (function() {
+    function foo(x) { return MyPromise.resolve(Promise.resolve(x)); }
+    %PrepareFunctionForOptimization(foo);
+    assertFulfilledWith(null, foo(null));
+    assertFulfilledWith('a', foo('a'));
+    %OptimizeFunctionOnNextCall(foo);
+    assertFulfilledWith(42, foo(42));
+  })();
+
+  (function() {
+    const thenable = new class Thenable {
+      then(fulfill, reject) {
+        fulfill(1);
+      }
+    };
+    function foo() { return MyPromise.resolve(thenable); }
+    %PrepareFunctionForOptimization(foo);
+    assertFulfilledWith(1, foo());
+    assertFulfilledWith(1, foo());
+    %OptimizeFunctionOnNextCall(foo);
+    assertFulfilledWith(1, foo());
+  })();
+})();
diff --git a/src/v8/test/mjsunit/compiler/promise-species.js b/src/v8/test/mjsunit/compiler/promise-species.js
new file mode 100644
index 0000000..17497a3
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/promise-species.js
@@ -0,0 +1,31 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+class Foo extends Promise {};
+
+function f() {
+  return new Promise(r => 88).then(x => 88);
+}
+
+%PrepareFunctionForOptimization(f);
+
+let y;
+
+y = f();
+assertFalse(y instanceof Foo);
+
+y = f();
+assertFalse(y instanceof Foo);
+
+%OptimizeFunctionOnNextCall(f);
+
+y = f();
+assertFalse(y instanceof Foo);
+
+assertTrue(Reflect.defineProperty(Promise, Symbol.species, {value: Foo}));
+
+y = f();
+assertInstanceof(y, Foo);
diff --git a/src/v8/test/mjsunit/compiler/property-calls.js b/src/v8/test/mjsunit/compiler/property-calls.js
index ad5ca81..508cf37 100644
--- a/src/v8/test/mjsunit/compiler/property-calls.js
+++ b/src/v8/test/mjsunit/compiler/property-calls.js
@@ -30,6 +30,7 @@
 function f(o) { return o.g(); }
 function g() { return 42; }
 
+%PrepareFunctionForOptimization(f);
 var object = { };
 object.g = g;
 for (var i = 0; i < 5; i++) f(object);
diff --git a/src/v8/test/mjsunit/compiler/property-refs.js b/src/v8/test/mjsunit/compiler/property-refs.js
index 6f1f19f..09fdca3 100644
--- a/src/v8/test/mjsunit/compiler/property-refs.js
+++ b/src/v8/test/mjsunit/compiler/property-refs.js
@@ -47,6 +47,7 @@
   return Load(object);
 }
 
+%PrepareFunctionForOptimization(LoadXY);
 for (var i = 0; i < 5; i++) LoadXY(i, i);
 %OptimizeFunctionOnNextCall(LoadXY);
 LoadXY(6, 6);
diff --git a/src/v8/test/mjsunit/compiler/property-static.js b/src/v8/test/mjsunit/compiler/property-static.js
index 0702134..51990af 100644
--- a/src/v8/test/mjsunit/compiler/property-static.js
+++ b/src/v8/test/mjsunit/compiler/property-static.js
@@ -46,6 +46,7 @@
     return object.load();
   }
 
+  %PrepareFunctionForOptimization(f);
   assertSame(1, f(1));
   assertSame(2, f(2));
   %OptimizeFunctionOnNextCall(f);
@@ -62,6 +63,7 @@
     return object.load();
   }
 
+  %PrepareFunctionForOptimization(f);
   assertSame(1, f(1));
   assertSame(2, f(2));
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/property-stores.js b/src/v8/test/mjsunit/compiler/property-stores.js
index 4ffac07..e593676 100644
--- a/src/v8/test/mjsunit/compiler/property-stores.js
+++ b/src/v8/test/mjsunit/compiler/property-stores.js
@@ -35,16 +35,19 @@
            h: function() { this.x = a; }};
 
 var i;
+%PrepareFunctionForOptimization(obj.f);
 for (i = 0; i < 5; i++) { obj.f(); }
 %OptimizeFunctionOnNextCall(obj.f);
 obj.f();
 assertEquals(7, obj.x);
 
+%PrepareFunctionForOptimization(obj.g);
 for (i = 0; i < 5; i++) { obj.g(); }
 %OptimizeFunctionOnNextCall(obj.g);
 obj.g();
 assertEquals(43, obj.x);
 
+%PrepareFunctionForOptimization(obj.h);
 for (i = 0; i < 5; i++) { obj.h(); }
 %OptimizeFunctionOnNextCall(obj.h);
 obj.h();
diff --git a/src/v8/test/mjsunit/compiler/proto-chain-constant.js b/src/v8/test/mjsunit/compiler/proto-chain-constant.js
index 0d9e3b0..4eedd4c 100644
--- a/src/v8/test/mjsunit/compiler/proto-chain-constant.js
+++ b/src/v8/test/mjsunit/compiler/proto-chain-constant.js
@@ -38,6 +38,7 @@
 
 function get4(obj) { return obj.f4; }
 
+%PrepareFunctionForOptimization(get4);
 assertEquals(4, get4(obj0)());
 assertEquals(4, get4(obj0)());
 %OptimizeFunctionOnNextCall(get4);
@@ -47,6 +48,7 @@
 
 function get3(obj) { return obj.f3; }
 
+%PrepareFunctionForOptimization(get3);
 assertEquals(3, get3(obj0)());
 assertEquals(3, get3(obj0)());
 %OptimizeFunctionOnNextCall(get3);
diff --git a/src/v8/test/mjsunit/compiler/proto-chain-load.js b/src/v8/test/mjsunit/compiler/proto-chain-load.js
index 60c6431..3454033 100644
--- a/src/v8/test/mjsunit/compiler/proto-chain-load.js
+++ b/src/v8/test/mjsunit/compiler/proto-chain-load.js
@@ -37,6 +37,7 @@
 
 function get4(obj) { return obj.f4; }
 
+%PrepareFunctionForOptimization(get4);
 assertEquals(4, get4(obj0));
 assertEquals(4, get4(obj0));
 %OptimizeFunctionOnNextCall(get4);
diff --git a/src/v8/test/mjsunit/compiler/receiver-conversion.js b/src/v8/test/mjsunit/compiler/receiver-conversion.js
index c3f807a..c4f8bf9 100644
--- a/src/v8/test/mjsunit/compiler/receiver-conversion.js
+++ b/src/v8/test/mjsunit/compiler/receiver-conversion.js
@@ -10,6 +10,7 @@
 
 var global = this;
 function test(outer, inner, check) {
+  %PrepareFunctionForOptimization(outer);
   check(outer());
   check(outer());
   %OptimizeFunctionOnNextCall(outer);
diff --git a/src/v8/test/mjsunit/compiler/recursive-deopt.js b/src/v8/test/mjsunit/compiler/recursive-deopt.js
index c921ade..6942a1d 100644
--- a/src/v8/test/mjsunit/compiler/recursive-deopt.js
+++ b/src/v8/test/mjsunit/compiler/recursive-deopt.js
@@ -35,6 +35,7 @@
   return f(n - 1) << one;
 }
 
+%PrepareFunctionForOptimization(f);
 
 var one = 1;
 for (var i = 0; i < 5; i++) assertEquals(1 << 5, f(4));
diff --git a/src/v8/test/mjsunit/compiler/redundancy-elimination.js b/src/v8/test/mjsunit/compiler/redundancy-elimination.js
new file mode 100644
index 0000000..dc01fb4
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/redundancy-elimination.js
@@ -0,0 +1,204 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test the RedundancyElimination::ReduceSpeculativeNumberOperation()
+// TurboFan optimization for the case of SpeculativeNumberAdd with
+// Number feedback.
+(function() {
+  function bar(i) {
+    return ++i;
+  }
+  bar(0.1);
+
+  function foo(a, i) {
+    const x = a[i];
+    const y = a[bar(i)];
+    return x + y;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(3, foo([1, 2], 0));
+  assertEquals(3, foo([1, 2], 0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo([1, 2], 0));
+})();
+
+// Test the RedundancyElimination::ReduceSpeculativeNumberOperation()
+// TurboFan optimization for the case of SpeculativeNumberAdd with
+// NumberOrOddball feedback.
+(function() {
+  function bar(i) {
+    return ++i;
+  }
+  assertEquals(NaN, bar(undefined));
+
+  function foo(a, i) {
+    const x = a[i];
+    const y = a[bar(i)];
+    return x + y;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(3, foo([1, 2], 0));
+  assertEquals(3, foo([1, 2], 0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo([1, 2], 0));
+})();
+
+// Test the RedundancyElimination::ReduceSpeculativeNumberOperation()
+// TurboFan optimization for the case of SpeculativeNumberSubtract with
+// Number feedback.
+(function() {
+  function bar(i) {
+    return --i;
+  }
+  assertEquals(-0.9, bar(0.1));
+
+  function foo(a, i) {
+    const x = a[i];
+    const y = a[bar(i)];
+    return x + y;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(3, foo([1, 2], 1));
+  assertEquals(3, foo([1, 2], 1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo([1, 2], 1));
+})();
+
+// Test the RedundancyElimination::ReduceSpeculativeNumberOperation()
+// TurboFan optimization for the case of SpeculativeNumberSubtract with
+// NumberOrOddball feedback.
+(function() {
+  function bar(i) {
+    return --i;
+  }
+  assertEquals(NaN, bar(undefined));
+
+  function foo(a, i) {
+    const x = a[i];
+    const y = a[bar(i)];
+    return x + y;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(3, foo([1, 2], 1));
+  assertEquals(3, foo([1, 2], 1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo([1, 2], 1));
+})();
+
+// Test the RedundancyElimination::ReduceSpeculativeNumberOperation()
+// TurboFan optimization for the case of SpeculativeToNumber.
+(function() {
+  function foo(a, i) {
+    const x = a[i];
+    const y = i++;
+    return x + y;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo([1, 2], 0));
+  assertEquals(1, foo([1, 2], 0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo([1, 2], 0));
+})();
+
+// Test the RedundancyElimination::ReduceSpeculativeNumberOperation()
+// TurboFan optimization for the case of SpeculativeSafeIntegerAdd.
+(function() {
+  function foo(a, i) {
+    const x = a[i];
+    const y = a[++i];
+    return x + y;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(3, foo([1, 2], 0));
+  assertEquals(3, foo([1, 2], 0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo([1, 2], 0));
+})();
+
+// Test the RedundancyElimination::ReduceSpeculativeNumberOperation()
+// TurboFan optimization for the case of SpeculativeSafeIntegerSubtract.
+(function() {
+  function foo(a, i) {
+    const x = a[i];
+    const y = a[--i];
+    return x + y;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(3, foo([1, 2], 1));
+  assertEquals(3, foo([1, 2], 1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(3, foo([1, 2], 1));
+})();
+
+// Test the RedundancyElimination::ReduceSpeculativeNumberComparison()
+// TurboFan optimization for the case of SpeculativeNumberEqual.
+(function() {
+  function foo(a, i) {
+    const x = a[i];
+    if (i === 0) return x;
+    return i;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo([1, 2], 0));
+  assertEquals(1, foo([1, 2], 1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo([1, 2], 0));
+  assertEquals(1, foo([1, 2], 1));
+  // Even passing -0 should not deoptimize and
+  // of course still pass the equality test above.
+  assertEquals(9, foo([9, 2], -0));
+  assertOptimized(foo);
+})();
+
+// Test the RedundancyElimination::ReduceSpeculativeNumberComparison()
+// TurboFan optimization for the case of SpeculativeNumberLessThan.
+(function() {
+  function foo(a, i) {
+    const x = a[i];
+    if (i < 1) return x;
+    return i;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo([1, 2], 0));
+  assertEquals(1, foo([1, 2], 1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo([1, 2], 0));
+  assertEquals(1, foo([1, 2], 1));
+  // Even passing -0 should not deoptimize and
+  // of course still pass the equality test above.
+  assertEquals(9, foo([9, 2], -0));
+  assertOptimized(foo);
+})();
+
+// Test the RedundancyElimination::ReduceSpeculativeNumberComparison()
+// TurboFan optimization for the case of SpeculativeNumberLessThanOrEqual.
+(function() {
+  function foo(a, i) {
+    const x = a[i];
+    if (i <= 0) return x;
+    return i;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo([1, 2], 0));
+  assertEquals(1, foo([1, 2], 1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo([1, 2], 0));
+  assertEquals(1, foo([1, 2], 1));
+  // Even passing -0 should not deoptimize and
+  // of course still pass the equality test above.
+  assertEquals(9, foo([9, 2], -0));
+  assertOptimized(foo);
+})();
diff --git a/src/v8/test/mjsunit/compiler/reflect-apply.js b/src/v8/test/mjsunit/compiler/reflect-apply.js
index fb8f201..4f431f3 100644
--- a/src/v8/test/mjsunit/compiler/reflect-apply.js
+++ b/src/v8/test/mjsunit/compiler/reflect-apply.js
@@ -10,6 +10,7 @@
   function bar() { return this; }
   function foo() { return Reflect.apply(bar); }
 
+  %PrepareFunctionForOptimization(foo);
   assertThrows(foo);
   assertThrows(foo);
   %OptimizeFunctionOnNextCall(foo);
@@ -20,6 +21,7 @@
   function bar() { return this; }
   function foo() { return Reflect.apply(bar, this); }
 
+  %PrepareFunctionForOptimization(foo);
   assertThrows(foo);
   assertThrows(foo);
   %OptimizeFunctionOnNextCall(foo);
@@ -30,6 +32,7 @@
   function bar() { return this; }
   function foo() { return Reflect.apply(bar, this, arguments, this); }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(42, foo.call(42));
   assertEquals(42, foo.call(42));
   %OptimizeFunctionOnNextCall(foo);
@@ -47,6 +50,7 @@
     }
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(1, foo());
   assertEquals(1, foo());
   %OptimizeFunctionOnNextCall(foo);
@@ -62,6 +66,7 @@
     }
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(1, foo());
   assertEquals(1, foo());
   %OptimizeFunctionOnNextCall(foo);
@@ -78,6 +83,7 @@
     return Reflect.apply(undefined, this, dummy);
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertThrows(foo, TypeError);
   assertThrows(foo, TypeError);
   %OptimizeFunctionOnNextCall(foo);
@@ -92,6 +98,7 @@
     return Reflect.apply(null, this, dummy);
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertThrows(foo, TypeError);
   assertThrows(foo, TypeError);
   %OptimizeFunctionOnNextCall(foo);
@@ -106,6 +113,7 @@
     return Reflect.apply(null, this, dummy);
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertThrows(foo, TypeError);
   assertThrows(foo, TypeError);
   %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/reflect-construct.js b/src/v8/test/mjsunit/compiler/reflect-construct.js
index fb70ff4..cf52856 100644
--- a/src/v8/test/mjsunit/compiler/reflect-construct.js
+++ b/src/v8/test/mjsunit/compiler/reflect-construct.js
@@ -10,6 +10,7 @@
   function A() {}
   function foo() { return Reflect.construct(A); }
 
+  %PrepareFunctionForOptimization(foo);
   assertThrows(foo);
   assertThrows(foo);
   %OptimizeFunctionOnNextCall(foo);
@@ -20,6 +21,7 @@
   function A(x) { this.x = x; }
   function foo() { return Reflect.construct(A, arguments); }
 
+  %PrepareFunctionForOptimization(foo);
   assertInstanceof(foo(), A);
   assertInstanceof(foo(), A);
   assertEquals(1, foo(1).x);
@@ -32,6 +34,7 @@
   function A(x) { this.x = x; }
   function foo() { return Reflect.construct(A, arguments, A, A); }
 
+  %PrepareFunctionForOptimization(foo);
   assertInstanceof(foo(), A);
   assertInstanceof(foo(), A);
   assertEquals(1, foo(1).x);
@@ -51,6 +54,7 @@
     }
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(1, foo());
   assertEquals(1, foo());
   %OptimizeFunctionOnNextCall(foo);
@@ -66,6 +70,7 @@
     }
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(1, foo());
   assertEquals(1, foo());
   %OptimizeFunctionOnNextCall(foo);
@@ -81,6 +86,7 @@
     return Reflect.construct(undefined, dummy, undefined);
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertThrows(foo, TypeError);
   assertThrows(foo, TypeError);
   %OptimizeFunctionOnNextCall(foo);
@@ -95,6 +101,7 @@
     return Reflect.construct(undefined, dummy);
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertThrows(foo, TypeError);
   assertThrows(foo, TypeError);
   %OptimizeFunctionOnNextCall(foo);
@@ -109,6 +116,7 @@
     return Reflect.construct(null, dummy, null);
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertThrows(foo, TypeError);
   assertThrows(foo, TypeError);
   %OptimizeFunctionOnNextCall(foo);
@@ -122,6 +130,7 @@
     return Reflect.construct(null, dummy);
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertThrows(foo, TypeError);
   assertThrows(foo, TypeError);
   %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/reflect-get.js b/src/v8/test/mjsunit/compiler/reflect-get.js
index 0c329e4..b414ccb 100644
--- a/src/v8/test/mjsunit/compiler/reflect-get.js
+++ b/src/v8/test/mjsunit/compiler/reflect-get.js
@@ -9,6 +9,7 @@
   "use strict";
   function foo() { return Reflect.get(); }
 
+  %PrepareFunctionForOptimization(foo);
   assertThrows(foo);
   assertThrows(foo);
   %OptimizeFunctionOnNextCall(foo);
@@ -18,6 +19,7 @@
   "use strict";
   function foo(o) { return Reflect.get(o); }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(undefined, foo({}));
   assertEquals(undefined, foo({}));
   %OptimizeFunctionOnNextCall(foo);
@@ -27,6 +29,7 @@
   "use strict";
   function foo(o) { return Reflect.get(o); }
 
+  %PrepareFunctionForOptimization(foo);
   assertThrows(foo.bind(undefined, 1));
   assertThrows(foo.bind(undefined, undefined));
   %OptimizeFunctionOnNextCall(foo);
@@ -45,6 +48,7 @@
     }
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(10, foo());
   assertEquals(10, foo());
   %OptimizeFunctionOnNextCall(foo);
@@ -61,6 +65,7 @@
     }
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(1, foo({[Symbol.toPrimitive]() { throw new Error(); }}));
   assertEquals(1, foo({[Symbol.toPrimitive]() { throw new Error(); }}));
   %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/reflect-getprototypeof.js b/src/v8/test/mjsunit/compiler/reflect-getprototypeof.js
index a5ea8914..5001158 100644
--- a/src/v8/test/mjsunit/compiler/reflect-getprototypeof.js
+++ b/src/v8/test/mjsunit/compiler/reflect-getprototypeof.js
@@ -9,6 +9,7 @@
 
 function foo() { return Reflect.getPrototypeOf(object); }
 
+%PrepareFunctionForOptimization(foo);
 assertSame(prototype, foo());
 assertSame(prototype, foo());
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/reflect-has.js b/src/v8/test/mjsunit/compiler/reflect-has.js
index 2f9ee1b..955ff26 100644
--- a/src/v8/test/mjsunit/compiler/reflect-has.js
+++ b/src/v8/test/mjsunit/compiler/reflect-has.js
@@ -9,6 +9,7 @@
   "use strict";
   function foo() { return Reflect.has(); }
 
+  %PrepareFunctionForOptimization(foo);
   assertThrows(foo);
   assertThrows(foo);
   %OptimizeFunctionOnNextCall(foo);
@@ -18,6 +19,7 @@
   "use strict";
   function foo(o) { return Reflect.has(o); }
 
+  %PrepareFunctionForOptimization(foo);
   assertFalse(foo({}));
   assertFalse(foo({}));
   %OptimizeFunctionOnNextCall(foo);
@@ -27,6 +29,7 @@
   "use strict";
   function foo(o) { return Reflect.has(o); }
 
+  %PrepareFunctionForOptimization(foo);
   assertThrows(foo.bind(undefined, 1));
   assertThrows(foo.bind(undefined, undefined));
   %OptimizeFunctionOnNextCall(foo);
@@ -44,6 +47,7 @@
     }
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(1, foo());
   assertEquals(1, foo());
   %OptimizeFunctionOnNextCall(foo);
@@ -60,6 +64,7 @@
     }
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(1, foo({[Symbol.toPrimitive]() { throw new Error(); }}));
   assertEquals(1, foo({[Symbol.toPrimitive]() { throw new Error(); }}));
   %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/regress-106351.js b/src/v8/test/mjsunit/compiler/regress-106351.js
index 2a67a05..0258029 100644
--- a/src/v8/test/mjsunit/compiler/regress-106351.js
+++ b/src/v8/test/mjsunit/compiler/regress-106351.js
@@ -33,6 +33,7 @@
   assertEquals(0.5, v);
 }
 
+%PrepareFunctionForOptimization(test);
 for (var i = 0; i < 5; ++i) test(0.5);
 %OptimizeFunctionOnNextCall(test);
 test(0.5);
diff --git a/src/v8/test/mjsunit/compiler/regress-1085.js b/src/v8/test/mjsunit/compiler/regress-1085.js
index 533cf59..c969ddf 100644
--- a/src/v8/test/mjsunit/compiler/regress-1085.js
+++ b/src/v8/test/mjsunit/compiler/regress-1085.js
@@ -31,6 +31,7 @@
 // This test relies on specific type feedback for Math.min.
 function f(x) { return 1 / Math.min(1, x); }
 
+%PrepareFunctionForOptimization(f);
 for (var i = 0; i < 5; ++i) f(1);
 %OptimizeFunctionOnNextCall(f);
 
diff --git a/src/v8/test/mjsunit/compiler/regress-1394.js b/src/v8/test/mjsunit/compiler/regress-1394.js
index fbf4357..94bff27 100644
--- a/src/v8/test/mjsunit/compiler/regress-1394.js
+++ b/src/v8/test/mjsunit/compiler/regress-1394.js
@@ -50,6 +50,8 @@
   return ret;
 };
 
+%PrepareFunctionForOptimization(f);
+
 for (var i = 0; i < 3; i++) assertEquals(i, f(i));
 
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/regress-177883.js b/src/v8/test/mjsunit/compiler/regress-177883.js
index d5af584..6636efa 100644
--- a/src/v8/test/mjsunit/compiler/regress-177883.js
+++ b/src/v8/test/mjsunit/compiler/regress-177883.js
@@ -171,6 +171,7 @@
     HEAPF32[i] = 1.0;
   }
 
+  %PrepareFunctionForOptimization(__ZNK4Math7frustum10clipstatusERKNS_4bboxE);
   __ZNK4Math7frustum10clipstatusERKNS_4bboxE(0, 0);
   __ZNK4Math7frustum10clipstatusERKNS_4bboxE(0, 0);
   __ZNK4Math7frustum10clipstatusERKNS_4bboxE(0, 0);
diff --git a/src/v8/test/mjsunit/compiler/regress-3218915.js b/src/v8/test/mjsunit/compiler/regress-3218915.js
index dfce815..abb47dc 100644
--- a/src/v8/test/mjsunit/compiler/regress-3218915.js
+++ b/src/v8/test/mjsunit/compiler/regress-3218915.js
@@ -42,6 +42,7 @@
 function test(x) { return observe(this, ((0, side_effect()), x + 1)); }
 
 // Run test enough times to get it optimized.
+%PrepareFunctionForOptimization(test);
 for (var i = 0; i < 5; ++i) test(0);
 %OptimizeFunctionOnNextCall(test);
 test(0);
diff --git a/src/v8/test/mjsunit/compiler/regress-411262.js b/src/v8/test/mjsunit/compiler/regress-411262.js
index ffbfe2e..320e3b7 100644
--- a/src/v8/test/mjsunit/compiler/regress-411262.js
+++ b/src/v8/test/mjsunit/compiler/regress-411262.js
@@ -33,5 +33,6 @@
   b.apply(this, arguments);
 }
 
+%PrepareFunctionForOptimization(f);
 %OptimizeFunctionOnNextCall(f);
 f();
diff --git a/src/v8/test/mjsunit/compiler/regress-4207.js b/src/v8/test/mjsunit/compiler/regress-4207.js
index c4ab5a7..48f26a8 100644
--- a/src/v8/test/mjsunit/compiler/regress-4207.js
+++ b/src/v8/test/mjsunit/compiler/regress-4207.js
@@ -5,11 +5,13 @@
 // Flags: --allow-natives-syntax
 
 function bar() { return 0/0 && 1; }
+%PrepareFunctionForOptimization(bar);
 assertEquals(NaN, bar());
 %OptimizeFunctionOnNextCall(bar);
 assertEquals(NaN, bar());
 
 function foo() { return 0/0 || 1; }
+%PrepareFunctionForOptimization(foo);
 assertEquals(1, foo());
 %OptimizeFunctionOnNextCall(foo);
 assertEquals(1, foo());
diff --git a/src/v8/test/mjsunit/compiler/regress-4389-1.js b/src/v8/test/mjsunit/compiler/regress-4389-1.js
index adb3716..5f77d54 100644
--- a/src/v8/test/mjsunit/compiler/regress-4389-1.js
+++ b/src/v8/test/mjsunit/compiler/regress-4389-1.js
@@ -5,6 +5,7 @@
 // Flags: --allow-natives-syntax
 
 function foo(x) { Math.fround(x); }
+%PrepareFunctionForOptimization(foo);
 foo(1);
 foo(2);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/regress-4389-2.js b/src/v8/test/mjsunit/compiler/regress-4389-2.js
index edfcf7a..2bfc6e6 100644
--- a/src/v8/test/mjsunit/compiler/regress-4389-2.js
+++ b/src/v8/test/mjsunit/compiler/regress-4389-2.js
@@ -5,6 +5,7 @@
 // Flags: --allow-natives-syntax
 
 function foo(x) { Math.sqrt(x); }
+%PrepareFunctionForOptimization(foo);
 foo(1);
 foo(2);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/regress-4389-3.js b/src/v8/test/mjsunit/compiler/regress-4389-3.js
index f4dbc48..a4eb335 100644
--- a/src/v8/test/mjsunit/compiler/regress-4389-3.js
+++ b/src/v8/test/mjsunit/compiler/regress-4389-3.js
@@ -5,6 +5,7 @@
 // Flags: --allow-natives-syntax
 
 function foo(x) { Math.floor(x); }
+%PrepareFunctionForOptimization(foo);
 foo(1);
 foo(2);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/regress-4389-4.js b/src/v8/test/mjsunit/compiler/regress-4389-4.js
index 2b9b149..600cfa8 100644
--- a/src/v8/test/mjsunit/compiler/regress-4389-4.js
+++ b/src/v8/test/mjsunit/compiler/regress-4389-4.js
@@ -5,6 +5,7 @@
 // Flags: --allow-natives-syntax
 
 function foo(x) { Math.round(x); }
+%PrepareFunctionForOptimization(foo);
 foo(1);
 foo(2);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/regress-4389-5.js b/src/v8/test/mjsunit/compiler/regress-4389-5.js
index e72a3c3..ab373b6 100644
--- a/src/v8/test/mjsunit/compiler/regress-4389-5.js
+++ b/src/v8/test/mjsunit/compiler/regress-4389-5.js
@@ -5,6 +5,7 @@
 // Flags: --allow-natives-syntax
 
 function foo(x) { Math.abs(x); }
+%PrepareFunctionForOptimization(foo);
 foo(1);
 foo(2);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/regress-4389-6.js b/src/v8/test/mjsunit/compiler/regress-4389-6.js
index 72a8856..c51ae9f 100644
--- a/src/v8/test/mjsunit/compiler/regress-4389-6.js
+++ b/src/v8/test/mjsunit/compiler/regress-4389-6.js
@@ -5,6 +5,7 @@
 // Flags: --allow-natives-syntax
 
 function foo(x) { Math.log(x); }
+%PrepareFunctionForOptimization(foo);
 foo(1);
 foo(2);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/regress-4413-1.js b/src/v8/test/mjsunit/compiler/regress-4413-1.js
index 5698235..10ef1f0 100644
--- a/src/v8/test/mjsunit/compiler/regress-4413-1.js
+++ b/src/v8/test/mjsunit/compiler/regress-4413-1.js
@@ -11,5 +11,6 @@
   return foo;
 })(this);
 
+%PrepareFunctionForOptimization(foo);
 %OptimizeFunctionOnNextCall(foo);
 foo();
diff --git a/src/v8/test/mjsunit/compiler/regress-4470-1.js b/src/v8/test/mjsunit/compiler/regress-4470-1.js
index 91d26b7..f737a39 100644
--- a/src/v8/test/mjsunit/compiler/regress-4470-1.js
+++ b/src/v8/test/mjsunit/compiler/regress-4470-1.js
@@ -9,6 +9,7 @@
 function foo(f) {
   f.x = 1;
 }
+%PrepareFunctionForOptimization(foo);
 foo(new Foo);
 foo(new Foo);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/regress-491578.js b/src/v8/test/mjsunit/compiler/regress-491578.js
index c275704..9f915ca 100644
--- a/src/v8/test/mjsunit/compiler/regress-491578.js
+++ b/src/v8/test/mjsunit/compiler/regress-491578.js
@@ -11,5 +11,6 @@
     f();
   }
 }
+%PrepareFunctionForOptimization(foo);
 %OptimizeFunctionOnNextCall(foo);
 foo();
diff --git a/src/v8/test/mjsunit/compiler/regress-5074.js b/src/v8/test/mjsunit/compiler/regress-5074.js
index 903b54a..25d69ef 100644
--- a/src/v8/test/mjsunit/compiler/regress-5074.js
+++ b/src/v8/test/mjsunit/compiler/regress-5074.js
@@ -12,6 +12,7 @@
   return x + b;
 }
 
+%PrepareFunctionForOptimization(foo);
 assertEquals(2.1, foo(1, 2));
 assertEquals(2.1, foo(1, 2));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/regress-5100.js b/src/v8/test/mjsunit/compiler/regress-5100.js
index 694cd8a..07fffd0 100644
--- a/src/v8/test/mjsunit/compiler/regress-5100.js
+++ b/src/v8/test/mjsunit/compiler/regress-5100.js
@@ -14,6 +14,7 @@
 (function() {
   function f(x) { return a[x]; }
 
+  %PrepareFunctionForOptimization(f);
   assertEquals(0, f(0));
   assertEquals(0, f(0));
   %OptimizeFunctionOnNextCall(f);
@@ -24,6 +25,7 @@
 (function() {
   function f( x) { return a[x]; }
 
+  %PrepareFunctionForOptimization(f);
   assertEquals(0, f(0));
   assertEquals(0, f(0));
   %OptimizeFunctionOnNextCall(f);
@@ -34,6 +36,7 @@
 (function() {
   function f( x) { return a[x]; }
 
+  %PrepareFunctionForOptimization(f);
   assertEquals(0, f(0));
   assertEquals(0, f(0));
   %OptimizeFunctionOnNextCall(f);
@@ -44,6 +47,7 @@
 (function() {
   function f( x) { return a[x]; }
 
+  %PrepareFunctionForOptimization(f);
   assertEquals(0, f(0));
   assertEquals(0, f(0));
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/regress-5129.js b/src/v8/test/mjsunit/compiler/regress-5129.js
index 1d100ab..001d7fe 100644
--- a/src/v8/test/mjsunit/compiler/regress-5129.js
+++ b/src/v8/test/mjsunit/compiler/regress-5129.js
@@ -11,5 +11,6 @@
  return ($sub|0) < 0;
 }
 
+%PrepareFunctionForOptimization(foo);
 %OptimizeFunctionOnNextCall(foo);
 assertTrue(foo(0x7fffffff,-1));
diff --git a/src/v8/test/mjsunit/compiler/regress-5158.js b/src/v8/test/mjsunit/compiler/regress-5158.js
index ead5f4e..9387807 100644
--- a/src/v8/test/mjsunit/compiler/regress-5158.js
+++ b/src/v8/test/mjsunit/compiler/regress-5158.js
@@ -9,6 +9,7 @@
   return (x > 0) ? x : 0 - x;
 }
 
+%PrepareFunctionForOptimization(foo);
 foo(1);
 foo(-1);
 foo(0);
diff --git a/src/v8/test/mjsunit/compiler/regress-5278.js b/src/v8/test/mjsunit/compiler/regress-5278.js
index 25b1fb0..ea65756 100644
--- a/src/v8/test/mjsunit/compiler/regress-5278.js
+++ b/src/v8/test/mjsunit/compiler/regress-5278.js
@@ -7,6 +7,7 @@
 function foo(a, b) {
   return a % b;
 }
+%PrepareFunctionForOptimization(foo);
 foo(2, 1);
 foo(2, 1);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/regress-5320.js b/src/v8/test/mjsunit/compiler/regress-5320.js
index e2fa65d..add57fd 100644
--- a/src/v8/test/mjsunit/compiler/regress-5320.js
+++ b/src/v8/test/mjsunit/compiler/regress-5320.js
@@ -28,6 +28,7 @@
 // Flags: --allow-natives-syntax --opt
 
 function OptimizeTruncatingBinaryOp(func) {
+  %PrepareFunctionForOptimization(func);
   func(42, -2);
   func(31, undefined);
   %OptimizeFunctionOnNextCall(func);
diff --git a/src/v8/test/mjsunit/compiler/regress-5538.js b/src/v8/test/mjsunit/compiler/regress-5538.js
index 7e4c25d..2878b40 100644
--- a/src/v8/test/mjsunit/compiler/regress-5538.js
+++ b/src/v8/test/mjsunit/compiler/regress-5538.js
@@ -10,6 +10,7 @@
     return Number.parseInt(x + 1);
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(1, foo(0));
   assertEquals(2, foo(1));
   %OptimizeFunctionOnNextCall(foo);
@@ -22,6 +23,7 @@
     return Number.parseInt(x + 1, 0);
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(1, foo(0));
   assertEquals(2, foo(1));
   %OptimizeFunctionOnNextCall(foo);
@@ -34,6 +36,7 @@
     return Number.parseInt(x + 1, 10);
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(1, foo(0));
   assertEquals(2, foo(1));
   %OptimizeFunctionOnNextCall(foo);
@@ -46,6 +49,7 @@
     return Number.parseInt(x + 1, undefined);
   }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals(1, foo(0));
   assertEquals(2, foo(1));
   %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/regress-600593.js b/src/v8/test/mjsunit/compiler/regress-600593.js
index c93f2ab..463f5ba 100644
--- a/src/v8/test/mjsunit/compiler/regress-600593.js
+++ b/src/v8/test/mjsunit/compiler/regress-600593.js
@@ -15,6 +15,7 @@
   return arguments.length;
 }
 
+%PrepareFunctionForOptimization(f);
 assertThrows(function() { f(true); });
 assertThrows(function() { f(false); });
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/regress-607493.js b/src/v8/test/mjsunit/compiler/regress-607493.js
index 540b47e..8e4721c 100644
--- a/src/v8/test/mjsunit/compiler/regress-607493.js
+++ b/src/v8/test/mjsunit/compiler/regress-607493.js
@@ -10,7 +10,10 @@
   function g() {
     for (var x in a) {
       try {
-        for (var i = 0; i < 10; i++) { %OptimizeOsr(); }
+        for (var i = 0; i < 10; i++) {
+          %OptimizeOsr();
+          %PrepareFunctionForOptimization(g);
+        }
         return;
       } catch(e) {
         continue;
@@ -18,6 +21,7 @@
     }
   }
 
+  %PrepareFunctionForOptimization(g);
   g();
 })();
 
@@ -27,11 +31,15 @@
   function g() {
     for (var x in a) {
       if (x) {
-        for (var i = 0; i < 10; i++) { %OptimizeOsr(); }
+        for (var i = 0; i < 10; i++) {
+          %OptimizeOsr();
+          %PrepareFunctionForOptimization(g);
+        }
       }
       continue;
     }
   }
 
+  %PrepareFunctionForOptimization(g);
   g();
 })();
diff --git a/src/v8/test/mjsunit/compiler/regress-621147.js b/src/v8/test/mjsunit/compiler/regress-621147.js
index 0a5a221..4c25b0c 100644
--- a/src/v8/test/mjsunit/compiler/regress-621147.js
+++ b/src/v8/test/mjsunit/compiler/regress-621147.js
@@ -16,6 +16,8 @@
   a[0] = 1;
 }
 
+%PrepareFunctionForOptimization(test2);
+
 test(0);
 
 var smi_array = [1,2];
diff --git a/src/v8/test/mjsunit/compiler/regress-621423.js b/src/v8/test/mjsunit/compiler/regress-621423.js
index 962176f..8bc3231 100644
--- a/src/v8/test/mjsunit/compiler/regress-621423.js
+++ b/src/v8/test/mjsunit/compiler/regress-621423.js
@@ -16,6 +16,7 @@
   g(a);
 }
 
+%PrepareFunctionForOptimization(f);
 f();
 %OptimizeFunctionOnNextCall(f);
 f();
diff --git a/src/v8/test/mjsunit/compiler/regress-626986.js b/src/v8/test/mjsunit/compiler/regress-626986.js
index 5e02918..7ca1d96 100644
--- a/src/v8/test/mjsunit/compiler/regress-626986.js
+++ b/src/v8/test/mjsunit/compiler/regress-626986.js
@@ -14,6 +14,8 @@
   o.f = x;
 }
 
+%PrepareFunctionForOptimization(f);
+
 f(o, g);
 f(o, g);
 f(o, g);
diff --git a/src/v8/test/mjsunit/compiler/regress-628403.js b/src/v8/test/mjsunit/compiler/regress-628403.js
index 4096ac3..7086d8b 100644
--- a/src/v8/test/mjsunit/compiler/regress-628403.js
+++ b/src/v8/test/mjsunit/compiler/regress-628403.js
@@ -20,6 +20,7 @@
 }
 
 %NeverOptimizeFunction(g);
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/regress-633497.js b/src/v8/test/mjsunit/compiler/regress-633497.js
index 8bf358a..0e3288e 100644
--- a/src/v8/test/mjsunit/compiler/regress-633497.js
+++ b/src/v8/test/mjsunit/compiler/regress-633497.js
@@ -23,6 +23,7 @@
   return +x;
 }
 
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/regress-638132.js b/src/v8/test/mjsunit/compiler/regress-638132.js
index 1b94feb..b452492 100644
--- a/src/v8/test/mjsunit/compiler/regress-638132.js
+++ b/src/v8/test/mjsunit/compiler/regress-638132.js
@@ -19,6 +19,7 @@
 g(1, 2);
 g(1, 2);
 
+%PrepareFunctionForOptimization(f);
 f(0);
 f(0);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/regress-639210.js b/src/v8/test/mjsunit/compiler/regress-639210.js
index 50303fb..a852a07 100644
--- a/src/v8/test/mjsunit/compiler/regress-639210.js
+++ b/src/v8/test/mjsunit/compiler/regress-639210.js
@@ -31,8 +31,10 @@
 
 m.init();
 
+%PrepareFunctionForOptimization(m.load);
 %OptimizeFunctionOnNextCall(m.load);
 assertEquals(2, m.load());
 
+%PrepareFunctionForOptimization(m.store);
 %OptimizeFunctionOnNextCall(m.store);
 assertEquals(0.1, m.store(1));
diff --git a/src/v8/test/mjsunit/compiler/regress-644048.js b/src/v8/test/mjsunit/compiler/regress-644048.js
index ee2dd6e..3aeb0e3 100644
--- a/src/v8/test/mjsunit/compiler/regress-644048.js
+++ b/src/v8/test/mjsunit/compiler/regress-644048.js
@@ -10,6 +10,7 @@
          : x) | 0
 }
 
+%PrepareFunctionForOptimization(foo);
 foo(1);
 foo(2);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/regress-645851.js b/src/v8/test/mjsunit/compiler/regress-645851.js
index 0ea70bd..a0d7276 100644
--- a/src/v8/test/mjsunit/compiler/regress-645851.js
+++ b/src/v8/test/mjsunit/compiler/regress-645851.js
@@ -11,9 +11,11 @@
       sum = sum + 1;
       %OptimizeOsr();
       if (sum == 2) return;
+      %PrepareFunctionForOptimization(f);
     }
   }
   return sum;
 }
 
+%PrepareFunctionForOptimization(f);
 f();
diff --git a/src/v8/test/mjsunit/compiler/regress-650215.js b/src/v8/test/mjsunit/compiler/regress-650215.js
index 95ae6cf..67ac3d9 100644
--- a/src/v8/test/mjsunit/compiler/regress-650215.js
+++ b/src/v8/test/mjsunit/compiler/regress-650215.js
@@ -13,4 +13,5 @@
   return x;
 }
 
+%PrepareFunctionForOptimization(f);
 assertEquals(0, f());
diff --git a/src/v8/test/mjsunit/compiler/regress-664117.js b/src/v8/test/mjsunit/compiler/regress-664117.js
index cf00591..3346db4 100644
--- a/src/v8/test/mjsunit/compiler/regress-664117.js
+++ b/src/v8/test/mjsunit/compiler/regress-664117.js
@@ -8,6 +8,7 @@
   return v.length + 1;
 }
 
+%PrepareFunctionForOptimization(foo);
 var v = [];
 foo();
 v.length = 0xFFFFFFFF;
diff --git a/src/v8/test/mjsunit/compiler/regress-664490.js b/src/v8/test/mjsunit/compiler/regress-664490.js
index 94094c7..69a8bd4 100644
--- a/src/v8/test/mjsunit/compiler/regress-664490.js
+++ b/src/v8/test/mjsunit/compiler/regress-664490.js
@@ -14,5 +14,6 @@
   foo(undefined == 0);
 }
 
+%PrepareFunctionForOptimization(f);
 %OptimizeFunctionOnNextCall(f);
 f();
diff --git a/src/v8/test/mjsunit/compiler/regress-665680.js b/src/v8/test/mjsunit/compiler/regress-665680.js
index b014bee..12713da 100644
--- a/src/v8/test/mjsunit/compiler/regress-665680.js
+++ b/src/v8/test/mjsunit/compiler/regress-665680.js
@@ -13,6 +13,7 @@
   }
 })();
 
+%PrepareFunctionForOptimization(invalidAsmFunction);
 invalidAsmFunction();
 %OptimizeFunctionOnNextCall(invalidAsmFunction);
 invalidAsmFunction();
diff --git a/src/v8/test/mjsunit/compiler/regress-668760.js b/src/v8/test/mjsunit/compiler/regress-668760.js
index 58294be..6cb0133 100644
--- a/src/v8/test/mjsunit/compiler/regress-668760.js
+++ b/src/v8/test/mjsunit/compiler/regress-668760.js
@@ -22,6 +22,7 @@
 
 this.__defineGetter__("o", deopt );
 
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/regress-669517.js b/src/v8/test/mjsunit/compiler/regress-669517.js
index 1905260..d6bbfd8 100644
--- a/src/v8/test/mjsunit/compiler/regress-669517.js
+++ b/src/v8/test/mjsunit/compiler/regress-669517.js
@@ -6,12 +6,14 @@
 
 (function() {
   "use asm";
-  return function() {
+  var f = function() {
     for (var i = 0; i < 10; i++) {
       if (i == 5) {
         %OptimizeOsr();
       }
     }
     with (Object());
-  }
+  };
+  %PrepareFunctionForOptimization(f);
+  return f;
 })()();
diff --git a/src/v8/test/mjsunit/compiler/regress-671574.js b/src/v8/test/mjsunit/compiler/regress-671574.js
index fad03f0..b9a6861 100644
--- a/src/v8/test/mjsunit/compiler/regress-671574.js
+++ b/src/v8/test/mjsunit/compiler/regress-671574.js
@@ -17,5 +17,6 @@
   } catch(e) {"Caught: " + e; }
 }
 
+%PrepareFunctionForOptimization(f);
 %OptimizeFunctionOnNextCall(f);
 f();
diff --git a/src/v8/test/mjsunit/compiler/regress-673244.js b/src/v8/test/mjsunit/compiler/regress-673244.js
index b18d47b..b962e6a 100644
--- a/src/v8/test/mjsunit/compiler/regress-673244.js
+++ b/src/v8/test/mjsunit/compiler/regress-673244.js
@@ -12,4 +12,5 @@
   }
 }
 
+%PrepareFunctionForOptimization(f);
 f();
diff --git a/src/v8/test/mjsunit/compiler/regress-675704.js b/src/v8/test/mjsunit/compiler/regress-675704.js
index 788f92e..f3c30e3 100644
--- a/src/v8/test/mjsunit/compiler/regress-675704.js
+++ b/src/v8/test/mjsunit/compiler/regress-675704.js
@@ -20,6 +20,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(g);
 g(false);
 g(false);
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/compiler/regress-700883.js b/src/v8/test/mjsunit/compiler/regress-700883.js
index 41440f3..d9722a2 100644
--- a/src/v8/test/mjsunit/compiler/regress-700883.js
+++ b/src/v8/test/mjsunit/compiler/regress-700883.js
@@ -18,6 +18,7 @@
  return min(y, x);
 }
 
+%PrepareFunctionForOptimization(foo);
 foo();
 %OptimizeFunctionOnNextCall(foo);
 foo();
diff --git a/src/v8/test/mjsunit/compiler/regress-7121.js b/src/v8/test/mjsunit/compiler/regress-7121.js
index 98c1a1a..0cf0dd3 100644
--- a/src/v8/test/mjsunit/compiler/regress-7121.js
+++ b/src/v8/test/mjsunit/compiler/regress-7121.js
@@ -2,9 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --harmony-bigint
+// Flags: --allow-natives-syntax
 
 function foo() { %_ToLength(42n) }
+%PrepareFunctionForOptimization(foo);
 assertThrows(foo, TypeError);
 %OptimizeFunctionOnNextCall(foo);
 assertThrows(foo, TypeError);
diff --git a/src/v8/test/mjsunit/compiler/regress-713367.js b/src/v8/test/mjsunit/compiler/regress-713367.js
index 1bf0a04..b4a6149 100644
--- a/src/v8/test/mjsunit/compiler/regress-713367.js
+++ b/src/v8/test/mjsunit/compiler/regress-713367.js
@@ -27,4 +27,5 @@
   }
 }
 
+%PrepareFunctionForOptimization(f);
 assertThrowsEquals(f, 42);
diff --git a/src/v8/test/mjsunit/compiler/regress-714483.js b/src/v8/test/mjsunit/compiler/regress-714483.js
index 7fc8868..748c28f 100644
--- a/src/v8/test/mjsunit/compiler/regress-714483.js
+++ b/src/v8/test/mjsunit/compiler/regress-714483.js
@@ -17,6 +17,7 @@
   return o.f();
 }
 
+%PrepareFunctionForOptimization(foo);
 foo(o1);
 try { foo(o2); } catch(e) {}
 foo(o1);
diff --git a/src/v8/test/mjsunit/compiler/regress-715651.js b/src/v8/test/mjsunit/compiler/regress-715651.js
index a75adc8..32ab1da 100644
--- a/src/v8/test/mjsunit/compiler/regress-715651.js
+++ b/src/v8/test/mjsunit/compiler/regress-715651.js
@@ -32,6 +32,7 @@
   return o.y;
 }
 
+%PrepareFunctionForOptimization(g);
 g(h());
 g(h());
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/compiler/regress-726554.js b/src/v8/test/mjsunit/compiler/regress-726554.js
index afd8193..f5338aa 100644
--- a/src/v8/test/mjsunit/compiler/regress-726554.js
+++ b/src/v8/test/mjsunit/compiler/regress-726554.js
@@ -21,6 +21,7 @@
 
 h(b, [1073741823, 2147483648, -12]);
 
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/regress-731495.js b/src/v8/test/mjsunit/compiler/regress-731495.js
index 7e0d850..d6fbfeb 100644
--- a/src/v8/test/mjsunit/compiler/regress-731495.js
+++ b/src/v8/test/mjsunit/compiler/regress-731495.js
@@ -10,6 +10,7 @@
   return global;
 };
 
+%PrepareFunctionForOptimization(foo);
 assertEquals(foo(), "bar");
 %OptimizeFunctionOnNextCall(foo);
 assertEquals(foo(), "bar");
diff --git a/src/v8/test/mjsunit/compiler/regress-733181.js b/src/v8/test/mjsunit/compiler/regress-733181.js
index 0a76ab7..fad95ce 100644
--- a/src/v8/test/mjsunit/compiler/regress-733181.js
+++ b/src/v8/test/mjsunit/compiler/regress-733181.js
@@ -8,6 +8,7 @@
   return ("xxxxxxxxxxxxxxxxxxxxxxx" + s).toLowerCase();
 }
 
+%PrepareFunctionForOptimization(l);
 l("abcd");
 l("abcd");
 %OptimizeFunctionOnNextCall(l);
@@ -17,6 +18,7 @@
   return ("xxxxxxxxxxxxxxxxxxxxxxx" + s).toUpperCase();
 }
 
+%PrepareFunctionForOptimization(u);
 u("abcd");
 u("abcd");
 %OptimizeFunctionOnNextCall(u);
diff --git a/src/v8/test/mjsunit/compiler/regress-736567.js b/src/v8/test/mjsunit/compiler/regress-736567.js
index 84c6dce..c42b569 100644
--- a/src/v8/test/mjsunit/compiler/regress-736567.js
+++ b/src/v8/test/mjsunit/compiler/regress-736567.js
@@ -15,6 +15,7 @@
   f(0, "s");
 }
 
+%PrepareFunctionForOptimization(g);
 assertThrows(g);
 %OptimizeFunctionOnNextCall(g);
 assertThrows(g);
diff --git a/src/v8/test/mjsunit/compiler/regress-739902.js b/src/v8/test/mjsunit/compiler/regress-739902.js
index 8f94995..cf8c306 100644
--- a/src/v8/test/mjsunit/compiler/regress-739902.js
+++ b/src/v8/test/mjsunit/compiler/regress-739902.js
@@ -11,6 +11,7 @@
 
   var e = 0x41000001;
 
+  %PrepareFunctionForOptimization(f);
   f(e);
   %OptimizeFunctionOnNextCall(f);
   assertEquals("A", f(e));
@@ -21,6 +22,7 @@
     return (x >>> 24) & 0xffff;
   };
 
+  %PrepareFunctionForOptimization(f);
   f(1);
   %OptimizeFunctionOnNextCall(f);
   assertEquals(0, f(1));
diff --git a/src/v8/test/mjsunit/compiler/regress-758096.js b/src/v8/test/mjsunit/compiler/regress-758096.js
index 1ed32c0..88178ca 100644
--- a/src/v8/test/mjsunit/compiler/regress-758096.js
+++ b/src/v8/test/mjsunit/compiler/regress-758096.js
@@ -16,6 +16,7 @@
     return obj.f();
   }
 
+  %PrepareFunctionForOptimization(f);
   f(x);
   f(y);
   f(x);
@@ -45,6 +46,7 @@
     return fg() + a;
   }
 
+  %PrepareFunctionForOptimization(h);
   h(0);
   h(0);
   h(1);
diff --git a/src/v8/test/mjsunit/compiler/regress-758983.js b/src/v8/test/mjsunit/compiler/regress-758983.js
index 45899c1..93627e3 100644
--- a/src/v8/test/mjsunit/compiler/regress-758983.js
+++ b/src/v8/test/mjsunit/compiler/regress-758983.js
@@ -13,6 +13,7 @@
   return r < 0;
 }
 
+%PrepareFunctionForOptimization(f);
 f(true);
 f(true);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/regress-761892.js b/src/v8/test/mjsunit/compiler/regress-761892.js
index 5423c59..d4ce122 100644
--- a/src/v8/test/mjsunit/compiler/regress-761892.js
+++ b/src/v8/test/mjsunit/compiler/regress-761892.js
@@ -9,6 +9,7 @@
   1.1!=(x||x0)
 }
 
+%PrepareFunctionForOptimization(f);
 f(1.1);
 f(1.1);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/regress-762057.js b/src/v8/test/mjsunit/compiler/regress-762057.js
index 4b5cab6..41942f9 100644
--- a/src/v8/test/mjsunit/compiler/regress-762057.js
+++ b/src/v8/test/mjsunit/compiler/regress-762057.js
@@ -14,6 +14,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(foo);
 let gaga = foo();
 gaga.next();
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/regress-772420.js b/src/v8/test/mjsunit/compiler/regress-772420.js
index 4b58b10..53ca7fb 100644
--- a/src/v8/test/mjsunit/compiler/regress-772420.js
+++ b/src/v8/test/mjsunit/compiler/regress-772420.js
@@ -22,6 +22,7 @@
   return value * undefined;
 }
 
+%PrepareFunctionForOptimization(foo);
 foo(3);
 foo(3);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/regress-772872.js b/src/v8/test/mjsunit/compiler/regress-772872.js
index 345ace8..1e8d824 100644
--- a/src/v8/test/mjsunit/compiler/regress-772872.js
+++ b/src/v8/test/mjsunit/compiler/regress-772872.js
@@ -7,6 +7,7 @@
 function f() {
   for (var x = 10; x > 5; x -= 16) {}
 }
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/regress-773954.js b/src/v8/test/mjsunit/compiler/regress-773954.js
index b78a499..ad1d667 100644
--- a/src/v8/test/mjsunit/compiler/regress-773954.js
+++ b/src/v8/test/mjsunit/compiler/regress-773954.js
@@ -13,6 +13,7 @@
   return 5 + o.x++;
 }
 
+%PrepareFunctionForOptimization(f);
 try {
   f(a);
   f(b);
diff --git a/src/v8/test/mjsunit/compiler/regress-780658.js b/src/v8/test/mjsunit/compiler/regress-780658.js
index 57fdbba..8eade77 100644
--- a/src/v8/test/mjsunit/compiler/regress-780658.js
+++ b/src/v8/test/mjsunit/compiler/regress-780658.js
@@ -19,6 +19,7 @@
     return get1(l);
 }
 
+%PrepareFunctionForOptimization(with_double);
 with_double(.5);
 with_tagged({});
 with_double(.6);
diff --git a/src/v8/test/mjsunit/compiler/regress-786521.js b/src/v8/test/mjsunit/compiler/regress-786521.js
index 2b16127..ae354e3 100644
--- a/src/v8/test/mjsunit/compiler/regress-786521.js
+++ b/src/v8/test/mjsunit/compiler/regress-786521.js
@@ -17,6 +17,7 @@
 inlined(true, 2);
 inlined(false, 1);
 
+%PrepareFunctionForOptimization(foo);
 function foo(b) { inlined(b, "") }
 foo(false); foo(false);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/regress-788539.js b/src/v8/test/mjsunit/compiler/regress-788539.js
index 889090c..b0caa2f 100644
--- a/src/v8/test/mjsunit/compiler/regress-788539.js
+++ b/src/v8/test/mjsunit/compiler/regress-788539.js
@@ -31,6 +31,7 @@
   f2(new C().bar.call(), Object(), String);
 }
 
+%PrepareFunctionForOptimization(f3);
 f3(new Array(1));
 f3(new Array(1));
 %OptimizeFunctionOnNextCall(f3);
diff --git a/src/v8/test/mjsunit/compiler/regress-793863.js b/src/v8/test/mjsunit/compiler/regress-793863.js
index 883805d..a27888e 100644
--- a/src/v8/test/mjsunit/compiler/regress-793863.js
+++ b/src/v8/test/mjsunit/compiler/regress-793863.js
@@ -8,5 +8,6 @@
   return arguments[0];
 }
 
+%PrepareFunctionForOptimization(f);
 %OptimizeFunctionOnNextCall(f);
 assertEquals(undefined, f());
diff --git a/src/v8/test/mjsunit/compiler/regress-796041.js b/src/v8/test/mjsunit/compiler/regress-796041.js
index e2c2e11..ac1d428 100644
--- a/src/v8/test/mjsunit/compiler/regress-796041.js
+++ b/src/v8/test/mjsunit/compiler/regress-796041.js
@@ -29,6 +29,7 @@
   return f(abort, "abc", a, b);
 }
 
+%PrepareFunctionForOptimization(g);
 g(true); g(true); g(true); g(true);
 
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/compiler/regress-797596.js b/src/v8/test/mjsunit/compiler/regress-797596.js
index 4e3594b..54ac741 100644
--- a/src/v8/test/mjsunit/compiler/regress-797596.js
+++ b/src/v8/test/mjsunit/compiler/regress-797596.js
@@ -8,6 +8,7 @@
   var obj = { func() {} };
   gc();
   function wrappedCode() { try { code(); } catch (e) {} }
+  %PrepareFunctionForOptimization(wrappedCode);
   function code() {
     obj.a;
     try {
diff --git a/src/v8/test/mjsunit/compiler/regress-799263.js b/src/v8/test/mjsunit/compiler/regress-799263.js
index b6b1165..a3c94a7 100644
--- a/src/v8/test/mjsunit/compiler/regress-799263.js
+++ b/src/v8/test/mjsunit/compiler/regress-799263.js
@@ -16,6 +16,8 @@
   b[0] = 9.431092e-317;
 }
 
+%PrepareFunctionForOptimization(opt);
+
 let arr1 = new Array(1);
 arr1[0] = 'a';
 opt(arr1, [0]);
diff --git a/src/v8/test/mjsunit/compiler/regress-801097.js b/src/v8/test/mjsunit/compiler/regress-801097.js
index d488ce4..655393a 100644
--- a/src/v8/test/mjsunit/compiler/regress-801097.js
+++ b/src/v8/test/mjsunit/compiler/regress-801097.js
@@ -14,6 +14,7 @@
 }
 
 var func = GetFunction();
+%PrepareFunctionForOptimization(func);
 assertThrows("func();");
 %OptimizeFunctionOnNextCall(func);
 assertThrows("func()");
diff --git a/src/v8/test/mjsunit/compiler/regress-803022.js b/src/v8/test/mjsunit/compiler/regress-803022.js
new file mode 100644
index 0000000..eea7545
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-803022.js
@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  for (var a = 0; a < 2; a++) {
+    if (a === 1) %OptimizeOsr();
+    while (0 && 1) {
+      for (var j = 1; j < 2; j++) { }
+    }
+  }
+}
+
+%PrepareFunctionForOptimization(foo);
+foo();
diff --git a/src/v8/test/mjsunit/compiler/regress-808472.js b/src/v8/test/mjsunit/compiler/regress-808472.js
new file mode 100644
index 0000000..8c8bdf1
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-808472.js
@@ -0,0 +1,12 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function opt() {
+    let opt, arr = [...[...[...[...new Uint8Array(0x10000)]]]];
+    while (arr--)  {
+        opt = ((typeof opt) === 'undefined') ? /a/ : arr;
+    }
+}
+opt();
+opt();
diff --git a/src/v8/test/mjsunit/compiler/regress-815392.js b/src/v8/test/mjsunit/compiler/regress-815392.js
new file mode 100644
index 0000000..367c5e8
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-815392.js
@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const __f_1 = eval(`(function __f_1() {
+    class Derived extends Object {
+      constructor() {
+        ${"this.a=1;".repeat(0x3fffe-8)}
+      }
+    }
+    return Derived;
+})`);
+assertThrows(() => new (__f_1())());
diff --git a/src/v8/test/mjsunit/compiler/regress-817225.js b/src/v8/test/mjsunit/compiler/regress-817225.js
new file mode 100644
index 0000000..9a2d67e
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-817225.js
@@ -0,0 +1,28 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+function inlined(abort, n, a, b) {
+  if (abort) return;
+  var x = a ? true : "" + a;
+  if (!a) {
+    var y = n + y + 10;
+    if(!b) {
+      x = y;
+    }
+    if (x) {
+      x = false;
+    }
+  }
+  return x + 1;
+}
+inlined();
+function optimized(abort, a, b) {
+  return inlined(abort, "abc", a, b);
+}
+%PrepareFunctionForOptimization(optimized);
+optimized(true);
+%OptimizeFunctionOnNextCall(optimized);
+optimized();
diff --git a/src/v8/test/mjsunit/compiler/regress-8380.js b/src/v8/test/mjsunit/compiler/regress-8380.js
new file mode 100644
index 0000000..f825185
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-8380.js
@@ -0,0 +1,34 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function reduceLHS() {
+  for (var i = 0; i < 2 ;i++) {
+    let [q, r] = [1n, 1n];
+    r = r - 1n;
+    q += 1n;
+    q = r;
+  }
+}
+
+%PrepareFunctionForOptimization(reduceLHS);
+reduceLHS();
+%OptimizeFunctionOnNextCall(reduceLHS);
+reduceLHS();
+
+
+function reduceRHS() {
+  for (var i = 0; i < 2 ;i++) {
+    let [q, r] = [1n, 1n];
+    r = 1n - r;
+    q += 1n;
+    q = r;
+  }
+}
+
+%PrepareFunctionForOptimization(reduceRHS);
+reduceRHS();
+%OptimizeFunctionOnNextCall(reduceRHS);
+reduceRHS();
diff --git a/src/v8/test/mjsunit/compiler/regress-841117.js b/src/v8/test/mjsunit/compiler/regress-841117.js
new file mode 100644
index 0000000..313bd39
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-841117.js
@@ -0,0 +1,12 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var v = 1e9;
+function f() { return Math.floor(v / 10); }
+%PrepareFunctionForOptimization(f);
+assertEquals(1e8, f());
+%OptimizeFunctionOnNextCall(f);
+assertEquals(1e8, f());
diff --git a/src/v8/test/mjsunit/compiler/regress-884052.js b/src/v8/test/mjsunit/compiler/regress-884052.js
new file mode 100644
index 0000000..937f976
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-884052.js
@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  var a = new Array(2);
+  for (var i = 1; i > -1; i = i - 2) {
+    if (i < a.length) a = new Array(i);
+  }
+}
+
+%PrepareFunctionForOptimization(foo);
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/compiler/regress-888923.js b/src/v8/test/mjsunit/compiler/regress-888923.js
new file mode 100644
index 0000000..5d3074d
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-888923.js
@@ -0,0 +1,33 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+  function f(o) {
+    o.x;
+    Object.create(o);
+    return o.y.a;
+  }
+
+  %PrepareFunctionForOptimization(f);
+  f({ x : 0, y : { a : 1 } });
+  f({ x : 0, y : { a : 2 } });
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(3, f({ x : 0, y : { a : 3 } }));
+})();
+
+(function() {
+  function f(o) {
+    let a = o.y;
+    Object.create(o);
+    return o.x + a;
+  }
+
+  %PrepareFunctionForOptimization(f);
+  f({ x : 42, y : 21 });
+  f({ x : 42, y : 21 });
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(63, f({ x : 42, y : 21 }));
+})();
diff --git a/src/v8/test/mjsunit/compiler/regress-890057.js b/src/v8/test/mjsunit/compiler/regress-890057.js
new file mode 100644
index 0000000..655c443
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-890057.js
@@ -0,0 +1,16 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {}
+function g() {
+  f.prototype = undefined;
+  f();
+  new f();
+}
+
+// Do not use %OptimizeFunctionOnNextCall here, this particular bug needs
+// to trigger truly concurrent compilation.
+for (let i = 0; i < 10000; i++) g();
diff --git a/src/v8/test/mjsunit/compiler/regress-890620.js b/src/v8/test/mjsunit/compiler/regress-890620.js
new file mode 100644
index 0000000..7723777
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-890620.js
@@ -0,0 +1,26 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = 42;
+
+function g(n) {
+  while (n > 0) {
+    a = new Array(n);
+    n--;
+  }
+}
+
+g(1);
+
+function f() {
+  g();
+}
+
+%PrepareFunctionForOptimization(f);
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
+assertEquals(1, a.length);
diff --git a/src/v8/test/mjsunit/compiler/regress-895799.js b/src/v8/test/mjsunit/compiler/regress-895799.js
new file mode 100644
index 0000000..c45a85f
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-895799.js
@@ -0,0 +1,28 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+class C extends Object {
+  constructor() {
+    try { super(); } catch (e) { };
+    return 1;
+  }
+}
+
+class A extends C {
+  constructor() {
+    super();
+    throw new Error();
+    return { get: () => this };
+  }
+}
+
+%PrepareFunctionForOptimization(A);
+
+var D = new Proxy(A, { get() { %DeoptimizeFunction(A); } });
+
+try { Reflect.construct(A, [], D); } catch(e) {}
+%OptimizeFunctionOnNextCall(A);
+try { Reflect.construct(A, [], D); } catch(e) {}
diff --git a/src/v8/test/mjsunit/compiler/regress-9017.js b/src/v8/test/mjsunit/compiler/regress-9017.js
new file mode 100644
index 0000000..7cbd4e0
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-9017.js
@@ -0,0 +1,39 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --noturbo-inlining --noturbo-verify-allocation
+
+// Ensure that very large stack frames can be used successfully.
+// The flag --noturbo-verify-allocation is to make this run a little faster; it
+// shouldn't affect the behavior.
+
+const frame_size = 4096 * 4;       // 4 pages
+const num_locals = frame_size / 8; // Assume 8-byte floating point values
+
+function f() { return 0.1; }
+
+// Function g, on positive inputs, will call itself recursively. On negative
+// inputs, it does a computation that requires a large number of locals.
+// The flag --noturbo-inlining is important to keep the compiler from realizing
+// that all of this work is for nothing.
+let g_text = "if (input === 0) return; if (input > 0) return g(input - 1);";
+g_text += " var inc = f(); var a0 = 0;";
+for (let i = 1; i < num_locals; ++i) {
+  g_text += " var a" + i + " = a" + (i - 1) + " + inc;";
+}
+g_text += " return f(a0";
+for (let i = 1; i < num_locals; ++i) {
+  g_text += ", a" + i;
+}
+g_text += ");";
+const g = new Function("input", g_text);
+
+%PrepareFunctionForOptimization(g);
+g(1);
+g(-1);
+%OptimizeFunctionOnNextCall(g);
+
+// Use recursion to get past whatever stack space is already committed.
+// 20 * 16kB = 320kB, comfortably below the default 1MB stack reservation limit.
+g(20);
diff --git a/src/v8/test/mjsunit/compiler/regress-902608.js b/src/v8/test/mjsunit/compiler/regress-902608.js
new file mode 100644
index 0000000..faa9ec4
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-902608.js
@@ -0,0 +1,16 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+async function f() {
+  var a = [...new Int8Array([, ...new Uint8Array(65536)])];
+  var p = new Proxy([f], {
+    set: function () { },
+    done: undefined.prototype
+  });
+}
+
+f()
+f();
diff --git a/src/v8/test/mjsunit/compiler/regress-9041.js b/src/v8/test/mjsunit/compiler/regress-9041.js
new file mode 100644
index 0000000..d7a8e6d
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-9041.js
@@ -0,0 +1,23 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+class A {}
+
+function foo(a, fn) {
+  const C = a.constructor;
+  fn(a);
+  return a instanceof C;
+};
+%PrepareFunctionForOptimization(foo);
+assertTrue(foo(new A(), a => {}));
+assertTrue(foo(new A(), a => {}));
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo(new A(), a => {}));
+assertFalse(foo(new A(), a => {
+  a.__proto__ = {};
+}));
+})();
diff --git a/src/v8/test/mjsunit/compiler/regress-905555-2.js b/src/v8/test/mjsunit/compiler/regress-905555-2.js
new file mode 100644
index 0000000..f7e2a72
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-905555-2.js
@@ -0,0 +1,26 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --block-concurrent-recompilation --noalways-opt
+
+global = 1;
+
+function boom(value) {
+  return global;
+}
+
+%PrepareFunctionForOptimization(boom);
+assertEquals(1, boom());
+assertEquals(1, boom());
+%OptimizeFunctionOnNextCall(boom, "concurrent");
+assertEquals(1, boom());
+
+delete this.global;
+
+%UnblockConcurrentRecompilation();
+
+// boom should be deoptimized because the global property cell has changed.
+assertUnoptimized(boom, "sync");
+
+assertThrows(boom);
diff --git a/src/v8/test/mjsunit/compiler/regress-905555.js b/src/v8/test/mjsunit/compiler/regress-905555.js
new file mode 100644
index 0000000..72ccf9a
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-905555.js
@@ -0,0 +1,26 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --block-concurrent-recompilation --noalways-opt
+
+global = 1;
+
+function boom(value) {
+  return global;
+}
+
+%PrepareFunctionForOptimization(boom);
+assertEquals(1, boom());
+assertEquals(1, boom());
+%OptimizeFunctionOnNextCall(boom, "concurrent");
+assertEquals(1, boom());
+
+this.__defineGetter__("global", () => 42);
+
+%UnblockConcurrentRecompilation();
+
+// boom should be deoptimized because the global property cell has changed.
+assertUnoptimized(boom, "sync");
+
+assertEquals(42, boom());
diff --git a/src/v8/test/mjsunit/compiler/regress-9087.js b/src/v8/test/mjsunit/compiler/regress-9087.js
new file mode 100644
index 0000000..ccb885a
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-9087.js
@@ -0,0 +1,21 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function constructor() {}
+const obj = Object.create(constructor.prototype);
+
+for (let i = 0; i < 1020; ++i) {
+  constructor.prototype["x" + i] = 42;
+}
+
+function foo() {
+  return obj instanceof constructor;
+};
+%PrepareFunctionForOptimization(foo);
+assertTrue(foo());
+assertTrue(foo());
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo());
diff --git a/src/v8/test/mjsunit/compiler/regress-910838.js b/src/v8/test/mjsunit/compiler/regress-910838.js
new file mode 100644
index 0000000..e671267
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-910838.js
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(b, s, x) {
+  if (!b) {
+    return (x ? b : s * undefined) ? 1 : 42;
+  }
+}
+
+function g(b, x) {
+  return f(b, 'abc', x);
+}
+
+%PrepareFunctionForOptimization(g);
+f(false, 0, 0);
+g(true, 0);
+%OptimizeFunctionOnNextCall(g);
+assertEquals(42, g(false, 0));
diff --git a/src/v8/test/mjsunit/compiler/regress-913232.js b/src/v8/test/mjsunit/compiler/regress-913232.js
new file mode 100644
index 0000000..46acd81
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-913232.js
@@ -0,0 +1,15 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function* E(b) {
+  while (true) {
+    for (yield* 0; b; yield* 0) {}
+  }
+}
+
+%PrepareFunctionForOptimization(E);
+%OptimizeFunctionOnNextCall(E);
+E();
diff --git a/src/v8/test/mjsunit/compiler/regress-9137-1.js b/src/v8/test/mjsunit/compiler/regress-9137-1.js
new file mode 100644
index 0000000..5743847
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-9137-1.js
@@ -0,0 +1,25 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+// Flags: --no-flush-bytecode --no-stress-flush-bytecode
+
+function changeMap(obj) {
+  obj.blub = 42;
+}
+
+function foo(obj) {
+  return obj.bind(changeMap(obj));
+}
+
+%NeverOptimizeFunction(changeMap);
+%PrepareFunctionForOptimization(foo);
+foo(function(){});
+foo(function(){});
+%OptimizeFunctionOnNextCall(foo);
+foo(function(){});
+%PrepareFunctionForOptimization(foo);
+%OptimizeFunctionOnNextCall(foo);
+foo(function(){});
+assertOptimized(foo);
diff --git a/src/v8/test/mjsunit/compiler/regress-9137-2.js b/src/v8/test/mjsunit/compiler/regress-9137-2.js
new file mode 100644
index 0000000..3642b06
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-9137-2.js
@@ -0,0 +1,29 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+// Flags: --no-flush-bytecode --no-stress-flush-bytecode
+
+function changeMap(obj) {
+  obj.blub = 42;
+}
+
+function reducer(acc, val, i, obj) {
+  return changeMap(obj);
+}
+
+function foo(obj) {
+  return obj.reduce(reducer);
+}
+
+%NeverOptimizeFunction(reducer);
+%PrepareFunctionForOptimization(foo);
+foo([0, 1, 2]);
+foo([0, 1, 2]);
+%OptimizeFunctionOnNextCall(foo);
+foo([0, 1, 2]);
+%PrepareFunctionForOptimization(foo);
+%OptimizeFunctionOnNextCall(foo);
+foo([0, 1, 2]);
+assertOptimized(foo);
diff --git a/src/v8/test/mjsunit/compiler/regress-919754.js b/src/v8/test/mjsunit/compiler/regress-919754.js
new file mode 100644
index 0000000..25d76a0
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-919754.js
@@ -0,0 +1,16 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+
+function f(get, ...a) {
+  for (let i = 0; i < 1000; i++) {
+    if (i === 999) %OptimizeOsr();
+    a.map(f);
+  }
+  return get();
+}
+%PrepareFunctionForOptimization(f);
+assertThrows(f);
diff --git a/src/v8/test/mjsunit/compiler/regress-924151.js b/src/v8/test/mjsunit/compiler/regress-924151.js
new file mode 100644
index 0000000..6454a71
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-924151.js
@@ -0,0 +1,29 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function g(code) {
+  try {
+    if (typeof code === 'function') {
+      +Symbol();
+    } else {
+      eval();
+    }
+  } catch (e) {
+    return;
+  }
+  dummy();
+}
+
+function f() {
+  g(g);
+}
+
+try { g(); } catch(e) {; }
+
+%PrepareFunctionForOptimization(f);
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/compiler/regress-932392.js b/src/v8/test/mjsunit/compiler/regress-932392.js
new file mode 100644
index 0000000..c98686f
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-932392.js
@@ -0,0 +1,14 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function opt(flag){
+  ((flag||(Math.max(-0,0)))==0)
+}
+
+%PrepareFunctionForOptimization(opt);
+try{opt(false)}catch{}
+%OptimizeFunctionOnNextCall(opt)
+try{opt(false)}catch{}
diff --git a/src/v8/test/mjsunit/compiler/regress-934175.js b/src/v8/test/mjsunit/compiler/regress-934175.js
new file mode 100644
index 0000000..af11586
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-934175.js
@@ -0,0 +1,29 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function ShortcutEmptyStringAddRight() {
+  let ar = new Float32Array(1);
+  function opt(i){
+    return ar[i] + (NaN ? 0 : '');
+  }
+  %PrepareFunctionForOptimization(opt);
+  ar[0] = 42;
+  opt(1);
+  %OptimizeFunctionOnNextCall(opt);
+  assertEquals("42", opt(0));
+})();
+
+(function ShortcutiEmptyStringAddLeft() {
+  let ar = new Float32Array(1);
+  function opt(i){
+    return (NaN ? 0 : '') + ar[i];
+  }
+  %PrepareFunctionForOptimization(opt);
+  ar[0] = 42;
+  opt(1);
+  %OptimizeFunctionOnNextCall(opt);
+  assertEquals("42", opt(0));
+})();
diff --git a/src/v8/test/mjsunit/compiler/regress-935092.js b/src/v8/test/mjsunit/compiler/regress-935092.js
new file mode 100644
index 0000000..2a0e5e9
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-935092.js
@@ -0,0 +1,21 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function opt(g) {
+  for (var X = 0; X < 1; X++) {
+    new function() {
+      this.y;
+    }().x;
+    (g || g && (g || -N)(g && 0)).y = 0;
+  }
+  (function() {
+    g;
+  });
+};
+%PrepareFunctionForOptimization(opt);
+opt({});
+%OptimizeFunctionOnNextCall(opt);
+opt({});
diff --git a/src/v8/test/mjsunit/compiler/regress-939316.js b/src/v8/test/mjsunit/compiler/regress-939316.js
new file mode 100644
index 0000000..c3326b6
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-939316.js
@@ -0,0 +1,40 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function JSCreate() {
+  function f(arg) {
+    const o = Reflect.construct(Object, arguments, Proxy);
+    o.foo = arg;
+  }
+
+  function g(i) {
+    f(i);
+  };
+  %PrepareFunctionForOptimization(g);
+  g(0);
+  g(1);
+  %OptimizeFunctionOnNextCall(g);
+  g(2);
+})();
+
+
+(function JSCreateArray() {
+  function f() {
+    try {
+      const o = Reflect.construct(Array, arguments, parseInt);
+    } catch (e) {
+    }
+  }
+
+  function g() {
+    f();
+  };
+  %PrepareFunctionForOptimization(g);
+  g();
+  g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+})();
diff --git a/src/v8/test/mjsunit/compiler/regress-944062-1.js b/src/v8/test/mjsunit/compiler/regress-944062-1.js
new file mode 100644
index 0000000..0367a9a
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-944062-1.js
@@ -0,0 +1,25 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const array = [42, 2.1];  // non-stable map (PACKED_DOUBLE)
+let b = false;
+
+function f() {
+  if (b) array[100000] = 4.2;  // go to dictionary mode
+  return 42;
+};
+%NeverOptimizeFunction(f);
+
+function includes() {
+  return array.includes(f());
+};
+%PrepareFunctionForOptimization(includes);
+assertTrue(includes());
+assertTrue(includes());
+%OptimizeFunctionOnNextCall(includes);
+assertTrue(includes());
+b = true;
+assertTrue(includes());
diff --git a/src/v8/test/mjsunit/compiler/regress-944062-2.js b/src/v8/test/mjsunit/compiler/regress-944062-2.js
new file mode 100644
index 0000000..aa03ce5
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-944062-2.js
@@ -0,0 +1,18 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function includes(key, array) {
+  // Transition to dictionary mode in the final invocation.
+  array.__defineSetter__(key, () => {});
+  // Will then read OOB.
+  return array.includes(1234);
+};
+%PrepareFunctionForOptimization(includes);
+includes('', []);
+includes("", []);
+%OptimizeFunctionOnNextCall(includes);
+includes("", []);
+includes("1235", []);
diff --git a/src/v8/test/mjsunit/compiler/regress-945187.js b/src/v8/test/mjsunit/compiler/regress-945187.js
new file mode 100644
index 0000000..5d7b0da
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-945187.js
@@ -0,0 +1,15 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+  const o = {get: Object};
+  Object.defineProperty(Object, 0, o);
+};
+%PrepareFunctionForOptimization(f);
+f();
+%OptimizeFunctionOnNextCall(f);
+delete Object.fromEntries;
+f();
diff --git a/src/v8/test/mjsunit/compiler/regress-945644.js b/src/v8/test/mjsunit/compiler/regress-945644.js
new file mode 100644
index 0000000..03c0e00
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-945644.js
@@ -0,0 +1,26 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(v5, v6) {
+  const v16 = [1337, 1337, -765470.5051836492];
+  let v19 = 0;
+  do {
+    const v20 = v19 + 1;
+    const v22 = Math.fround(v20);
+    v19 = v22;
+    const v23 = [v20, v22];
+    function v24() {
+      v20;
+      v22;
+    }
+    const v33 = v16.indexOf(v19);
+  } while (v19 < 6);
+};
+%PrepareFunctionForOptimization(f);
+f();
+Array.prototype.push(8);
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/compiler/regress-946889.js b/src/v8/test/mjsunit/compiler/regress-946889.js
new file mode 100644
index 0000000..a66b3b9
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-946889.js
@@ -0,0 +1,18 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+Object.preventExtensions(Array.prototype);
+
+function foo() {
+  var arr = [];
+  [...arr, 42, null];
+  arr.length = 1;
+};
+%PrepareFunctionForOptimization(foo);
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/compiler/regress-949435.js b/src/v8/test/mjsunit/compiler/regress-949435.js
new file mode 100644
index 0000000..d9f989a
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-949435.js
@@ -0,0 +1,16 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+  const v6 = new String();
+  v6.POSITIVE_INFINITY = 1337;
+  const v8 = Object.seal(v6);
+  v8.POSITIVE_INFINITY = Object;
+};
+%PrepareFunctionForOptimization(f);
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/compiler/regress-952586.js b/src/v8/test/mjsunit/compiler/regress-952586.js
new file mode 100644
index 0000000..1fe67b5
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-952586.js
@@ -0,0 +1,15 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+a = new Int8Array(1);
+
+function f(i) {
+  return i in a;
+};
+%PrepareFunctionForOptimization(f);
+assertTrue(f(0));
+%OptimizeFunctionOnNextCall(f);
+assertFalse(f(-1));
diff --git a/src/v8/test/mjsunit/compiler/regress-957559.js b/src/v8/test/mjsunit/compiler/regress-957559.js
new file mode 100644
index 0000000..a21ff34
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-957559.js
@@ -0,0 +1,20 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-always-opt --opt
+
+
+const v0 = [];
+function f(b) {
+  for (let v13 = 0; v13 <= 3; v13 = v13 + 2241165261) {
+    for (let i = 0; i < 8; i++) {}
+    const v23 = Math.max(v13, -0.0, -2523259642);
+    const v24 = v0[v23];
+  }
+};
+%PrepareFunctionForOptimization(f);
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/compiler/regress-958021.js b/src/v8/test/mjsunit/compiler/regress-958021.js
new file mode 100644
index 0000000..072a3e7
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-958021.js
@@ -0,0 +1,23 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function v0() {
+  let v7 = -4294967295;
+  try {
+    for (let v11 = 0; v11 < 8; v11++) {
+      const v13 = Symbol.isConcatSpreadable;
+      const v14 = v11 && v13;
+      const v15 = v7 <= v14;
+      for (var i = 0; i < 10; i++) {}
+    }
+  } catch (v20) {
+  }
+};
+%PrepareFunctionForOptimization(v0);
+v0();
+v0();
+%OptimizeFunctionOnNextCall(v0);
+v0();
diff --git a/src/v8/test/mjsunit/compiler/regress-958350.js b/src/v8/test/mjsunit/compiler/regress-958350.js
new file mode 100644
index 0000000..5f6d916
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-958350.js
@@ -0,0 +1,18 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(o) {
+  for (const x of o) {
+    o[100] = 1;
+    try { x.push(); } catch (e) {}
+  }
+}
+
+%PrepareFunctionForOptimization(foo);
+foo([1]);
+foo([1]);
+%OptimizeFunctionOnNextCall(foo);
+foo([1]);
diff --git a/src/v8/test/mjsunit/compiler/regress-958420.js b/src/v8/test/mjsunit/compiler/regress-958420.js
new file mode 100644
index 0000000..dd7e58d
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-958420.js
@@ -0,0 +1,18 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = [];
+
+function foo() {
+  return a[Symbol.iterator]().next();
+};
+%PrepareFunctionForOptimization(foo);
+a.__proto__.push(5);
+a.bla = {};
+
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/compiler/regress-958716.js b/src/v8/test/mjsunit/compiler/regress-958716.js
new file mode 100644
index 0000000..ee463af
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-958716.js
@@ -0,0 +1,17 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+for (let i = 0; i < 2; i++) {
+  new String().valueOf = Symbol;
+}
+
+function foo() {
+  Promise.resolve("");
+};
+%PrepareFunctionForOptimization(foo);
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/compiler/regress-961986.js b/src/v8/test/mjsunit/compiler/regress-961986.js
new file mode 100644
index 0000000..21e7bf4
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-961986.js
@@ -0,0 +1,17 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  const proto = [];
+  const obj = Object.create(proto);
+  obj[1] = "";
+  proto[1];
+  proto.bla = 42;
+};
+%PrepareFunctionForOptimization(foo);
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/compiler/regress-966560-1.js b/src/v8/test/mjsunit/compiler/regress-966560-1.js
new file mode 100644
index 0000000..e9ccd36
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-966560-1.js
@@ -0,0 +1,25 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+async function __f_3() {
+  return await __f_4();
+}
+async function __f_4() {
+  await x.then();
+  throw new Error();
+};
+%PrepareFunctionForOptimization(__f_4);
+async function __f_5(f) {
+  try {
+    await f();
+  } catch (e) {
+  }
+}
+(async () => {
+  ;
+  %OptimizeFunctionOnNextCall(__f_4);
+  await __f_5(__f_3);
+})();
diff --git a/src/v8/test/mjsunit/compiler/regress-966560-2.js b/src/v8/test/mjsunit/compiler/regress-966560-2.js
new file mode 100644
index 0000000..a4ccd85
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-966560-2.js
@@ -0,0 +1,15 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function* get() {
+  for (let x of [1,2,3]) {
+    yield;
+    get = [];
+  }
+}
+%PrepareFunctionForOptimization(get);
+%OptimizeFunctionOnNextCall(get);
+get();
diff --git a/src/v8/test/mjsunit/compiler/regress-977670.js b/src/v8/test/mjsunit/compiler/regress-977670.js
new file mode 100644
index 0000000..a87963d
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-977670.js
@@ -0,0 +1,21 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  var i;
+  for (i in 'xxxxxxxx') {
+    try { throw 42 } catch (e) {}
+  }
+  print(i);
+  i['' + 'length'] = 42;
+}
+
+%PrepareFunctionForOptimization(foo);
+foo();
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/compiler/regress-arguments.js b/src/v8/test/mjsunit/compiler/regress-arguments.js
index d32b435..70ce05f 100644
--- a/src/v8/test/mjsunit/compiler/regress-arguments.js
+++ b/src/v8/test/mjsunit/compiler/regress-arguments.js
@@ -37,14 +37,19 @@
 
 var foo = 42;
 
+%PrepareFunctionForOptimization(f);
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
+
+%PrepareFunctionForOptimization(g);
 for (var i = 0; i < 3; i++) assertEquals(42, g());
 %OptimizeFunctionOnNextCall(g);
-%OptimizeFunctionOnNextCall(f);
 assertEquals(42, g());
 
+%PrepareFunctionForOptimization(h);
 for (var i = 0; i < 3; i++) assertEquals(42, h());
 %OptimizeFunctionOnNextCall(h);
-%OptimizeFunctionOnNextCall(f);
 assertEquals(42, h());
 
 var G1 = 21;
@@ -58,7 +63,7 @@
 Number.prototype.foo = 42;
 delete Number.prototype.foo;
 
+%PrepareFunctionForOptimization(u);
 for (var i = 0; i < 3; i++) assertEquals(void 0, u());
 %OptimizeFunctionOnNextCall(u);
-%OptimizeFunctionOnNextCall(f);
 assertEquals(void 0, u());
diff --git a/src/v8/test/mjsunit/compiler/regress-closures-with-eval.js b/src/v8/test/mjsunit/compiler/regress-closures-with-eval.js
index d95d128..86ab260 100644
--- a/src/v8/test/mjsunit/compiler/regress-closures-with-eval.js
+++ b/src/v8/test/mjsunit/compiler/regress-closures-with-eval.js
@@ -29,6 +29,7 @@
 
 // Verifies that closures in presence of eval work fine.
 function withEval(expr, filter) {
+  %PrepareFunctionForOptimization(filter);
   function walk(v) {
     for (var i in v) {
       for (var i in v) {}
@@ -47,8 +48,9 @@
   return a;
 }
 
-var expr = '([' + makeTagInfoJSON(128).join(', ') + '])'
+var expr = '([' + makeTagInfoJSON(128).join(', ') + '])';
 
+%PrepareFunctionForOptimization(withEval);
 for (var n = 0; n < 5; n++) {
   withEval(expr, function(a) { return a; });
 }
diff --git a/src/v8/test/mjsunit/compiler/regress-compare-negate.js b/src/v8/test/mjsunit/compiler/regress-compare-negate.js
index e18d6a0..ac420c9 100644
--- a/src/v8/test/mjsunit/compiler/regress-compare-negate.js
+++ b/src/v8/test/mjsunit/compiler/regress-compare-negate.js
@@ -11,6 +11,7 @@
  return a < (sub|0);
 }
 
+%PrepareFunctionForOptimization(CompareNegate);
 var x = CompareNegate(1,0x80000000);
 %OptimizeFunctionOnNextCall(CompareNegate);
 CompareNegate(1,0x80000000);
diff --git a/src/v8/test/mjsunit/compiler/regress-const.js b/src/v8/test/mjsunit/compiler/regress-const.js
index 5099c2f..1c89368 100644
--- a/src/v8/test/mjsunit/compiler/regress-const.js
+++ b/src/v8/test/mjsunit/compiler/regress-const.js
@@ -41,15 +41,20 @@
   return x;
 }
 
+%PrepareFunctionForOptimization(f);
 for (var i = 0; i < 5; i++) {
   f();
-  g();
 }
-
 %OptimizeFunctionOnNextCall(f);
-%OptimizeFunctionOnNextCall(g);
 
 assertEquals(1, f());
+
+%PrepareFunctionForOptimization(g);
+for (var i = 0; i < 5; i++) {
+  g();
+}
+%OptimizeFunctionOnNextCall(g);
+
 assertEquals(42, g());
 
 
@@ -59,6 +64,8 @@
   return r + X;
 }
 
+%PrepareFunctionForOptimization(h);
+
 for (var i = 0; i < 5; i++) h(1,2);
 
 %OptimizeFunctionOnNextCall(h);
diff --git a/src/v8/test/mjsunit/compiler/regress-crbug-540593.js b/src/v8/test/mjsunit/compiler/regress-crbug-540593.js
index ec68e85..46c40cf 100644
--- a/src/v8/test/mjsunit/compiler/regress-crbug-540593.js
+++ b/src/v8/test/mjsunit/compiler/regress-crbug-540593.js
@@ -10,5 +10,6 @@
   function __f_2() { return __v_3(); }
   return __f_2;
 })(this);
+%PrepareFunctionForOptimization(__f_2);
 %OptimizeFunctionOnNextCall(__f_2);
 __f_2();
diff --git a/src/v8/test/mjsunit/compiler/regress-crbug-965513.js b/src/v8/test/mjsunit/compiler/regress-crbug-965513.js
new file mode 100644
index 0000000..349f7bf
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-crbug-965513.js
@@ -0,0 +1,15 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+// Flags: --allow-natives-syntax --opt
+
+%EnsureFeedbackVectorForFunction(foo);
+function foo(x) {
+  return x * (x == 1);
+};
+%PrepareFunctionForOptimization(foo);
+foo(0.5);
+foo(1.5);
+%OptimizeFunctionOnNextCall(foo);
+foo(1.5);
+assertOptimized(foo);
diff --git a/src/v8/test/mjsunit/compiler/regress-crbug-974474.js b/src/v8/test/mjsunit/compiler/regress-crbug-974474.js
new file mode 100644
index 0000000..5f32920
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-crbug-974474.js
@@ -0,0 +1,18 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+    const y = x == 42;
+    () => {y};
+    if (y) { Object(); }
+    [!!y];
+    return y;
+}
+
+%PrepareFunctionForOptimization(foo);
+foo(42); foo(42);
+%OptimizeFunctionOnNextCall(foo);
+foo(42);
diff --git a/src/v8/test/mjsunit/compiler/regress-crbug-974476.js b/src/v8/test/mjsunit/compiler/regress-crbug-974476.js
new file mode 100644
index 0000000..5672f9d
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-crbug-974476.js
@@ -0,0 +1,34 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function use(x) { return x; }
+%NeverOptimizeFunction(use);
+
+function foo() {
+  let result = undefined;
+  (function () {
+    const a = {};
+    for (_ of [0]) {
+      const empty = [];
+      (function () {
+        result = 42;
+        for (_ of [0]) {
+          for (_ of [0]) {
+            use(empty);
+          }
+        }
+        result = a;
+      })();
+    }
+  })();
+  return result;
+}
+
+%PrepareFunctionForOptimization(foo);
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/compiler/regress-dead-throw-inlining.js b/src/v8/test/mjsunit/compiler/regress-dead-throw-inlining.js
index 097a20b..df5b611 100644
--- a/src/v8/test/mjsunit/compiler/regress-dead-throw-inlining.js
+++ b/src/v8/test/mjsunit/compiler/regress-dead-throw-inlining.js
@@ -7,6 +7,7 @@
 function g() { if (false) throw 0; }
 function f() { g(); }
 
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/regress-escape-analysis-indirect.js b/src/v8/test/mjsunit/compiler/regress-escape-analysis-indirect.js
index 01f3e13..255a70a 100644
--- a/src/v8/test/mjsunit/compiler/regress-escape-analysis-indirect.js
+++ b/src/v8/test/mjsunit/compiler/regress-escape-analysis-indirect.js
@@ -9,6 +9,7 @@
   apply(function bogeyman() { value = 42 });
   return value;
 }
+%PrepareFunctionForOptimization(f);
 function apply(fun) { fun() }
 assertEquals(42, f(apply));
 assertEquals(42, f(apply));
diff --git a/src/v8/test/mjsunit/compiler/regress-f64-w32-change.js b/src/v8/test/mjsunit/compiler/regress-f64-w32-change.js
index 834da29..71badcb 100644
--- a/src/v8/test/mjsunit/compiler/regress-f64-w32-change.js
+++ b/src/v8/test/mjsunit/compiler/regress-f64-w32-change.js
@@ -19,5 +19,6 @@
   return f;
 })();
 
+%PrepareFunctionForOptimization(f);
 %OptimizeFunctionOnNextCall(f);
 assertEquals(0, f(0, -1));
diff --git a/src/v8/test/mjsunit/compiler/regress-funarguments.js b/src/v8/test/mjsunit/compiler/regress-funarguments.js
index c913bd9..98c45aa 100644
--- a/src/v8/test/mjsunit/compiler/regress-funarguments.js
+++ b/src/v8/test/mjsunit/compiler/regress-funarguments.js
@@ -62,16 +62,26 @@
   return o.g(x, "z");
 }
 
-function opt() {
+function opt_g() {
+  %PrepareFunctionForOptimization(o.g);
   for (var k=0; k<2; k++) {
     for (var i=0; i<5; i++) o.g(i, "g");
-    for (var j=0; j<5; j++) hej(j);
   }
   %OptimizeFunctionOnNextCall(o.g);
-  %OptimizeFunctionOnNextCall(hej);
+  o.g(0, "g");
 }
 
-opt();
+function opt_hej() {
+  %PrepareFunctionForOptimization(hej);
+  for (var k=0; k<2; k++) {
+    for (var j=0; j<5; j++) hej(j);
+  }
+  %OptimizeFunctionOnNextCall(hej);
+  hej(0)
+}
+
+opt_g();
+opt_hej();
 assertArrayEquals([0, "g"], o.g(0, "g"));
 assertArrayEquals([1, "f"], o.g(1, "g"));
 assertArrayEquals([0, "h"], hej(0));
@@ -79,7 +89,8 @@
 
 o = new B();
 
-opt();
+opt_g();
+opt_hej();
 assertArrayEquals([0, "f"], o.g(0, "g"));
 assertArrayEquals([1, "g"], o.g(1, "g"));
 assertArrayEquals([0, "f"], hej(0));
diff --git a/src/v8/test/mjsunit/compiler/regress-funcaller.js b/src/v8/test/mjsunit/compiler/regress-funcaller.js
index 5c2a597..1cb7f96 100644
--- a/src/v8/test/mjsunit/compiler/regress-funcaller.js
+++ b/src/v8/test/mjsunit/compiler/regress-funcaller.js
@@ -42,6 +42,7 @@
 
 var o = new A();
 
+%PrepareFunctionForOptimization(o.g);
 for (var i=0; i<5; i++) {
   o.g(i);
 }
@@ -56,6 +57,7 @@
   return o.g(x);
 }
 
+%PrepareFunctionForOptimization(hej);
 for (var j=0; j<5; j++) {
   hej(j);
 }
@@ -70,6 +72,7 @@
   return o.g(x);
 }
 
+%PrepareFunctionForOptimization(from_eval);
 for (var j=0; j<5; j++) {
   from_eval(j);
 }
diff --git a/src/v8/test/mjsunit/compiler/regress-gvn.js b/src/v8/test/mjsunit/compiler/regress-gvn.js
index 7055e34..cafb778 100644
--- a/src/v8/test/mjsunit/compiler/regress-gvn.js
+++ b/src/v8/test/mjsunit/compiler/regress-gvn.js
@@ -37,6 +37,8 @@
   return a[0];
 }
 
+%PrepareFunctionForOptimization(test);
+
 var a = new Array();
 
 var n = 100;
diff --git a/src/v8/test/mjsunit/compiler/regress-inline-callfunctionstub.js b/src/v8/test/mjsunit/compiler/regress-inline-callfunctionstub.js
index 3365534..1c391bb 100644
--- a/src/v8/test/mjsunit/compiler/regress-inline-callfunctionstub.js
+++ b/src/v8/test/mjsunit/compiler/regress-inline-callfunctionstub.js
@@ -38,6 +38,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(main);
 main(o.g);
 main(o.g);
 main(o.g);
diff --git a/src/v8/test/mjsunit/compiler/regress-intoverflow.js b/src/v8/test/mjsunit/compiler/regress-intoverflow.js
index 063a376..6c0388b 100644
--- a/src/v8/test/mjsunit/compiler/regress-intoverflow.js
+++ b/src/v8/test/mjsunit/compiler/regress-intoverflow.js
@@ -36,6 +36,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(testMul);
 for (var i=0; i<5; i++) testMul(0,0);
 %OptimizeFunctionOnNextCall(testMul);
 assertEquals(4611686018427388000, testMul(-0x40000000, -0x40000000));
@@ -48,6 +49,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(testAdd);
 for (var i=0; i<5; i++) testAdd(0,0);
 %OptimizeFunctionOnNextCall(testAdd);
 assertEquals(-4294967296, testAdd(-0x40000000, -0x40000000));
@@ -62,6 +64,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(testSub);
 for (var i=0; i<5; i++) testSub(0,0);
 %OptimizeFunctionOnNextCall(testSub);
 assertEquals(-2147483650, testSub(-0x40000000, 1));
diff --git a/src/v8/test/mjsunit/compiler/regress-lazy-deopt.js b/src/v8/test/mjsunit/compiler/regress-lazy-deopt.js
index 7662207..a0d777f 100644
--- a/src/v8/test/mjsunit/compiler/regress-lazy-deopt.js
+++ b/src/v8/test/mjsunit/compiler/regress-lazy-deopt.js
@@ -41,6 +41,7 @@
   return x >> a[0];
 }
 
+%PrepareFunctionForOptimization(f);
 f(42);
 f(42);
 assertEquals(42, f(42));
diff --git a/src/v8/test/mjsunit/compiler/regress-lbranch-double.js b/src/v8/test/mjsunit/compiler/regress-lbranch-double.js
index dca6d5b..304e9a9 100644
--- a/src/v8/test/mjsunit/compiler/regress-lbranch-double.js
+++ b/src/v8/test/mjsunit/compiler/regress-lbranch-double.js
@@ -34,6 +34,7 @@
   return Math.sqrt(2.6415) ? 88 : 99;
 }
 
+%PrepareFunctionForOptimization(foo);
 assertEquals(88, foo());
 assertEquals(88, foo());
 %OptimizeFunctionOnNextCall(foo)
diff --git a/src/v8/test/mjsunit/compiler/regress-loadfield.js b/src/v8/test/mjsunit/compiler/regress-loadfield.js
index a3da156..f8a9891 100644
--- a/src/v8/test/mjsunit/compiler/regress-loadfield.js
+++ b/src/v8/test/mjsunit/compiler/regress-loadfield.js
@@ -46,6 +46,8 @@
   }
 }
 
+%PrepareFunctionForOptimization(test);
+
 // Create an object with fast backing store properties.
 var a = {};
 a.p1 = "";
diff --git a/src/v8/test/mjsunit/compiler/regress-math-sign-nan-type.js b/src/v8/test/mjsunit/compiler/regress-math-sign-nan-type.js
index e16eba8..43f06bd 100644
--- a/src/v8/test/mjsunit/compiler/regress-math-sign-nan-type.js
+++ b/src/v8/test/mjsunit/compiler/regress-math-sign-nan-type.js
@@ -8,6 +8,7 @@
   return Math.sign(+a) < 2;
 }
 
+%PrepareFunctionForOptimization(f);
 f(NaN);
 f(NaN);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/regress-number-is-hole-nan.js b/src/v8/test/mjsunit/compiler/regress-number-is-hole-nan.js
index 368c837..0b618a1 100644
--- a/src/v8/test/mjsunit/compiler/regress-number-is-hole-nan.js
+++ b/src/v8/test/mjsunit/compiler/regress-number-is-hole-nan.js
@@ -8,6 +8,7 @@
 
 function foo() { return a[1]; }
 
+%PrepareFunctionForOptimization(foo);
 assertEquals(2.121736758e-314, foo());
 assertEquals(2.121736758e-314, foo());
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/regress-or.js b/src/v8/test/mjsunit/compiler/regress-or.js
index 939f2c3..e65a554 100644
--- a/src/v8/test/mjsunit/compiler/regress-or.js
+++ b/src/v8/test/mjsunit/compiler/regress-or.js
@@ -38,6 +38,7 @@
 
 function g1() { try { return 1; } finally {} }
 
+%PrepareFunctionForOptimization(f1);
 for (var i = 0; i < 5; i++) f1(42);
 %OptimizeFunctionOnNextCall(f1);
 
@@ -55,6 +56,7 @@
 
 function g2() { try { return 0; } finally {} }
 
+%PrepareFunctionForOptimization(f2);
 for (var i = 0; i < 5; i++) f2(42);
 %OptimizeFunctionOnNextCall(f2);
 
diff --git a/src/v8/test/mjsunit/compiler/regress-rep-change.js b/src/v8/test/mjsunit/compiler/regress-rep-change.js
index c8a0983..a0a0add 100644
--- a/src/v8/test/mjsunit/compiler/regress-rep-change.js
+++ b/src/v8/test/mjsunit/compiler/regress-rep-change.js
@@ -37,6 +37,8 @@
   for (var i = start; i < 10; i++) { }
 }
 
+%PrepareFunctionForOptimization(test);
+
 var n = 3;
 
 for (var i = 0; i < n; ++i) {
diff --git a/src/v8/test/mjsunit/compiler/regress-sealedarray-store-outofbounds.js b/src/v8/test/mjsunit/compiler/regress-sealedarray-store-outofbounds.js
new file mode 100644
index 0000000..4eecf9f
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-sealedarray-store-outofbounds.js
@@ -0,0 +1,19 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+const v3 = [0,"symbol"];
+const v5 = 0 - 1;
+const v6 = Object.seal(v3);
+let v9 = 0;
+function f1() {
+  v6[119090556] = v5;
+}
+%PrepareFunctionForOptimization(f1);
+f1();
+%OptimizeFunctionOnNextCall(f1);
+f1();
+assertOptimized(f1);
+assertEquals(v6.length, 2);
diff --git a/src/v8/test/mjsunit/compiler/regress-shared-deopt.js b/src/v8/test/mjsunit/compiler/regress-shared-deopt.js
index 669e0e2..f1479ba 100644
--- a/src/v8/test/mjsunit/compiler/regress-shared-deopt.js
+++ b/src/v8/test/mjsunit/compiler/regress-shared-deopt.js
@@ -47,11 +47,13 @@
     }
   }
 
+  %PrepareFunctionForOptimization(f4);
   f4(9);
   f4(11);
   %OptimizeFunctionOnNextCall(f4);
   f4(12);
 
+  %PrepareFunctionForOptimization(f5);
   f5(9);
   f5(11);
   %OptimizeFunctionOnNextCall(f5);
diff --git a/src/v8/test/mjsunit/compiler/regress-shift-left.js b/src/v8/test/mjsunit/compiler/regress-shift-left.js
index 110e899..ce9dde4 100644
--- a/src/v8/test/mjsunit/compiler/regress-shift-left.js
+++ b/src/v8/test/mjsunit/compiler/regress-shift-left.js
@@ -14,6 +14,7 @@
     return 1 << tmp1;
   }
 
+  %PrepareFunctionForOptimization(f);
   %OptimizeFunctionOnNextCall(f);
   assertEquals(512, f());
 })();
@@ -36,6 +37,7 @@
     return f;
   })();
 
+  %PrepareFunctionForOptimization(f);
   %OptimizeFunctionOnNextCall(f);
   assertEquals(512, f());
 })();
diff --git a/src/v8/test/mjsunit/compiler/regress-shift-right-logical.js b/src/v8/test/mjsunit/compiler/regress-shift-right-logical.js
index f2be2ad..41ea33a 100644
--- a/src/v8/test/mjsunit/compiler/regress-shift-right-logical.js
+++ b/src/v8/test/mjsunit/compiler/regress-shift-right-logical.js
@@ -14,6 +14,7 @@
     return 1 >>> tmp1;
   }
 
+  %PrepareFunctionForOptimization(f);
   %OptimizeFunctionOnNextCall(f);
   assertEquals(0, f());
 })();
@@ -36,6 +37,7 @@
     return f;
   })();
 
+  %PrepareFunctionForOptimization(f);
   %OptimizeFunctionOnNextCall(f);
   assertEquals(0, f());
 })();
diff --git a/src/v8/test/mjsunit/compiler/regress-shift-right.js b/src/v8/test/mjsunit/compiler/regress-shift-right.js
index 71bcb21..45ee9ef 100644
--- a/src/v8/test/mjsunit/compiler/regress-shift-right.js
+++ b/src/v8/test/mjsunit/compiler/regress-shift-right.js
@@ -14,6 +14,7 @@
     return 1 >> tmp1;
   }
 
+  %PrepareFunctionForOptimization(f);
   %OptimizeFunctionOnNextCall(f);
   assertEquals(0, f());
 })();
@@ -36,6 +37,7 @@
     return f;
   })();
 
+  %PrepareFunctionForOptimization(f);
   %OptimizeFunctionOnNextCall(f);
   assertEquals(0, f());
 })();
diff --git a/src/v8/test/mjsunit/compiler/regress-stacktrace-methods.js b/src/v8/test/mjsunit/compiler/regress-stacktrace-methods.js
index 4d28727..ff3fac7 100644
--- a/src/v8/test/mjsunit/compiler/regress-stacktrace-methods.js
+++ b/src/v8/test/mjsunit/compiler/regress-stacktrace-methods.js
@@ -41,10 +41,16 @@
 var s = new Svin();
 var v = 0;
 
+%PrepareFunctionForOptimization(Hest.prototype.one);
 for (var i = 0; i < 5; i++) {
   o.one(s);
 }
 %OptimizeFunctionOnNextCall(Hest.prototype.one);
+o.one(s);
+%PrepareFunctionForOptimization(Hest.prototype.three);
+for (var i = 0; i < 5; i++) {
+  o.one(s);
+}
 %OptimizeFunctionOnNextCall(Hest.prototype.three);
 o.one(s);
 
@@ -65,5 +71,5 @@
   assertTrue(stack.indexOf("38:56") != -1);
   assertTrue(stack.indexOf("34:51") != -1);
   assertTrue(stack.indexOf("36:38") != -1);
-  assertTrue(stack.indexOf("54:5") != -1);
+  assertTrue(stack.indexOf("60:5") != -1);
 }
diff --git a/src/v8/test/mjsunit/compiler/regress-store-holey-double-array.js b/src/v8/test/mjsunit/compiler/regress-store-holey-double-array.js
index 8123198..2daca73 100644
--- a/src/v8/test/mjsunit/compiler/regress-store-holey-double-array.js
+++ b/src/v8/test/mjsunit/compiler/regress-store-holey-double-array.js
@@ -19,6 +19,7 @@
 
   var a = [,0.1];
 
+  %PrepareFunctionForOptimization(g);
   g(f64, a, 1);
   g(f64, a, 1);
   %OptimizeFunctionOnNextCall(g);
@@ -35,6 +36,8 @@
   }
 
   var a=[,0.1];
+
+  %PrepareFunctionForOptimization(g);
   g(a, 1);
   g(a, 1);
   %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/compiler/regress-string-to-number-add.js b/src/v8/test/mjsunit/compiler/regress-string-to-number-add.js
index 0d524d2..4ba83a2 100644
--- a/src/v8/test/mjsunit/compiler/regress-string-to-number-add.js
+++ b/src/v8/test/mjsunit/compiler/regress-string-to-number-add.js
@@ -9,6 +9,7 @@
   return 1 + Number(s);
 }
 
+%PrepareFunctionForOptimization(f);
 f(0);
 f(0);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/regress-toint32.js b/src/v8/test/mjsunit/compiler/regress-toint32.js
index 75892d4..9840a33 100644
--- a/src/v8/test/mjsunit/compiler/regress-toint32.js
+++ b/src/v8/test/mjsunit/compiler/regress-toint32.js
@@ -38,6 +38,7 @@
   return v;
 }
 
+%PrepareFunctionForOptimization(f);
 assertEquals(G, f(G));
 assertEquals(G, f(G));
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/regress-truncate-number-or-undefined-to-float64.js b/src/v8/test/mjsunit/compiler/regress-truncate-number-or-undefined-to-float64.js
index 1dc3042..7cae7bc 100644
--- a/src/v8/test/mjsunit/compiler/regress-truncate-number-or-undefined-to-float64.js
+++ b/src/v8/test/mjsunit/compiler/regress-truncate-number-or-undefined-to-float64.js
@@ -13,6 +13,7 @@
   return +a;
 }
 
+%PrepareFunctionForOptimization(g);
 g(0);
 g(0);
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/compiler/regress-v8-5573.js b/src/v8/test/mjsunit/compiler/regress-v8-5573.js
index 216b791..2ac503d 100644
--- a/src/v8/test/mjsunit/compiler/regress-v8-5573.js
+++ b/src/v8/test/mjsunit/compiler/regress-v8-5573.js
@@ -11,5 +11,6 @@
   return !global;
 }
 
+%PrepareFunctionForOptimization(f);
 %OptimizeFunctionOnNextCall(f);
 assertTrue(f());
diff --git a/src/v8/test/mjsunit/compiler/regress-v8-5756.js b/src/v8/test/mjsunit/compiler/regress-v8-5756.js
index b7bfcda..f84b6f0 100644
--- a/src/v8/test/mjsunit/compiler/regress-v8-5756.js
+++ b/src/v8/test/mjsunit/compiler/regress-v8-5756.js
@@ -22,6 +22,7 @@
 }
 
 function f1() {
+  %PrepareFunctionForOptimization(k);
   z.toString = k;
   z.toString();
   z.toString();
diff --git a/src/v8/test/mjsunit/compiler/regress-v8-6077.js b/src/v8/test/mjsunit/compiler/regress-v8-6077.js
index 0e46988..f46b2db 100644
--- a/src/v8/test/mjsunit/compiler/regress-v8-6077.js
+++ b/src/v8/test/mjsunit/compiler/regress-v8-6077.js
@@ -63,6 +63,7 @@
   s += i;
 }
 
+%PrepareFunctionForOptimization(foo);
 foo(f32, 0);
 foo(f32, 0);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/regress-v8-6631.js b/src/v8/test/mjsunit/compiler/regress-v8-6631.js
index 58fe360..a28594a 100644
--- a/src/v8/test/mjsunit/compiler/regress-v8-6631.js
+++ b/src/v8/test/mjsunit/compiler/regress-v8-6631.js
@@ -16,6 +16,7 @@
   return g(h({}))
 };
 
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/regress-v8-9113.js b/src/v8/test/mjsunit/compiler/regress-v8-9113.js
new file mode 100644
index 0000000..7dc7651
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-v8-9113.js
@@ -0,0 +1,20 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+let dummy = {x: 0.1};
+
+let o = {x: 0};
+
+function f(o, v) {
+  o.x = v;
+};
+%PrepareFunctionForOptimization(f);
+f(o, 0);
+f(o, 0);
+assertEquals(Infinity, 1 / o.x);
+%OptimizeFunctionOnNextCall(f);
+f(o, -0);
+assertEquals(-Infinity, 1 / o.x);
diff --git a/src/v8/test/mjsunit/compiler/regress-v8-9139.js b/src/v8/test/mjsunit/compiler/regress-v8-9139.js
new file mode 100644
index 0000000..0587bdb
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regress-v8-9139.js
@@ -0,0 +1,20 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+let dummy = { x : {} };
+
+let o = { x : 0.1 };
+
+function f(o, a, b) {
+  o.x = a + b;
+}
+
+%PrepareFunctionForOptimization(f);
+f(o, 0.05, 0.05);
+f(o, 0.05, 0.05);
+%OptimizeFunctionOnNextCall(f);
+f(o, 0.05, 0.05);
+assertOptimized(f);
diff --git a/src/v8/test/mjsunit/compiler/regress-variable-liveness-let.js b/src/v8/test/mjsunit/compiler/regress-variable-liveness-let.js
index 4c6b693..81b55f7 100644
--- a/src/v8/test/mjsunit/compiler/regress-variable-liveness-let.js
+++ b/src/v8/test/mjsunit/compiler/regress-variable-liveness-let.js
@@ -11,5 +11,6 @@
   let x = 23;
 }
 
+%PrepareFunctionForOptimization(f);
 %OptimizeFunctionOnNextCall(f);
 f();
diff --git a/src/v8/test/mjsunit/compiler/regress-variable-liveness.js b/src/v8/test/mjsunit/compiler/regress-variable-liveness.js
index e18741d..086275c 100644
--- a/src/v8/test/mjsunit/compiler/regress-variable-liveness.js
+++ b/src/v8/test/mjsunit/compiler/regress-variable-liveness.js
@@ -17,6 +17,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(run);
 assertEquals(void 0, run());
 %OptimizeFunctionOnNextCall(run);
 assertEquals(void 0, run());
diff --git a/src/v8/test/mjsunit/compiler/regresss-933331.js b/src/v8/test/mjsunit/compiler/regresss-933331.js
new file mode 100644
index 0000000..a4af3a0
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/regresss-933331.js
@@ -0,0 +1,21 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function opt(r, flag){
+  var x;
+  for(let i = 0; i < 2; i++){
+    r[2] = 0;
+    x = r[0] << (flag ? r[0] : flag)
+  }
+  return x;
+}
+
+ar = [3.1];
+%PrepareFunctionForOptimization(opt);
+opt(ar,1);
+opt(ar,1);
+%OptimizeFunctionOnNextCall(opt);
+assertEquals(24, opt(ar,1));
diff --git a/src/v8/test/mjsunit/compiler/rest-parameters.js b/src/v8/test/mjsunit/compiler/rest-parameters.js
index 45b8cb3..425dc1e 100644
--- a/src/v8/test/mjsunit/compiler/rest-parameters.js
+++ b/src/v8/test/mjsunit/compiler/rest-parameters.js
@@ -14,6 +14,8 @@
   return [rest, f.apply(null, rest)];
 }
 
+%PrepareFunctionForOptimization(test);
+
 assertEquals(test(), [[], NaN]);
 assertEquals(test(1), [[1], NaN])
 assertEquals(test(1, 2), [[1,2], 3]);
@@ -37,6 +39,8 @@
   return [rest, a, f.apply(null, rest)];
 }
 
+%PrepareFunctionForOptimization(test);
+
 assertEquals(test(), [[], undefined, NaN]);
 assertEquals(test(1), [[], 1, NaN]);
 assertEquals(test(1, 2), [[2], 1, NaN]);
diff --git a/src/v8/test/mjsunit/compiler/rotate.js b/src/v8/test/mjsunit/compiler/rotate.js
index 1c81e49..b49f4f9 100644
--- a/src/v8/test/mjsunit/compiler/rotate.js
+++ b/src/v8/test/mjsunit/compiler/rotate.js
@@ -64,27 +64,32 @@
   return (x << (sa)) | (x >>> (32 - sa));
 }
 
+%PrepareFunctionForOptimization(ROR);
 assertEquals(1 << ((2 % 32)), ROR(1, 30));
 assertEquals(1 << ((2 % 32)), ROR(1, 30));
 %OptimizeFunctionOnNextCall(ROR);
 assertEquals(1 << ((2 % 32)), ROR(1, 30));
 
+%PrepareFunctionForOptimization(ROR1);
 assertEquals(0xF0000FFF | 0, ROR1(0x0000FFFF, 4));
 assertEquals(0xF0000FFF | 0, ROR1(0x0000FFFF, 4));
 %OptimizeFunctionOnNextCall(ROR1);
 assertEquals(0xF0000FFF | 0, ROR1(0x0000FFFF, 4));
 
+%PrepareFunctionForOptimization(ROR1);
 assertEquals(0x0FFFF000 | 0, ROR1(0x0000FFFF, 20));
 assertEquals(0x0FFFF000 | 0, ROR1(0x0000FFFF, 20));
 %OptimizeFunctionOnNextCall(ROR1);
 assertEquals(0x0FFFF000 | 0, ROR1(0x0000FFFF, 20));
 
+%PrepareFunctionForOptimization(ROR1);
 assertEquals(0x0FFFF000 | 0, ROR1(0x0000FFFF, Twenty()));
 assertEquals(0x0FFFF000 | 0, ROR1(0x0000FFFF, Twenty()));
 %OptimizeFunctionOnNextCall(ROR1);
 assertEquals(0x0FFFF000 | 0, ROR1(0x0000FFFF, Twenty()));
 
 for (var i = 0; i <= 100; i++) {
+  %PrepareFunctionForOptimization(ROR1);
   assertEquals(0xFFFFFFFF | 0, ROR1(0xFFFFFFFF, i));
   assertEquals(0xFFFFFFFF | 0, ROR1(0xFFFFFFFF, i));
   %OptimizeFunctionOnNextCall(ROR1);
@@ -92,6 +97,7 @@
 }
 
 for (var i = 0; i <= 100; i++) {
+  %PrepareFunctionForOptimization(ROR1);
   assertEquals(-1, ROR1(-1, i));
   assertEquals(-1, ROR1(-1, i));
   %OptimizeFunctionOnNextCall(ROR1);
@@ -99,6 +105,7 @@
 }
 
 for (var i = 0; i <= 100; i++) {
+  %PrepareFunctionForOptimization(ROR1);
   assertEquals(1 << (32 - (i % 32)), ROR1(1, i));
   assertEquals(1 << (32 - (i % 32)), ROR1(1, i));
   %OptimizeFunctionOnNextCall(ROR1);
@@ -106,6 +113,7 @@
 }
 
 for (var i = 0; i <= 100; i++) {
+  %PrepareFunctionForOptimization(ROR1);
   assertEquals(1 << (32 - (i % 32)), ROR1(1.4, i));
   assertEquals(1 << (32 - (i % 32)), ROR1(1.4, i));
   %OptimizeFunctionOnNextCall(ROR1);
@@ -114,22 +122,26 @@
 
 
 
+%PrepareFunctionForOptimization(ROR2);
 assertEquals(0xF0000FFF | 0, ROR2(0x0000FFFF, 28));
 assertEquals(0xF0000FFF | 0, ROR2(0x0000FFFF, 28));
 %OptimizeFunctionOnNextCall(ROR2);
 assertEquals(0xF0000FFF | 0, ROR2(0x0000FFFF, 28));
 
+%PrepareFunctionForOptimization(ROR2);
 assertEquals(0x0FFFF000 | 0, ROR2(0x0000FFFF, 12));
 assertEquals(0x0FFFF000 | 0, ROR2(0x0000FFFF, 12));
 %OptimizeFunctionOnNextCall(ROR2);
 assertEquals(0x0FFFF000 | 0, ROR2(0x0000FFFF, 12));
 
+%PrepareFunctionForOptimization(ROR2);
 assertEquals(0x0FFFF000 | 0, ROR2(0x0000FFFF, Twelve()));
 assertEquals(0x0FFFF000 | 0, ROR2(0x0000FFFF, Twelve()));
 %OptimizeFunctionOnNextCall(ROR2);
 assertEquals(0x0FFFF000 | 0, ROR2(0x0000FFFF, Twelve()));
 
 for (var i = 0; i <= 100; i++) {
+  %PrepareFunctionForOptimization(ROR2);
   assertEquals(0xFFFFFFFF | 0, ROR2(0xFFFFFFFF, i));
   assertEquals(0xFFFFFFFF | 0, ROR2(0xFFFFFFFF, i));
   %OptimizeFunctionOnNextCall(ROR2);
@@ -137,6 +149,7 @@
 }
 
 for (var i = 0; i <= 100; i++) {
+  %PrepareFunctionForOptimization(ROR2);
   assertEquals(-1, ROR2(-1, i));
   assertEquals(-1, ROR2(-1, i));
   %OptimizeFunctionOnNextCall(ROR2);
@@ -144,28 +157,33 @@
 }
 
 for (var i = 0; i <= 100; i++) {
+  %PrepareFunctionForOptimization(ROR2);
   assertEquals(1 << ((i % 32)), ROR2(1, i));
   assertEquals(1 << ((i % 32)), ROR2(1, i));
   %OptimizeFunctionOnNextCall(ROR2);
   assertEquals(1 << ((i % 32)), ROR2(1, i));
 }
 
+%PrepareFunctionForOptimization(ROR3);
 assertEquals(0xF0000FFF | 0, ROR3(0x0000FFFF, 4));
 assertEquals(0xF0000FFF | 0, ROR3(0x0000FFFF, 4));
 %OptimizeFunctionOnNextCall(ROR3);
 assertEquals(0xF0000FFF | 0, ROR3(0x0000FFFF, 4));
 
+%PrepareFunctionForOptimization(ROR3);
 assertEquals(0x0FFFF000 | 0, ROR3(0x0000FFFF, 20));
 assertEquals(0x0FFFF000 | 0, ROR3(0x0000FFFF, 20));
 %OptimizeFunctionOnNextCall(ROR3);
 assertEquals(0x0FFFF000 | 0, ROR3(0x0000FFFF, 20));
 
+%PrepareFunctionForOptimization(ROR3);
 assertEquals(0x0FFFF000 | 0, ROR3(0x0000FFFF, Twenty()));
 assertEquals(0x0FFFF000 | 0, ROR3(0x0000FFFF, Twenty()));
 %OptimizeFunctionOnNextCall(ROR3);
 assertEquals(0x0FFFF000 | 0, ROR3(0x0000FFFF, Twenty()));
 
 for (var i = 0; i <= 100; i++) {
+  %PrepareFunctionForOptimization(ROR3);
   assertEquals(0xFFFFFFFF | 0, ROR3(0xFFFFFFFF, i));
   assertEquals(0xFFFFFFFF | 0, ROR3(0xFFFFFFFF, i));
   %OptimizeFunctionOnNextCall(ROR3);
@@ -173,6 +191,7 @@
 }
 
 for (var i = 0; i <= 100; i++) {
+  %PrepareFunctionForOptimization(ROR3);
   assertEquals(-1, ROR3(-1, i));
   assertEquals(-1, ROR3(-1, i));
   %OptimizeFunctionOnNextCall(ROR3);
@@ -180,28 +199,33 @@
 }
 
 for (var i = 0; i <= 100; i++) {
+  %PrepareFunctionForOptimization(ROR3);
   assertEquals(1 << (32 - (i % 32)), ROR3(1, i));
   assertEquals(1 << (32 - (i % 32)), ROR3(1, i));
   %OptimizeFunctionOnNextCall(ROR3);
   assertEquals(1 << (32 - (i % 32)), ROR3(1, i));
 }
 
+%PrepareFunctionForOptimization(ROR4);
 assertEquals(0xF0000FFF | 0, ROR4(0x0000FFFF, 28));
 assertEquals(0xF0000FFF | 0, ROR4(0x0000FFFF, 28));
 %OptimizeFunctionOnNextCall(ROR4);
 assertEquals(0xF0000FFF | 0, ROR4(0x0000FFFF, 28));
 
+%PrepareFunctionForOptimization(ROR4);
 assertEquals(0x0FFFF000 | 0, ROR4(0x0000FFFF, 12));
 assertEquals(0x0FFFF000 | 0, ROR4(0x0000FFFF, 12));
 %OptimizeFunctionOnNextCall(ROR4);
 assertEquals(0x0FFFF000 | 0, ROR4(0x0000FFFF, 12));
 
+%PrepareFunctionForOptimization(ROR4);
 assertEquals(0x0FFFF000 | 0, ROR4(0x0000FFFF, Twelve()));
 assertEquals(0x0FFFF000 | 0, ROR4(0x0000FFFF, Twelve()));
 %OptimizeFunctionOnNextCall(ROR4);
 assertEquals(0x0FFFF000 | 0, ROR4(0x0000FFFF, Twelve()));
 
 for (var i = 0; i <= 100; i++) {
+  %PrepareFunctionForOptimization(ROR4);
   assertEquals(0xFFFFFFFF | 0, ROR4(0xFFFFFFFF, i));
   assertEquals(0xFFFFFFFF | 0, ROR4(0xFFFFFFFF, i));
   %OptimizeFunctionOnNextCall(ROR4);
@@ -209,6 +233,7 @@
 }
 
 for (var i = 0; i <= 100; i++) {
+  %PrepareFunctionForOptimization(ROR4);
   assertEquals(-1, ROR4(-1, i));
   assertEquals(-1, ROR4(-1, i));
   %OptimizeFunctionOnNextCall(ROR4);
@@ -216,6 +241,7 @@
 }
 
 for (var i = 0; i <= 100; i++) {
+  %PrepareFunctionForOptimization(ROR4);
   assertEquals(1 << ((i % 32)), ROR4(1, i));
   assertEquals(1 << ((i % 32)), ROR4(1, i));
   %OptimizeFunctionOnNextCall(ROR4);
@@ -260,48 +286,56 @@
 }
 
 // ROR1_sa20
+%PrepareFunctionForOptimization(ROR1_sa20);
 assertEquals(ROR1(0x0000FFFF, 20), ROR1_sa20(0x0000FFFF));
 assertEquals(ROR1(0x0000FFFF, 20), ROR1_sa20(0x0000FFFF));
 %OptimizeFunctionOnNextCall(ROR1_sa20);
 assertEquals(ROR1(0x0000FFFF, 20), ROR1_sa20(0x0000FFFF));
 
 // ROR1_sa40
+%PrepareFunctionForOptimization(ROR1_sa40);
 assertEquals(ROR1(0x0000FFFF, 40), ROR1_sa40(0x0000FFFF));
 assertEquals(ROR1(0x0000FFFF, 40), ROR1_sa40(0x0000FFFF));
 %OptimizeFunctionOnNextCall(ROR1_sa40);
 assertEquals(ROR1(0x0000FFFF, 40), ROR1_sa40(0x0000FFFF));
 
 // ROR2_sa20
+%PrepareFunctionForOptimization(ROR2_sa20);
 assertEquals(ROR2(0xFFFFFFFF, 20), ROR2_sa20(0xFFFFFFFF));
 assertEquals(ROR2(0xFFFFFFFF, 20), ROR2_sa20(0xFFFFFFFF));
 %OptimizeFunctionOnNextCall(ROR2_sa20);
 assertEquals(ROR2(0xFFFFFFFF, 20), ROR2_sa20(0xFFFFFFFF));
 
 // ROR2_sa40
+%PrepareFunctionForOptimization(ROR2_sa40);
 assertEquals(ROR2(0x0000FFFF, 40), ROR2_sa40(0x0000FFFF));
 assertEquals(ROR2(0x0000FFFF, 40), ROR2_sa40(0x0000FFFF));
 %OptimizeFunctionOnNextCall(ROR2_sa40);
 assertEquals(ROR2(0x0000FFFF, 40), ROR2_sa40(0x0000FFFF));
 
 // ROR3_sa20
+%PrepareFunctionForOptimization(ROR3_sa20);
 assertEquals(ROR3(0x0000FFFF, 20), ROR3_sa20(0x0000FFFF));
 assertEquals(ROR3(0x0000FFFF, 20), ROR3_sa20(0x0000FFFF));
 %OptimizeFunctionOnNextCall(ROR3_sa20);
 assertEquals(ROR3(0x0000FFFF, 20), ROR3_sa20(0x0000FFFF));
 
 // ROR3_sa40
+%PrepareFunctionForOptimization(ROR3_sa40);
 assertEquals(ROR3(0x0000FFFF, 40), ROR3_sa40(0x0000FFFF));
 assertEquals(ROR3(0x0000FFFF, 40), ROR3_sa40(0x0000FFFF));
 %OptimizeFunctionOnNextCall(ROR3_sa40);
 assertEquals(ROR3(0x0000FFFF, 40), ROR3_sa40(0x0000FFFF));
 
 // ROR4_sa20
+%PrepareFunctionForOptimization(ROR4_sa20);
 assertEquals(ROR4(0x0000FFFF, 20), ROR4_sa20(0x0000FFFF));
 assertEquals(ROR4(0x0000FFFF, 20), ROR4_sa20(0x0000FFFF));
 %OptimizeFunctionOnNextCall(ROR4_sa20);
 assertEquals(ROR4(0x0000FFFF, 20), ROR4_sa20(0x0000FFFF));
 
 // ROR4_sa40
+%PrepareFunctionForOptimization(ROR4_sa40);
 assertEquals(ROR4(0xFFFFFFFF, 40), ROR4_sa40(0xFFFFFFFF));
 assertEquals(ROR4(0xFFFFFFFF, 40), ROR4_sa40(0xFFFFFFFF));
 %OptimizeFunctionOnNextCall(ROR4_sa40);
diff --git a/src/v8/test/mjsunit/compiler/shift-shr.js b/src/v8/test/mjsunit/compiler/shift-shr.js
index c52ad43..e2bf7ab 100644
--- a/src/v8/test/mjsunit/compiler/shift-shr.js
+++ b/src/v8/test/mjsunit/compiler/shift-shr.js
@@ -19,6 +19,7 @@
   return errors;
 }
 
+%PrepareFunctionForOptimization(test_shr);
 assertEquals(0, test_shr(1));
 %OptimizeFunctionOnNextCall(test_shr);
 for (var i = 5; i >= -5; i--) {
@@ -34,6 +35,7 @@
     return array[y];
   }
 
+  %PrepareFunctionForOptimization(foo);
   foo(111, true, new Array(42));
   foo(111, true, new Array(42));
   %OptimizeFunctionOnNextCall(foo);
@@ -48,6 +50,7 @@
     return array[y];
   }
 
+  %PrepareFunctionForOptimization(foo);
   foo(111, true, new Array(42));
   foo(111, true, new Array(42));
   %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/simple-deopt.js b/src/v8/test/mjsunit/compiler/simple-deopt.js
index 7f985ac..99b7ef3 100644
--- a/src/v8/test/mjsunit/compiler/simple-deopt.js
+++ b/src/v8/test/mjsunit/compiler/simple-deopt.js
@@ -61,6 +61,7 @@
 function k(o) {
   return o.g();
 }
+%PrepareFunctionForOptimization(k);
 for (var i = 0; i < 5; i++) k(obj);
 %OptimizeFunctionOnNextCall(k);
 k(obj);
@@ -92,6 +93,7 @@
 var str = "abc";
 var r;
 function CallCharAt(n) { return str.charAt(n); }
+%PrepareFunctionForOptimization(CallCharAt);
 for (var i = 0; i < 5; i++) {
   r = CallCharAt(0);
 }
diff --git a/src/v8/test/mjsunit/compiler/simple-inlining.js b/src/v8/test/mjsunit/compiler/simple-inlining.js
index 8bd37ea..3899cf0 100644
--- a/src/v8/test/mjsunit/compiler/simple-inlining.js
+++ b/src/v8/test/mjsunit/compiler/simple-inlining.js
@@ -43,6 +43,7 @@
 
 var o1 = {};
 o1.f = function() { return 42; };
+%PrepareFunctionForOptimization(TestInlineConstant);
 for (var i = 0; i < 5; i++) TestInlineConstant(o1);
 %OptimizeFunctionOnNextCall(TestInlineConstant);
 TestInlineConstant(o1);
@@ -65,6 +66,7 @@
 
 var o2 = {};
 o2.g = function() { return this; };
+%PrepareFunctionForOptimization(TestInlineThis);
 for (var i = 0; i < 5; i++) TestInlineThis(o2);
 %OptimizeFunctionOnNextCall(TestInlineThis);
 TestInlineThis(o2);
@@ -87,6 +89,7 @@
 
 var o3 = {y:0,x:42};
 o3.h = function() { return this.x; };
+%PrepareFunctionForOptimization(TestInlineThisX);
 for (var i = 0; i < 5; i++) TestInlineThisX(o3);
 %OptimizeFunctionOnNextCall(TestInlineThisX);
 TestInlineThisX(o3);
@@ -109,6 +112,7 @@
 
 var o4 = {x:[1,2,3]};
 o4.h = function() { return this.x.length; };
+%PrepareFunctionForOptimization(TestInlineThisXLength);
 for (var i = 0; i < 5; i++) TestInlineThisXLength(o4);
 %OptimizeFunctionOnNextCall(TestInlineThisXLength);
 TestInlineThisXLength(o4);
@@ -132,6 +136,7 @@
 var o6 = {y:42}
 var o5 = {e:o6};
 o5.h = function() { return this.e.y; };
+%PrepareFunctionForOptimization(TestInlineThisXY);
 for (var i = 0; i < 5; i++) TestInlineThisXY(o5);
 %OptimizeFunctionOnNextCall(TestInlineThisXY);
 TestInlineThisXY(o5);
@@ -154,6 +159,7 @@
 
 var o7 = {x:[42,43,44]};
 o7.foo = function() { return this.x[0]; };
+%PrepareFunctionForOptimization(TestInlineThisX0);
 for (var i = 0; i < 5; i++) TestInlineThisX0(o7);
 %OptimizeFunctionOnNextCall(TestInlineThisX0);
 TestInlineThisX0(o7);
diff --git a/src/v8/test/mjsunit/compiler/smi-stores-opt.js b/src/v8/test/mjsunit/compiler/smi-stores-opt.js
index ca0923a..0ee7175 100644
--- a/src/v8/test/mjsunit/compiler/smi-stores-opt.js
+++ b/src/v8/test/mjsunit/compiler/smi-stores-opt.js
@@ -43,6 +43,7 @@
   return [result, literal];
 }
 
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/spread-call.js b/src/v8/test/mjsunit/compiler/spread-call.js
index 1b7ae6f..12234ed 100644
--- a/src/v8/test/mjsunit/compiler/spread-call.js
+++ b/src/v8/test/mjsunit/compiler/spread-call.js
@@ -14,6 +14,9 @@
   assertEquals(3, countArgs(...[1.1, 2, 3]));                     // Double
   assertEquals(4, countArgs(...[1.1, 2, , 3]));                   // HoleyDouble
   assertEquals(3, countArgs(...[{valueOf: () => 0}, 1.1, '2']));  // Object
+  assertEquals(3, countArgs(...Object.freeze([{valueOf: () => 0}, 1.1, '2'])));  // Frozen Object
+  assertEquals(3, countArgs(...Object.seal([{valueOf: () => 0}, 1.1, '2'])));  // Sealed Object
+  assertEquals(3, countArgs(...Object.preventExtensions([{valueOf: () => 0}, 1.1, '2'])));  // Non-extensible Object
   assertEquals(
       4, countArgs(...[{valueOf: () => 0}, 1.1, , '2']));  // HoleyObject
 
@@ -27,6 +30,7 @@
   assertEquals(0, countArgs(...arguments));
 }
 
+%PrepareFunctionForOptimization(tests);
 tests();
 tests();
 %OptimizeFunctionOnNextCall(tests);
@@ -38,6 +42,7 @@
   assertEquals(4, countArgs(1, ...args));
   assertEquals(5, countArgs(1, 2, ...args));
 }
+%PrepareFunctionForOptimization(testRest);
 testRest(1, 2, 3);
 testRest(1, 2, 3);
 %OptimizeFunctionOnNextCall(testRest);
@@ -51,6 +56,7 @@
   assertEquals(4, countArgs(1, a, b, ...args));
   assertEquals(5, countArgs(1, 2, a, b, ...args));
 }
+%PrepareFunctionForOptimization(testRestAndArgs);
 testRestAndArgs(1, 2, 3);
 testRestAndArgs(1, 2, 3);
 %OptimizeFunctionOnNextCall(testRestAndArgs);
@@ -63,6 +69,7 @@
   assertEquals(4, countArgs(1, ...arguments));
   assertEquals(5, countArgs(1, 2, ...arguments));
 }
+%PrepareFunctionForOptimization(testArgumentsStrict);
 testArgumentsStrict(1, 2, 3);
 testArgumentsStrict(1, 2, 3);
 %OptimizeFunctionOnNextCall(testArgumentsStrict);
@@ -74,6 +81,7 @@
   assertEquals(4, countArgs(1, ...arguments));
   assertEquals(5, countArgs(1, 2, ...arguments));
 }
+%PrepareFunctionForOptimization(testArgumentsSloppy);
 testArgumentsSloppy(1, 2, 3);
 testArgumentsSloppy(1, 2, 3);
 %OptimizeFunctionOnNextCall(testArgumentsSloppy);
diff --git a/src/v8/test/mjsunit/compiler/store-elimination.js b/src/v8/test/mjsunit/compiler/store-elimination.js
index 1806ed9..7defdd0 100644
--- a/src/v8/test/mjsunit/compiler/store-elimination.js
+++ b/src/v8/test/mjsunit/compiler/store-elimination.js
@@ -81,6 +81,7 @@
 %NeverOptimizeFunction(killall);
 
 function test(x, f) {
+  %PrepareFunctionForOptimization(f);
   assertEquals(x, f());
   assertEquals(x, f());
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/stress-deopt-count-1.js b/src/v8/test/mjsunit/compiler/stress-deopt-count-1.js
index 834a873..5c0e7b7 100644
--- a/src/v8/test/mjsunit/compiler/stress-deopt-count-1.js
+++ b/src/v8/test/mjsunit/compiler/stress-deopt-count-1.js
@@ -10,6 +10,7 @@
   return x + 1;
 }
 
+%PrepareFunctionForOptimization(f);
 f(0);
 %OptimizeFunctionOnNextCall(f);
 
diff --git a/src/v8/test/mjsunit/compiler/stress-deopt-count-2.js b/src/v8/test/mjsunit/compiler/stress-deopt-count-2.js
index 641a9e8..d91086a 100644
--- a/src/v8/test/mjsunit/compiler/stress-deopt-count-2.js
+++ b/src/v8/test/mjsunit/compiler/stress-deopt-count-2.js
@@ -11,6 +11,7 @@
   return x + 1;
 }
 
+%PrepareFunctionForOptimization(f);
 f(1);
 %OptimizeFunctionOnNextCall(f);
 
@@ -32,6 +33,7 @@
 
 // stress_deopt_count == 6
 
+%PrepareFunctionForOptimization(f);
 %OptimizeFunctionOnNextCall(f);
 f(1);
 assertOptimized(f, undefined, undefined, false);
diff --git a/src/v8/test/mjsunit/compiler/strict-equal-number.js b/src/v8/test/mjsunit/compiler/strict-equal-number.js
new file mode 100644
index 0000000..de98b8f
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/strict-equal-number.js
@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Make sure that we don't incorrectly truncate Oddball
+// to Number for strict equality comparisons.
+(function() {
+  function foo(x, y) { return x === y; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(0.1, 0.1));
+  assertTrue(foo(undefined, undefined));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(undefined, undefined));
+})();
diff --git a/src/v8/test/mjsunit/compiler/strict-equal-receiver.js b/src/v8/test/mjsunit/compiler/strict-equal-receiver.js
new file mode 100644
index 0000000..016e077
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/strict-equal-receiver.js
@@ -0,0 +1,161 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --noalways-opt
+
+// Known receivers strict equality.
+(function() {
+  const a = {};
+  const b = {};
+
+  function foo() { return a === b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo());
+  assertFalse(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo());
+})();
+
+// Known receiver/null strict equality.
+(function() {
+  const a = {};
+  const b = null;
+
+  function foo() { return a === b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo());
+  assertFalse(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo());
+})();
+
+// Known receiver/undefined strict equality.
+(function() {
+  const a = {};
+  const b = undefined;
+
+  function foo() { return a === b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo());
+  assertFalse(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo());
+})();
+
+// Known receiver on one side strict equality.
+(function() {
+  const a = {};
+  const b = {};
+
+  function foo(a) { return a === b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+})();
+
+// Known receiver on one side strict equality.
+(function() {
+  const a = {};
+  const b = null;
+
+  function foo(a) { return a === b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+})();
+
+// Known receiver on one side strict equality.
+(function() {
+  const a = {};
+  const b = undefined;
+
+  function foo(a) { return a === b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+})();
+
+// Feedback based receiver strict equality.
+(function() {
+  const a = {};
+  const b = {};
+
+  function foo(a, b) { return a === b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(b, b));
+  assertFalse(foo(a, b));
+  assertTrue(foo(a, a));
+  assertFalse(foo(b, a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(a, a));
+  assertFalse(foo(b, a));
+
+  // TurboFan bakes in feedback for the left hand side.
+  assertFalse(foo(null, b));
+  assertUnoptimized(foo);
+})();
+
+// Feedback based receiver/null strict equality.
+(function() {
+  const a = {};
+  const b = null;
+
+  function foo(a, b) { return a === b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(b, b));
+  assertFalse(foo(a, b));
+  assertTrue(foo(a, a));
+  assertFalse(foo(b, a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(a, a));
+  assertFalse(foo(b, a));
+
+  // TurboFan bakes in feedback for the left hand side.
+  assertFalse(foo(1, b));
+  assertUnoptimized(foo);
+})();
+
+// Feedback based receiver/undefined strict equality.
+(function() {
+  const a = {};
+  const b = undefined;
+
+  function foo(a, b) { return a === b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(b, b));
+  assertFalse(foo(a, b));
+  assertTrue(foo(a, a));
+  assertFalse(foo(b, a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(a, a));
+  assertFalse(foo(b, a));
+
+  // TurboFan bakes in feedback for the left hand side.
+  assertFalse(foo(1, b));
+  assertUnoptimized(foo);
+})();
diff --git a/src/v8/test/mjsunit/compiler/strict-equal-symbol.js b/src/v8/test/mjsunit/compiler/strict-equal-symbol.js
new file mode 100644
index 0000000..2cbb8d2
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/strict-equal-symbol.js
@@ -0,0 +1,53 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Known symbols strict equality.
+(function() {
+  const a = Symbol("a");
+  const b = Symbol("b");
+
+  function foo() { return a === b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo());
+  assertFalse(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo());
+})();
+
+// Known symbol on one side strict equality.
+(function() {
+  const a = Symbol("a");
+  const b = Symbol("b");
+
+  function foo(a) { return a === b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(b));
+  assertFalse(foo(a));
+})();
+
+// Feedback based symbol strict equality.
+(function() {
+  const a = Symbol("a");
+  const b = Symbol("b");
+
+  function foo(a, b) { return a === b; }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(b, b));
+  assertFalse(foo(a, b));
+  assertTrue(foo(a, a));
+  assertFalse(foo(b, a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(a, a));
+  assertFalse(foo(b, a));
+})();
diff --git a/src/v8/test/mjsunit/compiler/strict-recompile.js b/src/v8/test/mjsunit/compiler/strict-recompile.js
index 96e8bca..acd3fb2 100644
--- a/src/v8/test/mjsunit/compiler/strict-recompile.js
+++ b/src/v8/test/mjsunit/compiler/strict-recompile.js
@@ -46,6 +46,7 @@
 }
 
 var eval_foo = do_eval('(' + foo + ')');
+%PrepareFunctionForOptimization(eval_foo);
 for (var i = 0; i < 5; i++) assertTrue(eval_foo());
 %OptimizeFunctionOnNextCall(eval_foo);
 assertTrue(eval_foo());
diff --git a/src/v8/test/mjsunit/compiler/string-add-try-catch.js b/src/v8/test/mjsunit/compiler/string-add-try-catch.js
index d7a3d25..45eef99 100644
--- a/src/v8/test/mjsunit/compiler/string-add-try-catch.js
+++ b/src/v8/test/mjsunit/compiler/string-add-try-catch.js
@@ -4,6 +4,9 @@
 
 // Flags: --allow-natives-syntax
 
+// Test that string concatenation overflow (going over string max length)
+// is handled gracefully, i.e. an error is thrown
+
 var a = "a".repeat(%StringMaxLength());
 
 (function() {
@@ -15,6 +18,7 @@
     }
   }
 
+  %PrepareFunctionForOptimization(foo);
   foo("a");
   foo("a");
   %OptimizeFunctionOnNextCall(foo);
@@ -31,6 +35,64 @@
     }
   }
 
+  %PrepareFunctionForOptimization(foo);
+  foo("a");
+  foo("a");
+  %OptimizeFunctionOnNextCall(foo);
+  foo("a");
+  assertInstanceof(foo(a), RangeError);
+})();
+
+(function() {
+  function foo(a, b) {
+    try {
+      return "0123456789012".concat(a);
+    } catch (e) {
+      return e;
+    }
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  foo("a");
+  foo("a");
+  %OptimizeFunctionOnNextCall(foo);
+  foo("a");
+  assertInstanceof(foo(a), RangeError);
+})();
+
+var obj = {
+  toString: function() {
+    throw new Error('toString has thrown');
+  }
+};
+
+(function() {
+  function foo(a, b) {
+    try {
+      return "0123456789012" + obj;
+    } catch (e) {
+      return e;
+    }
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  foo("a");
+  foo("a");
+  %OptimizeFunctionOnNextCall(foo);
+  foo("a");
+  assertInstanceof(foo(a), Error);
+})();
+
+(function() {
+  function foo(a, b) {
+    try {
+      return a + 123;
+    } catch (e) {
+      return e;
+    }
+  }
+
+  %PrepareFunctionForOptimization(foo);
   foo("a");
   foo("a");
   %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/compiler/string-comparison-opt.js b/src/v8/test/mjsunit/compiler/string-comparison-opt.js
new file mode 100644
index 0000000..3aa68e0
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/string-comparison-opt.js
@@ -0,0 +1,267 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license
+// that can be found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) == "";
+  }
+  %PrepareFunctionForOptimization(f);
+  assertEquals(false, f("aaa"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(false, f("aaa"));
+})();
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) < "";
+  }
+  %PrepareFunctionForOptimization(f);
+  assertEquals(false, f("aaa"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(false, f("aaa"));
+})();
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) <= "";
+  }
+  %PrepareFunctionForOptimization(f);
+  assertEquals(false, f("aaa"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(false, f("aaa"));
+})();
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) > "";
+  }
+  %PrepareFunctionForOptimization(f);
+  assertEquals(true, f("aaa"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(true, f("aaa"));
+})();
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) >= "";
+  }
+  %PrepareFunctionForOptimization(f);
+  assertEquals(true, f("aaa"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(true, f("aaa"));
+})();
+
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) == a.charAt(2);
+  }
+  %PrepareFunctionForOptimization(f);
+  assertEquals(false, f("aab"));
+  assertEquals(true, f("aaa"));
+  assertEquals(false, f("acb"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(false, f("aab"));
+  assertEquals(true, f("aaa"));
+  assertEquals(false, f("acb"));
+})();
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) < a.charAt(2);
+  }
+  %PrepareFunctionForOptimization(f);
+  assertEquals(true, f("aab"));
+  assertEquals(false, f("aaa"));
+  assertEquals(false, f("acb"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(true, f("aab"));
+  assertEquals(false, f("aaa"));
+  assertEquals(false, f("acb"));
+})();
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) <= a.charAt(2);
+  }
+  %PrepareFunctionForOptimization(f);
+  assertEquals(true, f("aab"));
+  assertEquals(true, f("aaa"));
+  assertEquals(false, f("acb"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(true, f("aab"));
+  assertEquals(true, f("aaa"));
+  assertEquals(false, f("acb"));
+})();
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) > a.charAt(2);
+  }
+  %PrepareFunctionForOptimization(f);
+  assertEquals(false, f("aab"));
+  assertEquals(false, f("aaa"));
+  assertEquals(true, f("acb"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(false, f("aab"));
+  assertEquals(false, f("aaa"));
+  assertEquals(true, f("acb"));
+})();
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) >= a.charAt(2);
+  }
+  %PrepareFunctionForOptimization(f);
+  assertEquals(false, f("aab"));
+  assertEquals(true, f("aaa"));
+  assertEquals(true, f("acb"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(false, f("aab"));
+  assertEquals(true, f("aaa"));
+  assertEquals(true, f("acb"));
+})();
+
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) == "b";
+  }
+  %PrepareFunctionForOptimization(f);
+  assertEquals(false, f("aaa"));
+  assertEquals(true, f("bbb"));
+  assertEquals(false, f("ccc"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(false, f("aaa"));
+  assertEquals(true, f("bbb"));
+  assertEquals(false, f("ccc"));
+})();
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) == "bb";
+  }
+  %PrepareFunctionForOptimization(f);
+  assertEquals(false, f("aaa"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(false, f("aaa"));
+})();
+
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) < "b";
+  }
+  %PrepareFunctionForOptimization(f);
+  assertEquals(true, f("aaa"));
+  assertEquals(false, f("bbb"));
+  assertEquals(false, f("ccc"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(true, f("aaa"));
+  assertEquals(false, f("bbb"));
+  assertEquals(false, f("ccc"));
+})();
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) < "bb";
+  }
+  %PrepareFunctionForOptimization(f);
+  assertEquals(true, f("aaa"));
+  assertEquals(true, f("bbb"));
+  assertEquals(false, f("ccc"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(true, f("aaa"));
+  assertEquals(true, f("bbb"));
+  assertEquals(false, f("ccc"));
+})();
+
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) <= "b";
+  }
+  %PrepareFunctionForOptimization(f);
+  assertEquals(true, f("aaa"));
+  assertEquals(true, f("bbb"));
+  assertEquals(false, f("ccc"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(true, f("aaa"));
+  assertEquals(true, f("bbb"));
+  assertEquals(false, f("ccc"));
+})();
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) <= "bb";
+  }
+  %PrepareFunctionForOptimization(f);
+  assertEquals(true, f("aaa"));
+  assertEquals(true, f("bbb"));
+  assertEquals(false, f("ccc"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(true, f("aaa"));
+  assertEquals(true, f("bbb"));
+  assertEquals(false, f("ccc"));
+})();
+
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) > "b";
+  }
+  %PrepareFunctionForOptimization(f);
+  assertEquals(false, f("aaa"));
+  assertEquals(false, f("bbb"));
+  assertEquals(true, f("ccc"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(false, f("aaa"));
+  assertEquals(false, f("bbb"));
+  assertEquals(true, f("ccc"));
+})();
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) > "bb";
+  }
+  %PrepareFunctionForOptimization(f);
+  assertEquals(false, f("aaa"));
+  assertEquals(false, f("bbb"));
+  assertEquals(true, f("ccc"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(false, f("aaa"));
+  assertEquals(false, f("bbb"));
+  assertEquals(true, f("ccc"));
+})();
+
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) >= "b";
+  }
+  %PrepareFunctionForOptimization(f);
+  assertEquals(false, f("aaa"));
+  assertEquals(true, f("bbb"));
+  assertEquals(true, f("ccc"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(false, f("aaa"));
+  assertEquals(true, f("bbb"));
+  assertEquals(true, f("ccc"));
+})();
+
+(()=> {
+  function f(a) {
+    return a.charAt(1) >= "bb";
+  }
+  %PrepareFunctionForOptimization(f);
+  assertEquals(false, f("aaa"));
+  assertEquals(false, f("bbb"));
+  assertEquals(true, f("ccc"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(false, f("aaa"));
+  assertEquals(false, f("bbb"));
+  assertEquals(true, f("ccc"));
+})();
diff --git a/src/v8/test/mjsunit/compiler/string-concat-deopt.js b/src/v8/test/mjsunit/compiler/string-concat-deopt.js
new file mode 100644
index 0000000..d2c522d
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/string-concat-deopt.js
@@ -0,0 +1,104 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(() => {
+  function f(a) {
+    return "abc".concat();
+  }
+
+  %PrepareFunctionForOptimization(f);
+  assertEquals("abc", f());
+  assertEquals("abc", f());
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("abc", f());
+})();
+
+(() => {
+  function f(a) {
+    return "abc".concat(a);
+  }
+
+  %PrepareFunctionForOptimization(f);
+  assertEquals("abcde", f("de"));
+  assertEquals("abcde", f("de"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("abcde", f("de"));
+})();
+
+(() => {
+  function f(a) {
+    return "abc".concat(a);
+  }
+
+  %PrepareFunctionForOptimization(f);
+  assertEquals("abcde", f("de"));
+  assertEquals("abcde", f("de"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("abc1", f(1));
+})();
+
+(() => {
+  function f(a) {
+    return "abc".concat(a);
+  }
+
+  %PrepareFunctionForOptimization(f);
+  assertEquals("abcde", f("de"));
+  assertEquals("abcde", f("de"));
+  %OptimizeFunctionOnNextCall(f);
+  var s = "x".repeat(%StringMaxLength());
+  assertThrows(() => f(s), RangeError);
+})();
+
+
+(() => {
+  function f(a) {
+    return "ab".concat("c");
+  }
+
+  %PrepareFunctionForOptimization(f);
+  assertEquals("abc", f());
+  assertEquals("abc", f());
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("abc", f());
+})();
+
+(() => {
+  function f(a) {
+    return "ab".concat("c", a);
+  }
+
+  %PrepareFunctionForOptimization(f);
+  assertEquals("abcde", f("de"));
+  assertEquals("abcde", f("de"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("abcde", f("de"));
+})();
+
+(() => {
+  function f(a) {
+    return "ab".concat("c", a);
+  }
+
+  %PrepareFunctionForOptimization(f);
+  assertEquals("abcde", f("de"));
+  assertEquals("abcde", f("de"));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("abc1", f(1));
+})();
+
+(() => {
+  function f(a) {
+    return "ab".concat("c", a);
+  }
+
+  %PrepareFunctionForOptimization(f);
+  assertEquals("abcde", f("de"));
+  assertEquals("abcde", f("de"));
+  %OptimizeFunctionOnNextCall(f);
+  var s = "x".repeat(%StringMaxLength());
+  assertThrows(() => f(s), RangeError);
+})();
diff --git a/src/v8/test/mjsunit/compiler/string-concat-try-catch.js b/src/v8/test/mjsunit/compiler/string-concat-try-catch.js
index d85a891..382ae30 100644
--- a/src/v8/test/mjsunit/compiler/string-concat-try-catch.js
+++ b/src/v8/test/mjsunit/compiler/string-concat-try-catch.js
@@ -15,6 +15,7 @@
     }
   }
 
+  %PrepareFunctionForOptimization(foo);
   foo("a");
   foo("a");
   // Optimize with string length protector check.
@@ -22,6 +23,7 @@
   foo("a");
   assertInstanceof(foo(a), RangeError);
   // Optimize without string length protector check.
+  %PrepareFunctionForOptimization(foo);
   %OptimizeFunctionOnNextCall(foo);
   foo("a");
   assertInstanceof(foo(a), RangeError);
diff --git a/src/v8/test/mjsunit/compiler/string-concat-yield.js b/src/v8/test/mjsunit/compiler/string-concat-yield.js
index d6611d2..5b73fea 100644
--- a/src/v8/test/mjsunit/compiler/string-concat-yield.js
+++ b/src/v8/test/mjsunit/compiler/string-concat-yield.js
@@ -9,6 +9,7 @@
   return f;
 }
 
+%PrepareFunctionForOptimization(foo);
 %OptimizeFunctionOnNextCall(foo);
 var gen = foo();
 assertEquals('yielded', gen.next('unused').value);
diff --git a/src/v8/test/mjsunit/compiler/string-from-code-point.js b/src/v8/test/mjsunit/compiler/string-from-code-point.js
new file mode 100644
index 0000000..2d4686a
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/string-from-code-point.js
@@ -0,0 +1,37 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --noalways-opt
+
+// Test that String.fromCodePoint() properly identifies zeros.
+(function() {
+  function foo(x) {
+    return String.fromCodePoint(x);
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals("\u0000", foo(0));
+  assertEquals("\u0000", foo(-0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals("\u0000", foo(0));
+  assertEquals("\u0000", foo(-0));
+  assertOptimized(foo);
+
+  // Prepare foo to be re-optimized, ensuring it's bytecode / feedback vector
+  // doesn't get flushed after deoptimization.
+  %PrepareFunctionForOptimization(foo);
+
+  // Now passing anything outside the valid code point
+  // range should invalidate the optimized code.
+  assertThrows(_ => foo(-1));
+  assertUnoptimized(foo);
+
+  // And TurboFan should not inline the builtin anymore
+  // from now on (aka no deoptimization loop).
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals("\u0000", foo(0));
+  assertEquals("\u0000", foo(-0));
+  assertThrows(_ => foo(-1));
+  assertOptimized(foo);
+})();
diff --git a/src/v8/test/mjsunit/compiler/string-length.js b/src/v8/test/mjsunit/compiler/string-length.js
index 855a1a6..718bcfb 100644
--- a/src/v8/test/mjsunit/compiler/string-length.js
+++ b/src/v8/test/mjsunit/compiler/string-length.js
@@ -13,6 +13,7 @@
 function f1(x) {
   return x.length;
 }
+%PrepareFunctionForOptimization(f1);
 assertEquals(0, f1(""));
 assertEquals(1, f1("a"));
 %OptimizeFunctionOnNextCall(f1);
@@ -23,6 +24,7 @@
   x = x ? "" + y : "" + z;
   return x.length;
 }
+%PrepareFunctionForOptimization(f2);
 assertEquals(0, f2(true, "", "a"));
 assertEquals(1, f2(false, "", "a"));
 %OptimizeFunctionOnNextCall(f2);
diff --git a/src/v8/test/mjsunit/compiler/string-slice.js b/src/v8/test/mjsunit/compiler/string-slice.js
index 6c32747..5d5defb 100644
--- a/src/v8/test/mjsunit/compiler/string-slice.js
+++ b/src/v8/test/mjsunit/compiler/string-slice.js
@@ -7,6 +7,7 @@
 (function() {
   function foo(s) { return s.slice(-1); }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals('', foo(''));
   assertEquals('a', foo('a'));
   assertEquals('b', foo('ab'));
@@ -21,6 +22,7 @@
 (function() {
   function foo(s) { return s.slice(-1, undefined); }
 
+  %PrepareFunctionForOptimization(foo);
   assertEquals('', foo(''));
   assertEquals('a', foo('a'));
   assertEquals('b', foo('ab'));
diff --git a/src/v8/test/mjsunit/compiler/string-startswith.js b/src/v8/test/mjsunit/compiler/string-startswith.js
new file mode 100644
index 0000000..c060a5e
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/string-startswith.js
@@ -0,0 +1,81 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+(function() {
+  function foo(string) { return string.startsWith('a'); }
+
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(false, foo(''));
+  assertEquals(true, foo('a'));
+  assertEquals(false, foo('ba'));
+  assertEquals(true, foo('abc'));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(false, foo(''));
+  assertEquals(true, foo('a'));
+  assertEquals(false, foo('ba'));
+  assertEquals(true, foo('abc'));
+  assertOptimized(foo);
+})();
+
+(function() {
+  function f() { return "abc".startsWith(); }
+
+  %PrepareFunctionForOptimization(f);
+  assertEquals(false, f());
+  assertEquals(false, f());
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(false, f());
+  assertOptimized(f);
+})();
+
+(function() {
+  function g(n) { return "abc".startsWith("a", n); }
+
+  %PrepareFunctionForOptimization(g);
+  assertEquals(true, g(-1));
+  assertEquals(true, g(0));
+  assertEquals(false, g(1));
+  assertEquals(false, g(2));
+  assertEquals(false, g(3));
+  assertEquals(false, g(4));
+  %OptimizeFunctionOnNextCall(g);
+  assertEquals(true, g(-1));
+  assertEquals(true, g(0));
+  assertEquals(false, g(1));
+  assertEquals(false, g(2));
+  assertEquals(false, g(3));
+  assertEquals(false, g(4));
+  assertOptimized(g);
+})();
+
+(function() {
+  function g(n) { return "cba".startsWith("a", n); }
+
+  %PrepareFunctionForOptimization(g);
+  assertEquals(false, g(-1));
+  assertEquals(false, g(0));
+  assertEquals(false, g(1));
+  assertEquals(true, g(2));
+  assertEquals(false, g(3));
+  assertEquals(false, g(4));
+  %OptimizeFunctionOnNextCall(g);
+  assertEquals(false, g(-1));
+  assertEquals(false, g(0));
+  assertEquals(false, g(1));
+  assertEquals(true, g(2));
+  assertEquals(false, g(3));
+  assertEquals(false, g(4));
+  assertOptimized(g);
+})();
+
+(function() {
+  function f(n) { return "cba".startsWith("a", n); }
+  %PrepareFunctionForOptimization(f);
+  f();
+  f();
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(false, f(1073741824));
+})();
diff --git a/src/v8/test/mjsunit/compiler/switch-bailout.js b/src/v8/test/mjsunit/compiler/switch-bailout.js
index 084074e..71aa946 100644
--- a/src/v8/test/mjsunit/compiler/switch-bailout.js
+++ b/src/v8/test/mjsunit/compiler/switch-bailout.js
@@ -37,6 +37,7 @@
   return 99;
 }
 
+%PrepareFunctionForOptimization(f);
 for (var i = 0; i < 5; i++) f("foo");
 %OptimizeFunctionOnNextCall(f);
 f("foo");
diff --git a/src/v8/test/mjsunit/compiler/symbol-protototype.js b/src/v8/test/mjsunit/compiler/symbol-protototype.js
index 9a707e8..b1b2ac6 100644
--- a/src/v8/test/mjsunit/compiler/symbol-protototype.js
+++ b/src/v8/test/mjsunit/compiler/symbol-protototype.js
@@ -7,6 +7,7 @@
 function test1(s) {
   return s.toString;
 }
+%PrepareFunctionForOptimization(test1);
 assertSame(test1(Symbol()), Symbol.prototype.toString);
 assertSame(test1(Symbol()), Symbol.prototype.toString);
 %OptimizeFunctionOnNextCall(test1);
@@ -15,6 +16,7 @@
 function test2(s) {
   return s.valueOf;
 }
+%PrepareFunctionForOptimization(test2);
 assertSame(test2(Symbol()), Symbol.prototype.valueOf);
 assertSame(test2(Symbol()), Symbol.prototype.valueOf);
 %OptimizeFunctionOnNextCall(test2);
@@ -24,6 +26,7 @@
 function test3(s) {
   return s["foo"];
 }
+%PrepareFunctionForOptimization(test3);
 assertEquals(test3(Symbol()), 1);
 assertEquals(test3(Symbol()), 1);
 %OptimizeFunctionOnNextCall(test3);
@@ -33,6 +36,7 @@
 function test4(s) {
   return s.bar();
 }
+%PrepareFunctionForOptimization(test4);
 var s = Symbol("foo");
 assertEquals(test4(s), s);
 assertEquals(test4(s), s);
diff --git a/src/v8/test/mjsunit/compiler/tagged-template.js b/src/v8/test/mjsunit/compiler/tagged-template.js
new file mode 100644
index 0000000..29a9454
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/tagged-template.js
@@ -0,0 +1,51 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Case One: the template is already initialized before compilation.
+let saved_array;
+function tagged_function(a) {
+  saved_array = a;
+  return "something";
+}
+
+function foo(b) {
+  let a = tagged_function`hello ${b}`;
+  return a + " " + b;
+}
+
+%PrepareFunctionForOptimization(foo);
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
+
+// Case Two: the template hasn't been initialized at the point we
+// do optimized compile.
+function bar(b) {
+  if (b) {
+    let a = tagged_function`initialized late ${b}`;
+    b = a;
+  }
+  return b;
+}
+
+%PrepareFunctionForOptimization(bar);
+bar();
+bar();
+%OptimizeFunctionOnNextCall(bar);
+bar(true);
+
+let saved_array_from_optimized_call = saved_array;
+
+// Finally, ensure that if the function is deoptimized, the tagged-template
+// code still runs. This is useful to test because TurboFan doesn't cache
+// the tagged template in the feedback vector if it has to create it.
+%DeoptimizeFunction(bar);
+bar(true);
+
+// Furthermore, we want to ensure that the JSArray passed to the function
+// is the same.
+assertSame(saved_array_from_optimized_call, saved_array);
diff --git a/src/v8/test/mjsunit/compiler/try-binop.js b/src/v8/test/mjsunit/compiler/try-binop.js
index 2132ad2..f762eed 100644
--- a/src/v8/test/mjsunit/compiler/try-binop.js
+++ b/src/v8/test/mjsunit/compiler/try-binop.js
@@ -14,6 +14,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(mult_left_plain);
 %OptimizeFunctionOnNextCall(mult_left_plain);
 assertEquals("boom", mult_left_plain(boom));
 assertEquals(46, mult_left_plain(23));
@@ -26,6 +27,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(mult_right_plain);
 %OptimizeFunctionOnNextCall(mult_right_plain);
 assertEquals("boom", mult_right_plain(boom));
 assertEquals(69, mult_right_plain(23));
@@ -38,6 +40,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(mult_none_plain);
 %OptimizeFunctionOnNextCall(mult_none_plain);
 assertEquals("boom", mult_none_plain(boom, boom));
 assertEquals("boom", mult_none_plain(boom, 2));
diff --git a/src/v8/test/mjsunit/compiler/try-catch-deopt.js b/src/v8/test/mjsunit/compiler/try-catch-deopt.js
index 2b6372c..fb685c0 100644
--- a/src/v8/test/mjsunit/compiler/try-catch-deopt.js
+++ b/src/v8/test/mjsunit/compiler/try-catch-deopt.js
@@ -20,6 +20,7 @@
     }
   }
 
+  %PrepareFunctionForOptimization(f);
   assertEquals(43, f());
   assertEquals(43, f());
   %NeverOptimizeFunction(g);
@@ -50,6 +51,7 @@
     return b;
   }
 
+  %PrepareFunctionForOptimization(f);
   assertEquals(43, f());
   assertEquals(43, f());
   %NeverOptimizeFunction(g);
@@ -80,6 +82,7 @@
     return h() + 1;
   }
 
+  %PrepareFunctionForOptimization(f);
   assertEquals(44, f());
   assertEquals(44, f());
   %NeverOptimizeFunction(g);
@@ -109,6 +112,7 @@
     return a;
   }
 
+  %PrepareFunctionForOptimization(f);
   assertEquals(43, f());
   assertEquals(43, f());
   %NeverOptimizeFunction(g);
@@ -135,6 +139,7 @@
     }
     return x;
   }
+  %PrepareFunctionForOptimization(f);
   assertEquals(23, f(0));
   assertEquals(24, f(1));
   %OptimizeFunctionOnNextCall(f);
@@ -161,6 +166,7 @@
     }
     return x;
   }
+  %PrepareFunctionForOptimization(f);
   assertThrows(function() { f(0) });
   assertThrows(function() { f(1) });
   %OptimizeFunctionOnNextCall(f);
@@ -190,6 +196,7 @@
     }
     return x;
   }
+  %PrepareFunctionForOptimization(f);
   assertEquals(23, f(0));
   assertEquals(24, f(1));
   %OptimizeFunctionOnNextCall(f);
@@ -217,6 +224,7 @@
     }
     return x;
   }
+  %PrepareFunctionForOptimization(f);
   assertEquals(23, f(0));
   assertEquals(24, f(1));
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/try-context.js b/src/v8/test/mjsunit/compiler/try-context.js
index 4e6d9b0..50dd923 100644
--- a/src/v8/test/mjsunit/compiler/try-context.js
+++ b/src/v8/test/mjsunit/compiler/try-context.js
@@ -17,6 +17,7 @@
     }
     return x;
   }
+  %PrepareFunctionForOptimization(f);
   assertEquals(23, f(0));
   assertEquals(24, f(1));
   %OptimizeFunctionOnNextCall(f);
@@ -37,6 +38,7 @@
     }
     return x;
   }
+  %PrepareFunctionForOptimization(f);
   assertThrows(function() { f(0) });
   assertThrows(function() { f(1) });
   %OptimizeFunctionOnNextCall(f);
@@ -60,6 +62,7 @@
     }
     return x;
   }
+  %PrepareFunctionForOptimization(f);
   assertEquals(23, f(0));
   assertEquals(24, f(1));
   %OptimizeFunctionOnNextCall(f);
@@ -81,6 +84,7 @@
     }
     return x;
   }
+  %PrepareFunctionForOptimization(f);
   assertEquals(23, f(0));
   assertEquals(24, f(1));
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/try-deopt.js b/src/v8/test/mjsunit/compiler/try-deopt.js
index a4a6eb0..3ca341c 100644
--- a/src/v8/test/mjsunit/compiler/try-deopt.js
+++ b/src/v8/test/mjsunit/compiler/try-deopt.js
@@ -13,6 +13,7 @@
   }
   return x + 2;
 }
+%PrepareFunctionForOptimization(DeoptFromTry);
 %OptimizeFunctionOnNextCall(DeoptFromTry);
 assertEquals(24, DeoptFromTry(23));
 
@@ -26,6 +27,7 @@
   }
   return x + 2;
 }
+%PrepareFunctionForOptimization(DeoptFromCatch);
 %OptimizeFunctionOnNextCall(DeoptFromCatch);
 assertEquals(24, DeoptFromCatch(23));
 
@@ -39,6 +41,7 @@
   }
   return x + 2;
 }
+%PrepareFunctionForOptimization(DeoptFromFinally_Return);
 %OptimizeFunctionOnNextCall(DeoptFromFinally_Return);
 assertEquals(24, DeoptFromFinally_Return(23));
 
@@ -51,5 +54,6 @@
   }
   return x + 2;
 }
+%PrepareFunctionForOptimization(DeoptFromFinally_ReThrow);
 %OptimizeFunctionOnNextCall(DeoptFromFinally_ReThrow);
 assertThrows("DeoptFromFinally_ReThrow(new Error)", Error);
diff --git a/src/v8/test/mjsunit/compiler/try-finally-deopt.js b/src/v8/test/mjsunit/compiler/try-finally-deopt.js
index 455bf34..ee8da2e 100644
--- a/src/v8/test/mjsunit/compiler/try-finally-deopt.js
+++ b/src/v8/test/mjsunit/compiler/try-finally-deopt.js
@@ -17,6 +17,7 @@
     return global + a;
   }
 
+  %PrepareFunctionForOptimization(f);
   f();
   f();
   %OptimizeFunctionOnNextCall(f);
@@ -36,6 +37,7 @@
     return 1;
   }
 
+  %PrepareFunctionForOptimization(f);
   f();
   f();
   %OptimizeFunctionOnNextCall(f);
@@ -59,6 +61,8 @@
     return 1;
   }
 
+
+  %PrepareFunctionForOptimization(f);
   f();
   f();
   %OptimizeFunctionOnNextCall(f);
@@ -83,6 +87,8 @@
     return 1;
   }
 
+
+  %PrepareFunctionForOptimization(f);
   f();
   f();
   %OptimizeFunctionOnNextCall(f);
@@ -106,6 +112,7 @@
     return 1;
   }
 
+  %PrepareFunctionForOptimization(f);
   try { f(); } catch(e) {}
   try { f(); } catch(e) {}
   %OptimizeFunctionOnNextCall(f);
@@ -133,6 +140,7 @@
     return 1;
   }
 
+  %PrepareFunctionForOptimization(f);
   try { f(); } catch(e) {}
   try { f(); } catch(e) {}
   %OptimizeFunctionOnNextCall(f);
@@ -157,6 +165,7 @@
     return 1;
   }
 
+  %PrepareFunctionForOptimization(f);
   f();
   f();
   %OptimizeFunctionOnNextCall(f);
@@ -186,6 +195,7 @@
     return 1;
   }
 
+  %PrepareFunctionForOptimization(f);
   f();
   f();
   %OptimizeFunctionOnNextCall(f);
@@ -211,6 +221,7 @@
     return 1;
   }
 
+  %PrepareFunctionForOptimization(f);
   f();
   f();
   %OptimizeFunctionOnNextCall(f);
@@ -241,6 +252,7 @@
     return 1;
   }
 
+  %PrepareFunctionForOptimization(f);
   f();
   f();
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/compiler/try-osr.js b/src/v8/test/mjsunit/compiler/try-osr.js
index c0ef27a..fc6c9e4 100644
--- a/src/v8/test/mjsunit/compiler/try-osr.js
+++ b/src/v8/test/mjsunit/compiler/try-osr.js
@@ -13,6 +13,7 @@
   }
   return x + 2;
 }
+%PrepareFunctionForOptimization(OSRInsideTry);
 assertEquals(24, OSRInsideTry(23));
 
 
@@ -25,6 +26,7 @@
   }
   return x + 2;
 }
+%PrepareFunctionForOptimization(OSRInsideCatch);
 assertEquals(24, OSRInsideCatch(23));
 
 
@@ -37,6 +39,7 @@
   }
   return x + 2;
 }
+%PrepareFunctionForOptimization(OSRInsideFinally_Return);
 assertEquals(24, OSRInsideFinally_Return(23));
 
 
@@ -48,4 +51,5 @@
   }
   return x + 2;
 }
+%PrepareFunctionForOptimization(OSRInsideFinally_ReThrow);
 assertThrows("OSRInsideFinally_ReThrow(new Error)", Error);
diff --git a/src/v8/test/mjsunit/compiler/turbo-number-feedback.js b/src/v8/test/mjsunit/compiler/turbo-number-feedback.js
index 8875b8c..52c836a 100644
--- a/src/v8/test/mjsunit/compiler/turbo-number-feedback.js
+++ b/src/v8/test/mjsunit/compiler/turbo-number-feedback.js
@@ -9,6 +9,7 @@
     return a + b - c;
   }
 
+  %PrepareFunctionForOptimization(f0);
   assertEquals(4, f0(3, 2, 1));
   assertEquals(4, f0(3, 2, 1));
   %OptimizeFunctionOnNextCall(f0);
@@ -20,6 +21,7 @@
     return a + b - c;
   }
 
+  %PrepareFunctionForOptimization(f1);
   assertEquals(4.5, f1(3.5, 2.5, 1.5));
   assertEquals(4.5, f1(3.5, 2.5, 1.5));
   %OptimizeFunctionOnNextCall(f1);
@@ -34,6 +36,7 @@
     return (a >>> 0) + 1;
   }
 
+  %PrepareFunctionForOptimization(f2);
   assertEquals(1, f2(0));
   assertEquals(1, f2(0));
   %OptimizeFunctionOnNextCall(f2);
@@ -50,6 +53,7 @@
     return x + b;
   }
 
+  %PrepareFunctionForOptimization(f3);
   assertEquals(1, f3(0, 1));
   assertEquals(1, f3(0, 1));
   %OptimizeFunctionOnNextCall(f3);
@@ -62,6 +66,7 @@
     return a << b;
   }
 
+  %PrepareFunctionForOptimization(f4);
   assertEquals(24, f4(3, 3));
   assertEquals(40, f4(5, 3));
   %OptimizeFunctionOnNextCall(f4);
@@ -73,6 +78,7 @@
     return a << b;
   }
 
+  %PrepareFunctionForOptimization(f5);
   assertEquals(24, f5(3.3, 3.4));
   assertEquals(40, f5(5.1, 3.9));
   %OptimizeFunctionOnNextCall(f5);
@@ -84,6 +90,7 @@
     return a >> b;
   }
 
+  %PrepareFunctionForOptimization(f6);
   assertEquals(1, f6(8.3, 3.4));
   assertEquals(-2, f6(-16.1, 3.9));
   %OptimizeFunctionOnNextCall(f6);
@@ -95,6 +102,7 @@
     return a >>> b;
   }
 
+  %PrepareFunctionForOptimization(f7);
   assertEquals(1, f7(8.3, 3.4));
   assertEquals(536870910, f7(-16.1, 3.9));
   %OptimizeFunctionOnNextCall(f7);
diff --git a/src/v8/test/mjsunit/compiler/type-speculative-safe-integer-add.js b/src/v8/test/mjsunit/compiler/type-speculative-safe-integer-add.js
index 459e2b4..a45561b 100644
--- a/src/v8/test/mjsunit/compiler/type-speculative-safe-integer-add.js
+++ b/src/v8/test/mjsunit/compiler/type-speculative-safe-integer-add.js
@@ -19,6 +19,7 @@
         return y;
     }
 
+    %PrepareFunctionForOptimization(forgetAboutMinus0);
     forgetAboutMinus0(1);
     assertEquals(Infinity, forgetAboutMinus0(1));
     %OptimizeFunctionOnNextCall(forgetAboutMinus0);
@@ -43,6 +44,7 @@
         return NumberAdd(f(x), 0);
     }
 
+    %PrepareFunctionForOptimization(forgetAboutNaN);
     forgetAboutNaN(false);
     assertEquals(2, forgetAboutNaN(false));
     %OptimizeFunctionOnNextCall(forgetAboutNaN);
diff --git a/src/v8/test/mjsunit/compiler/typed-array-constructor.js b/src/v8/test/mjsunit/compiler/typed-array-constructor.js
new file mode 100644
index 0000000..fac5663
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/typed-array-constructor.js
@@ -0,0 +1,140 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const limit = %MaxSmi() + 1;
+
+(function() {
+  function foo() {
+    try { new Int8Array(limit); } catch (e) { return e.stack; }
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(/new Int8Array/.test(foo()));
+  assertTrue(/new Int8Array/.test(foo()));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(/new Int8Array/.test(foo()));
+})();
+
+(function() {
+  function foo() {
+    try { new Uint8Array(limit); } catch (e) { return e.stack; }
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(/new Uint8Array/.test(foo()));
+  assertTrue(/new Uint8Array/.test(foo()));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(/new Uint8Array/.test(foo()));
+})();
+
+(function() {
+  function foo() {
+    try { new Uint8ClampedArray(limit); } catch (e) { return e.stack; }
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(/new Uint8ClampedArray/.test(foo()));
+  assertTrue(/new Uint8ClampedArray/.test(foo()));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(/new Uint8ClampedArray/.test(foo()));
+})();
+
+(function() {
+  function foo() {
+    try { new Int16Array(limit); } catch (e) { return e.stack; }
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(/new Int16Array/.test(foo()));
+  assertTrue(/new Int16Array/.test(foo()));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(/new Int16Array/.test(foo()));
+})();
+
+(function() {
+  function foo() {
+    try { new Uint16Array(limit); } catch (e) { return e.stack; }
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(/new Uint16Array/.test(foo()));
+  assertTrue(/new Uint16Array/.test(foo()));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(/new Uint16Array/.test(foo()));
+})();
+
+(function() {
+  function foo() {
+    try { new Int32Array(limit); } catch (e) { return e.stack; }
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(/new Int32Array/.test(foo()));
+  assertTrue(/new Int32Array/.test(foo()));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(/new Int32Array/.test(foo()));
+})();
+
+(function() {
+  function foo() {
+    try { new Uint32Array(limit); } catch (e) { return e.stack; }
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(/new Uint32Array/.test(foo()));
+  assertTrue(/new Uint32Array/.test(foo()));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(/new Uint32Array/.test(foo()));
+})();
+
+(function() {
+  function foo() {
+    try { new Float32Array(limit); } catch (e) { return e.stack; }
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(/new Float32Array/.test(foo()));
+  assertTrue(/new Float32Array/.test(foo()));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(/new Float32Array/.test(foo()));
+})();
+
+
+(function() {
+  function foo() {
+    try { new Float64Array(limit); } catch (e) { return e.stack; }
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(/new Float64Array/.test(foo()));
+  assertTrue(/new Float64Array/.test(foo()));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(/new Float64Array/.test(foo()));
+})();
+
+(function() {
+  function foo() {
+    try { new BigInt64Array(limit); } catch (e) { return e.stack; }
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(/new BigInt64Array/.test(foo()));
+  assertTrue(/new BigInt64Array/.test(foo()));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(/new BigInt64Array/.test(foo()));
+})();
+
+(function() {
+  function foo() {
+    try { new BigUint64Array(limit); } catch (e) { return e.stack; }
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(/new BigUint64Array/.test(foo()));
+  assertTrue(/new BigUint64Array/.test(foo()));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(/new BigUint64Array/.test(foo()));
+})();
diff --git a/src/v8/test/mjsunit/compiler/typedarray-keyed.js b/src/v8/test/mjsunit/compiler/typedarray-keyed.js
new file mode 100644
index 0000000..d74fae9
--- /dev/null
+++ b/src/v8/test/mjsunit/compiler/typedarray-keyed.js
@@ -0,0 +1,41 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = new Int8Array(100);
+
+function has(i) {
+  return i in a;
+};
+%PrepareFunctionForOptimization(has);
+assertTrue(has(0));
+assertTrue(has(0));
+%OptimizeFunctionOnNextCall(has);
+assertTrue(has(0));
+assertTrue(has(1));
+
+function get(i) {
+  return a[i];
+};
+%PrepareFunctionForOptimization(get);
+assertEquals(0, get(0));
+assertEquals(0, get(0));
+%OptimizeFunctionOnNextCall(get);
+assertEquals(0, get(0));
+assertEquals(0, get(1));
+
+function set(i) {
+  return a[i] = 42 + i;
+};
+%PrepareFunctionForOptimization(set);
+assertEquals(42, set(0));
+assertEquals(42, a[0]);
+assertEquals(42, set(0));
+assertEquals(42, a[0]);
+%OptimizeFunctionOnNextCall(set);
+assertEquals(42, set(0));
+assertEquals(42, a[0]);
+assertEquals(43, set(1));
+assertEquals(43, a[1]);
diff --git a/src/v8/test/mjsunit/compiler/typedarray-prototype-tostringtag.js b/src/v8/test/mjsunit/compiler/typedarray-prototype-tostringtag.js
index de4b302..36575c7 100644
--- a/src/v8/test/mjsunit/compiler/typedarray-prototype-tostringtag.js
+++ b/src/v8/test/mjsunit/compiler/typedarray-prototype-tostringtag.js
@@ -24,6 +24,7 @@
   function foo(o) {
     return TypedArrayPrototype_toStringTag.call(o);
   }
+  %PrepareFunctionForOptimization(foo);
   assertEquals(undefined, foo(1));
   assertEquals(undefined, foo({}));
   assertEquals(undefined, foo([]));
@@ -46,6 +47,7 @@
     return TypedArrayProto_toStringTag(value) !== undefined;
   }
 
+  %PrepareFunctionForOptimization(isTypedArray);
   assertFalse(isTypedArray(1));
   assertFalse(isTypedArray({}));
   assertFalse(isTypedArray([]));
@@ -70,6 +72,7 @@
     return TypedArrayProto_toStringTag(value) === 'Uint8Array';
   }
 
+  %PrepareFunctionForOptimization(isUint8Array);
   assertFalse(isUint8Array(1));
   assertFalse(isUint8Array({}));
   assertFalse(isUint8Array([]));
diff --git a/src/v8/test/mjsunit/compiler/uint32.js b/src/v8/test/mjsunit/compiler/uint32.js
index 3568e27..a39d405 100644
--- a/src/v8/test/mjsunit/compiler/uint32.js
+++ b/src/v8/test/mjsunit/compiler/uint32.js
@@ -40,6 +40,7 @@
   return uint32_array[i];
 }
 
+%PrepareFunctionForOptimization(ChangeI2T);
 assertEquals(K1, ChangeI2T(uint32_array, 0));
 assertEquals(K2, ChangeI2T(uint32_array, 1));
 %OptimizeFunctionOnNextCall(ChangeI2T);
@@ -60,6 +61,7 @@
   return x;
 }
 
+%PrepareFunctionForOptimization(Deopt);
 assertEquals(K1, Deopt({x: 0}, uint32_array, 0));
 assertEquals(K2, Deopt({x: 0}, uint32_array, 1));
 %OptimizeFunctionOnNextCall(Deopt);
@@ -71,6 +73,7 @@
   return arr[0] + arr[1];
 }
 
+%PrepareFunctionForOptimization(ChangeI2D);
 assertEquals(K1 + K2, ChangeI2D(uint32_array));
 assertEquals(K1 + K2, ChangeI2D(uint32_array));
 %OptimizeFunctionOnNextCall(ChangeI2D);
@@ -80,6 +83,7 @@
   return (val >>> 0) >>> 1;
 }
 
+%PrepareFunctionForOptimization(ShrShr);
 assertEquals(K1, ShrShr(K2 | 0));
 assertEquals(K1, ShrShr(K2 | 0));
 %OptimizeFunctionOnNextCall(ShrShr);
@@ -89,6 +93,7 @@
   return val >> (-2 >>> 0);
 }
 
+%PrepareFunctionForOptimization(SarShr);
 var K3 = 0x80000000;
 assertEquals(-2, SarShr(K3 | 0));
 assertEquals(-2, SarShr(K3 | 0));
@@ -100,6 +105,7 @@
   return (i | 0);
 }
 
+%PrepareFunctionForOptimization(Uint32Phi);
 var K4 = 0x80000001;
 assertEquals(K3 | 0, Uint32Phi(true, K3, K4));
 assertEquals(K4 | 0, Uint32Phi(false, K3, K4));
@@ -114,6 +120,7 @@
   return (i | 0);
 }
 
+%PrepareFunctionForOptimization(NonUint32Phi);
 assertEquals(K3 | 0, NonUint32Phi(true, K3, K4));
 assertEquals(K4 | 0, NonUint32Phi(false, K3, K4));
 assertEquals(K3 | 0, NonUint32Phi(true, K3, K4));
@@ -132,6 +139,7 @@
   return (a | 0);
 }
 
+%PrepareFunctionForOptimization(PhiOfPhi);
 assertEquals(1, PhiOfPhi(1));
 assertEquals(1, PhiOfPhi(1));
 %OptimizeFunctionOnNextCall(PhiOfPhi);
@@ -147,6 +155,7 @@
   return a + a;
 }
 
+%PrepareFunctionForOptimization(PhiOfPhiUnsafe);
 assertEquals(2, PhiOfPhiUnsafe(1));
 assertEquals(2, PhiOfPhiUnsafe(1));
 %OptimizeFunctionOnNextCall(PhiOfPhiUnsafe);
@@ -166,6 +175,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(FillOldArrayWithHeapNumbers);
 FillOldArrayWithHeapNumbers(1);
 FillOldArrayWithHeapNumbers(1);
 %OptimizeFunctionOnNextCall(FillOldArrayWithHeapNumbers);
@@ -191,6 +201,7 @@
   return InnerWithArguments(v >>> 0, f);
 }
 
+%PrepareFunctionForOptimization(Outer);
 assertArrayEquals([0x0100, 0x01], Outer(0x0100, Pack));
 assertArrayEquals([0x0100, 0x01], Outer(0x0100, Pack));
 assertArrayEquals([0x0100, 0x01], Outer(0x0100, Pack));
diff --git a/src/v8/test/mjsunit/compiler/uint8-clamped-array.js b/src/v8/test/mjsunit/compiler/uint8-clamped-array.js
index 21cc5bb..63b74ea 100644
--- a/src/v8/test/mjsunit/compiler/uint8-clamped-array.js
+++ b/src/v8/test/mjsunit/compiler/uint8-clamped-array.js
@@ -9,6 +9,7 @@
     a[0] = v & 0xff;
   }
 
+  %PrepareFunctionForOptimization(foo);
   var a = new Uint8ClampedArray(4);
   foo(a, 1);
   foo(a, 2);
@@ -23,6 +24,7 @@
     a[0] = v >>> 0;
   }
 
+  %PrepareFunctionForOptimization(foo);
   var a = new Uint8ClampedArray(4);
   foo(a, 1);
   foo(a, 2);
@@ -37,6 +39,7 @@
     a[0] = v | 0;
   }
 
+  %PrepareFunctionForOptimization(foo);
   var a = new Uint8ClampedArray(4);
   foo(a, 1);
   foo(a, 2);
@@ -54,6 +57,7 @@
     a[0] = v;
   }
 
+  %PrepareFunctionForOptimization(foo);
   var a = new Uint8ClampedArray(4);
   foo(a, 1);
   foo(a, 2);
diff --git a/src/v8/test/mjsunit/compiler/unsigned-min-max.js b/src/v8/test/mjsunit/compiler/unsigned-min-max.js
index db91188..e5e33aa 100644
--- a/src/v8/test/mjsunit/compiler/unsigned-min-max.js
+++ b/src/v8/test/mjsunit/compiler/unsigned-min-max.js
@@ -10,6 +10,7 @@
   return Math.min(a, b);
 }
 
+%PrepareFunctionForOptimization(umin);
 umin(1, 1);
 umin(2, 2);
 %OptimizeFunctionOnNextCall(umin);
@@ -26,6 +27,7 @@
   return Math.max(a, b);
 }
 
+%PrepareFunctionForOptimization(umax);
 umax(1, 1);
 umax(2, 2);
 %OptimizeFunctionOnNextCall(umax);
diff --git a/src/v8/test/mjsunit/concurrent-initial-prototype-change.js b/src/v8/test/mjsunit/concurrent-initial-prototype-change.js
index 4a7241c..f4edee5 100644
--- a/src/v8/test/mjsunit/concurrent-initial-prototype-change.js
+++ b/src/v8/test/mjsunit/concurrent-initial-prototype-change.js
@@ -44,7 +44,9 @@
 function f1(a, i) {
   return a[i] + 0.5;
 }
+%PrepareFunctionForOptimization(f1);
 
+%PrepareFunctionForOptimization(f1);
 var arr = [0.0,,2.5];
 assertEquals(0.5, f1(arr, 0));
 assertEquals(0.5, f1(arr, 0));
diff --git a/src/v8/test/mjsunit/const-field-tracking.js b/src/v8/test/mjsunit/const-field-tracking.js
index 3da6d29..bc979b8 100644
--- a/src/v8/test/mjsunit/const-field-tracking.js
+++ b/src/v8/test/mjsunit/const-field-tracking.js
@@ -5,11 +5,6 @@
 // Flags: --allow-natives-syntax --opt --no-always-opt
 
 var global = this;
-
-// TODO(ishell): update the test once const->mutable migration does not
-// create a new map.
-var IS_INPLACE_MAP_MODIFICATION_SUPPORTED = false;
-
 var unique_id = 0;
 // Creates a function with unique SharedFunctionInfo to ensure the feedback
 // vector is unique for each test case.
@@ -42,40 +37,21 @@
   // {constant_object} is known to the compiler via global property cell
   // tracking.
   var load = MakeFunctionWithUniqueSFI("return constant_object.a.v;");
+  %PrepareFunctionForOptimization(load);
   load();
   load();
   %OptimizeFunctionOnNextCall(load);
   assertEquals(the_value, load());
   assertOptimized(load);
-  if (IS_INPLACE_MAP_MODIFICATION_SUPPORTED) {
-    var a = new A(other_value);
-    assertTrue(%HaveSameMap(a, the_object.a));
-    // Make constant field mutable by assigning another value
-    // to some other instance of A.
-    new A(the_value).v = other_value;
-    assertTrue(%HaveSameMap(a, new A(the_value)));
-    assertTrue(%HaveSameMap(a, the_object.a));
-    assertUnoptimized(load);
-    assertEquals(the_value, load());
-  } else {
-    var a = new A(other_value);
-    assertTrue(%HaveSameMap(a, the_object.a));
-    // Make constant field mutable by assigning another value
-    // to some other instance of A.
-    new A(the_value).v = other_value;
-    assertOptimized(load);
-    assertTrue(!%HaveSameMap(a, new A(the_value)));
-
-    assertTrue(%HaveSameMap(a, the_object.a));
-    // Ensure the {the_object.a} migrated to an up-to date version of a map
-    // by loading a property through IC.
-    assertEquals(the_value, the_object.a.v);
-    assertTrue(!%HaveSameMap(a, the_object.a));
-    assertOptimized(load);
-
-    // Now attempt to call load should deoptimize because of failed map check.
-    assertEquals(the_value, load());
-  }
+  var a = new A(other_value);
+  assertTrue(%HaveSameMap(a, the_object.a));
+  // Make constant field mutable by assigning another value
+  // to some other instance of A.
+  new A(the_value).v = other_value;
+  assertTrue(%HaveSameMap(a, new A(the_value)));
+  assertTrue(%HaveSameMap(a, the_object.a));
+  assertUnoptimized(load);
+  assertEquals(the_value, load());
   assertUnoptimized(load);
   assertEquals(the_value, load());
 }
@@ -123,6 +99,7 @@
 
   // Ensure O.prototype is in fast mode by loading from its field.
   function warmup() { return new O().v; }
+  %EnsureFeedbackVectorForFunction(warmup);
   warmup(); warmup(); warmup();
   assertTrue(%HasFastProperties(O.prototype));
 
@@ -130,20 +107,15 @@
   // map and therefore the compiler knows the prototype object and can
   // optimize load of "v".
   var load = MakeFunctionWithUniqueSFI("o", "return o.v;");
+  %PrepareFunctionForOptimization(load);
   load(new O());
   load(new O());
   %OptimizeFunctionOnNextCall(load);
   assertEquals(the_value, load(new O()));
   assertOptimized(load);
-  if (IS_INPLACE_MAP_MODIFICATION_SUPPORTED) {
-    // Invalidation of mutability should trigger deoptimization with a
-    // "field-owner" reason.
-    the_prototype.v = other_value;
-  } else {
-    // Invalidation of mutability should trigger deoptimization with a
-    // "prototype-check" (stability) reason.
-    the_prototype.v = other_value;
-  }
+  // Invalidation of mutability should trigger deoptimization with a
+  // "field-owner" reason.
+  the_prototype.v = other_value;
   assertUnoptimized(load);
 }
 
@@ -199,6 +171,7 @@
   // {constant_object} is known to the compiler via global property cell
   // tracking.
   var store = MakeFunctionWithUniqueSFI("v", "constant_object.a.v = v;");
+  %PrepareFunctionForOptimization(store);
   store(the_value);
   store(the_value);
   %OptimizeFunctionOnNextCall(store);
@@ -210,32 +183,25 @@
   assertEquals(the_value, constant_object.a.v);
   assertOptimized(store);
 
-  if (IS_INPLACE_MAP_MODIFICATION_SUPPORTED) {
-    var a = new A(other_value);
+  var a = new A(other_value);
 
-    if (typeof the_value == "function" || typeof the_value == "object") {
-      // For heap object fields "field-owner" dependency is installed for
-      // any access of the field, therefore making constant field mutable by
-      // assigning other value to some other instance of A should already
-      // trigger deoptimization.
-      assertTrue(%HaveSameMap(a, the_object.a));
-      new A(the_value).v = other_value;
-      assertTrue(%HaveSameMap(a, new A(the_value)));
-      assertTrue(%HaveSameMap(a, the_object.a));
-      assertUnoptimized(store);
-    } else {
-      assertOptimized(store);
-    }
-    // Storing other value deoptimizes because of failed value check.
-    store(other_value);
+  if (typeof the_value == "function" || typeof the_value == "object") {
+    // For heap object fields "field-owner" dependency is installed for
+    // any access of the field, therefore making constant field mutable by
+    // assigning other value to some other instance of A should already
+    // trigger deoptimization.
+    assertTrue(%HaveSameMap(a, the_object.a));
+    new A(the_value).v = other_value;
+    assertTrue(%HaveSameMap(a, new A(the_value)));
+    assertTrue(%HaveSameMap(a, the_object.a));
     assertUnoptimized(store);
-    assertEquals(other_value, constant_object.a.v);
   } else {
-    // Storing other value deoptimizes because of failed value check.
-    store(other_value);
-    assertUnoptimized(store);
-    assertEquals(other_value, constant_object.a.v);
+    assertOptimized(store);
   }
+  // Storing other value deoptimizes because of failed value check.
+  store(other_value);
+  assertUnoptimized(store);
+  assertEquals(other_value, constant_object.a.v);
 }
 
 // Test constant tracking with Smi values.
diff --git a/src/v8/test/mjsunit/constant-compare-nil-value.js b/src/v8/test/mjsunit/constant-compare-nil-value.js
index 9f5b2ad..13bef23 100644
--- a/src/v8/test/mjsunit/constant-compare-nil-value.js
+++ b/src/v8/test/mjsunit/constant-compare-nil-value.js
@@ -28,14 +28,14 @@
 // Flags: --allow-natives-syntax
 
 function inlined() {
-    return 1;
+  return 1;
 }
 
 function foo() {
-    if ((inlined() + 0.5) == null) return "null";
-    return "non-null";
-}
-
+  if (inlined() + 0.5 == null) return 'null';
+  return 'non-null';
+};
+%PrepareFunctionForOptimization(foo);
 assertEquals("non-null", foo());
 assertEquals("non-null", foo());
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/constant-fold-control-instructions.js b/src/v8/test/mjsunit/constant-fold-control-instructions.js
index be3cdfd..6fb8afa 100644
--- a/src/v8/test/mjsunit/constant-fold-control-instructions.js
+++ b/src/v8/test/mjsunit/constant-fold-control-instructions.js
@@ -25,7 +25,7 @@
   assertFalse(%_IsJSReceiver(1));
 }
 
-
+%PrepareFunctionForOptimization(test);
 test();
 test();
 %OptimizeFunctionOnNextCall(test);
diff --git a/src/v8/test/mjsunit/constant-folding-2.js b/src/v8/test/mjsunit/constant-folding-2.js
index 7586261..a0c0fed 100644
--- a/src/v8/test/mjsunit/constant-folding-2.js
+++ b/src/v8/test/mjsunit/constant-folding-2.js
@@ -28,22 +28,30 @@
 
 // Flags: --allow-natives-syntax --nostress-opt --opt
 
-function test(f) {
+function test(f, iterations) {
+  %PrepareFunctionForOptimization(f);
   f();
   f();
-  %OptimizeFunctionOnNextCall(f);
-  f();
+  // Some of the tests need to learn until they stabilize.
+  let n = iterations ? iterations : 1;
+  for (let i = 0; i < n; i++) {
+    %OptimizeFunctionOnNextCall(f);
+    f();
+    %PrepareFunctionForOptimization(f);
+  }
+  // Assert that the function finally stabilized.
+  assertOptimized(f);
 }
 
 test(function add() {
   assertEquals(2, 1 + 1);
   assertEquals(2.5, 1.25 + 1.25);
-  assertEquals("Infinity", String(Infinity + Infinity));
-  assertEquals("Infinity", String(Infinity + 3));
-  assertEquals("NaN", String(Infinity + (-Infinity)));
-  assertEquals("NaN", String(NaN + 2));
-  assertEquals("-Infinity", String(1 / (-0.0 + (-0.0))));
-  assertEquals("Infinity", String(1 / (-0.0 + 0.0)));
+  assertSame(Infinity, Infinity + Infinity);
+  assertSame(Infinity, Infinity + 3);
+  assertSame(NaN, Infinity + (-Infinity));
+  assertSame(NaN, NaN + 2);
+  assertSame(-Infinity, 1 / (-0.0 + (-0.0)));
+  assertSame(Infinity, 1 / (-0.0 + 0.0));
 });
 
 test(function inc() {
@@ -52,9 +60,9 @@
   var c = -Infinity;
   var d = NaN;
   assertEquals(2, ++a);
-  assertEquals("Infinity", String(++b));
-  assertEquals("-Infinity", String(++c));
-  assertEquals("NaN", String(++d));
+  assertSame(Infinity, ++b);
+  assertSame(-Infinity, ++c);
+  assertSame(NaN, ++d);
 });
 
 test(function dec() {
@@ -63,155 +71,155 @@
   var c = -Infinity;
   var d = NaN;
   assertEquals(0, --a);
-  assertEquals("Infinity", String(--b));
-  assertEquals("-Infinity", String(--c));
-  assertEquals("NaN", String(--d));
+  assertSame(Infinity, --b);
+  assertSame(-Infinity, --c);
+  assertSame(NaN, --d);
 });
 
 test(function sub() {
   assertEquals(0, 1 - 1);
   assertEquals(0.5, 1.5 - 1);
-  assertEquals("Infinity", String(Infinity - (-Infinity)));
-  assertEquals("Infinity", String(Infinity - 3));
-  assertEquals("NaN", String(Infinity - Infinity));
-  assertEquals("NaN", String(NaN - 2));
-  assertEquals("-Infinity", String(1 / (-0.0 - 0.0)));
-  assertEquals("Infinity", String(1 / (0.0 - 0.0)));
+  assertSame(Infinity, Infinity - (-Infinity));
+  assertSame(Infinity, Infinity - 3);
+  assertSame(NaN, Infinity - Infinity);
+  assertSame(NaN, NaN - 2);
+  assertSame(-Infinity, 1 / (-0.0 - 0.0));
+  assertSame(Infinity, 1 / (0.0 - 0.0));
 });
 
 test(function mul() {
   assertEquals(1, 1 * 1);
   assertEquals(2.25, 1.5 * 1.5);
-  assertEquals("Infinity", String(Infinity * Infinity));
-  assertEquals("-Infinity", String(Infinity * (-Infinity)));
-  assertEquals("Infinity", String(Infinity * 3));
-  assertEquals("-Infinity", String(Infinity * (-3)));
-  assertEquals("NaN", String(NaN * 3));
-  assertEquals("-Infinity", String(1 / (-0.0 * 0.0)));
-  assertEquals("Infinity", String(1 / (0.0 * 0.0)));
+  assertSame(Infinity, Infinity * Infinity);
+  assertSame(-Infinity, Infinity * (-Infinity));
+  assertSame(Infinity, Infinity * 3);
+  assertSame(-Infinity, Infinity * (-3));
+  assertSame(NaN, NaN * 3);
+  assertSame(-Infinity, 1 / (-0.0 * 0.0));
+  assertSame(Infinity, 1 / (0.0 * 0.0));
 });
 
 test(function div() {
   assertEquals(1, 1 / 1);
   assertEquals(1.5, 2.25 / 1.5);
-  assertEquals("NaN", String(Infinity / Infinity));
-  assertEquals("Infinity", String(Infinity / 3));
-  assertEquals("-Infinity", String(Infinity / (-3)));
-  assertEquals("NaN", String(NaN / 3));
-  assertEquals("-Infinity", String(1 / (-0.0)));
-  assertEquals("Infinity", String(Infinity/0.0));
+  assertSame(NaN, Infinity / Infinity);
+  assertSame(Infinity, Infinity / 3);
+  assertSame(-Infinity, Infinity / (-3));
+  assertSame(NaN, NaN / 3);
+  assertSame(-Infinity, 1 / (-0.0));
+  assertSame(Infinity, Infinity / 0.0);
 });
 
 test(function mathMin() {
   assertEquals(1, Math.min(1, 10));
   assertEquals(1.5, Math.min(1.5, 2.5));
   assertEquals(0, Math.min(Infinity, 0));
-  assertEquals("Infinity", String(Math.min(Infinity, Infinity)));
-  assertEquals("-Infinity", String(Math.min(Infinity, -Infinity)));
-  assertEquals("NaN", String(Math.min(NaN, 1)));
-  assertEquals("Infinity", String(1 / Math.min(0.0, 0.0)));
-  assertEquals("-Infinity", String(1 / Math.min(-0.0, -0.0)));
-  assertEquals("-Infinity", String(1 / Math.min(0.0, -0.0)));
+  assertSame(Infinity, Math.min(Infinity, Infinity));
+  assertSame(-Infinity, Math.min(Infinity, -Infinity));
+  assertSame(NaN, Math.min(NaN, 1));
+  assertSame(Infinity, 1 / Math.min(0.0, 0.0));
+  assertSame(-Infinity, 1 / Math.min(-0.0, -0.0));
+  assertSame(-Infinity, 1 / Math.min(0.0, -0.0));
 });
 
 test(function mathMax() {
   assertEquals(10, Math.max(1, 10));
   assertEquals(2.5, Math.max(1.5, 2.5));
   assertEquals(Infinity, Math.max(Infinity, 0));
-  assertEquals("-Infinity", String(Math.max(-Infinity, -Infinity)));
-  assertEquals("Infinity", String(Math.max(Infinity, -Infinity)));
-  assertEquals("NaN", String(Math.max(NaN, 1)));
-  assertEquals("Infinity", String(1 / Math.max(0.0, 0.0)));
-  assertEquals("-Infinity", String(1 / Math.max(-0.0, -0.0)));
-  assertEquals("Infinity", String(1 / Math.max(0.0, -0.0)));
+  assertSame(-Infinity, Math.max(-Infinity, -Infinity));
+  assertSame(Infinity, Math.max(Infinity, -Infinity));
+  assertSame(NaN, Math.max(NaN, 1));
+  assertSame(Infinity, 1 / Math.max(0.0, 0.0));
+  assertSame(-Infinity, 1 / Math.max(-0.0, -0.0));
+  assertSame(Infinity, 1 / Math.max(0.0, -0.0));
 });
 
 test(function mathExp() {
   assertEquals(1.0, Math.exp(0.0));
   assertTrue(2.7 < Math.exp(1) && Math.exp(1) < 2.8);
-  assertEquals("Infinity", String(Math.exp(Infinity)));
+  assertSame(Infinity, Math.exp(Infinity));
   assertEquals("0", String(Math.exp(-Infinity)));
-  assertEquals("NaN", String(Math.exp(NaN)));
+  assertSame(NaN, Math.exp(NaN));
 });
 
 test(function mathLog() {
   assertEquals(0.0, Math.log(1.0));
   assertTrue(1 < Math.log(3) && Math.log(3) < 1.5);
-  assertEquals("Infinity", String(Math.log(Infinity)));
-  assertEquals("NaN", String(Math.log(-Infinity)));
-  assertEquals("NaN", String(Math.exp(NaN)));
+  assertSame(Infinity, Math.log(Infinity));
+  assertSame(NaN, Math.log(-Infinity));
+  assertSame(NaN, Math.exp(NaN));
 });
 
 test(function mathSqrt() {
   assertEquals(1.0, Math.sqrt(1.0));
-  assertEquals("NaN", String(Math.sqrt(-1.0)));
-  assertEquals("Infinity", String(Math.sqrt(Infinity)));
-  assertEquals("NaN", String(Math.sqrt(-Infinity)));
-  assertEquals("NaN", String(Math.sqrt(NaN)));
+  assertSame(NaN, Math.sqrt(-1.0));
+  assertSame(Infinity, Math.sqrt(Infinity));
+  assertSame(NaN, Math.sqrt(-Infinity));
+  assertSame(NaN, Math.sqrt(NaN));
 });
 
 test(function mathPowHalf() {
   assertEquals(1.0, Math.pow(1.0, 0.5));
-  assertEquals("NaN", String(Math.sqrt(-1.0)));
-  assertEquals("Infinity", String(Math.pow(Infinity, 0.5)));
-  assertEquals("NaN", String(Math.sqrt(-Infinity, 0.5)));
+  assertSame(NaN, Math.sqrt(-1.0));
+  assertSame(Infinity, Math.pow(Infinity, 0.5));
+  assertSame(NaN, Math.sqrt(-Infinity, 0.5));
   assertEquals(0, Math.pow(Infinity, -0.5));
-  assertEquals("NaN", String(Math.sqrt(-Infinity, -0.5)));
-  assertEquals("NaN", String(Math.sqrt(NaN, 0.5)));
+  assertSame(NaN, Math.sqrt(-Infinity, -0.5));
+  assertSame(NaN, Math.sqrt(NaN, 0.5));
 });
 
 test(function mathAbs() {
   assertEquals(1.5, Math.abs(1.5));
   assertEquals(1.5, Math.abs(-1.5));
-  assertEquals("Infinity", String(Math.abs(Infinity)));
-  assertEquals("Infinity", String(Math.abs(-Infinity)));
-  assertEquals("NaN", String(Math.abs(NaN)));
+  assertSame(Infinity, Math.abs(Infinity));
+  assertSame(Infinity, Math.abs(-Infinity));
+  assertSame(NaN, Math.abs(NaN));
 });
 
 test(function mathRound() {
   assertEquals(2, Math.round(1.5));
   assertEquals(-1, Math.round(-1.5));
-  assertEquals("Infinity", String(Math.round(Infinity)));
-  assertEquals("-Infinity", String(Math.round(-Infinity)));
-  assertEquals("Infinity", String(1 / Math.round(0.0)));
-  assertEquals("-Infinity", String(1 / Math.round(-0.0)));
-  assertEquals("NaN", String(Math.round(NaN)));
+  assertSame(Infinity, Math.round(Infinity));
+  assertSame(-Infinity, Math.round(-Infinity));
+  assertSame(Infinity, 1 / Math.round(0.0));
+  assertSame(-Infinity, 1 / Math.round(-0.0));
+  assertSame(NaN, Math.round(NaN));
   assertEquals(Math.pow(2, 52) + 1, Math.round(Math.pow(2, 52) + 1));
 });
 
 test(function mathFround() {
   assertTrue(isNaN(Math.fround(NaN)));
-  assertEquals("Infinity", String(1/Math.fround(0)));
-  assertEquals("-Infinity", String(1/Math.fround(-0)));
-  assertEquals("Infinity", String(Math.fround(Infinity)));
-  assertEquals("-Infinity", String(Math.fround(-Infinity)));
-  assertEquals("Infinity", String(Math.fround(1E200)));
-  assertEquals("-Infinity", String(Math.fround(-1E200)));
+  assertSame(Infinity, 1 / Math.fround(0));
+  assertSame(-Infinity, 1 / Math.fround(-0));
+  assertSame(Infinity, Math.fround(Infinity));
+  assertSame(-Infinity, Math.fround(-Infinity));
+  assertSame(Infinity, Math.fround(1E200));
+  assertSame(-Infinity, Math.fround(-1E200));
   assertEquals(3.1415927410125732, Math.fround(Math.PI));
 });
 
 test(function mathFloor() {
   assertEquals(1, Math.floor(1.5));
   assertEquals(-2, Math.floor(-1.5));
-  assertEquals("Infinity", String(Math.floor(Infinity)));
-  assertEquals("-Infinity", String(Math.floor(-Infinity)));
-  assertEquals("Infinity", String(1 / Math.floor(0.0)));
-  assertEquals("-Infinity", String(1 / Math.floor(-0.0)));
-  assertEquals("NaN", String(Math.floor(NaN)));
+  assertSame(Infinity, Math.floor(Infinity));
+  assertSame(-Infinity, Math.floor(-Infinity));
+  assertSame(Infinity, 1 / Math.floor(0.0));
+  assertSame(-Infinity, 1 / Math.floor(-0.0));
+  assertSame(NaN, Math.floor(NaN));
   assertEquals(Math.pow(2, 52) + 1, Math.floor(Math.pow(2, 52) + 1));
 });
 
 test(function mathPow() {
   assertEquals(2.25, Math.pow(1.5, 2));
   assertTrue(1.8 < Math.pow(1.5, 1.5) && Math.pow(1.5, 1.5) < 1.9);
-  assertEquals("Infinity", String(Math.pow(Infinity, 0.5)));
-  assertEquals("Infinity", String(Math.pow(-Infinity, 0.5)));
+  assertSame(Infinity, Math.pow(Infinity, 0.5));
+  assertSame(Infinity, Math.pow(-Infinity, 0.5));
   assertEquals(0, Math.pow(Infinity, -0.5));
   assertEquals(0, Math.pow(Infinity, -0.5));
-  assertEquals("Infinity", String(Math.pow(Infinity, Infinity)));
+  assertSame(Infinity, Math.pow(Infinity, Infinity));
   assertEquals(0, Math.pow(Infinity, -Infinity));
-  assertEquals("NaN", String(Math.pow(Infinity, NaN)));
-  assertEquals("NaN", String(Math.pow(NaN, 2)));
+  assertSame(NaN, Math.pow(Infinity, NaN));
+  assertSame(NaN, Math.pow(NaN, 2));
 });
 
 test(function stringAdd() {
@@ -226,24 +234,66 @@
   assertEquals(-5, { length: -5 }.length);
 });
 
-test(function stringCharCodeAt() {
-  assertEquals(99, "abc".charCodeAt(2));
-  assertEquals("NaN", String("abc".charCodeAt(-1)));
-  assertEquals("NaN", String("abc".charCodeAt(4)));
-  assertEquals(98, "abc".charCodeAt(1.1));
-  assertEquals("NaN", String("abc".charCodeAt(4.1)));
-  assertEquals("NaN", String("abc".charCodeAt(1 + 4294967295)));
-});
-
 test(function stringCharAt() {
   assertEquals("c", "abc".charAt(2));
   assertEquals("", "abc".charAt(-1));
   assertEquals("", "abc".charAt(4));
   assertEquals("b", "abc".charAt(1.1));
   assertEquals("", "abc".charAt(4.1));
-  assertEquals("", String("abc".charAt(1 + 4294967295)));
-});
+  assertEquals("", "abc".charAt(Infinity));
+  assertEquals("", "abc".charAt(-Infinity));
+  assertEquals("a", "abc".charAt(-0));
+  assertEquals("a", "abc".charAt(+0));
+  assertEquals("", "".charAt());
+  assertEquals("", "abc".charAt(1 + 4294967295));
+}, 10);
 
+test(function stringCharCodeAt() {
+  assertSame(99, "abc".charCodeAt(2));
+  assertSame(NaN, "abc".charCodeAt(-1));
+  assertSame(NaN, "abc".charCodeAt(4));
+  assertSame(98, "abc".charCodeAt(1.1));
+  assertSame(NaN, "abc".charCodeAt(4.1));
+  assertSame(NaN, "abc".charCodeAt(Infinity));
+  assertSame(NaN, "abc".charCodeAt(-Infinity));
+  assertSame(97, "abc".charCodeAt(-0));
+  assertSame(97, "abc".charCodeAt(+0));
+  assertSame(NaN, "".charCodeAt());
+  assertSame(NaN, "abc".charCodeAt(1 + 4294967295));
+}, 10);
+
+test(function stringCodePointAt() {
+  assertSame(65533, "äϠ�𝌆".codePointAt(2));
+  assertSame(119558, "äϠ�𝌆".codePointAt(3));
+  assertSame(undefined, "äϠ�".codePointAt(-1));
+  assertSame(undefined, "äϠ�".codePointAt(4));
+  assertSame(992, "äϠ�".codePointAt(1.1));
+  assertSame(undefined, "äϠ�".codePointAt(4.1));
+  assertSame(undefined, "äϠ�".codePointAt(Infinity));
+  assertSame(undefined, "äϠ�".codePointAt(-Infinity));
+  assertSame(228, "äϠ�".codePointAt(-0));
+  assertSame(97, "aϠ�".codePointAt(+0));
+  assertSame(undefined, "".codePointAt());
+  assertSame(undefined, "äϠ�".codePointAt(1 + 4294967295));
+}, 10);
+
+test(function stringFromCodePoint() {
+  assertEquals(String.fromCodePoint(""), "\0");
+  assertEquals(String.fromCodePoint(), "");
+  assertEquals(String.fromCodePoint(-0), "\0");
+  assertEquals(String.fromCodePoint(0), "\0");
+  assertEquals(String.fromCodePoint(0x1D306), "\uD834\uDF06");
+  assertEquals(
+    String.fromCodePoint(0x1D306, 0x61, 0x1D307),
+    "\uD834\uDF06a\uD834\uDF07");
+  assertEquals(String.fromCodePoint(0x61, 0x62, 0x1D307), "ab\uD834\uDF07");
+  assertEquals(String.fromCodePoint(false), "\0");
+  assertEquals(String.fromCodePoint(null), "\0");
+}, 5);
+
+test(function stringFromCharCode() {
+  assertEquals("!", String.fromCharCode(0x10FF01));
+}, 2);
 
 test(function int32Mod() {
   assertEquals(-0, -2147483648 % (-1));
diff --git a/src/v8/test/mjsunit/constant-folding.js b/src/v8/test/mjsunit/constant-folding.js
index d6ac9fe..c147896 100644
--- a/src/v8/test/mjsunit/constant-folding.js
+++ b/src/v8/test/mjsunit/constant-folding.js
@@ -147,7 +147,6 @@
   switch(3) {
     case 5:
       assertUnreachable();
-      break;
     case 3:
       j = 13;
     default:
@@ -158,7 +157,6 @@
     case 9:
       j = 19;
       assertUnreachable();
-      break;
   }
   assertEquals(17, j, "switch with constant value");
 }
diff --git a/src/v8/test/mjsunit/context-calls-maintained.js b/src/v8/test/mjsunit/context-calls-maintained.js
index 95bf552..15094d2 100644
--- a/src/v8/test/mjsunit/context-calls-maintained.js
+++ b/src/v8/test/mjsunit/context-calls-maintained.js
@@ -44,6 +44,7 @@
   function f() { foo(1); }
 
   // Drive to monomorphic
+  %PrepareFunctionForOptimization(f);
   f(); f(); f();
 
   delete foo;
@@ -63,6 +64,7 @@
 
   foo = function(arg) { return arg * 3; }
   function g() { this.foo(1); }
+  %PrepareFunctionForOptimization(g);
   g(); g(); g();
   delete foo;
   assertThrows(function() { g(); }, TypeError);
@@ -77,7 +79,8 @@
 
 // Test: verify that a load with IC does the right thing.
 (function() {
-  var foo = function() { return a; }
+  var foo = function() { return a; };
+  %PrepareFunctionForOptimization(foo);
   a = 3;
   foo(); foo(); foo();
   delete a;
@@ -100,7 +103,8 @@
 // if the variable isn't found.
 (function() {
   var foo = function() { a = 3; }
-  var bar = function() { "use strict"; a = 3; }
+  var bar = function() { "use strict"; a = 3; };
+  %PrepareFunctionForOptimization(bar);
   foo(); foo(); foo();
   delete a;
   assertThrows(function() { bar(); }, ReferenceError);
diff --git a/src/v8/test/mjsunit/cross-realm-filtering.js b/src/v8/test/mjsunit/cross-realm-filtering.js
index b4e2520..60bf5b0 100644
--- a/src/v8/test/mjsunit/cross-realm-filtering.js
+++ b/src/v8/test/mjsunit/cross-realm-filtering.js
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --experimental-stack-trace-frames
+
 var realms = [Realm.current(), Realm.create()];
 
 // Check stack trace filtering across security contexts.
@@ -34,17 +36,17 @@
 
 Realm.eval(realms[1], script);
 assertSame(2, Realm.shared.error_0.length);
-assertSame(3, Realm.shared.error_1.length);
+assertSame(4, Realm.shared.error_1.length);
 
-assertTrue(Realm.shared.thrower_1 === Realm.shared.error_1[1].getFunction());
+assertTrue(Realm.shared.thrower_1 === Realm.shared.error_1[2].getFunction());
 assertNotIn(Realm.shared.thrower_0, Realm.shared.error_0);
 assertNotIn(Realm.shared.thrower_0, Realm.shared.error_1);
 
 Realm.eval(realms[0], script);
-assertSame(4, Realm.shared.error_0.length);
-assertSame(3, Realm.shared.error_1.length);
+assertSame(6, Realm.shared.error_0.length);
+assertSame(4, Realm.shared.error_1.length);
 
-assertTrue(Realm.shared.thrower_0 === Realm.shared.error_0[1].getFunction());
+assertTrue(Realm.shared.thrower_0 === Realm.shared.error_0[2].getFunction());
 assertNotIn(Realm.shared.thrower_1, Realm.shared.error_0);
 assertNotIn(Realm.shared.thrower_1, Realm.shared.error_1);
 
diff --git a/src/v8/test/mjsunit/cross-realm-global-prototype.js b/src/v8/test/mjsunit/cross-realm-global-prototype.js
index 46e5a3a..130d1b3 100644
--- a/src/v8/test/mjsunit/cross-realm-global-prototype.js
+++ b/src/v8/test/mjsunit/cross-realm-global-prototype.js
@@ -8,6 +8,7 @@
 var realm = Realm.create();
 var test = Realm.eval(realm,
     "() => { return Realm.global(0) instanceof Object }");
+%PrepareFunctionForOptimization(test);
 
 assertFalse(test());
 
diff --git a/src/v8/test/mjsunit/d8/d8-arguments.js b/src/v8/test/mjsunit/d8/d8-arguments.js
new file mode 100644
index 0000000..5e44ea0
--- /dev/null
+++ b/src/v8/test/mjsunit/d8/d8-arguments.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: -- 1 2 3
+
+assertEquals(["1", "2", "3"], arguments);
diff --git a/src/v8/test/mjsunit/d8/d8-worker-script.js b/src/v8/test/mjsunit/d8/d8-worker-script.js
new file mode 100644
index 0000000..7c5d595
--- /dev/null
+++ b/src/v8/test/mjsunit/d8/d8-worker-script.js
@@ -0,0 +1,39 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Verify that the Worker constrcutor by default treats its first argument
+// as the filename of a script load and run.
+
+// Resources: test/mjsunit/d8/d8-worker-script.txt
+
+if (this.Worker) {
+  var w = new Worker('test/mjsunit/d8/d8-worker-script.txt');
+  assertEquals("Starting worker", w.getMessage());
+  w.postMessage("");
+  assertEquals("DONE", w.getMessage());
+  w.terminate();
+}
diff --git a/src/v8/test/mjsunit/d8/d8-worker-script.txt b/src/v8/test/mjsunit/d8/d8-worker-script.txt
new file mode 100644
index 0000000..9254cea
--- /dev/null
+++ b/src/v8/test/mjsunit/d8/d8-worker-script.txt
@@ -0,0 +1,8 @@
+// Worker script used by d8-worker-script.js.
+// This file is named `.txt` to prevent it being treated as a test itself.
+
+onmessage = function(m) {
+  postMessage('DONE');
+}
+
+postMessage('Starting worker');
diff --git a/src/v8/test/mjsunit/d8/d8-worker-sharedarraybuffer.js b/src/v8/test/mjsunit/d8/d8-worker-sharedarraybuffer.js
index 09586c3..f166ca2 100644
--- a/src/v8/test/mjsunit/d8/d8-worker-sharedarraybuffer.js
+++ b/src/v8/test/mjsunit/d8/d8-worker-sharedarraybuffer.js
@@ -28,24 +28,24 @@
 // Flags: --harmony-sharedarraybuffer
 
 if (this.Worker) {
-  (function TestTransfer() {
+  (function TestClone() {
     var workerScript =
       `onmessage = function(m) {
         var sab = m;
         var ta = new Uint32Array(sab);
         if (sab.byteLength !== 16) {
-          throw new Error('SharedArrayBuffer transfer byteLength');
+          throw new Error('SharedArrayBuffer clone byteLength');
         }
         for (var i = 0; i < 4; ++i) {
           if (ta[i] !== i) {
-            throw new Error('SharedArrayBuffer transfer value ' + i);
+            throw new Error('SharedArrayBuffer clone value ' + i);
           }
         }
         // Atomically update ta[0]
         Atomics.store(ta, 0, 100);
       };`;
 
-    var w = new Worker(workerScript);
+    var w = new Worker(workerScript, {type: 'string'});
 
     var sab = new SharedArrayBuffer(16);
     var ta = new Uint32Array(sab);
@@ -53,7 +53,7 @@
       ta[i] = i;
     }
 
-    // Transfer SharedArrayBuffer
+    // Clone SharedArrayBuffer
     w.postMessage(sab);
     assertEquals(16, sab.byteLength);  // ArrayBuffer should not be neutered.
 
@@ -68,7 +68,7 @@
     assertEquals(16, sab.byteLength);  // Still not neutered.
   })();
 
-  (function TestTransferMulti() {
+  (function TestCloneMulti() {
     var workerScript =
       `onmessage = function(msg) {
        var sab = msg.sab;
@@ -84,7 +84,7 @@
     var id;
     var workers = [];
     for (id = 0; id < 4; ++id) {
-      workers[id] = new Worker(workerScript);
+      workers[id] = new Worker(workerScript, {type: 'string'});
       workers[id].postMessage({sab: sab, id: id});
     }
 
diff --git a/src/v8/test/mjsunit/d8/d8-worker-spawn-worker.js b/src/v8/test/mjsunit/d8/d8-worker-spawn-worker.js
index a114d85..621ec25 100644
--- a/src/v8/test/mjsunit/d8/d8-worker-spawn-worker.js
+++ b/src/v8/test/mjsunit/d8/d8-worker-spawn-worker.js
@@ -27,14 +27,14 @@
 
 if (this.Worker) {
   var workerScript =
-    `var w = new Worker('postMessage(42)');
+    `var w = new Worker('postMessage(42)', {type: 'string'});
      onmessage = function(parentMsg) {
        w.postMessage(parentMsg);
        var childMsg = w.getMessage();
        postMessage(childMsg);
      };`;
 
-  var w = new Worker(workerScript);
+  var w = new Worker(workerScript, {type: 'string'});
   w.postMessage(9);
   assertEquals(42, w.getMessage());
 }
diff --git a/src/v8/test/mjsunit/d8/d8-worker.js b/src/v8/test/mjsunit/d8/d8-worker.js
index a73d7b1..afc03f5 100644
--- a/src/v8/test/mjsunit/d8/d8-worker.js
+++ b/src/v8/test/mjsunit/d8/d8-worker.js
@@ -97,7 +97,21 @@
     return ab;
   }
 
-  var w = new Worker(workerScript);
+  assertThrows(function() {
+    // Second arg must be 'options' object
+    new Worker(workerScript, 123);
+  });
+
+  assertThrows(function() {
+    new Worker('test/mjsunit/d8/d8-worker.js', {type: 'invalid'});
+  });
+
+  assertThrows(function() {
+    // worker type defaults to 'classic' which tries to load from file
+    new Worker(workerScript);
+  });
+
+  var w = new Worker(workerScript, {type: 'string'});
 
   assertEquals("Starting worker", w.getMessage());
 
@@ -140,6 +154,12 @@
   w.postMessage(ab2, [ab2]);
   assertEquals(0, ab2.byteLength);  // ArrayBuffer should be neutered.
 
+  // Attempting to transfer the same ArrayBuffer twice should throw.
+  assertThrows(function() {
+    var ab3 = createArrayBuffer(4);
+    w.postMessage(ab3, [ab3, ab3]);
+  });
+
   assertEquals("undefined", typeof foo);
 
   // Read a message from the worker.
@@ -150,7 +170,7 @@
 
   // Make sure that the main thread doesn't block forever in getMessage() if
   // the worker dies without posting a message.
-  var w2 = new Worker('');
+  var w2 = new Worker('', {type: 'string'});
   var msg = w2.getMessage();
   assertEquals(undefined, msg);
 }
diff --git a/src/v8/test/mjsunit/date.js b/src/v8/test/mjsunit/date.js
index fc5bcc5..2b12e8d 100644
--- a/src/v8/test/mjsunit/date.js
+++ b/src/v8/test/mjsunit/date.js
@@ -155,6 +155,11 @@
 assertDoesNotThrow("new Date(-0x40000001, -0x40000001, -0x40000001," +
                    "-0x40000001, -0x40000001, -0x40000001, -0x40000001)")
 
+// Test that date as double type is treated as integer type in MakeDay
+// so that the hour should't be changed.
+d = new Date(2018, 0);
+assertEquals(Date.parse(new Date(2018, 0, 11)), d.setDate(11.2));
+assertEquals(0, d.getHours());
 
 // Modified test from WebKit
 // LayoutTests/fast/js/script-tests/date-utc-timeclip.js:
@@ -353,3 +358,13 @@
   assertTrue(delete Date.prototype.toString);
   assertTrue('[object Date]' !== Date());
 })();
+
+// Test minimum and maximum date range according to ES6 section 20.3.1.1:
+// "The actual range of times supported by ECMAScript Date objects is slightly
+// smaller: exactly -100,000,000 days to 100,000,000 days measured relative to
+// midnight at the beginning of 01 January, 1970 UTC. This gives a range of
+// 8,640,000,000,000,000 milliseconds to either side of 01 January, 1970 UTC."
+assertEquals(-8640000000000000, Date.parse("-271821-04-20T00:00:00.000Z"));
+assertEquals(8640000000000000, Date.parse("+275760-09-13T00:00:00.000Z"));
+assertTrue(isNaN(Date.parse("-271821-04-19T00:00:00.000Z")));
+assertTrue(isNaN(Date.parse("+275760-09-14T00:00:00.000Z")));
diff --git a/src/v8/test/mjsunit/default-nospec.js b/src/v8/test/mjsunit/default-nospec.js
new file mode 100644
index 0000000..98cef31
--- /dev/null
+++ b/src/v8/test/mjsunit/default-nospec.js
@@ -0,0 +1,97 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+(()=> {
+  function f(a, b, c) {
+    return String.prototype.indexOf.call(a, b, c);
+  }
+  %PrepareFunctionForOptimization(f);
+  f("abc", "de", 1);
+  f("abc", "de", 1);
+  %OptimizeFunctionOnNextCall(f);
+  f("abc", "de", {});
+  %PrepareFunctionForOptimization(f);
+  %OptimizeFunctionOnNextCall(f);
+  f("abc", "de", {});
+  assertOptimized(f);
+})();
+
+(()=> {
+  function f(a, b, c) {
+    return String.prototype.indexOf.apply(a, [b, c]);
+  }
+  %PrepareFunctionForOptimization(f);
+  f("abc", "de", 1);
+  f("abc", "de", 1);
+  %OptimizeFunctionOnNextCall(f);
+  f("abc", {}, 1);
+  %PrepareFunctionForOptimization(f);
+  %OptimizeFunctionOnNextCall(f);
+  f("abc", {}, 1);
+  assertOptimized(f);
+})();
+
+(()=> {
+  function f(a, b, c) {
+    return Reflect.apply(String.prototype.indexOf, a, [b, c]);
+  }
+  %PrepareFunctionForOptimization(f);
+  f("abc", "de", 1);
+  f("abc", "de", 1);
+  %PrepareFunctionForOptimization(f);
+  %OptimizeFunctionOnNextCall(f);
+  f({}, "de", 1);
+  %PrepareFunctionForOptimization(f);
+  %OptimizeFunctionOnNextCall(f);
+  f({}, "de", 1);
+  assertOptimized(f);
+})();
+
+(()=> {
+  function f(a, b) {
+    return String.fromCharCode.call(a, b);
+  }
+  %PrepareFunctionForOptimization(f);
+  f("abc", 1);
+  f("abc", 1);
+  %OptimizeFunctionOnNextCall(f);
+  f("abc", {});
+  %PrepareFunctionForOptimization(f);
+  %OptimizeFunctionOnNextCall(f);
+  f({}, {});
+  assertOptimized(f);
+})();
+
+(()=> {
+  function f(a, b) {
+    return String.fromCharCode.apply(undefined, [b, {}]);
+  }
+  %PrepareFunctionForOptimization(f);
+  f("abc", 1);
+  f("abc", 1);
+  %OptimizeFunctionOnNextCall(f);
+  f("abc", {});
+  %PrepareFunctionForOptimization(f);
+  %OptimizeFunctionOnNextCall(f);
+  f("abc", {});
+  assertOptimized(f);
+})();
+
+
+(()=> {
+  function f(a, b) {
+    return Reflect.apply(String.fromCharCode, a, [b, {}]);
+  }
+  %PrepareFunctionForOptimization(f);
+  f("abc", 1);
+  f("abc", 1);
+  %OptimizeFunctionOnNextCall(f);
+  f("abc", {});
+  %PrepareFunctionForOptimization(f);
+  %OptimizeFunctionOnNextCall(f);
+  f("abc", {});
+  assertOptimized(f);
+})();
diff --git a/src/v8/test/mjsunit/dehoisted-array-index.js b/src/v8/test/mjsunit/dehoisted-array-index.js
index f4a32c1..8e660c9 100644
--- a/src/v8/test/mjsunit/dehoisted-array-index.js
+++ b/src/v8/test/mjsunit/dehoisted-array-index.js
@@ -34,6 +34,7 @@
   return a[i + 1];
 }
 
+%PrepareFunctionForOptimization(aoo);
 aoo(1);
 aoo(-1);
 %OptimizeFunctionOnNextCall(aoo);
@@ -51,6 +52,7 @@
   return ret;
 }
 
+%PrepareFunctionForOptimization(boo);
 boo(1);
 boo(-1);
 %OptimizeFunctionOnNextCall(boo);
@@ -67,6 +69,7 @@
   return ret;
 }
 
+%PrepareFunctionForOptimization(coo);
 coo();
 coo();
 %OptimizeFunctionOnNextCall(coo);
@@ -81,6 +84,7 @@
   }
   return ret;
 }
+%PrepareFunctionForOptimization(doo);
 doo();
 doo();
 %OptimizeFunctionOnNextCall(doo);
@@ -97,6 +101,7 @@
 
   return ret;
 }
+%PrepareFunctionForOptimization(eoo);
 eoo();
 eoo();
 %OptimizeFunctionOnNextCall(eoo);
@@ -118,6 +123,7 @@
   return ret;
 }
 
+%PrepareFunctionForOptimization(foo);
 foo();
 foo();
 %OptimizeFunctionOnNextCall(foo);
@@ -133,6 +139,7 @@
 
   return a[i + 3];
 }
+%PrepareFunctionForOptimization(goo);
 goo(-1);
 goo(-1);
 %OptimizeFunctionOnNextCall(goo);
@@ -147,6 +154,7 @@
    return a[index() + 3];
 }
 
+%PrepareFunctionForOptimization(hoo);
 hoo();
 hoo();
 %OptimizeFunctionOnNextCall(hoo);
@@ -157,6 +165,7 @@
   return a[i] + a[i + 1];
 }
 
+%PrepareFunctionForOptimization(ioo);
 ioo(1);
 ioo(1);
 %OptimizeFunctionOnNextCall(ioo);
diff --git a/src/v8/test/mjsunit/deopt-global-accessor.js b/src/v8/test/mjsunit/deopt-global-accessor.js
index 5c544a0..4e6e73d 100644
--- a/src/v8/test/mjsunit/deopt-global-accessor.js
+++ b/src/v8/test/mjsunit/deopt-global-accessor.js
@@ -10,14 +10,18 @@
 
 function f() {
   return x;
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f();
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
 f();
 
-Object.defineProperty(this, "x", {get:function() { return 100; }});
+Object.defineProperty(this, 'x', {
+  get: function() {
+    return 100;
+  }
+});
 
 assertEquals(100, f());
diff --git a/src/v8/test/mjsunit/deopt-minus-zero.js b/src/v8/test/mjsunit/deopt-minus-zero.js
index 38795af..8555a70 100644
--- a/src/v8/test/mjsunit/deopt-minus-zero.js
+++ b/src/v8/test/mjsunit/deopt-minus-zero.js
@@ -31,11 +31,13 @@
   return a * b;
 }
 
+%PrepareFunctionForOptimization(mul);
 mul(-1, -1);
 mul(0x80000001|0, -1);
 mul(0x80000001|0, -1);
 %OptimizeFunctionOnNextCall(mul);
 mul(0, -1);
+%PrepareFunctionForOptimization(mul);
 %OptimizeFunctionOnNextCall(mul);
 mul(0, -1);
 
diff --git a/src/v8/test/mjsunit/deopt-recursive-eager-once.js b/src/v8/test/mjsunit/deopt-recursive-eager-once.js
index 1b4e155..f0bca16 100644
--- a/src/v8/test/mjsunit/deopt-recursive-eager-once.js
+++ b/src/v8/test/mjsunit/deopt-recursive-eager-once.js
@@ -14,18 +14,16 @@
         foo(i - 1, deopt);
     }
 }
+%PrepareFunctionForOptimization(foo);
 
-assertEquals(0, %GetDeoptCount(foo));
-
+%PrepareFunctionForOptimization(foo);
 foo(10);
 foo(10);
 %OptimizeFunctionOnNextCall(foo);
 foo(10);
 
 assertOptimized(foo);
-assertEquals(0, %GetDeoptCount(foo));
 
 foo(10, true);
 
 assertUnoptimized(foo);
-assertEquals(1, %GetDeoptCount(foo));
diff --git a/src/v8/test/mjsunit/deopt-recursive-lazy-once.js b/src/v8/test/mjsunit/deopt-recursive-lazy-once.js
index f75dde7..06f62ef 100644
--- a/src/v8/test/mjsunit/deopt-recursive-lazy-once.js
+++ b/src/v8/test/mjsunit/deopt-recursive-lazy-once.js
@@ -14,18 +14,16 @@
         foo(i - 1, deopt);
     }
 }
+%PrepareFunctionForOptimization(foo);
 
-assertEquals(0, %GetDeoptCount(foo));
-
+%PrepareFunctionForOptimization(foo);
 foo(10);
 foo(10);
 %OptimizeFunctionOnNextCall(foo);
 foo(10);
 
 assertOptimized(foo);
-assertEquals(0, %GetDeoptCount(foo));
 
 foo(10, true);
 
 assertUnoptimized(foo);
-assertEquals(1, %GetDeoptCount(foo));
diff --git a/src/v8/test/mjsunit/deopt-recursive-soft-once.js b/src/v8/test/mjsunit/deopt-recursive-soft-once.js
index f2cadf2..cb27a8d 100644
--- a/src/v8/test/mjsunit/deopt-recursive-soft-once.js
+++ b/src/v8/test/mjsunit/deopt-recursive-soft-once.js
@@ -16,18 +16,14 @@
     }
 }
 
-assertEquals(0, %GetDeoptCount(foo));
-
+%PrepareFunctionForOptimization(foo);
 foo(10);
 foo(10);
 %OptimizeFunctionOnNextCall(foo);
 foo(10);
 
 assertOptimized(foo);
-assertEquals(0, %GetDeoptCount(foo));
 
 foo(10, true, { bar: function(){} });
 
 assertUnoptimized(foo);
-// Soft deopts don't count to the deopt count.
-assertEquals(0, %GetDeoptCount(foo));
diff --git a/src/v8/test/mjsunit/deopt-unlinked.js b/src/v8/test/mjsunit/deopt-unlinked.js
index 1005737..4226314 100644
--- a/src/v8/test/mjsunit/deopt-unlinked.js
+++ b/src/v8/test/mjsunit/deopt-unlinked.js
@@ -3,26 +3,24 @@
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax --opt --no-always-opt
+// The deopt count is stored in the feedback vector which gets cleared when
+// bytecode is flushed, which --gc-interval can cause in stress modes.
+// Flags: --noflush-bytecode --nostress-flush-bytecode
 
-function foo() {}
-
-assertEquals(0, %GetDeoptCount(foo));
-
+function foo() {};
+%PrepareFunctionForOptimization(foo);
 foo();
 foo();
 %OptimizeFunctionOnNextCall(foo);
 foo();
 
 assertOptimized(foo);
-assertEquals(0, %GetDeoptCount(foo));
 
 // Unlink the function.
 %DeoptimizeFunction(foo);
 
 assertUnoptimized(foo);
-assertEquals(1, %GetDeoptCount(foo));
 
 foo();
 
 assertUnoptimized(foo);
-assertEquals(1, %GetDeoptCount(foo));
diff --git a/src/v8/test/mjsunit/deopt-with-fp-regs.js b/src/v8/test/mjsunit/deopt-with-fp-regs.js
index bdb0805..d5f02ac 100644
--- a/src/v8/test/mjsunit/deopt-with-fp-regs.js
+++ b/src/v8/test/mjsunit/deopt-with-fp-regs.js
@@ -75,6 +75,7 @@
   assertEquals(24,   d);
   assertEquals(37.5, e);
 }
+%PrepareFunctionForOptimization(test);
 
 
 test(10.0, 20.0, 30.0, 40.0, 50.0, 1.5);
diff --git a/src/v8/test/mjsunit/deopt-with-outer-context.js b/src/v8/test/mjsunit/deopt-with-outer-context.js
index 42a829d..52c7a37 100644
--- a/src/v8/test/mjsunit/deopt-with-outer-context.js
+++ b/src/v8/test/mjsunit/deopt-with-outer-context.js
@@ -8,13 +8,15 @@
   function inner() {
     var x = 10;
     (function() {
-       // Access x from inner function to force it to be context allocated.
-       x = 20;
-       %DeoptimizeFunction(inner);
+      // Access x from inner function to force it to be context allocated.
+      x = 20;
+      %DeoptimizeFunction(inner);
     })();
     // Variable y should be read from the outer context.
     return y;
   };
+  %PrepareFunctionForOptimization(inner);
+  ;
   %OptimizeFunctionOnNextCall(inner);
   return inner();
 }
diff --git a/src/v8/test/mjsunit/deserialize-optimize-inner.js b/src/v8/test/mjsunit/deserialize-optimize-inner.js
index ca78b8a..50976bc 100644
--- a/src/v8/test/mjsunit/deserialize-optimize-inner.js
+++ b/src/v8/test/mjsunit/deserialize-optimize-inner.js
@@ -6,6 +6,7 @@
 
 function f(x, y) { return x + y; }
 
+%PrepareFunctionForOptimization(f);
 assertEquals(1, f(0, 1));
 assertEquals(5, f(2, 3));
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/dictionary-prototypes.js b/src/v8/test/mjsunit/dictionary-prototypes.js
index 109f8d4..0186c63 100644
--- a/src/v8/test/mjsunit/dictionary-prototypes.js
+++ b/src/v8/test/mjsunit/dictionary-prototypes.js
@@ -47,6 +47,7 @@
   assertEquals(1, bar_func_called);
 }
 
+%EnsureFeedbackVectorForFunction(TestAddingPropertyToDictionaryPrototype);
 TestAddingPropertyToDictionaryPrototype();
 
 // Same as TestAddingPropertyToDictionaryPrototype, but using o["foo"] access
@@ -82,6 +83,7 @@
   assertEquals(1, bar_func_called);
 }
 
+%EnsureFeedbackVectorForFunction(TestAddingPropertyToDictionaryPrototype2);
 TestAddingPropertyToDictionaryPrototype2();
 
 function TestAddingPropertyToDictionaryPrototype_DefineProperty() {
@@ -113,6 +115,7 @@
   assertEquals(1, bar_func_called);
 }
 
+%EnsureFeedbackVectorForFunction(TestAddingPropertyToDictionaryPrototype_DefineProperty);
 TestAddingPropertyToDictionaryPrototype_DefineProperty();
 
 function TestAddingPropertyToDictionaryPrototype_DictionaryAddSlowPath() {
@@ -146,6 +149,7 @@
   assertEquals(1, bar_func_called);
 }
 
+%EnsureFeedbackVectorForFunction(TestAddingPropertyToDictionaryPrototype_DictionaryAddSlowPath);
 TestAddingPropertyToDictionaryPrototype_DictionaryAddSlowPath();
 
 function TestAddingAccessorPropertyToDictionaryPrototype() {
@@ -177,6 +181,7 @@
   assertEquals(1, bar_func_called);
 }
 
+%EnsureFeedbackVectorForFunction(TestAddingAccessorPropertyToDictionaryPrototype);
 TestAddingAccessorPropertyToDictionaryPrototype();
 
 function TestRemovingPropertyFromDictionaryPrototype() {
@@ -208,6 +213,7 @@
   assertEquals(10, bar_func_called);
 }
 
+%EnsureFeedbackVectorForFunction(TestRemovingPropertyFromDictionaryPrototype);
 TestRemovingPropertyFromDictionaryPrototype();
 
 // Same as TestRemovingPropertyFromDictionaryPrototype, but using o["foo"] access
@@ -242,6 +248,7 @@
   assertEquals(10, bar_func_called);
 }
 
+%EnsureFeedbackVectorForFunction(TestRemovingPropertyFromDictionaryPrototype2);
 TestRemovingPropertyFromDictionaryPrototype2();
 
 function TestAddingPropertyToDictionaryPrototype_Monomorphic() {
@@ -286,6 +293,7 @@
   assertEquals(1, bar_func_called);
 }
 
+%EnsureFeedbackVectorForFunction(TestAddingPropertyToDictionaryPrototype_Monomorphic);
 TestAddingPropertyToDictionaryPrototype_Monomorphic();
 
 function TestAddingKeyedPropertyToDictionaryPrototype_Monomorphic() {
@@ -331,6 +339,7 @@
   assertEquals(1, bar_func_called);
 }
 
+%EnsureFeedbackVectorForFunction(TestAddingKeyedPropertyToDictionaryPrototype_Monomorphic);
 TestAddingKeyedPropertyToDictionaryPrototype_Monomorphic();
 
 // Like TestAddingPropertyToDictionaryPrototype, except that the prototype isn't
@@ -369,6 +378,7 @@
   assertEquals(1, bar_func_called);
 }
 
+%EnsureFeedbackVectorForFunction(TestAddingPropertyToAlmostDictionaryPrototype);
 TestAddingPropertyToAlmostDictionaryPrototype();
 
 function TestReconfiguringDataToAccessor() {
@@ -406,4 +416,5 @@
   assertEquals(1, setter_called);
 }
 
+%EnsureFeedbackVectorForFunction(TestReconfiguringDataToAccessor);
 TestReconfiguringDataToAccessor();
diff --git a/src/v8/test/mjsunit/div-mod.js b/src/v8/test/mjsunit/div-mod.js
index 08cee8c..ccdac8d 100644
--- a/src/v8/test/mjsunit/div-mod.js
+++ b/src/v8/test/mjsunit/div-mod.js
@@ -305,6 +305,7 @@
 
 }
 
+%PrepareFunctionForOptimization(lithium_integer_mod);
 lithium_integer_mod();
 %OptimizeFunctionOnNextCall(lithium_integer_mod)
 lithium_integer_mod();
diff --git a/src/v8/test/mjsunit/div-mul-minus-one.js b/src/v8/test/mjsunit/div-mul-minus-one.js
index 71ad299..da6f8e3 100644
--- a/src/v8/test/mjsunit/div-mul-minus-one.js
+++ b/src/v8/test/mjsunit/div-mul-minus-one.js
@@ -30,7 +30,7 @@
 function div(g) {
   return (g/-1) ^ 1
 }
-
+%PrepareFunctionForOptimization(div);
 var kMinInt = 1 << 31;
 var expected_MinInt = div(kMinInt);
 var expected_minus_zero = div(0);
@@ -42,6 +42,7 @@
   return (g * -1) ^ 1
 }
 
+%PrepareFunctionForOptimization(mul);
 expected_MinInt = mul(kMinInt);
 expected_minus_zero = mul(0);
 %OptimizeFunctionOnNextCall(mul);
diff --git a/src/v8/test/mjsunit/double-truncation.js b/src/v8/test/mjsunit/double-truncation.js
index b43e1e6..7532629 100644
--- a/src/v8/test/mjsunit/double-truncation.js
+++ b/src/v8/test/mjsunit/double-truncation.js
@@ -30,8 +30,8 @@
 function RunOneTruncationTest(a, b) {
   var temp = a | 0;
   assertEquals(b, temp);
-}
-
+};
+%PrepareFunctionForOptimization(RunOneTruncationTest);
 function RunAllTruncationTests() {
   RunOneTruncationTest(0, 0);
   RunOneTruncationTest(0.5, 0);
diff --git a/src/v8/test/mjsunit/element-accessor.js b/src/v8/test/mjsunit/element-accessor.js
index 94acc5c..8d412ed 100644
--- a/src/v8/test/mjsunit/element-accessor.js
+++ b/src/v8/test/mjsunit/element-accessor.js
@@ -19,9 +19,14 @@
 
   var set = 0;
 
-  Object.defineProperty(o, "3", {
-    get:function() { return 100; },
-    set:function(v) { set = v; }});
+  Object.defineProperty(o, '3', {
+    get: function() {
+      return 100;
+    },
+    set: function(v) {
+      set = v;
+    }
+  });
 
   store(o, 3, 1000);
   assertEquals(1000, set);
@@ -32,25 +37,22 @@
   var o = new Int32Array(1);
   assertThrows(
       () => Object.defineProperty(o, '0', {get: function() {}}), TypeError);
-  assertEquals({
-    value: 0,
-    writable: true,
-    enumerable: true,
-    configurable: false
-  }, Object.getOwnPropertyDescriptor(o, "0"));
+  assertEquals(
+      {value: 0, writable: true, enumerable: true, configurable: false},
+      Object.getOwnPropertyDescriptor(o, '0'));
 })();
 
 (function() {
-  function f() {
-    var a = new Array();
-    a[1] = 1.5;
-    return a;
-  }
-
-  f();
-  f();
-  %OptimizeFunctionOnNextCall(f);
-  var a = f();
-  a[2] = 2;
-  assertEquals(3, a.length);
+function f() {
+  var a = new Array();
+  a[1] = 1.5;
+  return a;
+};
+%PrepareFunctionForOptimization(f);
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+var a = f();
+a[2] = 2;
+assertEquals(3, a.length);
 })();
diff --git a/src/v8/test/mjsunit/elements-kind-depends.js b/src/v8/test/mjsunit/elements-kind-depends.js
index 539fbd0..2e550c2 100644
--- a/src/v8/test/mjsunit/elements-kind-depends.js
+++ b/src/v8/test/mjsunit/elements-kind-depends.js
@@ -34,6 +34,7 @@
   a[2] = 20;
   return a;
 }
+%PrepareFunctionForOptimization(burn);
 
 function check(a) {
   assertEquals(10, a[0]);
@@ -56,6 +57,7 @@
     x[i] = (i+1) * 0.5;
   }
 }
+%PrepareFunctionForOptimization(loop_test);
 
 function check2(b) {
   assertEquals(0.5, b[0]);
diff --git a/src/v8/test/mjsunit/elements-kind.js b/src/v8/test/mjsunit/elements-kind.js
index e220f16..d98ceda 100644
--- a/src/v8/test/mjsunit/elements-kind.js
+++ b/src/v8/test/mjsunit/elements-kind.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --expose-gc --nostress-opt --typed-array-max-size-in-heap=2048
+// Flags: --allow-natives-syntax --expose-gc --nostress-opt
 
 var elements_kind = {
   fast_smi_only             :  'fast smi only elements',
@@ -151,6 +151,7 @@
   }
   var smi_only = new Array(1, 2, 3);
   assertKind(elements_kind.fast_smi_only, smi_only);
+  %PrepareFunctionForOptimization(monomorphic);
   for (var i = 0; i < 3; i++) monomorphic(smi_only);
     %OptimizeFunctionOnNextCall(monomorphic);
   monomorphic(smi_only);
@@ -174,20 +175,25 @@
   return eval(make_array_string());
 }
 
+%EnsureFeedbackVectorForFunction(construct_smis);
 function construct_smis() {
   var a = make_array();
   a[0] = 0;  // Send the COW array map to the steak house.
   assertKind(elements_kind.fast_smi_only, a);
   return a;
 }
+
   %NeverOptimizeFunction(construct_doubles);
+%EnsureFeedbackVectorForFunction(construct_doubles);
 function construct_doubles() {
   var a = construct_smis();
   a[0] = 1.5;
   assertKind(elements_kind.fast_double, a);
   return a;
 }
+
   %NeverOptimizeFunction(construct_objects);
+%EnsureFeedbackVectorForFunction(construct_objects);
 function construct_objects() {
   var a = construct_smis();
   a[0] = "one";
@@ -196,24 +202,26 @@
 }
 
 // Test crankshafted transition SMI->DOUBLE.
-  %NeverOptimizeFunction(convert_to_double);
+  %EnsureFeedbackVectorForFunction(convert_to_double);
 function convert_to_double(array) {
   array[1] = 2.5;
   assertKind(elements_kind.fast_double, array);
   assertEquals(2.5, array[1]);
-}
+};
+%PrepareFunctionForOptimization(convert_to_double);
 var smis = construct_smis();
 for (var i = 0; i < 3; i++) convert_to_double(smis);
   %OptimizeFunctionOnNextCall(convert_to_double);
 smis = construct_smis();
 convert_to_double(smis);
 // Test crankshafted transitions SMI->FAST and DOUBLE->FAST.
-  %NeverOptimizeFunction(convert_to_fast);
+  %EnsureFeedbackVectorForFunction(convert_to_fast);
 function convert_to_fast(array) {
   array[1] = "two";
   assertKind(elements_kind.fast, array);
   assertEquals("two", array[1]);
-}
+};
+%PrepareFunctionForOptimization(convert_to_fast);
 smis = construct_smis();
 for (var i = 0; i < 3; i++) convert_to_fast(smis);
 var doubles = construct_doubles();
@@ -225,12 +233,12 @@
 convert_to_fast(doubles);
 // Test transition chain SMI->DOUBLE->FAST (crankshafted function will
 // transition to FAST directly).
-  %NeverOptimizeFunction(convert_mixed);
 function convert_mixed(array, value, kind) {
   array[1] = value;
   assertKind(kind, array);
   assertEquals(value, array[1]);
 }
+%PrepareFunctionForOptimization(convert_mixed);
 smis = construct_smis();
 for (var i = 0; i < 3; i++) {
   convert_mixed(smis, 1.5, elements_kind.fast_double);
@@ -241,12 +249,17 @@
 }
 convert_mixed(construct_smis(), "three", elements_kind.fast);
 convert_mixed(construct_doubles(), "three", elements_kind.fast);
+
+if (%ICsAreEnabled()) {
+  // Test that allocation sites allocate correct elements kind initially based
+  // on previous transitions.
   %OptimizeFunctionOnNextCall(convert_mixed);
-smis = construct_smis();
-doubles = construct_doubles();
-convert_mixed(smis, 1, elements_kind.fast);
-convert_mixed(doubles, 1, elements_kind.fast);
-assertTrue(%HaveSameMap(smis, doubles));
+  smis = construct_smis();
+  doubles = construct_doubles();
+  convert_mixed(smis, 1, elements_kind.fast);
+  convert_mixed(doubles, 1, elements_kind.fast);
+  assertTrue(%HaveSameMap(smis, doubles));
+}
 
 // Crankshaft support for smi-only elements in dynamic array literals.
 function get(foo) { return foo; }  // Used to generate dynamic values.
@@ -262,6 +275,7 @@
   var c = [get(1), get(2), get(3.5)];
   assertKind(elements_kind.fast_double, c);
 }
+%PrepareFunctionForOptimization(crankshaft_test);
 for (var i = 0; i < 3; i++) {
   crankshaft_test();
 }
diff --git a/src/v8/test/mjsunit/elements-transition-hoisting.js b/src/v8/test/mjsunit/elements-transition-hoisting.js
index dcd742e..0406dc7 100644
--- a/src/v8/test/mjsunit/elements-transition-hoisting.js
+++ b/src/v8/test/mjsunit/elements-transition-hoisting.js
@@ -45,6 +45,7 @@
     } while (--count > 0);
   }
 
+  %PrepareFunctionForOptimization(testDoubleConversion4);
   testDoubleConversion4(new Array(5));
   testDoubleConversion4(new Array(5));  // Call twice to make sure that second
                                         // store is a transition and not
@@ -71,6 +72,7 @@
     } while (--count > 0);
   }
 
+  %PrepareFunctionForOptimization(testExactMapHoisting);
   testExactMapHoisting(new Array(5));
   testExactMapHoisting(new Array(5));  // Call twice to make sure that second
                                        // store is a transition and not
@@ -102,6 +104,7 @@
     } while (--count > 0);
   }
 
+  %PrepareFunctionForOptimization(testExactMapHoisting2);
   testExactMapHoisting2(new Array(5));
   testExactMapHoisting2(new Array(5));  // Call twice to make sure that second
                                         // store is a transition and not
@@ -129,6 +132,7 @@
     } while (--count > 0);
   }
 
+  %PrepareFunctionForOptimization(testExactMapHoisting3);
   var add_transition = new Array(5);
   add_transition.foo = 0;
   add_transition[0] = new Object();  // For FAST_ELEMENT transition to be created
@@ -155,6 +159,7 @@
   }
 
   /*
+  %PrepareFunctionForOptimization(testDominatingTransitionHoisting1);
   testDominatingTransitionHoisting1(new Array(5));
   testDominatingTransitionHoisting1(new Array(5));  // Call twice to make sure
                                                     // that second store is a
@@ -180,6 +185,7 @@
     } while (--count > 3);
   }
 
+  %PrepareFunctionForOptimization(testHoistingWithSideEffect);
   testHoistingWithSideEffect(new Array(5));
   testHoistingWithSideEffect(new Array(5));  // Call twice to make sure that
                                              // second store is a transition and
@@ -203,6 +209,7 @@
     } while (--count > 3);
   }
 
+  %PrepareFunctionForOptimization(testStraightLineDupeElinination);
   testStraightLineDupeElinination(new Array(0, 0, 0, 0, 0),0,0,0,0,.5);
   testStraightLineDupeElinination(new Array(0, 0, 0, 0, 0),0,0,0,.5,0);
   testStraightLineDupeElinination(new Array(0, 0, 0, 0, 0),0,0,.5,0,0);
diff --git a/src/v8/test/mjsunit/elide-double-hole-check-1.js b/src/v8/test/mjsunit/elide-double-hole-check-1.js
index 63569df..0fc2530 100644
--- a/src/v8/test/mjsunit/elide-double-hole-check-1.js
+++ b/src/v8/test/mjsunit/elide-double-hole-check-1.js
@@ -32,6 +32,7 @@
 }
 
 var a1 = [,,,,,,,,,,,,,,,,,,0.5];
+%PrepareFunctionForOptimization(f1);
 assertEquals(undefined, f1(a1, 1));
 assertEquals(undefined, f1(a1, 1));
 %OptimizeFunctionOnNextCall(f1);
@@ -42,6 +43,7 @@
   return a[i] + 0.5;
 }
 var a2_b = [0.0,,];
+%PrepareFunctionForOptimization(f2);
 assertEquals(0.5, f2(a2_b, 0));
 assertEquals(0.5, f2(a2_b, 0));
 %OptimizeFunctionOnNextCall(f2);
diff --git a/src/v8/test/mjsunit/elide-double-hole-check-10.js b/src/v8/test/mjsunit/elide-double-hole-check-10.js
index e9f2a9a..066f802 100644
--- a/src/v8/test/mjsunit/elide-double-hole-check-10.js
+++ b/src/v8/test/mjsunit/elide-double-hole-check-10.js
@@ -8,6 +8,7 @@
   return a[i] + 0.5;
 }
 var arr = [,0.0,2.5];
+%PrepareFunctionForOptimization(f1);
 assertEquals(0.5, f1(arr, 1));
 assertEquals(0.5, f1(arr, 1));
 %OptimizeFunctionOnNextCall(f1);
@@ -28,6 +29,7 @@
   optopush(array_prototype);
 }
 
+%PrepareFunctionForOptimization(foo);
 optopush([]);
 optopush([]);
 optopush([]);
diff --git a/src/v8/test/mjsunit/elide-double-hole-check-11.js b/src/v8/test/mjsunit/elide-double-hole-check-11.js
index 4603ac0..829049a 100644
--- a/src/v8/test/mjsunit/elide-double-hole-check-11.js
+++ b/src/v8/test/mjsunit/elide-double-hole-check-11.js
@@ -8,6 +8,7 @@
   return a[i] + 0.5;
 }
 var arr = [,0.0,2.5];
+%PrepareFunctionForOptimization(f1);
 assertEquals(0.5, f1(arr, 1));
 assertEquals(0.5, f1(arr, 1));
 %OptimizeFunctionOnNextCall(f1);
diff --git a/src/v8/test/mjsunit/elide-double-hole-check-12.js b/src/v8/test/mjsunit/elide-double-hole-check-12.js
index 758734d..21a4afe 100644
--- a/src/v8/test/mjsunit/elide-double-hole-check-12.js
+++ b/src/v8/test/mjsunit/elide-double-hole-check-12.js
@@ -10,6 +10,7 @@
 
 var other_realm = Realm.create();
 var arr = [,0.0,2.5];
+%PrepareFunctionForOptimization(f1);
 assertEquals(0.5, f1(arr, 1));
 assertEquals(0.5, f1(arr, 1));
 %OptimizeFunctionOnNextCall(f1);
diff --git a/src/v8/test/mjsunit/elide-double-hole-check-2.js b/src/v8/test/mjsunit/elide-double-hole-check-2.js
index 978abc3..7ab2011 100644
--- a/src/v8/test/mjsunit/elide-double-hole-check-2.js
+++ b/src/v8/test/mjsunit/elide-double-hole-check-2.js
@@ -29,13 +29,17 @@
 
 function f(a, i) {
   return a[i] + 0.5;
-}
-var arr = [0.0,,];
+};
+%PrepareFunctionForOptimization(f);
+var arr = [
+  0.0,
+  ,
+];
 assertEquals(0.5, f(arr, 0));
 assertEquals(0.5, f(arr, 0));
 %OptimizeFunctionOnNextCall(f);
 assertEquals(0.5, f(arr, 0));
 assertEquals(NaN, f(arr, 1));
-arr.__proto__ = [1.5,1.5,1.5];
+arr.__proto__ = [1.5, 1.5, 1.5];
 assertEquals(2, f(arr, 1));
 assertEquals(0.5, f(arr, 0));
diff --git a/src/v8/test/mjsunit/elide-double-hole-check-3.js b/src/v8/test/mjsunit/elide-double-hole-check-3.js
index f817940..58f92b0 100644
--- a/src/v8/test/mjsunit/elide-double-hole-check-3.js
+++ b/src/v8/test/mjsunit/elide-double-hole-check-3.js
@@ -29,8 +29,9 @@
 
 function f(a, i) {
   return a[i] + 0.5;
-}
-Array.prototype = [1.5,1.5,1.5];
+};
+%PrepareFunctionForOptimization(f);
+Array.prototype = [1.5, 1.5, 1.5];
 var arr = [0.0,,];
 assertEquals(0.5, f(arr, 0));
 assertEquals(0.5, f(arr, 0));
diff --git a/src/v8/test/mjsunit/elide-double-hole-check-4.js b/src/v8/test/mjsunit/elide-double-hole-check-4.js
index e2a5505..77eb57c 100644
--- a/src/v8/test/mjsunit/elide-double-hole-check-4.js
+++ b/src/v8/test/mjsunit/elide-double-hole-check-4.js
@@ -30,6 +30,7 @@
 function f1(a, i) {
   return a[i] + 0.5;
 }
+%PrepareFunctionForOptimization(f1);
 var arr = [0.0,,2.5];
 assertEquals(0.5, f1(arr, 0));
 assertEquals(0.5, f1(arr, 0));
diff --git a/src/v8/test/mjsunit/elide-double-hole-check-5.js b/src/v8/test/mjsunit/elide-double-hole-check-5.js
index d0970c8..80035cc 100644
--- a/src/v8/test/mjsunit/elide-double-hole-check-5.js
+++ b/src/v8/test/mjsunit/elide-double-hole-check-5.js
@@ -29,7 +29,8 @@
 
 function f1(a, i) {
   return a[i] + 0.5;
-}
+};
+%PrepareFunctionForOptimization(f1);
 var arr = [0.0,,2.5];
 assertEquals(0.5, f1(arr, 0));
 assertEquals(0.5, f1(arr, 0));
diff --git a/src/v8/test/mjsunit/elide-double-hole-check-6.js b/src/v8/test/mjsunit/elide-double-hole-check-6.js
index 01a8096..b465348 100644
--- a/src/v8/test/mjsunit/elide-double-hole-check-6.js
+++ b/src/v8/test/mjsunit/elide-double-hole-check-6.js
@@ -31,6 +31,7 @@
   return a[i] + 0.5;
 }
 var arr = [0.0,,2.5];
+%PrepareFunctionForOptimization(f1);
 assertEquals(0.5, f1(arr, 0));
 assertEquals(0.5, f1(arr, 0));
 %OptimizeFunctionOnNextCall(f1);
diff --git a/src/v8/test/mjsunit/elide-double-hole-check-7.js b/src/v8/test/mjsunit/elide-double-hole-check-7.js
index 2b13aff..673d2b0 100644
--- a/src/v8/test/mjsunit/elide-double-hole-check-7.js
+++ b/src/v8/test/mjsunit/elide-double-hole-check-7.js
@@ -30,6 +30,7 @@
 function f1(a, i) {
   return a[i] + 0.5;
 }
+%PrepareFunctionForOptimization(f1);
 var arr = [0.0,,2.5];
 assertEquals(0.5, f1(arr, 0));
 assertEquals(0.5, f1(arr, 0));
diff --git a/src/v8/test/mjsunit/elide-double-hole-check-8.js b/src/v8/test/mjsunit/elide-double-hole-check-8.js
index 35cc91f..e0aca86 100644
--- a/src/v8/test/mjsunit/elide-double-hole-check-8.js
+++ b/src/v8/test/mjsunit/elide-double-hole-check-8.js
@@ -31,6 +31,7 @@
   return a[i] + 0.5;
 }
 var arr = [0.0,,2.5];
+%PrepareFunctionForOptimization(f1);
 assertEquals(0.5, f1(arr, 0));
 assertEquals(0.5, f1(arr, 0));
 %OptimizeFunctionOnNextCall(f1);
diff --git a/src/v8/test/mjsunit/elide-double-hole-check-9.js b/src/v8/test/mjsunit/elide-double-hole-check-9.js
index bbcbfb2..dc857b7 100644
--- a/src/v8/test/mjsunit/elide-double-hole-check-9.js
+++ b/src/v8/test/mjsunit/elide-double-hole-check-9.js
@@ -37,9 +37,9 @@
 function f(a, i) {
   set_proto_elements();
   return a[i] + 0.5;
-}
-
-var arr = [0.0,,2.5];
+};
+%PrepareFunctionForOptimization(f);
+var arr = [0.0, , 2.5];
 assertEquals(0.5, f(arr, 0));
 assertEquals(0.5, f(arr, 0));
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/empirical_max_arraybuffer.js b/src/v8/test/mjsunit/empirical_max_arraybuffer.js
new file mode 100644
index 0000000..cacefd4
--- /dev/null
+++ b/src/v8/test/mjsunit/empirical_max_arraybuffer.js
@@ -0,0 +1,101 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let kMax31BitSmi = (1 << 30) - 1;
+let k1MiB = 1 * 1024 * 1024;
+let k1GiB = 1 * 1024 * 1024 * 1024;
+let k4GiB = 4 * k1GiB;
+let kPageSize = 65536;
+let kMaxArrayBufferSize = 2 * k1GiB - kPageSize; // TODO(titzer): raise this to 4GiB
+let kStrideLength = 65536;
+
+(function Test() {
+  var buffer;
+  try {
+    buffer = new ArrayBuffer(kMaxArrayBufferSize);
+  } catch (e) {
+    print("OOM: sorry, best effort max array buffer size test!");
+    return;
+  }
+
+  print("Allocated " + buffer.byteLength + " bytes");
+  assertEquals(kMaxArrayBufferSize, buffer.byteLength);
+
+  function probe(view, stride, f) {
+    print("--------------------");
+    let max = view.length;
+    for (let i = 0; i < max; i += stride) {
+      view[i] = f(i);
+    }
+    for (let i = 0; i < max; i += stride) {
+      //    print(`${i} = ${f(i)}`);
+      assertEquals(f(i), view[i]);
+    }
+  }
+
+  {
+    // Make an uint32 view and probe it.
+    let elemSize = 4;
+    let viewSize = kMaxArrayBufferSize / elemSize;
+    // TODO(titzer): view sizes are limited to 31 bit SMIs. fix.
+    if (viewSize <= kMax31BitSmi) {
+      let uint32 = new Uint32Array(buffer);
+      assertEquals(kMaxArrayBufferSize / elemSize, uint32.length);
+      probe(uint32, kStrideLength / elemSize,
+            i => (0xaabbccee ^ ((i >> 11) * 0x110005)) >>> 0);
+    }
+  }
+
+  {
+    // Make an uint16 view and probe it.
+    let elemSize = 2;
+    let viewSize = kMaxArrayBufferSize / elemSize;
+    // TODO(titzer): view sizes are limited to 31 bit SMIs. fix.
+    if (viewSize <= kMax31BitSmi) {
+      let uint16 = new Uint16Array(buffer);
+      assertEquals(kMaxArrayBufferSize / elemSize, uint16.length);
+      probe(uint16, kStrideLength / elemSize,
+            i => (0xccee ^ ((i >> 11) * 0x110005)) & 0xFFFF);
+    }
+  }
+
+  {
+    // Make an uint8 view and probe it.
+    let elemSize = 1;
+    let viewSize = kMaxArrayBufferSize / elemSize;
+    // TODO(titzer): view sizes are limited to 31 bit SMIs. fix.
+    if (viewSize <= kMax31BitSmi) {
+      let uint8 = new Uint8Array(buffer);
+      assertEquals(kMaxArrayBufferSize / elemSize, uint8.length);
+      probe(uint8, kStrideLength / elemSize,
+            i => (0xee ^ ((i >> 11) * 0x05)) & 0xFF);
+    }
+  }
+
+  {
+    // Make a float64 view and probe it.
+    let elemSize = 8;
+    let viewSize = kMaxArrayBufferSize / elemSize;
+    // TODO(titzer): view sizes are limited to 31 bit SMIs. fix.
+    if (viewSize <= kMax31BitSmi) {
+      let float64 = new Float64Array(buffer);
+      assertEquals(kMaxArrayBufferSize / elemSize, float64.length);
+      probe(float64, kStrideLength / elemSize,
+            i => 0xaabbccee ^ ((i >> 11) * 0x110005));
+    }
+  }
+
+  {
+    // Make a float32 view and probe it.
+    let elemSize = 4;
+    let viewSize = kMaxArrayBufferSize / elemSize;
+    // TODO(titzer): view sizes are limited to 31 bit SMIs. fix.
+    if (viewSize <= kMax31BitSmi) {
+      let float32 = new Float32Array(buffer);
+      assertEquals(kMaxArrayBufferSize / elemSize, float32.length);
+      probe(float32, kStrideLength / elemSize,
+            i => Math.fround(0xaabbccee ^ ((i >> 11) * 0x110005)));
+    }
+  }
+})();
diff --git a/src/v8/test/mjsunit/ensure-growing-store-learns.js b/src/v8/test/mjsunit/ensure-growing-store-learns.js
index 25fa0e6..5340919 100644
--- a/src/v8/test/mjsunit/ensure-growing-store-learns.js
+++ b/src/v8/test/mjsunit/ensure-growing-store-learns.js
@@ -18,6 +18,7 @@
     a[i] = 5.3;
   }
 
+  %PrepareFunctionForOptimization(foo);
   foo(a, 1);
   foo(a, 2);
   foo(a, 3);
@@ -29,6 +30,7 @@
   assertUnoptimized(foo);
   assertTrue(%HasDictionaryElements(a));
 
+  %PrepareFunctionForOptimization(foo);
   var b = [];
   foo(b, 1);
   foo(b, 2);
@@ -36,6 +38,7 @@
   b[10000] = 5;
   assertTrue(%HasDictionaryElements(b));
   foo(b, 3);
+  %PrepareFunctionForOptimization(foo);
   %OptimizeFunctionOnNextCall(foo);
   foo(b, 50000);
   assertOptimized(foo);
@@ -55,6 +58,7 @@
   }
 
   // The KeyedStoreIC will learn GROW_MODE.
+  %PrepareFunctionForOptimization(foo2);
   foo2(a, 10);
   foo2(a, 12);
   foo2(a, 31);
diff --git a/src/v8/test/mjsunit/error-stack.js b/src/v8/test/mjsunit/error-stack.js
new file mode 100644
index 0000000..566bca4
--- /dev/null
+++ b/src/v8/test/mjsunit/error-stack.js
@@ -0,0 +1,103 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+(function TestErrorObjectsRetainMap() {
+  const error1 = new Error("foo");
+  const error2 = new Error("bar");
+
+  assertTrue(%HaveSameMap(error1, error2));
+
+  // Trigger serialization of the stack-trace.
+  error1.stack;
+  assertTrue(%HaveSameMap(error1, error2));
+
+  error2.stack;
+  assertTrue(%HaveSameMap(error1, error2));
+})();
+
+(function TestPrepareStackTraceCallback() {
+  Error.prepareStackTrace = (error, frame) => {
+    return "custom stack trace No. 42";
+  };
+
+  const error = new Error("foo");
+
+  // Check it twice, so both code paths in the accessor are exercised.
+  assertEquals(error.stack, "custom stack trace No. 42");
+  assertEquals(error.stack, "custom stack trace No. 42");
+})();
+
+(function TestPrepareStackTraceCallbackMessesWithProperty() {
+  Error.prepareStackTrace = (error, frames) => {
+    error.stack = "Yes, we can write to this!";
+    return 42;
+  };
+
+  const error = new Error("foo");
+
+  // Check it twice. The first returns the formatting result,
+  // the second the value of the private symbol.
+  assertEquals(error.stack, 42);
+  assertEquals(error.stack, 42);
+})();
+
+(function TestPrepareStackTraceCallbackInstallsGetter() {
+  Error.prepareStackTrace = (error, frames) => {
+    Object.defineProperty(error, "stack", { get: () => 42 });
+    return "<formatted stack trace>";
+  };
+
+  const error = new Error("foo");
+
+  // Check it twice. The second time the accessor should be used.
+  assertEquals(error.stack, "<formatted stack trace>");
+  assertEquals(error.stack, 42);
+})();
+
+(function TestPrepareStackTraceCallbackInstallsSetter() {
+  Error.prepareStackTrace = (error, frames) => {
+    Object.defineProperty(error, "stack", { set: (x) => {
+      error[42] = x;
+    }});
+    return "<formatted stack trace>";
+  };
+
+  const error = new Error("foo");
+  // Cause the accessor to get installed.
+  error.stack;
+
+  error.stack = "Who needs stack traces anyway?";
+  assertEquals(error[42], "Who needs stack traces anyway?");
+  assertEquals(error.stack, undefined); // No getter.
+})();
+
+(function TestFormatStackPropertyInDictionaryMode() {
+  Error.prepareStackTrace = (error, frames) => {
+    return "<formatted stack trace>";
+  };
+  const error = new Error("foo");
+  error[%MaxSmi()] = 42;
+
+  assertTrue(%HasDictionaryElements(error));
+
+  // Check it twice.
+  assertEquals(error.stack, "<formatted stack trace>");
+  assertEquals(error.stack, "<formatted stack trace>");
+})();
+
+(function TestTransitionToDictionaryModeAfterFormatting() {
+  Error.prepareStackTrace = (error, frames) => {
+    return "<formatted stack trace>";
+  };
+  const error = new Error("foo");
+  assertFalse(%HasDictionaryElements(error));
+
+  assertEquals(error.stack, "<formatted stack trace>");
+
+  error[%MaxSmi()] = 42;
+  assertTrue(%HasDictionaryElements(error));
+  assertEquals(error.stack, "<formatted stack trace>");
+})();
diff --git a/src/v8/test/mjsunit/es6/array-fill-receiver.js b/src/v8/test/mjsunit/es6/array-fill-receiver.js
new file mode 100644
index 0000000..21d7a2a
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/array-fill-receiver.js
@@ -0,0 +1,118 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Ensure `Array.prototype.fill` functions correctly for numerous elements
+// kinds.
+
+// If no arguments are provided, call Array.p.fill without any arguments,
+// otherwise the test is allowed to specify what value to use to better control
+// ElementsKind transitions. From and to is provided by the harness.
+function callAndAssertFill(object, test_value, harness_value, from, to) {
+  let value = arguments.length > 2 ? test_value : harness_value;
+
+  Array.prototype.fill.call(object, value, from, to);
+
+  %HeapObjectVerify(object);
+  assertArrayHasValueInRange(object, value, from, to);
+}
+
+function assertArrayHasValueInRange(obj, value, from, to) {
+  for (let i = from; i < to; ++i) {
+    assertEquals(value, obj[i]);
+  }
+}
+
+// Tests are executed multiple times. Creating arrays using literal notation
+// will create COW-Arrays, which will propagate the most general ElementsKind
+// back to their allocation site.
+// pristineArray will always return a 🐄-Array with the ElementsKind we actually
+// want.
+let i = 0;
+function pristineArray(str) {
+  return eval(str + "//" + (i++));
+}
+
+let tests = {
+  ARRAY_PACKED_ELEMENTS(value, from, to) {
+    let array = pristineArray(
+        `["Some string", {}, /foobar/, "Another string", {}]`);
+    assertTrue(%HasObjectElements(array));
+    assertFalse(%HasHoleyElements(array));
+
+    callAndAssertFill(array, "42", ...arguments);
+  },
+
+  ARRAY_HOLEY_ELEMENTS(value, from, to) {
+    let array = pristineArray(`["Some string", , {}, , "Another string"]`);
+    assertTrue(%HasObjectElements(array));
+    assertTrue(%HasHoleyElements(array));
+
+    callAndAssertFill(array, "42", ...arguments);
+  },
+
+  ARRAY_PACKED_SMI_ELEMENTS(value, from, to) {
+    let array = pristineArray(`[0, -42, 5555, 23, 6]`);
+    assertTrue(%HasSmiElements(array));
+    assertFalse(%HasHoleyElements(array));
+
+    callAndAssertFill(array, 42, ...arguments);
+  },
+
+  ARRAY_HOLEY_SMI_ELEMENTS(value, from, to) {
+    let array = pristineArray(`[0, , 5555, , 6]`);
+    assertTrue(%HasSmiElements(array));
+    assertTrue(%HasHoleyElements(array));
+
+    callAndAssertFill(array, 42, ...arguments);
+  },
+
+  ARRAY_PACKED_DOUBLE_ELEMENTS(value, from, to) {
+    let array = pristineArray(`[3.14, 7.00001, NaN, -25.3333, 1.0]`);
+    assertTrue(%HasDoubleElements(array));
+    assertFalse(%HasHoleyElements(array));
+
+    callAndAssertFill(array, 42.42, ...arguments);
+  },
+
+  ARRAY_HOLEY_DOUBLE_ELEMENTS(value, from, to) {
+    let array = pristineArray(`[3.14, , , , 1.0]`);
+    assertTrue(%HasDoubleElements(array));
+    assertTrue(%HasHoleyElements(array));
+
+    callAndAssertFill(array, 42.42, ...arguments);
+  },
+
+  ARRAY_DICTIONARY_ELEMENTS(value, from, to) {
+    let array = pristineArray(`[0, , 2, 3, 4]`);
+    Object.defineProperty(array, 1, { get() { return this.foo; },
+                                      set(val) { this.foo = val; }});
+    assertTrue(%HasDictionaryElements(array));
+
+    callAndAssertFill(array, "42", ...arguments);
+  }
+
+  // TODO(szuend): Add additional tests receivers other than arrays
+  //               (Objects, TypedArrays, etc.).
+};
+
+function RunTest(test) {
+  test();
+  test(undefined);
+  test(undefined, 1);
+  test(undefined, 1, 4);
+}
+
+function RunTests(tests) {
+  Object.keys(tests).forEach(test => RunTest(tests[test]));
+}
+
+RunTests(tests);
+
+Array.prototype.__proto__ = {
+  __proto__: Array.prototype.__proto__
+};
+
+RunTests(tests);
diff --git a/src/v8/test/mjsunit/es6/array-fill.js b/src/v8/test/mjsunit/es6/array-fill.js
index ef316e8..8ca41c7 100644
--- a/src/v8/test/mjsunit/es6/array-fill.js
+++ b/src/v8/test/mjsunit/es6/array-fill.js
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --allow-natives-syntax
+
 assertEquals(1, Array.prototype.fill.length);
 
 assertArrayEquals([].fill(8), []);
@@ -28,3 +30,98 @@
 assertThrows('Object.freeze([0]).fill()', TypeError);
 assertThrows('Array.prototype.fill.call(null)', TypeError);
 assertThrows('Array.prototype.fill.call(undefined)', TypeError);
+
+function TestFillObjectWithAccessors() {
+  const kLength = 5;
+
+  let log = [];
+
+  let object = {
+    length: kLength,
+    get 1() {
+      log.push("get 1");
+      return this.foo;
+    },
+
+    set 1(val) {
+      log.push("set 1 " + val);
+      this.foo = val;
+    }
+  };
+
+  Array.prototype.fill.call(object, 42);
+
+  %HeapObjectVerify(object);
+  assertEquals(kLength, object.length);
+  assertArrayEquals(["set 1 42"], log);
+
+  for (let i = 0; i < kLength; ++i) {
+    assertEquals(42, object[i]);
+  }
+}
+TestFillObjectWithAccessors();
+
+function TestFillObjectWithMaxNumberLength() {
+  const kMaxSafeInt = 2 ** 53 - 1;
+  let object = {};
+  object.length = kMaxSafeInt;
+
+  Array.prototype.fill.call(object, 42, 2 ** 53 - 4);
+
+  %HeapObjectVerify(object);
+  assertEquals(kMaxSafeInt, object.length);
+  assertEquals(42, object[kMaxSafeInt - 3]);
+  assertEquals(42, object[kMaxSafeInt - 2]);
+  assertEquals(42, object[kMaxSafeInt - 1]);
+}
+TestFillObjectWithMaxNumberLength();
+
+function TestFillObjectWithPrototypeAccessors() {
+  const kLength = 5;
+  let log = [];
+  let proto = {
+    get 1() {
+      log.push("get 0");
+      return this.foo;
+    },
+
+    set 1(val) {
+      log.push("set 1 " + val);
+      this.foo = val;
+    }
+  };
+
+  let object = { __proto__: proto, 0:0, 2:2, length: kLength};
+
+  Array.prototype.fill.call(object, "42");
+
+  %HeapObjectVerify(object);
+  assertEquals(kLength, object.length);
+  assertArrayEquals(["set 1 42"], log);
+  assertTrue(object.hasOwnProperty(0));
+  assertFalse(object.hasOwnProperty(1));
+  assertTrue(object.hasOwnProperty(2));
+  assertTrue(object.hasOwnProperty(3));
+  assertTrue(object.hasOwnProperty(4));
+
+  for (let i = 0; i < kLength; ++i) {
+    assertEquals("42", object[i]);
+  }
+}
+TestFillObjectWithPrototypeAccessors();
+
+function TestFillSealedObject() {
+  let object = { length: 42 };
+  Object.seal(object);
+
+  assertThrows(() => Array.prototype.fill.call(object), TypeError);
+}
+TestFillSealedObject();
+
+function TestFillFrozenObject() {
+  let object = { length: 42 };
+  Object.freeze(object);
+
+  assertThrows(() => Array.prototype.fill.call(object), TypeError);
+}
+TestFillFrozenObject();
diff --git a/src/v8/test/mjsunit/es6/array-from.js b/src/v8/test/mjsunit/es6/array-from.js
index c483d3d..02a599d 100644
--- a/src/v8/test/mjsunit/es6/array-from.js
+++ b/src/v8/test/mjsunit/es6/array-from.js
@@ -161,6 +161,14 @@
 // The setter wasn't called
 assertEquals(0, setterCalled);
 
+// Non-callable iterators should cause a TypeError before calling the target
+// constructor.
+items = {};
+items[Symbol.iterator] = 7;
+function TestError() {}
+function ArrayLike() { throw new TestError() }
+assertThrows(function() { Array.from.call(ArrayLike, items); }, TypeError);
+
 // Check that array properties defined are writable, enumerable, configurable
 function ordinary() { }
 var x = Array.from.call(ordinary, [2]);
diff --git a/src/v8/test/mjsunit/es6/array-iterator-detached.js b/src/v8/test/mjsunit/es6/array-iterator-detached.js
index e9a9401..f385039 100644
--- a/src/v8/test/mjsunit/es6/array-iterator-detached.js
+++ b/src/v8/test/mjsunit/es6/array-iterator-detached.js
@@ -11,13 +11,13 @@
   assertEquals(0, it.next().value);
   assertEquals(1, it.next().value);
   assertEquals(2, it.next().value);
-  %ArrayBufferNeuter(array.buffer);
+  %ArrayBufferDetach(array.buffer);
   it.next();
 };
 %NeverOptimizeFunction(Baseline);
 
 assertThrows(Baseline, TypeError,
-    "Cannot perform Array Iterator.prototype.next on a detached ArrayBuffer");
+    "Cannot perform Array Iterator.prototype.next on a neutered ArrayBuffer");
 
 function Turbo(count = 10000) {
   let array = Array(10000);
@@ -32,16 +32,17 @@
   for (let i = 0; i < count; ++i) {
     let result = it.next();
     if (result.value === 255) {
-      %ArrayBufferNeuter(array.buffer);
+      %ArrayBufferDetach(array.buffer);
     }
     sum += result.value;
   }
   return sum;
 }
 
+%PrepareFunctionForOptimization(Turbo);
 Turbo(10);
 Turbo(10);
 %OptimizeFunctionOnNextCall(Turbo);
 
 assertThrows(Turbo, TypeError,
-    "Cannot perform Array Iterator.prototype.next on a detached ArrayBuffer");
+    "Cannot perform Array Iterator.prototype.next on a neutered ArrayBuffer");
diff --git a/src/v8/test/mjsunit/es6/array-iterator-turbo.js b/src/v8/test/mjsunit/es6/array-iterator-turbo.js
index 489a53d..40f4b2a 100644
--- a/src/v8/test/mjsunit/es6/array-iterator-turbo.js
+++ b/src/v8/test/mjsunit/es6/array-iterator-turbo.js
@@ -101,6 +101,7 @@
       let { array, expected, array2, expected2 } = tests[key];
 
       // Warmup:
+      %PrepareFunctionForOptimization(fn);
       fn(array);
       fn(array);
       %OptimizeFunctionOnNextCall(fn);
@@ -203,6 +204,7 @@
       };
 
       // Warmup
+      %PrepareFunctionForOptimization(sum);
       sum(array);
       sum(array);
       %OptimizeFunctionOnNextCall(sum);
@@ -217,7 +219,7 @@
 
       // Throw when detached
       let clone = new array.constructor(array);
-      %ArrayBufferNeuter(clone.buffer);
+      %ArrayBufferDetach(clone.buffer);
       assertThrows(() => sum(clone), TypeError);
 
       // Clear the slate for the next iteration.
diff --git a/src/v8/test/mjsunit/es6/array-iterator.js b/src/v8/test/mjsunit/es6/array-iterator.js
index d2d19b0..62485df 100644
--- a/src/v8/test/mjsunit/es6/array-iterator.js
+++ b/src/v8/test/mjsunit/es6/array-iterator.js
@@ -152,10 +152,6 @@
 
   assertEquals(Object.prototype, ArrayIteratorPrototype.__proto__);
 
-  assertEquals('Array Iterator', %_ClassOf(array[Symbol.iterator]()));
-  assertEquals('Array Iterator', %_ClassOf(array.keys()));
-  assertEquals('Array Iterator', %_ClassOf(array.entries()));
-
   assertFalse(ArrayIteratorPrototype.hasOwnProperty('constructor'));
   assertArrayEquals(['next'],
       Object.getOwnPropertyNames(ArrayIteratorPrototype));
@@ -256,3 +252,16 @@
   }, TypeError);
 }
 TestNonOwnSlots();
+
+function TestForDictionaryArray() {
+  var array = [];
+  array[1024] = 'c';
+  assertTrue(%HasDictionaryElements(array));
+  var iterator = array[Symbol.iterator]();
+  for (var i = 0; i < 1024; ++i) {
+    assertIteratorResult(void 0, false, iterator.next());
+  }
+  assertIteratorResult('c', false, iterator.next());
+  assertIteratorResult(void 0, true, iterator.next());
+}
+TestForDictionaryArray();
diff --git a/src/v8/test/mjsunit/es6/array-prototype-values.js b/src/v8/test/mjsunit/es6/array-prototype-values.js
index b7c4e78..4b4c043 100644
--- a/src/v8/test/mjsunit/es6/array-prototype-values.js
+++ b/src/v8/test/mjsunit/es6/array-prototype-values.js
@@ -1,8 +1,6 @@
 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
-//
-// Flags: --harmony-array-prototype-values
 
 // Functionality of the values iterator is tested elsewhere; this test
 // merely verifies that the 'values' property is set up correctly.
diff --git a/src/v8/test/mjsunit/es6/array-species-constructor-accessor.js b/src/v8/test/mjsunit/es6/array-species-constructor-accessor.js
index 7ebf328..7185d98 100644
--- a/src/v8/test/mjsunit/es6/array-species-constructor-accessor.js
+++ b/src/v8/test/mjsunit/es6/array-species-constructor-accessor.js
@@ -18,7 +18,7 @@
 class MyArray extends Array { }
 
 Object.defineProperty(x, 'constructor', {get() { return MyArray; }});
-assertFalse(%SpeciesProtector());
+assertFalse(%ArraySpeciesProtector());
 
 assertEquals(MyArray, x.map(()=>{}).constructor);
 assertEquals(MyArray, x.filter(()=>{}).constructor);
diff --git a/src/v8/test/mjsunit/es6/array-species-constructor-delete.js b/src/v8/test/mjsunit/es6/array-species-constructor-delete.js
index fff22a2..3b85d52 100644
--- a/src/v8/test/mjsunit/es6/array-species-constructor-delete.js
+++ b/src/v8/test/mjsunit/es6/array-species-constructor-delete.js
@@ -19,7 +19,7 @@
 
 Object.prototype.constructor = MyArray;
 delete Array.prototype.constructor;
-assertFalse(%SpeciesProtector());
+assertFalse(%ArraySpeciesProtector());
 
 assertEquals(MyArray, x.map(()=>{}).constructor);
 assertEquals(MyArray, x.filter(()=>{}).constructor);
diff --git a/src/v8/test/mjsunit/es6/array-species-constructor.js b/src/v8/test/mjsunit/es6/array-species-constructor.js
index 0d888f4..07e897d 100644
--- a/src/v8/test/mjsunit/es6/array-species-constructor.js
+++ b/src/v8/test/mjsunit/es6/array-species-constructor.js
@@ -18,7 +18,7 @@
 class MyArray extends Array { }
 
 x.constructor = MyArray;
-assertFalse(%SpeciesProtector());
+assertFalse(%ArraySpeciesProtector());
 
 assertEquals(MyArray, x.map(()=>{}).constructor);
 assertEquals(MyArray, x.filter(()=>{}).constructor);
diff --git a/src/v8/test/mjsunit/es6/array-species-delete.js b/src/v8/test/mjsunit/es6/array-species-delete.js
index 16a2fa2..2f0f50a 100644
--- a/src/v8/test/mjsunit/es6/array-species-delete.js
+++ b/src/v8/test/mjsunit/es6/array-species-delete.js
@@ -19,7 +19,7 @@
 
 Object.prototype[Symbol.species] = MyArray;
 delete Array[Symbol.species];
-assertFalse(%SpeciesProtector());
+assertFalse(%ArraySpeciesProtector());
 
 assertEquals(MyArray, x.map(()=>{}).constructor);
 assertEquals(MyArray, x.filter(()=>{}).constructor);
diff --git a/src/v8/test/mjsunit/es6/array-species-modified.js b/src/v8/test/mjsunit/es6/array-species-modified.js
index 58feb31..d5a7079 100644
--- a/src/v8/test/mjsunit/es6/array-species-modified.js
+++ b/src/v8/test/mjsunit/es6/array-species-modified.js
@@ -18,7 +18,7 @@
 class MyArray extends Array { }
 
 Object.defineProperty(Array, Symbol.species, {value: MyArray});
-assertFalse(%SpeciesProtector());
+assertFalse(%ArraySpeciesProtector());
 
 assertEquals(MyArray, x.map(()=>{}).constructor);
 assertEquals(MyArray, x.filter(()=>{}).constructor);
diff --git a/src/v8/test/mjsunit/es6/array-species-parent-constructor.js b/src/v8/test/mjsunit/es6/array-species-parent-constructor.js
index b4fb1d5..8a861fb 100644
--- a/src/v8/test/mjsunit/es6/array-species-parent-constructor.js
+++ b/src/v8/test/mjsunit/es6/array-species-parent-constructor.js
@@ -18,7 +18,7 @@
 class MyArray extends Array { }
 
 Array.prototype.constructor = MyArray;
-assertFalse(%SpeciesProtector());
+assertFalse(%ArraySpeciesProtector());
 
 assertEquals(MyArray, x.map(()=>{}).constructor);
 assertEquals(MyArray, x.filter(()=>{}).constructor);
diff --git a/src/v8/test/mjsunit/es6/array-species-proto.js b/src/v8/test/mjsunit/es6/array-species-proto.js
index 6b55881..d8e2ae5 100644
--- a/src/v8/test/mjsunit/es6/array-species-proto.js
+++ b/src/v8/test/mjsunit/es6/array-species-proto.js
@@ -18,7 +18,7 @@
 class MyArray extends Array { }
 
 x.__proto__ = MyArray.prototype;
-assertTrue(%SpeciesProtector());
+assertTrue(%ArraySpeciesProtector());
 
 assertEquals(MyArray, x.map(()=>{}).constructor);
 assertEquals(MyArray, x.filter(()=>{}).constructor);
diff --git a/src/v8/test/mjsunit/es6/array-spread-holey.js b/src/v8/test/mjsunit/es6/array-spread-holey.js
new file mode 100644
index 0000000..7d95e51
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/array-spread-holey.js
@@ -0,0 +1,52 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Test spreading of holey arrays. Holes should be replaced with undefined.
+
+var a = [, 2];
+
+assertEquals([, 2], [...a]);
+assertTrue([...a].hasOwnProperty(0));
+assertTrue([2, ...a].hasOwnProperty(1));
+
+
+class MyArray1 extends Array {
+  constructor(a) {
+    super(...a);
+  }
+}
+var myarr1 = new MyArray1(a);
+assertEquals(undefined, myarr1[0]);
+assertTrue(myarr1.hasOwnProperty(0));
+
+
+class MyArray2 extends Array {
+  constructor(a) {
+    super(2, ...a);
+  }
+}
+var myarr2 = new MyArray2(a);
+assertEquals(undefined, myarr2[1]);
+assertTrue(myarr2.hasOwnProperty(1));
+
+function foo0() { return arguments.hasOwnProperty(0); }
+assertTrue(foo0(...a));
+
+function foo1() { return arguments.hasOwnProperty(1); }
+assertTrue(foo1(2, ...a));
+
+// This test pollutes the Array prototype. No more tests should be run in the
+// same instance after this.
+a.__proto__[0] = 1;
+var arr2 = [...a];
+assertEquals([1,2], arr2);
+assertTrue(arr2.hasOwnProperty(0));
+
+myarr1 = new MyArray1(a);
+assertEquals(1, myarr1[0]);
+assertTrue(myarr1.hasOwnProperty(0));
+
+var myarr2 = new MyArray2(a);
+assertEquals(1, myarr2[1]);
+assertTrue(myarr2.hasOwnProperty(1));
diff --git a/src/v8/test/mjsunit/es6/array-spread-large-holey.js b/src/v8/test/mjsunit/es6/array-spread-large-holey.js
new file mode 100644
index 0000000..c319c18
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/array-spread-large-holey.js
@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Test spreading of large holey arrays, which are supposedly allocated in
+// LargeObjectSpace. Holes should be replaced with undefined.
+
+var arr = new Array(2e5);
+
+for (var i = 0; i < 10; i++) {
+  arr[i] = i;
+}
+
+var arr2 = [...arr];
+assertTrue(arr2.hasOwnProperty(10));
+assertEquals(undefined, arr2[10]);
+assertEquals(9, arr2[9]);
diff --git a/src/v8/test/mjsunit/es6/block-eval-var-over-let.js b/src/v8/test/mjsunit/es6/block-eval-var-over-let.js
index e16d7a0..784f5d2 100644
--- a/src/v8/test/mjsunit/es6/block-eval-var-over-let.js
+++ b/src/v8/test/mjsunit/es6/block-eval-var-over-let.js
@@ -141,15 +141,15 @@
 }
 assertTrue(caught);
 
-caught = false
-try {
-  (function() {
-    {
-      let x = 1;
-      eval('{ function x() {} }');
-    }
-  })();
-} catch (e) {
-  caught = true;
-}
-assertFalse(caught);
+// See ES#sec-web-compat-evaldeclarationinstantiation. Sloppy block functions
+// inside of blocks in eval behave similar to regular sloppy block function
+// hoisting: the var declaration on the function level is only created if
+// it would not cause a syntax error. A masking let would cause a conflicting
+// var declaration syntax error, and hence the var isn't introduced.
+(function() {
+  {
+    let x = 1;
+    eval('{ function x() {} }');
+    assertEquals(1, x);
+  }
+})();
diff --git a/src/v8/test/mjsunit/es6/block-let-crankshaft-sloppy.js b/src/v8/test/mjsunit/es6/block-let-crankshaft-sloppy.js
index 5711ac2..39ebea9 100644
--- a/src/v8/test/mjsunit/es6/block-let-crankshaft-sloppy.js
+++ b/src/v8/test/mjsunit/es6/block-let-crankshaft-sloppy.js
@@ -34,6 +34,7 @@
 
 for (var i = 0; i < functions.length; ++i) {
   var func = functions[i];
+  %PrepareFunctionForOptimization(func);
   print("Testing:");
   print(func);
   for (var j = 0; j < 10; ++j) {
@@ -315,6 +316,7 @@
       throw x;
     }
   }
+  %PrepareFunctionForOptimization(f);
   for (var i = 0; i < 5; i++) {
     try {
       f();
@@ -339,6 +341,7 @@
 function TestFunctionLocal(s) {
   'use strict';
   var func = eval("(function baz(){" + s + "; })");
+  %PrepareFunctionForOptimization(func);
   print("Testing:");
   print(func);
   for (var i = 0; i < 5; ++i) {
@@ -361,6 +364,7 @@
 function TestFunctionContext(s) {
   'use strict';
   var func = eval("(function baz(){ " + s + "; (function() { x; }); })");
+  %PrepareFunctionForOptimization(func);
   print("Testing:");
   print(func);
   for (var i = 0; i < 5; ++i) {
@@ -387,6 +391,7 @@
 function TestBlockLocal(s) {
   'use strict';
   var func = eval("(function baz(){ { " + s + "; } })");
+  %PrepareFunctionForOptimization(func);
   print("Testing:");
   print(func);
   for (var i = 0; i < 5; ++i) {
@@ -409,6 +414,7 @@
 function TestBlockContext(s) {
   'use strict';
   var func = eval("(function baz(){ { " + s + "; (function() { x; }); } })");
+  %PrepareFunctionForOptimization(func);
   print("Testing:");
   print(func);
   for (var i = 0; i < 5; ++i) {
@@ -467,6 +473,9 @@
   }
 }
 
+%PrepareFunctionForOptimization(f);
+%PrepareFunctionForOptimization(g);
+
 for (var i=0; i<10; i++) {
   f(i);
   g(i);
diff --git a/src/v8/test/mjsunit/es6/block-let-crankshaft.js b/src/v8/test/mjsunit/es6/block-let-crankshaft.js
index 97de765..2b135a8 100644
--- a/src/v8/test/mjsunit/es6/block-let-crankshaft.js
+++ b/src/v8/test/mjsunit/es6/block-let-crankshaft.js
@@ -36,6 +36,7 @@
 
 for (var i = 0; i < functions.length; ++i) {
   var func = functions[i];
+  %PrepareFunctionForOptimization(func);
   print("Testing:");
   print(func);
   for (var j = 0; j < 10; ++j) {
@@ -317,6 +318,7 @@
       throw x;
     }
   }
+  %PrepareFunctionForOptimization(f);
   for (var i = 0; i < 5; i++) {
     try {
       f();
@@ -341,6 +343,7 @@
 function TestFunctionLocal(s) {
   'use strict';
   var func = eval("(function baz(){" + s + "; })");
+  %PrepareFunctionForOptimization(func);
   print("Testing:");
   print(func);
   for (var i = 0; i < 5; ++i) {
@@ -363,6 +366,7 @@
 function TestFunctionContext(s) {
   'use strict';
   var func = eval("(function baz(){ " + s + "; (function() { x; }); })");
+  %PrepareFunctionForOptimization(func);
   print("Testing:");
   print(func);
   for (var i = 0; i < 5; ++i) {
@@ -389,6 +393,7 @@
 function TestBlockLocal(s) {
   'use strict';
   var func = eval("(function baz(){ { " + s + "; } })");
+  %PrepareFunctionForOptimization(func);
   print("Testing:");
   print(func);
   for (var i = 0; i < 5; ++i) {
@@ -411,6 +416,7 @@
 function TestBlockContext(s) {
   'use strict';
   var func = eval("(function baz(){ { " + s + "; (function() { x; }); } })");
+  %PrepareFunctionForOptimization(func);
   print("Testing:");
   print(func);
   for (var i = 0; i < 5; ++i) {
@@ -469,6 +475,9 @@
   }
 }
 
+%PrepareFunctionForOptimization(f);
+%PrepareFunctionForOptimization(g);
+
 for (var i=0; i<10; i++) {
   f(i);
   g(i);
diff --git a/src/v8/test/mjsunit/es6/block-let-declaration-sloppy.js b/src/v8/test/mjsunit/es6/block-let-declaration-sloppy.js
index ea0e39b..1611d44 100644
--- a/src/v8/test/mjsunit/es6/block-let-declaration-sloppy.js
+++ b/src/v8/test/mjsunit/es6/block-let-declaration-sloppy.js
@@ -118,19 +118,19 @@
 TestLocalDoesNotThrow("switch (true) { default: class x { }; }");
 
 // Test that redeclarations of functions are only allowed in outermost scope.
-TestLocalThrows("{ let f; var f; }");
-TestLocalThrows("{ var f; let f; }");
-TestLocalThrows("{ function f() {} let f; }");
-TestLocalThrows("{ let f; function f() {} }");
-TestLocalThrows("{ function f() {} var f; }");
-TestLocalThrows("{ var f; function f() {} }");
-TestLocalThrows("{ function f() {} class f {} }");
-TestLocalThrows("{ class f {}; function f() {} }");
-TestLocalThrows("{ function f() {} function f() {} }");
-TestLocalThrows("function f() {} let f;");
-TestLocalThrows("let f; function f() {}");
-TestLocalThrows("function f() {} class f {}");
-TestLocalThrows("class f {}; function f() {}");
+TestLocalThrows("{ let f; var f; }", SyntaxError);
+TestLocalThrows("{ var f; let f; }", SyntaxError);
+TestLocalThrows("{ function f() {} let f; }", SyntaxError);
+TestLocalThrows("{ let f; function f() {} }", SyntaxError);
+TestLocalThrows("{ function f() {} var f; }", SyntaxError);
+TestLocalThrows("{ var f; function f() {} }", SyntaxError);
+TestLocalThrows("{ function f() {} class f {} }", SyntaxError);
+TestLocalThrows("{ class f {}; function f() {} }", SyntaxError);
+TestLocalThrows("{ function f() {} function f() {} }", SyntaxError);
+TestLocalThrows("function f() {} let f;", SyntaxError);
+TestLocalThrows("let f; function f() {}", SyntaxError);
+TestLocalThrows("function f() {} class f {}", SyntaxError);
+TestLocalThrows("class f {}; function f() {}", SyntaxError);
 TestLocalDoesNotThrow("function arg() {}");
 TestLocalDoesNotThrow("function f() {} var f;");
 TestLocalDoesNotThrow("var f; function f() {}");
diff --git a/src/v8/test/mjsunit/es6/block-let-declaration.js b/src/v8/test/mjsunit/es6/block-let-declaration.js
index a138144..f6b2b7d 100644
--- a/src/v8/test/mjsunit/es6/block-let-declaration.js
+++ b/src/v8/test/mjsunit/es6/block-let-declaration.js
@@ -120,19 +120,19 @@
 TestLocalDoesNotThrow("switch (true) { default: class x { }; }");
 
 // Test that redeclarations of functions are only allowed in outermost scope.
-TestLocalThrows("{ let f; var f; }");
-TestLocalThrows("{ var f; let f; }");
-TestLocalThrows("{ function f() {} let f; }");
-TestLocalThrows("{ let f; function f() {} }");
-TestLocalThrows("{ function f() {} var f; }");
-TestLocalThrows("{ var f; function f() {} }");
-TestLocalThrows("{ function f() {} class f {} }");
-TestLocalThrows("{ class f {}; function f() {} }");
-TestLocalThrows("{ function f() {} function f() {} }");
-TestLocalThrows("function f() {} let f;");
-TestLocalThrows("let f; function f() {}");
-TestLocalThrows("function f() {} class f {}");
-TestLocalThrows("class f {}; function f() {}");
+TestLocalThrows("{ let f; var f; }", SyntaxError);
+TestLocalThrows("{ var f; let f; }", SyntaxError);
+TestLocalThrows("{ function f() {} let f; }", SyntaxError);
+TestLocalThrows("{ let f; function f() {} }", SyntaxError);
+TestLocalThrows("{ function f() {} var f; }", SyntaxError);
+TestLocalThrows("{ var f; function f() {} }", SyntaxError);
+TestLocalThrows("{ function f() {} class f {} }", SyntaxError);
+TestLocalThrows("{ class f {}; function f() {} }", SyntaxError);
+TestLocalThrows("{ function f() {} function f() {} }", SyntaxError);
+TestLocalThrows("function f() {} let f;", SyntaxError);
+TestLocalThrows("let f; function f() {}", SyntaxError);
+TestLocalThrows("function f() {} class f {}", SyntaxError);
+TestLocalThrows("class f {}; function f() {}", SyntaxError);
 TestLocalDoesNotThrow("function arg() {}");
 TestLocalDoesNotThrow("function f() {} var f;");
 TestLocalDoesNotThrow("var f; function f() {}");
diff --git a/src/v8/test/mjsunit/es6/block-scoping-sloppy.js b/src/v8/test/mjsunit/es6/block-scoping-sloppy.js
index d86eb07..1eb1a54 100644
--- a/src/v8/test/mjsunit/es6/block-scoping-sloppy.js
+++ b/src/v8/test/mjsunit/es6/block-scoping-sloppy.js
@@ -37,6 +37,7 @@
   assertEquals(1, x)
   assertEquals(undefined, y)
 }
+%PrepareFunctionForOptimization(f1);
 for (var j = 0; j < 5; ++j) f1();
 %OptimizeFunctionOnNextCall(f1);
 f1();
@@ -85,6 +86,7 @@
     assertEquals(8, b.foo());
   }
 }
+%PrepareFunctionForOptimization(f3);
 for (var j = 0; j < 5; ++j) f3(1);
 %OptimizeFunctionOnNextCall(f3);
 f3(1);
diff --git a/src/v8/test/mjsunit/es6/block-scoping.js b/src/v8/test/mjsunit/es6/block-scoping.js
index 9fa22cd..cf42054 100644
--- a/src/v8/test/mjsunit/es6/block-scoping.js
+++ b/src/v8/test/mjsunit/es6/block-scoping.js
@@ -39,6 +39,7 @@
   assertEquals(1, x)
   assertEquals(undefined, y)
 }
+%PrepareFunctionForOptimization(f1);
 for (var j = 0; j < 5; ++j) f1();
 %OptimizeFunctionOnNextCall(f1);
 f1();
@@ -87,6 +88,7 @@
     assertEquals(8, b.foo());
   }
 }
+%PrepareFunctionForOptimization(f3);
 for (var j = 0; j < 5; ++j) f3(1);
 %OptimizeFunctionOnNextCall(f3);
 f3(1);
diff --git a/src/v8/test/mjsunit/es6/block-sloppy-function.js b/src/v8/test/mjsunit/es6/block-sloppy-function.js
index d527a7d..5d22cd8 100644
--- a/src/v8/test/mjsunit/es6/block-sloppy-function.js
+++ b/src/v8/test/mjsunit/es6/block-sloppy-function.js
@@ -620,15 +620,12 @@
       return 4;
     } }`);
 
-    // assertEquals(0, f);
-    assertEquals(4, f());
+    assertEquals(0, f);
   }
 
-  // assertEquals(4, f());
-  assertEquals(undefined, f);
+  assertEquals(4, f());
 })();
 
-// This test is incorrect BUG(v8:5168). The commented assertions are correct.
 (function evalHoistingThroughWith() {
   with ({f: 0}) {
     eval(`{ function f() {
diff --git a/src/v8/test/mjsunit/es6/call-with-spread-modify-array-iterator.js b/src/v8/test/mjsunit/es6/call-with-spread-modify-array-iterator.js
index ef18cd3..aeeeb31 100644
--- a/src/v8/test/mjsunit/es6/call-with-spread-modify-array-iterator.js
+++ b/src/v8/test/mjsunit/es6/call-with-spread-modify-array-iterator.js
@@ -15,6 +15,7 @@
     return maxWithZero(x, y);
   }
 
+  %PrepareFunctionForOptimization(testMax);
   testMax(1, 2);
   testMax(1, 2);
   %OptimizeFunctionOnNextCall(testMax);
diff --git a/src/v8/test/mjsunit/es6/call-with-spread-modify-next.js b/src/v8/test/mjsunit/es6/call-with-spread-modify-next.js
index 3cae94f..3ac6b02 100644
--- a/src/v8/test/mjsunit/es6/call-with-spread-modify-next.js
+++ b/src/v8/test/mjsunit/es6/call-with-spread-modify-next.js
@@ -20,6 +20,7 @@
     return maxWithZero(x, y);
   }
 
+  %PrepareFunctionForOptimization(testMax);
   testMax(1, 2);
   testMax(1, 2);
   %OptimizeFunctionOnNextCall(testMax);
diff --git a/src/v8/test/mjsunit/es6/call-with-spread.js b/src/v8/test/mjsunit/es6/call-with-spread.js
index 3a1744a..be47d42 100644
--- a/src/v8/test/mjsunit/es6/call-with-spread.js
+++ b/src/v8/test/mjsunit/es6/call-with-spread.js
@@ -8,6 +8,7 @@
   'use strict';
 
   function testBaselineAndOpt(func) {
+    %PrepareFunctionForOptimization(func);
     func(-1, -2);
     func(-1, -2);
     %OptimizeFunctionOnNextCall(func);
@@ -76,6 +77,7 @@
 
 (function() {
   function testBaselineAndOpt(func) {
+    %PrepareFunctionForOptimization(func);
     func(-1, -2);
     func(-1, -2);
     %OptimizeFunctionOnNextCall(func);
diff --git a/src/v8/test/mjsunit/es6/classes-accesors.js b/src/v8/test/mjsunit/es6/classes-accesors.js
new file mode 100644
index 0000000..fedb548
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/classes-accesors.js
@@ -0,0 +1,97 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var b = 'b';
+
+(function TestOverwritingInstanceAccessors() {
+  var C, desc;
+  C = class {
+    [b]() { return 'B'; };
+    get b() { return 'get B'; };
+  };
+  desc = Object.getOwnPropertyDescriptor(C.prototype, 'b');
+  assertFalse(desc.enumerable);
+  assertTrue(desc.configurable);
+  assertEquals('get B', desc.get());
+  assertEquals(undefined, desc.set);
+
+  C = class {
+    [b]() { return 'B'; };
+    set b(v) { return 'set B'; };
+  };
+  desc = Object.getOwnPropertyDescriptor(C.prototype, 'b');
+  assertFalse(desc.enumerable);
+  assertTrue(desc.configurable);
+  assertEquals(undefined, desc.get);
+  assertEquals('set B', desc.set());
+
+  C = class {
+    set b(v) { return 'get B'; };
+    [b]() { return 'B'; };
+    get b() { return 'get B'; };
+  };
+  desc = Object.getOwnPropertyDescriptor(C.prototype, 'b');
+  assertFalse(desc.enumerable);
+  assertTrue(desc.configurable);
+  assertEquals('get B', desc.get());
+  assertEquals(undefined, desc.set);
+
+  C = class {
+    get b() { return 'get B'; };
+    [b]() { return 'B'; };
+    set b(v) { return 'set B'; };
+  };
+  desc = Object.getOwnPropertyDescriptor(C.prototype, 'b');
+  assertFalse(desc.enumerable);
+  assertTrue(desc.configurable);
+  assertEquals(undefined, desc.get);
+  assertEquals('set B', desc.set());
+})();
+
+(function TestOverwritingStaticAccessors() {
+  var C, desc;
+  C = class {
+    static [b]() { return 'B'; };
+    static get b() { return 'get B'; };
+  };
+  desc = Object.getOwnPropertyDescriptor(C, 'b');
+  assertFalse(desc.enumerable);
+  assertTrue(desc.configurable);
+  assertEquals('get B', desc.get());
+  assertEquals(undefined, desc.set);
+
+  C = class {
+    static [b]() { return 'B'; };
+    static set b(v) { return 'set B'; };
+  };
+  desc = Object.getOwnPropertyDescriptor(C, 'b');
+  assertFalse(desc.enumerable);
+  assertTrue(desc.configurable);
+  assertEquals(undefined, desc.get);
+  assertEquals('set B', desc.set());
+
+  C = class {
+    static set b(v) { return 'get B'; };
+    static [b]() { return 'B'; };
+    static get b() { return 'get B'; };
+  };
+  desc = Object.getOwnPropertyDescriptor(C, 'b');
+  assertFalse(desc.enumerable);
+  assertTrue(desc.configurable);
+  assertEquals('get B', desc.get());
+  assertEquals(undefined, desc.set);
+
+  C = class {
+    static get b() { return 'get B'; };
+    static [b]() { return 'B'; };
+    static set b(v) { return 'set B'; };
+  };
+  desc = Object.getOwnPropertyDescriptor(C, 'b');
+  assertFalse(desc.enumerable);
+  assertTrue(desc.configurable);
+  assertEquals(undefined, desc.get);
+  assertEquals('set B', desc.set());
+})();
diff --git a/src/v8/test/mjsunit/es6/classes-constructor.js b/src/v8/test/mjsunit/es6/classes-constructor.js
new file mode 100644
index 0000000..faf9404
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/classes-constructor.js
@@ -0,0 +1,131 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestDefaultConstructorNoCrash() {
+  // Regression test for https://code.google.com/p/v8/issues/detail?id=3661
+  class C {}
+  assertThrows(function () {C();}, TypeError);
+  assertThrows(function () {C(1);}, TypeError);
+  assertTrue(new C() instanceof C);
+  assertTrue(new C(1) instanceof C);
+})();
+
+
+(function TestConstructorCall(){
+  var realmIndex = Realm.create();
+  var otherTypeError = Realm.eval(realmIndex, "TypeError");
+  var A = Realm.eval(realmIndex, '"use strict"; class A {}; A');
+  var instance = new A();
+  var constructor = instance.constructor;
+  var otherTypeError = Realm.eval(realmIndex, 'TypeError');
+  if (otherTypeError === TypeError) {
+    throw Error('Should not happen!');
+  }
+
+  // ES6 9.2.1[[Call]] throws a TypeError in the caller context/Realm when the
+  // called function is a classConstructor
+  assertThrows(function() { Realm.eval(realmIndex, "A()") }, otherTypeError);
+  assertThrows(function() { instance.constructor() }, TypeError);
+  assertThrows(function() { A() }, TypeError);
+
+  // ES6 9.3.1 call() first activates the callee context before invoking the
+  // method. The TypeError from the constructor is thus thrown in the other
+  // Realm.
+  assertThrows(function() { Realm.eval(realmIndex, "A.call()") },
+      otherTypeError);
+  assertThrows(function() { constructor.call() }, otherTypeError);
+  assertThrows(function() { A.call() }, otherTypeError);
+})();
+
+
+(function TestConstructorCallOptimized() {
+  class A { };
+
+  function invoke_constructor() { A() }
+  function call_constructor() { A.call() }
+  function apply_constructor() { A.apply() }
+  %PrepareFunctionForOptimization(invoke_constructor);
+  %PrepareFunctionForOptimization(call_constructor);
+  %PrepareFunctionForOptimization(apply_constructor);
+
+  for (var i=0; i<3; i++) {
+    assertThrows(invoke_constructor);
+    assertThrows(call_constructor);
+    assertThrows(apply_constructor);
+  }
+  // Make sure we still check for class constructors when calling optimized
+  // code.
+  %OptimizeFunctionOnNextCall(invoke_constructor);
+  assertThrows(invoke_constructor);
+  %OptimizeFunctionOnNextCall(call_constructor);
+  assertThrows(call_constructor);
+  %OptimizeFunctionOnNextCall(apply_constructor);
+  assertThrows(apply_constructor);
+})();
+
+
+(function TestDefaultConstructor() {
+  var calls = 0;
+  class Base {
+    constructor() {
+      calls++;
+    }
+  }
+  class Derived extends Base {}
+  var object = new Derived;
+  assertEquals(1, calls);
+
+  calls = 0;
+  assertThrows(function() { Derived(); }, TypeError);
+  assertEquals(0, calls);
+})();
+
+
+(function TestDefaultConstructorArguments() {
+  var args, self;
+  class Base {
+    constructor() {
+      self = this;
+      args = arguments;
+    }
+  }
+  class Derived extends Base {}
+
+  new Derived;
+  assertEquals(0, args.length);
+
+  new Derived(0, 1, 2);
+  assertEquals(3, args.length);
+  assertTrue(self instanceof Derived);
+
+  var arr = new Array(100);
+  var obj = {};
+  assertThrows(function() {Derived.apply(obj, arr);}, TypeError);
+})();
+
+
+(function TestDefaultConstructorArguments2() {
+  var args;
+  class Base {
+    constructor(x, y) {
+      args = arguments;
+    }
+  }
+  class Derived extends Base {}
+
+  new Derived;
+  assertEquals(0, args.length);
+
+  new Derived(1);
+  assertEquals(1, args.length);
+  assertEquals(1, args[0]);
+
+  new Derived(1, 2, 3);
+  assertEquals(3, args.length);
+  assertEquals(1, args[0]);
+  assertEquals(2, args[1]);
+  assertEquals(3, args[2]);
+})();
diff --git a/src/v8/test/mjsunit/es6/classes-name-binding.js b/src/v8/test/mjsunit/es6/classes-name-binding.js
new file mode 100644
index 0000000..8dddcd7
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/classes-name-binding.js
@@ -0,0 +1,98 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestNameBindingConst() {
+  assertThrows('class C { constructor() { C = 42; } }; new C();', TypeError);
+  assertThrows('new (class C { constructor() { C = 42; } })', TypeError);
+  assertThrows('class C { m() { C = 42; } }; new C().m()', TypeError);
+  assertThrows('new (class C { m() { C = 42; } }).m()', TypeError);
+  assertThrows('class C { get x() { C = 42; } }; new C().x', TypeError);
+  assertThrows('(new (class C { get x() { C = 42; } })).x', TypeError);
+  assertThrows('class C { set x(_) { C = 42; } }; new C().x = 15;', TypeError);
+  assertThrows('(new (class C { set x(_) { C = 42; } })).x = 15;', TypeError);
+})();
+
+(function TestNameBinding() {
+  var C2;
+  class C {
+    constructor() {
+      C2 = C;
+    }
+    m() {
+      C2 = C;
+    }
+    get x() {
+      C2 = C;
+    }
+    set x(_) {
+      C2 = C;
+    }
+  }
+  new C();
+  assertEquals(C, C2);
+
+  C2 = undefined;
+  new C().m();
+  assertEquals(C, C2);
+
+  C2 = undefined;
+  new C().x;
+  assertEquals(C, C2);
+
+  C2 = undefined;
+  new C().x = 1;
+  assertEquals(C, C2);
+})();
+
+(function TestNameBindingExpression() {
+  var C3;
+  var C = class C2 {
+    constructor() {
+      assertEquals(C2, C);
+      C3 = C2;
+    }
+    m() {
+      assertEquals(C2, C);
+      C3 = C2;
+    }
+    get x() {
+      assertEquals(C2, C);
+      C3 = C2;
+    }
+    set x(_) {
+      assertEquals(C2, C);
+      C3 = C2;
+    }
+  }
+  new C();
+  assertEquals(C, C3);
+
+  C3 = undefined;
+  new C().m();
+  assertEquals(C, C3);
+
+  C3 = undefined;
+  new C().x;
+  assertEquals(C, C3);
+
+  C3 = undefined;
+  new C().x = 1;
+  assertEquals(C, C3);
+})();
+
+(function TestNameBindingInExtendsExpression() {
+  assertThrows(function() {
+    class x extends x {}
+  }, ReferenceError);
+
+  assertThrows(function() {
+    (class x extends x {});
+  }, ReferenceError);
+
+  assertThrows(function() {
+    var x = (class x extends x {});
+  }, ReferenceError);
+})();
diff --git a/src/v8/test/mjsunit/es6/classes-proto.js b/src/v8/test/mjsunit/es6/classes-proto.js
new file mode 100644
index 0000000..1f224de
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/classes-proto.js
@@ -0,0 +1,152 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function assertMethodDescriptor(object, name) {
+    var descr = Object.getOwnPropertyDescriptor(object, name);
+    assertTrue(descr.configurable);
+    assertFalse(descr.enumerable);
+    assertTrue(descr.writable);
+    assertEquals('function', typeof descr.value);
+    assertFalse('prototype' in descr.value);
+    assertEquals(name, descr.value.name);
+}
+
+
+function assertAccessorDescriptor(object, name) {
+    var descr = Object.getOwnPropertyDescriptor(object, name);
+    assertTrue(descr.configurable);
+    assertFalse(descr.enumerable);
+    assertEquals('function', typeof descr.get);
+    assertEquals('function', typeof descr.set);
+    assertFalse('prototype' in descr.get);
+    assertFalse('prototype' in descr.set);
+    assertEquals("get " + name, descr.get.name);
+    assertEquals("set " + name, descr.set.name);
+}
+
+
+(function TestProto() {
+  class C {
+    __proto__() { return 1; }
+  }
+  assertMethodDescriptor(C.prototype, '__proto__');
+  assertEquals(1, new C().__proto__());
+})();
+
+
+(function TestProtoStatic() {
+  class C {
+    static __proto__() { return 1; }
+  }
+  assertMethodDescriptor(C, '__proto__');
+  assertEquals(1, C.__proto__());
+})();
+
+
+(function TestProtoAccessor() {
+  class C {
+    get __proto__() { return this._p; }
+    set __proto__(v) { this._p = v; }
+  }
+  assertAccessorDescriptor(C.prototype, '__proto__');
+  var c = new C();
+  c._p = 1;
+  assertEquals(1, c.__proto__);
+  c.__proto__ = 2;
+  assertEquals(2, c.__proto__);
+})();
+
+
+(function TestStaticProtoAccessor() {
+  class C {
+    static get __proto__() { return this._p; }
+    static set __proto__(v) { this._p = v; }
+  }
+  assertAccessorDescriptor(C, '__proto__');
+  C._p = 1;
+  assertEquals(1, C.__proto__);
+  C.__proto__ = 2;
+  assertEquals(2, C.__proto__);
+})();
+
+
+(function TestSettersOnProto() {
+  function Base() {}
+  Base.prototype = {
+    set constructor(_) {
+      assertUnreachable();
+    },
+    set m(_) {
+      assertUnreachable();
+    }
+  };
+  Object.defineProperty(Base, 'staticM', {
+    set: function() {
+      assertUnreachable();
+    }
+  });
+
+  class C extends Base {
+    m() {
+      return 1;
+    }
+    static staticM() {
+      return 2;
+    }
+  }
+
+  assertEquals(1, new C().m());
+  assertEquals(2, C.staticM());
+})();
+
+
+(function TestConstructableButNoPrototype() {
+  var Base = function() {}.bind();
+  assertThrows(function() {
+    class C extends Base {}
+  }, TypeError);
+})();
+
+
+(function TestPrototypeGetter() {
+  var calls = 0;
+  var Base = function() {}.bind();
+  Object.defineProperty(Base, 'prototype', {
+    get: function() {
+      calls++;
+      return null;
+    },
+    configurable: true
+  });
+  class C extends Base {}
+  assertEquals(1, calls);
+
+  calls = 0;
+  Object.defineProperty(Base, 'prototype', {
+    get: function() {
+      calls++;
+      return 42;
+    },
+    configurable: true
+  });
+  assertThrows(function() {
+    class C extends Base {}
+  }, TypeError);
+  assertEquals(1, calls);
+})();
+
+
+(function TestPrototypeSetter() {
+  var Base = function() {}.bind();
+  Object.defineProperty(Base, 'prototype', {
+    set: function() {
+      assertUnreachable();
+    }
+  });
+  assertThrows(function() {
+    class C extends Base {}
+  }, TypeError);
+})();
diff --git a/src/v8/test/mjsunit/es6/classes-restricted-properties.js b/src/v8/test/mjsunit/es6/classes-restricted-properties.js
new file mode 100644
index 0000000..085f2f2
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/classes-restricted-properties.js
@@ -0,0 +1,165 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestThisAccessRestriction() {
+  class Base {}
+  (function() {
+    class C extends Base {
+      constructor() {
+        var y;
+        super();
+      }
+    }; new C();
+  }());
+  assertThrows(function() {
+    class C extends Base {
+      constructor() {
+        super(this.x);
+      }
+    }; new C();
+  }, ReferenceError);
+  assertThrows(function() {
+    class C extends Base {
+      constructor() {
+        super(this);
+      }
+    }; new C();
+  }, ReferenceError);
+  assertThrows(function() {
+    class C extends Base {
+      constructor() {
+        super.method();
+        super(this);
+      }
+    }; new C();
+  }, ReferenceError);
+  assertThrows(function() {
+    class C extends Base {
+      constructor() {
+        super(super.method());
+      }
+    }; new C();
+  }, ReferenceError);
+  assertThrows(function() {
+    class C extends Base {
+      constructor() {
+        super(super());
+      }
+    }; new C();
+  }, ReferenceError);
+  assertThrows(function() {
+    class C extends Base {
+      constructor() {
+        super(1, 2, Object.getPrototypeOf(this));
+      }
+    }; new C();
+  }, ReferenceError);
+  (function() {
+    class C extends Base {
+      constructor() {
+        { super(1, 2); }
+      }
+    }; new C();
+  }());
+  (function() {
+    class C extends Base {
+      constructor() {
+        if (1) super();
+      }
+    }; new C();
+  }());
+
+  class C1 extends Object {
+    constructor() {
+      'use strict';
+      super();
+    }
+  };
+  new C1();
+
+  class C2 extends Object {
+    constructor() {
+      ; 'use strict';;;;;
+      super();
+    }
+  };
+  new C2();
+
+  class C3 extends Object {
+    constructor() {
+      ; 'use strict';;;;;
+      // This is a comment.
+      super();
+    }
+  };
+  new C3();
+}());
+
+
+function testClassRestrictedProperties(C) {
+  assertEquals(false, C.hasOwnProperty("arguments"));
+  assertThrows(function() { return C.arguments; }, TypeError);
+  assertThrows(function() { C.arguments = {}; }, TypeError);
+
+  assertEquals(false, C.hasOwnProperty("caller"));
+  assertThrows(function() { return C.caller; }, TypeError);
+  assertThrows(function() { C.caller = {}; }, TypeError);
+
+  assertEquals(false, (new C).method.hasOwnProperty("arguments"));
+  assertThrows(function() { return new C().method.arguments; }, TypeError);
+  assertThrows(function() { new C().method.arguments = {}; }, TypeError);
+
+  assertEquals(false, (new C).method.hasOwnProperty("caller"));
+  assertThrows(function() { return new C().method.caller; }, TypeError);
+  assertThrows(function() { new C().method.caller = {}; }, TypeError);
+}
+
+
+(function testRestrictedPropertiesStrict() {
+  "use strict";
+  class ClassWithDefaultConstructor {
+    method() {}
+  }
+  class Class {
+    constructor() {}
+    method() {}
+  }
+  class DerivedClassWithDefaultConstructor extends Class {}
+  class DerivedClass extends Class { constructor() { super(); } }
+
+  testClassRestrictedProperties(ClassWithDefaultConstructor);
+  testClassRestrictedProperties(Class);
+  testClassRestrictedProperties(DerivedClassWithDefaultConstructor);
+  testClassRestrictedProperties(DerivedClass);
+  testClassRestrictedProperties(class { method() {} });
+  testClassRestrictedProperties(class { constructor() {} method() {} });
+  testClassRestrictedProperties(class extends Class { });
+  testClassRestrictedProperties(
+      class extends Class { constructor() { super(); } });
+})();
+
+
+(function testRestrictedPropertiesSloppy() {
+  class ClassWithDefaultConstructor {
+    method() {}
+  }
+  class Class {
+    constructor() {}
+    method() {}
+  }
+  class DerivedClassWithDefaultConstructor extends Class {}
+  class DerivedClass extends Class { constructor() { super(); } }
+
+  testClassRestrictedProperties(ClassWithDefaultConstructor);
+  testClassRestrictedProperties(Class);
+  testClassRestrictedProperties(DerivedClassWithDefaultConstructor);
+  testClassRestrictedProperties(DerivedClass);
+  testClassRestrictedProperties(class { method() {} });
+  testClassRestrictedProperties(class { constructor() {} method() {} });
+  testClassRestrictedProperties(class extends Class { });
+  testClassRestrictedProperties(
+      class extends Class { constructor() { super(); } });
+})();
diff --git a/src/v8/test/mjsunit/es6/classes-test-super.js b/src/v8/test/mjsunit/es6/classes-test-super.js
new file mode 100644
index 0000000..92f1872
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/classes-test-super.js
@@ -0,0 +1,120 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestSuperInMethods() {
+  class B {
+    method() {
+      return 1;
+    }
+    get x() {
+      return 2;
+    }
+  }
+  class C extends B {
+    method() {
+      assertEquals(2, super.x);
+      return super.method();
+    }
+  }
+  assertEquals(1, new C().method());
+})();
+
+
+(function TestSuperInGetter() {
+  class B {
+    method() {
+      return 1;
+    }
+    get x() {
+      return 2;
+    }
+  }
+  class C extends B {
+    get y() {
+      assertEquals(2, super.x);
+      return super.method();
+    }
+  }
+  assertEquals(1, new C().y);
+})();
+
+
+(function TestSuperInSetter() {
+  class B {
+    method() {
+      return 1;
+    }
+    get x() {
+      return 2;
+    }
+  }
+  class C extends B {
+    set y(v) {
+      assertEquals(3, v);
+      assertEquals(2, super.x);
+      assertEquals(1, super.method());
+    }
+  }
+  assertEquals(3, new C().y = 3);
+})();
+
+
+(function TestSuperInStaticMethods() {
+  class B {
+    static method() {
+      return 1;
+    }
+    static get x() {
+      return 2;
+    }
+  }
+  class C extends B {
+    static method() {
+      assertEquals(2, super.x);
+      return super.method();
+    }
+  }
+  assertEquals(1, C.method());
+})();
+
+
+(function TestSuperInStaticGetter() {
+  class B {
+    static method() {
+      return 1;
+    }
+    static get x() {
+      return 2;
+    }
+  }
+  class C extends B {
+    static get x() {
+      assertEquals(2, super.x);
+      return super.method();
+    }
+  }
+  assertEquals(1, C.x);
+})();
+
+
+(function TestSuperInStaticSetter() {
+  class B {
+    static method() {
+      return 1;
+    }
+    static get x() {
+      return 2;
+    }
+  }
+  class C extends B {
+    static set x(v) {
+      assertEquals(3, v);
+      assertEquals(2, super.x);
+      assertEquals(1, super.method());
+    }
+  }
+  assertEquals(3, C.x = 3);
+})();
diff --git a/src/v8/test/mjsunit/es6/classes.js b/src/v8/test/mjsunit/es6/classes.js
index a123dad..eb25f07 100644
--- a/src/v8/test/mjsunit/es6/classes.js
+++ b/src/v8/test/mjsunit/es6/classes.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --harmony-do-expressions
+// Flags: --allow-natives-syntax
 
 (function TestBasics() {
   var C = class C {}
@@ -23,10 +23,41 @@
   assertEquals('D2', D2.name);
 
   var E = class {}
-  assertEquals('E', E.name);  // Should be 'E'.
+  assertEquals('E', E.name);
 
   var F = class { constructor() {} };
-  assertEquals('F', F.name);  // Should be 'F'.
+  assertEquals('F', F.name);
+
+  var literal = { E: class {} };
+  assertEquals('E', literal.E.name);
+
+  literal = { E: class F {} };
+  assertEquals('F', literal.E.name);
+
+  literal = { __proto__: class {} };
+  assertEquals('', literal.__proto__.name);
+  assertEquals(
+      undefined, Object.getOwnPropertyDescriptor(literal.__proto__, 'name'));
+
+  literal = { __proto__: class F {} };
+  assertEquals('F', literal.__proto__.name);
+  assertNotEquals(
+      undefined, Object.getOwnPropertyDescriptor(literal.__proto__, 'name'));
+
+  class G {};
+  literal = { __proto__: G };
+  assertEquals('G', literal.__proto__.name);
+
+  var H = class { static name() { return 'A'; } };
+  literal = { __proto__ : H };
+  assertEquals('A', literal.__proto__.name());
+
+  literal = {
+    __proto__: class {
+      static name() { return 'A'; }
+    }
+  };
+  assertEquals('A', literal.__proto__.name());
 })();
 
 
@@ -187,7 +218,6 @@
   assertEquals('class E { x() { 42; } }', E.toString());
 })();
 
-
 function assertMethodDescriptor(object, name) {
   var descr = Object.getOwnPropertyDescriptor(object, name);
   assertTrue(descr.configurable);
@@ -345,247 +375,6 @@
   assertEquals(4, C.staticX );
 })();
 
-
-(function TestProto() {
-  class C {
-    __proto__() { return 1; }
-  }
-  assertMethodDescriptor(C.prototype, '__proto__');
-  assertEquals(1, new C().__proto__());
-})();
-
-
-(function TestProtoStatic() {
-  class C {
-    static __proto__() { return 1; }
-  }
-  assertMethodDescriptor(C, '__proto__');
-  assertEquals(1, C.__proto__());
-})();
-
-
-(function TestProtoAccessor() {
-  class C {
-    get __proto__() { return this._p; }
-    set __proto__(v) { this._p = v; }
-  }
-  assertAccessorDescriptor(C.prototype, '__proto__');
-  var c = new C();
-  c._p = 1;
-  assertEquals(1, c.__proto__);
-  c.__proto__ = 2;
-  assertEquals(2, c.__proto__);
-})();
-
-
-(function TestStaticProtoAccessor() {
-  class C {
-    static get __proto__() { return this._p; }
-    static set __proto__(v) { this._p = v; }
-  }
-  assertAccessorDescriptor(C, '__proto__');
-  C._p = 1;
-  assertEquals(1, C.__proto__);
-  C.__proto__ = 2;
-  assertEquals(2, C.__proto__);
-})();
-
-
-(function TestSettersOnProto() {
-  function Base() {}
-  Base.prototype = {
-    set constructor(_) {
-      assertUnreachable();
-    },
-    set m(_) {
-      assertUnreachable();
-    }
-  };
-  Object.defineProperty(Base, 'staticM', {
-    set: function() {
-      assertUnreachable();
-    }
-  });
-
-  class C extends Base {
-    m() {
-      return 1;
-    }
-    static staticM() {
-      return 2;
-    }
-  }
-
-  assertEquals(1, new C().m());
-  assertEquals(2, C.staticM());
-})();
-
-
-(function TestConstructableButNoPrototype() {
-  var Base = function() {}.bind();
-  assertThrows(function() {
-    class C extends Base {}
-  }, TypeError);
-})();
-
-
-(function TestPrototypeGetter() {
-  var calls = 0;
-  var Base = function() {}.bind();
-  Object.defineProperty(Base, 'prototype', {
-    get: function() {
-      calls++;
-      return null;
-    },
-    configurable: true
-  });
-  class C extends Base {}
-  assertEquals(1, calls);
-
-  calls = 0;
-  Object.defineProperty(Base, 'prototype', {
-    get: function() {
-      calls++;
-      return 42;
-    },
-    configurable: true
-  });
-  assertThrows(function() {
-    class C extends Base {}
-  }, TypeError);
-  assertEquals(1, calls);
-})();
-
-
-(function TestPrototypeSetter() {
-  var Base = function() {}.bind();
-  Object.defineProperty(Base, 'prototype', {
-    set: function() {
-      assertUnreachable();
-    }
-  });
-  assertThrows(function() {
-    class C extends Base {}
-  }, TypeError);
-})();
-
-
-(function TestSuperInMethods() {
-  class B {
-    method() {
-      return 1;
-    }
-    get x() {
-      return 2;
-    }
-  }
-  class C extends B {
-    method() {
-      assertEquals(2, super.x);
-      return super.method();
-    }
-  }
-  assertEquals(1, new C().method());
-})();
-
-
-(function TestSuperInGetter() {
-  class B {
-    method() {
-      return 1;
-    }
-    get x() {
-      return 2;
-    }
-  }
-  class C extends B {
-    get y() {
-      assertEquals(2, super.x);
-      return super.method();
-    }
-  }
-  assertEquals(1, new C().y);
-})();
-
-
-(function TestSuperInSetter() {
-  class B {
-    method() {
-      return 1;
-    }
-    get x() {
-      return 2;
-    }
-  }
-  class C extends B {
-    set y(v) {
-      assertEquals(3, v);
-      assertEquals(2, super.x);
-      assertEquals(1, super.method());
-    }
-  }
-  assertEquals(3, new C().y = 3);
-})();
-
-
-(function TestSuperInStaticMethods() {
-  class B {
-    static method() {
-      return 1;
-    }
-    static get x() {
-      return 2;
-    }
-  }
-  class C extends B {
-    static method() {
-      assertEquals(2, super.x);
-      return super.method();
-    }
-  }
-  assertEquals(1, C.method());
-})();
-
-
-(function TestSuperInStaticGetter() {
-  class B {
-    static method() {
-      return 1;
-    }
-    static get x() {
-      return 2;
-    }
-  }
-  class C extends B {
-    static get x() {
-      assertEquals(2, super.x);
-      return super.method();
-    }
-  }
-  assertEquals(1, C.x);
-})();
-
-
-(function TestSuperInStaticSetter() {
-  class B {
-    static method() {
-      return 1;
-    }
-    static get x() {
-      return 2;
-    }
-  }
-  class C extends B {
-    static set x(v) {
-      assertEquals(3, v);
-      assertEquals(2, super.x);
-      assertEquals(1, super.method());
-    }
-  }
-  assertEquals(3, C.x = 3);
-})();
-
-
 (function TestNumericPropertyNames() {
   class B {
     1() { return 1; }
@@ -653,416 +442,8 @@
   assertEquals(2147483653, C[2147483653]);
 })();
 
-
-(function TestDefaultConstructorNoCrash() {
-  // Regression test for https://code.google.com/p/v8/issues/detail?id=3661
-  class C {}
-  assertThrows(function () {C();}, TypeError);
-  assertThrows(function () {C(1);}, TypeError);
-  assertTrue(new C() instanceof C);
-  assertTrue(new C(1) instanceof C);
-})();
-
-
-(function TestConstructorCall(){
-  var realmIndex = Realm.create();
-  var otherTypeError = Realm.eval(realmIndex, "TypeError");
-  var A = Realm.eval(realmIndex, '"use strict"; class A {}; A');
-  var instance = new A();
-  var constructor = instance.constructor;
-  var otherTypeError = Realm.eval(realmIndex, 'TypeError');
-  if (otherTypeError === TypeError) {
-    throw Error('Should not happen!');
-  }
-
-  // ES6 9.2.1[[Call]] throws a TypeError in the caller context/Realm when the
-  // called function is a classConstructor
-  assertThrows(function() { Realm.eval(realmIndex, "A()") }, otherTypeError);
-  assertThrows(function() { instance.constructor() }, TypeError);
-  assertThrows(function() { A() }, TypeError);
-
-  // ES6 9.3.1 call() first activates the callee context before invoking the
-  // method. The TypeError from the constructor is thus thrown in the other
-  // Realm.
-  assertThrows(function() { Realm.eval(realmIndex, "A.call()") },
-      otherTypeError);
-  assertThrows(function() { constructor.call() }, otherTypeError);
-  assertThrows(function() { A.call() }, otherTypeError);
-})();
-
-
-(function TestConstructorCallOptimized() {
-  class A { };
-
-  function invoke_constructor() { A() }
-  function call_constructor() { A.call() }
-  function apply_constructor() { A.apply() }
-
-  for (var i=0; i<3; i++) {
-    assertThrows(invoke_constructor);
-    assertThrows(call_constructor);
-    assertThrows(apply_constructor);
-  }
-  // Make sure we still check for class constructors when calling optimized
-  // code.
-  %OptimizeFunctionOnNextCall(invoke_constructor);
-  assertThrows(invoke_constructor);
-  %OptimizeFunctionOnNextCall(call_constructor);
-  assertThrows(call_constructor);
-  %OptimizeFunctionOnNextCall(apply_constructor);
-  assertThrows(apply_constructor);
-})();
-
-
-(function TestDefaultConstructor() {
-  var calls = 0;
-  class Base {
-    constructor() {
-      calls++;
-    }
-  }
-  class Derived extends Base {}
-  var object = new Derived;
-  assertEquals(1, calls);
-
-  calls = 0;
-  assertThrows(function() { Derived(); }, TypeError);
-  assertEquals(0, calls);
-})();
-
-
-(function TestDefaultConstructorArguments() {
-  var args, self;
-  class Base {
-    constructor() {
-      self = this;
-      args = arguments;
-    }
-  }
-  class Derived extends Base {}
-
-  new Derived;
-  assertEquals(0, args.length);
-
-  new Derived(0, 1, 2);
-  assertEquals(3, args.length);
-  assertTrue(self instanceof Derived);
-
-  var arr = new Array(100);
-  var obj = {};
-  assertThrows(function() {Derived.apply(obj, arr);}, TypeError);
-})();
-
-
-(function TestDefaultConstructorArguments2() {
-  var args;
-  class Base {
-    constructor(x, y) {
-      args = arguments;
-    }
-  }
-  class Derived extends Base {}
-
-  new Derived;
-  assertEquals(0, args.length);
-
-  new Derived(1);
-  assertEquals(1, args.length);
-  assertEquals(1, args[0]);
-
-  new Derived(1, 2, 3);
-  assertEquals(3, args.length);
-  assertEquals(1, args[0]);
-  assertEquals(2, args[1]);
-  assertEquals(3, args[2]);
-})();
-
-
-(function TestNameBindingConst() {
-  assertThrows('class C { constructor() { C = 42; } }; new C();', TypeError);
-  assertThrows('new (class C { constructor() { C = 42; } })', TypeError);
-  assertThrows('class C { m() { C = 42; } }; new C().m()', TypeError);
-  assertThrows('new (class C { m() { C = 42; } }).m()', TypeError);
-  assertThrows('class C { get x() { C = 42; } }; new C().x', TypeError);
-  assertThrows('(new (class C { get x() { C = 42; } })).x', TypeError);
-  assertThrows('class C { set x(_) { C = 42; } }; new C().x = 15;', TypeError);
-  assertThrows('(new (class C { set x(_) { C = 42; } })).x = 15;', TypeError);
-})();
-
-
-(function TestNameBinding() {
-  var C2;
-  class C {
-    constructor() {
-      C2 = C;
-    }
-    m() {
-      C2 = C;
-    }
-    get x() {
-      C2 = C;
-    }
-    set x(_) {
-      C2 = C;
-    }
-  }
-  new C();
-  assertEquals(C, C2);
-
-  C2 = undefined;
-  new C().m();
-  assertEquals(C, C2);
-
-  C2 = undefined;
-  new C().x;
-  assertEquals(C, C2);
-
-  C2 = undefined;
-  new C().x = 1;
-  assertEquals(C, C2);
-})();
-
-
-(function TestNameBindingExpression() {
-  var C3;
-  var C = class C2 {
-    constructor() {
-      assertEquals(C2, C);
-      C3 = C2;
-    }
-    m() {
-      assertEquals(C2, C);
-      C3 = C2;
-    }
-    get x() {
-      assertEquals(C2, C);
-      C3 = C2;
-    }
-    set x(_) {
-      assertEquals(C2, C);
-      C3 = C2;
-    }
-  }
-  new C();
-  assertEquals(C, C3);
-
-  C3 = undefined;
-  new C().m();
-  assertEquals(C, C3);
-
-  C3 = undefined;
-  new C().x;
-  assertEquals(C, C3);
-
-  C3 = undefined;
-  new C().x = 1;
-  assertEquals(C, C3);
-})();
-
-
-(function TestNameBindingInExtendsExpression() {
-  assertThrows(function() {
-    class x extends x {}
-  }, ReferenceError);
-
-  assertThrows(function() {
-    (class x extends x {});
-  }, ReferenceError);
-
-  assertThrows(function() {
-    var x = (class x extends x {});
-  }, ReferenceError);
-})();
-
-
-(function TestThisAccessRestriction() {
-  class Base {}
-  (function() {
-    class C extends Base {
-      constructor() {
-        var y;
-        super();
-      }
-    }; new C();
-  }());
-  assertThrows(function() {
-    class C extends Base {
-      constructor() {
-        super(this.x);
-      }
-    }; new C();
-  }, ReferenceError);
-  assertThrows(function() {
-    class C extends Base {
-      constructor() {
-        super(this);
-      }
-    }; new C();
-  }, ReferenceError);
-  assertThrows(function() {
-    class C extends Base {
-      constructor() {
-        super.method();
-        super(this);
-      }
-    }; new C();
-  }, ReferenceError);
-  assertThrows(function() {
-    class C extends Base {
-      constructor() {
-        super(super.method());
-      }
-    }; new C();
-  }, ReferenceError);
-  assertThrows(function() {
-    class C extends Base {
-      constructor() {
-        super(super());
-      }
-    }; new C();
-  }, ReferenceError);
-  assertThrows(function() {
-    class C extends Base {
-      constructor() {
-        super(1, 2, Object.getPrototypeOf(this));
-      }
-    }; new C();
-  }, ReferenceError);
-  (function() {
-    class C extends Base {
-      constructor() {
-        { super(1, 2); }
-      }
-    }; new C();
-  }());
-  (function() {
-    class C extends Base {
-      constructor() {
-        if (1) super();
-      }
-    }; new C();
-  }());
-
-  class C1 extends Object {
-    constructor() {
-      'use strict';
-      super();
-    }
-  };
-  new C1();
-
-  class C2 extends Object {
-    constructor() {
-      ; 'use strict';;;;;
-      super();
-    }
-  };
-  new C2();
-
-  class C3 extends Object {
-    constructor() {
-      ; 'use strict';;;;;
-      // This is a comment.
-      super();
-    }
-  };
-  new C3();
-}());
-
-
-function testClassRestrictedProperties(C) {
-  assertEquals(false, C.hasOwnProperty("arguments"));
-  assertThrows(function() { return C.arguments; }, TypeError);
-  assertThrows(function() { C.arguments = {}; }, TypeError);
-
-  assertEquals(false, C.hasOwnProperty("caller"));
-  assertThrows(function() { return C.caller; }, TypeError);
-  assertThrows(function() { C.caller = {}; }, TypeError);
-
-  assertEquals(false, (new C).method.hasOwnProperty("arguments"));
-  assertThrows(function() { return new C().method.arguments; }, TypeError);
-  assertThrows(function() { new C().method.arguments = {}; }, TypeError);
-
-  assertEquals(false, (new C).method.hasOwnProperty("caller"));
-  assertThrows(function() { return new C().method.caller; }, TypeError);
-  assertThrows(function() { new C().method.caller = {}; }, TypeError);
-}
-
-
-(function testRestrictedPropertiesStrict() {
-  "use strict";
-  class ClassWithDefaultConstructor {
-    method() {}
-  }
-  class Class {
-    constructor() {}
-    method() {}
-  }
-  class DerivedClassWithDefaultConstructor extends Class {}
-  class DerivedClass extends Class { constructor() { super(); } }
-
-  testClassRestrictedProperties(ClassWithDefaultConstructor);
-  testClassRestrictedProperties(Class);
-  testClassRestrictedProperties(DerivedClassWithDefaultConstructor);
-  testClassRestrictedProperties(DerivedClass);
-  testClassRestrictedProperties(class { method() {} });
-  testClassRestrictedProperties(class { constructor() {} method() {} });
-  testClassRestrictedProperties(class extends Class { });
-  testClassRestrictedProperties(
-      class extends Class { constructor() { super(); } });
-})();
-
-
-(function testRestrictedPropertiesSloppy() {
-  class ClassWithDefaultConstructor {
-    method() {}
-  }
-  class Class {
-    constructor() {}
-    method() {}
-  }
-  class DerivedClassWithDefaultConstructor extends Class {}
-  class DerivedClass extends Class { constructor() { super(); } }
-
-  testClassRestrictedProperties(ClassWithDefaultConstructor);
-  testClassRestrictedProperties(Class);
-  testClassRestrictedProperties(DerivedClassWithDefaultConstructor);
-  testClassRestrictedProperties(DerivedClass);
-  testClassRestrictedProperties(class { method() {} });
-  testClassRestrictedProperties(class { constructor() {} method() {} });
-  testClassRestrictedProperties(class extends Class { });
-  testClassRestrictedProperties(
-      class extends Class { constructor() { super(); } });
-})();
-
-
 (function testReturnFromClassLiteral() {
 
-  function usingDoExpressionInBody() {
-    let x = 42;
-    let dummy = function() {x};
-    try {
-      class C {
-        dummy() {C}
-        [do {return}]() {}
-      };
-    } finally {
-      return x;
-    }
-  }
-  assertEquals(42, usingDoExpressionInBody());
-
-  function usingDoExpressionInExtends() {
-    let x = 42;
-    let dummy = function() {x};
-    try {
-      class C extends (do {return}) { dummy() {C} };
-    } finally {
-      return x;
-    }
-  }
-  assertEquals(42, usingDoExpressionInExtends());
-
   function usingYieldInBody() {
     function* foo() {
       class C {
@@ -1086,103 +467,3 @@
   assertEquals(42, usingYieldInExtends());
 
 })();
-
-
-(function testLargeClassesMethods() {
-  const kLimit = 2000;
-  let evalString = "(function(i) { " +
-      "let clazz = class { " +
-      "   constructor(i) { this.value = i; } ";
-  for (let i = 0; i < 2000; i++) {
-    evalString  += "property"+i+"() { return "+i+"; }; "
-  }
-  evalString += "};" +
-      " return new clazz(i); })";
-
-  let fn = eval(evalString);
-  assertEquals(fn(1).value, 1);
-  assertEquals(fn(2).value, 2);
-  assertEquals(fn(3).value, 3);
-  %OptimizeFunctionOnNextCall(fn);
-  assertEquals(fn(4).value, 4);
-
-  let instance = fn(1);
-  assertEquals(Object.getOwnPropertyNames(instance).length, 1);
-  assertEquals(Object.getOwnPropertyNames(instance.__proto__).length,
-      kLimit + 1);
-
-  // Call all instance functions.
-  for (let i = 0; i < kLimit; i++) {
-    const key = "property" + i;
-    assertEquals(instance[key](), i);
-  }
-})();
-
-
-(function testLargeClassesStaticMethods() {
-  const kLimit = 2000;
-  let evalString = "(function(i) { " +
-      "let clazz = class { " +
-      "   constructor(i) { this.value = i; } ";
-  for (let i = 0; i < kLimit; i++) {
-    evalString  += "static property"+i+"() { return "+i+" }; "
-  }
-  evalString += "};" +
-      " return new clazz(i); })";
-
-  let fn = eval(evalString);
-
-  assertEquals(fn(1).value, 1);
-  assertEquals(fn(2).value, 2);
-  assertEquals(fn(3).value, 3);
-  %OptimizeFunctionOnNextCall(fn);
-  assertEquals(fn(4).value, 4);
-
-  let instance = fn(1);
-  assertEquals(Object.getOwnPropertyNames(instance).length, 1);
-  assertEquals(instance.value, 1);
-  instance.value = 10;
-  assertEquals(instance.value, 10);
-
-  // kLimit + nof default properties (length, prototype, name).
-  assertEquals(Object.getOwnPropertyNames(instance.constructor).length,
-      kLimit + 3);
-
-  // Call all static properties.
-  for (let i = 0; i < kLimit; i++) {
-    const key = "property" + i;
-    assertEquals(instance.constructor[key](), i);
-  }
-})();
-
-
-(function testLargeClassesProperties(){
-  const kLimit = 2000;
-  let evalString = "(function(i) { " +
-      "let clazz = class { " +
-      "   constructor(i) { this.value = i;";
-  for (let i = 0; i < kLimit ; i++) {
-    evalString  += "this.property"+i +" = "+i+"; "
-  }
-  evalString += "}};" +
-      " return (new clazz(i)); })";
-
-  let fn = eval(evalString);
-  assertEquals(fn(1).value, 1);
-  assertEquals(fn(2).value, 2);
-  assertEquals(fn(3).value, 3);
-  %OptimizeFunctionOnNextCall(fn);
-  assertEquals(fn(4).value, 4);
-
-  let instance = fn(1);
-  assertEquals(Object.getOwnPropertyNames(instance).length, kLimit+1);
-
-  // Get and set all properties.
-  for (let i = 0; i < kLimit; i++) {
-    const key = "property" + i;
-    assertEquals(instance[key], i);
-    const value = "value"+i;
-    instance[key] = value;
-    assertEquals(instance[key], value);
-  }
-})();
diff --git a/src/v8/test/mjsunit/es6/collection-iterator.js b/src/v8/test/mjsunit/es6/collection-iterator.js
index 5a9b2f5..027584a 100644
--- a/src/v8/test/mjsunit/es6/collection-iterator.js
+++ b/src/v8/test/mjsunit/es6/collection-iterator.js
@@ -5,6 +5,7 @@
 // Flags: --allow-natives-syntax
 
 function test(f) {
+  %PrepareFunctionForOptimization(f);
   f();
   f();
   %OptimizeFunctionOnNextCall(f);
@@ -14,7 +15,6 @@
 test(function TestSetIterator() {
   var s = new Set;
   var iter = s.values();
-  assertEquals('Set Iterator', %_ClassOf(iter));
 
   var SetIteratorPrototype = iter.__proto__;
   assertFalse(SetIteratorPrototype.hasOwnProperty('constructor'));
@@ -160,7 +160,6 @@
 test(function TestMapIterator() {
   var m = new Map;
   var iter = m.values();
-  assertEquals('Map Iterator', %_ClassOf(iter));
 
   var MapIteratorPrototype = iter.__proto__;
   assertFalse(MapIteratorPrototype.hasOwnProperty('constructor'));
diff --git a/src/v8/test/mjsunit/es6/collections-constructor-custom-iterator.js b/src/v8/test/mjsunit/es6/collections-constructor-custom-iterator.js
new file mode 100644
index 0000000..29b65dc
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/collections-constructor-custom-iterator.js
@@ -0,0 +1,77 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+var global;
+
+function TestSetWithCustomIterator(ctor) {
+  const k1 = {};
+  const k2 = {};
+  const entries = [k1];
+  let callCount = 0;
+  entries[Symbol.iterator] = () => ({
+    next: () =>
+      callCount++ === 0
+        ? { value: k2, done: false }
+        : { done: true }
+  });
+  const set = new ctor(entries);
+  assertFalse(set.has(k1));
+  assertTrue(set.has(k2));
+  assertEquals(2, callCount);
+  // Keep entries alive to avoid collection of the weakly held map in optimized
+  // code which causes the code to deopt.
+  global = entries;
+}
+%PrepareFunctionForOptimization(TestSetWithCustomIterator);
+TestSetWithCustomIterator(Set);
+TestSetWithCustomIterator(Set);
+TestSetWithCustomIterator(Set);
+%OptimizeFunctionOnNextCall(TestSetWithCustomIterator);
+TestSetWithCustomIterator(Set);
+assertOptimized(TestSetWithCustomIterator);
+
+TestSetWithCustomIterator(WeakSet);
+%PrepareFunctionForOptimization(TestSetWithCustomIterator);
+TestSetWithCustomIterator(WeakSet);
+TestSetWithCustomIterator(WeakSet);
+%OptimizeFunctionOnNextCall(TestSetWithCustomIterator);
+TestSetWithCustomIterator(WeakSet);
+assertOptimized(TestSetWithCustomIterator);
+
+function TestMapWithCustomIterator(ctor) {
+  const k1 = {};
+  const k2 = {};
+  const entries = [[k1, 1]];
+  let callCount = 0;
+  entries[Symbol.iterator] = () => ({
+    next: () =>
+      callCount++ === 0
+        ? { value: [k2, 2], done: false }
+        : { done: true }
+  });
+  const map = new ctor(entries);
+  assertFalse(map.has(k1));
+  assertEquals(2, map.get(k2));
+  assertEquals(2, callCount);
+  // Keep entries alive to avoid collection of the weakly held map in optimized
+  // code which causes the code to deopt.
+  global = entries;
+}
+%PrepareFunctionForOptimization(TestMapWithCustomIterator);
+TestMapWithCustomIterator(Map);
+TestMapWithCustomIterator(Map);
+TestMapWithCustomIterator(Map);
+%OptimizeFunctionOnNextCall(TestMapWithCustomIterator);
+TestMapWithCustomIterator(Map);
+assertOptimized(TestMapWithCustomIterator);
+
+TestMapWithCustomIterator(WeakMap);
+%PrepareFunctionForOptimization(TestMapWithCustomIterator);
+TestMapWithCustomIterator(WeakMap);
+TestMapWithCustomIterator(WeakMap);
+%OptimizeFunctionOnNextCall(TestMapWithCustomIterator);
+TestMapWithCustomIterator(WeakMap);
+assertOptimized(TestMapWithCustomIterator);
diff --git a/src/v8/test/mjsunit/es6/collections-constructor-iterator-side-effect.js b/src/v8/test/mjsunit/es6/collections-constructor-iterator-side-effect.js
new file mode 100644
index 0000000..514e546
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/collections-constructor-iterator-side-effect.js
@@ -0,0 +1,84 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function TestSetWithModifiedIterator(ctor) {
+  const k1 = {};
+  const k2 = {};
+  const entries = [k1, k2];
+  const arrayIteratorProto = Object.getPrototypeOf(entries[Symbol.iterator]());
+  const originalNext = arrayIteratorProto.next;
+  let callCount = 0;
+  arrayIteratorProto.next = function() {
+    callCount++;
+    return originalNext.call(this);
+  };
+
+  const set = new ctor(entries);
+  assertEquals(3, callCount); // +1 for iterator done
+
+  if('size' in set) assertEquals(2, set.size);
+  assertTrue(set.has(k1));
+  assertTrue(set.has(k2));
+
+  arrayIteratorProto.next = originalNext;
+}
+%PrepareFunctionForOptimization(TestSetWithModifiedIterator);
+TestSetWithModifiedIterator(Set);
+TestSetWithModifiedIterator(Set);
+TestSetWithModifiedIterator(Set);
+%OptimizeFunctionOnNextCall(TestSetWithModifiedIterator);
+TestSetWithModifiedIterator(Set);
+assertOptimized(TestSetWithModifiedIterator);
+%DeoptimizeFunction(TestSetWithModifiedIterator);
+
+%PrepareFunctionForOptimization(TestSetWithModifiedIterator);
+TestSetWithModifiedIterator(WeakSet);
+TestSetWithModifiedIterator(WeakSet);
+TestSetWithModifiedIterator(WeakSet);
+%OptimizeFunctionOnNextCall(TestSetWithModifiedIterator);
+TestSetWithModifiedIterator(WeakSet);
+assertOptimized(TestSetWithModifiedIterator);
+%DeoptimizeFunction(TestSetWithModifiedIterator);
+
+
+function TestMapWithModifiedIterator(ctor) {
+  const k1 = {};
+  const k2 = {};
+  const entries = [[k1, 1], [k2, 2]];
+  const arrayIteratorProto = Object.getPrototypeOf(entries[Symbol.iterator]());
+  const originalNext = arrayIteratorProto.next;
+  let callCount = 0;
+  arrayIteratorProto.next = function() {
+    callCount++;
+    return originalNext.call(this);
+  };
+
+  const set = new ctor(entries);
+  assertEquals(3, callCount); // +1 for iterator done
+
+  if('size' in set) assertEquals(2, set.size);
+  assertEquals(1, set.get(k1));
+  assertEquals(2, set.get(k2));
+
+  arrayIteratorProto.next = originalNext;
+}
+%PrepareFunctionForOptimization(TestMapWithModifiedIterator);
+TestMapWithModifiedIterator(Map);
+TestMapWithModifiedIterator(Map);
+TestMapWithModifiedIterator(Map);
+%OptimizeFunctionOnNextCall(TestMapWithModifiedIterator);
+TestMapWithModifiedIterator(Map);
+assertOptimized(TestMapWithModifiedIterator);
+%DeoptimizeFunction(TestMapWithModifiedIterator);
+
+%PrepareFunctionForOptimization(TestMapWithModifiedIterator);
+TestMapWithModifiedIterator(WeakMap);
+TestMapWithModifiedIterator(WeakMap);
+TestMapWithModifiedIterator(WeakMap);
+%OptimizeFunctionOnNextCall(TestMapWithModifiedIterator);
+TestMapWithModifiedIterator(WeakMap);
+assertOptimized(TestMapWithModifiedIterator);
+%DeoptimizeFunction(TestMapWithModifiedIterator);
diff --git a/src/v8/test/mjsunit/es6/collections-constructor-with-modified-array-prototype.js b/src/v8/test/mjsunit/es6/collections-constructor-with-modified-array-prototype.js
new file mode 100644
index 0000000..0353be3
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/collections-constructor-with-modified-array-prototype.js
@@ -0,0 +1,69 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function TestSetWithCustomIterator(ctor) {
+  const k1 = {};
+  const k2 = {};
+  let callCount = 0;
+  Array.prototype[Symbol.iterator] = () => ({
+    next: () =>
+      callCount++ === 0
+        ? { value: k2, done: false }
+        : { done: true }
+  });
+  const entries = [k1];
+  const set = new ctor(entries);
+  assertFalse(set.has(k1));
+  assertTrue(set.has(k2));
+  assertEquals(2, callCount);
+}
+%PrepareFunctionForOptimization(TestSetWithCustomIterator);
+TestSetWithCustomIterator(Set);
+TestSetWithCustomIterator(Set);
+TestSetWithCustomIterator(Set);
+%OptimizeFunctionOnNextCall(TestSetWithCustomIterator);
+TestSetWithCustomIterator(Set);
+assertOptimized(TestSetWithCustomIterator);
+
+TestSetWithCustomIterator(WeakSet);
+%PrepareFunctionForOptimization(TestSetWithCustomIterator);
+TestSetWithCustomIterator(WeakSet);
+TestSetWithCustomIterator(WeakSet);
+%OptimizeFunctionOnNextCall(TestSetWithCustomIterator);
+TestSetWithCustomIterator(WeakSet);
+assertOptimized(TestSetWithCustomIterator);
+
+function TestMapWithCustomIterator(ctor) {
+  const k1 = {};
+  const k2 = {};
+  let callCount = 0;
+  Array.prototype[Symbol.iterator] = () => ({
+    next: () =>
+      callCount++ === 0
+        ? { value: [k2, 2], done: false }
+        : { done: true }
+  });
+  const entries = [[k1, 1]];
+  const map = new ctor(entries);
+  assertFalse(map.has(k1));
+  assertEquals(2, map.get(k2));
+  assertEquals(2, callCount);
+}
+%PrepareFunctionForOptimization(TestMapWithCustomIterator);
+TestMapWithCustomIterator(Map);
+TestMapWithCustomIterator(Map);
+TestMapWithCustomIterator(Map);
+%OptimizeFunctionOnNextCall(TestMapWithCustomIterator);
+TestMapWithCustomIterator(Map);
+assertOptimized(TestMapWithCustomIterator);
+
+TestMapWithCustomIterator(WeakMap);
+%PrepareFunctionForOptimization(TestMapWithCustomIterator);
+TestMapWithCustomIterator(WeakMap);
+TestMapWithCustomIterator(WeakMap);
+%OptimizeFunctionOnNextCall(TestMapWithCustomIterator);
+TestMapWithCustomIterator(WeakMap);
+assertOptimized(TestMapWithCustomIterator);
diff --git a/src/v8/test/mjsunit/es6/collections-constructor-with-modified-protoype.js b/src/v8/test/mjsunit/es6/collections-constructor-with-modified-protoype.js
new file mode 100644
index 0000000..91b8767
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/collections-constructor-with-modified-protoype.js
@@ -0,0 +1,80 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function TestSetPrototypeModified(ctor) {
+  const originalPrototypeAdd = ctor.prototype.add;
+  const k1 = {};
+  const k2 = {};
+  const entries = [k1, k2];
+  let addCount = 0;
+
+  ctor.prototype.add = function(value) {
+    addCount++;
+    originalPrototypeAdd.call(this, value);
+    entries.length = 1;
+  };
+  const set = new ctor(entries);
+
+  assertEquals(1, addCount);
+  assertTrue(set.has(k1));
+  assertFalse(set.has(k2));
+
+  ctor.prototype.add = originalPrototypeAdd;
+}
+%PrepareFunctionForOptimization(TestSetPrototypeModified);
+TestSetPrototypeModified(Set);
+TestSetPrototypeModified(Set);
+TestSetPrototypeModified(Set);
+%OptimizeFunctionOnNextCall(TestSetPrototypeModified);
+TestSetPrototypeModified(Set);
+assertOptimized(TestSetPrototypeModified);
+%DeoptimizeFunction(TestSetPrototypeModified);
+
+%PrepareFunctionForOptimization(TestSetPrototypeModified);
+TestSetPrototypeModified(WeakSet);
+TestSetPrototypeModified(WeakSet);
+TestSetPrototypeModified(WeakSet);
+%OptimizeFunctionOnNextCall(TestSetPrototypeModified);
+TestSetPrototypeModified(WeakSet);
+assertOptimized(TestSetPrototypeModified);
+%DeoptimizeFunction(TestSetPrototypeModified);
+
+function TestMapPrototypeModified(ctor) {
+  const originalPrototypeSet = ctor.prototype.set;
+  const k1 = {};
+  const k2 = {};
+  const entries = [[k1, 1], [k2, 2]];
+  let setCount = 0;
+
+  ctor.prototype.set = function(key, value) {
+    setCount++;
+    originalPrototypeSet.call(this, key, value);
+    entries.length = 1;
+  };
+  const map = new ctor(entries);
+
+  assertEquals(1, setCount);
+  assertTrue(map.has(k1));
+  assertFalse(map.has(k2));
+
+  ctor.prototype.set = originalPrototypeSet;
+}
+%PrepareFunctionForOptimization(TestMapPrototypeModified);
+TestMapPrototypeModified(Map);
+TestMapPrototypeModified(Map);
+TestMapPrototypeModified(Map);
+%OptimizeFunctionOnNextCall(TestMapPrototypeModified);
+TestMapPrototypeModified(Map);
+assertOptimized(TestMapPrototypeModified);
+%DeoptimizeFunction(TestMapPrototypeModified);
+
+%PrepareFunctionForOptimization(TestMapPrototypeModified);
+TestMapPrototypeModified(WeakMap);
+TestMapPrototypeModified(WeakMap);
+TestMapPrototypeModified(WeakMap);
+%OptimizeFunctionOnNextCall(TestMapPrototypeModified);
+TestMapPrototypeModified(WeakMap);
+assertOptimized(TestMapPrototypeModified);
diff --git a/src/v8/test/mjsunit/es6/collections.js b/src/v8/test/mjsunit/es6/collections.js
index 1664a93..feae629 100644
--- a/src/v8/test/mjsunit/es6/collections.js
+++ b/src/v8/test/mjsunit/es6/collections.js
@@ -307,17 +307,6 @@
 assertTrue(WeakSet.prototype.delete instanceof Function)
 
 
-// Test class of instance and prototype.
-assertEquals("Set", %_ClassOf(new Set))
-assertEquals("Object", %_ClassOf(Set.prototype))
-assertEquals("Map", %_ClassOf(new Map))
-assertEquals("Object", %_ClassOf(Map.prototype))
-assertEquals("WeakMap", %_ClassOf(new WeakMap))
-assertEquals("Object", %_ClassOf(WeakMap.prototype))
-assertEquals("WeakSet", %_ClassOf(new WeakSet))
-assertEquals("Object", %_ClassOf(WeakMap.prototype))
-
-
 // Test name of constructor.
 assertEquals("Set", Set.name);
 assertEquals("Map", Map.name);
diff --git a/src/v8/test/mjsunit/es6/computed-property-names-classes.js b/src/v8/test/mjsunit/es6/computed-property-names-classes.js
index da8e1d8..b3a62ed 100644
--- a/src/v8/test/mjsunit/es6/computed-property-names-classes.js
+++ b/src/v8/test/mjsunit/es6/computed-property-names-classes.js
@@ -213,6 +213,56 @@
 })();
 
 
+(function TestLength() {
+  class C {
+    static ['length']() {
+      return 42;
+    }
+  }
+  assertEquals(42, C.length());
+
+  class C1 {
+    static get ['length']() {
+      return 'A';
+    }
+  }
+  assertEquals('A', C1.length);
+
+  class C2 {
+    static get length() {
+      assertUnreachable();
+    }
+    static get ['length']() {
+      return 'B';
+    }
+  }
+  assertEquals('B', C2.length);
+
+  class C3 {
+    static get length() {
+      assertUnreachable();
+    }
+    static get ['length']() {
+      assertUnreachable();
+    }
+    static get ['length']() {
+      return 'C';
+    }
+  }
+  assertEquals('C', C3.length);
+
+  class C4 {
+    static get ['length']() {
+      assertUnreachable();
+    }
+    static get length() {
+      return 'D';
+    }
+  }
+  assertEquals('D', C4.length);
+})();
+
+
 (function TestGetter() {
   class C {
     get ['a']() {
diff --git a/src/v8/test/mjsunit/es6/computed-property-names-deopt.js b/src/v8/test/mjsunit/es6/computed-property-names-deopt.js
index 2f3a597..5d0e257 100644
--- a/src/v8/test/mjsunit/es6/computed-property-names-deopt.js
+++ b/src/v8/test/mjsunit/es6/computed-property-names-deopt.js
@@ -23,6 +23,7 @@
     return { [name]: value, __proto__: deoptMe() };
   }
 
+  %PrepareFunctionForOptimization(f);
   checkObject("a", 1, f("a", 1));
   checkObject("b", 2, f("b", 2));
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/es6/dataview-length.js b/src/v8/test/mjsunit/es6/dataview-length.js
new file mode 100644
index 0000000..9254039
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/dataview-length.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+
+assertEquals(DataView.length, 1);
diff --git a/src/v8/test/mjsunit/es6/destructuring-assignment.js b/src/v8/test/mjsunit/es6/destructuring-assignment.js
index dee7a0b..7f61e02 100644
--- a/src/v8/test/mjsunit/es6/destructuring-assignment.js
+++ b/src/v8/test/mjsunit/es6/destructuring-assignment.js
@@ -574,3 +574,58 @@
   assertEquals(1, ext("let x; ({x} = { x: super() })").x);
   assertEquals(1, ext("let x, y; ({ x: y } = { x } = { x: super() })").x);
 })();
+
+(function testInvalidReturn() {
+  function* g() { yield 1; }
+
+  let executed_x_setter;
+  let executed_return;
+  var a = {
+    set x(val) {
+      executed_x_setter = true;
+      throw 3;
+    }
+  };
+
+  // The exception from the execution of g().return() should be suppressed by
+  // the setter error.
+  executed_x_setter = false;
+  executed_return = false;
+  g.prototype.return = function() {
+    executed_return = true;
+    throw 4;
+  };
+  assertThrowsEquals("[a.x] = g()", 3);
+  assertTrue(executed_x_setter);
+  assertTrue(executed_return);
+
+  // The exception from g().return() not returning an object should be
+  // suppressed by the setter error.
+  executed_x_setter = false;
+  executed_return = false;
+  g.prototype.return = function() {
+    assertTrue(executed_return);
+    return null;
+  };
+  assertThrowsEquals("[a.x] = g()", 3);
+  assertTrue(executed_x_setter);
+  assertTrue(executed_return);
+
+  // The TypeError from g().return not being a method should suppress the setter
+  // error.
+  executed_x_setter = false;
+  g.prototype.return = "not a method";
+  assertThrows("[a.x] = g()", TypeError);
+  assertTrue(executed_x_setter);
+
+  // The exception from the access of g().return should suppress the setter
+  // error.
+  executed_x_setter = false;
+  Object.setPrototypeOf(g.prototype, {
+    get return() {
+      throw 4;
+    }
+  });
+  assertThrowsEquals("[a.x] = g()", 4);
+  assertTrue(executed_x_setter);
+})
diff --git a/src/v8/test/mjsunit/es6/destructuring-parameters-literalcount-nolazy.js b/src/v8/test/mjsunit/es6/destructuring-parameters-literalcount-nolazy.js
index 0317509..1ee6c8c 100644
--- a/src/v8/test/mjsunit/es6/destructuring-parameters-literalcount-nolazy.js
+++ b/src/v8/test/mjsunit/es6/destructuring-parameters-literalcount-nolazy.js
@@ -20,6 +20,7 @@
   assertSame(0, n.length);
   assertTrue(p.test("abc"));
 }
+%PrepareFunctionForOptimization(g);
 g({},{});
 %OptimizeFunctionOnNextCall(g);
 g({},{});
@@ -35,6 +36,7 @@
     assertSame(0, n.length);
     assertTrue(p.test("abc"));
   };
+%PrepareFunctionForOptimization(h);
 h({},{});
 %OptimizeFunctionOnNextCall(h);
 h({},{});
diff --git a/src/v8/test/mjsunit/es6/destructuring-parameters-literalcount.js b/src/v8/test/mjsunit/es6/destructuring-parameters-literalcount.js
index 77a3226..f399f90 100644
--- a/src/v8/test/mjsunit/es6/destructuring-parameters-literalcount.js
+++ b/src/v8/test/mjsunit/es6/destructuring-parameters-literalcount.js
@@ -20,6 +20,7 @@
   assertSame(0, n.length);
   assertTrue(p.test("abc"));
 }
+%PrepareFunctionForOptimization(g);
 g({},{});
 %OptimizeFunctionOnNextCall(g);
 g({},{});
@@ -35,6 +36,7 @@
     assertSame(0, n.length);
     assertTrue(p.test("abc"));
   };
+%PrepareFunctionForOptimization(h);
 h({},{});
 %OptimizeFunctionOnNextCall(h);
 h({},{});
diff --git a/src/v8/test/mjsunit/es6/destructuring.js b/src/v8/test/mjsunit/es6/destructuring.js
index f09165a..30df8c6 100644
--- a/src/v8/test/mjsunit/es6/destructuring.js
+++ b/src/v8/test/mjsunit/es6/destructuring.js
@@ -1190,3 +1190,13 @@
   assertEquals(undefined, eval('try {throw {foo: 1, bar: 2}} catch({foo}) {}'));
   assertEquals(undefined, eval('try {throw [1, 2, 3]} catch([x]) {}'));
 })();
+
+// Property access as declaration target.
+assertThrows("let [o.x=1]=[]", SyntaxError);
+assertThrows("let {x:o.f=1}={x:1}", SyntaxError);
+assertThrows("(o.f=1)=>0", SyntaxError);
+
+// Invalidly parenthesized declaration targets.
+assertThrows("for (({x}) of [{x:1}]) {}", SyntaxError);
+assertThrows("for (var ({x}) of [{x:1}]) {}", SyntaxError);
+assertThrows("for await (({x}) of [{x:1}]) {}", SyntaxError);
diff --git a/src/v8/test/mjsunit/es6/for-each-in-catch.js b/src/v8/test/mjsunit/es6/for-each-in-catch.js
index 674cddd..b38013e 100644
--- a/src/v8/test/mjsunit/es6/for-each-in-catch.js
+++ b/src/v8/test/mjsunit/es6/for-each-in-catch.js
@@ -5,25 +5,25 @@
 function checkIsRedeclarationError(code) {
   try {
     eval(`
-checkIsRedeclarationError : {
-  break checkIsRedeclarationError;
-${code}
-}
-`);
+      checkIsRedeclarationError: {
+        break checkIsRedeclarationError;
+        ${code}
+      }
+    `);
     assertUnreachable();
-  } catch(e) {
-    assertInstanceof(e, SyntaxError );
-    assertTrue( e.toString().indexOf("has already been declared") >= 0 );
+  } catch (e) {
+    assertInstanceof(e, SyntaxError);
+    assertTrue(e.toString().includes("has already been declared"));
   }
 }
 
 function checkIsNotRedeclarationError(code) {
-  assertDoesNotThrow(()=>eval(`
-checkIsNotRedeclarationError_label : {
-  break checkIsNotRedeclarationError_label;
-${code}
-}
-`));
+  assertDoesNotThrow(() => eval(`
+    checkIsNotRedeclarationError_label: {
+      break checkIsNotRedeclarationError_label;
+      ${code}
+    }
+  `));
 }
 
 
@@ -52,143 +52,145 @@
   'const {f:e}'
 ];
 
-// Check that `for (var ... of ...)` cannot redeclare a simple catch variable
-// but `for (var ... in ...)` can.
+// Check that both `for (var ... of ...)` and `for (var ... in ...)`
+// can redeclare a simple catch variable.
 for (let binding of var_e) {
-  checkIsRedeclarationError(`
-try {
-  throw 0;
-} catch(e) {
-  for (${binding} of []);
-}
-`);
-
   checkIsNotRedeclarationError(`
-try {
-  throw 0;
-} catch(e) {
-  for (${binding} in []);
-}
-`);
-}
-
-// Check that the above error occurs even for nested catches.
-for (let binding of var_e) {
-  checkIsRedeclarationError(`
-try {
-  throw 0;
-} catch(e) {
-  try {
-    throw 1;
-  } catch(f) {
     try {
-      throw 2;
-    } catch({}) {
+      throw 0;
+    } catch (e) {
       for (${binding} of []);
     }
-  }
-}
-`);
+  `);
 
   checkIsNotRedeclarationError(`
-try {
-  throw 0;
-} catch(e) {
-  try {
-    throw 1;
-  } catch(f) {
     try {
-      throw 2;
-    } catch({}) {
+      throw 0;
+    } catch (e) {
       for (${binding} in []);
     }
-  }
-}
-`);
+  `);
 }
 
-// Check that the above error does not occur if a declaration scope is between
-// the catch and the loop.
+// Check that the above applies even for nested catches.
 for (let binding of var_e) {
   checkIsNotRedeclarationError(`
-try {
-  throw 0;
-} catch(e) {
-  (()=>{for (${binding} of []);})();
-}
-`);
+    try {
+      throw 0;
+    } catch (e) {
+      try {
+        throw 1;
+      } catch (f) {
+        try {
+          throw 2;
+        } catch ({}) {
+          for (${binding} of []);
+        }
+      }
+    }
+  `);
 
   checkIsNotRedeclarationError(`
-try {
-  throw 0;
-} catch(e) {
-  (function(){for (${binding} of []);})();
+    try {
+      throw 0;
+    } catch (e) {
+      try {
+        throw 1;
+      } catch (f) {
+        try {
+          throw 2;
+        } catch ({}) {
+          for (${binding} in []);
+        }
+      }
+    }
+  `);
 }
-`);
+
+// Check that the above applies if a declaration scope is between the
+// catch and the loop.
+for (let binding of var_e) {
+  checkIsNotRedeclarationError(`
+    try {
+      throw 0;
+    } catch (e) {
+      (()=>{for (${binding} of []);})();
+    }
+  `);
+
+  checkIsNotRedeclarationError(`
+    try {
+      throw 0;
+    } catch (e) {
+      (function() {
+        for (${binding} of []);
+      })();
+    }
+  `);
 }
 
 // Check that there is no error when not declaring a var named e.
 for (let binding of not_var_e) {
   checkIsNotRedeclarationError(`
-try {
-  throw 0;
-} catch(e) {
-  for (${binding} of []);
-}
-`);
+    try {
+      throw 0;
+    } catch (e) {
+      for (${binding} of []);
+    }
+  `);
 }
 
 // Check that there is an error for both for-in and for-of when redeclaring
-// a non-simple catch parameter
+// a non-simple catch parameter.
 for (let binding of var_e) {
   checkIsRedeclarationError(`
-try {
-  throw 0;
-} catch({e}) {
-  for (${binding} of []);
-}
-`);
+    try {
+      throw 0;
+    } catch ({e}) {
+      for (${binding} of []);
+    }
+  `);
 
   checkIsRedeclarationError(`
-try {
-  throw 0;
-} catch({e}) {
-  for (${binding} in []);
-}
-`);
+    try {
+      throw 0;
+    } catch ({e}) {
+      for (${binding} in []);
+    }
+  `);
 }
 
 // Check that the above error occurs even for nested catches.
 for (let binding of var_e) {
   checkIsRedeclarationError(`
-try {
-  throw 0;
-} catch({e}) {
-  try {
-    throw 1;
-  } catch(f) {
     try {
-      throw 2;
-    } catch({}) {
-      for (${binding} of []);
+      throw 0;
+    } catch ({e}) {
+      try {
+        throw 1;
+      } catch (f) {
+        try {
+          throw 2;
+        } catch ({}) {
+          for (${binding} of []);
+        }
+      }
     }
-  }
-}
-`);
+  `);
 
   checkIsRedeclarationError(`
-try {
-  throw 0;
-} catch({e}) {
-  try {
-    throw 1;
-  } catch(f) {
     try {
-      throw 2;
-    } catch({}) {
-      for (${binding} in []);
+      throw 0;
+    } catch ({e}) {
+      try {
+        throw 1;
+      } catch (f) {
+        try {
+          throw 2;
+        } catch ({}) {
+          for (${binding} in []);
+        }
+      }
     }
-  }
-}
-`);
+  `);
 }
diff --git a/src/v8/test/mjsunit/es6/generators-objects.js b/src/v8/test/mjsunit/es6/generators-objects.js
index 2cc359f..ff216d4 100644
--- a/src/v8/test/mjsunit/es6/generators-objects.js
+++ b/src/v8/test/mjsunit/es6/generators-objects.js
@@ -55,7 +55,6 @@
   var iter = g();
   assertSame(g.prototype, Object.getPrototypeOf(iter));
   assertTrue(iter instanceof g);
-  assertEquals("Generator", %_ClassOf(iter));
   assertEquals("[object Generator]", String(iter));
   assertEquals([], Object.getOwnPropertyNames(iter));
   assertTrue(iter !== g());
diff --git a/src/v8/test/mjsunit/es6/indexed-integer-exotics.js b/src/v8/test/mjsunit/es6/indexed-integer-exotics.js
index 85ae369..7c2ba9e 100644
--- a/src/v8/test/mjsunit/es6/indexed-integer-exotics.js
+++ b/src/v8/test/mjsunit/es6/indexed-integer-exotics.js
@@ -49,6 +49,7 @@
 
 function f() { return array["-1"]; }
 
+%PrepareFunctionForOptimization(f);
 for (var i = 0; i < 3; i++) {
   assertEquals(undefined, f());
 }
diff --git a/src/v8/test/mjsunit/es6/instanceof-proxies.js b/src/v8/test/mjsunit/es6/instanceof-proxies.js
index 86b104c..3294ccb 100644
--- a/src/v8/test/mjsunit/es6/instanceof-proxies.js
+++ b/src/v8/test/mjsunit/es6/instanceof-proxies.js
@@ -11,6 +11,7 @@
   function foo(x) {
     return x instanceof Array;
   }
+  %PrepareFunctionForOptimization(foo);
   assertTrue(foo([]));
   assertFalse(foo({}));
   %OptimizeFunctionOnNextCall(foo);
@@ -42,6 +43,7 @@
     }
     return false;
   }
+  %PrepareFunctionForOptimization(foo_catch);
   assertTrue(foo_catch(o));
   %OptimizeFunctionOnNextCall(foo_catch);
   assertTrue(foo_catch(o));
diff --git a/src/v8/test/mjsunit/es6/iterator-close.js b/src/v8/test/mjsunit/es6/iterator-close.js
index fd8f361..1eb9124 100644
--- a/src/v8/test/mjsunit/es6/iterator-close.js
+++ b/src/v8/test/mjsunit/es6/iterator-close.js
@@ -115,21 +115,21 @@
   }, TypeError);
 
 
-  assertThrows(() => {
+  assertThrowsEquals(() => {
     for (var x of g()) { throw 666; }
-  }, TypeError);
+  }, 666);
 
-  assertThrows(() => {
+  assertThrowsEquals(() => {
     for (let x of g()) { throw 666; }
-  }, TypeError);
+  }, 666);
 
-  assertThrows(() => {
+  assertThrowsEquals(() => {
     for (const x of g()) { throw 666; }
-  }, TypeError);
+  }, 666);
 
-  assertThrows(() => {
+  assertThrowsEquals(() => {
     for (x of g()) { throw 666; }
-  }, TypeError);
+  }, 666);
 
 
   assertThrows(() => {
diff --git a/src/v8/test/mjsunit/es6/large-classes-methods.js b/src/v8/test/mjsunit/es6/large-classes-methods.js
new file mode 100644
index 0000000..6f1e34a
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/large-classes-methods.js
@@ -0,0 +1,38 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function testLargeClassesMethods() {
+  // This is to test for dictionary mode when there more than
+  // kMaxNumberOfDescriptors (1024) properties.
+  const kLimit = 1030;
+  let evalString = "(function(i) { " +
+      "let clazz = class { " +
+      "   constructor(i) { this.value = i; } ";
+  for (let i = 0; i < kLimit; i++) {
+    evalString  += "property"+i+"() { return "+i+"; }; "
+  }
+  evalString += "};" +
+      " return new clazz(i); })";
+
+  let fn = eval(evalString);
+  %PrepareFunctionForOptimization(fn);
+  assertEquals(fn(1).value, 1);
+  assertEquals(fn(2).value, 2);
+  assertEquals(fn(3).value, 3);
+  %OptimizeFunctionOnNextCall(fn);
+  assertEquals(fn(4).value, 4);
+
+  let instance = fn(1);
+  assertEquals(Object.getOwnPropertyNames(instance).length, 1);
+  assertEquals(Object.getOwnPropertyNames(instance.__proto__).length,
+      kLimit + 1);
+
+  // Call all instance functions.
+  for (let i = 0; i < kLimit; i++) {
+    const key = "property" + i;
+    assertEquals(instance[key](), i);
+  }
+})();
diff --git a/src/v8/test/mjsunit/es6/large-classes-properties.js b/src/v8/test/mjsunit/es6/large-classes-properties.js
new file mode 100644
index 0000000..a670b0a
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/large-classes-properties.js
@@ -0,0 +1,39 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function testLargeClassesProperties(){
+  // This is to test for dictionary mode when there more than
+  // kMaxNumberOfDescriptors (1024) properties.
+  const kLimit = 1030;
+  let evalString = "(function(i) { " +
+      "let clazz = class { " +
+      "   constructor(i) { this.value = i;";
+  for (let i = 0; i < kLimit ; i++) {
+    evalString  += "this.property"+i +" = "+i+"; "
+  }
+  evalString += "}};" +
+      " return (new clazz(i)); })";
+
+  let fn = eval(evalString);
+  %PrepareFunctionForOptimization(fn);
+  assertEquals(fn(1).value, 1);
+  assertEquals(fn(2).value, 2);
+  assertEquals(fn(3).value, 3);
+  %OptimizeFunctionOnNextCall(fn);
+  assertEquals(fn(4).value, 4);
+
+  let instance = fn(1);
+  assertEquals(Object.getOwnPropertyNames(instance).length, kLimit+1);
+
+  // Get and set all properties.
+  for (let i = 0; i < kLimit; i++) {
+    const key = "property" + i;
+    assertEquals(instance[key], i);
+    const value = "value"+i;
+    instance[key] = value;
+    assertEquals(instance[key], value);
+  }
+})();
diff --git a/src/v8/test/mjsunit/es6/large-classes-static-methods.js b/src/v8/test/mjsunit/es6/large-classes-static-methods.js
new file mode 100644
index 0000000..c812aa5
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/large-classes-static-methods.js
@@ -0,0 +1,44 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function testLargeClassesStaticMethods() {
+  // This is to test for dictionary mode when there more than
+  // kMaxNumberOfDescriptors (1024) properties.
+  const kLimit = 1030;
+  let evalString = "(function(i) { " +
+      "let clazz = class { " +
+      "   constructor(i) { this.value = i; } ";
+  for (let i = 0; i < kLimit; i++) {
+    evalString  += "static property"+i+"() { return "+i+" }; "
+  }
+  evalString += "};" +
+      " return new clazz(i); })";
+
+  let fn = eval(evalString);
+
+  %PrepareFunctionForOptimization(fn);
+  assertEquals(fn(1).value, 1);
+  assertEquals(fn(2).value, 2);
+  assertEquals(fn(3).value, 3);
+  %OptimizeFunctionOnNextCall(fn);
+  assertEquals(fn(4).value, 4);
+
+  let instance = fn(1);
+  assertEquals(Object.getOwnPropertyNames(instance).length, 1);
+  assertEquals(instance.value, 1);
+  instance.value = 10;
+  assertEquals(instance.value, 10);
+
+  // kLimit + nof default properties (length, prototype, name).
+  assertEquals(Object.getOwnPropertyNames(instance.constructor).length,
+      kLimit + 3);
+
+  // Call all static properties.
+  for (let i = 0; i < kLimit; i++) {
+    const key = "property" + i;
+    assertEquals(instance.constructor[key](), i);
+  }
+})();
diff --git a/src/v8/test/mjsunit/es6/map-constructor-entry-side-effect.js b/src/v8/test/mjsunit/es6/map-constructor-entry-side-effect.js
new file mode 100644
index 0000000..b8a6ec0
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/map-constructor-entry-side-effect.js
@@ -0,0 +1,50 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function TestMapConstructorEntrySideEffect(ctor) {
+  const k1 = {};
+  const k2 = {};
+  const k3 = {};
+  let callCount = 0;
+  const input = [
+    Object.defineProperty([, 1], "0", {
+      get() {
+        input.length = 2;
+        return k1;
+      }
+    }),
+    [k2, 2],
+    Object.defineProperty([, 3], "0", {
+      get() {
+        callCount++;
+        return k3;
+      }
+    })
+  ];
+  const col = new ctor(input);
+
+  assertEquals(0, callCount);
+  if ('size' in col) assertEquals(2, col.size);
+  assertEquals(col.get(k1), 1);
+  assertEquals(col.get(k2), 2);
+  assertFalse(col.has(k3));
+}
+
+%PrepareFunctionForOptimization(TestMapConstructorEntrySideEffect);
+TestMapConstructorEntrySideEffect(Map);
+TestMapConstructorEntrySideEffect(Map);
+TestMapConstructorEntrySideEffect(Map);
+%OptimizeFunctionOnNextCall(TestMapConstructorEntrySideEffect);
+TestMapConstructorEntrySideEffect(Map);
+assertOptimized(TestMapConstructorEntrySideEffect);
+
+TestMapConstructorEntrySideEffect(WeakMap);
+%PrepareFunctionForOptimization(TestMapConstructorEntrySideEffect);
+TestMapConstructorEntrySideEffect(WeakMap);
+TestMapConstructorEntrySideEffect(WeakMap);
+%OptimizeFunctionOnNextCall(TestMapConstructorEntrySideEffect);
+TestMapConstructorEntrySideEffect(WeakMap);
+assertOptimized(TestMapConstructorEntrySideEffect);
diff --git a/src/v8/test/mjsunit/es6/map-constructor-entry-side-effect2.js b/src/v8/test/mjsunit/es6/map-constructor-entry-side-effect2.js
new file mode 100644
index 0000000..de92b8d
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/map-constructor-entry-side-effect2.js
@@ -0,0 +1,56 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function TestMapConstructorEntrySideEffect(ctor) {
+  const originalPrototypeSet = ctor.prototype.set;
+  const k1 = {};
+  const k2 = {};
+  let callCount = 0;
+  const input = [
+    Object.defineProperty([, 1], "0", {
+      get() {
+        // Verify continuation retains original set function
+        ctor.prototype.set = () => {
+          callCount++;
+        };
+        return k1;
+      }
+    }),
+    [k2, 2]
+  ];
+  const col = new ctor(input);
+
+  assertEquals(0, callCount);
+  if ('size' in col) assertEquals(2, col.size);
+  assertTrue(col.has(k1));
+  assertTrue(col.has(k2));
+
+  const col2 = new ctor(input);
+
+  assertEquals(2, callCount);
+  if ('size' in col) assertEquals(0, col2.size);
+  assertFalse(col2.has(k1));
+  assertFalse(col2.has(k2));
+
+  ctor.prototype.set = originalPrototypeSet;
+}
+
+%PrepareFunctionForOptimization(TestMapConstructorEntrySideEffect);
+TestMapConstructorEntrySideEffect(Map);
+TestMapConstructorEntrySideEffect(Map);
+TestMapConstructorEntrySideEffect(Map);
+%OptimizeFunctionOnNextCall(TestMapConstructorEntrySideEffect);
+TestMapConstructorEntrySideEffect(Map);
+assertOptimized(TestMapConstructorEntrySideEffect);
+
+// This call would deopt
+TestMapConstructorEntrySideEffect(WeakMap);
+%PrepareFunctionForOptimization(TestMapConstructorEntrySideEffect);
+TestMapConstructorEntrySideEffect(WeakMap);
+TestMapConstructorEntrySideEffect(WeakMap);
+%OptimizeFunctionOnNextCall(TestMapConstructorEntrySideEffect);
+TestMapConstructorEntrySideEffect(WeakMap);
+assertOptimized(TestMapConstructorEntrySideEffect);
diff --git a/src/v8/test/mjsunit/es6/map-constructor-entry-side-effect3.js b/src/v8/test/mjsunit/es6/map-constructor-entry-side-effect3.js
new file mode 100644
index 0000000..c56a552
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/map-constructor-entry-side-effect3.js
@@ -0,0 +1,45 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function TestMapConstructorEntrySideEffect(ctor) {
+  const k1 = {};
+  const k2 = {};
+  const k3 = {};
+  const input = [
+    Object.defineProperty([, 1], "0", {
+      get() {
+        // Verify continuation accesses properly accesses subsequent entries
+        Object.defineProperty(input, "1", {
+          get: () => [k3, 3]
+        });
+        return k1;
+      }
+    }),
+    [k2, 2]
+  ];
+  const col = new ctor(input);
+
+  if ('size' in col) assertEquals(2, col.size);
+  assertTrue(col.has(k1));
+  assertFalse(col.has(k2));
+  assertTrue(col.has(k3));
+}
+
+%PrepareFunctionForOptimization(TestMapConstructorEntrySideEffect);
+TestMapConstructorEntrySideEffect(Map);
+TestMapConstructorEntrySideEffect(Map);
+TestMapConstructorEntrySideEffect(Map);
+%OptimizeFunctionOnNextCall(TestMapConstructorEntrySideEffect);
+TestMapConstructorEntrySideEffect(Map);
+assertOptimized(TestMapConstructorEntrySideEffect);
+
+TestMapConstructorEntrySideEffect(WeakMap);
+%PrepareFunctionForOptimization(TestMapConstructorEntrySideEffect);
+TestMapConstructorEntrySideEffect(WeakMap);
+TestMapConstructorEntrySideEffect(WeakMap);
+%OptimizeFunctionOnNextCall(TestMapConstructorEntrySideEffect);
+TestMapConstructorEntrySideEffect(WeakMap);
+assertOptimized(TestMapConstructorEntrySideEffect);
diff --git a/src/v8/test/mjsunit/es6/map-constructor-entry-side-effect4.js b/src/v8/test/mjsunit/es6/map-constructor-entry-side-effect4.js
new file mode 100644
index 0000000..3ed5e79
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/map-constructor-entry-side-effect4.js
@@ -0,0 +1,56 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function TestMapConstructorEntrySideEffect(ctor) {
+  const k1 = {};
+  const k2 = {};
+  const k3 = {};
+  let firstEntryCallCount = 0;
+  let lastEntryCallCount = 0;
+  const input = [
+    Object.defineProperty([, 1], "0", {
+      get() {
+        // Verify handling of a non-Smi array length
+        input.length = 2 ** 32 - 2;
+        firstEntryCallCount++;
+        return k1;
+      }
+    }),
+    [k2, 2],
+    Object.defineProperty([k3, ], "1", {
+      get() {
+        input.length = 1;
+        lastEntryCallCount++;
+        return 3;
+      }
+    })
+  ];
+  const col = new ctor(input);
+
+  assertEquals(1, firstEntryCallCount,);
+  assertEquals(1, lastEntryCallCount);
+  if ('size' in col) assertEquals(3, col.size);
+  assertEquals(1, col.get(k1));
+  assertEquals(2, col.get(k2));
+  assertEquals(3, col.get(k3));
+}
+
+%PrepareFunctionForOptimization(TestMapConstructorEntrySideEffect);
+TestMapConstructorEntrySideEffect(Map);
+TestMapConstructorEntrySideEffect(Map);
+TestMapConstructorEntrySideEffect(Map);
+%OptimizeFunctionOnNextCall(TestMapConstructorEntrySideEffect);
+TestMapConstructorEntrySideEffect(Map);
+assertOptimized(TestMapConstructorEntrySideEffect);
+
+// This call would deopt
+TestMapConstructorEntrySideEffect(WeakMap);
+%PrepareFunctionForOptimization(TestMapConstructorEntrySideEffect);
+TestMapConstructorEntrySideEffect(WeakMap);
+TestMapConstructorEntrySideEffect(WeakMap);
+%OptimizeFunctionOnNextCall(TestMapConstructorEntrySideEffect);
+TestMapConstructorEntrySideEffect(WeakMap);
+assertOptimized(TestMapConstructorEntrySideEffect);
diff --git a/src/v8/test/mjsunit/es6/map-iterator-1.js b/src/v8/test/mjsunit/es6/map-iterator-1.js
new file mode 100644
index 0000000..50d3772
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/map-iterator-1.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+
+assertEquals([[1,2], [2,3], [3,4]], [...map]);
+assertEquals([[1,2], [2,3], [3,4]], [...map.entries()]);
+assertEquals([1,2,3], [...map.keys()]);
+assertEquals([2,3,4], [...map.values()]);
+assertTrue(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+
+map[Symbol.iterator] = () => ({next: () => ({done: true})});
+
+assertTrue(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+assertEquals([], [...map]);
+assertEquals([[1,2], [2,3], [3,4]], [...map.entries()]);
+assertEquals([1,2,3], [...map.keys()]);
+assertEquals([2,3,4], [...map.values()]);
diff --git a/src/v8/test/mjsunit/es6/map-iterator-10.js b/src/v8/test/mjsunit/es6/map-iterator-10.js
new file mode 100644
index 0000000..d8d20ee
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/map-iterator-10.js
@@ -0,0 +1,34 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// This tests the interaction between the MapIterator protector and SetIterator
+// protector.
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+
+var set = new Set([1,2,3]);
+assertTrue(%SetIteratorProtector());
+
+// This changes %IteratorPrototype%. No more tests should be run after this in
+// the same instance.
+var iterator = map.keys();
+// iterator object --> %MapIteratorPrototype% --> %IteratorPrototype%
+iterator.__proto__.__proto__[Symbol.iterator] =
+  () => ({next: () => ({done: true})});
+
+assertFalse(%MapIteratorProtector());
+assertEquals([[1,2], [2,3], [3,4]], [...map]);
+assertEquals([], [...map.entries()]);
+assertEquals([], [...map.keys()]);
+assertEquals([], [...map.values()]);
+assertEquals([], [...iterator]);
+
+assertFalse(%SetIteratorProtector());
+assertEquals([1,2,3], [...set]);
+assertEquals([], [...set.entries()]);
+assertEquals([], [...set.keys()]);
+assertEquals([], [...set.values()]);
diff --git a/src/v8/test/mjsunit/es6/map-iterator-11.js b/src/v8/test/mjsunit/es6/map-iterator-11.js
new file mode 100644
index 0000000..02eada9
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/map-iterator-11.js
@@ -0,0 +1,35 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+
+var iterator = map.keys();
+assertEquals([1,2,3], [...map.keys()]);
+assertEquals([1,2,3], [...iterator]);
+assertEquals([], [...iterator]);
+
+iterator = map.values();
+assertEquals([2,3,4], [...iterator]);
+assertEquals([], [...iterator]);
+
+iterator = map.keys();
+iterator.next();
+assertEquals([2,3], [...iterator]);
+assertEquals([], [...iterator]);
+
+iterator = map.values();
+var iterator2 = map.values();
+
+map.delete(1);
+assertEquals([3,4], [...iterator]);
+assertEquals([], [...iterator]);
+
+map.set(1,5);
+assertEquals([3,4,5], [...iterator2]);
+assertEquals([], [...iterator2]);
+
+iterator = map.keys();
+map.set(4,6);
+assertEquals([2,3,1,4], [...iterator]);
+assertEquals([], [...iterator]);
diff --git a/src/v8/test/mjsunit/es6/map-iterator-2.js b/src/v8/test/mjsunit/es6/map-iterator-2.js
new file mode 100644
index 0000000..7adf058
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/map-iterator-2.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+
+// This changes %MapPrototype%. No more tests should be run after this in the
+// same instance.
+map.__proto__[Symbol.iterator] = () => ({next: () => ({done: true})});
+
+assertTrue(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+assertEquals([], [...map]);
+assertEquals([[1,2], [2,3], [3,4]], [...map.entries()]);
+assertEquals([1,2,3], [...map.keys()]);
+assertEquals([2,3,4], [...map.values()]);
diff --git a/src/v8/test/mjsunit/es6/map-iterator-3.js b/src/v8/test/mjsunit/es6/map-iterator-3.js
new file mode 100644
index 0000000..ca0dc9c
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/map-iterator-3.js
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+
+// This changes %MapIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = map[Symbol.iterator]();
+iterator.__proto__.next = () => ({done: true});
+
+assertFalse(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+assertEquals([], [...map]);
+assertEquals([], [...map.entries()]);
+assertEquals([], [...map.keys()]);
+assertEquals([], [...map.values()]);
+assertEquals([], [...iterator]);
diff --git a/src/v8/test/mjsunit/es6/map-iterator-4.js b/src/v8/test/mjsunit/es6/map-iterator-4.js
new file mode 100644
index 0000000..a43282a
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/map-iterator-4.js
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+
+// This changes %MapIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = map.keys();
+iterator.__proto__.next = () => ({done: true});
+
+assertFalse(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+assertEquals([], [...map]);
+assertEquals([], [...map.entries()]);
+assertEquals([], [...map.keys()]);
+assertEquals([], [...map.values()]);
+assertEquals([], [...iterator]);
diff --git a/src/v8/test/mjsunit/es6/map-iterator-5.js b/src/v8/test/mjsunit/es6/map-iterator-5.js
new file mode 100644
index 0000000..0af32b5
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/map-iterator-5.js
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+
+// This changes %MapIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = map.values();
+iterator.__proto__.next = () => ({done: true});
+
+assertFalse(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+assertEquals([], [...map]);
+assertEquals([], [...map.entries()]);
+assertEquals([], [...map.keys()]);
+assertEquals([], [...map.values()]);
+assertEquals([], [...iterator]);
diff --git a/src/v8/test/mjsunit/es6/map-iterator-6.js b/src/v8/test/mjsunit/es6/map-iterator-6.js
new file mode 100644
index 0000000..6611e7a
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/map-iterator-6.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+
+var iterator = map.values();
+iterator.next = () => ({done: true});
+
+assertFalse(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+assertEquals([[1,2], [2,3], [3,4]], [...map]);
+assertEquals([[1,2], [2,3], [3,4]], [...map.entries()]);
+assertEquals([1,2,3], [...map.keys()]);
+assertEquals([2,3,4], [...map.values()]);
+assertEquals([], [...iterator]);
diff --git a/src/v8/test/mjsunit/es6/map-iterator-7.js b/src/v8/test/mjsunit/es6/map-iterator-7.js
new file mode 100644
index 0000000..b5a2345
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/map-iterator-7.js
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+
+// This changes %MapIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = map.entries();
+iterator.__proto__.next = () => ({done: true});
+
+assertFalse(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+assertEquals([], [...map]);
+assertEquals([], [...map.entries()]);
+assertEquals([], [...map.keys()]);
+assertEquals([], [...map.values()]);
+assertEquals([], [...iterator]);
diff --git a/src/v8/test/mjsunit/es6/map-iterator-8.js b/src/v8/test/mjsunit/es6/map-iterator-8.js
new file mode 100644
index 0000000..caa2d51
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/map-iterator-8.js
@@ -0,0 +1,32 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// This tests the interaction between the MapIterator protector and SetIterator
+// protector.
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+
+var set = new Set([1,2,3]);
+assertTrue(%SetIteratorProtector());
+
+// This changes %MapIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = map.keys();
+iterator.__proto__[Symbol.iterator] = () => ({next: () => ({done: true})});
+
+assertFalse(%MapIteratorProtector());
+assertEquals([[1,2], [2,3], [3,4]], [...map]);
+assertEquals([], [...map.entries()]);
+assertEquals([], [...map.keys()]);
+assertEquals([], [...map.values()]);
+assertEquals([], [...iterator]);
+
+assertTrue(%SetIteratorProtector());
+assertEquals([1,2,3], [...set]);
+assertEquals([[1,1],[2,2],[3,3]], [...set.entries()]);
+assertEquals([1,2,3], [...set.keys()]);
+assertEquals([1,2,3], [...set.values()]);
diff --git a/src/v8/test/mjsunit/es6/map-iterator-9.js b/src/v8/test/mjsunit/es6/map-iterator-9.js
new file mode 100644
index 0000000..8670ba9
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/map-iterator-9.js
@@ -0,0 +1,30 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// This tests the interaction between the MapIterator protector and SetIterator
+// protector.
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+
+var set = new Set([1,2,3]);
+assertTrue(%SetIteratorProtector());
+
+var iterator = map.keys();
+iterator[Symbol.iterator] = () => ({next: () => ({done: true})});
+
+assertFalse(%MapIteratorProtector());
+assertEquals([[1,2], [2,3], [3,4]], [...map]);
+assertEquals([[1,2], [2,3], [3,4]], [...map.entries()]);
+assertEquals([1,2,3], [...map.keys()]);
+assertEquals([2,3,4], [...map.values()]);
+assertEquals([], [...iterator]);
+
+assertTrue(%SetIteratorProtector());
+assertEquals([1,2,3], [...set]);
+assertEquals([[1,1],[2,2],[3,3]], [...set.entries()]);
+assertEquals([1,2,3], [...set.keys()]);
+assertEquals([1,2,3], [...set.values()]);
diff --git a/src/v8/test/mjsunit/es6/math-clz32.js b/src/v8/test/mjsunit/es6/math-clz32.js
index 3cbd4c3..9fa6c84 100644
--- a/src/v8/test/mjsunit/es6/math-clz32.js
+++ b/src/v8/test/mjsunit/es6/math-clz32.js
@@ -30,6 +30,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(f);
 f(5);
 f(5);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/es6/math-fround.js b/src/v8/test/mjsunit/es6/math-fround.js
index c53396a..0c15737 100644
--- a/src/v8/test/mjsunit/es6/math-fround.js
+++ b/src/v8/test/mjsunit/es6/math-fround.js
@@ -19,6 +19,7 @@
 function unopt(x) { return Math.fround(x); }
 function opt(y) { return Math.fround(y); }
 
+%PrepareFunctionForOptimization(opt);
 opt(0.1);
 opt(0.1);
 unopt(0.1);
diff --git a/src/v8/test/mjsunit/es6/math-log2-log10.js b/src/v8/test/mjsunit/es6/math-log2-log10.js
index ea17a79..eeacee9 100644
--- a/src/v8/test/mjsunit/es6/math-log2-log10.js
+++ b/src/v8/test/mjsunit/es6/math-log2-log10.js
@@ -44,7 +44,9 @@
 for (var i = -310; i <= 308; i += 0.5) {
   assertEquals(i, Math.log10(Math.pow(10, i)));
   // Square roots are tested below.
-  if (i != -0.5 && i != 0.5) assertEquals(i, Math.log2(Math.pow(2, i)));
+  if (i != -0.5 && i != 0.5 ) {
+    assertEqualsDelta(i, Math.log2(Math.pow(2, i)), Number.EPSILON);
+  }
 }
 
 // Test denormals.
diff --git a/src/v8/test/mjsunit/es6/math-trunc.js b/src/v8/test/mjsunit/es6/math-trunc.js
index c925b5b..b878fae 100644
--- a/src/v8/test/mjsunit/es6/math-trunc.js
+++ b/src/v8/test/mjsunit/es6/math-trunc.js
@@ -32,6 +32,7 @@
 function testTrunc(expected, input) {
   var test = new Function('n',
                           '"' + (test_id++) + '";return Math.trunc(n)');
+  %PrepareFunctionForOptimization(test);
   assertEquals(expected, test(input));
   assertEquals(expected, test(input));
   assertEquals(expected, test(input));
@@ -41,6 +42,7 @@
   var test_double_input = new Function(
       'n',
       '"' + (test_id++) + '";return Math.trunc(+n)');
+  %PrepareFunctionForOptimization(test_double_input);
   assertEquals(expected, test_double_input(input));
   assertEquals(expected, test_double_input(input));
   assertEquals(expected, test_double_input(input));
@@ -50,6 +52,7 @@
   var test_double_output = new Function(
       'n',
       '"' + (test_id++) + '";return Math.trunc(n) + -0.0');
+  %PrepareFunctionForOptimization(test_double_output);
   assertEquals(expected, test_double_output(input));
   assertEquals(expected, test_double_output(input));
   assertEquals(expected, test_double_output(input));
@@ -63,6 +66,7 @@
   function itrunc(x) {
     return 1 / Math.trunc(x);
   }
+  %PrepareFunctionForOptimization(itrunc);
   assertEquals(Infinity, itrunc(0));
   assertEquals(-Infinity, itrunc(-0));
   assertEquals(Infinity, itrunc(Math.PI / 4));
diff --git a/src/v8/test/mjsunit/es6/microtask-delivery.js b/src/v8/test/mjsunit/es6/microtask-delivery.js
index 6b239be..9603516 100644
--- a/src/v8/test/mjsunit/es6/microtask-delivery.js
+++ b/src/v8/test/mjsunit/es6/microtask-delivery.js
@@ -40,7 +40,7 @@
 }
 
 function assertOrdering(expected) {
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
   assertArrayValues(expected, ordering);
 }
 
diff --git a/src/v8/test/mjsunit/es6/new-target.js b/src/v8/test/mjsunit/es6/new-target.js
index c77c153..67ec96a 100644
--- a/src/v8/test/mjsunit/es6/new-target.js
+++ b/src/v8/test/mjsunit/es6/new-target.js
@@ -401,13 +401,13 @@
 
 
 (function TestEarlyErrors() {
-  assertThrows(function() { Function("new.target = 42"); }, ReferenceError);
-  assertThrows(function() { Function("var foo = 1; new.target = foo = 42"); }, ReferenceError);
-  assertThrows(function() { Function("var foo = 1; foo = new.target = 42"); }, ReferenceError);
-  assertThrows(function() { Function("new.target--"); }, ReferenceError);
-  assertThrows(function() { Function("--new.target"); }, ReferenceError);
-  assertThrows(function() { Function("(new.target)++"); }, ReferenceError);
-  assertThrows(function() { Function("++(new.target)"); }, ReferenceError);
+  assertThrows(function() { Function("new.target = 42"); }, SyntaxError);
+  assertThrows(function() { Function("var foo = 1; new.target = foo = 42"); }, SyntaxError);
+  assertThrows(function() { Function("var foo = 1; foo = new.target = 42"); }, SyntaxError);
+  assertThrows(function() { Function("new.target--"); }, SyntaxError);
+  assertThrows(function() { Function("--new.target"); }, SyntaxError);
+  assertThrows(function() { Function("(new.target)++"); }, SyntaxError);
+  assertThrows(function() { Function("++(new.target)"); }, SyntaxError);
   assertThrows(function() { Function("for (new.target of {});"); }, SyntaxError);
 })();
 
diff --git a/src/v8/test/mjsunit/es6/object-assign.js b/src/v8/test/mjsunit/es6/object-assign.js
index 1fec766..2573e3d 100644
--- a/src/v8/test/mjsunit/es6/object-assign.js
+++ b/src/v8/test/mjsunit/es6/object-assign.js
@@ -171,3 +171,58 @@
   var source = {get k1() { throw "fail" }};
   assertThrows(()=>Object.assign(target, source));
 })();
+
+(function strings_and_symbol_order1() {
+  // first order
+  var log = [];
+
+  var sym1 = Symbol("x"), sym2 = Symbol("y");
+  var source = {
+      get [sym1](){ log.push("get sym1"); },
+      get a() { log.push("get a"); },
+      get b() { log.push("get b"); },
+      get c() { log.push("get c"); },
+      get [sym2](){ log.push("get sym2"); },
+  };
+
+  Object.assign({}, source);
+
+  assertEquals(log, ["get a", "get b", "get c", "get sym1", "get sym2"]);
+})();
+
+(function strings_and_symbol_order2() {
+  // first order
+  var log = [];
+
+  var sym1 = Symbol("x"), sym2 = Symbol("y");
+  var source = {
+      get [sym1](){ log.push("get sym1"); },
+      get a() { log.push("get a"); },
+      get [sym2](){ log.push("get sym2"); },
+      get b() { log.push("get b"); },
+      get c() { log.push("get c"); },
+  };
+
+  Object.assign({}, source);
+
+  assertEquals(log, ["get a", "get b", "get c", "get sym1", "get sym2"]);
+})();
+
+
+(function strings_and_symbol_order3() {
+  // first order
+  var log = [];
+
+  var sym1 = Symbol("x"), sym2 = Symbol("y");
+  var source = {
+      get a() { log.push("get a"); },
+      get [sym1](){ log.push("get sym1"); },
+      get b() { log.push("get b"); },
+      get [sym2](){ log.push("get sym2"); },
+      get c() { log.push("get c"); },
+  };
+
+  Object.assign({}, source);
+
+  assertEquals(log, ["get a", "get b", "get c", "get sym1", "get sym2"]);
+})();
diff --git a/src/v8/test/mjsunit/es6/object-literals-method.js b/src/v8/test/mjsunit/es6/object-literals-method.js
index 90bc51e..c4a8726 100644
--- a/src/v8/test/mjsunit/es6/object-literals-method.js
+++ b/src/v8/test/mjsunit/es6/object-literals-method.js
@@ -144,6 +144,7 @@
   var object = {
     method() { return 42; }
   };
+  %PrepareFunctionForOptimization(object.method);
   assertEquals(42, object.method());
   assertEquals(42, object.method());
   %OptimizeFunctionOnNextCall(object.method);
diff --git a/src/v8/test/mjsunit/es6/promise-all-overflow-1.js b/src/v8/test/mjsunit/es6/promise-all-overflow-1.js
new file mode 100644
index 0000000..1a1cb4b
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/promise-all-overflow-1.js
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+load('test/mjsunit/test-async.js');
+
+// Make sure we properly throw a RangeError when overflowing the maximum
+// number of elements for Promise.all, which is capped at 2^21 bits right
+// now, since we store the indices as identity hash on the resolve element
+// closures.
+const a = new Array(2 ** 21 - 1);
+const p = Promise.resolve(1);
+for (let i = 0; i < a.length; ++i) a[i] = p;
+testAsync(assert => {
+  assert.plan(1);
+  Promise.all(a).then(assert.unreachable, reason => {
+    assert.equals(true, reason instanceof RangeError);
+  });
+});
diff --git a/src/v8/test/mjsunit/es6/promise-all-overflow-2.js b/src/v8/test/mjsunit/es6/promise-all-overflow-2.js
new file mode 100644
index 0000000..61d0bd9
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/promise-all-overflow-2.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+load('test/mjsunit/test-async.js');
+
+// Test that pre-allocation of the result array works even if it needs to be
+// allocated in large object space.
+const a = new Array(64 * 1024);
+a.fill(Promise.resolve(1));
+testAsync(assert => {
+  assert.plan(1);
+  Promise.all(a).then(b => {
+    assert.equals(a.length, b.length);
+  });
+});
diff --git a/src/v8/test/mjsunit/es6/promise-all.js b/src/v8/test/mjsunit/es6/promise-all.js
new file mode 100644
index 0000000..3a0980d
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/promise-all.js
@@ -0,0 +1,86 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+load('test/mjsunit/test-async.js');
+
+// We store the index in the hash code field of the Promise.all resolve
+// element closures, so make sure we properly handle the cases where this
+// magical field turns into a PropertyArray later.
+(function() {
+  class MyPromise extends Promise {
+    then(resolve, reject) {
+      this.resolve = resolve;
+    }
+  };
+  const myPromise = new MyPromise(() => {});
+  MyPromise.all([myPromise]);
+  myPromise.resolve.x = 1;
+  myPromise.resolve(1);
+})();
+
+// Same test as above, but for PropertyDictionary.
+(function() {
+  class MyPromise extends Promise {
+    then(resolve, reject) {
+      this.resolve = resolve;
+    }
+  };
+  const myPromise = new MyPromise(() => {});
+  MyPromise.all([myPromise]);
+  for (let i = 0; i < 1025; ++i) {
+    myPromise.resolve[`x${i}`] = i;
+  }
+  myPromise.resolve(1);
+})();
+
+// Test that we return a proper array even if (custom) "then" invokes the
+// resolve callbacks right away.
+(function() {
+  class MyPromise extends Promise {
+    constructor(executor, id) {
+      super(executor);
+      this.id = id;
+    }
+
+    then(resolve, reject) {
+      if (this.id) return resolve(this.id);
+      return super.then(resolve, reject)
+    }
+  };
+  const a = new MyPromise(() => {}, 'a');
+  const b = new MyPromise(() => {}, 'b');
+  testAsync(assert => {
+    assert.plan(1);
+    MyPromise.all([a, b]).then(
+        v => assert.equals(['a', 'b'], v),
+        assert.unexpectedRejection());
+  });
+})();
+
+// Test that we properly handle holes introduced into the resulting array
+// by resolving some late elements immediately.
+(function() {
+  class MyPromise extends Promise {
+    then(resolve, reject) {
+      if (this.immediately) {
+        resolve(42);
+      } else {
+        super.then(resolve, reject);
+      }
+    }
+  };
+  const a = new Array(1024);
+  a.fill(MyPromise.resolve(1));
+  const p = MyPromise.resolve(0);
+  p.immediately = true;
+  a.push(p);
+  testAsync(assert => {
+    assert.plan(1);
+    MyPromise.all(a).then(
+        b => assert.equals(42, b[1024]),
+        assert.unexpectedRejection());
+  });
+})();
diff --git a/src/v8/test/mjsunit/es6/promise-resolve-thenable-job.js b/src/v8/test/mjsunit/es6/promise-resolve-thenable-job.js
new file mode 100644
index 0000000..70ab6cd
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/promise-resolve-thenable-job.js
@@ -0,0 +1,127 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function() {
+  let resolve;
+  let onFulfilledValue;
+  const p = new Promise(r => resolve = r);
+  resolve(Promise.resolve(1));
+  p.then(
+      v => {
+        onFulfilledValue = v;
+      },
+      e => {
+        assertUnreachable();
+      });
+  setTimeout(_ => assertEquals(1, onFulfilledValue));
+})();
+
+(function() {
+  let resolve;
+  let onRejectedReason;
+  const p = new Promise(r => resolve = r);
+  resolve(Promise.reject(1));
+  p.then(
+      v => {
+        assertUnreachable();
+      },
+      e => {
+        onRejectedReason = e;
+      });
+  setTimeout(_ => assertEquals(1, onRejectedReason));
+})();
+
+(function() {
+  let onFulfilledValue;
+  (async () => Promise.resolve(1))().then(
+      v => {
+        onFulfilledValue = v;
+      },
+      e => {
+        assertUnreachable();
+      });
+  setTimeout(_ => assertEquals(1, onFulfilledValue));
+})();
+
+(function() {
+  let onRejectedReason;
+  (async () => Promise.reject(1))().then(
+      v => {
+        assertUnreachable();
+      },
+      e => {
+        onRejectedReason = e;
+      });
+  setTimeout(_ => assertEquals(1, onRejectedReason));
+})();
+
+(function() {
+  let resolve;
+  let onFulfilledValue;
+  const p = new Promise(r => resolve = r);
+  resolve({
+    then(onFulfilled, onRejected) {
+      onFulfilled(1);
+    }
+  });
+  p.then(
+      v => {
+        onFulfilledValue = v;
+      },
+      e => {
+        assertUnreachable();
+      });
+  setTimeout(_ => assertEquals(1, onFulfilledValue));
+})();
+
+(function() {
+  let resolve;
+  let onRejectedReason;
+  const p = new Promise(r => resolve = r);
+  resolve({
+    then(onFulfilled, onRejected) {
+      onRejected(1);
+    }
+  });
+  p.then(
+      v => {
+        assertUnreachable();
+      },
+      e => {
+        onRejectedReason = e;
+      });
+  setTimeout(_ => assertEquals(1, onRejectedReason));
+})();
+
+(function() {
+  let onFulfilledValue;
+  (async () => ({
+    then(onFulfilled, onRejected) {
+      onFulfilled(1);
+    }
+  }))().then(
+      v => {
+        onFulfilledValue = v;
+      },
+      e => {
+        assertUnreachable();
+      });
+  setTimeout(_ => assertEquals(1, onFulfilledValue));
+})();
+
+(function() {
+  let onRejectedReason;
+  (async () => ({
+    then(onFulfilled, onRejected) {
+      onRejected(1);
+    }
+  }))().then(
+      v => {
+        assertUnreachable();
+      },
+      e => {
+        onRejectedReason = e;
+      });
+  setTimeout(_ => assertEquals(1, onRejectedReason));
+})();
diff --git a/src/v8/test/mjsunit/es6/promises.js b/src/v8/test/mjsunit/es6/promises.js
index 6e20d68..86b6afd 100644
--- a/src/v8/test/mjsunit/es6/promises.js
+++ b/src/v8/test/mjsunit/es6/promises.js
@@ -583,6 +583,15 @@
 })();
 
 (function() {
+  Promise.all({[symbolIterator](){ return null; }}).then(
+    assertUnreachable,
+    function(r) {
+      assertAsync(r instanceof TypeError, 'all/non iterable');
+    });
+  assertAsyncRan();
+})();
+
+(function() {
   var deferred = defer(Promise);
   var p = deferred.promise;
   function* f() {
diff --git a/src/v8/test/mjsunit/es6/proxies-constructor.js b/src/v8/test/mjsunit/es6/proxies-constructor.js
index 5b30725..93b64ec 100644
--- a/src/v8/test/mjsunit/es6/proxies-constructor.js
+++ b/src/v8/test/mjsunit/es6/proxies-constructor.js
@@ -2,6 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+(function testNewTarget() {
+  assertThrows(function(){ Proxy({}, {}); }, TypeError);
+  assertDoesNotThrow(function(){ new Proxy({}, {}); });
+})();
 
 (function testNonObjectTargetTypes() {
   assertThrows(function(){ new Proxy(undefined, {}); }, TypeError);
diff --git a/src/v8/test/mjsunit/es6/proxies-cross-realm-exception.js b/src/v8/test/mjsunit/es6/proxies-cross-realm-exception.js
index ffba5c2..571c7ca 100644
--- a/src/v8/test/mjsunit/es6/proxies-cross-realm-exception.js
+++ b/src/v8/test/mjsunit/es6/proxies-cross-realm-exception.js
@@ -20,6 +20,7 @@
 // Test that the instannceof check works in optimized code.
 var test = Realm.eval(realm,
     "()=>{1.1; return Realm.global(0) instanceof Object; }");
+%PrepareFunctionForOptimization(test);
 assertFalse(test());
 test();
 test();
diff --git a/src/v8/test/mjsunit/es6/proxies-get-own-property-descriptor.js b/src/v8/test/mjsunit/es6/proxies-get-own-property-descriptor.js
index 441ff16..ca50f6f 100644
--- a/src/v8/test/mjsunit/es6/proxies-get-own-property-descriptor.js
+++ b/src/v8/test/mjsunit/es6/proxies-get-own-property-descriptor.js
@@ -93,11 +93,11 @@
 // (Inv-4) "A property cannot be reported as existent, if it does not exist as
 // an own property of the target object and the target object is not
 // extensible."
-var existent_desc = {value: "yes"};
+var existent_desc = {value: "yes", writable: true};
 handler.getOwnPropertyDescriptor = function() { return existent_desc; };
 assertThrows('Object.getOwnPropertyDescriptor(proxy, "nonexistent")');
 assertEquals(
-    {value: "yes", writable: false, enumerable: false, configurable: false},
+    {value: "yes", writable: true, enumerable: false, configurable: false},
     Object.getOwnPropertyDescriptor(proxy, "configurable"));
 
 // Checking individual bailout points in the implementation:
diff --git a/src/v8/test/mjsunit/es6/proxies-ownkeys-clone.js b/src/v8/test/mjsunit/es6/proxies-ownkeys-clone.js
new file mode 100644
index 0000000..8fe9598
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/proxies-ownkeys-clone.js
@@ -0,0 +1,25 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var p = new Proxy({a: 1, b: 2}, {
+  ownKeys() { return ['a', 'b']; }
+});
+
+// clone and return a
+function f(a) {
+  var y = {...a}
+  return y;
+}
+
+// Call with different maps to force it into megamorphic state
+f({a: 1, b: 2});
+f({a1: 1, b1: 3});
+f({a2: 1, b2: 3});
+f({a3: 1, b3: 4});
+f({a4: 1, b4: 5});
+
+// Test that y was initialized correctly in the slow path
+var clone = f(p);
+assertEquals(clone.a, 1);
+assertEquals(clone.b, 2);
diff --git a/src/v8/test/mjsunit/es6/proxies-ownkeys.js b/src/v8/test/mjsunit/es6/proxies-ownkeys.js
index 7cc0a87..3b9011a 100644
--- a/src/v8/test/mjsunit/es6/proxies-ownkeys.js
+++ b/src/v8/test/mjsunit/es6/proxies-ownkeys.js
@@ -54,9 +54,9 @@
 keys.length = Math.pow(2, 33);
 assertThrows("Reflect.ownKeys(proxy)", RangeError);
 
-// Check that we allow duplicated keys.
+// Check that we don't allow duplicated keys.
 keys  = ['a', 'a', 'a']
-assertEquals(keys, Reflect.ownKeys(proxy));
+assertThrows("Reflect.ownKeys(proxy)", TypeError);
 
 // Non-Name results throw.
 keys = [1];
@@ -75,9 +75,9 @@
 keys = ["nonconf"];
 assertEquals(keys, Reflect.ownKeys(proxy));
 
-// Check that we allow duplicated keys.
+// Check that we don't allow duplicated keys.
 keys  = ['nonconf', 'nonconf', 'nonconf']
-assertEquals(keys, Reflect.ownKeys(proxy));
+assertThrows("Reflect.ownKeys(proxy)", TypeError);
 
 // Step 19a: The trap result must all keys of a non-extensible target.
 Object.preventExtensions(target);
@@ -89,6 +89,6 @@
 keys = ["nonconf", "target_one", "fantasy"];
 assertThrows("Reflect.ownKeys(proxy)", TypeError);
 
-// Check that we allow duplicated keys.
+// Check that we don't allow duplicated keys.
 keys  = ['nonconf', 'target_one', 'nonconf', 'nonconf', 'target_one',]
-assertEquals(keys, Reflect.ownKeys(proxy));
+assertThrows("Reflect.ownKeys(proxy)", TypeError);
diff --git a/src/v8/test/mjsunit/es6/proxies-prevent-extensions.js b/src/v8/test/mjsunit/es6/proxies-prevent-extensions.js
index dc3c42e..f6b4d3e 100644
--- a/src/v8/test/mjsunit/es6/proxies-prevent-extensions.js
+++ b/src/v8/test/mjsunit/es6/proxies-prevent-extensions.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-
+// Reflect.
 (function () {
   // No trap.
 
@@ -17,7 +17,6 @@
   assertFalse(Reflect.isExtensible(proxy));
 })();
 
-
 (function () {
   // "Undefined" trap.
 
@@ -40,13 +39,13 @@
   var handler = { preventExtensions: 42 };
   var proxy = new Proxy(target, handler);
 
-  assertThrows(() => {Reflect.preventExtensions(proxy)}, TypeError);
+  assertThrows(() => { Reflect.preventExtensions(proxy) }, TypeError);
 })();
 
 
 (function () {
   var target = {};
-  var handler = { isExtensible() {return "bla"} };
+  var handler = { isExtensible() { return "bla" } };
   var proxy = new Proxy(target, handler);
 
   // Trap returns trueish and target is extensible.
@@ -54,7 +53,7 @@
 
   // Trap returns trueish but target is not extensible.
   Reflect.preventExtensions(target);
-  assertThrows(() => {Reflect.isExtensible(proxy)}, TypeError);
+  assertThrows(() => { Reflect.isExtensible(proxy) }, TypeError);
 })();
 
 
@@ -62,7 +61,7 @@
   // Trap returns falsish.
 
   var target = {};
-  var handler = { preventExtensions() {return 0} };
+  var handler = { preventExtensions() { return 0 } };
   var proxy = new Proxy(target, handler);
 
   assertFalse(Reflect.preventExtensions(proxy));
@@ -73,13 +72,132 @@
 
 (function () {
   var target = {};
-  var handler = { preventExtensions() {return Symbol()} };
+  var handler = { preventExtensions() { return Symbol() } };
   var proxy = new Proxy(target, handler);
 
   // Trap returns trueish but target is extensible.
-  assertThrows(() => {Reflect.preventExtensions(proxy)}, TypeError);
+  assertThrows(() => { Reflect.preventExtensions(proxy) }, TypeError);
 
   // Trap returns trueish and target is not extensible.
   Reflect.preventExtensions(target);
   assertTrue(Reflect.preventExtensions(proxy));
 })();
+
+
+(function () {
+  // Target is proxy
+  var object = {};
+  assertTrue(Reflect.preventExtensions(object));
+  var target = new Proxy(object, {});
+  var proxy = new Proxy(target, {});
+  assertFalse(Reflect.isExtensible(object));
+  assertFalse(Reflect.isExtensible(target));
+  assertFalse(Reflect.isExtensible(proxy));
+})();
+
+// Object.
+(function () {
+  // No trap.
+
+  var target = {};
+  var handler = {};
+  var proxy = new Proxy(target, handler);
+
+  assertTrue(Object.isExtensible(target));
+  assertTrue(Object.isExtensible(proxy));
+  assertSame(proxy, Object.preventExtensions(proxy));
+  assertFalse(Object.isExtensible(target));
+  assertFalse(Object.isExtensible(proxy));
+})();
+
+(function () {
+  // "Undefined" trap.
+
+  var target = {};
+  var handler = { preventExtensions: null };
+  var proxy = new Proxy(target, handler);
+
+  assertTrue(Object.isExtensible(target));
+  assertTrue(Object.isExtensible(proxy));
+  assertSame(proxy, Object.preventExtensions(proxy));
+  assertFalse(Object.isExtensible(target));
+  assertFalse(Object.isExtensible(proxy));
+})();
+
+
+(function () {
+  // Invalid trap.
+
+  var target = {};
+  var handler = { preventExtensions: 42 };
+  var proxy = new Proxy(target, handler);
+
+  assertThrows(() => { Object.preventExtensions(proxy) }, TypeError);
+})();
+
+
+(function () {
+  var target = {};
+  var handler = { isExtensible() { return "bla" } };
+  var proxy = new Proxy(target, handler);
+
+  // Trap returns trueish and target is extensible.
+  assertTrue(Object.isExtensible(proxy));
+
+  // Trap returns trueish but target is not extensible.
+  assertSame(target, Object.preventExtensions(target));
+  assertThrows(() => { Object.isExtensible(proxy) }, TypeError);
+})();
+
+
+(function () {
+  // Trap returns falsish.
+
+  var target = {};
+  var handler = { isExtensible() { return false } };
+  var proxy = new Proxy(target, handler);
+
+  assertThrows(() => { Object.isExtensible(proxy) }, TypeError);
+  assertSame(target, Object.preventExtensions(target));
+  assertFalse(Object.isExtensible(proxy));
+})();
+
+
+(function () {
+  // Trap returns falsish.
+
+  var target = {};
+  var handler = { preventExtensions() { return 0 } };
+  var proxy = new Proxy(target, handler);
+
+  assertFalse(Reflect.preventExtensions(proxy));
+  assertSame(target, Object.preventExtensions(target));
+  assertFalse(Reflect.preventExtensions(proxy));
+  assertThrows(() => { Object.preventExtensions(proxy) }, TypeError);
+})();
+
+
+(function () {
+  var target = {};
+  var handler = { preventExtensions() { return Symbol() } };
+  var proxy = new Proxy(target, handler);
+
+  // Trap returns trueish but target is extensible.
+  assertThrows(() => { Object.preventExtensions(proxy) }, TypeError);
+
+  // Trap returns trueish and target is not extensible.
+  assertSame(target, Object.preventExtensions(target));
+  assertTrue(Reflect.preventExtensions(proxy));
+})();
+
+
+(function () {
+  // Target is proxy
+  var object = {};
+  assertSame(object, Object.preventExtensions(object));
+  var target = new Proxy(object, {});
+  var proxy = new Proxy(target, {});
+  assertFalse(Object.isExtensible(object));
+  assertFalse(Object.isExtensible(target));
+  assertFalse(Object.isExtensible(proxy));
+})();
diff --git a/src/v8/test/mjsunit/es6/proxies-revocable.js b/src/v8/test/mjsunit/es6/proxies-revocable.js
index 1f61174..82b853a 100644
--- a/src/v8/test/mjsunit/es6/proxies-revocable.js
+++ b/src/v8/test/mjsunit/es6/proxies-revocable.js
@@ -21,3 +21,9 @@
 for (var trap of traps) {
   assertThrows(() => Reflect[trap](proxy), TypeError);
 }
+
+// Throw TypeError if target or handler is revoked proxy
+var revocable = Proxy.revocable({}, {});
+revocable.revoke();
+assertThrows(function(){ Proxy.revocable(revocable.proxy, {}); }, TypeError);
+assertThrows(function(){ Proxy.revocable({}, revocable.proxy); }, TypeError);
diff --git a/src/v8/test/mjsunit/es6/proxies.js b/src/v8/test/mjsunit/es6/proxies.js
index 75a80a1..d96e5b3 100644
--- a/src/v8/test/mjsunit/es6/proxies.js
+++ b/src/v8/test/mjsunit/es6/proxies.js
@@ -55,7 +55,7 @@
 (function TestProxyProperties() {
   assertEquals(2, Proxy.length);
   assertEquals(Function.__proto__, Proxy.__proto__);
-  assertEquals(null, Proxy.prototype);
+  assertEquals(undefined, Proxy.prototype);
   assertEquals(undefined, Object.getOwnPropertyDescriptor(Proxy, "arguments"));
   assertThrows(() => Proxy.arguments, TypeError);
   assertEquals(undefined, Object.getOwnPropertyDescriptor(Proxy, "caller"));
@@ -1287,8 +1287,7 @@
 
 // ---------------------------------------------------------------------------
 // String conversion (Object.prototype.toString,
-//                    Object.prototype.toLocaleString,
-//                    Function.prototype.toString)
+//                    Object.prototype.toLocaleString)
 
 var key
 
@@ -1306,7 +1305,6 @@
   assertEquals(Symbol.toStringTag, key)
   assertEquals("my_proxy", Object.prototype.toLocaleString.call(f))
   assertEquals("toString", key)
-  assertThrows(function(){ Function.prototype.toString.call(f) })
 
   var o = Object.create(p)
   key = ""
@@ -1512,6 +1510,7 @@
   function f() {
     return o.x;
   }
+  %PrepareFunctionForOptimization(f);
   assertEquals(10, f());
   assertEquals(10, f());
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/es6/proxy-function-tostring.js b/src/v8/test/mjsunit/es6/proxy-function-tostring.js
new file mode 100644
index 0000000..e151bf6
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/proxy-function-tostring.js
@@ -0,0 +1,6 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals(new Proxy(function() {}, {}).toString(),
+             'function () { [native code] }');
diff --git a/src/v8/test/mjsunit/es6/reflect-define-property.js b/src/v8/test/mjsunit/es6/reflect-define-property.js
index 6ead02b..8045982 100644
--- a/src/v8/test/mjsunit/es6/reflect-define-property.js
+++ b/src/v8/test/mjsunit/es6/reflect-define-property.js
@@ -966,6 +966,7 @@
 obj2 = Object.create(obj1);
 obj3 = Object.create(obj2);
 
+%PrepareFunctionForOptimization(testGetterOnProto);
 testGetterOnProto(111, obj3);
 testGetterOnProto(111, obj3);
 %OptimizeFunctionOnNextCall(testGetterOnProto);
@@ -974,6 +975,7 @@
 
 assertTrue(Reflect.defineProperty(obj1, "quebec", { get: anotherGetter }));
 
+%PrepareFunctionForOptimization(testGetterOnProto);
 testGetterOnProto(222, obj3);
 testGetterOnProto(222, obj3);
 %OptimizeFunctionOnNextCall(testGetterOnProto);
@@ -997,6 +999,7 @@
 obj2 = Object.create(obj1);
 obj3 = Object.create(obj2);
 
+%PrepareFunctionForOptimization(testSetterOnProto);
 testSetterOnProto(445, obj3);
 testSetterOnProto(445, obj3);
 %OptimizeFunctionOnNextCall(testSetterOnProto);
@@ -1005,6 +1008,7 @@
 
 assertTrue(Reflect.defineProperty(obj1, "romeo", { set: anotherSetter }));
 
+%PrepareFunctionForOptimization(testSetterOnProto);
 testSetterOnProto(446, obj3);
 testSetterOnProto(446, obj3);
 %OptimizeFunctionOnNextCall(testSetterOnProto);
@@ -1023,6 +1027,7 @@
 obj2 = Object.create(obj1);
 obj3 = Object.create(obj2);
 
+%PrepareFunctionForOptimization(testSetterOnProtoStrict);
 testSetterOnProtoStrict(obj3);
 testSetterOnProtoStrict(obj3);
 %OptimizeFunctionOnNextCall(testSetterOnProtoStrict);
@@ -1051,6 +1056,7 @@
 
 function C() {}
 
+%PrepareFunctionForOptimization(Assign);
 Assign(new C);
 Assign(new C);
 %OptimizeFunctionOnNextCall(Assign);
diff --git a/src/v8/test/mjsunit/es6/reflect.js b/src/v8/test/mjsunit/es6/reflect.js
index 9e21717..cb8febb 100644
--- a/src/v8/test/mjsunit/es6/reflect.js
+++ b/src/v8/test/mjsunit/es6/reflect.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// TODO(neis): Test with proxies.
-
 
 
 ////////////////////////////////////////////////////////////////////////////////
diff --git a/src/v8/test/mjsunit/es6/regress/regress-347906.js b/src/v8/test/mjsunit/es6/regress/regress-347906.js
index daa62f5..4358b89 100644
--- a/src/v8/test/mjsunit/es6/regress/regress-347906.js
+++ b/src/v8/test/mjsunit/es6/regress/regress-347906.js
@@ -8,6 +8,7 @@
   return Math.clz32(12.34);
 }
 
+%PrepareFunctionForOptimization(foo);
 foo();
 foo();
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/es6/regress/regress-3741.js b/src/v8/test/mjsunit/es6/regress/regress-3741.js
index 0c5074a..fe5bc05 100644
--- a/src/v8/test/mjsunit/es6/regress/regress-3741.js
+++ b/src/v8/test/mjsunit/es6/regress/regress-3741.js
@@ -19,6 +19,7 @@
 }
 
 
+%PrepareFunctionForOptimization(f24);
 for (var j = 0; j < 10; ++j) {
   f24(12);
 }
diff --git a/src/v8/test/mjsunit/es6/regress/regress-411237.js b/src/v8/test/mjsunit/es6/regress/regress-411237.js
index ece6481..b2b1a39 100644
--- a/src/v8/test/mjsunit/es6/regress/regress-411237.js
+++ b/src/v8/test/mjsunit/es6/regress/regress-411237.js
@@ -4,6 +4,7 @@
 
 // Flags: --allow-natives-syntax
 
+%PrepareFunctionForOptimization(print);
 try {
   %OptimizeFunctionOnNextCall(print);
 } catch(e) { }
@@ -11,5 +12,6 @@
 try {
   function* f() {
   }
+  %PrepareFunctionForOptimization(f);
   %OptimizeFunctionOnNextCall(f);
 } catch(e) { }
diff --git a/src/v8/test/mjsunit/es6/regress/regress-4160.js b/src/v8/test/mjsunit/es6/regress/regress-4160.js
index d5dd270..5c44061 100644
--- a/src/v8/test/mjsunit/es6/regress/regress-4160.js
+++ b/src/v8/test/mjsunit/es6/regress/regress-4160.js
@@ -7,6 +7,7 @@
 (function(x) {
   (function(x) {
     var boom = (() => eval(x));
+    %PrepareFunctionForOptimization(boom);
     assertEquals(23, boom());
     assertEquals(23, boom());
     %OptimizeFunctionOnNextCall(boom);
@@ -19,6 +20,7 @@
 (function(x) {
   (function(x) {
     var boom = (() => (eval("var x = 66"), x));
+    %PrepareFunctionForOptimization(boom);
     assertEquals(66, boom());
     assertEquals(66, boom());
     %OptimizeFunctionOnNextCall(boom);
diff --git a/src/v8/test/mjsunit/es6/regress/regress-508074.js b/src/v8/test/mjsunit/es6/regress/regress-508074.js
index f4d1a44..0dd22ab 100644
--- a/src/v8/test/mjsunit/es6/regress/regress-508074.js
+++ b/src/v8/test/mjsunit/es6/regress/regress-508074.js
@@ -17,6 +17,7 @@
   f(6, 5, 4, 3, 2, 1);
 };
 
+%PrepareFunctionForOptimization(g);
 g();
 g();
 g();
diff --git a/src/v8/test/mjsunit/es6/regress/regress-5598.js b/src/v8/test/mjsunit/es6/regress/regress-5598.js
index b07894f..10956fd 100644
--- a/src/v8/test/mjsunit/es6/regress/regress-5598.js
+++ b/src/v8/test/mjsunit/es6/regress/regress-5598.js
@@ -9,6 +9,7 @@
   return b;
 }
 
+%PrepareFunctionForOptimization(fn);
 fn('a');
 fn('a');
 %OptimizeFunctionOnNextCall(fn);
diff --git a/src/v8/test/mjsunit/es6/regress/regress-5929-1.js b/src/v8/test/mjsunit/es6/regress/regress-5929-1.js
index 94e143f..5f361f3 100644
--- a/src/v8/test/mjsunit/es6/regress/regress-5929-1.js
+++ b/src/v8/test/mjsunit/es6/regress/regress-5929-1.js
@@ -8,7 +8,7 @@
 var arr = new Uint8Array(buf).fill(55);
 var tmp = {};
 tmp[Symbol.toPrimitive] = function () {
-  %ArrayBufferNeuter(arr.buffer);
+  %ArrayBufferDetach(arr.buffer);
   return 50;
 }
 arr.copyWithin(tmp);
diff --git a/src/v8/test/mjsunit/es6/regress/regress-666622.js b/src/v8/test/mjsunit/es6/regress/regress-666622.js
index 56731ab..f73842d 100644
--- a/src/v8/test/mjsunit/es6/regress/regress-666622.js
+++ b/src/v8/test/mjsunit/es6/regress/regress-666622.js
@@ -22,6 +22,7 @@
   } catch (e) {
   }
 }
+%PrepareFunctionForOptimization(testArray);
 testArray();
 testArray();
 %OptimizeFunctionOnNextCall(testArray);
@@ -33,6 +34,7 @@
   } catch (e) {
   }
 }
+%PrepareFunctionForOptimization(testTypedArray);
 testTypedArray();
 testTypedArray();
 %OptimizeFunctionOnNextCall(testTypedArray);
diff --git a/src/v8/test/mjsunit/es6/regress/regress-7706.js b/src/v8/test/mjsunit/es6/regress/regress-7706.js
new file mode 100644
index 0000000..7401a73
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/regress/regress-7706.js
@@ -0,0 +1,40 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function toString(o) {
+  %ToFastProperties(o.__proto__);
+  return Object.prototype.toString.call(o);
+}
+
+class TestNumber extends Number {}
+TestNumber.prototype[Symbol.toStringTag] = "TestNumber";
+assertEquals("[object TestNumber]", toString(new TestNumber), "Try #1");
+assertEquals("[object TestNumber]", toString(new TestNumber), "Try #2");
+
+class TestBoolean extends Boolean {}
+TestBoolean.prototype[Symbol.toStringTag] = "TestBoolean";
+assertEquals("[object TestBoolean]", toString(new TestBoolean), "Try #1");
+assertEquals("[object TestBoolean]", toString(new TestBoolean), "Try #2");
+
+class TestString extends String {}
+TestString.prototype[Symbol.toStringTag] = "TestString";
+assertEquals("[object TestString]", toString(new TestString), "Try #1");
+assertEquals("[object TestString]", toString(new TestString), "Try #2");
+
+class base {}
+class TestBigInt extends base {}
+TestBigInt.prototype[Symbol.toStringTag] = 'TestBigInt';
+var b = new TestBigInt();
+b.__proto__.__proto__ = BigInt.prototype;
+assertEquals("[object TestBigInt]", toString(b), "Try #1");
+assertEquals("[object TestBigInt]", toString(b), "Try #2");
+
+class TestSymbol extends base {}
+TestSymbol.prototype[Symbol.toStringTag] = 'TestSymbol';
+var sym = new TestSymbol();
+sym.__proto__.__proto__ = Symbol.prototype;
+assertEquals("[object TestSymbol]", toString(sym), "Try #1");
+assertEquals("[object TestSymbol]", toString(sym), "Try #2");
diff --git a/src/v8/test/mjsunit/es6/regress/regress-9234.js b/src/v8/test/mjsunit/es6/regress/regress-9234.js
new file mode 100644
index 0000000..e0c8b05
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/regress/regress-9234.js
@@ -0,0 +1,35 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function returnFalsishStrict() {
+  "use strict";
+
+  function trySet(o) {
+    o["bla"] = 0;
+  }
+
+  var proxy = new Proxy({}, {});
+  var proxy2 = new Proxy({}, { set() { return ""; } });
+
+  trySet(proxy);
+  trySet(proxy);
+  assertThrows(() => trySet(proxy2), TypeError);
+})();
+
+(function privateSymbolStrict() {
+  "use strict";
+  var proxy = new Proxy({}, {});
+  var proxy2 = new Proxy({a: 1}, { set() { return true; } });
+
+  function trySet(o) {
+    var symbol = o == proxy2 ? %CreatePrivateSymbol("private"): 1;
+    o[symbol] = 0;
+  }
+
+  trySet(proxy);
+  trySet(proxy);
+  assertThrows(() => trySet(proxy2), TypeError);
+})();
diff --git a/src/v8/test/mjsunit/es6/regress/regress-cr895860.js b/src/v8/test/mjsunit/es6/regress/regress-cr895860.js
new file mode 100644
index 0000000..1ecd1f7
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/regress/regress-cr895860.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function() {
+  var s = "f";
+
+  // 2^18 length, enough to ensure an array (of pointers) bigger than 500KB.
+  for (var i = 0; i < 18; i++) {
+    s += s;
+  }
+
+  var ss = [...s];
+})();
diff --git a/src/v8/test/mjsunit/es6/regress/regress-crbug-448730.js b/src/v8/test/mjsunit/es6/regress/regress-crbug-448730.js
index a3c70ac..8b9a8a3 100644
--- a/src/v8/test/mjsunit/es6/regress/regress-crbug-448730.js
+++ b/src/v8/test/mjsunit/es6/regress/regress-crbug-448730.js
@@ -8,6 +8,7 @@
 bar({ a: new Proxy({}, {}) });
 function foo(x) { x.a.b == ""; }
 var x = {a: {b: "" }};
+%PrepareFunctionForOptimization(foo);
 foo(x);
 foo(x);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/es6/regress/regress-crbug-820596.js b/src/v8/test/mjsunit/es6/regress/regress-crbug-820596.js
new file mode 100644
index 0000000..6257e14
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/regress/regress-crbug-820596.js
@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --print-ast
+
+var x;
+`Crashes if OOB read with --print-ast ${x}`;
diff --git a/src/v8/test/mjsunit/es6/regress/regress-crbug-837939.js b/src/v8/test/mjsunit/es6/regress/regress-crbug-837939.js
new file mode 100644
index 0000000..7afa614
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/regress/regress-crbug-837939.js
@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Create a double elements array.
+const iterable = [123.123];
+assertTrue(%HasDoubleElements(iterable))
+
+iterable.length = 0;
+assertTrue(%HasDoubleElements(iterable))
+
+// Should not throw here.
+let map = new Map(iterable);
+assertEquals(0, map.size);
+new WeakMap(iterable); // WeakMap does not have a size
diff --git a/src/v8/test/mjsunit/es6/regress/regress-inlined-new-target.js b/src/v8/test/mjsunit/es6/regress/regress-inlined-new-target.js
index 59932f6..c6a617f 100644
--- a/src/v8/test/mjsunit/es6/regress/regress-inlined-new-target.js
+++ b/src/v8/test/mjsunit/es6/regress/regress-inlined-new-target.js
@@ -7,6 +7,7 @@
 function g() { return { val: new.target }; }
 function f() { return (new g()).val; }
 
+%PrepareFunctionForOptimization(f);
 assertEquals(g, f());
 assertEquals(g, f());
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/es6/set-iterator-1.js b/src/v8/test/mjsunit/es6/set-iterator-1.js
new file mode 100644
index 0000000..2e4447d
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/set-iterator-1.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var set = new Set([1,2,3]);
+
+assertEquals([1,2,3], [...set]);
+assertEquals([[1,1],[2,2],[3,3]], [...set.entries()]);
+assertEquals([1,2,3], [...set.keys()]);
+assertEquals([1,2,3], [...set.values()]);
+assertTrue(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+
+set[Symbol.iterator] = () => ({next: () => ({done: true})});
+
+assertFalse(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+assertEquals([], [...set]);
+assertEquals([[1,1],[2,2],[3,3]], [...set.entries()]);
+assertEquals([1,2,3], [...set.keys()]);
+assertEquals([1,2,3], [...set.values()]);
diff --git a/src/v8/test/mjsunit/es6/set-iterator-10.js b/src/v8/test/mjsunit/es6/set-iterator-10.js
new file mode 100644
index 0000000..ec094d2
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/set-iterator-10.js
@@ -0,0 +1,34 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// This tests the interaction between the MapIterator protector and SetIterator
+// protector.
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+
+var set = new Set([1,2,3]);
+assertTrue(%SetIteratorProtector());
+
+// This changes %IteratorPrototype%. No more tests should be run after this in
+// the same instance.
+var iterator = set.keys();
+// iterator object --> %SetIteratorPrototype% --> %IteratorPrototype%
+iterator.__proto__.__proto__[Symbol.iterator] =
+  () => ({next: () => ({done: true})});
+
+assertFalse(%MapIteratorProtector());
+assertEquals([[1,2], [2,3], [3,4]], [...map]);
+assertEquals([], [...map.entries()]);
+assertEquals([], [...map.keys()]);
+assertEquals([], [...map.values()]);
+
+assertFalse(%SetIteratorProtector());
+assertEquals([], [...set.entries()]);
+assertEquals([1,2,3], [...set]);
+assertEquals([], [...set.keys()]);
+assertEquals([], [...set.values()]);
+assertEquals([], [...iterator]);
diff --git a/src/v8/test/mjsunit/es6/set-iterator-11.js b/src/v8/test/mjsunit/es6/set-iterator-11.js
new file mode 100644
index 0000000..dff71c8
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/set-iterator-11.js
@@ -0,0 +1,33 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var set = new Set([1,2,3]);
+
+var iterator = set.keys();
+
+assertEquals([1,2,3], [...set.keys()]);
+assertEquals([1,2,3], [...iterator]);
+assertEquals([], [...iterator]);
+
+iterator = set.values();
+assertEquals([1,2,3], [...iterator]);
+assertEquals([], [...iterator]);
+
+iterator = set.keys();
+iterator.next();
+assertEquals([2,3], [...iterator]);
+assertEquals([], [...iterator]);
+
+iterator = set.values();
+var iterator2 = set.values();
+
+set.delete(1);
+assertEquals([2,3], [...iterator]);
+
+set.add(4);
+assertEquals([2,3,4], [...iterator2]);
+
+iterator = set.keys();
+set.add(1);
+assertEquals([2,3,4,1], [...iterator]);
diff --git a/src/v8/test/mjsunit/es6/set-iterator-2.js b/src/v8/test/mjsunit/es6/set-iterator-2.js
new file mode 100644
index 0000000..b1fc6bb
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/set-iterator-2.js
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var set = new Set([1,2,3]);
+
+assertTrue(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+
+// This changes %SetPrototype%. No more tests should be run after this in the
+// same instance.
+set.__proto__[Symbol.iterator] = () => ({next: () => ({done: true})});
+
+assertFalse(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+assertEquals([], [...set]);
+assertEquals([[1,1],[2,2],[3,3]], [...set.entries()]);
+assertEquals([1,2,3], [...set.keys()]);
+assertEquals([1,2,3], [...set.values()]);
diff --git a/src/v8/test/mjsunit/es6/set-iterator-3.js b/src/v8/test/mjsunit/es6/set-iterator-3.js
new file mode 100644
index 0000000..b727f32
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/set-iterator-3.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var set = new Set([1,2,3]);
+
+assertTrue(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+
+// This changes %SetIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = set[Symbol.iterator]();
+iterator.__proto__.next = () => ({done: true});
+
+assertFalse(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+assertEquals([], [...set]);
+assertEquals([], [...set.entries()]);
+assertEquals([], [...set.keys()]);
+assertEquals([], [...set.values()]);
+assertEquals([], [...iterator]);
diff --git a/src/v8/test/mjsunit/es6/set-iterator-4.js b/src/v8/test/mjsunit/es6/set-iterator-4.js
new file mode 100644
index 0000000..69a1889
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/set-iterator-4.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var set = new Set([1,2,3]);
+
+assertTrue(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+
+// This changes %SetIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = set.keys();
+iterator.__proto__.next = () => ({done: true});
+
+assertFalse(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+assertEquals([], [...set]);
+assertEquals([], [...set.entries()]);
+assertEquals([], [...set.keys()]);
+assertEquals([], [...set.values()]);
+assertEquals([], [...iterator]);
diff --git a/src/v8/test/mjsunit/es6/set-iterator-5.js b/src/v8/test/mjsunit/es6/set-iterator-5.js
new file mode 100644
index 0000000..ec8a653
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/set-iterator-5.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var set = new Set([1,2,3]);
+
+assertTrue(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+
+// This changes %SetIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = set.values();
+iterator.__proto__.next = () => ({done: true});
+
+assertFalse(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+assertEquals([], [...set]);
+assertEquals([], [...set.entries()]);
+assertEquals([], [...set.keys()]);
+assertEquals([], [...set.values()]);
+assertEquals([], [...iterator]);
diff --git a/src/v8/test/mjsunit/es6/set-iterator-6.js b/src/v8/test/mjsunit/es6/set-iterator-6.js
new file mode 100644
index 0000000..c5a2a7b
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/set-iterator-6.js
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var set = new Set([1,2,3]);
+
+assertTrue(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+
+var iterator = set.values();
+iterator.next = () => ({done: true});
+
+assertFalse(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+assertEquals([1,2,3], [...set]);
+assertEquals([[1,1],[2,2],[3,3]], [...set.entries()]);
+assertEquals([1,2,3], [...set.keys()]);
+assertEquals([1,2,3], [...set.values()]);
+assertEquals([], [...iterator]);
diff --git a/src/v8/test/mjsunit/es6/set-iterator-7.js b/src/v8/test/mjsunit/es6/set-iterator-7.js
new file mode 100644
index 0000000..a244b1e
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/set-iterator-7.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var set = new Set([1,2,3]);
+
+assertTrue(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+
+// This changes %SetIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = set.entries();
+iterator.__proto__.next = () => ({done: true});
+
+assertFalse(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+assertEquals([], [...set]);
+assertEquals([], [...set.entries()]);
+assertEquals([], [...set.keys()]);
+assertEquals([], [...set.values()]);
+assertEquals([], [...iterator]);
diff --git a/src/v8/test/mjsunit/es6/set-iterator-8.js b/src/v8/test/mjsunit/es6/set-iterator-8.js
new file mode 100644
index 0000000..12f43b9
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/set-iterator-8.js
@@ -0,0 +1,31 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// This tests the interaction between the MapIterator protector and SetIterator
+// protector.
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+
+var set = new Set([1,2,3]);
+assertTrue(%SetIteratorProtector());
+
+// This changes %SetIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = set.keys();
+iterator.__proto__[Symbol.iterator] = () => ({next: () => ({done: true})});
+
+assertTrue(%MapIteratorProtector());
+assertEquals([[1,2], [2,3], [3,4]], [...map]);
+assertEquals([[1,2], [2,3], [3,4]], [...map.entries()]);
+assertEquals([1,2,3], [...map.keys()]);
+assertEquals([2,3,4], [...map.values()]);
+
+assertFalse(%SetIteratorProtector());
+assertEquals([], [...set.entries()]);
+assertEquals([1,2,3], [...set]);
+assertEquals([], [...set.keys()]);
+assertEquals([], [...set.values()]);
diff --git a/src/v8/test/mjsunit/es6/set-iterator-9.js b/src/v8/test/mjsunit/es6/set-iterator-9.js
new file mode 100644
index 0000000..1414a3f
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/set-iterator-9.js
@@ -0,0 +1,31 @@
+
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// This tests the interaction between the MapIterator protector and SetIterator
+// protector.
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+
+var set = new Set([1,2,3]);
+assertTrue(%SetIteratorProtector());
+
+var iterator = set.keys();
+iterator[Symbol.iterator] = () => ({next: () => ({done: true})});
+
+assertTrue(%MapIteratorProtector());
+assertEquals([[1,2], [2,3], [3,4]], [...map]);
+assertEquals([[1,2], [2,3], [3,4]], [...map.entries()]);
+assertEquals([1,2,3], [...map.keys()]);
+assertEquals([2,3,4], [...map.values()]);
+
+assertFalse(%SetIteratorProtector());
+assertEquals([[1,1],[2,2],[3,3]], [...set.entries()]);
+assertEquals([1,2,3], [...set]);
+assertEquals([1,2,3], [...set.keys()]);
+assertEquals([1,2,3], [...set.values()]);
+assertEquals([], [...iterator]);
diff --git a/src/v8/test/mjsunit/es6/spread-array-misc.js b/src/v8/test/mjsunit/es6/spread-array-misc.js
new file mode 100644
index 0000000..ceef31a
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/spread-array-misc.js
@@ -0,0 +1,283 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --allow-natives-syntax
+
+"use strict";
+{
+
+
+// We use g(a, b, c) instead of [a, b, c] when we care about Sminess being
+// preserved.
+function* g(...args) { for (const x of args) yield x; }
+// G is like g but triggers GC to avoid allocation-site updates.
+function* G(...args) { gc(); for (const x of args) { gc(); yield x; }; gc(); }
+
+
+assertEquals([], [...[]]);
+assertEquals([], [...[], ]);
+assertEquals([1], [1, ...[]]);
+assertEquals([1, 2], [1, ...[], 2]);
+assertEquals([, ], [, ...[]]);
+assertEquals([, ], [, ...[], ]);
+assertEquals([, ], [, ...[],...[]]);
+assertEquals([, ], [, ...[],...[], ]);
+assertEquals([1, 2, 3], [...[1, 2, 3]]);
+assertEquals([1, 1.5], [...g(1, 1.5)]);
+assertEquals([, 1, 1.5], [, ...g(1, 1.5)]);
+assertEquals([1, 2, 2.5, 3.5], [...g(1, 2, 2.5, 3.5)]);
+assertEquals([2.5, 1, 3.5, 4], [...g(2.5, 1, 3.5, 4)]);
+assertEquals([2.5, 3.5, 1, 4], [...g(2.5, 3.5, 1, 4)]);
+assertEquals([{a: 1}, {b: 2}], [...[{a: 1}, {b: 2}]]);
+assertEquals([0, {a: 1}, {b: 2}], [...g(0, {a: 1}, {b: 2})]);
+assertEquals([1, 1.5, "2"], [...g(1, 1.5, "2")]);
+
+
+function f1(x) {
+  return [...[x, x, x]];
+}
+assertEquals([1, 1, 1], f1(1));
+assertEquals([0.1, 0.1, 0.1], f1(0.1));
+assertEquals([{}, {}, {}], f1({}));
+assertEquals([1, 1, 1], f1(1));
+
+function f1_(x) {
+  return [...[x, x, x]];
+}
+%PrepareFunctionForOptimization(f1_);
+assertEquals([1, 1, 1], f1_(1));
+%OptimizeFunctionOnNextCall(f1_);
+assertEquals([1, 1, 1], f1_(1));
+assertEquals([0.1, 0.1, 0.1], f1_(0.1));
+assertEquals([{}, {}, {}], f1_({}));
+assertEquals([1, 1, 1], f1_(1));
+
+
+function f2(x) {
+  return [...[x, x, x], ,];
+}
+assertEquals([1, 1, 1, ,], f2(1));
+assertEquals([0.1, 0.1, 0.1, ,], f2(0.1));
+assertEquals([{}, {}, {}, ,], f2({}));
+assertEquals([1, 1, 1, ,], f2(1));
+
+function f2_(x) {
+  return [...[x, x, x], ,];
+}
+%PrepareFunctionForOptimization(f2_);
+assertEquals([1, 1, 1, ,], f2_(1));
+%OptimizeFunctionOnNextCall(f2_);
+assertEquals([1, 1, 1, ,], f2_(1));
+assertEquals([0.1, 0.1, 0.1, ,], f2_(0.1));
+assertEquals([{}, {}, {}, ,], f2_({}));
+assertEquals([1, 1, 1, ,], f2_(1));
+
+
+function f3(it) {
+  return [...it, ,];
+}
+assertEquals([1, 0.1, "1", , ], f3(g(1, 0.1, "1")));
+assertEquals([{}, 0.1, "1", , ], f3(g({}, 0.1, "1")));
+assertEquals([0, 0, 0, , ], f3(g(0, 0, 0)));
+assertEquals([1, 0.1, "1", , ], f3(g(1, 0.1, "1")));
+
+function f3_(it) {
+  return [...it, ,];
+}
+%PrepareFunctionForOptimization(f3_);
+assertEquals([1, 0.1, "1", , ], f3_(g(1, 0.1, "1")));
+%OptimizeFunctionOnNextCall(f3_);
+assertEquals([1, 0.1, "1", , ], f3_(g(1, 0.1, "1")));
+assertEquals([{}, 0.1, "1", , ], f3_(g({}, 0.1, "1")));
+assertEquals([0, 0, 0, , ], f3_(g(0, 0, 0)));
+assertEquals([1, 0.1, "1", , ], f3_(g(1, 0.1, "1")));
+
+
+function f4(x) {
+  return [...[x, x, x]];
+}
+assertEquals([1, 1, 1], f4(1));
+assertEquals([0.1, 0.1, 0.1], f4(0.1));
+assertEquals([{}, {}, {}], f4({}));
+assertEquals([1, 1, 1], f4(1));
+
+function f4_(x) {
+  return [...[x, x, x]];
+}
+%PrepareFunctionForOptimization(f4_);
+assertEquals([1, 1, 1], f4_(1));
+%OptimizeFunctionOnNextCall(f4_);
+assertEquals([1, 1, 1], f4_(1));
+assertEquals([0.1, 0.1, 0.1], f4_(0.1));
+assertEquals([{}, {}, {}], f4_({}));
+assertEquals([1, 1, 1], f4_(1));
+
+
+function f5(x) {
+  return [...[x, x, x], ,];
+}
+assertEquals([1, 1, 1, ,], f5(1));
+assertEquals([0.1, 0.1, 0.1, ,], f5(0.1));
+assertEquals([{}, {}, {}, ,], f5({}));
+assertEquals([1, 1, 1, ,], f5(1));
+
+function f5_(x) {
+  return [...[x, x, x], ,];
+}
+%PrepareFunctionForOptimization(f5_);
+assertEquals([1, 1, 1, ,], f5_(1));
+%OptimizeFunctionOnNextCall(f5_);
+assertEquals([1, 1, 1, ,], f5_(1));
+assertEquals([0.1, 0.1, 0.1, ,], f5_(0.1));
+assertEquals([{}, {}, {}, ,], f5_({}));
+assertEquals([1, 1, 1, ,], f5_(1));
+
+
+function f6(it) {
+  return [...it, ,];
+}
+assertEquals([1, 0.1, "1", , ], f6(g(1, 0.1, "1")));
+assertEquals([{}, 0.1, "1", , ], f6(g({}, 0.1, "1")));
+assertEquals([0, 0, 0, , ], f6(g(0, 0, 0)));
+assertEquals([1, 0.1, "1", , ], f6(g(1, 0.1, "1")));
+
+function f6_(it) {
+  return [...it, ,];
+}
+%PrepareFunctionForOptimization(f6_);
+assertEquals([1, 0.1, "1", , ], f6_(g(1, 0.1, "1")));
+%OptimizeFunctionOnNextCall(f6_);
+assertEquals([1, 0.1, "1", , ], f6_(g(1, 0.1, "1")));
+assertEquals([{}, 0.1, "1", , ], f6_(g({}, 0.1, "1")));
+assertEquals([0, 0, 0, , ], f6_(g(0, 0, 0)));
+assertEquals([1, 0.1, "1", , ], f6_(g(1, 0.1, "1")));
+
+
+function f7(it) {
+  return [...it];
+}
+assertEquals([1, 0.1, "1"], f7(G(1, 0.1, "1")));
+assertEquals([{}, 0.1, "1"], f7(G({}, 0.1, "1")));
+assertEquals([0, 0, 0], f7(G(0, 0, 0)));
+assertEquals([1, 0.1, "1"], f7(G(1, 0.1, "1")));
+
+function f7_(it) {
+  return [...it];
+}
+%PrepareFunctionForOptimization(f7_);
+assertEquals([1, 0.1, "1"], f7_(G(1, 0.1, "1")));
+%OptimizeFunctionOnNextCall(f7_);
+assertEquals([1, 0.1, "1"], f7_(G(1, 0.1, "1")));
+assertEquals([{}, 0.1, "1"], f7_(G({}, 0.1, "1")));
+assertEquals([0, 0, 0], f7_(G(0, 0, 0)));
+assertEquals([1, 0.1, "1"], f7_(G(1, 0.1, "1")));
+
+
+function f8(it) {
+  return [...it, ,];
+}
+assertEquals([1, 0.1, "1", , ], f8(G(1, 0.1, "1")));
+assertEquals([{}, 0.1, "1", , ], f8(G({}, 0.1, "1")));
+assertEquals([0, 0, 0, , ], f8(G(0, 0, 0)));
+assertEquals([1, 0.1, "1", , ], f8(G(1, 0.1, "1")));
+
+function f8_(it) {
+  return [...it, ,];
+}
+%PrepareFunctionForOptimization(f8_);
+assertEquals([1, 0.1, "1", , ], f8_(G(1, 0.1, "1")));
+%OptimizeFunctionOnNextCall(f8_);
+assertEquals([1, 0.1, "1", , ], f8_(G(1, 0.1, "1")));
+assertEquals([{}, 0.1, "1", , ], f8_(G({}, 0.1, "1")));
+assertEquals([0, 0, 0, , ], f8_(G(0, 0, 0)));
+assertEquals([1, 0.1, "1", , ], f8_(G(1, 0.1, "1")));
+
+
+// Megamorphic
+function* f9() {
+  for (let i = 0; i < 160000; ++i) yield i;
+}
+%PrepareFunctionForOptimization(f9);
+let a = [...f9()];
+assertEquals(160000, a.length);
+assertEquals(0, a[0]);
+assertEquals(159999, a[159999]);
+%OptimizeFunctionOnNextCall(f9);
+a = [...f9()];
+assertEquals(160000, a.length);
+assertEquals(0, a[0]);
+assertEquals(159999, a[159999]);
+
+// Slow stub
+function f10(b) {
+  let x = [
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+    ...b];
+  return x.length;
+}
+%PrepareFunctionForOptimization(f10);
+assertEquals(4335, f10([3.3, 3.3, 3.3]));
+assertEquals(4335, f10([{}, "", 3.3]));
+%OptimizeFunctionOnNextCall(f10);
+assertEquals(4335, f10([{}, "", 3.3]));
+assertEquals(4332, f10([]));
+
+
+}  // top-level scope
diff --git a/src/v8/test/mjsunit/es6/spread-array-mutated-prototype.js b/src/v8/test/mjsunit/es6/spread-array-mutated-prototype.js
new file mode 100644
index 0000000..029983b
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/spread-array-mutated-prototype.js
@@ -0,0 +1,240 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// NOTE:
+// Tests in this file are meant to run in the presence of an invalidated
+// NoElementsProtector, as effected by the following line.
+Array.prototype[0] = 42;
+delete Array.prototype[0];
+
+
+(function TestBasics() {
+  var a = [1, 2];
+  var b = [...a];
+  assertArrayEquals([1, 2], b)
+
+  assertArrayEquals(['a', 'b', 'c', 'd', 'e', 'f'],
+                    ['a', ...'bc', 'd', ...'ef'])
+})();
+
+
+var log = [];
+
+function* gen(n) {
+  log.push(n, 1);
+  yield 1;
+  log.push(n, 2);
+  yield 2;
+  log.push(n, 3);
+  yield 3;
+  log.push(n, 'done');
+}
+
+function id(v) {
+  log.push(v);
+  return v;
+}
+
+
+(function TestGenerator() {
+  assertArrayEquals([1, 2, 3], [...gen('a')]);
+  assertArrayEquals(['x', 1, 2, 3, 'y', 1, 2, 3, 'z'],
+                    ['x', ...gen('a'), 'y', ...gen('b'), 'z']);
+})();
+
+
+(function TestOrderOfExecution() {
+  log = [];
+  assertArrayEquals(['x', 1, 2, 3, 'y', 1, 2, 3, 'z'],
+                    [id('x'), ...gen('a'), id('y'), ...gen('b'), id('z')]);
+  assertArrayEquals([
+    'x', 'a', 1, 'a', 2, 'a', 3, 'a', 'done',
+    'y', 'b', 1, 'b', 2, 'b', 3, 'b', 'done',
+    'z'
+  ], log);
+})();
+
+
+(function TestNotIterable() {
+  var a;
+  assertThrows(function() {
+    a = [...42];
+  }, TypeError);
+  assertSame(undefined, a);
+
+
+})();
+
+
+(function TestInvalidIterator() {
+  var iter = {
+    [Symbol.iterator]: 42
+  };
+  var a;
+  assertThrows(function() {
+    a = [...iter];
+  }, TypeError);
+  assertSame(undefined, a);
+})();
+
+
+(function TestIteratorNotAnObject() {
+  var iter = {
+    [Symbol.iterator]() {
+      return 42;
+    }
+  };
+  var a;
+  assertThrows(function() {
+    a = [...iter];
+  }, TypeError);
+  assertSame(undefined, a);
+})();
+
+
+(function TestIteratorNoNext() {
+  var iter = {
+    [Symbol.iterator]() {
+      return {};
+    }
+  };
+  var a;
+  assertThrows(function() {
+    a = [...iter];
+  }, TypeError);
+  assertSame(undefined, a);
+})();
+
+
+(function TestIteratorResultDoneThrows() {
+  function MyError() {}
+  var iter = {
+    [Symbol.iterator]() {
+      return {
+        next() {
+          return {
+            get done() {
+              throw new MyError();
+            }
+          }
+        }
+      };
+    }
+  };
+  var a;
+  assertThrows(function() {
+    a = [...iter];
+  }, MyError);
+  assertSame(undefined, a);
+})();
+
+
+(function TestIteratorResultValueThrows() {
+  function MyError() {}
+  var iter = {
+    [Symbol.iterator]() {
+      return {
+        next() {
+          return {
+            done: false,
+            get value() {
+              throw new MyError();
+            }
+          }
+        }
+      };
+    }
+  };
+  var a;
+  assertThrows(function() {
+    a = [...iter];
+  }, MyError);
+  assertSame(undefined, a);
+})();
+
+
+(function TestOptimize() {
+  function f() {
+    return [...'abc'];
+  }
+  %PrepareFunctionForOptimization(f);
+  assertArrayEquals(['a', 'b', 'c'], f());
+  %OptimizeFunctionOnNextCall(f);
+  assertArrayEquals(['a', 'b', 'c'], f());
+})();
+
+
+(function TestDeoptimize() {
+  var iter = {
+    [Symbol.iterator]() {
+      var i = 0;
+      return {
+        next() {
+          %DeoptimizeFunction(f);
+          return {value: ++i, done: i === 3};
+        }
+      };
+    }
+  };
+  function f() {
+    return [0, ...iter];
+  }
+
+  assertArrayEquals([0, 1, 2], f());
+})();
+
+
+(function TestPrototypeSetter1() {
+  Object.defineProperty(Array.prototype, 3, {set() {throw 666}})
+  Object.defineProperty(Array.prototype, 4, {set() {throw 666}})
+
+  function f() {
+    return ['a', ...['b', 'c', 'd'], 'e']
+  }
+
+  %PrepareFunctionForOptimization(f);
+  assertArrayEquals(['a', 'b', 'c', 'd', 'e'], f());
+  %OptimizeFunctionOnNextCall(f);
+  assertArrayEquals(['a', 'b', 'c', 'd', 'e'], f());
+
+  delete Array.prototype[3];
+  delete Array.prototype[4];
+})();
+
+
+(function TestPrototypeSetter2() {
+  Object.defineProperty(Array.prototype.__proto__, 3, {set() {throw 666}})
+  Object.defineProperty(Array.prototype.__proto__, 4, {set() {throw 666}})
+
+  function f() {
+    return ['a', ...['b', 'c', 'd'], 'e']
+  }
+
+  %PrepareFunctionForOptimization(f);
+  assertArrayEquals(['a', 'b', 'c', 'd', 'e'], f());
+  %OptimizeFunctionOnNextCall(f);
+  assertArrayEquals(['a', 'b', 'c', 'd', 'e'], f());
+
+  delete Array.prototype.__proto__[3];
+  delete Array.prototype.__proto__[4];
+})();
+
+
+(function TestPrototypeProxy() {
+  const backup = Array.prototype.__proto__;
+  Array.prototype.__proto__ = new Proxy({}, {set() {throw 666}});
+
+  function f() {
+    return ['a', ...['b', 'c', 'd'], 'e']
+  }
+
+  %PrepareFunctionForOptimization(f);
+  assertArrayEquals(['a', 'b', 'c', 'd', 'e'], f());
+  %OptimizeFunctionOnNextCall(f);
+  assertArrayEquals(['a', 'b', 'c', 'd', 'e'], f());
+
+  Object.setPrototypeOf(Array.prototype, backup);
+})();
diff --git a/src/v8/test/mjsunit/es6/spread-array-pristine-prototype.js b/src/v8/test/mjsunit/es6/spread-array-pristine-prototype.js
new file mode 100644
index 0000000..9bf3a9a
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/spread-array-pristine-prototype.js
@@ -0,0 +1,184 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// NOTE:
+// Tests in this file are meant to run in the presence of a valid
+// NoElementsProtector. Do not touch Array.prototype here.
+
+(function TestBasics() {
+  var a = [1, 2];
+  var b = [...a];
+  assertArrayEquals([1, 2], b)
+
+  assertArrayEquals(['a', 'b', 'c', 'd', 'e', 'f'],
+                    ['a', ...'bc', 'd', ...'ef'])
+})();
+
+
+var log = [];
+
+function* gen(n) {
+  log.push(n, 1);
+  yield 1;
+  log.push(n, 2);
+  yield 2;
+  log.push(n, 3);
+  yield 3;
+  log.push(n, 'done');
+}
+
+function id(v) {
+  log.push(v);
+  return v;
+}
+
+
+(function TestGenerator() {
+  assertArrayEquals([1, 2, 3], [...gen('a')]);
+  assertArrayEquals(['x', 1, 2, 3, 'y', 1, 2, 3, 'z'],
+                    ['x', ...gen('a'), 'y', ...gen('b'), 'z']);
+})();
+
+
+(function TestOrderOfExecution() {
+  log = [];
+  assertArrayEquals(['x', 1, 2, 3, 'y', 1, 2, 3, 'z'],
+                    [id('x'), ...gen('a'), id('y'), ...gen('b'), id('z')]);
+  assertArrayEquals([
+    'x', 'a', 1, 'a', 2, 'a', 3, 'a', 'done',
+    'y', 'b', 1, 'b', 2, 'b', 3, 'b', 'done',
+    'z'
+  ], log);
+})();
+
+
+(function TestNotIterable() {
+  var a;
+  assertThrows(function() {
+    a = [...42];
+  }, TypeError);
+  assertSame(undefined, a);
+
+
+})();
+
+
+(function TestInvalidIterator() {
+  var iter = {
+    [Symbol.iterator]: 42
+  };
+  var a;
+  assertThrows(function() {
+    a = [...iter];
+  }, TypeError);
+  assertSame(undefined, a);
+})();
+
+
+(function TestIteratorNotAnObject() {
+  var iter = {
+    [Symbol.iterator]() {
+      return 42;
+    }
+  };
+  var a;
+  assertThrows(function() {
+    a = [...iter];
+  }, TypeError);
+  assertSame(undefined, a);
+})();
+
+
+(function TestIteratorNoNext() {
+  var iter = {
+    [Symbol.iterator]() {
+      return {};
+    }
+  };
+  var a;
+  assertThrows(function() {
+    a = [...iter];
+  }, TypeError);
+  assertSame(undefined, a);
+})();
+
+
+(function TestIteratorResultDoneThrows() {
+  function MyError() {}
+  var iter = {
+    [Symbol.iterator]() {
+      return {
+        next() {
+          return {
+            get done() {
+              throw new MyError();
+            }
+          }
+        }
+      };
+    }
+  };
+  var a;
+  assertThrows(function() {
+    a = [...iter];
+  }, MyError);
+  assertSame(undefined, a);
+})();
+
+
+(function TestIteratorResultValueThrows() {
+  function MyError() {}
+  var iter = {
+    [Symbol.iterator]() {
+      return {
+        next() {
+          return {
+            done: false,
+            get value() {
+              throw new MyError();
+            }
+          }
+        }
+      };
+    }
+  };
+  var a;
+  assertThrows(function() {
+    a = [...iter];
+  }, MyError);
+  assertSame(undefined, a);
+})();
+
+
+(function TestOptimize() {
+  function f() {
+    return [...'abc'];
+  }
+  %PrepareFunctionForOptimization(f);
+  assertArrayEquals(['a', 'b', 'c'], f());
+  %OptimizeFunctionOnNextCall(f);
+  assertArrayEquals(['a', 'b', 'c'], f());
+})();
+
+
+(function TestDeoptimize() {
+  var iter = {
+    [Symbol.iterator]() {
+      var i = 0;
+      return {
+        next() {
+          %DeoptimizeFunction(f);
+          return {value: ++i, done: i === 3};
+        }
+      };
+    }
+  };
+  function f() {
+    return [0, ...iter];
+  }
+
+  assertArrayEquals([0, 1, 2], f());
+})();
diff --git a/src/v8/test/mjsunit/es6/spread-array-prototype-proxy.js b/src/v8/test/mjsunit/es6/spread-array-prototype-proxy.js
new file mode 100644
index 0000000..0c59c85
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/spread-array-prototype-proxy.js
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+
+(function TestPrototypeProxy() {
+  const backup = Array.prototype.__proto__;
+  Array.prototype.__proto__ = new Proxy({}, {set() {throw 666}});
+
+  function f() {
+    return ['a', ...['b', 'c', 'd'], 'e']
+  }
+
+  %PrepareFunctionForOptimization(f);
+  assertArrayEquals(['a', 'b', 'c', 'd', 'e'], f());
+  %OptimizeFunctionOnNextCall(f);
+  assertArrayEquals(['a', 'b', 'c', 'd', 'e'], f());
+
+  Object.setPrototypeOf(Array.prototype, backup);
+})();
diff --git a/src/v8/test/mjsunit/es6/spread-array-prototype-setter1.js b/src/v8/test/mjsunit/es6/spread-array-prototype-setter1.js
new file mode 100644
index 0000000..85cb996
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/spread-array-prototype-setter1.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+
+(function TestPrototypeSetter1() {
+  Object.defineProperty(Array.prototype, 3, {set() {throw 666}})
+  Object.defineProperty(Array.prototype, 4, {set() {throw 666}})
+
+  function f() {
+    return ['a', ...['b', 'c', 'd'], 'e']
+  }
+
+  %PrepareFunctionForOptimization(f);
+  assertArrayEquals(['a', 'b', 'c', 'd', 'e'], f());
+  %OptimizeFunctionOnNextCall(f);
+  assertArrayEquals(['a', 'b', 'c', 'd', 'e'], f());
+
+  delete Array.prototype[3];
+  delete Array.prototype[4];
+})();
diff --git a/src/v8/test/mjsunit/es6/spread-array-prototype-setter2.js b/src/v8/test/mjsunit/es6/spread-array-prototype-setter2.js
new file mode 100644
index 0000000..d20b9e2
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/spread-array-prototype-setter2.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+
+(function TestPrototypeSetter2() {
+  Object.defineProperty(Array.prototype.__proto__, 3, {set() {throw 666}})
+  Object.defineProperty(Array.prototype.__proto__, 4, {set() {throw 666}})
+
+  function f() {
+    return ['a', ...['b', 'c', 'd'], 'e']
+  }
+
+  %PrepareFunctionForOptimization(f);
+  assertArrayEquals(['a', 'b', 'c', 'd', 'e'], f());
+  %OptimizeFunctionOnNextCall(f);
+  assertArrayEquals(['a', 'b', 'c', 'd', 'e'], f());
+
+  delete Array.prototype.__proto__[3];
+  delete Array.prototype.__proto__[4];
+})();
diff --git a/src/v8/test/mjsunit/es6/spread-call.js b/src/v8/test/mjsunit/es6/spread-call.js
index 7403e07..3d3232f 100644
--- a/src/v8/test/mjsunit/es6/spread-call.js
+++ b/src/v8/test/mjsunit/es6/spread-call.js
@@ -161,6 +161,7 @@
   assertEquals(36, O.sum(0, ...[1], 2, 3, ...[4, 5], 6, 7, 8));
   assertEquals(45, O.sum(0, ...[1], 2, 3, ...[4, 5], 6, 7, 8, ...[9]));
 };
+%PrepareFunctionForOptimization(testSpreadCallsStrict);
 testSpreadCallsStrict();
 %OptimizeFunctionOnNextCall(testSpreadCallsStrict);
 testSpreadCallsStrict();
diff --git a/src/v8/test/mjsunit/es6/string-endswith.js b/src/v8/test/mjsunit/es6/string-endswith.js
index b776ccc..c9d5634 100644
--- a/src/v8/test/mjsunit/es6/string-endswith.js
+++ b/src/v8/test/mjsunit/es6/string-endswith.js
@@ -417,3 +417,13 @@
 }, TypeError);
 re[Symbol.match] = false;
 assertEquals(false, "".startsWith(re));
+
+let didThrow = false;
+try {
+  "".endsWith(/./);
+} catch (err) {
+  didThrow = true;
+  assertEquals(err.name, "TypeError");
+  assertEquals(err.message, "First argument to String.prototype.endsWith must not be a regular expression");
+}
+assertTrue(didThrow);
diff --git a/src/v8/test/mjsunit/es6/string-fromcodepoint.js b/src/v8/test/mjsunit/es6/string-fromcodepoint.js
index c4634ac..9273432 100644
--- a/src/v8/test/mjsunit/es6/string-fromcodepoint.js
+++ b/src/v8/test/mjsunit/es6/string-fromcodepoint.js
@@ -5,6 +5,8 @@
 // Tests taken from:
 // https://github.com/mathiasbynens/String.fromCodePoint
 
+// Flags: --allow-natives-syntax
+
 assertEquals(String.fromCodePoint.length, 1);
 assertEquals(String.propertyIsEnumerable("fromCodePoint"), false);
 
@@ -14,34 +16,38 @@
 assertEquals(String.fromCodePoint(0), "\0");
 assertEquals(String.fromCodePoint(0x1D306), "\uD834\uDF06");
 assertEquals(
-    String.fromCodePoint(0x1D306, 0x61, 0x1D307),
-    "\uD834\uDF06a\uD834\uDF07");
+  String.fromCodePoint(0x1D306, 0x61, 0x1D307),
+  "\uD834\uDF06a\uD834\uDF07");
 assertEquals(String.fromCodePoint(0x61, 0x62, 0x1D307), "ab\uD834\uDF07");
 assertEquals(String.fromCodePoint(false), "\0");
 assertEquals(String.fromCodePoint(null), "\0");
 
-assertThrows(function() { String.fromCodePoint("_"); }, RangeError);
-assertThrows(function() { String.fromCodePoint("+Infinity"); }, RangeError);
-assertThrows(function() { String.fromCodePoint("-Infinity"); }, RangeError);
-assertThrows(function() { String.fromCodePoint(-1); }, RangeError);
-assertThrows(function() { String.fromCodePoint(0x10FFFF + 1); }, RangeError);
-assertThrows(function() { String.fromCodePoint(3.14); }, RangeError);
-assertThrows(function() { String.fromCodePoint(3e-2); }, RangeError);
-assertThrows(function() { String.fromCodePoint(-Infinity); }, RangeError);
-assertThrows(function() { String.fromCodePoint(+Infinity); }, RangeError);
-assertThrows(function() { String.fromCodePoint(NaN); }, RangeError);
-assertThrows(function() { String.fromCodePoint(undefined); }, RangeError);
-assertThrows(function() { String.fromCodePoint({}); }, RangeError);
-assertThrows(function() { String.fromCodePoint(/./); }, RangeError);
-assertThrows(function() { String.fromCodePoint({
-  valueOf: function() { throw Error(); } });
+assertThrows(function () { String.fromCodePoint("_"); }, RangeError);
+assertThrows(function () { String.fromCodePoint("+Infinity"); }, RangeError);
+assertThrows(function () { String.fromCodePoint("-Infinity"); }, RangeError);
+assertThrows(function () { String.fromCodePoint(-1); }, RangeError);
+assertThrows(function () { String.fromCodePoint(0x10FFFF + 1); }, RangeError);
+assertThrows(function () { String.fromCodePoint(3.14); }, RangeError);
+assertThrows(function () { String.fromCodePoint(3e-2); }, RangeError);
+assertThrows(function () { String.fromCodePoint(-Infinity); }, RangeError);
+assertThrows(function () { String.fromCodePoint(+Infinity); }, RangeError);
+assertThrows(function () { String.fromCodePoint(NaN); }, RangeError);
+assertThrows(function () { String.fromCodePoint(undefined); }, RangeError);
+assertThrows(function () { String.fromCodePoint({}); }, RangeError);
+assertThrows(function () { String.fromCodePoint(/./); }, RangeError);
+assertThrows(function () {
+  String.fromCodePoint({
+    valueOf: function () { throw Error(); }
+  });
 }, Error);
-assertThrows(function() { String.fromCodePoint({
-  valueOf: function() { throw Error(); } });
+assertThrows(function () {
+  String.fromCodePoint({
+    valueOf: function () { throw Error(); }
+  });
 }, Error);
 var tmp = 0x60;
 assertEquals(String.fromCodePoint({
-  valueOf: function() { ++tmp; return tmp; }
+  valueOf: function () { ++tmp; return tmp; }
 }), "a");
 assertEquals(tmp, 0x61);
 
diff --git a/src/v8/test/mjsunit/es6/string-iterator.js b/src/v8/test/mjsunit/es6/string-iterator.js
index b63de36..d47a03f 100644
--- a/src/v8/test/mjsunit/es6/string-iterator.js
+++ b/src/v8/test/mjsunit/es6/string-iterator.js
@@ -100,3 +100,12 @@
   var iterator = sliced_string[Symbol.iterator]();
 }
 TestSlicedStringRegression();
+
+
+(function(){
+  var str = "\uD83C\uDF1F\u5FCD\u8005\u306E\u653B\u6483\uD83C\uDF1F";
+  var arr = [...str];
+  assertEquals(["\uD83C\uDF1F", "\u5FCD", "\u8005", "\u306E", "\u653B",
+                "\u6483", "\uD83C\uDF1F"], arr);
+  assertEquals(7, arr.length);
+})();
diff --git a/src/v8/test/mjsunit/es6/string-iterator2.js b/src/v8/test/mjsunit/es6/string-iterator2.js
new file mode 100644
index 0000000..6bfd51a
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/string-iterator2.js
@@ -0,0 +1,26 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// Tests for spreading primitive strings.
+
+assertEquals([...''], []);
+
+var str = 'ott';
+assertEquals(['o', 't', 't'], [...str]);
+assertTrue(%StringIteratorProtector());
+
+str[Symbol.iterator] = {};
+// Symbol.iterator can't be set on primitive strings, so it shouldn't invalidate
+// the protector.
+assertTrue(%StringIteratorProtector());
+
+// This changes the String Iterator prototype. No more tests should be run after
+// this in the same instance.
+var iterator = str[Symbol.iterator]();
+iterator.__proto__.next = () => ({value : undefined, done : true});
+
+assertFalse(%StringIteratorProtector());
+assertEquals([], [...str]);
diff --git a/src/v8/test/mjsunit/es6/string-iterator3.js b/src/v8/test/mjsunit/es6/string-iterator3.js
new file mode 100644
index 0000000..1b0e027
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/string-iterator3.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// Tests for primitive strings.
+
+var str = 'ott';
+assertTrue(%StringIteratorProtector());
+assertEquals(['o', 't', 't'], [...str]);
+
+// This changes the String prototype. No more tests should be run after this in
+// the same instance.
+str.__proto__[Symbol.iterator] =
+    function() {
+      return {next : () => ({value : undefined, done : true})};
+    };
+assertFalse(%StringIteratorProtector());
+assertEquals([], [...str]);
diff --git a/src/v8/test/mjsunit/es6/string-iterator4.js b/src/v8/test/mjsunit/es6/string-iterator4.js
new file mode 100644
index 0000000..48c6521
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/string-iterator4.js
@@ -0,0 +1,30 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// Tests for wrapped strings.
+
+var str = new String('ott');
+assertTrue(%StringIteratorProtector());
+assertEquals(['o', 't', 't'], [...str]);
+
+function iterator_fn() {
+  return {next : () => ({value : undefined, done : true})};
+};
+
+str[Symbol.iterator] = iterator_fn;
+// This shouldn't invalidate the protector, because it doesn't support String
+// objects.
+assertTrue(%StringIteratorProtector());
+assertEquals([], [...str]);
+
+
+var str2 = new String('ott');
+assertEquals(['o', 't', 't'], [...str2]);
+// This changes the String prototype. No more tests should be run after this in
+// the same instance.
+str2.__proto__[Symbol.iterator] = iterator_fn;
+assertFalse(%StringIteratorProtector());
+assertEquals([], [...str2]);
diff --git a/src/v8/test/mjsunit/es6/string-iterator5.js b/src/v8/test/mjsunit/es6/string-iterator5.js
new file mode 100644
index 0000000..ec9754a
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/string-iterator5.js
@@ -0,0 +1,15 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Tests for primitive strings.
+
+var iterator = 'ott'[Symbol.iterator]();
+
+// These modifications shouldn't invalidate the String iterator protector.
+iterator.__proto__.fonts = {};
+assertTrue(%StringIteratorProtector());
+iterator.__proto__[0] = 0;
+assertTrue(%StringIteratorProtector());
diff --git a/src/v8/test/mjsunit/es6/string-iterator6.js b/src/v8/test/mjsunit/es6/string-iterator6.js
new file mode 100644
index 0000000..d1cd1f3
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/string-iterator6.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+assertTrue(%StringIteratorProtector());
+
+delete 'ott'.__proto__[Symbol.iterator];
+
+assertFalse(%StringIteratorProtector());
diff --git a/src/v8/test/mjsunit/es6/string-iterator7.js b/src/v8/test/mjsunit/es6/string-iterator7.js
new file mode 100644
index 0000000..387c6e8
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/string-iterator7.js
@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+assertTrue(%StringIteratorProtector());
+
+const p = ""[Symbol.iterator]().__proto__;
+let x = Object.create(p);
+x.next = 42;
+
+assertTrue(%StringIteratorProtector());
diff --git a/src/v8/test/mjsunit/es6/string-iterator8.js b/src/v8/test/mjsunit/es6/string-iterator8.js
new file mode 100644
index 0000000..dbd4b7c
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/string-iterator8.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+assertTrue(%StringIteratorProtector());
+
+var proto = String.prototype;
+
+String.prototype = {};
+
+assertEquals(proto, String.prototype);
+assertTrue(%StringIteratorProtector());
diff --git a/src/v8/test/mjsunit/es6/super-with-spread-modify-array-iterator.js b/src/v8/test/mjsunit/es6/super-with-spread-modify-array-iterator.js
index c1311af..09f43b7 100644
--- a/src/v8/test/mjsunit/es6/super-with-spread-modify-array-iterator.js
+++ b/src/v8/test/mjsunit/es6/super-with-spread-modify-array-iterator.js
@@ -23,6 +23,7 @@
   function testRestPoint(x, y) {
     return new RestPoint(x, y);
   }
+  %PrepareFunctionForOptimization(testRestPoint);
   testRestPoint(1, 2);
   testRestPoint(1, 2);
   %OptimizeFunctionOnNextCall(testRestPoint);
diff --git a/src/v8/test/mjsunit/es6/super-with-spread-modify-next.js b/src/v8/test/mjsunit/es6/super-with-spread-modify-next.js
index cd7798b..105830e 100644
--- a/src/v8/test/mjsunit/es6/super-with-spread-modify-next.js
+++ b/src/v8/test/mjsunit/es6/super-with-spread-modify-next.js
@@ -28,6 +28,7 @@
   function testArgumentsPoint(x, y) {
     return new ArgumentsPoint(x, y);
   }
+  %PrepareFunctionForOptimization(testArgumentsPoint);
   testArgumentsPoint(1, 2);
   testArgumentsPoint(1, 2);
   %OptimizeFunctionOnNextCall(testArgumentsPoint);
diff --git a/src/v8/test/mjsunit/es6/super-with-spread.js b/src/v8/test/mjsunit/es6/super-with-spread.js
index b0aea82..6fa73c0 100644
--- a/src/v8/test/mjsunit/es6/super-with-spread.js
+++ b/src/v8/test/mjsunit/es6/super-with-spread.js
@@ -15,6 +15,7 @@
   }
 
   function testBaselineAndOpt(func) {
+    %PrepareFunctionForOptimization(func);
     func(1, 2);
     func(1, 2);
     %OptimizeFunctionOnNextCall(func);
diff --git a/src/v8/test/mjsunit/es6/symbols.js b/src/v8/test/mjsunit/es6/symbols.js
index d83e217..026507e 100644
--- a/src/v8/test/mjsunit/es6/symbols.js
+++ b/src/v8/test/mjsunit/es6/symbols.js
@@ -44,6 +44,7 @@
   function indirectSymbol() { return Symbol() }
   function indirect() { return indirectSymbol() }
   for (var i = 0; i < 2; ++i) {
+    %PrepareFunctionForOptimization(indirect);
     for (var j = 0; j < 5; ++j) {
       symbols.push(Symbol())
       symbols.push(Symbol(undefined))
@@ -67,8 +68,6 @@
     assertEquals("symbol", typeof symbols[i])
     assertTrue(typeof symbols[i] === "symbol")
     assertFalse(%SymbolIsPrivate(symbols[i]))
-    assertEquals(null, %_ClassOf(symbols[i]))
-    assertEquals("Symbol", %_ClassOf(Object(symbols[i])))
   }
 }
 TestType()
@@ -521,6 +520,7 @@
   var throwFuncs = [lt, gt, le, ge, lt_same, gt_same, le_same, ge_same];
 
   for (var f of throwFuncs) {
+    %PrepareFunctionForOptimization(f);
     assertThrows(f, TypeError);
     %OptimizeFunctionOnNextCall(f);
     assertThrows(f, TypeError);
diff --git a/src/v8/test/mjsunit/es6/templates.js b/src/v8/test/mjsunit/es6/templates.js
index 3eb73e4..3da06b2 100644
--- a/src/v8/test/mjsunit/es6/templates.js
+++ b/src/v8/test/mjsunit/es6/templates.js
@@ -342,27 +342,30 @@
   var a = 1;
   var b = 2;
 
-  tag`head${a}tail`;
-  tag`head${b}tail`;
-
+  // Call-sites are cached by ParseNode. Same tag call in a loop
+  // means same template object
+  for (var i = 0; i < 2; ++i) {
+    tag`head${i == 0 ? a : b}tail`;
+  }
   assertEquals(2, callSites.length);
   assertSame(callSites[0], callSites[1]);
 
-  eval("tag`head${a}tail`");
-  assertEquals(3, callSites.length);
-  assertSame(callSites[1], callSites[2]);
-
-  eval("tag`head${b}tail`");
+  // Tag calls within eval() never have the same ParseNode as the same tag
+  // call from a different eval() invocation.
+  for (var i = 0; i < 2; ++i) {
+    eval("tag`head${i == 0 ? a : b}tail`");
+  }
   assertEquals(4, callSites.length);
-  assertSame(callSites[2], callSites[3]);
+  assertTrue(callSites[1] !== callSites[2]);
+  assertTrue(callSites[2] !== callSites[3]);
 
   (new Function("tag", "a", "b", "return tag`head${a}tail`;"))(tag, 1, 2);
   assertEquals(5, callSites.length);
-  assertSame(callSites[3], callSites[4]);
+  assertTrue(callSites[3] !== callSites[4]);
 
   (new Function("tag", "a", "b", "return tag`head${b}tail`;"))(tag, 1, 2);
   assertEquals(6, callSites.length);
-  assertSame(callSites[4], callSites[5]);
+  assertTrue(callSites[4] !== callSites[5]);
 
   callSites = [];
 
@@ -374,17 +377,19 @@
 
   callSites = [];
 
-  eval("tag`\\\r\n\\\n\\\r`");
-  eval("tag`\\\r\n\\\n\\\r`");
+  for (var i = 0; i < 2; ++i) {
+    eval("tag`\\\r\n\\\n\\\r`");
+  }
   assertEquals(2, callSites.length);
-  assertSame(callSites[0], callSites[1]);
+  assertTrue(callSites[0] !== callSites[1]);
   assertEquals("", callSites[0][0]);
   assertEquals("\\\n\\\n\\\n", callSites[0].raw[0]);
 
   callSites = [];
 
-  tag`\uc548\ub155`;
-  tag`\uc548\ub155`;
+  for (var i = 0; i < 2; ++i) {
+    tag`\uc548\ub155`;
+  }
   assertEquals(2, callSites.length);
   assertSame(callSites[0], callSites[1]);
   assertEquals("안녕", callSites[0][0]);
@@ -720,18 +725,143 @@
 (function testTaggedTemplateInvalidAssignmentTargetStrict() {
   "use strict";
   function f() {}
-  assertThrows(() => Function("++f`foo`"), ReferenceError);
-  assertThrows(() => Function("f`foo`++"), ReferenceError);
-  assertThrows(() => Function("--f`foo`"), ReferenceError);
-  assertThrows(() => Function("f`foo`--"), ReferenceError);
-  assertThrows(() => Function("f`foo` = 1"), ReferenceError);
+  assertThrows(() => Function("++f`foo`"), SyntaxError);
+  assertThrows(() => Function("f`foo`++"), SyntaxError);
+  assertThrows(() => Function("--f`foo`"), SyntaxError);
+  assertThrows(() => Function("f`foo`--"), SyntaxError);
+  assertThrows(() => Function("f`foo` = 1"), SyntaxError);
 })();
 
 (function testTaggedTemplateInvalidAssignmentTargetSloppy() {
   function f() {}
-  assertThrows(() => Function("++f`foo`"), ReferenceError);
-  assertThrows(() => Function("f`foo`++"), ReferenceError);
-  assertThrows(() => Function("--f`foo`"), ReferenceError);
-  assertThrows(() => Function("f`foo`--"), ReferenceError);
-  assertThrows(() => Function("f`foo` = 1"), ReferenceError);
+  assertThrows(() => Function("++f`foo`"), SyntaxError);
+  assertThrows(() => Function("f`foo`++"), SyntaxError);
+  assertThrows(() => Function("--f`foo`"), SyntaxError);
+  assertThrows(() => Function("f`foo`--"), SyntaxError);
+  assertThrows(() => Function("f`foo` = 1"), SyntaxError);
 })();
+
+// Disable eval caching if a tagged template occurs in a nested function
+var v = 0;
+var templates = [];
+function tag(callSite) { templates.push(callSite); }
+for (v = 0; v < 6; v += 2) {
+  eval("(function() { for (var i = 0; i < 2; ++i) tag`Hello${v}world` })()");
+  assertSame(templates[v], templates[v + 1]);
+}
+assertNotSame(templates[0], templates[2]);
+assertNotSame(templates[0], templates[4]);
+assertNotSame(templates[1], templates[3]);
+assertNotSame(templates[1], templates[5]);
+assertNotSame(templates[2], templates[4]);
+assertNotSame(templates[3], templates[5]);
+
+function makeSource1(id) {
+  return `function f() {
+    for (var i = 0; i < 2; ++i) tag\`Hello${id}world\`;
+  }
+  f();`;
+}
+templates = [];
+for (v = 0; v < 6; v += 2) {
+  eval(makeSource1(v));
+  assertSame(templates[v], templates[v + 1]);
+}
+assertNotSame(templates[0], templates[2]);
+assertNotSame(templates[0], templates[4]);
+assertNotSame(templates[1], templates[3]);
+assertNotSame(templates[1], templates[5]);
+assertNotSame(templates[2], templates[4]);
+assertNotSame(templates[3], templates[5]);
+
+templates = [];
+eval("(function() { for (var i = 0; i < 2; ++i) tag`Hello${1}world` })()");
+eval("(function() { for (var i = 0; i < 2; ++i) tag`Hello${2}world` })()");
+eval("(function() { for (var i = 0; i < 2; ++i) tag`Hello${2}world` })()");
+assertSame(templates[0], templates[1]);
+assertNotSame(templates[0], templates[2]);
+assertNotSame(templates[0], templates[4]);
+assertNotSame(templates[1], templates[3]);
+assertNotSame(templates[1], templates[5]);
+assertSame(templates[2], templates[3]);
+assertNotSame(templates[2], templates[4]);
+assertNotSame(templates[3], templates[5]);
+assertSame(templates[4],templates[5]);
+
+templates = [];
+eval(makeSource1(1));
+eval(makeSource1(2));
+eval(makeSource1(3));
+assertSame(templates[0], templates[1]);
+assertNotSame(templates[0], templates[2]);
+assertNotSame(templates[0], templates[4]);
+assertNotSame(templates[1], templates[3]);
+assertNotSame(templates[1], templates[5]);
+assertSame(templates[2], templates[3]);
+assertNotSame(templates[2], templates[4]);
+assertNotSame(templates[3], templates[5]);
+assertSame(templates[4],templates[5]);
+
+// Disable eval caching if a tagged template occurs in an even deeper nested function
+var v = 0;
+templates = [];
+for (v = 0; v < 6; v += 2) {
+    eval("(function() { (function() { for (var i = 0; i < 2; ++i) tag`Hello${v}world` })() })()");
+    if (!v) continue;
+    assertNotSame(templates[v], templates[v - 1]);
+}
+assertNotSame(templates[0], templates[2]);
+assertNotSame(templates[0], templates[4]);
+assertNotSame(templates[1], templates[3]);
+assertNotSame(templates[1], templates[5]);
+assertNotSame(templates[2], templates[4]);
+assertNotSame(templates[3], templates[5]);
+
+function makeSource2(id) {
+  return `function f() {
+    function innerF() {
+      for (var i = 0; i < 2; ++i) tag\`Hello${id}world\`;
+    }
+    return innerF();
+  }
+  f();`;
+}
+templates = [];
+for (v = 0; v < 6; v += 2) {
+  eval(makeSource2(v));
+  assertSame(templates[v], templates[v + 1]);
+}
+assertNotSame(templates[0], templates[2]);
+assertNotSame(templates[0], templates[4]);
+assertNotSame(templates[1], templates[3]);
+assertNotSame(templates[1], templates[5]);
+assertNotSame(templates[2], templates[4]);
+assertNotSame(templates[3], templates[5]);
+
+templates = [];
+eval("(function() { (function() { for (var i = 0; i < 2; ++i) tag`Hello${1}world` })() })()");
+eval("(function() { (function() { for (var i = 0; i < 2; ++i) tag`Hello${2}world` })() })()");
+eval("(function() { (function() { for (var i = 0; i < 2; ++i) tag`Hello${2}world` })() })()");
+assertSame(templates[0], templates[1]);
+assertNotSame(templates[0], templates[2]);
+assertNotSame(templates[0], templates[4]);
+assertNotSame(templates[1], templates[3]);
+assertNotSame(templates[1], templates[5]);
+assertSame(templates[2], templates[3]);
+assertNotSame(templates[2], templates[4]);
+assertNotSame(templates[3], templates[5]);
+assertSame(templates[4], templates[5]);
+
+templates = [];
+eval(makeSource2(1));
+eval(makeSource2(2));
+eval(makeSource2(3));
+assertSame(templates[0], templates[1]);
+assertNotSame(templates[0], templates[2]);
+assertNotSame(templates[0], templates[4]);
+assertNotSame(templates[1], templates[3]);
+assertNotSame(templates[1], templates[5]);
+assertSame(templates[2], templates[3]);
+assertNotSame(templates[2], templates[4]);
+assertNotSame(templates[3], templates[5]);
+assertSame(templates[4], templates[5]);
diff --git a/src/v8/test/mjsunit/es6/typedarray-construct-by-array-like.js b/src/v8/test/mjsunit/es6/typedarray-construct-by-array-like.js
index 66316f3..e6be924 100644
--- a/src/v8/test/mjsunit/es6/typedarray-construct-by-array-like.js
+++ b/src/v8/test/mjsunit/es6/typedarray-construct-by-array-like.js
@@ -120,6 +120,31 @@
   assertArrayEquals([1, 2, 22], ta);
 });
 
+tests.push(function TestConstructFromArrayNullIterator(constr) {
+  var arr = [1, 2, 3];
+  arr[Symbol.iterator] = null;
+
+  var ta = new Uint8Array(arr);
+
+  assertArrayEquals([1, 2, 3], ta);
+});
+
+tests.push(function TestConstructFromArrayUndefinedIterator(constr) {
+  var arr = [1, 2, 3];
+  arr[Symbol.iterator] = undefined;
+
+  var ta = new Uint8Array(arr);
+
+  assertArrayEquals([1, 2, 3], ta);
+});
+
+tests.push(function TestConstructFromArrayNonCallableIterator(constr) {
+  var arr = [1, 2, 3];
+  arr[Symbol.iterator] = 1;
+
+  assertThrows(() => new Uint8Array(arr), TypeError);
+});
+
 tests.push(function TestConstructFromArray(constr) {
   var n = 64;
   var jsArray = [];
@@ -150,8 +175,44 @@
   }
 });
 
+tests.push(function TestFromTypedArraySpecies(constr) {
+  var b = new ArrayBuffer(16);
+  var a1 = new constr(b);
+
+  var constructor_read = 0;
+  var cons = b.constructor;
+
+  Object.defineProperty(b, 'constructor', {
+    get: function() {
+      constructor_read++;
+      return cons;
+    }
+  });
+
+  var a2 = new constr(a1);
+
+  assertEquals(1, constructor_read);
+});
+
+tests.push(function TestFromTypedArraySpeciesDetachsBuffer(constr) {
+  var b = new ArrayBuffer(16);
+  var a1 = new constr(b);
+
+  var constructor_read = 0;
+  var cons = b.constructor;
+
+  Object.defineProperty(b, 'constructor', {
+    get: function() {
+      %ArrayBufferDetach(b);
+      return cons;
+    }
+  });
+
+  assertThrows(() => new constr(a1));
+});
+
 tests.push(function TestLengthIsMaxSmi(constr) {
-  var myObject = { 0: 5, 1: 6, length: %_MaxSmi() + 1 };
+  var myObject = { 0: 5, 1: 6, length: %MaxSmi() + 1 };
 
   assertThrows(function() {
     new constr(myObject);
@@ -197,7 +258,7 @@
 });
 
 tests.push(function TestLengthIsNonSmiNegativeNumber(constr) {
-  var ta = new constr({length: -%_MaxSmi() - 2});
+  var ta = new constr({length: -%MaxSmi() - 2});
 
   assertEquals(0, ta.length);
 });
diff --git a/src/v8/test/mjsunit/es6/typedarray-construct-offset-not-smi.js b/src/v8/test/mjsunit/es6/typedarray-construct-offset-not-smi.js
index 0a267bc..e6cbcc4 100644
--- a/src/v8/test/mjsunit/es6/typedarray-construct-offset-not-smi.js
+++ b/src/v8/test/mjsunit/es6/typedarray-construct-offset-not-smi.js
@@ -5,7 +5,7 @@
 // Flags: --allow-natives-syntax --mock-arraybuffer-allocator
 
 (function TestBufferByteLengthNonSmi() {
-  var non_smi_byte_length = %_MaxSmi() + 1;
+  var non_smi_byte_length = %MaxSmi() + 1;
 
   var buffer = new ArrayBuffer(non_smi_byte_length);
 
@@ -20,7 +20,7 @@
 })();
 
 (function TestByteOffsetNonSmi() {
-  var non_smi_byte_length = %_MaxSmi() + 11;
+  var non_smi_byte_length = %MaxSmi() + 11;
 
   var buffer = new ArrayBuffer(non_smi_byte_length);
 
diff --git a/src/v8/test/mjsunit/es6/typedarray-copywithin.js b/src/v8/test/mjsunit/es6/typedarray-copywithin.js
index c52a386..e60c88f 100644
--- a/src/v8/test/mjsunit/es6/typedarray-copywithin.js
+++ b/src/v8/test/mjsunit/es6/typedarray-copywithin.js
@@ -232,13 +232,13 @@
   var tmp = {
     [Symbol.toPrimitive]() {
       assertUnreachable("Parameter should not be processed when " +
-                        "array.[[ViewedArrayBuffer]] is neutered.");
+                        "array.[[ViewedArrayBuffer]] is detached.");
       return 0;
     }
   };
 
   var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
-  %ArrayBufferNeuter(array.buffer);
+  %ArrayBufferDetach(array.buffer);
 
   assertThrows(() => array.copyWithin(tmp, tmp, tmp), TypeError);
   assertEquals(0, array.length, "array.[[ViewedArrayBuffer]] is detached");
diff --git a/src/v8/test/mjsunit/es6/typedarray-detached.js b/src/v8/test/mjsunit/es6/typedarray-detached.js
new file mode 100644
index 0000000..bd8e2a1
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/typedarray-detached.js
@@ -0,0 +1,778 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Disable the detaching protector.
+%ArrayBufferDetach(new ArrayBuffer(1024));
+
+// ArrayBuffer
+
+function TestByteLength(param, expectedByteLength) {
+  var ab = new ArrayBuffer(param);
+  assertSame(expectedByteLength, ab.byteLength);
+}
+
+function TestArrayBufferCreation() {
+  TestByteLength(1, 1);
+  TestByteLength(256, 256);
+  TestByteLength(2.567, 2);
+
+  TestByteLength("abc", 0);
+
+  TestByteLength(0, 0);
+
+  assertThrows(function() { new ArrayBuffer(-10); }, RangeError);
+  assertThrows(function() { new ArrayBuffer(-2.567); }, RangeError);
+
+  assertThrows(function() {
+    var ab1 = new ArrayBuffer(0xFFFFFFFFFFFF)
+  }, RangeError);
+
+  var ab = new ArrayBuffer();
+  assertSame(0, ab.byteLength);
+  assertEquals("[object ArrayBuffer]",
+      Object.prototype.toString.call(ab));
+}
+
+TestArrayBufferCreation();
+
+function TestByteLengthNotWritable() {
+  var ab = new ArrayBuffer(1024);
+  assertSame(1024, ab.byteLength);
+
+  assertThrows(function() { "use strict"; ab.byteLength = 42; }, TypeError);
+}
+
+TestByteLengthNotWritable();
+
+function TestSlice(expectedResultLen, initialLen, start, end) {
+  var ab = new ArrayBuffer(initialLen);
+  var a1 = new Uint8Array(ab);
+  for (var i = 0; i < a1.length; i++) {
+    a1[i] = 0xCA;
+  }
+  var slice = ab.slice(start, end);
+  assertSame(expectedResultLen, slice.byteLength);
+  var a2 = new Uint8Array(slice);
+  for (var i = 0; i < a2.length; i++) {
+    assertSame(0xCA, a2[i]);
+  }
+}
+
+function TestArrayBufferSlice() {
+  var ab = new ArrayBuffer(1024);
+  var ab1 = ab.slice(512, 1024);
+  assertSame(512, ab1.byteLength);
+
+  TestSlice(512, 1024, 512, 1024);
+  TestSlice(512, 1024, 512);
+
+  TestSlice(0, 0, 1, 20);
+  TestSlice(100, 100, 0, 100);
+  TestSlice(100, 100, 0, 1000);
+
+  TestSlice(0, 100, 5, 1);
+
+  TestSlice(1, 100, -11, -10);
+  TestSlice(9, 100, -10, 99);
+  TestSlice(0, 100, -10, 80);
+  TestSlice(10, 100, 80, -10);
+
+  TestSlice(10, 100, 90, "100");
+  TestSlice(10, 100, "90", "100");
+
+  TestSlice(0,  100, 90, "abc");
+  TestSlice(10, 100, "abc", 10);
+
+  TestSlice(10, 100, 0.96, 10.96);
+  TestSlice(10, 100, 0.96, 10.01);
+  TestSlice(10, 100, 0.01, 10.01);
+  TestSlice(10, 100, 0.01, 10.96);
+
+  TestSlice(10, 100, 90);
+  TestSlice(10, 100, -10);
+}
+
+TestArrayBufferSlice();
+
+// Typed arrays
+
+function TestTypedArray(constr, elementSize, typicalElement) {
+  assertSame(elementSize, constr.BYTES_PER_ELEMENT);
+
+  var ab = new ArrayBuffer(256*elementSize);
+
+  var a0 = new constr(30);
+  assertEquals("[object " + constr.name + "]",
+      Object.prototype.toString.call(a0));
+
+  assertTrue(ArrayBuffer.isView(a0));
+  assertSame(elementSize, a0.BYTES_PER_ELEMENT);
+  assertSame(30, a0.length);
+  assertSame(30*elementSize, a0.byteLength);
+  assertSame(0, a0.byteOffset);
+  assertSame(30*elementSize, a0.buffer.byteLength);
+
+  var aLen0 = new constr(0);
+  assertSame(elementSize, aLen0.BYTES_PER_ELEMENT);
+  assertSame(0, aLen0.length);
+  assertSame(0, aLen0.byteLength);
+  assertSame(0, aLen0.byteOffset);
+  assertSame(0, aLen0.buffer.byteLength);
+
+  var aOverBufferLen0 = new constr(ab, 128*elementSize, 0);
+  assertSame(ab, aOverBufferLen0.buffer);
+  assertSame(elementSize, aOverBufferLen0.BYTES_PER_ELEMENT);
+  assertSame(0, aOverBufferLen0.length);
+  assertSame(0, aOverBufferLen0.byteLength);
+  assertSame(128*elementSize, aOverBufferLen0.byteOffset);
+
+  var a1 = new constr(ab, 128*elementSize, 128);
+  assertSame(ab, a1.buffer);
+  assertSame(elementSize, a1.BYTES_PER_ELEMENT);
+  assertSame(128, a1.length);
+  assertSame(128*elementSize, a1.byteLength);
+  assertSame(128*elementSize, a1.byteOffset);
+
+
+  var a2 = new constr(ab, 64*elementSize, 128);
+  assertSame(ab, a2.buffer);
+  assertSame(elementSize, a2.BYTES_PER_ELEMENT);
+  assertSame(128, a2.length);
+  assertSame(128*elementSize, a2.byteLength);
+  assertSame(64*elementSize, a2.byteOffset);
+
+  var a3 = new constr(ab, 192*elementSize);
+  assertSame(ab, a3.buffer);
+  assertSame(64, a3.length);
+  assertSame(64*elementSize, a3.byteLength);
+  assertSame(192*elementSize, a3.byteOffset);
+
+  var a4 = new constr(ab);
+  assertSame(ab, a4.buffer);
+  assertSame(256, a4.length);
+  assertSame(256*elementSize, a4.byteLength);
+  assertSame(0, a4.byteOffset);
+
+
+  var i;
+  for (i = 0; i < 128; i++) {
+    a1[i] = typicalElement;
+  }
+
+  for (i = 0; i < 128; i++) {
+    assertSame(typicalElement, a1[i]);
+  }
+
+  for (i = 0; i < 64; i++) {
+    assertSame(0, a2[i]);
+  }
+
+  for (i = 64; i < 128; i++) {
+    assertSame(typicalElement, a2[i]);
+  }
+
+  for (i = 0; i < 64; i++) {
+    assertSame(typicalElement, a3[i]);
+  }
+
+  for (i = 0; i < 128; i++) {
+    assertSame(0, a4[i]);
+  }
+
+  for (i = 128; i < 256; i++) {
+    assertSame(typicalElement, a4[i]);
+  }
+
+  var aAtTheEnd = new constr(ab, 256*elementSize);
+  assertSame(elementSize, aAtTheEnd.BYTES_PER_ELEMENT);
+  assertSame(0, aAtTheEnd.length);
+  assertSame(0, aAtTheEnd.byteLength);
+  assertSame(256*elementSize, aAtTheEnd.byteOffset);
+
+  assertThrows(function () { new constr(ab, 257*elementSize); }, RangeError);
+  assertThrows(
+      function () { new constr(ab, 128*elementSize, 192); },
+      RangeError);
+
+  if (elementSize !== 1) {
+    assertThrows(function() { new constr(ab, 128*elementSize - 1, 10); },
+                 RangeError);
+    var unalignedArrayBuffer = new ArrayBuffer(10*elementSize + 1);
+    var goodArray = new constr(unalignedArrayBuffer, 0, 10);
+    assertSame(10, goodArray.length);
+    assertSame(10*elementSize, goodArray.byteLength);
+    assertThrows(function() { new constr(unalignedArrayBuffer)}, RangeError);
+    assertThrows(function() { new constr(unalignedArrayBuffer, 5*elementSize)},
+                 RangeError);
+  }
+
+  var aFromUndef = new constr();
+  assertSame(elementSize, aFromUndef.BYTES_PER_ELEMENT);
+  assertSame(0, aFromUndef.length);
+  assertSame(0*elementSize, aFromUndef.byteLength);
+  assertSame(0, aFromUndef.byteOffset);
+  assertSame(0*elementSize, aFromUndef.buffer.byteLength);
+
+  var aFromNull = new constr(null);
+  assertSame(elementSize, aFromNull.BYTES_PER_ELEMENT);
+  assertSame(0, aFromNull.length);
+  assertSame(0*elementSize, aFromNull.byteLength);
+  assertSame(0, aFromNull.byteOffset);
+  assertSame(0*elementSize, aFromNull.buffer.byteLength);
+
+  var aFromBool = new constr(true);
+  assertSame(elementSize, aFromBool.BYTES_PER_ELEMENT);
+  assertSame(1, aFromBool.length);
+  assertSame(1*elementSize, aFromBool.byteLength);
+  assertSame(0, aFromBool.byteOffset);
+  assertSame(1*elementSize, aFromBool.buffer.byteLength);
+
+  var aFromString = new constr("30");
+  assertSame(elementSize, aFromString.BYTES_PER_ELEMENT);
+  assertSame(30, aFromString.length);
+  assertSame(30*elementSize, aFromString.byteLength);
+  assertSame(0, aFromString.byteOffset);
+  assertSame(30*elementSize, aFromString.buffer.byteLength);
+
+  assertThrows(function() { new constr(Symbol()); }, TypeError);
+
+  var jsArray = [];
+  for (i = 0; i < 30; i++) {
+    jsArray.push(typicalElement);
+  }
+  var aFromArray = new constr(jsArray);
+  assertSame(elementSize, aFromArray.BYTES_PER_ELEMENT);
+  assertSame(30, aFromArray.length);
+  assertSame(30*elementSize, aFromArray.byteLength);
+  assertSame(0, aFromArray.byteOffset);
+  assertSame(30*elementSize, aFromArray.buffer.byteLength);
+  for (i = 0; i < 30; i++) {
+    assertSame(typicalElement, aFromArray[i]);
+  }
+
+  var abLen0 = new ArrayBuffer(0);
+  var aOverAbLen0 = new constr(abLen0);
+  assertSame(abLen0, aOverAbLen0.buffer);
+  assertSame(elementSize, aOverAbLen0.BYTES_PER_ELEMENT);
+  assertSame(0, aOverAbLen0.length);
+  assertSame(0, aOverAbLen0.byteLength);
+  assertSame(0, aOverAbLen0.byteOffset);
+
+  var aNoParam = new constr();
+  assertSame(elementSize, aNoParam.BYTES_PER_ELEMENT);
+  assertSame(0, aNoParam.length);
+  assertSame(0, aNoParam.byteLength);
+  assertSame(0, aNoParam.byteOffset);
+
+  var a = new constr(ab, 64*elementSize, 128);
+  assertEquals("[object " + constr.name + "]",
+      Object.prototype.toString.call(a));
+  var desc = Object.getOwnPropertyDescriptor(
+      constr.prototype.__proto__, Symbol.toStringTag);
+  assertTrue(desc.configurable);
+  assertFalse(desc.enumerable);
+  assertFalse(!!desc.writable);
+  assertFalse(!!desc.set);
+  assertEquals("function", typeof desc.get);
+
+  // Test that the constructor can be called with an iterable
+  function* gen() { for (var i = 0; i < 10; i++) yield i; }
+  var genArr = new constr(gen());
+  assertEquals(10, genArr.length);
+  assertEquals(0, genArr[0]);
+  assertEquals(9, genArr[9]);
+  // Arrays can be converted to TypedArrays
+  genArr = new constr([1, 2, 3]);
+  assertEquals(3, genArr.length);
+  assertEquals(1, genArr[0]);
+  assertEquals(3, genArr[2]);
+  // Redefining Array.prototype[Symbol.iterator] still works
+  var arrayIterator = Array.prototype[Symbol.iterator];
+  Array.prototype[Symbol.iterator] = gen;
+  genArr = new constr([1, 2, 3]);
+  assertEquals(10, genArr.length);
+  assertEquals(0, genArr[0]);
+  assertEquals(9, genArr[9]);
+  Array.prototype[Symbol.iterator] = arrayIterator;
+  // Other array-like things can be made into a TypedArray
+  var myObject = { 0: 5, 1: 6, length: 2 };
+  genArr = new constr(myObject);
+  assertEquals(2, genArr.length);
+  assertEquals(5, genArr[0]);
+  assertEquals(6, genArr[1]);
+  // Iterator takes precedence over array-like, and the property
+  // is read only once.
+  var iteratorReadCount = 0;
+  Object.defineProperty(myObject, Symbol.iterator, {
+    get: function() { iteratorReadCount++; return gen; }
+  });
+  genArr = new constr(myObject);
+  assertEquals(10, genArr.length);
+  assertEquals(0, genArr[0]);
+  assertEquals(9, genArr[9]);
+  assertEquals(1, iteratorReadCount);
+}
+
+TestTypedArray(Uint8Array, 1, 0xFF);
+TestTypedArray(Int8Array, 1, -0x7F);
+TestTypedArray(Uint16Array, 2, 0xFFFF);
+TestTypedArray(Int16Array, 2, -0x7FFF);
+TestTypedArray(Uint32Array, 4, 0xFFFFFFFF);
+TestTypedArray(Int32Array, 4, -0x7FFFFFFF);
+TestTypedArray(Float32Array, 4, 0.5);
+TestTypedArray(Float64Array, 8, 0.5);
+TestTypedArray(Uint8ClampedArray, 1, 0xFF);
+
+function SubarrayTestCase(constructor, item, expectedResultLen, expectedStartIndex,
+                          initialLen, start, end) {
+  var a = new constructor(initialLen);
+  var s = a.subarray(start, end);
+  assertSame(constructor, s.constructor);
+  assertSame(expectedResultLen, s.length);
+  if (s.length > 0) {
+    s[0] = item;
+    assertSame(item, a[expectedStartIndex]);
+  }
+}
+
+function TestSubArray(constructor, item) {
+  SubarrayTestCase(constructor, item, 512, 512, 1024, 512, 1024);
+  SubarrayTestCase(constructor, item, 512, 512, 1024, 512);
+
+  SubarrayTestCase(constructor, item, 0, undefined, 0, 1, 20);
+  SubarrayTestCase(constructor, item, 100, 0,       100, 0, 100);
+  SubarrayTestCase(constructor, item, 100, 0,       100,  0, 1000);
+  SubarrayTestCase(constructor, item, 0, undefined, 100, 5, 1);
+
+  SubarrayTestCase(constructor, item, 1, 89,        100, -11, -10);
+  SubarrayTestCase(constructor, item, 9, 90,        100, -10, 99);
+  SubarrayTestCase(constructor, item, 0, undefined, 100, -10, 80);
+  SubarrayTestCase(constructor, item, 10,80,        100, 80, -10);
+
+  SubarrayTestCase(constructor, item, 10,90,        100, 90, "100");
+  SubarrayTestCase(constructor, item, 10,90,        100, "90", "100");
+
+  SubarrayTestCase(constructor, item, 0, undefined, 100, 90, "abc");
+  SubarrayTestCase(constructor, item, 10,0,         100, "abc", 10);
+
+  SubarrayTestCase(constructor, item, 10,0,         100, 0.96, 10.96);
+  SubarrayTestCase(constructor, item, 10,0,         100, 0.96, 10.01);
+  SubarrayTestCase(constructor, item, 10,0,         100, 0.01, 10.01);
+  SubarrayTestCase(constructor, item, 10,0,         100, 0.01, 10.96);
+
+
+  SubarrayTestCase(constructor, item, 10,90,        100, 90);
+  SubarrayTestCase(constructor, item, 10,90,        100, -10);
+
+  var method = constructor.prototype.subarray;
+  method.call(new constructor(100), 0, 100);
+  var o = {};
+  assertThrows(function() { method.call(o, 0, 100); }, TypeError);
+}
+
+TestSubArray(Uint8Array, 0xFF);
+TestSubArray(Int8Array, -0x7F);
+TestSubArray(Uint16Array, 0xFFFF);
+TestSubArray(Int16Array, -0x7FFF);
+TestSubArray(Uint32Array, 0xFFFFFFFF);
+TestSubArray(Int32Array, -0x7FFFFFFF);
+TestSubArray(Float32Array, 0.5);
+TestSubArray(Float64Array, 0.5);
+TestSubArray(Uint8ClampedArray, 0xFF);
+
+function TestTypedArrayOutOfRange(constructor, value, result) {
+  var a = new constructor(1);
+  a[0] = value;
+  assertSame(result, a[0]);
+}
+
+TestTypedArrayOutOfRange(Uint8Array, 0x1FA, 0xFA);
+TestTypedArrayOutOfRange(Uint8Array, -1, 0xFF);
+
+TestTypedArrayOutOfRange(Int8Array, 0x1FA, 0x7A - 0x80);
+
+TestTypedArrayOutOfRange(Uint16Array, 0x1FFFA, 0xFFFA);
+TestTypedArrayOutOfRange(Uint16Array, -1, 0xFFFF);
+TestTypedArrayOutOfRange(Int16Array, 0x1FFFA, 0x7FFA - 0x8000);
+
+TestTypedArrayOutOfRange(Uint32Array, 0x1FFFFFFFA, 0xFFFFFFFA);
+TestTypedArrayOutOfRange(Uint32Array, -1, 0xFFFFFFFF);
+TestTypedArrayOutOfRange(Int32Array, 0x1FFFFFFFA, 0x7FFFFFFA - 0x80000000);
+
+TestTypedArrayOutOfRange(Uint8ClampedArray, 0x1FA, 0xFF);
+TestTypedArrayOutOfRange(Uint8ClampedArray, -1, 0);
+
+var typedArrayConstructors = [
+  Uint8Array,
+  Int8Array,
+  Uint16Array,
+  Int16Array,
+  Uint32Array,
+  Int32Array,
+  Uint8ClampedArray,
+  Float32Array,
+  Float64Array];
+
+function TestPropertyTypeChecks(constructor) {
+  function CheckProperty(name) {
+    assertThrows(function() { 'use strict'; new constructor(10)[name] = 0; })
+    var d = Object.getOwnPropertyDescriptor(constructor.prototype.__proto__, name);
+    var o = {};
+    assertThrows(function() {d.get.call(o);}, TypeError);
+    for (var i = 0; i < typedArrayConstructors.length; i++) {
+      var ctor = typedArrayConstructors[i];
+      var a = new ctor(10);
+      d.get.call(a); // shouldn't throw
+    }
+  }
+
+  CheckProperty("buffer");
+  CheckProperty("byteOffset");
+  CheckProperty("byteLength");
+  CheckProperty("length");
+}
+
+for(i = 0; i < typedArrayConstructors.length; i++) {
+  TestPropertyTypeChecks(typedArrayConstructors[i]);
+}
+
+
+function TestTypedArraySet() {
+  // Test array.set in different combinations.
+
+  function assertArrayPrefix(expected, array) {
+    for (var i = 0; i < expected.length; ++i) {
+      assertEquals(expected[i], array[i]);
+    }
+  }
+
+  var a11 = new Int16Array([1, 2, 3, 4, 0, -1])
+  var a12 = new Uint16Array(15)
+  a12.set(a11, 3)
+  assertArrayPrefix([0, 0, 0, 1, 2, 3, 4, 0, 0xffff, 0, 0], a12)
+  assertThrows(function(){ a11.set(a12) })
+
+  var a21 = [1, undefined, 10, NaN, 0, -1, {valueOf: function() {return 3}}]
+  var a22 = new Int32Array(12)
+  a22.set(a21, 2)
+  assertArrayPrefix([0, 0, 1, 0, 10, 0, 0, -1, 3, 0], a22)
+
+  var a31 = new Float32Array([2, 4, 6, 8, 11, NaN, 1/0, -3])
+  var a32 = a31.subarray(2, 6)
+  a31.set(a32, 4)
+  assertArrayPrefix([2, 4, 6, 8, 6, 8, 11, NaN], a31)
+  assertArrayPrefix([6, 8, 6, 8], a32)
+
+  var a4 = new Uint8ClampedArray([3,2,5,6])
+  a4.set(a4)
+  assertArrayPrefix([3, 2, 5, 6], a4)
+
+  // Cases with overlapping backing store but different element sizes.
+  var b = new ArrayBuffer(4)
+  var a5 = new Int16Array(b)
+  var a50 = new Int8Array(b)
+  var a51 = new Int8Array(b, 0, 2)
+  var a52 = new Int8Array(b, 1, 2)
+  var a53 = new Int8Array(b, 2, 2)
+
+  a5.set([0x5050, 0x0a0a])
+  assertArrayPrefix([0x50, 0x50, 0x0a, 0x0a], a50)
+  assertArrayPrefix([0x50, 0x50], a51)
+  assertArrayPrefix([0x50, 0x0a], a52)
+  assertArrayPrefix([0x0a, 0x0a], a53)
+
+  a50.set([0x50, 0x50, 0x0a, 0x0a])
+  a51.set(a5)
+  assertArrayPrefix([0x50, 0x0a, 0x0a, 0x0a], a50)
+
+  a50.set([0x50, 0x50, 0x0a, 0x0a])
+  a52.set(a5)
+  assertArrayPrefix([0x50, 0x50, 0x0a, 0x0a], a50)
+
+  a50.set([0x50, 0x50, 0x0a, 0x0a])
+  a53.set(a5)
+  assertArrayPrefix([0x50, 0x50, 0x50, 0x0a], a50)
+
+  a50.set([0x50, 0x51, 0x0a, 0x0b])
+  a5.set(a51)
+  assertArrayPrefix([0x0050, 0x0051], a5)
+
+  a50.set([0x50, 0x51, 0x0a, 0x0b])
+  a5.set(a52)
+  assertArrayPrefix([0x0051, 0x000a], a5)
+
+  a50.set([0x50, 0x51, 0x0a, 0x0b])
+  a5.set(a53)
+  assertArrayPrefix([0x000a, 0x000b], a5)
+
+  // Mixed types of same size.
+  var a61 = new Float32Array([1.2, 12.3])
+  var a62 = new Int32Array(2)
+  a62.set(a61)
+  assertArrayPrefix([1, 12], a62)
+  a61.set(a62)
+  assertArrayPrefix([1, 12], a61)
+
+  // Invalid source
+  var a = new Uint16Array(50);
+  var expected = [];
+  for (i = 0; i < 50; i++) {
+    a[i] = i;
+    expected.push(i);
+  }
+  a.set({});
+  assertArrayPrefix(expected, a);
+  assertThrows(function() { a.set.call({}) }, TypeError);
+  assertThrows(function() { a.set.call([]) }, TypeError);
+
+  assertThrows(function() { a.set(0); }, TypeError);
+  assertThrows(function() { a.set(0, 1); }, TypeError);
+
+  assertEquals(1, a.set.length);
+}
+
+TestTypedArraySet();
+
+function TestTypedArraysWithIllegalIndices() {
+  var a = new Int32Array(100);
+
+  a[-10] = 10;
+  assertEquals(undefined, a[-10]);
+  a["-10"] = 10;
+  assertEquals(undefined, a["-10"]);
+
+  var s = "    -10";
+  a[s] = 10;
+  assertEquals(10, a[s]);
+  var s1 = "    -10   ";
+  a[s] = 10;
+  assertEquals(10, a[s]);
+
+  a["-1e2"] = 10;
+  assertEquals(10, a["-1e2"]);
+  assertEquals(undefined, a[-1e2]);
+
+  a["-0"] = 256;
+  var s2 = "     -0";
+  a[s2] = 255;
+  assertEquals(undefined, a["-0"]);
+  assertEquals(255, a[s2]);
+  assertEquals(0, a[-0]);
+
+  a[-Infinity] = 50;
+  assertEquals(undefined, a[-Infinity]);
+
+  a[1.5] = 10;
+  assertEquals(undefined, a[1.5]);
+  var nan = Math.sqrt(-1);
+  a[nan] = 5;
+  assertEquals(undefined, a[nan]);
+
+  var x = 0;
+  var y = -0;
+  assertEquals(Infinity, 1/x);
+  assertEquals(-Infinity, 1/y);
+  a[x] = 5;
+  a[y] = 27;
+  assertEquals(27, a[x]);
+  assertEquals(27, a[y]);
+}
+
+TestTypedArraysWithIllegalIndices();
+
+function TestTypedArraysWithIllegalIndicesStrict() {
+  'use strict';
+  var a = new Int32Array(100);
+
+  a[-10] = 10;
+  assertEquals(undefined, a[-10]);
+  a["-10"] = 10;
+  assertEquals(undefined, a["-10"]);
+
+  var s = "    -10";
+  a[s] = 10;
+  assertEquals(10, a[s]);
+  var s1 = "    -10   ";
+  a[s] = 10;
+  assertEquals(10, a[s]);
+
+  a["-1e2"] = 10;
+  assertEquals(10, a["-1e2"]);
+  assertEquals(undefined, a[-1e2]);
+
+  a["-0"] = 256;
+  var s2 = "     -0";
+  a[s2] = 255;
+  assertEquals(undefined, a["-0"]);
+  assertEquals(255, a[s2]);
+  assertEquals(0, a[-0]);
+
+  a[-Infinity] = 50;
+  assertEquals(undefined, a[-Infinity]);
+
+  a[1.5] = 10;
+  assertEquals(undefined, a[1.5]);
+  var nan = Math.sqrt(-1);
+  a[nan] = 5;
+  assertEquals(undefined, a[nan]);
+
+  var x = 0;
+  var y = -0;
+  assertEquals(Infinity, 1/x);
+  assertEquals(-Infinity, 1/y);
+  a[x] = 5;
+  a[y] = 27;
+  assertEquals(27, a[x]);
+  assertEquals(27, a[y]);
+}
+
+TestTypedArraysWithIllegalIndicesStrict();
+
+// DataView
+function TestDataViewConstructor() {
+  var ab = new ArrayBuffer(256);
+
+  var d1 = new DataView(ab, 1, 255);
+  assertTrue(ArrayBuffer.isView(d1));
+  assertSame(ab, d1.buffer);
+  assertSame(1, d1.byteOffset);
+  assertSame(255, d1.byteLength);
+
+  var d2 = new DataView(ab, 2);
+  assertSame(ab, d2.buffer);
+  assertSame(2, d2.byteOffset);
+  assertSame(254, d2.byteLength);
+
+  var d3 = new DataView(ab);
+  assertSame(ab, d3.buffer);
+  assertSame(0, d3.byteOffset);
+  assertSame(256, d3.byteLength);
+
+  var d3a = new DataView(ab, 1, 0);
+  assertSame(ab, d3a.buffer);
+  assertSame(1, d3a.byteOffset);
+  assertSame(0, d3a.byteLength);
+
+  var d3b = new DataView(ab, 256, 0);
+  assertSame(ab, d3b.buffer);
+  assertSame(256, d3b.byteOffset);
+  assertSame(0, d3b.byteLength);
+
+  var d3c = new DataView(ab, 256);
+  assertSame(ab, d3c.buffer);
+  assertSame(256, d3c.byteOffset);
+  assertSame(0, d3c.byteLength);
+
+  var d4 = new DataView(ab, 1, 3.1415926);
+  assertSame(ab, d4.buffer);
+  assertSame(1, d4.byteOffset);
+  assertSame(3, d4.byteLength);
+
+
+  // error cases
+  assertThrows(function() { new DataView(ab, -1); }, RangeError);
+  assertThrows(function() { new DataView(); }, TypeError);
+  assertThrows(function() { new DataView([]); }, TypeError);
+  assertThrows(function() { new DataView(ab, 257); }, RangeError);
+  assertThrows(function() { new DataView(ab, 1, 1024); }, RangeError);
+}
+
+TestDataViewConstructor();
+
+function TestDataViewPropertyTypeChecks() {
+  var a = new DataView(new ArrayBuffer(10));
+  function CheckProperty(name) {
+    var d = Object.getOwnPropertyDescriptor(DataView.prototype, name);
+    var o = {}
+    assertThrows(function() {d.get.call(o);}, TypeError);
+    d.get.call(a); // shouldn't throw
+  }
+
+  CheckProperty("buffer");
+  CheckProperty("byteOffset");
+  CheckProperty("byteLength");
+
+  function CheckGetSetLength(name) {
+    assertEquals(1, DataView.prototype["get" + name].length);
+    assertEquals(2, DataView.prototype["set" + name].length);
+  }
+  CheckGetSetLength("Int8");
+  CheckGetSetLength("Uint8");
+  CheckGetSetLength("Int16");
+  CheckGetSetLength("Uint16");
+  CheckGetSetLength("Int32");
+  CheckGetSetLength("Uint32");
+  CheckGetSetLength("Float32");
+  CheckGetSetLength("Float64");
+}
+
+
+TestDataViewPropertyTypeChecks();
+
+
+function TestDataViewToStringTag() {
+  var a = new DataView(new ArrayBuffer(10));
+  assertEquals("[object DataView]", Object.prototype.toString.call(a));
+  var desc = Object.getOwnPropertyDescriptor(
+      DataView.prototype, Symbol.toStringTag);
+  assertTrue(desc.configurable);
+  assertFalse(desc.enumerable);
+  assertFalse(desc.writable);
+  assertEquals("DataView", desc.value);
+}
+
+
+// General tests for properties
+
+// Test property attribute [[Enumerable]]
+function TestEnumerable(func, obj) {
+  function props(x) {
+    var array = [];
+    for (var p in x) array.push(p);
+    return array.sort();
+  }
+  assertArrayEquals([], props(func));
+  assertArrayEquals([], props(func.prototype));
+  if (obj)
+    assertArrayEquals([], props(obj));
+}
+TestEnumerable(ArrayBuffer, new ArrayBuffer());
+for(i = 0; i < typedArrayConstructors.length; i++) {
+  TestEnumerable(typedArrayConstructors[i]);
+}
+TestEnumerable(DataView, new DataView(new ArrayBuffer()));
+
+// Test arbitrary properties on ArrayBuffer
+function TestArbitrary(m) {
+  function TestProperty(map, property, value) {
+    map[property] = value;
+    assertEquals(value, map[property]);
+  }
+  for (var i = 0; i < 20; i++) {
+    TestProperty(m, 'key' + i, 'val' + i);
+    TestProperty(m, 'foo' + i, 'bar' + i);
+  }
+}
+TestArbitrary(new ArrayBuffer(256));
+for(i = 0; i < typedArrayConstructors.length; i++) {
+  TestArbitrary(new typedArrayConstructors[i](10));
+}
+TestArbitrary(new DataView(new ArrayBuffer(256)));
+
+
+// Test direct constructor call
+assertThrows(function() { ArrayBuffer(); }, TypeError);
+assertThrows(function() { DataView(new ArrayBuffer()); }, TypeError);
+
+function TestNonConfigurableProperties(constructor) {
+  var arr = new constructor([100])
+  assertFalse(Object.getOwnPropertyDescriptor(arr,"0").configurable)
+  assertFalse(delete arr[0])
+}
+
+for(i = 0; i < typedArrayConstructors.length; i++) {
+  TestNonConfigurableProperties(typedArrayConstructors[i]);
+}
diff --git a/src/v8/test/mjsunit/es6/typedarray-every.js b/src/v8/test/mjsunit/es6/typedarray-every.js
index a3498f5..feb7cc9 100644
--- a/src/v8/test/mjsunit/es6/typedarray-every.js
+++ b/src/v8/test/mjsunit/es6/typedarray-every.js
@@ -15,7 +15,7 @@
   Float32Array,
   Float64Array];
 
-function CheckTypedArrayIsNeutered(array) {
+function CheckTypedArrayIsDetached(array) {
   assertEquals(0, array.byteLength);
   assertEquals(0, array.byteOffset);
   assertEquals(0, array.length);
@@ -81,21 +81,21 @@
   CheckWrapping(3.14, Number);
   CheckWrapping({}, Object);
 
-  // Neutering the buffer backing the typed array mid-way should
+  // Detaching the buffer backing the typed array mid-way should
   // still make .forEach() finish, and the array should keep being
-  // empty after neutering it.
+  // empty after detaching it.
   count = 0;
   a = new constructor(3);
   result = a.every(function (n, index, array) {
-    assertFalse(array[index] === undefined);  // don't get here if neutered
-    if (count > 0) %ArrayBufferNeuter(array.buffer);
+    assertFalse(array[index] === undefined);  // don't get here if detached
+    if (count > 0) %ArrayBufferDetach(array.buffer);
     array[index] = n + 1;
     count++;
     return count > 1 ? array[index] === undefined : true;
   });
   assertEquals(2, count);
   assertEquals(true, result);
-  CheckTypedArrayIsNeutered(a);
+  CheckTypedArrayIsDetached(a);
   assertEquals(undefined, a[0]);
 
   // Calling array.buffer midway can change the backing store.
@@ -132,7 +132,6 @@
   });
   assertEquals(2, count);
   assertTrue(!!buffer);
-  assertEquals("ArrayBuffer", %_ClassOf(buffer));
   assertSame(buffer, a.buffer);
 
   // The %TypedArray%.every() method should not work when
@@ -162,7 +161,7 @@
 
   // Detached Operation
   var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
-  %ArrayBufferNeuter(array.buffer);
+  %ArrayBufferDetach(array.buffer);
   assertThrows(() => array.every(() => true), TypeError);
 }
 
diff --git a/src/v8/test/mjsunit/es6/typedarray-fill.js b/src/v8/test/mjsunit/es6/typedarray-fill.js
index 9ed2203..791b214 100644
--- a/src/v8/test/mjsunit/es6/typedarray-fill.js
+++ b/src/v8/test/mjsunit/es6/typedarray-fill.js
@@ -74,12 +74,12 @@
   var tmp = {
     [Symbol.toPrimitive]() {
       assertUnreachable("Parameter should not be processed when " +
-                        "array.[[ViewedArrayBuffer]] is neutered.");
+                        "array.[[ViewedArrayBuffer]] is detached.");
       return 0;
     }
   };
   var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
-  %ArrayBufferNeuter(array.buffer);
+  %ArrayBufferDetach(array.buffer);
   assertThrows(() => array.fill(tmp), TypeError);
 }
 
diff --git a/src/v8/test/mjsunit/es6/typedarray-filter.js b/src/v8/test/mjsunit/es6/typedarray-filter.js
new file mode 100644
index 0000000..077016a
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/typedarray-filter.js
@@ -0,0 +1,111 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var typedArrayConstructors = [
+  Uint8Array,
+  Int8Array,
+  Uint16Array,
+  Int16Array,
+  Uint32Array,
+  Int32Array,
+  Uint8ClampedArray,
+  Float32Array,
+  Float64Array];
+
+function TestTypedArrayFilter(constructor) {
+  assertEquals(1, constructor.prototype.filter.length);
+
+  // Throw type error if source array is detached while executing a callback
+  let ta1 = new constructor(10);
+  assertThrows(() =>
+    ta1.filter(() => %ArrayBufferDetach(ta1.buffer))
+  , TypeError);
+
+  // A new typed array should be created after finishing callbacks
+  var speciesCreated = 0;
+
+  class MyTypedArray extends constructor {
+    static get [Symbol.species]() {
+      return function() {
+        speciesCreated++;
+        return new constructor(10);
+      };
+    }
+  }
+
+  new MyTypedArray(10).filter(() => {
+    assertEquals(0, speciesCreated);
+    return true;
+  });
+  assertEquals(1, speciesCreated);
+
+  // A new typed array should be initialized to 0s
+  class LongTypedArray extends constructor {
+    static get [Symbol.species]() {
+      return function(len) {
+        return new constructor(len * 2);
+      }
+    }
+  }
+  let ta2 = new LongTypedArray(3).fill(1);
+  let ta3 = ta2.filter((val, index, array) => val > 0);
+  assertArrayEquals(ta3, [1, 1, 1, 0, 0, 0]);
+  assertEquals(ta3.constructor, constructor);
+
+  // Throw if a new typed array is too small
+  class ShortTypedArray extends constructor {
+    static get [Symbol.species]() {
+      return function(len) {
+        return new constructor(len/2);
+      }
+    }
+  }
+  assertThrows(() => new ShortTypedArray(10).filter(() => true));
+
+  // Throw if callback is not callable
+  assertThrows(() => new constructor(10).filter(123));
+  assertThrows(() => new constructor(10).filter({}));
+
+  // Empty result
+  assertEquals(new constructor(10).filter(() => false), new constructor(0));
+
+  // If a new typed array shares a buffer with a source array
+  let ab = new ArrayBuffer(100);
+  class SharedBufferTypedArray extends constructor {
+    static get [Symbol.species]() {
+      return function(len) {
+        return new constructor(ab, 0, 5);
+      }
+    }
+  }
+  let ta4 = new SharedBufferTypedArray(ab, 0, 5).fill(1);
+  let ta5 = ta4.filter(() => {
+    ta4[0] = 123;
+    ta4[2] = 123;
+    return true;
+  });
+  assertEquals(ta4.buffer, ta5.buffer);
+  assertArrayEquals(ta4, [1, 1, 123, 1, 1]);
+  assertArrayEquals(ta5, [1, 1, 123, 1, 1]);
+
+  // If a new typed array has a different type with source array
+  for (let j = 0; j < typedArrayConstructors.length; j++) {
+    let otherConstructor = typedArrayConstructors[j];
+    class OtherTypedArray extends constructor {
+      static get [Symbol.species]() {
+        return function(len) {
+          return new otherConstructor(len);
+        }
+      }
+    }
+    let ta6 = new OtherTypedArray(10).fill(123);
+    assertEquals(ta6.filter(() => true), new otherConstructor(10).fill(123));
+  }
+}
+
+for (i = 0; i < typedArrayConstructors.length; i++) {
+  TestTypedArrayFilter(typedArrayConstructors[i]);
+}
diff --git a/src/v8/test/mjsunit/es6/typedarray-find.js b/src/v8/test/mjsunit/es6/typedarray-find.js
index 6f646e5..f33e4c5 100644
--- a/src/v8/test/mjsunit/es6/typedarray-find.js
+++ b/src/v8/test/mjsunit/es6/typedarray-find.js
@@ -190,13 +190,13 @@
 var tmp = {
   [Symbol.toPrimitive]() {
     assertUnreachable("Parameter should not be processed when " +
-                      "array.[[ViewedArrayBuffer]] is neutered.");
+                      "array.[[ViewedArrayBuffer]] is detached.");
     return 0;
   }
 };
 
 var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
-%ArrayBufferNeuter(array.buffer);
+%ArrayBufferDetach(array.buffer);
 
 assertThrows(() => array.find(tmp), TypeError);
 }
diff --git a/src/v8/test/mjsunit/es6/typedarray-findindex.js b/src/v8/test/mjsunit/es6/typedarray-findindex.js
index 7447395..e31e174 100644
--- a/src/v8/test/mjsunit/es6/typedarray-findindex.js
+++ b/src/v8/test/mjsunit/es6/typedarray-findindex.js
@@ -190,11 +190,11 @@
   var tmp = {
     [Symbol.toPrimitive]() {
       assertUnreachable("Parameter should not be processed when " +
-                        "array.[[ViewedArrayBuffer]] is neutered.");
+                        "array.[[ViewedArrayBuffer]] is detached.");
       return 0;
     }
   };
   var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
-  %ArrayBufferNeuter(array.buffer);
+  %ArrayBufferDetach(array.buffer);
   assertThrows(() => array.findIndex(tmp), TypeError);
 }
diff --git a/src/v8/test/mjsunit/es6/typedarray-foreach.js b/src/v8/test/mjsunit/es6/typedarray-foreach.js
index 7a846b1..81c2120 100644
--- a/src/v8/test/mjsunit/es6/typedarray-foreach.js
+++ b/src/v8/test/mjsunit/es6/typedarray-foreach.js
@@ -15,7 +15,7 @@
   Float32Array,
   Float64Array];
 
-function CheckTypedArrayIsNeutered(array) {
+function CheckTypedArrayIsDetached(array) {
   assertEquals(0, array.byteLength);
   assertEquals(0, array.byteOffset);
   assertEquals(0, array.length);
@@ -84,7 +84,7 @@
   assertEquals(43, a[0]);
   assertEquals(42, a[1]);
 
-  // Neutering the buffer backing the typed array mid-way should
+  // Detaching the buffer backing the typed array mid-way should
   // still make .forEach() finish, but exiting early due to the missing
   // elements, and the array should keep being empty after detaching it.
   // TODO(dehrenberg): According to the ES6 spec, accessing or testing
@@ -94,12 +94,12 @@
   a = new constructor(3);
   count = 0;
   a.forEach(function (n, index, array) {
-    if (count > 0) %ArrayBufferNeuter(array.buffer);
+    if (count > 0) %ArrayBufferDetach(array.buffer);
     array[index] = n + 1;
     count++;
   });
   assertEquals(2, count);
-  CheckTypedArrayIsNeutered(a);
+  CheckTypedArrayIsDetached(a);
   assertEquals(undefined, a[0]);
 
   // The method must work for typed arrays created from ArrayBuffer.
@@ -121,7 +121,6 @@
   });
   assertEquals(2, count);
   assertTrue(!!buffer);
-  assertEquals("ArrayBuffer", %_ClassOf(buffer));
   assertSame(buffer, a.buffer);
 
   // The %TypedArray%.forEach() method should not work when
@@ -151,7 +150,7 @@
 
   // Detached Operation
   var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
-  %ArrayBufferNeuter(array.buffer);
+  %ArrayBufferDetach(array.buffer);
   assertThrows(() => array.forEach(() => true), TypeError);
 }
 
diff --git a/src/v8/test/mjsunit/es6/typedarray-from-detached-typedarray.js b/src/v8/test/mjsunit/es6/typedarray-from-detached-typedarray.js
new file mode 100644
index 0000000..6850571
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/typedarray-from-detached-typedarray.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var typedArrayConstructors = [
+  Uint8Array,
+  Int8Array,
+  Uint16Array,
+  Int16Array,
+  Uint32Array,
+  Int32Array,
+  Uint8ClampedArray,
+  Float32Array,
+  Float64Array
+];
+
+for (constructor of typedArrayConstructors) {
+  var ta = new constructor(10);
+  %ArrayBufferDetach(ta.buffer);
+  assertThrows(() => constructor.from(ta), TypeError);
+}
diff --git a/src/v8/test/mjsunit/es6/typedarray-from-next-overridden.js b/src/v8/test/mjsunit/es6/typedarray-from-next-overridden.js
new file mode 100644
index 0000000..4d918a4
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/typedarray-from-next-overridden.js
@@ -0,0 +1,29 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var typedArrayConstructors = [
+  Uint8Array,
+  Int8Array,
+  Uint16Array,
+  Int16Array,
+  Uint32Array,
+  Int32Array,
+  Uint8ClampedArray,
+  Float32Array,
+  Float64Array
+];
+
+for (var constructor of typedArrayConstructors) {
+  let ta = new constructor([1, 2, 3]);
+  let it = ta[Symbol.iterator]();
+  let original_next = it.__proto__["next"];
+  Object.defineProperty(it.__proto__, "next", {
+    value: function() {
+      return {value: undefined, done: true};
+    },
+    configurable: true
+  });
+  assertEquals(0, constructor.from(ta).length);
+  Object.defineProperty(it.__proto__, "next", original_next);
+}
diff --git a/src/v8/test/mjsunit/es6/typedarray-from-nonfunction-iterator.js b/src/v8/test/mjsunit/es6/typedarray-from-nonfunction-iterator.js
new file mode 100644
index 0000000..ff7d7bc
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/typedarray-from-nonfunction-iterator.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let ta = new Uint8Array([1, 2, 3]);
+
+ta[Symbol.iterator] = 1;
+assertThrows(function() { Uint8Array.from(ta); }, TypeError);
+
+ta[Symbol.iterator] = "bad";
+assertThrows(function() { Uint8Array.from(ta); }, TypeError);
diff --git a/src/v8/test/mjsunit/es6/typedarray-from.js b/src/v8/test/mjsunit/es6/typedarray-from.js
index 709c453..4bc17ca 100644
--- a/src/v8/test/mjsunit/es6/typedarray-from.js
+++ b/src/v8/test/mjsunit/es6/typedarray-from.js
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --allow-natives-syntax
+
 var typedArrayConstructors = [
   Uint8Array,
   Int8Array,
@@ -14,19 +16,65 @@
   Float64Array
 ];
 
+function defaultValue(constr) {
+  if (constr == Float32Array || constr == Float64Array) return NaN;
+  return 0;
+}
+
+function assertArrayLikeEquals(value, expected, type) {
+  assertEquals(value.__proto__, type.prototype);
+  assertEquals(expected.length, value.length);
+  for (var i = 0; i < value.length; ++i) {
+    assertEquals(expected[i], value[i]);
+  }
+}
+
+(function() {
+  var source = [-0, 0, 2**40, 2**41, 2**42];
+  var arr = Float64Array.from(source);
+  assertArrayLikeEquals(arr, source, Float64Array);
+
+  arr = Float32Array.from(source);
+  assertArrayLikeEquals(arr, source, Float32Array);
+})();
+
+(function() {
+  var source = [-0, 0, , 2**42];
+  var expected = [-0, 0, NaN, 2**42];
+  var arr = Float64Array.from(source);
+  assertArrayLikeEquals(arr, expected, Float64Array);
+
+  arr = Float32Array.from(source);
+  assertArrayLikeEquals(arr, expected, Float32Array);
+})();
+
+(function() {
+  var source = {0: -0, 1: 0, 2: 2**40, 3: 2**41, 4: 2**42, length: 5};
+  var expected = [-0, 0, 2**40, 2**41, 2**42];
+  var arr = Float64Array.from(source);
+  assertArrayLikeEquals(arr, expected, Float64Array);
+
+  arr = Float32Array.from(source);
+  assertArrayLikeEquals(arr, expected, Float32Array);
+})();
+
+(function() {
+  var source = [-0, 0, , 2**42];
+  Object.getPrototypeOf(source)[2] = 27;
+  var expected = [-0, 0, 27, 2**42];
+  var arr = Float64Array.from(source);
+  assertArrayLikeEquals(arr, expected, Float64Array);
+
+  arr = Float32Array.from(source);
+  assertArrayLikeEquals(arr, expected, Float32Array);
+})();
+
 for (var constructor of typedArrayConstructors) {
   assertEquals(1, constructor.from.length);
 
   // TypedArray.from only callable on this subclassing %TypedArray%
   assertThrows(function () {constructor.from.call(Array, [])}, TypeError);
 
-  function assertArrayLikeEquals(value, expected, type) {
-    assertEquals(value.__proto__, type.prototype);
-    assertEquals(expected.length, value.length);
-    for (var i = 0; i < value.length; ++i) {
-      assertEquals(expected[i], value[i]);
-    }
-  }
 
   // Assert that calling mapfn with / without thisArg in sloppy and strict modes
   // works as expected.
@@ -47,6 +95,14 @@
   assertThrows(function() {constructor.from.call(1, [])}, TypeError);
   assertThrows(function() {constructor.from.call(undefined, [])}, TypeError);
 
+  // Use a map function that returns non-numbers.
+  function mapper(value, index) {
+    return String.fromCharCode(value);
+  }
+  var d = defaultValue(constructor);
+  assertArrayLikeEquals(
+      constructor.from([72, 69, 89], mapper), [d, d, d], constructor);
+
   // Converting from various other types, demonstrating that it can
   // operate on array-like objects as well as iterables.
   // TODO(littledan): constructors should have similar flexibility.
@@ -72,12 +128,62 @@
   assertArrayLikeEquals(constructor.from(generator()),
                         [4, 5, 6], constructor);
 
+  // Check mapper is used for non-iterator case.
+  function mapper2(value, index) {
+    return value + 1;
+  }
+  var array_like = {
+    0: 1,
+    1: 2,
+    2: 3,
+    length: 3
+  };
+  assertArrayLikeEquals(constructor.from(array_like, mapper2),
+                        [2, 3, 4], constructor);
+
+  // With a smi source. Step 10 will set len = 0.
+  var source = 1;
+  assertArrayLikeEquals(constructor.from(source), [], constructor);
+
   assertThrows(function() { constructor.from(null); }, TypeError);
   assertThrows(function() { constructor.from(undefined); }, TypeError);
   assertThrows(function() { constructor.from([], null); }, TypeError);
   assertThrows(function() { constructor.from([], 'noncallable'); },
                TypeError);
 
+  source = [1, 2, 3];
+  var proxy = new Proxy(source, {});
+  assertArrayLikeEquals(constructor.from(proxy), source, constructor);
+
+  proxy = new Proxy(source, {
+    get: function(target, name) {
+      if (name === Symbol.iterator) return target[name];
+      if (name === "length") return 3;
+      return target[name] + 1;
+    }
+  });
+  assertArrayLikeEquals(constructor.from(proxy), [2, 3, 4], constructor);
+}
+
+// Tests that modify global state in a way that affects fast paths e.g. by
+// invalidating protectors or changing prototypes.
+for (var constructor of typedArrayConstructors) {
+  source = [1, 2, 3];
+  source[Symbol.iterator] = undefined;
+  assertArrayLikeEquals(constructor.from(source), source, constructor);
+
+  source = [{ valueOf: function(){ return 42; }}];
+  source[Symbol.iterator] = undefined;
+  assertArrayLikeEquals(constructor.from(source), [42], constructor);
+
+  Number.prototype[Symbol.iterator] = function* () {
+    yield 1;
+    yield 2;
+    yield 3;
+  }
+  assertArrayLikeEquals(constructor.from(1), [1, 2, 3], constructor);
+  assertArrayLikeEquals(constructor.from(1.1), [1, 2, 3], constructor);
+
   var nullIterator = {};
   nullIterator[Symbol.iterator] = null;
   assertArrayLikeEquals(constructor.from(nullIterator), [],
@@ -90,6 +196,26 @@
 
   assertThrows(function() { constructor.from([], null); }, TypeError);
 
+  d = defaultValue(constructor);
+  let ta1 = new constructor(3).fill(1);
+  Object.defineProperty(ta1, "length", {get: function() {
+    return 6;
+  }});
+  delete ta1[Symbol.iterator];
+  delete ta1.__proto__[Symbol.iterator];
+  delete ta1.__proto__.__proto__[Symbol.iterator];
+  assertArrayLikeEquals(constructor.from(ta1), [1, 1, 1, d, d, d], constructor);
+
+  let ta2 = new constructor(3).fill(1);
+  Object.defineProperty(ta2, "length", {get: function() {
+    %ArrayBufferDetach(ta2.buffer);
+    return 6;
+  }});
+  assertArrayLikeEquals(constructor.from(ta2), [d, d, d, d, d, d], constructor);
+
+  var o1 = {0: 0, 1: 1, 2: 2, length: 6};
+  assertArrayLikeEquals(constructor.from(o1), [0, 1, 2, d, d, d], constructor);
+
   // Ensure iterator is only accessed once, and only invoked once
   var called = 0;
   var arr = [1, 2, 3];
diff --git a/src/v8/test/mjsunit/es6/typedarray-indexing.js b/src/v8/test/mjsunit/es6/typedarray-indexing.js
index d12a157..cb88068 100644
--- a/src/v8/test/mjsunit/es6/typedarray-indexing.js
+++ b/src/v8/test/mjsunit/es6/typedarray-indexing.js
@@ -19,7 +19,7 @@
 var tmp = {
   [Symbol.toPrimitive]() {
     assertUnreachable("Parameter should not be processed when " +
-                      "array.[[ViewedArrayBuffer]] is neutered.");
+                      "array.[[ViewedArrayBuffer]] is detached.");
     return 0;
   }
 };
@@ -65,7 +65,7 @@
 
   // Detached Operation
   var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
-  %ArrayBufferNeuter(array.buffer);
+  %ArrayBufferDetach(array.buffer);
   assertThrows(() => array.indexOf(tmp), TypeError);
 
   // ----------------------------------------------------------------------
@@ -107,6 +107,6 @@
 
   // Detached Operation
   var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
-  %ArrayBufferNeuter(array.buffer);
+  %ArrayBufferDetach(array.buffer);
   assertThrows(() => array.lastIndexOf(tmp), TypeError);
 }
diff --git a/src/v8/test/mjsunit/es6/typedarray-iteration.js b/src/v8/test/mjsunit/es6/typedarray-iteration.js
index b423ed0..30b09ab 100644
--- a/src/v8/test/mjsunit/es6/typedarray-iteration.js
+++ b/src/v8/test/mjsunit/es6/typedarray-iteration.js
@@ -82,7 +82,7 @@
 
     // Detached Operation
     var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
-    %ArrayBufferNeuter(array.buffer);
+    %ArrayBufferDetach(array.buffer);
     assertThrows(() => array.filter(() => false), TypeError);
   })();
 
@@ -140,7 +140,7 @@
 
     // Detached Operation
     var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
-    %ArrayBufferNeuter(array.buffer);
+    %ArrayBufferDetach(array.buffer);
     assertThrows(() => array.map((v) => v), TypeError);
   })();
 
@@ -204,7 +204,7 @@
 
     // Detached Operation
     var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
-    %ArrayBufferNeuter(array.buffer);
+    %ArrayBufferDetach(array.buffer);
     assertThrows(() => array.some((v) => false), TypeError);
   })();
 
diff --git a/src/v8/test/mjsunit/es6/typedarray-keyedstore-tonumber.js b/src/v8/test/mjsunit/es6/typedarray-keyedstore-tonumber.js
new file mode 100644
index 0000000..ca48618
--- /dev/null
+++ b/src/v8/test/mjsunit/es6/typedarray-keyedstore-tonumber.js
@@ -0,0 +1,69 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let TypedArrayConstructors = [
+  Float64Array,
+  Float32Array,
+  Uint32Array,
+  Int32Array,
+  Uint16Array,
+  Int16Array,
+  Uint8Array,
+  Uint8ClampedArray,
+  Int8Array,
+];
+
+// Test KeyedStore in uninitialized and monomorphic states.
+for (let C of TypedArrayConstructors) {
+  let keyedSta = function(array) {
+    var didRun = false;
+    array[0] = {
+      valueOf() {
+        didRun = true;
+        return 42;
+      }
+    };
+
+    return { didRun, array };
+  };
+
+  for (var i = 0; i < 3; ++i) {
+    var { didRun, array } = keyedSta(new C(1));
+    assertTrue(didRun);
+    assertEquals(array[0], 42);
+
+    // OOB store
+    // FIXME: Throw a TypeError when storing OOB in a TypedArray.
+    var { didRun } = keyedSta(new C);
+    assertTrue(didRun);
+  }
+}
+
+// Test KeyedStore in polymorphic and megamorphic states.
+do {
+  let keyedSta = function(array) {
+    var didRun = false;
+    array[0] = {
+      valueOf() {
+        didRun = true;
+        return 42;
+      }
+    };
+
+    return { didRun, array };
+  };
+
+  for (var i = 0; i < 3; ++i) {
+    for (var C of TypedArrayConstructors) {
+      var { didRun, array } = keyedSta(new C(1));
+      assertTrue(didRun);
+      assertEquals(array[0], 42);
+
+      // OOB store
+      // FIXME: Throw a TypeError when storing OOB in a TypedArray.
+      var { didRun } = keyedSta(new C);
+      assertTrue(didRun);
+    }
+  }
+} while (false);
diff --git a/src/v8/test/mjsunit/es6/typedarray-map.js b/src/v8/test/mjsunit/es6/typedarray-map.js
index 54b535f..e8d9787 100644
--- a/src/v8/test/mjsunit/es6/typedarray-map.js
+++ b/src/v8/test/mjsunit/es6/typedarray-map.js
@@ -37,7 +37,7 @@
     new DetachingArray(5).map(function(v,i,a){
       print(i);
       if (i == 1) {
-        %ArrayBufferNeuter(target.buffer);
+        %ArrayBufferDetach(target.buffer);
       }
     })
   }, TypeError);
diff --git a/src/v8/test/mjsunit/es6/typedarray-of.js b/src/v8/test/mjsunit/es6/typedarray-of.js
index eaa7bde..8ae590a 100644
--- a/src/v8/test/mjsunit/es6/typedarray-of.js
+++ b/src/v8/test/mjsunit/es6/typedarray-of.js
@@ -1,6 +1,8 @@
 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
+//
+// Flags: --expose-gc
 
 // Based on Mozilla Array.of() tests at http://dxr.mozilla.org/mozilla-central/source/js/src/jit-test/tests/collections
 
@@ -130,6 +132,20 @@
   for (var x of [undefined, null, false, true, "cow", 42, 3.14]) {
     assertThrows(function () { constructor.of.call(x); }, TypeError);
   }
+
+  // Check if it's correctly accessing new typed array elements even after
+  // garbage collection is invoked in ToNumber.
+  var not_number = {
+    [Symbol.toPrimitive]() {
+      gc();
+      return 123;
+    }
+  };
+  var dangerous_array = new Array(64).fill(not_number);
+  var a = constructor.of(...dangerous_array);
+  for (var i = 0; i < 64; i++) {
+    assertEquals(123, a[i]);
+  }
 }
 
 for (var constructor of typedArrayConstructors) {
diff --git a/src/v8/test/mjsunit/es6/typedarray-reduce.js b/src/v8/test/mjsunit/es6/typedarray-reduce.js
index ba5d7f7..2746c57 100644
--- a/src/v8/test/mjsunit/es6/typedarray-reduce.js
+++ b/src/v8/test/mjsunit/es6/typedarray-reduce.js
@@ -254,13 +254,13 @@
   var tmp = {
     [Symbol.toPrimitive]() {
       assertUnreachable("Parameter should not be processed when " +
-                        "array.[[ViewedArrayBuffer]] is neutered.");
+                        "array.[[ViewedArrayBuffer]] is detached.");
       return 0;
     }
   };
 
   var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
-  %ArrayBufferNeuter(array.buffer);
+  %ArrayBufferDetach(array.buffer);
   assertThrows(() => array.reduce(sum, tmp), TypeError);
   assertThrows(() => array.reduceRight(sum, tmp), TypeError);
 }
diff --git a/src/v8/test/mjsunit/es6/typedarray-reverse.js b/src/v8/test/mjsunit/es6/typedarray-reverse.js
index bfeb227..d713371 100644
--- a/src/v8/test/mjsunit/es6/typedarray-reverse.js
+++ b/src/v8/test/mjsunit/es6/typedarray-reverse.js
@@ -57,7 +57,7 @@
   // Detached Operation
   if (constructor != ArrayMaker) {
     var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
-    %ArrayBufferNeuter(array.buffer);
+    %ArrayBufferDetach(array.buffer);
     assertThrows(() => array.reverse(), TypeError);
   }
 }
diff --git a/src/v8/test/mjsunit/es6/typedarray-set-bytelength-not-smi.js b/src/v8/test/mjsunit/es6/typedarray-set-bytelength-not-smi.js
index 1f84287..e4a8c2b 100644
--- a/src/v8/test/mjsunit/es6/typedarray-set-bytelength-not-smi.js
+++ b/src/v8/test/mjsunit/es6/typedarray-set-bytelength-not-smi.js
@@ -5,13 +5,13 @@
 // Flags: --allow-natives-syntax --mock-arraybuffer-allocator
 
 (function TestBufferByteLengthNonSmi() {
-  const source_buffer_length = %_MaxSmi() + 1;
+  const source_buffer_length = %MaxSmi() + 1;
   const source_buffer = new ArrayBuffer(source_buffer_length);
   const source = new Uint16Array(source_buffer);
   assertEquals(source_buffer_length, source_buffer.byteLength);
   assertEquals(source_buffer_length / 2, source.length);
 
-  const target_buffer_length = %_MaxSmi() - 1;
+  const target_buffer_length = %MaxSmi() - 1;
   const target_buffer = new ArrayBuffer(target_buffer_length);
   const target = new Uint16Array(target_buffer);
   assertEquals(target_buffer_length, target_buffer.byteLength);
diff --git a/src/v8/test/mjsunit/es6/typedarray-slice.js b/src/v8/test/mjsunit/es6/typedarray-slice.js
index 2f40fe5..bd89f86 100644
--- a/src/v8/test/mjsunit/es6/typedarray-slice.js
+++ b/src/v8/test/mjsunit/es6/typedarray-slice.js
@@ -73,12 +73,12 @@
   var tmp = {
     [Symbol.toPrimitive]() {
       assertUnreachable("Parameter should not be processed when " +
-                        "array.[[ViewedArrayBuffer]] is neutered.");
+                        "array.[[ViewedArrayBuffer]] is detached.");
       return 0;
     }
   };
   var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
-  %ArrayBufferNeuter(array.buffer);
+  %ArrayBufferDetach(array.buffer);
   assertThrows(() => array.slice(tmp, tmp), TypeError);
 
   // Check that the species array must be a typed array
diff --git a/src/v8/test/mjsunit/es6/typedarray-sort.js b/src/v8/test/mjsunit/es6/typedarray-sort.js
index b69009b..7cd08b1 100644
--- a/src/v8/test/mjsunit/es6/typedarray-sort.js
+++ b/src/v8/test/mjsunit/es6/typedarray-sort.js
@@ -65,6 +65,87 @@
 
   // Detached Operation
   var array = new constructor([1, 2, 3, 4, 5, 6, 7, 8, 9, 10]);
-  %ArrayBufferNeuter(array.buffer);
+  %ArrayBufferDetach(array.buffer);
   assertThrows(() => array.sort(), TypeError);
 }
+
+// Check that TypedArray.p.sort is stable.
+for (let constructor of typedArrayConstructors) {
+  // Sort an array [0..kSize-1] modulo 4. If the sort is stable, the array
+  // will be partitioned into 4 parts, where each part has only increasing
+  // elements.
+  const kSize = 128;
+  const kModulo = 4;
+  const kRunSize = kSize / kModulo;
+
+  const template = Array.from({ length: kSize }, (_, i) => i);
+  const array = new constructor(template);
+
+  const compare = (a, b) => (b % kModulo) - (a % kModulo);
+  array.sort(compare);
+
+  function assertIncreasing(from) {
+    for (let i = from + 1; i < from + kRunSize; ++i) {
+      assertTrue(array[i - 1] < array[i]);
+      assertEquals(array[i - 1] % kModulo, array[i] % kModulo);
+    }
+  }
+
+  for (let i = 0; i < kModulo; ++i) assertIncreasing(i * kRunSize);
+}
+
+// The following creates a test for each typed element kind, where the array
+// to sort consists of some max/min/zero elements.
+//
+// When providing a custom compare function, the torque version of
+// TypedArray.p.sort needs to convert array elements to "Number"/"BigInt"
+// and back. The following test checks the edge cases for that conversion.
+
+let constructorsWithArrays = [
+  {ctor: Uint8Array, array: [255, 254, 4, 3, 2, 1, 0]},
+  {ctor: Int8Array, array: [127, 126, 1, 0, -1, -127, -128]},
+  {ctor: Uint16Array, array: [2 ** 16 - 1, 2 ** 16 - 2, 4, 3, 2, 1, 0]},
+  {
+    ctor: Int16Array,
+    array: [2 ** 15 - 1, 2 ** 15 - 2, 1, 0, -1, -(2 ** 15 - 1), -(2 ** 15)]
+  },
+  {ctor: Uint32Array, array: [2 ** 32 - 1, 2 ** 32 - 2, 4, 3, 2, 1, 0]},
+  {
+    ctor: Int32Array,
+    array: [2 ** 31 - 1, 2 ** 31 - 2, 1, 0, -1, -(2 ** 31 - 1), -(2 ** 31)]
+  },
+  {
+    ctor: Float32Array,
+    array: [2 ** 24, 2 ** 24 - 1, 1, 0,-1, -(2 ** 24 - 1), -(2 ** 24)]
+  },
+  {
+    ctor: Float64Array,
+    array: [2 ** 53, 2 ** 53 - 1, 1, 0, -1, -(2 ** 53 - 1), -(2 ** 53)]
+  },
+  {ctor: Uint8ClampedArray, array: [255, 254, 4, 3, 2, 1, 0]},
+  {
+    ctor: BigUint64Array,
+    array: [2n ** 64n - 1n, 2n ** 64n - 2n, 4n, 3n, 2n, 1n, 0n]
+  },
+  {
+    ctor: BigInt64Array,
+    array: [2n ** 63n - 1n, 2n ** 63n - 2n, 1n, 0n,
+            -1n, -(2n ** 63n - 1n), -(2n ** 63n)]
+  }
+];
+
+// Compare function needs to return a Number in all cases, and not a BigInt.
+// Hence we can not simply return "a - b".
+function cmpfn(a, b) {
+  if (a < b) return -1;
+  if (b < a) return 1;
+  return 0;
+}
+
+for (let constructor of constructorsWithArrays) {
+  let array = new constructor.ctor(constructor.array);
+
+  assertEquals(array.sort(cmpfn), array);
+  assertArrayLikeEquals(array, constructor.array.reverse(), constructor.ctor);
+  assertEquals(array.length, constructor.array.length);
+}
diff --git a/src/v8/test/mjsunit/es6/typedarray-tostring.js b/src/v8/test/mjsunit/es6/typedarray-tostring.js
index a1fa9c7..f388881 100644
--- a/src/v8/test/mjsunit/es6/typedarray-tostring.js
+++ b/src/v8/test/mjsunit/es6/typedarray-tostring.js
@@ -71,10 +71,8 @@
   assertEquals("1,2,3", o1.join());
   assertEquals("1,2,3", o1.toString());
   assertThrows(function() { o1.toLocaleString() }, TypeError);
-  // TODO(littledan): Use the same function for TypedArray as for
-  // Array, as the spec says (but Firefox doesn't do either).
-  // Currently, using the same method leads to a bootstrap failure.
-  // assertEquals(o1.toString, Array.prototype.toString);
+
+  assertEquals(o1.toString, Array.prototype.toString);
 
   // Redefining length does not change result
   var a5 = new constructor([1, 2, 3])
@@ -101,7 +99,7 @@
 
   // Detached Operation
   var array = new constructor([1, 2, 3]);
-  %ArrayBufferNeuter(array.buffer);
+  %ArrayBufferDetach(array.buffer);
   assertThrows(() => array.join(), TypeError);
   assertThrows(() => array.toLocalString(), TypeError);
   assertThrows(() => array.toString(), TypeError);
diff --git a/src/v8/test/mjsunit/es6/typedarray.js b/src/v8/test/mjsunit/es6/typedarray.js
index 02bd91c..1da65a5 100644
--- a/src/v8/test/mjsunit/es6/typedarray.js
+++ b/src/v8/test/mjsunit/es6/typedarray.js
@@ -46,11 +46,9 @@
   assertThrows(function() { new ArrayBuffer(-10); }, RangeError);
   assertThrows(function() { new ArrayBuffer(-2.567); }, RangeError);
 
-/* TODO[dslomov]: Reenable the test
   assertThrows(function() {
     var ab1 = new ArrayBuffer(0xFFFFFFFFFFFF)
   }, RangeError);
-*/
 
   var ab = new ArrayBuffer();
   assertSame(0, ab.byteLength);
@@ -636,7 +634,7 @@
   var detached = false;
   evilarr[1] = {
     [Symbol.toPrimitive]() {
-      %ArrayBufferNeuter(a111.buffer);
+      %ArrayBufferDetach(a111.buffer);
       detached = true;
       return 1;
     }
@@ -648,7 +646,7 @@
   var tmp = {
     [Symbol.toPrimitive]() {
       assertUnreachable("Parameter should not be processed when " +
-                        "array.[[ViewedArrayBuffer]] is neutered.");
+                        "array.[[ViewedArrayBuffer]] is detached.");
       return 1;
     }
   };
@@ -662,7 +660,7 @@
       let detached = false;
       const offset = {
         [Symbol.toPrimitive]() {
-          %ArrayBufferNeuter(xs.buffer);
+          %ArrayBufferDetach(xs.buffer);
           detached = true;
           return 0;
         }
@@ -677,7 +675,7 @@
     for (const klass of typedArrayConstructors) {
       const a = new klass(2);
       for (let i = 0; i < a.length; i++) a[i] = i;
-      %ArrayBufferNeuter(a.buffer);
+      %ArrayBufferDetach(a.buffer);
 
       const b = new klass(2);
       assertThrows(() => b.set(a), TypeError);
@@ -815,10 +813,10 @@
   assertEquals(255, a[s2]);
   assertEquals(0, a[-0]);
 
-  /* Chromium bug: 424619
-   * a[-Infinity] = 50;
-   * assertEquals(undefined, a[-Infinity]);
-   */
+
+  a[-Infinity] = 50;
+  assertEquals(undefined, a[-Infinity]);
+
   a[1.5] = 10;
   assertEquals(undefined, a[1.5]);
   var nan = Math.sqrt(-1);
@@ -1022,3 +1020,29 @@
 
   a.set(v0);
 });
+
+function TestMapCustomSpeciesConstructor(constructor) {
+  const sample = new constructor([40, 42, 42]);
+  let result, ctorThis;
+
+  sample.constructor = {};
+  sample.constructor[Symbol.species] = function(count) {
+    result = arguments;
+    ctorThis = this;
+    return new constructor(count);
+  };
+
+  sample.map(function(v) { return v; });
+
+  assertSame(result.length, 1, "called with 1 argument");
+  assertSame(result[0], 3, "[0] is the new captured length");
+
+  assertTrue(
+    ctorThis instanceof sample.constructor[Symbol.species],
+    "`this` value in the @@species fn is an instance of the function itself"
+  );
+};
+
+for(i = 0; i < typedArrayConstructors.length; i++) {
+  TestPropertyTypeChecks(typedArrayConstructors[i]);
+}
diff --git a/src/v8/test/mjsunit/es6/unicode-regexp-restricted-syntax.js b/src/v8/test/mjsunit/es6/unicode-regexp-restricted-syntax.js
index dd4fa39..1cc46df 100644
--- a/src/v8/test/mjsunit/es6/unicode-regexp-restricted-syntax.js
+++ b/src/v8/test/mjsunit/es6/unicode-regexp-restricted-syntax.js
@@ -13,6 +13,7 @@
 assertThrows("/\\c0/u", SyntaxError);
 // test262/built-ins/RegExp/unicode_restricted_quantifiable_assertion
 assertThrows("/(?=.)*/u", SyntaxError);
+assertThrows("/(?=.){1,2}/u", SyntaxError);
 // test262/built-ins/RegExp/unicode_restricted_octal_escape
 assertThrows("/[\\1]/u", SyntaxError);
 assertThrows("/\\00/u", SyntaxError);
diff --git a/src/v8/test/mjsunit/es6/unscopables.js b/src/v8/test/mjsunit/es6/unscopables.js
index 782dd2d..d60abc4 100644
--- a/src/v8/test/mjsunit/es6/unscopables.js
+++ b/src/v8/test/mjsunit/es6/unscopables.js
@@ -96,7 +96,10 @@
   var fill = 'local fill';
   var find = 'local find';
   var findIndex = 'local findIndex';
+  var flat = 'local flat';
+  var flatMap = 'local flatMap';
   var keys = 'local keys';
+  var includes = 'local includes';
   var values = 'local values';
 
   var array = [];
@@ -108,6 +111,9 @@
     assertEquals('local fill', fill);
     assertEquals('local find', find);
     assertEquals('local findIndex', findIndex);
+    assertEquals('local flat', flat);
+    assertEquals('local flatMap', flatMap);
+    assertEquals('local includes', includes);
     assertEquals('local keys', keys);
     assertEquals('local values', values);
     assertEquals(42, toString);
diff --git a/src/v8/test/mjsunit/es7/array-includes-receiver.js b/src/v8/test/mjsunit/es7/array-includes-receiver.js
index edeae88..91916aa 100644
--- a/src/v8/test/mjsunit/es7/array-includes-receiver.js
+++ b/src/v8/test/mjsunit/es7/array-includes-receiver.js
@@ -356,7 +356,7 @@
 
     Detached_Int8Array() {
       var array = new Int8Array(10);
-      %ArrayBufferNeuter(array.buffer);
+      %ArrayBufferDetach(array.buffer);
       assertFalse(Array.prototype.includes.call(array, 0));
       assertFalse(Array.prototype.includes.call(array, 0, 10));
     },
@@ -391,7 +391,7 @@
 
     Detached_Uint8Array() {
       var array = new Uint8Array(10);
-      %ArrayBufferNeuter(array.buffer);
+      %ArrayBufferDetach(array.buffer);
       assertFalse(Array.prototype.includes.call(array, 0));
       assertFalse(Array.prototype.includes.call(array, 0, 10));
     },
@@ -421,7 +421,7 @@
 
     Detached_Uint8ClampedArray() {
       var array = new Uint8ClampedArray(10);
-      %ArrayBufferNeuter(array.buffer);
+      %ArrayBufferDetach(array.buffer);
       assertFalse(Array.prototype.includes.call(array, 0));
       assertFalse(Array.prototype.includes.call(array, 0, 10));
     },
@@ -453,7 +453,7 @@
 
     Detached_Int16Array() {
       var array = new Int16Array(10);
-      %ArrayBufferNeuter(array.buffer);
+      %ArrayBufferDetach(array.buffer);
       assertFalse(Array.prototype.includes.call(array, 0));
       assertFalse(Array.prototype.includes.call(array, 0, 10));
     },
@@ -485,7 +485,7 @@
 
     Detached_Uint16Array() {
       var array = new Uint16Array(10);
-      %ArrayBufferNeuter(array.buffer);
+      %ArrayBufferDetach(array.buffer);
       assertFalse(Array.prototype.includes.call(array, 0));
       assertFalse(Array.prototype.includes.call(array, 0, 10));
     },
@@ -517,7 +517,7 @@
 
     Detached_Int32Array() {
       var array = new Int32Array(10);
-      %ArrayBufferNeuter(array.buffer);
+      %ArrayBufferDetach(array.buffer);
       assertFalse(Array.prototype.includes.call(array, 0));
       assertFalse(Array.prototype.includes.call(array, 0, 10));
     },
@@ -550,7 +550,7 @@
 
     Detached_Uint32Array() {
       var array = new Uint32Array(10);
-      %ArrayBufferNeuter(array.buffer);
+      %ArrayBufferDetach(array.buffer);
       assertFalse(Array.prototype.includes.call(array, 0));
       assertFalse(Array.prototype.includes.call(array, 0, 10));
     },
@@ -583,7 +583,7 @@
 
     Detached_Float32Array() {
       var array = new Float32Array(10);
-      %ArrayBufferNeuter(array.buffer);
+      %ArrayBufferDetach(array.buffer);
       assertFalse(Array.prototype.includes.call(array, 0));
       assertFalse(Array.prototype.includes.call(array, 0, 10));
     },
@@ -616,7 +616,7 @@
 
     Detached_Float64Array() {
       var array = new Float32Array(10);
-      %ArrayBufferNeuter(array.buffer);
+      %ArrayBufferDetach(array.buffer);
       assertFalse(Array.prototype.includes.call(array, 0));
       assertFalse(Array.prototype.includes.call(array, 0, 10));
     },
diff --git a/src/v8/test/mjsunit/es7/array-includes.js b/src/v8/test/mjsunit/es7/array-includes.js
index 4170a1c..ac0f341 100644
--- a/src/v8/test/mjsunit/es7/array-includes.js
+++ b/src/v8/test/mjsunit/es7/array-includes.js
@@ -630,6 +630,34 @@
 })();
 
 
+// Array.prototype.includes accesses out-of-bounds if length is changed late.
+(function () {
+  let arr = [1, 2, 3];
+  assertTrue(arr.includes(undefined, {
+    toString: function () {
+      arr.length = 0;
+      return 0;
+    }
+  }));
+
+  arr = [1, 2, 3];
+  assertFalse(arr.includes(undefined, {
+    toString: function () {
+      arr.length = 0;
+      return 10;
+    }
+  }));
+
+  arr = [1, 2, 3];
+  assertFalse(arr.includes(4, {
+    toString: function () {
+      arr.push(4);
+      return 0;
+    }
+  }));
+})();
+
+
 // Array.prototype.includes should use the SameValueZero algorithm to compare
 (function() {
   assertTrue([1, 2, 3].includes(2));
diff --git a/src/v8/test/mjsunit/es7/exponentiation-operator.js b/src/v8/test/mjsunit/es7/exponentiation-operator.js
index 9d934bd..2c504a9 100644
--- a/src/v8/test/mjsunit/es7/exponentiation-operator.js
+++ b/src/v8/test/mjsunit/es7/exponentiation-operator.js
@@ -264,13 +264,13 @@
 TestOverrideMathPow();
 
 function TestBadAssignmentLHS() {
-  assertThrows("if (false) { 17 **= 10; }", ReferenceError);
-  assertThrows("if (false) { '17' **= 10; }", ReferenceError);
-  assertThrows("if (false) { /17/ **= 10; }", ReferenceError);
+  assertThrows("if (false) { 17 **= 10; }", SyntaxError);
+  assertThrows("if (false) { '17' **= 10; }", SyntaxError);
+  assertThrows("if (false) { /17/ **= 10; }", SyntaxError);
   assertThrows("if (false) { ({ valueOf() { return 17; } } **= 10); }",
-               ReferenceError);
-  // TODO(caitp): a Call expression as LHS should be an early ReferenceError!
-  // assertThrows("if (false) { Array() **= 10; }", ReferenceError);
+               SyntaxError);
+  // TODO(caitp): a Call expression as LHS should be an early SyntaxError!
+  // assertThrows("if (false) { Array() **= 10; }", SyntaxError);
   assertThrows(() => Array() **= 10, ReferenceError);
 }
 TestBadAssignmentLHS();
diff --git a/src/v8/test/mjsunit/es7/regress/regress-5986.js b/src/v8/test/mjsunit/es7/regress/regress-5986.js
index ca157f8..bd3e9e0 100644
--- a/src/v8/test/mjsunit/es7/regress/regress-5986.js
+++ b/src/v8/test/mjsunit/es7/regress/regress-5986.js
@@ -6,11 +6,9 @@
 var array = [1.7, 1.7, 1.7];
 var mutator = {
   [Symbol.toPrimitive]() {
-    Object.defineProperties(array, {
-      0: { get() { } },
-      1: { get() { } },
-      2: { get() { } },
-    });
+    Object.defineProperties(
+        array, {0: {get() {}}, 1: {get() {}}, 2: {get() {}}});
+
     return 0;
   }
 };
@@ -19,10 +17,14 @@
 
 function search(array, searchElement, startIndex) {
   return array.includes(searchElement, startIndex);
-}
-
+};
+%PrepareFunctionForOptimization(search);
 array = [1.7, 1.7, 1.7];
-var not_mutator = { [Symbol.toPrimitive]() { return 0; } };
+var not_mutator = {
+  [Symbol.toPrimitive]() {
+    return 0;
+  }
+};
 assertFalse(search(array, undefined, not_mutator));
 assertFalse(search(array, undefined, not_mutator));
 %OptimizeFunctionOnNextCall(search);
diff --git a/src/v8/test/mjsunit/es8/async-arrow-default-function-await.js b/src/v8/test/mjsunit/es8/async-arrow-default-function-await.js
new file mode 100644
index 0000000..6c4d00e
--- /dev/null
+++ b/src/v8/test/mjsunit/es8/async-arrow-default-function-await.js
@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+async(o = (function(await) {})) => 0
diff --git a/src/v8/test/mjsunit/es8/async-arrow-lexical-arguments.js b/src/v8/test/mjsunit/es8/async-arrow-lexical-arguments.js
index b29f17f..720770e 100644
--- a/src/v8/test/mjsunit/es8/async-arrow-lexical-arguments.js
+++ b/src/v8/test/mjsunit/es8/async-arrow-lexical-arguments.js
@@ -21,7 +21,7 @@
 
   assertFalse(hadValue || hadError);
 
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
 
   if (hadError) throw actual;
 
diff --git a/src/v8/test/mjsunit/es8/async-arrow-lexical-new.target.js b/src/v8/test/mjsunit/es8/async-arrow-lexical-new.target.js
index 943267e..7d01628 100644
--- a/src/v8/test/mjsunit/es8/async-arrow-lexical-new.target.js
+++ b/src/v8/test/mjsunit/es8/async-arrow-lexical-new.target.js
@@ -21,7 +21,7 @@
 
   assertFalse(hadValue || hadError);
 
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
 
   if (hadError) throw actual;
 
diff --git a/src/v8/test/mjsunit/es8/async-arrow-lexical-super.js b/src/v8/test/mjsunit/es8/async-arrow-lexical-super.js
index b15a383..b175ac5 100644
--- a/src/v8/test/mjsunit/es8/async-arrow-lexical-super.js
+++ b/src/v8/test/mjsunit/es8/async-arrow-lexical-super.js
@@ -21,7 +21,7 @@
 
   assertFalse(hadValue || hadError);
 
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
 
   if (hadError) throw actual;
 
diff --git a/src/v8/test/mjsunit/es8/async-arrow-lexical-this.js b/src/v8/test/mjsunit/es8/async-arrow-lexical-this.js
index 38bdddc..a21978d 100644
--- a/src/v8/test/mjsunit/es8/async-arrow-lexical-this.js
+++ b/src/v8/test/mjsunit/es8/async-arrow-lexical-this.js
@@ -21,7 +21,7 @@
 
   assertFalse(hadValue || hadError);
 
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
 
   if (hadError) throw actual;
 
diff --git a/src/v8/test/mjsunit/es8/async-await-basic.js b/src/v8/test/mjsunit/es8/async-await-basic.js
index 6e9ee02..1c7b2ac 100644
--- a/src/v8/test/mjsunit/es8/async-await-basic.js
+++ b/src/v8/test/mjsunit/es8/async-await-basic.js
@@ -23,7 +23,7 @@
 
   assertFalse(hadValue || hadError);
 
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
 
   if (!hadError) {
     throw new MjsUnitAssertionError(
@@ -57,7 +57,7 @@
 
   assertFalse(hadValue || hadError);
 
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
 
   if (hadError) throw actual;
 
@@ -402,7 +402,7 @@
     }
   }
   foo().then(() => log.push("c"));
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
   assertEquals(["b", "a", "c"], log);
 }
 
@@ -416,7 +416,7 @@
     }
   }
   foo().then(() => log.push("c"));
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
   assertEquals(["b", "a", "c"], log);
 }
 
@@ -430,7 +430,7 @@
     }
   }
   foo().then(() => log.push("c"));
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
   assertEquals(["a", "b", "c"], log);
 }
 
@@ -445,7 +445,7 @@
     }
   }
   foo().then(() => log.push("c"));
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
   assertEquals(["b", "c", "a"], log);
 }
 
@@ -459,7 +459,7 @@
     }
   }
   foo().then(() => log.push("c"));
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
   assertEquals(["b", "a", "c"], log);
 }
 
@@ -473,7 +473,7 @@
     }
   }
   foo().then(() => log.push("c"));
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
   assertEquals(["a", "b", "c"], log);
 }
 
@@ -488,7 +488,7 @@
     }
   }
   foo().then(() => log.push("c"));
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
   assertEquals(["b", "a", "c"], log);
 }
 
@@ -502,7 +502,7 @@
     }
   }
   foo().then(() => log.push("c"));
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
   assertEquals(["b", "a", "c"], log);
 }
 
@@ -516,7 +516,7 @@
     }
   }
   foo().then(() => log.push("c"));
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
   assertEquals(["a", "b", "c"], log);
 }
 
@@ -531,7 +531,7 @@
     }
   }
   foo().then(() => log.push("c"));
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
   assertEquals(["b", "c", "a"], log);
 }
 
@@ -545,7 +545,7 @@
     }
   }
   foo().then(() => log.push("c"));
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
   assertEquals(["b", "c", "a"], log);
 }
 
@@ -559,7 +559,7 @@
     }
   }
   foo().then(() => log.push("c"));
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
   assertEquals(["a", "b", "c"], log);
 }
 
@@ -585,7 +585,7 @@
 
   var ans;
   f2().then(x => ans = x).catch(e => ans = e);
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
   assertEquals([0], ans);
 }
 
diff --git a/src/v8/test/mjsunit/es8/async-await-interleaved.js b/src/v8/test/mjsunit/es8/async-await-interleaved.js
new file mode 100644
index 0000000..edc5a42
--- /dev/null
+++ b/src/v8/test/mjsunit/es8/async-await-interleaved.js
@@ -0,0 +1,61 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Check for correct interleaving of Promises and async/await
+(function () {
+  const iterations = 10;
+  let promiseCounter = iterations;
+  let awaitCounter = 0;
+
+  async function check(v) {
+    awaitCounter = v;
+    // The following checks ensure that "await" takes 3 ticks on the
+    // microtask queue. Note: this will change in the future
+    if (awaitCounter === 0) {
+      assertEquals(iterations, promiseCounter);
+    } else if (awaitCounter <= Math.floor(iterations / 3)) {
+      assertEquals(iterations - awaitCounter * 3, promiseCounter);
+    } else {
+      assertEquals(0, promiseCounter);
+    }
+  }
+
+  async function f() {
+    for (let i = 0; i < iterations; i++) {
+      await check(i);
+    }
+    return 0;
+  }
+
+  function countdown(v) {
+    promiseCounter = v;
+    if (v > 0) Promise.resolve(v - 1).then(countdown);
+  }
+
+  countdown(iterations);
+  f();
+})();
diff --git a/src/v8/test/mjsunit/es8/async-await-no-constructor.js b/src/v8/test/mjsunit/es8/async-await-no-constructor.js
index e954e2a..5e4780a 100644
--- a/src/v8/test/mjsunit/es8/async-await-no-constructor.js
+++ b/src/v8/test/mjsunit/es8/async-await-no-constructor.js
@@ -23,5 +23,5 @@
 
 foo();
 bar();
-%RunMicrotasks();
+%PerformMicrotaskCheckpoint();
 assertEquals(2, count);
diff --git a/src/v8/test/mjsunit/es8/async-await-species.js b/src/v8/test/mjsunit/es8/async-await-species.js
index b3e9254..3fc46fd 100644
--- a/src/v8/test/mjsunit/es8/async-await-species.js
+++ b/src/v8/test/mjsunit/es8/async-await-species.js
@@ -21,7 +21,7 @@
 
   assertFalse(hadValue || hadError);
 
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
 
   if (hadError) throw actual;
 
diff --git a/src/v8/test/mjsunit/es8/async-destructuring.js b/src/v8/test/mjsunit/es8/async-destructuring.js
index 1fbac5a..d5e90eb 100644
--- a/src/v8/test/mjsunit/es8/async-destructuring.js
+++ b/src/v8/test/mjsunit/es8/async-destructuring.js
@@ -21,7 +21,7 @@
 
   assertFalse(hadValue || hadError);
 
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
 
   if (!hadError) {
     throw new MjsUnitAssertionError(
@@ -55,7 +55,7 @@
 
   assertFalse(hadValue || hadError);
 
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
 
   if (hadError) throw actual;
 
@@ -77,7 +77,7 @@
   assertEquals(1, y);
   assertEquals(1, z);
   assertEquals(0, w);
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
   assertEquals(1, y);
   assertEquals(1, z);
   assertEquals(1, w);
diff --git a/src/v8/test/mjsunit/es8/async-function-stacktrace.js b/src/v8/test/mjsunit/es8/async-function-stacktrace.js
index ab6dd26..e9358c2 100644
--- a/src/v8/test/mjsunit/es8/async-function-stacktrace.js
+++ b/src/v8/test/mjsunit/es8/async-function-stacktrace.js
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --noasync-stack-traces
+
 async function test(func, funcs) {
   try {
     await func();
@@ -81,21 +83,19 @@
     try { await reject(); } catch (e) { throw new Error("FAIL"); }
   } }).c4, ["c4"]);
 
-  // TODO(caitp): We should infer anonymous async functions as the empty
-  // string, not as the name of a function they're passed as a parameter to.
   await test(async x => { throw new Error("FAIL") },
-             ["test", "test", "runTests"]);
+             ["test", "runTests"]);
   await test(async() => { throw new Error("FAIL") },
-             ["test", "test", "runTests"]);
+             ["test", "runTests"]);
   await test(async(a) => { throw new Error("FAIL") },
-             ["test", "test", "runTests"]);
+             ["test", "runTests"]);
   await test(async(a, b) => { throw new Error("FAIL") },
-             ["test", "test", "runTests"]);
+             ["test", "runTests"]);
 
-  await test(async x => { await 1; throw new Error("FAIL") }, ["test"]);
-  await test(async() => { await 1; throw new Error("FAIL") }, ["test"]);
-  await test(async(a) => { await 1; throw new Error("FAIL") }, ["test"]);
-  await test(async(a, b) => { await 1; throw new Error("FAIL") }, ["test"]);
+  await test(async x => { await 1; throw new Error("FAIL") }, []);
+  await test(async() => { await 1; throw new Error("FAIL") }, []);
+  await test(async(a) => { await 1; throw new Error("FAIL") }, []);
+  await test(async(a, b) => { await 1; throw new Error("FAIL") }, []);
 
   await test(async x => {
     await 1;
@@ -104,7 +104,7 @@
     } catch (e) {
       throw new Error("FAIL");
     }
-  }, ["test"]);
+  }, []);
 
   await test(async() => {
     await 1;
@@ -113,7 +113,7 @@
     } catch (e) {
       throw new Error("FAIL");
     }
-  }, ["test"]);
+  }, []);
 
   await test(async(a) => {
     await 1;
@@ -122,7 +122,7 @@
     } catch (e) {
       throw new Error("FAIL");
     }
-  }, ["test"]);
+  }, []);
 
   await test(async(a, b) => {
     await 1;
@@ -131,7 +131,7 @@
     } catch (e) {
       throw new Error("FAIL");
     }
-  }, ["test"]);
+  }, []);
 
   await test(async x => {
     await 1;
@@ -140,7 +140,7 @@
     } catch (e) {
       throw new Error("FAIL");
     }
-  }, ["test"]);
+  }, []);
 
   await test(async() => {
     await 1;
@@ -149,7 +149,7 @@
     } catch (e) {
       throw new Error("FAIL");
     }
-  }, ["test"]);
+  }, []);
 
   await test(async(a) => {
     await 1;
@@ -158,7 +158,7 @@
     } catch (e) {
       throw new Error("FAIL");
     }
-  }, ["test"]);
+  }, []);
 
   await test(async(a, b) => {
     await 1;
@@ -167,7 +167,7 @@
     } catch (e) {
       throw new Error("FAIL");
     }
-  }, ["test"]);
+  }, []);
 }
 
 runTests().catch(e => {
diff --git a/src/v8/test/mjsunit/es8/async-function-try-finally.js b/src/v8/test/mjsunit/es8/async-function-try-finally.js
index 9ba07eb..43badc4 100644
--- a/src/v8/test/mjsunit/es8/async-function-try-finally.js
+++ b/src/v8/test/mjsunit/es8/async-function-try-finally.js
@@ -21,7 +21,7 @@
 
   assertFalse(hadValue || hadError);
 
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
 
   if (!hadError) {
     throw new MjsUnitAssertionError(
@@ -55,7 +55,7 @@
 
   assertFalse(hadValue || hadError);
 
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
 
   if (hadError) throw actual;
 
diff --git a/src/v8/test/mjsunit/es8/object-entries.js b/src/v8/test/mjsunit/es8/object-entries.js
index 5c7e74e..f119cfc 100644
--- a/src/v8/test/mjsunit/es8/object-entries.js
+++ b/src/v8/test/mjsunit/es8/object-entries.js
@@ -19,7 +19,7 @@
 TestMeta();
 
 
-function TestBasic() {
+function TestBasic(withWarmup) {
   var x = 16;
   var O = {
     d: 1,
@@ -33,22 +33,29 @@
   O.a = 2;
   O.b = 4;
   Object.defineProperty(O, "HIDDEN", { enumerable: false, value: NaN });
-  assertEquals([
+  if (withWarmup) {
+    for (const key in O) {}
+  }
+  O.c = 6;
+  const resultEntries = [
     ["0", 123],
     ["256", "ducks"],
     ["1000", 456],
     ["d", 1],
-    ["c", 3],
+    ["c", 6],
     ["0x100", "quack"],
     ["a", 2],
     ["b", 4]
-  ], Object.entries(O));
+  ];
+  assertEquals(resultEntries, Object.entries(O));
+  assertEquals(resultEntries, Object.entries(O));
   assertEquals(Object.entries(O), Object.keys(O).map(key => [key, O[key]]));
 
   assertTrue(Array.isArray(Object.entries({})));
   assertEquals(0, Object.entries({}).length);
 }
 TestBasic();
+TestBasic(true);
 
 
 function TestToObject() {
@@ -59,7 +66,7 @@
 TestToObject();
 
 
-function TestOrder() {
+function TestOrder(withWarmup) {
   var O = {
     a: 1,
     [Symbol.iterator]: null
@@ -88,6 +95,11 @@
     }
   });
 
+  if (withWarmup) {
+    for (const key in P) {}
+  }
+  log = [];
+
   assertEquals([["456", 123], ["a", 1]], Object.entries(P));
   assertEquals([
     "[[OwnPropertyKeys]]",
@@ -99,9 +111,10 @@
   ], log);
 }
 TestOrder();
+TestOrder(true);
 
 
-function TestOrderWithDuplicates() {
+function TestOrderWithDuplicates(withWarmup) {
   var O = {
     a: 1,
     [Symbol.iterator]: null
@@ -130,30 +143,28 @@
     }
   });
 
-  assertEquals([
-    ["a", 1],
-    ["a", 1],
-    ["456", 123],
-    ["456", 123]
-  ], Object.entries(P));
-  assertEquals([
-    "[[OwnPropertyKeys]]",
-    "[[GetOwnProperty]](\"a\")",
-    "[[Get]](\"a\")",
-    "[[GetOwnProperty]](\"a\")",
-    "[[Get]](\"a\")",
-    "[[GetOwnProperty]](\"456\")",
-    "[[Get]](\"456\")",
-    "[[GetOwnProperty]](\"HIDDEN\")",
-    "[[GetOwnProperty]](\"HIDDEN\")",
-    "[[GetOwnProperty]](\"456\")",
-    "[[Get]](\"456\")"
-  ], log);
+  if (withWarmup) {
+    for (const key in O) {};
+    try { for (const key in P) {} } catch {};
+  }
+
+  assertThrows(() => Object.entries(P), TypeError);
 }
 TestOrderWithDuplicates();
+TestOrderWithDuplicates(true);
 
+function TestDescriptorProperty() {
+  function f() {};
+  const o = {};
+  o.a = f;
 
-function TestPropertyFilter() {
+  for (const key in o) {};
+  const entries = Object.entries(o);
+  assertEquals([['a', f]], entries);
+}
+TestDescriptorProperty();
+
+function TestPropertyFilter(withWarmup) {
   var object = { prop3: 30 };
   object[2] = 40;
   object["prop4"] = 50;
@@ -164,6 +175,10 @@
   var sym = Symbol("prop8");
   object[sym] = 90;
 
+  if (withWarmup) {
+    for (const key in object) {}
+  }
+
   values = Object.entries(object);
   assertEquals(5, values.length);
   assertEquals([
@@ -175,11 +190,33 @@
   ], values);
 }
 TestPropertyFilter();
+TestPropertyFilter(true);
 
+function TestPropertyFilter2(withWarmup) {
+  var object = { };
+  Object.defineProperty(object, "prop1", { value: 10 });
+  Object.defineProperty(object, "prop2", { value: 20 });
+  object.prop3 = 30;
 
-function TestWithProxy() {
+  if (withWarmup) {
+    for (const key in object) {}
+  }
+
+  values = Object.entries(object);
+  assertEquals(1, values.length);
+  assertEquals([
+    [ "prop3", 30 ],
+  ], values);
+}
+TestPropertyFilter2();
+TestPropertyFilter2(true);
+
+function TestWithProxy(withWarmup) {
   var obj1 = {prop1:10};
   var proxy1 = new Proxy(obj1, { });
+  if (withWarmup) {
+    for (const key in proxy1) {}
+  }
   assertEquals([ [ "prop1", 10 ] ], Object.entries(proxy1));
 
   var obj2 = {};
@@ -191,6 +228,9 @@
       return Reflect.getOwnPropertyDescriptor(target, name);
     }
   });
+  if (withWarmup) {
+    for (const key in proxy2) {}
+  }
   assertEquals([ [ "prop2", 20 ], [ "prop3", 30 ] ], Object.entries(proxy2));
 
   var obj3 = {};
@@ -206,12 +246,16 @@
       return [ "prop0", "prop1", Symbol("prop2"), Symbol("prop5") ];
     }
   });
+  if (withWarmup) {
+    for (const key in proxy3) {}
+  }
   assertEquals([ [ "prop0", 0 ], [ "prop1", 5 ] ], Object.entries(proxy3));
 }
 TestWithProxy();
+TestWithProxy(true);
 
 
-function TestMutateDuringEnumeration() {
+function TestMutateDuringEnumeration(withWarmup) {
   var aDeletesB = {
     get a() {
       delete this.b;
@@ -219,6 +263,9 @@
     },
     b: 2
   };
+  if (withWarmup) {
+    for (const key in aDeletesB) {}
+  }
   assertEquals([ [ "a", 1 ] ], Object.entries(aDeletesB));
 
   var aRemovesB = {
@@ -228,9 +275,15 @@
     },
     b: 2
   };
+  if (withWarmup) {
+    for (const key in aRemovesB) {}
+  }
   assertEquals([ [ "a", 1 ] ], Object.entries(aRemovesB));
 
   var aAddsB = { get a() { this.b = 2; return 1; } };
+  if (withWarmup) {
+    for (const key in aAddsB) {}
+  }
   assertEquals([ [ "a", 1 ] ], Object.entries(aAddsB));
 
   var aMakesBEnumerable = {};
@@ -243,12 +296,16 @@
   });
   Object.defineProperty(aMakesBEnumerable, "b", {
       value: 2, configurable:true, enumerable: false });
+  if (withWarmup) {
+    for (const key in aMakesBEnumerable) {}
+  }
   assertEquals([ [ "a", 1 ], [ "b", 2 ] ], Object.entries(aMakesBEnumerable));
 }
 TestMutateDuringEnumeration();
+TestMutateDuringEnumeration(true);
 
 
-(function TestElementKinds() {
+function TestElementKinds(withWarmup) {
   var O1 = { name: "1" }, O2 = { name: "2" }, O3 = { name: "3" };
   var PI = 3.141592653589793;
   var E = 2.718281828459045;
@@ -303,13 +360,22 @@
         }), [["0", "s"], ["1", "t"], ["2", "r"], ["9999", "Y"]] ],
   };
 
+  if (withWarmup) {
+    for (const key in element_kinds) {}
+  }
   for (let [kind, [object, expected]] of Object.entries(element_kinds)) {
+    if (withWarmup) {
+      for (const key in object) {}
+    }
     let result1 = Object.entries(object);
     %HeapObjectVerify(object);
     %HeapObjectVerify(result1);
     assertEquals(expected, result1, `fast Object.entries() with ${kind}`);
 
     let proxy = new Proxy(object, {});
+    if (withWarmup) {
+      for (const key in proxy) {}
+    }
     let result2 = Object.entries(proxy);
     %HeapObjectVerify(result2);
     assertEquals(result1, result2, `slow Object.entries() with ${kind}`);
@@ -331,9 +397,15 @@
   for (let [kind, [object, expected]] of Object.entries(element_kinds)) {
     if (kind == "FAST_STRING_WRAPPER_ELEMENTS") break;
     object.__defineGetter__(1, makeFastElements);
+    if (withWarmup) {
+      for (const key in object) {}
+    }
     let result1 = Object.entries(object).toString();
     %HeapObjectVerify(object);
     %HeapObjectVerify(result1);
   }
 
-})();
+}
+
+TestElementKinds();
+TestElementKinds(true);
diff --git a/src/v8/test/mjsunit/es8/object-get-own-property-descriptors.js b/src/v8/test/mjsunit/es8/object-get-own-property-descriptors.js
index f88840d..0bd84bd 100644
--- a/src/v8/test/mjsunit/es8/object-get-own-property-descriptors.js
+++ b/src/v8/test/mjsunit/es8/object-get-own-property-descriptors.js
@@ -193,21 +193,7 @@
     defineProperty(target, name, desc) { assertUnreachable(); }
   });
 
-  var result = Object.getOwnPropertyDescriptors(P);
-  assertEquals({
-    "A": {
-      "value": "VALUE",
-      "writable": false,
-      "enumerable": false,
-      "configurable": true
-    }
-  }, result);
-  assertTrue(result.hasOwnProperty("A"));
-  assertEquals([
-    "ownKeys()",
-    "getOwnPropertyDescriptor(A)",
-    "getOwnPropertyDescriptor(A)"
-  ], log);
+  assertThrows(() => Object.getOwnPropertyDescriptors(P), TypeError);
 }
 TestDuplicateKeys();
 
diff --git a/src/v8/test/mjsunit/es8/object-values.js b/src/v8/test/mjsunit/es8/object-values.js
index 23fcaed..b66e4af 100644
--- a/src/v8/test/mjsunit/es8/object-values.js
+++ b/src/v8/test/mjsunit/es8/object-values.js
@@ -121,20 +121,7 @@
     }
   });
 
-  assertEquals([1, 1, 123, 123], Object.values(P));
-  assertEquals([
-    "[[OwnPropertyKeys]]",
-    "[[GetOwnProperty]](\"a\")",
-    "[[Get]](\"a\")",
-    "[[GetOwnProperty]](\"a\")",
-    "[[Get]](\"a\")",
-    "[[GetOwnProperty]](\"456\")",
-    "[[Get]](\"456\")",
-    "[[GetOwnProperty]](\"HIDDEN\")",
-    "[[GetOwnProperty]](\"HIDDEN\")",
-    "[[GetOwnProperty]](\"456\")",
-    "[[Get]](\"456\")",
-  ], log);
+  assertThrows(() => Object.values(P), TypeError);
 }
 TestOrderWithDuplicates();
 
diff --git a/src/v8/test/mjsunit/es9/object-spread-basic.js b/src/v8/test/mjsunit/es9/object-spread-basic.js
index 8264da4..a4de924 100644
--- a/src/v8/test/mjsunit/es9/object-spread-basic.js
+++ b/src/v8/test/mjsunit/es9/object-spread-basic.js
@@ -11,6 +11,11 @@
 assertEquals({}, y = { ...null });
 
 assertEquals({}, y = { ...1 });
+assertEquals({}, y = { ...1n });
+assertEquals({}, y = { ...NaN });
+assertEquals({}, y = { ...false });
+assertEquals({}, y = { ...true });
+assertEquals({}, y = { ...Symbol() });
 assertEquals({0: 'f', 1: 'o', 2: 'o'}, y = { ...'foo' });
 assertEquals({0: 0, 1: 1}, y = { ...[0, 1] });
 assertEquals({}, { ...new Proxy({}, {}) });
@@ -104,6 +109,52 @@
 
 var x = { a:1 };
 assertEquals(x, y = { set a(_) { throw new Error(); }, ...x });
+var prop = Object.getOwnPropertyDescriptor(y, 'a');
+assertEquals(prop.value, 1);
+assertFalse("set" in prop);
+assertTrue(prop.enumerable);
+assertTrue(prop.configurable);
+assertTrue(prop.writable);
 
-var x = { a:1 };
+var x = { a:2 };
 assertEquals(x, y = { get a() { throw new Error(); }, ...x });
+var prop = Object.getOwnPropertyDescriptor(y, 'a');
+assertEquals(prop.value, 2);
+assertFalse("get" in prop);
+assertTrue(prop.enumerable);
+assertTrue(prop.configurable);
+assertTrue(prop.writable);
+
+var x = { a:3 };
+assertEquals(x, y = {
+  get a() {
+    throw new Error();
+  },
+  set a(_) {
+    throw new Error();
+  },
+  ...x
+});
+var prop = Object.getOwnPropertyDescriptor(y, 'a');
+assertEquals(prop.value, 3);
+assertFalse("get" in prop);
+assertFalse("set" in prop);
+assertTrue(prop.enumerable);
+assertTrue(prop.configurable);
+assertTrue(prop.writable);
+
+var x = Object.seal({ a:4 });
+assertEquals(x, y = { ...x });
+var prop = Object.getOwnPropertyDescriptor(y, 'a');
+assertEquals(prop.value, 4);
+assertTrue(prop.enumerable);
+assertTrue(prop.configurable);
+assertTrue(prop.writable);
+
+var x = Object.freeze({ a:5 });
+assertEquals(x, y = { ...x });
+var prop = Object.getOwnPropertyDescriptor(y, 'a');
+assertEquals(prop.value, 5);
+assertTrue(prop.enumerable);
+assertTrue(prop.configurable);
+assertTrue(prop.writable);
diff --git a/src/v8/test/mjsunit/es9/object-spread-ic-dontenum-transition.js b/src/v8/test/mjsunit/es9/object-spread-ic-dontenum-transition.js
new file mode 100644
index 0000000..c403566
--- /dev/null
+++ b/src/v8/test/mjsunit/es9/object-spread-ic-dontenum-transition.js
@@ -0,0 +1,26 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function testMegamorphicWithDontEnumTransition() {
+  function spread(o) { return { ...o }; }
+
+  // Set up transition tree
+  let obj = { ...{}, a: 0, b: 1, c: 2, };
+  Object.defineProperty(obj, "boom", { enumerable: false, configurable: true,
+                                       writable: true });
+
+  // make CloneObjectIC MEGAMORPHIC
+  spread(new Proxy({}, {}));
+
+  // Ensure we don't crash, and create the correct object
+  let result = spread({ a: 0, b: 1, c: 2, boom: 3 });
+
+  assertEquals({ a: 0, b: 1, c: 2, boom: 3 }, result);
+  assertEquals({
+    enumerable: true,
+    writable: true,
+    configurable: true,
+    value: 3,
+  }, Object.getOwnPropertyDescriptor(result, "boom"));
+})();
diff --git a/src/v8/test/mjsunit/es9/object-spread-ic-multiple-transitions.js b/src/v8/test/mjsunit/es9/object-spread-ic-multiple-transitions.js
new file mode 100644
index 0000000..f31a6d9
--- /dev/null
+++ b/src/v8/test/mjsunit/es9/object-spread-ic-multiple-transitions.js
@@ -0,0 +1,16 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function testMegamorphicWithNonSimpleTransitionHandler() {
+  function spread(o) { return { ...o }; }
+
+  // Set up transition tree
+  let obj = { ...{}, a: 0, b: 1, boom: 2};
+
+  // make CloneObjectIC MEGAMORPHIC
+  spread(new Proxy({}, {}));
+
+  // Ensure we don't crash, and create the correct object
+  assertEquals({ a: 0, b: 1, c: 2 }, spread({ a: 0, b: 1, c: 2 }));
+})();
diff --git a/src/v8/test/mjsunit/es9/object-spread-ic.js b/src/v8/test/mjsunit/es9/object-spread-ic.js
new file mode 100644
index 0000000..55d60f2
--- /dev/null
+++ b/src/v8/test/mjsunit/es9/object-spread-ic.js
@@ -0,0 +1,123 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function testDoubleElements() {
+  function f(src) { return {...src}; }
+  var src = [1.5];
+  src[0] = 1;
+
+  // Uninitialized
+  assertEquals({ 0: 1 }, f(src));
+
+  src[0] = 1.3;
+
+  // Monomorphic
+  assertEquals({ 0: 1.3 }, f(src));
+})();
+
+(function testInObjectProperties() {
+  function f(src) { return {...src}; }
+  function C() { this.foo = "foo"; }
+  var src;
+  for (var i = 0; i < 10; ++i) {
+    src = new C();
+  }
+
+  // Uninitialized
+  assertEquals({ foo: "foo" }, f(src));
+
+  // Monomorphic
+  assertEquals({ foo: "foo" }, f(src));
+})();
+
+(function testInObjectProperties2() {
+  function f(src) { return {...src}; }
+  function C() {
+    this.foo = "foo";
+    this.p0 = "0";
+    this.p1 = "1";
+    this.p2 = "2";
+    this.p3 = "3";
+  }
+  var src;
+  for (var i = 0; i < 10; ++i) {
+    src = new C();
+  }
+
+  // Uninitialized
+  assertEquals({ foo: "foo", p0: "0", p1: "1", p2: "2", p3: "3" }, f(src));
+
+  // Monomorphic
+  assertEquals({ foo: "foo", p0: "0", p1: "1", p2: "2", p3: "3" }, f(src));
+})();
+
+(function testPolymorphicToMegamorphic() {
+  function f(src) { return {...src}; }
+  function C1() {
+    this.foo = "foo";
+    this.p0 = "0";
+    this.p1 = "1";
+    this.p2 = "2";
+    this.p3 = "3";
+  }
+  function C2() {
+    this.p0 = "0";
+    this.p1 = "1";
+    this[0] = 0;
+  }
+  function C3() {
+    this.x = 774;
+    this.y = 663;
+    this.rgb = 0xFF00FF;
+  }
+  function C4() {
+    this.qqq = {};
+    this.v_1 = [];
+    this.name = "C4";
+    this.constructor = C4;
+  }
+
+  // Uninitialized
+  assertEquals({ foo: "foo", p0: "0", p1: "1", p2: "2", p3: "3" }, f(new C1()));
+
+  // Monomorphic
+  assertEquals({ foo: "foo", p0: "0", p1: "1", p2: "2", p3: "3" }, f(new C1()));
+
+  // Polymorphic (2)
+  assertEquals({ 0: 0, p0: "0", p1: "1" }, f(new C2()));
+  assertEquals({ 0: 0, p0: "0", p1: "1" }, f(new C2()));
+
+  // Polymorphic (3)
+  assertEquals({ x: 774, y: 663, rgb: 0xFF00FF }, f(new C3()));
+  assertEquals({ x: 774, y: 663, rgb: 0xFF00FF }, f(new C3()));
+
+  // Polymorphic (4)
+  assertEquals({ qqq: {}, v_1: [], name: "C4", constructor: C4 }, f(new C4()));
+  assertEquals({ qqq: {}, v_1: [], name: "C4", constructor: C4 }, f(new C4()));
+
+  // Megamorphic
+  assertEquals({ boop: 1 }, f({ boop: 1 }));
+})();
+
+// There are 2 paths in CloneObjectIC's handler which need to handle double
+// fields specially --- in object properties, and copying the property array.
+function testMutableInlineProperties() {
+  function inobject() { "use strict"; this.x = 1.1; }
+  const src = new inobject();
+  const x0 = src.x;
+  const clone = { ...src, x: x0 + 1 };
+  assertEquals(x0, src.x);
+  assertEquals({ x: 2.1 }, clone);
+}
+testMutableInlineProperties()
+
+function testMutableOutOfLineProperties() {
+  const src = { a: 1, b: 2, c: 3 };
+  src.x = 2.3;
+  const x0 = src.x;
+  const clone = { ...src, x: x0 + 1 };
+  assertEquals(x0, src.x);
+  assertEquals({ a: 1, b: 2, c: 3, x: 3.3 }, clone);
+}
+testMutableOutOfLineProperties();
diff --git a/src/v8/test/mjsunit/es9/regexp-lookbehind.js b/src/v8/test/mjsunit/es9/regexp-lookbehind.js
index 54c975c..c3aae31 100644
--- a/src/v8/test/mjsunit/es9/regexp-lookbehind.js
+++ b/src/v8/test/mjsunit/es9/regexp-lookbehind.js
@@ -162,3 +162,10 @@
 assertEquals(["b", "ac", "ac"], /(?<=a(\2)b(..\1))b/.exec("aacbacb"));
 assertEquals(["x", "aa"], /(?<=(?:\1b)(aa))./.exec("aabaax"));
 assertEquals(["x", "aa"], /(?<=(?:\1|b)(aa))./.exec("aaaax"));
+
+// Restricted syntax in Annex B 1.4.
+assertThrows("/(?<=.)*/u", SyntaxError);
+assertThrows("/(?<=.){1,2}/u", SyntaxError);
+assertThrows("/(?<=.)*/", SyntaxError);
+assertThrows("/(?<=.)?/", SyntaxError);
+assertThrows("/(?<=.)+/", SyntaxError);
diff --git a/src/v8/test/mjsunit/es9/regress/regress-866229.js b/src/v8/test/mjsunit/es9/regress/regress-866229.js
new file mode 100644
index 0000000..7e98c6a
--- /dev/null
+++ b/src/v8/test/mjsunit/es9/regress/regress-866229.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var obj = { length: 1, 0: "spread" };
+obj[Symbol.toStringTag] = "foo";
+obj[Symbol.hasInstance] = function() { return true; }
+obj[Symbol.isConcatSpreadable] = true;
+
+var obj2 = { ...obj };
+
+// Crash if fast result map bitfield is not set correctly, if verifying heap
+%HeapObjectVerify(obj2);
+
+// Ensure correct result for some well-known symbols
+assertEquals("[object foo]", Object.prototype.toString.call(obj2));
+assertTrue(Uint8Array instanceof obj2);
+assertEquals(["spread"], [].concat(obj2));
diff --git a/src/v8/test/mjsunit/es9/regress/regress-866282.js b/src/v8/test/mjsunit/es9/regress/regress-866282.js
new file mode 100644
index 0000000..ae23c05
--- /dev/null
+++ b/src/v8/test/mjsunit/es9/regress/regress-866282.js
@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Runtime_ObjectCloneIC_Slow() source argument must be a HeapObject handle,
+// because undefined/null are allowed.
+function spread(o) { return { ...o }; }
+
+// Transition to MEGAMORPHIC
+assertEquals({}, spread(new function C1() {}));
+assertEquals({}, spread(new function C2() {}));
+assertEquals({}, spread(new function C3() {}));
+assertEquals({}, spread(new function C4() {}));
+assertEquals({}, spread(new function C5() {}));
+
+// Trigger Runtime_ObjectCloneIC_Slow() with a non-JSReceiver.
+assertEquals({}, spread(undefined));
diff --git a/src/v8/test/mjsunit/es9/regress/regress-866357.js b/src/v8/test/mjsunit/es9/regress/regress-866357.js
new file mode 100644
index 0000000..2267fc2
--- /dev/null
+++ b/src/v8/test/mjsunit/es9/regress/regress-866357.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Check that we do appropriate used/unused field accounting
+var p = Promise.resolve();
+var then = p.then = () => {};
+
+function spread() { return { ...p }; }
+
+%PrepareFunctionForOptimization(spread);
+assertEquals({ then }, spread());
+assertEquals({ then }, spread());
+assertEquals({ then }, spread());
+%OptimizeFunctionOnNextCall(spread);
+assertEquals({ then }, spread());
diff --git a/src/v8/test/mjsunit/es9/regress/regress-866727.js b/src/v8/test/mjsunit/es9/regress/regress-866727.js
new file mode 100644
index 0000000..1c9d1dd
--- /dev/null
+++ b/src/v8/test/mjsunit/es9/regress/regress-866727.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Check that IfException/IfSuccess rewiring works in JSInliner
+function test() {
+  var spread = function(value) { return { ...value }; }
+  try {
+    assertEquals({}, spread());
+  } catch (e) {}
+};
+
+%PrepareFunctionForOptimization(test);
+test();
+test();
+test();
+%OptimizeFunctionOnNextCall(test);
+test();
diff --git a/src/v8/test/mjsunit/es9/regress/regress-866861.js b/src/v8/test/mjsunit/es9/regress/regress-866861.js
new file mode 100644
index 0000000..dc6c764
--- /dev/null
+++ b/src/v8/test/mjsunit/es9/regress/regress-866861.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Check that property constness for out-of-object fields is valid
+var o = {};
+var toString = o.toString = function() {};
+try {
+assertEquals({ toString }, o = { ...o });
+} catch (e) {}
+o.toString = [];
diff --git a/src/v8/test/mjsunit/es9/regress/regress-867958.js b/src/v8/test/mjsunit/es9/regress/regress-867958.js
new file mode 100644
index 0000000..eca3f1e
--- /dev/null
+++ b/src/v8/test/mjsunit/es9/regress/regress-867958.js
@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Check that encountering deprecated Maps does not cause CloneObjectIC to
+// crash.
+var obj1 = { x: 1 };
+var obj2 = { x: 2 }; // same map
+obj2.x = null; // deprecate map
+
+function f() { return { ...obj1 } };
+assertEquals({ x: 1 }, f()); // missed, object migrated to cached new map
+assertEquals({ x: 1 }, f()); // monomorphic cache-hit
diff --git a/src/v8/test/mjsunit/es9/regress/regress-869342.js b/src/v8/test/mjsunit/es9/regress/regress-869342.js
new file mode 100644
index 0000000..fceb98e
--- /dev/null
+++ b/src/v8/test/mjsunit/es9/regress/regress-869342.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+function spread(o) { return { ...o }; }
+
+(function setupPolymorphicFeedback() {
+  function C1() { this.p0 = 1; }
+  function C2() { this.p1 = 2; this.p2 = 3; }
+  assertEquals({ p0: 1 }, spread(new C1));
+  assertEquals({ p1: 2, p2: 3 }, spread(new C2));
+})();
+
+gc(); // Clobber cached map in feedback[0], and check that we don't crash
+function C3() { this.p0 = 3; }
+assertEquals({ p0: 3 }, spread(new C3));
diff --git a/src/v8/test/mjsunit/es9/regress/regress-902965.js b/src/v8/test/mjsunit/es9/regress/regress-902965.js
new file mode 100644
index 0000000..e2035b2
--- /dev/null
+++ b/src/v8/test/mjsunit/es9/regress/regress-902965.js
@@ -0,0 +1,12 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Previously, spreading in-object properties would always treat double fields
+// as tagged, potentially dereferencing a Float64.
+function inobjectDouble() {
+  "use strict";
+  this.x = -3.9;
+}
+const instance = new inobjectDouble();
+const clone = { ...instance, };
diff --git a/src/v8/test/mjsunit/es9/regress/regress-903070.js b/src/v8/test/mjsunit/es9/regress/regress-903070.js
new file mode 100644
index 0000000..cca02ee
--- /dev/null
+++ b/src/v8/test/mjsunit/es9/regress/regress-903070.js
@@ -0,0 +1,15 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function clone(src) {
+  return { ...src };
+}
+
+function inobjectDoubles() {
+  "use strict";
+  this.p0 = -6400510997704731;
+}
+
+// Check that unboxed double is not treated as tagged
+assertEquals({ p0: -6400510997704731 }, clone(new inobjectDoubles()));
diff --git a/src/v8/test/mjsunit/es9/regress/regress-904167.js b/src/v8/test/mjsunit/es9/regress/regress-904167.js
new file mode 100644
index 0000000..8986972
--- /dev/null
+++ b/src/v8/test/mjsunit/es9/regress/regress-904167.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Previously, spreading in-object properties would always treat double fields
+// as tagged, potentially dereferencing a Float64.
+
+// Ensure that we don't fail an assert from --verify-heap when cloning a
+// MutableHeapNumber in the CloneObjectIC handler case.
+var src, clone;
+for (var i = 0; i < 40000; i++) {
+    src = { ...i, x: -9007199254740991 };
+    clone = { ...src };
+}
diff --git a/src/v8/test/mjsunit/expose-cputracemark.js b/src/v8/test/mjsunit/expose-cputracemark.js
new file mode 100644
index 0000000..78cc8dc
--- /dev/null
+++ b/src/v8/test/mjsunit/expose-cputracemark.js
@@ -0,0 +1,37 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-cputracemark-as=cputracemark
+
+// Test --expose-cputracemark-as option.
+
+cputracemark(100);
+cputracemark(100, 'a');
+
+assertThrows(() => cputracemark(-1));
+assertThrows(() => cputracemark(null));
+assertThrows(() => cputracemark(""));
diff --git a/src/v8/test/mjsunit/external-array.js b/src/v8/test/mjsunit/external-array.js
index 78f2780..3f06140 100644
--- a/src/v8/test/mjsunit/external-array.js
+++ b/src/v8/test/mjsunit/external-array.js
@@ -38,6 +38,7 @@
   a[0] = 0;
   a[1] = 0;
 }
+%PrepareFunctionForOptimization(f);
 
 var a = new Int32Array(2);
 for (var i = 0; i < 5; i++) {
@@ -167,10 +168,12 @@
 // Test Float64Arrays.
 function get(a, index) {
   return a[index];
-}
+};
+%PrepareFunctionForOptimization(get);
 function set(a, index, value) {
   a[index] = value;
-}
+};
+%PrepareFunctionForOptimization(set);
 function temp() {
 var array = new Float64Array(2);
 for (var i = 0; i < 5; i++) {
@@ -293,6 +296,7 @@
 const kRuns = 10;
 
 function run_test(test_func, array, expected_result) {
+  %PrepareFunctionForOptimization(test_func);
   for (var i = 0; i < 5; i++) test_func(array, 0);
   %OptimizeFunctionOnNextCall(test_func);
   var sum = 0;
@@ -344,6 +348,7 @@
     assertTrue(delete a.length);
 
     // Make sure bounds checks are handled correctly for external arrays.
+    %PrepareFunctionForOptimization(run_bounds_test);
     run_bounds_test(a);
     run_bounds_test(a);
     run_bounds_test(a);
@@ -364,6 +369,7 @@
     return a[0] = a[0] = 1;
   }
 
+  %PrepareFunctionForOptimization(array_load_set_smi_check2);
   array_load_set_smi_check2(a);
   %OptimizeFunctionOnNextCall(array_load_set_smi_check2);
   array_load_set_smi_check2(a);
@@ -378,6 +384,7 @@
   ext_array[0] = undefined;
 }
 
+%PrepareFunctionForOptimization(store_float32_undefined);
 var float32_array = new Float32Array(1);
 // Make sure runtime does it right
 store_float32_undefined(float32_array);
@@ -394,6 +401,7 @@
   ext_array[0] = undefined;
 }
 
+%PrepareFunctionForOptimization(store_float64_undefined);
 var float64_array = new Float64Array(1);
 // Make sure runtime does it right
 store_float64_undefined(float64_array);
@@ -639,6 +647,8 @@
 
 function do_tagged_index_external_array_test(constructor) {
   var t_array = new constructor([1, 2, 3, 4, 5, 6]);
+  %PrepareFunctionForOptimization(goo);
+  %PrepareFunctionForOptimization(boo);
   assertEquals(1, goo(t_array, 0));
   assertEquals(1, goo(t_array, 0));
   boo(t_array, 0, 13);
@@ -661,6 +671,8 @@
 do_tagged_index_external_array_test(Float64Array);
 
 var built_in_array = new Array(1, 2, 3, 4, 5, 6);
+%PrepareFunctionForOptimization(goo);
+%PrepareFunctionForOptimization(boo);
 assertEquals(1, goo(built_in_array, 0));
 assertEquals(1, goo(built_in_array, 0));
 %OptimizeFunctionOnNextCall(goo);
@@ -671,6 +683,8 @@
 %ClearFunctionFeedback(boo);
 
 built_in_array = new Array(1.5, 2, 3, 4, 5, 6);
+%PrepareFunctionForOptimization(goo);
+%PrepareFunctionForOptimization(boo);
 assertEquals(1.5, goo(built_in_array, 0));
 assertEquals(1.5, goo(built_in_array, 0));
 %OptimizeFunctionOnNextCall(goo);
diff --git a/src/v8/test/mjsunit/external-backing-store-gc.js b/src/v8/test/mjsunit/external-backing-store-gc.js
new file mode 100644
index 0000000..005ec15
--- /dev/null
+++ b/src/v8/test/mjsunit/external-backing-store-gc.js
@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --mock-arraybuffer-allocator --mock-arraybuffer-allocator-limit=1300000000
+
+// --mock-arraybuffer-allocator-limit should be above the hard limit external
+// for memory. Below that limit anything is opportunistic and may be delayed,
+// e.g., by tasks getting stalled and the event loop not being invoked.
+
+for (var i = 0; i < 1536; i++) {
+  let garbage = new ArrayBuffer(1024*1024);
+}
diff --git a/src/v8/test/mjsunit/fast-element-smi-check.js b/src/v8/test/mjsunit/fast-element-smi-check.js
index 09b2d6a..fe5b291 100644
--- a/src/v8/test/mjsunit/fast-element-smi-check.js
+++ b/src/v8/test/mjsunit/fast-element-smi-check.js
@@ -39,8 +39,8 @@
 
 function test_load_set_smi_2(a) {
   return a[0] = a[0] = 1;
-}
-
+};
+%PrepareFunctionForOptimization(test_load_set_smi_2);
 test_load_set_smi_2(a);
 %OptimizeFunctionOnNextCall(test_load_set_smi_2);
 test_load_set_smi_2(a);
@@ -60,8 +60,8 @@
 
 function test_load_set_smi_4(b) {
   return b[0] = b[0] = 1;
-}
-
+};
+%PrepareFunctionForOptimization(test_load_set_smi_4);
 test_load_set_smi_4(b);
 %OptimizeFunctionOnNextCall(test_load_set_smi_4);
 test_load_set_smi_4(b);
diff --git a/src/v8/test/mjsunit/fast-literal.js b/src/v8/test/mjsunit/fast-literal.js
index 4fd92c4..9e9c797 100644
--- a/src/v8/test/mjsunit/fast-literal.js
+++ b/src/v8/test/mjsunit/fast-literal.js
@@ -25,15 +25,17 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --no-inline-new --nouse-allocation-folding
+// Flags: --allow-natives-syntax --no-inline-new
 
 %SetAllocationTimeout(20, 0);
 function f() {
   return [[1, 2, 3], [1.1, 1.2, 1.3], [[], [], []]];
-}
-
-f(); f(); f();
+};
+%PrepareFunctionForOptimization(f);
+f();
+f();
+f();
 %OptimizeFunctionOnNextCall(f);
-for (var i=0; i<50; i++) {
+for (var i = 0; i < 50; i++) {
   f();
 }
diff --git a/src/v8/test/mjsunit/fast-prototype.js b/src/v8/test/mjsunit/fast-prototype.js
index ad00bec..eb3331f 100644
--- a/src/v8/test/mjsunit/fast-prototype.js
+++ b/src/v8/test/mjsunit/fast-prototype.js
@@ -43,6 +43,7 @@
     obj["x" + i] = 0;
   }
 }
+%EnsureFeedbackVectorForFunction(AddProps);
 
 
 function DoProtoMagic(proto, set__proto__) {
@@ -58,9 +59,11 @@
   }
   // Prototypes are made fast when ICs encounter them.
   function ic() { return typeof receiver.foo; }
+  %EnsureFeedbackVectorForFunction(ic);
   ic();
   ic();
 }
+%EnsureFeedbackVectorForFunction(DoProtoMagic);
 
 
 function test(use_new, add_first, set__proto__) {
@@ -86,36 +89,41 @@
   }
   return proto;
 }
+%EnsureFeedbackVectorForFunction(test);
 
 // TODO(mstarzinger): This test fails easily if gc happens at the wrong time.
 gc();
 
-for (var i = 0; i < 4; i++) {
-  var set__proto__ = ((i & 1) != 0);
-  var use_new = ((i & 2) != 0);
+function test_fast_prototype() {
+  for (var i = 0; i < 4; i++) {
+    var set__proto__ = ((i & 1) != 0);
+    var use_new = ((i & 2) != 0);
 
-  test(use_new, true, set__proto__);
-  test(use_new, false, set__proto__);
-}
+    test(use_new, true, set__proto__);
+    test(use_new, false, set__proto__);
+  }
 
 
-var x = {a: 1, b: 2, c: 3};
-var o = { __proto__: x };
-assertFalse(%HasFastProperties(x));
-for (key in x) {
-  assertTrue(key == 'a');
-  break;
+  var x = {a: 1, b: 2, c: 3};
+  var o = { __proto__: x };
+  assertFalse(%HasFastProperties(x));
+  for (key in x) {
+    assertTrue(key == 'a');
+    break;
+  }
+  assertTrue(%HasFastProperties(x));
+  delete x.b;
+  for (key in x) {
+    assertTrue(key == 'a');
+    break;
+  }
+  assertTrue(%HasFastProperties(x));
+  x.d = 4;
+  assertTrue(%HasFastProperties(x));
+  for (key in x) {
+    assertTrue(key == 'a');
+    break;
+  }
 }
-assertTrue(%HasFastProperties(x));
-delete x.b;
-for (key in x) {
-  assertTrue(key == 'a');
-  break;
-}
-assertTrue(%HasFastProperties(x));
-x.d = 4;
-assertTrue(%HasFastProperties(x));
-for (key in x) {
-  assertTrue(key == 'a');
-  break;
-}
+%EnsureFeedbackVectorForFunction(test_fast_prototype);
+test_fast_prototype();
diff --git a/src/v8/test/mjsunit/field-representation-tracking-clone-object.js b/src/v8/test/mjsunit/field-representation-tracking-clone-object.js
new file mode 100644
index 0000000..328db20
--- /dev/null
+++ b/src/v8/test/mjsunit/field-representation-tracking-clone-object.js
@@ -0,0 +1,21 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(o) { return {...o}; }
+
+// Warmup the CloneObjectIC with `o.x` being
+// a HeapObject field.
+var o = {data:null};
+%PrepareFunctionForOptimization(foo);
+foo(o);
+foo(o);
+
+// Now update the field representation of o.x
+// in-place from HeapObject to Tagged and make
+// sure that this is handled properly in the
+// fast-path for CloneObjectIC.
+o.data = 1;
+assertEquals(1, %GetProperty(foo(o), "data"));
diff --git a/src/v8/test/mjsunit/field-representation-tracking.js b/src/v8/test/mjsunit/field-representation-tracking.js
new file mode 100644
index 0000000..a1c4317
--- /dev/null
+++ b/src/v8/test/mjsunit/field-representation-tracking.js
@@ -0,0 +1,31 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --modify-field-representation-inplace
+
+// Test that s->t field representation changes are done in-place.
+(function() {
+  function O(x) { this.x = x; }
+
+  const a = new O(42);
+  const b = new O(-8);
+  assertTrue(%HaveSameMap(a, b));
+  a.x = null;
+  assertTrue(%HaveSameMap(a, b));
+  b.x = null;
+  assertTrue(%HaveSameMap(a, b));
+})();
+
+// Test that h->t field representation changes are done in-place.
+(function() {
+  function O(x) { this.x = x; }
+
+  const a = new O(null);
+  const b = new O("Hello");
+  assertTrue(%HaveSameMap(a, b));
+  a.x = 1;
+  assertTrue(%HaveSameMap(a, b));
+  b.x = 2;
+  assertTrue(%HaveSameMap(a, b));
+})();
diff --git a/src/v8/test/mjsunit/field-type-tracking.js b/src/v8/test/mjsunit/field-type-tracking.js
index 2e0cb8b..1ff336a 100644
--- a/src/v8/test/mjsunit/field-type-tracking.js
+++ b/src/v8/test/mjsunit/field-type-tracking.js
@@ -9,13 +9,13 @@
   var o = { text: "Hello World!" };
   function A() {
     // Assign twice to make the field non-constant.
-    // TODO(ishell): update test once constant field tracking is done.
     this.a = {text: 'foo'};
     this.a = o;
   }
   function readA(x) {
     return x.a;
   }
+  %PrepareFunctionForOptimization(readA);
   var a = new A();
   assertUnoptimized(readA);
   readA(a); readA(a); readA(a);
@@ -27,6 +27,7 @@
   b.b = o;
   assertEquals(readA(b), o);
   assertUnoptimized(readA);
+  %PrepareFunctionForOptimization(readA);
   %OptimizeFunctionOnNextCall(readA);
   assertEquals(readA(a), o);
   assertOptimized(readA);
@@ -38,6 +39,7 @@
     return x.a;
   }
   assertUnoptimized(readAFromB);
+  %PrepareFunctionForOptimization(readAFromB);
   readAFromB(b); readAFromB(b); readAFromB(b);
   %OptimizeFunctionOnNextCall(readAFromB);
   assertEquals(readAFromB(b), o);
@@ -50,6 +52,8 @@
   c.a = [1];
   assertUnoptimized(readA);
   assertUnoptimized(readAFromB);
+  %PrepareFunctionForOptimization(readA);
+  %PrepareFunctionForOptimization(readAFromB);
   assertEquals(readA(a), o);
   assertEquals(readA(b), o);
   assertEquals(readA(c), [1]);
@@ -78,7 +82,9 @@
   A.prototype = {y: 20};
   function B(o) { return o.a.y; }
   function C() { this.a = new A(); }
+  %EnsureFeedbackVectorForFunction(C);
 
+  %PrepareFunctionForOptimization(B);
   B(new C());
   B(new C());
   %OptimizeFunctionOnNextCall(B);
@@ -89,6 +95,7 @@
   assertEquals(10, B(c));
   assertUnoptimized(B);
 
+  %PrepareFunctionForOptimization(B);
   var c = new C();
   %OptimizeFunctionOnNextCall(B);
   assertEquals(20, B(c));
@@ -111,13 +118,13 @@
 
 (function() {
   function Foo(x) { this.x = x; }
-  // TODO(ishell): update test once constant field tracking is done.
   var f0 = new Foo({x: 0});
   f0.x = {x: 0};  // make Foo.x non-constant here.
   var f1 = new Foo({x: 1});
   var f2 = new Foo({x: 2});
   var f3 = new Foo({x: 3});
   function readX(f) { return f.x.x; }
+  %PrepareFunctionForOptimization(readX);
   assertEquals(readX(f1), 1);
   assertEquals(readX(f2), 2);
   assertUnoptimized(readX);
@@ -125,6 +132,7 @@
   assertEquals(readX(f3), 3);
   assertOptimized(readX);
   function writeX(f, x) { f.x = x; }
+  %PrepareFunctionForOptimization(writeX);
   writeX(f1, {x: 11});
   writeX(f2, {x: 22});
   assertUnoptimized(writeX);
@@ -148,11 +156,12 @@
   var f2 = new Narf(2);
   var f3 = new Narf(3);
   function baz(f, y) { f.y = y; }
-  baz(f1, {y: 9});
-  baz(f2, {y: 9});
-  baz(f2, {y: 9});
+  %PrepareFunctionForOptimization(baz);
+  baz(f1, {b: 9});
+  baz(f2, {b: 9});
+  baz(f2, {b: 9});
   %OptimizeFunctionOnNextCall(baz);
-  baz(f2, {y: 9});
+  baz(f2, {b: 9});
   baz(f3, {a: -1});
   assertUnoptimized(baz);
 })();
@@ -163,6 +172,7 @@
   function readA(o) { return o.x.a; }
   var f = new Foo({a:1});
   var b = new Bar({a:2});
+  %PrepareFunctionForOptimization(readA);
   assertEquals(readA(f), 1);
   assertEquals(readA(b), 2);
   assertEquals(readA(f), 1);
diff --git a/src/v8/test/mjsunit/filter-element-kinds.js b/src/v8/test/mjsunit/filter-element-kinds.js
index 7853a33..24dd31a 100644
--- a/src/v8/test/mjsunit/filter-element-kinds.js
+++ b/src/v8/test/mjsunit/filter-element-kinds.js
@@ -77,6 +77,7 @@
 function runTest(test, kind, holey_predicate) {
 
   // Verify built-in implementation produces correct results.
+  %PrepareFunctionForOptimization(test);
   let a = test();
   assertKind(kind, a);
   holey_predicate(a);
diff --git a/src/v8/test/mjsunit/fixed-context-shapes-when-recompiling.js b/src/v8/test/mjsunit/fixed-context-shapes-when-recompiling.js
index 8221665..3289db7 100644
--- a/src/v8/test/mjsunit/fixed-context-shapes-when-recompiling.js
+++ b/src/v8/test/mjsunit/fixed-context-shapes-when-recompiling.js
@@ -7,7 +7,7 @@
 // Test that the information on which variables to allocate in context doesn't
 // change when recompiling.
 
-(function TestVarInInnerFunction() {
+function TestVarInInnerFunction() {
   // Introduce variables which would potentially be context allocated, depending
   // on whether an inner function refers to them or not.
   var a = 1;
@@ -26,13 +26,15 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestVarInInnerFunction);
+TestVarInInnerFunction();
 
 
 // Other tests are the same, except that the shadowing variable "a" in inner
 // functions is declared differently.
 
-(function TestLetInInnerFunction() {
+function TestLetInInnerFunction() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -48,9 +50,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestLetInInnerFunction);
+TestLetInInnerFunction();
 
-(function TestConstInInnerFunction() {
+function TestConstInInnerFunction() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -66,9 +70,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestConstInInnerFunction);
+TestConstInInnerFunction();
 
-(function TestInnerFunctionParameter() {
+function TestInnerFunctionParameter() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -83,9 +89,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerFunctionParameter);
+TestInnerFunctionParameter();
 
-(function TestInnerFunctionRestParameter() {
+function TestInnerFunctionRestParameter() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -100,9 +108,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerFunctionRestParameter);
+TestInnerFunctionRestParameter();
 
-(function TestInnerFunctionDestructuredParameter_1() {
+function TestInnerFunctionDestructuredParameter_1() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -117,9 +127,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerFunctionDestructuredParameter_1);
+TestInnerFunctionDestructuredParameter_1();
 
-(function TestInnerFunctionDestructuredParameter_2() {
+function TestInnerFunctionDestructuredParameter_2() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -134,9 +146,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerFunctionDestructuredParameter_2);
+TestInnerFunctionDestructuredParameter_2();
 
-(function TestInnerArrowFunctionParameter() {
+function TestInnerArrowFunctionParameter() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -149,9 +163,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerArrowFunctionParameter);
+TestInnerArrowFunctionParameter();
 
-(function TestInnerArrowFunctionRestParameter() {
+function TestInnerArrowFunctionRestParameter() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -164,9 +180,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerArrowFunctionRestParameter);
+TestInnerArrowFunctionRestParameter();
 
-(function TestInnerArrowFunctionDestructuredParameter_1() {
+function TestInnerArrowFunctionDestructuredParameter_1() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -179,9 +197,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerArrowFunctionDestructuredParameter_1);
+TestInnerArrowFunctionDestructuredParameter_1();
 
-(function TestInnerArrowFunctionDestructuredParameter_2() {
+function TestInnerArrowFunctionDestructuredParameter_2() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -194,9 +214,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerArrowFunctionDestructuredParameter_2);
+TestInnerArrowFunctionDestructuredParameter_2();
 
-(function TestInnerInnerFunctionParameter() {
+function TestInnerInnerFunctionParameter() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -211,9 +233,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerInnerFunctionParameter);
+TestInnerInnerFunctionParameter();
 
-(function TestInnerInnerFunctionRestParameter() {
+function TestInnerInnerFunctionRestParameter() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -228,9 +252,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerInnerFunctionRestParameter);
+TestInnerInnerFunctionRestParameter();
 
-(function TestInnerInnerFunctionDestructuredParameter_1() {
+function TestInnerInnerFunctionDestructuredParameter_1() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -245,9 +271,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerInnerFunctionDestructuredParameter_1);
+TestInnerInnerFunctionDestructuredParameter_1();
 
-(function TestInnerInnerFunctionDestructuredParameter_2() {
+function TestInnerInnerFunctionDestructuredParameter_2() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -262,9 +290,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerInnerFunctionDestructuredParameter_2);
+TestInnerInnerFunctionDestructuredParameter_2();
 
-(function TestInnerInnerArrowFunctionParameter() {
+function TestInnerInnerArrowFunctionParameter() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -279,9 +309,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerInnerArrowFunctionParameter);
+TestInnerInnerArrowFunctionParameter();
 
-(function TestInnerInnerArrowFunctionRestParameter() {
+function TestInnerInnerArrowFunctionRestParameter() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -296,9 +328,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerInnerArrowFunctionRestParameter);
+TestInnerInnerArrowFunctionRestParameter();
 
-(function TestInnerInnerArrowFunctionDestructuredParameter_1() {
+function TestInnerInnerArrowFunctionDestructuredParameter_1() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -313,9 +347,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerInnerArrowFunctionDestructuredParameter_1);
+TestInnerInnerArrowFunctionDestructuredParameter_1();
 
-(function TestInnerInnerArrowFunctionDestructuredParameter_2() {
+function TestInnerInnerArrowFunctionDestructuredParameter_2() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -330,9 +366,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerInnerArrowFunctionDestructuredParameter_2);
+TestInnerInnerArrowFunctionDestructuredParameter_2();
 
-(function TestInnerFunctionInnerFunction() {
+function TestInnerFunctionInnerFunction() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -348,9 +386,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerFunctionInnerFunction);
+TestInnerFunctionInnerFunction();
 
-(function TestInnerFunctionSloppyBlockFunction() {
+function TestInnerFunctionSloppyBlockFunction() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -366,9 +406,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerFunctionSloppyBlockFunction);
+TestInnerFunctionSloppyBlockFunction();
 
-(function TestInnerFunctionCatchVariable() {
+function TestInnerFunctionCatchVariable() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -387,9 +429,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+};
+%PrepareFunctionForOptimization(TestInnerFunctionCatchVariable);
+TestInnerFunctionCatchVariable();
 
-(function TestInnerFunctionLoopVariable1() {
+function TestInnerFunctionLoopVariable1() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -406,9 +450,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerFunctionLoopVariable1);
+TestInnerFunctionLoopVariable1();
 
-(function TestInnerFunctionLoopVariable2() {
+function TestInnerFunctionLoopVariable2() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -425,9 +471,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerFunctionLoopVariable2);
+TestInnerFunctionLoopVariable2();
 
-(function TestInnerFunctionLoopVariable3() {
+function TestInnerFunctionLoopVariable3() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -444,9 +492,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerFunctionLoopVariable3);
+TestInnerFunctionLoopVariable3();
 
-(function TestInnerFunctionLoopVariable4() {
+function TestInnerFunctionLoopVariable4() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -463,9 +513,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerFunctionLoopVariable4);
+TestInnerFunctionLoopVariable4();
 
-(function TestInnerFunctionClass() {
+function TestInnerFunctionClass() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -481,9 +533,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerFunctionClass);
+TestInnerFunctionClass();
 
-(function TestInnerFunctionDestructuring1() {
+function TestInnerFunctionDestructuring1() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -499,9 +553,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerFunctionDestructuring1);
+TestInnerFunctionDestructuring1();
 
-(function TestInnerFunctionDestructuring2() {
+function TestInnerFunctionDestructuring2() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -517,9 +573,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerFunctionDestructuring2);
+TestInnerFunctionDestructuring2();
 
-(function TestInnerFunctionDestructuring3() {
+function TestInnerFunctionDestructuring3() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -535,9 +593,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerFunctionDestructuring3);
+TestInnerFunctionDestructuring3();
 
-(function TestInnerFunctionDestructuring4() {
+function TestInnerFunctionDestructuring4() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -553,9 +613,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerFunctionDestructuring4);
+TestInnerFunctionDestructuring4();
 
-(function TestInnerFunctionDestructuring5() {
+function TestInnerFunctionDestructuring5() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -571,9 +633,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerFunctionDestructuring5);
+TestInnerFunctionDestructuring5();
 
-(function TestInnerFunctionDestructuring6() {
+function TestInnerFunctionDestructuring6() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -589,9 +653,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerFunctionDestructuring6);
+TestInnerFunctionDestructuring6();
 
-(function TestInnerFunctionDestructuring7() {
+function TestInnerFunctionDestructuring7() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -607,9 +673,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerFunctionDestructuring7);
+TestInnerFunctionDestructuring7();
 
-(function TestInnerFunctionDestructuring8() {
+function TestInnerFunctionDestructuring8() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -625,9 +693,11 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerFunctionDestructuring8);
+TestInnerFunctionDestructuring8();
 
-(function TestInnerFunctionDestructuring9() {
+function TestInnerFunctionDestructuring9() {
   var a = 1;
   var b = 2;
   var c = 3;
@@ -643,11 +713,13 @@
     assertEquals(2, b);
     assertEquals(3, c);
   }
-})();
+}
+%PrepareFunctionForOptimization(TestInnerFunctionDestructuring9);
+TestInnerFunctionDestructuring9();
 
 // A cluster of similar tests where the inner function only declares a variable
 // whose name clashes with an outer function variable name, but doesn't use it.
-(function TestRegress650969_1_var() {
+function TestRegress650969_1_var() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -657,9 +729,11 @@
       var a;
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_1_var);
+TestRegress650969_1_var();
 
-(function TestRegress650969_1_let() {
+function TestRegress650969_1_let() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -669,9 +743,11 @@
       let a;
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_1_let);
+TestRegress650969_1_let();
 
-(function TestRegress650969_2_var() {
+function TestRegress650969_2_var() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -681,9 +757,11 @@
       var a = 6;
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_2_var);
+TestRegress650969_2_var();
 
-(function TestRegress650969_2_let() {
+function TestRegress650969_2_let() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -693,9 +771,11 @@
       let a = 6;
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_2_let);
+TestRegress650969_2_let();
 
-(function TestRegress650969_2_const() {
+function TestRegress650969_2_const() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -705,9 +785,11 @@
       const a = 6;
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_2_const);
+TestRegress650969_2_const();
 
-(function TestRegress650969_3_var() {
+function TestRegress650969_3_var() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -717,9 +799,11 @@
       var a, b;
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_3_var);
+TestRegress650969_3_var();
 
-(function TestRegress650969_3_let() {
+function TestRegress650969_3_let() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -729,9 +813,11 @@
       let a, b;
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_3_let);
+TestRegress650969_3_let();
 
-(function TestRegress650969_4_var() {
+function TestRegress650969_4_var() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -741,9 +827,11 @@
       var a = 6, b;
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_4_var);
+TestRegress650969_4_var();
 
-(function TestRegress650969_4_let() {
+function TestRegress650969_4_let() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -753,9 +841,11 @@
       let a = 6, b;
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_4_let);
+TestRegress650969_4_let();
 
-(function TestRegress650969_4_const() {
+function TestRegress650969_4_const() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -765,9 +855,11 @@
       const a = 0, b = 0;
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_4_const);
+TestRegress650969_4_const();
 
-(function TestRegress650969_9_parameter() {
+function TestRegress650969_9_parameter() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -775,9 +867,11 @@
     var a;
     function inner(a) {}
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_9_parameter);
+TestRegress650969_9_parameter();
 
-(function TestRegress650969_9_restParameter() {
+function TestRegress650969_9_restParameter() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -785,9 +879,11 @@
     var a;
     function inner(...a) {}
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_9_restParameter);
+TestRegress650969_9_restParameter();
 
-(function TestRegress650969_9_destructuredParameter_1() {
+function TestRegress650969_9_destructuredParameter_1() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -795,9 +891,11 @@
     var a;
     function inner([d, a]) {}
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_9_destructuredParameter_1);
+TestRegress650969_9_destructuredParameter_1();
 
-(function TestRegress650969_9_destructuredParameter_2() {
+function TestRegress650969_9_destructuredParameter_2() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -805,9 +903,11 @@
     var a;
     function inner({d, a}) {}
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_9_destructuredParameter_2);
+TestRegress650969_9_destructuredParameter_2();
 
-(function TestRegress650969_10_parameter() {
+function TestRegress650969_10_parameter() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -817,9 +917,11 @@
       function innerinner(a) {}
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_10_parameter);
+TestRegress650969_10_parameter();
 
-(function TestRegress650969_10_restParameter() {
+function TestRegress650969_10_restParameter() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -829,9 +931,11 @@
       function innerinner(...a) {}
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_10_restParameter);
+TestRegress650969_10_restParameter();
 
-(function TestRegress650969_10_destructuredParameter_1() {
+function TestRegress650969_10_destructuredParameter_1() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -841,9 +945,11 @@
       function innerinner([d, a]) {}
     }
   }
-})();
+}
+%PrepareFunctionForOptimization( TestRegress650969_10_destructuredParameter_1);
+TestRegress650969_10_destructuredParameter_1();
 
-(function TestRegress650969_10_destructuredParameter_2() {
+function TestRegress650969_10_destructuredParameter_2() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -853,9 +959,11 @@
       function innerinner({d, a}) {}
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_10_destructuredParameter_2);
+TestRegress650969_10_destructuredParameter_2();
 
-(function TestRegress650969_11_var() {
+function TestRegress650969_11_var() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -865,9 +973,12 @@
       var [a, b] = [1, 2];
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_11_var);
+TestRegress650969_11_var();
 
-(function TestRegress650969_11_let() {
+
+function TestRegress650969_11_let() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -877,9 +988,11 @@
       let [a, b] = [1, 2];
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_11_let);
+TestRegress650969_11_let();
 
-(function TestRegress650969_11_const() {
+function TestRegress650969_11_const() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -889,9 +1002,11 @@
       const [a, b] = [1, 2];
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_11_const);
+TestRegress650969_11_const();
 
-(function TestRegress650969_12_var() {
+function TestRegress650969_12_var() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -901,9 +1016,11 @@
       var [b, a] = [1, 2];
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_12_var);
+TestRegress650969_12_var();
 
-(function TestRegress650969_12_let() {
+function TestRegress650969_12_let() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -913,9 +1030,11 @@
       let [b, a] = [1, 2];
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_12_let);
+TestRegress650969_12_let();
 
-(function TestRegress650969_12_const() {
+function TestRegress650969_12_const() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -925,9 +1044,11 @@
       const [b, a] = [1, 2];
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_12_const);
+TestRegress650969_12_const();
 
-(function TestRegress650969_13_var() {
+function TestRegress650969_13_var() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -937,9 +1058,11 @@
       var [b, ...a] = [1, 2];
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_13_var);
+TestRegress650969_13_var();
 
-(function TestRegress650969_13_let() {
+function TestRegress650969_13_let() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -949,9 +1072,11 @@
       let [b, ...a] = [1, 2];
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_13_let);
+TestRegress650969_13_let();
 
-(function TestRegress650969_13_const() {
+function TestRegress650969_13_const() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -961,9 +1086,11 @@
       const [b, ...a] = [1, 2];
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_13_const);
+TestRegress650969_13_const();
 
-(function TestRegress650969_14_var() {
+function TestRegress650969_14_var() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -973,9 +1100,11 @@
       var {a, b} = {a: 1, b: 2};
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_14_var);
+TestRegress650969_14_var();
 
-(function TestRegress650969_14_let() {
+function TestRegress650969_14_let() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -985,9 +1114,11 @@
       let {a, b} = {a: 1, b: 2};
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_14_let);
+TestRegress650969_14_let();
 
-(function TestRegress650969_14_const() {
+function TestRegress650969_14_const() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -997,9 +1128,11 @@
       const {a, b} = {a: 1, b: 2};
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_14_const);
+TestRegress650969_14_const();
 
-(function TestRegress650969_15_var() {
+function TestRegress650969_15_var() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -1009,9 +1142,11 @@
       var {b: {a}, c} = {b: {a: 1}, c: 2};
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_15_var);
+TestRegress650969_15_var();
 
-(function TestRegress650969_15_let() {
+function TestRegress650969_15_let() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -1021,9 +1156,11 @@
       let {b: {a}, c} = {b: {a: 1}, c: 2};
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_15_let);
+TestRegress650969_15_let();
 
-(function TestRegress650969_15_const() {
+function TestRegress650969_15_const() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -1033,9 +1170,11 @@
       const {b: {a}, c} = {b: {a: 1}, c: 2};
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_15_const);
+TestRegress650969_15_const();
 
-(function TestRegress650969_16_var() {
+function TestRegress650969_16_var() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -1045,9 +1184,11 @@
       var {a: {b}, c} = {a: {b: 1}, c: 2};
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_16_var);
+TestRegress650969_16_var();
 
-(function TestRegress650969_16_let() {
+function TestRegress650969_16_let() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -1057,9 +1198,11 @@
       let {a: {b}, c} = {a: {b: 1}, c: 2};
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_16_let);
+TestRegress650969_16_let();
 
-(function TestRegress650969_16_const() {
+function TestRegress650969_16_const() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -1069,9 +1212,11 @@
       const {a: {b}, c} = {a: {b: 1}, c: 2};
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_16_const);
+TestRegress650969_16_const();
 
-(function TestRegress650969_17_var() {
+function TestRegress650969_17_var() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -1081,9 +1226,11 @@
       for (var a = 0; 0 == 1; ) { }
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_17_var);
+TestRegress650969_17_var();
 
-(function TestRegress650969_17_let() {
+function TestRegress650969_17_let() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -1093,9 +1240,11 @@
       for (let a = 0; 0 == 1; ) { }
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_17_let);
+TestRegress650969_17_let();
 
-(function TestRegress650969_17_const() {
+function TestRegress650969_17_const() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -1105,9 +1254,11 @@
       for (const a = 0; 0 == 1; ) { }
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_17_const);
+TestRegress650969_17_const();
 
-(function TestRegress650969_18() {
+function TestRegress650969_18() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -1117,9 +1268,11 @@
       function innerinner([a, b]) {}
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_18);
+TestRegress650969_18();
 
-(function TestRegress650969_18() {
+function TestRegress650969_18() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -1129,11 +1282,13 @@
       function innerinner(a) {}
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_18);
+TestRegress650969_18();
 
 // Regression tests for an intermediate stage where unresolved references were
 // discarded too aggressively.
-(function TestRegress650969_sidetrack_var() {
+function TestRegress650969_sidetrack_var() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -1144,9 +1299,11 @@
       var {b: {a}, c} = {b: {a: 1}, c: 2};
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_sidetrack_var);
+TestRegress650969_sidetrack_var();
 
-(function TestRegress650969_sidetrack_let() {
+function TestRegress650969_sidetrack_let() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -1157,9 +1314,11 @@
       let {b: {a}, c} = {b: {a: 1}, c: 2};
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_sidetrack_let);
+TestRegress650969_sidetrack_let();
 
-(function TestRegress650969_sidetrack_const() {
+function TestRegress650969_sidetrack_const() {
   for (var i = 0; i < 3; ++i) {
     if (i == 1) {
       %OptimizeOsr();
@@ -1170,4 +1329,6 @@
       const {b: {a}, c} = {b: {a: 1}, c: 2};
     }
   }
-})();
+}
+%PrepareFunctionForOptimization(TestRegress650969_sidetrack_const);
+TestRegress650969_sidetrack_const();
diff --git a/src/v8/test/mjsunit/for-in-special-cases.js b/src/v8/test/mjsunit/for-in-special-cases.js
index b592ad2..27129e1 100644
--- a/src/v8/test/mjsunit/for-in-special-cases.js
+++ b/src/v8/test/mjsunit/for-in-special-cases.js
@@ -64,21 +64,15 @@
 
 
 function Accumulate(x) {
-  var accumulator = "";
+  var accumulator = [];
   for (var i in x) {
-    accumulator += i;
+    accumulator.push(i);
   }
   return accumulator;
 }
 
 for (var i = 0; i < 3; ++i) {
-  var elements = Accumulate("abcd");
-  // We do not assume that for-in enumerates elements in order.
-  assertTrue(-1 != elements.indexOf("0"));
-  assertTrue(-1 != elements.indexOf("1"));
-  assertTrue(-1 != elements.indexOf("2"));
-  assertTrue(-1 != elements.indexOf("3"));
-  assertEquals(4, elements.length);
+  assertEquals(Accumulate("abcd"), ['0', '1', '2', '3']);
 }
 
 function for_in_string_prototype() {
@@ -99,23 +93,51 @@
   // If for-in returns elements in a different order on multiple calls, this
   // assert will fail.  If that happens, consider if that behavior is OK.
   assertEquals(elements, elements1, "For-in elements not the same both times.");
-  // We do not assume that for-in enumerates elements in order.
-  assertTrue(-1 != elements.indexOf("0"));
-  assertTrue(-1 != elements.indexOf("1"));
-  assertTrue(-1 != elements.indexOf("2"));
-  assertTrue(-1 != elements.indexOf("7"));
-  assertTrue(-1 != elements.indexOf("foo"));
-  assertTrue(-1 != elements.indexOf("bar"));
-  assertTrue(-1 != elements.indexOf("gub"));
-  assertEquals(13, elements.length);
+  assertEquals(["7","bar","gub","0","1","2","foo"], elements)
 
-  elements = Accumulate(x);
-  assertTrue(-1 != elements.indexOf("0"));
-  assertTrue(-1 != elements.indexOf("1"));
-  assertTrue(-1 != elements.indexOf("2"));
-  assertTrue(-1 != elements.indexOf("foo"));
-  assertEquals(6, elements.length);
+  assertEquals(['0', '1', '2', 'foo'], Accumulate(x))
 }
 
 for_in_string_prototype();
 for_in_string_prototype();
+
+
+(function for_in_dictionary_prototype_1() {
+  let prototype1 = {prop: 0, prop1: 1};
+  let derived1 = Object.create(null, {
+    prop: {enumerable: false, configurable: true, value: 0},
+  });
+  Object.setPrototypeOf(derived1, prototype1);
+
+  let prototype2 = {prop: 0, prop1: 1};
+  let derived2 = Object.create(prototype2, {
+    prop: {enumerable: false, configurable: true, value: 0},
+  });
+
+  for (let i = 0; i < 3; i++) {
+    assertEquals(['prop1'], Accumulate(derived1));
+    assertEquals(['prop1'], Accumulate(derived2));
+  }
+})();
+
+(function for_in_dictionary_prototype_2() {
+  let prototype1 = {prop: 0, prop1: 1};
+  let derived1 = Object.create(null, {
+    prop: {enumerable: false, configurable: true, value: 1},
+    prop2: {enumerable: true, configurable: true, value: 2},
+    prop3: {enumerable: false, configurable: true, value: 3},
+  });
+  Object.setPrototypeOf(derived1, prototype1);
+
+  let prototype2 = {prop: 0, prop1: 1};
+  let derived2 = Object.create(prototype2, {
+    prop: {enumerable: false, configurable: true, value: 0},
+    prop2: {enumerable: true, configurable: true, value: 2},
+    prop3: {enumerable: false, configurable: true, value: 3},
+  });
+
+  for (let i = 0; i < 3; i++) {
+    assertEquals(['prop2', 'prop1'], Accumulate(derived1));
+    assertEquals(['prop2', 'prop1'], Accumulate(derived2));
+  }
+})();
diff --git a/src/v8/test/mjsunit/for-of-in-catch-duplicate-decl.js b/src/v8/test/mjsunit/for-of-in-catch-duplicate-decl.js
new file mode 100644
index 0000000..e1fdd43
--- /dev/null
+++ b/src/v8/test/mjsunit/for-of-in-catch-duplicate-decl.js
@@ -0,0 +1,5 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertDoesNotThrow("try { } catch (e) { var e; for (var e of []) {} }")
diff --git a/src/v8/test/mjsunit/frozen-array-reduce.js b/src/v8/test/mjsunit/frozen-array-reduce.js
new file mode 100644
index 0000000..6f121ae
--- /dev/null
+++ b/src/v8/test/mjsunit/frozen-array-reduce.js
@@ -0,0 +1,1420 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+/**
+ * @fileoverview Test reduce and reduceRight
+ */
+
+function clone(v) {
+  // Shallow-copies arrays, returns everything else verbatim.
+  if (v instanceof Array) {
+    // Shallow-copy an array.
+    var newArray = new Array(v.length);
+    for (var i in v) {
+      newArray[i] = v[i];
+    }
+    return newArray;
+  }
+  return v;
+}
+
+
+// Creates a callback function for reduce/reduceRight that tests the number
+// of arguments and otherwise behaves as "func", but which also
+// records all calls in an array on the function (as arrays of arguments
+// followed by result).
+function makeRecorder(func, testName) {
+  var record = [];
+  var f = function recorder(a, b, i, s) {
+    assertEquals(4, arguments.length,
+                 testName + "(number of arguments: " + arguments.length + ")");
+    assertEquals("number", typeof(i), testName + "(index must be number)");
+    assertEquals(s[i], b, testName + "(current argument is at index)");
+    if (record.length > 0) {
+      var prevRecord = record[record.length - 1];
+      var prevResult = prevRecord[prevRecord.length - 1];
+      assertEquals(prevResult, a,
+                   testName + "(prev result -> current input)");
+    }
+    var args = [clone(a), clone(b), i, clone(s)];
+    var result = func.apply(this, arguments);
+    args.push(clone(result));
+    record.push(args);
+    return result;
+  };
+  f.record = record;
+  return f;
+}
+
+
+function testReduce(type,
+                    testName,
+                    expectedResult,
+                    expectedCalls,
+                    array,
+                    combine,
+                    init) {
+  var rec = makeRecorder(combine);
+  var result;
+  if (arguments.length > 6) {
+    result = array[type](rec, init);
+  } else {
+    result = array[type](rec);
+  }
+  var calls = rec.record;
+  assertEquals(expectedCalls.length, calls.length,
+               testName + " (number of calls)");
+  for (var i = 0; i < expectedCalls.length; i++) {
+    assertEquals(expectedCalls[i], calls[i],
+                 testName + " (call " + (i + 1) + ")");
+  }
+  assertEquals(expectedResult, result, testName + " (result)");
+}
+
+
+function sum(a, b) { return Number(a) + Number(b); }
+function prod(a, b) { return Number(a) * Number(b); }
+function dec(a, b, i, arr) { return Number(a) + Number(b) * Math.pow(10, arr.length - i - 1); }
+function accumulate(acc, elem, i) { acc[i] = elem; return acc; }
+
+// ---- Test Reduce[Left]
+
+var simpleArray = ['2',4,6];
+Object.freeze(simpleArray);
+
+testReduce("reduce", "SimpleReduceSum", 12,
+           [[0, '2', 0, simpleArray, 2],
+            [2, 4, 1, simpleArray, 6],
+            [6, 6, 2, simpleArray, 12]],
+           simpleArray, sum, 0);
+
+testReduce("reduce", "SimpleReduceProd", 48,
+           [[1, '2', 0, simpleArray, 2],
+            [2, 4, 1, simpleArray, 8],
+            [8, 6, 2, simpleArray, 48]],
+           simpleArray, prod, 1);
+
+testReduce("reduce", "SimpleReduceDec", 246,
+           [[0, '2', 0, simpleArray, 200],
+            [200, 4, 1, simpleArray, 240],
+            [240, 6, 2, simpleArray, 246]],
+           simpleArray, dec, 0);
+
+testReduce("reduce", "SimpleReduceAccumulate", simpleArray,
+           [[[], '2', 0, simpleArray, ['2']],
+            [['2'], 4, 1, simpleArray, ['2', 4]],
+            [['2', 4], 6, 2, simpleArray, simpleArray]],
+           simpleArray, accumulate, []);
+
+var emptyArray = [];
+Object.freeze(emptyArray);
+
+testReduce("reduce", "EmptyReduceSum", 0, [], emptyArray, sum, 0);
+testReduce("reduce", "EmptyReduceProd", 1, [], emptyArray, prod, 1);
+testReduce("reduce", "EmptyReduceDec", 0, [], emptyArray, dec, 0);
+testReduce("reduce", "EmptyReduceAccumulate", [], [], emptyArray, accumulate, []);
+
+testReduce("reduce", "EmptyReduceSumNoInit", 0, emptyArray, [0], sum);
+testReduce("reduce", "EmptyReduceProdNoInit", 1, emptyArray, [1], prod);
+testReduce("reduce", "EmptyReduceDecNoInit", 0, emptyArray, [0], dec);
+testReduce("reduce", "EmptyReduceAccumulateNoInit", [], emptyArray, [[]], accumulate);
+
+
+var simpleSparseArray = [,,,'2',,4,,6,,];
+Object.freeze(simpleSparseArray);
+
+testReduce("reduce", "SimpleSparseReduceSum", 12,
+           [[0, '2', 3, simpleSparseArray, 2],
+            [2, 4, 5, simpleSparseArray, 6],
+            [6, 6, 7, simpleSparseArray, 12]],
+           simpleSparseArray, sum, 0);
+
+testReduce("reduce", "SimpleSparseReduceProd", 48,
+           [[1, '2', 3, simpleSparseArray, 2],
+            [2, 4, 5, simpleSparseArray, 8],
+            [8, 6, 7, simpleSparseArray, 48]],
+           simpleSparseArray, prod, 1);
+
+testReduce("reduce", "SimpleSparseReduceDec", 204060,
+           [[0, '2', 3, simpleSparseArray, 200000],
+            [200000, 4, 5, simpleSparseArray, 204000],
+            [204000, 6, 7, simpleSparseArray, 204060]],
+           simpleSparseArray, dec, 0);
+
+testReduce("reduce", "SimpleSparseReduceAccumulate", [,,,'2',,4,,6],
+           [[[], '2', 3, simpleSparseArray, [,,,'2']],
+            [[,,,'2'], 4, 5, simpleSparseArray, [,,,'2',,4]],
+            [[,,,'2',,4], 6, 7, simpleSparseArray, [,,,'2',,4,,6]]],
+           simpleSparseArray, accumulate, []);
+
+
+testReduce("reduce", "EmptySparseReduceSumNoInit", 0, [], [,,0,,], sum);
+testReduce("reduce", "EmptySparseReduceProdNoInit", 1, [], [,,1,,], prod);
+testReduce("reduce", "EmptySparseReduceDecNoInit", 0, [], [,,0,,], dec);
+testReduce("reduce", "EmptySparseReduceAccumulateNoInit",
+           [], [], [,,[],,], accumulate);
+
+
+var verySparseArray = [];
+verySparseArray.length = 10000;
+verySparseArray[2000] = '2';
+verySparseArray[5000] = 4;
+verySparseArray[9000] = 6;
+var verySparseSlice2 = verySparseArray.slice(0, 2001);
+var verySparseSlice4 = verySparseArray.slice(0, 5001);
+var verySparseSlice6 = verySparseArray.slice(0, 9001);
+Object.freeze(verySparseArray);
+
+testReduce("reduce", "VerySparseReduceSum", 12,
+           [[0, '2', 2000, verySparseArray, 2],
+            [2, 4, 5000, verySparseArray, 6],
+            [6, 6, 9000, verySparseArray, 12]],
+           verySparseArray, sum, 0);
+
+testReduce("reduce", "VerySparseReduceProd", 48,
+           [[1, '2', 2000, verySparseArray, 2],
+            [2, 4, 5000, verySparseArray, 8],
+            [8, 6, 9000, verySparseArray, 48]],
+           verySparseArray, prod, 1);
+
+testReduce("reduce", "VerySparseReduceDec", Infinity,
+           [[0, '2', 2000, verySparseArray, Infinity],
+            [Infinity, 4, 5000, verySparseArray, Infinity],
+            [Infinity, 6, 9000, verySparseArray, Infinity]],
+           verySparseArray, dec, 0);
+
+testReduce("reduce", "VerySparseReduceAccumulate",
+           verySparseSlice6,
+           [[[], '2', 2000, verySparseArray, verySparseSlice2],
+            [verySparseSlice2, 4, 5000, verySparseArray, verySparseSlice4],
+            [verySparseSlice4, 6, 9000, verySparseArray, verySparseSlice6]],
+           verySparseArray, accumulate, []);
+
+
+testReduce("reduce", "VerySparseReduceSumNoInit", 12,
+           [['2', 4, 5000, verySparseArray, 6],
+            [6, 6, 9000, verySparseArray, 12]],
+           verySparseArray, sum);
+
+testReduce("reduce", "VerySparseReduceProdNoInit", 48,
+           [['2', 4, 5000, verySparseArray, 8],
+            [8, 6, 9000, verySparseArray, 48]],
+           verySparseArray, prod);
+
+testReduce("reduce", "VerySparseReduceDecNoInit", Infinity,
+           [['2', 4, 5000, verySparseArray, Infinity],
+            [Infinity, 6, 9000, verySparseArray, Infinity]],
+           verySparseArray, dec);
+
+testReduce("reduce", "SimpleSparseReduceAccumulateNoInit",
+           '2',
+           [['2', 4, 5000, verySparseArray, '2'],
+            ['2', 6, 9000, verySparseArray, '2']],
+           verySparseArray, accumulate);
+
+
+// ---- Test ReduceRight
+
+testReduce("reduceRight", "SimpleReduceRightSum", 12,
+           [[0, 6, 2, simpleArray, 6],
+            [6, 4, 1, simpleArray, 10],
+            [10, '2', 0, simpleArray, 12]],
+           simpleArray, sum, 0);
+
+testReduce("reduceRight", "SimpleReduceRightProd", 48,
+           [[1, 6, 2, simpleArray, 6],
+            [6, 4, 1, simpleArray, 24],
+            [24, '2', 0, simpleArray, 48]],
+           simpleArray, prod, 1);
+
+testReduce("reduceRight", "SimpleReduceRightDec", 246,
+           [[0, 6, 2, simpleArray, 6],
+            [6, 4, 1, simpleArray, 46],
+            [46, '2', 0, simpleArray, 246]],
+           simpleArray, dec, 0);
+
+testReduce("reduceRight", "SimpleReduceRightAccumulate", simpleArray,
+           [[[], 6, 2, simpleArray, [,,6]],
+            [[,,6], 4, 1, simpleArray, [,4,6]],
+            [[,4,6], '2', 0, simpleArray, simpleArray]],
+           simpleArray, accumulate, []);
+
+
+testReduce("reduceRight", "EmptyReduceRightSum", 0, [], [], sum, 0);
+testReduce("reduceRight", "EmptyReduceRightProd", 1, [], [], prod, 1);
+testReduce("reduceRight", "EmptyReduceRightDec", 0, [], [], dec, 0);
+testReduce("reduceRight", "EmptyReduceRightAccumulate", [],
+           [], [], accumulate, []);
+
+testReduce("reduceRight", "EmptyReduceRightSumNoInit", 0, [], [0], sum);
+testReduce("reduceRight", "EmptyReduceRightProdNoInit", 1, [], [1], prod);
+testReduce("reduceRight", "EmptyReduceRightDecNoInit", 0, [], [0], dec);
+testReduce("reduceRight", "EmptyReduceRightAccumulateNoInit",
+           [], [], [[]], accumulate);
+
+
+testReduce("reduceRight", "SimpleSparseReduceRightSum", 12,
+           [[0, 6, 7, simpleSparseArray, 6],
+            [6, 4, 5, simpleSparseArray, 10],
+            [10, '2', 3, simpleSparseArray, 12]],
+           simpleSparseArray, sum, 0);
+
+testReduce("reduceRight", "SimpleSparseReduceRightProd", 48,
+           [[1, 6, 7, simpleSparseArray, 6],
+            [6, 4, 5, simpleSparseArray, 24],
+            [24, '2', 3, simpleSparseArray, 48]],
+           simpleSparseArray, prod, 1);
+
+testReduce("reduceRight", "SimpleSparseReduceRightDec", 204060,
+           [[0, 6, 7, simpleSparseArray, 60],
+            [60, 4, 5, simpleSparseArray, 4060],
+            [4060, '2', 3, simpleSparseArray, 204060]],
+           simpleSparseArray, dec, 0);
+
+testReduce("reduceRight", "SimpleSparseReduceRightAccumulate", [,,,'2',,4,,6],
+           [[[], 6, 7, simpleSparseArray, [,,,,,,,6]],
+            [[,,,,,,,6], 4, 5, simpleSparseArray, [,,,,,4,,6]],
+            [[,,,,,4,,6], '2', 3, simpleSparseArray, [,,,'2',,4,,6]]],
+           simpleSparseArray, accumulate, []);
+
+
+testReduce("reduceRight", "EmptySparseReduceRightSumNoInit",
+           0, [], [,,0,,], sum);
+testReduce("reduceRight", "EmptySparseReduceRightProdNoInit",
+           1, [], [,,1,,], prod);
+testReduce("reduceRight", "EmptySparseReduceRightDecNoInit",
+           0, [], [,,0,,], dec);
+testReduce("reduceRight", "EmptySparseReduceRightAccumulateNoInit",
+           [], [], [,,[],,], accumulate);
+
+
+var verySparseSuffix6 = [];
+verySparseSuffix6[9000] = 6;
+var verySparseSuffix4 = [];
+verySparseSuffix4[5000] = 4;
+verySparseSuffix4[9000] = 6;
+var verySparseSuffix2 = verySparseSlice6;
+
+
+testReduce("reduceRight", "VerySparseReduceRightSum", 12,
+           [[0, 6, 9000, verySparseArray, 6],
+            [6, 4, 5000, verySparseArray, 10],
+            [10, '2', 2000, verySparseArray, 12]],
+           verySparseArray, sum, 0);
+
+testReduce("reduceRight", "VerySparseReduceRightProd", 48,
+           [[1, 6, 9000, verySparseArray, 6],
+            [6, 4, 5000, verySparseArray, 24],
+            [24, '2', 2000, verySparseArray, 48]],
+           verySparseArray, prod, 1);
+
+testReduce("reduceRight", "VerySparseReduceRightDec", Infinity,
+           [[0, 6, 9000, verySparseArray, Infinity],
+            [Infinity, 4, 5000, verySparseArray, Infinity],
+            [Infinity, '2', 2000, verySparseArray, Infinity]],
+           verySparseArray, dec, 0);
+
+testReduce("reduceRight", "VerySparseReduceRightAccumulate",
+           verySparseSuffix2,
+           [[[], 6, 9000, verySparseArray, verySparseSuffix6],
+            [verySparseSuffix6, 4, 5000, verySparseArray, verySparseSuffix4],
+            [verySparseSuffix4, '2', 2000, verySparseArray, verySparseSuffix2]],
+           verySparseArray, accumulate, []);
+
+
+testReduce("reduceRight", "VerySparseReduceRightSumNoInit", 12,
+           [[6, 4, 5000, verySparseArray, 10],
+            [10, '2', 2000, verySparseArray, 12]],
+           verySparseArray, sum);
+
+testReduce("reduceRight", "VerySparseReduceRightProdNoInit", 48,
+           [[6, 4, 5000, verySparseArray, 24],
+            [24, '2', 2000, verySparseArray, 48]],
+           verySparseArray, prod);
+
+testReduce("reduceRight", "VerySparseReduceRightDecNoInit", Infinity,
+           [[6, 4, 5000, verySparseArray, Infinity],
+            [Infinity, '2', 2000, verySparseArray, Infinity]],
+           verySparseArray, dec);
+
+testReduce("reduceRight", "SimpleSparseReduceRightAccumulateNoInit",
+           6,
+           [[6, 4, 5000, verySparseArray, 6],
+            [6, '2', 2000, verySparseArray, 6]],
+           verySparseArray, accumulate);
+
+
+// undefined is an element
+var undefArray = [,,undefined,,undefined,,];
+Object.freeze(undefArray);
+
+testReduce("reduce", "SparseUndefinedReduceAdd", NaN,
+           [[0, undefined, 2, undefArray, NaN],
+            [NaN, undefined, 4, undefArray, NaN],
+           ],
+           undefArray, sum, 0);
+
+testReduce("reduceRight", "SparseUndefinedReduceRightAdd", NaN,
+           [[0, undefined, 4, undefArray, NaN],
+            [NaN, undefined, 2, undefArray, NaN],
+           ], undefArray, sum, 0);
+
+testReduce("reduce", "SparseUndefinedReduceAddNoInit", NaN,
+           [[undefined, undefined, 4, undefArray, NaN],
+           ], undefArray, sum);
+
+testReduce("reduceRight", "SparseUndefinedReduceRightAddNoInit", NaN,
+           [[undefined, undefined, 2, undefArray, NaN],
+           ], undefArray, sum);
+
+
+// Ignore non-array properties:
+
+var arrayPlus = [1,'2',,3];
+arrayPlus[-1] = NaN;
+arrayPlus[Math.pow(2,32)] = NaN;
+arrayPlus[NaN] = NaN;
+arrayPlus["00"] = NaN;
+arrayPlus["02"] = NaN;
+arrayPlus["-0"] = NaN;
+Object.freeze(arrayPlus);
+
+testReduce("reduce", "ArrayWithNonElementPropertiesReduce", 6,
+           [[0, 1, 0, arrayPlus, 1],
+            [1, '2', 1, arrayPlus, 3],
+            [3, 3, 3, arrayPlus, 6],
+           ], arrayPlus, sum, 0);
+
+testReduce("reduceRight", "ArrayWithNonElementPropertiesReduceRight", 6,
+           [[0, 3, 3, arrayPlus, 3],
+            [3, '2', 1, arrayPlus, 5],
+            [5, 1, 0, arrayPlus, 6],
+           ], arrayPlus, sum, 0);
+
+// Test passing undefined as initial value (to test missing parameter
+// detection).
+Object.freeze(['1']).reduce((a, b) => { assertEquals(a, undefined); assertEquals(b, '1') },
+           undefined);
+Object.freeze(['1', 2]).reduce((a, b) => { assertEquals(a, '1'); assertEquals(b, 2); });
+Object.freeze(['1']).reduce((a, b) => { assertTrue(false); });
+
+// Test error conditions:
+
+var exception = false;
+try {
+  Object.freeze(['1']).reduce("not a function");
+} catch (e) {
+  exception = true;
+  assertTrue(e instanceof TypeError,
+             "reduce callback not a function not throwing TypeError");
+  assertTrue(e.message.indexOf(" is not a function") >= 0,
+             "reduce non function TypeError type");
+}
+assertTrue(exception);
+
+exception = false;
+try {
+  Object.freeze(['1']).reduceRight("not a function");
+} catch (e) {
+  exception = true;
+  assertTrue(e instanceof TypeError,
+             "reduceRight callback not a function not throwing TypeError");
+  assertTrue(e.message.indexOf(" is not a function") >= 0,
+             "reduceRight non function TypeError type");
+}
+assertTrue(exception);
+
+exception = false;
+try {
+  Object.freeze([]).reduce(sum);
+} catch (e) {
+  exception = true;
+  assertTrue(e instanceof TypeError,
+             "reduce no initial value not throwing TypeError");
+  assertEquals("Reduce of empty array with no initial value", e.message,
+               "reduce no initial TypeError type");
+}
+assertTrue(exception);
+
+exception = false;
+try {
+  Object.freeze([]).reduceRight(sum);
+} catch (e) {
+  exception = true;
+  assertTrue(e instanceof TypeError,
+             "reduceRight no initial value not throwing TypeError");
+  assertEquals("Reduce of empty array with no initial value", e.message,
+               "reduceRight no initial TypeError type");
+}
+assertTrue(exception);
+
+exception = false;
+try {
+  Object.freeze([,,,]).reduce(sum);
+} catch (e) {
+  exception = true;
+  assertTrue(e instanceof TypeError,
+             "reduce sparse no initial value not throwing TypeError");
+  assertEquals("Reduce of empty array with no initial value", e.message,
+               "reduce no initial TypeError type");
+}
+assertTrue(exception);
+
+exception = false;
+try {
+  Object.freeze([,,,]).reduceRight(sum);
+} catch (e) {
+  exception = true;
+  assertTrue(e instanceof TypeError,
+             "reduceRight sparse no initial value not throwing TypeError");
+  assertEquals("Reduce of empty array with no initial value", e.message,
+               "reduceRight no initial TypeError type");
+}
+assertTrue(exception);
+
+
+// Array changing length
+
+function extender(a, b, i, s) {
+  s[s.length] = s.length;
+  return Number(a) + Number(b);
+}
+
+var arr = [1, '2', 3, 4];
+Object.freeze(arr);
+testReduce("reduce", "ArrayManipulationExtender", 10,
+           [[0, 1, 0, [1, '2', 3, 4], 1],
+            [1, '2', 1, [1, '2', 3, 4], 3],
+            [3, 3, 2, [1, '2', 3, 4], 6],
+            [6, 4, 3, [1, '2', 3, 4], 10],
+           ], arr, extender, 0);
+
+var arr = [];
+Object.defineProperty(arr, "0", { get: function() { delete this[0] },
+  configurable: true });
+assertEquals(undefined, Object.freeze(arr).reduce(function(val) { return val }));
+
+var arr = [];
+Object.defineProperty(arr, "0", { get: function() { delete this[0] },
+  configurable: true});
+assertEquals(undefined, Object.freeze(arr).reduceRight(function(val) { return val }));
+
+
+(function ReduceRightMaxIndex() {
+  const kMaxIndex = 0xffffffff-1;
+  let array = [];
+  array[kMaxIndex-2] = 'value-2';
+  array[kMaxIndex-1] = 'value-1';
+  // Use the maximum array index possible.
+  array[kMaxIndex] = 'value';
+  // Add the next index which is a normal property and thus will not show up.
+  array[kMaxIndex+1] = 'normal property';
+  assertThrowsEquals( () => {
+      Object.freeze(array).reduceRight((sum, value) => {
+        assertEquals('initial', sum);
+        assertEquals('value', value);
+        // Throw at this point as we would very slowly loop down from kMaxIndex.
+        throw 'do not continue';
+      }, 'initial')
+  }, 'do not continue');
+})();
+
+(function OptimizedReduce() {
+  let f = (a,current) => a + Number(current);
+  let g = function(a) {
+    return a.reduce(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  let a = [1,'2',3,4,5,6,7,8,9,10];
+  Object.freeze(a);
+  g(a); g(a);
+  let total = g(a);
+  %OptimizeFunctionOnNextCall(g);
+  assertEquals(total, g(a));
+  assertOptimized(g);
+})();
+
+(function OptimizedReduceEmpty() {
+  let f = (a,current) => a + Number(current);
+  let g = function(a) {
+    return a.reduce(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  let a = [1,'2',3,4,5,6,7,8,9,10];
+  Object.freeze(a);
+  g(a); g(a); g(a);
+  %OptimizeFunctionOnNextCall(g);
+  g(a);
+  assertOptimized(g);
+  assertThrows(() => g([]));
+  assertUnoptimized(g);
+})();
+
+(function OptimizedReduceLazyDeopt() {
+  let deopt = false;
+  let f = (a,current) => { if (deopt) %DeoptimizeNow(); return a + Number(current); };
+  let g = function(a) {
+    return a.reduce(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  let a = [1,'2',3,4,5,6,7,8,9,10];
+  Object.freeze(a);
+  g(a); g(a);
+  let total = g(a);
+  %OptimizeFunctionOnNextCall(g);
+  g(a);
+  assertOptimized(g);
+  deopt = true;
+  assertEquals(total, g(a));
+  assertOptimized(g);
+})();
+
+(function OptimizedReduceLazyDeoptMiddleOfIteration() {
+  let deopt = false;
+  let f = (a,current) => {
+    if (current == 6 && deopt) %DeoptimizeNow();
+    return a + Number(current);
+  };
+  let g = function(a) {
+    return a.reduce(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  let a = [11,'22',33,45,56,6,77,84,93,101];
+  Object.freeze(a);
+  g(a); g(a);
+  let total = g(a);
+  %OptimizeFunctionOnNextCall(g);
+  g(a);
+  assertOptimized(g);
+  deopt = true;
+  assertEquals(total, g(a));
+  assertOptimized(g);
+})();
+
+(function OptimizedReduceEagerDeoptMiddleOfIteration() {
+  let deopt = false;
+  let array = [11,'22',33,45,56,6,77,84,93,101];
+  Object.freeze(array);
+  let f = (a,current) => {
+    if (current == 6 && deopt) {array[0] = 1.5; }
+    return a + Number(current);
+  };
+  let g = function() {
+    return array.reduce(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertOptimized(g);
+  deopt = true;
+  g();
+  %PrepareFunctionForOptimization(g);
+  assertOptimized(g);
+  deopt = false;
+  array = [11,'22',33,45,56,6,77,84,93,101];
+  Object.freeze(array);
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertOptimized(g);
+  deopt = true;
+  assertEquals(total, g());
+  assertOptimized(g);
+})();
+
+(function OptimizedReduceEagerDeoptMiddleOfIterationHoley() {
+  let deopt = false;
+  let array = [, ,11,'22',,33,45,56,,6,77,84,93,101,];
+  Object.freeze(array);
+  let f = (a,current) => {
+    if (current == 6 && deopt) {array[0] = 1.5; }
+    return a + Number(current);
+  };
+  let g = function() {
+    return array.reduce(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertOptimized(g);
+  deopt = true;
+  g();
+  %PrepareFunctionForOptimization(g);
+  assertOptimized(g);
+  deopt = false;
+  array = [11,'22',33,45,56,6,77,84,93,101];
+  Object.freeze(array);
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertUnoptimized(g);
+  deopt = true;
+  assertEquals(total, g());
+  assertUnoptimized(g);
+})();
+
+(function TriggerReduceRightPreLoopDeopt() {
+  function f(a) {
+    a.reduceRight((x) => { return Number(x) + 1 });
+  };
+  %PrepareFunctionForOptimization(f);
+  var arr = Object.freeze([1, '2', ]);
+  f(arr);
+  f(arr);
+  %OptimizeFunctionOnNextCall(f);
+  assertThrows(() => f([]), TypeError);
+  assertUnoptimized(f);
+})();
+
+(function OptimizedReduceRightEagerDeoptMiddleOfIterationHoley() {
+  let deopt = false;
+  let array = [, ,11,'22',,33,45,56,,6,77,84,93,101,];
+  Object.freeze(array);
+  let f = (a,current) => {
+    if (current == 6 && deopt) {array[array.length-1] = 1.5; }
+    return a + Number(current);
+  };
+  let g = function() {
+    return array.reduceRight(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertOptimized(g);
+  deopt = true;
+  g();
+  %PrepareFunctionForOptimization(g);
+  assertOptimized(g);
+  deopt = false;
+  array = [11,'22',33,45,56,6,77,84,93,101];
+  Object.freeze(array);
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertUnoptimized(g);
+  deopt = true;
+  assertEquals(total, g());
+  assertUnoptimized(g);
+})();
+
+(function ReduceCatch() {
+  let f = (a,current) => {
+    return a + current;
+  };
+  let g = function() {
+    try {
+      return Object.freeze(array).reduce(f);
+    } catch (e) {
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  g();
+  assertEquals(total, g());
+  assertOptimized(g);
+})();
+
+(function ReduceThrow() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) throw "x";
+    return a + Number(current);
+  };
+  let array = [1,'2',3];
+  Object.freeze(array);
+  let g = function() {
+    try {
+      return array.reduce(f);
+    } catch (e) {
+      return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceThrow() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) throw "x";
+    return a + Number(current);
+  };
+  %NeverOptimizeFunction(f);
+  let array = [1,'2',3];
+  Object.freeze(array);
+  let g = function() {
+    try {
+      return array.reduce(f);
+    } catch (e) {
+      return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceFinally() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) throw "x";
+    return a + Number(current);
+  };
+  let array = [1,'2',3];
+  Object.freeze(array);
+  let g = function() {
+    try {
+      return array.reduce(f);
+    } catch (e) {
+    } finally {
+      if (done) return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceFinallyNoInline() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) throw "x";
+    return a + Number(current);
+  };
+  %NeverOptimizeFunction(f);
+  let array = [1, '2', 3];
+  Object.freeze(array);
+  let g = function() {
+    try {
+      return array.reduce(f);
+    } catch (e) {
+    } finally {
+      if (done) return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceNonCallableOpt() {
+  let done = false;
+  let f = (a, current) => {
+    return a + Number(current);
+  };
+  let array = [1,'2',3];
+  Object.freeze(array);
+  let g = function() {
+    return array.reduce(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g(); g();
+  assertEquals(6, g());
+  assertOptimized(g);
+  f = null;
+  assertThrows(() => g());
+  assertOptimized(g);
+})();
+
+(function ReduceCatchInlineDeopt() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) {
+      %DeoptimizeNow();
+      throw "x";
+    }
+    return a + Number(current);
+  };
+  let array = [1,2,3];
+  Object.freeze(array);
+  let g = function() {
+    try {
+      return array.reduce(f);
+    } catch (e) {
+      if (done) return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceFinallyInlineDeopt() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) {
+      %DeoptimizeNow();
+      throw "x";
+    }
+    return a + Number(current);
+  };
+  let array = [1,'2',3];
+  Object.freeze(array);
+  let g = function() {
+    try {
+      return array.reduce(f);
+    } catch (e) {
+    } finally {
+      if (done) return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function OptimizedReduceRight() {
+  let count = 0;
+  let f = (a,current,i) => a + Number(current) * ++count;
+  let g = function(a) {
+    count = 0;
+    return a.reduceRight(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  let a = [1,'2',3,4,5,6,7,8,9,10];
+  Object.freeze(a);
+  g(a); g(a);
+  let total = g(a);
+  %OptimizeFunctionOnNextCall(g);
+  assertEquals(total, g(a));
+  assertOptimized(g);
+})();
+
+(function OptimizedReduceEmpty() {
+  let count = 0;
+  let f = (a,current,i) => a + Number(current) * ++count;
+  let g = function(a) {
+    count = 0;
+    return a.reduceRight(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  let a = [1,'2',3,4,5,6,7,8,9,10];
+  Object.freeze(a);
+  g(a); g(a); g(a);
+  %OptimizeFunctionOnNextCall(g);
+  g(a);
+  assertOptimized(g);
+  assertThrows(() => g([]));
+  assertUnoptimized(g);
+})();
+
+(function OptimizedReduceLazyDeopt() {
+  let deopt = false;
+  let f = (a,current) => { if (deopt) %DeoptimizeNow(); return a + Number(current); };
+  let g = function(a) {
+    return a.reduceRight(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  let a = [1,'2',3,4,5,6,7,8,9,10];
+  Object.freeze(a);
+  g(a); g(a);
+  let total = g(a);
+  %OptimizeFunctionOnNextCall(g);
+  g(a);
+  deopt = true;
+  assertEquals(total, g(a));
+  assertOptimized(g);
+})();
+
+(function OptimizedReduceLazyDeoptMiddleOfIteration() {
+  let deopt = false;
+  let f = (a,current) => {
+    if (current == 6 && deopt) %DeoptimizeNow();
+    return a + Number(current);
+  };
+  let g = function(a) {
+    return a.reduceRight(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  let a = [11,'22',33,45,56,6,77,84,93,101];
+  Object.freeze(a);
+  g(a); g(a);
+  let total = g(a);
+  %OptimizeFunctionOnNextCall(g);
+  g(a);
+  deopt = true;
+  assertEquals(total, g(a));
+  assertOptimized(g);
+})();
+
+(function OptimizedReduceEagerDeoptMiddleOfIteration() {
+  let deopt = false;
+  let array = [11,'22',33,45,56,6,77,84,93,101];
+  Object.freeze(array);
+  let f = (a,current) => {
+    if (current == 6 && deopt) {array[9] = 1.5; }
+    return a + Number(current);
+  };
+  let g = function() {
+    return array.reduceRight(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertOptimized(g);
+  deopt = true;
+  g();
+  %PrepareFunctionForOptimization(g);
+  deopt = false;
+  array = [11,'22',33,45,56,6,77,84,93,101];
+  Object.freeze(array);
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  deopt = true;
+  assertEquals(total, g());
+  assertOptimized(g);
+})();
+
+(function ReduceCatch() {
+  let f = (a,current) => {
+    return a + Number(current);
+  };
+  let g = function() {
+    try {
+      return Object.freeze(array).reduceRight(f);
+    } catch (e) {
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  g();
+  assertEquals(total, g());
+  assertOptimized(g);
+})();
+
+(function ReduceThrow() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) throw "x";
+    return a + Number(current);
+  };
+  let array = [1,'2',3];
+  Object.freeze(array);
+  let g = function() {
+    try {
+      return array.reduceRight(f);
+    } catch (e) {
+      return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  assertOptimized(g);
+  done = true;
+  assertEquals(null, g());
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceThrow() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) throw "x";
+    return a + Number(current);
+  };
+  %NeverOptimizeFunction(f);
+  let array = [1,'2',3];
+  Object.freeze(array);
+  let g = function() {
+    try {
+      return array.reduceRight(f);
+    } catch (e) {
+      return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceFinally() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) throw "x";
+    return a + Number(current);
+  };
+  let array = [1, '2', 3];
+  Object.freeze(array);
+  let g = function() {
+    try {
+      return array.reduceRight(f);
+    } catch (e) {
+    } finally {
+      if (done) return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceFinallyNoInline() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) throw "x";
+    return a + Number(current);
+  };
+  %NeverOptimizeFunction(f);
+  let array = [1,'2',3];
+  Object.freeze(array);
+  let g = function() {
+    try {
+      return array.reduceRight(f);
+    } catch (e) {
+    } finally {
+      if (done) return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  assertOptimized(g);
+  done = true;
+  assertEquals(null, g());
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceNonCallableOpt() {
+  let done = false;
+  let f = (a, current) => {
+    return a + Number(current);
+  };
+  let array = [1,'2',3];
+  Object.freeze(array);
+  let g = function() {
+    return array.reduceRight(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g(); g();
+  assertEquals(6, g());
+  f = null;
+  assertThrows(() => g());
+  assertOptimized(g);
+})();
+
+(function ReduceCatchInlineDeopt() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) {
+      %DeoptimizeNow();
+      throw "x";
+    }
+    return a + Number(current);
+  };
+  let array = [1,'2',3];
+  Object.freeze(array);
+  let g = function() {
+    try {
+      return array.reduceRight(f);
+    } catch (e) {
+      if (done) return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceFinallyInlineDeopt() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) {
+      %DeoptimizeNow();
+      throw "x";
+    }
+    return a + Number(current);
+  };
+  let array = [1,'2',3];
+  Object.freeze(array);
+  let g = function() {
+    try {
+      return array.reduceRight(f);
+    } catch (e) {
+    } finally {
+      if (done) return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceHoleyArrayWithDefaultAccumulator() {
+  var holey = new Array(10);
+  Object.freeze(holey);
+  function reduce(a) {
+    let callback = function(accumulator, currentValue) {
+      return currentValue;
+    };
+    return a.reduce(callback, 13);
+  };
+  %PrepareFunctionForOptimization(reduce);
+  assertEquals(13, reduce(holey));
+  assertEquals(13, reduce(holey));
+  assertEquals(13, reduce(holey));
+  %OptimizeFunctionOnNextCall(reduce);
+  assertEquals(13, reduce(holey));
+  assertOptimized(reduce);
+})();
+
+(function ReduceRightHoleyArrayWithDefaultAccumulator() {
+  var holey = new Array(10);
+  Object.freeze(holey);
+  function reduce(a) {
+    let callback = function(accumulator, currentValue) {
+      return currentValue;
+    };
+    return a.reduceRight(callback, 13);
+  };
+  %PrepareFunctionForOptimization(reduce);
+  assertEquals(13, reduce(holey));
+  assertEquals(13, reduce(holey));
+  assertEquals(13, reduce(holey));
+  %OptimizeFunctionOnNextCall(reduce);
+  assertEquals(13, reduce(holey));
+  assertOptimized(reduce);
+})();
+
+(function ReduceHoleyArrayOneElementWithDefaultAccumulator() {
+  var holey = new Array(10);
+  holey[1] = '5';
+  Object.freeze(holey);
+  function reduce(a) {
+    let callback = function(accumulator, currentValue) {
+      return Number(currentValue) + accumulator;
+    };
+    return a.reduce(callback, 13);
+  };
+  %PrepareFunctionForOptimization(reduce);
+  assertEquals(18, reduce(holey));
+  assertEquals(18, reduce(holey));
+  assertEquals(18, reduce(holey));
+  %OptimizeFunctionOnNextCall(reduce);
+  assertEquals(18, reduce(holey));
+  assertOptimized(reduce);
+})();
+
+(function ReduceRightHoleyArrayOneElementWithDefaultAccumulator() {
+  var holey = new Array(10);
+  holey[1] = '5';
+  Object.freeze(holey);
+  function reduce(a) {
+    let callback = function(accumulator, currentValue) {
+      return Number(currentValue) + accumulator;
+    };
+    return a.reduceRight(callback, 13);
+  };
+  %PrepareFunctionForOptimization(reduce);
+  assertEquals(18, reduce(holey));
+  assertEquals(18, reduce(holey));
+  assertEquals(18, reduce(holey));
+  %OptimizeFunctionOnNextCall(reduce);
+  assertEquals(18, reduce(holey));
+  assertOptimized(reduce);
+})();
+
+(function ReduceMixedHoleyArrays() {
+  function r(a) {
+    return a.reduce((acc, i) => {acc[0]});
+  };
+  %PrepareFunctionForOptimization(r);
+  assertEquals(r(Object.freeze([[0]])), [0]);
+  assertEquals(r(Object.freeze([[0]])), [0]);
+  assertEquals(r(Object.freeze([0,,])), 0);
+  %OptimizeFunctionOnNextCall(r);
+  assertEquals(r(Object.freeze([,0,0])), undefined);
+  assertOptimized(r);
+})();
diff --git a/src/v8/test/mjsunit/function-named-self-reference.js b/src/v8/test/mjsunit/function-named-self-reference.js
index 5b03b09..4148d53 100644
--- a/src/v8/test/mjsunit/function-named-self-reference.js
+++ b/src/v8/test/mjsunit/function-named-self-reference.js
@@ -33,13 +33,14 @@
   %OptimizeFunctionOnNextCall(fn);
 
   function run(val) {
-    var res =  fn((val + 1) << 1);
+    var res = fn(val + 1 << 1);
 
     return res;
   }
 
   return run(0);
-}
-
+};
+;
+%PrepareFunctionForOptimization(fn);
 var res = fn();
 assertEquals(res, 2);
diff --git a/src/v8/test/mjsunit/generated-transition-stub.js b/src/v8/test/mjsunit/generated-transition-stub.js
index dadaa3c..8da3265 100644
--- a/src/v8/test/mjsunit/generated-transition-stub.js
+++ b/src/v8/test/mjsunit/generated-transition-stub.js
@@ -1,36 +1,13 @@
 // Copyright 2013 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
 
 // Flags: --allow-natives-syntax
 
 %NeverOptimizeFunction(test);
 function test() {
 
-  var iteration_count = 1;
+  const iteration_count = 1;
 
   function transition1(a, i, v) {
     a[i] = v;
@@ -40,14 +17,15 @@
   // Test PACKED SMI -> PACKED DOUBLE
   //
 
-  var a1 = [0, 1, 2, 3, 4];
+  %PrepareFunctionForOptimization(transition1);
+  const a1 = [0, 1, 2, 3, 4];
   transition1(a1, 0, 2.5);
-  var a2 = [0, 1, 2, 3, 4];
+  const a2 = [0, 1, 2, 3, 4];
   transition1(a2, 0, 2.5);
   assertFalse(%HasHoleyElements(a2));
   %OptimizeFunctionOnNextCall(transition1);
 
-  var a3 = [0, 1, 2, 3, 4];
+  const a3 = [0, 1, 2, 3, 4];
   assertTrue(%HasSmiElements(a3));
   transition1(a3, 0, 2.5);
   assertFalse(%HasHoleyElements(a3));
@@ -55,7 +33,7 @@
   assertEquals(2.5, a3[0]);
 
   // Test handling of hole.
-  var a4 = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9];
+  const a4 = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9];
   a4.length = 7;
   assertTrue(%HasSmiElements(a4));
   transition1(a4, 0, 2.5);
@@ -65,7 +43,7 @@
 
   // Large array should deopt to runtimea
   for (j = 0; j < iteration_count; ++j) {
-    a5 = new Array();
+    const a5 = new Array();
     for (i = 0; i < 0x40000; ++i) {
       a5[i] = 0;
     }
@@ -82,14 +60,15 @@
     a[i] = v;
   }
 
-  var b1 = [0, 1, 2, , 4];
+  %PrepareFunctionForOptimization(transition2);
+  const b1 = [0, 1, 2, , 4];
   transition2(b1, 0, 2.5);
-  var b2 = [0, 1, 2, , 4];
+  const b2 = [0, 1, 2, , 4];
   transition2(b2, 0, 2.5);
   assertTrue(%HasHoleyElements(b2));
   %OptimizeFunctionOnNextCall(transition2);
 
-  var b3 = [0, 1, 2, , 4];
+  const b3 = [0, 1, 2, , 4];
   assertTrue(%HasSmiElements(b3));
   assertTrue(%HasHoleyElements(b3));
   transition2(b3, 0, 2.5);
@@ -99,7 +78,7 @@
 
   // Large array should deopt to runtime
   for (j = 0; j < iteration_count; ++j) {
-    b4 = [0, ,0];
+    const b4 = [0, ,0];
     for (i = 3; i < 0x40000; ++i) {
       b4[i] = 0;
     }
@@ -116,15 +95,16 @@
     a[i] = v;
   }
 
-  var c1 = [0, 1, 2, 3.5, 4];
+  %PrepareFunctionForOptimization(transition3);
+  const c1 = [0, 1, 2, 3.5, 4];
   transition3(c1, 0, new Object());
-  var c2 = [0, 1, 2, 3.5, 4];
+  const c2 = [0, 1, 2, 3.5, 4];
   transition3(c2, 0, new Object());
   assertTrue(%HasObjectElements(c2));
   assertTrue(!%HasHoleyElements(c2));
   %OptimizeFunctionOnNextCall(transition3);
 
-  var c3 = [0, 1, 2, 3.5, 4];
+  const c3 = [0, 1, 2, 3.5, 4];
   assertTrue(%HasDoubleElements(c3));
   assertTrue(!%HasHoleyElements(c3));
   transition3(c3, 0, new Array());
@@ -136,7 +116,7 @@
   // Large array under the deopt threshold should be able to trigger GC without
   // causing crashes.
   for (j = 0; j < iteration_count; ++j) {
-    c4 = [0, 2.5, 0];
+    const c4 = [0, 2.5, 0];
     for (i = 3; i < 0xa000; ++i) {
       c4[i] = 0;
     }
@@ -150,7 +130,7 @@
 
   // Large array should deopt to runtime
   for (j = 0; j < iteration_count; ++j) {
-    c5 = [0, 2.5, 0];
+    const c5 = [0, 2.5, 0];
     for (i = 3; i < 0x40000; ++i) {
       c5[i] = 0;
     }
@@ -170,15 +150,16 @@
       a[i] = v;
   }
 
-  var d1 = [0, 1, , 3.5, 4];
+  %PrepareFunctionForOptimization(transition4);
+  const d1 = [0, 1, , 3.5, 4];
   transition4(d1, 0, new Object());
-  var d2 = [0, 1, , 3.5, 4];
+  const d2 = [0, 1, , 3.5, 4];
   transition4(d2, 0, new Object());
   assertTrue(%HasObjectElements(d2));
   assertTrue(%HasHoleyElements(d2));
   %OptimizeFunctionOnNextCall(transition4);
 
-  var d3 = [0, 1, , 3.5, 4];
+  const d3 = [0, 1, , 3.5, 4];
   assertTrue(%HasDoubleElements(d3));
   assertTrue(%HasHoleyElements(d3));
   transition4(d3, 0, new Array());
@@ -190,7 +171,7 @@
   // Large array under the deopt threshold should be able to trigger GC without
   // causing crashes.
   for (j = 0; j < iteration_count; ++j) {
-    d4 = [, 2.5, ,];
+    const d4 = [, 2.5, ,];
     for (i = 3; i < 0xa000; ++i) {
       d4[i] = 0;
     }
@@ -205,7 +186,7 @@
 
   // Large array should deopt to runtime
   for (j = 0; j < iteration_count; ++j) {
-    d5 = [, 2.5, ,];
+    const d5 = [, 2.5, ,];
     for (i = 3; i < 0x40000; ++i) {
       d5[i] = 0;
     }
diff --git a/src/v8/test/mjsunit/getters-on-elements.js b/src/v8/test/mjsunit/getters-on-elements.js
index d8cda83..a8d2b9e 100644
--- a/src/v8/test/mjsunit/getters-on-elements.js
+++ b/src/v8/test/mjsunit/getters-on-elements.js
@@ -52,6 +52,7 @@
   assertUnoptimized = empty_func;
   assertOptimized = empty_func;
 
+  prepareForOptimize = emtpy_func;
   optimize = empty_func;
   clearFunctionTypeFeedback = empty_func;
   deoptimizeFunction = empty_func;
@@ -59,6 +60,9 @@
   optimize = function(name) {
     %OptimizeFunctionOnNextCall(name);
   }
+  prepareForOptimize = function(name) {
+    %PrepareFunctionForOptimization(name);
+  }
   clearFunctionTypeFeedback = function(name) {
     %ClearFunctionFeedback(name);
   }
@@ -76,6 +80,7 @@
   var ap = [];
   ap.__defineGetter__(0, function() { calls++; return 0; });
 
+  prepareForOptimize(foo);
   foo(a);
   assertUnoptimized(foo);
   // Smi and Double elements transition the KeyedLoadIC to Generic state
@@ -145,6 +150,7 @@
   a = create_func();
   ap2 = [];
   a.__proto__ = ap2;
+  prepareForOptimize(foo);
   foo(a);
   foo(a);
   foo(a);
@@ -165,6 +171,7 @@
   a = create_func();
   a.__proto__ = ap2;
   bar = function(a) { return a[3] + 600; }
+  prepareForOptimize(bar);
   bar(a);
   bar(a);
   bar(a);
@@ -207,6 +214,7 @@
 
 var a = [3.5,,,3.5];
 fun = function(a) { return a[0] + 5.5; }
+prepareForOptimize(fun);
 fun(a);
 fun(a);
 fun(a);  // should have a monomorphic KeyedLoadIC.
@@ -229,6 +237,7 @@
 var ap = [,,3.5];
 ap.__proto__ = a.__proto__;
 a.__proto__ = ap;
+prepareForOptimize(fun);
 fun(a);
 optimize(fun);
 fun(a);
diff --git a/src/v8/test/mjsunit/global-infinity-strict.js b/src/v8/test/mjsunit/global-infinity-strict.js
index 8ab1683..e4ff33d 100644
--- a/src/v8/test/mjsunit/global-infinity-strict.js
+++ b/src/v8/test/mjsunit/global-infinity-strict.js
@@ -6,6 +6,7 @@
 "use strict";
 
 function test(expected, f) {
+  %PrepareFunctionForOptimization(f);
   assertEquals(expected, f());
   assertEquals(expected, f());
   %OptimizeFunctionOnNextCall(f);
@@ -14,6 +15,7 @@
 }
 
 function testThrows(f) {
+  %PrepareFunctionForOptimization(f);
   assertThrows(f);
   assertThrows(f);
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/global-infinity.js b/src/v8/test/mjsunit/global-infinity.js
index 3308057..d52f949 100644
--- a/src/v8/test/mjsunit/global-infinity.js
+++ b/src/v8/test/mjsunit/global-infinity.js
@@ -5,6 +5,7 @@
 // Flags: --allow-natives-syntax
 
 function test(expected, f) {
+  %PrepareFunctionForOptimization(f);
   assertEquals(expected, f());
   assertEquals(expected, f());
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/global-nan-strict.js b/src/v8/test/mjsunit/global-nan-strict.js
index 075d03c..79200e3 100644
--- a/src/v8/test/mjsunit/global-nan-strict.js
+++ b/src/v8/test/mjsunit/global-nan-strict.js
@@ -6,6 +6,7 @@
 "use strict";
 
 function test(expected, f) {
+  %PrepareFunctionForOptimization(f);
   assertEquals(expected, f());
   assertEquals(expected, f());
   %OptimizeFunctionOnNextCall(f);
@@ -14,6 +15,7 @@
 }
 
 function testThrows(f) {
+  %PrepareFunctionForOptimization(f);
   assertThrows(f);
   assertThrows(f);
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/global-nan.js b/src/v8/test/mjsunit/global-nan.js
index 5a98eff..0ed4cbf 100644
--- a/src/v8/test/mjsunit/global-nan.js
+++ b/src/v8/test/mjsunit/global-nan.js
@@ -5,6 +5,7 @@
 // Flags: --allow-natives-syntax
 
 function test(expected, f) {
+  %PrepareFunctionForOptimization(f);
   assertEquals(expected, f());
   assertEquals(expected, f());
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/global-undefined-strict.js b/src/v8/test/mjsunit/global-undefined-strict.js
index 9a0578a..a50d827 100644
--- a/src/v8/test/mjsunit/global-undefined-strict.js
+++ b/src/v8/test/mjsunit/global-undefined-strict.js
@@ -6,6 +6,7 @@
 "use strict";
 
 function test(expected, f) {
+  %PrepareFunctionForOptimization(f);
   assertEquals(expected, f());
   assertEquals(expected, f());
   %OptimizeFunctionOnNextCall(f);
@@ -14,6 +15,7 @@
 }
 
 function testThrows(f) {
+  %PrepareFunctionForOptimization(f);
   assertThrows(f);
   assertThrows(f);
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/global-undefined.js b/src/v8/test/mjsunit/global-undefined.js
index 6190f6f..53d8279 100644
--- a/src/v8/test/mjsunit/global-undefined.js
+++ b/src/v8/test/mjsunit/global-undefined.js
@@ -5,6 +5,7 @@
 // Flags: --allow-natives-syntax
 
 function test(expected, f) {
+  %PrepareFunctionForOptimization(f);
   assertEquals(expected, f());
   assertEquals(expected, f());
   %OptimizeFunctionOnNextCall(f);
@@ -13,6 +14,7 @@
 }
 
 function testThrows(f) {
+  %PrepareFunctionForOptimization(f);
   assertThrows(f);
   assertThrows(f);
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/harmony/array-flat-species.js b/src/v8/test/mjsunit/harmony/array-flat-species.js
new file mode 100644
index 0000000..7181c10
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/array-flat-species.js
@@ -0,0 +1,29 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+{
+  class MyArray extends Array {
+    static get [Symbol.species]() {
+      return Array;
+    }
+  }
+
+  const wannabe = new MyArray();
+  const flattened = wannabe.flat(Infinity);
+  assertEquals(false, flattened instanceof MyArray);
+  assertEquals(true, flattened instanceof Array);
+}
+
+{
+  class MyArray extends Array {
+    static get [Symbol.species]() {
+      return this;
+    }
+  }
+
+  const wannabe = new MyArray();
+  const flattened = wannabe.flat(Infinity);
+  assertEquals(true, flattened instanceof MyArray);
+  assertEquals(true, flattened instanceof Array);
+}
diff --git a/src/v8/test/mjsunit/harmony/array-flat.js b/src/v8/test/mjsunit/harmony/array-flat.js
new file mode 100644
index 0000000..9a291dc
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/array-flat.js
@@ -0,0 +1,63 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals(Array.prototype.flat.length, 0);
+assertEquals(Array.prototype.flat.name, 'flat');
+
+{
+  const input = [1, [2], [[3]]];
+
+  assertEquals(input.flat(),          [1, 2, [3]]);
+  assertEquals(input.flat(1),         [1, 2, [3]]);
+  assertEquals(input.flat(true),      [1, 2, [3]]);
+  assertEquals(input.flat(undefined), [1, 2, [3]]);
+
+  assertEquals(input.flat(-Infinity), [1, [2], [[3]]]);
+  assertEquals(input.flat(-1),        [1, [2], [[3]]]);
+  assertEquals(input.flat(-0),        [1, [2], [[3]]]);
+  assertEquals(input.flat(0),         [1, [2], [[3]]]);
+  assertEquals(input.flat(false),     [1, [2], [[3]]]);
+  assertEquals(input.flat(null),      [1, [2], [[3]]]);
+  assertEquals(input.flat(''),        [1, [2], [[3]]]);
+  assertEquals(input.flat('foo'),     [1, [2], [[3]]]);
+  assertEquals(input.flat(/./),       [1, [2], [[3]]]);
+  assertEquals(input.flat([]),        [1, [2], [[3]]]);
+  assertEquals(input.flat({}),        [1, [2], [[3]]]);
+  assertEquals(
+    input.flat(new Proxy({}, {})),    [1, [2], [[3]]]);
+  assertEquals(input.flat((x) => x),  [1, [2], [[3]]]);
+  assertEquals(
+    input.flat(String),               [1, [2], [[3]]]);
+
+  assertEquals(input.flat(2),         [1, 2, 3]);
+  assertEquals(input.flat(Infinity),  [1, 2, 3]);
+
+  assertThrows(() => { input.flat(Symbol()); }, TypeError);
+  assertThrows(() => { input.flat(Object.create(null)); }, TypeError);
+}
+
+{
+  const input = { 0: 'a', 1: 'b', 2: 'c', length: 'wat' };
+  assertEquals(Array.prototype.flat.call(input, Infinity), []);
+}
+
+{
+  let count = 0;
+  const input = {
+    get length() { ++count; return 0; }
+  };
+  const result = Array.prototype.flat.call(input, Infinity);
+  assertEquals(count, 1);
+}
+
+{
+  const descriptor = Object.getOwnPropertyDescriptor(
+    Array.prototype,
+    'flat'
+  );
+  assertEquals(descriptor.value, Array.prototype.flat);
+  assertEquals(descriptor.writable, true);
+  assertEquals(descriptor.enumerable, false);
+  assertEquals(descriptor.configurable, true);
+}
diff --git a/src/v8/test/mjsunit/harmony/array-flatMap-species.js b/src/v8/test/mjsunit/harmony/array-flatMap-species.js
new file mode 100644
index 0000000..48f9bea
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/array-flatMap-species.js
@@ -0,0 +1,29 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+{
+  class MyArray extends Array {
+    static get [Symbol.species]() {
+      return Array;
+    }
+  }
+
+  const wannabe = new MyArray();
+  const result = wannabe.flatMap(x => [x, x]);
+  assertEquals(false, result instanceof MyArray);
+  assertEquals(true, result instanceof Array);
+}
+
+{
+  class MyArray extends Array {
+    static get [Symbol.species]() {
+      return this;
+    }
+  }
+
+  const wannabe = new MyArray();
+  const result = wannabe.flatMap(x => [x, x]);
+  assertEquals(true, result instanceof MyArray);
+  assertEquals(true, result instanceof Array);
+}
diff --git a/src/v8/test/mjsunit/harmony/array-flatMap.js b/src/v8/test/mjsunit/harmony/array-flatMap.js
new file mode 100644
index 0000000..65a4025
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/array-flatMap.js
@@ -0,0 +1,162 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+assertEquals(Array.prototype.flatMap.length, 1);
+assertEquals(Array.prototype.flatMap.name, 'flatMap');
+
+assertEquals(
+  [1, 2, 3, 4].flatMap((element) => [element, element ** 2]),
+  [1, 1, 2, 4, 3, 9, 4, 16]
+);
+assertEquals(
+  [1, 2, 3, 4].flatMap((element) => [[element, element ** 2]]),
+  [[1, 1], [2, 4], [3, 9], [4, 16]]
+);
+
+{
+  const elements = new Set([
+    -Infinity,
+    -1,
+    -0,
+    +0,
+    +1,
+    Infinity,
+    null,
+    undefined,
+    true,
+    false,
+    '',
+    'foo',
+    /./,
+    [],
+    {},
+    Object.create(null),
+    new Proxy({}, {}),
+    Symbol(),
+    x => x ** 2,
+    String
+  ]);
+
+  for (const value of elements) {
+    assertEquals(
+      [value].flatMap((element) => [element, element]),
+      [value, value]
+    );
+  }
+}
+
+{
+  const array = [42];
+  assertEquals(
+    [array].flatMap((element) => [element, element]),
+    [array, array]
+  );
+}
+
+{
+  const nonCallables = new Set([
+    -Infinity,
+    -1,
+    -0,
+    +0,
+    +1,
+    Infinity,
+    null,
+    undefined,
+    true,
+    false,
+    '',
+    'foo',
+    /./,
+    [],
+    {},
+    Object.create(null),
+    new Proxy({}, {}),
+    Symbol(),
+  ]);
+  for (const nonCallable of nonCallables) {
+    assertThrows(() => {
+      [].flatMap(nonCallable);
+    }, TypeError);
+  }
+}
+
+{
+  const object = {
+    foo: 42,
+    get length() {
+      object.foo = 0;
+    }
+  };
+  const result = [object].flatMap((element) => [element, element]);
+  %HeapObjectVerify(result);
+  assertEquals(result, [object, object]);
+  assertEquals(result[0].foo, 42);
+}
+
+assertThrows(() => {
+  Array.prototype.flatMap.call(null, (element) => element);
+}, TypeError);
+assertThrows(() => {
+  Array.prototype.flatMap.call(undefined, (element) => element);
+}, TypeError);
+
+assertEquals(
+  Array.prototype.flatMap.call(
+    {
+      length: 1,
+      0: 'a',
+      1: 'b',
+    },
+    (element) => element
+  ),
+  ['a']
+);
+assertEquals(
+  Array.prototype.flatMap.call(
+    {
+      length: 2,
+      0: 'a',
+      1: 'b',
+    },
+    (element) => element
+  ),
+  ['a', 'b']
+);
+
+{
+  const result = [1, 2, 3].flatMap(function() {
+    return [this];
+  }, 'abc');
+  assertEquals(true, result[0] == 'abc');
+  assertEquals(true, result[1] == 'abc');
+  assertEquals(true, result[2] == 'abc');
+}
+
+{
+  const input = { 0: 'a', 1: 'b', 2: 'c', length: 'wat' };
+  assertEquals(Array.prototype.flatMap.call(input, x => [x]), []);
+}
+
+{
+  let count = 0;
+  const input = {
+    get length() { ++count; return 0; }
+  };
+  const result = Array.prototype.flatMap.call(input, x => [x]);
+  assertEquals(count, 1);
+}
+
+{
+  const descriptor = Object.getOwnPropertyDescriptor(
+    Array.prototype,
+    'flatMap'
+  );
+  assertEquals(descriptor.value, Array.prototype.flatMap);
+  assertEquals(descriptor.writable, true);
+  assertEquals(descriptor.enumerable, false);
+  assertEquals(descriptor.configurable, true);
+}
diff --git a/src/v8/test/mjsunit/harmony/async-await-optimization.js b/src/v8/test/mjsunit/harmony/async-await-optimization.js
new file mode 100644
index 0000000..b24e541
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/async-await-optimization.js
@@ -0,0 +1,124 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-await-optimization
+
+// test basic interleaving
+(function () {
+  const actual = [];
+  const expected = [ 'await', 1, 'await', 2 ];
+  const iterations = 2;
+
+  async function pushAwait() {
+    actual.push('await');
+  }
+
+  async function callAsync() {
+    for (let i = 0; i < iterations; i++) {
+      await pushAwait();
+    }
+    return 0;
+  }
+
+  function checkAssertions() {
+    assertArrayEquals(expected, actual,
+      'Async/await and promises should be interleaved.');
+  }
+
+  assertPromiseResult((async() => {
+    callAsync();
+
+    return new Promise(function (resolve) {
+      actual.push(1);
+      resolve();
+    }).then(function () {
+      actual.push(2);
+    }).then(checkAssertions);
+  })());
+})();
+
+// test async generators
+(function () {
+  const actual = [];
+  const expected = [ 'await', 1, 'await', 2 ];
+  const iterations = 2;
+
+  async function pushAwait() {
+    actual.push('await');
+  }
+
+  async function* callAsync() {
+    for (let i = 0; i < iterations; i++) {
+      await pushAwait();
+    }
+    return 0;
+  }
+
+  function checkAssertions() {
+    assertArrayEquals(expected, actual,
+      'Async/await and promises should be interleaved when using async generators.');
+  }
+
+  assertPromiseResult((async() => {
+    callAsync().next();
+
+    return new Promise(function (resolve) {
+      actual.push(1);
+      resolve();
+    }).then(function () {
+      actual.push(2);
+    }).then(checkAssertions);
+  })());
+})();
+
+// test yielding from async generators
+(function () {
+  const actual = [];
+  const expected = [
+    'Promise: 6',
+    'Promise: 5',
+    'Await: 3',
+    'Promise: 4',
+    'Promise: 3',
+    'Await: 2',
+    'Promise: 2',
+    'Promise: 1',
+    'Await: 1',
+    'Promise: 0'
+  ];
+  const iterations = 3;
+
+  async function* naturalNumbers(start) {
+    let current = start;
+    while (current > 0) {
+      yield Promise.resolve(current--);
+    }
+  }
+
+  async function trigger() {
+    for await (const num of naturalNumbers(iterations)) {
+      actual.push('Await: ' + num);
+    }
+  }
+
+  async function checkAssertions() {
+    assertArrayEquals(expected, actual,
+      'Async/await and promises should be interleaved when yielding.');
+  }
+
+  async function countdown(counter) {
+    actual.push('Promise: ' + counter);
+    if (counter > 0) {
+      return Promise.resolve(counter - 1).then(countdown);
+    } else {
+      await checkAssertions();
+    }
+  }
+
+  assertPromiseResult((async() => {
+    trigger();
+
+    return countdown(iterations * 2);
+  })());
+})();
diff --git a/src/v8/test/mjsunit/harmony/async-from-sync-iterator-next-tick-count.js b/src/v8/test/mjsunit/harmony/async-from-sync-iterator-next-tick-count.js
new file mode 100644
index 0000000..9730208
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/async-from-sync-iterator-next-tick-count.js
@@ -0,0 +1,33 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+const actual = [];
+
+function createIterator() {
+  return {
+    [Symbol.iterator]() { return this; },
+
+    next() {
+      return { value: Promise.resolve(1), done: true};
+    }
+  };
+}
+
+actual.push("start");
+iter = %CreateAsyncFromSyncIterator(createIterator());
+
+Promise.resolve(0)
+  .then(() => actual.push("tick 1"))
+  .then(() => actual.push("tick 2"))
+  .then(() => actual.push("tick 3"))
+  .then(() => actual.push("tick 4"))
+  .then(() => actual.push("tick 5"));
+
+let p = iter.next();
+p.then(_ => { actual.push("done"); } );
+
+%PerformMicrotaskCheckpoint();
+assertSame("start,tick 1,tick 2,done,tick 3,tick 4,tick 5", actual.join(","))
diff --git a/src/v8/test/mjsunit/harmony/async-from-sync-iterator-return-tick-count.js b/src/v8/test/mjsunit/harmony/async-from-sync-iterator-return-tick-count.js
new file mode 100644
index 0000000..c4c5f8d
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/async-from-sync-iterator-return-tick-count.js
@@ -0,0 +1,33 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+const actual = [];
+
+function createIterator() {
+  return {
+    [Symbol.iterator]() { return this; },
+
+    return() {
+      return { value: Promise.resolve(1), done: true};
+    }
+  };
+}
+
+actual.push("start");
+iter = %CreateAsyncFromSyncIterator(createIterator());
+
+Promise.resolve(0)
+  .then(() => actual.push("tick 1"))
+  .then(() => actual.push("tick 2"))
+  .then(() => actual.push("tick 3"))
+  .then(() => actual.push("tick 4"))
+  .then(() => actual.push("tick 5"));
+
+let p = iter.return();
+p.then(_ => { actual.push("done"); } );
+
+%PerformMicrotaskCheckpoint();
+assertSame("start,tick 1,tick 2,done,tick 3,tick 4,tick 5", actual.join(","))
diff --git a/src/v8/test/mjsunit/harmony/async-from-sync-iterator-throw-tick-count.js b/src/v8/test/mjsunit/harmony/async-from-sync-iterator-throw-tick-count.js
new file mode 100644
index 0000000..1550f4f
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/async-from-sync-iterator-throw-tick-count.js
@@ -0,0 +1,33 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+const actual = [];
+
+function createIterator() {
+  return {
+    [Symbol.iterator]() { return this; },
+
+    throw() {
+      return { value: Promise.resolve(1), done: true};
+    }
+  };
+}
+
+actual.push("start");
+iter = %CreateAsyncFromSyncIterator(createIterator());
+
+Promise.resolve(0)
+  .then(() => actual.push("tick 1"))
+  .then(() => actual.push("tick 2"))
+  .then(() => actual.push("tick 3"))
+  .then(() => actual.push("tick 4"))
+  .then(() => actual.push("tick 5"));
+
+let p = iter.throw();
+p.then(_ => { actual.push("done"); } );
+
+%PerformMicrotaskCheckpoint();
+assertSame("start,tick 1,tick 2,done,tick 3,tick 4,tick 5", actual.join(","))
diff --git a/src/v8/test/mjsunit/harmony/async-from-sync-iterator.js b/src/v8/test/mjsunit/harmony/async-from-sync-iterator.js
index a7b0d1b..e9dfe5d 100644
--- a/src/v8/test/mjsunit/harmony/async-from-sync-iterator.js
+++ b/src/v8/test/mjsunit/harmony/async-from-sync-iterator.js
@@ -24,7 +24,7 @@
 
   assertFalse(hadValue || hadError);
 
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
 
   if (!hadError) {
     throw new MjsUnitAssertionError(
@@ -185,7 +185,7 @@
   testFailure = error;
 });
 
-%RunMicrotasks();
+%PerformMicrotaskCheckpoint();
 if (testFailed) {
   throw testFailure;
 }
@@ -619,7 +619,7 @@
   testFailure = error;
 });
 
-%RunMicrotasks();
+%PerformMicrotaskCheckpoint();
 if (testFailed) {
   throw testFailure;
 }
@@ -663,7 +663,7 @@
 
   // Cycle through `f` to extract iterator methods
   f().catch(function() { %AbortJS("No error should have occurred"); });
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
 
   assertEquals(typeof extractedNext, "function");
   assertThrowsAsync(() => extractedNext.call(undefined), TypeError);
@@ -717,8 +717,8 @@
     next_: 0,
     get next() {
       log.push("get syncIterable.next");
-      let i = this.next_++;
       return (...args) => {
+        let i = this.next_++;
         log.push("call syncIterable.next(" + args.join(", ") + ")");
         return results[i];
       }
@@ -748,14 +748,12 @@
       "get nextValue#1.then",
       "call nextValue#1.then",
       "got value value1",
-      "get syncIterable.next",
       "call syncIterable.next()",
       "get iterResult #2.done",
       "get iterResult #2.value",
       "get nextValue#2.then",
       "call nextValue#2.then",
       "got value value2",
-      "get syncIterable.next",
       "call syncIterable.next()",
       "get iterResult #3.done",
       "get iterResult #3.value",
diff --git a/src/v8/test/mjsunit/harmony/async-generators-basic.js b/src/v8/test/mjsunit/harmony/async-generators-basic.js
index d7af183..77b1a84 100644
--- a/src/v8/test/mjsunit/harmony/async-generators-basic.js
+++ b/src/v8/test/mjsunit/harmony/async-generators-basic.js
@@ -21,7 +21,7 @@
 
   assertFalse(hadValue || hadError);
 
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
 
   if (!hadError) {
     throw new MjsUnitAssertionError(
@@ -55,7 +55,7 @@
 
   assertFalse(hadValue || hadError);
 
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
 
   if (hadError) throw actual;
 
@@ -103,12 +103,35 @@
 // ----------------------------------------------------------------------------
 // Do not install `AsyncGeneratorFunction` constructor on global object
 assertEquals(undefined, this.AsyncGeneratorFunction);
-let AsyncGeneratorFunction = (async function*() {}).constructor;
+
+// ----------------------------------------------------------------------------
+let AsyncGenerator = Object.getPrototypeOf(async function*() {});
+let AsyncGeneratorPrototype = AsyncGenerator.prototype;
+
+// %AsyncGenerator% and %AsyncGeneratorPrototype% are both ordinary objects
+assertEquals("object", typeof AsyncGenerator);
+assertEquals("object", typeof AsyncGeneratorPrototype);
+
+// %AsyncGenerator% <---> %AsyncGeneratorPrototype% circular reference
+assertEquals(AsyncGenerator, AsyncGeneratorPrototype.constructor);
+assertEquals(AsyncGeneratorPrototype, AsyncGenerator.prototype);
+
+let protoDesc = Object.getOwnPropertyDescriptor(AsyncGenerator, 'prototype');
+assertFalse(protoDesc.enumerable);
+assertFalse(protoDesc.writable);
+assertTrue(protoDesc.configurable);
+
+let ctorDesc =
+    Object.getOwnPropertyDescriptor(AsyncGeneratorPrototype, 'constructor');
+assertFalse(ctorDesc.enumerable);
+assertFalse(ctorDesc.writable);
+assertTrue(ctorDesc.configurable);
 
 // ----------------------------------------------------------------------------
 // The AsyncGeneratorFunction Constructor is the %AsyncGeneratorFunction%
 // intrinsic object and is a subclass of Function.
 // (proposal-async-iteration/#sec-asyncgeneratorfunction-constructor)
+let AsyncGeneratorFunction = AsyncGenerator.constructor;
 assertEquals(Object.getPrototypeOf(AsyncGeneratorFunction), Function);
 assertEquals(Object.getPrototypeOf(AsyncGeneratorFunction.prototype),
              Function.prototype);
@@ -425,7 +448,7 @@
 }
 it = asyncGeneratorForNestedResumeNext();
 it.next().then(logIterResult, AbortUnreachable);
-%RunMicrotasks();
+%PerformMicrotaskCheckpoint();
 assertEquals([
   { value: "rootbeer", done: false },
   { value: "float", done: false },
@@ -441,7 +464,7 @@
 };
 it = asyncGeneratorExprForNestedResumeNext();
 it.next().then(logIterResult, AbortUnreachable);
-%RunMicrotasks();
+%PerformMicrotaskCheckpoint();
 assertEquals([
   { value: "first", done: false },
   { value: "second", done: false },
@@ -459,7 +482,7 @@
 }).method;
 it = asyncGeneratorMethodForNestedResumeNext();
 it.next().then(logIterResult, AbortUnreachable);
-%RunMicrotasks();
+%PerformMicrotaskCheckpoint();
 assertEquals([
   { value: "remember", done: false },
   { value: "the cant!", done: false },
@@ -475,7 +498,7 @@
       yield await Resolver("rainbow!");`);
 it = asyncGeneratorCallEvalForNestedResumeNext();
 it.next().then(logIterResult, AbortUnreachable);
-%RunMicrotasks();
+%PerformMicrotaskCheckpoint();
 assertEquals([
   { value: "reading", done: false },
   { value: "rainbow!", done: false },
@@ -491,7 +514,7 @@
       yield await Resolver("BB!");`);
 it = asyncGeneratorNewEvalForNestedResumeNext();
 it.next().then(logIterResult, AbortUnreachable);
-%RunMicrotasks();
+%PerformMicrotaskCheckpoint();
 assertEquals([
   { value: 731, done: false },
   { value: "BB!", done: false },
@@ -513,7 +536,7 @@
 }
 it = asyncGeneratorForNestedResumeThrow();
 it.next().then(logIterResult, logError);
-%RunMicrotasks();
+%PerformMicrotaskCheckpoint();
 assertEquals([
   "throw1",
   "throw2",
@@ -533,7 +556,7 @@
 };
 it = asyncGeneratorExprForNestedResumeThrow();
 it.next().then(logIterResult, logError);
-%RunMicrotasks();
+%PerformMicrotaskCheckpoint();
 assertEquals([
   "throw3",
   "throw4",
@@ -555,7 +578,7 @@
 }).method;
 it = asyncGeneratorMethodForNestedResumeThrow();
 it.next().then(logIterResult, logError);
-%RunMicrotasks();
+%PerformMicrotaskCheckpoint();
 assertEquals([
   "throw5",
   "throw6",
@@ -575,7 +598,7 @@
       AbortUnreachable();`);
 it = asyncGeneratorCallEvalForNestedResumeThrow();
 it.next().then(logIterResult, logError);
-%RunMicrotasks();
+%PerformMicrotaskCheckpoint();
 assertEquals([
   "throw7",
   "throw8",
@@ -595,7 +618,7 @@
       AbortUnreachable();`);
 it = asyncGeneratorNewEvalForNestedResumeThrow();
 it.next().then(logIterResult, logError);
-%RunMicrotasks();
+%PerformMicrotaskCheckpoint();
 assertEquals([
   "throw9",
   "throw10",
@@ -613,7 +636,7 @@
 }
 it = asyncGeneratorForNestedResumeReturn();
 it.next().then(logIterResult, logError);
-%RunMicrotasks();
+%PerformMicrotaskCheckpoint();
 assertEquals([
   { value: "step1", done: false },
   { value: "step2", done: true },
@@ -628,7 +651,7 @@
 };
 it = asyncGeneratorExprForNestedResumeReturn();
 it.next().then(logIterResult, logError);
-%RunMicrotasks();
+%PerformMicrotaskCheckpoint();
 assertEquals([
   { value: "step3", done: false },
   { value: "step4", done: true },
@@ -645,7 +668,7 @@
 }).method;
 it = asyncGeneratorMethodForNestedResumeReturn();
 it.next().then(logIterResult, logError);
-%RunMicrotasks();
+%PerformMicrotaskCheckpoint();
 assertEquals([
   { value: "step5", done: false },
   { value: "step6", done: true },
@@ -660,7 +683,7 @@
       yield "step7";`);
 it = asyncGeneratorCallEvalForNestedResumeReturn();
 it.next().then(logIterResult, logError);
-%RunMicrotasks();
+%PerformMicrotaskCheckpoint();
 assertEquals([
   { value: "step7", done: false },
   { value: "step8", done: true },
@@ -675,7 +698,7 @@
       yield "step9";`);
 it = asyncGeneratorNewEvalForNestedResumeReturn();
 it.next().then(logIterResult, logError);
-%RunMicrotasks();
+%PerformMicrotaskCheckpoint();
 assertEquals([
   { value: "step9", done: false },
   { value: "step10", done: true },
diff --git a/src/v8/test/mjsunit/harmony/async-generators-resume-return.js b/src/v8/test/mjsunit/harmony/async-generators-resume-return.js
index 715c81f..2c6973e 100644
--- a/src/v8/test/mjsunit/harmony/async-generators-resume-return.js
+++ b/src/v8/test/mjsunit/harmony/async-generators-resume-return.js
@@ -4,6 +4,8 @@
 
 // Flags: --allow-natives-syntax
 
+load('test/mjsunit/test-async.js');
+
 // .return() from state suspendedStart with undefined
 testAsync(test => {
   test.plan(3);
diff --git a/src/v8/test/mjsunit/harmony/async-generators-return.js b/src/v8/test/mjsunit/harmony/async-generators-return.js
index 27cbd43..45f359f 100644
--- a/src/v8/test/mjsunit/harmony/async-generators-return.js
+++ b/src/v8/test/mjsunit/harmony/async-generators-return.js
@@ -4,6 +4,8 @@
 
 // Flags: --allow-natives-syntax
 
+load('test/mjsunit/test-async.js');
+
 testAsync(test => {
   test.plan(2);
 
@@ -68,7 +70,7 @@
 
 // Return a thenable which is fulfilled later
 testAsync(test => {
-  test.plan(2);
+  test.plan(3);
 
   let resolve;
   let awaitedThenable = { then(resolveFn) { resolve = resolveFn; } };
@@ -84,7 +86,8 @@
 
   gen().next().then(
       (iterResult) => {
-        test.equals({ value: "resolvedPromise", done: true }, iterResult);
+        test.equals("resolvedPromise", iterResult.value);
+        test.equals(true, iterResult.done);
         test.equals(true, finallyEvaluated);
       },
       test.unexpectedRejection());
diff --git a/src/v8/test/mjsunit/harmony/async-generators-yield.js b/src/v8/test/mjsunit/harmony/async-generators-yield.js
index feb6339..b34f6b8 100644
--- a/src/v8/test/mjsunit/harmony/async-generators-yield.js
+++ b/src/v8/test/mjsunit/harmony/async-generators-yield.js
@@ -4,6 +4,8 @@
 
 // Flags: --allow-natives-syntax
 
+load('test/mjsunit/test-async.js');
+
 // Yield a thenable which is never settled
 testAsync(test => {
   test.plan(0);
diff --git a/src/v8/test/mjsunit/harmony/async-iterators-resolve.js b/src/v8/test/mjsunit/harmony/async-iterators-resolve.js
new file mode 100644
index 0000000..182c5b7
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/async-iterators-resolve.js
@@ -0,0 +1,29 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+let actual = [];
+
+async function f() {
+  var p = Promise.resolve(0);
+  Object.defineProperty(p, "constructor", {
+    get() {
+      throw new Error();
+    }
+  });
+  actual.push("start");
+  for await (var x of [p]);
+  actual.push("never reached");
+}
+
+Promise.resolve(0)
+  .then(() => actual.push("tick 1"))
+  .then(() => actual.push("tick 2"))
+
+f().catch(() => actual.push("catch"));
+
+%PerformMicrotaskCheckpoint();
+
+assertSame(["start", "tick 1", "tick 2", "catch"].join(), actual.join());
diff --git a/src/v8/test/mjsunit/harmony/atomics-notify.js b/src/v8/test/mjsunit/harmony/atomics-notify.js
new file mode 100644
index 0000000..cf18321
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/atomics-notify.js
@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --harmony-sharedarraybuffer
+
+// This test needs to be killed if we remove Atomics.wake.
+assertNotSame(Atomics.wake, Atomics.notify);
diff --git a/src/v8/test/mjsunit/harmony/atomics-value-check.js b/src/v8/test/mjsunit/harmony/atomics-value-check.js
index b953863..053bc6d 100644
--- a/src/v8/test/mjsunit/harmony/atomics-value-check.js
+++ b/src/v8/test/mjsunit/harmony/atomics-value-check.js
@@ -12,7 +12,7 @@
       `onmessage=function(msg) {
          postMessage(0);
        };`;
-var worker = new Worker(workerScript);
+var worker = new Worker(workerScript, {type: 'string'});
 
 var value_obj = {
   valueOf: function() {worker.postMessage({sab:sab}, [sta.buffer]);
diff --git a/src/v8/test/mjsunit/harmony/bigint/add.js b/src/v8/test/mjsunit/harmony/bigint/add.js
index b57846e..791db6a 100644
--- a/src/v8/test/mjsunit/harmony/bigint/add.js
+++ b/src/v8/test/mjsunit/harmony/bigint/add.js
@@ -4,99 +4,95 @@
 
 // Generated by tools/bigint-tester.py.
 
-// Flags: --harmony-bigint
-
 var data = [{
-  a: "a2102214b151421124f462d37f843",
-  b: "90f3fa0f2fb9b1481b1a4737586ad6bdf71cb2ae51e06fdcb00fb779163e94ae4237",
-  r: "90f3fa0f2fb9b1481b1a4737586ad6bdf71cb2b872e29127c523d88b6584c1e63a7a"
+  a: -0xc4043e2c4cc49e4d6870103ce7c2ff2d512bf4b1b67553ba410db514ee0af8888ad6cfn,
+  b: 0x2aae86de73ff479133a657a40d26e8dcf192019c7421836615ec34978bad93n,
+  r: -0xc4043e2c2216176ef470c8abb41ca78944050bd4c4e3521dccec31aed81ec3f0ff293cn
 }, {
-  a: "35ca28bdd383c1b9ffdb851cc7f385ad370eef3d",
-  b: "-ca2d4dd677f23e005f44ec121303c3c304940eb2fd15e9e88772a3c5ba8515",
-  r: "-ca2d4dd677f23e005f44ebdc48db05ef80d254b32190cd2093ecf68eab95d8"
+  a: -0xee0933b25c8c0ef09fa385ffa1d3ca76855b560e186d27fa9f6ce105cb8517a4aecd5n,
+  b: -0x2ffc3a7babad313ede574774cb55cd40ab3b2n,
+  r: -0xee0933b25c8c0ef09fa385ffa1d3ca76b5579089c41a59397dc4287a96dae4e55a087n
 }, {
-  a: "-8abb4b6ca534b584fad2f5898dd22ae6",
-  b: "0",
-  r: "-8abb4b6ca534b584fad2f5898dd22ae6"
+  a: -0xdbb3e8fac212affdeda8959829838af77e43172n,
+  b: 0x2315999da3ac2ab89d2076cbe6e2e03082352e92c274680117ce7012dn,
+  r: 0x2315999da3ac2ab89c44c2e2ec20cd80844785fd2a4ae47620502cfbbn
 }, {
-  a: "b3",
-  b: "4180a0a",
-  r: "4180abd"
+  a: -0x5ad9780b309c24919defb1b331ebba4en,
+  b: 0xbe8dd806b3da0f79e7f6ad2fb566536cc78c1471c236891ce0n,
+  r: 0xbe8dd806b3da0f79e79bd3b7aa35b74835ee24c00f049d6292n
 }, {
-  a: "-8de89",
-  b: "c329fbab24d762a9453f90b134fcf5da9777aa1fdb26b74f27583a92a43f0f2c450",
-  r: "c329fbab24d762a9453f90b134fcf5da9777aa1fdb26b74f27583a92a43f0e9e5c7"
+  a: -0xade45eac6aaaf2c8097d7a3efecba4e80dd7aac4f692cfe841d113e68096c0218d521an,
+  b: -0x73c4119b366e22edd0797b5883a13e3bfc4124a559903ce785e0c833a8306b41cfn,
+  r: -0xade4d2707c4629362c6b4ab87a2428894c13a7061b3829787eb899c748ca6851f893e9n
 }, {
-  a: "-49af5f350d64c75047dfb107550dae478c983dd520e86c9807b1f5",
-  b: "60a62691669b8c323a29db2eb9cb75ba5811",
-  r: "-49af5f350d64c750477f0ae0c3a712bb5a5e13f9f22ea1224d59e4"
+  a: -0x6e9ab93d5cff3b3f31a55aa2f43fc321bff6978189e00fa4e64cn,
+  b: 0xec1caec29eb55312a313e50e20178873a350f1f89cbc971n,
+  r: -0x6e9aaa7b92131153dc743071b5eee120476f5d4c7ac085d91cdbn
 }, {
-  a: "80bf614aaa1140792099375f7fac9c7046303a8d13086755d505795f38761",
-  b: "-949dc945",
-  r: "80bf614aaa1140792099375f7fac9c7046303a8d13086755d50570155be1c"
+  a: -0x9a61c05bd53b74b731b8f8687e64d1ed1340404b5137ce39n,
+  b: -0x1e6793ea0fa51b2354b48n,
+  r: -0x9a61c05bd53b74b731b8f8687e66b86651e13a9d036d1981n
 }, {
-  a: "4241d736e6a40",
-  b: "-78e88f5eaeae4ff8b",
-  r: "-78e84d1cd7776954b"
+  a: -0x7c5a08517038f7dn,
+  b: 0x1d89f2n,
+  r: -0x7c5a08516e6058bn
 }, {
-  a: "-8033927bf52210827b99e712fb220631503adfaa4e0045c872b9b",
-  b: "-2f",
-  r: "-8033927bf52210827b99e712fb220631503adfaa4e0045c872bca"
+  a: -0xc4fd1b5aae2cfdc7b3ea6a74b7926a9a1ca3513bd08341e0c770080ban,
+  b: 0x76c79770202f9d9c6d2e244n,
+  r: -0xc4fd1b5aae2cfdc7b3ea6a74b7926a9a1c2c89a4606312432b02d9e76n
 }, {
-  a: "-3ad8b67efe9",
-  b: "-35586bf43788fd8e313da33c62d9a5",
-  r: "-35586bf43788fd8e314150c7cac98e"
+  a: 0xda114ddab6bfed910cc05c64f72961107beb98c3271n,
+  b: 0x98c52c393c6660663248fcbaa300b8n,
+  r: 0xda114ddab6bff71d5f83f02b5d2fc4350bb742f3329n
 }, {
-  a: "-a43d8c9af54e8ea545e1af4674613932650c833669c7adc9273b77",
-  b: "-6a4",
-  r: "-a43d8c9af54e8ea545e1af4674613932650c833669c7adc927421b"
+  a: -0x46311d926dfd26f0850ea3497fcd0d95a5dabab0361f219a601dc3dbe35d0n,
+  b: -0xf340af7b84e4eced2ca613e1ef4bb6aec4b8f01bc3n,
+  r: -0x46311d926dfd26f0851dd75477855be474ad8511743e1655cb0a0f6ae5193n
 }, {
-  a: "26c178e22dd42280a59b",
-  b: "fba77d85ba082981ce4a1ca21ac8b805b389297dc",
-  r: "fba77d85ba082981ce4a1f0e3256dae2f5b133d77"
+  a: 0xb2b4d9c0c73258a8092n,
+  b: 0xf4d1c3d2861cc0bfaea456c03b0f548a32effc1c3e1593935a6b0n,
+  r: 0xf4d1c3d2861cc0bfaea456c03b0f548a33a2b0f5fedcc5ec02742n
 }, {
-  a: "-c9bc2ac82920efc63fa48f63fae105ec432672b50269fad72ee8b44a1",
-  b: "8967d49deeff878f40fa1bf408400b8085820d47b",
-  r: "-c9bc2ac82920efc5b63cbac60be17e5d022c56c0fa29ef56a966a7026"
+  a: -0x56604879bdaaff7409cd59cfbafe73a74c284bfaeb991b6e11171bc08cf68bean,
+  b: 0xf4016a6e94c0f256af54fca00d6c909a620c6ea950c73cade3724174c12888n,
+  r: -0x556c470f4f163e81b31e04d31af10716b1c63f8c424854316333a97f18356362n
 }, {
-  a: "815a18c9a2d8c6e5f3fffa958430851c4ea3",
-  b: "59d451c6efad276d3cc393907dda0eca463488958f397bb09",
-  r: "59d451c6efad2f82de502dbe0a486e0a45dde0d8978b409ac"
+  a: -0x7a238c856c50aee41d1a2a1446a77f1567n,
+  b: 0x58n,
+  r: -0x7a238c856c50aee41d1a2a1446a77f150fn
 }, {
-  a: "8cfc360e8d215045cb5c289a50e5c7fa9da34c0b9d9be9597e6e476efdb121",
-  b: "-482747619f0edd06",
-  r: "8cfc360e8d215045cb5c289a50e5c7fa9da34c0b9d9be9115726e5cfeed41b"
+  a: 0xcdaf8c242e5da7265cc715871c3n,
+  b: -0x63604dd2b8df176c627ce3b018b2e74448746123d5578e66e9c0n,
+  r: -0x63604dd2b8df176c627ce3b00bd7ee82058e86b16f8b1d0e77fdn
 }, {
-  a: "346337dbb9bbfc08cb815434c50315d32d",
-  b: "-ac569f54f5ea8852463c7542e876a9953",
-  r: "299dcde66a5d5383a71d8ce0967bab39da"
+  a: 0xfa254e9c8d182d2bd90d8ff2b25d4e9819900b62b9ef60f3744ddc55cd362den,
+  b: -0x1fef80ff5d53dd0adaa75e8f0d16429851de115822n,
+  r: 0xfa254e9c8d182d2bd90d8df3ba4d58c2dbbf5db84406702210245737ec20abcn
 }, {
-  a: "8bb7c3e56",
-  b: "-c334d52ed6eb903256253e01fc0c5118fe9bc",
-  r: "-c334d52ed6eb903256253e01fc0bc5613ab66"
+  a: 0x3e85cn,
+  b: 0x687c558b2c1308c1a133d647ff7en,
+  r: 0x687c558b2c1308c1a133d64be7dan
 }, {
-  a: "b1f444a7a95e6d1d293ff0182e3dd5e945234484a5b47516b5b42627ed54fa8cf1221e",
-  b: "-93b77e906778b7e0a85c07e08babe730edd93ed37adef19da9e76de2add3",
-  r: "b1f444a7a8cab59e98d877604d9579e16497989d74c69bd7e23947364fab131f0e744b"
+  a: 0x9011db3dd56dbf2ef06154cbd48a67f6038483cff59f49011e57n,
+  b: 0xc033be10adcb6a7a5a697a7ef95ac3680611ff7ef690231314d338an,
+  r: 0xc03cbf2e61a8c1564d58809446180c0e857237c7338f7d07a4e51e1n
 }, {
-  a: "9a156524b9",
-  b: "-bce28d1561fc0153b836c6e0969d2674fcb960331cdb55df24e34e4b65136fcb59",
-  r: "-bce28d1561fc0153b836c6e0969d2674fcb960331cdb55df24e34e4acafe0aa6a0"
+  a: -0xefac02ab40df0f00a1b97a4n,
+  b: 0xc3b5e53656cd891e179ec3fb8a8d192f9bab5cfd76c014400n,
+  r: 0xc3b5e53656cd891e179ec3fb899d6d2cf06a7dee761e5ac5cn
 }, {
-  a: "5eaf418fbccefb4f53abc413c02cee60eb3880b615c615c2005b3d11c8ee4aaf3b4ded8",
-  b: "-eb8aa4a72cf44f06208",
-  r: "5eaf418fbccefb4f53abc413c02cee60eb3880b615c615c2005a518724471dbaec47cd0"
+  a: -0x7f9d48b408a5bb3827bc0149ecd538a2b2a7d4e1e0a4e9c36ee05f8be3a5b3n,
+  b: 0xd83d8cb2fb784703498cf0d61ff097ca42635664058cb85ea39f5931c37a1n,
+  r: -0x72196fe8d8ee36c7f323323c8ad62f260e819f7ba04c1e3d84a669f8c76e12n
 }];
 
 var error_count = 0;
 for (var i = 0; i < data.length; i++) {
   var d = data[i];
-  var a = BigInt.parseInt(d.a, 16);
-  var b = BigInt.parseInt(d.b, 16);
-  var r = a + b;
-  if (d.r !== r.toString(16)) {
-    print("Input A:  " + a.toString(16));
-    print("Input B:  " + b.toString(16));
+  var r = d.a + d.b;
+  if (d.r !== r) {
+    print("Input A:  " + d.a.toString(16));
+    print("Input B:  " + d.b.toString(16));
     print("Result:   " + r.toString(16));
     print("Expected: " + d.r);
     print("Op: +");
diff --git a/src/v8/test/mjsunit/harmony/bigint/and.js b/src/v8/test/mjsunit/harmony/bigint/and.js
index e5c3b14..a90ec22 100644
--- a/src/v8/test/mjsunit/harmony/bigint/and.js
+++ b/src/v8/test/mjsunit/harmony/bigint/and.js
@@ -4,99 +4,95 @@
 
 // Generated by tools/bigint-tester.py.
 
-// Flags: --harmony-bigint
-
 var data = [{
-  a: "-193b47d0d9a8688b329e80de92195f311825",
-  b: "-2fabed9434bff933e23ea21af0f21a43",
-  r: "-193b6ffbfdbc7cbffbbfe2feb21bfff31a67"
+  a: 0x9252b94f220ded0c18706998886397699c5a25527575dn,
+  b: -0x286817ba2e8fd8n,
+  r: 0x9252b94f220ded0c1870699888639769185a045015008n
 }, {
-  a: "35979ec99b7ff03f81817ebc9ddd50025d1ccf41565b502f0fc85ec54f630",
-  b: "be96016cc031653c9b1eceb1dd",
-  r: "8c9401648000603c810c44b010"
+  a: 0x15a28152354fe421bbe4649d4d22d536ac34f9ba962n,
+  b: 0x8n,
+  r: 0n
 }, {
-  a: "-f594f8199c11594681a9c38fd985a03d8c79ce6c8d342809924c89b385af43116ec3a21",
-  b: "-53e7b9738caaecc58fde1b5a4aa9f782f28a04e2bb29d207ccd5d45",
-  r: "-f594f8199c115946d3effbffddafecfd8fffdf7ecfbdff8bf2ce8df3bfafd317eed7f65"
+  a: 0xd09791bf7ae6703fae8d654104f54fcd957bbf028540b8e7c0f859fdcc1b7abd617en,
+  b: 0x24b473d03n,
+  r: 0x24a052102n
 }, {
-  a: "dd7245d3ca5b360296082e6ca91915179b257f36e45e6e44cf892db875fdcfb19522b3",
-  b: "-dcc83137df3bb234e1144390f6c5bc0772a07f2a4540865554d20ebd37be",
-  r: "dd7245d3ca0336028000044c891801140b013a02e00c4e00c5882d3820a90db1000002"
+  a: 0x2f73fbd05e9f7f70beba3dc7cd883732149a3d02a422f90f336n,
+  b: 0x4490583f8n,
+  r: 0x9008330n
 }, {
-  a: "-28",
-  b: "eaec4017147fd9741ff3b98f1b6f71d8f3d6869c18b39c6237a6b2d4d2fc3c81e9",
-  r: "eaec4017147fd9741ff3b98f1b6f71d8f3d6869c18b39c6237a6b2d4d2fc3c81c8"
+  a: 0xd6ea27844b3d356774e73de10d393ab9cadb81848e3b4a34d1f7440d3n,
+  b: 0x1639eeee731f3ba09234b5e15ec92f8bfb5cea28a0e89c59ed1c45b5f04n,
+  r: 0x10ea26000b39200234a5214009290ab948ca008088184824104504000n
 }, {
-  a: "-223909fc585f36f995d6f72dd9f169df1fad8",
-  b: "b13e919ce59c18c7c0517eecdb2519155cc",
-  r: "80360184a0880042000052240a040000508"
+  a: -0x131f5e2c196269fd140c8727a9a02170e0dddb6aec109a89bcn,
+  b: 0x401ec4eae8b756f2b222f6f565fb6acecce3c524e9b453n,
+  r: 0x12c488800242f230005655448b0a0204810124613440n
 }, {
-  a: "-fcb4ac9fdc7ee85d03585f944a79b28efffb461e17df2d",
-  b: "13cd27fb49c92d53c567688ab6b9",
-  r: "38023b100492100042160882091"
+  a: -0x5bcba128bf7b949780a4bd02782a63ae79f646a33b8672f3f692ab98n,
+  b: -0xa81dd8ff624072fce3a00eb0bd5700e5666c3beb7d59701c42489n,
+  r: -0x5bcba1fdbfffb497afeebf02fb2bf7fe7ff666e3bfb7f7f7f7d6afa0n
 }, {
-  a: "-1a16ca8c3725cec0c8a61ce81",
-  b: "-dbf3e",
-  r: "-1a16ca8c3725cec0c8a6dffbe"
+  a: 0xc997546528786548270061bcn,
+  b: 0x75023f046c04f9095f64d3b8c75ab21950an,
+  r: 0x499014640838044023000108n
 }, {
-  a: "-834db45b67472062091e",
-  b: "5aff66623af6b6cd042a361d5a22aea03152b764a056c71",
-  r: "5aff66623af6b6cd042a361d5a228a2030408304a056460"
+  a: 0x5ad0abd6e43ef787248af2607fb29b9c3f7a1e7b106269ff3bn,
+  b: -0xd483c8630392db4b620e0f6n,
+  r: 0x5ad0abd6e43ef787248af2607fb29380394a06520040491f0an
 }, {
-  a: "1a8c37cff2e02f5272bc61d60b8301e443c38172446f75d75e01c41f60",
-  b: "e15d12bee18edaca77ad15ff0a567e132bb1b046623858",
-  r: "215012bc61860a8201a401c30052440321911000401840"
+  a: -0x9ed448bdb4794e4c0485db9ebe6cad0b0n,
+  b: -0x549a70753c9afn,
+  r: -0x9ed448bdb4794e4c0485df9efe7dbd9b0n
 }, {
-  a: "-f463",
-  b: "bb02038e2ff03fa",
-  r: "bb02038e2ff0398"
+  a: -0x3a3fe42647633612082372714484767efc9673ce964b76f9f53a63d5n,
+  b: 0x99615e5edd0506cbb5512fb56ee2dd1238bn,
+  r: 0x986116189800068881100b0000608c1000bn
 }, {
-  a: "3178f92d2eeee1aebc33f085aa96c9046f1133ad6afbd666664ab79625639e001",
-  b: "124d8bd8ea20d8e510ba30d9",
-  r: "20d02406020586010382001"
+  a: -0xac1b8238c08f5n,
+  b: -0xb9439dfbbc70e12b3a1fc7ccbfebeacd9bb321d83d3an,
+  r: -0xb9439dfbbc70e12b3a1fc7ccbfebeacfdbbb23dc3dfen
 }, {
-  a: "fc7aaaa7a52f3604e1e700f01ea6f266912f583bffa78aee08939401056cde",
-  b: "-50e3611d6ada075f432319f10c8192f1de56ead628972",
-  r: "fc7aaaa7a52f3604e0e100e008025202010d4820ef2782c00012900005648e"
+  a: 0x120580503n,
+  b: 0x90e13d34618496af407fabefabdd23892f488n,
+  r: 0x20100400n
 }, {
-  a: "7dea10c67bdf023c00d94643e9f2d38295635b0b2b55a0e40818",
-  b: "8defe4741785c6c2d2ecaf7752a903ed",
-  r: "443e0701380844252082b5500a00008"
+  a: 0xaa51cn,
+  b: 0x2122a9c43b2531d5n,
+  r: 0x2114n
 }, {
-  a: "6f837e0ec2d00abb60051299bfd36b58c803f6445f91bb8dded858c6c1c476142",
-  b: "-26746eda5ca5095ab8f315c88b201cfa2affbbb700fc3bba8626b5bfd0a",
-  r: "6f837e08829000a3400400010cc22350c80304440000088d02c04040c14040042"
+  a: 0xaf43eb353c1547dc6ad79768e9a6n,
+  b: 0x55c80f89d8fe82dbf69eca557dd0479b6a449db77e38b2241ec81aa7d4042766dd3e63n,
+  r: 0x28022014081007d4000706482822n
 }, {
-  a: "ab69c286138358dea4308b60f12f212fcd1e0",
-  b: "-c8735b6ce5513cc661fdae7941055028a2ea768dc13b9c83a79b9bf84e62cdf",
-  r: "aa29c2041181501e84200840602401218d120"
+  a: 0xbd38b2d88212ceea6fbe3890769e46236n,
+  b: 0xeb22e568873e9bfdb5d2ddbc03n,
+  r: 0x88202468863a83890540c42002n
 }, {
-  a: "6c9ec2e7cdb2c1fb630a8e16323138db939c2a21e3576b777d",
-  b: "-51cf93f77a711c00",
-  r: "6c9ec2e7cdb2c1fb630a8e16323138db938c202000050a6400"
+  a: 0x24cd8c9634eddf319c57b54dffb49ce4974528f03b2c732d052ad496n,
+  b: -0x4079cfn,
+  r: 0x24cd8c9634eddf319c57b54dffb49ce4974528f03b2c732d052a8410n
 }, {
-  a: "edee34cd0c29ad27fed12e77a42aedbf8b53161716c90d516394b9038a2f125c95",
-  b: "-18a515e3705a582d82f14bd42075b3b",
-  r: "edee34cd0c29ad27fed12e77a42aedbf8b52140600c8085061049003022d100485"
+  a: -0x61f263476a1212fce55cf7d437f4364b73a1815a641n,
+  b: -0x19226cb79772cca166043a29d1f0fe1df5n,
+  r: -0x61f263476b9236fffd7fffde37f477ebffbf8ffbff5n
 }, {
-  a: "466fee7dabecbaea71c19892f045d7d196a80c6f",
-  b: "-5c93c7afd552be",
-  r: "466fee7dabecbaea71c19892f001441010280c42"
+  a: -0x44309b08a65bc7dc1e53d598d82ccdaa852941d7c851d907a6acn,
+  b: 0xdd93dc17d38658ee30453d5f27en,
+  r: 0x5d1304178102408230402d05054n
 }, {
-  a: "-657c587f67a70177797befb96f116c2843",
-  b: "-c3b8e2",
-  r: "-657c587f67a70177797befb96f11efb8e4"
+  a: 0x1e3eea4668e7a6c3bfa87d3f7a419bd18an,
+  b: -0x592d83940f884f9n,
+  r: 0x1e3eea4668e7a6c3bfa86d274201035102n
 }];
 
 var error_count = 0;
 for (var i = 0; i < data.length; i++) {
   var d = data[i];
-  var a = BigInt.parseInt(d.a, 16);
-  var b = BigInt.parseInt(d.b, 16);
-  var r = a & b;
-  if (d.r !== r.toString(16)) {
-    print("Input A:  " + a.toString(16));
-    print("Input B:  " + b.toString(16));
+  var r = d.a & d.b;
+  if (d.r !== r) {
+    print("Input A:  " + d.a.toString(16));
+    print("Input B:  " + d.b.toString(16));
     print("Result:   " + r.toString(16));
     print("Expected: " + d.r);
     print("Op: &");
diff --git a/src/v8/test/mjsunit/harmony/bigint/as-int-n.js b/src/v8/test/mjsunit/harmony/bigint/as-int-n.js
index faa7dba..ccb7c79 100644
--- a/src/v8/test/mjsunit/harmony/bigint/as-int-n.js
+++ b/src/v8/test/mjsunit/harmony/bigint/as-int-n.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-bigint
-
 // BigInt.asIntN
 {
   assertEquals(2, BigInt.asIntN.length);
@@ -147,6 +145,10 @@
   assertEquals(-4n, BigInt.asIntN(3, "12"));
   assertEquals(0x123456789abcdefn,
                BigInt.asIntN(64, 0xabcdef0123456789abcdefn));
+}{
+  // Regression test for crbug.com/v8/8426.
+  assertEquals(-0x8000000000000000n,
+               BigInt.asIntN(64, -0x8000000000000000n));
 }
 
 // BigInt.asUintN
@@ -284,9 +286,7 @@
   assertEquals(4294967296n, BigInt.asUintN(2**32, 4294967296n));
   assertEquals(4294967297n, BigInt.asUintN(2**32, 4294967297n));
 }{
-  assertEquals(
-      BigInt.parseInt("0x7234567812345678"),
-      BigInt.asUintN(63, BigInt.parseInt("0xf234567812345678")));
+  assertEquals(0x7234567812345678n, BigInt.asUintN(63, 0xf234567812345678n));
 }{
   assertThrows(() => BigInt.asUintN(2n, 12n), TypeError);
   assertThrows(() => BigInt.asUintN(-1, 0n), RangeError);
@@ -297,4 +297,8 @@
 }{
   assertThrows(() => BigInt.asUintN(3, 12), TypeError);
   assertEquals(4n, BigInt.asUintN(3, "12"));
+}{
+  // crbug.com/936506
+  assertEquals(1n, BigInt.asUintN(15, 0x100000001n));
+  assertEquals(1n, BigInt.asUintN(15, 0x10000000000000001n));
 }
diff --git a/src/v8/test/mjsunit/harmony/bigint/basics.js b/src/v8/test/mjsunit/harmony/bigint/basics.js
index 398d670..0368c69 100644
--- a/src/v8/test/mjsunit/harmony/bigint/basics.js
+++ b/src/v8/test/mjsunit/harmony/bigint/basics.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --harmony-bigint
+// Flags: --allow-natives-syntax
 
 'use strict'
 
@@ -56,6 +56,10 @@
   assertSame(BigInt(42n), 42n);
   assertSame(BigInt(Object(42n)), 42n);
   assertSame(BigInt(2**53 - 1), 9007199254740991n);
+  assertSame(BigInt(2**53), 9007199254740992n);
+  assertSame(BigInt(2**1000), 2n ** 1000n);
+  assertSame(BigInt(3.0755851989071915e29), 307558519890719151276406341632n);
+  assertSame(BigInt(-1e50), -0x446c3b15f992680000000000000000000000000000n);
   assertSame(BigInt(Object(2**53 - 1)), 9007199254740991n);
   assertSame(BigInt([]), 0n);
 }{
@@ -64,8 +68,6 @@
   assertThrows(() => BigInt(+Infinity), RangeError);
   assertThrows(() => BigInt(4.00000001), RangeError);
   assertThrows(() => BigInt(Object(4.00000001)), RangeError);
-  assertThrows(() => BigInt(2**53), RangeError);
-  assertThrows(() => BigInt(2**1000), RangeError);
 }
 
 // BigInt.prototype[Symbol.toStringTag]
@@ -197,6 +199,28 @@
   // Multi-digit BigInts.
   // Test parseInt/toString round trip on a list of randomly generated
   // string representations of numbers in various bases.
+
+  // Userland polyfill while we wait for BigInt.fromString (see:
+  // https://mathiasbynens.github.io/proposal-number-fromstring/ ).
+  // This intentionally only implements what the tests below need.
+  function ParseBigInt(str, radix) {
+    const alphabet = "0123456789abcdefghijklmnopqrstuvwxyz";
+    var result = 0n;
+    var base = BigInt(radix);
+    var index = 0;
+    var negative = false;
+    if (str[0] === "-") {
+      negative = true;
+      index++;
+    }
+    for (; index < str.length; index++) {
+      var digit = alphabet.indexOf(str[index]);
+      assertTrue(digit >= 0 && digit < radix);
+      result = result * base + BigInt(digit);
+    }
+    if (negative) result = -result;
+    return result;
+  }
   var positive = [0, 0,  // Skip base 0 and 1.
     "1100110001100010110011110110010010001011100111100101111000111101100001000",
     "1001200022210010220101120212021002011002201122200002211102120120021011020",
@@ -273,28 +297,12 @@
   ];
   for (var base = 2; base <= 36; base++) {
     var input = positive[base];
-    assertEquals(input, BigInt.parseInt(input, base).toString(base));
+    assertEquals(input, ParseBigInt(input, base).toString(base));
     input = negative[base];
-    assertEquals(input, BigInt.parseInt(input, base).toString(base));
+    assertEquals(input, ParseBigInt(input, base).toString(base));
   }
 }
 
-// .parseInt
-{
-  assertEquals("hellobigint", BigInt.parseInt("hellobigint", 32).toString(32));
-  assertEquals("abc", BigInt.parseInt("101010111100", 2).toString(16));
-  // Detect "0x" prefix.
-  assertEquals("f00dcafe", BigInt.parseInt("0xf00dcafe").toString(16));
-  // Default base is 10, trailing junk is skipped.
-  assertEquals("abc", BigInt.parseInt("2748junk").toString(16));
-  // Objects are converted to string.
-  let obj = {toString: () => "0x12345"};
-  assertEquals("12345", BigInt.parseInt(obj).toString(16));
-  // Empty and invalid strings throw.
-  assertThrows("BigInt.parseInt('')", SyntaxError);
-  assertThrows("BigInt.parseInt('nope', 2)", SyntaxError);
-}
-
 // .valueOf
 {
   assertEquals(Object(zero).valueOf(), another_zero);
diff --git a/src/v8/test/mjsunit/harmony/bigint/comparisons.js b/src/v8/test/mjsunit/harmony/bigint/comparisons.js
index 513ff37..abc7a80 100644
--- a/src/v8/test/mjsunit/harmony/bigint/comparisons.js
+++ b/src/v8/test/mjsunit/harmony/bigint/comparisons.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --harmony-bigint
+// Flags: --allow-natives-syntax
 
 'use strict'
 
@@ -297,18 +297,6 @@
   assertTrue(Reflect.defineProperty(obj, 'foo', {value: zero}));
   assertTrue(Reflect.defineProperty(obj, 'foo', {value: another_zero}));
   assertFalse(Reflect.defineProperty(obj, 'foo', {value: one}));
-}{
-  assertTrue(%SameValue(zero, zero));
-  assertTrue(%SameValue(zero, another_zero));
-
-  assertFalse(%SameValue(zero, +0));
-  assertFalse(%SameValue(zero, -0));
-
-  assertFalse(%SameValue(+0, zero));
-  assertFalse(%SameValue(-0, zero));
-
-  assertTrue(%SameValue(one, one));
-  assertTrue(%SameValue(one, another_one));
 }
 
 // SameValueZero
@@ -351,18 +339,6 @@
 
   assertTrue(new Map([[one, 42]]).has(one));
   assertTrue(new Map([[one, 42]]).has(another_one));
-}{
-  assertTrue(%SameValueZero(zero, zero));
-  assertTrue(%SameValueZero(zero, another_zero));
-
-  assertFalse(%SameValueZero(zero, +0));
-  assertFalse(%SameValueZero(zero, -0));
-
-  assertFalse(%SameValueZero(+0, zero));
-  assertFalse(%SameValueZero(-0, zero));
-
-  assertTrue(%SameValueZero(one, one));
-  assertTrue(%SameValueZero(one, another_one));
 }
 
 // Abstract comparison
@@ -429,8 +405,8 @@
   assertFalse(%Equal("-0x1", minus_one));
 
   const unsafe = "9007199254740993";  // 2**53 + 1
-  assertTrue(%GreaterThan(BigInt.parseInt(unsafe), unsafe));
-  assertTrue(%LessThan(unsafe, BigInt.parseInt(unsafe)));
+  assertFalse(%GreaterThan(eval(unsafe + "n"), unsafe));
+  assertFalse(%LessThan(unsafe, eval(unsafe + "n")));
 
   assertThrows(() => %LessThan(six, Symbol(6)), TypeError);
   assertThrows(() => %LessThan(Symbol(6), six), TypeError);
@@ -508,10 +484,10 @@
   assertFalse("-0x1" <= minus_one);
 
   const unsafe = "9007199254740993";  // 2**53 + 1
-  assertFalse(BigInt.parseInt(unsafe) < unsafe);
-  assertFalse(BigInt.parseInt(unsafe) <= unsafe);
-  assertTrue(unsafe < BigInt.parseInt(unsafe));
-  assertTrue(unsafe <= BigInt.parseInt(unsafe));
+  assertFalse(eval(unsafe + "n") < unsafe);
+  assertTrue(eval(unsafe + "n") <= unsafe);
+  assertFalse(unsafe < eval(unsafe + "n"));
+  assertTrue(unsafe <= eval(unsafe + "n"));
 
   assertThrows(() => six < Symbol(6), TypeError);
   assertThrows(() => six <= Symbol(6), TypeError);
diff --git a/src/v8/test/mjsunit/harmony/bigint/dataview.js b/src/v8/test/mjsunit/harmony/bigint/dataview.js
new file mode 100644
index 0000000..bad56d2
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/bigint/dataview.js
@@ -0,0 +1,86 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var buffer = new ArrayBuffer(64);
+var dataview = new DataView(buffer, 8, 24);
+var bytes = new Uint8Array(buffer);
+
+var b1 = 0xff1234567890abcdefn;
+var b1_64 = BigInt.asUintN(64, b1);
+
+dataview.setBigInt64(8, b1);
+assertEquals(0x12, bytes[16]);
+assertEquals(0x34, bytes[17]);
+assertEquals(0x56, bytes[18]);
+assertEquals(0x78, bytes[19]);
+assertEquals(0x90, bytes[20]);
+assertEquals(0xab, bytes[21]);
+assertEquals(0xcd, bytes[22]);
+assertEquals(0xef, bytes[23]);
+assertEquals(b1_64, dataview.getBigInt64(8));
+
+dataview.setBigInt64(8, b1, true);  // Little-endian.
+assertEquals(0xef, bytes[16]);
+assertEquals(0xcd, bytes[17]);
+assertEquals(0xab, bytes[18]);
+assertEquals(0x90, bytes[19]);
+assertEquals(0x78, bytes[20]);
+assertEquals(0x56, bytes[21]);
+assertEquals(0x34, bytes[22]);
+assertEquals(0x12, bytes[23]);
+assertEquals(b1_64, dataview.getBigInt64(8, true));
+
+dataview.setBigUint64(8, b1);
+assertEquals(0x12, bytes[16]);
+assertEquals(0x34, bytes[17]);
+assertEquals(0x56, bytes[18]);
+assertEquals(0x78, bytes[19]);
+assertEquals(0x90, bytes[20]);
+assertEquals(0xab, bytes[21]);
+assertEquals(0xcd, bytes[22]);
+assertEquals(0xef, bytes[23]);
+assertEquals(b1_64, dataview.getBigUint64(8));
+
+dataview.setBigUint64(8, b1, true);  // Little-endian.
+assertEquals(0xef, bytes[16]);
+assertEquals(0xcd, bytes[17]);
+assertEquals(0xab, bytes[18]);
+assertEquals(0x90, bytes[19]);
+assertEquals(0x78, bytes[20]);
+assertEquals(0x56, bytes[21]);
+assertEquals(0x34, bytes[22]);
+assertEquals(0x12, bytes[23]);
+assertEquals(b1_64, dataview.getBigUint64(8, true));
+
+var b2 = -0x76543210fedcba98n;
+dataview.setBigInt64(8, b2, true);
+assertEquals(0x68, bytes[16]);
+assertEquals(0x45, bytes[17]);
+assertEquals(0x23, bytes[18]);
+assertEquals(0x01, bytes[19]);
+assertEquals(0xef, bytes[20]);
+assertEquals(0xcd, bytes[21]);
+assertEquals(0xab, bytes[22]);
+assertEquals(0x89, bytes[23]);
+assertEquals(b2, dataview.getBigInt64(8, true));
+assertEquals(0x89abcdef01234568n, dataview.getBigUint64(8, true));
+
+var b3 = -0x8000000000000000n; // The int64_t minimum value.
+dataview.setBigInt64(8, b3);
+assertEquals(b3, dataview.getBigInt64(8));
+assertEquals(-b3, dataview.getBigUint64(8));
+
+var b4 = 0x8000000000000000n;
+dataview.setBigInt64(8, b4);
+assertEquals(-b4, dataview.getBigInt64(8));
+assertEquals(b4, dataview.getBigUint64(8));
+
+assertThrows(() => dataview.setBigInt64(0, 1), TypeError);
+assertThrows(() => dataview.setBigUint64(0, 1), TypeError);
+assertThrows(() => dataview.setInt32(0, 1n), TypeError);
+assertThrows(() => dataview.setUint32(0, 1n), TypeError);
+
+// None of the stores wrote out of bounds.
+for (var i = 0; i < 16; i++) assertEquals(0, bytes[i]);
+for (var i = 24; i < 64; i++) assertEquals(0, bytes[i]);
diff --git a/src/v8/test/mjsunit/harmony/bigint/dec.js b/src/v8/test/mjsunit/harmony/bigint/dec.js
index 5e1f40b..36ca219 100644
--- a/src/v8/test/mjsunit/harmony/bigint/dec.js
+++ b/src/v8/test/mjsunit/harmony/bigint/dec.js
@@ -4,77 +4,74 @@
 
 // Generated by tools/bigint-tester.py.
 
-// Flags: --harmony-bigint
-
 var data = [{
-  a: "-609648ccf253976b12f6b6c8e20790c17ef6b89ea9f536267783607cf465b1ca",
-  r: "-609648ccf253976b12f6b6c8e20790c17ef6b89ea9f536267783607cf465b1cb"
+  a: 0x26ffcdbd233a53e7ca4612f2b02e1f2c1d885c3177e7n,
+  r: 0x26ffcdbd233a53e7ca4612f2b02e1f2c1d885c3177e6n
 }, {
-  a: "-6e4c39cdd2c666e32cf2fd3c53a20eeb725e7578af97d42",
-  r: "-6e4c39cdd2c666e32cf2fd3c53a20eeb725e7578af97d43"
+  a: 0xf2a29a35193377a223ef0d6d98db95eeb24a4165f288fd2b4an,
+  r: 0xf2a29a35193377a223ef0d6d98db95eeb24a4165f288fd2b49n
 }, {
-  a: "34c93e1c",
-  r: "34c93e1b"
+  a: 0x454d22e29e6104n,
+  r: 0x454d22e29e6103n
 }, {
-  a: "-db3032",
-  r: "-db3033"
+  a: -0xb00874640d30e6fce6bf79508378ed17e44dacb48a4200bce536cec462b3c2n,
+  r: -0xb00874640d30e6fce6bf79508378ed17e44dacb48a4200bce536cec462b3c3n
 }, {
-  a: "8e658ffacbefbdec5",
-  r: "8e658ffacbefbdec4"
+  a: 0x4c151a24d765249c2bab4a1915b24b80ae437417c5n,
+  r: 0x4c151a24d765249c2bab4a1915b24b80ae437417c4n
 }, {
-  a: "-d321033ec94d6a75f",
-  r: "-d321033ec94d6a760"
+  a: -0xcbd476b1f9ca08ff820941n,
+  r: -0xcbd476b1f9ca08ff820942n
 }, {
-  a: "-286017f718d6118b581ec4357e456ce6d12c01aed9a32ff0cc048d",
-  r: "-286017f718d6118b581ec4357e456ce6d12c01aed9a32ff0cc048e"
+  a: -0xe848e5830fa1035322b39c2cdd031109ca8n,
+  r: -0xe848e5830fa1035322b39c2cdd031109ca9n
 }, {
-  a: "c0",
-  r: "bf"
+  a: -0x4d58c5e190f0ebac5bb36ca4d214069f69726c63a5n,
+  r: -0x4d58c5e190f0ebac5bb36ca4d214069f69726c63a6n
 }, {
-  a: "9f9577e008a6f46f7709f71362176ebe23d19eb9e58a41de6f2631b18f2ca",
-  r: "9f9577e008a6f46f7709f71362176ebe23d19eb9e58a41de6f2631b18f2c9"
+  a: 0x9b396n,
+  r: 0x9b395n
 }, {
-  a: "-9d4294590df0aa8ea46a5c2a3d186a6afcc00c6ebb072752",
-  r: "-9d4294590df0aa8ea46a5c2a3d186a6afcc00c6ebb072753"
+  a: 0x593921fe8b9d4906cn,
+  r: 0x593921fe8b9d4906bn
 }, {
-  a: "-4bc2aed1641151db908c0eb21aa46d8b406803dc0f71d66671322d59babf10c2",
-  r: "-4bc2aed1641151db908c0eb21aa46d8b406803dc0f71d66671322d59babf10c3"
+  a: -0xe127928c7cecd6e9ca94d98e858f9c76a0fccac62203aac7710cef1f9e352n,
+  r: -0xe127928c7cecd6e9ca94d98e858f9c76a0fccac62203aac7710cef1f9e353n
 }, {
-  a: "-1dfb3929632fbba39f60cabdc27",
-  r: "-1dfb3929632fbba39f60cabdc28"
+  a: 0xeb14cd952d06eb6fc613016f73b7339cbdd010n,
+  r: 0xeb14cd952d06eb6fc613016f73b7339cbdd00fn
 }, {
-  a: "c0d409943c093aec43ba99a33ef2bb54574ecdc7cccf6547ab44eafb27",
-  r: "c0d409943c093aec43ba99a33ef2bb54574ecdc7cccf6547ab44eafb26"
+  a: -0xfdeab6a3dbd603137f680413fecc9e1c80n,
+  r: -0xfdeab6a3dbd603137f680413fecc9e1c81n
 }, {
-  a: "3d148dcffe94f859c80b38c4",
-  r: "3d148dcffe94f859c80b38c3"
+  a: -0x7e9abbdfad170df2129dae8e15088a02b9ba99276a351a05n,
+  r: -0x7e9abbdfad170df2129dae8e15088a02b9ba99276a351a06n
 }, {
-  a: "0",
-  r: "-1"
+  a: 0x7b98f57n,
+  r: 0x7b98f56n
 }, {
-  a: "d659f6507e0ac2e653bdb7c3fb38c1514dd33619a9a0c87fcb69b22",
-  r: "d659f6507e0ac2e653bdb7c3fb38c1514dd33619a9a0c87fcb69b21"
+  a: -0x919751deb470faa60d7c5c995c8bed72f9542d710fbbf1341n,
+  r: -0x919751deb470faa60d7c5c995c8bed72f9542d710fbbf1342n
 }, {
-  a: "14efe",
-  r: "14efd"
+  a: -0xc5541d89b118a88afdd187228440427c8a24f9d9bn,
+  r: -0xc5541d89b118a88afdd187228440427c8a24f9d9cn
 }, {
-  a: "-f2df301948cd17ff391a6589a67551c00679687ba5",
-  r: "-f2df301948cd17ff391a6589a67551c00679687ba6"
+  a: -0xe6c88a170595fn,
+  r: -0xe6c88a1705960n
 }, {
-  a: "-e",
-  r: "-f"
+  a: -0xa1ffbfa388c332804dc4dc973n,
+  r: -0xa1ffbfa388c332804dc4dc974n
 }, {
-  a: "-a09cf77fea7af1767695c978af13fdb62f4f040b6fb803625fb124cc99139cddadd",
-  r: "-a09cf77fea7af1767695c978af13fdb62f4f040b6fb803625fb124cc99139cddade"
+  a: 0x67b768ce0c415127a77402861d1901dd7f60a8624ebea6ecafe03adc3cen,
+  r: 0x67b768ce0c415127a77402861d1901dd7f60a8624ebea6ecafe03adc3cdn
 }];
 
 var error_count = 0;
 for (var i = 0; i < data.length; i++) {
   var d = data[i];
-  var a = BigInt.parseInt(d.a, 16);
-  var r = --a;
-  if (d.r !== r.toString(16)) {
-    print("Input:    " + a.toString(16));
+  var r = --d.a;
+  if (d.r !== r) {
+    print("Input:    " + d.a.toString(16));
     print("Result:   " + r.toString(16));
     print("Expected: " + d.r);
     error_count++;
diff --git a/src/v8/test/mjsunit/harmony/bigint/div.js b/src/v8/test/mjsunit/harmony/bigint/div.js
index 771a0c7..8b16714 100644
--- a/src/v8/test/mjsunit/harmony/bigint/div.js
+++ b/src/v8/test/mjsunit/harmony/bigint/div.js
@@ -4,99 +4,95 @@
 
 // Generated by tools/bigint-tester.py.
 
-// Flags: --harmony-bigint
-
 var data = [{
-  a: "c0bb18527ab19a800932cc14c553c69688372809dde38f095fdb99478a7eba",
-  b: "8137ebc482f361a3e43fb80fe2ba509caa3f0acc62be0d2",
-  r: "17dd3b8ecbdd71a4"
+  a: -0x1e0f357314bac34227333c0c2086430dae88cb538f161174888591n,
+  b: 0x390n,
+  r: -0x8700f00dd65d4009ab90c5d3a887e9c8ad110a72ca7e0f84a40n
 }, {
-  a: "10c5163e874c786fcfcb48bbb0ccf8d6c66f480b76332194",
-  b: "4e462b2",
-  r: "36d8ca96869a7226d456bff9b5ed3effdcaaf6f83"
+  a: 0x9b7a0098fd2d495b4b2c76ff5888ae2a0359cfec6b029e6f3ee9b014802n,
+  b: 0xbn,
+  r: 0xe225d252e49ef6563ecc4fff0c69b782ed99e89db2ec895bfe6b2ea974n
 }, {
-  a: "-677f8c8668fcc826129f2724a5b88a6225dd19959810b5254afbc0",
-  b: "-2bf8ff1c49636",
-  r: "25a8bd406d721554f45ad37cc691d58821ad163f3a"
+  a: 0x6821a6dad136b9f64096337b45d6d947cf0f0b55501e33e66fbc4ef9776n,
+  b: 0xan,
+  r: 0xa69c3e2ae8578ff06756b8c53c8af53fb1b1abbbb363863d7f93b18f25n
 }, {
-  a: "e80276ba7d416f4f7e5f8917529eb204cc7ed08413261e73aa23f169eb46e7162",
-  b: "-c884f07a",
-  r: "-12834073e7cbc44804a99cb2778fb82b098645946d5e4f5e6c47c49267"
+  a: 0xf42f96f0c7f5a9c656a66122a9bcc57aa386bdb9a834e4174d45795ae408dae14e085cn,
+  b: -0x5e0d81a1107ef9a38b4f24b4n,
+  r: -0x298a4d479eac8c186fd61939024b420080b6ae6500c70c1n
 }, {
-  a: "-f9a51f64ce995e0a1c7f8369a573dae2533bc3df801edbb79235d41502e1ce",
-  b: "-f33bf",
-  r: "106bf522569501704f9700d6bfcd203a606e63725e339e92ff931f568f"
+  a: 0xbaf7baed984dda3c20f23201f366257c601f7fbcaf51d8b738a68fd92b4n,
+  b: 0xd24a1eafcn,
+  r: 0xe39bd4d870d72880e6ad88ec17bcca6bd0eaacfbbd28ba7458n
 }, {
-  a: "-6c9ae08dfa5b11c29ae30e53c108d915e0e87f1a8ca82f42d23a53b08895",
-  b: "-43fd79afe1ae6a4994ee7dfc2c89453d6b6",
-  r: "198ecd667e8cca17c2839b38fe"
+  a: -0xa658d0683d450bfec3de3fe4253f4348dd8e9a5b1002f6c24ff0en,
+  b: -0xeffb9a6fa690e0be59aba488b7a7c5a85a65a018242n,
+  r: 0xb1730d7206n
 }, {
-  a: "-d20a2f7074ecbc776b64c2e04ff007e194b8cdd106b2be2e78d752f2d16e9",
-  b: "43eb8ae7d7f9be6d77e3be696ffef",
-  r: "-317ab1a09014950e1c53b9e3e8f44873c"
+  a: 0x5a65f7b2dace4550099f4009192caa513468ef4da7e2fd81n,
+  b: 0xf144f8bfad42d9beaf7b82a46561n,
+  r: 0x5feae36e8e4932adcb21n
 }, {
-  a: "-999e0f75f2f652d403840cea3536b1a522433a331dace7c39d7990b993908fdd6",
-  b: "cea1de74020232c6c4bedca49d63f140c",
-  r: "-be51ac62c073e7d7cb9e43fc12436bfe"
+  a: -0x87271b0cbb63eba5e3d70f6af1aa6ec60c0a7884fb8d657b03en,
+  b: -0xb67f8c18099ce8fa0c0f4ce2852b5590f7a8037d326b0n,
+  r: 0xbd9602n
 }, {
-  a: "1b49ac0c323436294f1471a3f00feb197b9b42549c3",
-  b: "5a7e30888a22fbbcecfe2a0b2e5eca30",
-  r: "4d321e8fe1c"
+  a: 0xd4bc42a434dba1427d387f0858aaf39c6281ffc0f10b8b0996cb3bfn,
+  b: -0x4198d1fec9b48e38d42f2e295abc39c2a6866527efn,
+  r: -0x33e39b6878d955n
 }, {
-  a: "-689adf0d332ed26c63f8f361d5cb66056321b683ce87c60567df7305396f20d6ab8",
-  b: "82f3b92f5bb57811fdb66f519",
-  r: "-cc7e64b9ef239ac4c31b6ae3687aa181bda7657222"
+  a: 0x6a6f0c97d974dfd20337ca611dbdc96433964a206d54n,
+  b: 0x16c7c6f9e0e4e24d521e463fecb394e2936f3104590n,
+  r: 0x4an
 }, {
-  a: "-6fecb457f9e05c15b7fe038494c25053938d4747a01577cf2dc939a21e",
-  b: "b7cb6ce62c1d7483d0b675109f5782a1ad19",
-  r: "-9be52d2e94716bb441dbcd"
+  a: -0xd09af7515272d81a64307afaed8854c8e2996d8e01d4864n,
+  b: 0x7521dfcbdf4cfbbf8d3859bf67618c91dc6915718303dbn,
+  r: -0x1cn
 }, {
-  a: "f96f8276f314d37657ce7774bc539198ee84fcec8a53cbb3d36ad81040b715",
-  b: "-891c9a0dd99b02",
-  r: "-1d1b803e3484173c0d2e8add5042117eaa27c853c222f5fdd"
+  a: 0xf0da5f24832a2b651aac5dff62b22475212c26e123ff78c34560f35e9bcn,
+  b: -0xf9n,
+  r: -0xf79fbd51bf65f518c82563b974e4632b505ebe13adbfb6c297859a98cn
 }, {
-  a: "-d2c9a9068d57f2ebc9ad432b48b4135f2a911519d4b791",
-  b: "-a34d124b5b4825d314683098d0",
-  r: "14a715b96671307438926"
+  a: 0x76f4f5b5de8a263514554d62273e51f40342d5df692ae17625ead5b5fen,
+  b: -0xa5e697c57fb65858604e0a060737e7d9d1en,
+  r: -0xb78fb2167de210959e57cd3n
 }, {
-  a: "-59593d55f61c1c739601e15624fe2e61592fe6abf1ecb238c9f8e1a7bded9c1bd1c",
-  b: "f067a5a155fc894b0f7f0a939f1772c4d135a",
-  r: "-5f250867331e7eff64dafcd58e9922"
+  a: -0xa714d4d9d747fa5258f80f3887f4dda8a11423050046282n,
+  b: -0xaa3b218ab92e21920a707487fdbn,
+  r: 0xfb437487ba8580181ca3n
 }, {
-  a: "2c0a3172494623013ba14d01433ad38167f365765b1c0ca610",
-  b: "ffe8",
-  r: "2c0e52ca0c37483000215020c64d6ac36a455bf6fa4382"
+  a: -0x165f3c659ac4157cb3af081b3fc42c0c788e2df501596c2b8n,
+  b: -0xfaa86d6eca3n,
+  r: 0x16d94bce4865cf842d17a399d8b4467f3f369fn
 }, {
-  a: "-a9cde7cdfe56eb8bd6777543ae714fadac2d97a394d8e9e8",
-  b: "104b0d7135d3d2",
-  r: "-a6bfb9031e60b5bc4b20e814cabfd80bd27"
+  a: 0x268d93a21aab44c52f961b1c97c002f427eb8b11e0707e3879c3a348f8e2b1c40c122n,
+  b: 0x70ccda2e2bba53b124c877bb4edbdbd387742cfe59d9bn,
+  r: 0x577effaeb2338647e38edb43n
 }, {
-  a: "6216ceed0d221476bfba7701f8297af56a4e66d003f8165b",
-  b: "bfcaaf8676ad6a",
-  r: "82ed6efc83669b0bc476bdd717dcfb6f10"
+  a: 0x3a13493c9e8d3d986a2a56c0aa811be408e1560f30ae155n,
+  b: -0x62a1a35fd7e184be45a1d0ba67888f0d982afb7a90an,
+  r: -0x96bcn
 }, {
-  a: "-707752a899efbe8989d205293535a404a6afb39cf21ce1274",
-  b: "-3a24848be1024a6ea901f",
-  r: "1ef2f2a8c0ad85ff4e6e6afdd3966"
+  a: -0x2a3f3f90ea280bf64e7e460f004ea4fb2553637cb7c844f349f045ffdbn,
+  b: -0xf2af2581bddfd9bfc1158c86211c4f4b169c0b1n,
+  r: 0x2c90ab8577b8d0ee86en
 }, {
-  a: "-e662fb8c46f979ff3b3f576fffd5c51cf70071ab61168b2eafee4708af",
-  b: "964c4dd019b9a543df0cd1830a90428ec84ec04f8165283",
-  r: "-18869d87ce54"
+  a: 0x8fd5f992d4d767c8a360ad32142fa9e9d87bc0036d1d6bb7aa7471dd7f38bn,
+  b: 0xe70n,
+  r: 0x9f6709805e05fd8b3c433e470387f06391b6948459e4c2bc072747e2a0n
 }, {
-  a: "b4403dee3a192009a5aae85c74efdb52b66dee1be6befa66f708ca9bf6b7",
-  b: "-36db9f9f6e",
-  r: "-34928ce65c2b71a6b6ce351838d4263d91ff2bceecec7a91441"
+  a: 0x52c0e08ba0a22a00498058dfeeaab2b21909e81e30c48652699n,
+  b: 0x1d516c96827an,
+  r: 0x2d2967f58654a5d30934348b225bf2b6e2a3123dn
 }];
 
 var error_count = 0;
 for (var i = 0; i < data.length; i++) {
   var d = data[i];
-  var a = BigInt.parseInt(d.a, 16);
-  var b = BigInt.parseInt(d.b, 16);
-  var r = a / b;
-  if (d.r !== r.toString(16)) {
-    print("Input A:  " + a.toString(16));
-    print("Input B:  " + b.toString(16));
+  var r = d.a / d.b;
+  if (d.r !== r) {
+    print("Input A:  " + d.a.toString(16));
+    print("Input B:  " + d.b.toString(16));
     print("Result:   " + r.toString(16));
     print("Expected: " + d.r);
     print("Op: /");
diff --git a/src/v8/test/mjsunit/harmony/bigint/exp.js b/src/v8/test/mjsunit/harmony/bigint/exp.js
index 5a46011..7fbc2dc 100644
--- a/src/v8/test/mjsunit/harmony/bigint/exp.js
+++ b/src/v8/test/mjsunit/harmony/bigint/exp.js
@@ -2,7 +2,16 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --harmony-bigint
+// Flags: --allow-natives-syntax
+
+assertEquals(1n, (-1n) ** 0n);
+assertEquals(-1n, (-1n) ** 1n);
+assertEquals(1n, (-1n) ** 2n);
+assertEquals(-1n, (-1n) ** 3n);
+assertEquals(1n, (-1n) ** 4n);
+// Multi-digit exponents.
+assertEquals(1n, (-1n) ** (2n ** 80n));
+assertEquals(-1n, (-1n) ** ((2n ** 80n) + 1n));
 
 assertEquals(1n, 0n ** 0n);
 assertEquals(0n, 0n ** 1n);
diff --git a/src/v8/test/mjsunit/harmony/bigint/inc.js b/src/v8/test/mjsunit/harmony/bigint/inc.js
index 64865a2..7842600 100644
--- a/src/v8/test/mjsunit/harmony/bigint/inc.js
+++ b/src/v8/test/mjsunit/harmony/bigint/inc.js
@@ -4,77 +4,74 @@
 
 // Generated by tools/bigint-tester.py.
 
-// Flags: --harmony-bigint
-
 var data = [{
-  a: "-989c298c6fc3",
-  r: "-989c298c6fc2"
+  a: 0xb3df90n,
+  r: 0xb3df91n
 }, {
-  a: "bff2c86c449a56",
-  r: "bff2c86c449a57"
+  a: 0xaacd53fc9545eb394304a3c69caba730230a6527730an,
+  r: 0xaacd53fc9545eb394304a3c69caba730230a6527730bn
 }, {
-  a: "-6fb15264369b63e3b92d6f74458140d4b62a56ecbfca000492b6b8a0c56c651ebaecdd1",
-  r: "-6fb15264369b63e3b92d6f74458140d4b62a56ecbfca000492b6b8a0c56c651ebaecdd0"
+  a: 0x32efa4ba1c29098be7df8fa0f3c74a183612ecn,
+  r: 0x32efa4ba1c29098be7df8fa0f3c74a183612edn
 }, {
-  a: "e161f6284b91fa2646dc0f162c575bb8a0d0f5bfee26748b7181413567",
-  r: "e161f6284b91fa2646dc0f162c575bb8a0d0f5bfee26748b7181413568"
+  a: -0xcabed06f63ad50406b96187208cf9ec6faf46413ce83e280c31ben,
+  r: -0xcabed06f63ad50406b96187208cf9ec6faf46413ce83e280c31bdn
 }, {
-  a: "-4d073653cc812",
-  r: "-4d073653cc811"
+  a: -0x8a40ce58f753466f4008faa0814e76d9b594908df0e42cf6ad4a781e60ce2n,
+  r: -0x8a40ce58f753466f4008faa0814e76d9b594908df0e42cf6ad4a781e60ce1n
 }, {
-  a: "-ce31549364717dea9d1bf30baed642f",
-  r: "-ce31549364717dea9d1bf30baed642e"
+  a: -0x848c8fc23bc93801n,
+  r: -0x848c8fc23bc93800n
 }, {
-  a: "2ae123a62361f1de2cc5ca9cfd9658f47d",
-  r: "2ae123a62361f1de2cc5ca9cfd9658f47e"
+  a: -0x13a8316c5af3f3b06aab6642e717a7bdn,
+  r: -0x13a8316c5af3f3b06aab6642e717a7bcn
 }, {
-  a: "-4820298153b7bbd86337ad72e0d1ac7448de99bc6ce4c43c2",
-  r: "-4820298153b7bbd86337ad72e0d1ac7448de99bc6ce4c43c1"
+  a: -0x5f5e517cf7efe577cd689c36d1beb3d9df4cfdc3fcb55ed9e9d8fan,
+  r: -0x5f5e517cf7efe577cd689c36d1beb3d9df4cfdc3fcb55ed9e9d8f9n
 }, {
-  a: "2e",
-  r: "2f"
+  a: 0n,
+  r: 0x1n
 }, {
-  a: "-8f3b598ac2ab8a78a2d3e1f7ab1124b05a830aa1261bf57d8de2a",
-  r: "-8f3b598ac2ab8a78a2d3e1f7ab1124b05a830aa1261bf57d8de29"
+  a: 0x107d5ec8048c4d715e213ec74f9f04006d3f2d90dd95d17c3e82f7a4ccn,
+  r: 0x107d5ec8048c4d715e213ec74f9f04006d3f2d90dd95d17c3e82f7a4cdn
 }, {
-  a: "-5c070fdee0d3f4a9adc63",
-  r: "-5c070fdee0d3f4a9adc62"
+  a: 0xb8e09fc6037a75bbfn,
+  r: 0xb8e09fc6037a75bc0n
 }, {
-  a: "-3700cd6a6d1e68de1",
-  r: "-3700cd6a6d1e68de0"
+  a: 0x515d1b999660074184n,
+  r: 0x515d1b999660074185n
 }, {
-  a: "56c68c",
-  r: "56c68d"
+  a: 0xe12def67dc33628638612b8137d0fa425ea2dn,
+  r: 0xe12def67dc33628638612b8137d0fa425ea2en
 }, {
-  a: "-1ab894376fcf0dab9c",
-  r: "-1ab894376fcf0dab9b"
+  a: 0x96a9n,
+  r: 0x96aan
 }, {
-  a: "-937dcf37c57588e55260c3eea20318",
-  r: "-937dcf37c57588e55260c3eea20317"
+  a: -0x9df122a299a5e65b275028n,
+  r: -0x9df122a299a5e65b275027n
 }, {
-  a: "-f8ee63b438580a8915baf84edcfd0688247905e593e153644a88761bab0",
-  r: "-f8ee63b438580a8915baf84edcfd0688247905e593e153644a88761baaf"
+  a: 0x20dd05bfb5ed6ebfb05da9a7488800b8895fbfe6d709eecb6071cda73e13n,
+  r: 0x20dd05bfb5ed6ebfb05da9a7488800b8895fbfe6d709eecb6071cda73e14n
 }, {
-  a: "-c63d4353ddf575bf02",
-  r: "-c63d4353ddf575bf01"
+  a: 0xb38294d2e5523534c56dd6ef38ba744b29e3a3bb6f863f1aeaen,
+  r: 0xb38294d2e5523534c56dd6ef38ba744b29e3a3bb6f863f1aeafn
 }, {
-  a: "-bef439cc990a8b1d69b80fa7b3c703ba2",
-  r: "-bef439cc990a8b1d69b80fa7b3c703ba1"
+  a: -0x6b58de4ba9b2699ea6777dc1adc0b2486n,
+  r: -0x6b58de4ba9b2699ea6777dc1adc0b2485n
 }, {
-  a: "6007edbd20b0ba90d86cf80e871e898c8907bb37",
-  r: "6007edbd20b0ba90d86cf80e871e898c8907bb38"
+  a: 0xf40028a48894df5d81131046477a22e55cbead5n,
+  r: 0xf40028a48894df5d81131046477a22e55cbead6n
 }, {
-  a: "-692b36b5e874a448415678ac2b4d0a61c75bdc1674ae14d753cad7d46846",
-  r: "-692b36b5e874a448415678ac2b4d0a61c75bdc1674ae14d753cad7d46845"
+  a: -0x44cbe6c7f5e7e879d3cb2eaffc4af0a43affc094218031a1f123746549dd7b8cdcbdn,
+  r: -0x44cbe6c7f5e7e879d3cb2eaffc4af0a43affc094218031a1f123746549dd7b8cdcbcn
 }];
 
 var error_count = 0;
 for (var i = 0; i < data.length; i++) {
   var d = data[i];
-  var a = BigInt.parseInt(d.a, 16);
-  var r = ++a;
-  if (d.r !== r.toString(16)) {
-    print("Input:    " + a.toString(16));
+  var r = ++d.a;
+  if (d.r !== r) {
+    print("Input:    " + d.a.toString(16));
     print("Result:   " + r.toString(16));
     print("Expected: " + d.r);
     error_count++;
diff --git a/src/v8/test/mjsunit/harmony/bigint/json.js b/src/v8/test/mjsunit/harmony/bigint/json.js
index eb0eefc..cf39223 100644
--- a/src/v8/test/mjsunit/harmony/bigint/json.js
+++ b/src/v8/test/mjsunit/harmony/bigint/json.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --harmony-bigint
+// Flags: --allow-natives-syntax
 
 'use strict'
 
diff --git a/src/v8/test/mjsunit/harmony/bigint/misc.js b/src/v8/test/mjsunit/harmony/bigint/misc.js
new file mode 100644
index 0000000..1a11547
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/bigint/misc.js
@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Create BigInt in large object space for which MakeImmutable reduces the
+// length.
+const x = 2n ** (2n ** 22n);
+assertEquals(1n, x - (x - 1n));
diff --git a/src/v8/test/mjsunit/harmony/bigint/mod.js b/src/v8/test/mjsunit/harmony/bigint/mod.js
index c310e2d..01f64ad 100644
--- a/src/v8/test/mjsunit/harmony/bigint/mod.js
+++ b/src/v8/test/mjsunit/harmony/bigint/mod.js
@@ -4,99 +4,95 @@
 
 // Generated by tools/bigint-tester.py.
 
-// Flags: --harmony-bigint
-
 var data = [{
-  a: "-67c2a5ba4221c048b64ecca6dd979391c44296b8b87ce97584ebab03be18",
-  b: "-bebdbd9b278d05704416fd87d09aece9b69f98843",
-  r: "-8794ba5d9204eb8adfb5e44c11a65fe5af057e6a4"
+  a: 0xaed3c714bb42a73d708bcf1dc9a9deebadc913ef42bac6a6178a60n,
+  b: -0xf3d6bd1c059b79n,
+  r: 0x2a4f893c8ece3n
 }, {
-  a: "-843cfbe576106b8e7c0aabec2cde402e7f76a711dbbf6ae79d6d932e22cf",
-  b: "553d800ffcf69f80026",
-  r: "-272250d344908c21525"
+  a: -0x8a6d8cb8e32aba50e08fd50aecbda6821e1863bf9a2n,
+  b: 0xe19ab8530bce542ec6b4c848fc383a2b688f07976dd523dabn,
+  r: -0x8a6d8cb8e32aba50e08fd50aecbda6821e1863bf9a2n
 }, {
-  a: "-b5fc9e8e21fbad798bcd3571ab169dd5e2059d1a9aa4d1bf44fe18da725b",
-  b: "-da5d287414fbb2b4b",
-  r: "-2610eb2277e01a758"
+  a: 0x7cd19a308b217ddd9dcda69ebe37767f09a483cb87060314aeade6f6c619d27c3n,
+  b: 0xae30b5c754e0an,
+  r: 0x619154797565dn
 }, {
-  a: "a9c92d42b53a6fbf0824f5b7bd9ed1cab1f9419d7ec2b50f192abfa6d620d53",
-  b: "9de30592e1fe27d26afe06bbb4781c77ef58418",
-  r: "9a67af5868a619a48883aed4c0d0a876e2ce143"
+  a: -0xaa90d777e849974d7ebebd2ed76dce635e36713e9e0c97cen,
+  b: 0xcc2bc7239bf83ecafc74b25750981df258n,
+  r: -0xa32d47bc250c5a41d147a862099778685en
 }, {
-  a: "ffa271b138163a779c89f17aa720490854520120b1307ef",
-  b: "ab27ef49f3a00085981a5bc1c13530aec35e29c",
-  r: "4c49a63b98d2dd7a33a843f98ba82b54909e337"
+  a: 0x7386178fe1159c4ca3c4e5caa6eda4413926047efd22007931c22ab54bn,
+  b: 0xc05100caa704bca144n,
+  r: 0x55ead7f83d4a795753n
 }, {
-  a: "d43f739464bcc8643dfaa807cbbe1157189e33368dd19b800db3682bb0dcb73",
-  b: "bf66b1dc93054920039f9b3eba688d9",
-  r: "bb2f3000959d66b3962d755d141c3ac"
+  a: -0xa48867cf46692351a59bc89c0ddc9a6d2cd9f72578c0bab72d8389n,
+  b: 0x77c2eec6cc0bef33dd4756b223c35a0f2b528f8648a7n,
+  r: -0x184a6eed8fcd32399c59605c7255b5614b388be24b44n
 }, {
-  a: "111ae5ba62ec37fd157ef531195363c5c8ace4427ff58811746af94ab8",
-  b: "58112d0d88f3c8722d1e28942e8949c433c4619b451",
-  r: "283276aa2b6316ca2146b1e6bcc8aa8de4b5446847a"
+  a: 0xac7681c26f78191107c9cde47f984fc7ffb7bffd0a055fc14n,
+  b: -0xe2d91d1a0e1edc3f806a24c36f7ca0a8a9b44b66c9n,
+  r: 0xdf0b3460335089fca0b1da676b3d1e9caf15afd3den
 }, {
-  a: "-4609a1c7d563bbdb49fd01e05031395e6e06b78407e440",
-  b: "-75ee71f85344163bae2ba0e438",
-  r: "-68b517938971cb261babea1cf8"
+  a: -0x3035011f4adba0c032ddc2fc884ff7663b45cb3baebec0fn,
+  b: 0xcc27f9a21470911a61aae50ae118ebcf85ea4dn,
+  r: -0xc5ea1db5af95ccdce2844b13b82659be1ac2adn
 }, {
-  a: "292cd2c5eb3e80942066c5af8bfdaf8d1d091f61f3005d226318",
-  b: "5",
-  r: "3"
+  a: -0x2dbe79c42b1e8db7aea4ca9cfaf1350528b096e23f69ea322cn,
+  b: -0x82f7e4f2ee432485n,
+  r: -0x824bddbaf61ce383n
 }, {
-  a: "-a9f8c03f06200b54959a2ced325090be25417f0bf1274d",
-  b: "13eb3a0c772fc98e537883a3ef72e1ee37b249ee17c0510",
-  r: "-a9f8c03f06200b54959a2ced325090be25417f0bf1274d"
+  a: 0xc5c7fbeb60fdb9f8e8347ebf9fe303e3223394b2db93ce2n,
+  b: 0xcd988b4cb278a39fd3ae58c16616855f01fab0fb0n,
+  r: 0xc3b5157e680c8ca66df1bd640c6ad1601bd612b02n
 }, {
-  a: "c4ddadae9abee150068fe6536c6b2fe229070410da61a09abe1a7270b",
-  b: "5f4d55e3345e37fe8887f3ca5e",
-  r: "42eea65dd545aacdcd250b505b"
+  a: 0x73dd1e27450edb450fe4bd70494a8ad85a8ad9691bc40bf500a1n,
+  b: 0xc8fb467f71be8a6b965d21857ecfdn,
+  r: 0x646e6d9fa1e2eb2933b2e5a837d37n
 }, {
-  a: "-7a73d61e639dacedd207dfe1edc630b1dfda9078489a7f0cf79dcdfcbf3992efc13861f",
-  b: "-c0f2b9045bb3865d89cc0c9920c3ccfae382c250",
-  r: "-6bdc3d5943d7a35e4ecbc5c8deb335ca2c3bbc0f"
+  a: -0xecb217583ec4240399bfa34560b45f1fd08efd0ebb56b2dn,
+  b: 0xeba34abn,
+  r: -0xc2d347bn
 }, {
-  a: "-a9ac4a2e055f22c8ba7956ffca5457a71412eb74d3a180555bb25ce5096e23d6c619",
-  b: "-f3c",
-  r: "-a5d"
+  a: 0x29c8a9854802b9317b90683eb82609b3aa695598807fea0482a56567n,
+  b: -0xabe5e55b228f8n,
+  r: 0x52303615b525fn
 }, {
-  a: "-b16cfd7fbbf820afc77be1590fd9802ecd12059238b98bb96d9d215af4808",
-  b: "2c288a9de167",
-  r: "-2b3901c1b8d1"
+  a: 0x7b532ee90b3945dbed20180632f46c90d0edb558e39456103f50e5a74ff1dn,
+  b: 0x17n,
+  r: 0x6n
 }, {
-  a: "-df12dd3e56dc3c3dd769ad964f8356a5860177f1b4a3b95acc75",
-  b: "4ec6f5474b18",
-  r: "-17bf0980582d"
+  a: -0x6f1dbf8dedea796a2423fad9688d71340963da3a4f005f13e9cd4aa03b96c864552cn,
+  b: -0x408a4f36ec4a1b74642fb0a4559en,
+  r: -0x33c06c53e6e47ca87f36447f1b0n
 }, {
-  a: "1d197bf4aa09a02760cb004e9edf25e6591ae14d92b6cbf1349ea1c040d66",
-  b: "-23ebacc5f380e5649a1234c3ed050472569cbcd056",
-  r: "20e5e588b4861be3ec7b4005a6a50566e60a3a4364"
+  a: -0xe77508ff49bc76c78678676ca1edc82eb167f3b07d3208d89d26582ef74d60n,
+  b: -0xf005fb1a8b29035c72980abe4a0715c90n,
+  r: -0x159e8c7616079663b4e12765a05cc6d40n
 }, {
-  a: "fab19b7e774bf33bb42a7af90d8dc75cbc927e3225003610c05b117c25c90944d",
-  b: "-3b433469282a54d46cac",
-  r: "10eda9e98b721b4a2505"
+  a: 0x626749ef019017f53b2c686f26594e6d3c5f247cf0ed7024cca277n,
+  b: 0x5bd931ea8c6939115ad69f6ce3c6bbc300320n,
+  r: 0x3a4b041c36d0a45ef932745eab473943b1a97n
 }, {
-  a: "5b19514660782d3a2429d7791659868abb9d8fc96077247",
-  b: "-59188be60",
-  r: "2340c3607"
+  a: -0x960dde134b881d3366d659c7d8c3eb6346f50c08c6f78en,
+  b: -0xc9e7fa60f6ce1997012f5a6164138447fa248754985905dc6n,
+  r: -0x960dde134b881d3366d659c7d8c3eb6346f50c08c6f78en
 }, {
-  a: "-2884ed1401b5e976be7dc1faf7bffb632c808649fa75ab458cc66ef4e75",
-  b: "bf",
-  r: "-40"
+  a: 0x702dc0033e09e9e58ec3fc96f861587ad13cea1ed7b7eb301n,
+  b: 0x71f0c97687b4f3318be2fe54b90273n,
+  r: 0x4e1859254ac1d42f7c812decef00a3n
 }, {
-  a: "-4c9cdf26be1797e54480ab20797e35d04941c11ff78b040c00099422cec",
-  b: "ee20f34835529f4a73",
-  r: "-e24db40426d47f968b"
+  a: 0x39376649769a0abb26133deee934330ef21a2f90ea89476569630021af6023235n,
+  b: -0x4aaaec4085f65ccc9d547beb122160afcbb3n,
+  r: 0x3027d5ebb37c5aa438f11dfcafa3b003b91bn
 }];
 
 var error_count = 0;
 for (var i = 0; i < data.length; i++) {
   var d = data[i];
-  var a = BigInt.parseInt(d.a, 16);
-  var b = BigInt.parseInt(d.b, 16);
-  var r = a % b;
-  if (d.r !== r.toString(16)) {
-    print("Input A:  " + a.toString(16));
-    print("Input B:  " + b.toString(16));
+  var r = d.a % d.b;
+  if (d.r !== r) {
+    print("Input A:  " + d.a.toString(16));
+    print("Input B:  " + d.b.toString(16));
     print("Result:   " + r.toString(16));
     print("Expected: " + d.r);
     print("Op: %");
diff --git a/src/v8/test/mjsunit/harmony/bigint/mul.js b/src/v8/test/mjsunit/harmony/bigint/mul.js
index 83a6700..77c3a1c 100644
--- a/src/v8/test/mjsunit/harmony/bigint/mul.js
+++ b/src/v8/test/mjsunit/harmony/bigint/mul.js
@@ -4,99 +4,95 @@
 
 // Generated by tools/bigint-tester.py.
 
-// Flags: --harmony-bigint
-
 var data = [{
-  a: "-be5e349bf5ad48e7a5d",
-  b: "a47a19a48667620a82973579739e08c64651b3ede2c578ff975e",
-  r: "-7a4f25aa8725368922062fc91a110352a660657ffb3a489126ded10ccd29d929120c926"
+  a: 0x2bf1f236c2df29f7c99be052dfe1b69ae158d777fea487af889f6259f472c0n,
+  b: -0xae0090dfn,
+  r: -0x1dde8b7f987479d7b308e2b8a122703d417f921fd4ab04fcac81439ace4f445c7bf540n
 }, {
-  a: "912d5d85aec5ec6caf90514f0ec005f711caac82960c0ee911ef30f145107ae236783e6",
-  b: "0",
-  r: "0"
+  a: -0x71cd629b6682b5b1c50f9436ded88468bcn,
+  b: -0xb24ce1d11726048158fb42c02e9361973193n,
+  r: 0x4f42fbebca0bc1746d114996d9c9cceb4065c347da31dc0efa88db41f1f724aef81ff4n
 }, {
-  a: "-87c17f6930bdef7e7c7ae7dab8be3baa2e7d67",
-  b: "285af6503c42d077a0d59558deb170bad",
-  r: "-1566788db7747e33ddb6540190617b57856e5f3924447f9f400f34a9aa75aa7d20f2b9b"
+  a: 0xef7c15fb2256338bd0650fa51c28551108ccb9828850f1b415d0c8f1a47fc0e2f86n,
+  b: 0xc17n,
+  r: 0xb4f552dbf2c20292f5475d025276b9c70f16316c91e0a9a2833bf2d616bc484f808d0an
 }, {
-  a: "-3d0fd72abc5fb82d5cf45679812b71",
-  b: "-3c537c742e17c5fac136e33f5e7edf256ef52b6df",
-  r: "e63a0402966391e13e600371183f223379b66912ee706a2b369668b3e33e9a15992d6f"
+  a: 0xcc8a5a56c623d9f9be2103bc237976f26n,
+  b: 0x13a02fec7cfd49c5a081c06bbbaac5c70dc3an,
+  r: 0xfae417740ef1963ad78aa4252159d986593845690f4f5fe759f6d913d79810473d69cn
 }, {
-  a: "dfd77cf4b0d071df2487c9b77959ee027380a159b0",
-  b: "-56300fb05cba28d5150892ff66e77",
-  r: "-4b5c6a1976d3a318cb9f93e154dc362da4e740fa31d82baefead60c355bfea99eaa50d0"
+  a: -0x519n,
+  b: 0x7de5551df3ec2619a89139153663a79f8bdb47047423c8070d7cfddc26d43af8ee9n,
+  r: -0x281c60ee5b06ece38cc4c4bfd2242017c4ff0cd05b40a66abf3c22a1741efe09ef81c1n
 }, {
-  a: "-bea52261387bb2aaf8c61b5ee7bbf85b3bbbedfe60773ed9873cbceba078d3fecbb",
-  b: "-2ad7",
-  r: "1fe73453d2eabb331a676ede8eb9759c8c6bffe09c76947578e08b0152379841d867f0d"
+  a: 0x6fb9ba0d0n,
+  b: -0x86b45ffb80fbf2b61abc14b28855780f83e187fd6ae26e09d28d6f05260e1n,
+  r: -0x3ac9efdd4e930fcbf654819060b858f182f7768db6bc72deb8d734d2ea10fa02b656d0n
 }, {
-  a: "5b5a3a047d8f7e1519d6d92d3241c0f32c4d789",
-  b: "-4bd3e8c09b0ba71bc25416877a4c7135",
-  r: "-1b0f0d6ba20fe60049c4a172e8b1fb9824c1e85e21f1ebe08556b7074d8d4f4ac90185d"
+  a: -0xde2e7a0883a63d69d2120108f92943e4a34b63e8468c12b38a0519a6498n,
+  b: -0xb1857781fefn,
+  r: 0x9a11f83db6da31f78a2415d3891f79a0f6aafc69553fb458a2bc3ae2e2f65cb09251e8n
 }, {
-  a: "1b2c8263d4bac8cc825657f81fca6196799aff00fa960d5c04",
-  b: "-6b140fca30c8037b18d88",
-  r: "-b5dbba6fba700592408e2ebbba2d4c6557d61d1201e24314f690e77c0b59c68d8b1620"
+  a: -0x2c90284ebdb5237ba7c9562f596ef9a21254a3n,
+  b: -0xb55feab8b45cc1bcdcfc5585c9114de0n,
+  r: 0x1f929eda8d33ec2ded8d76382a4cb731f805d28e827521a27154b6618a6f87ed5215a0n
 }, {
-  a: "dd74f1f92ab5b9e0b447b7fe9076f7",
-  b: "-9dbb0acb24e6336fe4f37f8e942d1d5c22dfe4f34",
-  r: "-88728628dd4ed79514e720448e4f9ad422ba6ca62cd61bf779cfb3cb12afb5bbe20632c"
+  a: 0x11ffe68d26ca29eac43b64n,
+  b: -0xe3311b278fec1fb3f8f59acfd9147c773197fc54c66b25bdn,
+  r: -0xff95d530fd53e61744d86d09f9ab5401b1efb2133af5c47ffeca31aca22a4da414cd4n
 }, {
-  a: "-e97d2712832aa20a",
-  b: "-cb98c0fa9b4b35fc7a4ebed6d3d106bb758c244eb756c75587300ad",
-  r: "b9b1904d502a19d20cc7bd8e05670f667db817bb9104ef8acc747f3df6541eede4d80c2"
+  a: 0xbda74de44eeb2995a4185325014863n,
+  b: 0xf99164c7248a0372d72d82cbf65fdb345c84bca6n,
+  r: 0xb8e3712f119fefa47168950100b33aa1ec4e61a970d0eec2d2dd4b925cc4dfd709a432n
 }, {
-  a: "828ca2d8981f347f4bec14ba",
-  b: "-8ce5b6b1c329477a0a728ed81331af1f03e3eaa1ccb2cb3",
-  r: "-47da0e06c179e58b3e5d8abc4a2b274ede3a7d73c0b5fcb3690f0b544ed6c0b7120760e"
+  a: 0x47fc0bb6d761e12a1f7cf2a14f4cc777486b22516ca339641fn,
+  b: -0xd2fa2494ae242494f307n,
+  r: -0x3b531808ad9095f9f904dba47ef4a0aef54f736cc2836accb7b1b70f07ee862e8729d9n
 }, {
-  a: "aade382f2483a571e12cb1796bd124e21c6014261cef5d733a1b35fb01db7232c5b",
-  b: "-d34a",
-  r: "-8d068c8b18b90f6aaf82ed3260f68bdb06bf64613cdda736fc33395b7d16688edb9d34e"
+  a: 0x91d09f35203fcf69974d347ab718912cn,
+  b: 0xfc2d9a00611e4e1767b67db898b951e5d2bbb9n,
+  r: 0x8fa3561bff2cc00a780a71e5b16d6092296514d401c88fc54e04a91062775cb4e40cccn
 }, {
-  a: "34188043594e64ac10b37923ad29b4b536a4098ce76c9133155820b7843de95af",
-  b: "106952",
-  r: "356f6c0aa4a1a0d27dd2e8867420eddcd9fb5614450d6bb85cba0071e03e4563a0b90e"
+  a: 0x5a5b1ede360dafcac08c92f4b809e401502df5ab8569303a2n,
+  b: -0xb64d963b1ac4eb46ddd65n,
+  r: -0x40582a6083cd0feb5b33ac138feaf9250b5084e561807e56a8415c810a1bf9861d48ean
 }, {
-  a: "96b2a125fc041fe36aebe7dfd02a4f56b90",
-  b: "-a9f9c57a732002abf0764868f297442f61d1",
-  r: "-640ef4605c38f6643d60526833e7a3b7b71a72b7042434abc0ca600e7f79b3aa98e6090"
+  a: 0xf68275dc25d6af7dde130n,
+  b: 0xfe330b766e44f479e342e3315812e977d4d5e39bffe42111dn,
+  r: 0xf4c697f78dc7c9b3207b50cf2cf3035aa065e96c37c0be3345f71f34096f057e76b270n
 }, {
-  a: "-ae8327a77a340d2c90c93bb0ebe02d7a77d7c2a4e8d21a21d0",
-  b: "268a49068f2769f949d95",
-  r: "-1a45bc5e1b636b28bf716dfeaf0599cd932270796233adf7d58b8d72d06ac580c323e10"
+  a: 0x77009ed053f71n,
+  b: -0x647aecfc2af4079a586fbba99070c3f51d5465d9a4fd8c12cdab10854n,
+  r: -0x2eb5627edb1072a65a1db2d243d0bf2eeb5c3ff6ad61ec1063e9ee40b783bd06d55914n
 }, {
-  a: "-a0adcb953540a4f25fc97a40a2c9285bfba7e70e4ffc",
-  b: "fff2302a069e8f69d00e529a81b",
-  r: "-a0a5204f09eeb3ecd9fe2c6de34d0e0ed70c6d1589d95fd83de33d921a3152dfe5bcf94"
+  a: 0xccfa15bb6125b01bece5a919ab5e9128e784d63e50b5990ba8047a7effn,
+  b: 0x1a366ac48cdan,
+  r: 0x14fcf8728aa3dc5ef26b077dfc012d592c3a0cdfc3331942f921f037eea5af9eff9926n
 }, {
-  a: "-83771467194c5b612539be7228f366a8",
-  b: "9412ce8f98510486287bc15c35883fff04d126e",
-  r: "-4c0a803e9a079742969e01dbb7990566b2f5ac9658653c967b5d295f6a996ba1655ec30"
+  a: 0x4fc54a59f2n,
+  b: -0x93bbcbd684987407c4ec4a3cbdc7c4821c33ca20ca8449b0055905e9a8ffn,
+  r: -0x2e08ce533fdc7bb8a3a2280cfb116c85837b74606ed25f8daad623baa4ac7de758680en
 }, {
-  a: "12c3327d3d7ed4b3180cc301f98d351804451be431137fa48aa67627db867a2cd",
-  b: "-ee0af6",
-  r: "-11724697fa94a9caafbee6e7b778ecae17ed7ebba5575296b1fc4995a12fe5c9a8872fe"
+  a: -0xcf21626f318089a85738f7e9cdcf0a477f4d880ce58679n,
+  b: -0xc7ca8704a49fdb8f9567c68cn,
+  r: 0xa1a6d11a77d8e1b723bfa0242407a454274145c31bb6ede29bb0e3883b08951b36202cn
 }, {
-  a: "-5",
-  b: "-a00c8e774e3d4a6fc2fa384382720700e49e3e4b882bb5c4c0dbe4cdcd92126731128b",
-  r: "3203ec8548732742ecee319518c3a230477173779a8da8cd7c44b780503da5c03f55cb7"
+  a: 0x20c3cb19e51d4e2ac2c89f26e052bef8n,
+  b: -0xab2a148297108425ebd2fd17d897f647e0792fn,
+  r: -0x15e82b69a0eaed04cd140c6aed3b1f5bc0fc5de7ceddcb2d77615767b19dd82c744788n
 }, {
-  a: "a0a4dc9610ada50dfa633ad910a02aa20c85",
-  b: "-4d7aa1dc1cc1d1767b4e25a839e7c177652",
-  r: "-309e8a7c10fbc6b50f6ad012099765a35395b9d51112d50e0a8f3ac076942a9e5a0509a"
+  a: -0xcc4f48f45d8165569348fb995370n,
+  b: 0x140cc111df0a06e32335478ded744eb3a737a53409n,
+  r: -0x10005f808c07a1d91faac090aad06804b491919a9d2ed58f6caa52448ad97bd486aef0n
 }];
 
 var error_count = 0;
 for (var i = 0; i < data.length; i++) {
   var d = data[i];
-  var a = BigInt.parseInt(d.a, 16);
-  var b = BigInt.parseInt(d.b, 16);
-  var r = a * b;
-  if (d.r !== r.toString(16)) {
-    print("Input A:  " + a.toString(16));
-    print("Input B:  " + b.toString(16));
+  var r = d.a * d.b;
+  if (d.r !== r) {
+    print("Input A:  " + d.a.toString(16));
+    print("Input B:  " + d.b.toString(16));
     print("Result:   " + r.toString(16));
     print("Expected: " + d.r);
     print("Op: *");
diff --git a/src/v8/test/mjsunit/harmony/bigint/neg.js b/src/v8/test/mjsunit/harmony/bigint/neg.js
index 8cec9cc..15b2fb4 100644
--- a/src/v8/test/mjsunit/harmony/bigint/neg.js
+++ b/src/v8/test/mjsunit/harmony/bigint/neg.js
@@ -4,77 +4,74 @@
 
 // Generated by tools/bigint-tester.py.
 
-// Flags: --harmony-bigint
-
 var data = [{
-  a: "58ad59aa3aa9d04d4c12493966e204ef0500d5f92ecb31",
-  r: "-58ad59aa3aa9d04d4c12493966e204ef0500d5f92ecb31"
+  a: 0xcn,
+  r: -0xcn
 }, {
-  a: "6dbd19e4b781a8f113ae95738dda4b70ba027755052126c198d20ade97869ff",
-  r: "-6dbd19e4b781a8f113ae95738dda4b70ba027755052126c198d20ade97869ff"
+  a: -0x5a3d0f6cdb7987a2d262838c05359f786a484d052529n,
+  r: 0x5a3d0f6cdb7987a2d262838c05359f786a484d052529n
 }, {
-  a: "d02befb1c96364a984664f85",
-  r: "-d02befb1c96364a984664f85"
+  a: -0x98d8c6cbfd67b6b652b7a4670478f6706e06a3n,
+  r: 0x98d8c6cbfd67b6b652b7a4670478f6706e06a3n
 }, {
-  a: "86",
-  r: "-86"
+  a: -0xe66ac692ff012bd0f4ca38804628f71ff411aede09c59597n,
+  r: 0xe66ac692ff012bd0f4ca38804628f71ff411aede09c59597n
 }, {
-  a: "0",
-  r: "0"
+  a: -0x97e1e0c13c0c0c420aca92268ea802047c30570335de0000dn,
+  r: 0x97e1e0c13c0c0c420aca92268ea802047c30570335de0000dn
 }, {
-  a: "-f8da",
-  r: "f8da"
+  a: 0x6b2eddc3b212913abed4f5c84e3eee64d6463224dff8n,
+  r: -0x6b2eddc3b212913abed4f5c84e3eee64d6463224dff8n
 }, {
-  a: "2b0f358b54a82fbaddc5a6e61a5d",
-  r: "-2b0f358b54a82fbaddc5a6e61a5d"
+  a: -0xfcd42a712dd928deb51ab2d151fa6bee0f4dd2fa6n,
+  r: 0xfcd42a712dd928deb51ab2d151fa6bee0f4dd2fa6n
 }, {
-  a: "-3d32065b9bbb36ee521ff82da",
-  r: "3d32065b9bbb36ee521ff82da"
+  a: -0x75ba8e0e92a05ff552f2dc3afb39a4dn,
+  r: 0x75ba8e0e92a05ff552f2dc3afb39a4dn
 }, {
-  a: "ca3da934e8081c457933c90",
-  r: "-ca3da934e8081c457933c90"
+  a: 0x4570376e541836fab5190e08an,
+  r: -0x4570376e541836fab5190e08an
 }, {
-  a: "-e4d2bbdf90affad1d2a",
-  r: "e4d2bbdf90affad1d2a"
+  a: 0x15aca33cfb06n,
+  r: -0x15aca33cfb06n
 }, {
-  a: "-290845e8f55d467e3",
-  r: "290845e8f55d467e3"
+  a: 0x7ec0027910c44b791bf193c6f25487a9435n,
+  r: -0x7ec0027910c44b791bf193c6f25487a9435n
 }, {
-  a: "-771c77d2dd2227c30cf44f1bf3230",
-  r: "771c77d2dd2227c30cf44f1bf3230"
+  a: -0x31f0d92f358618e6b29a2899bd988533838d33839fb37n,
+  r: 0x31f0d92f358618e6b29a2899bd988533838d33839fb37n
 }, {
-  a: "-77aa11",
-  r: "77aa11"
+  a: 0xb4f84118d797244c982f1n,
+  r: -0xb4f84118d797244c982f1n
 }, {
-  a: "d220c8af9c97516bf5ec295585f711e020480d08ac11689726a285930",
-  r: "-d220c8af9c97516bf5ec295585f711e020480d08ac11689726a285930"
+  a: 0x626n,
+  r: -0x626n
 }, {
-  a: "53841e699f994e1a43f7f848f34d418792191de15b78e1a852c430b2f8af6e7",
-  r: "-53841e699f994e1a43f7f848f34d418792191de15b78e1a852c430b2f8af6e7"
+  a: 0x9f35c8968457d07608699df5894c0542f35b73b0b5ce8423aan,
+  r: -0x9f35c8968457d07608699df5894c0542f35b73b0b5ce8423aan
 }, {
-  a: "7c30187b8901bd748adc4bc243",
-  r: "-7c30187b8901bd748adc4bc243"
+  a: -0xb5be1f7937895adc457f051d1f4bc74d556b432dn,
+  r: 0xb5be1f7937895adc457f051d1f4bc74d556b432dn
 }, {
-  a: "-e07ac5649eb741a023b0f9928d5982032f6766a479c7fbf26",
-  r: "e07ac5649eb741a023b0f9928d5982032f6766a479c7fbf26"
+  a: 0xcacb413b3cab5a5f5086511728d1afbaa82ca41e69805daf47503e2n,
+  r: -0xcacb413b3cab5a5f5086511728d1afbaa82ca41e69805daf47503e2n
 }, {
-  a: "5ab3237bb32234bcaf8",
-  r: "-5ab3237bb32234bcaf8"
+  a: -0x77ef7cbb15cee20a519a1n,
+  r: 0x77ef7cbb15cee20a519a1n
 }, {
-  a: "7df7",
-  r: "-7df7"
+  a: -0x71ac9bfe7f5f70038c7fn,
+  r: 0x71ac9bfe7f5f70038c7fn
 }, {
-  a: "-518b7b",
-  r: "518b7b"
+  a: -0x500a02b8fd66ee1067022c02c7241acdc42b947bfb933aa95a8d6n,
+  r: 0x500a02b8fd66ee1067022c02c7241acdc42b947bfb933aa95a8d6n
 }];
 
 var error_count = 0;
 for (var i = 0; i < data.length; i++) {
   var d = data[i];
-  var a = BigInt.parseInt(d.a, 16);
-  var r = -a;
-  if (d.r !== r.toString(16)) {
-    print("Input:    " + a.toString(16));
+  var r = -d.a;
+  if (d.r !== r) {
+    print("Input:    " + d.a.toString(16));
     print("Result:   " + r.toString(16));
     print("Expected: " + d.r);
     error_count++;
diff --git a/src/v8/test/mjsunit/harmony/bigint/not.js b/src/v8/test/mjsunit/harmony/bigint/not.js
index 7ceaa01..27b6a78 100644
--- a/src/v8/test/mjsunit/harmony/bigint/not.js
+++ b/src/v8/test/mjsunit/harmony/bigint/not.js
@@ -4,77 +4,74 @@
 
 // Generated by tools/bigint-tester.py.
 
-// Flags: --harmony-bigint
-
 var data = [{
-  a: "3d02c87edc77722299f6559ecca038911f864a4e78c20af80f4a6d9",
-  r: "-3d02c87edc77722299f6559ecca038911f864a4e78c20af80f4a6da"
+  a: 0x9f0305cd75e4n,
+  r: -0x9f0305cd75e5n
 }, {
-  a: "ac01894aeaf77255ede209897561ec1e3c7e916b9",
-  r: "-ac01894aeaf77255ede209897561ec1e3c7e916ba"
+  a: -0xe8e9c8312f553c9n,
+  r: 0xe8e9c8312f553c8n
 }, {
-  a: "-7aaab657ab197f26eb6b98fe4c2c79b199a8156129ca04",
-  r: "7aaab657ab197f26eb6b98fe4c2c79b199a8156129ca03"
+  a: -0x1a29f0783a66534da3c024ad1cc854073f886888fen,
+  r: 0x1a29f0783a66534da3c024ad1cc854073f886888fdn
 }, {
-  a: "9718579cc52befdaff1ec035b5ed03cec5c1d1678c28712cf0c9bec2c807897b74f0",
-  r: "-9718579cc52befdaff1ec035b5ed03cec5c1d1678c28712cf0c9bec2c807897b74f1"
+  a: -0xfc2cc19496c1ced95be832ca5246d41c526b9fa28b88bcd39813aa336n,
+  r: 0xfc2cc19496c1ced95be832ca5246d41c526b9fa28b88bcd39813aa335n
 }, {
-  a: "e614366bc4e67509843254c52e13da5380b00a35aa1d233e70821f7d649ad1957db",
-  r: "-e614366bc4e67509843254c52e13da5380b00a35aa1d233e70821f7d649ad1957dc"
+  a: 0x13ebn,
+  r: -0x13ecn
 }, {
-  a: "fb815f78e6952b500226c",
-  r: "-fb815f78e6952b500226d"
+  a: 0x4c12d642b2a132f0c927ec7504b530fb45d5e249163ffdc59feb3de31881n,
+  r: -0x4c12d642b2a132f0c927ec7504b530fb45d5e249163ffdc59feb3de31882n
 }, {
-  a: "94404df802649cff2ea6c0996f55ec60c14f00ab29b287092389951f6227c4ec7",
-  r: "-94404df802649cff2ea6c0996f55ec60c14f00ab29b287092389951f6227c4ec8"
+  a: 0x49637a624cb8782002e3e0874ad76215e188cee948c7ce7b0f66e1d0n,
+  r: -0x49637a624cb8782002e3e0874ad76215e188cee948c7ce7b0f66e1d1n
 }, {
-  a: "-74b42cd7bccd",
-  r: "74b42cd7bccc"
+  a: -0x81cbae84e6753b885ada46c0bf72368c083fed622fn,
+  r: 0x81cbae84e6753b885ada46c0bf72368c083fed622en
 }, {
-  a: "da",
-  r: "-db"
+  a: -0xcdf793acfdd08b6n,
+  r: 0xcdf793acfdd08b5n
 }, {
-  a: "3a9ade198",
-  r: "-3a9ade199"
+  a: 0x88n,
+  r: -0x89n
 }, {
-  a: "56e766d24fd18c2241f244dedc426c0b1ae59e7ed4f06def0a75e0a5c8651e2ce87928",
-  r: "-56e766d24fd18c2241f244dedc426c0b1ae59e7ed4f06def0a75e0a5c8651e2ce87929"
+  a: -0x1fn,
+  r: 0x1en
 }, {
-  a: "cc430c91347b22ecb1a6f1a2ceea168ffa4a9b80065bd1ec5d",
-  r: "-cc430c91347b22ecb1a6f1a2ceea168ffa4a9b80065bd1ec5e"
+  a: 0x5c3278e76266b9e93d63eb4f2aa53716220aa1n,
+  r: -0x5c3278e76266b9e93d63eb4f2aa53716220aa2n
 }, {
-  a: "32e4b7f82d8c037d0f562296e21b1e58a",
-  r: "-32e4b7f82d8c037d0f562296e21b1e58b"
+  a: -0x9f4fe05n,
+  r: 0x9f4fe04n
 }, {
-  a: "-526d3f1a904561f0cde1f0a2a4",
-  r: "526d3f1a904561f0cde1f0a2a3"
+  a: 0xdn,
+  r: -0xen
 }, {
-  a: "3de5a9635a40539831c9665577e5eedbf680755e2065a0caa346759e17225",
-  r: "-3de5a9635a40539831c9665577e5eedbf680755e2065a0caa346759e17226"
+  a: -0x74a9d63d02bd1393b311211e35c8b2d11e2367ffffb812683365f02d98n,
+  r: 0x74a9d63d02bd1393b311211e35c8b2d11e2367ffffb812683365f02d97n
 }, {
-  a: "-d912828b8d6419900",
-  r: "d912828b8d64198ff"
+  a: 0x8a2831ae3e1b6b21a7b3d7ee921a0c0edf29b272d654f647169a5a6141d3aaf41439n,
+  r: -0x8a2831ae3e1b6b21a7b3d7ee921a0c0edf29b272d654f647169a5a6141d3aaf4143an
 }, {
-  a: "-17968ddf93",
-  r: "17968ddf92"
+  a: 0xa2ef28270a7e668e190bc303537f5a8ba3f0d59bcn,
+  r: -0xa2ef28270a7e668e190bc303537f5a8ba3f0d59bdn
 }, {
-  a: "-c2bfd766e34923d549bbaedb4d9b7bb35a61908e6144462a",
-  r: "c2bfd766e34923d549bbaedb4d9b7bb35a61908e61444629"
+  a: -0x4f8bd11ee4ef38682a0c94en,
+  r: 0x4f8bd11ee4ef38682a0c94dn
 }, {
-  a: "af426ec83aaafc84a94930e51a2899696a3d",
-  r: "-af426ec83aaafc84a94930e51a2899696a3e"
+  a: 0x5436d0721d1282755068add3b5ab5424cb455fad50811a9afff0be5n,
+  r: -0x5436d0721d1282755068add3b5ab5424cb455fad50811a9afff0be6n
 }, {
-  a: "-283de5b9379a45f065d3b8662ac38faa6492bc0eea6b7e3b51591a5cc27669e",
-  r: "283de5b9379a45f065d3b8662ac38faa6492bc0eea6b7e3b51591a5cc27669d"
+  a: 0x5db6907c92529f517d24a6ff7303de42cb9059ae2adc0c22n,
+  r: -0x5db6907c92529f517d24a6ff7303de42cb9059ae2adc0c23n
 }];
 
 var error_count = 0;
 for (var i = 0; i < data.length; i++) {
   var d = data[i];
-  var a = BigInt.parseInt(d.a, 16);
-  var r = ~a;
-  if (d.r !== r.toString(16)) {
-    print("Input:    " + a.toString(16));
+  var r = ~d.a;
+  if (d.r !== r) {
+    print("Input:    " + d.a.toString(16));
     print("Result:   " + r.toString(16));
     print("Expected: " + d.r);
     error_count++;
diff --git a/src/v8/test/mjsunit/harmony/bigint/or.js b/src/v8/test/mjsunit/harmony/bigint/or.js
index 4ee3265..3203258 100644
--- a/src/v8/test/mjsunit/harmony/bigint/or.js
+++ b/src/v8/test/mjsunit/harmony/bigint/or.js
@@ -4,99 +4,95 @@
 
 // Generated by tools/bigint-tester.py.
 
-// Flags: --harmony-bigint
-
 var data = [{
-  a: "a66",
-  b: "d0671cd6e4ebd7baf6e48b2529348cfa89fc9513ba30ef3f99aee07f267df163cf8",
-  r: "d0671cd6e4ebd7baf6e48b2529348cfa89fc9513ba30ef3f99aee07f267df163efe"
+  a: 0x77a87n,
+  b: 0xde08e7433fb9584911b8cb4bc7eed802299b4489fc635974d063847da4e8b461df5dn,
+  r: 0xde08e7433fb9584911b8cb4bc7eed802299b4489fc635974d063847da4e8b467ffdfn
 }, {
-  a: "a9950e5fc429f0f93d5fa8f306f4e5da88a8c9f9",
-  b: "d1fc1ac3db7ff5547462800923e616727120f74f0a6cb7bf1886dd4f4ac",
-  r: "d1fc1ac3db7ff554746a9959e7fe56ff7fb3f7ff8f7cffff5daedfcfdfd"
+  a: -0x1d3ff6f353f2d035ed7b4b8e5e4ae1c8d162n,
+  b: -0xcf829b11c2f996f388b22cd03aeb75ec434f3be8fde6466n,
+  r: -0x192f308302c00024a55a4004520a81c84062n
 }, {
-  a: "5e277a64b6515ad69ed8935ae8dcdb6dc66f98fcbb462b10bea0db15ad6010d",
-  b: "7df3",
-  r: "5e277a64b6515ad69ed8935ae8dcdb6dc66f98fcbb462b10bea0db15ad67dff"
+  a: 0x6dbbc93af9a9c222187dn,
+  b: -0xfaa906348dc49859c34bc7c6n,
+  r: -0xfaa9020404c400500149c781n
 }, {
-  a: "3b8368196588e684403965902763d66aa",
-  b: "-edf58c5ab418f49cf9fdb7f3b1c416a03c1dfbe90ba7ea6373c",
-  r: "-edf58c5ab418f49cf9c43493a0801600381dc2880b808821112"
+  a: 0xf8n,
+  b: 0x4388532n,
+  r: 0x43885fan
 }, {
-  a: "-5587f5e86137f8ea4d7259acdd0b77a26ea069385501c9985df6a5fcd3c",
-  b: "9878871628ea5cb66",
-  r: "-5587f5e86137f8ea4d7259acdd0b77a26ea069385501811849d605a041a"
+  a: -0x3ee35e1823b91414618f05995e11594920539921e9440n,
+  b: -0x58c5811ee19db01b7d9824c49682af55956119cfbc9868287ef138da08ee3n,
+  r: -0x3c80040002800414010101891c1048082051180008423n
 }, {
-  a: "-dc65679b1ea7c86c10890e6d6be3bd069b4c7",
-  b: "83ea9",
-  r: "-dc65679b1ea7c86c10890e6d6be3bd0618047"
+  a: -0xa2a70c5da9a7e98f242e82d518n,
+  b: 0n,
+  r: -0xa2a70c5da9a7e98f242e82d518n
 }, {
-  a: "-755f422bfb614b7ed2c8e05cd1e0e0a",
-  b: "-d3185fac5454a495d7b149e67df4436339e060d924d",
-  r: "-24154221496049744240204040c0209"
+  a: 0x7868475f450ff2b15a03eccb4d26ce8711383f615cn,
+  b: 0x1c62774e1db239cb461c4190b54de4d872f9484cf82ed1258cc14580cf29f608n,
+  r: 0x1c62774e1db239cb461c41f8fd4fffdd7ffbf95efbeedb6daecfc791ff3ff75cn
 }, {
-  a: "-1dfdf84b41ddd069053",
-  b: "f9b2bc80b580311773e9a5d57e8f24ace46bd2a0fce24404db684efa8692638b5d604e6",
-  r: "-1105784900548009011"
+  a: 0x865d033028551a71f6f9f8d7b36cf9819n,
+  b: -0x68e30391d9831a4ea3e65b2e433f55ba398n,
+  r: -0x68610290c9830a4482000206000c1102387n
 }, {
-  a: "18d1b78380aa9016029417c2ebe77a",
-  b: "-b63b35e6711dcbf00dc02cd936",
-  r: "-3835446109c9600800041806"
+  a: -0x817a0dacbafbaf40ef819fc62a8efc4b4960n,
+  b: -0x5af313e32a5386e29cb5d2b34d54f04da389f33d52444f177671e41n,
+  r: -0x12a04840a008a008f019504008074430841n
 }, {
-  a: "-9981f",
-  b: "-5d876576146a2d5dc8d52d26ea3304287af0922685f8e1a46875e80f24a470",
-  r: "-800f"
+  a: -0xef8c9475210c0a31aa12c34db6e7737609c75b78a54cn,
+  b: -0xba91b4ec3a5390db84febaeaddb8209155413e2e02fb0n,
+  r: -0xa9080441210808300a02820d9282011400034260250cn
 }, {
-  a: "-20f8052991bc5a8f2631c9e4b34aa9073a69913185a539d719",
-  b: "a59fdaa025b42",
-  r: "-20f8052991bc5a8f2631c9e4b34aa9073a6991200005398419"
+  a: -0xf4e707078d14001959f4n,
+  b: 0n,
+  r: -0xf4e707078d14001959f4n
 }, {
-  a: "-d02620570",
-  b: "-3b14d75fb9d9b95d13f884a82c9f16",
-  r: "-400200506"
+  a: 0x601f0n,
+  b: 0x246fbfn,
+  r: 0x266fffn
 }, {
-  a: "-8",
-  b: "-4",
-  r: "-4"
+  a: -0x9ccd3d1b6d4bcde8643ad641d395980bn,
+  b: -0x379e57728185fd098383a23c7f56dn,
+  r: -0x13901650808484018100003859009n
 }, {
-  a: "e0e8ab319d1f051560e1155ae5789dd4d9b638e07e5a57c3432e6cb9239d",
-  b: "85c9cd1f09436dc45ac783f31a21a1ff4e11ceca00cc164",
-  r: "e0e8ab319d1f0d5dfcf1f5def7fcddfcf9bf39e27e5ff7e35feeecbde3fd"
+  a: 0xcc4b3ba719bd1b37f254f36a72ee375ad22abn,
+  b: -0xb0c220750f2dad9de91ffb8a7bbf8ffefen,
+  r: -0x4000640e0c8098a0095880188a02dc55n
 }, {
-  a: "8131173cb5597e2ae560cae6d0907f004792b1b1c7",
-  b: "-2ac290724a7c86",
-  r: "-c290604a4c01"
+  a: 0xa230c33b718cd563f9c1577f4f8da160851902341ba1a6e6bdcbec413d98a18n,
+  b: 0xc2f4e2db2df59ccc34690479ebe64df967n,
+  r: 0xa230c33b718cd563f9c1577f4f8dad6fcf3db2ff5bede7e6bdcffeff7ddfb7fn
 }, {
-  a: "bdb24fd4d78b01d77e41d95f2c3eedeb2bf919",
-  b: "-97f6ccbd94d64ada501e0f288568",
-  r: "-14f60881940600d2401204000467"
+  a: -0x5fbac9a8f47n,
+  b: 0xf1bfe6f97e8f516685372b06ea89659c3df4ab3f6779e5c0b41e1b570fn,
+  r: -0x54ba0808841n
 }, {
-  a: "-d5ad86f9a4808394f6e7dcd2a67bd3e6a9",
-  b: "1a80309934942e4e55fbf2ba4d1d2f8cc4697338097e2c1b7ce013da8a79965974286",
-  r: "-408c066804000010f6c25450261a40a429"
+  a: -0x7fd2d4a4c60ba795e2fcn,
+  b: 0x33dcea557cc5156dacb9ad7b252598172f92d8cf7d38e69f0a0n,
+  r: -0xd02d02000082194025cn
 }, {
-  a: "c7a0086120a1613a28456",
-  b: "b8",
-  r: "c7a0086120a1613a284fe"
+  a: -0x3833089d7cf4e0181247572037a90cc2506342a2191137345e3a0e10n,
+  b: 0xededf5c7e54cd86afc6d838205c8a78cac7a0e410792a21cf3e4e38dd8ca2dd80n,
+  r: -0x283208103824c01802450720300908c2004142200111072052180210n
 }, {
-  a: "c8480c",
-  b: "0",
-  r: "c8480c"
+  a: -0x188818a47abbfe64357ccd1a33fb5cb875f86n,
+  b: -0x14faf1811ee737d048c025f7a1fe156f7e90d23a699d040609e631836500df2e30cdn,
+  r: -0x108808202299d040201c411832500cb061085n
 }, {
-  a: "ec8913fc89aa7a47672bc0f5269e8629cabf2dba88836cb3a9",
-  b: "-52594e7",
-  r: "-4010447"
+  a: 0xf60c0260022920bdbd1c837778657936956c15b4cb1n,
+  b: 0xa10df3b397c24n,
+  r: 0xf60c0260022920bdbd1c8377786579b79dffb7b7cb5n
 }];
 
 var error_count = 0;
 for (var i = 0; i < data.length; i++) {
   var d = data[i];
-  var a = BigInt.parseInt(d.a, 16);
-  var b = BigInt.parseInt(d.b, 16);
-  var r = a | b;
-  if (d.r !== r.toString(16)) {
-    print("Input A:  " + a.toString(16));
-    print("Input B:  " + b.toString(16));
+  var r = d.a | d.b;
+  if (d.r !== r) {
+    print("Input A:  " + d.a.toString(16));
+    print("Input B:  " + d.b.toString(16));
     print("Result:   " + r.toString(16));
     print("Expected: " + d.r);
     print("Op: |");
diff --git a/src/v8/test/mjsunit/harmony/bigint/regress-tonumbercode.js b/src/v8/test/mjsunit/harmony/bigint/regress-tonumbercode.js
new file mode 100644
index 0000000..2123748
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/bigint/regress-tonumbercode.js
@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(x, b) {
+    if (b) return Math.trunc(+(x))
+    else return Math.trunc(Number(x))
+}
+
+%PrepareFunctionForOptimization(f);
+f("1", true);
+f("2", true);
+f("2", false);
+%OptimizeFunctionOnNextCall(f);
+f(3n);
diff --git a/src/v8/test/mjsunit/harmony/bigint/regressions.js b/src/v8/test/mjsunit/harmony/bigint/regressions.js
index 3057fe1..b4a55c1 100644
--- a/src/v8/test/mjsunit/harmony/bigint/regressions.js
+++ b/src/v8/test/mjsunit/harmony/bigint/regressions.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-bigint
-
 var a = 5n;
 var b = a / -1n;
 assertEquals(5n, a);
@@ -18,3 +16,24 @@
 assertEquals(0n, -5n % -1n);
 
 assertTrue(0n === 0n);
+
+// crbug.com/818277: Must throw without DCHECK failures.
+// In order to run acceptably fast in Debug mode, this test assumes that
+// we allow at least 1 billion bits in a BigInt.
+var close_to_limit = 2n ** 1000000000n;
+assertThrows(() => close_to_limit ** 100n, RangeError);
+
+// Check boundary conditions of the power-of-two fast path.
+// The following "max" constants are just under BigInt::kMaxLengthBits
+// and replicate the computation of that constant.
+var kMaxInt = 2n ** 31n - 1n;
+var max64 = kMaxInt - 64n - 2n;
+var max32 = kMaxInt - 32n - 2n;
+// Platform independence trick: at least one of the two operations will throw!
+assertThrows(() => { var a = 2n ** max32; var b = 2n ** max64; }, RangeError);
+
+(function() {
+  function Constructor() { }
+  Constructor.prototype = 5n;
+  assertThrows(() => ({}) instanceof Constructor, TypeError);
+})();
diff --git a/src/v8/test/mjsunit/harmony/bigint/rematerialize-on-deopt.js b/src/v8/test/mjsunit/harmony/bigint/rematerialize-on-deopt.js
new file mode 100644
index 0000000..cee915c
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/bigint/rematerialize-on-deopt.js
@@ -0,0 +1,28 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+{
+  function test(a, b, c) {
+    let x = BigInt.asUintN(64, a + b);
+    console.log(x);
+    try {
+      return BigInt.asUintN(64, x + c);
+    } catch(_) {
+      return x;
+    }
+  }
+
+  %PrepareFunctionForOptimization(test);
+  test(3n, 4n, 5n);
+  test(6n, 7n, 8n);
+  test(9n, 2n, 1n);
+  %OptimizeFunctionOnNextCall(test);
+  test(1n, 2n, 3n);
+  test(3n, 2n, 1n);
+
+  assertEquals(6n, test(1n, 3n, 2n));
+  assertEquals(5n, test(2n, 3n, 2));
+}
diff --git a/src/v8/test/mjsunit/harmony/bigint/sar.js b/src/v8/test/mjsunit/harmony/bigint/sar.js
index 7feb8ae..66d2f2d 100644
--- a/src/v8/test/mjsunit/harmony/bigint/sar.js
+++ b/src/v8/test/mjsunit/harmony/bigint/sar.js
@@ -4,103 +4,95 @@
 
 // Generated by tools/bigint-tester.py.
 
-// Flags: --harmony-bigint
-
 var data = [{
-  a: "-4efa0d1f8a127",
-  b: "-66",
-  r: "-13be8347e2849c0000000000000000000000000"
+  a: 0x211a34fn,
+  b: 0xa6n,
+  r: 0n
 }, {
-  a: "-100000001",
-  b: "20",
-  r: "-2"
+  a: 0xa0d0aff5d2783ad192f37423n,
+  b: 0x7n,
+  r: 0x141a15feba4f075a325e6e8n
 }, {
-  a: "853cd87b0bd5c046aecbf4b3d",
-  b: "-96",
-  r: "214f361ec2f57011abb2fd2cf40000000000000000000000000000000000000"
+  a: -0x68ba010a12ed551fc17c67f63331eea3n,
+  b: 0xae5n,
+  r: -0x1n
 }, {
-  a: "-4bc82dba903fedec0a079f7ae4fa6bd6befa",
-  b: "0",
-  r: "-4bc82dba903fedec0a079f7ae4fa6bd6befa"
+  a: 0xb64dc8009n,
+  b: 0xf1n,
+  r: 0n
 }, {
-  a: "43969b4db0d921d9f0ca68f74e4e4b9073732a7955a5b4571",
-  b: "-91",
-  r: "872d369b61b243b3e194d1ee9c9c9720e6e654f2ab4b68ae2000000000000000000000000000000000000"
+  a: -0x364cdec628e438712e4f8cb7an,
+  b: 0x48cn,
+  r: -0x1n
 }, {
-  a: "495f57",
-  b: "-a5",
-  r: "92beae00000000000000000000000000000000000000000"
+  a: -0xb417099aba80a783f52790b779b38c2e6fbdf5f490d7b02a59e81032een,
+  b: 0x6a3n,
+  r: -0x1n
 }, {
-  a: "-22109b99d3025aaef5c3fbd27420a72",
-  b: "45d",
-  r: "-1"
+  a: 0x9d2b41n,
+  b: 0n,
+  r: 0x9d2b41n
 }, {
-  a: "b3f6b156f4afcf259efd3cd1",
-  b: "c7",
-  r: "0"
+  a: -0x4a070c83b02ba86434228a50cbaf50ddf38n,
+  b: -0x63n,
+  r: -0x25038641d815d4321a11452865d7a86ef9c0000000000000000000000000n
 }, {
-  a: "137aeeadc8d1395042e80393cc1b6a1c7b6e526ab1b6fc2f2859fd70e0c29df2802",
-  b: "f49",
-  r: "0"
+  a: 0x3e76514036ccb958c98f60n,
+  b: -0x76n,
+  r: 0xf9d94500db32e563263d8000000000000000000000000000000n
 }, {
-  a: "70f51026476e43bd7e911d37a4553701",
-  b: "33",
-  r: "e1ea204c8edc877afd2"
+  a: -0x51fe20d47ba564bc09337d5c8d284deb5006549bad2629230198f34n,
+  b: -0xfn,
+  r: -0x28ff106a3dd2b25e0499beae469426f5a8032a4dd693149180cc79a0000n
 }, {
-  a: "-3f935a89481c85d666498cf64fdc2a57028f7b295621dc665c0442229563",
-  b: "-2",
-  r: "-fe4d6a2520721759992633d93f70a95c0a3deca5588771997011088a558c"
+  a: 0x49adce1d09dadc5a0635f24d066d3a29e37b9be6059b88d0239d6ca6d92267a372n,
+  b: -0x6n,
+  r: 0x126b73874276b716818d7c93419b4e8a78dee6f98166e23408e75b29b64899e8dc80n
 }, {
-  a: "-c3",
-  b: "-87",
-  r: "-618000000000000000000000000000000000"
+  a: 0xca19971406fb07cn,
+  b: -0x17n,
+  r: 0x650ccb8a037d83e000000n
 }, {
-  a: "aae225520f630c0dfbb815f121836612d75a1f65a301461cd05ad0a741496",
-  b: "-4",
-  r: "aae225520f630c0dfbb815f121836612d75a1f65a301461cd05ad0a7414960"
+  a: 0xd8de8f631313b1f98f77d265ee48014f82eb20n,
+  b: 0xen,
+  r: 0x3637a3d8c4c4ec7e63ddf4997b920053e0bn
 }, {
-  a: "a5348f9af939041cc6ed386c060619a42f30c4aa8",
-  b: "95",
-  r: "529a"
+  a: -0x550d3470c8ad9b8f22ed01a4b1d3f648n,
+  b: -0x4dn,
+  r: -0xaa1a68e1915b371e45da034963a7ec900000000000000000000n
 }, {
-  a: "-4c27fc7e3892a6a5b517",
-  b: "-6c",
-  r: "-4c27fc7e3892a6a5b517000000000000000000000000000"
+  a: -0xa7eadcd4a1b8037081952f0a9199n,
+  b: -0xcfn,
+  r: -0x53f56e6a50dc01b840ca978548cc8000000000000000000000000000000000000000000000000000n
 }, {
-  a: "98efd35f2239f7efde9aef42ad0acd835e68ad868a2cd8fac260f1c7496e3fd2ada76",
-  b: "0",
-  r: "98efd35f2239f7efde9aef42ad0acd835e68ad868a2cd8fac260f1c7496e3fd2ada76"
+  a: -0x65b3933c9e1eb5f953f6cc55cn,
+  b: 0xa6cn,
+  r: -0x1n
 }, {
-  a: "-92f0264c863bdf66d4c83e8bf812123d759b4",
-  b: "-96",
-  r: "-24bc0993218ef7d9b5320fa2fe04848f5d66d00000000000000000000000000000000000000"
+  a: -0x92cea858475460661a2831a28434bde95e5132e1dcaeb161ec89bd9555f41n,
+  b: -0xbn,
+  r: -0x4967542c23aa30330d1418d1421a5ef4af289970ee5758b0f644decaaafa0800n
 }, {
-  a: "ec6341ff2b0e9cf8721e2eb4ec9c9",
-  b: "74",
-  r: "0"
+  a: -0x1d838ade17fe571916a26314b6a8b42e9b6e2b74238de734d6f5575df7n,
+  b: -0x7n,
+  r: -0xec1c56f0bff2b8c8b51318a5b545a174db715ba11c6f39a6b7aabaefb80n
 }, {
-  a: "-32de8dced947fa55cd0b91332a81f70",
-  b: "-5b",
-  r: "-196f46e76ca3fd2ae685c8999540fb800000000000000000000000"
+  a: 0xdd5bf8581e32875d44e26ef10c45bdff68d209015933586dc37211n,
+  b: -0xa9n,
+  r: 0x1bab7f0b03c650eba89c4dde2188b7bfed1a41202b266b0db86e422000000000000000000000000000000000000000000n
 }, {
-  a: "-3ef43bf8610f6533526ba734e85eafa04cd50a3",
-  b: "-25",
-  r: "-7de877f0c21eca66a4d74e69d0bd5f4099aa146000000000"
-}, {
-  a: "-9979591a367a32ae0039c54fd0f3d9e0ccc80be52b7e517fc94d9f3587dc54d933bb",
-  b: "0",
-  r: "-9979591a367a32ae0039c54fd0f3d9e0ccc80be52b7e517fc94d9f3587dc54d933bb"
+  a: -0xa92d3014dcn,
+  b: -0x4cn,
+  r: -0xa92d3014dc0000000000000000000n
 }];
 
 var error_count = 0;
 for (var i = 0; i < data.length; i++) {
   var d = data[i];
-  var a = BigInt.parseInt(d.a, 16);
-  var b = BigInt.parseInt(d.b, 16);
-  var r = a >> b;
-  if (d.r !== r.toString(16)) {
-    print("Input A:  " + a.toString(16));
-    print("Input B:  " + b.toString(16));
+  var r = d.a >> d.b;
+  if (d.r !== r) {
+    print("Input A:  " + d.a.toString(16));
+    print("Input B:  " + d.b.toString(16));
     print("Result:   " + r.toString(16));
     print("Expected: " + d.r);
     print("Op: >>");
diff --git a/src/v8/test/mjsunit/harmony/bigint/shl.js b/src/v8/test/mjsunit/harmony/bigint/shl.js
index 1b0f309..0e7b402 100644
--- a/src/v8/test/mjsunit/harmony/bigint/shl.js
+++ b/src/v8/test/mjsunit/harmony/bigint/shl.js
@@ -4,99 +4,95 @@
 
 // Generated by tools/bigint-tester.py.
 
-// Flags: --harmony-bigint
-
 var data = [{
-  a: "-9a6d035348727045f6abf7d59056d30e9ce885e87f5f8438347bfcda0a1f9b",
-  b: "-2",
-  r: "-269b40d4d21c9c117daafdf56415b4c3a73a217a1fd7e10e0d1eff368287e7"
+  a: -0xe813d76adc0a177778c0c232c595e8572b783210f4a7009d7c1787n,
+  b: 0x9en,
+  r: -0x3a04f5dab70285ddde30308cb1657a15cade0c843d29c0275f05e1c000000000000000000000000000000000000000n
 }, {
-  a: "615f9676062ea7a1b89396ce4208712f279475490829",
-  b: "ff",
-  r: "30afcb3b031753d0dc49cb672104389793ca3aa484148000000000000000000000000000000000000000000000000000000000000000"
+  a: -0xded00dff14554cn,
+  b: 0xd9n,
+  r: -0x1bda01bfe28aa98000000000000000000000000000000000000000000000000000000n
 }, {
-  a: "-9b6131d8b806543fce32b4c2ca2038ffa956929848a61b5eb7f",
-  b: "-e7",
-  r: "-1"
+  a: -0x50c2df089209be37998c8f6e30c4c95a61e77a9241n,
+  b: 0x46n,
+  r: -0x1430b7c224826f8de66323db8c3132569879dea490400000000000000000n
 }, {
-  a: "-331d9e",
-  b: "0",
-  r: "-331d9e"
+  a: 0x668086293eab52b52b879f00375d0f513f1ff9a93df788e38527en,
+  b: -0x3n,
+  r: 0xcd010c527d56a56a570f3e006eba1ea27e3ff3527bef11c70a4fn
 }, {
-  a: "cb79696d3a6f5d5d034e9d2",
-  b: "-d33",
-  r: "0"
+  a: 0n,
+  b: -0x1n,
+  r: 0n
 }, {
-  a: "ca99",
-  b: "10",
-  r: "ca990000"
+  a: 0x26bd28fb3e06bb0ddan,
+  b: -0xcn,
+  r: 0x26bd28fb3e06bb0n
 }, {
-  a: "6f97833d5",
-  b: "0",
-  r: "6f97833d5"
+  a: -0xa04dca5c74bdb1dbf2f0n,
+  b: -0x3fn,
+  r: -0x1409cn
 }, {
-  a: "67d36e7948d18af35f0823c0d58ba47ca0846cdfaa7a7407f09d44747275532681b343",
-  b: "f",
-  r: "33e9b73ca468c579af8411e06ac5d23e5042366fd53d3a03f84ea23a393aa99340d9a18000"
+  a: -0xd6b46ec3ead311e2e45ca4ae8aa9cf5acf4c2d6c61de06e9e36n,
+  b: -0xan,
+  r: -0x35ad1bb0fab4c478b917292ba2aa73d6b3d30b5b187781ba8n
 }, {
-  a: "f4896",
-  b: "-7",
-  r: "1e91"
+  a: -0x1f1922aen,
+  b: -0xbfn,
+  r: -0x1n
 }, {
-  a: "996ce2a9e0f7d65e0523204c9c469bfd14821efe571ac59cdc01",
-  b: "1d",
-  r: "132d9c553c1efacbc0a464099388d37fa29043dfcae358b39b8020000000"
+  a: 0x47n,
+  b: -0x2n,
+  r: 0x11n
 }, {
-  a: "-f8f",
-  b: "f1",
-  r: "-1f1e000000000000000000000000000000000000000000000000000000000000"
+  a: -0xf64n,
+  b: 0x7en,
+  r: -0x3d900000000000000000000000000000000n
 }, {
-  a: "-b685bbcd953ba9c5973ae523dc81d7b35e0cf2b9b51026d4ba1ac21bd5c3c18f9c13",
-  b: "0",
-  r: "-b685bbcd953ba9c5973ae523dc81d7b35e0cf2b9b51026d4ba1ac21bd5c3c18f9c13"
+  a: -0x78dn,
+  b: -0x85en,
+  r: -0x1n
 }, {
-  a: "e2295b362b7048fb163d1272178ed441517fc689e5ec5ea40f29",
-  b: "-30",
-  r: "e2295b362b7048fb163d1272178ed441517fc689"
+  a: -0xa03bc462b00e4113a2472eb73dn,
+  b: 0n,
+  r: -0xa03bc462b00e4113a2472eb73dn
 }, {
-  a: "-b322e816b014448f44e60b418582390d2a3ad95",
-  b: "0",
-  r: "-b322e816b014448f44e60b418582390d2a3ad95"
+  a: 0x3816aa0f01396f4abe0ee7164e211ce60ce590b615d86f6e6363c0bdd513d8a0n,
+  b: 0x4n,
+  r: 0x3816aa0f01396f4abe0ee7164e211ce60ce590b615d86f6e6363c0bdd513d8a00n
 }, {
-  a: "4c135e4d7",
-  b: "0",
-  r: "4c135e4d7"
+  a: -0xaf8711d29fdecd42a255f14aafe13b9404cced5df0af8b86080af7682cben,
+  b: 0x1n,
+  r: -0x15f0e23a53fbd9a8544abe2955fc277280999dabbe15f170c1015eed0597cn
 }, {
-  a: "-d5b694",
-  b: "f1",
-  r: "-1ab6d28000000000000000000000000000000000000000000000000000000000000"
+  a: 0x218b11dfn,
+  b: 0n,
+  r: 0x218b11dfn
 }, {
-  a: "-7994be7",
-  b: "-d",
-  r: "-3ccb"
+  a: 0x263fcb4707e6fd4a21b1f646ddd90a5e78d781c272621dcaf861d6250d7be675e067n,
+  b: -0x868n,
+  r: 0n
 }, {
-  a: "a6443add555ea15af90092e8",
-  b: "42",
-  r: "29910eb75557a856be4024ba00000000000000000"
+  a: 0x8312b459b585847682en,
+  b: 0x4en,
+  r: 0x20c4ad166d61611da0b80000000000000000000n
 }, {
-  a: "9385ed",
-  b: "e5",
-  r: "1270bda000000000000000000000000000000000000000000000000000000000"
+  a: 0xb45d42e0595a4b104b0b9a177ffdc52b401b61659fe163e720621aef8c8e6191ba7an,
+  b: 0x3n,
+  r: 0x5a2ea1702cad25882585cd0bbffee295a00db0b2cff0b1f390310d77c64730c8dd3d0n
 }, {
-  a: "-531",
-  b: "7d",
-  r: "-a620000000000000000000000000000000"
+  a: -0x42d2c4n,
+  b: 0xfdn,
+  r: -0x85a588000000000000000000000000000000000000000000000000000000000000000n
 }];
 
 var error_count = 0;
 for (var i = 0; i < data.length; i++) {
   var d = data[i];
-  var a = BigInt.parseInt(d.a, 16);
-  var b = BigInt.parseInt(d.b, 16);
-  var r = a << b;
-  if (d.r !== r.toString(16)) {
-    print("Input A:  " + a.toString(16));
-    print("Input B:  " + b.toString(16));
+  var r = d.a << d.b;
+  if (d.r !== r) {
+    print("Input A:  " + d.a.toString(16));
+    print("Input B:  " + d.b.toString(16));
     print("Result:   " + r.toString(16));
     print("Expected: " + d.r);
     print("Op: <<");
diff --git a/src/v8/test/mjsunit/harmony/bigint/sub.js b/src/v8/test/mjsunit/harmony/bigint/sub.js
index f0af2ca..21613f7 100644
--- a/src/v8/test/mjsunit/harmony/bigint/sub.js
+++ b/src/v8/test/mjsunit/harmony/bigint/sub.js
@@ -4,99 +4,95 @@
 
 // Generated by tools/bigint-tester.py.
 
-// Flags: --harmony-bigint
-
 var data = [{
-  a: "e5e5071838eb1314",
-  b: "3b7f55dce703a25ea14fdea6186156f775dec5d29f6edb3a014",
-  r: "-3b7f55dce703a25ea14fdea6186156f775d067822deb4c88d00"
+  a: 0xc4fd438551d58edn,
+  b: 0x91b42ee55a50d974an,
+  r: -0x90ef31a1d4ff03e5dn
 }, {
-  a: "-f",
-  b: "22d6805c7201a8ad4b9e6c2a7e8b5ab3bac",
-  r: "-22d6805c7201a8ad4b9e6c2a7e8b5ab3bbb"
+  a: -0x86b766ec276e390087458ce093b07b2574732d5f3f5125n,
+  b: 0x4b1fe0dd23316de1b38b343d4112fbd7e8c8d081de5dbabda7357fd9e868466693den,
+  r: -0x4b1fe0dd23316de1b38b34c3f879e7ff5701d10923ea9b5157b0a54e5b95a5a5e503n
 }, {
-  a: "-22",
-  b: "-11a0adfaedd5adb92297af1c3794ef5461dd8bc146db3",
-  r: "11a0adfaedd5adb92297af1c3794ef5461dd8bc146d91"
+  a: 0x63e1eac0d5470c8f802ec390b6415c43ed16d28d6dn,
+  b: -0xbe26927b2f6ae85b5d3062d869d22da005805d23142a236955127b6ca688c07fn,
+  r: 0xbe26927b2f6ae85b5d30633c4bbcee754c8ceca342edb41f966ebf59bd5b4decn
 }, {
-  a: "-d20c39d0",
-  b: "-46faa9d3eabcbd8b6d07adc2d0ff289d2",
-  r: "46faa9d3eabcbd8b6d07adc2c3de65002"
+  a: -0x873cf988993d97e5180fn,
+  b: -0xd791aa365f881a7f05f21f73ef390c0b37408dd0a908801682464178426an,
+  r: 0xd791aa365f881a7f05f21f73ef390c0b37408dd021cb868de908a9932a5bn
 }, {
-  a: "-e5b56109a11",
-  b: "211e1dcdf52f020ab0f16e18cc4e46027d05bfa3155b88973e630ae9a75bf2c7fbad269",
-  r: "-211e1dcdf52f020ab0f16e18cc4e46027d05bfa3155b88973e630ae9a75cd87d5cb6c7a"
+  a: -0xcb273d5b123eff101c62f016ae2896223b93b9114e40d1fn,
+  b: 0x2169f8c954623f8381bf12fd0927e1a645f5b3c6c00e58105c297ba40446208dn,
+  r: -0x2169f8c954623f838e7186d2ba4bd19747bbe2c82af0e1727fe2b735192a2dacn
 }, {
-  a: "-b682aa",
-  b: "-5fa59a6a80d39c0c885c030e9c8c84ec7",
-  r: "5fa59a6a80d39c0c885c030e9c811cc1d"
+  a: -0xe965bf745fffcf22n,
+  b: 0x7c3b92f8a030cbfca7cc5f2fd454459c79a3ac2201524468fbn,
+  r: -0x7c3b92f8a030cbfca7cc5f2fd454459c7a8d11e175b244381dn
 }, {
-  a: "-c1325b8ab9fea966f093bbfbc2e611b0e5bf0b13ce047c7133056d4eea",
-  b: "f97d5c4014c5cc87923c344a",
-  r: "-c1325b8ab9fea966f093bbfbc2e611b0e6b888700e19423dba97a98334"
+  a: 0n,
+  b: 0x6975a8ededffd265f472e660e18n,
+  r: -0x6975a8ededffd265f472e660e18n
 }, {
-  a: "-1872900ab729911a3c021db53672eda07a9ad623",
-  b: "152d13997090c43551edfc89d4c7ea5e9ffee4a114085858892e67e82edea6384aaaba7",
-  r: "-152d13997090c43551edfc89d4c7ea602727e54c86a169fc4950433b960d803ff4581ca"
+  a: -0x236bda1a3a9635190f26c3739b7342f33a27cd2568n,
+  b: 0x1a7e6n,
+  r: -0x236bda1a3a9635190f26c3739b7342f33a27cecd4en
 }, {
-  a: "5440388fc10de9",
-  b: "-4b",
-  r: "5440388fc10e34"
+  a: 0xb682b9c88f0b6d7b5e9a4f77dd0d7885d62cd162783b2e55b30b954e10caf3n,
+  b: 0x2c6574161d9aff7bbebd95e561fbd5d70d893e8c9772bcc697cddn,
+  r: 0xb682b9c88c451639fcc09f8021219f27800d140507629a6ce9946981a74e16n
 }, {
-  a: "-198dc54795a81722f70acc9cc20505492172c7819ba168e57d",
-  b: "-48f3b40bf850f771d44e423eb266846801d9e4e920c",
-  r: "-198dc543066cd66371fb557f7d20e15dfb0a81017e031a5371"
+  a: 0xdd6aa5240c4n,
+  b: 0xb9c7bef20c0cc0f814cce3c40d43e4c26en,
+  r: -0xb9c7bef20c0cc0f814cce3b636999281aan
 }, {
-  a: "c78082429b3163ce243c778",
-  b: "-97afe29",
-  r: "c78082429b3163cebbec5a1"
+  a: 0x35cd14329d5f81dbn,
+  b: 0x25997b1f3500f9b27f2ceean,
+  r: -0x25997b1bd82fb688a934d0fn
 }, {
-  a: "-50df",
-  b: "-d5352ec9c1b0e62b97ea1363ce8b72",
-  r: "d5352ec9c1b0e62b97ea1363ce3a93"
+  a: -0x55ec15d7ed316df3fc7bcfcce0f0a6d7034113bad6d74bae88d4aab03032n,
+  b: 0x9d09b8869aab44d6690fad48c8dffd0e18cc21fb26c2a80ac08fd4f42296f46d37cddn,
+  r: -0x9d09b886a00a0633e7e2c42808a7ba0ae6db2c6896f6b9466dfd49af0b243f183ad0fn
 }, {
-  a: "-5c9777f93d64636ff8bcda39125625aa58a49e9a4f29ece2b7afa5d",
-  b: "894bb7aa90b8687e6290c3218a4258dac9400d556caafe02cf8c312c053f2fc73",
-  r: "-894bb7aa9114fff65bce2784fa3b15b50252637b1703a2a169db5b18e7f6df6d0"
+  a: 0n,
+  b: -0xfbf3b308a6066d497e1cn,
+  r: 0xfbf3b308a6066d497e1cn
 }, {
-  a: "-e15c51f0627e460c477",
-  b: "-dfd13bac43ebe2f8e77f5b31314843",
-  r: "dfd13bac43ddcd33c879334cd083cc"
+  a: 0x6acfc1e4b681be9582cd28453387ed2c29f5eb4cd6d78aaac67n,
+  b: -0x4f5997n,
+  r: 0x6acfc1e4b681be9582cd28453387ed2c29f5eb4cd6d78fa05fen
 }, {
-  a: "0",
-  b: "adbd3e4b06b92771ae25eb52fca5fc86391303ebf7962",
-  r: "-adbd3e4b06b92771ae25eb52fca5fc86391303ebf7962"
+  a: -0xc93eb5cae0c90eb77e702ccb44eea6180829d0b360872n,
+  b: 0xdn,
+  r: -0xc93eb5cae0c90eb77e702ccb44eea6180829d0b36087fn
 }, {
-  a: "960a8aa627a1c48721f4e0",
-  b: "-9e8742ae61615481cdd12f0728f0b61",
-  r: "9e8742ae6ac1fd2c304b4b4f9b10041"
+  a: -0x324ef140a16c5c20a9a189a720136f4836ea98056n,
+  b: 0x49471582a658bf5524128e130b3378d29331baa8eb8n,
+  r: -0x49796473e6fa2bb144bc2f9cb2538c41db68a540f0en
 }, {
-  a: "-abf5cf9ff3c15b0645009",
-  b: "-e805773176aaa712d144e172db033c64aeaddf3380b2",
-  r: "e805773176aaa712d144e1681ba6426572982ecf30a9"
+  a: 0x6f15ac8490de4e308286fdde1142ad0052c2cn,
+  b: 0x9ca6c715de18d7f64a751452e967b5807eec951777245ce5fe3n,
+  r: -0x9ca6c715de18d78734c88fc20b1984fdf7eeb70634775c933b7n
 }, {
-  a: "349ebb89b13a7149ec1a4e067574c3825f90ec4e4413948b808c6a",
-  b: "-44cdc0e3efa11513525f68163033a59d7b0610070",
-  r: "349ebb89b13a7596c8288d0086c5f8a856124f517e6d6c3be18cda"
+  a: -0xc303adn,
+  b: 0x5ec0a706a54978a59b10007942e563957ad22e708678fbfdb02862b2c3n,
+  r: -0x5ec0a706a54978a59b10007942e563957ad22e708678fbfdb02925b670n
 }, {
-  a: "a86c53e8c49b20cff057882c4345c40f5c34a8cb8",
-  b: "-76453703c781511b52e663",
-  r: "a86c53e8c49b20cff05eec7fb3823c246de9d731b"
+  a: -0xdb736b5f3979c24f70aafa5f17711d725d552a9778e1n,
+  b: 0x70b56a0773498a45b796cf79ea18211614cn,
+  r: -0xdb736b5f408518efe7df930372ea8a69fbf6aca8da2dn
 }, {
-  a: "-2647d3c",
-  b: "776e5b3a57bd5196be1b9c99ae899d949cb2b94310c53be8910db71b",
-  r: "-776e5b3a57bd5196be1b9c99ae899d949cb2b94310c53be893723457"
+  a: 0xe91b9a797168c6b7440f946n,
+  b: -0x2588c1301521dd9646a2e22e3aca462ca95e76069be2f7b95d8bb81ccn,
+  r: 0x2588c1301521dd9646a2e22e3aca462caa4791a11554608014cfc7b12n
 }];
 
 var error_count = 0;
 for (var i = 0; i < data.length; i++) {
   var d = data[i];
-  var a = BigInt.parseInt(d.a, 16);
-  var b = BigInt.parseInt(d.b, 16);
-  var r = a - b;
-  if (d.r !== r.toString(16)) {
-    print("Input A:  " + a.toString(16));
-    print("Input B:  " + b.toString(16));
+  var r = d.a - d.b;
+  if (d.r !== r) {
+    print("Input A:  " + d.a.toString(16));
+    print("Input B:  " + d.b.toString(16));
     print("Result:   " + r.toString(16));
     print("Expected: " + d.r);
     print("Op: -");
diff --git a/src/v8/test/mjsunit/harmony/bigint/tonumber.js b/src/v8/test/mjsunit/harmony/bigint/tonumber.js
index d2802a7..a6f7d13 100644
--- a/src/v8/test/mjsunit/harmony/bigint/tonumber.js
+++ b/src/v8/test/mjsunit/harmony/bigint/tonumber.js
@@ -2,10 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-bigint
-
 function Check(bigint, number_string) {
-  var number = Number(number_string);
+  var number = Number(bigint);
   if (number_string.substring(0, 2) === "0x") {
     assertEquals(number_string.substring(2), number.toString(16));
   } else {
@@ -29,6 +27,19 @@
 Check(0x7ffffffffffffen, "0x80000000000000");  // 55 bits, tie to even.
 Check(0x7fffffffffffffn, "0x80000000000000");  // 55 bits, rounding up.
 Check(0x1ffff0000ffff0000n, "0x1ffff0000ffff0000");  // 65 bits.
+Check(100000000000000008192n, "100000000000000000000");  // Tie to even.
+
+// Check the cornercase where the most significant cut-off bit is 1.
+// If a digit beyond the mantissa is non-zero, we must round up;
+// otherwise tie to even.
+// ...digit2 ][    digit1    ][    digit0    ]
+//        [ mantissa  ]
+Check(0x01000000000000080000000000000000001000n,
+      "0x1000000000000100000000000000000000000");
+Check(0x01000000000000080000000000000000000000n,
+      "0x1000000000000000000000000000000000000");
+Check(0x01000000000000180000000000000000000000n,
+      "0x1000000000000200000000000000000000000");
 
 // Values near infinity.
 Check(1n << 1024n, "Infinity");
diff --git a/src/v8/test/mjsunit/harmony/bigint/turbo.js b/src/v8/test/mjsunit/harmony/bigint/turbo.js
index 87130ea..f32f22e 100644
--- a/src/v8/test/mjsunit/harmony/bigint/turbo.js
+++ b/src/v8/test/mjsunit/harmony/bigint/turbo.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --harmony-bigint
+// Flags: --allow-natives-syntax
 
 'use strict'
 
@@ -19,6 +19,7 @@
 
 function Test(f, ...cases) {
   for (let i = 0; i < cases.length; ++i) {
+    %PrepareFunctionForOptimization(f);
     test(f, cases[i]);
     %OptimizeFunctionOnNextCall(f);
     for (let j = 0; j < cases.length; ++j) {
@@ -31,7 +32,7 @@
 
 function V(input, expected_value) {
   function check(result) {
-    assertFalse(result.exception, input);
+    assertFalse(result.exception, `unexpected exception ${result.value} on input ${input}`);
     assertEquals(expected_value, result.value);
   }
   return {input, check};
@@ -39,7 +40,7 @@
 
 function E(input, expected_exception) {
   function check(result) {
-    assertTrue(result.exception, input);
+    assertTrue(result.exception, `expected exception ${expected_exception.name} on input ${input}`);
     assertInstanceof(result.value, expected_exception);
   }
   return {input, check};
@@ -56,10 +57,15 @@
 // inputs.
 ////////////////////////////////////////////////////////////////////////////////
 
-
 Test(x => Number(x),
     V(1n, 1), V(1, 1), V("", 0), V(1.4, 1.4), V(null, 0), V(six, 6));
 
+Test(x => Math.trunc(+x),
+    E(1n, TypeError), V(1, 1), V("", 0), V(1.4, 1), V(null, 0), E(six, TypeError));
+
+Test(x => Math.trunc(Number(x)),
+    V(1n, 1), V(1, 1), V("", 0), V(1.4, 1), V(null, 0), V(six, 6));
+
 Test(x => String(x),
     V(1n, "1"), V(1, "1"), V(1.4, "1.4"), V(null, "null"), V(six, "6"));
 
diff --git a/src/v8/test/mjsunit/harmony/bigint/typedarray.js b/src/v8/test/mjsunit/harmony/bigint/typedarray.js
new file mode 100644
index 0000000..93021a3
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/bigint/typedarray.js
@@ -0,0 +1,241 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var intarray = new BigInt64Array(8);
+var uintarray = new BigUint64Array(8);
+
+function test(f) {
+  %PrepareFunctionForOptimization(f);
+  f();
+  f();  // Make sure we test ICs.
+  f();
+  %OptimizeFunctionOnNextCall(f);
+  f();
+}
+
+function test_both(f) {
+  test(() => f(BigInt64Array));
+  test(() => f(BigUint64Array));
+}
+
+test(function basic_assignment() {
+  const x = 0x1234567890abcdefn;
+  intarray[0] = x;
+  assertEquals(x, intarray[0]);
+  uintarray[0] = x;
+  assertEquals(x, uintarray[0]);
+  const y = -0x76543210fedcba98n;
+  intarray[0] = y;
+  assertEquals(y, intarray[0]);
+});
+
+test(function construct() {
+  var a = new BigInt64Array([1n, -2n, {valueOf: () => 3n}]);
+  assertArrayEquals([1n, -2n, 3n], a);
+  assertThrows(() => new BigInt64Array([4, 5]), TypeError);
+  var b = new BigUint64Array([6n, -7n]);
+  assertArrayEquals([6n, 0xfffffffffffffff9n], b);
+  var c = new BigUint64Array(new BigInt64Array([8n, -9n]));
+  assertArrayEquals([8n, 0xfffffffffffffff7n], c);
+  var d = new BigInt64Array(new BigUint64Array([10n, 0xfffffffffffffff5n]));
+  assertArrayEquals([10n, -11n], d);
+  assertThrows(() => new BigInt64Array(new Int32Array([12, 13])), TypeError);
+  assertThrows(() => new Int32Array(new BigInt64Array([14n, -15n])), TypeError);
+});
+
+test_both(function copyWithin(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  a.copyWithin(0, 1, 3);
+  assertArrayEquals([2n, 3n, 3n], a);
+});
+
+test_both(function entries(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  var it = a.entries();
+  assertEquals([0, 1n], it.next().value);
+  assertEquals([1, 2n], it.next().value);
+  assertEquals([2, 3n], it.next().value);
+  assertTrue(it.next().done);
+});
+
+test_both(function every(BigArray) {
+  var a = BigArray.of(2n, 3n, 4n);
+  var seen = [];
+  assertTrue(a.every((x) => {seen.push(x); return x > 1n}));
+  assertEquals([2n, 3n, 4n], seen);
+});
+
+test_both(function fill(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n, 4n);
+  a.fill(7n, 1, 3);
+  assertArrayEquals([1n, 7n, 7n, 4n], a);
+  assertThrows(() => (new BigArray(3).fill(1)), TypeError);
+});
+
+test_both(function filter(BigArray) {
+  var a = BigArray.of(1n, 3n, 4n, 2n);
+  var b = a.filter((x) => x > 2n);
+  assertArrayEquals([3n, 4n], b);
+});
+
+test_both(function find(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  assertEquals(2n, a.find((x) => x === 2n));
+  assertEquals(undefined, a.find((x) => x === 2));
+});
+
+test_both(function findIndex(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  assertEquals(1, a.findIndex((x) => x === 2n));
+  assertEquals(-1, a.findIndex((x) => x === 2));
+});
+
+test_both(function forEach(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  var seen = [];
+  a.forEach((x) => seen.push(x));
+  assertEquals([1n, 2n, 3n], seen);
+});
+
+test_both(function from(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  var b = BigArray.from(a);
+  assertArrayEquals([1n, 2n, 3n], b);
+  assertThrows(() => BigArray.from([4, 5]), TypeError);
+  var c = BigArray.from([6, 7], BigInt);
+  assertArrayEquals([6n, 7n], c);
+  assertThrows(() => Int32Array.from([4n, 5n]), TypeError);
+  assertThrows(() => Int32Array.from([4, 5], BigInt), TypeError);
+});
+
+test(function from_mixed() {
+  var contents = [1n, 2n, 3n];
+  var a = new BigInt64Array(contents);
+  var b = BigUint64Array.from(a);
+  assertArrayEquals(contents, b);
+  var c = BigInt64Array.from(b);
+  assertArrayEquals(contents, c);
+});
+
+test_both(function includes(BigArray) {
+  var a = BigArray.of(0n, 1n, 2n);
+  assertTrue(a.includes(1n));
+  assertFalse(a.includes(undefined));
+  assertFalse(a.includes(1));
+  assertFalse(a.includes(0x1234567890abcdef123n));  // More than 64 bits.
+});
+
+test_both(function indexOf(BigArray) {
+  var a = BigArray.of(0n, 1n, 2n);
+  assertEquals(1, a.indexOf(1n));
+  assertEquals(-1, a.indexOf(undefined));
+  assertEquals(-1, a.indexOf(1));
+  assertEquals(-1, a.indexOf(0x1234567890abcdef123n));  // More than 64 bits.
+});
+
+test_both(function join(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  assertEquals("1-2-3", a.join("-"));
+});
+
+test_both(function keys(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  var it = a.keys();
+  assertEquals(0, it.next().value);
+  assertEquals(1, it.next().value);
+  assertEquals(2, it.next().value);
+  assertTrue(it.next().done);
+});
+
+test_both(function lastIndexOf(BigArray) {
+  var a = BigArray.of(0n, 1n, 2n);
+  assertEquals(1, a.lastIndexOf(1n));
+  assertEquals(-1, a.lastIndexOf(undefined));
+  assertEquals(-1, a.lastIndexOf(1));
+  assertEquals(-1, a.lastIndexOf(0x1234567890abcdef123n));  // > 64 bits.
+});
+
+test_both(function map(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  var b = a.map((x) => 2n * x);
+  assertEquals(BigArray, b.constructor);
+  assertArrayEquals([2n, 4n, 6n], b);
+});
+
+test_both(function of(BigArray) {
+  var a = BigArray.of(true, 2n, {valueOf: () => 3n}, "4");
+  assertArrayEquals([1n, 2n, 3n, 4n], a);
+  assertThrows(() => BigArray.of(1), TypeError)
+  assertThrows(() => BigArray.of(undefined), TypeError)
+});
+
+test_both(function reduce(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  assertEquals(6n, a.reduce((sum, x) => sum + x, 0n));
+});
+
+test_both(function reduceRight(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  assertEquals(6n, a.reduce((sum, x) => sum + x, 0n));
+});
+
+test_both(function reverse(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  a.reverse();
+  assertArrayEquals([3n, 2n, 1n], a);
+});
+
+test_both(function set(BigArray) {
+  var a = new BigArray(7);
+  a.set(BigArray.of(1n, 2n, 3n), 2);
+  assertArrayEquals([0n, 0n, 1n, 2n, 3n, 0n, 0n], a);
+  a.set([4n, 5n, 6n], 1);
+  assertArrayEquals([0n, 4n, 5n, 6n, 3n, 0n, 0n], a);
+  assertThrows(() => a.set([7, 8, 9], 3), TypeError);
+  assertThrows(() => a.set(Int32Array.of(10, 11), 2), TypeError);
+
+  var Other = BigArray == BigInt64Array ? BigUint64Array : BigInt64Array;
+  a.set(Other.of(12n, 13n), 4);
+  assertArrayEquals([0n, 4n, 5n, 6n, 12n, 13n, 0n], a);
+});
+
+test_both(function slice(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n, 4n);
+  var b = a.slice(1, 3);
+  assertArrayEquals([2n, 3n], b);
+});
+
+test_both(function some(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  assertTrue(a.some((x) => x === 2n));
+});
+
+test_both(function sort(BigArray) {
+  var a = BigArray.of(7n, 2n, 5n, 3n);
+  a.sort();
+  assertArrayEquals([2n, 3n, 5n, 7n], a);
+});
+
+test_both(function subarray(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n, 4n);
+  var b = a.subarray(1, 3);
+  assertEquals(BigArray, b.constructor);
+  assertArrayEquals([2n, 3n], b);
+});
+
+test_both(function toString(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  assertEquals("1,2,3", a.toString());
+});
+
+test_both(function values(BigArray) {
+  var a = BigArray.of(1n, 2n, 3n);
+  var it = a.values();
+  assertEquals(1n, it.next().value);
+  assertEquals(2n, it.next().value);
+  assertEquals(3n, it.next().value);
+  assertTrue(it.next().done);
+});
diff --git a/src/v8/test/mjsunit/harmony/bigint/xor.js b/src/v8/test/mjsunit/harmony/bigint/xor.js
index d8c9012..cf32b65 100644
--- a/src/v8/test/mjsunit/harmony/bigint/xor.js
+++ b/src/v8/test/mjsunit/harmony/bigint/xor.js
@@ -4,99 +4,95 @@
 
 // Generated by tools/bigint-tester.py.
 
-// Flags: --harmony-bigint
-
 var data = [{
-  a: "abde23cae3113c95ec7f444c7277658",
-  b: "-65e40fb1",
-  r: "-abde23cae3113c95ec7f444a2c379e9"
+  a: -0x46505bec40d461c595b5e4be178b7d00n,
+  b: -0x9170e5437d4e3ec7c0971e2c6d3bbbd2929ff108ea4ee64f7a91aa367fn,
+  r: 0x9170e5437d4e3ec7c0971e2c6d7deb897edf25692fdb53abc486214a81n
 }, {
-  a: "2d0bbdc05059c78b7e9f43689b2f7a9afaefd679212c2a9b990",
-  b: "29fcdb109b54650f9762b494916bc1cf14853430697febe7acf4327983ce0c6c4c183",
-  r: "29fcdb109b54650f974fbf29513b98089ffbab7301e4c49d360eddaffaef2046d7813"
+  a: -0x49171f24aa9660f7f854148018a8b03256200508n,
+  b: 0x75c2103e4e8e52d0311n,
+  r: -0x49171f24aa9660f7f85413dc39ab54dab30d0617n
 }, {
-  a: "b958dc77068d01811e031d6320df5e53823697be94f7654340b",
-  b: "-c1f5ca609a658e24fc33fec10a84b18fb745cb7c6",
-  r: "-b958dc77064cf44b7e9978ed04236dad433c130f1b4020883cf"
+  a: -0x3cde31210d299e4f6734f76c4f2df3056fn,
+  b: -0x402b7fe66d16877867f43n,
+  r: 0x3cde31210d299a4dd0ca91bd275a757a2cn
 }, {
-  a: "cf7319e3fe16912370c830906f88b",
-  b: "98d972f3c",
-  r: "cf7319e3fe16912370c8a8491d7b7"
+  a: 0x727n,
+  b: 0xe1c82371da63bdb801273077095be8977ff9f14aa619829bf4b418n,
+  r: 0xe1c82371da63bdb801273077095be8977ff9f14aa619829bf4b33fn
 }, {
-  a: "aea6d9e7cec74bca19",
-  b: "5abbcd0c5aa1f96fef9db32b3618de782db64b8f6b4",
-  r: "5abbcd0c5aa1f96fef9db32b3cf2b3e6515a3f33cad"
+  a: 0x7c2b1e0918a85bf5faea9077b7dn,
+  b: -0xed714ba58fd54b19n,
+  r: -0x7c2b1e0918a68ce140b26d23066n
 }, {
-  a: "-b522a022e90fa094f3b729a7a0a914349f5e1fd778829d7576ad36711",
-  b: "-aa00d2fd6a7636",
-  r: "b522a022e90fa094f3b729a7a0a914349f5e1fd778883d78597b91125"
+  a: 0x1dded5fd695f4babcan,
+  b: 0x7e1cb4346c68e84f8fbdd3501daead2ce99a90e56038n,
+  r: 0x7e1cb4346c68e84f8fbdd3501db373f914f3cfaecbf2n
 }, {
-  a: "9c2bc822ec4a590eb8a77ee630009713090",
-  b: "30b13459c1434",
-  r: "9c2bc822ec4a590eb8a77ed68134ced24a4"
+  a: 0xec7d9595de759652a3bb96c80edca63790c32ce7f6cf0ef0n,
+  b: -0x67f0feef424f56d6ae6856a20901199de53ebn,
+  r: -0xec7d9595de73e95d4d4fb23d63b640b2fae3bcf66f115d1bn
 }, {
-  a: "-f14873e1f6121d584d5541073c7ce162873e156b72fb3c943ffd5f212c0d6",
-  b: "f449f0a292048546924d2973626f5441c045d4adbfd00d301791f0db965f",
-  r: "-fe0cecebdf32550c247193900a5a14269b3a4821a9063c473e84402c9568b"
+  a: 0x69ab204291f752866c3d49fdf1d656298f43e896cea3ef31a04n,
+  b: -0x5f5b2fd130e33ed76fa22de5ac70bdf96dee80a09e3107e1c93a135ea80b7e3640cdn,
+  r: -0x5f5b2fd130e33ed769389fe1856fc8d10b2d543f412c628351ce2dd7c4e140c55ac9n
 }, {
-  a: "83d5552fba4213d8dd1ed9bc6c2",
-  b: "4f7ccc10ba9b6880b862f8d5e1c9",
-  r: "47419942413f49bd35b3154e270b"
+  a: -0xd396d40076en,
+  b: 0x3158623c80393n,
+  r: -0x318bf4e8804ffn
 }, {
-  a: "9fdb44741177921c8338b70fc7fa362295bfc92f6275fa16492",
-  b: "93676e5ef972",
-  r: "9fdb44741177921c8338b70fc7fa362295bfc92654031ff9de0"
+  a: 0x8c1dbfbd68007d171986777446303896a1ee46n,
+  b: -0x75fd69710f5bea1cece9d59ec4bca29712b49dcf5ee5cc3299d7fb4fb024f10ae955fn,
+  r: -0x75fd69710f5bea1cece9d59ec4bca29fd36f6619dee21d4301b08c0bd3277860f7b19n
 }, {
-  a: "4355637ed",
-  b: "-7aeb3013cc5eb39d56eed8104407a3e68039944f7673a0c75bd3",
-  r: "-7aeb3013cc5eb39d56eed8104407a3e68039944f767795916c40"
+  a: -0x4c6e3ccbabdd6f58450ec3ec8adfb10831b70893cb996f0ac97a0ae2f3a943185d1n,
+  b: 0xeb136731a19867949d46886e62050c4b446767a076c73dn,
+  r: -0x4c6e3ccbabdd6f58450ecd5dbcacab11b7ce4147a31f892a99bebea485d344742een
 }, {
-  a: "7fdf50188f716c13feced67a1c33ecf422",
-  b: "-7106cd7b9",
-  r: "-7fdf50188f716c13feced67a1b2380239b"
+  a: 0xeaff60e10ebb4b8f2da6a517n,
+  b: -0x17af62a3e808af1be3d864132dfd7363bc95872580585d7a9904n,
+  r: -0x17af62a3e808af1be3d864132dfd999cdc74899ecbd770dc3c15n
 }, {
-  a: "368cf8d0f5790a03774b9a1e116f82281ebd9e18de7f54a7d91f50",
-  b: "8bc4e4f24ce2a7d037079552e6c7db2795f15c92a01f4e0d9",
-  r: "368cf06cbb362ecd5d36996e683aac44630fe747cbb67ea62dff89"
+  a: -0xd4424b4f09210108076d63bd621180f280df8f4480n,
+  b: -0x20953185dd2c534b3cb8da73ce55ab386d62fe8a793a1e74cdf3ad95f3cc2573b3n,
+  r: 0x20953185dd2c534b3cb8da731a17e0776443ff827e577dc9afe22d677313aa37cdn
 }, {
-  a: "-7466a596078a20cc4eca96953e3",
-  b: "-666328e5437b1475dcfe2f44f1c6a82af82ce7ee7cf229c8398836d2d834f9014",
-  r: "666328e5437b1475dcfe2f44f1c6a82af82ce79a1a57bfcfb3a8fa9c12a26c3f1"
+  a: 0x84317d7ec6df6dbfe9413cee812ff95c587f61c7b8de5828d445a69555cff26fba9n,
+  b: -0x853c667aed62685df5993748e5668802b7bf918f8c1222a5267c33f013ff1e10f1b909n,
+  r: -0x8534256d3a8e05ab2e67a35b2b8e9afd227a16799069af40a4f177aa7aaa42efd742a2n
 }, {
-  a: "ad284b70a22d96bdefba53f134c65a1e4958013bb9a31f091fde6fc89",
-  b: "-c89374df2",
-  r: "-ad284b70a22d96bdefba53f134c65a1e4958013bb9a31f09d74d1b179"
+  a: -0xe3b4bf724b172b23c5834ed6f70f984ab3b146070770cbc3b86779db7n,
+  b: -0x68166de3a03d9efce30cb36e242db000c850c0d4f454594e23a1a7cn,
+  r: 0xe3dca91fa8b716bd39604265992bb5fab37916c7d3849f9af644d87cdn
 }, {
-  a: "-47df52354db5",
-  b: "-aa7f61aba9ad859e803e964418af30",
-  r: "aa7f61aba9ad859e807949162de29b"
+  a: -0x5358b8efb260b40e37cb5b45eb4e7864n,
+  b: -0x3e617e3967a5b3554ebf24f1e51a253dfc20a76ef01f02442fn,
+  r: 0x3e617e3967a5b3554eec7c490aa84589f2176c35b5f44c3c4dn
 }, {
-  a: "-f03ea80f22a3dc03f036b13f85faf5fb1",
-  b: "86e9110772d369fdd52b45a8fb22cea26cb73e908408f8a3cdf637f0042c8efdc11",
-  r: "-86e9110772d369fdd52b45a8fb22cea26c4700388b2a5b7fce0601413ba974083a2"
+  a: -0x702359917a8aceedc381n,
+  b: -0x714f08d9c29e9fc0044982eb2469707896265n,
+  r: 0x714f08d9c29e9fc0034bb77233c1dc964a1e4n
 }, {
-  a: "3603d29c8",
-  b: "f4849ec3ec3c352b",
-  r: "f4849ec08c011ce3"
+  a: -0x455ac38dn,
+  b: -0x6152562bf5b6f785abec41e8625bccd3bf3067225733dan,
+  r: 0x6152562bf5b6f785abec41e8625bccd3bf3067670df055n
 }, {
-  a: "e6668ed8eae8b4bb7bdf522d44e9f1bcf66",
-  b: "361cab4f5be1",
-  r: "e6668ed8eae8b4bb7bdf522e25234549487"
+  a: 0x47n,
+  b: 0xa3d30490286ddf5d4f4256n,
+  r: 0xa3d30490286ddf5d4f4211n
 }, {
-  a: "-d0395d",
-  b: "-4a8ee89d006d22a124070241caf5f4343bdfd30d12",
-  r: "4a8ee89d006d22a124070241caf5f4343bdf03344d"
+  a: -0x530cc599859ccdbbb3c1dcb46248a4474c63323cc58a7891da79e0322b91c795ac57n,
+  b: 0x2d986083244cd488657c947a952ae15b23d90ebbc34daan,
+  r: -0x530cc599859ccdbbb3c1dc99fa28276300b7ba59b91e0204f098bb11f29f7c56e1fdn
 }];
 
 var error_count = 0;
 for (var i = 0; i < data.length; i++) {
   var d = data[i];
-  var a = BigInt.parseInt(d.a, 16);
-  var b = BigInt.parseInt(d.b, 16);
-  var r = a ^ b;
-  if (d.r !== r.toString(16)) {
-    print("Input A:  " + a.toString(16));
-    print("Input B:  " + b.toString(16));
+  var r = d.a ^ d.b;
+  if (d.r !== r) {
+    print("Input A:  " + d.a.toString(16));
+    print("Input B:  " + d.b.toString(16));
     print("Result:   " + r.toString(16));
     print("Expected: " + d.r);
     print("Op: ^");
diff --git a/src/v8/test/mjsunit/harmony/bigintarray-keyedstore-tobigint.js b/src/v8/test/mjsunit/harmony/bigintarray-keyedstore-tobigint.js
new file mode 100644
index 0000000..18ba0ff
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/bigintarray-keyedstore-tobigint.js
@@ -0,0 +1,62 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let TypedArrayConstructors = [
+  BigUint64Array,
+  BigInt64Array,
+];
+
+// Test KeyedStore in uninitialized and monomorphic states.
+for (let C of TypedArrayConstructors) {
+  let keyedSta = function(array) {
+    var didRun = false;
+    array[0] = {
+      valueOf() {
+        didRun = true;
+        return 42n;
+      }
+    };
+
+    return { didRun, array };
+  };
+
+  for (var i = 0; i < 3; ++i) {
+    var { didRun, array } = keyedSta(new C(1));
+    assertTrue(didRun);
+    assertEquals(array[0], 42n);
+
+    // OOB store
+    // FIXME: Throw a TypeError when storing OOB in a TypedArray.
+    var { didRun } = keyedSta(new C);
+    assertTrue(didRun);
+  }
+}
+
+// Test KeyedStore in polymorphic and megamorphic states.
+do {
+  let keyedSta = function(array) {
+    var didRun = false;
+    array[0] = {
+      valueOf() {
+        didRun = true;
+        return 42n;
+      }
+    };
+
+    return { didRun, array };
+  };
+
+  for (var i = 0; i < 3; ++i) {
+    for (var C of TypedArrayConstructors) {
+      var { didRun, array } = keyedSta(new C(1));
+      assertTrue(didRun);
+      assertEquals(array[0], 42n);
+
+      // OOB store
+      // FIXME: Throw a TypeError when storing OOB in a TypedArray.
+      var { didRun } = keyedSta(new C);
+      assertTrue(didRun);
+    }
+  }
+} while (false);
diff --git a/src/v8/test/mjsunit/harmony/block-lazy-compile.js b/src/v8/test/mjsunit/harmony/block-lazy-compile.js
index a6efcbf..2957a65 100644
--- a/src/v8/test/mjsunit/harmony/block-lazy-compile.js
+++ b/src/v8/test/mjsunit/harmony/block-lazy-compile.js
@@ -43,6 +43,7 @@
 }
 
 var o = f();
+%PrepareFunctionForOptimization(o);
 assertEquals(1, o());
 assertEquals(2, o());
 assertEquals(3, o());
diff --git a/src/v8/test/mjsunit/harmony/for-await-of.js b/src/v8/test/mjsunit/harmony/for-await-of.js
index e23758a..1b4fcd7 100644
--- a/src/v8/test/mjsunit/harmony/for-await-of.js
+++ b/src/v8/test/mjsunit/harmony/for-await-of.js
@@ -1257,7 +1257,7 @@
   testFailure = error;
 });
 
-%RunMicrotasks();
+%PerformMicrotaskCheckpoint();
 
 if (testFailed) {
   throw testFailure;
diff --git a/src/v8/test/mjsunit/harmony/function-tostring.js b/src/v8/test/mjsunit/harmony/function-tostring.js
index 949ac22..2af14f1 100644
--- a/src/v8/test/mjsunit/harmony/function-tostring.js
+++ b/src/v8/test/mjsunit/harmony/function-tostring.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-function-tostring
-
 var prefix = "/*before*/";
 var suffix = "/*after*/";
 
@@ -122,3 +120,49 @@
 testDynamicFunction("a,/*A*/b", "return a");
 testDynamicFunction("/*A*/a,b", "return a");
 testDynamicFunction("a,b", "return a/*A*/");
+
+// Proxies of functions should not throw, but return a NativeFunction.
+assertEquals("function () { [native code] }",
+             new Proxy(function () { hidden }, {}).toString());
+assertEquals("function () { [native code] }",
+             new Proxy(() => { hidden }, {}).toString());
+assertEquals("function () { [native code] }",
+             new Proxy(class {}, {}).toString());
+assertEquals("function () { [native code] }",
+             new Proxy(function() { hidden }.bind({}), {}).toString());
+assertEquals("function () { [native code] }",
+             new Proxy(function*() { hidden }, {}).toString());
+assertEquals("function () { [native code] }",
+             new Proxy(async function() { hidden }, {}).toString());
+assertEquals("function () { [native code] }",
+             new Proxy(async function*() { hidden }, {}).toString());
+assertEquals("function () { [native code] }",
+             new Proxy({ method() { hidden } }.method, {}).toString());
+
+// Assert that we return a NativeFunction for script that has too large an
+// offset between function token position and start position for us to return
+// an exact representation of the source code.
+function testLongFunctionTokenOffset(functionType) {
+  var expected = "function f() { [native code] }";
+  // Spec requires that we return something that will cause eval to throws if we
+  // can't reproduce the function's source code.
+  assertThrows(() => eval(expected), SyntaxError);
+
+  var functionSource = functionType + " ".repeat(65535) + " f(){}";
+
+  // Function declaration
+  eval(functionSource);
+  assertEquals(expected, f.toString());
+
+  // Function expression
+  var f = eval("(" + functionSource + ")");
+  assertEquals(expected, f.toString());
+}
+testLongFunctionTokenOffset("function");
+testLongFunctionTokenOffset("function*");
+testLongFunctionTokenOffset("async function");
+testLongFunctionTokenOffset("async function*");
+
+// Non-callable proxies still throw.
+assertThrows(() => Function.prototype.toString.call(new Proxy({}, {})),
+             TypeError);
diff --git a/src/v8/test/mjsunit/harmony/futex.js b/src/v8/test/mjsunit/harmony/futex.js
index 4dbd9cd..188832c 100644
--- a/src/v8/test/mjsunit/harmony/futex.js
+++ b/src/v8/test/mjsunit/harmony/futex.js
@@ -107,6 +107,7 @@
 (function TestWakePositiveInfinity() {
   var i32a = new Int32Array(new SharedArrayBuffer(16));
   Atomics.wake(i32a, 0, Number.POSITIVE_INFINITY);
+  Atomics.notify(i32a, 0, Number.POSITIVE_INFINITY);
 })();
 
 // In a previous version, this test caused a check failure
@@ -121,7 +122,7 @@
 
 if (this.Worker) {
 
-  var TestWaitWithTimeout = function(timeout) {
+  var TestWaitWithTimeout = function(notify, timeout) {
     var sab = new SharedArrayBuffer(16);
     var i32a = new Int32Array(sab);
 
@@ -132,47 +133,49 @@
          postMessage(result);
        };`;
 
-    var worker = new Worker(workerScript);
+    var worker = new Worker(workerScript, {type: 'string'});
     worker.postMessage({sab: sab, offset: offset});
 
     // Spin until the worker is waiting on the futex.
     while (%AtomicsNumWaitersForTesting(i32a, 0) != 1) {}
 
-    Atomics.wake(i32a, 0, 1);
+    notify(i32a, 0, 1);
     assertEquals("ok", worker.getMessage());
     worker.terminate();
 
-    var worker2 = new Worker(workerScript);
+    var worker2 = new Worker(workerScript, {type: 'string'});
     var offset = 8;
     var i32a2 = new Int32Array(sab, offset);
     worker2.postMessage({sab: sab, offset: offset});
 
     // Spin until the worker is waiting on the futex.
     while (%AtomicsNumWaitersForTesting(i32a2, 0) != 1) {}
-    Atomics.wake(i32a2, 0, 1);
+    notify(i32a2, 0, 1);
     assertEquals("ok", worker2.getMessage());
     worker2.terminate();
 
     // Futex should work when index and buffer views are different, but
     // the real address is the same.
-    var worker3 = new Worker(workerScript);
+    var worker3 = new Worker(workerScript, {type: 'string'});
     i32a2 = new Int32Array(sab, 4);
     worker3.postMessage({sab: sab, offset: 8});
 
     // Spin until the worker is waiting on the futex.
     while (%AtomicsNumWaitersForTesting(i32a2, 1) != 1) {}
-    Atomics.wake(i32a2, 1, 1);
+    notify(i32a2, 1, 1);
     assertEquals("ok", worker3.getMessage());
     worker3.terminate();
   };
 
   // Test various infinite timeouts
-  TestWaitWithTimeout(undefined);
-  TestWaitWithTimeout(NaN);
-  TestWaitWithTimeout(Infinity);
+  TestWaitWithTimeout(Atomics.wake, undefined);
+  TestWaitWithTimeout(Atomics.wake, NaN);
+  TestWaitWithTimeout(Atomics.wake, Infinity);
+  TestWaitWithTimeout(Atomics.notify, undefined);
+  TestWaitWithTimeout(Atomics.notify, NaN);
+  TestWaitWithTimeout(Atomics.notify, Infinity);
 
-
-  (function TestWakeMulti() {
+  var TestWakeMulti = function(notify) {
     var sab = new SharedArrayBuffer(20);
     var i32a = new Int32Array(sab);
 
@@ -202,7 +205,7 @@
     var id;
     var workers = [];
     for (id = 0; id < 4; id++) {
-      workers[id] = new Worker(workerScript);
+      workers[id] = new Worker(workerScript, {type: 'string'});
       workers[id].postMessage({sab: sab, id: id});
     }
 
@@ -210,7 +213,7 @@
     while (%AtomicsNumWaitersForTesting(i32a, 4) != 4) {}
 
     // Wake up three waiters.
-    assertEquals(3, Atomics.wake(i32a, 4, 3));
+    assertEquals(3, notify(i32a, 4, 3));
 
     var wokenCount = 0;
     var waitingId = 0 + 1 + 2 + 3;
@@ -232,12 +235,16 @@
     assertEquals(1, %AtomicsNumWaitersForTesting(i32a, 4));
 
     // Finally wake the last waiter.
-    assertEquals(1, Atomics.wake(i32a, 4, 1));
+    assertEquals(1, notify(i32a, 4, 1));
     assertEquals("ok", workers[waitingId].getMessage());
     workers[waitingId].terminate();
 
     assertEquals(0, %AtomicsNumWaitersForTesting(i32a, 4));
 
-  })();
+  };
 
+  TestWakeMulti(Atomics.wake);
+  // TODO(binji): This is hitting d8's max worker count when run with multiple
+  // isolates. Re-enable when workers are cleaned up after termination.
+  // TestWakeMulti(Atomics.notify);
 }
diff --git a/src/v8/test/mjsunit/harmony/generators-reduced.js b/src/v8/test/mjsunit/harmony/generators-reduced.js
index 8ea96c6..1589666 100644
--- a/src/v8/test/mjsunit/harmony/generators-reduced.js
+++ b/src/v8/test/mjsunit/harmony/generators-reduced.js
@@ -8,6 +8,7 @@
 function* h() { try {yield 42} finally {yield 43} };
 function* g() { yield* h(); };
 
+%PrepareFunctionForOptimization(g);
 let x = g();
 x.next();
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/harmony/generators.js b/src/v8/test/mjsunit/harmony/generators.js
index a4fc1c4..65c88a5 100644
--- a/src/v8/test/mjsunit/harmony/generators.js
+++ b/src/v8/test/mjsunit/harmony/generators.js
@@ -2,10 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-do-expressions --allow-natives-syntax
+// Flags: --allow-natives-syntax
 
 
 function MaybeOptimizeOrDeoptimize(f) {
+  %PrepareFunctionForOptimization(f);
   let x = Math.random();  // --random-seed makes this deterministic
   if (x <= 0.33) {
     %OptimizeFunctionOnNextCall(f);
@@ -429,14 +430,6 @@
 }
 
 {
-  function* foo() { yield 2; (do {yield 3}) + 42; yield 4 }
-  g = foo();
-  assertEquals({value: 2, done: false}, Next(g));
-  assertEquals({value: 3, done: false}, Next(g));
-  assertEquals({value: 4, done: false}, Next(g));
-}
-
-{
   function* foo() { yield 2; return (yield 3) + 42; yield 4 }
   g = foo();
   assertEquals({value: 2, done: false}, Next(g));
diff --git a/src/v8/test/mjsunit/harmony/global-configurable.js b/src/v8/test/mjsunit/harmony/global-configurable.js
new file mode 100644
index 0000000..d7a8057
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/global-configurable.js
@@ -0,0 +1,6 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertTrue(delete globalThis);
+assertEquals(this.globalThis, undefined);
diff --git a/src/v8/test/mjsunit/harmony/global-writable.js b/src/v8/test/mjsunit/harmony/global-writable.js
new file mode 100644
index 0000000..e4bce2b
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/global-writable.js
@@ -0,0 +1,6 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+globalThis = '[[Writable]]';
+assertEquals(globalThis, '[[Writable]]');
diff --git a/src/v8/test/mjsunit/harmony/global.js b/src/v8/test/mjsunit/harmony/global.js
new file mode 100644
index 0000000..60a12fe
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/global.js
@@ -0,0 +1,26 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals(globalThis, this);
+assertEquals(this.globalThis, this);
+assertEquals(globalThis.globalThis, this);
+assertEquals(globalThis.globalThis.globalThis, this);
+assertEquals(globalThis.globalThis.globalThis.globalThis, this);
+
+{
+  const realm = Realm.create();
+  assertEquals(Realm.global(realm), Realm.eval(realm, 'globalThis'));
+  assertNotEquals(Realm.global(realm), globalThis);
+}
+
+{
+  const descriptor = Object.getOwnPropertyDescriptor(
+    this,
+    'globalThis'
+  );
+  assertEquals(descriptor.value, this);
+  assertEquals(descriptor.writable, true);
+  assertEquals(descriptor.enumerable, false);
+  assertEquals(descriptor.configurable, true);
+}
diff --git a/src/v8/test/mjsunit/harmony/hashbang-eval.js b/src/v8/test/mjsunit/harmony/hashbang-eval.js
new file mode 100644
index 0000000..645ecda
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/hashbang-eval.js
@@ -0,0 +1,9 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Hashbang syntax is allowed in eval.
+assertEquals(eval("#!"), undefined);
+assertEquals(eval("#!\n"), undefined);
+assertEquals(eval("#!---IGNORED---"), undefined);
+assertEquals(eval("#!---IGNORED---\n"), undefined);
diff --git a/src/v8/test/mjsunit/harmony/import-from-compilation-errored.js b/src/v8/test/mjsunit/harmony/import-from-compilation-errored.js
index 3c99498..8caf588 100644
--- a/src/v8/test/mjsunit/harmony/import-from-compilation-errored.js
+++ b/src/v8/test/mjsunit/harmony/import-from-compilation-errored.js
@@ -5,9 +5,9 @@
 // Flags: --allow-natives-syntax --harmony-dynamic-import
 
 var error1, error2;
-import('modules-skip-12.js').catch(e => error1 = e);
-import('modules-skip-12.js').catch(e => error2 = e);
-%RunMicrotasks();
+import('modules-skip-12.mjs').catch(e => error1 = e);
+import('modules-skip-12.mjs').catch(e => error2 = e);
+%PerformMicrotaskCheckpoint();
 
 assertEquals(error1, error2);
 assertInstanceof(error1, SyntaxError);
diff --git a/src/v8/test/mjsunit/harmony/import-from-evaluation-errored.js b/src/v8/test/mjsunit/harmony/import-from-evaluation-errored.js
index 3623091..e39ce7c 100644
--- a/src/v8/test/mjsunit/harmony/import-from-evaluation-errored.js
+++ b/src/v8/test/mjsunit/harmony/import-from-evaluation-errored.js
@@ -5,9 +5,9 @@
 // Flags: --allow-natives-syntax --harmony-dynamic-import
 
 var error1, error2;
-import('modules-skip-11.js').catch(e => error1 = e);
-import('modules-skip-11.js').catch(e => error2 = e);
-%RunMicrotasks();
+import('modules-skip-11.mjs').catch(e => error1 = e);
+import('modules-skip-11.mjs').catch(e => error2 = e);
+%PerformMicrotaskCheckpoint();
 
 assertEquals(error1, error2);
 assertEquals(typeof error1, "symbol");
diff --git a/src/v8/test/mjsunit/harmony/import-from-fetch-errored.js b/src/v8/test/mjsunit/harmony/import-from-fetch-errored.js
index f3db881..6d6510f 100644
--- a/src/v8/test/mjsunit/harmony/import-from-fetch-errored.js
+++ b/src/v8/test/mjsunit/harmony/import-from-fetch-errored.js
@@ -7,7 +7,7 @@
 var error1, error2;
 import('no-such-file').catch(e => error1 = e);
 import('no-such-file').catch(e => error2 = e);
-%RunMicrotasks();
+%PerformMicrotaskCheckpoint();
 
 assertEquals(error1, error2);
 assertEquals(typeof error1, "string");
diff --git a/src/v8/test/mjsunit/harmony/import-from-instantiation-errored.js b/src/v8/test/mjsunit/harmony/import-from-instantiation-errored.js
index 2a481d5..958ba55 100644
--- a/src/v8/test/mjsunit/harmony/import-from-instantiation-errored.js
+++ b/src/v8/test/mjsunit/harmony/import-from-instantiation-errored.js
@@ -5,9 +5,9 @@
 // Flags: --allow-natives-syntax --harmony-dynamic-import
 
 var error1, error2;
-import('modules-skip-10.js').catch(e => error1 = e);
-import('modules-skip-10.js').catch(e => error2 = e);
-%RunMicrotasks();
+import('modules-skip-10.mjs').catch(e => error1 = e);
+import('modules-skip-10.mjs').catch(e => error2 = e);
+%PerformMicrotaskCheckpoint();
 
 assertEquals(error1, error2);
 assertInstanceof(error1, SyntaxError);
diff --git a/src/v8/test/mjsunit/harmony/module-parsing-eval.mjs b/src/v8/test/mjsunit/harmony/module-parsing-eval.mjs
new file mode 100644
index 0000000..6c080db
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/module-parsing-eval.mjs
@@ -0,0 +1,39 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Check that import/export declarations are rejected in eval or local scope.
+assertThrows("export let x;", SyntaxError);
+assertThrows("import x from 'http://url';", SyntaxError);
+
+assertThrows("{ export let x; }", SyntaxError);
+assertThrows("{ import x from 'http://url'; }", SyntaxError);
+
+assertThrows("function f() { export let x; }", SyntaxError);
+assertThrows("function f() { import x from 'http://url'; }", SyntaxError);
+
+assertThrows("function f() { { export let x; } }", SyntaxError);
+assertThrows("function f() { { import x from 'http://url'; } }", SyntaxError);
diff --git a/src/v8/test/mjsunit/harmony/modules-import-1.mjs b/src/v8/test/mjsunit/harmony/modules-import-1.mjs
new file mode 100644
index 0000000..954ed9e
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-import-1.mjs
@@ -0,0 +1,12 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-dynamic-import
+
+var life;
+import('modules-skip-1.mjs').then(namespace => life = namespace.life());
+
+%PerformMicrotaskCheckpoint();
+
+assertEquals(42, life);
diff --git a/src/v8/test/mjsunit/harmony/modules-import-10.mjs b/src/v8/test/mjsunit/harmony/modules-import-10.mjs
new file mode 100644
index 0000000..539a63d
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-import-10.mjs
@@ -0,0 +1,15 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-dynamic-import
+
+var life;
+import('modules-skip-6.mjs').then(namespace => life = namespace.life);
+
+assertEquals(undefined, Object.life);
+
+%PerformMicrotaskCheckpoint();
+
+assertEquals(42, Object.life);
+assertEquals("42", life);
diff --git a/src/v8/test/mjsunit/harmony/modules-import-11.mjs b/src/v8/test/mjsunit/harmony/modules-import-11.mjs
new file mode 100644
index 0000000..bcbc419
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-import-11.mjs
@@ -0,0 +1,22 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-dynamic-import
+
+var ran = false;
+
+async function test() {
+  try {
+    let namespace = await import('modules-skip-7.mjs');
+    let life = await namespace.getLife();
+    assertEquals(42, life);
+    ran = true;
+  } catch (e) {
+    %AbortJS('failure: ' + e);
+  }
+}
+
+test();
+%PerformMicrotaskCheckpoint();
+assertTrue(ran);
diff --git a/src/v8/test/mjsunit/harmony/modules-import-12.mjs b/src/v8/test/mjsunit/harmony/modules-import-12.mjs
new file mode 100644
index 0000000..9f6dba6
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-import-12.mjs
@@ -0,0 +1,19 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-dynamic-import
+
+let ran = false;
+async function test() {
+  try {
+    let namespace = await import('modules-skip-empty.mjs');
+    ran = true;
+  } catch(e) {
+    %AbortJS('failure: '+ e);
+  }
+}
+
+test();
+%PerformMicrotaskCheckpoint();
+assertTrue(ran);
diff --git a/src/v8/test/mjsunit/harmony/modules-import-13.mjs b/src/v8/test/mjsunit/harmony/modules-import-13.mjs
new file mode 100644
index 0000000..dcbc042
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-import-13.mjs
@@ -0,0 +1,40 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-dynamic-import
+// Resources: test/mjsunit/harmony/modules-skip-1.mjs
+
+let ran = false;
+async function test1() {
+  try {
+    let x = { toString() { return 'modules-skip-1.mjs' } };
+    let namespace = await import(x);
+    let life = namespace.life();
+    assertEquals(42, life);
+    ran = true;
+  } catch(e) {
+    %AbortJS('failure: '+ e);
+  }
+}
+
+test1();
+%PerformMicrotaskCheckpoint();
+assertTrue(ran);
+
+ran = false;
+async function test2() {
+  try {
+    let x = { get toString() { return () => 'modules-skip-1.mjs' } };
+    let namespace = await import(x);
+    let life = namespace.life();
+    assertEquals(42, life);
+    ran = true;
+  } catch(e) {
+    %AbortJS('failure: '+ e);
+  }
+}
+
+test2();
+%PerformMicrotaskCheckpoint();
+assertTrue(ran);
diff --git a/src/v8/test/mjsunit/harmony/modules-import-14.mjs b/src/v8/test/mjsunit/harmony/modules-import-14.mjs
new file mode 100644
index 0000000..6c176ea
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-import-14.mjs
@@ -0,0 +1,26 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-dynamic-import
+
+var ran = false;
+
+async function test() {
+  try {
+    let x = await import('modules-skip-1.mjs');
+    // modules-skip-5.mjs statically imports modules-skip-1.mjs
+    let y = await import('modules-skip-5.mjs');
+    assertSame(x, y.static_life);
+
+    let z = await import('modules-skip-1.mjs');
+    assertSame(x, z);
+    ran = true;
+  } catch(e) {
+    %AbortJS('failure: '+ e.message);
+  }
+}
+
+test();
+%PerformMicrotaskCheckpoint();
+assertTrue(ran);
diff --git a/src/v8/test/mjsunit/harmony/modules-import-15.mjs b/src/v8/test/mjsunit/harmony/modules-import-15.mjs
new file mode 100644
index 0000000..b4febd5
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-import-15.mjs
@@ -0,0 +1,57 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-dynamic-import
+
+var ran = false;
+
+async function test1() {
+  try {
+    let x = await import('modules-skip-8.mjs');
+    %AbortJS('failure: should be unreachable');
+  } catch(e) {
+    assertEquals('Unexpected reserved word', e.message);
+    ran = true;
+  }
+}
+
+test1();
+%PerformMicrotaskCheckpoint();
+assertTrue(ran);
+
+ran = false;
+
+async function test2() {
+  try {
+    let x = await import('modules-skip-9.mjs');
+    %AbortJS('failure: should be unreachable');
+  } catch(e) {
+    assertInstanceof(e, SyntaxError);
+    assertEquals(
+      "The requested module 'modules-skip-empty.mjs' does not provide an " +
+      "export named 'default'",
+      e.message);
+    ran = true;
+  }
+}
+
+test2();
+%PerformMicrotaskCheckpoint();
+assertTrue(ran);
+
+ran = false;
+
+async function test3() {
+  try {
+    let x = await import('nonexistent-file.mjs');
+    %AbortJS('failure: should be unreachable');
+  } catch(e) {
+    assertTrue(e.startsWith('Error reading'));
+    ran = true;
+  }
+}
+
+test3();
+%PerformMicrotaskCheckpoint();
+assertTrue(ran);
diff --git a/src/v8/test/mjsunit/harmony/modules-import-16.mjs b/src/v8/test/mjsunit/harmony/modules-import-16.mjs
new file mode 100644
index 0000000..411bb1b
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-import-16.mjs
@@ -0,0 +1,36 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-dynamic-import
+
+globalThis.ran = false;
+globalThis.x = undefined;
+
+let body = "import('modules-skip-1.mjs').then(ns => { x = ns.life();" +
+    " ran = true;} ).catch(err => %AbortJS(err))"
+let func = new Function(body);
+func();
+
+%PerformMicrotaskCheckpoint();
+assertEquals(42, globalThis.x);
+assertTrue(globalThis.ran);
+
+globalThis.ran = false;
+body = "import('modules-skip-1.mjs').then(ns => { x = ns.life();" +
+    " ran = true;} ).catch(err => %AbortJS(err))"
+eval("var func = new Function(body); func();");
+
+%PerformMicrotaskCheckpoint();
+assertEquals(42, globalThis.x);
+assertTrue(globalThis.ran);
+
+globalThis.ran = false;
+body = "eval(import('modules-skip-1.mjs').then(ns => { x = ns.life();" +
+    " ran = true;} ).catch(err => %AbortJS(err)))"
+func = new Function(body);
+func();
+
+%PerformMicrotaskCheckpoint();
+assertEquals(42, globalThis.x);
+assertTrue(globalThis.ran);
diff --git a/src/v8/test/mjsunit/harmony/modules-import-17.mjs b/src/v8/test/mjsunit/harmony/modules-import-17.mjs
new file mode 100644
index 0000000..7c7eb2e
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-import-17.mjs
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-namespace-exports
+
+var ns;
+import('modules-skip-13.mjs').then(x => ns = x);
+%PerformMicrotaskCheckpoint();
+assertEquals(42, ns.default);
+assertEquals(ns, ns.self);
diff --git a/src/v8/test/mjsunit/harmony/modules-import-2.mjs b/src/v8/test/mjsunit/harmony/modules-import-2.mjs
new file mode 100644
index 0000000..2b0ee5b
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-import-2.mjs
@@ -0,0 +1,18 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-dynamic-import
+
+var life;
+var msg;
+import('modules-skip-1.mjs').then(namespace => life = namespace.life());
+import('modules-skip-2.mjs').catch(err => msg = err.message);
+
+assertEquals(undefined, life);
+assertEquals(undefined, msg);
+
+%PerformMicrotaskCheckpoint();
+
+assertEquals(42, life);
+assertEquals('42 is not the answer', msg);
diff --git a/src/v8/test/mjsunit/harmony/modules-import-3.mjs b/src/v8/test/mjsunit/harmony/modules-import-3.mjs
new file mode 100644
index 0000000..3cfb442
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-import-3.mjs
@@ -0,0 +1,22 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-dynamic-import
+
+var ran = false;
+async function foo () {
+  try {
+    let life = await import('modules-skip-2.mjs');
+    assertUnreachable();
+  } catch(e) {
+    assertEquals('42 is not the answer', e.message);
+    ran = true;
+  }
+}
+
+foo();
+
+%PerformMicrotaskCheckpoint();
+
+assertTrue(ran);
diff --git a/src/v8/test/mjsunit/harmony/modules-import-4.mjs b/src/v8/test/mjsunit/harmony/modules-import-4.mjs
new file mode 100644
index 0000000..38a80b3
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-import-4.mjs
@@ -0,0 +1,13 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-dynamic-import
+
+try {
+  import(x);
+  let x;
+  assertUnreachable();
+} catch(e) {
+  assertEquals("ReferenceError", e.name);
+}
diff --git a/src/v8/test/mjsunit/harmony/modules-import-5.mjs b/src/v8/test/mjsunit/harmony/modules-import-5.mjs
new file mode 100644
index 0000000..33991ef
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-import-5.mjs
@@ -0,0 +1,13 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-dynamic-import
+
+var life;
+let x = 'modules-skip-1.mjs';
+import(x).then(namespace => life = namespace.life());
+x = 'modules-skip-2.mjs';
+
+%PerformMicrotaskCheckpoint();
+assertEquals(42, life);
diff --git a/src/v8/test/mjsunit/harmony/modules-import-6.mjs b/src/v8/test/mjsunit/harmony/modules-import-6.mjs
new file mode 100644
index 0000000..ae38930
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-import-6.mjs
@@ -0,0 +1,29 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-dynamic-import
+
+var ran = false;
+
+async function test() {
+  try {
+    let [namespace1, namespace2] = await Promise.all([
+      import('modules-skip-1.mjs'),
+      import('modules-skip-3.mjs')
+    ]);
+
+    let life = namespace1.life();
+    let stringlife = namespace2.stringlife;
+    assertEquals(42, life);
+    assertEquals("42", stringlife);
+    ran = true;
+  } catch(e) {
+    %AbortJS("failure: " + e);
+  }
+}
+
+test();
+
+%PerformMicrotaskCheckpoint();
+assertTrue(ran);
diff --git a/src/v8/test/mjsunit/harmony/modules-import-7.mjs b/src/v8/test/mjsunit/harmony/modules-import-7.mjs
new file mode 100644
index 0000000..df16460
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-import-7.mjs
@@ -0,0 +1,24 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-dynamic-import
+
+var ran = false;
+
+async function test() {
+  try {
+    let namespace = await import('modules-skip-4.mjs');
+    assertEquals(42, namespace.life());
+    assertEquals("42", namespace.stringlife);
+    ran = true;
+  } catch(e) {
+    %AbortJS('failure: '+ e);
+  }
+}
+
+test();
+
+%PerformMicrotaskCheckpoint();
+
+assertTrue(ran);
diff --git a/src/v8/test/mjsunit/harmony/modules-import-8.mjs b/src/v8/test/mjsunit/harmony/modules-import-8.mjs
new file mode 100644
index 0000000..ac21a8c
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-import-8.mjs
@@ -0,0 +1,91 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-dynamic-import
+
+var ran = false;
+
+var x = {
+  get toString() { return undefined; }
+};
+import(x);
+
+var x = {
+  toString() {
+    throw new Error('42 is the answer');
+  }
+};
+import(x);
+
+var x = {
+  get toString() {
+    throw new Error('42 is the answer');
+  }
+};
+import(x);
+
+async function test1() {
+  try {
+    let x = {
+      toString() {
+        throw new Error('42 is the answer');
+      }
+    };
+
+    let namespace = await import(x);
+    %AbortJS('failure: this should throw');
+  } catch(e) {
+    assertEquals(e.message, '42 is the answer');
+    ran = true;
+  }
+}
+
+test1();
+
+%PerformMicrotaskCheckpoint();
+
+assertTrue(ran);
+
+ran = false;
+async function test2() {
+  try {
+    let x = {
+      get toString() {
+        throw new Error('42 is the answer');
+      }
+    };
+
+    let namespace = await import(x);
+    %AbortJS('failure: this should throw');
+  } catch(e) {
+    assertEquals(e.message, '42 is the answer');
+    ran = true;
+  }
+}
+
+test2();
+
+%PerformMicrotaskCheckpoint();
+
+assertTrue(ran);
+
+ran = false;
+async function test3() {
+  try {
+    let x = {
+      get toString() { return undefined; }
+    };
+    let namespace = await import(x);
+    %AbortJS('failure: this should throw');
+  } catch(e) {
+    assertEquals(e.message, 'Cannot convert object to primitive value');
+    ran = true;
+  }
+}
+
+test3();
+
+%PerformMicrotaskCheckpoint();
+
+assertTrue(ran);
diff --git a/src/v8/test/mjsunit/harmony/modules-import-9.mjs b/src/v8/test/mjsunit/harmony/modules-import-9.mjs
new file mode 100644
index 0000000..c3a19af
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-import-9.mjs
@@ -0,0 +1,22 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-dynamic-import
+
+var ran = false;
+
+async function test() {
+  try {
+    let namespace = await import('modules-skip-5.mjs').then(x => x);
+    assertSame(namespace.static_life, namespace.dynamic_life);
+    assertSame(namespace.relative_static_life, namespace.dynamic_life);
+    ran = true;
+  } catch(e) {
+    %AbortJS('failure: ' + e);
+  }
+}
+
+test();
+%PerformMicrotaskCheckpoint();
+assertTrue(ran);
diff --git a/src/v8/test/mjsunit/harmony/modules-import-large.mjs b/src/v8/test/mjsunit/harmony/modules-import-large.mjs
new file mode 100644
index 0000000..761f598
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-import-large.mjs
@@ -0,0 +1,1118 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+import * as m1 from "modules-skip-large1.mjs";
+import * as m2 from "modules-skip-large2.mjs";
+
+assertFalse(%HasFastProperties(m1));
+assertFalse(%HasFastProperties(m2));
+assertFalse(%HaveSameMap(m1, m2));
+
+function verify(m) {
+  assertEquals(m.a0, 0);
+  assertEquals(m.a1, 1);
+  assertEquals(m.a2, 2);
+  assertEquals(m.a3, 3);
+  assertEquals(m.a4, 4);
+  assertEquals(m.a5, 5);
+  assertEquals(m.a6, 6);
+  assertEquals(m.a7, 7);
+  assertEquals(m.a8, 8);
+  assertEquals(m.a9, 9);
+  assertEquals(m.a10, 10);
+  assertEquals(m.a11, 11);
+  assertEquals(m.a12, 12);
+  assertEquals(m.a13, 13);
+  assertEquals(m.a14, 14);
+  assertEquals(m.a15, 15);
+  assertEquals(m.a16, 16);
+  assertEquals(m.a17, 17);
+  assertEquals(m.a18, 18);
+  assertEquals(m.a19, 19);
+  assertEquals(m.a20, 20);
+  assertEquals(m.a21, 21);
+  assertEquals(m.a22, 22);
+  assertEquals(m.a23, 23);
+  assertEquals(m.a24, 24);
+  assertEquals(m.a25, 25);
+  assertEquals(m.a26, 26);
+  assertEquals(m.a27, 27);
+  assertEquals(m.a28, 28);
+  assertEquals(m.a29, 29);
+  assertEquals(m.a30, 30);
+  assertEquals(m.a31, 31);
+  assertEquals(m.a32, 32);
+  assertEquals(m.a33, 33);
+  assertEquals(m.a34, 34);
+  assertEquals(m.a35, 35);
+  assertEquals(m.a36, 36);
+  assertEquals(m.a37, 37);
+  assertEquals(m.a38, 38);
+  assertEquals(m.a39, 39);
+  assertEquals(m.a40, 40);
+  assertEquals(m.a41, 41);
+  assertEquals(m.a42, 42);
+  assertEquals(m.a43, 43);
+  assertEquals(m.a44, 44);
+  assertEquals(m.a45, 45);
+  assertEquals(m.a46, 46);
+  assertEquals(m.a47, 47);
+  assertEquals(m.a48, 48);
+  assertEquals(m.a49, 49);
+  assertEquals(m.a50, 50);
+  assertEquals(m.a51, 51);
+  assertEquals(m.a52, 52);
+  assertEquals(m.a53, 53);
+  assertEquals(m.a54, 54);
+  assertEquals(m.a55, 55);
+  assertEquals(m.a56, 56);
+  assertEquals(m.a57, 57);
+  assertEquals(m.a58, 58);
+  assertEquals(m.a59, 59);
+  assertEquals(m.a60, 60);
+  assertEquals(m.a61, 61);
+  assertEquals(m.a62, 62);
+  assertEquals(m.a63, 63);
+  assertEquals(m.a64, 64);
+  assertEquals(m.a65, 65);
+  assertEquals(m.a66, 66);
+  assertEquals(m.a67, 67);
+  assertEquals(m.a68, 68);
+  assertEquals(m.a69, 69);
+  assertEquals(m.a70, 70);
+  assertEquals(m.a71, 71);
+  assertEquals(m.a72, 72);
+  assertEquals(m.a73, 73);
+  assertEquals(m.a74, 74);
+  assertEquals(m.a75, 75);
+  assertEquals(m.a76, 76);
+  assertEquals(m.a77, 77);
+  assertEquals(m.a78, 78);
+  assertEquals(m.a79, 79);
+  assertEquals(m.a80, 80);
+  assertEquals(m.a81, 81);
+  assertEquals(m.a82, 82);
+  assertEquals(m.a83, 83);
+  assertEquals(m.a84, 84);
+  assertEquals(m.a85, 85);
+  assertEquals(m.a86, 86);
+  assertEquals(m.a87, 87);
+  assertEquals(m.a88, 88);
+  assertEquals(m.a89, 89);
+  assertEquals(m.a90, 90);
+  assertEquals(m.a91, 91);
+  assertEquals(m.a92, 92);
+  assertEquals(m.a93, 93);
+  assertEquals(m.a94, 94);
+  assertEquals(m.a95, 95);
+  assertEquals(m.a96, 96);
+  assertEquals(m.a97, 97);
+  assertEquals(m.a98, 98);
+  assertEquals(m.a99, 99);
+  assertEquals(m.a100, 100);
+  assertEquals(m.a101, 101);
+  assertEquals(m.a102, 102);
+  assertEquals(m.a103, 103);
+  assertEquals(m.a104, 104);
+  assertEquals(m.a105, 105);
+  assertEquals(m.a106, 106);
+  assertEquals(m.a107, 107);
+  assertEquals(m.a108, 108);
+  assertEquals(m.a109, 109);
+  assertEquals(m.a110, 110);
+  assertEquals(m.a111, 111);
+  assertEquals(m.a112, 112);
+  assertEquals(m.a113, 113);
+  assertEquals(m.a114, 114);
+  assertEquals(m.a115, 115);
+  assertEquals(m.a116, 116);
+  assertEquals(m.a117, 117);
+  assertEquals(m.a118, 118);
+  assertEquals(m.a119, 119);
+  assertEquals(m.a120, 120);
+  assertEquals(m.a121, 121);
+  assertEquals(m.a122, 122);
+  assertEquals(m.a123, 123);
+  assertEquals(m.a124, 124);
+  assertEquals(m.a125, 125);
+  assertEquals(m.a126, 126);
+  assertEquals(m.a127, 127);
+  assertEquals(m.a128, 128);
+  assertEquals(m.a129, 129);
+  assertEquals(m.a130, 130);
+  assertEquals(m.a131, 131);
+  assertEquals(m.a132, 132);
+  assertEquals(m.a133, 133);
+  assertEquals(m.a134, 134);
+  assertEquals(m.a135, 135);
+  assertEquals(m.a136, 136);
+  assertEquals(m.a137, 137);
+  assertEquals(m.a138, 138);
+  assertEquals(m.a139, 139);
+  assertEquals(m.a140, 140);
+  assertEquals(m.a141, 141);
+  assertEquals(m.a142, 142);
+  assertEquals(m.a143, 143);
+  assertEquals(m.a144, 144);
+  assertEquals(m.a145, 145);
+  assertEquals(m.a146, 146);
+  assertEquals(m.a147, 147);
+  assertEquals(m.a148, 148);
+  assertEquals(m.a149, 149);
+  assertEquals(m.a150, 150);
+  assertEquals(m.a151, 151);
+  assertEquals(m.a152, 152);
+  assertEquals(m.a153, 153);
+  assertEquals(m.a154, 154);
+  assertEquals(m.a155, 155);
+  assertEquals(m.a156, 156);
+  assertEquals(m.a157, 157);
+  assertEquals(m.a158, 158);
+  assertEquals(m.a159, 159);
+  assertEquals(m.a160, 160);
+  assertEquals(m.a161, 161);
+  assertEquals(m.a162, 162);
+  assertEquals(m.a163, 163);
+  assertEquals(m.a164, 164);
+  assertEquals(m.a165, 165);
+  assertEquals(m.a166, 166);
+  assertEquals(m.a167, 167);
+  assertEquals(m.a168, 168);
+  assertEquals(m.a169, 169);
+  assertEquals(m.a170, 170);
+  assertEquals(m.a171, 171);
+  assertEquals(m.a172, 172);
+  assertEquals(m.a173, 173);
+  assertEquals(m.a174, 174);
+  assertEquals(m.a175, 175);
+  assertEquals(m.a176, 176);
+  assertEquals(m.a177, 177);
+  assertEquals(m.a178, 178);
+  assertEquals(m.a179, 179);
+  assertEquals(m.a180, 180);
+  assertEquals(m.a181, 181);
+  assertEquals(m.a182, 182);
+  assertEquals(m.a183, 183);
+  assertEquals(m.a184, 184);
+  assertEquals(m.a185, 185);
+  assertEquals(m.a186, 186);
+  assertEquals(m.a187, 187);
+  assertEquals(m.a188, 188);
+  assertEquals(m.a189, 189);
+  assertEquals(m.a190, 190);
+  assertEquals(m.a191, 191);
+  assertEquals(m.a192, 192);
+  assertEquals(m.a193, 193);
+  assertEquals(m.a194, 194);
+  assertEquals(m.a195, 195);
+  assertEquals(m.a196, 196);
+  assertEquals(m.a197, 197);
+  assertEquals(m.a198, 198);
+  assertEquals(m.a199, 199);
+  assertEquals(m.a200, 200);
+  assertEquals(m.a201, 201);
+  assertEquals(m.a202, 202);
+  assertEquals(m.a203, 203);
+  assertEquals(m.a204, 204);
+  assertEquals(m.a205, 205);
+  assertEquals(m.a206, 206);
+  assertEquals(m.a207, 207);
+  assertEquals(m.a208, 208);
+  assertEquals(m.a209, 209);
+  assertEquals(m.a210, 210);
+  assertEquals(m.a211, 211);
+  assertEquals(m.a212, 212);
+  assertEquals(m.a213, 213);
+  assertEquals(m.a214, 214);
+  assertEquals(m.a215, 215);
+  assertEquals(m.a216, 216);
+  assertEquals(m.a217, 217);
+  assertEquals(m.a218, 218);
+  assertEquals(m.a219, 219);
+  assertEquals(m.a220, 220);
+  assertEquals(m.a221, 221);
+  assertEquals(m.a222, 222);
+  assertEquals(m.a223, 223);
+  assertEquals(m.a224, 224);
+  assertEquals(m.a225, 225);
+  assertEquals(m.a226, 226);
+  assertEquals(m.a227, 227);
+  assertEquals(m.a228, 228);
+  assertEquals(m.a229, 229);
+  assertEquals(m.a230, 230);
+  assertEquals(m.a231, 231);
+  assertEquals(m.a232, 232);
+  assertEquals(m.a233, 233);
+  assertEquals(m.a234, 234);
+  assertEquals(m.a235, 235);
+  assertEquals(m.a236, 236);
+  assertEquals(m.a237, 237);
+  assertEquals(m.a238, 238);
+  assertEquals(m.a239, 239);
+  assertEquals(m.a240, 240);
+  assertEquals(m.a241, 241);
+  assertEquals(m.a242, 242);
+  assertEquals(m.a243, 243);
+  assertEquals(m.a244, 244);
+  assertEquals(m.a245, 245);
+  assertEquals(m.a246, 246);
+  assertEquals(m.a247, 247);
+  assertEquals(m.a248, 248);
+  assertEquals(m.a249, 249);
+  assertEquals(m.a250, 250);
+  assertEquals(m.a251, 251);
+  assertEquals(m.a252, 252);
+  assertEquals(m.a253, 253);
+  assertEquals(m.a254, 254);
+  assertEquals(m.a255, 255);
+  assertEquals(m.a256, 256);
+  assertEquals(m.a257, 257);
+  assertEquals(m.a258, 258);
+  assertEquals(m.a259, 259);
+  assertEquals(m.a260, 260);
+  assertEquals(m.a261, 261);
+  assertEquals(m.a262, 262);
+  assertEquals(m.a263, 263);
+  assertEquals(m.a264, 264);
+  assertEquals(m.a265, 265);
+  assertEquals(m.a266, 266);
+  assertEquals(m.a267, 267);
+  assertEquals(m.a268, 268);
+  assertEquals(m.a269, 269);
+  assertEquals(m.a270, 270);
+  assertEquals(m.a271, 271);
+  assertEquals(m.a272, 272);
+  assertEquals(m.a273, 273);
+  assertEquals(m.a274, 274);
+  assertEquals(m.a275, 275);
+  assertEquals(m.a276, 276);
+  assertEquals(m.a277, 277);
+  assertEquals(m.a278, 278);
+  assertEquals(m.a279, 279);
+  assertEquals(m.a280, 280);
+  assertEquals(m.a281, 281);
+  assertEquals(m.a282, 282);
+  assertEquals(m.a283, 283);
+  assertEquals(m.a284, 284);
+  assertEquals(m.a285, 285);
+  assertEquals(m.a286, 286);
+  assertEquals(m.a287, 287);
+  assertEquals(m.a288, 288);
+  assertEquals(m.a289, 289);
+  assertEquals(m.a290, 290);
+  assertEquals(m.a291, 291);
+  assertEquals(m.a292, 292);
+  assertEquals(m.a293, 293);
+  assertEquals(m.a294, 294);
+  assertEquals(m.a295, 295);
+  assertEquals(m.a296, 296);
+  assertEquals(m.a297, 297);
+  assertEquals(m.a298, 298);
+  assertEquals(m.a299, 299);
+  assertEquals(m.a300, 300);
+  assertEquals(m.a301, 301);
+  assertEquals(m.a302, 302);
+  assertEquals(m.a303, 303);
+  assertEquals(m.a304, 304);
+  assertEquals(m.a305, 305);
+  assertEquals(m.a306, 306);
+  assertEquals(m.a307, 307);
+  assertEquals(m.a308, 308);
+  assertEquals(m.a309, 309);
+  assertEquals(m.a310, 310);
+  assertEquals(m.a311, 311);
+  assertEquals(m.a312, 312);
+  assertEquals(m.a313, 313);
+  assertEquals(m.a314, 314);
+  assertEquals(m.a315, 315);
+  assertEquals(m.a316, 316);
+  assertEquals(m.a317, 317);
+  assertEquals(m.a318, 318);
+  assertEquals(m.a319, 319);
+  assertEquals(m.a320, 320);
+  assertEquals(m.a321, 321);
+  assertEquals(m.a322, 322);
+  assertEquals(m.a323, 323);
+  assertEquals(m.a324, 324);
+  assertEquals(m.a325, 325);
+  assertEquals(m.a326, 326);
+  assertEquals(m.a327, 327);
+  assertEquals(m.a328, 328);
+  assertEquals(m.a329, 329);
+  assertEquals(m.a330, 330);
+  assertEquals(m.a331, 331);
+  assertEquals(m.a332, 332);
+  assertEquals(m.a333, 333);
+  assertEquals(m.a334, 334);
+  assertEquals(m.a335, 335);
+  assertEquals(m.a336, 336);
+  assertEquals(m.a337, 337);
+  assertEquals(m.a338, 338);
+  assertEquals(m.a339, 339);
+  assertEquals(m.a340, 340);
+  assertEquals(m.a341, 341);
+  assertEquals(m.a342, 342);
+  assertEquals(m.a343, 343);
+  assertEquals(m.a344, 344);
+  assertEquals(m.a345, 345);
+  assertEquals(m.a346, 346);
+  assertEquals(m.a347, 347);
+  assertEquals(m.a348, 348);
+  assertEquals(m.a349, 349);
+  assertEquals(m.a350, 350);
+  assertEquals(m.a351, 351);
+  assertEquals(m.a352, 352);
+  assertEquals(m.a353, 353);
+  assertEquals(m.a354, 354);
+  assertEquals(m.a355, 355);
+  assertEquals(m.a356, 356);
+  assertEquals(m.a357, 357);
+  assertEquals(m.a358, 358);
+  assertEquals(m.a359, 359);
+  assertEquals(m.a360, 360);
+  assertEquals(m.a361, 361);
+  assertEquals(m.a362, 362);
+  assertEquals(m.a363, 363);
+  assertEquals(m.a364, 364);
+  assertEquals(m.a365, 365);
+  assertEquals(m.a366, 366);
+  assertEquals(m.a367, 367);
+  assertEquals(m.a368, 368);
+  assertEquals(m.a369, 369);
+  assertEquals(m.a370, 370);
+  assertEquals(m.a371, 371);
+  assertEquals(m.a372, 372);
+  assertEquals(m.a373, 373);
+  assertEquals(m.a374, 374);
+  assertEquals(m.a375, 375);
+  assertEquals(m.a376, 376);
+  assertEquals(m.a377, 377);
+  assertEquals(m.a378, 378);
+  assertEquals(m.a379, 379);
+  assertEquals(m.a380, 380);
+  assertEquals(m.a381, 381);
+  assertEquals(m.a382, 382);
+  assertEquals(m.a383, 383);
+  assertEquals(m.a384, 384);
+  assertEquals(m.a385, 385);
+  assertEquals(m.a386, 386);
+  assertEquals(m.a387, 387);
+  assertEquals(m.a388, 388);
+  assertEquals(m.a389, 389);
+  assertEquals(m.a390, 390);
+  assertEquals(m.a391, 391);
+  assertEquals(m.a392, 392);
+  assertEquals(m.a393, 393);
+  assertEquals(m.a394, 394);
+  assertEquals(m.a395, 395);
+  assertEquals(m.a396, 396);
+  assertEquals(m.a397, 397);
+  assertEquals(m.a398, 398);
+  assertEquals(m.a399, 399);
+  assertEquals(m.a400, 400);
+  assertEquals(m.a401, 401);
+  assertEquals(m.a402, 402);
+  assertEquals(m.a403, 403);
+  assertEquals(m.a404, 404);
+  assertEquals(m.a405, 405);
+  assertEquals(m.a406, 406);
+  assertEquals(m.a407, 407);
+  assertEquals(m.a408, 408);
+  assertEquals(m.a409, 409);
+  assertEquals(m.a410, 410);
+  assertEquals(m.a411, 411);
+  assertEquals(m.a412, 412);
+  assertEquals(m.a413, 413);
+  assertEquals(m.a414, 414);
+  assertEquals(m.a415, 415);
+  assertEquals(m.a416, 416);
+  assertEquals(m.a417, 417);
+  assertEquals(m.a418, 418);
+  assertEquals(m.a419, 419);
+  assertEquals(m.a420, 420);
+  assertEquals(m.a421, 421);
+  assertEquals(m.a422, 422);
+  assertEquals(m.a423, 423);
+  assertEquals(m.a424, 424);
+  assertEquals(m.a425, 425);
+  assertEquals(m.a426, 426);
+  assertEquals(m.a427, 427);
+  assertEquals(m.a428, 428);
+  assertEquals(m.a429, 429);
+  assertEquals(m.a430, 430);
+  assertEquals(m.a431, 431);
+  assertEquals(m.a432, 432);
+  assertEquals(m.a433, 433);
+  assertEquals(m.a434, 434);
+  assertEquals(m.a435, 435);
+  assertEquals(m.a436, 436);
+  assertEquals(m.a437, 437);
+  assertEquals(m.a438, 438);
+  assertEquals(m.a439, 439);
+  assertEquals(m.a440, 440);
+  assertEquals(m.a441, 441);
+  assertEquals(m.a442, 442);
+  assertEquals(m.a443, 443);
+  assertEquals(m.a444, 444);
+  assertEquals(m.a445, 445);
+  assertEquals(m.a446, 446);
+  assertEquals(m.a447, 447);
+  assertEquals(m.a448, 448);
+  assertEquals(m.a449, 449);
+  assertEquals(m.a450, 450);
+  assertEquals(m.a451, 451);
+  assertEquals(m.a452, 452);
+  assertEquals(m.a453, 453);
+  assertEquals(m.a454, 454);
+  assertEquals(m.a455, 455);
+  assertEquals(m.a456, 456);
+  assertEquals(m.a457, 457);
+  assertEquals(m.a458, 458);
+  assertEquals(m.a459, 459);
+  assertEquals(m.a460, 460);
+  assertEquals(m.a461, 461);
+  assertEquals(m.a462, 462);
+  assertEquals(m.a463, 463);
+  assertEquals(m.a464, 464);
+  assertEquals(m.a465, 465);
+  assertEquals(m.a466, 466);
+  assertEquals(m.a467, 467);
+  assertEquals(m.a468, 468);
+  assertEquals(m.a469, 469);
+  assertEquals(m.a470, 470);
+  assertEquals(m.a471, 471);
+  assertEquals(m.a472, 472);
+  assertEquals(m.a473, 473);
+  assertEquals(m.a474, 474);
+  assertEquals(m.a475, 475);
+  assertEquals(m.a476, 476);
+  assertEquals(m.a477, 477);
+  assertEquals(m.a478, 478);
+  assertEquals(m.a479, 479);
+  assertEquals(m.a480, 480);
+  assertEquals(m.a481, 481);
+  assertEquals(m.a482, 482);
+  assertEquals(m.a483, 483);
+  assertEquals(m.a484, 484);
+  assertEquals(m.a485, 485);
+  assertEquals(m.a486, 486);
+  assertEquals(m.a487, 487);
+  assertEquals(m.a488, 488);
+  assertEquals(m.a489, 489);
+  assertEquals(m.a490, 490);
+  assertEquals(m.a491, 491);
+  assertEquals(m.a492, 492);
+  assertEquals(m.a493, 493);
+  assertEquals(m.a494, 494);
+  assertEquals(m.a495, 495);
+  assertEquals(m.a496, 496);
+  assertEquals(m.a497, 497);
+  assertEquals(m.a498, 498);
+  assertEquals(m.a499, 499);
+  assertEquals(m.a500, 500);
+  assertEquals(m.a501, 501);
+  assertEquals(m.a502, 502);
+  assertEquals(m.a503, 503);
+  assertEquals(m.a504, 504);
+  assertEquals(m.a505, 505);
+  assertEquals(m.a506, 506);
+  assertEquals(m.a507, 507);
+  assertEquals(m.a508, 508);
+  assertEquals(m.a509, 509);
+  assertEquals(m.a510, 510);
+  assertEquals(m.a511, 511);
+  assertEquals(m.a512, 512);
+  assertEquals(m.a513, 513);
+  assertEquals(m.a514, 514);
+  assertEquals(m.a515, 515);
+  assertEquals(m.a516, 516);
+  assertEquals(m.a517, 517);
+  assertEquals(m.a518, 518);
+  assertEquals(m.a519, 519);
+  assertEquals(m.a520, 520);
+  assertEquals(m.a521, 521);
+  assertEquals(m.a522, 522);
+  assertEquals(m.a523, 523);
+  assertEquals(m.a524, 524);
+  assertEquals(m.a525, 525);
+  assertEquals(m.a526, 526);
+  assertEquals(m.a527, 527);
+  assertEquals(m.a528, 528);
+  assertEquals(m.a529, 529);
+  assertEquals(m.a530, 530);
+  assertEquals(m.a531, 531);
+  assertEquals(m.a532, 532);
+  assertEquals(m.a533, 533);
+  assertEquals(m.a534, 534);
+  assertEquals(m.a535, 535);
+  assertEquals(m.a536, 536);
+  assertEquals(m.a537, 537);
+  assertEquals(m.a538, 538);
+  assertEquals(m.a539, 539);
+  assertEquals(m.a540, 540);
+  assertEquals(m.a541, 541);
+  assertEquals(m.a542, 542);
+  assertEquals(m.a543, 543);
+  assertEquals(m.a544, 544);
+  assertEquals(m.a545, 545);
+  assertEquals(m.a546, 546);
+  assertEquals(m.a547, 547);
+  assertEquals(m.a548, 548);
+  assertEquals(m.a549, 549);
+  assertEquals(m.a550, 550);
+  assertEquals(m.a551, 551);
+  assertEquals(m.a552, 552);
+  assertEquals(m.a553, 553);
+  assertEquals(m.a554, 554);
+  assertEquals(m.a555, 555);
+  assertEquals(m.a556, 556);
+  assertEquals(m.a557, 557);
+  assertEquals(m.a558, 558);
+  assertEquals(m.a559, 559);
+  assertEquals(m.a560, 560);
+  assertEquals(m.a561, 561);
+  assertEquals(m.a562, 562);
+  assertEquals(m.a563, 563);
+  assertEquals(m.a564, 564);
+  assertEquals(m.a565, 565);
+  assertEquals(m.a566, 566);
+  assertEquals(m.a567, 567);
+  assertEquals(m.a568, 568);
+  assertEquals(m.a569, 569);
+  assertEquals(m.a570, 570);
+  assertEquals(m.a571, 571);
+  assertEquals(m.a572, 572);
+  assertEquals(m.a573, 573);
+  assertEquals(m.a574, 574);
+  assertEquals(m.a575, 575);
+  assertEquals(m.a576, 576);
+  assertEquals(m.a577, 577);
+  assertEquals(m.a578, 578);
+  assertEquals(m.a579, 579);
+  assertEquals(m.a580, 580);
+  assertEquals(m.a581, 581);
+  assertEquals(m.a582, 582);
+  assertEquals(m.a583, 583);
+  assertEquals(m.a584, 584);
+  assertEquals(m.a585, 585);
+  assertEquals(m.a586, 586);
+  assertEquals(m.a587, 587);
+  assertEquals(m.a588, 588);
+  assertEquals(m.a589, 589);
+  assertEquals(m.a590, 590);
+  assertEquals(m.a591, 591);
+  assertEquals(m.a592, 592);
+  assertEquals(m.a593, 593);
+  assertEquals(m.a594, 594);
+  assertEquals(m.a595, 595);
+  assertEquals(m.a596, 596);
+  assertEquals(m.a597, 597);
+  assertEquals(m.a598, 598);
+  assertEquals(m.a599, 599);
+  assertEquals(m.a600, 600);
+  assertEquals(m.a601, 601);
+  assertEquals(m.a602, 602);
+  assertEquals(m.a603, 603);
+  assertEquals(m.a604, 604);
+  assertEquals(m.a605, 605);
+  assertEquals(m.a606, 606);
+  assertEquals(m.a607, 607);
+  assertEquals(m.a608, 608);
+  assertEquals(m.a609, 609);
+  assertEquals(m.a610, 610);
+  assertEquals(m.a611, 611);
+  assertEquals(m.a612, 612);
+  assertEquals(m.a613, 613);
+  assertEquals(m.a614, 614);
+  assertEquals(m.a615, 615);
+  assertEquals(m.a616, 616);
+  assertEquals(m.a617, 617);
+  assertEquals(m.a618, 618);
+  assertEquals(m.a619, 619);
+  assertEquals(m.a620, 620);
+  assertEquals(m.a621, 621);
+  assertEquals(m.a622, 622);
+  assertEquals(m.a623, 623);
+  assertEquals(m.a624, 624);
+  assertEquals(m.a625, 625);
+  assertEquals(m.a626, 626);
+  assertEquals(m.a627, 627);
+  assertEquals(m.a628, 628);
+  assertEquals(m.a629, 629);
+  assertEquals(m.a630, 630);
+  assertEquals(m.a631, 631);
+  assertEquals(m.a632, 632);
+  assertEquals(m.a633, 633);
+  assertEquals(m.a634, 634);
+  assertEquals(m.a635, 635);
+  assertEquals(m.a636, 636);
+  assertEquals(m.a637, 637);
+  assertEquals(m.a638, 638);
+  assertEquals(m.a639, 639);
+  assertEquals(m.a640, 640);
+  assertEquals(m.a641, 641);
+  assertEquals(m.a642, 642);
+  assertEquals(m.a643, 643);
+  assertEquals(m.a644, 644);
+  assertEquals(m.a645, 645);
+  assertEquals(m.a646, 646);
+  assertEquals(m.a647, 647);
+  assertEquals(m.a648, 648);
+  assertEquals(m.a649, 649);
+  assertEquals(m.a650, 650);
+  assertEquals(m.a651, 651);
+  assertEquals(m.a652, 652);
+  assertEquals(m.a653, 653);
+  assertEquals(m.a654, 654);
+  assertEquals(m.a655, 655);
+  assertEquals(m.a656, 656);
+  assertEquals(m.a657, 657);
+  assertEquals(m.a658, 658);
+  assertEquals(m.a659, 659);
+  assertEquals(m.a660, 660);
+  assertEquals(m.a661, 661);
+  assertEquals(m.a662, 662);
+  assertEquals(m.a663, 663);
+  assertEquals(m.a664, 664);
+  assertEquals(m.a665, 665);
+  assertEquals(m.a666, 666);
+  assertEquals(m.a667, 667);
+  assertEquals(m.a668, 668);
+  assertEquals(m.a669, 669);
+  assertEquals(m.a670, 670);
+  assertEquals(m.a671, 671);
+  assertEquals(m.a672, 672);
+  assertEquals(m.a673, 673);
+  assertEquals(m.a674, 674);
+  assertEquals(m.a675, 675);
+  assertEquals(m.a676, 676);
+  assertEquals(m.a677, 677);
+  assertEquals(m.a678, 678);
+  assertEquals(m.a679, 679);
+  assertEquals(m.a680, 680);
+  assertEquals(m.a681, 681);
+  assertEquals(m.a682, 682);
+  assertEquals(m.a683, 683);
+  assertEquals(m.a684, 684);
+  assertEquals(m.a685, 685);
+  assertEquals(m.a686, 686);
+  assertEquals(m.a687, 687);
+  assertEquals(m.a688, 688);
+  assertEquals(m.a689, 689);
+  assertEquals(m.a690, 690);
+  assertEquals(m.a691, 691);
+  assertEquals(m.a692, 692);
+  assertEquals(m.a693, 693);
+  assertEquals(m.a694, 694);
+  assertEquals(m.a695, 695);
+  assertEquals(m.a696, 696);
+  assertEquals(m.a697, 697);
+  assertEquals(m.a698, 698);
+  assertEquals(m.a699, 699);
+  assertEquals(m.a700, 700);
+  assertEquals(m.a701, 701);
+  assertEquals(m.a702, 702);
+  assertEquals(m.a703, 703);
+  assertEquals(m.a704, 704);
+  assertEquals(m.a705, 705);
+  assertEquals(m.a706, 706);
+  assertEquals(m.a707, 707);
+  assertEquals(m.a708, 708);
+  assertEquals(m.a709, 709);
+  assertEquals(m.a710, 710);
+  assertEquals(m.a711, 711);
+  assertEquals(m.a712, 712);
+  assertEquals(m.a713, 713);
+  assertEquals(m.a714, 714);
+  assertEquals(m.a715, 715);
+  assertEquals(m.a716, 716);
+  assertEquals(m.a717, 717);
+  assertEquals(m.a718, 718);
+  assertEquals(m.a719, 719);
+  assertEquals(m.a720, 720);
+  assertEquals(m.a721, 721);
+  assertEquals(m.a722, 722);
+  assertEquals(m.a723, 723);
+  assertEquals(m.a724, 724);
+  assertEquals(m.a725, 725);
+  assertEquals(m.a726, 726);
+  assertEquals(m.a727, 727);
+  assertEquals(m.a728, 728);
+  assertEquals(m.a729, 729);
+  assertEquals(m.a730, 730);
+  assertEquals(m.a731, 731);
+  assertEquals(m.a732, 732);
+  assertEquals(m.a733, 733);
+  assertEquals(m.a734, 734);
+  assertEquals(m.a735, 735);
+  assertEquals(m.a736, 736);
+  assertEquals(m.a737, 737);
+  assertEquals(m.a738, 738);
+  assertEquals(m.a739, 739);
+  assertEquals(m.a740, 740);
+  assertEquals(m.a741, 741);
+  assertEquals(m.a742, 742);
+  assertEquals(m.a743, 743);
+  assertEquals(m.a744, 744);
+  assertEquals(m.a745, 745);
+  assertEquals(m.a746, 746);
+  assertEquals(m.a747, 747);
+  assertEquals(m.a748, 748);
+  assertEquals(m.a749, 749);
+  assertEquals(m.a750, 750);
+  assertEquals(m.a751, 751);
+  assertEquals(m.a752, 752);
+  assertEquals(m.a753, 753);
+  assertEquals(m.a754, 754);
+  assertEquals(m.a755, 755);
+  assertEquals(m.a756, 756);
+  assertEquals(m.a757, 757);
+  assertEquals(m.a758, 758);
+  assertEquals(m.a759, 759);
+  assertEquals(m.a760, 760);
+  assertEquals(m.a761, 761);
+  assertEquals(m.a762, 762);
+  assertEquals(m.a763, 763);
+  assertEquals(m.a764, 764);
+  assertEquals(m.a765, 765);
+  assertEquals(m.a766, 766);
+  assertEquals(m.a767, 767);
+  assertEquals(m.a768, 768);
+  assertEquals(m.a769, 769);
+  assertEquals(m.a770, 770);
+  assertEquals(m.a771, 771);
+  assertEquals(m.a772, 772);
+  assertEquals(m.a773, 773);
+  assertEquals(m.a774, 774);
+  assertEquals(m.a775, 775);
+  assertEquals(m.a776, 776);
+  assertEquals(m.a777, 777);
+  assertEquals(m.a778, 778);
+  assertEquals(m.a779, 779);
+  assertEquals(m.a780, 780);
+  assertEquals(m.a781, 781);
+  assertEquals(m.a782, 782);
+  assertEquals(m.a783, 783);
+  assertEquals(m.a784, 784);
+  assertEquals(m.a785, 785);
+  assertEquals(m.a786, 786);
+  assertEquals(m.a787, 787);
+  assertEquals(m.a788, 788);
+  assertEquals(m.a789, 789);
+  assertEquals(m.a790, 790);
+  assertEquals(m.a791, 791);
+  assertEquals(m.a792, 792);
+  assertEquals(m.a793, 793);
+  assertEquals(m.a794, 794);
+  assertEquals(m.a795, 795);
+  assertEquals(m.a796, 796);
+  assertEquals(m.a797, 797);
+  assertEquals(m.a798, 798);
+  assertEquals(m.a799, 799);
+  assertEquals(m.a800, 800);
+  assertEquals(m.a801, 801);
+  assertEquals(m.a802, 802);
+  assertEquals(m.a803, 803);
+  assertEquals(m.a804, 804);
+  assertEquals(m.a805, 805);
+  assertEquals(m.a806, 806);
+  assertEquals(m.a807, 807);
+  assertEquals(m.a808, 808);
+  assertEquals(m.a809, 809);
+  assertEquals(m.a810, 810);
+  assertEquals(m.a811, 811);
+  assertEquals(m.a812, 812);
+  assertEquals(m.a813, 813);
+  assertEquals(m.a814, 814);
+  assertEquals(m.a815, 815);
+  assertEquals(m.a816, 816);
+  assertEquals(m.a817, 817);
+  assertEquals(m.a818, 818);
+  assertEquals(m.a819, 819);
+  assertEquals(m.a820, 820);
+  assertEquals(m.a821, 821);
+  assertEquals(m.a822, 822);
+  assertEquals(m.a823, 823);
+  assertEquals(m.a824, 824);
+  assertEquals(m.a825, 825);
+  assertEquals(m.a826, 826);
+  assertEquals(m.a827, 827);
+  assertEquals(m.a828, 828);
+  assertEquals(m.a829, 829);
+  assertEquals(m.a830, 830);
+  assertEquals(m.a831, 831);
+  assertEquals(m.a832, 832);
+  assertEquals(m.a833, 833);
+  assertEquals(m.a834, 834);
+  assertEquals(m.a835, 835);
+  assertEquals(m.a836, 836);
+  assertEquals(m.a837, 837);
+  assertEquals(m.a838, 838);
+  assertEquals(m.a839, 839);
+  assertEquals(m.a840, 840);
+  assertEquals(m.a841, 841);
+  assertEquals(m.a842, 842);
+  assertEquals(m.a843, 843);
+  assertEquals(m.a844, 844);
+  assertEquals(m.a845, 845);
+  assertEquals(m.a846, 846);
+  assertEquals(m.a847, 847);
+  assertEquals(m.a848, 848);
+  assertEquals(m.a849, 849);
+  assertEquals(m.a850, 850);
+  assertEquals(m.a851, 851);
+  assertEquals(m.a852, 852);
+  assertEquals(m.a853, 853);
+  assertEquals(m.a854, 854);
+  assertEquals(m.a855, 855);
+  assertEquals(m.a856, 856);
+  assertEquals(m.a857, 857);
+  assertEquals(m.a858, 858);
+  assertEquals(m.a859, 859);
+  assertEquals(m.a860, 860);
+  assertEquals(m.a861, 861);
+  assertEquals(m.a862, 862);
+  assertEquals(m.a863, 863);
+  assertEquals(m.a864, 864);
+  assertEquals(m.a865, 865);
+  assertEquals(m.a866, 866);
+  assertEquals(m.a867, 867);
+  assertEquals(m.a868, 868);
+  assertEquals(m.a869, 869);
+  assertEquals(m.a870, 870);
+  assertEquals(m.a871, 871);
+  assertEquals(m.a872, 872);
+  assertEquals(m.a873, 873);
+  assertEquals(m.a874, 874);
+  assertEquals(m.a875, 875);
+  assertEquals(m.a876, 876);
+  assertEquals(m.a877, 877);
+  assertEquals(m.a878, 878);
+  assertEquals(m.a879, 879);
+  assertEquals(m.a880, 880);
+  assertEquals(m.a881, 881);
+  assertEquals(m.a882, 882);
+  assertEquals(m.a883, 883);
+  assertEquals(m.a884, 884);
+  assertEquals(m.a885, 885);
+  assertEquals(m.a886, 886);
+  assertEquals(m.a887, 887);
+  assertEquals(m.a888, 888);
+  assertEquals(m.a889, 889);
+  assertEquals(m.a890, 890);
+  assertEquals(m.a891, 891);
+  assertEquals(m.a892, 892);
+  assertEquals(m.a893, 893);
+  assertEquals(m.a894, 894);
+  assertEquals(m.a895, 895);
+  assertEquals(m.a896, 896);
+  assertEquals(m.a897, 897);
+  assertEquals(m.a898, 898);
+  assertEquals(m.a899, 899);
+  assertEquals(m.a900, 900);
+  assertEquals(m.a901, 901);
+  assertEquals(m.a902, 902);
+  assertEquals(m.a903, 903);
+  assertEquals(m.a904, 904);
+  assertEquals(m.a905, 905);
+  assertEquals(m.a906, 906);
+  assertEquals(m.a907, 907);
+  assertEquals(m.a908, 908);
+  assertEquals(m.a909, 909);
+  assertEquals(m.a910, 910);
+  assertEquals(m.a911, 911);
+  assertEquals(m.a912, 912);
+  assertEquals(m.a913, 913);
+  assertEquals(m.a914, 914);
+  assertEquals(m.a915, 915);
+  assertEquals(m.a916, 916);
+  assertEquals(m.a917, 917);
+  assertEquals(m.a918, 918);
+  assertEquals(m.a919, 919);
+  assertEquals(m.a920, 920);
+  assertEquals(m.a921, 921);
+  assertEquals(m.a922, 922);
+  assertEquals(m.a923, 923);
+  assertEquals(m.a924, 924);
+  assertEquals(m.a925, 925);
+  assertEquals(m.a926, 926);
+  assertEquals(m.a927, 927);
+  assertEquals(m.a928, 928);
+  assertEquals(m.a929, 929);
+  assertEquals(m.a930, 930);
+  assertEquals(m.a931, 931);
+  assertEquals(m.a932, 932);
+  assertEquals(m.a933, 933);
+  assertEquals(m.a934, 934);
+  assertEquals(m.a935, 935);
+  assertEquals(m.a936, 936);
+  assertEquals(m.a937, 937);
+  assertEquals(m.a938, 938);
+  assertEquals(m.a939, 939);
+  assertEquals(m.a940, 940);
+  assertEquals(m.a941, 941);
+  assertEquals(m.a942, 942);
+  assertEquals(m.a943, 943);
+  assertEquals(m.a944, 944);
+  assertEquals(m.a945, 945);
+  assertEquals(m.a946, 946);
+  assertEquals(m.a947, 947);
+  assertEquals(m.a948, 948);
+  assertEquals(m.a949, 949);
+  assertEquals(m.a950, 950);
+  assertEquals(m.a951, 951);
+  assertEquals(m.a952, 952);
+  assertEquals(m.a953, 953);
+  assertEquals(m.a954, 954);
+  assertEquals(m.a955, 955);
+  assertEquals(m.a956, 956);
+  assertEquals(m.a957, 957);
+  assertEquals(m.a958, 958);
+  assertEquals(m.a959, 959);
+  assertEquals(m.a960, 960);
+  assertEquals(m.a961, 961);
+  assertEquals(m.a962, 962);
+  assertEquals(m.a963, 963);
+  assertEquals(m.a964, 964);
+  assertEquals(m.a965, 965);
+  assertEquals(m.a966, 966);
+  assertEquals(m.a967, 967);
+  assertEquals(m.a968, 968);
+  assertEquals(m.a969, 969);
+  assertEquals(m.a970, 970);
+  assertEquals(m.a971, 971);
+  assertEquals(m.a972, 972);
+  assertEquals(m.a973, 973);
+  assertEquals(m.a974, 974);
+  assertEquals(m.a975, 975);
+  assertEquals(m.a976, 976);
+  assertEquals(m.a977, 977);
+  assertEquals(m.a978, 978);
+  assertEquals(m.a979, 979);
+  assertEquals(m.a980, 980);
+  assertEquals(m.a981, 981);
+  assertEquals(m.a982, 982);
+  assertEquals(m.a983, 983);
+  assertEquals(m.a984, 984);
+  assertEquals(m.a985, 985);
+  assertEquals(m.a986, 986);
+  assertEquals(m.a987, 987);
+  assertEquals(m.a988, 988);
+  assertEquals(m.a989, 989);
+  assertEquals(m.a990, 990);
+  assertEquals(m.a991, 991);
+  assertEquals(m.a992, 992);
+  assertEquals(m.a993, 993);
+  assertEquals(m.a994, 994);
+  assertEquals(m.a995, 995);
+  assertEquals(m.a996, 996);
+  assertEquals(m.a997, 997);
+  assertEquals(m.a998, 998);
+  assertEquals(m.a999, 999);
+  assertEquals(m.a1000, 1000);
+  assertEquals(m.a1001, 1001);
+  assertEquals(m.a1002, 1002);
+  assertEquals(m.a1003, 1003);
+  assertEquals(m.a1004, 1004);
+  assertEquals(m.a1005, 1005);
+  assertEquals(m.a1006, 1006);
+  assertEquals(m.a1007, 1007);
+  assertEquals(m.a1008, 1008);
+  assertEquals(m.a1009, 1009);
+  assertEquals(m.a1010, 1010);
+  assertEquals(m.a1011, 1011);
+  assertEquals(m.a1012, 1012);
+  assertEquals(m.a1013, 1013);
+  assertEquals(m.a1014, 1014);
+  assertEquals(m.a1015, 1015);
+  assertEquals(m.a1016, 1016);
+  assertEquals(m.a1017, 1017);
+  assertEquals(m.a1018, 1018);
+  assertEquals(m.a1019, 1019);
+  assertEquals(m.a1020, 1020);
+  assertEquals(m.a1021, 1021);
+  assertEquals(m.a1022, 1022);
+  assertEquals(m.a1023, 1023);
+  assertEquals(m.a1024, 1024);
+  assertEquals(m.a1025, 1025);
+  assertEquals(m.a1026, 1026);
+  assertEquals(m.a1027, 1027);
+  assertEquals(m.a1028, 1028);
+  assertEquals(m.a1029, 1029);
+  assertEquals(m.a1030, 1030);
+  assertEquals(m.a1031, 1031);
+  assertEquals(m.a1032, 1032);
+  assertEquals(m.a1033, 1033);
+  assertEquals(m.a1034, 1034);
+  assertEquals(m.a1035, 1035);
+  assertEquals(m.a1036, 1036);
+  assertEquals(m.a1037, 1037);
+  assertEquals(m.a1038, 1038);
+  assertEquals(m.a1039, 1039);
+  assertEquals(m.a1040, 1040);
+  assertEquals(m.a1041, 1041);
+  assertEquals(m.a1042, 1042);
+  assertEquals(m.a1043, 1043);
+  assertEquals(m.a1044, 1044);
+  assertEquals(m.a1045, 1045);
+  assertEquals(m.a1046, 1046);
+  assertEquals(m.a1047, 1047);
+  assertEquals(m.a1048, 1048);
+  assertEquals(m.a1049, 1049);
+  assertEquals(m.a1050, 1050);
+  assertEquals(m.a1051, 1051);
+  assertEquals(m.a1052, 1052);
+  assertEquals(m.a1053, 1053);
+  assertEquals(m.a1054, 1054);
+  assertEquals(m.a1055, 1055);
+  assertEquals(m.a1056, 1056);
+  assertEquals(m.a1057, 1057);
+  assertEquals(m.a1058, 1058);
+  assertEquals(m.a1059, 1059);
+  assertEquals(m.a1060, 1060);
+  assertEquals(m.a1061, 1061);
+  assertEquals(m.a1062, 1062);
+  assertEquals(m.a1063, 1063);
+  assertEquals(m.a1064, 1064);
+  assertEquals(m.a1065, 1065);
+  assertEquals(m.a1066, 1066);
+  assertEquals(m.a1067, 1067);
+  assertEquals(m.a1068, 1068);
+  assertEquals(m.a1069, 1069);
+  assertEquals(m.a1070, 1070);
+  assertEquals(m.a1071, 1071);
+  assertEquals(m.a1072, 1072);
+  assertEquals(m.a1073, 1073);
+  assertEquals(m.a1074, 1074);
+  assertEquals(m.a1075, 1075);
+  assertEquals(m.a1076, 1076);
+  assertEquals(m.a1077, 1077);
+  assertEquals(m.a1078, 1078);
+  assertEquals(m.a1079, 1079);
+  assertEquals(m.a1080, 1080);
+  assertEquals(m.a1081, 1081);
+  assertEquals(m.a1082, 1082);
+  assertEquals(m.a1083, 1083);
+  assertEquals(m.a1084, 1084);
+  assertEquals(m.a1085, 1085);
+  assertEquals(m.a1086, 1086);
+  assertEquals(m.a1087, 1087);
+  assertEquals(m.a1088, 1088);
+  assertEquals(m.a1089, 1089);
+  assertEquals(m.a1090, 1090);
+  assertEquals(m.a1091, 1091);
+  assertEquals(m.a1092, 1092);
+  assertEquals(m.a1093, 1093);
+  assertEquals(m.a1094, 1094);
+  assertEquals(m.a1095, 1095);
+  assertEquals(m.a1096, 1096);
+  assertEquals(m.a1097, 1097);
+  assertEquals(m.a1098, 1098);
+  assertEquals(m.a1099, 1099);
+}
+verify(m1);  // Uninitialized.
+verify(m1);  // Premonomorphic.
+verify(m2);  // Monomorphic.
diff --git a/src/v8/test/mjsunit/harmony/modules-import-meta.mjs b/src/v8/test/mjsunit/harmony/modules-import-meta.mjs
new file mode 100644
index 0000000..ab2ac04
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-import-meta.mjs
@@ -0,0 +1,42 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+// Flags: --harmony-import-meta
+
+import foreign, { url as otherUrl } from './modules-skip-export-import-meta.mjs';
+
+assertEquals("object", typeof import.meta);
+assertEquals(null, Object.getPrototypeOf(import.meta));
+assertSame(import.meta, import.meta);
+
+const loadImportMetaArrow = () => import.meta;
+assertSame(loadImportMetaArrow(), import.meta);
+function loadImportMetaFn() {
+  try {
+    throw new Error('force catch code path for nested context');
+  } catch (e) {
+    return import.meta;
+  }
+}
+loadImportMetaFn();
+assertSame(loadImportMetaFn(), import.meta);
+
+// This property isn't part of the spec itself but is mentioned as an example
+assertMatches(/\/modules-import-meta\.mjs$/, import.meta.url);
+
+import.meta.x = 42;
+assertEquals(42, import.meta.x);
+Object.assign(import.meta, { foo: "bar" })
+assertEquals("bar", import.meta.foo);
+
+// PerformEval parses its argument for the goal symbol Script. So the following
+// should fail just as it does for every other Script context.
+//
+// See:
+// https://github.com/tc39/proposal-import-meta/issues/7#issuecomment-329363083
+assertThrows(() => eval('import.meta'), SyntaxError);
+assertThrows(() => new Function('return import.meta;'), SyntaxError);
+
+assertNotEquals(foreign, import.meta);
+assertMatches(/\/modules-skip-export-import-meta\.mjs$/, foreign.url);
+assertEquals(foreign.url, otherUrl);
diff --git a/src/v8/test/mjsunit/harmony/modules-import-namespace.mjs b/src/v8/test/mjsunit/harmony/modules-import-namespace.mjs
new file mode 100644
index 0000000..5dbe84c
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-import-namespace.mjs
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+import * as m from "modules-skip-3.mjs";
+
+function get() {
+  return m.stringlife;
+}
+
+%PrepareFunctionForOptimization(get);
+assertEquals("42", get());
+assertEquals("42", get());
+assertEquals("42", get());
+%OptimizeFunctionOnNextCall(get);
+assertEquals("42", get());
diff --git a/src/v8/test/mjsunit/harmony/modules-skip-1.mjs b/src/v8/test/mjsunit/harmony/modules-skip-1.mjs
new file mode 100644
index 0000000..ee854b6
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-skip-1.mjs
@@ -0,0 +1,5 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export function life() { return 42; }
diff --git a/src/v8/test/mjsunit/harmony/modules-skip-10.mjs b/src/v8/test/mjsunit/harmony/modules-skip-10.mjs
new file mode 100644
index 0000000..692dc38
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-skip-10.mjs
@@ -0,0 +1,5 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import {x} from "./modules-skip-10.mjs"
diff --git a/src/v8/test/mjsunit/harmony/modules-skip-11.mjs b/src/v8/test/mjsunit/harmony/modules-skip-11.mjs
new file mode 100644
index 0000000..8981f50
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-skip-11.mjs
@@ -0,0 +1,5 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+throw Symbol();
diff --git a/src/v8/test/mjsunit/harmony/modules-skip-12.mjs b/src/v8/test/mjsunit/harmony/modules-skip-12.mjs
new file mode 100644
index 0000000..05fedfa
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-skip-12.mjs
@@ -0,0 +1,5 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+$^#$%@#@^^%^%$^#%%#!#$%!#$@#$%
diff --git a/src/v8/test/mjsunit/harmony/modules-skip-13.mjs b/src/v8/test/mjsunit/harmony/modules-skip-13.mjs
new file mode 100644
index 0000000..1575a54
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-skip-13.mjs
@@ -0,0 +1,6 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export * as self from "./modules-skip-13.mjs";
+export default 42;
diff --git a/src/v8/test/mjsunit/harmony/modules-skip-2.mjs b/src/v8/test/mjsunit/harmony/modules-skip-2.mjs
new file mode 100644
index 0000000..6ff97a9
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-skip-2.mjs
@@ -0,0 +1,5 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+throw new Error('42 is not the answer');
diff --git a/src/v8/test/mjsunit/harmony/modules-skip-3.mjs b/src/v8/test/mjsunit/harmony/modules-skip-3.mjs
new file mode 100644
index 0000000..6f9984e
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-skip-3.mjs
@@ -0,0 +1,5 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export let stringlife = "42";
diff --git a/src/v8/test/mjsunit/harmony/modules-skip-4.mjs b/src/v8/test/mjsunit/harmony/modules-skip-4.mjs
new file mode 100644
index 0000000..d962bfe
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-skip-4.mjs
@@ -0,0 +1,6 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export * from 'modules-skip-1.mjs';
+export * from 'modules-skip-3.mjs';
diff --git a/src/v8/test/mjsunit/harmony/modules-skip-5.mjs b/src/v8/test/mjsunit/harmony/modules-skip-5.mjs
new file mode 100644
index 0000000..fc1eebb
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-skip-5.mjs
@@ -0,0 +1,15 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-dynamic-import
+
+var dynamic_life;
+
+import * as static_life from 'modules-skip-1.mjs';
+import * as relative_static_life from './modules-skip-1.mjs';
+import('modules-skip-1.mjs').then(namespace => dynamic_life = namespace);
+
+export { static_life };
+export { relative_static_life };
+export { dynamic_life };
diff --git a/src/v8/test/mjsunit/harmony/modules-skip-6.mjs b/src/v8/test/mjsunit/harmony/modules-skip-6.mjs
new file mode 100644
index 0000000..6acc2b8
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-skip-6.mjs
@@ -0,0 +1,11 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-dynamic-import
+
+Object.defineProperty(Object, 'life', {
+  value: 42
+});
+
+export let life = "42";
diff --git a/src/v8/test/mjsunit/harmony/modules-skip-7.mjs b/src/v8/test/mjsunit/harmony/modules-skip-7.mjs
new file mode 100644
index 0000000..4733c46
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-skip-7.mjs
@@ -0,0 +1,14 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-dynamic-import
+
+export async function getLife() {
+  try {
+    let namespace = await import('modules-skip-1.mjs');
+    return namespace.life();
+  } catch (e) {
+    %AbortJS('failure: ' + e);
+  }
+}
diff --git a/src/v8/test/mjsunit/harmony/modules-skip-8.mjs b/src/v8/test/mjsunit/harmony/modules-skip-8.mjs
new file mode 100644
index 0000000..816cf2c
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-skip-8.mjs
@@ -0,0 +1,5 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+await x;
diff --git a/src/v8/test/mjsunit/harmony/modules-skip-9.mjs b/src/v8/test/mjsunit/harmony/modules-skip-9.mjs
new file mode 100644
index 0000000..cca36f9
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-skip-9.mjs
@@ -0,0 +1,5 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import x from 'modules-skip-empty.mjs';
diff --git a/src/v8/test/mjsunit/harmony/modules-skip-empty.mjs b/src/v8/test/mjsunit/harmony/modules-skip-empty.mjs
new file mode 100644
index 0000000..4af874c
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-skip-empty.mjs
@@ -0,0 +1,3 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
diff --git a/src/v8/test/mjsunit/harmony/modules-skip-export-import-meta.mjs b/src/v8/test/mjsunit/harmony/modules-skip-export-import-meta.mjs
new file mode 100644
index 0000000..e58e501
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-skip-export-import-meta.mjs
@@ -0,0 +1,7 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export default import.meta;
+const { url } = import.meta;
+export { url };
diff --git a/src/v8/test/mjsunit/harmony/modules-skip-large1.mjs b/src/v8/test/mjsunit/harmony/modules-skip-large1.mjs
new file mode 100644
index 0000000..e643df3
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-skip-large1.mjs
@@ -0,0 +1,2204 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export let a0 = 0;
+export let a1 = 1;
+export let a2 = 2;
+export let a3 = 3;
+export let a4 = 4;
+export let a5 = 5;
+export let a6 = 6;
+export let a7 = 7;
+export let a8 = 8;
+export let a9 = 9;
+export let a10 = 10;
+export let a11 = 11;
+export let a12 = 12;
+export let a13 = 13;
+export let a14 = 14;
+export let a15 = 15;
+export let a16 = 16;
+export let a17 = 17;
+export let a18 = 18;
+export let a19 = 19;
+export let a20 = 20;
+export let a21 = 21;
+export let a22 = 22;
+export let a23 = 23;
+export let a24 = 24;
+export let a25 = 25;
+export let a26 = 26;
+export let a27 = 27;
+export let a28 = 28;
+export let a29 = 29;
+export let a30 = 30;
+export let a31 = 31;
+export let a32 = 32;
+export let a33 = 33;
+export let a34 = 34;
+export let a35 = 35;
+export let a36 = 36;
+export let a37 = 37;
+export let a38 = 38;
+export let a39 = 39;
+export let a40 = 40;
+export let a41 = 41;
+export let a42 = 42;
+export let a43 = 43;
+export let a44 = 44;
+export let a45 = 45;
+export let a46 = 46;
+export let a47 = 47;
+export let a48 = 48;
+export let a49 = 49;
+export let a50 = 50;
+export let a51 = 51;
+export let a52 = 52;
+export let a53 = 53;
+export let a54 = 54;
+export let a55 = 55;
+export let a56 = 56;
+export let a57 = 57;
+export let a58 = 58;
+export let a59 = 59;
+export let a60 = 60;
+export let a61 = 61;
+export let a62 = 62;
+export let a63 = 63;
+export let a64 = 64;
+export let a65 = 65;
+export let a66 = 66;
+export let a67 = 67;
+export let a68 = 68;
+export let a69 = 69;
+export let a70 = 70;
+export let a71 = 71;
+export let a72 = 72;
+export let a73 = 73;
+export let a74 = 74;
+export let a75 = 75;
+export let a76 = 76;
+export let a77 = 77;
+export let a78 = 78;
+export let a79 = 79;
+export let a80 = 80;
+export let a81 = 81;
+export let a82 = 82;
+export let a83 = 83;
+export let a84 = 84;
+export let a85 = 85;
+export let a86 = 86;
+export let a87 = 87;
+export let a88 = 88;
+export let a89 = 89;
+export let a90 = 90;
+export let a91 = 91;
+export let a92 = 92;
+export let a93 = 93;
+export let a94 = 94;
+export let a95 = 95;
+export let a96 = 96;
+export let a97 = 97;
+export let a98 = 98;
+export let a99 = 99;
+export let a100 = 100;
+export let a101 = 101;
+export let a102 = 102;
+export let a103 = 103;
+export let a104 = 104;
+export let a105 = 105;
+export let a106 = 106;
+export let a107 = 107;
+export let a108 = 108;
+export let a109 = 109;
+export let a110 = 110;
+export let a111 = 111;
+export let a112 = 112;
+export let a113 = 113;
+export let a114 = 114;
+export let a115 = 115;
+export let a116 = 116;
+export let a117 = 117;
+export let a118 = 118;
+export let a119 = 119;
+export let a120 = 120;
+export let a121 = 121;
+export let a122 = 122;
+export let a123 = 123;
+export let a124 = 124;
+export let a125 = 125;
+export let a126 = 126;
+export let a127 = 127;
+export let a128 = 128;
+export let a129 = 129;
+export let a130 = 130;
+export let a131 = 131;
+export let a132 = 132;
+export let a133 = 133;
+export let a134 = 134;
+export let a135 = 135;
+export let a136 = 136;
+export let a137 = 137;
+export let a138 = 138;
+export let a139 = 139;
+export let a140 = 140;
+export let a141 = 141;
+export let a142 = 142;
+export let a143 = 143;
+export let a144 = 144;
+export let a145 = 145;
+export let a146 = 146;
+export let a147 = 147;
+export let a148 = 148;
+export let a149 = 149;
+export let a150 = 150;
+export let a151 = 151;
+export let a152 = 152;
+export let a153 = 153;
+export let a154 = 154;
+export let a155 = 155;
+export let a156 = 156;
+export let a157 = 157;
+export let a158 = 158;
+export let a159 = 159;
+export let a160 = 160;
+export let a161 = 161;
+export let a162 = 162;
+export let a163 = 163;
+export let a164 = 164;
+export let a165 = 165;
+export let a166 = 166;
+export let a167 = 167;
+export let a168 = 168;
+export let a169 = 169;
+export let a170 = 170;
+export let a171 = 171;
+export let a172 = 172;
+export let a173 = 173;
+export let a174 = 174;
+export let a175 = 175;
+export let a176 = 176;
+export let a177 = 177;
+export let a178 = 178;
+export let a179 = 179;
+export let a180 = 180;
+export let a181 = 181;
+export let a182 = 182;
+export let a183 = 183;
+export let a184 = 184;
+export let a185 = 185;
+export let a186 = 186;
+export let a187 = 187;
+export let a188 = 188;
+export let a189 = 189;
+export let a190 = 190;
+export let a191 = 191;
+export let a192 = 192;
+export let a193 = 193;
+export let a194 = 194;
+export let a195 = 195;
+export let a196 = 196;
+export let a197 = 197;
+export let a198 = 198;
+export let a199 = 199;
+export let a200 = 200;
+export let a201 = 201;
+export let a202 = 202;
+export let a203 = 203;
+export let a204 = 204;
+export let a205 = 205;
+export let a206 = 206;
+export let a207 = 207;
+export let a208 = 208;
+export let a209 = 209;
+export let a210 = 210;
+export let a211 = 211;
+export let a212 = 212;
+export let a213 = 213;
+export let a214 = 214;
+export let a215 = 215;
+export let a216 = 216;
+export let a217 = 217;
+export let a218 = 218;
+export let a219 = 219;
+export let a220 = 220;
+export let a221 = 221;
+export let a222 = 222;
+export let a223 = 223;
+export let a224 = 224;
+export let a225 = 225;
+export let a226 = 226;
+export let a227 = 227;
+export let a228 = 228;
+export let a229 = 229;
+export let a230 = 230;
+export let a231 = 231;
+export let a232 = 232;
+export let a233 = 233;
+export let a234 = 234;
+export let a235 = 235;
+export let a236 = 236;
+export let a237 = 237;
+export let a238 = 238;
+export let a239 = 239;
+export let a240 = 240;
+export let a241 = 241;
+export let a242 = 242;
+export let a243 = 243;
+export let a244 = 244;
+export let a245 = 245;
+export let a246 = 246;
+export let a247 = 247;
+export let a248 = 248;
+export let a249 = 249;
+export let a250 = 250;
+export let a251 = 251;
+export let a252 = 252;
+export let a253 = 253;
+export let a254 = 254;
+export let a255 = 255;
+export let a256 = 256;
+export let a257 = 257;
+export let a258 = 258;
+export let a259 = 259;
+export let a260 = 260;
+export let a261 = 261;
+export let a262 = 262;
+export let a263 = 263;
+export let a264 = 264;
+export let a265 = 265;
+export let a266 = 266;
+export let a267 = 267;
+export let a268 = 268;
+export let a269 = 269;
+export let a270 = 270;
+export let a271 = 271;
+export let a272 = 272;
+export let a273 = 273;
+export let a274 = 274;
+export let a275 = 275;
+export let a276 = 276;
+export let a277 = 277;
+export let a278 = 278;
+export let a279 = 279;
+export let a280 = 280;
+export let a281 = 281;
+export let a282 = 282;
+export let a283 = 283;
+export let a284 = 284;
+export let a285 = 285;
+export let a286 = 286;
+export let a287 = 287;
+export let a288 = 288;
+export let a289 = 289;
+export let a290 = 290;
+export let a291 = 291;
+export let a292 = 292;
+export let a293 = 293;
+export let a294 = 294;
+export let a295 = 295;
+export let a296 = 296;
+export let a297 = 297;
+export let a298 = 298;
+export let a299 = 299;
+export let a300 = 300;
+export let a301 = 301;
+export let a302 = 302;
+export let a303 = 303;
+export let a304 = 304;
+export let a305 = 305;
+export let a306 = 306;
+export let a307 = 307;
+export let a308 = 308;
+export let a309 = 309;
+export let a310 = 310;
+export let a311 = 311;
+export let a312 = 312;
+export let a313 = 313;
+export let a314 = 314;
+export let a315 = 315;
+export let a316 = 316;
+export let a317 = 317;
+export let a318 = 318;
+export let a319 = 319;
+export let a320 = 320;
+export let a321 = 321;
+export let a322 = 322;
+export let a323 = 323;
+export let a324 = 324;
+export let a325 = 325;
+export let a326 = 326;
+export let a327 = 327;
+export let a328 = 328;
+export let a329 = 329;
+export let a330 = 330;
+export let a331 = 331;
+export let a332 = 332;
+export let a333 = 333;
+export let a334 = 334;
+export let a335 = 335;
+export let a336 = 336;
+export let a337 = 337;
+export let a338 = 338;
+export let a339 = 339;
+export let a340 = 340;
+export let a341 = 341;
+export let a342 = 342;
+export let a343 = 343;
+export let a344 = 344;
+export let a345 = 345;
+export let a346 = 346;
+export let a347 = 347;
+export let a348 = 348;
+export let a349 = 349;
+export let a350 = 350;
+export let a351 = 351;
+export let a352 = 352;
+export let a353 = 353;
+export let a354 = 354;
+export let a355 = 355;
+export let a356 = 356;
+export let a357 = 357;
+export let a358 = 358;
+export let a359 = 359;
+export let a360 = 360;
+export let a361 = 361;
+export let a362 = 362;
+export let a363 = 363;
+export let a364 = 364;
+export let a365 = 365;
+export let a366 = 366;
+export let a367 = 367;
+export let a368 = 368;
+export let a369 = 369;
+export let a370 = 370;
+export let a371 = 371;
+export let a372 = 372;
+export let a373 = 373;
+export let a374 = 374;
+export let a375 = 375;
+export let a376 = 376;
+export let a377 = 377;
+export let a378 = 378;
+export let a379 = 379;
+export let a380 = 380;
+export let a381 = 381;
+export let a382 = 382;
+export let a383 = 383;
+export let a384 = 384;
+export let a385 = 385;
+export let a386 = 386;
+export let a387 = 387;
+export let a388 = 388;
+export let a389 = 389;
+export let a390 = 390;
+export let a391 = 391;
+export let a392 = 392;
+export let a393 = 393;
+export let a394 = 394;
+export let a395 = 395;
+export let a396 = 396;
+export let a397 = 397;
+export let a398 = 398;
+export let a399 = 399;
+export let a400 = 400;
+export let a401 = 401;
+export let a402 = 402;
+export let a403 = 403;
+export let a404 = 404;
+export let a405 = 405;
+export let a406 = 406;
+export let a407 = 407;
+export let a408 = 408;
+export let a409 = 409;
+export let a410 = 410;
+export let a411 = 411;
+export let a412 = 412;
+export let a413 = 413;
+export let a414 = 414;
+export let a415 = 415;
+export let a416 = 416;
+export let a417 = 417;
+export let a418 = 418;
+export let a419 = 419;
+export let a420 = 420;
+export let a421 = 421;
+export let a422 = 422;
+export let a423 = 423;
+export let a424 = 424;
+export let a425 = 425;
+export let a426 = 426;
+export let a427 = 427;
+export let a428 = 428;
+export let a429 = 429;
+export let a430 = 430;
+export let a431 = 431;
+export let a432 = 432;
+export let a433 = 433;
+export let a434 = 434;
+export let a435 = 435;
+export let a436 = 436;
+export let a437 = 437;
+export let a438 = 438;
+export let a439 = 439;
+export let a440 = 440;
+export let a441 = 441;
+export let a442 = 442;
+export let a443 = 443;
+export let a444 = 444;
+export let a445 = 445;
+export let a446 = 446;
+export let a447 = 447;
+export let a448 = 448;
+export let a449 = 449;
+export let a450 = 450;
+export let a451 = 451;
+export let a452 = 452;
+export let a453 = 453;
+export let a454 = 454;
+export let a455 = 455;
+export let a456 = 456;
+export let a457 = 457;
+export let a458 = 458;
+export let a459 = 459;
+export let a460 = 460;
+export let a461 = 461;
+export let a462 = 462;
+export let a463 = 463;
+export let a464 = 464;
+export let a465 = 465;
+export let a466 = 466;
+export let a467 = 467;
+export let a468 = 468;
+export let a469 = 469;
+export let a470 = 470;
+export let a471 = 471;
+export let a472 = 472;
+export let a473 = 473;
+export let a474 = 474;
+export let a475 = 475;
+export let a476 = 476;
+export let a477 = 477;
+export let a478 = 478;
+export let a479 = 479;
+export let a480 = 480;
+export let a481 = 481;
+export let a482 = 482;
+export let a483 = 483;
+export let a484 = 484;
+export let a485 = 485;
+export let a486 = 486;
+export let a487 = 487;
+export let a488 = 488;
+export let a489 = 489;
+export let a490 = 490;
+export let a491 = 491;
+export let a492 = 492;
+export let a493 = 493;
+export let a494 = 494;
+export let a495 = 495;
+export let a496 = 496;
+export let a497 = 497;
+export let a498 = 498;
+export let a499 = 499;
+export let a500 = 500;
+export let a501 = 501;
+export let a502 = 502;
+export let a503 = 503;
+export let a504 = 504;
+export let a505 = 505;
+export let a506 = 506;
+export let a507 = 507;
+export let a508 = 508;
+export let a509 = 509;
+export let a510 = 510;
+export let a511 = 511;
+export let a512 = 512;
+export let a513 = 513;
+export let a514 = 514;
+export let a515 = 515;
+export let a516 = 516;
+export let a517 = 517;
+export let a518 = 518;
+export let a519 = 519;
+export let a520 = 520;
+export let a521 = 521;
+export let a522 = 522;
+export let a523 = 523;
+export let a524 = 524;
+export let a525 = 525;
+export let a526 = 526;
+export let a527 = 527;
+export let a528 = 528;
+export let a529 = 529;
+export let a530 = 530;
+export let a531 = 531;
+export let a532 = 532;
+export let a533 = 533;
+export let a534 = 534;
+export let a535 = 535;
+export let a536 = 536;
+export let a537 = 537;
+export let a538 = 538;
+export let a539 = 539;
+export let a540 = 540;
+export let a541 = 541;
+export let a542 = 542;
+export let a543 = 543;
+export let a544 = 544;
+export let a545 = 545;
+export let a546 = 546;
+export let a547 = 547;
+export let a548 = 548;
+export let a549 = 549;
+export let a550 = 550;
+export let a551 = 551;
+export let a552 = 552;
+export let a553 = 553;
+export let a554 = 554;
+export let a555 = 555;
+export let a556 = 556;
+export let a557 = 557;
+export let a558 = 558;
+export let a559 = 559;
+export let a560 = 560;
+export let a561 = 561;
+export let a562 = 562;
+export let a563 = 563;
+export let a564 = 564;
+export let a565 = 565;
+export let a566 = 566;
+export let a567 = 567;
+export let a568 = 568;
+export let a569 = 569;
+export let a570 = 570;
+export let a571 = 571;
+export let a572 = 572;
+export let a573 = 573;
+export let a574 = 574;
+export let a575 = 575;
+export let a576 = 576;
+export let a577 = 577;
+export let a578 = 578;
+export let a579 = 579;
+export let a580 = 580;
+export let a581 = 581;
+export let a582 = 582;
+export let a583 = 583;
+export let a584 = 584;
+export let a585 = 585;
+export let a586 = 586;
+export let a587 = 587;
+export let a588 = 588;
+export let a589 = 589;
+export let a590 = 590;
+export let a591 = 591;
+export let a592 = 592;
+export let a593 = 593;
+export let a594 = 594;
+export let a595 = 595;
+export let a596 = 596;
+export let a597 = 597;
+export let a598 = 598;
+export let a599 = 599;
+export let a600 = 600;
+export let a601 = 601;
+export let a602 = 602;
+export let a603 = 603;
+export let a604 = 604;
+export let a605 = 605;
+export let a606 = 606;
+export let a607 = 607;
+export let a608 = 608;
+export let a609 = 609;
+export let a610 = 610;
+export let a611 = 611;
+export let a612 = 612;
+export let a613 = 613;
+export let a614 = 614;
+export let a615 = 615;
+export let a616 = 616;
+export let a617 = 617;
+export let a618 = 618;
+export let a619 = 619;
+export let a620 = 620;
+export let a621 = 621;
+export let a622 = 622;
+export let a623 = 623;
+export let a624 = 624;
+export let a625 = 625;
+export let a626 = 626;
+export let a627 = 627;
+export let a628 = 628;
+export let a629 = 629;
+export let a630 = 630;
+export let a631 = 631;
+export let a632 = 632;
+export let a633 = 633;
+export let a634 = 634;
+export let a635 = 635;
+export let a636 = 636;
+export let a637 = 637;
+export let a638 = 638;
+export let a639 = 639;
+export let a640 = 640;
+export let a641 = 641;
+export let a642 = 642;
+export let a643 = 643;
+export let a644 = 644;
+export let a645 = 645;
+export let a646 = 646;
+export let a647 = 647;
+export let a648 = 648;
+export let a649 = 649;
+export let a650 = 650;
+export let a651 = 651;
+export let a652 = 652;
+export let a653 = 653;
+export let a654 = 654;
+export let a655 = 655;
+export let a656 = 656;
+export let a657 = 657;
+export let a658 = 658;
+export let a659 = 659;
+export let a660 = 660;
+export let a661 = 661;
+export let a662 = 662;
+export let a663 = 663;
+export let a664 = 664;
+export let a665 = 665;
+export let a666 = 666;
+export let a667 = 667;
+export let a668 = 668;
+export let a669 = 669;
+export let a670 = 670;
+export let a671 = 671;
+export let a672 = 672;
+export let a673 = 673;
+export let a674 = 674;
+export let a675 = 675;
+export let a676 = 676;
+export let a677 = 677;
+export let a678 = 678;
+export let a679 = 679;
+export let a680 = 680;
+export let a681 = 681;
+export let a682 = 682;
+export let a683 = 683;
+export let a684 = 684;
+export let a685 = 685;
+export let a686 = 686;
+export let a687 = 687;
+export let a688 = 688;
+export let a689 = 689;
+export let a690 = 690;
+export let a691 = 691;
+export let a692 = 692;
+export let a693 = 693;
+export let a694 = 694;
+export let a695 = 695;
+export let a696 = 696;
+export let a697 = 697;
+export let a698 = 698;
+export let a699 = 699;
+export let a700 = 700;
+export let a701 = 701;
+export let a702 = 702;
+export let a703 = 703;
+export let a704 = 704;
+export let a705 = 705;
+export let a706 = 706;
+export let a707 = 707;
+export let a708 = 708;
+export let a709 = 709;
+export let a710 = 710;
+export let a711 = 711;
+export let a712 = 712;
+export let a713 = 713;
+export let a714 = 714;
+export let a715 = 715;
+export let a716 = 716;
+export let a717 = 717;
+export let a718 = 718;
+export let a719 = 719;
+export let a720 = 720;
+export let a721 = 721;
+export let a722 = 722;
+export let a723 = 723;
+export let a724 = 724;
+export let a725 = 725;
+export let a726 = 726;
+export let a727 = 727;
+export let a728 = 728;
+export let a729 = 729;
+export let a730 = 730;
+export let a731 = 731;
+export let a732 = 732;
+export let a733 = 733;
+export let a734 = 734;
+export let a735 = 735;
+export let a736 = 736;
+export let a737 = 737;
+export let a738 = 738;
+export let a739 = 739;
+export let a740 = 740;
+export let a741 = 741;
+export let a742 = 742;
+export let a743 = 743;
+export let a744 = 744;
+export let a745 = 745;
+export let a746 = 746;
+export let a747 = 747;
+export let a748 = 748;
+export let a749 = 749;
+export let a750 = 750;
+export let a751 = 751;
+export let a752 = 752;
+export let a753 = 753;
+export let a754 = 754;
+export let a755 = 755;
+export let a756 = 756;
+export let a757 = 757;
+export let a758 = 758;
+export let a759 = 759;
+export let a760 = 760;
+export let a761 = 761;
+export let a762 = 762;
+export let a763 = 763;
+export let a764 = 764;
+export let a765 = 765;
+export let a766 = 766;
+export let a767 = 767;
+export let a768 = 768;
+export let a769 = 769;
+export let a770 = 770;
+export let a771 = 771;
+export let a772 = 772;
+export let a773 = 773;
+export let a774 = 774;
+export let a775 = 775;
+export let a776 = 776;
+export let a777 = 777;
+export let a778 = 778;
+export let a779 = 779;
+export let a780 = 780;
+export let a781 = 781;
+export let a782 = 782;
+export let a783 = 783;
+export let a784 = 784;
+export let a785 = 785;
+export let a786 = 786;
+export let a787 = 787;
+export let a788 = 788;
+export let a789 = 789;
+export let a790 = 790;
+export let a791 = 791;
+export let a792 = 792;
+export let a793 = 793;
+export let a794 = 794;
+export let a795 = 795;
+export let a796 = 796;
+export let a797 = 797;
+export let a798 = 798;
+export let a799 = 799;
+export let a800 = 800;
+export let a801 = 801;
+export let a802 = 802;
+export let a803 = 803;
+export let a804 = 804;
+export let a805 = 805;
+export let a806 = 806;
+export let a807 = 807;
+export let a808 = 808;
+export let a809 = 809;
+export let a810 = 810;
+export let a811 = 811;
+export let a812 = 812;
+export let a813 = 813;
+export let a814 = 814;
+export let a815 = 815;
+export let a816 = 816;
+export let a817 = 817;
+export let a818 = 818;
+export let a819 = 819;
+export let a820 = 820;
+export let a821 = 821;
+export let a822 = 822;
+export let a823 = 823;
+export let a824 = 824;
+export let a825 = 825;
+export let a826 = 826;
+export let a827 = 827;
+export let a828 = 828;
+export let a829 = 829;
+export let a830 = 830;
+export let a831 = 831;
+export let a832 = 832;
+export let a833 = 833;
+export let a834 = 834;
+export let a835 = 835;
+export let a836 = 836;
+export let a837 = 837;
+export let a838 = 838;
+export let a839 = 839;
+export let a840 = 840;
+export let a841 = 841;
+export let a842 = 842;
+export let a843 = 843;
+export let a844 = 844;
+export let a845 = 845;
+export let a846 = 846;
+export let a847 = 847;
+export let a848 = 848;
+export let a849 = 849;
+export let a850 = 850;
+export let a851 = 851;
+export let a852 = 852;
+export let a853 = 853;
+export let a854 = 854;
+export let a855 = 855;
+export let a856 = 856;
+export let a857 = 857;
+export let a858 = 858;
+export let a859 = 859;
+export let a860 = 860;
+export let a861 = 861;
+export let a862 = 862;
+export let a863 = 863;
+export let a864 = 864;
+export let a865 = 865;
+export let a866 = 866;
+export let a867 = 867;
+export let a868 = 868;
+export let a869 = 869;
+export let a870 = 870;
+export let a871 = 871;
+export let a872 = 872;
+export let a873 = 873;
+export let a874 = 874;
+export let a875 = 875;
+export let a876 = 876;
+export let a877 = 877;
+export let a878 = 878;
+export let a879 = 879;
+export let a880 = 880;
+export let a881 = 881;
+export let a882 = 882;
+export let a883 = 883;
+export let a884 = 884;
+export let a885 = 885;
+export let a886 = 886;
+export let a887 = 887;
+export let a888 = 888;
+export let a889 = 889;
+export let a890 = 890;
+export let a891 = 891;
+export let a892 = 892;
+export let a893 = 893;
+export let a894 = 894;
+export let a895 = 895;
+export let a896 = 896;
+export let a897 = 897;
+export let a898 = 898;
+export let a899 = 899;
+export let a900 = 900;
+export let a901 = 901;
+export let a902 = 902;
+export let a903 = 903;
+export let a904 = 904;
+export let a905 = 905;
+export let a906 = 906;
+export let a907 = 907;
+export let a908 = 908;
+export let a909 = 909;
+export let a910 = 910;
+export let a911 = 911;
+export let a912 = 912;
+export let a913 = 913;
+export let a914 = 914;
+export let a915 = 915;
+export let a916 = 916;
+export let a917 = 917;
+export let a918 = 918;
+export let a919 = 919;
+export let a920 = 920;
+export let a921 = 921;
+export let a922 = 922;
+export let a923 = 923;
+export let a924 = 924;
+export let a925 = 925;
+export let a926 = 926;
+export let a927 = 927;
+export let a928 = 928;
+export let a929 = 929;
+export let a930 = 930;
+export let a931 = 931;
+export let a932 = 932;
+export let a933 = 933;
+export let a934 = 934;
+export let a935 = 935;
+export let a936 = 936;
+export let a937 = 937;
+export let a938 = 938;
+export let a939 = 939;
+export let a940 = 940;
+export let a941 = 941;
+export let a942 = 942;
+export let a943 = 943;
+export let a944 = 944;
+export let a945 = 945;
+export let a946 = 946;
+export let a947 = 947;
+export let a948 = 948;
+export let a949 = 949;
+export let a950 = 950;
+export let a951 = 951;
+export let a952 = 952;
+export let a953 = 953;
+export let a954 = 954;
+export let a955 = 955;
+export let a956 = 956;
+export let a957 = 957;
+export let a958 = 958;
+export let a959 = 959;
+export let a960 = 960;
+export let a961 = 961;
+export let a962 = 962;
+export let a963 = 963;
+export let a964 = 964;
+export let a965 = 965;
+export let a966 = 966;
+export let a967 = 967;
+export let a968 = 968;
+export let a969 = 969;
+export let a970 = 970;
+export let a971 = 971;
+export let a972 = 972;
+export let a973 = 973;
+export let a974 = 974;
+export let a975 = 975;
+export let a976 = 976;
+export let a977 = 977;
+export let a978 = 978;
+export let a979 = 979;
+export let a980 = 980;
+export let a981 = 981;
+export let a982 = 982;
+export let a983 = 983;
+export let a984 = 984;
+export let a985 = 985;
+export let a986 = 986;
+export let a987 = 987;
+export let a988 = 988;
+export let a989 = 989;
+export let a990 = 990;
+export let a991 = 991;
+export let a992 = 992;
+export let a993 = 993;
+export let a994 = 994;
+export let a995 = 995;
+export let a996 = 996;
+export let a997 = 997;
+export let a998 = 998;
+export let a999 = 999;
+export let a1000 = 1000;
+export let a1001 = 1001;
+export let a1002 = 1002;
+export let a1003 = 1003;
+export let a1004 = 1004;
+export let a1005 = 1005;
+export let a1006 = 1006;
+export let a1007 = 1007;
+export let a1008 = 1008;
+export let a1009 = 1009;
+export let a1010 = 1010;
+export let a1011 = 1011;
+export let a1012 = 1012;
+export let a1013 = 1013;
+export let a1014 = 1014;
+export let a1015 = 1015;
+export let a1016 = 1016;
+export let a1017 = 1017;
+export let a1018 = 1018;
+export let a1019 = 1019;
+export let a1020 = 1020;
+export let a1021 = 1021;
+export let a1022 = 1022;
+export let a1023 = 1023;
+export let a1024 = 1024;
+export let a1025 = 1025;
+export let a1026 = 1026;
+export let a1027 = 1027;
+export let a1028 = 1028;
+export let a1029 = 1029;
+export let a1030 = 1030;
+export let a1031 = 1031;
+export let a1032 = 1032;
+export let a1033 = 1033;
+export let a1034 = 1034;
+export let a1035 = 1035;
+export let a1036 = 1036;
+export let a1037 = 1037;
+export let a1038 = 1038;
+export let a1039 = 1039;
+export let a1040 = 1040;
+export let a1041 = 1041;
+export let a1042 = 1042;
+export let a1043 = 1043;
+export let a1044 = 1044;
+export let a1045 = 1045;
+export let a1046 = 1046;
+export let a1047 = 1047;
+export let a1048 = 1048;
+export let a1049 = 1049;
+export let a1050 = 1050;
+export let a1051 = 1051;
+export let a1052 = 1052;
+export let a1053 = 1053;
+export let a1054 = 1054;
+export let a1055 = 1055;
+export let a1056 = 1056;
+export let a1057 = 1057;
+export let a1058 = 1058;
+export let a1059 = 1059;
+export let a1060 = 1060;
+export let a1061 = 1061;
+export let a1062 = 1062;
+export let a1063 = 1063;
+export let a1064 = 1064;
+export let a1065 = 1065;
+export let a1066 = 1066;
+export let a1067 = 1067;
+export let a1068 = 1068;
+export let a1069 = 1069;
+export let a1070 = 1070;
+export let a1071 = 1071;
+export let a1072 = 1072;
+export let a1073 = 1073;
+export let a1074 = 1074;
+export let a1075 = 1075;
+export let a1076 = 1076;
+export let a1077 = 1077;
+export let a1078 = 1078;
+export let a1079 = 1079;
+export let a1080 = 1080;
+export let a1081 = 1081;
+export let a1082 = 1082;
+export let a1083 = 1083;
+export let a1084 = 1084;
+export let a1085 = 1085;
+export let a1086 = 1086;
+export let a1087 = 1087;
+export let a1088 = 1088;
+export let a1089 = 1089;
+export let a1090 = 1090;
+export let a1091 = 1091;
+export let a1092 = 1092;
+export let a1093 = 1093;
+export let a1094 = 1094;
+export let a1095 = 1095;
+export let a1096 = 1096;
+export let a1097 = 1097;
+export let a1098 = 1098;
+export let a1099 = 1099;
+export let a1100 = 1100;
+export let a1101 = 1101;
+export let a1102 = 1102;
+export let a1103 = 1103;
+export let a1104 = 1104;
+export let a1105 = 1105;
+export let a1106 = 1106;
+export let a1107 = 1107;
+export let a1108 = 1108;
+export let a1109 = 1109;
+export let a1110 = 1110;
+export let a1111 = 1111;
+export let a1112 = 1112;
+export let a1113 = 1113;
+export let a1114 = 1114;
+export let a1115 = 1115;
+export let a1116 = 1116;
+export let a1117 = 1117;
+export let a1118 = 1118;
+export let a1119 = 1119;
+export let a1120 = 1120;
+export let a1121 = 1121;
+export let a1122 = 1122;
+export let a1123 = 1123;
+export let a1124 = 1124;
+export let a1125 = 1125;
+export let a1126 = 1126;
+export let a1127 = 1127;
+export let a1128 = 1128;
+export let a1129 = 1129;
+export let a1130 = 1130;
+export let a1131 = 1131;
+export let a1132 = 1132;
+export let a1133 = 1133;
+export let a1134 = 1134;
+export let a1135 = 1135;
+export let a1136 = 1136;
+export let a1137 = 1137;
+export let a1138 = 1138;
+export let a1139 = 1139;
+export let a1140 = 1140;
+export let a1141 = 1141;
+export let a1142 = 1142;
+export let a1143 = 1143;
+export let a1144 = 1144;
+export let a1145 = 1145;
+export let a1146 = 1146;
+export let a1147 = 1147;
+export let a1148 = 1148;
+export let a1149 = 1149;
+export let a1150 = 1150;
+export let a1151 = 1151;
+export let a1152 = 1152;
+export let a1153 = 1153;
+export let a1154 = 1154;
+export let a1155 = 1155;
+export let a1156 = 1156;
+export let a1157 = 1157;
+export let a1158 = 1158;
+export let a1159 = 1159;
+export let a1160 = 1160;
+export let a1161 = 1161;
+export let a1162 = 1162;
+export let a1163 = 1163;
+export let a1164 = 1164;
+export let a1165 = 1165;
+export let a1166 = 1166;
+export let a1167 = 1167;
+export let a1168 = 1168;
+export let a1169 = 1169;
+export let a1170 = 1170;
+export let a1171 = 1171;
+export let a1172 = 1172;
+export let a1173 = 1173;
+export let a1174 = 1174;
+export let a1175 = 1175;
+export let a1176 = 1176;
+export let a1177 = 1177;
+export let a1178 = 1178;
+export let a1179 = 1179;
+export let a1180 = 1180;
+export let a1181 = 1181;
+export let a1182 = 1182;
+export let a1183 = 1183;
+export let a1184 = 1184;
+export let a1185 = 1185;
+export let a1186 = 1186;
+export let a1187 = 1187;
+export let a1188 = 1188;
+export let a1189 = 1189;
+export let a1190 = 1190;
+export let a1191 = 1191;
+export let a1192 = 1192;
+export let a1193 = 1193;
+export let a1194 = 1194;
+export let a1195 = 1195;
+export let a1196 = 1196;
+export let a1197 = 1197;
+export let a1198 = 1198;
+export let a1199 = 1199;
+export let a1200 = 1200;
+export let a1201 = 1201;
+export let a1202 = 1202;
+export let a1203 = 1203;
+export let a1204 = 1204;
+export let a1205 = 1205;
+export let a1206 = 1206;
+export let a1207 = 1207;
+export let a1208 = 1208;
+export let a1209 = 1209;
+export let a1210 = 1210;
+export let a1211 = 1211;
+export let a1212 = 1212;
+export let a1213 = 1213;
+export let a1214 = 1214;
+export let a1215 = 1215;
+export let a1216 = 1216;
+export let a1217 = 1217;
+export let a1218 = 1218;
+export let a1219 = 1219;
+export let a1220 = 1220;
+export let a1221 = 1221;
+export let a1222 = 1222;
+export let a1223 = 1223;
+export let a1224 = 1224;
+export let a1225 = 1225;
+export let a1226 = 1226;
+export let a1227 = 1227;
+export let a1228 = 1228;
+export let a1229 = 1229;
+export let a1230 = 1230;
+export let a1231 = 1231;
+export let a1232 = 1232;
+export let a1233 = 1233;
+export let a1234 = 1234;
+export let a1235 = 1235;
+export let a1236 = 1236;
+export let a1237 = 1237;
+export let a1238 = 1238;
+export let a1239 = 1239;
+export let a1240 = 1240;
+export let a1241 = 1241;
+export let a1242 = 1242;
+export let a1243 = 1243;
+export let a1244 = 1244;
+export let a1245 = 1245;
+export let a1246 = 1246;
+export let a1247 = 1247;
+export let a1248 = 1248;
+export let a1249 = 1249;
+export let a1250 = 1250;
+export let a1251 = 1251;
+export let a1252 = 1252;
+export let a1253 = 1253;
+export let a1254 = 1254;
+export let a1255 = 1255;
+export let a1256 = 1256;
+export let a1257 = 1257;
+export let a1258 = 1258;
+export let a1259 = 1259;
+export let a1260 = 1260;
+export let a1261 = 1261;
+export let a1262 = 1262;
+export let a1263 = 1263;
+export let a1264 = 1264;
+export let a1265 = 1265;
+export let a1266 = 1266;
+export let a1267 = 1267;
+export let a1268 = 1268;
+export let a1269 = 1269;
+export let a1270 = 1270;
+export let a1271 = 1271;
+export let a1272 = 1272;
+export let a1273 = 1273;
+export let a1274 = 1274;
+export let a1275 = 1275;
+export let a1276 = 1276;
+export let a1277 = 1277;
+export let a1278 = 1278;
+export let a1279 = 1279;
+export let a1280 = 1280;
+export let a1281 = 1281;
+export let a1282 = 1282;
+export let a1283 = 1283;
+export let a1284 = 1284;
+export let a1285 = 1285;
+export let a1286 = 1286;
+export let a1287 = 1287;
+export let a1288 = 1288;
+export let a1289 = 1289;
+export let a1290 = 1290;
+export let a1291 = 1291;
+export let a1292 = 1292;
+export let a1293 = 1293;
+export let a1294 = 1294;
+export let a1295 = 1295;
+export let a1296 = 1296;
+export let a1297 = 1297;
+export let a1298 = 1298;
+export let a1299 = 1299;
+export let a1300 = 1300;
+export let a1301 = 1301;
+export let a1302 = 1302;
+export let a1303 = 1303;
+export let a1304 = 1304;
+export let a1305 = 1305;
+export let a1306 = 1306;
+export let a1307 = 1307;
+export let a1308 = 1308;
+export let a1309 = 1309;
+export let a1310 = 1310;
+export let a1311 = 1311;
+export let a1312 = 1312;
+export let a1313 = 1313;
+export let a1314 = 1314;
+export let a1315 = 1315;
+export let a1316 = 1316;
+export let a1317 = 1317;
+export let a1318 = 1318;
+export let a1319 = 1319;
+export let a1320 = 1320;
+export let a1321 = 1321;
+export let a1322 = 1322;
+export let a1323 = 1323;
+export let a1324 = 1324;
+export let a1325 = 1325;
+export let a1326 = 1326;
+export let a1327 = 1327;
+export let a1328 = 1328;
+export let a1329 = 1329;
+export let a1330 = 1330;
+export let a1331 = 1331;
+export let a1332 = 1332;
+export let a1333 = 1333;
+export let a1334 = 1334;
+export let a1335 = 1335;
+export let a1336 = 1336;
+export let a1337 = 1337;
+export let a1338 = 1338;
+export let a1339 = 1339;
+export let a1340 = 1340;
+export let a1341 = 1341;
+export let a1342 = 1342;
+export let a1343 = 1343;
+export let a1344 = 1344;
+export let a1345 = 1345;
+export let a1346 = 1346;
+export let a1347 = 1347;
+export let a1348 = 1348;
+export let a1349 = 1349;
+export let a1350 = 1350;
+export let a1351 = 1351;
+export let a1352 = 1352;
+export let a1353 = 1353;
+export let a1354 = 1354;
+export let a1355 = 1355;
+export let a1356 = 1356;
+export let a1357 = 1357;
+export let a1358 = 1358;
+export let a1359 = 1359;
+export let a1360 = 1360;
+export let a1361 = 1361;
+export let a1362 = 1362;
+export let a1363 = 1363;
+export let a1364 = 1364;
+export let a1365 = 1365;
+export let a1366 = 1366;
+export let a1367 = 1367;
+export let a1368 = 1368;
+export let a1369 = 1369;
+export let a1370 = 1370;
+export let a1371 = 1371;
+export let a1372 = 1372;
+export let a1373 = 1373;
+export let a1374 = 1374;
+export let a1375 = 1375;
+export let a1376 = 1376;
+export let a1377 = 1377;
+export let a1378 = 1378;
+export let a1379 = 1379;
+export let a1380 = 1380;
+export let a1381 = 1381;
+export let a1382 = 1382;
+export let a1383 = 1383;
+export let a1384 = 1384;
+export let a1385 = 1385;
+export let a1386 = 1386;
+export let a1387 = 1387;
+export let a1388 = 1388;
+export let a1389 = 1389;
+export let a1390 = 1390;
+export let a1391 = 1391;
+export let a1392 = 1392;
+export let a1393 = 1393;
+export let a1394 = 1394;
+export let a1395 = 1395;
+export let a1396 = 1396;
+export let a1397 = 1397;
+export let a1398 = 1398;
+export let a1399 = 1399;
+export let a1400 = 1400;
+export let a1401 = 1401;
+export let a1402 = 1402;
+export let a1403 = 1403;
+export let a1404 = 1404;
+export let a1405 = 1405;
+export let a1406 = 1406;
+export let a1407 = 1407;
+export let a1408 = 1408;
+export let a1409 = 1409;
+export let a1410 = 1410;
+export let a1411 = 1411;
+export let a1412 = 1412;
+export let a1413 = 1413;
+export let a1414 = 1414;
+export let a1415 = 1415;
+export let a1416 = 1416;
+export let a1417 = 1417;
+export let a1418 = 1418;
+export let a1419 = 1419;
+export let a1420 = 1420;
+export let a1421 = 1421;
+export let a1422 = 1422;
+export let a1423 = 1423;
+export let a1424 = 1424;
+export let a1425 = 1425;
+export let a1426 = 1426;
+export let a1427 = 1427;
+export let a1428 = 1428;
+export let a1429 = 1429;
+export let a1430 = 1430;
+export let a1431 = 1431;
+export let a1432 = 1432;
+export let a1433 = 1433;
+export let a1434 = 1434;
+export let a1435 = 1435;
+export let a1436 = 1436;
+export let a1437 = 1437;
+export let a1438 = 1438;
+export let a1439 = 1439;
+export let a1440 = 1440;
+export let a1441 = 1441;
+export let a1442 = 1442;
+export let a1443 = 1443;
+export let a1444 = 1444;
+export let a1445 = 1445;
+export let a1446 = 1446;
+export let a1447 = 1447;
+export let a1448 = 1448;
+export let a1449 = 1449;
+export let a1450 = 1450;
+export let a1451 = 1451;
+export let a1452 = 1452;
+export let a1453 = 1453;
+export let a1454 = 1454;
+export let a1455 = 1455;
+export let a1456 = 1456;
+export let a1457 = 1457;
+export let a1458 = 1458;
+export let a1459 = 1459;
+export let a1460 = 1460;
+export let a1461 = 1461;
+export let a1462 = 1462;
+export let a1463 = 1463;
+export let a1464 = 1464;
+export let a1465 = 1465;
+export let a1466 = 1466;
+export let a1467 = 1467;
+export let a1468 = 1468;
+export let a1469 = 1469;
+export let a1470 = 1470;
+export let a1471 = 1471;
+export let a1472 = 1472;
+export let a1473 = 1473;
+export let a1474 = 1474;
+export let a1475 = 1475;
+export let a1476 = 1476;
+export let a1477 = 1477;
+export let a1478 = 1478;
+export let a1479 = 1479;
+export let a1480 = 1480;
+export let a1481 = 1481;
+export let a1482 = 1482;
+export let a1483 = 1483;
+export let a1484 = 1484;
+export let a1485 = 1485;
+export let a1486 = 1486;
+export let a1487 = 1487;
+export let a1488 = 1488;
+export let a1489 = 1489;
+export let a1490 = 1490;
+export let a1491 = 1491;
+export let a1492 = 1492;
+export let a1493 = 1493;
+export let a1494 = 1494;
+export let a1495 = 1495;
+export let a1496 = 1496;
+export let a1497 = 1497;
+export let a1498 = 1498;
+export let a1499 = 1499;
+export let a1500 = 1500;
+export let a1501 = 1501;
+export let a1502 = 1502;
+export let a1503 = 1503;
+export let a1504 = 1504;
+export let a1505 = 1505;
+export let a1506 = 1506;
+export let a1507 = 1507;
+export let a1508 = 1508;
+export let a1509 = 1509;
+export let a1510 = 1510;
+export let a1511 = 1511;
+export let a1512 = 1512;
+export let a1513 = 1513;
+export let a1514 = 1514;
+export let a1515 = 1515;
+export let a1516 = 1516;
+export let a1517 = 1517;
+export let a1518 = 1518;
+export let a1519 = 1519;
+export let a1520 = 1520;
+export let a1521 = 1521;
+export let a1522 = 1522;
+export let a1523 = 1523;
+export let a1524 = 1524;
+export let a1525 = 1525;
+export let a1526 = 1526;
+export let a1527 = 1527;
+export let a1528 = 1528;
+export let a1529 = 1529;
+export let a1530 = 1530;
+export let a1531 = 1531;
+export let a1532 = 1532;
+export let a1533 = 1533;
+export let a1534 = 1534;
+export let a1535 = 1535;
+export let a1536 = 1536;
+export let a1537 = 1537;
+export let a1538 = 1538;
+export let a1539 = 1539;
+export let a1540 = 1540;
+export let a1541 = 1541;
+export let a1542 = 1542;
+export let a1543 = 1543;
+export let a1544 = 1544;
+export let a1545 = 1545;
+export let a1546 = 1546;
+export let a1547 = 1547;
+export let a1548 = 1548;
+export let a1549 = 1549;
+export let a1550 = 1550;
+export let a1551 = 1551;
+export let a1552 = 1552;
+export let a1553 = 1553;
+export let a1554 = 1554;
+export let a1555 = 1555;
+export let a1556 = 1556;
+export let a1557 = 1557;
+export let a1558 = 1558;
+export let a1559 = 1559;
+export let a1560 = 1560;
+export let a1561 = 1561;
+export let a1562 = 1562;
+export let a1563 = 1563;
+export let a1564 = 1564;
+export let a1565 = 1565;
+export let a1566 = 1566;
+export let a1567 = 1567;
+export let a1568 = 1568;
+export let a1569 = 1569;
+export let a1570 = 1570;
+export let a1571 = 1571;
+export let a1572 = 1572;
+export let a1573 = 1573;
+export let a1574 = 1574;
+export let a1575 = 1575;
+export let a1576 = 1576;
+export let a1577 = 1577;
+export let a1578 = 1578;
+export let a1579 = 1579;
+export let a1580 = 1580;
+export let a1581 = 1581;
+export let a1582 = 1582;
+export let a1583 = 1583;
+export let a1584 = 1584;
+export let a1585 = 1585;
+export let a1586 = 1586;
+export let a1587 = 1587;
+export let a1588 = 1588;
+export let a1589 = 1589;
+export let a1590 = 1590;
+export let a1591 = 1591;
+export let a1592 = 1592;
+export let a1593 = 1593;
+export let a1594 = 1594;
+export let a1595 = 1595;
+export let a1596 = 1596;
+export let a1597 = 1597;
+export let a1598 = 1598;
+export let a1599 = 1599;
+export let a1600 = 1600;
+export let a1601 = 1601;
+export let a1602 = 1602;
+export let a1603 = 1603;
+export let a1604 = 1604;
+export let a1605 = 1605;
+export let a1606 = 1606;
+export let a1607 = 1607;
+export let a1608 = 1608;
+export let a1609 = 1609;
+export let a1610 = 1610;
+export let a1611 = 1611;
+export let a1612 = 1612;
+export let a1613 = 1613;
+export let a1614 = 1614;
+export let a1615 = 1615;
+export let a1616 = 1616;
+export let a1617 = 1617;
+export let a1618 = 1618;
+export let a1619 = 1619;
+export let a1620 = 1620;
+export let a1621 = 1621;
+export let a1622 = 1622;
+export let a1623 = 1623;
+export let a1624 = 1624;
+export let a1625 = 1625;
+export let a1626 = 1626;
+export let a1627 = 1627;
+export let a1628 = 1628;
+export let a1629 = 1629;
+export let a1630 = 1630;
+export let a1631 = 1631;
+export let a1632 = 1632;
+export let a1633 = 1633;
+export let a1634 = 1634;
+export let a1635 = 1635;
+export let a1636 = 1636;
+export let a1637 = 1637;
+export let a1638 = 1638;
+export let a1639 = 1639;
+export let a1640 = 1640;
+export let a1641 = 1641;
+export let a1642 = 1642;
+export let a1643 = 1643;
+export let a1644 = 1644;
+export let a1645 = 1645;
+export let a1646 = 1646;
+export let a1647 = 1647;
+export let a1648 = 1648;
+export let a1649 = 1649;
+export let a1650 = 1650;
+export let a1651 = 1651;
+export let a1652 = 1652;
+export let a1653 = 1653;
+export let a1654 = 1654;
+export let a1655 = 1655;
+export let a1656 = 1656;
+export let a1657 = 1657;
+export let a1658 = 1658;
+export let a1659 = 1659;
+export let a1660 = 1660;
+export let a1661 = 1661;
+export let a1662 = 1662;
+export let a1663 = 1663;
+export let a1664 = 1664;
+export let a1665 = 1665;
+export let a1666 = 1666;
+export let a1667 = 1667;
+export let a1668 = 1668;
+export let a1669 = 1669;
+export let a1670 = 1670;
+export let a1671 = 1671;
+export let a1672 = 1672;
+export let a1673 = 1673;
+export let a1674 = 1674;
+export let a1675 = 1675;
+export let a1676 = 1676;
+export let a1677 = 1677;
+export let a1678 = 1678;
+export let a1679 = 1679;
+export let a1680 = 1680;
+export let a1681 = 1681;
+export let a1682 = 1682;
+export let a1683 = 1683;
+export let a1684 = 1684;
+export let a1685 = 1685;
+export let a1686 = 1686;
+export let a1687 = 1687;
+export let a1688 = 1688;
+export let a1689 = 1689;
+export let a1690 = 1690;
+export let a1691 = 1691;
+export let a1692 = 1692;
+export let a1693 = 1693;
+export let a1694 = 1694;
+export let a1695 = 1695;
+export let a1696 = 1696;
+export let a1697 = 1697;
+export let a1698 = 1698;
+export let a1699 = 1699;
+export let a1700 = 1700;
+export let a1701 = 1701;
+export let a1702 = 1702;
+export let a1703 = 1703;
+export let a1704 = 1704;
+export let a1705 = 1705;
+export let a1706 = 1706;
+export let a1707 = 1707;
+export let a1708 = 1708;
+export let a1709 = 1709;
+export let a1710 = 1710;
+export let a1711 = 1711;
+export let a1712 = 1712;
+export let a1713 = 1713;
+export let a1714 = 1714;
+export let a1715 = 1715;
+export let a1716 = 1716;
+export let a1717 = 1717;
+export let a1718 = 1718;
+export let a1719 = 1719;
+export let a1720 = 1720;
+export let a1721 = 1721;
+export let a1722 = 1722;
+export let a1723 = 1723;
+export let a1724 = 1724;
+export let a1725 = 1725;
+export let a1726 = 1726;
+export let a1727 = 1727;
+export let a1728 = 1728;
+export let a1729 = 1729;
+export let a1730 = 1730;
+export let a1731 = 1731;
+export let a1732 = 1732;
+export let a1733 = 1733;
+export let a1734 = 1734;
+export let a1735 = 1735;
+export let a1736 = 1736;
+export let a1737 = 1737;
+export let a1738 = 1738;
+export let a1739 = 1739;
+export let a1740 = 1740;
+export let a1741 = 1741;
+export let a1742 = 1742;
+export let a1743 = 1743;
+export let a1744 = 1744;
+export let a1745 = 1745;
+export let a1746 = 1746;
+export let a1747 = 1747;
+export let a1748 = 1748;
+export let a1749 = 1749;
+export let a1750 = 1750;
+export let a1751 = 1751;
+export let a1752 = 1752;
+export let a1753 = 1753;
+export let a1754 = 1754;
+export let a1755 = 1755;
+export let a1756 = 1756;
+export let a1757 = 1757;
+export let a1758 = 1758;
+export let a1759 = 1759;
+export let a1760 = 1760;
+export let a1761 = 1761;
+export let a1762 = 1762;
+export let a1763 = 1763;
+export let a1764 = 1764;
+export let a1765 = 1765;
+export let a1766 = 1766;
+export let a1767 = 1767;
+export let a1768 = 1768;
+export let a1769 = 1769;
+export let a1770 = 1770;
+export let a1771 = 1771;
+export let a1772 = 1772;
+export let a1773 = 1773;
+export let a1774 = 1774;
+export let a1775 = 1775;
+export let a1776 = 1776;
+export let a1777 = 1777;
+export let a1778 = 1778;
+export let a1779 = 1779;
+export let a1780 = 1780;
+export let a1781 = 1781;
+export let a1782 = 1782;
+export let a1783 = 1783;
+export let a1784 = 1784;
+export let a1785 = 1785;
+export let a1786 = 1786;
+export let a1787 = 1787;
+export let a1788 = 1788;
+export let a1789 = 1789;
+export let a1790 = 1790;
+export let a1791 = 1791;
+export let a1792 = 1792;
+export let a1793 = 1793;
+export let a1794 = 1794;
+export let a1795 = 1795;
+export let a1796 = 1796;
+export let a1797 = 1797;
+export let a1798 = 1798;
+export let a1799 = 1799;
+export let a1800 = 1800;
+export let a1801 = 1801;
+export let a1802 = 1802;
+export let a1803 = 1803;
+export let a1804 = 1804;
+export let a1805 = 1805;
+export let a1806 = 1806;
+export let a1807 = 1807;
+export let a1808 = 1808;
+export let a1809 = 1809;
+export let a1810 = 1810;
+export let a1811 = 1811;
+export let a1812 = 1812;
+export let a1813 = 1813;
+export let a1814 = 1814;
+export let a1815 = 1815;
+export let a1816 = 1816;
+export let a1817 = 1817;
+export let a1818 = 1818;
+export let a1819 = 1819;
+export let a1820 = 1820;
+export let a1821 = 1821;
+export let a1822 = 1822;
+export let a1823 = 1823;
+export let a1824 = 1824;
+export let a1825 = 1825;
+export let a1826 = 1826;
+export let a1827 = 1827;
+export let a1828 = 1828;
+export let a1829 = 1829;
+export let a1830 = 1830;
+export let a1831 = 1831;
+export let a1832 = 1832;
+export let a1833 = 1833;
+export let a1834 = 1834;
+export let a1835 = 1835;
+export let a1836 = 1836;
+export let a1837 = 1837;
+export let a1838 = 1838;
+export let a1839 = 1839;
+export let a1840 = 1840;
+export let a1841 = 1841;
+export let a1842 = 1842;
+export let a1843 = 1843;
+export let a1844 = 1844;
+export let a1845 = 1845;
+export let a1846 = 1846;
+export let a1847 = 1847;
+export let a1848 = 1848;
+export let a1849 = 1849;
+export let a1850 = 1850;
+export let a1851 = 1851;
+export let a1852 = 1852;
+export let a1853 = 1853;
+export let a1854 = 1854;
+export let a1855 = 1855;
+export let a1856 = 1856;
+export let a1857 = 1857;
+export let a1858 = 1858;
+export let a1859 = 1859;
+export let a1860 = 1860;
+export let a1861 = 1861;
+export let a1862 = 1862;
+export let a1863 = 1863;
+export let a1864 = 1864;
+export let a1865 = 1865;
+export let a1866 = 1866;
+export let a1867 = 1867;
+export let a1868 = 1868;
+export let a1869 = 1869;
+export let a1870 = 1870;
+export let a1871 = 1871;
+export let a1872 = 1872;
+export let a1873 = 1873;
+export let a1874 = 1874;
+export let a1875 = 1875;
+export let a1876 = 1876;
+export let a1877 = 1877;
+export let a1878 = 1878;
+export let a1879 = 1879;
+export let a1880 = 1880;
+export let a1881 = 1881;
+export let a1882 = 1882;
+export let a1883 = 1883;
+export let a1884 = 1884;
+export let a1885 = 1885;
+export let a1886 = 1886;
+export let a1887 = 1887;
+export let a1888 = 1888;
+export let a1889 = 1889;
+export let a1890 = 1890;
+export let a1891 = 1891;
+export let a1892 = 1892;
+export let a1893 = 1893;
+export let a1894 = 1894;
+export let a1895 = 1895;
+export let a1896 = 1896;
+export let a1897 = 1897;
+export let a1898 = 1898;
+export let a1899 = 1899;
+export let a1900 = 1900;
+export let a1901 = 1901;
+export let a1902 = 1902;
+export let a1903 = 1903;
+export let a1904 = 1904;
+export let a1905 = 1905;
+export let a1906 = 1906;
+export let a1907 = 1907;
+export let a1908 = 1908;
+export let a1909 = 1909;
+export let a1910 = 1910;
+export let a1911 = 1911;
+export let a1912 = 1912;
+export let a1913 = 1913;
+export let a1914 = 1914;
+export let a1915 = 1915;
+export let a1916 = 1916;
+export let a1917 = 1917;
+export let a1918 = 1918;
+export let a1919 = 1919;
+export let a1920 = 1920;
+export let a1921 = 1921;
+export let a1922 = 1922;
+export let a1923 = 1923;
+export let a1924 = 1924;
+export let a1925 = 1925;
+export let a1926 = 1926;
+export let a1927 = 1927;
+export let a1928 = 1928;
+export let a1929 = 1929;
+export let a1930 = 1930;
+export let a1931 = 1931;
+export let a1932 = 1932;
+export let a1933 = 1933;
+export let a1934 = 1934;
+export let a1935 = 1935;
+export let a1936 = 1936;
+export let a1937 = 1937;
+export let a1938 = 1938;
+export let a1939 = 1939;
+export let a1940 = 1940;
+export let a1941 = 1941;
+export let a1942 = 1942;
+export let a1943 = 1943;
+export let a1944 = 1944;
+export let a1945 = 1945;
+export let a1946 = 1946;
+export let a1947 = 1947;
+export let a1948 = 1948;
+export let a1949 = 1949;
+export let a1950 = 1950;
+export let a1951 = 1951;
+export let a1952 = 1952;
+export let a1953 = 1953;
+export let a1954 = 1954;
+export let a1955 = 1955;
+export let a1956 = 1956;
+export let a1957 = 1957;
+export let a1958 = 1958;
+export let a1959 = 1959;
+export let a1960 = 1960;
+export let a1961 = 1961;
+export let a1962 = 1962;
+export let a1963 = 1963;
+export let a1964 = 1964;
+export let a1965 = 1965;
+export let a1966 = 1966;
+export let a1967 = 1967;
+export let a1968 = 1968;
+export let a1969 = 1969;
+export let a1970 = 1970;
+export let a1971 = 1971;
+export let a1972 = 1972;
+export let a1973 = 1973;
+export let a1974 = 1974;
+export let a1975 = 1975;
+export let a1976 = 1976;
+export let a1977 = 1977;
+export let a1978 = 1978;
+export let a1979 = 1979;
+export let a1980 = 1980;
+export let a1981 = 1981;
+export let a1982 = 1982;
+export let a1983 = 1983;
+export let a1984 = 1984;
+export let a1985 = 1985;
+export let a1986 = 1986;
+export let a1987 = 1987;
+export let a1988 = 1988;
+export let a1989 = 1989;
+export let a1990 = 1990;
+export let a1991 = 1991;
+export let a1992 = 1992;
+export let a1993 = 1993;
+export let a1994 = 1994;
+export let a1995 = 1995;
+export let a1996 = 1996;
+export let a1997 = 1997;
+export let a1998 = 1998;
+export let a1999 = 1999;
+export let a2000 = 2000;
+export let a2001 = 2001;
+export let a2002 = 2002;
+export let a2003 = 2003;
+export let a2004 = 2004;
+export let a2005 = 2005;
+export let a2006 = 2006;
+export let a2007 = 2007;
+export let a2008 = 2008;
+export let a2009 = 2009;
+export let a2010 = 2010;
+export let a2011 = 2011;
+export let a2012 = 2012;
+export let a2013 = 2013;
+export let a2014 = 2014;
+export let a2015 = 2015;
+export let a2016 = 2016;
+export let a2017 = 2017;
+export let a2018 = 2018;
+export let a2019 = 2019;
+export let a2020 = 2020;
+export let a2021 = 2021;
+export let a2022 = 2022;
+export let a2023 = 2023;
+export let a2024 = 2024;
+export let a2025 = 2025;
+export let a2026 = 2026;
+export let a2027 = 2027;
+export let a2028 = 2028;
+export let a2029 = 2029;
+export let a2030 = 2030;
+export let a2031 = 2031;
+export let a2032 = 2032;
+export let a2033 = 2033;
+export let a2034 = 2034;
+export let a2035 = 2035;
+export let a2036 = 2036;
+export let a2037 = 2037;
+export let a2038 = 2038;
+export let a2039 = 2039;
+export let a2040 = 2040;
+export let a2041 = 2041;
+export let a2042 = 2042;
+export let a2043 = 2043;
+export let a2044 = 2044;
+export let a2045 = 2045;
+export let a2046 = 2046;
+export let a2047 = 2047;
+export let a2048 = 2048;
+export let a2049 = 2049;
+export let a2050 = 2050;
+export let a2051 = 2051;
+export let a2052 = 2052;
+export let a2053 = 2053;
+export let a2054 = 2054;
+export let a2055 = 2055;
+export let a2056 = 2056;
+export let a2057 = 2057;
+export let a2058 = 2058;
+export let a2059 = 2059;
+export let a2060 = 2060;
+export let a2061 = 2061;
+export let a2062 = 2062;
+export let a2063 = 2063;
+export let a2064 = 2064;
+export let a2065 = 2065;
+export let a2066 = 2066;
+export let a2067 = 2067;
+export let a2068 = 2068;
+export let a2069 = 2069;
+export let a2070 = 2070;
+export let a2071 = 2071;
+export let a2072 = 2072;
+export let a2073 = 2073;
+export let a2074 = 2074;
+export let a2075 = 2075;
+export let a2076 = 2076;
+export let a2077 = 2077;
+export let a2078 = 2078;
+export let a2079 = 2079;
+export let a2080 = 2080;
+export let a2081 = 2081;
+export let a2082 = 2082;
+export let a2083 = 2083;
+export let a2084 = 2084;
+export let a2085 = 2085;
+export let a2086 = 2086;
+export let a2087 = 2087;
+export let a2088 = 2088;
+export let a2089 = 2089;
+export let a2090 = 2090;
+export let a2091 = 2091;
+export let a2092 = 2092;
+export let a2093 = 2093;
+export let a2094 = 2094;
+export let a2095 = 2095;
+export let a2096 = 2096;
+export let a2097 = 2097;
+export let a2098 = 2098;
+export let a2099 = 2099;
+export let a2100 = 2100;
+export let a2101 = 2101;
+export let a2102 = 2102;
+export let a2103 = 2103;
+export let a2104 = 2104;
+export let a2105 = 2105;
+export let a2106 = 2106;
+export let a2107 = 2107;
+export let a2108 = 2108;
+export let a2109 = 2109;
+export let a2110 = 2110;
+export let a2111 = 2111;
+export let a2112 = 2112;
+export let a2113 = 2113;
+export let a2114 = 2114;
+export let a2115 = 2115;
+export let a2116 = 2116;
+export let a2117 = 2117;
+export let a2118 = 2118;
+export let a2119 = 2119;
+export let a2120 = 2120;
+export let a2121 = 2121;
+export let a2122 = 2122;
+export let a2123 = 2123;
+export let a2124 = 2124;
+export let a2125 = 2125;
+export let a2126 = 2126;
+export let a2127 = 2127;
+export let a2128 = 2128;
+export let a2129 = 2129;
+export let a2130 = 2130;
+export let a2131 = 2131;
+export let a2132 = 2132;
+export let a2133 = 2133;
+export let a2134 = 2134;
+export let a2135 = 2135;
+export let a2136 = 2136;
+export let a2137 = 2137;
+export let a2138 = 2138;
+export let a2139 = 2139;
+export let a2140 = 2140;
+export let a2141 = 2141;
+export let a2142 = 2142;
+export let a2143 = 2143;
+export let a2144 = 2144;
+export let a2145 = 2145;
+export let a2146 = 2146;
+export let a2147 = 2147;
+export let a2148 = 2148;
+export let a2149 = 2149;
+export let a2150 = 2150;
+export let a2151 = 2151;
+export let a2152 = 2152;
+export let a2153 = 2153;
+export let a2154 = 2154;
+export let a2155 = 2155;
+export let a2156 = 2156;
+export let a2157 = 2157;
+export let a2158 = 2158;
+export let a2159 = 2159;
+export let a2160 = 2160;
+export let a2161 = 2161;
+export let a2162 = 2162;
+export let a2163 = 2163;
+export let a2164 = 2164;
+export let a2165 = 2165;
+export let a2166 = 2166;
+export let a2167 = 2167;
+export let a2168 = 2168;
+export let a2169 = 2169;
+export let a2170 = 2170;
+export let a2171 = 2171;
+export let a2172 = 2172;
+export let a2173 = 2173;
+export let a2174 = 2174;
+export let a2175 = 2175;
+export let a2176 = 2176;
+export let a2177 = 2177;
+export let a2178 = 2178;
+export let a2179 = 2179;
+export let a2180 = 2180;
+export let a2181 = 2181;
+export let a2182 = 2182;
+export let a2183 = 2183;
+export let a2184 = 2184;
+export let a2185 = 2185;
+export let a2186 = 2186;
+export let a2187 = 2187;
+export let a2188 = 2188;
+export let a2189 = 2189;
+export let a2190 = 2190;
+export let a2191 = 2191;
+export let a2192 = 2192;
+export let a2193 = 2193;
+export let a2194 = 2194;
+export let a2195 = 2195;
+export let a2196 = 2196;
+export let a2197 = 2197;
+export let a2198 = 2198;
+export let a2199 = 2199;
diff --git a/src/v8/test/mjsunit/harmony/modules-skip-large2.mjs b/src/v8/test/mjsunit/harmony/modules-skip-large2.mjs
new file mode 100644
index 0000000..2c03557
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/modules-skip-large2.mjs
@@ -0,0 +1,1104 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export let a0 = 0;
+export let a1 = 1;
+export let a2 = 2;
+export let a3 = 3;
+export let a4 = 4;
+export let a5 = 5;
+export let a6 = 6;
+export let a7 = 7;
+export let a8 = 8;
+export let a9 = 9;
+export let a10 = 10;
+export let a11 = 11;
+export let a12 = 12;
+export let a13 = 13;
+export let a14 = 14;
+export let a15 = 15;
+export let a16 = 16;
+export let a17 = 17;
+export let a18 = 18;
+export let a19 = 19;
+export let a20 = 20;
+export let a21 = 21;
+export let a22 = 22;
+export let a23 = 23;
+export let a24 = 24;
+export let a25 = 25;
+export let a26 = 26;
+export let a27 = 27;
+export let a28 = 28;
+export let a29 = 29;
+export let a30 = 30;
+export let a31 = 31;
+export let a32 = 32;
+export let a33 = 33;
+export let a34 = 34;
+export let a35 = 35;
+export let a36 = 36;
+export let a37 = 37;
+export let a38 = 38;
+export let a39 = 39;
+export let a40 = 40;
+export let a41 = 41;
+export let a42 = 42;
+export let a43 = 43;
+export let a44 = 44;
+export let a45 = 45;
+export let a46 = 46;
+export let a47 = 47;
+export let a48 = 48;
+export let a49 = 49;
+export let a50 = 50;
+export let a51 = 51;
+export let a52 = 52;
+export let a53 = 53;
+export let a54 = 54;
+export let a55 = 55;
+export let a56 = 56;
+export let a57 = 57;
+export let a58 = 58;
+export let a59 = 59;
+export let a60 = 60;
+export let a61 = 61;
+export let a62 = 62;
+export let a63 = 63;
+export let a64 = 64;
+export let a65 = 65;
+export let a66 = 66;
+export let a67 = 67;
+export let a68 = 68;
+export let a69 = 69;
+export let a70 = 70;
+export let a71 = 71;
+export let a72 = 72;
+export let a73 = 73;
+export let a74 = 74;
+export let a75 = 75;
+export let a76 = 76;
+export let a77 = 77;
+export let a78 = 78;
+export let a79 = 79;
+export let a80 = 80;
+export let a81 = 81;
+export let a82 = 82;
+export let a83 = 83;
+export let a84 = 84;
+export let a85 = 85;
+export let a86 = 86;
+export let a87 = 87;
+export let a88 = 88;
+export let a89 = 89;
+export let a90 = 90;
+export let a91 = 91;
+export let a92 = 92;
+export let a93 = 93;
+export let a94 = 94;
+export let a95 = 95;
+export let a96 = 96;
+export let a97 = 97;
+export let a98 = 98;
+export let a99 = 99;
+export let a100 = 100;
+export let a101 = 101;
+export let a102 = 102;
+export let a103 = 103;
+export let a104 = 104;
+export let a105 = 105;
+export let a106 = 106;
+export let a107 = 107;
+export let a108 = 108;
+export let a109 = 109;
+export let a110 = 110;
+export let a111 = 111;
+export let a112 = 112;
+export let a113 = 113;
+export let a114 = 114;
+export let a115 = 115;
+export let a116 = 116;
+export let a117 = 117;
+export let a118 = 118;
+export let a119 = 119;
+export let a120 = 120;
+export let a121 = 121;
+export let a122 = 122;
+export let a123 = 123;
+export let a124 = 124;
+export let a125 = 125;
+export let a126 = 126;
+export let a127 = 127;
+export let a128 = 128;
+export let a129 = 129;
+export let a130 = 130;
+export let a131 = 131;
+export let a132 = 132;
+export let a133 = 133;
+export let a134 = 134;
+export let a135 = 135;
+export let a136 = 136;
+export let a137 = 137;
+export let a138 = 138;
+export let a139 = 139;
+export let a140 = 140;
+export let a141 = 141;
+export let a142 = 142;
+export let a143 = 143;
+export let a144 = 144;
+export let a145 = 145;
+export let a146 = 146;
+export let a147 = 147;
+export let a148 = 148;
+export let a149 = 149;
+export let a150 = 150;
+export let a151 = 151;
+export let a152 = 152;
+export let a153 = 153;
+export let a154 = 154;
+export let a155 = 155;
+export let a156 = 156;
+export let a157 = 157;
+export let a158 = 158;
+export let a159 = 159;
+export let a160 = 160;
+export let a161 = 161;
+export let a162 = 162;
+export let a163 = 163;
+export let a164 = 164;
+export let a165 = 165;
+export let a166 = 166;
+export let a167 = 167;
+export let a168 = 168;
+export let a169 = 169;
+export let a170 = 170;
+export let a171 = 171;
+export let a172 = 172;
+export let a173 = 173;
+export let a174 = 174;
+export let a175 = 175;
+export let a176 = 176;
+export let a177 = 177;
+export let a178 = 178;
+export let a179 = 179;
+export let a180 = 180;
+export let a181 = 181;
+export let a182 = 182;
+export let a183 = 183;
+export let a184 = 184;
+export let a185 = 185;
+export let a186 = 186;
+export let a187 = 187;
+export let a188 = 188;
+export let a189 = 189;
+export let a190 = 190;
+export let a191 = 191;
+export let a192 = 192;
+export let a193 = 193;
+export let a194 = 194;
+export let a195 = 195;
+export let a196 = 196;
+export let a197 = 197;
+export let a198 = 198;
+export let a199 = 199;
+export let a200 = 200;
+export let a201 = 201;
+export let a202 = 202;
+export let a203 = 203;
+export let a204 = 204;
+export let a205 = 205;
+export let a206 = 206;
+export let a207 = 207;
+export let a208 = 208;
+export let a209 = 209;
+export let a210 = 210;
+export let a211 = 211;
+export let a212 = 212;
+export let a213 = 213;
+export let a214 = 214;
+export let a215 = 215;
+export let a216 = 216;
+export let a217 = 217;
+export let a218 = 218;
+export let a219 = 219;
+export let a220 = 220;
+export let a221 = 221;
+export let a222 = 222;
+export let a223 = 223;
+export let a224 = 224;
+export let a225 = 225;
+export let a226 = 226;
+export let a227 = 227;
+export let a228 = 228;
+export let a229 = 229;
+export let a230 = 230;
+export let a231 = 231;
+export let a232 = 232;
+export let a233 = 233;
+export let a234 = 234;
+export let a235 = 235;
+export let a236 = 236;
+export let a237 = 237;
+export let a238 = 238;
+export let a239 = 239;
+export let a240 = 240;
+export let a241 = 241;
+export let a242 = 242;
+export let a243 = 243;
+export let a244 = 244;
+export let a245 = 245;
+export let a246 = 246;
+export let a247 = 247;
+export let a248 = 248;
+export let a249 = 249;
+export let a250 = 250;
+export let a251 = 251;
+export let a252 = 252;
+export let a253 = 253;
+export let a254 = 254;
+export let a255 = 255;
+export let a256 = 256;
+export let a257 = 257;
+export let a258 = 258;
+export let a259 = 259;
+export let a260 = 260;
+export let a261 = 261;
+export let a262 = 262;
+export let a263 = 263;
+export let a264 = 264;
+export let a265 = 265;
+export let a266 = 266;
+export let a267 = 267;
+export let a268 = 268;
+export let a269 = 269;
+export let a270 = 270;
+export let a271 = 271;
+export let a272 = 272;
+export let a273 = 273;
+export let a274 = 274;
+export let a275 = 275;
+export let a276 = 276;
+export let a277 = 277;
+export let a278 = 278;
+export let a279 = 279;
+export let a280 = 280;
+export let a281 = 281;
+export let a282 = 282;
+export let a283 = 283;
+export let a284 = 284;
+export let a285 = 285;
+export let a286 = 286;
+export let a287 = 287;
+export let a288 = 288;
+export let a289 = 289;
+export let a290 = 290;
+export let a291 = 291;
+export let a292 = 292;
+export let a293 = 293;
+export let a294 = 294;
+export let a295 = 295;
+export let a296 = 296;
+export let a297 = 297;
+export let a298 = 298;
+export let a299 = 299;
+export let a300 = 300;
+export let a301 = 301;
+export let a302 = 302;
+export let a303 = 303;
+export let a304 = 304;
+export let a305 = 305;
+export let a306 = 306;
+export let a307 = 307;
+export let a308 = 308;
+export let a309 = 309;
+export let a310 = 310;
+export let a311 = 311;
+export let a312 = 312;
+export let a313 = 313;
+export let a314 = 314;
+export let a315 = 315;
+export let a316 = 316;
+export let a317 = 317;
+export let a318 = 318;
+export let a319 = 319;
+export let a320 = 320;
+export let a321 = 321;
+export let a322 = 322;
+export let a323 = 323;
+export let a324 = 324;
+export let a325 = 325;
+export let a326 = 326;
+export let a327 = 327;
+export let a328 = 328;
+export let a329 = 329;
+export let a330 = 330;
+export let a331 = 331;
+export let a332 = 332;
+export let a333 = 333;
+export let a334 = 334;
+export let a335 = 335;
+export let a336 = 336;
+export let a337 = 337;
+export let a338 = 338;
+export let a339 = 339;
+export let a340 = 340;
+export let a341 = 341;
+export let a342 = 342;
+export let a343 = 343;
+export let a344 = 344;
+export let a345 = 345;
+export let a346 = 346;
+export let a347 = 347;
+export let a348 = 348;
+export let a349 = 349;
+export let a350 = 350;
+export let a351 = 351;
+export let a352 = 352;
+export let a353 = 353;
+export let a354 = 354;
+export let a355 = 355;
+export let a356 = 356;
+export let a357 = 357;
+export let a358 = 358;
+export let a359 = 359;
+export let a360 = 360;
+export let a361 = 361;
+export let a362 = 362;
+export let a363 = 363;
+export let a364 = 364;
+export let a365 = 365;
+export let a366 = 366;
+export let a367 = 367;
+export let a368 = 368;
+export let a369 = 369;
+export let a370 = 370;
+export let a371 = 371;
+export let a372 = 372;
+export let a373 = 373;
+export let a374 = 374;
+export let a375 = 375;
+export let a376 = 376;
+export let a377 = 377;
+export let a378 = 378;
+export let a379 = 379;
+export let a380 = 380;
+export let a381 = 381;
+export let a382 = 382;
+export let a383 = 383;
+export let a384 = 384;
+export let a385 = 385;
+export let a386 = 386;
+export let a387 = 387;
+export let a388 = 388;
+export let a389 = 389;
+export let a390 = 390;
+export let a391 = 391;
+export let a392 = 392;
+export let a393 = 393;
+export let a394 = 394;
+export let a395 = 395;
+export let a396 = 396;
+export let a397 = 397;
+export let a398 = 398;
+export let a399 = 399;
+export let a400 = 400;
+export let a401 = 401;
+export let a402 = 402;
+export let a403 = 403;
+export let a404 = 404;
+export let a405 = 405;
+export let a406 = 406;
+export let a407 = 407;
+export let a408 = 408;
+export let a409 = 409;
+export let a410 = 410;
+export let a411 = 411;
+export let a412 = 412;
+export let a413 = 413;
+export let a414 = 414;
+export let a415 = 415;
+export let a416 = 416;
+export let a417 = 417;
+export let a418 = 418;
+export let a419 = 419;
+export let a420 = 420;
+export let a421 = 421;
+export let a422 = 422;
+export let a423 = 423;
+export let a424 = 424;
+export let a425 = 425;
+export let a426 = 426;
+export let a427 = 427;
+export let a428 = 428;
+export let a429 = 429;
+export let a430 = 430;
+export let a431 = 431;
+export let a432 = 432;
+export let a433 = 433;
+export let a434 = 434;
+export let a435 = 435;
+export let a436 = 436;
+export let a437 = 437;
+export let a438 = 438;
+export let a439 = 439;
+export let a440 = 440;
+export let a441 = 441;
+export let a442 = 442;
+export let a443 = 443;
+export let a444 = 444;
+export let a445 = 445;
+export let a446 = 446;
+export let a447 = 447;
+export let a448 = 448;
+export let a449 = 449;
+export let a450 = 450;
+export let a451 = 451;
+export let a452 = 452;
+export let a453 = 453;
+export let a454 = 454;
+export let a455 = 455;
+export let a456 = 456;
+export let a457 = 457;
+export let a458 = 458;
+export let a459 = 459;
+export let a460 = 460;
+export let a461 = 461;
+export let a462 = 462;
+export let a463 = 463;
+export let a464 = 464;
+export let a465 = 465;
+export let a466 = 466;
+export let a467 = 467;
+export let a468 = 468;
+export let a469 = 469;
+export let a470 = 470;
+export let a471 = 471;
+export let a472 = 472;
+export let a473 = 473;
+export let a474 = 474;
+export let a475 = 475;
+export let a476 = 476;
+export let a477 = 477;
+export let a478 = 478;
+export let a479 = 479;
+export let a480 = 480;
+export let a481 = 481;
+export let a482 = 482;
+export let a483 = 483;
+export let a484 = 484;
+export let a485 = 485;
+export let a486 = 486;
+export let a487 = 487;
+export let a488 = 488;
+export let a489 = 489;
+export let a490 = 490;
+export let a491 = 491;
+export let a492 = 492;
+export let a493 = 493;
+export let a494 = 494;
+export let a495 = 495;
+export let a496 = 496;
+export let a497 = 497;
+export let a498 = 498;
+export let a499 = 499;
+export let a500 = 500;
+export let a501 = 501;
+export let a502 = 502;
+export let a503 = 503;
+export let a504 = 504;
+export let a505 = 505;
+export let a506 = 506;
+export let a507 = 507;
+export let a508 = 508;
+export let a509 = 509;
+export let a510 = 510;
+export let a511 = 511;
+export let a512 = 512;
+export let a513 = 513;
+export let a514 = 514;
+export let a515 = 515;
+export let a516 = 516;
+export let a517 = 517;
+export let a518 = 518;
+export let a519 = 519;
+export let a520 = 520;
+export let a521 = 521;
+export let a522 = 522;
+export let a523 = 523;
+export let a524 = 524;
+export let a525 = 525;
+export let a526 = 526;
+export let a527 = 527;
+export let a528 = 528;
+export let a529 = 529;
+export let a530 = 530;
+export let a531 = 531;
+export let a532 = 532;
+export let a533 = 533;
+export let a534 = 534;
+export let a535 = 535;
+export let a536 = 536;
+export let a537 = 537;
+export let a538 = 538;
+export let a539 = 539;
+export let a540 = 540;
+export let a541 = 541;
+export let a542 = 542;
+export let a543 = 543;
+export let a544 = 544;
+export let a545 = 545;
+export let a546 = 546;
+export let a547 = 547;
+export let a548 = 548;
+export let a549 = 549;
+export let a550 = 550;
+export let a551 = 551;
+export let a552 = 552;
+export let a553 = 553;
+export let a554 = 554;
+export let a555 = 555;
+export let a556 = 556;
+export let a557 = 557;
+export let a558 = 558;
+export let a559 = 559;
+export let a560 = 560;
+export let a561 = 561;
+export let a562 = 562;
+export let a563 = 563;
+export let a564 = 564;
+export let a565 = 565;
+export let a566 = 566;
+export let a567 = 567;
+export let a568 = 568;
+export let a569 = 569;
+export let a570 = 570;
+export let a571 = 571;
+export let a572 = 572;
+export let a573 = 573;
+export let a574 = 574;
+export let a575 = 575;
+export let a576 = 576;
+export let a577 = 577;
+export let a578 = 578;
+export let a579 = 579;
+export let a580 = 580;
+export let a581 = 581;
+export let a582 = 582;
+export let a583 = 583;
+export let a584 = 584;
+export let a585 = 585;
+export let a586 = 586;
+export let a587 = 587;
+export let a588 = 588;
+export let a589 = 589;
+export let a590 = 590;
+export let a591 = 591;
+export let a592 = 592;
+export let a593 = 593;
+export let a594 = 594;
+export let a595 = 595;
+export let a596 = 596;
+export let a597 = 597;
+export let a598 = 598;
+export let a599 = 599;
+export let a600 = 600;
+export let a601 = 601;
+export let a602 = 602;
+export let a603 = 603;
+export let a604 = 604;
+export let a605 = 605;
+export let a606 = 606;
+export let a607 = 607;
+export let a608 = 608;
+export let a609 = 609;
+export let a610 = 610;
+export let a611 = 611;
+export let a612 = 612;
+export let a613 = 613;
+export let a614 = 614;
+export let a615 = 615;
+export let a616 = 616;
+export let a617 = 617;
+export let a618 = 618;
+export let a619 = 619;
+export let a620 = 620;
+export let a621 = 621;
+export let a622 = 622;
+export let a623 = 623;
+export let a624 = 624;
+export let a625 = 625;
+export let a626 = 626;
+export let a627 = 627;
+export let a628 = 628;
+export let a629 = 629;
+export let a630 = 630;
+export let a631 = 631;
+export let a632 = 632;
+export let a633 = 633;
+export let a634 = 634;
+export let a635 = 635;
+export let a636 = 636;
+export let a637 = 637;
+export let a638 = 638;
+export let a639 = 639;
+export let a640 = 640;
+export let a641 = 641;
+export let a642 = 642;
+export let a643 = 643;
+export let a644 = 644;
+export let a645 = 645;
+export let a646 = 646;
+export let a647 = 647;
+export let a648 = 648;
+export let a649 = 649;
+export let a650 = 650;
+export let a651 = 651;
+export let a652 = 652;
+export let a653 = 653;
+export let a654 = 654;
+export let a655 = 655;
+export let a656 = 656;
+export let a657 = 657;
+export let a658 = 658;
+export let a659 = 659;
+export let a660 = 660;
+export let a661 = 661;
+export let a662 = 662;
+export let a663 = 663;
+export let a664 = 664;
+export let a665 = 665;
+export let a666 = 666;
+export let a667 = 667;
+export let a668 = 668;
+export let a669 = 669;
+export let a670 = 670;
+export let a671 = 671;
+export let a672 = 672;
+export let a673 = 673;
+export let a674 = 674;
+export let a675 = 675;
+export let a676 = 676;
+export let a677 = 677;
+export let a678 = 678;
+export let a679 = 679;
+export let a680 = 680;
+export let a681 = 681;
+export let a682 = 682;
+export let a683 = 683;
+export let a684 = 684;
+export let a685 = 685;
+export let a686 = 686;
+export let a687 = 687;
+export let a688 = 688;
+export let a689 = 689;
+export let a690 = 690;
+export let a691 = 691;
+export let a692 = 692;
+export let a693 = 693;
+export let a694 = 694;
+export let a695 = 695;
+export let a696 = 696;
+export let a697 = 697;
+export let a698 = 698;
+export let a699 = 699;
+export let a700 = 700;
+export let a701 = 701;
+export let a702 = 702;
+export let a703 = 703;
+export let a704 = 704;
+export let a705 = 705;
+export let a706 = 706;
+export let a707 = 707;
+export let a708 = 708;
+export let a709 = 709;
+export let a710 = 710;
+export let a711 = 711;
+export let a712 = 712;
+export let a713 = 713;
+export let a714 = 714;
+export let a715 = 715;
+export let a716 = 716;
+export let a717 = 717;
+export let a718 = 718;
+export let a719 = 719;
+export let a720 = 720;
+export let a721 = 721;
+export let a722 = 722;
+export let a723 = 723;
+export let a724 = 724;
+export let a725 = 725;
+export let a726 = 726;
+export let a727 = 727;
+export let a728 = 728;
+export let a729 = 729;
+export let a730 = 730;
+export let a731 = 731;
+export let a732 = 732;
+export let a733 = 733;
+export let a734 = 734;
+export let a735 = 735;
+export let a736 = 736;
+export let a737 = 737;
+export let a738 = 738;
+export let a739 = 739;
+export let a740 = 740;
+export let a741 = 741;
+export let a742 = 742;
+export let a743 = 743;
+export let a744 = 744;
+export let a745 = 745;
+export let a746 = 746;
+export let a747 = 747;
+export let a748 = 748;
+export let a749 = 749;
+export let a750 = 750;
+export let a751 = 751;
+export let a752 = 752;
+export let a753 = 753;
+export let a754 = 754;
+export let a755 = 755;
+export let a756 = 756;
+export let a757 = 757;
+export let a758 = 758;
+export let a759 = 759;
+export let a760 = 760;
+export let a761 = 761;
+export let a762 = 762;
+export let a763 = 763;
+export let a764 = 764;
+export let a765 = 765;
+export let a766 = 766;
+export let a767 = 767;
+export let a768 = 768;
+export let a769 = 769;
+export let a770 = 770;
+export let a771 = 771;
+export let a772 = 772;
+export let a773 = 773;
+export let a774 = 774;
+export let a775 = 775;
+export let a776 = 776;
+export let a777 = 777;
+export let a778 = 778;
+export let a779 = 779;
+export let a780 = 780;
+export let a781 = 781;
+export let a782 = 782;
+export let a783 = 783;
+export let a784 = 784;
+export let a785 = 785;
+export let a786 = 786;
+export let a787 = 787;
+export let a788 = 788;
+export let a789 = 789;
+export let a790 = 790;
+export let a791 = 791;
+export let a792 = 792;
+export let a793 = 793;
+export let a794 = 794;
+export let a795 = 795;
+export let a796 = 796;
+export let a797 = 797;
+export let a798 = 798;
+export let a799 = 799;
+export let a800 = 800;
+export let a801 = 801;
+export let a802 = 802;
+export let a803 = 803;
+export let a804 = 804;
+export let a805 = 805;
+export let a806 = 806;
+export let a807 = 807;
+export let a808 = 808;
+export let a809 = 809;
+export let a810 = 810;
+export let a811 = 811;
+export let a812 = 812;
+export let a813 = 813;
+export let a814 = 814;
+export let a815 = 815;
+export let a816 = 816;
+export let a817 = 817;
+export let a818 = 818;
+export let a819 = 819;
+export let a820 = 820;
+export let a821 = 821;
+export let a822 = 822;
+export let a823 = 823;
+export let a824 = 824;
+export let a825 = 825;
+export let a826 = 826;
+export let a827 = 827;
+export let a828 = 828;
+export let a829 = 829;
+export let a830 = 830;
+export let a831 = 831;
+export let a832 = 832;
+export let a833 = 833;
+export let a834 = 834;
+export let a835 = 835;
+export let a836 = 836;
+export let a837 = 837;
+export let a838 = 838;
+export let a839 = 839;
+export let a840 = 840;
+export let a841 = 841;
+export let a842 = 842;
+export let a843 = 843;
+export let a844 = 844;
+export let a845 = 845;
+export let a846 = 846;
+export let a847 = 847;
+export let a848 = 848;
+export let a849 = 849;
+export let a850 = 850;
+export let a851 = 851;
+export let a852 = 852;
+export let a853 = 853;
+export let a854 = 854;
+export let a855 = 855;
+export let a856 = 856;
+export let a857 = 857;
+export let a858 = 858;
+export let a859 = 859;
+export let a860 = 860;
+export let a861 = 861;
+export let a862 = 862;
+export let a863 = 863;
+export let a864 = 864;
+export let a865 = 865;
+export let a866 = 866;
+export let a867 = 867;
+export let a868 = 868;
+export let a869 = 869;
+export let a870 = 870;
+export let a871 = 871;
+export let a872 = 872;
+export let a873 = 873;
+export let a874 = 874;
+export let a875 = 875;
+export let a876 = 876;
+export let a877 = 877;
+export let a878 = 878;
+export let a879 = 879;
+export let a880 = 880;
+export let a881 = 881;
+export let a882 = 882;
+export let a883 = 883;
+export let a884 = 884;
+export let a885 = 885;
+export let a886 = 886;
+export let a887 = 887;
+export let a888 = 888;
+export let a889 = 889;
+export let a890 = 890;
+export let a891 = 891;
+export let a892 = 892;
+export let a893 = 893;
+export let a894 = 894;
+export let a895 = 895;
+export let a896 = 896;
+export let a897 = 897;
+export let a898 = 898;
+export let a899 = 899;
+export let a900 = 900;
+export let a901 = 901;
+export let a902 = 902;
+export let a903 = 903;
+export let a904 = 904;
+export let a905 = 905;
+export let a906 = 906;
+export let a907 = 907;
+export let a908 = 908;
+export let a909 = 909;
+export let a910 = 910;
+export let a911 = 911;
+export let a912 = 912;
+export let a913 = 913;
+export let a914 = 914;
+export let a915 = 915;
+export let a916 = 916;
+export let a917 = 917;
+export let a918 = 918;
+export let a919 = 919;
+export let a920 = 920;
+export let a921 = 921;
+export let a922 = 922;
+export let a923 = 923;
+export let a924 = 924;
+export let a925 = 925;
+export let a926 = 926;
+export let a927 = 927;
+export let a928 = 928;
+export let a929 = 929;
+export let a930 = 930;
+export let a931 = 931;
+export let a932 = 932;
+export let a933 = 933;
+export let a934 = 934;
+export let a935 = 935;
+export let a936 = 936;
+export let a937 = 937;
+export let a938 = 938;
+export let a939 = 939;
+export let a940 = 940;
+export let a941 = 941;
+export let a942 = 942;
+export let a943 = 943;
+export let a944 = 944;
+export let a945 = 945;
+export let a946 = 946;
+export let a947 = 947;
+export let a948 = 948;
+export let a949 = 949;
+export let a950 = 950;
+export let a951 = 951;
+export let a952 = 952;
+export let a953 = 953;
+export let a954 = 954;
+export let a955 = 955;
+export let a956 = 956;
+export let a957 = 957;
+export let a958 = 958;
+export let a959 = 959;
+export let a960 = 960;
+export let a961 = 961;
+export let a962 = 962;
+export let a963 = 963;
+export let a964 = 964;
+export let a965 = 965;
+export let a966 = 966;
+export let a967 = 967;
+export let a968 = 968;
+export let a969 = 969;
+export let a970 = 970;
+export let a971 = 971;
+export let a972 = 972;
+export let a973 = 973;
+export let a974 = 974;
+export let a975 = 975;
+export let a976 = 976;
+export let a977 = 977;
+export let a978 = 978;
+export let a979 = 979;
+export let a980 = 980;
+export let a981 = 981;
+export let a982 = 982;
+export let a983 = 983;
+export let a984 = 984;
+export let a985 = 985;
+export let a986 = 986;
+export let a987 = 987;
+export let a988 = 988;
+export let a989 = 989;
+export let a990 = 990;
+export let a991 = 991;
+export let a992 = 992;
+export let a993 = 993;
+export let a994 = 994;
+export let a995 = 995;
+export let a996 = 996;
+export let a997 = 997;
+export let a998 = 998;
+export let a999 = 999;
+export let a1000 = 1000;
+export let a1001 = 1001;
+export let a1002 = 1002;
+export let a1003 = 1003;
+export let a1004 = 1004;
+export let a1005 = 1005;
+export let a1006 = 1006;
+export let a1007 = 1007;
+export let a1008 = 1008;
+export let a1009 = 1009;
+export let a1010 = 1010;
+export let a1011 = 1011;
+export let a1012 = 1012;
+export let a1013 = 1013;
+export let a1014 = 1014;
+export let a1015 = 1015;
+export let a1016 = 1016;
+export let a1017 = 1017;
+export let a1018 = 1018;
+export let a1019 = 1019;
+export let a1020 = 1020;
+export let a1021 = 1021;
+export let a1022 = 1022;
+export let a1023 = 1023;
+export let a1024 = 1024;
+export let a1025 = 1025;
+export let a1026 = 1026;
+export let a1027 = 1027;
+export let a1028 = 1028;
+export let a1029 = 1029;
+export let a1030 = 1030;
+export let a1031 = 1031;
+export let a1032 = 1032;
+export let a1033 = 1033;
+export let a1034 = 1034;
+export let a1035 = 1035;
+export let a1036 = 1036;
+export let a1037 = 1037;
+export let a1038 = 1038;
+export let a1039 = 1039;
+export let a1040 = 1040;
+export let a1041 = 1041;
+export let a1042 = 1042;
+export let a1043 = 1043;
+export let a1044 = 1044;
+export let a1045 = 1045;
+export let a1046 = 1046;
+export let a1047 = 1047;
+export let a1048 = 1048;
+export let a1049 = 1049;
+export let a1050 = 1050;
+export let a1051 = 1051;
+export let a1052 = 1052;
+export let a1053 = 1053;
+export let a1054 = 1054;
+export let a1055 = 1055;
+export let a1056 = 1056;
+export let a1057 = 1057;
+export let a1058 = 1058;
+export let a1059 = 1059;
+export let a1060 = 1060;
+export let a1061 = 1061;
+export let a1062 = 1062;
+export let a1063 = 1063;
+export let a1064 = 1064;
+export let a1065 = 1065;
+export let a1066 = 1066;
+export let a1067 = 1067;
+export let a1068 = 1068;
+export let a1069 = 1069;
+export let a1070 = 1070;
+export let a1071 = 1071;
+export let a1072 = 1072;
+export let a1073 = 1073;
+export let a1074 = 1074;
+export let a1075 = 1075;
+export let a1076 = 1076;
+export let a1077 = 1077;
+export let a1078 = 1078;
+export let a1079 = 1079;
+export let a1080 = 1080;
+export let a1081 = 1081;
+export let a1082 = 1082;
+export let a1083 = 1083;
+export let a1084 = 1084;
+export let a1085 = 1085;
+export let a1086 = 1086;
+export let a1087 = 1087;
+export let a1088 = 1088;
+export let a1089 = 1089;
+export let a1090 = 1090;
+export let a1091 = 1091;
+export let a1092 = 1092;
+export let a1093 = 1093;
+export let a1094 = 1094;
+export let a1095 = 1095;
+export let a1096 = 1096;
+export let a1097 = 1097;
+export let a1098 = 1098;
+export let a1099 = 1099;
diff --git a/src/v8/test/mjsunit/harmony/numeric-separator.js b/src/v8/test/mjsunit/harmony/numeric-separator.js
new file mode 100644
index 0000000..0ea3ac8
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/numeric-separator.js
@@ -0,0 +1,116 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-numeric-separator
+
+{
+  const basic = 1_0_0_0;
+  assertEquals(basic, 1000);
+}
+{
+  const exponent = 1_0e+1;
+  assertEquals(exponent, 10e+1);
+}
+{
+  const exponent2 = 1_0e+1_0;
+  assertEquals(exponent2, 10e+10);
+}
+{
+  const hex = 0xF_F_FF;
+  assertEquals(hex, 0xFFFF);
+}
+{
+  const octal = 0o7_7_7;
+  assertEquals(octal, 0o777);
+}
+{
+  let exception = false;
+  try {
+    const code = `"use strict" const implicitOctal = 07_7_7`;
+    eval(code);
+  } catch(e) {
+    exception = true;
+    assertInstanceof(e, SyntaxError);
+  }
+  assertTrue(exception);
+}
+
+{
+  const binary = 0b0_1_0_1_0;
+  assertEquals(binary, 0b01010);
+}
+{
+  const leadingZeros = 09_1_3;
+  assertEquals(leadingZeros, 0913);
+}
+
+{
+  const dot1 = 9_1.1_3;
+  assertEquals(dot1, 91.13);
+
+  const dot2 = 1.1_3;
+  assertEquals(dot2, 1.13);
+
+  const dot3 = 1_1.21;
+  assertEquals(dot3, 11.21);
+}
+
+{
+  const basic = Number('1_2_3');
+  assertEquals(NaN, basic);
+  const exponent = Number('1_0e+1');
+  assertEquals(NaN, exponent);
+  const exponent2 = Number('1_0e+1_0');
+  assertEquals(NaN, exponent2);
+  const hex = Number('0xF_F_FF');
+  assertEquals(NaN, hex);
+  const octal = Number('0o7_7_7');
+  assertEquals(NaN, octal);
+  const binary = Number('0b0_1_0_1_0');
+  assertEquals(NaN, binary);
+  const leadingZeros = Number('09_1_3');
+  assertEquals(NaN, leadingZeros);
+  const dot1 = Number('9_1.1_3');
+  assertEquals(NaN, dot1);
+  const dot2 = Number('1.1_3');
+  assertEquals(NaN, dot2);
+  const dot3 = Number('1_1.21');
+  assertEquals(NaN, dot3);
+}
+
+{
+  assertEquals(1, parseInt('1_2_3'));
+  assertEquals(0, parseInt('0_1_0_1_0'));
+  assertEquals(15, parseInt('0xF_F'));
+  assertEquals(10, parseInt('10e+1_0'));
+  assertEquals(0, parseInt('0o7_7_7'));
+  assertEquals(0, parseInt('0b1_0_1_0'));
+  assertEquals(9, parseInt('9_1.1_3'));
+  assertEquals(1, parseInt('1.1_3'));
+  assertEquals(1, parseInt('1_1.21'));
+  assertEquals(17, parseInt('017_123'));
+
+  assertEquals(1, parseInt('1_2_3', 10));
+  assertEquals(15, parseInt('0xF_F', 16));
+  assertEquals(7, parseInt('7_7_7', 8));
+  assertEquals(1, parseInt('1_0_1_0', 2));
+}
+
+assertThrows('1_0_0_0_', SyntaxError);
+assertThrows('1e_1', SyntaxError);
+assertThrows('1e+_1', SyntaxError);
+assertThrows('1_e+1', SyntaxError);
+assertThrows('1__0', SyntaxError);
+assertThrows('0x_1', SyntaxError);
+assertThrows('0x1__1', SyntaxError);
+assertThrows('0x1_', SyntaxError);
+assertThrows('0b_0101', SyntaxError);
+assertThrows('0b11_', SyntaxError);
+assertThrows('0b1__1', SyntaxError);
+assertThrows('0o777_', SyntaxError);
+assertThrows('0o_777', SyntaxError);
+assertThrows('0o7__77', SyntaxError);
+assertThrows('0777_', SyntaxError);
+assertThrows('07__77', SyntaxError);
+assertThrows('07_7_7', SyntaxError);
diff --git a/src/v8/test/mjsunit/harmony/object-fromentries.js b/src/v8/test/mjsunit/harmony/object-fromentries.js
new file mode 100644
index 0000000..86733b1
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/object-fromentries.js
@@ -0,0 +1,437 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const fromEntries = Object.fromEntries;
+const ObjectPrototype = Object.prototype;
+const ObjectPrototypeHasOwnProperty = ObjectPrototype.hasOwnProperty;
+function hasOwnProperty(O, Name) {
+  if (O === undefined || O === null) return false;
+  return ObjectPrototypeHasOwnProperty.call(O, Name);
+}
+
+let test = {
+  methodExists() {
+    assertTrue(hasOwnProperty(Object, "fromEntries"));
+    assertEquals("function", typeof Object.fromEntries);
+  },
+
+  methodLength() {
+    assertEquals(1, Object.fromEntries.length);
+  },
+
+  methodName() {
+    assertEquals("fromEntries", Object.fromEntries.name);
+  },
+
+  methodPropertyDescriptor() {
+    let descriptor = Object.getOwnPropertyDescriptor(Object, "fromEntries");
+    assertFalse(descriptor.enumerable);
+    assertTrue(descriptor.configurable);
+    assertTrue(descriptor.writable);
+    assertEquals(descriptor.value, Object.fromEntries);
+  },
+
+  exceptionIfNotCoercible() {
+    assertThrows(() => fromEntries(null), TypeError);
+    assertThrows(() => fromEntries(undefined), TypeError);
+  },
+
+  exceptionIfNotIterable() {
+    let nonIterable = [1, 2, 3, 4, 5];
+    Object.defineProperty(nonIterable, Symbol.iterator, { value: undefined });
+    assertThrows(() => fromEntries(nonIterable), TypeError);
+  },
+
+  exceptionIfGetIteratorThrows() {
+    let iterable = [1, 2, 3, 4, 5];
+    class ThrewDuringGet {};
+    Object.defineProperty(iterable, Symbol.iterator, {
+      get() { throw new ThrewDuringGet(); }
+    });
+    assertThrows(() => fromEntries(iterable), ThrewDuringGet);
+  },
+
+  exceptionIfCallIteratorThrows() {
+    let iterable = [1, 2, 3, 4, 5];
+    class ThrewDuringCall {};
+    iterable[Symbol.iterator] = function() {
+      throw new ThrewDuringCall();
+    }
+    assertThrows(() => fromEntries(iterable), ThrewDuringCall);
+  },
+
+  exceptionIfIteratorNextThrows() {
+    let iterable = [1, 2, 3, 4, 5];
+    class ThrewDuringIteratorNext {}
+    iterable[Symbol.iterator] = function() {
+      return {
+        next() { throw new ThrewDuringIteratorNext; },
+        return() {
+          throw new Error(
+              "IteratorClose must not be performed if IteratorStep throws");
+        },
+      }
+    }
+    assertThrows(() => fromEntries(iterable), ThrewDuringIteratorNext);
+  },
+
+  exceptionIfIteratorCompleteThrows() {
+    let iterable = [1, 2, 3, 4, 5];
+    class ThrewDuringIteratorComplete {}
+    iterable[Symbol.iterator] = function() {
+      return {
+        next() {
+          return {
+            get value() { throw new Error(
+                "IteratorValue must not be performed before IteratorComplete");
+            },
+            get done() {
+              throw new ThrewDuringIteratorComplete();
+            }
+          }
+          throw new ThrewDuringIteratorNext;
+        },
+        return() {
+          throw new Error(
+              "IteratorClose must not be performed if IteratorStep throws");
+        },
+      }
+    }
+    assertThrows(() => fromEntries(iterable), ThrewDuringIteratorComplete);
+  },
+
+  exceptionIfEntryIsNotObject() {
+    {
+      // Fast path (Objects/Smis)
+      let iterables = [[null], [undefined], [1], [NaN], [false], [Symbol()],
+                       [""]];
+      for (let iterable of iterables) {
+        assertThrows(() => fromEntries(iterable), TypeError);
+      }
+    }
+    {
+      // Fast path (Doubles)
+      let iterable = [3.7, , , 3.6, 1.1, -0.4];
+      assertThrows(() => fromEntries(iterable), TypeError);
+    }
+    {
+      // Slow path
+      let i = 0;
+      let values = [null, undefined, 1, NaN, false, Symbol(), ""];
+      let iterable = {
+        [Symbol.iterator]() { return this; },
+        next() {
+          return {
+            done: i >= values.length,
+            value: values[i++],
+          }
+        },
+      };
+      for (let k = 0; k < values.length; ++k) {
+        assertThrows(() => fromEntries(iterable), TypeError);
+      }
+      assertEquals({}, fromEntries(iterable));
+    }
+  },
+
+  returnIfEntryIsNotObject() {
+    // Only observable/verifiable in the slow path :(
+    let i = 0;
+    let didCallReturn = false;
+    let values = [null, undefined, 1, NaN, false, Symbol(), ""];
+    let iterable = {
+      [Symbol.iterator]() { return this; },
+      next() {
+        return {
+          done: i >= values.length,
+          value: values[i++],
+        }
+      },
+      return() { didCallReturn = true; throw new Error("Unused!"); }
+    };
+    for (let k = 0; k < values.length; ++k) {
+      didCallReturn = false;
+      assertThrows(() => fromEntries(iterable), TypeError);
+      assertTrue(didCallReturn);
+    }
+    assertEquals({}, fromEntries(iterable));
+  },
+
+  returnIfEntryKeyAccessorThrows() {
+    class ThrewDuringKeyAccessor {};
+    let entries = [{ get 0() { throw new ThrewDuringKeyAccessor(); },
+                     get 1() { throw new Error("Unreachable!"); } }];
+    let didCallReturn = false;
+    let iterator = entries[Symbol.iterator]();
+    iterator.return = function() {
+      didCallReturn = true;
+      throw new Error("Unused!");
+    }
+    assertThrows(() => fromEntries(iterator), ThrewDuringKeyAccessor);
+    assertTrue(didCallReturn);
+  },
+
+  returnIfEntryKeyAccessorThrows() {
+    class ThrewDuringValueAccessor {};
+    let entries = [{ get 1() { throw new ThrewDuringValueAccessor(); },
+                         0: "key",
+                      }];
+    let didCallReturn = false;
+    let iterator = entries[Symbol.iterator]();
+    iterator.return = function() {
+      didCallReturn = true;
+      throw new Error("Unused!");
+    };
+    assertThrows(() => fromEntries(iterator), ThrewDuringValueAccessor);
+    assertTrue(didCallReturn);
+  },
+
+  returnIfKeyToStringThrows() {
+    class ThrewDuringKeyToString {};
+    let operations = [];
+    let entries = [{
+      get 0() {
+        operations.push("[[Get]] key");
+        return {
+          toString() {
+            operations.push("toString(key)");
+            throw new ThrewDuringKeyToString();
+          },
+          valueOf() {
+            operations.push("valueOf(key)");
+          }
+        };
+      },
+      get 1() {
+        operations.push("[[Get]] value");
+        return "value";
+      },
+    }];
+
+    let iterator = entries[Symbol.iterator]();
+    iterator.return = function() {
+      operations.push("IteratorClose");
+      throw new Error("Unused!");
+    };
+    assertThrows(() => fromEntries(iterator), ThrewDuringKeyToString);
+    assertEquals([
+      "[[Get]] key",
+      "[[Get]] value",
+      "toString(key)",
+      "IteratorClose",
+    ], operations);
+  },
+
+  throwsIfIteratorValueThrows() {
+    let iterable = [1, 2, 3, 4, 5];
+    class ThrewDuringIteratorValue {}
+    iterable[Symbol.iterator] = function() {
+      return {
+        next() {
+          return {
+            get value() { throw new ThrewDuringIteratorValue(); },
+            get done() { return false; }
+          }
+          throw new ThrewDuringIteratorNext;
+        },
+        return() {
+          throw new Error(
+              "IteratorClose must not be performed if IteratorStep throws");
+        },
+      }
+    }
+    assertThrows(() => fromEntries(iterable), ThrewDuringIteratorValue);
+  },
+
+  emptyIterable() {
+    let iterables = [[], new Set(), new Map()];
+    for (let iterable of iterables) {
+      let result = fromEntries(iterable);
+      assertEquals({}, result);
+      assertEquals(ObjectPrototype, result.__proto__);
+    }
+  },
+
+  keyOrderFastPath() {
+    let entries = [
+      ["z", 1],
+      ["y", 2],
+      ["x", 3],
+      ["y", 4],
+      [100, 0],
+    ];
+    let result = fromEntries(entries);
+    assertEquals({
+      100: 0,
+      z: 1,
+      y: 4,
+      x: 3,
+    }, result);
+    assertEquals(["100", "z", "y", "x"], Object.keys(result));
+  },
+
+  keyOrderSlowPath() {
+    let entries = [
+      ["z", 1],
+      ["y", 2],
+      ["x", 3],
+      ["y", 4],
+      [100, 0],
+    ];
+    let i = 0;
+    let iterable = {
+      [Symbol.iterator]() { return this; },
+      next() {
+        return {
+          done: i >= entries.length,
+          value: entries[i++]
+        }
+      },
+      return() { throw new Error("Unreachable!"); }
+    };
+    let result = fromEntries(iterable);
+    assertEquals({
+      100: 0,
+      z: 1,
+      y: 4,
+      x: 3,
+    }, result);
+    assertEquals(["100", "z", "y", "x"], Object.keys(result));
+  },
+
+  doesNotUseIteratorForKeyValuePairFastCase() {
+    class Entry {
+      constructor(k, v) {
+        this[0] = k;
+        this[1] = v;
+      }
+      get [Symbol.iterator]() {
+        throw new Error("Should not load Symbol.iterator from Entry!");
+      }
+    }
+    function e(k, v) { return new Entry(k, v); }
+    let entries = [e(100, 0), e('z', 1), e('y', 2), e('x', 3), e('y', 4)];
+    let result = fromEntries(entries);
+    assertEquals({
+      100: 0,
+      z: 1,
+      y: 4,
+      x: 3,
+    }, result);
+  },
+
+  doesNotUseIteratorForKeyValuePairSlowCase() {
+    class Entry {
+      constructor(k, v) {
+        this[0] = k;
+        this[1] = v;
+      }
+      get [Symbol.iterator]() {
+        throw new Error("Should not load Symbol.iterator from Entry!");
+      }
+    }
+    function e(k, v) { return new Entry(k, v); }
+    let entries = new Set(
+        [e(100, 0), e('z', 1), e('y', 2), e('x', 3), e('y', 4)]);
+    let result = fromEntries(entries);
+    assertEquals({
+      100: 0,
+      z: 1,
+      y: 4,
+      x: 3,
+    }, result);
+  },
+
+  createDataPropertyFastCase() {
+    Object.defineProperty(ObjectPrototype, "property", {
+      configurable: true,
+      get() { throw new Error("Should not invoke getter on prototype!"); },
+      set() { throw new Error("Should not invoke setter on prototype!"); },
+    });
+
+    let entries = [["property", "value"]];
+    let result = fromEntries(entries);
+    assertEquals(result.property, "value");
+    delete ObjectPrototype.property;
+  },
+
+  createDataPropertySlowCase() {
+    Object.defineProperty(ObjectPrototype, "property", {
+      configurable: true,
+      get() { throw new Error("Should not invoke getter on prototype!"); },
+      set() { throw new Error("Should not invoke setter on prototype!"); },
+    });
+
+    let entries = new Set([["property", "value"]]);
+    let result = fromEntries(entries);
+    assertEquals(result.property, "value");
+    delete ObjectPrototype.property;
+  },
+
+  keyToPrimitiveMutatesArrayInFastCase() {
+    let mySymbol = Symbol();
+    let entries = [[0, 1], ["a", 2], [{
+      [Symbol.toPrimitive]() {
+        // The fast path should bail out if a key is a JSReceiver, otherwise
+        // assumptions about the structure of the iterable can change. If the
+        // fast path doesn't bail out, the 4th key would be "undefined".
+        delete entries[3][0];
+        entries[3].__proto__ = { 0: "shfifty", };
+        return mySymbol;
+      },
+    }, 3], [3, 4]];
+    let result = fromEntries(entries);
+    assertEquals({
+      0: 1,
+      "a": 2,
+      [mySymbol]: 3,
+      "shfifty": 4,
+    }, result);
+    assertEquals(["0", "a", "shfifty", mySymbol], Reflect.ownKeys(result));
+  },
+
+  keyToStringMutatesArrayInFastCase() {
+    let mySymbol = Symbol();
+    let entries = [[mySymbol, 1], [0, 2], [{
+      toString() {
+        delete entries[3][0];
+        entries[3].__proto__ = { 0: "shfifty", };
+        return "z";
+      },
+      valueOf() { throw new Error("Unused!"); }
+    }, 3], [3, 4]];
+    let result = fromEntries(entries);
+    assertEquals({
+      [mySymbol]: 1,
+      0: 2,
+      "z": 3,
+      "shfifty": 4,
+    }, result);
+    assertEquals(["0", "z", "shfifty", mySymbol], Reflect.ownKeys(result));
+  },
+
+  keyValueOfMutatesArrayInFastCase() {
+    let mySymbol = Symbol();
+    let entries = [[mySymbol, 1], ["z", 2], [{
+      toString: undefined,
+      valueOf() {
+        delete entries[3][0];
+        entries[3].__proto__ = { 0: "shfifty", };
+        return 0;
+      },
+    }, 3], [3, 4]];
+    let result = fromEntries(entries);
+    assertEquals({
+      [mySymbol]: 1,
+      "z": 2,
+      0: 3,
+      "shfifty": 4,
+    }, result);
+    assertEquals(["0", "z", "shfifty", mySymbol], Reflect.ownKeys(result));
+  },
+}
+
+for (let t of Reflect.ownKeys(test)) {
+  test[t]();
+}
diff --git a/src/v8/test/mjsunit/harmony/optional-catch-binding-breaks.js b/src/v8/test/mjsunit/harmony/optional-catch-binding-breaks.js
index 82be60c..7ba4ad0 100644
--- a/src/v8/test/mjsunit/harmony/optional-catch-binding-breaks.js
+++ b/src/v8/test/mjsunit/harmony/optional-catch-binding-breaks.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-optional-catch-binding
-
 let state = 'initial';
 x: try {
   throw new Error('caught');
diff --git a/src/v8/test/mjsunit/harmony/optional-catch-binding.js b/src/v8/test/mjsunit/harmony/optional-catch-binding.js
index 093288c..eaedc82 100644
--- a/src/v8/test/mjsunit/harmony/optional-catch-binding.js
+++ b/src/v8/test/mjsunit/harmony/optional-catch-binding.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-optional-catch-binding
-
 let state = 'initial';
 try {
   throw new Error('caught');
diff --git a/src/v8/test/mjsunit/harmony/private-fields-ic.js b/src/v8/test/mjsunit/harmony/private-fields-ic.js
new file mode 100644
index 0000000..95f9147
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/private-fields-ic.js
@@ -0,0 +1,292 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+{
+  class X {
+    #x = 1;
+    getX(arg) { return arg.#x; }
+    setX(arg, val) { arg.#x = val; }
+  }
+
+  let x1 = new X;
+  let y = new class {};
+
+  // IC: 0 -> Error
+  assertThrows(() => x1.getX(y), TypeError);
+  assertThrows(() => x1.getX(y), TypeError);
+  assertThrows(() => x1.getX(y), TypeError);
+
+  assertThrows(() => x1.setX(y, 2), TypeError);
+  assertThrows(() => x1.setX(y, 3), TypeError);
+  assertThrows(() => x1.setX(y, 4), TypeError);
+
+  // IC: 0 -> Monomorphic
+  assertEquals(1, x1.getX(x1));
+  assertEquals(1, x1.getX(x1));
+  assertEquals(1, x1.getX(x1));
+
+  x1.setX(x1, 2);
+  x1.setX(x1, 3);
+  x1.setX(x1, 4);
+}
+
+{
+  class X {
+    #x = 1;
+    getX(arg) { return arg.#x; }
+    setX(arg, val) { arg.#x = val; }
+  }
+
+  let x1 = new X;
+  // IC: 0 -> Monomorphic
+  assertEquals(1, x1.getX(x1));
+  assertEquals(1, x1.getX(x1));
+  assertEquals(1, x1.getX(x1));
+
+  x1.setX(x1, 2);
+  x1.setX(x1, 3);
+  x1.setX(x1, 4);
+
+  let y = new class {};
+  // IC: Monomorphic -> Error
+  assertThrows(() => x1.getX(y), TypeError);
+  assertThrows(() => x1.getX(y), TypeError);
+  assertThrows(() => x1.getX(y), TypeError);
+
+  assertThrows(() => x1.setX(y, 2), TypeError);
+  assertThrows(() => x1.setX(y, 3), TypeError);
+  assertThrows(() => x1.setX(y, 4), TypeError);
+
+  let x3 = new X;
+  // IC: Monomorphic -> Monomorphic
+  assertEquals(1, x1.getX(x3));
+  assertEquals(1, x1.getX(x3));
+  assertEquals(1, x1.getX(x3));
+
+  x1.setX(x3, 2);
+  x1.setX(x3, 3);
+  x1.setX(x3, 4);
+}
+
+
+{
+  class X {
+    #x = 1;
+    getX(arg) { return arg.#x; }
+    setX(arg, val) { arg.#x = val; }
+  }
+
+  let x1 = new X;
+  // IC: 0 -> Monomorphic
+  assertEquals(1, x1.getX(x1));
+  assertEquals(1, x1.getX(x1));
+  assertEquals(1, x1.getX(x1));
+
+  x1.setX(x1, 2);
+  x1.setX(x1, 3);
+  x1.setX(x1, 4);
+
+  class X2 extends X {
+    #x2 = 2;
+  }
+
+  let x2 = new X2;
+  // IC: Monomorphic -> Polymorphic
+  assertEquals(1, x1.getX(x2));
+  assertEquals(1, x1.getX(x2));
+  assertEquals(1, x1.getX(x2));
+
+  x1.setX(x2, 2);
+  x1.setX(x2, 3);
+  x1.setX(x2, 4);
+
+  let y = new class {};
+
+  // IC: Polymorphic -> Error
+  assertThrows(() => x1.getX(y), TypeError);
+  assertThrows(() => x1.getX(y), TypeError);
+  assertThrows(() => x1.getX(y), TypeError);
+
+  assertThrows(() => x1.setX(y, 2), TypeError);
+  assertThrows(() => x1.setX(y, 3), TypeError);
+  assertThrows(() => x1.setX(y, 4), TypeError);
+
+  class X3 extends X {
+    #x3 = 2;
+  }
+
+  let x3 = new X3;
+  // IC: Polymorphic -> Polymorphic
+  assertEquals(1, x1.getX(x3));
+  assertEquals(1, x1.getX(x3));
+  assertEquals(1, x1.getX(x3));
+
+  x1.setX(x3, 2);
+  x1.setX(x3, 3);
+  x1.setX(x3, 4);
+}
+
+{
+  class X {
+    #x = 1;
+    getX(arg) { return arg.#x; }
+    setX(arg, val) { arg.#x = val; }
+  }
+
+  let x1 = new X;
+  // IC: 0 -> Monomorphic
+  assertEquals(1, x1.getX(x1));
+  assertEquals(1, x1.getX(x1));
+  assertEquals(1, x1.getX(x1));
+
+  x1.setX(x1, 2);
+  x1.setX(x1, 3);
+  x1.setX(x1, 4);
+
+  class X2 extends X {
+    #x2 = 2;
+  }
+
+  let x2 = new X2;
+  // IC: Monomorphic -> Polymorphic
+  assertEquals(1, x1.getX(x2));
+  assertEquals(1, x1.getX(x2));
+  assertEquals(1, x1.getX(x2));
+
+  x1.setX(x2, 2);
+  x1.setX(x2, 3);
+  x1.setX(x2, 4);
+
+  class X3 extends X {
+    #x3 = 2;
+  }
+
+  let x3 = new X3;
+  assertEquals(1, x1.getX(x3));
+  assertEquals(1, x1.getX(x3));
+  assertEquals(1, x1.getX(x3));
+
+  x1.setX(x3, 2);
+  x1.setX(x3, 3);
+  x1.setX(x3, 4);
+
+
+  class X4 extends X {
+    #x4 = 2;
+  }
+
+  let x4 = new X4;
+  assertEquals(1, x1.getX(x4));
+  assertEquals(1, x1.getX(x4));
+  assertEquals(1, x1.getX(x4));
+
+  x1.setX(x4, 2);
+  x1.setX(x4, 3);
+  x1.setX(x4, 4);
+
+  class X5 extends X {
+    #x5 = 2;
+  }
+
+  let x5 = new X5;
+  // IC: Polymorphic -> Megamorphic
+  assertEquals(1, x1.getX(x5));
+  assertEquals(1, x1.getX(x5));
+  assertEquals(1, x1.getX(x5));
+
+  x1.setX(x5, 2);
+  x1.setX(x5, 3);
+  x1.setX(x5, 4);
+
+  let y = new class {};
+
+  // IC: Megamorphic -> Error
+  assertThrows(() => x1.getX(y), TypeError);
+  assertThrows(() => x1.getX(y), TypeError);
+  assertThrows(() => x1.getX(y), TypeError);
+
+  assertThrows(() => x1.setX(y, 2), TypeError);
+  assertThrows(() => x1.setX(y, 3), TypeError);
+  assertThrows(() => x1.setX(y, 4), TypeError);
+
+  class X6 extends X {
+    #x6 = 2;
+  }
+
+  let x6 = new X6;
+  // IC: Megamorphic -> Megamorphic
+  assertEquals(1, x1.getX(x6));
+  assertEquals(1, x1.getX(x6));
+  assertEquals(1, x1.getX(x6));
+
+  x1.setX(x6, 2);
+  x1.setX(x6, 3);
+  x1.setX(x6, 4);
+}
+
+{
+  class C {
+    #a = 1;
+    getA() { return this.#a; }
+    setA(v) { this.#a = v; }
+  }
+
+  let p = new Proxy(new C, {
+    get(target, name) {
+      return target[name];
+    },
+
+    set(target, name, val) {
+      target[name] = val;
+    }
+  });
+
+  assertThrows(() => p.getA(), TypeError);
+  assertThrows(() => p.getA(), TypeError);
+  assertThrows(() => p.getA(), TypeError);
+
+  assertThrows(() => p.setA(2), TypeError);
+  assertThrows(() => p.setA(3), TypeError);
+  assertThrows(() => p.setA(4), TypeError);
+
+  let x = new Proxy(new C, {});
+  assertThrows(() => x.getA(), TypeError);
+  assertThrows(() => x.getA(), TypeError);
+  assertThrows(() => x.getA(), TypeError);
+
+  assertThrows(() => x.setA(2), TypeError);
+  assertThrows(() => x.setA(3), TypeError);
+  assertThrows(() => x.setA(4), TypeError);
+}
+
+{
+  class A {
+    constructor(arg) {
+      return arg;
+    }
+  }
+
+  class X extends A {
+    #x = 1;
+
+    constructor(arg) {
+      super(arg);
+    }
+
+    getX(arg) { return arg.#x; }
+
+    setX(arg, val) { arg.#x = val; }
+  }
+
+  let proxy = new Proxy({}, {});
+  let x = new X(proxy);
+
+  assertEquals(1, X.prototype.getX(proxy));
+  assertEquals(1, X.prototype.getX(proxy));
+  assertEquals(1, X.prototype.getX(proxy));
+
+  X.prototype.setX(proxy, 2);
+  X.prototype.setX(proxy, 3);
+  X.prototype.setX(proxy, 4);
+}
diff --git a/src/v8/test/mjsunit/harmony/private-fields-special-object.js b/src/v8/test/mjsunit/harmony/private-fields-special-object.js
new file mode 100644
index 0000000..4e6801e
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/private-fields-special-object.js
@@ -0,0 +1,51 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+load('test/mjsunit/test-async.js');
+
+async function f(assert) {
+  try {
+    module_namespace_obj = await import('modules-skip-1.mjs');
+  } catch(e) {
+    %AbortJS(e);
+  }
+
+  class A {
+    constructor(arg) {
+      return arg;
+    }
+  }
+
+  class X extends A {
+    #x = 1;
+
+    constructor(arg) {
+      super(arg);
+    }
+
+    getX(arg) {
+      return arg.#x;
+    }
+
+    setX(arg, val) { arg.#x = val; }
+  }
+
+  let x = new X(module_namespace_obj);
+
+  assert.equals(1, X.prototype.getX(module_namespace_obj));
+  assert.equals(1, X.prototype.getX(module_namespace_obj));
+  assert.equals(1, X.prototype.getX(module_namespace_obj));
+
+  X.prototype.setX(module_namespace_obj, 2);
+  X.prototype.setX(module_namespace_obj, 3);
+  X.prototype.setX(module_namespace_obj, 4);
+}
+
+testAsync(assert => {
+  assert.plan(3);
+
+  f(assert).catch(assert.unreachable);
+}, "private-fields-special-object");
diff --git a/src/v8/test/mjsunit/harmony/private-fields-static.js b/src/v8/test/mjsunit/harmony/private-fields-static.js
new file mode 100644
index 0000000..a731a35
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/private-fields-static.js
@@ -0,0 +1,356 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+
+"use strict";
+
+{
+  class C {
+    static #a;
+    static getA() { return this.#a; }
+  }
+
+  assertEquals(undefined, C.a);
+  assertEquals(undefined, C.getA());
+
+  let c = new C;
+  assertEquals(undefined, c.a);
+}
+
+{
+  class C {
+    static #a = 1;
+    static getA() { return this.#a; }
+  }
+
+  assertEquals(undefined, C.a);
+  assertEquals(1, C.getA());
+
+  let c = new C;
+  assertEquals(undefined, c.a);
+}
+
+{
+  class C {
+    static #a = 1;
+    static #b = this.#a;
+    static getB() { return this.#b; }
+  }
+
+  assertEquals(1, C.getB());
+
+  let c = new C;
+  assertEquals(undefined, c.getB);
+}
+
+{
+  class C {
+    static #a = 1;
+    static getA() { return this.#a; }
+    constructor() {
+      assertThrows(() => this.#a, TypeError);
+      C.#a = 2;
+    }
+  }
+
+  assertEquals(1, C.getA());
+
+  let c = new C;
+  assertThrows(() => C.prototype.getA.call(c));
+  assertEquals(2, C.getA());
+}
+
+{
+  class C {
+    static #a = this;
+    static #b = () => this;
+    static getA() { return this.#a; }
+    static getB() { return this.#b; }
+  }
+
+  assertSame(C, C.getA());
+  assertSame(C, C.getB()());
+}
+
+{
+  class C {
+    static #a = this;
+    static #b = function() { return this; };
+    static getA() { return this.#a; }
+    static getB() { return this.#b; }
+  }
+
+  assertSame(C, C.getA());
+  assertSame(C, C.getB().call(C));
+  assertSame(undefined, C.getB()());
+}
+
+
+{
+  class C {
+    static #a = function() { return 1 };
+    static getA() {return this.#a;}
+  }
+
+  assertEquals('#a', C.getA().name);
+}
+
+{
+  let d = function() { return new.target; }
+  class C {
+    static #c = d;
+    static getC() { return this.#c; }
+  }
+
+  assertEquals(undefined, C.getC()());
+  assertSame(new d, new (C.getC()));
+}
+
+{
+  class C {
+    static #a = 1;
+    static getA(instance) { return instance.#a; }
+  }
+
+  class B { }
+
+  assertEquals(undefined, C.a);
+  assertEquals(1, C.getA(C));
+  assertThrows(() => C.getA(B), TypeError);
+}
+
+{
+  class A {
+    static #a = 1;
+    static getA() { return this.#a; }
+  }
+
+  class B extends A {}
+  assertThrows(() => B.getA(), TypeError);
+}
+
+{
+  class A {
+    static #a = 1;
+    static getA() { return A.#a; }
+  }
+
+  class B extends A {}
+  assertSame(1, B.getA());
+}
+
+{
+  let prototypeLookup = false;
+  class A {
+    static set a(val) {
+      prototypeLookup = true;
+    }
+
+    static get a() { return undefined; }
+  }
+
+  class C extends A {
+    static #a = 1;
+    static getA() { return this.#a; }
+  }
+
+  assertEquals(1, C.getA());
+  assertEquals(false, prototypeLookup);
+}
+
+{
+  class A {
+    static a = 1;
+  }
+
+  class B extends A {
+    static #b = this.a;
+    static getB() { return this.#b; }
+  }
+
+  assertEquals(1, B.getB());
+}
+
+{
+  class A {
+    static #a = 1;
+    static getA() { return this.#a; }
+  }
+
+  class B extends A {
+    static getA() { return super.getA(); }
+  }
+
+  assertThrows(() => B.getA(), TypeError);
+}
+
+{
+  class A {
+    static #a = 1;
+    static getA() { return this.#a;}
+  }
+
+  class B extends A {
+    static #a = 2;
+    static get_A() { return this.#a;}
+  }
+
+  assertEquals(1, A.getA());
+  assertThrows(() => B.getA(), TypeError);
+  assertEquals(2, B.get_A());
+}
+
+{
+  let foo = undefined;
+  class A {
+    static #a = (function() { foo = 1; })();
+  }
+
+  assertEquals(1, foo);
+}
+
+{
+  let foo = undefined;
+  class A extends class {} {
+    static #a = (function() { foo = 1; })();
+  }
+
+  assertEquals(1, foo);
+}
+
+{
+  function makeClass() {
+    return class {
+      static #a;
+      static setA(val) { this.#a = val; }
+      static getA() { return this.#a; }
+    }
+  }
+
+  let classA = makeClass();
+  let classB = makeClass();
+
+  assertEquals(undefined, classA.getA());
+  assertEquals(undefined, classB.getA());
+
+  classA.setA(3);
+  assertEquals(3, classA.getA());
+  assertEquals(undefined, classB.getA());
+
+  classB.setA(5);
+  assertEquals(3, classA.getA());
+  assertEquals(5, classB.getA());
+
+  assertThrows(() => classA.getA.call(classB), TypeError);
+  assertThrows(() => classB.getA.call(classA), TypeError);
+}
+
+{
+  let value = undefined;
+
+  new class {
+    static #a = 1;
+    static getA() { return this.#a; }
+
+    constructor() {
+      new class C {
+        static #a = 2;
+        constructor() {
+          value = C.#a;
+        }
+      }
+    }
+  }
+
+  assertEquals(2, value);
+}
+
+{
+  class A {
+    static #a = 1;
+    static b = class {
+      static getA() { return this.#a; }
+      static get_A(val) { return val.#a; }
+    }
+  }
+
+  assertEquals(1, A.b.getA.call(A));
+  assertEquals(1, A.b.get_A(A));
+}
+
+{
+  assertThrows(() => class { static b = this.#a; static #a = 1 }, TypeError);
+}
+
+{
+  let symbol = Symbol();
+
+  class C {
+    static #a = 1;
+    static [symbol] = 1;
+    static getA() { return this.#a; }
+    static setA(val) { this.#a = val; }
+  }
+
+  var p = new Proxy(C, {
+    get: function(target, name) {
+      if (typeof(arg) === 'symbol') {
+        assertFalse(%SymbolIsPrivate(name));
+      }
+      return target[name];
+    }
+  });
+
+  assertThrows(() => p.getA(), TypeError);
+  assertThrows(() => p.setA(1), TypeError);
+  assertEquals(1, p[symbol]);
+}
+
+{
+  class C {
+    static #b = Object.freeze(this);
+    static getA() { return this.#a; }
+    static #a = 1;
+  }
+
+  assertEquals(1, C.getA());
+}
+
+{
+  class C {
+    static #a = 1;
+    static getA() { return eval('this.#a'); }
+  }
+
+  assertEquals(1, C.getA());
+}
+
+{
+  var C;
+  eval('C = class { static #a = 1; static getA() { return eval(\'this.#a\'); }}');
+
+  assertEquals(1, C.getA());
+}
+
+{
+  class C {
+    static #a = 1;
+    static getA() { return this.#a; }
+    static setA() { eval('this.#a = 4'); }
+  }
+
+  assertEquals(1, C.getA());
+  C.setA();
+  assertEquals(4, C.getA());
+}
+
+{
+  class C {
+    static getA() { return eval('this.#a'); }
+  }
+
+  assertThrows(() => C.getA(), SyntaxError);
+}
diff --git a/src/v8/test/mjsunit/harmony/private-fields.js b/src/v8/test/mjsunit/harmony/private-fields.js
new file mode 100644
index 0000000..0c1c04b
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/private-fields.js
@@ -0,0 +1,478 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+
+"use strict";
+
+{
+  class C {
+    #a;
+    getA() { return this.#a; }
+  }
+
+  assertEquals(undefined, C.a);
+
+  let c = new C;
+  assertEquals(undefined, c.a);
+  assertEquals(undefined, c.getA());
+}
+
+{
+  class C {
+    #a = 1;
+    getA() { return this.#a; }
+  }
+
+  assertEquals(undefined, C.a);
+
+  let c = new C;
+  assertEquals(undefined, c.a);
+  assertEquals(1, c.getA());
+}
+
+{
+  class C {
+    #a = 1;
+    #b = this.#a;
+    getB() { return this.#b; }
+  }
+
+  let c = new C;
+  assertEquals(1, c.getB());
+}
+
+{
+  class C {
+    #a = 1;
+    getA() { return this.#a; }
+    constructor() {
+      assertEquals(1, this.#a);
+      this.#a = 5;
+    }
+  }
+
+  let c = new C;
+  assertEquals(5, c.getA());
+}
+
+{
+  class C {
+    #a = this;
+    #b = () => this;
+    getA() { return this.#a; }
+    getB() { return this.#b; }
+  }
+
+  let c1 = new C;
+  assertSame(c1, c1.getA());
+  assertSame(c1, c1.getB()());
+  let c2 = new C;
+  assertSame(c1, c1.getB().call(c2));
+}
+
+{
+  class C {
+    #a = this;
+    #b = function() { return this; };
+    getA() { return this.#a; }
+    getB() { return this.#b; }
+  }
+
+  let c1 = new C;
+  assertSame(c1, c1.getA());
+  assertSame(c1, c1.getB().call(c1));
+  let c2 = new C;
+  assertSame(c2, c1.getB().call(c2));
+}
+
+
+{
+  class C {
+    #a = function() { return 1 };
+    getA() {return this.#a;}
+  }
+
+  let c = new C;
+  assertEquals('#a', c.getA().name);
+}
+
+{
+  let d = function() { return new.target; }
+  class C {
+    #c = d;
+    getC() { return this.#c; }
+  }
+
+  let c = new C;
+  assertEquals(undefined, c.getC()());
+  assertSame(new d, new (c.getC()));
+}
+
+{
+  class C {
+    #b = new.target;
+    #c = () => new.target;
+    getB() { return this.#b; }
+    getC() { return this.#c; }
+  }
+
+  let c = new C;
+  assertEquals(undefined, c.getB());
+  assertEquals(undefined, c.getC()());
+}
+
+{
+  class C {
+    #a = 1;
+    #b = () => this.#a;
+    getB() { return this.#b; }
+  }
+
+  let c1 = new C;
+  assertSame(1, c1.getB()());
+}
+
+{
+  class C {
+    #a = 1;
+    getA(instance) { return instance.#a; }
+  }
+
+  class B { }
+  let c = new C;
+  assertEquals(undefined, c.a);
+  assertEquals(1, c.getA(c));
+
+  assertThrows(() => c.getA(new B), TypeError);
+}
+
+{
+  class A {
+    #a = 1;
+    getA() { return this.#a; }
+  }
+
+  class B extends A {}
+  let b = new B;
+  assertEquals(1, b.getA());
+}
+
+{
+  let prototypeLookup = false;
+  class A {
+    set a(val) {
+      prototypeLookup = true;
+    }
+
+    get a() { return undefined; }
+  }
+
+  class C extends A {
+    #a = 1;
+    getA() { return this.#a; }
+  }
+
+  let c = new C;
+  assertEquals(1, c.getA());
+  assertEquals(false, prototypeLookup);
+}
+
+{
+  class A {
+    constructor() { this.a = 1; }
+  }
+
+  class B extends A {
+    #b = this.a;
+    getB() { return this.#b; }
+  }
+
+  let b = new B;
+  assertEquals(1, b.getB());
+}
+
+{
+  class A {
+    #a = 1;
+    getA() { return this.#a; }
+  }
+
+  class B extends A {
+    #b = super.getA();
+    getB() { return this.#b; }
+  }
+
+  let b = new B;
+  assertEquals(1, b.getB());
+}
+
+{
+  class A {
+    #a = 1;
+    getA() { return this.#a;}
+  }
+
+  class B extends A {
+    #a = 2;
+    get_A() { return this.#a;}
+  }
+
+  let a = new A;
+  let b = new B;
+  assertEquals(1, a.getA());
+  assertEquals(1, b.getA());
+  assertEquals(2, b.get_A());
+}
+
+{
+  let foo = undefined;
+  class A {
+    #a = 1;
+    constructor() {
+      foo = this.#a;
+    }
+  }
+
+  let a = new A;
+  assertEquals(1, foo);
+}
+
+{
+  let foo = undefined;
+  class A extends class {} {
+    #a = 1;
+    constructor() {
+      super();
+      foo = this.#a;
+    }
+  }
+
+  let a = new A;
+  assertEquals(1, foo);
+}
+
+{
+  function makeClass() {
+    return class {
+      #a;
+      setA(val) { this.#a = val; }
+      getA() { return this.#a; }
+    }
+  }
+
+  let classA = makeClass();
+  let a = new classA;
+  let classB = makeClass();
+  let b = new classB;
+
+  assertEquals(undefined, a.getA());
+  assertEquals(undefined, b.getA());
+
+  a.setA(3);
+  assertEquals(3, a.getA());
+  assertEquals(undefined, b.getA());
+
+  b.setA(5);
+  assertEquals(3, a.getA());
+  assertEquals(5, b.getA());
+
+  assertThrows(() => a.getA.call(b), TypeError);
+  assertThrows(() => b.getA.call(a), TypeError);
+}
+
+{
+  let value = undefined;
+
+  new class {
+    #a = 1;
+    getA() { return this.#a; }
+
+    constructor() {
+      new class {
+        #a = 2;
+        constructor() {
+          value = this.#a;
+        }
+      }
+    }
+  }
+
+  assertEquals(2, value);
+}
+
+{
+  class A {
+    #a = 1;
+    b = class {
+      getA() { return this.#a; }
+      get_A(val) { return val.#a; }
+    }
+  }
+
+  let a = new A();
+  let b = new a.b;
+  assertEquals(1, b.getA.call(a));
+  assertEquals(1, b.get_A(a));
+}
+
+{
+  class C {
+    b = this.#a;
+    #a = 1;
+  }
+
+  assertThrows(() => new C, TypeError);
+}
+
+{
+  class C {
+    #b = this.#a;
+    #a = 1;
+  }
+
+  assertThrows(() => new C, TypeError);
+}
+
+{
+  let symbol = Symbol();
+
+  class C {
+    #a = 1;
+    [symbol] = 1;
+    getA() { return this.#a; }
+    setA(val) { this.#a = val; }
+  }
+
+  var p = new Proxy(new C, {
+    get: function(target, name) {
+      if (typeof(arg) === 'symbol') {
+        assertFalse(%SymbolIsPrivate(name));
+      }
+      return target[name];
+    }
+  });
+
+  assertThrows(() => p.getA(), TypeError);
+  assertThrows(() => p.setA(1), TypeError);
+  assertEquals(1, p[symbol]);
+}
+
+{
+  class C {
+    #b = Object.freeze(this);
+    #a = 1;
+    getA() { return this.#a; }
+  }
+
+  let c = new C;
+  assertEquals(1, c.getA());
+}
+
+{
+  class C {
+    #a = 1;
+    setA(another, val) { another.#a = val; }
+    getA(another) { return another.#a; }
+  }
+
+  let c = new C;
+  assertThrows(() => c.setA({}, 2), TypeError);
+  c.setA(c, 3);
+  assertEquals(3, c.getA(c));
+}
+
+{
+  class A {
+    constructor(arg) {
+      return arg;
+    }
+  }
+
+  class C extends A {
+    #x = 1;
+
+    constructor(arg) {
+      super(arg);
+    }
+
+    getX(arg) {
+      return arg.#x;
+    }
+  }
+
+  let leaker = new Proxy({}, {});
+  let c = new C(leaker);
+  assertEquals(1, C.prototype.getX(leaker));
+  assertSame(c, leaker);
+
+  c = new C();
+  assertThrows(() => new C(c), TypeError);
+
+  new C(1);
+}
+
+{
+  class C {
+    #a = 1;
+    b;
+    getA() { return this.b().#a; }
+  }
+
+  let c = new C();
+  c.b = () => c;
+  assertEquals(1, c.getA());
+}
+
+{
+  class C {
+    #a = 1;
+    b;
+    getA(arg) { return arg.b().#a; }
+  }
+
+  let c = new C();
+  c.b = () => c;
+  assertEquals(1, c.getA(c));
+}
+
+{
+  class C {
+    #a = 1;
+    getA() { return eval('this.#a'); }
+  }
+
+  let c = new C;
+  assertEquals(1, c.getA());
+}
+
+{
+  var C;
+  eval('C = class {#a = 1;getA() { return eval(\'this.#a\'); }}');
+
+  let c = new C;
+  assertEquals(1, c.getA());
+}
+
+{
+  class C {
+    #a = 1;
+    getA() { return this.#a; }
+    setA() { eval('this.#a = 4'); }
+  }
+  let c = new C;
+  assertEquals(1, c.getA());
+  c.setA();
+  assertEquals(4, c.getA());
+}
+
+{
+  class C {
+    getA() { return eval('this.#a'); }
+  }
+
+  let c = new C;
+  assertThrows(() => c.getA(), SyntaxError);
+}
diff --git a/src/v8/test/mjsunit/harmony/private-methods.js b/src/v8/test/mjsunit/harmony/private-methods.js
new file mode 100644
index 0000000..360b065
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/private-methods.js
@@ -0,0 +1,283 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-private-methods
+
+"use strict";
+
+// Basic private method test
+{
+  let calledWith;
+  class C {
+    #a(arg) { calledWith = arg; }
+    callA(arg) { this.#a(arg); }
+  }
+
+  const c = new C;
+  assertEquals(undefined, c.a);
+  assertEquals(undefined, calledWith);
+  c.callA(1);
+  assertEquals(1, calledWith);
+}
+
+// Call private method in another instance
+{
+  class C {
+    #a(arg) { this.calledWith = arg; }
+    callAIn(obj, arg) { obj.#a(arg); }
+  }
+
+  const c = new C;
+  const c2 = new C;
+
+  assertEquals(undefined, c.a);
+  assertEquals(undefined, c.calledWith);
+  assertEquals(undefined, c2.calledWith);
+
+  c2.callAIn(c, 'fromC2');
+  assertEquals('fromC2', c.calledWith);
+  assertEquals(undefined, c2.calledWith);
+
+  c2.callAIn(c2, 'c2');
+  assertEquals('fromC2', c.calledWith);
+  assertEquals('c2', c2.calledWith);
+
+  assertThrows(() => { c2.callAIn({}); }, TypeError);
+}
+
+// Private methods and private fields
+{
+  class C {
+    #a;
+    constructor(a) {
+      this.#a = a;
+    }
+    #getAPlus1() {
+      return this.#a + 1;
+    }
+    equals(obj) {
+      return this.#getAPlus1() === obj.#getAPlus1();
+    }
+  }
+  const c = new C(0);
+  const c2 = new C(2);
+  const c3 = new C(2);
+  assertEquals(true, c2.equals(c3));
+  assertEquals(false, c2.equals(c));
+  assertEquals(false, c3.equals(c));
+}
+
+// Class inheritance
+{
+  class A {
+    #val;
+    constructor(a) {
+      this.#val = a;
+    }
+    #a() { return this.#val; }
+    getA() { return this.#a(); }
+  }
+  class B extends A {
+    constructor(b) {
+      super(b);
+    }
+    b() { return this.getA() }
+  }
+  const b = new B(1);
+  assertEquals(1, b.b());
+}
+
+// Private members should be accessed according to the class the
+// invoked method is in.
+{
+  class A {
+    #val;
+    constructor(a) {
+      this.#val = a;
+    }
+    #getVal() { return this.#val; }
+    getA() { return this.#getVal(); }
+    getVal() { return this.#getVal(); }
+  }
+
+  class B extends A {
+    #val;
+    constructor(a, b) {
+      super(a);
+      this.#val = b;
+    }
+    #getVal() { return this.#val; }
+    getB() { return this.#getVal(); }
+    getVal() { return this.#getVal(); }
+  }
+
+  const b = new B(1, 2);
+  assertEquals(1, b.getA());
+  assertEquals(2, b.getB());
+  assertEquals(1, A.prototype.getVal.call(b));
+  assertEquals(2, B.prototype.getVal.call(b));
+  const a = new A(1);
+  assertEquals(1, a.getA());
+  assertThrows(() => B.prototype.getB.call(a), TypeError);
+}
+
+// Private methods in nested classes.
+{
+  class C {
+    #b() {
+      class B {
+        #foo(arg) { return arg; }
+        callFoo(arg) { return this.#foo(arg); }
+      }
+      return new B();
+    }
+    createB() { return this.#b(); }
+  }
+  const c = new C;
+  const b = c.createB();
+  assertEquals(1, b.callFoo(1));
+}
+
+// Private methods in nested classes with inheritance.
+{
+  class C {
+    #b() {
+      class B extends C {
+        #foo(arg) { return arg; }
+        callFoo(arg) { return this.#foo(arg); }
+      }
+      return new B();
+    }
+    createB() { return this.#b(); }
+  }
+
+  const c = new C;
+  const b = c.createB();
+  assertEquals(1, b.callFoo(1));
+  const b2 = b.createB();
+  assertEquals(1, b2.callFoo(1));
+}
+
+// Class expressions.
+{
+  const C = class {
+    #a() { return 1; }
+    callA(obj) { return obj.#a() }
+  };
+  const c = new C;
+  const c2 = new C;
+  assertEquals(1, c.callA(c));
+  assertEquals(1, c.callA(c2));
+}
+
+// Nested class expressions.
+{
+  const C = class {
+    #b() {
+      const B = class {
+        #foo(arg) { return arg; }
+        callFoo(arg) { return this.#foo(arg); }
+      };
+      return new B();
+    }
+    createB() { return this.#b(); }
+  };
+
+  const c = new C;
+  const b = c.createB();
+  assertEquals(1, b.callFoo(1));
+}
+
+
+// Nested class expressions with hierarchy.
+{
+  const C = class {
+    #b() {
+      const B = class extends C {
+        #foo(arg) { return arg; }
+        callFoo(arg) { return this.#foo(arg); }
+      }
+      return new B();
+    }
+    createB() { return this.#b(); }
+  }
+
+  const c = new C;
+  const b = c.createB();
+  assertEquals(1, b.callFoo(1));
+  const b2 = b.createB();
+  assertEquals(1, b2.callFoo(1));
+}
+
+// Adding the brand twice on the same object should throw.
+{
+  class A {
+    constructor(arg) {
+      return arg;
+    }
+  }
+
+  class C extends A {
+    #x() { }
+
+    constructor(arg) {
+      super(arg);
+    }
+  }
+
+  let c1 = new C({});
+  assertThrows(() => new C(c1), TypeError);
+}
+
+// Private methods should be not visible to proxies.
+{
+  class X {
+    #x() {}
+    x() { this.#x(); };
+    callX(obj) { obj.#x(); }
+  }
+  let handlerCalled = false;
+  const x = new X();
+  let p = new Proxy(new X, {
+    apply(target, thisArg, argumentsList) {
+      handlerCalled = true;
+      Reflect.apply(target, thisArg, argumentsList);
+    }
+  });
+  assertThrows(() => p.x(), TypeError);
+  assertThrows(() => x.callX(p), TypeError);
+  assertThrows(() => X.prototype.x.call(p), TypeError);
+  assertThrows(() => X.prototype.callX(p), TypeError);
+  assertEquals(false, handlerCalled);
+}
+
+// Reference outside of class.
+{
+  class C {
+    #a() {}
+  }
+  assertThrows('new C().#a()');
+}
+
+// Duplicate private names.
+{
+  assertThrows('class C { #a = 1; #a() {} }');
+}
+
+{
+  // TODO(v8:9177): test extending a class expression that does not have
+  // a private method.
+  class D extends class {
+    #c() {}
+  } {
+    #d() {}
+  }
+
+  class E extends D {
+    #e() {}
+  }
+
+  new D;
+  new E;
+}
diff --git a/src/v8/test/mjsunit/harmony/private.js b/src/v8/test/mjsunit/harmony/private.js
index 39376f3..c4306c5 100644
--- a/src/v8/test/mjsunit/harmony/private.js
+++ b/src/v8/test/mjsunit/harmony/private.js
@@ -57,8 +57,6 @@
     assertEquals("symbol", typeof symbols[i])
     assertTrue(typeof symbols[i] === "symbol")
     assertTrue(%SymbolIsPrivate(symbols[i]))
-    assertEquals(null, %_ClassOf(symbols[i]))
-    assertEquals("Symbol", %_ClassOf(Object(symbols[i])))
   }
 }
 TestType()
diff --git a/src/v8/test/mjsunit/harmony/promise-all-settled.js b/src/v8/test/mjsunit/harmony/promise-all-settled.js
new file mode 100644
index 0000000..18d1882
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/promise-all-settled.js
@@ -0,0 +1,259 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-promise-all-settled
+
+class MyError extends Error {}
+
+const descriptor = Object.getOwnPropertyDescriptor(Promise, "allSettled");
+assertTrue(descriptor.configurable);
+assertTrue(descriptor.writable);
+assertFalse(descriptor.enumerable);
+
+// 1. Let C be the this value.
+// 2. If Type(C) is not Object, throw a TypeError exception.
+assertThrows(() => Promise.allSettled.call(1), TypeError);
+
+{
+  // 3. Let promiseCapability be ? NewPromiseCapability(C).
+  let called = false;
+  class MyPromise extends Promise {
+    constructor(...args) {
+      called = true;
+      super(...args);
+    }
+  }
+
+  MyPromise.allSettled([]);
+  assertTrue(called);
+}
+
+{
+  // 4. Let iteratorRecord be GetIterator(iterable).
+  // 5. IfAbruptRejectPromise(iteratorRecord, promiseCapability).
+  let caught = false;
+  (async function() {
+    class MyError extends Error {}
+    let err;
+
+    try {
+      await Promise.allSettled({
+        [Symbol.iterator]() {
+          throw new MyError();
+        }
+      });
+    } catch (e) {
+      assertTrue(e instanceof MyError);
+      caught = true;
+    }
+  })();
+
+  %PerformMicrotaskCheckpoint();
+  assertTrue(caught);
+}
+
+{
+  // 6. a. Let next be IteratorStep(iteratorRecord).
+  let iteratorStep = false;
+  (async function() {
+    try {
+      await Promise.allSettled({
+        [Symbol.iterator]() {
+          return {
+            next() {
+              iteratorStep = true;
+              return { done: true }
+            }
+          };
+        }
+      });
+    } catch (e) {
+      %AbortJS(e.stack);
+    }
+  })();
+
+  %PerformMicrotaskCheckpoint();
+  assertTrue(iteratorStep);
+}
+
+{
+  // 6. a. Let next be IteratorStep(iteratorRecord).
+  // 6. b. If next is an abrupt completion, set iteratorRecord.[[Done]] to true.
+  // 6. c. ReturnIfAbrupt(next).
+  let caught = false;
+  (async function() {
+    try {
+      await Promise.allSettled({
+        [Symbol.iterator]() {
+          return {
+            next() {
+              throw new MyError();
+            }
+          };
+        }
+      });
+    } catch (e) {
+      assertTrue(e instanceof MyError);
+      caught = true;
+    }
+  })();
+
+  %PerformMicrotaskCheckpoint();
+  assertTrue(caught);
+}
+
+{
+  // 6. e. Let nextValue be IteratorValue(next).
+  let iteratorValue = false;
+  (async function() {
+    try {
+      await Promise.allSettled({
+        [Symbol.iterator]() {
+          let done = false;
+
+          return {
+            next() {
+              let result = { value: 1, done };
+              iteratorValue = true;
+              done = true;
+              return result;
+            }
+          };
+        }
+      });
+    } catch (e) {
+      %AbortJS(e.stack);
+    }
+  })();
+
+  %PerformMicrotaskCheckpoint();
+  assertTrue(iteratorValue);
+}
+
+{
+  // 6. e. Let nextValue be IteratorValue(next).
+  // 6. f. If nextValue is an abrupt completion, set iteratorRecord.[[Done]] to true.
+  // 6. g. ReturnIfAbrupt(nextValue).
+  let caught = false;
+  (async function() {
+    try {
+      await Promise.allSettled({
+        [Symbol.iterator]() {
+          let done = false;
+
+          return {
+            next() {
+              return result = {
+                get value() {throw new MyError(''); },
+                done: false
+              };
+            }
+          };
+        }
+      });
+    } catch (e) {
+      assertTrue(e instanceof MyError);
+      caught = true;
+    }
+  })();
+
+  %PerformMicrotaskCheckpoint();
+  assertTrue(caught);
+}
+
+{
+  // TODO(mathias): https://github.com/tc39/proposal-promise-allSettled/pull/40
+  // 6. i. Let nextPromise be ? Invoke(constructor, "resolve", « nextValue »).
+  let called = false;
+  class MyPromise extends Promise {
+    static resolve(...args) {
+      called = true;
+      super.resolve(...args);
+    }
+  }
+
+  MyPromise.allSettled([1]);
+  assertTrue(called);
+}
+
+{
+  // 6. z. Perform ? Invoke(nextPromise, "then", « resolveElement, rejectElement »).
+  let called = false;
+  class MyPromise extends Promise {
+    then(...args) {
+      called = true;
+      super.resolve(...args);
+    }
+  }
+
+  MyPromise.allSettled([1]);
+  assertTrue(called);
+}
+
+{
+  let called = false;
+  let result;
+  Promise.allSettled([]).then(x => {
+    called = true;
+    result = x;
+  });
+
+  %PerformMicrotaskCheckpoint();
+  assertTrue(called);
+  assertEquals(result, []);
+}
+
+{
+  let called = false;
+  Promise.allSettled([Promise.resolve("foo")]).then(v => {
+    assertEquals(v.length, 1);
+    const [x] = v;
+
+    assertSame(Object.getPrototypeOf(x), Object.getPrototypeOf({}));
+    const descs = Object.getOwnPropertyDescriptors(x);
+    assertEquals(Object.keys(descs).length, 2);
+
+    const { value: desc } = descs;
+    assertTrue(desc.writable);
+    assertTrue(desc.enumerable);
+    assertTrue(desc.configurable);
+
+    assertEquals(x.value, "foo");
+    assertEquals(x.status, "fulfilled");
+    called = true;
+  });
+
+  %PerformMicrotaskCheckpoint();
+  assertTrue(called);
+}
+
+{
+  let called = false;
+  Promise.allSettled([Promise.reject("foo")]).then(v => {
+    assertEquals(v.length, 1);
+    const [x] = v;
+    assertEquals(x.reason, "foo");
+    assertEquals(x.status, "rejected");
+    called = true;
+  });
+
+  %PerformMicrotaskCheckpoint();
+  assertTrue(called);
+}
+
+{
+  let called = false;
+  Promise.allSettled([Promise.resolve("bar"), Promise.reject("foo")]).then(v => {
+    assertEquals(v.length, 2);
+    const [x, y] = v;
+    assertEquals(x.value, "bar");
+    assertEquals(x.status, "fulfilled");
+    assertEquals(y.reason, "foo");
+    assertEquals(y.status, "rejected");
+    called = true;
+  });
+
+  %PerformMicrotaskCheckpoint();
+  assertTrue(called);
+}
diff --git a/src/v8/test/mjsunit/harmony/promise-prototype-finally.js b/src/v8/test/mjsunit/harmony/promise-prototype-finally.js
index 4e91f2e..b545650 100644
--- a/src/v8/test/mjsunit/harmony/promise-prototype-finally.js
+++ b/src/v8/test/mjsunit/harmony/promise-prototype-finally.js
@@ -2,7 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-promise-finally --allow-natives-syntax
+// Flags: --allow-natives-syntax
+
+load('test/mjsunit/test-async.js');
 
 assertThrows(() => Promise.prototype.finally.call(5), TypeError);
 
diff --git a/src/v8/test/mjsunit/harmony/public-instance-class-fields.js b/src/v8/test/mjsunit/harmony/public-instance-class-fields.js
index a82a0ac..8ab1e31 100644
--- a/src/v8/test/mjsunit/harmony/public-instance-class-fields.js
+++ b/src/v8/test/mjsunit/harmony/public-instance-class-fields.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-public-fields
 "use strict";
 
 {
@@ -507,7 +506,7 @@
   }
 
   assertThrows(() => new C1, ReferenceError);
-  assertEquals([1,1], log);
+  assertEquals([1], log);
 
   log = [];
   class C2 extends class {} {
@@ -520,7 +519,7 @@
   }
 
   assertThrows(() => new C2, ReferenceError);
-  assertEquals([1,1], log);
+  assertEquals([1], log);
 }
 
 {
@@ -696,3 +695,21 @@
   let x = new X;
   assertEquals(1, x.p);
 }
+
+{
+  let thisInInitializer, thisInConstructor, thisFromArrowFn, arrowFn;
+  let C = class extends class {} {
+    field = (thisInInitializer = this, thisFromArrowFn = arrowFn());
+    constructor() {
+      arrowFn = () => this;
+      super();
+      thisInConstructor = this;
+    }
+  };
+
+  let c = new C();
+
+  assertSame(thisInInitializer, c);
+  assertSame(thisFromArrowFn, c);
+  assertSame(thisInConstructor, c);
+}
diff --git a/src/v8/test/mjsunit/harmony/public-static-class-fields.js b/src/v8/test/mjsunit/harmony/public-static-class-fields.js
index 3de3e2d..0c7a3e5 100644
--- a/src/v8/test/mjsunit/harmony/public-static-class-fields.js
+++ b/src/v8/test/mjsunit/harmony/public-static-class-fields.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-public-fields --harmony-static-fields
-
 "use strict";
 
 {
@@ -457,3 +455,16 @@
 
   assertEquals(1, X.p);
 }
+
+{
+  let p = { z: class { static y = this.name } }
+  assertEquals(p.z.y, 'z');
+
+  let q = { ["z"]: class { static y = this.name } }
+  assertEquals(q.z.y, 'z');
+
+  const C = class {
+    static x = this.name;
+  }
+  assertEquals(C.x, 'C');
+}
diff --git a/src/v8/test/mjsunit/harmony/regexp-named-captures.js b/src/v8/test/mjsunit/harmony/regexp-named-captures.js
index 72041b9..e1fa60d 100644
--- a/src/v8/test/mjsunit/harmony/regexp-named-captures.js
+++ b/src/v8/test/mjsunit/harmony/regexp-named-captures.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-named-captures --allow-natives-syntax
+// Flags: --allow-natives-syntax
 
 // Malformed named captures.
 assertThrows("/(?<>a)/u", SyntaxError);  // Empty name.
@@ -425,7 +425,7 @@
 {
   const re = /./;
   const result = re.exec("a");
-  assertTrue(%SpeciesProtector());
+  assertTrue(%ArraySpeciesProtector());
   assertEquals(result.__proto__, Array.prototype);
   assertTrue(result.hasOwnProperty('groups'));
   assertArrayEquals(["a"], result);
@@ -433,7 +433,7 @@
   assertEquals(undefined, result.groups);
 
   Array.prototype.groups = { a: "b" };
-  assertTrue(%SpeciesProtector());
+  assertTrue(%ArraySpeciesProtector());
   assertEquals("$<a>", "a".replace(re, "$<a>"));
   Array.prototype.groups = undefined;
 }
@@ -441,7 +441,7 @@
 {
   const re = toSlowMode(/./);
   const result = re.exec("a");
-  assertTrue(%SpeciesProtector());
+  assertTrue(%ArraySpeciesProtector());
   assertEquals(result.__proto__, Array.prototype);
   assertTrue(result.hasOwnProperty('groups'));
   assertArrayEquals(["a"], result);
@@ -449,7 +449,7 @@
   assertEquals(undefined, result.groups);
 
   Array.prototype.groups = { a: "b" };
-  assertTrue(%SpeciesProtector());
+  assertTrue(%ArraySpeciesProtector());
   assertEquals("$<a>", "a".replace(re, "$<a>"));
   Array.prototype.groups = undefined;
 }
@@ -457,7 +457,7 @@
 {
   const re = /(?<a>a).|(?<x>x)/;
   const result = re.exec("ab");
-  assertTrue(%SpeciesProtector());
+  assertTrue(%ArraySpeciesProtector());
   assertEquals(result.__proto__, Array.prototype);
   assertTrue(result.hasOwnProperty('groups'));
   assertArrayEquals(["ab", "a", undefined], result);
@@ -467,7 +467,7 @@
   // a is a matched named capture, b is an unmatched named capture, and z
   // is not a named capture.
   Array.prototype.groups = { a: "b", x: "y", z: "z" };
-  assertTrue(%SpeciesProtector());
+  assertTrue(%ArraySpeciesProtector());
   assertEquals("a", "ab".replace(re, "$<a>"));
   assertEquals("", "ab".replace(re, "$<x>"));
   assertEquals("", "ab".replace(re, "$<z>"));
@@ -477,7 +477,7 @@
 {
   const re = toSlowMode(/(?<a>a).|(?<x>x)/);
   const result = re.exec("ab");
-  assertTrue(%SpeciesProtector());
+  assertTrue(%ArraySpeciesProtector());
   assertEquals(result.__proto__, Array.prototype);
   assertTrue(result.hasOwnProperty('groups'));
   assertArrayEquals(["ab", "a", undefined], result);
@@ -487,7 +487,7 @@
   // a is a matched named capture, b is an unmatched named capture, and z
   // is not a named capture.
   Array.prototype.groups = { a: "b", x: "y", z: "z" };
-  assertTrue(%SpeciesProtector());
+  assertTrue(%ArraySpeciesProtector());
   assertEquals("a", "ab".replace(re, "$<a>"));
   assertEquals("", "ab".replace(re, "$<x>"));
   assertEquals("", "ab".replace(re, "$<z>"));
@@ -506,13 +506,13 @@
 
   const re = new FakeRegExp();
   const result = re.exec("ab");
-  assertTrue(%SpeciesProtector());
+  assertTrue(%ArraySpeciesProtector());
   assertEquals(result.__proto__, Array.prototype);
   assertFalse(result.hasOwnProperty('groups'));
 
   Array.prototype.groups = { a: "b" };
   Array.prototype.groups.__proto__.b = "c";
-  assertTrue(%SpeciesProtector());
+  assertTrue(%ArraySpeciesProtector());
   assertEquals("b", "ab".replace(re, "$<a>"));
   assertEquals("c", "ab".replace(re, "$<b>"));
   Array.prototype.groups = undefined;
@@ -531,7 +531,7 @@
 
   const re = new FakeRegExp();
   const result = re.exec("ab");
-  assertTrue(%SpeciesProtector());
+  assertTrue(%ArraySpeciesProtector());
   assertEquals(result.__proto__, Array.prototype);
   assertTrue(result.hasOwnProperty('groups'));
   assertEquals({ a: "b" }, result.groups);
diff --git a/src/v8/test/mjsunit/harmony/regexp-overriden-exec.js b/src/v8/test/mjsunit/harmony/regexp-overriden-exec.js
new file mode 100644
index 0000000..7aba0ae
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/regexp-overriden-exec.js
@@ -0,0 +1,26 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-always-opt --opt
+
+const r = RegExp('bla');
+
+function foo() {
+  r.test('string');
+}
+
+%PrepareFunctionForOptimization(foo);
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
+assertOptimized(foo);
+
+r.__proto__.exec = function() {
+  return null;
+}
+Object.freeze(r.__proto__);
+
+foo();
+assertUnoptimized(foo);
diff --git a/src/v8/test/mjsunit/harmony/regexp-property-binary.js b/src/v8/test/mjsunit/harmony/regexp-property-binary.js
index d0c4dc5..793e6ac 100644
--- a/src/v8/test/mjsunit/harmony/regexp-property-binary.js
+++ b/src/v8/test/mjsunit/harmony/regexp-property-binary.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
-
 function t(re, s) { assertTrue(re.test(s)); }
 function f(re, s) { assertFalse(re.test(s)); }
 
diff --git a/src/v8/test/mjsunit/harmony/regexp-property-char-class.js b/src/v8/test/mjsunit/harmony/regexp-property-char-class.js
index 1de8acb..7a64a9e 100644
--- a/src/v8/test/mjsunit/harmony/regexp-property-char-class.js
+++ b/src/v8/test/mjsunit/harmony/regexp-property-char-class.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
-
 assertThrows("/[\\p]/u");
 assertThrows("/[\\p{garbage}]/u");
 assertThrows("/[\\p{}]/u");
diff --git a/src/v8/test/mjsunit/harmony/regexp-property-emoji-flag-sequence-generated.js b/src/v8/test/mjsunit/harmony/regexp-property-emoji-flag-sequence-generated.js
new file mode 100644
index 0000000..1de0a48
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/regexp-property-emoji-flag-sequence-generated.js
@@ -0,0 +1,270 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-regexp-sequence
+
+// These tests have been generated by the script at
+// https://gist.github.com/mathiasbynens/3b42c99a227521dabfe68d9e63f00f42.
+// Do not modify this file directly!
+
+const re = /\p{Emoji_Flag_Sequence}/u;
+
+assertTrue(re.test('\u{1F1E6}\u{1F1E8}'));
+assertTrue(re.test('\u{1F1FF}\u{1F1FC}'));
+assertTrue(re.test('\u{1F1E6}\u{1F1EA}'));
+assertTrue(re.test('\u{1F1E6}\u{1F1EB}'));
+assertTrue(re.test('\u{1F1E6}\u{1F1EC}'));
+assertTrue(re.test('\u{1F1E6}\u{1F1EE}'));
+assertTrue(re.test('\u{1F1E6}\u{1F1F1}'));
+assertTrue(re.test('\u{1F1E6}\u{1F1F2}'));
+assertTrue(re.test('\u{1F1E6}\u{1F1F4}'));
+assertTrue(re.test('\u{1F1E6}\u{1F1F6}'));
+assertTrue(re.test('\u{1F1E6}\u{1F1F7}'));
+assertTrue(re.test('\u{1F1E6}\u{1F1F8}'));
+assertTrue(re.test('\u{1F1E6}\u{1F1F9}'));
+assertTrue(re.test('\u{1F1E6}\u{1F1FA}'));
+assertTrue(re.test('\u{1F1E6}\u{1F1FC}'));
+assertTrue(re.test('\u{1F1E6}\u{1F1FD}'));
+assertTrue(re.test('\u{1F1E6}\u{1F1FF}'));
+assertTrue(re.test('\u{1F1E7}\u{1F1E6}'));
+assertTrue(re.test('\u{1F1E7}\u{1F1E7}'));
+assertTrue(re.test('\u{1F1E7}\u{1F1E9}'));
+assertTrue(re.test('\u{1F1E7}\u{1F1EA}'));
+assertTrue(re.test('\u{1F1E7}\u{1F1EB}'));
+assertTrue(re.test('\u{1F1E7}\u{1F1EC}'));
+assertTrue(re.test('\u{1F1E7}\u{1F1ED}'));
+assertTrue(re.test('\u{1F1E7}\u{1F1EE}'));
+assertTrue(re.test('\u{1F1E7}\u{1F1EF}'));
+assertTrue(re.test('\u{1F1E7}\u{1F1F1}'));
+assertTrue(re.test('\u{1F1E7}\u{1F1F2}'));
+assertTrue(re.test('\u{1F1E7}\u{1F1F3}'));
+assertTrue(re.test('\u{1F1E7}\u{1F1F4}'));
+assertTrue(re.test('\u{1F1E7}\u{1F1F6}'));
+assertTrue(re.test('\u{1F1E7}\u{1F1F7}'));
+assertTrue(re.test('\u{1F1E7}\u{1F1F8}'));
+assertTrue(re.test('\u{1F1E7}\u{1F1F9}'));
+assertTrue(re.test('\u{1F1E7}\u{1F1FB}'));
+assertTrue(re.test('\u{1F1E7}\u{1F1FC}'));
+assertTrue(re.test('\u{1F1E7}\u{1F1FE}'));
+assertTrue(re.test('\u{1F1E7}\u{1F1FF}'));
+assertTrue(re.test('\u{1F1E8}\u{1F1E6}'));
+assertTrue(re.test('\u{1F1E8}\u{1F1E8}'));
+assertTrue(re.test('\u{1F1E8}\u{1F1E9}'));
+assertTrue(re.test('\u{1F1E8}\u{1F1EB}'));
+assertTrue(re.test('\u{1F1E8}\u{1F1EC}'));
+assertTrue(re.test('\u{1F1E8}\u{1F1ED}'));
+assertTrue(re.test('\u{1F1E8}\u{1F1EE}'));
+assertTrue(re.test('\u{1F1E8}\u{1F1F0}'));
+assertTrue(re.test('\u{1F1E8}\u{1F1F1}'));
+assertTrue(re.test('\u{1F1E8}\u{1F1F2}'));
+assertTrue(re.test('\u{1F1E8}\u{1F1F3}'));
+assertTrue(re.test('\u{1F1E8}\u{1F1F4}'));
+assertTrue(re.test('\u{1F1E8}\u{1F1F5}'));
+assertTrue(re.test('\u{1F1E8}\u{1F1F7}'));
+assertTrue(re.test('\u{1F1E8}\u{1F1FA}'));
+assertTrue(re.test('\u{1F1E8}\u{1F1FB}'));
+assertTrue(re.test('\u{1F1E8}\u{1F1FC}'));
+assertTrue(re.test('\u{1F1E8}\u{1F1FD}'));
+assertTrue(re.test('\u{1F1E8}\u{1F1FE}'));
+assertTrue(re.test('\u{1F1E8}\u{1F1FF}'));
+assertTrue(re.test('\u{1F1E9}\u{1F1EA}'));
+assertTrue(re.test('\u{1F1E9}\u{1F1EC}'));
+assertTrue(re.test('\u{1F1E9}\u{1F1EF}'));
+assertTrue(re.test('\u{1F1E9}\u{1F1F0}'));
+assertTrue(re.test('\u{1F1E9}\u{1F1F2}'));
+assertTrue(re.test('\u{1F1E9}\u{1F1F4}'));
+assertTrue(re.test('\u{1F1E9}\u{1F1FF}'));
+assertTrue(re.test('\u{1F1EA}\u{1F1E6}'));
+assertTrue(re.test('\u{1F1EA}\u{1F1E8}'));
+assertTrue(re.test('\u{1F1EA}\u{1F1EA}'));
+assertTrue(re.test('\u{1F1EA}\u{1F1EC}'));
+assertTrue(re.test('\u{1F1EA}\u{1F1ED}'));
+assertTrue(re.test('\u{1F1EA}\u{1F1F7}'));
+assertTrue(re.test('\u{1F1EA}\u{1F1F8}'));
+assertTrue(re.test('\u{1F1EA}\u{1F1F9}'));
+assertTrue(re.test('\u{1F1EA}\u{1F1FA}'));
+assertTrue(re.test('\u{1F1EB}\u{1F1EE}'));
+assertTrue(re.test('\u{1F1EB}\u{1F1EF}'));
+assertTrue(re.test('\u{1F1EB}\u{1F1F0}'));
+assertTrue(re.test('\u{1F1EB}\u{1F1F2}'));
+assertTrue(re.test('\u{1F1EB}\u{1F1F4}'));
+assertTrue(re.test('\u{1F1EB}\u{1F1F7}'));
+assertTrue(re.test('\u{1F1EC}\u{1F1E6}'));
+assertTrue(re.test('\u{1F1EC}\u{1F1E7}'));
+assertTrue(re.test('\u{1F1EC}\u{1F1E9}'));
+assertTrue(re.test('\u{1F1EC}\u{1F1EA}'));
+assertTrue(re.test('\u{1F1EC}\u{1F1EB}'));
+assertTrue(re.test('\u{1F1EC}\u{1F1EC}'));
+assertTrue(re.test('\u{1F1EC}\u{1F1ED}'));
+assertTrue(re.test('\u{1F1EC}\u{1F1EE}'));
+assertTrue(re.test('\u{1F1EC}\u{1F1F1}'));
+assertTrue(re.test('\u{1F1EC}\u{1F1F2}'));
+assertTrue(re.test('\u{1F1EC}\u{1F1F3}'));
+assertTrue(re.test('\u{1F1EC}\u{1F1F5}'));
+assertTrue(re.test('\u{1F1EC}\u{1F1F6}'));
+assertTrue(re.test('\u{1F1EC}\u{1F1F7}'));
+assertTrue(re.test('\u{1F1EC}\u{1F1F8}'));
+assertTrue(re.test('\u{1F1EC}\u{1F1F9}'));
+assertTrue(re.test('\u{1F1EC}\u{1F1FA}'));
+assertTrue(re.test('\u{1F1EC}\u{1F1FC}'));
+assertTrue(re.test('\u{1F1EC}\u{1F1FE}'));
+assertTrue(re.test('\u{1F1ED}\u{1F1F0}'));
+assertTrue(re.test('\u{1F1ED}\u{1F1F2}'));
+assertTrue(re.test('\u{1F1ED}\u{1F1F3}'));
+assertTrue(re.test('\u{1F1ED}\u{1F1F7}'));
+assertTrue(re.test('\u{1F1ED}\u{1F1F9}'));
+assertTrue(re.test('\u{1F1ED}\u{1F1FA}'));
+assertTrue(re.test('\u{1F1EE}\u{1F1E8}'));
+assertTrue(re.test('\u{1F1EE}\u{1F1E9}'));
+assertTrue(re.test('\u{1F1EE}\u{1F1EA}'));
+assertTrue(re.test('\u{1F1EE}\u{1F1F1}'));
+assertTrue(re.test('\u{1F1EE}\u{1F1F2}'));
+assertTrue(re.test('\u{1F1EE}\u{1F1F3}'));
+assertTrue(re.test('\u{1F1EE}\u{1F1F4}'));
+assertTrue(re.test('\u{1F1EE}\u{1F1F6}'));
+assertTrue(re.test('\u{1F1EE}\u{1F1F7}'));
+assertTrue(re.test('\u{1F1EE}\u{1F1F8}'));
+assertTrue(re.test('\u{1F1EE}\u{1F1F9}'));
+assertTrue(re.test('\u{1F1EF}\u{1F1EA}'));
+assertTrue(re.test('\u{1F1EF}\u{1F1F2}'));
+assertTrue(re.test('\u{1F1EF}\u{1F1F4}'));
+assertTrue(re.test('\u{1F1EF}\u{1F1F5}'));
+assertTrue(re.test('\u{1F1F0}\u{1F1EA}'));
+assertTrue(re.test('\u{1F1F0}\u{1F1EC}'));
+assertTrue(re.test('\u{1F1F0}\u{1F1ED}'));
+assertTrue(re.test('\u{1F1F0}\u{1F1EE}'));
+assertTrue(re.test('\u{1F1F0}\u{1F1F2}'));
+assertTrue(re.test('\u{1F1F0}\u{1F1F3}'));
+assertTrue(re.test('\u{1F1F0}\u{1F1F5}'));
+assertTrue(re.test('\u{1F1F0}\u{1F1F7}'));
+assertTrue(re.test('\u{1F1F0}\u{1F1FC}'));
+assertTrue(re.test('\u{1F1E6}\u{1F1E9}'));
+assertTrue(re.test('\u{1F1F0}\u{1F1FF}'));
+assertTrue(re.test('\u{1F1F1}\u{1F1E6}'));
+assertTrue(re.test('\u{1F1F1}\u{1F1E7}'));
+assertTrue(re.test('\u{1F1F1}\u{1F1E8}'));
+assertTrue(re.test('\u{1F1F1}\u{1F1EE}'));
+assertTrue(re.test('\u{1F1F1}\u{1F1F0}'));
+assertTrue(re.test('\u{1F1F1}\u{1F1F7}'));
+assertTrue(re.test('\u{1F1F1}\u{1F1F8}'));
+assertTrue(re.test('\u{1F1F1}\u{1F1F9}'));
+assertTrue(re.test('\u{1F1F1}\u{1F1FA}'));
+assertTrue(re.test('\u{1F1F1}\u{1F1FB}'));
+assertTrue(re.test('\u{1F1F1}\u{1F1FE}'));
+assertTrue(re.test('\u{1F1F2}\u{1F1E6}'));
+assertTrue(re.test('\u{1F1F2}\u{1F1E8}'));
+assertTrue(re.test('\u{1F1F2}\u{1F1E9}'));
+assertTrue(re.test('\u{1F1F2}\u{1F1EA}'));
+assertTrue(re.test('\u{1F1F2}\u{1F1EB}'));
+assertTrue(re.test('\u{1F1F2}\u{1F1EC}'));
+assertTrue(re.test('\u{1F1F2}\u{1F1ED}'));
+assertTrue(re.test('\u{1F1F2}\u{1F1F0}'));
+assertTrue(re.test('\u{1F1F2}\u{1F1F1}'));
+assertTrue(re.test('\u{1F1F2}\u{1F1F2}'));
+assertTrue(re.test('\u{1F1F2}\u{1F1F3}'));
+assertTrue(re.test('\u{1F1F2}\u{1F1F4}'));
+assertTrue(re.test('\u{1F1F2}\u{1F1F5}'));
+assertTrue(re.test('\u{1F1F2}\u{1F1F6}'));
+assertTrue(re.test('\u{1F1F2}\u{1F1F7}'));
+assertTrue(re.test('\u{1F1F2}\u{1F1F8}'));
+assertTrue(re.test('\u{1F1F2}\u{1F1F9}'));
+assertTrue(re.test('\u{1F1F2}\u{1F1FA}'));
+assertTrue(re.test('\u{1F1F2}\u{1F1FB}'));
+assertTrue(re.test('\u{1F1F2}\u{1F1FC}'));
+assertTrue(re.test('\u{1F1F2}\u{1F1FD}'));
+assertTrue(re.test('\u{1F1F2}\u{1F1FE}'));
+assertTrue(re.test('\u{1F1F2}\u{1F1FF}'));
+assertTrue(re.test('\u{1F1F3}\u{1F1E6}'));
+assertTrue(re.test('\u{1F1F3}\u{1F1E8}'));
+assertTrue(re.test('\u{1F1F3}\u{1F1EA}'));
+assertTrue(re.test('\u{1F1F3}\u{1F1EB}'));
+assertTrue(re.test('\u{1F1F3}\u{1F1EC}'));
+assertTrue(re.test('\u{1F1F3}\u{1F1EE}'));
+assertTrue(re.test('\u{1F1F3}\u{1F1F1}'));
+assertTrue(re.test('\u{1F1F3}\u{1F1F4}'));
+assertTrue(re.test('\u{1F1F3}\u{1F1F5}'));
+assertTrue(re.test('\u{1F1F3}\u{1F1F7}'));
+assertTrue(re.test('\u{1F1F3}\u{1F1FA}'));
+assertTrue(re.test('\u{1F1F3}\u{1F1FF}'));
+assertTrue(re.test('\u{1F1F4}\u{1F1F2}'));
+assertTrue(re.test('\u{1F1F5}\u{1F1E6}'));
+assertTrue(re.test('\u{1F1F5}\u{1F1EA}'));
+assertTrue(re.test('\u{1F1F5}\u{1F1EB}'));
+assertTrue(re.test('\u{1F1F5}\u{1F1EC}'));
+assertTrue(re.test('\u{1F1F5}\u{1F1ED}'));
+assertTrue(re.test('\u{1F1F5}\u{1F1F0}'));
+assertTrue(re.test('\u{1F1F5}\u{1F1F1}'));
+assertTrue(re.test('\u{1F1F5}\u{1F1F2}'));
+assertTrue(re.test('\u{1F1F5}\u{1F1F3}'));
+assertTrue(re.test('\u{1F1F5}\u{1F1F7}'));
+assertTrue(re.test('\u{1F1F5}\u{1F1F8}'));
+assertTrue(re.test('\u{1F1F5}\u{1F1F9}'));
+assertTrue(re.test('\u{1F1F5}\u{1F1FC}'));
+assertTrue(re.test('\u{1F1F5}\u{1F1FE}'));
+assertTrue(re.test('\u{1F1F6}\u{1F1E6}'));
+assertTrue(re.test('\u{1F1F7}\u{1F1EA}'));
+assertTrue(re.test('\u{1F1F7}\u{1F1F4}'));
+assertTrue(re.test('\u{1F1F7}\u{1F1F8}'));
+assertTrue(re.test('\u{1F1F7}\u{1F1FA}'));
+assertTrue(re.test('\u{1F1F7}\u{1F1FC}'));
+assertTrue(re.test('\u{1F1F8}\u{1F1E6}'));
+assertTrue(re.test('\u{1F1F8}\u{1F1E7}'));
+assertTrue(re.test('\u{1F1F8}\u{1F1E8}'));
+assertTrue(re.test('\u{1F1F8}\u{1F1E9}'));
+assertTrue(re.test('\u{1F1F8}\u{1F1EA}'));
+assertTrue(re.test('\u{1F1F8}\u{1F1EC}'));
+assertTrue(re.test('\u{1F1F8}\u{1F1ED}'));
+assertTrue(re.test('\u{1F1F8}\u{1F1EE}'));
+assertTrue(re.test('\u{1F1F8}\u{1F1EF}'));
+assertTrue(re.test('\u{1F1F8}\u{1F1F0}'));
+assertTrue(re.test('\u{1F1F8}\u{1F1F1}'));
+assertTrue(re.test('\u{1F1F8}\u{1F1F2}'));
+assertTrue(re.test('\u{1F1F8}\u{1F1F3}'));
+assertTrue(re.test('\u{1F1F8}\u{1F1F4}'));
+assertTrue(re.test('\u{1F1F8}\u{1F1F7}'));
+assertTrue(re.test('\u{1F1F8}\u{1F1F8}'));
+assertTrue(re.test('\u{1F1F8}\u{1F1F9}'));
+assertTrue(re.test('\u{1F1F8}\u{1F1FB}'));
+assertTrue(re.test('\u{1F1F8}\u{1F1FD}'));
+assertTrue(re.test('\u{1F1F8}\u{1F1FE}'));
+assertTrue(re.test('\u{1F1F8}\u{1F1FF}'));
+assertTrue(re.test('\u{1F1F9}\u{1F1E6}'));
+assertTrue(re.test('\u{1F1F9}\u{1F1E8}'));
+assertTrue(re.test('\u{1F1F9}\u{1F1E9}'));
+assertTrue(re.test('\u{1F1F9}\u{1F1EB}'));
+assertTrue(re.test('\u{1F1F9}\u{1F1EC}'));
+assertTrue(re.test('\u{1F1F9}\u{1F1ED}'));
+assertTrue(re.test('\u{1F1F9}\u{1F1EF}'));
+assertTrue(re.test('\u{1F1F9}\u{1F1F0}'));
+assertTrue(re.test('\u{1F1F9}\u{1F1F1}'));
+assertTrue(re.test('\u{1F1F9}\u{1F1F2}'));
+assertTrue(re.test('\u{1F1F9}\u{1F1F3}'));
+assertTrue(re.test('\u{1F1F9}\u{1F1F4}'));
+assertTrue(re.test('\u{1F1F9}\u{1F1F7}'));
+assertTrue(re.test('\u{1F1F9}\u{1F1F9}'));
+assertTrue(re.test('\u{1F1F9}\u{1F1FB}'));
+assertTrue(re.test('\u{1F1F9}\u{1F1FC}'));
+assertTrue(re.test('\u{1F1F9}\u{1F1FF}'));
+assertTrue(re.test('\u{1F1FA}\u{1F1E6}'));
+assertTrue(re.test('\u{1F1FA}\u{1F1EC}'));
+assertTrue(re.test('\u{1F1FA}\u{1F1F2}'));
+assertTrue(re.test('\u{1F1FA}\u{1F1F3}'));
+assertTrue(re.test('\u{1F1FA}\u{1F1F8}'));
+assertTrue(re.test('\u{1F1FA}\u{1F1FE}'));
+assertTrue(re.test('\u{1F1FA}\u{1F1FF}'));
+assertTrue(re.test('\u{1F1FB}\u{1F1E6}'));
+assertTrue(re.test('\u{1F1FB}\u{1F1E8}'));
+assertTrue(re.test('\u{1F1FB}\u{1F1EA}'));
+assertTrue(re.test('\u{1F1FB}\u{1F1EC}'));
+assertTrue(re.test('\u{1F1FB}\u{1F1EE}'));
+assertTrue(re.test('\u{1F1FB}\u{1F1F3}'));
+assertTrue(re.test('\u{1F1FB}\u{1F1FA}'));
+assertTrue(re.test('\u{1F1FC}\u{1F1EB}'));
+assertTrue(re.test('\u{1F1FC}\u{1F1F8}'));
+assertTrue(re.test('\u{1F1FD}\u{1F1F0}'));
+assertTrue(re.test('\u{1F1FE}\u{1F1EA}'));
+assertTrue(re.test('\u{1F1FE}\u{1F1F9}'));
+assertTrue(re.test('\u{1F1FF}\u{1F1E6}'));
+assertTrue(re.test('\u{1F1FF}\u{1F1F2}'));
+assertTrue(re.test('\u{1F1F0}\u{1F1FE}'));
diff --git a/src/v8/test/mjsunit/harmony/regexp-property-emoji-keycap-sequence-generated.js b/src/v8/test/mjsunit/harmony/regexp-property-emoji-keycap-sequence-generated.js
new file mode 100644
index 0000000..2d72b47
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/regexp-property-emoji-keycap-sequence-generated.js
@@ -0,0 +1,24 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-regexp-sequence
+
+// These tests have been generated by the script at
+// https://gist.github.com/mathiasbynens/3b42c99a227521dabfe68d9e63f00f42.
+// Do not modify this file directly!
+
+const re = /\p{Emoji_Keycap_Sequence}/u;
+
+assertTrue(re.test('#\uFE0F\u20E3'));
+assertTrue(re.test('9\uFE0F\u20E3'));
+assertTrue(re.test('0\uFE0F\u20E3'));
+assertTrue(re.test('1\uFE0F\u20E3'));
+assertTrue(re.test('2\uFE0F\u20E3'));
+assertTrue(re.test('3\uFE0F\u20E3'));
+assertTrue(re.test('*\uFE0F\u20E3'));
+assertTrue(re.test('5\uFE0F\u20E3'));
+assertTrue(re.test('6\uFE0F\u20E3'));
+assertTrue(re.test('7\uFE0F\u20E3'));
+assertTrue(re.test('8\uFE0F\u20E3'));
+assertTrue(re.test('4\uFE0F\u20E3'));
diff --git a/src/v8/test/mjsunit/harmony/regexp-property-emoji-modifier-sequence-generated.js b/src/v8/test/mjsunit/harmony/regexp-property-emoji-modifier-sequence-generated.js
new file mode 100644
index 0000000..b990bf7
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/regexp-property-emoji-modifier-sequence-generated.js
@@ -0,0 +1,541 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-regexp-sequence
+
+// TODO(mathias): Update these tests once a Unicode 12-friendly ICU
+// version rolls into V8.
+
+const re = /\p{Emoji_Modifier_Sequence}/u;
+
+assertTrue(re.test('\u261D\u{1F3FB}'));
+assertTrue(re.test('\u{1F9DD}\u{1F3FF}'));
+assertTrue(re.test('\u261D\u{1F3FD}'));
+assertTrue(re.test('\u261D\u{1F3FE}'));
+assertTrue(re.test('\u261D\u{1F3FF}'));
+assertTrue(re.test('\u26F9\u{1F3FB}'));
+assertTrue(re.test('\u26F9\u{1F3FC}'));
+assertTrue(re.test('\u26F9\u{1F3FD}'));
+assertTrue(re.test('\u26F9\u{1F3FE}'));
+assertTrue(re.test('\u26F9\u{1F3FF}'));
+assertTrue(re.test('\u270A\u{1F3FB}'));
+assertTrue(re.test('\u270A\u{1F3FC}'));
+assertTrue(re.test('\u270A\u{1F3FD}'));
+assertTrue(re.test('\u270A\u{1F3FE}'));
+assertTrue(re.test('\u270A\u{1F3FF}'));
+assertTrue(re.test('\u270B\u{1F3FB}'));
+assertTrue(re.test('\u270B\u{1F3FC}'));
+assertTrue(re.test('\u270B\u{1F3FD}'));
+assertTrue(re.test('\u270B\u{1F3FE}'));
+assertTrue(re.test('\u270B\u{1F3FF}'));
+assertTrue(re.test('\u270C\u{1F3FB}'));
+assertTrue(re.test('\u270C\u{1F3FC}'));
+assertTrue(re.test('\u270C\u{1F3FD}'));
+assertTrue(re.test('\u270C\u{1F3FE}'));
+assertTrue(re.test('\u270C\u{1F3FF}'));
+assertTrue(re.test('\u270D\u{1F3FB}'));
+assertTrue(re.test('\u270D\u{1F3FC}'));
+assertTrue(re.test('\u270D\u{1F3FD}'));
+assertTrue(re.test('\u270D\u{1F3FE}'));
+assertTrue(re.test('\u270D\u{1F3FF}'));
+assertTrue(re.test('\u{1F385}\u{1F3FB}'));
+assertTrue(re.test('\u{1F385}\u{1F3FC}'));
+assertTrue(re.test('\u{1F385}\u{1F3FD}'));
+assertTrue(re.test('\u{1F385}\u{1F3FE}'));
+assertTrue(re.test('\u{1F385}\u{1F3FF}'));
+assertTrue(re.test('\u{1F3C2}\u{1F3FB}'));
+assertTrue(re.test('\u{1F3C2}\u{1F3FC}'));
+assertTrue(re.test('\u{1F3C2}\u{1F3FD}'));
+assertTrue(re.test('\u{1F3C2}\u{1F3FE}'));
+assertTrue(re.test('\u{1F3C2}\u{1F3FF}'));
+assertTrue(re.test('\u{1F3C3}\u{1F3FB}'));
+assertTrue(re.test('\u{1F3C3}\u{1F3FC}'));
+assertTrue(re.test('\u{1F3C3}\u{1F3FD}'));
+assertTrue(re.test('\u{1F3C3}\u{1F3FE}'));
+assertTrue(re.test('\u{1F3C3}\u{1F3FF}'));
+assertTrue(re.test('\u{1F3C4}\u{1F3FB}'));
+assertTrue(re.test('\u{1F3C4}\u{1F3FC}'));
+assertTrue(re.test('\u{1F3C4}\u{1F3FD}'));
+assertTrue(re.test('\u{1F3C4}\u{1F3FE}'));
+assertTrue(re.test('\u{1F3C4}\u{1F3FF}'));
+assertTrue(re.test('\u{1F3C7}\u{1F3FB}'));
+assertTrue(re.test('\u{1F3C7}\u{1F3FC}'));
+assertTrue(re.test('\u{1F3C7}\u{1F3FD}'));
+assertTrue(re.test('\u{1F3C7}\u{1F3FE}'));
+assertTrue(re.test('\u{1F3C7}\u{1F3FF}'));
+assertTrue(re.test('\u{1F3CA}\u{1F3FB}'));
+assertTrue(re.test('\u{1F3CA}\u{1F3FC}'));
+assertTrue(re.test('\u{1F3CA}\u{1F3FD}'));
+assertTrue(re.test('\u{1F3CA}\u{1F3FE}'));
+assertTrue(re.test('\u{1F3CA}\u{1F3FF}'));
+assertTrue(re.test('\u{1F3CB}\u{1F3FB}'));
+assertTrue(re.test('\u{1F3CB}\u{1F3FC}'));
+assertTrue(re.test('\u{1F3CB}\u{1F3FD}'));
+assertTrue(re.test('\u{1F3CB}\u{1F3FE}'));
+assertTrue(re.test('\u{1F3CB}\u{1F3FF}'));
+assertTrue(re.test('\u{1F3CC}\u{1F3FB}'));
+assertTrue(re.test('\u{1F3CC}\u{1F3FC}'));
+assertTrue(re.test('\u{1F3CC}\u{1F3FD}'));
+assertTrue(re.test('\u{1F3CC}\u{1F3FE}'));
+assertTrue(re.test('\u{1F3CC}\u{1F3FF}'));
+assertTrue(re.test('\u{1F442}\u{1F3FB}'));
+assertTrue(re.test('\u{1F442}\u{1F3FC}'));
+assertTrue(re.test('\u{1F442}\u{1F3FD}'));
+assertTrue(re.test('\u{1F442}\u{1F3FE}'));
+assertTrue(re.test('\u{1F442}\u{1F3FF}'));
+assertTrue(re.test('\u{1F443}\u{1F3FB}'));
+assertTrue(re.test('\u{1F443}\u{1F3FC}'));
+assertTrue(re.test('\u{1F443}\u{1F3FD}'));
+assertTrue(re.test('\u{1F443}\u{1F3FE}'));
+assertTrue(re.test('\u{1F443}\u{1F3FF}'));
+assertTrue(re.test('\u{1F446}\u{1F3FB}'));
+assertTrue(re.test('\u{1F446}\u{1F3FC}'));
+assertTrue(re.test('\u{1F446}\u{1F3FD}'));
+assertTrue(re.test('\u{1F446}\u{1F3FE}'));
+assertTrue(re.test('\u{1F446}\u{1F3FF}'));
+assertTrue(re.test('\u{1F447}\u{1F3FB}'));
+assertTrue(re.test('\u{1F447}\u{1F3FC}'));
+assertTrue(re.test('\u{1F447}\u{1F3FD}'));
+assertTrue(re.test('\u{1F447}\u{1F3FE}'));
+assertTrue(re.test('\u{1F447}\u{1F3FF}'));
+assertTrue(re.test('\u{1F448}\u{1F3FB}'));
+assertTrue(re.test('\u{1F448}\u{1F3FC}'));
+assertTrue(re.test('\u{1F448}\u{1F3FD}'));
+assertTrue(re.test('\u{1F448}\u{1F3FE}'));
+assertTrue(re.test('\u{1F448}\u{1F3FF}'));
+assertTrue(re.test('\u{1F449}\u{1F3FB}'));
+assertTrue(re.test('\u{1F449}\u{1F3FC}'));
+assertTrue(re.test('\u{1F449}\u{1F3FD}'));
+assertTrue(re.test('\u{1F449}\u{1F3FE}'));
+assertTrue(re.test('\u{1F449}\u{1F3FF}'));
+assertTrue(re.test('\u{1F44A}\u{1F3FB}'));
+assertTrue(re.test('\u{1F44A}\u{1F3FC}'));
+assertTrue(re.test('\u{1F44A}\u{1F3FD}'));
+assertTrue(re.test('\u{1F44A}\u{1F3FE}'));
+assertTrue(re.test('\u{1F44A}\u{1F3FF}'));
+assertTrue(re.test('\u{1F44B}\u{1F3FB}'));
+assertTrue(re.test('\u{1F44B}\u{1F3FC}'));
+assertTrue(re.test('\u{1F44B}\u{1F3FD}'));
+assertTrue(re.test('\u{1F44B}\u{1F3FE}'));
+assertTrue(re.test('\u{1F44B}\u{1F3FF}'));
+assertTrue(re.test('\u{1F44C}\u{1F3FB}'));
+assertTrue(re.test('\u{1F44C}\u{1F3FC}'));
+assertTrue(re.test('\u{1F44C}\u{1F3FD}'));
+assertTrue(re.test('\u{1F44C}\u{1F3FE}'));
+assertTrue(re.test('\u{1F44C}\u{1F3FF}'));
+assertTrue(re.test('\u{1F44D}\u{1F3FB}'));
+assertTrue(re.test('\u{1F44D}\u{1F3FC}'));
+assertTrue(re.test('\u{1F44D}\u{1F3FD}'));
+assertTrue(re.test('\u{1F44D}\u{1F3FE}'));
+assertTrue(re.test('\u{1F44D}\u{1F3FF}'));
+assertTrue(re.test('\u{1F44E}\u{1F3FB}'));
+assertTrue(re.test('\u{1F44E}\u{1F3FC}'));
+assertTrue(re.test('\u{1F44E}\u{1F3FD}'));
+assertTrue(re.test('\u{1F44E}\u{1F3FE}'));
+assertTrue(re.test('\u{1F44E}\u{1F3FF}'));
+assertTrue(re.test('\u{1F44F}\u{1F3FB}'));
+assertTrue(re.test('\u{1F44F}\u{1F3FC}'));
+assertTrue(re.test('\u{1F44F}\u{1F3FD}'));
+assertTrue(re.test('\u{1F44F}\u{1F3FE}'));
+assertTrue(re.test('\u{1F44F}\u{1F3FF}'));
+assertTrue(re.test('\u{1F450}\u{1F3FB}'));
+assertTrue(re.test('\u{1F450}\u{1F3FC}'));
+assertTrue(re.test('\u{1F450}\u{1F3FD}'));
+assertTrue(re.test('\u{1F450}\u{1F3FE}'));
+assertTrue(re.test('\u{1F450}\u{1F3FF}'));
+assertTrue(re.test('\u{1F466}\u{1F3FB}'));
+assertTrue(re.test('\u{1F466}\u{1F3FC}'));
+assertTrue(re.test('\u{1F466}\u{1F3FD}'));
+assertTrue(re.test('\u{1F466}\u{1F3FE}'));
+assertTrue(re.test('\u{1F466}\u{1F3FF}'));
+assertTrue(re.test('\u{1F467}\u{1F3FB}'));
+assertTrue(re.test('\u{1F467}\u{1F3FC}'));
+assertTrue(re.test('\u{1F467}\u{1F3FD}'));
+assertTrue(re.test('\u{1F467}\u{1F3FE}'));
+assertTrue(re.test('\u{1F467}\u{1F3FF}'));
+assertTrue(re.test('\u{1F468}\u{1F3FB}'));
+assertTrue(re.test('\u{1F468}\u{1F3FC}'));
+assertTrue(re.test('\u{1F468}\u{1F3FD}'));
+assertTrue(re.test('\u{1F468}\u{1F3FE}'));
+assertTrue(re.test('\u{1F468}\u{1F3FF}'));
+assertTrue(re.test('\u{1F469}\u{1F3FB}'));
+assertTrue(re.test('\u{1F469}\u{1F3FC}'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}'));
+assertTrue(re.test('\u{1F46E}\u{1F3FB}'));
+assertTrue(re.test('\u{1F46E}\u{1F3FC}'));
+assertTrue(re.test('\u{1F46E}\u{1F3FD}'));
+assertTrue(re.test('\u{1F46E}\u{1F3FE}'));
+assertTrue(re.test('\u{1F46E}\u{1F3FF}'));
+assertTrue(re.test('\u{1F470}\u{1F3FB}'));
+assertTrue(re.test('\u{1F470}\u{1F3FC}'));
+assertTrue(re.test('\u{1F470}\u{1F3FD}'));
+assertTrue(re.test('\u{1F470}\u{1F3FE}'));
+assertTrue(re.test('\u{1F470}\u{1F3FF}'));
+assertTrue(re.test('\u{1F471}\u{1F3FB}'));
+assertTrue(re.test('\u{1F471}\u{1F3FC}'));
+assertTrue(re.test('\u{1F471}\u{1F3FD}'));
+assertTrue(re.test('\u{1F471}\u{1F3FE}'));
+assertTrue(re.test('\u{1F471}\u{1F3FF}'));
+assertTrue(re.test('\u{1F472}\u{1F3FB}'));
+assertTrue(re.test('\u{1F472}\u{1F3FC}'));
+assertTrue(re.test('\u{1F472}\u{1F3FD}'));
+assertTrue(re.test('\u{1F472}\u{1F3FE}'));
+assertTrue(re.test('\u{1F472}\u{1F3FF}'));
+assertTrue(re.test('\u{1F473}\u{1F3FB}'));
+assertTrue(re.test('\u{1F473}\u{1F3FC}'));
+assertTrue(re.test('\u{1F473}\u{1F3FD}'));
+assertTrue(re.test('\u{1F473}\u{1F3FE}'));
+assertTrue(re.test('\u{1F473}\u{1F3FF}'));
+assertTrue(re.test('\u{1F474}\u{1F3FB}'));
+assertTrue(re.test('\u{1F474}\u{1F3FC}'));
+assertTrue(re.test('\u{1F474}\u{1F3FD}'));
+assertTrue(re.test('\u{1F474}\u{1F3FE}'));
+assertTrue(re.test('\u{1F474}\u{1F3FF}'));
+assertTrue(re.test('\u{1F475}\u{1F3FB}'));
+assertTrue(re.test('\u{1F475}\u{1F3FC}'));
+assertTrue(re.test('\u{1F475}\u{1F3FD}'));
+assertTrue(re.test('\u{1F475}\u{1F3FE}'));
+assertTrue(re.test('\u{1F475}\u{1F3FF}'));
+assertTrue(re.test('\u{1F476}\u{1F3FB}'));
+assertTrue(re.test('\u{1F476}\u{1F3FC}'));
+assertTrue(re.test('\u{1F476}\u{1F3FD}'));
+assertTrue(re.test('\u{1F476}\u{1F3FE}'));
+assertTrue(re.test('\u{1F476}\u{1F3FF}'));
+assertTrue(re.test('\u{1F477}\u{1F3FB}'));
+assertTrue(re.test('\u{1F477}\u{1F3FC}'));
+assertTrue(re.test('\u{1F477}\u{1F3FD}'));
+assertTrue(re.test('\u{1F477}\u{1F3FE}'));
+assertTrue(re.test('\u{1F477}\u{1F3FF}'));
+assertTrue(re.test('\u{1F478}\u{1F3FB}'));
+assertTrue(re.test('\u{1F478}\u{1F3FC}'));
+assertTrue(re.test('\u{1F478}\u{1F3FD}'));
+assertTrue(re.test('\u{1F478}\u{1F3FE}'));
+assertTrue(re.test('\u{1F478}\u{1F3FF}'));
+assertTrue(re.test('\u{1F47C}\u{1F3FB}'));
+assertTrue(re.test('\u{1F47C}\u{1F3FC}'));
+assertTrue(re.test('\u{1F47C}\u{1F3FD}'));
+assertTrue(re.test('\u{1F47C}\u{1F3FE}'));
+assertTrue(re.test('\u{1F47C}\u{1F3FF}'));
+assertTrue(re.test('\u{1F481}\u{1F3FB}'));
+assertTrue(re.test('\u{1F481}\u{1F3FC}'));
+assertTrue(re.test('\u{1F481}\u{1F3FD}'));
+assertTrue(re.test('\u{1F481}\u{1F3FE}'));
+assertTrue(re.test('\u{1F481}\u{1F3FF}'));
+assertTrue(re.test('\u{1F482}\u{1F3FB}'));
+assertTrue(re.test('\u{1F482}\u{1F3FC}'));
+assertTrue(re.test('\u{1F482}\u{1F3FD}'));
+assertTrue(re.test('\u{1F482}\u{1F3FE}'));
+assertTrue(re.test('\u{1F482}\u{1F3FF}'));
+assertTrue(re.test('\u{1F483}\u{1F3FB}'));
+assertTrue(re.test('\u{1F483}\u{1F3FC}'));
+assertTrue(re.test('\u{1F483}\u{1F3FD}'));
+assertTrue(re.test('\u{1F483}\u{1F3FE}'));
+assertTrue(re.test('\u{1F483}\u{1F3FF}'));
+assertTrue(re.test('\u{1F485}\u{1F3FB}'));
+assertTrue(re.test('\u{1F485}\u{1F3FC}'));
+assertTrue(re.test('\u{1F485}\u{1F3FD}'));
+assertTrue(re.test('\u{1F485}\u{1F3FE}'));
+assertTrue(re.test('\u{1F485}\u{1F3FF}'));
+assertTrue(re.test('\u{1F486}\u{1F3FB}'));
+assertTrue(re.test('\u{1F486}\u{1F3FC}'));
+assertTrue(re.test('\u{1F486}\u{1F3FD}'));
+assertTrue(re.test('\u{1F486}\u{1F3FE}'));
+assertTrue(re.test('\u{1F486}\u{1F3FF}'));
+assertTrue(re.test('\u{1F487}\u{1F3FB}'));
+assertTrue(re.test('\u{1F487}\u{1F3FC}'));
+assertTrue(re.test('\u{1F487}\u{1F3FD}'));
+assertTrue(re.test('\u{1F487}\u{1F3FE}'));
+assertTrue(re.test('\u{1F487}\u{1F3FF}'));
+assertTrue(re.test('\u{1F4AA}\u{1F3FB}'));
+assertTrue(re.test('\u{1F4AA}\u{1F3FC}'));
+assertTrue(re.test('\u{1F4AA}\u{1F3FD}'));
+assertTrue(re.test('\u{1F4AA}\u{1F3FE}'));
+assertTrue(re.test('\u{1F4AA}\u{1F3FF}'));
+assertTrue(re.test('\u{1F574}\u{1F3FB}'));
+assertTrue(re.test('\u{1F574}\u{1F3FC}'));
+assertTrue(re.test('\u{1F574}\u{1F3FD}'));
+assertTrue(re.test('\u{1F574}\u{1F3FE}'));
+assertTrue(re.test('\u{1F574}\u{1F3FF}'));
+assertTrue(re.test('\u{1F575}\u{1F3FB}'));
+assertTrue(re.test('\u{1F575}\u{1F3FC}'));
+assertTrue(re.test('\u{1F575}\u{1F3FD}'));
+assertTrue(re.test('\u{1F575}\u{1F3FE}'));
+assertTrue(re.test('\u{1F575}\u{1F3FF}'));
+assertTrue(re.test('\u{1F57A}\u{1F3FB}'));
+assertTrue(re.test('\u{1F57A}\u{1F3FC}'));
+assertTrue(re.test('\u{1F57A}\u{1F3FD}'));
+assertTrue(re.test('\u{1F57A}\u{1F3FE}'));
+assertTrue(re.test('\u{1F57A}\u{1F3FF}'));
+assertTrue(re.test('\u{1F590}\u{1F3FB}'));
+assertTrue(re.test('\u{1F590}\u{1F3FC}'));
+assertTrue(re.test('\u{1F590}\u{1F3FD}'));
+assertTrue(re.test('\u{1F590}\u{1F3FE}'));
+assertTrue(re.test('\u{1F590}\u{1F3FF}'));
+assertTrue(re.test('\u261D\u{1F3FC}'));
+assertTrue(re.test('\u{1F595}\u{1F3FC}'));
+assertTrue(re.test('\u{1F595}\u{1F3FD}'));
+assertTrue(re.test('\u{1F595}\u{1F3FE}'));
+assertTrue(re.test('\u{1F595}\u{1F3FF}'));
+assertTrue(re.test('\u{1F596}\u{1F3FB}'));
+assertTrue(re.test('\u{1F596}\u{1F3FC}'));
+assertTrue(re.test('\u{1F596}\u{1F3FD}'));
+assertTrue(re.test('\u{1F596}\u{1F3FE}'));
+assertTrue(re.test('\u{1F596}\u{1F3FF}'));
+assertTrue(re.test('\u{1F645}\u{1F3FB}'));
+assertTrue(re.test('\u{1F645}\u{1F3FC}'));
+assertTrue(re.test('\u{1F645}\u{1F3FD}'));
+assertTrue(re.test('\u{1F645}\u{1F3FE}'));
+assertTrue(re.test('\u{1F645}\u{1F3FF}'));
+assertTrue(re.test('\u{1F646}\u{1F3FB}'));
+assertTrue(re.test('\u{1F646}\u{1F3FC}'));
+assertTrue(re.test('\u{1F646}\u{1F3FD}'));
+assertTrue(re.test('\u{1F646}\u{1F3FE}'));
+assertTrue(re.test('\u{1F646}\u{1F3FF}'));
+assertTrue(re.test('\u{1F647}\u{1F3FB}'));
+assertTrue(re.test('\u{1F647}\u{1F3FC}'));
+assertTrue(re.test('\u{1F647}\u{1F3FD}'));
+assertTrue(re.test('\u{1F647}\u{1F3FE}'));
+assertTrue(re.test('\u{1F647}\u{1F3FF}'));
+assertTrue(re.test('\u{1F64B}\u{1F3FB}'));
+assertTrue(re.test('\u{1F64B}\u{1F3FC}'));
+assertTrue(re.test('\u{1F64B}\u{1F3FD}'));
+assertTrue(re.test('\u{1F64B}\u{1F3FE}'));
+assertTrue(re.test('\u{1F64B}\u{1F3FF}'));
+assertTrue(re.test('\u{1F64C}\u{1F3FB}'));
+assertTrue(re.test('\u{1F64C}\u{1F3FC}'));
+assertTrue(re.test('\u{1F64C}\u{1F3FD}'));
+assertTrue(re.test('\u{1F64C}\u{1F3FE}'));
+assertTrue(re.test('\u{1F64C}\u{1F3FF}'));
+assertTrue(re.test('\u{1F64D}\u{1F3FB}'));
+assertTrue(re.test('\u{1F64D}\u{1F3FC}'));
+assertTrue(re.test('\u{1F64D}\u{1F3FD}'));
+assertTrue(re.test('\u{1F64D}\u{1F3FE}'));
+assertTrue(re.test('\u{1F64D}\u{1F3FF}'));
+assertTrue(re.test('\u{1F64E}\u{1F3FB}'));
+assertTrue(re.test('\u{1F64E}\u{1F3FC}'));
+assertTrue(re.test('\u{1F64E}\u{1F3FD}'));
+assertTrue(re.test('\u{1F64E}\u{1F3FE}'));
+assertTrue(re.test('\u{1F64E}\u{1F3FF}'));
+assertTrue(re.test('\u{1F64F}\u{1F3FB}'));
+assertTrue(re.test('\u{1F64F}\u{1F3FC}'));
+assertTrue(re.test('\u{1F64F}\u{1F3FD}'));
+assertTrue(re.test('\u{1F64F}\u{1F3FE}'));
+assertTrue(re.test('\u{1F64F}\u{1F3FF}'));
+assertTrue(re.test('\u{1F6A3}\u{1F3FB}'));
+assertTrue(re.test('\u{1F6A3}\u{1F3FC}'));
+assertTrue(re.test('\u{1F6A3}\u{1F3FD}'));
+assertTrue(re.test('\u{1F6A3}\u{1F3FE}'));
+assertTrue(re.test('\u{1F6A3}\u{1F3FF}'));
+assertTrue(re.test('\u{1F6B4}\u{1F3FB}'));
+assertTrue(re.test('\u{1F6B4}\u{1F3FC}'));
+assertTrue(re.test('\u{1F6B4}\u{1F3FD}'));
+assertTrue(re.test('\u{1F6B4}\u{1F3FE}'));
+assertTrue(re.test('\u{1F6B4}\u{1F3FF}'));
+assertTrue(re.test('\u{1F6B5}\u{1F3FB}'));
+assertTrue(re.test('\u{1F6B5}\u{1F3FC}'));
+assertTrue(re.test('\u{1F6B5}\u{1F3FD}'));
+assertTrue(re.test('\u{1F6B5}\u{1F3FE}'));
+assertTrue(re.test('\u{1F6B5}\u{1F3FF}'));
+assertTrue(re.test('\u{1F6B6}\u{1F3FB}'));
+assertTrue(re.test('\u{1F6B6}\u{1F3FC}'));
+assertTrue(re.test('\u{1F6B6}\u{1F3FD}'));
+assertTrue(re.test('\u{1F6B6}\u{1F3FE}'));
+assertTrue(re.test('\u{1F6B6}\u{1F3FF}'));
+assertTrue(re.test('\u{1F6C0}\u{1F3FB}'));
+assertTrue(re.test('\u{1F6C0}\u{1F3FC}'));
+assertTrue(re.test('\u{1F6C0}\u{1F3FD}'));
+assertTrue(re.test('\u{1F6C0}\u{1F3FE}'));
+assertTrue(re.test('\u{1F6C0}\u{1F3FF}'));
+assertTrue(re.test('\u{1F6CC}\u{1F3FB}'));
+assertTrue(re.test('\u{1F6CC}\u{1F3FC}'));
+assertTrue(re.test('\u{1F6CC}\u{1F3FD}'));
+assertTrue(re.test('\u{1F6CC}\u{1F3FE}'));
+assertTrue(re.test('\u{1F6CC}\u{1F3FF}'));
+assertTrue(re.test('\u{1F918}\u{1F3FB}'));
+assertTrue(re.test('\u{1F918}\u{1F3FC}'));
+assertTrue(re.test('\u{1F918}\u{1F3FD}'));
+assertTrue(re.test('\u{1F918}\u{1F3FE}'));
+assertTrue(re.test('\u{1F918}\u{1F3FF}'));
+assertTrue(re.test('\u{1F919}\u{1F3FB}'));
+assertTrue(re.test('\u{1F919}\u{1F3FC}'));
+assertTrue(re.test('\u{1F919}\u{1F3FD}'));
+assertTrue(re.test('\u{1F919}\u{1F3FE}'));
+assertTrue(re.test('\u{1F919}\u{1F3FF}'));
+assertTrue(re.test('\u{1F91A}\u{1F3FB}'));
+assertTrue(re.test('\u{1F91A}\u{1F3FC}'));
+assertTrue(re.test('\u{1F91A}\u{1F3FD}'));
+assertTrue(re.test('\u{1F91A}\u{1F3FE}'));
+assertTrue(re.test('\u{1F91A}\u{1F3FF}'));
+assertTrue(re.test('\u{1F91B}\u{1F3FB}'));
+assertTrue(re.test('\u{1F91B}\u{1F3FC}'));
+assertTrue(re.test('\u{1F91B}\u{1F3FD}'));
+assertTrue(re.test('\u{1F91B}\u{1F3FE}'));
+assertTrue(re.test('\u{1F91B}\u{1F3FF}'));
+assertTrue(re.test('\u{1F91C}\u{1F3FB}'));
+assertTrue(re.test('\u{1F91C}\u{1F3FC}'));
+assertTrue(re.test('\u{1F91C}\u{1F3FD}'));
+assertTrue(re.test('\u{1F91C}\u{1F3FE}'));
+assertTrue(re.test('\u{1F91C}\u{1F3FF}'));
+assertTrue(re.test('\u{1F91E}\u{1F3FB}'));
+assertTrue(re.test('\u{1F91E}\u{1F3FC}'));
+assertTrue(re.test('\u{1F91E}\u{1F3FD}'));
+assertTrue(re.test('\u{1F91E}\u{1F3FE}'));
+assertTrue(re.test('\u{1F91E}\u{1F3FF}'));
+assertTrue(re.test('\u{1F91F}\u{1F3FB}'));
+assertTrue(re.test('\u{1F91F}\u{1F3FC}'));
+assertTrue(re.test('\u{1F91F}\u{1F3FD}'));
+assertTrue(re.test('\u{1F91F}\u{1F3FE}'));
+assertTrue(re.test('\u{1F91F}\u{1F3FF}'));
+assertTrue(re.test('\u{1F926}\u{1F3FB}'));
+assertTrue(re.test('\u{1F926}\u{1F3FC}'));
+assertTrue(re.test('\u{1F926}\u{1F3FD}'));
+assertTrue(re.test('\u{1F926}\u{1F3FE}'));
+assertTrue(re.test('\u{1F926}\u{1F3FF}'));
+assertTrue(re.test('\u{1F930}\u{1F3FB}'));
+assertTrue(re.test('\u{1F930}\u{1F3FC}'));
+assertTrue(re.test('\u{1F930}\u{1F3FD}'));
+assertTrue(re.test('\u{1F930}\u{1F3FE}'));
+assertTrue(re.test('\u{1F930}\u{1F3FF}'));
+assertTrue(re.test('\u{1F931}\u{1F3FB}'));
+assertTrue(re.test('\u{1F931}\u{1F3FC}'));
+assertTrue(re.test('\u{1F931}\u{1F3FD}'));
+assertTrue(re.test('\u{1F931}\u{1F3FE}'));
+assertTrue(re.test('\u{1F931}\u{1F3FF}'));
+assertTrue(re.test('\u{1F932}\u{1F3FB}'));
+assertTrue(re.test('\u{1F932}\u{1F3FC}'));
+assertTrue(re.test('\u{1F932}\u{1F3FD}'));
+assertTrue(re.test('\u{1F932}\u{1F3FE}'));
+assertTrue(re.test('\u{1F932}\u{1F3FF}'));
+assertTrue(re.test('\u{1F933}\u{1F3FB}'));
+assertTrue(re.test('\u{1F933}\u{1F3FC}'));
+assertTrue(re.test('\u{1F933}\u{1F3FD}'));
+assertTrue(re.test('\u{1F933}\u{1F3FE}'));
+assertTrue(re.test('\u{1F933}\u{1F3FF}'));
+assertTrue(re.test('\u{1F934}\u{1F3FB}'));
+assertTrue(re.test('\u{1F934}\u{1F3FC}'));
+assertTrue(re.test('\u{1F934}\u{1F3FD}'));
+assertTrue(re.test('\u{1F934}\u{1F3FE}'));
+assertTrue(re.test('\u{1F934}\u{1F3FF}'));
+assertTrue(re.test('\u{1F935}\u{1F3FB}'));
+assertTrue(re.test('\u{1F935}\u{1F3FC}'));
+assertTrue(re.test('\u{1F935}\u{1F3FD}'));
+assertTrue(re.test('\u{1F935}\u{1F3FE}'));
+assertTrue(re.test('\u{1F935}\u{1F3FF}'));
+assertTrue(re.test('\u{1F936}\u{1F3FB}'));
+assertTrue(re.test('\u{1F936}\u{1F3FC}'));
+assertTrue(re.test('\u{1F936}\u{1F3FD}'));
+assertTrue(re.test('\u{1F936}\u{1F3FE}'));
+assertTrue(re.test('\u{1F936}\u{1F3FF}'));
+assertTrue(re.test('\u{1F937}\u{1F3FB}'));
+assertTrue(re.test('\u{1F937}\u{1F3FC}'));
+assertTrue(re.test('\u{1F937}\u{1F3FD}'));
+assertTrue(re.test('\u{1F937}\u{1F3FE}'));
+assertTrue(re.test('\u{1F937}\u{1F3FF}'));
+assertTrue(re.test('\u{1F938}\u{1F3FB}'));
+assertTrue(re.test('\u{1F938}\u{1F3FC}'));
+assertTrue(re.test('\u{1F938}\u{1F3FD}'));
+assertTrue(re.test('\u{1F938}\u{1F3FE}'));
+assertTrue(re.test('\u{1F938}\u{1F3FF}'));
+assertTrue(re.test('\u{1F939}\u{1F3FB}'));
+assertTrue(re.test('\u{1F939}\u{1F3FC}'));
+assertTrue(re.test('\u{1F939}\u{1F3FD}'));
+assertTrue(re.test('\u{1F939}\u{1F3FE}'));
+assertTrue(re.test('\u{1F939}\u{1F3FF}'));
+assertTrue(re.test('\u{1F93D}\u{1F3FB}'));
+assertTrue(re.test('\u{1F93D}\u{1F3FC}'));
+assertTrue(re.test('\u{1F93D}\u{1F3FD}'));
+assertTrue(re.test('\u{1F93D}\u{1F3FE}'));
+assertTrue(re.test('\u{1F93D}\u{1F3FF}'));
+assertTrue(re.test('\u{1F93E}\u{1F3FB}'));
+assertTrue(re.test('\u{1F93E}\u{1F3FC}'));
+assertTrue(re.test('\u{1F93E}\u{1F3FD}'));
+assertTrue(re.test('\u{1F93E}\u{1F3FE}'));
+assertTrue(re.test('\u{1F93E}\u{1F3FF}'));
+assertTrue(re.test('\u{1F9B5}\u{1F3FB}'));
+assertTrue(re.test('\u{1F9B5}\u{1F3FC}'));
+assertTrue(re.test('\u{1F9B5}\u{1F3FD}'));
+assertTrue(re.test('\u{1F9B5}\u{1F3FE}'));
+assertTrue(re.test('\u{1F9B5}\u{1F3FF}'));
+assertTrue(re.test('\u{1F9B6}\u{1F3FB}'));
+assertTrue(re.test('\u{1F9B6}\u{1F3FC}'));
+assertTrue(re.test('\u{1F9B6}\u{1F3FD}'));
+assertTrue(re.test('\u{1F9B6}\u{1F3FE}'));
+assertTrue(re.test('\u{1F9B6}\u{1F3FF}'));
+assertTrue(re.test('\u{1F9B8}\u{1F3FB}'));
+assertTrue(re.test('\u{1F9B8}\u{1F3FC}'));
+assertTrue(re.test('\u{1F9B8}\u{1F3FD}'));
+assertTrue(re.test('\u{1F9B8}\u{1F3FE}'));
+assertTrue(re.test('\u{1F9B8}\u{1F3FF}'));
+assertTrue(re.test('\u{1F9B9}\u{1F3FB}'));
+assertTrue(re.test('\u{1F9B9}\u{1F3FC}'));
+assertTrue(re.test('\u{1F9B9}\u{1F3FD}'));
+assertTrue(re.test('\u{1F9B9}\u{1F3FE}'));
+assertTrue(re.test('\u{1F9B9}\u{1F3FF}'));
+assertTrue(re.test('\u{1F9D1}\u{1F3FB}'));
+assertTrue(re.test('\u{1F9D1}\u{1F3FC}'));
+assertTrue(re.test('\u{1F9D1}\u{1F3FD}'));
+assertTrue(re.test('\u{1F9D1}\u{1F3FE}'));
+assertTrue(re.test('\u{1F9D1}\u{1F3FF}'));
+assertTrue(re.test('\u{1F9D2}\u{1F3FB}'));
+assertTrue(re.test('\u{1F9D2}\u{1F3FC}'));
+assertTrue(re.test('\u{1F9D2}\u{1F3FD}'));
+assertTrue(re.test('\u{1F9D2}\u{1F3FE}'));
+assertTrue(re.test('\u{1F9D2}\u{1F3FF}'));
+assertTrue(re.test('\u{1F9D3}\u{1F3FB}'));
+assertTrue(re.test('\u{1F9D3}\u{1F3FC}'));
+assertTrue(re.test('\u{1F9D3}\u{1F3FD}'));
+assertTrue(re.test('\u{1F9D3}\u{1F3FE}'));
+assertTrue(re.test('\u{1F9D3}\u{1F3FF}'));
+assertTrue(re.test('\u{1F9D4}\u{1F3FB}'));
+assertTrue(re.test('\u{1F9D4}\u{1F3FC}'));
+assertTrue(re.test('\u{1F9D4}\u{1F3FD}'));
+assertTrue(re.test('\u{1F9D4}\u{1F3FE}'));
+assertTrue(re.test('\u{1F9D4}\u{1F3FF}'));
+assertTrue(re.test('\u{1F9D5}\u{1F3FB}'));
+assertTrue(re.test('\u{1F9D5}\u{1F3FC}'));
+assertTrue(re.test('\u{1F9D5}\u{1F3FD}'));
+assertTrue(re.test('\u{1F9D5}\u{1F3FE}'));
+assertTrue(re.test('\u{1F9D5}\u{1F3FF}'));
+assertTrue(re.test('\u{1F9D6}\u{1F3FB}'));
+assertTrue(re.test('\u{1F9D6}\u{1F3FC}'));
+assertTrue(re.test('\u{1F9D6}\u{1F3FD}'));
+assertTrue(re.test('\u{1F9D6}\u{1F3FE}'));
+assertTrue(re.test('\u{1F9D6}\u{1F3FF}'));
+assertTrue(re.test('\u{1F9D7}\u{1F3FB}'));
+assertTrue(re.test('\u{1F9D7}\u{1F3FC}'));
+assertTrue(re.test('\u{1F9D7}\u{1F3FD}'));
+assertTrue(re.test('\u{1F9D7}\u{1F3FE}'));
+assertTrue(re.test('\u{1F9D7}\u{1F3FF}'));
+assertTrue(re.test('\u{1F9D8}\u{1F3FB}'));
+assertTrue(re.test('\u{1F9D8}\u{1F3FC}'));
+assertTrue(re.test('\u{1F9D8}\u{1F3FD}'));
+assertTrue(re.test('\u{1F9D8}\u{1F3FE}'));
+assertTrue(re.test('\u{1F9D8}\u{1F3FF}'));
+assertTrue(re.test('\u{1F9D9}\u{1F3FB}'));
+assertTrue(re.test('\u{1F9D9}\u{1F3FC}'));
+assertTrue(re.test('\u{1F9D9}\u{1F3FD}'));
+assertTrue(re.test('\u{1F9D9}\u{1F3FE}'));
+assertTrue(re.test('\u{1F9D9}\u{1F3FF}'));
+assertTrue(re.test('\u{1F9DA}\u{1F3FB}'));
+assertTrue(re.test('\u{1F9DA}\u{1F3FC}'));
+assertTrue(re.test('\u{1F9DA}\u{1F3FD}'));
+assertTrue(re.test('\u{1F9DA}\u{1F3FE}'));
+assertTrue(re.test('\u{1F9DA}\u{1F3FF}'));
+assertTrue(re.test('\u{1F9DB}\u{1F3FB}'));
+assertTrue(re.test('\u{1F9DB}\u{1F3FC}'));
+assertTrue(re.test('\u{1F9DB}\u{1F3FD}'));
+assertTrue(re.test('\u{1F9DB}\u{1F3FE}'));
+assertTrue(re.test('\u{1F9DB}\u{1F3FF}'));
+assertTrue(re.test('\u{1F9DC}\u{1F3FB}'));
+assertTrue(re.test('\u{1F9DC}\u{1F3FC}'));
+assertTrue(re.test('\u{1F9DC}\u{1F3FD}'));
+assertTrue(re.test('\u{1F9DC}\u{1F3FE}'));
+assertTrue(re.test('\u{1F9DC}\u{1F3FF}'));
+assertTrue(re.test('\u{1F9DD}\u{1F3FB}'));
+assertTrue(re.test('\u{1F9DD}\u{1F3FC}'));
+assertTrue(re.test('\u{1F9DD}\u{1F3FD}'));
+assertTrue(re.test('\u{1F9DD}\u{1F3FE}'));
+assertTrue(re.test('\u{1F595}\u{1F3FB}'));
diff --git a/src/v8/test/mjsunit/harmony/regexp-property-emoji-tag-sequence-generated.js b/src/v8/test/mjsunit/harmony/regexp-property-emoji-tag-sequence-generated.js
new file mode 100644
index 0000000..839d557
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/regexp-property-emoji-tag-sequence-generated.js
@@ -0,0 +1,15 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-regexp-sequence
+
+// These tests have been generated by the script at
+// https://gist.github.com/mathiasbynens/3b42c99a227521dabfe68d9e63f00f42.
+// Do not modify this file directly!
+
+const re = /\p{Emoji_Tag_Sequence}/u;
+
+assertTrue(re.test('\u{1F3F4}\u{E0067}\u{E0062}\u{E0065}\u{E006E}\u{E0067}\u{E007F}'));
+assertTrue(re.test('\u{1F3F4}\u{E0067}\u{E0062}\u{E0073}\u{E0063}\u{E0074}\u{E007F}'));
+assertTrue(re.test('\u{1F3F4}\u{E0067}\u{E0062}\u{E0077}\u{E006C}\u{E0073}\u{E007F}'));
diff --git a/src/v8/test/mjsunit/harmony/regexp-property-emoji-zwj-sequence-generated.js b/src/v8/test/mjsunit/harmony/regexp-property-emoji-zwj-sequence-generated.js
new file mode 100644
index 0000000..b04f0e4
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/regexp-property-emoji-zwj-sequence-generated.js
@@ -0,0 +1,915 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-regexp-sequence
+
+// These tests have been generated by the script at
+// https://gist.github.com/mathiasbynens/3b42c99a227521dabfe68d9e63f00f42.
+// Do not modify this file directly!
+
+const re = /\p{Emoji_ZWJ_Sequence}/u;
+
+assertTrue(re.test('\u{1F468}\u200D\u2764\uFE0F\u200D\u{1F468}'));
+assertTrue(re.test('\u{1F441}\uFE0F\u200D\u{1F5E8}\uFE0F'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F466}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F466}\u200D\u{1F466}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F467}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F467}\u200D\u{1F466}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F467}\u200D\u{1F467}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F468}\u200D\u{1F466}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F468}\u200D\u{1F466}\u200D\u{1F466}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F468}\u200D\u{1F467}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F468}\u200D\u{1F467}\u200D\u{1F466}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F468}\u200D\u{1F467}\u200D\u{1F467}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F469}\u200D\u{1F466}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F469}\u200D\u{1F466}\u200D\u{1F466}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F469}\u200D\u{1F467}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F469}\u200D\u{1F467}\u200D\u{1F466}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F469}\u200D\u{1F467}\u200D\u{1F467}'));
+assertTrue(re.test('\u{1F468}\u{1F3FC}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FB}'));
+assertTrue(re.test('\u{1F468}\u{1F3FD}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FB}'));
+assertTrue(re.test('\u{1F468}\u{1F3FD}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FC}'));
+assertTrue(re.test('\u{1F468}\u{1F3FE}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FB}'));
+assertTrue(re.test('\u{1F468}\u{1F3FE}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FC}'));
+assertTrue(re.test('\u{1F468}\u{1F3FE}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FD}'));
+assertTrue(re.test('\u{1F468}\u{1F3FF}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FB}'));
+assertTrue(re.test('\u{1F468}\u{1F3FF}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FC}'));
+assertTrue(re.test('\u{1F468}\u{1F3FF}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FD}'));
+assertTrue(re.test('\u{1F468}\u{1F3FF}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FE}'));
+assertTrue(re.test('\u{1F469}\u200D\u2764\uFE0F\u200D\u{1F468}'));
+assertTrue(re.test('\u{1F469}\u200D\u2764\uFE0F\u200D\u{1F469}'));
+assertTrue(re.test('\u{1F469}\u200D\u2764\uFE0F\u200D\u{1F48B}\u200D\u{1F468}'));
+assertTrue(re.test('\u{1F469}\u200D\u2764\uFE0F\u200D\u{1F48B}\u200D\u{1F469}'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F466}'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F466}\u200D\u{1F466}'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F467}'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F467}\u200D\u{1F466}'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F467}\u200D\u{1F467}'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F469}\u200D\u{1F466}'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F469}\u200D\u{1F466}\u200D\u{1F466}'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F469}\u200D\u{1F467}'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F469}\u200D\u{1F467}\u200D\u{1F466}'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F469}\u200D\u{1F467}\u200D\u{1F467}'));
+assertTrue(re.test('\u{1F469}\u{1F3FB}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FC}'));
+assertTrue(re.test('\u{1F469}\u{1F3FB}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FD}'));
+assertTrue(re.test('\u{1F469}\u{1F3FB}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FE}'));
+assertTrue(re.test('\u{1F469}\u{1F3FB}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FF}'));
+assertTrue(re.test('\u{1F469}\u{1F3FC}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FB}'));
+assertTrue(re.test('\u{1F469}\u{1F3FC}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FD}'));
+assertTrue(re.test('\u{1F469}\u{1F3FC}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FE}'));
+assertTrue(re.test('\u{1F469}\u{1F3FC}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FF}'));
+assertTrue(re.test('\u{1F469}\u{1F3FC}\u200D\u{1F91D}\u200D\u{1F469}\u{1F3FB}'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FB}'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FC}'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FE}'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FF}'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}\u200D\u{1F91D}\u200D\u{1F469}\u{1F3FB}'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}\u200D\u{1F91D}\u200D\u{1F469}\u{1F3FC}'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FB}'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FC}'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FD}'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FF}'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u{1F91D}\u200D\u{1F469}\u{1F3FB}'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u{1F91D}\u200D\u{1F469}\u{1F3FC}'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u{1F91D}\u200D\u{1F469}\u{1F3FD}'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FB}'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FC}'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FD}'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u{1F91D}\u200D\u{1F468}\u{1F3FE}'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u{1F91D}\u200D\u{1F469}\u{1F3FB}'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u{1F91D}\u200D\u{1F469}\u{1F3FC}'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u{1F91D}\u200D\u{1F469}\u{1F3FD}'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u{1F91D}\u200D\u{1F469}\u{1F3FE}'));
+assertTrue(re.test('\u{1F9D1}\u200D\u{1F91D}\u200D\u{1F9D1}'));
+assertTrue(re.test('\u{1F9D1}\u{1F3FB}\u200D\u{1F91D}\u200D\u{1F9D1}\u{1F3FB}'));
+assertTrue(re.test('\u{1F9D1}\u{1F3FC}\u200D\u{1F91D}\u200D\u{1F9D1}\u{1F3FB}'));
+assertTrue(re.test('\u{1F9D1}\u{1F3FC}\u200D\u{1F91D}\u200D\u{1F9D1}\u{1F3FC}'));
+assertTrue(re.test('\u{1F9D1}\u{1F3FD}\u200D\u{1F91D}\u200D\u{1F9D1}\u{1F3FB}'));
+assertTrue(re.test('\u{1F9D1}\u{1F3FD}\u200D\u{1F91D}\u200D\u{1F9D1}\u{1F3FC}'));
+assertTrue(re.test('\u{1F9D1}\u{1F3FD}\u200D\u{1F91D}\u200D\u{1F9D1}\u{1F3FD}'));
+assertTrue(re.test('\u{1F9D1}\u{1F3FE}\u200D\u{1F91D}\u200D\u{1F9D1}\u{1F3FB}'));
+assertTrue(re.test('\u{1F9D1}\u{1F3FE}\u200D\u{1F91D}\u200D\u{1F9D1}\u{1F3FC}'));
+assertTrue(re.test('\u{1F9D1}\u{1F3FE}\u200D\u{1F91D}\u200D\u{1F9D1}\u{1F3FD}'));
+assertTrue(re.test('\u{1F9D1}\u{1F3FE}\u200D\u{1F91D}\u200D\u{1F9D1}\u{1F3FE}'));
+assertTrue(re.test('\u{1F9D1}\u{1F3FF}\u200D\u{1F91D}\u200D\u{1F9D1}\u{1F3FB}'));
+assertTrue(re.test('\u{1F9D1}\u{1F3FF}\u200D\u{1F91D}\u200D\u{1F9D1}\u{1F3FC}'));
+assertTrue(re.test('\u{1F9D1}\u{1F3FF}\u200D\u{1F91D}\u200D\u{1F9D1}\u{1F3FD}'));
+assertTrue(re.test('\u{1F9D1}\u{1F3FF}\u200D\u{1F91D}\u200D\u{1F9D1}\u{1F3FE}'));
+assertTrue(re.test('\u{1F9D1}\u{1F3FF}\u200D\u{1F91D}\u200D\u{1F9D1}\u{1F3FF}'));
+assertTrue(re.test('\u{1F468}\u200D\u2695\uFE0F'));
+assertTrue(re.test('\u{1F468}\u200D\u2696\uFE0F'));
+assertTrue(re.test('\u{1F468}\u200D\u2708\uFE0F'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F33E}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F373}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F393}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F3A4}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F3A8}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F3EB}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F3ED}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F4BB}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F4BC}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F527}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F52C}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F680}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F692}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F9AF}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F9BC}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F9BD}'));
+assertTrue(re.test('\u{1F468}\u{1F3FB}\u200D\u2695\uFE0F'));
+assertTrue(re.test('\u{1F468}\u{1F3FB}\u200D\u2696\uFE0F'));
+assertTrue(re.test('\u{1F468}\u{1F3FB}\u200D\u2708\uFE0F'));
+assertTrue(re.test('\u{1F468}\u{1F3FB}\u200D\u{1F33E}'));
+assertTrue(re.test('\u{1F468}\u{1F3FB}\u200D\u{1F373}'));
+assertTrue(re.test('\u{1F468}\u{1F3FB}\u200D\u{1F393}'));
+assertTrue(re.test('\u{1F468}\u{1F3FB}\u200D\u{1F3A4}'));
+assertTrue(re.test('\u{1F468}\u{1F3FB}\u200D\u{1F3A8}'));
+assertTrue(re.test('\u{1F468}\u{1F3FB}\u200D\u{1F3EB}'));
+assertTrue(re.test('\u{1F468}\u{1F3FB}\u200D\u{1F3ED}'));
+assertTrue(re.test('\u{1F468}\u{1F3FB}\u200D\u{1F4BB}'));
+assertTrue(re.test('\u{1F468}\u{1F3FB}\u200D\u{1F4BC}'));
+assertTrue(re.test('\u{1F468}\u{1F3FB}\u200D\u{1F527}'));
+assertTrue(re.test('\u{1F468}\u{1F3FB}\u200D\u{1F52C}'));
+assertTrue(re.test('\u{1F468}\u{1F3FB}\u200D\u{1F680}'));
+assertTrue(re.test('\u{1F468}\u{1F3FB}\u200D\u{1F692}'));
+assertTrue(re.test('\u{1F468}\u{1F3FB}\u200D\u{1F9AF}'));
+assertTrue(re.test('\u{1F468}\u{1F3FB}\u200D\u{1F9BC}'));
+assertTrue(re.test('\u{1F468}\u{1F3FB}\u200D\u{1F9BD}'));
+assertTrue(re.test('\u{1F468}\u{1F3FC}\u200D\u2695\uFE0F'));
+assertTrue(re.test('\u{1F468}\u{1F3FC}\u200D\u2696\uFE0F'));
+assertTrue(re.test('\u{1F468}\u{1F3FC}\u200D\u2708\uFE0F'));
+assertTrue(re.test('\u{1F468}\u{1F3FC}\u200D\u{1F33E}'));
+assertTrue(re.test('\u{1F468}\u{1F3FC}\u200D\u{1F373}'));
+assertTrue(re.test('\u{1F468}\u{1F3FC}\u200D\u{1F393}'));
+assertTrue(re.test('\u{1F468}\u{1F3FC}\u200D\u{1F3A4}'));
+assertTrue(re.test('\u{1F468}\u{1F3FC}\u200D\u{1F3A8}'));
+assertTrue(re.test('\u{1F468}\u{1F3FC}\u200D\u{1F3EB}'));
+assertTrue(re.test('\u{1F468}\u{1F3FC}\u200D\u{1F3ED}'));
+assertTrue(re.test('\u{1F468}\u{1F3FC}\u200D\u{1F4BB}'));
+assertTrue(re.test('\u{1F468}\u{1F3FC}\u200D\u{1F4BC}'));
+assertTrue(re.test('\u{1F468}\u{1F3FC}\u200D\u{1F527}'));
+assertTrue(re.test('\u{1F468}\u{1F3FC}\u200D\u{1F52C}'));
+assertTrue(re.test('\u{1F468}\u{1F3FC}\u200D\u{1F680}'));
+assertTrue(re.test('\u{1F468}\u{1F3FC}\u200D\u{1F692}'));
+assertTrue(re.test('\u{1F468}\u{1F3FC}\u200D\u{1F9AF}'));
+assertTrue(re.test('\u{1F468}\u{1F3FC}\u200D\u{1F9BC}'));
+assertTrue(re.test('\u{1F468}\u{1F3FC}\u200D\u{1F9BD}'));
+assertTrue(re.test('\u{1F468}\u{1F3FD}\u200D\u2695\uFE0F'));
+assertTrue(re.test('\u{1F468}\u{1F3FD}\u200D\u2696\uFE0F'));
+assertTrue(re.test('\u{1F468}\u{1F3FD}\u200D\u2708\uFE0F'));
+assertTrue(re.test('\u{1F468}\u{1F3FD}\u200D\u{1F33E}'));
+assertTrue(re.test('\u{1F468}\u{1F3FD}\u200D\u{1F373}'));
+assertTrue(re.test('\u{1F468}\u{1F3FD}\u200D\u{1F393}'));
+assertTrue(re.test('\u{1F468}\u{1F3FD}\u200D\u{1F3A4}'));
+assertTrue(re.test('\u{1F468}\u{1F3FD}\u200D\u{1F3A8}'));
+assertTrue(re.test('\u{1F468}\u{1F3FD}\u200D\u{1F3EB}'));
+assertTrue(re.test('\u{1F468}\u{1F3FD}\u200D\u{1F3ED}'));
+assertTrue(re.test('\u{1F468}\u{1F3FD}\u200D\u{1F4BB}'));
+assertTrue(re.test('\u{1F468}\u{1F3FD}\u200D\u{1F4BC}'));
+assertTrue(re.test('\u{1F468}\u{1F3FD}\u200D\u{1F527}'));
+assertTrue(re.test('\u{1F468}\u{1F3FD}\u200D\u{1F52C}'));
+assertTrue(re.test('\u{1F468}\u{1F3FD}\u200D\u{1F680}'));
+assertTrue(re.test('\u{1F468}\u{1F3FD}\u200D\u{1F692}'));
+assertTrue(re.test('\u{1F468}\u{1F3FD}\u200D\u{1F9AF}'));
+assertTrue(re.test('\u{1F468}\u{1F3FD}\u200D\u{1F9BC}'));
+assertTrue(re.test('\u{1F468}\u{1F3FD}\u200D\u{1F9BD}'));
+assertTrue(re.test('\u{1F468}\u{1F3FE}\u200D\u2695\uFE0F'));
+assertTrue(re.test('\u{1F468}\u{1F3FE}\u200D\u2696\uFE0F'));
+assertTrue(re.test('\u{1F468}\u{1F3FE}\u200D\u2708\uFE0F'));
+assertTrue(re.test('\u{1F468}\u{1F3FE}\u200D\u{1F33E}'));
+assertTrue(re.test('\u{1F468}\u{1F3FE}\u200D\u{1F373}'));
+assertTrue(re.test('\u{1F468}\u{1F3FE}\u200D\u{1F393}'));
+assertTrue(re.test('\u{1F468}\u{1F3FE}\u200D\u{1F3A4}'));
+assertTrue(re.test('\u{1F468}\u{1F3FE}\u200D\u{1F3A8}'));
+assertTrue(re.test('\u{1F468}\u{1F3FE}\u200D\u{1F3EB}'));
+assertTrue(re.test('\u{1F468}\u{1F3FE}\u200D\u{1F3ED}'));
+assertTrue(re.test('\u{1F468}\u{1F3FE}\u200D\u{1F4BB}'));
+assertTrue(re.test('\u{1F468}\u{1F3FE}\u200D\u{1F4BC}'));
+assertTrue(re.test('\u{1F468}\u{1F3FE}\u200D\u{1F527}'));
+assertTrue(re.test('\u{1F468}\u{1F3FE}\u200D\u{1F52C}'));
+assertTrue(re.test('\u{1F468}\u{1F3FE}\u200D\u{1F680}'));
+assertTrue(re.test('\u{1F468}\u{1F3FE}\u200D\u{1F692}'));
+assertTrue(re.test('\u{1F468}\u{1F3FE}\u200D\u{1F9AF}'));
+assertTrue(re.test('\u{1F468}\u{1F3FE}\u200D\u{1F9BC}'));
+assertTrue(re.test('\u{1F468}\u{1F3FE}\u200D\u{1F9BD}'));
+assertTrue(re.test('\u{1F468}\u{1F3FF}\u200D\u2695\uFE0F'));
+assertTrue(re.test('\u{1F468}\u{1F3FF}\u200D\u2696\uFE0F'));
+assertTrue(re.test('\u{1F468}\u{1F3FF}\u200D\u2708\uFE0F'));
+assertTrue(re.test('\u{1F468}\u{1F3FF}\u200D\u{1F33E}'));
+assertTrue(re.test('\u{1F468}\u{1F3FF}\u200D\u{1F373}'));
+assertTrue(re.test('\u{1F468}\u{1F3FF}\u200D\u{1F393}'));
+assertTrue(re.test('\u{1F468}\u{1F3FF}\u200D\u{1F3A4}'));
+assertTrue(re.test('\u{1F468}\u{1F3FF}\u200D\u{1F3A8}'));
+assertTrue(re.test('\u{1F468}\u{1F3FF}\u200D\u{1F3EB}'));
+assertTrue(re.test('\u{1F468}\u{1F3FF}\u200D\u{1F3ED}'));
+assertTrue(re.test('\u{1F468}\u{1F3FF}\u200D\u{1F4BB}'));
+assertTrue(re.test('\u{1F468}\u{1F3FF}\u200D\u{1F4BC}'));
+assertTrue(re.test('\u{1F468}\u{1F3FF}\u200D\u{1F527}'));
+assertTrue(re.test('\u{1F468}\u{1F3FF}\u200D\u{1F52C}'));
+assertTrue(re.test('\u{1F468}\u{1F3FF}\u200D\u{1F680}'));
+assertTrue(re.test('\u{1F468}\u{1F3FF}\u200D\u{1F692}'));
+assertTrue(re.test('\u{1F468}\u{1F3FF}\u200D\u{1F9AF}'));
+assertTrue(re.test('\u{1F468}\u{1F3FF}\u200D\u{1F9BC}'));
+assertTrue(re.test('\u{1F468}\u{1F3FF}\u200D\u{1F9BD}'));
+assertTrue(re.test('\u{1F469}\u200D\u2695\uFE0F'));
+assertTrue(re.test('\u{1F469}\u200D\u2696\uFE0F'));
+assertTrue(re.test('\u{1F469}\u200D\u2708\uFE0F'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F33E}'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F373}'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F393}'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F3A4}'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F3A8}'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F3EB}'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F3ED}'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F4BB}'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F4BC}'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F527}'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F52C}'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F680}'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F692}'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F9AF}'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F9BC}'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F9BD}'));
+assertTrue(re.test('\u{1F469}\u{1F3FB}\u200D\u2695\uFE0F'));
+assertTrue(re.test('\u{1F469}\u{1F3FB}\u200D\u2696\uFE0F'));
+assertTrue(re.test('\u{1F469}\u{1F3FB}\u200D\u2708\uFE0F'));
+assertTrue(re.test('\u{1F469}\u{1F3FB}\u200D\u{1F33E}'));
+assertTrue(re.test('\u{1F469}\u{1F3FB}\u200D\u{1F373}'));
+assertTrue(re.test('\u{1F469}\u{1F3FB}\u200D\u{1F393}'));
+assertTrue(re.test('\u{1F469}\u{1F3FB}\u200D\u{1F3A4}'));
+assertTrue(re.test('\u{1F469}\u{1F3FB}\u200D\u{1F3A8}'));
+assertTrue(re.test('\u{1F469}\u{1F3FB}\u200D\u{1F3EB}'));
+assertTrue(re.test('\u{1F469}\u{1F3FB}\u200D\u{1F3ED}'));
+assertTrue(re.test('\u{1F469}\u{1F3FB}\u200D\u{1F4BB}'));
+assertTrue(re.test('\u{1F469}\u{1F3FB}\u200D\u{1F4BC}'));
+assertTrue(re.test('\u{1F469}\u{1F3FB}\u200D\u{1F527}'));
+assertTrue(re.test('\u{1F469}\u{1F3FB}\u200D\u{1F52C}'));
+assertTrue(re.test('\u{1F469}\u{1F3FB}\u200D\u{1F680}'));
+assertTrue(re.test('\u{1F469}\u{1F3FB}\u200D\u{1F692}'));
+assertTrue(re.test('\u{1F469}\u{1F3FB}\u200D\u{1F9AF}'));
+assertTrue(re.test('\u{1F469}\u{1F3FB}\u200D\u{1F9BC}'));
+assertTrue(re.test('\u{1F469}\u{1F3FB}\u200D\u{1F9BD}'));
+assertTrue(re.test('\u{1F469}\u{1F3FC}\u200D\u2695\uFE0F'));
+assertTrue(re.test('\u{1F469}\u{1F3FC}\u200D\u2696\uFE0F'));
+assertTrue(re.test('\u{1F469}\u{1F3FC}\u200D\u2708\uFE0F'));
+assertTrue(re.test('\u{1F469}\u{1F3FC}\u200D\u{1F33E}'));
+assertTrue(re.test('\u{1F469}\u{1F3FC}\u200D\u{1F373}'));
+assertTrue(re.test('\u{1F469}\u{1F3FC}\u200D\u{1F393}'));
+assertTrue(re.test('\u{1F469}\u{1F3FC}\u200D\u{1F3A4}'));
+assertTrue(re.test('\u{1F469}\u{1F3FC}\u200D\u{1F3A8}'));
+assertTrue(re.test('\u{1F469}\u{1F3FC}\u200D\u{1F3EB}'));
+assertTrue(re.test('\u{1F469}\u{1F3FC}\u200D\u{1F3ED}'));
+assertTrue(re.test('\u{1F469}\u{1F3FC}\u200D\u{1F4BB}'));
+assertTrue(re.test('\u{1F469}\u{1F3FC}\u200D\u{1F4BC}'));
+assertTrue(re.test('\u{1F469}\u{1F3FC}\u200D\u{1F527}'));
+assertTrue(re.test('\u{1F469}\u{1F3FC}\u200D\u{1F52C}'));
+assertTrue(re.test('\u{1F469}\u{1F3FC}\u200D\u{1F680}'));
+assertTrue(re.test('\u{1F469}\u{1F3FC}\u200D\u{1F692}'));
+assertTrue(re.test('\u{1F469}\u{1F3FC}\u200D\u{1F9AF}'));
+assertTrue(re.test('\u{1F469}\u{1F3FC}\u200D\u{1F9BC}'));
+assertTrue(re.test('\u{1F469}\u{1F3FC}\u200D\u{1F9BD}'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}\u200D\u2695\uFE0F'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}\u200D\u2696\uFE0F'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}\u200D\u2708\uFE0F'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}\u200D\u{1F33E}'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}\u200D\u{1F373}'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}\u200D\u{1F393}'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}\u200D\u{1F3A4}'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}\u200D\u{1F3A8}'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}\u200D\u{1F3EB}'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}\u200D\u{1F3ED}'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}\u200D\u{1F4BB}'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}\u200D\u{1F4BC}'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}\u200D\u{1F527}'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}\u200D\u{1F52C}'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}\u200D\u{1F680}'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}\u200D\u{1F692}'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}\u200D\u{1F9AF}'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}\u200D\u{1F9BC}'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}\u200D\u{1F9BD}'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u2695\uFE0F'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u2696\uFE0F'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u2708\uFE0F'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u{1F33E}'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u{1F373}'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u{1F393}'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u{1F3A4}'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u{1F3A8}'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u{1F3EB}'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u{1F3ED}'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u{1F4BB}'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u{1F4BC}'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u{1F527}'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u{1F52C}'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u{1F680}'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u{1F692}'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u{1F9AF}'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u{1F9BC}'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u{1F9BD}'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u2695\uFE0F'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u2696\uFE0F'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u2708\uFE0F'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u{1F33E}'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u{1F373}'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u{1F393}'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u{1F3A4}'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u{1F3A8}'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u{1F3EB}'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u{1F3ED}'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u{1F4BB}'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u{1F4BC}'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u{1F527}'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u{1F52C}'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u{1F680}'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u{1F692}'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u{1F9AF}'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u{1F9BC}'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u{1F9BD}'));
+assertTrue(re.test('\u26F9\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u26F9\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u26F9\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u26F9\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u26F9\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u26F9\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u26F9\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u26F9\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u26F9\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u26F9\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u26F9\uFE0F\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u26F9\uFE0F\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3C3}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3C3}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3C3}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3C3}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3C3}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3C3}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3C3}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3C3}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3C3}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3C3}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3C3}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3C3}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3C4}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3C4}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3C4}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3C4}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3C4}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3C4}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3C4}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3C4}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3C4}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3C4}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3C4}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3C4}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3CA}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3CA}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3CA}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3CA}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3CA}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3CA}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3CA}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3CA}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3CA}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3CA}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3CA}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3CA}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3CB}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3CB}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3CB}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3CB}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3CB}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3CB}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3CB}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3CB}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3CB}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3CB}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3CB}\uFE0F\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3CB}\uFE0F\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3CC}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3CC}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3CC}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3CC}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3CC}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3CC}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3CC}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3CC}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3CC}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3CC}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F3CC}\uFE0F\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F3CC}\uFE0F\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F46E}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F46E}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F46E}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F46E}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F46E}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F46E}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F46E}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F46E}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F46E}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F46E}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F46E}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F46E}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F46F}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F46F}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F471}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F471}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F471}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F471}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F471}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F471}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F471}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F471}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F471}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F471}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F471}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F471}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F473}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F473}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F473}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F473}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F473}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F473}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F473}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F473}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F473}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F473}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F473}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F473}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F477}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F477}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F477}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F477}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F477}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F477}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F477}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F477}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F477}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F477}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F477}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F477}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F481}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F481}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F481}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F481}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F481}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F481}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F481}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F481}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F481}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F481}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F481}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F481}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F482}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F482}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F468}\u200D\u2764\uFE0F\u200D\u{1F48B}\u200D\u{1F468}'));
+assertTrue(re.test('\u{1F482}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F482}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F482}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F482}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F482}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F482}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F482}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F482}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F482}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F486}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F486}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F486}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F486}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F486}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F486}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F486}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F486}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F486}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F486}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F486}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F486}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F487}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F487}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F487}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F487}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F487}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F487}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F487}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F487}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F487}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F487}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F487}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F487}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F575}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F575}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F575}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F575}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F575}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F575}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F575}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F575}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F575}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F575}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F575}\uFE0F\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F575}\uFE0F\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F645}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F645}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F645}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F645}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F645}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F645}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F645}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F645}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F645}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F645}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F645}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F645}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F646}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F646}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F646}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F646}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F646}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F646}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F646}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F646}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F646}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F646}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F646}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F646}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F647}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F647}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F647}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F647}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F647}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F647}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F647}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F647}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F647}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F647}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F647}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F647}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F64B}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F64B}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F64B}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F64B}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F64B}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F64B}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F64B}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F64B}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F64B}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F64B}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F64B}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F64B}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F64D}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F64D}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F64D}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F64D}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F64D}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F64D}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F64D}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F64D}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F64D}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F64D}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F64D}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F64D}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F64E}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F64E}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F64E}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F64E}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F64E}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F64E}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F64E}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F64E}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F64E}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F64E}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F64E}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F64E}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F6A3}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F6A3}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F6A3}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F6A3}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F6A3}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F6A3}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F6A3}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F6A3}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F6A3}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F6A3}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F6A3}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F6A3}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F6B4}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F6B4}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F6B4}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F6B4}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F6B4}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F6B4}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F6B4}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F6B4}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F6B4}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F6B4}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F6B4}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F6B4}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F6B5}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F6B5}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F6B5}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F6B5}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F6B5}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F6B5}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F6B5}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F6B5}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F6B5}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F6B5}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F6B5}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F6B5}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F6B6}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F6B6}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F6B6}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F6B6}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F6B6}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F6B6}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F6B6}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F6B6}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F6B6}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F6B6}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F6B6}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F6B6}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F926}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F926}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F926}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F926}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F926}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F926}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F926}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F926}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F926}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F926}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F926}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F926}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F937}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F937}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F937}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F937}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F937}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F937}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F937}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F937}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F937}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F937}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F937}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F937}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F938}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F938}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F938}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F938}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F938}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F938}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F938}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F938}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F938}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F938}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F938}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F938}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F939}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F939}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F939}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F939}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F939}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F939}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F939}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F939}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F939}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F939}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F939}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F939}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F93C}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F93C}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F93D}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F93D}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F93D}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F93D}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F93D}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F93D}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F93D}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F93D}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F93D}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F93D}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F93D}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F93D}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F93E}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F93E}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F93E}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F93E}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F93E}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F93E}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F93E}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F93E}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F93E}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F93E}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F93E}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F93E}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9B8}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9B8}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9B8}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9B8}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9B8}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9B8}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9B8}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9B8}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9B8}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9B8}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9B8}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9B8}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9B9}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9B9}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9B9}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9B9}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9B9}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9B9}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9B9}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9B9}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9B9}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9B9}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9B9}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9B9}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9CD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9CD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9CD}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9CD}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9CD}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9CD}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9CD}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9CD}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9CD}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9CD}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9CD}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9CD}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9CE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9CE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9CE}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9CE}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9CE}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9CE}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9CE}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9CE}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9CE}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9CE}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9CE}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9CE}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9CF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9CF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9CF}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9CF}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9CF}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9CF}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9CF}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9CF}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9CF}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9CF}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9CF}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9CF}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9D6}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9D6}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9D6}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9D6}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9D6}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9D6}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9D6}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9D6}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9D6}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9D6}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9D6}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9D6}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9D7}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9D7}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9D7}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9D7}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9D7}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9D7}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9D7}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9D7}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9D7}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9D7}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9D7}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9D7}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9D8}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9D8}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9D8}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9D8}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9D8}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9D8}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9D8}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9D8}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9D8}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9D8}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9D8}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9D8}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9D9}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9D9}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9D9}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9D9}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9D9}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9D9}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9D9}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9D9}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9D9}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9D9}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9D9}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9D9}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9DA}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9DA}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9DA}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9DA}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9DA}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9DA}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9DA}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9DA}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9DA}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9DA}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9DA}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9DA}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9DB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9DB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9DB}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9DB}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9DB}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9DB}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9DB}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9DB}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9DB}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9DB}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9DB}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9DB}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9DC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9DC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9DC}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9DC}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9DC}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9DC}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9DC}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9DC}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9DC}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9DC}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9DC}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9DC}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9DD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9DD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9DD}\u{1F3FB}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9DD}\u{1F3FB}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9DD}\u{1F3FC}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9DD}\u{1F3FC}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9DD}\u{1F3FD}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9DD}\u{1F3FD}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9DD}\u{1F3FE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9DD}\u{1F3FE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9DD}\u{1F3FF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9DD}\u{1F3FF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9DE}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9DE}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F9DF}\u200D\u2640\uFE0F'));
+assertTrue(re.test('\u{1F9DF}\u200D\u2642\uFE0F'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F9B0}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F9B1}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F9B2}'));
+assertTrue(re.test('\u{1F468}\u200D\u{1F9B3}'));
+assertTrue(re.test('\u{1F468}\u{1F3FB}\u200D\u{1F9B0}'));
+assertTrue(re.test('\u{1F468}\u{1F3FB}\u200D\u{1F9B1}'));
+assertTrue(re.test('\u{1F468}\u{1F3FB}\u200D\u{1F9B2}'));
+assertTrue(re.test('\u{1F468}\u{1F3FB}\u200D\u{1F9B3}'));
+assertTrue(re.test('\u{1F468}\u{1F3FC}\u200D\u{1F9B0}'));
+assertTrue(re.test('\u{1F468}\u{1F3FC}\u200D\u{1F9B1}'));
+assertTrue(re.test('\u{1F468}\u{1F3FC}\u200D\u{1F9B2}'));
+assertTrue(re.test('\u{1F468}\u{1F3FC}\u200D\u{1F9B3}'));
+assertTrue(re.test('\u{1F468}\u{1F3FD}\u200D\u{1F9B0}'));
+assertTrue(re.test('\u{1F468}\u{1F3FD}\u200D\u{1F9B1}'));
+assertTrue(re.test('\u{1F468}\u{1F3FD}\u200D\u{1F9B2}'));
+assertTrue(re.test('\u{1F468}\u{1F3FD}\u200D\u{1F9B3}'));
+assertTrue(re.test('\u{1F468}\u{1F3FE}\u200D\u{1F9B0}'));
+assertTrue(re.test('\u{1F468}\u{1F3FE}\u200D\u{1F9B1}'));
+assertTrue(re.test('\u{1F468}\u{1F3FE}\u200D\u{1F9B2}'));
+assertTrue(re.test('\u{1F468}\u{1F3FE}\u200D\u{1F9B3}'));
+assertTrue(re.test('\u{1F468}\u{1F3FF}\u200D\u{1F9B0}'));
+assertTrue(re.test('\u{1F468}\u{1F3FF}\u200D\u{1F9B1}'));
+assertTrue(re.test('\u{1F468}\u{1F3FF}\u200D\u{1F9B2}'));
+assertTrue(re.test('\u{1F468}\u{1F3FF}\u200D\u{1F9B3}'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F9B0}'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F9B1}'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F9B2}'));
+assertTrue(re.test('\u{1F469}\u200D\u{1F9B3}'));
+assertTrue(re.test('\u{1F469}\u{1F3FB}\u200D\u{1F9B0}'));
+assertTrue(re.test('\u{1F469}\u{1F3FB}\u200D\u{1F9B1}'));
+assertTrue(re.test('\u{1F469}\u{1F3FB}\u200D\u{1F9B2}'));
+assertTrue(re.test('\u{1F469}\u{1F3FB}\u200D\u{1F9B3}'));
+assertTrue(re.test('\u{1F469}\u{1F3FC}\u200D\u{1F9B0}'));
+assertTrue(re.test('\u{1F469}\u{1F3FC}\u200D\u{1F9B1}'));
+assertTrue(re.test('\u{1F469}\u{1F3FC}\u200D\u{1F9B2}'));
+assertTrue(re.test('\u{1F469}\u{1F3FC}\u200D\u{1F9B3}'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}\u200D\u{1F9B0}'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}\u200D\u{1F9B1}'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}\u200D\u{1F9B2}'));
+assertTrue(re.test('\u{1F469}\u{1F3FD}\u200D\u{1F9B3}'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u{1F9B0}'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u{1F9B1}'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u{1F9B2}'));
+assertTrue(re.test('\u{1F469}\u{1F3FE}\u200D\u{1F9B3}'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u{1F9B0}'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u{1F9B1}'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u{1F9B2}'));
+assertTrue(re.test('\u{1F469}\u{1F3FF}\u200D\u{1F9B3}'));
+assertTrue(re.test('\u{1F3F3}\uFE0F\u200D\u{1F308}'));
+assertTrue(re.test('\u{1F3F4}\u200D\u2620\uFE0F'));
+assertTrue(re.test('\u{1F415}\u200D\u{1F9BA}'));
+assertTrue(re.test('\u{1F482}\u{1F3FB}\u200D\u2640\uFE0F'));
diff --git a/src/v8/test/mjsunit/harmony/regexp-property-enumerated.js b/src/v8/test/mjsunit/harmony/regexp-property-enumerated.js
index e1db74c..c58d2ae 100644
--- a/src/v8/test/mjsunit/harmony/regexp-property-enumerated.js
+++ b/src/v8/test/mjsunit/harmony/regexp-property-enumerated.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
-
 assertThrows("/\\p{Bidi_Class=L}+/u");
 assertThrows("/\\p{bc=Left_To_Right}+/u");
 assertThrows("/\\p{bc=AL}+/u");
diff --git a/src/v8/test/mjsunit/harmony/regexp-property-exact-match.js b/src/v8/test/mjsunit/harmony/regexp-property-exact-match.js
index 09d129e..d192f46 100644
--- a/src/v8/test/mjsunit/harmony/regexp-property-exact-match.js
+++ b/src/v8/test/mjsunit/harmony/regexp-property-exact-match.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
-
 assertThrows("/\\p{In CJK}/u");
 assertThrows("/\\p{InCJKUnifiedIdeographs}/u");
 assertThrows("/\\p{InCJK}/u");
diff --git a/src/v8/test/mjsunit/harmony/regexp-property-general-category.js b/src/v8/test/mjsunit/harmony/regexp-property-general-category.js
index 3d514b0..fe39441 100644
--- a/src/v8/test/mjsunit/harmony/regexp-property-general-category.js
+++ b/src/v8/test/mjsunit/harmony/regexp-property-general-category.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
-
 assertThrows("/\\p/u");
 assertThrows("/\\p{garbage}/u");
 assertThrows("/\\p{}/u");
diff --git a/src/v8/test/mjsunit/harmony/regexp-property-invalid.js b/src/v8/test/mjsunit/harmony/regexp-property-invalid.js
index 56c27ba..7fef5df 100644
--- a/src/v8/test/mjsunit/harmony/regexp-property-invalid.js
+++ b/src/v8/test/mjsunit/harmony/regexp-property-invalid.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
-
 assertThrows("/\p{Block=ASCII}+/u");
 assertThrows("/\p{Block=ASCII}+/u");
 assertThrows("/\p{Block=Basic_Latin}+/u");
@@ -36,3 +34,5 @@
 assertThrows("/\\pI/u");
 assertThrows("/\\p{I}/u");
 assertThrows("/\\p{CJK}/u");
+
+assertThrows("/\\p{}/u");
diff --git a/src/v8/test/mjsunit/harmony/regexp-property-lu-ui0.js b/src/v8/test/mjsunit/harmony/regexp-property-lu-ui0.js
index 27911e7..45aeb3f 100644
--- a/src/v8/test/mjsunit/harmony/regexp-property-lu-ui0.js
+++ b/src/v8/test/mjsunit/harmony/regexp-property-lu-ui0.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
 // Files: test/mjsunit/harmony/regexp-property-lu-ui.js
 
 testCodePointRange(0);
diff --git a/src/v8/test/mjsunit/harmony/regexp-property-lu-ui1.js b/src/v8/test/mjsunit/harmony/regexp-property-lu-ui1.js
index e0177b8..2cfad37 100644
--- a/src/v8/test/mjsunit/harmony/regexp-property-lu-ui1.js
+++ b/src/v8/test/mjsunit/harmony/regexp-property-lu-ui1.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
 // Files: test/mjsunit/harmony/regexp-property-lu-ui.js
 
 testCodePointRange(1);
diff --git a/src/v8/test/mjsunit/harmony/regexp-property-lu-ui2.js b/src/v8/test/mjsunit/harmony/regexp-property-lu-ui2.js
index 7a916b0..2d24575 100644
--- a/src/v8/test/mjsunit/harmony/regexp-property-lu-ui2.js
+++ b/src/v8/test/mjsunit/harmony/regexp-property-lu-ui2.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
 // Files: test/mjsunit/harmony/regexp-property-lu-ui.js
 
 testCodePointRange(2);
diff --git a/src/v8/test/mjsunit/harmony/regexp-property-lu-ui3.js b/src/v8/test/mjsunit/harmony/regexp-property-lu-ui3.js
index 51cf522..788ab7d 100644
--- a/src/v8/test/mjsunit/harmony/regexp-property-lu-ui3.js
+++ b/src/v8/test/mjsunit/harmony/regexp-property-lu-ui3.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
 // Files: test/mjsunit/harmony/regexp-property-lu-ui.js
 
 testCodePointRange(3);
diff --git a/src/v8/test/mjsunit/harmony/regexp-property-lu-ui4.js b/src/v8/test/mjsunit/harmony/regexp-property-lu-ui4.js
index ab22e7f..0d5f5d7 100644
--- a/src/v8/test/mjsunit/harmony/regexp-property-lu-ui4.js
+++ b/src/v8/test/mjsunit/harmony/regexp-property-lu-ui4.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
 // Files: test/mjsunit/harmony/regexp-property-lu-ui.js
 
 testCodePointRange(4);
diff --git a/src/v8/test/mjsunit/harmony/regexp-property-lu-ui5.js b/src/v8/test/mjsunit/harmony/regexp-property-lu-ui5.js
index 668ddbf..3d8bb81 100644
--- a/src/v8/test/mjsunit/harmony/regexp-property-lu-ui5.js
+++ b/src/v8/test/mjsunit/harmony/regexp-property-lu-ui5.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
 // Files: test/mjsunit/harmony/regexp-property-lu-ui.js
 
 testCodePointRange(5);
diff --git a/src/v8/test/mjsunit/harmony/regexp-property-lu-ui6.js b/src/v8/test/mjsunit/harmony/regexp-property-lu-ui6.js
index 51669e1..267c375 100644
--- a/src/v8/test/mjsunit/harmony/regexp-property-lu-ui6.js
+++ b/src/v8/test/mjsunit/harmony/regexp-property-lu-ui6.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
 // Files: test/mjsunit/harmony/regexp-property-lu-ui.js
 
 testCodePointRange(6);
diff --git a/src/v8/test/mjsunit/harmony/regexp-property-lu-ui7.js b/src/v8/test/mjsunit/harmony/regexp-property-lu-ui7.js
index 68f3e0f..463d1cd 100644
--- a/src/v8/test/mjsunit/harmony/regexp-property-lu-ui7.js
+++ b/src/v8/test/mjsunit/harmony/regexp-property-lu-ui7.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
 // Files: test/mjsunit/harmony/regexp-property-lu-ui.js
 
 testCodePointRange(7);
diff --git a/src/v8/test/mjsunit/harmony/regexp-property-lu-ui8.js b/src/v8/test/mjsunit/harmony/regexp-property-lu-ui8.js
index b38abe2..f4bba8d 100644
--- a/src/v8/test/mjsunit/harmony/regexp-property-lu-ui8.js
+++ b/src/v8/test/mjsunit/harmony/regexp-property-lu-ui8.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
 // Files: test/mjsunit/harmony/regexp-property-lu-ui.js
 
 testCodePointRange(8);
diff --git a/src/v8/test/mjsunit/harmony/regexp-property-lu-ui9.js b/src/v8/test/mjsunit/harmony/regexp-property-lu-ui9.js
index 5c9ca06..7eb4b31 100644
--- a/src/v8/test/mjsunit/harmony/regexp-property-lu-ui9.js
+++ b/src/v8/test/mjsunit/harmony/regexp-property-lu-ui9.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
 // Files: test/mjsunit/harmony/regexp-property-lu-ui.js
 
 testCodePointRange(9);
diff --git a/src/v8/test/mjsunit/harmony/regexp-property-script-extensions.js b/src/v8/test/mjsunit/harmony/regexp-property-script-extensions.js
index e208c99..149ee90 100644
--- a/src/v8/test/mjsunit/harmony/regexp-property-script-extensions.js
+++ b/src/v8/test/mjsunit/harmony/regexp-property-script-extensions.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
-
 function t(re, s) { assertTrue(re.test(s)); }
 function f(re, s) { assertFalse(re.test(s)); }
 
@@ -25,7 +23,7 @@
 f(/\p{Script=Cypriot}+/u, "\u{10107}");
 f(/\p{scx=Cprt}+/u, "\u3003");
 
-/* Auto-generated from unicode data file using following script
+/* Auto-generated from Unicode data file using following script
 let data = read("ScriptExtensions.txt");
 let map = new Map();
 for (let line of data.split("\n")) {
@@ -45,10 +43,6 @@
 for (let s of map.keys()){
   let codepoints = map.get(s);
   print(`// Script_Extension=${s}`);
-  for (let c of codepoints.values()) {
-    print(`t(/\\p{scx=${s}}/u, "\\u{${c.toString(16)}}");`);
-    print(`f(/\\P{scx=${s}}/u, "\\u{${c.toString(16)}}");`);
-  }
   for (let i = 0; i < 5;) {
     let c = (Math.random() * 0x110000) | 0;
     if (codepoints.has(c)) continue;
@@ -58,2764 +52,384 @@
 }
 */
 
-// Unicode version 9.0.0
-// Script_Extension=Deva
-t(/\p{scx=Deva}/u, "\u{1cd1}");
-f(/\P{scx=Deva}/u, "\u{1cd1}");
-t(/\p{scx=Deva}/u, "\u{1cd4}");
-f(/\P{scx=Deva}/u, "\u{1cd4}");
-t(/\p{scx=Deva}/u, "\u{1cd5}");
-f(/\P{scx=Deva}/u, "\u{1cd5}");
-t(/\p{scx=Deva}/u, "\u{1cd6}");
-f(/\P{scx=Deva}/u, "\u{1cd6}");
-t(/\p{scx=Deva}/u, "\u{1cd8}");
-f(/\P{scx=Deva}/u, "\u{1cd8}");
-t(/\p{scx=Deva}/u, "\u{1cdb}");
-f(/\P{scx=Deva}/u, "\u{1cdb}");
-t(/\p{scx=Deva}/u, "\u{1cde}");
-f(/\P{scx=Deva}/u, "\u{1cde}");
-t(/\p{scx=Deva}/u, "\u{1cdf}");
-f(/\P{scx=Deva}/u, "\u{1cdf}");
-t(/\p{scx=Deva}/u, "\u{1ce1}");
-f(/\P{scx=Deva}/u, "\u{1ce1}");
-t(/\p{scx=Deva}/u, "\u{1ce2}");
-f(/\P{scx=Deva}/u, "\u{1ce2}");
-t(/\p{scx=Deva}/u, "\u{1ce3}");
-f(/\P{scx=Deva}/u, "\u{1ce3}");
-t(/\p{scx=Deva}/u, "\u{1ce4}");
-f(/\P{scx=Deva}/u, "\u{1ce4}");
-t(/\p{scx=Deva}/u, "\u{1ce5}");
-f(/\P{scx=Deva}/u, "\u{1ce5}");
-t(/\p{scx=Deva}/u, "\u{1ce6}");
-f(/\P{scx=Deva}/u, "\u{1ce6}");
-t(/\p{scx=Deva}/u, "\u{1ce7}");
-f(/\P{scx=Deva}/u, "\u{1ce7}");
-t(/\p{scx=Deva}/u, "\u{1ce8}");
-f(/\P{scx=Deva}/u, "\u{1ce8}");
-t(/\p{scx=Deva}/u, "\u{1ce9}");
-f(/\P{scx=Deva}/u, "\u{1ce9}");
-t(/\p{scx=Deva}/u, "\u{1cea}");
-f(/\P{scx=Deva}/u, "\u{1cea}");
-t(/\p{scx=Deva}/u, "\u{1ceb}");
-f(/\P{scx=Deva}/u, "\u{1ceb}");
-t(/\p{scx=Deva}/u, "\u{1cec}");
-f(/\P{scx=Deva}/u, "\u{1cec}");
-t(/\p{scx=Deva}/u, "\u{1ced}");
-f(/\P{scx=Deva}/u, "\u{1ced}");
-t(/\p{scx=Deva}/u, "\u{1cee}");
-f(/\P{scx=Deva}/u, "\u{1cee}");
-t(/\p{scx=Deva}/u, "\u{1cef}");
-f(/\P{scx=Deva}/u, "\u{1cef}");
-t(/\p{scx=Deva}/u, "\u{1cf0}");
-f(/\P{scx=Deva}/u, "\u{1cf0}");
-t(/\p{scx=Deva}/u, "\u{1cf1}");
-f(/\P{scx=Deva}/u, "\u{1cf1}");
-t(/\p{scx=Deva}/u, "\u{1cf6}");
-f(/\P{scx=Deva}/u, "\u{1cf6}");
-t(/\p{scx=Deva}/u, "\u{a8f1}");
-f(/\P{scx=Deva}/u, "\u{a8f1}");
-t(/\p{scx=Deva}/u, "\u{1cd0}");
-f(/\P{scx=Deva}/u, "\u{1cd0}");
-t(/\p{scx=Deva}/u, "\u{1cd2}");
-f(/\P{scx=Deva}/u, "\u{1cd2}");
-t(/\p{scx=Deva}/u, "\u{1cd3}");
-f(/\P{scx=Deva}/u, "\u{1cd3}");
-t(/\p{scx=Deva}/u, "\u{1cf2}");
-f(/\P{scx=Deva}/u, "\u{1cf2}");
-t(/\p{scx=Deva}/u, "\u{1cf3}");
-f(/\P{scx=Deva}/u, "\u{1cf3}");
-t(/\p{scx=Deva}/u, "\u{1cf4}");
-f(/\P{scx=Deva}/u, "\u{1cf4}");
-t(/\p{scx=Deva}/u, "\u{1cf8}");
-f(/\P{scx=Deva}/u, "\u{1cf8}");
-t(/\p{scx=Deva}/u, "\u{1cf9}");
-f(/\P{scx=Deva}/u, "\u{1cf9}");
-t(/\p{scx=Deva}/u, "\u{1cf5}");
-f(/\P{scx=Deva}/u, "\u{1cf5}");
-t(/\p{scx=Deva}/u, "\u{1cd7}");
-f(/\P{scx=Deva}/u, "\u{1cd7}");
-t(/\p{scx=Deva}/u, "\u{1cd9}");
-f(/\P{scx=Deva}/u, "\u{1cd9}");
-t(/\p{scx=Deva}/u, "\u{1cdc}");
-f(/\P{scx=Deva}/u, "\u{1cdc}");
-t(/\p{scx=Deva}/u, "\u{1cdd}");
-f(/\P{scx=Deva}/u, "\u{1cdd}");
-t(/\p{scx=Deva}/u, "\u{1ce0}");
-f(/\P{scx=Deva}/u, "\u{1ce0}");
-t(/\p{scx=Deva}/u, "\u{a8f3}");
-f(/\P{scx=Deva}/u, "\u{a8f3}");
-t(/\p{scx=Deva}/u, "\u{20f0}");
-f(/\P{scx=Deva}/u, "\u{20f0}");
-t(/\p{scx=Deva}/u, "\u{966}");
-f(/\P{scx=Deva}/u, "\u{966}");
-t(/\p{scx=Deva}/u, "\u{967}");
-f(/\P{scx=Deva}/u, "\u{967}");
-t(/\p{scx=Deva}/u, "\u{968}");
-f(/\P{scx=Deva}/u, "\u{968}");
-t(/\p{scx=Deva}/u, "\u{969}");
-f(/\P{scx=Deva}/u, "\u{969}");
-t(/\p{scx=Deva}/u, "\u{96a}");
-f(/\P{scx=Deva}/u, "\u{96a}");
-t(/\p{scx=Deva}/u, "\u{96b}");
-f(/\P{scx=Deva}/u, "\u{96b}");
-t(/\p{scx=Deva}/u, "\u{96c}");
-f(/\P{scx=Deva}/u, "\u{96c}");
-t(/\p{scx=Deva}/u, "\u{96d}");
-f(/\P{scx=Deva}/u, "\u{96d}");
-t(/\p{scx=Deva}/u, "\u{96e}");
-f(/\P{scx=Deva}/u, "\u{96e}");
-t(/\p{scx=Deva}/u, "\u{96f}");
-f(/\P{scx=Deva}/u, "\u{96f}");
-t(/\p{scx=Deva}/u, "\u{1cda}");
-f(/\P{scx=Deva}/u, "\u{1cda}");
-t(/\p{scx=Deva}/u, "\u{a836}");
-f(/\P{scx=Deva}/u, "\u{a836}");
-t(/\p{scx=Deva}/u, "\u{a837}");
-f(/\P{scx=Deva}/u, "\u{a837}");
-t(/\p{scx=Deva}/u, "\u{a838}");
-f(/\P{scx=Deva}/u, "\u{a838}");
-t(/\p{scx=Deva}/u, "\u{a839}");
-f(/\P{scx=Deva}/u, "\u{a839}");
-t(/\p{scx=Deva}/u, "\u{a830}");
-f(/\P{scx=Deva}/u, "\u{a830}");
-t(/\p{scx=Deva}/u, "\u{a831}");
-f(/\P{scx=Deva}/u, "\u{a831}");
-t(/\p{scx=Deva}/u, "\u{a832}");
-f(/\P{scx=Deva}/u, "\u{a832}");
-t(/\p{scx=Deva}/u, "\u{a833}");
-f(/\P{scx=Deva}/u, "\u{a833}");
-t(/\p{scx=Deva}/u, "\u{a834}");
-f(/\P{scx=Deva}/u, "\u{a834}");
-t(/\p{scx=Deva}/u, "\u{a835}");
-f(/\P{scx=Deva}/u, "\u{a835}");
-t(/\p{scx=Deva}/u, "\u{952}");
-f(/\P{scx=Deva}/u, "\u{952}");
-t(/\p{scx=Deva}/u, "\u{951}");
-f(/\P{scx=Deva}/u, "\u{951}");
-t(/\p{scx=Deva}/u, "\u{964}");
-f(/\P{scx=Deva}/u, "\u{964}");
-t(/\p{scx=Deva}/u, "\u{965}");
-f(/\P{scx=Deva}/u, "\u{965}");
-f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{ce0}");
-f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{98eb0}");
-f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{1b381}");
-f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{558ed}");
-f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{36998}");
-// Script_Extension=Dupl
-t(/\p{scx=Dupl}/u, "\u{1bca0}");
-f(/\P{scx=Dupl}/u, "\u{1bca0}");
-t(/\p{scx=Dupl}/u, "\u{1bca1}");
-f(/\P{scx=Dupl}/u, "\u{1bca1}");
-t(/\p{scx=Dupl}/u, "\u{1bca2}");
-f(/\P{scx=Dupl}/u, "\u{1bca2}");
-t(/\p{scx=Dupl}/u, "\u{1bca3}");
-f(/\P{scx=Dupl}/u, "\u{1bca3}");
-f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{42ba7}");
-f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{fa669}");
-f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{8a725}");
-f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{4d069}");
-f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{b3c09}");
-// Script_Extension=Grek
-t(/\p{scx=Grek}/u, "\u{342}");
-f(/\P{scx=Grek}/u, "\u{342}");
-t(/\p{scx=Grek}/u, "\u{345}");
-f(/\P{scx=Grek}/u, "\u{345}");
-t(/\p{scx=Grek}/u, "\u{1dc0}");
-f(/\P{scx=Grek}/u, "\u{1dc0}");
-t(/\p{scx=Grek}/u, "\u{1dc1}");
-f(/\P{scx=Grek}/u, "\u{1dc1}");
-f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{dd38b}");
-f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{121bd}");
-f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{f8499}");
-f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{29b57}");
-f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{6e536}");
-// Script_Extension=Hani
-t(/\p{scx=Hani}/u, "\u{3006}");
-f(/\P{scx=Hani}/u, "\u{3006}");
-t(/\p{scx=Hani}/u, "\u{303e}");
-f(/\P{scx=Hani}/u, "\u{303e}");
-t(/\p{scx=Hani}/u, "\u{303f}");
-f(/\P{scx=Hani}/u, "\u{303f}");
-t(/\p{scx=Hani}/u, "\u{3190}");
-f(/\P{scx=Hani}/u, "\u{3190}");
-t(/\p{scx=Hani}/u, "\u{3191}");
-f(/\P{scx=Hani}/u, "\u{3191}");
-t(/\p{scx=Hani}/u, "\u{3192}");
-f(/\P{scx=Hani}/u, "\u{3192}");
-t(/\p{scx=Hani}/u, "\u{3193}");
-f(/\P{scx=Hani}/u, "\u{3193}");
-t(/\p{scx=Hani}/u, "\u{3194}");
-f(/\P{scx=Hani}/u, "\u{3194}");
-t(/\p{scx=Hani}/u, "\u{3195}");
-f(/\P{scx=Hani}/u, "\u{3195}");
-t(/\p{scx=Hani}/u, "\u{3196}");
-f(/\P{scx=Hani}/u, "\u{3196}");
-t(/\p{scx=Hani}/u, "\u{3197}");
-f(/\P{scx=Hani}/u, "\u{3197}");
-t(/\p{scx=Hani}/u, "\u{3198}");
-f(/\P{scx=Hani}/u, "\u{3198}");
-t(/\p{scx=Hani}/u, "\u{3199}");
-f(/\P{scx=Hani}/u, "\u{3199}");
-t(/\p{scx=Hani}/u, "\u{319a}");
-f(/\P{scx=Hani}/u, "\u{319a}");
-t(/\p{scx=Hani}/u, "\u{319b}");
-f(/\P{scx=Hani}/u, "\u{319b}");
-t(/\p{scx=Hani}/u, "\u{319c}");
-f(/\P{scx=Hani}/u, "\u{319c}");
-t(/\p{scx=Hani}/u, "\u{319d}");
-f(/\P{scx=Hani}/u, "\u{319d}");
-t(/\p{scx=Hani}/u, "\u{319e}");
-f(/\P{scx=Hani}/u, "\u{319e}");
-t(/\p{scx=Hani}/u, "\u{319f}");
-f(/\P{scx=Hani}/u, "\u{319f}");
-t(/\p{scx=Hani}/u, "\u{31c0}");
-f(/\P{scx=Hani}/u, "\u{31c0}");
-t(/\p{scx=Hani}/u, "\u{31c1}");
-f(/\P{scx=Hani}/u, "\u{31c1}");
-t(/\p{scx=Hani}/u, "\u{31c2}");
-f(/\P{scx=Hani}/u, "\u{31c2}");
-t(/\p{scx=Hani}/u, "\u{31c3}");
-f(/\P{scx=Hani}/u, "\u{31c3}");
-t(/\p{scx=Hani}/u, "\u{31c4}");
-f(/\P{scx=Hani}/u, "\u{31c4}");
-t(/\p{scx=Hani}/u, "\u{31c5}");
-f(/\P{scx=Hani}/u, "\u{31c5}");
-t(/\p{scx=Hani}/u, "\u{31c6}");
-f(/\P{scx=Hani}/u, "\u{31c6}");
-t(/\p{scx=Hani}/u, "\u{31c7}");
-f(/\P{scx=Hani}/u, "\u{31c7}");
-t(/\p{scx=Hani}/u, "\u{31c8}");
-f(/\P{scx=Hani}/u, "\u{31c8}");
-t(/\p{scx=Hani}/u, "\u{31c9}");
-f(/\P{scx=Hani}/u, "\u{31c9}");
-t(/\p{scx=Hani}/u, "\u{31ca}");
-f(/\P{scx=Hani}/u, "\u{31ca}");
-t(/\p{scx=Hani}/u, "\u{31cb}");
-f(/\P{scx=Hani}/u, "\u{31cb}");
-t(/\p{scx=Hani}/u, "\u{31cc}");
-f(/\P{scx=Hani}/u, "\u{31cc}");
-t(/\p{scx=Hani}/u, "\u{31cd}");
-f(/\P{scx=Hani}/u, "\u{31cd}");
-t(/\p{scx=Hani}/u, "\u{31ce}");
-f(/\P{scx=Hani}/u, "\u{31ce}");
-t(/\p{scx=Hani}/u, "\u{31cf}");
-f(/\P{scx=Hani}/u, "\u{31cf}");
-t(/\p{scx=Hani}/u, "\u{31d0}");
-f(/\P{scx=Hani}/u, "\u{31d0}");
-t(/\p{scx=Hani}/u, "\u{31d1}");
-f(/\P{scx=Hani}/u, "\u{31d1}");
-t(/\p{scx=Hani}/u, "\u{31d2}");
-f(/\P{scx=Hani}/u, "\u{31d2}");
-t(/\p{scx=Hani}/u, "\u{31d3}");
-f(/\P{scx=Hani}/u, "\u{31d3}");
-t(/\p{scx=Hani}/u, "\u{31d4}");
-f(/\P{scx=Hani}/u, "\u{31d4}");
-t(/\p{scx=Hani}/u, "\u{31d5}");
-f(/\P{scx=Hani}/u, "\u{31d5}");
-t(/\p{scx=Hani}/u, "\u{31d6}");
-f(/\P{scx=Hani}/u, "\u{31d6}");
-t(/\p{scx=Hani}/u, "\u{31d7}");
-f(/\P{scx=Hani}/u, "\u{31d7}");
-t(/\p{scx=Hani}/u, "\u{31d8}");
-f(/\P{scx=Hani}/u, "\u{31d8}");
-t(/\p{scx=Hani}/u, "\u{31d9}");
-f(/\P{scx=Hani}/u, "\u{31d9}");
-t(/\p{scx=Hani}/u, "\u{31da}");
-f(/\P{scx=Hani}/u, "\u{31da}");
-t(/\p{scx=Hani}/u, "\u{31db}");
-f(/\P{scx=Hani}/u, "\u{31db}");
-t(/\p{scx=Hani}/u, "\u{31dc}");
-f(/\P{scx=Hani}/u, "\u{31dc}");
-t(/\p{scx=Hani}/u, "\u{31dd}");
-f(/\P{scx=Hani}/u, "\u{31dd}");
-t(/\p{scx=Hani}/u, "\u{31de}");
-f(/\P{scx=Hani}/u, "\u{31de}");
-t(/\p{scx=Hani}/u, "\u{31df}");
-f(/\P{scx=Hani}/u, "\u{31df}");
-t(/\p{scx=Hani}/u, "\u{31e0}");
-f(/\P{scx=Hani}/u, "\u{31e0}");
-t(/\p{scx=Hani}/u, "\u{31e1}");
-f(/\P{scx=Hani}/u, "\u{31e1}");
-t(/\p{scx=Hani}/u, "\u{31e2}");
-f(/\P{scx=Hani}/u, "\u{31e2}");
-t(/\p{scx=Hani}/u, "\u{31e3}");
-f(/\P{scx=Hani}/u, "\u{31e3}");
-t(/\p{scx=Hani}/u, "\u{3220}");
-f(/\P{scx=Hani}/u, "\u{3220}");
-t(/\p{scx=Hani}/u, "\u{3221}");
-f(/\P{scx=Hani}/u, "\u{3221}");
-t(/\p{scx=Hani}/u, "\u{3222}");
-f(/\P{scx=Hani}/u, "\u{3222}");
-t(/\p{scx=Hani}/u, "\u{3223}");
-f(/\P{scx=Hani}/u, "\u{3223}");
-t(/\p{scx=Hani}/u, "\u{3224}");
-f(/\P{scx=Hani}/u, "\u{3224}");
-t(/\p{scx=Hani}/u, "\u{3225}");
-f(/\P{scx=Hani}/u, "\u{3225}");
-t(/\p{scx=Hani}/u, "\u{3226}");
-f(/\P{scx=Hani}/u, "\u{3226}");
-t(/\p{scx=Hani}/u, "\u{3227}");
-f(/\P{scx=Hani}/u, "\u{3227}");
-t(/\p{scx=Hani}/u, "\u{3228}");
-f(/\P{scx=Hani}/u, "\u{3228}");
-t(/\p{scx=Hani}/u, "\u{3229}");
-f(/\P{scx=Hani}/u, "\u{3229}");
-t(/\p{scx=Hani}/u, "\u{322a}");
-f(/\P{scx=Hani}/u, "\u{322a}");
-t(/\p{scx=Hani}/u, "\u{322b}");
-f(/\P{scx=Hani}/u, "\u{322b}");
-t(/\p{scx=Hani}/u, "\u{322c}");
-f(/\P{scx=Hani}/u, "\u{322c}");
-t(/\p{scx=Hani}/u, "\u{322d}");
-f(/\P{scx=Hani}/u, "\u{322d}");
-t(/\p{scx=Hani}/u, "\u{322e}");
-f(/\P{scx=Hani}/u, "\u{322e}");
-t(/\p{scx=Hani}/u, "\u{322f}");
-f(/\P{scx=Hani}/u, "\u{322f}");
-t(/\p{scx=Hani}/u, "\u{3230}");
-f(/\P{scx=Hani}/u, "\u{3230}");
-t(/\p{scx=Hani}/u, "\u{3231}");
-f(/\P{scx=Hani}/u, "\u{3231}");
-t(/\p{scx=Hani}/u, "\u{3232}");
-f(/\P{scx=Hani}/u, "\u{3232}");
-t(/\p{scx=Hani}/u, "\u{3233}");
-f(/\P{scx=Hani}/u, "\u{3233}");
-t(/\p{scx=Hani}/u, "\u{3234}");
-f(/\P{scx=Hani}/u, "\u{3234}");
-t(/\p{scx=Hani}/u, "\u{3235}");
-f(/\P{scx=Hani}/u, "\u{3235}");
-t(/\p{scx=Hani}/u, "\u{3236}");
-f(/\P{scx=Hani}/u, "\u{3236}");
-t(/\p{scx=Hani}/u, "\u{3237}");
-f(/\P{scx=Hani}/u, "\u{3237}");
-t(/\p{scx=Hani}/u, "\u{3238}");
-f(/\P{scx=Hani}/u, "\u{3238}");
-t(/\p{scx=Hani}/u, "\u{3239}");
-f(/\P{scx=Hani}/u, "\u{3239}");
-t(/\p{scx=Hani}/u, "\u{323a}");
-f(/\P{scx=Hani}/u, "\u{323a}");
-t(/\p{scx=Hani}/u, "\u{323b}");
-f(/\P{scx=Hani}/u, "\u{323b}");
-t(/\p{scx=Hani}/u, "\u{323c}");
-f(/\P{scx=Hani}/u, "\u{323c}");
-t(/\p{scx=Hani}/u, "\u{323d}");
-f(/\P{scx=Hani}/u, "\u{323d}");
-t(/\p{scx=Hani}/u, "\u{323e}");
-f(/\P{scx=Hani}/u, "\u{323e}");
-t(/\p{scx=Hani}/u, "\u{323f}");
-f(/\P{scx=Hani}/u, "\u{323f}");
-t(/\p{scx=Hani}/u, "\u{3240}");
-f(/\P{scx=Hani}/u, "\u{3240}");
-t(/\p{scx=Hani}/u, "\u{3241}");
-f(/\P{scx=Hani}/u, "\u{3241}");
-t(/\p{scx=Hani}/u, "\u{3242}");
-f(/\P{scx=Hani}/u, "\u{3242}");
-t(/\p{scx=Hani}/u, "\u{3243}");
-f(/\P{scx=Hani}/u, "\u{3243}");
-t(/\p{scx=Hani}/u, "\u{3244}");
-f(/\P{scx=Hani}/u, "\u{3244}");
-t(/\p{scx=Hani}/u, "\u{3245}");
-f(/\P{scx=Hani}/u, "\u{3245}");
-t(/\p{scx=Hani}/u, "\u{3246}");
-f(/\P{scx=Hani}/u, "\u{3246}");
-t(/\p{scx=Hani}/u, "\u{3247}");
-f(/\P{scx=Hani}/u, "\u{3247}");
-t(/\p{scx=Hani}/u, "\u{3280}");
-f(/\P{scx=Hani}/u, "\u{3280}");
-t(/\p{scx=Hani}/u, "\u{3281}");
-f(/\P{scx=Hani}/u, "\u{3281}");
-t(/\p{scx=Hani}/u, "\u{3282}");
-f(/\P{scx=Hani}/u, "\u{3282}");
-t(/\p{scx=Hani}/u, "\u{3283}");
-f(/\P{scx=Hani}/u, "\u{3283}");
-t(/\p{scx=Hani}/u, "\u{3284}");
-f(/\P{scx=Hani}/u, "\u{3284}");
-t(/\p{scx=Hani}/u, "\u{3285}");
-f(/\P{scx=Hani}/u, "\u{3285}");
-t(/\p{scx=Hani}/u, "\u{3286}");
-f(/\P{scx=Hani}/u, "\u{3286}");
-t(/\p{scx=Hani}/u, "\u{3287}");
-f(/\P{scx=Hani}/u, "\u{3287}");
-t(/\p{scx=Hani}/u, "\u{3288}");
-f(/\P{scx=Hani}/u, "\u{3288}");
-t(/\p{scx=Hani}/u, "\u{3289}");
-f(/\P{scx=Hani}/u, "\u{3289}");
-t(/\p{scx=Hani}/u, "\u{328a}");
-f(/\P{scx=Hani}/u, "\u{328a}");
-t(/\p{scx=Hani}/u, "\u{328b}");
-f(/\P{scx=Hani}/u, "\u{328b}");
-t(/\p{scx=Hani}/u, "\u{328c}");
-f(/\P{scx=Hani}/u, "\u{328c}");
-t(/\p{scx=Hani}/u, "\u{328d}");
-f(/\P{scx=Hani}/u, "\u{328d}");
-t(/\p{scx=Hani}/u, "\u{328e}");
-f(/\P{scx=Hani}/u, "\u{328e}");
-t(/\p{scx=Hani}/u, "\u{328f}");
-f(/\P{scx=Hani}/u, "\u{328f}");
-t(/\p{scx=Hani}/u, "\u{3290}");
-f(/\P{scx=Hani}/u, "\u{3290}");
-t(/\p{scx=Hani}/u, "\u{3291}");
-f(/\P{scx=Hani}/u, "\u{3291}");
-t(/\p{scx=Hani}/u, "\u{3292}");
-f(/\P{scx=Hani}/u, "\u{3292}");
-t(/\p{scx=Hani}/u, "\u{3293}");
-f(/\P{scx=Hani}/u, "\u{3293}");
-t(/\p{scx=Hani}/u, "\u{3294}");
-f(/\P{scx=Hani}/u, "\u{3294}");
-t(/\p{scx=Hani}/u, "\u{3295}");
-f(/\P{scx=Hani}/u, "\u{3295}");
-t(/\p{scx=Hani}/u, "\u{3296}");
-f(/\P{scx=Hani}/u, "\u{3296}");
-t(/\p{scx=Hani}/u, "\u{3297}");
-f(/\P{scx=Hani}/u, "\u{3297}");
-t(/\p{scx=Hani}/u, "\u{3298}");
-f(/\P{scx=Hani}/u, "\u{3298}");
-t(/\p{scx=Hani}/u, "\u{3299}");
-f(/\P{scx=Hani}/u, "\u{3299}");
-t(/\p{scx=Hani}/u, "\u{329a}");
-f(/\P{scx=Hani}/u, "\u{329a}");
-t(/\p{scx=Hani}/u, "\u{329b}");
-f(/\P{scx=Hani}/u, "\u{329b}");
-t(/\p{scx=Hani}/u, "\u{329c}");
-f(/\P{scx=Hani}/u, "\u{329c}");
-t(/\p{scx=Hani}/u, "\u{329d}");
-f(/\P{scx=Hani}/u, "\u{329d}");
-t(/\p{scx=Hani}/u, "\u{329e}");
-f(/\P{scx=Hani}/u, "\u{329e}");
-t(/\p{scx=Hani}/u, "\u{329f}");
-f(/\P{scx=Hani}/u, "\u{329f}");
-t(/\p{scx=Hani}/u, "\u{32a0}");
-f(/\P{scx=Hani}/u, "\u{32a0}");
-t(/\p{scx=Hani}/u, "\u{32a1}");
-f(/\P{scx=Hani}/u, "\u{32a1}");
-t(/\p{scx=Hani}/u, "\u{32a2}");
-f(/\P{scx=Hani}/u, "\u{32a2}");
-t(/\p{scx=Hani}/u, "\u{32a3}");
-f(/\P{scx=Hani}/u, "\u{32a3}");
-t(/\p{scx=Hani}/u, "\u{32a4}");
-f(/\P{scx=Hani}/u, "\u{32a4}");
-t(/\p{scx=Hani}/u, "\u{32a5}");
-f(/\P{scx=Hani}/u, "\u{32a5}");
-t(/\p{scx=Hani}/u, "\u{32a6}");
-f(/\P{scx=Hani}/u, "\u{32a6}");
-t(/\p{scx=Hani}/u, "\u{32a7}");
-f(/\P{scx=Hani}/u, "\u{32a7}");
-t(/\p{scx=Hani}/u, "\u{32a8}");
-f(/\P{scx=Hani}/u, "\u{32a8}");
-t(/\p{scx=Hani}/u, "\u{32a9}");
-f(/\P{scx=Hani}/u, "\u{32a9}");
-t(/\p{scx=Hani}/u, "\u{32aa}");
-f(/\P{scx=Hani}/u, "\u{32aa}");
-t(/\p{scx=Hani}/u, "\u{32ab}");
-f(/\P{scx=Hani}/u, "\u{32ab}");
-t(/\p{scx=Hani}/u, "\u{32ac}");
-f(/\P{scx=Hani}/u, "\u{32ac}");
-t(/\p{scx=Hani}/u, "\u{32ad}");
-f(/\P{scx=Hani}/u, "\u{32ad}");
-t(/\p{scx=Hani}/u, "\u{32ae}");
-f(/\P{scx=Hani}/u, "\u{32ae}");
-t(/\p{scx=Hani}/u, "\u{32af}");
-f(/\P{scx=Hani}/u, "\u{32af}");
-t(/\p{scx=Hani}/u, "\u{32b0}");
-f(/\P{scx=Hani}/u, "\u{32b0}");
-t(/\p{scx=Hani}/u, "\u{32c0}");
-f(/\P{scx=Hani}/u, "\u{32c0}");
-t(/\p{scx=Hani}/u, "\u{32c1}");
-f(/\P{scx=Hani}/u, "\u{32c1}");
-t(/\p{scx=Hani}/u, "\u{32c2}");
-f(/\P{scx=Hani}/u, "\u{32c2}");
-t(/\p{scx=Hani}/u, "\u{32c3}");
-f(/\P{scx=Hani}/u, "\u{32c3}");
-t(/\p{scx=Hani}/u, "\u{32c4}");
-f(/\P{scx=Hani}/u, "\u{32c4}");
-t(/\p{scx=Hani}/u, "\u{32c5}");
-f(/\P{scx=Hani}/u, "\u{32c5}");
-t(/\p{scx=Hani}/u, "\u{32c6}");
-f(/\P{scx=Hani}/u, "\u{32c6}");
-t(/\p{scx=Hani}/u, "\u{32c7}");
-f(/\P{scx=Hani}/u, "\u{32c7}");
-t(/\p{scx=Hani}/u, "\u{32c8}");
-f(/\P{scx=Hani}/u, "\u{32c8}");
-t(/\p{scx=Hani}/u, "\u{32c9}");
-f(/\P{scx=Hani}/u, "\u{32c9}");
-t(/\p{scx=Hani}/u, "\u{32ca}");
-f(/\P{scx=Hani}/u, "\u{32ca}");
-t(/\p{scx=Hani}/u, "\u{32cb}");
-f(/\P{scx=Hani}/u, "\u{32cb}");
-t(/\p{scx=Hani}/u, "\u{3358}");
-f(/\P{scx=Hani}/u, "\u{3358}");
-t(/\p{scx=Hani}/u, "\u{3359}");
-f(/\P{scx=Hani}/u, "\u{3359}");
-t(/\p{scx=Hani}/u, "\u{335a}");
-f(/\P{scx=Hani}/u, "\u{335a}");
-t(/\p{scx=Hani}/u, "\u{335b}");
-f(/\P{scx=Hani}/u, "\u{335b}");
-t(/\p{scx=Hani}/u, "\u{335c}");
-f(/\P{scx=Hani}/u, "\u{335c}");
-t(/\p{scx=Hani}/u, "\u{335d}");
-f(/\P{scx=Hani}/u, "\u{335d}");
-t(/\p{scx=Hani}/u, "\u{335e}");
-f(/\P{scx=Hani}/u, "\u{335e}");
-t(/\p{scx=Hani}/u, "\u{335f}");
-f(/\P{scx=Hani}/u, "\u{335f}");
-t(/\p{scx=Hani}/u, "\u{3360}");
-f(/\P{scx=Hani}/u, "\u{3360}");
-t(/\p{scx=Hani}/u, "\u{3361}");
-f(/\P{scx=Hani}/u, "\u{3361}");
-t(/\p{scx=Hani}/u, "\u{3362}");
-f(/\P{scx=Hani}/u, "\u{3362}");
-t(/\p{scx=Hani}/u, "\u{3363}");
-f(/\P{scx=Hani}/u, "\u{3363}");
-t(/\p{scx=Hani}/u, "\u{3364}");
-f(/\P{scx=Hani}/u, "\u{3364}");
-t(/\p{scx=Hani}/u, "\u{3365}");
-f(/\P{scx=Hani}/u, "\u{3365}");
-t(/\p{scx=Hani}/u, "\u{3366}");
-f(/\P{scx=Hani}/u, "\u{3366}");
-t(/\p{scx=Hani}/u, "\u{3367}");
-f(/\P{scx=Hani}/u, "\u{3367}");
-t(/\p{scx=Hani}/u, "\u{3368}");
-f(/\P{scx=Hani}/u, "\u{3368}");
-t(/\p{scx=Hani}/u, "\u{3369}");
-f(/\P{scx=Hani}/u, "\u{3369}");
-t(/\p{scx=Hani}/u, "\u{336a}");
-f(/\P{scx=Hani}/u, "\u{336a}");
-t(/\p{scx=Hani}/u, "\u{336b}");
-f(/\P{scx=Hani}/u, "\u{336b}");
-t(/\p{scx=Hani}/u, "\u{336c}");
-f(/\P{scx=Hani}/u, "\u{336c}");
-t(/\p{scx=Hani}/u, "\u{336d}");
-f(/\P{scx=Hani}/u, "\u{336d}");
-t(/\p{scx=Hani}/u, "\u{336e}");
-f(/\P{scx=Hani}/u, "\u{336e}");
-t(/\p{scx=Hani}/u, "\u{336f}");
-f(/\P{scx=Hani}/u, "\u{336f}");
-t(/\p{scx=Hani}/u, "\u{3370}");
-f(/\P{scx=Hani}/u, "\u{3370}");
-t(/\p{scx=Hani}/u, "\u{337b}");
-f(/\P{scx=Hani}/u, "\u{337b}");
-t(/\p{scx=Hani}/u, "\u{337c}");
-f(/\P{scx=Hani}/u, "\u{337c}");
-t(/\p{scx=Hani}/u, "\u{337d}");
-f(/\P{scx=Hani}/u, "\u{337d}");
-t(/\p{scx=Hani}/u, "\u{337e}");
-f(/\P{scx=Hani}/u, "\u{337e}");
-t(/\p{scx=Hani}/u, "\u{337f}");
-f(/\P{scx=Hani}/u, "\u{337f}");
-t(/\p{scx=Hani}/u, "\u{33e0}");
-f(/\P{scx=Hani}/u, "\u{33e0}");
-t(/\p{scx=Hani}/u, "\u{33e1}");
-f(/\P{scx=Hani}/u, "\u{33e1}");
-t(/\p{scx=Hani}/u, "\u{33e2}");
-f(/\P{scx=Hani}/u, "\u{33e2}");
-t(/\p{scx=Hani}/u, "\u{33e3}");
-f(/\P{scx=Hani}/u, "\u{33e3}");
-t(/\p{scx=Hani}/u, "\u{33e4}");
-f(/\P{scx=Hani}/u, "\u{33e4}");
-t(/\p{scx=Hani}/u, "\u{33e5}");
-f(/\P{scx=Hani}/u, "\u{33e5}");
-t(/\p{scx=Hani}/u, "\u{33e6}");
-f(/\P{scx=Hani}/u, "\u{33e6}");
-t(/\p{scx=Hani}/u, "\u{33e7}");
-f(/\P{scx=Hani}/u, "\u{33e7}");
-t(/\p{scx=Hani}/u, "\u{33e8}");
-f(/\P{scx=Hani}/u, "\u{33e8}");
-t(/\p{scx=Hani}/u, "\u{33e9}");
-f(/\P{scx=Hani}/u, "\u{33e9}");
-t(/\p{scx=Hani}/u, "\u{33ea}");
-f(/\P{scx=Hani}/u, "\u{33ea}");
-t(/\p{scx=Hani}/u, "\u{33eb}");
-f(/\P{scx=Hani}/u, "\u{33eb}");
-t(/\p{scx=Hani}/u, "\u{33ec}");
-f(/\P{scx=Hani}/u, "\u{33ec}");
-t(/\p{scx=Hani}/u, "\u{33ed}");
-f(/\P{scx=Hani}/u, "\u{33ed}");
-t(/\p{scx=Hani}/u, "\u{33ee}");
-f(/\P{scx=Hani}/u, "\u{33ee}");
-t(/\p{scx=Hani}/u, "\u{33ef}");
-f(/\P{scx=Hani}/u, "\u{33ef}");
-t(/\p{scx=Hani}/u, "\u{33f0}");
-f(/\P{scx=Hani}/u, "\u{33f0}");
-t(/\p{scx=Hani}/u, "\u{33f1}");
-f(/\P{scx=Hani}/u, "\u{33f1}");
-t(/\p{scx=Hani}/u, "\u{33f2}");
-f(/\P{scx=Hani}/u, "\u{33f2}");
-t(/\p{scx=Hani}/u, "\u{33f3}");
-f(/\P{scx=Hani}/u, "\u{33f3}");
-t(/\p{scx=Hani}/u, "\u{33f4}");
-f(/\P{scx=Hani}/u, "\u{33f4}");
-t(/\p{scx=Hani}/u, "\u{33f5}");
-f(/\P{scx=Hani}/u, "\u{33f5}");
-t(/\p{scx=Hani}/u, "\u{33f6}");
-f(/\P{scx=Hani}/u, "\u{33f6}");
-t(/\p{scx=Hani}/u, "\u{33f7}");
-f(/\P{scx=Hani}/u, "\u{33f7}");
-t(/\p{scx=Hani}/u, "\u{33f8}");
-f(/\P{scx=Hani}/u, "\u{33f8}");
-t(/\p{scx=Hani}/u, "\u{33f9}");
-f(/\P{scx=Hani}/u, "\u{33f9}");
-t(/\p{scx=Hani}/u, "\u{33fa}");
-f(/\P{scx=Hani}/u, "\u{33fa}");
-t(/\p{scx=Hani}/u, "\u{33fb}");
-f(/\P{scx=Hani}/u, "\u{33fb}");
-t(/\p{scx=Hani}/u, "\u{33fc}");
-f(/\P{scx=Hani}/u, "\u{33fc}");
-t(/\p{scx=Hani}/u, "\u{33fd}");
-f(/\P{scx=Hani}/u, "\u{33fd}");
-t(/\p{scx=Hani}/u, "\u{33fe}");
-f(/\P{scx=Hani}/u, "\u{33fe}");
-t(/\p{scx=Hani}/u, "\u{1d360}");
-f(/\P{scx=Hani}/u, "\u{1d360}");
-t(/\p{scx=Hani}/u, "\u{1d361}");
-f(/\P{scx=Hani}/u, "\u{1d361}");
-t(/\p{scx=Hani}/u, "\u{1d362}");
-f(/\P{scx=Hani}/u, "\u{1d362}");
-t(/\p{scx=Hani}/u, "\u{1d363}");
-f(/\P{scx=Hani}/u, "\u{1d363}");
-t(/\p{scx=Hani}/u, "\u{1d364}");
-f(/\P{scx=Hani}/u, "\u{1d364}");
-t(/\p{scx=Hani}/u, "\u{1d365}");
-f(/\P{scx=Hani}/u, "\u{1d365}");
-t(/\p{scx=Hani}/u, "\u{1d366}");
-f(/\P{scx=Hani}/u, "\u{1d366}");
-t(/\p{scx=Hani}/u, "\u{1d367}");
-f(/\P{scx=Hani}/u, "\u{1d367}");
-t(/\p{scx=Hani}/u, "\u{1d368}");
-f(/\P{scx=Hani}/u, "\u{1d368}");
-t(/\p{scx=Hani}/u, "\u{1d369}");
-f(/\P{scx=Hani}/u, "\u{1d369}");
-t(/\p{scx=Hani}/u, "\u{1d36a}");
-f(/\P{scx=Hani}/u, "\u{1d36a}");
-t(/\p{scx=Hani}/u, "\u{1d36b}");
-f(/\P{scx=Hani}/u, "\u{1d36b}");
-t(/\p{scx=Hani}/u, "\u{1d36c}");
-f(/\P{scx=Hani}/u, "\u{1d36c}");
-t(/\p{scx=Hani}/u, "\u{1d36d}");
-f(/\P{scx=Hani}/u, "\u{1d36d}");
-t(/\p{scx=Hani}/u, "\u{1d36e}");
-f(/\P{scx=Hani}/u, "\u{1d36e}");
-t(/\p{scx=Hani}/u, "\u{1d36f}");
-f(/\P{scx=Hani}/u, "\u{1d36f}");
-t(/\p{scx=Hani}/u, "\u{1d370}");
-f(/\P{scx=Hani}/u, "\u{1d370}");
-t(/\p{scx=Hani}/u, "\u{1d371}");
-f(/\P{scx=Hani}/u, "\u{1d371}");
-t(/\p{scx=Hani}/u, "\u{1f250}");
-f(/\P{scx=Hani}/u, "\u{1f250}");
-t(/\p{scx=Hani}/u, "\u{1f251}");
-f(/\P{scx=Hani}/u, "\u{1f251}");
-t(/\p{scx=Hani}/u, "\u{302a}");
-f(/\P{scx=Hani}/u, "\u{302a}");
-t(/\p{scx=Hani}/u, "\u{302b}");
-f(/\P{scx=Hani}/u, "\u{302b}");
-t(/\p{scx=Hani}/u, "\u{302c}");
-f(/\P{scx=Hani}/u, "\u{302c}");
-t(/\p{scx=Hani}/u, "\u{302d}");
-f(/\P{scx=Hani}/u, "\u{302d}");
-t(/\p{scx=Hani}/u, "\u{303c}");
-f(/\P{scx=Hani}/u, "\u{303c}");
-t(/\p{scx=Hani}/u, "\u{303d}");
-f(/\P{scx=Hani}/u, "\u{303d}");
-t(/\p{scx=Hani}/u, "\u{3003}");
-f(/\P{scx=Hani}/u, "\u{3003}");
-t(/\p{scx=Hani}/u, "\u{3013}");
-f(/\P{scx=Hani}/u, "\u{3013}");
-t(/\p{scx=Hani}/u, "\u{301c}");
-f(/\P{scx=Hani}/u, "\u{301c}");
-t(/\p{scx=Hani}/u, "\u{301d}");
-f(/\P{scx=Hani}/u, "\u{301d}");
-t(/\p{scx=Hani}/u, "\u{301e}");
-f(/\P{scx=Hani}/u, "\u{301e}");
-t(/\p{scx=Hani}/u, "\u{301f}");
-f(/\P{scx=Hani}/u, "\u{301f}");
-t(/\p{scx=Hani}/u, "\u{3030}");
-f(/\P{scx=Hani}/u, "\u{3030}");
-t(/\p{scx=Hani}/u, "\u{3037}");
-f(/\P{scx=Hani}/u, "\u{3037}");
-t(/\p{scx=Hani}/u, "\u{fe45}");
-f(/\P{scx=Hani}/u, "\u{fe45}");
-t(/\p{scx=Hani}/u, "\u{fe46}");
-f(/\P{scx=Hani}/u, "\u{fe46}");
-t(/\p{scx=Hani}/u, "\u{3001}");
-f(/\P{scx=Hani}/u, "\u{3001}");
-t(/\p{scx=Hani}/u, "\u{3002}");
-f(/\P{scx=Hani}/u, "\u{3002}");
-t(/\p{scx=Hani}/u, "\u{3008}");
-f(/\P{scx=Hani}/u, "\u{3008}");
-t(/\p{scx=Hani}/u, "\u{3009}");
-f(/\P{scx=Hani}/u, "\u{3009}");
-t(/\p{scx=Hani}/u, "\u{300a}");
-f(/\P{scx=Hani}/u, "\u{300a}");
-t(/\p{scx=Hani}/u, "\u{300b}");
-f(/\P{scx=Hani}/u, "\u{300b}");
-t(/\p{scx=Hani}/u, "\u{300c}");
-f(/\P{scx=Hani}/u, "\u{300c}");
-t(/\p{scx=Hani}/u, "\u{300d}");
-f(/\P{scx=Hani}/u, "\u{300d}");
-t(/\p{scx=Hani}/u, "\u{300e}");
-f(/\P{scx=Hani}/u, "\u{300e}");
-t(/\p{scx=Hani}/u, "\u{300f}");
-f(/\P{scx=Hani}/u, "\u{300f}");
-t(/\p{scx=Hani}/u, "\u{3010}");
-f(/\P{scx=Hani}/u, "\u{3010}");
-t(/\p{scx=Hani}/u, "\u{3011}");
-f(/\P{scx=Hani}/u, "\u{3011}");
-t(/\p{scx=Hani}/u, "\u{3014}");
-f(/\P{scx=Hani}/u, "\u{3014}");
-t(/\p{scx=Hani}/u, "\u{3015}");
-f(/\P{scx=Hani}/u, "\u{3015}");
-t(/\p{scx=Hani}/u, "\u{3016}");
-f(/\P{scx=Hani}/u, "\u{3016}");
-t(/\p{scx=Hani}/u, "\u{3017}");
-f(/\P{scx=Hani}/u, "\u{3017}");
-t(/\p{scx=Hani}/u, "\u{3018}");
-f(/\P{scx=Hani}/u, "\u{3018}");
-t(/\p{scx=Hani}/u, "\u{3019}");
-f(/\P{scx=Hani}/u, "\u{3019}");
-t(/\p{scx=Hani}/u, "\u{301a}");
-f(/\P{scx=Hani}/u, "\u{301a}");
-t(/\p{scx=Hani}/u, "\u{301b}");
-f(/\P{scx=Hani}/u, "\u{301b}");
-t(/\p{scx=Hani}/u, "\u{30fb}");
-f(/\P{scx=Hani}/u, "\u{30fb}");
-t(/\p{scx=Hani}/u, "\u{ff61}");
-f(/\P{scx=Hani}/u, "\u{ff61}");
-t(/\p{scx=Hani}/u, "\u{ff62}");
-f(/\P{scx=Hani}/u, "\u{ff62}");
-t(/\p{scx=Hani}/u, "\u{ff63}");
-f(/\P{scx=Hani}/u, "\u{ff63}");
-t(/\p{scx=Hani}/u, "\u{ff64}");
-f(/\P{scx=Hani}/u, "\u{ff64}");
-t(/\p{scx=Hani}/u, "\u{ff65}");
-f(/\P{scx=Hani}/u, "\u{ff65}");
-f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{a7c}");
-f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{9c8f4}");
-f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{54f00}");
-f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{6c549}");
-f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{c5c5}");
-// Script_Extension=Latn
-t(/\p{scx=Latn}/u, "\u{363}");
-f(/\P{scx=Latn}/u, "\u{363}");
-t(/\p{scx=Latn}/u, "\u{364}");
-f(/\P{scx=Latn}/u, "\u{364}");
-t(/\p{scx=Latn}/u, "\u{365}");
-f(/\P{scx=Latn}/u, "\u{365}");
-t(/\p{scx=Latn}/u, "\u{366}");
-f(/\P{scx=Latn}/u, "\u{366}");
-t(/\p{scx=Latn}/u, "\u{367}");
-f(/\P{scx=Latn}/u, "\u{367}");
-t(/\p{scx=Latn}/u, "\u{368}");
-f(/\P{scx=Latn}/u, "\u{368}");
-t(/\p{scx=Latn}/u, "\u{369}");
-f(/\P{scx=Latn}/u, "\u{369}");
-t(/\p{scx=Latn}/u, "\u{36a}");
-f(/\P{scx=Latn}/u, "\u{36a}");
-t(/\p{scx=Latn}/u, "\u{36b}");
-f(/\P{scx=Latn}/u, "\u{36b}");
-t(/\p{scx=Latn}/u, "\u{36c}");
-f(/\P{scx=Latn}/u, "\u{36c}");
-t(/\p{scx=Latn}/u, "\u{36d}");
-f(/\P{scx=Latn}/u, "\u{36d}");
-t(/\p{scx=Latn}/u, "\u{36e}");
-f(/\P{scx=Latn}/u, "\u{36e}");
-t(/\p{scx=Latn}/u, "\u{36f}");
-f(/\P{scx=Latn}/u, "\u{36f}");
-t(/\p{scx=Latn}/u, "\u{485}");
-f(/\P{scx=Latn}/u, "\u{485}");
-t(/\p{scx=Latn}/u, "\u{486}");
-f(/\P{scx=Latn}/u, "\u{486}");
-t(/\p{scx=Latn}/u, "\u{10fb}");
-f(/\P{scx=Latn}/u, "\u{10fb}");
-t(/\p{scx=Latn}/u, "\u{20f0}");
-f(/\P{scx=Latn}/u, "\u{20f0}");
-t(/\p{scx=Latn}/u, "\u{a92e}");
-f(/\P{scx=Latn}/u, "\u{a92e}");
-t(/\p{scx=Latn}/u, "\u{952}");
-f(/\P{scx=Latn}/u, "\u{952}");
-t(/\p{scx=Latn}/u, "\u{951}");
-f(/\P{scx=Latn}/u, "\u{951}");
-f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{fcf93}");
-f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{f40d2}");
-f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{7f2e4}");
-f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{5ccdd}");
-f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{1010dd}");
-// Script_Extension=Arab
-t(/\p{scx=Arab}/u, "\u{102e0}");
-f(/\P{scx=Arab}/u, "\u{102e0}");
-t(/\p{scx=Arab}/u, "\u{102e1}");
-f(/\P{scx=Arab}/u, "\u{102e1}");
-t(/\p{scx=Arab}/u, "\u{102e2}");
-f(/\P{scx=Arab}/u, "\u{102e2}");
-t(/\p{scx=Arab}/u, "\u{102e3}");
-f(/\P{scx=Arab}/u, "\u{102e3}");
-t(/\p{scx=Arab}/u, "\u{102e4}");
-f(/\P{scx=Arab}/u, "\u{102e4}");
-t(/\p{scx=Arab}/u, "\u{102e5}");
-f(/\P{scx=Arab}/u, "\u{102e5}");
-t(/\p{scx=Arab}/u, "\u{102e6}");
-f(/\P{scx=Arab}/u, "\u{102e6}");
-t(/\p{scx=Arab}/u, "\u{102e7}");
-f(/\P{scx=Arab}/u, "\u{102e7}");
-t(/\p{scx=Arab}/u, "\u{102e8}");
-f(/\P{scx=Arab}/u, "\u{102e8}");
-t(/\p{scx=Arab}/u, "\u{102e9}");
-f(/\P{scx=Arab}/u, "\u{102e9}");
-t(/\p{scx=Arab}/u, "\u{102ea}");
-f(/\P{scx=Arab}/u, "\u{102ea}");
-t(/\p{scx=Arab}/u, "\u{102eb}");
-f(/\P{scx=Arab}/u, "\u{102eb}");
-t(/\p{scx=Arab}/u, "\u{102ec}");
-f(/\P{scx=Arab}/u, "\u{102ec}");
-t(/\p{scx=Arab}/u, "\u{102ed}");
-f(/\P{scx=Arab}/u, "\u{102ed}");
-t(/\p{scx=Arab}/u, "\u{102ee}");
-f(/\P{scx=Arab}/u, "\u{102ee}");
-t(/\p{scx=Arab}/u, "\u{102ef}");
-f(/\P{scx=Arab}/u, "\u{102ef}");
-t(/\p{scx=Arab}/u, "\u{102f0}");
-f(/\P{scx=Arab}/u, "\u{102f0}");
-t(/\p{scx=Arab}/u, "\u{102f1}");
-f(/\P{scx=Arab}/u, "\u{102f1}");
-t(/\p{scx=Arab}/u, "\u{102f2}");
-f(/\P{scx=Arab}/u, "\u{102f2}");
-t(/\p{scx=Arab}/u, "\u{102f3}");
-f(/\P{scx=Arab}/u, "\u{102f3}");
-t(/\p{scx=Arab}/u, "\u{102f4}");
-f(/\P{scx=Arab}/u, "\u{102f4}");
-t(/\p{scx=Arab}/u, "\u{102f5}");
-f(/\P{scx=Arab}/u, "\u{102f5}");
-t(/\p{scx=Arab}/u, "\u{102f6}");
-f(/\P{scx=Arab}/u, "\u{102f6}");
-t(/\p{scx=Arab}/u, "\u{102f7}");
-f(/\P{scx=Arab}/u, "\u{102f7}");
-t(/\p{scx=Arab}/u, "\u{102f8}");
-f(/\P{scx=Arab}/u, "\u{102f8}");
-t(/\p{scx=Arab}/u, "\u{102f9}");
-f(/\P{scx=Arab}/u, "\u{102f9}");
-t(/\p{scx=Arab}/u, "\u{102fa}");
-f(/\P{scx=Arab}/u, "\u{102fa}");
-t(/\p{scx=Arab}/u, "\u{102fb}");
-f(/\P{scx=Arab}/u, "\u{102fb}");
-t(/\p{scx=Arab}/u, "\u{64b}");
-f(/\P{scx=Arab}/u, "\u{64b}");
-t(/\p{scx=Arab}/u, "\u{64c}");
-f(/\P{scx=Arab}/u, "\u{64c}");
-t(/\p{scx=Arab}/u, "\u{64d}");
-f(/\P{scx=Arab}/u, "\u{64d}");
-t(/\p{scx=Arab}/u, "\u{64e}");
-f(/\P{scx=Arab}/u, "\u{64e}");
-t(/\p{scx=Arab}/u, "\u{64f}");
-f(/\P{scx=Arab}/u, "\u{64f}");
-t(/\p{scx=Arab}/u, "\u{650}");
-f(/\P{scx=Arab}/u, "\u{650}");
-t(/\p{scx=Arab}/u, "\u{651}");
-f(/\P{scx=Arab}/u, "\u{651}");
-t(/\p{scx=Arab}/u, "\u{652}");
-f(/\P{scx=Arab}/u, "\u{652}");
-t(/\p{scx=Arab}/u, "\u{653}");
-f(/\P{scx=Arab}/u, "\u{653}");
-t(/\p{scx=Arab}/u, "\u{654}");
-f(/\P{scx=Arab}/u, "\u{654}");
-t(/\p{scx=Arab}/u, "\u{655}");
-f(/\P{scx=Arab}/u, "\u{655}");
-t(/\p{scx=Arab}/u, "\u{670}");
-f(/\P{scx=Arab}/u, "\u{670}");
-t(/\p{scx=Arab}/u, "\u{660}");
-f(/\P{scx=Arab}/u, "\u{660}");
-t(/\p{scx=Arab}/u, "\u{661}");
-f(/\P{scx=Arab}/u, "\u{661}");
-t(/\p{scx=Arab}/u, "\u{662}");
-f(/\P{scx=Arab}/u, "\u{662}");
-t(/\p{scx=Arab}/u, "\u{663}");
-f(/\P{scx=Arab}/u, "\u{663}");
-t(/\p{scx=Arab}/u, "\u{664}");
-f(/\P{scx=Arab}/u, "\u{664}");
-t(/\p{scx=Arab}/u, "\u{665}");
-f(/\P{scx=Arab}/u, "\u{665}");
-t(/\p{scx=Arab}/u, "\u{666}");
-f(/\P{scx=Arab}/u, "\u{666}");
-t(/\p{scx=Arab}/u, "\u{667}");
-f(/\P{scx=Arab}/u, "\u{667}");
-t(/\p{scx=Arab}/u, "\u{668}");
-f(/\P{scx=Arab}/u, "\u{668}");
-t(/\p{scx=Arab}/u, "\u{669}");
-f(/\P{scx=Arab}/u, "\u{669}");
-t(/\p{scx=Arab}/u, "\u{fdf2}");
-f(/\P{scx=Arab}/u, "\u{fdf2}");
-t(/\p{scx=Arab}/u, "\u{fdfd}");
-f(/\P{scx=Arab}/u, "\u{fdfd}");
-t(/\p{scx=Arab}/u, "\u{60c}");
-f(/\P{scx=Arab}/u, "\u{60c}");
-t(/\p{scx=Arab}/u, "\u{61b}");
-f(/\P{scx=Arab}/u, "\u{61b}");
-t(/\p{scx=Arab}/u, "\u{61f}");
-f(/\P{scx=Arab}/u, "\u{61f}");
-t(/\p{scx=Arab}/u, "\u{640}");
-f(/\P{scx=Arab}/u, "\u{640}");
-f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{8901f}");
-f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{91256}");
-f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{71d97}");
-f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{3c94d}");
-f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{f9299}");
-// Script_Extension=Copt
-t(/\p{scx=Copt}/u, "\u{102e0}");
-f(/\P{scx=Copt}/u, "\u{102e0}");
-t(/\p{scx=Copt}/u, "\u{102e1}");
-f(/\P{scx=Copt}/u, "\u{102e1}");
-t(/\p{scx=Copt}/u, "\u{102e2}");
-f(/\P{scx=Copt}/u, "\u{102e2}");
-t(/\p{scx=Copt}/u, "\u{102e3}");
-f(/\P{scx=Copt}/u, "\u{102e3}");
-t(/\p{scx=Copt}/u, "\u{102e4}");
-f(/\P{scx=Copt}/u, "\u{102e4}");
-t(/\p{scx=Copt}/u, "\u{102e5}");
-f(/\P{scx=Copt}/u, "\u{102e5}");
-t(/\p{scx=Copt}/u, "\u{102e6}");
-f(/\P{scx=Copt}/u, "\u{102e6}");
-t(/\p{scx=Copt}/u, "\u{102e7}");
-f(/\P{scx=Copt}/u, "\u{102e7}");
-t(/\p{scx=Copt}/u, "\u{102e8}");
-f(/\P{scx=Copt}/u, "\u{102e8}");
-t(/\p{scx=Copt}/u, "\u{102e9}");
-f(/\P{scx=Copt}/u, "\u{102e9}");
-t(/\p{scx=Copt}/u, "\u{102ea}");
-f(/\P{scx=Copt}/u, "\u{102ea}");
-t(/\p{scx=Copt}/u, "\u{102eb}");
-f(/\P{scx=Copt}/u, "\u{102eb}");
-t(/\p{scx=Copt}/u, "\u{102ec}");
-f(/\P{scx=Copt}/u, "\u{102ec}");
-t(/\p{scx=Copt}/u, "\u{102ed}");
-f(/\P{scx=Copt}/u, "\u{102ed}");
-t(/\p{scx=Copt}/u, "\u{102ee}");
-f(/\P{scx=Copt}/u, "\u{102ee}");
-t(/\p{scx=Copt}/u, "\u{102ef}");
-f(/\P{scx=Copt}/u, "\u{102ef}");
-t(/\p{scx=Copt}/u, "\u{102f0}");
-f(/\P{scx=Copt}/u, "\u{102f0}");
-t(/\p{scx=Copt}/u, "\u{102f1}");
-f(/\P{scx=Copt}/u, "\u{102f1}");
-t(/\p{scx=Copt}/u, "\u{102f2}");
-f(/\P{scx=Copt}/u, "\u{102f2}");
-t(/\p{scx=Copt}/u, "\u{102f3}");
-f(/\P{scx=Copt}/u, "\u{102f3}");
-t(/\p{scx=Copt}/u, "\u{102f4}");
-f(/\P{scx=Copt}/u, "\u{102f4}");
-t(/\p{scx=Copt}/u, "\u{102f5}");
-f(/\P{scx=Copt}/u, "\u{102f5}");
-t(/\p{scx=Copt}/u, "\u{102f6}");
-f(/\P{scx=Copt}/u, "\u{102f6}");
-t(/\p{scx=Copt}/u, "\u{102f7}");
-f(/\P{scx=Copt}/u, "\u{102f7}");
-t(/\p{scx=Copt}/u, "\u{102f8}");
-f(/\P{scx=Copt}/u, "\u{102f8}");
-t(/\p{scx=Copt}/u, "\u{102f9}");
-f(/\P{scx=Copt}/u, "\u{102f9}");
-t(/\p{scx=Copt}/u, "\u{102fa}");
-f(/\P{scx=Copt}/u, "\u{102fa}");
-t(/\p{scx=Copt}/u, "\u{102fb}");
-f(/\P{scx=Copt}/u, "\u{102fb}");
-f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{b543e}");
-f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{10ce3f}");
-f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{ea3a9}");
-f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{83f15}");
-f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{8b9a5}");
-// Script_Extension=Syrc
-t(/\p{scx=Syrc}/u, "\u{64b}");
-f(/\P{scx=Syrc}/u, "\u{64b}");
-t(/\p{scx=Syrc}/u, "\u{64c}");
-f(/\P{scx=Syrc}/u, "\u{64c}");
-t(/\p{scx=Syrc}/u, "\u{64d}");
-f(/\P{scx=Syrc}/u, "\u{64d}");
-t(/\p{scx=Syrc}/u, "\u{64e}");
-f(/\P{scx=Syrc}/u, "\u{64e}");
-t(/\p{scx=Syrc}/u, "\u{64f}");
-f(/\P{scx=Syrc}/u, "\u{64f}");
-t(/\p{scx=Syrc}/u, "\u{650}");
-f(/\P{scx=Syrc}/u, "\u{650}");
-t(/\p{scx=Syrc}/u, "\u{651}");
-f(/\P{scx=Syrc}/u, "\u{651}");
-t(/\p{scx=Syrc}/u, "\u{652}");
-f(/\P{scx=Syrc}/u, "\u{652}");
-t(/\p{scx=Syrc}/u, "\u{653}");
-f(/\P{scx=Syrc}/u, "\u{653}");
-t(/\p{scx=Syrc}/u, "\u{654}");
-f(/\P{scx=Syrc}/u, "\u{654}");
-t(/\p{scx=Syrc}/u, "\u{655}");
-f(/\P{scx=Syrc}/u, "\u{655}");
-t(/\p{scx=Syrc}/u, "\u{670}");
-f(/\P{scx=Syrc}/u, "\u{670}");
-t(/\p{scx=Syrc}/u, "\u{60c}");
-f(/\P{scx=Syrc}/u, "\u{60c}");
-t(/\p{scx=Syrc}/u, "\u{61b}");
-f(/\P{scx=Syrc}/u, "\u{61b}");
-t(/\p{scx=Syrc}/u, "\u{61f}");
-f(/\P{scx=Syrc}/u, "\u{61f}");
-t(/\p{scx=Syrc}/u, "\u{640}");
-f(/\P{scx=Syrc}/u, "\u{640}");
-f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{dab32}");
-f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{6b768}");
-f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{877e7}");
-f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{66f8b}");
-f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{12a45}");
-// Script_Extension=Thaa
-t(/\p{scx=Thaa}/u, "\u{660}");
-f(/\P{scx=Thaa}/u, "\u{660}");
-t(/\p{scx=Thaa}/u, "\u{661}");
-f(/\P{scx=Thaa}/u, "\u{661}");
-t(/\p{scx=Thaa}/u, "\u{662}");
-f(/\P{scx=Thaa}/u, "\u{662}");
-t(/\p{scx=Thaa}/u, "\u{663}");
-f(/\P{scx=Thaa}/u, "\u{663}");
-t(/\p{scx=Thaa}/u, "\u{664}");
-f(/\P{scx=Thaa}/u, "\u{664}");
-t(/\p{scx=Thaa}/u, "\u{665}");
-f(/\P{scx=Thaa}/u, "\u{665}");
-t(/\p{scx=Thaa}/u, "\u{666}");
-f(/\P{scx=Thaa}/u, "\u{666}");
-t(/\p{scx=Thaa}/u, "\u{667}");
-f(/\P{scx=Thaa}/u, "\u{667}");
-t(/\p{scx=Thaa}/u, "\u{668}");
-f(/\P{scx=Thaa}/u, "\u{668}");
-t(/\p{scx=Thaa}/u, "\u{669}");
-f(/\P{scx=Thaa}/u, "\u{669}");
-t(/\p{scx=Thaa}/u, "\u{fdf2}");
-f(/\P{scx=Thaa}/u, "\u{fdf2}");
-t(/\p{scx=Thaa}/u, "\u{fdfd}");
-f(/\P{scx=Thaa}/u, "\u{fdfd}");
-t(/\p{scx=Thaa}/u, "\u{60c}");
-f(/\P{scx=Thaa}/u, "\u{60c}");
-t(/\p{scx=Thaa}/u, "\u{61b}");
-f(/\P{scx=Thaa}/u, "\u{61b}");
-t(/\p{scx=Thaa}/u, "\u{61f}");
-f(/\P{scx=Thaa}/u, "\u{61f}");
-f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{bf3cb}");
-f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{33196}");
-f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{5bc9e}");
-f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{b350c}");
-f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{1a475}");
-// Script_Extension=Armn
-t(/\p{scx=Armn}/u, "\u{589}");
-f(/\P{scx=Armn}/u, "\u{589}");
-f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{a4bc3}");
-f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{7e5df}");
-f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{619d5}");
-f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{6299c}");
-f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{ecd52}");
-// Script_Extension=Geor
-t(/\p{scx=Geor}/u, "\u{589}");
-f(/\P{scx=Geor}/u, "\u{589}");
-t(/\p{scx=Geor}/u, "\u{10fb}");
-f(/\P{scx=Geor}/u, "\u{10fb}");
-f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{1b0d2}");
-f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{9e197}");
-f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{413c6}");
-f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{25864}");
-f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{3cec4}");
+// Unicode version 11.0.0
+// https://unicode.org/Public/10.0.0/ucd/ScriptExtensions.txt
+
 // Script_Extension=Beng
-t(/\p{scx=Beng}/u, "\u{a8f1}");
-f(/\P{scx=Beng}/u, "\u{a8f1}");
-t(/\p{scx=Beng}/u, "\u{9e6}");
-f(/\P{scx=Beng}/u, "\u{9e6}");
-t(/\p{scx=Beng}/u, "\u{9e7}");
-f(/\P{scx=Beng}/u, "\u{9e7}");
-t(/\p{scx=Beng}/u, "\u{9e8}");
-f(/\P{scx=Beng}/u, "\u{9e8}");
-t(/\p{scx=Beng}/u, "\u{9e9}");
-f(/\P{scx=Beng}/u, "\u{9e9}");
-t(/\p{scx=Beng}/u, "\u{9ea}");
-f(/\P{scx=Beng}/u, "\u{9ea}");
-t(/\p{scx=Beng}/u, "\u{9eb}");
-f(/\P{scx=Beng}/u, "\u{9eb}");
-t(/\p{scx=Beng}/u, "\u{9ec}");
-f(/\P{scx=Beng}/u, "\u{9ec}");
-t(/\p{scx=Beng}/u, "\u{9ed}");
-f(/\P{scx=Beng}/u, "\u{9ed}");
-t(/\p{scx=Beng}/u, "\u{9ee}");
-f(/\P{scx=Beng}/u, "\u{9ee}");
-t(/\p{scx=Beng}/u, "\u{9ef}");
-f(/\P{scx=Beng}/u, "\u{9ef}");
-t(/\p{scx=Beng}/u, "\u{952}");
-f(/\P{scx=Beng}/u, "\u{952}");
-t(/\p{scx=Beng}/u, "\u{951}");
-f(/\P{scx=Beng}/u, "\u{951}");
-t(/\p{scx=Beng}/u, "\u{964}");
-f(/\P{scx=Beng}/u, "\u{964}");
-t(/\p{scx=Beng}/u, "\u{965}");
-f(/\P{scx=Beng}/u, "\u{965}");
-f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{10b8e0}");
-f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{a1a3d}");
-f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{63024}");
-f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{e1e3a}");
-f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{732a7}");
+f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{e52ee}");
+f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{78b48}");
+f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{59987}");
+f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{d18a8}");
+f(/(?=\P{sc=Beng})\p{scx=Beng}/u, "\u{2b84e}");
+// Script_Extension=Deva
+f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{757f8}");
+f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{2cb44}");
+f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{7624d}");
+f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{9a219}");
+f(/(?=\P{sc=Deva})\p{scx=Deva}/u, "\u{e41a8}");
+// Script_Extension=Dupl
+f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{4ae62}");
+f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{b80a}");
+f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{c856c}");
+f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{36c5f}");
+f(/(?=\P{sc=Dupl})\p{scx=Dupl}/u, "\u{42ef3}");
+// Script_Extension=Grek
+f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{85c59}");
+f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{bd40}");
+f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{7ffef}");
+f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{b4a21}");
+f(/(?=\P{sc=Grek})\p{scx=Grek}/u, "\u{b97b3}");
+// Script_Extension=Hani
+f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{d59d4}");
+f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{8da54}");
+f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{77a36}");
+f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{8d66b}");
+f(/(?=\P{sc=Hani})\p{scx=Hani}/u, "\u{b2371}");
+// Script_Extension=Latn
+f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{10d47b}");
+f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{7a184}");
+f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{a64ac}");
+f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{ea450}");
+f(/(?=\P{sc=Latn})\p{scx=Latn}/u, "\u{ab23e}");
+// Script_Extension=Arab
+f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{43609}");
+f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{bea28}");
+f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{f9ef}");
+f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{7b3fc}");
+f(/(?=\P{sc=Arab})\p{scx=Arab}/u, "\u{3a64a}");
+// Script_Extension=Copt
+f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{a7927}");
+f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{e11a5}");
+f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{a7afe}");
+f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{68bd4}");
+f(/(?=\P{sc=Copt})\p{scx=Copt}/u, "\u{4c963}");
+// Script_Extension=Rohg
+f(/(?=\P{sc=Rohg})\p{scx=Rohg}/u, "\u{cd74e}");
+f(/(?=\P{sc=Rohg})\p{scx=Rohg}/u, "\u{c4e3c}");
+f(/(?=\P{sc=Rohg})\p{scx=Rohg}/u, "\u{1f2de}");
+f(/(?=\P{sc=Rohg})\p{scx=Rohg}/u, "\u{999ca}");
+f(/(?=\P{sc=Rohg})\p{scx=Rohg}/u, "\u{f25d9}");
+// Script_Extension=Syrc
+f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{dd913}");
+f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{81cdc}");
+f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{32fb2}");
+f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{cc6ec}");
+f(/(?=\P{sc=Syrc})\p{scx=Syrc}/u, "\u{adba2}");
+// Script_Extension=Thaa
+f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{782b1}");
+f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{ca567}");
+f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{c1506}");
+f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{e783}");
+f(/(?=\P{sc=Thaa})\p{scx=Thaa}/u, "\u{fc8e1}");
+// Script_Extension=Armn
+f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{36a6d}");
+f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{6c98}");
+f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{c4326}");
+f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{25eb6}");
+f(/(?=\P{sc=Armn})\p{scx=Armn}/u, "\u{db9d9}");
+// Script_Extension=Geor
+f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{e48f5}");
+f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{9914e}");
+f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{49dad}");
+f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{9d193}");
+f(/(?=\P{sc=Geor})\p{scx=Geor}/u, "\u{10ce35}");
 // Script_Extension=Bopo
-t(/\p{scx=Bopo}/u, "\u{302a}");
-f(/\P{scx=Bopo}/u, "\u{302a}");
-t(/\p{scx=Bopo}/u, "\u{302b}");
-f(/\P{scx=Bopo}/u, "\u{302b}");
-t(/\p{scx=Bopo}/u, "\u{302c}");
-f(/\P{scx=Bopo}/u, "\u{302c}");
-t(/\p{scx=Bopo}/u, "\u{302d}");
-f(/\P{scx=Bopo}/u, "\u{302d}");
-t(/\p{scx=Bopo}/u, "\u{3003}");
-f(/\P{scx=Bopo}/u, "\u{3003}");
-t(/\p{scx=Bopo}/u, "\u{3013}");
-f(/\P{scx=Bopo}/u, "\u{3013}");
-t(/\p{scx=Bopo}/u, "\u{301c}");
-f(/\P{scx=Bopo}/u, "\u{301c}");
-t(/\p{scx=Bopo}/u, "\u{301d}");
-f(/\P{scx=Bopo}/u, "\u{301d}");
-t(/\p{scx=Bopo}/u, "\u{301e}");
-f(/\P{scx=Bopo}/u, "\u{301e}");
-t(/\p{scx=Bopo}/u, "\u{301f}");
-f(/\P{scx=Bopo}/u, "\u{301f}");
-t(/\p{scx=Bopo}/u, "\u{3030}");
-f(/\P{scx=Bopo}/u, "\u{3030}");
-t(/\p{scx=Bopo}/u, "\u{3037}");
-f(/\P{scx=Bopo}/u, "\u{3037}");
-t(/\p{scx=Bopo}/u, "\u{fe45}");
-f(/\P{scx=Bopo}/u, "\u{fe45}");
-t(/\p{scx=Bopo}/u, "\u{fe46}");
-f(/\P{scx=Bopo}/u, "\u{fe46}");
-t(/\p{scx=Bopo}/u, "\u{3001}");
-f(/\P{scx=Bopo}/u, "\u{3001}");
-t(/\p{scx=Bopo}/u, "\u{3002}");
-f(/\P{scx=Bopo}/u, "\u{3002}");
-t(/\p{scx=Bopo}/u, "\u{3008}");
-f(/\P{scx=Bopo}/u, "\u{3008}");
-t(/\p{scx=Bopo}/u, "\u{3009}");
-f(/\P{scx=Bopo}/u, "\u{3009}");
-t(/\p{scx=Bopo}/u, "\u{300a}");
-f(/\P{scx=Bopo}/u, "\u{300a}");
-t(/\p{scx=Bopo}/u, "\u{300b}");
-f(/\P{scx=Bopo}/u, "\u{300b}");
-t(/\p{scx=Bopo}/u, "\u{300c}");
-f(/\P{scx=Bopo}/u, "\u{300c}");
-t(/\p{scx=Bopo}/u, "\u{300d}");
-f(/\P{scx=Bopo}/u, "\u{300d}");
-t(/\p{scx=Bopo}/u, "\u{300e}");
-f(/\P{scx=Bopo}/u, "\u{300e}");
-t(/\p{scx=Bopo}/u, "\u{300f}");
-f(/\P{scx=Bopo}/u, "\u{300f}");
-t(/\p{scx=Bopo}/u, "\u{3010}");
-f(/\P{scx=Bopo}/u, "\u{3010}");
-t(/\p{scx=Bopo}/u, "\u{3011}");
-f(/\P{scx=Bopo}/u, "\u{3011}");
-t(/\p{scx=Bopo}/u, "\u{3014}");
-f(/\P{scx=Bopo}/u, "\u{3014}");
-t(/\p{scx=Bopo}/u, "\u{3015}");
-f(/\P{scx=Bopo}/u, "\u{3015}");
-t(/\p{scx=Bopo}/u, "\u{3016}");
-f(/\P{scx=Bopo}/u, "\u{3016}");
-t(/\p{scx=Bopo}/u, "\u{3017}");
-f(/\P{scx=Bopo}/u, "\u{3017}");
-t(/\p{scx=Bopo}/u, "\u{3018}");
-f(/\P{scx=Bopo}/u, "\u{3018}");
-t(/\p{scx=Bopo}/u, "\u{3019}");
-f(/\P{scx=Bopo}/u, "\u{3019}");
-t(/\p{scx=Bopo}/u, "\u{301a}");
-f(/\P{scx=Bopo}/u, "\u{301a}");
-t(/\p{scx=Bopo}/u, "\u{301b}");
-f(/\P{scx=Bopo}/u, "\u{301b}");
-t(/\p{scx=Bopo}/u, "\u{30fb}");
-f(/\P{scx=Bopo}/u, "\u{30fb}");
-t(/\p{scx=Bopo}/u, "\u{ff61}");
-f(/\P{scx=Bopo}/u, "\u{ff61}");
-t(/\p{scx=Bopo}/u, "\u{ff62}");
-f(/\P{scx=Bopo}/u, "\u{ff62}");
-t(/\p{scx=Bopo}/u, "\u{ff63}");
-f(/\P{scx=Bopo}/u, "\u{ff63}");
-t(/\p{scx=Bopo}/u, "\u{ff64}");
-f(/\P{scx=Bopo}/u, "\u{ff64}");
-t(/\p{scx=Bopo}/u, "\u{ff65}");
-f(/\P{scx=Bopo}/u, "\u{ff65}");
-f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{d9494}");
-f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{c8328}");
-f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{fbf6e}");
-f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{1b8cc}");
-f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{10477}");
+f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{36ac1}");
+f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{73ae5}");
+f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{cd0a}");
+f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{bd8bd}");
+f(/(?=\P{sc=Bopo})\p{scx=Bopo}/u, "\u{eb174}");
 // Script_Extension=Bugi
-t(/\p{scx=Bugi}/u, "\u{a9cf}");
-f(/\P{scx=Bugi}/u, "\u{a9cf}");
-f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{ec046}");
-f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{a8402}");
-f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{85530}");
-f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{86942}");
-f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{c6ded}");
+f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{7dcfc}");
+f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{b17d1}");
+f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{15cb5}");
+f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{10d4f6}");
+f(/(?=\P{sc=Bugi})\p{scx=Bugi}/u, "\u{12bbe}");
 // Script_Extension=Java
-t(/\p{scx=Java}/u, "\u{a9cf}");
-f(/\P{scx=Java}/u, "\u{a9cf}");
-f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{d4343}");
-f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{6d000}");
-f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{c72a4}");
-f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{9ad6f}");
-f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{fb350}");
+f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{10f6f3}");
+f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{75579}");
+f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{b39e4}");
+f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{104b64}");
+f(/(?=\P{sc=Java})\p{scx=Java}/u, "\u{102995}");
 // Script_Extension=Cprt
-t(/\p{scx=Cprt}/u, "\u{10100}");
-f(/\P{scx=Cprt}/u, "\u{10100}");
-t(/\p{scx=Cprt}/u, "\u{10101}");
-f(/\P{scx=Cprt}/u, "\u{10101}");
-t(/\p{scx=Cprt}/u, "\u{10102}");
-f(/\P{scx=Cprt}/u, "\u{10102}");
-t(/\p{scx=Cprt}/u, "\u{10137}");
-f(/\P{scx=Cprt}/u, "\u{10137}");
-t(/\p{scx=Cprt}/u, "\u{10138}");
-f(/\P{scx=Cprt}/u, "\u{10138}");
-t(/\p{scx=Cprt}/u, "\u{10139}");
-f(/\P{scx=Cprt}/u, "\u{10139}");
-t(/\p{scx=Cprt}/u, "\u{1013a}");
-f(/\P{scx=Cprt}/u, "\u{1013a}");
-t(/\p{scx=Cprt}/u, "\u{1013b}");
-f(/\P{scx=Cprt}/u, "\u{1013b}");
-t(/\p{scx=Cprt}/u, "\u{1013c}");
-f(/\P{scx=Cprt}/u, "\u{1013c}");
-t(/\p{scx=Cprt}/u, "\u{1013d}");
-f(/\P{scx=Cprt}/u, "\u{1013d}");
-t(/\p{scx=Cprt}/u, "\u{1013e}");
-f(/\P{scx=Cprt}/u, "\u{1013e}");
-t(/\p{scx=Cprt}/u, "\u{1013f}");
-f(/\P{scx=Cprt}/u, "\u{1013f}");
-t(/\p{scx=Cprt}/u, "\u{10107}");
-f(/\P{scx=Cprt}/u, "\u{10107}");
-t(/\p{scx=Cprt}/u, "\u{10108}");
-f(/\P{scx=Cprt}/u, "\u{10108}");
-t(/\p{scx=Cprt}/u, "\u{10109}");
-f(/\P{scx=Cprt}/u, "\u{10109}");
-t(/\p{scx=Cprt}/u, "\u{1010a}");
-f(/\P{scx=Cprt}/u, "\u{1010a}");
-t(/\p{scx=Cprt}/u, "\u{1010b}");
-f(/\P{scx=Cprt}/u, "\u{1010b}");
-t(/\p{scx=Cprt}/u, "\u{1010c}");
-f(/\P{scx=Cprt}/u, "\u{1010c}");
-t(/\p{scx=Cprt}/u, "\u{1010d}");
-f(/\P{scx=Cprt}/u, "\u{1010d}");
-t(/\p{scx=Cprt}/u, "\u{1010e}");
-f(/\P{scx=Cprt}/u, "\u{1010e}");
-t(/\p{scx=Cprt}/u, "\u{1010f}");
-f(/\P{scx=Cprt}/u, "\u{1010f}");
-t(/\p{scx=Cprt}/u, "\u{10110}");
-f(/\P{scx=Cprt}/u, "\u{10110}");
-t(/\p{scx=Cprt}/u, "\u{10111}");
-f(/\P{scx=Cprt}/u, "\u{10111}");
-t(/\p{scx=Cprt}/u, "\u{10112}");
-f(/\P{scx=Cprt}/u, "\u{10112}");
-t(/\p{scx=Cprt}/u, "\u{10113}");
-f(/\P{scx=Cprt}/u, "\u{10113}");
-t(/\p{scx=Cprt}/u, "\u{10114}");
-f(/\P{scx=Cprt}/u, "\u{10114}");
-t(/\p{scx=Cprt}/u, "\u{10115}");
-f(/\P{scx=Cprt}/u, "\u{10115}");
-t(/\p{scx=Cprt}/u, "\u{10116}");
-f(/\P{scx=Cprt}/u, "\u{10116}");
-t(/\p{scx=Cprt}/u, "\u{10117}");
-f(/\P{scx=Cprt}/u, "\u{10117}");
-t(/\p{scx=Cprt}/u, "\u{10118}");
-f(/\P{scx=Cprt}/u, "\u{10118}");
-t(/\p{scx=Cprt}/u, "\u{10119}");
-f(/\P{scx=Cprt}/u, "\u{10119}");
-t(/\p{scx=Cprt}/u, "\u{1011a}");
-f(/\P{scx=Cprt}/u, "\u{1011a}");
-t(/\p{scx=Cprt}/u, "\u{1011b}");
-f(/\P{scx=Cprt}/u, "\u{1011b}");
-t(/\p{scx=Cprt}/u, "\u{1011c}");
-f(/\P{scx=Cprt}/u, "\u{1011c}");
-t(/\p{scx=Cprt}/u, "\u{1011d}");
-f(/\P{scx=Cprt}/u, "\u{1011d}");
-t(/\p{scx=Cprt}/u, "\u{1011e}");
-f(/\P{scx=Cprt}/u, "\u{1011e}");
-t(/\p{scx=Cprt}/u, "\u{1011f}");
-f(/\P{scx=Cprt}/u, "\u{1011f}");
-t(/\p{scx=Cprt}/u, "\u{10120}");
-f(/\P{scx=Cprt}/u, "\u{10120}");
-t(/\p{scx=Cprt}/u, "\u{10121}");
-f(/\P{scx=Cprt}/u, "\u{10121}");
-t(/\p{scx=Cprt}/u, "\u{10122}");
-f(/\P{scx=Cprt}/u, "\u{10122}");
-t(/\p{scx=Cprt}/u, "\u{10123}");
-f(/\P{scx=Cprt}/u, "\u{10123}");
-t(/\p{scx=Cprt}/u, "\u{10124}");
-f(/\P{scx=Cprt}/u, "\u{10124}");
-t(/\p{scx=Cprt}/u, "\u{10125}");
-f(/\P{scx=Cprt}/u, "\u{10125}");
-t(/\p{scx=Cprt}/u, "\u{10126}");
-f(/\P{scx=Cprt}/u, "\u{10126}");
-t(/\p{scx=Cprt}/u, "\u{10127}");
-f(/\P{scx=Cprt}/u, "\u{10127}");
-t(/\p{scx=Cprt}/u, "\u{10128}");
-f(/\P{scx=Cprt}/u, "\u{10128}");
-t(/\p{scx=Cprt}/u, "\u{10129}");
-f(/\P{scx=Cprt}/u, "\u{10129}");
-t(/\p{scx=Cprt}/u, "\u{1012a}");
-f(/\P{scx=Cprt}/u, "\u{1012a}");
-t(/\p{scx=Cprt}/u, "\u{1012b}");
-f(/\P{scx=Cprt}/u, "\u{1012b}");
-t(/\p{scx=Cprt}/u, "\u{1012c}");
-f(/\P{scx=Cprt}/u, "\u{1012c}");
-t(/\p{scx=Cprt}/u, "\u{1012d}");
-f(/\P{scx=Cprt}/u, "\u{1012d}");
-t(/\p{scx=Cprt}/u, "\u{1012e}");
-f(/\P{scx=Cprt}/u, "\u{1012e}");
-t(/\p{scx=Cprt}/u, "\u{1012f}");
-f(/\P{scx=Cprt}/u, "\u{1012f}");
-t(/\p{scx=Cprt}/u, "\u{10130}");
-f(/\P{scx=Cprt}/u, "\u{10130}");
-t(/\p{scx=Cprt}/u, "\u{10131}");
-f(/\P{scx=Cprt}/u, "\u{10131}");
-t(/\p{scx=Cprt}/u, "\u{10132}");
-f(/\P{scx=Cprt}/u, "\u{10132}");
-t(/\p{scx=Cprt}/u, "\u{10133}");
-f(/\P{scx=Cprt}/u, "\u{10133}");
-f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{27a83}");
-f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{172f5}");
-f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{6ef51}");
-f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{7837}");
-f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{c5ce1}");
+f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{46b94}");
+f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{3eaa1}");
+f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{3dd9a}");
+f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{c3e90}");
+f(/(?=\P{sc=Cprt})\p{scx=Cprt}/u, "\u{75301}");
 // Script_Extension=Linb
-t(/\p{scx=Linb}/u, "\u{10100}");
-f(/\P{scx=Linb}/u, "\u{10100}");
-t(/\p{scx=Linb}/u, "\u{10101}");
-f(/\P{scx=Linb}/u, "\u{10101}");
-t(/\p{scx=Linb}/u, "\u{10102}");
-f(/\P{scx=Linb}/u, "\u{10102}");
-t(/\p{scx=Linb}/u, "\u{10137}");
-f(/\P{scx=Linb}/u, "\u{10137}");
-t(/\p{scx=Linb}/u, "\u{10138}");
-f(/\P{scx=Linb}/u, "\u{10138}");
-t(/\p{scx=Linb}/u, "\u{10139}");
-f(/\P{scx=Linb}/u, "\u{10139}");
-t(/\p{scx=Linb}/u, "\u{1013a}");
-f(/\P{scx=Linb}/u, "\u{1013a}");
-t(/\p{scx=Linb}/u, "\u{1013b}");
-f(/\P{scx=Linb}/u, "\u{1013b}");
-t(/\p{scx=Linb}/u, "\u{1013c}");
-f(/\P{scx=Linb}/u, "\u{1013c}");
-t(/\p{scx=Linb}/u, "\u{1013d}");
-f(/\P{scx=Linb}/u, "\u{1013d}");
-t(/\p{scx=Linb}/u, "\u{1013e}");
-f(/\P{scx=Linb}/u, "\u{1013e}");
-t(/\p{scx=Linb}/u, "\u{1013f}");
-f(/\P{scx=Linb}/u, "\u{1013f}");
-t(/\p{scx=Linb}/u, "\u{10107}");
-f(/\P{scx=Linb}/u, "\u{10107}");
-t(/\p{scx=Linb}/u, "\u{10108}");
-f(/\P{scx=Linb}/u, "\u{10108}");
-t(/\p{scx=Linb}/u, "\u{10109}");
-f(/\P{scx=Linb}/u, "\u{10109}");
-t(/\p{scx=Linb}/u, "\u{1010a}");
-f(/\P{scx=Linb}/u, "\u{1010a}");
-t(/\p{scx=Linb}/u, "\u{1010b}");
-f(/\P{scx=Linb}/u, "\u{1010b}");
-t(/\p{scx=Linb}/u, "\u{1010c}");
-f(/\P{scx=Linb}/u, "\u{1010c}");
-t(/\p{scx=Linb}/u, "\u{1010d}");
-f(/\P{scx=Linb}/u, "\u{1010d}");
-t(/\p{scx=Linb}/u, "\u{1010e}");
-f(/\P{scx=Linb}/u, "\u{1010e}");
-t(/\p{scx=Linb}/u, "\u{1010f}");
-f(/\P{scx=Linb}/u, "\u{1010f}");
-t(/\p{scx=Linb}/u, "\u{10110}");
-f(/\P{scx=Linb}/u, "\u{10110}");
-t(/\p{scx=Linb}/u, "\u{10111}");
-f(/\P{scx=Linb}/u, "\u{10111}");
-t(/\p{scx=Linb}/u, "\u{10112}");
-f(/\P{scx=Linb}/u, "\u{10112}");
-t(/\p{scx=Linb}/u, "\u{10113}");
-f(/\P{scx=Linb}/u, "\u{10113}");
-t(/\p{scx=Linb}/u, "\u{10114}");
-f(/\P{scx=Linb}/u, "\u{10114}");
-t(/\p{scx=Linb}/u, "\u{10115}");
-f(/\P{scx=Linb}/u, "\u{10115}");
-t(/\p{scx=Linb}/u, "\u{10116}");
-f(/\P{scx=Linb}/u, "\u{10116}");
-t(/\p{scx=Linb}/u, "\u{10117}");
-f(/\P{scx=Linb}/u, "\u{10117}");
-t(/\p{scx=Linb}/u, "\u{10118}");
-f(/\P{scx=Linb}/u, "\u{10118}");
-t(/\p{scx=Linb}/u, "\u{10119}");
-f(/\P{scx=Linb}/u, "\u{10119}");
-t(/\p{scx=Linb}/u, "\u{1011a}");
-f(/\P{scx=Linb}/u, "\u{1011a}");
-t(/\p{scx=Linb}/u, "\u{1011b}");
-f(/\P{scx=Linb}/u, "\u{1011b}");
-t(/\p{scx=Linb}/u, "\u{1011c}");
-f(/\P{scx=Linb}/u, "\u{1011c}");
-t(/\p{scx=Linb}/u, "\u{1011d}");
-f(/\P{scx=Linb}/u, "\u{1011d}");
-t(/\p{scx=Linb}/u, "\u{1011e}");
-f(/\P{scx=Linb}/u, "\u{1011e}");
-t(/\p{scx=Linb}/u, "\u{1011f}");
-f(/\P{scx=Linb}/u, "\u{1011f}");
-t(/\p{scx=Linb}/u, "\u{10120}");
-f(/\P{scx=Linb}/u, "\u{10120}");
-t(/\p{scx=Linb}/u, "\u{10121}");
-f(/\P{scx=Linb}/u, "\u{10121}");
-t(/\p{scx=Linb}/u, "\u{10122}");
-f(/\P{scx=Linb}/u, "\u{10122}");
-t(/\p{scx=Linb}/u, "\u{10123}");
-f(/\P{scx=Linb}/u, "\u{10123}");
-t(/\p{scx=Linb}/u, "\u{10124}");
-f(/\P{scx=Linb}/u, "\u{10124}");
-t(/\p{scx=Linb}/u, "\u{10125}");
-f(/\P{scx=Linb}/u, "\u{10125}");
-t(/\p{scx=Linb}/u, "\u{10126}");
-f(/\P{scx=Linb}/u, "\u{10126}");
-t(/\p{scx=Linb}/u, "\u{10127}");
-f(/\P{scx=Linb}/u, "\u{10127}");
-t(/\p{scx=Linb}/u, "\u{10128}");
-f(/\P{scx=Linb}/u, "\u{10128}");
-t(/\p{scx=Linb}/u, "\u{10129}");
-f(/\P{scx=Linb}/u, "\u{10129}");
-t(/\p{scx=Linb}/u, "\u{1012a}");
-f(/\P{scx=Linb}/u, "\u{1012a}");
-t(/\p{scx=Linb}/u, "\u{1012b}");
-f(/\P{scx=Linb}/u, "\u{1012b}");
-t(/\p{scx=Linb}/u, "\u{1012c}");
-f(/\P{scx=Linb}/u, "\u{1012c}");
-t(/\p{scx=Linb}/u, "\u{1012d}");
-f(/\P{scx=Linb}/u, "\u{1012d}");
-t(/\p{scx=Linb}/u, "\u{1012e}");
-f(/\P{scx=Linb}/u, "\u{1012e}");
-t(/\p{scx=Linb}/u, "\u{1012f}");
-f(/\P{scx=Linb}/u, "\u{1012f}");
-t(/\p{scx=Linb}/u, "\u{10130}");
-f(/\P{scx=Linb}/u, "\u{10130}");
-t(/\p{scx=Linb}/u, "\u{10131}");
-f(/\P{scx=Linb}/u, "\u{10131}");
-t(/\p{scx=Linb}/u, "\u{10132}");
-f(/\P{scx=Linb}/u, "\u{10132}");
-t(/\p{scx=Linb}/u, "\u{10133}");
-f(/\P{scx=Linb}/u, "\u{10133}");
-f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{42fd8}");
-f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{5847b}");
-f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{71859}");
-f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{6b485}");
-f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{ba1f}");
+f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{b0cc}");
+f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{2759a}");
+f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{a6482}");
+f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{11c84}");
+f(/(?=\P{sc=Linb})\p{scx=Linb}/u, "\u{a3931}");
 // Script_Extension=Cyrl
-t(/\p{scx=Cyrl}/u, "\u{484}");
-f(/\P{scx=Cyrl}/u, "\u{484}");
-t(/\p{scx=Cyrl}/u, "\u{487}");
-f(/\P{scx=Cyrl}/u, "\u{487}");
-t(/\p{scx=Cyrl}/u, "\u{2e43}");
-f(/\P{scx=Cyrl}/u, "\u{2e43}");
-t(/\p{scx=Cyrl}/u, "\u{a66f}");
-f(/\P{scx=Cyrl}/u, "\u{a66f}");
-t(/\p{scx=Cyrl}/u, "\u{485}");
-f(/\P{scx=Cyrl}/u, "\u{485}");
-t(/\p{scx=Cyrl}/u, "\u{486}");
-f(/\P{scx=Cyrl}/u, "\u{486}");
-t(/\p{scx=Cyrl}/u, "\u{483}");
-f(/\P{scx=Cyrl}/u, "\u{483}");
-f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{a7c62}");
-f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{d4e8}");
-f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{95699}");
-f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{2175f}");
-f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{10000c}");
+f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{2d4a3}");
+f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{394c9}");
+f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{aa2e7}");
+f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{823e3}");
+f(/(?=\P{sc=Cyrl})\p{scx=Cyrl}/u, "\u{f753e}");
 // Script_Extension=Glag
-t(/\p{scx=Glag}/u, "\u{484}");
-f(/\P{scx=Glag}/u, "\u{484}");
-t(/\p{scx=Glag}/u, "\u{487}");
-f(/\P{scx=Glag}/u, "\u{487}");
-t(/\p{scx=Glag}/u, "\u{2e43}");
-f(/\P{scx=Glag}/u, "\u{2e43}");
-t(/\p{scx=Glag}/u, "\u{a66f}");
-f(/\P{scx=Glag}/u, "\u{a66f}");
-f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{bcabd}");
-f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{d05c1}");
-f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{b9e24}");
-f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{22e2e}");
-f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{d3d37}");
+f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{f060c}");
+f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{f4430}");
+f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{89208}");
+f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{3b2fa}");
+f(/(?=\P{sc=Glag})\p{scx=Glag}/u, "\u{5a463}");
 // Script_Extension=Perm
-t(/\p{scx=Perm}/u, "\u{483}");
-f(/\P{scx=Perm}/u, "\u{483}");
-f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{10d33d}");
-f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{4c279}");
-f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{73666}");
-f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{2e79d}");
-f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{680f8}");
+f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{f4f29}");
+f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{154a1}");
+f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{8d2e1}");
+f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{6ddec}");
+f(/(?=\P{sc=Perm})\p{scx=Perm}/u, "\u{2859e}");
 // Script_Extension=Gran
-t(/\p{scx=Gran}/u, "\u{1cd0}");
-f(/\P{scx=Gran}/u, "\u{1cd0}");
-t(/\p{scx=Gran}/u, "\u{1cd2}");
-f(/\P{scx=Gran}/u, "\u{1cd2}");
-t(/\p{scx=Gran}/u, "\u{1cd3}");
-f(/\P{scx=Gran}/u, "\u{1cd3}");
-t(/\p{scx=Gran}/u, "\u{1cf2}");
-f(/\P{scx=Gran}/u, "\u{1cf2}");
-t(/\p{scx=Gran}/u, "\u{1cf3}");
-f(/\P{scx=Gran}/u, "\u{1cf3}");
-t(/\p{scx=Gran}/u, "\u{1cf4}");
-f(/\P{scx=Gran}/u, "\u{1cf4}");
-t(/\p{scx=Gran}/u, "\u{1cf8}");
-f(/\P{scx=Gran}/u, "\u{1cf8}");
-t(/\p{scx=Gran}/u, "\u{1cf9}");
-f(/\P{scx=Gran}/u, "\u{1cf9}");
-t(/\p{scx=Gran}/u, "\u{baa}");
-f(/\P{scx=Gran}/u, "\u{baa}");
-t(/\p{scx=Gran}/u, "\u{bb5}");
-f(/\P{scx=Gran}/u, "\u{bb5}");
-t(/\p{scx=Gran}/u, "\u{be6}");
-f(/\P{scx=Gran}/u, "\u{be6}");
-t(/\p{scx=Gran}/u, "\u{be7}");
-f(/\P{scx=Gran}/u, "\u{be7}");
-t(/\p{scx=Gran}/u, "\u{be8}");
-f(/\P{scx=Gran}/u, "\u{be8}");
-t(/\p{scx=Gran}/u, "\u{be9}");
-f(/\P{scx=Gran}/u, "\u{be9}");
-t(/\p{scx=Gran}/u, "\u{bea}");
-f(/\P{scx=Gran}/u, "\u{bea}");
-t(/\p{scx=Gran}/u, "\u{beb}");
-f(/\P{scx=Gran}/u, "\u{beb}");
-t(/\p{scx=Gran}/u, "\u{bec}");
-f(/\P{scx=Gran}/u, "\u{bec}");
-t(/\p{scx=Gran}/u, "\u{bed}");
-f(/\P{scx=Gran}/u, "\u{bed}");
-t(/\p{scx=Gran}/u, "\u{bee}");
-f(/\P{scx=Gran}/u, "\u{bee}");
-t(/\p{scx=Gran}/u, "\u{bef}");
-f(/\P{scx=Gran}/u, "\u{bef}");
-t(/\p{scx=Gran}/u, "\u{bf0}");
-f(/\P{scx=Gran}/u, "\u{bf0}");
-t(/\p{scx=Gran}/u, "\u{bf1}");
-f(/\P{scx=Gran}/u, "\u{bf1}");
-t(/\p{scx=Gran}/u, "\u{bf2}");
-f(/\P{scx=Gran}/u, "\u{bf2}");
-t(/\p{scx=Gran}/u, "\u{11303}");
-f(/\P{scx=Gran}/u, "\u{11303}");
-t(/\p{scx=Gran}/u, "\u{1133c}");
-f(/\P{scx=Gran}/u, "\u{1133c}");
-t(/\p{scx=Gran}/u, "\u{20f0}");
-f(/\P{scx=Gran}/u, "\u{20f0}");
-t(/\p{scx=Gran}/u, "\u{952}");
-f(/\P{scx=Gran}/u, "\u{952}");
-t(/\p{scx=Gran}/u, "\u{951}");
-f(/\P{scx=Gran}/u, "\u{951}");
-t(/\p{scx=Gran}/u, "\u{964}");
-f(/\P{scx=Gran}/u, "\u{964}");
-t(/\p{scx=Gran}/u, "\u{965}");
-f(/\P{scx=Gran}/u, "\u{965}");
-f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{bb28a}");
-f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{ede3d}");
-f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{5a3a1}");
-f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{a9d70}");
-f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{d1d5e}");
-// Script_Extension=Knda
-t(/\p{scx=Knda}/u, "\u{1cf5}");
-f(/\P{scx=Knda}/u, "\u{1cf5}");
-t(/\p{scx=Knda}/u, "\u{1cda}");
-f(/\P{scx=Knda}/u, "\u{1cda}");
-t(/\p{scx=Knda}/u, "\u{a830}");
-f(/\P{scx=Knda}/u, "\u{a830}");
-t(/\p{scx=Knda}/u, "\u{a831}");
-f(/\P{scx=Knda}/u, "\u{a831}");
-t(/\p{scx=Knda}/u, "\u{a832}");
-f(/\P{scx=Knda}/u, "\u{a832}");
-t(/\p{scx=Knda}/u, "\u{a833}");
-f(/\P{scx=Knda}/u, "\u{a833}");
-t(/\p{scx=Knda}/u, "\u{a834}");
-f(/\P{scx=Knda}/u, "\u{a834}");
-t(/\p{scx=Knda}/u, "\u{a835}");
-f(/\P{scx=Knda}/u, "\u{a835}");
-t(/\p{scx=Knda}/u, "\u{952}");
-f(/\P{scx=Knda}/u, "\u{952}");
-t(/\p{scx=Knda}/u, "\u{951}");
-f(/\P{scx=Knda}/u, "\u{951}");
-t(/\p{scx=Knda}/u, "\u{964}");
-f(/\P{scx=Knda}/u, "\u{964}");
-t(/\p{scx=Knda}/u, "\u{965}");
-f(/\P{scx=Knda}/u, "\u{965}");
-f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{1571e}");
-f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{8e880}");
-f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{5995d}");
-f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{8516e}");
-f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{108a91}");
+f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{dcc3b}");
+f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{240a1}");
+f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{d94fd}");
+f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{3e537}");
+f(/(?=\P{sc=Gran})\p{scx=Gran}/u, "\u{ddf65}");
 // Script_Extension=Shrd
-t(/\p{scx=Shrd}/u, "\u{1cd7}");
-f(/\P{scx=Shrd}/u, "\u{1cd7}");
-t(/\p{scx=Shrd}/u, "\u{1cd9}");
-f(/\P{scx=Shrd}/u, "\u{1cd9}");
-t(/\p{scx=Shrd}/u, "\u{1cdc}");
-f(/\P{scx=Shrd}/u, "\u{1cdc}");
-t(/\p{scx=Shrd}/u, "\u{1cdd}");
-f(/\P{scx=Shrd}/u, "\u{1cdd}");
-t(/\p{scx=Shrd}/u, "\u{1ce0}");
-f(/\P{scx=Shrd}/u, "\u{1ce0}");
-t(/\p{scx=Shrd}/u, "\u{951}");
-f(/\P{scx=Shrd}/u, "\u{951}");
-f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{5c32b}");
-f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{10fe3a}");
-f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{4e2d9}");
-f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{ea40}");
-f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{cc847}");
+f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{c17cc}");
+f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{2d717}");
+f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{93c84}");
+f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{e4d57}");
+f(/(?=\P{sc=Shrd})\p{scx=Shrd}/u, "\u{4449a}");
 // Script_Extension=Taml
-t(/\p{scx=Taml}/u, "\u{a8f3}");
-f(/\P{scx=Taml}/u, "\u{a8f3}");
-t(/\p{scx=Taml}/u, "\u{baa}");
-f(/\P{scx=Taml}/u, "\u{baa}");
-t(/\p{scx=Taml}/u, "\u{bb5}");
-f(/\P{scx=Taml}/u, "\u{bb5}");
-t(/\p{scx=Taml}/u, "\u{be6}");
-f(/\P{scx=Taml}/u, "\u{be6}");
-t(/\p{scx=Taml}/u, "\u{be7}");
-f(/\P{scx=Taml}/u, "\u{be7}");
-t(/\p{scx=Taml}/u, "\u{be8}");
-f(/\P{scx=Taml}/u, "\u{be8}");
-t(/\p{scx=Taml}/u, "\u{be9}");
-f(/\P{scx=Taml}/u, "\u{be9}");
-t(/\p{scx=Taml}/u, "\u{bea}");
-f(/\P{scx=Taml}/u, "\u{bea}");
-t(/\p{scx=Taml}/u, "\u{beb}");
-f(/\P{scx=Taml}/u, "\u{beb}");
-t(/\p{scx=Taml}/u, "\u{bec}");
-f(/\P{scx=Taml}/u, "\u{bec}");
-t(/\p{scx=Taml}/u, "\u{bed}");
-f(/\P{scx=Taml}/u, "\u{bed}");
-t(/\p{scx=Taml}/u, "\u{bee}");
-f(/\P{scx=Taml}/u, "\u{bee}");
-t(/\p{scx=Taml}/u, "\u{bef}");
-f(/\P{scx=Taml}/u, "\u{bef}");
-t(/\p{scx=Taml}/u, "\u{bf0}");
-f(/\P{scx=Taml}/u, "\u{bf0}");
-t(/\p{scx=Taml}/u, "\u{bf1}");
-f(/\P{scx=Taml}/u, "\u{bf1}");
-t(/\p{scx=Taml}/u, "\u{bf2}");
-f(/\P{scx=Taml}/u, "\u{bf2}");
-t(/\p{scx=Taml}/u, "\u{11303}");
-f(/\P{scx=Taml}/u, "\u{11303}");
-t(/\p{scx=Taml}/u, "\u{1133c}");
-f(/\P{scx=Taml}/u, "\u{1133c}");
-t(/\p{scx=Taml}/u, "\u{1cda}");
-f(/\P{scx=Taml}/u, "\u{1cda}");
-t(/\p{scx=Taml}/u, "\u{952}");
-f(/\P{scx=Taml}/u, "\u{952}");
-t(/\p{scx=Taml}/u, "\u{951}");
-f(/\P{scx=Taml}/u, "\u{951}");
-t(/\p{scx=Taml}/u, "\u{964}");
-f(/\P{scx=Taml}/u, "\u{964}");
-t(/\p{scx=Taml}/u, "\u{965}");
-f(/\P{scx=Taml}/u, "\u{965}");
-f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{cd2c8}");
-f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{3b11}");
-f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{4c056}");
-f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{f32f7}");
-f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{b753f}");
+f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{fb7ab}");
+f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{d687c}");
+f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{b6aea}");
+f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{e42bc}");
+f(/(?=\P{sc=Taml})\p{scx=Taml}/u, "\u{77534}");
 // Script_Extension=Gujr
-t(/\p{scx=Gujr}/u, "\u{ae6}");
-f(/\P{scx=Gujr}/u, "\u{ae6}");
-t(/\p{scx=Gujr}/u, "\u{ae7}");
-f(/\P{scx=Gujr}/u, "\u{ae7}");
-t(/\p{scx=Gujr}/u, "\u{ae8}");
-f(/\P{scx=Gujr}/u, "\u{ae8}");
-t(/\p{scx=Gujr}/u, "\u{ae9}");
-f(/\P{scx=Gujr}/u, "\u{ae9}");
-t(/\p{scx=Gujr}/u, "\u{aea}");
-f(/\P{scx=Gujr}/u, "\u{aea}");
-t(/\p{scx=Gujr}/u, "\u{aeb}");
-f(/\P{scx=Gujr}/u, "\u{aeb}");
-t(/\p{scx=Gujr}/u, "\u{aec}");
-f(/\P{scx=Gujr}/u, "\u{aec}");
-t(/\p{scx=Gujr}/u, "\u{aed}");
-f(/\P{scx=Gujr}/u, "\u{aed}");
-t(/\p{scx=Gujr}/u, "\u{aee}");
-f(/\P{scx=Gujr}/u, "\u{aee}");
-t(/\p{scx=Gujr}/u, "\u{aef}");
-f(/\P{scx=Gujr}/u, "\u{aef}");
-t(/\p{scx=Gujr}/u, "\u{a836}");
-f(/\P{scx=Gujr}/u, "\u{a836}");
-t(/\p{scx=Gujr}/u, "\u{a837}");
-f(/\P{scx=Gujr}/u, "\u{a837}");
-t(/\p{scx=Gujr}/u, "\u{a838}");
-f(/\P{scx=Gujr}/u, "\u{a838}");
-t(/\p{scx=Gujr}/u, "\u{a839}");
-f(/\P{scx=Gujr}/u, "\u{a839}");
-t(/\p{scx=Gujr}/u, "\u{a830}");
-f(/\P{scx=Gujr}/u, "\u{a830}");
-t(/\p{scx=Gujr}/u, "\u{a831}");
-f(/\P{scx=Gujr}/u, "\u{a831}");
-t(/\p{scx=Gujr}/u, "\u{a832}");
-f(/\P{scx=Gujr}/u, "\u{a832}");
-t(/\p{scx=Gujr}/u, "\u{a833}");
-f(/\P{scx=Gujr}/u, "\u{a833}");
-t(/\p{scx=Gujr}/u, "\u{a834}");
-f(/\P{scx=Gujr}/u, "\u{a834}");
-t(/\p{scx=Gujr}/u, "\u{a835}");
-f(/\P{scx=Gujr}/u, "\u{a835}");
-t(/\p{scx=Gujr}/u, "\u{952}");
-f(/\P{scx=Gujr}/u, "\u{952}");
-t(/\p{scx=Gujr}/u, "\u{951}");
-f(/\P{scx=Gujr}/u, "\u{951}");
-t(/\p{scx=Gujr}/u, "\u{964}");
-f(/\P{scx=Gujr}/u, "\u{964}");
-t(/\p{scx=Gujr}/u, "\u{965}");
-f(/\P{scx=Gujr}/u, "\u{965}");
-f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{6e146}");
-f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{6c1e2}");
-f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{122b2}");
-f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{1084c8}");
-f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{e13be}");
+f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{4b35c}");
+f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{889e5}");
+f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{107d78}");
+f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{c68d8}");
+f(/(?=\P{sc=Gujr})\p{scx=Gujr}/u, "\u{a5b0a}");
 // Script_Extension=Khoj
-t(/\p{scx=Khoj}/u, "\u{ae6}");
-f(/\P{scx=Khoj}/u, "\u{ae6}");
-t(/\p{scx=Khoj}/u, "\u{ae7}");
-f(/\P{scx=Khoj}/u, "\u{ae7}");
-t(/\p{scx=Khoj}/u, "\u{ae8}");
-f(/\P{scx=Khoj}/u, "\u{ae8}");
-t(/\p{scx=Khoj}/u, "\u{ae9}");
-f(/\P{scx=Khoj}/u, "\u{ae9}");
-t(/\p{scx=Khoj}/u, "\u{aea}");
-f(/\P{scx=Khoj}/u, "\u{aea}");
-t(/\p{scx=Khoj}/u, "\u{aeb}");
-f(/\P{scx=Khoj}/u, "\u{aeb}");
-t(/\p{scx=Khoj}/u, "\u{aec}");
-f(/\P{scx=Khoj}/u, "\u{aec}");
-t(/\p{scx=Khoj}/u, "\u{aed}");
-f(/\P{scx=Khoj}/u, "\u{aed}");
-t(/\p{scx=Khoj}/u, "\u{aee}");
-f(/\P{scx=Khoj}/u, "\u{aee}");
-t(/\p{scx=Khoj}/u, "\u{aef}");
-f(/\P{scx=Khoj}/u, "\u{aef}");
-f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{54d2e}");
-f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{7f810}");
-f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{1b6a5}");
-f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{25b08}");
-f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{3f5a4}");
+f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{2da77}");
+f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{9fb5}");
+f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{a0268}");
+f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{10d835}");
+f(/(?=\P{sc=Khoj})\p{scx=Khoj}/u, "\u{49e92}");
 // Script_Extension=Guru
-t(/\p{scx=Guru}/u, "\u{a66}");
-f(/\P{scx=Guru}/u, "\u{a66}");
-t(/\p{scx=Guru}/u, "\u{a67}");
-f(/\P{scx=Guru}/u, "\u{a67}");
-t(/\p{scx=Guru}/u, "\u{a68}");
-f(/\P{scx=Guru}/u, "\u{a68}");
-t(/\p{scx=Guru}/u, "\u{a69}");
-f(/\P{scx=Guru}/u, "\u{a69}");
-t(/\p{scx=Guru}/u, "\u{a6a}");
-f(/\P{scx=Guru}/u, "\u{a6a}");
-t(/\p{scx=Guru}/u, "\u{a6b}");
-f(/\P{scx=Guru}/u, "\u{a6b}");
-t(/\p{scx=Guru}/u, "\u{a6c}");
-f(/\P{scx=Guru}/u, "\u{a6c}");
-t(/\p{scx=Guru}/u, "\u{a6d}");
-f(/\P{scx=Guru}/u, "\u{a6d}");
-t(/\p{scx=Guru}/u, "\u{a6e}");
-f(/\P{scx=Guru}/u, "\u{a6e}");
-t(/\p{scx=Guru}/u, "\u{a6f}");
-f(/\P{scx=Guru}/u, "\u{a6f}");
-t(/\p{scx=Guru}/u, "\u{a836}");
-f(/\P{scx=Guru}/u, "\u{a836}");
-t(/\p{scx=Guru}/u, "\u{a837}");
-f(/\P{scx=Guru}/u, "\u{a837}");
-t(/\p{scx=Guru}/u, "\u{a838}");
-f(/\P{scx=Guru}/u, "\u{a838}");
-t(/\p{scx=Guru}/u, "\u{a839}");
-f(/\P{scx=Guru}/u, "\u{a839}");
-t(/\p{scx=Guru}/u, "\u{a830}");
-f(/\P{scx=Guru}/u, "\u{a830}");
-t(/\p{scx=Guru}/u, "\u{a831}");
-f(/\P{scx=Guru}/u, "\u{a831}");
-t(/\p{scx=Guru}/u, "\u{a832}");
-f(/\P{scx=Guru}/u, "\u{a832}");
-t(/\p{scx=Guru}/u, "\u{a833}");
-f(/\P{scx=Guru}/u, "\u{a833}");
-t(/\p{scx=Guru}/u, "\u{a834}");
-f(/\P{scx=Guru}/u, "\u{a834}");
-t(/\p{scx=Guru}/u, "\u{a835}");
-f(/\P{scx=Guru}/u, "\u{a835}");
-t(/\p{scx=Guru}/u, "\u{952}");
-f(/\P{scx=Guru}/u, "\u{952}");
-t(/\p{scx=Guru}/u, "\u{951}");
-f(/\P{scx=Guru}/u, "\u{951}");
-t(/\p{scx=Guru}/u, "\u{964}");
-f(/\P{scx=Guru}/u, "\u{964}");
-t(/\p{scx=Guru}/u, "\u{965}");
-f(/\P{scx=Guru}/u, "\u{965}");
-f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{c01ee}");
-f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{8b95a}");
-f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{bf5a}");
-f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{171c5}");
-f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{89de9}");
+f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{54186}");
+f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{a2fff}");
+f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{e25c3}");
+f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{10496}");
+f(/(?=\P{sc=Guru})\p{scx=Guru}/u, "\u{10ad15}");
 // Script_Extension=Mult
-t(/\p{scx=Mult}/u, "\u{a66}");
-f(/\P{scx=Mult}/u, "\u{a66}");
-t(/\p{scx=Mult}/u, "\u{a67}");
-f(/\P{scx=Mult}/u, "\u{a67}");
-t(/\p{scx=Mult}/u, "\u{a68}");
-f(/\P{scx=Mult}/u, "\u{a68}");
-t(/\p{scx=Mult}/u, "\u{a69}");
-f(/\P{scx=Mult}/u, "\u{a69}");
-t(/\p{scx=Mult}/u, "\u{a6a}");
-f(/\P{scx=Mult}/u, "\u{a6a}");
-t(/\p{scx=Mult}/u, "\u{a6b}");
-f(/\P{scx=Mult}/u, "\u{a6b}");
-t(/\p{scx=Mult}/u, "\u{a6c}");
-f(/\P{scx=Mult}/u, "\u{a6c}");
-t(/\p{scx=Mult}/u, "\u{a6d}");
-f(/\P{scx=Mult}/u, "\u{a6d}");
-t(/\p{scx=Mult}/u, "\u{a6e}");
-f(/\P{scx=Mult}/u, "\u{a6e}");
-t(/\p{scx=Mult}/u, "\u{a6f}");
-f(/\P{scx=Mult}/u, "\u{a6f}");
-f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{cb98f}");
-f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{d30de}");
-f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{5d609}");
-f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{935d8}");
-f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{72f8e}");
+f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{2794e}");
+f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{2f6b4}");
+f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{d50f2}");
+f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{62dac}");
+f(/(?=\P{sc=Mult})\p{scx=Mult}/u, "\u{ad0b2}");
 // Script_Extension=Hira
-t(/\p{scx=Hira}/u, "\u{3031}");
-f(/\P{scx=Hira}/u, "\u{3031}");
-t(/\p{scx=Hira}/u, "\u{3032}");
-f(/\P{scx=Hira}/u, "\u{3032}");
-t(/\p{scx=Hira}/u, "\u{3033}");
-f(/\P{scx=Hira}/u, "\u{3033}");
-t(/\p{scx=Hira}/u, "\u{3034}");
-f(/\P{scx=Hira}/u, "\u{3034}");
-t(/\p{scx=Hira}/u, "\u{3035}");
-f(/\P{scx=Hira}/u, "\u{3035}");
-t(/\p{scx=Hira}/u, "\u{3099}");
-f(/\P{scx=Hira}/u, "\u{3099}");
-t(/\p{scx=Hira}/u, "\u{309a}");
-f(/\P{scx=Hira}/u, "\u{309a}");
-t(/\p{scx=Hira}/u, "\u{309b}");
-f(/\P{scx=Hira}/u, "\u{309b}");
-t(/\p{scx=Hira}/u, "\u{309c}");
-f(/\P{scx=Hira}/u, "\u{309c}");
-t(/\p{scx=Hira}/u, "\u{30a0}");
-f(/\P{scx=Hira}/u, "\u{30a0}");
-t(/\p{scx=Hira}/u, "\u{30fc}");
-f(/\P{scx=Hira}/u, "\u{30fc}");
-t(/\p{scx=Hira}/u, "\u{ff70}");
-f(/\P{scx=Hira}/u, "\u{ff70}");
-t(/\p{scx=Hira}/u, "\u{ff9e}");
-f(/\P{scx=Hira}/u, "\u{ff9e}");
-t(/\p{scx=Hira}/u, "\u{ff9f}");
-f(/\P{scx=Hira}/u, "\u{ff9f}");
-t(/\p{scx=Hira}/u, "\u{303c}");
-f(/\P{scx=Hira}/u, "\u{303c}");
-t(/\p{scx=Hira}/u, "\u{303d}");
-f(/\P{scx=Hira}/u, "\u{303d}");
-t(/\p{scx=Hira}/u, "\u{3003}");
-f(/\P{scx=Hira}/u, "\u{3003}");
-t(/\p{scx=Hira}/u, "\u{3013}");
-f(/\P{scx=Hira}/u, "\u{3013}");
-t(/\p{scx=Hira}/u, "\u{301c}");
-f(/\P{scx=Hira}/u, "\u{301c}");
-t(/\p{scx=Hira}/u, "\u{301d}");
-f(/\P{scx=Hira}/u, "\u{301d}");
-t(/\p{scx=Hira}/u, "\u{301e}");
-f(/\P{scx=Hira}/u, "\u{301e}");
-t(/\p{scx=Hira}/u, "\u{301f}");
-f(/\P{scx=Hira}/u, "\u{301f}");
-t(/\p{scx=Hira}/u, "\u{3030}");
-f(/\P{scx=Hira}/u, "\u{3030}");
-t(/\p{scx=Hira}/u, "\u{3037}");
-f(/\P{scx=Hira}/u, "\u{3037}");
-t(/\p{scx=Hira}/u, "\u{fe45}");
-f(/\P{scx=Hira}/u, "\u{fe45}");
-t(/\p{scx=Hira}/u, "\u{fe46}");
-f(/\P{scx=Hira}/u, "\u{fe46}");
-t(/\p{scx=Hira}/u, "\u{3001}");
-f(/\P{scx=Hira}/u, "\u{3001}");
-t(/\p{scx=Hira}/u, "\u{3002}");
-f(/\P{scx=Hira}/u, "\u{3002}");
-t(/\p{scx=Hira}/u, "\u{3008}");
-f(/\P{scx=Hira}/u, "\u{3008}");
-t(/\p{scx=Hira}/u, "\u{3009}");
-f(/\P{scx=Hira}/u, "\u{3009}");
-t(/\p{scx=Hira}/u, "\u{300a}");
-f(/\P{scx=Hira}/u, "\u{300a}");
-t(/\p{scx=Hira}/u, "\u{300b}");
-f(/\P{scx=Hira}/u, "\u{300b}");
-t(/\p{scx=Hira}/u, "\u{300c}");
-f(/\P{scx=Hira}/u, "\u{300c}");
-t(/\p{scx=Hira}/u, "\u{300d}");
-f(/\P{scx=Hira}/u, "\u{300d}");
-t(/\p{scx=Hira}/u, "\u{300e}");
-f(/\P{scx=Hira}/u, "\u{300e}");
-t(/\p{scx=Hira}/u, "\u{300f}");
-f(/\P{scx=Hira}/u, "\u{300f}");
-t(/\p{scx=Hira}/u, "\u{3010}");
-f(/\P{scx=Hira}/u, "\u{3010}");
-t(/\p{scx=Hira}/u, "\u{3011}");
-f(/\P{scx=Hira}/u, "\u{3011}");
-t(/\p{scx=Hira}/u, "\u{3014}");
-f(/\P{scx=Hira}/u, "\u{3014}");
-t(/\p{scx=Hira}/u, "\u{3015}");
-f(/\P{scx=Hira}/u, "\u{3015}");
-t(/\p{scx=Hira}/u, "\u{3016}");
-f(/\P{scx=Hira}/u, "\u{3016}");
-t(/\p{scx=Hira}/u, "\u{3017}");
-f(/\P{scx=Hira}/u, "\u{3017}");
-t(/\p{scx=Hira}/u, "\u{3018}");
-f(/\P{scx=Hira}/u, "\u{3018}");
-t(/\p{scx=Hira}/u, "\u{3019}");
-f(/\P{scx=Hira}/u, "\u{3019}");
-t(/\p{scx=Hira}/u, "\u{301a}");
-f(/\P{scx=Hira}/u, "\u{301a}");
-t(/\p{scx=Hira}/u, "\u{301b}");
-f(/\P{scx=Hira}/u, "\u{301b}");
-t(/\p{scx=Hira}/u, "\u{30fb}");
-f(/\P{scx=Hira}/u, "\u{30fb}");
-t(/\p{scx=Hira}/u, "\u{ff61}");
-f(/\P{scx=Hira}/u, "\u{ff61}");
-t(/\p{scx=Hira}/u, "\u{ff62}");
-f(/\P{scx=Hira}/u, "\u{ff62}");
-t(/\p{scx=Hira}/u, "\u{ff63}");
-f(/\P{scx=Hira}/u, "\u{ff63}");
-t(/\p{scx=Hira}/u, "\u{ff64}");
-f(/\P{scx=Hira}/u, "\u{ff64}");
-t(/\p{scx=Hira}/u, "\u{ff65}");
-f(/\P{scx=Hira}/u, "\u{ff65}");
-f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{e76fe}");
-f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{53a36}");
-f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{acd83}");
-f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{b4cab}");
-f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{e9807}");
+f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{be070}");
+f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{d2d48}");
+f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{ec3a2}");
+f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{b2f9d}");
+f(/(?=\P{sc=Hira})\p{scx=Hira}/u, "\u{4b539}");
 // Script_Extension=Kana
-t(/\p{scx=Kana}/u, "\u{3031}");
-f(/\P{scx=Kana}/u, "\u{3031}");
-t(/\p{scx=Kana}/u, "\u{3032}");
-f(/\P{scx=Kana}/u, "\u{3032}");
-t(/\p{scx=Kana}/u, "\u{3033}");
-f(/\P{scx=Kana}/u, "\u{3033}");
-t(/\p{scx=Kana}/u, "\u{3034}");
-f(/\P{scx=Kana}/u, "\u{3034}");
-t(/\p{scx=Kana}/u, "\u{3035}");
-f(/\P{scx=Kana}/u, "\u{3035}");
-t(/\p{scx=Kana}/u, "\u{3099}");
-f(/\P{scx=Kana}/u, "\u{3099}");
-t(/\p{scx=Kana}/u, "\u{309a}");
-f(/\P{scx=Kana}/u, "\u{309a}");
-t(/\p{scx=Kana}/u, "\u{309b}");
-f(/\P{scx=Kana}/u, "\u{309b}");
-t(/\p{scx=Kana}/u, "\u{309c}");
-f(/\P{scx=Kana}/u, "\u{309c}");
-t(/\p{scx=Kana}/u, "\u{30a0}");
-f(/\P{scx=Kana}/u, "\u{30a0}");
-t(/\p{scx=Kana}/u, "\u{30fc}");
-f(/\P{scx=Kana}/u, "\u{30fc}");
-t(/\p{scx=Kana}/u, "\u{ff70}");
-f(/\P{scx=Kana}/u, "\u{ff70}");
-t(/\p{scx=Kana}/u, "\u{ff9e}");
-f(/\P{scx=Kana}/u, "\u{ff9e}");
-t(/\p{scx=Kana}/u, "\u{ff9f}");
-f(/\P{scx=Kana}/u, "\u{ff9f}");
-t(/\p{scx=Kana}/u, "\u{303c}");
-f(/\P{scx=Kana}/u, "\u{303c}");
-t(/\p{scx=Kana}/u, "\u{303d}");
-f(/\P{scx=Kana}/u, "\u{303d}");
-t(/\p{scx=Kana}/u, "\u{3003}");
-f(/\P{scx=Kana}/u, "\u{3003}");
-t(/\p{scx=Kana}/u, "\u{3013}");
-f(/\P{scx=Kana}/u, "\u{3013}");
-t(/\p{scx=Kana}/u, "\u{301c}");
-f(/\P{scx=Kana}/u, "\u{301c}");
-t(/\p{scx=Kana}/u, "\u{301d}");
-f(/\P{scx=Kana}/u, "\u{301d}");
-t(/\p{scx=Kana}/u, "\u{301e}");
-f(/\P{scx=Kana}/u, "\u{301e}");
-t(/\p{scx=Kana}/u, "\u{301f}");
-f(/\P{scx=Kana}/u, "\u{301f}");
-t(/\p{scx=Kana}/u, "\u{3030}");
-f(/\P{scx=Kana}/u, "\u{3030}");
-t(/\p{scx=Kana}/u, "\u{3037}");
-f(/\P{scx=Kana}/u, "\u{3037}");
-t(/\p{scx=Kana}/u, "\u{fe45}");
-f(/\P{scx=Kana}/u, "\u{fe45}");
-t(/\p{scx=Kana}/u, "\u{fe46}");
-f(/\P{scx=Kana}/u, "\u{fe46}");
-t(/\p{scx=Kana}/u, "\u{3001}");
-f(/\P{scx=Kana}/u, "\u{3001}");
-t(/\p{scx=Kana}/u, "\u{3002}");
-f(/\P{scx=Kana}/u, "\u{3002}");
-t(/\p{scx=Kana}/u, "\u{3008}");
-f(/\P{scx=Kana}/u, "\u{3008}");
-t(/\p{scx=Kana}/u, "\u{3009}");
-f(/\P{scx=Kana}/u, "\u{3009}");
-t(/\p{scx=Kana}/u, "\u{300a}");
-f(/\P{scx=Kana}/u, "\u{300a}");
-t(/\p{scx=Kana}/u, "\u{300b}");
-f(/\P{scx=Kana}/u, "\u{300b}");
-t(/\p{scx=Kana}/u, "\u{300c}");
-f(/\P{scx=Kana}/u, "\u{300c}");
-t(/\p{scx=Kana}/u, "\u{300d}");
-f(/\P{scx=Kana}/u, "\u{300d}");
-t(/\p{scx=Kana}/u, "\u{300e}");
-f(/\P{scx=Kana}/u, "\u{300e}");
-t(/\p{scx=Kana}/u, "\u{300f}");
-f(/\P{scx=Kana}/u, "\u{300f}");
-t(/\p{scx=Kana}/u, "\u{3010}");
-f(/\P{scx=Kana}/u, "\u{3010}");
-t(/\p{scx=Kana}/u, "\u{3011}");
-f(/\P{scx=Kana}/u, "\u{3011}");
-t(/\p{scx=Kana}/u, "\u{3014}");
-f(/\P{scx=Kana}/u, "\u{3014}");
-t(/\p{scx=Kana}/u, "\u{3015}");
-f(/\P{scx=Kana}/u, "\u{3015}");
-t(/\p{scx=Kana}/u, "\u{3016}");
-f(/\P{scx=Kana}/u, "\u{3016}");
-t(/\p{scx=Kana}/u, "\u{3017}");
-f(/\P{scx=Kana}/u, "\u{3017}");
-t(/\p{scx=Kana}/u, "\u{3018}");
-f(/\P{scx=Kana}/u, "\u{3018}");
-t(/\p{scx=Kana}/u, "\u{3019}");
-f(/\P{scx=Kana}/u, "\u{3019}");
-t(/\p{scx=Kana}/u, "\u{301a}");
-f(/\P{scx=Kana}/u, "\u{301a}");
-t(/\p{scx=Kana}/u, "\u{301b}");
-f(/\P{scx=Kana}/u, "\u{301b}");
-t(/\p{scx=Kana}/u, "\u{30fb}");
-f(/\P{scx=Kana}/u, "\u{30fb}");
-t(/\p{scx=Kana}/u, "\u{ff61}");
-f(/\P{scx=Kana}/u, "\u{ff61}");
-t(/\p{scx=Kana}/u, "\u{ff62}");
-f(/\P{scx=Kana}/u, "\u{ff62}");
-t(/\p{scx=Kana}/u, "\u{ff63}");
-f(/\P{scx=Kana}/u, "\u{ff63}");
-t(/\p{scx=Kana}/u, "\u{ff64}");
-f(/\P{scx=Kana}/u, "\u{ff64}");
-t(/\p{scx=Kana}/u, "\u{ff65}");
-f(/\P{scx=Kana}/u, "\u{ff65}");
-f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{62d2b}");
-f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{7fb02}");
-f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{272ad}");
-f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{d8eae}");
-f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{5ff06}");
+f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{545d5}");
+f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{23e9d}");
+f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{104ba8}");
+f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{dc9d5}");
+f(/(?=\P{sc=Kana})\p{scx=Kana}/u, "\u{8229c}");
 // Script_Extension=Mong
-t(/\p{scx=Mong}/u, "\u{1802}");
-f(/\P{scx=Mong}/u, "\u{1802}");
-t(/\p{scx=Mong}/u, "\u{1803}");
-f(/\P{scx=Mong}/u, "\u{1803}");
-t(/\p{scx=Mong}/u, "\u{1805}");
-f(/\P{scx=Mong}/u, "\u{1805}");
-f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{9b814}");
-f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{2dce3}");
-f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{2f969}");
-f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{10f87c}");
-f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{57d}");
+f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{3b0ad}");
+f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{d9402}");
+f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{8f4ae}");
+f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{18b7d}");
+f(/(?=\P{sc=Mong})\p{scx=Mong}/u, "\u{e0393}");
 // Script_Extension=Phag
-t(/\p{scx=Phag}/u, "\u{1802}");
-f(/\P{scx=Phag}/u, "\u{1802}");
-t(/\p{scx=Phag}/u, "\u{1803}");
-f(/\P{scx=Phag}/u, "\u{1803}");
-t(/\p{scx=Phag}/u, "\u{1805}");
-f(/\P{scx=Phag}/u, "\u{1805}");
-f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{aa326}");
-f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{ba8f3}");
-f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{2cc5d}");
-f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{f8f43}");
-f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{effbb}");
+f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{3eb13}");
+f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{273e7}");
+f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{d7ad4}");
+f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{80daf}");
+f(/(?=\P{sc=Phag})\p{scx=Phag}/u, "\u{bd1ad}");
 // Script_Extension=Cakm
-t(/\p{scx=Cakm}/u, "\u{9e6}");
-f(/\P{scx=Cakm}/u, "\u{9e6}");
-t(/\p{scx=Cakm}/u, "\u{9e7}");
-f(/\P{scx=Cakm}/u, "\u{9e7}");
-t(/\p{scx=Cakm}/u, "\u{9e8}");
-f(/\P{scx=Cakm}/u, "\u{9e8}");
-t(/\p{scx=Cakm}/u, "\u{9e9}");
-f(/\P{scx=Cakm}/u, "\u{9e9}");
-t(/\p{scx=Cakm}/u, "\u{9ea}");
-f(/\P{scx=Cakm}/u, "\u{9ea}");
-t(/\p{scx=Cakm}/u, "\u{9eb}");
-f(/\P{scx=Cakm}/u, "\u{9eb}");
-t(/\p{scx=Cakm}/u, "\u{9ec}");
-f(/\P{scx=Cakm}/u, "\u{9ec}");
-t(/\p{scx=Cakm}/u, "\u{9ed}");
-f(/\P{scx=Cakm}/u, "\u{9ed}");
-t(/\p{scx=Cakm}/u, "\u{9ee}");
-f(/\P{scx=Cakm}/u, "\u{9ee}");
-t(/\p{scx=Cakm}/u, "\u{9ef}");
-f(/\P{scx=Cakm}/u, "\u{9ef}");
-t(/\p{scx=Cakm}/u, "\u{1040}");
-f(/\P{scx=Cakm}/u, "\u{1040}");
-t(/\p{scx=Cakm}/u, "\u{1041}");
-f(/\P{scx=Cakm}/u, "\u{1041}");
-t(/\p{scx=Cakm}/u, "\u{1042}");
-f(/\P{scx=Cakm}/u, "\u{1042}");
-t(/\p{scx=Cakm}/u, "\u{1043}");
-f(/\P{scx=Cakm}/u, "\u{1043}");
-t(/\p{scx=Cakm}/u, "\u{1044}");
-f(/\P{scx=Cakm}/u, "\u{1044}");
-t(/\p{scx=Cakm}/u, "\u{1045}");
-f(/\P{scx=Cakm}/u, "\u{1045}");
-t(/\p{scx=Cakm}/u, "\u{1046}");
-f(/\P{scx=Cakm}/u, "\u{1046}");
-t(/\p{scx=Cakm}/u, "\u{1047}");
-f(/\P{scx=Cakm}/u, "\u{1047}");
-t(/\p{scx=Cakm}/u, "\u{1048}");
-f(/\P{scx=Cakm}/u, "\u{1048}");
-t(/\p{scx=Cakm}/u, "\u{1049}");
-f(/\P{scx=Cakm}/u, "\u{1049}");
-f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{f475a}");
-f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{7c476}");
-f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{10d135}");
-f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{9365b}");
-f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{363e5}");
+f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{19eeb}");
+f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{19dab}");
+f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{f3a42}");
+f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{455c7}");
+f(/(?=\P{sc=Cakm})\p{scx=Cakm}/u, "\u{baa96}");
 // Script_Extension=Sylo
-t(/\p{scx=Sylo}/u, "\u{9e6}");
-f(/\P{scx=Sylo}/u, "\u{9e6}");
-t(/\p{scx=Sylo}/u, "\u{9e7}");
-f(/\P{scx=Sylo}/u, "\u{9e7}");
-t(/\p{scx=Sylo}/u, "\u{9e8}");
-f(/\P{scx=Sylo}/u, "\u{9e8}");
-t(/\p{scx=Sylo}/u, "\u{9e9}");
-f(/\P{scx=Sylo}/u, "\u{9e9}");
-t(/\p{scx=Sylo}/u, "\u{9ea}");
-f(/\P{scx=Sylo}/u, "\u{9ea}");
-t(/\p{scx=Sylo}/u, "\u{9eb}");
-f(/\P{scx=Sylo}/u, "\u{9eb}");
-t(/\p{scx=Sylo}/u, "\u{9ec}");
-f(/\P{scx=Sylo}/u, "\u{9ec}");
-t(/\p{scx=Sylo}/u, "\u{9ed}");
-f(/\P{scx=Sylo}/u, "\u{9ed}");
-t(/\p{scx=Sylo}/u, "\u{9ee}");
-f(/\P{scx=Sylo}/u, "\u{9ee}");
-t(/\p{scx=Sylo}/u, "\u{9ef}");
-f(/\P{scx=Sylo}/u, "\u{9ef}");
-t(/\p{scx=Sylo}/u, "\u{964}");
-f(/\P{scx=Sylo}/u, "\u{964}");
-t(/\p{scx=Sylo}/u, "\u{965}");
-f(/\P{scx=Sylo}/u, "\u{965}");
-f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{b299f}");
-f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{10375e}");
-f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{ffbda}");
-f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{19058}");
-f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{461b8}");
+f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{54d3}");
+f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{283e9}");
+f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{edab9}");
+f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{e135d}");
+f(/(?=\P{sc=Sylo})\p{scx=Sylo}/u, "\u{31bc2}");
 // Script_Extension=Mymr
-t(/\p{scx=Mymr}/u, "\u{1040}");
-f(/\P{scx=Mymr}/u, "\u{1040}");
-t(/\p{scx=Mymr}/u, "\u{1041}");
-f(/\P{scx=Mymr}/u, "\u{1041}");
-t(/\p{scx=Mymr}/u, "\u{1042}");
-f(/\P{scx=Mymr}/u, "\u{1042}");
-t(/\p{scx=Mymr}/u, "\u{1043}");
-f(/\P{scx=Mymr}/u, "\u{1043}");
-t(/\p{scx=Mymr}/u, "\u{1044}");
-f(/\P{scx=Mymr}/u, "\u{1044}");
-t(/\p{scx=Mymr}/u, "\u{1045}");
-f(/\P{scx=Mymr}/u, "\u{1045}");
-t(/\p{scx=Mymr}/u, "\u{1046}");
-f(/\P{scx=Mymr}/u, "\u{1046}");
-t(/\p{scx=Mymr}/u, "\u{1047}");
-f(/\P{scx=Mymr}/u, "\u{1047}");
-t(/\p{scx=Mymr}/u, "\u{1048}");
-f(/\P{scx=Mymr}/u, "\u{1048}");
-t(/\p{scx=Mymr}/u, "\u{1049}");
-f(/\P{scx=Mymr}/u, "\u{1049}");
-t(/\p{scx=Mymr}/u, "\u{a92e}");
-f(/\P{scx=Mymr}/u, "\u{a92e}");
-f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{103b42}");
-f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{71346}");
-f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{25259}");
-f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{469c5}");
-f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{faf0c}");
+f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{9d605}");
+f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{109cae}");
+f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{cc2dd}");
+f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{d1757}");
+f(/(?=\P{sc=Mymr})\p{scx=Mymr}/u, "\u{baaff}");
 // Script_Extension=Tale
-t(/\p{scx=Tale}/u, "\u{1040}");
-f(/\P{scx=Tale}/u, "\u{1040}");
-t(/\p{scx=Tale}/u, "\u{1041}");
-f(/\P{scx=Tale}/u, "\u{1041}");
-t(/\p{scx=Tale}/u, "\u{1042}");
-f(/\P{scx=Tale}/u, "\u{1042}");
-t(/\p{scx=Tale}/u, "\u{1043}");
-f(/\P{scx=Tale}/u, "\u{1043}");
-t(/\p{scx=Tale}/u, "\u{1044}");
-f(/\P{scx=Tale}/u, "\u{1044}");
-t(/\p{scx=Tale}/u, "\u{1045}");
-f(/\P{scx=Tale}/u, "\u{1045}");
-t(/\p{scx=Tale}/u, "\u{1046}");
-f(/\P{scx=Tale}/u, "\u{1046}");
-t(/\p{scx=Tale}/u, "\u{1047}");
-f(/\P{scx=Tale}/u, "\u{1047}");
-t(/\p{scx=Tale}/u, "\u{1048}");
-f(/\P{scx=Tale}/u, "\u{1048}");
-t(/\p{scx=Tale}/u, "\u{1049}");
-f(/\P{scx=Tale}/u, "\u{1049}");
-f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{1416e}");
-f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{ccc0}");
-f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{2a52f}");
-f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{47a2b}");
-f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{7752b}");
+f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{81845}");
+f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{fe9d6}");
+f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{8c1a0}");
+f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{f1a55}");
+f(/(?=\P{sc=Tale})\p{scx=Tale}/u, "\u{a8f6}");
 // Script_Extension=Lina
-t(/\p{scx=Lina}/u, "\u{10107}");
-f(/\P{scx=Lina}/u, "\u{10107}");
-t(/\p{scx=Lina}/u, "\u{10108}");
-f(/\P{scx=Lina}/u, "\u{10108}");
-t(/\p{scx=Lina}/u, "\u{10109}");
-f(/\P{scx=Lina}/u, "\u{10109}");
-t(/\p{scx=Lina}/u, "\u{1010a}");
-f(/\P{scx=Lina}/u, "\u{1010a}");
-t(/\p{scx=Lina}/u, "\u{1010b}");
-f(/\P{scx=Lina}/u, "\u{1010b}");
-t(/\p{scx=Lina}/u, "\u{1010c}");
-f(/\P{scx=Lina}/u, "\u{1010c}");
-t(/\p{scx=Lina}/u, "\u{1010d}");
-f(/\P{scx=Lina}/u, "\u{1010d}");
-t(/\p{scx=Lina}/u, "\u{1010e}");
-f(/\P{scx=Lina}/u, "\u{1010e}");
-t(/\p{scx=Lina}/u, "\u{1010f}");
-f(/\P{scx=Lina}/u, "\u{1010f}");
-t(/\p{scx=Lina}/u, "\u{10110}");
-f(/\P{scx=Lina}/u, "\u{10110}");
-t(/\p{scx=Lina}/u, "\u{10111}");
-f(/\P{scx=Lina}/u, "\u{10111}");
-t(/\p{scx=Lina}/u, "\u{10112}");
-f(/\P{scx=Lina}/u, "\u{10112}");
-t(/\p{scx=Lina}/u, "\u{10113}");
-f(/\P{scx=Lina}/u, "\u{10113}");
-t(/\p{scx=Lina}/u, "\u{10114}");
-f(/\P{scx=Lina}/u, "\u{10114}");
-t(/\p{scx=Lina}/u, "\u{10115}");
-f(/\P{scx=Lina}/u, "\u{10115}");
-t(/\p{scx=Lina}/u, "\u{10116}");
-f(/\P{scx=Lina}/u, "\u{10116}");
-t(/\p{scx=Lina}/u, "\u{10117}");
-f(/\P{scx=Lina}/u, "\u{10117}");
-t(/\p{scx=Lina}/u, "\u{10118}");
-f(/\P{scx=Lina}/u, "\u{10118}");
-t(/\p{scx=Lina}/u, "\u{10119}");
-f(/\P{scx=Lina}/u, "\u{10119}");
-t(/\p{scx=Lina}/u, "\u{1011a}");
-f(/\P{scx=Lina}/u, "\u{1011a}");
-t(/\p{scx=Lina}/u, "\u{1011b}");
-f(/\P{scx=Lina}/u, "\u{1011b}");
-t(/\p{scx=Lina}/u, "\u{1011c}");
-f(/\P{scx=Lina}/u, "\u{1011c}");
-t(/\p{scx=Lina}/u, "\u{1011d}");
-f(/\P{scx=Lina}/u, "\u{1011d}");
-t(/\p{scx=Lina}/u, "\u{1011e}");
-f(/\P{scx=Lina}/u, "\u{1011e}");
-t(/\p{scx=Lina}/u, "\u{1011f}");
-f(/\P{scx=Lina}/u, "\u{1011f}");
-t(/\p{scx=Lina}/u, "\u{10120}");
-f(/\P{scx=Lina}/u, "\u{10120}");
-t(/\p{scx=Lina}/u, "\u{10121}");
-f(/\P{scx=Lina}/u, "\u{10121}");
-t(/\p{scx=Lina}/u, "\u{10122}");
-f(/\P{scx=Lina}/u, "\u{10122}");
-t(/\p{scx=Lina}/u, "\u{10123}");
-f(/\P{scx=Lina}/u, "\u{10123}");
-t(/\p{scx=Lina}/u, "\u{10124}");
-f(/\P{scx=Lina}/u, "\u{10124}");
-t(/\p{scx=Lina}/u, "\u{10125}");
-f(/\P{scx=Lina}/u, "\u{10125}");
-t(/\p{scx=Lina}/u, "\u{10126}");
-f(/\P{scx=Lina}/u, "\u{10126}");
-t(/\p{scx=Lina}/u, "\u{10127}");
-f(/\P{scx=Lina}/u, "\u{10127}");
-t(/\p{scx=Lina}/u, "\u{10128}");
-f(/\P{scx=Lina}/u, "\u{10128}");
-t(/\p{scx=Lina}/u, "\u{10129}");
-f(/\P{scx=Lina}/u, "\u{10129}");
-t(/\p{scx=Lina}/u, "\u{1012a}");
-f(/\P{scx=Lina}/u, "\u{1012a}");
-t(/\p{scx=Lina}/u, "\u{1012b}");
-f(/\P{scx=Lina}/u, "\u{1012b}");
-t(/\p{scx=Lina}/u, "\u{1012c}");
-f(/\P{scx=Lina}/u, "\u{1012c}");
-t(/\p{scx=Lina}/u, "\u{1012d}");
-f(/\P{scx=Lina}/u, "\u{1012d}");
-t(/\p{scx=Lina}/u, "\u{1012e}");
-f(/\P{scx=Lina}/u, "\u{1012e}");
-t(/\p{scx=Lina}/u, "\u{1012f}");
-f(/\P{scx=Lina}/u, "\u{1012f}");
-t(/\p{scx=Lina}/u, "\u{10130}");
-f(/\P{scx=Lina}/u, "\u{10130}");
-t(/\p{scx=Lina}/u, "\u{10131}");
-f(/\P{scx=Lina}/u, "\u{10131}");
-t(/\p{scx=Lina}/u, "\u{10132}");
-f(/\P{scx=Lina}/u, "\u{10132}");
-t(/\p{scx=Lina}/u, "\u{10133}");
-f(/\P{scx=Lina}/u, "\u{10133}");
-f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{901a6}");
-f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{4be73}");
-f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{c7b70}");
-f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{97401}");
-f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{48165}");
-// Script_Extension=Kthi
-t(/\p{scx=Kthi}/u, "\u{966}");
-f(/\P{scx=Kthi}/u, "\u{966}");
-t(/\p{scx=Kthi}/u, "\u{967}");
-f(/\P{scx=Kthi}/u, "\u{967}");
-t(/\p{scx=Kthi}/u, "\u{968}");
-f(/\P{scx=Kthi}/u, "\u{968}");
-t(/\p{scx=Kthi}/u, "\u{969}");
-f(/\P{scx=Kthi}/u, "\u{969}");
-t(/\p{scx=Kthi}/u, "\u{96a}");
-f(/\P{scx=Kthi}/u, "\u{96a}");
-t(/\p{scx=Kthi}/u, "\u{96b}");
-f(/\P{scx=Kthi}/u, "\u{96b}");
-t(/\p{scx=Kthi}/u, "\u{96c}");
-f(/\P{scx=Kthi}/u, "\u{96c}");
-t(/\p{scx=Kthi}/u, "\u{96d}");
-f(/\P{scx=Kthi}/u, "\u{96d}");
-t(/\p{scx=Kthi}/u, "\u{96e}");
-f(/\P{scx=Kthi}/u, "\u{96e}");
-t(/\p{scx=Kthi}/u, "\u{96f}");
-f(/\P{scx=Kthi}/u, "\u{96f}");
-t(/\p{scx=Kthi}/u, "\u{a836}");
-f(/\P{scx=Kthi}/u, "\u{a836}");
-t(/\p{scx=Kthi}/u, "\u{a837}");
-f(/\P{scx=Kthi}/u, "\u{a837}");
-t(/\p{scx=Kthi}/u, "\u{a838}");
-f(/\P{scx=Kthi}/u, "\u{a838}");
-t(/\p{scx=Kthi}/u, "\u{a839}");
-f(/\P{scx=Kthi}/u, "\u{a839}");
-t(/\p{scx=Kthi}/u, "\u{a830}");
-f(/\P{scx=Kthi}/u, "\u{a830}");
-t(/\p{scx=Kthi}/u, "\u{a831}");
-f(/\P{scx=Kthi}/u, "\u{a831}");
-t(/\p{scx=Kthi}/u, "\u{a832}");
-f(/\P{scx=Kthi}/u, "\u{a832}");
-t(/\p{scx=Kthi}/u, "\u{a833}");
-f(/\P{scx=Kthi}/u, "\u{a833}");
-t(/\p{scx=Kthi}/u, "\u{a834}");
-f(/\P{scx=Kthi}/u, "\u{a834}");
-t(/\p{scx=Kthi}/u, "\u{a835}");
-f(/\P{scx=Kthi}/u, "\u{a835}");
-f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{13d9b}");
-f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{24ff4}");
-f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{4c2c6}");
-f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{dfa34}");
-f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{cfd5e}");
-// Script_Extension=Mahj
-t(/\p{scx=Mahj}/u, "\u{966}");
-f(/\P{scx=Mahj}/u, "\u{966}");
-t(/\p{scx=Mahj}/u, "\u{967}");
-f(/\P{scx=Mahj}/u, "\u{967}");
-t(/\p{scx=Mahj}/u, "\u{968}");
-f(/\P{scx=Mahj}/u, "\u{968}");
-t(/\p{scx=Mahj}/u, "\u{969}");
-f(/\P{scx=Mahj}/u, "\u{969}");
-t(/\p{scx=Mahj}/u, "\u{96a}");
-f(/\P{scx=Mahj}/u, "\u{96a}");
-t(/\p{scx=Mahj}/u, "\u{96b}");
-f(/\P{scx=Mahj}/u, "\u{96b}");
-t(/\p{scx=Mahj}/u, "\u{96c}");
-f(/\P{scx=Mahj}/u, "\u{96c}");
-t(/\p{scx=Mahj}/u, "\u{96d}");
-f(/\P{scx=Mahj}/u, "\u{96d}");
-t(/\p{scx=Mahj}/u, "\u{96e}");
-f(/\P{scx=Mahj}/u, "\u{96e}");
-t(/\p{scx=Mahj}/u, "\u{96f}");
-f(/\P{scx=Mahj}/u, "\u{96f}");
-t(/\p{scx=Mahj}/u, "\u{a836}");
-f(/\P{scx=Mahj}/u, "\u{a836}");
-t(/\p{scx=Mahj}/u, "\u{a837}");
-f(/\P{scx=Mahj}/u, "\u{a837}");
-t(/\p{scx=Mahj}/u, "\u{a838}");
-f(/\P{scx=Mahj}/u, "\u{a838}");
-t(/\p{scx=Mahj}/u, "\u{a839}");
-f(/\P{scx=Mahj}/u, "\u{a839}");
-t(/\p{scx=Mahj}/u, "\u{a830}");
-f(/\P{scx=Mahj}/u, "\u{a830}");
-t(/\p{scx=Mahj}/u, "\u{a831}");
-f(/\P{scx=Mahj}/u, "\u{a831}");
-t(/\p{scx=Mahj}/u, "\u{a832}");
-f(/\P{scx=Mahj}/u, "\u{a832}");
-t(/\p{scx=Mahj}/u, "\u{a833}");
-f(/\P{scx=Mahj}/u, "\u{a833}");
-t(/\p{scx=Mahj}/u, "\u{a834}");
-f(/\P{scx=Mahj}/u, "\u{a834}");
-t(/\p{scx=Mahj}/u, "\u{a835}");
-f(/\P{scx=Mahj}/u, "\u{a835}");
-t(/\p{scx=Mahj}/u, "\u{964}");
-f(/\P{scx=Mahj}/u, "\u{964}");
-t(/\p{scx=Mahj}/u, "\u{965}");
-f(/\P{scx=Mahj}/u, "\u{965}");
-f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{101f2b}");
-f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{15a19}");
-f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{de10b}");
-f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{240fd}");
-f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{e5eef}");
+f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{e3554}");
+f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{e7555}");
+f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{29fc1}");
+f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{3fe04}");
+f(/(?=\P{sc=Lina})\p{scx=Lina}/u, "\u{df6e2}");
+// Script_Extension=Knda
+f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{36afd}");
+f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{72966}");
+f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{531de}");
+f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{cd350}");
+f(/(?=\P{sc=Knda})\p{scx=Knda}/u, "\u{4081f}");
 // Script_Extension=Kali
-t(/\p{scx=Kali}/u, "\u{a92e}");
-f(/\P{scx=Kali}/u, "\u{a92e}");
-f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{59dbb}");
-f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{ac769}");
-f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{9255e}");
-f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{a0523}");
-f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{cca65}");
+f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{2cc77}");
+f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{7973a}");
+f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{d67e0}");
+f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{6f0a6}");
+f(/(?=\P{sc=Kali})\p{scx=Kali}/u, "\u{130b7}");
 // Script_Extension=Buhd
-t(/\p{scx=Buhd}/u, "\u{1735}");
-f(/\P{scx=Buhd}/u, "\u{1735}");
-t(/\p{scx=Buhd}/u, "\u{1736}");
-f(/\P{scx=Buhd}/u, "\u{1736}");
-f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{102987}");
-f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{92d8}");
-f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{85acd}");
-f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{91eee}");
-f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{99bf7}");
+f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{91a77}");
+f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{dad60}");
+f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{10577d}");
+f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{107c7d}");
+f(/(?=\P{sc=Buhd})\p{scx=Buhd}/u, "\u{6d43d}");
 // Script_Extension=Hano
-t(/\p{scx=Hano}/u, "\u{1735}");
-f(/\P{scx=Hano}/u, "\u{1735}");
-t(/\p{scx=Hano}/u, "\u{1736}");
-f(/\P{scx=Hano}/u, "\u{1736}");
-f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{7b94b}");
-f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{10a944}");
-f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{2cec}");
-f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{64635}");
-f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{25bea}");
+f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{7e942}");
+f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{b0a24}");
+f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{106205}");
+f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{4ac72}");
+f(/(?=\P{sc=Hano})\p{scx=Hano}/u, "\u{e6681}");
 // Script_Extension=Tagb
-t(/\p{scx=Tagb}/u, "\u{1735}");
-f(/\P{scx=Tagb}/u, "\u{1735}");
-t(/\p{scx=Tagb}/u, "\u{1736}");
-f(/\P{scx=Tagb}/u, "\u{1736}");
-f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{950fe}");
-f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{e85b7}");
-f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{aead9}");
-f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{37473}");
-f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{a421a}");
+f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{dd8fa}");
+f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{e622d}");
+f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{d43fb}");
+f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{10ba23}");
+f(/(?=\P{sc=Tagb})\p{scx=Tagb}/u, "\u{bfbce}");
 // Script_Extension=Tglg
-t(/\p{scx=Tglg}/u, "\u{1735}");
-f(/\P{scx=Tglg}/u, "\u{1735}");
-t(/\p{scx=Tglg}/u, "\u{1736}");
-f(/\P{scx=Tglg}/u, "\u{1736}");
-f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{c560d}");
-f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{23ff2}");
-f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{b1557}");
-f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{f0d06}");
-f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{9982b}");
+f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{bb9f4}");
+f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{cb69f}");
+f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{5bb3f}");
+f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{b6f43}");
+f(/(?=\P{sc=Tglg})\p{scx=Tglg}/u, "\u{d013b}");
+// Script_Extension=Dogr
+f(/(?=\P{sc=Dogr})\p{scx=Dogr}/u, "\u{2d845}");
+f(/(?=\P{sc=Dogr})\p{scx=Dogr}/u, "\u{1a910}");
+f(/(?=\P{sc=Dogr})\p{scx=Dogr}/u, "\u{3ba2a}");
+f(/(?=\P{sc=Dogr})\p{scx=Dogr}/u, "\u{bde46}");
+f(/(?=\P{sc=Dogr})\p{scx=Dogr}/u, "\u{108e84}");
+// Script_Extension=Kthi
+f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{10dd0}");
+f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{5484b}");
+f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{3aed6}");
+f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{1e733}");
+f(/(?=\P{sc=Kthi})\p{scx=Kthi}/u, "\u{9448f}");
+// Script_Extension=Mahj
+f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{a2006}");
+f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{184cd}");
+f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{575ba}");
+f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{1005cb}");
+f(/(?=\P{sc=Mahj})\p{scx=Mahj}/u, "\u{c2d02}");
 // Script_Extension=Hang
-t(/\p{scx=Hang}/u, "\u{3003}");
-f(/\P{scx=Hang}/u, "\u{3003}");
-t(/\p{scx=Hang}/u, "\u{3013}");
-f(/\P{scx=Hang}/u, "\u{3013}");
-t(/\p{scx=Hang}/u, "\u{301c}");
-f(/\P{scx=Hang}/u, "\u{301c}");
-t(/\p{scx=Hang}/u, "\u{301d}");
-f(/\P{scx=Hang}/u, "\u{301d}");
-t(/\p{scx=Hang}/u, "\u{301e}");
-f(/\P{scx=Hang}/u, "\u{301e}");
-t(/\p{scx=Hang}/u, "\u{301f}");
-f(/\P{scx=Hang}/u, "\u{301f}");
-t(/\p{scx=Hang}/u, "\u{3030}");
-f(/\P{scx=Hang}/u, "\u{3030}");
-t(/\p{scx=Hang}/u, "\u{3037}");
-f(/\P{scx=Hang}/u, "\u{3037}");
-t(/\p{scx=Hang}/u, "\u{fe45}");
-f(/\P{scx=Hang}/u, "\u{fe45}");
-t(/\p{scx=Hang}/u, "\u{fe46}");
-f(/\P{scx=Hang}/u, "\u{fe46}");
-t(/\p{scx=Hang}/u, "\u{3001}");
-f(/\P{scx=Hang}/u, "\u{3001}");
-t(/\p{scx=Hang}/u, "\u{3002}");
-f(/\P{scx=Hang}/u, "\u{3002}");
-t(/\p{scx=Hang}/u, "\u{3008}");
-f(/\P{scx=Hang}/u, "\u{3008}");
-t(/\p{scx=Hang}/u, "\u{3009}");
-f(/\P{scx=Hang}/u, "\u{3009}");
-t(/\p{scx=Hang}/u, "\u{300a}");
-f(/\P{scx=Hang}/u, "\u{300a}");
-t(/\p{scx=Hang}/u, "\u{300b}");
-f(/\P{scx=Hang}/u, "\u{300b}");
-t(/\p{scx=Hang}/u, "\u{300c}");
-f(/\P{scx=Hang}/u, "\u{300c}");
-t(/\p{scx=Hang}/u, "\u{300d}");
-f(/\P{scx=Hang}/u, "\u{300d}");
-t(/\p{scx=Hang}/u, "\u{300e}");
-f(/\P{scx=Hang}/u, "\u{300e}");
-t(/\p{scx=Hang}/u, "\u{300f}");
-f(/\P{scx=Hang}/u, "\u{300f}");
-t(/\p{scx=Hang}/u, "\u{3010}");
-f(/\P{scx=Hang}/u, "\u{3010}");
-t(/\p{scx=Hang}/u, "\u{3011}");
-f(/\P{scx=Hang}/u, "\u{3011}");
-t(/\p{scx=Hang}/u, "\u{3014}");
-f(/\P{scx=Hang}/u, "\u{3014}");
-t(/\p{scx=Hang}/u, "\u{3015}");
-f(/\P{scx=Hang}/u, "\u{3015}");
-t(/\p{scx=Hang}/u, "\u{3016}");
-f(/\P{scx=Hang}/u, "\u{3016}");
-t(/\p{scx=Hang}/u, "\u{3017}");
-f(/\P{scx=Hang}/u, "\u{3017}");
-t(/\p{scx=Hang}/u, "\u{3018}");
-f(/\P{scx=Hang}/u, "\u{3018}");
-t(/\p{scx=Hang}/u, "\u{3019}");
-f(/\P{scx=Hang}/u, "\u{3019}");
-t(/\p{scx=Hang}/u, "\u{301a}");
-f(/\P{scx=Hang}/u, "\u{301a}");
-t(/\p{scx=Hang}/u, "\u{301b}");
-f(/\P{scx=Hang}/u, "\u{301b}");
-t(/\p{scx=Hang}/u, "\u{30fb}");
-f(/\P{scx=Hang}/u, "\u{30fb}");
-t(/\p{scx=Hang}/u, "\u{ff61}");
-f(/\P{scx=Hang}/u, "\u{ff61}");
-t(/\p{scx=Hang}/u, "\u{ff62}");
-f(/\P{scx=Hang}/u, "\u{ff62}");
-t(/\p{scx=Hang}/u, "\u{ff63}");
-f(/\P{scx=Hang}/u, "\u{ff63}");
-t(/\p{scx=Hang}/u, "\u{ff64}");
-f(/\P{scx=Hang}/u, "\u{ff64}");
-t(/\p{scx=Hang}/u, "\u{ff65}");
-f(/\P{scx=Hang}/u, "\u{ff65}");
-f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{97df3}");
-f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{e74b9}");
-f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{a68b2}");
-f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{82b9f}");
-f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{60ae0}");
-// Script_Extension=Mlym
-t(/\p{scx=Mlym}/u, "\u{1cda}");
-f(/\P{scx=Mlym}/u, "\u{1cda}");
-t(/\p{scx=Mlym}/u, "\u{952}");
-f(/\P{scx=Mlym}/u, "\u{952}");
-t(/\p{scx=Mlym}/u, "\u{951}");
-f(/\P{scx=Mlym}/u, "\u{951}");
-t(/\p{scx=Mlym}/u, "\u{964}");
-f(/\P{scx=Mlym}/u, "\u{964}");
-t(/\p{scx=Mlym}/u, "\u{965}");
-f(/\P{scx=Mlym}/u, "\u{965}");
-f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{8ac6a}");
-f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{2b695}");
-f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{56e47}");
-f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{c86ba}");
-f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{b74e9}");
-// Script_Extension=Telu
-t(/\p{scx=Telu}/u, "\u{1cda}");
-f(/\P{scx=Telu}/u, "\u{1cda}");
-t(/\p{scx=Telu}/u, "\u{952}");
-f(/\P{scx=Telu}/u, "\u{952}");
-t(/\p{scx=Telu}/u, "\u{951}");
-f(/\P{scx=Telu}/u, "\u{951}");
-t(/\p{scx=Telu}/u, "\u{964}");
-f(/\P{scx=Telu}/u, "\u{964}");
-t(/\p{scx=Telu}/u, "\u{965}");
-f(/\P{scx=Telu}/u, "\u{965}");
-f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{d8bfa}");
-f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{d2cc3}");
-f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{54006}");
-f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{104bf0}");
-f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{2a98d}");
-// Script_Extension=Adlm
-t(/\p{scx=Adlm}/u, "\u{640}");
-f(/\P{scx=Adlm}/u, "\u{640}");
-f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{17d17}");
-f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{90cdc}");
-f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{8a2ee}");
-f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{b1106}");
-f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{49e11}");
-// Script_Extension=Mand
-t(/\p{scx=Mand}/u, "\u{640}");
-f(/\P{scx=Mand}/u, "\u{640}");
-f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{103f01}");
-f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{d921a}");
-f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{dc97e}");
-f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{f1404}");
-f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{5f57c}");
-// Script_Extension=Mani
-t(/\p{scx=Mani}/u, "\u{640}");
-f(/\P{scx=Mani}/u, "\u{640}");
-f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{4785e}");
-f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{8a387}");
-f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{10553f}");
-f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{46537}");
-f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{301ef}");
-// Script_Extension=Phlp
-t(/\p{scx=Phlp}/u, "\u{640}");
-f(/\P{scx=Phlp}/u, "\u{640}");
-f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{b669d}");
-f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{e819a}");
-f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{5a57a}");
-f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{d6899}");
-f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{3215f}");
+f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{b42fb}");
+f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{15eff}");
+f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{cc05b}");
+f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{85919}");
+f(/(?=\P{sc=Hang})\p{scx=Hang}/u, "\u{c27ea}");
 // Script_Extension=Yiii
-t(/\p{scx=Yiii}/u, "\u{3001}");
-f(/\P{scx=Yiii}/u, "\u{3001}");
-t(/\p{scx=Yiii}/u, "\u{3002}");
-f(/\P{scx=Yiii}/u, "\u{3002}");
-t(/\p{scx=Yiii}/u, "\u{3008}");
-f(/\P{scx=Yiii}/u, "\u{3008}");
-t(/\p{scx=Yiii}/u, "\u{3009}");
-f(/\P{scx=Yiii}/u, "\u{3009}");
-t(/\p{scx=Yiii}/u, "\u{300a}");
-f(/\P{scx=Yiii}/u, "\u{300a}");
-t(/\p{scx=Yiii}/u, "\u{300b}");
-f(/\P{scx=Yiii}/u, "\u{300b}");
-t(/\p{scx=Yiii}/u, "\u{300c}");
-f(/\P{scx=Yiii}/u, "\u{300c}");
-t(/\p{scx=Yiii}/u, "\u{300d}");
-f(/\P{scx=Yiii}/u, "\u{300d}");
-t(/\p{scx=Yiii}/u, "\u{300e}");
-f(/\P{scx=Yiii}/u, "\u{300e}");
-t(/\p{scx=Yiii}/u, "\u{300f}");
-f(/\P{scx=Yiii}/u, "\u{300f}");
-t(/\p{scx=Yiii}/u, "\u{3010}");
-f(/\P{scx=Yiii}/u, "\u{3010}");
-t(/\p{scx=Yiii}/u, "\u{3011}");
-f(/\P{scx=Yiii}/u, "\u{3011}");
-t(/\p{scx=Yiii}/u, "\u{3014}");
-f(/\P{scx=Yiii}/u, "\u{3014}");
-t(/\p{scx=Yiii}/u, "\u{3015}");
-f(/\P{scx=Yiii}/u, "\u{3015}");
-t(/\p{scx=Yiii}/u, "\u{3016}");
-f(/\P{scx=Yiii}/u, "\u{3016}");
-t(/\p{scx=Yiii}/u, "\u{3017}");
-f(/\P{scx=Yiii}/u, "\u{3017}");
-t(/\p{scx=Yiii}/u, "\u{3018}");
-f(/\P{scx=Yiii}/u, "\u{3018}");
-t(/\p{scx=Yiii}/u, "\u{3019}");
-f(/\P{scx=Yiii}/u, "\u{3019}");
-t(/\p{scx=Yiii}/u, "\u{301a}");
-f(/\P{scx=Yiii}/u, "\u{301a}");
-t(/\p{scx=Yiii}/u, "\u{301b}");
-f(/\P{scx=Yiii}/u, "\u{301b}");
-t(/\p{scx=Yiii}/u, "\u{30fb}");
-f(/\P{scx=Yiii}/u, "\u{30fb}");
-t(/\p{scx=Yiii}/u, "\u{ff61}");
-f(/\P{scx=Yiii}/u, "\u{ff61}");
-t(/\p{scx=Yiii}/u, "\u{ff62}");
-f(/\P{scx=Yiii}/u, "\u{ff62}");
-t(/\p{scx=Yiii}/u, "\u{ff63}");
-f(/\P{scx=Yiii}/u, "\u{ff63}");
-t(/\p{scx=Yiii}/u, "\u{ff64}");
-f(/\P{scx=Yiii}/u, "\u{ff64}");
-t(/\p{scx=Yiii}/u, "\u{ff65}");
-f(/\P{scx=Yiii}/u, "\u{ff65}");
-f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{2f309}");
-f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{b5b22}");
-f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{d51ae}");
-f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{77b48}");
-f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{12f5}");
-// Script_Extension=Modi
-t(/\p{scx=Modi}/u, "\u{a836}");
-f(/\P{scx=Modi}/u, "\u{a836}");
-t(/\p{scx=Modi}/u, "\u{a837}");
-f(/\P{scx=Modi}/u, "\u{a837}");
-t(/\p{scx=Modi}/u, "\u{a838}");
-f(/\P{scx=Modi}/u, "\u{a838}");
-t(/\p{scx=Modi}/u, "\u{a839}");
-f(/\P{scx=Modi}/u, "\u{a839}");
-t(/\p{scx=Modi}/u, "\u{a830}");
-f(/\P{scx=Modi}/u, "\u{a830}");
-t(/\p{scx=Modi}/u, "\u{a831}");
-f(/\P{scx=Modi}/u, "\u{a831}");
-t(/\p{scx=Modi}/u, "\u{a832}");
-f(/\P{scx=Modi}/u, "\u{a832}");
-t(/\p{scx=Modi}/u, "\u{a833}");
-f(/\P{scx=Modi}/u, "\u{a833}");
-t(/\p{scx=Modi}/u, "\u{a834}");
-f(/\P{scx=Modi}/u, "\u{a834}");
-t(/\p{scx=Modi}/u, "\u{a835}");
-f(/\P{scx=Modi}/u, "\u{a835}");
-f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{e64ef}");
-f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{ff1a8}");
-f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{103374}");
-f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{721f6}");
-f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{65c4f}");
-// Script_Extension=Sind
-t(/\p{scx=Sind}/u, "\u{a836}");
-f(/\P{scx=Sind}/u, "\u{a836}");
-t(/\p{scx=Sind}/u, "\u{a837}");
-f(/\P{scx=Sind}/u, "\u{a837}");
-t(/\p{scx=Sind}/u, "\u{a838}");
-f(/\P{scx=Sind}/u, "\u{a838}");
-t(/\p{scx=Sind}/u, "\u{a839}");
-f(/\P{scx=Sind}/u, "\u{a839}");
-t(/\p{scx=Sind}/u, "\u{a830}");
-f(/\P{scx=Sind}/u, "\u{a830}");
-t(/\p{scx=Sind}/u, "\u{a831}");
-f(/\P{scx=Sind}/u, "\u{a831}");
-t(/\p{scx=Sind}/u, "\u{a832}");
-f(/\P{scx=Sind}/u, "\u{a832}");
-t(/\p{scx=Sind}/u, "\u{a833}");
-f(/\P{scx=Sind}/u, "\u{a833}");
-t(/\p{scx=Sind}/u, "\u{a834}");
-f(/\P{scx=Sind}/u, "\u{a834}");
-t(/\p{scx=Sind}/u, "\u{a835}");
-f(/\P{scx=Sind}/u, "\u{a835}");
-t(/\p{scx=Sind}/u, "\u{964}");
-f(/\P{scx=Sind}/u, "\u{964}");
-t(/\p{scx=Sind}/u, "\u{965}");
-f(/\P{scx=Sind}/u, "\u{965}");
-f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{63856}");
-f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{10fce1}");
-f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{e9acf}");
-f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{3127f}");
-f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{c7ceb}");
-// Script_Extension=Takr
-t(/\p{scx=Takr}/u, "\u{a836}");
-f(/\P{scx=Takr}/u, "\u{a836}");
-t(/\p{scx=Takr}/u, "\u{a837}");
-f(/\P{scx=Takr}/u, "\u{a837}");
-t(/\p{scx=Takr}/u, "\u{a838}");
-f(/\P{scx=Takr}/u, "\u{a838}");
-t(/\p{scx=Takr}/u, "\u{a839}");
-f(/\P{scx=Takr}/u, "\u{a839}");
-t(/\p{scx=Takr}/u, "\u{a830}");
-f(/\P{scx=Takr}/u, "\u{a830}");
-t(/\p{scx=Takr}/u, "\u{a831}");
-f(/\P{scx=Takr}/u, "\u{a831}");
-t(/\p{scx=Takr}/u, "\u{a832}");
-f(/\P{scx=Takr}/u, "\u{a832}");
-t(/\p{scx=Takr}/u, "\u{a833}");
-f(/\P{scx=Takr}/u, "\u{a833}");
-t(/\p{scx=Takr}/u, "\u{a834}");
-f(/\P{scx=Takr}/u, "\u{a834}");
-t(/\p{scx=Takr}/u, "\u{a835}");
-f(/\P{scx=Takr}/u, "\u{a835}");
-t(/\p{scx=Takr}/u, "\u{964}");
-f(/\P{scx=Takr}/u, "\u{964}");
-t(/\p{scx=Takr}/u, "\u{965}");
-f(/\P{scx=Takr}/u, "\u{965}");
-f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{ec200}");
-f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{10602d}");
-f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{6143c}");
-f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{cc552}");
-f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{d1b37}");
-// Script_Extension=Tirh
-t(/\p{scx=Tirh}/u, "\u{a836}");
-f(/\P{scx=Tirh}/u, "\u{a836}");
-t(/\p{scx=Tirh}/u, "\u{a837}");
-f(/\P{scx=Tirh}/u, "\u{a837}");
-t(/\p{scx=Tirh}/u, "\u{a838}");
-f(/\P{scx=Tirh}/u, "\u{a838}");
-t(/\p{scx=Tirh}/u, "\u{a839}");
-f(/\P{scx=Tirh}/u, "\u{a839}");
-t(/\p{scx=Tirh}/u, "\u{a830}");
-f(/\P{scx=Tirh}/u, "\u{a830}");
-t(/\p{scx=Tirh}/u, "\u{a831}");
-f(/\P{scx=Tirh}/u, "\u{a831}");
-t(/\p{scx=Tirh}/u, "\u{a832}");
-f(/\P{scx=Tirh}/u, "\u{a832}");
-t(/\p{scx=Tirh}/u, "\u{a833}");
-f(/\P{scx=Tirh}/u, "\u{a833}");
-t(/\p{scx=Tirh}/u, "\u{a834}");
-f(/\P{scx=Tirh}/u, "\u{a834}");
-t(/\p{scx=Tirh}/u, "\u{a835}");
-f(/\P{scx=Tirh}/u, "\u{a835}");
-t(/\p{scx=Tirh}/u, "\u{964}");
-f(/\P{scx=Tirh}/u, "\u{964}");
-t(/\p{scx=Tirh}/u, "\u{965}");
-f(/\P{scx=Tirh}/u, "\u{965}");
-f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{d8409}");
-f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{4406c}");
-f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{aef3d}");
-f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{46186}");
-f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{b1229}");
+f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{b9c10}");
+f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{55fef}");
+f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{fe59b}");
+f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{ffd82}");
+f(/(?=\P{sc=Yiii})\p{scx=Yiii}/u, "\u{7df88}");
+// Script_Extension=Mlym
+f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{38ca6}");
+f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{b536b}");
+f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{d73c3}");
+f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{ef7c}");
+f(/(?=\P{sc=Mlym})\p{scx=Mlym}/u, "\u{54f11}");
 // Script_Extension=Orya
-t(/\p{scx=Orya}/u, "\u{952}");
-f(/\P{scx=Orya}/u, "\u{952}");
-t(/\p{scx=Orya}/u, "\u{951}");
-f(/\P{scx=Orya}/u, "\u{951}");
-t(/\p{scx=Orya}/u, "\u{964}");
-f(/\P{scx=Orya}/u, "\u{964}");
-t(/\p{scx=Orya}/u, "\u{965}");
-f(/\P{scx=Orya}/u, "\u{965}");
-f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{38982}");
-f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{a6422}");
-f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{b40c4}");
-f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{50b36}");
-f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{8033b}");
+f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{103437}");
+f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{6db9f}");
+f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{c0cbf}");
+f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{693e6}");
+f(/(?=\P{sc=Orya})\p{scx=Orya}/u, "\u{107f31}");
+// Script_Extension=Telu
+f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{4565}");
+f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{92ad2}");
+f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{7de0b}");
+f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{bc7b2}");
+f(/(?=\P{sc=Telu})\p{scx=Telu}/u, "\u{9edd7}");
+// Script_Extension=Adlm
+f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{8be77}");
+f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{31dbb}");
+f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{f2854}");
+f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{10a682}");
+f(/(?=\P{sc=Adlm})\p{scx=Adlm}/u, "\u{eba94}");
+// Script_Extension=Mand
+f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{180bd}");
+f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{98fb9}");
+f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{aaa0c}");
+f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{de7c8}");
+f(/(?=\P{sc=Mand})\p{scx=Mand}/u, "\u{e27ed}");
+// Script_Extension=Mani
+f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{88d89}");
+f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{2102d}");
+f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{35a92}");
+f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{1e78e}");
+f(/(?=\P{sc=Mani})\p{scx=Mani}/u, "\u{6afba}");
+// Script_Extension=Phlp
+f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{10677d}");
+f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{31238}");
+f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{62ae}");
+f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{88872}");
+f(/(?=\P{sc=Phlp})\p{scx=Phlp}/u, "\u{9720e}");
+// Script_Extension=Sogd
+f(/(?=\P{sc=Sogd})\p{scx=Sogd}/u, "\u{4c593}");
+f(/(?=\P{sc=Sogd})\p{scx=Sogd}/u, "\u{74ba6}");
+f(/(?=\P{sc=Sogd})\p{scx=Sogd}/u, "\u{f97a0}");
+f(/(?=\P{sc=Sogd})\p{scx=Sogd}/u, "\u{62e97}");
+f(/(?=\P{sc=Sogd})\p{scx=Sogd}/u, "\u{d2895}");
+// Script_Extension=Modi
+f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{107b3}");
+f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{c6ffe}");
+f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{57254}");
+f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{3a9de}");
+f(/(?=\P{sc=Modi})\p{scx=Modi}/u, "\u{bb58d}");
+// Script_Extension=Sind
+f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{b2f72}");
+f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{f7673}");
+f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{b2066}");
+f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{22ea9}");
+f(/(?=\P{sc=Sind})\p{scx=Sind}/u, "\u{492a}");
+// Script_Extension=Takr
+f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{89a3a}");
+f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{2c9bb}");
+f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{60523}");
+f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{86916}");
+f(/(?=\P{sc=Takr})\p{scx=Takr}/u, "\u{ce4af}");
+// Script_Extension=Tirh
+f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{2905}");
+f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{900cf}");
+f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{4b07a}");
+f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{2319}");
+f(/(?=\P{sc=Tirh})\p{scx=Tirh}/u, "\u{69d82}");
+// Script_Extension=Gong
+f(/(?=\P{sc=Gong})\p{scx=Gong}/u, "\u{3ce05}");
+f(/(?=\P{sc=Gong})\p{scx=Gong}/u, "\u{362e8}");
+f(/(?=\P{sc=Gong})\p{scx=Gong}/u, "\u{fe0b9}");
+f(/(?=\P{sc=Gong})\p{scx=Gong}/u, "\u{99c0c}");
+f(/(?=\P{sc=Gong})\p{scx=Gong}/u, "\u{10a9c2}");
 // Script_Extension=Sinh
-t(/\p{scx=Sinh}/u, "\u{964}");
-f(/\P{scx=Sinh}/u, "\u{964}");
-t(/\p{scx=Sinh}/u, "\u{965}");
-f(/\P{scx=Sinh}/u, "\u{965}");
-f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{10a8c2}");
-f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{109c02}");
-f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{eb3fd}");
-f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{a884}");
-f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{89f0f}");
+f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{8ac14}");
+f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{fea84}");
+f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{5f107}");
+f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{7ed82}");
+f(/(?=\P{sc=Sinh})\p{scx=Sinh}/u, "\u{1b5b4}");
 // Script_Extension=Limb
-t(/\p{scx=Limb}/u, "\u{965}");
-f(/\P{scx=Limb}/u, "\u{965}");
-f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{9c91e}");
-f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{e0433}");
-f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{10d7c7}");
-f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{f3980}");
-f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{d5094}");
+f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{36208}");
+f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{dff4e}");
+f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{fb421}");
+f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{5e20e}");
+f(/(?=\P{sc=Limb})\p{scx=Limb}/u, "\u{b6402}");
diff --git a/src/v8/test/mjsunit/harmony/regexp-property-scripts.js b/src/v8/test/mjsunit/harmony/regexp-property-scripts.js
index 565a59a..af0d443 100644
--- a/src/v8/test/mjsunit/harmony/regexp-property-scripts.js
+++ b/src/v8/test/mjsunit/harmony/regexp-property-scripts.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
-
 function t(re, s) { assertTrue(re.test(s)); }
 function f(re, s) { assertFalse(re.test(s)); }
 
diff --git a/src/v8/test/mjsunit/harmony/regexp-property-sequence.js b/src/v8/test/mjsunit/harmony/regexp-property-sequence.js
new file mode 100644
index 0000000..4d43298
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/regexp-property-sequence.js
@@ -0,0 +1,88 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-regexp-sequence
+
+// Normal usage.
+assertDoesNotThrow("/\\p{Emoji_Flag_Sequence}/u");
+assertTrue(/\p{Emoji_Flag_Sequence}/u.test("\u{1F1E9}\u{1F1EA}"));
+
+assertDoesNotThrow("/\\p{Emoji_Keycap_Sequence}/u");
+assertTrue(/\p{Emoji_Keycap_Sequence}/u.test("\u0023\uFE0F\u20E3"));
+
+assertDoesNotThrow("/\\p{Emoji_Keycap_Sequence}/u");
+assertFalse(/\p{Emoji_Keycap_Sequence}/u.test("\u0022\uFE0F\u20E3"));
+
+assertDoesNotThrow("/\\p{Emoji_Modifier_Sequence}/u");
+assertTrue(/\p{Emoji_Modifier_Sequence}/u.test("\u26F9\u{1F3FF}"));
+
+assertDoesNotThrow("/\\p{Emoji_ZWJ_Sequence}/u");
+assertTrue(/\p{Emoji_ZWJ_Sequence}/u.test("\u{1F468}\u{200D}\u{1F467}"));
+
+// Without unicode flag.
+assertDoesNotThrow("/\\p{Emoji_Flag_Sequence}/");
+assertFalse(/\p{Emoji_Flag_Sequence}/.test("\u{1F1E9}\u{1F1EA}"));
+assertTrue(/\p{Emoji_Flag_Sequence}/.test("\\p{Emoji_Flag_Sequence}"));
+
+// Negated and/or inside a character class.
+assertThrows("/\\P{Emoji_Flag_Sequence}/u");
+assertThrows("/\\P{Emoji_Keycap_Sequence}/u");
+assertThrows("/\\P{Emoji_Modifier_Sequence}/u");
+assertThrows("/\\P{Emoji_Tag_Sequence}/u");
+assertThrows("/\\P{Emoji_ZWJ_Sequence}/u");
+
+assertThrows("/[\\p{Emoji_Flag_Sequence}]/u");
+assertThrows("/[\\p{Emoji_Keycap_Sequence}]/u");
+assertThrows("/[\\p{Emoji_Modifier_Sequence}]/u");
+assertThrows("/[\\p{Emoji_Tag_Sequence}]/u");
+assertThrows("/[\\p{Emoji_ZWJ_Sequence}]/u");
+
+assertThrows("/[\\P{Emoji_Flag_Sequence}]/u");
+assertThrows("/[\\P{Emoji_Keycap_Sequence}]/u");
+assertThrows("/[\\P{Emoji_Modifier_Sequence}]/u");
+assertThrows("/[\\P{Emoji_Tag_Sequence}]/u");
+assertThrows("/[\\P{Emoji_ZWJ_Sequence}]/u");
+
+assertThrows("/[\\w\\p{Emoji_Flag_Sequence}]/u");
+assertThrows("/[\\w\\p{Emoji_Keycap_Sequence}]/u");
+assertThrows("/[\\w\\p{Emoji_Modifier_Sequence}]/u");
+assertThrows("/[\\w\\p{Emoji_Tag_Sequence}]/u");
+assertThrows("/[\\w\\p{Emoji_ZWJ_Sequence}]/u");
+
+assertThrows("/[\\w\\P{Emoji_Flag_Sequence}]/u");
+assertThrows("/[\\w\\P{Emoji_Keycap_Sequence}]/u");
+assertThrows("/[\\w\\P{Emoji_Modifier_Sequence}]/u");
+assertThrows("/[\\w\\P{Emoji_Tag_Sequence}]/u");
+assertThrows("/[\\w\\P{Emoji_ZWJ_Sequence}]/u");
+
+// Two regional indicators, but not a country.
+assertFalse(/\p{Emoji_Flag_Sequence}/u.test("\u{1F1E6}\u{1F1E6}"));
+
+// ZWJ sequence as in two ZWJ elements joined by a ZWJ, but not in the list.
+assertFalse(/\p{Emoji_ZWJ_Sequence}/u.test("\u{1F467}\u{200D}\u{1F468}"));
+
+// More complex regexp
+assertEquals(
+    ["country flag: \u{1F1E6}\u{1F1F9}"],
+    /Country Flag: \p{Emoji_Flag_Sequence}/iu.exec(
+        "this is an example of a country flag: \u{1F1E6}\u{1F1F9} is Austria"));
+assertEquals(
+    ["country flag: \u{1F1E6}\u{1F1F9}", "\u{1F1E6}\u{1F1F9}"],
+    /Country Flag: (\p{Emoji_Flag_Sequence})/iu.exec(
+        "this is an example of a country flag: \u{1F1E6}\u{1F1F9} is Austria"));
+assertEquals(
+    ["country flag: \u{1F1E6}\u{1F1F9}"],
+    /Country Flag: ..(?<=\p{Emoji_Flag_Sequence})/iu.exec(
+        "this is an example of a country flag: \u{1F1E6}\u{1F1F9} is Austria"));
+assertEquals(
+    ["flag: \u{1F1E6}\u{1F1F9}", "\u{1F1E6}\u{1F1F9}"],
+    /Flag: ..(?<=(\p{Emoji_Flag_Sequence})|\p{Emoji_Keycap_Sequence})/iu.exec(
+        "this is an example of a country flag: \u{1F1E6}\u{1F1F9} is Austria"));
+
+// Partial sequences.
+assertFalse(/\p{Emoji_Flag_Sequence}/u.test("\u{1F1E6}_"));
+assertFalse(/\p{Emoji_Keycap_Sequence}/u.test("2\uFE0F_"));
+assertFalse(/\p{Emoji_Modifier_Sequence}/u.test("\u261D_"));
+assertFalse(/\p{Emoji_Tag_Sequence}/u.test("\u{1F3F4}\u{E0067}\u{E0062}\u{E0065}\u{E006E}\u{E0067}_"));
+assertFalse(/\p{Emoji_ZWJ_Sequence}/u.test("\u{1F468}\u200D\u2764\uFE0F\u200D_"));
diff --git a/src/v8/test/mjsunit/harmony/regexp-property-special.js b/src/v8/test/mjsunit/harmony/regexp-property-special.js
index 58a7f6b..07263c6 100644
--- a/src/v8/test/mjsunit/harmony/regexp-property-special.js
+++ b/src/v8/test/mjsunit/harmony/regexp-property-special.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
-
 function t(re, s) { assertTrue(re.test(s)); }
 function f(re, s) { assertFalse(re.test(s)); }
 
diff --git a/src/v8/test/mjsunit/harmony/regress-generators-resume.js b/src/v8/test/mjsunit/harmony/regress-generators-resume.js
index c72ac30..77c933e 100644
--- a/src/v8/test/mjsunit/harmony/regress-generators-resume.js
+++ b/src/v8/test/mjsunit/harmony/regress-generators-resume.js
@@ -12,6 +12,7 @@
   return 0;
 }
 
+%PrepareFunctionForOptimization(foo);
 g = foo();
 %OptimizeFunctionOnNextCall(foo);
 g.next();
diff --git a/src/v8/test/mjsunit/harmony/regress/regress-772649.js b/src/v8/test/mjsunit/harmony/regress/regress-772649.js
index 2ff2767..cb88b4a 100644
--- a/src/v8/test/mjsunit/harmony/regress/regress-772649.js
+++ b/src/v8/test/mjsunit/harmony/regress/regress-772649.js
@@ -5,6 +5,7 @@
 // Flags: --allow-natives-syntax
 
 async function* gen([[notIterable]] = [null]) {}
+%PrepareFunctionForOptimization(gen);
 assertThrows(() => gen(), TypeError);
 assertThrows(() => gen(), TypeError);
 %OptimizeFunctionOnNextCall(gen);
diff --git a/src/v8/test/mjsunit/harmony/regress/regress-8808.js b/src/v8/test/mjsunit/harmony/regress/regress-8808.js
new file mode 100644
index 0000000..6127749
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/regress/regress-8808.js
@@ -0,0 +1,13 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(() => eval(`
+  class Foo {
+    #x = 1;
+    destructureX() {
+      const { #x: x } = this;
+      return x;
+    }
+  }
+`), SyntaxError);
diff --git a/src/v8/test/mjsunit/harmony/regress/regress-897436.js b/src/v8/test/mjsunit/harmony/regress/regress-897436.js
new file mode 100644
index 0000000..c0cf416
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/regress/regress-897436.js
@@ -0,0 +1,12 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --enable-slow-asserts
+
+async function* gen() {
+  const alwaysPending = new Promise(() => {});
+  alwaysPending.then = "non-callable then";
+  yield alwaysPending;
+}
+gen().next();
diff --git a/src/v8/test/mjsunit/harmony/regress/regress-912504.js b/src/v8/test/mjsunit/harmony/regress/regress-912504.js
new file mode 100644
index 0000000..42428ba
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/regress/regress-912504.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --always-opt --allow-natives-syntax
+
+function test() {
+  Object.fromEntries([[]]);
+  %DeoptimizeNow();
+}
+test();
diff --git a/src/v8/test/mjsunit/harmony/regress/regress-952722.js b/src/v8/test/mjsunit/harmony/regress/regress-952722.js
new file mode 100644
index 0000000..6d6b020
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/regress/regress-952722.js
@@ -0,0 +1,12 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-lazy
+
+class A {
+  static #a = 1;
+  static b = class {
+    static get_A() { return val.#a; }
+  }
+}
diff --git a/src/v8/test/mjsunit/harmony/regress/regress-crbug-347528.js b/src/v8/test/mjsunit/harmony/regress/regress-crbug-347528.js
index e4e8efb..8fd8eac 100644
--- a/src/v8/test/mjsunit/harmony/regress/regress-crbug-347528.js
+++ b/src/v8/test/mjsunit/harmony/regress/regress-crbug-347528.js
@@ -30,6 +30,7 @@
 "use strict";
 let unused_var = 1;
 function __f_12() { new Array(); }
+%PrepareFunctionForOptimization(__f_12);
 __f_12();
 __f_12();
 %OptimizeFunctionOnNextCall(__f_12);
diff --git a/src/v8/test/mjsunit/harmony/sharedarraybuffer-stress.js b/src/v8/test/mjsunit/harmony/sharedarraybuffer-stress.js
new file mode 100644
index 0000000..24724ee
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/sharedarraybuffer-stress.js
@@ -0,0 +1,36 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function Alloc(size) {
+  let b = new SharedArrayBuffer(size);
+  let v = new Int32Array(b);
+  return {buffer : b, view : v};
+}
+
+function RunSomeAllocs(total, retained, size) {
+  print(`-------iterations = ${total}, retained = $ { retained } -------`);
+  var array = new Array(retained);
+  for (var i = 0; i < total; i++) {
+    if ((i % 25) == 0)
+      print(`iteration $ { i }`);
+    let pair = Alloc(size);
+    // For some iterations, retain the memory, view, or both.
+    switch (i % 3) {
+    case 0:
+      pair.memory = null;
+      break;
+    case 1:
+      pair.view = null;
+      break;
+    case 2:
+      break;
+    }
+    array[i % retained] = pair;
+  }
+}
+
+RunSomeAllocs(10, 1, 1024);
+RunSomeAllocs(100, 3, 2048);
+RunSomeAllocs(1000, 10, 16384);
+RunSomeAllocs(10000, 20, 32768);
diff --git a/src/v8/test/mjsunit/harmony/sharedarraybuffer-worker-gc-stress.js b/src/v8/test/mjsunit/harmony/sharedarraybuffer-worker-gc-stress.js
new file mode 100644
index 0000000..7c86db7
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/sharedarraybuffer-worker-gc-stress.js
@@ -0,0 +1,22 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load("test/mjsunit/worker-ping-test.js");
+
+let config = {
+  numThings: 4,       // size of circular buffer
+  numWorkers: 4,      // number of workers
+  numMessages: 10000, // number of messages sent to each worker
+  allocInterval: 11,  // interval for allocating new things per worker
+  traceScript: false, // print the script
+  traceAlloc: false,  // print each allocation attempt
+  traceIteration: 10, // print diagnostics every so many iterations
+  abortOnFail: true,  // kill worker if allocation fails
+
+  AllocThing: function AllocThing(id) {
+    return new SharedArrayBuffer(10000);
+  },
+}
+
+RunWorkerPingTest(config);
diff --git a/src/v8/test/mjsunit/harmony/sharedarraybuffer.js b/src/v8/test/mjsunit/harmony/sharedarraybuffer.js
index a79574d..6fa8494 100644
--- a/src/v8/test/mjsunit/harmony/sharedarraybuffer.js
+++ b/src/v8/test/mjsunit/harmony/sharedarraybuffer.js
@@ -47,11 +47,9 @@
   assertThrows(function() { new SharedArrayBuffer(-10); }, RangeError);
   assertThrows(function() { new SharedArrayBuffer(-2.567); }, RangeError);
 
-/* TODO[dslomov]: Reenable the test
   assertThrows(function() {
     var ab1 = new SharedArrayBuffer(0xFFFFFFFFFFFF)
   }, RangeError);
-*/
 
   var sab = new SharedArrayBuffer();
   assertSame(0, sab.byteLength);
@@ -450,10 +448,10 @@
   assertEquals(255, a[s2]);
   assertEquals(0, a[-0]);
 
-  /* Chromium bug: 424619
-   * a[-Infinity] = 50;
-   * assertEquals(undefined, a[-Infinity]);
-   */
+
+  a[-Infinity] = 50;
+  assertEquals(undefined, a[-Infinity]);
+
   a[1.5] = 10;
   assertEquals(undefined, a[1.5]);
   var nan = Math.sqrt(-1);
@@ -499,10 +497,9 @@
   assertEquals(255, a[s2]);
   assertEquals(0, a[-0]);
 
-  /* Chromium bug: 424619
-   * a[-Infinity] = 50;
-   * assertEquals(undefined, a[-Infinity]);
-   */
+  a[-Infinity] = 50;
+  assertEquals(undefined, a[-Infinity]);
+
   a[1.5] = 10;
   assertEquals(undefined, a[1.5]);
   var nan = Math.sqrt(-1);
diff --git a/src/v8/test/mjsunit/harmony/string-matchAll-deleted-matchAll.js b/src/v8/test/mjsunit/harmony/string-matchAll-deleted-matchAll.js
new file mode 100644
index 0000000..2de260f
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/string-matchAll-deleted-matchAll.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+delete RegExp.prototype[Symbol.matchAll];
+const str = 'a';
+assertThrows(() => str.matchAll(/\w/g), TypeError);
diff --git a/src/v8/test/mjsunit/harmony/string-matchAll.js b/src/v8/test/mjsunit/harmony/string-matchAll.js
new file mode 100644
index 0000000..39c2d0d
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/string-matchAll.js
@@ -0,0 +1,98 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function TestReceiverNonString() {
+  const iter = 'a'.matchAll(/./);
+  assertThrows(
+    () => iter.next.call(0),
+    TypeError
+  );
+})();
+
+
+(function TestAncestry() {
+  const iterProto = Object.getPrototypeOf('a'.matchAll(/./));
+  const arrProto = Object.getPrototypeOf([][Symbol.iterator]());
+
+  assertSame(Object.getPrototypeOf(iterProto), Object.getPrototypeOf(arrProto));
+})();
+
+
+function TestNoMatch(string, regex_or_string) {
+  const next_result = string.matchAll(regex_or_string).next();
+  assertSame(undefined, next_result.value);
+  assertTrue(next_result.done);
+}
+TestNoMatch('a', /b/);
+TestNoMatch('a', /b/g);
+TestNoMatch('a', 'b');
+
+
+(function NonGlobalRegex() {
+  const iter = 'ab'.matchAll(/./);
+  let next_result = iter.next();
+  assertEquals(['a'], next_result.value);
+  assertFalse(next_result.done);
+
+  next_result = iter.next();
+  assertEquals(undefined, next_result.value);
+  assertTrue(next_result.done);
+})();
+
+
+function TestGlobalRegex(regex_or_string) {
+  const iter = 'ab'.matchAll(/./g);
+  let next_result = iter.next();
+  assertEquals(['a'], next_result.value);
+  assertFalse(next_result.done);
+
+  next_result = iter.next();
+  assertEquals(['b'], next_result.value);
+  assertFalse(next_result.done);
+
+  next_result = iter.next();
+  assertSame(undefined, next_result.value);
+  assertTrue(next_result.done);
+}
+TestGlobalRegex(/./g);
+TestGlobalRegex('.');
+
+
+function TestEmptyGlobalRegExp(regex_or_string) {
+  const iter = 'd'.matchAll(regex_or_string);
+  let next_result = iter.next();
+  assertEquals([''], next_result.value);
+  assertFalse(next_result.done);
+
+  next_result = iter.next();
+  assertEquals([''], next_result.value);
+  assertFalse(next_result.done);
+
+  next_result = iter.next();
+  assertSame(undefined, next_result.value);
+  assertTrue(next_result.done);
+}
+TestEmptyGlobalRegExp(undefined);
+TestEmptyGlobalRegExp(/(?:)/g);
+TestEmptyGlobalRegExp('');
+
+
+(function TestGlobalRegExpLastIndex() {
+  const regex = /./g;
+  const string = 'abc';
+  regex.exec(string);
+  assertSame(1, regex.lastIndex);
+
+  const iter = string.matchAll(regex);
+
+  // Verify an internal RegExp is created and mutations to the provided RegExp
+  // are not abservered.
+  regex.exec(string);
+  assertSame(2, regex.lastIndex);
+
+  let next_result = iter.next();
+  assertEquals(['b'], next_result.value);
+  assertFalse(next_result.done);
+  assertSame(2, regex.lastIndex);
+})();
diff --git a/src/v8/test/mjsunit/harmony/symbol-description.js b/src/v8/test/mjsunit/harmony/symbol-description.js
new file mode 100644
index 0000000..39de1b0
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/symbol-description.js
@@ -0,0 +1,51 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+{
+  let desc = Object.getOwnPropertyDescriptor(Symbol.prototype, 'description');
+  assertEquals(desc.set, undefined);
+  assertEquals(desc.writable, undefined);
+  assertFalse(desc.enumerable);
+  assertTrue(desc.configurable);
+}
+
+{
+  const empty = Symbol();
+  assertEquals(empty.description, undefined);
+
+  const symbol = Symbol('test');
+  assertEquals(symbol.description, 'test');
+  assertFalse(symbol.hasOwnProperty('description'));
+}
+
+{
+  const empty = Object(Symbol());
+  assertEquals(empty.description, undefined);
+
+  const symbol = Object(Symbol('test'));
+  assertEquals(symbol.description, 'test');
+  assertFalse(symbol.hasOwnProperty('description'));
+}
+
+{
+  assertThrows(function() {
+    const proxy = new Proxy({}, {});
+    Symbol.prototype.description.call(proxy);
+  }, TypeError);
+
+  assertThrows(function() {
+    const smi = 123;
+    Symbol.prototype.description.call(smi);
+  }, TypeError);
+
+  assertThrows(function() {
+    const str = 'string';
+    Symbol.prototype.description.call(string);
+  }, TypeError);
+
+  assertThrows(function() {
+    const obj = { prop: 'test' };
+    Symbol.prototype.description.call(obj);
+  }, TypeError);
+}
diff --git a/src/v8/test/mjsunit/harmony/to-number.js b/src/v8/test/mjsunit/harmony/to-number.js
index 6dc4db5..a48a7d8 100644
--- a/src/v8/test/mjsunit/harmony/to-number.js
+++ b/src/v8/test/mjsunit/harmony/to-number.js
@@ -5,47 +5,34 @@
 // Flags: --allow-natives-syntax
 
 assertEquals(1, %ToNumber(1));
-assertEquals(1, %_ToNumber(1));
 
 assertEquals(.5, %ToNumber(.5));
-assertEquals(.5, %_ToNumber(.5));
 
 assertEquals(0, %ToNumber(null));
-assertEquals(0, %_ToNumber(null));
 
 assertEquals(1, %ToNumber(true));
-assertEquals(1, %_ToNumber(true));
 
 assertEquals(0, %ToNumber(false));
-assertEquals(0, %_ToNumber(false));
 
 assertEquals(NaN, %ToNumber(undefined));
-assertEquals(NaN, %_ToNumber(undefined));
 
 assertEquals(-1, %ToNumber("-1"));
-assertEquals(-1, %_ToNumber("-1"));
 assertEquals(123, %ToNumber("123"));
-assertEquals(123, %_ToNumber("123"));
 assertEquals(NaN, %ToNumber("random text"));
-assertEquals(NaN, %_ToNumber("random text"));
 
 assertThrows(function() { %ToNumber(Symbol.toPrimitive) }, TypeError);
-assertThrows(function() { %_ToNumber(Symbol.toPrimitive) }, TypeError);
 
 var a = { toString: function() { return 54321 }};
 assertEquals(54321, %ToNumber(a));
-assertEquals(54321, %_ToNumber(a));
 
 var b = { valueOf: function() { return 42 }};
 assertEquals(42, %ToNumber(b));
-assertEquals(42, %_ToNumber(b));
 
 var c = {
   toString: function() { return "x"},
   valueOf: function() { return 123 }
 };
 assertEquals(123, %ToNumber(c));
-assertEquals(123, %_ToNumber(c));
 
 var d = {
   [Symbol.toPrimitive]: function(hint) {
@@ -54,8 +41,6 @@
   }
 };
 assertEquals(987654321, %ToNumber(d));
-assertEquals(987654321, %_ToNumber(d));
 
 var e = new Date(0);
 assertEquals(0, %ToNumber(e));
-assertEquals(0, %_ToNumber(e));
diff --git a/src/v8/test/mjsunit/harmony/to-string.js b/src/v8/test/mjsunit/harmony/to-string.js
index dfe36c2..e0589e0 100644
--- a/src/v8/test/mjsunit/harmony/to-string.js
+++ b/src/v8/test/mjsunit/harmony/to-string.js
@@ -4,51 +4,51 @@
 
 // Flags: --allow-natives-syntax
 
-assertEquals("1", %ToString(1));
-assertEquals("1", %_ToString(1));
+assertEquals("1", %ToStringRT(1));
+assertEquals("1", %_ToStringRT(1));
 
-assertEquals("0.5", %ToString(.5));
-assertEquals("0.5", %_ToString(.5));
+assertEquals("0.5", %ToStringRT(.5));
+assertEquals("0.5", %_ToStringRT(.5));
 
-assertEquals("null", %ToString(null));
-assertEquals("null", %_ToString(null));
+assertEquals("null", %ToStringRT(null));
+assertEquals("null", %_ToStringRT(null));
 
-assertEquals("true", %ToString(true));
-assertEquals("true", %_ToString(true));
+assertEquals("true", %ToStringRT(true));
+assertEquals("true", %_ToStringRT(true));
 
-assertEquals("false", %ToString(false));
-assertEquals("false", %_ToString(false));
+assertEquals("false", %ToStringRT(false));
+assertEquals("false", %_ToStringRT(false));
 
-assertEquals("undefined", %ToString(undefined));
-assertEquals("undefined", %_ToString(undefined));
+assertEquals("undefined", %ToStringRT(undefined));
+assertEquals("undefined", %_ToStringRT(undefined));
 
-assertEquals("random text", %ToString("random text"));
-assertEquals("random text", %_ToString("random text"));
+assertEquals("random text", %ToStringRT("random text"));
+assertEquals("random text", %_ToStringRT("random text"));
 
-assertThrows(function() { %ToString(Symbol.toPrimitive) }, TypeError);
-assertThrows(function() { %_ToString(Symbol.toPrimitive) }, TypeError);
+assertThrows(function() { %ToStringRT(Symbol.toPrimitive) }, TypeError);
+assertThrows(function() { %_ToStringRT(Symbol.toPrimitive) }, TypeError);
 
 var a = { toString: function() { return "xyz" }};
-assertEquals("xyz", %ToString(a));
-assertEquals("xyz", %_ToString(a));
+assertEquals("xyz", %ToStringRT(a));
+assertEquals("xyz", %_ToStringRT(a));
 
 var b = { valueOf: function() { return 42 }};
-assertEquals("[object Object]", %ToString(b));
-assertEquals("[object Object]", %_ToString(b));
+assertEquals("[object Object]", %ToStringRT(b));
+assertEquals("[object Object]", %_ToStringRT(b));
 
 var c = {
   toString: function() { return "x"},
   valueOf: function() { return 123 }
 };
-assertEquals("x", %ToString(c));
-assertEquals("x", %_ToString(c));
+assertEquals("x", %ToStringRT(c));
+assertEquals("x", %_ToStringRT(c));
 
 var d = {
   [Symbol.toPrimitive]: function(hint) { return hint }
 };
-assertEquals("string", %ToString(d));
-assertEquals("string", %_ToString(d));
+assertEquals("string", %ToStringRT(d));
+assertEquals("string", %_ToStringRT(d));
 
 var e = new Date(0);
-assertEquals(e.toString(), %ToString(e));
-assertEquals(e.toString(), %_ToString(e));
+assertEquals(e.toString(), %ToStringRT(e));
+assertEquals(e.toString(), %_ToStringRT(e));
diff --git a/src/v8/test/mjsunit/harmony/weakrefs/basics.js b/src/v8/test/mjsunit/harmony/weakrefs/basics.js
new file mode 100644
index 0000000..df599eb
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/weakrefs/basics.js
@@ -0,0 +1,170 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs
+
+(function TestConstructFinalizationGroup() {
+  let fg = new FinalizationGroup(() => {});
+  assertEquals(fg.toString(), "[object FinalizationGroup]");
+  assertNotSame(fg.__proto__, Object.prototype);
+  assertSame(fg.__proto__.__proto__, Object.prototype);
+})();
+
+(function TestFinalizationGroupConstructorCallAsFunction() {
+  let caught = false;
+  let message = "";
+  try {
+    let f = FinalizationGroup(() => {});
+  } catch (e) {
+    message = e.message;
+    caught = true;
+  } finally {
+    assertTrue(caught);
+    assertEquals(message, "Constructor FinalizationGroup requires 'new'");
+  }
+})();
+
+(function TestConstructFinalizationGroupCleanupNotCallable() {
+  let message = "FinalizationGroup: cleanup must be callable";
+  assertThrows(() => { let fg = new FinalizationGroup(); }, TypeError, message);
+  assertThrows(() => { let fg = new FinalizationGroup(1); }, TypeError, message);
+  assertThrows(() => { let fg = new FinalizationGroup(null); }, TypeError, message);
+})();
+
+(function TestConstructFinalizationGroupWithCallableProxyAsCleanup() {
+  let handler = {};
+  let obj = () => {};
+  let proxy = new Proxy(obj, handler);
+  let fg = new FinalizationGroup(proxy);
+})();
+
+(function TestConstructFinalizationGroupWithNonCallableProxyAsCleanup() {
+  let message = "FinalizationGroup: cleanup must be callable";
+  let handler = {};
+  let obj = {};
+  let proxy = new Proxy(obj, handler);
+  assertThrows(() => { let fg = new FinalizationGroup(proxy); }, TypeError, message);
+})();
+
+(function TestRegisterWithNonObjectTarget() {
+  let fg = new FinalizationGroup(() => {});
+  let message = "FinalizationGroup.prototype.register: target must be an object";
+  assertThrows(() => fg.register(1, "holdings"), TypeError, message);
+  assertThrows(() => fg.register(false, "holdings"), TypeError, message);
+  assertThrows(() => fg.register("foo", "holdings"), TypeError, message);
+  assertThrows(() => fg.register(Symbol(), "holdings"), TypeError, message);
+  assertThrows(() => fg.register(null, "holdings"), TypeError, message);
+  assertThrows(() => fg.register(undefined, "holdings"), TypeError, message);
+})();
+
+(function TestRegisterWithProxy() {
+  let handler = {};
+  let obj = {};
+  let proxy = new Proxy(obj, handler);
+  let fg = new FinalizationGroup(() => {});
+  fg.register(proxy);
+})();
+
+(function TestRegisterTargetAndHoldingsSameValue() {
+  let fg = new FinalizationGroup(() => {});
+  let obj = {a: 1};
+  // SameValue(target, holdings) not ok
+  assertThrows(() => fg.register(obj, obj), TypeError,
+               "FinalizationGroup.prototype.register: target and holdings must not be same");
+  let holdings = {a: 1};
+  fg.register(obj, holdings);
+})();
+
+(function TestRegisterWithoutFinalizationGroup() {
+  assertThrows(() => FinalizationGroup.prototype.register.call({}, {}, "holdings"), TypeError);
+  // Does not throw:
+  let fg = new FinalizationGroup(() => {});
+  FinalizationGroup.prototype.register.call(fg, {}, "holdings");
+})();
+
+(function TestUnregisterWithNonExistentKey() {
+  let fg = new FinalizationGroup(() => {});
+  let success = fg.unregister({"k": "whatever"});
+  assertFalse(success);
+})();
+
+(function TestUnregisterWithNonFinalizationGroup() {
+  assertThrows(() => FinalizationGroup.prototype.unregister.call({}, {}),
+               TypeError);
+})();
+
+(function TestUnregisterWithNonObjectUnregisterToken() {
+  let fg = new FinalizationGroup(() => {});
+  assertThrows(() => fg.unregister(1), TypeError);
+  assertThrows(() => fg.unregister(1n), TypeError);
+  assertThrows(() => fg.unregister('one'), TypeError);
+  assertThrows(() => fg.unregister(Symbol()), TypeError);
+  assertThrows(() => fg.unregister(true), TypeError);
+  assertThrows(() => fg.unregister(false), TypeError);
+  assertThrows(() => fg.unregister(undefined), TypeError);
+  assertThrows(() => fg.unregister(null), TypeError);
+})();
+
+(function TestWeakRefConstructor() {
+  let wr = new WeakRef({});
+  assertEquals(wr.toString(), "[object WeakRef]");
+  assertNotSame(wr.__proto__, Object.prototype);
+
+  let deref_desc = Object.getOwnPropertyDescriptor(wr.__proto__, "deref");
+  assertEquals(true, deref_desc.configurable);
+  assertEquals(false, deref_desc.enumerable);
+  assertEquals("function", typeof deref_desc.value);
+})();
+
+(function TestWeakRefConstructorWithNonObject() {
+  let message = "WeakRef: target must be an object";
+  assertThrows(() => new WeakRef(), TypeError, message);
+  assertThrows(() => new WeakRef(1), TypeError, message);
+  assertThrows(() => new WeakRef(false), TypeError, message);
+  assertThrows(() => new WeakRef("foo"), TypeError, message);
+  assertThrows(() => new WeakRef(Symbol()), TypeError, message);
+  assertThrows(() => new WeakRef(null), TypeError, message);
+  assertThrows(() => new WeakRef(undefined), TypeError, message);
+})();
+
+(function TestWeakRefConstructorCallAsFunction() {
+  let caught = false;
+  let message = "";
+  try {
+    let f = WeakRef({});
+  } catch (e) {
+    message = e.message;
+    caught = true;
+  } finally {
+    assertTrue(caught);
+    assertEquals(message, "Constructor WeakRef requires 'new'");
+  }
+})();
+
+(function TestWeakRefWithProxy() {
+  let handler = {};
+  let obj = {};
+  let proxy = new Proxy(obj, handler);
+  let wr = new WeakRef(proxy);
+})();
+
+(function TestCleanupSomeWithoutFinalizationGroup() {
+  assertThrows(() => FinalizationGroup.prototype.cleanupSome.call({}), TypeError);
+  // Does not throw:
+  let fg = new FinalizationGroup(() => {});
+  let rv = FinalizationGroup.prototype.cleanupSome.call(fg);
+  assertEquals(undefined, rv);
+})();
+
+(function TestCleanupSomeWithNonCallableCallback() {
+  let fg = new FinalizationGroup(() => {});
+  assertThrows(() => fg.cleanupSome(1), TypeError);
+  assertThrows(() => fg.cleanupSome(1n), TypeError);
+  assertThrows(() => fg.cleanupSome(Symbol()), TypeError);
+  assertThrows(() => fg.cleanupSome({}), TypeError);
+  assertThrows(() => fg.cleanupSome('foo'), TypeError);
+  assertThrows(() => fg.cleanupSome(true), TypeError);
+  assertThrows(() => fg.cleanupSome(false), TypeError);
+  assertThrows(() => fg.cleanupSome(null), TypeError);
+})();
diff --git a/src/v8/test/mjsunit/harmony/weakrefs/cleanup-doesnt-iterate-all-holdings.js b/src/v8/test/mjsunit/harmony/weakrefs/cleanup-doesnt-iterate-all-holdings.js
new file mode 100644
index 0000000..2072628
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/weakrefs/cleanup-doesnt-iterate-all-holdings.js
@@ -0,0 +1,88 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+
+let cleanup_call_count = 0;
+let cleanup = function(iter) {
+  if (cleanup_call_count == 0) {
+    // First call: iterate 2 of the 3 holdings
+    let holdings_list = [];
+    for (holdings of iter) {
+      holdings_list.push(holdings);
+      // Don't iterate the rest of the holdings
+      if (holdings_list.length == 2) {
+        break;
+      }
+    }
+    assertEquals(holdings_list.length, 2);
+    assertTrue(holdings_list[0] < 3);
+    assertTrue(holdings_list[1] < 3);
+    // Update call count only after the asserts; this ensures that the test
+    // fails even if the exceptions inside the cleanup function are swallowed.
+    cleanup_call_count++;
+  } else {
+    // Second call: iterate one leftover holdings and one holdings.
+    assertEquals(1, cleanup_call_count);
+    let holdings_list = [];
+    for (holdings of iter) {
+      holdings_list.push(holdings);
+    }
+    assertEquals(holdings_list.length, 2);
+    assertTrue((holdings_list[0] < 3 && holdings_list[1] == 100) ||
+               (holdings_list[1] < 3 && holdings_list[0] == 100));
+    // Update call count only after the asserts; this ensures that the test
+    // fails even if the exceptions inside the cleanup function are swallowed.
+    cleanup_call_count++;
+  }
+}
+
+let fg = new FinalizationGroup(cleanup);
+// Create 3 objects and register them in the FinalizationGroup. The objects need
+// to be inside a closure so that we can reliably kill them!
+
+(function() {
+  let objects = [];
+
+  for (let i = 0; i < 3; ++i) {
+    objects[i] = {a: i};
+    fg.register(objects[i], i);
+  }
+
+  gc();
+  assertEquals(0, cleanup_call_count);
+
+  // Drop the references to the objects.
+  objects = [];
+})();
+
+// This GC will reclaim the targets.
+gc();
+assertEquals(0, cleanup_call_count);
+
+let timeout_func_1 = function() {
+  assertEquals(1, cleanup_call_count);
+
+  // Assert that the cleanup function won't be called unless new targets appear.
+  setTimeout(timeout_func_2, 0);
+}
+
+setTimeout(timeout_func_1, 0);
+
+let timeout_func_2 = function() {
+  assertEquals(1, cleanup_call_count);
+
+  // Create a new object and register it.
+  let obj = {};
+  let wc = fg.register(obj, 100);
+  obj = null;
+
+  gc();
+
+  setTimeout(timeout_func_3, 0);
+}
+
+let timeout_func_3 = function() {
+  assertEquals(2, cleanup_call_count);
+}
diff --git a/src/v8/test/mjsunit/harmony/weakrefs/cleanup-from-different-realm.js b/src/v8/test/mjsunit/harmony/weakrefs/cleanup-from-different-realm.js
new file mode 100644
index 0000000..97ab1db
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/weakrefs/cleanup-from-different-realm.js
@@ -0,0 +1,34 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+
+let r = Realm.create();
+
+let cleanup = Realm.eval(r, "var stored_global; function cleanup() { stored_global = globalThis; } cleanup");
+let realm_global_this = Realm.eval(r, "globalThis");
+
+let fg = new FinalizationGroup(cleanup);
+
+// Create an object and a register it in the FinalizationGroup. The object needs
+// to be inside a closure so that we can reliably kill them!
+let weak_cell;
+
+(function() {
+  let object = {};
+  fg.register(object, {});
+
+  // object goes out of scope.
+})();
+
+gc();
+
+// Assert that the cleanup function was called in its Realm.
+let timeout_func = function() {
+  let stored_global = Realm.eval(r, "stored_global;");
+  assertNotEquals(stored_global, globalThis);
+  assertEquals(stored_global, realm_global_this);
+}
+
+setTimeout(timeout_func, 0);
diff --git a/src/v8/test/mjsunit/harmony/weakrefs/cleanup-is-a-microtask.js b/src/v8/test/mjsunit/harmony/weakrefs/cleanup-is-a-microtask.js
new file mode 100644
index 0000000..c6b834e
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/weakrefs/cleanup-is-a-microtask.js
@@ -0,0 +1,56 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+
+// This test asserts that the cleanup function call, scheduled by GC, is a
+// microtask and not a normal task.
+
+// Inside a microtask, cause GC (which should schedule the cleanup as
+// microtask).  lso schedule another microtask. Assert that the cleanup
+// function ran before the other microtask.
+
+function scheduleMicrotask(func) {
+  Promise.resolve().then(func);
+}
+
+let log = [];
+
+let cleanup = (iter) => {
+  log.push("cleanup");
+  for (holdings of iter) { }
+}
+
+let fg = new FinalizationGroup(cleanup);
+let o = null;
+
+(function() {
+  // Use a closure here to avoid other references to o which might keep it alive
+  // (e.g., stack frames pointing to it).
+  o = {};
+  fg.register(o, {});
+})();
+
+let microtask_after_cleanup = () => {
+  log.push("microtask_after_cleanup");
+}
+
+let first_microtask = function() {
+  log.push("first_microtask");
+
+  // This schedules the cleanup function as microtask.
+  o = null;
+  gc();
+
+  // Schedule a microtask which should run after the cleanup microtask.
+  scheduleMicrotask(microtask_after_cleanup);
+}
+
+scheduleMicrotask(first_microtask);
+
+setTimeout(() => {
+  // Assert that the functions got called in the right order.
+  let wanted_log = ["first_microtask", "cleanup", "microtask_after_cleanup"];
+  assertEquals(wanted_log, log);
+}, 0);
diff --git a/src/v8/test/mjsunit/harmony/weakrefs/cleanup-on-detached-realm.js b/src/v8/test/mjsunit/harmony/weakrefs/cleanup-on-detached-realm.js
new file mode 100644
index 0000000..ca156e0
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/weakrefs/cleanup-on-detached-realm.js
@@ -0,0 +1,22 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+
+let r = Realm.create();
+let FG = Realm.eval(r, "FinalizationGroup");
+Realm.detachGlobal(r);
+
+let fg = new FG(()=> {
+  assertUnreachable();
+});
+
+(() => {
+  let object = {};
+  fg.register(object, {});
+
+  // object goes out of scope.
+})();
+
+gc();
diff --git a/src/v8/test/mjsunit/harmony/weakrefs/cleanup-proxy-from-different-realm.js b/src/v8/test/mjsunit/harmony/weakrefs/cleanup-proxy-from-different-realm.js
new file mode 100644
index 0000000..1d275a1
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/weakrefs/cleanup-proxy-from-different-realm.js
@@ -0,0 +1,34 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+
+let r = Realm.create();
+
+let cleanup = Realm.eval(r, "var stored_global; let cleanup = new Proxy(function() { stored_global = globalThis;}, {}); cleanup");
+let realm_global_this = Realm.eval(r, "globalThis");
+
+let fg = new FinalizationGroup(cleanup);
+
+// Create an object and register it in the FinalizationGroup. The object needs
+// to be inside a closure so that we can reliably kill them!
+let weak_cell;
+
+(function() {
+  let object = {};
+  fg.register(object, "holdings");
+
+  // object goes out of scope.
+})();
+
+gc();
+
+// Assert that the cleanup function was called in its Realm.
+let timeout_func = function() {
+  let stored_global = Realm.eval(r, "stored_global;");
+  assertNotEquals(stored_global, globalThis);
+  assertEquals(stored_global, realm_global_this);
+}
+
+setTimeout(timeout_func, 0);
diff --git a/src/v8/test/mjsunit/harmony/weakrefs/cleanupsome-2.js b/src/v8/test/mjsunit/harmony/weakrefs/cleanupsome-2.js
new file mode 100644
index 0000000..67ed64e
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/weakrefs/cleanupsome-2.js
@@ -0,0 +1,31 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking --allow-natives-syntax
+
+let cleanup_count = 0;
+let cleanup_holdings = [];
+let cleanup = function(iter) {
+  for (holdings of iter) {
+    cleanup_holdings.push(holdings);
+  }
+  ++cleanup_count;
+}
+
+let fg = new FinalizationGroup(cleanup);
+(function() {
+  let o = {};
+  fg.register(o, "holdings");
+
+  assertEquals(0, cleanup_count);
+})();
+
+// GC will detect o as dead.
+gc();
+
+// passing no callback, should trigger cleanup function
+fg.cleanupSome();
+assertEquals(1, cleanup_count);
+assertEquals(1, cleanup_holdings.length);
+assertEquals("holdings", cleanup_holdings[0]);
diff --git a/src/v8/test/mjsunit/harmony/weakrefs/cleanupsome-after-unregister.js b/src/v8/test/mjsunit/harmony/weakrefs/cleanupsome-after-unregister.js
new file mode 100644
index 0000000..363fc4a
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/weakrefs/cleanupsome-after-unregister.js
@@ -0,0 +1,38 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+
+let cleanup_count = 0;
+let cleanup_holdings = [];
+let cleanup = function(iter) {
+  for (holdings of iter) {
+    cleanup_holdings.push(holdings);
+  }
+  ++cleanup_count;
+}
+
+let fg = new FinalizationGroup(cleanup);
+let key = {"k": "this is the key"};
+(function() {
+  let o = {};
+  weak_cell = fg.register(o, "holdings", key);
+
+  // cleanupSome won't do anything since there are no reclaimed targets.
+  fg.cleanupSome();
+  assertEquals(0, cleanup_count);
+  // Keep o alive to the end of the function, so that --stress-opt mode
+  // is robust towards --gc-interval timing.
+  return o;
+})();
+
+// GC will detect the WeakCell as dirty.
+gc();
+
+// Unregister the tracked object just before calling cleanupSome.
+fg.unregister(key);
+
+fg.cleanupSome();
+
+assertEquals(0, cleanup_count);
diff --git a/src/v8/test/mjsunit/harmony/weakrefs/cleanupsome.js b/src/v8/test/mjsunit/harmony/weakrefs/cleanupsome.js
new file mode 100644
index 0000000..06eb292
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/weakrefs/cleanupsome.js
@@ -0,0 +1,36 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking --allow-natives-syntax
+
+let cleanup_count = 0;
+let cleanup_holdings = [];
+let cleanup = function(iter) {
+  %AbortJS("shouldn't be called");
+}
+
+let cleanup2 = function(iter) {
+  for (holdings of iter) {
+    cleanup_holdings.push(holdings);
+  }
+  ++cleanup_count;
+}
+
+let fg = new FinalizationGroup(cleanup);
+(function() {
+  let o = {};
+  fg.register(o, "holdings");
+
+  // cleanupSome won't do anything since there are no reclaimed targets.
+  fg.cleanupSome(cleanup2);
+  assertEquals(0, cleanup_count);
+})();
+
+// GC will detect o as dead.
+gc();
+
+fg.cleanupSome(cleanup2);
+assertEquals(1, cleanup_count);
+assertEquals(1, cleanup_holdings.length);
+assertEquals("holdings", cleanup_holdings[0]);
diff --git a/src/v8/test/mjsunit/harmony/weakrefs/finalization-group-keeps-holdings-alive.js b/src/v8/test/mjsunit/harmony/weakrefs/finalization-group-keeps-holdings-alive.js
new file mode 100644
index 0000000..ea35a2e
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/weakrefs/finalization-group-keeps-holdings-alive.js
@@ -0,0 +1,40 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+
+let cleanup_called = false;
+let cleanup = function(iter) {
+  assertFalse(cleanup_called);
+  let holdings_list = [];
+  for (holdings of iter) {
+    holdings_list.push(holdings);
+  }
+  assertEquals(holdings_list.length, 1);
+  assertEquals(holdings_list[0].a, "this is the holdings object");
+  cleanup_called = true;
+}
+
+let fg = new FinalizationGroup(cleanup);
+let o1 = {};
+let holdings = {'a': 'this is the holdings object'};
+fg.register(o1, holdings);
+
+gc();
+assertFalse(cleanup_called);
+
+// Drop the last references to o1.
+o1 = null;
+
+// Drop the last reference to the holdings. The FinalizationGroup keeps it
+// alive, so the cleanup function will be called as normal.
+holdings = null;
+gc();
+assertFalse(cleanup_called);
+
+let timeout_func = function() {
+  assertTrue(cleanup_called);
+}
+
+setTimeout(timeout_func, 0);
diff --git a/src/v8/test/mjsunit/harmony/weakrefs/finalizationgroup-and-weakref.js b/src/v8/test/mjsunit/harmony/weakrefs/finalizationgroup-and-weakref.js
new file mode 100644
index 0000000..bd66f1c
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/weakrefs/finalizationgroup-and-weakref.js
@@ -0,0 +1,44 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking --allow-natives-syntax
+
+let cleanup_called = false;
+let cleanup = function(iter) {
+  assertFalse(cleanup_called);
+  let holdings_list = [];
+  for (holdings of iter) {
+    holdings_list.push(holdings);
+  }
+  assertEquals(1, holdings_list.length);
+  assertEquals("holdings", holdings_list[0]);
+  cleanup_called = true;
+}
+
+let fg = new FinalizationGroup(cleanup);
+let weak_ref;
+(function() {
+  let o = {};
+  weak_ref = new WeakRef(o);
+  fg.register(o, "holdings");
+})();
+
+// Since the WeakRef was created during this turn, it is not cleared by GC. The
+// pointer inside the FinalizationGroup is not cleared either, since the WeakRef
+// keeps the target object alive.
+gc();
+(function() {
+  assertNotEquals(undefined, weak_ref.deref());
+})();
+
+%PerformMicrotaskCheckpoint();
+// Next turn.
+
+gc();
+
+%PerformMicrotaskCheckpoint();
+// Next turn.
+
+assertTrue(cleanup_called);
+assertEquals(undefined, weak_ref.deref());
diff --git a/src/v8/test/mjsunit/harmony/weakrefs/finalizationgroup-scheduled-for-cleanup-multiple-times.js b/src/v8/test/mjsunit/harmony/weakrefs/finalizationgroup-scheduled-for-cleanup-multiple-times.js
new file mode 100644
index 0000000..a1cff3a
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/weakrefs/finalizationgroup-scheduled-for-cleanup-multiple-times.js
@@ -0,0 +1,71 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+// Flags: --no-stress-flush-bytecode
+
+let cleanup0_call_count = 0;
+let cleanup0_holdings_count = 0;
+
+let cleanup1_call_count = 0;
+let cleanup1_holdings_count = 0;
+
+let cleanup0 = function(iter) {
+  for (holdings of iter) {
+    ++cleanup0_holdings_count;
+  }
+  ++cleanup0_call_count;
+}
+
+let cleanup1 = function(iter) {
+  for (holdings of iter) {
+    ++cleanup1_holdings_count;
+  }
+  ++cleanup1_call_count;
+}
+
+let fg0 = new FinalizationGroup(cleanup0);
+let fg1 = new FinalizationGroup(cleanup1);
+
+// Register 1 weak reference for each FinalizationGroup and kill the objects they point to.
+(function() {
+  // The objects need to be inside a closure so that we can reliably kill them.
+  let objects = [];
+  objects[0] = {};
+  objects[1] = {};
+
+  fg0.register(objects[0], "holdings0-0");
+  fg1.register(objects[1], "holdings1-0");
+
+  // Drop the references to the objects.
+  objects = [];
+
+  // Will schedule both fg0 and fg1 for cleanup.
+  gc();
+})();
+
+// Before the cleanup task has a chance to run, do the same thing again, so both
+// FinalizationGroups are (again) scheduled for cleanup. This has to be a IIFE function
+// (so that we can reliably kill the objects) so we cannot use the same function
+// as before.
+(function() {
+  let objects = [];
+  objects[0] = {};
+  objects[1] = {};
+  fg0.register(objects[0], "holdings0-1");
+  fg1.register(objects[1], "holdings1-1");
+  objects = [];
+  gc();
+})();
+
+let timeout_func = function() {
+  assertEquals(1, cleanup0_call_count);
+  assertEquals(2, cleanup0_holdings_count);
+  assertEquals(1, cleanup1_call_count);
+  assertEquals(2, cleanup1_holdings_count);
+}
+
+// Give the cleanup task a chance to run. All holdings will be iterated during
+// the same invocation of the cleanup function.
+setTimeout(timeout_func, 0);
diff --git a/src/v8/test/mjsunit/harmony/weakrefs/iterating-in-cleanup.js b/src/v8/test/mjsunit/harmony/weakrefs/iterating-in-cleanup.js
new file mode 100644
index 0000000..73aac76
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/weakrefs/iterating-in-cleanup.js
@@ -0,0 +1,45 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+
+let cleanup_called = false;
+let cleanup = function(iter) {
+  assertFalse(cleanup_called);
+  let holdings_list = [];
+  for (holdings of iter) {
+    holdings_list.push(holdings);
+  }
+  assertEquals(holdings_list.length, 2);
+  if (holdings_list[0] == 1) {
+    assertEquals(holdings_list[1], 2);
+  } else {
+    assertEquals(holdings_list[0], 2);
+    assertEquals(holdings_list[1], 1);
+  }
+  cleanup_called = true;
+}
+
+let fg = new FinalizationGroup(cleanup);
+let o1 = {};
+let o2 = {};
+fg.register(o1, 1);
+fg.register(o2, 2);
+
+gc();
+assertFalse(cleanup_called);
+
+// Drop the last references to o1 and o2.
+o1 = null;
+o2 = null;
+// GC will reclaim the target objects; the cleanup function will be called the
+// next time we enter the event loop.
+gc();
+assertFalse(cleanup_called);
+
+let timeout_func = function() {
+  assertTrue(cleanup_called);
+}
+
+setTimeout(timeout_func, 0);
diff --git a/src/v8/test/mjsunit/harmony/weakrefs/multiple-dirty-finalization-groups.js b/src/v8/test/mjsunit/harmony/weakrefs/multiple-dirty-finalization-groups.js
new file mode 100644
index 0000000..51e7214
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/weakrefs/multiple-dirty-finalization-groups.js
@@ -0,0 +1,42 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+
+let cleanup_call_count = 0;
+let cleanup_holdings_count = 0;
+let cleanup = function(iter) {
+  for (holdings of iter) {
+    ++cleanup_holdings_count;
+  }
+  ++cleanup_call_count;
+}
+
+let fg1 = new FinalizationGroup(cleanup);
+let fg2 = new FinalizationGroup(cleanup);
+
+// Create two objects and register them in FinalizationGroups. The objects need
+// to be inside a closure so that we can reliably kill them!
+
+(function() {
+  let object1 = {};
+  fg1.register(object1, "holdings1");
+
+  let object2 = {};
+  fg2.register(object2, "holdings2");
+
+  // object1 and object2 go out of scope.
+})();
+
+// This GC will discover dirty WeakCells and schedule cleanup.
+gc();
+assertEquals(0, cleanup_call_count);
+
+// Assert that the cleanup function was called and iterated the holdings.
+let timeout_func = function() {
+  assertEquals(2, cleanup_call_count);
+  assertEquals(2, cleanup_holdings_count);
+}
+
+setTimeout(timeout_func, 0);
diff --git a/src/v8/test/mjsunit/harmony/weakrefs/two-weakrefs.js b/src/v8/test/mjsunit/harmony/weakrefs/two-weakrefs.js
new file mode 100644
index 0000000..c3fc9f7
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/weakrefs/two-weakrefs.js
@@ -0,0 +1,48 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking --allow-natives-syntax
+
+let o1 = {};
+let o2 = {};
+let wr1;
+let wr2;
+(function() {
+  wr1 = new WeakRef(o1);
+  wr2 = new WeakRef(o2);
+})();
+
+// Since the WeakRefs were created during this turn, they're not cleared by GC.
+gc();
+
+(function() {
+  assertNotEquals(undefined, wr1.deref());
+  assertNotEquals(undefined, wr2.deref());
+})();
+
+%PerformMicrotaskCheckpoint();
+// New turn.
+
+wr1.deref();
+o1 = null;
+gc(); // deref makes sure we don't clean up wr1
+
+%PerformMicrotaskCheckpoint();
+// New turn.
+
+wr2.deref();
+o2 = null;
+gc(); // deref makes sure we don't clean up wr2
+
+%PerformMicrotaskCheckpoint();
+// New turn.
+
+assertEquals(undefined, wr1.deref());
+
+gc();
+
+%PerformMicrotaskCheckpoint();
+// New turn.
+
+assertEquals(undefined, wr2.deref());
diff --git a/src/v8/test/mjsunit/harmony/weakrefs/undefined-holdings.js b/src/v8/test/mjsunit/harmony/weakrefs/undefined-holdings.js
new file mode 100644
index 0000000..ac3dc60
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/weakrefs/undefined-holdings.js
@@ -0,0 +1,39 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+
+let cleanup_call_count = 0;
+let cleanup_holdings_count = 0;
+let cleanup = function(iter) {
+  for (holdings of iter) {
+    assertEquals(holdings, undefined);
+    ++cleanup_holdings_count;
+  }
+  ++cleanup_call_count;
+}
+
+let fg = new FinalizationGroup(cleanup);
+
+// Create an object and register it in the FinalizationGroup. The object needs to be inside
+// a closure so that we can reliably kill them!
+
+(function() {
+  let object = {};
+  fg.register(object);
+
+  // object goes out of scope.
+})();
+
+// This GC will reclaim the target object and schedule cleanup.
+gc();
+assertEquals(0, cleanup_call_count);
+
+// Assert that the cleanup function was called and iterated the holdings.
+let timeout_func = function() {
+  assertEquals(1, cleanup_call_count);
+  assertEquals(1, cleanup_holdings_count);
+}
+
+setTimeout(timeout_func, 0);
diff --git a/src/v8/test/mjsunit/harmony/weakrefs/unregister-after-cleanup.js b/src/v8/test/mjsunit/harmony/weakrefs/unregister-after-cleanup.js
new file mode 100644
index 0000000..3db18e0
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/weakrefs/unregister-after-cleanup.js
@@ -0,0 +1,47 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+
+let cleanup_call_count = 0;
+let cleanup_holdings_count = 0;
+let cleanup = function(iter) {
+  for (holdings of iter) {
+    assertEquals("holdings", holdings);
+    ++cleanup_holdings_count;
+  }
+  ++cleanup_call_count;
+}
+
+let fg = new FinalizationGroup(cleanup);
+let key = {"k": "this is the key"};
+// Create an object and register it in the FinalizationGroup. The object needs
+// to be inside a closure so that we can reliably kill them!
+
+(function() {
+  let object = {};
+  fg.register(object, "holdings", key);
+
+  // object goes out of scope.
+})();
+
+// This GC will reclaim the target object and schedule cleanup.
+gc();
+assertEquals(0, cleanup_call_count);
+
+// Assert that the cleanup function was called and iterated the holdings.
+let timeout_func = function() {
+  assertEquals(1, cleanup_call_count);
+  assertEquals(1, cleanup_holdings_count);
+
+  // Unregister an already iterated over weak reference.
+  let success = fg.unregister(key);
+  assertFalse(success);
+
+  // Assert that it didn't do anything.
+  setTimeout(() => { assertEquals(1, cleanup_call_count); }, 0);
+  setTimeout(() => { assertEquals(1, cleanup_holdings_count); }, 0);
+}
+
+setTimeout(timeout_func, 0);
diff --git a/src/v8/test/mjsunit/harmony/weakrefs/unregister-before-cleanup.js b/src/v8/test/mjsunit/harmony/weakrefs/unregister-before-cleanup.js
new file mode 100644
index 0000000..c54dbb2
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/weakrefs/unregister-before-cleanup.js
@@ -0,0 +1,37 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking --noincremental-marking
+
+let cleanup_call_count = 0;
+let cleanup = function(iter) {
+  ++cleanup_call_count;
+}
+
+let fg = new FinalizationGroup(cleanup);
+let key = {"k": "this is the key"};
+// Create an object and register it in the FinalizationGroup. The object needs
+// to be inside a closure so that we can reliably kill them!
+
+(function() {
+  let object = {};
+  fg.register(object, "my holdings", key);
+
+  // Clear the WeakCell before the GC has a chance to discover it.
+  let success = fg.unregister(key);
+  assertTrue(success);
+
+  // object goes out of scope.
+})();
+
+// This GC will reclaim the target object.
+gc();
+assertEquals(0, cleanup_call_count);
+
+// Assert that the cleanup function won't be called, since we called unregister.
+let timeout_func = function() {
+  assertEquals(0, cleanup_call_count);
+}
+
+setTimeout(timeout_func, 0);
diff --git a/src/v8/test/mjsunit/harmony/weakrefs/unregister-called-twice.js b/src/v8/test/mjsunit/harmony/weakrefs/unregister-called-twice.js
new file mode 100644
index 0000000..d1dd8f8
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/weakrefs/unregister-called-twice.js
@@ -0,0 +1,42 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+
+let cleanup_call_count = 0;
+let cleanup = function(iter) {
+  ++cleanup_call_count;
+}
+
+let fg = new FinalizationGroup(cleanup);
+let key = {"k": "this is the key"};
+// Create an object and register it in the FinalizationGroup. The object needs
+// to be inside a closure so that we can reliably kill them!
+
+(function() {
+  let object = {};
+  fg.register(object, "holdings", key);
+
+  // Unregister before the GC has a chance to discover the object.
+  let success = fg.unregister(key);
+  assertTrue(success);
+
+  // Call unregister again (just to assert we handle this gracefully).
+  success = fg.unregister(key);
+  assertFalse(success);
+
+  // object goes out of scope.
+})();
+
+// This GC will reclaim the target object.
+gc();
+assertEquals(0, cleanup_call_count);
+
+// Assert that the cleanup function won't be called, since the weak reference
+// was unregistered.
+let timeout_func = function() {
+  assertEquals(0, cleanup_call_count);
+}
+
+setTimeout(timeout_func, 0);
diff --git a/src/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup1.js b/src/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup1.js
new file mode 100644
index 0000000..80ca85f
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup1.js
@@ -0,0 +1,42 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+
+let cleanup_call_count = 0;
+let cleanup_holdings_count = 0;
+let cleanup = function(iter) {
+  // Unregister before we've iterated through the holdings.
+  let success = fg.unregister(key);
+  assertTrue(success);
+
+  for (wc of iter) {
+    ++cleanup_holdings_count;
+  }
+  ++cleanup_call_count;
+}
+
+let fg = new FinalizationGroup(cleanup);
+let key = {"k": "the key"};
+// Create an object and register it in the FinalizationGroup. The object needs
+// to be inside a closure so that we can reliably kill them!
+
+(function() {
+  let object = {};
+  fg.register(object, "holdings", key);
+
+  // object goes out of scope.
+})();
+
+// This GC will discover unretained targets and schedule cleanup.
+gc();
+assertEquals(0, cleanup_call_count);
+
+// Assert that the cleanup function was called, but didn't iterate any holdings.
+let timeout_func = function() {
+  assertEquals(1, cleanup_call_count);
+  assertEquals(0, cleanup_holdings_count);
+}
+
+setTimeout(timeout_func, 0);
diff --git a/src/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup2.js b/src/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup2.js
new file mode 100644
index 0000000..038f509
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup2.js
@@ -0,0 +1,42 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+
+let cleanup_call_count = 0;
+let cleanup_holdings_count = 0;
+let cleanup = function(iter) {
+  for (holdings of iter) {
+    assertEquals(holdings, "holdings");
+    let success = fg.unregister(key);
+    assertFalse(success);
+
+    ++cleanup_holdings_count;
+  }
+  ++cleanup_call_count;
+}
+
+let fg = new FinalizationGroup(cleanup);
+// Create an object and register it in the FinalizationGroup. The object needs to be inside
+// a closure so that we can reliably kill them!
+let key = {"k": "this is the key"};
+
+(function() {
+  let object = {};
+  fg.register(object, "holdings", key);
+
+  // object goes out of scope.
+})();
+
+// This GC will discover dirty WeakCells and schedule cleanup.
+gc();
+assertEquals(0, cleanup_call_count);
+
+// Assert that the cleanup function was called and iterated the WeakCell.
+let timeout_func = function() {
+  assertEquals(1, cleanup_call_count);
+  assertEquals(1, cleanup_holdings_count);
+}
+
+setTimeout(timeout_func, 0);
diff --git a/src/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup3.js b/src/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup3.js
new file mode 100644
index 0000000..af6b5c1
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup3.js
@@ -0,0 +1,43 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+
+let cleanup_call_count = 0;
+let cleanup_holdings_count = 0;
+let cleanup = function(iter) {
+  for (holdings of iter) {
+    assertEquals(holdings, "holdings");
+    ++cleanup_holdings_count;
+  }
+  // Unregister an already iterated over weak reference.
+  let success = fg.unregister(key);
+  assertFalse(success);
+  ++cleanup_call_count;
+}
+
+let fg = new FinalizationGroup(cleanup);
+let key = {"k": "this is the key"};
+
+// Create an object and register it in the FinalizationGroup. The object needs to be inside
+// a closure so that we can reliably kill them!
+
+(function() {
+  let object = {};
+  fg.register(object, "holdings", key);
+
+  // object goes out of scope.
+})();
+
+// This GC will reclaim the target object and schedule cleanup.
+gc();
+assertEquals(0, cleanup_call_count);
+
+// Assert that the cleanup function was called and iterated the holdings.
+let timeout_func = function() {
+  assertEquals(1, cleanup_call_count);
+  assertEquals(1, cleanup_holdings_count);
+}
+
+setTimeout(timeout_func, 0);
diff --git a/src/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup4.js b/src/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup4.js
new file mode 100644
index 0000000..8a0a5d5
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup4.js
@@ -0,0 +1,50 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+
+let cleanup_call_count = 0;
+let cleanup_holdings_count = 0;
+let cleanup = function(iter) {
+  for (holdings of iter) {
+    // See which target we're iterating over and unregister the other one.
+    if (holdings == 1) {
+      let success = fg.unregister(key2);
+      assertTrue(success);
+    } else {
+      assertSame(holdings, 2);
+      let success = fg.unregister(key1);
+      assertTrue(success);
+    }
+    ++cleanup_holdings_count;
+  }
+  ++cleanup_call_count;
+}
+
+let fg = new FinalizationGroup(cleanup);
+let key1 = {"k": "first key"};
+let key2 = {"k": "second key"};
+// Create two objects and register them in the FinalizationGroup. The objects
+// need to be inside a closure so that we can reliably kill them!
+
+(function() {
+  let object1 = {};
+  fg.register(object1, 1, key1);
+  let object2 = {};
+  fg.register(object2, 2, key2);
+
+  // object1 and object2 go out of scope.
+})();
+
+// This GC will reclaim target objects and schedule cleanup.
+gc();
+assertEquals(0, cleanup_call_count);
+
+// Assert that the cleanup function was called and iterated one holdings (but not the other one).
+let timeout_func = function() {
+  assertEquals(1, cleanup_call_count);
+  assertEquals(1, cleanup_holdings_count);
+}
+
+setTimeout(timeout_func, 0);
diff --git a/src/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup5.js b/src/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup5.js
new file mode 100644
index 0000000..974485e
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/weakrefs/unregister-inside-cleanup5.js
@@ -0,0 +1,48 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+
+let cleanup_call_count = 0;
+let cleanup_holdings_count = 0;
+let cleanup = function(iter) {
+  for (holdings of iter) {
+    assertEquals(holdings, "holdings");
+
+    // There's one more object with the same key that we haven't
+    // iterated over yet so we should be able to unregister the
+    // callback for that one.
+    let success = fg.unregister(key);
+    assertTrue(success);
+
+    ++cleanup_holdings_count;
+  }
+  ++cleanup_call_count;
+}
+
+let fg = new FinalizationGroup(cleanup);
+// Create an object and register it in the FinalizationGroup. The object needs to be inside
+// a closure so that we can reliably kill them!
+let key = {"k": "this is the key"};
+
+(function() {
+  let object = {};
+  let object2 = {};
+  fg.register(object, "holdings", key);
+  fg.register(object2, "holdings", key);
+
+  // object goes out of scope.
+})();
+
+// This GC will discover dirty WeakCells and schedule cleanup.
+gc();
+assertEquals(0, cleanup_call_count);
+
+// Assert that the cleanup function was called and iterated the WeakCell.
+let timeout_func = function() {
+  assertEquals(1, cleanup_call_count);
+  assertEquals(1, cleanup_holdings_count);
+}
+
+setTimeout(timeout_func, 0);
diff --git a/src/v8/test/mjsunit/harmony/weakrefs/unregister-many.js b/src/v8/test/mjsunit/harmony/weakrefs/unregister-many.js
new file mode 100644
index 0000000..8be0db1
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/weakrefs/unregister-many.js
@@ -0,0 +1,51 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+
+let cleanup_call_count = 0;
+let cleanup_holdings_count = 0;
+let cleanup = function(iter) {
+  for (holdings of iter) {
+    assertEquals("holdings2", holdings);
+    ++cleanup_holdings_count;
+  }
+  ++cleanup_call_count;
+}
+
+let fg = new FinalizationGroup(cleanup);
+let key1 = {"k": "key1"};
+let key2 = {"k": "key2"};
+// Create three objects and register them in the FinalizationGroup. The objects
+// need to be inside a closure so that we can reliably kill them!
+
+(function() {
+  let object1a = {};
+  fg.register(object1a, "holdings1a", key1);
+
+  let object1b = {};
+  fg.register(object1b, "holdings1b", key1);
+
+  let object2 = {};
+  fg.register(object2, "holdings2", key2);
+
+  // Unregister before the GC has a chance to discover the objects.
+  let success = fg.unregister(key1);
+  assertTrue(success);
+
+  // objects go out of scope.
+})();
+
+// This GC will reclaim the target objects.
+gc();
+assertEquals(0, cleanup_call_count);
+
+// Assert that the cleanup function will be called only for the reference which
+// was not unregistered.
+let timeout_func = function() {
+  assertEquals(1, cleanup_call_count);
+  assertEquals(1, cleanup_holdings_count);
+}
+
+setTimeout(timeout_func, 0);
diff --git a/src/v8/test/mjsunit/harmony/weakrefs/unregister-when-cleanup-already-scheduled.js b/src/v8/test/mjsunit/harmony/weakrefs/unregister-when-cleanup-already-scheduled.js
new file mode 100644
index 0000000..4ad4425
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/weakrefs/unregister-when-cleanup-already-scheduled.js
@@ -0,0 +1,37 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+
+let cleanup_call_count = 0;
+let cleanup = function(iter) {
+  ++cleanup_call_count;
+}
+
+let key = {"k": "this is my key"};
+let fg = new FinalizationGroup(cleanup);
+// Create an object and register it in the FinalizationGroup. The object needs to be inside
+// a closure so that we can reliably kill them!
+
+(function() {
+  let object = {};
+  fg.register(object, {}, key);
+
+  // object goes out of scope.
+})();
+
+// This GC will discover dirty WeakCells and schedule cleanup.
+gc();
+assertEquals(0, cleanup_call_count);
+
+// Unregister the object from the FinalizationGroup before cleanup has ran.
+let success = fg.unregister(key);
+assertTrue(success);
+
+// Assert that the cleanup function won't be called.
+let timeout_func = function() {
+  assertEquals(0, cleanup_call_count);
+}
+
+setTimeout(timeout_func, 0);
diff --git a/src/v8/test/mjsunit/harmony/weakrefs/weak-cell-basics.js b/src/v8/test/mjsunit/harmony/weakrefs/weak-cell-basics.js
new file mode 100644
index 0000000..170a52d
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/weakrefs/weak-cell-basics.js
@@ -0,0 +1,37 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking
+
+let cleanup_called = false;
+let cleanup = function(iter) {
+  assertFalse(cleanup_called);
+  let result = iter.next();
+  assertEquals(result.value, holdings);
+  assertFalse(result.done);
+  result = iter.next();
+  assertTrue(result.done);
+  cleanup_called = true;
+}
+
+let fg = new FinalizationGroup(cleanup);
+let o = {};
+let holdings = {'h': 55};
+fg.register(o, holdings);
+
+gc();
+assertFalse(cleanup_called);
+
+// Drop the last reference to o.
+o = null;
+// GC will clear the WeakCell; the cleanup function will be called the next time
+// we enter the event loop.
+gc();
+assertFalse(cleanup_called);
+
+let timeout_func = function() {
+  assertTrue(cleanup_called);
+}
+
+setTimeout(timeout_func, 0);
diff --git a/src/v8/test/mjsunit/harmony/weakrefs/weakref-creation-keeps-alive.js b/src/v8/test/mjsunit/harmony/weakrefs/weakref-creation-keeps-alive.js
new file mode 100644
index 0000000..18e3af2
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/weakrefs/weakref-creation-keeps-alive.js
@@ -0,0 +1,27 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking --allow-natives-syntax
+
+let wr;
+(function() {
+  let o = {};
+  wr = new WeakRef(o);
+  // Don't deref here, we want to test that the creation is enough to keep the
+  // WeakRef alive until the end of the turn.
+})();
+
+gc();
+
+// Since the WeakRef was created during this turn, it is not cleared by GC.
+(function() {
+  assertNotEquals(undefined, wr.deref());
+})();
+
+%PerformMicrotaskCheckpoint();
+// Next turn.
+
+gc();
+
+assertEquals(undefined, wr.deref());
diff --git a/src/v8/test/mjsunit/harmony/weakrefs/weakref-deref-keeps-alive.js b/src/v8/test/mjsunit/harmony/weakrefs/weakref-deref-keeps-alive.js
new file mode 100644
index 0000000..c17f060
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/weakrefs/weakref-deref-keeps-alive.js
@@ -0,0 +1,45 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-weak-refs --expose-gc --noincremental-marking --allow-natives-syntax
+
+let wr;
+let wr_control; // control WeakRef for testing what happens without deref
+(function() {
+  let o1 = {};
+  wr = new WeakRef(o1);
+  let o2 = {};
+  wr_control = new WeakRef(o2);
+})();
+
+let strong = {a: wr.deref(), b: wr_control.deref()};
+
+gc();
+
+%PerformMicrotaskCheckpoint();
+// Next turn.
+
+// Call deref inside a closure, trying to avoid accidentally storing a strong
+// reference into the object in the stack frame.
+(function() {
+  wr.deref();
+})();
+
+strong = null;
+
+// This GC will clear wr_control.
+gc();
+
+(function() {
+  assertNotEquals(undefined, wr.deref());
+  // Now the control WeakRef got cleared, since nothing was keeping it alive.
+  assertEquals(undefined, wr_control.deref());
+})();
+
+%PerformMicrotaskCheckpoint();
+// Next turn.
+
+gc();
+
+assertEquals(undefined, wr.deref());
diff --git a/src/v8/test/mjsunit/harmony/well-formed-json-stringify-checked.js b/src/v8/test/mjsunit/harmony/well-formed-json-stringify-checked.js
new file mode 100644
index 0000000..a42187f
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/well-formed-json-stringify-checked.js
@@ -0,0 +1,2573 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Test JSON.stringify for cases that hit
+// JsonStringifier::SerializeString_.
+
+// All code points from U+0000 to U+00FF.
+assertEquals('"___\\u0000"', JSON.stringify('___\0'));
+assertEquals('"___\\u0001"', JSON.stringify('___\x01'));
+assertEquals('"___\\u0002"', JSON.stringify('___\x02'));
+assertEquals('"___\\u0003"', JSON.stringify('___\x03'));
+assertEquals('"___\\u0004"', JSON.stringify('___\x04'));
+assertEquals('"___\\u0005"', JSON.stringify('___\x05'));
+assertEquals('"___\\u0006"', JSON.stringify('___\x06'));
+assertEquals('"___\\u0007"', JSON.stringify('___\x07'));
+assertEquals('"___\\b"', JSON.stringify('___\b'));
+assertEquals('"___\\t"', JSON.stringify('___\t'));
+assertEquals('"___\\n"', JSON.stringify('___\n'));
+assertEquals('"___\\u000b"', JSON.stringify('___\x0B'));
+assertEquals('"___\\f"', JSON.stringify('___\f'));
+assertEquals('"___\\r"', JSON.stringify('___\r'));
+assertEquals('"___\\u000e"', JSON.stringify('___\x0E'));
+assertEquals('"___\\u000f"', JSON.stringify('___\x0F'));
+assertEquals('"___\\u0010"', JSON.stringify('___\x10'));
+assertEquals('"___\\u0011"', JSON.stringify('___\x11'));
+assertEquals('"___\\u0012"', JSON.stringify('___\x12'));
+assertEquals('"___\\u0013"', JSON.stringify('___\x13'));
+assertEquals('"___\\u0014"', JSON.stringify('___\x14'));
+assertEquals('"___\\u0015"', JSON.stringify('___\x15'));
+assertEquals('"___\\u0016"', JSON.stringify('___\x16'));
+assertEquals('"___\\u0017"', JSON.stringify('___\x17'));
+assertEquals('"___\\u0018"', JSON.stringify('___\x18'));
+assertEquals('"___\\u0019"', JSON.stringify('___\x19'));
+assertEquals('"___\\u001a"', JSON.stringify('___\x1A'));
+assertEquals('"___\\u001b"', JSON.stringify('___\x1B'));
+assertEquals('"___\\u001c"', JSON.stringify('___\x1C'));
+assertEquals('"___\\u001d"', JSON.stringify('___\x1D'));
+assertEquals('"___\\u001e"', JSON.stringify('___\x1E'));
+assertEquals('"___\\u001f"', JSON.stringify('___\x1F'));
+assertEquals('"___ "', JSON.stringify('___ '));
+assertEquals('"___!"', JSON.stringify('___!'));
+assertEquals('"___\\""', JSON.stringify('___"'));
+assertEquals('"___#"', JSON.stringify('___#'));
+assertEquals('"___$"', JSON.stringify('___$'));
+assertEquals('"___%"', JSON.stringify('___%'));
+assertEquals('"___&"', JSON.stringify('___&'));
+assertEquals('"___\'"', JSON.stringify('___\''));
+assertEquals('"___("', JSON.stringify('___('));
+assertEquals('"___)"', JSON.stringify('___)'));
+assertEquals('"___*"', JSON.stringify('___*'));
+assertEquals('"___+"', JSON.stringify('___+'));
+assertEquals('"___,"', JSON.stringify('___,'));
+assertEquals('"___-"', JSON.stringify('___-'));
+assertEquals('"___."', JSON.stringify('___.'));
+assertEquals('"___/"', JSON.stringify('___/'));
+assertEquals('"___0"', JSON.stringify('___0'));
+assertEquals('"___1"', JSON.stringify('___1'));
+assertEquals('"___2"', JSON.stringify('___2'));
+assertEquals('"___3"', JSON.stringify('___3'));
+assertEquals('"___4"', JSON.stringify('___4'));
+assertEquals('"___5"', JSON.stringify('___5'));
+assertEquals('"___6"', JSON.stringify('___6'));
+assertEquals('"___7"', JSON.stringify('___7'));
+assertEquals('"___8"', JSON.stringify('___8'));
+assertEquals('"___9"', JSON.stringify('___9'));
+assertEquals('"___:"', JSON.stringify('___:'));
+assertEquals('"___;"', JSON.stringify('___;'));
+assertEquals('"___<"', JSON.stringify('___<'));
+assertEquals('"___="', JSON.stringify('___='));
+assertEquals('"___>"', JSON.stringify('___>'));
+assertEquals('"___?"', JSON.stringify('___?'));
+assertEquals('"___@"', JSON.stringify('___@'));
+assertEquals('"___A"', JSON.stringify('___A'));
+assertEquals('"___B"', JSON.stringify('___B'));
+assertEquals('"___C"', JSON.stringify('___C'));
+assertEquals('"___D"', JSON.stringify('___D'));
+assertEquals('"___E"', JSON.stringify('___E'));
+assertEquals('"___F"', JSON.stringify('___F'));
+assertEquals('"___G"', JSON.stringify('___G'));
+assertEquals('"___H"', JSON.stringify('___H'));
+assertEquals('"___I"', JSON.stringify('___I'));
+assertEquals('"___J"', JSON.stringify('___J'));
+assertEquals('"___K"', JSON.stringify('___K'));
+assertEquals('"___L"', JSON.stringify('___L'));
+assertEquals('"___M"', JSON.stringify('___M'));
+assertEquals('"___N"', JSON.stringify('___N'));
+assertEquals('"___O"', JSON.stringify('___O'));
+assertEquals('"___P"', JSON.stringify('___P'));
+assertEquals('"___Q"', JSON.stringify('___Q'));
+assertEquals('"___R"', JSON.stringify('___R'));
+assertEquals('"___S"', JSON.stringify('___S'));
+assertEquals('"___T"', JSON.stringify('___T'));
+assertEquals('"___U"', JSON.stringify('___U'));
+assertEquals('"___V"', JSON.stringify('___V'));
+assertEquals('"___W"', JSON.stringify('___W'));
+assertEquals('"___X"', JSON.stringify('___X'));
+assertEquals('"___Y"', JSON.stringify('___Y'));
+assertEquals('"___Z"', JSON.stringify('___Z'));
+assertEquals('"___["', JSON.stringify('___['));
+assertEquals('"___\\\\"', JSON.stringify('___\\'));
+assertEquals('"___]"', JSON.stringify('___]'));
+assertEquals('"___^"', JSON.stringify('___^'));
+assertEquals('"____"', JSON.stringify('____'));
+assertEquals('"___`"', JSON.stringify('___`'));
+assertEquals('"___a"', JSON.stringify('___a'));
+assertEquals('"___b"', JSON.stringify('___b'));
+assertEquals('"___c"', JSON.stringify('___c'));
+assertEquals('"___d"', JSON.stringify('___d'));
+assertEquals('"___e"', JSON.stringify('___e'));
+assertEquals('"___f"', JSON.stringify('___f'));
+assertEquals('"___g"', JSON.stringify('___g'));
+assertEquals('"___h"', JSON.stringify('___h'));
+assertEquals('"___i"', JSON.stringify('___i'));
+assertEquals('"___j"', JSON.stringify('___j'));
+assertEquals('"___k"', JSON.stringify('___k'));
+assertEquals('"___l"', JSON.stringify('___l'));
+assertEquals('"___m"', JSON.stringify('___m'));
+assertEquals('"___n"', JSON.stringify('___n'));
+assertEquals('"___o"', JSON.stringify('___o'));
+assertEquals('"___p"', JSON.stringify('___p'));
+assertEquals('"___q"', JSON.stringify('___q'));
+assertEquals('"___r"', JSON.stringify('___r'));
+assertEquals('"___s"', JSON.stringify('___s'));
+assertEquals('"___t"', JSON.stringify('___t'));
+assertEquals('"___u"', JSON.stringify('___u'));
+assertEquals('"___v"', JSON.stringify('___v'));
+assertEquals('"___w"', JSON.stringify('___w'));
+assertEquals('"___x"', JSON.stringify('___x'));
+assertEquals('"___y"', JSON.stringify('___y'));
+assertEquals('"___z"', JSON.stringify('___z'));
+assertEquals('"___{"', JSON.stringify('___{'));
+assertEquals('"___|"', JSON.stringify('___|'));
+assertEquals('"___}"', JSON.stringify('___}'));
+assertEquals('"___~"', JSON.stringify('___~'));
+assertEquals('"___\x7F"', JSON.stringify('___\x7F'));
+assertEquals('"___\x80"', JSON.stringify('___\x80'));
+assertEquals('"___\x81"', JSON.stringify('___\x81'));
+assertEquals('"___\x82"', JSON.stringify('___\x82'));
+assertEquals('"___\x83"', JSON.stringify('___\x83'));
+assertEquals('"___\x84"', JSON.stringify('___\x84'));
+assertEquals('"___\x85"', JSON.stringify('___\x85'));
+assertEquals('"___\x86"', JSON.stringify('___\x86'));
+assertEquals('"___\x87"', JSON.stringify('___\x87'));
+assertEquals('"___\x88"', JSON.stringify('___\x88'));
+assertEquals('"___\x89"', JSON.stringify('___\x89'));
+assertEquals('"___\x8A"', JSON.stringify('___\x8A'));
+assertEquals('"___\x8B"', JSON.stringify('___\x8B'));
+assertEquals('"___\x8C"', JSON.stringify('___\x8C'));
+assertEquals('"___\x8D"', JSON.stringify('___\x8D'));
+assertEquals('"___\x8E"', JSON.stringify('___\x8E'));
+assertEquals('"___\x8F"', JSON.stringify('___\x8F'));
+assertEquals('"___\x90"', JSON.stringify('___\x90'));
+assertEquals('"___\x91"', JSON.stringify('___\x91'));
+assertEquals('"___\x92"', JSON.stringify('___\x92'));
+assertEquals('"___\x93"', JSON.stringify('___\x93'));
+assertEquals('"___\x94"', JSON.stringify('___\x94'));
+assertEquals('"___\x95"', JSON.stringify('___\x95'));
+assertEquals('"___\x96"', JSON.stringify('___\x96'));
+assertEquals('"___\x97"', JSON.stringify('___\x97'));
+assertEquals('"___\x98"', JSON.stringify('___\x98'));
+assertEquals('"___\x99"', JSON.stringify('___\x99'));
+assertEquals('"___\x9A"', JSON.stringify('___\x9A'));
+assertEquals('"___\x9B"', JSON.stringify('___\x9B'));
+assertEquals('"___\x9C"', JSON.stringify('___\x9C'));
+assertEquals('"___\x9D"', JSON.stringify('___\x9D'));
+assertEquals('"___\x9E"', JSON.stringify('___\x9E'));
+assertEquals('"___\x9F"', JSON.stringify('___\x9F'));
+assertEquals('"___\xA0"', JSON.stringify('___\xA0'));
+assertEquals('"___\xA1"', JSON.stringify('___\xA1'));
+assertEquals('"___\xA2"', JSON.stringify('___\xA2'));
+assertEquals('"___\xA3"', JSON.stringify('___\xA3'));
+assertEquals('"___\xA4"', JSON.stringify('___\xA4'));
+assertEquals('"___\xA5"', JSON.stringify('___\xA5'));
+assertEquals('"___\xA6"', JSON.stringify('___\xA6'));
+assertEquals('"___\xA7"', JSON.stringify('___\xA7'));
+assertEquals('"___\xA8"', JSON.stringify('___\xA8'));
+assertEquals('"___\xA9"', JSON.stringify('___\xA9'));
+assertEquals('"___\xAA"', JSON.stringify('___\xAA'));
+assertEquals('"___\xAB"', JSON.stringify('___\xAB'));
+assertEquals('"___\xAC"', JSON.stringify('___\xAC'));
+assertEquals('"___\xAD"', JSON.stringify('___\xAD'));
+assertEquals('"___\xAE"', JSON.stringify('___\xAE'));
+assertEquals('"___\xAF"', JSON.stringify('___\xAF'));
+assertEquals('"___\xB0"', JSON.stringify('___\xB0'));
+assertEquals('"___\xB1"', JSON.stringify('___\xB1'));
+assertEquals('"___\xB2"', JSON.stringify('___\xB2'));
+assertEquals('"___\xB3"', JSON.stringify('___\xB3'));
+assertEquals('"___\xB4"', JSON.stringify('___\xB4'));
+assertEquals('"___\xB5"', JSON.stringify('___\xB5'));
+assertEquals('"___\xB6"', JSON.stringify('___\xB6'));
+assertEquals('"___\xB7"', JSON.stringify('___\xB7'));
+assertEquals('"___\xB8"', JSON.stringify('___\xB8'));
+assertEquals('"___\xB9"', JSON.stringify('___\xB9'));
+assertEquals('"___\xBA"', JSON.stringify('___\xBA'));
+assertEquals('"___\xBB"', JSON.stringify('___\xBB'));
+assertEquals('"___\xBC"', JSON.stringify('___\xBC'));
+assertEquals('"___\xBD"', JSON.stringify('___\xBD'));
+assertEquals('"___\xBE"', JSON.stringify('___\xBE'));
+assertEquals('"___\xBF"', JSON.stringify('___\xBF'));
+assertEquals('"___\xC0"', JSON.stringify('___\xC0'));
+assertEquals('"___\xC1"', JSON.stringify('___\xC1'));
+assertEquals('"___\xC2"', JSON.stringify('___\xC2'));
+assertEquals('"___\xC3"', JSON.stringify('___\xC3'));
+assertEquals('"___\xC4"', JSON.stringify('___\xC4'));
+assertEquals('"___\xC5"', JSON.stringify('___\xC5'));
+assertEquals('"___\xC6"', JSON.stringify('___\xC6'));
+assertEquals('"___\xC7"', JSON.stringify('___\xC7'));
+assertEquals('"___\xC8"', JSON.stringify('___\xC8'));
+assertEquals('"___\xC9"', JSON.stringify('___\xC9'));
+assertEquals('"___\xCA"', JSON.stringify('___\xCA'));
+assertEquals('"___\xCB"', JSON.stringify('___\xCB'));
+assertEquals('"___\xCC"', JSON.stringify('___\xCC'));
+assertEquals('"___\xCD"', JSON.stringify('___\xCD'));
+assertEquals('"___\xCE"', JSON.stringify('___\xCE'));
+assertEquals('"___\xCF"', JSON.stringify('___\xCF'));
+assertEquals('"___\xD0"', JSON.stringify('___\xD0'));
+assertEquals('"___\xD1"', JSON.stringify('___\xD1'));
+assertEquals('"___\xD2"', JSON.stringify('___\xD2'));
+assertEquals('"___\xD3"', JSON.stringify('___\xD3'));
+assertEquals('"___\xD4"', JSON.stringify('___\xD4'));
+assertEquals('"___\xD5"', JSON.stringify('___\xD5'));
+assertEquals('"___\xD6"', JSON.stringify('___\xD6'));
+assertEquals('"___\xD7"', JSON.stringify('___\xD7'));
+assertEquals('"___\xD8"', JSON.stringify('___\xD8'));
+assertEquals('"___\xD9"', JSON.stringify('___\xD9'));
+assertEquals('"___\xDA"', JSON.stringify('___\xDA'));
+assertEquals('"___\xDB"', JSON.stringify('___\xDB'));
+assertEquals('"___\xDC"', JSON.stringify('___\xDC'));
+assertEquals('"___\xDD"', JSON.stringify('___\xDD'));
+assertEquals('"___\xDE"', JSON.stringify('___\xDE'));
+assertEquals('"___\xDF"', JSON.stringify('___\xDF'));
+assertEquals('"___\xE0"', JSON.stringify('___\xE0'));
+assertEquals('"___\xE1"', JSON.stringify('___\xE1'));
+assertEquals('"___\xE2"', JSON.stringify('___\xE2'));
+assertEquals('"___\xE3"', JSON.stringify('___\xE3'));
+assertEquals('"___\xE4"', JSON.stringify('___\xE4'));
+assertEquals('"___\xE5"', JSON.stringify('___\xE5'));
+assertEquals('"___\xE6"', JSON.stringify('___\xE6'));
+assertEquals('"___\xE7"', JSON.stringify('___\xE7'));
+assertEquals('"___\xE8"', JSON.stringify('___\xE8'));
+assertEquals('"___\xE9"', JSON.stringify('___\xE9'));
+assertEquals('"___\xEA"', JSON.stringify('___\xEA'));
+assertEquals('"___\xEB"', JSON.stringify('___\xEB'));
+assertEquals('"___\xEC"', JSON.stringify('___\xEC'));
+assertEquals('"___\xED"', JSON.stringify('___\xED'));
+assertEquals('"___\xEE"', JSON.stringify('___\xEE'));
+assertEquals('"___\xEF"', JSON.stringify('___\xEF'));
+assertEquals('"___\xF0"', JSON.stringify('___\xF0'));
+assertEquals('"___\xF1"', JSON.stringify('___\xF1'));
+assertEquals('"___\xF2"', JSON.stringify('___\xF2'));
+assertEquals('"___\xF3"', JSON.stringify('___\xF3'));
+assertEquals('"___\xF4"', JSON.stringify('___\xF4'));
+assertEquals('"___\xF5"', JSON.stringify('___\xF5'));
+assertEquals('"___\xF6"', JSON.stringify('___\xF6'));
+assertEquals('"___\xF7"', JSON.stringify('___\xF7'));
+assertEquals('"___\xF8"', JSON.stringify('___\xF8'));
+assertEquals('"___\xF9"', JSON.stringify('___\xF9'));
+assertEquals('"___\xFA"', JSON.stringify('___\xFA'));
+assertEquals('"___\xFB"', JSON.stringify('___\xFB'));
+assertEquals('"___\xFC"', JSON.stringify('___\xFC'));
+assertEquals('"___\xFD"', JSON.stringify('___\xFD'));
+assertEquals('"___\xFE"', JSON.stringify('___\xFE'));
+assertEquals('"___\xFF"', JSON.stringify('___\xFF'));
+
+// A random selection of code points from U+0100 to U+D7FF.
+assertEquals('"___\u0100"', JSON.stringify('___\u0100'));
+assertEquals('"___\u0120"', JSON.stringify('___\u0120'));
+assertEquals('"___\u07D3"', JSON.stringify('___\u07D3'));
+assertEquals('"___\u0B8B"', JSON.stringify('___\u0B8B'));
+assertEquals('"___\u0C4C"', JSON.stringify('___\u0C4C'));
+assertEquals('"___\u178D"', JSON.stringify('___\u178D'));
+assertEquals('"___\u18B8"', JSON.stringify('___\u18B8'));
+assertEquals('"___\u193E"', JSON.stringify('___\u193E'));
+assertEquals('"___\u198A"', JSON.stringify('___\u198A'));
+assertEquals('"___\u1AF5"', JSON.stringify('___\u1AF5'));
+assertEquals('"___\u1D38"', JSON.stringify('___\u1D38'));
+assertEquals('"___\u1E37"', JSON.stringify('___\u1E37'));
+assertEquals('"___\u1FC2"', JSON.stringify('___\u1FC2'));
+assertEquals('"___\u22C7"', JSON.stringify('___\u22C7'));
+assertEquals('"___\u2619"', JSON.stringify('___\u2619'));
+assertEquals('"___\u272A"', JSON.stringify('___\u272A'));
+assertEquals('"___\u2B7F"', JSON.stringify('___\u2B7F'));
+assertEquals('"___\u2DFF"', JSON.stringify('___\u2DFF'));
+assertEquals('"___\u341B"', JSON.stringify('___\u341B'));
+assertEquals('"___\u3A3C"', JSON.stringify('___\u3A3C'));
+assertEquals('"___\u3E53"', JSON.stringify('___\u3E53'));
+assertEquals('"___\u3EC2"', JSON.stringify('___\u3EC2'));
+assertEquals('"___\u3F76"', JSON.stringify('___\u3F76'));
+assertEquals('"___\u3F85"', JSON.stringify('___\u3F85'));
+assertEquals('"___\u43C7"', JSON.stringify('___\u43C7'));
+assertEquals('"___\u4A19"', JSON.stringify('___\u4A19'));
+assertEquals('"___\u4A1C"', JSON.stringify('___\u4A1C'));
+assertEquals('"___\u4F80"', JSON.stringify('___\u4F80'));
+assertEquals('"___\u5A30"', JSON.stringify('___\u5A30'));
+assertEquals('"___\u5B55"', JSON.stringify('___\u5B55'));
+assertEquals('"___\u5C74"', JSON.stringify('___\u5C74'));
+assertEquals('"___\u6006"', JSON.stringify('___\u6006'));
+assertEquals('"___\u63CC"', JSON.stringify('___\u63CC'));
+assertEquals('"___\u6608"', JSON.stringify('___\u6608'));
+assertEquals('"___\u6ABF"', JSON.stringify('___\u6ABF'));
+assertEquals('"___\u6AE9"', JSON.stringify('___\u6AE9'));
+assertEquals('"___\u6C91"', JSON.stringify('___\u6C91'));
+assertEquals('"___\u714B"', JSON.stringify('___\u714B'));
+assertEquals('"___\u728A"', JSON.stringify('___\u728A'));
+assertEquals('"___\u7485"', JSON.stringify('___\u7485'));
+assertEquals('"___\u77C8"', JSON.stringify('___\u77C8'));
+assertEquals('"___\u7BE9"', JSON.stringify('___\u7BE9'));
+assertEquals('"___\u7CEF"', JSON.stringify('___\u7CEF'));
+assertEquals('"___\u7DD5"', JSON.stringify('___\u7DD5'));
+assertEquals('"___\u8DF1"', JSON.stringify('___\u8DF1'));
+assertEquals('"___\u94A9"', JSON.stringify('___\u94A9'));
+assertEquals('"___\u94F2"', JSON.stringify('___\u94F2'));
+assertEquals('"___\u9A7A"', JSON.stringify('___\u9A7A'));
+assertEquals('"___\u9AA6"', JSON.stringify('___\u9AA6'));
+assertEquals('"___\uA2B0"', JSON.stringify('___\uA2B0'));
+assertEquals('"___\uB711"', JSON.stringify('___\uB711'));
+assertEquals('"___\uBC01"', JSON.stringify('___\uBC01'));
+assertEquals('"___\uBCB6"', JSON.stringify('___\uBCB6'));
+assertEquals('"___\uBD70"', JSON.stringify('___\uBD70'));
+assertEquals('"___\uC3CD"', JSON.stringify('___\uC3CD'));
+assertEquals('"___\uC451"', JSON.stringify('___\uC451'));
+assertEquals('"___\uC677"', JSON.stringify('___\uC677'));
+assertEquals('"___\uC89B"', JSON.stringify('___\uC89B'));
+assertEquals('"___\uCBEF"', JSON.stringify('___\uCBEF'));
+assertEquals('"___\uCEF8"', JSON.stringify('___\uCEF8'));
+assertEquals('"___\uD089"', JSON.stringify('___\uD089'));
+assertEquals('"___\uD24D"', JSON.stringify('___\uD24D'));
+assertEquals('"___\uD3A7"', JSON.stringify('___\uD3A7'));
+assertEquals('"___\uD7FF"', JSON.stringify('___\uD7FF'));
+
+// All lone surrogates, i.e. code points from U+D800 to U+DFFF.
+assertEquals('"___\\ud800"', JSON.stringify('___\uD800'));
+assertEquals('"___\\ud801"', JSON.stringify('___\uD801'));
+assertEquals('"___\\ud802"', JSON.stringify('___\uD802'));
+assertEquals('"___\\ud803"', JSON.stringify('___\uD803'));
+assertEquals('"___\\ud804"', JSON.stringify('___\uD804'));
+assertEquals('"___\\ud805"', JSON.stringify('___\uD805'));
+assertEquals('"___\\ud806"', JSON.stringify('___\uD806'));
+assertEquals('"___\\ud807"', JSON.stringify('___\uD807'));
+assertEquals('"___\\ud808"', JSON.stringify('___\uD808'));
+assertEquals('"___\\ud809"', JSON.stringify('___\uD809'));
+assertEquals('"___\\ud80a"', JSON.stringify('___\uD80A'));
+assertEquals('"___\\ud80b"', JSON.stringify('___\uD80B'));
+assertEquals('"___\\ud80c"', JSON.stringify('___\uD80C'));
+assertEquals('"___\\ud80d"', JSON.stringify('___\uD80D'));
+assertEquals('"___\\ud80e"', JSON.stringify('___\uD80E'));
+assertEquals('"___\\ud80f"', JSON.stringify('___\uD80F'));
+assertEquals('"___\\ud810"', JSON.stringify('___\uD810'));
+assertEquals('"___\\ud811"', JSON.stringify('___\uD811'));
+assertEquals('"___\\ud812"', JSON.stringify('___\uD812'));
+assertEquals('"___\\ud813"', JSON.stringify('___\uD813'));
+assertEquals('"___\\ud814"', JSON.stringify('___\uD814'));
+assertEquals('"___\\ud815"', JSON.stringify('___\uD815'));
+assertEquals('"___\\ud816"', JSON.stringify('___\uD816'));
+assertEquals('"___\\ud817"', JSON.stringify('___\uD817'));
+assertEquals('"___\\ud818"', JSON.stringify('___\uD818'));
+assertEquals('"___\\ud819"', JSON.stringify('___\uD819'));
+assertEquals('"___\\ud81a"', JSON.stringify('___\uD81A'));
+assertEquals('"___\\ud81b"', JSON.stringify('___\uD81B'));
+assertEquals('"___\\ud81c"', JSON.stringify('___\uD81C'));
+assertEquals('"___\\ud81d"', JSON.stringify('___\uD81D'));
+assertEquals('"___\\ud81e"', JSON.stringify('___\uD81E'));
+assertEquals('"___\\ud81f"', JSON.stringify('___\uD81F'));
+assertEquals('"___\\ud820"', JSON.stringify('___\uD820'));
+assertEquals('"___\\ud821"', JSON.stringify('___\uD821'));
+assertEquals('"___\\ud822"', JSON.stringify('___\uD822'));
+assertEquals('"___\\ud823"', JSON.stringify('___\uD823'));
+assertEquals('"___\\ud824"', JSON.stringify('___\uD824'));
+assertEquals('"___\\ud825"', JSON.stringify('___\uD825'));
+assertEquals('"___\\ud826"', JSON.stringify('___\uD826'));
+assertEquals('"___\\ud827"', JSON.stringify('___\uD827'));
+assertEquals('"___\\ud828"', JSON.stringify('___\uD828'));
+assertEquals('"___\\ud829"', JSON.stringify('___\uD829'));
+assertEquals('"___\\ud82a"', JSON.stringify('___\uD82A'));
+assertEquals('"___\\ud82b"', JSON.stringify('___\uD82B'));
+assertEquals('"___\\ud82c"', JSON.stringify('___\uD82C'));
+assertEquals('"___\\ud82d"', JSON.stringify('___\uD82D'));
+assertEquals('"___\\ud82e"', JSON.stringify('___\uD82E'));
+assertEquals('"___\\ud82f"', JSON.stringify('___\uD82F'));
+assertEquals('"___\\ud830"', JSON.stringify('___\uD830'));
+assertEquals('"___\\ud831"', JSON.stringify('___\uD831'));
+assertEquals('"___\\ud832"', JSON.stringify('___\uD832'));
+assertEquals('"___\\ud833"', JSON.stringify('___\uD833'));
+assertEquals('"___\\ud834"', JSON.stringify('___\uD834'));
+assertEquals('"___\\ud835"', JSON.stringify('___\uD835'));
+assertEquals('"___\\ud836"', JSON.stringify('___\uD836'));
+assertEquals('"___\\ud837"', JSON.stringify('___\uD837'));
+assertEquals('"___\\ud838"', JSON.stringify('___\uD838'));
+assertEquals('"___\\ud839"', JSON.stringify('___\uD839'));
+assertEquals('"___\\ud83a"', JSON.stringify('___\uD83A'));
+assertEquals('"___\\ud83b"', JSON.stringify('___\uD83B'));
+assertEquals('"___\\ud83c"', JSON.stringify('___\uD83C'));
+assertEquals('"___\\ud83d"', JSON.stringify('___\uD83D'));
+assertEquals('"___\\ud83e"', JSON.stringify('___\uD83E'));
+assertEquals('"___\\ud83f"', JSON.stringify('___\uD83F'));
+assertEquals('"___\\ud840"', JSON.stringify('___\uD840'));
+assertEquals('"___\\ud841"', JSON.stringify('___\uD841'));
+assertEquals('"___\\ud842"', JSON.stringify('___\uD842'));
+assertEquals('"___\\ud843"', JSON.stringify('___\uD843'));
+assertEquals('"___\\ud844"', JSON.stringify('___\uD844'));
+assertEquals('"___\\ud845"', JSON.stringify('___\uD845'));
+assertEquals('"___\\ud846"', JSON.stringify('___\uD846'));
+assertEquals('"___\\ud847"', JSON.stringify('___\uD847'));
+assertEquals('"___\\ud848"', JSON.stringify('___\uD848'));
+assertEquals('"___\\ud849"', JSON.stringify('___\uD849'));
+assertEquals('"___\\ud84a"', JSON.stringify('___\uD84A'));
+assertEquals('"___\\ud84b"', JSON.stringify('___\uD84B'));
+assertEquals('"___\\ud84c"', JSON.stringify('___\uD84C'));
+assertEquals('"___\\ud84d"', JSON.stringify('___\uD84D'));
+assertEquals('"___\\ud84e"', JSON.stringify('___\uD84E'));
+assertEquals('"___\\ud84f"', JSON.stringify('___\uD84F'));
+assertEquals('"___\\ud850"', JSON.stringify('___\uD850'));
+assertEquals('"___\\ud851"', JSON.stringify('___\uD851'));
+assertEquals('"___\\ud852"', JSON.stringify('___\uD852'));
+assertEquals('"___\\ud853"', JSON.stringify('___\uD853'));
+assertEquals('"___\\ud854"', JSON.stringify('___\uD854'));
+assertEquals('"___\\ud855"', JSON.stringify('___\uD855'));
+assertEquals('"___\\ud856"', JSON.stringify('___\uD856'));
+assertEquals('"___\\ud857"', JSON.stringify('___\uD857'));
+assertEquals('"___\\ud858"', JSON.stringify('___\uD858'));
+assertEquals('"___\\ud859"', JSON.stringify('___\uD859'));
+assertEquals('"___\\ud85a"', JSON.stringify('___\uD85A'));
+assertEquals('"___\\ud85b"', JSON.stringify('___\uD85B'));
+assertEquals('"___\\ud85c"', JSON.stringify('___\uD85C'));
+assertEquals('"___\\ud85d"', JSON.stringify('___\uD85D'));
+assertEquals('"___\\ud85e"', JSON.stringify('___\uD85E'));
+assertEquals('"___\\ud85f"', JSON.stringify('___\uD85F'));
+assertEquals('"___\\ud860"', JSON.stringify('___\uD860'));
+assertEquals('"___\\ud861"', JSON.stringify('___\uD861'));
+assertEquals('"___\\ud862"', JSON.stringify('___\uD862'));
+assertEquals('"___\\ud863"', JSON.stringify('___\uD863'));
+assertEquals('"___\\ud864"', JSON.stringify('___\uD864'));
+assertEquals('"___\\ud865"', JSON.stringify('___\uD865'));
+assertEquals('"___\\ud866"', JSON.stringify('___\uD866'));
+assertEquals('"___\\ud867"', JSON.stringify('___\uD867'));
+assertEquals('"___\\ud868"', JSON.stringify('___\uD868'));
+assertEquals('"___\\ud869"', JSON.stringify('___\uD869'));
+assertEquals('"___\\ud86a"', JSON.stringify('___\uD86A'));
+assertEquals('"___\\ud86b"', JSON.stringify('___\uD86B'));
+assertEquals('"___\\ud86c"', JSON.stringify('___\uD86C'));
+assertEquals('"___\\ud86d"', JSON.stringify('___\uD86D'));
+assertEquals('"___\\ud86e"', JSON.stringify('___\uD86E'));
+assertEquals('"___\\ud86f"', JSON.stringify('___\uD86F'));
+assertEquals('"___\\ud870"', JSON.stringify('___\uD870'));
+assertEquals('"___\\ud871"', JSON.stringify('___\uD871'));
+assertEquals('"___\\ud872"', JSON.stringify('___\uD872'));
+assertEquals('"___\\ud873"', JSON.stringify('___\uD873'));
+assertEquals('"___\\ud874"', JSON.stringify('___\uD874'));
+assertEquals('"___\\ud875"', JSON.stringify('___\uD875'));
+assertEquals('"___\\ud876"', JSON.stringify('___\uD876'));
+assertEquals('"___\\ud877"', JSON.stringify('___\uD877'));
+assertEquals('"___\\ud878"', JSON.stringify('___\uD878'));
+assertEquals('"___\\ud879"', JSON.stringify('___\uD879'));
+assertEquals('"___\\ud87a"', JSON.stringify('___\uD87A'));
+assertEquals('"___\\ud87b"', JSON.stringify('___\uD87B'));
+assertEquals('"___\\ud87c"', JSON.stringify('___\uD87C'));
+assertEquals('"___\\ud87d"', JSON.stringify('___\uD87D'));
+assertEquals('"___\\ud87e"', JSON.stringify('___\uD87E'));
+assertEquals('"___\\ud87f"', JSON.stringify('___\uD87F'));
+assertEquals('"___\\ud880"', JSON.stringify('___\uD880'));
+assertEquals('"___\\ud881"', JSON.stringify('___\uD881'));
+assertEquals('"___\\ud882"', JSON.stringify('___\uD882'));
+assertEquals('"___\\ud883"', JSON.stringify('___\uD883'));
+assertEquals('"___\\ud884"', JSON.stringify('___\uD884'));
+assertEquals('"___\\ud885"', JSON.stringify('___\uD885'));
+assertEquals('"___\\ud886"', JSON.stringify('___\uD886'));
+assertEquals('"___\\ud887"', JSON.stringify('___\uD887'));
+assertEquals('"___\\ud888"', JSON.stringify('___\uD888'));
+assertEquals('"___\\ud889"', JSON.stringify('___\uD889'));
+assertEquals('"___\\ud88a"', JSON.stringify('___\uD88A'));
+assertEquals('"___\\ud88b"', JSON.stringify('___\uD88B'));
+assertEquals('"___\\ud88c"', JSON.stringify('___\uD88C'));
+assertEquals('"___\\ud88d"', JSON.stringify('___\uD88D'));
+assertEquals('"___\\ud88e"', JSON.stringify('___\uD88E'));
+assertEquals('"___\\ud88f"', JSON.stringify('___\uD88F'));
+assertEquals('"___\\ud890"', JSON.stringify('___\uD890'));
+assertEquals('"___\\ud891"', JSON.stringify('___\uD891'));
+assertEquals('"___\\ud892"', JSON.stringify('___\uD892'));
+assertEquals('"___\\ud893"', JSON.stringify('___\uD893'));
+assertEquals('"___\\ud894"', JSON.stringify('___\uD894'));
+assertEquals('"___\\ud895"', JSON.stringify('___\uD895'));
+assertEquals('"___\\ud896"', JSON.stringify('___\uD896'));
+assertEquals('"___\\ud897"', JSON.stringify('___\uD897'));
+assertEquals('"___\\ud898"', JSON.stringify('___\uD898'));
+assertEquals('"___\\ud899"', JSON.stringify('___\uD899'));
+assertEquals('"___\\ud89a"', JSON.stringify('___\uD89A'));
+assertEquals('"___\\ud89b"', JSON.stringify('___\uD89B'));
+assertEquals('"___\\ud89c"', JSON.stringify('___\uD89C'));
+assertEquals('"___\\ud89d"', JSON.stringify('___\uD89D'));
+assertEquals('"___\\ud89e"', JSON.stringify('___\uD89E'));
+assertEquals('"___\\ud89f"', JSON.stringify('___\uD89F'));
+assertEquals('"___\\ud8a0"', JSON.stringify('___\uD8A0'));
+assertEquals('"___\\ud8a1"', JSON.stringify('___\uD8A1'));
+assertEquals('"___\\ud8a2"', JSON.stringify('___\uD8A2'));
+assertEquals('"___\\ud8a3"', JSON.stringify('___\uD8A3'));
+assertEquals('"___\\ud8a4"', JSON.stringify('___\uD8A4'));
+assertEquals('"___\\ud8a5"', JSON.stringify('___\uD8A5'));
+assertEquals('"___\\ud8a6"', JSON.stringify('___\uD8A6'));
+assertEquals('"___\\ud8a7"', JSON.stringify('___\uD8A7'));
+assertEquals('"___\\ud8a8"', JSON.stringify('___\uD8A8'));
+assertEquals('"___\\ud8a9"', JSON.stringify('___\uD8A9'));
+assertEquals('"___\\ud8aa"', JSON.stringify('___\uD8AA'));
+assertEquals('"___\\ud8ab"', JSON.stringify('___\uD8AB'));
+assertEquals('"___\\ud8ac"', JSON.stringify('___\uD8AC'));
+assertEquals('"___\\ud8ad"', JSON.stringify('___\uD8AD'));
+assertEquals('"___\\ud8ae"', JSON.stringify('___\uD8AE'));
+assertEquals('"___\\ud8af"', JSON.stringify('___\uD8AF'));
+assertEquals('"___\\ud8b0"', JSON.stringify('___\uD8B0'));
+assertEquals('"___\\ud8b1"', JSON.stringify('___\uD8B1'));
+assertEquals('"___\\ud8b2"', JSON.stringify('___\uD8B2'));
+assertEquals('"___\\ud8b3"', JSON.stringify('___\uD8B3'));
+assertEquals('"___\\ud8b4"', JSON.stringify('___\uD8B4'));
+assertEquals('"___\\ud8b5"', JSON.stringify('___\uD8B5'));
+assertEquals('"___\\ud8b6"', JSON.stringify('___\uD8B6'));
+assertEquals('"___\\ud8b7"', JSON.stringify('___\uD8B7'));
+assertEquals('"___\\ud8b8"', JSON.stringify('___\uD8B8'));
+assertEquals('"___\\ud8b9"', JSON.stringify('___\uD8B9'));
+assertEquals('"___\\ud8ba"', JSON.stringify('___\uD8BA'));
+assertEquals('"___\\ud8bb"', JSON.stringify('___\uD8BB'));
+assertEquals('"___\\ud8bc"', JSON.stringify('___\uD8BC'));
+assertEquals('"___\\ud8bd"', JSON.stringify('___\uD8BD'));
+assertEquals('"___\\ud8be"', JSON.stringify('___\uD8BE'));
+assertEquals('"___\\ud8bf"', JSON.stringify('___\uD8BF'));
+assertEquals('"___\\ud8c0"', JSON.stringify('___\uD8C0'));
+assertEquals('"___\\ud8c1"', JSON.stringify('___\uD8C1'));
+assertEquals('"___\\ud8c2"', JSON.stringify('___\uD8C2'));
+assertEquals('"___\\ud8c3"', JSON.stringify('___\uD8C3'));
+assertEquals('"___\\ud8c4"', JSON.stringify('___\uD8C4'));
+assertEquals('"___\\ud8c5"', JSON.stringify('___\uD8C5'));
+assertEquals('"___\\ud8c6"', JSON.stringify('___\uD8C6'));
+assertEquals('"___\\ud8c7"', JSON.stringify('___\uD8C7'));
+assertEquals('"___\\ud8c8"', JSON.stringify('___\uD8C8'));
+assertEquals('"___\\ud8c9"', JSON.stringify('___\uD8C9'));
+assertEquals('"___\\ud8ca"', JSON.stringify('___\uD8CA'));
+assertEquals('"___\\ud8cb"', JSON.stringify('___\uD8CB'));
+assertEquals('"___\\ud8cc"', JSON.stringify('___\uD8CC'));
+assertEquals('"___\\ud8cd"', JSON.stringify('___\uD8CD'));
+assertEquals('"___\\ud8ce"', JSON.stringify('___\uD8CE'));
+assertEquals('"___\\ud8cf"', JSON.stringify('___\uD8CF'));
+assertEquals('"___\\ud8d0"', JSON.stringify('___\uD8D0'));
+assertEquals('"___\\ud8d1"', JSON.stringify('___\uD8D1'));
+assertEquals('"___\\ud8d2"', JSON.stringify('___\uD8D2'));
+assertEquals('"___\\ud8d3"', JSON.stringify('___\uD8D3'));
+assertEquals('"___\\ud8d4"', JSON.stringify('___\uD8D4'));
+assertEquals('"___\\ud8d5"', JSON.stringify('___\uD8D5'));
+assertEquals('"___\\ud8d6"', JSON.stringify('___\uD8D6'));
+assertEquals('"___\\ud8d7"', JSON.stringify('___\uD8D7'));
+assertEquals('"___\\ud8d8"', JSON.stringify('___\uD8D8'));
+assertEquals('"___\\ud8d9"', JSON.stringify('___\uD8D9'));
+assertEquals('"___\\ud8da"', JSON.stringify('___\uD8DA'));
+assertEquals('"___\\ud8db"', JSON.stringify('___\uD8DB'));
+assertEquals('"___\\ud8dc"', JSON.stringify('___\uD8DC'));
+assertEquals('"___\\ud8dd"', JSON.stringify('___\uD8DD'));
+assertEquals('"___\\ud8de"', JSON.stringify('___\uD8DE'));
+assertEquals('"___\\ud8df"', JSON.stringify('___\uD8DF'));
+assertEquals('"___\\ud8e0"', JSON.stringify('___\uD8E0'));
+assertEquals('"___\\ud8e1"', JSON.stringify('___\uD8E1'));
+assertEquals('"___\\ud8e2"', JSON.stringify('___\uD8E2'));
+assertEquals('"___\\ud8e3"', JSON.stringify('___\uD8E3'));
+assertEquals('"___\\ud8e4"', JSON.stringify('___\uD8E4'));
+assertEquals('"___\\ud8e5"', JSON.stringify('___\uD8E5'));
+assertEquals('"___\\ud8e6"', JSON.stringify('___\uD8E6'));
+assertEquals('"___\\ud8e7"', JSON.stringify('___\uD8E7'));
+assertEquals('"___\\ud8e8"', JSON.stringify('___\uD8E8'));
+assertEquals('"___\\ud8e9"', JSON.stringify('___\uD8E9'));
+assertEquals('"___\\ud8ea"', JSON.stringify('___\uD8EA'));
+assertEquals('"___\\ud8eb"', JSON.stringify('___\uD8EB'));
+assertEquals('"___\\ud8ec"', JSON.stringify('___\uD8EC'));
+assertEquals('"___\\ud8ed"', JSON.stringify('___\uD8ED'));
+assertEquals('"___\\ud8ee"', JSON.stringify('___\uD8EE'));
+assertEquals('"___\\ud8ef"', JSON.stringify('___\uD8EF'));
+assertEquals('"___\\ud8f0"', JSON.stringify('___\uD8F0'));
+assertEquals('"___\\ud8f1"', JSON.stringify('___\uD8F1'));
+assertEquals('"___\\ud8f2"', JSON.stringify('___\uD8F2'));
+assertEquals('"___\\ud8f3"', JSON.stringify('___\uD8F3'));
+assertEquals('"___\\ud8f4"', JSON.stringify('___\uD8F4'));
+assertEquals('"___\\ud8f5"', JSON.stringify('___\uD8F5'));
+assertEquals('"___\\ud8f6"', JSON.stringify('___\uD8F6'));
+assertEquals('"___\\ud8f7"', JSON.stringify('___\uD8F7'));
+assertEquals('"___\\ud8f8"', JSON.stringify('___\uD8F8'));
+assertEquals('"___\\ud8f9"', JSON.stringify('___\uD8F9'));
+assertEquals('"___\\ud8fa"', JSON.stringify('___\uD8FA'));
+assertEquals('"___\\ud8fb"', JSON.stringify('___\uD8FB'));
+assertEquals('"___\\ud8fc"', JSON.stringify('___\uD8FC'));
+assertEquals('"___\\ud8fd"', JSON.stringify('___\uD8FD'));
+assertEquals('"___\\ud8fe"', JSON.stringify('___\uD8FE'));
+assertEquals('"___\\ud8ff"', JSON.stringify('___\uD8FF'));
+assertEquals('"___\\ud900"', JSON.stringify('___\uD900'));
+assertEquals('"___\\ud901"', JSON.stringify('___\uD901'));
+assertEquals('"___\\ud902"', JSON.stringify('___\uD902'));
+assertEquals('"___\\ud903"', JSON.stringify('___\uD903'));
+assertEquals('"___\\ud904"', JSON.stringify('___\uD904'));
+assertEquals('"___\\ud905"', JSON.stringify('___\uD905'));
+assertEquals('"___\\ud906"', JSON.stringify('___\uD906'));
+assertEquals('"___\\ud907"', JSON.stringify('___\uD907'));
+assertEquals('"___\\ud908"', JSON.stringify('___\uD908'));
+assertEquals('"___\\ud909"', JSON.stringify('___\uD909'));
+assertEquals('"___\\ud90a"', JSON.stringify('___\uD90A'));
+assertEquals('"___\\ud90b"', JSON.stringify('___\uD90B'));
+assertEquals('"___\\ud90c"', JSON.stringify('___\uD90C'));
+assertEquals('"___\\ud90d"', JSON.stringify('___\uD90D'));
+assertEquals('"___\\ud90e"', JSON.stringify('___\uD90E'));
+assertEquals('"___\\ud90f"', JSON.stringify('___\uD90F'));
+assertEquals('"___\\ud910"', JSON.stringify('___\uD910'));
+assertEquals('"___\\ud911"', JSON.stringify('___\uD911'));
+assertEquals('"___\\ud912"', JSON.stringify('___\uD912'));
+assertEquals('"___\\ud913"', JSON.stringify('___\uD913'));
+assertEquals('"___\\ud914"', JSON.stringify('___\uD914'));
+assertEquals('"___\\ud915"', JSON.stringify('___\uD915'));
+assertEquals('"___\\ud916"', JSON.stringify('___\uD916'));
+assertEquals('"___\\ud917"', JSON.stringify('___\uD917'));
+assertEquals('"___\\ud918"', JSON.stringify('___\uD918'));
+assertEquals('"___\\ud919"', JSON.stringify('___\uD919'));
+assertEquals('"___\\ud91a"', JSON.stringify('___\uD91A'));
+assertEquals('"___\\ud91b"', JSON.stringify('___\uD91B'));
+assertEquals('"___\\ud91c"', JSON.stringify('___\uD91C'));
+assertEquals('"___\\ud91d"', JSON.stringify('___\uD91D'));
+assertEquals('"___\\ud91e"', JSON.stringify('___\uD91E'));
+assertEquals('"___\\ud91f"', JSON.stringify('___\uD91F'));
+assertEquals('"___\\ud920"', JSON.stringify('___\uD920'));
+assertEquals('"___\\ud921"', JSON.stringify('___\uD921'));
+assertEquals('"___\\ud922"', JSON.stringify('___\uD922'));
+assertEquals('"___\\ud923"', JSON.stringify('___\uD923'));
+assertEquals('"___\\ud924"', JSON.stringify('___\uD924'));
+assertEquals('"___\\ud925"', JSON.stringify('___\uD925'));
+assertEquals('"___\\ud926"', JSON.stringify('___\uD926'));
+assertEquals('"___\\ud927"', JSON.stringify('___\uD927'));
+assertEquals('"___\\ud928"', JSON.stringify('___\uD928'));
+assertEquals('"___\\ud929"', JSON.stringify('___\uD929'));
+assertEquals('"___\\ud92a"', JSON.stringify('___\uD92A'));
+assertEquals('"___\\ud92b"', JSON.stringify('___\uD92B'));
+assertEquals('"___\\ud92c"', JSON.stringify('___\uD92C'));
+assertEquals('"___\\ud92d"', JSON.stringify('___\uD92D'));
+assertEquals('"___\\ud92e"', JSON.stringify('___\uD92E'));
+assertEquals('"___\\ud92f"', JSON.stringify('___\uD92F'));
+assertEquals('"___\\ud930"', JSON.stringify('___\uD930'));
+assertEquals('"___\\ud931"', JSON.stringify('___\uD931'));
+assertEquals('"___\\ud932"', JSON.stringify('___\uD932'));
+assertEquals('"___\\ud933"', JSON.stringify('___\uD933'));
+assertEquals('"___\\ud934"', JSON.stringify('___\uD934'));
+assertEquals('"___\\ud935"', JSON.stringify('___\uD935'));
+assertEquals('"___\\ud936"', JSON.stringify('___\uD936'));
+assertEquals('"___\\ud937"', JSON.stringify('___\uD937'));
+assertEquals('"___\\ud938"', JSON.stringify('___\uD938'));
+assertEquals('"___\\ud939"', JSON.stringify('___\uD939'));
+assertEquals('"___\\ud93a"', JSON.stringify('___\uD93A'));
+assertEquals('"___\\ud93b"', JSON.stringify('___\uD93B'));
+assertEquals('"___\\ud93c"', JSON.stringify('___\uD93C'));
+assertEquals('"___\\ud93d"', JSON.stringify('___\uD93D'));
+assertEquals('"___\\ud93e"', JSON.stringify('___\uD93E'));
+assertEquals('"___\\ud93f"', JSON.stringify('___\uD93F'));
+assertEquals('"___\\ud940"', JSON.stringify('___\uD940'));
+assertEquals('"___\\ud941"', JSON.stringify('___\uD941'));
+assertEquals('"___\\ud942"', JSON.stringify('___\uD942'));
+assertEquals('"___\\ud943"', JSON.stringify('___\uD943'));
+assertEquals('"___\\ud944"', JSON.stringify('___\uD944'));
+assertEquals('"___\\ud945"', JSON.stringify('___\uD945'));
+assertEquals('"___\\ud946"', JSON.stringify('___\uD946'));
+assertEquals('"___\\ud947"', JSON.stringify('___\uD947'));
+assertEquals('"___\\ud948"', JSON.stringify('___\uD948'));
+assertEquals('"___\\ud949"', JSON.stringify('___\uD949'));
+assertEquals('"___\\ud94a"', JSON.stringify('___\uD94A'));
+assertEquals('"___\\ud94b"', JSON.stringify('___\uD94B'));
+assertEquals('"___\\ud94c"', JSON.stringify('___\uD94C'));
+assertEquals('"___\\ud94d"', JSON.stringify('___\uD94D'));
+assertEquals('"___\\ud94e"', JSON.stringify('___\uD94E'));
+assertEquals('"___\\ud94f"', JSON.stringify('___\uD94F'));
+assertEquals('"___\\ud950"', JSON.stringify('___\uD950'));
+assertEquals('"___\\ud951"', JSON.stringify('___\uD951'));
+assertEquals('"___\\ud952"', JSON.stringify('___\uD952'));
+assertEquals('"___\\ud953"', JSON.stringify('___\uD953'));
+assertEquals('"___\\ud954"', JSON.stringify('___\uD954'));
+assertEquals('"___\\ud955"', JSON.stringify('___\uD955'));
+assertEquals('"___\\ud956"', JSON.stringify('___\uD956'));
+assertEquals('"___\\ud957"', JSON.stringify('___\uD957'));
+assertEquals('"___\\ud958"', JSON.stringify('___\uD958'));
+assertEquals('"___\\ud959"', JSON.stringify('___\uD959'));
+assertEquals('"___\\ud95a"', JSON.stringify('___\uD95A'));
+assertEquals('"___\\ud95b"', JSON.stringify('___\uD95B'));
+assertEquals('"___\\ud95c"', JSON.stringify('___\uD95C'));
+assertEquals('"___\\ud95d"', JSON.stringify('___\uD95D'));
+assertEquals('"___\\ud95e"', JSON.stringify('___\uD95E'));
+assertEquals('"___\\ud95f"', JSON.stringify('___\uD95F'));
+assertEquals('"___\\ud960"', JSON.stringify('___\uD960'));
+assertEquals('"___\\ud961"', JSON.stringify('___\uD961'));
+assertEquals('"___\\ud962"', JSON.stringify('___\uD962'));
+assertEquals('"___\\ud963"', JSON.stringify('___\uD963'));
+assertEquals('"___\\ud964"', JSON.stringify('___\uD964'));
+assertEquals('"___\\ud965"', JSON.stringify('___\uD965'));
+assertEquals('"___\\ud966"', JSON.stringify('___\uD966'));
+assertEquals('"___\\ud967"', JSON.stringify('___\uD967'));
+assertEquals('"___\\ud968"', JSON.stringify('___\uD968'));
+assertEquals('"___\\ud969"', JSON.stringify('___\uD969'));
+assertEquals('"___\\ud96a"', JSON.stringify('___\uD96A'));
+assertEquals('"___\\ud96b"', JSON.stringify('___\uD96B'));
+assertEquals('"___\\ud96c"', JSON.stringify('___\uD96C'));
+assertEquals('"___\\ud96d"', JSON.stringify('___\uD96D'));
+assertEquals('"___\\ud96e"', JSON.stringify('___\uD96E'));
+assertEquals('"___\\ud96f"', JSON.stringify('___\uD96F'));
+assertEquals('"___\\ud970"', JSON.stringify('___\uD970'));
+assertEquals('"___\\ud971"', JSON.stringify('___\uD971'));
+assertEquals('"___\\ud972"', JSON.stringify('___\uD972'));
+assertEquals('"___\\ud973"', JSON.stringify('___\uD973'));
+assertEquals('"___\\ud974"', JSON.stringify('___\uD974'));
+assertEquals('"___\\ud975"', JSON.stringify('___\uD975'));
+assertEquals('"___\\ud976"', JSON.stringify('___\uD976'));
+assertEquals('"___\\ud977"', JSON.stringify('___\uD977'));
+assertEquals('"___\\ud978"', JSON.stringify('___\uD978'));
+assertEquals('"___\\ud979"', JSON.stringify('___\uD979'));
+assertEquals('"___\\ud97a"', JSON.stringify('___\uD97A'));
+assertEquals('"___\\ud97b"', JSON.stringify('___\uD97B'));
+assertEquals('"___\\ud97c"', JSON.stringify('___\uD97C'));
+assertEquals('"___\\ud97d"', JSON.stringify('___\uD97D'));
+assertEquals('"___\\ud97e"', JSON.stringify('___\uD97E'));
+assertEquals('"___\\ud97f"', JSON.stringify('___\uD97F'));
+assertEquals('"___\\ud980"', JSON.stringify('___\uD980'));
+assertEquals('"___\\ud981"', JSON.stringify('___\uD981'));
+assertEquals('"___\\ud982"', JSON.stringify('___\uD982'));
+assertEquals('"___\\ud983"', JSON.stringify('___\uD983'));
+assertEquals('"___\\ud984"', JSON.stringify('___\uD984'));
+assertEquals('"___\\ud985"', JSON.stringify('___\uD985'));
+assertEquals('"___\\ud986"', JSON.stringify('___\uD986'));
+assertEquals('"___\\ud987"', JSON.stringify('___\uD987'));
+assertEquals('"___\\ud988"', JSON.stringify('___\uD988'));
+assertEquals('"___\\ud989"', JSON.stringify('___\uD989'));
+assertEquals('"___\\ud98a"', JSON.stringify('___\uD98A'));
+assertEquals('"___\\ud98b"', JSON.stringify('___\uD98B'));
+assertEquals('"___\\ud98c"', JSON.stringify('___\uD98C'));
+assertEquals('"___\\ud98d"', JSON.stringify('___\uD98D'));
+assertEquals('"___\\ud98e"', JSON.stringify('___\uD98E'));
+assertEquals('"___\\ud98f"', JSON.stringify('___\uD98F'));
+assertEquals('"___\\ud990"', JSON.stringify('___\uD990'));
+assertEquals('"___\\ud991"', JSON.stringify('___\uD991'));
+assertEquals('"___\\ud992"', JSON.stringify('___\uD992'));
+assertEquals('"___\\ud993"', JSON.stringify('___\uD993'));
+assertEquals('"___\\ud994"', JSON.stringify('___\uD994'));
+assertEquals('"___\\ud995"', JSON.stringify('___\uD995'));
+assertEquals('"___\\ud996"', JSON.stringify('___\uD996'));
+assertEquals('"___\\ud997"', JSON.stringify('___\uD997'));
+assertEquals('"___\\ud998"', JSON.stringify('___\uD998'));
+assertEquals('"___\\ud999"', JSON.stringify('___\uD999'));
+assertEquals('"___\\ud99a"', JSON.stringify('___\uD99A'));
+assertEquals('"___\\ud99b"', JSON.stringify('___\uD99B'));
+assertEquals('"___\\ud99c"', JSON.stringify('___\uD99C'));
+assertEquals('"___\\ud99d"', JSON.stringify('___\uD99D'));
+assertEquals('"___\\ud99e"', JSON.stringify('___\uD99E'));
+assertEquals('"___\\ud99f"', JSON.stringify('___\uD99F'));
+assertEquals('"___\\ud9a0"', JSON.stringify('___\uD9A0'));
+assertEquals('"___\\ud9a1"', JSON.stringify('___\uD9A1'));
+assertEquals('"___\\ud9a2"', JSON.stringify('___\uD9A2'));
+assertEquals('"___\\ud9a3"', JSON.stringify('___\uD9A3'));
+assertEquals('"___\\ud9a4"', JSON.stringify('___\uD9A4'));
+assertEquals('"___\\ud9a5"', JSON.stringify('___\uD9A5'));
+assertEquals('"___\\ud9a6"', JSON.stringify('___\uD9A6'));
+assertEquals('"___\\ud9a7"', JSON.stringify('___\uD9A7'));
+assertEquals('"___\\ud9a8"', JSON.stringify('___\uD9A8'));
+assertEquals('"___\\ud9a9"', JSON.stringify('___\uD9A9'));
+assertEquals('"___\\ud9aa"', JSON.stringify('___\uD9AA'));
+assertEquals('"___\\ud9ab"', JSON.stringify('___\uD9AB'));
+assertEquals('"___\\ud9ac"', JSON.stringify('___\uD9AC'));
+assertEquals('"___\\ud9ad"', JSON.stringify('___\uD9AD'));
+assertEquals('"___\\ud9ae"', JSON.stringify('___\uD9AE'));
+assertEquals('"___\\ud9af"', JSON.stringify('___\uD9AF'));
+assertEquals('"___\\ud9b0"', JSON.stringify('___\uD9B0'));
+assertEquals('"___\\ud9b1"', JSON.stringify('___\uD9B1'));
+assertEquals('"___\\ud9b2"', JSON.stringify('___\uD9B2'));
+assertEquals('"___\\ud9b3"', JSON.stringify('___\uD9B3'));
+assertEquals('"___\\ud9b4"', JSON.stringify('___\uD9B4'));
+assertEquals('"___\\ud9b5"', JSON.stringify('___\uD9B5'));
+assertEquals('"___\\ud9b6"', JSON.stringify('___\uD9B6'));
+assertEquals('"___\\ud9b7"', JSON.stringify('___\uD9B7'));
+assertEquals('"___\\ud9b8"', JSON.stringify('___\uD9B8'));
+assertEquals('"___\\ud9b9"', JSON.stringify('___\uD9B9'));
+assertEquals('"___\\ud9ba"', JSON.stringify('___\uD9BA'));
+assertEquals('"___\\ud9bb"', JSON.stringify('___\uD9BB'));
+assertEquals('"___\\ud9bc"', JSON.stringify('___\uD9BC'));
+assertEquals('"___\\ud9bd"', JSON.stringify('___\uD9BD'));
+assertEquals('"___\\ud9be"', JSON.stringify('___\uD9BE'));
+assertEquals('"___\\ud9bf"', JSON.stringify('___\uD9BF'));
+assertEquals('"___\\ud9c0"', JSON.stringify('___\uD9C0'));
+assertEquals('"___\\ud9c1"', JSON.stringify('___\uD9C1'));
+assertEquals('"___\\ud9c2"', JSON.stringify('___\uD9C2'));
+assertEquals('"___\\ud9c3"', JSON.stringify('___\uD9C3'));
+assertEquals('"___\\ud9c4"', JSON.stringify('___\uD9C4'));
+assertEquals('"___\\ud9c5"', JSON.stringify('___\uD9C5'));
+assertEquals('"___\\ud9c6"', JSON.stringify('___\uD9C6'));
+assertEquals('"___\\ud9c7"', JSON.stringify('___\uD9C7'));
+assertEquals('"___\\ud9c8"', JSON.stringify('___\uD9C8'));
+assertEquals('"___\\ud9c9"', JSON.stringify('___\uD9C9'));
+assertEquals('"___\\ud9ca"', JSON.stringify('___\uD9CA'));
+assertEquals('"___\\ud9cb"', JSON.stringify('___\uD9CB'));
+assertEquals('"___\\ud9cc"', JSON.stringify('___\uD9CC'));
+assertEquals('"___\\ud9cd"', JSON.stringify('___\uD9CD'));
+assertEquals('"___\\ud9ce"', JSON.stringify('___\uD9CE'));
+assertEquals('"___\\ud9cf"', JSON.stringify('___\uD9CF'));
+assertEquals('"___\\ud9d0"', JSON.stringify('___\uD9D0'));
+assertEquals('"___\\ud9d1"', JSON.stringify('___\uD9D1'));
+assertEquals('"___\\ud9d2"', JSON.stringify('___\uD9D2'));
+assertEquals('"___\\ud9d3"', JSON.stringify('___\uD9D3'));
+assertEquals('"___\\ud9d4"', JSON.stringify('___\uD9D4'));
+assertEquals('"___\\ud9d5"', JSON.stringify('___\uD9D5'));
+assertEquals('"___\\ud9d6"', JSON.stringify('___\uD9D6'));
+assertEquals('"___\\ud9d7"', JSON.stringify('___\uD9D7'));
+assertEquals('"___\\ud9d8"', JSON.stringify('___\uD9D8'));
+assertEquals('"___\\ud9d9"', JSON.stringify('___\uD9D9'));
+assertEquals('"___\\ud9da"', JSON.stringify('___\uD9DA'));
+assertEquals('"___\\ud9db"', JSON.stringify('___\uD9DB'));
+assertEquals('"___\\ud9dc"', JSON.stringify('___\uD9DC'));
+assertEquals('"___\\ud9dd"', JSON.stringify('___\uD9DD'));
+assertEquals('"___\\ud9de"', JSON.stringify('___\uD9DE'));
+assertEquals('"___\\ud9df"', JSON.stringify('___\uD9DF'));
+assertEquals('"___\\ud9e0"', JSON.stringify('___\uD9E0'));
+assertEquals('"___\\ud9e1"', JSON.stringify('___\uD9E1'));
+assertEquals('"___\\ud9e2"', JSON.stringify('___\uD9E2'));
+assertEquals('"___\\ud9e3"', JSON.stringify('___\uD9E3'));
+assertEquals('"___\\ud9e4"', JSON.stringify('___\uD9E4'));
+assertEquals('"___\\ud9e5"', JSON.stringify('___\uD9E5'));
+assertEquals('"___\\ud9e6"', JSON.stringify('___\uD9E6'));
+assertEquals('"___\\ud9e7"', JSON.stringify('___\uD9E7'));
+assertEquals('"___\\ud9e8"', JSON.stringify('___\uD9E8'));
+assertEquals('"___\\ud9e9"', JSON.stringify('___\uD9E9'));
+assertEquals('"___\\ud9ea"', JSON.stringify('___\uD9EA'));
+assertEquals('"___\\ud9eb"', JSON.stringify('___\uD9EB'));
+assertEquals('"___\\ud9ec"', JSON.stringify('___\uD9EC'));
+assertEquals('"___\\ud9ed"', JSON.stringify('___\uD9ED'));
+assertEquals('"___\\ud9ee"', JSON.stringify('___\uD9EE'));
+assertEquals('"___\\ud9ef"', JSON.stringify('___\uD9EF'));
+assertEquals('"___\\ud9f0"', JSON.stringify('___\uD9F0'));
+assertEquals('"___\\ud9f1"', JSON.stringify('___\uD9F1'));
+assertEquals('"___\\ud9f2"', JSON.stringify('___\uD9F2'));
+assertEquals('"___\\ud9f3"', JSON.stringify('___\uD9F3'));
+assertEquals('"___\\ud9f4"', JSON.stringify('___\uD9F4'));
+assertEquals('"___\\ud9f5"', JSON.stringify('___\uD9F5'));
+assertEquals('"___\\ud9f6"', JSON.stringify('___\uD9F6'));
+assertEquals('"___\\ud9f7"', JSON.stringify('___\uD9F7'));
+assertEquals('"___\\ud9f8"', JSON.stringify('___\uD9F8'));
+assertEquals('"___\\ud9f9"', JSON.stringify('___\uD9F9'));
+assertEquals('"___\\ud9fa"', JSON.stringify('___\uD9FA'));
+assertEquals('"___\\ud9fb"', JSON.stringify('___\uD9FB'));
+assertEquals('"___\\ud9fc"', JSON.stringify('___\uD9FC'));
+assertEquals('"___\\ud9fd"', JSON.stringify('___\uD9FD'));
+assertEquals('"___\\ud9fe"', JSON.stringify('___\uD9FE'));
+assertEquals('"___\\ud9ff"', JSON.stringify('___\uD9FF'));
+assertEquals('"___\\uda00"', JSON.stringify('___\uDA00'));
+assertEquals('"___\\uda01"', JSON.stringify('___\uDA01'));
+assertEquals('"___\\uda02"', JSON.stringify('___\uDA02'));
+assertEquals('"___\\uda03"', JSON.stringify('___\uDA03'));
+assertEquals('"___\\uda04"', JSON.stringify('___\uDA04'));
+assertEquals('"___\\uda05"', JSON.stringify('___\uDA05'));
+assertEquals('"___\\uda06"', JSON.stringify('___\uDA06'));
+assertEquals('"___\\uda07"', JSON.stringify('___\uDA07'));
+assertEquals('"___\\uda08"', JSON.stringify('___\uDA08'));
+assertEquals('"___\\uda09"', JSON.stringify('___\uDA09'));
+assertEquals('"___\\uda0a"', JSON.stringify('___\uDA0A'));
+assertEquals('"___\\uda0b"', JSON.stringify('___\uDA0B'));
+assertEquals('"___\\uda0c"', JSON.stringify('___\uDA0C'));
+assertEquals('"___\\uda0d"', JSON.stringify('___\uDA0D'));
+assertEquals('"___\\uda0e"', JSON.stringify('___\uDA0E'));
+assertEquals('"___\\uda0f"', JSON.stringify('___\uDA0F'));
+assertEquals('"___\\uda10"', JSON.stringify('___\uDA10'));
+assertEquals('"___\\uda11"', JSON.stringify('___\uDA11'));
+assertEquals('"___\\uda12"', JSON.stringify('___\uDA12'));
+assertEquals('"___\\uda13"', JSON.stringify('___\uDA13'));
+assertEquals('"___\\uda14"', JSON.stringify('___\uDA14'));
+assertEquals('"___\\uda15"', JSON.stringify('___\uDA15'));
+assertEquals('"___\\uda16"', JSON.stringify('___\uDA16'));
+assertEquals('"___\\uda17"', JSON.stringify('___\uDA17'));
+assertEquals('"___\\uda18"', JSON.stringify('___\uDA18'));
+assertEquals('"___\\uda19"', JSON.stringify('___\uDA19'));
+assertEquals('"___\\uda1a"', JSON.stringify('___\uDA1A'));
+assertEquals('"___\\uda1b"', JSON.stringify('___\uDA1B'));
+assertEquals('"___\\uda1c"', JSON.stringify('___\uDA1C'));
+assertEquals('"___\\uda1d"', JSON.stringify('___\uDA1D'));
+assertEquals('"___\\uda1e"', JSON.stringify('___\uDA1E'));
+assertEquals('"___\\uda1f"', JSON.stringify('___\uDA1F'));
+assertEquals('"___\\uda20"', JSON.stringify('___\uDA20'));
+assertEquals('"___\\uda21"', JSON.stringify('___\uDA21'));
+assertEquals('"___\\uda22"', JSON.stringify('___\uDA22'));
+assertEquals('"___\\uda23"', JSON.stringify('___\uDA23'));
+assertEquals('"___\\uda24"', JSON.stringify('___\uDA24'));
+assertEquals('"___\\uda25"', JSON.stringify('___\uDA25'));
+assertEquals('"___\\uda26"', JSON.stringify('___\uDA26'));
+assertEquals('"___\\uda27"', JSON.stringify('___\uDA27'));
+assertEquals('"___\\uda28"', JSON.stringify('___\uDA28'));
+assertEquals('"___\\uda29"', JSON.stringify('___\uDA29'));
+assertEquals('"___\\uda2a"', JSON.stringify('___\uDA2A'));
+assertEquals('"___\\uda2b"', JSON.stringify('___\uDA2B'));
+assertEquals('"___\\uda2c"', JSON.stringify('___\uDA2C'));
+assertEquals('"___\\uda2d"', JSON.stringify('___\uDA2D'));
+assertEquals('"___\\uda2e"', JSON.stringify('___\uDA2E'));
+assertEquals('"___\\uda2f"', JSON.stringify('___\uDA2F'));
+assertEquals('"___\\uda30"', JSON.stringify('___\uDA30'));
+assertEquals('"___\\uda31"', JSON.stringify('___\uDA31'));
+assertEquals('"___\\uda32"', JSON.stringify('___\uDA32'));
+assertEquals('"___\\uda33"', JSON.stringify('___\uDA33'));
+assertEquals('"___\\uda34"', JSON.stringify('___\uDA34'));
+assertEquals('"___\\uda35"', JSON.stringify('___\uDA35'));
+assertEquals('"___\\uda36"', JSON.stringify('___\uDA36'));
+assertEquals('"___\\uda37"', JSON.stringify('___\uDA37'));
+assertEquals('"___\\uda38"', JSON.stringify('___\uDA38'));
+assertEquals('"___\\uda39"', JSON.stringify('___\uDA39'));
+assertEquals('"___\\uda3a"', JSON.stringify('___\uDA3A'));
+assertEquals('"___\\uda3b"', JSON.stringify('___\uDA3B'));
+assertEquals('"___\\uda3c"', JSON.stringify('___\uDA3C'));
+assertEquals('"___\\uda3d"', JSON.stringify('___\uDA3D'));
+assertEquals('"___\\uda3e"', JSON.stringify('___\uDA3E'));
+assertEquals('"___\\uda3f"', JSON.stringify('___\uDA3F'));
+assertEquals('"___\\uda40"', JSON.stringify('___\uDA40'));
+assertEquals('"___\\uda41"', JSON.stringify('___\uDA41'));
+assertEquals('"___\\uda42"', JSON.stringify('___\uDA42'));
+assertEquals('"___\\uda43"', JSON.stringify('___\uDA43'));
+assertEquals('"___\\uda44"', JSON.stringify('___\uDA44'));
+assertEquals('"___\\uda45"', JSON.stringify('___\uDA45'));
+assertEquals('"___\\uda46"', JSON.stringify('___\uDA46'));
+assertEquals('"___\\uda47"', JSON.stringify('___\uDA47'));
+assertEquals('"___\\uda48"', JSON.stringify('___\uDA48'));
+assertEquals('"___\\uda49"', JSON.stringify('___\uDA49'));
+assertEquals('"___\\uda4a"', JSON.stringify('___\uDA4A'));
+assertEquals('"___\\uda4b"', JSON.stringify('___\uDA4B'));
+assertEquals('"___\\uda4c"', JSON.stringify('___\uDA4C'));
+assertEquals('"___\\uda4d"', JSON.stringify('___\uDA4D'));
+assertEquals('"___\\uda4e"', JSON.stringify('___\uDA4E'));
+assertEquals('"___\\uda4f"', JSON.stringify('___\uDA4F'));
+assertEquals('"___\\uda50"', JSON.stringify('___\uDA50'));
+assertEquals('"___\\uda51"', JSON.stringify('___\uDA51'));
+assertEquals('"___\\uda52"', JSON.stringify('___\uDA52'));
+assertEquals('"___\\uda53"', JSON.stringify('___\uDA53'));
+assertEquals('"___\\uda54"', JSON.stringify('___\uDA54'));
+assertEquals('"___\\uda55"', JSON.stringify('___\uDA55'));
+assertEquals('"___\\uda56"', JSON.stringify('___\uDA56'));
+assertEquals('"___\\uda57"', JSON.stringify('___\uDA57'));
+assertEquals('"___\\uda58"', JSON.stringify('___\uDA58'));
+assertEquals('"___\\uda59"', JSON.stringify('___\uDA59'));
+assertEquals('"___\\uda5a"', JSON.stringify('___\uDA5A'));
+assertEquals('"___\\uda5b"', JSON.stringify('___\uDA5B'));
+assertEquals('"___\\uda5c"', JSON.stringify('___\uDA5C'));
+assertEquals('"___\\uda5d"', JSON.stringify('___\uDA5D'));
+assertEquals('"___\\uda5e"', JSON.stringify('___\uDA5E'));
+assertEquals('"___\\uda5f"', JSON.stringify('___\uDA5F'));
+assertEquals('"___\\uda60"', JSON.stringify('___\uDA60'));
+assertEquals('"___\\uda61"', JSON.stringify('___\uDA61'));
+assertEquals('"___\\uda62"', JSON.stringify('___\uDA62'));
+assertEquals('"___\\uda63"', JSON.stringify('___\uDA63'));
+assertEquals('"___\\uda64"', JSON.stringify('___\uDA64'));
+assertEquals('"___\\uda65"', JSON.stringify('___\uDA65'));
+assertEquals('"___\\uda66"', JSON.stringify('___\uDA66'));
+assertEquals('"___\\uda67"', JSON.stringify('___\uDA67'));
+assertEquals('"___\\uda68"', JSON.stringify('___\uDA68'));
+assertEquals('"___\\uda69"', JSON.stringify('___\uDA69'));
+assertEquals('"___\\uda6a"', JSON.stringify('___\uDA6A'));
+assertEquals('"___\\uda6b"', JSON.stringify('___\uDA6B'));
+assertEquals('"___\\uda6c"', JSON.stringify('___\uDA6C'));
+assertEquals('"___\\uda6d"', JSON.stringify('___\uDA6D'));
+assertEquals('"___\\uda6e"', JSON.stringify('___\uDA6E'));
+assertEquals('"___\\uda6f"', JSON.stringify('___\uDA6F'));
+assertEquals('"___\\uda70"', JSON.stringify('___\uDA70'));
+assertEquals('"___\\uda71"', JSON.stringify('___\uDA71'));
+assertEquals('"___\\uda72"', JSON.stringify('___\uDA72'));
+assertEquals('"___\\uda73"', JSON.stringify('___\uDA73'));
+assertEquals('"___\\uda74"', JSON.stringify('___\uDA74'));
+assertEquals('"___\\uda75"', JSON.stringify('___\uDA75'));
+assertEquals('"___\\uda76"', JSON.stringify('___\uDA76'));
+assertEquals('"___\\uda77"', JSON.stringify('___\uDA77'));
+assertEquals('"___\\uda78"', JSON.stringify('___\uDA78'));
+assertEquals('"___\\uda79"', JSON.stringify('___\uDA79'));
+assertEquals('"___\\uda7a"', JSON.stringify('___\uDA7A'));
+assertEquals('"___\\uda7b"', JSON.stringify('___\uDA7B'));
+assertEquals('"___\\uda7c"', JSON.stringify('___\uDA7C'));
+assertEquals('"___\\uda7d"', JSON.stringify('___\uDA7D'));
+assertEquals('"___\\uda7e"', JSON.stringify('___\uDA7E'));
+assertEquals('"___\\uda7f"', JSON.stringify('___\uDA7F'));
+assertEquals('"___\\uda80"', JSON.stringify('___\uDA80'));
+assertEquals('"___\\uda81"', JSON.stringify('___\uDA81'));
+assertEquals('"___\\uda82"', JSON.stringify('___\uDA82'));
+assertEquals('"___\\uda83"', JSON.stringify('___\uDA83'));
+assertEquals('"___\\uda84"', JSON.stringify('___\uDA84'));
+assertEquals('"___\\uda85"', JSON.stringify('___\uDA85'));
+assertEquals('"___\\uda86"', JSON.stringify('___\uDA86'));
+assertEquals('"___\\uda87"', JSON.stringify('___\uDA87'));
+assertEquals('"___\\uda88"', JSON.stringify('___\uDA88'));
+assertEquals('"___\\uda89"', JSON.stringify('___\uDA89'));
+assertEquals('"___\\uda8a"', JSON.stringify('___\uDA8A'));
+assertEquals('"___\\uda8b"', JSON.stringify('___\uDA8B'));
+assertEquals('"___\\uda8c"', JSON.stringify('___\uDA8C'));
+assertEquals('"___\\uda8d"', JSON.stringify('___\uDA8D'));
+assertEquals('"___\\uda8e"', JSON.stringify('___\uDA8E'));
+assertEquals('"___\\uda8f"', JSON.stringify('___\uDA8F'));
+assertEquals('"___\\uda90"', JSON.stringify('___\uDA90'));
+assertEquals('"___\\uda91"', JSON.stringify('___\uDA91'));
+assertEquals('"___\\uda92"', JSON.stringify('___\uDA92'));
+assertEquals('"___\\uda93"', JSON.stringify('___\uDA93'));
+assertEquals('"___\\uda94"', JSON.stringify('___\uDA94'));
+assertEquals('"___\\uda95"', JSON.stringify('___\uDA95'));
+assertEquals('"___\\uda96"', JSON.stringify('___\uDA96'));
+assertEquals('"___\\uda97"', JSON.stringify('___\uDA97'));
+assertEquals('"___\\uda98"', JSON.stringify('___\uDA98'));
+assertEquals('"___\\uda99"', JSON.stringify('___\uDA99'));
+assertEquals('"___\\uda9a"', JSON.stringify('___\uDA9A'));
+assertEquals('"___\\uda9b"', JSON.stringify('___\uDA9B'));
+assertEquals('"___\\uda9c"', JSON.stringify('___\uDA9C'));
+assertEquals('"___\\uda9d"', JSON.stringify('___\uDA9D'));
+assertEquals('"___\\uda9e"', JSON.stringify('___\uDA9E'));
+assertEquals('"___\\uda9f"', JSON.stringify('___\uDA9F'));
+assertEquals('"___\\udaa0"', JSON.stringify('___\uDAA0'));
+assertEquals('"___\\udaa1"', JSON.stringify('___\uDAA1'));
+assertEquals('"___\\udaa2"', JSON.stringify('___\uDAA2'));
+assertEquals('"___\\udaa3"', JSON.stringify('___\uDAA3'));
+assertEquals('"___\\udaa4"', JSON.stringify('___\uDAA4'));
+assertEquals('"___\\udaa5"', JSON.stringify('___\uDAA5'));
+assertEquals('"___\\udaa6"', JSON.stringify('___\uDAA6'));
+assertEquals('"___\\udaa7"', JSON.stringify('___\uDAA7'));
+assertEquals('"___\\udaa8"', JSON.stringify('___\uDAA8'));
+assertEquals('"___\\udaa9"', JSON.stringify('___\uDAA9'));
+assertEquals('"___\\udaaa"', JSON.stringify('___\uDAAA'));
+assertEquals('"___\\udaab"', JSON.stringify('___\uDAAB'));
+assertEquals('"___\\udaac"', JSON.stringify('___\uDAAC'));
+assertEquals('"___\\udaad"', JSON.stringify('___\uDAAD'));
+assertEquals('"___\\udaae"', JSON.stringify('___\uDAAE'));
+assertEquals('"___\\udaaf"', JSON.stringify('___\uDAAF'));
+assertEquals('"___\\udab0"', JSON.stringify('___\uDAB0'));
+assertEquals('"___\\udab1"', JSON.stringify('___\uDAB1'));
+assertEquals('"___\\udab2"', JSON.stringify('___\uDAB2'));
+assertEquals('"___\\udab3"', JSON.stringify('___\uDAB3'));
+assertEquals('"___\\udab4"', JSON.stringify('___\uDAB4'));
+assertEquals('"___\\udab5"', JSON.stringify('___\uDAB5'));
+assertEquals('"___\\udab6"', JSON.stringify('___\uDAB6'));
+assertEquals('"___\\udab7"', JSON.stringify('___\uDAB7'));
+assertEquals('"___\\udab8"', JSON.stringify('___\uDAB8'));
+assertEquals('"___\\udab9"', JSON.stringify('___\uDAB9'));
+assertEquals('"___\\udaba"', JSON.stringify('___\uDABA'));
+assertEquals('"___\\udabb"', JSON.stringify('___\uDABB'));
+assertEquals('"___\\udabc"', JSON.stringify('___\uDABC'));
+assertEquals('"___\\udabd"', JSON.stringify('___\uDABD'));
+assertEquals('"___\\udabe"', JSON.stringify('___\uDABE'));
+assertEquals('"___\\udabf"', JSON.stringify('___\uDABF'));
+assertEquals('"___\\udac0"', JSON.stringify('___\uDAC0'));
+assertEquals('"___\\udac1"', JSON.stringify('___\uDAC1'));
+assertEquals('"___\\udac2"', JSON.stringify('___\uDAC2'));
+assertEquals('"___\\udac3"', JSON.stringify('___\uDAC3'));
+assertEquals('"___\\udac4"', JSON.stringify('___\uDAC4'));
+assertEquals('"___\\udac5"', JSON.stringify('___\uDAC5'));
+assertEquals('"___\\udac6"', JSON.stringify('___\uDAC6'));
+assertEquals('"___\\udac7"', JSON.stringify('___\uDAC7'));
+assertEquals('"___\\udac8"', JSON.stringify('___\uDAC8'));
+assertEquals('"___\\udac9"', JSON.stringify('___\uDAC9'));
+assertEquals('"___\\udaca"', JSON.stringify('___\uDACA'));
+assertEquals('"___\\udacb"', JSON.stringify('___\uDACB'));
+assertEquals('"___\\udacc"', JSON.stringify('___\uDACC'));
+assertEquals('"___\\udacd"', JSON.stringify('___\uDACD'));
+assertEquals('"___\\udace"', JSON.stringify('___\uDACE'));
+assertEquals('"___\\udacf"', JSON.stringify('___\uDACF'));
+assertEquals('"___\\udad0"', JSON.stringify('___\uDAD0'));
+assertEquals('"___\\udad1"', JSON.stringify('___\uDAD1'));
+assertEquals('"___\\udad2"', JSON.stringify('___\uDAD2'));
+assertEquals('"___\\udad3"', JSON.stringify('___\uDAD3'));
+assertEquals('"___\\udad4"', JSON.stringify('___\uDAD4'));
+assertEquals('"___\\udad5"', JSON.stringify('___\uDAD5'));
+assertEquals('"___\\udad6"', JSON.stringify('___\uDAD6'));
+assertEquals('"___\\udad7"', JSON.stringify('___\uDAD7'));
+assertEquals('"___\\udad8"', JSON.stringify('___\uDAD8'));
+assertEquals('"___\\udad9"', JSON.stringify('___\uDAD9'));
+assertEquals('"___\\udada"', JSON.stringify('___\uDADA'));
+assertEquals('"___\\udadb"', JSON.stringify('___\uDADB'));
+assertEquals('"___\\udadc"', JSON.stringify('___\uDADC'));
+assertEquals('"___\\udadd"', JSON.stringify('___\uDADD'));
+assertEquals('"___\\udade"', JSON.stringify('___\uDADE'));
+assertEquals('"___\\udadf"', JSON.stringify('___\uDADF'));
+assertEquals('"___\\udae0"', JSON.stringify('___\uDAE0'));
+assertEquals('"___\\udae1"', JSON.stringify('___\uDAE1'));
+assertEquals('"___\\udae2"', JSON.stringify('___\uDAE2'));
+assertEquals('"___\\udae3"', JSON.stringify('___\uDAE3'));
+assertEquals('"___\\udae4"', JSON.stringify('___\uDAE4'));
+assertEquals('"___\\udae5"', JSON.stringify('___\uDAE5'));
+assertEquals('"___\\udae6"', JSON.stringify('___\uDAE6'));
+assertEquals('"___\\udae7"', JSON.stringify('___\uDAE7'));
+assertEquals('"___\\udae8"', JSON.stringify('___\uDAE8'));
+assertEquals('"___\\udae9"', JSON.stringify('___\uDAE9'));
+assertEquals('"___\\udaea"', JSON.stringify('___\uDAEA'));
+assertEquals('"___\\udaeb"', JSON.stringify('___\uDAEB'));
+assertEquals('"___\\udaec"', JSON.stringify('___\uDAEC'));
+assertEquals('"___\\udaed"', JSON.stringify('___\uDAED'));
+assertEquals('"___\\udaee"', JSON.stringify('___\uDAEE'));
+assertEquals('"___\\udaef"', JSON.stringify('___\uDAEF'));
+assertEquals('"___\\udaf0"', JSON.stringify('___\uDAF0'));
+assertEquals('"___\\udaf1"', JSON.stringify('___\uDAF1'));
+assertEquals('"___\\udaf2"', JSON.stringify('___\uDAF2'));
+assertEquals('"___\\udaf3"', JSON.stringify('___\uDAF3'));
+assertEquals('"___\\udaf4"', JSON.stringify('___\uDAF4'));
+assertEquals('"___\\udaf5"', JSON.stringify('___\uDAF5'));
+assertEquals('"___\\udaf6"', JSON.stringify('___\uDAF6'));
+assertEquals('"___\\udaf7"', JSON.stringify('___\uDAF7'));
+assertEquals('"___\\udaf8"', JSON.stringify('___\uDAF8'));
+assertEquals('"___\\udaf9"', JSON.stringify('___\uDAF9'));
+assertEquals('"___\\udafa"', JSON.stringify('___\uDAFA'));
+assertEquals('"___\\udafb"', JSON.stringify('___\uDAFB'));
+assertEquals('"___\\udafc"', JSON.stringify('___\uDAFC'));
+assertEquals('"___\\udafd"', JSON.stringify('___\uDAFD'));
+assertEquals('"___\\udafe"', JSON.stringify('___\uDAFE'));
+assertEquals('"___\\udaff"', JSON.stringify('___\uDAFF'));
+assertEquals('"___\\udb00"', JSON.stringify('___\uDB00'));
+assertEquals('"___\\udb01"', JSON.stringify('___\uDB01'));
+assertEquals('"___\\udb02"', JSON.stringify('___\uDB02'));
+assertEquals('"___\\udb03"', JSON.stringify('___\uDB03'));
+assertEquals('"___\\udb04"', JSON.stringify('___\uDB04'));
+assertEquals('"___\\udb05"', JSON.stringify('___\uDB05'));
+assertEquals('"___\\udb06"', JSON.stringify('___\uDB06'));
+assertEquals('"___\\udb07"', JSON.stringify('___\uDB07'));
+assertEquals('"___\\udb08"', JSON.stringify('___\uDB08'));
+assertEquals('"___\\udb09"', JSON.stringify('___\uDB09'));
+assertEquals('"___\\udb0a"', JSON.stringify('___\uDB0A'));
+assertEquals('"___\\udb0b"', JSON.stringify('___\uDB0B'));
+assertEquals('"___\\udb0c"', JSON.stringify('___\uDB0C'));
+assertEquals('"___\\udb0d"', JSON.stringify('___\uDB0D'));
+assertEquals('"___\\udb0e"', JSON.stringify('___\uDB0E'));
+assertEquals('"___\\udb0f"', JSON.stringify('___\uDB0F'));
+assertEquals('"___\\udb10"', JSON.stringify('___\uDB10'));
+assertEquals('"___\\udb11"', JSON.stringify('___\uDB11'));
+assertEquals('"___\\udb12"', JSON.stringify('___\uDB12'));
+assertEquals('"___\\udb13"', JSON.stringify('___\uDB13'));
+assertEquals('"___\\udb14"', JSON.stringify('___\uDB14'));
+assertEquals('"___\\udb15"', JSON.stringify('___\uDB15'));
+assertEquals('"___\\udb16"', JSON.stringify('___\uDB16'));
+assertEquals('"___\\udb17"', JSON.stringify('___\uDB17'));
+assertEquals('"___\\udb18"', JSON.stringify('___\uDB18'));
+assertEquals('"___\\udb19"', JSON.stringify('___\uDB19'));
+assertEquals('"___\\udb1a"', JSON.stringify('___\uDB1A'));
+assertEquals('"___\\udb1b"', JSON.stringify('___\uDB1B'));
+assertEquals('"___\\udb1c"', JSON.stringify('___\uDB1C'));
+assertEquals('"___\\udb1d"', JSON.stringify('___\uDB1D'));
+assertEquals('"___\\udb1e"', JSON.stringify('___\uDB1E'));
+assertEquals('"___\\udb1f"', JSON.stringify('___\uDB1F'));
+assertEquals('"___\\udb20"', JSON.stringify('___\uDB20'));
+assertEquals('"___\\udb21"', JSON.stringify('___\uDB21'));
+assertEquals('"___\\udb22"', JSON.stringify('___\uDB22'));
+assertEquals('"___\\udb23"', JSON.stringify('___\uDB23'));
+assertEquals('"___\\udb24"', JSON.stringify('___\uDB24'));
+assertEquals('"___\\udb25"', JSON.stringify('___\uDB25'));
+assertEquals('"___\\udb26"', JSON.stringify('___\uDB26'));
+assertEquals('"___\\udb27"', JSON.stringify('___\uDB27'));
+assertEquals('"___\\udb28"', JSON.stringify('___\uDB28'));
+assertEquals('"___\\udb29"', JSON.stringify('___\uDB29'));
+assertEquals('"___\\udb2a"', JSON.stringify('___\uDB2A'));
+assertEquals('"___\\udb2b"', JSON.stringify('___\uDB2B'));
+assertEquals('"___\\udb2c"', JSON.stringify('___\uDB2C'));
+assertEquals('"___\\udb2d"', JSON.stringify('___\uDB2D'));
+assertEquals('"___\\udb2e"', JSON.stringify('___\uDB2E'));
+assertEquals('"___\\udb2f"', JSON.stringify('___\uDB2F'));
+assertEquals('"___\\udb30"', JSON.stringify('___\uDB30'));
+assertEquals('"___\\udb31"', JSON.stringify('___\uDB31'));
+assertEquals('"___\\udb32"', JSON.stringify('___\uDB32'));
+assertEquals('"___\\udb33"', JSON.stringify('___\uDB33'));
+assertEquals('"___\\udb34"', JSON.stringify('___\uDB34'));
+assertEquals('"___\\udb35"', JSON.stringify('___\uDB35'));
+assertEquals('"___\\udb36"', JSON.stringify('___\uDB36'));
+assertEquals('"___\\udb37"', JSON.stringify('___\uDB37'));
+assertEquals('"___\\udb38"', JSON.stringify('___\uDB38'));
+assertEquals('"___\\udb39"', JSON.stringify('___\uDB39'));
+assertEquals('"___\\udb3a"', JSON.stringify('___\uDB3A'));
+assertEquals('"___\\udb3b"', JSON.stringify('___\uDB3B'));
+assertEquals('"___\\udb3c"', JSON.stringify('___\uDB3C'));
+assertEquals('"___\\udb3d"', JSON.stringify('___\uDB3D'));
+assertEquals('"___\\udb3e"', JSON.stringify('___\uDB3E'));
+assertEquals('"___\\udb3f"', JSON.stringify('___\uDB3F'));
+assertEquals('"___\\udb40"', JSON.stringify('___\uDB40'));
+assertEquals('"___\\udb41"', JSON.stringify('___\uDB41'));
+assertEquals('"___\\udb42"', JSON.stringify('___\uDB42'));
+assertEquals('"___\\udb43"', JSON.stringify('___\uDB43'));
+assertEquals('"___\\udb44"', JSON.stringify('___\uDB44'));
+assertEquals('"___\\udb45"', JSON.stringify('___\uDB45'));
+assertEquals('"___\\udb46"', JSON.stringify('___\uDB46'));
+assertEquals('"___\\udb47"', JSON.stringify('___\uDB47'));
+assertEquals('"___\\udb48"', JSON.stringify('___\uDB48'));
+assertEquals('"___\\udb49"', JSON.stringify('___\uDB49'));
+assertEquals('"___\\udb4a"', JSON.stringify('___\uDB4A'));
+assertEquals('"___\\udb4b"', JSON.stringify('___\uDB4B'));
+assertEquals('"___\\udb4c"', JSON.stringify('___\uDB4C'));
+assertEquals('"___\\udb4d"', JSON.stringify('___\uDB4D'));
+assertEquals('"___\\udb4e"', JSON.stringify('___\uDB4E'));
+assertEquals('"___\\udb4f"', JSON.stringify('___\uDB4F'));
+assertEquals('"___\\udb50"', JSON.stringify('___\uDB50'));
+assertEquals('"___\\udb51"', JSON.stringify('___\uDB51'));
+assertEquals('"___\\udb52"', JSON.stringify('___\uDB52'));
+assertEquals('"___\\udb53"', JSON.stringify('___\uDB53'));
+assertEquals('"___\\udb54"', JSON.stringify('___\uDB54'));
+assertEquals('"___\\udb55"', JSON.stringify('___\uDB55'));
+assertEquals('"___\\udb56"', JSON.stringify('___\uDB56'));
+assertEquals('"___\\udb57"', JSON.stringify('___\uDB57'));
+assertEquals('"___\\udb58"', JSON.stringify('___\uDB58'));
+assertEquals('"___\\udb59"', JSON.stringify('___\uDB59'));
+assertEquals('"___\\udb5a"', JSON.stringify('___\uDB5A'));
+assertEquals('"___\\udb5b"', JSON.stringify('___\uDB5B'));
+assertEquals('"___\\udb5c"', JSON.stringify('___\uDB5C'));
+assertEquals('"___\\udb5d"', JSON.stringify('___\uDB5D'));
+assertEquals('"___\\udb5e"', JSON.stringify('___\uDB5E'));
+assertEquals('"___\\udb5f"', JSON.stringify('___\uDB5F'));
+assertEquals('"___\\udb60"', JSON.stringify('___\uDB60'));
+assertEquals('"___\\udb61"', JSON.stringify('___\uDB61'));
+assertEquals('"___\\udb62"', JSON.stringify('___\uDB62'));
+assertEquals('"___\\udb63"', JSON.stringify('___\uDB63'));
+assertEquals('"___\\udb64"', JSON.stringify('___\uDB64'));
+assertEquals('"___\\udb65"', JSON.stringify('___\uDB65'));
+assertEquals('"___\\udb66"', JSON.stringify('___\uDB66'));
+assertEquals('"___\\udb67"', JSON.stringify('___\uDB67'));
+assertEquals('"___\\udb68"', JSON.stringify('___\uDB68'));
+assertEquals('"___\\udb69"', JSON.stringify('___\uDB69'));
+assertEquals('"___\\udb6a"', JSON.stringify('___\uDB6A'));
+assertEquals('"___\\udb6b"', JSON.stringify('___\uDB6B'));
+assertEquals('"___\\udb6c"', JSON.stringify('___\uDB6C'));
+assertEquals('"___\\udb6d"', JSON.stringify('___\uDB6D'));
+assertEquals('"___\\udb6e"', JSON.stringify('___\uDB6E'));
+assertEquals('"___\\udb6f"', JSON.stringify('___\uDB6F'));
+assertEquals('"___\\udb70"', JSON.stringify('___\uDB70'));
+assertEquals('"___\\udb71"', JSON.stringify('___\uDB71'));
+assertEquals('"___\\udb72"', JSON.stringify('___\uDB72'));
+assertEquals('"___\\udb73"', JSON.stringify('___\uDB73'));
+assertEquals('"___\\udb74"', JSON.stringify('___\uDB74'));
+assertEquals('"___\\udb75"', JSON.stringify('___\uDB75'));
+assertEquals('"___\\udb76"', JSON.stringify('___\uDB76'));
+assertEquals('"___\\udb77"', JSON.stringify('___\uDB77'));
+assertEquals('"___\\udb78"', JSON.stringify('___\uDB78'));
+assertEquals('"___\\udb79"', JSON.stringify('___\uDB79'));
+assertEquals('"___\\udb7a"', JSON.stringify('___\uDB7A'));
+assertEquals('"___\\udb7b"', JSON.stringify('___\uDB7B'));
+assertEquals('"___\\udb7c"', JSON.stringify('___\uDB7C'));
+assertEquals('"___\\udb7d"', JSON.stringify('___\uDB7D'));
+assertEquals('"___\\udb7e"', JSON.stringify('___\uDB7E'));
+assertEquals('"___\\udb7f"', JSON.stringify('___\uDB7F'));
+assertEquals('"___\\udb80"', JSON.stringify('___\uDB80'));
+assertEquals('"___\\udb81"', JSON.stringify('___\uDB81'));
+assertEquals('"___\\udb82"', JSON.stringify('___\uDB82'));
+assertEquals('"___\\udb83"', JSON.stringify('___\uDB83'));
+assertEquals('"___\\udb84"', JSON.stringify('___\uDB84'));
+assertEquals('"___\\udb85"', JSON.stringify('___\uDB85'));
+assertEquals('"___\\udb86"', JSON.stringify('___\uDB86'));
+assertEquals('"___\\udb87"', JSON.stringify('___\uDB87'));
+assertEquals('"___\\udb88"', JSON.stringify('___\uDB88'));
+assertEquals('"___\\udb89"', JSON.stringify('___\uDB89'));
+assertEquals('"___\\udb8a"', JSON.stringify('___\uDB8A'));
+assertEquals('"___\\udb8b"', JSON.stringify('___\uDB8B'));
+assertEquals('"___\\udb8c"', JSON.stringify('___\uDB8C'));
+assertEquals('"___\\udb8d"', JSON.stringify('___\uDB8D'));
+assertEquals('"___\\udb8e"', JSON.stringify('___\uDB8E'));
+assertEquals('"___\\udb8f"', JSON.stringify('___\uDB8F'));
+assertEquals('"___\\udb90"', JSON.stringify('___\uDB90'));
+assertEquals('"___\\udb91"', JSON.stringify('___\uDB91'));
+assertEquals('"___\\udb92"', JSON.stringify('___\uDB92'));
+assertEquals('"___\\udb93"', JSON.stringify('___\uDB93'));
+assertEquals('"___\\udb94"', JSON.stringify('___\uDB94'));
+assertEquals('"___\\udb95"', JSON.stringify('___\uDB95'));
+assertEquals('"___\\udb96"', JSON.stringify('___\uDB96'));
+assertEquals('"___\\udb97"', JSON.stringify('___\uDB97'));
+assertEquals('"___\\udb98"', JSON.stringify('___\uDB98'));
+assertEquals('"___\\udb99"', JSON.stringify('___\uDB99'));
+assertEquals('"___\\udb9a"', JSON.stringify('___\uDB9A'));
+assertEquals('"___\\udb9b"', JSON.stringify('___\uDB9B'));
+assertEquals('"___\\udb9c"', JSON.stringify('___\uDB9C'));
+assertEquals('"___\\udb9d"', JSON.stringify('___\uDB9D'));
+assertEquals('"___\\udb9e"', JSON.stringify('___\uDB9E'));
+assertEquals('"___\\udb9f"', JSON.stringify('___\uDB9F'));
+assertEquals('"___\\udba0"', JSON.stringify('___\uDBA0'));
+assertEquals('"___\\udba1"', JSON.stringify('___\uDBA1'));
+assertEquals('"___\\udba2"', JSON.stringify('___\uDBA2'));
+assertEquals('"___\\udba3"', JSON.stringify('___\uDBA3'));
+assertEquals('"___\\udba4"', JSON.stringify('___\uDBA4'));
+assertEquals('"___\\udba5"', JSON.stringify('___\uDBA5'));
+assertEquals('"___\\udba6"', JSON.stringify('___\uDBA6'));
+assertEquals('"___\\udba7"', JSON.stringify('___\uDBA7'));
+assertEquals('"___\\udba8"', JSON.stringify('___\uDBA8'));
+assertEquals('"___\\udba9"', JSON.stringify('___\uDBA9'));
+assertEquals('"___\\udbaa"', JSON.stringify('___\uDBAA'));
+assertEquals('"___\\udbab"', JSON.stringify('___\uDBAB'));
+assertEquals('"___\\udbac"', JSON.stringify('___\uDBAC'));
+assertEquals('"___\\udbad"', JSON.stringify('___\uDBAD'));
+assertEquals('"___\\udbae"', JSON.stringify('___\uDBAE'));
+assertEquals('"___\\udbaf"', JSON.stringify('___\uDBAF'));
+assertEquals('"___\\udbb0"', JSON.stringify('___\uDBB0'));
+assertEquals('"___\\udbb1"', JSON.stringify('___\uDBB1'));
+assertEquals('"___\\udbb2"', JSON.stringify('___\uDBB2'));
+assertEquals('"___\\udbb3"', JSON.stringify('___\uDBB3'));
+assertEquals('"___\\udbb4"', JSON.stringify('___\uDBB4'));
+assertEquals('"___\\udbb5"', JSON.stringify('___\uDBB5'));
+assertEquals('"___\\udbb6"', JSON.stringify('___\uDBB6'));
+assertEquals('"___\\udbb7"', JSON.stringify('___\uDBB7'));
+assertEquals('"___\\udbb8"', JSON.stringify('___\uDBB8'));
+assertEquals('"___\\udbb9"', JSON.stringify('___\uDBB9'));
+assertEquals('"___\\udbba"', JSON.stringify('___\uDBBA'));
+assertEquals('"___\\udbbb"', JSON.stringify('___\uDBBB'));
+assertEquals('"___\\udbbc"', JSON.stringify('___\uDBBC'));
+assertEquals('"___\\udbbd"', JSON.stringify('___\uDBBD'));
+assertEquals('"___\\udbbe"', JSON.stringify('___\uDBBE'));
+assertEquals('"___\\udbbf"', JSON.stringify('___\uDBBF'));
+assertEquals('"___\\udbc0"', JSON.stringify('___\uDBC0'));
+assertEquals('"___\\udbc1"', JSON.stringify('___\uDBC1'));
+assertEquals('"___\\udbc2"', JSON.stringify('___\uDBC2'));
+assertEquals('"___\\udbc3"', JSON.stringify('___\uDBC3'));
+assertEquals('"___\\udbc4"', JSON.stringify('___\uDBC4'));
+assertEquals('"___\\udbc5"', JSON.stringify('___\uDBC5'));
+assertEquals('"___\\udbc6"', JSON.stringify('___\uDBC6'));
+assertEquals('"___\\udbc7"', JSON.stringify('___\uDBC7'));
+assertEquals('"___\\udbc8"', JSON.stringify('___\uDBC8'));
+assertEquals('"___\\udbc9"', JSON.stringify('___\uDBC9'));
+assertEquals('"___\\udbca"', JSON.stringify('___\uDBCA'));
+assertEquals('"___\\udbcb"', JSON.stringify('___\uDBCB'));
+assertEquals('"___\\udbcc"', JSON.stringify('___\uDBCC'));
+assertEquals('"___\\udbcd"', JSON.stringify('___\uDBCD'));
+assertEquals('"___\\udbce"', JSON.stringify('___\uDBCE'));
+assertEquals('"___\\udbcf"', JSON.stringify('___\uDBCF'));
+assertEquals('"___\\udbd0"', JSON.stringify('___\uDBD0'));
+assertEquals('"___\\udbd1"', JSON.stringify('___\uDBD1'));
+assertEquals('"___\\udbd2"', JSON.stringify('___\uDBD2'));
+assertEquals('"___\\udbd3"', JSON.stringify('___\uDBD3'));
+assertEquals('"___\\udbd4"', JSON.stringify('___\uDBD4'));
+assertEquals('"___\\udbd5"', JSON.stringify('___\uDBD5'));
+assertEquals('"___\\udbd6"', JSON.stringify('___\uDBD6'));
+assertEquals('"___\\udbd7"', JSON.stringify('___\uDBD7'));
+assertEquals('"___\\udbd8"', JSON.stringify('___\uDBD8'));
+assertEquals('"___\\udbd9"', JSON.stringify('___\uDBD9'));
+assertEquals('"___\\udbda"', JSON.stringify('___\uDBDA'));
+assertEquals('"___\\udbdb"', JSON.stringify('___\uDBDB'));
+assertEquals('"___\\udbdc"', JSON.stringify('___\uDBDC'));
+assertEquals('"___\\udbdd"', JSON.stringify('___\uDBDD'));
+assertEquals('"___\\udbde"', JSON.stringify('___\uDBDE'));
+assertEquals('"___\\udbdf"', JSON.stringify('___\uDBDF'));
+assertEquals('"___\\udbe0"', JSON.stringify('___\uDBE0'));
+assertEquals('"___\\udbe1"', JSON.stringify('___\uDBE1'));
+assertEquals('"___\\udbe2"', JSON.stringify('___\uDBE2'));
+assertEquals('"___\\udbe3"', JSON.stringify('___\uDBE3'));
+assertEquals('"___\\udbe4"', JSON.stringify('___\uDBE4'));
+assertEquals('"___\\udbe5"', JSON.stringify('___\uDBE5'));
+assertEquals('"___\\udbe6"', JSON.stringify('___\uDBE6'));
+assertEquals('"___\\udbe7"', JSON.stringify('___\uDBE7'));
+assertEquals('"___\\udbe8"', JSON.stringify('___\uDBE8'));
+assertEquals('"___\\udbe9"', JSON.stringify('___\uDBE9'));
+assertEquals('"___\\udbea"', JSON.stringify('___\uDBEA'));
+assertEquals('"___\\udbeb"', JSON.stringify('___\uDBEB'));
+assertEquals('"___\\udbec"', JSON.stringify('___\uDBEC'));
+assertEquals('"___\\udbed"', JSON.stringify('___\uDBED'));
+assertEquals('"___\\udbee"', JSON.stringify('___\uDBEE'));
+assertEquals('"___\\udbef"', JSON.stringify('___\uDBEF'));
+assertEquals('"___\\udbf0"', JSON.stringify('___\uDBF0'));
+assertEquals('"___\\udbf1"', JSON.stringify('___\uDBF1'));
+assertEquals('"___\\udbf2"', JSON.stringify('___\uDBF2'));
+assertEquals('"___\\udbf3"', JSON.stringify('___\uDBF3'));
+assertEquals('"___\\udbf4"', JSON.stringify('___\uDBF4'));
+assertEquals('"___\\udbf5"', JSON.stringify('___\uDBF5'));
+assertEquals('"___\\udbf6"', JSON.stringify('___\uDBF6'));
+assertEquals('"___\\udbf7"', JSON.stringify('___\uDBF7'));
+assertEquals('"___\\udbf8"', JSON.stringify('___\uDBF8'));
+assertEquals('"___\\udbf9"', JSON.stringify('___\uDBF9'));
+assertEquals('"___\\udbfa"', JSON.stringify('___\uDBFA'));
+assertEquals('"___\\udbfb"', JSON.stringify('___\uDBFB'));
+assertEquals('"___\\udbfc"', JSON.stringify('___\uDBFC'));
+assertEquals('"___\\udbfd"', JSON.stringify('___\uDBFD'));
+assertEquals('"___\\udbfe"', JSON.stringify('___\uDBFE'));
+assertEquals('"___\\udbff"', JSON.stringify('___\uDBFF'));
+assertEquals('"___\\udc00"', JSON.stringify('___\uDC00'));
+assertEquals('"___\\udc01"', JSON.stringify('___\uDC01'));
+assertEquals('"___\\udc02"', JSON.stringify('___\uDC02'));
+assertEquals('"___\\udc03"', JSON.stringify('___\uDC03'));
+assertEquals('"___\\udc04"', JSON.stringify('___\uDC04'));
+assertEquals('"___\\udc05"', JSON.stringify('___\uDC05'));
+assertEquals('"___\\udc06"', JSON.stringify('___\uDC06'));
+assertEquals('"___\\udc07"', JSON.stringify('___\uDC07'));
+assertEquals('"___\\udc08"', JSON.stringify('___\uDC08'));
+assertEquals('"___\\udc09"', JSON.stringify('___\uDC09'));
+assertEquals('"___\\udc0a"', JSON.stringify('___\uDC0A'));
+assertEquals('"___\\udc0b"', JSON.stringify('___\uDC0B'));
+assertEquals('"___\\udc0c"', JSON.stringify('___\uDC0C'));
+assertEquals('"___\\udc0d"', JSON.stringify('___\uDC0D'));
+assertEquals('"___\\udc0e"', JSON.stringify('___\uDC0E'));
+assertEquals('"___\\udc0f"', JSON.stringify('___\uDC0F'));
+assertEquals('"___\\udc10"', JSON.stringify('___\uDC10'));
+assertEquals('"___\\udc11"', JSON.stringify('___\uDC11'));
+assertEquals('"___\\udc12"', JSON.stringify('___\uDC12'));
+assertEquals('"___\\udc13"', JSON.stringify('___\uDC13'));
+assertEquals('"___\\udc14"', JSON.stringify('___\uDC14'));
+assertEquals('"___\\udc15"', JSON.stringify('___\uDC15'));
+assertEquals('"___\\udc16"', JSON.stringify('___\uDC16'));
+assertEquals('"___\\udc17"', JSON.stringify('___\uDC17'));
+assertEquals('"___\\udc18"', JSON.stringify('___\uDC18'));
+assertEquals('"___\\udc19"', JSON.stringify('___\uDC19'));
+assertEquals('"___\\udc1a"', JSON.stringify('___\uDC1A'));
+assertEquals('"___\\udc1b"', JSON.stringify('___\uDC1B'));
+assertEquals('"___\\udc1c"', JSON.stringify('___\uDC1C'));
+assertEquals('"___\\udc1d"', JSON.stringify('___\uDC1D'));
+assertEquals('"___\\udc1e"', JSON.stringify('___\uDC1E'));
+assertEquals('"___\\udc1f"', JSON.stringify('___\uDC1F'));
+assertEquals('"___\\udc20"', JSON.stringify('___\uDC20'));
+assertEquals('"___\\udc21"', JSON.stringify('___\uDC21'));
+assertEquals('"___\\udc22"', JSON.stringify('___\uDC22'));
+assertEquals('"___\\udc23"', JSON.stringify('___\uDC23'));
+assertEquals('"___\\udc24"', JSON.stringify('___\uDC24'));
+assertEquals('"___\\udc25"', JSON.stringify('___\uDC25'));
+assertEquals('"___\\udc26"', JSON.stringify('___\uDC26'));
+assertEquals('"___\\udc27"', JSON.stringify('___\uDC27'));
+assertEquals('"___\\udc28"', JSON.stringify('___\uDC28'));
+assertEquals('"___\\udc29"', JSON.stringify('___\uDC29'));
+assertEquals('"___\\udc2a"', JSON.stringify('___\uDC2A'));
+assertEquals('"___\\udc2b"', JSON.stringify('___\uDC2B'));
+assertEquals('"___\\udc2c"', JSON.stringify('___\uDC2C'));
+assertEquals('"___\\udc2d"', JSON.stringify('___\uDC2D'));
+assertEquals('"___\\udc2e"', JSON.stringify('___\uDC2E'));
+assertEquals('"___\\udc2f"', JSON.stringify('___\uDC2F'));
+assertEquals('"___\\udc30"', JSON.stringify('___\uDC30'));
+assertEquals('"___\\udc31"', JSON.stringify('___\uDC31'));
+assertEquals('"___\\udc32"', JSON.stringify('___\uDC32'));
+assertEquals('"___\\udc33"', JSON.stringify('___\uDC33'));
+assertEquals('"___\\udc34"', JSON.stringify('___\uDC34'));
+assertEquals('"___\\udc35"', JSON.stringify('___\uDC35'));
+assertEquals('"___\\udc36"', JSON.stringify('___\uDC36'));
+assertEquals('"___\\udc37"', JSON.stringify('___\uDC37'));
+assertEquals('"___\\udc38"', JSON.stringify('___\uDC38'));
+assertEquals('"___\\udc39"', JSON.stringify('___\uDC39'));
+assertEquals('"___\\udc3a"', JSON.stringify('___\uDC3A'));
+assertEquals('"___\\udc3b"', JSON.stringify('___\uDC3B'));
+assertEquals('"___\\udc3c"', JSON.stringify('___\uDC3C'));
+assertEquals('"___\\udc3d"', JSON.stringify('___\uDC3D'));
+assertEquals('"___\\udc3e"', JSON.stringify('___\uDC3E'));
+assertEquals('"___\\udc3f"', JSON.stringify('___\uDC3F'));
+assertEquals('"___\\udc40"', JSON.stringify('___\uDC40'));
+assertEquals('"___\\udc41"', JSON.stringify('___\uDC41'));
+assertEquals('"___\\udc42"', JSON.stringify('___\uDC42'));
+assertEquals('"___\\udc43"', JSON.stringify('___\uDC43'));
+assertEquals('"___\\udc44"', JSON.stringify('___\uDC44'));
+assertEquals('"___\\udc45"', JSON.stringify('___\uDC45'));
+assertEquals('"___\\udc46"', JSON.stringify('___\uDC46'));
+assertEquals('"___\\udc47"', JSON.stringify('___\uDC47'));
+assertEquals('"___\\udc48"', JSON.stringify('___\uDC48'));
+assertEquals('"___\\udc49"', JSON.stringify('___\uDC49'));
+assertEquals('"___\\udc4a"', JSON.stringify('___\uDC4A'));
+assertEquals('"___\\udc4b"', JSON.stringify('___\uDC4B'));
+assertEquals('"___\\udc4c"', JSON.stringify('___\uDC4C'));
+assertEquals('"___\\udc4d"', JSON.stringify('___\uDC4D'));
+assertEquals('"___\\udc4e"', JSON.stringify('___\uDC4E'));
+assertEquals('"___\\udc4f"', JSON.stringify('___\uDC4F'));
+assertEquals('"___\\udc50"', JSON.stringify('___\uDC50'));
+assertEquals('"___\\udc51"', JSON.stringify('___\uDC51'));
+assertEquals('"___\\udc52"', JSON.stringify('___\uDC52'));
+assertEquals('"___\\udc53"', JSON.stringify('___\uDC53'));
+assertEquals('"___\\udc54"', JSON.stringify('___\uDC54'));
+assertEquals('"___\\udc55"', JSON.stringify('___\uDC55'));
+assertEquals('"___\\udc56"', JSON.stringify('___\uDC56'));
+assertEquals('"___\\udc57"', JSON.stringify('___\uDC57'));
+assertEquals('"___\\udc58"', JSON.stringify('___\uDC58'));
+assertEquals('"___\\udc59"', JSON.stringify('___\uDC59'));
+assertEquals('"___\\udc5a"', JSON.stringify('___\uDC5A'));
+assertEquals('"___\\udc5b"', JSON.stringify('___\uDC5B'));
+assertEquals('"___\\udc5c"', JSON.stringify('___\uDC5C'));
+assertEquals('"___\\udc5d"', JSON.stringify('___\uDC5D'));
+assertEquals('"___\\udc5e"', JSON.stringify('___\uDC5E'));
+assertEquals('"___\\udc5f"', JSON.stringify('___\uDC5F'));
+assertEquals('"___\\udc60"', JSON.stringify('___\uDC60'));
+assertEquals('"___\\udc61"', JSON.stringify('___\uDC61'));
+assertEquals('"___\\udc62"', JSON.stringify('___\uDC62'));
+assertEquals('"___\\udc63"', JSON.stringify('___\uDC63'));
+assertEquals('"___\\udc64"', JSON.stringify('___\uDC64'));
+assertEquals('"___\\udc65"', JSON.stringify('___\uDC65'));
+assertEquals('"___\\udc66"', JSON.stringify('___\uDC66'));
+assertEquals('"___\\udc67"', JSON.stringify('___\uDC67'));
+assertEquals('"___\\udc68"', JSON.stringify('___\uDC68'));
+assertEquals('"___\\udc69"', JSON.stringify('___\uDC69'));
+assertEquals('"___\\udc6a"', JSON.stringify('___\uDC6A'));
+assertEquals('"___\\udc6b"', JSON.stringify('___\uDC6B'));
+assertEquals('"___\\udc6c"', JSON.stringify('___\uDC6C'));
+assertEquals('"___\\udc6d"', JSON.stringify('___\uDC6D'));
+assertEquals('"___\\udc6e"', JSON.stringify('___\uDC6E'));
+assertEquals('"___\\udc6f"', JSON.stringify('___\uDC6F'));
+assertEquals('"___\\udc70"', JSON.stringify('___\uDC70'));
+assertEquals('"___\\udc71"', JSON.stringify('___\uDC71'));
+assertEquals('"___\\udc72"', JSON.stringify('___\uDC72'));
+assertEquals('"___\\udc73"', JSON.stringify('___\uDC73'));
+assertEquals('"___\\udc74"', JSON.stringify('___\uDC74'));
+assertEquals('"___\\udc75"', JSON.stringify('___\uDC75'));
+assertEquals('"___\\udc76"', JSON.stringify('___\uDC76'));
+assertEquals('"___\\udc77"', JSON.stringify('___\uDC77'));
+assertEquals('"___\\udc78"', JSON.stringify('___\uDC78'));
+assertEquals('"___\\udc79"', JSON.stringify('___\uDC79'));
+assertEquals('"___\\udc7a"', JSON.stringify('___\uDC7A'));
+assertEquals('"___\\udc7b"', JSON.stringify('___\uDC7B'));
+assertEquals('"___\\udc7c"', JSON.stringify('___\uDC7C'));
+assertEquals('"___\\udc7d"', JSON.stringify('___\uDC7D'));
+assertEquals('"___\\udc7e"', JSON.stringify('___\uDC7E'));
+assertEquals('"___\\udc7f"', JSON.stringify('___\uDC7F'));
+assertEquals('"___\\udc80"', JSON.stringify('___\uDC80'));
+assertEquals('"___\\udc81"', JSON.stringify('___\uDC81'));
+assertEquals('"___\\udc82"', JSON.stringify('___\uDC82'));
+assertEquals('"___\\udc83"', JSON.stringify('___\uDC83'));
+assertEquals('"___\\udc84"', JSON.stringify('___\uDC84'));
+assertEquals('"___\\udc85"', JSON.stringify('___\uDC85'));
+assertEquals('"___\\udc86"', JSON.stringify('___\uDC86'));
+assertEquals('"___\\udc87"', JSON.stringify('___\uDC87'));
+assertEquals('"___\\udc88"', JSON.stringify('___\uDC88'));
+assertEquals('"___\\udc89"', JSON.stringify('___\uDC89'));
+assertEquals('"___\\udc8a"', JSON.stringify('___\uDC8A'));
+assertEquals('"___\\udc8b"', JSON.stringify('___\uDC8B'));
+assertEquals('"___\\udc8c"', JSON.stringify('___\uDC8C'));
+assertEquals('"___\\udc8d"', JSON.stringify('___\uDC8D'));
+assertEquals('"___\\udc8e"', JSON.stringify('___\uDC8E'));
+assertEquals('"___\\udc8f"', JSON.stringify('___\uDC8F'));
+assertEquals('"___\\udc90"', JSON.stringify('___\uDC90'));
+assertEquals('"___\\udc91"', JSON.stringify('___\uDC91'));
+assertEquals('"___\\udc92"', JSON.stringify('___\uDC92'));
+assertEquals('"___\\udc93"', JSON.stringify('___\uDC93'));
+assertEquals('"___\\udc94"', JSON.stringify('___\uDC94'));
+assertEquals('"___\\udc95"', JSON.stringify('___\uDC95'));
+assertEquals('"___\\udc96"', JSON.stringify('___\uDC96'));
+assertEquals('"___\\udc97"', JSON.stringify('___\uDC97'));
+assertEquals('"___\\udc98"', JSON.stringify('___\uDC98'));
+assertEquals('"___\\udc99"', JSON.stringify('___\uDC99'));
+assertEquals('"___\\udc9a"', JSON.stringify('___\uDC9A'));
+assertEquals('"___\\udc9b"', JSON.stringify('___\uDC9B'));
+assertEquals('"___\\udc9c"', JSON.stringify('___\uDC9C'));
+assertEquals('"___\\udc9d"', JSON.stringify('___\uDC9D'));
+assertEquals('"___\\udc9e"', JSON.stringify('___\uDC9E'));
+assertEquals('"___\\udc9f"', JSON.stringify('___\uDC9F'));
+assertEquals('"___\\udca0"', JSON.stringify('___\uDCA0'));
+assertEquals('"___\\udca1"', JSON.stringify('___\uDCA1'));
+assertEquals('"___\\udca2"', JSON.stringify('___\uDCA2'));
+assertEquals('"___\\udca3"', JSON.stringify('___\uDCA3'));
+assertEquals('"___\\udca4"', JSON.stringify('___\uDCA4'));
+assertEquals('"___\\udca5"', JSON.stringify('___\uDCA5'));
+assertEquals('"___\\udca6"', JSON.stringify('___\uDCA6'));
+assertEquals('"___\\udca7"', JSON.stringify('___\uDCA7'));
+assertEquals('"___\\udca8"', JSON.stringify('___\uDCA8'));
+assertEquals('"___\\udca9"', JSON.stringify('___\uDCA9'));
+assertEquals('"___\\udcaa"', JSON.stringify('___\uDCAA'));
+assertEquals('"___\\udcab"', JSON.stringify('___\uDCAB'));
+assertEquals('"___\\udcac"', JSON.stringify('___\uDCAC'));
+assertEquals('"___\\udcad"', JSON.stringify('___\uDCAD'));
+assertEquals('"___\\udcae"', JSON.stringify('___\uDCAE'));
+assertEquals('"___\\udcaf"', JSON.stringify('___\uDCAF'));
+assertEquals('"___\\udcb0"', JSON.stringify('___\uDCB0'));
+assertEquals('"___\\udcb1"', JSON.stringify('___\uDCB1'));
+assertEquals('"___\\udcb2"', JSON.stringify('___\uDCB2'));
+assertEquals('"___\\udcb3"', JSON.stringify('___\uDCB3'));
+assertEquals('"___\\udcb4"', JSON.stringify('___\uDCB4'));
+assertEquals('"___\\udcb5"', JSON.stringify('___\uDCB5'));
+assertEquals('"___\\udcb6"', JSON.stringify('___\uDCB6'));
+assertEquals('"___\\udcb7"', JSON.stringify('___\uDCB7'));
+assertEquals('"___\\udcb8"', JSON.stringify('___\uDCB8'));
+assertEquals('"___\\udcb9"', JSON.stringify('___\uDCB9'));
+assertEquals('"___\\udcba"', JSON.stringify('___\uDCBA'));
+assertEquals('"___\\udcbb"', JSON.stringify('___\uDCBB'));
+assertEquals('"___\\udcbc"', JSON.stringify('___\uDCBC'));
+assertEquals('"___\\udcbd"', JSON.stringify('___\uDCBD'));
+assertEquals('"___\\udcbe"', JSON.stringify('___\uDCBE'));
+assertEquals('"___\\udcbf"', JSON.stringify('___\uDCBF'));
+assertEquals('"___\\udcc0"', JSON.stringify('___\uDCC0'));
+assertEquals('"___\\udcc1"', JSON.stringify('___\uDCC1'));
+assertEquals('"___\\udcc2"', JSON.stringify('___\uDCC2'));
+assertEquals('"___\\udcc3"', JSON.stringify('___\uDCC3'));
+assertEquals('"___\\udcc4"', JSON.stringify('___\uDCC4'));
+assertEquals('"___\\udcc5"', JSON.stringify('___\uDCC5'));
+assertEquals('"___\\udcc6"', JSON.stringify('___\uDCC6'));
+assertEquals('"___\\udcc7"', JSON.stringify('___\uDCC7'));
+assertEquals('"___\\udcc8"', JSON.stringify('___\uDCC8'));
+assertEquals('"___\\udcc9"', JSON.stringify('___\uDCC9'));
+assertEquals('"___\\udcca"', JSON.stringify('___\uDCCA'));
+assertEquals('"___\\udccb"', JSON.stringify('___\uDCCB'));
+assertEquals('"___\\udccc"', JSON.stringify('___\uDCCC'));
+assertEquals('"___\\udccd"', JSON.stringify('___\uDCCD'));
+assertEquals('"___\\udcce"', JSON.stringify('___\uDCCE'));
+assertEquals('"___\\udccf"', JSON.stringify('___\uDCCF'));
+assertEquals('"___\\udcd0"', JSON.stringify('___\uDCD0'));
+assertEquals('"___\\udcd1"', JSON.stringify('___\uDCD1'));
+assertEquals('"___\\udcd2"', JSON.stringify('___\uDCD2'));
+assertEquals('"___\\udcd3"', JSON.stringify('___\uDCD3'));
+assertEquals('"___\\udcd4"', JSON.stringify('___\uDCD4'));
+assertEquals('"___\\udcd5"', JSON.stringify('___\uDCD5'));
+assertEquals('"___\\udcd6"', JSON.stringify('___\uDCD6'));
+assertEquals('"___\\udcd7"', JSON.stringify('___\uDCD7'));
+assertEquals('"___\\udcd8"', JSON.stringify('___\uDCD8'));
+assertEquals('"___\\udcd9"', JSON.stringify('___\uDCD9'));
+assertEquals('"___\\udcda"', JSON.stringify('___\uDCDA'));
+assertEquals('"___\\udcdb"', JSON.stringify('___\uDCDB'));
+assertEquals('"___\\udcdc"', JSON.stringify('___\uDCDC'));
+assertEquals('"___\\udcdd"', JSON.stringify('___\uDCDD'));
+assertEquals('"___\\udcde"', JSON.stringify('___\uDCDE'));
+assertEquals('"___\\udcdf"', JSON.stringify('___\uDCDF'));
+assertEquals('"___\\udce0"', JSON.stringify('___\uDCE0'));
+assertEquals('"___\\udce1"', JSON.stringify('___\uDCE1'));
+assertEquals('"___\\udce2"', JSON.stringify('___\uDCE2'));
+assertEquals('"___\\udce3"', JSON.stringify('___\uDCE3'));
+assertEquals('"___\\udce4"', JSON.stringify('___\uDCE4'));
+assertEquals('"___\\udce5"', JSON.stringify('___\uDCE5'));
+assertEquals('"___\\udce6"', JSON.stringify('___\uDCE6'));
+assertEquals('"___\\udce7"', JSON.stringify('___\uDCE7'));
+assertEquals('"___\\udce8"', JSON.stringify('___\uDCE8'));
+assertEquals('"___\\udce9"', JSON.stringify('___\uDCE9'));
+assertEquals('"___\\udcea"', JSON.stringify('___\uDCEA'));
+assertEquals('"___\\udceb"', JSON.stringify('___\uDCEB'));
+assertEquals('"___\\udcec"', JSON.stringify('___\uDCEC'));
+assertEquals('"___\\udced"', JSON.stringify('___\uDCED'));
+assertEquals('"___\\udcee"', JSON.stringify('___\uDCEE'));
+assertEquals('"___\\udcef"', JSON.stringify('___\uDCEF'));
+assertEquals('"___\\udcf0"', JSON.stringify('___\uDCF0'));
+assertEquals('"___\\udcf1"', JSON.stringify('___\uDCF1'));
+assertEquals('"___\\udcf2"', JSON.stringify('___\uDCF2'));
+assertEquals('"___\\udcf3"', JSON.stringify('___\uDCF3'));
+assertEquals('"___\\udcf4"', JSON.stringify('___\uDCF4'));
+assertEquals('"___\\udcf5"', JSON.stringify('___\uDCF5'));
+assertEquals('"___\\udcf6"', JSON.stringify('___\uDCF6'));
+assertEquals('"___\\udcf7"', JSON.stringify('___\uDCF7'));
+assertEquals('"___\\udcf8"', JSON.stringify('___\uDCF8'));
+assertEquals('"___\\udcf9"', JSON.stringify('___\uDCF9'));
+assertEquals('"___\\udcfa"', JSON.stringify('___\uDCFA'));
+assertEquals('"___\\udcfb"', JSON.stringify('___\uDCFB'));
+assertEquals('"___\\udcfc"', JSON.stringify('___\uDCFC'));
+assertEquals('"___\\udcfd"', JSON.stringify('___\uDCFD'));
+assertEquals('"___\\udcfe"', JSON.stringify('___\uDCFE'));
+assertEquals('"___\\udcff"', JSON.stringify('___\uDCFF'));
+assertEquals('"___\\udd00"', JSON.stringify('___\uDD00'));
+assertEquals('"___\\udd01"', JSON.stringify('___\uDD01'));
+assertEquals('"___\\udd02"', JSON.stringify('___\uDD02'));
+assertEquals('"___\\udd03"', JSON.stringify('___\uDD03'));
+assertEquals('"___\\udd04"', JSON.stringify('___\uDD04'));
+assertEquals('"___\\udd05"', JSON.stringify('___\uDD05'));
+assertEquals('"___\\udd06"', JSON.stringify('___\uDD06'));
+assertEquals('"___\\udd07"', JSON.stringify('___\uDD07'));
+assertEquals('"___\\udd08"', JSON.stringify('___\uDD08'));
+assertEquals('"___\\udd09"', JSON.stringify('___\uDD09'));
+assertEquals('"___\\udd0a"', JSON.stringify('___\uDD0A'));
+assertEquals('"___\\udd0b"', JSON.stringify('___\uDD0B'));
+assertEquals('"___\\udd0c"', JSON.stringify('___\uDD0C'));
+assertEquals('"___\\udd0d"', JSON.stringify('___\uDD0D'));
+assertEquals('"___\\udd0e"', JSON.stringify('___\uDD0E'));
+assertEquals('"___\\udd0f"', JSON.stringify('___\uDD0F'));
+assertEquals('"___\\udd10"', JSON.stringify('___\uDD10'));
+assertEquals('"___\\udd11"', JSON.stringify('___\uDD11'));
+assertEquals('"___\\udd12"', JSON.stringify('___\uDD12'));
+assertEquals('"___\\udd13"', JSON.stringify('___\uDD13'));
+assertEquals('"___\\udd14"', JSON.stringify('___\uDD14'));
+assertEquals('"___\\udd15"', JSON.stringify('___\uDD15'));
+assertEquals('"___\\udd16"', JSON.stringify('___\uDD16'));
+assertEquals('"___\\udd17"', JSON.stringify('___\uDD17'));
+assertEquals('"___\\udd18"', JSON.stringify('___\uDD18'));
+assertEquals('"___\\udd19"', JSON.stringify('___\uDD19'));
+assertEquals('"___\\udd1a"', JSON.stringify('___\uDD1A'));
+assertEquals('"___\\udd1b"', JSON.stringify('___\uDD1B'));
+assertEquals('"___\\udd1c"', JSON.stringify('___\uDD1C'));
+assertEquals('"___\\udd1d"', JSON.stringify('___\uDD1D'));
+assertEquals('"___\\udd1e"', JSON.stringify('___\uDD1E'));
+assertEquals('"___\\udd1f"', JSON.stringify('___\uDD1F'));
+assertEquals('"___\\udd20"', JSON.stringify('___\uDD20'));
+assertEquals('"___\\udd21"', JSON.stringify('___\uDD21'));
+assertEquals('"___\\udd22"', JSON.stringify('___\uDD22'));
+assertEquals('"___\\udd23"', JSON.stringify('___\uDD23'));
+assertEquals('"___\\udd24"', JSON.stringify('___\uDD24'));
+assertEquals('"___\\udd25"', JSON.stringify('___\uDD25'));
+assertEquals('"___\\udd26"', JSON.stringify('___\uDD26'));
+assertEquals('"___\\udd27"', JSON.stringify('___\uDD27'));
+assertEquals('"___\\udd28"', JSON.stringify('___\uDD28'));
+assertEquals('"___\\udd29"', JSON.stringify('___\uDD29'));
+assertEquals('"___\\udd2a"', JSON.stringify('___\uDD2A'));
+assertEquals('"___\\udd2b"', JSON.stringify('___\uDD2B'));
+assertEquals('"___\\udd2c"', JSON.stringify('___\uDD2C'));
+assertEquals('"___\\udd2d"', JSON.stringify('___\uDD2D'));
+assertEquals('"___\\udd2e"', JSON.stringify('___\uDD2E'));
+assertEquals('"___\\udd2f"', JSON.stringify('___\uDD2F'));
+assertEquals('"___\\udd30"', JSON.stringify('___\uDD30'));
+assertEquals('"___\\udd31"', JSON.stringify('___\uDD31'));
+assertEquals('"___\\udd32"', JSON.stringify('___\uDD32'));
+assertEquals('"___\\udd33"', JSON.stringify('___\uDD33'));
+assertEquals('"___\\udd34"', JSON.stringify('___\uDD34'));
+assertEquals('"___\\udd35"', JSON.stringify('___\uDD35'));
+assertEquals('"___\\udd36"', JSON.stringify('___\uDD36'));
+assertEquals('"___\\udd37"', JSON.stringify('___\uDD37'));
+assertEquals('"___\\udd38"', JSON.stringify('___\uDD38'));
+assertEquals('"___\\udd39"', JSON.stringify('___\uDD39'));
+assertEquals('"___\\udd3a"', JSON.stringify('___\uDD3A'));
+assertEquals('"___\\udd3b"', JSON.stringify('___\uDD3B'));
+assertEquals('"___\\udd3c"', JSON.stringify('___\uDD3C'));
+assertEquals('"___\\udd3d"', JSON.stringify('___\uDD3D'));
+assertEquals('"___\\udd3e"', JSON.stringify('___\uDD3E'));
+assertEquals('"___\\udd3f"', JSON.stringify('___\uDD3F'));
+assertEquals('"___\\udd40"', JSON.stringify('___\uDD40'));
+assertEquals('"___\\udd41"', JSON.stringify('___\uDD41'));
+assertEquals('"___\\udd42"', JSON.stringify('___\uDD42'));
+assertEquals('"___\\udd43"', JSON.stringify('___\uDD43'));
+assertEquals('"___\\udd44"', JSON.stringify('___\uDD44'));
+assertEquals('"___\\udd45"', JSON.stringify('___\uDD45'));
+assertEquals('"___\\udd46"', JSON.stringify('___\uDD46'));
+assertEquals('"___\\udd47"', JSON.stringify('___\uDD47'));
+assertEquals('"___\\udd48"', JSON.stringify('___\uDD48'));
+assertEquals('"___\\udd49"', JSON.stringify('___\uDD49'));
+assertEquals('"___\\udd4a"', JSON.stringify('___\uDD4A'));
+assertEquals('"___\\udd4b"', JSON.stringify('___\uDD4B'));
+assertEquals('"___\\udd4c"', JSON.stringify('___\uDD4C'));
+assertEquals('"___\\udd4d"', JSON.stringify('___\uDD4D'));
+assertEquals('"___\\udd4e"', JSON.stringify('___\uDD4E'));
+assertEquals('"___\\udd4f"', JSON.stringify('___\uDD4F'));
+assertEquals('"___\\udd50"', JSON.stringify('___\uDD50'));
+assertEquals('"___\\udd51"', JSON.stringify('___\uDD51'));
+assertEquals('"___\\udd52"', JSON.stringify('___\uDD52'));
+assertEquals('"___\\udd53"', JSON.stringify('___\uDD53'));
+assertEquals('"___\\udd54"', JSON.stringify('___\uDD54'));
+assertEquals('"___\\udd55"', JSON.stringify('___\uDD55'));
+assertEquals('"___\\udd56"', JSON.stringify('___\uDD56'));
+assertEquals('"___\\udd57"', JSON.stringify('___\uDD57'));
+assertEquals('"___\\udd58"', JSON.stringify('___\uDD58'));
+assertEquals('"___\\udd59"', JSON.stringify('___\uDD59'));
+assertEquals('"___\\udd5a"', JSON.stringify('___\uDD5A'));
+assertEquals('"___\\udd5b"', JSON.stringify('___\uDD5B'));
+assertEquals('"___\\udd5c"', JSON.stringify('___\uDD5C'));
+assertEquals('"___\\udd5d"', JSON.stringify('___\uDD5D'));
+assertEquals('"___\\udd5e"', JSON.stringify('___\uDD5E'));
+assertEquals('"___\\udd5f"', JSON.stringify('___\uDD5F'));
+assertEquals('"___\\udd60"', JSON.stringify('___\uDD60'));
+assertEquals('"___\\udd61"', JSON.stringify('___\uDD61'));
+assertEquals('"___\\udd62"', JSON.stringify('___\uDD62'));
+assertEquals('"___\\udd63"', JSON.stringify('___\uDD63'));
+assertEquals('"___\\udd64"', JSON.stringify('___\uDD64'));
+assertEquals('"___\\udd65"', JSON.stringify('___\uDD65'));
+assertEquals('"___\\udd66"', JSON.stringify('___\uDD66'));
+assertEquals('"___\\udd67"', JSON.stringify('___\uDD67'));
+assertEquals('"___\\udd68"', JSON.stringify('___\uDD68'));
+assertEquals('"___\\udd69"', JSON.stringify('___\uDD69'));
+assertEquals('"___\\udd6a"', JSON.stringify('___\uDD6A'));
+assertEquals('"___\\udd6b"', JSON.stringify('___\uDD6B'));
+assertEquals('"___\\udd6c"', JSON.stringify('___\uDD6C'));
+assertEquals('"___\\udd6d"', JSON.stringify('___\uDD6D'));
+assertEquals('"___\\udd6e"', JSON.stringify('___\uDD6E'));
+assertEquals('"___\\udd6f"', JSON.stringify('___\uDD6F'));
+assertEquals('"___\\udd70"', JSON.stringify('___\uDD70'));
+assertEquals('"___\\udd71"', JSON.stringify('___\uDD71'));
+assertEquals('"___\\udd72"', JSON.stringify('___\uDD72'));
+assertEquals('"___\\udd73"', JSON.stringify('___\uDD73'));
+assertEquals('"___\\udd74"', JSON.stringify('___\uDD74'));
+assertEquals('"___\\udd75"', JSON.stringify('___\uDD75'));
+assertEquals('"___\\udd76"', JSON.stringify('___\uDD76'));
+assertEquals('"___\\udd77"', JSON.stringify('___\uDD77'));
+assertEquals('"___\\udd78"', JSON.stringify('___\uDD78'));
+assertEquals('"___\\udd79"', JSON.stringify('___\uDD79'));
+assertEquals('"___\\udd7a"', JSON.stringify('___\uDD7A'));
+assertEquals('"___\\udd7b"', JSON.stringify('___\uDD7B'));
+assertEquals('"___\\udd7c"', JSON.stringify('___\uDD7C'));
+assertEquals('"___\\udd7d"', JSON.stringify('___\uDD7D'));
+assertEquals('"___\\udd7e"', JSON.stringify('___\uDD7E'));
+assertEquals('"___\\udd7f"', JSON.stringify('___\uDD7F'));
+assertEquals('"___\\udd80"', JSON.stringify('___\uDD80'));
+assertEquals('"___\\udd81"', JSON.stringify('___\uDD81'));
+assertEquals('"___\\udd82"', JSON.stringify('___\uDD82'));
+assertEquals('"___\\udd83"', JSON.stringify('___\uDD83'));
+assertEquals('"___\\udd84"', JSON.stringify('___\uDD84'));
+assertEquals('"___\\udd85"', JSON.stringify('___\uDD85'));
+assertEquals('"___\\udd86"', JSON.stringify('___\uDD86'));
+assertEquals('"___\\udd87"', JSON.stringify('___\uDD87'));
+assertEquals('"___\\udd88"', JSON.stringify('___\uDD88'));
+assertEquals('"___\\udd89"', JSON.stringify('___\uDD89'));
+assertEquals('"___\\udd8a"', JSON.stringify('___\uDD8A'));
+assertEquals('"___\\udd8b"', JSON.stringify('___\uDD8B'));
+assertEquals('"___\\udd8c"', JSON.stringify('___\uDD8C'));
+assertEquals('"___\\udd8d"', JSON.stringify('___\uDD8D'));
+assertEquals('"___\\udd8e"', JSON.stringify('___\uDD8E'));
+assertEquals('"___\\udd8f"', JSON.stringify('___\uDD8F'));
+assertEquals('"___\\udd90"', JSON.stringify('___\uDD90'));
+assertEquals('"___\\udd91"', JSON.stringify('___\uDD91'));
+assertEquals('"___\\udd92"', JSON.stringify('___\uDD92'));
+assertEquals('"___\\udd93"', JSON.stringify('___\uDD93'));
+assertEquals('"___\\udd94"', JSON.stringify('___\uDD94'));
+assertEquals('"___\\udd95"', JSON.stringify('___\uDD95'));
+assertEquals('"___\\udd96"', JSON.stringify('___\uDD96'));
+assertEquals('"___\\udd97"', JSON.stringify('___\uDD97'));
+assertEquals('"___\\udd98"', JSON.stringify('___\uDD98'));
+assertEquals('"___\\udd99"', JSON.stringify('___\uDD99'));
+assertEquals('"___\\udd9a"', JSON.stringify('___\uDD9A'));
+assertEquals('"___\\udd9b"', JSON.stringify('___\uDD9B'));
+assertEquals('"___\\udd9c"', JSON.stringify('___\uDD9C'));
+assertEquals('"___\\udd9d"', JSON.stringify('___\uDD9D'));
+assertEquals('"___\\udd9e"', JSON.stringify('___\uDD9E'));
+assertEquals('"___\\udd9f"', JSON.stringify('___\uDD9F'));
+assertEquals('"___\\udda0"', JSON.stringify('___\uDDA0'));
+assertEquals('"___\\udda1"', JSON.stringify('___\uDDA1'));
+assertEquals('"___\\udda2"', JSON.stringify('___\uDDA2'));
+assertEquals('"___\\udda3"', JSON.stringify('___\uDDA3'));
+assertEquals('"___\\udda4"', JSON.stringify('___\uDDA4'));
+assertEquals('"___\\udda5"', JSON.stringify('___\uDDA5'));
+assertEquals('"___\\udda6"', JSON.stringify('___\uDDA6'));
+assertEquals('"___\\udda7"', JSON.stringify('___\uDDA7'));
+assertEquals('"___\\udda8"', JSON.stringify('___\uDDA8'));
+assertEquals('"___\\udda9"', JSON.stringify('___\uDDA9'));
+assertEquals('"___\\uddaa"', JSON.stringify('___\uDDAA'));
+assertEquals('"___\\uddab"', JSON.stringify('___\uDDAB'));
+assertEquals('"___\\uddac"', JSON.stringify('___\uDDAC'));
+assertEquals('"___\\uddad"', JSON.stringify('___\uDDAD'));
+assertEquals('"___\\uddae"', JSON.stringify('___\uDDAE'));
+assertEquals('"___\\uddaf"', JSON.stringify('___\uDDAF'));
+assertEquals('"___\\uddb0"', JSON.stringify('___\uDDB0'));
+assertEquals('"___\\uddb1"', JSON.stringify('___\uDDB1'));
+assertEquals('"___\\uddb2"', JSON.stringify('___\uDDB2'));
+assertEquals('"___\\uddb3"', JSON.stringify('___\uDDB3'));
+assertEquals('"___\\uddb4"', JSON.stringify('___\uDDB4'));
+assertEquals('"___\\uddb5"', JSON.stringify('___\uDDB5'));
+assertEquals('"___\\uddb6"', JSON.stringify('___\uDDB6'));
+assertEquals('"___\\uddb7"', JSON.stringify('___\uDDB7'));
+assertEquals('"___\\uddb8"', JSON.stringify('___\uDDB8'));
+assertEquals('"___\\uddb9"', JSON.stringify('___\uDDB9'));
+assertEquals('"___\\uddba"', JSON.stringify('___\uDDBA'));
+assertEquals('"___\\uddbb"', JSON.stringify('___\uDDBB'));
+assertEquals('"___\\uddbc"', JSON.stringify('___\uDDBC'));
+assertEquals('"___\\uddbd"', JSON.stringify('___\uDDBD'));
+assertEquals('"___\\uddbe"', JSON.stringify('___\uDDBE'));
+assertEquals('"___\\uddbf"', JSON.stringify('___\uDDBF'));
+assertEquals('"___\\uddc0"', JSON.stringify('___\uDDC0'));
+assertEquals('"___\\uddc1"', JSON.stringify('___\uDDC1'));
+assertEquals('"___\\uddc2"', JSON.stringify('___\uDDC2'));
+assertEquals('"___\\uddc3"', JSON.stringify('___\uDDC3'));
+assertEquals('"___\\uddc4"', JSON.stringify('___\uDDC4'));
+assertEquals('"___\\uddc5"', JSON.stringify('___\uDDC5'));
+assertEquals('"___\\uddc6"', JSON.stringify('___\uDDC6'));
+assertEquals('"___\\uddc7"', JSON.stringify('___\uDDC7'));
+assertEquals('"___\\uddc8"', JSON.stringify('___\uDDC8'));
+assertEquals('"___\\uddc9"', JSON.stringify('___\uDDC9'));
+assertEquals('"___\\uddca"', JSON.stringify('___\uDDCA'));
+assertEquals('"___\\uddcb"', JSON.stringify('___\uDDCB'));
+assertEquals('"___\\uddcc"', JSON.stringify('___\uDDCC'));
+assertEquals('"___\\uddcd"', JSON.stringify('___\uDDCD'));
+assertEquals('"___\\uddce"', JSON.stringify('___\uDDCE'));
+assertEquals('"___\\uddcf"', JSON.stringify('___\uDDCF'));
+assertEquals('"___\\uddd0"', JSON.stringify('___\uDDD0'));
+assertEquals('"___\\uddd1"', JSON.stringify('___\uDDD1'));
+assertEquals('"___\\uddd2"', JSON.stringify('___\uDDD2'));
+assertEquals('"___\\uddd3"', JSON.stringify('___\uDDD3'));
+assertEquals('"___\\uddd4"', JSON.stringify('___\uDDD4'));
+assertEquals('"___\\uddd5"', JSON.stringify('___\uDDD5'));
+assertEquals('"___\\uddd6"', JSON.stringify('___\uDDD6'));
+assertEquals('"___\\uddd7"', JSON.stringify('___\uDDD7'));
+assertEquals('"___\\uddd8"', JSON.stringify('___\uDDD8'));
+assertEquals('"___\\uddd9"', JSON.stringify('___\uDDD9'));
+assertEquals('"___\\uddda"', JSON.stringify('___\uDDDA'));
+assertEquals('"___\\udddb"', JSON.stringify('___\uDDDB'));
+assertEquals('"___\\udddc"', JSON.stringify('___\uDDDC'));
+assertEquals('"___\\udddd"', JSON.stringify('___\uDDDD'));
+assertEquals('"___\\uddde"', JSON.stringify('___\uDDDE'));
+assertEquals('"___\\udddf"', JSON.stringify('___\uDDDF'));
+assertEquals('"___\\udde0"', JSON.stringify('___\uDDE0'));
+assertEquals('"___\\udde1"', JSON.stringify('___\uDDE1'));
+assertEquals('"___\\udde2"', JSON.stringify('___\uDDE2'));
+assertEquals('"___\\udde3"', JSON.stringify('___\uDDE3'));
+assertEquals('"___\\udde4"', JSON.stringify('___\uDDE4'));
+assertEquals('"___\\udde5"', JSON.stringify('___\uDDE5'));
+assertEquals('"___\\udde6"', JSON.stringify('___\uDDE6'));
+assertEquals('"___\\udde7"', JSON.stringify('___\uDDE7'));
+assertEquals('"___\\udde8"', JSON.stringify('___\uDDE8'));
+assertEquals('"___\\udde9"', JSON.stringify('___\uDDE9'));
+assertEquals('"___\\uddea"', JSON.stringify('___\uDDEA'));
+assertEquals('"___\\uddeb"', JSON.stringify('___\uDDEB'));
+assertEquals('"___\\uddec"', JSON.stringify('___\uDDEC'));
+assertEquals('"___\\udded"', JSON.stringify('___\uDDED'));
+assertEquals('"___\\uddee"', JSON.stringify('___\uDDEE'));
+assertEquals('"___\\uddef"', JSON.stringify('___\uDDEF'));
+assertEquals('"___\\uddf0"', JSON.stringify('___\uDDF0'));
+assertEquals('"___\\uddf1"', JSON.stringify('___\uDDF1'));
+assertEquals('"___\\uddf2"', JSON.stringify('___\uDDF2'));
+assertEquals('"___\\uddf3"', JSON.stringify('___\uDDF3'));
+assertEquals('"___\\uddf4"', JSON.stringify('___\uDDF4'));
+assertEquals('"___\\uddf5"', JSON.stringify('___\uDDF5'));
+assertEquals('"___\\uddf6"', JSON.stringify('___\uDDF6'));
+assertEquals('"___\\uddf7"', JSON.stringify('___\uDDF7'));
+assertEquals('"___\\uddf8"', JSON.stringify('___\uDDF8'));
+assertEquals('"___\\uddf9"', JSON.stringify('___\uDDF9'));
+assertEquals('"___\\uddfa"', JSON.stringify('___\uDDFA'));
+assertEquals('"___\\uddfb"', JSON.stringify('___\uDDFB'));
+assertEquals('"___\\uddfc"', JSON.stringify('___\uDDFC'));
+assertEquals('"___\\uddfd"', JSON.stringify('___\uDDFD'));
+assertEquals('"___\\uddfe"', JSON.stringify('___\uDDFE'));
+assertEquals('"___\\uddff"', JSON.stringify('___\uDDFF'));
+assertEquals('"___\\ude00"', JSON.stringify('___\uDE00'));
+assertEquals('"___\\ude01"', JSON.stringify('___\uDE01'));
+assertEquals('"___\\ude02"', JSON.stringify('___\uDE02'));
+assertEquals('"___\\ude03"', JSON.stringify('___\uDE03'));
+assertEquals('"___\\ude04"', JSON.stringify('___\uDE04'));
+assertEquals('"___\\ude05"', JSON.stringify('___\uDE05'));
+assertEquals('"___\\ude06"', JSON.stringify('___\uDE06'));
+assertEquals('"___\\ude07"', JSON.stringify('___\uDE07'));
+assertEquals('"___\\ude08"', JSON.stringify('___\uDE08'));
+assertEquals('"___\\ude09"', JSON.stringify('___\uDE09'));
+assertEquals('"___\\ude0a"', JSON.stringify('___\uDE0A'));
+assertEquals('"___\\ude0b"', JSON.stringify('___\uDE0B'));
+assertEquals('"___\\ude0c"', JSON.stringify('___\uDE0C'));
+assertEquals('"___\\ude0d"', JSON.stringify('___\uDE0D'));
+assertEquals('"___\\ude0e"', JSON.stringify('___\uDE0E'));
+assertEquals('"___\\ude0f"', JSON.stringify('___\uDE0F'));
+assertEquals('"___\\ude10"', JSON.stringify('___\uDE10'));
+assertEquals('"___\\ude11"', JSON.stringify('___\uDE11'));
+assertEquals('"___\\ude12"', JSON.stringify('___\uDE12'));
+assertEquals('"___\\ude13"', JSON.stringify('___\uDE13'));
+assertEquals('"___\\ude14"', JSON.stringify('___\uDE14'));
+assertEquals('"___\\ude15"', JSON.stringify('___\uDE15'));
+assertEquals('"___\\ude16"', JSON.stringify('___\uDE16'));
+assertEquals('"___\\ude17"', JSON.stringify('___\uDE17'));
+assertEquals('"___\\ude18"', JSON.stringify('___\uDE18'));
+assertEquals('"___\\ude19"', JSON.stringify('___\uDE19'));
+assertEquals('"___\\ude1a"', JSON.stringify('___\uDE1A'));
+assertEquals('"___\\ude1b"', JSON.stringify('___\uDE1B'));
+assertEquals('"___\\ude1c"', JSON.stringify('___\uDE1C'));
+assertEquals('"___\\ude1d"', JSON.stringify('___\uDE1D'));
+assertEquals('"___\\ude1e"', JSON.stringify('___\uDE1E'));
+assertEquals('"___\\ude1f"', JSON.stringify('___\uDE1F'));
+assertEquals('"___\\ude20"', JSON.stringify('___\uDE20'));
+assertEquals('"___\\ude21"', JSON.stringify('___\uDE21'));
+assertEquals('"___\\ude22"', JSON.stringify('___\uDE22'));
+assertEquals('"___\\ude23"', JSON.stringify('___\uDE23'));
+assertEquals('"___\\ude24"', JSON.stringify('___\uDE24'));
+assertEquals('"___\\ude25"', JSON.stringify('___\uDE25'));
+assertEquals('"___\\ude26"', JSON.stringify('___\uDE26'));
+assertEquals('"___\\ude27"', JSON.stringify('___\uDE27'));
+assertEquals('"___\\ude28"', JSON.stringify('___\uDE28'));
+assertEquals('"___\\ude29"', JSON.stringify('___\uDE29'));
+assertEquals('"___\\ude2a"', JSON.stringify('___\uDE2A'));
+assertEquals('"___\\ude2b"', JSON.stringify('___\uDE2B'));
+assertEquals('"___\\ude2c"', JSON.stringify('___\uDE2C'));
+assertEquals('"___\\ude2d"', JSON.stringify('___\uDE2D'));
+assertEquals('"___\\ude2e"', JSON.stringify('___\uDE2E'));
+assertEquals('"___\\ude2f"', JSON.stringify('___\uDE2F'));
+assertEquals('"___\\ude30"', JSON.stringify('___\uDE30'));
+assertEquals('"___\\ude31"', JSON.stringify('___\uDE31'));
+assertEquals('"___\\ude32"', JSON.stringify('___\uDE32'));
+assertEquals('"___\\ude33"', JSON.stringify('___\uDE33'));
+assertEquals('"___\\ude34"', JSON.stringify('___\uDE34'));
+assertEquals('"___\\ude35"', JSON.stringify('___\uDE35'));
+assertEquals('"___\\ude36"', JSON.stringify('___\uDE36'));
+assertEquals('"___\\ude37"', JSON.stringify('___\uDE37'));
+assertEquals('"___\\ude38"', JSON.stringify('___\uDE38'));
+assertEquals('"___\\ude39"', JSON.stringify('___\uDE39'));
+assertEquals('"___\\ude3a"', JSON.stringify('___\uDE3A'));
+assertEquals('"___\\ude3b"', JSON.stringify('___\uDE3B'));
+assertEquals('"___\\ude3c"', JSON.stringify('___\uDE3C'));
+assertEquals('"___\\ude3d"', JSON.stringify('___\uDE3D'));
+assertEquals('"___\\ude3e"', JSON.stringify('___\uDE3E'));
+assertEquals('"___\\ude3f"', JSON.stringify('___\uDE3F'));
+assertEquals('"___\\ude40"', JSON.stringify('___\uDE40'));
+assertEquals('"___\\ude41"', JSON.stringify('___\uDE41'));
+assertEquals('"___\\ude42"', JSON.stringify('___\uDE42'));
+assertEquals('"___\\ude43"', JSON.stringify('___\uDE43'));
+assertEquals('"___\\ude44"', JSON.stringify('___\uDE44'));
+assertEquals('"___\\ude45"', JSON.stringify('___\uDE45'));
+assertEquals('"___\\ude46"', JSON.stringify('___\uDE46'));
+assertEquals('"___\\ude47"', JSON.stringify('___\uDE47'));
+assertEquals('"___\\ude48"', JSON.stringify('___\uDE48'));
+assertEquals('"___\\ude49"', JSON.stringify('___\uDE49'));
+assertEquals('"___\\ude4a"', JSON.stringify('___\uDE4A'));
+assertEquals('"___\\ude4b"', JSON.stringify('___\uDE4B'));
+assertEquals('"___\\ude4c"', JSON.stringify('___\uDE4C'));
+assertEquals('"___\\ude4d"', JSON.stringify('___\uDE4D'));
+assertEquals('"___\\ude4e"', JSON.stringify('___\uDE4E'));
+assertEquals('"___\\ude4f"', JSON.stringify('___\uDE4F'));
+assertEquals('"___\\ude50"', JSON.stringify('___\uDE50'));
+assertEquals('"___\\ude51"', JSON.stringify('___\uDE51'));
+assertEquals('"___\\ude52"', JSON.stringify('___\uDE52'));
+assertEquals('"___\\ude53"', JSON.stringify('___\uDE53'));
+assertEquals('"___\\ude54"', JSON.stringify('___\uDE54'));
+assertEquals('"___\\ude55"', JSON.stringify('___\uDE55'));
+assertEquals('"___\\ude56"', JSON.stringify('___\uDE56'));
+assertEquals('"___\\ude57"', JSON.stringify('___\uDE57'));
+assertEquals('"___\\ude58"', JSON.stringify('___\uDE58'));
+assertEquals('"___\\ude59"', JSON.stringify('___\uDE59'));
+assertEquals('"___\\ude5a"', JSON.stringify('___\uDE5A'));
+assertEquals('"___\\ude5b"', JSON.stringify('___\uDE5B'));
+assertEquals('"___\\ude5c"', JSON.stringify('___\uDE5C'));
+assertEquals('"___\\ude5d"', JSON.stringify('___\uDE5D'));
+assertEquals('"___\\ude5e"', JSON.stringify('___\uDE5E'));
+assertEquals('"___\\ude5f"', JSON.stringify('___\uDE5F'));
+assertEquals('"___\\ude60"', JSON.stringify('___\uDE60'));
+assertEquals('"___\\ude61"', JSON.stringify('___\uDE61'));
+assertEquals('"___\\ude62"', JSON.stringify('___\uDE62'));
+assertEquals('"___\\ude63"', JSON.stringify('___\uDE63'));
+assertEquals('"___\\ude64"', JSON.stringify('___\uDE64'));
+assertEquals('"___\\ude65"', JSON.stringify('___\uDE65'));
+assertEquals('"___\\ude66"', JSON.stringify('___\uDE66'));
+assertEquals('"___\\ude67"', JSON.stringify('___\uDE67'));
+assertEquals('"___\\ude68"', JSON.stringify('___\uDE68'));
+assertEquals('"___\\ude69"', JSON.stringify('___\uDE69'));
+assertEquals('"___\\ude6a"', JSON.stringify('___\uDE6A'));
+assertEquals('"___\\ude6b"', JSON.stringify('___\uDE6B'));
+assertEquals('"___\\ude6c"', JSON.stringify('___\uDE6C'));
+assertEquals('"___\\ude6d"', JSON.stringify('___\uDE6D'));
+assertEquals('"___\\ude6e"', JSON.stringify('___\uDE6E'));
+assertEquals('"___\\ude6f"', JSON.stringify('___\uDE6F'));
+assertEquals('"___\\ude70"', JSON.stringify('___\uDE70'));
+assertEquals('"___\\ude71"', JSON.stringify('___\uDE71'));
+assertEquals('"___\\ude72"', JSON.stringify('___\uDE72'));
+assertEquals('"___\\ude73"', JSON.stringify('___\uDE73'));
+assertEquals('"___\\ude74"', JSON.stringify('___\uDE74'));
+assertEquals('"___\\ude75"', JSON.stringify('___\uDE75'));
+assertEquals('"___\\ude76"', JSON.stringify('___\uDE76'));
+assertEquals('"___\\ude77"', JSON.stringify('___\uDE77'));
+assertEquals('"___\\ude78"', JSON.stringify('___\uDE78'));
+assertEquals('"___\\ude79"', JSON.stringify('___\uDE79'));
+assertEquals('"___\\ude7a"', JSON.stringify('___\uDE7A'));
+assertEquals('"___\\ude7b"', JSON.stringify('___\uDE7B'));
+assertEquals('"___\\ude7c"', JSON.stringify('___\uDE7C'));
+assertEquals('"___\\ude7d"', JSON.stringify('___\uDE7D'));
+assertEquals('"___\\ude7e"', JSON.stringify('___\uDE7E'));
+assertEquals('"___\\ude7f"', JSON.stringify('___\uDE7F'));
+assertEquals('"___\\ude80"', JSON.stringify('___\uDE80'));
+assertEquals('"___\\ude81"', JSON.stringify('___\uDE81'));
+assertEquals('"___\\ude82"', JSON.stringify('___\uDE82'));
+assertEquals('"___\\ude83"', JSON.stringify('___\uDE83'));
+assertEquals('"___\\ude84"', JSON.stringify('___\uDE84'));
+assertEquals('"___\\ude85"', JSON.stringify('___\uDE85'));
+assertEquals('"___\\ude86"', JSON.stringify('___\uDE86'));
+assertEquals('"___\\ude87"', JSON.stringify('___\uDE87'));
+assertEquals('"___\\ude88"', JSON.stringify('___\uDE88'));
+assertEquals('"___\\ude89"', JSON.stringify('___\uDE89'));
+assertEquals('"___\\ude8a"', JSON.stringify('___\uDE8A'));
+assertEquals('"___\\ude8b"', JSON.stringify('___\uDE8B'));
+assertEquals('"___\\ude8c"', JSON.stringify('___\uDE8C'));
+assertEquals('"___\\ude8d"', JSON.stringify('___\uDE8D'));
+assertEquals('"___\\ude8e"', JSON.stringify('___\uDE8E'));
+assertEquals('"___\\ude8f"', JSON.stringify('___\uDE8F'));
+assertEquals('"___\\ude90"', JSON.stringify('___\uDE90'));
+assertEquals('"___\\ude91"', JSON.stringify('___\uDE91'));
+assertEquals('"___\\ude92"', JSON.stringify('___\uDE92'));
+assertEquals('"___\\ude93"', JSON.stringify('___\uDE93'));
+assertEquals('"___\\ude94"', JSON.stringify('___\uDE94'));
+assertEquals('"___\\ude95"', JSON.stringify('___\uDE95'));
+assertEquals('"___\\ude96"', JSON.stringify('___\uDE96'));
+assertEquals('"___\\ude97"', JSON.stringify('___\uDE97'));
+assertEquals('"___\\ude98"', JSON.stringify('___\uDE98'));
+assertEquals('"___\\ude99"', JSON.stringify('___\uDE99'));
+assertEquals('"___\\ude9a"', JSON.stringify('___\uDE9A'));
+assertEquals('"___\\ude9b"', JSON.stringify('___\uDE9B'));
+assertEquals('"___\\ude9c"', JSON.stringify('___\uDE9C'));
+assertEquals('"___\\ude9d"', JSON.stringify('___\uDE9D'));
+assertEquals('"___\\ude9e"', JSON.stringify('___\uDE9E'));
+assertEquals('"___\\ude9f"', JSON.stringify('___\uDE9F'));
+assertEquals('"___\\udea0"', JSON.stringify('___\uDEA0'));
+assertEquals('"___\\udea1"', JSON.stringify('___\uDEA1'));
+assertEquals('"___\\udea2"', JSON.stringify('___\uDEA2'));
+assertEquals('"___\\udea3"', JSON.stringify('___\uDEA3'));
+assertEquals('"___\\udea4"', JSON.stringify('___\uDEA4'));
+assertEquals('"___\\udea5"', JSON.stringify('___\uDEA5'));
+assertEquals('"___\\udea6"', JSON.stringify('___\uDEA6'));
+assertEquals('"___\\udea7"', JSON.stringify('___\uDEA7'));
+assertEquals('"___\\udea8"', JSON.stringify('___\uDEA8'));
+assertEquals('"___\\udea9"', JSON.stringify('___\uDEA9'));
+assertEquals('"___\\udeaa"', JSON.stringify('___\uDEAA'));
+assertEquals('"___\\udeab"', JSON.stringify('___\uDEAB'));
+assertEquals('"___\\udeac"', JSON.stringify('___\uDEAC'));
+assertEquals('"___\\udead"', JSON.stringify('___\uDEAD'));
+assertEquals('"___\\udeae"', JSON.stringify('___\uDEAE'));
+assertEquals('"___\\udeaf"', JSON.stringify('___\uDEAF'));
+assertEquals('"___\\udeb0"', JSON.stringify('___\uDEB0'));
+assertEquals('"___\\udeb1"', JSON.stringify('___\uDEB1'));
+assertEquals('"___\\udeb2"', JSON.stringify('___\uDEB2'));
+assertEquals('"___\\udeb3"', JSON.stringify('___\uDEB3'));
+assertEquals('"___\\udeb4"', JSON.stringify('___\uDEB4'));
+assertEquals('"___\\udeb5"', JSON.stringify('___\uDEB5'));
+assertEquals('"___\\udeb6"', JSON.stringify('___\uDEB6'));
+assertEquals('"___\\udeb7"', JSON.stringify('___\uDEB7'));
+assertEquals('"___\\udeb8"', JSON.stringify('___\uDEB8'));
+assertEquals('"___\\udeb9"', JSON.stringify('___\uDEB9'));
+assertEquals('"___\\udeba"', JSON.stringify('___\uDEBA'));
+assertEquals('"___\\udebb"', JSON.stringify('___\uDEBB'));
+assertEquals('"___\\udebc"', JSON.stringify('___\uDEBC'));
+assertEquals('"___\\udebd"', JSON.stringify('___\uDEBD'));
+assertEquals('"___\\udebe"', JSON.stringify('___\uDEBE'));
+assertEquals('"___\\udebf"', JSON.stringify('___\uDEBF'));
+assertEquals('"___\\udec0"', JSON.stringify('___\uDEC0'));
+assertEquals('"___\\udec1"', JSON.stringify('___\uDEC1'));
+assertEquals('"___\\udec2"', JSON.stringify('___\uDEC2'));
+assertEquals('"___\\udec3"', JSON.stringify('___\uDEC3'));
+assertEquals('"___\\udec4"', JSON.stringify('___\uDEC4'));
+assertEquals('"___\\udec5"', JSON.stringify('___\uDEC5'));
+assertEquals('"___\\udec6"', JSON.stringify('___\uDEC6'));
+assertEquals('"___\\udec7"', JSON.stringify('___\uDEC7'));
+assertEquals('"___\\udec8"', JSON.stringify('___\uDEC8'));
+assertEquals('"___\\udec9"', JSON.stringify('___\uDEC9'));
+assertEquals('"___\\udeca"', JSON.stringify('___\uDECA'));
+assertEquals('"___\\udecb"', JSON.stringify('___\uDECB'));
+assertEquals('"___\\udecc"', JSON.stringify('___\uDECC'));
+assertEquals('"___\\udecd"', JSON.stringify('___\uDECD'));
+assertEquals('"___\\udece"', JSON.stringify('___\uDECE'));
+assertEquals('"___\\udecf"', JSON.stringify('___\uDECF'));
+assertEquals('"___\\uded0"', JSON.stringify('___\uDED0'));
+assertEquals('"___\\uded1"', JSON.stringify('___\uDED1'));
+assertEquals('"___\\uded2"', JSON.stringify('___\uDED2'));
+assertEquals('"___\\uded3"', JSON.stringify('___\uDED3'));
+assertEquals('"___\\uded4"', JSON.stringify('___\uDED4'));
+assertEquals('"___\\uded5"', JSON.stringify('___\uDED5'));
+assertEquals('"___\\uded6"', JSON.stringify('___\uDED6'));
+assertEquals('"___\\uded7"', JSON.stringify('___\uDED7'));
+assertEquals('"___\\uded8"', JSON.stringify('___\uDED8'));
+assertEquals('"___\\uded9"', JSON.stringify('___\uDED9'));
+assertEquals('"___\\udeda"', JSON.stringify('___\uDEDA'));
+assertEquals('"___\\udedb"', JSON.stringify('___\uDEDB'));
+assertEquals('"___\\udedc"', JSON.stringify('___\uDEDC'));
+assertEquals('"___\\udedd"', JSON.stringify('___\uDEDD'));
+assertEquals('"___\\udede"', JSON.stringify('___\uDEDE'));
+assertEquals('"___\\udedf"', JSON.stringify('___\uDEDF'));
+assertEquals('"___\\udee0"', JSON.stringify('___\uDEE0'));
+assertEquals('"___\\udee1"', JSON.stringify('___\uDEE1'));
+assertEquals('"___\\udee2"', JSON.stringify('___\uDEE2'));
+assertEquals('"___\\udee3"', JSON.stringify('___\uDEE3'));
+assertEquals('"___\\udee4"', JSON.stringify('___\uDEE4'));
+assertEquals('"___\\udee5"', JSON.stringify('___\uDEE5'));
+assertEquals('"___\\udee6"', JSON.stringify('___\uDEE6'));
+assertEquals('"___\\udee7"', JSON.stringify('___\uDEE7'));
+assertEquals('"___\\udee8"', JSON.stringify('___\uDEE8'));
+assertEquals('"___\\udee9"', JSON.stringify('___\uDEE9'));
+assertEquals('"___\\udeea"', JSON.stringify('___\uDEEA'));
+assertEquals('"___\\udeeb"', JSON.stringify('___\uDEEB'));
+assertEquals('"___\\udeec"', JSON.stringify('___\uDEEC'));
+assertEquals('"___\\udeed"', JSON.stringify('___\uDEED'));
+assertEquals('"___\\udeee"', JSON.stringify('___\uDEEE'));
+assertEquals('"___\\udeef"', JSON.stringify('___\uDEEF'));
+assertEquals('"___\\udef0"', JSON.stringify('___\uDEF0'));
+assertEquals('"___\\udef1"', JSON.stringify('___\uDEF1'));
+assertEquals('"___\\udef2"', JSON.stringify('___\uDEF2'));
+assertEquals('"___\\udef3"', JSON.stringify('___\uDEF3'));
+assertEquals('"___\\udef4"', JSON.stringify('___\uDEF4'));
+assertEquals('"___\\udef5"', JSON.stringify('___\uDEF5'));
+assertEquals('"___\\udef6"', JSON.stringify('___\uDEF6'));
+assertEquals('"___\\udef7"', JSON.stringify('___\uDEF7'));
+assertEquals('"___\\udef8"', JSON.stringify('___\uDEF8'));
+assertEquals('"___\\udef9"', JSON.stringify('___\uDEF9'));
+assertEquals('"___\\udefa"', JSON.stringify('___\uDEFA'));
+assertEquals('"___\\udefb"', JSON.stringify('___\uDEFB'));
+assertEquals('"___\\udefc"', JSON.stringify('___\uDEFC'));
+assertEquals('"___\\udefd"', JSON.stringify('___\uDEFD'));
+assertEquals('"___\\udefe"', JSON.stringify('___\uDEFE'));
+assertEquals('"___\\udeff"', JSON.stringify('___\uDEFF'));
+assertEquals('"___\\udf00"', JSON.stringify('___\uDF00'));
+assertEquals('"___\\udf01"', JSON.stringify('___\uDF01'));
+assertEquals('"___\\udf02"', JSON.stringify('___\uDF02'));
+assertEquals('"___\\udf03"', JSON.stringify('___\uDF03'));
+assertEquals('"___\\udf04"', JSON.stringify('___\uDF04'));
+assertEquals('"___\\udf05"', JSON.stringify('___\uDF05'));
+assertEquals('"___\\udf06"', JSON.stringify('___\uDF06'));
+assertEquals('"___\\udf07"', JSON.stringify('___\uDF07'));
+assertEquals('"___\\udf08"', JSON.stringify('___\uDF08'));
+assertEquals('"___\\udf09"', JSON.stringify('___\uDF09'));
+assertEquals('"___\\udf0a"', JSON.stringify('___\uDF0A'));
+assertEquals('"___\\udf0b"', JSON.stringify('___\uDF0B'));
+assertEquals('"___\\udf0c"', JSON.stringify('___\uDF0C'));
+assertEquals('"___\\udf0d"', JSON.stringify('___\uDF0D'));
+assertEquals('"___\\udf0e"', JSON.stringify('___\uDF0E'));
+assertEquals('"___\\udf0f"', JSON.stringify('___\uDF0F'));
+assertEquals('"___\\udf10"', JSON.stringify('___\uDF10'));
+assertEquals('"___\\udf11"', JSON.stringify('___\uDF11'));
+assertEquals('"___\\udf12"', JSON.stringify('___\uDF12'));
+assertEquals('"___\\udf13"', JSON.stringify('___\uDF13'));
+assertEquals('"___\\udf14"', JSON.stringify('___\uDF14'));
+assertEquals('"___\\udf15"', JSON.stringify('___\uDF15'));
+assertEquals('"___\\udf16"', JSON.stringify('___\uDF16'));
+assertEquals('"___\\udf17"', JSON.stringify('___\uDF17'));
+assertEquals('"___\\udf18"', JSON.stringify('___\uDF18'));
+assertEquals('"___\\udf19"', JSON.stringify('___\uDF19'));
+assertEquals('"___\\udf1a"', JSON.stringify('___\uDF1A'));
+assertEquals('"___\\udf1b"', JSON.stringify('___\uDF1B'));
+assertEquals('"___\\udf1c"', JSON.stringify('___\uDF1C'));
+assertEquals('"___\\udf1d"', JSON.stringify('___\uDF1D'));
+assertEquals('"___\\udf1e"', JSON.stringify('___\uDF1E'));
+assertEquals('"___\\udf1f"', JSON.stringify('___\uDF1F'));
+assertEquals('"___\\udf20"', JSON.stringify('___\uDF20'));
+assertEquals('"___\\udf21"', JSON.stringify('___\uDF21'));
+assertEquals('"___\\udf22"', JSON.stringify('___\uDF22'));
+assertEquals('"___\\udf23"', JSON.stringify('___\uDF23'));
+assertEquals('"___\\udf24"', JSON.stringify('___\uDF24'));
+assertEquals('"___\\udf25"', JSON.stringify('___\uDF25'));
+assertEquals('"___\\udf26"', JSON.stringify('___\uDF26'));
+assertEquals('"___\\udf27"', JSON.stringify('___\uDF27'));
+assertEquals('"___\\udf28"', JSON.stringify('___\uDF28'));
+assertEquals('"___\\udf29"', JSON.stringify('___\uDF29'));
+assertEquals('"___\\udf2a"', JSON.stringify('___\uDF2A'));
+assertEquals('"___\\udf2b"', JSON.stringify('___\uDF2B'));
+assertEquals('"___\\udf2c"', JSON.stringify('___\uDF2C'));
+assertEquals('"___\\udf2d"', JSON.stringify('___\uDF2D'));
+assertEquals('"___\\udf2e"', JSON.stringify('___\uDF2E'));
+assertEquals('"___\\udf2f"', JSON.stringify('___\uDF2F'));
+assertEquals('"___\\udf30"', JSON.stringify('___\uDF30'));
+assertEquals('"___\\udf31"', JSON.stringify('___\uDF31'));
+assertEquals('"___\\udf32"', JSON.stringify('___\uDF32'));
+assertEquals('"___\\udf33"', JSON.stringify('___\uDF33'));
+assertEquals('"___\\udf34"', JSON.stringify('___\uDF34'));
+assertEquals('"___\\udf35"', JSON.stringify('___\uDF35'));
+assertEquals('"___\\udf36"', JSON.stringify('___\uDF36'));
+assertEquals('"___\\udf37"', JSON.stringify('___\uDF37'));
+assertEquals('"___\\udf38"', JSON.stringify('___\uDF38'));
+assertEquals('"___\\udf39"', JSON.stringify('___\uDF39'));
+assertEquals('"___\\udf3a"', JSON.stringify('___\uDF3A'));
+assertEquals('"___\\udf3b"', JSON.stringify('___\uDF3B'));
+assertEquals('"___\\udf3c"', JSON.stringify('___\uDF3C'));
+assertEquals('"___\\udf3d"', JSON.stringify('___\uDF3D'));
+assertEquals('"___\\udf3e"', JSON.stringify('___\uDF3E'));
+assertEquals('"___\\udf3f"', JSON.stringify('___\uDF3F'));
+assertEquals('"___\\udf40"', JSON.stringify('___\uDF40'));
+assertEquals('"___\\udf41"', JSON.stringify('___\uDF41'));
+assertEquals('"___\\udf42"', JSON.stringify('___\uDF42'));
+assertEquals('"___\\udf43"', JSON.stringify('___\uDF43'));
+assertEquals('"___\\udf44"', JSON.stringify('___\uDF44'));
+assertEquals('"___\\udf45"', JSON.stringify('___\uDF45'));
+assertEquals('"___\\udf46"', JSON.stringify('___\uDF46'));
+assertEquals('"___\\udf47"', JSON.stringify('___\uDF47'));
+assertEquals('"___\\udf48"', JSON.stringify('___\uDF48'));
+assertEquals('"___\\udf49"', JSON.stringify('___\uDF49'));
+assertEquals('"___\\udf4a"', JSON.stringify('___\uDF4A'));
+assertEquals('"___\\udf4b"', JSON.stringify('___\uDF4B'));
+assertEquals('"___\\udf4c"', JSON.stringify('___\uDF4C'));
+assertEquals('"___\\udf4d"', JSON.stringify('___\uDF4D'));
+assertEquals('"___\\udf4e"', JSON.stringify('___\uDF4E'));
+assertEquals('"___\\udf4f"', JSON.stringify('___\uDF4F'));
+assertEquals('"___\\udf50"', JSON.stringify('___\uDF50'));
+assertEquals('"___\\udf51"', JSON.stringify('___\uDF51'));
+assertEquals('"___\\udf52"', JSON.stringify('___\uDF52'));
+assertEquals('"___\\udf53"', JSON.stringify('___\uDF53'));
+assertEquals('"___\\udf54"', JSON.stringify('___\uDF54'));
+assertEquals('"___\\udf55"', JSON.stringify('___\uDF55'));
+assertEquals('"___\\udf56"', JSON.stringify('___\uDF56'));
+assertEquals('"___\\udf57"', JSON.stringify('___\uDF57'));
+assertEquals('"___\\udf58"', JSON.stringify('___\uDF58'));
+assertEquals('"___\\udf59"', JSON.stringify('___\uDF59'));
+assertEquals('"___\\udf5a"', JSON.stringify('___\uDF5A'));
+assertEquals('"___\\udf5b"', JSON.stringify('___\uDF5B'));
+assertEquals('"___\\udf5c"', JSON.stringify('___\uDF5C'));
+assertEquals('"___\\udf5d"', JSON.stringify('___\uDF5D'));
+assertEquals('"___\\udf5e"', JSON.stringify('___\uDF5E'));
+assertEquals('"___\\udf5f"', JSON.stringify('___\uDF5F'));
+assertEquals('"___\\udf60"', JSON.stringify('___\uDF60'));
+assertEquals('"___\\udf61"', JSON.stringify('___\uDF61'));
+assertEquals('"___\\udf62"', JSON.stringify('___\uDF62'));
+assertEquals('"___\\udf63"', JSON.stringify('___\uDF63'));
+assertEquals('"___\\udf64"', JSON.stringify('___\uDF64'));
+assertEquals('"___\\udf65"', JSON.stringify('___\uDF65'));
+assertEquals('"___\\udf66"', JSON.stringify('___\uDF66'));
+assertEquals('"___\\udf67"', JSON.stringify('___\uDF67'));
+assertEquals('"___\\udf68"', JSON.stringify('___\uDF68'));
+assertEquals('"___\\udf69"', JSON.stringify('___\uDF69'));
+assertEquals('"___\\udf6a"', JSON.stringify('___\uDF6A'));
+assertEquals('"___\\udf6b"', JSON.stringify('___\uDF6B'));
+assertEquals('"___\\udf6c"', JSON.stringify('___\uDF6C'));
+assertEquals('"___\\udf6d"', JSON.stringify('___\uDF6D'));
+assertEquals('"___\\udf6e"', JSON.stringify('___\uDF6E'));
+assertEquals('"___\\udf6f"', JSON.stringify('___\uDF6F'));
+assertEquals('"___\\udf70"', JSON.stringify('___\uDF70'));
+assertEquals('"___\\udf71"', JSON.stringify('___\uDF71'));
+assertEquals('"___\\udf72"', JSON.stringify('___\uDF72'));
+assertEquals('"___\\udf73"', JSON.stringify('___\uDF73'));
+assertEquals('"___\\udf74"', JSON.stringify('___\uDF74'));
+assertEquals('"___\\udf75"', JSON.stringify('___\uDF75'));
+assertEquals('"___\\udf76"', JSON.stringify('___\uDF76'));
+assertEquals('"___\\udf77"', JSON.stringify('___\uDF77'));
+assertEquals('"___\\udf78"', JSON.stringify('___\uDF78'));
+assertEquals('"___\\udf79"', JSON.stringify('___\uDF79'));
+assertEquals('"___\\udf7a"', JSON.stringify('___\uDF7A'));
+assertEquals('"___\\udf7b"', JSON.stringify('___\uDF7B'));
+assertEquals('"___\\udf7c"', JSON.stringify('___\uDF7C'));
+assertEquals('"___\\udf7d"', JSON.stringify('___\uDF7D'));
+assertEquals('"___\\udf7e"', JSON.stringify('___\uDF7E'));
+assertEquals('"___\\udf7f"', JSON.stringify('___\uDF7F'));
+assertEquals('"___\\udf80"', JSON.stringify('___\uDF80'));
+assertEquals('"___\\udf81"', JSON.stringify('___\uDF81'));
+assertEquals('"___\\udf82"', JSON.stringify('___\uDF82'));
+assertEquals('"___\\udf83"', JSON.stringify('___\uDF83'));
+assertEquals('"___\\udf84"', JSON.stringify('___\uDF84'));
+assertEquals('"___\\udf85"', JSON.stringify('___\uDF85'));
+assertEquals('"___\\udf86"', JSON.stringify('___\uDF86'));
+assertEquals('"___\\udf87"', JSON.stringify('___\uDF87'));
+assertEquals('"___\\udf88"', JSON.stringify('___\uDF88'));
+assertEquals('"___\\udf89"', JSON.stringify('___\uDF89'));
+assertEquals('"___\\udf8a"', JSON.stringify('___\uDF8A'));
+assertEquals('"___\\udf8b"', JSON.stringify('___\uDF8B'));
+assertEquals('"___\\udf8c"', JSON.stringify('___\uDF8C'));
+assertEquals('"___\\udf8d"', JSON.stringify('___\uDF8D'));
+assertEquals('"___\\udf8e"', JSON.stringify('___\uDF8E'));
+assertEquals('"___\\udf8f"', JSON.stringify('___\uDF8F'));
+assertEquals('"___\\udf90"', JSON.stringify('___\uDF90'));
+assertEquals('"___\\udf91"', JSON.stringify('___\uDF91'));
+assertEquals('"___\\udf92"', JSON.stringify('___\uDF92'));
+assertEquals('"___\\udf93"', JSON.stringify('___\uDF93'));
+assertEquals('"___\\udf94"', JSON.stringify('___\uDF94'));
+assertEquals('"___\\udf95"', JSON.stringify('___\uDF95'));
+assertEquals('"___\\udf96"', JSON.stringify('___\uDF96'));
+assertEquals('"___\\udf97"', JSON.stringify('___\uDF97'));
+assertEquals('"___\\udf98"', JSON.stringify('___\uDF98'));
+assertEquals('"___\\udf99"', JSON.stringify('___\uDF99'));
+assertEquals('"___\\udf9a"', JSON.stringify('___\uDF9A'));
+assertEquals('"___\\udf9b"', JSON.stringify('___\uDF9B'));
+assertEquals('"___\\udf9c"', JSON.stringify('___\uDF9C'));
+assertEquals('"___\\udf9d"', JSON.stringify('___\uDF9D'));
+assertEquals('"___\\udf9e"', JSON.stringify('___\uDF9E'));
+assertEquals('"___\\udf9f"', JSON.stringify('___\uDF9F'));
+assertEquals('"___\\udfa0"', JSON.stringify('___\uDFA0'));
+assertEquals('"___\\udfa1"', JSON.stringify('___\uDFA1'));
+assertEquals('"___\\udfa2"', JSON.stringify('___\uDFA2'));
+assertEquals('"___\\udfa3"', JSON.stringify('___\uDFA3'));
+assertEquals('"___\\udfa4"', JSON.stringify('___\uDFA4'));
+assertEquals('"___\\udfa5"', JSON.stringify('___\uDFA5'));
+assertEquals('"___\\udfa6"', JSON.stringify('___\uDFA6'));
+assertEquals('"___\\udfa7"', JSON.stringify('___\uDFA7'));
+assertEquals('"___\\udfa8"', JSON.stringify('___\uDFA8'));
+assertEquals('"___\\udfa9"', JSON.stringify('___\uDFA9'));
+assertEquals('"___\\udfaa"', JSON.stringify('___\uDFAA'));
+assertEquals('"___\\udfab"', JSON.stringify('___\uDFAB'));
+assertEquals('"___\\udfac"', JSON.stringify('___\uDFAC'));
+assertEquals('"___\\udfad"', JSON.stringify('___\uDFAD'));
+assertEquals('"___\\udfae"', JSON.stringify('___\uDFAE'));
+assertEquals('"___\\udfaf"', JSON.stringify('___\uDFAF'));
+assertEquals('"___\\udfb0"', JSON.stringify('___\uDFB0'));
+assertEquals('"___\\udfb1"', JSON.stringify('___\uDFB1'));
+assertEquals('"___\\udfb2"', JSON.stringify('___\uDFB2'));
+assertEquals('"___\\udfb3"', JSON.stringify('___\uDFB3'));
+assertEquals('"___\\udfb4"', JSON.stringify('___\uDFB4'));
+assertEquals('"___\\udfb5"', JSON.stringify('___\uDFB5'));
+assertEquals('"___\\udfb6"', JSON.stringify('___\uDFB6'));
+assertEquals('"___\\udfb7"', JSON.stringify('___\uDFB7'));
+assertEquals('"___\\udfb8"', JSON.stringify('___\uDFB8'));
+assertEquals('"___\\udfb9"', JSON.stringify('___\uDFB9'));
+assertEquals('"___\\udfba"', JSON.stringify('___\uDFBA'));
+assertEquals('"___\\udfbb"', JSON.stringify('___\uDFBB'));
+assertEquals('"___\\udfbc"', JSON.stringify('___\uDFBC'));
+assertEquals('"___\\udfbd"', JSON.stringify('___\uDFBD'));
+assertEquals('"___\\udfbe"', JSON.stringify('___\uDFBE'));
+assertEquals('"___\\udfbf"', JSON.stringify('___\uDFBF'));
+assertEquals('"___\\udfc0"', JSON.stringify('___\uDFC0'));
+assertEquals('"___\\udfc1"', JSON.stringify('___\uDFC1'));
+assertEquals('"___\\udfc2"', JSON.stringify('___\uDFC2'));
+assertEquals('"___\\udfc3"', JSON.stringify('___\uDFC3'));
+assertEquals('"___\\udfc4"', JSON.stringify('___\uDFC4'));
+assertEquals('"___\\udfc5"', JSON.stringify('___\uDFC5'));
+assertEquals('"___\\udfc6"', JSON.stringify('___\uDFC6'));
+assertEquals('"___\\udfc7"', JSON.stringify('___\uDFC7'));
+assertEquals('"___\\udfc8"', JSON.stringify('___\uDFC8'));
+assertEquals('"___\\udfc9"', JSON.stringify('___\uDFC9'));
+assertEquals('"___\\udfca"', JSON.stringify('___\uDFCA'));
+assertEquals('"___\\udfcb"', JSON.stringify('___\uDFCB'));
+assertEquals('"___\\udfcc"', JSON.stringify('___\uDFCC'));
+assertEquals('"___\\udfcd"', JSON.stringify('___\uDFCD'));
+assertEquals('"___\\udfce"', JSON.stringify('___\uDFCE'));
+assertEquals('"___\\udfcf"', JSON.stringify('___\uDFCF'));
+assertEquals('"___\\udfd0"', JSON.stringify('___\uDFD0'));
+assertEquals('"___\\udfd1"', JSON.stringify('___\uDFD1'));
+assertEquals('"___\\udfd2"', JSON.stringify('___\uDFD2'));
+assertEquals('"___\\udfd3"', JSON.stringify('___\uDFD3'));
+assertEquals('"___\\udfd4"', JSON.stringify('___\uDFD4'));
+assertEquals('"___\\udfd5"', JSON.stringify('___\uDFD5'));
+assertEquals('"___\\udfd6"', JSON.stringify('___\uDFD6'));
+assertEquals('"___\\udfd7"', JSON.stringify('___\uDFD7'));
+assertEquals('"___\\udfd8"', JSON.stringify('___\uDFD8'));
+assertEquals('"___\\udfd9"', JSON.stringify('___\uDFD9'));
+assertEquals('"___\\udfda"', JSON.stringify('___\uDFDA'));
+assertEquals('"___\\udfdb"', JSON.stringify('___\uDFDB'));
+assertEquals('"___\\udfdc"', JSON.stringify('___\uDFDC'));
+assertEquals('"___\\udfdd"', JSON.stringify('___\uDFDD'));
+assertEquals('"___\\udfde"', JSON.stringify('___\uDFDE'));
+assertEquals('"___\\udfdf"', JSON.stringify('___\uDFDF'));
+assertEquals('"___\\udfe0"', JSON.stringify('___\uDFE0'));
+assertEquals('"___\\udfe1"', JSON.stringify('___\uDFE1'));
+assertEquals('"___\\udfe2"', JSON.stringify('___\uDFE2'));
+assertEquals('"___\\udfe3"', JSON.stringify('___\uDFE3'));
+assertEquals('"___\\udfe4"', JSON.stringify('___\uDFE4'));
+assertEquals('"___\\udfe5"', JSON.stringify('___\uDFE5'));
+assertEquals('"___\\udfe6"', JSON.stringify('___\uDFE6'));
+assertEquals('"___\\udfe7"', JSON.stringify('___\uDFE7'));
+assertEquals('"___\\udfe8"', JSON.stringify('___\uDFE8'));
+assertEquals('"___\\udfe9"', JSON.stringify('___\uDFE9'));
+assertEquals('"___\\udfea"', JSON.stringify('___\uDFEA'));
+assertEquals('"___\\udfeb"', JSON.stringify('___\uDFEB'));
+assertEquals('"___\\udfec"', JSON.stringify('___\uDFEC'));
+assertEquals('"___\\udfed"', JSON.stringify('___\uDFED'));
+assertEquals('"___\\udfee"', JSON.stringify('___\uDFEE'));
+assertEquals('"___\\udfef"', JSON.stringify('___\uDFEF'));
+assertEquals('"___\\udff0"', JSON.stringify('___\uDFF0'));
+assertEquals('"___\\udff1"', JSON.stringify('___\uDFF1'));
+assertEquals('"___\\udff2"', JSON.stringify('___\uDFF2'));
+assertEquals('"___\\udff3"', JSON.stringify('___\uDFF3'));
+assertEquals('"___\\udff4"', JSON.stringify('___\uDFF4'));
+assertEquals('"___\\udff5"', JSON.stringify('___\uDFF5'));
+assertEquals('"___\\udff6"', JSON.stringify('___\uDFF6'));
+assertEquals('"___\\udff7"', JSON.stringify('___\uDFF7'));
+assertEquals('"___\\udff8"', JSON.stringify('___\uDFF8'));
+assertEquals('"___\\udff9"', JSON.stringify('___\uDFF9'));
+assertEquals('"___\\udffa"', JSON.stringify('___\uDFFA'));
+assertEquals('"___\\udffb"', JSON.stringify('___\uDFFB'));
+assertEquals('"___\\udffc"', JSON.stringify('___\uDFFC'));
+assertEquals('"___\\udffd"', JSON.stringify('___\uDFFD'));
+assertEquals('"___\\udffe"', JSON.stringify('___\uDFFE'));
+assertEquals('"___\\udfff"', JSON.stringify('___\uDFFF'));
+
+// A random selection of code points from U+E000 to U+FFFF.
+assertEquals('"___\uE000"', JSON.stringify('___\uE000'));
+assertEquals('"___\uE00B"', JSON.stringify('___\uE00B'));
+assertEquals('"___\uE0CC"', JSON.stringify('___\uE0CC'));
+assertEquals('"___\uE0FD"', JSON.stringify('___\uE0FD'));
+assertEquals('"___\uE19E"', JSON.stringify('___\uE19E'));
+assertEquals('"___\uE1B1"', JSON.stringify('___\uE1B1'));
+assertEquals('"___\uE24F"', JSON.stringify('___\uE24F'));
+assertEquals('"___\uE262"', JSON.stringify('___\uE262'));
+assertEquals('"___\uE2C9"', JSON.stringify('___\uE2C9'));
+assertEquals('"___\uE2DF"', JSON.stringify('___\uE2DF'));
+assertEquals('"___\uE389"', JSON.stringify('___\uE389'));
+assertEquals('"___\uE413"', JSON.stringify('___\uE413'));
+assertEquals('"___\uE546"', JSON.stringify('___\uE546'));
+assertEquals('"___\uE5E4"', JSON.stringify('___\uE5E4'));
+assertEquals('"___\uE66B"', JSON.stringify('___\uE66B'));
+assertEquals('"___\uE73D"', JSON.stringify('___\uE73D'));
+assertEquals('"___\uE74F"', JSON.stringify('___\uE74F'));
+assertEquals('"___\uE759"', JSON.stringify('___\uE759'));
+assertEquals('"___\uE795"', JSON.stringify('___\uE795'));
+assertEquals('"___\uE836"', JSON.stringify('___\uE836'));
+assertEquals('"___\uE85D"', JSON.stringify('___\uE85D'));
+assertEquals('"___\uE909"', JSON.stringify('___\uE909'));
+assertEquals('"___\uE990"', JSON.stringify('___\uE990'));
+assertEquals('"___\uE99F"', JSON.stringify('___\uE99F'));
+assertEquals('"___\uE9AC"', JSON.stringify('___\uE9AC'));
+assertEquals('"___\uE9C2"', JSON.stringify('___\uE9C2'));
+assertEquals('"___\uEB11"', JSON.stringify('___\uEB11'));
+assertEquals('"___\uED33"', JSON.stringify('___\uED33'));
+assertEquals('"___\uED7D"', JSON.stringify('___\uED7D'));
+assertEquals('"___\uEDA9"', JSON.stringify('___\uEDA9'));
+assertEquals('"___\uEDFB"', JSON.stringify('___\uEDFB'));
+assertEquals('"___\uEE09"', JSON.stringify('___\uEE09'));
+assertEquals('"___\uEE0D"', JSON.stringify('___\uEE0D'));
+assertEquals('"___\uEE34"', JSON.stringify('___\uEE34'));
+assertEquals('"___\uEE37"', JSON.stringify('___\uEE37'));
+assertEquals('"___\uEE38"', JSON.stringify('___\uEE38'));
+assertEquals('"___\uEF80"', JSON.stringify('___\uEF80'));
+assertEquals('"___\uEFE2"', JSON.stringify('___\uEFE2'));
+assertEquals('"___\uF02C"', JSON.stringify('___\uF02C'));
+assertEquals('"___\uF09A"', JSON.stringify('___\uF09A'));
+assertEquals('"___\uF0C1"', JSON.stringify('___\uF0C1'));
+assertEquals('"___\uF12C"', JSON.stringify('___\uF12C'));
+assertEquals('"___\uF250"', JSON.stringify('___\uF250'));
+assertEquals('"___\uF2A3"', JSON.stringify('___\uF2A3'));
+assertEquals('"___\uF340"', JSON.stringify('___\uF340'));
+assertEquals('"___\uF3C9"', JSON.stringify('___\uF3C9'));
+assertEquals('"___\uF3F5"', JSON.stringify('___\uF3F5'));
+assertEquals('"___\uF41B"', JSON.stringify('___\uF41B'));
+assertEquals('"___\uF420"', JSON.stringify('___\uF420'));
+assertEquals('"___\uF440"', JSON.stringify('___\uF440'));
+assertEquals('"___\uF4AE"', JSON.stringify('___\uF4AE'));
+assertEquals('"___\uF4B0"', JSON.stringify('___\uF4B0'));
+assertEquals('"___\uF50D"', JSON.stringify('___\uF50D'));
+assertEquals('"___\uF55D"', JSON.stringify('___\uF55D'));
+assertEquals('"___\uF55E"', JSON.stringify('___\uF55E'));
+assertEquals('"___\uF5CD"', JSON.stringify('___\uF5CD'));
+assertEquals('"___\uF657"', JSON.stringify('___\uF657'));
+assertEquals('"___\uF66D"', JSON.stringify('___\uF66D'));
+assertEquals('"___\uF68F"', JSON.stringify('___\uF68F'));
+assertEquals('"___\uF6A6"', JSON.stringify('___\uF6A6'));
+assertEquals('"___\uF6AA"', JSON.stringify('___\uF6AA'));
+assertEquals('"___\uF6EB"', JSON.stringify('___\uF6EB'));
+assertEquals('"___\uF79A"', JSON.stringify('___\uF79A'));
+assertEquals('"___\uF7E7"', JSON.stringify('___\uF7E7'));
+assertEquals('"___\uF7E8"', JSON.stringify('___\uF7E8'));
+assertEquals('"___\uF834"', JSON.stringify('___\uF834'));
+assertEquals('"___\uF88B"', JSON.stringify('___\uF88B'));
+assertEquals('"___\uF8D5"', JSON.stringify('___\uF8D5'));
+assertEquals('"___\uF8F1"', JSON.stringify('___\uF8F1'));
+assertEquals('"___\uF905"', JSON.stringify('___\uF905'));
+assertEquals('"___\uF927"', JSON.stringify('___\uF927'));
+assertEquals('"___\uF943"', JSON.stringify('___\uF943'));
+assertEquals('"___\uF949"', JSON.stringify('___\uF949'));
+assertEquals('"___\uF9A1"', JSON.stringify('___\uF9A1'));
+assertEquals('"___\uF9C7"', JSON.stringify('___\uF9C7'));
+assertEquals('"___\uFA0F"', JSON.stringify('___\uFA0F'));
+assertEquals('"___\uFA20"', JSON.stringify('___\uFA20'));
+assertEquals('"___\uFAA7"', JSON.stringify('___\uFAA7'));
+assertEquals('"___\uFBCD"', JSON.stringify('___\uFBCD'));
+assertEquals('"___\uFBF7"', JSON.stringify('___\uFBF7'));
+assertEquals('"___\uFC40"', JSON.stringify('___\uFC40'));
+assertEquals('"___\uFC4B"', JSON.stringify('___\uFC4B'));
+assertEquals('"___\uFC51"', JSON.stringify('___\uFC51'));
+assertEquals('"___\uFC5E"', JSON.stringify('___\uFC5E'));
+assertEquals('"___\uFC67"', JSON.stringify('___\uFC67'));
+assertEquals('"___\uFC8B"', JSON.stringify('___\uFC8B'));
+assertEquals('"___\uFE32"', JSON.stringify('___\uFE32'));
+assertEquals('"___\uFFC4"', JSON.stringify('___\uFFC4'));
+assertEquals('"___\uFFFD"', JSON.stringify('___\uFFFD'));
+assertEquals('"___\uFFFE"', JSON.stringify('___\uFFFE'));
+assertEquals('"___\uFFFF"', JSON.stringify('___\uFFFF'));
+
+// A random selection of astral symbols, i.e. surrogate pairs, i.e.
+// code points from U+010000 to U+10FFFF.
+assertEquals('"___\u{10000}"', JSON.stringify('___\u{10000}'));
+assertEquals('"___\u{11DE7}"', JSON.stringify('___\u{11DE7}'));
+assertEquals('"___\u{15997}"', JSON.stringify('___\u{15997}'));
+assertEquals('"___\u{187B0}"', JSON.stringify('___\u{187B0}'));
+assertEquals('"___\u{190B2}"', JSON.stringify('___\u{190B2}'));
+assertEquals('"___\u{1BF79}"', JSON.stringify('___\u{1BF79}'));
+assertEquals('"___\u{1C624}"', JSON.stringify('___\u{1C624}'));
+assertEquals('"___\u{1D9F4}"', JSON.stringify('___\u{1D9F4}'));
+assertEquals('"___\u{24149}"', JSON.stringify('___\u{24149}'));
+assertEquals('"___\u{2521C}"', JSON.stringify('___\u{2521C}'));
+assertEquals('"___\u{2762D}"', JSON.stringify('___\u{2762D}'));
+assertEquals('"___\u{2930B}"', JSON.stringify('___\u{2930B}'));
+assertEquals('"___\u{29EC4}"', JSON.stringify('___\u{29EC4}'));
+assertEquals('"___\u{29F9A}"', JSON.stringify('___\u{29F9A}'));
+assertEquals('"___\u{2A27D}"', JSON.stringify('___\u{2A27D}'));
+assertEquals('"___\u{2B363}"', JSON.stringify('___\u{2B363}'));
+assertEquals('"___\u{2C037}"', JSON.stringify('___\u{2C037}'));
+assertEquals('"___\u{2FAE0}"', JSON.stringify('___\u{2FAE0}'));
+assertEquals('"___\u{2FFCF}"', JSON.stringify('___\u{2FFCF}'));
+assertEquals('"___\u{32C1C}"', JSON.stringify('___\u{32C1C}'));
+assertEquals('"___\u{33DA8}"', JSON.stringify('___\u{33DA8}'));
+assertEquals('"___\u{3DCA4}"', JSON.stringify('___\u{3DCA4}'));
+assertEquals('"___\u{44FA0}"', JSON.stringify('___\u{44FA0}'));
+assertEquals('"___\u{45618}"', JSON.stringify('___\u{45618}'));
+assertEquals('"___\u{47395}"', JSON.stringify('___\u{47395}'));
+assertEquals('"___\u{4752C}"', JSON.stringify('___\u{4752C}'));
+assertEquals('"___\u{483FE}"', JSON.stringify('___\u{483FE}'));
+assertEquals('"___\u{49D35}"', JSON.stringify('___\u{49D35}'));
+assertEquals('"___\u{4CE3B}"', JSON.stringify('___\u{4CE3B}'));
+assertEquals('"___\u{55196}"', JSON.stringify('___\u{55196}'));
+assertEquals('"___\u{58B3E}"', JSON.stringify('___\u{58B3E}'));
+assertEquals('"___\u{5AA47}"', JSON.stringify('___\u{5AA47}'));
+assertEquals('"___\u{5C4B8}"', JSON.stringify('___\u{5C4B8}'));
+assertEquals('"___\u{5DD1B}"', JSON.stringify('___\u{5DD1B}'));
+assertEquals('"___\u{5FDCB}"', JSON.stringify('___\u{5FDCB}'));
+assertEquals('"___\u{611BA}"', JSON.stringify('___\u{611BA}'));
+assertEquals('"___\u{66433}"', JSON.stringify('___\u{66433}'));
+assertEquals('"___\u{690D7}"', JSON.stringify('___\u{690D7}'));
+assertEquals('"___\u{6F617}"', JSON.stringify('___\u{6F617}'));
+assertEquals('"___\u{711E4}"', JSON.stringify('___\u{711E4}'));
+assertEquals('"___\u{758D2}"', JSON.stringify('___\u{758D2}'));
+assertEquals('"___\u{780AC}"', JSON.stringify('___\u{780AC}'));
+assertEquals('"___\u{7AE5F}"', JSON.stringify('___\u{7AE5F}'));
+assertEquals('"___\u{7C2FB}"', JSON.stringify('___\u{7C2FB}'));
+assertEquals('"___\u{7D25F}"', JSON.stringify('___\u{7D25F}'));
+assertEquals('"___\u{8027A}"', JSON.stringify('___\u{8027A}'));
+assertEquals('"___\u{84817}"', JSON.stringify('___\u{84817}'));
+assertEquals('"___\u{8B070}"', JSON.stringify('___\u{8B070}'));
+assertEquals('"___\u{8B390}"', JSON.stringify('___\u{8B390}'));
+assertEquals('"___\u{8BC03}"', JSON.stringify('___\u{8BC03}'));
+assertEquals('"___\u{8BE63}"', JSON.stringify('___\u{8BE63}'));
+assertEquals('"___\u{8F12A}"', JSON.stringify('___\u{8F12A}'));
+assertEquals('"___\u{9345D}"', JSON.stringify('___\u{9345D}'));
+assertEquals('"___\u{937A9}"', JSON.stringify('___\u{937A9}'));
+assertEquals('"___\u{94596}"', JSON.stringify('___\u{94596}'));
+assertEquals('"___\u{967BB}"', JSON.stringify('___\u{967BB}'));
+assertEquals('"___\u{A19D1}"', JSON.stringify('___\u{A19D1}'));
+assertEquals('"___\u{A4FC5}"', JSON.stringify('___\u{A4FC5}'));
+assertEquals('"___\u{AC9CF}"', JSON.stringify('___\u{AC9CF}'));
+assertEquals('"___\u{B1366}"', JSON.stringify('___\u{B1366}'));
+assertEquals('"___\u{B3D32}"', JSON.stringify('___\u{B3D32}'));
+assertEquals('"___\u{B74BA}"', JSON.stringify('___\u{B74BA}'));
+assertEquals('"___\u{B8FB0}"', JSON.stringify('___\u{B8FB0}'));
+assertEquals('"___\u{BA0A5}"', JSON.stringify('___\u{BA0A5}'));
+assertEquals('"___\u{BB48E}"', JSON.stringify('___\u{BB48E}'));
+assertEquals('"___\u{C0B60}"', JSON.stringify('___\u{C0B60}'));
+assertEquals('"___\u{C2D34}"', JSON.stringify('___\u{C2D34}'));
+assertEquals('"___\u{C6C75}"', JSON.stringify('___\u{C6C75}'));
+assertEquals('"___\u{C9F26}"', JSON.stringify('___\u{C9F26}'));
+assertEquals('"___\u{CDBD0}"', JSON.stringify('___\u{CDBD0}'));
+assertEquals('"___\u{D1E28}"', JSON.stringify('___\u{D1E28}'));
+assertEquals('"___\u{D4A80}"', JSON.stringify('___\u{D4A80}'));
+assertEquals('"___\u{D947F}"', JSON.stringify('___\u{D947F}'));
+assertEquals('"___\u{D9B8A}"', JSON.stringify('___\u{D9B8A}'));
+assertEquals('"___\u{DA203}"', JSON.stringify('___\u{DA203}'));
+assertEquals('"___\u{DEFD3}"', JSON.stringify('___\u{DEFD3}'));
+assertEquals('"___\u{E4F7C}"', JSON.stringify('___\u{E4F7C}'));
+assertEquals('"___\u{E6BB3}"', JSON.stringify('___\u{E6BB3}'));
+assertEquals('"___\u{E972D}"', JSON.stringify('___\u{E972D}'));
+assertEquals('"___\u{EB335}"', JSON.stringify('___\u{EB335}'));
+assertEquals('"___\u{ED3F8}"', JSON.stringify('___\u{ED3F8}'));
+assertEquals('"___\u{ED940}"', JSON.stringify('___\u{ED940}'));
+assertEquals('"___\u{EF6F8}"', JSON.stringify('___\u{EF6F8}'));
+assertEquals('"___\u{F1F57}"', JSON.stringify('___\u{F1F57}'));
+assertEquals('"___\u{F33B5}"', JSON.stringify('___\u{F33B5}'));
+assertEquals('"___\u{F4D2A}"', JSON.stringify('___\u{F4D2A}'));
+assertEquals('"___\u{F70BA}"', JSON.stringify('___\u{F70BA}'));
+assertEquals('"___\u{F899F}"', JSON.stringify('___\u{F899F}'));
+assertEquals('"___\u{1034BF}"', JSON.stringify('___\u{1034BF}'));
+assertEquals('"___\u{107ACF}"', JSON.stringify('___\u{107ACF}'));
+assertEquals('"___\u{10881F}"', JSON.stringify('___\u{10881F}'));
+assertEquals('"___\u{1098A5}"', JSON.stringify('___\u{1098A5}'));
+assertEquals('"___\u{10ABD1}"', JSON.stringify('___\u{10ABD1}'));
+assertEquals('"___\u{10B5C5}"', JSON.stringify('___\u{10B5C5}'));
+assertEquals('"___\u{10CC79}"', JSON.stringify('___\u{10CC79}'));
+assertEquals('"___\u{10CD19}"', JSON.stringify('___\u{10CD19}'));
+assertEquals('"___\u{10FFFF}"', JSON.stringify('___\u{10FFFF}'));
diff --git a/src/v8/test/mjsunit/harmony/well-formed-json-stringify-unchecked.js b/src/v8/test/mjsunit/harmony/well-formed-json-stringify-unchecked.js
new file mode 100644
index 0000000..20d7520
--- /dev/null
+++ b/src/v8/test/mjsunit/harmony/well-formed-json-stringify-unchecked.js
@@ -0,0 +1,2573 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Test JSON.stringify for cases that hit
+// JsonStringifier::SerializeStringUnchecked_.
+
+// All code points from U+0000 to U+00FF.
+assertEquals('"\\u0000"', JSON.stringify('\0'));
+assertEquals('"\\u0001"', JSON.stringify('\x01'));
+assertEquals('"\\u0002"', JSON.stringify('\x02'));
+assertEquals('"\\u0003"', JSON.stringify('\x03'));
+assertEquals('"\\u0004"', JSON.stringify('\x04'));
+assertEquals('"\\u0005"', JSON.stringify('\x05'));
+assertEquals('"\\u0006"', JSON.stringify('\x06'));
+assertEquals('"\\u0007"', JSON.stringify('\x07'));
+assertEquals('"\\b"', JSON.stringify('\b'));
+assertEquals('"\\t"', JSON.stringify('\t'));
+assertEquals('"\\n"', JSON.stringify('\n'));
+assertEquals('"\\u000b"', JSON.stringify('\x0B'));
+assertEquals('"\\f"', JSON.stringify('\f'));
+assertEquals('"\\r"', JSON.stringify('\r'));
+assertEquals('"\\u000e"', JSON.stringify('\x0E'));
+assertEquals('"\\u000f"', JSON.stringify('\x0F'));
+assertEquals('"\\u0010"', JSON.stringify('\x10'));
+assertEquals('"\\u0011"', JSON.stringify('\x11'));
+assertEquals('"\\u0012"', JSON.stringify('\x12'));
+assertEquals('"\\u0013"', JSON.stringify('\x13'));
+assertEquals('"\\u0014"', JSON.stringify('\x14'));
+assertEquals('"\\u0015"', JSON.stringify('\x15'));
+assertEquals('"\\u0016"', JSON.stringify('\x16'));
+assertEquals('"\\u0017"', JSON.stringify('\x17'));
+assertEquals('"\\u0018"', JSON.stringify('\x18'));
+assertEquals('"\\u0019"', JSON.stringify('\x19'));
+assertEquals('"\\u001a"', JSON.stringify('\x1A'));
+assertEquals('"\\u001b"', JSON.stringify('\x1B'));
+assertEquals('"\\u001c"', JSON.stringify('\x1C'));
+assertEquals('"\\u001d"', JSON.stringify('\x1D'));
+assertEquals('"\\u001e"', JSON.stringify('\x1E'));
+assertEquals('"\\u001f"', JSON.stringify('\x1F'));
+assertEquals('" "', JSON.stringify(' '));
+assertEquals('"!"', JSON.stringify('!'));
+assertEquals('"\\""', JSON.stringify('"'));
+assertEquals('"#"', JSON.stringify('#'));
+assertEquals('"$"', JSON.stringify('$'));
+assertEquals('"%"', JSON.stringify('%'));
+assertEquals('"&"', JSON.stringify('&'));
+assertEquals('"\'"', JSON.stringify('\''));
+assertEquals('"("', JSON.stringify('('));
+assertEquals('")"', JSON.stringify(')'));
+assertEquals('"*"', JSON.stringify('*'));
+assertEquals('"+"', JSON.stringify('+'));
+assertEquals('","', JSON.stringify(','));
+assertEquals('"-"', JSON.stringify('-'));
+assertEquals('"."', JSON.stringify('.'));
+assertEquals('"/"', JSON.stringify('/'));
+assertEquals('"0"', JSON.stringify('0'));
+assertEquals('"1"', JSON.stringify('1'));
+assertEquals('"2"', JSON.stringify('2'));
+assertEquals('"3"', JSON.stringify('3'));
+assertEquals('"4"', JSON.stringify('4'));
+assertEquals('"5"', JSON.stringify('5'));
+assertEquals('"6"', JSON.stringify('6'));
+assertEquals('"7"', JSON.stringify('7'));
+assertEquals('"8"', JSON.stringify('8'));
+assertEquals('"9"', JSON.stringify('9'));
+assertEquals('":"', JSON.stringify(':'));
+assertEquals('";"', JSON.stringify(';'));
+assertEquals('"<"', JSON.stringify('<'));
+assertEquals('"="', JSON.stringify('='));
+assertEquals('">"', JSON.stringify('>'));
+assertEquals('"?"', JSON.stringify('?'));
+assertEquals('"@"', JSON.stringify('@'));
+assertEquals('"A"', JSON.stringify('A'));
+assertEquals('"B"', JSON.stringify('B'));
+assertEquals('"C"', JSON.stringify('C'));
+assertEquals('"D"', JSON.stringify('D'));
+assertEquals('"E"', JSON.stringify('E'));
+assertEquals('"F"', JSON.stringify('F'));
+assertEquals('"G"', JSON.stringify('G'));
+assertEquals('"H"', JSON.stringify('H'));
+assertEquals('"I"', JSON.stringify('I'));
+assertEquals('"J"', JSON.stringify('J'));
+assertEquals('"K"', JSON.stringify('K'));
+assertEquals('"L"', JSON.stringify('L'));
+assertEquals('"M"', JSON.stringify('M'));
+assertEquals('"N"', JSON.stringify('N'));
+assertEquals('"O"', JSON.stringify('O'));
+assertEquals('"P"', JSON.stringify('P'));
+assertEquals('"Q"', JSON.stringify('Q'));
+assertEquals('"R"', JSON.stringify('R'));
+assertEquals('"S"', JSON.stringify('S'));
+assertEquals('"T"', JSON.stringify('T'));
+assertEquals('"U"', JSON.stringify('U'));
+assertEquals('"V"', JSON.stringify('V'));
+assertEquals('"W"', JSON.stringify('W'));
+assertEquals('"X"', JSON.stringify('X'));
+assertEquals('"Y"', JSON.stringify('Y'));
+assertEquals('"Z"', JSON.stringify('Z'));
+assertEquals('"["', JSON.stringify('['));
+assertEquals('"\\\\"', JSON.stringify('\\'));
+assertEquals('"]"', JSON.stringify(']'));
+assertEquals('"^"', JSON.stringify('^'));
+assertEquals('"_"', JSON.stringify('_'));
+assertEquals('"`"', JSON.stringify('`'));
+assertEquals('"a"', JSON.stringify('a'));
+assertEquals('"b"', JSON.stringify('b'));
+assertEquals('"c"', JSON.stringify('c'));
+assertEquals('"d"', JSON.stringify('d'));
+assertEquals('"e"', JSON.stringify('e'));
+assertEquals('"f"', JSON.stringify('f'));
+assertEquals('"g"', JSON.stringify('g'));
+assertEquals('"h"', JSON.stringify('h'));
+assertEquals('"i"', JSON.stringify('i'));
+assertEquals('"j"', JSON.stringify('j'));
+assertEquals('"k"', JSON.stringify('k'));
+assertEquals('"l"', JSON.stringify('l'));
+assertEquals('"m"', JSON.stringify('m'));
+assertEquals('"n"', JSON.stringify('n'));
+assertEquals('"o"', JSON.stringify('o'));
+assertEquals('"p"', JSON.stringify('p'));
+assertEquals('"q"', JSON.stringify('q'));
+assertEquals('"r"', JSON.stringify('r'));
+assertEquals('"s"', JSON.stringify('s'));
+assertEquals('"t"', JSON.stringify('t'));
+assertEquals('"u"', JSON.stringify('u'));
+assertEquals('"v"', JSON.stringify('v'));
+assertEquals('"w"', JSON.stringify('w'));
+assertEquals('"x"', JSON.stringify('x'));
+assertEquals('"y"', JSON.stringify('y'));
+assertEquals('"z"', JSON.stringify('z'));
+assertEquals('"{"', JSON.stringify('{'));
+assertEquals('"|"', JSON.stringify('|'));
+assertEquals('"}"', JSON.stringify('}'));
+assertEquals('"~"', JSON.stringify('~'));
+assertEquals('"\x7F"', JSON.stringify('\x7F'));
+assertEquals('"\x80"', JSON.stringify('\x80'));
+assertEquals('"\x81"', JSON.stringify('\x81'));
+assertEquals('"\x82"', JSON.stringify('\x82'));
+assertEquals('"\x83"', JSON.stringify('\x83'));
+assertEquals('"\x84"', JSON.stringify('\x84'));
+assertEquals('"\x85"', JSON.stringify('\x85'));
+assertEquals('"\x86"', JSON.stringify('\x86'));
+assertEquals('"\x87"', JSON.stringify('\x87'));
+assertEquals('"\x88"', JSON.stringify('\x88'));
+assertEquals('"\x89"', JSON.stringify('\x89'));
+assertEquals('"\x8A"', JSON.stringify('\x8A'));
+assertEquals('"\x8B"', JSON.stringify('\x8B'));
+assertEquals('"\x8C"', JSON.stringify('\x8C'));
+assertEquals('"\x8D"', JSON.stringify('\x8D'));
+assertEquals('"\x8E"', JSON.stringify('\x8E'));
+assertEquals('"\x8F"', JSON.stringify('\x8F'));
+assertEquals('"\x90"', JSON.stringify('\x90'));
+assertEquals('"\x91"', JSON.stringify('\x91'));
+assertEquals('"\x92"', JSON.stringify('\x92'));
+assertEquals('"\x93"', JSON.stringify('\x93'));
+assertEquals('"\x94"', JSON.stringify('\x94'));
+assertEquals('"\x95"', JSON.stringify('\x95'));
+assertEquals('"\x96"', JSON.stringify('\x96'));
+assertEquals('"\x97"', JSON.stringify('\x97'));
+assertEquals('"\x98"', JSON.stringify('\x98'));
+assertEquals('"\x99"', JSON.stringify('\x99'));
+assertEquals('"\x9A"', JSON.stringify('\x9A'));
+assertEquals('"\x9B"', JSON.stringify('\x9B'));
+assertEquals('"\x9C"', JSON.stringify('\x9C'));
+assertEquals('"\x9D"', JSON.stringify('\x9D'));
+assertEquals('"\x9E"', JSON.stringify('\x9E'));
+assertEquals('"\x9F"', JSON.stringify('\x9F'));
+assertEquals('"\xA0"', JSON.stringify('\xA0'));
+assertEquals('"\xA1"', JSON.stringify('\xA1'));
+assertEquals('"\xA2"', JSON.stringify('\xA2'));
+assertEquals('"\xA3"', JSON.stringify('\xA3'));
+assertEquals('"\xA4"', JSON.stringify('\xA4'));
+assertEquals('"\xA5"', JSON.stringify('\xA5'));
+assertEquals('"\xA6"', JSON.stringify('\xA6'));
+assertEquals('"\xA7"', JSON.stringify('\xA7'));
+assertEquals('"\xA8"', JSON.stringify('\xA8'));
+assertEquals('"\xA9"', JSON.stringify('\xA9'));
+assertEquals('"\xAA"', JSON.stringify('\xAA'));
+assertEquals('"\xAB"', JSON.stringify('\xAB'));
+assertEquals('"\xAC"', JSON.stringify('\xAC'));
+assertEquals('"\xAD"', JSON.stringify('\xAD'));
+assertEquals('"\xAE"', JSON.stringify('\xAE'));
+assertEquals('"\xAF"', JSON.stringify('\xAF'));
+assertEquals('"\xB0"', JSON.stringify('\xB0'));
+assertEquals('"\xB1"', JSON.stringify('\xB1'));
+assertEquals('"\xB2"', JSON.stringify('\xB2'));
+assertEquals('"\xB3"', JSON.stringify('\xB3'));
+assertEquals('"\xB4"', JSON.stringify('\xB4'));
+assertEquals('"\xB5"', JSON.stringify('\xB5'));
+assertEquals('"\xB6"', JSON.stringify('\xB6'));
+assertEquals('"\xB7"', JSON.stringify('\xB7'));
+assertEquals('"\xB8"', JSON.stringify('\xB8'));
+assertEquals('"\xB9"', JSON.stringify('\xB9'));
+assertEquals('"\xBA"', JSON.stringify('\xBA'));
+assertEquals('"\xBB"', JSON.stringify('\xBB'));
+assertEquals('"\xBC"', JSON.stringify('\xBC'));
+assertEquals('"\xBD"', JSON.stringify('\xBD'));
+assertEquals('"\xBE"', JSON.stringify('\xBE'));
+assertEquals('"\xBF"', JSON.stringify('\xBF'));
+assertEquals('"\xC0"', JSON.stringify('\xC0'));
+assertEquals('"\xC1"', JSON.stringify('\xC1'));
+assertEquals('"\xC2"', JSON.stringify('\xC2'));
+assertEquals('"\xC3"', JSON.stringify('\xC3'));
+assertEquals('"\xC4"', JSON.stringify('\xC4'));
+assertEquals('"\xC5"', JSON.stringify('\xC5'));
+assertEquals('"\xC6"', JSON.stringify('\xC6'));
+assertEquals('"\xC7"', JSON.stringify('\xC7'));
+assertEquals('"\xC8"', JSON.stringify('\xC8'));
+assertEquals('"\xC9"', JSON.stringify('\xC9'));
+assertEquals('"\xCA"', JSON.stringify('\xCA'));
+assertEquals('"\xCB"', JSON.stringify('\xCB'));
+assertEquals('"\xCC"', JSON.stringify('\xCC'));
+assertEquals('"\xCD"', JSON.stringify('\xCD'));
+assertEquals('"\xCE"', JSON.stringify('\xCE'));
+assertEquals('"\xCF"', JSON.stringify('\xCF'));
+assertEquals('"\xD0"', JSON.stringify('\xD0'));
+assertEquals('"\xD1"', JSON.stringify('\xD1'));
+assertEquals('"\xD2"', JSON.stringify('\xD2'));
+assertEquals('"\xD3"', JSON.stringify('\xD3'));
+assertEquals('"\xD4"', JSON.stringify('\xD4'));
+assertEquals('"\xD5"', JSON.stringify('\xD5'));
+assertEquals('"\xD6"', JSON.stringify('\xD6'));
+assertEquals('"\xD7"', JSON.stringify('\xD7'));
+assertEquals('"\xD8"', JSON.stringify('\xD8'));
+assertEquals('"\xD9"', JSON.stringify('\xD9'));
+assertEquals('"\xDA"', JSON.stringify('\xDA'));
+assertEquals('"\xDB"', JSON.stringify('\xDB'));
+assertEquals('"\xDC"', JSON.stringify('\xDC'));
+assertEquals('"\xDD"', JSON.stringify('\xDD'));
+assertEquals('"\xDE"', JSON.stringify('\xDE'));
+assertEquals('"\xDF"', JSON.stringify('\xDF'));
+assertEquals('"\xE0"', JSON.stringify('\xE0'));
+assertEquals('"\xE1"', JSON.stringify('\xE1'));
+assertEquals('"\xE2"', JSON.stringify('\xE2'));
+assertEquals('"\xE3"', JSON.stringify('\xE3'));
+assertEquals('"\xE4"', JSON.stringify('\xE4'));
+assertEquals('"\xE5"', JSON.stringify('\xE5'));
+assertEquals('"\xE6"', JSON.stringify('\xE6'));
+assertEquals('"\xE7"', JSON.stringify('\xE7'));
+assertEquals('"\xE8"', JSON.stringify('\xE8'));
+assertEquals('"\xE9"', JSON.stringify('\xE9'));
+assertEquals('"\xEA"', JSON.stringify('\xEA'));
+assertEquals('"\xEB"', JSON.stringify('\xEB'));
+assertEquals('"\xEC"', JSON.stringify('\xEC'));
+assertEquals('"\xED"', JSON.stringify('\xED'));
+assertEquals('"\xEE"', JSON.stringify('\xEE'));
+assertEquals('"\xEF"', JSON.stringify('\xEF'));
+assertEquals('"\xF0"', JSON.stringify('\xF0'));
+assertEquals('"\xF1"', JSON.stringify('\xF1'));
+assertEquals('"\xF2"', JSON.stringify('\xF2'));
+assertEquals('"\xF3"', JSON.stringify('\xF3'));
+assertEquals('"\xF4"', JSON.stringify('\xF4'));
+assertEquals('"\xF5"', JSON.stringify('\xF5'));
+assertEquals('"\xF6"', JSON.stringify('\xF6'));
+assertEquals('"\xF7"', JSON.stringify('\xF7'));
+assertEquals('"\xF8"', JSON.stringify('\xF8'));
+assertEquals('"\xF9"', JSON.stringify('\xF9'));
+assertEquals('"\xFA"', JSON.stringify('\xFA'));
+assertEquals('"\xFB"', JSON.stringify('\xFB'));
+assertEquals('"\xFC"', JSON.stringify('\xFC'));
+assertEquals('"\xFD"', JSON.stringify('\xFD'));
+assertEquals('"\xFE"', JSON.stringify('\xFE'));
+assertEquals('"\xFF"', JSON.stringify('\xFF'));
+
+// A random selection of code points from U+0100 to U+D7FF.
+assertEquals('"\u0100"', JSON.stringify('\u0100'));
+assertEquals('"\u0120"', JSON.stringify('\u0120'));
+assertEquals('"\u07D3"', JSON.stringify('\u07D3'));
+assertEquals('"\u0B8B"', JSON.stringify('\u0B8B'));
+assertEquals('"\u0C4C"', JSON.stringify('\u0C4C'));
+assertEquals('"\u178D"', JSON.stringify('\u178D'));
+assertEquals('"\u18B8"', JSON.stringify('\u18B8'));
+assertEquals('"\u193E"', JSON.stringify('\u193E'));
+assertEquals('"\u198A"', JSON.stringify('\u198A'));
+assertEquals('"\u1AF5"', JSON.stringify('\u1AF5'));
+assertEquals('"\u1D38"', JSON.stringify('\u1D38'));
+assertEquals('"\u1E37"', JSON.stringify('\u1E37'));
+assertEquals('"\u1FC2"', JSON.stringify('\u1FC2'));
+assertEquals('"\u22C7"', JSON.stringify('\u22C7'));
+assertEquals('"\u2619"', JSON.stringify('\u2619'));
+assertEquals('"\u272A"', JSON.stringify('\u272A'));
+assertEquals('"\u2B7F"', JSON.stringify('\u2B7F'));
+assertEquals('"\u2DFF"', JSON.stringify('\u2DFF'));
+assertEquals('"\u341B"', JSON.stringify('\u341B'));
+assertEquals('"\u3A3C"', JSON.stringify('\u3A3C'));
+assertEquals('"\u3E53"', JSON.stringify('\u3E53'));
+assertEquals('"\u3EC2"', JSON.stringify('\u3EC2'));
+assertEquals('"\u3F76"', JSON.stringify('\u3F76'));
+assertEquals('"\u3F85"', JSON.stringify('\u3F85'));
+assertEquals('"\u43C7"', JSON.stringify('\u43C7'));
+assertEquals('"\u4A19"', JSON.stringify('\u4A19'));
+assertEquals('"\u4A1C"', JSON.stringify('\u4A1C'));
+assertEquals('"\u4F80"', JSON.stringify('\u4F80'));
+assertEquals('"\u5A30"', JSON.stringify('\u5A30'));
+assertEquals('"\u5B55"', JSON.stringify('\u5B55'));
+assertEquals('"\u5C74"', JSON.stringify('\u5C74'));
+assertEquals('"\u6006"', JSON.stringify('\u6006'));
+assertEquals('"\u63CC"', JSON.stringify('\u63CC'));
+assertEquals('"\u6608"', JSON.stringify('\u6608'));
+assertEquals('"\u6ABF"', JSON.stringify('\u6ABF'));
+assertEquals('"\u6AE9"', JSON.stringify('\u6AE9'));
+assertEquals('"\u6C91"', JSON.stringify('\u6C91'));
+assertEquals('"\u714B"', JSON.stringify('\u714B'));
+assertEquals('"\u728A"', JSON.stringify('\u728A'));
+assertEquals('"\u7485"', JSON.stringify('\u7485'));
+assertEquals('"\u77C8"', JSON.stringify('\u77C8'));
+assertEquals('"\u7BE9"', JSON.stringify('\u7BE9'));
+assertEquals('"\u7CEF"', JSON.stringify('\u7CEF'));
+assertEquals('"\u7DD5"', JSON.stringify('\u7DD5'));
+assertEquals('"\u8DF1"', JSON.stringify('\u8DF1'));
+assertEquals('"\u94A9"', JSON.stringify('\u94A9'));
+assertEquals('"\u94F2"', JSON.stringify('\u94F2'));
+assertEquals('"\u9A7A"', JSON.stringify('\u9A7A'));
+assertEquals('"\u9AA6"', JSON.stringify('\u9AA6'));
+assertEquals('"\uA2B0"', JSON.stringify('\uA2B0'));
+assertEquals('"\uB711"', JSON.stringify('\uB711'));
+assertEquals('"\uBC01"', JSON.stringify('\uBC01'));
+assertEquals('"\uBCB6"', JSON.stringify('\uBCB6'));
+assertEquals('"\uBD70"', JSON.stringify('\uBD70'));
+assertEquals('"\uC3CD"', JSON.stringify('\uC3CD'));
+assertEquals('"\uC451"', JSON.stringify('\uC451'));
+assertEquals('"\uC677"', JSON.stringify('\uC677'));
+assertEquals('"\uC89B"', JSON.stringify('\uC89B'));
+assertEquals('"\uCBEF"', JSON.stringify('\uCBEF'));
+assertEquals('"\uCEF8"', JSON.stringify('\uCEF8'));
+assertEquals('"\uD089"', JSON.stringify('\uD089'));
+assertEquals('"\uD24D"', JSON.stringify('\uD24D'));
+assertEquals('"\uD3A7"', JSON.stringify('\uD3A7'));
+assertEquals('"\uD7FF"', JSON.stringify('\uD7FF'));
+
+// All lone surrogates, i.e. code points from U+D800 to U+DFFF.
+assertEquals('"\\ud800"', JSON.stringify('\uD800'));
+assertEquals('"\\ud801"', JSON.stringify('\uD801'));
+assertEquals('"\\ud802"', JSON.stringify('\uD802'));
+assertEquals('"\\ud803"', JSON.stringify('\uD803'));
+assertEquals('"\\ud804"', JSON.stringify('\uD804'));
+assertEquals('"\\ud805"', JSON.stringify('\uD805'));
+assertEquals('"\\ud806"', JSON.stringify('\uD806'));
+assertEquals('"\\ud807"', JSON.stringify('\uD807'));
+assertEquals('"\\ud808"', JSON.stringify('\uD808'));
+assertEquals('"\\ud809"', JSON.stringify('\uD809'));
+assertEquals('"\\ud80a"', JSON.stringify('\uD80A'));
+assertEquals('"\\ud80b"', JSON.stringify('\uD80B'));
+assertEquals('"\\ud80c"', JSON.stringify('\uD80C'));
+assertEquals('"\\ud80d"', JSON.stringify('\uD80D'));
+assertEquals('"\\ud80e"', JSON.stringify('\uD80E'));
+assertEquals('"\\ud80f"', JSON.stringify('\uD80F'));
+assertEquals('"\\ud810"', JSON.stringify('\uD810'));
+assertEquals('"\\ud811"', JSON.stringify('\uD811'));
+assertEquals('"\\ud812"', JSON.stringify('\uD812'));
+assertEquals('"\\ud813"', JSON.stringify('\uD813'));
+assertEquals('"\\ud814"', JSON.stringify('\uD814'));
+assertEquals('"\\ud815"', JSON.stringify('\uD815'));
+assertEquals('"\\ud816"', JSON.stringify('\uD816'));
+assertEquals('"\\ud817"', JSON.stringify('\uD817'));
+assertEquals('"\\ud818"', JSON.stringify('\uD818'));
+assertEquals('"\\ud819"', JSON.stringify('\uD819'));
+assertEquals('"\\ud81a"', JSON.stringify('\uD81A'));
+assertEquals('"\\ud81b"', JSON.stringify('\uD81B'));
+assertEquals('"\\ud81c"', JSON.stringify('\uD81C'));
+assertEquals('"\\ud81d"', JSON.stringify('\uD81D'));
+assertEquals('"\\ud81e"', JSON.stringify('\uD81E'));
+assertEquals('"\\ud81f"', JSON.stringify('\uD81F'));
+assertEquals('"\\ud820"', JSON.stringify('\uD820'));
+assertEquals('"\\ud821"', JSON.stringify('\uD821'));
+assertEquals('"\\ud822"', JSON.stringify('\uD822'));
+assertEquals('"\\ud823"', JSON.stringify('\uD823'));
+assertEquals('"\\ud824"', JSON.stringify('\uD824'));
+assertEquals('"\\ud825"', JSON.stringify('\uD825'));
+assertEquals('"\\ud826"', JSON.stringify('\uD826'));
+assertEquals('"\\ud827"', JSON.stringify('\uD827'));
+assertEquals('"\\ud828"', JSON.stringify('\uD828'));
+assertEquals('"\\ud829"', JSON.stringify('\uD829'));
+assertEquals('"\\ud82a"', JSON.stringify('\uD82A'));
+assertEquals('"\\ud82b"', JSON.stringify('\uD82B'));
+assertEquals('"\\ud82c"', JSON.stringify('\uD82C'));
+assertEquals('"\\ud82d"', JSON.stringify('\uD82D'));
+assertEquals('"\\ud82e"', JSON.stringify('\uD82E'));
+assertEquals('"\\ud82f"', JSON.stringify('\uD82F'));
+assertEquals('"\\ud830"', JSON.stringify('\uD830'));
+assertEquals('"\\ud831"', JSON.stringify('\uD831'));
+assertEquals('"\\ud832"', JSON.stringify('\uD832'));
+assertEquals('"\\ud833"', JSON.stringify('\uD833'));
+assertEquals('"\\ud834"', JSON.stringify('\uD834'));
+assertEquals('"\\ud835"', JSON.stringify('\uD835'));
+assertEquals('"\\ud836"', JSON.stringify('\uD836'));
+assertEquals('"\\ud837"', JSON.stringify('\uD837'));
+assertEquals('"\\ud838"', JSON.stringify('\uD838'));
+assertEquals('"\\ud839"', JSON.stringify('\uD839'));
+assertEquals('"\\ud83a"', JSON.stringify('\uD83A'));
+assertEquals('"\\ud83b"', JSON.stringify('\uD83B'));
+assertEquals('"\\ud83c"', JSON.stringify('\uD83C'));
+assertEquals('"\\ud83d"', JSON.stringify('\uD83D'));
+assertEquals('"\\ud83e"', JSON.stringify('\uD83E'));
+assertEquals('"\\ud83f"', JSON.stringify('\uD83F'));
+assertEquals('"\\ud840"', JSON.stringify('\uD840'));
+assertEquals('"\\ud841"', JSON.stringify('\uD841'));
+assertEquals('"\\ud842"', JSON.stringify('\uD842'));
+assertEquals('"\\ud843"', JSON.stringify('\uD843'));
+assertEquals('"\\ud844"', JSON.stringify('\uD844'));
+assertEquals('"\\ud845"', JSON.stringify('\uD845'));
+assertEquals('"\\ud846"', JSON.stringify('\uD846'));
+assertEquals('"\\ud847"', JSON.stringify('\uD847'));
+assertEquals('"\\ud848"', JSON.stringify('\uD848'));
+assertEquals('"\\ud849"', JSON.stringify('\uD849'));
+assertEquals('"\\ud84a"', JSON.stringify('\uD84A'));
+assertEquals('"\\ud84b"', JSON.stringify('\uD84B'));
+assertEquals('"\\ud84c"', JSON.stringify('\uD84C'));
+assertEquals('"\\ud84d"', JSON.stringify('\uD84D'));
+assertEquals('"\\ud84e"', JSON.stringify('\uD84E'));
+assertEquals('"\\ud84f"', JSON.stringify('\uD84F'));
+assertEquals('"\\ud850"', JSON.stringify('\uD850'));
+assertEquals('"\\ud851"', JSON.stringify('\uD851'));
+assertEquals('"\\ud852"', JSON.stringify('\uD852'));
+assertEquals('"\\ud853"', JSON.stringify('\uD853'));
+assertEquals('"\\ud854"', JSON.stringify('\uD854'));
+assertEquals('"\\ud855"', JSON.stringify('\uD855'));
+assertEquals('"\\ud856"', JSON.stringify('\uD856'));
+assertEquals('"\\ud857"', JSON.stringify('\uD857'));
+assertEquals('"\\ud858"', JSON.stringify('\uD858'));
+assertEquals('"\\ud859"', JSON.stringify('\uD859'));
+assertEquals('"\\ud85a"', JSON.stringify('\uD85A'));
+assertEquals('"\\ud85b"', JSON.stringify('\uD85B'));
+assertEquals('"\\ud85c"', JSON.stringify('\uD85C'));
+assertEquals('"\\ud85d"', JSON.stringify('\uD85D'));
+assertEquals('"\\ud85e"', JSON.stringify('\uD85E'));
+assertEquals('"\\ud85f"', JSON.stringify('\uD85F'));
+assertEquals('"\\ud860"', JSON.stringify('\uD860'));
+assertEquals('"\\ud861"', JSON.stringify('\uD861'));
+assertEquals('"\\ud862"', JSON.stringify('\uD862'));
+assertEquals('"\\ud863"', JSON.stringify('\uD863'));
+assertEquals('"\\ud864"', JSON.stringify('\uD864'));
+assertEquals('"\\ud865"', JSON.stringify('\uD865'));
+assertEquals('"\\ud866"', JSON.stringify('\uD866'));
+assertEquals('"\\ud867"', JSON.stringify('\uD867'));
+assertEquals('"\\ud868"', JSON.stringify('\uD868'));
+assertEquals('"\\ud869"', JSON.stringify('\uD869'));
+assertEquals('"\\ud86a"', JSON.stringify('\uD86A'));
+assertEquals('"\\ud86b"', JSON.stringify('\uD86B'));
+assertEquals('"\\ud86c"', JSON.stringify('\uD86C'));
+assertEquals('"\\ud86d"', JSON.stringify('\uD86D'));
+assertEquals('"\\ud86e"', JSON.stringify('\uD86E'));
+assertEquals('"\\ud86f"', JSON.stringify('\uD86F'));
+assertEquals('"\\ud870"', JSON.stringify('\uD870'));
+assertEquals('"\\ud871"', JSON.stringify('\uD871'));
+assertEquals('"\\ud872"', JSON.stringify('\uD872'));
+assertEquals('"\\ud873"', JSON.stringify('\uD873'));
+assertEquals('"\\ud874"', JSON.stringify('\uD874'));
+assertEquals('"\\ud875"', JSON.stringify('\uD875'));
+assertEquals('"\\ud876"', JSON.stringify('\uD876'));
+assertEquals('"\\ud877"', JSON.stringify('\uD877'));
+assertEquals('"\\ud878"', JSON.stringify('\uD878'));
+assertEquals('"\\ud879"', JSON.stringify('\uD879'));
+assertEquals('"\\ud87a"', JSON.stringify('\uD87A'));
+assertEquals('"\\ud87b"', JSON.stringify('\uD87B'));
+assertEquals('"\\ud87c"', JSON.stringify('\uD87C'));
+assertEquals('"\\ud87d"', JSON.stringify('\uD87D'));
+assertEquals('"\\ud87e"', JSON.stringify('\uD87E'));
+assertEquals('"\\ud87f"', JSON.stringify('\uD87F'));
+assertEquals('"\\ud880"', JSON.stringify('\uD880'));
+assertEquals('"\\ud881"', JSON.stringify('\uD881'));
+assertEquals('"\\ud882"', JSON.stringify('\uD882'));
+assertEquals('"\\ud883"', JSON.stringify('\uD883'));
+assertEquals('"\\ud884"', JSON.stringify('\uD884'));
+assertEquals('"\\ud885"', JSON.stringify('\uD885'));
+assertEquals('"\\ud886"', JSON.stringify('\uD886'));
+assertEquals('"\\ud887"', JSON.stringify('\uD887'));
+assertEquals('"\\ud888"', JSON.stringify('\uD888'));
+assertEquals('"\\ud889"', JSON.stringify('\uD889'));
+assertEquals('"\\ud88a"', JSON.stringify('\uD88A'));
+assertEquals('"\\ud88b"', JSON.stringify('\uD88B'));
+assertEquals('"\\ud88c"', JSON.stringify('\uD88C'));
+assertEquals('"\\ud88d"', JSON.stringify('\uD88D'));
+assertEquals('"\\ud88e"', JSON.stringify('\uD88E'));
+assertEquals('"\\ud88f"', JSON.stringify('\uD88F'));
+assertEquals('"\\ud890"', JSON.stringify('\uD890'));
+assertEquals('"\\ud891"', JSON.stringify('\uD891'));
+assertEquals('"\\ud892"', JSON.stringify('\uD892'));
+assertEquals('"\\ud893"', JSON.stringify('\uD893'));
+assertEquals('"\\ud894"', JSON.stringify('\uD894'));
+assertEquals('"\\ud895"', JSON.stringify('\uD895'));
+assertEquals('"\\ud896"', JSON.stringify('\uD896'));
+assertEquals('"\\ud897"', JSON.stringify('\uD897'));
+assertEquals('"\\ud898"', JSON.stringify('\uD898'));
+assertEquals('"\\ud899"', JSON.stringify('\uD899'));
+assertEquals('"\\ud89a"', JSON.stringify('\uD89A'));
+assertEquals('"\\ud89b"', JSON.stringify('\uD89B'));
+assertEquals('"\\ud89c"', JSON.stringify('\uD89C'));
+assertEquals('"\\ud89d"', JSON.stringify('\uD89D'));
+assertEquals('"\\ud89e"', JSON.stringify('\uD89E'));
+assertEquals('"\\ud89f"', JSON.stringify('\uD89F'));
+assertEquals('"\\ud8a0"', JSON.stringify('\uD8A0'));
+assertEquals('"\\ud8a1"', JSON.stringify('\uD8A1'));
+assertEquals('"\\ud8a2"', JSON.stringify('\uD8A2'));
+assertEquals('"\\ud8a3"', JSON.stringify('\uD8A3'));
+assertEquals('"\\ud8a4"', JSON.stringify('\uD8A4'));
+assertEquals('"\\ud8a5"', JSON.stringify('\uD8A5'));
+assertEquals('"\\ud8a6"', JSON.stringify('\uD8A6'));
+assertEquals('"\\ud8a7"', JSON.stringify('\uD8A7'));
+assertEquals('"\\ud8a8"', JSON.stringify('\uD8A8'));
+assertEquals('"\\ud8a9"', JSON.stringify('\uD8A9'));
+assertEquals('"\\ud8aa"', JSON.stringify('\uD8AA'));
+assertEquals('"\\ud8ab"', JSON.stringify('\uD8AB'));
+assertEquals('"\\ud8ac"', JSON.stringify('\uD8AC'));
+assertEquals('"\\ud8ad"', JSON.stringify('\uD8AD'));
+assertEquals('"\\ud8ae"', JSON.stringify('\uD8AE'));
+assertEquals('"\\ud8af"', JSON.stringify('\uD8AF'));
+assertEquals('"\\ud8b0"', JSON.stringify('\uD8B0'));
+assertEquals('"\\ud8b1"', JSON.stringify('\uD8B1'));
+assertEquals('"\\ud8b2"', JSON.stringify('\uD8B2'));
+assertEquals('"\\ud8b3"', JSON.stringify('\uD8B3'));
+assertEquals('"\\ud8b4"', JSON.stringify('\uD8B4'));
+assertEquals('"\\ud8b5"', JSON.stringify('\uD8B5'));
+assertEquals('"\\ud8b6"', JSON.stringify('\uD8B6'));
+assertEquals('"\\ud8b7"', JSON.stringify('\uD8B7'));
+assertEquals('"\\ud8b8"', JSON.stringify('\uD8B8'));
+assertEquals('"\\ud8b9"', JSON.stringify('\uD8B9'));
+assertEquals('"\\ud8ba"', JSON.stringify('\uD8BA'));
+assertEquals('"\\ud8bb"', JSON.stringify('\uD8BB'));
+assertEquals('"\\ud8bc"', JSON.stringify('\uD8BC'));
+assertEquals('"\\ud8bd"', JSON.stringify('\uD8BD'));
+assertEquals('"\\ud8be"', JSON.stringify('\uD8BE'));
+assertEquals('"\\ud8bf"', JSON.stringify('\uD8BF'));
+assertEquals('"\\ud8c0"', JSON.stringify('\uD8C0'));
+assertEquals('"\\ud8c1"', JSON.stringify('\uD8C1'));
+assertEquals('"\\ud8c2"', JSON.stringify('\uD8C2'));
+assertEquals('"\\ud8c3"', JSON.stringify('\uD8C3'));
+assertEquals('"\\ud8c4"', JSON.stringify('\uD8C4'));
+assertEquals('"\\ud8c5"', JSON.stringify('\uD8C5'));
+assertEquals('"\\ud8c6"', JSON.stringify('\uD8C6'));
+assertEquals('"\\ud8c7"', JSON.stringify('\uD8C7'));
+assertEquals('"\\ud8c8"', JSON.stringify('\uD8C8'));
+assertEquals('"\\ud8c9"', JSON.stringify('\uD8C9'));
+assertEquals('"\\ud8ca"', JSON.stringify('\uD8CA'));
+assertEquals('"\\ud8cb"', JSON.stringify('\uD8CB'));
+assertEquals('"\\ud8cc"', JSON.stringify('\uD8CC'));
+assertEquals('"\\ud8cd"', JSON.stringify('\uD8CD'));
+assertEquals('"\\ud8ce"', JSON.stringify('\uD8CE'));
+assertEquals('"\\ud8cf"', JSON.stringify('\uD8CF'));
+assertEquals('"\\ud8d0"', JSON.stringify('\uD8D0'));
+assertEquals('"\\ud8d1"', JSON.stringify('\uD8D1'));
+assertEquals('"\\ud8d2"', JSON.stringify('\uD8D2'));
+assertEquals('"\\ud8d3"', JSON.stringify('\uD8D3'));
+assertEquals('"\\ud8d4"', JSON.stringify('\uD8D4'));
+assertEquals('"\\ud8d5"', JSON.stringify('\uD8D5'));
+assertEquals('"\\ud8d6"', JSON.stringify('\uD8D6'));
+assertEquals('"\\ud8d7"', JSON.stringify('\uD8D7'));
+assertEquals('"\\ud8d8"', JSON.stringify('\uD8D8'));
+assertEquals('"\\ud8d9"', JSON.stringify('\uD8D9'));
+assertEquals('"\\ud8da"', JSON.stringify('\uD8DA'));
+assertEquals('"\\ud8db"', JSON.stringify('\uD8DB'));
+assertEquals('"\\ud8dc"', JSON.stringify('\uD8DC'));
+assertEquals('"\\ud8dd"', JSON.stringify('\uD8DD'));
+assertEquals('"\\ud8de"', JSON.stringify('\uD8DE'));
+assertEquals('"\\ud8df"', JSON.stringify('\uD8DF'));
+assertEquals('"\\ud8e0"', JSON.stringify('\uD8E0'));
+assertEquals('"\\ud8e1"', JSON.stringify('\uD8E1'));
+assertEquals('"\\ud8e2"', JSON.stringify('\uD8E2'));
+assertEquals('"\\ud8e3"', JSON.stringify('\uD8E3'));
+assertEquals('"\\ud8e4"', JSON.stringify('\uD8E4'));
+assertEquals('"\\ud8e5"', JSON.stringify('\uD8E5'));
+assertEquals('"\\ud8e6"', JSON.stringify('\uD8E6'));
+assertEquals('"\\ud8e7"', JSON.stringify('\uD8E7'));
+assertEquals('"\\ud8e8"', JSON.stringify('\uD8E8'));
+assertEquals('"\\ud8e9"', JSON.stringify('\uD8E9'));
+assertEquals('"\\ud8ea"', JSON.stringify('\uD8EA'));
+assertEquals('"\\ud8eb"', JSON.stringify('\uD8EB'));
+assertEquals('"\\ud8ec"', JSON.stringify('\uD8EC'));
+assertEquals('"\\ud8ed"', JSON.stringify('\uD8ED'));
+assertEquals('"\\ud8ee"', JSON.stringify('\uD8EE'));
+assertEquals('"\\ud8ef"', JSON.stringify('\uD8EF'));
+assertEquals('"\\ud8f0"', JSON.stringify('\uD8F0'));
+assertEquals('"\\ud8f1"', JSON.stringify('\uD8F1'));
+assertEquals('"\\ud8f2"', JSON.stringify('\uD8F2'));
+assertEquals('"\\ud8f3"', JSON.stringify('\uD8F3'));
+assertEquals('"\\ud8f4"', JSON.stringify('\uD8F4'));
+assertEquals('"\\ud8f5"', JSON.stringify('\uD8F5'));
+assertEquals('"\\ud8f6"', JSON.stringify('\uD8F6'));
+assertEquals('"\\ud8f7"', JSON.stringify('\uD8F7'));
+assertEquals('"\\ud8f8"', JSON.stringify('\uD8F8'));
+assertEquals('"\\ud8f9"', JSON.stringify('\uD8F9'));
+assertEquals('"\\ud8fa"', JSON.stringify('\uD8FA'));
+assertEquals('"\\ud8fb"', JSON.stringify('\uD8FB'));
+assertEquals('"\\ud8fc"', JSON.stringify('\uD8FC'));
+assertEquals('"\\ud8fd"', JSON.stringify('\uD8FD'));
+assertEquals('"\\ud8fe"', JSON.stringify('\uD8FE'));
+assertEquals('"\\ud8ff"', JSON.stringify('\uD8FF'));
+assertEquals('"\\ud900"', JSON.stringify('\uD900'));
+assertEquals('"\\ud901"', JSON.stringify('\uD901'));
+assertEquals('"\\ud902"', JSON.stringify('\uD902'));
+assertEquals('"\\ud903"', JSON.stringify('\uD903'));
+assertEquals('"\\ud904"', JSON.stringify('\uD904'));
+assertEquals('"\\ud905"', JSON.stringify('\uD905'));
+assertEquals('"\\ud906"', JSON.stringify('\uD906'));
+assertEquals('"\\ud907"', JSON.stringify('\uD907'));
+assertEquals('"\\ud908"', JSON.stringify('\uD908'));
+assertEquals('"\\ud909"', JSON.stringify('\uD909'));
+assertEquals('"\\ud90a"', JSON.stringify('\uD90A'));
+assertEquals('"\\ud90b"', JSON.stringify('\uD90B'));
+assertEquals('"\\ud90c"', JSON.stringify('\uD90C'));
+assertEquals('"\\ud90d"', JSON.stringify('\uD90D'));
+assertEquals('"\\ud90e"', JSON.stringify('\uD90E'));
+assertEquals('"\\ud90f"', JSON.stringify('\uD90F'));
+assertEquals('"\\ud910"', JSON.stringify('\uD910'));
+assertEquals('"\\ud911"', JSON.stringify('\uD911'));
+assertEquals('"\\ud912"', JSON.stringify('\uD912'));
+assertEquals('"\\ud913"', JSON.stringify('\uD913'));
+assertEquals('"\\ud914"', JSON.stringify('\uD914'));
+assertEquals('"\\ud915"', JSON.stringify('\uD915'));
+assertEquals('"\\ud916"', JSON.stringify('\uD916'));
+assertEquals('"\\ud917"', JSON.stringify('\uD917'));
+assertEquals('"\\ud918"', JSON.stringify('\uD918'));
+assertEquals('"\\ud919"', JSON.stringify('\uD919'));
+assertEquals('"\\ud91a"', JSON.stringify('\uD91A'));
+assertEquals('"\\ud91b"', JSON.stringify('\uD91B'));
+assertEquals('"\\ud91c"', JSON.stringify('\uD91C'));
+assertEquals('"\\ud91d"', JSON.stringify('\uD91D'));
+assertEquals('"\\ud91e"', JSON.stringify('\uD91E'));
+assertEquals('"\\ud91f"', JSON.stringify('\uD91F'));
+assertEquals('"\\ud920"', JSON.stringify('\uD920'));
+assertEquals('"\\ud921"', JSON.stringify('\uD921'));
+assertEquals('"\\ud922"', JSON.stringify('\uD922'));
+assertEquals('"\\ud923"', JSON.stringify('\uD923'));
+assertEquals('"\\ud924"', JSON.stringify('\uD924'));
+assertEquals('"\\ud925"', JSON.stringify('\uD925'));
+assertEquals('"\\ud926"', JSON.stringify('\uD926'));
+assertEquals('"\\ud927"', JSON.stringify('\uD927'));
+assertEquals('"\\ud928"', JSON.stringify('\uD928'));
+assertEquals('"\\ud929"', JSON.stringify('\uD929'));
+assertEquals('"\\ud92a"', JSON.stringify('\uD92A'));
+assertEquals('"\\ud92b"', JSON.stringify('\uD92B'));
+assertEquals('"\\ud92c"', JSON.stringify('\uD92C'));
+assertEquals('"\\ud92d"', JSON.stringify('\uD92D'));
+assertEquals('"\\ud92e"', JSON.stringify('\uD92E'));
+assertEquals('"\\ud92f"', JSON.stringify('\uD92F'));
+assertEquals('"\\ud930"', JSON.stringify('\uD930'));
+assertEquals('"\\ud931"', JSON.stringify('\uD931'));
+assertEquals('"\\ud932"', JSON.stringify('\uD932'));
+assertEquals('"\\ud933"', JSON.stringify('\uD933'));
+assertEquals('"\\ud934"', JSON.stringify('\uD934'));
+assertEquals('"\\ud935"', JSON.stringify('\uD935'));
+assertEquals('"\\ud936"', JSON.stringify('\uD936'));
+assertEquals('"\\ud937"', JSON.stringify('\uD937'));
+assertEquals('"\\ud938"', JSON.stringify('\uD938'));
+assertEquals('"\\ud939"', JSON.stringify('\uD939'));
+assertEquals('"\\ud93a"', JSON.stringify('\uD93A'));
+assertEquals('"\\ud93b"', JSON.stringify('\uD93B'));
+assertEquals('"\\ud93c"', JSON.stringify('\uD93C'));
+assertEquals('"\\ud93d"', JSON.stringify('\uD93D'));
+assertEquals('"\\ud93e"', JSON.stringify('\uD93E'));
+assertEquals('"\\ud93f"', JSON.stringify('\uD93F'));
+assertEquals('"\\ud940"', JSON.stringify('\uD940'));
+assertEquals('"\\ud941"', JSON.stringify('\uD941'));
+assertEquals('"\\ud942"', JSON.stringify('\uD942'));
+assertEquals('"\\ud943"', JSON.stringify('\uD943'));
+assertEquals('"\\ud944"', JSON.stringify('\uD944'));
+assertEquals('"\\ud945"', JSON.stringify('\uD945'));
+assertEquals('"\\ud946"', JSON.stringify('\uD946'));
+assertEquals('"\\ud947"', JSON.stringify('\uD947'));
+assertEquals('"\\ud948"', JSON.stringify('\uD948'));
+assertEquals('"\\ud949"', JSON.stringify('\uD949'));
+assertEquals('"\\ud94a"', JSON.stringify('\uD94A'));
+assertEquals('"\\ud94b"', JSON.stringify('\uD94B'));
+assertEquals('"\\ud94c"', JSON.stringify('\uD94C'));
+assertEquals('"\\ud94d"', JSON.stringify('\uD94D'));
+assertEquals('"\\ud94e"', JSON.stringify('\uD94E'));
+assertEquals('"\\ud94f"', JSON.stringify('\uD94F'));
+assertEquals('"\\ud950"', JSON.stringify('\uD950'));
+assertEquals('"\\ud951"', JSON.stringify('\uD951'));
+assertEquals('"\\ud952"', JSON.stringify('\uD952'));
+assertEquals('"\\ud953"', JSON.stringify('\uD953'));
+assertEquals('"\\ud954"', JSON.stringify('\uD954'));
+assertEquals('"\\ud955"', JSON.stringify('\uD955'));
+assertEquals('"\\ud956"', JSON.stringify('\uD956'));
+assertEquals('"\\ud957"', JSON.stringify('\uD957'));
+assertEquals('"\\ud958"', JSON.stringify('\uD958'));
+assertEquals('"\\ud959"', JSON.stringify('\uD959'));
+assertEquals('"\\ud95a"', JSON.stringify('\uD95A'));
+assertEquals('"\\ud95b"', JSON.stringify('\uD95B'));
+assertEquals('"\\ud95c"', JSON.stringify('\uD95C'));
+assertEquals('"\\ud95d"', JSON.stringify('\uD95D'));
+assertEquals('"\\ud95e"', JSON.stringify('\uD95E'));
+assertEquals('"\\ud95f"', JSON.stringify('\uD95F'));
+assertEquals('"\\ud960"', JSON.stringify('\uD960'));
+assertEquals('"\\ud961"', JSON.stringify('\uD961'));
+assertEquals('"\\ud962"', JSON.stringify('\uD962'));
+assertEquals('"\\ud963"', JSON.stringify('\uD963'));
+assertEquals('"\\ud964"', JSON.stringify('\uD964'));
+assertEquals('"\\ud965"', JSON.stringify('\uD965'));
+assertEquals('"\\ud966"', JSON.stringify('\uD966'));
+assertEquals('"\\ud967"', JSON.stringify('\uD967'));
+assertEquals('"\\ud968"', JSON.stringify('\uD968'));
+assertEquals('"\\ud969"', JSON.stringify('\uD969'));
+assertEquals('"\\ud96a"', JSON.stringify('\uD96A'));
+assertEquals('"\\ud96b"', JSON.stringify('\uD96B'));
+assertEquals('"\\ud96c"', JSON.stringify('\uD96C'));
+assertEquals('"\\ud96d"', JSON.stringify('\uD96D'));
+assertEquals('"\\ud96e"', JSON.stringify('\uD96E'));
+assertEquals('"\\ud96f"', JSON.stringify('\uD96F'));
+assertEquals('"\\ud970"', JSON.stringify('\uD970'));
+assertEquals('"\\ud971"', JSON.stringify('\uD971'));
+assertEquals('"\\ud972"', JSON.stringify('\uD972'));
+assertEquals('"\\ud973"', JSON.stringify('\uD973'));
+assertEquals('"\\ud974"', JSON.stringify('\uD974'));
+assertEquals('"\\ud975"', JSON.stringify('\uD975'));
+assertEquals('"\\ud976"', JSON.stringify('\uD976'));
+assertEquals('"\\ud977"', JSON.stringify('\uD977'));
+assertEquals('"\\ud978"', JSON.stringify('\uD978'));
+assertEquals('"\\ud979"', JSON.stringify('\uD979'));
+assertEquals('"\\ud97a"', JSON.stringify('\uD97A'));
+assertEquals('"\\ud97b"', JSON.stringify('\uD97B'));
+assertEquals('"\\ud97c"', JSON.stringify('\uD97C'));
+assertEquals('"\\ud97d"', JSON.stringify('\uD97D'));
+assertEquals('"\\ud97e"', JSON.stringify('\uD97E'));
+assertEquals('"\\ud97f"', JSON.stringify('\uD97F'));
+assertEquals('"\\ud980"', JSON.stringify('\uD980'));
+assertEquals('"\\ud981"', JSON.stringify('\uD981'));
+assertEquals('"\\ud982"', JSON.stringify('\uD982'));
+assertEquals('"\\ud983"', JSON.stringify('\uD983'));
+assertEquals('"\\ud984"', JSON.stringify('\uD984'));
+assertEquals('"\\ud985"', JSON.stringify('\uD985'));
+assertEquals('"\\ud986"', JSON.stringify('\uD986'));
+assertEquals('"\\ud987"', JSON.stringify('\uD987'));
+assertEquals('"\\ud988"', JSON.stringify('\uD988'));
+assertEquals('"\\ud989"', JSON.stringify('\uD989'));
+assertEquals('"\\ud98a"', JSON.stringify('\uD98A'));
+assertEquals('"\\ud98b"', JSON.stringify('\uD98B'));
+assertEquals('"\\ud98c"', JSON.stringify('\uD98C'));
+assertEquals('"\\ud98d"', JSON.stringify('\uD98D'));
+assertEquals('"\\ud98e"', JSON.stringify('\uD98E'));
+assertEquals('"\\ud98f"', JSON.stringify('\uD98F'));
+assertEquals('"\\ud990"', JSON.stringify('\uD990'));
+assertEquals('"\\ud991"', JSON.stringify('\uD991'));
+assertEquals('"\\ud992"', JSON.stringify('\uD992'));
+assertEquals('"\\ud993"', JSON.stringify('\uD993'));
+assertEquals('"\\ud994"', JSON.stringify('\uD994'));
+assertEquals('"\\ud995"', JSON.stringify('\uD995'));
+assertEquals('"\\ud996"', JSON.stringify('\uD996'));
+assertEquals('"\\ud997"', JSON.stringify('\uD997'));
+assertEquals('"\\ud998"', JSON.stringify('\uD998'));
+assertEquals('"\\ud999"', JSON.stringify('\uD999'));
+assertEquals('"\\ud99a"', JSON.stringify('\uD99A'));
+assertEquals('"\\ud99b"', JSON.stringify('\uD99B'));
+assertEquals('"\\ud99c"', JSON.stringify('\uD99C'));
+assertEquals('"\\ud99d"', JSON.stringify('\uD99D'));
+assertEquals('"\\ud99e"', JSON.stringify('\uD99E'));
+assertEquals('"\\ud99f"', JSON.stringify('\uD99F'));
+assertEquals('"\\ud9a0"', JSON.stringify('\uD9A0'));
+assertEquals('"\\ud9a1"', JSON.stringify('\uD9A1'));
+assertEquals('"\\ud9a2"', JSON.stringify('\uD9A2'));
+assertEquals('"\\ud9a3"', JSON.stringify('\uD9A3'));
+assertEquals('"\\ud9a4"', JSON.stringify('\uD9A4'));
+assertEquals('"\\ud9a5"', JSON.stringify('\uD9A5'));
+assertEquals('"\\ud9a6"', JSON.stringify('\uD9A6'));
+assertEquals('"\\ud9a7"', JSON.stringify('\uD9A7'));
+assertEquals('"\\ud9a8"', JSON.stringify('\uD9A8'));
+assertEquals('"\\ud9a9"', JSON.stringify('\uD9A9'));
+assertEquals('"\\ud9aa"', JSON.stringify('\uD9AA'));
+assertEquals('"\\ud9ab"', JSON.stringify('\uD9AB'));
+assertEquals('"\\ud9ac"', JSON.stringify('\uD9AC'));
+assertEquals('"\\ud9ad"', JSON.stringify('\uD9AD'));
+assertEquals('"\\ud9ae"', JSON.stringify('\uD9AE'));
+assertEquals('"\\ud9af"', JSON.stringify('\uD9AF'));
+assertEquals('"\\ud9b0"', JSON.stringify('\uD9B0'));
+assertEquals('"\\ud9b1"', JSON.stringify('\uD9B1'));
+assertEquals('"\\ud9b2"', JSON.stringify('\uD9B2'));
+assertEquals('"\\ud9b3"', JSON.stringify('\uD9B3'));
+assertEquals('"\\ud9b4"', JSON.stringify('\uD9B4'));
+assertEquals('"\\ud9b5"', JSON.stringify('\uD9B5'));
+assertEquals('"\\ud9b6"', JSON.stringify('\uD9B6'));
+assertEquals('"\\ud9b7"', JSON.stringify('\uD9B7'));
+assertEquals('"\\ud9b8"', JSON.stringify('\uD9B8'));
+assertEquals('"\\ud9b9"', JSON.stringify('\uD9B9'));
+assertEquals('"\\ud9ba"', JSON.stringify('\uD9BA'));
+assertEquals('"\\ud9bb"', JSON.stringify('\uD9BB'));
+assertEquals('"\\ud9bc"', JSON.stringify('\uD9BC'));
+assertEquals('"\\ud9bd"', JSON.stringify('\uD9BD'));
+assertEquals('"\\ud9be"', JSON.stringify('\uD9BE'));
+assertEquals('"\\ud9bf"', JSON.stringify('\uD9BF'));
+assertEquals('"\\ud9c0"', JSON.stringify('\uD9C0'));
+assertEquals('"\\ud9c1"', JSON.stringify('\uD9C1'));
+assertEquals('"\\ud9c2"', JSON.stringify('\uD9C2'));
+assertEquals('"\\ud9c3"', JSON.stringify('\uD9C3'));
+assertEquals('"\\ud9c4"', JSON.stringify('\uD9C4'));
+assertEquals('"\\ud9c5"', JSON.stringify('\uD9C5'));
+assertEquals('"\\ud9c6"', JSON.stringify('\uD9C6'));
+assertEquals('"\\ud9c7"', JSON.stringify('\uD9C7'));
+assertEquals('"\\ud9c8"', JSON.stringify('\uD9C8'));
+assertEquals('"\\ud9c9"', JSON.stringify('\uD9C9'));
+assertEquals('"\\ud9ca"', JSON.stringify('\uD9CA'));
+assertEquals('"\\ud9cb"', JSON.stringify('\uD9CB'));
+assertEquals('"\\ud9cc"', JSON.stringify('\uD9CC'));
+assertEquals('"\\ud9cd"', JSON.stringify('\uD9CD'));
+assertEquals('"\\ud9ce"', JSON.stringify('\uD9CE'));
+assertEquals('"\\ud9cf"', JSON.stringify('\uD9CF'));
+assertEquals('"\\ud9d0"', JSON.stringify('\uD9D0'));
+assertEquals('"\\ud9d1"', JSON.stringify('\uD9D1'));
+assertEquals('"\\ud9d2"', JSON.stringify('\uD9D2'));
+assertEquals('"\\ud9d3"', JSON.stringify('\uD9D3'));
+assertEquals('"\\ud9d4"', JSON.stringify('\uD9D4'));
+assertEquals('"\\ud9d5"', JSON.stringify('\uD9D5'));
+assertEquals('"\\ud9d6"', JSON.stringify('\uD9D6'));
+assertEquals('"\\ud9d7"', JSON.stringify('\uD9D7'));
+assertEquals('"\\ud9d8"', JSON.stringify('\uD9D8'));
+assertEquals('"\\ud9d9"', JSON.stringify('\uD9D9'));
+assertEquals('"\\ud9da"', JSON.stringify('\uD9DA'));
+assertEquals('"\\ud9db"', JSON.stringify('\uD9DB'));
+assertEquals('"\\ud9dc"', JSON.stringify('\uD9DC'));
+assertEquals('"\\ud9dd"', JSON.stringify('\uD9DD'));
+assertEquals('"\\ud9de"', JSON.stringify('\uD9DE'));
+assertEquals('"\\ud9df"', JSON.stringify('\uD9DF'));
+assertEquals('"\\ud9e0"', JSON.stringify('\uD9E0'));
+assertEquals('"\\ud9e1"', JSON.stringify('\uD9E1'));
+assertEquals('"\\ud9e2"', JSON.stringify('\uD9E2'));
+assertEquals('"\\ud9e3"', JSON.stringify('\uD9E3'));
+assertEquals('"\\ud9e4"', JSON.stringify('\uD9E4'));
+assertEquals('"\\ud9e5"', JSON.stringify('\uD9E5'));
+assertEquals('"\\ud9e6"', JSON.stringify('\uD9E6'));
+assertEquals('"\\ud9e7"', JSON.stringify('\uD9E7'));
+assertEquals('"\\ud9e8"', JSON.stringify('\uD9E8'));
+assertEquals('"\\ud9e9"', JSON.stringify('\uD9E9'));
+assertEquals('"\\ud9ea"', JSON.stringify('\uD9EA'));
+assertEquals('"\\ud9eb"', JSON.stringify('\uD9EB'));
+assertEquals('"\\ud9ec"', JSON.stringify('\uD9EC'));
+assertEquals('"\\ud9ed"', JSON.stringify('\uD9ED'));
+assertEquals('"\\ud9ee"', JSON.stringify('\uD9EE'));
+assertEquals('"\\ud9ef"', JSON.stringify('\uD9EF'));
+assertEquals('"\\ud9f0"', JSON.stringify('\uD9F0'));
+assertEquals('"\\ud9f1"', JSON.stringify('\uD9F1'));
+assertEquals('"\\ud9f2"', JSON.stringify('\uD9F2'));
+assertEquals('"\\ud9f3"', JSON.stringify('\uD9F3'));
+assertEquals('"\\ud9f4"', JSON.stringify('\uD9F4'));
+assertEquals('"\\ud9f5"', JSON.stringify('\uD9F5'));
+assertEquals('"\\ud9f6"', JSON.stringify('\uD9F6'));
+assertEquals('"\\ud9f7"', JSON.stringify('\uD9F7'));
+assertEquals('"\\ud9f8"', JSON.stringify('\uD9F8'));
+assertEquals('"\\ud9f9"', JSON.stringify('\uD9F9'));
+assertEquals('"\\ud9fa"', JSON.stringify('\uD9FA'));
+assertEquals('"\\ud9fb"', JSON.stringify('\uD9FB'));
+assertEquals('"\\ud9fc"', JSON.stringify('\uD9FC'));
+assertEquals('"\\ud9fd"', JSON.stringify('\uD9FD'));
+assertEquals('"\\ud9fe"', JSON.stringify('\uD9FE'));
+assertEquals('"\\ud9ff"', JSON.stringify('\uD9FF'));
+assertEquals('"\\uda00"', JSON.stringify('\uDA00'));
+assertEquals('"\\uda01"', JSON.stringify('\uDA01'));
+assertEquals('"\\uda02"', JSON.stringify('\uDA02'));
+assertEquals('"\\uda03"', JSON.stringify('\uDA03'));
+assertEquals('"\\uda04"', JSON.stringify('\uDA04'));
+assertEquals('"\\uda05"', JSON.stringify('\uDA05'));
+assertEquals('"\\uda06"', JSON.stringify('\uDA06'));
+assertEquals('"\\uda07"', JSON.stringify('\uDA07'));
+assertEquals('"\\uda08"', JSON.stringify('\uDA08'));
+assertEquals('"\\uda09"', JSON.stringify('\uDA09'));
+assertEquals('"\\uda0a"', JSON.stringify('\uDA0A'));
+assertEquals('"\\uda0b"', JSON.stringify('\uDA0B'));
+assertEquals('"\\uda0c"', JSON.stringify('\uDA0C'));
+assertEquals('"\\uda0d"', JSON.stringify('\uDA0D'));
+assertEquals('"\\uda0e"', JSON.stringify('\uDA0E'));
+assertEquals('"\\uda0f"', JSON.stringify('\uDA0F'));
+assertEquals('"\\uda10"', JSON.stringify('\uDA10'));
+assertEquals('"\\uda11"', JSON.stringify('\uDA11'));
+assertEquals('"\\uda12"', JSON.stringify('\uDA12'));
+assertEquals('"\\uda13"', JSON.stringify('\uDA13'));
+assertEquals('"\\uda14"', JSON.stringify('\uDA14'));
+assertEquals('"\\uda15"', JSON.stringify('\uDA15'));
+assertEquals('"\\uda16"', JSON.stringify('\uDA16'));
+assertEquals('"\\uda17"', JSON.stringify('\uDA17'));
+assertEquals('"\\uda18"', JSON.stringify('\uDA18'));
+assertEquals('"\\uda19"', JSON.stringify('\uDA19'));
+assertEquals('"\\uda1a"', JSON.stringify('\uDA1A'));
+assertEquals('"\\uda1b"', JSON.stringify('\uDA1B'));
+assertEquals('"\\uda1c"', JSON.stringify('\uDA1C'));
+assertEquals('"\\uda1d"', JSON.stringify('\uDA1D'));
+assertEquals('"\\uda1e"', JSON.stringify('\uDA1E'));
+assertEquals('"\\uda1f"', JSON.stringify('\uDA1F'));
+assertEquals('"\\uda20"', JSON.stringify('\uDA20'));
+assertEquals('"\\uda21"', JSON.stringify('\uDA21'));
+assertEquals('"\\uda22"', JSON.stringify('\uDA22'));
+assertEquals('"\\uda23"', JSON.stringify('\uDA23'));
+assertEquals('"\\uda24"', JSON.stringify('\uDA24'));
+assertEquals('"\\uda25"', JSON.stringify('\uDA25'));
+assertEquals('"\\uda26"', JSON.stringify('\uDA26'));
+assertEquals('"\\uda27"', JSON.stringify('\uDA27'));
+assertEquals('"\\uda28"', JSON.stringify('\uDA28'));
+assertEquals('"\\uda29"', JSON.stringify('\uDA29'));
+assertEquals('"\\uda2a"', JSON.stringify('\uDA2A'));
+assertEquals('"\\uda2b"', JSON.stringify('\uDA2B'));
+assertEquals('"\\uda2c"', JSON.stringify('\uDA2C'));
+assertEquals('"\\uda2d"', JSON.stringify('\uDA2D'));
+assertEquals('"\\uda2e"', JSON.stringify('\uDA2E'));
+assertEquals('"\\uda2f"', JSON.stringify('\uDA2F'));
+assertEquals('"\\uda30"', JSON.stringify('\uDA30'));
+assertEquals('"\\uda31"', JSON.stringify('\uDA31'));
+assertEquals('"\\uda32"', JSON.stringify('\uDA32'));
+assertEquals('"\\uda33"', JSON.stringify('\uDA33'));
+assertEquals('"\\uda34"', JSON.stringify('\uDA34'));
+assertEquals('"\\uda35"', JSON.stringify('\uDA35'));
+assertEquals('"\\uda36"', JSON.stringify('\uDA36'));
+assertEquals('"\\uda37"', JSON.stringify('\uDA37'));
+assertEquals('"\\uda38"', JSON.stringify('\uDA38'));
+assertEquals('"\\uda39"', JSON.stringify('\uDA39'));
+assertEquals('"\\uda3a"', JSON.stringify('\uDA3A'));
+assertEquals('"\\uda3b"', JSON.stringify('\uDA3B'));
+assertEquals('"\\uda3c"', JSON.stringify('\uDA3C'));
+assertEquals('"\\uda3d"', JSON.stringify('\uDA3D'));
+assertEquals('"\\uda3e"', JSON.stringify('\uDA3E'));
+assertEquals('"\\uda3f"', JSON.stringify('\uDA3F'));
+assertEquals('"\\uda40"', JSON.stringify('\uDA40'));
+assertEquals('"\\uda41"', JSON.stringify('\uDA41'));
+assertEquals('"\\uda42"', JSON.stringify('\uDA42'));
+assertEquals('"\\uda43"', JSON.stringify('\uDA43'));
+assertEquals('"\\uda44"', JSON.stringify('\uDA44'));
+assertEquals('"\\uda45"', JSON.stringify('\uDA45'));
+assertEquals('"\\uda46"', JSON.stringify('\uDA46'));
+assertEquals('"\\uda47"', JSON.stringify('\uDA47'));
+assertEquals('"\\uda48"', JSON.stringify('\uDA48'));
+assertEquals('"\\uda49"', JSON.stringify('\uDA49'));
+assertEquals('"\\uda4a"', JSON.stringify('\uDA4A'));
+assertEquals('"\\uda4b"', JSON.stringify('\uDA4B'));
+assertEquals('"\\uda4c"', JSON.stringify('\uDA4C'));
+assertEquals('"\\uda4d"', JSON.stringify('\uDA4D'));
+assertEquals('"\\uda4e"', JSON.stringify('\uDA4E'));
+assertEquals('"\\uda4f"', JSON.stringify('\uDA4F'));
+assertEquals('"\\uda50"', JSON.stringify('\uDA50'));
+assertEquals('"\\uda51"', JSON.stringify('\uDA51'));
+assertEquals('"\\uda52"', JSON.stringify('\uDA52'));
+assertEquals('"\\uda53"', JSON.stringify('\uDA53'));
+assertEquals('"\\uda54"', JSON.stringify('\uDA54'));
+assertEquals('"\\uda55"', JSON.stringify('\uDA55'));
+assertEquals('"\\uda56"', JSON.stringify('\uDA56'));
+assertEquals('"\\uda57"', JSON.stringify('\uDA57'));
+assertEquals('"\\uda58"', JSON.stringify('\uDA58'));
+assertEquals('"\\uda59"', JSON.stringify('\uDA59'));
+assertEquals('"\\uda5a"', JSON.stringify('\uDA5A'));
+assertEquals('"\\uda5b"', JSON.stringify('\uDA5B'));
+assertEquals('"\\uda5c"', JSON.stringify('\uDA5C'));
+assertEquals('"\\uda5d"', JSON.stringify('\uDA5D'));
+assertEquals('"\\uda5e"', JSON.stringify('\uDA5E'));
+assertEquals('"\\uda5f"', JSON.stringify('\uDA5F'));
+assertEquals('"\\uda60"', JSON.stringify('\uDA60'));
+assertEquals('"\\uda61"', JSON.stringify('\uDA61'));
+assertEquals('"\\uda62"', JSON.stringify('\uDA62'));
+assertEquals('"\\uda63"', JSON.stringify('\uDA63'));
+assertEquals('"\\uda64"', JSON.stringify('\uDA64'));
+assertEquals('"\\uda65"', JSON.stringify('\uDA65'));
+assertEquals('"\\uda66"', JSON.stringify('\uDA66'));
+assertEquals('"\\uda67"', JSON.stringify('\uDA67'));
+assertEquals('"\\uda68"', JSON.stringify('\uDA68'));
+assertEquals('"\\uda69"', JSON.stringify('\uDA69'));
+assertEquals('"\\uda6a"', JSON.stringify('\uDA6A'));
+assertEquals('"\\uda6b"', JSON.stringify('\uDA6B'));
+assertEquals('"\\uda6c"', JSON.stringify('\uDA6C'));
+assertEquals('"\\uda6d"', JSON.stringify('\uDA6D'));
+assertEquals('"\\uda6e"', JSON.stringify('\uDA6E'));
+assertEquals('"\\uda6f"', JSON.stringify('\uDA6F'));
+assertEquals('"\\uda70"', JSON.stringify('\uDA70'));
+assertEquals('"\\uda71"', JSON.stringify('\uDA71'));
+assertEquals('"\\uda72"', JSON.stringify('\uDA72'));
+assertEquals('"\\uda73"', JSON.stringify('\uDA73'));
+assertEquals('"\\uda74"', JSON.stringify('\uDA74'));
+assertEquals('"\\uda75"', JSON.stringify('\uDA75'));
+assertEquals('"\\uda76"', JSON.stringify('\uDA76'));
+assertEquals('"\\uda77"', JSON.stringify('\uDA77'));
+assertEquals('"\\uda78"', JSON.stringify('\uDA78'));
+assertEquals('"\\uda79"', JSON.stringify('\uDA79'));
+assertEquals('"\\uda7a"', JSON.stringify('\uDA7A'));
+assertEquals('"\\uda7b"', JSON.stringify('\uDA7B'));
+assertEquals('"\\uda7c"', JSON.stringify('\uDA7C'));
+assertEquals('"\\uda7d"', JSON.stringify('\uDA7D'));
+assertEquals('"\\uda7e"', JSON.stringify('\uDA7E'));
+assertEquals('"\\uda7f"', JSON.stringify('\uDA7F'));
+assertEquals('"\\uda80"', JSON.stringify('\uDA80'));
+assertEquals('"\\uda81"', JSON.stringify('\uDA81'));
+assertEquals('"\\uda82"', JSON.stringify('\uDA82'));
+assertEquals('"\\uda83"', JSON.stringify('\uDA83'));
+assertEquals('"\\uda84"', JSON.stringify('\uDA84'));
+assertEquals('"\\uda85"', JSON.stringify('\uDA85'));
+assertEquals('"\\uda86"', JSON.stringify('\uDA86'));
+assertEquals('"\\uda87"', JSON.stringify('\uDA87'));
+assertEquals('"\\uda88"', JSON.stringify('\uDA88'));
+assertEquals('"\\uda89"', JSON.stringify('\uDA89'));
+assertEquals('"\\uda8a"', JSON.stringify('\uDA8A'));
+assertEquals('"\\uda8b"', JSON.stringify('\uDA8B'));
+assertEquals('"\\uda8c"', JSON.stringify('\uDA8C'));
+assertEquals('"\\uda8d"', JSON.stringify('\uDA8D'));
+assertEquals('"\\uda8e"', JSON.stringify('\uDA8E'));
+assertEquals('"\\uda8f"', JSON.stringify('\uDA8F'));
+assertEquals('"\\uda90"', JSON.stringify('\uDA90'));
+assertEquals('"\\uda91"', JSON.stringify('\uDA91'));
+assertEquals('"\\uda92"', JSON.stringify('\uDA92'));
+assertEquals('"\\uda93"', JSON.stringify('\uDA93'));
+assertEquals('"\\uda94"', JSON.stringify('\uDA94'));
+assertEquals('"\\uda95"', JSON.stringify('\uDA95'));
+assertEquals('"\\uda96"', JSON.stringify('\uDA96'));
+assertEquals('"\\uda97"', JSON.stringify('\uDA97'));
+assertEquals('"\\uda98"', JSON.stringify('\uDA98'));
+assertEquals('"\\uda99"', JSON.stringify('\uDA99'));
+assertEquals('"\\uda9a"', JSON.stringify('\uDA9A'));
+assertEquals('"\\uda9b"', JSON.stringify('\uDA9B'));
+assertEquals('"\\uda9c"', JSON.stringify('\uDA9C'));
+assertEquals('"\\uda9d"', JSON.stringify('\uDA9D'));
+assertEquals('"\\uda9e"', JSON.stringify('\uDA9E'));
+assertEquals('"\\uda9f"', JSON.stringify('\uDA9F'));
+assertEquals('"\\udaa0"', JSON.stringify('\uDAA0'));
+assertEquals('"\\udaa1"', JSON.stringify('\uDAA1'));
+assertEquals('"\\udaa2"', JSON.stringify('\uDAA2'));
+assertEquals('"\\udaa3"', JSON.stringify('\uDAA3'));
+assertEquals('"\\udaa4"', JSON.stringify('\uDAA4'));
+assertEquals('"\\udaa5"', JSON.stringify('\uDAA5'));
+assertEquals('"\\udaa6"', JSON.stringify('\uDAA6'));
+assertEquals('"\\udaa7"', JSON.stringify('\uDAA7'));
+assertEquals('"\\udaa8"', JSON.stringify('\uDAA8'));
+assertEquals('"\\udaa9"', JSON.stringify('\uDAA9'));
+assertEquals('"\\udaaa"', JSON.stringify('\uDAAA'));
+assertEquals('"\\udaab"', JSON.stringify('\uDAAB'));
+assertEquals('"\\udaac"', JSON.stringify('\uDAAC'));
+assertEquals('"\\udaad"', JSON.stringify('\uDAAD'));
+assertEquals('"\\udaae"', JSON.stringify('\uDAAE'));
+assertEquals('"\\udaaf"', JSON.stringify('\uDAAF'));
+assertEquals('"\\udab0"', JSON.stringify('\uDAB0'));
+assertEquals('"\\udab1"', JSON.stringify('\uDAB1'));
+assertEquals('"\\udab2"', JSON.stringify('\uDAB2'));
+assertEquals('"\\udab3"', JSON.stringify('\uDAB3'));
+assertEquals('"\\udab4"', JSON.stringify('\uDAB4'));
+assertEquals('"\\udab5"', JSON.stringify('\uDAB5'));
+assertEquals('"\\udab6"', JSON.stringify('\uDAB6'));
+assertEquals('"\\udab7"', JSON.stringify('\uDAB7'));
+assertEquals('"\\udab8"', JSON.stringify('\uDAB8'));
+assertEquals('"\\udab9"', JSON.stringify('\uDAB9'));
+assertEquals('"\\udaba"', JSON.stringify('\uDABA'));
+assertEquals('"\\udabb"', JSON.stringify('\uDABB'));
+assertEquals('"\\udabc"', JSON.stringify('\uDABC'));
+assertEquals('"\\udabd"', JSON.stringify('\uDABD'));
+assertEquals('"\\udabe"', JSON.stringify('\uDABE'));
+assertEquals('"\\udabf"', JSON.stringify('\uDABF'));
+assertEquals('"\\udac0"', JSON.stringify('\uDAC0'));
+assertEquals('"\\udac1"', JSON.stringify('\uDAC1'));
+assertEquals('"\\udac2"', JSON.stringify('\uDAC2'));
+assertEquals('"\\udac3"', JSON.stringify('\uDAC3'));
+assertEquals('"\\udac4"', JSON.stringify('\uDAC4'));
+assertEquals('"\\udac5"', JSON.stringify('\uDAC5'));
+assertEquals('"\\udac6"', JSON.stringify('\uDAC6'));
+assertEquals('"\\udac7"', JSON.stringify('\uDAC7'));
+assertEquals('"\\udac8"', JSON.stringify('\uDAC8'));
+assertEquals('"\\udac9"', JSON.stringify('\uDAC9'));
+assertEquals('"\\udaca"', JSON.stringify('\uDACA'));
+assertEquals('"\\udacb"', JSON.stringify('\uDACB'));
+assertEquals('"\\udacc"', JSON.stringify('\uDACC'));
+assertEquals('"\\udacd"', JSON.stringify('\uDACD'));
+assertEquals('"\\udace"', JSON.stringify('\uDACE'));
+assertEquals('"\\udacf"', JSON.stringify('\uDACF'));
+assertEquals('"\\udad0"', JSON.stringify('\uDAD0'));
+assertEquals('"\\udad1"', JSON.stringify('\uDAD1'));
+assertEquals('"\\udad2"', JSON.stringify('\uDAD2'));
+assertEquals('"\\udad3"', JSON.stringify('\uDAD3'));
+assertEquals('"\\udad4"', JSON.stringify('\uDAD4'));
+assertEquals('"\\udad5"', JSON.stringify('\uDAD5'));
+assertEquals('"\\udad6"', JSON.stringify('\uDAD6'));
+assertEquals('"\\udad7"', JSON.stringify('\uDAD7'));
+assertEquals('"\\udad8"', JSON.stringify('\uDAD8'));
+assertEquals('"\\udad9"', JSON.stringify('\uDAD9'));
+assertEquals('"\\udada"', JSON.stringify('\uDADA'));
+assertEquals('"\\udadb"', JSON.stringify('\uDADB'));
+assertEquals('"\\udadc"', JSON.stringify('\uDADC'));
+assertEquals('"\\udadd"', JSON.stringify('\uDADD'));
+assertEquals('"\\udade"', JSON.stringify('\uDADE'));
+assertEquals('"\\udadf"', JSON.stringify('\uDADF'));
+assertEquals('"\\udae0"', JSON.stringify('\uDAE0'));
+assertEquals('"\\udae1"', JSON.stringify('\uDAE1'));
+assertEquals('"\\udae2"', JSON.stringify('\uDAE2'));
+assertEquals('"\\udae3"', JSON.stringify('\uDAE3'));
+assertEquals('"\\udae4"', JSON.stringify('\uDAE4'));
+assertEquals('"\\udae5"', JSON.stringify('\uDAE5'));
+assertEquals('"\\udae6"', JSON.stringify('\uDAE6'));
+assertEquals('"\\udae7"', JSON.stringify('\uDAE7'));
+assertEquals('"\\udae8"', JSON.stringify('\uDAE8'));
+assertEquals('"\\udae9"', JSON.stringify('\uDAE9'));
+assertEquals('"\\udaea"', JSON.stringify('\uDAEA'));
+assertEquals('"\\udaeb"', JSON.stringify('\uDAEB'));
+assertEquals('"\\udaec"', JSON.stringify('\uDAEC'));
+assertEquals('"\\udaed"', JSON.stringify('\uDAED'));
+assertEquals('"\\udaee"', JSON.stringify('\uDAEE'));
+assertEquals('"\\udaef"', JSON.stringify('\uDAEF'));
+assertEquals('"\\udaf0"', JSON.stringify('\uDAF0'));
+assertEquals('"\\udaf1"', JSON.stringify('\uDAF1'));
+assertEquals('"\\udaf2"', JSON.stringify('\uDAF2'));
+assertEquals('"\\udaf3"', JSON.stringify('\uDAF3'));
+assertEquals('"\\udaf4"', JSON.stringify('\uDAF4'));
+assertEquals('"\\udaf5"', JSON.stringify('\uDAF5'));
+assertEquals('"\\udaf6"', JSON.stringify('\uDAF6'));
+assertEquals('"\\udaf7"', JSON.stringify('\uDAF7'));
+assertEquals('"\\udaf8"', JSON.stringify('\uDAF8'));
+assertEquals('"\\udaf9"', JSON.stringify('\uDAF9'));
+assertEquals('"\\udafa"', JSON.stringify('\uDAFA'));
+assertEquals('"\\udafb"', JSON.stringify('\uDAFB'));
+assertEquals('"\\udafc"', JSON.stringify('\uDAFC'));
+assertEquals('"\\udafd"', JSON.stringify('\uDAFD'));
+assertEquals('"\\udafe"', JSON.stringify('\uDAFE'));
+assertEquals('"\\udaff"', JSON.stringify('\uDAFF'));
+assertEquals('"\\udb00"', JSON.stringify('\uDB00'));
+assertEquals('"\\udb01"', JSON.stringify('\uDB01'));
+assertEquals('"\\udb02"', JSON.stringify('\uDB02'));
+assertEquals('"\\udb03"', JSON.stringify('\uDB03'));
+assertEquals('"\\udb04"', JSON.stringify('\uDB04'));
+assertEquals('"\\udb05"', JSON.stringify('\uDB05'));
+assertEquals('"\\udb06"', JSON.stringify('\uDB06'));
+assertEquals('"\\udb07"', JSON.stringify('\uDB07'));
+assertEquals('"\\udb08"', JSON.stringify('\uDB08'));
+assertEquals('"\\udb09"', JSON.stringify('\uDB09'));
+assertEquals('"\\udb0a"', JSON.stringify('\uDB0A'));
+assertEquals('"\\udb0b"', JSON.stringify('\uDB0B'));
+assertEquals('"\\udb0c"', JSON.stringify('\uDB0C'));
+assertEquals('"\\udb0d"', JSON.stringify('\uDB0D'));
+assertEquals('"\\udb0e"', JSON.stringify('\uDB0E'));
+assertEquals('"\\udb0f"', JSON.stringify('\uDB0F'));
+assertEquals('"\\udb10"', JSON.stringify('\uDB10'));
+assertEquals('"\\udb11"', JSON.stringify('\uDB11'));
+assertEquals('"\\udb12"', JSON.stringify('\uDB12'));
+assertEquals('"\\udb13"', JSON.stringify('\uDB13'));
+assertEquals('"\\udb14"', JSON.stringify('\uDB14'));
+assertEquals('"\\udb15"', JSON.stringify('\uDB15'));
+assertEquals('"\\udb16"', JSON.stringify('\uDB16'));
+assertEquals('"\\udb17"', JSON.stringify('\uDB17'));
+assertEquals('"\\udb18"', JSON.stringify('\uDB18'));
+assertEquals('"\\udb19"', JSON.stringify('\uDB19'));
+assertEquals('"\\udb1a"', JSON.stringify('\uDB1A'));
+assertEquals('"\\udb1b"', JSON.stringify('\uDB1B'));
+assertEquals('"\\udb1c"', JSON.stringify('\uDB1C'));
+assertEquals('"\\udb1d"', JSON.stringify('\uDB1D'));
+assertEquals('"\\udb1e"', JSON.stringify('\uDB1E'));
+assertEquals('"\\udb1f"', JSON.stringify('\uDB1F'));
+assertEquals('"\\udb20"', JSON.stringify('\uDB20'));
+assertEquals('"\\udb21"', JSON.stringify('\uDB21'));
+assertEquals('"\\udb22"', JSON.stringify('\uDB22'));
+assertEquals('"\\udb23"', JSON.stringify('\uDB23'));
+assertEquals('"\\udb24"', JSON.stringify('\uDB24'));
+assertEquals('"\\udb25"', JSON.stringify('\uDB25'));
+assertEquals('"\\udb26"', JSON.stringify('\uDB26'));
+assertEquals('"\\udb27"', JSON.stringify('\uDB27'));
+assertEquals('"\\udb28"', JSON.stringify('\uDB28'));
+assertEquals('"\\udb29"', JSON.stringify('\uDB29'));
+assertEquals('"\\udb2a"', JSON.stringify('\uDB2A'));
+assertEquals('"\\udb2b"', JSON.stringify('\uDB2B'));
+assertEquals('"\\udb2c"', JSON.stringify('\uDB2C'));
+assertEquals('"\\udb2d"', JSON.stringify('\uDB2D'));
+assertEquals('"\\udb2e"', JSON.stringify('\uDB2E'));
+assertEquals('"\\udb2f"', JSON.stringify('\uDB2F'));
+assertEquals('"\\udb30"', JSON.stringify('\uDB30'));
+assertEquals('"\\udb31"', JSON.stringify('\uDB31'));
+assertEquals('"\\udb32"', JSON.stringify('\uDB32'));
+assertEquals('"\\udb33"', JSON.stringify('\uDB33'));
+assertEquals('"\\udb34"', JSON.stringify('\uDB34'));
+assertEquals('"\\udb35"', JSON.stringify('\uDB35'));
+assertEquals('"\\udb36"', JSON.stringify('\uDB36'));
+assertEquals('"\\udb37"', JSON.stringify('\uDB37'));
+assertEquals('"\\udb38"', JSON.stringify('\uDB38'));
+assertEquals('"\\udb39"', JSON.stringify('\uDB39'));
+assertEquals('"\\udb3a"', JSON.stringify('\uDB3A'));
+assertEquals('"\\udb3b"', JSON.stringify('\uDB3B'));
+assertEquals('"\\udb3c"', JSON.stringify('\uDB3C'));
+assertEquals('"\\udb3d"', JSON.stringify('\uDB3D'));
+assertEquals('"\\udb3e"', JSON.stringify('\uDB3E'));
+assertEquals('"\\udb3f"', JSON.stringify('\uDB3F'));
+assertEquals('"\\udb40"', JSON.stringify('\uDB40'));
+assertEquals('"\\udb41"', JSON.stringify('\uDB41'));
+assertEquals('"\\udb42"', JSON.stringify('\uDB42'));
+assertEquals('"\\udb43"', JSON.stringify('\uDB43'));
+assertEquals('"\\udb44"', JSON.stringify('\uDB44'));
+assertEquals('"\\udb45"', JSON.stringify('\uDB45'));
+assertEquals('"\\udb46"', JSON.stringify('\uDB46'));
+assertEquals('"\\udb47"', JSON.stringify('\uDB47'));
+assertEquals('"\\udb48"', JSON.stringify('\uDB48'));
+assertEquals('"\\udb49"', JSON.stringify('\uDB49'));
+assertEquals('"\\udb4a"', JSON.stringify('\uDB4A'));
+assertEquals('"\\udb4b"', JSON.stringify('\uDB4B'));
+assertEquals('"\\udb4c"', JSON.stringify('\uDB4C'));
+assertEquals('"\\udb4d"', JSON.stringify('\uDB4D'));
+assertEquals('"\\udb4e"', JSON.stringify('\uDB4E'));
+assertEquals('"\\udb4f"', JSON.stringify('\uDB4F'));
+assertEquals('"\\udb50"', JSON.stringify('\uDB50'));
+assertEquals('"\\udb51"', JSON.stringify('\uDB51'));
+assertEquals('"\\udb52"', JSON.stringify('\uDB52'));
+assertEquals('"\\udb53"', JSON.stringify('\uDB53'));
+assertEquals('"\\udb54"', JSON.stringify('\uDB54'));
+assertEquals('"\\udb55"', JSON.stringify('\uDB55'));
+assertEquals('"\\udb56"', JSON.stringify('\uDB56'));
+assertEquals('"\\udb57"', JSON.stringify('\uDB57'));
+assertEquals('"\\udb58"', JSON.stringify('\uDB58'));
+assertEquals('"\\udb59"', JSON.stringify('\uDB59'));
+assertEquals('"\\udb5a"', JSON.stringify('\uDB5A'));
+assertEquals('"\\udb5b"', JSON.stringify('\uDB5B'));
+assertEquals('"\\udb5c"', JSON.stringify('\uDB5C'));
+assertEquals('"\\udb5d"', JSON.stringify('\uDB5D'));
+assertEquals('"\\udb5e"', JSON.stringify('\uDB5E'));
+assertEquals('"\\udb5f"', JSON.stringify('\uDB5F'));
+assertEquals('"\\udb60"', JSON.stringify('\uDB60'));
+assertEquals('"\\udb61"', JSON.stringify('\uDB61'));
+assertEquals('"\\udb62"', JSON.stringify('\uDB62'));
+assertEquals('"\\udb63"', JSON.stringify('\uDB63'));
+assertEquals('"\\udb64"', JSON.stringify('\uDB64'));
+assertEquals('"\\udb65"', JSON.stringify('\uDB65'));
+assertEquals('"\\udb66"', JSON.stringify('\uDB66'));
+assertEquals('"\\udb67"', JSON.stringify('\uDB67'));
+assertEquals('"\\udb68"', JSON.stringify('\uDB68'));
+assertEquals('"\\udb69"', JSON.stringify('\uDB69'));
+assertEquals('"\\udb6a"', JSON.stringify('\uDB6A'));
+assertEquals('"\\udb6b"', JSON.stringify('\uDB6B'));
+assertEquals('"\\udb6c"', JSON.stringify('\uDB6C'));
+assertEquals('"\\udb6d"', JSON.stringify('\uDB6D'));
+assertEquals('"\\udb6e"', JSON.stringify('\uDB6E'));
+assertEquals('"\\udb6f"', JSON.stringify('\uDB6F'));
+assertEquals('"\\udb70"', JSON.stringify('\uDB70'));
+assertEquals('"\\udb71"', JSON.stringify('\uDB71'));
+assertEquals('"\\udb72"', JSON.stringify('\uDB72'));
+assertEquals('"\\udb73"', JSON.stringify('\uDB73'));
+assertEquals('"\\udb74"', JSON.stringify('\uDB74'));
+assertEquals('"\\udb75"', JSON.stringify('\uDB75'));
+assertEquals('"\\udb76"', JSON.stringify('\uDB76'));
+assertEquals('"\\udb77"', JSON.stringify('\uDB77'));
+assertEquals('"\\udb78"', JSON.stringify('\uDB78'));
+assertEquals('"\\udb79"', JSON.stringify('\uDB79'));
+assertEquals('"\\udb7a"', JSON.stringify('\uDB7A'));
+assertEquals('"\\udb7b"', JSON.stringify('\uDB7B'));
+assertEquals('"\\udb7c"', JSON.stringify('\uDB7C'));
+assertEquals('"\\udb7d"', JSON.stringify('\uDB7D'));
+assertEquals('"\\udb7e"', JSON.stringify('\uDB7E'));
+assertEquals('"\\udb7f"', JSON.stringify('\uDB7F'));
+assertEquals('"\\udb80"', JSON.stringify('\uDB80'));
+assertEquals('"\\udb81"', JSON.stringify('\uDB81'));
+assertEquals('"\\udb82"', JSON.stringify('\uDB82'));
+assertEquals('"\\udb83"', JSON.stringify('\uDB83'));
+assertEquals('"\\udb84"', JSON.stringify('\uDB84'));
+assertEquals('"\\udb85"', JSON.stringify('\uDB85'));
+assertEquals('"\\udb86"', JSON.stringify('\uDB86'));
+assertEquals('"\\udb87"', JSON.stringify('\uDB87'));
+assertEquals('"\\udb88"', JSON.stringify('\uDB88'));
+assertEquals('"\\udb89"', JSON.stringify('\uDB89'));
+assertEquals('"\\udb8a"', JSON.stringify('\uDB8A'));
+assertEquals('"\\udb8b"', JSON.stringify('\uDB8B'));
+assertEquals('"\\udb8c"', JSON.stringify('\uDB8C'));
+assertEquals('"\\udb8d"', JSON.stringify('\uDB8D'));
+assertEquals('"\\udb8e"', JSON.stringify('\uDB8E'));
+assertEquals('"\\udb8f"', JSON.stringify('\uDB8F'));
+assertEquals('"\\udb90"', JSON.stringify('\uDB90'));
+assertEquals('"\\udb91"', JSON.stringify('\uDB91'));
+assertEquals('"\\udb92"', JSON.stringify('\uDB92'));
+assertEquals('"\\udb93"', JSON.stringify('\uDB93'));
+assertEquals('"\\udb94"', JSON.stringify('\uDB94'));
+assertEquals('"\\udb95"', JSON.stringify('\uDB95'));
+assertEquals('"\\udb96"', JSON.stringify('\uDB96'));
+assertEquals('"\\udb97"', JSON.stringify('\uDB97'));
+assertEquals('"\\udb98"', JSON.stringify('\uDB98'));
+assertEquals('"\\udb99"', JSON.stringify('\uDB99'));
+assertEquals('"\\udb9a"', JSON.stringify('\uDB9A'));
+assertEquals('"\\udb9b"', JSON.stringify('\uDB9B'));
+assertEquals('"\\udb9c"', JSON.stringify('\uDB9C'));
+assertEquals('"\\udb9d"', JSON.stringify('\uDB9D'));
+assertEquals('"\\udb9e"', JSON.stringify('\uDB9E'));
+assertEquals('"\\udb9f"', JSON.stringify('\uDB9F'));
+assertEquals('"\\udba0"', JSON.stringify('\uDBA0'));
+assertEquals('"\\udba1"', JSON.stringify('\uDBA1'));
+assertEquals('"\\udba2"', JSON.stringify('\uDBA2'));
+assertEquals('"\\udba3"', JSON.stringify('\uDBA3'));
+assertEquals('"\\udba4"', JSON.stringify('\uDBA4'));
+assertEquals('"\\udba5"', JSON.stringify('\uDBA5'));
+assertEquals('"\\udba6"', JSON.stringify('\uDBA6'));
+assertEquals('"\\udba7"', JSON.stringify('\uDBA7'));
+assertEquals('"\\udba8"', JSON.stringify('\uDBA8'));
+assertEquals('"\\udba9"', JSON.stringify('\uDBA9'));
+assertEquals('"\\udbaa"', JSON.stringify('\uDBAA'));
+assertEquals('"\\udbab"', JSON.stringify('\uDBAB'));
+assertEquals('"\\udbac"', JSON.stringify('\uDBAC'));
+assertEquals('"\\udbad"', JSON.stringify('\uDBAD'));
+assertEquals('"\\udbae"', JSON.stringify('\uDBAE'));
+assertEquals('"\\udbaf"', JSON.stringify('\uDBAF'));
+assertEquals('"\\udbb0"', JSON.stringify('\uDBB0'));
+assertEquals('"\\udbb1"', JSON.stringify('\uDBB1'));
+assertEquals('"\\udbb2"', JSON.stringify('\uDBB2'));
+assertEquals('"\\udbb3"', JSON.stringify('\uDBB3'));
+assertEquals('"\\udbb4"', JSON.stringify('\uDBB4'));
+assertEquals('"\\udbb5"', JSON.stringify('\uDBB5'));
+assertEquals('"\\udbb6"', JSON.stringify('\uDBB6'));
+assertEquals('"\\udbb7"', JSON.stringify('\uDBB7'));
+assertEquals('"\\udbb8"', JSON.stringify('\uDBB8'));
+assertEquals('"\\udbb9"', JSON.stringify('\uDBB9'));
+assertEquals('"\\udbba"', JSON.stringify('\uDBBA'));
+assertEquals('"\\udbbb"', JSON.stringify('\uDBBB'));
+assertEquals('"\\udbbc"', JSON.stringify('\uDBBC'));
+assertEquals('"\\udbbd"', JSON.stringify('\uDBBD'));
+assertEquals('"\\udbbe"', JSON.stringify('\uDBBE'));
+assertEquals('"\\udbbf"', JSON.stringify('\uDBBF'));
+assertEquals('"\\udbc0"', JSON.stringify('\uDBC0'));
+assertEquals('"\\udbc1"', JSON.stringify('\uDBC1'));
+assertEquals('"\\udbc2"', JSON.stringify('\uDBC2'));
+assertEquals('"\\udbc3"', JSON.stringify('\uDBC3'));
+assertEquals('"\\udbc4"', JSON.stringify('\uDBC4'));
+assertEquals('"\\udbc5"', JSON.stringify('\uDBC5'));
+assertEquals('"\\udbc6"', JSON.stringify('\uDBC6'));
+assertEquals('"\\udbc7"', JSON.stringify('\uDBC7'));
+assertEquals('"\\udbc8"', JSON.stringify('\uDBC8'));
+assertEquals('"\\udbc9"', JSON.stringify('\uDBC9'));
+assertEquals('"\\udbca"', JSON.stringify('\uDBCA'));
+assertEquals('"\\udbcb"', JSON.stringify('\uDBCB'));
+assertEquals('"\\udbcc"', JSON.stringify('\uDBCC'));
+assertEquals('"\\udbcd"', JSON.stringify('\uDBCD'));
+assertEquals('"\\udbce"', JSON.stringify('\uDBCE'));
+assertEquals('"\\udbcf"', JSON.stringify('\uDBCF'));
+assertEquals('"\\udbd0"', JSON.stringify('\uDBD0'));
+assertEquals('"\\udbd1"', JSON.stringify('\uDBD1'));
+assertEquals('"\\udbd2"', JSON.stringify('\uDBD2'));
+assertEquals('"\\udbd3"', JSON.stringify('\uDBD3'));
+assertEquals('"\\udbd4"', JSON.stringify('\uDBD4'));
+assertEquals('"\\udbd5"', JSON.stringify('\uDBD5'));
+assertEquals('"\\udbd6"', JSON.stringify('\uDBD6'));
+assertEquals('"\\udbd7"', JSON.stringify('\uDBD7'));
+assertEquals('"\\udbd8"', JSON.stringify('\uDBD8'));
+assertEquals('"\\udbd9"', JSON.stringify('\uDBD9'));
+assertEquals('"\\udbda"', JSON.stringify('\uDBDA'));
+assertEquals('"\\udbdb"', JSON.stringify('\uDBDB'));
+assertEquals('"\\udbdc"', JSON.stringify('\uDBDC'));
+assertEquals('"\\udbdd"', JSON.stringify('\uDBDD'));
+assertEquals('"\\udbde"', JSON.stringify('\uDBDE'));
+assertEquals('"\\udbdf"', JSON.stringify('\uDBDF'));
+assertEquals('"\\udbe0"', JSON.stringify('\uDBE0'));
+assertEquals('"\\udbe1"', JSON.stringify('\uDBE1'));
+assertEquals('"\\udbe2"', JSON.stringify('\uDBE2'));
+assertEquals('"\\udbe3"', JSON.stringify('\uDBE3'));
+assertEquals('"\\udbe4"', JSON.stringify('\uDBE4'));
+assertEquals('"\\udbe5"', JSON.stringify('\uDBE5'));
+assertEquals('"\\udbe6"', JSON.stringify('\uDBE6'));
+assertEquals('"\\udbe7"', JSON.stringify('\uDBE7'));
+assertEquals('"\\udbe8"', JSON.stringify('\uDBE8'));
+assertEquals('"\\udbe9"', JSON.stringify('\uDBE9'));
+assertEquals('"\\udbea"', JSON.stringify('\uDBEA'));
+assertEquals('"\\udbeb"', JSON.stringify('\uDBEB'));
+assertEquals('"\\udbec"', JSON.stringify('\uDBEC'));
+assertEquals('"\\udbed"', JSON.stringify('\uDBED'));
+assertEquals('"\\udbee"', JSON.stringify('\uDBEE'));
+assertEquals('"\\udbef"', JSON.stringify('\uDBEF'));
+assertEquals('"\\udbf0"', JSON.stringify('\uDBF0'));
+assertEquals('"\\udbf1"', JSON.stringify('\uDBF1'));
+assertEquals('"\\udbf2"', JSON.stringify('\uDBF2'));
+assertEquals('"\\udbf3"', JSON.stringify('\uDBF3'));
+assertEquals('"\\udbf4"', JSON.stringify('\uDBF4'));
+assertEquals('"\\udbf5"', JSON.stringify('\uDBF5'));
+assertEquals('"\\udbf6"', JSON.stringify('\uDBF6'));
+assertEquals('"\\udbf7"', JSON.stringify('\uDBF7'));
+assertEquals('"\\udbf8"', JSON.stringify('\uDBF8'));
+assertEquals('"\\udbf9"', JSON.stringify('\uDBF9'));
+assertEquals('"\\udbfa"', JSON.stringify('\uDBFA'));
+assertEquals('"\\udbfb"', JSON.stringify('\uDBFB'));
+assertEquals('"\\udbfc"', JSON.stringify('\uDBFC'));
+assertEquals('"\\udbfd"', JSON.stringify('\uDBFD'));
+assertEquals('"\\udbfe"', JSON.stringify('\uDBFE'));
+assertEquals('"\\udbff"', JSON.stringify('\uDBFF'));
+assertEquals('"\\udc00"', JSON.stringify('\uDC00'));
+assertEquals('"\\udc01"', JSON.stringify('\uDC01'));
+assertEquals('"\\udc02"', JSON.stringify('\uDC02'));
+assertEquals('"\\udc03"', JSON.stringify('\uDC03'));
+assertEquals('"\\udc04"', JSON.stringify('\uDC04'));
+assertEquals('"\\udc05"', JSON.stringify('\uDC05'));
+assertEquals('"\\udc06"', JSON.stringify('\uDC06'));
+assertEquals('"\\udc07"', JSON.stringify('\uDC07'));
+assertEquals('"\\udc08"', JSON.stringify('\uDC08'));
+assertEquals('"\\udc09"', JSON.stringify('\uDC09'));
+assertEquals('"\\udc0a"', JSON.stringify('\uDC0A'));
+assertEquals('"\\udc0b"', JSON.stringify('\uDC0B'));
+assertEquals('"\\udc0c"', JSON.stringify('\uDC0C'));
+assertEquals('"\\udc0d"', JSON.stringify('\uDC0D'));
+assertEquals('"\\udc0e"', JSON.stringify('\uDC0E'));
+assertEquals('"\\udc0f"', JSON.stringify('\uDC0F'));
+assertEquals('"\\udc10"', JSON.stringify('\uDC10'));
+assertEquals('"\\udc11"', JSON.stringify('\uDC11'));
+assertEquals('"\\udc12"', JSON.stringify('\uDC12'));
+assertEquals('"\\udc13"', JSON.stringify('\uDC13'));
+assertEquals('"\\udc14"', JSON.stringify('\uDC14'));
+assertEquals('"\\udc15"', JSON.stringify('\uDC15'));
+assertEquals('"\\udc16"', JSON.stringify('\uDC16'));
+assertEquals('"\\udc17"', JSON.stringify('\uDC17'));
+assertEquals('"\\udc18"', JSON.stringify('\uDC18'));
+assertEquals('"\\udc19"', JSON.stringify('\uDC19'));
+assertEquals('"\\udc1a"', JSON.stringify('\uDC1A'));
+assertEquals('"\\udc1b"', JSON.stringify('\uDC1B'));
+assertEquals('"\\udc1c"', JSON.stringify('\uDC1C'));
+assertEquals('"\\udc1d"', JSON.stringify('\uDC1D'));
+assertEquals('"\\udc1e"', JSON.stringify('\uDC1E'));
+assertEquals('"\\udc1f"', JSON.stringify('\uDC1F'));
+assertEquals('"\\udc20"', JSON.stringify('\uDC20'));
+assertEquals('"\\udc21"', JSON.stringify('\uDC21'));
+assertEquals('"\\udc22"', JSON.stringify('\uDC22'));
+assertEquals('"\\udc23"', JSON.stringify('\uDC23'));
+assertEquals('"\\udc24"', JSON.stringify('\uDC24'));
+assertEquals('"\\udc25"', JSON.stringify('\uDC25'));
+assertEquals('"\\udc26"', JSON.stringify('\uDC26'));
+assertEquals('"\\udc27"', JSON.stringify('\uDC27'));
+assertEquals('"\\udc28"', JSON.stringify('\uDC28'));
+assertEquals('"\\udc29"', JSON.stringify('\uDC29'));
+assertEquals('"\\udc2a"', JSON.stringify('\uDC2A'));
+assertEquals('"\\udc2b"', JSON.stringify('\uDC2B'));
+assertEquals('"\\udc2c"', JSON.stringify('\uDC2C'));
+assertEquals('"\\udc2d"', JSON.stringify('\uDC2D'));
+assertEquals('"\\udc2e"', JSON.stringify('\uDC2E'));
+assertEquals('"\\udc2f"', JSON.stringify('\uDC2F'));
+assertEquals('"\\udc30"', JSON.stringify('\uDC30'));
+assertEquals('"\\udc31"', JSON.stringify('\uDC31'));
+assertEquals('"\\udc32"', JSON.stringify('\uDC32'));
+assertEquals('"\\udc33"', JSON.stringify('\uDC33'));
+assertEquals('"\\udc34"', JSON.stringify('\uDC34'));
+assertEquals('"\\udc35"', JSON.stringify('\uDC35'));
+assertEquals('"\\udc36"', JSON.stringify('\uDC36'));
+assertEquals('"\\udc37"', JSON.stringify('\uDC37'));
+assertEquals('"\\udc38"', JSON.stringify('\uDC38'));
+assertEquals('"\\udc39"', JSON.stringify('\uDC39'));
+assertEquals('"\\udc3a"', JSON.stringify('\uDC3A'));
+assertEquals('"\\udc3b"', JSON.stringify('\uDC3B'));
+assertEquals('"\\udc3c"', JSON.stringify('\uDC3C'));
+assertEquals('"\\udc3d"', JSON.stringify('\uDC3D'));
+assertEquals('"\\udc3e"', JSON.stringify('\uDC3E'));
+assertEquals('"\\udc3f"', JSON.stringify('\uDC3F'));
+assertEquals('"\\udc40"', JSON.stringify('\uDC40'));
+assertEquals('"\\udc41"', JSON.stringify('\uDC41'));
+assertEquals('"\\udc42"', JSON.stringify('\uDC42'));
+assertEquals('"\\udc43"', JSON.stringify('\uDC43'));
+assertEquals('"\\udc44"', JSON.stringify('\uDC44'));
+assertEquals('"\\udc45"', JSON.stringify('\uDC45'));
+assertEquals('"\\udc46"', JSON.stringify('\uDC46'));
+assertEquals('"\\udc47"', JSON.stringify('\uDC47'));
+assertEquals('"\\udc48"', JSON.stringify('\uDC48'));
+assertEquals('"\\udc49"', JSON.stringify('\uDC49'));
+assertEquals('"\\udc4a"', JSON.stringify('\uDC4A'));
+assertEquals('"\\udc4b"', JSON.stringify('\uDC4B'));
+assertEquals('"\\udc4c"', JSON.stringify('\uDC4C'));
+assertEquals('"\\udc4d"', JSON.stringify('\uDC4D'));
+assertEquals('"\\udc4e"', JSON.stringify('\uDC4E'));
+assertEquals('"\\udc4f"', JSON.stringify('\uDC4F'));
+assertEquals('"\\udc50"', JSON.stringify('\uDC50'));
+assertEquals('"\\udc51"', JSON.stringify('\uDC51'));
+assertEquals('"\\udc52"', JSON.stringify('\uDC52'));
+assertEquals('"\\udc53"', JSON.stringify('\uDC53'));
+assertEquals('"\\udc54"', JSON.stringify('\uDC54'));
+assertEquals('"\\udc55"', JSON.stringify('\uDC55'));
+assertEquals('"\\udc56"', JSON.stringify('\uDC56'));
+assertEquals('"\\udc57"', JSON.stringify('\uDC57'));
+assertEquals('"\\udc58"', JSON.stringify('\uDC58'));
+assertEquals('"\\udc59"', JSON.stringify('\uDC59'));
+assertEquals('"\\udc5a"', JSON.stringify('\uDC5A'));
+assertEquals('"\\udc5b"', JSON.stringify('\uDC5B'));
+assertEquals('"\\udc5c"', JSON.stringify('\uDC5C'));
+assertEquals('"\\udc5d"', JSON.stringify('\uDC5D'));
+assertEquals('"\\udc5e"', JSON.stringify('\uDC5E'));
+assertEquals('"\\udc5f"', JSON.stringify('\uDC5F'));
+assertEquals('"\\udc60"', JSON.stringify('\uDC60'));
+assertEquals('"\\udc61"', JSON.stringify('\uDC61'));
+assertEquals('"\\udc62"', JSON.stringify('\uDC62'));
+assertEquals('"\\udc63"', JSON.stringify('\uDC63'));
+assertEquals('"\\udc64"', JSON.stringify('\uDC64'));
+assertEquals('"\\udc65"', JSON.stringify('\uDC65'));
+assertEquals('"\\udc66"', JSON.stringify('\uDC66'));
+assertEquals('"\\udc67"', JSON.stringify('\uDC67'));
+assertEquals('"\\udc68"', JSON.stringify('\uDC68'));
+assertEquals('"\\udc69"', JSON.stringify('\uDC69'));
+assertEquals('"\\udc6a"', JSON.stringify('\uDC6A'));
+assertEquals('"\\udc6b"', JSON.stringify('\uDC6B'));
+assertEquals('"\\udc6c"', JSON.stringify('\uDC6C'));
+assertEquals('"\\udc6d"', JSON.stringify('\uDC6D'));
+assertEquals('"\\udc6e"', JSON.stringify('\uDC6E'));
+assertEquals('"\\udc6f"', JSON.stringify('\uDC6F'));
+assertEquals('"\\udc70"', JSON.stringify('\uDC70'));
+assertEquals('"\\udc71"', JSON.stringify('\uDC71'));
+assertEquals('"\\udc72"', JSON.stringify('\uDC72'));
+assertEquals('"\\udc73"', JSON.stringify('\uDC73'));
+assertEquals('"\\udc74"', JSON.stringify('\uDC74'));
+assertEquals('"\\udc75"', JSON.stringify('\uDC75'));
+assertEquals('"\\udc76"', JSON.stringify('\uDC76'));
+assertEquals('"\\udc77"', JSON.stringify('\uDC77'));
+assertEquals('"\\udc78"', JSON.stringify('\uDC78'));
+assertEquals('"\\udc79"', JSON.stringify('\uDC79'));
+assertEquals('"\\udc7a"', JSON.stringify('\uDC7A'));
+assertEquals('"\\udc7b"', JSON.stringify('\uDC7B'));
+assertEquals('"\\udc7c"', JSON.stringify('\uDC7C'));
+assertEquals('"\\udc7d"', JSON.stringify('\uDC7D'));
+assertEquals('"\\udc7e"', JSON.stringify('\uDC7E'));
+assertEquals('"\\udc7f"', JSON.stringify('\uDC7F'));
+assertEquals('"\\udc80"', JSON.stringify('\uDC80'));
+assertEquals('"\\udc81"', JSON.stringify('\uDC81'));
+assertEquals('"\\udc82"', JSON.stringify('\uDC82'));
+assertEquals('"\\udc83"', JSON.stringify('\uDC83'));
+assertEquals('"\\udc84"', JSON.stringify('\uDC84'));
+assertEquals('"\\udc85"', JSON.stringify('\uDC85'));
+assertEquals('"\\udc86"', JSON.stringify('\uDC86'));
+assertEquals('"\\udc87"', JSON.stringify('\uDC87'));
+assertEquals('"\\udc88"', JSON.stringify('\uDC88'));
+assertEquals('"\\udc89"', JSON.stringify('\uDC89'));
+assertEquals('"\\udc8a"', JSON.stringify('\uDC8A'));
+assertEquals('"\\udc8b"', JSON.stringify('\uDC8B'));
+assertEquals('"\\udc8c"', JSON.stringify('\uDC8C'));
+assertEquals('"\\udc8d"', JSON.stringify('\uDC8D'));
+assertEquals('"\\udc8e"', JSON.stringify('\uDC8E'));
+assertEquals('"\\udc8f"', JSON.stringify('\uDC8F'));
+assertEquals('"\\udc90"', JSON.stringify('\uDC90'));
+assertEquals('"\\udc91"', JSON.stringify('\uDC91'));
+assertEquals('"\\udc92"', JSON.stringify('\uDC92'));
+assertEquals('"\\udc93"', JSON.stringify('\uDC93'));
+assertEquals('"\\udc94"', JSON.stringify('\uDC94'));
+assertEquals('"\\udc95"', JSON.stringify('\uDC95'));
+assertEquals('"\\udc96"', JSON.stringify('\uDC96'));
+assertEquals('"\\udc97"', JSON.stringify('\uDC97'));
+assertEquals('"\\udc98"', JSON.stringify('\uDC98'));
+assertEquals('"\\udc99"', JSON.stringify('\uDC99'));
+assertEquals('"\\udc9a"', JSON.stringify('\uDC9A'));
+assertEquals('"\\udc9b"', JSON.stringify('\uDC9B'));
+assertEquals('"\\udc9c"', JSON.stringify('\uDC9C'));
+assertEquals('"\\udc9d"', JSON.stringify('\uDC9D'));
+assertEquals('"\\udc9e"', JSON.stringify('\uDC9E'));
+assertEquals('"\\udc9f"', JSON.stringify('\uDC9F'));
+assertEquals('"\\udca0"', JSON.stringify('\uDCA0'));
+assertEquals('"\\udca1"', JSON.stringify('\uDCA1'));
+assertEquals('"\\udca2"', JSON.stringify('\uDCA2'));
+assertEquals('"\\udca3"', JSON.stringify('\uDCA3'));
+assertEquals('"\\udca4"', JSON.stringify('\uDCA4'));
+assertEquals('"\\udca5"', JSON.stringify('\uDCA5'));
+assertEquals('"\\udca6"', JSON.stringify('\uDCA6'));
+assertEquals('"\\udca7"', JSON.stringify('\uDCA7'));
+assertEquals('"\\udca8"', JSON.stringify('\uDCA8'));
+assertEquals('"\\udca9"', JSON.stringify('\uDCA9'));
+assertEquals('"\\udcaa"', JSON.stringify('\uDCAA'));
+assertEquals('"\\udcab"', JSON.stringify('\uDCAB'));
+assertEquals('"\\udcac"', JSON.stringify('\uDCAC'));
+assertEquals('"\\udcad"', JSON.stringify('\uDCAD'));
+assertEquals('"\\udcae"', JSON.stringify('\uDCAE'));
+assertEquals('"\\udcaf"', JSON.stringify('\uDCAF'));
+assertEquals('"\\udcb0"', JSON.stringify('\uDCB0'));
+assertEquals('"\\udcb1"', JSON.stringify('\uDCB1'));
+assertEquals('"\\udcb2"', JSON.stringify('\uDCB2'));
+assertEquals('"\\udcb3"', JSON.stringify('\uDCB3'));
+assertEquals('"\\udcb4"', JSON.stringify('\uDCB4'));
+assertEquals('"\\udcb5"', JSON.stringify('\uDCB5'));
+assertEquals('"\\udcb6"', JSON.stringify('\uDCB6'));
+assertEquals('"\\udcb7"', JSON.stringify('\uDCB7'));
+assertEquals('"\\udcb8"', JSON.stringify('\uDCB8'));
+assertEquals('"\\udcb9"', JSON.stringify('\uDCB9'));
+assertEquals('"\\udcba"', JSON.stringify('\uDCBA'));
+assertEquals('"\\udcbb"', JSON.stringify('\uDCBB'));
+assertEquals('"\\udcbc"', JSON.stringify('\uDCBC'));
+assertEquals('"\\udcbd"', JSON.stringify('\uDCBD'));
+assertEquals('"\\udcbe"', JSON.stringify('\uDCBE'));
+assertEquals('"\\udcbf"', JSON.stringify('\uDCBF'));
+assertEquals('"\\udcc0"', JSON.stringify('\uDCC0'));
+assertEquals('"\\udcc1"', JSON.stringify('\uDCC1'));
+assertEquals('"\\udcc2"', JSON.stringify('\uDCC2'));
+assertEquals('"\\udcc3"', JSON.stringify('\uDCC3'));
+assertEquals('"\\udcc4"', JSON.stringify('\uDCC4'));
+assertEquals('"\\udcc5"', JSON.stringify('\uDCC5'));
+assertEquals('"\\udcc6"', JSON.stringify('\uDCC6'));
+assertEquals('"\\udcc7"', JSON.stringify('\uDCC7'));
+assertEquals('"\\udcc8"', JSON.stringify('\uDCC8'));
+assertEquals('"\\udcc9"', JSON.stringify('\uDCC9'));
+assertEquals('"\\udcca"', JSON.stringify('\uDCCA'));
+assertEquals('"\\udccb"', JSON.stringify('\uDCCB'));
+assertEquals('"\\udccc"', JSON.stringify('\uDCCC'));
+assertEquals('"\\udccd"', JSON.stringify('\uDCCD'));
+assertEquals('"\\udcce"', JSON.stringify('\uDCCE'));
+assertEquals('"\\udccf"', JSON.stringify('\uDCCF'));
+assertEquals('"\\udcd0"', JSON.stringify('\uDCD0'));
+assertEquals('"\\udcd1"', JSON.stringify('\uDCD1'));
+assertEquals('"\\udcd2"', JSON.stringify('\uDCD2'));
+assertEquals('"\\udcd3"', JSON.stringify('\uDCD3'));
+assertEquals('"\\udcd4"', JSON.stringify('\uDCD4'));
+assertEquals('"\\udcd5"', JSON.stringify('\uDCD5'));
+assertEquals('"\\udcd6"', JSON.stringify('\uDCD6'));
+assertEquals('"\\udcd7"', JSON.stringify('\uDCD7'));
+assertEquals('"\\udcd8"', JSON.stringify('\uDCD8'));
+assertEquals('"\\udcd9"', JSON.stringify('\uDCD9'));
+assertEquals('"\\udcda"', JSON.stringify('\uDCDA'));
+assertEquals('"\\udcdb"', JSON.stringify('\uDCDB'));
+assertEquals('"\\udcdc"', JSON.stringify('\uDCDC'));
+assertEquals('"\\udcdd"', JSON.stringify('\uDCDD'));
+assertEquals('"\\udcde"', JSON.stringify('\uDCDE'));
+assertEquals('"\\udcdf"', JSON.stringify('\uDCDF'));
+assertEquals('"\\udce0"', JSON.stringify('\uDCE0'));
+assertEquals('"\\udce1"', JSON.stringify('\uDCE1'));
+assertEquals('"\\udce2"', JSON.stringify('\uDCE2'));
+assertEquals('"\\udce3"', JSON.stringify('\uDCE3'));
+assertEquals('"\\udce4"', JSON.stringify('\uDCE4'));
+assertEquals('"\\udce5"', JSON.stringify('\uDCE5'));
+assertEquals('"\\udce6"', JSON.stringify('\uDCE6'));
+assertEquals('"\\udce7"', JSON.stringify('\uDCE7'));
+assertEquals('"\\udce8"', JSON.stringify('\uDCE8'));
+assertEquals('"\\udce9"', JSON.stringify('\uDCE9'));
+assertEquals('"\\udcea"', JSON.stringify('\uDCEA'));
+assertEquals('"\\udceb"', JSON.stringify('\uDCEB'));
+assertEquals('"\\udcec"', JSON.stringify('\uDCEC'));
+assertEquals('"\\udced"', JSON.stringify('\uDCED'));
+assertEquals('"\\udcee"', JSON.stringify('\uDCEE'));
+assertEquals('"\\udcef"', JSON.stringify('\uDCEF'));
+assertEquals('"\\udcf0"', JSON.stringify('\uDCF0'));
+assertEquals('"\\udcf1"', JSON.stringify('\uDCF1'));
+assertEquals('"\\udcf2"', JSON.stringify('\uDCF2'));
+assertEquals('"\\udcf3"', JSON.stringify('\uDCF3'));
+assertEquals('"\\udcf4"', JSON.stringify('\uDCF4'));
+assertEquals('"\\udcf5"', JSON.stringify('\uDCF5'));
+assertEquals('"\\udcf6"', JSON.stringify('\uDCF6'));
+assertEquals('"\\udcf7"', JSON.stringify('\uDCF7'));
+assertEquals('"\\udcf8"', JSON.stringify('\uDCF8'));
+assertEquals('"\\udcf9"', JSON.stringify('\uDCF9'));
+assertEquals('"\\udcfa"', JSON.stringify('\uDCFA'));
+assertEquals('"\\udcfb"', JSON.stringify('\uDCFB'));
+assertEquals('"\\udcfc"', JSON.stringify('\uDCFC'));
+assertEquals('"\\udcfd"', JSON.stringify('\uDCFD'));
+assertEquals('"\\udcfe"', JSON.stringify('\uDCFE'));
+assertEquals('"\\udcff"', JSON.stringify('\uDCFF'));
+assertEquals('"\\udd00"', JSON.stringify('\uDD00'));
+assertEquals('"\\udd01"', JSON.stringify('\uDD01'));
+assertEquals('"\\udd02"', JSON.stringify('\uDD02'));
+assertEquals('"\\udd03"', JSON.stringify('\uDD03'));
+assertEquals('"\\udd04"', JSON.stringify('\uDD04'));
+assertEquals('"\\udd05"', JSON.stringify('\uDD05'));
+assertEquals('"\\udd06"', JSON.stringify('\uDD06'));
+assertEquals('"\\udd07"', JSON.stringify('\uDD07'));
+assertEquals('"\\udd08"', JSON.stringify('\uDD08'));
+assertEquals('"\\udd09"', JSON.stringify('\uDD09'));
+assertEquals('"\\udd0a"', JSON.stringify('\uDD0A'));
+assertEquals('"\\udd0b"', JSON.stringify('\uDD0B'));
+assertEquals('"\\udd0c"', JSON.stringify('\uDD0C'));
+assertEquals('"\\udd0d"', JSON.stringify('\uDD0D'));
+assertEquals('"\\udd0e"', JSON.stringify('\uDD0E'));
+assertEquals('"\\udd0f"', JSON.stringify('\uDD0F'));
+assertEquals('"\\udd10"', JSON.stringify('\uDD10'));
+assertEquals('"\\udd11"', JSON.stringify('\uDD11'));
+assertEquals('"\\udd12"', JSON.stringify('\uDD12'));
+assertEquals('"\\udd13"', JSON.stringify('\uDD13'));
+assertEquals('"\\udd14"', JSON.stringify('\uDD14'));
+assertEquals('"\\udd15"', JSON.stringify('\uDD15'));
+assertEquals('"\\udd16"', JSON.stringify('\uDD16'));
+assertEquals('"\\udd17"', JSON.stringify('\uDD17'));
+assertEquals('"\\udd18"', JSON.stringify('\uDD18'));
+assertEquals('"\\udd19"', JSON.stringify('\uDD19'));
+assertEquals('"\\udd1a"', JSON.stringify('\uDD1A'));
+assertEquals('"\\udd1b"', JSON.stringify('\uDD1B'));
+assertEquals('"\\udd1c"', JSON.stringify('\uDD1C'));
+assertEquals('"\\udd1d"', JSON.stringify('\uDD1D'));
+assertEquals('"\\udd1e"', JSON.stringify('\uDD1E'));
+assertEquals('"\\udd1f"', JSON.stringify('\uDD1F'));
+assertEquals('"\\udd20"', JSON.stringify('\uDD20'));
+assertEquals('"\\udd21"', JSON.stringify('\uDD21'));
+assertEquals('"\\udd22"', JSON.stringify('\uDD22'));
+assertEquals('"\\udd23"', JSON.stringify('\uDD23'));
+assertEquals('"\\udd24"', JSON.stringify('\uDD24'));
+assertEquals('"\\udd25"', JSON.stringify('\uDD25'));
+assertEquals('"\\udd26"', JSON.stringify('\uDD26'));
+assertEquals('"\\udd27"', JSON.stringify('\uDD27'));
+assertEquals('"\\udd28"', JSON.stringify('\uDD28'));
+assertEquals('"\\udd29"', JSON.stringify('\uDD29'));
+assertEquals('"\\udd2a"', JSON.stringify('\uDD2A'));
+assertEquals('"\\udd2b"', JSON.stringify('\uDD2B'));
+assertEquals('"\\udd2c"', JSON.stringify('\uDD2C'));
+assertEquals('"\\udd2d"', JSON.stringify('\uDD2D'));
+assertEquals('"\\udd2e"', JSON.stringify('\uDD2E'));
+assertEquals('"\\udd2f"', JSON.stringify('\uDD2F'));
+assertEquals('"\\udd30"', JSON.stringify('\uDD30'));
+assertEquals('"\\udd31"', JSON.stringify('\uDD31'));
+assertEquals('"\\udd32"', JSON.stringify('\uDD32'));
+assertEquals('"\\udd33"', JSON.stringify('\uDD33'));
+assertEquals('"\\udd34"', JSON.stringify('\uDD34'));
+assertEquals('"\\udd35"', JSON.stringify('\uDD35'));
+assertEquals('"\\udd36"', JSON.stringify('\uDD36'));
+assertEquals('"\\udd37"', JSON.stringify('\uDD37'));
+assertEquals('"\\udd38"', JSON.stringify('\uDD38'));
+assertEquals('"\\udd39"', JSON.stringify('\uDD39'));
+assertEquals('"\\udd3a"', JSON.stringify('\uDD3A'));
+assertEquals('"\\udd3b"', JSON.stringify('\uDD3B'));
+assertEquals('"\\udd3c"', JSON.stringify('\uDD3C'));
+assertEquals('"\\udd3d"', JSON.stringify('\uDD3D'));
+assertEquals('"\\udd3e"', JSON.stringify('\uDD3E'));
+assertEquals('"\\udd3f"', JSON.stringify('\uDD3F'));
+assertEquals('"\\udd40"', JSON.stringify('\uDD40'));
+assertEquals('"\\udd41"', JSON.stringify('\uDD41'));
+assertEquals('"\\udd42"', JSON.stringify('\uDD42'));
+assertEquals('"\\udd43"', JSON.stringify('\uDD43'));
+assertEquals('"\\udd44"', JSON.stringify('\uDD44'));
+assertEquals('"\\udd45"', JSON.stringify('\uDD45'));
+assertEquals('"\\udd46"', JSON.stringify('\uDD46'));
+assertEquals('"\\udd47"', JSON.stringify('\uDD47'));
+assertEquals('"\\udd48"', JSON.stringify('\uDD48'));
+assertEquals('"\\udd49"', JSON.stringify('\uDD49'));
+assertEquals('"\\udd4a"', JSON.stringify('\uDD4A'));
+assertEquals('"\\udd4b"', JSON.stringify('\uDD4B'));
+assertEquals('"\\udd4c"', JSON.stringify('\uDD4C'));
+assertEquals('"\\udd4d"', JSON.stringify('\uDD4D'));
+assertEquals('"\\udd4e"', JSON.stringify('\uDD4E'));
+assertEquals('"\\udd4f"', JSON.stringify('\uDD4F'));
+assertEquals('"\\udd50"', JSON.stringify('\uDD50'));
+assertEquals('"\\udd51"', JSON.stringify('\uDD51'));
+assertEquals('"\\udd52"', JSON.stringify('\uDD52'));
+assertEquals('"\\udd53"', JSON.stringify('\uDD53'));
+assertEquals('"\\udd54"', JSON.stringify('\uDD54'));
+assertEquals('"\\udd55"', JSON.stringify('\uDD55'));
+assertEquals('"\\udd56"', JSON.stringify('\uDD56'));
+assertEquals('"\\udd57"', JSON.stringify('\uDD57'));
+assertEquals('"\\udd58"', JSON.stringify('\uDD58'));
+assertEquals('"\\udd59"', JSON.stringify('\uDD59'));
+assertEquals('"\\udd5a"', JSON.stringify('\uDD5A'));
+assertEquals('"\\udd5b"', JSON.stringify('\uDD5B'));
+assertEquals('"\\udd5c"', JSON.stringify('\uDD5C'));
+assertEquals('"\\udd5d"', JSON.stringify('\uDD5D'));
+assertEquals('"\\udd5e"', JSON.stringify('\uDD5E'));
+assertEquals('"\\udd5f"', JSON.stringify('\uDD5F'));
+assertEquals('"\\udd60"', JSON.stringify('\uDD60'));
+assertEquals('"\\udd61"', JSON.stringify('\uDD61'));
+assertEquals('"\\udd62"', JSON.stringify('\uDD62'));
+assertEquals('"\\udd63"', JSON.stringify('\uDD63'));
+assertEquals('"\\udd64"', JSON.stringify('\uDD64'));
+assertEquals('"\\udd65"', JSON.stringify('\uDD65'));
+assertEquals('"\\udd66"', JSON.stringify('\uDD66'));
+assertEquals('"\\udd67"', JSON.stringify('\uDD67'));
+assertEquals('"\\udd68"', JSON.stringify('\uDD68'));
+assertEquals('"\\udd69"', JSON.stringify('\uDD69'));
+assertEquals('"\\udd6a"', JSON.stringify('\uDD6A'));
+assertEquals('"\\udd6b"', JSON.stringify('\uDD6B'));
+assertEquals('"\\udd6c"', JSON.stringify('\uDD6C'));
+assertEquals('"\\udd6d"', JSON.stringify('\uDD6D'));
+assertEquals('"\\udd6e"', JSON.stringify('\uDD6E'));
+assertEquals('"\\udd6f"', JSON.stringify('\uDD6F'));
+assertEquals('"\\udd70"', JSON.stringify('\uDD70'));
+assertEquals('"\\udd71"', JSON.stringify('\uDD71'));
+assertEquals('"\\udd72"', JSON.stringify('\uDD72'));
+assertEquals('"\\udd73"', JSON.stringify('\uDD73'));
+assertEquals('"\\udd74"', JSON.stringify('\uDD74'));
+assertEquals('"\\udd75"', JSON.stringify('\uDD75'));
+assertEquals('"\\udd76"', JSON.stringify('\uDD76'));
+assertEquals('"\\udd77"', JSON.stringify('\uDD77'));
+assertEquals('"\\udd78"', JSON.stringify('\uDD78'));
+assertEquals('"\\udd79"', JSON.stringify('\uDD79'));
+assertEquals('"\\udd7a"', JSON.stringify('\uDD7A'));
+assertEquals('"\\udd7b"', JSON.stringify('\uDD7B'));
+assertEquals('"\\udd7c"', JSON.stringify('\uDD7C'));
+assertEquals('"\\udd7d"', JSON.stringify('\uDD7D'));
+assertEquals('"\\udd7e"', JSON.stringify('\uDD7E'));
+assertEquals('"\\udd7f"', JSON.stringify('\uDD7F'));
+assertEquals('"\\udd80"', JSON.stringify('\uDD80'));
+assertEquals('"\\udd81"', JSON.stringify('\uDD81'));
+assertEquals('"\\udd82"', JSON.stringify('\uDD82'));
+assertEquals('"\\udd83"', JSON.stringify('\uDD83'));
+assertEquals('"\\udd84"', JSON.stringify('\uDD84'));
+assertEquals('"\\udd85"', JSON.stringify('\uDD85'));
+assertEquals('"\\udd86"', JSON.stringify('\uDD86'));
+assertEquals('"\\udd87"', JSON.stringify('\uDD87'));
+assertEquals('"\\udd88"', JSON.stringify('\uDD88'));
+assertEquals('"\\udd89"', JSON.stringify('\uDD89'));
+assertEquals('"\\udd8a"', JSON.stringify('\uDD8A'));
+assertEquals('"\\udd8b"', JSON.stringify('\uDD8B'));
+assertEquals('"\\udd8c"', JSON.stringify('\uDD8C'));
+assertEquals('"\\udd8d"', JSON.stringify('\uDD8D'));
+assertEquals('"\\udd8e"', JSON.stringify('\uDD8E'));
+assertEquals('"\\udd8f"', JSON.stringify('\uDD8F'));
+assertEquals('"\\udd90"', JSON.stringify('\uDD90'));
+assertEquals('"\\udd91"', JSON.stringify('\uDD91'));
+assertEquals('"\\udd92"', JSON.stringify('\uDD92'));
+assertEquals('"\\udd93"', JSON.stringify('\uDD93'));
+assertEquals('"\\udd94"', JSON.stringify('\uDD94'));
+assertEquals('"\\udd95"', JSON.stringify('\uDD95'));
+assertEquals('"\\udd96"', JSON.stringify('\uDD96'));
+assertEquals('"\\udd97"', JSON.stringify('\uDD97'));
+assertEquals('"\\udd98"', JSON.stringify('\uDD98'));
+assertEquals('"\\udd99"', JSON.stringify('\uDD99'));
+assertEquals('"\\udd9a"', JSON.stringify('\uDD9A'));
+assertEquals('"\\udd9b"', JSON.stringify('\uDD9B'));
+assertEquals('"\\udd9c"', JSON.stringify('\uDD9C'));
+assertEquals('"\\udd9d"', JSON.stringify('\uDD9D'));
+assertEquals('"\\udd9e"', JSON.stringify('\uDD9E'));
+assertEquals('"\\udd9f"', JSON.stringify('\uDD9F'));
+assertEquals('"\\udda0"', JSON.stringify('\uDDA0'));
+assertEquals('"\\udda1"', JSON.stringify('\uDDA1'));
+assertEquals('"\\udda2"', JSON.stringify('\uDDA2'));
+assertEquals('"\\udda3"', JSON.stringify('\uDDA3'));
+assertEquals('"\\udda4"', JSON.stringify('\uDDA4'));
+assertEquals('"\\udda5"', JSON.stringify('\uDDA5'));
+assertEquals('"\\udda6"', JSON.stringify('\uDDA6'));
+assertEquals('"\\udda7"', JSON.stringify('\uDDA7'));
+assertEquals('"\\udda8"', JSON.stringify('\uDDA8'));
+assertEquals('"\\udda9"', JSON.stringify('\uDDA9'));
+assertEquals('"\\uddaa"', JSON.stringify('\uDDAA'));
+assertEquals('"\\uddab"', JSON.stringify('\uDDAB'));
+assertEquals('"\\uddac"', JSON.stringify('\uDDAC'));
+assertEquals('"\\uddad"', JSON.stringify('\uDDAD'));
+assertEquals('"\\uddae"', JSON.stringify('\uDDAE'));
+assertEquals('"\\uddaf"', JSON.stringify('\uDDAF'));
+assertEquals('"\\uddb0"', JSON.stringify('\uDDB0'));
+assertEquals('"\\uddb1"', JSON.stringify('\uDDB1'));
+assertEquals('"\\uddb2"', JSON.stringify('\uDDB2'));
+assertEquals('"\\uddb3"', JSON.stringify('\uDDB3'));
+assertEquals('"\\uddb4"', JSON.stringify('\uDDB4'));
+assertEquals('"\\uddb5"', JSON.stringify('\uDDB5'));
+assertEquals('"\\uddb6"', JSON.stringify('\uDDB6'));
+assertEquals('"\\uddb7"', JSON.stringify('\uDDB7'));
+assertEquals('"\\uddb8"', JSON.stringify('\uDDB8'));
+assertEquals('"\\uddb9"', JSON.stringify('\uDDB9'));
+assertEquals('"\\uddba"', JSON.stringify('\uDDBA'));
+assertEquals('"\\uddbb"', JSON.stringify('\uDDBB'));
+assertEquals('"\\uddbc"', JSON.stringify('\uDDBC'));
+assertEquals('"\\uddbd"', JSON.stringify('\uDDBD'));
+assertEquals('"\\uddbe"', JSON.stringify('\uDDBE'));
+assertEquals('"\\uddbf"', JSON.stringify('\uDDBF'));
+assertEquals('"\\uddc0"', JSON.stringify('\uDDC0'));
+assertEquals('"\\uddc1"', JSON.stringify('\uDDC1'));
+assertEquals('"\\uddc2"', JSON.stringify('\uDDC2'));
+assertEquals('"\\uddc3"', JSON.stringify('\uDDC3'));
+assertEquals('"\\uddc4"', JSON.stringify('\uDDC4'));
+assertEquals('"\\uddc5"', JSON.stringify('\uDDC5'));
+assertEquals('"\\uddc6"', JSON.stringify('\uDDC6'));
+assertEquals('"\\uddc7"', JSON.stringify('\uDDC7'));
+assertEquals('"\\uddc8"', JSON.stringify('\uDDC8'));
+assertEquals('"\\uddc9"', JSON.stringify('\uDDC9'));
+assertEquals('"\\uddca"', JSON.stringify('\uDDCA'));
+assertEquals('"\\uddcb"', JSON.stringify('\uDDCB'));
+assertEquals('"\\uddcc"', JSON.stringify('\uDDCC'));
+assertEquals('"\\uddcd"', JSON.stringify('\uDDCD'));
+assertEquals('"\\uddce"', JSON.stringify('\uDDCE'));
+assertEquals('"\\uddcf"', JSON.stringify('\uDDCF'));
+assertEquals('"\\uddd0"', JSON.stringify('\uDDD0'));
+assertEquals('"\\uddd1"', JSON.stringify('\uDDD1'));
+assertEquals('"\\uddd2"', JSON.stringify('\uDDD2'));
+assertEquals('"\\uddd3"', JSON.stringify('\uDDD3'));
+assertEquals('"\\uddd4"', JSON.stringify('\uDDD4'));
+assertEquals('"\\uddd5"', JSON.stringify('\uDDD5'));
+assertEquals('"\\uddd6"', JSON.stringify('\uDDD6'));
+assertEquals('"\\uddd7"', JSON.stringify('\uDDD7'));
+assertEquals('"\\uddd8"', JSON.stringify('\uDDD8'));
+assertEquals('"\\uddd9"', JSON.stringify('\uDDD9'));
+assertEquals('"\\uddda"', JSON.stringify('\uDDDA'));
+assertEquals('"\\udddb"', JSON.stringify('\uDDDB'));
+assertEquals('"\\udddc"', JSON.stringify('\uDDDC'));
+assertEquals('"\\udddd"', JSON.stringify('\uDDDD'));
+assertEquals('"\\uddde"', JSON.stringify('\uDDDE'));
+assertEquals('"\\udddf"', JSON.stringify('\uDDDF'));
+assertEquals('"\\udde0"', JSON.stringify('\uDDE0'));
+assertEquals('"\\udde1"', JSON.stringify('\uDDE1'));
+assertEquals('"\\udde2"', JSON.stringify('\uDDE2'));
+assertEquals('"\\udde3"', JSON.stringify('\uDDE3'));
+assertEquals('"\\udde4"', JSON.stringify('\uDDE4'));
+assertEquals('"\\udde5"', JSON.stringify('\uDDE5'));
+assertEquals('"\\udde6"', JSON.stringify('\uDDE6'));
+assertEquals('"\\udde7"', JSON.stringify('\uDDE7'));
+assertEquals('"\\udde8"', JSON.stringify('\uDDE8'));
+assertEquals('"\\udde9"', JSON.stringify('\uDDE9'));
+assertEquals('"\\uddea"', JSON.stringify('\uDDEA'));
+assertEquals('"\\uddeb"', JSON.stringify('\uDDEB'));
+assertEquals('"\\uddec"', JSON.stringify('\uDDEC'));
+assertEquals('"\\udded"', JSON.stringify('\uDDED'));
+assertEquals('"\\uddee"', JSON.stringify('\uDDEE'));
+assertEquals('"\\uddef"', JSON.stringify('\uDDEF'));
+assertEquals('"\\uddf0"', JSON.stringify('\uDDF0'));
+assertEquals('"\\uddf1"', JSON.stringify('\uDDF1'));
+assertEquals('"\\uddf2"', JSON.stringify('\uDDF2'));
+assertEquals('"\\uddf3"', JSON.stringify('\uDDF3'));
+assertEquals('"\\uddf4"', JSON.stringify('\uDDF4'));
+assertEquals('"\\uddf5"', JSON.stringify('\uDDF5'));
+assertEquals('"\\uddf6"', JSON.stringify('\uDDF6'));
+assertEquals('"\\uddf7"', JSON.stringify('\uDDF7'));
+assertEquals('"\\uddf8"', JSON.stringify('\uDDF8'));
+assertEquals('"\\uddf9"', JSON.stringify('\uDDF9'));
+assertEquals('"\\uddfa"', JSON.stringify('\uDDFA'));
+assertEquals('"\\uddfb"', JSON.stringify('\uDDFB'));
+assertEquals('"\\uddfc"', JSON.stringify('\uDDFC'));
+assertEquals('"\\uddfd"', JSON.stringify('\uDDFD'));
+assertEquals('"\\uddfe"', JSON.stringify('\uDDFE'));
+assertEquals('"\\uddff"', JSON.stringify('\uDDFF'));
+assertEquals('"\\ude00"', JSON.stringify('\uDE00'));
+assertEquals('"\\ude01"', JSON.stringify('\uDE01'));
+assertEquals('"\\ude02"', JSON.stringify('\uDE02'));
+assertEquals('"\\ude03"', JSON.stringify('\uDE03'));
+assertEquals('"\\ude04"', JSON.stringify('\uDE04'));
+assertEquals('"\\ude05"', JSON.stringify('\uDE05'));
+assertEquals('"\\ude06"', JSON.stringify('\uDE06'));
+assertEquals('"\\ude07"', JSON.stringify('\uDE07'));
+assertEquals('"\\ude08"', JSON.stringify('\uDE08'));
+assertEquals('"\\ude09"', JSON.stringify('\uDE09'));
+assertEquals('"\\ude0a"', JSON.stringify('\uDE0A'));
+assertEquals('"\\ude0b"', JSON.stringify('\uDE0B'));
+assertEquals('"\\ude0c"', JSON.stringify('\uDE0C'));
+assertEquals('"\\ude0d"', JSON.stringify('\uDE0D'));
+assertEquals('"\\ude0e"', JSON.stringify('\uDE0E'));
+assertEquals('"\\ude0f"', JSON.stringify('\uDE0F'));
+assertEquals('"\\ude10"', JSON.stringify('\uDE10'));
+assertEquals('"\\ude11"', JSON.stringify('\uDE11'));
+assertEquals('"\\ude12"', JSON.stringify('\uDE12'));
+assertEquals('"\\ude13"', JSON.stringify('\uDE13'));
+assertEquals('"\\ude14"', JSON.stringify('\uDE14'));
+assertEquals('"\\ude15"', JSON.stringify('\uDE15'));
+assertEquals('"\\ude16"', JSON.stringify('\uDE16'));
+assertEquals('"\\ude17"', JSON.stringify('\uDE17'));
+assertEquals('"\\ude18"', JSON.stringify('\uDE18'));
+assertEquals('"\\ude19"', JSON.stringify('\uDE19'));
+assertEquals('"\\ude1a"', JSON.stringify('\uDE1A'));
+assertEquals('"\\ude1b"', JSON.stringify('\uDE1B'));
+assertEquals('"\\ude1c"', JSON.stringify('\uDE1C'));
+assertEquals('"\\ude1d"', JSON.stringify('\uDE1D'));
+assertEquals('"\\ude1e"', JSON.stringify('\uDE1E'));
+assertEquals('"\\ude1f"', JSON.stringify('\uDE1F'));
+assertEquals('"\\ude20"', JSON.stringify('\uDE20'));
+assertEquals('"\\ude21"', JSON.stringify('\uDE21'));
+assertEquals('"\\ude22"', JSON.stringify('\uDE22'));
+assertEquals('"\\ude23"', JSON.stringify('\uDE23'));
+assertEquals('"\\ude24"', JSON.stringify('\uDE24'));
+assertEquals('"\\ude25"', JSON.stringify('\uDE25'));
+assertEquals('"\\ude26"', JSON.stringify('\uDE26'));
+assertEquals('"\\ude27"', JSON.stringify('\uDE27'));
+assertEquals('"\\ude28"', JSON.stringify('\uDE28'));
+assertEquals('"\\ude29"', JSON.stringify('\uDE29'));
+assertEquals('"\\ude2a"', JSON.stringify('\uDE2A'));
+assertEquals('"\\ude2b"', JSON.stringify('\uDE2B'));
+assertEquals('"\\ude2c"', JSON.stringify('\uDE2C'));
+assertEquals('"\\ude2d"', JSON.stringify('\uDE2D'));
+assertEquals('"\\ude2e"', JSON.stringify('\uDE2E'));
+assertEquals('"\\ude2f"', JSON.stringify('\uDE2F'));
+assertEquals('"\\ude30"', JSON.stringify('\uDE30'));
+assertEquals('"\\ude31"', JSON.stringify('\uDE31'));
+assertEquals('"\\ude32"', JSON.stringify('\uDE32'));
+assertEquals('"\\ude33"', JSON.stringify('\uDE33'));
+assertEquals('"\\ude34"', JSON.stringify('\uDE34'));
+assertEquals('"\\ude35"', JSON.stringify('\uDE35'));
+assertEquals('"\\ude36"', JSON.stringify('\uDE36'));
+assertEquals('"\\ude37"', JSON.stringify('\uDE37'));
+assertEquals('"\\ude38"', JSON.stringify('\uDE38'));
+assertEquals('"\\ude39"', JSON.stringify('\uDE39'));
+assertEquals('"\\ude3a"', JSON.stringify('\uDE3A'));
+assertEquals('"\\ude3b"', JSON.stringify('\uDE3B'));
+assertEquals('"\\ude3c"', JSON.stringify('\uDE3C'));
+assertEquals('"\\ude3d"', JSON.stringify('\uDE3D'));
+assertEquals('"\\ude3e"', JSON.stringify('\uDE3E'));
+assertEquals('"\\ude3f"', JSON.stringify('\uDE3F'));
+assertEquals('"\\ude40"', JSON.stringify('\uDE40'));
+assertEquals('"\\ude41"', JSON.stringify('\uDE41'));
+assertEquals('"\\ude42"', JSON.stringify('\uDE42'));
+assertEquals('"\\ude43"', JSON.stringify('\uDE43'));
+assertEquals('"\\ude44"', JSON.stringify('\uDE44'));
+assertEquals('"\\ude45"', JSON.stringify('\uDE45'));
+assertEquals('"\\ude46"', JSON.stringify('\uDE46'));
+assertEquals('"\\ude47"', JSON.stringify('\uDE47'));
+assertEquals('"\\ude48"', JSON.stringify('\uDE48'));
+assertEquals('"\\ude49"', JSON.stringify('\uDE49'));
+assertEquals('"\\ude4a"', JSON.stringify('\uDE4A'));
+assertEquals('"\\ude4b"', JSON.stringify('\uDE4B'));
+assertEquals('"\\ude4c"', JSON.stringify('\uDE4C'));
+assertEquals('"\\ude4d"', JSON.stringify('\uDE4D'));
+assertEquals('"\\ude4e"', JSON.stringify('\uDE4E'));
+assertEquals('"\\ude4f"', JSON.stringify('\uDE4F'));
+assertEquals('"\\ude50"', JSON.stringify('\uDE50'));
+assertEquals('"\\ude51"', JSON.stringify('\uDE51'));
+assertEquals('"\\ude52"', JSON.stringify('\uDE52'));
+assertEquals('"\\ude53"', JSON.stringify('\uDE53'));
+assertEquals('"\\ude54"', JSON.stringify('\uDE54'));
+assertEquals('"\\ude55"', JSON.stringify('\uDE55'));
+assertEquals('"\\ude56"', JSON.stringify('\uDE56'));
+assertEquals('"\\ude57"', JSON.stringify('\uDE57'));
+assertEquals('"\\ude58"', JSON.stringify('\uDE58'));
+assertEquals('"\\ude59"', JSON.stringify('\uDE59'));
+assertEquals('"\\ude5a"', JSON.stringify('\uDE5A'));
+assertEquals('"\\ude5b"', JSON.stringify('\uDE5B'));
+assertEquals('"\\ude5c"', JSON.stringify('\uDE5C'));
+assertEquals('"\\ude5d"', JSON.stringify('\uDE5D'));
+assertEquals('"\\ude5e"', JSON.stringify('\uDE5E'));
+assertEquals('"\\ude5f"', JSON.stringify('\uDE5F'));
+assertEquals('"\\ude60"', JSON.stringify('\uDE60'));
+assertEquals('"\\ude61"', JSON.stringify('\uDE61'));
+assertEquals('"\\ude62"', JSON.stringify('\uDE62'));
+assertEquals('"\\ude63"', JSON.stringify('\uDE63'));
+assertEquals('"\\ude64"', JSON.stringify('\uDE64'));
+assertEquals('"\\ude65"', JSON.stringify('\uDE65'));
+assertEquals('"\\ude66"', JSON.stringify('\uDE66'));
+assertEquals('"\\ude67"', JSON.stringify('\uDE67'));
+assertEquals('"\\ude68"', JSON.stringify('\uDE68'));
+assertEquals('"\\ude69"', JSON.stringify('\uDE69'));
+assertEquals('"\\ude6a"', JSON.stringify('\uDE6A'));
+assertEquals('"\\ude6b"', JSON.stringify('\uDE6B'));
+assertEquals('"\\ude6c"', JSON.stringify('\uDE6C'));
+assertEquals('"\\ude6d"', JSON.stringify('\uDE6D'));
+assertEquals('"\\ude6e"', JSON.stringify('\uDE6E'));
+assertEquals('"\\ude6f"', JSON.stringify('\uDE6F'));
+assertEquals('"\\ude70"', JSON.stringify('\uDE70'));
+assertEquals('"\\ude71"', JSON.stringify('\uDE71'));
+assertEquals('"\\ude72"', JSON.stringify('\uDE72'));
+assertEquals('"\\ude73"', JSON.stringify('\uDE73'));
+assertEquals('"\\ude74"', JSON.stringify('\uDE74'));
+assertEquals('"\\ude75"', JSON.stringify('\uDE75'));
+assertEquals('"\\ude76"', JSON.stringify('\uDE76'));
+assertEquals('"\\ude77"', JSON.stringify('\uDE77'));
+assertEquals('"\\ude78"', JSON.stringify('\uDE78'));
+assertEquals('"\\ude79"', JSON.stringify('\uDE79'));
+assertEquals('"\\ude7a"', JSON.stringify('\uDE7A'));
+assertEquals('"\\ude7b"', JSON.stringify('\uDE7B'));
+assertEquals('"\\ude7c"', JSON.stringify('\uDE7C'));
+assertEquals('"\\ude7d"', JSON.stringify('\uDE7D'));
+assertEquals('"\\ude7e"', JSON.stringify('\uDE7E'));
+assertEquals('"\\ude7f"', JSON.stringify('\uDE7F'));
+assertEquals('"\\ude80"', JSON.stringify('\uDE80'));
+assertEquals('"\\ude81"', JSON.stringify('\uDE81'));
+assertEquals('"\\ude82"', JSON.stringify('\uDE82'));
+assertEquals('"\\ude83"', JSON.stringify('\uDE83'));
+assertEquals('"\\ude84"', JSON.stringify('\uDE84'));
+assertEquals('"\\ude85"', JSON.stringify('\uDE85'));
+assertEquals('"\\ude86"', JSON.stringify('\uDE86'));
+assertEquals('"\\ude87"', JSON.stringify('\uDE87'));
+assertEquals('"\\ude88"', JSON.stringify('\uDE88'));
+assertEquals('"\\ude89"', JSON.stringify('\uDE89'));
+assertEquals('"\\ude8a"', JSON.stringify('\uDE8A'));
+assertEquals('"\\ude8b"', JSON.stringify('\uDE8B'));
+assertEquals('"\\ude8c"', JSON.stringify('\uDE8C'));
+assertEquals('"\\ude8d"', JSON.stringify('\uDE8D'));
+assertEquals('"\\ude8e"', JSON.stringify('\uDE8E'));
+assertEquals('"\\ude8f"', JSON.stringify('\uDE8F'));
+assertEquals('"\\ude90"', JSON.stringify('\uDE90'));
+assertEquals('"\\ude91"', JSON.stringify('\uDE91'));
+assertEquals('"\\ude92"', JSON.stringify('\uDE92'));
+assertEquals('"\\ude93"', JSON.stringify('\uDE93'));
+assertEquals('"\\ude94"', JSON.stringify('\uDE94'));
+assertEquals('"\\ude95"', JSON.stringify('\uDE95'));
+assertEquals('"\\ude96"', JSON.stringify('\uDE96'));
+assertEquals('"\\ude97"', JSON.stringify('\uDE97'));
+assertEquals('"\\ude98"', JSON.stringify('\uDE98'));
+assertEquals('"\\ude99"', JSON.stringify('\uDE99'));
+assertEquals('"\\ude9a"', JSON.stringify('\uDE9A'));
+assertEquals('"\\ude9b"', JSON.stringify('\uDE9B'));
+assertEquals('"\\ude9c"', JSON.stringify('\uDE9C'));
+assertEquals('"\\ude9d"', JSON.stringify('\uDE9D'));
+assertEquals('"\\ude9e"', JSON.stringify('\uDE9E'));
+assertEquals('"\\ude9f"', JSON.stringify('\uDE9F'));
+assertEquals('"\\udea0"', JSON.stringify('\uDEA0'));
+assertEquals('"\\udea1"', JSON.stringify('\uDEA1'));
+assertEquals('"\\udea2"', JSON.stringify('\uDEA2'));
+assertEquals('"\\udea3"', JSON.stringify('\uDEA3'));
+assertEquals('"\\udea4"', JSON.stringify('\uDEA4'));
+assertEquals('"\\udea5"', JSON.stringify('\uDEA5'));
+assertEquals('"\\udea6"', JSON.stringify('\uDEA6'));
+assertEquals('"\\udea7"', JSON.stringify('\uDEA7'));
+assertEquals('"\\udea8"', JSON.stringify('\uDEA8'));
+assertEquals('"\\udea9"', JSON.stringify('\uDEA9'));
+assertEquals('"\\udeaa"', JSON.stringify('\uDEAA'));
+assertEquals('"\\udeab"', JSON.stringify('\uDEAB'));
+assertEquals('"\\udeac"', JSON.stringify('\uDEAC'));
+assertEquals('"\\udead"', JSON.stringify('\uDEAD'));
+assertEquals('"\\udeae"', JSON.stringify('\uDEAE'));
+assertEquals('"\\udeaf"', JSON.stringify('\uDEAF'));
+assertEquals('"\\udeb0"', JSON.stringify('\uDEB0'));
+assertEquals('"\\udeb1"', JSON.stringify('\uDEB1'));
+assertEquals('"\\udeb2"', JSON.stringify('\uDEB2'));
+assertEquals('"\\udeb3"', JSON.stringify('\uDEB3'));
+assertEquals('"\\udeb4"', JSON.stringify('\uDEB4'));
+assertEquals('"\\udeb5"', JSON.stringify('\uDEB5'));
+assertEquals('"\\udeb6"', JSON.stringify('\uDEB6'));
+assertEquals('"\\udeb7"', JSON.stringify('\uDEB7'));
+assertEquals('"\\udeb8"', JSON.stringify('\uDEB8'));
+assertEquals('"\\udeb9"', JSON.stringify('\uDEB9'));
+assertEquals('"\\udeba"', JSON.stringify('\uDEBA'));
+assertEquals('"\\udebb"', JSON.stringify('\uDEBB'));
+assertEquals('"\\udebc"', JSON.stringify('\uDEBC'));
+assertEquals('"\\udebd"', JSON.stringify('\uDEBD'));
+assertEquals('"\\udebe"', JSON.stringify('\uDEBE'));
+assertEquals('"\\udebf"', JSON.stringify('\uDEBF'));
+assertEquals('"\\udec0"', JSON.stringify('\uDEC0'));
+assertEquals('"\\udec1"', JSON.stringify('\uDEC1'));
+assertEquals('"\\udec2"', JSON.stringify('\uDEC2'));
+assertEquals('"\\udec3"', JSON.stringify('\uDEC3'));
+assertEquals('"\\udec4"', JSON.stringify('\uDEC4'));
+assertEquals('"\\udec5"', JSON.stringify('\uDEC5'));
+assertEquals('"\\udec6"', JSON.stringify('\uDEC6'));
+assertEquals('"\\udec7"', JSON.stringify('\uDEC7'));
+assertEquals('"\\udec8"', JSON.stringify('\uDEC8'));
+assertEquals('"\\udec9"', JSON.stringify('\uDEC9'));
+assertEquals('"\\udeca"', JSON.stringify('\uDECA'));
+assertEquals('"\\udecb"', JSON.stringify('\uDECB'));
+assertEquals('"\\udecc"', JSON.stringify('\uDECC'));
+assertEquals('"\\udecd"', JSON.stringify('\uDECD'));
+assertEquals('"\\udece"', JSON.stringify('\uDECE'));
+assertEquals('"\\udecf"', JSON.stringify('\uDECF'));
+assertEquals('"\\uded0"', JSON.stringify('\uDED0'));
+assertEquals('"\\uded1"', JSON.stringify('\uDED1'));
+assertEquals('"\\uded2"', JSON.stringify('\uDED2'));
+assertEquals('"\\uded3"', JSON.stringify('\uDED3'));
+assertEquals('"\\uded4"', JSON.stringify('\uDED4'));
+assertEquals('"\\uded5"', JSON.stringify('\uDED5'));
+assertEquals('"\\uded6"', JSON.stringify('\uDED6'));
+assertEquals('"\\uded7"', JSON.stringify('\uDED7'));
+assertEquals('"\\uded8"', JSON.stringify('\uDED8'));
+assertEquals('"\\uded9"', JSON.stringify('\uDED9'));
+assertEquals('"\\udeda"', JSON.stringify('\uDEDA'));
+assertEquals('"\\udedb"', JSON.stringify('\uDEDB'));
+assertEquals('"\\udedc"', JSON.stringify('\uDEDC'));
+assertEquals('"\\udedd"', JSON.stringify('\uDEDD'));
+assertEquals('"\\udede"', JSON.stringify('\uDEDE'));
+assertEquals('"\\udedf"', JSON.stringify('\uDEDF'));
+assertEquals('"\\udee0"', JSON.stringify('\uDEE0'));
+assertEquals('"\\udee1"', JSON.stringify('\uDEE1'));
+assertEquals('"\\udee2"', JSON.stringify('\uDEE2'));
+assertEquals('"\\udee3"', JSON.stringify('\uDEE3'));
+assertEquals('"\\udee4"', JSON.stringify('\uDEE4'));
+assertEquals('"\\udee5"', JSON.stringify('\uDEE5'));
+assertEquals('"\\udee6"', JSON.stringify('\uDEE6'));
+assertEquals('"\\udee7"', JSON.stringify('\uDEE7'));
+assertEquals('"\\udee8"', JSON.stringify('\uDEE8'));
+assertEquals('"\\udee9"', JSON.stringify('\uDEE9'));
+assertEquals('"\\udeea"', JSON.stringify('\uDEEA'));
+assertEquals('"\\udeeb"', JSON.stringify('\uDEEB'));
+assertEquals('"\\udeec"', JSON.stringify('\uDEEC'));
+assertEquals('"\\udeed"', JSON.stringify('\uDEED'));
+assertEquals('"\\udeee"', JSON.stringify('\uDEEE'));
+assertEquals('"\\udeef"', JSON.stringify('\uDEEF'));
+assertEquals('"\\udef0"', JSON.stringify('\uDEF0'));
+assertEquals('"\\udef1"', JSON.stringify('\uDEF1'));
+assertEquals('"\\udef2"', JSON.stringify('\uDEF2'));
+assertEquals('"\\udef3"', JSON.stringify('\uDEF3'));
+assertEquals('"\\udef4"', JSON.stringify('\uDEF4'));
+assertEquals('"\\udef5"', JSON.stringify('\uDEF5'));
+assertEquals('"\\udef6"', JSON.stringify('\uDEF6'));
+assertEquals('"\\udef7"', JSON.stringify('\uDEF7'));
+assertEquals('"\\udef8"', JSON.stringify('\uDEF8'));
+assertEquals('"\\udef9"', JSON.stringify('\uDEF9'));
+assertEquals('"\\udefa"', JSON.stringify('\uDEFA'));
+assertEquals('"\\udefb"', JSON.stringify('\uDEFB'));
+assertEquals('"\\udefc"', JSON.stringify('\uDEFC'));
+assertEquals('"\\udefd"', JSON.stringify('\uDEFD'));
+assertEquals('"\\udefe"', JSON.stringify('\uDEFE'));
+assertEquals('"\\udeff"', JSON.stringify('\uDEFF'));
+assertEquals('"\\udf00"', JSON.stringify('\uDF00'));
+assertEquals('"\\udf01"', JSON.stringify('\uDF01'));
+assertEquals('"\\udf02"', JSON.stringify('\uDF02'));
+assertEquals('"\\udf03"', JSON.stringify('\uDF03'));
+assertEquals('"\\udf04"', JSON.stringify('\uDF04'));
+assertEquals('"\\udf05"', JSON.stringify('\uDF05'));
+assertEquals('"\\udf06"', JSON.stringify('\uDF06'));
+assertEquals('"\\udf07"', JSON.stringify('\uDF07'));
+assertEquals('"\\udf08"', JSON.stringify('\uDF08'));
+assertEquals('"\\udf09"', JSON.stringify('\uDF09'));
+assertEquals('"\\udf0a"', JSON.stringify('\uDF0A'));
+assertEquals('"\\udf0b"', JSON.stringify('\uDF0B'));
+assertEquals('"\\udf0c"', JSON.stringify('\uDF0C'));
+assertEquals('"\\udf0d"', JSON.stringify('\uDF0D'));
+assertEquals('"\\udf0e"', JSON.stringify('\uDF0E'));
+assertEquals('"\\udf0f"', JSON.stringify('\uDF0F'));
+assertEquals('"\\udf10"', JSON.stringify('\uDF10'));
+assertEquals('"\\udf11"', JSON.stringify('\uDF11'));
+assertEquals('"\\udf12"', JSON.stringify('\uDF12'));
+assertEquals('"\\udf13"', JSON.stringify('\uDF13'));
+assertEquals('"\\udf14"', JSON.stringify('\uDF14'));
+assertEquals('"\\udf15"', JSON.stringify('\uDF15'));
+assertEquals('"\\udf16"', JSON.stringify('\uDF16'));
+assertEquals('"\\udf17"', JSON.stringify('\uDF17'));
+assertEquals('"\\udf18"', JSON.stringify('\uDF18'));
+assertEquals('"\\udf19"', JSON.stringify('\uDF19'));
+assertEquals('"\\udf1a"', JSON.stringify('\uDF1A'));
+assertEquals('"\\udf1b"', JSON.stringify('\uDF1B'));
+assertEquals('"\\udf1c"', JSON.stringify('\uDF1C'));
+assertEquals('"\\udf1d"', JSON.stringify('\uDF1D'));
+assertEquals('"\\udf1e"', JSON.stringify('\uDF1E'));
+assertEquals('"\\udf1f"', JSON.stringify('\uDF1F'));
+assertEquals('"\\udf20"', JSON.stringify('\uDF20'));
+assertEquals('"\\udf21"', JSON.stringify('\uDF21'));
+assertEquals('"\\udf22"', JSON.stringify('\uDF22'));
+assertEquals('"\\udf23"', JSON.stringify('\uDF23'));
+assertEquals('"\\udf24"', JSON.stringify('\uDF24'));
+assertEquals('"\\udf25"', JSON.stringify('\uDF25'));
+assertEquals('"\\udf26"', JSON.stringify('\uDF26'));
+assertEquals('"\\udf27"', JSON.stringify('\uDF27'));
+assertEquals('"\\udf28"', JSON.stringify('\uDF28'));
+assertEquals('"\\udf29"', JSON.stringify('\uDF29'));
+assertEquals('"\\udf2a"', JSON.stringify('\uDF2A'));
+assertEquals('"\\udf2b"', JSON.stringify('\uDF2B'));
+assertEquals('"\\udf2c"', JSON.stringify('\uDF2C'));
+assertEquals('"\\udf2d"', JSON.stringify('\uDF2D'));
+assertEquals('"\\udf2e"', JSON.stringify('\uDF2E'));
+assertEquals('"\\udf2f"', JSON.stringify('\uDF2F'));
+assertEquals('"\\udf30"', JSON.stringify('\uDF30'));
+assertEquals('"\\udf31"', JSON.stringify('\uDF31'));
+assertEquals('"\\udf32"', JSON.stringify('\uDF32'));
+assertEquals('"\\udf33"', JSON.stringify('\uDF33'));
+assertEquals('"\\udf34"', JSON.stringify('\uDF34'));
+assertEquals('"\\udf35"', JSON.stringify('\uDF35'));
+assertEquals('"\\udf36"', JSON.stringify('\uDF36'));
+assertEquals('"\\udf37"', JSON.stringify('\uDF37'));
+assertEquals('"\\udf38"', JSON.stringify('\uDF38'));
+assertEquals('"\\udf39"', JSON.stringify('\uDF39'));
+assertEquals('"\\udf3a"', JSON.stringify('\uDF3A'));
+assertEquals('"\\udf3b"', JSON.stringify('\uDF3B'));
+assertEquals('"\\udf3c"', JSON.stringify('\uDF3C'));
+assertEquals('"\\udf3d"', JSON.stringify('\uDF3D'));
+assertEquals('"\\udf3e"', JSON.stringify('\uDF3E'));
+assertEquals('"\\udf3f"', JSON.stringify('\uDF3F'));
+assertEquals('"\\udf40"', JSON.stringify('\uDF40'));
+assertEquals('"\\udf41"', JSON.stringify('\uDF41'));
+assertEquals('"\\udf42"', JSON.stringify('\uDF42'));
+assertEquals('"\\udf43"', JSON.stringify('\uDF43'));
+assertEquals('"\\udf44"', JSON.stringify('\uDF44'));
+assertEquals('"\\udf45"', JSON.stringify('\uDF45'));
+assertEquals('"\\udf46"', JSON.stringify('\uDF46'));
+assertEquals('"\\udf47"', JSON.stringify('\uDF47'));
+assertEquals('"\\udf48"', JSON.stringify('\uDF48'));
+assertEquals('"\\udf49"', JSON.stringify('\uDF49'));
+assertEquals('"\\udf4a"', JSON.stringify('\uDF4A'));
+assertEquals('"\\udf4b"', JSON.stringify('\uDF4B'));
+assertEquals('"\\udf4c"', JSON.stringify('\uDF4C'));
+assertEquals('"\\udf4d"', JSON.stringify('\uDF4D'));
+assertEquals('"\\udf4e"', JSON.stringify('\uDF4E'));
+assertEquals('"\\udf4f"', JSON.stringify('\uDF4F'));
+assertEquals('"\\udf50"', JSON.stringify('\uDF50'));
+assertEquals('"\\udf51"', JSON.stringify('\uDF51'));
+assertEquals('"\\udf52"', JSON.stringify('\uDF52'));
+assertEquals('"\\udf53"', JSON.stringify('\uDF53'));
+assertEquals('"\\udf54"', JSON.stringify('\uDF54'));
+assertEquals('"\\udf55"', JSON.stringify('\uDF55'));
+assertEquals('"\\udf56"', JSON.stringify('\uDF56'));
+assertEquals('"\\udf57"', JSON.stringify('\uDF57'));
+assertEquals('"\\udf58"', JSON.stringify('\uDF58'));
+assertEquals('"\\udf59"', JSON.stringify('\uDF59'));
+assertEquals('"\\udf5a"', JSON.stringify('\uDF5A'));
+assertEquals('"\\udf5b"', JSON.stringify('\uDF5B'));
+assertEquals('"\\udf5c"', JSON.stringify('\uDF5C'));
+assertEquals('"\\udf5d"', JSON.stringify('\uDF5D'));
+assertEquals('"\\udf5e"', JSON.stringify('\uDF5E'));
+assertEquals('"\\udf5f"', JSON.stringify('\uDF5F'));
+assertEquals('"\\udf60"', JSON.stringify('\uDF60'));
+assertEquals('"\\udf61"', JSON.stringify('\uDF61'));
+assertEquals('"\\udf62"', JSON.stringify('\uDF62'));
+assertEquals('"\\udf63"', JSON.stringify('\uDF63'));
+assertEquals('"\\udf64"', JSON.stringify('\uDF64'));
+assertEquals('"\\udf65"', JSON.stringify('\uDF65'));
+assertEquals('"\\udf66"', JSON.stringify('\uDF66'));
+assertEquals('"\\udf67"', JSON.stringify('\uDF67'));
+assertEquals('"\\udf68"', JSON.stringify('\uDF68'));
+assertEquals('"\\udf69"', JSON.stringify('\uDF69'));
+assertEquals('"\\udf6a"', JSON.stringify('\uDF6A'));
+assertEquals('"\\udf6b"', JSON.stringify('\uDF6B'));
+assertEquals('"\\udf6c"', JSON.stringify('\uDF6C'));
+assertEquals('"\\udf6d"', JSON.stringify('\uDF6D'));
+assertEquals('"\\udf6e"', JSON.stringify('\uDF6E'));
+assertEquals('"\\udf6f"', JSON.stringify('\uDF6F'));
+assertEquals('"\\udf70"', JSON.stringify('\uDF70'));
+assertEquals('"\\udf71"', JSON.stringify('\uDF71'));
+assertEquals('"\\udf72"', JSON.stringify('\uDF72'));
+assertEquals('"\\udf73"', JSON.stringify('\uDF73'));
+assertEquals('"\\udf74"', JSON.stringify('\uDF74'));
+assertEquals('"\\udf75"', JSON.stringify('\uDF75'));
+assertEquals('"\\udf76"', JSON.stringify('\uDF76'));
+assertEquals('"\\udf77"', JSON.stringify('\uDF77'));
+assertEquals('"\\udf78"', JSON.stringify('\uDF78'));
+assertEquals('"\\udf79"', JSON.stringify('\uDF79'));
+assertEquals('"\\udf7a"', JSON.stringify('\uDF7A'));
+assertEquals('"\\udf7b"', JSON.stringify('\uDF7B'));
+assertEquals('"\\udf7c"', JSON.stringify('\uDF7C'));
+assertEquals('"\\udf7d"', JSON.stringify('\uDF7D'));
+assertEquals('"\\udf7e"', JSON.stringify('\uDF7E'));
+assertEquals('"\\udf7f"', JSON.stringify('\uDF7F'));
+assertEquals('"\\udf80"', JSON.stringify('\uDF80'));
+assertEquals('"\\udf81"', JSON.stringify('\uDF81'));
+assertEquals('"\\udf82"', JSON.stringify('\uDF82'));
+assertEquals('"\\udf83"', JSON.stringify('\uDF83'));
+assertEquals('"\\udf84"', JSON.stringify('\uDF84'));
+assertEquals('"\\udf85"', JSON.stringify('\uDF85'));
+assertEquals('"\\udf86"', JSON.stringify('\uDF86'));
+assertEquals('"\\udf87"', JSON.stringify('\uDF87'));
+assertEquals('"\\udf88"', JSON.stringify('\uDF88'));
+assertEquals('"\\udf89"', JSON.stringify('\uDF89'));
+assertEquals('"\\udf8a"', JSON.stringify('\uDF8A'));
+assertEquals('"\\udf8b"', JSON.stringify('\uDF8B'));
+assertEquals('"\\udf8c"', JSON.stringify('\uDF8C'));
+assertEquals('"\\udf8d"', JSON.stringify('\uDF8D'));
+assertEquals('"\\udf8e"', JSON.stringify('\uDF8E'));
+assertEquals('"\\udf8f"', JSON.stringify('\uDF8F'));
+assertEquals('"\\udf90"', JSON.stringify('\uDF90'));
+assertEquals('"\\udf91"', JSON.stringify('\uDF91'));
+assertEquals('"\\udf92"', JSON.stringify('\uDF92'));
+assertEquals('"\\udf93"', JSON.stringify('\uDF93'));
+assertEquals('"\\udf94"', JSON.stringify('\uDF94'));
+assertEquals('"\\udf95"', JSON.stringify('\uDF95'));
+assertEquals('"\\udf96"', JSON.stringify('\uDF96'));
+assertEquals('"\\udf97"', JSON.stringify('\uDF97'));
+assertEquals('"\\udf98"', JSON.stringify('\uDF98'));
+assertEquals('"\\udf99"', JSON.stringify('\uDF99'));
+assertEquals('"\\udf9a"', JSON.stringify('\uDF9A'));
+assertEquals('"\\udf9b"', JSON.stringify('\uDF9B'));
+assertEquals('"\\udf9c"', JSON.stringify('\uDF9C'));
+assertEquals('"\\udf9d"', JSON.stringify('\uDF9D'));
+assertEquals('"\\udf9e"', JSON.stringify('\uDF9E'));
+assertEquals('"\\udf9f"', JSON.stringify('\uDF9F'));
+assertEquals('"\\udfa0"', JSON.stringify('\uDFA0'));
+assertEquals('"\\udfa1"', JSON.stringify('\uDFA1'));
+assertEquals('"\\udfa2"', JSON.stringify('\uDFA2'));
+assertEquals('"\\udfa3"', JSON.stringify('\uDFA3'));
+assertEquals('"\\udfa4"', JSON.stringify('\uDFA4'));
+assertEquals('"\\udfa5"', JSON.stringify('\uDFA5'));
+assertEquals('"\\udfa6"', JSON.stringify('\uDFA6'));
+assertEquals('"\\udfa7"', JSON.stringify('\uDFA7'));
+assertEquals('"\\udfa8"', JSON.stringify('\uDFA8'));
+assertEquals('"\\udfa9"', JSON.stringify('\uDFA9'));
+assertEquals('"\\udfaa"', JSON.stringify('\uDFAA'));
+assertEquals('"\\udfab"', JSON.stringify('\uDFAB'));
+assertEquals('"\\udfac"', JSON.stringify('\uDFAC'));
+assertEquals('"\\udfad"', JSON.stringify('\uDFAD'));
+assertEquals('"\\udfae"', JSON.stringify('\uDFAE'));
+assertEquals('"\\udfaf"', JSON.stringify('\uDFAF'));
+assertEquals('"\\udfb0"', JSON.stringify('\uDFB0'));
+assertEquals('"\\udfb1"', JSON.stringify('\uDFB1'));
+assertEquals('"\\udfb2"', JSON.stringify('\uDFB2'));
+assertEquals('"\\udfb3"', JSON.stringify('\uDFB3'));
+assertEquals('"\\udfb4"', JSON.stringify('\uDFB4'));
+assertEquals('"\\udfb5"', JSON.stringify('\uDFB5'));
+assertEquals('"\\udfb6"', JSON.stringify('\uDFB6'));
+assertEquals('"\\udfb7"', JSON.stringify('\uDFB7'));
+assertEquals('"\\udfb8"', JSON.stringify('\uDFB8'));
+assertEquals('"\\udfb9"', JSON.stringify('\uDFB9'));
+assertEquals('"\\udfba"', JSON.stringify('\uDFBA'));
+assertEquals('"\\udfbb"', JSON.stringify('\uDFBB'));
+assertEquals('"\\udfbc"', JSON.stringify('\uDFBC'));
+assertEquals('"\\udfbd"', JSON.stringify('\uDFBD'));
+assertEquals('"\\udfbe"', JSON.stringify('\uDFBE'));
+assertEquals('"\\udfbf"', JSON.stringify('\uDFBF'));
+assertEquals('"\\udfc0"', JSON.stringify('\uDFC0'));
+assertEquals('"\\udfc1"', JSON.stringify('\uDFC1'));
+assertEquals('"\\udfc2"', JSON.stringify('\uDFC2'));
+assertEquals('"\\udfc3"', JSON.stringify('\uDFC3'));
+assertEquals('"\\udfc4"', JSON.stringify('\uDFC4'));
+assertEquals('"\\udfc5"', JSON.stringify('\uDFC5'));
+assertEquals('"\\udfc6"', JSON.stringify('\uDFC6'));
+assertEquals('"\\udfc7"', JSON.stringify('\uDFC7'));
+assertEquals('"\\udfc8"', JSON.stringify('\uDFC8'));
+assertEquals('"\\udfc9"', JSON.stringify('\uDFC9'));
+assertEquals('"\\udfca"', JSON.stringify('\uDFCA'));
+assertEquals('"\\udfcb"', JSON.stringify('\uDFCB'));
+assertEquals('"\\udfcc"', JSON.stringify('\uDFCC'));
+assertEquals('"\\udfcd"', JSON.stringify('\uDFCD'));
+assertEquals('"\\udfce"', JSON.stringify('\uDFCE'));
+assertEquals('"\\udfcf"', JSON.stringify('\uDFCF'));
+assertEquals('"\\udfd0"', JSON.stringify('\uDFD0'));
+assertEquals('"\\udfd1"', JSON.stringify('\uDFD1'));
+assertEquals('"\\udfd2"', JSON.stringify('\uDFD2'));
+assertEquals('"\\udfd3"', JSON.stringify('\uDFD3'));
+assertEquals('"\\udfd4"', JSON.stringify('\uDFD4'));
+assertEquals('"\\udfd5"', JSON.stringify('\uDFD5'));
+assertEquals('"\\udfd6"', JSON.stringify('\uDFD6'));
+assertEquals('"\\udfd7"', JSON.stringify('\uDFD7'));
+assertEquals('"\\udfd8"', JSON.stringify('\uDFD8'));
+assertEquals('"\\udfd9"', JSON.stringify('\uDFD9'));
+assertEquals('"\\udfda"', JSON.stringify('\uDFDA'));
+assertEquals('"\\udfdb"', JSON.stringify('\uDFDB'));
+assertEquals('"\\udfdc"', JSON.stringify('\uDFDC'));
+assertEquals('"\\udfdd"', JSON.stringify('\uDFDD'));
+assertEquals('"\\udfde"', JSON.stringify('\uDFDE'));
+assertEquals('"\\udfdf"', JSON.stringify('\uDFDF'));
+assertEquals('"\\udfe0"', JSON.stringify('\uDFE0'));
+assertEquals('"\\udfe1"', JSON.stringify('\uDFE1'));
+assertEquals('"\\udfe2"', JSON.stringify('\uDFE2'));
+assertEquals('"\\udfe3"', JSON.stringify('\uDFE3'));
+assertEquals('"\\udfe4"', JSON.stringify('\uDFE4'));
+assertEquals('"\\udfe5"', JSON.stringify('\uDFE5'));
+assertEquals('"\\udfe6"', JSON.stringify('\uDFE6'));
+assertEquals('"\\udfe7"', JSON.stringify('\uDFE7'));
+assertEquals('"\\udfe8"', JSON.stringify('\uDFE8'));
+assertEquals('"\\udfe9"', JSON.stringify('\uDFE9'));
+assertEquals('"\\udfea"', JSON.stringify('\uDFEA'));
+assertEquals('"\\udfeb"', JSON.stringify('\uDFEB'));
+assertEquals('"\\udfec"', JSON.stringify('\uDFEC'));
+assertEquals('"\\udfed"', JSON.stringify('\uDFED'));
+assertEquals('"\\udfee"', JSON.stringify('\uDFEE'));
+assertEquals('"\\udfef"', JSON.stringify('\uDFEF'));
+assertEquals('"\\udff0"', JSON.stringify('\uDFF0'));
+assertEquals('"\\udff1"', JSON.stringify('\uDFF1'));
+assertEquals('"\\udff2"', JSON.stringify('\uDFF2'));
+assertEquals('"\\udff3"', JSON.stringify('\uDFF3'));
+assertEquals('"\\udff4"', JSON.stringify('\uDFF4'));
+assertEquals('"\\udff5"', JSON.stringify('\uDFF5'));
+assertEquals('"\\udff6"', JSON.stringify('\uDFF6'));
+assertEquals('"\\udff7"', JSON.stringify('\uDFF7'));
+assertEquals('"\\udff8"', JSON.stringify('\uDFF8'));
+assertEquals('"\\udff9"', JSON.stringify('\uDFF9'));
+assertEquals('"\\udffa"', JSON.stringify('\uDFFA'));
+assertEquals('"\\udffb"', JSON.stringify('\uDFFB'));
+assertEquals('"\\udffc"', JSON.stringify('\uDFFC'));
+assertEquals('"\\udffd"', JSON.stringify('\uDFFD'));
+assertEquals('"\\udffe"', JSON.stringify('\uDFFE'));
+assertEquals('"\\udfff"', JSON.stringify('\uDFFF'));
+
+// A random selection of code points from U+E000 to U+FFFF.
+assertEquals('"\uE000"', JSON.stringify('\uE000'));
+assertEquals('"\uE00B"', JSON.stringify('\uE00B'));
+assertEquals('"\uE0CC"', JSON.stringify('\uE0CC'));
+assertEquals('"\uE0FD"', JSON.stringify('\uE0FD'));
+assertEquals('"\uE19E"', JSON.stringify('\uE19E'));
+assertEquals('"\uE1B1"', JSON.stringify('\uE1B1'));
+assertEquals('"\uE24F"', JSON.stringify('\uE24F'));
+assertEquals('"\uE262"', JSON.stringify('\uE262'));
+assertEquals('"\uE2C9"', JSON.stringify('\uE2C9'));
+assertEquals('"\uE2DF"', JSON.stringify('\uE2DF'));
+assertEquals('"\uE389"', JSON.stringify('\uE389'));
+assertEquals('"\uE413"', JSON.stringify('\uE413'));
+assertEquals('"\uE546"', JSON.stringify('\uE546'));
+assertEquals('"\uE5E4"', JSON.stringify('\uE5E4'));
+assertEquals('"\uE66B"', JSON.stringify('\uE66B'));
+assertEquals('"\uE73D"', JSON.stringify('\uE73D'));
+assertEquals('"\uE74F"', JSON.stringify('\uE74F'));
+assertEquals('"\uE759"', JSON.stringify('\uE759'));
+assertEquals('"\uE795"', JSON.stringify('\uE795'));
+assertEquals('"\uE836"', JSON.stringify('\uE836'));
+assertEquals('"\uE85D"', JSON.stringify('\uE85D'));
+assertEquals('"\uE909"', JSON.stringify('\uE909'));
+assertEquals('"\uE990"', JSON.stringify('\uE990'));
+assertEquals('"\uE99F"', JSON.stringify('\uE99F'));
+assertEquals('"\uE9AC"', JSON.stringify('\uE9AC'));
+assertEquals('"\uE9C2"', JSON.stringify('\uE9C2'));
+assertEquals('"\uEB11"', JSON.stringify('\uEB11'));
+assertEquals('"\uED33"', JSON.stringify('\uED33'));
+assertEquals('"\uED7D"', JSON.stringify('\uED7D'));
+assertEquals('"\uEDA9"', JSON.stringify('\uEDA9'));
+assertEquals('"\uEDFB"', JSON.stringify('\uEDFB'));
+assertEquals('"\uEE09"', JSON.stringify('\uEE09'));
+assertEquals('"\uEE0D"', JSON.stringify('\uEE0D'));
+assertEquals('"\uEE34"', JSON.stringify('\uEE34'));
+assertEquals('"\uEE37"', JSON.stringify('\uEE37'));
+assertEquals('"\uEE38"', JSON.stringify('\uEE38'));
+assertEquals('"\uEF80"', JSON.stringify('\uEF80'));
+assertEquals('"\uEFE2"', JSON.stringify('\uEFE2'));
+assertEquals('"\uF02C"', JSON.stringify('\uF02C'));
+assertEquals('"\uF09A"', JSON.stringify('\uF09A'));
+assertEquals('"\uF0C1"', JSON.stringify('\uF0C1'));
+assertEquals('"\uF12C"', JSON.stringify('\uF12C'));
+assertEquals('"\uF250"', JSON.stringify('\uF250'));
+assertEquals('"\uF2A3"', JSON.stringify('\uF2A3'));
+assertEquals('"\uF340"', JSON.stringify('\uF340'));
+assertEquals('"\uF3C9"', JSON.stringify('\uF3C9'));
+assertEquals('"\uF3F5"', JSON.stringify('\uF3F5'));
+assertEquals('"\uF41B"', JSON.stringify('\uF41B'));
+assertEquals('"\uF420"', JSON.stringify('\uF420'));
+assertEquals('"\uF440"', JSON.stringify('\uF440'));
+assertEquals('"\uF4AE"', JSON.stringify('\uF4AE'));
+assertEquals('"\uF4B0"', JSON.stringify('\uF4B0'));
+assertEquals('"\uF50D"', JSON.stringify('\uF50D'));
+assertEquals('"\uF55D"', JSON.stringify('\uF55D'));
+assertEquals('"\uF55E"', JSON.stringify('\uF55E'));
+assertEquals('"\uF5CD"', JSON.stringify('\uF5CD'));
+assertEquals('"\uF657"', JSON.stringify('\uF657'));
+assertEquals('"\uF66D"', JSON.stringify('\uF66D'));
+assertEquals('"\uF68F"', JSON.stringify('\uF68F'));
+assertEquals('"\uF6A6"', JSON.stringify('\uF6A6'));
+assertEquals('"\uF6AA"', JSON.stringify('\uF6AA'));
+assertEquals('"\uF6EB"', JSON.stringify('\uF6EB'));
+assertEquals('"\uF79A"', JSON.stringify('\uF79A'));
+assertEquals('"\uF7E7"', JSON.stringify('\uF7E7'));
+assertEquals('"\uF7E8"', JSON.stringify('\uF7E8'));
+assertEquals('"\uF834"', JSON.stringify('\uF834'));
+assertEquals('"\uF88B"', JSON.stringify('\uF88B'));
+assertEquals('"\uF8D5"', JSON.stringify('\uF8D5'));
+assertEquals('"\uF8F1"', JSON.stringify('\uF8F1'));
+assertEquals('"\uF905"', JSON.stringify('\uF905'));
+assertEquals('"\uF927"', JSON.stringify('\uF927'));
+assertEquals('"\uF943"', JSON.stringify('\uF943'));
+assertEquals('"\uF949"', JSON.stringify('\uF949'));
+assertEquals('"\uF9A1"', JSON.stringify('\uF9A1'));
+assertEquals('"\uF9C7"', JSON.stringify('\uF9C7'));
+assertEquals('"\uFA0F"', JSON.stringify('\uFA0F'));
+assertEquals('"\uFA20"', JSON.stringify('\uFA20'));
+assertEquals('"\uFAA7"', JSON.stringify('\uFAA7'));
+assertEquals('"\uFBCD"', JSON.stringify('\uFBCD'));
+assertEquals('"\uFBF7"', JSON.stringify('\uFBF7'));
+assertEquals('"\uFC40"', JSON.stringify('\uFC40'));
+assertEquals('"\uFC4B"', JSON.stringify('\uFC4B'));
+assertEquals('"\uFC51"', JSON.stringify('\uFC51'));
+assertEquals('"\uFC5E"', JSON.stringify('\uFC5E'));
+assertEquals('"\uFC67"', JSON.stringify('\uFC67'));
+assertEquals('"\uFC8B"', JSON.stringify('\uFC8B'));
+assertEquals('"\uFE32"', JSON.stringify('\uFE32'));
+assertEquals('"\uFFC4"', JSON.stringify('\uFFC4'));
+assertEquals('"\uFFFD"', JSON.stringify('\uFFFD'));
+assertEquals('"\uFFFE"', JSON.stringify('\uFFFE'));
+assertEquals('"\uFFFF"', JSON.stringify('\uFFFF'));
+
+// A random selection of astral symbols, i.e. surrogate pairs, i.e.
+// code points from U+010000 to U+10FFFF.
+assertEquals('"\u{10000}"', JSON.stringify('\u{10000}'));
+assertEquals('"\u{11DE7}"', JSON.stringify('\u{11DE7}'));
+assertEquals('"\u{15997}"', JSON.stringify('\u{15997}'));
+assertEquals('"\u{187B0}"', JSON.stringify('\u{187B0}'));
+assertEquals('"\u{190B2}"', JSON.stringify('\u{190B2}'));
+assertEquals('"\u{1BF79}"', JSON.stringify('\u{1BF79}'));
+assertEquals('"\u{1C624}"', JSON.stringify('\u{1C624}'));
+assertEquals('"\u{1D9F4}"', JSON.stringify('\u{1D9F4}'));
+assertEquals('"\u{24149}"', JSON.stringify('\u{24149}'));
+assertEquals('"\u{2521C}"', JSON.stringify('\u{2521C}'));
+assertEquals('"\u{2762D}"', JSON.stringify('\u{2762D}'));
+assertEquals('"\u{2930B}"', JSON.stringify('\u{2930B}'));
+assertEquals('"\u{29EC4}"', JSON.stringify('\u{29EC4}'));
+assertEquals('"\u{29F9A}"', JSON.stringify('\u{29F9A}'));
+assertEquals('"\u{2A27D}"', JSON.stringify('\u{2A27D}'));
+assertEquals('"\u{2B363}"', JSON.stringify('\u{2B363}'));
+assertEquals('"\u{2C037}"', JSON.stringify('\u{2C037}'));
+assertEquals('"\u{2FAE0}"', JSON.stringify('\u{2FAE0}'));
+assertEquals('"\u{2FFCF}"', JSON.stringify('\u{2FFCF}'));
+assertEquals('"\u{32C1C}"', JSON.stringify('\u{32C1C}'));
+assertEquals('"\u{33DA8}"', JSON.stringify('\u{33DA8}'));
+assertEquals('"\u{3DCA4}"', JSON.stringify('\u{3DCA4}'));
+assertEquals('"\u{44FA0}"', JSON.stringify('\u{44FA0}'));
+assertEquals('"\u{45618}"', JSON.stringify('\u{45618}'));
+assertEquals('"\u{47395}"', JSON.stringify('\u{47395}'));
+assertEquals('"\u{4752C}"', JSON.stringify('\u{4752C}'));
+assertEquals('"\u{483FE}"', JSON.stringify('\u{483FE}'));
+assertEquals('"\u{49D35}"', JSON.stringify('\u{49D35}'));
+assertEquals('"\u{4CE3B}"', JSON.stringify('\u{4CE3B}'));
+assertEquals('"\u{55196}"', JSON.stringify('\u{55196}'));
+assertEquals('"\u{58B3E}"', JSON.stringify('\u{58B3E}'));
+assertEquals('"\u{5AA47}"', JSON.stringify('\u{5AA47}'));
+assertEquals('"\u{5C4B8}"', JSON.stringify('\u{5C4B8}'));
+assertEquals('"\u{5DD1B}"', JSON.stringify('\u{5DD1B}'));
+assertEquals('"\u{5FDCB}"', JSON.stringify('\u{5FDCB}'));
+assertEquals('"\u{611BA}"', JSON.stringify('\u{611BA}'));
+assertEquals('"\u{66433}"', JSON.stringify('\u{66433}'));
+assertEquals('"\u{690D7}"', JSON.stringify('\u{690D7}'));
+assertEquals('"\u{6F617}"', JSON.stringify('\u{6F617}'));
+assertEquals('"\u{711E4}"', JSON.stringify('\u{711E4}'));
+assertEquals('"\u{758D2}"', JSON.stringify('\u{758D2}'));
+assertEquals('"\u{780AC}"', JSON.stringify('\u{780AC}'));
+assertEquals('"\u{7AE5F}"', JSON.stringify('\u{7AE5F}'));
+assertEquals('"\u{7C2FB}"', JSON.stringify('\u{7C2FB}'));
+assertEquals('"\u{7D25F}"', JSON.stringify('\u{7D25F}'));
+assertEquals('"\u{8027A}"', JSON.stringify('\u{8027A}'));
+assertEquals('"\u{84817}"', JSON.stringify('\u{84817}'));
+assertEquals('"\u{8B070}"', JSON.stringify('\u{8B070}'));
+assertEquals('"\u{8B390}"', JSON.stringify('\u{8B390}'));
+assertEquals('"\u{8BC03}"', JSON.stringify('\u{8BC03}'));
+assertEquals('"\u{8BE63}"', JSON.stringify('\u{8BE63}'));
+assertEquals('"\u{8F12A}"', JSON.stringify('\u{8F12A}'));
+assertEquals('"\u{9345D}"', JSON.stringify('\u{9345D}'));
+assertEquals('"\u{937A9}"', JSON.stringify('\u{937A9}'));
+assertEquals('"\u{94596}"', JSON.stringify('\u{94596}'));
+assertEquals('"\u{967BB}"', JSON.stringify('\u{967BB}'));
+assertEquals('"\u{A19D1}"', JSON.stringify('\u{A19D1}'));
+assertEquals('"\u{A4FC5}"', JSON.stringify('\u{A4FC5}'));
+assertEquals('"\u{AC9CF}"', JSON.stringify('\u{AC9CF}'));
+assertEquals('"\u{B1366}"', JSON.stringify('\u{B1366}'));
+assertEquals('"\u{B3D32}"', JSON.stringify('\u{B3D32}'));
+assertEquals('"\u{B74BA}"', JSON.stringify('\u{B74BA}'));
+assertEquals('"\u{B8FB0}"', JSON.stringify('\u{B8FB0}'));
+assertEquals('"\u{BA0A5}"', JSON.stringify('\u{BA0A5}'));
+assertEquals('"\u{BB48E}"', JSON.stringify('\u{BB48E}'));
+assertEquals('"\u{C0B60}"', JSON.stringify('\u{C0B60}'));
+assertEquals('"\u{C2D34}"', JSON.stringify('\u{C2D34}'));
+assertEquals('"\u{C6C75}"', JSON.stringify('\u{C6C75}'));
+assertEquals('"\u{C9F26}"', JSON.stringify('\u{C9F26}'));
+assertEquals('"\u{CDBD0}"', JSON.stringify('\u{CDBD0}'));
+assertEquals('"\u{D1E28}"', JSON.stringify('\u{D1E28}'));
+assertEquals('"\u{D4A80}"', JSON.stringify('\u{D4A80}'));
+assertEquals('"\u{D947F}"', JSON.stringify('\u{D947F}'));
+assertEquals('"\u{D9B8A}"', JSON.stringify('\u{D9B8A}'));
+assertEquals('"\u{DA203}"', JSON.stringify('\u{DA203}'));
+assertEquals('"\u{DEFD3}"', JSON.stringify('\u{DEFD3}'));
+assertEquals('"\u{E4F7C}"', JSON.stringify('\u{E4F7C}'));
+assertEquals('"\u{E6BB3}"', JSON.stringify('\u{E6BB3}'));
+assertEquals('"\u{E972D}"', JSON.stringify('\u{E972D}'));
+assertEquals('"\u{EB335}"', JSON.stringify('\u{EB335}'));
+assertEquals('"\u{ED3F8}"', JSON.stringify('\u{ED3F8}'));
+assertEquals('"\u{ED940}"', JSON.stringify('\u{ED940}'));
+assertEquals('"\u{EF6F8}"', JSON.stringify('\u{EF6F8}'));
+assertEquals('"\u{F1F57}"', JSON.stringify('\u{F1F57}'));
+assertEquals('"\u{F33B5}"', JSON.stringify('\u{F33B5}'));
+assertEquals('"\u{F4D2A}"', JSON.stringify('\u{F4D2A}'));
+assertEquals('"\u{F70BA}"', JSON.stringify('\u{F70BA}'));
+assertEquals('"\u{F899F}"', JSON.stringify('\u{F899F}'));
+assertEquals('"\u{1034BF}"', JSON.stringify('\u{1034BF}'));
+assertEquals('"\u{107ACF}"', JSON.stringify('\u{107ACF}'));
+assertEquals('"\u{10881F}"', JSON.stringify('\u{10881F}'));
+assertEquals('"\u{1098A5}"', JSON.stringify('\u{1098A5}'));
+assertEquals('"\u{10ABD1}"', JSON.stringify('\u{10ABD1}'));
+assertEquals('"\u{10B5C5}"', JSON.stringify('\u{10B5C5}'));
+assertEquals('"\u{10CC79}"', JSON.stringify('\u{10CC79}'));
+assertEquals('"\u{10CD19}"', JSON.stringify('\u{10CD19}'));
+assertEquals('"\u{10FFFF}"', JSON.stringify('\u{10FFFF}'));
diff --git a/src/v8/test/mjsunit/has-own-property.js b/src/v8/test/mjsunit/has-own-property.js
index 5ff8db5..b009b7d 100644
--- a/src/v8/test/mjsunit/has-own-property.js
+++ b/src/v8/test/mjsunit/has-own-property.js
@@ -25,6 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// Normal objects.
 // Check for objects.
 assertTrue({x:12}.hasOwnProperty('x'));
 assertFalse({x:12}.hasOwnProperty('y'));
@@ -36,3 +37,135 @@
 // Check for numbers.
 assertFalse((123).hasOwnProperty('length'));
 assertFalse(Object.prototype.hasOwnProperty.call(123, 'length'));
+
+// Frozen object.
+// Check for objects.
+assertTrue(Object.freeze({x:12}).hasOwnProperty('x'));
+assertFalse(Object.freeze({x:12}).hasOwnProperty('y'));
+
+// Check for strings.
+assertTrue(Object.freeze('').hasOwnProperty('length'));
+assertTrue(Object.prototype.hasOwnProperty.call(Object.freeze(''), 'length'));
+
+// Check for numbers.
+assertFalse(Object.freeze(123).hasOwnProperty('length'));
+assertFalse(Object.prototype.hasOwnProperty.call(Object.freeze(123), 'length'));
+
+// Direct vs. inherited properties.
+var o = ['exist'];
+Object.freeze(o);
+assertTrue(o.hasOwnProperty('0'));
+assertFalse(o.hasOwnProperty('toString'));
+assertFalse(o.hasOwnProperty('hasOwnProperty'));
+
+// Using hasOwnProperty as a property name.
+var foo = ['a'];
+foo.hasOwnProperty = function() { return false; };
+Object.freeze(foo);
+assertFalse(foo.hasOwnProperty('0')); // always returns false.
+
+// Use another Object's hasOwnProperty
+// and call it with 'this' set to foo.
+assertTrue(({}).hasOwnProperty.call(foo, '0'));
+
+// It's also possible to use the hasOwnProperty property
+// from the Object prototype for this purpose.
+assertTrue(Object.prototype.hasOwnProperty.call(foo, '0'));
+
+// Check for null or undefined
+var o = Object.freeze([, null, undefined, 'a', 1, Symbol('2')]);
+assertFalse(o.hasOwnProperty('0')); // hole
+assertTrue(o.hasOwnProperty('1'));
+assertTrue(o.hasOwnProperty('2'));
+assertTrue(o.hasOwnProperty('3'));
+assertTrue(o.hasOwnProperty('4'));
+assertTrue(o.hasOwnProperty('5'));
+assertFalse(o.hasOwnProperty('6')); // out of bounds
+
+// Sealed object.
+// Check for objects.
+assertTrue(Object.seal({x:12}).hasOwnProperty('x'));
+assertFalse(Object.seal({x:12}).hasOwnProperty('y'));
+
+// Check for strings.
+assertTrue(Object.seal('').hasOwnProperty('length'));
+assertTrue(Object.prototype.hasOwnProperty.call(Object.seal(''), 'length'));
+
+// Check for numbers.
+assertFalse(Object.seal(123).hasOwnProperty('length'));
+assertFalse(Object.prototype.hasOwnProperty.call(Object.seal(123), 'length'));
+
+// Direct vs. inherited properties.
+var o = ['exist'];
+Object.seal(o);
+assertTrue(o.hasOwnProperty('0'));
+assertFalse(o.hasOwnProperty('toString'));
+assertFalse(o.hasOwnProperty('hasOwnProperty'));
+
+// Using hasOwnProperty as a property name.
+var foo = ['a'];
+foo.hasOwnProperty = function() { return false; };
+Object.seal(foo);
+assertFalse(foo.hasOwnProperty('0')); // always returns false.
+
+// Use another Object's hasOwnProperty
+// and call it with 'this' set to foo.
+assertTrue(({}).hasOwnProperty.call(foo, '0'));
+
+// It's also possible to use the hasOwnProperty property
+// from the Object prototype for this purpose.
+assertTrue(Object.prototype.hasOwnProperty.call(foo, '0'));
+
+// Check for null or undefined
+var o = Object.seal([, null, undefined, 'a', 1, Symbol('2')]);
+assertFalse(o.hasOwnProperty('0')); // hole.
+assertTrue(o.hasOwnProperty('1'));
+assertTrue(o.hasOwnProperty('2'));
+assertTrue(o.hasOwnProperty('3'));
+assertTrue(o.hasOwnProperty('4'));
+assertTrue(o.hasOwnProperty('5'));
+assertFalse(o.hasOwnProperty('6')); // out of bounds.
+
+// Non-extensible object.
+// Check for objects.
+assertTrue(Object.preventExtensions({x:12}).hasOwnProperty('x'));
+assertFalse(Object.preventExtensions({x:12}).hasOwnProperty('y'));
+
+// Check for strings.
+assertTrue(Object.preventExtensions('').hasOwnProperty('length'));
+assertTrue(Object.prototype.hasOwnProperty.call(Object.preventExtensions(''), 'length'));
+
+// Check for numbers.
+assertFalse(Object.preventExtensions(123).hasOwnProperty('length'));
+assertFalse(Object.prototype.hasOwnProperty.call(Object.preventExtensions(123), 'length'));
+
+// Direct vs. inherited properties.
+var o = ['exist'];
+Object.preventExtensions(o);
+assertTrue(o.hasOwnProperty('0'));
+assertFalse(o.hasOwnProperty('toString'));
+assertFalse(o.hasOwnProperty('hasOwnProperty'));
+
+// Using hasOwnProperty as a property name.
+var foo = ['a'];
+foo.hasOwnProperty = function() { return false; };
+Object.preventExtensions(foo);
+assertFalse(foo.hasOwnProperty('0')); // always returns false.
+
+// Use another Object's hasOwnProperty
+// and call it with 'this' set to foo.
+assertTrue(({}).hasOwnProperty.call(foo, '0'));
+
+// It's also possible to use the hasOwnProperty property
+// from the Object prototype for this purpose.
+assertTrue(Object.prototype.hasOwnProperty.call(foo, '0'));
+
+// Check for null or undefined.
+var o = Object.preventExtensions([, null, undefined, 'a', 1, Symbol('2')]);
+assertFalse(o.hasOwnProperty('0')); // hole.
+assertTrue(o.hasOwnProperty('1'));
+assertTrue(o.hasOwnProperty('2'));
+assertTrue(o.hasOwnProperty('3'));
+assertTrue(o.hasOwnProperty('4'));
+assertTrue(o.hasOwnProperty('5'));
+assertFalse(o.hasOwnProperty('6')); // out of bounds.
diff --git a/src/v8/test/mjsunit/hash-code.js b/src/v8/test/mjsunit/hash-code.js
index 1a0057f..7937d7c 100644
--- a/src/v8/test/mjsunit/hash-code.js
+++ b/src/v8/test/mjsunit/hash-code.js
@@ -5,7 +5,7 @@
 // Flags: --allow-natives-syntax
 
 function f() {
-  var x = { a: 1 }
+  var x = {a: 1};
   var set = new Set();
   set.add(x);
 
@@ -17,8 +17,8 @@
   x.g = 6;
 
   assertTrue(set.has(x));
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/ignition/optimized-stack-trace.js b/src/v8/test/mjsunit/ignition/optimized-stack-trace.js
index 77f9acf..4f5cd78 100644
--- a/src/v8/test/mjsunit/ignition/optimized-stack-trace.js
+++ b/src/v8/test/mjsunit/ignition/optimized-stack-trace.js
@@ -13,8 +13,8 @@
 
 function g(x) {
   return f();
-}
-
+};
+%PrepareFunctionForOptimization(g);
 g();
 g();
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/ignition/osr-from-bytecode.js b/src/v8/test/mjsunit/ignition/osr-from-bytecode.js
index a0c80f8..c1575e6 100644
--- a/src/v8/test/mjsunit/ignition/osr-from-bytecode.js
+++ b/src/v8/test/mjsunit/ignition/osr-from-bytecode.js
@@ -9,4 +9,5 @@
     if (i == 5) %OptimizeOsr();
   }
 }
+%PrepareFunctionForOptimization(f);
 f();
diff --git a/src/v8/test/mjsunit/ignition/osr-from-generator.js b/src/v8/test/mjsunit/ignition/osr-from-generator.js
index 2344a31..5fe1012 100644
--- a/src/v8/test/mjsunit/ignition/osr-from-generator.js
+++ b/src/v8/test/mjsunit/ignition/osr-from-generator.js
@@ -11,6 +11,7 @@
     }
     return 23;
   }
+  %PrepareFunctionForOptimization(gen1);
   var g = gen1();
   assertEquals({ value:23, done:true }, g.next());
 })();
@@ -23,6 +24,7 @@
     }
     return 23;
   }
+  %PrepareFunctionForOptimization(gen2);
   var g = gen2();
   assertEquals({ value:0, done:false }, g.next());
   assertEquals({ value:1, done:false }, g.next());
@@ -38,6 +40,7 @@
     }
     return 23;
   }
+  %PrepareFunctionForOptimization(gen3);
   var g = gen3();
   assertEquals({ value:0, done:false }, g.next());
   assertEquals({ value:1, done:false }, g.next());
@@ -52,11 +55,13 @@
         for (var k = 0; k < 10; ++k) {
           if (k == 5) %OptimizeOsr();
         }
+        %PrepareFunctionForOptimization(gen4);
       }
       yield i;
     }
     return 23;
   }
+  %PrepareFunctionForOptimization(gen4);
   var g = gen4();
   assertEquals({ value:0, done:false }, g.next());
   assertEquals({ value:1, done:false }, g.next());
diff --git a/src/v8/test/mjsunit/ignition/regress-616064.js b/src/v8/test/mjsunit/ignition/regress-616064.js
index 805de41..f14679a 100644
--- a/src/v8/test/mjsunit/ignition/regress-616064.js
+++ b/src/v8/test/mjsunit/ignition/regress-616064.js
@@ -13,7 +13,7 @@
       return Worker.__f_0(-2147483648, __f_0);
     };
 
-    var __v_9 = new Worker('');
+    var __v_9 = new Worker('', {type: 'string'});
     __f_1 = {s: Math.s, __f_1: true};
   }
 }
diff --git a/src/v8/test/mjsunit/ignition/throw-if-hole.js b/src/v8/test/mjsunit/ignition/throw-if-hole.js
index ea3f6df..c9578a5 100644
--- a/src/v8/test/mjsunit/ignition/throw-if-hole.js
+++ b/src/v8/test/mjsunit/ignition/throw-if-hole.js
@@ -11,10 +11,14 @@
 }
 
 f(0);
+assertThrows(() => {f(1)}, ReferenceError);
+
+%PrepareFunctionForOptimization(f);
+f(0);
 f(0);
 %OptimizeFunctionOnNextCall(f);
 f(0);
 assertOptimized(f);
 // Check that hole checks are handled correctly in optimized code.
-assertThrowsEquals(() => {f(1)}, ReferenceError());
+assertThrows(() => {f(1)}, ReferenceError);
 assertOptimized(f);
diff --git a/src/v8/test/mjsunit/ignition/throw-if-not-hole.js b/src/v8/test/mjsunit/ignition/throw-if-not-hole.js
index 672e42d..554b622 100644
--- a/src/v8/test/mjsunit/ignition/throw-if-not-hole.js
+++ b/src/v8/test/mjsunit/ignition/throw-if-not-hole.js
@@ -15,14 +15,20 @@
     }
   }
 }
+// No feedback case
+test = new B(0);
+assertThrows(() => {new B(1)}, ReferenceError);
 
+// Ensure Feedback
+%PrepareFunctionForOptimization(B);
+%EnsureFeedbackVectorForFunction(A);
 test = new B(0);
 test = new B(0);
-assertThrowsEquals(() => {new B(1)}, ReferenceError());
-assertThrowsEquals(() => {new B(1)}, ReferenceError());
+assertThrows(() => {new B(1)}, ReferenceError);
+assertThrows(() => {new B(1)}, ReferenceError);
 %OptimizeFunctionOnNextCall(B);
 test = new B(0);
 assertOptimized(B);
 // Check that hole checks are handled correctly in optimized code.
-assertThrowsEquals(() => {new B(1)}, ReferenceError());
+assertThrows(() => {new B(1)}, ReferenceError);
 assertOptimized(B);
diff --git a/src/v8/test/mjsunit/ignition/throw-super-not-called.js b/src/v8/test/mjsunit/ignition/throw-super-not-called.js
index c95509e..ee85129 100644
--- a/src/v8/test/mjsunit/ignition/throw-super-not-called.js
+++ b/src/v8/test/mjsunit/ignition/throw-super-not-called.js
@@ -16,10 +16,14 @@
 }
 
 test = new B(1);
+assertThrows(() => {new B(0)}, ReferenceError);
+
+%PrepareFunctionForOptimization(B);
+test = new B(1);
 test = new B(1);
 %OptimizeFunctionOnNextCall(B);
 test = new B(1);
 assertOptimized(B);
 // Check that hole checks are handled correctly in optimized code.
-assertThrowsEquals(() => {new B(0)}, ReferenceError());
+assertThrows(() => {new B(0)}, ReferenceError);
 assertOptimized(B);
diff --git a/src/v8/test/mjsunit/immutable-context-slot-inlining.js b/src/v8/test/mjsunit/immutable-context-slot-inlining.js
index 3b278c3..58b1b81 100644
--- a/src/v8/test/mjsunit/immutable-context-slot-inlining.js
+++ b/src/v8/test/mjsunit/immutable-context-slot-inlining.js
@@ -16,6 +16,7 @@
       g = function() {
         return y;
       };
+      %PrepareFunctionForOptimization(h);
       assertEquals(5, h(g));
       assertEquals(5, h(g));
       %OptimizeFunctionOnNextCall(h);
diff --git a/src/v8/test/mjsunit/induction-variable-turbofan.js b/src/v8/test/mjsunit/induction-variable-turbofan.js
index 6ef804e..edb2859 100644
--- a/src/v8/test/mjsunit/induction-variable-turbofan.js
+++ b/src/v8/test/mjsunit/induction-variable-turbofan.js
@@ -85,6 +85,7 @@
 }
 
 function test(f) {
+  %PrepareFunctionForOptimization(f);
   f();
   assertTrue(f());
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/integrity-level-map-update.js b/src/v8/test/mjsunit/integrity-level-map-update.js
new file mode 100644
index 0000000..9c02470
--- /dev/null
+++ b/src/v8/test/mjsunit/integrity-level-map-update.js
@@ -0,0 +1,167 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function SealAndReconfigure() {
+  function C() { this.x = 1; this.y = 1; Object.seal(this); }
+
+  let c1 = new C();
+
+  c1.x = 0.1;
+
+  let c2 = new C();
+  let c3 = new C();
+  let c4 = new C();
+
+  // The objects c2, c3 and c4 should follow the same transition
+  // path that we reconfigured c1 to.
+  assertTrue(%HaveSameMap(c1, c2));
+  assertTrue(%HaveSameMap(c1, c3));
+  assertTrue(%HaveSameMap(c1, c4));
+
+  c2.x = 0.1;
+  c3.x = 0.1;
+  c4.x = 0.1;
+
+  assertTrue(%HaveSameMap(c1, c2));
+  assertTrue(%HaveSameMap(c1, c3));
+  assertTrue(%HaveSameMap(c1, c4));
+})();
+
+(function SealAndReconfigureWithIC() {
+  function C() { this.x = 1; this.y = 1; Object.seal(this); }
+
+  let c1 = new C();
+
+  function g(o) {
+    o.x = 0.1;
+  }
+
+  g(c1);
+
+  let c2 = new C();
+  let c3 = new C();
+  let c4 = new C();
+
+  // The objects c2, c3 and c4 should follow the same transition
+  // path that we reconfigured c1 to.
+  assertTrue(%HaveSameMap(c1, c2));
+  assertTrue(%HaveSameMap(c1, c3));
+  assertTrue(%HaveSameMap(c1, c4));
+
+  g(c2);
+  g(c3);
+  g(c4);
+
+  assertTrue(%HaveSameMap(c1, c2));
+  assertTrue(%HaveSameMap(c1, c3));
+  assertTrue(%HaveSameMap(c1, c4));
+})();
+
+(function SealReconfigureAndMigrateWithIC() {
+  function C() { this.x = 1; this.y = 1; Object.seal(this); }
+
+  let c1 = new C();
+  let c2 = new C();
+  let c3 = new C();
+  let c4 = new C();
+
+  function g(o) {
+    o.x = 0.1;
+  }
+
+  g(c1);
+
+  // Now c2, c3 and c4 have deprecated maps.
+  assertFalse(%HaveSameMap(c1, c2));
+  assertFalse(%HaveSameMap(c1, c3));
+  assertFalse(%HaveSameMap(c1, c4));
+
+  g(c2);
+  g(c3);
+  g(c4);
+
+  assertTrue(%HaveSameMap(c1, c2));
+  assertTrue(%HaveSameMap(c1, c3));
+  assertTrue(%HaveSameMap(c1, c4));
+})();
+
+(function SealReconfigureAndMigrateWithOptCode() {
+  function C() { this.x = 1; this.y = 1; Object.seal(this); }
+
+  let c1 = new C();
+  let c2 = new C();
+  let c3 = new C();
+  let c4 = new C();
+
+  function g(o) {
+    o.x = 0.1;
+  }
+
+  %PrepareFunctionForOptimization(g);
+  g(c1);
+  g(c2);
+  g(c3);
+  %OptimizeFunctionOnNextCall(g);
+  g(c4);
+
+  assertTrue(%HaveSameMap(c1, c2));
+  assertTrue(%HaveSameMap(c1, c3));
+  assertTrue(%HaveSameMap(c1, c4));
+})();
+
+(function PreventExtensionsAndReconfigure() {
+  function C() { this.x = 1; this.y = 1; Object.preventExtensions(this); }
+
+  let c1 = new C();
+
+  function g(o) {
+    o.x = 0.1;
+  }
+
+  g(c1);
+
+  let c2 = new C();
+  let c3 = new C();
+  let c4 = new C();
+
+  c2.x = 0.1;
+  c3.x = 0.1;
+  c4.x = 0.1;
+
+  assertTrue(%HaveSameMap(c1, c2));
+  assertTrue(%HaveSameMap(c1, c3));
+  assertTrue(%HaveSameMap(c1, c4));
+})();
+
+(function PreventExtensionsSealAndReconfigure() {
+  function C() {
+    this.x = 1;
+    this.y = 1;
+    Object.preventExtensions(this);
+    Object.seal(this);
+  }
+
+  let c1 = new C();
+
+  function g(o) {
+    o.x = 0.1;
+  }
+
+  g(c1);
+
+  let c2 = new C();
+  let c3 = new C();
+  let c4 = new C();
+
+  c2.x = 0.1;
+  c3.x = 0.1;
+  c4.x = 0.1;
+
+  // Ideally, all the objects would have the same map, but at the moment
+  // we shortcut the unnecessary integrity level transitions.
+  assertTrue(%HaveSameMap(c2, c3));
+  assertTrue(%HaveSameMap(c2, c4));
+})();
diff --git a/src/v8/test/mjsunit/interrupt-budget-override.js b/src/v8/test/mjsunit/interrupt-budget-override.js
new file mode 100644
index 0000000..6dbf078
--- /dev/null
+++ b/src/v8/test/mjsunit/interrupt-budget-override.js
@@ -0,0 +1,18 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --opt --interrupt-budget=100 --budget-for-feedback-vector-allocation=10 --allow-natives-syntax
+
+function f() {
+  let s = 0;
+  for (let i = 0; i < 10; i++) {
+    s += i;
+  }
+  return s;
+}
+
+%PrepareFunctionForOptimization(f);
+f();
+f();
+assertOptimized(f);
diff --git a/src/v8/test/mjsunit/intl-numberformat-formattoparts.js b/src/v8/test/mjsunit/intl-numberformat-formattoparts.js
new file mode 100644
index 0000000..48c8c85
--- /dev/null
+++ b/src/v8/test/mjsunit/intl-numberformat-formattoparts.js
@@ -0,0 +1,335 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Adapted from Gecko's js/src/tests/Intl/NumberFormat/formatToParts.js,
+// which was dedicated to the public domain.
+
+// NOTE: Some of these tests exercise standard behavior (e.g. that format and
+//       formatToParts expose the same formatted string).  But much of this,
+//       like the exact-formatted-string expectations, is technically
+//       implementation-dependent.  This is necessary as a practical matter to
+//       properly test the conversion from ICU's nested-field exposure to
+//       ECMA-402's sequential-parts exposure.
+
+if (this.Intl) {
+
+  function GenericPartCreator(type)
+  {
+    return function(str) { return { type, value: str }; };
+  }
+
+  var Nan = GenericPartCreator("nan");
+  var Inf = GenericPartCreator("infinity");
+  var Integer = GenericPartCreator("integer");
+  var Group = GenericPartCreator("group");
+  var Decimal = GenericPartCreator("decimal");
+  var Fraction = GenericPartCreator("fraction");
+  var MinusSign = GenericPartCreator("minusSign");
+  var PlusSign = GenericPartCreator("plusSign");
+  var PercentSign = GenericPartCreator("percentSign");
+  var Currency = GenericPartCreator("currency");
+  var Literal = GenericPartCreator("literal");
+
+  function assertParts(nf, x, expected)
+  {
+    var parts = nf.formatToParts(x);
+    assertEquals(nf.format(x),
+                 parts.map(part => part.value).join(""));
+
+    var len = parts.length;
+    assertEquals(expected.length, len);
+    for (var i = 0; i < len; i++)
+    {
+      assertEquals(expected[i].type, parts[i].type);
+      assertEquals(expected[i].value, parts[i].value);
+    }
+  }
+
+  //-----------------------------------------------------------------------------
+
+  // Test behavior of a currency with code formatting.
+  var usdCodeOptions =
+    {
+      style: "currency",
+      currency: "USD",
+      currencyDisplay: "code",
+      minimumFractionDigits: 0,
+      maximumFractionDigits: 0,
+    };
+  var usDollarsCode = new Intl.NumberFormat("en-US", usdCodeOptions);
+
+  assertParts(usDollarsCode, 25,
+              [Currency("USD"), Literal("\u00a0"), Integer("25")]);
+
+  // ISO 4217 currency codes are formed from an ISO 3166-1 alpha-2 country code
+  // followed by a third letter.  ISO 3166 guarantees that no country code
+  // starting with "X" will ever be assigned.  Stepping carefully around a few
+  // 4217-designated special "currencies", XQQ will never have a representation.
+  // Thus, yes: this really is specified to work, as unrecognized or unsupported
+  // codes pass into the string unmodified.
+  var xqqCodeOptions =
+    {
+      style: "currency",
+      currency: "XQQ",
+      currencyDisplay: "code",
+      minimumFractionDigits: 0,
+      maximumFractionDigits: 0,
+    };
+  var xqqMoneyCode = new Intl.NumberFormat("en-US", xqqCodeOptions);
+
+  assertParts(xqqMoneyCode, 25,
+              [Currency("XQQ"), Literal("\u00a0"), Integer("25")]);
+
+  // Test currencyDisplay: "name".
+  var usdNameOptions =
+    {
+      style: "currency",
+      currency: "USD",
+      currencyDisplay: "name",
+      minimumFractionDigits: 0,
+      maximumFractionDigits: 0,
+    };
+  var usDollarsName = new Intl.NumberFormat("en-US", usdNameOptions);
+
+  assertParts(usDollarsName, 25,
+              [Integer("25"), Literal(" "), Currency("US dollars")]);
+
+  var usdNameGroupingOptions =
+    {
+      style: "currency",
+      currency: "USD",
+      currencyDisplay: "name",
+      minimumFractionDigits: 0,
+      maximumFractionDigits: 0,
+    };
+  var usDollarsNameGrouping =
+    new Intl.NumberFormat("en-US", usdNameGroupingOptions);
+
+  assertParts(usDollarsNameGrouping, 12345678,
+              [Integer("12"),
+               Group(","),
+               Integer("345"),
+               Group(","),
+               Integer("678"),
+               Literal(" "),
+               Currency("US dollars")]);
+
+  // But if the implementation doesn't recognize the currency, the provided code
+  // is used in place of a proper name, unmolested.
+  var xqqNameOptions =
+    {
+      style: "currency",
+      currency: "XQQ",
+      currencyDisplay: "name",
+      minimumFractionDigits: 0,
+      maximumFractionDigits: 0,
+    };
+  var xqqMoneyName = new Intl.NumberFormat("en-US", xqqNameOptions);
+
+  assertParts(xqqMoneyName, 25,
+              [Integer("25"), Literal(" "), Currency("XQQ")]);
+
+  // Test some currencies with fractional components.
+
+  var usdNameFractionOptions =
+    {
+      style: "currency",
+      currency: "USD",
+      currencyDisplay: "name",
+      minimumFractionDigits: 2,
+      maximumFractionDigits: 2,
+    };
+  var usdNameFractionFormatter =
+    new Intl.NumberFormat("en-US", usdNameFractionOptions);
+
+  // The US national surplus (i.e. debt) as of October 18, 2016.
+  // (Replicating data from a comment in Intl.cpp.)
+  var usNationalSurplus = -19766580028249.41;
+
+  assertParts(usdNameFractionFormatter, usNationalSurplus,
+              [MinusSign("-"),
+               Integer("19"),
+               Group(","),
+               Integer("766"),
+               Group(","),
+               Integer("580"),
+               Group(","),
+               Integer("028"),
+               Group(","),
+               Integer("249"),
+               Decimal("."),
+               Fraction("41"),
+               Literal(" "),
+               Currency("US dollars")]);
+
+  // Percents in various forms.
+
+  var usPercentOptions =
+    {
+      style: "percent",
+      minimumFractionDigits: 1,
+      maximumFractionDigits: 1,
+    };
+  var usPercentFormatter =
+    new Intl.NumberFormat("en-US", usPercentOptions);
+
+  assertParts(usPercentFormatter, 0.375,
+              [Integer("37"), Decimal("."), Fraction("5"), PercentSign("%")]);
+
+  assertParts(usPercentFormatter, -1284.375,
+              [MinusSign("-"),
+               Integer("128"),
+               Group(","),
+               Integer("437"),
+               Decimal("."),
+               Fraction("5"),
+               PercentSign("%")]);
+
+  assertParts(usPercentFormatter, NaN,
+              [Nan("NaN"), PercentSign("%")]);
+
+  assertParts(usPercentFormatter, Infinity,
+              [Inf("∞"), PercentSign("%")]);
+
+  assertParts(usPercentFormatter, -Infinity,
+              [MinusSign("-"), Inf("∞"), PercentSign("%")]);
+
+  var arPercentOptions =
+    {
+      style: "percent",
+      minimumFractionDigits: 2,
+    };
+  var arPercentFormatter =
+    new Intl.NumberFormat("ar-IQ", arPercentOptions);
+
+  assertParts(arPercentFormatter, -135.32,
+              [Literal("\u{061C}"),
+               MinusSign("-"),
+               Integer("١٣"),
+               Group("٬"),
+               Integer("٥٣٢"),
+               Decimal("٫"),
+               Fraction("٠٠"),
+               PercentSign("٪"),
+               Literal("\u{061C}")]);
+
+  // Decimals.
+
+  var usDecimalOptions =
+    {
+      style: "decimal",
+      maximumFractionDigits: 7 // minimum defaults to 0
+    };
+  var usDecimalFormatter =
+    new Intl.NumberFormat("en-US", usDecimalOptions);
+
+  assertParts(usDecimalFormatter, 42,
+              [Integer("42")]);
+
+  assertParts(usDecimalFormatter, 1337,
+              [Integer("1"), Group(","), Integer("337")]);
+
+  assertParts(usDecimalFormatter, -6.25,
+              [MinusSign("-"), Integer("6"), Decimal("."), Fraction("25")]);
+
+  assertParts(usDecimalFormatter, -1376.25,
+              [MinusSign("-"),
+               Integer("1"),
+               Group(","),
+               Integer("376"),
+               Decimal("."),
+               Fraction("25")]);
+
+  assertParts(usDecimalFormatter, 124816.8359375,
+              [Integer("124"),
+               Group(","),
+               Integer("816"),
+               Decimal("."),
+               Fraction("8359375")]);
+
+  var usNoGroupingDecimalOptions =
+    {
+      style: "decimal",
+      useGrouping: false,
+      maximumFractionDigits: 7 // minimum defaults to 0
+    };
+  var usNoGroupingDecimalFormatter =
+    new Intl.NumberFormat("en-US", usNoGroupingDecimalOptions);
+
+  assertParts(usNoGroupingDecimalFormatter, 1337,
+              [Integer("1337")]);
+
+  assertParts(usNoGroupingDecimalFormatter, -6.25,
+              [MinusSign("-"), Integer("6"), Decimal("."), Fraction("25")]);
+
+  assertParts(usNoGroupingDecimalFormatter, -1376.25,
+              [MinusSign("-"),
+               Integer("1376"),
+               Decimal("."),
+               Fraction("25")]);
+
+  assertParts(usNoGroupingDecimalFormatter, 124816.8359375,
+              [Integer("124816"),
+               Decimal("."),
+               Fraction("8359375")]);
+
+  var deDecimalOptions =
+    {
+      style: "decimal",
+      maximumFractionDigits: 7 // minimum defaults to 0
+    };
+  var deDecimalFormatter =
+    new Intl.NumberFormat("de-DE", deDecimalOptions);
+
+  assertParts(deDecimalFormatter, 42,
+              [Integer("42")]);
+
+  assertParts(deDecimalFormatter, 1337,
+              [Integer("1"), Group("."), Integer("337")]);
+
+  assertParts(deDecimalFormatter, -6.25,
+              [MinusSign("-"), Integer("6"), Decimal(","), Fraction("25")]);
+
+  assertParts(deDecimalFormatter, -1376.25,
+              [MinusSign("-"),
+               Integer("1"),
+               Group("."),
+               Integer("376"),
+               Decimal(","),
+               Fraction("25")]);
+
+  assertParts(deDecimalFormatter, 124816.8359375,
+              [Integer("124"),
+               Group("."),
+               Integer("816"),
+               Decimal(","),
+               Fraction("8359375")]);
+
+  var deNoGroupingDecimalOptions =
+    {
+      style: "decimal",
+      useGrouping: false,
+      maximumFractionDigits: 7 // minimum defaults to 0
+    };
+  var deNoGroupingDecimalFormatter =
+    new Intl.NumberFormat("de-DE", deNoGroupingDecimalOptions);
+
+  assertParts(deNoGroupingDecimalFormatter, 1337,
+              [Integer("1337")]);
+
+  assertParts(deNoGroupingDecimalFormatter, -6.25,
+              [MinusSign("-"), Integer("6"), Decimal(","), Fraction("25")]);
+
+  assertParts(deNoGroupingDecimalFormatter, -1376.25,
+              [MinusSign("-"),
+               Integer("1376"),
+               Decimal(","),
+               Fraction("25")]);
+
+  assertParts(deNoGroupingDecimalFormatter, 124816.8359375,
+              [Integer("124816"),
+               Decimal(","),
+               Fraction("8359375")]);
+
+}
diff --git a/src/v8/test/mjsunit/intl-pluralrules-select.js b/src/v8/test/mjsunit/intl-pluralrules-select.js
new file mode 100644
index 0000000..6e24202
--- /dev/null
+++ b/src/v8/test/mjsunit/intl-pluralrules-select.js
@@ -0,0 +1,50 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+if (this.Intl) {
+  var pr;
+  var suffixes;
+  function format(n) {
+    return "" + n + suffixes[pr.select(n)];
+  }
+
+  // These English examples illustrate the purpose of the PluralRules class.
+  pr = new Intl.PluralRules("en-US");
+  suffixes = {
+    one:   " day",
+    other: " days",
+  };
+  assertEquals("0 days",   format(0));
+  assertEquals("0.5 days", format(0.5));
+  assertEquals("1 day",    format(1));
+  assertEquals("1.5 days", format(1.5));
+  assertEquals("2 days",   format(2));
+
+  pr = new Intl.PluralRules("en-US", {type: "ordinal"});
+  suffixes = {
+    one:   "st",
+    two:   "nd",
+    few:   "rd",
+    other: "th",
+  };
+  assertEquals("0th",   format(0));
+  assertEquals("1st",   format(1));
+  assertEquals("2nd",   format(2));
+  assertEquals("3rd",   format(3));
+  assertEquals("4th",   format(4));
+  assertEquals("11th",  format(11));
+  assertEquals("21st",  format(21));
+  assertEquals("103rd", format(103));
+
+  // Arabic can cause every possible return value from select()
+  pr = new Intl.PluralRules("ar");
+  suffixes = null;
+  assertEquals("zero",  pr.select(0));
+  assertEquals("one",   pr.select(1));
+  assertEquals("two",   pr.select(2));
+  assertEquals("few",   pr.select(3));
+  assertEquals("many",  pr.select(11));
+  assertEquals("other", pr.select(100));
+  assertEquals("other", pr.select(1.5));
+}
diff --git a/src/v8/test/mjsunit/invalid-lhs.js b/src/v8/test/mjsunit/invalid-lhs.js
index 92929b6..aec8410 100644
--- a/src/v8/test/mjsunit/invalid-lhs.js
+++ b/src/v8/test/mjsunit/invalid-lhs.js
@@ -29,23 +29,23 @@
 // exceptions are delayed until runtime.
 
 // Normal assignments:
-assertThrows("12 = 12", ReferenceError);
-assertThrows("x++ = 12", ReferenceError);
+assertThrows("12 = 12", SyntaxError);
+assertThrows("x++ = 12", SyntaxError);
 assertThrows("eval('var x') = 12", ReferenceError);
-assertThrows("if (false) 12 = 12", ReferenceError);
+assertThrows("if (false) 12 = 12", SyntaxError);
 assertDoesNotThrow("if (false) eval('var x') = 12");
 
 // Pre- and post-fix operations:
-assertThrows("12++", ReferenceError);
-assertThrows("12--", ReferenceError);
-assertThrows("++12", ReferenceError);
-assertThrows("--12", ReferenceError);
+assertThrows("12++", SyntaxError);
+assertThrows("12--", SyntaxError);
+assertThrows("++12", SyntaxError);
+assertThrows("--12", SyntaxError);
 assertThrows("++(eval('12'))", ReferenceError);
 assertThrows("(eval('12'))++", ReferenceError);
-assertThrows("if (false) 12++", ReferenceError);
-assertThrows("if (false) 12--", ReferenceError);
-assertThrows("if (false) ++12", ReferenceError);
-assertThrows("if (false) --12", ReferenceError);
+assertThrows("if (false) 12++", SyntaxError);
+assertThrows("if (false) 12--", SyntaxError);
+assertThrows("if (false) ++12", SyntaxError);
+assertThrows("if (false) --12", SyntaxError);
 assertDoesNotThrow("if (false) ++(eval('12'))");
 assertDoesNotThrow("if (false) (eval('12'))++");
 
@@ -56,19 +56,19 @@
 assertDoesNotThrow("if (false) for (eval('0') in [1]) print(12);");
 
 // For:
-assertThrows("for (12 = 1;;) print(12);", ReferenceError);
+assertThrows("for (12 = 1;;) print(12);", SyntaxError);
 assertThrows("for (eval('var x') = 1;;) print(12);", ReferenceError);
-assertThrows("if (false) for (12 = 1;;) print(12);", ReferenceError);
+assertThrows("if (false) for (12 = 1;;) print(12);", SyntaxError);
 assertDoesNotThrow("if (false) for (eval('var x') = 1;;) print(12);");
 
 // Assignments to 'this'.
-assertThrows("this = 42", ReferenceError);
-assertThrows("function f() { this = 12; }", ReferenceError);
+assertThrows("this = 42", SyntaxError);
+assertThrows("function f() { this = 12; }", SyntaxError);
 assertThrows("for (this in {x:3, y:4, z:5}) ;", SyntaxError);
-assertThrows("for (this = 0;;) ;", ReferenceError);
-assertThrows("this++", ReferenceError);
-assertThrows("++this", ReferenceError);
-assertThrows("this--", ReferenceError);
-assertThrows("--this", ReferenceError);
-assertThrows("if (false) this = 42", ReferenceError);
-assertThrows("if (false) this++", ReferenceError);
+assertThrows("for (this = 0;;) ;", SyntaxError);
+assertThrows("this++", SyntaxError);
+assertThrows("++this", SyntaxError);
+assertThrows("this--", SyntaxError);
+assertThrows("--this", SyntaxError);
+assertThrows("if (false) this = 42", SyntaxError);
+assertThrows("if (false) this++", SyntaxError);
diff --git a/src/v8/test/mjsunit/json-parse-slice.js b/src/v8/test/mjsunit/json-parse-slice.js
new file mode 100644
index 0000000..b2b36c1
--- /dev/null
+++ b/src/v8/test/mjsunit/json-parse-slice.js
@@ -0,0 +1,6 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var s = 'abcabcabcabcabc["possibly a sliced string"]'.slice(15)
+assertEquals(["possibly a sliced string"], JSON.parse(s));
diff --git a/src/v8/test/mjsunit/json-parser-recursive.js b/src/v8/test/mjsunit/json-parser-recursive.js
index 1e00c83..0f086e3 100644
--- a/src/v8/test/mjsunit/json-parser-recursive.js
+++ b/src/v8/test/mjsunit/json-parser-recursive.js
@@ -30,4 +30,5 @@
   str = "[1," + str + "]";
 }
 
-assertThrows(function() { JSON.parse(str); }, RangeError);
+// Make sure we don't overflow on very deeply nested JSON objects.
+JSON.parse(str);
diff --git a/src/v8/test/mjsunit/json-stringify-typedarray.js b/src/v8/test/mjsunit/json-stringify-typedarray.js
new file mode 100644
index 0000000..48a4fbb
--- /dev/null
+++ b/src/v8/test/mjsunit/json-stringify-typedarray.js
@@ -0,0 +1,18 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+[Int8Array, Uint8Array, Uint8ClampedArray, Int16Array, Uint16Array, Int32Array,
+ Uint32Array, Float32Array, Float64Array]
+    .forEach(constructor => {
+      const empty = new constructor(0);
+      assertEquals('{}', JSON.stringify(empty));
+
+      const tiny = new constructor(2).fill(123);
+      assertEquals('{"0":123,"1":123}', JSON.stringify(tiny));
+
+      const huge = new constructor(64).fill(123);
+      assertEquals(
+          '{"0":123,"1":123,"2":123,"3":123,"4":123,"5":123,"6":123,"7":123,"8":123,"9":123,"10":123,"11":123,"12":123,"13":123,"14":123,"15":123,"16":123,"17":123,"18":123,"19":123,"20":123,"21":123,"22":123,"23":123,"24":123,"25":123,"26":123,"27":123,"28":123,"29":123,"30":123,"31":123,"32":123,"33":123,"34":123,"35":123,"36":123,"37":123,"38":123,"39":123,"40":123,"41":123,"42":123,"43":123,"44":123,"45":123,"46":123,"47":123,"48":123,"49":123,"50":123,"51":123,"52":123,"53":123,"54":123,"55":123,"56":123,"57":123,"58":123,"59":123,"60":123,"61":123,"62":123,"63":123}',
+          JSON.stringify(huge));
+    });
diff --git a/src/v8/test/mjsunit/json.js b/src/v8/test/mjsunit/json.js
index 102f777..f6e4c20 100644
--- a/src/v8/test/mjsunit/json.js
+++ b/src/v8/test/mjsunit/json.js
@@ -375,32 +375,28 @@
 assertEquals(42, JSON.parse(o));
 
 
-for (var i = 0; i < 65536; i++) {
+for (var i = 0x0000; i <= 0xFFFF; i++) {
   var string = String.fromCharCode(i);
   var encoded = JSON.stringify(string);
-  var expected = "uninitialized";
+  var expected = 'uninitialized';
   // Following the ES5 specification of the abstraction function Quote.
   if (string == '"' || string == '\\') {
     // Step 2.a
     expected = '\\' + string;
-  } else if ("\b\t\n\r\f".indexOf(string) >= 0) {
+  } else if ("\b\t\n\r\f".includes(string)) {
     // Step 2.b
     if (string == '\b') expected = '\\b';
     else if (string == '\t') expected = '\\t';
     else if (string == '\n') expected = '\\n';
     else if (string == '\f') expected = '\\f';
     else if (string == '\r') expected = '\\r';
-  } else if (i < 32) {
+  } else if (i < 0x20 || (i >= 0xD800 && i <= 0xDFFF)) {
     // Step 2.c
-    if (i < 16) {
-      expected = "\\u000" + i.toString(16);
-    } else {
-      expected = "\\u00" + i.toString(16);
-    }
+    expected = '\\u' + i.toString(16).padStart(4, '0');
   } else {
     expected = string;
   }
-  assertEquals('"' + expected + '"', encoded, "Codepoint " + i);
+  assertEquals('"' + expected + '"', encoded, "code point " + i);
 }
 
 
@@ -524,3 +520,6 @@
 
 reviver = (k, v) => (v === Infinity) ? "inf" : v;
 assertEquals('{"":"inf"}', JSON.stringify({"":Infinity}, reviver));
+
+assertEquals([10.4, "\u1234"], JSON.parse("[10.4, \"\u1234\"]"));
+assertEquals(10, JSON.parse('{"10":10}')["10"]);
diff --git a/src/v8/test/mjsunit/json2.js b/src/v8/test/mjsunit/json2.js
index 917e8c8..f56fd43 100644
--- a/src/v8/test/mjsunit/json2.js
+++ b/src/v8/test/mjsunit/json2.js
@@ -54,7 +54,7 @@
 TestStringify(expected_1, array_1);
 TestStringify(expected_2, array_2);
 
-// Test JSValue with custom prototype.
+// Test JSPrimitiveWrapper with custom prototype.
 var num_wrapper = Object(42);
 num_wrapper.__proto__ = { __proto__: null,
                           toString: function() { return true; } };
diff --git a/src/v8/test/mjsunit/keyed-has-ic-module-export.mjs b/src/v8/test/mjsunit/keyed-has-ic-module-export.mjs
new file mode 100644
index 0000000..b36d053
--- /dev/null
+++ b/src/v8/test/mjsunit/keyed-has-ic-module-export.mjs
@@ -0,0 +1,7 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export var a = "A";
+export var b = "B";
+export var c = "C";
diff --git a/src/v8/test/mjsunit/keyed-has-ic-module-import.mjs b/src/v8/test/mjsunit/keyed-has-ic-module-import.mjs
new file mode 100644
index 0000000..c8a5f51
--- /dev/null
+++ b/src/v8/test/mjsunit/keyed-has-ic-module-import.mjs
@@ -0,0 +1,70 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+import * as mod from "keyed-has-ic-module-export.mjs";
+
+function testIn(obj, key) {
+  return key in obj;
+}
+
+function expectTrue(obj, key) {
+  assertTrue(testIn(obj, key));
+}
+
+function expectFalse(obj, key) {
+  assertFalse(testIn(obj, key));
+}
+
+var tests = {
+  monomporphicTrue: function() {
+    expectTrue(mod, "a");
+    expectTrue(mod, "a");
+    expectTrue(mod, "a");
+  },
+
+  polymprohicKeyTrue: function() {
+    expectTrue(mod, "a");
+    expectTrue(mod, "b");
+    expectTrue(mod, "c");
+  },
+
+  monomorphicFalse: function() {
+    expectFalse(mod, "d");
+    expectFalse(mod, "d");
+    expectFalse(mod, "d");
+  },
+
+  polymorphicKeyFalse: function() {
+    expectFalse(mod, "d");
+    expectFalse(mod, "e");
+    expectFalse(mod, "f");
+  },
+
+  polymorphicTrue: function() {
+    var o = {a: "A"};
+    expectTrue(mod, "a");
+    expectTrue(o, "a");
+    expectTrue(mod, "a");
+    expectTrue(o, "a");
+  },
+
+  polymorphicFalse: function() {
+    var o = {a: "A"};
+    expectFalse(mod, "d");
+    expectFalse(o, "d");
+    expectFalse(mod, "d");
+    expectFalse(o, "d");
+  }
+};
+
+for (let test in tests) {
+  %DeoptimizeFunction(testIn);
+  %ClearFunctionFeedback(testIn);
+  %PrepareFunctionForOptimization(testIn);
+  tests[test]();
+  %OptimizeFunctionOnNextCall(testIn);
+  tests[test]();
+}
diff --git a/src/v8/test/mjsunit/keyed-has-ic.js b/src/v8/test/mjsunit/keyed-has-ic.js
new file mode 100644
index 0000000..05c46e0
--- /dev/null
+++ b/src/v8/test/mjsunit/keyed-has-ic.js
@@ -0,0 +1,505 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function testIn(obj, key) {
+  return key in obj;
+}
+
+function expectTrue(obj, key) {
+  assertTrue(testIn(obj, key));
+}
+
+function expectFalse(obj, key) {
+  assertFalse(testIn(obj, key));
+}
+
+var tests = {
+  TestMonomorphicPackedSMIArray: function() {
+    var a = [0, 1, 2];
+    expectTrue(a, 0);
+    expectTrue(a, 1);
+    expectTrue(a, 2);
+    expectFalse(a, 3);
+  },
+
+  TestMonomorphicPackedArrayPrototypeProperty: function()
+  {
+    var a = [0, 1, 2];
+
+    expectTrue(a, 0);
+    expectTrue(a, 1);
+    expectFalse(a, 3);
+    Array.prototype[3] = 3;
+    expectTrue(a, 3);
+
+    // ensure the prototype change doesn't affect later tests
+    delete Array.prototype[3];
+    assertFalse((3 in Array.prototype));
+    expectFalse(a, 3);
+  },
+
+  TestMonomorphicPackedDoubleArray: function() {
+    var a = [0.0, 1.1, 2.2];
+    expectTrue(a, 0);
+    expectTrue(a, 1);
+    expectTrue(a, 2);
+    expectFalse(a, 3);
+  },
+
+  TestMonomorphicPackedArray: function() {
+    var a = ["A", "B", {}];
+    expectTrue(a, 0);
+    expectTrue(a, 1);
+    expectTrue(a, 2);
+    expectFalse(a, 3);
+  },
+
+  TestMonomorphicHoleyArray: function() {
+    var a = [0, 1, 2];
+    a[4] = 4;
+
+    expectTrue(a, 0);
+    expectTrue(a, 1);
+    expectTrue(a, 2);
+    expectFalse(a, 3);
+    expectTrue(a, 4);
+  },
+
+  TestMonomorphicTypedArray: function() {
+    var a = new Int32Array(3);
+    expectTrue(a, 0);
+    expectTrue(a, 1);
+    expectTrue(a, 2);
+    expectFalse(a, 3);
+    expectFalse(a, 4);
+  },
+
+  TestPolymorphicPackedArrays: function() {
+    var a = [0, 1, 2];
+    var b = [0.0, 1.1, 2.2];
+    var c = ["A", "B", {}];
+    expectTrue(c, 0);
+    expectTrue(b, 1);
+    expectTrue(a, 2);
+    expectTrue(c, 1);
+    expectTrue(b, 2);
+    expectTrue(a, 0);
+    expectFalse(c, 3);
+    expectFalse(b, 4);
+    expectFalse(a, 5);
+  },
+
+  TestPolymorphicMixedArrays: function() {
+    var a = new Array(3);     // holey SMI
+    var b = [0.0,1.1,2.2];    // packed double
+    var c = new Int8Array(3); // typed array
+
+    expectFalse(a, 0);
+    expectTrue(b, 1);
+    expectTrue(c, 2);
+    expectFalse(a, 1);
+    expectTrue(b, 2);
+    expectTrue(c, 0);
+    expectFalse(a, 3);
+    expectFalse(b, 4);
+    expectFalse(c, 5);
+  },
+
+  TestMegamorphicArrays: function() {
+    var a = [0,1,2,3]           // packed SMI
+    var b = new Array(3);       // holey SMI
+    var c = [0.0,1.1,2.2];      // packed double
+    var d = ['a', 'b', 'c']     // packed
+    var e = new Int8Array(3);   // typed array
+    var f = new Uint8Array(3);  // typed array
+    var g = new Int32Array(3);  // typed array
+
+    expectTrue(a, 0);
+    expectFalse(b, 1);
+    expectTrue(c, 2);
+    expectFalse(d, 3);
+    expectFalse(e, 4);
+    expectFalse(f, 5);
+    expectFalse(g, 6);
+    expectFalse(a, 5);
+    expectFalse(b, 4);
+    expectFalse(c, 3);
+    expectTrue(d, 2);
+    expectTrue(e, 1);
+    expectTrue(f, 0);
+    expectTrue(g, 0);
+  },
+
+  TestMonomorphicObject: function() {
+    var a = { a: "A", b: "B" };
+
+    expectTrue(a, 'a');
+    expectTrue(a, 'a');
+    expectTrue(a, 'a');
+  },
+
+  TestMonomorphicProxyHasPropertyNoTrap: function() {
+    var a = new Proxy({a: 'A'}, {});
+
+    expectTrue(a, 'a');
+    expectTrue(a, 'a');
+    expectTrue(a, 'a');
+  },
+
+  TestMonomorphicProxyNoPropertyNoTrap: function() {
+    var a = new Proxy({}, {});
+
+    expectFalse(a, 'a');
+    expectFalse(a, 'a');
+    expectFalse(a, 'a');
+  },
+
+  TestMonomorphicProxyHasPropertyHasTrap: function() {
+    var a = new Proxy({a: 'A'}, { has: function() {return false;}});
+
+    expectFalse(a, 'a');
+    expectFalse(a, 'a');
+    expectFalse(a, 'a');
+  },
+
+  TestMonomorphicProxyNoPropertyHasTrap: function() {
+    var a = new Proxy({}, { has: function() { return true; }});
+
+    expectTrue(a, 'a');
+    expectTrue(a, 'a');
+    expectTrue(a, 'a');
+  },
+
+  TestMonomorphicObjectPrototype: function() {
+    var a = { b: "B" };
+
+    expectFalse(a, 'a');
+    expectFalse(a, 'a');
+    expectFalse(a, 'a');
+    Object.prototype.a = 'A';
+    expectTrue(a, 'a');
+    delete Object.prototype.a;
+    assertFalse((a in Object.prototype));
+    expectFalse(a, 'a');
+  },
+
+  TestPolymorphicObject: function() {
+    var a = { a: "A" };
+    var b = { a: "A", b: "B" };
+    var c = { b: "B", c: "C" };
+
+    expectTrue(a, 'a');
+    expectTrue(a, 'a');
+    expectTrue(b, 'a');
+    expectFalse(c, 'a');
+    expectTrue(a, 'a');
+    expectTrue(b, 'a');
+    expectFalse(c, 'a');
+  },
+
+  TestMegamorphicObject: function() {
+    var a = { a: "A" };
+    var b = { a: "A", b: "B" };
+    var c = { b: "B", c: "C" };
+    var d = { b: "A", a: "B" };
+    var e = { e: "E", a: "A" };
+    var f = { f: "F", b: "B", c: "C" };
+
+    expectTrue(a, 'a');
+    expectTrue(a, 'a');
+    expectTrue(b, 'a');
+    expectFalse(c, 'a');
+    expectTrue(d, 'a');
+    expectTrue(e, 'a');
+    expectFalse(f, 'a');
+    expectTrue(a, 'a');
+    expectTrue(b, 'a');
+    expectFalse(c, 'a');
+    expectTrue(d, 'a');
+    expectTrue(e, 'a');
+    expectFalse(f, 'a');
+  },
+
+  TestPolymorphicKeys: function() {
+    var a = { a: "A", b: "B" };
+
+    expectTrue(a, 'a');
+    expectTrue(a, 'b');
+    expectFalse(a, 'c');
+    expectTrue(a, 'a');
+    expectTrue(a, 'b');
+    expectFalse(a, 'c');
+    expectTrue(a, 'a');
+    expectTrue(a, 'b');
+    expectFalse(a, 'c');
+  },
+
+  TestPolymorphicMixed: function() {
+    var a = { a: "A" };
+    var b = new Proxy({}, {});
+    var c = new Int32Array(3);
+
+    expectTrue(a, 'a');
+    expectTrue(a, 'a');
+    expectFalse(b, 'a');
+    expectFalse(c, 'a');
+    expectTrue(a, 'a');
+    expectFalse(b, 'a');
+    expectFalse(c, 'a');
+  },
+};
+
+for (test in tests) {
+  %DeoptimizeFunction(testIn);
+  %ClearFunctionFeedback(testIn);
+  %PrepareFunctionForOptimization(testIn);
+  tests[test]();
+  %OptimizeFunctionOnNextCall(testIn);
+  tests[test]();
+}
+
+// test function prototypes.
+(function() {
+  var o = function() {};
+
+  var proto = function() {
+    assertTrue("prototype" in o);
+    o.prototype;
+  };
+
+  %PrepareFunctionForOptimization(proto);
+  proto();
+  proto();
+  %OptimizeFunctionOnNextCall(proto);
+  proto();
+})();
+
+// `in` is not allowed on string
+(function() {
+  function test() {
+    0 in "string"
+  };
+
+  %PrepareFunctionForOptimization(test);
+  assertThrows(test, TypeError);
+  assertThrows(test, TypeError);
+  %OptimizeFunctionOnNextCall(test);
+  assertThrows(test, TypeError);
+})();
+
+// `in` is allowed on `this` even when `this` is a string
+(function() {
+  function test() {
+    assertTrue("length" in this);
+  };
+
+  %PrepareFunctionForOptimization(test);
+  test.call("");
+  test.call("");
+  %OptimizeFunctionOnNextCall(test);
+  test.call("");
+})();
+
+(function() {
+  var index = 0;
+  function test(i) {
+    return index in arguments;
+  };
+
+  %PrepareFunctionForOptimization(test);
+  assertFalse(test())
+  assertFalse(test())
+  assertTrue(test(0));
+  assertTrue(test(0,1));
+
+  index = 2;
+  assertFalse(test())
+  assertFalse(test(0));
+  assertFalse(test(0,1));
+  assertTrue(test(0,1,2));
+
+  %OptimizeFunctionOnNextCall(test);
+  assertFalse(test(0,1));
+  assertTrue(test(0,1,2));
+})();
+
+(function() {
+  function test(a) {
+    arguments[3] = 1;
+    return 2 in arguments;
+  };
+
+  %PrepareFunctionForOptimization(test);
+  assertFalse(test(1));
+  assertFalse(test(1));
+  %OptimizeFunctionOnNextCall(test);
+  assertFalse(test(1));
+})();
+
+(function() {
+  function test(o, k) {
+    try {
+      k in o;
+    } catch (e) {
+      return false;
+    }
+    return true;
+  }
+  %PrepareFunctionForOptimization(test);
+
+  var str = "string";
+  // this will place slow_stub in the IC for strings.
+  assertFalse(test(str, "length"));
+  assertFalse(test(str, "length"));
+
+  // this turns the cache polymorphic, and causes generats LoadElement
+  // handlers for everything in the cache. This test ensures that
+  // KeyedLoadIC::LoadElementHandler can handle seeing string maps.
+  var ary = [0,1,2,3];
+  assertTrue(test(ary, 1));
+  assertTrue(test(ary, 1));
+
+  assertFalse(test(str, 0));
+  assertFalse(test(str, 0));
+  %OptimizeFunctionOnNextCall(test);
+  assertFalse(test(str, 0));
+})();
+
+(function() {
+  function test(o, k) {
+    try {
+      k in o;
+    } catch (e) {
+      return false;
+    }
+    return true;
+  }
+  %PrepareFunctionForOptimization(test);
+
+  var str = "string";
+  assertFalse(test(str, "length"));
+  assertFalse(test(str, "length"));
+  %OptimizeFunctionOnNextCall(test);
+  assertFalse(test(str, "length"));
+})();
+
+(function() {
+  function test(o, k) {
+    try {
+      k in o;
+    } catch (e) {
+      return false;
+    }
+    return true;
+  }
+  %PrepareFunctionForOptimization(test);
+
+  var str = "string";
+  assertFalse(test(str, 0));
+  assertFalse(test(str, 0));
+  %OptimizeFunctionOnNextCall(test);
+  assertFalse(test(str, 0));
+})();
+
+(function() {
+  function test(o, k) {
+    try {
+      k in o;
+    } catch (e) {
+      return false;
+    }
+    return true;
+  }
+  %PrepareFunctionForOptimization(test);
+
+  var ary = [0, 1, 2, '3'];
+  function testArray(ary) {
+    assertTrue(test(ary, 1));
+    assertTrue(test(ary, 1));
+  }
+  testArray(ary);
+  // Packed
+  // Non-extensible
+  var b =  Object.preventExtensions(ary);
+  testArray(b);
+
+  // Sealed
+  var c =  Object.seal(ary);
+  testArray(c);
+
+  // Frozen
+  var d =  Object.freeze(ary);
+  testArray(d);
+
+  // Holey
+  var ary = [, 0, 1, 2, '3'];
+  // Non-extensible
+  var b =  Object.preventExtensions(ary);
+  testArray(b);
+
+  // Sealed
+  var c =  Object.seal(ary);
+  testArray(c);
+
+  // Frozen
+  var d =  Object.freeze(ary);
+  testArray(d);
+
+  var str = "string";
+  assertFalse(test(str, 0));
+  assertFalse(test(str, 0));
+  %OptimizeFunctionOnNextCall(test);
+  assertFalse(test(str, 0));
+})();
+
+const heap_constant_ary = [0,1,2,'3'];
+
+function testHeapConstantArray(heap_constant_ary) {
+
+  function test() {
+    return 1 in heap_constant_ary;
+  }
+  %PrepareFunctionForOptimization(test);
+
+  assertTrue(test());
+  assertTrue(test());
+  %OptimizeFunctionOnNextCall(test);
+  assertTrue(test());
+
+  heap_constant_ary[1] = 2;
+  assertTrue(test());
+  %PrepareFunctionForOptimization(test);
+  %OptimizeFunctionOnNextCall(test);
+  assertTrue(test());
+}
+testHeapConstantArray(heap_constant_ary);
+
+// Packed
+// Non-extensible
+var b =  Object.preventExtensions(heap_constant_ary);
+testHeapConstantArray(b);
+
+// Sealed
+var c =  Object.seal(heap_constant_ary);
+testHeapConstantArray(c);
+
+// Frozen
+var d =  Object.freeze(heap_constant_ary);
+testHeapConstantArray(d);
+
+// Holey
+const holey_heap_constant_ary = [,0,1,2,'3'];
+// Non-extensible
+var b =  Object.preventExtensions(holey_heap_constant_ary);
+testHeapConstantArray(b);
+
+// Sealed
+var c =  Object.seal(holey_heap_constant_ary);
+testHeapConstantArray(c);
+
+// Frozen
+var d =  Object.freeze(holey_heap_constant_ary);
+testHeapConstantArray(d);
diff --git a/src/v8/test/mjsunit/keyed-ic.js b/src/v8/test/mjsunit/keyed-ic.js
index a6726ed..2775935 100644
--- a/src/v8/test/mjsunit/keyed-ic.js
+++ b/src/v8/test/mjsunit/keyed-ic.js
@@ -150,24 +150,106 @@
 runTest = function() {
   var o = [ 42, 43 ];
 
-  var initial_X = 0;
-  var X = initial_X;
-  var Y = 1;
+  function test(o) {
+    var initial_X = 0;
+    var X = initial_X;
+    var Y = 1;
 
-  function fieldTest(change_index) {
-    for (var i = 0; i < 10; i++) {
-      var property = o[X];
-      if (i <= change_index) {
-        assertEquals(42, property);
-      } else {
-        assertEquals(43, property);
+    function fieldTest(change_index) {
+      for (var i = 0; i < 10; i++) {
+        var property = o[X];
+        if (i <= change_index) {
+          assertEquals(42, property);
+        } else {
+          assertEquals(43, property);
+        }
+        if (i == change_index) X = Y;
       }
-      if (i == change_index) X = Y;
-    }
-    X = initial_X;
-  };
+      X = initial_X;
+    };
 
-  for (var i = 0; i < 10; i++) fieldTest(i);
+    for (var i = 0; i < 10; i++) fieldTest(i);
+  }
+  test(o);
+
+  // Non-extensible
+  var b =  Object.preventExtensions(o);
+  test(b);
+
+  // Sealed
+  var c =  Object.seal(o);
+  test(c);
+
+  // Frozen
+  var d =  Object.freeze(o);
+  test(d);
+}
+
+runTest();
+
+// ----------------------------------------------------------------------
+// Indexed access for packed/holey elements
+// ----------------------------------------------------------------------
+runTest = function() {
+  var o = [ 'a', 43 ];
+
+  function test(o, holey=false) {
+    var initial_X = 0;
+    var X = initial_X;
+    var Y = 1;
+
+    function fieldTest(change_index) {
+      for (var i = 0; i < 10; i++) {
+        var property = o[X];
+        if (i <= change_index) {
+          if (holey) {
+            assertEquals(undefined, property);
+          } else {
+            assertEquals('a', property);
+          }
+        } else {
+          if (holey) {
+            assertEquals('a', property);
+          }
+          else {
+            assertEquals(43, property);
+          }
+        }
+        if (i == change_index) X = Y;
+      }
+      X = initial_X;
+    };
+
+    for (var i = 0; i < 10; i++) fieldTest(i);
+  }
+  test(o);
+
+  // Packed
+  // Non-extensible
+  var b =  Object.preventExtensions(o);
+  test(b);
+
+  // Sealed
+  var c =  Object.seal(o);
+  test(c);
+
+  // Frozen
+  var d =  Object.freeze(o);
+  test(d);
+
+  // Holey
+  // Non-extensible
+  o = [, 'a'];
+  var b =  Object.preventExtensions(o);
+  test(b, true);
+
+  // Sealed
+  var c =  Object.seal(o);
+  test(c, true);
+
+  // Frozen
+  var d =  Object.freeze(o);
+  test(d, true);
 }
 
 runTest();
diff --git a/src/v8/test/mjsunit/keyed-load-hole-to-undefined.js b/src/v8/test/mjsunit/keyed-load-hole-to-undefined.js
index ffac548..0f2d3b9 100644
--- a/src/v8/test/mjsunit/keyed-load-hole-to-undefined.js
+++ b/src/v8/test/mjsunit/keyed-load-hole-to-undefined.js
@@ -11,6 +11,7 @@
 
 function foo(a, i) { return a[i]; }
 
+%PrepareFunctionForOptimization(foo);
 var a = ['one', , 'three'];
 foo(a, 0);
 foo(a, 0);
diff --git a/src/v8/test/mjsunit/keyed-load-null-receiver.js b/src/v8/test/mjsunit/keyed-load-null-receiver.js
new file mode 100644
index 0000000..b5b844b
--- /dev/null
+++ b/src/v8/test/mjsunit/keyed-load-null-receiver.js
@@ -0,0 +1,42 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var count = 0;
+function load(a) {
+  var prop = {
+    toString: function() {
+      count++;
+      return 'z';
+    }
+  };
+
+  a[prop] ^= 1;
+}
+
+function f(null_or_undefined) {
+  // Turn the LoadIC megamorphic
+  load({a0:1, z:2});
+  load({a1:1, z:2});
+  load({a2:1, z:2});
+  load({a3:1, z:2});
+  load({a4:1, z:2});
+  // Now try null to check if generic IC handles this correctly.
+  // It shouldn't call prop.toString.
+  load(null_or_undefined);
+}
+
+try {
+  f(null);
+} catch(error) {
+  assertInstanceof(error, TypeError);
+  assertSame(10, count);
+}
+
+try {
+  count = 0;
+  f(undefined);
+} catch(error) {
+  assertInstanceof(error, TypeError);
+  assertSame(10, count);
+}
diff --git a/src/v8/test/mjsunit/keyed-load-with-string-key.js b/src/v8/test/mjsunit/keyed-load-with-string-key.js
index ee055e4..bb2a242 100644
--- a/src/v8/test/mjsunit/keyed-load-with-string-key.js
+++ b/src/v8/test/mjsunit/keyed-load-with-string-key.js
@@ -36,6 +36,7 @@
   return obj[key];
 }
 
+%PrepareFunctionForOptimization(get);
 get(o, "foo");
 get(o, "foo");
 get(o, "foo");
diff --git a/src/v8/test/mjsunit/keyed-load-with-symbol-key.js b/src/v8/test/mjsunit/keyed-load-with-symbol-key.js
index d0be0a0..8015cdf 100644
--- a/src/v8/test/mjsunit/keyed-load-with-symbol-key.js
+++ b/src/v8/test/mjsunit/keyed-load-with-symbol-key.js
@@ -37,6 +37,7 @@
   return obj[key];
 }
 
+%PrepareFunctionForOptimization(get);
 assertEquals("bar", get(o, s));
 get(o, s);
 get(o, s);
diff --git a/src/v8/test/mjsunit/keyed-named-access.js b/src/v8/test/mjsunit/keyed-named-access.js
index 11f8fb5..aec57dd 100644
--- a/src/v8/test/mjsunit/keyed-named-access.js
+++ b/src/v8/test/mjsunit/keyed-named-access.js
@@ -17,18 +17,21 @@
   return result;
 }
 
+%PrepareFunctionForOptimization(f);
 f(o1);
 f(o1);
 f(o1);
 %OptimizeFunctionOnNextCall(f);
 assertEquals(1000, f(o1));
 
+%PrepareFunctionForOptimization(f);
 f(o2);
 f(o2);
 f(o2);
 %OptimizeFunctionOnNextCall(f);
 assertEquals(1100, f(o2));
 
+%PrepareFunctionForOptimization(f);
 f(o3);
 f(o3);
 f(o3);
@@ -53,6 +56,7 @@
    return g(1, o[h()]--, 10);
   }
 
+  %PrepareFunctionForOptimization(test);
   test(global);
   test(global);
   %OptimizeFunctionOnNextCall(test);
@@ -65,6 +69,7 @@
    this[0, ""]--;
   }
 
+  %PrepareFunctionForOptimization(test);
   test();
   test();
   %OptimizeFunctionOnNextCall(test);
diff --git a/src/v8/test/mjsunit/keyed-store-array-literal.js b/src/v8/test/mjsunit/keyed-store-array-literal.js
new file mode 100644
index 0000000..000385b
--- /dev/null
+++ b/src/v8/test/mjsunit/keyed-store-array-literal.js
@@ -0,0 +1,80 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+
+function f1() {
+  const x = [,];
+  x[1] = 42;
+  assertEquals([undefined, 42], x);
+}
+
+%PrepareFunctionForOptimization(f1);
+f1();
+f1();
+%OptimizeFunctionOnNextCall(f1);
+f1();
+f1();
+
+
+function f2() {
+  const x = [0];
+  for (const y of [1, 2, 3, 4]) {
+    x[x.length] = y;
+  }
+  assertEquals([0, 1, 2, 3, 4], x);
+}
+
+%PrepareFunctionForOptimization(f2);
+f2();
+f2();
+%OptimizeFunctionOnNextCall(f2);
+f2();
+f2();
+
+
+function f3() {
+  const x = [0];
+  for (const y of [1.1, {}]) {
+    x[x.length] = y;
+  }
+  assertEquals([0, 1.1, {}], x);
+}
+
+%PrepareFunctionForOptimization(f3);
+f3();
+f3();
+%OptimizeFunctionOnNextCall(f3);
+f3();
+f3();
+
+
+function f4(x) {
+  x[x.length] = x.length;
+}
+
+%PrepareFunctionForOptimization(f4);
+let x1 = [];
+f4(x1);
+assertEquals([0], x1);
+f4(x1);
+assertEquals([0, 1], x1);
+%OptimizeFunctionOnNextCall(f4);
+f4(x1);
+assertEquals([0, 1, 2], x1);
+f4(x1);
+assertEquals([0, 1, 2, 3], x1);
+
+%PrepareFunctionForOptimization(f4);
+let x2 = {length: 42};
+f4(x2);
+assertEquals(42, x2[42]);
+f4(x2);
+assertEquals(42, x2[42]);
+%OptimizeFunctionOnNextCall(f4);
+f4(x2);
+assertEquals(42, x2[42]);
+f4(x2);
+assertEquals(42, x2[42]);
diff --git a/src/v8/test/mjsunit/keyed-store-generic.js b/src/v8/test/mjsunit/keyed-store-generic.js
index c2c48dd..e5d6ab4 100644
--- a/src/v8/test/mjsunit/keyed-store-generic.js
+++ b/src/v8/test/mjsunit/keyed-store-generic.js
@@ -16,7 +16,7 @@
 
 (function TestSpeciesProtector() {
   function MyArray() {}
-  assertTrue(%SpeciesProtector());
+  assertTrue(%ArraySpeciesProtector());
   f(Array.prototype, "constructor", MyArray);
-  assertFalse(%SpeciesProtector());
+  assertFalse(%ArraySpeciesProtector());
 })();
diff --git a/src/v8/test/mjsunit/large-object-literal-slow-elements.js b/src/v8/test/mjsunit/large-object-literal-slow-elements.js
index eefde1b..c977e04 100644
--- a/src/v8/test/mjsunit/large-object-literal-slow-elements.js
+++ b/src/v8/test/mjsunit/large-object-literal-slow-elements.js
@@ -27,6 +27,7 @@
   %HeapObjectVerify(object);
 }
 
+%PrepareFunctionForOptimization(TestLargeObjectElements);
 TestLargeObjectElements();
 TestLargeObjectElements();
 %OptimizeFunctionOnNextCall(TestLargeObjectElements);
diff --git a/src/v8/test/mjsunit/large-object-literal.js b/src/v8/test/mjsunit/large-object-literal.js
index 8bf4deb..1c539c8 100644
--- a/src/v8/test/mjsunit/large-object-literal.js
+++ b/src/v8/test/mjsunit/large-object-literal.js
@@ -36,7 +36,7 @@
 
   for (var i = 0; i < size; i++) {
     if (i > 0) literal += ",";
-    literal += ("a" + i + ":" + i);
+    literal += 'a' + i + ':' + i;
   }
   literal += "}";
 
@@ -45,7 +45,7 @@
 
   // Check that the properties have the expected values.
   for (var i = 0; i < size; i++) {
-    assertEquals(i, o["a"+i]);
+    assertEquals(i, o['a' + i]);
   }
 }
 function testElementLiteral(size) {
@@ -55,7 +55,7 @@
 
   for (var i = 0; i < size; i++) {
     if (i > 0) literal += ",";
-    literal += (i + ":'" + i+"'");
+    literal += i + ':\'' + i + '\'';
   }
   literal += "}";
 
@@ -64,7 +64,7 @@
 
   // Check that the properties have the expected values.
   for (var i = 0; i < size; i++) {
-    assertEquals(i+"", o[i]);
+    assertEquals(i + '', o[i]);
   }
 }
 
@@ -83,8 +83,9 @@
 
 function TestSlowLiteralOptimized() {
   function f() {
-    return {__proto__:null, bar:"barValue"};
-  }
+    return {__proto__: null, bar: 'barValue'};
+  };
+  %PrepareFunctionForOptimization(f);
   let obj = f();
   assertFalse(%HasFastProperties(obj));
   assertEquals(Object.getPrototypeOf(obj), null);
diff --git a/src/v8/test/mjsunit/lea-add.js b/src/v8/test/mjsunit/lea-add.js
index 28a1494..cc1224e 100644
--- a/src/v8/test/mjsunit/lea-add.js
+++ b/src/v8/test/mjsunit/lea-add.js
@@ -59,24 +59,28 @@
   return sum;
 }
 
+%PrepareFunctionForOptimization(a);
 a();
 a();
 %OptimizeFunctionOnNextCall(a);
 assertEquals(124750, a());
 assertEquals(124750, a());
 
+%PrepareFunctionForOptimization(b);
 b();
 b();
 %OptimizeFunctionOnNextCall(b);
 assertEquals(-125250, b());
 assertEquals(-125250, b());
 
+%PrepareFunctionForOptimization(c);
 c();
 c();
 %OptimizeFunctionOnNextCall(c);
 assertEquals(-1073741698750, c());
 assertEquals(-1073741698750, c());
 
+%PrepareFunctionForOptimization(d);
 d();
 d();
 %OptimizeFunctionOnNextCall(d);
diff --git a/src/v8/test/mjsunit/linecontinuation.js b/src/v8/test/mjsunit/linecontinuation.js
new file mode 100644
index 0000000..a8f2f61
--- /dev/null
+++ b/src/v8/test/mjsunit/linecontinuation.js
@@ -0,0 +1,40 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// https://tc39.github.io/ecma262/#sec-literals-string-literals
+//
+// LineContinuation ::
+//   \ LineTerminatorSequence
+//
+// LineTerminatorSequence ::
+//   <LF>
+//   <CR>[lookahead ≠ <LF>]
+//   <LS>
+//   <PS>
+//   <CR><LF>
+
+// LineTerminatorSequence :: <LF>
+assertEquals('', eval('"\\\n"'));
+assertEquals('', eval("'\\\n'"));
+assertEquals('', eval('`\\\n`'));
+
+// LineTerminatorSequence :: <CR>[lookahead ≠ <LF>]
+assertEquals('', eval('"\\\r"'));
+assertEquals('', eval("'\\\r'"));
+assertEquals('', eval('`\\\r`'));
+
+// LineTerminatorSequence :: <LS>
+assertEquals('', eval('"\\\u2028"'));
+assertEquals('', eval("'\\\u2028'"));
+assertEquals('', eval('`\\\u2028`'));
+
+// LineTerminatorSequence :: <PS>
+assertEquals('', eval('"\\\u2029"'));
+assertEquals('', eval("'\\\u2029'"));
+assertEquals('', eval('`\\\u2029`'));
+
+// LineTerminatorSequence :: <CR><LF>
+assertEquals('', eval('"\\\r\n"'));
+assertEquals('', eval("'\\\r\n'"));
+assertEquals('', eval('`\\\r\n`'));
diff --git a/src/v8/test/mjsunit/lithium/DivI.js b/src/v8/test/mjsunit/lithium/DivI.js
index 5420d8c..3f51168 100644
--- a/src/v8/test/mjsunit/lithium/DivI.js
+++ b/src/v8/test/mjsunit/lithium/DivI.js
@@ -38,6 +38,7 @@
   return result / b;
 }
 
+%PrepareFunctionForOptimization(foo);
 foo(700, 5);
 var r1 = foo(700, 5);
 %OptimizeFunctionOnNextCall(foo);
@@ -50,6 +51,7 @@
 }
 
 // Test deoptimization of MinInt / -1.
+%PrepareFunctionForOptimization(boo);
 assertEquals(2147483600, boo(-2147483600));
 assertEquals(2147483600, boo(-2147483600));
 %OptimizeFunctionOnNextCall(boo);
diff --git a/src/v8/test/mjsunit/lithium/MathExp.js b/src/v8/test/mjsunit/lithium/MathExp.js
index 854ff5f..4157092 100644
--- a/src/v8/test/mjsunit/lithium/MathExp.js
+++ b/src/v8/test/mjsunit/lithium/MathExp.js
@@ -31,6 +31,7 @@
   return Math.exp(x);
 }
 
+%PrepareFunctionForOptimization(foo);
 foo(12.3);
 var r1 = foo(12.3);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/lithium/MulI.js b/src/v8/test/mjsunit/lithium/MulI.js
index 68588bd..dd6226d 100644
--- a/src/v8/test/mjsunit/lithium/MulI.js
+++ b/src/v8/test/mjsunit/lithium/MulI.js
@@ -45,6 +45,7 @@
   return result * a;
 }
 
+%PrepareFunctionForOptimization(foo_smi);
 foo_smi(10, 5);
 var r1 = foo_smi(10, 5);
 %OptimizeFunctionOnNextCall(foo_smi);
@@ -52,6 +53,7 @@
 
 assertEquals(r1, r2);
 
+%PrepareFunctionForOptimization(foo_int);
 foo_int(10, 21474800);
 var r3 = foo_int(10, 21474800);
 %OptimizeFunctionOnNextCall(foo_int);
@@ -64,6 +66,7 @@
   return value * -1;
 }
 
+%PrepareFunctionForOptimization(foo2);
 foo2(-2147483600);
 foo2(-2147483600);
 %OptimizeFunctionOnNextCall(foo2);
diff --git a/src/v8/test/mjsunit/lithium/StoreKeyed.js b/src/v8/test/mjsunit/lithium/StoreKeyed.js
index d34f390..16c0172 100644
--- a/src/v8/test/mjsunit/lithium/StoreKeyed.js
+++ b/src/v8/test/mjsunit/lithium/StoreKeyed.js
@@ -45,11 +45,13 @@
 var A2_int = [12, 23];
 var A3_int = [12, 23];
 
+%PrepareFunctionForOptimization(foo);
 foo(A1, 1, 3.4);
 foo(A2, 1, 3.4);
 %OptimizeFunctionOnNextCall(foo);
 foo(A3, 1, 3.4);
 
+%PrepareFunctionForOptimization(foo_int);
 foo_int(A1_int, 1, 34);
 foo_int(A2_int, 1, 34);
 %OptimizeFunctionOnNextCall(foo_int);
diff --git a/src/v8/test/mjsunit/lithium/StoreKeyedExternal.js b/src/v8/test/mjsunit/lithium/StoreKeyedExternal.js
index a5670fe..e8944bb 100644
--- a/src/v8/test/mjsunit/lithium/StoreKeyedExternal.js
+++ b/src/v8/test/mjsunit/lithium/StoreKeyedExternal.js
@@ -72,26 +72,31 @@
 var A2_double = new Float64Array(2);
 var A3_double = new Float64Array(2);
 
+%PrepareFunctionForOptimization(foo_pixel);
 foo_pixel(A1_pixel, 1, 34);
 foo_pixel(A2_pixel, 1, 34);
 %OptimizeFunctionOnNextCall(foo_pixel);
 foo_pixel(A3_pixel, 1, 34);
 
+%PrepareFunctionForOptimization(foo_uint16);
 foo_uint16(A1_uint16, 1, 3.4);
 foo_uint16(A2_uint16, 1, 3.4);
 %OptimizeFunctionOnNextCall(foo_uint16);
 foo_uint16(A3_uint16, 1, 3.4);
 
+%PrepareFunctionForOptimization(foo_uint32);
 foo_uint32(A1_uint32, 1, 3.4);
 foo_uint32(A2_uint32, 1, 3.4);
 %OptimizeFunctionOnNextCall(foo_uint32);
 foo_uint32(A3_uint32, 1, 3.4);
 
+%PrepareFunctionForOptimization(foo_float);
 foo_float(A1_float, 1, 3.4);
 foo_float(A2_float, 1, 3.4);
 %OptimizeFunctionOnNextCall(foo_float);
 foo_float(A3_float, 1, 3.4);
 
+%PrepareFunctionForOptimization(foo_double);
 foo_double(A1_double, 1, 3.4);
 foo_double(A2_double, 1, 3.4);
 %OptimizeFunctionOnNextCall(foo_double);
diff --git a/src/v8/test/mjsunit/load_poly_effect.js b/src/v8/test/mjsunit/load_poly_effect.js
index 7663d86..8ac4837 100644
--- a/src/v8/test/mjsunit/load_poly_effect.js
+++ b/src/v8/test/mjsunit/load_poly_effect.js
@@ -39,6 +39,7 @@
 var o2 = {x_tagged:{}};
 o2.x_tagged = 1;
 
+%PrepareFunctionForOptimization(load);
 load({x:1}, o2);
 load({x:1}, o2);
 print(load(o, o2));
diff --git a/src/v8/test/mjsunit/math-abs.js b/src/v8/test/mjsunit/math-abs.js
index 4fb72ba..d688516 100644
--- a/src/v8/test/mjsunit/math-abs.js
+++ b/src/v8/test/mjsunit/math-abs.js
@@ -106,6 +106,7 @@
 for(var i = 0; i < 1000; i++) {
   foo(-i);
 }
+%PrepareFunctionForOptimization(foo);
 assertEquals(42, foo(-42));
 %OptimizeFunctionOnNextCall(foo)
 assertEquals(42, foo(-42));
@@ -115,7 +116,8 @@
 var a = [-1, -2];
 function foo2() {
   return Math.abs(a[0]);
-}
+};
+%PrepareFunctionForOptimization(foo2);
 assertEquals(1, foo2());
 assertEquals(1, foo2());
 %OptimizeFunctionOnNextCall(foo2);
@@ -132,6 +134,7 @@
 // Create minimum integer input for abs() using bitwise operations
 // that should overflow.
 bits = 32;
+%PrepareFunctionForOptimization(absHalf);
 assertEquals(2147483648, absHalf(bits));
 assertEquals(2147483648, absHalf(bits));
 %OptimizeFunctionOnNextCall(absHalf);
diff --git a/src/v8/test/mjsunit/math-ceil.js b/src/v8/test/mjsunit/math-ceil.js
index 05794f4..d0999b0 100644
--- a/src/v8/test/mjsunit/math-ceil.js
+++ b/src/v8/test/mjsunit/math-ceil.js
@@ -9,6 +9,7 @@
 function testCeil(expect, input) {
   var test = new Function('n',
                           '"' + (test_id++) + '";return Math.ceil(n)');
+  %PrepareFunctionForOptimization(test);
   assertEquals(expect, test(input));
   assertEquals(expect, test(input));
   assertEquals(expect, test(input));
@@ -18,6 +19,7 @@
   var test_double_input = new Function(
       'n',
       '"' + (test_id++) + '";return Math.ceil(+n)');
+  %PrepareFunctionForOptimization(test_double_input);
   assertEquals(expect, test_double_input(input));
   assertEquals(expect, test_double_input(input));
   assertEquals(expect, test_double_input(input));
@@ -27,6 +29,7 @@
   var test_double_output = new Function(
       'n',
       '"' + (test_id++) + '";return Math.ceil(n) + -0.0');
+  %PrepareFunctionForOptimization(test_double_output);
   assertEquals(expect, test_double_output(input));
   assertEquals(expect, test_double_output(input));
   assertEquals(expect, test_double_output(input));
@@ -36,6 +39,7 @@
   var test_via_floor = new Function(
       'n',
       '"' + (test_id++) + '";return -Math.floor(-n)');
+  %PrepareFunctionForOptimization(test_via_floor);
   assertEquals(expect, test_via_floor(input));
   assertEquals(expect, test_via_floor(input));
   assertEquals(expect, test_via_floor(input));
@@ -46,6 +50,7 @@
     var test_via_trunc = new Function(
         'n',
         '"' + (test_id++) + '";return Math.trunc(n)');
+    %PrepareFunctionForOptimization(test_via_trunc);
     assertEquals(expect, test_via_trunc(input));
     assertEquals(expect, test_via_trunc(input));
     assertEquals(expect, test_via_trunc(input));
diff --git a/src/v8/test/mjsunit/math-deopt.js b/src/v8/test/mjsunit/math-deopt.js
new file mode 100644
index 0000000..609e406
--- /dev/null
+++ b/src/v8/test/mjsunit/math-deopt.js
@@ -0,0 +1,80 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license
+// that can be found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+(()=> {
+  function f(a) {
+    return Math.abs(a);
+  }
+  %PrepareFunctionForOptimization(f);
+  f(1);
+  f(1);
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  %PrepareFunctionForOptimization(f);
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  assertOptimized(f);
+})();
+
+(()=> {
+  function f(a) {
+    return Math.min(1,a);
+  }
+  %PrepareFunctionForOptimization(f);
+  f(1);
+  f(1);
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  %PrepareFunctionForOptimization(f);
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  assertOptimized(f);
+})();
+
+(()=> {
+  function f(a) {
+    return Math.pow(a,10);
+  }
+  %PrepareFunctionForOptimization(f);
+  f(1);
+  f(1);
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  %PrepareFunctionForOptimization(f);
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  assertOptimized(f);
+})();
+
+(()=> {
+  function f(a) {
+    return Math.clz32(a);
+  }
+  %PrepareFunctionForOptimization(f);
+  f(1);
+  f(1);
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  %PrepareFunctionForOptimization(f);
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  assertOptimized(f);
+})();
+
+(()=> {
+  function f(a) {
+    return Math.imul(a, 10);
+  }
+  %PrepareFunctionForOptimization(f);
+  f(1);
+  f(1);
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  %PrepareFunctionForOptimization(f);
+  %OptimizeFunctionOnNextCall(f);
+  f("100");
+  assertOptimized(f);
+})();
diff --git a/src/v8/test/mjsunit/math-floor-negative.js b/src/v8/test/mjsunit/math-floor-negative.js
index e39d5ad..f04f527 100644
--- a/src/v8/test/mjsunit/math-floor-negative.js
+++ b/src/v8/test/mjsunit/math-floor-negative.js
@@ -31,19 +31,19 @@
   // Trigger overflow when converting/truncating double to integer.
   // Divide by 10 to avoid overflow when smi-tagging at the end.
   return Math.floor(-100000000000.5) / 10;
-}
-
+};
+%PrepareFunctionForOptimization(test1);
 function test2() {
   // Trigger no overflow.
   return Math.floor(-100.2);
-}
-
+};
+%PrepareFunctionForOptimization(test2);
 function test3() {
   // Trigger overflow when compensating by subtracting after compare.
   // Divide by 10 to avoid overflow when smi-tagging at the end.
   return Math.floor(-2147483648.1) / 10;
-}
-
+};
+%PrepareFunctionForOptimization(test3);
 test1();
 test1();
 %OptimizeFunctionOnNextCall(test1);
diff --git a/src/v8/test/mjsunit/math-floor-of-div-minus-zero.js b/src/v8/test/mjsunit/math-floor-of-div-minus-zero.js
index a721467..0c424c5 100644
--- a/src/v8/test/mjsunit/math-floor-of-div-minus-zero.js
+++ b/src/v8/test/mjsunit/math-floor-of-div-minus-zero.js
@@ -34,6 +34,7 @@
   assertTrue(0 === (Math.floor((zero_in_array[0] | 0) / -1) | 0));
 }
 
+%PrepareFunctionForOptimization(test_div_no_deopt_minus_zero);
 test_div_no_deopt_minus_zero();
 test_div_no_deopt_minus_zero();
 %OptimizeFunctionOnNextCall(test_div_no_deopt_minus_zero);
diff --git a/src/v8/test/mjsunit/math-floor-of-div-nosudiv.js b/src/v8/test/mjsunit/math-floor-of-div-nosudiv.js
index 5340f83..9b97784 100644
--- a/src/v8/test/mjsunit/math-floor-of-div-nosudiv.js
+++ b/src/v8/test/mjsunit/math-floor-of-div-nosudiv.js
@@ -180,6 +180,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(test_div);
 test_div();
 %OptimizeFunctionOnNextCall(test_div);
 test_div();
@@ -201,6 +202,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(test_div2);
 test_div2();
 %OptimizeFunctionOnNextCall(test_div2);
 test_div2();
@@ -244,6 +246,9 @@
   }
 }
 
+%PrepareFunctionForOptimization(test_div_deopt_minus_zero);
+%PrepareFunctionForOptimization(test_div_deopt_overflow);
+%PrepareFunctionForOptimization(test_div_deopt_div_by_zero);
 test_div_deopt_minus_zero();
 test_div_deopt_overflow();
 test_div_deopt_div_by_zero();
@@ -277,6 +282,9 @@
   }
 }
 
+%PrepareFunctionForOptimization(test_div_deopt_minus_zero_v);
+%PrepareFunctionForOptimization(test_div_deopt_overflow_v);
+%PrepareFunctionForOptimization(test_div_deopt_div_by_zero_v);
 test_div_deopt_minus_zero_v();
 test_div_deopt_overflow_v();
 test_div_deopt_div_by_zero_v();
diff --git a/src/v8/test/mjsunit/math-floor-of-div.js b/src/v8/test/mjsunit/math-floor-of-div.js
index d0026e9..1c695a4 100644
--- a/src/v8/test/mjsunit/math-floor-of-div.js
+++ b/src/v8/test/mjsunit/math-floor-of-div.js
@@ -35,72 +35,74 @@
 var limit = 0x1000000;
 var exhaustive_limit = 100;
 var step = 10;
-var values = [0x10000001,
-              0x12345678,
-              -0x789abcdf,  // 0x87654321
-              0x01234567,
-              0x76543210,
-              -0x80000000,  // 0x80000000
-              0x7fffffff,
-              -0x0fffffff,  // 0xf0000001
-              0x00000010,
-              -0x01000000   // 0xff000000
-              ];
+var values = [
+  0x10000001, 0x12345678,
+  -0x789abcdf,  // 0x87654321
+  0x01234567, 0x76543210,
+  -0x80000000,  // 0x80000000
+  0x7fffffff,
+  -0x0fffffff,  // 0xf0000001
+  0x00000010,
+  -0x01000000  // 0xff000000
+];
 
 function test_div() {
   var c = 0;
   for (var k = 0; k <= limit; k++) {
-    if (k > exhaustive_limit) { c += step; k += c; }
-    assertEquals(Math.floor(div(k,   1)), Math.floor(k /   1));
-    assertEquals(Math.floor(div(k,   -1)), Math.floor(k /   -1));
-    assertEquals(Math.floor(div(k,   2)), Math.floor(k /   2));
-    assertEquals(Math.floor(div(k,   -2)), Math.floor(k /   -2));
-    assertEquals(Math.floor(div(k,   3)), Math.floor(k /   3));
-    assertEquals(Math.floor(div(k,   -3)), Math.floor(k /   -3));
-    assertEquals(Math.floor(div(k,   4)), Math.floor(k /   4));
-    assertEquals(Math.floor(div(k,   -4)), Math.floor(k /   -4));
-    assertEquals(Math.floor(div(k,   5)), Math.floor(k /   5));
-    assertEquals(Math.floor(div(k,   -5)), Math.floor(k /   -5));
-    assertEquals(Math.floor(div(k,   6)), Math.floor(k /   6));
-    assertEquals(Math.floor(div(k,   -6)), Math.floor(k /   -6));
-    assertEquals(Math.floor(div(k,   7)), Math.floor(k /   7));
-    assertEquals(Math.floor(div(k,   -7)), Math.floor(k /   -7));
-    assertEquals(Math.floor(div(k,   8)), Math.floor(k /   8));
-    assertEquals(Math.floor(div(k,   -8)), Math.floor(k /   -8));
-    assertEquals(Math.floor(div(k,   9)), Math.floor(k /   9));
-    assertEquals(Math.floor(div(k,   -9)), Math.floor(k /   -9));
-    assertEquals(Math.floor(div(k,  10)), Math.floor(k /  10));
-    assertEquals(Math.floor(div(k,  -10)), Math.floor(k /  -10));
-    assertEquals(Math.floor(div(k,  11)), Math.floor(k /  11));
-    assertEquals(Math.floor(div(k,  -11)), Math.floor(k /  -11));
-    assertEquals(Math.floor(div(k,  12)), Math.floor(k /  12));
-    assertEquals(Math.floor(div(k,  -12)), Math.floor(k /  -12));
-    assertEquals(Math.floor(div(k,  13)), Math.floor(k /  13));
-    assertEquals(Math.floor(div(k,  -13)), Math.floor(k /  -13));
-    assertEquals(Math.floor(div(k,  14)), Math.floor(k /  14));
-    assertEquals(Math.floor(div(k,  -14)), Math.floor(k /  -14));
-    assertEquals(Math.floor(div(k,  15)), Math.floor(k /  15));
-    assertEquals(Math.floor(div(k,  -15)), Math.floor(k /  -15));
-    assertEquals(Math.floor(div(k,  16)), Math.floor(k /  16));
-    assertEquals(Math.floor(div(k,  -16)), Math.floor(k /  -16));
-    assertEquals(Math.floor(div(k,  17)), Math.floor(k /  17));
-    assertEquals(Math.floor(div(k,  -17)), Math.floor(k /  -17));
-    assertEquals(Math.floor(div(k,  18)), Math.floor(k /  18));
-    assertEquals(Math.floor(div(k,  -18)), Math.floor(k /  -18));
-    assertEquals(Math.floor(div(k,  19)), Math.floor(k /  19));
-    assertEquals(Math.floor(div(k,  -19)), Math.floor(k /  -19));
-    assertEquals(Math.floor(div(k,  20)), Math.floor(k /  20));
-    assertEquals(Math.floor(div(k,  -20)), Math.floor(k /  -20));
-    assertEquals(Math.floor(div(k,  21)), Math.floor(k /  21));
-    assertEquals(Math.floor(div(k,  -21)), Math.floor(k /  -21));
-    assertEquals(Math.floor(div(k,  22)), Math.floor(k /  22));
-    assertEquals(Math.floor(div(k,  -22)), Math.floor(k /  -22));
-    assertEquals(Math.floor(div(k,  23)), Math.floor(k /  23));
-    assertEquals(Math.floor(div(k,  -23)), Math.floor(k /  -23));
-    assertEquals(Math.floor(div(k,  24)), Math.floor(k /  24));
-    assertEquals(Math.floor(div(k,  -24)), Math.floor(k /  -24));
-    assertEquals(Math.floor(div(k,  25)), Math.floor(k /  25));
-    assertEquals(Math.floor(div(k,  -25)), Math.floor(k /  -25));
+    if (k > exhaustive_limit) {
+      c += step;
+      k += c;
+    }
+    assertEquals(Math.floor(div(k, 1)), Math.floor(k / 1));
+    assertEquals(Math.floor(div(k, -1)), Math.floor(k / -1));
+    assertEquals(Math.floor(div(k, 2)), Math.floor(k / 2));
+    assertEquals(Math.floor(div(k, -2)), Math.floor(k / -2));
+    assertEquals(Math.floor(div(k, 3)), Math.floor(k / 3));
+    assertEquals(Math.floor(div(k, -3)), Math.floor(k / -3));
+    assertEquals(Math.floor(div(k, 4)), Math.floor(k / 4));
+    assertEquals(Math.floor(div(k, -4)), Math.floor(k / -4));
+    assertEquals(Math.floor(div(k, 5)), Math.floor(k / 5));
+    assertEquals(Math.floor(div(k, -5)), Math.floor(k / -5));
+    assertEquals(Math.floor(div(k, 6)), Math.floor(k / 6));
+    assertEquals(Math.floor(div(k, -6)), Math.floor(k / -6));
+    assertEquals(Math.floor(div(k, 7)), Math.floor(k / 7));
+    assertEquals(Math.floor(div(k, -7)), Math.floor(k / -7));
+    assertEquals(Math.floor(div(k, 8)), Math.floor(k / 8));
+    assertEquals(Math.floor(div(k, -8)), Math.floor(k / -8));
+    assertEquals(Math.floor(div(k, 9)), Math.floor(k / 9));
+    assertEquals(Math.floor(div(k, -9)), Math.floor(k / -9));
+    assertEquals(Math.floor(div(k, 10)), Math.floor(k / 10));
+    assertEquals(Math.floor(div(k, -10)), Math.floor(k / -10));
+    assertEquals(Math.floor(div(k, 11)), Math.floor(k / 11));
+    assertEquals(Math.floor(div(k, -11)), Math.floor(k / -11));
+    assertEquals(Math.floor(div(k, 12)), Math.floor(k / 12));
+    assertEquals(Math.floor(div(k, -12)), Math.floor(k / -12));
+    assertEquals(Math.floor(div(k, 13)), Math.floor(k / 13));
+    assertEquals(Math.floor(div(k, -13)), Math.floor(k / -13));
+    assertEquals(Math.floor(div(k, 14)), Math.floor(k / 14));
+    assertEquals(Math.floor(div(k, -14)), Math.floor(k / -14));
+    assertEquals(Math.floor(div(k, 15)), Math.floor(k / 15));
+    assertEquals(Math.floor(div(k, -15)), Math.floor(k / -15));
+    assertEquals(Math.floor(div(k, 16)), Math.floor(k / 16));
+    assertEquals(Math.floor(div(k, -16)), Math.floor(k / -16));
+    assertEquals(Math.floor(div(k, 17)), Math.floor(k / 17));
+    assertEquals(Math.floor(div(k, -17)), Math.floor(k / -17));
+    assertEquals(Math.floor(div(k, 18)), Math.floor(k / 18));
+    assertEquals(Math.floor(div(k, -18)), Math.floor(k / -18));
+    assertEquals(Math.floor(div(k, 19)), Math.floor(k / 19));
+    assertEquals(Math.floor(div(k, -19)), Math.floor(k / -19));
+    assertEquals(Math.floor(div(k, 20)), Math.floor(k / 20));
+    assertEquals(Math.floor(div(k, -20)), Math.floor(k / -20));
+    assertEquals(Math.floor(div(k, 21)), Math.floor(k / 21));
+    assertEquals(Math.floor(div(k, -21)), Math.floor(k / -21));
+    assertEquals(Math.floor(div(k, 22)), Math.floor(k / 22));
+    assertEquals(Math.floor(div(k, -22)), Math.floor(k / -22));
+    assertEquals(Math.floor(div(k, 23)), Math.floor(k / 23));
+    assertEquals(Math.floor(div(k, -23)), Math.floor(k / -23));
+    assertEquals(Math.floor(div(k, 24)), Math.floor(k / 24));
+    assertEquals(Math.floor(div(k, -24)), Math.floor(k / -24));
+    assertEquals(Math.floor(div(k, 25)), Math.floor(k / 25));
+    assertEquals(Math.floor(div(k, -25)), Math.floor(k / -25));
     assertEquals(Math.floor(div(k, 125)), Math.floor(k / 125));
     assertEquals(Math.floor(div(k, -125)), Math.floor(k / -125));
     assertEquals(Math.floor(div(k, 625)), Math.floor(k / 625));
@@ -108,57 +110,60 @@
   }
   c = 0;
   for (var k = 0; k <= limit; k++) {
-    if (k > exhaustive_limit) { c += step; k += c; }
-    assertEquals(Math.floor(div(-k,   1)), Math.floor(-k /   1));
-    assertEquals(Math.floor(div(-k,   -1)), Math.floor(-k /   -1));
-    assertEquals(Math.floor(div(-k,   2)), Math.floor(-k /   2));
-    assertEquals(Math.floor(div(-k,   -2)), Math.floor(-k /   -2));
-    assertEquals(Math.floor(div(-k,   3)), Math.floor(-k /   3));
-    assertEquals(Math.floor(div(-k,   -3)), Math.floor(-k /   -3));
-    assertEquals(Math.floor(div(-k,   4)), Math.floor(-k /   4));
-    assertEquals(Math.floor(div(-k,   -4)), Math.floor(-k /   -4));
-    assertEquals(Math.floor(div(-k,   5)), Math.floor(-k /   5));
-    assertEquals(Math.floor(div(-k,   -5)), Math.floor(-k /   -5));
-    assertEquals(Math.floor(div(-k,   6)), Math.floor(-k /   6));
-    assertEquals(Math.floor(div(-k,   -6)), Math.floor(-k /   -6));
-    assertEquals(Math.floor(div(-k,   7)), Math.floor(-k /   7));
-    assertEquals(Math.floor(div(-k,   -7)), Math.floor(-k /   -7));
-    assertEquals(Math.floor(div(-k,   8)), Math.floor(-k /   8));
-    assertEquals(Math.floor(div(-k,   -8)), Math.floor(-k /   -8));
-    assertEquals(Math.floor(div(-k,   9)), Math.floor(-k /   9));
-    assertEquals(Math.floor(div(-k,   -9)), Math.floor(-k /   -9));
-    assertEquals(Math.floor(div(-k,  10)), Math.floor(-k /  10));
-    assertEquals(Math.floor(div(-k,  -10)), Math.floor(-k /  -10));
-    assertEquals(Math.floor(div(-k,  11)), Math.floor(-k /  11));
-    assertEquals(Math.floor(div(-k,  -11)), Math.floor(-k /  -11));
-    assertEquals(Math.floor(div(-k,  12)), Math.floor(-k /  12));
-    assertEquals(Math.floor(div(-k,  -12)), Math.floor(-k /  -12));
-    assertEquals(Math.floor(div(-k,  13)), Math.floor(-k /  13));
-    assertEquals(Math.floor(div(-k,  -13)), Math.floor(-k /  -13));
-    assertEquals(Math.floor(div(-k,  14)), Math.floor(-k /  14));
-    assertEquals(Math.floor(div(-k,  -14)), Math.floor(-k /  -14));
-    assertEquals(Math.floor(div(-k,  15)), Math.floor(-k /  15));
-    assertEquals(Math.floor(div(-k,  -15)), Math.floor(-k /  -15));
-    assertEquals(Math.floor(div(-k,  16)), Math.floor(-k /  16));
-    assertEquals(Math.floor(div(-k,  -16)), Math.floor(-k /  -16));
-    assertEquals(Math.floor(div(-k,  17)), Math.floor(-k /  17));
-    assertEquals(Math.floor(div(-k,  -17)), Math.floor(-k /  -17));
-    assertEquals(Math.floor(div(-k,  18)), Math.floor(-k /  18));
-    assertEquals(Math.floor(div(-k,  -18)), Math.floor(-k /  -18));
-    assertEquals(Math.floor(div(-k,  19)), Math.floor(-k /  19));
-    assertEquals(Math.floor(div(-k,  -19)), Math.floor(-k /  -19));
-    assertEquals(Math.floor(div(-k,  20)), Math.floor(-k /  20));
-    assertEquals(Math.floor(div(-k,  -20)), Math.floor(-k /  -20));
-    assertEquals(Math.floor(div(-k,  21)), Math.floor(-k /  21));
-    assertEquals(Math.floor(div(-k,  -21)), Math.floor(-k /  -21));
-    assertEquals(Math.floor(div(-k,  22)), Math.floor(-k /  22));
-    assertEquals(Math.floor(div(-k,  -22)), Math.floor(-k /  -22));
-    assertEquals(Math.floor(div(-k,  23)), Math.floor(-k /  23));
-    assertEquals(Math.floor(div(-k,  -23)), Math.floor(-k /  -23));
-    assertEquals(Math.floor(div(-k,  24)), Math.floor(-k /  24));
-    assertEquals(Math.floor(div(-k,  -24)), Math.floor(-k /  -24));
-    assertEquals(Math.floor(div(-k,  25)), Math.floor(-k /  25));
-    assertEquals(Math.floor(div(-k,  -25)), Math.floor(-k /  -25));
+    if (k > exhaustive_limit) {
+      c += step;
+      k += c;
+    }
+    assertEquals(Math.floor(div(-k, 1)), Math.floor(-k / 1));
+    assertEquals(Math.floor(div(-k, -1)), Math.floor(-k / -1));
+    assertEquals(Math.floor(div(-k, 2)), Math.floor(-k / 2));
+    assertEquals(Math.floor(div(-k, -2)), Math.floor(-k / -2));
+    assertEquals(Math.floor(div(-k, 3)), Math.floor(-k / 3));
+    assertEquals(Math.floor(div(-k, -3)), Math.floor(-k / -3));
+    assertEquals(Math.floor(div(-k, 4)), Math.floor(-k / 4));
+    assertEquals(Math.floor(div(-k, -4)), Math.floor(-k / -4));
+    assertEquals(Math.floor(div(-k, 5)), Math.floor(-k / 5));
+    assertEquals(Math.floor(div(-k, -5)), Math.floor(-k / -5));
+    assertEquals(Math.floor(div(-k, 6)), Math.floor(-k / 6));
+    assertEquals(Math.floor(div(-k, -6)), Math.floor(-k / -6));
+    assertEquals(Math.floor(div(-k, 7)), Math.floor(-k / 7));
+    assertEquals(Math.floor(div(-k, -7)), Math.floor(-k / -7));
+    assertEquals(Math.floor(div(-k, 8)), Math.floor(-k / 8));
+    assertEquals(Math.floor(div(-k, -8)), Math.floor(-k / -8));
+    assertEquals(Math.floor(div(-k, 9)), Math.floor(-k / 9));
+    assertEquals(Math.floor(div(-k, -9)), Math.floor(-k / -9));
+    assertEquals(Math.floor(div(-k, 10)), Math.floor(-k / 10));
+    assertEquals(Math.floor(div(-k, -10)), Math.floor(-k / -10));
+    assertEquals(Math.floor(div(-k, 11)), Math.floor(-k / 11));
+    assertEquals(Math.floor(div(-k, -11)), Math.floor(-k / -11));
+    assertEquals(Math.floor(div(-k, 12)), Math.floor(-k / 12));
+    assertEquals(Math.floor(div(-k, -12)), Math.floor(-k / -12));
+    assertEquals(Math.floor(div(-k, 13)), Math.floor(-k / 13));
+    assertEquals(Math.floor(div(-k, -13)), Math.floor(-k / -13));
+    assertEquals(Math.floor(div(-k, 14)), Math.floor(-k / 14));
+    assertEquals(Math.floor(div(-k, -14)), Math.floor(-k / -14));
+    assertEquals(Math.floor(div(-k, 15)), Math.floor(-k / 15));
+    assertEquals(Math.floor(div(-k, -15)), Math.floor(-k / -15));
+    assertEquals(Math.floor(div(-k, 16)), Math.floor(-k / 16));
+    assertEquals(Math.floor(div(-k, -16)), Math.floor(-k / -16));
+    assertEquals(Math.floor(div(-k, 17)), Math.floor(-k / 17));
+    assertEquals(Math.floor(div(-k, -17)), Math.floor(-k / -17));
+    assertEquals(Math.floor(div(-k, 18)), Math.floor(-k / 18));
+    assertEquals(Math.floor(div(-k, -18)), Math.floor(-k / -18));
+    assertEquals(Math.floor(div(-k, 19)), Math.floor(-k / 19));
+    assertEquals(Math.floor(div(-k, -19)), Math.floor(-k / -19));
+    assertEquals(Math.floor(div(-k, 20)), Math.floor(-k / 20));
+    assertEquals(Math.floor(div(-k, -20)), Math.floor(-k / -20));
+    assertEquals(Math.floor(div(-k, 21)), Math.floor(-k / 21));
+    assertEquals(Math.floor(div(-k, -21)), Math.floor(-k / -21));
+    assertEquals(Math.floor(div(-k, 22)), Math.floor(-k / 22));
+    assertEquals(Math.floor(div(-k, -22)), Math.floor(-k / -22));
+    assertEquals(Math.floor(div(-k, 23)), Math.floor(-k / 23));
+    assertEquals(Math.floor(div(-k, -23)), Math.floor(-k / -23));
+    assertEquals(Math.floor(div(-k, 24)), Math.floor(-k / 24));
+    assertEquals(Math.floor(div(-k, -24)), Math.floor(-k / -24));
+    assertEquals(Math.floor(div(-k, 25)), Math.floor(-k / 25));
+    assertEquals(Math.floor(div(-k, -25)), Math.floor(-k / -25));
     assertEquals(Math.floor(div(-k, 125)), Math.floor(-k / 125));
     assertEquals(Math.floor(div(-k, -125)), Math.floor(-k / -125));
     assertEquals(Math.floor(div(-k, 625)), Math.floor(-k / 625));
@@ -168,18 +173,22 @@
   // Use (values[key] | 0) to force the integer type.
   for (var i = 0; i < values.length; i++) {
     for (var j = 0; j < values.length; j++) {
-      assertEquals(Math.floor(div((values[i] | 0), (values[j] | 0))),
-                   Math.floor((values[i] | 0) / (values[j] | 0)));
-      assertEquals(Math.floor(div(-(values[i] | 0), (values[j] | 0))),
-                   Math.floor(-(values[i] | 0) / (values[j] | 0)));
-      assertEquals(Math.floor(div((values[i] | 0), -(values[j] | 0))),
-                   Math.floor((values[i] | 0) / -(values[j] | 0)));
-      assertEquals(Math.floor(div(-(values[i] | 0), -(values[j] | 0))),
-                   Math.floor(-(values[i] | 0) / -(values[j] | 0)));
+      assertEquals(
+          Math.floor(div(values[i] | 0, values[j] | 0)),
+          Math.floor((values[i] | 0) / (values[j] | 0)));
+      assertEquals(
+          Math.floor(div(-(values[i] | 0), values[j] | 0)),
+          Math.floor(-(values[i] | 0) / (values[j] | 0)));
+      assertEquals(
+          Math.floor(div(values[i] | 0, -(values[j] | 0))),
+          Math.floor((values[i] | 0) / -(values[j] | 0)));
+      assertEquals(
+          Math.floor(div(-(values[i] | 0), -(values[j] | 0))),
+          Math.floor(-(values[i] | 0) / -(values[j] | 0)));
     }
   }
-}
-
+};
+%PrepareFunctionForOptimization(test_div);
 test_div();
 %OptimizeFunctionOnNextCall(test_div);
 test_div();
@@ -189,18 +198,22 @@
 function test_div2() {
   for (var i = 0; i < values2.length; i++) {
     for (var j = 0; j < values2.length; j++) {
-      assertEquals(Math.floor(div((values2[i] | 0), (values2[j] | 0))),
-                   Math.floor((values2[i] | 0) / (values2[j] | 0)));
-      assertEquals(Math.floor(div(-(values2[i] | 0), (values2[j] | 0))),
-                   Math.floor(-(values2[i] | 0) / (values2[j] | 0)));
-      assertEquals(Math.floor(div((values2[i] | 0), -(values2[j] | 0))),
-                   Math.floor((values2[i] | 0) / -(values2[j] | 0)));
-      assertEquals(Math.floor(div(-(values2[i] | 0), -(values2[j] | 0))),
-                   Math.floor(-(values2[i] | 0) / -(values2[j] | 0)));
+      assertEquals(
+          Math.floor(div(values2[i] | 0, values2[j] | 0)),
+          Math.floor((values2[i] | 0) / (values2[j] | 0)));
+      assertEquals(
+          Math.floor(div(-(values2[i] | 0), values2[j] | 0)),
+          Math.floor(-(values2[i] | 0) / (values2[j] | 0)));
+      assertEquals(
+          Math.floor(div(values2[i] | 0, -(values2[j] | 0))),
+          Math.floor((values2[i] | 0) / -(values2[j] | 0)));
+      assertEquals(
+          Math.floor(div(-(values2[i] | 0), -(values2[j] | 0))),
+          Math.floor(-(values2[i] | 0) / -(values2[j] | 0)));
     }
   }
-}
-
+};
+%PrepareFunctionForOptimization(test_div2);
 test_div2();
 %OptimizeFunctionOnNextCall(test_div2);
 test_div2();
@@ -227,23 +240,22 @@
   for (var i = 0; i < 2; ++i) {
     assertTrue(IsNegativeZero(Math.floor((zero_in_array[0] | 0) / -1)));
   }
-}
-
+};
+%PrepareFunctionForOptimization(test_div_deopt_minus_zero);
 function test_div_deopt_overflow() {
   for (var i = 0; i < 2; ++i) {
     // We use '| 0' to force the representation to int32.
-    assertEquals(-min_int_in_array[0],
-                 Math.floor((min_int_in_array[0] | 0) / -1));
+    assertEquals(
+        -min_int_in_array[0], Math.floor((min_int_in_array[0] | 0) / -1));
   }
-}
-
+};
+%PrepareFunctionForOptimization(test_div_deopt_overflow);
 function test_div_deopt_div_by_zero() {
   for (var i = 0; i < 2; ++i) {
-    assertEquals(div(i, 0),
-                 Math.floor(i / 0));
+    assertEquals(div(i, 0), Math.floor(i / 0));
   }
-}
-
+};
+%PrepareFunctionForOptimization(test_div_deopt_div_by_zero);
 test_div_deopt_minus_zero();
 test_div_deopt_overflow();
 test_div_deopt_div_by_zero();
@@ -257,26 +269,26 @@
 // Test for dividing by variable.
 function test_div_deopt_minus_zero_v() {
   for (var i = 0; i < 2; ++i) {
-    assertTrue(IsNegativeZero(Math.floor((zero_in_array[0] | 0) /
-               neg_one_in_array[0])));
+    assertTrue(IsNegativeZero(
+        Math.floor((zero_in_array[0] | 0) / neg_one_in_array[0])));
   }
-}
-
+};
+%PrepareFunctionForOptimization(test_div_deopt_minus_zero_v);
 function test_div_deopt_overflow_v() {
   for (var i = 0; i < 2; ++i) {
     // We use '| 0' to force the representation to int32.
-    assertEquals(-min_int_in_array[0],
-                 Math.floor((min_int_in_array[0] | 0) / neg_one_in_array[0]));
+    assertEquals(
+        -min_int_in_array[0],
+        Math.floor((min_int_in_array[0] | 0) / neg_one_in_array[0]));
   }
-}
-
+};
+%PrepareFunctionForOptimization(test_div_deopt_overflow_v);
 function test_div_deopt_div_by_zero_v() {
   for (var i = 0; i < 2; ++i) {
-    assertEquals(div(i, 0),
-                 Math.floor(i / zero_in_array[0]));
+    assertEquals(div(i, 0), Math.floor(i / zero_in_array[0]));
   }
-}
-
+};
+%PrepareFunctionForOptimization(test_div_deopt_div_by_zero_v);
 test_div_deopt_minus_zero_v();
 test_div_deopt_overflow_v();
 test_div_deopt_div_by_zero_v();
@@ -291,8 +303,8 @@
 // Test for flooring division with negative dividend.
 function flooring_div_by_3(y) {
   return Math.floor(y / 3);
-}
-
+};
+%PrepareFunctionForOptimization(flooring_div_by_3);
 assertEquals(-1, flooring_div_by_3(-2));
 assertEquals(-1, flooring_div_by_3(-2));
 %OptimizeFunctionOnNextCall(flooring_div_by_3);
diff --git a/src/v8/test/mjsunit/math-floor-part1.js b/src/v8/test/mjsunit/math-floor-part1.js
index bad1edd..c386c11 100644
--- a/src/v8/test/mjsunit/math-floor-part1.js
+++ b/src/v8/test/mjsunit/math-floor-part1.js
@@ -32,6 +32,7 @@
 function testFloor(expect, input) {
   var test = new Function('n',
                           '"' + (test_id++) + '";return Math.floor(n)');
+  %PrepareFunctionForOptimization(test);
   assertEquals(expect, test(input));
   assertEquals(expect, test(input));
   assertEquals(expect, test(input));
@@ -41,6 +42,7 @@
   var test_double_input = new Function(
       'n',
       '"' + (test_id++) + '";return Math.floor(+n)');
+  %PrepareFunctionForOptimization(test_double_input);
   assertEquals(expect, test_double_input(input));
   assertEquals(expect, test_double_input(input));
   assertEquals(expect, test_double_input(input));
@@ -50,6 +52,7 @@
   var test_double_output = new Function(
       'n',
       '"' + (test_id++) + '";return Math.floor(n) + -0.0');
+  %PrepareFunctionForOptimization(test_double_output);
   assertEquals(expect, test_double_output(input));
   assertEquals(expect, test_double_output(input));
   assertEquals(expect, test_double_output(input));
@@ -59,6 +62,7 @@
   var test_via_ceil = new Function(
       'n',
       '"' + (test_id++) + '";return -Math.ceil(-n)');
+  %PrepareFunctionForOptimization(test_via_ceil);
   assertEquals(expect, test_via_ceil(input));
   assertEquals(expect, test_via_ceil(input));
   assertEquals(expect, test_via_ceil(input));
@@ -69,6 +73,7 @@
     var test_via_trunc = new Function(
         'n',
         '"' + (test_id++) + '";return Math.trunc(n)');
+    %PrepareFunctionForOptimization(test_via_trunc);
     assertEquals(expect, test_via_trunc(input));
     assertEquals(expect, test_via_trunc(input));
     assertEquals(expect, test_via_trunc(input));
@@ -88,6 +93,7 @@
   function ifloor(x) {
     return 1 / Math.floor(x);
   }
+  %PrepareFunctionForOptimization(ifloor);
   assertEquals(-Infinity, ifloor(-0));
   assertEquals(-Infinity, ifloor(-0));
   assertEquals(-Infinity, ifloor(-0));
diff --git a/src/v8/test/mjsunit/math-floor-part2.js b/src/v8/test/mjsunit/math-floor-part2.js
index 6589798..c404f6e 100644
--- a/src/v8/test/mjsunit/math-floor-part2.js
+++ b/src/v8/test/mjsunit/math-floor-part2.js
@@ -32,6 +32,7 @@
 function testFloor(expect, input) {
   var test = new Function('n',
                           '"' + (test_id++) + '";return Math.floor(n)');
+  %PrepareFunctionForOptimization(test);
   assertEquals(expect, test(input));
   assertEquals(expect, test(input));
   assertEquals(expect, test(input));
@@ -41,6 +42,7 @@
   var test_double_input = new Function(
       'n',
       '"' + (test_id++) + '";return Math.floor(+n)');
+  %PrepareFunctionForOptimization(test_double_input);
   assertEquals(expect, test_double_input(input));
   assertEquals(expect, test_double_input(input));
   assertEquals(expect, test_double_input(input));
@@ -50,6 +52,7 @@
   var test_double_output = new Function(
       'n',
       '"' + (test_id++) + '";return Math.floor(n) + -0.0');
+  %PrepareFunctionForOptimization(test_double_output);
   assertEquals(expect, test_double_output(input));
   assertEquals(expect, test_double_output(input));
   assertEquals(expect, test_double_output(input));
@@ -59,6 +62,7 @@
   var test_via_ceil = new Function(
       'n',
       '"' + (test_id++) + '";return -Math.ceil(-n)');
+  %PrepareFunctionForOptimization(test_via_ceil);
   assertEquals(expect, test_via_ceil(input));
   assertEquals(expect, test_via_ceil(input));
   assertEquals(expect, test_via_ceil(input));
@@ -69,6 +73,7 @@
     var test_via_trunc = new Function(
         'n',
         '"' + (test_id++) + '";return Math.trunc(n)');
+    %PrepareFunctionForOptimization(test_via_trunc);
     assertEquals(expect, test_via_trunc(input));
     assertEquals(expect, test_via_trunc(input));
     assertEquals(expect, test_via_trunc(input));
diff --git a/src/v8/test/mjsunit/math-floor-part3.js b/src/v8/test/mjsunit/math-floor-part3.js
index 4ce645e..c8a3727 100644
--- a/src/v8/test/mjsunit/math-floor-part3.js
+++ b/src/v8/test/mjsunit/math-floor-part3.js
@@ -32,6 +32,7 @@
 function testFloor(expect, input) {
   var test = new Function('n',
                           '"' + (test_id++) + '";return Math.floor(n)');
+  %PrepareFunctionForOptimization(test);
   assertEquals(expect, test(input));
   assertEquals(expect, test(input));
   assertEquals(expect, test(input));
@@ -41,6 +42,7 @@
   var test_double_input = new Function(
       'n',
       '"' + (test_id++) + '";return Math.floor(+n)');
+  %PrepareFunctionForOptimization(test_double_input);
   assertEquals(expect, test_double_input(input));
   assertEquals(expect, test_double_input(input));
   assertEquals(expect, test_double_input(input));
@@ -50,6 +52,7 @@
   var test_double_output = new Function(
       'n',
       '"' + (test_id++) + '";return Math.floor(n) + -0.0');
+  %PrepareFunctionForOptimization(test_double_output);
   assertEquals(expect, test_double_output(input));
   assertEquals(expect, test_double_output(input));
   assertEquals(expect, test_double_output(input));
@@ -59,6 +62,7 @@
   var test_via_ceil = new Function(
       'n',
       '"' + (test_id++) + '";return -Math.ceil(-n)');
+  %PrepareFunctionForOptimization(test_via_ceil);
   assertEquals(expect, test_via_ceil(input));
   assertEquals(expect, test_via_ceil(input));
   assertEquals(expect, test_via_ceil(input));
@@ -69,6 +73,7 @@
     var test_via_trunc = new Function(
         'n',
         '"' + (test_id++) + '";return Math.trunc(n)');
+    %PrepareFunctionForOptimization(test_via_trunc);
     assertEquals(expect, test_via_trunc(input));
     assertEquals(expect, test_via_trunc(input));
     assertEquals(expect, test_via_trunc(input));
diff --git a/src/v8/test/mjsunit/math-floor-part4.js b/src/v8/test/mjsunit/math-floor-part4.js
index 4992002..ebabb74 100644
--- a/src/v8/test/mjsunit/math-floor-part4.js
+++ b/src/v8/test/mjsunit/math-floor-part4.js
@@ -32,6 +32,7 @@
 function testFloor(expect, input) {
   var test = new Function('n',
                           '"' + (test_id++) + '";return Math.floor(n)');
+  %PrepareFunctionForOptimization(test);
   assertEquals(expect, test(input));
   assertEquals(expect, test(input));
   assertEquals(expect, test(input));
@@ -41,6 +42,7 @@
   var test_double_input = new Function(
       'n',
       '"' + (test_id++) + '";return Math.floor(+n)');
+  %PrepareFunctionForOptimization(test_double_input);
   assertEquals(expect, test_double_input(input));
   assertEquals(expect, test_double_input(input));
   assertEquals(expect, test_double_input(input));
@@ -50,6 +52,7 @@
   var test_double_output = new Function(
       'n',
       '"' + (test_id++) + '";return Math.floor(n) + -0.0');
+  %PrepareFunctionForOptimization(test_double_output);
   assertEquals(expect, test_double_output(input));
   assertEquals(expect, test_double_output(input));
   assertEquals(expect, test_double_output(input));
@@ -59,6 +62,7 @@
   var test_via_ceil = new Function(
       'n',
       '"' + (test_id++) + '";return -Math.ceil(-n)');
+  %PrepareFunctionForOptimization(test_via_ceil);
   assertEquals(expect, test_via_ceil(input));
   assertEquals(expect, test_via_ceil(input));
   assertEquals(expect, test_via_ceil(input));
@@ -69,6 +73,7 @@
     var test_via_trunc = new Function(
         'n',
         '"' + (test_id++) + '";return Math.trunc(n)');
+    %PrepareFunctionForOptimization(test_via_trunc);
     assertEquals(expect, test_via_trunc(input));
     assertEquals(expect, test_via_trunc(input));
     assertEquals(expect, test_via_trunc(input));
@@ -106,7 +111,8 @@
     ret += Math.floor(n);
   }
   return ret;
-}
+};
+%PrepareFunctionForOptimization(floorsum);
 assertEquals(-0, floorsum(1, -0));
 %OptimizeFunctionOnNextCall(floorsum);
 // The optimized function will deopt.  Run it with enough iterations to try
diff --git a/src/v8/test/mjsunit/math-imul.js b/src/v8/test/mjsunit/math-imul.js
index e05c000..db9baae 100644
--- a/src/v8/test/mjsunit/math-imul.js
+++ b/src/v8/test/mjsunit/math-imul.js
@@ -29,20 +29,26 @@
 
 var imul_func = Math.imul;
 function imul_polyfill(a, b) {
-  var ah  = (a >>> 16) & 0xffff;
+  var ah = a >>> 16 & 0xffff;
   var al = a & 0xffff;
-  var bh  = (b >>> 16) & 0xffff;
+  var bh = b >>> 16 & 0xffff;
   var bl = b & 0xffff;
-  return ((al * bl) + (((ah * bl + al * bh) << 16) >>> 0) | 0);
+  return al * bl + (ah * bl + al * bh << 16 >>> 0) | 0;
 }
 
 function TestMathImul(expected, a, b) {
-  function imul_meth_closure(a, b) { return Math.imul(a, b); }
-  function imul_func_closure(a, b) { return imul_func(a, b); }
+  function imul_meth_closure(a, b) {
+    return Math.imul(a, b);
+  };
+  %PrepareFunctionForOptimization(imul_meth_closure);
+  function imul_func_closure(a, b) {
+    return imul_func(a, b);
+  }
 
   // Test reference implementation.
+  ;
+  %PrepareFunctionForOptimization(imul_func_closure);
   assertEquals(expected, imul_polyfill(a, b));
-
   // Test direct method call.
   assertEquals(expected, Math.imul(a, b));
 
diff --git a/src/v8/test/mjsunit/math-min-max.js b/src/v8/test/mjsunit/math-min-max.js
index a4d1b27..b3e84be 100644
--- a/src/v8/test/mjsunit/math-min-max.js
+++ b/src/v8/test/mjsunit/math-min-max.js
@@ -117,6 +117,7 @@
 assertEquals(Infinity, 1/Math.max(-0, ZERO));
 
 function run(crankshaft_test) {
+  %PrepareFunctionForOptimization(crankshaft_test);
   crankshaft_test(1);
   crankshaft_test(1);
   %OptimizeFunctionOnNextCall(crankshaft_test);
@@ -184,6 +185,7 @@
   return Math.min(o.a, o.b);
 }
 
+%PrepareFunctionForOptimization(f);
 assertEquals(1, f(o));
 assertEquals(1, f(o));
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/math-pow.js b/src/v8/test/mjsunit/math-pow.js
index ffbf418..d347d53 100644
--- a/src/v8/test/mjsunit/math-pow.js
+++ b/src/v8/test/mjsunit/math-pow.js
@@ -167,6 +167,7 @@
       (-1*(Math.pow(2,52))*(Math.pow(2,-1074))) === -2.2250738585072014e-308);
 }
 
+%PrepareFunctionForOptimization(test);
 test();
 test();
 %OptimizeFunctionOnNextCall(test);
diff --git a/src/v8/test/mjsunit/math-round.js b/src/v8/test/mjsunit/math-round.js
index 12a9265..aeed206 100644
--- a/src/v8/test/mjsunit/math-round.js
+++ b/src/v8/test/mjsunit/math-round.js
@@ -33,6 +33,7 @@
   // sure it gets optimized each time.
   var doRound = new Function('input',
                              '"' + (test_id++) + '";return Math.round(input)');
+  %PrepareFunctionForOptimization(doRound);
   assertEquals(expect, doRound(input));
   assertEquals(expect, doRound(input));
   assertEquals(expect, doRound(input));
@@ -43,6 +44,7 @@
   // optimized code.
   var doRoundToDouble = new Function('input',
                                      '"' + (test_id++) + '";return Math.round(input) + -0.0');
+  %PrepareFunctionForOptimization(doRoundToDouble);
   assertEquals(expect, doRoundToDouble(input));
   assertEquals(expect, doRoundToDouble(input));
   assertEquals(expect, doRoundToDouble(input));
@@ -64,7 +66,8 @@
     ret += Math.round(n);
   }
   return ret;
-}
+};
+%PrepareFunctionForOptimization(roundsum);
 assertEquals(-0, roundsum(1, -0));
 %OptimizeFunctionOnNextCall(roundsum);
 // The optimized function will deopt.  Run it with enough iterations to try
diff --git a/src/v8/test/mjsunit/messages.js b/src/v8/test/mjsunit/messages.js
index 39d7b02..916a7d5 100644
--- a/src/v8/test/mjsunit/messages.js
+++ b/src/v8/test/mjsunit/messages.js
@@ -44,19 +44,18 @@
 }, "Function.prototype.apply was called on 1, which is a number " +
    "and not a function", TypeError);
 
-// kArrayFunctionsOnFrozen
 test(function() {
   var a = [1, 2];
   Object.freeze(a);
   a.splice(1, 1, [1]);
-}, "Cannot modify frozen array elements", TypeError);
+}, "Cannot assign to read only property '1' of object '[object Array]'",
+   TypeError);
 
-// kArrayFunctionsOnSealed
 test(function() {
   var a = [1];
   Object.seal(a);
   a.shift();
-}, "Cannot add/remove sealed array elements", TypeError);
+}, "Cannot delete property '0' of [object Array]", TypeError);
 
 // kCalledNonCallable
 test(function() {
@@ -127,13 +126,6 @@
   [].join(o);
 }, "Cannot convert object to primitive value", TypeError);
 
-// kCircularStructure
-test(function() {
-  var o = {};
-  o.o = o;
-  JSON.stringify(o);
-}, "Converting circular structure to JSON", TypeError);
-
 // kConstructorNotFunction
 test(function() {
   Map();
@@ -172,15 +164,15 @@
 for (constructor of typedArrayConstructors) {
   test(() => {
     const ta = new constructor([1]);
-    %ArrayBufferNeuter(ta.buffer);
+    %ArrayBufferDetach(ta.buffer);
     ta.find(() => {});
-  }, "Cannot perform %TypedArray%.prototype.find on a detached ArrayBuffer", TypeError);
+  }, "Cannot perform %TypedArray%.prototype.find on a neutered ArrayBuffer", TypeError);
 
   test(() => {
     const ta = new constructor([1]);
-    %ArrayBufferNeuter(ta.buffer);
+    %ArrayBufferDetach(ta.buffer);
     ta.findIndex(() => {});
-  }, "Cannot perform %TypedArray%.prototype.findIndex on a detached ArrayBuffer", TypeError);
+  }, "Cannot perform %TypedArray%.prototype.findIndex on a neutered ArrayBuffer", TypeError);
 }
 
 // kFirstArgumentNotRegExp
@@ -291,6 +283,20 @@
   new Map([1]);
 }, "Iterator value 1 is not an entry object", TypeError);
 
+test(function() {
+  let holeyDoubleArray = [, 123.123];
+  assertTrue(%HasDoubleElements(holeyDoubleArray));
+  assertTrue(%HasHoleyElements(holeyDoubleArray));
+  new Map(holeyDoubleArray);
+}, "Iterator value undefined is not an entry object", TypeError);
+
+test(function() {
+  let holeyDoubleArray = [, 123.123];
+  assertTrue(%HasDoubleElements(holeyDoubleArray));
+  assertTrue(%HasHoleyElements(holeyDoubleArray));
+  new WeakMap(holeyDoubleArray);
+}, "Iterator value undefined is not an entry object", TypeError);
+
 // kNotConstructor
 test(function() {
   new Symbol();
@@ -557,6 +563,10 @@
   "a".repeat(1 << 30);
 }, "Invalid string length", RangeError);
 
+test(function() {
+  new Array(1 << 30).join();
+}, "Invalid string length", RangeError);
+
 // kNormalizationForm
 test(function() {
   "".normalize("ABC");
diff --git a/src/v8/test/mjsunit/mjsunit.js b/src/v8/test/mjsunit/mjsunit.js
index 10cf527..8582b38 100644
--- a/src/v8/test/mjsunit/mjsunit.js
+++ b/src/v8/test/mjsunit/mjsunit.js
@@ -55,12 +55,18 @@
 // For known primitive values, please use assertEquals.
 var assertSame;
 
+// Inverse of assertSame.
+var assertNotSame;
+
 // Expected and found values are identical primitive values or functions
 // or similarly structured objects (checking internal properties
 // of, e.g., Number and Date objects, the elements of arrays
 // and the properties of non-Array objects).
 var assertEquals;
 
+// Deep equality predicate used by assertEquals.
+var deepEquals;
+
 // Expected and found values are not identical primitive values or functions
 // or similarly structured objects (checking internal properties
 // of, e.g., Number and Date objects, the elements of arrays
@@ -101,14 +107,21 @@
 // Assert that the passed function or eval code throws an exception.
 // The optional second argument is an exception constructor that the
 // thrown exception is checked against with "instanceof".
-// The optional third argument is a message type string that is compared
-// to the type property on the thrown exception.
+// The optional third argument is a message type string or RegExp object that is
+// compared to the message of the thrown exception.
 var assertThrows;
 
 // Assert that the passed function throws an exception.
 // The exception is checked against the second argument using assertEquals.
 var assertThrowsEquals;
 
+// Assert that the passed promise does not resolve, but eventually throws an
+// exception. The optional second argument is an exception constructor that the
+// thrown exception is checked against with "instanceof".
+// The optional third argument is a message type string or RegExp object that is
+// compared to the message of the thrown exception.
+var assertThrowsAsync;
+
 // Assert that the passed function or eval code does not throw an exception.
 var assertDoesNotThrow;
 
@@ -132,7 +145,15 @@
 // Assert that a string matches a given regex.
 var assertMatches;
 
-// Assert the result of a promise.
+// Assert that a promise resolves or rejects.
+// Parameters:
+// {promise} - the promise
+// {success} - optional - a callback which is called with the result of the
+//             resolving promise.
+//  {fail} -   optional - a callback which is called with the result of the
+//             rejecting promise. If the promise is rejected but no {fail}
+//             callback is set, the error is propagated out of the promise
+//             chain.
 var assertPromiseResult;
 
 var promiseTestChain;
@@ -152,8 +173,12 @@
   kOptimizingConcurrently: 1 << 9,
   kIsExecuting: 1 << 10,
   kTopmostFrameIsTurboFanned: 1 << 11,
+  kLiteMode: 1 << 12,
 };
 
+// Returns true if --lite-mode is on and we can't ever turn on optimization.
+var isNeverOptimizeLiteMode;
+
 // Returns true if --no-opt mode is on.
 var isNeverOptimize;
 
@@ -166,18 +191,17 @@
 // Returns true if given function is optimized.
 var isOptimized;
 
-// Returns true if given function is compiled by Crankshaft.
-var isCrankshafted;
-
 // Returns true if given function is compiled by TurboFan.
 var isTurboFanned;
 
-// Used for async tests. See definition below for more documentation.
-var testAsync;
-
 // Monkey-patchable all-purpose failure handler.
 var failWithMessage;
 
+// Returns the formatted failure text.  Used by test-async.js.
+var formatFailureText;
+
+// Returns a pretty-printed string representation of the passed value.
+var prettyPrinted;
 
 (function () {  // Scope for utility functions.
 
@@ -196,7 +220,7 @@
   // TODO(neis): Remove try-catch once BigInts are enabled by default.
   try {
     BigIntPrototypeValueOf = BigInt.prototype.valueOf;
-  } catch(e) {}
+  } catch (e) {}
 
   function classOf(object) {
     // Argument must not be null or undefined.
@@ -224,7 +248,7 @@
   }
 
 
-  function PrettyPrint(value) {
+  prettyPrinted = function prettyPrinted(value) {
     switch (typeof value) {
       case "string":
         return JSON.stringify(value);
@@ -247,11 +271,12 @@
           case "String":
           case "Boolean":
           case "Date":
-            return objectClass + "(" + PrettyPrint(ValueOf(value)) + ")";
+            return objectClass + "(" + prettyPrinted(ValueOf(value)) + ")";
           case "RegExp":
             return RegExpPrototypeToString.call(value);
           case "Array":
-            var mapped = ArrayPrototypeMap.call(value, PrettyPrintArrayElement);
+            var mapped = ArrayPrototypeMap.call(
+                value, prettyPrintedArrayElement);
             var joined = ArrayPrototypeJoin.call(mapped, ",");
             return "[" + joined + "]";
           case "Uint8Array":
@@ -267,7 +292,7 @@
           case "Object":
             break;
           default:
-            return objectClass + "()";
+            return objectClass + "(" + String(value) + ")";
         }
         // [[Class]] is "Object".
         var name = value.constructor.name;
@@ -279,9 +304,9 @@
   }
 
 
-  function PrettyPrintArrayElement(value, index, array) {
+  function prettyPrintedArrayElement(value, index, array) {
     if (value === undefined && !(index in array)) return "";
-    return PrettyPrint(value);
+    return prettyPrinted(value);
   }
 
 
@@ -289,14 +314,14 @@
     throw new MjsUnitAssertionError(message);
   }
 
-  function formatFailureText(expectedText, found, name_opt) {
+  formatFailureText = function(expectedText, found, name_opt) {
     var message = "Fail" + "ure";
     if (name_opt) {
       // Fix this when we ditch the old test runner.
       message += " (" + name_opt + ")";
     }
 
-    var foundText = PrettyPrint(found);
+    var foundText = prettyPrinted(found);
     if (expectedText.length <= 40 && foundText.length <= 40) {
       message += ": expected <" + expectedText + "> found <" + foundText + ">";
     } else {
@@ -327,7 +352,7 @@
   }
 
 
-  function deepEquals(a, b) {
+  deepEquals = function deepEquals(a, b) {
     if (a === b) {
       // Check for -0.
       if (a === 0) return (1 / a) === (1 / b);
@@ -365,26 +390,24 @@
   }
 
   assertSame = function assertSame(expected, found, name_opt) {
-    // TODO(mstarzinger): We should think about using Harmony's egal operator
-    // or the function equivalent Object.is() here.
-    if (found === expected) {
-      if (expected !== 0 || (1 / expected) === (1 / found)) return;
-    } else if ((expected !== expected) && (found !== found)) {
-      return;
-    }
-    fail(PrettyPrint(expected), found, name_opt);
+    if (Object.is(expected, found)) return;
+    fail(prettyPrinted(expected), found, name_opt);
   };
 
+  assertNotSame = function assertNotSame(expected, found, name_opt) {
+    if (!Object.is(expected, found)) return;
+    fail("not same as " + prettyPrinted(expected), found, name_opt);
+  }
 
   assertEquals = function assertEquals(expected, found, name_opt) {
     if (!deepEquals(found, expected)) {
-      fail(PrettyPrint(expected), found, name_opt);
+      fail(prettyPrinted(expected), found, name_opt);
     }
   };
 
   assertNotEquals = function assertNotEquals(expected, found, name_opt) {
     if (deepEquals(found, expected)) {
-      fail("not equals to " + PrettyPrint(expected), found, name_opt);
+      fail("not equals to " + prettyPrinted(expected), found, name_opt);
     }
   };
 
@@ -392,7 +415,7 @@
   assertEqualsDelta =
       function assertEqualsDelta(expected, found, delta, name_opt) {
     if (Math.abs(expected - found) > delta) {
-      fail(PrettyPrint(expected) + " +- " + PrettyPrint(delta), found, name_opt);
+      fail(prettyPrinted(expected) + " +- " + prettyPrinted(delta), found, name_opt);
     }
   };
 
@@ -452,45 +475,74 @@
     }
   };
 
+  function executeCode(code) {
+    if (typeof code === 'function')  return code();
+    if (typeof code === 'string') return eval(code);
+    failWithMessage(
+        'Given code is neither function nor string, but ' + (typeof code) +
+        ': <' + prettyPrinted(code) + '>');
+  }
+
+  function checkException(e, type_opt, cause_opt) {
+    if (type_opt !== undefined) {
+      assertEquals('function', typeof type_opt);
+      assertInstanceof(e, type_opt);
+    }
+    if (RegExp !== undefined && cause_opt instanceof RegExp) {
+      assertMatches(cause_opt, e.message, 'Error message');
+    } else if (cause_opt !== undefined) {
+      assertEquals(cause_opt, e.message, 'Error message');
+    }
+  }
 
   assertThrows = function assertThrows(code, type_opt, cause_opt) {
+    if (arguments.length > 1 && type_opt === undefined) {
+      failWithMessage('invalid use of assertThrows, unknown type_opt given');
+    }
+    if (type_opt !== undefined && typeof type_opt !== 'function') {
+      failWithMessage(
+          'invalid use of assertThrows, maybe you want assertThrowsEquals');
+    }
     try {
-      if (typeof code === 'function') {
-        code();
-      } else {
-        eval(code);
-      }
+      executeCode(code);
     } catch (e) {
-      if (typeof type_opt === 'function') {
-        assertInstanceof(e, type_opt);
-      } else if (type_opt !== void 0) {
-        failWithMessage(
-            'invalid use of assertThrows, maybe you want assertThrowsEquals');
-      }
-      if (arguments.length >= 3) {
-        if (cause_opt instanceof RegExp) {
-          assertMatches(cause_opt, e.message, "Error message");
-        } else {
-          assertEquals(cause_opt, e.message, "Error message");
-        }
-      }
-      // Success.
+      checkException(e, type_opt, cause_opt);
       return;
     }
-    failWithMessage("Did not throw exception");
+    let msg = 'Did not throw exception';
+    if (type_opt !== undefined && type_opt.name !== undefined)
+      msg += ', expected ' + type_opt.name;
+    failWithMessage(msg);
   };
 
-
   assertThrowsEquals = function assertThrowsEquals(fun, val) {
     try {
       fun();
-    } catch(e) {
-      assertEquals(val, e);
+    } catch (e) {
+      assertSame(val, e);
       return;
     }
-    failWithMessage("Did not throw exception");
+    failWithMessage('Did not throw exception, expected ' + prettyPrinted(val));
   };
 
+  assertThrowsAsync = function assertThrowsAsync(promise, type_opt, cause_opt) {
+    if (arguments.length > 1 && type_opt === undefined) {
+      failWithMessage('invalid use of assertThrows, unknown type_opt given');
+    }
+    if (type_opt !== undefined && typeof type_opt !== 'function') {
+      failWithMessage(
+          'invalid use of assertThrows, maybe you want assertThrowsEquals');
+    }
+    let msg = 'Promise did not throw exception';
+    if (type_opt !== undefined && type_opt.name !== undefined)
+      msg += ', expected ' + type_opt.name;
+    return assertPromiseResult(
+        promise,
+        // Use setTimeout to throw the error again to get out of the promise
+        // chain.
+        res => setTimeout(_ => fail('<throw>', res, msg), 0),
+        e => checkException(e, type_opt, cause_opt));
+  };
 
   assertInstanceof = function assertInstanceof(obj, type) {
     if (!(obj instanceof type)) {
@@ -499,21 +551,17 @@
       if (typeof actualConstructor === "function") {
         actualTypeName = actualConstructor.name || String(actualConstructor);
       }
-      failWithMessage("Object <" + PrettyPrint(obj) + "> is not an instance of <" +
+      failWithMessage("Object <" + prettyPrinted(obj) + "> is not an instance of <" +
                (type.name || type) + ">" +
                (actualTypeName ? " but of <" + actualTypeName + ">" : ""));
     }
   };
 
-
-   assertDoesNotThrow = function assertDoesNotThrow(code, name_opt) {
+  assertDoesNotThrow = function assertDoesNotThrow(code, name_opt) {
     try {
-      if (typeof code === 'function') {
-        return code();
-      } else {
-        return eval(code);
-      }
+      executeCode(code);
     } catch (e) {
+      if (e instanceof MjsUnitAssertionError) throw e;
       failWithMessage("threw an exception: " + (e.message || e));
     }
   };
@@ -542,35 +590,50 @@
     }
   };
 
-  assertPromiseResult = function(promise, success, fail) {
-    // Use --allow-natives-syntax to use this function. Note that this function
-    // overwrites {failWithMessage} permanently with %AbortJS.
+  function concatenateErrors(stack, exception) {
+    // If the exception does not contain a stack trace, wrap it in a new Error.
+    if (!exception.stack) exception = new Error(exception);
 
-    // We have to patch mjsunit because normal assertion failures just throw
-    // exceptions which are swallowed in a then clause.
-    // We use eval here to avoid parsing issues with the natives syntax.
-    if (!success) success = () => {};
-
-    failWithMessage = (msg) => eval("%AbortJS(msg)");
-    if (!fail) {
-      fail = result => failWithMessage("assertPromiseResult failed: " + result);
+    // If the exception already provides a special stack trace, we do not modify
+    // it.
+    if (typeof exception.stack !== 'string') {
+      return exception;
     }
+    exception.stack = stack + '\n\n' + exception.stack;
+    return exception;
+  }
 
-    var test_promise =
-        promise.then(
-          result => {
-            try {
-              success(result);
-            } catch (e) {
-              failWithMessage(String(e));
-            }
-          },
-          result => {
-            fail(result);
+  assertPromiseResult = function(promise, success, fail) {
+    if (success !== undefined) assertEquals('function', typeof success);
+    if (fail !== undefined) assertEquals('function', typeof fail);
+    assertInstanceof(promise, Promise);
+    const stack = (new Error()).stack;
+
+    var test_promise = promise.then(
+        result => {
+          try {
+            if (--promiseTestCount == 0) testRunner.notifyDone();
+            if (success !== undefined) success(result);
+          } catch (e) {
+            // Use setTimeout to throw the error again to get out of the promise
+            // chain.
+            setTimeout(_ => {
+              throw concatenateErrors(stack, e);
+            }, 0);
           }
-        )
-        .then((x)=> {
-          if (--promiseTestCount == 0) testRunner.notifyDone();
+        },
+        result => {
+          try {
+            if (--promiseTestCount == 0) testRunner.notifyDone();
+            if (fail === undefined) throw result;
+            fail(result);
+          } catch (e) {
+            // Use setTimeout to throw the error again to get out of the promise
+            // chain.
+            setTimeout(_ => {
+              throw concatenateErrors(stack, e);
+            }, 0);
+          }
         });
 
     if (!promiseTestChain) promiseTestChain = Promise.resolve();
@@ -617,11 +680,19 @@
       fun, sync_opt, name_opt, skip_if_maybe_deopted = true) {
     if (sync_opt === undefined) sync_opt = "";
     var opt_status = OptimizationStatus(fun, sync_opt);
+    // Tests that use assertOptimized() do not make sense for Lite mode where
+    // optimization is always disabled, explicitly exit the test with a warning.
+    if (opt_status & V8OptimizationStatus.kLiteMode) {
+      print("Warning: Test uses assertOptimized in Lite mode, skipping test.");
+      testRunner.quit(0);
+    }
     // Tests that use assertOptimized() do not make sense if --no-opt
     // option is provided. Such tests must add --opt to flags comment.
     assertFalse((opt_status & V8OptimizationStatus.kNeverOptimize) !== 0,
                 "test does not make sense with --no-opt");
-    assertTrue((opt_status & V8OptimizationStatus.kIsFunction) !== 0, name_opt);
+    assertTrue(
+        (opt_status & V8OptimizationStatus.kIsFunction) !== 0,
+        'should be a function: ' + name_opt);
     if (skip_if_maybe_deopted &&
         (opt_status & V8OptimizationStatus.kMaybeDeopted) !== 0) {
       // When --deopt-every-n-times flag is specified it's no longer guaranteed
@@ -629,7 +700,14 @@
       // to stress test the deoptimizer.
       return;
     }
-    assertTrue((opt_status & V8OptimizationStatus.kOptimized) !== 0, name_opt);
+    assertTrue(
+        (opt_status & V8OptimizationStatus.kOptimized) !== 0,
+        'should be optimized: ' + name_opt);
+  }
+
+  isNeverOptimizeLiteMode = function isNeverOptimizeLiteMode() {
+    var opt_status = OptimizationStatus(undefined, "");
+    return (opt_status & V8OptimizationStatus.kLiteMode) !== 0;
   }
 
   isNeverOptimize = function isNeverOptimize() {
@@ -657,14 +735,6 @@
     return (opt_status & V8OptimizationStatus.kOptimized) !== 0;
   }
 
-  isCrankshafted = function isCrankshafted(fun) {
-    var opt_status = OptimizationStatus(fun, "");
-    assertTrue((opt_status & V8OptimizationStatus.kIsFunction) !== 0,
-               "not a function");
-    return (opt_status & V8OptimizationStatus.kOptimized) !== 0 &&
-           (opt_status & V8OptimizationStatus.kTurboFanned) === 0;
-  }
-
   isTurboFanned = function isTurboFanned(fun) {
     var opt_status = OptimizationStatus(fun, "");
     assertTrue((opt_status & V8OptimizationStatus.kIsFunction) !== 0,
@@ -729,114 +799,7 @@
         return frame;
       });
       return "" + error.message + "\n" + ArrayPrototypeJoin.call(stack, "\n");
-    } catch(e) {};
+    } catch (e) {};
     return error.stack;
   }
-
-  /**
-   * This is to be used through the testAsync helper function defined
-   * below.
-   *
-   * This requires the --allow-natives-syntax flag to allow calling
-   * runtime functions.
-   *
-   * There must be at least one assertion in an async test. A test
-   * with no assertions will fail.
-   *
-   * @example
-   * testAsync(assert => {
-   *   assert.plan(1) // There should be one assertion in this test.
-   *   Promise.resolve(1)
-   *    .then(val => assert.equals(1, val),
-   *          assert.unreachable);
-   * })
-   */
-  class AsyncAssertion {
-    constructor(test, name) {
-      this.expectedAsserts_ = -1;
-      this.actualAsserts_ = 0;
-      this.test_ = test;
-      this.name_ = name || '';
-    }
-
-    /**
-     * Sets the number of expected asserts in the test. The test fails
-     * if the number of asserts computed after running the test is not
-     * equal to this specified value.
-     * @param {number} expectedAsserts
-     */
-    plan(expectedAsserts) {
-      this.expectedAsserts_ = expectedAsserts;
-    }
-
-    fail(expectedText, found) {
-      let message = formatFailureText(expectedText, found);
-      message += "\nin test:" + this.name_
-      message += "\n" + Function.prototype.toString.apply(this.test_);
-      eval("%AbortJS(message)");
-    }
-
-    equals(expected, found, name_opt) {
-      this.actualAsserts_++;
-      if (!deepEquals(expected, found)) {
-        this.fail(PrettyPrint(expected), found, name_opt);
-      }
-    }
-
-    unreachable() {
-      let message = "Failure: unreachable in test: " + this.name_;
-      message += "\n" + Function.prototype.toString.apply(this.test_);
-      eval("%AbortJS(message)");
-    }
-
-    unexpectedRejection(details) {
-      return (error) => {
-        let message =
-            "Failure: unexpected Promise rejection in test: " + this.name_;
-        if (details) message += "\n    @" + details;
-        if (error instanceof Error) {
-          message += "\n" + String(error.stack);
-        } else {
-          message += "\n" + String(error);
-        }
-        message += "\n\n" + Function.prototype.toString.apply(this.test_);
-        eval("%AbortJS(message)");
-      };
-    }
-
-    drainMicrotasks() {
-      eval("%RunMicrotasks()");
-    }
-
-    done_() {
-      if (this.expectedAsserts_ === -1) {
-        let message = "Please call t.plan(count) to initialize test harness " +
-            "with correct assert count (Note: count > 0)";
-        eval("%AbortJS(message)");
-      }
-
-      if (this.expectedAsserts_ !== this.actualAsserts_) {
-        let message = "Expected asserts: " + this.expectedAsserts_;
-        message += ", Actual asserts: " + this.actualAsserts_;
-        message += "\nin test: " + this.name_;
-        message += "\n" + Function.prototype.toString.apply(this.test_);
-        eval("%AbortJS(message)");
-      }
-    }
-  }
-
-  /** This is used to test async functions and promises.
-   * @param {testCallback} test - test function
-   * @param {string} [name] - optional name of the test
-   *
-   *
-   * @callback testCallback
-   * @param {AsyncAssertion} assert
-   */
-  testAsync = function(test, name) {
-    let assert = new AsyncAssertion(test, name);
-    test(assert);
-    eval("%RunMicrotasks()");
-    assert.done_();
-  }
 })();
diff --git a/src/v8/test/mjsunit/mjsunit.status b/src/v8/test/mjsunit/mjsunit.status
index d91ff6f..bdcf3cf 100644
--- a/src/v8/test/mjsunit/mjsunit.status
+++ b/src/v8/test/mjsunit/mjsunit.status
@@ -32,6 +32,8 @@
   'modules-skip*': [SKIP],
   'harmony/modules-skip*': [SKIP],
   'regress/modules-skip*': [SKIP],
+  'wasm/exceptions-utils': [SKIP],
+  'wasm/wasm-module-builder': [SKIP],
 
   # All tests in the bug directory are expected to fail.
   'bugs/*': [FAIL],
@@ -52,8 +54,11 @@
   # Issue 3784: setters-on-elements is flaky
   'setters-on-elements': [PASS, FAIL],
 
-  # Issue 5495: enable the test when the constant field tracking in enabled.
-  'const-field-tracking': [SKIP],
+  # Issue 8505: Math.pow is incorrect for asm.js
+  'regress/wasm/regress-8505': [SKIP],
+
+  # Issue 9380: Memory leaks of shared WebAssembly.Memory objects
+  'wasm/shared-memory-worker-gc': [SKIP],
 
   ##############################################################################
   # Too slow in debug mode with --stress-opt mode.
@@ -72,6 +77,13 @@
   # Too slow in debug mode and under turbofan.
   'regress/regress-4595': [PASS, NO_VARIANTS, ['mode == debug', SKIP]],
 
+  # Too slow in debug mode, due to large allocations.
+  'regress/regress-crbug-941743': [PASS, ['mode == debug', SKIP], ['(arch == arm or arch == arm64 or arch == mipsel or arch == mips64el) and simulator_run == True', SKIP]],
+
+  # Too slow in debug mode BUG(v8:9506): times out.
+  'wasm/shared-memory-worker-explicit-gc-stress': [PASS, ['mode == debug', SKIP], ['tsan', SKIP]],
+  'wasm/shared-memory-worker-gc-stress': [PASS, ['mode == debug', SKIP]],
+
   ##############################################################################
   # Only RegExp stuff tested, no need for extensive optimizing compiler tests.
   'regexp-global': [PASS, NO_VARIANTS],
@@ -84,10 +96,10 @@
 
   # Issue 488: this test sometimes times out.
   # TODO(arm): This seems to flush out a bug on arm with simulator.
-  'array-constructor': [PASS, SLOW, ['arch == arm and simulator == True', SKIP]],
+  'array-constructor': [PASS, SLOW, ['arch == arm and simulator_run == True', SKIP]],
 
   # Very slow test
-  'regress/regress-crbug-808192' : [PASS, NO_VARIANTS, ['arch == arm or arch == arm64 or arch == android_arm or arch == android_arm64 or arch == mipsel or arch == mips64el or arch == mips64 or arch == mips', SKIP]],
+  'regress/regress-crbug-808192' : [PASS, SLOW, NO_VARIANTS, ['mode == debug or arch == arm or arch == arm64 or arch == android_arm or arch == android_arm64 or arch == mipsel or arch == mips64el or arch == mips64 or arch == mips or arch == s390 or arch == s390x or arch == ppc or arch == ppc64', SKIP]],
 
   # Very slow on ARM and MIPS, contains no architecture dependent code.
   'unicode-case-overoptimization': [PASS, NO_VARIANTS, ['arch == arm or arch == arm64 or arch == android_arm or arch == android_arm64 or arch == mipsel or arch == mips64el or arch == mips64 or arch == mips', SKIP]],
@@ -104,6 +116,10 @@
   'generated-transition-stub': [PASS, ['mode == debug', SKIP]],
   'migrations': [SKIP],
   'array-functions-prototype-misc': [PASS, SLOW, ['mode == debug', SKIP]],
+  'compiler/regress-9017': [PASS, SLOW],
+  'compiler/regress-808472': [PASS, ['mode == debug', SKIP]],
+  'es6/promise-all-overflow-1': [SKIP],
+  'es6/promise-all-overflow-2': [PASS, SLOW, ['mode == debug or arch != x64', SKIP]],
 
   ##############################################################################
   # This test sets the umask on a per-process basis and hence cannot be
@@ -118,10 +134,11 @@
   'tools/dumpcpp': [PASS, NO_VARIANTS, ['arch == android_arm or arch == android_arm64 or arch == android_ia32', SKIP]],
 
   ##############################################################################
-  # This test generates a file in the test directory, so we cannot run several
-  # variants of the test simultaneously. Additionally the test should not be
-  # affected by variants.
+  # These tests generate files in the test directory, so we cannot run several
+  # variants of them simultaneously. Additionally they should not be affected by
+  # variants.
   'd8/enable-tracing': [PASS, NO_VARIANTS],
+  'tools/compiler-trace-flags': [PASS, NO_VARIANTS],
 
   ##############################################################################
   # Long running test that reproduces memory leak and should be run manually.
@@ -130,7 +147,7 @@
   ##############################################################################
   # Tests verifying CHECK and ASSERT.
   'verify-check-false': [FAIL, NO_VARIANTS],
-  'verify-assert-false': [NO_VARIANTS, ['mode == release and dcheck_always_on == False', PASS], ['mode == debug or dcheck_always_on == True', FAIL]],
+  'verify-assert-false': [NO_VARIANTS, ['mode == release and dcheck_always_on == False', PASS], ['mode == debug', FAIL]],
 
   ##############################################################################
   # Tests with different versions for release and debug.
@@ -139,7 +156,7 @@
   'regress/regress-634-debug': [PASS, ['mode == release', SKIP]],
 
   # BUG(v8:2989).
-  'regress/regress-2989': [FAIL, NO_VARIANTS],
+  'regress/regress-2989': [FAIL, NO_VARIANTS, ['lite_mode == True', SKIP]],
 
   # This test variant makes only sense on arm.
   'math-floor-of-div-nosudiv': [PASS, SLOW, ['arch not in [arm, arm64, android_arm, android_arm64]', SKIP]],
@@ -149,19 +166,33 @@
   'asm/poppler/*': [PASS, SLOW, NO_VARIANTS],
   'asm/sqlite3/*': [PASS, SLOW, NO_VARIANTS],
 
+  # OOM flakes in isolates tests because too many largish heaps are created.
+  'asm/asm-heap': [PASS, NO_VARIANTS, ['isolates', SKIP]],
+
   # Slow tests.
   'copy-on-write-assert': [PASS, SLOW],
   'es6/typedarray-construct-offset-not-smi': [PASS, SLOW],
+  'harmony/futex': [PASS, SLOW],
   'harmony/regexp-property-script-extensions': [PASS, SLOW],
+  'ignition/regress-672027': [PASS, SLOW],
+  'md5': [PASS, SLOW],
   'numops-fuzz-part*': [PASS, ['mode == debug', SLOW]],
   'readonly': [PASS, SLOW],
   'regress/regress-1122': [PASS, SLOW],
   'regress/regress-605470': [PASS, SLOW],
   'regress/regress-655573': [PASS, SLOW],
   'regress/regress-1200351': [PASS, SLOW],
-  'regress/regress-crbug-474297': [PASS, ['gc_stress == False', SKIP]],
+  'regress/wasm/regress-810973': [PASS, SLOW],
+  'string-replace-gc': [PASS, SLOW],
+  'wasm/asm-wasm-f32': [PASS, SLOW],
+  'wasm/asm-wasm-f64': [PASS, SLOW],
   'wasm/embenchen/*': [PASS, SLOW],
+  'wasm/grow-memory': [PASS, SLOW],
   'wasm/unreachable-validation': [PASS, SLOW],
+  'wasm/atomics-stress': [PASS, SLOW, NO_VARIANTS, ['mode != release or dcheck_always_on', SKIP], ['(arch == arm or arch == arm64) and simulator_run', SKIP], ['tsan', SKIP]],
+  'wasm/atomics64-stress': [PASS, SLOW, NO_VARIANTS, ['mode != release or dcheck_always_on', SKIP], ['(arch == arm or arch == arm64) and simulator_run', SKIP], ['tsan', SKIP]],
+  'wasm/compare-exchange-stress': [PASS, SLOW, NO_VARIANTS],
+  'wasm/compare-exchange64-stress': [PASS, SLOW, NO_VARIANTS],
 
   # case-insensitive unicode regexp relies on case mapping provided by ICU.
   'es6/unicode-regexp-ignore-case': [PASS, ['no_i18n == True', FAIL]],
@@ -180,6 +211,11 @@
   # noi18n cannot turn on ICU backend for Date
   'icu-date-to-string': [PASS, ['no_i18n == True', SKIP]],
   'icu-date-lord-howe': [PASS, ['no_i18n == True', SKIP]],
+  'tzoffset-transition-apia': [PASS, ['no_i18n == True', SKIP]],
+  'tzoffset-transition-lord-howe': [PASS, ['no_i18n == True', SKIP]],
+  'tzoffset-transition-moscow': [PASS, ['no_i18n == True', SKIP]],
+  'tzoffset-transition-new-york': [PASS, ['no_i18n == True', SKIP]],
+  'tzoffset-seoul': [PASS, ['no_i18n == True', SKIP]],
 
   # TODO(bmeurer): Flaky timeouts (sometimes <1s, sometimes >3m).
   'unicodelctest': [PASS, NO_VARIANTS],
@@ -189,11 +225,33 @@
   #                  which makes the test useless.
   'big-object-literal': [PASS, ['mode == debug', SKIP]],
 
+  # Runs out of stack space in debug builds.
+  'big-array-literal': [PASS, ['mode == debug', SKIP]],
+
   # BUG(v8:6306).
   'wasm/huge-memory': [SKIP],
 
   # Allocates a huge string and then flattens it, very slow in debug mode.
   'regress/regress-752764': [PASS, ['mode == debug', SLOW]],
+
+  # https://crbug.com/v8/7697
+  'array-literal-feedback': [PASS, FAIL],
+
+  # https://crbug.com/v8/7775
+  'allocation-site-info': [SKIP],
+
+  # BUG(v8:8169)
+  'external-backing-store-gc': [SKIP],
+
+  # Test is only enabled on ASAN. Takes too long on many other bots.
+  'regress/regress-crbug-9161': [SKIP],
+
+  # BUG(v8:9260)
+  'tools/profviz': [SKIP],
+
+  # Test doesn't work on 32-bit architectures (it would require a
+  # regexp pattern with too many captures).
+  'regress/regress-976627': [FAIL, ['arch == x64 or arch == arm64 or arch == mips64el or arch == ppc64 or arch == s390x', PASS]],
 }],  # ALWAYS
 
 ['novfp3 == True', {
@@ -227,10 +285,11 @@
   'osr-elements-kind': [SKIP],
   'regress/regress-crbug-137689': [SKIP],
   'regress/regress-trap-allocation-memento': [SKIP],
-  'regress/regress-165637': [SKIP],
   'regress/regress-2249': [SKIP],
   'regress/regress-4121': [SKIP],
+  'regress/regress-6989': [SKIP],
   'compare-known-objects-slow': [SKIP],
+  'compiler/array-multiple-receiver-maps': [SKIP],
   # Tests taking too long
   'packed-elements': [SKIP],
   'regress/regress-1122': [SKIP],
@@ -242,6 +301,10 @@
   'unicode-test': [SKIP],
   'whitespaces': [SKIP],
 
+  # Unsuitable for GC stress because coverage information is lost on GC.
+  'code-coverage-ad-hoc': [SKIP],
+  'code-coverage-precise': [SKIP],
+
   # TODO(mstarzinger): Takes too long with TF.
   'array-sort': [PASS, NO_VARIANTS],
   'regress/regress-91008': [PASS, NO_VARIANTS],
@@ -263,21 +326,89 @@
   # Slow tests.
   'array-constructor': [PASS, SLOW],
   'json': [PASS, SLOW],
-  'regress/regress-446389': [PASS, SLOW],
-  'regress/regress-inline-getter-near-stack-limit': [PASS, SLOW],
+  'large-object-literal-slow-elements': [PASS, SLOW],
 
   # BUG(v8:4779): Crashes flakily with stress mode on arm64.
   'array-splice': [PASS, SLOW, ['arch == arm64', NO_VARIANTS]],
 
-  # BUG(chromium:751825): Crashes flakily.
-  'wasm/js-api': [SKIP],
-
-  # BUG(chromium:773631): Crashes flakily.
-  'wasm/streaming-trap-location': [SKIP],
-
+  # BUG(v8:7880): Slow tests.
+  'regress/regress-707066': [SKIP],
+  'regress/regress-446389': [SKIP],
+  'regress/regress-458987': [SKIP],
+  'es6/regress/regress-crbug-465671': [SKIP],
+  'regress/regress-inline-getter-near-stack-limit': [SKIP],
+  'es6/regress/regress-crbug-465671-null': [SKIP],
+  'regress/regress-148378': [SKIP],
+  'regress/regress-crbug-762472': [SKIP],
 }],  # 'gc_stress == True'
 
 ##############################################################################
+['lite_mode or variant == jitless', {
+  # Skip tests not suitable for lite_mode.
+
+  # TODO(v8:7777): Re-enable once wasm is supported in jitless mode.
+  'regress/regress-5888': [SKIP],
+  'regress/regress-5911': [SKIP],
+  'regress/regress-813440': [SKIP],
+  'regress/regress-crbug-746835': [SKIP],
+  'regress/regress-crbug-772056': [SKIP],
+  'regress/regress-crbug-816961': [SKIP],
+  'regress/regress-crbug-969498': [SKIP],
+  'regress/wasm/*': [SKIP],
+  'regress/regress-8947': [SKIP],
+  'regress/regress-9165': [SKIP],
+  'regress/regress-v8-9106': [SKIP],
+  'wasm/*': [SKIP],
+
+  # Other tests that use asm / wasm / optimized code.
+  'asm/asm-heap': [SKIP],
+  'asm/asm-validation': [SKIP],
+  'asm/call-stdlib': [SKIP],
+  'asm/call-annotation': [SKIP],
+  'asm/global-imports': [SKIP],
+  'asm/regress-913822': [SKIP],
+  'asm/regress-937650': [SKIP],
+  'asm/regress-9531': [SKIP],
+  'asm/return-types': [SKIP],
+  'regress/regress-599719': [SKIP],
+  'regress/regress-6196': [SKIP],
+  'regress/regress-6700': [SKIP],
+  'regress/regress-6838-2': [SKIP],
+  'regress/regress-6838-3': [SKIP],
+  'regress/regress-9022': [SKIP],
+  'regress/regress-crbug-934138': [SKIP],
+  'regress/regress-crbug-976934': [SKIP],
+
+  # Timeouts in lite / jitless mode.
+  'asm/embenchen/*': [SKIP],
+
+  # Tests that generate code at runtime.
+  'code-comments': [SKIP],
+  'regress/regress-617526': [SKIP],
+  'regress/regress-7893': [SKIP],
+  'regress/regress-8377': [SKIP],
+  'regress/regress-863810': [SKIP],
+  'regress/regress-crbug-721835': [SKIP],
+  'regress/regress-crbug-759327': [SKIP],
+  'regress/regress-crbug-898974': [SKIP],
+
+  # These tests check that we can trace the compiler.
+  'tools/compiler-trace-flags': [SKIP],
+  'tools/compiler-trace-flags-wasm': [SKIP],
+
+  # Slow with pointer compression.
+  'regress/regress-crbug-319860': [PASS, ['pointer_compression', SLOW]],
+}],  # 'lite_mode or variant == jitless'
+
+##############################################################################
+['is_full_debug', {
+  # Tests too slow in non-optimized debug mode.
+  'compiler/regress-9017': [SKIP],
+  'regress/regress-2790': [SKIP],
+  'regress/regress-740784': [SKIP],
+}],  # 'is_full_debug'
+
+##############################################################################
 ['byteorder == big', {
   # Emscripten requires little-endian, skip all tests on big endian platforms.
   'asm/embenchen/*': [SKIP],
@@ -320,6 +451,12 @@
   # BUG(v8:4016)
   'regress/regress-crbug-467047': [SKIP],
 
+  # OOMing tests
+  'regress/regress-500980': [SKIP],
+
+  # BUG(v8:9337).
+  'compiler/regress-9017': [SKIP],
+
   # Slow tests.
   'array-concat': [PASS, SLOW],
   'array-indexing': [PASS, SLOW],
@@ -328,7 +465,6 @@
   'array-splice': [PASS, SLOW],
   'bit-not': [PASS, SLOW],
   'compiler/alloc-number': [PASS, SLOW],
-  'compiler/osr-assert': [PASS, SLOW],
   'compiler/osr-with-args': [PASS, SLOW],
   'generated-transition-stub': [PASS, SLOW],
   'json2': [PASS, SLOW],
@@ -336,8 +472,6 @@
   'math-floor-of-div': [PASS, SLOW],
   'messages': [PASS, SLOW],
   'packed-elements': [PASS, SLOW],
-  'regress/regress-2185-2': [PASS, SLOW],
-  'regress/regress-2185': [PASS, SLOW],
   'regress/regress-2790': [PASS, SLOW],
   'regress/regress-331444': [PASS, SLOW],
   'regress/regress-490': [PASS, SLOW],
@@ -353,6 +487,9 @@
 
   # BUG(v8:7247).
   'regress/regress-779407': [PASS, SLOW, NO_VARIANTS],
+
+  # BUG(v8:9256). Slow with pointer compression.
+  'regress/regress-708247': [PASS, ['pointer_compression', SLOW]],
 }],  # 'arch == arm64'
 
 ['arch == arm64 and mode == debug and simulator_run', {
@@ -367,8 +504,6 @@
   'unicodelctest-no-optimization': [PASS, SLOW],
   # Issue 3219:
   'getters-on-elements': [PASS, ['gc_stress == True', FAIL]],
-  # Expects to finish in a certain time, but sometimes doesn't.
-  'regress/regress-165637': [SKIP],
 }],  # 'arch == arm64 and mode == debug and simulator_run'
 
 ##############################################################################
@@ -395,6 +530,9 @@
   # https://bugs.chromium.org/p/v8/issues/detail?id=7102
   # Flaky due to huge string allocation.
   'regress/regress-748069': [SKIP],
+
+  # Test is tailored for ASAN. Takes too long on many other bots.
+  'regress/regress-crbug-9161': [PASS, SLOW],
 }],  # 'asan == True'
 
 ##############################################################################
@@ -408,21 +546,16 @@
   'string-localecompare': [SKIP],
 
   # Too slow.
+  'asm/embenchen/zlib': [SKIP],
   'harmony/regexp-property-lu-ui': [SKIP],
-
-  # Flaky with baseline?
-  'regress/regress-2185-2': [SKIP],
-
-  # Slow tests with --noopt.
-  'compiler/osr-one': [PASS, SLOW],
-  'compiler/osr-two': [PASS, SLOW],
-  'wasm/grow-memory': [PASS, SLOW],
+  'regress/regress-779407': [SKIP],
+  'wasm/embenchen/box2d': [SKIP],
+  'wasm/embenchen/lua_binarytrees': [SKIP],
+  'wasm/embenchen/zlib': [SKIP],
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=7102
   # Flaky due to huge string allocation.
   'regress/regress-748069': [SKIP],
-  # Slow test.
-  'regress/regress-779407': [PASS, SLOW],
 }],  # 'msan == True'
 
 ##############################################################################
@@ -437,10 +570,28 @@
   # BUG(v8:7042). Uses a lot of memory.
   'regress/regress-678917': [SKIP],
 
+  # BUG(v8:8103). Uses a lot of memory.
+  'regress/regress-852258': [SKIP],
+
   # BUG(v8:6924). The test uses a lot of memory.
   'regress/wasm/regress-694433': [SKIP],
   'es6/typedarray': [PASS, NO_VARIANTS],
-  'regress/regress-752764': [PASS, NO_VARIANTS],
+  'regress/regress-752764': [PASS, SLOW, NO_VARIANTS],
+
+  # BUG(v8:9242). Uses a lot of memory.
+  'regress/regress-599414-array-concat-fast-path': [PASS, SLOW],
+
+  # BUG(v8:9026). Flaky timeouts.
+  'es6/large-classes-properties': [SKIP],
+
+  # Slow tests.
+  'compiler/regress-9017': [PASS, SLOW],
+  'es6/block-conflicts-sloppy': [PASS, SLOW],
+  'math-floor-part1': [PASS, SLOW],
+  'regress/regress-500980': [PASS, SLOW],
+
+  # BUG(v8:9506): times out.
+  'wasm/shared-memory-worker-explicit-gc-stress': [SKIP],
 }],  # 'tsan == True'
 
 ##############################################################################
@@ -474,11 +625,13 @@
   # Currently always deopt on minus zero
   'math-floor-of-div-minus-zero': [SKIP],
 
+  # BUG(v8:9337).
+  'compiler/regress-9017': [SKIP],
+
   # Slow tests.
   'array-sort': [PASS, SLOW],
   'compiler/osr-with-args': [PASS, SLOW],
   'packed-elements': [PASS, SLOW],
-  'regress/regress-2185-2': [PASS, SLOW],
   'regress/regress-2790': [PASS, SLOW],
   'regress/regress-91008': [PASS, SLOW],
   'regress/regress-json-stringify-gc': [PASS, SLOW],
@@ -536,6 +689,11 @@
   # Requires too much memory on MIPS.
   'regress/regress-752764': [SKIP],
   'regress/regress-779407': [SKIP],
+  'harmony/bigint/regressions': [SKIP],
+
+  # Pre-r6 MIPS32 doesn't have instructions needed to properly handle 64-bit
+  # atomic instructions.
+  'wasm/atomics64-stress': [PASS, ['mips_arch_variant != r6', SKIP]],
 }],  # 'arch == mipsel or arch == mips'
 
 ##############################################################################
@@ -590,6 +748,11 @@
   'regress/regress-779407': [SKIP],
 }],  # 'arch == mips64el or arch == mips64'
 
+['(arch == mips64el or arch == mips64) and simulator_run', {
+  # Slow tests which have flaky timeout on simulator.
+  'wasm/atomics64-stress': [SKIP],
+}],  # '(arch == mips64el or arch == mips64) and simulator_run'
+
 ##############################################################################
 ['system == windows', {
   # TODO(mstarzinger): Too slow with turbo fan.
@@ -602,22 +765,57 @@
   'icu-date-to-string': [SKIP],
   'icu-date-lord-howe': [SKIP],
   'regress/regress-6288': [SKIP],
+  'tzoffset-transition-apia': [SKIP],
+  'tzoffset-transition-lord-howe': [SKIP],
+  'tzoffset-transition-moscow': [SKIP],
+  'tzoffset-transition-new-york': [SKIP],
+  'tzoffset-transition-new-york-noi18n': [SKIP],
+  'tzoffset-seoul': [SKIP],
+  'tzoffset-seoul-noi18n': [SKIP],
 }],  # 'system == windows'
 
 ##############################################################################
+['system == android', {
+  # Tests consistently failing on Android.
+  # Setting the locale with environment variables unavailable
+  'icu-date-to-string': [SKIP],
+  'icu-date-lord-howe': [SKIP],
+  'regress/regress-6288': [SKIP],
+  # OOM:
+  'regress/regress-748069': [FAIL],
+  'regress/regress-752764': [FAIL],
+  # Flaky OOM:
+  'regress/regress-779407': [SKIP],
+  'regress/regress-852258': [SKIP],
+}],  # 'system == android'
+
+##############################################################################
 ['system == macos', {
   # BUG(v8:5333)
   'big-object-literal': [SKIP],
 }],  # 'system == macos'
 
 ##############################################################################
-['deopt_fuzzer == True', {
+['isolates', {
+  # Slow tests.
+  'es6/typedarray-of': [PASS, SLOW],
+  'regress/regress-crbug-854299': [PASS, SLOW],
+
+  # Runs flakily OOM because multiple isolates are involved which create many
+  # wasm memories each. Before running OOM on a wasm memory allocation we
+  # trigger a GC, but only in the isolate allocating the new memory.
+  'wasm/module-memory': [SKIP],
+  'wasm/shared-memory-gc-stress': [SKIP],
+}],  # 'isolates'
+
+##############################################################################
+['deopt_fuzzer', {
 
   # Skip tests that are not suitable for deoptimization fuzzing.
   'never-optimize': [SKIP],
-  'regress/regress-2185-2': [SKIP],
   'readonly': [SKIP],
   'array-feedback': [SKIP],
+  'array-reduce': [SKIP],
   'deopt-recursive-eager-once': [SKIP],
   'deopt-recursive-lazy-once': [SKIP],
   'deopt-recursive-soft-once': [SKIP],
@@ -633,16 +831,58 @@
   'shared-function-tier-up-turbo': [SKIP],
 
   # Fails deopt_fuzzer due to --deopt_every_n_times
-  'es6/array-iterator-turbo': [SKIP]
-}],  # 'deopt_fuzzer == True'
+  'es6/array-iterator-turbo': [SKIP],
+
+  # Too slow tests.
+  'regress/regress-740784': [SKIP],
+}],  # 'deopt_fuzzer'
 
 ##############################################################################
-['gc_fuzzer == True', {
+['gc_fuzzer', {
   'regress/regress-336820': [SKIP],
   'regress/regress-748069': [SKIP],
   'regress/regress-778668': [SKIP],
   'ignition/regress-672027': [PASS, ['tsan', SKIP]],
-}],  # 'gc_fuzzer == True'
+  'string-replace-gc': [PASS, SLOW, ['mode == debug', SKIP]],
+
+  # Unsuitable for GC fuzzing because coverage information is lost on GC.
+  'code-coverage-ad-hoc': [SKIP],
+  'code-coverage-precise': [SKIP],
+
+  # Flaky under GC stress (sometimes precludes the tested optimization)
+  'compiler/load-elimination-const-field': [SKIP],
+
+  # Passes incompatible arguments.
+  'd8/d8-arguments': [SKIP],
+
+  # Fails allocation on tsan.
+  'regress/regress-779407': [PASS, ['tsan', SKIP]],
+
+  # Tests that fail some assertions due to checking internal state sensitive
+  # to GC.
+  'compiler/native-context-specialization-hole-check': [SKIP],
+  'regress/regress-trap-allocation-memento': [SKIP],
+  'regress/regress-v8-9267-*': [SKIP],
+  'shared-function-tier-up-turbo': [SKIP],
+}],  # 'gc_fuzzer'
+
+##############################################################################
+['endurance_fuzzer', {
+  # BUG(v8:7400).
+  'wasm/lazy-compilation': [SKIP],
+
+  # BUG(v8:7429).
+  'regress/regress-599414-array-concat-fast-path': [SKIP],
+
+  # Often crashes due to memory consumption.
+  'regress/regress-655573': [SKIP],
+
+  # TSAN allocation failures.
+  'deep-recursion': [PASS, ['tsan', SKIP]],
+  'regress/regress-430201b': [PASS, ['tsan', SKIP]],
+  'regress/regress-crbug-493779': [PASS, ['tsan', SKIP]],
+  'regress/wasm/regress-763439': [PASS, ['tsan', SKIP]],
+}],  # 'endurance_fuzzer'
 
 ##############################################################################
 ['predictable == True', {
@@ -654,20 +894,31 @@
 
   # BUG(v8:7166).
   'd8/enable-tracing': [SKIP],
+  # Relies on async compilation which requires background tasks.
+  'wasm/streaming-error-position': [SKIP],
+  # Intentionally non-deterministic using shared arraybuffers.
+  'wasm/atomics-stress': [SKIP],
+  'wasm/atomics64-stress': [SKIP],
+  'wasm/futex': [SKIP],
 }],  # 'predictable == True'
 
 ##############################################################################
-['arch == ppc and simulator_run or arch == ppc64 and simulator_run', {
+['simulator_run and (arch in [ppc64, s390x])', {
 
   # take too long with the simulator.
   'regress/regress-1132': [SKIP],
   'regress/regress-740784': [SKIP],
+  'regress/regress-crbug-941743': [SKIP],
   'regress/regress-crbug-482998': [PASS, SLOW],
   'regress/regress-91008': [PASS, SLOW],
+  'regress/regress-779407': [PASS, SLOW],
+  'packed-elements': [PASS, SLOW],
   'harmony/regexp-property-lu-ui': [PASS, SLOW],
   'whitespaces': [PASS, SLOW],
-  'wasm/grow-memory': [PASS, SLOW],
-}],  # 'arch == ppc and simulator_run'
+  'generated-transition-stub': [PASS, SLOW],
+  'wasm/atomics-stress': [SKIP],
+  'wasm/atomics64-stress': [SKIP],
+}],  # 'simulator_run and (arch in [ppc64, s390x])'
 
 ##############################################################################
 ['arch == ppc64', {
@@ -678,29 +929,73 @@
 }],  # 'arch == ppc64'
 
 ##############################################################################
-['arch == ppc64 or arch == ppc or arch == s390 or arch == s390x', {
+['system == aix', {
+  # stack overflow
+  'regress/regress-crbug-178790': [PASS, ['mode == debug', SKIP]],
+}],  # 'system == aix'
 
-  # TODO(ppc/s390): implement atomic operations
-  'wasm/atomics': [SKIP],
-}],  # 'arch == ppc64 or arch == ppc or arch == s390 or arch == s390x'
+##############################################################################
+['arch == s390x', {
+  # stack overflow
+  'regress/regress-crbug-178790': [PASS, ['mode == debug', SKIP]],
+}],  # 'arch == s390x'
 
 ##############################################################################
 ['variant == stress', {
-  'es6/array-iterator-turbo': [SKIP],
-
+  # Slow tests.
   'array-natives-elements': [SKIP],
+  'big-object-literal': [SKIP],
+  'es6/array-iterator-turbo': [SKIP],
   'ignition/regress-599001-verifyheap': [SKIP],
   'unicode-test': [SKIP],
 
-  # Slow tests.
-  'regress/regress-2185-2': [SKIP],
+  # Flaky crash on Odroid devices: https://crbug.com/v8/7678
+  'regress/regress-336820': [PASS, ['arch == arm and not simulator_run', SKIP]],
+
+  # Goes OOM on ODROID devices: https://crbug.com/v8/9026
+  # Too slow on PPC: https://crbug.com/v8/9246
+  'es6/large-classes-properties': [PASS, SLOW, ['(arch == arm and not simulator_run) or arch in [ppc, ppc64]', SKIP]],
+  'regress/regress-1122': [PASS, ['tsan', SKIP]],
+
+  # Too slow with gc_stress on arm64.
+  'messages': [PASS, ['gc_stress and arch == arm64', SKIP]],
+
+  # Slow on arm64 simulator: https://crbug.com/v8/7783
+  'string-replace-gc': [PASS, ['arch == arm64 and simulator_run', SKIP]],
+
+  # Too memory hungry.
+  'regress/regress-779407': [PASS, ['tsan', SKIP]],
+  'regress/regress-599414-array-concat-fast-path':  [PASS, ['tsan', SKIP]],
+
+  # Too memory hungry on Odroid devices.
+  'regress/regress-678917': [PASS, ['arch == arm and not simulator_run', SKIP]],
 }],  # variant == stress
 
 ##############################################################################
-['variant == nooptimization', {
-  # Slow tests.
-  'regress/regress-2185-2': [SKIP],
-}],  # variant == nooptimization
+['variant == stress and (arch == arm or arch == arm64) and simulator_run', {
+  # Slow tests: https://crbug.com/v8/7783
+  'es6/large-classes-properties': [SKIP],
+  'generated-transition-stub': [SKIP],
+  'regress/regress-336820': [SKIP],
+  'wasm/grow-memory': [SKIP],
+}],  # variant == stress and (arch == arm or arch == arm64) and simulator_run
+
+##############################################################################
+['variant == nooptimization and (arch == arm or arch == arm64) and simulator_run', {
+  # Slow tests: https://crbug.com/v8/7783
+  'md5': [SKIP],
+  'packed-elements': [SKIP],
+  'regress/regress-crbug-319860': [SKIP],
+  'wasm/asm-wasm-f32': [SKIP],
+  'wasm/asm-wasm-f64': [SKIP],
+  'wasm/grow-memory': [SKIP],
+}],  # variant == nooptimization and (arch == arm or arch == arm64) and simulator_run
+
+##############################################################################
+['(arch == arm or arch == arm64)', {
+  # Flaky tests: https://crbug.com/v8/8090
+  'regress/regress-752764': [SKIP],
+}],  # (arch == arm or arch == arm64)
 
 ##############################################################################
 ['gcov_coverage', {
@@ -712,7 +1007,7 @@
 }],  # 'gcov_coverage'
 
 ##############################################################################
-['variant == wasm_traps', {
+['variant == no_wasm_traps', {
   # Skip stuff uninteresting for wasm traps
   'bugs/*': [SKIP],
   'compiler/*': [SKIP],
@@ -728,13 +1023,7 @@
   'math-*': [SKIP],
   'unicode-test': [SKIP],
   'whitespaces': [SKIP],
-}],  # variant == wasm_traps
-
-['variant == wasm_traps and gc_stress == True', {
-  # TODO(eholk): these tests are disabled due to address space exhaustion.
-  # Re-enable them once Wasm address space limits are in place.
-  '*': [SKIP],
-}],  # variant == wasm_traps and gc_stress == True
+}],  # variant == no_wasm_traps
 
 ##############################################################################
 ['no_harness', {
@@ -750,24 +1039,48 @@
 }], # arch != x64 or deopt_fuzzer
 
 ##############################################################################
-# Liftoff is currently only sufficiently implemented on x64 and ia32.
+# Liftoff is currently only sufficiently implemented on x64, ia32, arm64 and
+# arm.
 # TODO(clemensh): Implement on all other platforms (crbug.com/v8/6600).
-['arch != x64 and arch != ia32', {
+['arch != x64 and arch != ia32 and arch != arm64 and arch != arm', {
   'wasm/liftoff': [SKIP],
-}], # arch != x64 and arch != ia32
-
-##############################################################################
-['variant == liftoff', {
-  # In the liftoff variant, liftoff compilation happens even though the test
-  # does not explicitly enable it.
-  'wasm/default-liftoff-setting': [SKIP],
-}], # variant == liftoff
+  'wasm/tier-up-testing-flag': [SKIP],
+}], # arch != x64 and arch != ia32 and arch != arm64 and arch != arm
 
 ##############################################################################
 ['variant == slow_path and gc_stress', {
   # Slow tests.
   'regress/regress-crbug-493779': [SKIP],
   'string-replace-gc': [SKIP],
+
+  # https://crbug.com/v8/9221
+  'wasm/grow-shared-memory': [SKIP],
 }],  # variant == slow_path
 
+##############################################################################
+['arch == x64', {
+  # TODO: Flaky test: crbug.com/v8/7899
+  'wasm/asm-wasm-i32': [SKIP],
+  'wasm/asm-wasm-f64': [SKIP],
+}], # arch == x64
+
+##############################################################################
+['arch in [arm, android_arm, android_ia32, ia32, ppc, s390, s390x, mipsel, mips]', {
+  # TODO(ssauleau): implement BigInt<>Wasm conversion for other arch -
+  # crbug.com/v8/7741
+  'wasm/bigint': [SKIP],
+  'wasm/bigint-i64-to-imported-js-func': [SKIP],
+}], # arch in [arm, android_arm, android_ia32, ia32, ppc, s390, s390x, mipsel, mips]
+
+##############################################################################
+['arch not in [x64, arm, arm64] or system != linux', {
+  # Unwinding info writer is only supported on x64, arm, and arm64 Linux
+  'regress/regress-913844': [SKIP],
+}],
+
+##############################################################################
+['variant == jitless and not embedded_builtins', {
+  '*': [SKIP],
+}], # variant == jitless and not embedded_builtins
+
 ]
diff --git a/src/v8/test/mjsunit/mjsunit_numfuzz.js b/src/v8/test/mjsunit/mjsunit_numfuzz.js
new file mode 100644
index 0000000..c0af3e3
--- /dev/null
+++ b/src/v8/test/mjsunit/mjsunit_numfuzz.js
@@ -0,0 +1,12 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This file is added after mjsunit.js on the number fuzzer in order to
+// ignore optimization state assertions, which are invalid in many test cases
+// when gc timings are fuzzed.
+
+(function () {
+  assertUnoptimized = function assertUnoptimized() {};
+  assertOptimized = function assertOptimized() {};
+})();
diff --git a/src/v8/test/mjsunit/modules-circular-valid.mjs b/src/v8/test/mjsunit/modules-circular-valid.mjs
new file mode 100644
index 0000000..8d3977f
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-circular-valid.mjs
@@ -0,0 +1,5 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export {a as b} from "modules-skip-circular-valid.mjs";
diff --git a/src/v8/test/mjsunit/modules-cycle.mjs b/src/v8/test/mjsunit/modules-cycle.mjs
new file mode 100644
index 0000000..730ac87
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-cycle.mjs
@@ -0,0 +1,6 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import "modules-skip-cycle.mjs";
+export {a as foo} from "modules-skip-1.mjs"
diff --git a/src/v8/test/mjsunit/modules-default-name1.mjs b/src/v8/test/mjsunit/modules-default-name1.mjs
new file mode 100644
index 0000000..0943853
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-default-name1.mjs
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import {default as goo} from "modules-skip-default-name1.mjs";
+assertEquals(
+    {value: "gaga", configurable: true, writable: false, enumerable: false},
+    Reflect.getOwnPropertyDescriptor(goo, 'name'));
diff --git a/src/v8/test/mjsunit/modules-default-name2.mjs b/src/v8/test/mjsunit/modules-default-name2.mjs
new file mode 100644
index 0000000..c89536e
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-default-name2.mjs
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import {default as goo} from "modules-skip-default-name2.mjs";
+assertEquals(
+    {value: "gaga", configurable: true, writable: false, enumerable: false},
+    Reflect.getOwnPropertyDescriptor(goo, 'name'));
diff --git a/src/v8/test/mjsunit/modules-default-name3.mjs b/src/v8/test/mjsunit/modules-default-name3.mjs
new file mode 100644
index 0000000..cad829c
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-default-name3.mjs
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import {default as goo} from "modules-skip-default-name3.mjs";
+assertEquals(
+    {value: "default", configurable: true, writable: false, enumerable: false},
+    Reflect.getOwnPropertyDescriptor(goo, 'name'));
diff --git a/src/v8/test/mjsunit/modules-default-name4.mjs b/src/v8/test/mjsunit/modules-default-name4.mjs
new file mode 100644
index 0000000..c3b8ea0
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-default-name4.mjs
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import {default as goo} from "modules-skip-default-name4.mjs";
+assertEquals(
+    {value: "Gaga", configurable: true, writable: false, enumerable: false},
+    Reflect.getOwnPropertyDescriptor(goo, 'name'));
diff --git a/src/v8/test/mjsunit/modules-default-name5.mjs b/src/v8/test/mjsunit/modules-default-name5.mjs
new file mode 100644
index 0000000..ac55b0f
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-default-name5.mjs
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import {default as goo} from "modules-skip-default-name5.mjs";
+assertEquals(
+    {value: "Gaga", configurable: true, writable: false, enumerable: false},
+    Reflect.getOwnPropertyDescriptor(goo, 'name'));
diff --git a/src/v8/test/mjsunit/modules-default-name6.mjs b/src/v8/test/mjsunit/modules-default-name6.mjs
new file mode 100644
index 0000000..eec2493
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-default-name6.mjs
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import {default as goo} from "modules-skip-default-name6.mjs";
+assertEquals(
+    {value: "default", configurable: true, writable: false, enumerable: false},
+    Reflect.getOwnPropertyDescriptor(goo, 'name'));
diff --git a/src/v8/test/mjsunit/modules-default-name7.mjs b/src/v8/test/mjsunit/modules-default-name7.mjs
new file mode 100644
index 0000000..f8799ba
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-default-name7.mjs
@@ -0,0 +1,9 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import {default as goo} from "modules-skip-default-name7.mjs";
+let descr = Reflect.getOwnPropertyDescriptor(goo, 'name');
+assertEquals(descr,
+    {value: descr.value, configurable: true, writable: true, enumerable: false});
+assertEquals("yo", descr.value());
diff --git a/src/v8/test/mjsunit/modules-default-name8.mjs b/src/v8/test/mjsunit/modules-default-name8.mjs
new file mode 100644
index 0000000..1c3db2d
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-default-name8.mjs
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import {default as goo} from "modules-skip-default-name8.mjs";
+assertEquals(
+    {value: "default", configurable: true, writable: false, enumerable: false},
+    Reflect.getOwnPropertyDescriptor(goo, 'name'));
diff --git a/src/v8/test/mjsunit/modules-default-name9.mjs b/src/v8/test/mjsunit/modules-default-name9.mjs
new file mode 100644
index 0000000..27083f9
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-default-name9.mjs
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import {default as goo} from "modules-skip-default-name9.mjs";
+assertEquals(
+    {value: "default", configurable: true, writable: false, enumerable: false},
+    Reflect.getOwnPropertyDescriptor(goo, 'name'));
diff --git a/src/v8/test/mjsunit/modules-default.mjs b/src/v8/test/mjsunit/modules-default.mjs
new file mode 100644
index 0000000..facbbd0
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-default.mjs
@@ -0,0 +1,9 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import foo from "modules-skip-1.mjs";
+assertEquals(42, foo);
+
+import {default as gaga} from "modules-skip-1.mjs";
+assertEquals(42, gaga);
diff --git a/src/v8/test/mjsunit/modules-empty-import1.mjs b/src/v8/test/mjsunit/modules-empty-import1.mjs
new file mode 100644
index 0000000..11bb94d
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-empty-import1.mjs
@@ -0,0 +1,7 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import "modules-skip-empty-import.mjs";
+import {counter} from "modules-skip-empty-import-aux.mjs";
+assertEquals(1, counter);
diff --git a/src/v8/test/mjsunit/modules-empty-import2.mjs b/src/v8/test/mjsunit/modules-empty-import2.mjs
new file mode 100644
index 0000000..aab6c2a
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-empty-import2.mjs
@@ -0,0 +1,7 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import {} from "modules-skip-empty-import.mjs";
+import {counter} from "modules-skip-empty-import-aux.mjs";
+assertEquals(1, counter);
diff --git a/src/v8/test/mjsunit/modules-empty-import3.mjs b/src/v8/test/mjsunit/modules-empty-import3.mjs
new file mode 100644
index 0000000..be7fa7e
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-empty-import3.mjs
@@ -0,0 +1,7 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export {} from "modules-skip-empty-import.mjs";
+import {counter} from "modules-skip-empty-import-aux.mjs";
+assertEquals(1, counter);
diff --git a/src/v8/test/mjsunit/modules-empty-import4.mjs b/src/v8/test/mjsunit/modules-empty-import4.mjs
new file mode 100644
index 0000000..55576c0
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-empty-import4.mjs
@@ -0,0 +1,9 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import "modules-skip-empty-import.mjs";
+import {} from "modules-skip-empty-import.mjs";
+export {} from "modules-skip-empty-import.mjs";
+import {counter} from "modules-skip-empty-import-aux.mjs";
+assertEquals(1, counter);
diff --git a/src/v8/test/mjsunit/modules-error-trace.mjs b/src/v8/test/mjsunit/modules-error-trace.mjs
new file mode 100644
index 0000000..12a6f33
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-error-trace.mjs
@@ -0,0 +1,7 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Make sure the generator resume function doesn't show up in the stack trace.
+const stack = (new Error).stack;
+assertEquals(2, stack.split(/\r\n|\r|\n/).length);
diff --git a/src/v8/test/mjsunit/modules-export-star-as1.mjs b/src/v8/test/mjsunit/modules-export-star-as1.mjs
new file mode 100644
index 0000000..41aac3d
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-export-star-as1.mjs
@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+// Flags: --harmony-namespace-exports
+
+import {foo} from "./modules-skip-8.mjs";
+assertEquals(42, foo.default);
+assertEquals(1, foo.get_a());
diff --git a/src/v8/test/mjsunit/modules-export-star-as2.mjs b/src/v8/test/mjsunit/modules-export-star-as2.mjs
new file mode 100644
index 0000000..86be1c2
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-export-star-as2.mjs
@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+// Flags: --harmony-namespace-exports
+
+export * as self from "./modules-export-star-as2.mjs";
+export * as self_again from "./modules-export-star-as2.mjs";
+import {self as myself} from "./modules-export-star-as2.mjs";
+import {self_again as myself_again} from "./modules-export-star-as2.mjs";
+
+assertEquals(["self", "self_again"], Object.keys(myself));
+assertEquals(myself, myself.self);
+assertEquals(myself_again, myself.self_again);
+assertEquals(myself, myself_again);
+
+assertThrows(_ => self, ReferenceError);
+assertThrows(_ => self_again, ReferenceError);
diff --git a/src/v8/test/mjsunit/modules-export-star-as3.mjs b/src/v8/test/mjsunit/modules-export-star-as3.mjs
new file mode 100644
index 0000000..4e00aef
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-export-star-as3.mjs
@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+// Flags: --harmony-namespace-exports
+
+let self = 42;
+export * as self from "./modules-export-star-as3.mjs";
+import {self as myself} from "./modules-export-star-as3.mjs";
+assertEquals(["self"], Object.keys(myself));
+assertEquals(myself, myself.self);
+assertEquals(42, self);
+self++;
+assertEquals(43, self);
diff --git a/src/v8/test/mjsunit/modules-exports1.mjs b/src/v8/test/mjsunit/modules-exports1.mjs
new file mode 100644
index 0000000..4afd52e
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-exports1.mjs
@@ -0,0 +1,53 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export var myvar = "VAR";
+assertEquals("VAR", myvar);
+assertEquals("VAR", eval("myvar"));
+(() => assertEquals("VAR", myvar))();
+
+export let mylet = "LET";
+assertEquals("LET", mylet);
+assertEquals("LET", eval("mylet"));
+(() => assertEquals("LET", mylet))();
+
+export const myconst = "CONST";
+assertEquals("CONST", myconst);
+assertEquals("CONST", eval("myconst"));
+(() => assertEquals("CONST", myconst))();
+
+
+myvar = 1;
+assertEquals(1, myvar);
+assertEquals(1, eval("myvar"));
+(() => assertEquals(1, myvar))();
+(() => myvar = 2)();
+assertEquals(2, myvar);
+(() => assertEquals(2, myvar))();
+{
+  let f = () => assertEquals(2, myvar);
+  f();
+}
+
+mylet = 1;
+assertEquals(1, mylet);
+assertEquals(1, eval("mylet"));
+(() => assertEquals(1, mylet))();
+(() => mylet = 2)();
+assertEquals(2, mylet);
+assertEquals(2, eval("mylet"));
+(() => assertEquals(2, mylet))();
+{
+  let f = () => assertEquals(2, mylet);
+  f();
+}
+
+assertThrows(() => myconst = 1, TypeError);
+assertEquals("CONST", myconst);
+assertEquals("CONST", eval("myconst"));
+(() => assertEquals("CONST", myconst))();
+{
+  let f = () => assertEquals("CONST", myconst);
+  f();
+}
diff --git a/src/v8/test/mjsunit/modules-exports2.mjs b/src/v8/test/mjsunit/modules-exports2.mjs
new file mode 100644
index 0000000..0c858cb
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-exports2.mjs
@@ -0,0 +1,29 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export function foo() { return 42 }
+assertEquals(42, foo());
+foo = 1;
+assertEquals(1, foo);
+
+let gaga = 43;
+export {gaga as gugu};
+assertEquals(43, gaga);
+
+export default (function bar() { return 43 })
+assertThrows(() => bar(), ReferenceError);
+assertThrows("default", SyntaxError);
+assertThrows("*default*", SyntaxError);
+
+
+var bla = 44;
+var blu = 45;
+export {bla};
+export {bla as blu};
+export {bla as bli};
+assertEquals(44, bla);
+assertEquals(45, blu);
+bla = 46;
+assertEquals(46, bla);
+assertEquals(45, blu);
diff --git a/src/v8/test/mjsunit/modules-exports3.mjs b/src/v8/test/mjsunit/modules-exports3.mjs
new file mode 100644
index 0000000..cf36f70
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-exports3.mjs
@@ -0,0 +1,46 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export { myvar, mylet, myconst };
+
+var myvar = "VAR";
+assertEquals("VAR", myvar);
+let mylet = "LET";
+assertEquals("LET", mylet);
+const myconst = "CONST";
+assertEquals("CONST", myconst);
+
+function* gaga() { yield 1 }
+assertEquals(1, gaga().next().value);
+export {gaga};
+export default gaga;
+export {gaga as gigi};
+assertEquals(1, gaga().next().value);
+
+
+export let gugu = 42;
+
+{
+  assertEquals(42, gugu);
+}
+
+try {
+  assertEquals(42, gugu);
+} catch(_) {
+  assertUnreachable();
+}
+
+try {
+  throw {};
+} catch(_) {
+  assertEquals(42, gugu);
+}
+
+try {
+  throw {};
+} catch({x=gugu}) {
+  assertEquals(42, x);
+}
+
+assertEquals(5, eval("var x = 5; x"));
diff --git a/src/v8/test/mjsunit/modules-imports1.mjs b/src/v8/test/mjsunit/modules-imports1.mjs
new file mode 100644
index 0000000..3927b0d
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-imports1.mjs
@@ -0,0 +1,24 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import {a as x, set_a as set_x} from "modules-skip-1.mjs"
+
+let get_x = () => x;
+
+assertEquals(1, x);
+assertEquals(1, (() => x)());
+assertEquals(1, eval('x'));
+assertEquals(1, get_x());
+
+assertThrows(() => x = 666, TypeError);
+assertEquals(1, x);
+assertEquals(1, (() => x)());
+assertEquals(1, eval('x'));
+assertEquals(1, get_x());
+
+set_x("foo");
+assertEquals("foo", x);
+assertEquals("foo", (() => x)());
+assertEquals("foo", eval('x'));
+assertEquals("foo", get_x());
diff --git a/src/v8/test/mjsunit/modules-imports2.mjs b/src/v8/test/mjsunit/modules-imports2.mjs
new file mode 100644
index 0000000..de76045
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-imports2.mjs
@@ -0,0 +1,24 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let get_x = () => x;
+
+assertEquals(1, x);
+assertEquals(1, (() => x)());
+assertEquals(1, eval('x'));
+assertEquals(1, get_x());
+
+assertThrows(() => x = 666, TypeError);
+assertEquals(1, x);
+assertEquals(1, (() => x)());
+assertEquals(1, eval('x'));
+assertEquals(1, get_x());
+
+set_x("foo");
+assertEquals("foo", x);
+assertEquals("foo", (() => x)());
+assertEquals("foo", eval('x'));
+assertEquals("foo", get_x());
+
+import {a as x, set_a as set_x} from "modules-skip-1.mjs"
diff --git a/src/v8/test/mjsunit/modules-imports3.mjs b/src/v8/test/mjsunit/modules-imports3.mjs
new file mode 100644
index 0000000..b656e8b
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-imports3.mjs
@@ -0,0 +1,36 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import {a as x, a as y} from "modules-skip-1.mjs";
+import {b as z, get_a, set_a} from "modules-skip-1.mjs";
+
+assertEquals(1, get_a());
+assertEquals(1, x);
+assertEquals(1, y);
+assertEquals(1, z);
+
+set_a(2);
+assertEquals(2, get_a());
+assertEquals(2, x);
+assertEquals(2, y);
+assertEquals(2, z);
+
+assertThrows(() => x = 3, TypeError);
+assertThrows(() => y = 3, TypeError);
+assertThrows(() => z = 3, TypeError);
+
+assertEquals(2, get_a());
+assertEquals(2, x);
+assertEquals(2, y);
+assertEquals(2, z);
+
+assertEquals(2, eval('get_a()'));
+assertEquals(2, eval('x'));
+assertEquals(2, eval('y'));
+assertEquals(2, eval('z'));
+
+assertEquals(2, (() => get_a())());
+assertEquals(2, (() => x)());
+assertEquals(2, (() => y)());
+assertEquals(2, (() => z)());
diff --git a/src/v8/test/mjsunit/modules-imports4.mjs b/src/v8/test/mjsunit/modules-imports4.mjs
new file mode 100644
index 0000000..d777b05
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-imports4.mjs
@@ -0,0 +1,29 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import {b, c} from "modules-skip-2.mjs";
+import {a, set_a} from "modules-skip-1.mjs";
+import x from "modules-skip-2.mjs";
+
+assertEquals(42, x);
+
+assertEquals(1, a);
+assertEquals(1, b);
+assertEquals(1, c);
+
+set_a(2);
+assertEquals(2, a);
+assertEquals(2, b);
+assertEquals(2, c);
+
+assertThrows(() => a = 3, TypeError);
+assertThrows(() => b = 3, TypeError);
+assertThrows(() => c = 3, TypeError);
+
+assertEquals(2, a);
+assertEquals(2, b);
+assertEquals(2, c);
+
+assertThrows(() => x = 43, TypeError);
+assertEquals(42, x);
diff --git a/src/v8/test/mjsunit/modules-imports5.mjs b/src/v8/test/mjsunit/modules-imports5.mjs
new file mode 100644
index 0000000..fe53f8a
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-imports5.mjs
@@ -0,0 +1,7 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import {a} from "modules-skip-3.mjs";
+export var b = 20;
+assertEquals(42, a+b);
diff --git a/src/v8/test/mjsunit/modules-imports6.mjs b/src/v8/test/mjsunit/modules-imports6.mjs
new file mode 100644
index 0000000..5dec159
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-imports6.mjs
@@ -0,0 +1,23 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import {b, c} from "modules-skip-4.mjs";
+import {a, set_a} from "modules-skip-4.mjs";
+
+assertEquals(1, a);
+assertEquals(1, b);
+assertEquals(1, c);
+
+set_a(2);
+assertEquals(2, a);
+assertEquals(2, b);
+assertEquals(2, c);
+
+assertThrows(() => a = 3, TypeError);
+assertThrows(() => b = 3, TypeError);
+assertThrows(() => c = 3, TypeError);
+
+assertEquals(2, a);
+assertEquals(2, b);
+assertEquals(2, c);
diff --git a/src/v8/test/mjsunit/modules-imports7.mjs b/src/v8/test/mjsunit/modules-imports7.mjs
new file mode 100644
index 0000000..5d6f6b9
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-imports7.mjs
@@ -0,0 +1,6 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import {a} from "modules-skip-6.mjs";
+assertEquals(10, a);
diff --git a/src/v8/test/mjsunit/modules-imports8.mjs b/src/v8/test/mjsunit/modules-imports8.mjs
new file mode 100644
index 0000000..781674f
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-imports8.mjs
@@ -0,0 +1,9 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+// Flags: --harmony-namespace-exports
+
+import {a, b} from "./modules-skip-9.mjs";
+assertSame(a, b);
+assertEquals(42, a.default);
+assertEquals(1, a.a);
diff --git a/src/v8/test/mjsunit/modules-init1.mjs b/src/v8/test/mjsunit/modules-init1.mjs
new file mode 100644
index 0000000..553db8f
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-init1.mjs
@@ -0,0 +1,7 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import "modules-skip-init1.mjs";
+export function bar() { return 42 };
+bar = 5;
diff --git a/src/v8/test/mjsunit/modules-init2.mjs b/src/v8/test/mjsunit/modules-init2.mjs
new file mode 100644
index 0000000..f2e2683
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-init2.mjs
@@ -0,0 +1,6 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import {bar} from "modules-init1.mjs";
+assertEquals(5, bar);
diff --git a/src/v8/test/mjsunit/modules-init3.mjs b/src/v8/test/mjsunit/modules-init3.mjs
new file mode 100644
index 0000000..c11c205
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-init3.mjs
@@ -0,0 +1,23 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import {check} from "modules-skip-init3.mjs";
+
+assertSame(undefined, w);
+assertThrows(() => x, ReferenceError);
+assertThrows(() => y, ReferenceError);
+assertThrows(() => z, ReferenceError);
+
+assertEquals(23, w = 23);
+assertThrows(() => x = 666, ReferenceError);
+assertThrows(() => y = 666, ReferenceError);
+assertThrows(() => z = 666, TypeError);
+
+export function* v() { return 40 }
+export var w = 41;
+export let x = 42;
+export class y {};
+export const z = "hello world";
+
+assertTrue(check());
diff --git a/src/v8/test/mjsunit/modules-init4.mjs b/src/v8/test/mjsunit/modules-init4.mjs
new file mode 100644
index 0000000..681edd5
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-init4.mjs
@@ -0,0 +1,6 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import "./modules-skip-init4a.mjs"
+export {foo, ns} from "./modules-skip-init4b.mjs"
diff --git a/src/v8/test/mjsunit/modules-namespace-getownproperty1.mjs b/src/v8/test/mjsunit/modules-namespace-getownproperty1.mjs
new file mode 100644
index 0000000..00ad50c
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-namespace-getownproperty1.mjs
@@ -0,0 +1,146 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import * as ns from "./modules-namespace-getownproperty1.mjs";
+
+
+////////////////////////////////////////////////////////////////////////////////
+// There are three exports, a and b and c (all let-declared).  Variable b is
+// declared AFTER the first set of tests ran (see below).
+export let a = 1;
+export let c = 3;
+////////////////////////////////////////////////////////////////////////////////
+
+
+// for-in
+assertThrows(() => { for (let p in ns) {} }, ReferenceError);
+
+// Object.prototype.propertyIsEnumerable
+assertTrue(Object.prototype.propertyIsEnumerable.call(ns, 'a'));
+assertThrows(() => Object.prototype.propertyIsEnumerable.call(ns, 'b'),
+    ReferenceError);
+assertTrue(Object.prototype.propertyIsEnumerable.call(ns, 'c'));
+
+// Object.prototype.hasOwnProperty
+assertTrue(Object.prototype.hasOwnProperty.call(ns, 'a'));
+assertThrows(() => Object.prototype.hasOwnProperty.call(ns, 'b'),
+    ReferenceError);
+assertTrue(Object.prototype.hasOwnProperty.call(ns, 'c'));
+
+// Object.keys
+assertThrows(() => Object.keys(ns), ReferenceError);
+
+// Object.entries
+assertThrows(() => Object.entries(ns), ReferenceError);
+
+// Object.values
+assertThrows(() => Object.values(ns), ReferenceError);
+
+// Object.getOwnPropertyNames
+assertEquals(['a', 'b', 'c'], Object.getOwnPropertyNames(ns));
+
+// Object.getOwnPropertySymbols
+assertEquals([Symbol.toStringTag], Object.getOwnPropertySymbols(ns));
+
+// Reflect.ownKeys
+assertEquals(['a', 'b', 'c', Symbol.toStringTag], Reflect.ownKeys(ns));
+
+// Object.assign
+var copy = {};
+assertThrows(() => Object.assign(copy, ns), ReferenceError);
+assertEquals({a: 1}, copy);
+
+// Object.isFrozen
+assertFalse(Object.isFrozen(ns));
+
+// Object.isSealed
+assertThrows(() => Object.isSealed(ns), ReferenceError);
+
+// Object.freeze
+assertThrows(() => Object.freeze(ns), TypeError);
+
+// Object.seal
+assertThrows(() => Object.seal(ns), ReferenceError);
+
+// JSON.stringify
+assertThrows(() => JSON.stringify(ns), ReferenceError);
+
+// PropertyDefinition
+assertThrows(() => ({...copy} = ns), ReferenceError);
+
+// delete
+assertThrows(() => delete ns.b, TypeError);
+assertFalse(Reflect.deleteProperty(ns, 'b'));
+
+
+////////////////////////////////////////////////////////////////////////////////
+// Variable b is declared here.
+export let b = 2;
+////////////////////////////////////////////////////////////////////////////////
+
+
+// for-in
+var i = 1;
+for (let p in ns) {
+  assertEquals(i, ns[p]);
+  i++
+}
+assertEquals(i, 4);
+
+// Object.prototype.propertyIsEnumerable
+assertTrue(Object.prototype.propertyIsEnumerable.call(ns, 'a'));
+assertTrue(Object.prototype.propertyIsEnumerable.call(ns, 'b'));
+assertTrue(Object.prototype.propertyIsEnumerable.call(ns, 'c'));
+
+// Object.prototype.hasOwnProperty
+assertTrue(Object.prototype.hasOwnProperty.call(ns, 'a'));
+assertTrue(Object.prototype.hasOwnProperty.call(ns, 'b'));
+assertTrue(Object.prototype.hasOwnProperty.call(ns, 'c'));
+
+// Object.keys
+assertEquals(['a', 'b', 'c'], Object.keys(ns));
+
+// Object.entries
+assertEquals([['a', 1], ['b', 2], ['c', 3]], Object.entries(ns));
+
+// Object.values
+assertEquals([1, 2, 3], Object.values(ns));
+
+// Object.getOwnPropertyNames
+assertEquals(['a', 'b', 'c'], Object.getOwnPropertyNames(ns));
+
+// Object.getOwnPropertySymbols
+assertEquals([Symbol.toStringTag], Object.getOwnPropertySymbols(ns));
+
+// Reflect.ownKeys
+assertEquals(['a', 'b', 'c', Symbol.toStringTag], Reflect.ownKeys(ns));
+
+// Object.assign
+copy = {};
+Object.assign(copy, ns);
+assertEquals({a: 1, b:2, c:3}, copy);
+
+// Object.isFrozen
+assertFalse(Object.isFrozen(ns));
+
+// Object.isSealed
+assertTrue(Object.isSealed(ns));
+
+// Object.freeze
+assertThrows(() => Object.freeze(ns), TypeError);
+
+// Object.seal
+assertDoesNotThrow(() => Object.seal(ns));
+
+// JSON.stringify
+assertEquals('{"a":1,"b":2,"c":3}', JSON.stringify(ns));
+
+// PropertyDefinition
+copy = {};
+({...copy} = ns);
+assertEquals({a: 1, b:2, c:3}, copy);
+
+// delete
+assertThrows(() => delete ns.b, TypeError);
+assertFalse(Reflect.deleteProperty(ns, 'b'));
diff --git a/src/v8/test/mjsunit/modules-namespace-getownproperty2.mjs b/src/v8/test/mjsunit/modules-namespace-getownproperty2.mjs
new file mode 100644
index 0000000..e3f3130
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-namespace-getownproperty2.mjs
@@ -0,0 +1,146 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import * as ns from "./modules-namespace-getownproperty2.mjs";
+
+// This tests the same as modules-namespace-getownproperty1.mjs except that here
+// variable a doesn't exist. This means that the late-declared variable b is the
+// (alphabetically) first property of the namespace object, which makes a
+// difference for some operations.
+
+
+////////////////////////////////////////////////////////////////////////////////
+// There are two exports, b and c (both let-declared).  Variable b is
+// declared AFTER the first set of tests ran (see below).
+export let c = 3;
+////////////////////////////////////////////////////////////////////////////////
+
+
+// for-in
+assertThrows(() => { for (let p in ns) {} }, ReferenceError);
+
+// Object.prototype.propertyIsEnumerable
+assertThrows(() => Object.prototype.propertyIsEnumerable.call(ns, 'b'),
+    ReferenceError);
+assertTrue(Object.prototype.propertyIsEnumerable.call(ns, 'c'));
+
+// Object.prototype.hasOwnProperty
+assertThrows(() => Object.prototype.hasOwnProperty.call(ns, 'b'),
+    ReferenceError);
+assertTrue(Object.prototype.hasOwnProperty.call(ns, 'c'));
+
+// Object.keys
+assertThrows(() => Object.keys(ns), ReferenceError);
+
+// Object.entries
+assertThrows(() => Object.entries(ns), ReferenceError);
+
+// Object.values
+assertThrows(() => Object.values(ns), ReferenceError);
+
+// Object.getOwnPropertyNames
+assertEquals(['b', 'c'], Object.getOwnPropertyNames(ns));
+
+// Object.getOwnPropertySymbols
+assertEquals([Symbol.toStringTag], Object.getOwnPropertySymbols(ns));
+
+// Reflect.ownKeys
+assertEquals(['b', 'c', Symbol.toStringTag], Reflect.ownKeys(ns));
+
+// Object.assign
+var copy = {};
+assertThrows(() => Object.assign(copy, ns), ReferenceError);
+assertEquals({}, copy);
+
+// Object.isFrozen
+assertThrows(() => Object.isFrozen(ns), ReferenceError);
+
+// Object.isSealed
+assertThrows(() => Object.isSealed(ns), ReferenceError);
+
+// Object.freeze
+assertThrows(() => Object.freeze(ns), ReferenceError);
+
+// Object.seal
+assertThrows(() => Object.seal(ns), ReferenceError);
+
+// JSON.stringify
+assertThrows(() => JSON.stringify(ns), ReferenceError);
+
+// PropertyDefinition
+assertThrows(() => ({...copy} = ns), ReferenceError);
+
+// delete
+assertThrows(() => delete ns.b, TypeError);
+assertFalse(Reflect.deleteProperty(ns, 'b'));
+
+
+////////////////////////////////////////////////////////////////////////////////
+// Variable b is declared here.
+export let b = 2;
+////////////////////////////////////////////////////////////////////////////////
+
+
+// for-in
+var i = 2;
+for (let p in ns) {
+  assertEquals(i, ns[p]);
+  i++
+}
+assertEquals(i, 4);
+
+// Object.prototype.propertyIsEnumerable
+assertTrue(Object.prototype.propertyIsEnumerable.call(ns, 'b'));
+assertTrue(Object.prototype.propertyIsEnumerable.call(ns, 'c'));
+
+// Object.prototype.hasOwnProperty
+assertTrue(Object.prototype.hasOwnProperty.call(ns, 'b'));
+assertTrue(Object.prototype.hasOwnProperty.call(ns, 'c'));
+
+// Object.keys
+assertEquals(['b', 'c'], Object.keys(ns));
+
+// Object.entries
+assertEquals([['b', 2], ['c', 3]], Object.entries(ns));
+
+// Object.values
+assertEquals([2, 3], Object.values(ns));
+
+// Object.getOwnPropertyNames
+assertEquals(['b', 'c'], Object.getOwnPropertyNames(ns));
+
+// Object.getOwnPropertySymbols
+assertEquals([Symbol.toStringTag], Object.getOwnPropertySymbols(ns));
+
+// Reflect.ownKeys
+assertEquals(['b', 'c', Symbol.toStringTag], Reflect.ownKeys(ns));
+
+// Object.assign
+copy = {};
+Object.assign(copy, ns);
+assertEquals({b:2, c:3}, copy);
+
+// Object.isFrozen
+assertFalse(Object.isFrozen(ns));
+
+// Object.isSealed
+assertTrue(Object.isSealed(ns));
+
+// Object.freeze
+assertThrows(() => Object.freeze(ns), TypeError);
+
+// Object.seal
+assertDoesNotThrow(() => Object.seal(ns));
+
+// JSON.stringify
+assertEquals('{"b":2,"c":3}', JSON.stringify(ns));
+
+// PropertyDefinition
+copy = {};
+({...copy} = ns);
+assertEquals({b:2, c:3}, copy);
+
+// delete
+assertThrows(() => delete ns.b, TypeError);
+assertFalse(Reflect.deleteProperty(ns, 'b'));
diff --git a/src/v8/test/mjsunit/modules-namespace1.mjs b/src/v8/test/mjsunit/modules-namespace1.mjs
new file mode 100644
index 0000000..8087e83
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-namespace1.mjs
@@ -0,0 +1,71 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let ja = 42;
+export {ja as yo};
+export const bla = "blaa";
+export {foo as foo_again};
+// See further below for the actual star import that declares "foo".
+
+// The object itself.
+assertEquals("object", typeof foo);
+assertThrows(() => foo = 666, TypeError);
+assertFalse(Reflect.isExtensible(foo));
+assertTrue(Reflect.preventExtensions(foo));
+assertThrows(() => Reflect.apply(foo, {}, []));
+assertThrows(() => Reflect.construct(foo, {}, []));
+assertSame(null, Reflect.getPrototypeOf(foo));
+assertTrue(Reflect.setPrototypeOf(foo, null));
+assertFalse(Reflect.setPrototypeOf(foo, {}));
+assertSame(null, Reflect.getPrototypeOf(foo));
+assertEquals(
+    ["bla", "foo_again", "yo", Symbol.toStringTag], Reflect.ownKeys(foo));
+
+// Its "yo" property.
+assertEquals(
+    {value: 42, enumerable: true, configurable: false, writable: true},
+    Reflect.getOwnPropertyDescriptor(foo, "yo"));
+assertFalse(Reflect.deleteProperty(foo, "yo"));
+assertTrue(Reflect.has(foo, "yo"));
+assertFalse(Reflect.set(foo, "yo", true));
+// TODO(neis): The next two should be False.
+assertTrue(Reflect.defineProperty(foo, "yo",
+    Reflect.getOwnPropertyDescriptor(foo, "yo")));
+assertTrue(Reflect.defineProperty(foo, "yo", {}));
+assertFalse(Reflect.defineProperty(foo, "yo", {get() {return 1}}));
+assertEquals(42, Reflect.get(foo, "yo"));
+assertEquals(43, (ja++, foo.yo));
+
+// Its "foo_again" property.
+assertSame(foo, foo.foo_again);
+
+// Its @@toStringTag property.
+assertTrue(Reflect.has(foo, Symbol.toStringTag));
+assertEquals("string", typeof Reflect.get(foo, Symbol.toStringTag));
+assertEquals(
+    {value: "Module", configurable: false, writable: false, enumerable: false},
+    Reflect.getOwnPropertyDescriptor(foo, Symbol.toStringTag));
+assertFalse(Reflect.deleteProperty(foo, Symbol.toStringTag));
+assertEquals(
+    {value: "Module", configurable: false, writable: false, enumerable: false},
+    Reflect.getOwnPropertyDescriptor(foo, Symbol.toStringTag));
+
+// Nonexistent properties.
+let nonexistent = ["gaga", 123, Symbol('')];
+for (let key of nonexistent) {
+  assertSame(undefined, Reflect.getOwnPropertyDescriptor(foo, key));
+  assertTrue(Reflect.deleteProperty(foo, key));
+  assertFalse(Reflect.set(foo, key, true));
+  assertSame(undefined, Reflect.get(foo, key));
+  assertFalse(Reflect.defineProperty(foo, key, {get() {return 1}}));
+  assertFalse(Reflect.has(foo, key));
+}
+
+// The actual star import that we are testing. Namespace imports are
+// initialized before evaluation.
+import * as foo from "modules-namespace1.mjs";
+
+// There can be only one namespace object.
+import * as bar from "modules-namespace1.mjs";
+assertSame(foo, bar);
diff --git a/src/v8/test/mjsunit/modules-namespace2.mjs b/src/v8/test/mjsunit/modules-namespace2.mjs
new file mode 100644
index 0000000..6197a90
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-namespace2.mjs
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals(
+    ["b", "c", "get_a", "ns2", "set_a", "zzz", Symbol.toStringTag],
+    Reflect.ownKeys(ns));
+
+import * as foo from "modules-skip-1.mjs";
+assertSame(foo.a, ns.b);
+assertSame(foo.a, ns.c);
+assertSame(foo.get_a, ns.get_a);
+assertSame(foo.set_a, ns.set_a);
+assertEquals(123, ns.zzz);
+
+assertSame(ns, ns.ns2.ns);
+import * as ns from "modules-skip-namespace.mjs";
+export {ns};
diff --git a/src/v8/test/mjsunit/modules-namespace3.mjs b/src/v8/test/mjsunit/modules-namespace3.mjs
new file mode 100644
index 0000000..5234009
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-namespace3.mjs
@@ -0,0 +1,9 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import * as foo from "modules-namespace3.mjs";
+export * from "modules-namespace3.mjs";
+export var bar;
+assertEquals(["bar", "default"], Object.getOwnPropertyNames(foo));
+export default function() {};
diff --git a/src/v8/test/mjsunit/modules-namespace4.mjs b/src/v8/test/mjsunit/modules-namespace4.mjs
new file mode 100644
index 0000000..93c577c
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-namespace4.mjs
@@ -0,0 +1,57 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import * as foo from "modules-namespace4.mjs";
+
+assertSame(undefined, a);
+assertThrows(() => b, ReferenceError);
+assertThrows(() => B, ReferenceError);
+assertThrows(() => c, ReferenceError);
+assertEquals(45, d());
+
+assertSame(undefined, foo.a);
+assertThrows(() => foo.b, ReferenceError);
+assertThrows(() => foo.B, ReferenceError);
+assertThrows(() => foo.c, ReferenceError);
+assertEquals(45, foo.d());
+assertThrows(() => foo.default, ReferenceError);
+assertSame(undefined, foo.doesnotexist);
+
+Function("Foo", " \
+    with (Foo) { \
+      assertEquals(undefined, a); \
+      assertThrows(() => b, ReferenceError); \
+      assertThrows(() => B, ReferenceError); \
+      assertThrows(() => c, ReferenceError); \
+      assertEquals(45, d()); \
+    }")(foo);
+
+export var a = 42;
+export let b = 43;
+export {b as B};
+export const c = 44;
+export function d() { return 45 };
+export default 46;
+
+assertEquals(42, a);
+assertEquals(43, b);
+assertEquals(44, c);
+assertEquals(45, d());
+
+assertEquals(42, foo.a);
+assertEquals(43, foo.b);
+assertEquals(43, foo.B);
+assertEquals(44, foo.c);
+assertEquals(45, foo.d());
+assertEquals(46, foo.default);
+assertSame(undefined, foo.doesnotexist);
+
+Function("Foo", " \
+    with (Foo) { \
+      assertEquals(42, a); \
+      assertEquals(43, b); \
+      assertEquals(43, B); \
+      assertEquals(44, c); \
+      assertEquals(45, d()); \
+    }")(foo);
diff --git a/src/v8/test/mjsunit/modules-preparse.mjs b/src/v8/test/mjsunit/modules-preparse.mjs
new file mode 100644
index 0000000..3eb0b17
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-preparse.mjs
@@ -0,0 +1,9 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let foo = 42;
+function testFoo(x) { assertEquals(x, foo); }
+testFoo(42);
+foo++;
+testFoo(43);
diff --git a/src/v8/test/mjsunit/modules-relative-path.mjs b/src/v8/test/mjsunit/modules-relative-path.mjs
new file mode 100644
index 0000000..f400bc0
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-relative-path.mjs
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import {x as y} from "./modules-relative-path.mjs";
+export let x = 0;
+
+assertEquals(0, x);
+assertEquals(x, y);
+x++;
+assertEquals(1, x);
+assertEquals(x, y);
diff --git a/src/v8/test/mjsunit/modules-skip-1.mjs b/src/v8/test/mjsunit/modules-skip-1.mjs
new file mode 100644
index 0000000..3573180
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-skip-1.mjs
@@ -0,0 +1,9 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export default 42;
+export let a = 1;
+export {a as b};
+export function set_a(x) { a = x };
+export function get_a() { return a };
diff --git a/src/v8/test/mjsunit/modules-skip-2.mjs b/src/v8/test/mjsunit/modules-skip-2.mjs
new file mode 100644
index 0000000..352690a
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-skip-2.mjs
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export {a as b, default} from "modules-skip-1.mjs";
+import {a as tmp} from "modules-skip-1.mjs";
+export {tmp as c};
+export const zzz = 999;
diff --git a/src/v8/test/mjsunit/modules-skip-3.mjs b/src/v8/test/mjsunit/modules-skip-3.mjs
new file mode 100644
index 0000000..7668299
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-skip-3.mjs
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import {b} from "modules-imports5.mjs";
+export let a = 22;
+assertSame(undefined, b);
+assertEquals(22, a);
diff --git a/src/v8/test/mjsunit/modules-skip-4.mjs b/src/v8/test/mjsunit/modules-skip-4.mjs
new file mode 100644
index 0000000..3549fd1
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-skip-4.mjs
@@ -0,0 +1,6 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export * from "modules-skip-1.mjs";
+export * from "modules-skip-2.mjs";
diff --git a/src/v8/test/mjsunit/modules-skip-5.mjs b/src/v8/test/mjsunit/modules-skip-5.mjs
new file mode 100644
index 0000000..6a1ef49
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-skip-5.mjs
@@ -0,0 +1,5 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export function a() { return "ooo" }
diff --git a/src/v8/test/mjsunit/modules-skip-6.mjs b/src/v8/test/mjsunit/modules-skip-6.mjs
new file mode 100644
index 0000000..c6d400c
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-skip-6.mjs
@@ -0,0 +1,7 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export * from "modules-skip-1.mjs";
+export * from "modules-skip-5.mjs";
+export const a = 10;
diff --git a/src/v8/test/mjsunit/modules-skip-7.mjs b/src/v8/test/mjsunit/modules-skip-7.mjs
new file mode 100644
index 0000000..4515128
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-skip-7.mjs
@@ -0,0 +1,6 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export * from "modules-skip-1.mjs"
+export * from "modules-skip-5.mjs"
diff --git a/src/v8/test/mjsunit/modules-skip-8.mjs b/src/v8/test/mjsunit/modules-skip-8.mjs
new file mode 100644
index 0000000..8b1d981
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-skip-8.mjs
@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export * as foo from "./modules-skip-1.mjs";
diff --git a/src/v8/test/mjsunit/modules-skip-9.mjs b/src/v8/test/mjsunit/modules-skip-9.mjs
new file mode 100644
index 0000000..3eb53ac
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-skip-9.mjs
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import * as b from "./modules-skip-1.mjs";
+export {b};
+export * as a from "./modules-skip-1.mjs";
diff --git a/src/v8/test/mjsunit/modules-skip-circular-valid.mjs b/src/v8/test/mjsunit/modules-skip-circular-valid.mjs
new file mode 100644
index 0000000..a408dd6
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-skip-circular-valid.mjs
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export let a = {key: 'value'};
+import {b} from "modules-circular-valid.mjs";
+assertSame(a, b);
+assertEquals('value', a.key);
diff --git a/src/v8/test/mjsunit/modules-skip-cycle.mjs b/src/v8/test/mjsunit/modules-skip-cycle.mjs
new file mode 100644
index 0000000..0d0f41a
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-skip-cycle.mjs
@@ -0,0 +1,5 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export {foo} from "modules-cycle.mjs";
diff --git a/src/v8/test/mjsunit/modules-skip-default-name1.mjs b/src/v8/test/mjsunit/modules-skip-default-name1.mjs
new file mode 100644
index 0000000..30a95cd
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-skip-default-name1.mjs
@@ -0,0 +1,5 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export default function gaga() {}
diff --git a/src/v8/test/mjsunit/modules-skip-default-name2.mjs b/src/v8/test/mjsunit/modules-skip-default-name2.mjs
new file mode 100644
index 0000000..a064b05
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-skip-default-name2.mjs
@@ -0,0 +1,5 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export default (function gaga() {})
diff --git a/src/v8/test/mjsunit/modules-skip-default-name3.mjs b/src/v8/test/mjsunit/modules-skip-default-name3.mjs
new file mode 100644
index 0000000..ed26e46
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-skip-default-name3.mjs
@@ -0,0 +1,5 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export default (function () {})
diff --git a/src/v8/test/mjsunit/modules-skip-default-name4.mjs b/src/v8/test/mjsunit/modules-skip-default-name4.mjs
new file mode 100644
index 0000000..1c569be
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-skip-default-name4.mjs
@@ -0,0 +1,5 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export default class Gaga { }
diff --git a/src/v8/test/mjsunit/modules-skip-default-name5.mjs b/src/v8/test/mjsunit/modules-skip-default-name5.mjs
new file mode 100644
index 0000000..df72336
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-skip-default-name5.mjs
@@ -0,0 +1,5 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export default (class Gaga { })
diff --git a/src/v8/test/mjsunit/modules-skip-default-name6.mjs b/src/v8/test/mjsunit/modules-skip-default-name6.mjs
new file mode 100644
index 0000000..02f5629
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-skip-default-name6.mjs
@@ -0,0 +1,5 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export default (class { })
diff --git a/src/v8/test/mjsunit/modules-skip-default-name7.mjs b/src/v8/test/mjsunit/modules-skip-default-name7.mjs
new file mode 100644
index 0000000..e4400ca
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-skip-default-name7.mjs
@@ -0,0 +1,5 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export default (class { static name() {return "yo"} })
diff --git a/src/v8/test/mjsunit/modules-skip-default-name8.mjs b/src/v8/test/mjsunit/modules-skip-default-name8.mjs
new file mode 100644
index 0000000..83e1ae4
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-skip-default-name8.mjs
@@ -0,0 +1,5 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export default function() { }
diff --git a/src/v8/test/mjsunit/modules-skip-default-name9.mjs b/src/v8/test/mjsunit/modules-skip-default-name9.mjs
new file mode 100644
index 0000000..ac166f3
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-skip-default-name9.mjs
@@ -0,0 +1,5 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export default class { }
diff --git a/src/v8/test/mjsunit/modules-skip-empty-import-aux.mjs b/src/v8/test/mjsunit/modules-skip-empty-import-aux.mjs
new file mode 100644
index 0000000..1eb5b15
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-skip-empty-import-aux.mjs
@@ -0,0 +1,6 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export let counter = 0;
+export function incr() { counter++ };
diff --git a/src/v8/test/mjsunit/modules-skip-empty-import.mjs b/src/v8/test/mjsunit/modules-skip-empty-import.mjs
new file mode 100644
index 0000000..b45c7c7
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-skip-empty-import.mjs
@@ -0,0 +1,6 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import {incr} from "modules-skip-empty-import-aux.mjs";
+incr();
diff --git a/src/v8/test/mjsunit/modules-skip-init1.mjs b/src/v8/test/mjsunit/modules-skip-init1.mjs
new file mode 100644
index 0000000..c8b3dd1
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-skip-init1.mjs
@@ -0,0 +1,6 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import {bar} from "modules-init1.mjs";
+assertEquals(42, bar());
diff --git a/src/v8/test/mjsunit/modules-skip-init3.mjs b/src/v8/test/mjsunit/modules-skip-init3.mjs
new file mode 100644
index 0000000..2362e00
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-skip-init3.mjs
@@ -0,0 +1,26 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import {v, w, x, y, z} from "modules-init3.mjs";
+
+assertEquals({value: 40, done: true}, v().next());
+assertSame(undefined, w);
+assertThrows(() => x, ReferenceError);
+assertThrows(() => y, ReferenceError);
+assertThrows(() => z, ReferenceError);
+
+assertThrows(() => v = 666, TypeError);
+assertThrows(() => w = 666, TypeError);
+assertThrows(() => x = 666, TypeError);
+assertThrows(() => y = 666, TypeError);
+assertThrows(() => z = 666, TypeError);
+
+export function check() {
+  assertEquals({value: 40, done: true}, v().next());
+  assertEquals(41, w);
+  assertEquals(42, x);
+  assertEquals("y", y.name);
+  assertEquals("hello world", z);
+  return true;
+}
diff --git a/src/v8/test/mjsunit/modules-skip-init4a.mjs b/src/v8/test/mjsunit/modules-skip-init4a.mjs
new file mode 100644
index 0000000..3d1f068
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-skip-init4a.mjs
@@ -0,0 +1,8 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import {foo, ns} from "./modules-init4.mjs"
+assertEquals(foo(), 42)
+assertEquals(ns.foo(), 42)
+assertSame(foo, ns.foo)
diff --git a/src/v8/test/mjsunit/modules-skip-init4b.mjs b/src/v8/test/mjsunit/modules-skip-init4b.mjs
new file mode 100644
index 0000000..36225f0
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-skip-init4b.mjs
@@ -0,0 +1,7 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import * as ns from "./modules-skip-init4b.mjs"
+export function foo() { return 42 }
+export {ns}
diff --git a/src/v8/test/mjsunit/modules-skip-namespace.mjs b/src/v8/test/mjsunit/modules-skip-namespace.mjs
new file mode 100644
index 0000000..7cd90ec
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-skip-namespace.mjs
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+//assertEquals(
+//    ["ns", Symbol.toStringTag, Symbol.iterator], Reflect.ownKeys(ns2));
+//assertEquals(["ns"], [...ns2]);
+
+export * from "modules-skip-4.mjs";
+export * from "modules-skip-5.mjs";
+export var zzz = 123;
+export {ns2};
+import * as ns2 from "modules-namespace2.mjs";
diff --git a/src/v8/test/mjsunit/modules-skip-star-exports-conflict.mjs b/src/v8/test/mjsunit/modules-skip-star-exports-conflict.mjs
new file mode 100644
index 0000000..f68ac1f
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-skip-star-exports-conflict.mjs
@@ -0,0 +1,6 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export * from "modules-skip-1.mjs";
+export * from "modules-skip-5.mjs";
diff --git a/src/v8/test/mjsunit/modules-skip-star-exports-cycle.mjs b/src/v8/test/mjsunit/modules-skip-star-exports-cycle.mjs
new file mode 100644
index 0000000..5ad76ce
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-skip-star-exports-cycle.mjs
@@ -0,0 +1,6 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export * from "modules-skip-star-exports-cycle.mjs";
+export * from "modules-star-exports-cycle.mjs";
diff --git a/src/v8/test/mjsunit/modules-star-exports-cycle.mjs b/src/v8/test/mjsunit/modules-star-exports-cycle.mjs
new file mode 100644
index 0000000..72a037e
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-star-exports-cycle.mjs
@@ -0,0 +1,9 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const bar = 42;
+export {bar as foo};
+
+import {foo} from "modules-skip-star-exports-cycle.mjs";
+assertEquals(42, foo);
diff --git a/src/v8/test/mjsunit/modules-this.mjs b/src/v8/test/mjsunit/modules-this.mjs
new file mode 100644
index 0000000..9c736c2
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-this.mjs
@@ -0,0 +1,5 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals(undefined, this);
diff --git a/src/v8/test/mjsunit/modules-turbo1.mjs b/src/v8/test/mjsunit/modules-turbo1.mjs
new file mode 100644
index 0000000..b814b48
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-turbo1.mjs
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+// Flags: --allow-natives-syntax --opt --turbo-filter=*
+
+export let x = 0;
+function foo() { x++ };
+%PrepareFunctionForOptimization(foo);
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
+assertOptimized(foo);
+assertEquals(2, x);
diff --git a/src/v8/test/mjsunit/modules-turbo2.mjs b/src/v8/test/mjsunit/modules-turbo2.mjs
new file mode 100644
index 0000000..172f33b
--- /dev/null
+++ b/src/v8/test/mjsunit/modules-turbo2.mjs
@@ -0,0 +1,16 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+// Flags: --allow-natives-syntax
+
+export let x = 0;
+
+function foo() { return x++ };
+
+function gaga(f) { return f() };
+
+%PrepareFunctionForOptimization(gaga);
+assertEquals(0, gaga(foo));
+assertEquals(1, gaga(foo));
+%OptimizeFunctionOnNextCall(gaga);
+assertEquals(2, gaga(foo));
diff --git a/src/v8/test/mjsunit/nans.js b/src/v8/test/mjsunit/nans.js
index 5630e5b..ddd6e4c 100644
--- a/src/v8/test/mjsunit/nans.js
+++ b/src/v8/test/mjsunit/nans.js
@@ -36,6 +36,7 @@
 // Test that both kinds of NaNs (signaling or quiet) do not signal
 
 function TestAllModes(f) {
+  %PrepareFunctionForOptimization(f);
   f(); // Runtime
   f(); // IC
   f(); // IC second time
diff --git a/src/v8/test/mjsunit/neuter-twice.js b/src/v8/test/mjsunit/neuter-twice.js
index 3501cee..1bf0fa9 100644
--- a/src/v8/test/mjsunit/neuter-twice.js
+++ b/src/v8/test/mjsunit/neuter-twice.js
@@ -5,5 +5,5 @@
 // Flags: --allow-natives-syntax
 
 var ab = new ArrayBuffer(100);
-%ArrayBufferNeuter(ab);
-%ArrayBufferNeuter(ab);
+%ArrayBufferDetach(ab);
+%ArrayBufferDetach(ab);
diff --git a/src/v8/test/mjsunit/never-optimize.js b/src/v8/test/mjsunit/never-optimize.js
index 5efaa47..f2b764e 100644
--- a/src/v8/test/mjsunit/never-optimize.js
+++ b/src/v8/test/mjsunit/never-optimize.js
@@ -29,6 +29,7 @@
 
 function o1() {
 }
+%PrepareFunctionForOptimization(o1);
 
 o1(); o1();
 %OptimizeFunctionOnNextCall(o1);
@@ -45,6 +46,8 @@
 function u2() {
   u1();
 }
+%PrepareFunctionForOptimization(u1);
+%PrepareFunctionForOptimization(u2);
 
 u1(); u1();
 u2(); u2();
diff --git a/src/v8/test/mjsunit/non-extensible-array-reduce.js b/src/v8/test/mjsunit/non-extensible-array-reduce.js
new file mode 100644
index 0000000..1bc87b7
--- /dev/null
+++ b/src/v8/test/mjsunit/non-extensible-array-reduce.js
@@ -0,0 +1,1420 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+/**
+ * @fileoverview Test reduce and reduceRight
+ */
+
+function clone(v) {
+  // Shallow-copies arrays, returns everything else verbatim.
+  if (v instanceof Array) {
+    // Shallow-copy an array.
+    var newArray = new Array(v.length);
+    for (var i in v) {
+      newArray[i] = v[i];
+    }
+    return newArray;
+  }
+  return v;
+}
+
+
+// Creates a callback function for reduce/reduceRight that tests the number
+// of arguments and otherwise behaves as "func", but which also
+// records all calls in an array on the function (as arrays of arguments
+// followed by result).
+function makeRecorder(func, testName) {
+  var record = [];
+  var f = function recorder(a, b, i, s) {
+    assertEquals(4, arguments.length,
+                 testName + "(number of arguments: " + arguments.length + ")");
+    assertEquals("number", typeof(i), testName + "(index must be number)");
+    assertEquals(s[i], b, testName + "(current argument is at index)");
+    if (record.length > 0) {
+      var prevRecord = record[record.length - 1];
+      var prevResult = prevRecord[prevRecord.length - 1];
+      assertEquals(prevResult, a,
+                   testName + "(prev result -> current input)");
+    }
+    var args = [clone(a), clone(b), i, clone(s)];
+    var result = func.apply(this, arguments);
+    args.push(clone(result));
+    record.push(args);
+    return result;
+  };
+  f.record = record;
+  return f;
+}
+
+
+function testReduce(type,
+                    testName,
+                    expectedResult,
+                    expectedCalls,
+                    array,
+                    combine,
+                    init) {
+  var rec = makeRecorder(combine);
+  var result;
+  if (arguments.length > 6) {
+    result = array[type](rec, init);
+  } else {
+    result = array[type](rec);
+  }
+  var calls = rec.record;
+  assertEquals(expectedCalls.length, calls.length,
+               testName + " (number of calls)");
+  for (var i = 0; i < expectedCalls.length; i++) {
+    assertEquals(expectedCalls[i], calls[i],
+                 testName + " (call " + (i + 1) + ")");
+  }
+  assertEquals(expectedResult, result, testName + " (result)");
+}
+
+
+function sum(a, b) { return Number(a) + Number(b); }
+function prod(a, b) { return Number(a) * Number(b); }
+function dec(a, b, i, arr) { return Number(a) + Number(b) * Math.pow(10, arr.length - i - 1); }
+function accumulate(acc, elem, i) { acc[i] = elem; return acc; }
+
+// ---- Test Reduce[Left]
+
+var simpleArray = ['2',4,6];
+Object.preventExtensions(simpleArray);
+
+testReduce("reduce", "SimpleReduceSum", 12,
+           [[0, '2', 0, simpleArray, 2],
+            [2, 4, 1, simpleArray, 6],
+            [6, 6, 2, simpleArray, 12]],
+           simpleArray, sum, 0);
+
+testReduce("reduce", "SimpleReduceProd", 48,
+           [[1, '2', 0, simpleArray, 2],
+            [2, 4, 1, simpleArray, 8],
+            [8, 6, 2, simpleArray, 48]],
+           simpleArray, prod, 1);
+
+testReduce("reduce", "SimpleReduceDec", 246,
+           [[0, '2', 0, simpleArray, 200],
+            [200, 4, 1, simpleArray, 240],
+            [240, 6, 2, simpleArray, 246]],
+           simpleArray, dec, 0);
+
+testReduce("reduce", "SimpleReduceAccumulate", simpleArray,
+           [[[], '2', 0, simpleArray, ['2']],
+            [['2'], 4, 1, simpleArray, ['2', 4]],
+            [['2', 4], 6, 2, simpleArray, simpleArray]],
+           simpleArray, accumulate, []);
+
+var emptyArray = [];
+Object.preventExtensions(emptyArray);
+
+testReduce("reduce", "EmptyReduceSum", 0, [], emptyArray, sum, 0);
+testReduce("reduce", "EmptyReduceProd", 1, [], emptyArray, prod, 1);
+testReduce("reduce", "EmptyReduceDec", 0, [], emptyArray, dec, 0);
+testReduce("reduce", "EmptyReduceAccumulate", [], [], emptyArray, accumulate, []);
+
+testReduce("reduce", "EmptyReduceSumNoInit", 0, emptyArray, [0], sum);
+testReduce("reduce", "EmptyReduceProdNoInit", 1, emptyArray, [1], prod);
+testReduce("reduce", "EmptyReduceDecNoInit", 0, emptyArray, [0], dec);
+testReduce("reduce", "EmptyReduceAccumulateNoInit", [], emptyArray, [[]], accumulate);
+
+
+var simpleSparseArray = [,,,'2',,4,,6,,];
+Object.preventExtensions(simpleSparseArray);
+
+testReduce("reduce", "SimpleSparseReduceSum", 12,
+           [[0, '2', 3, simpleSparseArray, 2],
+            [2, 4, 5, simpleSparseArray, 6],
+            [6, 6, 7, simpleSparseArray, 12]],
+           simpleSparseArray, sum, 0);
+
+testReduce("reduce", "SimpleSparseReduceProd", 48,
+           [[1, '2', 3, simpleSparseArray, 2],
+            [2, 4, 5, simpleSparseArray, 8],
+            [8, 6, 7, simpleSparseArray, 48]],
+           simpleSparseArray, prod, 1);
+
+testReduce("reduce", "SimpleSparseReduceDec", 204060,
+           [[0, '2', 3, simpleSparseArray, 200000],
+            [200000, 4, 5, simpleSparseArray, 204000],
+            [204000, 6, 7, simpleSparseArray, 204060]],
+           simpleSparseArray, dec, 0);
+
+testReduce("reduce", "SimpleSparseReduceAccumulate", [,,,'2',,4,,6],
+           [[[], '2', 3, simpleSparseArray, [,,,'2']],
+            [[,,,'2'], 4, 5, simpleSparseArray, [,,,'2',,4]],
+            [[,,,'2',,4], 6, 7, simpleSparseArray, [,,,'2',,4,,6]]],
+           simpleSparseArray, accumulate, []);
+
+
+testReduce("reduce", "EmptySparseReduceSumNoInit", 0, [], [,,0,,], sum);
+testReduce("reduce", "EmptySparseReduceProdNoInit", 1, [], [,,1,,], prod);
+testReduce("reduce", "EmptySparseReduceDecNoInit", 0, [], [,,0,,], dec);
+testReduce("reduce", "EmptySparseReduceAccumulateNoInit",
+           [], [], [,,[],,], accumulate);
+
+
+var verySparseArray = [];
+verySparseArray.length = 10000;
+verySparseArray[2000] = '2';
+verySparseArray[5000] = 4;
+verySparseArray[9000] = 6;
+var verySparseSlice2 = verySparseArray.slice(0, 2001);
+var verySparseSlice4 = verySparseArray.slice(0, 5001);
+var verySparseSlice6 = verySparseArray.slice(0, 9001);
+Object.preventExtensions(verySparseArray);
+
+testReduce("reduce", "VerySparseReduceSum", 12,
+           [[0, '2', 2000, verySparseArray, 2],
+            [2, 4, 5000, verySparseArray, 6],
+            [6, 6, 9000, verySparseArray, 12]],
+           verySparseArray, sum, 0);
+
+testReduce("reduce", "VerySparseReduceProd", 48,
+           [[1, '2', 2000, verySparseArray, 2],
+            [2, 4, 5000, verySparseArray, 8],
+            [8, 6, 9000, verySparseArray, 48]],
+           verySparseArray, prod, 1);
+
+testReduce("reduce", "VerySparseReduceDec", Infinity,
+           [[0, '2', 2000, verySparseArray, Infinity],
+            [Infinity, 4, 5000, verySparseArray, Infinity],
+            [Infinity, 6, 9000, verySparseArray, Infinity]],
+           verySparseArray, dec, 0);
+
+testReduce("reduce", "VerySparseReduceAccumulate",
+           verySparseSlice6,
+           [[[], '2', 2000, verySparseArray, verySparseSlice2],
+            [verySparseSlice2, 4, 5000, verySparseArray, verySparseSlice4],
+            [verySparseSlice4, 6, 9000, verySparseArray, verySparseSlice6]],
+           verySparseArray, accumulate, []);
+
+
+testReduce("reduce", "VerySparseReduceSumNoInit", 12,
+           [['2', 4, 5000, verySparseArray, 6],
+            [6, 6, 9000, verySparseArray, 12]],
+           verySparseArray, sum);
+
+testReduce("reduce", "VerySparseReduceProdNoInit", 48,
+           [['2', 4, 5000, verySparseArray, 8],
+            [8, 6, 9000, verySparseArray, 48]],
+           verySparseArray, prod);
+
+testReduce("reduce", "VerySparseReduceDecNoInit", Infinity,
+           [['2', 4, 5000, verySparseArray, Infinity],
+            [Infinity, 6, 9000, verySparseArray, Infinity]],
+           verySparseArray, dec);
+
+testReduce("reduce", "SimpleSparseReduceAccumulateNoInit",
+           '2',
+           [['2', 4, 5000, verySparseArray, '2'],
+            ['2', 6, 9000, verySparseArray, '2']],
+           verySparseArray, accumulate);
+
+
+// ---- Test ReduceRight
+
+testReduce("reduceRight", "SimpleReduceRightSum", 12,
+           [[0, 6, 2, simpleArray, 6],
+            [6, 4, 1, simpleArray, 10],
+            [10, '2', 0, simpleArray, 12]],
+           simpleArray, sum, 0);
+
+testReduce("reduceRight", "SimpleReduceRightProd", 48,
+           [[1, 6, 2, simpleArray, 6],
+            [6, 4, 1, simpleArray, 24],
+            [24, '2', 0, simpleArray, 48]],
+           simpleArray, prod, 1);
+
+testReduce("reduceRight", "SimpleReduceRightDec", 246,
+           [[0, 6, 2, simpleArray, 6],
+            [6, 4, 1, simpleArray, 46],
+            [46, '2', 0, simpleArray, 246]],
+           simpleArray, dec, 0);
+
+testReduce("reduceRight", "SimpleReduceRightAccumulate", simpleArray,
+           [[[], 6, 2, simpleArray, [,,6]],
+            [[,,6], 4, 1, simpleArray, [,4,6]],
+            [[,4,6], '2', 0, simpleArray, simpleArray]],
+           simpleArray, accumulate, []);
+
+
+testReduce("reduceRight", "EmptyReduceRightSum", 0, [], [], sum, 0);
+testReduce("reduceRight", "EmptyReduceRightProd", 1, [], [], prod, 1);
+testReduce("reduceRight", "EmptyReduceRightDec", 0, [], [], dec, 0);
+testReduce("reduceRight", "EmptyReduceRightAccumulate", [],
+           [], [], accumulate, []);
+
+testReduce("reduceRight", "EmptyReduceRightSumNoInit", 0, [], [0], sum);
+testReduce("reduceRight", "EmptyReduceRightProdNoInit", 1, [], [1], prod);
+testReduce("reduceRight", "EmptyReduceRightDecNoInit", 0, [], [0], dec);
+testReduce("reduceRight", "EmptyReduceRightAccumulateNoInit",
+           [], [], [[]], accumulate);
+
+
+testReduce("reduceRight", "SimpleSparseReduceRightSum", 12,
+           [[0, 6, 7, simpleSparseArray, 6],
+            [6, 4, 5, simpleSparseArray, 10],
+            [10, '2', 3, simpleSparseArray, 12]],
+           simpleSparseArray, sum, 0);
+
+testReduce("reduceRight", "SimpleSparseReduceRightProd", 48,
+           [[1, 6, 7, simpleSparseArray, 6],
+            [6, 4, 5, simpleSparseArray, 24],
+            [24, '2', 3, simpleSparseArray, 48]],
+           simpleSparseArray, prod, 1);
+
+testReduce("reduceRight", "SimpleSparseReduceRightDec", 204060,
+           [[0, 6, 7, simpleSparseArray, 60],
+            [60, 4, 5, simpleSparseArray, 4060],
+            [4060, '2', 3, simpleSparseArray, 204060]],
+           simpleSparseArray, dec, 0);
+
+testReduce("reduceRight", "SimpleSparseReduceRightAccumulate", [,,,'2',,4,,6],
+           [[[], 6, 7, simpleSparseArray, [,,,,,,,6]],
+            [[,,,,,,,6], 4, 5, simpleSparseArray, [,,,,,4,,6]],
+            [[,,,,,4,,6], '2', 3, simpleSparseArray, [,,,'2',,4,,6]]],
+           simpleSparseArray, accumulate, []);
+
+
+testReduce("reduceRight", "EmptySparseReduceRightSumNoInit",
+           0, [], [,,0,,], sum);
+testReduce("reduceRight", "EmptySparseReduceRightProdNoInit",
+           1, [], [,,1,,], prod);
+testReduce("reduceRight", "EmptySparseReduceRightDecNoInit",
+           0, [], [,,0,,], dec);
+testReduce("reduceRight", "EmptySparseReduceRightAccumulateNoInit",
+           [], [], [,,[],,], accumulate);
+
+
+var verySparseSuffix6 = [];
+verySparseSuffix6[9000] = 6;
+var verySparseSuffix4 = [];
+verySparseSuffix4[5000] = 4;
+verySparseSuffix4[9000] = 6;
+var verySparseSuffix2 = verySparseSlice6;
+
+
+testReduce("reduceRight", "VerySparseReduceRightSum", 12,
+           [[0, 6, 9000, verySparseArray, 6],
+            [6, 4, 5000, verySparseArray, 10],
+            [10, '2', 2000, verySparseArray, 12]],
+           verySparseArray, sum, 0);
+
+testReduce("reduceRight", "VerySparseReduceRightProd", 48,
+           [[1, 6, 9000, verySparseArray, 6],
+            [6, 4, 5000, verySparseArray, 24],
+            [24, '2', 2000, verySparseArray, 48]],
+           verySparseArray, prod, 1);
+
+testReduce("reduceRight", "VerySparseReduceRightDec", Infinity,
+           [[0, 6, 9000, verySparseArray, Infinity],
+            [Infinity, 4, 5000, verySparseArray, Infinity],
+            [Infinity, '2', 2000, verySparseArray, Infinity]],
+           verySparseArray, dec, 0);
+
+testReduce("reduceRight", "VerySparseReduceRightAccumulate",
+           verySparseSuffix2,
+           [[[], 6, 9000, verySparseArray, verySparseSuffix6],
+            [verySparseSuffix6, 4, 5000, verySparseArray, verySparseSuffix4],
+            [verySparseSuffix4, '2', 2000, verySparseArray, verySparseSuffix2]],
+           verySparseArray, accumulate, []);
+
+
+testReduce("reduceRight", "VerySparseReduceRightSumNoInit", 12,
+           [[6, 4, 5000, verySparseArray, 10],
+            [10, '2', 2000, verySparseArray, 12]],
+           verySparseArray, sum);
+
+testReduce("reduceRight", "VerySparseReduceRightProdNoInit", 48,
+           [[6, 4, 5000, verySparseArray, 24],
+            [24, '2', 2000, verySparseArray, 48]],
+           verySparseArray, prod);
+
+testReduce("reduceRight", "VerySparseReduceRightDecNoInit", Infinity,
+           [[6, 4, 5000, verySparseArray, Infinity],
+            [Infinity, '2', 2000, verySparseArray, Infinity]],
+           verySparseArray, dec);
+
+testReduce("reduceRight", "SimpleSparseReduceRightAccumulateNoInit",
+           6,
+           [[6, 4, 5000, verySparseArray, 6],
+            [6, '2', 2000, verySparseArray, 6]],
+           verySparseArray, accumulate);
+
+
+// undefined is an element
+var undefArray = [,,undefined,,undefined,,];
+Object.preventExtensions(undefArray);
+
+testReduce("reduce", "SparseUndefinedReduceAdd", NaN,
+           [[0, undefined, 2, undefArray, NaN],
+            [NaN, undefined, 4, undefArray, NaN],
+           ],
+           undefArray, sum, 0);
+
+testReduce("reduceRight", "SparseUndefinedReduceRightAdd", NaN,
+           [[0, undefined, 4, undefArray, NaN],
+            [NaN, undefined, 2, undefArray, NaN],
+           ], undefArray, sum, 0);
+
+testReduce("reduce", "SparseUndefinedReduceAddNoInit", NaN,
+           [[undefined, undefined, 4, undefArray, NaN],
+           ], undefArray, sum);
+
+testReduce("reduceRight", "SparseUndefinedReduceRightAddNoInit", NaN,
+           [[undefined, undefined, 2, undefArray, NaN],
+           ], undefArray, sum);
+
+
+// Ignore non-array properties:
+
+var arrayPlus = [1,'2',,3];
+arrayPlus[-1] = NaN;
+arrayPlus[Math.pow(2,32)] = NaN;
+arrayPlus[NaN] = NaN;
+arrayPlus["00"] = NaN;
+arrayPlus["02"] = NaN;
+arrayPlus["-0"] = NaN;
+Object.preventExtensions(arrayPlus);
+
+testReduce("reduce", "ArrayWithNonElementPropertiesReduce", 6,
+           [[0, 1, 0, arrayPlus, 1],
+            [1, '2', 1, arrayPlus, 3],
+            [3, 3, 3, arrayPlus, 6],
+           ], arrayPlus, sum, 0);
+
+testReduce("reduceRight", "ArrayWithNonElementPropertiesReduceRight", 6,
+           [[0, 3, 3, arrayPlus, 3],
+            [3, '2', 1, arrayPlus, 5],
+            [5, 1, 0, arrayPlus, 6],
+           ], arrayPlus, sum, 0);
+
+// Test passing undefined as initial value (to test missing parameter
+// detection).
+Object.preventExtensions(['1']).reduce((a, b) => { assertEquals(a, undefined); assertEquals(b, '1') },
+           undefined);
+Object.preventExtensions(['1', 2]).reduce((a, b) => { assertEquals(a, '1'); assertEquals(b, 2); });
+Object.preventExtensions(['1']).reduce((a, b) => { assertTrue(false); });
+
+// Test error conditions:
+
+var exception = false;
+try {
+  Object.preventExtensions(['1']).reduce("not a function");
+} catch (e) {
+  exception = true;
+  assertTrue(e instanceof TypeError,
+             "reduce callback not a function not throwing TypeError");
+  assertTrue(e.message.indexOf(" is not a function") >= 0,
+             "reduce non function TypeError type");
+}
+assertTrue(exception);
+
+exception = false;
+try {
+  Object.preventExtensions(['1']).reduceRight("not a function");
+} catch (e) {
+  exception = true;
+  assertTrue(e instanceof TypeError,
+             "reduceRight callback not a function not throwing TypeError");
+  assertTrue(e.message.indexOf(" is not a function") >= 0,
+             "reduceRight non function TypeError type");
+}
+assertTrue(exception);
+
+exception = false;
+try {
+  Object.preventExtensions([]).reduce(sum);
+} catch (e) {
+  exception = true;
+  assertTrue(e instanceof TypeError,
+             "reduce no initial value not throwing TypeError");
+  assertEquals("Reduce of empty array with no initial value", e.message,
+               "reduce no initial TypeError type");
+}
+assertTrue(exception);
+
+exception = false;
+try {
+  Object.preventExtensions([]).reduceRight(sum);
+} catch (e) {
+  exception = true;
+  assertTrue(e instanceof TypeError,
+             "reduceRight no initial value not throwing TypeError");
+  assertEquals("Reduce of empty array with no initial value", e.message,
+               "reduceRight no initial TypeError type");
+}
+assertTrue(exception);
+
+exception = false;
+try {
+  Object.preventExtensions([,,,]).reduce(sum);
+} catch (e) {
+  exception = true;
+  assertTrue(e instanceof TypeError,
+             "reduce sparse no initial value not throwing TypeError");
+  assertEquals("Reduce of empty array with no initial value", e.message,
+               "reduce no initial TypeError type");
+}
+assertTrue(exception);
+
+exception = false;
+try {
+  Object.preventExtensions([,,,]).reduceRight(sum);
+} catch (e) {
+  exception = true;
+  assertTrue(e instanceof TypeError,
+             "reduceRight sparse no initial value not throwing TypeError");
+  assertEquals("Reduce of empty array with no initial value", e.message,
+               "reduceRight no initial TypeError type");
+}
+assertTrue(exception);
+
+
+// Array changing length
+
+function extender(a, b, i, s) {
+  s[s.length] = s.length;
+  return Number(a) + Number(b);
+}
+
+var arr = [1, '2', 3, 4];
+Object.preventExtensions(arr);
+testReduce("reduce", "ArrayManipulationExtender", 10,
+           [[0, 1, 0, [1, '2', 3, 4], 1],
+            [1, '2', 1, [1, '2', 3, 4], 3],
+            [3, 3, 2, [1, '2', 3, 4], 6],
+            [6, 4, 3, [1, '2', 3, 4], 10],
+           ], arr, extender, 0);
+
+var arr = [];
+Object.defineProperty(arr, "0", { get: function() { delete this[0] },
+  configurable: true });
+assertEquals(undefined, Object.preventExtensions(arr).reduce(function(val) { return val }));
+
+var arr = [];
+Object.defineProperty(arr, "0", { get: function() { delete this[0] },
+  configurable: true});
+assertEquals(undefined, Object.preventExtensions(arr).reduceRight(function(val) { return val }));
+
+
+(function ReduceRightMaxIndex() {
+  const kMaxIndex = 0xffffffff-1;
+  let array = [];
+  array[kMaxIndex-2] = 'value-2';
+  array[kMaxIndex-1] = 'value-1';
+  // Use the maximum array index possible.
+  array[kMaxIndex] = 'value';
+  // Add the next index which is a normal property and thus will not show up.
+  array[kMaxIndex+1] = 'normal property';
+  assertThrowsEquals( () => {
+      Object.preventExtensions(array).reduceRight((sum, value) => {
+        assertEquals('initial', sum);
+        assertEquals('value', value);
+        // Throw at this point as we would very slowly loop down from kMaxIndex.
+        throw 'do not continue';
+      }, 'initial')
+  }, 'do not continue');
+})();
+
+(function OptimizedReduce() {
+  let f = (a,current) => a + Number(current);
+  let g = function(a) {
+    return a.reduce(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  let a = [1,'2',3,4,5,6,7,8,9,10];
+  Object.preventExtensions(a);
+  g(a); g(a);
+  let total = g(a);
+  %OptimizeFunctionOnNextCall(g);
+  assertEquals(total, g(a));
+  assertOptimized(g);
+})();
+
+(function OptimizedReduceEmpty() {
+  let f = (a,current) => a + Number(current);
+  let g = function(a) {
+    return a.reduce(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  let a = [1,'2',3,4,5,6,7,8,9,10];
+  Object.preventExtensions(a);
+  g(a); g(a); g(a);
+  %OptimizeFunctionOnNextCall(g);
+  g(a);
+  assertOptimized(g);
+  assertThrows(() => g([]));
+  assertUnoptimized(g);
+})();
+
+(function OptimizedReduceLazyDeopt() {
+  let deopt = false;
+  let f = (a,current) => { if (deopt) %DeoptimizeNow(); return a + Number(current); };
+  let g = function(a) {
+    return a.reduce(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  let a = [1,'2',3,4,5,6,7,8,9,10];
+  Object.preventExtensions(a);
+  g(a); g(a);
+  let total = g(a);
+  %OptimizeFunctionOnNextCall(g);
+  g(a);
+  assertOptimized(g);
+  deopt = true;
+  assertEquals(total, g(a));
+  assertOptimized(g);
+})();
+
+(function OptimizedReduceLazyDeoptMiddleOfIteration() {
+  let deopt = false;
+  let f = (a,current) => {
+    if (current == 6 && deopt) %DeoptimizeNow();
+    return a + Number(current);
+  };
+  let g = function(a) {
+    return a.reduce(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  let a = [11,'22',33,45,56,6,77,84,93,101];
+  Object.preventExtensions(a);
+  g(a); g(a);
+  let total = g(a);
+  %OptimizeFunctionOnNextCall(g);
+  g(a);
+  assertOptimized(g);
+  deopt = true;
+  assertEquals(total, g(a));
+  assertOptimized(g);
+})();
+
+(function OptimizedReduceEagerDeoptMiddleOfIteration() {
+  let deopt = false;
+  let array = [11,'22',33,45,56,6,77,84,93,101];
+  Object.preventExtensions(array);
+  let f = (a,current) => {
+    if (current == 6 && deopt) {array[0] = 1.5; }
+    return a + Number(current);
+  };
+  let g = function() {
+    return array.reduce(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertOptimized(g);
+  deopt = true;
+  g();
+  %PrepareFunctionForOptimization(g);
+  assertOptimized(g);
+  deopt = false;
+  array = [11,'22',33,45,56,6,77,84,93,101];
+  Object.preventExtensions(array);
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertOptimized(g);
+  deopt = true;
+  assertEquals(total, g());
+  assertOptimized(g);
+})();
+
+(function OptimizedReduceEagerDeoptMiddleOfIterationHoley() {
+  let deopt = false;
+  let array = [, ,11,'22',,33,45,56,,6,77,84,93,101,];
+  Object.preventExtensions(array);
+  let f = (a,current) => {
+    if (current == 6 && deopt) {array[0] = 1.5; }
+    return a + Number(current);
+  };
+  let g = function() {
+    return array.reduce(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertOptimized(g);
+  deopt = true;
+  g();
+  assertOptimized(g);
+  deopt = false;
+  array = [11,'22',33,45,56,6,77,84,93,101];
+  Object.preventExtensions(array);
+  %PrepareFunctionForOptimization(g);
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertUnoptimized(g);
+  deopt = true;
+  assertEquals(total, g());
+  assertUnoptimized(g);
+})();
+
+(function TriggerReduceRightPreLoopDeopt() {
+  function f(a) {
+    a.reduceRight((x) => { return Number(x) + 1 });
+  };
+  %PrepareFunctionForOptimization(f);
+  var arr = Object.preventExtensions([1, '2', ]);
+  f(arr);
+  f(arr);
+  %OptimizeFunctionOnNextCall(f);
+  assertThrows(() => f([]), TypeError);
+  assertUnoptimized(f);
+})();
+
+(function OptimizedReduceRightEagerDeoptMiddleOfIterationHoley() {
+  let deopt = false;
+  let array = [, ,11,'22',,33,45,56,,6,77,84,93,101,];
+  Object.preventExtensions(array);
+  let f = (a,current) => {
+    if (current == 6 && deopt) {array[array.length-1] = 1.5; }
+    return a + Number(current);
+  };
+  let g = function() {
+    return array.reduceRight(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertOptimized(g);
+  deopt = true;
+  g();
+  assertOptimized(g);
+  deopt = false;
+  array = [11,'22',33,45,56,6,77,84,93,101];
+  Object.preventExtensions(array);
+  %PrepareFunctionForOptimization(g);
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertUnoptimized(g);
+  deopt = true;
+  assertEquals(total, g());
+  assertUnoptimized(g);
+})();
+
+(function ReduceCatch() {
+  let f = (a,current) => {
+    return a + current;
+  };
+  let g = function() {
+    try {
+      return Object.preventExtensions(array).reduce(f);
+    } catch (e) {
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  g();
+  assertEquals(total, g());
+  assertOptimized(g);
+})();
+
+(function ReduceThrow() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) throw "x";
+    return a + Number(current);
+  };
+  let array = [1,'2',3];
+  Object.preventExtensions(array);
+  let g = function() {
+    try {
+      return array.reduce(f);
+    } catch (e) {
+      return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceThrow() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) throw "x";
+    return a + Number(current);
+  };
+  %NeverOptimizeFunction(f);
+  let array = [1,'2',3];
+  Object.preventExtensions(array);
+  let g = function() {
+    try {
+      return array.reduce(f);
+    } catch (e) {
+      return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceFinally() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) throw "x";
+    return a + Number(current);
+  };
+  let array = [1,'2',3];
+  Object.preventExtensions(array);
+  let g = function() {
+    try {
+      return array.reduce(f);
+    } catch (e) {
+    } finally {
+      if (done) return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceFinallyNoInline() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) throw "x";
+    return a + Number(current);
+  };
+  %NeverOptimizeFunction(f);
+  let array = [1, '2', 3];
+  Object.preventExtensions(array);
+  let g = function() {
+    try {
+      return array.reduce(f);
+    } catch (e) {
+    } finally {
+      if (done) return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceNonCallableOpt() {
+  let done = false;
+  let f = (a, current) => {
+    return a + Number(current);
+  };
+  let array = [1,'2',3];
+  Object.preventExtensions(array);
+  let g = function() {
+    return array.reduce(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g(); g();
+  assertEquals(6, g());
+  assertOptimized(g);
+  f = null;
+  assertThrows(() => g());
+  assertOptimized(g);
+})();
+
+(function ReduceCatchInlineDeopt() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) {
+      %DeoptimizeNow();
+      throw "x";
+    }
+    return a + Number(current);
+  };
+  let array = [1,2,3];
+  Object.preventExtensions(array);
+  let g = function() {
+    try {
+      return array.reduce(f);
+    } catch (e) {
+      if (done) return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceFinallyInlineDeopt() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) {
+      %DeoptimizeNow();
+      throw "x";
+    }
+    return a + Number(current);
+  };
+  let array = [1,'2',3];
+  Object.preventExtensions(array);
+  let g = function() {
+    try {
+      return array.reduce(f);
+    } catch (e) {
+    } finally {
+      if (done) return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function OptimizedReduceRight() {
+  let count = 0;
+  let f = (a,current,i) => a + Number(current) * ++count;
+  let g = function(a) {
+    count = 0;
+    return a.reduceRight(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  let a = [1,'2',3,4,5,6,7,8,9,10];
+  Object.preventExtensions(a);
+  g(a); g(a);
+  let total = g(a);
+  %OptimizeFunctionOnNextCall(g);
+  assertEquals(total, g(a));
+  assertOptimized(g);
+})();
+
+(function OptimizedReduceEmpty() {
+  let count = 0;
+  let f = (a,current,i) => a + Number(current) * ++count;
+  let g = function(a) {
+    count = 0;
+    return a.reduceRight(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  let a = [1,'2',3,4,5,6,7,8,9,10];
+  Object.preventExtensions(a);
+  g(a); g(a); g(a);
+  %OptimizeFunctionOnNextCall(g);
+  g(a);
+  assertOptimized(g);
+  assertThrows(() => g([]));
+  assertUnoptimized(g);
+})();
+
+(function OptimizedReduceLazyDeopt() {
+  let deopt = false;
+  let f = (a,current) => { if (deopt) %DeoptimizeNow(); return a + Number(current); };
+  let g = function(a) {
+    return a.reduceRight(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  let a = [1,'2',3,4,5,6,7,8,9,10];
+  Object.preventExtensions(a);
+  g(a); g(a);
+  let total = g(a);
+  %OptimizeFunctionOnNextCall(g);
+  g(a);
+  deopt = true;
+  assertEquals(total, g(a));
+  assertOptimized(g);
+})();
+
+(function OptimizedReduceLazyDeoptMiddleOfIteration() {
+  let deopt = false;
+  let f = (a,current) => {
+    if (current == 6 && deopt) %DeoptimizeNow();
+    return a + Number(current);
+  };
+  let g = function(a) {
+    return a.reduceRight(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  let a = [11,'22',33,45,56,6,77,84,93,101];
+  Object.preventExtensions(a);
+  g(a); g(a);
+  let total = g(a);
+  %OptimizeFunctionOnNextCall(g);
+  g(a);
+  deopt = true;
+  assertEquals(total, g(a));
+  assertOptimized(g);
+})();
+
+(function OptimizedReduceEagerDeoptMiddleOfIteration() {
+  let deopt = false;
+  let array = [11,'22',33,45,56,6,77,84,93,101];
+  Object.preventExtensions(array);
+  let f = (a,current) => {
+    if (current == 6 && deopt) {array[9] = 1.5; }
+    return a + Number(current);
+  };
+  let g = function() {
+    return array.reduceRight(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertOptimized(g);
+  deopt = true;
+  g();
+  %PrepareFunctionForOptimization(g);
+  deopt = false;
+  array = [11,'22',33,45,56,6,77,84,93,101];
+  Object.preventExtensions(array);
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  deopt = true;
+  assertEquals(total, g());
+  assertOptimized(g);
+})();
+
+(function ReduceCatch() {
+  let f = (a,current) => {
+    return a + Number(current);
+  };
+  let g = function() {
+    try {
+      return Object.preventExtensions(array).reduceRight(f);
+    } catch (e) {
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  g();
+  assertEquals(total, g());
+  assertOptimized(g);
+})();
+
+(function ReduceThrow() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) throw "x";
+    return a + Number(current);
+  };
+  let array = [1,'2',3];
+  Object.preventExtensions(array);
+  let g = function() {
+    try {
+      return array.reduceRight(f);
+    } catch (e) {
+      return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  assertOptimized(g);
+  done = true;
+  assertEquals(null, g());
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceThrow() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) throw "x";
+    return a + Number(current);
+  };
+  %NeverOptimizeFunction(f);
+  let array = [1,'2',3];
+  Object.preventExtensions(array);
+  let g = function() {
+    try {
+      return array.reduceRight(f);
+    } catch (e) {
+      return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceFinally() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) throw "x";
+    return a + Number(current);
+  };
+  let array = [1, '2', 3];
+  Object.preventExtensions(array);
+  let g = function() {
+    try {
+      return array.reduceRight(f);
+    } catch (e) {
+    } finally {
+      if (done) return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceFinallyNoInline() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) throw "x";
+    return a + Number(current);
+  };
+  %NeverOptimizeFunction(f);
+  let array = [1,'2',3];
+  Object.preventExtensions(array);
+  let g = function() {
+    try {
+      return array.reduceRight(f);
+    } catch (e) {
+    } finally {
+      if (done) return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  assertOptimized(g);
+  done = true;
+  assertEquals(null, g());
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceNonCallableOpt() {
+  let done = false;
+  let f = (a, current) => {
+    return a + Number(current);
+  };
+  let array = [1,'2',3];
+  Object.preventExtensions(array);
+  let g = function() {
+    return array.reduceRight(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g(); g();
+  assertEquals(6, g());
+  f = null;
+  assertThrows(() => g());
+  assertOptimized(g);
+})();
+
+(function ReduceCatchInlineDeopt() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) {
+      %DeoptimizeNow();
+      throw "x";
+    }
+    return a + Number(current);
+  };
+  let array = [1,'2',3];
+  Object.preventExtensions(array);
+  let g = function() {
+    try {
+      return array.reduceRight(f);
+    } catch (e) {
+      if (done) return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceFinallyInlineDeopt() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) {
+      %DeoptimizeNow();
+      throw "x";
+    }
+    return a + Number(current);
+  };
+  let array = [1,'2',3];
+  Object.preventExtensions(array);
+  let g = function() {
+    try {
+      return array.reduceRight(f);
+    } catch (e) {
+    } finally {
+      if (done) return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceHoleyArrayWithDefaultAccumulator() {
+  var holey = new Array(10);
+  Object.preventExtensions(holey);
+  function reduce(a) {
+    let callback = function(accumulator, currentValue) {
+      return currentValue;
+    };
+    return a.reduce(callback, 13);
+  };
+  %PrepareFunctionForOptimization(reduce);
+  assertEquals(13, reduce(holey));
+  assertEquals(13, reduce(holey));
+  assertEquals(13, reduce(holey));
+  %OptimizeFunctionOnNextCall(reduce);
+  assertEquals(13, reduce(holey));
+  assertOptimized(reduce);
+})();
+
+(function ReduceRightHoleyArrayWithDefaultAccumulator() {
+  var holey = new Array(10);
+  Object.preventExtensions(holey);
+  function reduce(a) {
+    let callback = function(accumulator, currentValue) {
+      return currentValue;
+    };
+    return a.reduceRight(callback, 13);
+  };
+  %PrepareFunctionForOptimization(reduce);
+  assertEquals(13, reduce(holey));
+  assertEquals(13, reduce(holey));
+  assertEquals(13, reduce(holey));
+  %OptimizeFunctionOnNextCall(reduce);
+  assertEquals(13, reduce(holey));
+  assertOptimized(reduce);
+})();
+
+(function ReduceHoleyArrayOneElementWithDefaultAccumulator() {
+  var holey = new Array(10);
+  holey[1] = '5';
+  Object.preventExtensions(holey);
+  function reduce(a) {
+    let callback = function(accumulator, currentValue) {
+      return Number(currentValue) + accumulator;
+    };
+    return a.reduce(callback, 13);
+  };
+  %PrepareFunctionForOptimization(reduce);
+  assertEquals(18, reduce(holey));
+  assertEquals(18, reduce(holey));
+  assertEquals(18, reduce(holey));
+  %OptimizeFunctionOnNextCall(reduce);
+  assertEquals(18, reduce(holey));
+  assertOptimized(reduce);
+})();
+
+(function ReduceRightHoleyArrayOneElementWithDefaultAccumulator() {
+  var holey = new Array(10);
+  holey[1] = '5';
+  Object.preventExtensions(holey);
+  function reduce(a) {
+    let callback = function(accumulator, currentValue) {
+      return Number(currentValue) + accumulator;
+    };
+    return a.reduceRight(callback, 13);
+  };
+  %PrepareFunctionForOptimization(reduce);
+  assertEquals(18, reduce(holey));
+  assertEquals(18, reduce(holey));
+  assertEquals(18, reduce(holey));
+  %OptimizeFunctionOnNextCall(reduce);
+  assertEquals(18, reduce(holey));
+  assertOptimized(reduce);
+})();
+
+(function ReduceMixedHoleyArrays() {
+  function r(a) {
+    return a.reduce((acc, i) => {acc[0]});
+  };
+  %PrepareFunctionForOptimization(r);
+  assertEquals(r(Object.preventExtensions([[0]])), [0]);
+  assertEquals(r(Object.preventExtensions([[0]])), [0]);
+  assertEquals(r(Object.preventExtensions([0,,])), 0);
+  %OptimizeFunctionOnNextCall(r);
+  assertEquals(r(Object.preventExtensions([,0,0])), undefined);
+  assertOptimized(r);
+})();
diff --git a/src/v8/test/mjsunit/noopt.js b/src/v8/test/mjsunit/noopt.js
index 70aed32..9ee73ae 100644
--- a/src/v8/test/mjsunit/noopt.js
+++ b/src/v8/test/mjsunit/noopt.js
@@ -7,8 +7,10 @@
 
 // Check that --noopt actually works.
 
-function f() { return 42; }
-
+function f() {
+  return 42;
+};
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/number-isnan-opt.js b/src/v8/test/mjsunit/number-isnan-opt.js
index a5d4b9f..052eb0b 100644
--- a/src/v8/test/mjsunit/number-isnan-opt.js
+++ b/src/v8/test/mjsunit/number-isnan-opt.js
@@ -7,6 +7,7 @@
 (function() {
   function foo(x) { return Number.isNaN(x); }
 
+  %PrepareFunctionForOptimization(foo);
   assertTrue(foo(+undefined));
   assertFalse(foo(undefined));
   %OptimizeFunctionOnNextCall(foo);
@@ -17,6 +18,7 @@
 (function() {
   function foo(x) { return Number.isNaN(+x); }
 
+  %PrepareFunctionForOptimization(foo);
   assertTrue(foo(+undefined));
   assertFalse(foo(0));
   %OptimizeFunctionOnNextCall(foo);
@@ -27,6 +29,7 @@
 (function() {
   function foo(x) { return Number.isNaN(x|0); }
 
+  %PrepareFunctionForOptimization(foo);
   assertFalse(foo(+undefined));
   assertFalse(foo(0));
   %OptimizeFunctionOnNextCall(foo);
@@ -37,6 +40,7 @@
 (function() {
   function foo(x) { return Number.isNaN("" + x); }
 
+  %PrepareFunctionForOptimization(foo);
   assertFalse(foo(undefined));
   assertFalse(foo(0));
   %OptimizeFunctionOnNextCall(foo);
@@ -47,6 +51,7 @@
 (function() {
   function foo(x) { return Number.isNaN(0/0); }
 
+  %PrepareFunctionForOptimization(foo);
   assertTrue(foo());
   assertTrue(foo());
   %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/number-tostring-subnormal.js b/src/v8/test/mjsunit/number-tostring-subnormal.js
new file mode 100644
index 0000000..80305f6
--- /dev/null
+++ b/src/v8/test/mjsunit/number-tostring-subnormal.js
@@ -0,0 +1,92 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Tests Number.prototype.toString for numbers within or near the subnormal
+// range, when the radix argument is 2.
+
+// A JavaScript number is a IEEE 754 binary64 (double-precision floating-point)
+// value, so we should be able to provide a binary string value that is an
+// exact representation.
+
+const zeros = count => '0'.repeat(count);
+
+const test = (binaryStringValue, double) => {
+  assertEquals(binaryStringValue, double.toString(2));
+};
+
+// 2**-1074
+test(`0.${zeros(1073)}1`, Number.MIN_VALUE);
+
+// Bug v8:9294
+test(`0.${zeros(1022)}1101100011110111011100000100011001111101110001010111`,
+    1.8858070859709815e-308);
+test(`0.${zeros(1021)}11110111001111000110110111011101110001000000000000001`,
+    4.297800585227606e-308);
+
+// Normal doubles smaller than 2**-1021 (4.450147717014403e-308). These values
+// are not in the subnormal range, but like the subnormals they have a gap of
+// Number.MIN_VALUE between themselves and the next double.
+test(`0.${zeros(1021)}11100001110000011100111110011010010100100010001001001`,
+    3.924423154449847e-308);
+test(`-0.${zeros(1021)}11001101101111001101100010110110011000000011010111001`,
+    -3.57641826104544e-308);
+test(`-0.${zeros(1021)}11101100100000100110110001000010010001001000101110001`,
+    -4.1113361447183043e-308);
+test(`0.${zeros(1021)}11111001101000111100111001001101101001001011010001101`,
+    4.339587042263274e-308);
+test(`0.${zeros(1021)}10111011101001010010101011100001110000000001011110001`,
+    3.261909352323954e-308);
+test(`0.${zeros(1021)}10001001101101110110000110001011100001100111111111001`,
+    2.3939766453008923e-308);
+test(`-0.${zeros(1021)}11101001000110010001100111110111001001000001100010011`,
+    -4.052034242003901e-308);
+test(`-0.${zeros(1021)}10001111010010000100000110100010101101001000110010101`,
+    -2.4907311894031355e-308);
+test(`-0.${zeros(1021)}10101100001001010011101010001110011010000001111000001`,
+    -2.9924709724070097e-308);
+test(`-0.${zeros(1021)}11111101001111010110001011001001000100110101001010111`,
+    -4.402165887028534e-308);
+
+// Subnormal doubles: numbers smaller than 2**-1022 (2.2250738585072014e-308).
+test(`0.${zeros(1022)}1100111101100011000101110111111000011111110001001011`,
+    1.802545172319673e-308);
+test(`0.${zeros(1022)}1111001000101011101110111111011111111100111101101011`,
+    2.104874994274149e-308);
+test(`-0.${zeros(1022)}1001110011110110110010010010010001111100001111101011`,
+    -1.3642832344349763e-308);
+test(`0.${zeros(1023)}111101010100011111101110111101011000001110011101101`,
+    1.0659537476238824e-308);
+test(`-0.${zeros(1023)}100101011110101100111101101001110011101011110111101`,
+    -6.51524700064251e-309);
+test(`-0.${zeros(1024)}10011100110100110010111101001001111100000101000111`,
+    -3.407686279964664e-309);
+test(`-0.${zeros(1024)}11101001001010000001101111010101011111111011010111`,
+    -5.06631661953108e-309);
+test(`-0.${zeros(1024)}10111100111100001100010100110011001011000011011101`,
+    -4.105533080656306e-309);
+test(`0.${zeros(1025)}1101111100101101111110101111001010101100001100111`,
+    2.42476131288505e-309);
+test(`-0.${zeros(1025)}1001000100011011100101010010101010101011101000111`,
+    -1.576540281929606e-309);
+test(`0.${zeros(1023)}111101100001000000001011101011101010001110011111101`,
+    1.0693508455891784e-308);
+test(`0.${zeros(1024)}11100010101101001101011010110001110101110100010001`,
+    4.926157093545696e-309);
+test(`-0.${zeros(1027)}10010111100001111110000101011001010111100011011`,
+    -4.1158103328176e-310);
+test(`0.${zeros(1030)}11111010010111010110101101000111010011100001`,
+    8.500372841691e-311);
+test(`0.${zeros(1033)}101001010011111001100100001010001101`,
+    7.01292938871e-312);
+test(`0.${zeros(1037)}11101010101101100111000110100111001`, 6.22574126804e-313);
+test(`-0.${zeros(1040)}10100001001101011011111001111111`, -5.3451064043e-314);
+test(`-0.${zeros(1043)}1001100101100100000001000011111`, -6.35731246e-315);
+test(`0.${zeros(1046)}10101110110100011010110001`, 9.05676893e-316);
+test(`-0.${zeros(1050)}11001010000110011100011`, -6.5438353e-317);
+test(`0.${zeros(1053)}111001010000010001`, 9.269185e-318);
+test(`-0.${zeros(1057)}1100001000010101`, -4.90953e-319);
+test(`-0.${zeros(1059)}10011001001111`, -9.6906e-320);
+test(`0.${zeros(1063)}111101111`, 9.782e-321);
+test(`0.${zeros(1067)}10011`, 3.75e-322);
+test(`-0.${zeros(1070)}1`, -4e-323);
diff --git a/src/v8/test/mjsunit/object-define-property.js b/src/v8/test/mjsunit/object-define-property.js
index cc9c0b7..dba774cf 100644
--- a/src/v8/test/mjsunit/object-define-property.js
+++ b/src/v8/test/mjsunit/object-define-property.js
@@ -1053,12 +1053,14 @@
 function testGetterOnProto(expected, o) {
   assertEquals(expected, o.quebec);
 }
+%PrepareFunctionForOptimization(testGetterOnProto);
 
 obj1 = {};
 Object.defineProperty(obj1, "quebec", { get: getter, configurable: true });
 obj2 = Object.create(obj1);
 obj3 = Object.create(obj2);
 
+%PrepareFunctionForOptimization(testGetterOnProto);
 testGetterOnProto(111, obj3);
 testGetterOnProto(111, obj3);
 %OptimizeFunctionOnNextCall(testGetterOnProto);
@@ -1069,6 +1071,7 @@
 
 testGetterOnProto(222, obj3);
 testGetterOnProto(222, obj3);
+%PrepareFunctionForOptimization(testGetterOnProto);
 %OptimizeFunctionOnNextCall(testGetterOnProto);
 testGetterOnProto(222, obj3);
 testGetterOnProto(222, obj3);
@@ -1083,6 +1086,7 @@
   o.romeo = 444;
   assertEquals(expected, modifyMe);
 }
+%PrepareFunctionForOptimization(testSetterOnProto);
 
 obj1 = {};
 Object.defineProperty(obj1, "romeo", { set: setter, configurable: true });
@@ -1099,6 +1103,7 @@
 
 testSetterOnProto(446, obj3);
 testSetterOnProto(446, obj3);
+%PrepareFunctionForOptimization(testSetterOnProto);
 %OptimizeFunctionOnNextCall(testSetterOnProto);
 testSetterOnProto(446, obj3);
 testSetterOnProto(446, obj3);
@@ -1108,6 +1113,7 @@
   "use strict";
   o.sierra = 12345;
 }
+%PrepareFunctionForOptimization(testSetterOnProtoStrict);
 
 obj1 = {};
 Object.defineProperty(obj1, "sierra",
@@ -1140,6 +1146,7 @@
 function Assign(o) {
   o.blubb = 123;
 }
+%PrepareFunctionForOptimization(Assign);
 
 function C() {}
 
diff --git a/src/v8/test/mjsunit/object-freeze.js b/src/v8/test/mjsunit/object-freeze.js
index 23f5af0..244f952 100644
--- a/src/v8/test/mjsunit/object-freeze.js
+++ b/src/v8/test/mjsunit/object-freeze.js
@@ -396,3 +396,958 @@
   assertFalse(Object.getOwnPropertyDescriptor(args, "length").writable);
   assertFalse(Object.getOwnPropertyDescriptor(args, "callee").writable);
 })();
+
+// Test packed element array built-in functions with freeze.
+function testPackedFrozenArray1(obj) {
+  assertTrue(Object.isSealed(obj));
+  // Verify that the value can't be written
+  obj1 = new Array(...obj);
+  var length = obj.length;
+  for (var i = 0; i < length-1; i++) {
+    obj[i] = 'new';
+    assertEquals(obj1[i], obj[i]);
+  }
+  // for symbol we cannot compare directly
+  assertTrue(typeof obj[length-1] == 'symbol');
+
+  // Verify that the length can't be written by builtins.
+  assertTrue(Array.isArray(obj));
+  assertThrows(function() { obj.pop(); }, TypeError);
+  assertThrows(function() { obj.push(); }, TypeError);
+  assertThrows(function() { obj.shift(); }, TypeError);
+  assertThrows(function() { obj.unshift(); }, TypeError);
+  assertThrows(function() { obj.copyWithin(0,0); }, TypeError);
+  assertThrows(function() { obj.fill(0); }, TypeError);
+  assertThrows(function() { obj.reverse(); }, TypeError);
+  assertThrows(function() { obj.sort(); }, TypeError);
+  assertThrows(function() { obj.splice(0); }, TypeError);
+  assertThrows(function() { obj.splice(0, 0); }, TypeError);
+  assertTrue(Object.isFrozen(obj));
+
+  // Verify search, filter, iterator
+  assertEquals(obj.lastIndexOf(1), 2);
+  assertEquals(obj.indexOf('a'), 4);
+  assertEquals(obj.indexOf(undefined), 0);
+  assertFalse(obj.includes(Symbol("test")));
+  assertTrue(obj.includes(undefined));
+  assertFalse(obj.includes(NaN));
+  assertTrue(obj.includes());
+  assertEquals(obj.find(x => x==0), undefined);
+  assertEquals(obj.findIndex(x => x=='a'), 4);
+  assertTrue(obj.some(x => typeof x == 'symbol'));
+  assertFalse(obj.every(x => x == -1));
+  var filteredArray = obj.filter(e => typeof e == "symbol");
+  assertEquals(filteredArray.length, 1);
+  assertEquals(obj.map(x => x), obj);
+  var countPositiveNumber = 0;
+  obj.forEach(function(item, index) {
+    if (item === 1) {
+      countPositiveNumber++;
+      assertEquals(index, 2);
+    }
+  });
+  assertEquals(countPositiveNumber, 1);
+  assertEquals(obj.length, obj.concat([]).length);
+  var iterator = obj.values();
+  assertEquals(iterator.next().value, undefined);
+  assertEquals(iterator.next().value, null);
+  var iterator = obj.keys();
+  assertEquals(iterator.next().value, 0);
+  assertEquals(iterator.next().value, 1);
+  var iterator = obj.entries();
+  assertEquals(iterator.next().value, [0, undefined]);
+  assertEquals(iterator.next().value, [1, null]);
+}
+
+obj = new Array(undefined, null, 1, -1, 'a', Symbol("test"));
+assertTrue(%HasPackedElements(obj));
+Object.freeze(obj);
+testPackedFrozenArray1(obj);
+
+// Verify change from sealed to frozen
+obj = new Array(undefined, null, 1, -1, 'a', Symbol("test"));
+assertTrue(%HasPackedElements(obj));
+Object.seal(obj);
+Object.freeze(obj);
+assertTrue(Object.isSealed(obj));
+testPackedFrozenArray1(obj);
+
+// Verify change from non-extensible to frozen
+obj = new Array(undefined, null, 1, -1, 'a', Symbol("test"));
+assertTrue(%HasPackedElements(obj));
+Object.preventExtensions(obj);
+Object.freeze(obj);
+assertTrue(Object.isSealed(obj));
+testPackedFrozenArray1(obj);
+
+// Verify flat, map, slice, flatMap, join, reduce, reduceRight for frozen packed array
+function testPackedFrozenArray2(arr) {
+  assertTrue(Object.isFrozen(arr));
+  assertTrue(Array.isArray(arr));
+  assertEquals(arr.map(x => [x]), [['a'], ['b'], ['c']]);
+  assertEquals(arr.flatMap(x => [x]), arr);
+  assertEquals(arr.flat(), arr);
+  assertEquals(arr.join('-'), "a-b-c");
+  const reducer = (accumulator, currentValue) => accumulator + currentValue;
+  assertEquals(arr.reduce(reducer), "abc");
+  assertEquals(arr.reduceRight(reducer), "cba");
+  assertEquals(arr.slice(0, 1), ['a']);
+}
+var arr1 = new Array('a', 'b', 'c');
+assertTrue(%HasPackedElements(arr1));
+Object.freeze(arr1);
+testPackedFrozenArray2(arr1);
+
+// Verify change from sealed to frozen
+var arr2 = new Array('a', 'b', 'c');
+assertTrue(%HasPackedElements(arr2));
+Object.seal(arr2);
+Object.freeze(arr2);
+testPackedFrozenArray2(arr2);
+
+// Verify change from non-extensible to frozen
+var arr2 = new Array('a', 'b', 'c');
+assertTrue(%HasPackedElements(arr2));
+Object.preventExtensions(arr2);
+Object.freeze(arr2);
+testPackedFrozenArray2(arr2);
+
+// Verify that repeatedly attemping to freeze a typed array fails
+var typedArray = new Uint8Array(10);
+assertThrows(() => { Object.freeze(typedArray); }, TypeError);
+assertFalse(Object.isFrozen(typedArray));
+assertThrows(() => { Object.freeze(typedArray); }, TypeError);
+assertFalse(Object.isFrozen(typedArray));
+
+// Verify that freezing an empty typed array works
+var typedArray = new Uint8Array(0);
+Object.freeze(typedArray);
+assertTrue(Object.isFrozen(typedArray));
+
+// Test regression with Object.defineProperty
+var obj = [];
+obj.propertyA = 42;
+obj[0] = true;
+Object.freeze(obj);
+assertThrows(function() {
+  Object.defineProperty(obj, 'propertyA', {
+    value: obj,
+  });
+}, TypeError);
+assertEquals(42, obj.propertyA);
+assertThrows(function() {
+  Object.defineProperty(obj, 'propertyA', {
+    value: obj,
+    writable: false,
+  });
+}, TypeError);
+assertDoesNotThrow(function() {obj.propertyA = 2;});
+assertEquals(obj.propertyA, 42);
+assertThrows(function() {
+  Object.defineProperty(obj, 'abc', {
+    value: obj,
+  });
+}, TypeError);
+
+// Regression test with simple array
+var arr = ['a'];
+Object.freeze(arr);
+arr[0] = 'b';
+assertEquals(arr[0], 'a');
+
+// Test regression Array.concat with double
+var arr = ['a'];
+Object.freeze(arr);
+arr = arr.concat(0.5);
+assertEquals(arr, ['a', 0.5]);
+Object.freeze(arr);
+arr = arr.concat([1.5, 'b']);
+assertEquals(arr, ['a', 0.5, 1.5, 'b']);
+
+// Regression test with change length
+var arr = ['a', 'b'];
+Object.freeze(arr);
+assertEquals(arr.length, 2);
+arr.length = 3;
+assertEquals(arr.length, 2);
+arr[2] = 'c';
+assertEquals(arr[2], undefined);
+arr.length = 1;
+assertEquals(arr.length, 2);
+
+// Start testing with holey array
+// Test holey element array built-in functions with freeze.
+function testHoleyFrozenArray1(obj) {
+  assertTrue(Object.isSealed(obj));
+  // Verify that the value can't be written
+  obj1 = new Array(...obj);
+  var length = obj.length;
+  for (var i = 0; i < length-1; i++) {
+    obj[i] = 'new';
+    assertEquals(obj1[i], obj[i]);
+  }
+  // for symbol we cannot compare directly
+  assertTrue(typeof obj[length-1] == 'symbol');
+
+  // Verify that the length can't be written by builtins.
+  assertTrue(Array.isArray(obj));
+  assertThrows(function() { obj.pop(); }, TypeError);
+  assertThrows(function() { obj.push(); }, TypeError);
+  assertThrows(function() { obj.shift(); }, TypeError);
+  assertThrows(function() { obj.unshift(); }, TypeError);
+  assertThrows(function() { obj.copyWithin(0,0); }, TypeError);
+  assertThrows(function() { obj.fill(0); }, TypeError);
+  assertThrows(function() { obj.reverse(); }, TypeError);
+  assertThrows(function() { obj.sort(); }, TypeError);
+  assertThrows(function() { obj.splice(0); }, TypeError);
+  assertThrows(function() { obj.splice(0, 0); }, TypeError);
+  assertTrue(Object.isFrozen(obj));
+
+  // Verify search, filter, iterator
+  assertEquals(obj.lastIndexOf(1), 2);
+  assertEquals(obj.indexOf('a'), 5);
+  assertEquals(obj.indexOf(undefined), 0);
+  assertFalse(obj.includes(Symbol("test")));
+  assertTrue(obj.includes(undefined));
+  assertFalse(obj.includes(NaN));
+  assertTrue(obj.includes());
+  assertEquals(obj.find(x => x==0), undefined);
+  assertEquals(obj.findIndex(x => x=='a'), 5);
+  assertTrue(obj.some(x => typeof x == 'symbol'));
+  assertFalse(obj.every(x => x == -1));
+  var filteredArray = obj.filter(e => typeof e == "symbol");
+  assertEquals(filteredArray.length, 1);
+  assertEquals(obj.map(x => x), obj);
+  var countPositiveNumber = 0;
+  obj.forEach(function(item, index) {
+    if (item === 1) {
+      countPositiveNumber++;
+      assertEquals(index, 2);
+    }
+  });
+  assertEquals(countPositiveNumber, 1);
+  assertEquals(obj.length, obj.concat([]).length);
+  var iterator = obj.values();
+  assertEquals(iterator.next().value, undefined);
+  assertEquals(iterator.next().value, null);
+  var iterator = obj.keys();
+  assertEquals(iterator.next().value, 0);
+  assertEquals(iterator.next().value, 1);
+  var iterator = obj.entries();
+  assertEquals(iterator.next().value, [0, undefined]);
+  assertEquals(iterator.next().value, [1, null]);
+}
+
+obj = [undefined, null, 1, , -1, 'a', Symbol("test")];
+assertTrue(%HasHoleyElements(obj));
+Object.freeze(obj);
+testHoleyFrozenArray1(obj);
+
+// Verify change from sealed to frozen
+obj = [undefined, null, 1, , -1, 'a', Symbol("test")];
+assertTrue(%HasHoleyElements(obj));
+Object.seal(obj);
+Object.freeze(obj);
+assertTrue(Object.isSealed(obj));
+testHoleyFrozenArray1(obj);
+
+// Verify change from non-extensible to frozen
+obj = [undefined, null, 1, ,-1, 'a', Symbol("test")];
+assertTrue(%HasHoleyElements(obj));
+Object.preventExtensions(obj);
+Object.freeze(obj);
+assertTrue(Object.isSealed(obj));
+testHoleyFrozenArray1(obj);
+
+// Verify flat, map, slice, flatMap, join, reduce, reduceRight for frozen packed array
+function testHoleyFrozenArray2(arr) {
+  assertTrue(Object.isFrozen(arr));
+  assertTrue(Array.isArray(arr));
+  assertEquals(arr.map(x => [x]), [, ['a'], ['b'], ['c']]);
+  assertEquals(arr.flatMap(x => [x]), ["a", "b", "c"]);
+  assertEquals(arr.flat(), ["a", "b", "c"]);
+  assertEquals(arr.join('-'), "-a-b-c");
+  const reducer = (accumulator, currentValue) => accumulator + currentValue;
+  assertEquals(arr.reduce(reducer), "abc");
+  assertEquals(arr.reduceRight(reducer), "cba");
+  assertEquals(arr.slice(0, 1), [,]);
+  assertEquals(arr.slice(1, 2), ["a"]);
+}
+var arr1 = [, 'a', 'b', 'c'];
+assertTrue(%HasHoleyElements(arr1));
+Object.freeze(arr1);
+testHoleyFrozenArray2(arr1);
+
+// Verify change from sealed to frozen
+var arr2 = [, 'a', 'b', 'c'];
+assertTrue(%HasHoleyElements(arr2));
+Object.seal(arr2);
+Object.freeze(arr2);
+testHoleyFrozenArray2(arr2);
+
+// Verify change from non-extensible to frozen
+var arr2 = [, 'a', 'b', 'c'];
+assertTrue(%HasHoleyElements(arr2));
+Object.preventExtensions(arr2);
+Object.freeze(arr2);
+testHoleyFrozenArray2(arr2);
+
+// Test regression with Object.defineProperty
+var obj = ['a', , 'b'];
+obj.propertyA = 42;
+obj[0] = true;
+Object.freeze(obj);
+assertThrows(function() {
+  Object.defineProperty(obj, 'propertyA', {
+    value: obj,
+  });
+}, TypeError);
+assertEquals(42, obj.propertyA);
+assertThrows(function() {
+  Object.defineProperty(obj, 'propertyA', {
+    value: obj,
+    writable: false,
+  });
+}, TypeError);
+assertDoesNotThrow(function() {obj.propertyA = 2;});
+assertEquals(obj.propertyA, 42);
+assertThrows(function() {
+  Object.defineProperty(obj, 'abc', {
+    value: obj,
+  });
+}, TypeError);
+
+// Regression test with simple holey array
+var arr = [, 'a'];
+Object.freeze(arr);
+arr[1] = 'b';
+assertEquals(arr[1], 'a');
+arr[0] = 1;
+assertEquals(arr[0], undefined);
+
+// Test regression Array.concat with double
+var arr = ['a', , 'b'];
+Object.freeze(arr);
+arr = arr.concat(0.5);
+assertEquals(arr, ['a', ,'b', 0.5]);
+Object.freeze(arr);
+arr = arr.concat([1.5, 'c']);
+assertEquals(arr, ['a', ,'b', 0.5, 1.5, 'c']);
+
+// Regression test with change length
+var arr = ['a', ,'b'];
+Object.freeze(arr);
+assertEquals(arr.length, 3);
+arr.length = 4;
+assertEquals(arr.length, 3);
+arr[3] = 'c';
+assertEquals(arr[2], 'b');
+assertEquals(arr[3], undefined);
+arr.length = 2;
+assertEquals(arr.length, 3);
+
+// Change length with holey entries at the end
+var arr = ['a', ,];
+Object.freeze(arr);
+assertEquals(arr.length, 2);
+arr.length = 0;
+assertEquals(arr.length, 2);
+arr.length = 3;
+assertEquals(arr.length, 2);
+arr.length = 0;
+assertEquals(arr.length, 2);
+
+// Spread with array
+var arr = ['a', 'b', 'c'];
+Object.freeze(arr);
+var arrSpread = [...arr];
+assertEquals(arrSpread.length, arr.length);
+assertEquals(arrSpread[0], 'a');
+assertEquals(arrSpread[1], 'b');
+assertEquals(arrSpread[2], 'c');
+
+// Spread with array-like
+function returnArgs() {
+  return Object.freeze(arguments);
+}
+var arrLike = returnArgs('a', 'b', 'c');
+assertTrue(Object.isFrozen(arrLike));
+var arrSpread = [...arrLike];
+assertEquals(arrSpread.length, arrLike.length);
+assertEquals(arrSpread[0], 'a');
+assertEquals(arrSpread[1], 'b');
+assertEquals(arrSpread[2], 'c');
+
+// Spread with holey
+function countArgs() {
+  return arguments.length;
+}
+var arr = [, 'b','c'];
+Object.freeze(arr);
+assertEquals(countArgs(...arr), 3);
+assertEquals(countArgs(...[...arr]), 3);
+assertEquals(countArgs.apply(this, [...arr]), 3);
+function checkUndefined() {
+  return arguments[0] === undefined;
+}
+assertTrue(checkUndefined(...arr));
+assertTrue(checkUndefined(...[...arr]));
+assertTrue(checkUndefined.apply(this, [...arr]));
+
+//
+// Array.prototype.map
+//
+(function() {
+  var a = Object.freeze(['0','1','2','3','4']);
+
+  // Simple use.
+  var result = [1,2,3,4,5];
+  assertArrayEquals(result, a.map(function(n) { return Number(n) + 1; }));
+
+  // Use specified object as this object when calling the function.
+  var o = { delta: 42 }
+  result = [42,43,44,45,46];
+  assertArrayEquals(result, a.map(function(n) { return this.delta + Number(n); }, o));
+
+  // Modify original array.
+  b = Object.freeze(['0','1','2','3','4']);
+  result = [1,2,3,4,5];
+  assertArrayEquals(result,
+      b.map(function(n, index, array) {
+        array[index] = Number(n) + 1; return Number(n) + 1;
+      }));
+  assertArrayEquals(b, a);
+
+  // Only loop through initial part of array and elements are not
+  // added.
+  a = Object.freeze(['0','1','2','3','4']);
+  result = [1,2,3,4,5];
+  assertArrayEquals(result,
+      a.map(function(n, index, array) { assertThrows(() => { array.push(n) }); return Number(n) + 1; }));
+  assertArrayEquals(['0','1','2','3','4'], a);
+
+  // Respect holes.
+  a = new Array(20);
+  a[1] = '2';
+  Object.freeze(a);
+  a = Object.freeze(a).map(function(n) { return 2*Number(n); });
+
+  for (var i in a) {
+    assertEquals(4, a[i]);
+    assertEquals('1', i);
+  }
+
+  // Skip over missing properties.
+  a = {
+    "0": 1,
+    "2": 2,
+    length: 3
+  };
+  var received = [];
+  assertArrayEquals([2, , 4],
+      Array.prototype.map.call(Object.freeze(a), function(n) {
+        received.push(n);
+        return n * 2;
+      }));
+  assertArrayEquals([1, 2], received);
+
+  // Modify array prototype
+  a = ['1', , 2];
+  received = [];
+  assertThrows(() => {
+    Array.prototype.map.call(Object.freeze(a), function(n) {
+      a.__proto__ = null;
+      received.push(n);
+      return n * 2;
+    });
+  }, TypeError);
+  assertArrayEquals([], received);
+
+  // Create a new object in each function call when receiver is a
+  // primitive value. See ECMA-262, Annex C.
+  a = [];
+  Object.freeze(['1', '2']).map(function() { a.push(this) }, "");
+  assertTrue(a[0] !== a[1]);
+
+  // Do not create a new object otherwise.
+  a = [];
+  Object.freeze(['1', '2']).map(function() { a.push(this) }, {});
+  assertSame(a[0], a[1]);
+
+  // In strict mode primitive values should not be coerced to an object.
+  a = [];
+  Object.freeze(['1', '2']).map(function() { 'use strict'; a.push(this); }, "");
+  assertEquals("", a[0]);
+  assertEquals(a[0], a[1]);
+
+})();
+
+// Test with double elements
+// Test packed element array built-in functions with freeze.
+function testDoubleFrozenArray1(obj) {
+  assertTrue(Object.isSealed(obj));
+  // Verify that the value can't be written
+  obj1 = new Array(...obj);
+  var length = obj.length;
+  for (var i = 0; i < length-1; i++) {
+    obj[i] = 'new';
+    assertEquals(obj1[i], obj[i]);
+  }
+  // Verify that the length can't be written by builtins.
+  assertTrue(Array.isArray(obj));
+  assertThrows(function() { obj.pop(); }, TypeError);
+  assertThrows(function() { obj.push(); }, TypeError);
+  assertThrows(function() { obj.shift(); }, TypeError);
+  assertThrows(function() { obj.unshift(); }, TypeError);
+  assertThrows(function() { obj.copyWithin(0,0); }, TypeError);
+  assertThrows(function() { obj.fill(0); }, TypeError);
+  assertThrows(function() { obj.reverse(); }, TypeError);
+  assertThrows(function() { obj.sort(); }, TypeError);
+  assertThrows(function() { obj.splice(0); }, TypeError);
+  assertThrows(function() { obj.splice(0, 0); }, TypeError);
+  assertTrue(Object.isFrozen(obj));
+
+  // Verify search, filter, iterator
+  assertEquals(obj.lastIndexOf(1), 2);
+  assertEquals(obj.indexOf(undefined), -1);
+  assertFalse(obj.includes(Symbol("test")));
+  assertTrue(obj.includes(1));
+  assertTrue(obj.includes(-1.1));
+  assertFalse(obj.includes());
+  assertEquals(obj.find(x => x==0), undefined);
+  assertEquals(obj.findIndex(x => x==2), 4);
+  assertFalse(obj.some(x => typeof x == 'symbol'));
+  assertFalse(obj.every(x => x == -1));
+  var filteredArray = obj.filter(e => typeof e == "symbol");
+  assertEquals(filteredArray.length, 0);
+  assertEquals(obj.map(x => x), obj);
+  var countPositiveNumber = 0;
+  obj.forEach(function(item, index) {
+    if (item === 1) {
+      countPositiveNumber++;
+      assertEquals(index, 2);
+    }
+  });
+  assertEquals(countPositiveNumber, 1);
+  assertEquals(obj.length, obj.concat([]).length);
+  var iterator = obj.values();
+  assertEquals(iterator.next().value, 1.1);
+  assertEquals(iterator.next().value, -1.1);
+  var iterator = obj.keys();
+  assertEquals(iterator.next().value, 0);
+  assertEquals(iterator.next().value, 1);
+  var iterator = obj.entries();
+  assertEquals(iterator.next().value, [0, 1.1]);
+  assertEquals(iterator.next().value, [1, -1.1]);
+}
+
+obj = new Array(1.1, -1.1, 1, -1, 2);
+assertTrue(%HasDoubleElements(obj));
+Object.freeze(obj);
+testDoubleFrozenArray1(obj);
+
+// Verify change from sealed to frozen
+obj = new Array(1.1, -1.1, 1, -1, 2);
+assertTrue(%HasDoubleElements(obj));
+Object.seal(obj);
+Object.freeze(obj);
+assertTrue(Object.isSealed(obj));
+testDoubleFrozenArray1(obj);
+
+// Verify change from non-extensible to frozen
+obj = new Array(1.1, -1.1, 1, -1, 2);
+assertTrue(%HasDoubleElements(obj));
+Object.preventExtensions(obj);
+Object.freeze(obj);
+assertTrue(Object.isSealed(obj));
+testDoubleFrozenArray1(obj);
+
+// Verify flat, map, slice, flatMap, join, reduce, reduceRight for frozen packed array
+function testDoubleFrozenArray2(arr) {
+  assertTrue(Object.isFrozen(arr));
+  assertTrue(Array.isArray(arr));
+  assertEquals(arr.map(x => [x]), [[1], [1.1], [0]]);
+  assertEquals(arr.flatMap(x => [x]), arr);
+  assertEquals(arr.flat(), arr);
+  assertEquals(arr.join('-'), "1-1.1-0");
+  const reducer = (accumulator, currentValue) => accumulator + currentValue;
+  assertEquals(arr.reduce(reducer), 2.1);
+  assertEquals(arr.reduceRight(reducer), 2.1);
+  assertEquals(arr.slice(0, 1), [1]);
+}
+var arr1 = new Array(1, 1.1, 0);
+assertTrue(%HasDoubleElements(arr1));
+Object.freeze(arr1);
+testDoubleFrozenArray2(arr1);
+
+// Verify change from sealed to frozen
+var arr1 = new Array(1, 1.1, 0);
+assertTrue(%HasDoubleElements(arr1));
+Object.seal(arr1);
+Object.freeze(arr1);
+testDoubleFrozenArray2(arr1);
+
+
+// Verify change from non-extensible to frozen
+var arr1 = new Array(1, 1.1, 0);
+assertTrue(%HasDoubleElements(arr1));
+Object.preventExtensions(arr1);
+Object.freeze(arr1);
+testDoubleFrozenArray2(arr1);
+
+// Test regression with Object.defineProperty
+var obj = [];
+obj.propertyA = 42;
+obj[0] = 1.1;
+Object.freeze(obj);
+assertThrows(function() {
+  Object.defineProperty(obj, 'propertyA', {
+    value: obj,
+  });
+}, TypeError);
+assertEquals(42, obj.propertyA);
+assertThrows(function() {
+  Object.defineProperty(obj, 'propertyA', {
+    value: obj,
+    writable: false,
+  });
+}, TypeError);
+assertDoesNotThrow(function() {obj.propertyA = 2;});
+assertEquals(obj.propertyA, 42);
+assertThrows(function() {
+  Object.defineProperty(obj, 'abc', {
+    value: obj,
+  });
+}, TypeError);
+
+// Regression test with simple array
+var arr = [1.1];
+Object.freeze(arr);
+arr[0] = 1;
+assertEquals(arr[0], 1.1);
+
+// Test regression Array.concat with double
+var arr = [1.1];
+Object.freeze(arr);
+arr = arr.concat(0.5);
+assertEquals(arr, [1.1, 0.5]);
+Object.freeze(arr);
+arr = arr.concat([1.5, 'b']);
+assertEquals(arr, [1.1, 0.5, 1.5, 'b']);
+
+// Regression test with change length
+var arr = [1.1, 0];
+Object.freeze(arr);
+assertEquals(arr.length, 2);
+arr.length = 3;
+assertEquals(arr.length, 2);
+arr[2] = 'c';
+assertEquals(arr[2], undefined);
+arr.length = 1;
+assertEquals(arr.length, 2);
+
+// Start testing with holey array
+// Test holey element array built-in functions with freeze.
+function testHoleyDoubleFrozenArray1(obj) {
+  assertTrue(Object.isSealed(obj));
+  // Verify that the value can't be written
+  obj1 = new Array(...obj);
+  var length = obj.length;
+  for (var i = 0; i < length-1; i++) {
+    obj[i] = 'new';
+    assertEquals(obj1[i], obj[i]);
+  }
+
+  // Verify that the length can't be written by builtins.
+  assertTrue(Array.isArray(obj));
+  assertThrows(function() { obj.pop(); }, TypeError);
+  assertThrows(function() { obj.push(); }, TypeError);
+  assertThrows(function() { obj.shift(); }, TypeError);
+  assertThrows(function() { obj.unshift(); }, TypeError);
+  assertThrows(function() { obj.copyWithin(0,0); }, TypeError);
+  assertThrows(function() { obj.fill(0); }, TypeError);
+  assertThrows(function() { obj.reverse(); }, TypeError);
+  assertThrows(function() { obj.sort(); }, TypeError);
+  assertThrows(function() { obj.splice(0); }, TypeError);
+  assertThrows(function() { obj.splice(0, 0); }, TypeError);
+  assertTrue(Object.isFrozen(obj));
+
+  // Verify search, filter, iterator
+  assertEquals(obj.lastIndexOf(1), 2);
+  assertEquals(obj.indexOf(1.1), 5);
+  assertEquals(obj.indexOf(undefined), -1);
+  assertFalse(obj.includes(Symbol("test")));
+  assertTrue(obj.includes(undefined));
+  assertFalse(obj.includes(NaN));
+  assertTrue(obj.includes());
+  assertEquals(obj.find(x => x==2), undefined);
+  assertEquals(obj.findIndex(x => x==1.1), 5);
+  assertFalse(obj.some(x => typeof x == 'symbol'));
+  assertFalse(obj.every(x => x == -1));
+  var filteredArray = obj.filter(e => typeof e == "symbol");
+  assertEquals(filteredArray.length, 0);
+  assertEquals(obj.map(x => x), obj);
+  var countPositiveNumber = 0;
+  obj.forEach(function(item, index) {
+    if (item === 1) {
+      countPositiveNumber++;
+      assertEquals(index, 2);
+    }
+  });
+  assertEquals(countPositiveNumber, 1);
+  assertEquals(obj.length, obj.concat([]).length);
+  var iterator = obj.values();
+  assertEquals(iterator.next().value, -1.1);
+  assertEquals(iterator.next().value, 0);
+  var iterator = obj.keys();
+  assertEquals(iterator.next().value, 0);
+  assertEquals(iterator.next().value, 1);
+  var iterator = obj.entries();
+  assertEquals(iterator.next().value, [0, -1.1]);
+  assertEquals(iterator.next().value, [1, 0]);
+}
+
+obj = [-1.1, 0, 1, , -1, 1.1];
+assertTrue(%HasHoleyElements(obj));
+Object.freeze(obj);
+testHoleyDoubleFrozenArray1(obj);
+
+// Verify change from sealed to frozen
+obj = [-1.1, 0, 1, , -1, 1.1];
+assertTrue(%HasHoleyElements(obj));
+Object.seal(obj);
+Object.freeze(obj);
+assertTrue(Object.isSealed(obj));
+testHoleyDoubleFrozenArray1(obj);
+
+// Verify change from non-extensible to frozen
+obj = [-1.1, 0, 1, , -1, 1.1];
+assertTrue(%HasHoleyElements(obj));
+Object.preventExtensions(obj);
+Object.freeze(obj);
+assertTrue(Object.isSealed(obj));
+testHoleyDoubleFrozenArray1(obj);
+
+// Verify flat, map, slice, flatMap, join, reduce, reduceRight for frozen packed array
+function testHoleyDoubleFrozenArray2(arr) {
+  assertTrue(Object.isFrozen(arr));
+  assertTrue(Array.isArray(arr));
+  assertEquals(arr.map(x => [x]), [, [1.1], [1], [0]]);
+  assertEquals(arr.flatMap(x => [x]), [1.1, 1, 0]);
+  assertEquals(arr.flat(), [1.1, 1, 0]);
+  assertEquals(arr.join('-'), "-1.1-1-0");
+  const reducer = (accumulator, currentValue) => accumulator + currentValue;
+  assertEquals(arr.reduce(reducer), 2.1);
+  assertEquals(arr.reduceRight(reducer), 2.1);
+  assertEquals(arr.slice(0, 1), [,]);
+  assertEquals(arr.slice(1, 2), [1.1]);
+}
+var arr1 = [, 1.1, 1, 0];
+assertTrue(%HasHoleyElements(arr1));
+Object.preventExtensions(arr1);
+Object.freeze(arr1);
+testHoleyDoubleFrozenArray2(arr1);
+
+// Verify change from sealed to frozen
+var arr1 = [, 1.1, 1, 0];
+assertTrue(%HasHoleyElements(arr1));
+Object.seal(arr1);
+Object.freeze(arr1);
+testHoleyDoubleFrozenArray2(arr1);
+
+// Verify change from non-extensible to frozen
+var arr1 = [, 1.1, 1, 0];
+assertTrue(%HasHoleyElements(arr1));
+Object.preventExtensions(arr1);
+Object.freeze(arr1);
+testHoleyDoubleFrozenArray2(arr1);
+
+// Test regression with Object.defineProperty
+var obj = [1.1, , 0];
+obj.propertyA = 42;
+obj[0] = true;
+Object.freeze(obj);
+assertThrows(function() {
+  Object.defineProperty(obj, 'propertyA', {
+    value: obj,
+  });
+}, TypeError);
+assertEquals(42, obj.propertyA);
+assertThrows(function() {
+  Object.defineProperty(obj, 'propertyA', {
+    value: obj,
+    writable: false,
+  });
+}, TypeError);
+assertDoesNotThrow(function() {obj.propertyA = 2;});
+assertEquals(obj.propertyA, 42);
+assertThrows(function() {
+  Object.defineProperty(obj, 'abc', {
+    value: obj,
+  });
+}, TypeError);
+
+// Regression test with simple holey array
+var arr = [, 1.1];
+Object.freeze(arr);
+arr[1] = 'b';
+assertEquals(arr[1], 1.1);
+arr[0] = 1;
+assertEquals(arr[0], undefined);
+
+// Test regression Array.concat with double
+var arr = [1.1, , 0];
+Object.freeze(arr);
+arr = arr.concat(0.5);
+assertEquals(arr, [1.1, , 0, 0.5]);
+Object.freeze(arr);
+arr = arr.concat([1.5, 'c']);
+assertEquals(arr, [1.1, ,0, 0.5, 1.5, 'c']);
+
+// Regression test with change length
+var arr = [1.1, ,0];
+Object.freeze(arr);
+assertEquals(arr.length, 3);
+arr.length = 4;
+assertEquals(arr.length, 3);
+arr[3] = 'c';
+assertEquals(arr[2], 0);
+assertEquals(arr[3], undefined);
+arr.length = 2;
+assertEquals(arr.length, 3);
+
+// Change length with holey entries at the end
+var arr = [1.1, ,];
+Object.freeze(arr);
+assertEquals(arr.length, 2);
+arr.length = 0;
+assertEquals(arr.length, 2);
+arr.length = 3;
+assertEquals(arr.length, 2);
+arr.length = 0;
+assertEquals(arr.length, 2);
+
+// Spread with array
+var arr = [1.1, 0, -1];
+Object.freeze(arr);
+var arrSpread = [...arr];
+assertEquals(arrSpread.length, arr.length);
+assertEquals(arrSpread[0], 1.1);
+assertEquals(arrSpread[1], 0);
+assertEquals(arrSpread[2], -1);
+
+// Spread with array-like
+function returnArgs() {
+  return Object.freeze(arguments);
+}
+var arrLike = returnArgs(1.1, 0, -1);
+assertTrue(Object.isFrozen(arrLike));
+var arrSpread = [...arrLike];
+assertEquals(arrSpread.length, arrLike.length);
+assertEquals(arrSpread[0], 1.1);
+assertEquals(arrSpread[1], 0);
+assertEquals(arrSpread[2], -1);
+
+// Spread with holey
+function countArgs() {
+  return arguments.length;
+}
+var arr = [, 1.1, 0];
+Object.freeze(arr);
+assertEquals(countArgs(...arr), 3);
+assertEquals(countArgs(...[...arr]), 3);
+assertEquals(countArgs.apply(this, [...arr]), 3);
+function checkUndefined() {
+  return arguments[0] === undefined;
+}
+assertTrue(checkUndefined(...arr));
+assertTrue(checkUndefined(...[...arr]));
+assertTrue(checkUndefined.apply(this, [...arr]));
+
+//
+// Array.prototype.map
+//
+(function() {
+  var a = Object.freeze([0.1,1,2,3,4]);
+
+  // Simple use.
+  var result = [1.1,2,3,4,5];
+  assertArrayEquals(result, a.map(function(n) { return Number(n) + 1; }));
+
+  // Use specified object as this object when calling the function.
+  var o = { delta: 42 }
+  result = [42.1,43,44,45,46];
+  assertArrayEquals(result, a.map(function(n) { return this.delta + Number(n); }, o));
+
+  // Modify original array.
+  b = Object.freeze([0.1,1,2,3,4]);
+  result = [1.1,2,3,4,5];
+  assertArrayEquals(result,
+      b.map(function(n, index, array) {
+        array[index] = Number(n) + 1; return Number(n) + 1;
+      }));
+  assertArrayEquals(b, a);
+
+  // Only loop through initial part of array and elements are not
+  // added.
+  a = Object.freeze([0.1,1,2,3,4]);
+  result = [1.1,2,3,4,5];
+  assertArrayEquals(result,
+      a.map(function(n, index, array) { assertThrows(() => { array.push(n) }); return Number(n) + 1; }));
+  assertArrayEquals([0.1,1,2,3,4], a);
+
+  // Respect holes.
+  a = new Array(20);
+  a[1] = 1.1;
+  Object.freeze(a);
+  a = Object.freeze(a).map(function(n) { return 2*Number(n); });
+
+  for (var i in a) {
+    assertEquals(2.2, a[i]);
+    assertEquals('1', i);
+  }
+
+  // Skip over missing properties.
+  a = {
+    "0": 1.1,
+    "2": 2,
+    length: 3
+  };
+  var received = [];
+  assertArrayEquals([2.2, , 4],
+      Array.prototype.map.call(Object.freeze(a), function(n) {
+        received.push(n);
+        return n * 2;
+      }));
+  assertArrayEquals([1.1, 2], received);
+
+  // Modify array prototype
+  a = [1.1, , 2];
+  received = [];
+  assertThrows(() => {
+    Array.prototype.map.call(Object.freeze(a), function(n) {
+      a.__proto__ = null;
+      received.push(n);
+      return n * 2;
+    });
+  }, TypeError);
+  assertArrayEquals([], received);
+
+  // Create a new object in each function call when receiver is a
+  // primitive value. See ECMA-262, Annex C.
+  a = [];
+  Object.freeze([1.1, 2]).map(function() { a.push(this) }, "");
+  assertTrue(a[0] !== a[1]);
+
+  // Do not create a new object otherwise.
+  a = [];
+  Object.freeze([1.1, 2]).map(function() { a.push(this) }, {});
+  assertSame(a[0], a[1]);
+
+  // In strict mode primitive values should not be coerced to an object.
+  a = [];
+  Object.freeze([1.1, 1.2]).map(function() { 'use strict'; a.push(this); }, "");
+  assertEquals("", a[0]);
+  assertEquals(a[0], a[1]);
+
+})();
diff --git a/src/v8/test/mjsunit/object-get-own-property-names.js b/src/v8/test/mjsunit/object-get-own-property-names.js
index aee6585..7ce24fe 100644
--- a/src/v8/test/mjsunit/object-get-own-property-names.js
+++ b/src/v8/test/mjsunit/object-get-own-property-names.js
@@ -28,6 +28,9 @@
 // Test ES5 section 15.2.3.4 Object.getOwnPropertyNames.
 
 // Check simple cases.
+var obj = {};
+assertEquals(0, Object.getOwnPropertyNames(obj).length);
+
 var obj = { a: 1, b: 2};
 var propertyNames = Object.getOwnPropertyNames(obj);
 propertyNames.sort();
@@ -52,6 +55,13 @@
 assertEquals("c", propertyNames[1]);
 
 // Check that non-enumerable properties are being returned.
+var obj = {};
+Object.defineProperty(obj, 'x', {
+  value: 1,
+  enumerable: false
+});
+assertEquals(1, Object.getOwnPropertyNames(obj).length);
+
 var propertyNames = Object.getOwnPropertyNames([1, 2]);
 propertyNames.sort();
 assertEquals(3, propertyNames.length);
diff --git a/src/v8/test/mjsunit/object-keys-typedarray.js b/src/v8/test/mjsunit/object-keys-typedarray.js
new file mode 100644
index 0000000..b80608b
--- /dev/null
+++ b/src/v8/test/mjsunit/object-keys-typedarray.js
@@ -0,0 +1,17 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+[Int8Array, Uint8Array, Uint8ClampedArray, Int16Array, Uint16Array, Int32Array,
+ Uint32Array, Float32Array, Float64Array]
+    .forEach(constructor => {
+      const huge = new constructor(128);
+      assertEquals(Array.from({length: 128}).map((_, i) => String(i)),
+                   Object.keys(huge));
+
+      const tiny = new constructor(2);
+      assertEquals(["0", "1"], Object.keys(tiny));
+
+      const empty = new constructor(0);
+      assertEquals([], Object.keys(empty));
+});
diff --git a/src/v8/test/mjsunit/object-keys.js b/src/v8/test/mjsunit/object-keys.js
index 29eb85d..847a673 100644
--- a/src/v8/test/mjsunit/object-keys.js
+++ b/src/v8/test/mjsunit/object-keys.js
@@ -4,6 +4,31 @@
 
 // Flags: --allow-natives-syntax
 
+// Ensure empty keys are handled properly
+(function() {
+  const a = {};
+  let k = Object.keys(a);
+  %HeapObjectVerify(k);
+  assertEquals(0, k.length);
+})();
+
+// Ensure non-enumerable keys are handled properly
+(function() {
+  const a = {};
+  Object.defineProperty(a, 'x', {
+    value: 1,
+    enumerable: false
+  });
+  let k = Object.keys(a);
+  %HeapObjectVerify(k);
+  assertEquals(0, k.length);
+
+  a.y = 2;
+  k = Object.keys(a);
+  %HeapObjectVerify(k);
+  assertEquals(1, k.length);
+})();
+
 // Ensure that mutation of the Object.keys result doesn't affect the
 // enumeration cache for fast-mode objects.
 (function() {
@@ -32,3 +57,61 @@
   k.shift();
   assertEquals(0, k.length);
 })();
+
+// Ensure we invoke all steps on proxies.
+(function ObjectKeysProxy() {
+  let log = [];
+  let result = Object.keys(new Proxy({}, {
+    ownKeys(target) {
+      log.push('ownKeys');
+      return ['a', 'b', 'c'];
+    },
+    getOwnPropertyDescriptor(target, key) {
+      log.push('getOwnPropertyDescriptor-' + key);
+      if (key === 'b') return {enumerable: false, configurable: true};
+      return {enumerable: true, configurable: true};
+    }
+  }));
+  assertEquals(['a', 'c'], result);
+  assertEquals(
+      [
+        'ownKeys', 'getOwnPropertyDescriptor-a', 'getOwnPropertyDescriptor-b',
+        'getOwnPropertyDescriptor-c'
+      ],
+      log);
+
+  // Test normal target.
+  log = [];
+  let target = {a: 1, b: 1, c: 1};
+  let handler = {
+    getOwnPropertyDescriptor(target, key) {
+      log.push('getOwnPropertyDescriptor-' + key);
+      if (key === 'b') return {enumerable: false, configurable: true};
+      return {enumerable: true, configurable: true};
+    }
+  };
+  result = Object.keys(new Proxy(target, handler));
+  assertEquals(['a', 'c'], result);
+  assertEquals(
+      [
+        'getOwnPropertyDescriptor-a', 'getOwnPropertyDescriptor-b',
+        'getOwnPropertyDescriptor-c'
+      ],
+      log);
+
+  // Test trap invocation with non-enumerable target properties.
+  log = [];
+  target = Object.create(Object.prototype, {
+    a: {enumerable: true, configurable: true},
+    b: {enumerable: false, configurable: true},
+    c: {enumerable: true, configurable: true}
+  });
+  result = Object.keys(new Proxy(target, handler));
+  assertEquals(['a', 'c'], result);
+  assertEquals(
+      [
+        'getOwnPropertyDescriptor-a', 'getOwnPropertyDescriptor-b',
+        'getOwnPropertyDescriptor-c'
+      ],
+      log);
+})();
diff --git a/src/v8/test/mjsunit/object-literal-overwrite.js b/src/v8/test/mjsunit/object-literal-overwrite.js
index 4d19d35..955c5a2 100644
--- a/src/v8/test/mjsunit/object-literal-overwrite.js
+++ b/src/v8/test/mjsunit/object-literal-overwrite.js
@@ -33,51 +33,33 @@
 
 // Tests for the full code generator (if active).
 
-var foo1 = {
-  bar: 6,
-  bar: 7
-};
+var foo1 = {bar: 6, bar: 7};
 
-var foo2 = {
-  bar: function(a){},
-  bar: 7
-};
+var foo2 = {bar: function(a) {}, bar: 7};
 
-var foo3 = {
-  bar: function(a){},
-  bar: function(b){},
-  bar: 7
-};
+var foo3 = {bar: function(a) {}, bar: function(b) {}, bar: 7};
 
 var foo4 = {
-  bar: function(b){},
+  bar: function(b) {},
   bar: 4,
-  bar: function(){return 7},
+  bar: function() {
+    return 7;
+  }
 };
 
-var foo5 = {
-  13: function(a){},
-  13: 7
-}
+var foo5 = {13: function(a) {}, 13: 7};
 
-var foo6 = {
-  14.31: function(a){},
-  14.31: 7
-}
+var foo6 = {14.31: function(a) {}, 14.31: 7};
 
-var foo7 = {
-  15: 6,
-  15: 7
-}
+var foo7 = {15: 6, 15: 7};
 
 function foo8(i) {
-  var obj = {
-    x: {a: i},
-    x: 7
-  };
+  var obj = {x: {a: i}, x: 7};
+
   return obj.x;
 };
-
+%PrepareFunctionForOptimization(foo8);
+;
 assertEquals(7, foo1.bar);
 assertEquals(7, foo2.bar);
 assertEquals(7, foo3.bar);
@@ -95,18 +77,23 @@
 // Test for the classic code generator.
 
 function fun(x) {
-  var inner = { j: function(x) { return x; }, j: 7 };
+  var inner = {
+    j: function(x) {
+      return x;
+    },
+    j: 7
+  };
   return inner.j;
 }
 
-assertEquals(7, fun(7) );
+assertEquals(7, fun(7));
 
 // Check that the initializers of computed properties are executed, even if
 // no store instructions are generated for the literals.
 
 var glob1 = 0;
 
-var bar1 = { x: glob1++, x: glob1++, x: glob1++, x: 7};
+var bar1 = {x: glob1++, x: glob1++, x: glob1++, x: 7};
 
 assertEquals(3, glob1);
 
@@ -114,7 +101,7 @@
 var glob2 = 0;
 
 function fun2() {
-  var r = { y: glob2++, y: glob2++, y: glob2++, y: 7};
+  var r = {y: glob2++, y: glob2++, y: glob2++, y: 7};
   return r.y;
 }
 
@@ -125,7 +112,7 @@
 var glob3 = 0;
 
 function fun3() {
-  var r = { 113: glob3++, 113: glob3++, 113: glob3++, 113: 7};
+  var r = {113: glob3++, 113: glob3++, 113: glob3++, 113: 7};
   return r[113];
 }
 
diff --git a/src/v8/test/mjsunit/object-literal.js b/src/v8/test/mjsunit/object-literal.js
index cbc4f5d..0050792 100644
--- a/src/v8/test/mjsunit/object-literal.js
+++ b/src/v8/test/mjsunit/object-literal.js
@@ -28,6 +28,7 @@
 // Flags: --allow-natives-syntax
 
 function runLiteralsTest(fn) {
+  %PrepareFunctionForOptimization(fn);
   // The first run creates an copy directly from the boilerplate decsription.
   fn();
   // The second run will create the boilerplate.
@@ -531,6 +532,7 @@
   function f() {
     return {__proto__:null, bar:"barValue"};
   }
+  %PrepareFunctionForOptimization(f);
   let obj = f();
   assertFalse(%HasFastProperties(obj));
   assertEquals(Object.getPrototypeOf(obj), null);
diff --git a/src/v8/test/mjsunit/object-prevent-extensions.js b/src/v8/test/mjsunit/object-prevent-extensions.js
index 9f3091e..4bda84e 100644
--- a/src/v8/test/mjsunit/object-prevent-extensions.js
+++ b/src/v8/test/mjsunit/object-prevent-extensions.js
@@ -30,6 +30,8 @@
 // Flags: --allow-natives-syntax
 
 
+assertFalse(Object.isExtensible());
+
 var obj1 = {};
 // Extensible defaults to true.
 assertTrue(Object.isExtensible(obj1));
@@ -160,3 +162,773 @@
 assertFalse(Object.isSealed(obj));
 assertFalse(Object.isSealed(obj2));
 assertTrue(%HaveSameMap(obj, obj2));
+
+// Test packed element array built-in functions with preventExtensions.
+obj = new Array(undefined, null, 1, -1, 'a', Symbol("test"));
+assertTrue(%HasPackedElements(obj));
+Object.preventExtensions(obj);
+assertFalse(Object.isSealed(obj));
+assertFalse(Object.isFrozen(obj));
+assertFalse(Object.isExtensible(obj));
+assertTrue(Array.isArray(obj));
+
+// Verify that the length can't be written by builtins.
+assertThrows(function() { obj.push(1); }, TypeError);
+assertDoesNotThrow(function() { obj.shift(); });
+assertThrows(function() { obj.unshift(1); }, TypeError);
+assertThrows(function() { obj.splice(0, 0, 1); }, TypeError);
+assertDoesNotThrow(function() {obj.splice(0, 0)});
+
+// Verify search, filter, iterator
+obj = new Array(undefined, null, 1, -1, 'a', Symbol("test"));
+assertTrue(%HasPackedElements(obj));
+Object.preventExtensions(obj);
+assertFalse(Object.isSealed(obj));
+assertFalse(Object.isFrozen(obj));
+assertFalse(Object.isExtensible(obj));
+assertTrue(Array.isArray(obj));
+assertEquals(obj.lastIndexOf(1), 2);
+assertEquals(obj.indexOf('a'), 4);
+assertEquals(obj.indexOf(undefined), 0);
+assertFalse(obj.includes(Symbol("test")));
+assertTrue(obj.includes(undefined));
+assertFalse(obj.includes(NaN));
+assertTrue(obj.includes());
+assertEquals(obj.find(x => x==0), undefined);
+assertEquals(obj.findIndex(x => x=='a'), 4);
+assertTrue(obj.some(x => typeof x == 'symbol'));
+assertFalse(obj.every(x => x == -1));
+var filteredArray = obj.filter(e => typeof e == "symbol");
+assertEquals(filteredArray.length, 1);
+assertEquals(obj.map(x => x), obj);
+var countPositiveNumber = 0;
+obj.forEach(function(item, index) {
+  if (item === 1) {
+    countPositiveNumber++;
+    assertEquals(index, 2);
+  }
+});
+assertEquals(countPositiveNumber, 1);
+assertEquals(obj.length, obj.concat([]).length);
+var iterator = obj.values();
+assertEquals(iterator.next().value, undefined);
+assertEquals(iterator.next().value, null);
+var iterator = obj.keys();
+assertEquals(iterator.next().value, 0);
+assertEquals(iterator.next().value, 1);
+var iterator = obj.entries();
+assertEquals(iterator.next().value, [0, undefined]);
+assertEquals(iterator.next().value, [1, null]);
+
+// Verify that the value can be written
+var length = obj.length;
+for (var i = 0; i < length-1; i++) {
+  obj[i] = 'new';
+  assertEquals(obj[i], 'new');
+}
+
+// Verify flat, map, flatMap, join, reduce, reduceRight for non-extensible packed array
+var arr = ['a', 'b', 'c'];
+assertTrue(%HasPackedElements(arr));
+Object.preventExtensions(arr);
+assertFalse(Object.isSealed(obj));
+assertFalse(Object.isFrozen(obj));
+assertFalse(Object.isExtensible(obj));
+assertTrue(Array.isArray(obj));
+assertEquals(arr.map(x => [x]), [['a'], ['b'], ['c']]);
+assertEquals(arr.flatMap(x => [x]), arr);
+assertEquals(arr.flat(), arr);
+assertEquals(arr.join('-'), "a-b-c");
+const reducer = (accumulator, currentValue) => accumulator + currentValue;
+assertEquals(arr.reduce(reducer), "abc");
+assertEquals(arr.reduceRight(reducer), "cba");
+assertEquals(arr.slice(0, 1), ['a']);
+
+// Verify change content of non-extensible packed array
+arr.sort();
+assertEquals(arr.join(''), "abc");
+arr.reverse();
+assertEquals(arr.join(''), "cba");
+arr.copyWithin(0, 1, 2);
+assertEquals(arr.join(''),"bba");
+arr.fill('d');
+assertEquals(arr.join(''), "ddd");
+arr.pop();
+assertEquals(arr.join(''), "dd");
+
+// Regression test with simple array
+var arr = ['a'];
+Object.preventExtensions(arr);
+arr[0] = 'b';
+assertEquals(arr[0], 'b');
+
+// Test regression Array.concat with double
+var arr = ['a'];
+Object.preventExtensions(arr);
+arr = arr.concat(0.5);
+assertEquals(arr, ['a', 0.5]);
+Object.preventExtensions(arr);
+arr = arr.concat([1.5, 'b']);
+assertEquals(arr, ['a', 0.5, 1.5, 'b']);
+
+// Regression test with change length
+var arr = ['a', 'b'];
+Object.preventExtensions(arr);
+assertEquals(arr.length, 2);
+arr.length = 3;
+assertEquals(arr.length, 3);
+arr[2] = 'c';
+assertEquals(arr[2], undefined);
+arr.length = 1;
+assertEquals(arr.length, 1);
+assertEquals(arr[1], undefined);
+
+// Test for holey array
+// Test holey element array built-in functions with preventExtensions.
+obj = [undefined, null, 1, , -1, 'a', Symbol("test")];
+assertTrue(%HasHoleyElements(obj));
+Object.preventExtensions(obj);
+assertFalse(Object.isSealed(obj));
+assertFalse(Object.isFrozen(obj));
+assertFalse(Object.isExtensible(obj));
+assertTrue(Array.isArray(obj));
+
+// Verify that the length can't be written by builtins.
+assertThrows(function() { obj.push(1); }, TypeError);
+assertThrows(function() { obj.shift(); }, TypeError);
+assertThrows(function() { obj.unshift(1); }, TypeError);
+assertThrows(function() { obj.splice(0, 0, 1); }, TypeError);
+assertDoesNotThrow(function() {obj.splice(0, 0)});
+
+// Verify search, filter, iterator
+obj = [undefined, null, 1, ,-1, 'a', Symbol("test")];
+assertTrue(%HasHoleyElements(obj));
+Object.preventExtensions(obj);
+assertFalse(Object.isSealed(obj));
+assertFalse(Object.isFrozen(obj));
+assertFalse(Object.isExtensible(obj));
+assertTrue(Array.isArray(obj));
+assertEquals(obj.lastIndexOf(1), 2);
+assertEquals(obj.indexOf('a'), 5);
+assertEquals(obj.indexOf(undefined), 0);
+assertFalse(obj.includes(Symbol("test")));
+assertTrue(obj.includes(undefined));
+assertFalse(obj.includes(NaN));
+assertTrue(obj.includes());
+assertEquals(obj.find(x => x==0), undefined);
+assertEquals(obj.findIndex(x => x=='a'), 5);
+assertTrue(obj.some(x => typeof x == 'symbol'));
+assertFalse(obj.every(x => x == -1));
+var filteredArray = obj.filter(e => typeof e == "symbol");
+assertEquals(filteredArray.length, 1);
+assertEquals(obj.map(x => x), obj);
+var countPositiveNumber = 0;
+obj.forEach(function(item, index) {
+  if (item === 1) {
+    countPositiveNumber++;
+    assertEquals(index, 2);
+  }
+});
+assertEquals(countPositiveNumber, 1);
+assertEquals(obj.length, obj.concat([]).length);
+var iterator = obj.values();
+assertEquals(iterator.next().value, undefined);
+assertEquals(iterator.next().value, null);
+var iterator = obj.keys();
+assertEquals(iterator.next().value, 0);
+assertEquals(iterator.next().value, 1);
+var iterator = obj.entries();
+assertEquals(iterator.next().value, [0, undefined]);
+assertEquals(iterator.next().value, [1, null]);
+
+// Verify that the value can be written
+var length = obj.length;
+for (var i = 0; i < length-1; i++) {
+  if (i==3) continue;
+  obj[i] = 'new';
+  assertEquals(obj[i], 'new');
+}
+
+// Verify flat, map, flatMap, join, reduce, reduceRight for non-extensible holey array
+var arr = [, 'a', 'b', 'c'];
+assertTrue(%HasHoleyElements(arr));
+Object.preventExtensions(arr);
+assertFalse(Object.isSealed(obj));
+assertFalse(Object.isFrozen(obj));
+assertFalse(Object.isExtensible(obj));
+assertTrue(Array.isArray(obj));
+assertEquals(arr.map(x => [x]), [, ['a'], ['b'], ['c']]);
+assertEquals(arr.flatMap(x => [x]), ["a", "b", "c"]);
+assertEquals(arr.flat(), ["a", "b", "c"]);
+assertEquals(arr.join('-'), "-a-b-c");
+const reducer1 = (accumulator, currentValue) => accumulator + currentValue;
+assertEquals(arr.reduce(reducer1), "abc");
+assertEquals(arr.reduceRight(reducer1), "cba");
+assertEquals(arr.slice(0, 1), [,]);
+assertEquals(arr.slice(1, 2), ["a"]);
+
+// Verify change content of non-extensible holey array
+assertThrows(function(){arr.sort();}, TypeError);
+assertEquals(arr.join(''), "abc");
+assertThrows(function(){arr.reverse();}, TypeError);
+assertEquals(arr.join(''), "abc");
+assertThrows(function(){arr.copyWithin(0, 1, 2);}, TypeError);
+arr.copyWithin(1, 2, 3);
+assertEquals(arr.join(''),"bbc");
+assertThrows(function(){arr.fill('d');}, TypeError);
+assertEquals(arr.join(''), "bbc");
+arr.pop();
+assertEquals(arr.join(''), "bb");
+
+// Regression test with simple holey array
+var arr = [, 'a'];
+Object.preventExtensions(arr);
+arr[1] = 'b';
+assertEquals(arr[1], 'b');
+arr[0] = 1;
+assertEquals(arr[0], undefined);
+
+// Test regression Array.concat with double
+var arr = ['a', , 'b'];
+Object.preventExtensions(arr);
+arr = arr.concat(0.5);
+assertEquals(arr, ['a', ,'b', 0.5]);
+Object.preventExtensions(arr);
+arr = arr.concat([1.5, 'c']);
+assertEquals(arr, ['a', ,'b', 0.5, 1.5, 'c']);
+
+// Regression test with change length
+var arr = ['a', , 'b'];
+Object.preventExtensions(arr);
+assertEquals(arr.length, 3);
+arr.length = 4;
+assertEquals(arr.length, 4);
+arr[3] = 'c';
+assertEquals(arr[3], undefined);
+arr.length = 2;
+assertEquals(arr.length, 2);
+assertEquals(arr[2], undefined);
+assertEquals(arr.pop(), undefined);
+assertEquals(arr.length, 1);
+assertEquals(arr[1], undefined);
+
+// Change length with holey entries at the end
+var arr = ['a', ,];
+Object.preventExtensions(arr);
+assertEquals(arr.length, 2);
+arr.length = 0;
+assertEquals(arr.length, 0);
+arr.length = 3;
+assertEquals(arr.length, 3);
+arr.length = 0;
+assertEquals(arr.length, 0);
+
+// Spread with array
+var arr = ['a', 'b', 'c'];
+Object.preventExtensions(arr);
+var arrSpread = [...arr];
+assertEquals(arrSpread.length, arr.length);
+assertEquals(arrSpread[0], 'a');
+assertEquals(arrSpread[1], 'b');
+assertEquals(arrSpread[2], 'c');
+
+// Spread with array-like
+function returnArgs() {
+  return Object.preventExtensions(arguments);
+}
+var arrLike = returnArgs('a', 'b', 'c');
+assertFalse(Object.isExtensible(arrLike));
+var arrSpread = [...arrLike];
+assertEquals(arrSpread.length, arrLike.length);
+assertEquals(arrSpread[0], 'a');
+assertEquals(arrSpread[1], 'b');
+assertEquals(arrSpread[2], 'c');
+
+// Spread with holey
+function countArgs() {
+  return arguments.length;
+}
+var arr = [, 'b','c'];
+Object.preventExtensions(arr);
+assertEquals(countArgs(...arr), 3);
+assertEquals(countArgs(...[...arr]), 3);
+assertEquals(countArgs.apply(this, [...arr]), 3);
+function checkUndefined() {
+  return arguments[0] === undefined;
+}
+assertTrue(checkUndefined(...arr));
+assertTrue(checkUndefined(...[...arr]));
+assertTrue(checkUndefined.apply(this, [...arr]));
+
+//
+// Array.prototype.map
+//
+(function() {
+  var a = Object.preventExtensions(['0','1','2','3','4']);
+
+  // Simple use.
+  var result = [1,2,3,4,5];
+  assertArrayEquals(result, a.map(function(n) { return Number(n) + 1; }));
+
+  // Use specified object as this object when calling the function.
+  var o = { delta: 42 }
+  result = [42,43,44,45,46];
+  assertArrayEquals(result, a.map(function(n) { return this.delta + Number(n); }, o));
+
+  // Modify original array.
+  b = Object.preventExtensions(['0','1','2','3','4']);
+  result = [1,2,3,4,5];
+  assertArrayEquals(result,
+      b.map(function(n, index, array) {
+        array[index] = Number(n) + 1; return Number(n) + 1;
+      }));
+  assertArrayEquals(b, result);
+
+  // Only loop through initial part of array and elements are not
+  // added.
+  a = Object.preventExtensions(['0','1','2','3','4']);
+  result = [1,2,3,4,5];
+  assertArrayEquals(result,
+      a.map(function(n, index, array) { assertThrows(() => { array.push(n) }); return Number(n) + 1; }));
+  assertArrayEquals(['0','1','2','3','4'], a);
+
+  // Respect holes.
+  a = new Array(20);
+  a[1] = '2';
+  Object.preventExtensions(a);
+  a = Object.preventExtensions(a).map(function(n) { return 2*Number(n); });
+
+  for (var i in a) {
+    assertEquals(4, a[i]);
+    assertEquals('1', i);
+  }
+
+  // Skip over missing properties.
+  a = {
+    "0": 1,
+    "2": 2,
+    length: 3
+  };
+  var received = [];
+  assertArrayEquals([2, , 4],
+      Array.prototype.map.call(Object.preventExtensions(a), function(n) {
+        received.push(n);
+        return n * 2;
+      }));
+  assertArrayEquals([1, 2], received);
+
+  // Modify array prototype
+  a = ['1', , 2];
+  received = [];
+  assertThrows(() => {
+    Array.prototype.map.call(Object.preventExtensions(a), function(n) {
+      a.__proto__ = null;
+      received.push(n);
+      return n * 2;
+    });
+  }, TypeError);
+  assertArrayEquals([], received);
+
+  // Create a new object in each function call when receiver is a
+  // primitive value. See ECMA-262, Annex C.
+  a = [];
+  Object.preventExtensions(['1', '2']).map(function() { a.push(this) }, "");
+  assertTrue(a[0] !== a[1]);
+
+  // Do not create a new object otherwise.
+  a = [];
+  Object.preventExtensions(['1', '2']).map(function() { a.push(this) }, {});
+  assertSame(a[0], a[1]);
+
+  // In strict mode primitive values should not be coerced to an object.
+  a = [];
+  Object.preventExtensions(['1', '2']).map(function() { 'use strict'; a.push(this); }, "");
+  assertEquals("", a[0]);
+  assertEquals(a[0], a[1]);
+
+})();
+
+
+// Test for double element
+// Test packed element array built-in functions with preventExtensions.
+obj = new Array(-1.1, 0, 1, -1, 1.1);
+assertTrue(%HasDoubleElements(obj));
+Object.preventExtensions(obj);
+assertFalse(Object.isSealed(obj));
+assertFalse(Object.isFrozen(obj));
+assertFalse(Object.isExtensible(obj));
+assertTrue(Array.isArray(obj));
+
+// Verify that the length can't be written by builtins.
+assertThrows(function() { obj.push(1); }, TypeError);
+assertDoesNotThrow(function() { obj.shift(); });
+assertThrows(function() { obj.unshift(1); }, TypeError);
+assertThrows(function() { obj.splice(0, 0, 1); }, TypeError);
+assertDoesNotThrow(function() {obj.splice(0, 0)});
+
+// Verify search, filter, iterator
+obj = new Array(-1.1, 0, 1, -1, 1.1);
+assertTrue(%HasDoubleElements(obj));
+Object.preventExtensions(obj);
+assertFalse(Object.isSealed(obj));
+assertFalse(Object.isFrozen(obj));
+assertFalse(Object.isExtensible(obj));
+assertTrue(Array.isArray(obj));
+assertEquals(obj.lastIndexOf(1), 2);
+assertEquals(obj.indexOf(1.1), 4);
+assertEquals(obj.indexOf(undefined), -1);
+assertFalse(obj.includes(Symbol("test")));
+assertFalse(obj.includes(undefined));
+assertFalse(obj.includes(NaN));
+assertFalse(obj.includes());
+assertEquals(obj.find(x => x==0), 0);
+assertEquals(obj.findIndex(x => x==1.1), 4);
+assertFalse(obj.some(x => typeof x == 'symbol'));
+assertFalse(obj.every(x => x == -1));
+var filteredArray = obj.filter(e => typeof e == "symbol");
+assertEquals(filteredArray.length, 0);
+assertEquals(obj.map(x => x), obj);
+var countPositiveNumber = 0;
+obj.forEach(function(item, index) {
+  if (item === 1) {
+    countPositiveNumber++;
+    assertEquals(index, 2);
+  }
+});
+assertEquals(countPositiveNumber, 1);
+assertEquals(obj.length, obj.concat([]).length);
+var iterator = obj.values();
+assertEquals(iterator.next().value, -1.1);
+assertEquals(iterator.next().value, 0);
+var iterator = obj.keys();
+assertEquals(iterator.next().value, 0);
+assertEquals(iterator.next().value, 1);
+var iterator = obj.entries();
+assertEquals(iterator.next().value, [0, -1.1]);
+assertEquals(iterator.next().value, [1, 0]);
+
+// Verify that the value can be written
+var length = obj.length;
+for (var i = 0; i < length-1; i++) {
+  obj[i] = 'new';
+  assertEquals(obj[i], 'new');
+}
+
+// Verify flat, map, flatMap, join, reduce, reduceRight for non-extensible packed array
+var arr = [1.1, 0, 1];
+assertTrue(%HasDoubleElements(arr));
+Object.preventExtensions(arr);
+assertFalse(Object.isSealed(obj));
+assertFalse(Object.isFrozen(obj));
+assertFalse(Object.isExtensible(obj));
+assertTrue(Array.isArray(obj));
+assertEquals(arr.map(x => [x]), [[1.1], [0], [1]]);
+assertEquals(arr.flatMap(x => [x]), arr);
+assertEquals(arr.flat(), arr);
+assertEquals(arr.join('-'), "1.1-0-1");
+assertEquals(arr.reduce(reducer), 2.1);
+assertEquals(arr.reduceRight(reducer), 2.1);
+assertEquals(arr.slice(0, 1), [1.1]);
+
+// Verify change content of non-extensible packed array
+arr.sort();
+assertEquals(arr.join(''), "011.1");
+arr.reverse();
+assertEquals(arr.join(''), "1.110");
+arr.copyWithin(0, 1, 2);
+assertEquals(arr.join(''),"110");
+arr.fill('d');
+assertEquals(arr.join(''), "ddd");
+arr.pop();
+assertEquals(arr.join(''), "dd");
+
+// Regression test with simple array
+var arr = [1.1];
+Object.preventExtensions(arr);
+arr[0] = 'b';
+assertEquals(arr[0], 'b');
+
+// Test regression Array.concat with double
+var arr = [1.1];
+Object.preventExtensions(arr);
+arr = arr.concat(0.5);
+assertEquals(arr, [1.1, 0.5]);
+Object.preventExtensions(arr);
+arr = arr.concat([1.5, 'b']);
+assertEquals(arr, [1.1, 0.5, 1.5, 'b']);
+
+// Regression test with change length
+var arr = [1.1, 0];
+Object.preventExtensions(arr);
+assertEquals(arr.length, 2);
+arr.length = 3;
+assertEquals(arr.length, 3);
+arr[2] = 'c';
+assertEquals(arr[2], undefined);
+arr.length = 1;
+assertEquals(arr.length, 1);
+assertEquals(arr[1], undefined);
+
+// Test for holey array
+// Test holey element array built-in functions with preventExtensions.
+obj = [-1.1, 0, 1, , -1, 1.1];
+assertTrue(%HasDoubleElements(obj));
+Object.preventExtensions(obj);
+assertFalse(Object.isSealed(obj));
+assertFalse(Object.isFrozen(obj));
+assertFalse(Object.isExtensible(obj));
+assertTrue(Array.isArray(obj));
+
+// Verify that the length can't be written by builtins.
+assertThrows(function() { obj.push(1); }, TypeError);
+assertThrows(function() { obj.shift(); }, TypeError);
+assertThrows(function() { obj.unshift(1); }, TypeError);
+assertThrows(function() { obj.splice(0, 0, 1); }, TypeError);
+assertDoesNotThrow(function() {obj.splice(0, 0)});
+
+// Verify search, filter, iterator
+obj = [-1.1, 0, 1, ,-1, 1.1];
+assertTrue(%HasHoleyElements(obj));
+Object.preventExtensions(obj);
+assertFalse(Object.isSealed(obj));
+assertFalse(Object.isFrozen(obj));
+assertFalse(Object.isExtensible(obj));
+assertTrue(Array.isArray(obj));
+assertEquals(obj.lastIndexOf(1), 2);
+assertEquals(obj.indexOf(1.1), 5);
+assertEquals(obj.indexOf(undefined), -1);
+assertFalse(obj.includes(Symbol("test")));
+assertTrue(obj.includes(undefined));
+assertFalse(obj.includes(NaN));
+assertTrue(obj.includes());
+assertEquals(obj.find(x => x==0), 0);
+assertEquals(obj.findIndex(x => x==1.1), 5);
+assertFalse(obj.some(x => typeof x == 'symbol'));
+assertFalse(obj.every(x => x == -1));
+var filteredArray = obj.filter(e => typeof e == "symbol");
+assertEquals(filteredArray.length, 0);
+assertEquals(obj.map(x => x), obj);
+var countPositiveNumber = 0;
+obj.forEach(function(item, index) {
+  if (item === 1) {
+    countPositiveNumber++;
+    assertEquals(index, 2);
+  }
+});
+assertEquals(countPositiveNumber, 1);
+assertEquals(obj.length, obj.concat([]).length);
+var iterator = obj.values();
+assertEquals(iterator.next().value, -1.1);
+assertEquals(iterator.next().value, 0);
+var iterator = obj.keys();
+assertEquals(iterator.next().value, 0);
+assertEquals(iterator.next().value, 1);
+var iterator = obj.entries();
+assertEquals(iterator.next().value, [0, -1.1]);
+assertEquals(iterator.next().value, [1, 0]);
+
+// Verify that the value can be written
+var length = obj.length;
+for (var i = 0; i < length-1; i++) {
+  if (i==3) continue;
+  obj[i] = 'new';
+  assertEquals(obj[i], 'new');
+}
+
+// Verify flat, map, flatMap, join, reduce, reduceRight for non-extensible holey array
+var arr = [, 1.1, 0, 1];
+assertTrue(%HasDoubleElements(arr));
+Object.preventExtensions(arr);
+assertFalse(Object.isSealed(obj));
+assertFalse(Object.isFrozen(obj));
+assertFalse(Object.isExtensible(obj));
+assertTrue(Array.isArray(obj));
+assertEquals(arr.map(x => [x]), [, [1.1], [0], [1]]);
+assertEquals(arr.flatMap(x => [x]), [1.1, 0, 1]);
+assertEquals(arr.flat(), [1.1, 0, 1]);
+assertEquals(arr.join('-'), "-1.1-0-1");
+assertEquals(arr.reduce(reducer1), 2.1);
+assertEquals(arr.reduceRight(reducer1), 2.1);
+assertEquals(arr.slice(0, 1), [,]);
+assertEquals(arr.slice(1, 2), [1.1]);
+
+// Verify change content of non-extensible holey array
+assertThrows(function(){arr.sort();}, TypeError);
+assertEquals(arr.join(''), "1.101");
+assertThrows(function(){arr.reverse();}, TypeError);
+assertEquals(arr.join(''), "1.101");
+assertThrows(function(){arr.copyWithin(0, 1, 2);}, TypeError);
+arr.copyWithin(1, 2, 3);
+assertEquals(arr.join(''),"001");
+assertThrows(function(){arr.fill('d');}, TypeError);
+assertEquals(arr.join(''), "001");
+arr.pop();
+assertEquals(arr.join(''), "00");
+
+// Regression test with simple holey array
+var arr = [, 1.1];
+Object.preventExtensions(arr);
+arr[1] = 'b';
+assertEquals(arr[1], 'b');
+arr[0] = 1;
+assertEquals(arr[0], undefined);
+
+// Test regression Array.concat with double
+var arr = [1.1, , 0];
+Object.preventExtensions(arr);
+arr = arr.concat(0.5);
+assertEquals(arr, [1.1, , 0, 0.5]);
+Object.preventExtensions(arr);
+arr = arr.concat([1.5, 'c']);
+assertEquals(arr, [1.1, , 0, 0.5, 1.5, 'c']);
+
+// Regression test with change length
+var arr = [1.1, , 0];
+Object.preventExtensions(arr);
+assertEquals(arr.length, 3);
+arr.length = 4;
+assertEquals(arr.length, 4);
+arr[3] = 'c';
+assertEquals(arr[3], undefined);
+arr.length = 2;
+assertEquals(arr.length, 2);
+assertEquals(arr[2], undefined);
+assertEquals(arr.pop(), undefined);
+assertEquals(arr.length, 1);
+assertEquals(arr[1], undefined);
+
+// Change length with holey entries at the end
+var arr = [1.1, ,];
+Object.preventExtensions(arr);
+assertEquals(arr.length, 2);
+arr.length = 0;
+assertEquals(arr.length, 0);
+arr.length = 3;
+assertEquals(arr.length, 3);
+arr.length = 0;
+assertEquals(arr.length, 0);
+
+// Spread with array
+var arr = [1.1, 0, -1];
+Object.preventExtensions(arr);
+var arrSpread = [...arr];
+assertEquals(arrSpread.length, arr.length);
+assertEquals(arrSpread[0], 1.1);
+assertEquals(arrSpread[1], 0);
+assertEquals(arrSpread[2], -1);
+
+// Spread with array-like
+function returnArgs() {
+  return Object.preventExtensions(arguments);
+}
+var arrLike = returnArgs(1.1, 0, -1);
+assertFalse(Object.isExtensible(arrLike));
+var arrSpread = [...arrLike];
+assertEquals(arrSpread.length, arrLike.length);
+assertEquals(arrSpread[0], 1.1);
+assertEquals(arrSpread[1], 0);
+assertEquals(arrSpread[2], -1);
+
+// Spread with holey
+function countArgs() {
+  return arguments.length;
+}
+var arr = [, 1.1, 0];
+Object.preventExtensions(arr);
+assertEquals(countArgs(...arr), 3);
+assertEquals(countArgs(...[...arr]), 3);
+assertEquals(countArgs.apply(this, [...arr]), 3);
+function checkUndefined() {
+  return arguments[0] === undefined;
+}
+assertTrue(checkUndefined(...arr));
+assertTrue(checkUndefined(...[...arr]));
+assertTrue(checkUndefined.apply(this, [...arr]));
+
+//
+// Array.prototype.map
+//
+(function() {
+  var a = Object.preventExtensions([0.1,1,2,3,4]);
+
+  // Simple use.
+  var result = [1.1,2,3,4,5];
+  assertArrayEquals(result, a.map(function(n) { return Number(n) + 1; }));
+
+  // Use specified object as this object when calling the function.
+  var o = { delta: 42 }
+  result = [42.1,43,44,45,46];
+  assertArrayEquals(result, a.map(function(n) { return this.delta + Number(n); }, o));
+
+  // Modify original array.
+  b = Object.preventExtensions([0.1,1,2,3,4]);
+  result = [1.1,2,3,4,5];
+  assertArrayEquals(result,
+      b.map(function(n, index, array) {
+        array[index] = Number(n) + 1; return Number(n) + 1;
+      }));
+  assertArrayEquals(b, result);
+
+  // Only loop through initial part of array and elements are not
+  // added.
+  a = Object.preventExtensions([0.1,1,2,3,4]);
+  result = [1.1,2,3,4,5];
+  assertArrayEquals(result,
+      a.map(function(n, index, array) { assertThrows(() => { array.push(n) }); return Number(n) + 1; }));
+  assertArrayEquals([0.1,1,2,3,4], a);
+
+  // Respect holes.
+  a = new Array(20);
+  a[1] = 1.1;
+  Object.preventExtensions(a);
+  a = Object.preventExtensions(a).map(function(n) { return 2*Number(n); });
+
+  for (var i in a) {
+    assertEquals(2.2, a[i]);
+    assertEquals('1', i);
+  }
+
+  // Skip over missing properties.
+  a = {
+    "0": 1.1,
+    "2": 2,
+    length: 3
+  };
+  var received = [];
+  assertArrayEquals([2.2, , 4],
+      Array.prototype.map.call(Object.preventExtensions(a), function(n) {
+        received.push(n);
+        return n * 2;
+      }));
+  assertArrayEquals([1.1, 2], received);
+
+  // Modify array prototype
+  a = [1.1 , 2];
+  received = [];
+  assertThrows(() => {
+    Array.prototype.map.call(Object.preventExtensions(a), function(n) {
+      a.__proto__ = null;
+      received.push(n);
+      return n * 2;
+    });
+  }, TypeError);
+  assertArrayEquals([], received);
+
+  // Create a new object in each function call when receiver is a
+  // primitive value. See ECMA-262, Annex C.
+  a = [];
+  Object.preventExtensions([1.1, 2]).map(function() { a.push(this) }, "");
+  assertTrue(a[0] !== a[1]);
+
+  // Do not create a new object otherwise.
+  a = [];
+  Object.preventExtensions([1.1, 2]).map(function() { a.push(this) }, {});
+  assertSame(a[0], a[1]);
+
+  // In strict mode primitive values should not be coerced to an object.
+  a = [];
+  Object.preventExtensions([1.1, 2]).map(function() { 'use strict'; a.push(this); }, "");
+  assertEquals("", a[0]);
+  assertEquals(a[0], a[1]);
+
+})();
diff --git a/src/v8/test/mjsunit/object-seal.js b/src/v8/test/mjsunit/object-seal.js
index f685b41..684d94a 100644
--- a/src/v8/test/mjsunit/object-seal.js
+++ b/src/v8/test/mjsunit/object-seal.js
@@ -36,7 +36,7 @@
   assertSame(non_objects[key], Object.seal(non_objects[key]));
 }
 
-// Test that isFrozen always returns true for non-objects
+// Test that isSealed always returns true for non-objects
 for (var key in non_objects) {
   assertTrue(Object.isSealed(non_objects[key]));
 }
@@ -153,7 +153,6 @@
 // We should be able to overwrite the existing value.
 assertEquals('foo', arr[0]);
 
-
 // Test that isSealed returns the correct value even if configurable
 // has been set to false on all properties manually and the extensible
 // flag has also been set to false manually.
@@ -221,9 +220,11 @@
 // Verify that crankshaft still does the right thing.
 obj = [1, 2, 3];
 
-push_call = function(a) { a.push(1000); return a; }
+push_call = function(a) { a.push(1000); return a; };
+%PrepareFunctionForOptimization(push_call);
 // Include a call site that doesn't have a custom built-in.
-var shift_call = function(a) { a.shift(1000); return a; }
+var shift_call = function(a) { a.shift(1000); return a; };
+%PrepareFunctionForOptimization(shift_call);
 for (var i = 0; i < 3; i++) {
   push_call(obj);
   shift_call(obj);
@@ -389,3 +390,905 @@
 assertDoesNotThrow(function() { return new Sealed(); });
 Sealed.prototype.prototypeExists = true;
 assertTrue((new Sealed()).prototypeExists);
+
+obj = new Int32Array(10);
+Object.seal(obj);
+assertTrue(Object.isSealed(obj));
+
+// Test packed element array built-in functions with seal.
+function testPackedSealedArray1(obj) {
+  assertTrue(Object.isSealed(obj));
+  assertFalse(Object.isFrozen(obj));
+  assertTrue(Array.isArray(obj));
+
+  // Verify that the length can't be written by builtins.
+  assertThrows(function() { obj.pop(); }, TypeError);
+  assertThrows(function() { obj.push(1); }, TypeError);
+  assertThrows(function() { obj.shift(); }, TypeError);
+  assertThrows(function() { obj.unshift(1); }, TypeError);
+  assertThrows(function() { obj.splice(0); }, TypeError);
+  assertDoesNotThrow(function() { obj.splice(0, 0); });
+
+  // Verify search, filter, iterator
+  obj = new Array(undefined, null, 1, -1, 'a', Symbol("test"));
+  assertTrue(%HasPackedElements(obj));
+  Object.seal(obj);
+  assertTrue(Object.isSealed(obj));
+  assertFalse(Object.isFrozen(obj));
+  assertTrue(Array.isArray(obj));
+  assertEquals(obj.lastIndexOf(1), 2);
+  assertEquals(obj.indexOf('a'), 4);
+  assertEquals(obj.indexOf(undefined), 0);
+  assertFalse(obj.includes(Symbol("test")));
+  assertTrue(obj.includes(undefined));
+  assertFalse(obj.includes(NaN));
+  assertTrue(obj.includes());
+  assertEquals(obj.find(x => x==0), undefined);
+  assertEquals(obj.findIndex(x => x=='a'), 4);
+  assertTrue(obj.some(x => typeof x == 'symbol'));
+  assertFalse(obj.every(x => x == -1));
+  var filteredArray = obj.filter(e => typeof e == "symbol");
+  assertEquals(filteredArray.length, 1);
+  assertEquals(obj.map(x => x), obj);
+  var countPositiveNumber = 0;
+  obj.forEach(function(item, index) {
+    if (item === 1) {
+      countPositiveNumber++;
+      assertEquals(index, 2);
+    }
+  });
+  assertEquals(countPositiveNumber, 1);
+  assertEquals(obj.length, obj.concat([]).length);
+  var iterator = obj.values();
+  assertEquals(iterator.next().value, undefined);
+  assertEquals(iterator.next().value, null);
+  var iterator = obj.keys();
+  assertEquals(iterator.next().value, 0);
+  assertEquals(iterator.next().value, 1);
+  var iterator = obj.entries();
+  assertEquals(iterator.next().value, [0, undefined]);
+  assertEquals(iterator.next().value, [1, null]);
+
+  // Verify that the value can be written
+  var length = obj.length;
+  for (var i = 0; i < length-1; i++) {
+    obj[i] = 'new';
+    assertEquals(obj[i], 'new');
+  }
+};
+obj = new Array(undefined, null, 1, -1, 'a', Symbol("test"));
+assertTrue(%HasPackedElements(obj));
+Object.seal(obj);
+testPackedSealedArray1(obj);
+
+// Verify after transition from preventExtensions
+obj = new Array(undefined, null, 1, -1, 'a', Symbol("test"));
+assertTrue(%HasPackedElements(obj));
+Object.preventExtensions(obj);
+Object.seal(obj);
+testPackedSealedArray1(obj);
+
+// Verify flat, map, slice, flatMap, join, reduce, reduceRight for sealed packed array
+function testPackedSealedArray2(arr) {
+  assertTrue(Object.isSealed(arr));
+  assertFalse(Object.isFrozen(arr));
+  assertEquals(arr.map(x => [x]), [['a'], ['b'], ['c']]);
+  assertEquals(arr.flatMap(x => [x]), arr);
+  assertEquals(arr.flat(), arr);
+  assertEquals(arr.join('-'), "a-b-c");
+  const reducer = (accumulator, currentValue) => accumulator + currentValue;
+  assertEquals(arr.reduce(reducer), "abc");
+  assertEquals(arr.reduceRight(reducer), "cba");
+  assertEquals(arr.slice(0, 1), ['a']);
+  // Verify change content of sealed packed array
+  arr.sort();
+  assertEquals(arr.join(''), "abc");
+  arr.reverse();
+  assertEquals(arr.join(''), "cba");
+  arr.copyWithin(0, 1, 2);
+  assertEquals(arr.join(''),"bba");
+  arr.fill('d');
+  assertEquals(arr.join(''), "ddd");
+}
+
+var arr1 = new Array('a', 'b', 'c');
+assertTrue(%HasPackedElements(arr1));
+Object.seal(arr1);
+testPackedSealedArray2(arr1);
+
+var arr2 = new Array('a', 'b', 'c');
+assertTrue(%HasPackedElements(arr2));
+Object.preventExtensions(arr2);
+Object.seal(arr2);
+testPackedSealedArray2(arr2);
+
+// Test regression with Object.defineProperty
+var obj = [];
+obj.propertyA = 42;
+obj[0] = true;
+Object.seal(obj);
+assertDoesNotThrow(function() {
+  Object.defineProperty(obj, 'propertyA', {
+    value: obj,
+  });
+});
+assertEquals(obj, obj.propertyA);
+assertDoesNotThrow(function() {
+  Object.defineProperty(obj, 'propertyA', {
+    value: obj,
+    writable: false,
+  });
+});
+obj.propertyA = 42;
+assertEquals(obj.propertyA, 42);
+assertThrows(function() {
+  Object.defineProperty(obj, 'abc', {
+    value: obj,
+  });
+}, TypeError);
+
+// Regression test with simple array
+var arr = ['a'];
+Object.seal(arr);
+arr[0] = 'b';
+assertEquals(arr[0], 'b');
+
+// Test regression Array.concat with double
+var arr = ['a'];
+Object.seal(arr);
+arr = arr.concat(0.5);
+assertEquals(arr, ['a', 0.5]);
+Object.seal(arr);
+arr = arr.concat([1.5, 'b']);
+assertEquals(arr, ['a', 0.5, 1.5, 'b']);
+
+// Regression test with change length
+var arr = ['a', 'b'];
+Object.seal(arr);
+assertEquals(arr.length, 2);
+arr.length = 3;
+assertEquals(arr.length, 3);
+arr[2] = 'c';
+assertEquals(arr[2], undefined);
+arr.length = 1;
+assertEquals(arr.length, 2);
+
+// Start testing for holey element array
+// Test holey element array built-in functions with seal.
+function testHoleySealedArray1(obj) {
+  assertTrue(Object.isSealed(obj));
+  assertFalse(Object.isFrozen(obj));
+  assertTrue(Array.isArray(obj));
+
+  // Verify that the length can't be written by builtins.
+  assertThrows(function() { obj.pop(); }, TypeError);
+  assertThrows(function() { obj.push(1); }, TypeError);
+  assertThrows(function() { obj.shift(); }, TypeError);
+  assertThrows(function() { obj.unshift(1); }, TypeError);
+  assertThrows(function() { obj.splice(0); }, TypeError);
+  assertDoesNotThrow(function() { obj.splice(0, 0); });
+
+  // Verify search, filter, iterator
+  obj = [undefined, null, 1, , -1, 'a', Symbol("test")];
+  assertTrue(%HasHoleyElements(obj));
+  Object.seal(obj);
+  assertTrue(Object.isSealed(obj));
+  assertFalse(Object.isFrozen(obj));
+  assertTrue(Array.isArray(obj));
+  assertEquals(obj.lastIndexOf(1), 2);
+  assertEquals(obj.indexOf('a'), 5);
+  assertEquals(obj.indexOf(undefined), 0);
+  assertFalse(obj.includes(Symbol("test")));
+  assertTrue(obj.includes(undefined));
+  assertFalse(obj.includes(NaN));
+  assertTrue(obj.includes());
+  assertEquals(obj.find(x => x==0), undefined);
+  assertEquals(obj.findIndex(x => x=='a'), 5);
+  assertTrue(obj.some(x => typeof x == 'symbol'));
+  assertFalse(obj.every(x => x == -1));
+  var filteredArray = obj.filter(e => typeof e == "symbol");
+  assertEquals(filteredArray.length, 1);
+  assertEquals(obj.map(x => x), obj);
+  var countPositiveNumber = 0;
+  obj.forEach(function(item, index) {
+    if (item === 1) {
+      countPositiveNumber++;
+      assertEquals(index, 2);
+    }
+  });
+  assertEquals(countPositiveNumber, 1);
+  assertEquals(obj.length, obj.concat([]).length);
+  var iterator = obj.values();
+  assertEquals(iterator.next().value, undefined);
+  assertEquals(iterator.next().value, null);
+  var iterator = obj.keys();
+  assertEquals(iterator.next().value, 0);
+  assertEquals(iterator.next().value, 1);
+  var iterator = obj.entries();
+  assertEquals(iterator.next().value, [0, undefined]);
+  assertEquals(iterator.next().value, [1, null]);
+
+  // Verify that the value can be written
+  var length = obj.length;
+  for (var i = 0; i < length; i++) {
+    if (i==3) continue;
+    obj[i] = 'new';
+    assertEquals(obj[i], 'new');
+  }
+};
+obj = [undefined, null, 1, , -1, 'a', Symbol("test")];
+assertTrue(%HasHoleyElements(obj));
+Object.seal(obj);
+testHoleySealedArray1(obj);
+
+// Verify after transition from preventExtensions
+obj = [undefined, null, 1, , -1, 'a', Symbol("test")];
+assertTrue(%HasHoleyElements(obj));
+Object.preventExtensions(obj);
+Object.seal(obj);
+testHoleySealedArray1(obj);
+
+// Verify flat, map, slice, flatMap, join, reduce, reduceRight for sealed holey array
+function testHoleySealedArray2(arr) {
+  assertTrue(Object.isSealed(arr));
+  assertFalse(Object.isFrozen(arr));
+  assertEquals(arr.map(x => [x]), [, ['a'], ['b'], ['c']]);
+  assertEquals(arr.flatMap(x => [x]), ["a", "b", "c"]);
+  assertEquals(arr.flat(), ["a", "b", "c"]);
+  assertEquals(arr.join('-'), "-a-b-c");
+  const reducer = (accumulator, currentValue) => accumulator + currentValue;
+  assertEquals(arr.reduce(reducer), "abc");
+  assertEquals(arr.reduceRight(reducer), "cba");
+  assertEquals(arr.slice(0, 1), [,]);
+  assertEquals(arr.slice(1, 2), ["a"]);
+  // Verify change content of sealed holey array
+  assertThrows(function(){arr.sort();}, TypeError);
+  assertEquals(arr.join(''), "abc");
+  assertThrows(function(){arr.reverse();}, TypeError);
+  assertEquals(arr.join(''), "abc");
+  assertThrows(function(){arr.copyWithin(0, 1, 2);}, TypeError);
+  assertEquals(arr.join(''),"abc");
+  arr.copyWithin(1, 2, 3);
+  assertEquals(arr.join(''),"bbc");
+  assertThrows(function(){arr.fill('d');}, TypeError);
+  assertEquals(arr.join(''), "bbc");
+}
+
+var arr1 = [, 'a', 'b', 'c'];
+assertTrue(%HasHoleyElements(arr1));
+Object.seal(arr1);
+testHoleySealedArray2(arr1);
+
+var arr2 = [, 'a', 'b', 'c'];
+assertTrue(%HasHoleyElements(arr2));
+Object.preventExtensions(arr2);
+Object.seal(arr2);
+testHoleySealedArray2(arr2);
+
+// Test regression with Object.defineProperty
+var obj = ['a', , 'b'];
+obj.propertyA = 42;
+obj[0] = true;
+Object.seal(obj);
+assertDoesNotThrow(function() {
+  Object.defineProperty(obj, 'propertyA', {
+    value: obj,
+  });
+});
+assertEquals(obj, obj.propertyA);
+assertDoesNotThrow(function() {
+  Object.defineProperty(obj, 'propertyA', {
+    value: obj,
+    writable: false,
+  });
+});
+obj.propertyA = 42;
+assertEquals(obj.propertyA, 42);
+assertThrows(function() {
+  Object.defineProperty(obj, 'abc', {
+    value: obj,
+  });
+}, TypeError);
+
+// Regression test with simple holey array
+var arr = [, 'a'];
+Object.seal(arr);
+arr[1] = 'b';
+assertEquals(arr[1], 'b');
+arr[0] = 1;
+assertEquals(arr[0], undefined);
+
+// Test regression Array.concat with double
+var arr = ['a', , 'b'];
+Object.seal(arr);
+arr = arr.concat(0.5);
+assertEquals(arr, ['a', ,'b', 0.5]);
+Object.seal(arr);
+arr = arr.concat([1.5, 'c']);
+assertEquals(arr, ['a', ,'b', 0.5, 1.5, 'c']);
+
+// Regression test with change length
+var arr = ['a', ,'b'];
+Object.seal(arr);
+assertEquals(arr.length, 3);
+arr.length = 4;
+assertEquals(arr.length, 4);
+arr[3] = 'c';
+assertEquals(arr[3], undefined);
+arr.length = 2;
+assertEquals(arr.length, 3);
+
+// Change length with holey entries at the end
+var arr = ['a', ,];
+Object.seal(arr);
+assertEquals(arr.length, 2);
+arr.length = 0;
+assertEquals(arr.length, 1);
+arr.length = 3;
+assertEquals(arr.length, 3);
+arr.length = 0;
+assertEquals(arr.length, 1);
+
+// Spread with array
+var arr = ['a', 'b', 'c'];
+Object.seal(arr);
+var arrSpread = [...arr];
+assertEquals(arrSpread.length, arr.length);
+assertEquals(arrSpread[0], 'a');
+assertEquals(arrSpread[1], 'b');
+assertEquals(arrSpread[2], 'c');
+
+// Spread with array-like
+function returnArgs() {
+  return Object.seal(arguments);
+}
+var arrLike = returnArgs('a', 'b', 'c');
+assertTrue(Object.isSealed(arrLike));
+var arrSpread = [...arrLike];
+assertEquals(arrSpread.length, arrLike.length);
+assertEquals(arrSpread[0], 'a');
+assertEquals(arrSpread[1], 'b');
+assertEquals(arrSpread[2], 'c');
+
+// Spread with holey
+function countArgs() {
+  return arguments.length;
+}
+var arr = [, 'b','c'];
+Object.seal(arr);
+assertEquals(countArgs(...arr), 3);
+assertEquals(countArgs(...[...arr]), 3);
+assertEquals(countArgs.apply(this, [...arr]), 3);
+function checkUndefined() {
+  return arguments[0] === undefined;
+}
+assertTrue(checkUndefined(...arr));
+assertTrue(checkUndefined(...[...arr]));
+assertTrue(checkUndefined.apply(this, [...arr]));
+
+//
+// Array.prototype.map
+//
+(function() {
+  var a = Object.seal(['0','1','2','3','4']);
+
+  // Simple use.
+  var result = [1,2,3,4,5];
+  assertArrayEquals(result, a.map(function(n) { return Number(n) + 1; }));
+
+  // Use specified object as this object when calling the function.
+  var o = { delta: 42 }
+  result = [42,43,44,45,46];
+  assertArrayEquals(result, a.map(function(n) { return this.delta + Number(n); }, o));
+
+  // Modify original array.
+  b = Object.seal(['0','1','2','3','4']);
+  result = [1,2,3,4,5];
+  assertArrayEquals(result,
+      b.map(function(n, index, array) {
+        array[index] = Number(n) + 1; return Number(n) + 1;
+      }));
+  assertArrayEquals(b, result);
+
+  // Only loop through initial part of array and elements are not
+  // added.
+  a = Object.seal(['0','1','2','3','4']);
+  result = [1,2,3,4,5];
+  assertArrayEquals(result,
+      a.map(function(n, index, array) { assertThrows(() => { array.push(n) }); return Number(n) + 1; }));
+  assertArrayEquals(['0','1','2','3','4'], a);
+
+  // Respect holes.
+  a = new Array(20);
+  a[1] = '2';
+  Object.seal(a);
+  a = Object.seal(a).map(function(n) { return 2*Number(n); });
+
+  for (var i in a) {
+    assertEquals(4, a[i]);
+    assertEquals('1', i);
+  }
+
+  // Skip over missing properties.
+  a = {
+    "0": 1,
+    "2": 2,
+    length: 3
+  };
+  var received = [];
+  assertArrayEquals([2, , 4],
+      Array.prototype.map.call(Object.seal(a), function(n) {
+        received.push(n);
+        return n * 2;
+      }));
+  assertArrayEquals([1, 2], received);
+
+  // Modify array prototype
+  a = ['1', , 2];
+  received = [];
+  assertThrows(() => {
+    Array.prototype.map.call(Object.seal(a), function(n) {
+      a.__proto__ = null;
+      received.push(n);
+      return n * 2;
+    });
+  }, TypeError);
+  assertArrayEquals([], received);
+
+  // Create a new object in each function call when receiver is a
+  // primitive value. See ECMA-262, Annex C.
+  a = [];
+  Object.seal(['1', '2']).map(function() { a.push(this) }, "");
+  assertTrue(a[0] !== a[1]);
+
+  // Do not create a new object otherwise.
+  a = [];
+  Object.seal(['1', '2']).map(function() { a.push(this) }, {});
+  assertSame(a[0], a[1]);
+
+  // In strict mode primitive values should not be coerced to an object.
+  a = [];
+  Object.seal(['1', '2']).map(function() { 'use strict'; a.push(this); }, "");
+  assertEquals("", a[0]);
+  assertEquals(a[0], a[1]);
+
+})();
+
+
+// Test with double elements
+// Test packed element array built-in functions with seal.
+function testDoubleSealedArray1(obj) {
+  assertTrue(Object.isSealed(obj));
+  assertFalse(Object.isFrozen(obj));
+  assertTrue(Array.isArray(obj));
+
+  // Verify that the length can't be written by builtins.
+  assertThrows(function() { obj.pop(); }, TypeError);
+  assertThrows(function() { obj.push(1); }, TypeError);
+  assertThrows(function() { obj.shift(); }, TypeError);
+  assertThrows(function() { obj.unshift(1); }, TypeError);
+  assertThrows(function() { obj.splice(0); }, TypeError);
+  assertDoesNotThrow(function() { obj.splice(0, 0); });
+
+  // Verify search, filter, iterator
+  assertEquals(obj.lastIndexOf(1), 1);
+  assertEquals(obj.indexOf(undefined), -1);
+  assertFalse(obj.includes(Symbol("test")));
+  assertTrue(obj.includes(1));
+  assertTrue(obj.includes(-1.1));
+  assertFalse(obj.includes());
+  assertEquals(obj.find(x => x==0), undefined);
+  assertEquals(obj.findIndex(x => x==2), 3);
+  assertFalse(obj.some(x => typeof x == 'symbol'));
+  assertFalse(obj.every(x => x == -1));
+  var filteredArray = obj.filter(e => typeof e == "symbol");
+  assertEquals(filteredArray.length, 0);
+  assertEquals(obj.map(x => x), obj);
+  var countPositiveNumber = 0;
+  obj.forEach(function(item, index) {
+    if (item === 1) {
+      countPositiveNumber++;
+      assertEquals(index, 1);
+    }
+  });
+  assertEquals(countPositiveNumber, 1);
+  assertEquals(obj.length, obj.concat([]).length);
+  var iterator = obj.values();
+  assertEquals(iterator.next().value, -1.1);
+  assertEquals(iterator.next().value, 1);
+  var iterator = obj.keys();
+  assertEquals(iterator.next().value, 0);
+  assertEquals(iterator.next().value, 1);
+  var iterator = obj.entries();
+  assertEquals(iterator.next().value, [0, -1.1]);
+  assertEquals(iterator.next().value, [1, 1]);
+
+  // Verify that the value can't be written
+  var length = obj.length;
+  for (var i = 0; i < length; i++) {
+    obj[i] = 'new';
+    assertEquals('new', obj[i]);
+  }
+}
+
+obj = new Array(1.1, -1.1, 1, -1, 2);
+assertTrue(%HasDoubleElements(obj));
+Object.seal(obj);
+testDoubleSealedArray1(obj);
+
+// Verify change from non-extensible to sealed
+obj = new Array(1.1, -1.1, 1, -1, 2);
+assertTrue(%HasDoubleElements(obj));
+Object.preventExtensions(obj);
+Object.seal(obj);
+assertTrue(Object.isSealed(obj));
+testDoubleSealedArray1(obj);
+
+// Verify flat, map, slice, flatMap, join, reduce, reduceRight for sealed packed array
+function testDoubleSealedArray2(arr) {
+  assertTrue(Object.isSealed(arr));
+  assertTrue(Array.isArray(arr));
+  assertEquals(arr.map(x => [x]), [[1], [1.1], [0]]);
+  assertEquals(arr.flatMap(x => [x]), arr);
+  assertEquals(arr.flat(), arr);
+  assertEquals(arr.join('-'), "1-1.1-0");
+  const reducer = (accumulator, currentValue) => accumulator + currentValue;
+  assertEquals(arr.reduce(reducer), 2.1);
+  assertEquals(arr.reduceRight(reducer), 2.1);
+  assertEquals(arr.slice(0, 1), [1]);
+}
+var arr1 = new Array(1, 1.1, 0);
+assertTrue(%HasDoubleElements(arr1));
+Object.seal(arr1);
+testDoubleSealedArray2(arr1);
+
+// Verify change from non-extensible to sealed
+var arr1 = new Array(1, 1.1, 0);
+assertTrue(%HasDoubleElements(arr1));
+Object.preventExtensions(arr1);
+Object.seal(arr1);
+testDoubleSealedArray2(arr1);
+
+// Test regression with Object.defineProperty
+var obj = [];
+obj.propertyA = 42;
+obj[0] = 1.1;
+Object.seal(obj);
+assertDoesNotThrow(function() {
+  Object.defineProperty(obj, 'propertyA', {
+    value: obj,
+  });
+});
+assertEquals(obj, obj.propertyA);
+assertDoesNotThrow(function() {
+  Object.defineProperty(obj, 'propertyA', {
+    value: obj,
+    writable: false,
+  });
+});
+obj.propertyA = 42;
+assertEquals(obj.propertyA, 42);
+assertThrows(function() {
+  Object.defineProperty(obj, 'abc', {
+    value: obj,
+  });
+}, TypeError);
+
+// Regression test with simple array
+var arr = [1.1];
+Object.seal(arr);
+arr[0] = 1;
+assertEquals(arr[0], 1);
+
+// Test regression Array.concat with double
+var arr = [1.1];
+Object.seal(arr);
+arr = arr.concat(0.5);
+assertEquals(arr, [1.1, 0.5]);
+Object.seal(arr);
+arr = arr.concat([1.5, 'b']);
+assertEquals(arr, [1.1, 0.5, 1.5, 'b']);
+
+// Regression test with change length
+var arr = [1.1, 0];
+Object.seal(arr);
+assertEquals(arr.length, 2);
+arr.length = 3;
+assertEquals(arr.length, 3);
+arr[2] = 'c';
+assertEquals(arr[2], undefined);
+arr.length = 1;
+assertEquals(arr.length, 2);
+
+// Start testing for holey double element array
+// Test holey double element array built-in functions with seal.
+function testHoleyDoubleSealedArray1() {
+  assertTrue(Object.isSealed(obj));
+  assertFalse(Object.isFrozen(obj));
+  assertTrue(Array.isArray(obj));
+
+  // Verify that the length can't be written by builtins.
+  assertThrows(function() { obj.pop(); }, TypeError);
+  assertThrows(function() { obj.push(1); }, TypeError);
+  assertThrows(function() { obj.shift(); }, TypeError);
+  assertThrows(function() { obj.unshift(1); }, TypeError);
+  assertThrows(function() { obj.splice(0); }, TypeError);
+  assertDoesNotThrow(function() { obj.splice(0, 0); });
+
+  // Verify search, filter, iterator
+  obj = [-1.1, 0, 1, , -1, 1.1];
+  assertTrue(%HasHoleyElements(obj));
+  Object.seal(obj);
+  assertTrue(Object.isSealed(obj));
+  assertFalse(Object.isFrozen(obj));
+  assertTrue(Array.isArray(obj));
+  assertEquals(obj.lastIndexOf(1), 2);
+  assertEquals(obj.indexOf(1.1), 5);
+  assertEquals(obj.indexOf(undefined), -1);
+  assertFalse(obj.includes(Symbol("test")));
+  assertTrue(obj.includes(undefined));
+  assertFalse(obj.includes(NaN));
+  assertTrue(obj.includes());
+  assertEquals(obj.find(x => x==0), 0);
+  assertEquals(obj.findIndex(x => x==1.1), 5);
+  assertFalse(obj.some(x => typeof x == 'symbol'));
+  assertFalse(obj.every(x => x == -1));
+  var filteredArray = obj.filter(e => typeof e == "symbol");
+  assertEquals(filteredArray.length, 0);
+  assertEquals(obj.map(x => x), obj);
+  var countPositiveNumber = 0;
+  obj.forEach(function(item, index) {
+    if (item === 1) {
+      countPositiveNumber++;
+      assertEquals(index, 2);
+    }
+  });
+  assertEquals(countPositiveNumber, 1);
+  assertEquals(obj.length, obj.concat([]).length);
+  var iterator = obj.values();
+  assertEquals(iterator.next().value, -1.1);
+  assertEquals(iterator.next().value, 0);
+  var iterator = obj.keys();
+  assertEquals(iterator.next().value, 0);
+  assertEquals(iterator.next().value, 1);
+  var iterator = obj.entries();
+  assertEquals(iterator.next().value, [0, -1.1]);
+  assertEquals(iterator.next().value, [1, 0]);
+
+  // Verify that the value can be written
+  var length = obj.length;
+  for (var i = 0; i < length; i++) {
+    if (i==3) continue;
+    obj[i] = 'new';
+    assertEquals(obj[i], 'new');
+  }
+};
+
+obj = [-1.1, 0, 1, , -1, 1.1];
+assertTrue(%HasHoleyElements(obj));
+Object.seal(obj);
+testHoleyDoubleSealedArray1(obj);
+
+// Verify change from non-extensible to sealed
+obj = [-1.1, 0, 1, , -1, 1.1];
+assertTrue(%HasHoleyElements(obj));
+Object.preventExtensions(obj);
+Object.seal(obj);
+assertTrue(Object.isSealed(obj));
+testHoleyDoubleSealedArray1(obj);
+
+// Verify flat, map, slice, flatMap, join, reduce, reduceRight for sealed packed array
+function testHoleyDoubleSealedArray2(arr) {
+  assertTrue(Object.isSealed(arr));
+  assertTrue(Array.isArray(arr));
+  assertEquals(arr.map(x => [x]), [, [1.1], [1], [0]]);
+  assertEquals(arr.flatMap(x => [x]), [1.1, 1, 0]);
+  assertEquals(arr.flat(), [1.1, 1, 0]);
+  assertEquals(arr.join('-'), "-1.1-1-0");
+  const reducer = (accumulator, currentValue) => accumulator + currentValue;
+  assertEquals(arr.reduce(reducer), 2.1);
+  assertEquals(arr.reduceRight(reducer), 2.1);
+  assertEquals(arr.slice(0, 1), [,]);
+  assertEquals(arr.slice(1, 2), [1.1]);
+}
+var arr1 = [, 1.1, 1, 0];
+assertTrue(%HasHoleyElements(arr1));
+Object.seal(arr1);
+testHoleyDoubleSealedArray2(arr1);
+
+// Verify change from non-extensible to sealed
+var arr1 = [, 1.1, 1, 0];
+assertTrue(%HasHoleyElements(arr1));
+Object.preventExtensions(arr1);
+Object.seal(arr1);
+testHoleyDoubleSealedArray2(arr1);
+
+// Test regression with Object.defineProperty
+var obj = [1.1, , 0];
+obj.propertyA = 42;
+obj[0] = 1.2;
+Object.seal(obj);
+assertDoesNotThrow(function() {
+  Object.defineProperty(obj, 'propertyA', {
+    value: obj,
+  });
+});
+assertEquals(obj, obj.propertyA);
+assertDoesNotThrow(function() {
+  Object.defineProperty(obj, 'propertyA', {
+    value: obj,
+    writable: false,
+  });
+});
+obj.propertyA = 42;
+assertEquals(obj.propertyA, 42);
+assertThrows(function() {
+  Object.defineProperty(obj, 'abc', {
+    value: obj,
+  });
+}, TypeError);
+
+// Regression test with simple holey array
+var arr = [, 1.1];
+Object.seal(arr);
+arr[1] = 'b';
+assertEquals(arr[1], 'b');
+arr[0] = 1;
+assertEquals(arr[0], undefined);
+
+// Test regression Array.concat with double
+var arr = [1.1, , 0];
+Object.seal(arr);
+arr = arr.concat(0.5);
+assertEquals(arr, [1.1, , 0, 0.5]);
+Object.seal(arr);
+arr = arr.concat([1.5, 'c']);
+assertEquals(arr, [1.1, ,0, 0.5, 1.5, 'c']);
+
+// Regression test with change length
+var arr = [1.1, ,0];
+Object.seal(arr);
+assertEquals(arr.length, 3);
+arr.length = 4;
+assertEquals(arr.length, 4);
+arr[3] = 'c';
+assertEquals(arr[2], 0);
+assertEquals(arr[3], undefined);
+arr.length = 2;
+assertEquals(arr.length, 3);
+
+// Change length with holey entries at the end
+var arr = [1.1, ,];
+Object.seal(arr);
+assertEquals(arr.length, 2);
+arr.length = 0;
+assertEquals(arr.length, 1);
+arr.length = 3;
+assertEquals(arr.length, 3);
+arr.length = 0;
+assertEquals(arr.length, 1);
+
+// Spread with array
+var arr = [1.1, 0, -1];
+Object.seal(arr);
+var arrSpread = [...arr];
+assertEquals(arrSpread.length, arr.length);
+assertEquals(arrSpread[0], 1.1);
+assertEquals(arrSpread[1], 0);
+assertEquals(arrSpread[2], -1);
+
+// Spread with array-like
+function returnArgs() {
+  return Object.seal(arguments);
+}
+var arrLike = returnArgs(1.1, 0, -1);
+assertTrue(Object.isSealed(arrLike));
+var arrSpread = [...arrLike];
+assertEquals(arrSpread.length, arrLike.length);
+assertEquals(arrSpread[0], 1.1);
+assertEquals(arrSpread[1], 0);
+assertEquals(arrSpread[2], -1);
+
+// Spread with holey
+function countArgs() {
+  return arguments.length;
+}
+var arr = [, 1.1, 0];
+Object.seal(arr);
+assertEquals(countArgs(...arr), 3);
+assertEquals(countArgs(...[...arr]), 3);
+assertEquals(countArgs.apply(this, [...arr]), 3);
+function checkUndefined() {
+  return arguments[0] === undefined;
+}
+assertTrue(checkUndefined(...arr));
+assertTrue(checkUndefined(...[...arr]));
+assertTrue(checkUndefined.apply(this, [...arr]));
+
+//
+// Array.prototype.map
+//
+(function() {
+  var a = Object.seal([0.1,1,2,3,4]);
+
+  // Simple use.
+  var result = [1.1,2,3,4,5];
+  assertArrayEquals(result, a.map(function(n) { return Number(n) + 1; }));
+
+  // Use specified object as this object when calling the function.
+  var o = { delta: 42 }
+  result = [42.1,43,44,45,46];
+  assertArrayEquals(result, a.map(function(n) { return this.delta + Number(n); }, o));
+
+  // Modify original array.
+  b = Object.seal([0.1,1,2,3,4]);
+  result = [1.1,2,3,4,5];
+  assertArrayEquals(result,
+      b.map(function(n, index, array) {
+        array[index] = Number(n) + 1; return Number(n) + 1;
+      }));
+  assertArrayEquals(b, result);
+
+  // Only loop through initial part of array and elements are not
+  // added.
+  a = Object.seal([0.1,1,2,3,4]);
+  result = [1.1,2,3,4,5];
+  assertArrayEquals(result,
+      a.map(function(n, index, array) { assertThrows(() => { array.push(n) }); return Number(n) + 1; }));
+  assertArrayEquals([0.1,1,2,3,4], a);
+
+  // Respect holes.
+  a = new Array(20);
+  a[1] = 1.1;
+  Object.seal(a);
+  a = Object.seal(a).map(function(n) { return 2*Number(n); });
+
+  for (var i in a) {
+    assertEquals(2.2, a[i]);
+    assertEquals('1', i);
+  }
+
+  // Skip over missing properties.
+  a = {
+    "0": 1.1,
+    "2": 2,
+    length: 3
+  };
+  var received = [];
+  assertArrayEquals([2.2, , 4],
+      Array.prototype.map.call(Object.seal(a), function(n) {
+        received.push(n);
+        return n * 2;
+      }));
+  assertArrayEquals([1.1, 2], received);
+
+  // Modify array prototype
+  a = [1.1, , 2];
+  received = [];
+  assertThrows(() => {
+    Array.prototype.map.call(Object.seal(a), function(n) {
+      a.__proto__ = null;
+      received.push(n);
+      return n * 2;
+    });
+  }, TypeError);
+  assertArrayEquals([], received);
+
+  // Create a new object in each function call when receiver is a
+  // primitive value. See ECMA-262, Annex C.
+  a = [];
+  Object.seal([1.1, 2]).map(function() { a.push(this) }, "");
+  assertTrue(a[0] !== a[1]);
+
+  // Do not create a new object otherwise.
+  a = [];
+  Object.seal([1.1, 2]).map(function() { a.push(this) }, {});
+  assertSame(a[0], a[1]);
+
+  // In strict mode primitive values should not be coerced to an object.
+  a = [];
+  Object.seal([1.1, 1.2]).map(function() { 'use strict'; a.push(this); }, "");
+  assertEquals("", a[0]);
+  assertEquals(a[0], a[1]);
+
+})();
diff --git a/src/v8/test/mjsunit/omit-constant-mapcheck.js b/src/v8/test/mjsunit/omit-constant-mapcheck.js
index ae6308f..672595f 100644
--- a/src/v8/test/mjsunit/omit-constant-mapcheck.js
+++ b/src/v8/test/mjsunit/omit-constant-mapcheck.js
@@ -27,12 +27,12 @@
 
 // Flags: --allow-natives-syntax
 
-var g1 = { a:1 }
+var g1 = {a: 1};
 
 function load() {
   return g1.a;
-}
-
+};
+%PrepareFunctionForOptimization(load);
 assertEquals(1, load());
 assertEquals(1, load());
 %OptimizeFunctionOnNextCall(load);
@@ -40,12 +40,12 @@
 delete g1.a;
 assertEquals(undefined, load());
 
-var g2 = { a:2 }
+var g2 = {a: 2};
 
 function load2() {
   return g2.a;
-}
-
+};
+%PrepareFunctionForOptimization(load2);
 assertEquals(2, load2());
 assertEquals(2, load2());
 %OptimizeFunctionOnNextCall(load2);
@@ -54,17 +54,17 @@
 g2.a = 5;
 assertEquals(5, load2());
 
-var g3 = { a:2, b:9, c:1 }
+var g3 = {a: 2, b: 9, c: 1};
 
 function store(v) {
   g3.a = v;
   return g3.a;
-}
-
+};
+%PrepareFunctionForOptimization(store);
 assertEquals(5, store(5));
 assertEquals(8, store(8));
 %OptimizeFunctionOnNextCall(store);
 assertEquals(10, store(10));
 delete g3.c;
 store(7);
-assertEquals({a:7, b:9}, g3);
+assertEquals({a: 7, b: 9}, g3);
diff --git a/src/v8/test/mjsunit/opt-elements-kind.js b/src/v8/test/mjsunit/opt-elements-kind.js
index 8634366..976c3d6 100644
--- a/src/v8/test/mjsunit/opt-elements-kind.js
+++ b/src/v8/test/mjsunit/opt-elements-kind.js
@@ -100,6 +100,7 @@
   return eval(make_array_string());
 }
 
+%EnsureFeedbackVectorForFunction(construct_smis);
 function construct_smis() {
   var a = make_array();
   a[0] = 0;  // Send the COW array map to the steak house.
@@ -108,6 +109,7 @@
 }
 
 %NeverOptimizeFunction(construct_doubles);
+%EnsureFeedbackVectorForFunction(construct_doubles);
 function construct_doubles() {
   var a = construct_smis();
   a[0] = 1.5;
@@ -116,12 +118,14 @@
 }
 
 %NeverOptimizeFunction(convert_mixed);
+%EnsureFeedbackVectorForFunction(convert_mixed);
 function convert_mixed(array, value, kind) {
   array[1] = value;
   assertKind(kind, array);
   assertEquals(value, array[1]);
 }
 
+%PrepareFunctionForOptimization(test1);
 function test1() {
   // Test transition chain SMI->DOUBLE->FAST (crankshafted function will
   // transition to FAST directly).
@@ -134,11 +138,15 @@
   convert_mixed(construct_smis(), "three", elements_kind.fast);
   convert_mixed(construct_doubles(), "three", elements_kind.fast);
 
-  smis = construct_smis();
-  doubles = construct_doubles();
-  convert_mixed(smis, 1, elements_kind.fast);
-  convert_mixed(doubles, 1, elements_kind.fast);
-  assertTrue(%HaveSameMap(smis, doubles));
+  if (%ICsAreEnabled()) {
+    // Test that allocation sites allocate correct elements kind initially based
+    // on previous transitions.
+    smis = construct_smis();
+    doubles = construct_doubles();
+    convert_mixed(smis, 1, elements_kind.fast);
+    convert_mixed(doubles, 1, elements_kind.fast);
+    assertTrue(%HaveSameMap(smis, doubles));
+  }
 }
 
 function clear_ic_state() {
diff --git a/src/v8/test/mjsunit/optimized-array-every.js b/src/v8/test/mjsunit/optimized-array-every.js
index 0cbab7d..30578c5 100644
--- a/src/v8/test/mjsunit/optimized-array-every.js
+++ b/src/v8/test/mjsunit/optimized-array-every.js
@@ -15,6 +15,7 @@
       return v < 2;
     });
   }
+  %PrepareFunctionForOptimization(earlyExit);
   assertFalse(earlyExit());
   earlyExit();
   %OptimizeFunctionOnNextCall(earlyExit);
@@ -35,6 +36,7 @@
        return v < 8;
      });
   }
+  %PrepareFunctionForOptimization(softyPlusEarlyExit);
   assertFalse(softyPlusEarlyExit(false));
   softyPlusEarlyExit(false);
   %OptimizeFunctionOnNextCall(softyPlusEarlyExit);
@@ -58,6 +60,7 @@
        return v < 8;
      });
   }
+  %PrepareFunctionForOptimization(softyPlusEarlyExit);
   assertFalse(softyPlusEarlyExit(false));
   assertArrayEquals([1, 2, 3, 4, 5, 6, 7, 8], called_values);
   softyPlusEarlyExit(false);
@@ -81,6 +84,7 @@
       return true;
     });
   }
+  %PrepareFunctionForOptimization(eagerDeoptInCalled);
   eagerDeoptInCalled();
   eagerDeoptInCalled();
   %OptimizeFunctionOnNextCall(eagerDeoptInCalled);
@@ -102,6 +106,7 @@
       return true;
     });
   }
+  %PrepareFunctionForOptimization(eagerDeoptInCalled);
   assertTrue(eagerDeoptInCalled());
   assertArrayEquals([1, 2, 3, 4, 5, 6, 7, 8, 9, 10], called_values);
   eagerDeoptInCalled();
@@ -125,6 +130,7 @@
       return true;
     });
   }
+  %PrepareFunctionForOptimization(lazyChanger);
   assertTrue(lazyChanger());
   lazyChanger();
   %OptimizeFunctionOnNextCall(lazyChanger);
@@ -144,6 +150,7 @@
       return true;
     });
   }
+  %PrepareFunctionForOptimization(lazyChanger);
   assertTrue(lazyChanger());
   lazyChanger();
   %OptimizeFunctionOnNextCall(lazyChanger);
@@ -164,6 +171,7 @@
       return true;
     });
   }
+  %PrepareFunctionForOptimization(lazyChanger);
   assertTrue(lazyChanger());
   lazyChanger();
   %OptimizeFunctionOnNextCall(lazyChanger);
@@ -184,6 +192,7 @@
       return true;
     });
   }
+  %PrepareFunctionForOptimization(eagerDeoptInCalled);
   eagerDeoptInCalled();
   eagerDeoptInCalled();
   %OptimizeFunctionOnNextCall(eagerDeoptInCalled);
@@ -207,6 +216,7 @@
       return true;
     });
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -232,6 +242,7 @@
     %NeverOptimizeFunction(callback);
     a.every(callback);
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -259,6 +270,7 @@
       caught = true;
     }
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -287,6 +299,7 @@
       caught = true;
     }
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -318,6 +331,7 @@
     }
     return result;
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   assertEquals(true, lazyDeopt(false));
   assertEquals(true, lazyDeopt(false));
   assertEquals("nope", lazyDeopt(true));
@@ -343,6 +357,7 @@
       return true;
     });
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -370,6 +385,7 @@
     b.every(callback);
     return did_assert_error;
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -397,6 +413,7 @@
     });
     return did_assert_error;
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -420,6 +437,7 @@
       return true;
     });
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   assertThrows(() => lazyDeopt());
   assertThrows(() => lazyDeopt());
   try {
@@ -446,6 +464,7 @@
     });
     return callback_values;
   }
+  %PrepareFunctionForOptimization(withHoles);
   withHoles();
   withHoles();
   %OptimizeFunctionOnNextCall(withHoles);
@@ -462,6 +481,7 @@
     });
     return callback_values;
   }
+  %PrepareFunctionForOptimization(withHoles);
   withHoles();
   withHoles();
   %OptimizeFunctionOnNextCall(withHoles);
@@ -476,6 +496,7 @@
   function unreliable(a, b) {
     return a.every(x => true, side_effect(a, b));
   }
+  %PrepareFunctionForOptimization(unreliable);
 
   let a = [1, 2, 3];
   unreliable(a, false);
@@ -492,6 +513,7 @@
   function notCallable() {
     return a.every(undefined);
   }
+  %PrepareFunctionForOptimization(notCallable);
 
   assertThrows(notCallable, TypeError);
   try { notCallable(); } catch(e) { }
@@ -509,6 +531,7 @@
       return true;
     });
   }
+  %PrepareFunctionForOptimization(prototypeChanged);
   prototypeChanged();
   prototypeChanged();
   %OptimizeFunctionOnNextCall(prototypeChanged);
diff --git a/src/v8/test/mjsunit/optimized-array-find.js b/src/v8/test/mjsunit/optimized-array-find.js
index abcd2cf..b8f3baa 100644
--- a/src/v8/test/mjsunit/optimized-array-find.js
+++ b/src/v8/test/mjsunit/optimized-array-find.js
@@ -20,6 +20,7 @@
       return v === 20;
     });
   }
+  %PrepareFunctionForOptimization(eagerDeoptInCalled);
   eagerDeoptInCalled();
   eagerDeoptInCalled();
   %OptimizeFunctionOnNextCall(eagerDeoptInCalled);
@@ -41,6 +42,7 @@
       return v === 9;
     });
   }
+  %PrepareFunctionForOptimization(eagerDeoptInCalled);
   assertEquals(9, eagerDeoptInCalled());
   assertArrayEquals([1, 2, 3, 4, 5, 6, 7, 8, 9], called_values);
   eagerDeoptInCalled();
@@ -65,6 +67,7 @@
       return v > 3;
     });
   }
+  %PrepareFunctionForOptimization(lazyChanger);
   assertEquals(4, lazyChanger());
   lazyChanger();
   %OptimizeFunctionOnNextCall(lazyChanger);
@@ -84,6 +87,7 @@
       return false;
     });
   }
+  %PrepareFunctionForOptimization(lazyChanger);
   assertEquals(undefined, lazyChanger());
   lazyChanger();
   %OptimizeFunctionOnNextCall(lazyChanger);
@@ -104,6 +108,7 @@
       return v > 3;
     });
   }
+  %PrepareFunctionForOptimization(lazyChanger);
   assertEquals(4, lazyChanger());
   lazyChanger();
   %OptimizeFunctionOnNextCall(lazyChanger);
@@ -124,6 +129,7 @@
       return false;
     });
   }
+  %PrepareFunctionForOptimization(eagerDeoptInCalled);
   eagerDeoptInCalled();
   eagerDeoptInCalled();
   %OptimizeFunctionOnNextCall(eagerDeoptInCalled);
@@ -147,6 +153,7 @@
       return false;
     });
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -172,6 +179,7 @@
     %NeverOptimizeFunction(callback);
     a.find(callback);
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -199,6 +207,7 @@
       caught = true;
     }
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -227,6 +236,7 @@
       caught = true;
     }
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -258,6 +268,7 @@
     }
     return result;
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   assertEquals(3, lazyDeopt(false));
   assertEquals(3, lazyDeopt(false));
   assertEquals("nope", lazyDeopt(true));
@@ -283,6 +294,7 @@
       return false;
     });
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -310,6 +322,7 @@
     b.find(callback);
     return did_assert_error;
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -337,6 +350,7 @@
     });
     return did_assert_error;
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -360,6 +374,7 @@
       return false;
     });
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   assertThrows(() => lazyDeopt());
   assertThrows(() => lazyDeopt());
   try {
@@ -385,6 +400,7 @@
       return false;
     });
   }
+  %PrepareFunctionForOptimization(prototypeChanged);
   prototypeChanged();
   prototypeChanged();
   %OptimizeFunctionOnNextCall(prototypeChanged);
@@ -406,6 +422,7 @@
     });
     return callback_values;
   }
+  %PrepareFunctionForOptimization(withHoles);
   withHoles();
   withHoles();
   %OptimizeFunctionOnNextCall(withHoles);
@@ -422,6 +439,7 @@
     });
     return callback_values;
   }
+  %PrepareFunctionForOptimization(withHoles);
   withHoles();
   withHoles();
   %OptimizeFunctionOnNextCall(withHoles);
@@ -436,6 +454,7 @@
   function unreliable(a, b) {
     return a.find(x => false, side_effect(a, b));
   }
+  %PrepareFunctionForOptimization(unreliable);
 
   let a = [1, 2, 3];
   unreliable(a, false);
@@ -452,6 +471,7 @@
   function notCallable() {
     return a.find(undefined);
   }
+  %PrepareFunctionForOptimization(notCallable);
 
   assertThrows(notCallable, TypeError);
   try { notCallable(); } catch(e) { }
diff --git a/src/v8/test/mjsunit/optimized-array-findindex.js b/src/v8/test/mjsunit/optimized-array-findindex.js
index 91f4a6c..299ae0a 100644
--- a/src/v8/test/mjsunit/optimized-array-findindex.js
+++ b/src/v8/test/mjsunit/optimized-array-findindex.js
@@ -20,6 +20,7 @@
       return v === 20;
     });
   }
+  %PrepareFunctionForOptimization(eagerDeoptInCalled);
   eagerDeoptInCalled();
   eagerDeoptInCalled();
   %OptimizeFunctionOnNextCall(eagerDeoptInCalled);
@@ -41,6 +42,7 @@
       return v === 9;
     });
   }
+  %PrepareFunctionForOptimization(eagerDeoptInCalled);
   assertEquals(8, eagerDeoptInCalled());
   assertArrayEquals([1, 2, 3, 4, 5, 6, 7, 8, 9], called_values);
   eagerDeoptInCalled();
@@ -65,6 +67,7 @@
       return v > 3;
     });
   }
+  %PrepareFunctionForOptimization(lazyChanger);
   assertEquals(3, lazyChanger());
   lazyChanger();
   %OptimizeFunctionOnNextCall(lazyChanger);
@@ -84,6 +87,7 @@
       return false;
     });
   }
+  %PrepareFunctionForOptimization(lazyChanger);
   assertEquals(-1, lazyChanger());
   lazyChanger();
   %OptimizeFunctionOnNextCall(lazyChanger);
@@ -104,6 +108,7 @@
       return v > 3;
     });
   }
+  %PrepareFunctionForOptimization(lazyChanger);
   assertEquals(3, lazyChanger());
   lazyChanger();
   %OptimizeFunctionOnNextCall(lazyChanger);
@@ -124,6 +129,7 @@
       return false;
     });
   }
+  %PrepareFunctionForOptimization(eagerDeoptInCalled);
   eagerDeoptInCalled();
   eagerDeoptInCalled();
   %OptimizeFunctionOnNextCall(eagerDeoptInCalled);
@@ -147,6 +153,7 @@
       return false;
     });
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -172,6 +179,7 @@
     %NeverOptimizeFunction(callback);
     a.findIndex(callback);
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -199,6 +207,7 @@
       caught = true;
     }
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -227,6 +236,7 @@
       caught = true;
     }
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -258,6 +268,7 @@
     }
     return result;
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   assertEquals(2, lazyDeopt(false));
   assertEquals(2, lazyDeopt(false));
   assertEquals("nope", lazyDeopt(true));
@@ -283,6 +294,7 @@
       return false;
     });
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -310,6 +322,7 @@
     b.findIndex(callback);
     return did_assert_error;
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -337,6 +350,7 @@
     });
     return did_assert_error;
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -360,6 +374,7 @@
       return false;
     });
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   assertThrows(() => lazyDeopt());
   assertThrows(() => lazyDeopt());
   try {
@@ -385,6 +400,7 @@
       return false;
     });
   }
+  %PrepareFunctionForOptimization(prototypeChanged);
   prototypeChanged();
   prototypeChanged();
   %OptimizeFunctionOnNextCall(prototypeChanged);
@@ -406,6 +422,7 @@
     });
     return callback_values;
   }
+  %PrepareFunctionForOptimization(withHoles);
   withHoles();
   withHoles();
   %OptimizeFunctionOnNextCall(withHoles);
@@ -422,6 +439,7 @@
     });
     return callback_values;
   }
+  %PrepareFunctionForOptimization(withHoles);
   withHoles();
   withHoles();
   %OptimizeFunctionOnNextCall(withHoles);
@@ -436,6 +454,7 @@
   function unreliable(a, b) {
     return a.findIndex(x => false, side_effect(a, b));
   }
+  %PrepareFunctionForOptimization(unreliable);
 
   let a = [1, 2, 3];
   unreliable(a, false);
@@ -452,6 +471,7 @@
   function notCallable() {
     return a.findIndex(undefined);
   }
+  %PrepareFunctionForOptimization(notCallable);
 
   assertThrows(notCallable, TypeError);
   try { notCallable(); } catch(e) { }
diff --git a/src/v8/test/mjsunit/optimized-array-some.js b/src/v8/test/mjsunit/optimized-array-some.js
index 8d0114a..7386270 100644
--- a/src/v8/test/mjsunit/optimized-array-some.js
+++ b/src/v8/test/mjsunit/optimized-array-some.js
@@ -15,6 +15,7 @@
       return v > 2;
     });
   }
+  %PrepareFunctionForOptimization(earlyExit);
   assertTrue(earlyExit());
   earlyExit();
   %OptimizeFunctionOnNextCall(earlyExit);
@@ -35,6 +36,7 @@
        return v > 7;
      });
   }
+  %PrepareFunctionForOptimization(softyPlusEarlyExit);
   assertTrue(softyPlusEarlyExit(false));
   softyPlusEarlyExit(false);
   %OptimizeFunctionOnNextCall(softyPlusEarlyExit);
@@ -58,6 +60,7 @@
        return v > 7;
      });
   }
+  %PrepareFunctionForOptimization(softyPlusEarlyExit);
   assertTrue(softyPlusEarlyExit(false));
   assertArrayEquals([1, 2, 3, 4, 5, 6, 7, 8], called_values);
   softyPlusEarlyExit(false);
@@ -81,6 +84,7 @@
       return false;
     });
   }
+  %PrepareFunctionForOptimization(eagerDeoptInCalled);
   eagerDeoptInCalled();
   eagerDeoptInCalled();
   %OptimizeFunctionOnNextCall(eagerDeoptInCalled);
@@ -102,6 +106,7 @@
       return false;
     });
   }
+  %PrepareFunctionForOptimization(eagerDeoptInCalled);
   assertFalse(eagerDeoptInCalled());
   assertArrayEquals([1, 2, 3, 4, 5, 6, 7, 8, 9, 10], called_values);
   eagerDeoptInCalled();
@@ -125,6 +130,7 @@
       return false;
     });
   }
+  %PrepareFunctionForOptimization(lazyChanger);
   assertFalse(lazyChanger());
   lazyChanger();
   %OptimizeFunctionOnNextCall(lazyChanger);
@@ -144,6 +150,7 @@
       return false;
     });
   }
+  %PrepareFunctionForOptimization(lazyChanger);
   assertFalse(lazyChanger());
   lazyChanger();
   %OptimizeFunctionOnNextCall(lazyChanger);
@@ -164,6 +171,7 @@
       return false;
     });
   }
+  %PrepareFunctionForOptimization(lazyChanger);
   assertFalse(lazyChanger());
   lazyChanger();
   %OptimizeFunctionOnNextCall(lazyChanger);
@@ -184,6 +192,7 @@
       return false;
     });
   }
+  %PrepareFunctionForOptimization(eagerDeoptInCalled);
   eagerDeoptInCalled();
   eagerDeoptInCalled();
   %OptimizeFunctionOnNextCall(eagerDeoptInCalled);
@@ -207,6 +216,7 @@
       return false;
     });
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -232,6 +242,7 @@
     %NeverOptimizeFunction(callback);
     a.some(callback);
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -259,6 +270,7 @@
       caught = true;
     }
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -287,6 +299,7 @@
       caught = true;
     }
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -318,6 +331,7 @@
     }
     return result;
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   assertEquals(false, lazyDeopt(false));
   assertEquals(false, lazyDeopt(false));
   assertEquals("nope", lazyDeopt(true));
@@ -343,6 +357,7 @@
       return false;
     });
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -370,6 +385,7 @@
     b.some(callback);
     return did_assert_error;
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -397,6 +413,7 @@
     });
     return did_assert_error;
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -420,6 +437,7 @@
       return false;
     });
   }
+  %PrepareFunctionForOptimization(lazyDeopt);
   assertThrows(() => lazyDeopt());
   assertThrows(() => lazyDeopt());
   try {
@@ -445,6 +463,7 @@
       return false;
     });
   }
+  %PrepareFunctionForOptimization(prototypeChanged);
   prototypeChanged();
   prototypeChanged();
   %OptimizeFunctionOnNextCall(prototypeChanged);
@@ -466,6 +485,7 @@
     });
     return callback_values;
   }
+  %PrepareFunctionForOptimization(withHoles);
   withHoles();
   withHoles();
   %OptimizeFunctionOnNextCall(withHoles);
@@ -482,6 +502,7 @@
     });
     return callback_values;
   }
+  %PrepareFunctionForOptimization(withHoles);
   withHoles();
   withHoles();
   %OptimizeFunctionOnNextCall(withHoles);
@@ -494,6 +515,7 @@
   function notCallable() {
     return a.some(undefined);
   }
+  %PrepareFunctionForOptimization(notCallable);
 
   assertThrows(notCallable, TypeError);
   try { notCallable(); } catch(e) { }
diff --git a/src/v8/test/mjsunit/optimized-filter.js b/src/v8/test/mjsunit/optimized-filter.js
index 3c7d827..97eb1f2 100644
--- a/src/v8/test/mjsunit/optimized-filter.js
+++ b/src/v8/test/mjsunit/optimized-filter.js
@@ -23,7 +23,8 @@
       return true;
     }
     return a.filter(callback);
-  }
+  };
+  %PrepareFunctionForOptimization(eagerDeoptInCalled);
   eagerDeoptInCalled();
   eagerDeoptInCalled();
   %OptimizeFunctionOnNextCall(eagerDeoptInCalled);
@@ -43,7 +44,8 @@
       return i == 0 ? false : true;
     }
     return a.filter(callback);
-  }
+  };
+  %PrepareFunctionForOptimization(eagerDeoptInCalled);
   var like_a = [1,2,3,4,5,6,7,8,9,10];
   assertEquals(like_a.slice(1), eagerDeoptInCalled());
   eagerDeoptInCalled();
@@ -66,7 +68,8 @@
       return true;
     }
     return a.filter(callback);
-  }
+  };
+  %PrepareFunctionForOptimization(lazyChanger);
   assertEquals(a, lazyChanger());
   lazyChanger();
   %OptimizeFunctionOnNextCall(lazyChanger);
@@ -88,7 +91,8 @@
       return true;
     }
     return a.filter(callback);
-  }
+  };
+  %PrepareFunctionForOptimization(lazyDeselection);
   assertEquals(a, lazyDeselection());
   lazyDeselection();
   %OptimizeFunctionOnNextCall(lazyDeselection);
@@ -111,7 +115,8 @@
       return true;
     }
     a_noescape.filter(callback);
-  }
+  };
+  %PrepareFunctionForOptimization(eagerDeoptInCalled);
   eagerDeoptInCalled();
   eagerDeoptInCalled();
   %OptimizeFunctionOnNextCall(eagerDeoptInCalled);
@@ -138,7 +143,8 @@
     };
     %NeverOptimizeFunction(callback);
     b.filter(callback);
-  }
+  };
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -160,7 +166,8 @@
       return true;
     }
     a.filter(callback);
-  }
+  };
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -184,7 +191,8 @@
     };
     %NeverOptimizeFunction(callback);
     a.filter(callback);
-  }
+  };
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -209,7 +217,8 @@
       return true;
     }
     a.filter(callback);
-  }
+  };
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -238,7 +247,8 @@
     } catch (e) {
       caught = true;
     }
-  }
+  };
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -268,7 +278,8 @@
     } catch (e) {
       caught = true;
     }
-  }
+  };
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -299,7 +310,8 @@
       result = "nope";
     }
     return result;
-  }
+  };
+  %PrepareFunctionForOptimization(lazyDeopt);
   assertEquals([1,2,3,4], lazyDeopt(false));
   assertEquals([1,2,3,4], lazyDeopt(false));
   assertEquals("nope", lazyDeopt(true));
@@ -326,7 +338,8 @@
     };
     var o = [1,2,3];
     b.filter(callback);
-  }
+  };
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -351,7 +364,8 @@
     %NeverOptimizeFunction(callback);
     var o = [1,2,3];
     b.filter(callback);
-  }
+  };
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -377,7 +391,8 @@
     };
     var o = [1,2,3];
     b.filter(callback);
-  }
+  };
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -401,7 +416,8 @@
       return true;
     };
     a.filter(callback);
-  }
+  };
+  %PrepareFunctionForOptimization(lazyDeopt);
   assertThrows(() => lazyDeopt());
   assertThrows(() => lazyDeopt());
   try {
@@ -428,6 +444,7 @@
       return true;
     });
   }
+  %PrepareFunctionForOptimization(withHoles);
   withHoles();
   withHoles();
   %OptimizeFunctionOnNextCall(withHoles);
@@ -445,6 +462,7 @@
       return true;
     });
   }
+  %PrepareFunctionForOptimization(withHoles);
   withHoles();
   withHoles();
   %OptimizeFunctionOnNextCall(withHoles);
@@ -461,6 +479,7 @@
     return a.filter(x => x % 2 === 0, side_effect(a, b));
   }
 
+  %PrepareFunctionForOptimization(unreliable);
   let a = [1, 2, 3];
   unreliable(a, false);
   unreliable(a, false);
@@ -480,7 +499,8 @@
       return true;
     }
     a.filter(callback);
-  }
+  };
+  %PrepareFunctionForOptimization(species_breakage);
   species_breakage();
   species_breakage();
   %OptimizeFunctionOnNextCall(species_breakage);
diff --git a/src/v8/test/mjsunit/optimized-foreach-holey-2.js b/src/v8/test/mjsunit/optimized-foreach-holey-2.js
index 6779377..637aa1b 100644
--- a/src/v8/test/mjsunit/optimized-foreach-holey-2.js
+++ b/src/v8/test/mjsunit/optimized-foreach-holey-2.js
@@ -21,7 +21,8 @@
       result += v;
     };
     b.forEach(sum);
-  }
+  };
+  %PrepareFunctionForOptimization(f);
   f();
   f();
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/optimized-foreach-holey-3.js b/src/v8/test/mjsunit/optimized-foreach-holey-3.js
index a397a0a..5767bf4 100644
--- a/src/v8/test/mjsunit/optimized-foreach-holey-3.js
+++ b/src/v8/test/mjsunit/optimized-foreach-holey-3.js
@@ -5,28 +5,33 @@
 // Flags: --allow-natives-syntax --expose-gc --turbo-inline-array-builtins
 
 (function() {
-  var result = 0;
-  var proto_set_func = function(p, s) {
-    %NeverOptimizeFunction(proto_set_func);
-    if (s) {
-      p[0] = 1;
-    }
+var result = 0;
+var proto_set_func = function(p, s) {
+  %NeverOptimizeFunction(proto_set_func);
+  if (s) {
+    p[0] = 1;
   }
-  var f = function(s) {
-    var b = [,,];
-    b[1] = 0;
-    b[2] = 2;
-    var sum = function(v,i,o) {
-      if (i==1) proto_set_func(b.__proto__, s);
-      result += v;
-    };
-    b.forEach(sum);
-  }
-  f();
-  f();
-  %OptimizeFunctionOnNextCall(f);
-  f();
-  f(true);
-  f();
-  assertEquals(11, result);
+};
+var f = function(s) {
+  var b = [
+    ,
+    ,
+  ];
+  b[1] = 0;
+  b[2] = 2;
+  var sum = function(v, i, o) {
+    if (i == 1) proto_set_func(b.__proto__, s);
+    result += v;
+  };
+  b.forEach(sum);
+};
+;
+%PrepareFunctionForOptimization(f);
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
+f(true);
+f();
+assertEquals(11, result);
 })();
diff --git a/src/v8/test/mjsunit/optimized-foreach-holey.js b/src/v8/test/mjsunit/optimized-foreach-holey.js
index 90145bf..95ccbf9 100644
--- a/src/v8/test/mjsunit/optimized-foreach-holey.js
+++ b/src/v8/test/mjsunit/optimized-foreach-holey.js
@@ -14,7 +14,8 @@
       result += i;
     };
     b.forEach(sum);
-  }
+  };
+  %PrepareFunctionForOptimization(f);
   f();
   f();
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/optimized-foreach-polymorph.js b/src/v8/test/mjsunit/optimized-foreach-polymorph.js
index ed49583..ca5653c 100644
--- a/src/v8/test/mjsunit/optimized-foreach-polymorph.js
+++ b/src/v8/test/mjsunit/optimized-foreach-polymorph.js
@@ -19,7 +19,8 @@
       result += i;
     }
     arg.forEach(sum);
-  }
+  };
+  %PrepareFunctionForOptimization(polymorph1);
   polymorph1(a);
   polymorph1(a);
   polymorph1(b);
@@ -39,7 +40,8 @@
       result += i;
     }
     arg.forEach(sum);
-  }
+  };
+  %PrepareFunctionForOptimization(polymorph1);
   polymorph1(a);
   polymorph1(a);
   polymorph1(b);
@@ -61,7 +63,8 @@
       result += i;
     }
     arg.forEach(sum);
-  }
+  };
+  %PrepareFunctionForOptimization(polymorph1);
   polymorph1(a);
   polymorph1(a);
   polymorph1(b);
@@ -82,7 +85,8 @@
       result += v;
     }
     arg.forEach(sum);
-  }
+  };
+  %PrepareFunctionForOptimization(polymorph1);
   polymorph1(d);
   polymorph1(d);
   polymorph1(d);
@@ -100,7 +104,8 @@
       result += v;
     }
     arg.forEach(sum);
-  }
+  };
+  %PrepareFunctionForOptimization(polymorph1);
   polymorph1(d);
   polymorph1(e);
   polymorph1(d);
diff --git a/src/v8/test/mjsunit/optimized-foreach.js b/src/v8/test/mjsunit/optimized-foreach.js
index 1fe54b5..c47bd03 100644
--- a/src/v8/test/mjsunit/optimized-foreach.js
+++ b/src/v8/test/mjsunit/optimized-foreach.js
@@ -4,225 +4,253 @@
 
 // Flags: --allow-natives-syntax --expose-gc --turbo-inline-array-builtins
 
-var a = [0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,0,0];
-var b = [1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25];
-var c = [1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25];
+var a = [
+  0,  1,  2,  3,  4,  5,  6,  7,  8,  9,  10, 11, 12, 13,
+  14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 0,  0
+];
+var b = [
+  1,  2,  3,  4,  5,  6,  7,  8,  9,  10, 11, 12, 13,
+  14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25
+];
+var c = [
+  1,  2,  3,  4,  5,  6,  7,  8,  9,  10, 11, 12, 13,
+  14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25
+];
 
 // Unknown field access leads to soft-deopt unrelated to forEach, should still
 // lead to correct result.
 (function() {
-  var result = 0;
-  var eagerDeoptInCalled = function(deopt) {
-    var sum = function(v,i,o) {
-      result += v;
-      if (i == 13 && deopt) {
-        a.abc = 25;
-      }
+var result = 0;
+var eagerDeoptInCalled = function(deopt) {
+  var sum = function(v, i, o) {
+    result += v;
+    if (i == 13 && deopt) {
+      a.abc = 25;
     }
-    a.forEach(sum);
-  }
-  eagerDeoptInCalled();
-  eagerDeoptInCalled();
-  %OptimizeFunctionOnNextCall(eagerDeoptInCalled);
-  eagerDeoptInCalled();
-  eagerDeoptInCalled(true);
-  eagerDeoptInCalled();
-  assertEquals(1500, result);
+  };
+  a.forEach(sum);
+};
+;
+%PrepareFunctionForOptimization(eagerDeoptInCalled);
+eagerDeoptInCalled();
+eagerDeoptInCalled();
+%OptimizeFunctionOnNextCall(eagerDeoptInCalled);
+eagerDeoptInCalled();
+eagerDeoptInCalled(true);
+eagerDeoptInCalled();
+assertEquals(1500, result);
 })();
 
 // Length change detected during loop, must cause properly handled eager deopt.
 (function() {
-  var result = 0;
-  var eagerDeoptInCalled = function(deopt) {
-    var sum = function(v,i,o) {
-      result += v;
-      a.length = (i == 13 && deopt) ? 25 : 27;
-    }
-    a.forEach(sum);
-  }
-  eagerDeoptInCalled();
-  eagerDeoptInCalled();
-  %OptimizeFunctionOnNextCall(eagerDeoptInCalled);
-  eagerDeoptInCalled();
-  eagerDeoptInCalled(true);
-  eagerDeoptInCalled();
-  assertEquals(1500, result);
+var result = 0;
+var eagerDeoptInCalled = function(deopt) {
+  var sum = function(v, i, o) {
+    result += v;
+    a.length = i == 13 && deopt ? 25 : 27;
+  };
+  a.forEach(sum);
+};
+;
+%PrepareFunctionForOptimization(eagerDeoptInCalled);
+eagerDeoptInCalled();
+eagerDeoptInCalled();
+%OptimizeFunctionOnNextCall(eagerDeoptInCalled);
+eagerDeoptInCalled();
+eagerDeoptInCalled(true);
+eagerDeoptInCalled();
+assertEquals(1500, result);
 })();
 
 // Escape analyzed array
 (function() {
-  var result = 0;
-  var eagerDeoptInCalled = function(deopt) {
-    var a_noescape = [0,1,2,3,4,5];
-    var sum = function(v,i,o) {
-      result += v;
-      if (i == 13 && deopt) {
-        a_noescape.length = 25;
-      }
+var result = 0;
+var eagerDeoptInCalled = function(deopt) {
+  var a_noescape = [0, 1, 2, 3, 4, 5];
+  var sum = function(v, i, o) {
+    result += v;
+    if (i == 13 && deopt) {
+      a_noescape.length = 25;
     }
-    a_noescape.forEach(sum);
-  }
-  eagerDeoptInCalled();
-  eagerDeoptInCalled();
-  %OptimizeFunctionOnNextCall(eagerDeoptInCalled);
-  eagerDeoptInCalled();
-  eagerDeoptInCalled(true);
-  eagerDeoptInCalled();
-  assertEquals(75, result);
+  };
+  a_noescape.forEach(sum);
+};
+;
+%PrepareFunctionForOptimization(eagerDeoptInCalled);
+eagerDeoptInCalled();
+eagerDeoptInCalled();
+%OptimizeFunctionOnNextCall(eagerDeoptInCalled);
+eagerDeoptInCalled();
+eagerDeoptInCalled(true);
+eagerDeoptInCalled();
+assertEquals(75, result);
 })();
 
 // Escape analyzed array where sum function isn't inlined, forcing a lazy deopt
 // with GC that relies on the stashed-away return result fro the lazy deopt
 // being properly stored in a place on the stack that gets GC'ed.
 (function() {
-  var result = 0;
-  var lazyDeopt = function(deopt) {
-    var b = [1,2,3];
-    var sum = function(v,i,o) {
-      result += i;
-      if (i == 1 && deopt) {
-        %DeoptimizeFunction(lazyDeopt);
-      }
-      gc(); gc();
-    };
-    %NeverOptimizeFunction(sum);
-    b.forEach(sum);
-  }
-  lazyDeopt();
-  lazyDeopt();
-  %OptimizeFunctionOnNextCall(lazyDeopt);
-  lazyDeopt();
-  lazyDeopt(true);
-  lazyDeopt();
+var result = 0;
+var lazyDeopt = function(deopt) {
+  var b = [1, 2, 3];
+  var sum = function(v, i, o) {
+    result += i;
+    if (i == 1 && deopt) {
+      %DeoptimizeFunction(lazyDeopt);
+    }
+    gc();
+    gc();
+  };
+  %NeverOptimizeFunction(sum);
+  b.forEach(sum);
+};
+;
+%PrepareFunctionForOptimization(lazyDeopt);
+lazyDeopt();
+lazyDeopt();
+%OptimizeFunctionOnNextCall(lazyDeopt);
+lazyDeopt();
+lazyDeopt(true);
+lazyDeopt();
 })();
 
 // Lazy deopt from runtime call from inlined callback function.
 (function() {
-  var result = 0;
-  var lazyDeopt = function(deopt) {
-    var sum = function(v,i,o) {
-      result += i;
-      if (i == 13 && deopt) {
-          %DeoptimizeNow();
-      }
+var result = 0;
+var lazyDeopt = function(deopt) {
+  var sum = function(v, i, o) {
+    result += i;
+    if (i == 13 && deopt) {
+      %DeoptimizeNow();
     }
-    b.forEach(sum);
-  }
-  lazyDeopt();
-  lazyDeopt();
-  %OptimizeFunctionOnNextCall(lazyDeopt);
-  lazyDeopt();
-  lazyDeopt(true);
-  lazyDeopt();
-  assertEquals(1500, result);
+  };
+  b.forEach(sum);
+};
+;
+%PrepareFunctionForOptimization(lazyDeopt);
+lazyDeopt();
+lazyDeopt();
+%OptimizeFunctionOnNextCall(lazyDeopt);
+lazyDeopt();
+lazyDeopt(true);
+lazyDeopt();
+assertEquals(1500, result);
 })();
 
 // Lazy deopt from runtime call from non-inline callback function.
 (function() {
-  var result = 0;
-  var lazyDeopt = function(deopt) {
-    var sum = function(v,i,o) {
-      result += i;
-      if (i == 13 && deopt) {
-          %DeoptimizeNow();
-      }
-    };
-    %NeverOptimizeFunction(sum);
-    b.forEach(sum);
-  }
-  lazyDeopt();
-  lazyDeopt();
-  %OptimizeFunctionOnNextCall(lazyDeopt);
-  lazyDeopt();
-  lazyDeopt(true);
-  lazyDeopt();
-  assertEquals(1500, result);
+var result = 0;
+var lazyDeopt = function(deopt) {
+  var sum = function(v, i, o) {
+    result += i;
+    if (i == 13 && deopt) {
+      %DeoptimizeNow();
+    }
+  };
+  %NeverOptimizeFunction(sum);
+  b.forEach(sum);
+};
+;
+%PrepareFunctionForOptimization(lazyDeopt);
+lazyDeopt();
+lazyDeopt();
+%OptimizeFunctionOnNextCall(lazyDeopt);
+lazyDeopt();
+lazyDeopt(true);
+lazyDeopt();
+assertEquals(1500, result);
 })();
 
 (function() {
-  var result = 0;
-  var lazyDeopt = function(deopt) {
-    var sum = function(v,i,o) {
-      result += i;
-      if (i == 13 && deopt) {
-          %DeoptimizeNow();
-          gc();
-          gc();
-          gc();
-      }
+var result = 0;
+var lazyDeopt = function(deopt) {
+  var sum = function(v, i, o) {
+    result += i;
+    if (i == 13 && deopt) {
+      %DeoptimizeNow();
+      gc();
+      gc();
+      gc();
     }
-    c.forEach(sum);
-  }
-  lazyDeopt();
-  lazyDeopt();
-  %OptimizeFunctionOnNextCall(lazyDeopt);
-  lazyDeopt();
-  lazyDeopt(true);
-  lazyDeopt();
-  assertEquals(1500, result);
+  };
+  c.forEach(sum);
+};
+;
+%PrepareFunctionForOptimization(lazyDeopt);
+lazyDeopt();
+lazyDeopt();
+%OptimizeFunctionOnNextCall(lazyDeopt);
+lazyDeopt();
+lazyDeopt(true);
+lazyDeopt();
+assertEquals(1500, result);
 })();
 
 // Call to a.forEach is done inside a try-catch block and the callback function
 // being called actually throws.
 (function() {
-  var caught = false;
-  var result = 0;
-  var lazyDeopt = function(deopt) {
-    var sum = function(v,i,o) {
-      result += i;
-      if (i == 1 && deopt) {
-        throw("a");
-      }
+var caught = false;
+var result = 0;
+var lazyDeopt = function(deopt) {
+  var sum = function(v, i, o) {
+    result += i;
+    if (i == 1 && deopt) {
+      throw 'a';
     }
-    try {
-      c.forEach(sum);
-    } catch (e) {
-      caught = true;
-    }
+  };
+  try {
+    c.forEach(sum);
+  } catch (e) {
+    caught = true;
   }
-  lazyDeopt();
-  lazyDeopt();
-  %OptimizeFunctionOnNextCall(lazyDeopt);
-  lazyDeopt();
-  assertDoesNotThrow(lazyDeopt.bind(this, true));
-  assertTrue(caught);
-  lazyDeopt();
+};
+;
+%PrepareFunctionForOptimization(lazyDeopt);
+lazyDeopt();
+lazyDeopt();
+%OptimizeFunctionOnNextCall(lazyDeopt);
+lazyDeopt();
+assertDoesNotThrow(lazyDeopt.bind(this, true));
+assertTrue(caught);
+lazyDeopt();
 })();
 
 // Call to a.forEach is done inside a try-catch block and the callback function
 // being called actually throws, but the callback is not inlined.
 (function() {
-  var caught = false;
-  var result = 0;
-  var lazyDeopt = function(deopt) {
-    var sum = function(v,i,o) {
-      result += i;
-      if (i == 1 && deopt) {
-        throw("a");
-      }
-    };
-    %NeverOptimizeFunction(sum);
-    try {
-      c.forEach(sum);
-    } catch (e) {
-      caught = true;
+var caught = false;
+var result = 0;
+var lazyDeopt = function(deopt) {
+  var sum = function(v, i, o) {
+    result += i;
+    if (i == 1 && deopt) {
+      throw 'a';
     }
+  };
+  %NeverOptimizeFunction(sum);
+  try {
+    c.forEach(sum);
+  } catch (e) {
+    caught = true;
   }
-  lazyDeopt();
-  lazyDeopt();
-  %OptimizeFunctionOnNextCall(lazyDeopt);
-  lazyDeopt();
-  assertDoesNotThrow(lazyDeopt.bind(this, true));
-  assertTrue(caught);
-  lazyDeopt();
+};
+;
+%PrepareFunctionForOptimization(lazyDeopt);
+lazyDeopt();
+lazyDeopt();
+%OptimizeFunctionOnNextCall(lazyDeopt);
+lazyDeopt();
+assertDoesNotThrow(lazyDeopt.bind(this, true));
+assertTrue(caught);
+lazyDeopt();
 })();
 
 // Call to a.forEach is done inside a try-catch block and the callback function
 // being called throws into a deoptimized caller function.
 (function TestThrowIntoDeoptimizedOuter() {
-  var a = [1,2,3,4];
+  var a = [1, 2, 3, 4];
   var lazyDeopt = function(deopt) {
-    var sum = function(v,i,o) {
+    var sum = function(v, i, o) {
       result += v;
       if (i == 1 && deopt) {
         %DeoptimizeFunction(lazyDeopt);
@@ -234,11 +262,13 @@
     try {
       a.forEach(sum);
     } catch (e) {
-      assertEquals("some exception", e)
+      assertEquals('some exception', e);
       result += 100;
     }
     return result;
-  }
+  };
+  ;
+  %PrepareFunctionForOptimization(lazyDeopt);
   assertEquals(10, lazyDeopt(false));
   assertEquals(10, lazyDeopt(false));
   assertEquals(103, lazyDeopt(true));
@@ -249,99 +279,107 @@
 })();
 
 (function() {
-  var re = /Array\.forEach/;
-  var lazyDeopt = function foobar(deopt) {
-    var b = [1,2,3];
-    var result = 0;
-    var sum = function(v,i,o) {
-      result += v;
-      if (i == 1) {
-        var e = new Error();
-        print(e.stack);
-        assertTrue(re.exec(e.stack) !== null);
-      }
-    };
-    var o = [1,2,3];
-    b.forEach(sum);
-  }
-  lazyDeopt();
-  lazyDeopt();
-  %OptimizeFunctionOnNextCall(lazyDeopt);
-  lazyDeopt();
-})();
-
-(function() {
-  var re = /Array\.forEach/;
-  var lazyDeopt = function(deopt) {
-    var b = [1,2,3];
-    var result = 0;
-    var sum = function(v,i,o) {
-      result += v;
-      if (i == 1) {
-        var e = new Error();
-        assertTrue(re.exec(e.stack) !== null);
-      }
-    };
-    %NeverOptimizeFunction(sum);
-    var o = [1,2,3];
-    b.forEach(sum);
-  }
-  lazyDeopt();
-  lazyDeopt();
-  %OptimizeFunctionOnNextCall(lazyDeopt);
-  lazyDeopt();
-})();
-
-(function() {
-  var re = /Array\.forEach/;
-  var lazyDeopt = function(deopt) {
-    var b = [1,2,3];
-    var result = 0;
-    var sum = function(v,i,o) {
-      result += v;
-      if (i == 1) {
-        %DeoptimizeNow();
-      } else if (i == 2) {
-        var e = new Error();
-        assertTrue(re.exec(e.stack) !== null);
-      }
-    };
-    var o = [1,2,3];
-    b.forEach(sum);
-  }
-  lazyDeopt();
-  lazyDeopt();
-  %OptimizeFunctionOnNextCall(lazyDeopt);
-  lazyDeopt();
-})();
-
-(function() {
-  var re = /Array\.forEach/;
-  var a = [1,2,3];
+var re = /Array\.forEach/;
+var lazyDeopt = function foobar(deopt) {
+  var b = [1, 2, 3];
   var result = 0;
-  var lazyDeopt = function() {
-    var sum = function(v,i,o) {
-      result += i;
-      if (i == 1) {
-        %DeoptimizeFunction(lazyDeopt);
-        throw new Error();
-      }
-    };
-    a.forEach(sum);
-  }
-  assertThrows(() => lazyDeopt());
-  assertThrows(() => lazyDeopt());
-  try {
-    lazyDeopt();
-  } catch (e) {
-    assertTrue(re.exec(e.stack) !== null);
-  }
-  %OptimizeFunctionOnNextCall(lazyDeopt);
-  try {
-    lazyDeopt();
-  } catch (e) {
-    assertTrue(re.exec(e.stack) !== null);
-  }
+  var sum = function(v, i, o) {
+    result += v;
+    if (i == 1) {
+      var e = new Error();
+      print(e.stack);
+      assertTrue(re.exec(e.stack) !== null);
+    }
+  };
+  var o = [1, 2, 3];
+  b.forEach(sum);
+};
+;
+%PrepareFunctionForOptimization(lazyDeopt);
+lazyDeopt();
+lazyDeopt();
+%OptimizeFunctionOnNextCall(lazyDeopt);
+lazyDeopt();
+})();
+
+(function() {
+var re = /Array\.forEach/;
+var lazyDeopt = function(deopt) {
+  var b = [1, 2, 3];
+  var result = 0;
+  var sum = function(v, i, o) {
+    result += v;
+    if (i == 1) {
+      var e = new Error();
+      assertTrue(re.exec(e.stack) !== null);
+    }
+  };
+  %NeverOptimizeFunction(sum);
+  var o = [1, 2, 3];
+  b.forEach(sum);
+};
+;
+%PrepareFunctionForOptimization(lazyDeopt);
+lazyDeopt();
+lazyDeopt();
+%OptimizeFunctionOnNextCall(lazyDeopt);
+lazyDeopt();
+})();
+
+(function() {
+var re = /Array\.forEach/;
+var lazyDeopt = function(deopt) {
+  var b = [1, 2, 3];
+  var result = 0;
+  var sum = function(v, i, o) {
+    result += v;
+    if (i == 1) {
+      %DeoptimizeNow();
+    } else if (i == 2) {
+      var e = new Error();
+      assertTrue(re.exec(e.stack) !== null);
+    }
+  };
+  var o = [1, 2, 3];
+  b.forEach(sum);
+};
+;
+%PrepareFunctionForOptimization(lazyDeopt);
+lazyDeopt();
+lazyDeopt();
+%OptimizeFunctionOnNextCall(lazyDeopt);
+lazyDeopt();
+})();
+
+(function() {
+var re = /Array\.forEach/;
+var a = [1, 2, 3];
+var result = 0;
+var lazyDeopt = function() {
+  var sum = function(v, i, o) {
+    result += i;
+    if (i == 1) {
+      %DeoptimizeFunction(lazyDeopt);
+      throw new Error();
+    }
+  };
+  a.forEach(sum);
+};
+;
+%PrepareFunctionForOptimization(lazyDeopt);
+assertThrows(() => lazyDeopt());
+assertThrows(() => lazyDeopt());
+try {
+  lazyDeopt();
+} catch (e) {
+  assertTrue(re.exec(e.stack) !== null);
+}
+%OptimizeFunctionOnNextCall(lazyDeopt);
+try {
+  lazyDeopt();
+} catch (e) {
+  assertTrue(re.exec(e.stack) !== null);
+}
 })();
 
 // Verify holes are skipped.
@@ -353,7 +391,8 @@
       callback_values.push(v);
     });
     return callback_values;
-  }
+  };
+  %PrepareFunctionForOptimization(withHoles);
   withHoles();
   withHoles();
   %OptimizeFunctionOnNextCall(withHoles);
@@ -368,7 +407,8 @@
       callback_values.push(v);
     });
     return callback_values;
-  }
+  };
+  %PrepareFunctionForOptimization(withHoles);
   withHoles();
   withHoles();
   %OptimizeFunctionOnNextCall(withHoles);
@@ -377,14 +417,17 @@
 
 // Ensure that we handle side-effects between load and call.
 (() => {
-  function side_effect(a, b) { if (b) a.foo = 3; return a; }
+  function side_effect(a, b) {
+    if (b) a.foo = 3;
+    return a;
+  }
   %NeverOptimizeFunction(side_effect);
 
   function unreliable(a, b) {
     let sum = 0;
     return a.forEach(x => sum += x, side_effect(a, b));
-  }
-
+  };
+  %PrepareFunctionForOptimization(unreliable);
   let a = [1, 2, 3];
   unreliable(a, false);
   unreliable(a, false);
diff --git a/src/v8/test/mjsunit/optimized-includes-polymorph.js b/src/v8/test/mjsunit/optimized-includes-polymorph.js
new file mode 100644
index 0000000..d71428a
--- /dev/null
+++ b/src/v8/test/mjsunit/optimized-includes-polymorph.js
@@ -0,0 +1,118 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var o1 = {};
+var o2 = {};
+var a = [0, 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,0,0];
+var b = [,,,,,2,3,4];
+var c = [o1, o2];
+var d = [,,, o2, o1];
+var e = [0.5,3,4];
+var f = [,,,,0.5,3,4];
+
+function checkIncludes(ary, value) {
+  return ary.includes(value)
+}
+
+function checkIndexOf(ary, value, expected) {
+  return ary.indexOf(value) == expected;
+}
+
+function expectIncludes(ary, value) {
+  assertTrue(checkIncludes(ary, value));
+}
+
+function expectNotIncludes(ary, value) {
+  assertFalse(checkIncludes(ary, value));
+}
+
+function expectIndexOf(ary, value, expected) {
+  assertTrue(checkIndexOf(ary, value, expected));
+}
+
+var testIncludes = {
+  polymorphic: function() {
+    expectIncludes(a, 21);
+    expectIncludes(b, 4);
+    expectIncludes(c, o2);
+    expectIncludes(d, o1);
+    expectNotIncludes(a, o1);
+    expectNotIncludes(b, o2);
+    expectNotIncludes(c, 3);
+    expectNotIncludes(d, 4);
+    },
+
+  polymorphicDouble: function() {
+    expectIncludes(e, 3);
+    expectIncludes(f, 0.5);
+    expectNotIncludes(e, 10);
+    expectNotIncludes(f, 0.25);
+  },
+
+  polymorphicMixed: function() {
+    expectIncludes(a, 21);
+    expectIncludes(b, 4);
+    expectIncludes(c, o2);
+    expectIncludes(d, o1);
+    expectIncludes(e, 3);
+    expectIncludes(f, 0.5);
+    expectNotIncludes(a, o1);
+    expectNotIncludes(b, o2);
+    expectNotIncludes(c, 3);
+    expectNotIncludes(d, 4);
+    expectNotIncludes(e, 10);
+    expectNotIncludes(f, 0.25);
+  },
+};
+
+var testIndexOf = {
+  polymorphic: function() {
+    expectIndexOf(a, 21, 21);
+    expectIndexOf(b, 4, 7);
+    expectIndexOf(c, o2, 1);
+    expectIndexOf(d, o1, 4);
+    expectIndexOf(a, o1, -1);
+    expectIndexOf(b, o2, -1);
+    expectIndexOf(c, 3, -1);
+    expectIndexOf(d, 4, -1);
+  },
+
+  polymorphicDouble: function() {
+    expectIndexOf(e, 3, 1);
+    expectIndexOf(f, 0.5, 4);
+    expectIndexOf(e, 10, -1);
+    expectIndexOf(f, 0.25, -1);
+  },
+
+  polymorphicMixed: function() {
+    expectIndexOf(a, 21, 21);
+    expectIndexOf(b, 4, 7);
+    expectIndexOf(c, o2, 1);
+    expectIndexOf(d, o1, 4);
+    expectIndexOf(e, 3, 1);
+    expectIndexOf(f, 0.5, 4);
+    expectIndexOf(a, o1, -1);
+    expectIndexOf(b, o2, -1);
+    expectIndexOf(c, 3, -1);
+    expectIndexOf(d, 4, -1);
+    expectIndexOf(e, 10, -1);
+    expectIndexOf(f, 0.25, -1);
+  },
+};
+
+function runTests(tests, func) {
+  for (test in tests) {
+    %DeoptimizeFunction(func);
+    %ClearFunctionFeedback(func);
+    %PrepareFunctionForOptimization(func);
+    tests[test]();
+    %OptimizeFunctionOnNextCall(func);
+    tests[test]();
+  }
+}
+
+runTests(testIncludes, checkIncludes)
+runTests(testIndexOf, checkIndexOf)
diff --git a/src/v8/test/mjsunit/optimized-map.js b/src/v8/test/mjsunit/optimized-map.js
index 6a3df4d..1095f7b 100644
--- a/src/v8/test/mjsunit/optimized-map.js
+++ b/src/v8/test/mjsunit/optimized-map.js
@@ -20,9 +20,11 @@
         a.abc = 25;
       }
       return v;
-    }
+    };
+    %EnsureFeedbackVectorForFunction(callback);
     a.map(callback);
-  }
+  };
+  %PrepareFunctionForOptimization(eagerDeoptInCalled);
   eagerDeoptInCalled();
   eagerDeoptInCalled();
   %OptimizeFunctionOnNextCall(eagerDeoptInCalled);
@@ -40,9 +42,11 @@
       result += v;
       a.length = (i == 13 && deopt) ? 25 : 27;
       return v;
-    }
+    };
+    %EnsureFeedbackVectorForFunction(callback);
     a.map(callback);
-  }
+  };
+  %PrepareFunctionForOptimization(eagerDeoptInCalled);
   eagerDeoptInCalled();
   eagerDeoptInCalled();
   %OptimizeFunctionOnNextCall(eagerDeoptInCalled);
@@ -63,9 +67,11 @@
         a_noescape.length = 25;
       }
       return v;
-    }
+    };
+    %EnsureFeedbackVectorForFunction(callback);
     a_noescape.map(callback);
-  }
+  };
+  %PrepareFunctionForOptimization(eagerDeoptInCalled);
   eagerDeoptInCalled();
   eagerDeoptInCalled();
   %OptimizeFunctionOnNextCall(eagerDeoptInCalled);
@@ -90,9 +96,11 @@
       gc(); gc();
       return v;
     };
+    %EnsureFeedbackVectorForFunction(callback);
     %NeverOptimizeFunction(callback);
     b.map(callback);
-  }
+  };
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -113,9 +121,11 @@
       }
       return 2 * v;
     };
+    %EnsureFeedbackVectorForFunction(callback);
     %NeverOptimizeFunction(callback);
     return b.map(callback);
-  }
+  };
+  %PrepareFunctionForOptimization(lazyDeopt);
   assertEquals([2,4,6], lazyDeopt());
   assertEquals([2,4,6], lazyDeopt());
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -132,9 +142,11 @@
           %DeoptimizeNow();
       }
       return v;
-    }
+    };
+    %EnsureFeedbackVectorForFunction(callback);
     b.map(callback);
-  }
+  };
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -155,9 +167,11 @@
       }
       return v;
     };
+    %EnsureFeedbackVectorForFunction(callback);
     %NeverOptimizeFunction(callback);
     b.map(callback);
-  }
+  };
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -179,9 +193,11 @@
           gc();
       }
       return v;
-    }
+    };
+    %EnsureFeedbackVectorForFunction(callback);
     c.map(callback);
-  }
+  };
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -203,13 +219,15 @@
         throw("a");
       }
       return v;
-    }
+    };
+    %EnsureFeedbackVectorForFunction(callback);
     try {
       c.map(callback);
     } catch (e) {
       caught = true;
     }
-  }
+  };
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -232,13 +250,15 @@
       }
       return v;
     };
+    %EnsureFeedbackVectorForFunction(callback);
     %NeverOptimizeFunction(callback);
     try {
       c.map(callback);
     } catch (e) {
       caught = true;
     }
-  }
+  };
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -260,6 +280,7 @@
       }
       return 2 * v;
     };
+    %EnsureFeedbackVectorForFunction(callback);
     %NeverOptimizeFunction(callback);
     var result = 0;
     try {
@@ -269,7 +290,8 @@
       result = "nope";
     }
     return result;
-  }
+  };
+  %PrepareFunctionForOptimization(lazyDeopt);
   assertEquals([2,4,6,8], lazyDeopt(false));
   assertEquals([2,4,6,8], lazyDeopt(false));
   assertEquals("nope", lazyDeopt(true));
@@ -292,9 +314,11 @@
       }
       return v;
     };
+    %EnsureFeedbackVectorForFunction(callback);
     var o = [1,2,3];
     b.map(callback);
-  }
+  };
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -314,10 +338,12 @@
       }
       return v;
     };
+    %EnsureFeedbackVectorForFunction(callback);
     %NeverOptimizeFunction(callback);
     var o = [1,2,3];
     b.map(callback);
-  }
+  };
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -339,9 +365,11 @@
       }
       return v;
     };
+    %EnsureFeedbackVectorForFunction(callback);
     var o = [1,2,3];
     b.map(callback);
-  }
+  };
+  %PrepareFunctionForOptimization(lazyDeopt);
   lazyDeopt();
   lazyDeopt();
   %OptimizeFunctionOnNextCall(lazyDeopt);
@@ -361,8 +389,10 @@
       }
       return v;
     };
+    %EnsureFeedbackVectorForFunction(callback);
     a.map(callback);
-  }
+  };
+  %PrepareFunctionForOptimization(lazyDeopt);
   assertThrows(() => lazyDeopt());
   assertThrows(() => lazyDeopt());
   try {
@@ -393,9 +423,11 @@
         // array.
         return v;
       }
-    }
+    };
+    %EnsureFeedbackVectorForFunction(callback);
     return c.map(callback);
-  }
+  };
+  %PrepareFunctionForOptimization(to_double);
   to_double();
   to_double();
   %OptimizeFunctionOnNextCall(to_double);
@@ -423,9 +455,11 @@
         // Later, to PACKED_ELEMENTS.
         return v + 'hello';
       }
-    }
+    };
+    %EnsureFeedbackVectorForFunction(callback);
     return c.map(callback);
-  }
+  };
+  %PrepareFunctionForOptimization(to_fast);
   to_fast();
   to_fast();
   %OptimizeFunctionOnNextCall(to_fast);
@@ -443,8 +477,10 @@
   function double_results() {
     // TurboFan recognizes the result is a double.
     var callback = v => v + 0.5;
+    %EnsureFeedbackVectorForFunction(callback);
     return a.map(callback);
   }
+  %PrepareFunctionForOptimization(double_results);
   double_results();
   double_results();
   %OptimizeFunctionOnNextCall(double_results);
@@ -461,6 +497,7 @@
     var callback = v => "hello" + v.toString();
     return a.map(callback);
   }
+  %PrepareFunctionForOptimization(string_results);
   string_results();
   string_results();
   %OptimizeFunctionOnNextCall(string_results);
@@ -479,6 +516,7 @@
       return v;
     });
   }
+  %PrepareFunctionForOptimization(withHoles);
   withHoles();
   withHoles();
   %OptimizeFunctionOnNextCall(withHoles);
@@ -496,6 +534,7 @@
       return v;
     });
   }
+  %PrepareFunctionForOptimization(withHoles);
   withHoles();
   withHoles();
   %OptimizeFunctionOnNextCall(withHoles);
@@ -513,6 +552,7 @@
   }
 
   let a = [1, 2, 3];
+  %PrepareFunctionForOptimization(unreliable);
   unreliable(a, false);
   unreliable(a, false);
   %OptimizeFunctionOnNextCall(unreliable);
@@ -531,7 +571,8 @@
       return v;
     }
     a.map(callback);
-  }
+  };
+  %PrepareFunctionForOptimization(species_breakage);
   species_breakage();
   species_breakage();
   %OptimizeFunctionOnNextCall(species_breakage);
diff --git a/src/v8/test/mjsunit/optimized-reduce.js b/src/v8/test/mjsunit/optimized-reduce.js
new file mode 100644
index 0000000..67904a3
--- /dev/null
+++ b/src/v8/test/mjsunit/optimized-reduce.js
@@ -0,0 +1,76 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc --turbo-inline-array-builtins
+// Flags: --opt --no-always-opt
+
+// Unknown field access leads to eager-deopt unrelated to reduce, should still
+// lead to correct result.
+(() => {
+  const a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
+  // For this particular eager deopt point to work, we need to dodge
+  // TurboFan's soft-deopts through a non-inlined and non-optimized function
+  // call to foo().
+  function foo(o, deopt) { if (deopt) { o.abc = 3; }}
+  %NeverOptimizeFunction(foo);
+  function eagerDeoptInCalled(deopt) {
+    return a.reduce((r, v, i, o) => {
+      if (i === 7) {
+        foo(a, deopt);
+      }
+      return r + "S";
+    }, "H");
+  }
+  %PrepareFunctionForOptimization(eagerDeoptInCalled);
+  eagerDeoptInCalled();
+  eagerDeoptInCalled();
+  %OptimizeFunctionOnNextCall(eagerDeoptInCalled);
+  eagerDeoptInCalled();
+  assertEquals("HSSSSSSSSSS", eagerDeoptInCalled(true));
+})();
+
+// Make sure we gracefully handle the case of an empty array in
+// optimized code.
+(function() {
+  var nothingThere = function(only_holes) {
+    var a = [1,2,,3];  // holey smi array.
+    if (only_holes) {
+      a = [,,,];  // also a holey smi array.
+    }
+    return a.reduce((r,v,i,o)=>r+v);
+  };
+  %PrepareFunctionForOptimization(nothingThere);
+  nothingThere();
+  nothingThere();
+  %OptimizeFunctionOnNextCall(nothingThere);
+  assertThrows(() => nothingThere(true));
+})();
+
+// An error generated inside the callback includes reduce in it's
+// stack trace.
+(function() {
+  var re = /Array\.reduce/;
+  var alwaysThrows = function() {
+    var b = [,,,];
+    var result = 0;
+    var callback = function(r,v,i,o) {
+      return r + v;
+    };
+    b.reduce(callback);
+  }
+  try {
+    alwaysThrows();
+  } catch (e) {
+    assertTrue(re.exec(e.stack) !== null);
+  }
+  %PrepareFunctionForOptimization(alwaysThrows);
+  try { alwaysThrows(); } catch (e) {}
+  try { alwaysThrows(); } catch (e) {}
+  %OptimizeFunctionOnNextCall(alwaysThrows);
+  try {
+    alwaysThrows();
+  } catch (e) {
+    assertTrue(re.exec(e.stack) !== null);
+  }
+})();
diff --git a/src/v8/test/mjsunit/optimized-reduceright.js b/src/v8/test/mjsunit/optimized-reduceright.js
new file mode 100644
index 0000000..4c7b21e
--- /dev/null
+++ b/src/v8/test/mjsunit/optimized-reduceright.js
@@ -0,0 +1,96 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc --turbo-inline-array-builtins
+// Flags: --opt --no-always-opt
+
+// Unknown field access leads to eager-deopt unrelated to reduceright, should
+// still lead to correct result.
+(() => {
+  const a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
+  // For this particular eager deopt point to work, we need to dodge
+  // TurboFan's soft-deopts through a non-inlined and non-optimized function
+  // call to foo().
+  function foo(o, deopt) {
+    if (deopt) {
+      o.abc = 3;
+    }
+  }
+  %NeverOptimizeFunction(foo);
+  function eagerDeoptInCalled(deopt) {
+    return a.reduceRight((r, v, i, o) => {
+      if (i === 7) {
+        foo(a, deopt);
+      }
+      return r + "S";
+    }, "H");
+  };
+  %PrepareFunctionForOptimization(eagerDeoptInCalled);
+  eagerDeoptInCalled();
+  eagerDeoptInCalled();
+  %OptimizeFunctionOnNextCall(eagerDeoptInCalled);
+  eagerDeoptInCalled();
+  assertEquals("HSSSSSSSSSS", eagerDeoptInCalled(true));
+})();
+
+// Make sure we gracefully handle the case of an empty array in
+// optimized code.
+(function() {
+var nothingThere = function(only_holes) {
+  var a = [1, 2, , 3];  // holey smi array.
+  if (only_holes) {
+    a = [
+      ,
+      ,
+      ,
+    ];  // also a holey smi array.
+  }
+  return a.reduceRight((r, v, i, o) => r + v);
+};
+;
+%PrepareFunctionForOptimization(nothingThere);
+nothingThere();
+nothingThere();
+%OptimizeFunctionOnNextCall(nothingThere);
+assertThrows(() => nothingThere(true));
+})();
+
+// An error generated inside the callback includes reduce in it's
+// stack trace.
+(function() {
+var re = /Array\.reduceRight/;
+var alwaysThrows = function() {
+  var b = [
+    ,
+    ,
+    ,
+  ];
+  var result = 0;
+  var callback = function(r, v, i, o) {
+    return r + v;
+  };
+  b.reduceRight(callback);
+};
+;
+%PrepareFunctionForOptimization(alwaysThrows);
+try {
+  alwaysThrows();
+} catch (e) {
+  assertTrue(re.exec(e.stack) !== null);
+}
+try {
+  alwaysThrows();
+} catch (e) {
+}
+try {
+  alwaysThrows();
+} catch (e) {
+}
+%OptimizeFunctionOnNextCall(alwaysThrows);
+try {
+  alwaysThrows();
+} catch (e) {
+  assertTrue(re.exec(e.stack) !== null);
+}
+})();
diff --git a/src/v8/test/mjsunit/optimized-typeof.js b/src/v8/test/mjsunit/optimized-typeof.js
index b0c0725..bcd348c 100644
--- a/src/v8/test/mjsunit/optimized-typeof.js
+++ b/src/v8/test/mjsunit/optimized-typeof.js
@@ -28,19 +28,19 @@
 // Flags: --allow-natives-syntax
 
 function typeofDirectly() {
-  return typeof({}) === "undefined";
-}
-
+  return typeof{} === 'undefined';
+};
+%PrepareFunctionForOptimization(typeofDirectly);
 typeofDirectly();
 typeofDirectly();
 %OptimizeFunctionOnNextCall(typeofDirectly);
 typeofDirectly();
 
 function typeofViaVariable() {
-  var foo = typeof({})
+  var foo = typeof{};
   return foo === "undefined";
-}
-
+};
+%PrepareFunctionForOptimization(typeofViaVariable);
 typeofViaVariable();
 typeofViaVariable();
 %OptimizeFunctionOnNextCall(typeofViaVariable);
diff --git a/src/v8/test/mjsunit/osr-elements-kind.js b/src/v8/test/mjsunit/osr-elements-kind.js
index d68da9b..5f0e7b7 100644
--- a/src/v8/test/mjsunit/osr-elements-kind.js
+++ b/src/v8/test/mjsunit/osr-elements-kind.js
@@ -87,56 +87,67 @@
   assertEquals(expected, getKind(obj), name_opt);
 }
 
-%NeverOptimizeFunction(construct_smis);
-%NeverOptimizeFunction(construct_doubles);
-%NeverOptimizeFunction(convert_mixed);
-for (var i = 0; i < 10; i++) { if (i == 5) %OptimizeOsr(); }
+%EnsureFeedbackVectorForFunction(test_osr_elements_kind);
+function test_osr_elements_kind() {
+  %NeverOptimizeFunction(construct_smis);
+  %NeverOptimizeFunction(construct_doubles);
+  %NeverOptimizeFunction(convert_mixed);
+  for (var i = 0; i < 10; i++) { if (i == 5) %OptimizeOsr(); }
 
-// This code exists to eliminate the learning influence of AllocationSites
-// on the following tests.
-var __sequence = 0;
-function make_array_string() {
-  this.__sequence = this.__sequence + 1;
-  return "/* " + this.__sequence + " */  [0, 0, 0];"
+  // This code exists to eliminate the learning influence of AllocationSites
+  // on the following tests.
+  var __sequence = 0;
+  function make_array_string() {
+    this.__sequence = this.__sequence + 1;
+    return "/* " + this.__sequence + " */  [0, 0, 0];"
+  }
+  function make_array() {
+    return eval(make_array_string());
+  }
+
+  %EnsureFeedbackVectorForFunction(construct_smis);
+  function construct_smis() {
+    var a = make_array();
+    a[0] = 0;  // Send the COW array map to the steak house.
+    assertKind(elements_kind.fast_smi_only, a);
+    return a;
+  }
+
+  %EnsureFeedbackVectorForFunction(construct_doubles);
+  function construct_doubles() {
+    var a = construct_smis();
+    a[0] = 1.5;
+    assertKind(elements_kind.fast_double, a);
+    return a;
+  }
+
+  // Test transition chain SMI->DOUBLE->FAST (optimized function will
+  // transition to FAST directly).
+  %EnsureFeedbackVectorForFunction(convert_mixed);
+  function convert_mixed(array, value, kind) {
+    array[1] = value;
+    assertKind(kind, array);
+    assertEquals(value, array[1]);
+  }
+  smis = construct_smis();
+  convert_mixed(smis, 1.5, elements_kind.fast_double);
+
+  doubles = construct_doubles();
+  convert_mixed(doubles, "three", elements_kind.fast);
+
+  convert_mixed(construct_smis(), "three", elements_kind.fast);
+  convert_mixed(construct_doubles(), "three", elements_kind.fast);
+
+  if (%ICsAreEnabled()) {
+    // Test that allocation sites allocate correct elements kind initially based
+    // on previous transitions.
+    smis = construct_smis();
+    doubles = construct_doubles();
+    convert_mixed(smis, 1, elements_kind.fast);
+    convert_mixed(doubles, 1, elements_kind.fast);
+    assertTrue(%HaveSameMap(smis, doubles));
+  }
 }
-function make_array() {
-  return eval(make_array_string());
-}
-
-function construct_smis() {
-  var a = make_array();
-  a[0] = 0;  // Send the COW array map to the steak house.
-  assertKind(elements_kind.fast_smi_only, a);
-  return a;
-}
-function construct_doubles() {
-  var a = construct_smis();
-  a[0] = 1.5;
-  assertKind(elements_kind.fast_double, a);
-  return a;
-}
-
-// Test transition chain SMI->DOUBLE->FAST (optimized function will
-// transition to FAST directly).
-function convert_mixed(array, value, kind) {
-  array[1] = value;
-  assertKind(kind, array);
-  assertEquals(value, array[1]);
-}
-smis = construct_smis();
-convert_mixed(smis, 1.5, elements_kind.fast_double);
-
-doubles = construct_doubles();
-convert_mixed(doubles, "three", elements_kind.fast);
-
-convert_mixed(construct_smis(), "three", elements_kind.fast);
-convert_mixed(construct_doubles(), "three", elements_kind.fast);
-
-smis = construct_smis();
-doubles = construct_doubles();
-convert_mixed(smis, 1, elements_kind.fast);
-convert_mixed(doubles, 1, elements_kind.fast);
-assertTrue(%HaveSameMap(smis, doubles));
 
 // Throw away type information in the ICs for next stress run.
 gc();
diff --git a/src/v8/test/mjsunit/outobject-double-for-in.js b/src/v8/test/mjsunit/outobject-double-for-in.js
index eb8ac94..59fcf83 100644
--- a/src/v8/test/mjsunit/outobject-double-for-in.js
+++ b/src/v8/test/mjsunit/outobject-double-for-in.js
@@ -60,6 +60,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(test_props);
 test_props(z);
 test_props(z);
 %OptimizeFunctionOnNextCall(test_props);
diff --git a/src/v8/test/mjsunit/packed-elements.js b/src/v8/test/mjsunit/packed-elements.js
index d421c51..d0df553 100644
--- a/src/v8/test/mjsunit/packed-elements.js
+++ b/src/v8/test/mjsunit/packed-elements.js
@@ -94,6 +94,7 @@
 function test_with_optimization(f) {
   // Run tests in a loop to make sure that inlined Array() constructor runs out
   // of new space memory and must fall back on runtime impl.
+  %PrepareFunctionForOptimization(f);
   for (i = 0; i < 25000; ++i) f();
   %OptimizeFunctionOnNextCall(f);
   for (i = 0; i < 25000; ++i) f(); // Make sure GC happens
diff --git a/src/v8/test/mjsunit/parallel-compile-tasks.js b/src/v8/test/mjsunit/parallel-compile-tasks.js
new file mode 100644
index 0000000..fbde569
--- /dev/null
+++ b/src/v8/test/mjsunit/parallel-compile-tasks.js
@@ -0,0 +1,70 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --compiler-dispatcher --parallel-compile-tasks --use-external-strings
+
+(function(a) {
+ assertEquals(a, "IIFE");
+})("IIFE");
+
+(function(a, ...rest) {
+ assertEquals(a, 1);
+ assertEquals(rest.length, 2);
+ assertEquals(rest[0], 2);
+ assertEquals(rest[1], 3);
+})(1,2,3);
+
+var outer_var = 42;
+
+function lazy_outer() {
+ return 42;
+}
+
+var eager_outer = (function() { return 42; });
+
+(function() {
+ assertEquals(outer_var, 42);
+ assertEquals(lazy_outer(), 42);
+ assertEquals(eager_outer(), 42);
+})();
+
+var gen = (function*() {
+ yield 1;
+ yield 2;
+})();
+
+assertEquals(gen.next().value, 1);
+assertEquals(gen.next().value, 2);
+
+var result = (function recursive(a=0) {
+ if (a == 1) {
+  return 42;
+ }
+ return recursive(1);
+})();
+
+assertEquals(result, 42);
+
+var a = 42;
+var b;
+var c = (a, b = (function z(){ return a+1; })());
+assertEquals(b, 43);
+assertEquals(c, 43);
+var c = (a, b = (function z(){ return a+1; })()) => { return b; };
+assertEquals(c(314), 315);
+
+// http://crbug.com/898076
+(function() {
+  class foo {};
+});  // Don't call IIFE so that it is compiled during idle time
+
+// http://crbug.com/900535
+(function() {
+  "use asm";
+  function bar(i, j) {
+    i = i|0;
+    j = j|0;
+  }
+  return {bar: bar};
+});  // Don't call IIFE so that it is compiled during idle time
diff --git a/src/v8/test/mjsunit/parallel-optimize-disabled.js b/src/v8/test/mjsunit/parallel-optimize-disabled.js
index bcd7110..631c381 100644
--- a/src/v8/test/mjsunit/parallel-optimize-disabled.js
+++ b/src/v8/test/mjsunit/parallel-optimize-disabled.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --concurrent-recompilation
+// Flags: --concurrent-recompilation --turbo-inlining
 // Flags: --allow-natives-syntax --no-always-opt
 
 if (!%IsConcurrentRecompilationSupported()) {
@@ -43,6 +43,8 @@
   g();
 }
 
+%PrepareFunctionForOptimization(f);
+%PrepareFunctionForOptimization(g);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/pixel-array-rounding.js b/src/v8/test/mjsunit/pixel-array-rounding.js
index b7db51c..8050c13 100644
--- a/src/v8/test/mjsunit/pixel-array-rounding.js
+++ b/src/v8/test/mjsunit/pixel-array-rounding.js
@@ -39,6 +39,7 @@
   return pixels[1] + pixels[6];
 }
 
+%PrepareFunctionForOptimization(f);
 f();
 f();
 assertEquals(6, pixels[5]);
diff --git a/src/v8/test/mjsunit/polymorph-arrays.js b/src/v8/test/mjsunit/polymorph-arrays.js
index 7d3221a..7c2c09a 100644
--- a/src/v8/test/mjsunit/polymorph-arrays.js
+++ b/src/v8/test/mjsunit/polymorph-arrays.js
@@ -45,6 +45,7 @@
     function load(a, i) {
       return a[i];
     }
+    %PrepareFunctionForOptimization(load);
 
     var object_array = new Object;
     var sparse_object_array = new Object;
@@ -110,6 +111,7 @@
     function store(a, i, val) {
       a[i] = val;
     }
+    %PrepareFunctionForOptimization(store);
 
     var object_array = new Object;
     var sparse_object_array = new Object;
diff --git a/src/v8/test/mjsunit/promise-perform-all-resolve-lookup.js b/src/v8/test/mjsunit/promise-perform-all-resolve-lookup.js
new file mode 100644
index 0000000..8e877df
--- /dev/null
+++ b/src/v8/test/mjsunit/promise-perform-all-resolve-lookup.js
@@ -0,0 +1,28 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+let count = 0;
+class MyPromise extends Promise {
+  static get resolve() {
+    count++;
+    return super.resolve;
+  }
+}
+
+MyPromise.all([1, 2, 3, 4, 5]);
+assertEquals(1, count);
+%PerformMicrotaskCheckpoint();
+assertEquals(1, count);
+
+count = 0;
+MyPromise.all([
+  Promise.resolve(1),
+  Promise.resolve(2),
+  Promise.reject(3)
+]);
+assertEquals(1, count);
+%PerformMicrotaskCheckpoint();
+assertEquals(1, count);
diff --git a/src/v8/test/mjsunit/promise-perform-all-settled-resolve-lookup.js b/src/v8/test/mjsunit/promise-perform-all-settled-resolve-lookup.js
new file mode 100644
index 0000000..a2f5f01
--- /dev/null
+++ b/src/v8/test/mjsunit/promise-perform-all-settled-resolve-lookup.js
@@ -0,0 +1,28 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --harmony-promise-all-settled
+
+let count = 0;
+class MyPromise extends Promise {
+  static get resolve() {
+    count++;
+    return super.resolve;
+  }
+}
+
+MyPromise.allSettled([1, 2, 3, 4, 5]);
+assertEquals(1, count);
+%PerformMicrotaskCheckpoint();
+assertEquals(1, count);
+
+count = 0;
+MyPromise.allSettled([
+  Promise.resolve(1),
+  Promise.resolve(2),
+  Promise.reject(3)
+]);
+assertEquals(1, count);
+%PerformMicrotaskCheckpoint();
+assertEquals(1, count);
diff --git a/src/v8/test/mjsunit/promise-perfrom-race-resolve-lookup.js b/src/v8/test/mjsunit/promise-perfrom-race-resolve-lookup.js
new file mode 100644
index 0000000..72c9c40
--- /dev/null
+++ b/src/v8/test/mjsunit/promise-perfrom-race-resolve-lookup.js
@@ -0,0 +1,28 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+let count = 0;
+class MyPromise extends Promise {
+  static get resolve() {
+    count++;
+    return super.resolve;
+  }
+}
+
+MyPromise.race([1, 2, 3, 4, 5]);
+assertEquals(1, count);
+%PerformMicrotaskCheckpoint();
+assertEquals(1, count);
+
+count = 0;
+MyPromise.race([
+  Promise.resolve(1),
+  Promise.resolve(2),
+  Promise.reject(3)
+]);
+assertEquals(1, count);
+%PerformMicrotaskCheckpoint();
+assertEquals(1, count);
diff --git a/src/v8/test/mjsunit/proto-elements-add-during-foreach.js b/src/v8/test/mjsunit/proto-elements-add-during-foreach.js
index 8ee4ebc..83b8000 100644
--- a/src/v8/test/mjsunit/proto-elements-add-during-foreach.js
+++ b/src/v8/test/mjsunit/proto-elements-add-during-foreach.js
@@ -2,9 +2,37 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-var a = [0,1,2,,,,7];
-var proto = {}
-a.__proto__ = proto;
-var visits = 0;
-Array.prototype.forEach.call(a, (v,i,o) => { ++visits; proto[4] = 4; });
-assertEquals(5, visits);
+(()=>{
+  var a = [0,1,2,,,,7];
+  var proto = {}
+  a.__proto__ = proto;
+  var visits = 0;
+  Array.prototype.forEach.call(a, (v,i,o) => { ++visits; proto[4] = 4; });
+  assertEquals(5, visits);
+})();
+
+// We have a fast path for arrays with the initial array prototype.
+// If elements are inserted into the initial array prototype as we traverse
+// a holey array, we should gracefully exit the fast path.
+(()=>{
+  let a = [1, 2, 3,,,, 7];
+  function poison(v, i) {
+    if (i === 2) {
+      [].__proto__[4] = 3;
+    }
+    return v*v;
+  }
+  a.forEach(poison);
+})();
+
+// Same, but for a double array.
+(()=>{
+  let a = [1, 2.5, 3,,,, 7];
+  function poison(v, i) {
+    if (i === 2) {
+      [].__proto__[4] = 3;
+    }
+    return v*v;
+  }
+  a.forEach(poison);
+})();
diff --git a/src/v8/test/mjsunit/prototype-arity.js b/src/v8/test/mjsunit/prototype-arity.js
new file mode 100644
index 0000000..bd0319f
--- /dev/null
+++ b/src/v8/test/mjsunit/prototype-arity.js
@@ -0,0 +1,67 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const types = [
+  [Object, "{}"],
+  [String, "\"abc\""],
+  [RegExp, "/abc/"],
+  [WeakMap, "(new WeakMap())"],
+  [WeakSet, "(new WeakSet())"],
+  [Map, "(new Map())"],
+  [Set, "(new Set())"],
+  [Function, "(function f() {return 1})"],
+  [Array, "[1,2,3, {}]"],
+  [Boolean, "(new Boolean())"],
+  [Symbol, "(new Symbol())"],
+  [BigInt, "(new BigInt(42))"],
+  [Math, "Math"],
+  [Date, "(new Date())"],
+  [Promise, "(new Promise())"],
+  [Reflect, "Reflect"],
+  [Proxy, "(new Proxy({}, {}))"],
+];
+
+if (typeof Intl == "object") {
+  types.push([Intl, "Intl"]);
+  types.push([Intl.Collator, "Intl.Collator"]);
+  types.push([Intl.ListFormat, "Intl.ListFormat"]);
+  types.push([Intl.NumberFormat, "Intl.NumberFormat"]);
+  types.push([Intl.PluralRules, "Intl.PluralRules"]);
+  types.push([Intl.RelativeTimeFormat, "Intl.RelativeTimeFormat"]);
+}
+
+const callTemplate = () => {
+  function f() {
+    return constr_exp.propCall(args)
+  }
+  %PrepareFunctionForOptimization(f);
+  try { f(); } catch (e) {}
+  try { f(); } catch (e) {}
+  %OptimizeFunctionOnNextCall(f);
+  try { f(); } catch (e) {}
+}
+
+const mkCall = (constr_exp, propCall) => {
+  const arrowFunction = callTemplate.toString().replace("constr_exp", constr_exp).replace("propCall", propCall).replace("args", "");
+  return `(${arrowFunction})();`;
+}
+
+for ([type, constr_exp, blacklist] of types) {
+  const proto = type.prototype || type;
+  for (const f of Object.getOwnPropertyNames(proto)) {
+    const d = Object.getOwnPropertyDescriptor(proto, f);
+    if (d.get || d.set || (typeof proto[f]) != "function") continue;
+    const source = mkCall(constr_exp, f);
+    try {
+      eval(source);
+    } catch (err) {
+      // Exceptions are OK.
+      console.log(`EXN ${err} for ${type.toString()} ${f}`)
+      console.log(source);
+      continue;
+    }
+  }
+}
diff --git a/src/v8/test/mjsunit/prototype-changes.js b/src/v8/test/mjsunit/prototype-changes.js
index e7fcc7e..c34f760 100644
--- a/src/v8/test/mjsunit/prototype-changes.js
+++ b/src/v8/test/mjsunit/prototype-changes.js
@@ -24,7 +24,8 @@
 function f(expected) {
   var result = c.z;
   assertEquals(expected, result);
-}
+};
+%PrepareFunctionForOptimization(f);
 f(undefined);
 f(undefined);
 %OptimizeFunctionOnNextCall(f);
@@ -35,9 +36,12 @@
 
 // Test updating .__proto__ pointers.
 var p1 = {foo: 1.5};
-var p2 = {}; p2.__proto__ = p1;
-var p3 = {}; p3.__proto__ = p2;
-var o = {}; o.__proto__ = p3;
+var p2 = {};
+p2.__proto__ = p1;
+var p3 = {};
+p3.__proto__ = p2;
+var o = {};
+o.__proto__ = p3;
 
 for (var i = 0; i < 2; i++) o.foo;  // Force registration.
 
@@ -52,5 +56,9 @@
 g(o, 1.7);
 g(o, 1.7);
 g(o, 1.7);
-Object.defineProperty(p1a, "foo", {get: function() { return "foo"}});
+Object.defineProperty(p1a, 'foo', {
+  get: function() {
+    return 'foo';
+  }
+});
 g(o, "foo");
diff --git a/src/v8/test/mjsunit/prototype-non-existing.js b/src/v8/test/mjsunit/prototype-non-existing.js
index 367a59f..293aefb 100644
--- a/src/v8/test/mjsunit/prototype-non-existing.js
+++ b/src/v8/test/mjsunit/prototype-non-existing.js
@@ -34,6 +34,7 @@
     var result = c.z;
     assertEquals(expected, result);
   }
+  %PrepareFunctionForOptimization(f);
   f("a");
   f("a");
   f("a");
@@ -74,6 +75,7 @@
     var result = c.z;
     assertEquals(expected, result);
   }
+  %PrepareFunctionForOptimization(f);
   f("a");
   f("a");
   f("a");
diff --git a/src/v8/test/mjsunit/readonly.js b/src/v8/test/mjsunit/readonly.js
index 72a08a7..ec938d6 100644
--- a/src/v8/test/mjsunit/readonly.js
+++ b/src/v8/test/mjsunit/readonly.js
@@ -34,7 +34,7 @@
 }
 
 function CreateFromObject() {
-  return new Object;
+  return new Object();
 }
 
 function CreateDefault() {
@@ -43,19 +43,27 @@
 
 function CreateFromConstructor(proto) {
   function C() {}
-  (new C).b = 9;  // Make sure that we can have an in-object property.
+  new C().b = 9;  // Make sure that we can have an in-object property.
   C.prototype = proto;
-  return function() { return new C; }
+  return function() {
+    return new C();
+  };
 }
 
 function CreateFromApi(proto) {
-  return function() { return Object.create(proto); }
+  return function() {
+    return Object.create(proto);
+  };
 }
 
 function CreateWithProperty(proto) {
-  function C() { this.a = -100; }
+  function C() {
+    this.a = -100;
+  }
   C.prototype = proto;
-  return function() { return new C; }
+  return function() {
+    return new C();
+  };
 }
 
 var bases = [CreateFromLiteral, CreateFromObject, CreateDefault];
@@ -87,7 +95,7 @@
             o.up = o;
             for (var j = 0; j < up; ++j) o.up = Object.getPrototypeOf(o.up);
             return o;
-          })
+          });
         }
       }
     }
@@ -102,11 +110,17 @@
 }
 
 function ReadonlyByAccessorPropertyWithoutSetter(o, name) {
-  Object.defineProperty(o, name, {get: function() { return -42; }});
+  Object.defineProperty(o, name, {
+    get: function() {
+      return -42;
+    }
+  });
 }
 
 function ReadonlyByGetter(o, name) {
-  o.__defineGetter__("a", function() { return -43; });
+  o.__defineGetter__('a', function() {
+    return -43;
+  });
 }
 
 function ReadonlyByFreeze(o, name) {
@@ -131,18 +145,19 @@
       return {value: -46, writable: false, configurable: true};
     }
   });
+
   o.__proto__ = p;
 }
 
 var readonlys = [
   ReadonlyByNonwritableDataProperty, ReadonlyByAccessorPropertyWithoutSetter,
-  ReadonlyByGetter, ReadonlyByFreeze, ReadonlyByProto // ReadonlyByProxy
-]
+  ReadonlyByGetter, ReadonlyByFreeze, ReadonlyByProto  // ReadonlyByProxy
+];
 
 function TestAllReadonlys(f) {
   // Provide various methods to making a property read-only.
   for (var i = 0; i < readonlys.length; ++i) {
-    print("  readonly =", i)
+    print('  readonly =', i);
     f(readonlys[i]);
   }
 }
@@ -152,13 +167,13 @@
 
 function Assign(o, x) {
   o.a = x;
-}
-
+};
+%PrepareFunctionForOptimization(Assign);
 function AssignStrict(o, x) {
   "use strict";
   o.a = x;
-}
-
+};
+%PrepareFunctionForOptimization(AssignStrict);
 function TestAllModes(f) {
   for (var strict = 0; strict < 2; ++strict) {
     print(" strict =", strict);
@@ -167,14 +182,16 @@
 }
 
 function TestAllScenarios(f) {
-  for (var t = 0; t < 100; t = 2*t + 1) {
-    print("t =", t)
+  for (var t = 0; t < 100; t = 2 * t + 1) {
+    print('t =', t);
     f(function(strict, create, readonly) {
       // Make sure that the assignments are monomorphic.
       %DeoptimizeFunction(Assign);
       %DeoptimizeFunction(AssignStrict);
       %ClearFunctionFeedback(Assign);
       %ClearFunctionFeedback(AssignStrict);
+      %PrepareFunctionForOptimization(Assign);
+      %PrepareFunctionForOptimization(AssignStrict);
       for (var i = 0; i < t; ++i) {
         var o = create();
         assertFalse("a" in o && !("a" in o.__proto__));
@@ -193,7 +210,10 @@
       if (strict === 0)
         Assign(o, t + 1);
       else
-        assertThrows(function() { AssignStrict(o, t + 1) }, TypeError);
+
+        assertThrows(function() {
+          AssignStrict(o, t + 1);
+        }, TypeError);
       assertTrue(o.a < 0);
     });
   }
@@ -212,22 +232,23 @@
   });
 });
 
-
 // Extra test forcing bailout.
 
-function Assign2(o, x) { o.a = x }
-
+function Assign2(o, x) {
+  o.a = x;
+};
+%PrepareFunctionForOptimization(Assign2);
 (function() {
-  var p = CreateFromConstructor(Object.prototype)();
-  var c = CreateFromConstructor(p);
-  for (var i = 0; i < 3; ++i) {
-    var o = c();
-    Assign2(o, i);
-    assertEquals(i, o.a);
-  }
-  %OptimizeFunctionOnNextCall(Assign2);
-  ReadonlyByNonwritableDataProperty(p, "a");
+var p = CreateFromConstructor(Object.prototype)();
+var c = CreateFromConstructor(p);
+for (var i = 0; i < 3; ++i) {
   var o = c();
-  Assign2(o, 0);
-  assertTrue(o.a < 0);
+  Assign2(o, i);
+  assertEquals(i, o.a);
+}
+%OptimizeFunctionOnNextCall(Assign2);
+ReadonlyByNonwritableDataProperty(p, "a");
+var o = c();
+Assign2(o, 0);
+assertTrue(o.a < 0);
 })();
diff --git a/src/v8/test/mjsunit/recursive-store-opt.js b/src/v8/test/mjsunit/recursive-store-opt.js
index fb26492..b29c258 100644
--- a/src/v8/test/mjsunit/recursive-store-opt.js
+++ b/src/v8/test/mjsunit/recursive-store-opt.js
@@ -33,8 +33,8 @@
 
 function f() {
   return new g();
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regexp-modifiers-autogenerated-i18n.js b/src/v8/test/mjsunit/regexp-modifiers-autogenerated-i18n.js
index 18e086c..aace711 100644
--- a/src/v8/test/mjsunit/regexp-modifiers-autogenerated-i18n.js
+++ b/src/v8/test/mjsunit/regexp-modifiers-autogenerated-i18n.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --regexp-mode-modifiers --harmony-regexp-property
+// Flags: --regexp-mode-modifiers
 
 // These regexps are just grepped out of the other tests we already have
 // and the syntax changed from out-of-line i flag to inline i flag.
diff --git a/src/v8/test/mjsunit/regexp-modifiers-autogenerated.js b/src/v8/test/mjsunit/regexp-modifiers-autogenerated.js
index e74ea8b..82d1341 100644
--- a/src/v8/test/mjsunit/regexp-modifiers-autogenerated.js
+++ b/src/v8/test/mjsunit/regexp-modifiers-autogenerated.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --regexp-mode-modifiers --harmony-regexp-property
+// Flags: --regexp-mode-modifiers
 
 // These regexps are just grepped out of the other tests we already have
 // and the syntax changed from out-of-line i flag to inline i flag.
diff --git a/src/v8/test/mjsunit/regexp-override-exec.js b/src/v8/test/mjsunit/regexp-override-exec.js
new file mode 100644
index 0000000..66dbf13
--- /dev/null
+++ b/src/v8/test/mjsunit/regexp-override-exec.js
@@ -0,0 +1,19 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var s = "baa";
+
+assertEquals(1, s.search(/a/));
+assertEquals(["aa"], s.match(/a./));
+assertEquals(["b", "", ""], s.split(/a/));
+
+let o = { index : 3, 0 : "x" };
+
+RegExp.prototype.exec = () => { return o; }
+assertEquals(3, s.search(/a/));
+assertEquals(o, s.match(/a./));
+assertEquals("baar", s.replace(/a./, "r"));
+
+RegExp.prototype.exec = () => { return null; }
+assertEquals(["baa"], s.split(/a/));
diff --git a/src/v8/test/mjsunit/regexp-override-symbol-match-all.js b/src/v8/test/mjsunit/regexp-override-symbol-match-all.js
new file mode 100644
index 0000000..10a78a6
--- /dev/null
+++ b/src/v8/test/mjsunit/regexp-override-symbol-match-all.js
@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var s = "baa";
+
+assertEquals([["b"]], [...s.matchAll(/./)]);
+
+RegExp.prototype[Symbol.matchAll] = () => 42;
+assertEquals(42, s.matchAll(/a./));
diff --git a/src/v8/test/mjsunit/regexp-override-symbol-match.js b/src/v8/test/mjsunit/regexp-override-symbol-match.js
new file mode 100644
index 0000000..da9b6f5
--- /dev/null
+++ b/src/v8/test/mjsunit/regexp-override-symbol-match.js
@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var s = "baa";
+
+assertEquals(["aa"], s.match(/a./));
+
+RegExp.prototype[Symbol.match] = () => 42;
+assertEquals(42, s.match(/a./));
diff --git a/src/v8/test/mjsunit/regexp-override-symbol-replace.js b/src/v8/test/mjsunit/regexp-override-symbol-replace.js
new file mode 100644
index 0000000..8f3e5c1
--- /dev/null
+++ b/src/v8/test/mjsunit/regexp-override-symbol-replace.js
@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var s = "baa";
+
+assertEquals("bca", s.replace(/a/, "c"));
+
+RegExp.prototype[Symbol.replace] = () => 42;
+assertEquals(42, s.replace(/a./));
diff --git a/src/v8/test/mjsunit/regexp-override-symbol-search.js b/src/v8/test/mjsunit/regexp-override-symbol-search.js
new file mode 100644
index 0000000..2daf25a
--- /dev/null
+++ b/src/v8/test/mjsunit/regexp-override-symbol-search.js
@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var s = "baa";
+
+assertEquals(1, s.search(/a/));
+
+RegExp.prototype[Symbol.search] = () => 42;
+assertEquals(42, s.search(/a/));
diff --git a/src/v8/test/mjsunit/regexp-override-symbol-split.js b/src/v8/test/mjsunit/regexp-override-symbol-split.js
new file mode 100644
index 0000000..f5d35b1
--- /dev/null
+++ b/src/v8/test/mjsunit/regexp-override-symbol-split.js
@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var s = "baa";
+
+assertEquals(["b", "", ""], s.split(/a/));
+
+RegExp.prototype[Symbol.split] = () => 42;
+assertEquals(42, s.split(/a./));
diff --git a/src/v8/test/mjsunit/regexp.js b/src/v8/test/mjsunit/regexp.js
index dd4832b..0cad7e7 100644
--- a/src/v8/test/mjsunit/regexp.js
+++ b/src/v8/test/mjsunit/regexp.js
@@ -808,3 +808,30 @@
 
 assertFalse(/\uDB88|\uDBEC|aa/.test(""));
 assertFalse(/\uDB88|\uDBEC|aa/u.test(""));
+
+// EscapeRegExpPattern
+assertEquals("\\n", /\n/.source);
+assertEquals("\\n", new RegExp("\n").source);
+assertEquals("\\n", new RegExp("\\n").source);
+assertEquals("\\\\n", /\\n/.source);
+assertEquals("\\r", /\r/.source);
+assertEquals("\\r", new RegExp("\r").source);
+assertEquals("\\r", new RegExp("\\r").source);
+assertEquals("\\\\r", /\\r/.source);
+assertEquals("\\u2028", /\u2028/.source);
+assertEquals("\\u2028", new RegExp("\u2028").source);
+assertEquals("\\u2028", new RegExp("\\u2028").source);
+assertEquals("\\u2029", /\u2029/.source);
+assertEquals("\\u2029", new RegExp("\u2029").source);
+assertEquals("\\u2029", new RegExp("\\u2029").source);
+assertEquals("[/]", /[/]/.source);
+assertEquals("[\\/]", /[\/]/.source);
+assertEquals("[\\\\/]", /[\\/]/.source);
+assertEquals("[/]", new RegExp("[/]").source);
+assertEquals("[/]", new RegExp("[\/]").source);
+assertEquals("[\\/]", new RegExp("[\\/]").source);
+assertEquals("[[/]", /[[/]/.source);
+assertEquals("[/]]", /[/]]/.source);
+assertEquals("[[/]]", /[[/]]/.source);
+assertEquals("[[\\/]", /[[\/]/.source);
+assertEquals("[[\\/]]", /[[\/]]/.source);
diff --git a/src/v8/test/mjsunit/regress-906893.js b/src/v8/test/mjsunit/regress-906893.js
new file mode 100644
index 0000000..981b582
--- /dev/null
+++ b/src/v8/test/mjsunit/regress-906893.js
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const r = /x/;
+let counter = 0;
+
+r.exec = () => { counter++; return null; }
+
+function f() {
+  r.test("ABcd");
+}
+
+%PrepareFunctionForOptimization(f);
+f();
+assertEquals(1, counter);
+%OptimizeFunctionOnNextCall(f);
+
+f();
+assertEquals(2, counter);
diff --git a/src/v8/test/mjsunit/regress-918763.js b/src/v8/test/mjsunit/regress-918763.js
new file mode 100644
index 0000000..2e70536
--- /dev/null
+++ b/src/v8/test/mjsunit/regress-918763.js
@@ -0,0 +1,15 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function C() {}
+C.__proto__ = null;
+
+function f(c) { return 0 instanceof c; }
+
+%PrepareFunctionForOptimization(f);
+f(C);
+%OptimizeFunctionOnNextCall(f);
+assertThrows(() => f(0));
diff --git a/src/v8/test/mjsunit/regress-930045.js b/src/v8/test/mjsunit/regress-930045.js
new file mode 100644
index 0000000..8983c20
--- /dev/null
+++ b/src/v8/test/mjsunit/regress-930045.js
@@ -0,0 +1,35 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-private-fields
+
+(function CaptureStackTracePrivateSymbol() {
+  var o = {};
+  Object.preventExtensions(o);
+
+  try { Error.captureStackTrace(o); } catch (e) {}
+  try { Error.captureStackTrace(o); } catch (e) {}
+})();
+
+(function PrivateFieldAfterPreventExtensions() {
+  class C {
+    constructor() {
+      this.x = 1;
+      Object.preventExtensions(this);
+    }
+  }
+
+  class D extends C {
+    #i = 42;
+
+    set(i) { this.#i = i; }
+    get(i) { return this.#i; }
+  }
+
+  let d = new D();
+  d.x = 0.1;
+  assertEquals(42, d.get());
+  d.set(43);
+  assertEquals(43, d.get());
+})();
diff --git a/src/v8/test/mjsunit/regress-932101.js b/src/v8/test/mjsunit/regress-932101.js
new file mode 100644
index 0000000..720ee11
--- /dev/null
+++ b/src/v8/test/mjsunit/regress-932101.js
@@ -0,0 +1,11 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+o = Object("A");
+o.x = 1;
+Object.seal(o);
+o.x = 0.1
+
+o[1] = "b";
+assertEquals(undefined, o[1]);
diff --git a/src/v8/test/mjsunit/regress-952682.js b/src/v8/test/mjsunit/regress-952682.js
new file mode 100644
index 0000000..dd0e687
--- /dev/null
+++ b/src/v8/test/mjsunit/regress-952682.js
@@ -0,0 +1,15 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(array, x) {
+  array.x = x;
+  array[0] = undefined;
+  return array;
+}
+
+f([1], 1);
+f([2], 1);
+%HeapObjectVerify(f([3], undefined));
diff --git a/src/v8/test/mjsunit/regress-956426.js b/src/v8/test/mjsunit/regress-956426.js
new file mode 100644
index 0000000..93ccd7d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress-956426.js
@@ -0,0 +1,10 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var b = { x: 0, y: 0, 0: '' };
+var a = { x: 0, y: 100000000000, 0: '' };
+Object.seal(b);
+b.x = '';
diff --git a/src/v8/test/mjsunit/regress-958725.js b/src/v8/test/mjsunit/regress-958725.js
new file mode 100644
index 0000000..bb0bd11
--- /dev/null
+++ b/src/v8/test/mjsunit/regress-958725.js
@@ -0,0 +1,24 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(v3) {
+  Symbol[Symbol.replace] = Object;
+  const v8 = {};
+  let i = 0;
+  do {
+    const v12 = v3[3];
+    for (let v17 = 0; v17 < 100000; v17++) {
+    }
+    const v18 = Object();
+    function v19(v20, v21, v22) {}
+    i++;;
+  } while (i < 1);
+  const v25 = Object.freeze(v8);
+};
+%PrepareFunctionForOptimization(f);
+f(Object);
+%OptimizeFunctionOnNextCall(f);
+f(Object);
diff --git a/src/v8/test/mjsunit/regress-963346.js b/src/v8/test/mjsunit/regress-963346.js
new file mode 100644
index 0000000..8f29556
--- /dev/null
+++ b/src/v8/test/mjsunit/regress-963346.js
@@ -0,0 +1,15 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var o = ['3'];
+function foo(i) { o.x = i; }
+foo("string");
+Object.preventExtensions(o);
+Object.seal(o);
+print('foo');
+foo(0);
+%HeapObjectVerify(o);
+assertEquals(o.x, 0);
diff --git a/src/v8/test/mjsunit/regress-966460.js b/src/v8/test/mjsunit/regress-966460.js
new file mode 100644
index 0000000..8acf49b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress-966460.js
@@ -0,0 +1,11 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+PI = [];
+PI[250] = PI;
+Object.seal(PI);
+assertTrue(Object.isSealed(PI));
+var proxy = new Proxy(PI, PI);
+Object.freeze(proxy);
+assertTrue(Object.isFrozen(proxy));
diff --git a/src/v8/test/mjsunit/regress-regexp-functional-replace-slow.js b/src/v8/test/mjsunit/regress-regexp-functional-replace-slow.js
new file mode 100644
index 0000000..033bcee
--- /dev/null
+++ b/src/v8/test/mjsunit/regress-regexp-functional-replace-slow.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/a/.constructor = "";
+
+assertEquals("b", "a".replace(/a/, () => "b"));
diff --git a/src/v8/test/mjsunit/regress-v8-8445-2.js b/src/v8/test/mjsunit/regress-v8-8445-2.js
new file mode 100644
index 0000000..e37c7a0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress-v8-8445-2.js
@@ -0,0 +1,27 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+class MyRegExp {
+  exec() { return null; }
+}
+
+var r = /c/;
+
+assertEquals(["ab", ""], "abc".split(r));
+assertEquals([["c"]], [..."c".matchAll(r)]);
+
+r.constructor =  { [Symbol.species] : MyRegExp };
+
+assertEquals(["abc"], "abc".split(r));
+assertEquals([], [..."c".matchAll(r)]);
+
+assertEquals(["ab", ""], "abc".split(/c/));
+assertEquals([["c"]], [..."c".matchAll(/c/)]);
+
+RegExp.prototype.constructor =  { [Symbol.species] : MyRegExp };
+
+assertEquals(["abc"], "abc".split(/c/));
+assertEquals([], [..."c".matchAll(/c/)]);
diff --git a/src/v8/test/mjsunit/regress-v8-8445.js b/src/v8/test/mjsunit/regress-v8-8445.js
new file mode 100644
index 0000000..94443be
--- /dev/null
+++ b/src/v8/test/mjsunit/regress-v8-8445.js
@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+class MyRegExp {
+  exec() { return null; }
+}
+
+assertEquals(["ab", ""], "abc".split(/c/));
+assertEquals([["a"]], [..."a".matchAll(/a/)]);
+
+Object.defineProperty(RegExp, Symbol.species, { get() { return MyRegExp; }});
+
+assertEquals(["abc"], "abc".split(/c/));
+assertEquals([], [..."a".matchAll(/a/)]);
diff --git a/src/v8/test/mjsunit/regress/binop-in-effect-context-deopt.js b/src/v8/test/mjsunit/regress/binop-in-effect-context-deopt.js
index 8d60e90..a0af463 100644
--- a/src/v8/test/mjsunit/regress/binop-in-effect-context-deopt.js
+++ b/src/v8/test/mjsunit/regress/binop-in-effect-context-deopt.js
@@ -31,10 +31,14 @@
   function f(a, deopt, osr) {
     var result = (a + 10, "result");
     var dummy = deopt + 0;
-    for (var i = 0; osr && i < 2; i++) %OptimizeOsr();
+    for (var i = 0; osr && i < 2; i++) {
+      %PrepareFunctionForOptimization(f);
+      %OptimizeOsr();
+    }
     return result;
   }
 
+  %PrepareFunctionForOptimization(f);
   assertEquals("result", f(true, 3, false));
   assertEquals("result", f(true, 3, false));
   %OptimizeFunctionOnNextCall(f);
@@ -58,6 +62,7 @@
   function f() {
     return g(void(h() + ""));
   };
+  %PrepareFunctionForOptimization(f);
 
   f();
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/call-function-in-effect-context-deopt.js b/src/v8/test/mjsunit/regress/call-function-in-effect-context-deopt.js
index 72d3938..4e852d8 100644
--- a/src/v8/test/mjsunit/regress/call-function-in-effect-context-deopt.js
+++ b/src/v8/test/mjsunit/regress/call-function-in-effect-context-deopt.js
@@ -31,10 +31,14 @@
   var result = "result";
   %_Call(function() {}, 0, 0);
   var dummy = deopt + 0;
-  for (var i = 0; osr && i < 2; i++) %OptimizeOsr();
+  for (var i = 0; osr && i < 2; i++) {
+    %PrepareFunctionForOptimization(f);
+    %OptimizeOsr();
+  }
   return result;
 }
 
+%PrepareFunctionForOptimization(f);
 assertEquals("result", f(3, false));
 assertEquals("result", f(3, false));
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/compare-map-elim1.js b/src/v8/test/mjsunit/regress/compare-map-elim1.js
index d98c089..42d7cbd 100644
--- a/src/v8/test/mjsunit/regress/compare-map-elim1.js
+++ b/src/v8/test/mjsunit/regress/compare-map-elim1.js
@@ -30,8 +30,8 @@
 
 function foo(o) {
   return o.foo1;
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 function getter() {
   return this.x + this.z + foo2(this);
 }
@@ -40,11 +40,11 @@
   return o.a;
 }
 
-var o1 = {z:0, x:1};
-var o2 = {z:0, a:1.5, x:1};
-var o3 = {z:0, a:1.5};
-Object.defineProperty(o1, "foo1", {get:getter});
-Object.defineProperty(o2, "foo1", {get:getter});
+var o1 = {z: 0, x: 1};
+var o2 = {z: 0, a: 1.5, x: 1};
+var o3 = {z: 0, a: 1.5};
+Object.defineProperty(o1, 'foo1', {get: getter});
+Object.defineProperty(o2, 'foo1', {get: getter});
 
 foo(o1);
 foo(o1);
diff --git a/src/v8/test/mjsunit/regress/comparison-in-effect-context-deopt.js b/src/v8/test/mjsunit/regress/comparison-in-effect-context-deopt.js
index b28dff7..2142ce1 100644
--- a/src/v8/test/mjsunit/regress/comparison-in-effect-context-deopt.js
+++ b/src/v8/test/mjsunit/regress/comparison-in-effect-context-deopt.js
@@ -32,16 +32,16 @@
   return "deopt";
 }
 
-var x = { toString : lazyDeopt };
+var x = {toString: lazyDeopt};
 
 function g(x) {
   return "result";
 }
 
 function test(x) {
-  return g(void(x == ""));
-}
-
+  return g(void (x == ''));
+};
+%PrepareFunctionForOptimization(test);
 test(x);
 %OptimizeFunctionOnNextCall(test);
 assertEquals("result", test(x));
diff --git a/src/v8/test/mjsunit/regress/consolidated-holey-load.js b/src/v8/test/mjsunit/regress/consolidated-holey-load.js
index ef8f1ef..375b742 100644
--- a/src/v8/test/mjsunit/regress/consolidated-holey-load.js
+++ b/src/v8/test/mjsunit/regress/consolidated-holey-load.js
@@ -29,10 +29,10 @@
 
 function foo(array) {
   return array[0];
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 var a = [1, 2, , 4];  // Holey Smi elements.
-var b = ["abcd", 0];  // Fast elements.
+var b = ['abcd', 0];  // Fast elements.
 foo(b);  // Observe fast elements first, or the IC will transition without
 foo(a);  // going polymorphic.
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/cross-script-vars.js b/src/v8/test/mjsunit/regress/cross-script-vars.js
index fd235f9..4148cdb 100644
--- a/src/v8/test/mjsunit/regress/cross-script-vars.js
+++ b/src/v8/test/mjsunit/regress/cross-script-vars.js
@@ -71,13 +71,13 @@
       'var x;' +
       'function ' + name + '() {' +
       '  return x;' +
-      '};';
+      '};'
   return Realm.eval(test_realm, AddStrict(code, cfg));
 }
 
 function LoadVar() {
   var name = 'LoadVar_' + test_realm;
-  var code =
+  var code = (cfg.optimize ? '%PrepareFunctionForOptimization(' + name + ');' : '') +
       (cfg.optimize ? '%OptimizeFunctionOnNextCall(' + name + ');' : '') +
       name + '();';
   return Realm.eval(test_realm, AddStrict(code, cfg));
@@ -88,7 +88,6 @@
   var code = 'var g = (Function("return this"))();' +
       'var x;' +
       'function ' + name + '(v) {' +
-//      '  %DebugPrint(g);' +
       '  return x = v;' +
       '};';
   return Realm.eval(test_realm, AddStrict(code, cfg));
@@ -96,7 +95,7 @@
 
 function StoreVar(v) {
   var name = 'StoreVar_' + test_realm;
-  var code =
+  var code = (cfg.optimize ? '%PrepareFunctionForOptimization(' + name + ');' : '') +
       (cfg.optimize ? '%OptimizeFunctionOnNextCall(' + name + ');' : '') +
       name + '(' + v + ');';
   return Realm.eval(test_realm, AddStrict(code, cfg));
diff --git a/src/v8/test/mjsunit/regress/internalized-string-not-equal.js b/src/v8/test/mjsunit/regress/internalized-string-not-equal.js
index 911279b..e5121ec 100644
--- a/src/v8/test/mjsunit/regress/internalized-string-not-equal.js
+++ b/src/v8/test/mjsunit/regress/internalized-string-not-equal.js
@@ -30,9 +30,10 @@
 // A bug in r15773, when masks for internalized string and string types
 // were reorganized.
 function equal(o1, o2) {
-  return (o1 == o2);
-}
-var a = "abc";
+  return o1 == o2;
+};
+%PrepareFunctionForOptimization(equal);
+var a = 'abc';
 var b = "abc";
 equal(a, b);
 equal(a, b);
diff --git a/src/v8/test/mjsunit/regress/math-min.js b/src/v8/test/mjsunit/regress/math-min.js
index 942e9d0..703170f 100644
--- a/src/v8/test/mjsunit/regress/math-min.js
+++ b/src/v8/test/mjsunit/regress/math-min.js
@@ -16,34 +16,34 @@
   var z = a[0];
   // Same register.
   assertEquals(0, Math.min(z, z));
-}
-
+};
+%PrepareFunctionForOptimization(f1);
 function f2() {
   // Different registers.
   assertEquals(0, Math.min(a[0], a[1]));
-}
-
+};
+%PrepareFunctionForOptimization(f2);
 function f3() {
   // Zero and minus zero.
   assertEquals(-0, Math.min(a[1], a[2]));
-}
-
+};
+%PrepareFunctionForOptimization(f3);
 function f4() {
   // Zero and minus zero, reversed order.
   assertEquals(-0, Math.min(a[2], a[1]));
-}
-
+};
+%PrepareFunctionForOptimization(f4);
 function f5() {
   // Minus zero, same register.
   var m_z = a[2];
   assertEquals(-0, Math.min(m_z, m_z));
-}
-
+};
+%PrepareFunctionForOptimization(f5);
 function f6() {
   // Minus zero, different registers.
   assertEquals(-0, Math.min(a[2], a[3]));
-}
-
+};
+%PrepareFunctionForOptimization(f6);
 for (var i = 0; i < 3; i++) {
   f1();
   f2();
diff --git a/src/v8/test/mjsunit/regress/number-named-call-deopt.js b/src/v8/test/mjsunit/regress/number-named-call-deopt.js
index 1598af1..e2ed056 100644
--- a/src/v8/test/mjsunit/regress/number-named-call-deopt.js
+++ b/src/v8/test/mjsunit/regress/number-named-call-deopt.js
@@ -29,11 +29,13 @@
 
 function f(x, deopt, osr) {
   var res = "result";
-  void(x.toString(10, deopt + 0));
-  if (osr) for (var i = 0; i < 100000; i++) { }
+  void x.toString(10, deopt + 0);
+  if (osr)
+    for (var i = 0; i < 100000; i++) {
+    }
   return res;
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f(4, 0, false);
 f(4, 0, false);
 f(4, 0, false);
diff --git a/src/v8/test/mjsunit/regress/poly_count_operation.js b/src/v8/test/mjsunit/regress/poly_count_operation.js
index a8a1ed2..99e1747 100644
--- a/src/v8/test/mjsunit/regress/poly_count_operation.js
+++ b/src/v8/test/mjsunit/regress/poly_count_operation.js
@@ -35,6 +35,7 @@
 function f_mono(o) {
   return 5 + o.x++;
 }
+%PrepareFunctionForOptimization(f_mono);
 
 var to_deopt = f_mono;
 
@@ -75,6 +76,7 @@
 function f_poly(o) {
   return 5 + o.x++;
 }
+%PrepareFunctionForOptimization(f_poly);
 
 v = 1;
 to_deopt = f_poly;
@@ -93,6 +95,7 @@
 assertEquals(6, g);
 assertEquals(6, s);
 
+%PrepareFunctionForOptimization(f_poly);
 %OptimizeFunctionOnNextCall(f_poly);
 v = undefined;
 assertEquals(NaN, f_poly(o2));
@@ -102,6 +105,7 @@
 function f_pre(o) {
   return 5 + ++o.x;
 }
+%PrepareFunctionForOptimization(f_pre);
 
 v = 1;
 to_deopt = f_pre;
@@ -120,6 +124,7 @@
 assertEquals(10, g);
 assertEquals(10, s);
 
+%PrepareFunctionForOptimization(f_pre);
 %OptimizeFunctionOnNextCall(f_pre);
 v = undefined;
 assertEquals(NaN, f_pre(o2));
@@ -130,6 +135,7 @@
 function f_get(o) {
   return 5 + o.x++;
 }
+%PrepareFunctionForOptimization(f_get);
 
 v = 1;
 to_deopt = f_get;
@@ -148,6 +154,7 @@
 assertEquals(14, g);
 assertEquals(14, s);
 
+%PrepareFunctionForOptimization(f_get);
 %OptimizeFunctionOnNextCall(f_get);
 v = undefined;
 assertEquals(NaN, f_get(o2));
diff --git a/src/v8/test/mjsunit/regress/polymorphic-accessor-test-context.js b/src/v8/test/mjsunit/regress/polymorphic-accessor-test-context.js
index 6188279..e19540d 100644
--- a/src/v8/test/mjsunit/regress/polymorphic-accessor-test-context.js
+++ b/src/v8/test/mjsunit/regress/polymorphic-accessor-test-context.js
@@ -4,20 +4,32 @@
 
 // Flags: --allow-natives-syntax
 
-function t1() { return this instanceof t1; }
-function t2() { return this instanceof t2; }
+function t1() {
+  return this instanceof t1;
+}
+function t2() {
+  return this instanceof t2;
+}
 
-var o1 = new (function() { })();
-Object.defineProperty(o1, "t", {get:function() { return this instanceof o1.constructor; }});
-var o2 = new (function() { })();
-Object.defineProperty(o2, "t", {get:function() { return this instanceof o1.constructor; }});
-var o3 = new (function() { })();
+var o1 = new function() {}();
+Object.defineProperty(o1, 't', {
+  get: function() {
+    return this instanceof o1.constructor;
+  }
+});
+var o2 = new function() {}();
+Object.defineProperty(o2, 't', {
+  get: function() {
+    return this instanceof o1.constructor;
+  }
+});
+var o3 = new function() {}();
 o3.t = true;
 
 function f(o) {
   return 1 + (o.t ? 1 : 2);
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f(o1);
 f(o1);
 f(o2);
diff --git a/src/v8/test/mjsunit/regress/post-increment-close-context.js b/src/v8/test/mjsunit/regress/post-increment-close-context.js
index 08ade10..29c3d18 100644
--- a/src/v8/test/mjsunit/regress/post-increment-close-context.js
+++ b/src/v8/test/mjsunit/regress/post-increment-close-context.js
@@ -29,8 +29,9 @@
 
 var foo = {bar: -2};
 function crash() {
-  return !(foo.bar++);
-}
+  return !foo.bar++;
+};
+%PrepareFunctionForOptimization(crash);
 assertFalse(crash());
 assertEquals(-1, foo.bar);
 %OptimizeFunctionOnNextCall(crash);
diff --git a/src/v8/test/mjsunit/regress/regress-100409.js b/src/v8/test/mjsunit/regress/regress-100409.js
index c29250f..ce3cbf4 100644
--- a/src/v8/test/mjsunit/regress/regress-100409.js
+++ b/src/v8/test/mjsunit/regress/regress-100409.js
@@ -27,10 +27,10 @@
 
 // Flags: --allow-natives-syntax
 
-function outer () {
+function outer() {
   var val = 0;
 
-  function foo () {
+  function foo() {
     val = 0;
     val;
     var z = false;
@@ -41,15 +41,14 @@
       }
     }
     return val++;
-  }
-
+  };
+  %PrepareFunctionForOptimization(foo);
   return foo;
 }
 
-
 var foo = outer();
 
 assertEquals(1, foo());
 assertEquals(1, foo());
-    %OptimizeFunctionOnNextCall(foo);
+%OptimizeFunctionOnNextCall(foo);
 assertEquals(1, foo());
diff --git a/src/v8/test/mjsunit/regress/regress-1079.js b/src/v8/test/mjsunit/regress/regress-1079.js
index 208dc5b..78401bf 100644
--- a/src/v8/test/mjsunit/regress/regress-1079.js
+++ b/src/v8/test/mjsunit/regress/regress-1079.js
@@ -33,6 +33,7 @@
 function optimized() {
   return unoptimized.apply(null, arguments);
 }
+%PrepareFunctionForOptimization(optimized);
 
 // It's not crucial that this is unoptimized.
 function unoptimized() {
diff --git a/src/v8/test/mjsunit/regress/regress-108296.js b/src/v8/test/mjsunit/regress/regress-108296.js
index 38ecda7..a38d0e4 100644
--- a/src/v8/test/mjsunit/regress/regress-108296.js
+++ b/src/v8/test/mjsunit/regress/regress-108296.js
@@ -30,18 +30,20 @@
 // This test checks that young immediates embedded into code objects
 // are referenced through a cell.
 
-function f (k, a, b) {
+function f(k, a, b) {
   // Create control flow for a.foo.  Control flow resolution will
   // be generated as a part of a gap move. Gap move operate on immediates as
   // a.foo is a CONSTANT_FUNCTION.
   var x = k ? a.foo : a.foo;
   return x.prototype;
-}
-
-var a = { };
+};
+%PrepareFunctionForOptimization(f);
+var a = {};
 
 // Make sure that foo is a CONSTANT_FUNCTION but not be pretenured.
-a.foo = (function () { return function () {}; })();
+a.foo = function() {
+  return function() {};
+}();
 
 // Ensure that both branches of ternary operator have monomorphic type feedback.
 f(true, a, a);
diff --git a/src/v8/test/mjsunit/regress/regress-1099.js b/src/v8/test/mjsunit/regress/regress-1099.js
index 49e4a52..235ff89 100644
--- a/src/v8/test/mjsunit/regress/regress-1099.js
+++ b/src/v8/test/mjsunit/regress/regress-1099.js
@@ -42,6 +42,7 @@
 }
 
 var y = Y(X());
+%PrepareFunctionForOptimization(y);
 
 for (var i = 0; i < 5; i++) {
   assertTrue(y("foo"));
diff --git a/src/v8/test/mjsunit/regress/regress-110509.js b/src/v8/test/mjsunit/regress/regress-110509.js
index 132bd23..549bbd0 100644
--- a/src/v8/test/mjsunit/regress/regress-110509.js
+++ b/src/v8/test/mjsunit/regress/regress-110509.js
@@ -32,8 +32,8 @@
 function foo() {
   Math.random();
   new Function("");
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 foo();
 foo();
 foo();
diff --git a/src/v8/test/mjsunit/regress/regress-1106.js b/src/v8/test/mjsunit/regress/regress-1106.js
index e462d5d..f70c348 100644
--- a/src/v8/test/mjsunit/regress/regress-1106.js
+++ b/src/v8/test/mjsunit/regress/regress-1106.js
@@ -37,19 +37,25 @@
 delete x.foo;
 x.foo = 5;
 
-function f() { return foo; }
-
-for (i=0 ; i < 5; ++i) {
+function f() {
+  return foo;
+};
+%PrepareFunctionForOptimization(f);
+for (i = 0; i < 5; ++i) {
   assertEquals(5, f());
 }
 %OptimizeFunctionOnNextCall(f);
 assertEquals(5, f());
 
 // Test calls on functions defined in the prototype of the global object.
-x.gee = function() { return 42; }
-function g() { return gee(); }
-
-for (i=0 ; i < 5; ++i) {
+x.gee = function() {
+  return 42;
+};
+function g() {
+  return gee();
+};
+%PrepareFunctionForOptimization(g);
+for (i = 0; i < 5; ++i) {
   assertEquals(42, g());
 }
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/regress/regress-1117.js b/src/v8/test/mjsunit/regress/regress-1117.js
index 664dadd..808e596 100644
--- a/src/v8/test/mjsunit/regress/regress-1117.js
+++ b/src/v8/test/mjsunit/regress/regress-1117.js
@@ -30,14 +30,20 @@
 // Test that we actually return the right value (-0) when we multiply
 // constant 0 with a negative integer.
 
-function foo(y) {return 0 * y; }
-assertEquals(1/foo(-42), -Infinity);
-assertEquals(1/foo(-42), -Infinity);
+function foo(y) {
+  return 0 * y;
+};
+%PrepareFunctionForOptimization(foo);
+assertEquals(1 / foo(-42), -Infinity);
+assertEquals(1 / foo(-42), -Infinity);
 %OptimizeFunctionOnNextCall(foo);
-assertEquals(1/foo(-42), -Infinity);
+assertEquals(1 / foo(-42), -Infinity);
 
-function bar(x) { return x * 0; }
-assertEquals(Infinity, 1/bar(5));
-assertEquals(Infinity, 1/bar(5));
+function bar(x) {
+  return x * 0;
+};
+%PrepareFunctionForOptimization(bar);
+assertEquals(Infinity, 1 / bar(5));
+assertEquals(Infinity, 1 / bar(5));
 %OptimizeFunctionOnNextCall(bar);
-assertEquals(-Infinity, 1/bar(-5));
+assertEquals(-Infinity, 1 / bar(-5));
diff --git a/src/v8/test/mjsunit/regress/regress-1118.js b/src/v8/test/mjsunit/regress/regress-1118.js
index 05b192d..9143b6d 100644
--- a/src/v8/test/mjsunit/regress/regress-1118.js
+++ b/src/v8/test/mjsunit/regress/regress-1118.js
@@ -31,21 +31,28 @@
 // should be able to construct a receiver from all optimized stack frames.
 
 function A() { }
+%EnsureFeedbackVectorForFunction(A);
 A.prototype.f = function() { }
 
 function B() { }
+%EnsureFeedbackVectorForFunction(B);
 
 var o = new A();
 
 // This function throws if o does not have an f property, and should not be
 // inlined.
 function g() { try { return o.f(); } finally { }}
+%EnsureFeedbackVectorForFunction(g);
 
 // This function should be optimized via OSR.
 function h() {
-  for (var i = 0; i < 10; i++) %OptimizeOsr();
+  for (var i = 0; i < 10; i++) {
+    %OptimizeOsr();
+    %PrepareFunctionForOptimization(h);
+  }
   g();
 }
+%PrepareFunctionForOptimization(h);
 
 h();
 o = new B();
diff --git a/src/v8/test/mjsunit/regress/regress-115100.js b/src/v8/test/mjsunit/regress/regress-115100.js
index c917446..6740a55 100644
--- a/src/v8/test/mjsunit/regress/regress-115100.js
+++ b/src/v8/test/mjsunit/regress/regress-115100.js
@@ -27,8 +27,13 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(obj) { obj.prop = 0; }
-function mk() { return Object.create(null); }
+function foo(obj) {
+  obj.prop = 0;
+};
+%PrepareFunctionForOptimization(foo);
+function mk() {
+  return Object.create(null);
+}
 
 foo(mk());
 foo(mk());
diff --git a/src/v8/test/mjsunit/regress/regress-1166.js b/src/v8/test/mjsunit/regress/regress-1166.js
index 8278aba..ca3f830 100644
--- a/src/v8/test/mjsunit/regress/regress-1166.js
+++ b/src/v8/test/mjsunit/regress/regress-1166.js
@@ -29,10 +29,14 @@
 
 // Deoptimization after a short-circuit logical operation in an effect
 // context should not see the value of the expression.
-function observe(x, y) { return x; }
+function observe(x, y) {
+  return x;
+}
 
-function test(x) { return observe(1, ((false || false), x + 1)); }
-
+function test(x) {
+  return observe(1, (false || false, x + 1));
+};
+%PrepareFunctionForOptimization(test);
 for (var i = 0; i < 5; ++i) test(0);
 %OptimizeFunctionOnNextCall(test);
 test(0);
diff --git a/src/v8/test/mjsunit/regress/regress-1167.js b/src/v8/test/mjsunit/regress/regress-1167.js
index 2206f3d..a79b998 100644
--- a/src/v8/test/mjsunit/regress/regress-1167.js
+++ b/src/v8/test/mjsunit/regress/regress-1167.js
@@ -33,7 +33,7 @@
   var a = new Array(n);
   for (var i = 0; i < n; ++i) {
     // ~ of a non-numeric value is used to trigger deoptimization.
-    a[i] = void(!(delete 'object')) % ~(delete 4);
+    a[i] = void !delete 'object' % ~delete 4;
   }
 }
 
@@ -49,7 +49,7 @@
 function test1(n) {
   var a = new Array(n);
   for (var i = 0; i < n; ++i) {
-    a[i] = void(!(- 'object')) % ~(delete 4);
+    a[i] = void !-'object' % ~delete 4;
   }
 }
 
@@ -62,14 +62,15 @@
 
 // A similar issue, different subexpression of unary ! (e0 !== e1 is
 // translated into !(e0 == e1)) and different effect context.
-function side_effect() { }
-function observe(x, y) { return x; }
-function test2(x) {
-  return observe(this,
-                 (((side_effect.observe <= side_effect.side_effect) !== false),
-                  x + 1));
+function side_effect() {}
+function observe(x, y) {
+  return x;
 }
-
+function test2(x) {
+  return observe(
+      this, (side_effect.observe <= side_effect.side_effect !== false, x + 1));
+};
+%PrepareFunctionForOptimization(test2);
 for (var i = 0; i < 5; ++i) test2(0);
 %OptimizeFunctionOnNextCall(test2);
 test2(0);
diff --git a/src/v8/test/mjsunit/regress/regress-1199637.js b/src/v8/test/mjsunit/regress/regress-1199637.js
index ae7c5e0..763484d 100644
--- a/src/v8/test/mjsunit/regress/regress-1199637.js
+++ b/src/v8/test/mjsunit/regress/regress-1199637.js
@@ -32,44 +32,53 @@
 var NONE = 0;
 var READ_ONLY = 1;
 
+function AddNamedProperty(object, name, value, attrs) {
+  Object.defineProperty(object, name, {
+      value,
+      configurable: true,
+      enumerable: true,
+      writable: (attrs & READ_ONLY) === 0
+  });
+}
+
 // Use DeclareGlobal...
-%AddNamedProperty(this.__proto__, "a", 1234, NONE);
+AddNamedProperty(this.__proto__, "a", 1234, NONE);
 assertEquals(1234, a);
 eval("var a = 5678;");
 assertEquals(5678, a);
 
-%AddNamedProperty(this.__proto__, "b", 1234, NONE);
+AddNamedProperty(this.__proto__, "b", 1234, NONE);
 assertEquals(1234, b);
 eval("var b = 5678;");
 assertEquals(5678, b);
 
-%AddNamedProperty(this.__proto__, "c", 1234, READ_ONLY);
+AddNamedProperty(this.__proto__, "c", 1234, READ_ONLY);
 assertEquals(1234, c);
 eval("var c = 5678;");
 assertEquals(5678, c);
 
-%AddNamedProperty(this.__proto__, "d", 1234, READ_ONLY);
+AddNamedProperty(this.__proto__, "d", 1234, READ_ONLY);
 assertEquals(1234, d);
 eval("var d = 5678;");
 assertEquals(5678, d);
 
 // Use DeclareContextSlot...
-%AddNamedProperty(this.__proto__, "x", 1234, NONE);
+AddNamedProperty(this.__proto__, "x", 1234, NONE);
 assertEquals(1234, x);
 eval("with({}) { var x = 5678; }");
 assertEquals(5678, x);
 
-%AddNamedProperty(this.__proto__, "y", 1234, NONE);
+AddNamedProperty(this.__proto__, "y", 1234, NONE);
 assertEquals(1234, y);
 eval("with({}) { var y = 5678; }");
 assertEquals(5678, y);
 
-%AddNamedProperty(this.__proto__, "z", 1234, READ_ONLY);
+AddNamedProperty(this.__proto__, "z", 1234, READ_ONLY);
 assertEquals(1234, z);
 eval("with({}) { var z = 5678; }");
 assertEquals(5678, z);
 
-%AddNamedProperty(this.__proto__, "w", 1234, READ_ONLY);
+AddNamedProperty(this.__proto__, "w", 1234, READ_ONLY);
 assertEquals(1234, w);
 eval("with({}) { var w = 5678; }");
 assertEquals(5678, w);
diff --git a/src/v8/test/mjsunit/regress/regress-1210.js b/src/v8/test/mjsunit/regress/regress-1210.js
index 43500e7..ff5b5bc 100644
--- a/src/v8/test/mjsunit/regress/regress-1210.js
+++ b/src/v8/test/mjsunit/regress/regress-1210.js
@@ -32,18 +32,24 @@
 
 var a = 0;
 
-function observe(x, y) { return x; }
+function observe(x, y) {
+  return x;
+}
 
-function side_effect(x) { a = x; }
+function side_effect(x) {
+  a = x;
+}
 
 function test() {
   // We will trigger deoptimization of 'a + 0' which should bail out to
   // immediately after the call to 'side_effect' (i.e., still in the key
   // subexpression of the arguments access).
-  return observe(a, arguments[side_effect(a), a + 0]);
+  return observe(a, arguments[(side_effect(a), a + 0)]);
 }
 
 // Run enough to optimize assuming global 'a' is a smi.
+;
+%PrepareFunctionForOptimization(test);
 for (var i = 0; i < 10; ++i) test(0);
 %OptimizeFunctionOnNextCall(test);
 test(0);
diff --git a/src/v8/test/mjsunit/regress/regress-123512.js b/src/v8/test/mjsunit/regress/regress-123512.js
index 8a747bc..2ff3c51 100644
--- a/src/v8/test/mjsunit/regress/regress-123512.js
+++ b/src/v8/test/mjsunit/regress/regress-123512.js
@@ -33,7 +33,8 @@
 
 function f(x) {
   return [x][0];
-}
+};
+%PrepareFunctionForOptimization(f);
 
 // Test data element on prototype.
 Object.prototype[0] = 23;
@@ -47,6 +48,7 @@
 Object.prototype.__defineGetter__(0, function() { throw Error(); });
 assertSame(4, f(4));
 assertSame(5, f(5));
+%PrepareFunctionForOptimization(f);
 %OptimizeFunctionOnNextCall(f);
 assertSame(6, f(6));
 %DeoptimizeFunction(f);
@@ -57,7 +59,8 @@
 function g(x, y) {
   var o = { foo:x, 0:y };
   return o.foo + o[0];
-}
+};
+%PrepareFunctionForOptimization(g);
 
 // Test data property and element on prototype.
 Object.prototype[0] = 23;
@@ -73,6 +76,7 @@
 Object.prototype.__defineGetter__('foo', function() { throw Error(); });
 assertSame(3, g(1, 2));
 assertSame(5, g(2, 3));
+%PrepareFunctionForOptimization(g);
 %OptimizeFunctionOnNextCall(g);
 assertSame(7, g(3, 4));
 %DeoptimizeFunction(g);
diff --git a/src/v8/test/mjsunit/regress/regress-1237.js b/src/v8/test/mjsunit/regress/regress-1237.js
index 111df80..a0865c5 100644
--- a/src/v8/test/mjsunit/regress/regress-1237.js
+++ b/src/v8/test/mjsunit/regress/regress-1237.js
@@ -29,11 +29,13 @@
 
 // Deoptimization after a conditional expression in an effect context should
 // not see the value of the expression.
-function observe(x, y) { return x; }
-function test(x) {
-  return observe(1, ((x? observe(observe.prototype.x): 'c'), x + 1));
+function observe(x, y) {
+  return x;
 }
-
+function test(x) {
+  return observe(1, (x ? observe(observe.prototype.x) : 'c', x + 1));
+};
+%PrepareFunctionForOptimization(test);
 for (var i = 0; i < 5; ++i) test(0);
 %OptimizeFunctionOnNextCall(test);
 test(0);
diff --git a/src/v8/test/mjsunit/regress/regress-123919.js b/src/v8/test/mjsunit/regress/regress-123919.js
index be34608..0eddf24 100644
--- a/src/v8/test/mjsunit/regress/regress-123919.js
+++ b/src/v8/test/mjsunit/regress/regress-123919.js
@@ -27,20 +27,20 @@
 
 // Flags: --allow-natives-syntax --gc-global
 
-function g(max,val) {
+function g(max, val) {
   this.x = 0;
   for (var i = 0; i < max; i++) {
-    this.x = i/100;
+    this.x = i / 100;
   }
   this.val = val;
 }
 
 function f(max) {
   var val = 0.5;
-  var obj = new g(max,val);
+  var obj = new g(max, val);
   assertSame(val, obj.val);
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f(1);
 f(1);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-124594.js b/src/v8/test/mjsunit/regress/regress-124594.js
index d51e1f6..c17dfde 100644
--- a/src/v8/test/mjsunit/regress/regress-124594.js
+++ b/src/v8/test/mjsunit/regress/regress-124594.js
@@ -42,9 +42,9 @@
 
 function g(deopt) {
   return new f(deopt);
-}
-
-assertEquals({x:1}, g(false));
-assertEquals({x:1}, g(false));
+};
+%PrepareFunctionForOptimization(g);
+assertEquals({x: 1}, g(false));
+assertEquals({x: 1}, g(false));
 %OptimizeFunctionOnNextCall(g);
-assertEquals({x:"1foo"}, g(true));
+assertEquals({x: '1foo'}, g(true));
diff --git a/src/v8/test/mjsunit/regress/regress-1257.js b/src/v8/test/mjsunit/regress/regress-1257.js
index c5ed14d..4ea42c9 100644
--- a/src/v8/test/mjsunit/regress/regress-1257.js
+++ b/src/v8/test/mjsunit/regress/regress-1257.js
@@ -31,4 +31,5 @@
     };
 }
 
+%PrepareFunctionForOptimization(foo);
 foo();
diff --git a/src/v8/test/mjsunit/regress/regress-1323.js b/src/v8/test/mjsunit/regress/regress-1323.js
index 552a48d..d5d9554 100644
--- a/src/v8/test/mjsunit/regress/regress-1323.js
+++ b/src/v8/test/mjsunit/regress/regress-1323.js
@@ -30,8 +30,8 @@
 // Regression test for load/store operating with wrong number of bits.
 function get(a, index) {
   return a[index];
-}
-
+};
+%PrepareFunctionForOptimization(get);
 var a = new Float32Array(2);
 a[0] = 2.5;
 a[1] = 3.5;
@@ -42,7 +42,8 @@
 
 function set(a, index, value) {
   a[index] = value;
-}
+};
+%PrepareFunctionForOptimization(set);
 for (var i = 0; i < 5; i++) set(a, 0, 4.5);
 %OptimizeFunctionOnNextCall(set);
 set(a, 0, 4.5);
diff --git a/src/v8/test/mjsunit/regress/regress-1337.js b/src/v8/test/mjsunit/regress/regress-1337.js
index ebcf84b..c284c3f 100644
--- a/src/v8/test/mjsunit/regress/regress-1337.js
+++ b/src/v8/test/mjsunit/regress/regress-1337.js
@@ -29,12 +29,22 @@
 
 // Test that the throw is not inlined if object literals cannot be
 // inlined.
-function bar() { throw {}; }
-
-function foo() { bar(); }
-
-for (var i = 0; i < 5; ++i) {
-    try { foo() } catch (e) { }
+function bar() {
+  throw {};
 }
-%OptimizeFunctionOnNextCall(foo)
-try { foo() } catch (e) { }
+
+function foo() {
+  bar();
+};
+%PrepareFunctionForOptimization(foo);
+for (var i = 0; i < 5; ++i) {
+  try {
+    foo();
+  } catch (e) {
+  }
+}
+%OptimizeFunctionOnNextCall(foo);
+try {
+  foo();
+} catch (e) {
+}
diff --git a/src/v8/test/mjsunit/regress/regress-1351.js b/src/v8/test/mjsunit/regress/regress-1351.js
index 656b19f..359c216 100644
--- a/src/v8/test/mjsunit/regress/regress-1351.js
+++ b/src/v8/test/mjsunit/regress/regress-1351.js
@@ -30,13 +30,13 @@
 // Test that the arguments value is does not escape when it appears as
 // an intermediate value in an expression.
 
-function h() { }
+function h() {}
 
 function f() {
   var a = null;
   h(a = arguments);
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f();
 %OptimizeFunctionOnNextCall(f);
 f();
diff --git a/src/v8/test/mjsunit/regress/regress-137768.js b/src/v8/test/mjsunit/regress/regress-137768.js
index 9fbd7f3..894bc82 100644
--- a/src/v8/test/mjsunit/regress/regress-137768.js
+++ b/src/v8/test/mjsunit/regress/regress-137768.js
@@ -34,7 +34,7 @@
   this[2] = 3;
 }
 
-function bad_func(o,a) {
+function bad_func(o, a) {
   var s = 0;
   for (var i = 0; i < 1; ++i) {
     o.newFileToChangeMap = undefined;
@@ -42,8 +42,8 @@
     s += x;
   }
   return s;
-}
-
+};
+%PrepareFunctionForOptimization(bad_func);
 o = new Object();
 a = new TestConstructor();
 bad_func(o, a);
diff --git a/src/v8/test/mjsunit/regress/regress-1412.js b/src/v8/test/mjsunit/regress/regress-1412.js
index b043f19..48bb163 100644
--- a/src/v8/test/mjsunit/regress/regress-1412.js
+++ b/src/v8/test/mjsunit/regress/regress-1412.js
@@ -30,22 +30,25 @@
 
 // Flags: --allow-natives-syntax
 
-function strict() { "use strict"; return this; }
+function strict() {
+  'use strict';
+  return this;
+}
 
 function test_strict() {
   assertEquals(void 0, strict.apply(undefined, arguments));
   assertEquals(42, strict.apply(42, arguments));
   assertEquals("asdf", strict.apply("asdf", arguments));
-}
-
+};
+%PrepareFunctionForOptimization(test_strict);
 for (var i = 0; i < 10; i++) test_strict();
 %OptimizeFunctionOnNextCall(test_strict);
 test_strict();
 
 function test_builtin(receiver) {
   Object.prototype.valueOf.apply(receiver, arguments);
-}
-
+};
+%PrepareFunctionForOptimization(test_builtin);
 for (var i = 0; i < 10; i++) test_builtin(this);
 %OptimizeFunctionOnNextCall(test_builtin);
 test_builtin(this);
@@ -53,7 +56,7 @@
 var exception = false;
 try {
   test_builtin(undefined);
-} catch(e) {
+} catch (e) {
   exception = true;
 }
 assertTrue(exception);
diff --git a/src/v8/test/mjsunit/regress/regress-1423.js b/src/v8/test/mjsunit/regress/regress-1423.js
index b0d0ca3..45726a1 100644
--- a/src/v8/test/mjsunit/regress/regress-1423.js
+++ b/src/v8/test/mjsunit/regress/regress-1423.js
@@ -32,8 +32,8 @@
 
 function f0() {
   return f1('literal', true);
-}
-
+};
+%PrepareFunctionForOptimization(f0);
 function f1(x, y) {
   return f2(x, y);
 }
diff --git a/src/v8/test/mjsunit/regress/regress-1434.js b/src/v8/test/mjsunit/regress/regress-1434.js
index 6f197af..5766abb 100644
--- a/src/v8/test/mjsunit/regress/regress-1434.js
+++ b/src/v8/test/mjsunit/regress/regress-1434.js
@@ -29,8 +29,8 @@
 
 function compare(a, b) {
   return a === b;
-}
-
+};
+%PrepareFunctionForOptimization(compare);
 compare(1.5, 2.5);
 %OptimizeFunctionOnNextCall(compare);
 assertTrue(compare(undefined, undefined));
diff --git a/src/v8/test/mjsunit/regress/regress-1476.js b/src/v8/test/mjsunit/regress/regress-1476.js
index 1277e7f..43e9a8d 100644
--- a/src/v8/test/mjsunit/regress/regress-1476.js
+++ b/src/v8/test/mjsunit/regress/regress-1476.js
@@ -27,9 +27,11 @@
 
 // Flags: --allow-natives-syntax
 
-function foo (i) { return (i % 2) | 0; }
-
-assertEquals (-1, foo(-1));
-assertEquals (-1, foo(-1));
+function foo(i) {
+  return i % 2 | 0;
+};
+%PrepareFunctionForOptimization(foo);
+assertEquals(-1, foo(-1));
+assertEquals(-1, foo(-1));
 %OptimizeFunctionOnNextCall(foo);
-assertEquals (-1, foo(-1));
+assertEquals(-1, foo(-1));
diff --git a/src/v8/test/mjsunit/regress/regress-1521.js b/src/v8/test/mjsunit/regress/regress-1521.js
index 3149f05..a2aed5e 100644
--- a/src/v8/test/mjsunit/regress/regress-1521.js
+++ b/src/v8/test/mjsunit/regress/regress-1521.js
@@ -33,14 +33,16 @@
     throw new Error();
   } catch (e) {
     var y = {f: 1};
-    var f = function () {
+    var f = function() {
       var z = y;
-      var g = function () {
+      var g = function() {
         if (y.f === z.f) return x;
       };
+      ;
+      %PrepareFunctionForOptimization(g);
       %OptimizeFunctionOnNextCall(g);
       return g;
-    }
+    };
     assertEquals(3, f()());
   }
 }
diff --git a/src/v8/test/mjsunit/regress/regress-1560.js b/src/v8/test/mjsunit/regress/regress-1560.js
index a0aa7e6..98bbef1 100644
--- a/src/v8/test/mjsunit/regress/regress-1560.js
+++ b/src/v8/test/mjsunit/regress/regress-1560.js
@@ -47,11 +47,13 @@
 }
 
 function write(a, i) { a[i] = "bazinga!"; }
+%PrepareFunctionForOptimization(write);
 
 function test(factories, w) {
+  %PrepareFunctionForOptimization(w);
   factories.forEach(function(f) { w(f(), 0); });
   factories.forEach(function(f) { w(f(), 0); });
-      %OptimizeFunctionOnNextCall(w);
+  %OptimizeFunctionOnNextCall(w);
   factories.forEach(function(f) { w(f(), 0); });
 }
 
diff --git a/src/v8/test/mjsunit/regress/regress-1563.js b/src/v8/test/mjsunit/regress/regress-1563.js
index 884b125..de2c636 100644
--- a/src/v8/test/mjsunit/regress/regress-1563.js
+++ b/src/v8/test/mjsunit/regress/regress-1563.js
@@ -33,8 +33,8 @@
 // assignments.
 function set_pixel(obj, arg) {
   obj[0] = arg;
-}
-
+};
+%PrepareFunctionForOptimization(set_pixel);
 set_pixel(obj, 1.5);
 set_pixel(obj, NaN);
 %OptimizeFunctionOnNextCall(set_pixel);
diff --git a/src/v8/test/mjsunit/regress/regress-1582.js b/src/v8/test/mjsunit/regress/regress-1582.js
index 346d68a..ca3f7b4 100644
--- a/src/v8/test/mjsunit/regress/regress-1582.js
+++ b/src/v8/test/mjsunit/regress/regress-1582.js
@@ -39,7 +39,9 @@
   var arrIsArguments = (arr[1] !== rest);
   assertEquals(restIsArray, arrIsArguments);
 }
+%PrepareFunctionForOptimization(f);
 
+%PrepareFunctionForOptimization(f);
 f(false, 'b', 'c');
 f(false, 'b', 'c');
 f(false, 'b', 'c');
diff --git a/src/v8/test/mjsunit/regress/regress-1583.js b/src/v8/test/mjsunit/regress/regress-1583.js
index c4a344c..6e7afdc 100644
--- a/src/v8/test/mjsunit/regress/regress-1583.js
+++ b/src/v8/test/mjsunit/regress/regress-1583.js
@@ -43,6 +43,7 @@
 }
 
 var o = f();
+%PrepareFunctionForOptimization(o.m);
 assertEquals('hest', o.m());
 assertEquals('hest', o.m());
 assertEquals('hest', o.m());
diff --git a/src/v8/test/mjsunit/regress/regress-1592.js b/src/v8/test/mjsunit/regress/regress-1592.js
index 8f6fba0..eff8c1b 100644
--- a/src/v8/test/mjsunit/regress/regress-1592.js
+++ b/src/v8/test/mjsunit/regress/regress-1592.js
@@ -27,15 +27,15 @@
 
 // Flags: --allow-natives-syntax
 
-var f = {
-  apply: function(a, b) {}
-};
+var f = {apply: function(a, b) {}};
 
 function test(a) {
   f.apply(this, arguments);
 }
 
 // Initialize ICs.
+;
+%PrepareFunctionForOptimization(test);
 test(1);
 test(1);
 
diff --git a/src/v8/test/mjsunit/regress/regress-164442.js b/src/v8/test/mjsunit/regress/regress-164442.js
index 1160d87..e2acd2e 100644
--- a/src/v8/test/mjsunit/regress/regress-164442.js
+++ b/src/v8/test/mjsunit/regress/regress-164442.js
@@ -32,8 +32,8 @@
 
 function ensureNotNegative(x) {
   return Math.max(0, x | 0);
-}
-
+};
+%PrepareFunctionForOptimization(ensureNotNegative);
 
 ensureNotNegative(1);
 ensureNotNegative(2);
diff --git a/src/v8/test/mjsunit/regress/regress-1647.js b/src/v8/test/mjsunit/regress/regress-1647.js
index ab6608c..51623e7 100644
--- a/src/v8/test/mjsunit/regress/regress-1647.js
+++ b/src/v8/test/mjsunit/regress/regress-1647.js
@@ -29,13 +29,14 @@
 
 // Test for correct deoptimization in named function expressions.
 
-var t = { foo: function() {} };
+var t = {foo: function() {}};
 
-var f = (function bar() {
- t.foo();
- assertEquals("function", typeof bar);
-});
-
+var f = function bar() {
+  t.foo();
+  assertEquals('function', typeof bar);
+};
+;
+%PrepareFunctionForOptimization(f);
 for (var i = 0; i < 10; i++) f();
 %OptimizeFunctionOnNextCall(f);
 t.number = 2;
diff --git a/src/v8/test/mjsunit/regress/regress-1650.js b/src/v8/test/mjsunit/regress/regress-1650.js
index fb6a178..e9ea57a 100644
--- a/src/v8/test/mjsunit/regress/regress-1650.js
+++ b/src/v8/test/mjsunit/regress/regress-1650.js
@@ -27,11 +27,13 @@
 
 // Flags: --allow-natives-syntax
 
-function g(f) { return f.call.apply(f.bind, arguments); }
+function g(f) {
+  return f.call.apply(f.bind, arguments);
+};
+%PrepareFunctionForOptimization(g);
+var x = new Object();
 
-var x = new Object;
-
-function t() { }
+function t() {}
 
 g(t, x);
 g(t, x);
@@ -53,7 +55,7 @@
 Fake.prototype.bind = function () {
 };
 
-var fake = new Fake;
+var fake = new Fake();
 
 g(fake, x);
 
diff --git a/src/v8/test/mjsunit/regress/regress-165637.js b/src/v8/test/mjsunit/regress/regress-165637.js
index 6e28726..2a7fc44 100644
--- a/src/v8/test/mjsunit/regress/regress-165637.js
+++ b/src/v8/test/mjsunit/regress/regress-165637.js
@@ -1,53 +1,6 @@
 // Copyright 2012 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Flags: --allow-natives-syntax
-
-// Should not take a very long time (n^2 algorithms are bad)
-
-function do_slices() {
-  var data = new Array(1024 * 12); // 12kB
-
-  for (var i = 0; i < data.length; i++) {
-    data[i] = 255;
-  }
-
-  var start = Date.now();
-
-  for (i = 0; i < 20000; i++) {
-    data.slice(4, 1);
-  }
-
-  return Date.now() - start;
-}
-
-// Should never take more than 3 seconds (if the bug is fixed, the test takes
-// considerably less time than 3 seconds).
-assertTrue(do_slices() < (3 * 1000));
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
 
 // Make sure that packed and unpacked array slices are still properly handled
 var holey_array = [1, 2, 3, 4, 5,,,,,,];
diff --git a/src/v8/test/mjsunit/regress/regress-166379.js b/src/v8/test/mjsunit/regress/regress-166379.js
index 2cda611..2c68f32 100644
--- a/src/v8/test/mjsunit/regress/regress-166379.js
+++ b/src/v8/test/mjsunit/regress/regress-166379.js
@@ -27,12 +27,16 @@
 
 // Flags: --allow-natives-syntax
 
-function mod(a, b) { return a % b; }
+function mod(a, b) {
+  return a % b;
+}
 
 // Feed integer type info and optimize.
+;
+%PrepareFunctionForOptimization(mod);
 assertEquals(0, mod(4, 2));
 assertEquals(1, mod(3, 2));
 %OptimizeFunctionOnNextCall(mod);
 
 // Surprise mod with overflow.
-assertEquals(-Infinity, 1/mod(-2147483648, -1));
+assertEquals(-Infinity, 1 / mod(-2147483648, -1));
diff --git a/src/v8/test/mjsunit/regress/regress-171641.js b/src/v8/test/mjsunit/regress/regress-171641.js
index 8db6781..d8caec6 100644
--- a/src/v8/test/mjsunit/regress/regress-171641.js
+++ b/src/v8/test/mjsunit/regress/regress-171641.js
@@ -32,8 +32,8 @@
     p = Math.min(p, i);
   }
   m = Math.floor((k | 0) / p);
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 foo(0, 1);
 foo(0, 1);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-1898.js b/src/v8/test/mjsunit/regress/regress-1898.js
index 5440446..ef47abf 100644
--- a/src/v8/test/mjsunit/regress/regress-1898.js
+++ b/src/v8/test/mjsunit/regress/regress-1898.js
@@ -29,8 +29,8 @@
 
 function f(x) {
   Math.log(Math.min(0.1, Math.abs(x)));
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f(0.1);
 f(0.1);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-201590.js b/src/v8/test/mjsunit/regress/regress-201590.js
index 0e7ba57..18bc8c3 100644
--- a/src/v8/test/mjsunit/regress/regress-201590.js
+++ b/src/v8/test/mjsunit/regress/regress-201590.js
@@ -60,6 +60,7 @@
   assertEquals(288, b.y);
 }
 
+%PrepareFunctionForOptimization(Foo.prototype.bar);
 baz();
 baz();
 %OptimizeFunctionOnNextCall(Foo.prototype.bar);
diff --git a/src/v8/test/mjsunit/regress/regress-2030.js b/src/v8/test/mjsunit/regress/regress-2030.js
index fb5a3d0..adbfc74 100644
--- a/src/v8/test/mjsunit/regress/regress-2030.js
+++ b/src/v8/test/mjsunit/regress/regress-2030.js
@@ -42,8 +42,8 @@
 
 function f(o) {
   return o.x;
-}
-
+};
+%PrepareFunctionForOptimization(f);
 assertSame(1, f(aa));
 assertSame(1, f(aa));
 assertSame(2, f(bb));
diff --git a/src/v8/test/mjsunit/regress/regress-2045.js b/src/v8/test/mjsunit/regress/regress-2045.js
index 822ee1f..9cc7a4c 100644
--- a/src/v8/test/mjsunit/regress/regress-2045.js
+++ b/src/v8/test/mjsunit/regress/regress-2045.js
@@ -38,9 +38,11 @@
 
 function baz() {
   return bar(1, 2);
-}
-
-G = {x: 0};
+};
+%PrepareFunctionForOptimization(baz);
+G = {
+  x: 0
+};
 baz();
 baz();
 %OptimizeFunctionOnNextCall(baz);
diff --git a/src/v8/test/mjsunit/regress/regress-2056.js b/src/v8/test/mjsunit/regress/regress-2056.js
index d34a750..6ac350f 100644
--- a/src/v8/test/mjsunit/regress/regress-2056.js
+++ b/src/v8/test/mjsunit/regress/regress-2056.js
@@ -28,39 +28,37 @@
 // Flags: --allow-natives-syntax
 
 var cases = [
-    [0.0, 0.0, 0.0, 0,0],
-    [undefined, 0.0, NaN, NaN],
-    [0.0, undefined, NaN, NaN],
-    [NaN, 0.0, NaN, NaN],
-    [0.0, NaN, NaN, NaN],
-    [-NaN, 0.0, NaN, NaN],
-    [0.0, -NaN, NaN, NaN],
-    [Infinity, 0.0, Infinity, 0.0],
-    [0.0, Infinity, Infinity, 0.0],
-    [-Infinity, 0.0, 0.0, -Infinity],
-    [0.0, -Infinity, 0.0, -Infinity]
+  [0.0, 0.0, 0.0, 0, 0], [undefined, 0.0, NaN, NaN], [0.0, undefined, NaN, NaN],
+  [NaN, 0.0, NaN, NaN], [0.0, NaN, NaN, NaN], [-NaN, 0.0, NaN, NaN],
+  [0.0, -NaN, NaN, NaN], [Infinity, 0.0, Infinity, 0.0],
+  [0.0, Infinity, Infinity, 0.0], [-Infinity, 0.0, 0.0, -Infinity],
+  [0.0, -Infinity, 0.0, -Infinity]
 ];
 
 function do_min(a, b) {
-    return Math.min(a, b);
-}
-
+  return Math.min(a, b);
+};
+%PrepareFunctionForOptimization(do_min);
 function do_max(a, b) {
-    return Math.max(a, b);
+  return Math.max(a, b);
 }
 
 // Make sure that non-crankshaft results match expectations.
+;
+%PrepareFunctionForOptimization(do_max);
 for (i = 0; i < cases.length; ++i) {
-    var c = cases[i];
-    assertEquals(c[3], do_min(c[0], c[1]));
-    assertEquals(c[2], do_max(c[0], c[1]));
+  var c = cases[i];
+  assertEquals(c[3], do_min(c[0], c[1]));
+  assertEquals(c[2], do_max(c[0], c[1]));
 }
 
 // Make sure that crankshaft results match expectations.
 for (i = 0; i < cases.length; ++i) {
-    var c = cases[i];
-    %OptimizeFunctionOnNextCall(do_min);
-    %OptimizeFunctionOnNextCall(do_max);
-    assertEquals(c[3], do_min(c[0], c[1]));
-    assertEquals(c[2], do_max(c[0], c[1]));
+  var c = cases[i];
+  %OptimizeFunctionOnNextCall(do_min);
+  %OptimizeFunctionOnNextCall(do_max);
+  assertEquals(c[3], do_min(c[0], c[1]));
+  assertEquals(c[2], do_max(c[0], c[1]));
+  %PrepareFunctionForOptimization(do_min);
+  %PrepareFunctionForOptimization(do_max);
 }
diff --git a/src/v8/test/mjsunit/regress/regress-2110.js b/src/v8/test/mjsunit/regress/regress-2110.js
index d7f78d2..e905708 100644
--- a/src/v8/test/mjsunit/regress/regress-2110.js
+++ b/src/v8/test/mjsunit/regress/regress-2110.js
@@ -32,8 +32,8 @@
 function test() {
   uint8[0] = 0x800000aa;
   assertEquals(0xaa, uint8[0]);
-}
-
+};
+%PrepareFunctionForOptimization(test);
 test();
 test();
 test();
@@ -45,8 +45,8 @@
 function test2() {
   uint32[0] = 0x80123456789abcde;
   assertEquals(0x789ac000, uint32[0]);
-}
-
+};
+%PrepareFunctionForOptimization(test2);
 test2();
 test2();
 %OptimizeFunctionOnNextCall(test2);
diff --git a/src/v8/test/mjsunit/regress/regress-2132.js b/src/v8/test/mjsunit/regress/regress-2132.js
index c2f6c29..9df1c1b 100644
--- a/src/v8/test/mjsunit/regress/regress-2132.js
+++ b/src/v8/test/mjsunit/regress/regress-2132.js
@@ -31,6 +31,7 @@
   return (x * y) | 0;
 }
 
+%PrepareFunctionForOptimization(mul);
 mul(0, 0);
 mul(0, 0);
 %OptimizeFunctionOnNextCall(mul);
@@ -41,6 +42,7 @@
   return (x / y) | 0;
 }
 
+%PrepareFunctionForOptimization(div);
 div(4, 2);
 div(4, 2);
 %OptimizeFunctionOnNextCall(div);
diff --git a/src/v8/test/mjsunit/regress/regress-2170.js b/src/v8/test/mjsunit/regress/regress-2170.js
index 99f432d..faf4416 100644
--- a/src/v8/test/mjsunit/regress/regress-2170.js
+++ b/src/v8/test/mjsunit/regress/regress-2170.js
@@ -35,15 +35,15 @@
     for (var j = 0; j < a.length; j++) {
       x.push(a[j]);
     }
-    for(var j = 0; j < x.length; j++) {
+    for (var j = 0; j < x.length; j++) {
       if (typeof x[j] != 'number') {
         throw "foo";
       }
       x[j] = x[j];
     }
   }
-}
-
+};
+%PrepareFunctionForOptimization(array_fun);
 try {
   for (var i = 0; i < 10; ++i) {
     array_fun();
diff --git a/src/v8/test/mjsunit/regress/regress-2193.js b/src/v8/test/mjsunit/regress/regress-2193.js
index 4ec050e..068476b 100644
--- a/src/v8/test/mjsunit/regress/regress-2193.js
+++ b/src/v8/test/mjsunit/regress/regress-2193.js
@@ -40,12 +40,15 @@
 
 // Create two closures that share the same literal boilerplates.
 var closure1 = MakeClosure();
+%PrepareFunctionForOptimization(closure1);
 var closure2 = MakeClosure();
+%PrepareFunctionForOptimization(closure2);
 var expected = [1,2,3,3,4,5,6,7,8,9,bozo];
 
 // Make sure we generate optimized code for the first closure after
 // warming it up properly so that the literals boilerplate is generated
 // and the optimized code uses CreateArrayLiteralShallow runtime call.
+%PrepareFunctionForOptimization(closure1);
 assertEquals(0, closure1(false));
 assertEquals(expected, closure1(true));
 %OptimizeFunctionOnNextCall(closure1);
@@ -53,6 +56,7 @@
 
 // Optimize the second closure, which should reuse the optimized code
 // from the first closure with the same literal boilerplates.
+%PrepareFunctionForOptimization(closure2);
 assertEquals(0, closure2(false));
 %OptimizeFunctionOnNextCall(closure2);
 assertEquals(expected, closure2(true));
diff --git a/src/v8/test/mjsunit/regress/regress-2234.js b/src/v8/test/mjsunit/regress/regress-2234.js
index 8da513e..4e55c63 100644
--- a/src/v8/test/mjsunit/regress/regress-2234.js
+++ b/src/v8/test/mjsunit/regress/regress-2234.js
@@ -33,8 +33,8 @@
   // Check whether the first cache line has been accidentally overwritten
   // with incorrect key.
   assertEquals(0, Math.sin(0));
-}
-
+};
+%PrepareFunctionForOptimization(test);
 for (i = 0; i < 10000; ++i) {
   test(i);
   if (i == 0) %OptimizeFunctionOnNextCall(test);
diff --git a/src/v8/test/mjsunit/regress/regress-2250.js b/src/v8/test/mjsunit/regress/regress-2250.js
index e2ce546..a01606a 100644
--- a/src/v8/test/mjsunit/regress/regress-2250.js
+++ b/src/v8/test/mjsunit/regress/regress-2250.js
@@ -53,6 +53,7 @@
     ;
 }
 
+%PrepareFunctionForOptimization(test);
 eq({}, {});
 eq({}, {});
 eq(1, 1);
@@ -60,6 +61,7 @@
 test();
 %OptimizeFunctionOnNextCall(test);
 test();
+%PrepareFunctionForOptimization(test);
 %OptimizeFunctionOnNextCall(test);
 // Second compilation should have noticed that LICM wasn't a good idea, and now
 // function should no longer deopt when called.
diff --git a/src/v8/test/mjsunit/regress/regress-2261.js b/src/v8/test/mjsunit/regress/regress-2261.js
index 000e07d..c480a7c 100644
--- a/src/v8/test/mjsunit/regress/regress-2261.js
+++ b/src/v8/test/mjsunit/regress/regress-2261.js
@@ -40,8 +40,8 @@
     %DebugPrint(arguments[0]);
     forceDeopt + 1;
     return arguments[0];
-  }
-
+  };
+  %PrepareFunctionForOptimization(inner);
   assertEquals(1, inner(1));
   assertEquals(1, inner(1));
   %OptimizeFunctionOnNextCall(inner);
@@ -68,8 +68,8 @@
 
   function outer(x) {
     return inner(x);
-  }
-
+  };
+  %PrepareFunctionForOptimization(outer);
   assertEquals(1, outer(1));
   assertEquals(1, outer(1));
   %OptimizeFunctionOnNextCall(outer);
@@ -84,7 +84,7 @@
 
 (function () {
   var forceDeopt = 0;
-  function inner(x,y,z) {
+  function inner(x, y, z) {
     "use strict";
     x = 3;
     // Do not remove this %DebugPrint as it makes sure the deopt happens
@@ -97,13 +97,13 @@
   function middle(x) {
     "use strict";
     x = 2;
-    return inner(10*x, 20*x, 30*x) + arguments[0];
+    return inner(10 * x, 20 * x, 30 * x) + arguments[0];
   }
 
   function outer(x) {
-   return middle(x);
-  }
-
+    return middle(x);
+  };
+  %PrepareFunctionForOptimization(outer);
   assertEquals(21, outer(1));
   assertEquals(21, outer(1));
   %OptimizeFunctionOnNextCall(outer);
diff --git a/src/v8/test/mjsunit/regress/regress-2294.js b/src/v8/test/mjsunit/regress/regress-2294.js
index 43ba10d..6679d62 100644
--- a/src/v8/test/mjsunit/regress/regress-2294.js
+++ b/src/v8/test/mjsunit/regress/regress-2294.js
@@ -62,8 +62,8 @@
   assertEquals(255, clampedArray[0]);
   clampedArray[0] = -1000000000000;
   assertEquals(0, clampedArray[0]);
-}
-
+};
+%PrepareFunctionForOptimization(test);
 test();
 test();
 %OptimizeFunctionOnNextCall(test);
diff --git a/src/v8/test/mjsunit/regress/regress-2315.js b/src/v8/test/mjsunit/regress/regress-2315.js
index 9e40d0d..2ae4b4c 100644
--- a/src/v8/test/mjsunit/regress/regress-2315.js
+++ b/src/v8/test/mjsunit/regress/regress-2315.js
@@ -30,7 +30,9 @@
 var foo = (function() {
   return eval("(function bar() { return 1; })");
 })();
+%PrepareFunctionForOptimization(foo);
 
+%PrepareFunctionForOptimization(foo);
 foo();
 foo();
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-2339.js b/src/v8/test/mjsunit/regress/regress-2339.js
index d7d2bb3..abad9fd 100644
--- a/src/v8/test/mjsunit/regress/regress-2339.js
+++ b/src/v8/test/mjsunit/regress/regress-2339.js
@@ -35,8 +35,10 @@
   var always_five = always_undefined || 5;
   return always_zero * always_five * .5;
 }
+%EnsureFeedbackVectorForFunction(simple_two_args);
 
 
+%PrepareFunctionForOptimization(simple);
 simple();
 simple();
 %OptimizeFunctionOnNextCall(simple);
diff --git a/src/v8/test/mjsunit/regress/regress-234101.js b/src/v8/test/mjsunit/regress/regress-234101.js
index 74228df..1f2be03 100644
--- a/src/v8/test/mjsunit/regress/regress-234101.js
+++ b/src/v8/test/mjsunit/regress/regress-234101.js
@@ -33,9 +33,9 @@
 // either enhance the gap resolver or make sure that such moves don't happen.
 
 function foo(x) {
- return (x ? NaN : 0.2) + 0.1;
-}
-
+  return (x ? NaN : 0.2) + 0.1;
+};
+%PrepareFunctionForOptimization(foo);
 foo(false);
 foo(false);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-2451.js b/src/v8/test/mjsunit/regress/regress-2451.js
index 08efda2..0e63cfe 100644
--- a/src/v8/test/mjsunit/regress/regress-2451.js
+++ b/src/v8/test/mjsunit/regress/regress-2451.js
@@ -33,6 +33,7 @@
   assertEquals(-1.0, Math.round(-0.5000000000000001));
 }
 
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-247688.js b/src/v8/test/mjsunit/regress/regress-247688.js
index 80e2884..d00dba8 100644
--- a/src/v8/test/mjsunit/regress/regress-247688.js
+++ b/src/v8/test/mjsunit/regress/regress-247688.js
@@ -28,38 +28,38 @@
 // Flags: --allow-natives-syntax
 
 var a = {};
-a.x = 1
-a.y = 1.5
+a.x = 1;
+a.y = 1.5;
 
-var b = {}
+var b = {};
 b.x = 1.5;
 b.y = 1;
 
-var c = {}
+var c = {};
 c.x = 1.5;
 
-var d = {}
+var d = {};
 d.x = 1.5;
 
-var e = {}
+var e = {};
 e.x = 1.5;
 
-var f = {}
+var f = {};
 f.x = 1.5;
 
-var g = {}
+var g = {};
 g.x = 1.5;
 
-var h = {}
+var h = {};
 h.x = 1.5;
 
-var i = {}
+var i = {};
 i.x = 1.5;
 
-var o = {}
-var p = {y : 10, z : 1}
+var o = {};
+var p = {y: 10, z: 1};
 o.__proto__ = p;
-delete p.z
+delete p.z;
 
 function foo(v, w) {
   // Make load via IC in optimized code. Its target will get overwritten by
@@ -68,8 +68,8 @@
   // Make store with transition to make this code dependent on the map.
   w.y = 1;
   return b.y;
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 foo(o, c);
 foo(o, d);
 foo(o, e);
diff --git a/src/v8/test/mjsunit/regress/regress-2489.js b/src/v8/test/mjsunit/regress/regress-2489.js
index 882c4f7..1feeb30 100644
--- a/src/v8/test/mjsunit/regress/regress-2489.js
+++ b/src/v8/test/mjsunit/regress/regress-2489.js
@@ -31,8 +31,8 @@
 
 function f(a, b) {
   return g("c", "d");
-}
-
+};
+%PrepareFunctionForOptimization(f);
 function g(a, b) {
   g.constructor.apply(this, arguments);
 }
@@ -40,7 +40,7 @@
 g.constructor = function(a, b) {
   assertEquals("c", a);
   assertEquals("d", b);
-}
+};
 
 f("a", "b");
 f("a", "b");
diff --git a/src/v8/test/mjsunit/regress/regress-2499.js b/src/v8/test/mjsunit/regress/regress-2499.js
index 52aad87..7fc87fc 100644
--- a/src/v8/test/mjsunit/regress/regress-2499.js
+++ b/src/v8/test/mjsunit/regress/regress-2499.js
@@ -28,13 +28,13 @@
 // Flags: --allow-natives-syntax
 
 function foo(word, nBits) {
-  return (word[1] >>> nBits) | (word[0] << (32 - nBits));
-}
-
+  return word[1] >>> nBits | word[0] << 32 - nBits;
+};
+%PrepareFunctionForOptimization(foo);
 word = [0x1001, 0];
 
 var expected = foo(word, 1);
 foo(word, 1);
 %OptimizeFunctionOnNextCall(foo);
 var optimized = foo(word, 1);
-assertEquals(expected, optimized)
+assertEquals(expected, optimized);
diff --git a/src/v8/test/mjsunit/regress/regress-252797.js b/src/v8/test/mjsunit/regress/regress-252797.js
index 08b2217..4d68ff8 100644
--- a/src/v8/test/mjsunit/regress/regress-252797.js
+++ b/src/v8/test/mjsunit/regress/regress-252797.js
@@ -55,6 +55,7 @@
   obj.holderMethod();
 }
 
+%PrepareFunctionForOptimization(callConstantFunctionOnPrototype);
 callConstantFunctionOnPrototype(receiver);
 callConstantFunctionOnPrototype(receiver);
 %OptimizeFunctionOnNextCall(callConstantFunctionOnPrototype);
diff --git a/src/v8/test/mjsunit/regress/regress-2537.js b/src/v8/test/mjsunit/regress/regress-2537.js
index 1a86000..4f7b6c6 100644
--- a/src/v8/test/mjsunit/regress/regress-2537.js
+++ b/src/v8/test/mjsunit/regress/regress-2537.js
@@ -31,15 +31,15 @@
 
 function foo(x, expected) {
   assertEquals(expected, x);  // This succeeds.
-  x += 0;  // Force int32 representation so that
-           // CompareNumericAndBranch is used.
+  x += 0;                     // Force int32 representation so that
+  // CompareNumericAndBranch is used.
   if (3 != x) {
     x += 0;  // Poor man's "iDef".
     // Fails due to Smi-tagging without overflow check.
     assertEquals(expected, x);
   }
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 foo(1, 1);
 foo(3, 3);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-2539.js b/src/v8/test/mjsunit/regress/regress-2539.js
index 5d263f8..d2587bb 100644
--- a/src/v8/test/mjsunit/regress/regress-2539.js
+++ b/src/v8/test/mjsunit/regress/regress-2539.js
@@ -33,17 +33,18 @@
 
 function A() {
   B(10, 11);
-}
-
-function B(x,y) {
-  x = 0; y = 0;
+};
+%PrepareFunctionForOptimization(A);
+function B(x, y) {
+  x = 0;
+  y = 0;
   dispatcher.func.apply(this, arguments);
   assertSame(2, arguments.length);
   assertSame(10, arguments[0]);
   assertSame(11, arguments[1]);
 }
 
-function C(x,y) {
+function C(x, y) {
   assertSame(2, arguments.length);
   assertSame(10, arguments[0]);
   assertSame(11, arguments[1]);
diff --git a/src/v8/test/mjsunit/regress/regress-2595.js b/src/v8/test/mjsunit/regress/regress-2595.js
index c7e9571..f4cfee9 100644
--- a/src/v8/test/mjsunit/regress/regress-2595.js
+++ b/src/v8/test/mjsunit/regress/regress-2595.js
@@ -27,12 +27,21 @@
 
 // Flags: --allow-natives-syntax
 
-var p = { f: function () { return "p"; } };
+var p = {
+  f: function() {
+    return 'p';
+  }
+};
 var o = Object.create(p);
 o.x = true;
 delete o.x;  // slow case object
 
-var u = { x: 0, f: function () { return "u"; } };  // object with some other map
+var u = {
+  x: 0,
+  f: function() {
+    return 'u';
+  }
+};  // object with some other map
 
 function F(x) {
   return x.f();
@@ -41,8 +50,10 @@
 // First make CALL IC in F go MEGAMORPHIC and ensure that we put the stub
 // that calls p.f (guarded by a negative dictionary lookup on the receiver)
 // into the stub cache
-assertEquals("p", F(o));
-assertEquals("p", F(o));
+;
+%PrepareFunctionForOptimization(F);
+assertEquals('p', F(o));
+assertEquals('p', F(o));
 assertEquals("u", F(u));
 assertEquals("p", F(o));
 assertEquals("u", F(u));
@@ -53,5 +64,7 @@
 assertEquals("p", F(o));
 
 // Add f to o. o's map will *not* change.
-o.f = function () { return "o"; };
+o.f = function() {
+  return 'o';
+};
 assertEquals("o", F(o));
diff --git a/src/v8/test/mjsunit/regress/regress-2596.js b/src/v8/test/mjsunit/regress/regress-2596.js
index 6500988..f21079a 100644
--- a/src/v8/test/mjsunit/regress/regress-2596.js
+++ b/src/v8/test/mjsunit/regress/regress-2596.js
@@ -29,7 +29,7 @@
 
 var ab = new ArrayBuffer(8);
 var i_view = new Int32Array(ab);
-i_view[0] = %GetHoleNaNUpper()
+i_view[0] = %GetHoleNaNUpper();
 i_view[1] = %GetHoleNaNLower();
 var doubles = new Float64Array(ab);  // kHoleNaN
 assertTrue(isNaN(doubles[0]));
@@ -42,8 +42,8 @@
 function boom(index) {
   array[index] = doubles[0];
   return array[index];
-}
-
+};
+%PrepareFunctionForOptimization(boom);
 assertTrue(isNaN(boom(0)));
 assertTrue(isNaN(boom(0)));
 assertTrue(isNaN(boom(0)));
diff --git a/src/v8/test/mjsunit/regress/regress-2612.js b/src/v8/test/mjsunit/regress/regress-2612.js
index 6008948..7603901 100644
--- a/src/v8/test/mjsunit/regress/regress-2612.js
+++ b/src/v8/test/mjsunit/regress/regress-2612.js
@@ -68,7 +68,9 @@
 
 source += "x=1; return _0;"
 var f = new Function(source);
+%PrepareFunctionForOptimization(f);
 
+%PrepareFunctionForOptimization(f);
 f();
 %OptimizeFunctionOnNextCall(f);
 f();
diff --git a/src/v8/test/mjsunit/regress/regress-2618.js b/src/v8/test/mjsunit/regress/regress-2618.js
index 8e539ff..1cb56ca 100644
--- a/src/v8/test/mjsunit/regress/regress-2618.js
+++ b/src/v8/test/mjsunit/regress/regress-2618.js
@@ -25,16 +25,23 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --use-osr --allow-natives-syntax --ignition-osr --opt
+// Flags: --use-osr --allow-natives-syntax --opt
 // Flags: --no-always-opt
 
-// Can't OSR with always-opt.
+// Can't OSR with always-opt or in Lite mode.
+if (isNeverOptimizeLiteMode()) {
+  print("Warning: skipping test that requires optimization in Lite mode.");
+  testRunner.quit(0);
+}
 assertFalse(isAlwaysOptimize());
 
 function f() {
   do {
     do {
-      for (var i = 0; i < 10; i++) %OptimizeOsr();
+      for (var i = 0; i < 10; i++) {
+        %OptimizeOsr();
+        %PrepareFunctionForOptimization(f);
+      }
       // Note: this check can't be wrapped in a function, because
       // calling that function causes a deopt from lack of call
       // feedback.
@@ -46,6 +53,7 @@
   } while (false);
 }
 
+%PrepareFunctionForOptimization(f);
 f();
 
 function g() {
@@ -65,7 +73,10 @@
             do {
               do {
                 do {
-                  for (var i = 0; i < 10; i++) %OptimizeOsr();
+                  for (var i = 0; i < 10; i++) {
+                    %OptimizeOsr();
+                    %PrepareFunctionForOptimization(g);
+                  }
                   var opt_status = %GetOptimizationStatus(g);
                   assertTrue(
                     (opt_status & V8OptimizationStatus.kMaybeDeopted) !== 0 ||
@@ -81,4 +92,5 @@
   } while (false);
 }
 
+%PrepareFunctionForOptimization(g);
 g();
diff --git a/src/v8/test/mjsunit/regress/regress-264203.js b/src/v8/test/mjsunit/regress/regress-264203.js
index fa00756..0b066d4 100644
--- a/src/v8/test/mjsunit/regress/regress-264203.js
+++ b/src/v8/test/mjsunit/regress/regress-264203.js
@@ -36,7 +36,9 @@
   }
   return result;
 }
+%PrepareFunctionForOptimization(foo);
 
+%PrepareFunctionForOptimization(foo);
 foo(0);
 foo(0);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-2671-1.js b/src/v8/test/mjsunit/regress/regress-2671-1.js
index 7937d6a..d288738 100644
--- a/src/v8/test/mjsunit/regress/regress-2671-1.js
+++ b/src/v8/test/mjsunit/regress/regress-2671-1.js
@@ -36,7 +36,9 @@
   a[i]++;
   assertTrue(isNaN(a[i]));
 }
+%PrepareFunctionForOptimization(f);
 
+%PrepareFunctionForOptimization(f);
 f();
 f();
 f();
diff --git a/src/v8/test/mjsunit/regress/regress-2671.js b/src/v8/test/mjsunit/regress/regress-2671.js
index 73a3098..6bdff7d 100644
--- a/src/v8/test/mjsunit/regress/regress-2671.js
+++ b/src/v8/test/mjsunit/regress/regress-2671.js
@@ -36,7 +36,9 @@
   a[i] = 1/y;
   assertFalse(isNaN(a[i]));
 }
+%PrepareFunctionForOptimization(f);
 
+%PrepareFunctionForOptimization(f);
 f();
 f();
 f();
diff --git a/src/v8/test/mjsunit/regress/regress-2758.js b/src/v8/test/mjsunit/regress/regress-2758.js
index ee78844..9f97e71 100644
--- a/src/v8/test/mjsunit/regress/regress-2758.js
+++ b/src/v8/test/mjsunit/regress/regress-2758.js
@@ -38,6 +38,7 @@
 
 for (var i = 0; i < 5; ++i) {
   for (var j in functions) {
+    %PrepareFunctionForOptimization(functions[j]);
     print(functions[i])
     assertThrows(functions[j], TypeError)
   }
diff --git a/src/v8/test/mjsunit/regress/regress-2813.js b/src/v8/test/mjsunit/regress/regress-2813.js
index 97ae43b..9903e63 100644
--- a/src/v8/test/mjsunit/regress/regress-2813.js
+++ b/src/v8/test/mjsunit/regress/regress-2813.js
@@ -36,8 +36,8 @@
     }
   }
   return 0;
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 assertEquals(0, foo(0));
 assertEquals(0, foo(0));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-2843.js b/src/v8/test/mjsunit/regress/regress-2843.js
index 5b28c2d..f71161c 100644
--- a/src/v8/test/mjsunit/regress/regress-2843.js
+++ b/src/v8/test/mjsunit/regress/regress-2843.js
@@ -37,7 +37,9 @@
   fun();
   return a;
 }
+%PrepareFunctionForOptimization(foo);
 
+%PrepareFunctionForOptimization(foo);
 assertThrows("foo(1, bailout)");
 assertThrows("foo(1, bailout)");
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-298269.js b/src/v8/test/mjsunit/regress/regress-298269.js
index f6604df..ee44e88 100644
--- a/src/v8/test/mjsunit/regress/regress-298269.js
+++ b/src/v8/test/mjsunit/regress/regress-298269.js
@@ -1,45 +1,31 @@
 // Copyright 2013 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
 
-function Cb(a) {
+// Flags: --allow-natives-syntax
+
+function Cb(a, trigger) {
   var f, g;
   for(f = a.length; f--;) {
     g = a.charCodeAt(f);
     // This will fail after OSR if Runtime_StringCharCodeAt is modified
     // to iterates optimized frames and visit safepoint pointers.
+    if (g == "C".charCodeAt(0)) {
+      %OptimizeOsr();
+      %PrepareFunctionForOptimization(Cb);
+    }
   }
   return g;
 }
 
 var s1 = "long string to make cons string 1";
 var s2 = "long string to make cons string 2";
+%PrepareFunctionForOptimization(Cb);
 Cb(s1 + s2);
+%PrepareFunctionForOptimization(Cb);
 Cb(s1);
 var s3 = "string for triggering osr in Cb";
-for (var i = 0; i < 16; i++) s3 = s3 + s3;
-Cb(s3);
+%PrepareFunctionForOptimization(Cb);
+Cb(s3 + s3);
+%PrepareFunctionForOptimization(Cb);
 Cb(s1 + s2);
diff --git a/src/v8/test/mjsunit/regress/regress-2987.js b/src/v8/test/mjsunit/regress/regress-2987.js
index 02927e2..94c15bd 100644
--- a/src/v8/test/mjsunit/regress/regress-2987.js
+++ b/src/v8/test/mjsunit/regress/regress-2987.js
@@ -35,7 +35,7 @@
   this.x = 0;
 }
 
-var deopt = { deopt:false };
+var deopt = {deopt: false};
 function boogeyman(mode, value) {
   var object = new constructor();
   if (mode) {
@@ -45,8 +45,8 @@
   }
   deopt.deopt;
   assertEquals(value, object.x);
-}
-
+};
+%PrepareFunctionForOptimization(boogeyman);
 boogeyman(true, 1);
 boogeyman(true, 1);
 boogeyman(false, 2);
diff --git a/src/v8/test/mjsunit/regress/regress-2989.js b/src/v8/test/mjsunit/regress/regress-2989.js
index 49c4a1c..236fff3 100644
--- a/src/v8/test/mjsunit/regress/regress-2989.js
+++ b/src/v8/test/mjsunit/regress/regress-2989.js
@@ -21,14 +21,20 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 // SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --opt
+
+if (isNeverOptimizeLiteMode()) {
+  print("Warning: skipping test that requires optimization in Lite mode.");
+  testRunner.quit(0);
+}
 
 (function ArgumentsObjectChange() {
   function f(x) {
-      x = 42;
-      return f.arguments[0];
-  }
-
+    x = 42;
+    return f.arguments[0];
+  };
+  %PrepareFunctionForOptimization(f);
+  %EnsureFeedbackVectorForFunction(f);
   f(0);
   %OptimizeFunctionOnNextCall(f);
   assertEquals(42, f(0));
diff --git a/src/v8/test/mjsunit/regress/regress-3029.js b/src/v8/test/mjsunit/regress/regress-3029.js
index ae412df..ca9f476 100644
--- a/src/v8/test/mjsunit/regress/regress-3029.js
+++ b/src/v8/test/mjsunit/regress/regress-3029.js
@@ -37,8 +37,8 @@
 
 function g() {
   f();
-}
-
+};
+%PrepareFunctionForOptimization(g);
 assertThrows("g()", TypeError);
 assertThrows("g()", TypeError);
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/regress/regress-3032.js b/src/v8/test/mjsunit/regress/regress-3032.js
index 9b18e14..e7cd58d 100644
--- a/src/v8/test/mjsunit/regress/regress-3032.js
+++ b/src/v8/test/mjsunit/regress/regress-3032.js
@@ -27,6 +27,10 @@
 
 // Flags: --allow-natives-syntax
 
-for (var i = 0; i < 10; i++) { if (i == 5) %OptimizeOsr(); }
-var xl = 4096;
-var z = i % xl;
+function f() {
+  for (var i = 0; i < 10; i++) { if (i == 5) %OptimizeOsr(); }
+  var xl = 4096;
+  var z = i % xl;
+}
+%PrepareFunctionForOptimization(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-3039.js b/src/v8/test/mjsunit/regress/regress-3039.js
index 3c7f62c..42640ce 100644
--- a/src/v8/test/mjsunit/regress/regress-3039.js
+++ b/src/v8/test/mjsunit/regress/regress-3039.js
@@ -28,10 +28,12 @@
 // Flags: --allow-natives-syntax
 
 function do_div(x, y) {
-  return (x / y) | 0;
+  return x / y | 0;
 }
 
 // Preparation.
+;
+%PrepareFunctionForOptimization(do_div);
 assertEquals(17, do_div(51, 3));
 assertEquals(13, do_div(65, 5));
 %OptimizeFunctionOnNextCall(do_div);
diff --git a/src/v8/test/mjsunit/regress/regress-3158.js b/src/v8/test/mjsunit/regress/regress-3158.js
index c691273..79f41eb 100644
--- a/src/v8/test/mjsunit/regress/regress-3158.js
+++ b/src/v8/test/mjsunit/regress/regress-3158.js
@@ -9,8 +9,8 @@
 
 function foo(a, i) {
   return a[i];
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 var a = new Array(100000);
 a[3] = 'x';
 
diff --git a/src/v8/test/mjsunit/regress/regress-3176.js b/src/v8/test/mjsunit/regress/regress-3176.js
index dbfe821..3a1bfde 100644
--- a/src/v8/test/mjsunit/regress/regress-3176.js
+++ b/src/v8/test/mjsunit/regress/regress-3176.js
@@ -16,13 +16,16 @@
   }
   return sum;
 }
+%PrepareFunctionForOptimization(foo);
 
 var a = new Int32Array(10);
 
+%PrepareFunctionForOptimization(foo);
 foo(a);
 foo(a);
 %OptimizeFunctionOnNextCall(foo);
 foo(a);
+%PrepareFunctionForOptimization(foo);
 %OptimizeFunctionOnNextCall(foo);
 foo(a);
 assertOptimized(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-3183.js b/src/v8/test/mjsunit/regress/regress-3183.js
index 4551621..2905082 100644
--- a/src/v8/test/mjsunit/regress/regress-3183.js
+++ b/src/v8/test/mjsunit/regress/regress-3183.js
@@ -42,7 +42,9 @@
 
   function foo() { return bar(arguments[0], arguments[1], arguments[2]); }
   function baz(f, deopt) { return foo("x", deopt, f); }
+  %PrepareFunctionForOptimization(baz);
 
+  %PrepareFunctionForOptimization(baz);
   baz(f1, 0);
   baz(f2, 0);
   %OptimizeFunctionOnNextCall(baz);
@@ -65,7 +67,9 @@
 
   function foo() { return bar(arguments[0], arguments[1]); }
   function baz(deopt) { return foo("x", deopt); }
+  %PrepareFunctionForOptimization(baz);
 
+  %PrepareFunctionForOptimization(baz);
   baz(0);
   baz(0);
   %OptimizeFunctionOnNextCall(baz);
@@ -88,7 +92,9 @@
 
   function foo() { return bar(arguments[0], arguments[1]); }
   function baz(deopt) { return foo(0, deopt); }
+  %PrepareFunctionForOptimization(baz);
 
+  %PrepareFunctionForOptimization(baz);
   baz(0);
   baz(0);
   %OptimizeFunctionOnNextCall(baz);
diff --git a/src/v8/test/mjsunit/regress/regress-318420.js b/src/v8/test/mjsunit/regress/regress-318420.js
index 77bef10..ea458fb 100644
--- a/src/v8/test/mjsunit/regress/regress-318420.js
+++ b/src/v8/test/mjsunit/regress/regress-318420.js
@@ -38,8 +38,9 @@
       a[d].apply(e[d], arguments)
     }
   }
-}
+};
 
+%PrepareFunctionForOptimization(obj.foo);
 obj.foo(1, 2, 3, 4);
 obj.foo(1, 2, 3, 4);
 %OptimizeFunctionOnNextCall(obj.foo);
diff --git a/src/v8/test/mjsunit/regress/regress-319722-ArrayBuffer.js b/src/v8/test/mjsunit/regress/regress-319722-ArrayBuffer.js
index 9a24fc5..4a48a61 100644
--- a/src/v8/test/mjsunit/regress/regress-319722-ArrayBuffer.js
+++ b/src/v8/test/mjsunit/regress/regress-319722-ArrayBuffer.js
@@ -26,7 +26,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --nostress-opt --allow-natives-syntax --mock-arraybuffer-allocator
-var maxSize = %_MaxSmi() + 1;
+var maxSize = %MaxSmi() + 1;
 var ab;
 
 // Allocate the largest ArrayBuffer we can on this architecture.
diff --git a/src/v8/test/mjsunit/regress/regress-319722-TypedArrays.js b/src/v8/test/mjsunit/regress/regress-319722-TypedArrays.js
index e497aec..0445e2d 100644
--- a/src/v8/test/mjsunit/regress/regress-319722-TypedArrays.js
+++ b/src/v8/test/mjsunit/regress/regress-319722-TypedArrays.js
@@ -27,7 +27,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --nostress-opt --allow-natives-syntax
-var maxSize = %_MaxSmi() + 1;
+var maxSize = %MaxSmi() + 1;
 function TestArray(constr) {
   assertThrows(function() {
     new constr(maxSize);
diff --git a/src/v8/test/mjsunit/regress/regress-3204.js b/src/v8/test/mjsunit/regress/regress-3204.js
index b3161be..f3e1b37 100644
--- a/src/v8/test/mjsunit/regress/regress-3204.js
+++ b/src/v8/test/mjsunit/regress/regress-3204.js
@@ -7,11 +7,11 @@
 // -----------------------------------------------------------------------------
 
 function SmiTaggingCanOverflow(x) {
- x = x | 0;
- if (x == 0) return;
- return x;
-}
-
+  x = x | 0;
+  if (x == 0) return;
+  return x;
+};
+%PrepareFunctionForOptimization(SmiTaggingCanOverflow);
 SmiTaggingCanOverflow(2147483647);
 SmiTaggingCanOverflow(2147483647);
 %OptimizeFunctionOnNextCall(SmiTaggingCanOverflow);
@@ -23,8 +23,8 @@
   var x = 0;
   for (var i = -1; i < 0; ++i) x = i % 2;
   return x;
-}
-
+};
+%PrepareFunctionForOptimization(ModILeftCanBeNegative);
 ModILeftCanBeNegative();
 %OptimizeFunctionOnNextCall(ModILeftCanBeNegative);
 assertEquals(-1, ModILeftCanBeNegative());
@@ -33,10 +33,10 @@
 
 function ModIRightCanBeZero() {
   var x = 0;
-  for (var i = -1; i <= 0; ++i) x = (2 % i) | 0;
+  for (var i = -1; i <= 0; ++i) x = 2 % i | 0;
   return x;
-}
-
+};
+%PrepareFunctionForOptimization(ModIRightCanBeZero);
 ModIRightCanBeZero();
 %OptimizeFunctionOnNextCall(ModIRightCanBeZero);
 ModIRightCanBeZero();
diff --git a/src/v8/test/mjsunit/regress/regress-320532.js b/src/v8/test/mjsunit/regress/regress-320532.js
index 7559550..1b4990a 100644
--- a/src/v8/test/mjsunit/regress/regress-320532.js
+++ b/src/v8/test/mjsunit/regress/regress-320532.js
@@ -30,12 +30,15 @@
 
 
 function bar() { return new Array(); }
+%PrepareFunctionForOptimization(bar);
 bar();
 bar();
 %OptimizeFunctionOnNextCall(bar);
 a = bar();
 function foo(len) { return new Array(len); }
+%PrepareFunctionForOptimization(foo);
 foo(0);
 foo(0);
+%PrepareFunctionForOptimization(bar);
 %OptimizeFunctionOnNextCall(bar);
 foo(0);
diff --git a/src/v8/test/mjsunit/regress/regress-3218530.js b/src/v8/test/mjsunit/regress/regress-3218530.js
index 247f3df..54c66df 100644
--- a/src/v8/test/mjsunit/regress/regress-3218530.js
+++ b/src/v8/test/mjsunit/regress/regress-3218530.js
@@ -33,7 +33,7 @@
 
 function test() {
   var bignumber = 31363200000;
-  assertDoesNotThrow(assertEquals(m[p](Math.round(bignumber/864E5)/7)+1, 52));
+  assertEquals(m[p](Math.round(bignumber/864E5)/7)+1, 52);
 }
 
 test();
diff --git a/src/v8/test/mjsunit/regress/regress-3218915.js b/src/v8/test/mjsunit/regress/regress-3218915.js
index 4b08a6e..2850092 100644
--- a/src/v8/test/mjsunit/regress/regress-3218915.js
+++ b/src/v8/test/mjsunit/regress/regress-3218915.js
@@ -37,7 +37,9 @@
   }
   return (y = x + 1, y > 1) ? 'medium' : 'small';
 }
+%PrepareFunctionForOptimization(withCommaExpressionInConditional);
 
+%PrepareFunctionForOptimization(withCommaExpressionInConditional);
 for (var i = 0; i < 5; i++) {
   withCommaExpressionInConditional(i);
 }
diff --git a/src/v8/test/mjsunit/regress/regress-323845.js b/src/v8/test/mjsunit/regress/regress-323845.js
index 4e81657..300dc92 100644
--- a/src/v8/test/mjsunit/regress/regress-323845.js
+++ b/src/v8/test/mjsunit/regress/regress-323845.js
@@ -40,8 +40,10 @@
 
 function f() {
   g({});
-}
-
-f(); f(); f();
+};
+%PrepareFunctionForOptimization(f);
+f();
+f();
+f();
 %OptimizeFunctionOnNextCall(f);
 f();
diff --git a/src/v8/test/mjsunit/regress/regress-3255.js b/src/v8/test/mjsunit/regress/regress-3255.js
index 0e77435..3526d60 100644
--- a/src/v8/test/mjsunit/regress/regress-3255.js
+++ b/src/v8/test/mjsunit/regress/regress-3255.js
@@ -16,4 +16,4 @@
 f(str, 0);
 
 // This is just to trigger elements validation, object already broken.
-%SetProperty(str, 1, 'y', 0);
+%SetKeyedProperty(str, 1, 'y');
diff --git a/src/v8/test/mjsunit/regress/regress-330046.js b/src/v8/test/mjsunit/regress/regress-330046.js
index 24557b4..bd7809b 100644
--- a/src/v8/test/mjsunit/regress/regress-330046.js
+++ b/src/v8/test/mjsunit/regress/regress-330046.js
@@ -40,6 +40,7 @@
   }
   return sum;
 }
+%PrepareFunctionForOptimization(f);
 
 f(10, o3);
 f(20, o3);
@@ -51,6 +52,7 @@
 
 // This causes all code for f to be lazily deopted.
 o2.a = 5;
+%PrepareFunctionForOptimization(f);
 
 // If OSR did not evict the old code, it will be installed in f here.
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-3307.js b/src/v8/test/mjsunit/regress/regress-3307.js
index 1fc770d..d27d26d 100644
--- a/src/v8/test/mjsunit/regress/regress-3307.js
+++ b/src/v8/test/mjsunit/regress/regress-3307.js
@@ -14,8 +14,8 @@
     a.x += b.x;
   }
   return a.x;
-}
-
+};
+%PrepareFunctionForOptimization(f);
 new p(0.1);  // make 'x' mutable box double field in p.
 
 assertEquals(3, f());
diff --git a/src/v8/test/mjsunit/regress/regress-331416.js b/src/v8/test/mjsunit/regress/regress-331416.js
index 0c60fce..062d7b9 100644
--- a/src/v8/test/mjsunit/regress/regress-331416.js
+++ b/src/v8/test/mjsunit/regress/regress-331416.js
@@ -29,8 +29,9 @@
 
 function load(a, i) {
   return a[i];
-}
-load([1, 2, 3], "length");
+};
+%PrepareFunctionForOptimization(load);
+load([1, 2, 3], 'length');
 load(3);
 load([1, 2, 3], 3);
 load(0, 0);
@@ -40,8 +41,9 @@
 
 function store(a, i, x) {
   a[i] = x;
-}
-store([1, 2, 3], "length", 3);
+};
+%PrepareFunctionForOptimization(store);
+store([1, 2, 3], 'length', 3);
 store(3);
 store([1, 2, 3], 3, 3);
 store(0, 0, 1);
diff --git a/src/v8/test/mjsunit/regress/regress-333594.js b/src/v8/test/mjsunit/regress/regress-333594.js
index 6f6dbaa..47da85b 100644
--- a/src/v8/test/mjsunit/regress/regress-333594.js
+++ b/src/v8/test/mjsunit/regress/regress-333594.js
@@ -34,8 +34,8 @@
 
 function func() {
   return {x: G};
-}
-
+};
+%PrepareFunctionForOptimization(func);
 func();
 func();
 %OptimizeFunctionOnNextCall(func);
diff --git a/src/v8/test/mjsunit/regress/regress-334.js b/src/v8/test/mjsunit/regress/regress-334.js
index c52c72a..9a20c6a 100644
--- a/src/v8/test/mjsunit/regress/regress-334.js
+++ b/src/v8/test/mjsunit/regress/regress-334.js
@@ -33,14 +33,23 @@
 var DONT_ENUM   = 2;
 var DONT_DELETE = 4;
 
+function AddNamedProperty(object, name, value, attrs) {
+  Object.defineProperty(object, name, {
+      value,
+      configurable: (attrs & DONT_DELETE) === 0,
+      enumerable: (attrs & DONT_ENUM) === 0,
+      writable: (attrs & READ_ONLY) === 0
+  });
+}
+
 function func1(){}
 function func2(){}
 
 var object = {__proto__:{}};
-%AddNamedProperty(object, "foo", func1, DONT_ENUM | DONT_DELETE);
-%AddNamedProperty(object, "bar", func1, DONT_ENUM | READ_ONLY);
-%AddNamedProperty(object, "baz", func1, DONT_DELETE | READ_ONLY);
-%AddNamedProperty(object.__proto__, "bif", func1, DONT_ENUM | DONT_DELETE);
+AddNamedProperty(object, "foo", func1, DONT_ENUM | DONT_DELETE);
+AddNamedProperty(object, "bar", func1, DONT_ENUM | READ_ONLY);
+AddNamedProperty(object, "baz", func1, DONT_DELETE | READ_ONLY);
+AddNamedProperty(object.__proto__, "bif", func1, DONT_ENUM | DONT_DELETE);
 object.bif = func2;
 
 function enumerable(obj) {
diff --git a/src/v8/test/mjsunit/regress/regress-334708.js b/src/v8/test/mjsunit/regress/regress-334708.js
index f0291bb..185da2e 100644
--- a/src/v8/test/mjsunit/regress/regress-334708.js
+++ b/src/v8/test/mjsunit/regress/regress-334708.js
@@ -33,8 +33,8 @@
 
 function bar(x, y) {
   return foo(x + 1, y + 1);
-}
-
+};
+%PrepareFunctionForOptimization(bar);
 foo(16, "4");
 
 bar(64, 2);
diff --git a/src/v8/test/mjsunit/regress/regress-3359.js b/src/v8/test/mjsunit/regress/regress-3359.js
index 0973797..ce800b8 100644
--- a/src/v8/test/mjsunit/regress/regress-3359.js
+++ b/src/v8/test/mjsunit/regress/regress-3359.js
@@ -6,7 +6,8 @@
 
 function f() {
   return 1 >> Boolean.constructor + 1;
-}
+};
+%PrepareFunctionForOptimization(f);
 assertEquals(1, f());
 %OptimizeFunctionOnNextCall(f);
 assertEquals(1, f());
diff --git a/src/v8/test/mjsunit/regress/regress-336820.js b/src/v8/test/mjsunit/regress/regress-336820.js
index 56d8874..660a8fc 100644
--- a/src/v8/test/mjsunit/regress/regress-336820.js
+++ b/src/v8/test/mjsunit/regress/regress-336820.js
@@ -28,11 +28,10 @@
 // Flags: --max-old-space-size=1600
 
 assertThrows((function() {
-  s = "Hello World!\n";
-  while (true) {
-    x = new Array();
-    x[0] = s;
-    x[1000] = s;
-    x[1000000] = s;
-    s = x.join("::");
-  }}), RangeError);
+  let str = "a".repeat(1e7);
+  let arr = new Array(2000);
+  for (let i = 0; i < 200; ++i) {
+    arr[i*10] = str;
+  }
+  let res = arr.join(':');
+}), RangeError);
diff --git a/src/v8/test/mjsunit/regress/regress-3380.js b/src/v8/test/mjsunit/regress/regress-3380.js
index 2fae459..8cf60af 100644
--- a/src/v8/test/mjsunit/regress/regress-3380.js
+++ b/src/v8/test/mjsunit/regress/regress-3380.js
@@ -5,12 +5,12 @@
 // Flags: --allow-natives-syntax
 
 function foo(a) {
-  return (a[0] >>> 0) > 0;
-}
-
+  return a[0] >>> 0 > 0;
+};
+%PrepareFunctionForOptimization(foo);
 var a = new Uint32Array([4]);
 var b = new Uint32Array([0x80000000]);
 assertTrue(foo(a));
 assertTrue(foo(a));
 %OptimizeFunctionOnNextCall(foo);
-assertTrue(foo(b))
+assertTrue(foo(b));
diff --git a/src/v8/test/mjsunit/regress/regress-3392.js b/src/v8/test/mjsunit/regress/regress-3392.js
index 375f302..f5b6274 100644
--- a/src/v8/test/mjsunit/regress/regress-3392.js
+++ b/src/v8/test/mjsunit/regress/regress-3392.js
@@ -10,8 +10,8 @@
     a.b = 1;
   }
   assertTrue(0 <= a.b);
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 foo();
 foo();
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-343609.js b/src/v8/test/mjsunit/regress/regress-343609.js
index 520b54e..d7bfe63 100644
--- a/src/v8/test/mjsunit/regress/regress-343609.js
+++ b/src/v8/test/mjsunit/regress/regress-343609.js
@@ -27,6 +27,7 @@
   (function () {
     var o = {c: 10};
     var f1 = get_closure2();
+    %PrepareFunctionForOptimization(f1);
     f1(o);
     f1(o);
     %OptimizeFunctionOnNextCall(f1);
@@ -38,6 +39,7 @@
 function opt() {
   (function () {
     var f1 = get_closure();
+    %PrepareFunctionForOptimization(f1);
     f1(new Ctor());
     f1(new Ctor());
     %OptimizeFunctionOnNextCall(f1);
diff --git a/src/v8/test/mjsunit/regress/regress-346343.js b/src/v8/test/mjsunit/regress/regress-346343.js
index e4c1066..6e3f7d5 100644
--- a/src/v8/test/mjsunit/regress/regress-346343.js
+++ b/src/v8/test/mjsunit/regress/regress-346343.js
@@ -32,10 +32,13 @@
     var y = o.y;
   }
 }
-f({y:1.1});
-f({y:1.1});
+f({y: 1.1});
+f({y: 1.1});
 
-function g(x) { f({z:x}); }
+function g(x) {
+  f({z: x});
+};
+%PrepareFunctionForOptimization(g);
 g(1);
 g(2);
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/regress/regress-346587.js b/src/v8/test/mjsunit/regress/regress-346587.js
index e907002..961d5e6 100644
--- a/src/v8/test/mjsunit/regress/regress-346587.js
+++ b/src/v8/test/mjsunit/regress/regress-346587.js
@@ -9,9 +9,9 @@
 }
 
 function foo() {
-  bar({ x : 'baz' });
-}
-
+  bar({x: 'baz'});
+};
+%PrepareFunctionForOptimization(foo);
 foo();
 foo();
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-347262.js b/src/v8/test/mjsunit/regress/regress-347262.js
index 76bc34a..5f4b038 100644
--- a/src/v8/test/mjsunit/regress/regress-347262.js
+++ b/src/v8/test/mjsunit/regress/regress-347262.js
@@ -35,7 +35,8 @@
   function f(x) {
     g();
     return arguments[0];
-  }
+  };
+  %PrepareFunctionForOptimization(f);
   f();
   f();
   %OptimizeFunctionOnNextCall(f);
@@ -50,11 +51,12 @@
   }
 
   function f(x) {
-    var o1 = { o2 : 1 };
+    var o1 = {o2: 1};
     var a = g(o1);
     o1.o2 = 3;
     return arguments[0] + a[0].o2;
-  }
+  };
+  %PrepareFunctionForOptimization(f);
   f(0);
   f(0);
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-347542.js b/src/v8/test/mjsunit/regress/regress-347542.js
index 901d798..3929a60 100644
--- a/src/v8/test/mjsunit/regress/regress-347542.js
+++ b/src/v8/test/mjsunit/regress/regress-347542.js
@@ -4,7 +4,8 @@
 
 // Flags: --allow-natives-syntax
 
-function foo() {}
+function foo() {};
+%PrepareFunctionForOptimization(foo);
 foo();
 %OptimizeFunctionOnNextCall(foo);
 foo();
diff --git a/src/v8/test/mjsunit/regress/regress-347543.js b/src/v8/test/mjsunit/regress/regress-347543.js
index ddea23a..bbef389 100644
--- a/src/v8/test/mjsunit/regress/regress-347543.js
+++ b/src/v8/test/mjsunit/regress/regress-347543.js
@@ -7,8 +7,8 @@
 function f(a) {
   a[5000000] = 256;
   assertEquals(256, a[5000000]);
-}
-
+};
+%PrepareFunctionForOptimization(f);
 var v1 = new Array(5000001);
 var v2 = new Array(10);
 f(v1);
diff --git a/src/v8/test/mjsunit/regress/regress-3476.js b/src/v8/test/mjsunit/regress/regress-3476.js
index f4333db..bb45252 100644
--- a/src/v8/test/mjsunit/regress/regress-3476.js
+++ b/src/v8/test/mjsunit/regress/regress-3476.js
@@ -5,7 +5,11 @@
 // Flags: --allow-natives-syntax
 
 function MyWrapper(v) {
-  return { valueOf: function() { return v } };
+  return {
+    valueOf: function() {
+      return v;
+    }
+  };
 }
 
 function f() {
@@ -16,8 +20,8 @@
   assertEquals("xtrue", "x" + true);
   assertEquals("ytrue", new String("y") + true);
   assertEquals("ztrue", new MyWrapper("z") + true);
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-347904.js b/src/v8/test/mjsunit/regress/regress-347904.js
index 1a27b05..967c8d3 100644
--- a/src/v8/test/mjsunit/regress/regress-347904.js
+++ b/src/v8/test/mjsunit/regress/regress-347904.js
@@ -8,5 +8,7 @@
 function f() {
   v = 1578221999;
 };
+%PrepareFunctionForOptimization(f);
+;
 %OptimizeFunctionOnNextCall(f);
 f();
diff --git a/src/v8/test/mjsunit/regress/regress-347909.js b/src/v8/test/mjsunit/regress/regress-347909.js
index 90a8e6a..4cf4d2c 100644
--- a/src/v8/test/mjsunit/regress/regress-347909.js
+++ b/src/v8/test/mjsunit/regress/regress-347909.js
@@ -4,7 +4,7 @@
 
 // Flags: --allow-natives-syntax
 
-var a = {y:1.5};
+var a = {y: 1.5};
 a.y = 0;
 var b = a.y;
 a.y = {};
@@ -12,7 +12,8 @@
 function f() {
   d = 0;
   return {y: b};
-}
+};
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-347914.js b/src/v8/test/mjsunit/regress/regress-347914.js
index 170a4f8..6ec0ea5 100644
--- a/src/v8/test/mjsunit/regress/regress-347914.js
+++ b/src/v8/test/mjsunit/regress/regress-347914.js
@@ -81,6 +81,7 @@
     assertTrue(false);
   }
 }
+%PrepareFunctionForOptimization(__f_0);
 __v_4 = {};
 __v_4.size = function() { return 42; }
 __v_4.g = function() { return this.size(); };
diff --git a/src/v8/test/mjsunit/regress/regress-348280.js b/src/v8/test/mjsunit/regress/regress-348280.js
index 319c270..90075ca 100644
--- a/src/v8/test/mjsunit/regress/regress-348280.js
+++ b/src/v8/test/mjsunit/regress/regress-348280.js
@@ -4,12 +4,17 @@
 
 // Flags: --allow-natives-syntax
 
-function baz(f) { f(); }
+function baz(f) {
+  f();
+}
 function goo() {}
 baz(goo);
 baz(goo);
 
-function bar(p) { if (p == 0) baz(1); }
+function bar(p) {
+  if (p == 0) baz(1);
+};
+%PrepareFunctionForOptimization(bar);
 bar(1);
 bar(1);
 %OptimizeFunctionOnNextCall(bar);
diff --git a/src/v8/test/mjsunit/regress/regress-348512.js b/src/v8/test/mjsunit/regress/regress-348512.js
index 7d89666..ccb23dc 100644
--- a/src/v8/test/mjsunit/regress/regress-348512.js
+++ b/src/v8/test/mjsunit/regress/regress-348512.js
@@ -27,10 +27,16 @@
 
 // Flags: --allow-natives-syntax
 
-function h(y) { assertEquals(42, y.u); }
-function g() { h.apply(0, arguments); }
-function f(x) { g({ u : x }); }
-
+function h(y) {
+  assertEquals(42, y.u);
+}
+function g() {
+  h.apply(0, arguments);
+}
+function f(x) {
+  g({u: x});
+};
+%PrepareFunctionForOptimization(f);
 f(42);
 f(42);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-349885.js b/src/v8/test/mjsunit/regress/regress-349885.js
index dd3e795..fa48d22 100644
--- a/src/v8/test/mjsunit/regress/regress-349885.js
+++ b/src/v8/test/mjsunit/regress/regress-349885.js
@@ -8,7 +8,8 @@
 
 function foo(a) {
   a[292755462] = new Object();
-}
+};
+%PrepareFunctionForOptimization(foo);
 foo(new Array(5));
 foo(new Array(5));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-350863.js b/src/v8/test/mjsunit/regress/regress-350863.js
index 616792b..3092197 100644
--- a/src/v8/test/mjsunit/regress/regress-350863.js
+++ b/src/v8/test/mjsunit/regress/regress-350863.js
@@ -27,7 +27,7 @@
 //
 // Flags: --allow-natives-syntax
 
-var __v_7 = { };
+var __v_7 = {};
 function __f_8(base, condition) {
   __v_7[base + 3] = 0;
   __v_7[base + 4] = 0;
@@ -38,7 +38,8 @@
     __v_7[base + 0] = 0;
     __v_7[base + 18] = 0;
   }
-}
+};
+%PrepareFunctionForOptimization(__f_8);
 __f_8(1, true);
 __f_8(1, false);
 %OptimizeFunctionOnNextCall(__f_8);
diff --git a/src/v8/test/mjsunit/regress/regress-351261.js b/src/v8/test/mjsunit/regress/regress-351261.js
index 5a634fa..1e4d7ad 100644
--- a/src/v8/test/mjsunit/regress/regress-351261.js
+++ b/src/v8/test/mjsunit/regress/regress-351261.js
@@ -9,11 +9,12 @@
 }
 
 function foo() {
-  var __v_8 = new Object;
+  var __v_8 = new Object();
   var __v_7 = new Array(4999990);
   store(__v_8);
   store(__v_7);
-}
+};
+%PrepareFunctionForOptimization(foo);
 foo();
 %OptimizeFunctionOnNextCall(foo);
 foo();
diff --git a/src/v8/test/mjsunit/regress/regress-351263.js b/src/v8/test/mjsunit/regress/regress-351263.js
index 28edbcd..5f0819c 100644
--- a/src/v8/test/mjsunit/regress/regress-351263.js
+++ b/src/v8/test/mjsunit/regress/regress-351263.js
@@ -29,8 +29,9 @@
 
 var __v_12 = {};
 function __f_30(x, sa) {
-  return (x >>> sa) | (x << (__v_12 - sa));
-}
+  return x >>> sa | x << __v_12 - sa;
+};
+%PrepareFunctionForOptimization(__f_30);
 __f_30(1.4, 1);
 __f_30(1.4, 1);
 %OptimizeFunctionOnNextCall(__f_30);
diff --git a/src/v8/test/mjsunit/regress/regress-351319.js b/src/v8/test/mjsunit/regress/regress-351319.js
index a2afbb6..9c61d7f 100644
--- a/src/v8/test/mjsunit/regress/regress-351319.js
+++ b/src/v8/test/mjsunit/regress/regress-351319.js
@@ -30,7 +30,8 @@
 function __f_0(a, base) {
   a[base] = 1;
   a[base] = -1749557862;
-}
+};
+%PrepareFunctionForOptimization(__f_0);
 var __v_0 = new Array(1024);
 var __v_1 = new Array(128);
 __f_0(__v_0, 1);
diff --git a/src/v8/test/mjsunit/regress/regress-351624.js b/src/v8/test/mjsunit/regress/regress-351624.js
index fc3715b..9b67888 100644
--- a/src/v8/test/mjsunit/regress/regress-351624.js
+++ b/src/v8/test/mjsunit/regress/regress-351624.js
@@ -7,14 +7,14 @@
 var big = 1e10;
 var backup = new Float64Array(1);
 
-function mult0(val){
+function mult0(val) {
   var prod = val * big;
   backup[0] = prod;
   var rounded = Math.round(prod);
   assertEquals(prod, backup[0]);
   return rounded;
-}
-
+};
+%PrepareFunctionForOptimization(mult0);
 var count = 5;
 for (var i = 0; i < count; i++) {
   if (i == count - 1) %OptimizeFunctionOnNextCall(mult0);
diff --git a/src/v8/test/mjsunit/regress/regress-352982.js b/src/v8/test/mjsunit/regress/regress-352982.js
index 5d3ce1c..174cf33 100644
--- a/src/v8/test/mjsunit/regress/regress-352982.js
+++ b/src/v8/test/mjsunit/regress/regress-352982.js
@@ -29,8 +29,10 @@
 
 function __f_4(i1) {
   return __v_3[i1] * __v_3[0];
-}
+};
+%PrepareFunctionForOptimization(__f_4);
 function __f_3(i1) {
+  %PrepareFunctionForOptimization(__f_4);
   __f_4(i1);
   __f_4(i1 + 16);
   __f_4(i1 + 32);
diff --git a/src/v8/test/mjsunit/regress/regress-353004.js b/src/v8/test/mjsunit/regress/regress-353004.js
index fe19354..f5430c6 100644
--- a/src/v8/test/mjsunit/regress/regress-353004.js
+++ b/src/v8/test/mjsunit/regress/regress-353004.js
@@ -8,7 +8,7 @@
 
 assertThrows(function() {
   var array1 = new Uint8Array(buffer1, {valueOf : function() {
-    %ArrayBufferNeuter(buffer1);
+    %ArrayBufferDetach(buffer1);
     return 0;
   }});
 }, TypeError);
@@ -17,7 +17,7 @@
 
 assertThrows(function() {
   var array2 = new Uint8Array(buffer2, 0, {valueOf : function() {
-      %ArrayBufferNeuter(buffer2);
+      %ArrayBufferDetach(buffer2);
       return 100 * 1024;
   }});
 }, TypeError);
@@ -30,7 +30,7 @@
       return 0;
     }}, {valueOf : function() {
       convertedLength = true;
-      %ArrayBufferNeuter(buffer1);
+      %ArrayBufferDetach(buffer1);
       return 0;
   }}), TypeError);
 assertTrue(convertedOffset);
@@ -38,7 +38,7 @@
 
 var buffer3 = new ArrayBuffer(100 * 1024 * 1024);
 var dataView1 = new DataView(buffer3, {valueOf : function() {
-  %ArrayBufferNeuter(buffer3);
+  %ArrayBufferDetach(buffer3);
   return 0;
 }});
 
@@ -47,7 +47,7 @@
 var buffer4 = new ArrayBuffer(100 * 1024);
 assertThrows(function() {
   var dataView2 = new DataView(buffer4, 0, {valueOf : function() {
-    %ArrayBufferNeuter(buffer4);
+    %ArrayBufferDetach(buffer4);
     return 100 * 1024 * 1024;
   }});
 }, RangeError);
@@ -56,7 +56,7 @@
 var buffer5 = new ArrayBuffer(100 * 1024);
 assertThrows(function() {
   buffer5.slice({valueOf : function() {
-    %ArrayBufferNeuter(buffer5);
+    %ArrayBufferDetach(buffer5);
     return 0;
   }}, 100 * 1024 * 1024);
 }, TypeError);
@@ -65,7 +65,7 @@
 var buffer7 = new ArrayBuffer(100 * 1024 * 1024);
 assertThrows(function() {
   buffer7.slice(0, {valueOf : function() {
-    %ArrayBufferNeuter(buffer7);
+    %ArrayBufferDetach(buffer7);
     return 100 * 1024 * 1024;
   }});
 }, TypeError);
@@ -74,7 +74,7 @@
 var array9 = new Uint8Array(buffer9);
 assertThrows(() =>
   array9.subarray({valueOf : function() {
-    %ArrayBufferNeuter(buffer9);
+    %ArrayBufferDetach(buffer9);
     return 0;
   }}, 1024), TypeError);
 assertEquals(0, array9.length);
@@ -83,7 +83,7 @@
 var array11 = new Uint8Array(buffer11);
 assertThrows(() =>
   array11.subarray(0, {valueOf : function() {
-    %ArrayBufferNeuter(buffer11);
+    %ArrayBufferDetach(buffer11);
     return 1024;
   }}), TypeError);
 assertEquals(0, array11.length);
diff --git a/src/v8/test/mjsunit/regress/regress-354433.js b/src/v8/test/mjsunit/regress/regress-354433.js
index 80ea286..de984d3 100644
--- a/src/v8/test/mjsunit/regress/regress-354433.js
+++ b/src/v8/test/mjsunit/regress/regress-354433.js
@@ -47,6 +47,7 @@
 }
 
 function __f_8(a,b) { return a%b };
+%PrepareFunctionForOptimization(__f_8);
 
 __f_5(__f_8, 1 << 30, 1);
 __f_5(__f_8, 1, 1 << 30);
diff --git a/src/v8/test/mjsunit/regress/regress-355486.js b/src/v8/test/mjsunit/regress/regress-355486.js
index 55362a1..c7feb21 100644
--- a/src/v8/test/mjsunit/regress/regress-355486.js
+++ b/src/v8/test/mjsunit/regress/regress-355486.js
@@ -4,9 +4,13 @@
 
 // Flags: --allow-natives-syntax
 
-function f() { var v = arguments[0]; }
-function g() { f(); }
-
+function f() {
+  var v = arguments[0];
+}
+function g() {
+  f();
+};
+%PrepareFunctionForOptimization(g);
 g();
 g();
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/regress/regress-355523.js b/src/v8/test/mjsunit/regress/regress-355523.js
index d61fe84..854f533 100644
--- a/src/v8/test/mjsunit/regress/regress-355523.js
+++ b/src/v8/test/mjsunit/regress/regress-355523.js
@@ -28,9 +28,14 @@
 // Flags: --allow-natives-syntax
 // This test requires ASAN.
 
-function __f_4(a, b) { }
-function __f_8(n) { return __f_4(arguments[13], arguments[-10]); }
-function __f_6(a) { return __f_8(0, a); }
+function __f_4(a, b) {}
+function __f_8(n) {
+  return __f_4(arguments[13], arguments[-10]);
+};
+%PrepareFunctionForOptimization(__f_8);
+function __f_6(a) {
+  return __f_8(0, a);
+}
 __f_8(0);
 __f_8(0);
 %OptimizeFunctionOnNextCall(__f_8);
diff --git a/src/v8/test/mjsunit/regress/regress-356053.js b/src/v8/test/mjsunit/regress/regress-356053.js
index 8f0dbdd..2695c48 100644
--- a/src/v8/test/mjsunit/regress/regress-356053.js
+++ b/src/v8/test/mjsunit/regress/regress-356053.js
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 // Flags: --noconcurrent-recompilation --expose-gc --allow-natives-syntax
+// Flags: --concurrent-recompilation --block-concurrent-recompilation
 
-%SetFlags("--concurrent-recompilation --block-concurrent-recompilation");
 gc();
 try { %UnblockConcurrentRecompilation(); } catch (e) { }
diff --git a/src/v8/test/mjsunit/regress/regress-3564.js b/src/v8/test/mjsunit/regress/regress-3564.js
index a0b9eb2..75f98d7 100644
--- a/src/v8/test/mjsunit/regress/regress-3564.js
+++ b/src/v8/test/mjsunit/regress/regress-3564.js
@@ -5,7 +5,11 @@
 // Flags: --allow-natives-syntax
 
 function MyWrapper(v) {
-  return { valueOf: function() { return v } };
+  return {
+    valueOf: function() {
+      return v;
+    }
+  };
 }
 
 function f() {
@@ -16,8 +20,8 @@
   assertFalse("a" > "x");
   assertFalse("a" > new String("y"));
   assertFalse("a" > new MyWrapper("z"));
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-357103.js b/src/v8/test/mjsunit/regress/regress-357103.js
index 692729d..c56c889 100644
--- a/src/v8/test/mjsunit/regress/regress-357103.js
+++ b/src/v8/test/mjsunit/regress/regress-357103.js
@@ -4,7 +4,7 @@
 
 // Flags: --allow-natives-syntax
 
-%SetFlags("--gc-interval=1");
+%SetAllocationTimeout(1, 1);
 
 var key = "Huckleberry Finn" + "Tom Sawyer";
 var o = {};
diff --git a/src/v8/test/mjsunit/regress/regress-357105.js b/src/v8/test/mjsunit/regress/regress-357105.js
index d3eefd0..77a7186 100644
--- a/src/v8/test/mjsunit/regress/regress-357105.js
+++ b/src/v8/test/mjsunit/regress/regress-357105.js
@@ -4,9 +4,9 @@
 
 // Flags: --allow-natives-syntax --expose-gc
 
-var global = { };
+var global = {};
 
-function do_nothing() { }
+function do_nothing() {}
 
 function f(opt_gc) {
   var x = new Array(3);
@@ -14,8 +14,8 @@
   opt_gc();
   global[1] = 15.5;
   return x;
-}
-
+};
+%PrepareFunctionForOptimization(f);
 gc();
 global = f(gc);
 global = f(do_nothing);
diff --git a/src/v8/test/mjsunit/regress/regress-358057.js b/src/v8/test/mjsunit/regress/regress-358057.js
index c5fe73a..2eea74c 100644
--- a/src/v8/test/mjsunit/regress/regress-358057.js
+++ b/src/v8/test/mjsunit/regress/regress-358057.js
@@ -12,8 +12,8 @@
     __v_1 = __v_0[__v_6 + 10];
     return __v_1;
   }
-}
-
+};
+%PrepareFunctionForOptimization(__f_12);
 assertEquals(0xAA, __f_12(-1));
 %OptimizeFunctionOnNextCall(__f_12);
 assertEquals(0xAA, __f_12(-1));
diff --git a/src/v8/test/mjsunit/regress/regress-358059.js b/src/v8/test/mjsunit/regress/regress-358059.js
index 30738f9..7bf44b9 100644
--- a/src/v8/test/mjsunit/regress/regress-358059.js
+++ b/src/v8/test/mjsunit/regress/regress-358059.js
@@ -4,9 +4,14 @@
 
 // Flags: --allow-natives-syntax
 
-function f(a, b) { return b + (a.x++); }
+function f(a, b) {
+  return b + a.x++;
+};
+%PrepareFunctionForOptimization(f);
 var o = {};
-o.__defineGetter__('x', function() { return 1; });
+o.__defineGetter__('x', function() {
+  return 1;
+});
 assertEquals(4, f(o, 3));
 assertEquals(4, f(o, 3));
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-359441.js b/src/v8/test/mjsunit/regress/regress-359441.js
index d96468c..f9d0105 100644
--- a/src/v8/test/mjsunit/regress/regress-359441.js
+++ b/src/v8/test/mjsunit/regress/regress-359441.js
@@ -10,8 +10,8 @@
 
 function f() {
   new g();
-}
-
+};
+%PrepareFunctionForOptimization(f);
 function deopt(x) {
   %DeoptimizeFunction(f);
 }
diff --git a/src/v8/test/mjsunit/regress/regress-359491.js b/src/v8/test/mjsunit/regress/regress-359491.js
index d72875a..e205d61 100644
--- a/src/v8/test/mjsunit/regress/regress-359491.js
+++ b/src/v8/test/mjsunit/regress/regress-359491.js
@@ -25,6 +25,8 @@
   }
 
   // Gather type feedback for g, but only on one branch for f.
+  ;
+  %PrepareFunctionForOptimization(g);
   g(1);
   g(1);
   %OptimizeFunctionOnNextCall(g);
@@ -42,10 +44,10 @@
   }
 
   // Gather type feedback for both branches.
-  f({ a : 1}, {b : 1}, 1);
-  f({ c : 1}, {d : 1}, 1);
-  f({ a : 1}, {c : 1}, 0);
-  f({ b : 1}, {d : 1}, 0);
+  f({a: 1}, {b: 1}, 1);
+  f({c: 1}, {d: 1}, 1);
+  f({a: 1}, {c: 1}, 0);
+  f({b: 1}, {d: 1}, 0);
 
   function g(mode) {
     var x = 1e10 | 0;
@@ -53,6 +55,8 @@
   }
 
   // Gather type feedback for g, but only on one branch for f.
+  ;
+  %PrepareFunctionForOptimization(g);
   g(1);
   g(1);
   %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/regress/regress-361608.js b/src/v8/test/mjsunit/regress/regress-361608.js
index b3cc90c..320d2ce 100644
--- a/src/v8/test/mjsunit/regress/regress-361608.js
+++ b/src/v8/test/mjsunit/regress/regress-361608.js
@@ -14,6 +14,7 @@
     f(function() { x = i; });
   }
 }
+%PrepareFunctionForOptimization(foo);
 
 foo();
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-362128.js b/src/v8/test/mjsunit/regress/regress-362128.js
index 18ac5db..94ac7b7 100644
--- a/src/v8/test/mjsunit/regress/regress-362128.js
+++ b/src/v8/test/mjsunit/regress/regress-362128.js
@@ -29,6 +29,7 @@
     return method.apply(receiver, arguments);
   }
 })();
+%PrepareFunctionForOptimization(foo);
 
 foo("a", "b", "c");
 foo("a", "b", "c");
diff --git a/src/v8/test/mjsunit/regress/regress-363956.js b/src/v8/test/mjsunit/regress/regress-363956.js
index 76d6728..680f653 100644
--- a/src/v8/test/mjsunit/regress/regress-363956.js
+++ b/src/v8/test/mjsunit/regress/regress-363956.js
@@ -4,8 +4,13 @@
 
 // Flags: --allow-natives-syntax
 
-function Fuu() { this.x = this.x.x; }
-Fuu.prototype.x = {x: 1}
+function Fuu() {
+  this.x = this.x.x;
+};
+%PrepareFunctionForOptimization(Fuu);
+Fuu.prototype.x = {
+  x: 1
+};
 new Fuu();
 new Fuu();
 %OptimizeFunctionOnNextCall(Fuu);
diff --git a/src/v8/test/mjsunit/regress/regress-3650-1.js b/src/v8/test/mjsunit/regress/regress-3650-1.js
index f5aad4f..6799bc0 100644
--- a/src/v8/test/mjsunit/regress/regress-3650-1.js
+++ b/src/v8/test/mjsunit/regress/regress-3650-1.js
@@ -14,6 +14,7 @@
   }
   return result.join('');
 }
+%PrepareFunctionForOptimization(f);
 
 var t = {a: "1", b: "2"};
 assertEquals("aa11ab12ba21bb22", f(t));
diff --git a/src/v8/test/mjsunit/regress/regress-3650-2.js b/src/v8/test/mjsunit/regress/regress-3650-2.js
index aaa6d55..6f7c51e 100644
--- a/src/v8/test/mjsunit/regress/regress-3650-2.js
+++ b/src/v8/test/mjsunit/regress/regress-3650-2.js
@@ -15,6 +15,7 @@
   for (var p in c) { s++; }
   return s;
 }
+%PrepareFunctionForOptimization(foo);
 
 assertEquals(2, foo(a));
 assertEquals(1, foo(b));
diff --git a/src/v8/test/mjsunit/regress/regress-3650-3.js b/src/v8/test/mjsunit/regress/regress-3650-3.js
index 6195b12..e613235 100644
--- a/src/v8/test/mjsunit/regress/regress-3650-3.js
+++ b/src/v8/test/mjsunit/regress/regress-3650-3.js
@@ -10,6 +10,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(foo);
 foo([1,2,3]);
 foo([2,3,4]);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-368243.js b/src/v8/test/mjsunit/regress/regress-368243.js
index 6647d12..73853d3 100644
--- a/src/v8/test/mjsunit/regress/regress-368243.js
+++ b/src/v8/test/mjsunit/regress/regress-368243.js
@@ -12,6 +12,7 @@
     }
   }
 };
+%PrepareFunctionForOptimization(foo);
 
 c = {
   "one" : { x : 1},
diff --git a/src/v8/test/mjsunit/regress/regress-370827.js b/src/v8/test/mjsunit/regress/regress-370827.js
index e6d5185..f07e6d6 100644
--- a/src/v8/test/mjsunit/regress/regress-370827.js
+++ b/src/v8/test/mjsunit/regress/regress-370827.js
@@ -6,15 +6,17 @@
 
 function g(dummy, x) {
   var start = "";
-  if (x) { start = x + " - "; }
+  if (x) {
+    start = x + ' - ';
+  }
   start = start + "array length";
 };
 
 function f() {
   gc();
   g([0.1]);
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f();
 %OptimizeFunctionOnNextCall(f);
 f();
diff --git a/src/v8/test/mjsunit/regress/regress-3709.js b/src/v8/test/mjsunit/regress/regress-3709.js
index ecb906a..17b4612 100644
--- a/src/v8/test/mjsunit/regress/regress-3709.js
+++ b/src/v8/test/mjsunit/regress/regress-3709.js
@@ -18,6 +18,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(foo);
 foo();
 foo();
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-379770.js b/src/v8/test/mjsunit/regress/regress-379770.js
index ab1b339..031d3f4 100644
--- a/src/v8/test/mjsunit/regress/regress-379770.js
+++ b/src/v8/test/mjsunit/regress/regress-379770.js
@@ -6,10 +6,14 @@
 
 function foo(obj) {
   var counter = 1;
-  for (var i = 0; i < obj.length; i++) %OptimizeOsr();
+  for (var i = 0; i < obj.length; i++) {
+    %OptimizeOsr();
+    %PrepareFunctionForOptimization(foo);
+  }
   counter += obj;
   return counter;
 }
+%PrepareFunctionForOptimization(foo);
 
 function bar() {
   var a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12];
diff --git a/src/v8/test/mjsunit/regress/regress-380092.js b/src/v8/test/mjsunit/regress/regress-380092.js
index fe6b0b7..ee149da 100644
--- a/src/v8/test/mjsunit/regress/regress-380092.js
+++ b/src/v8/test/mjsunit/regress/regress-380092.js
@@ -6,8 +6,8 @@
 
 function many_hoist(o, index) {
   return o[index + 33554427];
-}
-
+};
+%PrepareFunctionForOptimization(many_hoist);
 var obj = {};
 many_hoist(obj, 0);
 %OptimizeFunctionOnNextCall(many_hoist);
@@ -15,8 +15,8 @@
 
 function constant_too_large(o, index) {
   return o[index + 1033554433];
-}
-
+};
+%PrepareFunctionForOptimization(constant_too_large);
 constant_too_large(obj, 0);
 %OptimizeFunctionOnNextCall(constant_too_large);
 constant_too_large(obj, 5);
diff --git a/src/v8/test/mjsunit/regress/regress-381313.js b/src/v8/test/mjsunit/regress/regress-381313.js
index d2b9d7c..46e1f93 100644
--- a/src/v8/test/mjsunit/regress/regress-381313.js
+++ b/src/v8/test/mjsunit/regress/regress-381313.js
@@ -32,10 +32,10 @@
 
   deopt + 0;
 
-  return a0 + a1 + a2 + a3 + a4 + a5 + a6 + a7 + a8 + a9 +
-         a10 + a11 + a12 + a13 + a14 + a15 + a16 + a17 + a18 + a19;
-}
-
+  return a0 + a1 + a2 + a3 + a4 + a5 + a6 + a7 + a8 + a9 + a10 + a11 + a12 +
+      a13 + a14 + a15 + a16 + a17 + a18 + a19;
+};
+%PrepareFunctionForOptimization(f);
 f(0.5, 0);
 f(0.5, 0);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-385054.js b/src/v8/test/mjsunit/regress/regress-385054.js
index 115bca0..0961242 100644
--- a/src/v8/test/mjsunit/regress/regress-385054.js
+++ b/src/v8/test/mjsunit/regress/regress-385054.js
@@ -8,8 +8,8 @@
   var a = [1, 2];
   a[x];
   return a[0 - x];
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f(0);
 f(0);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-385565.js b/src/v8/test/mjsunit/regress/regress-385565.js
index 541e461..1403119 100644
--- a/src/v8/test/mjsunit/regress/regress-385565.js
+++ b/src/v8/test/mjsunit/regress/regress-385565.js
@@ -43,6 +43,7 @@
 var o1 = {m: 1};
 var o2 = {a: 0, m:1};
 
+%PrepareFunctionForOptimization(callsFReceiver);
 var r1 = callsFReceiver(o1);
 callsFReceiver(o1);
 %OptimizeFunctionOnNextCall(callsFReceiver);
@@ -50,13 +51,17 @@
 assertOptimized(callsFReceiver);
 callsFReceiver(o2);
 assertUnoptimized(callsFReceiver);
+
+%PrepareFunctionForOptimization(callsFReceiver);
 var r3 = callsFReceiver(o1);
 
 assertEquals(1, r1);
 assertTrue(r1 === r2);
 assertTrue(r2 === r3);
 
+%OptimizeFunctionOnNextCall(callsFReceiver);
 r1 = callsFReceiver(o1);
+%PrepareFunctionForOptimization(callsFReceiver);
 callsFReceiver(o1);
 %OptimizeFunctionOnNextCall(callsFReceiver);
 r2 = callsFReceiver(o1);
diff --git a/src/v8/test/mjsunit/regress/regress-386034.js b/src/v8/test/mjsunit/regress/regress-386034.js
index d770ce9..bdf1b1b 100644
--- a/src/v8/test/mjsunit/regress/regress-386034.js
+++ b/src/v8/test/mjsunit/regress/regress-386034.js
@@ -9,11 +9,13 @@
   for (i = 0; i < 1; i++) {
     v.apply(this, arguments);
   }
-}
-
+};
+%PrepareFunctionForOptimization(f);
 function g() {}
 
 f(g);
 f(g);
 %OptimizeFunctionOnNextCall(f);
-assertThrows(function() { f('----'); }, TypeError);
+assertThrows(function() {
+  f('----');
+}, TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-3865.js b/src/v8/test/mjsunit/regress/regress-3865.js
index 0d1d02f..87d895f 100644
--- a/src/v8/test/mjsunit/regress/regress-3865.js
+++ b/src/v8/test/mjsunit/regress/regress-3865.js
@@ -7,7 +7,8 @@
 function bar() {
   var radix = 10;
   return 21 / radix | 0;
-}
+};
+%PrepareFunctionForOptimization(bar);
 assertEquals(2, bar());
 assertEquals(2, bar());
 %OptimizeFunctionOnNextCall(bar);
diff --git a/src/v8/test/mjsunit/regress/regress-3884.js b/src/v8/test/mjsunit/regress/regress-3884.js
index ecd000f..3321a45 100644
--- a/src/v8/test/mjsunit/regress/regress-3884.js
+++ b/src/v8/test/mjsunit/regress/regress-3884.js
@@ -19,8 +19,8 @@
   if (x === 1.9 || x === 1.4) {
     gc();
   }
-}
-
+};
+%PrepareFunctionForOptimization(f);
 %OptimizeFunctionOnNextCall(f);
 
 f('some_other_string_1');
diff --git a/src/v8/test/mjsunit/regress/regress-3969.js b/src/v8/test/mjsunit/regress/regress-3969.js
index 4659e1c..31aeae3 100644
--- a/src/v8/test/mjsunit/regress/regress-3969.js
+++ b/src/v8/test/mjsunit/regress/regress-3969.js
@@ -18,8 +18,9 @@
 
 Outer.prototype.boom = function() {
   return this.inner.property;
-}
+};
 
+%PrepareFunctionForOptimization(Outer.prototype.boom);
 assertEquals("OK", outer.boom());
 assertEquals("OK", outer.boom());
 %OptimizeFunctionOnNextCall(Outer.prototype.boom);
diff --git a/src/v8/test/mjsunit/regress/regress-397.js b/src/v8/test/mjsunit/regress/regress-397.js
index 0e4143d..fd34786 100644
--- a/src/v8/test/mjsunit/regress/regress-397.js
+++ b/src/v8/test/mjsunit/regress/regress-397.js
@@ -35,8 +35,8 @@
 
   assertEquals("Infinity", String(Math.pow(-Infinity, 0.5)));
   assertEquals(0, Math.pow(-Infinity, -0.5));
-}
-
+};
+%PrepareFunctionForOptimization(test);
 test();
 test();
 %OptimizeFunctionOnNextCall(test);
diff --git a/src/v8/test/mjsunit/regress/regress-3976.js b/src/v8/test/mjsunit/regress/regress-3976.js
index efa3ac0..9b37c2c 100644
--- a/src/v8/test/mjsunit/regress/regress-3976.js
+++ b/src/v8/test/mjsunit/regress/regress-3976.js
@@ -72,7 +72,7 @@
 
 print("generating");
 
-var str = generate(50000);
+var str = generate(10000);
 
 print("parsing "  + str.length);
 JSON.parse(str);
diff --git a/src/v8/test/mjsunit/regress/regress-3985.js b/src/v8/test/mjsunit/regress/regress-3985.js
index 6dbc4bd..0c1ceca 100644
--- a/src/v8/test/mjsunit/regress/regress-3985.js
+++ b/src/v8/test/mjsunit/regress/regress-3985.js
@@ -8,7 +8,8 @@
 
 function h() {
   try {  // Prevent inlining in Crankshaft.
-  } catch(e) { }
+  } catch (e) {
+  }
   var res = g.arguments[0].x;
   if (shouldThrow) {
     throw res;
@@ -16,20 +17,22 @@
   return res;
 }
 
-function g(o) { h(); }
+function g(o) {
+  h();
+}
 
 function f1() {
-  var o = { x : 1 };
+  var o = {x: 1};
   g(o);
   return o.x;
-}
-
+};
+%PrepareFunctionForOptimization(f1);
 function f2() {
-  var o = { x : 2 };
+  var o = {x: 2};
   g(o);
   return o.x;
-}
-
+};
+%PrepareFunctionForOptimization(f2);
 f1();
 f2();
 f1();
@@ -37,9 +40,13 @@
 %OptimizeFunctionOnNextCall(f1);
 %OptimizeFunctionOnNextCall(f2);
 shouldThrow = true;
-try { f1(); } catch(e) {
+try {
+  f1();
+} catch (e) {
   assertEquals(e, 1);
 }
-try { f2(); } catch(e) {
+try {
+  f2();
+} catch (e) {
   assertEquals(e, 2);
 }
diff --git a/src/v8/test/mjsunit/regress/regress-4023.js b/src/v8/test/mjsunit/regress/regress-4023.js
index 902741f..16bbecc 100644
--- a/src/v8/test/mjsunit/regress/regress-4023.js
+++ b/src/v8/test/mjsunit/regress/regress-4023.js
@@ -14,14 +14,16 @@
 }
 function KeepMapAlive(o) {
   return o.o;
-}
+};
+%PrepareFunctionForOptimization(KeepMapAlive);
 function SetInner(o, i) {
   o.inner_field = i;
-}
+};
+%PrepareFunctionForOptimization(SetInner);
 function Crash(o) {
   return o.inner_field.property;
-}
-
+};
+%PrepareFunctionForOptimization(Crash);
 var inner = new Inner();
 var outer = new Outer();
 
diff --git a/src/v8/test/mjsunit/regress/regress-410912.js b/src/v8/test/mjsunit/regress/regress-410912.js
index 9a2e46d..761b009 100644
--- a/src/v8/test/mjsunit/regress/regress-410912.js
+++ b/src/v8/test/mjsunit/regress/regress-410912.js
@@ -38,7 +38,9 @@
   __v_1.a = __v_0[i];
   gc();
 }
+%PrepareFunctionForOptimization(__f_0);
 try {
+  %PrepareFunctionForOptimization(__f_0);
 __f_0(__v_1,__v_0,0);
 __f_0(__v_1,__v_0,0);
 %OptimizeFunctionOnNextCall(__f_0);
@@ -84,6 +86,7 @@
   return o.__f_4();
 }
 try {
+  %PrepareFunctionForOptimization(__f_7);
 for (var __v_7 = 0; __v_7 < 5; __v_7++) __f_7(__v_5);
 %OptimizeFunctionOnNextCall(__f_7);
 __f_7(__v_5);
@@ -111,6 +114,7 @@
 var __v_8;
 } catch(e) { print("Caught: " + e); }
 function __f_9(n) { return __v_9.charAt(n); }
+%PrepareFunctionForOptimization(__f_9);
 try {
 for (var __v_7 = 0; __v_7 < 5; __v_7++) {
   __v_8 = __f_9(0);
diff --git a/src/v8/test/mjsunit/regress/regress-4121.js b/src/v8/test/mjsunit/regress/regress-4121.js
index 0f03e79..a2f5d74 100644
--- a/src/v8/test/mjsunit/regress/regress-4121.js
+++ b/src/v8/test/mjsunit/regress/regress-4121.js
@@ -9,9 +9,9 @@
     // Ensure small array literals start in specific element kind mode.
     assertTrue(%HasSmiElements([]));
     assertTrue(%HasSmiElements([1]));
-    assertTrue(%HasSmiElements([1,2]));
+    assertTrue(%HasSmiElements([1, 2]));
     assertTrue(%HasDoubleElements([1.1]));
-    assertTrue(%HasDoubleElements([1.1,2]));
+    assertTrue(%HasDoubleElements([1.1, 2]));
 
     var a = [1, 2, 3];
     if (warmup) {
@@ -23,6 +23,9 @@
     // propagated to the next closure.
     assertTrue(%HasDoubleElements(a));
   };
+  %PrepareFunctionForOptimization(closure);
+  ;
+  %EnsureFeedbackVectorForFunction(closure);
   if (optimize) %OptimizeFunctionOnNextCall(closure);
   closure();
 }
@@ -31,7 +34,7 @@
 function test() {
   var warmup = true;
   for (var i = 0; i < 3; i++) {
-    print("iter: " + i + ", warmup: "+ warmup);
+    print('iter: ' + i + ', warmup: ' + warmup);
     literals_sharing_test(warmup, false);
     warmup = false;
   }
diff --git a/src/v8/test/mjsunit/regress/regress-412162.js b/src/v8/test/mjsunit/regress/regress-412162.js
index 6a7ad0c..ad7f954 100644
--- a/src/v8/test/mjsunit/regress/regress-412162.js
+++ b/src/v8/test/mjsunit/regress/regress-412162.js
@@ -6,8 +6,8 @@
 
 function test() {
   Math.abs(-NaN).toString();
-}
-
+};
+%PrepareFunctionForOptimization(test);
 test();
 test();
 %OptimizeFunctionOnNextCall(test);
diff --git a/src/v8/test/mjsunit/regress/regress-416730.js b/src/v8/test/mjsunit/regress/regress-416730.js
index 8d7f207..70fe623 100644
--- a/src/v8/test/mjsunit/regress/regress-416730.js
+++ b/src/v8/test/mjsunit/regress/regress-416730.js
@@ -7,13 +7,11 @@
 var d = {x: undefined, y: undefined};
 
 function Crash(left, right) {
-  var c = {
-    x: right.x - left.x,
-    y: right.y - left.y
-  };
-  return c.x * c.y;
-}
+  var c = {x: right.x - left.x, y: right.y - left.y};
 
+  return c.x * c.y;
+};
+%PrepareFunctionForOptimization(Crash);
 var a = {x: 0.5, y: 0};
 var b = {x: 1, y: 0};
 
diff --git a/src/v8/test/mjsunit/regress/regress-4173.js b/src/v8/test/mjsunit/regress/regress-4173.js
index 9aa49be..8ac75af 100644
--- a/src/v8/test/mjsunit/regress/regress-4173.js
+++ b/src/v8/test/mjsunit/regress/regress-4173.js
@@ -6,11 +6,12 @@
 
 function Migrator(o) {
   return o.foo;
-}
+};
+%PrepareFunctionForOptimization(Migrator);
 function Loader(o) {
   return o[0];
-}
-
+};
+%PrepareFunctionForOptimization(Loader);
 var first_smi_array = [1];
 var second_smi_array = [2];
 var first_object_array = ["first"];
diff --git a/src/v8/test/mjsunit/regress/regress-4266.js b/src/v8/test/mjsunit/regress/regress-4266.js
index f886250..4fdc71c 100644
--- a/src/v8/test/mjsunit/regress/regress-4266.js
+++ b/src/v8/test/mjsunit/regress/regress-4266.js
@@ -10,8 +10,8 @@
   } catch (e) {
     return e.message;
   }
-}
-
+};
+%PrepareFunctionForOptimization(test);
 assertEquals("[].foo is not a function", test());
 %OptimizeFunctionOnNextCall(test);
 assertEquals("[].foo is not a function", test());
diff --git a/src/v8/test/mjsunit/regress/regress-4267.js b/src/v8/test/mjsunit/regress/regress-4267.js
index f8cf746..f1519fa 100644
--- a/src/v8/test/mjsunit/regress/regress-4267.js
+++ b/src/v8/test/mjsunit/regress/regress-4267.js
@@ -10,6 +10,7 @@
 Object.defineProperty(a, "0", {configurable: false, value: 10});
 assertEquals(1, a.length);
 var setter = ()=>{ a.length = 0; };
+%PrepareFunctionForOptimization(setter);
 assertThrows(setter);
 assertThrows(setter);
 %OptimizeFunctionOnNextCall(setter);
diff --git a/src/v8/test/mjsunit/regress/regress-4271.js b/src/v8/test/mjsunit/regress/regress-4271.js
index bc18771..5b724b0 100644
--- a/src/v8/test/mjsunit/regress/regress-4271.js
+++ b/src/v8/test/mjsunit/regress/regress-4271.js
@@ -17,7 +17,7 @@
   });
 
   // Don't throw for real worker
-  var worker = new Worker('');
+  var worker = new Worker('', {type: 'string'});
   worker.getMessage();
   worker.postMessage({});
   worker.terminate();
diff --git a/src/v8/test/mjsunit/regress/regress-4279.js b/src/v8/test/mjsunit/regress/regress-4279.js
index 64ef967..ddc2727 100644
--- a/src/v8/test/mjsunit/regress/regress-4279.js
+++ b/src/v8/test/mjsunit/regress/regress-4279.js
@@ -4,7 +4,7 @@
 
 if (this.Worker && this.quit) {
   try {
-      new Function(new Worker("55"));
+      new Function(new Worker("55"), {type: 'string'});
   } catch(err) {}
 
   quit();
diff --git a/src/v8/test/mjsunit/regress/regress-430201.js b/src/v8/test/mjsunit/regress/regress-430201.js
index dfd1346..9443d1d 100644
--- a/src/v8/test/mjsunit/regress/regress-430201.js
+++ b/src/v8/test/mjsunit/regress/regress-430201.js
@@ -26,10 +26,10 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --allow-natives-syntax --expose-gc --nostress-incremental-marking
+// Flags: --stress-compaction
 
 var array_1 = [];
 
-%SetFlags("--stress-compaction");
 for (var a = 0; a < 10000; a++) { array_1[a * 100] = 0; }
 
 gc();
diff --git a/src/v8/test/mjsunit/regress/regress-430201b.js b/src/v8/test/mjsunit/regress/regress-430201b.js
index 056504d..7e890b7 100644
--- a/src/v8/test/mjsunit/regress/regress-430201b.js
+++ b/src/v8/test/mjsunit/regress/regress-430201b.js
@@ -25,12 +25,11 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --expose-gc
+// Flags: --allow-natives-syntax --expose-gc --stress-compaction
 
 (function() {
   var array_1 = [];
 
-    %SetFlags("--stress-compaction");
   for (var a = 0; a < 10000; a++) { array_1[a * 100] = 0; }
 
   gc();
diff --git a/src/v8/test/mjsunit/regress/regress-4325.js b/src/v8/test/mjsunit/regress/regress-4325.js
index e88bdd3..64fe43b 100644
--- a/src/v8/test/mjsunit/regress/regress-4325.js
+++ b/src/v8/test/mjsunit/regress/regress-4325.js
@@ -5,12 +5,12 @@
 // Flags: --allow-natives-syntax --expose-gc
 
 function Inner() {
-    this.p1 = 0;
-      this.p2 = 3;
+  this.p1 = 0;
+  this.p2 = 3;
 }
 
 function Outer() {
-    this.p3 = 0;
+  this.p3 = 0;
 }
 
 var i1 = new Inner();
@@ -23,7 +23,7 @@
 // Let Inner.map1 die by migrating i2 to Inner.map2:
 print(i2.p1);
 gc();
-// o1.map's descriptor for "inner" is now a cleared WeakCell;
+// o1.map's descriptor for "inner" is now a cleared weak reference;
 // o1.inner's actual map is Inner.map2.
 // Prepare Inner.map3, deprecating Inner.map2.
 i2.p2 = 0.5;
@@ -38,8 +38,9 @@
 // but in fact o1.inner.map is still Inner.map2!
 
 function loader(o) {
-    return o.inner.p2;
-}
+  return o.inner.p2;
+};
+%PrepareFunctionForOptimization(loader);
 loader(o2);
 loader(o2);
 %OptimizeFunctionOnNextCall(loader);
diff --git a/src/v8/test/mjsunit/regress/regress-435073.js b/src/v8/test/mjsunit/regress/regress-435073.js
index dbaa612..96bffde 100644
--- a/src/v8/test/mjsunit/regress/regress-435073.js
+++ b/src/v8/test/mjsunit/regress/regress-435073.js
@@ -4,8 +4,10 @@
 
 // Flags: --allow-natives-syntax --verify-heap
 
-function test(x) { [x,,]; }
-
+function test(x) {
+  [x, , ];
+};
+%PrepareFunctionForOptimization(test);
 test(0);
 test(0);
 %OptimizeFunctionOnNextCall(test);
diff --git a/src/v8/test/mjsunit/regress/regress-435477.js b/src/v8/test/mjsunit/regress/regress-435477.js
index 0a15000..d6eb3d0 100644
--- a/src/v8/test/mjsunit/regress/regress-435477.js
+++ b/src/v8/test/mjsunit/regress/regress-435477.js
@@ -7,8 +7,8 @@
 
 function f(a, base) {
   a[base] = 2;
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f(a, undefined);
 f("r12", undefined);
 f(a, 0);
diff --git a/src/v8/test/mjsunit/regress/regress-436893.js b/src/v8/test/mjsunit/regress/regress-436893.js
index 38e7b5f..c3eb4a2 100644
--- a/src/v8/test/mjsunit/regress/regress-436893.js
+++ b/src/v8/test/mjsunit/regress/regress-436893.js
@@ -33,5 +33,6 @@
 }
 // Test passing null or undefined as receiver.
 function g() { return foo.apply(null, x()++); }
+%PrepareFunctionForOptimization(g);
 %OptimizeFunctionOnNextCall(g);
 assertThrows(g);
diff --git a/src/v8/test/mjsunit/regress/regress-4374.js b/src/v8/test/mjsunit/regress/regress-4374.js
index afae71c..1d6cc77 100644
--- a/src/v8/test/mjsunit/regress/regress-4374.js
+++ b/src/v8/test/mjsunit/regress/regress-4374.js
@@ -9,6 +9,7 @@
   var max = Math.max;
   return function f() { return max(0, -1); };
 })();
+%PrepareFunctionForOptimization(f);
 
 assertEquals(0, f());
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-437765.js b/src/v8/test/mjsunit/regress/regress-437765.js
index 698c39d..63cee81 100644
--- a/src/v8/test/mjsunit/regress/regress-437765.js
+++ b/src/v8/test/mjsunit/regress/regress-437765.js
@@ -14,8 +14,8 @@
 
 function baz() {
   bar(64, 2);
-}
-
+};
+%PrepareFunctionForOptimization(baz);
 baz();
 baz();
 %OptimizeFunctionOnNextCall(baz);
diff --git a/src/v8/test/mjsunit/regress/regress-4380.js b/src/v8/test/mjsunit/regress/regress-4380.js
index 06a6479..5eb773f 100644
--- a/src/v8/test/mjsunit/regress/regress-4380.js
+++ b/src/v8/test/mjsunit/regress/regress-4380.js
@@ -9,6 +9,7 @@
   return x == undefined;
 }
 
+%PrepareFunctionForOptimization(bar);
 // Make the keyed load be polymorphic on holey smi and holey fast.
 bar([, 2, 3]);
 bar([, 'two', 'three']);
diff --git a/src/v8/test/mjsunit/regress/regress-4388.js b/src/v8/test/mjsunit/regress/regress-4388.js
index 908bccc..a0853f2 100644
--- a/src/v8/test/mjsunit/regress/regress-4388.js
+++ b/src/v8/test/mjsunit/regress/regress-4388.js
@@ -14,6 +14,7 @@
     }
   }
 }
+%PrepareFunctionForOptimization(test_hole_check_for_let);
 assertDoesNotThrow("test_hole_check_for_let(0)");
 assertThrows("test_hole_check_for_let(1)", ReferenceError);
 %OptimizeFunctionOnNextCall(test_hole_check_for_let)
@@ -29,6 +30,7 @@
     }
   }
 }
+%PrepareFunctionForOptimization(test_hole_check_for_const);
 assertThrows("test_hole_check_for_const(0)", TypeError);
 assertThrows("test_hole_check_for_const(1)", ReferenceError);
 %OptimizeFunctionOnNextCall(test_hole_check_for_const)
diff --git a/src/v8/test/mjsunit/regress/regress-446389.js b/src/v8/test/mjsunit/regress/regress-446389.js
index d600638..8923202 100644
--- a/src/v8/test/mjsunit/regress/regress-446389.js
+++ b/src/v8/test/mjsunit/regress/regress-446389.js
@@ -5,6 +5,7 @@
 // Flags: --allow-natives-syntax
 
 function runNearStackLimit(f) { function t() { try { t(); } catch(e) { f(); } }; try { t(); } catch(e) {} }
+%PrepareFunctionForOptimization(__f_3);
 %OptimizeFunctionOnNextCall(__f_3);
 function __f_3() {
     var __v_5 = a[0];
diff --git a/src/v8/test/mjsunit/regress/regress-447526.js b/src/v8/test/mjsunit/regress/regress-447526.js
index 9f9396f..f4ce1dd 100644
--- a/src/v8/test/mjsunit/regress/regress-447526.js
+++ b/src/v8/test/mjsunit/regress/regress-447526.js
@@ -19,6 +19,7 @@
     bar();
   }
 }
+%PrepareFunctionForOptimization(foo);
 
 
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-449291.js b/src/v8/test/mjsunit/regress/regress-449291.js
index fb56027..721a1f3 100644
--- a/src/v8/test/mjsunit/regress/regress-449291.js
+++ b/src/v8/test/mjsunit/regress/regress-449291.js
@@ -4,15 +4,19 @@
 
 // Flags: --allow-natives-syntax
 
-a = {y:1.5};
+a = {
+  y: 1.5
+};
 a.y = 1093445778;
 b = a.y;
-c = {y:{}};
+c = {
+  y: {}
+};
 
 function f() {
   return {y: b};
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-4493-1.js b/src/v8/test/mjsunit/regress/regress-4493-1.js
index a24c8b0..5c16f99 100644
--- a/src/v8/test/mjsunit/regress/regress-4493-1.js
+++ b/src/v8/test/mjsunit/regress/regress-4493-1.js
@@ -4,13 +4,20 @@
 
 // Flags: --allow-natives-syntax
 
-function baz(x, f) { return x.length; };
+function baz(x, f) {
+  return x.length;
+};
 
 function bar(x, y) {
   if (y) {}
-  baz(x, function() { return x; });
+  baz(x, function() {
+    return x;
+  });
 };
 
-function foo(x) { bar(x, ''); }
+function foo(x) {
+  bar(x, '');
+};
+%PrepareFunctionForOptimization(foo);
 %OptimizeFunctionOnNextCall(foo);
 foo(['a']);
diff --git a/src/v8/test/mjsunit/regress/regress-4507.js b/src/v8/test/mjsunit/regress/regress-4507.js
index a3fe510..a36031b 100644
--- a/src/v8/test/mjsunit/regress/regress-4507.js
+++ b/src/v8/test/mjsunit/regress/regress-4507.js
@@ -5,14 +5,15 @@
 // Flags: --allow-natives-syntax
 
 function broken(value) {
-  return Math.floor(value/65536);
+  return Math.floor(value / 65536);
 }
 function toUnsigned(i) {
   return i >>> 0;
 }
 function outer(i) {
   return broken(toUnsigned(i));
-}
+};
+%PrepareFunctionForOptimization(outer);
 for (var i = 0; i < 5; i++) outer(0);
 broken(0x80000000);  // Spice things up with a sprinkling of type feedback.
 %OptimizeFunctionOnNextCall(outer);
diff --git a/src/v8/test/mjsunit/regress/regress-451322.js b/src/v8/test/mjsunit/regress/regress-451322.js
index b7794f5..21871c0 100644
--- a/src/v8/test/mjsunit/regress/regress-451322.js
+++ b/src/v8/test/mjsunit/regress/regress-451322.js
@@ -9,8 +9,8 @@
 function bar() {
   var baz = 0 - {};
   if (foo > 24) return baz * 0;
-}
-
+};
+%PrepareFunctionForOptimization(bar);
 bar();
 bar();
 %OptimizeFunctionOnNextCall(bar);
diff --git a/src/v8/test/mjsunit/regress/regress-4515.js b/src/v8/test/mjsunit/regress/regress-4515.js
index 81610f0..d98377b 100644
--- a/src/v8/test/mjsunit/regress/regress-4515.js
+++ b/src/v8/test/mjsunit/regress/regress-4515.js
@@ -6,8 +6,8 @@
 
 function f(array) {
   return array.length >>> 0;
-}
-
+};
+%PrepareFunctionForOptimization(f);
 var a = new Array();
 a[4000000000] = "A";
 
diff --git a/src/v8/test/mjsunit/regress/regress-451958.js b/src/v8/test/mjsunit/regress/regress-451958.js
index 33695f2..41cd23b 100644
--- a/src/v8/test/mjsunit/regress/regress-451958.js
+++ b/src/v8/test/mjsunit/regress/regress-451958.js
@@ -15,6 +15,7 @@
     for (i = 0; i < 1; i++) ;
   }
 }
+%PrepareFunctionForOptimization(foo);
 %OptimizeFunctionOnNextCall(foo);
 foo();
 
@@ -27,5 +28,6 @@
   for (__v_45 = 128; __v_45 < 256; __v_45++) {
   }
 }
+%PrepareFunctionForOptimization(bar);
 %OptimizeFunctionOnNextCall(bar);
 assertThrows(bar);
diff --git a/src/v8/test/mjsunit/regress/regress-4521.js b/src/v8/test/mjsunit/regress/regress-4521.js
index f9bdafc..2646296 100644
--- a/src/v8/test/mjsunit/regress/regress-4521.js
+++ b/src/v8/test/mjsunit/regress/regress-4521.js
@@ -13,6 +13,7 @@
 class C extends B {
   bar() { return super[%DeoptimizeFunction(C.prototype.bar), "foo"]() }
 }
+%PrepareFunctionForOptimization(C.prototype.bar);
 
 assertEquals(23, new C().bar());
 assertEquals(23, new C().bar());
diff --git a/src/v8/test/mjsunit/regress/regress-4525.js b/src/v8/test/mjsunit/regress/regress-4525.js
index b962dc0..1439108 100644
--- a/src/v8/test/mjsunit/regress/regress-4525.js
+++ b/src/v8/test/mjsunit/regress/regress-4525.js
@@ -25,6 +25,7 @@
 }
 
 var o = construct(receiver);
+%PrepareFunctionForOptimization(o.bar);
 check(o.bar.call(123), Object(123), Number);
 check(o.bar.call("a"), Object("a"), String);
 check(o.bar.call(undefined), this, Object);
diff --git a/src/v8/test/mjsunit/regress/regress-457935.js b/src/v8/test/mjsunit/regress/regress-457935.js
index d34db05..54f9134 100644
--- a/src/v8/test/mjsunit/regress/regress-457935.js
+++ b/src/v8/test/mjsunit/regress/regress-457935.js
@@ -4,7 +4,7 @@
 
 // Flags: --allow-natives-syntax
 
-function dummy(x) { };
+function dummy(x) {};
 
 function g() {
   return g.arguments;
@@ -17,8 +17,8 @@
     o.y = +o.y;
     g();
   }
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f(1);
 f(1);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-460917.js b/src/v8/test/mjsunit/regress/regress-460917.js
index ed64c9c..88e8cd9 100644
--- a/src/v8/test/mjsunit/regress/regress-460917.js
+++ b/src/v8/test/mjsunit/regress/regress-460917.js
@@ -15,8 +15,10 @@
 }
 
 // Prepare type feedback for the "t = a1[0]" load: fast elements.
+;
+%PrepareFunctionForOptimization(boom);
 var fast_elem = new Array(1);
-fast_elem[0] = "tagged";
+fast_elem[0] = 'tagged';
 boom(fast_elem, [1]);
 
 // Prepare type feedback for the "a2[0] = 0.3" store: double elements.
diff --git a/src/v8/test/mjsunit/regress/regress-466993.js b/src/v8/test/mjsunit/regress/regress-466993.js
index 6bf02bb..4bc5182 100644
--- a/src/v8/test/mjsunit/regress/regress-466993.js
+++ b/src/v8/test/mjsunit/regress/regress-466993.js
@@ -5,10 +5,12 @@
 // Flags: --allow-natives-syntax
 
 var test = function() {
-  var a = {"1": false, "2": false, "3": false, "4": false};
+  var a = {'1': false, '2': false, '3': false, '4': false};
   assertEquals(false, a[1]);
   a[1] = true;
 };
+;
+%PrepareFunctionForOptimization(test);
 test();
 test();
 test();
diff --git a/src/v8/test/mjsunit/regress/regress-467481.js b/src/v8/test/mjsunit/regress/regress-467481.js
index dcb12d8..185a366 100644
--- a/src/v8/test/mjsunit/regress/regress-467481.js
+++ b/src/v8/test/mjsunit/regress/regress-467481.js
@@ -8,7 +8,8 @@
   var v7 = a2[0];
   var v8 = a1[0];
   a2[0] = 0.3;
-}
+};
+%PrepareFunctionForOptimization(f);
 v6 = new Array(1);
 v6[0] = "tagged";
 f(v6, [1]);
diff --git a/src/v8/test/mjsunit/regress/regress-4715.js b/src/v8/test/mjsunit/regress/regress-4715.js
index 3304120..aeacf82 100644
--- a/src/v8/test/mjsunit/regress/regress-4715.js
+++ b/src/v8/test/mjsunit/regress/regress-4715.js
@@ -36,6 +36,7 @@
   }
   return key;
 }
+%PrepareFunctionForOptimization(foo);
 
 // Collect type feedback for slow-mode for-in.
 foo(training);
diff --git a/src/v8/test/mjsunit/regress/regress-4788-1.js b/src/v8/test/mjsunit/regress/regress-4788-1.js
index 347ab5e..9258f7b 100644
--- a/src/v8/test/mjsunit/regress/regress-4788-1.js
+++ b/src/v8/test/mjsunit/regress/regress-4788-1.js
@@ -12,6 +12,8 @@
   return foo;
 })();
 
+%PrepareFunctionForOptimization(f);
+
 function deopt(f) {
   return {
     toString : function() {
diff --git a/src/v8/test/mjsunit/regress/regress-4788-2.js b/src/v8/test/mjsunit/regress/regress-4788-2.js
index 5441705..6339b04 100644
--- a/src/v8/test/mjsunit/regress/regress-4788-2.js
+++ b/src/v8/test/mjsunit/regress/regress-4788-2.js
@@ -12,9 +12,11 @@
   return foo;
 })();
 
+%PrepareFunctionForOptimization(f);
+
 function deopt(f) {
   return {
-    toString : function() {
+    toString: function() {
       %DeoptimizeFunction(f);
       return "2";
     }
diff --git a/src/v8/test/mjsunit/regress/regress-4800.js b/src/v8/test/mjsunit/regress/regress-4800.js
index af7cbc0..5885cf6 100644
--- a/src/v8/test/mjsunit/regress/regress-4800.js
+++ b/src/v8/test/mjsunit/regress/regress-4800.js
@@ -70,6 +70,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(f);
 f(0, 10);
 f(0, 10);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-484544.js b/src/v8/test/mjsunit/regress/regress-484544.js
index 709a890..f8ba1d6 100644
--- a/src/v8/test/mjsunit/regress/regress-484544.js
+++ b/src/v8/test/mjsunit/regress/regress-484544.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
-// Flags: --nouse-allocation-folding  --stress-compaction --predictable
+// Flags: --stress-compaction --predictable
 
 function f() {
   return [[], [], [[], [], []]];
diff --git a/src/v8/test/mjsunit/regress/regress-487981.js b/src/v8/test/mjsunit/regress/regress-487981.js
index 829c25c..f548944 100644
--- a/src/v8/test/mjsunit/regress/regress-487981.js
+++ b/src/v8/test/mjsunit/regress/regress-487981.js
@@ -10,13 +10,15 @@
   return o.field.b.x;
 }
 
+%PrepareFunctionForOptimization(__f_2);
+
 try {
   %OptimizeFunctionOnNextCall(__f_2);
   __v_1 = __f_2();
-} catch(e) { }
+} catch (e) { }
 
 function __f_3() { __f_3(/./.test()); };
 
 try {
-__f_3();
-} catch(e) { }
+  __f_3();
+} catch (e) { }
diff --git a/src/v8/test/mjsunit/regress/regress-488398.js b/src/v8/test/mjsunit/regress/regress-488398.js
index 77ea293..756c668 100644
--- a/src/v8/test/mjsunit/regress/regress-488398.js
+++ b/src/v8/test/mjsunit/regress/regress-488398.js
@@ -12,6 +12,7 @@
   __v_16[base + 1] = 1;
   __v_16[base + 4] = base + 4;
 }
+%PrepareFunctionForOptimization(__f_17);
 __f_17(__v_16, true);
 __f_17(__v_16, 14);
 %OptimizeFunctionOnNextCall(__f_17);
diff --git a/src/v8/test/mjsunit/regress/regress-4964.js b/src/v8/test/mjsunit/regress/regress-4964.js
index d834708..ad259dc 100644
--- a/src/v8/test/mjsunit/regress/regress-4964.js
+++ b/src/v8/test/mjsunit/regress/regress-4964.js
@@ -4,19 +4,19 @@
 
 // Flags: --allow-natives-syntax
 
-// Neutered source
+// Detached source
 var ab = new ArrayBuffer(10);
-ab.constructor = { get [Symbol.species]() { %ArrayBufferNeuter(ab); return ArrayBuffer; } };
+ab.constructor = { get [Symbol.species]() { %ArrayBufferDetach(ab); return ArrayBuffer; } };
 assertThrows(() => ab.slice(0), TypeError);
 
-// Neutered target
-class NeuteredArrayBuffer extends ArrayBuffer {
+// Detached target
+class DetachedArrayBuffer extends ArrayBuffer {
   constructor(...args) {
     super(...args);
-    %ArrayBufferNeuter(this);
+    %ArrayBufferDetach(this);
   }
 }
 
 var ab2 = new ArrayBuffer(10);
-ab2.constructor = NeuteredArrayBuffer;
+ab2.constructor = DetachedArrayBuffer;
 assertThrows(() => ab2.slice(0), TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-4970.js b/src/v8/test/mjsunit/regress/regress-4970.js
index da0033b..b34b539 100644
--- a/src/v8/test/mjsunit/regress/regress-4970.js
+++ b/src/v8/test/mjsunit/regress/regress-4970.js
@@ -10,6 +10,7 @@
   f();
 }
 
+%PrepareFunctionForOptimization(g);
 assertThrows(g, SyntaxError);
 %OptimizeFunctionOnNextCall(g);
 assertThrows(g, SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-4971.js b/src/v8/test/mjsunit/regress/regress-4971.js
index 041f6c2..7866a5f 100644
--- a/src/v8/test/mjsunit/regress/regress-4971.js
+++ b/src/v8/test/mjsunit/regress/regress-4971.js
@@ -12,8 +12,9 @@
   Object.defineProperty(C.prototype, "boom", { get: function() {
     if (should_deoptimize_caller) %DeoptimizeFunction(D.prototype.f);
     return this.m
-  }})
+  }});
 
+  %PrepareFunctionForOptimization(D.prototype.f);
   assertEquals(23, new D().f());
   assertEquals(23, new D().f());
   %OptimizeFunctionOnNextCall(D.prototype.f);
@@ -30,8 +31,9 @@
   Object.defineProperty(C.prototype, "boom", { get: function() {
     if (should_deoptimize_caller) %DeoptimizeFunction(D.prototype.f);
     return this.m
-  }})
+  }});
 
+  %PrepareFunctionForOptimization(D.prototype.f);
   assertEquals(23, new D().f("boom"));
   assertEquals(23, new D().f("boom"));
   %OptimizeFunctionOnNextCall(D.prototype.f);
diff --git a/src/v8/test/mjsunit/regress/regress-5006.js b/src/v8/test/mjsunit/regress/regress-5006.js
index 29f145d..48ffb5f 100644
--- a/src/v8/test/mjsunit/regress/regress-5006.js
+++ b/src/v8/test/mjsunit/regress/regress-5006.js
@@ -4,7 +4,10 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(x) { return Math.imul(x|0, 2); }
+function foo(x) {
+  return Math.imul(x | 0, 2);
+};
+%PrepareFunctionForOptimization(foo);
 print(foo(1));
 print(foo(1));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-500831.js b/src/v8/test/mjsunit/regress/regress-500831.js
index 3895c4d..d86fbf45 100644
--- a/src/v8/test/mjsunit/regress/regress-500831.js
+++ b/src/v8/test/mjsunit/regress/regress-500831.js
@@ -11,9 +11,9 @@
     return true;
   }
   if (typeof a != typeof b) return false;
-  if (typeof a == "number");
-  if (typeof a !== "object" && typeof a !== "function")
-    return false;
+  if (typeof a == 'number')
+    ;
+  if (typeof a !== "object" && typeof a !== "function") return false;
   var objectClass = classOf();
   if (b) return false;
   if (objectClass === "RegExp") {;
@@ -29,8 +29,8 @@
     }
     return true;
   }
-  if (objectClass == "String" || objectClass == "Number" ||
-      objectClass == "Boolean" || objectClass == "Date") {
+  if (objectClass == 'String' || objectClass == 'Number' ||
+      objectClass == 'Boolean' || objectClass == 'Date') {
     if (a.valueOf()) return false;
   };
 }
@@ -88,7 +88,9 @@
   equals();
   __v_9[0] = -1000000000000;
   equals(__v_6[0]);
-}
+};
+%PrepareFunctionForOptimization(__f_6);
 __f_6();
-__f_6(); %OptimizeFunctionOnNextCall(__f_6);
+__f_6();
+%OptimizeFunctionOnNextCall(__f_6);
 __f_6();
diff --git a/src/v8/test/mjsunit/regress/regress-5033.js b/src/v8/test/mjsunit/regress/regress-5033.js
index 728094f..4cf292b 100644
--- a/src/v8/test/mjsunit/regress/regress-5033.js
+++ b/src/v8/test/mjsunit/regress/regress-5033.js
@@ -6,15 +6,13 @@
 
 var test = function() {
   var t = Date.now();  // Just any non-constant double value.
-  var o = {
-    ['p']: 1,
-    t
-  };
+  var o = {['p']: 1, t};
 };
 
 function caller() {
   test();
-}
+};
+%PrepareFunctionForOptimization(caller);
 caller();
 caller();
 %OptimizeFunctionOnNextCall(caller);
diff --git a/src/v8/test/mjsunit/regress/regress-5085.js b/src/v8/test/mjsunit/regress/regress-5085.js
index 0ed034d..e141ded 100644
--- a/src/v8/test/mjsunit/regress/regress-5085.js
+++ b/src/v8/test/mjsunit/regress/regress-5085.js
@@ -4,11 +4,72 @@
 
 // Flags: --allow-natives-syntax
 
+g = async function() {
+  await 10;
+};
+assertEquals(undefined, g.prototype);
+g();
+assertEquals(undefined, g.prototype);
+
+gen = function*() {
+  yield 10;
+};
+assertTrue(gen.prototype != undefined && gen.prototype != null);
+gen();
+assertTrue(gen.prototype != undefined && gen.prototype != null);
+
+async_gen = async function*() {
+  yield 10;
+};
+assertTrue(async_gen.prototype != undefined && async_gen.prototype != null);
+async_gen();
+assertTrue(async_gen.prototype != undefined && async_gen.prototype != null);
+
 function foo(x) {
   return x instanceof Proxy;
+};
+%PrepareFunctionForOptimization(foo);
+function test_for_exception() {
+  caught_exception = false;
+  try {
+    foo({});
+  } catch (e) {
+    caught_exception = true;
+    assertEquals(
+        'Function has non-object prototype \'undefined\' in instanceof check',
+        e.message);
+  } finally {
+    assertTrue(caught_exception);
+  }
 }
 
-assertFalse(foo({}));
-assertFalse(foo({}));
+test_for_exception();
+test_for_exception();
 %OptimizeFunctionOnNextCall(foo);
-assertFalse(foo({}));
+test_for_exception();
+
+Proxy.__proto__.prototype = Function.prototype;
+assertTrue((() => {}) instanceof Proxy);
+
+assertEquals(
+    new Proxy({}, {
+      get(o, s) {
+        return s;
+      }
+    }).test,
+    'test');
+
+Proxy.__proto__ = {
+  prototype: {b: 2},
+  a: 1
+};
+
+assertEquals(Proxy.prototype, {b: 2});
+
+(function testProxyCreationContext() {
+  let realm = Realm.create();
+  let p1 = new Proxy({}, {});
+  let p2 = Realm.eval(realm, "new Proxy({}, {})");
+  assertEquals(0, Realm.owner(p1));
+  assertEquals(1, Realm.owner(p2));
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-5205.js b/src/v8/test/mjsunit/regress/regress-5205.js
index 0d88f45..547a1d9 100644
--- a/src/v8/test/mjsunit/regress/regress-5205.js
+++ b/src/v8/test/mjsunit/regress/regress-5205.js
@@ -9,6 +9,7 @@
     if (o == 'warmup') { return g() }
     with (o) { return x }
   }
+  %PrepareFunctionForOptimization(f);
   function g() {
     // Only a marker function serving as weak embedded object.
   }
diff --git a/src/v8/test/mjsunit/regress/regress-5252.js b/src/v8/test/mjsunit/regress/regress-5252.js
index 41f3fee..fdc910c 100644
--- a/src/v8/test/mjsunit/regress/regress-5252.js
+++ b/src/v8/test/mjsunit/regress/regress-5252.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --ignition-osr
+// Flags: --allow-natives-syntax
 
 (function TestNonLoopyLoop() {
   function f() {
@@ -11,7 +11,9 @@
       return 23;
     } while(false)
   }
+  %PrepareFunctionForOptimization(f);
   assertEquals(23, f());
+  %PrepareFunctionForOptimization(f);
   assertEquals(23, f());
 })();
 
@@ -24,6 +26,7 @@
     } while(false)
     return 999;
   }
+  %PrepareFunctionForOptimization(g);
   var gen = g();
   assertEquals({ value:23, done:false }, gen.next());
   assertEquals({ value:42, done:false }, gen.next());
diff --git a/src/v8/test/mjsunit/regress/regress-5262.js b/src/v8/test/mjsunit/regress/regress-5262.js
index 06932a2..05fc0e5 100644
--- a/src/v8/test/mjsunit/regress/regress-5262.js
+++ b/src/v8/test/mjsunit/regress/regress-5262.js
@@ -12,6 +12,7 @@
     for (var i = 0; i < 3; ++i) {
       if (i == 1) %OptimizeOsr();
     }
+    %PrepareFunctionForOptimization(f);
     %OptimizeFunctionOnNextCall(f);
     f(false);     // Trigger tier-up due to recursive call.
     boom(this);   // Causes a deopt due to below dependency.
@@ -20,6 +21,7 @@
   }
   return 65;
 }
+%PrepareFunctionForOptimization(f);
 assertEquals(65, f(false));
 assertEquals(65, f(false));
 assertEquals(42, f(true));
diff --git a/src/v8/test/mjsunit/regress/regress-5275-1.js b/src/v8/test/mjsunit/regress/regress-5275-1.js
index 542bae0..5951619 100644
--- a/src/v8/test/mjsunit/regress/regress-5275-1.js
+++ b/src/v8/test/mjsunit/regress/regress-5275-1.js
@@ -8,11 +8,11 @@
   var a = new Array(1);
   a[0] = x;
   return a;
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 assertEquals([1], foo(1));
 assertEquals([1], foo(1));
 %OptimizeFunctionOnNextCall(foo);
 assertEquals([1], foo(1));
-Array.prototype.__defineSetter__("0", function() {});
+Array.prototype.__defineSetter__('0', function() {});
 assertEquals([undefined], foo(1));
diff --git a/src/v8/test/mjsunit/regress/regress-5275-2.js b/src/v8/test/mjsunit/regress/regress-5275-2.js
index 2da422d..04b6114 100644
--- a/src/v8/test/mjsunit/regress/regress-5275-2.js
+++ b/src/v8/test/mjsunit/regress/regress-5275-2.js
@@ -8,11 +8,11 @@
   var a = new Array(1);
   a[0] = x;
   return a;
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 assertEquals([1], foo(1));
 assertEquals([1], foo(1));
 %OptimizeFunctionOnNextCall(foo);
 assertEquals([1], foo(1));
-Object.prototype.__defineSetter__("0", function() {});
+Object.prototype.__defineSetter__('0', function() {});
 assertEquals([undefined], foo(1));
diff --git a/src/v8/test/mjsunit/regress/regress-5286.js b/src/v8/test/mjsunit/regress/regress-5286.js
index 210d986..1b5f736 100644
--- a/src/v8/test/mjsunit/regress/regress-5286.js
+++ b/src/v8/test/mjsunit/regress/regress-5286.js
@@ -5,37 +5,45 @@
 // Flags: --allow-natives-syntax
 
 (function() {
-  function foo(x, y) { return x % y; }
-
-  assertEquals(0, foo(2, 2));
-  assertEquals(0, foo(4, 4));
-  %OptimizeFunctionOnNextCall(foo);
-  assertEquals(-0, foo(-8, 8));
+function foo(x, y) {
+  return x % y;
+};
+%PrepareFunctionForOptimization(foo);
+assertEquals(0, foo(2, 2));
+assertEquals(0, foo(4, 4));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(-0, foo(-8, 8));
 })();
 
 (function() {
-  function foo(x, y) { return x % y; }
-
-  assertEquals(0, foo(1, 1));
-  assertEquals(0, foo(2, 2));
-  %OptimizeFunctionOnNextCall(foo);
-  assertEquals(-0, foo(-3, 3));
+function foo(x, y) {
+  return x % y;
+};
+%PrepareFunctionForOptimization(foo);
+assertEquals(0, foo(1, 1));
+assertEquals(0, foo(2, 2));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(-0, foo(-3, 3));
 })();
 
 (function() {
-  function foo(x, y) { return x % y; }
-
-  assertEquals(0, foo(1, 1));
-  assertEquals(0, foo(2, 2));
-  %OptimizeFunctionOnNextCall(foo);
-  assertEquals(-0, foo(-2147483648, -1));
+function foo(x, y) {
+  return x % y;
+};
+%PrepareFunctionForOptimization(foo);
+assertEquals(0, foo(1, 1));
+assertEquals(0, foo(2, 2));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(-0, foo(-2147483648, -1));
 })();
 
 (function() {
-  function foo(x, y) { return x % y; }
-
-  assertEquals(0, foo(1, 1));
-  assertEquals(0, foo(2, 2));
-  %OptimizeFunctionOnNextCall(foo);
-  assertEquals(-0, foo(-2147483648, -2147483648));
+function foo(x, y) {
+  return x % y;
+};
+%PrepareFunctionForOptimization(foo);
+assertEquals(0, foo(1, 1));
+assertEquals(0, foo(2, 2));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(-0, foo(-2147483648, -2147483648));
 })();
diff --git a/src/v8/test/mjsunit/regress/regress-5332.js b/src/v8/test/mjsunit/regress/regress-5332.js
index f0a0ef9..5849d66 100644
--- a/src/v8/test/mjsunit/regress/regress-5332.js
+++ b/src/v8/test/mjsunit/regress/regress-5332.js
@@ -5,27 +5,27 @@
 // Flags: --allow-natives-syntax
 
 (function() {
-  function foo() {
-    var a = new Array(2);
-    a[1] = 1.5;
-    return a;
-  }
-
-  assertEquals(undefined, foo()[0]);
-  assertEquals(undefined, foo()[0]);
-  %OptimizeFunctionOnNextCall(foo);
-  assertEquals(undefined, foo()[0]);
+function foo() {
+  var a = new Array(2);
+  a[1] = 1.5;
+  return a;
+};
+%PrepareFunctionForOptimization(foo);
+assertEquals(undefined, foo()[0]);
+assertEquals(undefined, foo()[0]);
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(undefined, foo()[0]);
 })();
 
 (function() {
-  function foo() {
-    var a = Array(2);
-    a[1] = 1.5;
-    return a;
-  }
-
-  assertEquals(undefined, foo()[0]);
-  assertEquals(undefined, foo()[0]);
-  %OptimizeFunctionOnNextCall(foo);
-  assertEquals(undefined, foo()[0]);
+function foo() {
+  var a = Array(2);
+  a[1] = 1.5;
+  return a;
+};
+%PrepareFunctionForOptimization(foo);
+assertEquals(undefined, foo()[0]);
+assertEquals(undefined, foo()[0]);
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(undefined, foo()[0]);
 })();
diff --git a/src/v8/test/mjsunit/regress/regress-5357.js b/src/v8/test/mjsunit/regress/regress-5357.js
index 11ada60..938c157 100644
--- a/src/v8/test/mjsunit/regress/regress-5357.js
+++ b/src/v8/test/mjsunit/regress/regress-5357.js
@@ -9,8 +9,8 @@
   a = Math.max(0, a);
   a++;
   return a;
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 foo(0);
 foo(0);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-5404.js b/src/v8/test/mjsunit/regress/regress-5404.js
index eddd183..104aed0 100644
--- a/src/v8/test/mjsunit/regress/regress-5404.js
+++ b/src/v8/test/mjsunit/regress/regress-5404.js
@@ -8,6 +8,7 @@
   return a + "0123456789012";
 }
 
+%PrepareFunctionForOptimization(foo);
 foo("a");
 foo("a");
 %OptimizeFunctionOnNextCall(foo);
@@ -16,6 +17,7 @@
 var a = "a".repeat(%StringMaxLength());
 assertThrows(function() { foo(a); }, RangeError);
 
+%PrepareFunctionForOptimization(foo);
 %OptimizeFunctionOnNextCall(foo);
 assertThrows(function() { foo(a); }, RangeError);
 assertOptimized(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-5405.js b/src/v8/test/mjsunit/regress/regress-5405.js
index eeab479..e21818c 100644
--- a/src/v8/test/mjsunit/regress/regress-5405.js
+++ b/src/v8/test/mjsunit/regress/regress-5405.js
@@ -11,7 +11,7 @@
     return 10;
   }
 })();
-%RunMicrotasks();
+%PerformMicrotaskCheckpoint();
 
 (function() {
   with ({get ['.new.target']() { log.push('new.target') }}) {
diff --git a/src/v8/test/mjsunit/regress/regress-556543.js b/src/v8/test/mjsunit/regress/regress-556543.js
index 9e9bedd..f2d079f 100644
--- a/src/v8/test/mjsunit/regress/regress-556543.js
+++ b/src/v8/test/mjsunit/regress/regress-556543.js
@@ -12,6 +12,7 @@
       }
     }
   }
-}
+};
+%PrepareFunctionForOptimization(f);
 %OptimizeFunctionOnNextCall(f);
 f();
diff --git a/src/v8/test/mjsunit/regress/regress-5636-1.js b/src/v8/test/mjsunit/regress/regress-5636-1.js
index c1cafe6..4be9eb5 100644
--- a/src/v8/test/mjsunit/regress/regress-5636-1.js
+++ b/src/v8/test/mjsunit/regress/regress-5636-1.js
@@ -6,10 +6,13 @@
 
 function f(n) {
   var a = [];
-  function g() { return x }
+  function g() {
+    return x;
+  };
   for (var i = 0; i < n; ++i) {
     var x = i;
     a[i] = g;
+    %PrepareFunctionForOptimization(g);
     %OptimizeFunctionOnNextCall(g);
     g();
   }
diff --git a/src/v8/test/mjsunit/regress/regress-5636-2.js b/src/v8/test/mjsunit/regress/regress-5636-2.js
index e767336..a03dc06 100644
--- a/src/v8/test/mjsunit/regress/regress-5636-2.js
+++ b/src/v8/test/mjsunit/regress/regress-5636-2.js
@@ -7,10 +7,13 @@
 function f(n) {
   "use asm";
   var a = [];
-  function g() { return x }
+  function g() {
+    return x;
+  };
   for (var i = 0; i < n; ++i) {
     var x = i;
     a[i] = g;
+    %PrepareFunctionForOptimization(g);
     %OptimizeFunctionOnNextCall(g);
     g();
   }
diff --git a/src/v8/test/mjsunit/regress/regress-5638.js b/src/v8/test/mjsunit/regress/regress-5638.js
index 034e4c4..1df1b6c 100644
--- a/src/v8/test/mjsunit/regress/regress-5638.js
+++ b/src/v8/test/mjsunit/regress/regress-5638.js
@@ -19,6 +19,7 @@
     }
   }
 }
+%PrepareFunctionForOptimization(B);
 
 var thrower = new Proxy(A, {
   get(target, property, receiver) {
diff --git a/src/v8/test/mjsunit/regress/regress-5638b.js b/src/v8/test/mjsunit/regress/regress-5638b.js
index b72a80e..9804327 100644
--- a/src/v8/test/mjsunit/regress/regress-5638b.js
+++ b/src/v8/test/mjsunit/regress/regress-5638b.js
@@ -18,6 +18,7 @@
     construction_counter++;
   }
 }
+%PrepareFunctionForOptimization(B);
 
 var superclass_counter = 0;
 
diff --git a/src/v8/test/mjsunit/regress/regress-5691.js b/src/v8/test/mjsunit/regress/regress-5691.js
new file mode 100644
index 0000000..b460ac4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5691.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+var log = "";
+var result;
+Promise.resolve()
+  .then(() => log += "|turn1")
+  .then(() => log += "|turn2")
+  .then(() => log += "|turn3")
+  .then(() => log += "|turn4")
+  .then(() => result = "|start|turn1|fast-resolve|turn2|turn3|slow-resolve|turn4\n"+log)
+  .catch(e => print("ERROR", e));
+
+Promise.resolve(Promise.resolve()).then(() => log += "|fast-resolve");
+(class extends Promise {}).resolve(Promise.resolve()).then(() => log += "|slow-resolve");
+
+log += "|start";
+%PerformMicrotaskCheckpoint();
+assertEquals("|start|turn1|fast-resolve|turn2|turn3|slow-resolve|turn4\n\
+|start|turn1|fast-resolve|turn2|turn3|slow-resolve|turn4", result);
diff --git a/src/v8/test/mjsunit/regress/regress-572589.js b/src/v8/test/mjsunit/regress/regress-572589.js
index 1fd755a..03686e6 100644
--- a/src/v8/test/mjsunit/regress/regress-572589.js
+++ b/src/v8/test/mjsunit/regress/regress-572589.js
@@ -7,5 +7,6 @@
 "use strict";
 eval();
 var f = ({x}) => { };
+%PrepareFunctionForOptimization(f);
 %OptimizeFunctionOnNextCall(f);
 assertThrows(f);
diff --git a/src/v8/test/mjsunit/regress/regress-5749.js b/src/v8/test/mjsunit/regress/regress-5749.js
index 42e8832..26b17ac 100644
--- a/src/v8/test/mjsunit/regress/regress-5749.js
+++ b/src/v8/test/mjsunit/regress/regress-5749.js
@@ -5,8 +5,9 @@
 // Flags: --allow-natives-syntax
 
 function f(x) {
-    (x ** 1) === '';
-}
+  x ** 1 === '';
+};
+%PrepareFunctionForOptimization(f);
 f();
 f();
 f();
@@ -14,8 +15,9 @@
 f();
 
 function g(x) {
-    '' === (x ** 1);
-}
+  '' === x ** 1;
+};
+%PrepareFunctionForOptimization(g);
 g();
 g();
 g();
diff --git a/src/v8/test/mjsunit/regress/regress-5790.js b/src/v8/test/mjsunit/regress/regress-5790.js
index eb40523..3e8d3f8 100644
--- a/src/v8/test/mjsunit/regress/regress-5790.js
+++ b/src/v8/test/mjsunit/regress/regress-5790.js
@@ -9,10 +9,12 @@
   if (a) return arguments[1];
 }
 
+%PrepareFunctionForOptimization(foo);
 foo(false);
 foo(false);
 %OptimizeFunctionOnNextCall(foo);
 foo(true, 1);
+%PrepareFunctionForOptimization(foo);
 foo(true, 1);
 %OptimizeFunctionOnNextCall(foo);
 foo(false);
diff --git a/src/v8/test/mjsunit/regress/regress-5802.js b/src/v8/test/mjsunit/regress/regress-5802.js
index 57c8198..7c40ea4 100644
--- a/src/v8/test/mjsunit/regress/regress-5802.js
+++ b/src/v8/test/mjsunit/regress/regress-5802.js
@@ -9,11 +9,13 @@
 
   var o = { [Symbol.toPrimitive]: () => "o" };
 
+  %PrepareFunctionForOptimization(eq);
   assertTrue(eq(o, o));
   assertTrue(eq(o, o));
   %OptimizeFunctionOnNextCall(eq);
   assertTrue(eq(o, o));
   assertTrue(eq("o", o));
+  %PrepareFunctionForOptimization(eq);
   assertTrue(eq(o, "o"));
   %OptimizeFunctionOnNextCall(eq);
   assertTrue(eq(o, o));
@@ -27,11 +29,13 @@
 
   var o = { [Symbol.toPrimitive]: () => "o" };
 
+  %PrepareFunctionForOptimization(ne);
   assertFalse(ne(o, o));
   assertFalse(ne(o, o));
   %OptimizeFunctionOnNextCall(ne);
   assertFalse(ne(o, o));
   assertFalse(ne("o", o));
+  %PrepareFunctionForOptimization(ne);
   assertFalse(ne(o, "o"));
   %OptimizeFunctionOnNextCall(ne);
   assertFalse(ne(o, o));
@@ -47,6 +51,7 @@
   var b = {b};
   var u = %GetUndetectable();
 
+  %PrepareFunctionForOptimization(eq);
   assertTrue(eq(a, a));
   assertTrue(eq(b, b));
   assertFalse(eq(a, b));
@@ -61,6 +66,7 @@
   assertFalse(eq(a, b));
   assertFalse(eq(b, a));
   assertTrue(eq(null, u));
+  %PrepareFunctionForOptimization(eq);
   assertTrue(eq(undefined, u));
   assertTrue(eq(u, null));
   assertTrue(eq(u, undefined));
@@ -83,6 +89,7 @@
   var b = {b};
   var u = %GetUndetectable();
 
+  %PrepareFunctionForOptimization(ne);
   assertFalse(ne(a, a));
   assertFalse(ne(b, b));
   assertTrue(ne(a, b));
@@ -97,6 +104,7 @@
   assertTrue(ne(a, b));
   assertTrue(ne(b, a));
   assertFalse(ne(null, u));
+  %PrepareFunctionForOptimization(ne);
   assertFalse(ne(undefined, u));
   assertFalse(ne(u, null));
   assertFalse(ne(u, undefined));
diff --git a/src/v8/test/mjsunit/regress/regress-585041.js b/src/v8/test/mjsunit/regress/regress-585041.js
index c072ed2..4471daf 100644
--- a/src/v8/test/mjsunit/regress/regress-585041.js
+++ b/src/v8/test/mjsunit/regress/regress-585041.js
@@ -14,8 +14,8 @@
   if (dummy) {
     f(arr, -2147483648);
   }
-}
-
+};
+%PrepareFunctionForOptimization(boom);
 boom(false);
 %OptimizeFunctionOnNextCall(boom);
 boom(false);
diff --git a/src/v8/test/mjsunit/regress/regress-5888.js b/src/v8/test/mjsunit/regress/regress-5888.js
index 0725ac4..6481c79 100644
--- a/src/v8/test/mjsunit/regress/regress-5888.js
+++ b/src/v8/test/mjsunit/regress/regress-5888.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 (function() {
diff --git a/src/v8/test/mjsunit/regress/regress-590074.js b/src/v8/test/mjsunit/regress/regress-590074.js
index 80ae41b..f06af30 100644
--- a/src/v8/test/mjsunit/regress/regress-590074.js
+++ b/src/v8/test/mjsunit/regress/regress-590074.js
@@ -23,7 +23,8 @@
   __v_5 = __f_10();
   __v_4 = __f_10();
   __f_2(__v_5);
-}
+};
+%PrepareFunctionForOptimization(__f_9);
 __f_9();
 %OptimizeFunctionOnNextCall(__f_9);
 __f_9();
diff --git a/src/v8/test/mjsunit/regress/regress-5911.js b/src/v8/test/mjsunit/regress/regress-5911.js
index 0175fd3..9d6d4ae 100644
--- a/src/v8/test/mjsunit/regress/regress-5911.js
+++ b/src/v8/test/mjsunit/regress/regress-5911.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 (function() {
diff --git a/src/v8/test/mjsunit/regress/regress-592341.js b/src/v8/test/mjsunit/regress/regress-592341.js
index 2fa4752..293973a 100644
--- a/src/v8/test/mjsunit/regress/regress-592341.js
+++ b/src/v8/test/mjsunit/regress/regress-592341.js
@@ -10,27 +10,27 @@
 
 (function LiteralCompareNullDeopt() {
   function f() {
-   return id(null == %DeoptimizeNow());
-  }
-
+    return id(null == %DeoptimizeNow());
+  };
+  %PrepareFunctionForOptimization(f);
   %OptimizeFunctionOnNextCall(f);
   assertTrue(f());
 })();
 
 (function LiteralCompareUndefinedDeopt() {
   function f() {
-   return id(undefined == %DeoptimizeNow());
-  }
-
+    return id(undefined == %DeoptimizeNow());
+  };
+  %PrepareFunctionForOptimization(f);
   %OptimizeFunctionOnNextCall(f);
   assertTrue(f());
 })();
 
 (function LiteralCompareTypeofDeopt() {
   function f() {
-   return id("undefined" == typeof(%DeoptimizeNow()));
-  }
-
+    return id('undefined' == typeof %DeoptimizeNow());
+  };
+  %PrepareFunctionForOptimization(f);
   %OptimizeFunctionOnNextCall(f);
   assertTrue(f());
 })();
diff --git a/src/v8/test/mjsunit/regress/regress-592353.js b/src/v8/test/mjsunit/regress/regress-592353.js
index f4e3b68..858df09 100644
--- a/src/v8/test/mjsunit/regress/regress-592353.js
+++ b/src/v8/test/mjsunit/regress/regress-592353.js
@@ -6,5 +6,6 @@
 
 with ({}) {}
 f = ({x}) => { };
+%PrepareFunctionForOptimization(f);
 %OptimizeFunctionOnNextCall(f);
 f({});
diff --git a/src/v8/test/mjsunit/regress/regress-5943.js b/src/v8/test/mjsunit/regress/regress-5943.js
index df21c20..0b769ca 100644
--- a/src/v8/test/mjsunit/regress/regress-5943.js
+++ b/src/v8/test/mjsunit/regress/regress-5943.js
@@ -6,8 +6,8 @@
 
 function createHTML() {
   return '' + '<div><div><di';
-}
-
+};
+%PrepareFunctionForOptimization(createHTML);
 createHTML();
 %OptimizeFunctionOnNextCall(createHTML);
 
diff --git a/src/v8/test/mjsunit/regress/regress-5972.js b/src/v8/test/mjsunit/regress/regress-5972.js
index 68fe3ac..f484627 100644
--- a/src/v8/test/mjsunit/regress/regress-5972.js
+++ b/src/v8/test/mjsunit/regress/regress-5972.js
@@ -9,8 +9,8 @@
 function foo(a) {
   const o = a ? foo : undetectable;
   return typeof o === 'function';
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 assertFalse(foo(false));
 assertFalse(foo(false));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-599068-func-bindings.js b/src/v8/test/mjsunit/regress/regress-599068-func-bindings.js
index 887c000..cd4222c 100644
--- a/src/v8/test/mjsunit/regress/regress-599068-func-bindings.js
+++ b/src/v8/test/mjsunit/regress/regress-599068-func-bindings.js
@@ -28,7 +28,8 @@
 (function f() {
   function assignSloppy() {
     f += "x";
-  }
+  };
+  %PrepareFunctionForOptimization(assignSloppy);
   assertDoesNotThrow(assignSloppy);
   assertDoesNotThrow(assignSloppy);
   %OptimizeFunctionOnNextCall(assignSloppy);
@@ -37,7 +38,8 @@
   function assignStrict() {
     'use strict';
     f += "x";
-  }
+  };
+  %PrepareFunctionForOptimization(assignStrict);
   assertThrows(assignStrict, TypeError);
   assertThrows(assignStrict, TypeError);
   %OptimizeFunctionOnNextCall(assignStrict);
diff --git a/src/v8/test/mjsunit/regress/regress-599412.js b/src/v8/test/mjsunit/regress/regress-599412.js
index d5c411d..f6125e5 100644
--- a/src/v8/test/mjsunit/regress/regress-599412.js
+++ b/src/v8/test/mjsunit/regress/regress-599412.js
@@ -9,14 +9,16 @@
   print();
 }
 
-function g(a) { return a.length; }
+function g(a) {
+  return a.length;
+}
 g('0');
 g('1');
 
 function f() {
   h(g([]));
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f();
 %OptimizeFunctionOnNextCall(f);
 f();
diff --git a/src/v8/test/mjsunit/regress/regress-599414-array-concat-fast-path.js b/src/v8/test/mjsunit/regress/regress-599414-array-concat-fast-path.js
index 3819233..9febb65 100644
--- a/src/v8/test/mjsunit/regress/regress-599414-array-concat-fast-path.js
+++ b/src/v8/test/mjsunit/regress/regress-599414-array-concat-fast-path.js
@@ -7,5 +7,5 @@
 
 assertThrows(() => {
   for (;;) {
-    a = a.concat(a, a, a, a, a, a);
+    a = a.concat(a, a, a, a, a);
   }}, RangeError);
diff --git a/src/v8/test/mjsunit/regress/regress-599710.js b/src/v8/test/mjsunit/regress/regress-599710.js
index dd1ba8d..0f768b2 100644
--- a/src/v8/test/mjsunit/regress/regress-599710.js
+++ b/src/v8/test/mjsunit/regress/regress-599710.js
@@ -4,46 +4,74 @@
 
 // Flags: --allow-natives-syntax
 
-var f1 = function() { while (1) { } }
+var f1 = function() {
+  while (1) {
+  }
+};
 
 function g1() {
   var s = "hey";
-  f1 = function() { return true; }
-  if (f1()) { return s; }
-}
-
+  f1 = function() {
+    return true;
+  };
+  if (f1()) {
+    return s;
+  }
+};
+%PrepareFunctionForOptimization(g1);
 %OptimizeFunctionOnNextCall(g1);
 assertEquals("hey", g1());
 
-var f2 = function() { do { } while (1); }
+var f2 = function() {
+  do {
+  } while (1);
+};
 
 function g2() {
   var s = "hey";
-  f2 = function() { return true; }
-  if (f2()) { return s; }
-}
-
+  f2 = function() {
+    return true;
+  };
+  if (f2()) {
+    return s;
+  }
+};
+%PrepareFunctionForOptimization(g2);
 %OptimizeFunctionOnNextCall(g2);
 assertEquals("hey", g2());
 
-var f3 = function() { for (;;); }
+var f3 = function() {
+  for (;;)
+    ;
+};
 
 function g3() {
   var s = "hey";
-  f3 = function() { return true; }
-  if (f3()) { return s; }
-}
-
+  f3 = function() {
+    return true;
+  };
+  if (f3()) {
+    return s;
+  }
+};
+%PrepareFunctionForOptimization(g3);
 %OptimizeFunctionOnNextCall(g3);
 assertEquals("hey", g3());
 
-var f4 = function() { for (;;); }
+var f4 = function() {
+  for (;;)
+    ;
+};
 
 function g4() {
   var s = "hey";
-  f4 = function() { return true; }
-  while (f4()) { return s; }
-}
-
+  f4 = function() {
+    return true;
+  };
+  while (f4()) {
+    return s;
+  }
+};
+%PrepareFunctionForOptimization(g4);
 %OptimizeFunctionOnNextCall(g4);
 assertEquals("hey", g4());
diff --git a/src/v8/test/mjsunit/regress/regress-606021.js b/src/v8/test/mjsunit/regress/regress-606021.js
index 54b283e..2044c98 100644
--- a/src/v8/test/mjsunit/regress/regress-606021.js
+++ b/src/v8/test/mjsunit/regress/regress-606021.js
@@ -14,6 +14,7 @@
 
 var f1 = foo();
 var f2 = foo();
+%PrepareFunctionForOptimization(f1);
 
 // Both closures point to full code.
 f1(false);
diff --git a/src/v8/test/mjsunit/regress/regress-6063.js b/src/v8/test/mjsunit/regress/regress-6063.js
index 4a0d168..8704066 100644
--- a/src/v8/test/mjsunit/regress/regress-6063.js
+++ b/src/v8/test/mjsunit/regress/regress-6063.js
@@ -9,8 +9,8 @@
 
 function foo(a, i) {
   return U16[0] === 0xffff;
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 assertTrue(foo());
 assertTrue(foo());
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-6082.js b/src/v8/test/mjsunit/regress/regress-6082.js
index aec1be0..e1a70cf 100644
--- a/src/v8/test/mjsunit/regress/regress-6082.js
+++ b/src/v8/test/mjsunit/regress/regress-6082.js
@@ -4,7 +4,10 @@
 
 // Flags: --allow-natives-syntax
 
-function foo() { return Number.isNaN(); }
+function foo() {
+  return Number.isNaN();
+};
+%PrepareFunctionForOptimization(foo);
 assertFalse(foo());
 assertFalse(foo());
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-6121.js b/src/v8/test/mjsunit/regress/regress-6121.js
index c29ba2b..0a45764 100644
--- a/src/v8/test/mjsunit/regress/regress-6121.js
+++ b/src/v8/test/mjsunit/regress/regress-6121.js
@@ -12,6 +12,7 @@
     return true;
   }
 }
+%PrepareFunctionForOptimization(foo);
 
 var o = new Proxy({a:1},{
   getOwnPropertyDescriptor(target, property) { throw target; }
diff --git a/src/v8/test/mjsunit/regress/regress-612146.js b/src/v8/test/mjsunit/regress/regress-612146.js
index 1bd3f0b..0ceed5a 100644
--- a/src/v8/test/mjsunit/regress/regress-612146.js
+++ b/src/v8/test/mjsunit/regress/regress-612146.js
@@ -15,18 +15,19 @@
     return arguments_[0];
   }
 };
-
+%PrepareFunctionForOptimization(f);
+;
 f(0);
 f(0);
 %OptimizeFunctionOnNextCall(f);
 assertEquals(1, f(1));
 
 function g() {
-    var a = arguments;
-    %DeoptimizeNow();
-    return a.length;
-}
-
+  var a = arguments;
+  %DeoptimizeNow();
+  return a.length;
+};
+%PrepareFunctionForOptimization(g);
 g(1);
 g(1);
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/regress/regress-612412.js b/src/v8/test/mjsunit/regress/regress-612412.js
index 3debe66..4cd9b9f 100644
--- a/src/v8/test/mjsunit/regress/regress-612412.js
+++ b/src/v8/test/mjsunit/regress/regress-612412.js
@@ -15,6 +15,7 @@
     }
   }
 })();
+%PrepareFunctionForOptimization(f);
 
 g = (function() { f((Array), counter()); });
 g();
diff --git a/src/v8/test/mjsunit/regress/regress-6248.js b/src/v8/test/mjsunit/regress/regress-6248.js
index 0631892..e16452d 100644
--- a/src/v8/test/mjsunit/regress/regress-6248.js
+++ b/src/v8/test/mjsunit/regress/regress-6248.js
@@ -16,6 +16,8 @@
     }
   }
 }
+
+%PrepareFunctionForOptimization(C);
 Object.setPrototypeOf(C, parseInt);
 assertSame(sentinelObject, new C());
 assertSame(sentinelObject, new C());
diff --git a/src/v8/test/mjsunit/regress/regress-625121.js b/src/v8/test/mjsunit/regress/regress-625121.js
index 27ad0f5..44f890c 100644
--- a/src/v8/test/mjsunit/regress/regress-625121.js
+++ b/src/v8/test/mjsunit/regress/regress-625121.js
@@ -5,6 +5,7 @@
 // Flags: --allow-natives-syntax
 
 function test(f) {
+  %PrepareFunctionForOptimization(f);
   f(0);
   f(NaN);
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-6288.js b/src/v8/test/mjsunit/regress/regress-6288.js
index 337af54..5f550c3 100644
--- a/src/v8/test/mjsunit/regress/regress-6288.js
+++ b/src/v8/test/mjsunit/regress/regress-6288.js
@@ -8,6 +8,6 @@
 // DateTimeFormat but not Collation
 
 if (this.Intl) {
-  assertEquals('und', Intl.Collator().resolvedOptions().locale);
+  assertEquals('pt', Intl.Collator().resolvedOptions().locale);
   assertEquals('pt-BR', Intl.DateTimeFormat().resolvedOptions().locale);
 }
diff --git a/src/v8/test/mjsunit/regress/regress-632289.js b/src/v8/test/mjsunit/regress/regress-632289.js
index e216035..f988505 100644
--- a/src/v8/test/mjsunit/regress/regress-632289.js
+++ b/src/v8/test/mjsunit/regress/regress-632289.js
@@ -5,7 +5,9 @@
 // Flags: --always-opt --allow-natives-syntax
 
 try {
-} catch(e) {; }
+} catch (e) {
+  ;
+}
 (function __f_12() {
 })();
 (function __f_6() {
@@ -15,8 +17,9 @@
     try {
     } catch (e) {
     }
-  }
- __f_4();
+  };
+  %PrepareFunctionForOptimization(__f_4);
+  __f_4();
   %OptimizeFunctionOnNextCall(__f_4);
- __f_4();
+  __f_4();
 })();
diff --git a/src/v8/test/mjsunit/regress/regress-634-debug.js b/src/v8/test/mjsunit/regress/regress-634-debug.js
index 17ca828..8eaaa4f 100644
--- a/src/v8/test/mjsunit/regress/regress-634-debug.js
+++ b/src/v8/test/mjsunit/regress/regress-634-debug.js
@@ -35,6 +35,7 @@
   %SetAllocationTimeout(-1, -1, true);
 }
 
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-6373.js b/src/v8/test/mjsunit/regress/regress-6373.js
index 8673e83..4aa4641 100644
--- a/src/v8/test/mjsunit/regress/regress-6373.js
+++ b/src/v8/test/mjsunit/regress/regress-6373.js
@@ -4,19 +4,19 @@
 
 // Flags: --allow-natives-syntax
 
-var A = {}
+var A = {};
 
 A[Symbol.hasInstance] = function(x) {
   %DeoptimizeFunction(foo);
   return 1;
-}
+};
 
-var a = {}
+var a = {};
 
 function foo(o) {
   return o instanceof A;
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 foo(a);
 foo(a);
 assertTrue(foo(a) !== 1);
diff --git a/src/v8/test/mjsunit/regress/regress-639270.js b/src/v8/test/mjsunit/regress/regress-639270.js
index 731175d..fe7dd8b 100644
--- a/src/v8/test/mjsunit/regress/regress-639270.js
+++ b/src/v8/test/mjsunit/regress/regress-639270.js
@@ -8,6 +8,7 @@
 
 var g = (async () => { return JSON.stringify() });
 
+%PrepareFunctionForOptimization(g);
 g();
 g();
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/regress/regress-642409.js b/src/v8/test/mjsunit/regress/regress-642409.js
index eceb070..72fa103 100644
--- a/src/v8/test/mjsunit/regress/regress-642409.js
+++ b/src/v8/test/mjsunit/regress/regress-642409.js
@@ -16,6 +16,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(SubClass);
 new SubClass();
 new SubClass();
 %OptimizeFunctionOnNextCall(SubClass);
diff --git a/src/v8/test/mjsunit/regress/regress-653407.js b/src/v8/test/mjsunit/regress/regress-653407.js
index 66d537e..45fa2eb 100644
--- a/src/v8/test/mjsunit/regress/regress-653407.js
+++ b/src/v8/test/mjsunit/regress/regress-653407.js
@@ -8,19 +8,19 @@
 // constructors in turbofan.
 
 class superClass {
-  constructor () {}
+  constructor() {}
 }
 
 class subClass extends superClass {
-  constructor () {
+  constructor() {
     super();
   }
 }
 
 function f() {
- new subClass();
-}
-
+  new subClass();
+};
+%PrepareFunctionForOptimization(f);
 f(); // We need this to collect feedback, so that subClass gets inlined in f.
-%OptimizeFunctionOnNextCall(f)
+%OptimizeFunctionOnNextCall(f);
 f();
diff --git a/src/v8/test/mjsunit/regress/regress-6607-1.js b/src/v8/test/mjsunit/regress/regress-6607-1.js
index 74b702b..92177df 100644
--- a/src/v8/test/mjsunit/regress/regress-6607-1.js
+++ b/src/v8/test/mjsunit/regress/regress-6607-1.js
@@ -8,6 +8,7 @@
   return a[i];
 }
 
+%PrepareFunctionForOptimization(get);
 get([1,,3], 0);
 get([1,,3], 2);
 %OptimizeFunctionOnNextCall(get);
diff --git a/src/v8/test/mjsunit/regress/regress-6607-2.js b/src/v8/test/mjsunit/regress/regress-6607-2.js
index cfb0009..26aafa3 100644
--- a/src/v8/test/mjsunit/regress/regress-6607-2.js
+++ b/src/v8/test/mjsunit/regress/regress-6607-2.js
@@ -8,6 +8,7 @@
   return a[i];
 }
 
+%PrepareFunctionForOptimization(get);
 get([1,,3], 0);
 get([1,,3], 2);
 %OptimizeFunctionOnNextCall(get);
diff --git a/src/v8/test/mjsunit/regress/regress-662845.js b/src/v8/test/mjsunit/regress/regress-662845.js
index 7740ed1..4a2fdbc 100644
--- a/src/v8/test/mjsunit/regress/regress-662845.js
+++ b/src/v8/test/mjsunit/regress/regress-662845.js
@@ -5,10 +5,12 @@
 // Flags: --allow-natives-syntax
 
 function foo(x) {
-  (function() { x = 1; })()
+  (function() {
+    x = 1;
+  })();
   return arguments[0];
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 assertEquals(1, foo(42));
 assertEquals(1, foo(42));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-662904.js b/src/v8/test/mjsunit/regress/regress-662904.js
index 00ab1cd..d827559 100644
--- a/src/v8/test/mjsunit/regress/regress-662904.js
+++ b/src/v8/test/mjsunit/regress/regress-662904.js
@@ -13,6 +13,7 @@
   return sum;
 }
 
+%PrepareFunctionForOptimization(foo);
 assertEquals("0a", foo());
 assertEquals("0a", foo());
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-664087.js b/src/v8/test/mjsunit/regress/regress-664087.js
index 6739167..52eadb5 100644
--- a/src/v8/test/mjsunit/regress/regress-664087.js
+++ b/src/v8/test/mjsunit/regress/regress-664087.js
@@ -8,14 +8,20 @@
   throw 1;
 }
 
-var v = { valueOf : g };
+var v = {valueOf: g};
 
 function foo(v) {
   v++;
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 %NeverOptimizeFunction(g);
-assertThrows(function () { foo(v); });
-assertThrows(function () { foo(v); });
+assertThrows(function() {
+  foo(v);
+});
+assertThrows(function() {
+  foo(v);
+});
 %OptimizeFunctionOnNextCall(foo);
-assertThrows(function () { foo(v); });
+assertThrows(function() {
+  foo(v);
+});
diff --git a/src/v8/test/mjsunit/regress/regress-666046.js b/src/v8/test/mjsunit/regress/regress-666046.js
index b461538..5cdaa11 100644
--- a/src/v8/test/mjsunit/regress/regress-666046.js
+++ b/src/v8/test/mjsunit/regress/regress-666046.js
@@ -29,6 +29,7 @@
 
 // Ensure |proto| is marked as "should be fast".
 var o = new A();
+%EnsureFeedbackVectorForFunction(foo);
 foo(o);
 foo(o);
 foo(o);
diff --git a/src/v8/test/mjsunit/regress/regress-6681.mjs b/src/v8/test/mjsunit/regress/regress-6681.mjs
new file mode 100644
index 0000000..e9f7126
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6681.mjs
@@ -0,0 +1,8 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import * as ns from "./regress-6681.mjs";
+export var foo;
+
+assertEquals(false, Reflect.defineProperty(ns, 'foo', {value: 123}));
diff --git a/src/v8/test/mjsunit/regress/regress-669024.js b/src/v8/test/mjsunit/regress/regress-669024.js
index 079cb96..a5469f3 100644
--- a/src/v8/test/mjsunit/regress/regress-669024.js
+++ b/src/v8/test/mjsunit/regress/regress-669024.js
@@ -4,15 +4,19 @@
 
 // Flags: --allow-natives-syntax
 
-function h(y) { return y.u; }
-
-function g() { return h.apply(0, arguments); }
-
-function f(x) {
-  var o = { u : x };
-  return g(o);
+function h(y) {
+  return y.u;
 }
 
+function g() {
+  return h.apply(0, arguments);
+}
+
+function f(x) {
+  var o = {u: x};
+  return g(o);
+};
+%PrepareFunctionForOptimization(f);
 f(42);
 f(0.1);
 
diff --git a/src/v8/test/mjsunit/regress/regress-6700.js b/src/v8/test/mjsunit/regress/regress-6700.js
index 342cac4..c20cefd 100644
--- a/src/v8/test/mjsunit/regress/regress-6700.js
+++ b/src/v8/test/mjsunit/regress/regress-6700.js
@@ -4,6 +4,8 @@
 
 // Flags: --allow-natives-syntax
 
+let kMinHeapSize = 4096;
+
 (function TestLeftRight() {
   function Module(stdlib, foreign, heap) {
     "use asm";
@@ -14,7 +16,7 @@
     }
     return { f:f }
   }
-  var buffer = new ArrayBuffer(1024);
+  var buffer = new ArrayBuffer(kMinHeapSize);
   var module = new Module(this, {}, buffer);
   assertTrue(%IsAsmWasmCode(Module));
   new Int32Array(buffer)[42] = 23;
@@ -31,7 +33,7 @@
     }
     return { f:f }
   }
-  var buffer = new ArrayBuffer(1024);
+  var buffer = new ArrayBuffer(kMinHeapSize);
   var module = new Module(this, {}, buffer)
   assertTrue(%IsAsmWasmCode(Module));
   new Int32Array(buffer)[42 >> 4] = 23;
@@ -48,7 +50,7 @@
     }
     return { f:f }
   }
-  var buffer = new ArrayBuffer(1024);
+  var buffer = new ArrayBuffer(kMinHeapSize);
   var module = new Module(this, {}, buffer)
   assertFalse(%IsAsmWasmCode(Module));
   new Int32Array(buffer)[42 & 0xfc] = 23;
@@ -65,7 +67,7 @@
     }
     return { f:f }
   }
-  var buffer = new ArrayBuffer(1024);
+  var buffer = new ArrayBuffer(kMinHeapSize);
   var module = new Module(this, {}, buffer)
   assertFalse(%IsAsmWasmCode(Module));
   new Int32Array(buffer)[42 >> 3] = 23;
@@ -82,7 +84,7 @@
     }
     return { f:f }
   }
-  var buffer = new ArrayBuffer(1024);
+  var buffer = new ArrayBuffer(kMinHeapSize);
   var module = new Module(this, {}, buffer)
   assertFalse(%IsAsmWasmCode(Module));
   new Int32Array(buffer)[42 << 2] = 23;
diff --git a/src/v8/test/mjsunit/regress/regress-6703.js b/src/v8/test/mjsunit/regress/regress-6703.js
new file mode 100644
index 0000000..82bf21d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6703.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertTrue(/(\u039C)/i.test("\xB5"));
+assertTrue(/(\u039C)+/i.test("\xB5"));
+assertTrue(/(\u039C)/ui.test("\xB5"));
+assertTrue(/(\u039C)+/ui.test("\xB5"));
+
+assertTrue(/(\u03BC)/i.test("\xB5"));
+assertTrue(/(\u03BC)+/i.test("\xB5"));
+assertTrue(/(\u03BC)/ui.test("\xB5"));
+assertTrue(/(\u03BC)+/ui.test("\xB5"));
+
+assertTrue(/(\u03BC)/i.test("\u039C"));
+assertTrue(/(\u03BC)+/i.test("\u039C"));
+assertTrue(/(\u03BC)/ui.test("\u039C"));
+assertTrue(/(\u03BC)+/ui.test("\u039C"));
+
+assertTrue(/(\u0178)/i.test("\xFF"));
+assertTrue(/(\u0178)+/i.test("\xFF"));
+assertTrue(/(\u0178)/ui.test("\xFF"));
+assertTrue(/(\u0178)+/ui.test("\xFF"));
diff --git a/src/v8/test/mjsunit/regress/regress-6711.js b/src/v8/test/mjsunit/regress/regress-6711.js
new file mode 100644
index 0000000..c1b61c7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6711.js
@@ -0,0 +1,21 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// ensure `delete this` throws before `super` is called.
+assertThrows(()=>{
+  new class extends Object {
+    constructor() {
+      delete this;
+      super();
+    }
+  }
+}, ReferenceError);
+
+// ensure `delete this` doesn't throw after `super` is called.
+new class extends Object {
+  constructor() {
+    super();
+    delete this;
+  }
+}
diff --git a/src/v8/test/mjsunit/regress/regress-673242.js b/src/v8/test/mjsunit/regress/regress-673242.js
index ceb60f5..c2388d2 100644
--- a/src/v8/test/mjsunit/regress/regress-673242.js
+++ b/src/v8/test/mjsunit/regress/regress-673242.js
@@ -5,13 +5,15 @@
 // Flags: --mark-shared-functions-for-tier-up  --allow-natives-syntax --expose-gc
 
 function foo() {
-  function bar() {
-  }
+  function bar() {};
+  %PrepareFunctionForOptimization(bar);
   return bar;
 }
 
 // Mark bar's shared function info for tier-up
 // (but don't optimize).
+;
+%PrepareFunctionForOptimization(foo);
 var bar = foo();
 %OptimizeFunctionOnNextCall(bar);
 
diff --git a/src/v8/test/mjsunit/regress/regress-681383.js b/src/v8/test/mjsunit/regress/regress-681383.js
index e8c3593..ba8cf17 100644
--- a/src/v8/test/mjsunit/regress/regress-681383.js
+++ b/src/v8/test/mjsunit/regress/regress-681383.js
@@ -13,6 +13,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(f);
 f(false);
 f(false);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-682349.js b/src/v8/test/mjsunit/regress/regress-682349.js
index d94e069..f82f242 100644
--- a/src/v8/test/mjsunit/regress/regress-682349.js
+++ b/src/v8/test/mjsunit/regress/regress-682349.js
@@ -9,5 +9,5 @@
   success = (f.caller === null);
 }
 Promise.resolve().then(f);
-%RunMicrotasks();
+%PerformMicrotaskCheckpoint();
 assertTrue(success);
diff --git a/src/v8/test/mjsunit/regress/regress-683617.js b/src/v8/test/mjsunit/regress/regress-683617.js
index 18da682..0fba26b 100644
--- a/src/v8/test/mjsunit/regress/regress-683617.js
+++ b/src/v8/test/mjsunit/regress/regress-683617.js
@@ -10,7 +10,8 @@
   if (deopt) {
     return it.next().value;
   }
-}
+};
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-687.js b/src/v8/test/mjsunit/regress/regress-687.js
index a917a44..9dffcc1 100644
--- a/src/v8/test/mjsunit/regress/regress-687.js
+++ b/src/v8/test/mjsunit/regress/regress-687.js
@@ -29,9 +29,8 @@
 // update a accessor property to a data property using Object.defineProperty.
 
 var obj = { get value() {}, set value (v) { throw "Error";} };
-assertDoesNotThrow(
-    Object.defineProperty(obj, "value",
-                          { value: 5, writable:true, configurable: true }));
+Object.defineProperty(obj, "value",
+                      { value: 5, writable:true, configurable: true });
 var desc = Object.getOwnPropertyDescriptor(obj, "value");
 assertEquals(obj.value, 5);
 assertTrue(desc.configurable);
@@ -49,7 +48,7 @@
 var create = Object.create(proto);
 
 assertEquals(create.value, undefined);
-assertDoesNotThrow(create.value = 4);
+create.value = 4;
 assertEquals(create.value, 4);
 
 // These tests where provided in bug 959, but are all related to the this issue.
diff --git a/src/v8/test/mjsunit/regress/regress-6907.js b/src/v8/test/mjsunit/regress/regress-6907.js
index 0749365..dc58a58 100644
--- a/src/v8/test/mjsunit/regress/regress-6907.js
+++ b/src/v8/test/mjsunit/regress/regress-6907.js
@@ -13,7 +13,8 @@
     try { throw 0 } catch(e) {
       return b.forEach(callback);
     }
-  }
+  };
+  %PrepareFunctionForOptimization(f);
   f();
   f();
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-6941.js b/src/v8/test/mjsunit/regress/regress-6941.js
index a837083..aba4d5c 100644
--- a/src/v8/test/mjsunit/regress/regress-6941.js
+++ b/src/v8/test/mjsunit/regress/regress-6941.js
@@ -7,6 +7,7 @@
 function foo(x) {
   return Symbol.iterator == x;
 }
+%PrepareFunctionForOptimization(foo);
 
 function main() {
   foo(Symbol());
diff --git a/src/v8/test/mjsunit/regress/regress-6948.js b/src/v8/test/mjsunit/regress/regress-6948.js
index c7e0fae..4ebf6e1 100644
--- a/src/v8/test/mjsunit/regress/regress-6948.js
+++ b/src/v8/test/mjsunit/regress/regress-6948.js
@@ -8,6 +8,7 @@
 
 function foo(s) { return o[s]; }
 
+%PrepareFunctionForOptimization(foo);
 var s = 'c' + 'c';
 foo(s);
 foo(s);
diff --git a/src/v8/test/mjsunit/regress/regress-696651.js b/src/v8/test/mjsunit/regress/regress-696651.js
index 650c978..9a97dde 100644
--- a/src/v8/test/mjsunit/regress/regress-696651.js
+++ b/src/v8/test/mjsunit/regress/regress-696651.js
@@ -4,8 +4,12 @@
 
 // Flags: --allow-natives-syntax
 
-function get_a() { return "aaaaaaaaaaaaaa"; }
-function get_b() { return "bbbbbbbbbbbbbb"; }
+function get_a() {
+  return 'aaaaaaaaaaaaaa';
+}
+function get_b() {
+  return 'bbbbbbbbbbbbbb';
+}
 
 function get_string() {
   return get_a() + get_b();
@@ -13,8 +17,8 @@
 
 function prefix(s) {
   return s + get_string();
-}
-
+};
+%PrepareFunctionForOptimization(prefix);
 prefix("");
 prefix("");
 %OptimizeFunctionOnNextCall(prefix);
diff --git a/src/v8/test/mjsunit/regress/regress-698790.js b/src/v8/test/mjsunit/regress/regress-698790.js
index 8791cb5..c4c58ad 100644
--- a/src/v8/test/mjsunit/regress/regress-698790.js
+++ b/src/v8/test/mjsunit/regress/regress-698790.js
@@ -11,8 +11,11 @@
 
 // Same thing but using TF lowering.
 
-function make_cons_string(s) { return s + "aaaaaaaaaaaaaa"; }
-make_cons_string("");
+function make_cons_string(s) {
+  return s + 'aaaaaaaaaaaaaa';
+};
+%PrepareFunctionForOptimization(make_cons_string);
+make_cons_string('');
 %OptimizeFunctionOnNextCall(make_cons_string);
 var cons_str = make_cons_string("");
 new RegExp(cons_str);
diff --git a/src/v8/test/mjsunit/regress/regress-6989.js b/src/v8/test/mjsunit/regress/regress-6989.js
index b4a33c5..26035dd 100644
--- a/src/v8/test/mjsunit/regress/regress-6989.js
+++ b/src/v8/test/mjsunit/regress/regress-6989.js
@@ -7,6 +7,7 @@
 (function() {
   function foo(o) { o["x"] = 1; }
 
+  %PrepareFunctionForOptimization(foo);
   assertThrows(() => foo(undefined));
   assertThrows(() => foo(undefined));
   %OptimizeFunctionOnNextCall(foo);
@@ -17,6 +18,7 @@
 (function() {
   function foo(o) { o["x"] = 1; }
 
+  %PrepareFunctionForOptimization(foo);
   assertThrows(() => foo(null));
   assertThrows(() => foo(null));
   %OptimizeFunctionOnNextCall(foo);
@@ -27,6 +29,7 @@
 (function() {
   function foo(o) { return o["x"]; }
 
+  %PrepareFunctionForOptimization(foo);
   assertThrows(() => foo(undefined));
   assertThrows(() => foo(undefined));
   %OptimizeFunctionOnNextCall(foo);
@@ -37,6 +40,7 @@
 (function() {
   function foo(o) { return o["x"]; }
 
+  %PrepareFunctionForOptimization(foo);
   assertThrows(() => foo(null));
   assertThrows(() => foo(null));
   %OptimizeFunctionOnNextCall(foo);
@@ -47,6 +51,7 @@
 (function() {
   function foo(o) { o.x = 1; }
 
+  %PrepareFunctionForOptimization(foo);
   assertThrows(() => foo(undefined));
   assertThrows(() => foo(undefined));
   %OptimizeFunctionOnNextCall(foo);
@@ -57,6 +62,7 @@
 (function() {
   function foo(o) { o.x = 1; }
 
+  %PrepareFunctionForOptimization(foo);
   assertThrows(() => foo(null));
   assertThrows(() => foo(null));
   %OptimizeFunctionOnNextCall(foo);
@@ -67,6 +73,7 @@
 (function() {
   function foo(o) { return o.x; }
 
+  %PrepareFunctionForOptimization(foo);
   assertThrows(() => foo(undefined));
   assertThrows(() => foo(undefined));
   %OptimizeFunctionOnNextCall(foo);
@@ -77,6 +84,7 @@
 (function() {
   function foo(o) { return o.x; }
 
+  %PrepareFunctionForOptimization(foo);
   assertThrows(() => foo(null));
   assertThrows(() => foo(null));
   %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-6991.js b/src/v8/test/mjsunit/regress/regress-6991.js
index 1c6b976..e88b5e3 100644
--- a/src/v8/test/mjsunit/regress/regress-6991.js
+++ b/src/v8/test/mjsunit/regress/regress-6991.js
@@ -6,6 +6,7 @@
 
 function foo(o) { return o.x; }
 
+%PrepareFunctionForOptimization(foo);
 assertEquals(undefined, foo({}));
 assertEquals(undefined, foo(1));
 assertEquals(undefined, foo({}));
diff --git a/src/v8/test/mjsunit/regress/regress-7014-1.js b/src/v8/test/mjsunit/regress/regress-7014-1.js
index 6aadf91..c678087 100644
--- a/src/v8/test/mjsunit/regress/regress-7014-1.js
+++ b/src/v8/test/mjsunit/regress/regress-7014-1.js
@@ -8,6 +8,7 @@
   return s[5];
 }
 
+%PrepareFunctionForOptimization(foo);
 assertEquals("f", foo("abcdef"));
 assertEquals(undefined, foo("a"));
 %OptimizeFunctionOnNextCall(foo);
@@ -19,6 +20,7 @@
 String.prototype[5] = "5";
 
 assertEquals("f", foo("abcdef"));
+%PrepareFunctionForOptimization(foo);
 assertEquals("5", foo("a"));
 %OptimizeFunctionOnNextCall(foo);
 assertEquals("f", foo("abcdef"));
diff --git a/src/v8/test/mjsunit/regress/regress-7014-2.js b/src/v8/test/mjsunit/regress/regress-7014-2.js
index 057e170..6ec6df6 100644
--- a/src/v8/test/mjsunit/regress/regress-7014-2.js
+++ b/src/v8/test/mjsunit/regress/regress-7014-2.js
@@ -8,6 +8,7 @@
   return s[5];
 }
 
+%PrepareFunctionForOptimization(foo);
 assertEquals("f", foo("abcdef"));
 assertEquals(undefined, foo("a"));
 %OptimizeFunctionOnNextCall(foo);
@@ -23,6 +24,7 @@
 });
 
 assertEquals("f", foo("abcdef"));
+%PrepareFunctionForOptimization(foo);
 assertEquals("5", foo("a"));
 %OptimizeFunctionOnNextCall(foo);
 assertEquals("f", foo("abcdef"));
diff --git a/src/v8/test/mjsunit/regress/regress-705934.js b/src/v8/test/mjsunit/regress/regress-705934.js
index 7dfc5bd..cd8ecc7 100644
--- a/src/v8/test/mjsunit/regress/regress-705934.js
+++ b/src/v8/test/mjsunit/regress/regress-705934.js
@@ -2,12 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-named-captures --stack-size=100
+// Flags: --stack-size=100
 
 function call_replace_close_to_stack_overflow() {
   try {
     call_replace_close_to_stack_overflow();
-  } catch(e) {
+  } catch {
     "b".replace(/(b)/g);
   }
 }
diff --git a/src/v8/test/mjsunit/regress/regress-707066.js b/src/v8/test/mjsunit/regress/regress-707066.js
index b33b585..b5d70c2 100644
--- a/src/v8/test/mjsunit/regress/regress-707066.js
+++ b/src/v8/test/mjsunit/regress/regress-707066.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
-// Flags: --harmony-function-tostring
-
 // There was a bug in CreateDynamicFunction where a stack overflow
 // situation caused an assertion failure.
 
diff --git a/src/v8/test/mjsunit/regress/regress-707410.js b/src/v8/test/mjsunit/regress/regress-707410.js
index 4bacf8c..cc3f58c 100644
--- a/src/v8/test/mjsunit/regress/regress-707410.js
+++ b/src/v8/test/mjsunit/regress/regress-707410.js
@@ -5,6 +5,5 @@
 // Flags: --allow-natives-syntax
 
 var a = new Uint8Array(1024*1024);
-%ArrayBufferNeuter(a.buffer);
-var b = new Uint8Array(a);
-assertEquals(0, b.length);
+%ArrayBufferDetach(a.buffer);
+assertThrows(() => new Uint8Array(a));
diff --git a/src/v8/test/mjsunit/regress/regress-709782.js b/src/v8/test/mjsunit/regress/regress-709782.js
index e33f694..91fbb88 100644
--- a/src/v8/test/mjsunit/regress/regress-709782.js
+++ b/src/v8/test/mjsunit/regress/regress-709782.js
@@ -5,9 +5,13 @@
 // Flags: --allow-natives-syntax
 
 var a = [0];
-function bar(x) { return x; }
-function foo() { return a.reduce(bar); }
-
+function bar(x) {
+  return x;
+}
+function foo() {
+  return a.reduce(bar);
+};
+%PrepareFunctionForOptimization(foo);
 assertEquals(0, foo());
 assertEquals(0, foo());
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-7135.js b/src/v8/test/mjsunit/regress/regress-7135.js
index 2387241..3621dec 100644
--- a/src/v8/test/mjsunit/regress/regress-7135.js
+++ b/src/v8/test/mjsunit/regress/regress-7135.js
@@ -5,12 +5,14 @@
 // Flags: --allow-natives-syntax --opt
 
 function foo() { return -"0" }
+%PrepareFunctionForOptimization(foo);
 foo();
 %OptimizeFunctionOnNextCall(foo);
 foo();
 assertOptimized(foo);
 
 function bar() { return -"1" }
+%PrepareFunctionForOptimization(bar);
 bar();
 %OptimizeFunctionOnNextCall(bar);
 bar();
diff --git a/src/v8/test/mjsunit/regress/regress-718891.js b/src/v8/test/mjsunit/regress/regress-718891.js
index 209568d..80aa1ec 100644
--- a/src/v8/test/mjsunit/regress/regress-718891.js
+++ b/src/v8/test/mjsunit/regress/regress-718891.js
@@ -24,6 +24,7 @@
   // so that the closure doesn't leak in a dead register).
   (() => {
     var optimized_closure = ClosureFactory();
+    %PrepareFunctionForOptimization(optimized_closure);
     // Use .call to avoid the CallIC retaining the JSFunction in the
     // feedback vector via a weak map, which would mean it wouldn't be
     // collected in the minor gc below.
@@ -40,6 +41,7 @@
   // old->new remember set.
   (() => {
     var dummy = function() { return 1; };
+    %PrepareFunctionForOptimization(dummy);
     %OptimizeFunctionOnNextCall(dummy);
     dummy();
   })();
diff --git a/src/v8/test/mjsunit/regress/regress-7254.js b/src/v8/test/mjsunit/regress/regress-7254.js
new file mode 100644
index 0000000..3c514c4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-7254.js
@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function foo(a) {
+  a[0];
+  a[1] = "";
+}
+
+%PrepareFunctionForOptimization(foo);
+foo([0,0].map(x => x));
+foo([0,0].map(x => x));
+%OptimizeFunctionOnNextCall(foo);
+foo([0,0].map(x => x));
+assertOptimized(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-725858.js b/src/v8/test/mjsunit/regress/regress-725858.js
index 466673f..dbb6526 100644
--- a/src/v8/test/mjsunit/regress/regress-725858.js
+++ b/src/v8/test/mjsunit/regress/regress-725858.js
@@ -7,5 +7,6 @@
 function f() {}
 var src = 'f(' + '0,'.repeat(0x201f) + ')';
 var boom = new Function(src);
+%PrepareFunctionForOptimization(boom);
 %OptimizeFunctionOnNextCall(boom);
 boom();
diff --git a/src/v8/test/mjsunit/regress/regress-727662.js b/src/v8/test/mjsunit/regress/regress-727662.js
index 62b53b4..d7eed69 100644
--- a/src/v8/test/mjsunit/regress/regress-727662.js
+++ b/src/v8/test/mjsunit/regress/regress-727662.js
@@ -5,18 +5,18 @@
 // Flags: --allow-natives-syntax --expose-gc
 
 (function() {
-  function thingo(i, b) {
-    var s = b ? "ac" : "abcd";
-    i = i >>> 0;
-    if (i < s.length) {
-      var c = s.charCodeAt(i);
-      gc();
-      return c;
-    }
+function thingo(i, b) {
+  var s = b ? "ac" : "abcd";
+  i = i >>> 0;
+  if (i < s.length) {
+    var c = s.charCodeAt(i);
+    gc();
+    return c;
   }
-  thingo(0, true);
-  thingo(0, true);
-  %OptimizeFunctionOnNextCall(thingo);
-  thingo(0, true);
-
+};
+%PrepareFunctionForOptimization(thingo);
+thingo(0, true);
+thingo(0, true);
+%OptimizeFunctionOnNextCall(thingo);
+thingo(0, true);
 })();
diff --git a/src/v8/test/mjsunit/regress/regress-730254.js b/src/v8/test/mjsunit/regress/regress-730254.js
index 2db49ce..9241946 100644
--- a/src/v8/test/mjsunit/regress/regress-730254.js
+++ b/src/v8/test/mjsunit/regress/regress-730254.js
@@ -30,8 +30,9 @@
 var __v_0 = {};
 __v_0 = new Map();
 function __f_0() {
-  __v_0[0] --;
-}
+  __v_0[0]--;
+};
+%PrepareFunctionForOptimization(__f_0);
 __f_0();
 %OptimizeFunctionOnNextCall(__f_0);
 __f_0();
diff --git a/src/v8/test/mjsunit/regress/regress-7369.js b/src/v8/test/mjsunit/regress/regress-7369.js
new file mode 100644
index 0000000..de715ef
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-7369.js
@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals(-Infinity, 1/parseInt(-0.9));
+assertEquals(-Infinity, 1/parseInt("-0.9"));
+assertEquals(-Infinity, 1/parseInt(-0.09));
+assertEquals(-Infinity, 1/parseInt(-0.009));
diff --git a/src/v8/test/mjsunit/regress/regress-740694.js b/src/v8/test/mjsunit/regress/regress-740694.js
index f07eb1b..6f31fef 100644
--- a/src/v8/test/mjsunit/regress/regress-740694.js
+++ b/src/v8/test/mjsunit/regress/regress-740694.js
@@ -17,6 +17,6 @@
 var promise = __f_0();
 promise.then(assertUnreachable,
              err => { done = true; error = err });
-%RunMicrotasks();
+%PerformMicrotaskCheckpoint();
 assertTrue(error.startsWith('Error reading'));
 assertTrue(done);
diff --git a/src/v8/test/mjsunit/regress/regress-747075.js b/src/v8/test/mjsunit/regress/regress-747075.js
index 3b5116a..a04b490 100644
--- a/src/v8/test/mjsunit/regress/regress-747075.js
+++ b/src/v8/test/mjsunit/regress/regress-747075.js
@@ -2,13 +2,21 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --allow-natives-syntax
+
 r = [
   14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14,
   14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14
 ];
 
-
-for (i = -1; i < 100000; i++) {
-  r2 = r.map(function(y) {return y/64} );
+function f() {
+  r2 = r.map(function(y) {
+    return y / 64;
+  });
   assertTrue(r2[0] < 1);
-}
+};
+%PrepareFunctionForOptimization(f);
+for (let i = 0; i < 1000; ++i) f();
+for (let i = 0; i < 1000; ++i) f();
+%OptimizeFunctionOnNextCall(f);
+for (let i = 0; i < 1000; ++i) f();
diff --git a/src/v8/test/mjsunit/regress/regress-747825.js b/src/v8/test/mjsunit/regress/regress-747825.js
index f61693e..7be2323 100644
--- a/src/v8/test/mjsunit/regress/regress-747825.js
+++ b/src/v8/test/mjsunit/regress/regress-747825.js
@@ -12,6 +12,7 @@
   g(r);
 }
 
+%PrepareFunctionForOptimization(f);
 f(); f(); %OptimizeFunctionOnNextCall(f);  // Warm-up.
 
 var re;
diff --git a/src/v8/test/mjsunit/regress/regress-748069.js b/src/v8/test/mjsunit/regress/regress-748069.js
index e652cca..86c2f8f 100644
--- a/src/v8/test/mjsunit/regress/regress-748069.js
+++ b/src/v8/test/mjsunit/regress/regress-748069.js
@@ -2,6 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// This test gets very slow with slow asserts.
+// Flags: --noenable-slow-asserts
+
 try {
   var a = 'a'.repeat(1 << 28);
 } catch (e) {
diff --git a/src/v8/test/mjsunit/regress/regress-7510.js b/src/v8/test/mjsunit/regress/regress-7510.js
new file mode 100644
index 0000000..4cd562a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-7510.js
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function foo(a) {
+  for (const x of a) {
+    a[100] = 1;
+  }
+}
+
+%PrepareFunctionForOptimization(foo);
+foo([1]);
+foo([1]);
+%OptimizeFunctionOnNextCall(foo);
+foo([1]);
+%PrepareFunctionForOptimization(foo);
+%OptimizeFunctionOnNextCall(foo);
+foo([1]);
+assertOptimized(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-7642.js b/src/v8/test/mjsunit/regress/regress-7642.js
new file mode 100644
index 0000000..fa9f023
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-7642.js
@@ -0,0 +1,58 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-public-fields
+
+const a = [2];
+const b = [4];
+
+let log;
+
+class C {
+  constructor(...args) {
+    log = args;
+  }
+}
+
+class D extends C {
+  field = 42;
+  constructor() { super(1) };
+}
+assertEquals(42, (new D).field);
+assertEquals([1], log);
+
+class E extends C {
+  field = 42;
+  constructor() { super(...a) };
+}
+assertEquals(42, (new E).field);
+assertEquals([2], log);
+
+class F extends C {
+  field = 42;
+  constructor() { super(1, ...a) };
+}
+assertEquals(42, (new F).field);
+assertEquals([1, 2], log);
+
+class G extends C {
+  field = 42;
+  constructor() { super(1, ...a, 3) };
+}
+assertEquals(42, (new G).field);
+assertEquals([1, 2, 3], log);
+
+class H extends C {
+  field = 42;
+  constructor() { super(1, ...a, 3, ...b) };
+}
+assertEquals(42, (new H).field);
+assertEquals([1, 2, 3, 4], log);
+
+class I extends C {
+  field = 42;
+  constructor() { super(1, ...a, 3, ...b, 5) };
+}
+assertEquals(42, (new I).field);
+assertEquals([1, 2, 3, 4, 5], log);
diff --git a/src/v8/test/mjsunit/regress/regress-7652.js b/src/v8/test/mjsunit/regress/regress-7652.js
new file mode 100644
index 0000000..c83df25
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-7652.js
@@ -0,0 +1,26 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const splice = Array.prototype.splice;
+const unshift = Array.prototype.unshift;
+
+{
+  let a = {length: 2**53 - 1};
+  assertThrows(() => unshift.call(a, 42), TypeError);
+  assertEquals(unshift.call(a), 2**53 - 1);
+}
+
+{
+  let a = {length: 2**53 - 1};
+  assertThrows(() => splice.call(a, 0, 0, 42), TypeError);
+  assertEquals(splice.call(a, 0, 1, 42).length, 1);
+  assertEquals(a[0], 42);
+}
+
+{
+  let a = {length: 2**53 - 1, [Symbol.isConcatSpreadable]: true};
+  assertThrows(() => [42].concat(a), TypeError);
+  assertThrows(() => [, ].concat(a), TypeError);
+  assertThrows(() => [].concat(42, a), TypeError);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-7677.js b/src/v8/test/mjsunit/regress/regress-7677.js
new file mode 100644
index 0000000..0c951de
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-7677.js
@@ -0,0 +1,63 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+
+// Generate a frozen or sealed array-like object.
+function arraylike(freeze) {
+  let x;
+  const obj = {length: 42};
+  Object.defineProperty(obj, 5, {get() {return x}, set(y) {x = y}});
+  return freeze ? Object.freeze(obj) : Object.seal(obj);
+}
+
+// Array.prototype.fill
+{
+  const sealed = arraylike(false);
+  Array.prototype.fill.call(sealed, "foo", 5, 6);
+  assertEquals("foo", sealed[5]);
+  assertThrows(() => Array.prototype.fill.call(sealed, "foo"), TypeError);
+}{
+  const frozen = arraylike(true);
+  Array.prototype.fill.call(frozen, "foo", 5, 6);
+  assertEquals("foo", frozen[5]);
+  assertThrows(() => Array.prototype.fill.call(frozen, "foo"), TypeError);
+}
+
+// Array.prototype.shift
+{
+  const sealed = Object.seal({length: 0});
+  assertEquals(undefined, Array.prototype.shift.call(sealed));
+}{
+  const sealed = Object.seal({length: 42});
+  assertEquals(undefined, Array.prototype.shift.call(sealed));
+}{
+  let x;
+  let obj = {length: 42, [1]: "foo"};
+  Object.defineProperty(obj, 0, {get() {return x}, set(y) {x = y}});
+  const sealed = Object.seal(obj);
+  assertThrows(() => Array.prototype.shift.call(sealed), TypeError);
+  assertEquals("foo", sealed[0]);
+}{
+  const frozen = Object.freeze({length: 0});
+  assertThrows(() => Array.prototype.shift.call(frozen), TypeError);
+}
+
+// Array.prototype.splice
+{
+  const sealed = arraylike(false);
+  assertEquals([undefined], Array.prototype.splice.call(sealed, 5, 1, "foo"));
+  assertEquals("foo", sealed[5]);
+  assertThrows(() => Array.prototype.splice.call(sealed, 5, 0, "bar"),
+      TypeError);
+  assertEquals("foo", sealed[5]);
+}{
+  const frozen = arraylike(true);
+  assertThrows(() => Array.prototype.splice.call(frozen, 5, 1, "foo"),
+      TypeError);
+  assertEquals("foo", frozen[5]);
+  assertThrows(() => Array.prototype.splice.call(frozen, 5, 0, "bar"),
+      TypeError);
+  assertEquals("foo", frozen[5]);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-7716.js b/src/v8/test/mjsunit/regress/regress-7716.js
new file mode 100644
index 0000000..8ce8367
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-7716.js
@@ -0,0 +1,51 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+// Deeply nested target.
+
+let proxy = new Proxy(function(){}, {});
+for (let i = 0; i < 100000; i++) {
+  proxy = new Proxy(proxy, {});
+}
+
+// Ensure these nested calls don't segfault. They may not all throw exceptions
+// depending on whether the compiler is able to perform tail call optimization
+// on the affected routines.
+try { Reflect.apply(proxy, {}, []) } catch(_) {}
+try { Reflect.construct(proxy, []) } catch(_) {}
+try { Reflect.defineProperty(proxy, "x", {}) } catch(_) {}
+try { Reflect.deleteProperty(proxy, "x") } catch(_) {}
+try { Reflect.get(proxy, "x") } catch(_) {}
+try { Reflect.getOwnPropertyDescriptor(proxy, "x") } catch(_) {}
+try { Reflect.getPrototypeOf(proxy) } catch(_) {}
+try { Reflect.has(proxy, "x") } catch(_) {}
+try { Reflect.isExtensible(proxy) } catch(_) {}
+try { Reflect.ownKeys(proxy) } catch(_) {}
+try { Reflect.preventExtensions(proxy) } catch(_) {}
+try { Reflect.setPrototypeOf(proxy, {}) } catch(_) {}
+try { Reflect.set(proxy, "x", {}) } catch(_) {}
+
+
+// Recursive handler.
+
+function run(trap, ...args) {
+  let handler = {};
+  const proxy = new Proxy(function(){}, handler);
+  handler[trap] = (target, ...args) => Reflect[trap](proxy, ...args);
+  return Reflect[trap](proxy, ...args);
+}
+
+assertThrows(() => run("apply", {}, []), RangeError);
+assertThrows(() => run("construct", []), RangeError);
+assertThrows(() => run("defineProperty", "x", {}), RangeError);
+assertThrows(() => run("deleteProperty", "x"), RangeError);
+assertThrows(() => run("get", "x"), RangeError);
+assertThrows(() => run("getOwnPropertyDescriptor", "x"), RangeError);
+assertThrows(() => run("has", "x"), RangeError);
+assertThrows(() => run("isExtensible"), RangeError);
+assertThrows(() => run("ownKeys"), RangeError);
+assertThrows(() => run("preventExtensions"), RangeError);
+assertThrows(() => run("setPrototypeOf", {}), RangeError);
+assertThrows(() => run("set", "x", {}), RangeError);
diff --git a/src/v8/test/mjsunit/regress/regress-7740.js b/src/v8/test/mjsunit/regress/regress-7740.js
new file mode 100644
index 0000000..7da0cc7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-7740.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var x = 0;
+x = 42;
+
+function foo(a, b) {
+  let y = a < a;
+  if (b) x = y;
+};
+%PrepareFunctionForOptimization(foo);
+foo(1, false);
+foo(1, false);
+%OptimizeFunctionOnNextCall(foo);
+foo(1, true);
diff --git a/src/v8/test/mjsunit/regress/regress-774824.js b/src/v8/test/mjsunit/regress/regress-774824.js
index ca2decc..abb3671 100644
--- a/src/v8/test/mjsunit/regress/regress-774824.js
+++ b/src/v8/test/mjsunit/regress/regress-774824.js
@@ -9,8 +9,8 @@
   a.outOfObjectProperty = undefined;
   %DeoptimizeNow();
   return !a;
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-775888.js b/src/v8/test/mjsunit/regress/regress-775888.js
index 8aa809e..270d071 100644
--- a/src/v8/test/mjsunit/regress/regress-775888.js
+++ b/src/v8/test/mjsunit/regress/regress-775888.js
@@ -7,10 +7,10 @@
 function __f_7586(__v_27535) {
   let a = __v_27535.shift();
   return a;
-}
-
+};
+%PrepareFunctionForOptimization(__f_7586);
 function __f_7587() {
-  var __v_27536 = [ 1, 15, 16];
+  var __v_27536 = [1, 15, 16];
   __f_7586(__v_27536);
   __v_27536.unshift(__v_27536);
 }
diff --git a/src/v8/test/mjsunit/regress/regress-776309.js b/src/v8/test/mjsunit/regress/regress-776309.js
index 98a38c0..9ec4e7f 100644
--- a/src/v8/test/mjsunit/regress/regress-776309.js
+++ b/src/v8/test/mjsunit/regress/regress-776309.js
@@ -14,6 +14,7 @@
   %_DeoptimizeNow();
   return o.t;
 }
+%PrepareFunctionForOptimization(f);
 
 // Finish slack tracking for C.
 for (var i = 0; i < 1000; i++) new C();
diff --git a/src/v8/test/mjsunit/regress/regress-7773.js b/src/v8/test/mjsunit/regress/regress-7773.js
new file mode 100644
index 0000000..7930ae9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-7773.js
@@ -0,0 +1,71 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function testFunctionNames() {
+  let descriptor = {
+    value: '',
+    writable: false,
+    enumerable: false,
+    configurable: true
+  };
+  // Functions have a "name" property by default.
+  assertEquals(
+      descriptor, Object.getOwnPropertyDescriptor(function(){}, 'name'));
+  let a = { fn: function(){} };
+  assertSame('fn', a.fn.name);
+  descriptor.value = 'fn';
+  assertEquals(descriptor, Object.getOwnPropertyDescriptor(a.fn, 'name'));
+
+  let b = { __proto__: function(){} };
+  assertSame('', b.__proto__.name);
+  descriptor.value = '';
+  assertEquals(
+      descriptor, Object.getOwnPropertyDescriptor(b.__proto__, 'name'));
+
+  let c = { fn: function F(){} };
+  assertSame('F', c.fn.name);
+  descriptor.value = 'F';
+  assertEquals(descriptor, Object.getOwnPropertyDescriptor(c.fn, 'name'));
+
+  let d = { __proto__: function E(){} };
+  assertSame('E', d.__proto__.name);
+  descriptor.value = 'E';
+  assertEquals(
+      descriptor, Object.getOwnPropertyDescriptor(d.__proto__, 'name'));
+})();
+
+(function testClassNames() {
+  let descriptor = {
+    value: '',
+    writable: false,
+    enumerable: false,
+    configurable: true
+  };
+
+  // Anonymous classes do not have a "name" property by default.
+  assertSame(undefined, Object.getOwnPropertyDescriptor(class {}, 'name'));
+  descriptor.value = 'C';
+  assertEquals(descriptor, Object.getOwnPropertyDescriptor(class C {}, 'name'));
+
+  let a = { fn: class {} };
+  assertSame('fn', a.fn.name);
+  descriptor.value = 'fn';
+  assertEquals(descriptor, Object.getOwnPropertyDescriptor(a.fn, 'name'));
+
+  let b = { __proto__: class {} };
+  assertSame('', b.__proto__.name);
+  assertSame(
+      undefined, Object.getOwnPropertyDescriptor(b.__proto__, 'name'));
+
+  let c = { fn: class F {} };
+  assertSame('F', c.fn.name);
+  descriptor.value = 'F';
+  assertEquals(descriptor, Object.getOwnPropertyDescriptor(c.fn, 'name'));
+
+  let d = { __proto__: class F {} };
+  assertSame('F', d.__proto__.name);
+  descriptor.value = 'F';
+  assertEquals(
+      descriptor, Object.getOwnPropertyDescriptor(d.__proto__, 'name'));
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-778668.js b/src/v8/test/mjsunit/regress/regress-778668.js
index cb6a359..93bde12 100644
--- a/src/v8/test/mjsunit/regress/regress-778668.js
+++ b/src/v8/test/mjsunit/regress/regress-778668.js
@@ -3,6 +3,22 @@
 // found in the LICENSE file.
 
 (function () {
+  function f() {
+    arguments.length = -5;
+    Array.prototype.slice.call(arguments);
+  }
+  f('a')
+})();
+
+(function () {
+  function f() {
+    arguments.length = 2.3;
+    Array.prototype.slice.call(arguments);
+  }
+  f('a')
+})();
+
+(function () {
   function f( __v_59960) {
     arguments.length = -5;
     Array.prototype.slice.call(arguments);
@@ -13,7 +29,6 @@
 (function () {
   function f( __v_59960) {
     arguments.length = 2.3;
-    print(arguments.length);
     Array.prototype.slice.call(arguments);
   }
   f('a')
diff --git a/src/v8/test/mjsunit/regress/regress-7791.js b/src/v8/test/mjsunit/regress/regress-7791.js
new file mode 100644
index 0000000..9b4d2c4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-7791.js
@@ -0,0 +1,120 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+
+
+// Data property last.
+
+{
+  const o = {
+    get foo() { return 666 },
+    foo: 42,
+  };
+  assertEquals(42, Object.getOwnPropertyDescriptor(o, 'foo').value);
+}
+
+{
+  const o = {
+    set foo(_) { },
+    foo: 42,
+  };
+  assertEquals(42, Object.getOwnPropertyDescriptor(o, 'foo').value);
+}
+
+{
+  const o = {
+    get foo() { return 666 },
+    set foo(_) { },
+    foo: 42,
+  };
+  assertEquals(42, Object.getOwnPropertyDescriptor(o, 'foo').value);
+}
+
+{
+  const o = {
+    get foo() { return 666 },
+    set ['foo'.slice()](_) { },
+    foo: 42,
+  };
+  assertEquals(42, Object.getOwnPropertyDescriptor(o, 'foo').value);
+}
+
+{
+  const o = {
+    get ['foo'.slice()]() { return 666 },
+    set ['foo'.slice()](_) { },
+    foo: 42,
+  };
+  assertEquals(42, Object.getOwnPropertyDescriptor(o, 'foo').value);
+}
+
+
+// Data property first.
+
+{
+  const o = {
+    foo: 666,
+    get foo() { return 42 },
+  };
+  assertEquals(42, Object.getOwnPropertyDescriptor(o, 'foo').get());
+}
+
+{
+  const o = {
+    foo: 666,
+    set foo(_) { },
+  };
+  assertEquals(undefined, Object.getOwnPropertyDescriptor(o, 'foo').get);
+  assertEquals(undefined, Object.getOwnPropertyDescriptor(o, 'foo').value);
+}
+
+{
+  const o = {
+    foo: 666,
+    get foo() { return 42 },
+    set foo(_) { },
+  };
+  assertEquals(42, Object.getOwnPropertyDescriptor(o, 'foo').get());
+}
+
+{
+  const o = {
+    foo: 666,
+    get ['foo'.slice()]() { return 42 },
+    set foo(_) { },
+  };
+  assertEquals(42, Object.getOwnPropertyDescriptor(o, 'foo').get());
+}
+
+{
+  const o = {
+    foo: 666,
+    get ['foo'.slice()]() { return 42 },
+    set ['foo'](_) { },
+  };
+  assertEquals(42, Object.getOwnPropertyDescriptor(o, 'foo').get());
+}
+
+
+// Data property in the middle.
+
+{
+  const o = {
+    get foo() { return 42 },
+    foo: 666,
+    set foo(_) { },
+  };
+  assertEquals(undefined, Object.getOwnPropertyDescriptor(o, 'foo').get);
+  assertEquals(undefined, Object.getOwnPropertyDescriptor(o, 'foo').set());
+}
+
+{
+  const o = {
+    set foo(_) { },
+    foo: 666,
+    get foo() { return 42 },
+  };
+  assertEquals(42, Object.getOwnPropertyDescriptor(o, 'foo').get());
+}
diff --git a/src/v8/test/mjsunit/regress/regress-781218.js b/src/v8/test/mjsunit/regress/regress-781218.js
index f51e99f..e1b870b 100644
--- a/src/v8/test/mjsunit/regress/regress-781218.js
+++ b/src/v8/test/mjsunit/regress/regress-781218.js
@@ -6,7 +6,7 @@
 
 var m = new Map();
 
-function C() { }
+function C() {}
 
 // Make sure slack tracking kicks in and shrinks the default size to prevent
 // any further in-object properties.
@@ -17,10 +17,11 @@
 }
 
 // Warm up {f}.
+;
+%PrepareFunctionForOptimization(f);
 f(new C());
 f(new C());
 
-
 var o = new C();
 %HeapObjectVerify(o);
 
diff --git a/src/v8/test/mjsunit/regress/regress-782754.js b/src/v8/test/mjsunit/regress/regress-782754.js
index 608c48a..87d5bf1 100644
--- a/src/v8/test/mjsunit/regress/regress-782754.js
+++ b/src/v8/test/mjsunit/regress/regress-782754.js
@@ -4,11 +4,14 @@
 
 // Flags: --allow-natives-syntax
 
-let a = [1,2];
-function f(skip) { g(undefined, skip) }
+let a = [1, 2];
+function f(skip) {
+  g(undefined, skip);
+};
+%PrepareFunctionForOptimization(f);
 function g(x, skip) {
   if (skip) return;
-  return a[x+1];
+  return a[x + 1];
 }
 g(0, false);
 g(0, false);
diff --git a/src/v8/test/mjsunit/regress/regress-783051.js b/src/v8/test/mjsunit/regress/regress-783051.js
index 0e5af37..ee69bed 100644
--- a/src/v8/test/mjsunit/regress/regress-783051.js
+++ b/src/v8/test/mjsunit/regress/regress-783051.js
@@ -4,7 +4,10 @@
 
 // Flags: --allow-natives-syntax
 
-function f() { return Math.abs([][0]); }
+function f() {
+  return Math.abs([][0]);
+};
+%PrepareFunctionForOptimization(f);
 f();
 %OptimizeFunctionOnNextCall(f);
 f();
diff --git a/src/v8/test/mjsunit/regress/regress-7893.js b/src/v8/test/mjsunit/regress/regress-7893.js
new file mode 100644
index 0000000..5ed008e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-7893.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+function Module(stdlib, imports, buffer) {
+  "use asm";
+  function f() {
+    var bar = 0;
+    return 0x1e+bar|0;
+  }
+  return f;
+}
+var f = Module(this);
+assertTrue(%IsWasmCode(f));
+assertTrue(%IsAsmWasmCode(Module));
+assertEquals(0x1e, f());
diff --git a/src/v8/test/mjsunit/regress/regress-791334.mjs b/src/v8/test/mjsunit/regress/regress-791334.mjs
new file mode 100644
index 0000000..7e79b2e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-791334.mjs
@@ -0,0 +1,6 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let foo = () => { return this };
+assertEquals(undefined, foo());
diff --git a/src/v8/test/mjsunit/regress/regress-791958.js b/src/v8/test/mjsunit/regress/regress-791958.js
index 443ef6e..5b7e753 100644
--- a/src/v8/test/mjsunit/regress/regress-791958.js
+++ b/src/v8/test/mjsunit/regress/regress-791958.js
@@ -4,12 +4,15 @@
 
 // Flags: --allow-natives-syntax
 
-obj = {m: print};
+obj = {
+  m: print
+};
 function foo() {
   for (var x = -536870912; x != -536870903; ++x) {
     obj.m(-x >= 1000000 ? x % 1000000 : y);
   }
-}
+};
+%PrepareFunctionForOptimization(foo);
 foo();
 %OptimizeFunctionOnNextCall(foo);
 foo();
diff --git a/src/v8/test/mjsunit/regress/regress-793588.js b/src/v8/test/mjsunit/regress/regress-793588.js
index 6ad7a76..ea30d12 100644
--- a/src/v8/test/mjsunit/regress/regress-793588.js
+++ b/src/v8/test/mjsunit/regress/regress-793588.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
-
 assertNull(/a\P{Any}a/u.exec("a\u{d83d}a"));
 assertEquals(["a\u{d83d}a"], /a\p{Any}a/u.exec("a\u{d83d}a"));
 assertEquals(["a\u{d83d}a"], /(?:a\P{Any}a|a\p{Any}a)/u.exec("a\u{d83d}a"));
diff --git a/src/v8/test/mjsunit/regress/regress-793793.js b/src/v8/test/mjsunit/regress/regress-793793.js
index e89c5e5..f7f57c7 100644
--- a/src/v8/test/mjsunit/regress/regress-793793.js
+++ b/src/v8/test/mjsunit/regress/regress-793793.js
@@ -2,6 +2,4 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property
-
 assertThrows(() => new RegExp("\\1(\\P{P\0[}()/", "u"), SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-794822.js b/src/v8/test/mjsunit/regress/regress-794822.js
index c9b4600..bc769e7 100644
--- a/src/v8/test/mjsunit/regress/regress-794822.js
+++ b/src/v8/test/mjsunit/regress/regress-794822.js
@@ -9,11 +9,13 @@
   for (;;) {
     arg;
     yield;
-    function inner() { tmp }
+    function inner() {
+      tmp;
+    }
     break;
   }
-}
-
+};
+%PrepareFunctionForOptimization(opt);
 opt();
 %OptimizeFunctionOnNextCall(opt);
 opt();
diff --git a/src/v8/test/mjsunit/regress/regress-794825.js b/src/v8/test/mjsunit/regress/regress-794825.js
index 3709e8e..bd4f846 100644
--- a/src/v8/test/mjsunit/regress/regress-794825.js
+++ b/src/v8/test/mjsunit/regress/regress-794825.js
@@ -45,8 +45,8 @@
     } else {
       yield;
     }
-}
-
+};
+%PrepareFunctionForOptimization(opt);
 opt();
 // Optimize function to trigger the iteration over jump
 // table.
diff --git a/src/v8/test/mjsunit/regress/regress-797581.js b/src/v8/test/mjsunit/regress/regress-797581.js
index 17ac0ea..0613d1c 100644
--- a/src/v8/test/mjsunit/regress/regress-797581.js
+++ b/src/v8/test/mjsunit/regress/regress-797581.js
@@ -3,6 +3,11 @@
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax --harmony-dynamic-import
+// Resources: test/mjsunit/regress/modules-skip-regress-797581-1.js
+// Resources: test/mjsunit/regress/modules-skip-regress-797581-2.js
+// Resources: test/mjsunit/regress/modules-skip-regress-797581-3.js
+// Resources: test/mjsunit/regress/modules-skip-regress-797581-4.js
+// Resources: test/mjsunit/regress/modules-skip-regress-797581-5.js
 
 function TryToLoadModule(filename, expect_error, token) {
   let caught_error;
@@ -12,11 +17,11 @@
   }
 
   import(filename).catch(SetError);
-  %RunMicrotasks();
+  %PerformMicrotaskCheckpoint();
 
   if (expect_error) {
     assertTrue(caught_error instanceof SyntaxError);
-    assertEquals("Unexpected token " + token, caught_error.message);
+    assertEquals("Unexpected token '" + token + "'", caught_error.message);
   } else {
     assertEquals(undefined, caught_error);
   }
diff --git a/src/v8/test/mjsunit/regress/regress-800651.js b/src/v8/test/mjsunit/regress/regress-800651.js
new file mode 100644
index 0000000..05e31fe
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-800651.js
@@ -0,0 +1,31 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+var list = [];
+function log(item) { list.push(item); }
+async function f() {
+  try {
+    let namespace = await import(/a/);
+  } catch(e) {
+    log(1);
+  }
+}
+f();
+
+async function importUndefined() {
+  try {
+    await import({ get toString() { return undefined; }})
+  } catch(e) {
+    log(2);
+  }
+}
+
+function g() {
+  let namespace = Promise.resolve().then(importUndefined);
+}
+g();
+%PerformMicrotaskCheckpoint();
+assertEquals(list, [1,2]);
diff --git a/src/v8/test/mjsunit/regress/regress-802060.js b/src/v8/test/mjsunit/regress/regress-802060.js
index e975615..d223cd0 100644
--- a/src/v8/test/mjsunit/regress/regress-802060.js
+++ b/src/v8/test/mjsunit/regress/regress-802060.js
@@ -7,12 +7,13 @@
 function assertEquals(expected, found) {
   found.length !== expected.length;
 }
-assertEquals([], [])
+assertEquals([], []);
 assertEquals("a", "a");
 assertEquals([], []);
 function f() {
   assertEquals(0, undefined);
-}
+};
+%PrepareFunctionForOptimization(f);
 try {
   f();
 } catch (e) {
diff --git a/src/v8/test/mjsunit/regress/regress-8033.js b/src/v8/test/mjsunit/regress/regress-8033.js
new file mode 100644
index 0000000..437ca2a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-8033.js
@@ -0,0 +1,45 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("foo: if (true) do { continue foo } while (false)", SyntaxError);
+assertThrows("foo: if (true) while (false) { continue foo }", SyntaxError);
+assertThrows("foo: if (true) for (; false; ) { continue foo }", SyntaxError);
+assertThrows("foo: if (true) for (let x of []) { continue foo }", SyntaxError);
+assertThrows("foo: if (true) for (let x in []) { continue foo }", SyntaxError);
+
+assertThrows("foo: if (true) { do { continue foo } while (false) }", SyntaxError);
+assertThrows("foo: if (true) { while (false) { continue foo } }", SyntaxError);
+assertThrows("foo: if (true) { for (; false; ) { continue foo } }", SyntaxError);
+assertThrows("foo: if (true) { for (let x of []) { continue foo } }", SyntaxError);
+assertThrows("foo: if (true) { for (let x in []) { continue foo } }", SyntaxError);
+
+assertThrows("foo: goo: if (true) do { continue foo } while (false)", SyntaxError);
+assertThrows("foo: goo: if (true) while (false) { continue foo }", SyntaxError);
+assertThrows("foo: goo: if (true) for (; false; ) { continue foo }", SyntaxError);
+assertThrows("foo: goo: if (true) for (let x of []) { continue foo }", SyntaxError);
+assertThrows("foo: goo: if (true) for (let x in []) { continue foo }", SyntaxError);
+
+assertThrows("foo: goo: if (true) { do { continue foo } while (false) }", SyntaxError);
+assertThrows("foo: goo: if (true) { while (false) { continue foo } }", SyntaxError);
+assertThrows("foo: goo: if (true) { for (; false; ) { continue foo } }", SyntaxError);
+assertThrows("foo: goo: if (true) { for (let x of []) { continue foo } }", SyntaxError);
+assertThrows("foo: goo: if (true) { for (let x in []) { continue foo } }", SyntaxError);
+
+assertDoesNotThrow("if (true) foo: goo: do { continue foo } while (false)");
+assertDoesNotThrow("if (true) foo: goo: while (false) { continue foo }");
+assertDoesNotThrow("if (true) foo: goo: for (; false; ) { continue foo }");
+assertDoesNotThrow("if (true) foo: goo: for (let x of []) { continue foo }");
+assertDoesNotThrow("if (true) foo: goo: for (let x in []) { continue foo }");
+
+assertThrows("if (true) foo: goo: { do { continue foo } while (false) }", SyntaxError);
+assertThrows("if (true) foo: goo: { while (false) { continue foo } }", SyntaxError);
+assertThrows("if (true) foo: goo: { for (; false; ) { continue foo } }", SyntaxError);
+assertThrows("if (true) foo: goo: { for (let x of []) { continue foo } }", SyntaxError);
+assertThrows("if (true) foo: goo: { for (let x in []) { continue foo } }", SyntaxError);
+
+assertDoesNotThrow("if (true) { foo: goo: do { continue foo } while (false) }");
+assertDoesNotThrow("if (true) { foo: goo: while (false) { continue foo } }");
+assertDoesNotThrow("if (true) { foo: goo: for (; false; ) { continue foo } }");
+assertDoesNotThrow("if (true) { foo: goo: for (let x of []) { continue foo } }");
+assertDoesNotThrow("if (true) { foo: goo: for (let x in []) { continue foo } }");
diff --git a/src/v8/test/mjsunit/regress/regress-803750.js b/src/v8/test/mjsunit/regress/regress-803750.js
new file mode 100644
index 0000000..3541ff9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-803750.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Verify that very large arrays can be constructed.
+assertEquals(Array.isArray(Array.of.apply(Array, Array(65536))), true);
+assertEquals(Array.isArray(Array.of.apply(null, Array(65536))), true);
diff --git a/src/v8/test/mjsunit/regress/regress-804096.js b/src/v8/test/mjsunit/regress/regress-804096.js
new file mode 100644
index 0000000..43a2ef4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-804096.js
@@ -0,0 +1,12 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --opt
+
+for (let i = 0; i < 5000; i++) {
+  try {
+    [].reduce(function() {});
+  } catch (x) {
+  }
+}
diff --git a/src/v8/test/mjsunit/regress/regress-804176.js b/src/v8/test/mjsunit/regress/regress-804176.js
new file mode 100644
index 0000000..ab36c8c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-804176.js
@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const set_entries = [{}];
+set_entries[Symbol.iterator] = function() {};
+assertThrows(() => new Set(set_entries), TypeError);
+assertThrows(() => new WeakSet(set_entries), TypeError);
+
+const map_entries = [[{}, 1]];
+map_entries[Symbol.iterator] = function() {};
+assertThrows(() => new Set(map_entries), TypeError);
+assertThrows(() => new WeakSet(map_entries), TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-804177.js b/src/v8/test/mjsunit/regress/regress-804177.js
new file mode 100644
index 0000000..b100480
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-804177.js
@@ -0,0 +1,38 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Tests that insertion at the beginning via unshift won't crash when using a
+// constructor that creates an array larger than normal. (Also values inserted
+// by original constructor past the end should not survive into the result of
+// unshift).
+(function testUnshift() {
+  a = [1];
+  function f() {
+    return a;
+  }
+  b = Array.of.call(f);
+  b.unshift(2);
+  assertEquals(b, [2]);
+})();
+
+// Tests that insertion past the end won't expose values previously put into the
+// backing store by using a constructor that creates an array larger than normal.
+(function testInsertionPastEnd() {
+  a = [9,9,9,9];
+  function f() {
+    return a;
+  }
+  b = Array.of.call(f,1,2);
+  b[4] = 1;
+  assertEquals(b, [1, 2, undefined, undefined, 1]);
+})();
+
+// Tests that using Array.of with a constructor returning an object with an
+// unwriteable length throws a TypeError.
+(function testFrozenArrayThrows() {
+  function f() {
+    return Object.freeze([1,2,3]);
+  }
+  assertThrows(function() { Array.of.call(f); }, TypeError);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-804188.js b/src/v8/test/mjsunit/regress/regress-804188.js
new file mode 100644
index 0000000..72fe8ef
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-804188.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Object.defineProperty(Array.prototype, Symbol.iterator, {
+  value: function* () {}
+});
+const arrayIteratorProto = Object.getPrototypeOf([][Symbol.iterator]());
+arrayIteratorProto.next = function() {};
+
+assertThrows(() => new Map([[{}, 1], [{}, 2]]), TypeError);
+assertThrows(() => new WeakMap([[{}, 1], [{}, 2]]), TypeError);
+assertThrows(() => new Set([{}]), TypeError);
+assertThrows(() => new WeakSet([{}]), TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-804288.js b/src/v8/test/mjsunit/regress/regress-804288.js
new file mode 100644
index 0000000..6f7855d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-804288.js
@@ -0,0 +1,9 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var arr = [{}];
+Object.setPrototypeOf(arr, {});
+var ta = new Uint8Array(arr);
+
+let kDeclNoLocals = 0;
diff --git a/src/v8/test/mjsunit/regress/regress-804801.js b/src/v8/test/mjsunit/regress/regress-804801.js
new file mode 100644
index 0000000..daec8dc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-804801.js
@@ -0,0 +1,34 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f() { return 42; }
+const bound_function = f.bind();
+const callable_proxy = new Proxy(function(){}.__proto__, {});
+
+function testSet(ctor) {
+  new ctor([]);
+  new ctor([{},{}]);
+}
+
+function testMap(ctor) {
+  new ctor([]);
+  new ctor([[{},{}],[{},{}]]);
+}
+
+function testAllVariants(set_or_add_function) {
+  Set.prototype.add = set_or_add_function;
+  testSet(Set);
+
+  WeakSet.prototype.add = set_or_add_function;
+  testSet(WeakSet);
+
+  Map.prototype.set = set_or_add_function;
+  testMap(Map);
+
+  WeakMap.prototype.set = set_or_add_function;
+  testMap(WeakMap);
+}
+
+testAllVariants(bound_function);
+testAllVariants(callable_proxy);
diff --git a/src/v8/test/mjsunit/regress/regress-804837.js b/src/v8/test/mjsunit/regress/regress-804837.js
new file mode 100644
index 0000000..2844ff3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-804837.js
@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --opt --allow-natives-syntax
+
+var __v_25662 = [, 1.8];
+function __f_6214(__v_25668) {
+  __v_25662.reduce(() => {
+    1;
+  });
+};
+%PrepareFunctionForOptimization(__f_6214);
+__f_6214();
+__f_6214();
+%OptimizeFunctionOnNextCall(__f_6214);
+__f_6214();
diff --git a/src/v8/test/mjsunit/regress/regress-805729.js b/src/v8/test/mjsunit/regress/regress-805729.js
new file mode 100644
index 0000000..0703aa2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-805729.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+async function* asyncGenerator() {};
+let gen = asyncGenerator();
+gen.return({ get then() { delete this.then; gen.next(); } });
diff --git a/src/v8/test/mjsunit/regress/regress-805768.js b/src/v8/test/mjsunit/regress/regress-805768.js
new file mode 100644
index 0000000..e9aea27
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-805768.js
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  var a = [''];
+  print(a[0]);
+  return a;
+}
+
+function bar(a) {
+  a[0] = 'bazinga!';
+};
+%PrepareFunctionForOptimization(bar);
+for (var i = 0; i < 5; i++) bar([]);
+
+%OptimizeFunctionOnNextCall(bar);
+bar(foo());
+assertEquals([''], foo());
diff --git a/src/v8/test/mjsunit/regress/regress-812451.js b/src/v8/test/mjsunit/regress/regress-812451.js
new file mode 100644
index 0000000..8ccad1d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-812451.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+var x = [];
+function foo(x, p) {
+  x[p] = 5.3;
+}
+foo(x, 1);
+foo(x, 2);
+foo(x, -1);
+gc();
diff --git a/src/v8/test/mjsunit/regress/regress-8133-1.js b/src/v8/test/mjsunit/regress/regress-8133-1.js
new file mode 100644
index 0000000..8f3cc73
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-8133-1.js
@@ -0,0 +1,16 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const arr = [1, , 3];
+
+function mapper(x) {
+  Array.prototype[1] = 2;
+  return x + 1;
+}
+
+// This iterates over arr using the iterator protocol, which turns the hole into
+// undefined.  The mapper function then gets called in a separate iteration over
+// the acquired elements, where it increments undefined, which produces NaN and
+// gets converted to 0.
+assertArrayEquals([2, 0, 4], Uint16Array.from(arr, mapper));
diff --git a/src/v8/test/mjsunit/regress/regress-8133-2.js b/src/v8/test/mjsunit/regress/regress-8133-2.js
new file mode 100644
index 0000000..e163e3c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-8133-2.js
@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const arr = [1, , 3];
+
+function mapper(x) {
+  Array.prototype[1] = 2;
+  return x + 1;
+}
+
+// We force a direct iteration (using the array length, not the iterator
+// protocol). The mapper function gets called during this iteration, not in a
+// separate one. Hence when index 1 is read, 2 is retrieved from the prototype
+// and incremented to 3.
+Array.prototype[Symbol.iterator] = undefined;
+assertArrayEquals([2, 3, 4], Uint16Array.from(arr, mapper));
diff --git a/src/v8/test/mjsunit/regress/regress-813440.js b/src/v8/test/mjsunit/regress/regress-813440.js
new file mode 100644
index 0000000..f4df95d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-813440.js
@@ -0,0 +1,16 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --invoke-weak-callbacks --omit-quit --expose-wasm --allow-natives-syntax
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+const builder = new WasmModuleBuilder();
+builder.addFunction('f', kSig_i_v).addBody([kExprI32Const, 42]);
+const buffer = builder.toBuffer();
+// Start async compilation, but don't wait for it to finish.
+const module = WebAssembly.compile(buffer);
+
+// This create the collator.
+'퓛'.localeCompare();
diff --git a/src/v8/test/mjsunit/regress/regress-814643.js b/src/v8/test/mjsunit/regress/regress-814643.js
new file mode 100644
index 0000000..085c56f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-814643.js
@@ -0,0 +1,6 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Number.prototype.__proto__ = String.prototype;
+Uint8Array.from(1);
diff --git a/src/v8/test/mjsunit/regress/regress-816289.js b/src/v8/test/mjsunit/regress/regress-816289.js
new file mode 100644
index 0000000..4a3a4b6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-816289.js
@@ -0,0 +1,6 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+delete String.prototype[Symbol.iterator];
+Int8Array.from("anything");
diff --git a/src/v8/test/mjsunit/regress/regress-816317.js b/src/v8/test/mjsunit/regress/regress-816317.js
new file mode 100644
index 0000000..304786e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-816317.js
@@ -0,0 +1,12 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let a = new Float64Array(15);
+Object.defineProperty(a, "length", {
+  get: function () {
+    return 6;
+  }
+});
+delete a.__proto__.__proto__[Symbol.iterator];
+Float64Array.from(a);
diff --git a/src/v8/test/mjsunit/regress/regress-818070.js b/src/v8/test/mjsunit/regress/regress-818070.js
new file mode 100644
index 0000000..f94a01d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-818070.js
@@ -0,0 +1,38 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --opt --no-always-opt --allow-natives-syntax
+
+function f(a) {
+  Math.imul(a);
+}
+
+x = { [Symbol.toPrimitive]: () => FAIL };
+%PrepareFunctionForOptimization(f);
+f(1);
+f(1);
+%OptimizeFunctionOnNextCall(f);
+assertThrows(() => f(x), ReferenceError);
+
+function f(a) {
+  Math.pow(a);
+}
+
+x = { [Symbol.toPrimitive]: () => FAIL };
+%PrepareFunctionForOptimization(f);
+f(1);
+f(1);
+%OptimizeFunctionOnNextCall(f);
+assertThrows(() => f(x), ReferenceError);
+
+function f(a) {
+  Math.atan2(a);
+}
+
+x = { [Symbol.toPrimitive]: () => FAIL };
+%PrepareFunctionForOptimization(f);
+f(1);
+f(1);
+%OptimizeFunctionOnNextCall(f);
+assertThrows(() => f(x), ReferenceError);
diff --git a/src/v8/test/mjsunit/regress/regress-818438.js b/src/v8/test/mjsunit/regress/regress-818438.js
new file mode 100644
index 0000000..67f235d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-818438.js
@@ -0,0 +1,55 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function foo(b) {
+  [,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+   ...b];
+}
+Array.prototype.__defineSetter__("0", () => {});
+foo([3.3, 3.3, 3.3]);
+foo([{}, 3.3]);
diff --git a/src/v8/test/mjsunit/regress/regress-821137.js b/src/v8/test/mjsunit/regress/regress-821137.js
new file mode 100644
index 0000000..639b3b9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-821137.js
@@ -0,0 +1,27 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Tests that creating an iterator that shrinks the array populated by
+// Array.from does not lead to out of bounds writes.
+let oobArray = [];
+let maxSize = 1028 * 8;
+Array.from.call(function() { return oobArray }, {[Symbol.iterator] : _ => (
+  {
+    counter : 0,
+    next() {
+      let result = this.counter++;
+      if (this.counter > maxSize) {
+        oobArray.length = 0;
+        return {done: true};
+      } else {
+        return {value: result, done: false};
+      }
+    }
+  }
+) });
+assertEquals(oobArray.length, maxSize);
+
+// iterator reset the length to 0 just before returning done, so this will crash
+// if the backing store was not resized correctly.
+oobArray[oobArray.length - 1] = 0x41414141;
diff --git a/src/v8/test/mjsunit/regress/regress-821368.js b/src/v8/test/mjsunit/regress/regress-821368.js
new file mode 100644
index 0000000..8f8a01b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-821368.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const worker = new Worker("onmessage = function(){}", {type: 'string'});
+const buffer = new ArrayBuffer();
+worker.postMessage(buffer, [buffer]);
+try {
+  worker.postMessage(buffer, [buffer]);
+} catch (e) {
+  if (e != "ArrayBuffer could not be transferred") {
+    throw e;
+  }
+}
diff --git a/src/v8/test/mjsunit/regress/regress-8241.js b/src/v8/test/mjsunit/regress/regress-8241.js
new file mode 100644
index 0000000..fb9d547
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-8241.js
@@ -0,0 +1,6 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f(x) { }
+f(x=>x, [x,y] = [1,2]);
diff --git a/src/v8/test/mjsunit/regress/regress-8265.js b/src/v8/test/mjsunit/regress/regress-8265.js
new file mode 100644
index 0000000..ffe6191
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-8265.js
@@ -0,0 +1,12 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --random-seed=1
+
+for (let i = 0; i < 54; ++i) Math.random();
+let sum = 0;
+for (let i = 0; i < 10; ++i)
+  sum += Math.floor(Math.random() * 50);
+
+assertNotEquals(0, sum);
diff --git a/src/v8/test/mjsunit/regress/regress-8377.js b/src/v8/test/mjsunit/regress/regress-8377.js
new file mode 100644
index 0000000..32d2eb7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-8377.js
@@ -0,0 +1,24 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Module(global, env, buffer) {
+  "use asm";
+  function test1() {
+    var x = 0;
+    x = -1 / 1 | 0;
+    return x | 0;
+  }
+  function test2() {
+    var x = 0;
+    x = (-1 / 1) | 0;
+    return x | 0;
+  }
+  return { test1: test1, test2: test2 };
+};
+let module = Module(this);
+assertEquals(-1, module.test1());
+assertEquals(-1, module.test2());
+assertTrue(%IsAsmWasmCode(Module));
diff --git a/src/v8/test/mjsunit/regress/regress-8384.js b/src/v8/test/mjsunit/regress/regress-8384.js
new file mode 100644
index 0000000..c4d85e0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-8384.js
@@ -0,0 +1,65 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function assert(cond) {
+  if (!cond) throw 'Assert';
+}
+
+function Constructor() {
+  this.padding1 = null;
+  this.padding2 = null;
+  this.padding3 = null;
+  this.padding4 = null;
+  this.padding5 = null;
+  this.padding6 = null;
+  this.padding7 = null;
+  this.padding8 = null;
+  this.padding9 = null;
+  this.padding10 = null;
+  this.padding11 = null;
+  this.padding12 = null;
+  this.padding13 = null;
+  this.padding14 = null;
+  this.padding15 = null;
+  this.padding16 = null;
+  this.padding17 = null;
+  this.padding18 = null;
+  this.padding19 = null;
+  this.padding20 = null;
+  this.padding21 = null;
+  this.padding22 = null;
+  this.padding23 = null;
+  this.padding24 = null;
+  this.padding25 = null;
+  this.padding26 = null;
+  this.padding27 = null;
+  this.padding28 = null;
+  this.padding29 = null;
+  this.array = null;
+  this.accumulator = 0;
+}
+
+function f(k) {
+  var c = k.accumulator | 0;
+  k.accumulator = k.array[k.accumulator + 1 | 0] | 0;
+  k.array[c + 1 | 0] = -1;
+  var head = k.accumulator;
+  assert(head + c & 1);
+  while (head >= 0) {
+    head = k.array[head + 1 | 0];
+  }
+  return;
+};
+%PrepareFunctionForOptimization(f);
+const tmp = new Constructor();
+tmp.array = new Int32Array(5);
+for (var i = 1; i < 5; i++) tmp.array[i] = i | 0;
+tmp.accumulator = 0;
+
+f(tmp);
+f(tmp);
+%OptimizeFunctionOnNextCall(f);
+f(tmp);  // This must not trigger the {assert}.
diff --git a/src/v8/test/mjsunit/regress/regress-838766.js b/src/v8/test/mjsunit/regress/regress-838766.js
new file mode 100644
index 0000000..d342f80
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-838766.js
@@ -0,0 +1,15 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+  x = x | 2147483648;
+  return Number.parseInt(x + 65535, 8);
+};
+%PrepareFunctionForOptimization(foo);
+assertEquals(-72161, foo());
+assertEquals(-72161, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(-72161, foo());
diff --git a/src/v8/test/mjsunit/regress/regress-840106.js b/src/v8/test/mjsunit/regress/regress-840106.js
new file mode 100644
index 0000000..568ab75
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-840106.js
@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var buffer = new ArrayBuffer(1024 * 1024);
+buffer.constructor = {
+  [Symbol.species]: new Proxy(function() {}, {
+    get: _ => {
+      %ArrayBufferDetach(buffer);
+    }
+  })
+};
+var array1 = new Uint8Array(buffer, 0, 1024);
+assertThrows(() => new Uint8Array(array1));
+assertThrows(() => new Int8Array(array1));
diff --git a/src/v8/test/mjsunit/regress/regress-842078.js b/src/v8/test/mjsunit/regress/regress-842078.js
new file mode 100644
index 0000000..9ce6aec
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-842078.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-externalize-string
+
+// Attempt to externalize a string that's in RO_SPACE, which is not allowed as
+// the string's map would need to be writable.
+assertThrows(() => {
+  externalizeString("1", false)
+});
+assertThrows(() => {
+  externalizeString("1", true)
+});
diff --git a/src/v8/test/mjsunit/regress/regress-842612.js b/src/v8/test/mjsunit/regress/regress-842612.js
new file mode 100644
index 0000000..0ce4c04
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-842612.js
@@ -0,0 +1,16 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var arr = [undefined];
+
+function f() {
+  assertEquals(0, arr.indexOf(undefined, -1));
+};
+%PrepareFunctionForOptimization(f);
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-843062-1.js b/src/v8/test/mjsunit/regress/regress-843062-1.js
new file mode 100644
index 0000000..60ea65a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-843062-1.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var sparse_array = [];
+
+sparse_array[100] = 3;
+sparse_array[200] = undefined;
+sparse_array[300] = 4;
+sparse_array[400] = 5;
+sparse_array[500] = 6;
+sparse_array[600] = 5;
+sparse_array[700] = 4;
+sparse_array[800] = undefined;
+sparse_array[900] = 3
+sparse_array[41999] = "filler";
+
+sparse_array.lastIndexOf(3, 99);
diff --git a/src/v8/test/mjsunit/regress/regress-843062-2.js b/src/v8/test/mjsunit/regress/regress-843062-2.js
new file mode 100644
index 0000000..30170d5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-843062-2.js
@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+class C {
+  [1]() { return 'B'; }
+}
+Object.keys(C.prototype);
diff --git a/src/v8/test/mjsunit/regress/regress-843062-3.js b/src/v8/test/mjsunit/regress/regress-843062-3.js
new file mode 100644
index 0000000..638a26f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-843062-3.js
@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar(len) {
+  return new Array(len);
+};
+%PrepareFunctionForOptimization(bar);
+bar(0);
+%OptimizeFunctionOnNextCall(bar);
+bar(0);
diff --git a/src/v8/test/mjsunit/regress/regress-843543.js b/src/v8/test/mjsunit/regress/regress-843543.js
new file mode 100644
index 0000000..50e2de7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-843543.js
@@ -0,0 +1,19 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+const o = {
+  x: 9
+};
+o.__proto__ = Array.prototype;
+
+function foo(o) {
+  return o.indexOf(undefined);
+};
+%PrepareFunctionForOptimization(foo);
+assertEquals(-1, foo(o));
+assertEquals(-1, foo(o));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(-1, foo(o));
diff --git a/src/v8/test/mjsunit/regress/regress-8449.js b/src/v8/test/mjsunit/regress/regress-8449.js
new file mode 100644
index 0000000..32fa82a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-8449.js
@@ -0,0 +1,25 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+{
+  const x = [, 1];
+  x.__proto__ = [42];
+  const y = [...x];
+  assertEquals([42, 1], y);
+  assertTrue(y.hasOwnProperty(0));
+}
+
+{
+  const x = [, 1];
+  x.__proto__ = [42];
+  assertEquals(42, x[Symbol.iterator]().next().value);
+}
+
+{
+  const array_prototype = [].__proto__;
+  array_prototype[0] = 42;
+  const x = [, 1];
+  assertEquals(42, x[Symbol.iterator]().next().value);
+  delete array_prototype[0];
+}
diff --git a/src/v8/test/mjsunit/regress/regress-849663.js b/src/v8/test/mjsunit/regress/regress-849663.js
new file mode 100644
index 0000000..8e8304f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-849663.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const v1 = 0xFFFFFFFF;
+const v3 = new Float64Array();
+new Date(v3, v3, 0xFFFFFFFF,);
diff --git a/src/v8/test/mjsunit/regress/regress-8510.js b/src/v8/test/mjsunit/regress/regress-8510.js
new file mode 100644
index 0000000..bbaccd9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-8510.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stress-compaction --throws
+
+load('test/mjsunit/regress/regress-8510.js');
diff --git a/src/v8/test/mjsunit/regress/regress-852258.js b/src/v8/test/mjsunit/regress/regress-852258.js
new file mode 100644
index 0000000..0cf1a45
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-852258.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+try {
+  let ta0 = new Int16Array(0x24924925);
+  let ta2 = ta0.slice(1);
+  let ta1 = ta0.slice(0x24924924);
+} catch (e) {
+  // Allocation failed, that's fine.
+}
diff --git a/src/v8/test/mjsunit/regress/regress-852765.js b/src/v8/test/mjsunit/regress/regress-852765.js
new file mode 100644
index 0000000..13fbf46
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-852765.js
@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// The actual regression test
+assertThrows("(import(foo)) =>", SyntaxError, "Invalid destructuring assignment target");
+
+// Other related tests
+assertThrows("import(foo) =>", SyntaxError, "Malformed arrow function parameter list");
+assertThrows("(a, import(foo)) =>", SyntaxError, "Invalid destructuring assignment target");
+assertThrows("(1, import(foo)) =>", SyntaxError, "Invalid destructuring assignment target");
+assertThrows("(super(foo)) =>", SyntaxError, "'super' keyword unexpected here");
+assertThrows("(bar(foo)) =>", SyntaxError, "Invalid destructuring assignment target");
+
+// No syntax errors
+assertThrows("[import(foo).then] = [1];", ReferenceError, "foo is not defined");
+assertThrows("[[import(foo).then]] = [[1]];", ReferenceError, "foo is not defined");
diff --git a/src/v8/test/mjsunit/regress/regress-854066-2.js b/src/v8/test/mjsunit/regress/regress-854066-2.js
new file mode 100644
index 0000000..d37126b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-854066-2.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+oobArray = [];
+delete oobArray.__proto__[Symbol.iterator];
+for (let i = 0; i < 1e5; ++i) {
+  oobArray[i] = 1.1;
+}
+floatArray = new Float64Array(oobArray.length);
+Float64Array.from.call(function(length) {
+  oobArray.length = 0;
+  return floatArray;
+}, oobArray);
diff --git a/src/v8/test/mjsunit/regress/regress-854066.js b/src/v8/test/mjsunit/regress/regress-854066.js
new file mode 100644
index 0000000..418084b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-854066.js
@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+oobArray = [];
+for (let i = 0; i < 1e5; ++i) {
+  oobArray[i] = 1.1;
+}
+floatArray = new Float64Array(oobArray.length);
+Float64Array.from.call(function(length) {
+  oobArray.length = 0;
+  return floatArray;
+}, oobArray);
diff --git a/src/v8/test/mjsunit/regress/regress-8607.js b/src/v8/test/mjsunit/regress/regress-8607.js
new file mode 100644
index 0000000..9f77bc5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-8607.js
@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("[({ p: this }), [][0]] = x", SyntaxError);
+assertThrows("[...a, [][0]] = []", SyntaxError);
+assertThrows("[...o=1,[][0]] = []", SyntaxError);
+assertThrows("({x(){},y:[][0]} = {})", SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-862433.js b/src/v8/test/mjsunit/regress/regress-862433.js
new file mode 100644
index 0000000..015a45a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-862433.js
@@ -0,0 +1,9 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var arr = [];
+for (var i = 1; i != 390000; ++i) {
+  arr.push("f()");
+}
+new Function(arr.join());
diff --git a/src/v8/test/mjsunit/regress/regress-8630.js b/src/v8/test/mjsunit/regress/regress-8630.js
new file mode 100644
index 0000000..205fb1b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-8630.js
@@ -0,0 +1,33 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Parameters can't have parentheses (both patterns and identifiers)
+assertThrows("( ({x: 1}) ) => {};", SyntaxError);
+assertThrows("( (x) ) => {}", SyntaxError);
+assertThrows("( ({x: 1}) = y ) => {}", SyntaxError);
+assertThrows("( (x) = y ) => {}", SyntaxError);
+
+// Declarations can't have parentheses (both patterns and identifiers)
+assertThrows("let [({x: 1})] = [];", SyntaxError);
+assertThrows("let [(x)] = [];", SyntaxError);
+assertThrows("let [({x: 1}) = y] = [];", SyntaxError);
+assertThrows("let [(x) = y] = [];", SyntaxError);
+assertThrows("var [({x: 1})] = [];", SyntaxError);
+assertThrows("var [(x)] = [];", SyntaxError);
+assertThrows("var [({x: 1}) = y] = [];", SyntaxError);
+assertThrows("var [(x) = y] = [];", SyntaxError);
+
+// Patterns can't have parentheses in assignments either
+assertThrows("[({x: 1}) = y] = [];", SyntaxError);
+assertThrows("({a,b}) = {a:2,b:3}", SyntaxError);
+
+// Parentheses are fine around identifiers in assignments though, even inside a
+// pattern
+var x;
+[(x)] = [2];
+assertEquals(x, 2);
+[(x) = 3] = [];
+assertEquals(x, 3);
diff --git a/src/v8/test/mjsunit/regress/regress-863155.js b/src/v8/test/mjsunit/regress/regress-863155.js
new file mode 100644
index 0000000..fb5d465
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-863155.js
@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --always-opt
+
+for (let i = 0; i < 5; i++) {
+  try { typeof x } catch (e) {};
+  let x;
+}
diff --git a/src/v8/test/mjsunit/regress/regress-863810.js b/src/v8/test/mjsunit/regress/regress-863810.js
new file mode 100644
index 0000000..3bec6f5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-863810.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-liftoff --no-wasm-tier-up --no-future --debug-code
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addFunction('main', kSig_i_v)
+  .addBody([
+    kExprI64Const, 0xa3, 0x82, 0x83, 0x86, 0x8c, 0xd8, 0xae, 0xb5, 0x40,
+    kExprI32ConvertI64,
+    kExprI32Const, 0x00,
+    kExprI32Sub,
+  ]).exportFunc();
+const instance = builder.instantiate();
+print(instance.exports.main(1, 2, 3));
diff --git a/src/v8/test/mjsunit/regress/regress-865310.js b/src/v8/test/mjsunit/regress/regress-865310.js
new file mode 100644
index 0000000..17fe2cd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-865310.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+check = function() {
+  assertEquals(null, check.caller);
+};
+
+var obj = {};
+obj.valueOf = check;
+
+function f() {
+  Number(obj);
+};
+%PrepareFunctionForOptimization(f);
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-8659.js b/src/v8/test/mjsunit/regress/regress-8659.js
new file mode 100644
index 0000000..636c667
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-8659.js
@@ -0,0 +1,5 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("const [(x)] = []", SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-869735.js b/src/v8/test/mjsunit/regress/regress-869735.js
new file mode 100644
index 0000000..6338bc2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-869735.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+  return arguments.length;
+};
+%PrepareFunctionForOptimization(f);
+var a = [];
+%OptimizeFunctionOnNextCall(f);
+a.length = 81832;
+f(...a);
diff --git a/src/v8/test/mjsunit/regress/regress-8708.js b/src/v8/test/mjsunit/regress/regress-8708.js
new file mode 100644
index 0000000..4faff33
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-8708.js
@@ -0,0 +1,10 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stack-size=100
+
+let array = new Array(1);
+array.splice(1, 0, array);
+
+assertThrows(() => array.flat(Infinity), RangeError);
diff --git a/src/v8/test/mjsunit/regress/regress-875493.js b/src/v8/test/mjsunit/regress/regress-875493.js
new file mode 100644
index 0000000..81fbac4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-875493.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function test() {
+  const re = /./y;
+  re.lastIndex = 3;
+  const str = 'fg';
+  return re[Symbol.replace](str, '$');
+}
+
+%SetForceSlowPath(false);
+const fast = test();
+%SetForceSlowPath(true);
+const slow = test();
+%SetForceSlowPath(false);
+
+assertEquals(slow, fast);
diff --git a/src/v8/test/mjsunit/regress/regress-883059.js b/src/v8/test/mjsunit/regress/regress-883059.js
new file mode 100644
index 0000000..ed70fed
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-883059.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --random-seed=-1595876594 --disable-in-process-stack-traces  --no-lazy
+
+var __v_47 = ({[__v_46]: __f_52}) => { var __v_46 = 'b'; return __f_52; };
diff --git a/src/v8/test/mjsunit/regress/regress-889722.js b/src/v8/test/mjsunit/regress/regress-889722.js
new file mode 100644
index 0000000..c883dbe
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-889722.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function getRandomProperty(v, rand) {
+  var properties = Object.getOwnPropertyNames(v);
+  return properties[rand % properties.length];
+}
+r = Realm.create();
+o = Realm.eval(r, "() => { return Realm.global(-10) instanceof Object }");
+o.__p_211203344 = o[getRandomProperty(o, 211203344)];
diff --git a/src/v8/test/mjsunit/regress/regress-890553.js b/src/v8/test/mjsunit/regress/regress-890553.js
new file mode 100644
index 0000000..33f13e8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-890553.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var s = "function __f_9(func, testName) {" +
+  "var __v_0 = function __f_10(__v_14, __v_14) {" +
+  "  return __v_16;" +
+  "}; " +
+"}"
+assertThrows(function() { eval(s); });
diff --git a/src/v8/test/mjsunit/regress/regress-8913.js b/src/v8/test/mjsunit/regress/regress-8913.js
new file mode 100644
index 0000000..72dd492
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-8913.js
@@ -0,0 +1,17 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function foo(t) { return 'a'.concat(t); }
+
+%PrepareFunctionForOptimization(foo);
+foo(1);
+foo(1);
+%OptimizeFunctionOnNextCall(foo);
+foo(1);
+%PrepareFunctionForOptimization(foo);
+%OptimizeFunctionOnNextCall(foo);
+foo(1);
+assertOptimized(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-892858.js b/src/v8/test/mjsunit/regress/regress-892858.js
new file mode 100644
index 0000000..ec921e3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-892858.js
@@ -0,0 +1,32 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+async function foo() {
+  await Promise.resolve(42);
+}
+
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-8947.js b/src/v8/test/mjsunit/regress/regress-8947.js
new file mode 100644
index 0000000..17507b1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-8947.js
@@ -0,0 +1,49 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function testCallReexportedJSFunc() {
+ print(arguments.callee.name);
+
+  function dothrow() {
+    throw "exception";
+  }
+
+  var builder = new WasmModuleBuilder();
+  const imp_index = builder.addImport("w", "m", kSig_i_v);
+  builder.addExport("exp", imp_index);
+  var exp = builder.instantiate({w: {m: dothrow}}).exports.exp;
+
+  builder.addImport("w", "m", kSig_i_v);
+  builder.addFunction("main", kSig_i_v)
+    .addBody([
+      kExprCallFunction, 0, // --
+    ])                             // --
+    .exportFunc();
+
+  var main = builder.instantiate({w: {m: exp}}).exports.main;
+  assertThrowsEquals(main, "exception");
+})();
+
+(function testCallReexportedAPIFunc() {
+ print(arguments.callee.name);
+
+  var builder = new WasmModuleBuilder();
+  const imp_index = builder.addImport("w", "m", kSig_i_v);
+  builder.addExport("exp", imp_index);
+  var exp = builder.instantiate({w: {m: WebAssembly.Module}}).exports.exp;
+
+  builder.addImport("w", "m", kSig_i_v);
+  builder.addFunction("main", kSig_i_v)
+    .addBody([
+      kExprCallFunction, 0, // --
+    ])                             // --
+    .exportFunc();
+
+  var main = builder.instantiate({w: {m: exp}}).exports.main;
+  assertThrows(main, TypeError);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-895691.js b/src/v8/test/mjsunit/regress/regress-895691.js
new file mode 100644
index 0000000..7f2176c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-895691.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const n = 2 ** 32;
+const x = new Float32Array();
+
+function f() {
+  for (var i = 96; i < 100; i += 4) {
+    x[i] = i + n;
+  }
+};
+%PrepareFunctionForOptimization(f);
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-896326.js b/src/v8/test/mjsunit/regress/regress-896326.js
new file mode 100644
index 0000000..88c2e56
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-896326.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stack-size=100
+
+function f() {
+}
+
+var large_array = Array(150 * 1024);
+assertThrows('new f(... large_array)', RangeError);
diff --git a/src/v8/test/mjsunit/regress/regress-897366.js b/src/v8/test/mjsunit/regress/regress-897366.js
new file mode 100644
index 0000000..990e215
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-897366.js
@@ -0,0 +1,15 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --gc-interval=100
+
+let xs = [];
+for (let i = 0; i < 205; ++i) {
+  xs.push(i);
+}
+xs.sort((a, b) => {
+  xs.shift();
+  xs[xs.length] = -246;
+  return a - b;
+});
diff --git a/src/v8/test/mjsunit/regress/regress-897512.js b/src/v8/test/mjsunit/regress/regress-897512.js
new file mode 100644
index 0000000..649ee2b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-897512.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Fill up the Array prototype's elements.
+for (let i = 0; i < 100; i++) Array.prototype.unshift(3.14);
+
+// Create a holey double elements array.
+const o31 = [1.1];
+o31[37] = 2.2;
+
+// Concat converts to dictionary elements.
+const o51 = o31.concat(false);
+
+// Set one element to undefined to trigger the movement bug.
+o51[0] = undefined;
+
+assertEquals(o51.length, 39);
+
+// Sort triggers the bug.
+o51.sort();
+
+assertEquals(o51.length, 39);
diff --git a/src/v8/test/mjsunit/regress/regress-897815.js b/src/v8/test/mjsunit/regress/regress-897815.js
new file mode 100644
index 0000000..943e8c1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-897815.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function __f_19350() {
+  function __f_19351() {
+    function __f_19352() {
+    }
+  };
+  %PrepareFunctionForOptimization(__f_19351);
+  try {
+    __f_19350();
+  } catch (e) {
+  }
+  %OptimizeFunctionOnNextCall(__f_19351);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-898812.js b/src/v8/test/mjsunit/regress/regress-898812.js
new file mode 100644
index 0000000..889bd53
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-898812.js
@@ -0,0 +1,5 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("(async)(a)=>{}", SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-898936.js b/src/v8/test/mjsunit/regress/regress-898936.js
new file mode 100644
index 0000000..b32c469
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-898936.js
@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("async(...x=e)()=>");
diff --git a/src/v8/test/mjsunit/regress/regress-899115.js b/src/v8/test/mjsunit/regress/regress-899115.js
new file mode 100644
index 0000000..4e8af5f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-899115.js
@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  Object.getPrototypeOf([]).includes();
+};
+%PrepareFunctionForOptimization(foo);
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-899133.js b/src/v8/test/mjsunit/regress/regress-899133.js
new file mode 100644
index 0000000..4e11d49
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-899133.js
@@ -0,0 +1,5 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("let fun = ({a} = {a: 30}) => {", SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-899474.js b/src/v8/test/mjsunit/regress/regress-899474.js
new file mode 100644
index 0000000..ea16bb0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-899474.js
@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("class A {...", SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-899537.js b/src/v8/test/mjsunit/regress/regress-899537.js
new file mode 100644
index 0000000..3cd772c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-899537.js
@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+[ class  { c = [ c ] = c } ]
diff --git a/src/v8/test/mjsunit/regress/regress-900085.js b/src/v8/test/mjsunit/regress/regress-900085.js
new file mode 100644
index 0000000..5efaf7e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-900085.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(
+    "async function f() { let v = 1; for await (var v of {}) { }",
+    SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-9002.js b/src/v8/test/mjsunit/regress/regress-9002.js
new file mode 100644
index 0000000..94b4c93
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-9002.js
@@ -0,0 +1,36 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+function f() {
+  return 42;
+}
+
+function g() {
+  return 52;
+}
+
+%NeverOptimizeFunction(f);
+
+function foo(cond) {
+  let func;
+  if (cond) {
+    func = f;
+  } else {
+    func = g;
+  }
+  func();
+}
+
+%PrepareFunctionForOptimization(foo);
+foo(true);
+foo(false);
+%OptimizeFunctionOnNextCall(foo);
+foo(true);
+foo(false);
+
+// Just a sanitary check, we have a DCHECK in js-inlining.cc to make sure
+// f is not inlined into foo.
+assertUnoptimized(f);
diff --git a/src/v8/test/mjsunit/regress/regress-900585.js b/src/v8/test/mjsunit/regress/regress-900585.js
new file mode 100644
index 0000000..456f2c8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-900585.js
@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("/*for..in*/for(var [x5, functional] = this = function(id) { return id } in false) var x2, x;", SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-900786.js b/src/v8/test/mjsunit/regress/regress-900786.js
new file mode 100644
index 0000000..c012e3f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-900786.js
@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("{function g(){}function g(){+", SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-901633.js b/src/v8/test/mjsunit/regress/regress-901633.js
new file mode 100644
index 0000000..220926c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-901633.js
@@ -0,0 +1,24 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const magic0 = 2396;
+const magic1 = 1972;
+
+// Fill xs with float arrays.
+const xs = [];
+for (let j = 0; j < magic0; ++j) {
+  xs[j] = [j + 0.1];
+}
+
+// Sort, but trim the array at some point.
+let cmp_calls = 0;
+xs.sort((lhs, rhs) => {
+  lhs = lhs || [0];
+  rhs = rhs || [0];
+  if (cmp_calls++ == magic1) xs.length = 1;
+  return lhs[0] - rhs[0];
+});
+
+// The final shape of the array is unspecified since the comparison function is
+// inconsistent.
diff --git a/src/v8/test/mjsunit/regress/regress-9017.js b/src/v8/test/mjsunit/regress/regress-9017.js
new file mode 100644
index 0000000..1b9b9e7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-9017.js
@@ -0,0 +1,15 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Call a recursive function that uses large numbers of bound arguments. If we
+// are failing to touch consecutive guard pages on Windows when extending the
+// stack for bound arguments, then this would crash.
+
+const frameSize = 4096 * 5;
+const numValues = frameSize / 4;
+const arr = new Array(numValues);
+let counter = 10;
+function f() { --counter; return 1 + (counter > 0 ? bound() : 0); }
+const bound = f.bind.apply(f, arr);
+bound();
diff --git a/src/v8/test/mjsunit/regress/regress-901798.js b/src/v8/test/mjsunit/regress/regress-901798.js
new file mode 100644
index 0000000..a9a4d94
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-901798.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(a) {
+  return (a >>> 1073741824) + -3;
+};
+%PrepareFunctionForOptimization(f);
+assertEquals(-3, f(0));
+assertEquals(-2, f(1));
+%OptimizeFunctionOnNextCall(f);
+assertEquals(4294967291, f(-2));
diff --git a/src/v8/test/mjsunit/regress/regress-9022.js b/src/v8/test/mjsunit/regress/regress-9022.js
new file mode 100644
index 0000000..7922c39
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-9022.js
@@ -0,0 +1,30 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+function Module(stdlib, ffi) {
+  "use asm";
+  var log = ffi.log;
+  function boom() {
+    while (1) {
+      label: {
+        break;
+      }
+      log(1);
+      break;
+    }
+    log(2);
+  }
+  return { boom: boom }
+}
+
+var log_value = 0;
+function log(i) {
+  log_value += i;
+}
+
+Module({}, { log: log }).boom();
+assertTrue(%IsAsmWasmCode(Module));
+assertEquals(2, log_value);
diff --git a/src/v8/test/mjsunit/regress/regress-902552.js b/src/v8/test/mjsunit/regress/regress-902552.js
new file mode 100644
index 0000000..41a6ea8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-902552.js
@@ -0,0 +1,15 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+  var C = class {};
+  for (var i = 0; i < 4; ++i) {
+    if (i == 2) %OptimizeOsr();
+    C.prototype.foo = 42;
+  }
+}
+%PrepareFunctionForOptimization(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-902810.js b/src/v8/test/mjsunit/regress/regress-902810.js
new file mode 100644
index 0000000..76ea7d9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-902810.js
@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("((__v_4 = __v_4, __v_0) => eval(__v_4))()", ReferenceError)
diff --git a/src/v8/test/mjsunit/regress/regress-903527.js b/src/v8/test/mjsunit/regress/regress-903527.js
new file mode 100644
index 0000000..fe56d8c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-903527.js
@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("e*!`\\2`", SyntaxError)
diff --git a/src/v8/test/mjsunit/regress/regress-9036-1.js b/src/v8/test/mjsunit/regress/regress-9036-1.js
new file mode 100644
index 0000000..3569686
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-9036-1.js
@@ -0,0 +1,10 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function C() {};
+
+const p = new Proxy({}, { getPrototypeOf() { return C.prototype } });
+
+assertTrue(p instanceof C);
+assertTrue(p instanceof C);
diff --git a/src/v8/test/mjsunit/regress/regress-9036-2.js b/src/v8/test/mjsunit/regress/regress-9036-2.js
new file mode 100644
index 0000000..f5bb5c0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-9036-2.js
@@ -0,0 +1,10 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function C() {};
+
+const p = new Proxy({}, { getPrototypeOf() { return C.prototype } });
+
+assertTrue(C[Symbol.hasInstance](p));
+assertTrue(C[Symbol.hasInstance](p));
diff --git a/src/v8/test/mjsunit/regress/regress-9036-3.js b/src/v8/test/mjsunit/regress/regress-9036-3.js
new file mode 100644
index 0000000..ca97dc9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-9036-3.js
@@ -0,0 +1,11 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function C() {};
+
+const p = new Proxy({}, { getPrototypeOf() { return C.prototype } });
+const o = Object.create(p);
+
+assertTrue(o instanceof C);
+assertTrue(o instanceof C);
diff --git a/src/v8/test/mjsunit/regress/regress-903697.js b/src/v8/test/mjsunit/regress/regress-903697.js
new file mode 100644
index 0000000..ad2f560
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-903697.js
@@ -0,0 +1,16 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc --verify-heap
+
+function f() {
+  C = class {};
+  for (var i = 0; i < 5; ++i) {
+    gc();
+    if (i == 2) %OptimizeOsr();
+    C.prototype.foo = i + 9000000000000000;
+  }
+}
+%PrepareFunctionForOptimization(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-903874.js b/src/v8/test/mjsunit/regress/regress-903874.js
new file mode 100644
index 0000000..c1301eb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-903874.js
@@ -0,0 +1,6 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var code = "function f(" + ("{o(".repeat(10000));
+assertThrows(code, SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-904255.js b/src/v8/test/mjsunit/regress/regress-904255.js
new file mode 100644
index 0000000..dd24dbd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-904255.js
@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("((__v_0 = __v_0.replace(...new Array(), '0').slice(...new Int32Array(), '0')) => print())()", ReferenceError);
diff --git a/src/v8/test/mjsunit/regress/regress-904275.js b/src/v8/test/mjsunit/regress/regress-904275.js
new file mode 100644
index 0000000..10233d9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-904275.js
@@ -0,0 +1,30 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function __isPropertyOfType(obj, name) {
+    Object.getOwnPropertyDescriptor(obj, name)
+}
+function __getProperties(obj, type) {
+  for (let name of Object.getOwnPropertyNames(obj)) {
+    __isPropertyOfType(obj, name);
+  }
+}
+function __getRandomProperty(obj) {
+  let properties = __getProperties(obj);
+}
+function __f_6776(__v_33890, __v_33891) {
+  var __v_33896 = __v_33891();
+ __getRandomProperty([])
+}
+(function __f_6777() {
+  var __v_33906 = async () => { };
+    __f_6776(1, () => __v_33906())
+})();
+(function __f_6822() {
+  try {
+    __f_6776(1, () => __f_6822());
+  } catch (e) {}
+  var __v_34059 = async (__v_34079 = () => eval()) => { };
+    delete __v_34059[__getRandomProperty(__v_34059)];
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-904417.js b/src/v8/test/mjsunit/regress/regress-904417.js
new file mode 100644
index 0000000..90568dd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-904417.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar(o) {
+  return o.hello, Object.getPrototypeOf(o);
+};
+%PrepareFunctionForOptimization(bar);
+var y = { __proto__: {}, hello: 44 };
+var z = { hello: 45 };
+
+bar(y);
+bar(z);
+bar(y);
+%OptimizeFunctionOnNextCall(bar);
+bar(y);
diff --git a/src/v8/test/mjsunit/regress/regress-904707.js b/src/v8/test/mjsunit/regress/regress-904707.js
new file mode 100644
index 0000000..fdf89c2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-904707.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+delete Float64Array.prototype.__proto__[Symbol.iterator];
+
+let a = new Float64Array(9);
+Object.defineProperty(a, "length", {
+  get: function () { %ArrayBufferDetach(a.buffer); return 6; }
+});
+
+Float64Array.from(a);
diff --git a/src/v8/test/mjsunit/regress/regress-905587.js b/src/v8/test/mjsunit/regress/regress-905587.js
new file mode 100644
index 0000000..297846d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-905587.js
@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("function test() { '\\u`''\\u' }", SyntaxError)
diff --git a/src/v8/test/mjsunit/regress/regress-905907.js b/src/v8/test/mjsunit/regress/regress-905907.js
new file mode 100644
index 0000000..06bbb51
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-905907.js
@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var g = function f(a = 3) {
+  var context_allocated = undefined;
+  function inner() { f(); f(context_allocated) };
+  inner();
+};
+assertThrows("g()", RangeError);
diff --git a/src/v8/test/mjsunit/regress/regress-906406.js b/src/v8/test/mjsunit/regress/regress-906406.js
new file mode 100644
index 0000000..eb79ff0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-906406.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+for (x = 0; x < 10000; ++x) {
+    [(x) => x, [, 4294967295].find((x) => x), , 2].includes('x', -0);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-907479.js b/src/v8/test/mjsunit/regress/regress-907479.js
new file mode 100644
index 0000000..e3e1d09
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-907479.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+'use strict';
+
+{
+  const x = [42];
+  x.splice(0, 0, 23);
+  assertEquals([23, 42], x);
+  x.length++;
+  assertEquals([23, 42, ,], x);
+  assertFalse(x.hasOwnProperty(2));
+}
+
+{
+  const x = [4.2];
+  x.splice(0, 0, 23);
+  assertEquals([23, 4.2], x);
+  x.length++;
+  assertEquals([23, 4.2, ,], x);
+  assertFalse(x.hasOwnProperty(2));
+}
diff --git a/src/v8/test/mjsunit/regress/regress-907575.js b/src/v8/test/mjsunit/regress/regress-907575.js
new file mode 100644
index 0000000..2f63c3d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-907575.js
@@ -0,0 +1,6 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("0 || () =>", SyntaxError);
+assertThrows("++(a) =>", SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-907669.js b/src/v8/test/mjsunit/regress/regress-907669.js
new file mode 100644
index 0000000..155ff06
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-907669.js
@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("function f() { function g() { (); ", SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-908231.js b/src/v8/test/mjsunit/regress/regress-908231.js
new file mode 100644
index 0000000..8af5f30
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-908231.js
@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(`
+    class C {
+      get [(function() { function lazy() { Syntax Error } })()]() {}
+    }`, SyntaxError)
diff --git a/src/v8/test/mjsunit/regress/regress-908250.js b/src/v8/test/mjsunit/regress/regress-908250.js
new file mode 100644
index 0000000..78f071d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-908250.js
@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("(al,al,e={}=e)=>l", SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-908975.js b/src/v8/test/mjsunit/regress/regress-908975.js
new file mode 100644
index 0000000..b80f4ce
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-908975.js
@@ -0,0 +1,6 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+[] = [];
+a => 0
diff --git a/src/v8/test/mjsunit/regress/regress-9105.js b/src/v8/test/mjsunit/regress/regress-9105.js
new file mode 100644
index 0000000..bd73af0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-9105.js
@@ -0,0 +1,11 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let array = new Uint32Array(32);
+array[10] = 10; array[20] = 20;
+
+Array.prototype.sort.call(array);
+assertEquals(32, array.length);
+assertEquals(10, array[30]);
+assertEquals(20, array[31]);
diff --git a/src/v8/test/mjsunit/regress/regress-912162.js b/src/v8/test/mjsunit/regress/regress-912162.js
new file mode 100644
index 0000000..b661725
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-912162.js
@@ -0,0 +1,23 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = new Array();
+a.prototype = a;
+
+function f() {
+ a.length = 0x2000001;
+ a.push();
+}
+
+({}).__proto__ = a;
+
+f()
+f()
+
+a.length = 1;
+a.fill(-255);
+
+%HeapObjectVerify(a);
diff --git a/src/v8/test/mjsunit/regress/regress-913844.js b/src/v8/test/mjsunit/regress/regress-913844.js
new file mode 100644
index 0000000..3516f35
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-913844.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --disable-in-process-stack-traces --perf-prof-unwinding-info --turbo-loop-rotation
+for (var x = 0; x < 1000000; x++)
+;
diff --git a/src/v8/test/mjsunit/regress/regress-9165.js b/src/v8/test/mjsunit/regress/regress-9165.js
new file mode 100644
index 0000000..1de6e9d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-9165.js
@@ -0,0 +1,47 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-anyref
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+let kSig_r_i = makeSig([kWasmI32], [kWasmAnyRef]);
+
+(function TestMergeOfAnyFuncIntoAnyRef() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("merge", kSig_r_i)
+      .addLocals({anyref_count: 1, anyfunc_count: 1})
+      .addBody([
+        kExprGetLocal, 0,
+        kExprI32Eqz,
+        kExprIf, kWasmAnyRef,
+          kExprGetLocal, 1,
+        kExprElse,
+          kExprGetLocal, 2,
+        kExprEnd,
+      ]).exportFunc();
+  let instance = builder.instantiate();
+  assertEquals(null, instance.exports.merge(0));
+  assertEquals(null, instance.exports.merge(1));
+})();
+
+(function TestMergeOfAnyFuncIntoNullRef() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("merge", kSig_r_i)
+      .addLocals({anyfunc_count: 1})
+      .addBody([
+        kExprGetLocal, 0,
+        kExprI32Eqz,
+        kExprIf, kWasmAnyRef,
+          kExprRefNull,
+        kExprElse,
+          kExprGetLocal, 1,
+        kExprEnd,
+      ]).exportFunc();
+  let instance = builder.instantiate();
+  assertEquals(null, instance.exports.merge(0));
+  assertEquals(null, instance.exports.merge(1));
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-917215.js b/src/v8/test/mjsunit/regress/regress-917215.js
new file mode 100644
index 0000000..e8d7e10
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-917215.js
@@ -0,0 +1,6 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+a: if (true) b: { break a; break b; }
+else b: { break a; break b; }
diff --git a/src/v8/test/mjsunit/regress/regress-917755.js b/src/v8/test/mjsunit/regress/regress-917755.js
new file mode 100644
index 0000000..6cd4a24
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-917755.js
@@ -0,0 +1,17 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(`
+{
+    function a() {}
+}
+
+{
+    // Duplicate lexical declarations are only allowed if they are both sloppy
+    // block functions (see bug 4693). In this case the sloppy block function
+    // conflicts with the lexical variable declaration, causing a syntax error.
+    let a;
+    function a() {};
+}
+`, SyntaxError)
diff --git a/src/v8/test/mjsunit/regress/regress-917988.js b/src/v8/test/mjsunit/regress/regress-917988.js
new file mode 100644
index 0000000..e9a8458
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-917988.js
@@ -0,0 +1,31 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Tests if class declarations in parameter list are correctly handled.
+function v_2(
+v_3 = class v_4 {
+    get [[] = ';']() { }
+}
+) { }
+v_2();
+
+// Test object inside a class in a parameter list
+(function f(
+v_3 = class v_4 {
+    get [{} = ';']() { }
+}
+) { })();
+
+// Test destructuring of class in parameters
+(function f( {p, q} = class C { get [[] = ';']() {} } ) {})();
+
+// Test array destructuring of class in parameters
+class C {};
+C[Symbol.iterator] = function() {
+  return {
+    next: function() { return { done: true }; },
+    _first: true
+  };
+};
+(function f1([p, q] = class D extends C { get [[]]() {} }) { })();
diff --git a/src/v8/test/mjsunit/regress/regress-919340.js b/src/v8/test/mjsunit/regress/regress-919340.js
new file mode 100644
index 0000000..d28b505
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-919340.js
@@ -0,0 +1,17 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+var E = 'Σ';
+var PI = 123;
+function f() {
+  print(E = 2, /b/.test(E) || /b/.test(E = 2));
+  (E = 3) * PI;
+};
+%PrepareFunctionForOptimization(f);
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-919710.js b/src/v8/test/mjsunit/regress/regress-919710.js
new file mode 100644
index 0000000..1142295
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-919710.js
@@ -0,0 +1,5 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("( let ) => { 'use strict';  let }", SyntaxError)
diff --git a/src/v8/test/mjsunit/regress/regress-921382.js b/src/v8/test/mjsunit/regress/regress-921382.js
new file mode 100644
index 0000000..d7cce2b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-921382.js
@@ -0,0 +1,5 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("(d * f * g) * e => 0", SyntaxError)
diff --git a/src/v8/test/mjsunit/regress/regress-923723.js b/src/v8/test/mjsunit/regress/regress-923723.js
new file mode 100644
index 0000000..5a838e5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-923723.js
@@ -0,0 +1,14 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stack-size=50
+
+function __f_3() {
+  try {
+    __f_3();
+  } catch(e) {
+    eval("let fun = ({a} = {a: 30}) => {");
+  }
+}
+assertThrows(__f_3);
diff --git a/src/v8/test/mjsunit/regress/regress-926036.js b/src/v8/test/mjsunit/regress/regress-926036.js
new file mode 100644
index 0000000..3c8f49c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-926036.js
@@ -0,0 +1,5 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("async() => { for await (var a ;;) {} }", SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-930486.js b/src/v8/test/mjsunit/regress/regress-930486.js
new file mode 100644
index 0000000..8b4aafa
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-930486.js
@@ -0,0 +1,10 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var __v_49026 = function () {};
+
+__v_49026.prototype = undefined;
+__v_49026.x = 23;
+__v_49026.prototype = new ArrayBuffer();
+__v_49026.x = 2147483649;
diff --git a/src/v8/test/mjsunit/regress/regress-932953.js b/src/v8/test/mjsunit/regress/regress-932953.js
new file mode 100644
index 0000000..59d7499
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-932953.js
@@ -0,0 +1,63 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function NonExtensibleBetweenSetterAndGetter() {
+  o = {};
+  o.x = 42;
+  o.__defineGetter__('y', function() {});
+  Object.preventExtensions(o);
+  o.__defineSetter__('y', function() {});
+  o.x = 0.1;
+})();
+
+(function InterleavedIntegrityLevel() {
+  o = {};
+  o.x = 42;
+  o.__defineSetter__('y', function() {});
+  Object.preventExtensions(o);
+  o.__defineGetter__('y', function() {
+    return 44;
+  });
+  Object.seal(o);
+  o.x = 0.1;
+  assertEquals(44, o.y);
+})();
+
+(function TryUpdateRepeatedIntegrityLevel() {
+  function C() {
+    this.x = 0;
+    this.x = 1;
+    Object.preventExtensions(this);
+    Object.seal(this);
+  }
+
+  const o1 = new C();
+  const o2 = new C();
+  const o3 = new C();
+
+  function f(o) {
+    return o.x;
+  }
+
+  // Warm up the IC.
+  ;
+  %PrepareFunctionForOptimization(f);
+  f(o1);
+  f(o1);
+  f(o1);
+
+  // Reconfigure to double field.
+  o3.x = 0.1;
+
+  // Migrate o2 to the new shape.
+  f(o2);
+
+  %OptimizeFunctionOnNextCall(f);
+  f(o1);
+
+  assertTrue(%HaveSameMap(o1, o2));
+  assertTrue(%HaveSameMap(o1, o3));
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-933179.js b/src/v8/test/mjsunit/regress/regress-933179.js
new file mode 100644
index 0000000..a9e7f07
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-933179.js
@@ -0,0 +1,10 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var o = { ...{ length : 1 } };
+
+o.x = 1;
+delete o.x;
+
+o.length = 2;
diff --git a/src/v8/test/mjsunit/regress/regress-933776.js b/src/v8/test/mjsunit/regress/regress-933776.js
new file mode 100644
index 0000000..6736348
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-933776.js
@@ -0,0 +1,6 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+__v_51351 = /[^]$/gm;
+"a\nb\rc\n\rd\r\ne".replace(__v_51351, "*$1");
diff --git a/src/v8/test/mjsunit/regress/regress-936077.js b/src/v8/test/mjsunit/regress/regress-936077.js
new file mode 100644
index 0000000..2bc6dc5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-936077.js
@@ -0,0 +1,21 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --allow-natives-syntax
+// Flags: --concurrent-inlining --function-context-specialization
+
+function main() {
+  var obj = {};
+  function foo() {
+    return obj[0];
+  };
+  %PrepareFunctionForOptimization(foo);
+  ;
+  gc();
+  obj.x = 10;
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+}
+main();
+main();
diff --git a/src/v8/test/mjsunit/regress/regress-937681.js b/src/v8/test/mjsunit/regress/regress-937681.js
new file mode 100644
index 0000000..81af553
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-937681.js
@@ -0,0 +1,17 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const str = 'aaaa';
+
+const re0 = /./y;
+
+// Twice to go through both runtime and the builtin.
+re0.lastIndex = 9;
+assertEquals(str, re0[Symbol.replace](str, () => 42));
+re0.lastIndex = 9;
+assertEquals(str, re0[Symbol.replace](str, () => 42));
+re0.lastIndex = 9;
+assertEquals(str, re0[Symbol.replace](str, "42"));
+re0.lastIndex = 9;
+assertEquals(str, re0[Symbol.replace](str, "42"));
diff --git a/src/v8/test/mjsunit/regress/regress-9383.js b/src/v8/test/mjsunit/regress/regress-9383.js
new file mode 100644
index 0000000..8814955
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-9383.js
@@ -0,0 +1,50 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+// Flags: --throws --cache=code --enable-lazy-source-positions
+
+// Test ensures that the getters and setters are added in the same order in the
+// generated bytecode regardless of the isolate's hash seed. This gets tested
+// because of the use of the code cache.
+var c = {
+  get b() {
+  },
+  get getter() {
+  },
+  set a(n) {
+  },
+  set a(n) {
+  },
+  set setter1(n) {
+  },
+  set setter2(n) {
+  },
+  set setter3(n) {
+  },
+  set setter4(n) {
+  },
+  set setter5(n) {
+  },
+  set setter6(n) {
+  },
+  set setter7(n) {
+  },
+  set setter8(n) {
+  },
+  set setter9(n) {
+  },
+  set setter10(n) {
+  },
+  set setter11(n) {
+  },
+  set setter12(n) {
+  },
+  set setter12(n) {
+  },
+};
+
+for (x in c) {
+  print(x);
+}
+
+throw new Error();
diff --git a/src/v8/test/mjsunit/regress/regress-940361.js b/src/v8/test/mjsunit/regress/regress-940361.js
new file mode 100644
index 0000000..6dae01d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-940361.js
@@ -0,0 +1,21 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const re = /abc/;
+
+// Move the test method one prototype up.
+re.__proto__.__proto__.test = re.__proto__.test;
+delete re.__proto__.test;
+
+function foo(s) {
+  return re.test(s);
+};
+%PrepareFunctionForOptimization(foo);
+assertTrue(foo('abc'));
+assertTrue(foo('abc'));
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo('abc'));
+assertFalse(foo('ab'));
diff --git a/src/v8/test/mjsunit/regress/regress-940722.js b/src/v8/test/mjsunit/regress/regress-940722.js
new file mode 100644
index 0000000..355b7c3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-940722.js
@@ -0,0 +1,13 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stack-size=100
+
+var __v_27278 = "x";
+for (var __v_27279 = 0; __v_27279 != 13; __v_27279++) {
+  try { __v_27278 += __v_27278; } catch (e) {}
+}
+
+// Can throw or not, but should not crash.
+try { /(xx|x)*/.exec(__v_27278); } catch (e) {}
diff --git a/src/v8/test/mjsunit/regress/regress-944945.js b/src/v8/test/mjsunit/regress/regress-944945.js
new file mode 100644
index 0000000..8256eaf
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-944945.js
@@ -0,0 +1,6 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const E = '"use asm";\nfunction f() { LOCALS }\nreturn f;';
+const PI = new Function(E.replace('LOCALS', Array(999995).fill('0.9')));
diff --git a/src/v8/test/mjsunit/regress/regress-9466.js b/src/v8/test/mjsunit/regress/regress-9466.js
new file mode 100644
index 0000000..a3ddc0d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-9466.js
@@ -0,0 +1,10 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const o = [];
+o.__proto__ = {};
+o.constructor = function() {};
+o.constructor[Symbol.species] = function f() {};
+o.__proto__ = Array.prototype;
+assertEquals(o.constructor[Symbol.species], o.concat([1,2,3]).constructor);
diff --git a/src/v8/test/mjsunit/regress/regress-947822.js b/src/v8/test/mjsunit/regress/regress-947822.js
new file mode 100644
index 0000000..2857954
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-947822.js
@@ -0,0 +1,18 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let cnt = 0;
+const re = /x/y;
+const replacement = {
+  toString: () => {
+    cnt++;
+    if (cnt == 2) {
+      re.lastIndex = { valueOf: () => { re.x = -1073741825; return 7; }};
+    }
+    return 'y$';
+  }
+};
+
+const str = re[Symbol.replace]("x", replacement);
+assertEquals(str, "y$");
diff --git a/src/v8/test/mjsunit/regress/regress-948248.js b/src/v8/test/mjsunit/regress/regress-948248.js
new file mode 100644
index 0000000..61b1d19
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-948248.js
@@ -0,0 +1,8 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Non-ascii intrinsic calls shouldn't crash V8.
+assertThrows("%ಠ_ಠ()", SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-948307.js b/src/v8/test/mjsunit/regress/regress-948307.js
new file mode 100644
index 0000000..cb0fb34
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-948307.js
@@ -0,0 +1,15 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+const set = new WeakSet()
+const obj = {};
+// Two GCs to promote {set} and {obj} to old-space.
+gc();
+gc();
+// Allocate a large array so {obj} will become an evacuation candidate.
+const foo = new Int8Array(0x0F000000);
+// Trigger ephemeron key write barrier.
+set.add(obj);
diff --git a/src/v8/test/mjsunit/regress/regress-950328.js b/src/v8/test/mjsunit/regress/regress-950328.js
new file mode 100644
index 0000000..b8f3e56
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-950328.js
@@ -0,0 +1,45 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function NoStoreBecauseReadonlyLength() {
+  var a = [];
+  Object.defineProperty(a, 'length', { writable: false });
+
+
+  function f() {
+    var o = {__proto__: a};
+    o.push;
+  };
+  %PrepareFunctionForOptimization(f);
+  f();
+  f();
+  %OptimizeFunctionOnNextCall(f);
+
+  a[0] = 1.1;
+  f();
+  assertEquals(undefined, a[0]);
+})();
+
+(function NoStoreBecauseTypedArrayProto() {
+  const arr_proto = [].__proto__;
+  const arr = [];
+
+  function f() {
+    const i32arr = new Int32Array();
+
+    const obj = {};
+    obj.__proto__ = arr;
+    arr_proto.__proto__ = i32arr;
+    obj.__proto__ = arr;
+    arr_proto.__proto__ = i32arr;
+  };
+  %PrepareFunctionForOptimization(f);
+  f();
+  %OptimizeFunctionOnNextCall(f);
+  arr[1024] = [];
+  f();
+  assertEquals(undefined, arr[1024]);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-961237.js b/src/v8/test/mjsunit/regress/regress-961237.js
new file mode 100644
index 0000000..a1e57b7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-961237.js
@@ -0,0 +1,15 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const a = 1.1;
+const b = null;
+
+function f(x) { return -0 == (x ? a : b); }
+%PrepareFunctionForOptimization(f);
+assertEquals(false, f(true));
+assertEquals(false, f(true));
+%OptimizeFunctionOnNextCall(f);
+assertEquals(false, f(false));
diff --git a/src/v8/test/mjsunit/regress/regress-961508.js b/src/v8/test/mjsunit/regress/regress-961508.js
new file mode 100644
index 0000000..45ab0f8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-961508.js
@@ -0,0 +1,7 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --print-ast
+
+const foo = new class bar extends async function () {}.constructor {}();
diff --git a/src/v8/test/mjsunit/regress/regress-961709-classes-opt.js b/src/v8/test/mjsunit/regress/regress-961709-classes-opt.js
new file mode 100644
index 0000000..dfa6446
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-961709-classes-opt.js
@@ -0,0 +1,34 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+function foo(a, i) {
+  a[i] = 1;
+  return a[i];
+}
+
+class MyArray extends (class C extends Array {
+}){};
+
+o = new MyArray;
+
+%PrepareFunctionForOptimization(foo);
+assertEquals(1, foo(o, 0));
+assertEquals(1, foo(o, 1));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(1, foo(o, 2));
+assertOptimized(foo);
+
+// Change prototype
+o.__proto__.__proto__ = new Int32Array(3);
+
+
+// Check it still works
+assertEquals(undefined, foo(o, 3));
+assertUnoptimized(foo);
+%PrepareFunctionForOptimization(foo);
+assertEquals(undefined, foo(o, 3));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(undefined, foo(o, 3));
diff --git a/src/v8/test/mjsunit/regress/regress-961709-classes.js b/src/v8/test/mjsunit/regress/regress-961709-classes.js
new file mode 100644
index 0000000..a574321
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-961709-classes.js
@@ -0,0 +1,29 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+// Flags: --allow-natives-syntax
+
+function foo(a, i) {
+  a[i] = 1;
+  return a[i];
+}
+
+class MyArray extends (class C extends Array {
+}){};
+
+o = new MyArray;
+
+%EnsureFeedbackVectorForFunction(foo);
+// initialize IC
+assertEquals(1, foo(o, 0));
+assertEquals(1, foo(o, 1));
+
+// Change prototype
+o.__proto__.__proto__ = new Int32Array(2);
+
+
+// Check it still works
+assertEquals(undefined, foo(o, 2));
+assertEquals(undefined, foo(o, 2));
diff --git a/src/v8/test/mjsunit/regress/regress-962.js b/src/v8/test/mjsunit/regress/regress-962.js
index 85ada0c..7940055 100644
--- a/src/v8/test/mjsunit/regress/regress-962.js
+++ b/src/v8/test/mjsunit/regress/regress-962.js
@@ -52,6 +52,7 @@
 
 var ctx = new F;
 
+%PrepareFunctionForOptimization(F.prototype.foo);
 for (var i = 0; i < 5; i++) ctx.foo();
 %OptimizeFunctionOnNextCall(F.prototype.foo);
 ctx.foo();
diff --git a/src/v8/test/mjsunit/regress/regress-963891.js b/src/v8/test/mjsunit/regress/regress-963891.js
new file mode 100644
index 0000000..32a087a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-963891.js
@@ -0,0 +1,15 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var bar = true;
+bar = false;
+function foo() {
+  return !bar;
+};
+%PrepareFunctionForOptimization(foo);
+assertEquals(foo(), true);
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(foo(), true);
diff --git a/src/v8/test/mjsunit/regress/regress-97116.js b/src/v8/test/mjsunit/regress/regress-97116.js
index b858ca5..924348b 100644
--- a/src/v8/test/mjsunit/regress/regress-97116.js
+++ b/src/v8/test/mjsunit/regress/regress-97116.js
@@ -31,15 +31,17 @@
 // have a pending lazy deoptimization on the stack.
 
 function deopt() {
-  try { } catch (e) { }  // Avoid inlining.
+  try {
+  } catch (e) {
+  }  // Avoid inlining.
   %DeoptimizeFunction(outer);
   for (var i = 0; i < 10; i++) gc();  // Force code flushing.
 }
 
 function outer(should_deopt) {
   inner(should_deopt);
-}
-
+};
+%PrepareFunctionForOptimization(outer);
 function inner(should_deopt) {
   if (should_deopt) deopt();
 }
diff --git a/src/v8/test/mjsunit/regress/regress-97116b.js b/src/v8/test/mjsunit/regress/regress-97116b.js
index 91e7d6e..908109a 100644
--- a/src/v8/test/mjsunit/regress/regress-97116b.js
+++ b/src/v8/test/mjsunit/regress/regress-97116b.js
@@ -38,8 +38,8 @@
 
 function outer(should_deopt) {
   inner(should_deopt);
-}
-
+};
+%PrepareFunctionForOptimization(outer);
 function inner(should_deopt) {
   if (should_deopt) deopt();
 }
diff --git a/src/v8/test/mjsunit/regress/regress-976627.js b/src/v8/test/mjsunit/regress/regress-976627.js
new file mode 100644
index 0000000..1dde87e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-976627.js
@@ -0,0 +1,40 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --young-generation-large-objects
+
+function v2() {
+    const v8 = Symbol || 9007199254740991;
+    function v9(v10,v11,v12) {
+    }
+    const v16 = String();
+    const v100 = String();//add
+    const v106 = String();// add
+    const v116 = String();// add
+    const v17 = Int32Array();
+    const v18 = Map();
+    const v19 = [];
+    const v20 = v18.values();
+    function v21(v22,v23,v24,v25,v26) {
+    }
+    function v28(v29,v30,v31) {
+        function v32(v33,v34,v35,v36) {
+        }
+        let v39 = 0;
+        do {
+            const v40 = v32();
+            function v99() {
+            }
+        } while (v39 < 8);
+    }
+    const v41 = Promise();
+}
+const v46 = ["has",13.37,-9007199254740991,Reflect];
+for (let v50 = 64; v50 <= 2000; v50++) {
+    v46.push(v50,v2);
+}
+const v54 = RegExp(v46);
+const v55 = v54.exec();
+
+assertTrue(%HasElementsInALargeObjectSpace(v55));
diff --git a/src/v8/test/mjsunit/regress/regress-977870.js b/src/v8/test/mjsunit/regress/regress-977870.js
new file mode 100644
index 0000000..89175cc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-977870.js
@@ -0,0 +1,14 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f() {
+  v_0 = {};
+  Object.defineProperty(v_0, '0', {});
+  v_0.p_0 = 0;
+  assertArrayEquals(['0', 'p_0'],
+                    Object.getOwnPropertyNames(v_0));
+  assertArrayEquals(['0', 'p_0'],
+                    Object.getOwnPropertyNames(v_0));
+}
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-980891.js b/src/v8/test/mjsunit/regress/regress-980891.js
new file mode 100644
index 0000000..7d65932
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-980891.js
@@ -0,0 +1,15 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let str = "";
+
+// Many named captures force the resulting named capture backing store into
+// large object space.
+for (var i = 0; i < 0x2000; i++) str += "(?<a"+i+">)|";
+str += "(?<b>)";
+
+const regexp = new RegExp(str);
+const result = "xxx".match(regexp);
+
+assertNotNull(result);
diff --git a/src/v8/test/mjsunit/regress/regress-981236.js b/src/v8/test/mjsunit/regress/regress-981236.js
new file mode 100644
index 0000000..e6ff956
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-981236.js
@@ -0,0 +1,17 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var count = 0;
+function keyedSta(a) {
+  a[0] = {
+    valueOf() {
+      count += 1;
+      return 42n;
+    }
+  };
+};
+
+array1  = keyedSta(new BigInt64Array(1));
+var r = keyedSta(new BigInt64Array());
+assertEquals(count, 2);
diff --git a/src/v8/test/mjsunit/regress/regress-982702.js b/src/v8/test/mjsunit/regress/regress-982702.js
new file mode 100644
index 0000000..43a32d5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-982702.js
@@ -0,0 +1,21 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+class A {
+    static #foo = 3;
+    constructor() {
+      print(A.prototype.#foo);
+    }
+}
+
+assertThrows(() => new A(), TypeError);
+
+class B {
+  static #foo = 3;
+  constructor() {
+    B.prototype.#foo = 2;
+  }
+}
+
+assertThrows(() => new B(), TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-995.js b/src/v8/test/mjsunit/regress/regress-995.js
index 3f99179..cf680da 100644
--- a/src/v8/test/mjsunit/regress/regress-995.js
+++ b/src/v8/test/mjsunit/regress/regress-995.js
@@ -39,14 +39,6 @@
 }
 f(new String("bar"));
 
-// HClassOf.
-function g(value) {
-  if (%_ClassOf(value) === 'Date') {
-    if (%_ClassOf(value) === 'String') assertTrue(false);
-  }
-}
-g(new Date());
-
 // HIsNull.
 function h(value) {
   if (value == null) {
diff --git a/src/v8/test/mjsunit/regress/regress-add-minus-zero.js b/src/v8/test/mjsunit/regress/regress-add-minus-zero.js
index cb77cdf..9c0ddc9 100644
--- a/src/v8/test/mjsunit/regress/regress-add-minus-zero.js
+++ b/src/v8/test/mjsunit/regress/regress-add-minus-zero.js
@@ -29,9 +29,12 @@
 
 var o = { a: 0 };
 
-function f(x) { return -o.a + 0; };
-
-assertEquals("Infinity", String(1/f()));
-assertEquals("Infinity", String(1/f()));
+function f(x) {
+  return -o.a + 0;
+};
+%PrepareFunctionForOptimization(f);
+;
+assertEquals('Infinity', String(1 / f()));
+assertEquals('Infinity', String(1 / f()));
 %OptimizeFunctionOnNextCall(f);
-assertEquals("Infinity", String(1/f()));
+assertEquals('Infinity', String(1 / f()));
diff --git a/src/v8/test/mjsunit/regress/regress-alloc-smi-check.js b/src/v8/test/mjsunit/regress/regress-alloc-smi-check.js
index 295048a..8fcc793 100644
--- a/src/v8/test/mjsunit/regress/regress-alloc-smi-check.js
+++ b/src/v8/test/mjsunit/regress/regress-alloc-smi-check.js
@@ -8,8 +8,8 @@
 
 function f(a) {
   a[200000000] = x;
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f(new Array(100000));
 f([]);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-arg-materialize-store.js b/src/v8/test/mjsunit/regress/regress-arg-materialize-store.js
index 2a30dc8..d79e997 100644
--- a/src/v8/test/mjsunit/regress/regress-arg-materialize-store.js
+++ b/src/v8/test/mjsunit/regress/regress-arg-materialize-store.js
@@ -9,13 +9,13 @@
 }
 
 function g(deopt) {
-  var o = { x : 2 };
+  var o = {x: 2};
   f();
   o.x = 1;
   deopt + 0;
   return o.x;
-}
-
+};
+%PrepareFunctionForOptimization(g);
 g(0);
 g(0);
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/regress/regress-arguments-liveness-analysis.js b/src/v8/test/mjsunit/regress/regress-arguments-liveness-analysis.js
index 95c2c00..5525a4b 100644
--- a/src/v8/test/mjsunit/regress/regress-arguments-liveness-analysis.js
+++ b/src/v8/test/mjsunit/regress/regress-arguments-liveness-analysis.js
@@ -4,17 +4,20 @@
 
 // Flags: --allow-natives-syntax
 
-function r(v) { return v.f }
-function h() { }
+function r(v) {
+  return v.f;
+}
+function h() {}
 function y(v) {
   var x = arguments;
   h.apply(r(v), x);
 };
-
-y({f:3});
-y({f:3});
-y({f:3});
+%PrepareFunctionForOptimization(y);
+;
+y({f: 3});
+y({f: 3});
+y({f: 3});
 
 %OptimizeFunctionOnNextCall(y);
 
-y({ f : 3, u : 4 });
+y({f: 3, u: 4});
diff --git a/src/v8/test/mjsunit/regress/regress-arm64-spillslots.js b/src/v8/test/mjsunit/regress/regress-arm64-spillslots.js
index 1791b24..827090b 100644
--- a/src/v8/test/mjsunit/regress/regress-arm64-spillslots.js
+++ b/src/v8/test/mjsunit/regress/regress-arm64-spillslots.js
@@ -23,8 +23,8 @@
   var ret = [];
   ret.push(Inlined(input[0], 1, 2));
   return ret;
-}
-
+};
+%PrepareFunctionForOptimization(Process);
 var input = [new Message("TEST PASS")];
 
 Process(input);
diff --git a/src/v8/test/mjsunit/regress/regress-array-pop-deopt.js b/src/v8/test/mjsunit/regress/regress-array-pop-deopt.js
index 9a0d35d..ac8ffe5 100644
--- a/src/v8/test/mjsunit/regress/regress-array-pop-deopt.js
+++ b/src/v8/test/mjsunit/regress/regress-array-pop-deopt.js
@@ -27,13 +27,13 @@
 
 // Flags: --allow-natives-syntax
 
-var o = [6,7,8,9];
+var o = [6, 7, 8, 9];
 
 function f(b) {
   var v = o.pop() + b;
   return v;
-}
-
+};
+%PrepareFunctionForOptimization(f);
 assertEquals(10, f(1));
 assertEquals(9, f(1));
 assertEquals(8, f(1));
diff --git a/src/v8/test/mjsunit/regress/regress-arrow-single-expression-eval.js b/src/v8/test/mjsunit/regress/regress-arrow-single-expression-eval.js
new file mode 100644
index 0000000..83a9ca1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-arrow-single-expression-eval.js
@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+((x=1) => eval("var x = 10"))();
diff --git a/src/v8/test/mjsunit/regress/regress-bce-underflow.js b/src/v8/test/mjsunit/regress/regress-bce-underflow.js
index daa7760..0ab7cdf 100644
--- a/src/v8/test/mjsunit/regress/regress-bce-underflow.js
+++ b/src/v8/test/mjsunit/regress/regress-bce-underflow.js
@@ -15,6 +15,7 @@
   }
   return result;
 }
+%PrepareFunctionForOptimization(f);
 
 function f2(a, c, x, i, d) {
   return a[x + c] + a[x - 0] + a[i - d];
diff --git a/src/v8/test/mjsunit/regress/regress-binop.js b/src/v8/test/mjsunit/regress/regress-binop.js
index 7a8b419..0824804 100644
--- a/src/v8/test/mjsunit/regress/regress-binop.js
+++ b/src/v8/test/mjsunit/regress/regress-binop.js
@@ -37,6 +37,7 @@
 
 var x = {toString : function() {return 1}}
 function add(a,b){return a+b;}
+%PrepareFunctionForOptimization(add);
 add(1,x);
 add(1,x);
 %OptimizeFunctionOnNextCall(add);
@@ -85,6 +86,7 @@
 function minus(a,b) { return a-b };
 function check_minus(a,b) { return a-b };
 function mod(a,b) { return a%b };
+%PrepareFunctionForOptimization(mod);
 function check_mod(a,b) { return a%b };
 
 test(minus,check_minus,1,2);
@@ -124,16 +126,20 @@
 test(mod,check_mod,1,2);
 
 test(mod,check_mod,1<<30,1);
+%PrepareFunctionForOptimization(mod);
 %OptimizeFunctionOnNextCall(mod);
 test(mod,check_mod,1<<30,1);
 test(mod,check_mod,1,1<<30);
+%PrepareFunctionForOptimization(mod);
 %OptimizeFunctionOnNextCall(mod);
 test(mod,check_mod,1,1<<30);
 test(mod,check_mod,1<<30,-(1<<30));
+%PrepareFunctionForOptimization(mod);
 %OptimizeFunctionOnNextCall(mod);
 test(mod,check_mod,1<<30,-(1<<30));
 
 test(mod,check_mod,1,{},2);
+%PrepareFunctionForOptimization(mod);
 %OptimizeFunctionOnNextCall(mod);
 test(mod,check_mod,1,{},2);
 
@@ -172,6 +178,7 @@
   var d = [0.1, ,0.3];
   return a + d[i];
 }
+%PrepareFunctionForOptimization(string_add);
 
 string_add(1.1, 0);
 string_add("", 0);
diff --git a/src/v8/test/mjsunit/regress/regress-calls-with-migrating-prototypes.js b/src/v8/test/mjsunit/regress/regress-calls-with-migrating-prototypes.js
index a306e5d..fe2f368 100644
--- a/src/v8/test/mjsunit/regress/regress-calls-with-migrating-prototypes.js
+++ b/src/v8/test/mjsunit/regress/regress-calls-with-migrating-prototypes.js
@@ -28,22 +28,27 @@
 // Flags: --allow-natives-syntax
 
 function f() {
- return 1;
+  return 1;
 }
 function C1(f) {
- this.f = f;
+  this.f = f;
 }
 var o1 = new C1(f);
-var o2 = {__proto__: new C1(f) }
+var o2 = {__proto__: new C1(f)};
 function foo(o) {
- return o.f();
-}
+  return o.f();
+};
+%PrepareFunctionForOptimization(foo);
 foo(o1);
 foo(o1);
 foo(o2);
 foo(o1);
-var o3 = new C1(function() { return 2; });
+var o3 = new C1(function() {
+  return 2;
+});
 %OptimizeFunctionOnNextCall(foo);
 assertEquals(1, foo(o2));
-o2.__proto__.f = function() { return 3; };
+o2.__proto__.f = function() {
+  return 3;
+};
 assertEquals(3, foo(o2));
diff --git a/src/v8/test/mjsunit/regress/regress-captured-object-no-dummy-use.js b/src/v8/test/mjsunit/regress/regress-captured-object-no-dummy-use.js
index cdf548d..880d702 100644
--- a/src/v8/test/mjsunit/regress/regress-captured-object-no-dummy-use.js
+++ b/src/v8/test/mjsunit/regress/regress-captured-object-no-dummy-use.js
@@ -5,13 +5,16 @@
 // Flags: --allow-natives-syntax
 
 var global = "10.1";
-function f() { }
-function g(a) { this.d = a; }
+function f() {}
+function g(a) {
+  this.d = a;
+}
 function h() {
   var x = new f();
   global.dummy = this;
   var y = new g(x);
-}
+};
+%PrepareFunctionForOptimization(h);
 h();
 h();
 %OptimizeFunctionOnNextCall(h);
diff --git a/src/v8/test/mjsunit/regress/regress-charat-empty.js b/src/v8/test/mjsunit/regress/regress-charat-empty.js
new file mode 100644
index 0000000..32d60ed
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-charat-empty.js
@@ -0,0 +1,15 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --opt --no-always-opt --allow-natives-syntax
+(() => {
+  function f(s) {
+    return s.charAt();
+  };
+  %PrepareFunctionForOptimization(f);
+  f('');
+  f("");
+  %OptimizeFunctionOnNextCall(f);
+  f("");
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-check-eliminate-loop-phis.js b/src/v8/test/mjsunit/regress/regress-check-eliminate-loop-phis.js
index 3791c35..d89147d 100644
--- a/src/v8/test/mjsunit/regress/regress-check-eliminate-loop-phis.js
+++ b/src/v8/test/mjsunit/regress/regress-check-eliminate-loop-phis.js
@@ -15,6 +15,7 @@
   return result;
 }
 
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-clobbered-fp-regs.js b/src/v8/test/mjsunit/regress/regress-clobbered-fp-regs.js
index 7795ae9..cec9467 100644
--- a/src/v8/test/mjsunit/regress/regress-clobbered-fp-regs.js
+++ b/src/v8/test/mjsunit/regress/regress-clobbered-fp-regs.js
@@ -37,7 +37,7 @@
   var f7 = 0.7 * y;
   var f8 = 0.8 * y;
   a[0] = x;
-  var sum = (f1 + f2 + f3 + f4 + f5 + f6 + f7 + f8);
+  var sum = f1 + f2 + f3 + f4 + f5 + f6 + f7 + f8;
   assertEquals(1, y);
   var expected = 3.6;
   if (Math.abs(expected - sum) > 0.01) {
@@ -46,9 +46,11 @@
 }
 
 // Generate TransitionElementsKindStub.
+;
+%PrepareFunctionForOptimization(store);
 store([1], 1, 1);
 store([1], 1.1, 1);
 store([1], 1.1, 1);
 %OptimizeFunctionOnNextCall(store);
 // This will trap on allocation site in TransitionElementsKindStub.
-store([1], 1, 1)
+store([1], 1, 1);
diff --git a/src/v8/test/mjsunit/regress/regress-cntl-descriptors-enum.js b/src/v8/test/mjsunit/regress/regress-cntl-descriptors-enum.js
index fd4ac6d..ee30d07 100644
--- a/src/v8/test/mjsunit/regress/regress-cntl-descriptors-enum.js
+++ b/src/v8/test/mjsunit/regress/regress-cntl-descriptors-enum.js
@@ -27,13 +27,16 @@
 
 // Flags: --allow-natives-syntax --expose-gc
 
-DontEnum = 2;
-
 var o = {};
-%AddNamedProperty(o, "a", 0, DontEnum);
+Object.defineProperty(o, "a", {
+    value: 0, configurable: true, writable: true, enumerable: false
+});
 
 var o2 = {};
-%AddNamedProperty(o2, "a", 0, DontEnum);
+Object.defineProperty(o2, "a", {
+    value: 0, configurable: true, writable: true, enumerable: false
+});
+
 
 assertTrue(%HaveSameMap(o, o2));
 
diff --git a/src/v8/test/mjsunit/regress/regress-compare-constant-doubles.js b/src/v8/test/mjsunit/regress/regress-compare-constant-doubles.js
index 0f8ffe3..7485913 100644
--- a/src/v8/test/mjsunit/regress/regress-compare-constant-doubles.js
+++ b/src/v8/test/mjsunit/regress/regress-compare-constant-doubles.js
@@ -51,6 +51,7 @@
   right = 0.5 * base;
 }
 
+%PrepareFunctionForOptimization(foo);
 prepare(21);
 assertEquals("ok", foo());
 assertEquals("ok", foo());
diff --git a/src/v8/test/mjsunit/regress/regress-convert-hole.js b/src/v8/test/mjsunit/regress/regress-convert-hole.js
index 1e9c3f3..6e12aca 100644
--- a/src/v8/test/mjsunit/regress/regress-convert-hole.js
+++ b/src/v8/test/mjsunit/regress/regress-convert-hole.js
@@ -43,6 +43,7 @@
 }
 
 var a1 = [0, 0, 0, {}];
+%PrepareFunctionForOptimization(f_store);
 f_store(true, false, a1, 0);
 f_store(true, true, a1, 0);
 f_store(false, false, a1, 1);
@@ -72,6 +73,7 @@
   return d;
 }
 
+%PrepareFunctionForOptimization(f_call);
 f_call(test_arg(1.5), true, false, 0);
 f_call(test_arg(2.5), true, true, 0);
 f_call(test_arg(1), false, false, 1);
@@ -100,6 +102,7 @@
 }
 
 var a2 = new Int32Array(10);
+%PrepareFunctionForOptimization(f_external);
 f_external(true, false, true, a2, 0);
 f_external(true, true, true, a2, 0);
 f_external(false, false, true, a2, 1);
diff --git a/src/v8/test/mjsunit/regress/regress-convert-hole2.js b/src/v8/test/mjsunit/regress/regress-convert-hole2.js
index 02ef4dd..bd89077 100644
--- a/src/v8/test/mjsunit/regress/regress-convert-hole2.js
+++ b/src/v8/test/mjsunit/regress/regress-convert-hole2.js
@@ -34,6 +34,7 @@
   return l + v;
 }
 
+%PrepareFunctionForOptimization(f);
 assertEquals("test1.5", f(a, 0, "test"));
 assertEquals("test1.5", f(a, 0, "test"));
 %OptimizeFunctionOnNextCall(f);
@@ -51,6 +52,7 @@
   return "test" + v + x;
 }
 
+%PrepareFunctionForOptimization(f2);
 f2(true, [1.4,1.8,,1.9], [1.4,1.8,,1.9]);
 f2(true, [1.4,1.8,,1.9], [1.4,1.8,,1.9]);
 f2(false, [1.4,1.8,,1.9], [1.4,1.8,,1.9]);
@@ -63,6 +65,7 @@
   a[0] = 1.5;
 }
 
+%PrepareFunctionForOptimization(t_smi);
 t_smi([1,,3]);
 t_smi([1,,3]);
 t_smi([1,,3]);
@@ -77,6 +80,7 @@
   b[1] = {};
 }
 
+%PrepareFunctionForOptimization(t);
 t([1.4, 1.6,,1.8, NaN]);
 t([1.4, 1.6,,1.8, NaN]);
 %OptimizeFunctionOnNextCall(t);
diff --git a/src/v8/test/mjsunit/regress/regress-copy-hole-to-field.js b/src/v8/test/mjsunit/regress/regress-copy-hole-to-field.js
index fa3db92..2a74642 100644
--- a/src/v8/test/mjsunit/regress/regress-copy-hole-to-field.js
+++ b/src/v8/test/mjsunit/regress/regress-copy-hole-to-field.js
@@ -28,30 +28,30 @@
 // Flags: --allow-natives-syntax
 
 // Copy a hole from HOLEY_DOUBLE to double field.
-var a = [1.5,,1.7];
-var o = {a:1.8};
+var a = [1.5, , 1.7];
+var o = {a: 1.8};
 
-function f1(o,a,i) {
+function f1(o, a, i) {
   o.a = a[i];
-}
-
-f1(o,a,0);
-f1(o,a,0);
+};
+%PrepareFunctionForOptimization(f1);
+f1(o, a, 0);
+f1(o, a, 0);
 assertEquals(1.5, o.a);
 %OptimizeFunctionOnNextCall(f1);
-f1(o,a,1);
+f1(o, a, 1);
 assertEquals(undefined, o.a);
 
 // Copy a hole from HOLEY_SMI to smi field.
-var a = [1,,3];
-var o = {ab:5};
+var a = [1, , 3];
+var o = {ab: 5};
 
-function f2(o,a,i) {
+function f2(o, a, i) {
   o.ab = a[i];
-}
-
-f2(o,a,0);
-f2(o,a,0);
+};
+%PrepareFunctionForOptimization(f2);
+f2(o, a, 0);
+f2(o, a, 0);
 %OptimizeFunctionOnNextCall(f2);
-f2(o,a,1);
+f2(o, a, 1);
 assertEquals(undefined, o.ab);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-125148.js b/src/v8/test/mjsunit/regress/regress-crbug-125148.js
index 0f7bcd8..2f70d5b 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-125148.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-125148.js
@@ -44,6 +44,7 @@
 
 function bar(x) { return x.foo(); }
 
+%PrepareFunctionForOptimization(bar);
 assertEquals(111, bar(C));
 assertEquals(111, bar(C));
 ToDictionaryMode(B);
@@ -61,6 +62,7 @@
 
 function boo(x) { return x.baz; }
 
+%PrepareFunctionForOptimization(boo);
 assertEquals(111, boo(C));
 assertEquals(111, boo(C));
 ToDictionaryMode(B);
@@ -83,6 +85,7 @@
   return setterValue;
 }
 
+%PrepareFunctionForOptimization(fuu);
 assertEquals(111, fuu(C));
 assertEquals(111, fuu(C));
 ToDictionaryMode(B);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-134055.js b/src/v8/test/mjsunit/regress/regress-crbug-134055.js
index 9b658fb..c6d1151 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-134055.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-134055.js
@@ -29,8 +29,8 @@
 
 function crash(obj) {
   return obj.foo;
-}
-
+};
+%PrepareFunctionForOptimization(crash);
 function base(number_of_properties) {
   var result = new Array();
   for (var i = 0; i < number_of_properties; i++) {
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-134609.js b/src/v8/test/mjsunit/regress/regress-crbug-134609.js
index da7d85d..01129ae 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-134609.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-134609.js
@@ -27,18 +27,19 @@
 
 // Flags: --allow-natives-syntax --inline-accessors
 
-var forceDeopt = {x:0};
+var forceDeopt = {x: 0};
 
-var objectWithGetterProperty = (function (value) {
+var objectWithGetterProperty = function(value) {
   var obj = {};
-  Object.defineProperty(obj, "getterProperty", {
+  Object.defineProperty(obj, 'getterProperty', {
     get: function foo() {
       forceDeopt.x;
       return value;
-    },
+    }
   });
+
   return obj;
-})("bad");
+}('bad');
 
 function test() {
   var iAmContextAllocated = "good";
@@ -46,9 +47,11 @@
   return iAmContextAllocated;
 
   // Make sure that the local variable is context allocated.
-  function unused() { iAmContextAllocated; }
-}
-
+  function unused() {
+    iAmContextAllocated;
+  }
+};
+%PrepareFunctionForOptimization(test);
 assertEquals("good", test());
 assertEquals("good", test());
 %OptimizeFunctionOnNextCall(test);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-138887.js b/src/v8/test/mjsunit/regress/regress-crbug-138887.js
index 8d8e169..bd65e3b 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-138887.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-138887.js
@@ -40,9 +40,11 @@
 
 var f1 = factory(worker1);
 var f2 = factory(f1);
+%PrepareFunctionForOptimization(f1);
 assertEquals(11, f2(1));  // Result: 1 + f1(0) == 1 + 10.
 assertEquals(11, f2(1));
 %OptimizeFunctionOnNextCall(f1);
+%PrepareFunctionForOptimization(f2);
 assertEquals(10, f1(0));  // Terminates immediately -> returns 10.
 %OptimizeFunctionOnNextCall(f2);
 assertEquals(102, f2(1000));  // 1 + f1(999) == 1 + 1 + worker1(998) == 102
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-140083.js b/src/v8/test/mjsunit/regress/regress-crbug-140083.js
index e38192c..9554802 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-140083.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-140083.js
@@ -29,16 +29,19 @@
 
 // Test that the absence of a setter in a compound/count operation works.
 
-Object.defineProperty(Object.prototype, "foo",
-                      { get: function() { return 123; } });
+Object.defineProperty(Object.prototype, 'foo', {
+  get: function() {
+    return 123;
+  }
+});
 
 function bar(o) {
   o.foo += 42;
   o.foo++;
-}
-
+};
+%PrepareFunctionForOptimization(bar);
 var baz = {};
 bar(baz);
 bar(baz);
-%OptimizeFunctionOnNextCall(bar)
+%OptimizeFunctionOnNextCall(bar);
 bar(baz);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-142218.js b/src/v8/test/mjsunit/regress/regress-crbug-142218.js
index 373f83b..cc7d45f 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-142218.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-142218.js
@@ -32,8 +32,8 @@
 
 function insert_element(key) {
   a[key] = 42;
-}
-
+};
+%PrepareFunctionForOptimization(insert_element);
 insert_element(1);
 %OptimizeFunctionOnNextCall(insert_element);
 insert_element(new Object());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-145961.js b/src/v8/test/mjsunit/regress/regress-crbug-145961.js
index eb88945..ec981ed 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-145961.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-145961.js
@@ -31,8 +31,8 @@
   var a = new Int32Array(2);
   var x = a[0];
   return Math.min(x, x);
-}
-
+};
+%PrepareFunctionForOptimization(test);
 assertEquals(0, test());
 assertEquals(0, test());
 %OptimizeFunctionOnNextCall(test);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-147475.js b/src/v8/test/mjsunit/regress/regress-crbug-147475.js
index 180744c..2f0e750 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-147475.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-147475.js
@@ -40,8 +40,10 @@
 
 var f1 = factory(worker1);
 var f2 = factory(f1);
+%PrepareFunctionForOptimization(f1);
 assertEquals(11, f2(1));
 %OptimizeFunctionOnNextCall(f1);
+%PrepareFunctionForOptimization(f2);
 assertEquals(10, f1(0));
 %OptimizeFunctionOnNextCall(f2);
 assertEquals(102, f2(2));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-150545.js b/src/v8/test/mjsunit/regress/regress-crbug-150545.js
index cfee061..04c42a6 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-150545.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-150545.js
@@ -42,11 +42,16 @@
     assertSame(2, arguments[1]);
     assertSame(3, arguments[2]);
   }
+  %EnsureFeedbackVectorForFunction(inner);
 
   function outer() {
     inner(1,2,3);
-    for (var i = 0; i < 3; i++) %OptimizeOsr();
+    for (var i = 0; i < 3; i++) {
+      %OptimizeOsr();
+      %PrepareFunctionForOptimization(outer);
+    }
   }
+  %PrepareFunctionForOptimization(outer);
 
   outer();
 })();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-150729.js b/src/v8/test/mjsunit/regress/regress-crbug-150729.js
index 15aa587..cb0493e 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-150729.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-150729.js
@@ -32,7 +32,8 @@
   i = [t, 1];
   var M = [i[0], Math.cos(t) + i[7074959]];
   t += .05;
-}
+};
+%PrepareFunctionForOptimization(burn);
 for (var j = 0; j < 5; j++) {
   if (j == 2) %OptimizeFunctionOnNextCall(burn);
   burn();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-163530.js b/src/v8/test/mjsunit/regress/regress-crbug-163530.js
index 7abae14..32c6f5a 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-163530.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-163530.js
@@ -44,6 +44,7 @@
     return arguments.length;
   };
 
+  %PrepareFunctionForOptimization(object.a);
   assertSame(0, object.a());
   assertSame(0, object.a());
   %OptimizeFunctionOnNextCall(object.a);
@@ -71,6 +72,7 @@
     return arguments.length;
   };
 
+  %PrepareFunctionForOptimization(object.a);
   assertSame(8, object.a());
   assertSame(8, object.a());
   %OptimizeFunctionOnNextCall(object.a);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-173907.js b/src/v8/test/mjsunit/regress/regress-crbug-173907.js
index 9f92fef..df5055f 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-173907.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-173907.js
@@ -34,7 +34,9 @@
 var result = new Float64Array(2);
 
 function spill() {
-  try { } catch (e) { }
+  try {
+  } catch (e) {
+  }
 }
 
 function buggy() {
@@ -45,13 +47,13 @@
   spill();  // At this point initial values for phi1 and phi2 are spilled.
 
   var xmm1 = v;
-  var xmm2 = v*v*v;
-  var xmm3 = v*v*v*v;
-  var xmm4 = v*v*v*v*v;
-  var xmm5 = v*v*v*v*v*v;
-  var xmm6 = v*v*v*v*v*v*v;
-  var xmm7 = v*v*v*v*v*v*v*v;
-  var xmm8 = v*v*v*v*v*v*v*v*v;
+  var xmm2 = v * v * v;
+  var xmm3 = v * v * v * v;
+  var xmm4 = v * v * v * v * v;
+  var xmm5 = v * v * v * v * v * v;
+  var xmm6 = v * v * v * v * v * v * v;
+  var xmm7 = v * v * v * v * v * v * v * v;
+  var xmm8 = v * v * v * v * v * v * v * v * v;
 
   // All registers are blocked and phis for phi1 and phi2 are spilled because
   // their left (incoming) value is spilled, there are no free registers,
@@ -73,10 +75,10 @@
   // Now we want to get values of phi1 and phi2. However we would like to
   // do it in a way that does not produce any uses of phi1&phi2 that have
   // a register beneficial policy. How? We just hide these uses behind phis.
-  result[0] = (O === 0) ? phi1 : phi2;
-  result[1] = (O !== 0) ? phi1 : phi2;
-}
-
+  result[0] = O === 0 ? phi1 : phi2;
+  result[1] = O !== 0 ? phi1 : phi2;
+};
+%PrepareFunctionForOptimization(buggy);
 function test() {
   buggy();
   assertArrayEquals([X + K, X - K], result);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-173907b.js b/src/v8/test/mjsunit/regress/regress-crbug-173907b.js
index 4ecfd64..f01ac13 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-173907b.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-173907b.js
@@ -45,13 +45,13 @@
   spill();  // At this point initial values for phi1 and phi2 are spilled.
 
   var xmm1 = v;
-  var xmm2 = v*v*v;
-  var xmm3 = v*v*v*v;
-  var xmm4 = v*v*v*v*v;
-  var xmm5 = v*v*v*v*v*v;
-  var xmm6 = v*v*v*v*v*v*v;
-  var xmm7 = v*v*v*v*v*v*v*v;
-  var xmm8 = v*v*v*v*v*v*v*v*v;
+  var xmm2 = v * v * v;
+  var xmm3 = v * v * v * v;
+  var xmm4 = v * v * v * v * v;
+  var xmm5 = v * v * v * v * v * v;
+  var xmm6 = v * v * v * v * v * v * v;
+  var xmm7 = v * v * v * v * v * v * v * v;
+  var xmm8 = v * v * v * v * v * v * v * v * v;
 
   // All registers are blocked and phis for phi1 and phi2 are spilled because
   // their left (incoming) value is spilled, there are no free registers,
@@ -73,10 +73,10 @@
   // Now we want to get values of phi1 and phi2. However we would like to
   // do it in a way that does not produce any uses of phi1&phi2 that have
   // a register beneficial policy. How? We just hide these uses behind phis.
-  result[0] = (O === 0) ? phi1 : phi2;
-  result[1] = (O !== 0) ? phi1 : phi2;
-}
-
+  result[0] = O === 0 ? phi1 : phi2;
+  result[1] = O !== 0 ? phi1 : phi2;
+};
+%PrepareFunctionForOptimization(buggy);
 function test() {
   buggy();
   assertArrayEquals([X + K, X - K], result);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-173974.js b/src/v8/test/mjsunit/regress/regress-crbug-173974.js
index 905bd60..c273dd6 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-173974.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-173974.js
@@ -29,8 +29,9 @@
 
 function f() {
   var count = "";
-  count[0] --;
-}
+  count[0]--;
+};
+%PrepareFunctionForOptimization(f);
 f();
 %OptimizeFunctionOnNextCall(f);
 f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-178790.js b/src/v8/test/mjsunit/regress/regress-crbug-178790.js
index 25cc96b..f04b606 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-178790.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-178790.js
@@ -25,6 +25,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// Flags: --stack-size=1200
+
 // Create a regexp in the form of a?a?...a? so that fully
 // traversing the entire graph would be prohibitively expensive.
 // This should not cause time out.
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-196583.js b/src/v8/test/mjsunit/regress/regress-crbug-196583.js
index c486158..0111353 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-196583.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-196583.js
@@ -29,20 +29,31 @@
 
 var a = 1;
 a.__proto__.f = 1;
-a.__proto__.f = function() { return 1; }
+a.__proto__.f = function() {
+  return 1;
+};
 
 // Create some polymorphism.
 function B() {}
-B.prototype = {f: function() { return 2; }};
+B.prototype = {
+  f: function() {
+    return 2;
+  }
+};
 var b = new B();
 function C() {}
-C.prototype = {g: "foo", f: function() { return 3; }};
+C.prototype = {
+  g: 'foo',
+  f: function() {
+    return 3;
+  }
+};
 var c = new C();
 
 function crash(obj) {
   return obj.f();
-}
-
+};
+%PrepareFunctionForOptimization(crash);
 for (var i = 0; i < 2; i++) {
   crash(a);
   crash(b);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-217858.js b/src/v8/test/mjsunit/regress/regress-crbug-217858.js
index d6d6e9f..598325f 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-217858.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-217858.js
@@ -1,37 +1,18 @@
 // Copyright 2013 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
 
-// Flags: --noanalyze-environment-liveness
+// Flags: --noanalyze-environment-liveness --allow-natives-syntax
 
 var r = /r/;
 function f() {
   r[r] = function() {};
 }
 
-for (var i = 0; i < 300000; i++) {
-  f();
+function g() {
+  for (var i = 0; i < 300; i++) {
+    f();
+    if (i == 150) %OptimizeOsr();
+  }
 }
+%PrepareFunctionForOptimization(g);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-233737.js b/src/v8/test/mjsunit/regress/regress-crbug-233737.js
index df8aa15..8d8d79e 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-233737.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-233737.js
@@ -34,8 +34,8 @@
 
 function hole(i) {
   return a[i] << 0;
-}
-
+};
+%PrepareFunctionForOptimization(hole);
 assertEquals(1, hole(0));
 assertEquals(1, hole(0));
 %OptimizeFunctionOnNextCall(hole);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-240032.js b/src/v8/test/mjsunit/regress/regress-crbug-240032.js
index 7ce95d3..08eff6a 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-240032.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-240032.js
@@ -41,7 +41,8 @@
 // Optimize object comparison with new-space RHS.
 function cmp(o, f) {
   return f === o.func;
-}
+};
+%PrepareFunctionForOptimization(cmp);
 assertTrue(cmp(o, o.func));
 assertTrue(cmp(o, o.func));
 %OptimizeFunctionOnNextCall(cmp);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-242502.js b/src/v8/test/mjsunit/regress/regress-crbug-242502.js
index 8ee7640..6024744 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-242502.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-242502.js
@@ -33,14 +33,14 @@
 
 function call(o) {
   return o['']();
-}
-
+};
+%PrepareFunctionForOptimization(call);
 function test() {
-  var o1 = %ToFastProperties(Object.create({ foo:1 }, { '': { value:f }}));
-  var o2 = %ToFastProperties(Object.create({ bar:1 }, { '': { value:f }}));
-  var o3 = %ToFastProperties(Object.create({ baz:1 }, { '': { value:f }}));
-  var o4 = %ToFastProperties(Object.create({ qux:1 }, { '': { value:f }}));
-  var o5 = %ToFastProperties(Object.create({ loo:1 }, { '': { value:f }}));
+  var o1 = %ToFastProperties(Object.create({foo: 1}, {'': {value: f}}));
+  var o2 = %ToFastProperties(Object.create({bar: 1}, {'': {value: f}}));
+  var o3 = %ToFastProperties(Object.create({baz: 1}, {'': {value: f}}));
+  var o4 = %ToFastProperties(Object.create({qux: 1}, {'': {value: f}}));
+  var o5 = %ToFastProperties(Object.create({loo: 1}, {'': {value: f}}));
   // Called twice on o1 to turn monomorphic.
   assertEquals(23, call(o1));
   assertEquals(23, call(o1));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-242870.js b/src/v8/test/mjsunit/regress/regress-crbug-242870.js
index 7183375..cf93a35 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-242870.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-242870.js
@@ -30,9 +30,9 @@
 var non_const_true = true;
 
 function f() {
-  return (non_const_true || true && g());
-}
-
+  return non_const_true || true && g();
+};
+%PrepareFunctionForOptimization(f);
 function g() {
   for (;;) {}
 }
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-242924.js b/src/v8/test/mjsunit/regress/regress-crbug-242924.js
index 68ad7c6..439f388 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-242924.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-242924.js
@@ -28,21 +28,21 @@
 // Flags: --allow-natives-syntax --expose-gc --gc-global
 
 function f() {
-  return [,{}];
-}
-
-assertEquals([,{}], f());
-assertEquals([,{}], f());
+  return [, {}];
+};
+%PrepareFunctionForOptimization(f);
+assertEquals([, {}], f());
+assertEquals([, {}], f());
 %OptimizeFunctionOnNextCall(f);
-assertEquals([,{}], f());
+assertEquals([, {}], f());
 gc();
 
 function g() {
-  return [[,1.5],{}];
-}
-
-assertEquals([[,1.5],{}], g());
-assertEquals([[,1.5],{}], g());
+  return [[, 1.5], {}];
+};
+%PrepareFunctionForOptimization(g);
+assertEquals([[, 1.5], {}], g());
+assertEquals([[, 1.5], {}], g());
 %OptimizeFunctionOnNextCall(g);
-assertEquals([[,1.5],{}], g());
+assertEquals([[, 1.5], {}], g());
 gc();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-243868.js b/src/v8/test/mjsunit/regress/regress-crbug-243868.js
index 106d9cc..a542465 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-243868.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-243868.js
@@ -30,12 +30,14 @@
 var non_const_true = true;
 
 function f(o) {
-  return (non_const_true && (o.val == null || false));
+  return non_const_true && (o.val == null || false);
 }
 
 // Create an object with a constant function in another realm.
+;
+%PrepareFunctionForOptimization(f);
 var realm = Realm.create();
-var realmObject = Realm.eval(realm, "function g() {}; var o = { val:g }; o;")
+var realmObject = Realm.eval(realm, 'function g() {}; var o = { val:g }; o;');
 
 // Make the CompareNil IC in the function monomorphic.
 assertFalse(f(realmObject));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-244461.js b/src/v8/test/mjsunit/regress/regress-crbug-244461.js
index 2afb76a..fca334c 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-244461.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-244461.js
@@ -30,8 +30,8 @@
 function foo(arg) {
   var a = arg();
   return a;
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 
 foo(Array);
 foo(Array);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-245424.js b/src/v8/test/mjsunit/regress/regress-crbug-245424.js
index 005c8ba..56e22cd 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-245424.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-245424.js
@@ -28,13 +28,11 @@
 // Flags: --allow-natives-syntax
 
 function boom() {
-  var a = {
-    foo: "bar",
-    foo: "baz"
-  };
-  return a;
-}
+  var a = {foo: 'bar', foo: 'baz'};
 
+  return a;
+};
+%PrepareFunctionForOptimization(boom);
 assertEquals("baz", boom().foo);
 assertEquals("baz", boom().foo);
 %OptimizeFunctionOnNextCall(boom);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-245480.js b/src/v8/test/mjsunit/regress/regress-crbug-245480.js
index b8557c9..1d052f0 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-245480.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-245480.js
@@ -38,8 +38,8 @@
 
 function create_array(arg) {
   return new Array(arg);
-}
-
+};
+%PrepareFunctionForOptimization(create_array);
 obj = create_array(0);
 assertHoley(obj);
 create_array(0);
@@ -49,9 +49,9 @@
 
 // The code below would assert in debug or crash in release
 function f(length) {
-  return new Array(length)
-}
-
+  return new Array(length);
+};
+%PrepareFunctionForOptimization(f);
 f(0);
 f(0);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-258519.js b/src/v8/test/mjsunit/regress/regress-crbug-258519.js
index b2015a8..2f4601b 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-258519.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-258519.js
@@ -28,16 +28,18 @@
 // Flags: --allow-natives-syntax
 
 var a = {
-  compare_null: function(x) { return null != x; },
+  compare_null: function(x) {
+    return null != x;
+  },
   kaboom: function() {}
-}
+};
 
 function crash(x) {
   var b = a;
   b.compare_null(x) && b.kaboom();
   return "ok";
-}
-
+};
+%PrepareFunctionForOptimization(crash);
 assertEquals("ok", crash(null));
 assertEquals("ok", crash(null));
 %OptimizeFunctionOnNextCall(crash);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-263276.js b/src/v8/test/mjsunit/regress/regress-crbug-263276.js
index 05aa94c..0842fe3 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-263276.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-263276.js
@@ -35,8 +35,8 @@
 
 function bad(array) {
   array[array.length] = 1;
-}
-
+};
+%PrepareFunctionForOptimization(bad);
 bad(array1);
 bad(array1);
 bad(array2);  // Length is now 1.
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-272564.js b/src/v8/test/mjsunit/regress/regress-crbug-272564.js
index 5475298..1af8563 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-272564.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-272564.js
@@ -33,14 +33,14 @@
 
 function ce(a, b) {
   "number" == typeof a && (a = (b ? Math.round(a) : a) + "px");
-  return a
+  return a;
 }
 
 function pe(a, b, c) {
   if (b instanceof Bb) b = b.width;
   a.width = ce(b, !0);
-}
-
+};
+%PrepareFunctionForOptimization(pe);
 var a = new Bb(1);
 var b = new Bb(5);
 pe(a, b, 0);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-274438.js b/src/v8/test/mjsunit/regress/regress-crbug-274438.js
index 5d6817d..1e37d2b 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-274438.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-274438.js
@@ -28,12 +28,12 @@
 // Flags: --allow-natives-syntax
 
 function f(a, b) {
-  var x = { a:a };
-  switch(b) { case "string": }
-  var y = { b:b };
+  var x = {a: a};
+  switch (b) { case 'string': }
+  var y = {b: b};
   return y;
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f("a", "b");
 f("a", "b");
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-280333.js b/src/v8/test/mjsunit/regress/regress-crbug-280333.js
index ca3fdc7..2071a30 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-280333.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-280333.js
@@ -40,6 +40,7 @@
   return 0;
 }
 
+%PrepareFunctionForOptimization(foo);
 assertEquals(0, foo(1, funky));
 assertEquals(0, foo(1, funky));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-285355.js b/src/v8/test/mjsunit/regress/regress-crbug-285355.js
index ebd480a..5bcd27a 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-285355.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-285355.js
@@ -35,9 +35,9 @@
 
 function crash(array) {
   return array[~inverted_index()] = 2;
-}
-
+};
+%PrepareFunctionForOptimization(crash);
 assertEquals(2, crash(new Array(1)));
 assertEquals(2, crash(new Array(1)));
-%OptimizeFunctionOnNextCall(crash)
+%OptimizeFunctionOnNextCall(crash);
 assertEquals(2, crash(new Array(1)));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-305309.js b/src/v8/test/mjsunit/regress/regress-crbug-305309.js
index cd89bed..85affd6 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-305309.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-305309.js
@@ -41,7 +41,8 @@
 
 function Two(x) {
   return x.two;
-}
+};
+%PrepareFunctionForOptimization(Two);
 assertEquals(2, Two(a));
 assertEquals(2, Two(a));
 b2.constant_function = "no longer constant!";
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-306851.js b/src/v8/test/mjsunit/regress/regress-crbug-306851.js
index 77b711a..125486d 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-306851.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-306851.js
@@ -32,8 +32,12 @@
 };
 
 Object.defineProperty(Counter.prototype, 'count', {
-  get: function() { return this.value; },
-  set: function(value) { this.value = value; }
+  get: function() {
+    return this.value;
+  },
+  set: function(value) {
+    this.value = value;
+  }
 });
 
 var obj = new Counter();
@@ -41,8 +45,8 @@
 function bummer() {
   obj.count++;
   return obj.count;
-}
-
+};
+%PrepareFunctionForOptimization(bummer);
 assertEquals(1, bummer());
 assertEquals(2, bummer());
 assertEquals(3, bummer());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-309623.js b/src/v8/test/mjsunit/regress/regress-crbug-309623.js
index c77611a..ef35a67 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-309623.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-309623.js
@@ -38,8 +38,8 @@
 function foo(i) {
   a[0] = u[i];
   return a[0];
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 assertEquals(u[0], foo(0));
 assertEquals(u[0], foo(0));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-315252.js b/src/v8/test/mjsunit/regress/regress-crbug-315252.js
index 51454bf..670a092 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-315252.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-315252.js
@@ -28,27 +28,29 @@
 // Flags: --allow-natives-syntax
 
 function f(a, b, c) {
- this.a = a;
- this.b = b;
- this.c = c;
+  this.a = a;
+  this.b = b;
+  this.c = c;
 }
 var o3 = new f(1, 2, 3.5);
 var o4 = new f(1, 2.5, 3);
 var o1 = new f(1.5, 2, 3);
 var o2 = new f(1.5, 2, 3);
 function migrate(o) {
- return o.a;
+  return o.a;
 }
 // Use migrate to stabilize o1, o2 and o4 in [double, double, smi].
 migrate(o4);
 migrate(o1);
 migrate(o2);
 function store_transition(o) {
- o.d = 1;
+  o.d = 1;
 }
 // Optimize "store_transition" to transition from [double, double, smi] to
 // [double, double, smi, smi]. This adds a dependency on the
 // [double, double, smi] map.
+;
+%PrepareFunctionForOptimization(store_transition);
 store_transition(o4);
 store_transition(o1);
 store_transition(o2);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-318671.js b/src/v8/test/mjsunit/regress/regress-crbug-318671.js
index 54a7d5e..e04d37f 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-318671.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-318671.js
@@ -27,8 +27,10 @@
 
 // Flags: --allow-natives-syntax
 
-function add(x, y) { return x + y; }
-
+function add(x, y) {
+  return x + y;
+};
+%PrepareFunctionForOptimization(add);
 print(add({ a: 1 }, "a"));
 print(add({ b: 1 }, "b"));
 print(add({ c: 1 }, "c"));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-319835.js b/src/v8/test/mjsunit/regress/regress-crbug-319835.js
index 48f871f..66cbd21 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-319835.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-319835.js
@@ -27,7 +27,9 @@
 
 // Flags: --allow-natives-syntax
 
-try {} catch(e) {}  // No need to optimize the top level.
+try {
+} catch (e) {
+}  // No need to optimize the top level.
 
 var size = 0x20000;
 var a = new Float64Array(size);
@@ -37,8 +39,8 @@
   for (var i = 0; i < 1; i++) {
     a[index + offset] = 0xcc;
   }
-}
-
+};
+%PrepareFunctionForOptimization(store);
 store(training, -0x20000000);
 store(training, -0x20000000 + 1);
 store(training, -0x20000000);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-319860.js b/src/v8/test/mjsunit/regress/regress-crbug-319860.js
index b81fb85..1ba21c9 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-319860.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-319860.js
@@ -36,12 +36,13 @@
   return result;
 }
 
+%PrepareFunctionForOptimization(read);
 var a = new Int8Array(0x2000001);
 read(a, 0);
 read(a, 0);
 %OptimizeFunctionOnNextCall(read);
 
 // Segfault maybe?
-for (var i = 0; i > -1000000; --i) {
-  read(a, i);
+for (var i = 0; i > -100000; i -= 987) {
+  assertEquals(0, read(a, i));
 }
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-323942.js b/src/v8/test/mjsunit/regress/regress-crbug-323942.js
index 15af494..3e255ec 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-323942.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-323942.js
@@ -30,16 +30,26 @@
 "use strict";
 
 // Function is defined on the prototype chain.
-var holder = { f: function() { return 42; } };
-var receiver = { };
-receiver.__proto__ = { };
+var holder = {
+  f: function() {
+    return 42;
+  }
+};
+var receiver = {};
+receiver.__proto__ = {};
 receiver.__proto__.__proto__ = holder;
 
 // Inline two levels.
-function h(o) { return o.f.apply(this, arguments); }
-function g(o) { return h(o); }
+function h(o) {
+  return o.f.apply(this, arguments);
+}
+function g(o) {
+  return h(o);
+}
 
 // Collect type information for apply call.
+;
+%PrepareFunctionForOptimization(g);
 assertEquals(42, g(receiver));
 assertEquals(42, g(receiver));
 
@@ -50,7 +60,9 @@
 // Lookup of o.f during graph creation fails.
 %OptimizeFunctionOnNextCall(g);
 
-assertThrows(function() { g(receiver); });
+assertThrows(function() {
+  g(receiver);
+});
 
 // Put function back.
 receiver.__proto__.__proto__ = holder;
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-329709.js b/src/v8/test/mjsunit/regress/regress-crbug-329709.js
index c5316f3..98919d6 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-329709.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-329709.js
@@ -28,14 +28,17 @@
 // Flags: --allow-natives-syntax
 
 function boom(x) {
-  switch(x) {
-    case 1: return "one";
-    case 1500000000: return "non-smi int32";
-    default: return "default";
+  switch (x) {
+    case 1:
+      return 'one';
+    case 1500000000:
+      return 'non-smi int32';
+    default:
+      return 'default';
   }
-}
-
+};
+%PrepareFunctionForOptimization(boom);
 assertEquals("one", boom(1));
 assertEquals("one", boom(1));
-%OptimizeFunctionOnNextCall(boom)
+%OptimizeFunctionOnNextCall(boom);
 assertEquals("non-smi int32", boom(1500000000));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-336148.js b/src/v8/test/mjsunit/regress/regress-crbug-336148.js
index 8157c9f..87895f9 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-336148.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-336148.js
@@ -32,6 +32,7 @@
   if (true) return o.v && a;
 }
 
+%PrepareFunctionForOptimization(f);
 f({});
 f({});
 %OptimizeFunctionOnNextCall(f);
@@ -43,6 +44,8 @@
 function f3() { return 0 && 2; };
 function f4() { return 0 || 2; };
 
+[f1, f2, f3, f4].forEach(function(f) { %PrepareFunctionForOptimization(f); });
+
 function test() {
   assertEquals(2, f1());
   assertEquals(1, f2());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-340064.js b/src/v8/test/mjsunit/regress/regress-crbug-340064.js
index f2ab1d6..ff71ac5 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-340064.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-340064.js
@@ -29,8 +29,8 @@
 
 function f(v) {
   return v.length;
-}
-
+};
+%PrepareFunctionForOptimization(f);
 assertEquals(4, f("test"));
 assertEquals(4, f("test"));
 assertEquals(undefined, f(true));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-344186.js b/src/v8/test/mjsunit/regress/regress-crbug-344186.js
index 6486f38..7f002b8 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-344186.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-344186.js
@@ -10,7 +10,8 @@
   array[base - 95] = 1;
   array[base - 99] = 2;
   array[base + 4] = 3;
-}
+};
+%PrepareFunctionForOptimization(fun);
 fun(100);
 %OptimizeFunctionOnNextCall(fun);
 fun(0);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-345715.js b/src/v8/test/mjsunit/regress/regress-crbug-345715.js
index a375341..8f97447 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-345715.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-345715.js
@@ -4,10 +4,14 @@
 
 // Flags: --allow-natives-syntax
 
-a = {y:1.5};
+a = {
+  y: 1.5
+};
 a.y = 0;
 b = a.y;
-c = {y:{}};
+c = {
+  y: {}
+};
 
 function f() {
   return 1;
@@ -15,11 +19,11 @@
 
 function g() {
   var e = {y: b};
-  var d = {x:f()};
-  var d = {x:f()};
+  var d = {x: f()};
+  var d = {x: f()};
   return [e, d];
-}
-
+};
+%PrepareFunctionForOptimization(g);
 g();
 g();
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-345820.js b/src/v8/test/mjsunit/regress/regress-crbug-345820.js
index bdd0af9..af7f001 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-345820.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-345820.js
@@ -12,7 +12,8 @@
   for (var i = -1; i < N; i++) {
     __v_6[i] = i;
   }
-}
+};
+%PrepareFunctionForOptimization(__f_7);
 __f_7(1);
 %OptimizeFunctionOnNextCall(__f_7);
 __f_7(__v_6.length);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-346636.js b/src/v8/test/mjsunit/regress/regress-crbug-346636.js
index 247f8be..5d8b773 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-346636.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-346636.js
@@ -6,15 +6,15 @@
 
 function assertSame(expected, found) {
   if (found === expected) {
-    if (expected !== 0 || (1 / expected) == (1 / found)) return;
+    if (expected !== 0 || 1 / expected == 1 / found) return;
   }
   return;
 };
 
 function foo(x) {
   return x.bar;
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 function getter1() {
   assertSame(this, this);
 }
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-347903.js b/src/v8/test/mjsunit/regress/regress-crbug-347903.js
index b5174da..31abee9 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-347903.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-347903.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --use-allocation-folding --verify-heap
+// Flags: --allow-natives-syntax --verify-heap
 
 function f() {
   var a = new Array(84632);
@@ -11,9 +11,11 @@
   var b = new Array(84632);
   var c = new Array(84632);
   return [a, b, c];
-}
-f(); f();
+};
+%PrepareFunctionForOptimization(f);
+f();
+f();
 %OptimizeFunctionOnNextCall(f);
-for(var i = 0; i < 10; i++) {
+for (var i = 0; i < 10; i++) {
   f();
 }
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-349079.js b/src/v8/test/mjsunit/regress/regress-crbug-349079.js
index b1076ea..1ee5ece 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-349079.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-349079.js
@@ -16,7 +16,8 @@
   assertEquals(b, Math.max(b++, c++));
   assertEquals(c, Math.min(b++, c++));
   assertEquals(b, Math.max(b++, a++));
-}
+};
+%PrepareFunctionForOptimization(crash);
 crash();
 crash();
 %OptimizeFunctionOnNextCall(crash);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-349465.js b/src/v8/test/mjsunit/regress/regress-crbug-349465.js
index 2188750..5de6b93 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-349465.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-349465.js
@@ -8,7 +8,8 @@
   a[base] = 1;
   a[base + 4] = 2;
   a[base] = 3;
-}
+};
+%PrepareFunctionForOptimization(f);
 var a1 = new Array(1024);
 var a2 = new Array(128);
 f(a1, 1);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-349878.js b/src/v8/test/mjsunit/regress/regress-crbug-349878.js
index 5ed048f..ca37e63 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-349878.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-349878.js
@@ -27,6 +27,7 @@
   return h(b);
 }
 
+%PrepareFunctionForOptimization(g);
 g();
 g();
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-350434.js b/src/v8/test/mjsunit/regress/regress-crbug-350434.js
index 8a9a8e5..9df2c9b 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-350434.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-350434.js
@@ -13,7 +13,7 @@
 
 
 function crash(o, timeout) {
-  var s = "4000111222";  // Outside Smi range.
+  var s = '4000111222';  // Outside Smi range.
   %SetAllocationTimeout(100000, timeout);
   // This allocates a heap number, causing a GC, triggering lazy deopt.
   var end = s >>> 0;
@@ -21,8 +21,8 @@
   // This creates a map dependency, which gives the GC a reason to trigger
   // a lazy deopt when that map dies.
   o.bar = 2;
-}
-
+};
+%PrepareFunctionForOptimization(crash);
 crash(o, 100000);
 crash(o, 100000);
 crash(p, 100000);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-351320.js b/src/v8/test/mjsunit/regress/regress-crbug-351320.js
index 3ffef0b..e5b90d3 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-351320.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-351320.js
@@ -6,7 +6,9 @@
 
 var result = 0;
 var o1 = {};
-o2 = {y:1.5};
+o2 = {
+  y: 1.5
+};
 o2.y = 0;
 o3 = o2.y;
 
@@ -14,8 +16,8 @@
   for (var i = 0; i < 10; i++) {
     result += o1.x + o3.foo;
   }
-}
-
+};
+%PrepareFunctionForOptimization(crash);
 crash();
 %OptimizeFunctionOnNextCall(crash);
 crash();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-351658.js b/src/v8/test/mjsunit/regress/regress-crbug-351658.js
index ae6b50e..3e53c74 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-351658.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-351658.js
@@ -10,5 +10,5 @@
   f();
   assertUnreachable();
 } catch(e) {
-  assertTrue(e instanceof ReferenceError);
+  assertTrue(e instanceof SyntaxError);
 }
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-352058.js b/src/v8/test/mjsunit/regress/regress-crbug-352058.js
index e270d83..1bf27ed 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-352058.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-352058.js
@@ -9,8 +9,8 @@
 function f() {
   v2 = [1.2, 2.3];
   v0 = [12, 23];
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-352929.js b/src/v8/test/mjsunit/regress/regress-crbug-352929.js
index a5872c1..78e6351 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-352929.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-352929.js
@@ -9,7 +9,7 @@
 var dummy2 = new Int32Array(100);
 
 array[-17] = 0;
-function fun(base,cond) {
+function fun(base, cond) {
   array[base - 1] = 1;
   array[base - 2] = 2;
   if (cond) {
@@ -19,11 +19,12 @@
     array[base - 6] = 5;
     array[base - 100] = 777;
   }
-}
-fun(5,true);
-fun(7,false);
+};
+%PrepareFunctionForOptimization(fun);
+fun(5, true);
+fun(7, false);
 %OptimizeFunctionOnNextCall(fun);
-fun(7,false);
+fun(7, false);
 
 for (var i = 0; i < dummy.length; i++) {
   assertEquals(0, dummy[i]);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-354391.js b/src/v8/test/mjsunit/regress/regress-crbug-354391.js
index e652bd3..33517f6 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-354391.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-354391.js
@@ -6,8 +6,8 @@
 
 function load(a, i) {
   return a[i];
-}
-
+};
+%PrepareFunctionForOptimization(load);
 function f2(a, b, c, d, index) {
   return load(arguments, index);
 }
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-357330.js b/src/v8/test/mjsunit/regress/regress-crbug-357330.js
index b3edf00..b6ee249 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-357330.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-357330.js
@@ -10,6 +10,7 @@
   if (null != g) {}
 };
 
+%PrepareFunctionForOptimization(f);
 f(1.4);
 f(1.4);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-374838.js b/src/v8/test/mjsunit/regress/regress-crbug-374838.js
index 614b4d9..f116bb4 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-374838.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-374838.js
@@ -12,8 +12,8 @@
     a.shift();
   }
   return result;
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 assertEquals(1, foo());
 assertEquals(1, foo());
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-380512.js b/src/v8/test/mjsunit/regress/regress-crbug-380512.js
index af78ba7..7134245 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-380512.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-380512.js
@@ -4,8 +4,10 @@
 
 // Flags: --allow-natives-syntax
 
-function f() { [].lastIndexOf(42); }
-
+function f() {
+  [].lastIndexOf(42);
+};
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-381534.js b/src/v8/test/mjsunit/regress/regress-crbug-381534.js
index 2aa3929..4a3d319 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-381534.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-381534.js
@@ -7,32 +7,34 @@
 var obj = {};
 
 function f(v) {
-  var v1 = -(4/3);
+  var v1 = -(4 / 3);
   var v2 = 1;
-  var arr = new Array(+0, true, 0, -0, false, undefined, null, "0", obj, v1, -(4/3), -1.3333333333333, "str", v2, 1, false);
-  assertEquals(10, arr.lastIndexOf(-(4/3)));
-  assertEquals(9, arr.indexOf(-(4/3)));
+  var arr = new Array(
+      +0, true, 0, -0, false, undefined, null, '0', obj, v1, -(4 / 3),
+      -1.3333333333333, 'str', v2, 1, false);
+  assertEquals(10, arr.lastIndexOf(-(4 / 3)));
+  assertEquals(9, arr.indexOf(-(4 / 3)));
 
   assertEquals(10, arr.lastIndexOf(v));
   assertEquals(9, arr.indexOf(v));
 
   assertEquals(8, arr.lastIndexOf(obj));
   assertEquals(8, arr.indexOf(obj));
-}
-
+};
+%PrepareFunctionForOptimization(f);
 function g(v, x, index) {
-  var arr = new Array({}, x-1.1, x-2, x-3.1);
+  var arr = new Array({}, x - 1.1, x - 2, x - 3.1);
   assertEquals(index, arr.indexOf(0));
   assertEquals(index, arr.lastIndexOf(0));
 
   assertEquals(index, arr.indexOf(v));
   assertEquals(index, arr.lastIndexOf(v));
-}
-
-f(-(4/3));
-f(-(4/3));
+};
+%PrepareFunctionForOptimization(g);
+f(-(4 / 3));
+f(-(4 / 3));
 %OptimizeFunctionOnNextCall(f);
-f(-(4/3));
+f(-(4 / 3));
 
 g(0, 2, 2);
 g(0, 3.1, 3);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-382513.js b/src/v8/test/mjsunit/regress/regress-crbug-382513.js
index 59d2dca..5b2e14c 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-382513.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-382513.js
@@ -4,7 +4,10 @@
 
 // Flags: --allow-natives-syntax
 
-function foo() { return [+0,false].indexOf(-(4/3)); }
+function foo() {
+  return [+0, false].indexOf(-(4 / 3));
+};
+%PrepareFunctionForOptimization(foo);
 foo();
 foo();
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-387636.js b/src/v8/test/mjsunit/regress/regress-crbug-387636.js
index 1e50ace..c4ab3f2 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-387636.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-387636.js
@@ -6,8 +6,8 @@
 
 function f() {
   [].indexOf(0x40000000);
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-390918.js b/src/v8/test/mjsunit/regress/regress-crbug-390918.js
index 4c202b3..d19e983 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-390918.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-390918.js
@@ -10,8 +10,8 @@
   for (var i = 0; i < 2; i++) {
     arr[2 * scale] = 0;
   }
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f({});
 f({});
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-397662.js b/src/v8/test/mjsunit/regress/regress-crbug-397662.js
new file mode 100644
index 0000000..15e8631
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-397662.js
@@ -0,0 +1,9 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --mock-arraybuffer-allocator --allow-natives-syntax
+
+var a = new Uint8Array(%MaxSmi() >> 1);
+a.x = 1;
+assertThrows(()=>Object.entries(a), RangeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-405517.js b/src/v8/test/mjsunit/regress/regress-crbug-405517.js
index 578e76a..23632a5 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-405517.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-405517.js
@@ -5,11 +5,11 @@
 // Flags: --allow-natives-syntax --gc-interval=203
 
 function f() {
- var e = [0];
- Object.preventExtensions(e);
- for (var i = 0; i < 4; i++) e.shift();
-}
-
+  var e = [0];
+  Object.preventExtensions(e);
+  for (var i = 0; i < 4; i++) e.shift();
+};
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-407946.js b/src/v8/test/mjsunit/regress/regress-crbug-407946.js
index d5687cc..33da171 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-407946.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-407946.js
@@ -4,8 +4,10 @@
 
 // Flags: --allow-natives-syntax
 
-function f(n) { return [0].indexOf((n - n) + 0); }
-
+function f(n) {
+  return [0].indexOf(n - n + 0);
+};
+%PrepareFunctionForOptimization(f);
 assertEquals(0, f(.1));
 assertEquals(0, f(.1));
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-412208.js b/src/v8/test/mjsunit/regress/regress-crbug-412208.js
index a194f85..a214f70 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-412208.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-412208.js
@@ -10,6 +10,7 @@
   return non_const_true || (f() = this);
 }
 
+%PrepareFunctionForOptimization(f);
 assertTrue(f());
 assertTrue(f());
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-412210.js b/src/v8/test/mjsunit/regress/regress-crbug-412210.js
index 6ec7d62..8f9c13c 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-412210.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-412210.js
@@ -7,6 +7,7 @@
 function f(x) {
   return (x ? "" >> 0 : "") + /a/;
 };
-
+%PrepareFunctionForOptimization(f);
+;
 %OptimizeFunctionOnNextCall(f);
 f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-412215.js b/src/v8/test/mjsunit/regress/regress-crbug-412215.js
index ad926fc..c1da1f0 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-412215.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-412215.js
@@ -15,6 +15,7 @@
   d = 357;
   return {foo: b};
 }
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
@@ -27,6 +28,7 @@
   return obj.foo.length;
 }
 
+%PrepareFunctionForOptimization(g);
 g(dummy);
 g(dummy);
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-412319.js b/src/v8/test/mjsunit/regress/regress-crbug-412319.js
index 158fc59..3a72887 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-412319.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-412319.js
@@ -5,11 +5,12 @@
 // Flags: --allow-natives-syntax
 
 function __f_6() {
- var __v_7 = [0];
- Object.preventExtensions(__v_7);
- for (var __v_6 = -2; __v_6 < 19; __v_6++) __v_7.shift();
- __f_7(__v_7);
-}
+  var __v_7 = [0];
+  Object.preventExtensions(__v_7);
+  for (var __v_6 = -2; __v_6 < 19; __v_6++) __v_7.shift();
+  __f_7(__v_7);
+};
+%PrepareFunctionForOptimization(__f_6);
 __f_6();
 __f_6();
 %OptimizeFunctionOnNextCall(__f_6);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-417508.js b/src/v8/test/mjsunit/regress/regress-crbug-417508.js
index 589fb88..705ab36 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-417508.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-417508.js
@@ -7,23 +7,51 @@
 function foo(x) {
   var k = "value";
   return x[k] = 1;
-}
+};
+%PrepareFunctionForOptimization(foo);
 var obj = {};
-Object.defineProperty(obj, "value", {set: function(x) { throw "nope"; }});
-try { foo(obj); } catch(e) {}
-try { foo(obj); } catch(e) {}
+Object.defineProperty(obj, 'value', {
+  set: function(x) {
+    throw 'nope';
+  }
+});
+try {
+  foo(obj);
+} catch (e) {
+}
+try {
+  foo(obj);
+} catch (e) {
+}
 %OptimizeFunctionOnNextCall(foo);
-try { foo(obj); } catch(e) {}
+try {
+  foo(obj);
+} catch (e) {
+}
 
 function bar(x) {
   var k = "value";
   return (x[k] = 1) ? "ok" : "nope";
-}
+};
+%PrepareFunctionForOptimization(bar);
 var obj2 = {};
-Object.defineProperty(obj2, "value",
-    {set: function(x) { throw "nope"; return true; } });
+Object.defineProperty(obj2, 'value', {
+  set: function(x) {
+    throw 'nope';
+    return true;
+  }
+});
 
-try { bar(obj2); } catch(e) {}
-try { bar(obj2); } catch(e) {}
+try {
+  bar(obj2);
+} catch (e) {
+}
+try {
+  bar(obj2);
+} catch (e) {
+}
 %OptimizeFunctionOnNextCall(bar);
-try { bar(obj2); } catch(e) {}
+try {
+  bar(obj2);
+} catch (e) {
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-425519.js b/src/v8/test/mjsunit/regress/regress-crbug-425519.js
index d08e7b9..2534b85 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-425519.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-425519.js
@@ -6,8 +6,8 @@
 
 function load(a, i) {
   return a[i];
-}
-
+};
+%PrepareFunctionForOptimization(load);
 load([]);
 load(0);
 load("x", 0);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-433332.js b/src/v8/test/mjsunit/regress/regress-crbug-433332.js
index d763243..2a69a39 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-433332.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-433332.js
@@ -10,6 +10,7 @@
   if (null != g) {}
 };
 
+%PrepareFunctionForOptimization(f);
 f(1.4);
 f(1.4);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-476477-2.js b/src/v8/test/mjsunit/regress/regress-crbug-476477-2.js
index 4dbb41b..e179d5e 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-476477-2.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-476477-2.js
@@ -8,8 +8,8 @@
   var s = Math.floor(x / 3600);
   Math.floor(s);
   return s % 24;
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 foo(12345678);
 foo(12345678);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-478612.js b/src/v8/test/mjsunit/regress/regress-crbug-478612.js
index 3419722..cbf0682 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-478612.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-478612.js
@@ -5,14 +5,17 @@
 // Flags: --allow-natives-syntax
 
 // This is used to force binary operations below to have tagged representation.
-var z = {valueOf: function() { return 3; }};
-
+var z = {
+  valueOf: function() {
+    return 3;
+  }
+};
 
 function f() {
   var y = -2;
   return (1 & z) - y++;
-}
-
+};
+%PrepareFunctionForOptimization(f);
 assertEquals(3, f());
 assertEquals(3, f());
 %OptimizeFunctionOnNextCall(f);
@@ -21,9 +24,9 @@
 
 function g() {
   var y = 2;
-  return (1 & z) | y++;
-}
-
+  return 1 & z | y++;
+};
+%PrepareFunctionForOptimization(g);
 assertEquals(3, g());
 assertEquals(3, g());
 %OptimizeFunctionOnNextCall(g);
@@ -32,9 +35,9 @@
 
 function h() {
   var y = 3;
-  return (3 & z) & y++;
-}
-
+  return 3 & z & y++;
+};
+%PrepareFunctionForOptimization(h);
 assertEquals(3, h());
 assertEquals(3, h());
 %OptimizeFunctionOnNextCall(h);
@@ -43,9 +46,9 @@
 
 function i() {
   var y = 2;
-  return (1 & z) ^ y++;
-}
-
+  return 1 & z ^ y++;
+};
+%PrepareFunctionForOptimization(i);
 assertEquals(3, i());
 assertEquals(3, i());
 %OptimizeFunctionOnNextCall(i);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-480807.js b/src/v8/test/mjsunit/regress/regress-crbug-480807.js
index a1448d6..7913a3a 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-480807.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-480807.js
@@ -16,6 +16,8 @@
   }
   return c;
 }
+%PrepareFunctionForOptimization(foo);
+
 try {
   foo();
 } catch (e) {
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-485410.js b/src/v8/test/mjsunit/regress/regress-crbug-485410.js
index bb11c82..8c2fa1e 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-485410.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-485410.js
@@ -8,15 +8,16 @@
 function ToHeapNumber(i) {
   doubles[0] = i;
   return doubles[0];
-}
+};
+%PrepareFunctionForOptimization(ToHeapNumber);
 for (var i = 0; i < 3; i++) ToHeapNumber(i);
 %OptimizeFunctionOnNextCall(ToHeapNumber);
 ToHeapNumber(1);
 
 function Fail(a, i, v) {
   a[i] = v;
-}
-
+};
+%PrepareFunctionForOptimization(Fail);
 for (var i = 0; i < 3; i++) Fail(new Array(1), 1, i);
 %OptimizeFunctionOnNextCall(Fail);
 // 1050 > JSObject::kMaxGap, causing stub failure and runtime call.
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-485548-1.js b/src/v8/test/mjsunit/regress/regress-crbug-485548-1.js
index 6a25dcd..ffb564d 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-485548-1.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-485548-1.js
@@ -5,15 +5,19 @@
 // Flags: --allow-natives-syntax --expose-gc
 
 var inner = new Array();
-inner.a = {x:1};
+inner.a = {
+  x: 1
+};
 inner[0] = 1.5;
-inner.b = {x:2};
+inner.b = {
+  x: 2
+};
 assertTrue(%HasDoubleElements(inner));
 
 function foo(o) {
   return o.field.a.x;
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 var outer = {};
 outer.field = inner;
 foo(outer);
@@ -23,7 +27,11 @@
 foo(outer);
 
 // Generalize representation of field "a" of inner object.
-var v = { get x() { return 0x7fffffff; } };
+var v = {
+  get x() {
+    return 0x7fffffff;
+  }
+};
 inner.a = v;
 
 gc();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-485548-2.js b/src/v8/test/mjsunit/regress/regress-crbug-485548-2.js
index 02c6326..c85bb59 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-485548-2.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-485548-2.js
@@ -5,15 +5,19 @@
 // Flags: --allow-natives-syntax --expose-gc
 
 var inner = new Array();
-inner.a = {x:1};
+inner.a = {
+  x: 1
+};
 inner[0] = 1.5;
-inner.b = {x:2};
+inner.b = {
+  x: 2
+};
 assertTrue(%HasDoubleElements(inner));
 
 function foo(o) {
   return o.field.b.x;
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 var outer = {};
 outer.field = inner;
 foo(outer);
@@ -23,7 +27,11 @@
 foo(outer);
 
 // Generalize representation of field "b" of inner object.
-var v = { get x() { return 0x7fffffff; } };
+var v = {
+  get x() {
+    return 0x7fffffff;
+  }
+};
 inner.b = v;
 
 gc();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-487608.js b/src/v8/test/mjsunit/regress/regress-crbug-487608.js
index c1eafce..b5fb0dd 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-487608.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-487608.js
@@ -14,8 +14,8 @@
   result += a[index];
   result += inlined(a, index);
   return result;
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 foo(0);
 foo(0);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-489293.js b/src/v8/test/mjsunit/regress/regress-crbug-489293.js
index bcfc702..ef71a18 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-489293.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-489293.js
@@ -8,9 +8,10 @@
 function f() {
   var x = 0;
   for (var y = 0; y < 0; ++y) {
-    x = (x + y) | 0;
+    x = x + y | 0;
   }
   return unbound;
-}
+};
+%PrepareFunctionForOptimization(f);
 %OptimizeFunctionOnNextCall(f);
 assertThrows(f, ReferenceError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-490021.js b/src/v8/test/mjsunit/regress/regress-crbug-490021.js
index 745c0a8..36b113f 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-490021.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-490021.js
@@ -7,8 +7,8 @@
 var global = new Object(3);
 function f() {
   global[0] = global[0] >>> 15.5;
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-491062.js b/src/v8/test/mjsunit/regress/regress-crbug-491062.js
index d2cd757..4113654 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-491062.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-491062.js
@@ -15,7 +15,7 @@
   }
   if (count < 100) {
     count++;
-    %DebugGetLoadedScripts();
+    %DebugGetLoadedScriptIds();
   }
 }
 f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-500435.js b/src/v8/test/mjsunit/regress/regress-crbug-500435.js
index acc17ac..1f603a9 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-500435.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-500435.js
@@ -16,6 +16,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(foo);
 foo([1,2]);
 foo([2,3]);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-500497.js b/src/v8/test/mjsunit/regress/regress-crbug-500497.js
index 4917193..b77fa4f 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-500497.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-500497.js
@@ -11,14 +11,16 @@
 function Ctor() {
   var result = {a: {}, b: {}, c: {}, d: {}, e: {}, f: {}, g: {}};
   return result;
-}
-
+};
+%PrepareFunctionForOptimization(Ctor);
 gc();
 
 for (var i = 0; i < 120; i++) {
   // Make the "a" property long-lived, while everything else is short-lived.
   global.push(Ctor().a);
-  (function FillNewSpace() { new Array(10000); })();
+  (function FillNewSpace() {
+    new Array(10000);
+  })();
 }
 
 // The bad situation is only triggered if Ctor wasn't optimized too early.
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-500824.js b/src/v8/test/mjsunit/regress/regress-crbug-500824.js
index 08d0d10..15f3222 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-500824.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-500824.js
@@ -19,5 +19,6 @@
   };
 })(get_thrower()).fun;
 
+%PrepareFunctionForOptimization(f);
 %OptimizeFunctionOnNextCall(f);
 f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-503578.js b/src/v8/test/mjsunit/regress/regress-crbug-503578.js
index 1274d91..59c33da 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-503578.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-503578.js
@@ -8,7 +8,7 @@
     var __v_5 = new Uint32Array(__v_1);
     return __v_5;
   }
-  var __v_6 = new Worker('onmessage = function() {}');
+  var __v_6 = new Worker('onmessage = function() {}', {type: 'string'});
   var __v_3 = __f_0(16);
   __v_6.postMessage(__v_3);
 }
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-503698.js b/src/v8/test/mjsunit/regress/regress-crbug-503698.js
index 415d1bc..c817bed 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-503698.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-503698.js
@@ -5,5 +5,5 @@
 // Flags: --invoke-weak-callbacks
 
 if (this.Worker) {
-  var __v_6 = new Worker('');
+  var __v_6 = new Worker('', {type: 'string'});
 }
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-503968.js b/src/v8/test/mjsunit/regress/regress-crbug-503968.js
index 78d1c7b..0552163 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-503968.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-503968.js
@@ -8,6 +8,6 @@
     this.l = [new __f_0, new __f_0];
   }
   __v_6 = new __f_1;
-  var __v_9 = new Worker('');
+  var __v_9 = new Worker('', {type: 'string'});
   __v_9.postMessage(__v_6);
 }
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-503991.js b/src/v8/test/mjsunit/regress/regress-crbug-503991.js
index 6a3b0de..7b96e92 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-503991.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-503991.js
@@ -4,6 +4,6 @@
 
 if (this.Worker) {
   __v_3 = "";
-  var __v_6 = new Worker('');
+  var __v_6 = new Worker('', {type: 'string'});
   __v_6.postMessage(__v_3);
 }
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-504136.js b/src/v8/test/mjsunit/regress/regress-crbug-504136.js
index 4ed6843..25b11e0 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-504136.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-504136.js
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 if (this.Worker) {
-  var __v_10 = new Worker('');
+  var __v_10 = new Worker('', {type: 'string'});
   __v_10.terminate();
  __v_10.getMessage();
 }
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-504727.js b/src/v8/test/mjsunit/regress/regress-crbug-504727.js
index 16d8ff1..a295a1b 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-504727.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-504727.js
@@ -5,5 +5,5 @@
 // Flags: --no-test
 
 if (this.Worker) {
-  var __v_2 = new Worker('');
+  var __v_2 = new Worker('', {type: 'string'});
 }
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-504729.js b/src/v8/test/mjsunit/regress/regress-crbug-504729.js
index 435cafe..8b1f8b0 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-504729.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-504729.js
@@ -5,5 +5,5 @@
 if (this.Worker) {
   Function.prototype.toString = "foo";
   function __f_7() {}
-  assertThrows(function() { var __v_5 = new Worker(__f_7.toString()); });
+  assertThrows(function() { var __v_5 = new Worker(__f_7.toString(), {type: 'string'}) });
 }
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-505354.js b/src/v8/test/mjsunit/regress/regress-crbug-505354.js
index 61c40c4..6237cfa 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-505354.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-505354.js
@@ -8,7 +8,9 @@
   "use strict";
   try {
     for (let i = 0; i < 10; i++) {}
-  } catch(e) {}
-}
+  } catch (e) {
+  }
+};
+%PrepareFunctionForOptimization(f);
 %OptimizeFunctionOnNextCall(f);
 f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-505778.js b/src/v8/test/mjsunit/regress/regress-crbug-505778.js
index 74d96ab..3d87ba6 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-505778.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-505778.js
@@ -3,6 +3,6 @@
 // found in the LICENSE file.
 
 if (this.Worker) {
-  var __v_7 = new Worker('onmessage = function() {}');
+  var __v_7 = new Worker('onmessage = function() {}', {type: 'string'});
   __v_7.postMessage("");
 }
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-506549.js b/src/v8/test/mjsunit/regress/regress-crbug-506549.js
index 40e162c..219fd10 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-506549.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-506549.js
@@ -5,6 +5,6 @@
 if (this.Worker) {
   var __v_5 = {};
   __v_5.__defineGetter__('byteLength', function() {foo();});
-  var __v_8 = new Worker('onmessage = function() {};');
+  var __v_8 = new Worker('onmessage = function() {};', {type: 'string'});
   assertThrows(function() { __v_8.postMessage(__v_5); });
 }
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-510738.js b/src/v8/test/mjsunit/regress/regress-crbug-510738.js
index 0e154a9..013f9b4 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-510738.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-510738.js
@@ -5,6 +5,7 @@
 // Flags: --allow-natives-syntax
 
 function check(f, result) {
+  %PrepareFunctionForOptimization(f);
   %OptimizeFunctionOnNextCall(f);
   assertEquals(result, f());
 }
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-511880.js b/src/v8/test/mjsunit/regress/regress-crbug-511880.js
index f9b05ff..5dceb2a 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-511880.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-511880.js
@@ -4,10 +4,10 @@
 
 if (this.Worker) {
   var __v_8 =
-    `var __v_9 = new Worker('postMessage(42)');
+    `var __v_9 = new Worker('postMessage(42)', {type: 'string'});
      onmessage = function(parentMsg) {
        __v_9.postMessage(parentMsg);
      };`;
-  var __v_9 = new Worker(__v_8);
+  var __v_9 = new Worker(__v_8, {type: 'string'});
   __v_9.postMessage(9);
 }
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-513471.js b/src/v8/test/mjsunit/regress/regress-crbug-513471.js
index 48c793e..11afbe8 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-513471.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-513471.js
@@ -4,7 +4,9 @@
 
 // Flags: --allow-natives-syntax
 
-var g = (function*(){});
+var g = function*() {};
+;
+%PrepareFunctionForOptimization(g);
 var f = g();
 %OptimizeFunctionOnNextCall(g);
 f.next();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-513507.js b/src/v8/test/mjsunit/regress/regress-crbug-513507.js
index ae321ba..87ba8b9 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-513507.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-513507.js
@@ -16,8 +16,10 @@
       if (i == osr_fuse) %OptimizeOsr();
     }
   }
+  %PrepareFunctionForOptimization(fun);
   return fun;
 }
+%PrepareFunctionForOptimization(makeFun);
 
 makeFun()(7);  // Warm up.
 makeFun()(4);  // Optimize once.
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-514081.js b/src/v8/test/mjsunit/regress/regress-crbug-514081.js
index ee3ed81..3d99b45 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-514081.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-514081.js
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 if (this.Worker) {
-  var __v_7 = new Worker('onmessage = function() {};');
+  var __v_7 = new Worker('onmessage = function() {};', {type: 'string'});
   var e;
   var ab = new ArrayBuffer(2 * 1000 * 1000);
   try {
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-518747.js b/src/v8/test/mjsunit/regress/regress-crbug-518747.js
index f1787c4..2a4058d 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-518747.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-518747.js
@@ -4,6 +4,6 @@
 
 if (this.Worker) {
   Worker.prototype = 12;
-  var __v_6 = new Worker('');
+  var __v_6 = new Worker('', {type: 'string'});
   __v_6.postMessage([]);
 }
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-522496.js b/src/v8/test/mjsunit/regress/regress-crbug-522496.js
index e47e0a0..4dea5a8 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-522496.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-522496.js
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 if (this.Worker) {
-  var worker = new Worker("onmessage = function(){}");
+  var worker = new Worker("onmessage = function(){}", {type: 'string'});
   var buf = new ArrayBuffer();
   worker.postMessage(buf, [buf]);
 }
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-522895.js b/src/v8/test/mjsunit/regress/regress-crbug-522895.js
index f28f3a1..8258524 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-522895.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-522895.js
@@ -10,6 +10,7 @@
   "  while (i-- > 31) {" +
   "    %OptimizeOsr(); " +
   "    j = 9;          " +
+  "    %PrepareFunctionForOptimization(bar1); " +
   "    while (j-- > 7);" +
   "  }                 " +
   "  return i;         " +
@@ -19,4 +20,6 @@
   return eval("(" + body + ")");
 }
 
-gen()();
+var f = gen();
+%PrepareFunctionForOptimization(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-523213.js b/src/v8/test/mjsunit/regress/regress-crbug-523213.js
index 15b16bb..00fc08e 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-523213.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-523213.js
@@ -8,14 +8,14 @@
 var v2 = [];
 v1.__proto__ = v2;
 
-function f(){
+function f() {
   var a = [];
-  for(var i=0; i<2; i++){
+  for (var i = 0; i < 2; i++) {
     a.push([]);
     a = v2;
   }
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f();
 %OptimizeFunctionOnNextCall(f);
 f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-523307.js b/src/v8/test/mjsunit/regress/regress-crbug-523307.js
index f290967..8d5d4bc 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-523307.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-523307.js
@@ -8,8 +8,8 @@
   var c = x * x << 366;
   var a = c + c;
   return a;
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f(1);
 f(1);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-527364.js b/src/v8/test/mjsunit/regress/regress-crbug-527364.js
index 914bed0..2391ca0 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-527364.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-527364.js
@@ -22,5 +22,6 @@
 }
 
 var boom = module().f;
+%PrepareFunctionForOptimization(boom);
 %OptimizeFunctionOnNextCall(boom)
 run_close_to_stack_limit(boom);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-530598.js b/src/v8/test/mjsunit/regress/regress-crbug-530598.js
index f385523..07f48f0 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-530598.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-530598.js
@@ -10,6 +10,7 @@
   function f() { return g(); }
   return f;
 })();
+%PrepareFunctionForOptimization(f1);
 assertThrows("f1()");
 %OptimizeFunctionOnNextCall(f1);
 assertThrows("f1()");
@@ -20,6 +21,7 @@
   function f(a) { return a || g(); }
   return f;
 })();
+%PrepareFunctionForOptimization(f2);
 assertTrue(f2(true));
 %OptimizeFunctionOnNextCall(f2);
 assertTrue(f2(true));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-537444.js b/src/v8/test/mjsunit/regress/regress-crbug-537444.js
index d6fe6b8..0aca33c 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-537444.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-537444.js
@@ -17,8 +17,8 @@
 function h(x) {
   var z = g(x, 1);
   return z + 1;
-}
-
+};
+%PrepareFunctionForOptimization(h);
 
 h(1);
 h(1);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-551287.js b/src/v8/test/mjsunit/regress/regress-crbug-551287.js
index a85deef..1517b56 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-551287.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-551287.js
@@ -4,14 +4,18 @@
 
 // Flags: --allow-natives-syntax
 
-function f() { do { } while (true); }
-
-function boom(x) {
-  switch(x) {
-    case 1:
-    case f(): return;
-  }
+function f() {
+  do {
+  } while (true);
 }
 
-%OptimizeFunctionOnNextCall(boom)
+function boom(x) {
+  switch (x) {
+    case 1:
+    case f():
+      return;
+  }
+};
+%PrepareFunctionForOptimization(boom);
+%OptimizeFunctionOnNextCall(boom);
 boom(1);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-554831.js b/src/v8/test/mjsunit/regress/regress-crbug-554831.js
index 3d022b2..27106d5 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-554831.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-554831.js
@@ -7,6 +7,7 @@
 (function() {
   var key = "s";
   function f(object) { return object[key]; };
+  %PrepareFunctionForOptimization(f);
   f("");
   f("");
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-557807.js b/src/v8/test/mjsunit/regress/regress-crbug-557807.js
index a96bc99..384579f 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-557807.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-557807.js
@@ -4,8 +4,13 @@
 
 // Flags: --allow-natives-syntax
 
-function bar() { return { __proto__: this }; }
-function foo(a) { a[0] = 0.3; }
+function bar() {
+  return {__proto__: this};
+}
+function foo(a) {
+  a[0] = 0.3;
+};
+%PrepareFunctionForOptimization(foo);
 foo(bar());
 %OptimizeFunctionOnNextCall(foo);
 foo(bar());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-571064.js b/src/v8/test/mjsunit/regress/regress-crbug-571064.js
index a28a383..7b9666c 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-571064.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-571064.js
@@ -12,7 +12,8 @@
 }
 function CallFuncWithPrototype() {
   CallFunc(prototype);
-}
+};
+%PrepareFunctionForOptimization(CallFuncWithPrototype);
 CallFunc([]);
 CallFunc([]);
 %OptimizeFunctionOnNextCall(CallFuncWithPrototype);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-573858.js b/src/v8/test/mjsunit/regress/regress-crbug-573858.js
index 270df5a..744176c 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-573858.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-573858.js
@@ -4,13 +4,24 @@
 
 // Flags: --allow-natives-syntax
 
-var throw_type_error = Object.getOwnPropertyDescriptor(
-    (function() {"use strict"}).__proto__, "caller").get;
+var throw_type_error = Object
+                           .getOwnPropertyDescriptor(
+                               function() {
+                                 'use strict';
+                               }.__proto__,
+                               'caller')
+                           .get;
 
-function create_initial_map() { this instanceof throw_type_error }
+function create_initial_map() {
+  this instanceof throw_type_error;
+};
+%PrepareFunctionForOptimization(create_initial_map);
 %OptimizeFunctionOnNextCall(create_initial_map);
 assertThrows(create_initial_map);
 
-function test() { new throw_type_error }
+function test() {
+  new throw_type_error();
+};
+%PrepareFunctionForOptimization(test);
 %OptimizeFunctionOnNextCall(test);
 assertThrows(test);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-577112.js b/src/v8/test/mjsunit/regress/regress-crbug-577112.js
index 504f921..0e8d20f 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-577112.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-577112.js
@@ -8,7 +8,8 @@
 var prototype = Array.prototype;
 function f() {
   prototype.lastIndexOf({});
-}
+};
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-587068.js b/src/v8/test/mjsunit/regress/regress-crbug-587068.js
index 864f8ce..8704d72 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-587068.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-587068.js
@@ -7,6 +7,7 @@
 // The Crankshaft fast case for String.fromCharCode used to unconditionally
 // deoptimize on non int32 indices.
 function foo(i) { return String.fromCharCode(i); }
+%PrepareFunctionForOptimization(foo);
 foo(33);
 foo(33);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-589792.js b/src/v8/test/mjsunit/regress/regress-crbug-589792.js
index f735afc..bba887a 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-589792.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-589792.js
@@ -16,5 +16,6 @@
   }
   return foo
 })(this, 0, new ArrayBuffer(256));
+%PrepareFunctionForOptimization(boom);
 %OptimizeFunctionOnNextCall(boom);
 boom(0, 0x1000);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-590989-1.js b/src/v8/test/mjsunit/regress/regress-crbug-590989-1.js
index 73118eb..a974b55 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-590989-1.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-590989-1.js
@@ -9,10 +9,12 @@
 
 function g(x) { return x.foo === +x.foo; }
 
+%PrepareFunctionForOptimization(g);
 assertEquals(false, g(o));
 assertEquals(false, g(o));
 %OptimizeFunctionOnNextCall(g);
 assertEquals(false, g(o));  // Still fine here.
 assertEquals(true, g(p));
+%PrepareFunctionForOptimization(g);
 %OptimizeFunctionOnNextCall(g);
 assertEquals(false, g(o));  // Confused by type feedback.
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-590989-2.js b/src/v8/test/mjsunit/regress/regress-crbug-590989-2.js
index cae1d9d..33ab7d8 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-590989-2.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-590989-2.js
@@ -4,8 +4,10 @@
 
 // Flags: --allow-natives-syntax
 
-function f(x) { return x === +x; }
-
+function f(x) {
+  return x === +x;
+};
+%PrepareFunctionForOptimization(f);
 assertEquals(false, f(undefined));
 assertEquals(false, f(undefined));
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-594183.js b/src/v8/test/mjsunit/regress/regress-crbug-594183.js
index cb80034..ddf5159 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-594183.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-594183.js
@@ -24,6 +24,7 @@
   return sum;
 }
 
+%PrepareFunctionForOptimization(load);
 load();
 load();
 %OptimizeFunctionOnNextCall(load);
@@ -37,6 +38,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(store);
 store();
 store();
 %OptimizeFunctionOnNextCall(store);
@@ -70,6 +72,7 @@
   store_element(o5, key);
 }
 
+%PrepareFunctionForOptimization(inferrable_store);
 inferrable_store(0);
 inferrable_store(0);
 %OptimizeFunctionOnNextCall(inferrable_store);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-595615.js b/src/v8/test/mjsunit/regress/regress-crbug-595615.js
index f5d0ee5..8b009ef 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-595615.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-595615.js
@@ -8,8 +8,18 @@
 
 function f(o) {
   return o.x();
+};
+%PrepareFunctionForOptimization(f);
+try {
+  f({x: 1});
+} catch (e) {
 }
-try { f({ x: 1 }); } catch(e) {}
-try { f({ x: 1 }); } catch(e) {}
+try {
+  f({x: 1});
+} catch (e) {
+}
 %OptimizeFunctionOnNextCall(f);
-try { f({ x: 1 }); } catch(e) {}
+try {
+  f({x: 1});
+} catch (e) {
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-598998.js b/src/v8/test/mjsunit/regress/regress-crbug-598998.js
index a2a0262..3a9143c 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-598998.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-598998.js
@@ -20,8 +20,8 @@
 
 function h(x) {
   g(x, 1);
-}
-
+};
+%PrepareFunctionForOptimization(h);
 %NeverOptimizeFunction(deopt_function);
 
 h(1);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-599003.js b/src/v8/test/mjsunit/regress/regress-crbug-599003.js
index da29455..0642758 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-599003.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-599003.js
@@ -23,8 +23,8 @@
 
 function g2() {
   return new A();
-}
-
+};
+%PrepareFunctionForOptimization(g2);
 var o = g1();
 %OptimizeFunctionOnNextCall(g2);
 g2();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-601617.js b/src/v8/test/mjsunit/regress/regress-crbug-601617.js
index e1a5cbd..bd47605 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-601617.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-601617.js
@@ -15,7 +15,7 @@
 }
 
 function f1() {
-  var o = { x : 1 };
+  var o = {x: 1};
   var res = g(o);
   return res;
 }
@@ -23,8 +23,8 @@
 function f0() {
   "use strict";
   return f1(5);
-}
-
+};
+%PrepareFunctionForOptimization(f0);
 %NeverOptimizeFunction(h);
 f0();
 f0();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-602595.js b/src/v8/test/mjsunit/regress/regress-crbug-602595.js
index 7f6d478..aaad9d7 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-602595.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-602595.js
@@ -4,8 +4,10 @@
 
 // Flags: --allow-natives-syntax --turbo-escape
 
-function f(a) { return [a] }
-
+function f(a) {
+  return [a];
+};
+%PrepareFunctionForOptimization(f);
 assertEquals([23], f(23));
 assertEquals([42], f(42));
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-604680.js b/src/v8/test/mjsunit/regress/regress-crbug-604680.js
index 8835807..b26935b 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-604680.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-604680.js
@@ -15,20 +15,20 @@
 }
 
 function f1() {
-  var o = { x : 42 };
+  var o = {x: 42};
   var res = g(o);
   return 1;
 }
 
-function f0(a, b)  {
+function f0(a, b) {
   "use strict";
   return f1(5);
-}
-
+};
+%PrepareFunctionForOptimization(f0);
 function boom(b) {
   if (b) throw new Error("boom!");
-}
-
+};
+%PrepareFunctionForOptimization(boom);
 %NeverOptimizeFunction(h);
 f0();
 f0();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-608278.js b/src/v8/test/mjsunit/regress/regress-crbug-608278.js
index c8d2fcc..e18605c 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-608278.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-608278.js
@@ -7,7 +7,7 @@
 "use strict";
 
 function h() {
-  var stack = (new Error("boom")).stack;
+  var stack = new Error('boom').stack;
   print(stack);
   %DeoptimizeFunction(f1);
   %DeoptimizeFunction(f2);
@@ -27,8 +27,8 @@
   var o = {};
   o.__defineGetter__('p', g);
   o.p;
-}
-
+};
+%PrepareFunctionForOptimization(f1);
 f1();
 f1();
 %OptimizeFunctionOnNextCall(f1);
@@ -39,8 +39,8 @@
   var o = {};
   o.__defineSetter__('q', g);
   o.q = 1;
-}
-
+};
+%PrepareFunctionForOptimization(f2);
 f2();
 f2();
 %OptimizeFunctionOnNextCall(f2);
@@ -53,8 +53,8 @@
 
 function f3() {
   new A();
-}
-
+};
+%PrepareFunctionForOptimization(f3);
 f3();
 f3();
 %OptimizeFunctionOnNextCall(f3);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-613494.js b/src/v8/test/mjsunit/regress/regress-crbug-613494.js
index 6fcc1e9..b6f2ebb 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-613494.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-613494.js
@@ -6,8 +6,11 @@
 
 function f() {
   var bound = 0;
-  function g() { return bound }
-}
+  function g() {
+    return bound;
+  }
+};
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-613919.js b/src/v8/test/mjsunit/regress/regress-crbug-613919.js
index cbd3e43..3124565 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-613919.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-613919.js
@@ -11,7 +11,8 @@
 }
 function f() {
   return g(false);
-}
+};
+%PrepareFunctionForOptimization(f);
 assertEquals(23, f());
 assertEquals(23, f());
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-614292.js b/src/v8/test/mjsunit/regress/regress-crbug-614292.js
index 3a67c17..e0d3517 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-614292.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-614292.js
@@ -6,8 +6,8 @@
 
 function foo() {
   return [] | 0 && values[0] || false;
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 %OptimizeFunctionOnNextCall(foo);
 try {
   foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-614644.js b/src/v8/test/mjsunit/regress/regress-crbug-614644.js
index d219cd3..a2bfb1f 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-614644.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-614644.js
@@ -7,9 +7,9 @@
 function f(a, x) {
   a.shift(2, a.length = 2);
   a[0] = x;
-}
-
-f([ ], 1.1);
+};
+%PrepareFunctionForOptimization(f);
+f([], 1.1);
 f([1], 1.1);
 %OptimizeFunctionOnNextCall(f);
 f([1], 1.1);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-616709-1.js b/src/v8/test/mjsunit/regress/regress-crbug-616709-1.js
index 75abe3c..66acd91 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-616709-1.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-616709-1.js
@@ -6,13 +6,13 @@
 
 // Make the Object prototype have dictionary properties.
 for (var i = 0; i < 2000; i++) {
-  Object.prototype['X'+i] = true;
+  Object.prototype['X' + i] = true;
 }
 
 function boom(a1) {
   return a1[0];
-}
-
+};
+%PrepareFunctionForOptimization(boom);
 var a = new Array(1);
 a[0] = 0.1;
 boom(a);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-616709-2.js b/src/v8/test/mjsunit/regress/regress-crbug-616709-2.js
index 27e5d2d..9e4e245 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-616709-2.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-616709-2.js
@@ -6,13 +6,13 @@
 
 // Make the Array prototype have dictionary properties.
 for (var i = 0; i < 2000; i++) {
-  Array.prototype['X'+i] = true;
+  Array.prototype['X' + i] = true;
 }
 
 function boom(a1) {
   return a1[0];
-}
-
+};
+%PrepareFunctionForOptimization(boom);
 var a = new Array(1);
 a[0] = 0.1;
 boom(a);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-617567.js b/src/v8/test/mjsunit/regress/regress-crbug-617567.js
index f0c696e..d883543 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-617567.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-617567.js
@@ -17,8 +17,8 @@
 function f() {
   v3 = v2;
   g();
-}
-
+};
+%PrepareFunctionForOptimization(f);
 assertThrows(g);
 %OptimizeFunctionOnNextCall(f);
 assertThrows(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-621816.js b/src/v8/test/mjsunit/regress/regress-crbug-621816.js
index 8ef291a..64032a6 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-621816.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-621816.js
@@ -9,9 +9,10 @@
   o.a = 1;
 }
 function g() {
-  var o = { ['a']: function(){} };
+  var o = {['a']: function() {}};
   f();
-}
+};
+%PrepareFunctionForOptimization(g);
 f();
 f();
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-621868.js b/src/v8/test/mjsunit/regress/regress-crbug-621868.js
index dcd7b87..f582481 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-621868.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-621868.js
@@ -10,10 +10,10 @@
 
 function g() {
   f();
-  var d = {x : f()};
+  var d = {x: f()};
   return [d];
-}
-
+};
+%PrepareFunctionForOptimization(g);
 g();
 g();
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-624747.js b/src/v8/test/mjsunit/regress/regress-crbug-624747.js
index 7927263..e0acbfa 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-624747.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-624747.js
@@ -10,13 +10,13 @@
   try {
     unref;
   } catch (e) {
-    return (1 instanceof TypeError) && unref();  // Call in tail position!
+    return 1 instanceof TypeError && unref();  // Call in tail position!
   }
 }
 
 function foo() {
   return bar();  // Call in tail position!
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 %OptimizeFunctionOnNextCall(foo);
 foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-624919.js b/src/v8/test/mjsunit/regress/regress-crbug-624919.js
index 5a2b100..d4cff87 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-624919.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-624919.js
@@ -6,8 +6,8 @@
 
 function f(a, b, c, d, e) {
   if (a && (b, c ? d() : e())) return 0;
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-625547.js b/src/v8/test/mjsunit/regress/regress-crbug-625547.js
index 20eb85d..0c3e022 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-625547.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-625547.js
@@ -10,12 +10,14 @@
 v2 = 0;
 gc();
 
-var minus_zero = {z:-0.0}.z;
+var minus_zero = {z: -0.0}.z;
 var nan = undefined + 1;
 function f() {
   v1 = minus_zero;
   v2 = nan;
 };
+%PrepareFunctionForOptimization(f);
+;
 %OptimizeFunctionOnNextCall(f);
 f();
 gc();  // Boom!
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-627828.js b/src/v8/test/mjsunit/regress/regress-crbug-627828.js
index 12c59a3..9389cc0 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-627828.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-627828.js
@@ -12,8 +12,14 @@
         return "x";
       }
     };
-    return { [o]() { return 23 } };
-  }
+
+    return {
+      [o]() {
+        return 23;
+      }
+    };
+  };
+  %PrepareFunctionForOptimization(f);
   assertEquals(23, f().x());
   assertEquals(23, f().x());
   %OptimizeFunctionOnNextCall(f);
@@ -25,14 +31,12 @@
   // happens in the object literal.
 
   Object.defineProperty(Object.prototype, 'x_proto', {
-    get: function () {
+    get: function() {
       return 21;
     },
-    set: function () {
-    }
+    set: function() {}
   });
 
-
   function f() {
     var o = {
       toString: function() {
@@ -40,8 +44,14 @@
         return "x_proto";
       }
     };
-    return { [o]() { return 23 } };
-  }
+
+    return {
+      [o]() {
+        return 23;
+      }
+    };
+  };
+  %PrepareFunctionForOptimization(f);
   assertEquals(23, f().x_proto());
   assertEquals(23, f().x_proto());
   %OptimizeFunctionOnNextCall(f);
@@ -59,11 +69,16 @@
         return "y";
       }
     };
+
     class C {
-      [o]() { return 42 };
+      [o]() {
+        return 42;
+      }
     }
+
     return new C();
-  }
+  };
+  %PrepareFunctionForOptimization(g);
   assertEquals(42, g().y());
   assertEquals(42, g().y());
   %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-629062.js b/src/v8/test/mjsunit/regress/regress-crbug-629062.js
index 228ae6d..8234481 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-629062.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-629062.js
@@ -5,9 +5,9 @@
 // Flags: --allow-natives-syntax
 
 function foo(x) {
-  return 1 + ((1 == 0) && undefined);
-}
-
+  return 1 + (1 == 0 && undefined);
+};
+%PrepareFunctionForOptimization(foo);
 foo(false);
 foo(false);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-629435.js b/src/v8/test/mjsunit/regress/regress-crbug-629435.js
index b73f601..1a126be 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-629435.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-629435.js
@@ -14,6 +14,7 @@
 function foo() {
   var x = -0;
   bar(x + 1);
-}
+};
+%PrepareFunctionForOptimization(foo);
 %OptimizeFunctionOnNextCall(foo);
 foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-629823.js b/src/v8/test/mjsunit/regress/regress-crbug-629823.js
index bbf74b8..55d3cfe 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-629823.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-629823.js
@@ -4,7 +4,7 @@
 
 // Flags: --allow-natives-syntax
 
-var o = {}
+var o = {};
 function bar() {
   o[0] = +o[0];
   o = /\u23a1|__v_4/;
@@ -12,6 +12,9 @@
 bar();
 bar();
 bar();
-function foo() { bar(); }
+function foo() {
+  bar();
+};
+%PrepareFunctionForOptimization(foo);
 %OptimizeFunctionOnNextCall(foo);
 foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-630923.js b/src/v8/test/mjsunit/regress/regress-crbug-630923.js
index ff0d2dd..05ccc0a 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-630923.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-630923.js
@@ -10,7 +10,8 @@
 }
 function foo() {
   bar(o);
-}
+};
+%PrepareFunctionForOptimization(foo);
 foo();
 %OptimizeFunctionOnNextCall(foo);
 foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631027.js b/src/v8/test/mjsunit/regress/regress-crbug-631027.js
index f3d04b8..6fa1f77 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-631027.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631027.js
@@ -7,6 +7,7 @@
 function f() {
   with ({ value:"foo" }) { return value; }
 }
+%PrepareFunctionForOptimization(f);
 assertEquals("foo", f());
 %OptimizeFunctionOnNextCall(f);
 assertEquals("foo", f());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-1.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-1.js
index bd40dcd..6647882 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-631318-1.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-1.js
@@ -4,11 +4,16 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(x) { return x < x; }
+function foo(x) {
+  return x < x;
+}
 foo(1);
 foo(2);
 
-function bar(x) { foo(x); }
+function bar(x) {
+  foo(x);
+};
+%PrepareFunctionForOptimization(bar);
 %OptimizeFunctionOnNextCall(bar);
 
 assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-10.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-10.js
index 1c4fcca..d7456c4 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-631318-10.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-10.js
@@ -4,11 +4,16 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(x) { return x << x; }
+function foo(x) {
+  return x << x;
+}
 foo(1);
 foo(2);
 
-function bar(x) { foo(x); }
+function bar(x) {
+  foo(x);
+};
+%PrepareFunctionForOptimization(bar);
 %OptimizeFunctionOnNextCall(bar);
 
 assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-11.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-11.js
index a03a125..beccf8d 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-631318-11.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-11.js
@@ -4,11 +4,16 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(x) { return x >> x; }
+function foo(x) {
+  return x >> x;
+}
 foo(1);
 foo(2);
 
-function bar(x) { foo(x); }
+function bar(x) {
+  foo(x);
+};
+%PrepareFunctionForOptimization(bar);
 %OptimizeFunctionOnNextCall(bar);
 
 assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-12.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-12.js
index f710bd0..35fea62 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-631318-12.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-12.js
@@ -4,11 +4,16 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(x) { return x >>> x; }
+function foo(x) {
+  return x >>> x;
+}
 foo(1);
 foo(2);
 
-function bar(x) { foo(x); }
+function bar(x) {
+  foo(x);
+};
+%PrepareFunctionForOptimization(bar);
 %OptimizeFunctionOnNextCall(bar);
 
 assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-13.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-13.js
index 7a78448..3ee5f0f 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-631318-13.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-13.js
@@ -4,11 +4,16 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(x) { return x & x; }
+function foo(x) {
+  return x & x;
+}
 foo(1);
 foo(2);
 
-function bar(x) { foo(x); }
+function bar(x) {
+  foo(x);
+};
+%PrepareFunctionForOptimization(bar);
 %OptimizeFunctionOnNextCall(bar);
 
 assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-14.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-14.js
index 829bf90..d58c47b 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-631318-14.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-14.js
@@ -4,11 +4,16 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(x) { return x | x; }
+function foo(x) {
+  return x | x;
+}
 foo(1);
 foo(2);
 
-function bar(x) { foo(x); }
+function bar(x) {
+  foo(x);
+};
+%PrepareFunctionForOptimization(bar);
 %OptimizeFunctionOnNextCall(bar);
 
 assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-15.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-15.js
index 1257d79..6057e5e 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-631318-15.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-15.js
@@ -4,11 +4,16 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(x) { return x ^ x; }
+function foo(x) {
+  return x ^ x;
+}
 foo(1);
 foo(2);
 
-function bar(x) { foo(x); }
+function bar(x) {
+  foo(x);
+};
+%PrepareFunctionForOptimization(bar);
 %OptimizeFunctionOnNextCall(bar);
 
 assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-2.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-2.js
index ce46b27..bda54c3 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-631318-2.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-2.js
@@ -4,11 +4,16 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(x) { return x > x; }
+function foo(x) {
+  return x > x;
+}
 foo(1);
 foo(2);
 
-function bar(x) { foo(x); }
+function bar(x) {
+  foo(x);
+};
+%PrepareFunctionForOptimization(bar);
 %OptimizeFunctionOnNextCall(bar);
 
 assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-3.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-3.js
index 4258b15..b0b93fe 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-631318-3.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-3.js
@@ -4,11 +4,16 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(x) { return x >= x; }
+function foo(x) {
+  return x >= x;
+}
 foo(1);
 foo(2);
 
-function bar(x) { foo(x); }
+function bar(x) {
+  foo(x);
+};
+%PrepareFunctionForOptimization(bar);
 %OptimizeFunctionOnNextCall(bar);
 
 assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-4.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-4.js
index 7e8cdf8..4d6360a 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-631318-4.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-4.js
@@ -4,11 +4,16 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(x) { return x <= x; }
+function foo(x) {
+  return x <= x;
+}
 foo(1);
 foo(2);
 
-function bar(x) { foo(x); }
+function bar(x) {
+  foo(x);
+};
+%PrepareFunctionForOptimization(bar);
 %OptimizeFunctionOnNextCall(bar);
 
 assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-5.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-5.js
index acdedcb..de4e121 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-631318-5.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-5.js
@@ -4,11 +4,16 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(x) { return x + x; }
+function foo(x) {
+  return x + x;
+}
 foo(1);
 foo(2);
 
-function bar(x) { foo(x); }
+function bar(x) {
+  foo(x);
+};
+%PrepareFunctionForOptimization(bar);
 %OptimizeFunctionOnNextCall(bar);
 
 assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-6.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-6.js
index d17772f..9102344 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-631318-6.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-6.js
@@ -4,11 +4,16 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(x) { return x / x; }
+function foo(x) {
+  return x / x;
+}
 foo(1);
 foo(2);
 
-function bar(x) { foo(x); }
+function bar(x) {
+  foo(x);
+};
+%PrepareFunctionForOptimization(bar);
 %OptimizeFunctionOnNextCall(bar);
 
 assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-7.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-7.js
index 7d03fa8..61d638b 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-631318-7.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-7.js
@@ -4,11 +4,16 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(x) { return x * x; }
+function foo(x) {
+  return x * x;
+}
 foo(1);
 foo(2);
 
-function bar(x) { foo(x); }
+function bar(x) {
+  foo(x);
+};
+%PrepareFunctionForOptimization(bar);
 %OptimizeFunctionOnNextCall(bar);
 
 assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-8.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-8.js
index 474110b..322d0d0 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-631318-8.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-8.js
@@ -4,11 +4,16 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(x) { return x % x; }
+function foo(x) {
+  return x % x;
+}
 foo(1);
 foo(2);
 
-function bar(x) { foo(x); }
+function bar(x) {
+  foo(x);
+};
+%PrepareFunctionForOptimization(bar);
 %OptimizeFunctionOnNextCall(bar);
 
 assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-9.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-9.js
index ad472e0..acdcc51 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-631318-9.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-9.js
@@ -4,11 +4,16 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(x) { return x - x; }
+function foo(x) {
+  return x - x;
+}
 foo(1);
 foo(2);
 
-function bar(x) { foo(x); }
+function bar(x) {
+  foo(x);
+};
+%PrepareFunctionForOptimization(bar);
 %OptimizeFunctionOnNextCall(bar);
 
 assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-635923.js b/src/v8/test/mjsunit/regress/regress-crbug-635923.js
index 5101b79..7ce504f 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-635923.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-635923.js
@@ -4,9 +4,14 @@
 
 // Flags: --allow-natives-syntax --turbo-filter=f
 
-function f(x) { return x + 23 }
-function g(x) { return f(x) + 42 }
-
+function f(x) {
+  return x + 23;
+};
+%PrepareFunctionForOptimization(f);
+function g(x) {
+  return f(x) + 42;
+};
+%PrepareFunctionForOptimization(g);
 assertEquals(23, f(0));
 assertEquals(24, f(1));
 assertEquals(67, g(2));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-638551.js b/src/v8/test/mjsunit/regress/regress-crbug-638551.js
index f812359..a793032 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-638551.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-638551.js
@@ -7,12 +7,15 @@
 function f() {
   for (var i = 0; i < 10; i++) if (i == 5) %OptimizeOsr();
   function g() {}
+  %PrepareFunctionForOptimization(g);
   %OptimizeFunctionOnNextCall(g);
   g();
 }
+%PrepareFunctionForOptimization(f);
 f();
 gc();  // Make sure that ...
 gc();  // ... code flushing ...
 gc();  // ... clears code ...
 gc();  // ... attached to {g}.
+%PrepareFunctionForOptimization(f);
 f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-640369.js b/src/v8/test/mjsunit/regress/regress-crbug-640369.js
index 97982d1..3ca396b 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-640369.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-640369.js
@@ -8,8 +8,10 @@
   this.x = 0;
   for (var i = 0; i < max; ) {}
 }
+%EnsureFeedbackVectorForFunction(A);
 function foo() {
   for (var i = 0; i < 1; i = 2) %OptimizeOsr();
   return new A();
 }
+%PrepareFunctionForOptimization(foo);
 try { foo(); } catch (e) { }
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-640497.js b/src/v8/test/mjsunit/regress/regress-crbug-640497.js
index 3b90d1b..eb02802 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-640497.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-640497.js
@@ -5,14 +5,19 @@
 // Flags: --allow-natives-syntax --turbo-escape
 
 // Warm up {g} with arrays and strings.
-function g(v) { return v.length; }
+function g(v) {
+  return v.length;
+}
 assertEquals(1, g("x"));
 assertEquals(2, g("xy"));
 assertEquals(1, g([1]));
-assertEquals(2, g([1,2]));
+assertEquals(2, g([1, 2]));
 
 // Inline into {f}, where we see only an array.
-function f() { assertEquals(0, g([])); }
+function f() {
+  assertEquals(0, g([]));
+};
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-642056.js b/src/v8/test/mjsunit/regress/regress-crbug-642056.js
index ca9fc78..74b279e 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-642056.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-642056.js
@@ -6,9 +6,9 @@
 
 function f(o) {
   return o.x instanceof Array;
-}
-
-var o = { x : 1.5 };
+};
+%PrepareFunctionForOptimization(f);
+var o = {x: 1.5};
 o.x = 0;
 
 f(o);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-643073.js b/src/v8/test/mjsunit/regress/regress-crbug-643073.js
index 1301ddd..b2ed7ab 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-643073.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-643073.js
@@ -4,10 +4,12 @@
 
 // Flags: --allow-natives-syntax
 
-for (i in [0,0]) {}
+for (i in [0, 0]) {
+}
 function foo() {
   i = 0;
   return i < 0;
-}
+};
+%PrepareFunctionForOptimization(foo);
 %OptimizeFunctionOnNextCall(foo);
 foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-644245.js b/src/v8/test/mjsunit/regress/regress-crbug-644245.js
index 8671490..937e5bd 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-644245.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-644245.js
@@ -12,6 +12,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-644689-1.js b/src/v8/test/mjsunit/regress/regress-crbug-644689-1.js
index 49bf902..dd49e14 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-644689-1.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-644689-1.js
@@ -6,8 +6,10 @@
 
 for (var i = 0; i < 1024; ++i) Object.prototype["i" + i] = i;
 
-function foo() { [].push(1); }
-
+function foo() {
+  [].push(1);
+};
+%PrepareFunctionForOptimization(foo);
 foo();
 foo();
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-644689-2.js b/src/v8/test/mjsunit/regress/regress-crbug-644689-2.js
index 03831b1..958ad72 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-644689-2.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-644689-2.js
@@ -6,8 +6,10 @@
 
 for (var i = 0; i < 1024; ++i) Object.prototype["i" + i] = i;
 
-function foo() { [1].pop(); }
-
+function foo() {
+  [1].pop();
+};
+%PrepareFunctionForOptimization(foo);
 foo();
 foo();
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-645103.js b/src/v8/test/mjsunit/regress/regress-crbug-645103.js
index b81b9f2..04f04e2 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-645103.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-645103.js
@@ -11,6 +11,7 @@
     super();
   }
 }
+%PrepareFunctionForOptimization(Subclass);
 new Subclass();
 new Subclass();
 %OptimizeFunctionOnNextCall(Subclass);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-645438.js b/src/v8/test/mjsunit/regress/regress-crbug-645438.js
index ff17152..a8ab1c3 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-645438.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-645438.js
@@ -4,13 +4,15 @@
 
 // Flags: --allow-natives-syntax
 
-function n(x,y){
-  y = (y-(0x80000000|0)|0);
-  return (x/y)|0;
+function n(x, y) {
+  y = y - (0x80000000 | 0) | 0;
+  return x / y | 0;
 };
+%PrepareFunctionForOptimization(n);
+;
 var x = -0x80000000;
 var y = 0x7fffffff;
-n(x,y);
-n(x,y);
+n(x, y);
+n(x, y);
 %OptimizeFunctionOnNextCall(n);
-assertEquals(x, n(x,y));
+assertEquals(x, n(x, y));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-645888.js b/src/v8/test/mjsunit/regress/regress-crbug-645888.js
index 0687972..f29dbeb 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-645888.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-645888.js
@@ -15,4 +15,5 @@
     throw "no loop, thank you";
   }
 }
+%PrepareFunctionForOptimization(f);
 assertThrows(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-647217.js b/src/v8/test/mjsunit/regress/regress-crbug-647217.js
index ab45c9a..2beae1e 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-647217.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-647217.js
@@ -7,6 +7,12 @@
 var source = "return 1" + new Array(2048).join(' + a') + "";
 eval("function g(a) {" + source + "}");
 
-function f(a) { return g(a) }
+function f(a) {
+  return g(a);
+};
+%PrepareFunctionForOptimization(f);
 %OptimizeFunctionOnNextCall(f);
-try { f(0) } catch(e) {}
+try {
+  f(0);
+} catch (e) {
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-647887.js b/src/v8/test/mjsunit/regress/regress-crbug-647887.js
index 84e598d..e9ef5b3 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-647887.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-647887.js
@@ -10,5 +10,6 @@
   return key === undefined;
 }
 
+%PrepareFunctionForOptimization(f);
 %OptimizeFunctionOnNextCall(f);
 assertFalse(f({ foo:0 }));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-648539.js b/src/v8/test/mjsunit/regress/regress-crbug-648539.js
index c12f16d..78a9ba0 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-648539.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-648539.js
@@ -10,7 +10,8 @@
 }
 function g() {
   return f();
-}
+};
+%PrepareFunctionForOptimization(g);
 assertThrows(g, TypeError);
 assertThrows(g, TypeError);
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-648737.js b/src/v8/test/mjsunit/regress/regress-crbug-648737.js
index e78cb20..c70d92e 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-648737.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-648737.js
@@ -7,8 +7,9 @@
 function f(str) {
   var s = "We turn {" + str + "} into a ConsString now";
   return s.length;
-}
-assertEquals(33, f("a"));
+};
+%PrepareFunctionForOptimization(f);
+assertEquals(33, f('a'));
 assertEquals(33, f("b"));
 %OptimizeFunctionOnNextCall(f);
 assertEquals(33, f("c"));
@@ -17,8 +18,9 @@
   var s = "We also try to materalize {" + str + "} when deopting";
   %DeoptimizeNow();
   return s.length;
-}
-assertEquals(43, g("a"));
+};
+%PrepareFunctionForOptimization(g);
+assertEquals(43, g('a'));
 assertEquals(43, g("b"));
 %OptimizeFunctionOnNextCall(g);
 assertEquals(43, g("c"));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-650404.js b/src/v8/test/mjsunit/regress/regress-crbug-650404.js
index ebf14e6..e01a974 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-650404.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-650404.js
@@ -23,10 +23,14 @@
 
 function reader(o, i) {
   // Dummy try-catch, so that TurboFan is used to optimize this.
-  try {} catch(e) {}
+  try {
+  } catch (e) {
+  }
   return o[i];
 }
 // Optimize reader!
+;
+%PrepareFunctionForOptimization(reader);
 for (var i = 0; i < 3; i++) reader(bomb, 0);
 %OptimizeFunctionOnNextCall(reader);
 reader(bomb, 0);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-654723.js b/src/v8/test/mjsunit/regress/regress-crbug-654723.js
index fa81233..6d61d90 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-654723.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-654723.js
@@ -8,8 +8,8 @@
 
 function foo(s) {
   return k + s;
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 foo("a");
 foo("a");
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-655004.js b/src/v8/test/mjsunit/regress/regress-crbug-655004.js
index 1cba1ef..28c1bff 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-655004.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-655004.js
@@ -8,7 +8,8 @@
   a.x = 0;
   if (a.x === 0) a[1] = 0.1;
   a.x = {};
-}
+};
+%PrepareFunctionForOptimization(foo);
 foo(new Array(1));
 foo(new Array(1));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-656037.js b/src/v8/test/mjsunit/regress/regress-crbug-656037.js
index 47d09aa..a7372e2 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-656037.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-656037.js
@@ -6,8 +6,8 @@
 
 function foo(a) {
   return a.push(true);
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 var a = [];
 assertEquals(1, foo(a));
 assertEquals(2, foo(a));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-656275.js b/src/v8/test/mjsunit/regress/regress-crbug-656275.js
index 74b29c1..dafcb2a 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-656275.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-656275.js
@@ -6,8 +6,10 @@
 
 var a = 1;
 
-function foo(x) { a = Math.fround(x + 1); }
-
+function foo(x) {
+  a = Math.fround(x + 1);
+};
+%PrepareFunctionForOptimization(foo);
 foo(1);
 foo(1);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-657478.js b/src/v8/test/mjsunit/regress/regress-crbug-657478.js
index 0827a7a..2fdfd35 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-657478.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-657478.js
@@ -6,6 +6,7 @@
 
 function foo(o) { return %_ToLength(o.length); }
 
+%PrepareFunctionForOptimization(foo);
 foo(new Array(4));
 foo(new Array(Math.pow(2, 32) - 1));
 foo({length: 10});
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-658185.js b/src/v8/test/mjsunit/regress/regress-crbug-658185.js
index 60de8d6..1b3d6a8 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-658185.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-658185.js
@@ -6,14 +6,15 @@
 
 var t = 0;
 function foo() {
-  var o = {x:1};
-  var p = {y:2.5, x:0};
+  var o = {x: 1};
+  var p = {y: 2.5, x: 0};
   o = [];
   for (var i = 0; i < 2; ++i) {
     t = o.x;
     o = p;
   }
-}
+};
+%PrepareFunctionForOptimization(foo);
 foo();
 foo();
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-658691.js b/src/v8/test/mjsunit/regress/regress-crbug-658691.js
index 4f226e7..6f8fef6 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-658691.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-658691.js
@@ -15,8 +15,10 @@
 // The {g} function is compiled using Ignition.
 // 1) The call to {f} requires arguments adaptation.
 // 2) The call to {f} is not in tail position.
+;
+%PrepareFunctionForOptimization(f);
 function g() {
-  return f() + "-no-tail";
+  return f() + '-no-tail';
 }
 
 assertEquals("true-no-tail", g());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-659475-1.js b/src/v8/test/mjsunit/regress/regress-crbug-659475-1.js
index 2648203..dd138dc 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-659475-1.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-659475-1.js
@@ -14,11 +14,13 @@
   n.xyz = 0x826852f4;
 }
 
+%PrepareFunctionForOptimization(Ctor);
 Ctor();
 Ctor();
 %OptimizeFunctionOnNextCall(Ctor);
 Ctor();
 
+%PrepareFunctionForOptimization(Check);
 Check();
 Check();
 %OptimizeFunctionOnNextCall(Check);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-659475-2.js b/src/v8/test/mjsunit/regress/regress-crbug-659475-2.js
index 49e02fd..6ae3f49 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-659475-2.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-659475-2.js
@@ -15,11 +15,13 @@
   n.xyz = 0x826852f4;
 }
 
+%PrepareFunctionForOptimization(Ctor);
 Ctor();
 Ctor();
 %OptimizeFunctionOnNextCall(Ctor);
 Ctor();
 
+%PrepareFunctionForOptimization(Check);
 Check();
 Check();
 %OptimizeFunctionOnNextCall(Check);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-659915a.js b/src/v8/test/mjsunit/regress/regress-crbug-659915a.js
index 507a0f1..1e6a12d 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-659915a.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-659915a.js
@@ -17,6 +17,7 @@
 
 function boom() { return g(1) }
 
+%PrepareFunctionForOptimization(boom);
 assertEquals(1, h(1));
 assertEquals(2, boom());
 assertEquals(3, boom());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-659915b.js b/src/v8/test/mjsunit/regress/regress-crbug-659915b.js
index 6fdb13f..16f9ffc 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-659915b.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-659915b.js
@@ -5,16 +5,25 @@
 // Flags: --allow-natives-syntax
 
 (function() {
-  var x = 23;
-  function f() { return x; }
-  function g() { [x] = [x + 1]; }
-  function h() { g(); return x; }
+var x = 23;
+function f() {
+  return x;
+}
+function g() {
+  [x] = [x + 1];
+}
+function h() {
+  g();
+  return x;
+}
 
-  function boom() { return h() }
-
-  assertEquals(24, boom());
-  assertEquals(25, boom());
-  assertEquals(26, boom());
-  %OptimizeFunctionOnNextCall(boom);
-  assertEquals(27, boom());
+function boom() {
+  return h();
+};
+%PrepareFunctionForOptimization(boom);
+assertEquals(24, boom());
+assertEquals(25, boom());
+assertEquals(26, boom());
+%OptimizeFunctionOnNextCall(boom);
+assertEquals(27, boom());
 })();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-660379.js b/src/v8/test/mjsunit/regress/regress-crbug-660379.js
index 8463462..6c65829 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-660379.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-660379.js
@@ -13,9 +13,10 @@
     try {
       g();  // Right at the end of try.
     } catch (e) {
-      assertEquals("boom", e)
+      assertEquals('boom', e);
     }
-  }
+  };
+  %PrepareFunctionForOptimization(f);
   assertDoesNotThrow(f);
   assertDoesNotThrow(f);
   %OptimizeFunctionOnNextCall(f);
@@ -34,7 +35,8 @@
     } catch (e) {
       assertUnreachable();
     }
-  }
+  };
+  %PrepareFunctionForOptimization(f);
   assertThrows(f);
   assertThrows(f);
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-661949.js b/src/v8/test/mjsunit/regress/regress-crbug-661949.js
index e083cae..08093a5 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-661949.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-661949.js
@@ -4,11 +4,14 @@
 
 // Flags: --allow-natives-syntax
 
-var foo = (function() {
+var foo = function() {
   'use asm';
-  function foo() { ''[0]; }
+  function foo() {
+    ''[0];
+  };
+  %PrepareFunctionForOptimization(foo);
   return foo;
-})();
+}();
 
 foo();
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-662367.js b/src/v8/test/mjsunit/regress/regress-crbug-662367.js
index fcaf545..700531b 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-662367.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-662367.js
@@ -9,7 +9,8 @@
 (function ConstantFoldZeroDivZero() {
   function f() {
     return 0 / zero;
-  }
+  };
+  %PrepareFunctionForOptimization(f);
   assertTrue(isNaN(f()));
   assertTrue(isNaN(f()));
   %OptimizeFunctionOnNextCall(f);
@@ -19,7 +20,8 @@
 (function ConstantFoldMinusZeroDivZero() {
   function f() {
     return -0 / zero;
-  }
+  };
+  %PrepareFunctionForOptimization(f);
   assertTrue(isNaN(f()));
   assertTrue(isNaN(f()));
   %OptimizeFunctionOnNextCall(f);
@@ -29,7 +31,8 @@
 (function ConstantFoldNaNDivZero() {
   function f() {
     return NaN / 0;
-  }
+  };
+  %PrepareFunctionForOptimization(f);
   assertTrue(isNaN(f()));
   assertTrue(isNaN(f()));
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-662410.js b/src/v8/test/mjsunit/regress/regress-crbug-662410.js
index f1cbc6b..5818a93 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-662410.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-662410.js
@@ -4,7 +4,9 @@
 
 // Flags: --allow-natives-syntax
 
-function g(v) { return v.constructor; }
+function g(v) {
+  return v.constructor;
+}
 
 g({});
 g({});
@@ -15,7 +17,7 @@
     i = i + 1;
     g(i);
   } while (i < 1);
-}
-
+};
+%PrepareFunctionForOptimization(f);
 %OptimizeFunctionOnNextCall(f);
 f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-662830.js b/src/v8/test/mjsunit/regress/regress-crbug-662830.js
index 3126978..27ba39d 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-662830.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-662830.js
@@ -11,9 +11,11 @@
 
 function g() {
   try { f(); } catch(e) { }
+  %PrepareFunctionForOptimization(g);
   for (var i = 0; i < 3; ++i) if (i === 1) %OptimizeOsr();
   %_DeoptimizeNow();
 }
+%PrepareFunctionForOptimization(g);
 
 %OptimizeFunctionOnNextCall(g);
 g();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-663340.js b/src/v8/test/mjsunit/regress/regress-crbug-663340.js
index 37d285d..1343921 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-663340.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-663340.js
@@ -7,10 +7,11 @@
 var expected = undefined;
 
 function foo() {
-  var a = [0,,{}];
+  var a = [0, , {}];
   a.shift();
   assertEquals(expected, a[0]);
-}
+};
+%PrepareFunctionForOptimization(foo);
 foo();
 foo();
 %OptimizeFunctionOnNextCall(foo);
@@ -22,10 +23,11 @@
 foo();
 
 function bar() {
-  var a = [0,,{}];
+  var a = [0, , {}];
   a.shift();
   assertEquals(expected, a[0]);
-}
+};
+%PrepareFunctionForOptimization(bar);
 bar();
 bar();
 %OptimizeFunctionOnNextCall(bar);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-663402.js b/src/v8/test/mjsunit/regress/regress-crbug-663402.js
index 5368bd6..4349972 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-663402.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-663402.js
@@ -23,6 +23,7 @@
 // a single instruction's immediate field (2^12).
 var kLength = 701;
 emit_f(kLength);
+%PrepareFunctionForOptimization(f);
 f(1);
 f(1);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-663750.js b/src/v8/test/mjsunit/regress/regress-crbug-663750.js
index 1b3b531..885bb9b 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-663750.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-663750.js
@@ -11,6 +11,7 @@
 this.x = 0;
 delete x;
 
+%PrepareFunctionForOptimization(foo);
 foo();
 foo();
 %OptimizeFunctionOnNextCall(foo);
@@ -19,6 +20,7 @@
 
 Object.freeze(this);
 
+%PrepareFunctionForOptimization(foo);
 foo(4);
 foo(5);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-664084.js b/src/v8/test/mjsunit/regress/regress-crbug-664084.js
index 79e221e..55eb4d2 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-664084.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-664084.js
@@ -6,8 +6,8 @@
 
 function foo() {
   return +({} + 1);
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 assertEquals(NaN, foo());
 assertEquals(NaN, foo());
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-664942.js b/src/v8/test/mjsunit/regress/regress-crbug-664942.js
index 3b76990..7041637 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-664942.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-664942.js
@@ -6,7 +6,8 @@
 
 function foo() {
   return 'x'[0];
-}
+};
+%PrepareFunctionForOptimization(foo);
 foo();
 %OptimizeFunctionOnNextCall(foo);
 assertEquals("x", foo());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-665587.js b/src/v8/test/mjsunit/regress/regress-crbug-665587.js
index a9b3841..48f31c5 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-665587.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-665587.js
@@ -13,4 +13,5 @@
     gc();
   }
 }
+%PrepareFunctionForOptimization(f);
 f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-665793.js b/src/v8/test/mjsunit/regress/regress-crbug-665793.js
index d445d51..8ff8460 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-665793.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-665793.js
@@ -6,7 +6,8 @@
 
 function foo() {
   return 'x'[1];
-}
+};
+%PrepareFunctionForOptimization(foo);
 assertEquals(undefined, foo());
 %OptimizeFunctionOnNextCall(foo);
 assertEquals(undefined, foo());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-667689.js b/src/v8/test/mjsunit/regress/regress-crbug-667689.js
index e83c40e..174a7d9 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-667689.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-667689.js
@@ -5,12 +5,18 @@
 // Flags: --allow-natives-syntax
 
 function foo() {}
-foo.__defineGetter__(undefined, function() {})
+foo.__defineGetter__(undefined, function() {});
 
 function bar() {}
-function baz(x) { return x instanceof bar };
+function baz(x) {
+  return x instanceof bar;
+};
+%PrepareFunctionForOptimization(baz);
+;
 %OptimizeFunctionOnNextCall(baz);
 baz();
 Object.setPrototypeOf(bar, null);
-bar[Symbol.hasInstance] = function() { return true };
+bar[Symbol.hasInstance] = function() {
+  return true;
+};
 assertTrue(baz());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-668795.js b/src/v8/test/mjsunit/regress/regress-crbug-668795.js
index b85d222..42c2d52 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-668795.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-668795.js
@@ -17,5 +17,6 @@
   }
   return result;
 }
+%PrepareFunctionForOptimization(f);
 
 assertEquals("R:121212", f());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-669451.js b/src/v8/test/mjsunit/regress/regress-crbug-669451.js
index 0bbc1c1..7354ce3 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-669451.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-669451.js
@@ -6,10 +6,20 @@
 
 function foo() {
   var a = [,];
-  a[0] = {}
+  a[0] = {};
   a[0].toString = FAIL;
+};
+%PrepareFunctionForOptimization(foo);
+try {
+  foo();
+} catch (e) {
 }
-try { foo(); } catch (e) {}
-try { foo(); } catch (e) {}
+try {
+  foo();
+} catch (e) {
+}
 %OptimizeFunctionOnNextCall(foo);
-try { foo(); } catch (e) {}
+try {
+  foo();
+} catch (e) {
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-669850.js b/src/v8/test/mjsunit/regress/regress-crbug-669850.js
index 50f5940..7330f78 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-669850.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-669850.js
@@ -5,6 +5,7 @@
 // Flags: --allow-natives-syntax
 
 eval('function f(a) { return [' + new Array(1 << 17) + ',a] }');
+%PrepareFunctionForOptimization(f);
 assertEquals(23, f(23)[1 << 17]);
 assertEquals(42, f(42)[1 << 17]);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-671576.js b/src/v8/test/mjsunit/regress/regress-crbug-671576.js
index b9c7bcc..94710b3 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-671576.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-671576.js
@@ -8,6 +8,7 @@
   for (var i of [NaN].keys());
 }
 
+%PrepareFunctionForOptimization(f);
 f();
 %OptimizeFunctionOnNextCall(f);
 f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-672792.js b/src/v8/test/mjsunit/regress/regress-crbug-672792.js
index d458f7c..91af1e7 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-672792.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-672792.js
@@ -7,6 +7,8 @@
 // Generate a function {f} containing a large array literal of doubles.
 eval("function f() { return [" + String("0.1,").repeat(65535) + "] }");
 
+%PrepareFunctionForOptimization(f);
+
 // Running the function once will initialize the boilerplate.
 assertEquals(65535, f().length);
 
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-679202.js b/src/v8/test/mjsunit/regress/regress-crbug-679202.js
index e435022..7300490 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-679202.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-679202.js
@@ -6,8 +6,10 @@
 
 var x = Object.prototype;
 
-function f() { return x <= x; }
-
+function f() {
+  return x <= x;
+};
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-679378.js b/src/v8/test/mjsunit/regress/regress-crbug-679378.js
index fded13f..f6bba5d 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-679378.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-679378.js
@@ -6,12 +6,19 @@
 
 var x = {};
 x.__defineGetter__('0', () => 0);
-x.a = {v: 1.51};
+x.a = {
+  v: 1.51
+};
 
 var y = {};
-y.a = {u:"OK"};
+y.a = {
+  u: 'OK'
+};
 
-function foo(o) { return o.a.u; }
+function foo(o) {
+  return o.a.u;
+};
+%PrepareFunctionForOptimization(foo);
 foo(y);
 foo(y);
 foo(x);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-681983.js b/src/v8/test/mjsunit/regress/regress-crbug-681983.js
index eab161c..a812a82 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-681983.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-681983.js
@@ -14,5 +14,6 @@
   return g(-1);
 }
 
+%PrepareFunctionForOptimization(f);
 %OptimizeFunctionOnNextCall(f);
 assertEquals(4294967295, f());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-684208.js b/src/v8/test/mjsunit/regress/regress-crbug-684208.js
index 7055a7e..26d66d1 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-684208.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-684208.js
@@ -9,6 +9,7 @@
   %_DeoptimizeNow();
   return a[2];
 }
+%PrepareFunctionForOptimization(foo);
 assertSame(undefined, foo());
 assertSame(undefined, foo());
 %OptimizeFunctionOnNextCall(foo)
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-685050.js b/src/v8/test/mjsunit/regress/regress-crbug-685050.js
index 2560e2e..72d9db3 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-685050.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-685050.js
@@ -14,6 +14,7 @@
 function foo() {
   bar([1, 2, 3]);
   bar(a);
-}
+};
+%PrepareFunctionForOptimization(foo);
 %OptimizeFunctionOnNextCall(foo);
 foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-685506.js b/src/v8/test/mjsunit/regress/regress-crbug-685506.js
index 1be9c02..087e9898 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-685506.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-685506.js
@@ -11,14 +11,15 @@
   for (var __v_1 = 0; __v_1 < 10016; __v_1++) {
     a.push({});
   }
-  a.map(function() {}) + "";
+  a.map(function() {}) + '';
 }
 init();
 
 function foo() {
   a.push((a + "!", 23));
   return a;
-}
+};
+%PrepareFunctionForOptimization(foo);
 assertEquals(23, foo()[10016]);
 assertEquals(23, foo()[10017]);
 assertEquals(23, foo()[10018]);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-685634.js b/src/v8/test/mjsunit/regress/regress-crbug-685634.js
index 2032744..9b4d70d 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-685634.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-685634.js
@@ -6,7 +6,10 @@
 
 "use strict";
 
-function foo(f) { return f.apply(this, arguments); }
+function foo(f) {
+  return f.apply(this, arguments);
+};
+%PrepareFunctionForOptimization(foo);
 function bar() {}
 
 foo(bar);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-685680.js b/src/v8/test/mjsunit/regress/regress-crbug-685680.js
index 3c23e41..ff15965 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-685680.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-685680.js
@@ -7,8 +7,8 @@
 function foo(s) {
   s = s + '0123456789012';
   return s.indexOf('0');
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 assertEquals(0, foo('0'));
 assertEquals(0, foo('0'));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-686102.js b/src/v8/test/mjsunit/regress/regress-crbug-686102.js
index 13f4503..7aa0a35 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-686102.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-686102.js
@@ -8,7 +8,8 @@
 Object.freeze(a);
 function foo() {
   return a.length;
-}
+};
+%PrepareFunctionForOptimization(foo);
 assertEquals(0, foo());
 assertEquals(0, foo());
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-686427.js b/src/v8/test/mjsunit/regress/regress-crbug-686427.js
index b1827a4..8ee3664 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-686427.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-686427.js
@@ -7,7 +7,8 @@
 function f(a, base) {
   a[base + 4] = 23;
   return a;
-}
+};
+%PrepareFunctionForOptimization(f);
 var i = 1073741824;
 assertEquals(23, f({}, 1)[1 + 4]);
 assertEquals(23, f([], 2)[2 + 4]);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-686737.js b/src/v8/test/mjsunit/regress/regress-crbug-686737.js
index aab7113..5c85aac 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-686737.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-686737.js
@@ -4,9 +4,14 @@
 
 // Flags: --allow-natives-syntax
 
-Object.prototype.__defineGetter__(0, () => { throw Error() });
-var a = [,0.1];
-function foo(i) { a[i]; }
+Object.prototype.__defineGetter__(0, () => {
+  throw Error();
+});
+var a = [, 0.1];
+function foo(i) {
+  a[i];
+};
+%PrepareFunctionForOptimization(foo);
 foo(1);
 foo(1);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-687029.js b/src/v8/test/mjsunit/regress/regress-crbug-687029.js
index c3ca01f..056e252 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-687029.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-687029.js
@@ -7,7 +7,8 @@
 function foo(x) {
   x = Math.clz32(x);
   return "a".indexOf("a", x);
-}
+};
+%PrepareFunctionForOptimization(foo);
 foo(1);
 foo(1);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-687063.js b/src/v8/test/mjsunit/regress/regress-crbug-687063.js
new file mode 100644
index 0000000..c887f70
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-687063.js
@@ -0,0 +1,32 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Collect the actual properties looked up on the Proxy.
+const actual = [];
+
+// Perform a relational comparison with a Proxy on the right hand
+// side and a Symbol which cannot be turned into a Number on the
+// left hand side.
+function foo() {
+  actual.length = 0;
+  const lhs = Symbol();
+  const rhs = new Proxy({}, {
+    get: function(target, property, receiver) {
+      actual.push(property);
+      return undefined;
+    }
+  });
+
+  return lhs < rhs;
+};
+%PrepareFunctionForOptimization(foo);
+assertThrows(foo, TypeError);
+assertEquals([Symbol.toPrimitive, 'valueOf', 'toString'], actual);
+assertThrows(foo, TypeError);
+assertEquals([Symbol.toPrimitive, 'valueOf', 'toString'], actual);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(foo, TypeError);
+assertEquals([Symbol.toPrimitive, 'valueOf', 'toString'], actual);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-687990.js b/src/v8/test/mjsunit/regress/regress-crbug-687990.js
index 2410085..da82f2e 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-687990.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-687990.js
@@ -12,5 +12,6 @@
   return function() { o.x = null; }
 })();
 
+%PrepareFunctionForOptimization(foo);
 %OptimizeFunctionOnNextCall(foo);
 foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-691323.js b/src/v8/test/mjsunit/regress/regress-crbug-691323.js
index d786875..5002cea 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-691323.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-691323.js
@@ -7,7 +7,7 @@
 var array = new Uint8Array(buffer).fill(55);
 var tmp = {};
 tmp[Symbol.toPrimitive] = function () {
-  %ArrayBufferNeuter(array.buffer)
+  %ArrayBufferDetach(array.buffer)
   return 0;
 };
 
@@ -18,7 +18,7 @@
 array = new Uint8Array(buffer).fill(55);
 tmp = {};
 tmp[Symbol.toPrimitive] = function () {
-  %ArrayBufferNeuter(array.buffer)
+  %ArrayBufferDetach(array.buffer)
   return 0;
 };
 
@@ -29,7 +29,7 @@
 array = new Uint8Array(buffer).fill(55);
 tmp = {};
 tmp[Symbol.toPrimitive] = function () {
-  %ArrayBufferNeuter(array.buffer)
+  %ArrayBufferDetach(array.buffer)
   return 0;
 };
 assertEquals(true, Array.prototype.includes.call(array, undefined, tmp));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-694416.js b/src/v8/test/mjsunit/regress/regress-crbug-694416.js
index 14303f2..fe10178 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-694416.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-694416.js
@@ -9,8 +9,8 @@
 
 function foo(name) {
   return this[name];
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 assertEquals(23, foo('good'));
 assertEquals(23, foo('good'));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-694709.js b/src/v8/test/mjsunit/regress/regress-crbug-694709.js
index 407b477..945024b 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-694709.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-694709.js
@@ -6,7 +6,8 @@
 
 function f(primitive) {
   return primitive.__proto__;
-}
+};
+%PrepareFunctionForOptimization(f);
 assertEquals(Symbol.prototype, f(Symbol()));
 assertEquals(Symbol.prototype, f(Symbol()));
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-696622.js b/src/v8/test/mjsunit/regress/regress-crbug-696622.js
index 5b8d2e3..79c4144 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-696622.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-696622.js
@@ -8,6 +8,7 @@
 class D extends C { constructor() { super(...unresolved, 75) } }
 D.__proto__ = null;
 
+%PrepareFunctionForOptimization(D);
 assertThrows(() => new D(), TypeError);
 assertThrows(() => new D(), TypeError);
 %OptimizeFunctionOnNextCall(D);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-698607.js b/src/v8/test/mjsunit/regress/regress-crbug-698607.js
index c9df425..07d53cc 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-698607.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-698607.js
@@ -6,16 +6,16 @@
 
 function assertSame(expected, found) {
   if (found === expected) {
-  } else if ((expected !== expected) && (found !== found)) {
+  } else if (expected !== expected && found !== found) {
   }
 }
 
 function foo() {
-  var x = {var: 0.5};
+  var x = {var : 0.5};
   assertSame(x, x.val);
   return () => x;
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 foo(1);
 foo(1);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-699282.js b/src/v8/test/mjsunit/regress/regress-crbug-699282.js
index 726b1f7..21d96cb 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-699282.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-699282.js
@@ -5,7 +5,10 @@
 // Flags: --allow-natives-syntax
 
 var v = 1;
-function foo() { return Math.floor(-v / 125); }
+function foo() {
+  return Math.floor(-v / 125);
+};
+%PrepareFunctionForOptimization(foo);
 assertEquals(-1, foo());
 %OptimizeFunctionOnNextCall(foo);
 assertEquals(-1, foo());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-700733.js b/src/v8/test/mjsunit/regress/regress-crbug-700733.js
index 0a130fa..5683e7a 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-700733.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-700733.js
@@ -27,6 +27,7 @@
   var obj = {};
   obj.load_boom = smi_arr;
 
+  %PrepareFunctionForOptimization(do_keyed_load);
   do_keyed_load(arrs);
   do_keyed_load(arrs);
   %OptimizeFunctionOnNextCall(do_keyed_load);
@@ -57,6 +58,7 @@
   var obj = {};
   obj.store_boom = smi_arr;
 
+  %PrepareFunctionForOptimization(do_keyed_store);
   do_keyed_store(arrs);
   do_keyed_store(arrs);
   %OptimizeFunctionOnNextCall(do_keyed_store);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-703610.js b/src/v8/test/mjsunit/regress/regress-crbug-703610.js
index a8901d5..3115fe7 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-703610.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-703610.js
@@ -9,7 +9,8 @@
 new fun();
 function f() {
   return fun.prototype;
-}
+};
+%PrepareFunctionForOptimization(f);
 assertEquals(42, f());
 assertEquals(42, f());
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-706642.js b/src/v8/test/mjsunit/regress/regress-crbug-706642.js
index 4467c68..a10cdc0 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-706642.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-706642.js
@@ -31,6 +31,7 @@
   }
 });
 
+%PrepareFunctionForOptimization(B);
 Reflect.construct(B, [], observer);
 Reflect.construct(B, [], observer);
 %OptimizeFunctionOnNextCall(B);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-708050-1.js b/src/v8/test/mjsunit/regress/regress-crbug-708050-1.js
index be26e10..4b4ae40 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-708050-1.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-708050-1.js
@@ -4,14 +4,14 @@
 
 // Flags: --allow-natives-syntax
 
-var v = {}
+var v = {};
 
 function foo() {
   v[0] = 5;
   v[-0] = 27;
   return v[0];
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 assertEquals(27, foo());
 %OptimizeFunctionOnNextCall(foo);
 assertEquals(27, foo());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-708050-2.js b/src/v8/test/mjsunit/regress/regress-crbug-708050-2.js
index a7d9b29..a8c50a4 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-708050-2.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-708050-2.js
@@ -10,8 +10,8 @@
   v[0] = 5;
   v[-0] = 27;
   return v[0];
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 assertEquals(27, foo());
 %OptimizeFunctionOnNextCall(foo);
 assertEquals(27, foo());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-709537.js b/src/v8/test/mjsunit/regress/regress-crbug-709537.js
index 088c65b..05c38eb 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-709537.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-709537.js
@@ -6,7 +6,8 @@
 
 function foo() {
   return { 0: {}, x: {} };
-}
+};
+%PrepareFunctionForOptimization(foo);
 var ref = foo();
 assertEquals(ref, foo());
 assertEquals(ref, foo());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-709753.js b/src/v8/test/mjsunit/regress/regress-crbug-709753.js
index e4d4d4e..315d8c6 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-709753.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-709753.js
@@ -4,9 +4,11 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(a, i) { a[i].x; }
-
-var a = [,0.1];
+function foo(a, i) {
+  a[i].x;
+};
+%PrepareFunctionForOptimization(foo);
+var a = [, 0.1];
 foo(a, 1);
 foo(a, 1);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-711166.js b/src/v8/test/mjsunit/regress/regress-crbug-711166.js
index 7f4acb9..93fbaf8 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-711166.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-711166.js
@@ -4,18 +4,25 @@
 
 // Flags: --allow-natives-syntax
 
-'use strict'
+'use strict';
 function g() {
   var x = 1;
-  try { undefined.x } catch (e) { x = e; }
-  (function() { x });
+  try {
+    undefined.x;
+  } catch (e) {
+    x = e;
+  }
+  (function() {
+    x;
+  });
   return x;
 }
 function f(a) {
   var args = arguments;
   assertInstanceof(g(), TypeError);
   return args.length;
-}
+};
+%PrepareFunctionForOptimization(f);
 assertEquals(1, f(0));
 assertEquals(1, f(0));
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-712802.js b/src/v8/test/mjsunit/regress/regress-crbug-712802.js
index e23519e..de99a58 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-712802.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-712802.js
@@ -4,8 +4,10 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(...args) { return Array.isArray(args); }
-
+function foo(...args) {
+  return Array.isArray(args);
+};
+%PrepareFunctionForOptimization(foo);
 assertTrue(foo());
 assertTrue(foo());
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-715151.js b/src/v8/test/mjsunit/regress/regress-crbug-715151.js
index c0b2c5d..3bd99ec 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-715151.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-715151.js
@@ -8,7 +8,8 @@
   var a = [0];
   Object.preventExtensions(a);
   return a.pop();
-}
+};
+%PrepareFunctionForOptimization(foo);
 foo();
 foo();
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-715404.js b/src/v8/test/mjsunit/regress/regress-crbug-715404.js
index 8ff2d00..0667d20 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-715404.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-715404.js
@@ -4,7 +4,10 @@
 
 // Flags: --allow-natives-syntax
 
-function foo() { Array(-1); }
+function foo() {
+  Array(-1);
+};
+%PrepareFunctionForOptimization(foo);
 assertThrows(foo, RangeError);
 assertThrows(foo, RangeError);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-715455.js b/src/v8/test/mjsunit/regress/regress-crbug-715455.js
index 21ec165..87b2402 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-715455.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-715455.js
@@ -20,6 +20,6 @@
   src = src.replace(/MODULE/g, "Module" + i);
   src = src.replace(/LIMIT/g, test_set[i]);
   var module = eval("(" + src + ")");
-  assertDoesNotThrow(module(this).f());
+  module(this).f();
   assertFalse(%IsAsmWasmCode(module));
 }
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-715862.js b/src/v8/test/mjsunit/regress/regress-crbug-715862.js
index 60e836d..b64ff19 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-715862.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-715862.js
@@ -8,8 +8,8 @@
   a.x = 0;
   a[1] = 0.1;
   a.x = {};
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f(new Array(1));
 f(new Array());
 
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-719479.js b/src/v8/test/mjsunit/regress/regress-crbug-719479.js
index dac49de..40e3895 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-719479.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-719479.js
@@ -15,9 +15,10 @@
 };
 bar([{}, 6, NaN], [1.8, , NaN]);
 function foo() {
-  var a = [1,2,3,4];
+  var a = [1, 2, 3, 4];
   bar(a.length, a.length);
-}
+};
+%PrepareFunctionForOptimization(foo);
 foo();
 foo();
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-722756.js b/src/v8/test/mjsunit/regress/regress-crbug-722756.js
index b4d82ad..aa5a735 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-722756.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-722756.js
@@ -7,31 +7,33 @@
 var array = [[{}], [1.1]];
 
 function transition() {
-  for(var i = 0; i < array.length; i++){
+  for (var i = 0; i < array.length; i++) {
     var arr = array[i];
     arr[0] = {};
   }
 }
 
-var double_arr2 = [1.1,2.2];
+var double_arr2 = [1.1, 2.2];
 
 var flag = 0;
 function swap() {
-  try {} catch(e) {}  // Prevent Crankshaft from inlining this.
+  try {
+  } catch (e) {
+  }  // Prevent Crankshaft from inlining this.
   if (flag == 1) {
     array[1] = double_arr2;
   }
 }
 
 var expected = 6.176516726456e-312;
-function f(){
+function f() {
   swap();
   double_arr2[0] = 1;
   transition();
   double_arr2[1] = expected;
-}
-
-for(var i = 0; i < 3; i++) {
+};
+%PrepareFunctionForOptimization(f);
+for (var i = 0; i < 3; i++) {
   f();
 }
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-722871.js b/src/v8/test/mjsunit/regress/regress-crbug-722871.js
index c5b7958..e71f083 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-722871.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-722871.js
@@ -7,7 +7,7 @@
 let runningWorkers = 0;
 
 function startWorker(script) {
-  let worker = new Worker(script);
+  let worker = new Worker(script, {type: 'string'});
   worker.done = false;
   worker.idx = workers.length;
   workers.push(worker);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-723455.js b/src/v8/test/mjsunit/regress/regress-crbug-723455.js
index 85f5e3c..d42b15b 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-723455.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-723455.js
@@ -8,8 +8,8 @@
   a.x = 0;
   a[0] = 0.1;
   a.x = {};
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f(new Array(1));
 f(new Array(1));
 f(new Array());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-724153.js b/src/v8/test/mjsunit/regress/regress-crbug-724153.js
index 541a493..a571f8e 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-724153.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-724153.js
@@ -6,11 +6,12 @@
 
 (function TestParameterLimit() {
   var src = '(function f(a,';
-  for (var i = 0; i < 65535 - 2; i++) {
+  for (var i = 0; i < 65534 - 2; i++) {
     src += 'b' + i + ',';
   }
   src += 'c) { return a + c })';
   var f = eval(src);
+  %PrepareFunctionForOptimization(f);
   assertEquals(NaN, f(1));
   assertEquals(NaN, f(2));
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-724608.js b/src/v8/test/mjsunit/regress/regress-crbug-724608.js
index cd91211..54ffddd 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-724608.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-724608.js
@@ -6,7 +6,8 @@
 
 function foo(x) {
   return {['p']: 0, x};
-}
+};
+%PrepareFunctionForOptimization(foo);
 foo();
 var a = {['p']: ''};
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-725201.js b/src/v8/test/mjsunit/regress/regress-crbug-725201.js
index c540b6d..bedad8f 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-725201.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-725201.js
@@ -8,6 +8,7 @@
   function __f_2() {
     Array.prototype.__proto__ = { 77e4  : null };
   }
+  %PrepareFunctionForOptimization(__f_2);
   __f_2();
   %OptimizeFunctionOnNextCall(__f_2);
   __f_2();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-729573-1.js b/src/v8/test/mjsunit/regress/regress-crbug-729573-1.js
index 1b596ab..8d1ecf3 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-729573-1.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-729573-1.js
@@ -5,63 +5,69 @@
 // Flags: --allow-natives-syntax
 
 (function() {
-  function foo() {
-    var a = foo.bind(this);
-    %DeoptimizeNow();
-    if (!a) return a;
-    return 0;
-  }
-
-  assertEquals(0, foo());
-  assertEquals(0, foo());
-  %OptimizeFunctionOnNextCall(foo);
-  assertEquals(0, foo());
+function foo() {
+  var a = foo.bind(this);
+  %DeoptimizeNow();
+  if (!a) return a;
+  return 0;
+};
+%PrepareFunctionForOptimization(foo);
+assertEquals(0, foo());
+assertEquals(0, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(0, foo());
 })();
 
 (function() {
-  "use strict";
+"use strict";
 
-  function foo() {
-    var a = foo.bind(this);
-    %DeoptimizeNow();
-    if (!a) return a;
-    return 0;
-  }
-
-  assertEquals(0, foo());
-  assertEquals(0, foo());
-  %OptimizeFunctionOnNextCall(foo);
-  assertEquals(0, foo());
+function foo() {
+  var a = foo.bind(this);
+  %DeoptimizeNow();
+  if (!a) return a;
+  return 0;
+};
+%PrepareFunctionForOptimization(foo);
+assertEquals(0, foo());
+assertEquals(0, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(0, foo());
 })();
 
 (function() {
-  function foo() {
-    var a = foo.bind(this);
-    %DeoptimizeNow();
-    if (!a) return a;
-    return 0;
-  }
-  foo.prototype = {custom: "prototype"};
+function foo() {
+  var a = foo.bind(this);
+  %DeoptimizeNow();
+  if (!a) return a;
+  return 0;
+};
+%PrepareFunctionForOptimization(foo);
+foo.prototype = {
+  custom: 'prototype'
+};
 
-  assertEquals(0, foo());
-  assertEquals(0, foo());
-  %OptimizeFunctionOnNextCall(foo);
-  assertEquals(0, foo());
+assertEquals(0, foo());
+assertEquals(0, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(0, foo());
 })();
 
 (function() {
-  "use strict";
+"use strict";
 
-  function foo() {
-    var a = foo.bind(this);
-    %DeoptimizeNow();
-    if (!a) return a;
-    return 0;
-  }
-  foo.prototype = {custom: "prototype"};
+function foo() {
+  var a = foo.bind(this);
+  %DeoptimizeNow();
+  if (!a) return a;
+  return 0;
+};
+%PrepareFunctionForOptimization(foo);
+foo.prototype = {
+  custom: 'prototype'
+};
 
-  assertEquals(0, foo());
-  assertEquals(0, foo());
-  %OptimizeFunctionOnNextCall(foo);
-  assertEquals(0, foo());
+assertEquals(0, foo());
+assertEquals(0, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(0, foo());
 })();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-729573-2.js b/src/v8/test/mjsunit/regress/regress-crbug-729573-2.js
index 45486ec..16910a3 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-729573-2.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-729573-2.js
@@ -12,10 +12,12 @@
 function foo(f) {
   var a = bar.bind(42, 1);
   return f() ? 0 : a;
+};
+%PrepareFunctionForOptimization(foo);
+function t() {
+  return true;
 }
 
-function t() { return true; }
-
 assertEquals(0, foo(t));
 assertEquals(0, foo(t));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-732169.js b/src/v8/test/mjsunit/regress/regress-crbug-732169.js
index 41dc9d2..913b862 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-732169.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-732169.js
@@ -7,6 +7,7 @@
 (function TestGeneratorMaterialization() {
   function* f([x]) { yield x }
   // No warm-up of {f} to trigger soft deopt.
+  %PrepareFunctionForOptimization(f);
   %OptimizeFunctionOnNextCall(f);
   var gen = f([23]);
   assertEquals("[object Generator]", gen.toString());
@@ -22,6 +23,7 @@
     return gen;
   }
   function h() { f() }
+  %PrepareFunctionForOptimization(h);
   // Enough warm-up to make {p} an in-object property.
   for (var i = 0; i < 100; ++i) { g(); h(); }
   %OptimizeFunctionOnNextCall(h);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-736575.js b/src/v8/test/mjsunit/regress/regress-crbug-736575.js
index 3622b09..7edf684 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-736575.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-736575.js
@@ -5,9 +5,9 @@
 // Flags: --allow-natives-syntax
 
 function f() {
-  return [...[/*hole*/, 2.3]];
-}
-
+  return [...[, /*hole*/ 2.3]];
+};
+%PrepareFunctionForOptimization(f);
 assertEquals(undefined, f()[0]);
 assertEquals(undefined, f()[0]);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-736633.js b/src/v8/test/mjsunit/regress/regress-crbug-736633.js
index 4c9f0cc..90badab 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-736633.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-736633.js
@@ -13,8 +13,10 @@
     case 2147483647:
       return x + 1;
   }
+
   return 0;
-}
+};
+%PrepareFunctionForOptimization(f);
 assertEquals(1, f(0));
 assertEquals(2, f(1));
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-740116.js b/src/v8/test/mjsunit/regress/regress-crbug-740116.js
index dc6fb64..de894a2 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-740116.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-740116.js
@@ -5,7 +5,10 @@
 // Flags: --allow-natives-syntax
 
 (function TestReflectGetPrototypeOfOnPrimitive() {
-  function f() { return Reflect.getPrototypeOf(""); }
+  function f() {
+    return Reflect.getPrototypeOf('');
+  };
+  %PrepareFunctionForOptimization(f);
   assertThrows(f, TypeError);
   assertThrows(f, TypeError);
   %OptimizeFunctionOnNextCall(f);
@@ -13,7 +16,10 @@
 })();
 
 (function TestObjectGetPrototypeOfOnPrimitive() {
-  function f() { return Object.getPrototypeOf(""); }
+  function f() {
+    return Object.getPrototypeOf('');
+  };
+  %PrepareFunctionForOptimization(f);
   assertSame(String.prototype, f());
   assertSame(String.prototype, f());
   %OptimizeFunctionOnNextCall(f);
@@ -21,7 +27,10 @@
 })();
 
 (function TestDunderProtoOnPrimitive() {
-  function f() { return "".__proto__; }
+  function f() {
+    return ''.__proto__;
+  };
+  %PrepareFunctionForOptimization(f);
   assertSame(String.prototype, f());
   assertSame(String.prototype, f());
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-741078.js b/src/v8/test/mjsunit/regress/regress-crbug-741078.js
index 8dfea72..2dd071b 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-741078.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-741078.js
@@ -4,8 +4,8 @@
 
 // Flags: --allow-natives-syntax --expose-gc
 
-function* gen() {}
-
+function* gen() {};
+%PrepareFunctionForOptimization(gen);
 (function warmup() {
   for (var i = 0; i < 100; ++i) {
     var g = gen();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-743154.js b/src/v8/test/mjsunit/regress/regress-crbug-743154.js
index a5bb2aa..cf9adea 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-743154.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-743154.js
@@ -17,6 +17,8 @@
 Array.prototype.sort.call(v);
 
 assertEquals(['0', '1073741824', 'length'], Object.keys(v));
+assertTrue(v.hasOwnProperty(0));
 assertEquals(1.5, v[0]);
+assertFalse(v.hasOwnProperty(1));
 assertEquals(1.5, v[1]);
 assertEquals(0, v[1073741824]);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-747062.js b/src/v8/test/mjsunit/regress/regress-crbug-747062.js
index 7e0e92a..bd82ec6 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-747062.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-747062.js
@@ -5,7 +5,10 @@
 // Flags: --allow-natives-syntax
 
 (function TestNonCallableForEach() {
-  function foo() { [].forEach(undefined) }
+  function foo() {
+    [].forEach(undefined);
+  };
+  %PrepareFunctionForOptimization(foo);
   assertThrows(foo, TypeError);
   assertThrows(foo, TypeError);
   %OptimizeFunctionOnNextCall(foo);
@@ -13,7 +16,14 @@
 })();
 
 (function TestNonCallableForEachCaught() {
-  function foo() { try { [].forEach(undefined) } catch(e) { return e } }
+  function foo() {
+    try {
+      [].forEach(undefined);
+    } catch (e) {
+      return e;
+    }
+  };
+  %PrepareFunctionForOptimization(foo);
   assertInstanceof(foo(), TypeError);
   assertInstanceof(foo(), TypeError);
   %OptimizeFunctionOnNextCall(foo);
@@ -21,7 +31,10 @@
 })();
 
 (function TestNonCallableMap() {
-  function foo() { [].map(undefined); }
+  function foo() {
+    [].map(undefined);
+  };
+  %PrepareFunctionForOptimization(foo);
   assertThrows(foo, TypeError);
   assertThrows(foo, TypeError);
   %OptimizeFunctionOnNextCall(foo);
@@ -29,7 +42,14 @@
 })();
 
 (function TestNonCallableMapCaught() {
-  function foo() { try { [].map(undefined) } catch(e) { return e } }
+  function foo() {
+    try {
+      [].map(undefined);
+    } catch (e) {
+      return e;
+    }
+  };
+  %PrepareFunctionForOptimization(foo);
   assertInstanceof(foo(), TypeError);
   assertInstanceof(foo(), TypeError);
   %OptimizeFunctionOnNextCall(foo);
@@ -37,7 +57,10 @@
 })();
 
 (function TestNonCallableFilter() {
-  function foo() { [].filter(undefined); }
+  function foo() {
+    [].filter(undefined);
+  };
+  %PrepareFunctionForOptimization(foo);
   assertThrows(foo, TypeError);
   assertThrows(foo, TypeError);
   %OptimizeFunctionOnNextCall(foo);
@@ -45,7 +68,14 @@
 })();
 
 (function TestNonCallableFilterCaught() {
-  function foo() { try { [].filter(undefined) } catch(e) { return e } }
+  function foo() {
+    try {
+      [].filter(undefined);
+    } catch (e) {
+      return e;
+    }
+  };
+  %PrepareFunctionForOptimization(foo);
   assertInstanceof(foo(), TypeError);
   assertInstanceof(foo(), TypeError);
   %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-747979.js b/src/v8/test/mjsunit/regress/regress-crbug-747979.js
index bbdea1d..add8563 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-747979.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-747979.js
@@ -8,8 +8,8 @@
   %HeapObjectVerify(a);
   a[1] = 0;
   %HeapObjectVerify(a);
-}
-
+};
+%PrepareFunctionForOptimization(f);
 function foo() {}
 
 var arr1 = [0];
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-751715.js b/src/v8/test/mjsunit/regress/regress-crbug-751715.js
index 68241eb..f1e20a4 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-751715.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-751715.js
@@ -8,6 +8,7 @@
 class Derived extends Base {
   constructor() { super(); }
 }
+%PrepareFunctionForOptimization(Derived);
 var proxy = new Proxy(Base, { get() {} });
 assertDoesNotThrow(() => Reflect.construct(Derived, []));
 assertThrows(() => Reflect.construct(Derived, [], proxy), TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-752481.js b/src/v8/test/mjsunit/regress/regress-crbug-752481.js
index d0cc6a3..3cf181d 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-752481.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-752481.js
@@ -7,6 +7,7 @@
 const A = class A {}
 
 function test(foo) {
+  %PrepareFunctionForOptimization(foo);
   assertThrows(foo);
   assertThrows(foo);
   %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-752826.js b/src/v8/test/mjsunit/regress/regress-crbug-752826.js
index d0e124e..8cb6111 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-752826.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-752826.js
@@ -15,7 +15,8 @@
 }
 function f() {
   return g(23, 42);
-}
+};
+%PrepareFunctionForOptimization(f);
 assertEquals(42, f());
 assertEquals(42, f());
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-752846.js b/src/v8/test/mjsunit/regress/regress-crbug-752846.js
index c2095dc..9daf3fb 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-752846.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-752846.js
@@ -17,5 +17,5 @@
   var proto = Object.getPrototypeOf(val);
 
   var proxy = new Proxy({}, {});
-  Object.setPrototypeOf(proto, proxy);
+  Object.setPrototypeOf(proxy, proto);
 }
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-755044.js b/src/v8/test/mjsunit/regress/regress-crbug-755044.js
index 45f0e84..6032e9a 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-755044.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-755044.js
@@ -4,12 +4,13 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(f){
+function foo(f) {
   f.caller;
 }
 function bar(f) {
   new foo(f);
-}
+};
+%PrepareFunctionForOptimization(bar);
 bar(function() {});
 %OptimizeFunctionOnNextCall(bar);
 bar(function() {});
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-757199.js b/src/v8/test/mjsunit/regress/regress-crbug-757199.js
index d2e9502..879f6b3 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-757199.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-757199.js
@@ -16,12 +16,12 @@
 }
 function f() {
   g(obj1);
-}
-
+};
+%PrepareFunctionForOptimization(f);
 obj1.x = 0;
 f();
 
-obj1.__defineGetter__("x", function() {});
+obj1.__defineGetter__('x', function() {});
 
 g(obj2);
 
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-759327.js b/src/v8/test/mjsunit/regress/regress-crbug-759327.js
index 9b42217..4aed8a4 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-759327.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-759327.js
@@ -13,7 +13,7 @@
   return { f: f };
 }
 function instantiate() {
-  var buffer = new ArrayBuffer(0);
+  var buffer = new ArrayBuffer(4096);
   Module(this, {}, buffer).f();
   try {} finally {}
   gc();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-762874-1.js b/src/v8/test/mjsunit/regress/regress-crbug-762874-1.js
index ab1b7c1..0925b61 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-762874-1.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-762874-1.js
@@ -10,8 +10,8 @@
 function foo(s) {
   let x = s.indexOf("", maxLength);
   return x === maxLength;
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 assertTrue(foo(s));
 assertTrue(foo(s));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-762874-2.js b/src/v8/test/mjsunit/regress/regress-crbug-762874-2.js
index 6d301b5..4daea83 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-762874-2.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-762874-2.js
@@ -10,8 +10,8 @@
 function foo(s) {
   let x = s.lastIndexOf("", maxLength);
   return x === maxLength;
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 assertTrue(foo(s));
 assertTrue(foo(s));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-766635.js b/src/v8/test/mjsunit/regress/regress-crbug-766635.js
index ae0de0a..9676936 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-766635.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-766635.js
@@ -4,29 +4,80 @@
 
 // Flags: --allow-natives-syntax
 
-function classOf() {; }
-function PrettyPrint(value) { return ""; }
-function fail() { }
-function deepEquals(a, b) { if (a === b) { if (a === 0)1 / b; return true; } if (typeof a != typeof b) return false; if (typeof a == "number") return isNaN(); if (typeof a !== "object" && typeof a !== "function") return false; var objectClass = classOf(); if (b) return false; if (objectClass === "RegExp") {; } if (objectClass === "Function") return false; if (objectClass === "Array") { var elementCount = 0; if (a.length != b.length) { return false; } for (var i = 0; i < a.length; i++) { if (a[i][i]) return false; } return true; } if (objectClass == "String" || objectClass == "Number" || objectClass == "Boolean" || objectClass == "Date") { if (a.valueOf()) return false; }; }
-assertSame = function assertSame() { if (found === expected) { if (1 / found) return; } else if ((expected !== expected) && (found !== found)) { return; }; }; assertEquals = function assertEquals(expected, found, name_opt) { if (!deepEquals(found, expected)) { fail(PrettyPrint(expected),); } };
+function classOf() {
+  ;
+}
+function PrettyPrint(value) {
+  return '';
+}
+function fail() {}
+function deepEquals(a, b) {
+  if (a === b) {
+    if (a === 0) 1 / b;
+    return true;
+  }
+  if (typeof a != typeof b) return false;
+  if (typeof a == 'number') return isNaN();
+  if (typeof a !== 'object' && typeof a !== 'function') return false;
+  var objectClass = classOf();
+  if (b) return false;
+  if (objectClass === 'RegExp') {
+    ;
+  }
+  if (objectClass === 'Function') return false;
+  if (objectClass === 'Array') {
+    var elementCount = 0;
+    if (a.length != b.length) {
+      return false;
+    }
+    for (var i = 0; i < a.length; i++) {
+      if (a[i][i]) return false;
+    }
+    return true;
+  }
+  if (objectClass == 'String' || objectClass == 'Number' ||
+      objectClass == 'Boolean' || objectClass == 'Date') {
+    if (a.valueOf()) return false;
+  };
+}
+assertSame = function assertSame() {
+  if (found === expected) {
+    if (1 / found) return;
+  } else if (expected !== expected && found !== found) {
+    return;
+  };
+};
+assertEquals = function assertEquals(expected, found, name_opt) {
+  if (!deepEquals(found, expected)) {
+    fail(PrettyPrint(expected));
+  }
+};
 var __v_3 = {};
 function __f_0() {
   assertEquals();
 }
 try {
   __f_0();
-} catch(e) {; }
+} catch (e) {
+  ;
+}
 __v_2 = 0;
-o2 = {y:1.5};
+o2 = {
+  y: 1.5
+};
 o2.y = 0;
 o3 = o2.y;
 function __f_1() {
   for (var __v_1 = 0; __v_1 < 10; __v_1++) {
     __v_2 += __v_3.x + o3.foo;
-    [ 3].filter(__f_9);
+    [3].filter(__f_9);
   }
-}
+};
+%PrepareFunctionForOptimization(__f_1);
 __f_1();
 %OptimizeFunctionOnNextCall(__f_1);
 __f_1();
-function __f_9(){ "use __f_9"; assertEquals( this); }
+function __f_9() {
+  'use __f_9';
+  assertEquals(this);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-768080.js b/src/v8/test/mjsunit/regress/regress-crbug-768080.js
index cfd1fc1..1e32c13 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-768080.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-768080.js
@@ -11,7 +11,8 @@
   }
   function f() {
     return new g();
-  }
+  };
+  %PrepareFunctionForOptimization(f);
   new C();  // Warm-up!
   assertThrows(f, TypeError);
   assertThrows(f, TypeError);
@@ -29,7 +30,8 @@
   }
   function f() {
     return new g();
-  }
+  };
+  %PrepareFunctionForOptimization(f);
   new C();  // Warm-up!
   assertThrows(f, TypeError);
   assertThrows(f, TypeError);
@@ -43,7 +45,8 @@
   }
   function f() {
     return new g();
-  }
+  };
+  %PrepareFunctionForOptimization(f);
   assertThrows(f, TypeError);
   assertThrows(f, TypeError);
   %OptimizeFunctionOnNextCall(f);
@@ -56,7 +59,8 @@
   }
   function f() {
     return g();
-  }
+  };
+  %PrepareFunctionForOptimization(f);
   assertThrows(f, TypeError);
   assertThrows(f, TypeError);
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-768367.js b/src/v8/test/mjsunit/regress/regress-crbug-768367.js
index d1041f3..c04937b 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-768367.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-768367.js
@@ -6,8 +6,10 @@
 
 const o = {};
 
-function foo() { return o[4294967295]; }
-
+function foo() {
+  return o[4294967295];
+};
+%PrepareFunctionForOptimization(foo);
 assertEquals(undefined, foo());
 assertEquals(undefined, foo());
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-769852.js b/src/v8/test/mjsunit/regress/regress-crbug-769852.js
index 120ea01..9fb9624 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-769852.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-769852.js
@@ -7,8 +7,9 @@
 function f(o) {
   function g() {}
   Object.keys(o).forEach(suite => g());
-}
+};
+%PrepareFunctionForOptimization(f);
 assertDoesNotThrow(() => f({}));
-assertDoesNotThrow(() => f({ x:0 }));
+assertDoesNotThrow(() => f({x: 0}));
 %OptimizeFunctionOnNextCall(f);
-assertDoesNotThrow(() => f({ x:0 }));
+assertDoesNotThrow(() => f({x: 0}));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-770543.js b/src/v8/test/mjsunit/regress/regress-crbug-770543.js
index 5397a49..ac8301c 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-770543.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-770543.js
@@ -10,7 +10,8 @@
       Object.getOwnPropertyDescriptor(g, "caller");
     };
     [0].forEach(g);
-  }
+  };
+  %PrepareFunctionForOptimization(f);
   f();
   f();
   %OptimizeFunctionOnNextCall(f);
@@ -23,7 +24,8 @@
   }
   function f() {
     [0].forEach(g);
-  }
+  };
+  %PrepareFunctionForOptimization(f);
   f();
   f();
   %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-770581.js b/src/v8/test/mjsunit/regress/regress-crbug-770581.js
index 64edec9..c07b9fa 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-770581.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-770581.js
@@ -6,12 +6,12 @@
 
 function f(callback) {
   [Object].forEach(callback);
-}
-
+};
+%PrepareFunctionForOptimization(f);
 function message_of_f() {
   try {
     f("a teapot");
-  } catch(e) {
+  } catch (e) {
     return String(e);
   }
 }
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-771971.js b/src/v8/test/mjsunit/regress/regress-crbug-771971.js
index cb40db5..cd3aa73 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-771971.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-771971.js
@@ -4,8 +4,10 @@
 
 // Flags: --allow-natives-syntax
 
-function f() { Object.is(); }
-
+function f() {
+  Object.is();
+};
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-772056.js b/src/v8/test/mjsunit/regress/regress-crbug-772056.js
index 380bae3..d9fb4d5 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-772056.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-772056.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 var builder = new WasmModuleBuilder();
@@ -14,4 +13,4 @@
   initial: 1, maximum:1000000});
 let instance = new WebAssembly.Instance(module, {x: {table:table}});
 
-assertThrows(() => table.grow(Infinity), RangeError);
+assertThrows(() => table.grow(Infinity), TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-772610.js b/src/v8/test/mjsunit/regress/regress-crbug-772610.js
index d68ebbf..6681966 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-772610.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-772610.js
@@ -11,6 +11,7 @@
   %_DeoptimizeNow();
   return o.length;
 }
+%PrepareFunctionForOptimization(f);
 assertEquals(1, f());
 assertEquals(1, f());
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-772672.js b/src/v8/test/mjsunit/regress/regress-crbug-772672.js
index 86e7383..02ba84d 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-772672.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-772672.js
@@ -4,8 +4,10 @@
 
 // Flags: --allow-natives-syntax
 
-function foo() { return new Array(120 * 1024); }
-
+function foo() {
+  return new Array(120 * 1024);
+};
+%PrepareFunctionForOptimization(foo);
 foo()[0] = 0.1;
 %OptimizeFunctionOnNextCall(foo);
 foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-772689.js b/src/v8/test/mjsunit/regress/regress-crbug-772689.js
index 32e220d..d0f753c 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-772689.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-772689.js
@@ -9,13 +9,13 @@
     super();
     this.y = 1;
   }
-}
+};
 
 function foo(x) {
   var a = new A();
   if (x) return a.y;
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 assertEquals(undefined, foo(false));
 assertEquals(undefined, foo(false));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-772720.js b/src/v8/test/mjsunit/regress/regress-crbug-772720.js
index 3e359f6..dc83bfb 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-772720.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-772720.js
@@ -10,6 +10,7 @@
   local += 'abcdefghijkl' + (0 + global);
   global += 'abcdefghijkl';
 }
+%PrepareFunctionForOptimization(f);
 f();
 %OptimizeFunctionOnNextCall(f);
 f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-774459.js b/src/v8/test/mjsunit/regress/regress-crbug-774459.js
index 4263c32..dc6e57c 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-774459.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-774459.js
@@ -5,16 +5,16 @@
 // Flags: --allow-natives-syntax
 
 (function() {
-  const m = new Map();
-  const k = Math.pow(2, 31) - 1;
-  m.set(k, 1);
+const m = new Map();
+const k = Math.pow(2, 31) - 1;
+m.set(k, 1);
 
-  function foo(m, k) {
-    return m.get(k | 0);
-  }
-
-  assertEquals(1, foo(m, k));
-  assertEquals(1, foo(m, k));
-  %OptimizeFunctionOnNextCall(foo);
-  assertEquals(1, foo(m, k));
+function foo(m, k) {
+  return m.get(k | 0);
+};
+%PrepareFunctionForOptimization(foo);
+assertEquals(1, foo(m, k));
+assertEquals(1, foo(m, k));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(1, foo(m, k));
 })();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-776511.js b/src/v8/test/mjsunit/regress/regress-crbug-776511.js
index f757bc2..62805c9 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-776511.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-776511.js
@@ -26,6 +26,7 @@
     };
     return __v_59904.filter(__v_59909);
   };
+  %PrepareFunctionForOptimization(__v_59906);
   print(__v_59906());
   __v_59904[__getRandomProperty(__v_59904, 366855)] = this, gc();
   print(__v_59906());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-779344.js b/src/v8/test/mjsunit/regress/regress-crbug-779344.js
index 5198a67..9211071 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-779344.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-779344.js
@@ -5,6 +5,4 @@
 var o = {};
 var proxy = new Proxy(() => {}, o);
 o.apply = proxy;
-assertThrows(
-  () => Function.prototype.call.call(proxy)
-);
+assertThrows(proxy);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-779367.js b/src/v8/test/mjsunit/regress/regress-crbug-779367.js
index 3836b34..6784a49 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-779367.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-779367.js
@@ -6,8 +6,8 @@
 
 function g(o) {
   return o.x;
-}
-
+};
+%PrepareFunctionForOptimization(g);
 Object.defineProperty(g, 'x', {set(v) {}});
 
 g.prototype = 1;
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-781116-1.js b/src/v8/test/mjsunit/regress/regress-crbug-781116-1.js
index 83af7a8..50693eb 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-781116-1.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-781116-1.js
@@ -9,14 +9,17 @@
 }
 function bar(store) {
   baz(Array.prototype, store);
-  baz(this.arguments, true);
-}
+};
+%PrepareFunctionForOptimization(bar);
 bar(false);
 bar(false);
 %OptimizeFunctionOnNextCall(bar);
 bar(true);
 
-function foo() { [].push(); }
+function foo() {
+  [].push();
+};
+%PrepareFunctionForOptimization(foo);
 foo();
 foo();
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-781116-2.js b/src/v8/test/mjsunit/regress/regress-crbug-781116-2.js
index f8ffbe8..3deb4a5 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-781116-2.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-781116-2.js
@@ -9,14 +9,17 @@
 }
 function bar(store) {
   baz(Object.prototype, store);
-  baz(this.arguments, true);
-}
+};
+%PrepareFunctionForOptimization(bar);
 bar(false);
 bar(false);
 %OptimizeFunctionOnNextCall(bar);
 bar(true);
 
-function foo() { [].push(); }
+function foo() {
+  [].push();
+};
+%PrepareFunctionForOptimization(foo);
 foo();
 foo();
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-781506-1.js b/src/v8/test/mjsunit/regress/regress-crbug-781506-1.js
index 6048fb9..4617c38 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-781506-1.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-781506-1.js
@@ -4,8 +4,10 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(a) { return a[0]; }
-
+function foo(a) {
+  return a[0];
+};
+%PrepareFunctionForOptimization(foo);
 assertEquals(undefined, foo(x => x));
 assertEquals(undefined, foo({}));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-781506-2.js b/src/v8/test/mjsunit/regress/regress-crbug-781506-2.js
index 71801df..a7239f7 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-781506-2.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-781506-2.js
@@ -4,8 +4,10 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(o) { return o[0]; }
-
+function foo(o) {
+  return o[0];
+};
+%PrepareFunctionForOptimization(foo);
 assertEquals(undefined, foo({}));
 Array.prototype[0] = 0;
 assertEquals(undefined, foo({}));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-781506-3.js b/src/v8/test/mjsunit/regress/regress-crbug-781506-3.js
index 70b29896..b73dac9 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-781506-3.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-781506-3.js
@@ -4,8 +4,10 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(a, i) { return a[i] + 0.5; }
-
+function foo(a, i) {
+  return a[i] + 0.5;
+};
+%PrepareFunctionForOptimization(foo);
 foo({}, 1);
 Array.prototype.unshift(1.5);
 assertTrue(Number.isNaN(foo({}, 1)));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-781583.js b/src/v8/test/mjsunit/regress/regress-crbug-781583.js
index fd14ad7..f2c85ff 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-781583.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-781583.js
@@ -6,8 +6,8 @@
 
 function* generator(a) {
   a.pop().next();
-}
-
+};
+%PrepareFunctionForOptimization(generator);
 function prepareGenerators(n) {
   var a = [{ next: () => 0 }];
   for (var i = 0; i < n; ++i) {
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-786723.js b/src/v8/test/mjsunit/regress/regress-crbug-786723.js
index d4e0957..f6f8c24 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-786723.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-786723.js
@@ -10,6 +10,8 @@
     o.x = 1;
     return Object.create(o);
   };
+  %PrepareFunctionForOptimization(g);
+  ;
   gc();
   o.x = 10;
   %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-7907.js b/src/v8/test/mjsunit/regress/regress-crbug-7907.js
new file mode 100644
index 0000000..fafa659
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-7907.js
@@ -0,0 +1,9 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let arr = new Array(10);
+Object.defineProperty(arr, 0, {value: 10, writable: false});
+Object.defineProperty(arr, 9, {value: 1, writable: false});
+
+assertThrows(() => arr.sort(), TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-791245-1.js b/src/v8/test/mjsunit/regress/regress-crbug-791245-1.js
index 0d51f8a..cc4a80c 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-791245-1.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-791245-1.js
@@ -4,14 +4,14 @@
 
 // Flags: --allow-natives-syntax
 
-const s = new Map;
+const s = new Map();
 
 function foo(s) {
   const i = s[Symbol.iterator]();
   i.next();
   return i;
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 console.log(foo(s));
 console.log(foo(s));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-791245-2.js b/src/v8/test/mjsunit/regress/regress-crbug-791245-2.js
index 6734ed2..9f40a11 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-791245-2.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-791245-2.js
@@ -4,14 +4,14 @@
 
 // Flags: --allow-natives-syntax
 
-const s = new Set;
+const s = new Set();
 
 function foo(s) {
   const i = s[Symbol.iterator]();
   i.next();
   return i;
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 console.log(foo(s));
 console.log(foo(s));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-800032.js b/src/v8/test/mjsunit/regress/regress-crbug-800032.js
index 7c9206c..2b4bc06 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-800032.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-800032.js
@@ -6,10 +6,7 @@
 
 
 class Derived extends RegExp {
-  constructor(a) {
-    // Syntax Error
-    const a = 1;
-  }
+  constructor(a) { throw "error" }
 }
 
 let o = Reflect.construct(RegExp, [], Derived);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-801627.js b/src/v8/test/mjsunit/regress/regress-crbug-801627.js
index 0e51fff..cfaa2b7 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-801627.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-801627.js
@@ -19,6 +19,7 @@
 // Feed a bound function as new.target
 // to the profiler, so HeapObjectMatcher
 // can find it.
+%PrepareFunctionForOptimization(Derived);
 Reflect.construct(Derived, [], Object.bind());
 %OptimizeFunctionOnNextCall(Derived);
 new Derived();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-802333.js b/src/v8/test/mjsunit/regress/regress-crbug-802333.js
new file mode 100644
index 0000000..63697ba
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-802333.js
@@ -0,0 +1,24 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function deferred_func() {
+  class C {
+    method1() {}
+  }
+}
+
+let bound = (a => a).bind(this, 0);
+
+function opt() {
+  deferred_func.prototype;  // ReduceJSLoadNamed
+
+  return bound();
+};
+%PrepareFunctionForOptimization(opt);
+assertEquals(0, opt());
+%OptimizeFunctionOnNextCall(opt);
+
+assertEquals(0, opt());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-805765.js b/src/v8/test/mjsunit/regress/regress-crbug-805765.js
new file mode 100644
index 0000000..b630efb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-805765.js
@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var code = "(function* gen() {"
+for (var i = 0; i < 256; ++i) {
+  code += `var v_${i} = 0;`
+}
+code += `yield; })`
+
+var gen = eval(code);
+var g = gen();
+g.next();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-806200.js b/src/v8/test/mjsunit/regress/regress-crbug-806200.js
new file mode 100644
index 0000000..dbd6601
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-806200.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+assertThrows("%Foo(...spread)", SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-806388.js b/src/v8/test/mjsunit/regress/regress-crbug-806388.js
index b55b501..138ae18 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-806388.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-806388.js
@@ -5,10 +5,7 @@
 // Flags: --allow-natives-syntax --enable-slow-asserts --expose-gc
 
 class Derived extends Array {
-    constructor(a) {
-      // Syntax Error.
-      const a = 1;
-    }
+    constructor(a) { throw "error" }
 }
 
 // Derived is not a subclass of RegExp
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-807096.js b/src/v8/test/mjsunit/regress/regress-crbug-807096.js
index 845120d..c503fda 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-807096.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-807096.js
@@ -4,6 +4,8 @@
 //
 // Flags: --allow-natives-syntax --no-lazy
 
+load('test/mjsunit/test-async.js');
+
 // For regression testing, it's important that these functions are:
 // 1) toplevel
 // 2) arrow functions with single-expression bodies
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-808192.js b/src/v8/test/mjsunit/regress/regress-crbug-808192.js
index 3336c00..f57d5fc 100644
--- a/src/v8/test/mjsunit/regress/regress-crbug-808192.js
+++ b/src/v8/test/mjsunit/regress/regress-crbug-808192.js
@@ -2,8 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// TODO(cbruni): enable always opt once v8:7438
-// Flags: --expose-gc --no-always-opt
+// Flags: --expose-gc
 
 const f = eval(`(function f(i) {
   if (i == 0) {
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-813450.js b/src/v8/test/mjsunit/regress/regress-crbug-813450.js
new file mode 100644
index 0000000..b301012
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-813450.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var constructorArgs = new Array(0x10100);
+var constructor = function() {};
+var target = new Proxy(constructor, {
+  construct: function() {
+  }
+});
+var proxy = new Proxy(target, {
+  construct: function(newTarget, args) {
+    return Reflect.construct(constructor, []);
+  }
+});
+var instance = new proxy();
+var instance2 = Reflect.construct(proxy, constructorArgs);
+%HeapObjectVerify(target);
+%HeapObjectVerify(proxy);
+%HeapObjectVerify(instance);
+%HeapObjectVerify(instance2);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-813630.js b/src/v8/test/mjsunit/regress/regress-crbug-813630.js
new file mode 100644
index 0000000..7ec9e35
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-813630.js
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Regression test for a bug where aborting a function which has a rest
+// parameter didn't work correctly.
+function g(...args) {
+  x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+  x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+  x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+  x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+  x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+  x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+  x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+  x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+  x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+  x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+  x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+  x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+  x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+  x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-816961.js b/src/v8/test/mjsunit/regress/regress-crbug-816961.js
new file mode 100644
index 0000000..c1637ad
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-816961.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(function() {
+  var memory = new WebAssembly.Memory({initial: 64 * 1024 * 1024 / 0x10000});
+  var array = new Uint8Array(memory.buffer);
+  Uint8Array.of.call(function() { return array },
+                    {valueOf() { memory.grow(1); } });
+}, TypeError);
+
+assertThrows(function() {
+  var memory = new WebAssembly.Memory({initial: 64 * 1024 * 1024 / 0x10000});
+  var array = new Uint8Array(memory.buffer);
+  Uint8Array.from.call(function() { return array },
+                       [{valueOf() { memory.grow(1); } }],
+                       x => x);
+}, TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-819086.js b/src/v8/test/mjsunit/regress/regress-crbug-819086.js
new file mode 100644
index 0000000..edc13ec
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-819086.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  return [...[, -Infinity]];
+};
+%PrepareFunctionForOptimization(foo);
+foo()[0];
+foo()[0];
+%OptimizeFunctionOnNextCall(foo);
+foo()[0];
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-819298.js b/src/v8/test/mjsunit/regress/regress-crbug-819298.js
new file mode 100644
index 0000000..f4ebd75
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-819298.js
@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = new Int32Array(2);
+
+function foo(base) {
+  a[base - 91] = 1;
+};
+%PrepareFunctionForOptimization(foo);
+foo("");
+foo("");
+%OptimizeFunctionOnNextCall(foo);
+foo(NaN);
+assertEquals(0, a[0]);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-820312.js b/src/v8/test/mjsunit/regress/regress-crbug-820312.js
new file mode 100644
index 0000000..448d4e9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-820312.js
@@ -0,0 +1,26 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+let arr = new Array(0x10000);
+let resolve_element_closures = new Array(0x10000);
+
+for (let i = 0; i < arr.length; i++) {
+    arr[i] = new Promise(() => {});
+    arr[i].then = ((idx, resolve) => {
+        resolve_element_closures[idx] = resolve;
+    }).bind(null, i);
+}
+
+Promise.all(arr);
+
+// 0xffff is too large, transitions to DICTIONARY_ELEMENTS
+resolve_element_closures[0xffff]();
+
+// grows the capacity, the elements kind of the result array is still DICTIONARY_ELEMENTS, but the elements object of it is no more a dictionary.
+resolve_element_closures[100]();
+
+// You can observe that V8 crashes here in debug mode.
+resolve_element_closures[0xfffe]();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-820820.js b/src/v8/test/mjsunit/regress/regress-crbug-820820.js
new file mode 100644
index 0000000..1dd9383
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-820820.js
@@ -0,0 +1,24 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function* generator() {
+  yield undefined;
+}
+function bar(x) {
+  const objects = [];
+  for (let obj of generator()) {
+  }
+  return objects[0];
+}
+function foo() {
+  try { undefined[0] = bar(); } catch (e) { }
+  Math.min(bar(), bar(), bar());
+}
+%PrepareFunctionForOptimization(foo);
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-821159-1.js b/src/v8/test/mjsunit/regress/regress-crbug-821159-1.js
new file mode 100644
index 0000000..058688a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-821159-1.js
@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+Array.prototype[0] = 0;
+Math.max(...[3]);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-821159-2.js b/src/v8/test/mjsunit/regress/regress-crbug-821159-2.js
new file mode 100644
index 0000000..a982068
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-821159-2.js
@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+Object.prototype[0] = 0;
+Math.max(...[3]);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-821159-3.js b/src/v8/test/mjsunit/regress/regress-crbug-821159-3.js
new file mode 100644
index 0000000..2bb09c7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-821159-3.js
@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+Array.prototype[0] = 0;
+Math.max(...[3.1]);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-821159-4.js b/src/v8/test/mjsunit/regress/regress-crbug-821159-4.js
new file mode 100644
index 0000000..ec596c6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-821159-4.js
@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+Object.prototype[0] = 0;
+Math.max(...[3.1]);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-822284.js b/src/v8/test/mjsunit/regress/regress-crbug-822284.js
new file mode 100644
index 0000000..e27e12f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-822284.js
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(a) {
+  a = "" + Math.abs(a);
+  return a.charCodeAt(0);
+}
+
+// Add '1' to the number to string table (as SeqString).
+%PrepareFunctionForOptimization(foo);
+String.fromCharCode(49);
+// Turn the SeqString into a ThinString via forced internalization.
+const o = {};
+o[1..toString()] = 1;
+
+assertEquals(49, foo(1));
+assertEquals(49, foo(1));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(49, foo(1));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-823069.js b/src/v8/test/mjsunit/regress/regress-crbug-823069.js
new file mode 100644
index 0000000..c382033
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-823069.js
@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var v = [];
+Object.defineProperty(v, "length", {value: 3, writable: false});
+assertThrows(()=>{v.pop();});
+assertThrows(()=>{v.shift();});
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-823130.js b/src/v8/test/mjsunit/regress/regress-crbug-823130.js
new file mode 100644
index 0000000..42174f1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-823130.js
@@ -0,0 +1,40 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+var __v_1 = new Array();
+var __v_2 = 0x30;
+var __v_4 = "abc";
+var __v_3 = "def";
+
+function __f_2(b) {
+  [...b];
+}
+__f_2([1]);
+__f_2([3.3]);
+__f_2([{}]);
+
+var vars = [__v_1, __v_2, __v_3, __v_4];
+
+for (var j = 0; j < vars.length && j < 7; j++) {
+  for (var k = j; k < vars.length && k < 7 + j; k++) {
+    var v1 = vars[j];
+    var e1, e2;
+    try {
+      __f_2(v1);
+      __f_2();
+    } catch (e) {
+      e1 = "" + e;
+    }
+    gc();
+    try {
+      __f_2(v1);
+      __f_2();
+    } catch (e) {
+      e2 = "" + e;
+    }
+    assertEquals(e1, e2);
+  }
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-825045.js b/src/v8/test/mjsunit/regress/regress-crbug-825045.js
new file mode 100644
index 0000000..85367f0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-825045.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const obj = new class A extends async function
+() {}
+.constructor {}
+();
+delete obj.name;
+Number.prototype.__proto__ = obj;
+function foo() {
+  return obj.bind();
+};
+%PrepareFunctionForOptimization(foo);
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-827013.js b/src/v8/test/mjsunit/regress/regress-crbug-827013.js
new file mode 100644
index 0000000..9281fbf
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-827013.js
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function Test() {
+  var f = () => 42;
+  function modify_f() {
+    delete f.length;
+    delete f.name;
+
+    var g = Object.create(f);
+    for (var i = 0; i < 5; i++) {
+      g.dummy;
+    }
+  }
+  %EnsureFeedbackVectorForFunction(f);
+  assertTrue(%HasFastProperties(f));
+
+  var h = f.bind(this);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-830565.js b/src/v8/test/mjsunit/regress/regress-crbug-830565.js
new file mode 100644
index 0000000..00f49bb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-830565.js
@@ -0,0 +1,19 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+load('test/mjsunit/test-async.js');
+
+testAsync(assert => {
+  assert.plan(1);
+  const error = new TypeError('Throwing');
+  Promise.resolve({ then(resolve, reject) {
+    throw error;
+  }}).then(v => {
+    assert.unreachable();
+  }, e => {
+    assert.equals(error, e);
+  });
+});
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-831943.js b/src/v8/test/mjsunit/regress/regress-crbug-831943.js
new file mode 100644
index 0000000..b69da06
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-831943.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+class MyRegExp extends RegExp {
+  exec(str) {
+    const r = super.exec.call(this, str);
+    if (r) r[0] = 0;
+    return r;
+  }
+}
+
+const result = 'a'.match(new MyRegExp('.', 'g'));
+assertArrayEquals(result, ['0']);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-831984.js b/src/v8/test/mjsunit/regress/regress-crbug-831984.js
new file mode 100644
index 0000000..c483323
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-831984.js
@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+let arr = [...Array(9000)];
+for (let j = 0; j < 40; j++) {
+  Reflect.ownKeys(arr).shift();
+  Array(64386);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-840220.js b/src/v8/test/mjsunit/regress/regress-crbug-840220.js
new file mode 100644
index 0000000..8245635
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-840220.js
@@ -0,0 +1,12 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var boundFunction = (function(){}).bind();
+
+var instance = new Uint8Array()
+instance.constructor = {
+  [Symbol.species]: boundFunction
+};
+
+assertThrows(() => instance.map(each => each * 2), TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-841592.js b/src/v8/test/mjsunit/regress/regress-crbug-841592.js
new file mode 100644
index 0000000..bc64fd9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-841592.js
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// a has packed SMI elements
+a = [];
+
+// a has dictionary elements
+a.length = 0xFFFFFFF;
+
+// a has dictionary elements and the backing array is
+// empty_slow_element_dictionary (length 0)
+a.length = 0;
+
+// a has dictionary elements and the backing array is
+// empty_slow_element_dictionary (length 0xFFFFFFF)
+a.length = 0xFFFFFFF;
+
+// This will crash if V8 attempts to remove 0 elements from
+// empty_slow_element_dictionary as it is in RO_SPACE.
+a.length = 1;
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-843022.js b/src/v8/test/mjsunit/regress/regress-crbug-843022.js
new file mode 100644
index 0000000..868054f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-843022.js
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Produce an fast, but empty result.
+const fast_regexp_result = /./g.exec("a");
+fast_regexp_result.length = 0;
+class RegExpWithFastResult extends RegExp {
+  constructor() { super(".", "g"); this.number_of_runs = 0; }
+  exec(str) { return (this.number_of_runs++ == 0) ? fast_regexp_result : null; }
+}
+
+// A slow empty result.
+const slow_regexp_result = [];
+class RegExpWithSlowResult extends RegExp {
+  constructor() { super(".", "g"); this.number_of_runs = 0; }
+  exec(str) { return (this.number_of_runs++ == 0) ? slow_regexp_result : null; }
+}
+
+assertEquals(["undefined"], "a".match(new RegExpWithFastResult()));
+assertEquals(["undefined"], "a".match(new RegExpWithSlowResult()));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-848165.js b/src/v8/test/mjsunit/regress/regress-crbug-848165.js
new file mode 100644
index 0000000..670e70f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-848165.js
@@ -0,0 +1,9 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+class cls0 {
+  static get length(){ return 42; };
+  static get [1](){ return 21; };
+};
+Object.defineProperty(cls0, "length", {value:'1'});
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-849024.js b/src/v8/test/mjsunit/regress/regress-crbug-849024.js
new file mode 100644
index 0000000..a1df577
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-849024.js
@@ -0,0 +1,43 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+this.__proto__ = new Proxy({}, {});
+
+function test1() {
+  eval("bla");
+}
+
+assertThrows(test1, ReferenceError);
+assertThrows(test1, ReferenceError);
+assertThrows(test1, ReferenceError);
+
+function test2() {
+  gc();
+  eval("bla");
+}
+
+assertThrows(test2, ReferenceError);
+assertThrows(test2, ReferenceError);
+assertThrows(test2, ReferenceError);
+
+function foo() {
+  try {
+    eval("bla");
+  } catch(e) {
+    return;
+  }
+  throw 1337;
+}
+
+function test3() {
+  gc();
+  foo();
+  foo();
+}
+
+assertDoesNotThrow(test3);
+assertDoesNotThrow(test3);
+assertDoesNotThrow(test3);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-850005.js b/src/v8/test/mjsunit/regress/regress-crbug-850005.js
new file mode 100644
index 0000000..d80d466
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-850005.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let args = [3.34, ];
+function f(a, b, c) {};
+f(...args);
+args = args.splice();
+f(...args);
+args = [];
+f(...args);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-851393.js b/src/v8/test/mjsunit/regress/regress-crbug-851393.js
new file mode 100644
index 0000000..82060b5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-851393.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var proxy = new Proxy({}, {});
+
+Object.assign(proxy, { b: "boom", 060: "ah", o: "ouch" });
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-852592.js b/src/v8/test/mjsunit/regress/regress-crbug-852592.js
new file mode 100644
index 0000000..356c51c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-852592.js
@@ -0,0 +1,25 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const kArraySize = 1024;
+
+let array = [];
+for (let i = 1; i < kArraySize; ++i) {
+  array[i] = i + 0.1;
+}
+
+assertEquals(array.length, kArraySize);
+
+let executed = false;
+compareFn = _ => {
+  if (!executed) {
+    executed = true;
+
+    array.length = 1; // shrink
+    array.length = 0; // replace
+    array.length = kArraySize; // restore the original length
+  }
+}
+
+array.sort(compareFn);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-854299.js b/src/v8/test/mjsunit/regress/regress-crbug-854299.js
new file mode 100644
index 0000000..3aa296a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-854299.js
@@ -0,0 +1,27 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+let rand = n => Math.floor(Math.random() * n);
+
+for (let i = 0; i < 1000; ++i) {
+  array = [];
+  let len = rand(30);
+  for(let i = 0; i < len; ++i) {
+    array[i] = [i + 0.1];
+  }
+
+  let counter = 0;
+  array.sort((a, b) => {
+    a = a || [0];
+    b = b || [0];
+
+    if (counter++ == rand(30)) {
+      array.length = 1;
+      gc();
+    }
+    return a[0] - b[0];
+  });
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-856095.js b/src/v8/test/mjsunit/regress/regress-crbug-856095.js
new file mode 100644
index 0000000..ae55ec6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-856095.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f(a, b, c) { }
+function a() {
+    let o1;
+    o1 = new Array();
+    f(...o1);
+    o1[1000] = Infinity;
+}
+
+a();
+a();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-859809.js b/src/v8/test/mjsunit/regress/regress-crbug-859809.js
new file mode 100644
index 0000000..af5dd7a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-859809.js
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+let xs = [];
+const kSize = 200;
+for (let i = 0; i < kSize; ++i) {
+  xs.push(i);
+}
+
+let counter = 0;
+xs.sort((a, b) => {
+  if (counter++ % 10 == 0) {
+    xs.shift();
+    gc();
+  }
+
+  return a - b;
+});
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-860788.js b/src/v8/test/mjsunit/regress/regress-crbug-860788.js
new file mode 100644
index 0000000..fe0dcb8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-860788.js
@@ -0,0 +1,30 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-async-hooks
+
+try {
+Object.prototype.__defineGetter__(0, function(){});
+assertThrows("x");
+} catch(e) { print("Caught: " + e); }
+
+try {
+(function() {
+  let asyncIds = [], triggerIds = [];
+  let ah = async_hooks.createHook({
+    init(asyncId, type, triggerAsyncId, resource) {
+      if (type !== 'PROMISE') { return; }
+      assertThrows("asyncIds.push(asyncId);");
+      assertThrows("triggerIds.push(triggerAsyncId)");
+    },
+  });
+  ah.enable();
+  async function foo() {}
+  foo();
+})();
+} catch(e) { print("Caught: " + e); }
+try {
+  var obj = {prop: 7};
+  assertThrows("nonexistent(obj)");
+} catch(e) { print("Caught: " + e); }
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-862538.js b/src/v8/test/mjsunit/regress/regress-crbug-862538.js
new file mode 100644
index 0000000..f5da2ee
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-862538.js
@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var uvwxyzundefined;
+
+function __f_5778(__v_29973) {
+  var __v_29975 = __v_29973 + undefined;
+  var __v_29976 = __v_29975.substring( 20);
+  ({})[__v_29975];
+  return eval(__v_29976);
+}
+__f_5778("abcdefghijklmnopqrstuvwxyz");
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-865312.js b/src/v8/test/mjsunit/regress/regress-crbug-865312.js
new file mode 100644
index 0000000..8df1bd9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-865312.js
@@ -0,0 +1,34 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const intArrayConstructors = [
+  Uint8Array,
+  Int8Array,
+  Uint16Array,
+  Int16Array,
+  Uint32Array,
+  Int32Array,
+  Uint8ClampedArray
+];
+
+const floatArrayConstructors = [
+  Float32Array,
+  Float64Array
+];
+
+const typedArrayConstructors = [...intArrayConstructors,
+                                ...floatArrayConstructors];
+
+for (let constructor of typedArrayConstructors) {
+  // Shadowing the length of a TypedArray should work for Array.p.fill,
+  // but not crash it.
+  let array = new constructor([2, 2]);
+  assertEquals(2, array.length);
+
+  Object.defineProperty(array, 'length', {value: 5});
+  Array.prototype.fill.call(array, 5);
+
+  assertArrayEquals([5, 5], [array[0], array[1]]);
+  assertEquals(undefined, array[2]);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-865892.js b/src/v8/test/mjsunit/regress/regress-crbug-865892.js
new file mode 100644
index 0000000..f2d2f6f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-865892.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-async-hooks
+
+let ah = async_hooks.createHook(
+{
+  init(asyncId, type) {
+    if (type !== 'PROMISE') { return; }
+    assertThrows('asyncIds.push(asyncId);');
+  }
+});
+ah.enable();
+
+async function foo() {
+  let x = { toString() { return 'modules-skip-1.js' } };
+  assertThrows('await import(x);');
+}
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-866315.js b/src/v8/test/mjsunit/regress/regress-crbug-866315.js
new file mode 100644
index 0000000..4eb032d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-866315.js
@@ -0,0 +1,12 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-async-hooks
+
+let num = 42;
+let ah = async_hooks.createHook({});
+
+num.__proto__.__proto__ = ah;
+assertThrows('num.enable()');
+assertThrows('num.disable()');
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-867776.js b/src/v8/test/mjsunit/regress/regress-crbug-867776.js
new file mode 100644
index 0000000..76d2121
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-867776.js
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+for (var i = 0; i < 3; i++) {
+  var array = new BigInt64Array(200);
+
+  function evil_callback() {
+    %ArrayBufferDetach(array.buffer);
+    gc();
+    return 1094795585n;
+  }
+
+  var evil_object = {valueOf: evil_callback};
+  var root;
+  try {
+    root = BigInt64Array.of.call(function() { return array }, evil_object);
+  } catch(e) {}
+  gc();
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-869313.js b/src/v8/test/mjsunit/regress/regress-crbug-869313.js
new file mode 100644
index 0000000..1b4f9c5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-869313.js
@@ -0,0 +1,15 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f() {
+  try {
+    var a = new ArrayBuffer(1073741824);
+    var d = new DataView(a);
+    return d.getUint8() === 0;
+  } catch(e) {
+    return true;
+  }
+}
+
+!f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-871886.js b/src/v8/test/mjsunit/regress/regress-crbug-871886.js
new file mode 100644
index 0000000..0114431
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-871886.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let arr = [1.5, 2.5];
+arr.slice(0,
+  { valueOf: function () {
+      arr.length = 0;
+      return 2;
+    }
+  });
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-876443.js b/src/v8/test/mjsunit/regress/regress-crbug-876443.js
new file mode 100644
index 0000000..33ffa02
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-876443.js
@@ -0,0 +1,9 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags:
+
+var a = [5.65];
+a.splice(0);
+var b = a.splice(-4, 9, 10);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-878845.js b/src/v8/test/mjsunit/regress/regress-crbug-878845.js
new file mode 100644
index 0000000..2913f9e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-878845.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let arr = [, 0.1];
+
+Array.prototype.lastIndexOf.call(arr, 100, {
+  valueOf() {
+    arr.length = 0;
+  }
+});
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-879560.js b/src/v8/test/mjsunit/regress/regress-crbug-879560.js
new file mode 100644
index 0000000..da5c6d9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-879560.js
@@ -0,0 +1,16 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  var x = 1;
+  x = undefined;
+  while (x--)
+    ;
+};
+%PrepareFunctionForOptimization(foo);
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-879898.js b/src/v8/test/mjsunit/regress/regress-crbug-879898.js
new file mode 100644
index 0000000..b4e5c88
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-879898.js
@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  return Symbol.toPrimitive++;
+};
+%PrepareFunctionForOptimization(foo);
+assertThrows(foo);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-880207.js b/src/v8/test/mjsunit/regress/regress-crbug-880207.js
new file mode 100644
index 0000000..6778b5e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-880207.js
@@ -0,0 +1,37 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestOptimizedFastExpm1MinusZero() {
+  function foo() {
+    return Object.is(Math.expm1(-0), -0);
+  };
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();
+
+(function TestOptimizedExpm1MinusZeroSlowPath() {
+  function f(x) {
+    return Object.is(Math.expm1(x), -0);
+  };
+  %PrepareFunctionForOptimization(f);
+  function g() {
+    return f(-0);
+  };
+  %PrepareFunctionForOptimization(g);
+  f(0);
+  // Compile function optimistically for numbers (with fast inlined
+  // path for Math.expm1).
+  %OptimizeFunctionOnNextCall(f);
+  // Invalidate the optimistic assumption, deopting and marking non-number
+  // input feedback in the call IC.
+  f("0");
+  // Optimize again, now with non-lowered call to Math.expm1.
+  assertTrue(g());
+  %OptimizeFunctionOnNextCall(g);
+  assertTrue(g());
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-881247.js b/src/v8/test/mjsunit/regress/regress-crbug-881247.js
new file mode 100644
index 0000000..4605c3f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-881247.js
@@ -0,0 +1,24 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const resolvedPromise = Promise.resolve();
+
+function spread() {
+  const result = { ...resolvedPromise };
+  %HeapObjectVerify(result);
+  return result;
+}
+
+resolvedPromise[undefined] =  {a:1};
+%HeapObjectVerify(resolvedPromise);
+
+spread();
+
+resolvedPromise[undefined] = undefined;
+%HeapObjectVerify(resolvedPromise);
+
+spread();
+%HeapObjectVerify(resolvedPromise);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-882233-1.js b/src/v8/test/mjsunit/regress/regress-crbug-882233-1.js
new file mode 100644
index 0000000..197660a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-882233-1.js
@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Intended to test bug [882233] on CSA fast-path.
+
+let array = [];
+Object.defineProperty(array, 'length', {writable: false});
+
+assertEquals(array.length, 0);
+assertThrows(() => array.shift(), TypeError);
+
+let object = { length: 0 };
+Object.defineProperty(object, 'length', {writable: false});
+
+assertEquals(object.length, 0);
+assertThrows(() => Array.prototype.shift.call(object));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-882233-2.js b/src/v8/test/mjsunit/regress/regress-crbug-882233-2.js
new file mode 100644
index 0000000..b79ac2a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-882233-2.js
@@ -0,0 +1,34 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Intended to test bug [882233] on TF inlined (js-call-reducer) path.
+
+function shift_array() {
+  let array = [];
+  Object.defineProperty(array, 'length', {writable : false});
+  return array.shift();
+}
+
+%PrepareFunctionForOptimization(shift_array);
+assertThrows(shift_array);
+assertThrows(shift_array);
+%OptimizeFunctionOnNextCall(shift_array);
+assertThrows(shift_array);
+assertOptimized(shift_array);
+
+
+function shift_object() {
+  let object = { length: 0 };
+  Object.defineProperty(object, 'length', {writable : false});
+  return object.shift();
+}
+
+%PrepareFunctionForOptimization(shift_object);
+assertThrows(shift_object);
+assertThrows(shift_object);
+%OptimizeFunctionOnNextCall(shift_object);
+assertThrows(shift_object);
+assertOptimized(shift_object);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-884933.js b/src/v8/test/mjsunit/regress/regress-crbug-884933.js
new file mode 100644
index 0000000..229e0b0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-884933.js
@@ -0,0 +1,85 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Test Uint8 -> Word64 conversions.
+(function() {
+function bar(x, y) {
+  return x + y;
+}
+
+bar(0.1, 0.2);
+bar(0.1, 0.2);
+
+function foo(dv) {
+  return bar(dv.getUint8(0, true), 0xFFFFFFFF);
+};
+%PrepareFunctionForOptimization(foo);
+const dv = new DataView(new ArrayBuffer(8));
+assertEquals(0xFFFFFFFF, foo(dv));
+assertEquals(0xFFFFFFFF, foo(dv));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(0xFFFFFFFF, foo(dv));
+})();
+
+// Test Int8 -> Word64 conversions.
+(function() {
+function bar(x, y) {
+  return x + y;
+}
+
+bar(0.1, 0.2);
+bar(0.1, 0.2);
+
+function foo(dv) {
+  return bar(dv.getInt8(0, true), 0xFFFFFFFF);
+};
+%PrepareFunctionForOptimization(foo);
+const dv = new DataView(new ArrayBuffer(8));
+assertEquals(0xFFFFFFFF, foo(dv));
+assertEquals(0xFFFFFFFF, foo(dv));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(0xFFFFFFFF, foo(dv));
+})();
+
+// Test Uint16 -> Word64 conversions.
+(function() {
+function bar(x, y) {
+  return x + y;
+}
+
+bar(0.1, 0.2);
+bar(0.1, 0.2);
+
+function foo(dv) {
+  return bar(dv.getUint16(0, true), 0xFFFFFFFF);
+};
+%PrepareFunctionForOptimization(foo);
+const dv = new DataView(new ArrayBuffer(8));
+assertEquals(0xFFFFFFFF, foo(dv));
+assertEquals(0xFFFFFFFF, foo(dv));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(0xFFFFFFFF, foo(dv));
+})();
+
+// Test Int16 -> Word64 conversions.
+(function() {
+function bar(x, y) {
+  return x + y;
+}
+
+bar(0.1, 0.2);
+bar(0.1, 0.2);
+
+function foo(dv) {
+  return bar(dv.getInt16(0, true), 0xFFFFFFFF);
+};
+%PrepareFunctionForOptimization(foo);
+const dv = new DataView(new ArrayBuffer(8));
+assertEquals(0xFFFFFFFF, foo(dv));
+assertEquals(0xFFFFFFFF, foo(dv));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(0xFFFFFFFF, foo(dv));
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-885404.js b/src/v8/test/mjsunit/regress/regress-crbug-885404.js
new file mode 100644
index 0000000..534b883
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-885404.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --verify-heap --expose-gc
+
+var ab = new ArrayBuffer(2);
+try { new Int32Array(ab); } catch (e) { }
+assertEquals(2, ab.byteLength);
+gc();
+assertEquals(2, ab.byteLength);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-887891.js b/src/v8/test/mjsunit/regress/regress-crbug-887891.js
new file mode 100644
index 0000000..0e72ab2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-887891.js
@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --verify-heap
+
+const l = 1000000000;
+const a = [];
+function foo() { var x = new Int32Array(l); }
+try { foo(); } catch (e) { }
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-888825.js b/src/v8/test/mjsunit/regress/regress-crbug-888825.js
new file mode 100644
index 0000000..9aa52d6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-888825.js
@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+eval("((a=function g() { function g() {}}) => {})();");
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-890243.js b/src/v8/test/mjsunit/regress/regress-crbug-890243.js
new file mode 100644
index 0000000..e6a9ebc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-890243.js
@@ -0,0 +1,32 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// We need a SpeculativeNumberAdd with Number feedback.
+function bar(x) {
+  return x + x;
+}
+bar(0.1);
+
+// We also need an indirection via an object field such
+// that only after escape analysis TurboFan can figure
+// out that the value `y` is actually a Number in the
+// safe integer range.
+function baz(y) {
+  return {y};
+}
+baz(null);
+baz(0);
+
+// Now we can put all of that together to get a kRepBit
+// use of a kWord64 value (on 64-bit architectures).
+function foo(o) {
+  return !baz(bar(o.x)).y;
+};
+%PrepareFunctionForOptimization(foo);
+assertFalse(foo({x: 1}));
+assertFalse(foo({x: 1}));
+%OptimizeFunctionOnNextCall(foo);
+assertFalse(foo({x: 1}));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-891627.js b/src/v8/test/mjsunit/regress/regress-crbug-891627.js
new file mode 100644
index 0000000..b21c25f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-891627.js
@@ -0,0 +1,45 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// We need a NumberModulus, so we make sure that we have a
+// SpeculativeNumberModulus with Number feedback, and later
+// on use it with known Number inputs (via the bitwise or),
+// such that JSTypedLowering turns it into the NumberModulus.
+function bar(x) { return x % 2; }
+bar(0.1);
+
+// Check that the Word32->Float64 conversion works properly.
+(function() {
+  function foo(x) {
+    // The NumberEqual identifies 0 and -0.
+    return bar(x | -1) == 4294967295;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(1));
+  assertFalse(foo(0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(1));
+  assertFalse(foo(0));
+})();
+
+// Check that the Word32->Word32 conversion works properly.
+(function() {
+  function makeFoo(y) {
+    return function foo(x) {
+      return bar(x | -1) == y;
+    }
+  }
+  makeFoo(0);  // Defeat the function context specialization.
+  const foo = makeFoo(1);
+
+  %PrepareFunctionForOptimization(foo);
+  assertFalse(foo(1));
+  assertFalse(foo(0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(1));
+  assertFalse(foo(0));
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-892472-1.js b/src/v8/test/mjsunit/regress/regress-crbug-892472-1.js
new file mode 100644
index 0000000..d6332fd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-892472-1.js
@@ -0,0 +1,9 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --async-stack-traces
+
+const a = /x/;
+a.exec = RegExp.prototype.test;
+assertThrows(() => RegExp.prototype.test.call(a));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-892472-2.js b/src/v8/test/mjsunit/regress/regress-crbug-892472-2.js
new file mode 100644
index 0000000..0f9a2c1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-892472-2.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --async-stack-traces
+
+assertThrows(_ => '' + {toString: Object.prototype.toLocaleString});
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-895199.js b/src/v8/test/mjsunit/regress/regress-crbug-895199.js
new file mode 100644
index 0000000..b70d4ce
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-895199.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  var a = new Array(2);
+  a[0] = 23.1234;
+  a[1] = 25.1234;
+  %DeoptimizeNow();
+  return a[2];
+};
+%PrepareFunctionForOptimization(foo);
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-896181.js b/src/v8/test/mjsunit/regress/regress-crbug-896181.js
new file mode 100644
index 0000000..9aef4fc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-896181.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = new Array();
+a[0] = 0.1;
+a[2] = 0.2;
+Object.defineProperty(a, 1, {
+  get: function() {
+    a[4] = 0.3;
+  },
+});
+
+assertSame('0.1,,0.2', a.join());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-896700.js b/src/v8/test/mjsunit/regress/regress-crbug-896700.js
new file mode 100644
index 0000000..3e6232a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-896700.js
@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --async-stack-traces --expose-async-hooks
+
+async_hooks.createHook({
+  after() { throw new Error(); }
+}).enable();
+Promise.resolve().then();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-897098.js b/src/v8/test/mjsunit/regress/regress-crbug-897098.js
new file mode 100644
index 0000000..fe11aa1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-897098.js
@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const arr = [1.1,2.2,3.3];
+arr.pop();
+const start = {toString: function() {arr.pop();}}
+arr.includes(0, start);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-897404.js b/src/v8/test/mjsunit/regress/regress-crbug-897404.js
new file mode 100644
index 0000000..7e8b48d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-897404.js
@@ -0,0 +1,16 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function TestError() {}
+
+const a = new Array(2**32 - 1);
+
+// Force early exit to avoid an unreasonably long test.
+a[0] = {
+  toString() { throw new TestError(); }
+};
+
+// Verify join throws test error and does not fail due to asserts (Negative
+// length fixed array allocation).
+assertThrows(() => a.join(), TestError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-897406.js b/src/v8/test/mjsunit/regress/regress-crbug-897406.js
new file mode 100644
index 0000000..62eeeeb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-897406.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --async-stack-traces --expose-async-hooks
+
+async_hooks.createHook({
+  after() { throw new Error(); }
+}).enable();
+
+(async function() {
+  await 1;
+  await 1;
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-897514.js b/src/v8/test/mjsunit/regress/regress-crbug-897514.js
new file mode 100644
index 0000000..822a6bc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-897514.js
@@ -0,0 +1,26 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Create transtion => 'get a'.
+let o = {};
+Object.defineProperty(o, 'a', {
+    enumerable: true,
+    configurable: true,
+    get: function() { return 7 }
+});
+
+function spread(o) {
+  let result = { ...o };
+  %HeapObjectVerify(result);
+  return result;
+}
+
+for (let i = 0; i<3; i++) {
+  spread([]);
+  // Use different transition => 'a'.
+  spread({ a:0 });
+  spread("abc");
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-898785.js b/src/v8/test/mjsunit/regress/regress-crbug-898785.js
new file mode 100644
index 0000000..668b095
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-898785.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = [0, 1];
+var o = { [Symbol.toPrimitive]() { a.length = 1; return 2; } };
+
+a.push(2);
+a.lastIndexOf(5, o);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-898974.js b/src/v8/test/mjsunit/regress/regress-crbug-898974.js
new file mode 100644
index 0000000..1b9b07a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-898974.js
@@ -0,0 +1,34 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Module(global, env, buffer) {
+  "use asm";
+  var HEAPF64 = new global.Float64Array(buffer);
+  var HEAPF32 = new global.Float32Array(buffer);
+  var Math_fround = global.Math.fround;
+  function main_d_f() {
+    HEAPF64[0] = Math_fround(+HEAPF64[0]);
+  }
+  function main_d_fq() {
+    HEAPF64[1] = HEAPF32[4096];
+  }
+  function main_f_dq() {
+    HEAPF32[4] = HEAPF64[4096];
+  }
+  return {main_d_f: main_d_f, main_d_fq: main_d_fq, main_f_dq: main_f_dq};
+};
+let buffer = new ArrayBuffer(4096);
+let module = Module(this, undefined, buffer);
+let view64 = new Float64Array(buffer);
+let view32 = new Float32Array(buffer);
+assertEquals(view64[0] = 2.3, view64[0]);
+module.main_d_f();
+module.main_d_fq();
+module.main_f_dq();
+assertTrue(%IsAsmWasmCode(Module));
+assertEquals(Math.fround(2.3), view64[0]);
+assertTrue(isNaN(view64[1]));
+assertTrue(isNaN(view32[4]));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-899464.js b/src/v8/test/mjsunit/regress/regress-crbug-899464.js
new file mode 100644
index 0000000..b2f594c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-899464.js
@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+''.matchAll(/./u);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-899524.js b/src/v8/test/mjsunit/regress/regress-crbug-899524.js
new file mode 100644
index 0000000..9c1cca7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-899524.js
@@ -0,0 +1,34 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function empty() {}
+
+function baz(expected, found) {
+  var start = "";
+  found.length, start + 'x';
+  if (expected.length === found.length) {
+    for (var i = 0; i < expected.length; ++i) {
+      empty(found[i]);
+    }
+  }
+}
+
+baz([1], new class A extends Array {}());
+
+(function () {
+  "use strict";
+  function bar() {
+    baz([1, 2], arguments);
+  }
+  function foo() {
+    bar(2147483648, -[]);
+  };
+  %PrepareFunctionForOptimization(foo);
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-899535.js b/src/v8/test/mjsunit/regress/regress-crbug-899535.js
new file mode 100644
index 0000000..aab112b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-899535.js
@@ -0,0 +1,6 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let a = [1.1, 2.2, 3.3];
+a.includes(4.4, { toString: () => a.length = 0 });
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-900674.js b/src/v8/test/mjsunit/regress/regress-crbug-900674.js
new file mode 100644
index 0000000..22a9ead
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-900674.js
@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  let val = Promise.resolve().then();
+};
+%PrepareFunctionForOptimization(foo);
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-902395.js b/src/v8/test/mjsunit/regress/regress-crbug-902395.js
new file mode 100644
index 0000000..129a234
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-902395.js
@@ -0,0 +1,34 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function opt() {
+  try {
+    Object.seal({});
+  } finally {
+    try {
+      // Carefully crafted by clusterfuzz to alias the temporary object literal
+      // register with the below dead try block's context register.
+      ({toString() {}})
+          .
+
+          apply(-1)
+          .x();
+    } finally {
+      if (2.2) {
+        return;
+      }
+      // This code should be dead.
+      try {
+        Reflect.construct;
+      } finally {
+      }
+    }
+  }
+};
+%PrepareFunctionForOptimization(opt);
+opt();
+%OptimizeFunctionOnNextCall(opt);
+opt();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-902610.js b/src/v8/test/mjsunit/regress/regress-crbug-902610.js
new file mode 100644
index 0000000..11b88f2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-902610.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(() => {
+  // Make a function with 65535 args. This should throw a SyntaxError because -1
+  // is reserved for the "don't adapt arguments" sentinel.
+  var f_with_65535_args =
+      eval("(function(" + Array(65535).fill("x").join(",") + "){})");
+  f_with_65535_args();
+}, SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-902672.js b/src/v8/test/mjsunit/regress/regress-crbug-902672.js
new file mode 100644
index 0000000..4073b55
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-902672.js
@@ -0,0 +1,8 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = this;
+var b = {};
+a.length = 4294967296; // 2 ^ 32 (max array length + 1)
+assertThrows(() => Array.prototype.join.call(a,b), TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-903043.js b/src/v8/test/mjsunit/regress/regress-crbug-903043.js
new file mode 100644
index 0000000..7337a69
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-903043.js
@@ -0,0 +1,39 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+function foo() {
+  const x = 1e-1;
+  return Object.is(-0, x * -1e-308);
+};
+%PrepareFunctionForOptimization(foo);
+assertFalse(foo());
+assertFalse(foo());
+%OptimizeFunctionOnNextCall(foo);
+assertFalse(foo());
+})();
+
+(function() {
+function foo(x) {
+  return Object.is(-0, x * -1e-308);
+};
+%PrepareFunctionForOptimization(foo);
+assertFalse(foo(1e-1));
+assertFalse(foo(1e-1));
+%OptimizeFunctionOnNextCall(foo);
+assertFalse(foo(1e-1));
+})();
+
+(function() {
+function foo(x) {
+  return Object.is(-0, x);
+};
+%PrepareFunctionForOptimization(foo);
+assertFalse(foo(1e-1 * -1e-308));
+assertFalse(foo(1e-1 * -1e-308));
+%OptimizeFunctionOnNextCall(foo);
+assertFalse(foo(1e-1 * -1e-308));
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-905457.js b/src/v8/test/mjsunit/regress/regress-crbug-905457.js
new file mode 100644
index 0000000..ca820a7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-905457.js
@@ -0,0 +1,49 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+function foo(x) {
+  return Math.abs(Math.min(+x, 0));
+};
+%PrepareFunctionForOptimization(foo);
+assertEquals(NaN, foo());
+assertEquals(NaN, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(NaN, foo());
+})();
+
+(function() {
+function foo(x) {
+  return Math.abs(Math.min(-x, 0));
+};
+%PrepareFunctionForOptimization(foo);
+assertEquals(NaN, foo());
+assertEquals(NaN, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(NaN, foo());
+})();
+
+(function() {
+function foo(x) {
+  return Math.abs(Math.max(0, +x));
+};
+%PrepareFunctionForOptimization(foo);
+assertEquals(NaN, foo());
+assertEquals(NaN, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(NaN, foo());
+})();
+
+(function() {
+function foo(x) {
+  return Math.abs(Math.max(0, -x));
+};
+%PrepareFunctionForOptimization(foo);
+assertEquals(NaN, foo());
+assertEquals(NaN, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(NaN, foo());
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-906043.js b/src/v8/test/mjsunit/regress/regress-crbug-906043.js
new file mode 100644
index 0000000..eb10ec2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-906043.js
@@ -0,0 +1,34 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function fun(arg) {
+  let x = arguments.length;
+  a1 = new Array(0x10);
+  a1[0] = 1.1;
+  a2 = new Array(0x10);
+  a2[0] = 1.1;
+  a1[(x >> 16) * 21] = 1.39064994160909e-309;  // 0xffff00000000
+  a1[(x >> 16) * 41] = 8.91238232205e-313;  // 0x2a00000000
+}
+
+var a1, a2;
+var a3 = [1.1, 2.2];
+a3.length = 0x11000;
+a3.fill(3.3);
+
+var a4 = [1.1];
+
+%PrepareFunctionForOptimization(fun);
+for (let i = 0; i < 3; i++) fun(...a4);
+%OptimizeFunctionOnNextCall(fun);
+fun(...a4);
+
+res = fun(...a3);
+
+assertEquals(16, a2.length);
+for (let i = 8; i < 32; i++) {
+  assertEquals(undefined, a2[i]);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-906220.js b/src/v8/test/mjsunit/regress/regress-crbug-906220.js
new file mode 100644
index 0000000..9085f68
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-906220.js
@@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  new Array().pop();
+};
+%PrepareFunctionForOptimization(foo);
+assertEquals(undefined, foo());
+assertEquals(undefined, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(undefined, foo());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-906870.js b/src/v8/test/mjsunit/regress/regress-crbug-906870.js
new file mode 100644
index 0000000..7dc86bf
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-906870.js
@@ -0,0 +1,49 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+function foo() {
+  return Infinity / Math.max(-0, +0);
+};
+%PrepareFunctionForOptimization(foo);
+assertEquals(+Infinity, foo());
+assertEquals(+Infinity, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(+Infinity, foo());
+})();
+
+(function() {
+function foo() {
+  return Infinity / Math.max(+0, -0);
+};
+%PrepareFunctionForOptimization(foo);
+assertEquals(+Infinity, foo());
+assertEquals(+Infinity, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(+Infinity, foo());
+})();
+
+(function() {
+function foo() {
+  return Infinity / Math.min(-0, +0);
+};
+%PrepareFunctionForOptimization(foo);
+assertEquals(-Infinity, foo());
+assertEquals(-Infinity, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(-Infinity, foo());
+})();
+
+(function() {
+function foo() {
+  return Infinity / Math.min(+0, -0);
+};
+%PrepareFunctionForOptimization(foo);
+assertEquals(-Infinity, foo());
+assertEquals(-Infinity, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(-Infinity, foo());
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-90771.js b/src/v8/test/mjsunit/regress/regress-crbug-90771.js
new file mode 100644
index 0000000..b541ff8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-90771.js
@@ -0,0 +1,15 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+// Flags: --allow-natives-syntax
+function target() {};
+
+for (let key of Object.getOwnPropertyNames(this)) {
+  try {
+    let newTarget = this[key];
+    let arg = target;
+    Reflect.construct(target, arg, newTarget);
+  } catch {}
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-908309.js b/src/v8/test/mjsunit/regress/regress-crbug-908309.js
new file mode 100644
index 0000000..8a2b463
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-908309.js
@@ -0,0 +1,33 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const p = Object.defineProperty(Promise.resolve(), 'then', {
+  value() {
+    return 0;
+  }
+});
+
+(function() {
+function foo() {
+  return p.catch().catch();
+};
+%PrepareFunctionForOptimization(foo);
+assertThrows(foo, TypeError);
+assertThrows(foo, TypeError);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(foo, TypeError);
+})();
+
+(function() {
+function foo() {
+  return p.finally().finally();
+};
+%PrepareFunctionForOptimization(foo);
+assertThrows(foo, TypeError);
+assertThrows(foo, TypeError);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(foo, TypeError);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-909614.js b/src/v8/test/mjsunit/regress/regress-crbug-909614.js
new file mode 100644
index 0000000..4070c9b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-909614.js
@@ -0,0 +1,9 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let just_under = 2n ** 30n - 1n;
+let just_above = 2n ** 30n;
+
+assertDoesNotThrow(() => { var dummy = 2n ** just_under; });
+assertThrows(() => { var dummy = 2n ** just_above; });
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-911416.js b/src/v8/test/mjsunit/regress/regress-crbug-911416.js
new file mode 100644
index 0000000..60d7ae8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-911416.js
@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals(7, ({[Symbol.hasInstance.description]:7})["Symbol.hasInstance"]);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-913212.js b/src/v8/test/mjsunit/regress/regress-crbug-913212.js
new file mode 100644
index 0000000..2de99d6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-913212.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const globalThis = this;
+Object.setPrototypeOf(this, new Proxy({}, {
+  get(target, prop, receiver) {
+    assertTrue(receiver === globalThis);
+  }
+}));
+undefined_name_access
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-913222.js b/src/v8/test/mjsunit/regress/regress-crbug-913222.js
new file mode 100644
index 0000000..6410c54
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-913222.js
@@ -0,0 +1,10 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stack-size=100
+__v_0 = '(function() {\n';
+for (var __v_1 = 0; __v_1 < 10000; __v_1++) {
+    __v_0 += '  return function() {\n';
+}
+assertThrows(()=>eval(__v_0), RangeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-913296.js b/src/v8/test/mjsunit/regress/regress-crbug-913296.js
new file mode 100644
index 0000000..feb2eaf
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-913296.js
@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(trigger) {
+  return Object.is((trigger ? -0 : 0) - 0, -0);
+};
+%PrepareFunctionForOptimization(foo);
+assertFalse(foo(false));
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo(true));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-915783.js b/src/v8/test/mjsunit/regress/regress-crbug-915783.js
new file mode 100644
index 0000000..9220b4a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-915783.js
@@ -0,0 +1,35 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const constructors = [
+  [Uint8Array, [0, 1]],
+  [Int8Array, [0, 1]],
+  [Uint16Array, [0, 1]],
+  [Int16Array, [0, 1]],
+  [Uint32Array, [0, 1]],
+  [Int32Array, [0, 1]],
+  [Float32Array, [0, 1]],
+  [Float64Array, [0, 1]],
+  [Uint8ClampedArray, [0, 1]],
+  [BigInt64Array, [0n, 1n]],
+  [BigUint64Array, [0n, 1n]]
+];
+
+let typedArray;
+function detachBuffer() {
+  %ArrayBufferDetach(typedArray.buffer);
+  return 'a';
+}
+Number.prototype.toString = detachBuffer;
+BigInt.prototype.toString = detachBuffer;
+Number.prototype.toLocaleString = detachBuffer;
+BigInt.prototype.toLocaleString = detachBuffer;
+
+constructors.forEach(([constructor, arr]) => {
+  typedArray = new constructor(arr);
+  assertSame(typedArray.join(), '0,1');
+  assertSame(typedArray.toLocaleString(), 'a,');
+});
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-9161.js b/src/v8/test/mjsunit/regress/regress-crbug-9161.js
new file mode 100644
index 0000000..a90a8ad
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-9161.js
@@ -0,0 +1,59 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// This test is a reproduction of a crash that happens when a TypedArray
+// backed by a SharedArrayBuffer is concurrently modified while sorting.
+// Segfaults would need a long time to trigger in normal builds, so this
+// reproduction is tailored to trigger on ASAN builds. On ASAN builds,
+// out-of-bounds accesses while sorting would result in an immediate failure.
+
+const lock = new Int32Array(new SharedArrayBuffer(4));
+
+const kIterations = 5000;
+const kLength = 2000;
+
+const kStageIndex = 0;
+const kStageInit = 0;
+const kStageRunning = 1;
+const kStageDone = 2;
+
+Atomics.store(lock, kStageIndex, kStageInit);
+
+function WaitUntil(expected) {
+  while (true) {
+    const value = Atomics.load(lock, kStageIndex);
+    if (value === expected) break;
+  }
+}
+
+const workerScript = `
+  onmessage = function([sab, lock]) {
+    const i32a = new Int32Array(sab);
+    Atomics.store(lock, ${kStageIndex}, ${kStageRunning});
+
+    for (let j = 1; j < ${kIterations}; ++j) {
+      for (let i = 0; i < i32a.length; ++i) {
+        i32a[i] = j;
+      }
+    }
+
+    postMessage("done");
+    Atomics.store(lock, ${kStageIndex}, ${kStageDone});
+  };`;
+
+const worker = new Worker(workerScript, {type: 'string'});
+
+const i32a = new Int32Array(
+  new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT * kLength)
+);
+
+worker.postMessage([i32a.buffer, lock]);
+WaitUntil(kStageRunning);
+
+for (let i = 0; i < kIterations; ++i) {
+  i32a.sort();
+}
+
+WaitUntil(kStageDone);
+assertEquals(worker.getMessage(), "done");
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-916288.js b/src/v8/test/mjsunit/regress/regress-crbug-916288.js
new file mode 100644
index 0000000..aa170c9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-916288.js
@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("(a()=0)=>0", SyntaxError)
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-917076.js b/src/v8/test/mjsunit/regress/regress-crbug-917076.js
new file mode 100644
index 0000000..7c19c02
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-917076.js
@@ -0,0 +1,20 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+let speciesCounter = 0;
+
+Object.defineProperty(Promise, Symbol.species, {
+  value: function(...args) {
+    speciesCounter++;
+    return new Promise(...args);
+  }
+});
+
+async function foo() { }
+
+assertPromiseResult(Promise.all([foo()]), () => {
+  assertEquals(3, speciesCounter);
+});
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-917980.js b/src/v8/test/mjsunit/regress/regress-crbug-917980.js
new file mode 100644
index 0000000..18dc782
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-917980.js
@@ -0,0 +1,33 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const constructors = [
+  [Uint8Array, [0, 1]],
+  [Int8Array, [0, 1]],
+  [Uint16Array, [0, 1]],
+  [Int16Array, [0, 1]],
+  [Uint32Array, [0, 1]],
+  [Int32Array, [0, 1]],
+  [Float32Array, [0, 1]],
+  [Float64Array, [0, 1]],
+  [Uint8ClampedArray, [0, 1]],
+  [BigInt64Array, [0n, 1n]],
+  [BigUint64Array, [0n, 1n]]
+];
+
+let typedArray;
+
+const separator = {
+  toString() {
+    %ArrayBufferDetach(typedArray.buffer);
+    return '*';
+  }
+};
+
+constructors.forEach(([constructor, arr]) => {
+  typedArray = new constructor(arr);
+  assertSame(typedArray.join(separator), '*');
+});
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-920184.js b/src/v8/test/mjsunit/regress/regress-crbug-920184.js
new file mode 100644
index 0000000..c38f181
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-920184.js
@@ -0,0 +1,14 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --verify-heap --enable-slow-asserts
+
+var Ctor = function() {
+  return [];
+};
+var a = ["one", "two", "three"];
+a.constructor = {};
+a.constructor[Symbol.species] = Ctor;
+
+a.filter(function() { return true; });
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-923264.js b/src/v8/test/mjsunit/regress/regress-crbug-923264.js
new file mode 100644
index 0000000..e8c0d43
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-923264.js
@@ -0,0 +1,27 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --verify-heap --expose-gc
+
+let paramName = '';
+for (let i=0; i < 2**10; i++) {
+  paramName += 'a';
+}
+
+let params = '';
+for (let i = 0; i < 2**10; i++) {
+  params += paramName + i + ',';
+}
+
+let fn = eval(`(
+  class A {
+    constructor (${params}) {
+      function lazy() {
+        return function lazier() { return ${paramName+1} }
+      };
+      return lazy;
+    }
+})`);
+
+gc()
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-923265.js b/src/v8/test/mjsunit/regress/regress-crbug-923265.js
new file mode 100644
index 0000000..8e6125b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-923265.js
@@ -0,0 +1,9 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let a = {0: 5, 1: 4, 2: 3, length: 2};
+Object.freeze(a);
+
+assertThrows(() => Array.prototype.sort.call(a));
+assertPropertiesEqual({0: 5, 1: 4, 2: 3, length: 2}, a);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-923705.js b/src/v8/test/mjsunit/regress/regress-crbug-923705.js
new file mode 100644
index 0000000..9cdb98b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-923705.js
@@ -0,0 +1,15 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --verify-heap
+
+function __f_5() {
+  function __f_1() {
+    function __f_0() {
+      ({y = eval()}) => assertEquals()();
+    }
+  }
+}
+
+__f_5();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-926651.js b/src/v8/test/mjsunit/regress/regress-crbug-926651.js
new file mode 100644
index 0000000..8ec3c60
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-926651.js
@@ -0,0 +1,12 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var asdf = false;
+
+const f =
+  (v1 = (function g() {
+    if (asdf) { return; } else { return; }
+    (function h() {});
+  })()) => 1;
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-926819.js b/src/v8/test/mjsunit/regress/regress-crbug-926819.js
new file mode 100644
index 0000000..060c72f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-926819.js
@@ -0,0 +1,5 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("a(function(){{let f;function f}})", SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-926856.js b/src/v8/test/mjsunit/regress/regress-crbug-926856.js
new file mode 100644
index 0000000..a3fa934
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-926856.js
@@ -0,0 +1,18 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Need a fast array with enough elements to surpass
+// kMaxRegularHeapObjectSize.
+var size = 63392;
+var a = [];
+function build() {
+  for (let i = 0; i < size; i++) {
+    a.push(i);
+  }
+}
+
+build();
+
+function c(v) { return v + 0.5; }
+a.map(c);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-930580.js b/src/v8/test/mjsunit/regress/regress-crbug-930580.js
new file mode 100644
index 0000000..e7f4987
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-930580.js
@@ -0,0 +1,9 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function outer() {
+  (arg = (function inner() {
+    return this
+  })()) => 0;
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-930948-base.js b/src/v8/test/mjsunit/regress/regress-crbug-930948-base.js
new file mode 100644
index 0000000..740f42a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-930948-base.js
@@ -0,0 +1,10 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --verify-heap --allow-natives-syntax
+
+function foo() {
+  return [undefined].map(Math.asin);
+}
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-930948.js b/src/v8/test/mjsunit/regress/regress-crbug-930948.js
new file mode 100644
index 0000000..3c5975b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-930948.js
@@ -0,0 +1,27 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --verify-heap --allow-natives-syntax
+
+// This checks that TransitionAndStoreNumberElement silences NaNs.
+function foo() {
+  return [undefined].map(Math.asin);
+};
+%PrepareFunctionForOptimization(foo);
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
+
+// This checks that TransitionAndStoreElement silences NaNs.
+function bar(b) {
+  return [undefined].map(x => b ? Math.asin(x) : "string");
+};
+%PrepareFunctionForOptimization(bar);
+bar(true);
+bar(false);
+bar(true);
+bar(false);
+%OptimizeFunctionOnNextCall(bar);
+bar(true);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-931664.js b/src/v8/test/mjsunit/regress/regress-crbug-931664.js
new file mode 100644
index 0000000..e1f1495
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-931664.js
@@ -0,0 +1,20 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function opt(){
+  for(l in('a')){
+    try{
+      for(a in('')) {
+        for(let arg2 in(+(arg2)));
+      }
+    }
+    finally{}
+  }
+}
+%PrepareFunctionForOptimization(opt);
+opt();
+%OptimizeFunctionOnNextCall(opt);
+opt();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-932034.js b/src/v8/test/mjsunit/regress/regress-crbug-932034.js
new file mode 100644
index 0000000..56758b4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-932034.js
@@ -0,0 +1,12 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --mock-arraybuffer-allocator
+
+// Verify on 32-bit architectures, a byte length overflow is handled gracefully.
+try {
+  new BigInt64Array(%MaxSmi());
+} catch(e) {
+  assertInstanceof(e, RangeError);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-933214.js b/src/v8/test/mjsunit/regress/regress-crbug-933214.js
new file mode 100644
index 0000000..56b96ac
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-933214.js
@@ -0,0 +1,13 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(`
+    function __v_0() {
+        function __v_2() {
+            try {
+                function* __v_0() {}
+                function __v_0() {}
+            }
+        }
+    }`, SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-934138.js b/src/v8/test/mjsunit/regress/regress-crbug-934138.js
new file mode 100644
index 0000000..2d23486
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-934138.js
@@ -0,0 +1,38 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestTrailingJunkAfterExport() {
+  function Module() {
+    "use asm";
+    function f() {}
+    return {f: f}
+    %kaboom;
+  }
+  assertThrows(() => Module(), ReferenceError);
+  assertFalse(%IsAsmWasmCode(Module));
+})();
+
+(function TestExportWithSemicolon() {
+  function Module() {
+    "use asm";
+    function f() {}
+    return {f: f};
+    // appreciate the semicolon
+  }
+  assertDoesNotThrow(() => Module());
+  assertTrue(%IsAsmWasmCode(Module));
+})();
+
+(function TestExportWithoutSemicolon() {
+  function Module() {
+    "use asm";
+    function f() {}
+    return {f: f}
+    // appreciate the nothingness
+  }
+  assertDoesNotThrow(() => Module());
+  assertTrue(%IsAsmWasmCode(Module));
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-934166.js b/src/v8/test/mjsunit/regress/regress-crbug-934166.js
new file mode 100644
index 0000000..bb44549
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-934166.js
@@ -0,0 +1,23 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+{
+  function f() {
+    for(let i = 0; i < 10; ++i){
+      %PrepareFunctionForOptimization(f);
+      try{
+        // Carefully constructed by a fuzzer to use a new register for s(), whose
+        // write is dead due to the unconditional throw after s()=N, but which is
+        // read in the ({...g}) call, which therefore must also be marked dead and
+        // elided.
+        with(f&&g&&(s()=N)({...g})){}
+      } catch {}
+      %OptimizeOsr();
+    }
+  }
+  %EnsureFeedbackVectorForFunction(f);
+  f();
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-935800.js b/src/v8/test/mjsunit/regress/regress-crbug-935800.js
new file mode 100644
index 0000000..18f735d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-935800.js
@@ -0,0 +1,12 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function foo() {
+  "use asm";
+  function bar() {}
+  return {bar: bar};
+}
+var module = foo();
+assertTrue(Object.getOwnPropertyNames(module.bar).includes("prototype"));
+assertInstanceof(new module.bar(), module.bar);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-935932.js b/src/v8/test/mjsunit/regress/regress-crbug-935932.js
new file mode 100644
index 0000000..1a60ec9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-935932.js
@@ -0,0 +1,95 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function test(func, expect) {
+    %PrepareFunctionForOptimization(func);
+    assertTrue(func() == expect);
+    %OptimizeFunctionOnNextCall(func);
+    assertTrue(func() == expect);
+}
+
+// Check loading a constant off the global.
+var v0 = 10;
+function check_v0() { return "v0" in this; }
+test(check_v0, true);
+
+// make it non-constant.
+v0 = 0;
+test(check_v0, true);
+
+// test a missing value.
+function check_v1() { return "v1" in this; }
+test(check_v1, false);
+this.v1 = 3;
+test(check_v1, true);
+delete this.v1;
+test(check_v1, false);
+
+// test undefined.
+var v2;
+function check_v2() { return "v2" in this; }
+test(check_v2, true);
+
+// test a constant object.
+var v3 = {};
+function check_v3() { return "v3" in this; }
+test(check_v3, true);
+// make the object non-constant.
+v3 = [];
+test(check_v3, true);
+
+// test non-configurable
+Object.defineProperty(this, "v4", { value: {}, configurable: false});
+function check_v4() { return "v4" in this; }
+test(check_v4, true);
+
+// Test loading from arrays with different prototypes.
+(function() {
+  function testIn(index, array) {
+    return index in array;
+  }
+  %PrepareFunctionForOptimization(testIn);
+
+  let a = [];
+  a.__proto__ = [0,1,2];
+  a[1] = 3;
+
+  // First load will set IC to Load handle with allow hole to undefined conversion false.
+  assertTrue(testIn(0, a));
+  // Second load will hit ICMiss when hole is loaded. Seeing the same map twice, the IC will be set megamorphic.
+  assertTrue(testIn(0, a));
+  %OptimizeFunctionOnNextCall(testIn);
+  // Test JIT to ensure proper handling.
+  assertTrue(testIn(0, a));
+
+  %ClearFunctionFeedback(testIn);
+  %DeoptimizeFunction(testIn);
+  %PrepareFunctionForOptimization(testIn);
+
+  // First load will set IC to Load handle with allow hole to undefined conversion false.
+  assertTrue(testIn(0, a));
+  %OptimizeFunctionOnNextCall(testIn);
+  // Test JIT to ensure proper handling if hole is loaded.
+  assertTrue(testIn(0, a));
+
+  // Repeat the same testing for access out-of-bounds of the array, but in bounds of it's prototype.
+  %ClearFunctionFeedback(testIn);
+  %DeoptimizeFunction(testIn);
+  %PrepareFunctionForOptimization(testIn);
+
+  assertTrue(testIn(2, a));
+  assertTrue(testIn(2, a));
+  %OptimizeFunctionOnNextCall(testIn);
+  assertTrue(testIn(2, a));
+
+  %ClearFunctionFeedback(testIn);
+  %DeoptimizeFunction(testIn);
+  %PrepareFunctionForOptimization(testIn);
+
+  assertTrue(testIn(2, a));
+  %OptimizeFunctionOnNextCall(testIn);
+  assertTrue(testIn(2, a));
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-936302.js b/src/v8/test/mjsunit/regress/regress-crbug-936302.js
new file mode 100644
index 0000000..4969fe3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-936302.js
@@ -0,0 +1,25 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+(function() {
+'use strict';
+
+function baz() {
+  'use asm';
+  function f() {}
+  return {f: f};
+}
+
+function foo(x) {
+  baz(x);
+  %DeoptimizeFunction(foo);
+};
+%PrepareFunctionForOptimization(foo);
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-937618.js b/src/v8/test/mjsunit/regress/regress-crbug-937618.js
new file mode 100644
index 0000000..5e004f7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-937618.js
@@ -0,0 +1,37 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+let target = {0: 42, a: 42};
+
+let proxy = new Proxy(target, {
+  has: function() {
+    return false;
+  }
+});
+
+Object.preventExtensions(target);
+
+function testLookupElementInProxy() {
+  0 in proxy;
+}
+
+// 9.5.7 [[HasProperty]] 9. states that if the trap returns false, and the
+// target hasOwnProperty, and the target is non-extensible, throw a type error.
+;
+%PrepareFunctionForOptimization(testLookupElementInProxy);
+assertThrows(testLookupElementInProxy, TypeError);
+assertThrows(testLookupElementInProxy, TypeError);
+%OptimizeFunctionOnNextCall(testLookupElementInProxy);
+assertThrows(testLookupElementInProxy, TypeError);
+
+function testLookupPropertyInProxy() {
+  "a" in proxy;
+};
+%PrepareFunctionForOptimization(testLookupPropertyInProxy);
+assertThrows(testLookupPropertyInProxy, TypeError);
+assertThrows(testLookupPropertyInProxy, TypeError);
+%OptimizeFunctionOnNextCall(testLookupPropertyInProxy);
+assertThrows(testLookupPropertyInProxy, TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-937649.js b/src/v8/test/mjsunit/regress/regress-crbug-937649.js
new file mode 100644
index 0000000..5dd794d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-937649.js
@@ -0,0 +1,18 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+// Flags: --allow-natives-syntax
+
+(function() {
+function foo(x) {
+  const i = x > 0;
+  const dv = new DataView(ab);
+  return dv.getUint16(i);
+};
+%PrepareFunctionForOptimization(foo);
+const ab = new ArrayBuffer(2);
+foo(0);
+foo(0);
+%OptimizeFunctionOnNextCall(foo);
+foo(0);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-937734.js b/src/v8/test/mjsunit/regress/regress-crbug-937734.js
new file mode 100644
index 0000000..2972956
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-937734.js
@@ -0,0 +1,17 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function foo()
+{
+    return 1 in [0];
+}
+
+%PrepareFunctionForOptimization(foo);
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
+assertOptimized(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-940274.js b/src/v8/test/mjsunit/regress/regress-crbug-940274.js
new file mode 100644
index 0000000..da9da31
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-940274.js
@@ -0,0 +1,11 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function foo() {
+  var a = new Array({});
+  a.shift();
+  assertFalse(a.hasOwnProperty(0));
+}
+
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-941703.js b/src/v8/test/mjsunit/regress/regress-crbug-941703.js
new file mode 100644
index 0000000..ec4847c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-941703.js
@@ -0,0 +1,5 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("(this) , this =>", SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-941743.js b/src/v8/test/mjsunit/regress/regress-crbug-941743.js
new file mode 100644
index 0000000..eaac4c4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-941743.js
@@ -0,0 +1,29 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --noenable-slow-asserts
+
+// This call ensures that TurboFan won't inline array constructors.
+Array(2 ** 30);
+
+// Set up a fast holey smi array, and generate optimized code.
+let a = [1, 2, , , , 3];
+function mapping(a) {
+  return a.map(v => v);
+};
+%PrepareFunctionForOptimization(mapping);
+mapping(a);
+mapping(a);
+%OptimizeFunctionOnNextCall(mapping);
+mapping(a);
+
+// Now lengthen the array, but ensure that it points to a non-dictionary
+// backing store.
+a.length = 32 * 1024 * 1024 - 1;
+a.fill(1, 0);
+a.push(2);
+a.length += 500;
+// Now, the non-inlined array constructor should produce an array with
+// dictionary elements: causing a crash.
+mapping(a);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-942068.js b/src/v8/test/mjsunit/regress/regress-crbug-942068.js
new file mode 100644
index 0000000..a0b68d4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-942068.js
@@ -0,0 +1,17 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(index, array) {
+  return index in array;
+};
+%PrepareFunctionForOptimization(foo);
+let arr = [];
+arr.__proto__ = [0];
+assertFalse(foo(0, {}));
+assertTrue(foo(0, arr));
+assertFalse(foo(0, {}));
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo(0, arr));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-944435.js b/src/v8/test/mjsunit/regress/regress-crbug-944435.js
new file mode 100644
index 0000000..c3810be
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-944435.js
@@ -0,0 +1,38 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --verify-heap --expose-gc
+
+function foo(  )  {
+  return [
+  0,
+  1,
+  2,
+  3,
+  4,
+  5,
+  6,
+  7,
+  8,
+  9,
+  10,
+  0x1000000,
+  0x40000000,
+  12,
+  60,
+  100,
+  1000 * 60 * 60 * 24].map(Math.asin);
+}
+
+let b = [];
+b.constructor = {};
+b.constructor[Symbol.species] = function() {};
+
+let a = [];
+for (let i = 0; i < 10; i++) {
+  a.push(foo());
+  gc();
+  gc();
+  gc();
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-944865.js b/src/v8/test/mjsunit/regress/regress-crbug-944865.js
new file mode 100644
index 0000000..630563f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-944865.js
@@ -0,0 +1,16 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  const r = {e: NaN, g: undefined, c: undefined};
+  const u = {__proto__: {}, e: new Set(), g: 0, c: undefined};
+  return r;
+};
+%PrepareFunctionForOptimization(foo);
+foo();
+%OptimizeFunctionOnNextCall(foo);
+const o = foo();
+Object.defineProperty(o, 'c', {value: 42});
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-944971.js b/src/v8/test/mjsunit/regress/regress-crbug-944971.js
new file mode 100644
index 0000000..8f3f4a8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-944971.js
@@ -0,0 +1,19 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let re = /x/y;
+let cnt = 0;
+let str = re[Symbol.replace]("x", {
+  toString: () => {
+    cnt++;
+    if (cnt == 2) {
+      re.lastIndex = {valueOf: () => {
+        re.x = 42;
+        return 0;
+      }};
+    }
+    return 'y$';
+  }
+});
+assertEquals("y$", str);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-950747.js b/src/v8/test/mjsunit/regress/regress-crbug-950747.js
new file mode 100644
index 0000000..21a91bb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-950747.js
@@ -0,0 +1,11 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let o = {};
+Reflect.set(o, "a", 0.1);
+
+let o1 = {};
+o1.a = {};
+
+Reflect.set(o, "a", 0.1);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-951400.js b/src/v8/test/mjsunit/regress/regress-crbug-951400.js
new file mode 100644
index 0000000..17ed9d4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-951400.js
@@ -0,0 +1,20 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+function foo(arr) {
+  gc();
+  eval(arr);
+};
+%PrepareFunctionForOptimization(foo);
+try {
+  foo("tag`Hello${tag}`");
+} catch (e) {}
+
+%OptimizeFunctionOnNextCall(foo);
+
+try {
+  foo("tag.prop`${tag}`");
+} catch (e) {}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-959645-1.js b/src/v8/test/mjsunit/regress/regress-crbug-959645-1.js
new file mode 100644
index 0000000..afe9612
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-959645-1.js
@@ -0,0 +1,15 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --modify-field-representations-inplace
+
+function f(array, x) {
+  array.x = x;
+  array[0] = 1.1;
+  return array;
+}
+
+f([1], 1);
+f([2], 1);
+%HeapObjectVerify(f([3], undefined));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-959645-2.js b/src/v8/test/mjsunit/regress/regress-crbug-959645-2.js
new file mode 100644
index 0000000..634bfa9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-959645-2.js
@@ -0,0 +1,15 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --modify-field-representations-inplace
+
+function f(array, x) {
+  array.x = x;
+  array[0] = undefined;
+  return array;
+}
+
+f([1.1], 1);
+f([2.2], 1);
+%HeapObjectVerify(f([3.3], undefined));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-959727.js b/src/v8/test/mjsunit/regress/regress-crbug-959727.js
new file mode 100644
index 0000000..36bda5b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-959727.js
@@ -0,0 +1,11 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+'use strict';
+let r = Realm.createAllowCrossRealmAccess();
+Realm.detachGlobal(r);
+try {
+  Realm.global(r)[1] = 0;
+} catch (e) {
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-961522.js b/src/v8/test/mjsunit/regress/regress-crbug-961522.js
new file mode 100644
index 0000000..aba7e61
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-961522.js
@@ -0,0 +1,18 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --nolazy
+
+(function () {
+  let arr = [, 3];
+  function inlined() {
+  }
+  function foo() {
+    arr.reduce(inlined);
+  };
+  %PrepareFunctionForOptimization(foo);
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-961709-1.js b/src/v8/test/mjsunit/regress/regress-crbug-961709-1.js
new file mode 100644
index 0000000..c03d5d5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-961709-1.js
@@ -0,0 +1,26 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  const a = [];
+  a[0] = 1;
+  return a[0];
+}
+
+function bar() {
+  const a = new Array(10);
+  a[0] = 1;
+  return a[0];
+}
+
+Object.setPrototypeOf(Array.prototype, new Int8Array());
+%EnsureFeedbackVectorForFunction(foo);
+assertEquals(undefined, foo());
+assertEquals(undefined, foo());
+
+%EnsureFeedbackVectorForFunction(bar);
+assertEquals(undefined, bar());
+assertEquals(undefined, bar());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-961709-2.js b/src/v8/test/mjsunit/regress/regress-crbug-961709-2.js
new file mode 100644
index 0000000..0201411
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-961709-2.js
@@ -0,0 +1,32 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function foo() {
+  const a = [];
+  a[0] = 1;
+  return a[0];
+};
+
+function bar() {
+  const a = new Array(10);
+  a[0] = 1;
+  return a[0];
+};
+
+Object.setPrototypeOf(Array.prototype, new Int8Array());
+%PrepareFunctionForOptimization(foo);
+assertEquals(undefined, foo());
+assertEquals(undefined, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(undefined, foo());
+assertOptimized(foo);
+
+%PrepareFunctionForOptimization(bar);
+assertEquals(undefined, bar());
+assertEquals(undefined, bar());
+%OptimizeFunctionOnNextCall(bar);
+assertEquals(undefined, bar());
+assertOptimized(bar);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-963568.js b/src/v8/test/mjsunit/regress/regress-crbug-963568.js
new file mode 100644
index 0000000..bc902b8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-963568.js
@@ -0,0 +1,6 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+JSON.parse('{"0":true,"1":true,"2":true,"3":true,"4":true,"9":true," ":true,"D":true,"B":true,"-1":true,"A":true,"C":true}');
+JSON.parse('{"0":true,"1":true,"2":true,"3":true,"4":true,"9":true," ":true,"D":true,"B":true,"-1":true,"A":true,"C":true}');
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-964833.js b/src/v8/test/mjsunit/regress/regress-crbug-964833.js
new file mode 100644
index 0000000..d5683b7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-964833.js
@@ -0,0 +1,33 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+  var n = 3;
+  var obj = {};
+
+  var m = n;
+  for (;;) {
+    m++;
+
+    if (m == 456) {
+      break;
+    }
+
+    var i = 0;
+    var j = 0;
+    while (i < 1) {
+      j = i;
+      i++;
+    }
+    obj.y = j;
+  }
+}
+
+%PrepareFunctionForOptimization(f);
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-964869.js b/src/v8/test/mjsunit/regress/regress-crbug-964869.js
new file mode 100644
index 0000000..d630669
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-964869.js
@@ -0,0 +1,5 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const o = {x: JSON.parse('{"x":1.1}').x};
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-966450.js b/src/v8/test/mjsunit/regress/regress-crbug-966450.js
new file mode 100644
index 0000000..3ba5eba
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-966450.js
@@ -0,0 +1,17 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let prop = "someName";
+function foo(a, b, v) { return a[b] = 0 }
+try {
+  foo("", prop);
+} catch(e) {}
+var target = {};
+var traps = { set() {return 42} };
+var proxy = new Proxy(target, traps);
+Object.defineProperty(target, prop, { value: 0 });
+try {
+  foo(proxy, prop);
+} catch (e) { }
+foo(proxy, prop, 0);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-967065.js b/src/v8/test/mjsunit/regress/regress-crbug-967065.js
new file mode 100644
index 0000000..ca6744c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-967065.js
@@ -0,0 +1,16 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Tests that the receiver {length} property conversion works on 32-bit
+// systems (i.e. it should not crash).
+
+function ThrowingSort() {
+  const __v_3 = new Array(2147549152);
+  Object.defineProperty(__v_3, 0, {
+    get: () => { throw new Error("Do not actually sort!"); }
+  });
+  __v_3.sort();
+}
+
+assertThrows(() => ThrowingSort());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-967101.js b/src/v8/test/mjsunit/regress/regress-crbug-967101.js
new file mode 100644
index 0000000..18365f9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-967101.js
@@ -0,0 +1,48 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// For packed sealed object.
+function packedStore() {
+  let a = Object.seal([""]);
+  a[0] = 0;
+  assertEquals(a[0], 0);
+}
+
+packedStore();
+packedStore();
+
+// For holey sealed object.
+function holeyStore() {
+  let a = Object.seal([, ""]);
+  a[0] = 0;
+  assertEquals(a[0], undefined);
+}
+
+holeyStore();
+holeyStore();
+
+// Make sure IC store for holey is consistent.
+let a = Object.seal([, ""]);
+function foo() {
+  a[1] = 0;
+}
+
+foo();
+foo();
+function bar() {
+  a[0] = 1;
+}
+assertEquals(a, [, 0]);
+bar();
+assertEquals(a, [, 0]);
+bar();
+assertEquals(a, [, 0]);
+function baz() {
+  a[2] = 2;
+}
+assertEquals(a, [, 0]);
+baz();
+assertEquals(a, [, 0]);
+baz();
+assertEquals(a, [, 0]);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-967151.js b/src/v8/test/mjsunit/regress/regress-crbug-967151.js
new file mode 100644
index 0000000..d98c01a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-967151.js
@@ -0,0 +1,12 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-externalize-string
+
+__v_3 = "100                         external string turned into two byte";
+__v_2 = __v_3.substring(0, 28);
+try {
+  externalizeString(__v_3, true);
+} catch (e) {}
+assertEquals(100, JSON.parse(__v_2));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-967254.js b/src/v8/test/mjsunit/regress/regress-crbug-967254.js
new file mode 100644
index 0000000..95333d5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-967254.js
@@ -0,0 +1,17 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Test that fast COW arrays are properly handled by Array#sort.
+
+function COWSort() {
+  const array = ["cc", "c", "aa", "bb", "b", "ab", "ac"];
+  array.sort();
+  return array;
+}
+
+assertArrayEquals(["aa", "ab", "ac", "b", "bb", "c", "cc"], COWSort());
+
+Array.prototype.sort = () => {};
+
+assertArrayEquals(["cc", "c", "aa", "bb", "b", "ab", "ac"], COWSort());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-967434.js b/src/v8/test/mjsunit/regress/regress-crbug-967434.js
new file mode 100644
index 0000000..3c08d98
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-967434.js
@@ -0,0 +1,40 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f1(h_also_eval) {
+  this.x = h_also_eval;
+}
+
+function f2(h, h_eval) {
+  var o = new f1(h());
+  // During the last call to f3 with g2 as an argument, this store is
+  // bi-morphic, including a version that refers to the old map (before
+  // the replacement of f1's prototype). As a result, during load elimination
+  // we see two stores with incompatible representations: One in the
+  // constructor, and one in the impossible branch of the bi-morphic store
+  // site.
+  o.x = h_eval;
+};
+function f3(h) {
+  %PrepareFunctionForOptimization(f2);
+  f2(h, h());
+  %OptimizeFunctionOnNextCall(f2);
+  f2(h, h());
+}
+
+function g1() {
+  return {};
+};
+function g2() {
+  return 4.2;
+};
+
+f3(g1);
+f3(g2);
+
+f3(g1);
+f1.prototype = {};
+f3(g2);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-969368.js b/src/v8/test/mjsunit/regress/regress-crbug-969368.js
new file mode 100644
index 0000000..cfc60a3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-969368.js
@@ -0,0 +1,19 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Module() {
+  'use asm';
+  function f() {}
+  function g() {
+    var x = 0.0;
+    table[x & 3]();
+  }
+  var table = [f, f, f, f];
+  return { g: g };
+}
+var m = Module();
+assertDoesNotThrow(m.g);
+assertFalse(%IsAsmWasmCode(Module));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-969498.js b/src/v8/test/mjsunit/regress/regress-crbug-969498.js
new file mode 100644
index 0000000..4dddcb3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-969498.js
@@ -0,0 +1,16 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let global = new WebAssembly.Global({value: 'f32', mutable: true}, 2e66);
+global.value = 2e66;
+
+// Custom additional test case:
+const kRoundsDown = 3.4028235677973362e+38;
+const kRoundsToInf = 3.4028235677973366e+38;
+var floats = new Float32Array([kRoundsDown, kRoundsToInf]);
+assertNotEquals(Infinity, floats[0]);
+assertEquals(Infinity, floats[1]);
+floats.set([kRoundsDown, kRoundsToInf]);
+assertNotEquals(Infinity, floats[0]);
+assertEquals(Infinity, floats[1]);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-971383.js b/src/v8/test/mjsunit/regress/regress-crbug-971383.js
new file mode 100644
index 0000000..0d5595b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-971383.js
@@ -0,0 +1,7 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --icu-locale=tr
+
+assertEquals(["HIJK"], "HIJK".match(/[a-z]+/gi));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-971782.js b/src/v8/test/mjsunit/regress/regress-crbug-971782.js
new file mode 100644
index 0000000..d979bc9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-971782.js
@@ -0,0 +1,18 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(dv) {
+  for (let i = -1; i < 1; ++i) {
+    dv.setUint16(i % 1);
+  }
+}
+
+const dv = new DataView(new ArrayBuffer(2));
+%PrepareFunctionForOptimization(foo);
+foo(dv);
+foo(dv);
+%OptimizeFunctionOnNextCall(foo);
+foo(dv);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-976256.js b/src/v8/test/mjsunit/regress/regress-crbug-976256.js
new file mode 100644
index 0000000..990e931
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-976256.js
@@ -0,0 +1,24 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(r) {
+  return r.finally();
+}
+
+const resolution = Promise.resolve();
+foo(resolution);
+
+function bar() {
+  try {
+    foo(undefined);
+  } catch (e) {}
+}
+
+%PrepareFunctionForOptimization(bar);
+bar();
+bar();
+%OptimizeFunctionOnNextCall(bar);
+bar();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-976598.js b/src/v8/test/mjsunit/regress/regress-crbug-976598.js
new file mode 100644
index 0000000..0e1a787
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-976598.js
@@ -0,0 +1,18 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+  return { value: NaN };
+}
+
+%PrepareFunctionForOptimization(f);
+f();
+f();
+
+let x = { value: "Y" };
+
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-976934.js b/src/v8/test/mjsunit/regress/regress-crbug-976934.js
new file mode 100644
index 0000000..4c31615
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-976934.js
@@ -0,0 +1,22 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Module(stdlib, imports, heap) {
+  "use asm";
+
+  var fround = stdlib.Math.fround;
+
+  function f() {
+    var x = fround(-1.7976931348623157e+308);
+    return fround(x);
+  }
+
+  return { f: f };
+}
+
+var m = Module(this);
+assertEquals(-Infinity, m.f());
+assertTrue(%IsAsmWasmCode(Module));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-977012.js b/src/v8/test/mjsunit/regress/regress-crbug-977012.js
new file mode 100644
index 0000000..4e94953
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-977012.js
@@ -0,0 +1,17 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function foo(arg) {
+  var ret = { x: arg };
+  ret.__defineSetter__("y", function() { });
+  return ret;
+}
+
+// v1 creates a map with a Smi field, v2 deprecates v1's map.
+let v1 = foo(10);
+let v2 = foo(10.5);
+
+// Trigger a PrepareForDataProperty on v1, which also triggers an update to
+// dictionary due to the different accessors on v1 and v2's y property.
+v1.x = 20.5;
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-977089.js b/src/v8/test/mjsunit/regress/regress-crbug-977089.js
new file mode 100644
index 0000000..d7db660
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-977089.js
@@ -0,0 +1,45 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+// This function was carefully constructed by Clusterfuzz to execute a certain
+// sequence of transitions. Thus, it may no longer test anything useful if
+// the transition logic changes.
+//
+// The more stable unit test testing the same bug is:
+//   test-field-type-tracking/NormalizeToMigrationTarget
+var foo = function() {
+
+  function f1(arg) {
+    var ret = { x: arg };
+    ret.__defineGetter__("y", function() { });
+    return ret;
+  }
+  // Create v1 with a map with properties: {x:Smi, y:AccessorPair}
+  let v1 = f1(10);
+  // Create a map with properties: {x:Double, y:AccessorPair}, deprecating the
+  // previous map.
+  let v2 = f1(10.5);
+
+  // Access x on v1 to a function that reads x, which triggers it to update its
+  // map. This update transitions v1 to slow mode as there is already a "y"
+  // transition with a different accessor.
+  //
+  // Note that the parent function `foo` can't be an IIFE, as then this callsite
+  // would use the NoFeedback version of the LdaNamedProperty bytecode, and this
+  // doesn't trigger the map update.
+  v1.x;
+
+  // Create v3 which overwrites a non-accessor with an accessor, triggering it
+  // to normalize, and picking up the same cached normalized map as v1. However,
+  // v3's map is not a migration target and v1's is (as it was migrated to when
+  // updating v1), so the migration target bit doesn't match. This should be
+  // fine and shouldn't trigger any DCHECKs.
+  let v3 = { z:1 };
+  v3.__defineGetter__("z", function() {});
+};
+
+%EnsureFeedbackVectorForFunction(foo);
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-979023.js b/src/v8/test/mjsunit/regress/regress-crbug-979023.js
new file mode 100644
index 0000000..0d31be3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-979023.js
@@ -0,0 +1,18 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function foo(arg) {
+  var ret = { x: arg };
+  Object.defineProperty(ret, "y", {
+    get: function () { },
+    configurable: true
+  });
+  return ret;
+}
+let v0 = foo(10);
+let v1 = foo(10.5);
+Object.defineProperty(v0, "y", {
+  get: function () { },
+  configurable: true
+});
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-979401.js b/src/v8/test/mjsunit/regress/regress-crbug-979401.js
new file mode 100644
index 0000000..2ef5084
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-979401.js
@@ -0,0 +1,20 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let min_fields = 1015;
+let max_fields = 1025;
+
+let static_fields_src = "";
+let instance_fields_src = "";
+for (let i = 0; i < max_fields; i++) {
+  static_fields_src += "  static f" + i + "() {}\n";
+  instance_fields_src += "  g" + i + "() {}\n";
+
+  if (i >= min_fields) {
+    let src1 = "class A {\n" + static_fields_src + "}\n";
+    eval(src1);
+    let src2 = "class B {\n" + instance_fields_src + "}\n";
+    eval(src2);
+  }
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-980168.js b/src/v8/test/mjsunit/regress/regress-crbug-980168.js
new file mode 100644
index 0000000..163d22b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-980168.js
@@ -0,0 +1,56 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --verify-heap
+
+// seal then freeze.
+(function () {
+  const v1 = Object.seal(Object);
+  const v3 = Object();
+  const v4 = Object(Object);
+  v3.__proto__ = v4;
+  const v6 = Object.freeze(Object);
+})();
+
+// preventExtensions then freeze.
+(function () {
+  const v1 = Object.preventExtensions(Object);
+  const v3 = Object();
+  const v4 = Object(Object);
+  v3.__proto__ = v4;
+  const v6 = Object.freeze(Object);
+})();
+
+// preventExtensions then seal.
+(function () {
+  const v1 = Object.preventExtensions(Object);
+  const v3 = Object();
+  const v4 = Object(Object);
+  v3.__proto__ = v4;
+  const v6 = Object.seal(Object);
+})();
+
+// freeze.
+(function () {
+  const v3 = Object();
+  const v4 = Object(Object);
+  v3.__proto__ = v4;
+  const v6 = Object.freeze(Object);
+})();
+
+// seal.
+(function () {
+  const v3 = Object();
+  const v4 = Object(Object);
+  v3.__proto__ = v4;
+  const v6 = Object.seal(Object);
+})();
+
+// preventExtensions.
+(function () {
+  const v3 = Object();
+  const v4 = Object(Object);
+  v3.__proto__ = v4;
+  const v6 = Object.preventExtensions(Object);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-980292.js b/src/v8/test/mjsunit/regress/regress-crbug-980292.js
new file mode 100644
index 0000000..779c1a1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-980292.js
@@ -0,0 +1,19 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+let v2 = Object;
+const v4 = new Proxy(Object,v2);
+const v6 = (9).__proto__;
+v6.__proto__ = v4;
+function v8(v9,v10,v11) {
+    let v14 = 0;
+    do {
+      const v16 = (0x1337).prototype;
+      v14++;
+    } while (v14 < 24);
+}
+const v7 = [1,2,3,4];
+const v17 = v7.findIndex(v8);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-980529.js b/src/v8/test/mjsunit/regress/regress-crbug-980529.js
new file mode 100644
index 0000000..2fdf7ad
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-980529.js
@@ -0,0 +1,19 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+const a = {toString: () => {
+  console.log("print arguments", print.arguments);
+}};
+
+function g(x) {
+  print(x);
+}
+
+%PrepareFunctionForOptimization(g);
+g(a);
+g(a);
+%OptimizeFunctionOnNextCall(g);
+g(a);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-984344.js b/src/v8/test/mjsunit/regress/regress-crbug-984344.js
new file mode 100644
index 0000000..fea2c2d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-984344.js
@@ -0,0 +1,34 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function largeAllocToTriggerGC() {
+  for (let i = 0; i < 16; i++) {
+    let ab = new ArrayBuffer(1024 * 1024 * 10);
+  }
+}
+
+function foo() {
+  eval('function bar(a) {}' +
+       '(function() {' +
+       '  for (let c = 0; c < 505; c++) {' +
+       '    while (Promise >= 0xDEADBEEF) {' +
+       '      Array.prototype.slice.call(bar, bar, bar);' +
+       '    }' +
+       '    for (let i = 0; i < 413; i++) {' +
+       '    }' +
+       '  }' +
+       '})();' +
+       'largeAllocToTriggerGC();');
+}
+
+
+foo();
+foo();
+foo();
+// Don't prepare until here to allow function to be flushed.
+%PrepareFunctionForOptimization(foo);
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-985660.js b/src/v8/test/mjsunit/regress/regress-crbug-985660.js
new file mode 100644
index 0000000..49ddf93
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-985660.js
@@ -0,0 +1,23 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+try {
+  Object.defineProperty(Number.prototype, "v", {
+    get: constructor
+  });
+} catch (e) {}
+
+function foo(obj) {
+  return obj.v;
+}
+
+%PrepareFunctionForOptimization(foo);
+%OptimizeFunctionOnNextCall(foo);
+foo(3);
+%PrepareFunctionForOptimization(foo);
+%OptimizeFunctionOnNextCall(foo);
+foo(3);
+foo(4);
diff --git a/src/v8/test/mjsunit/regress/regress-deep-proto.js b/src/v8/test/mjsunit/regress/regress-deep-proto.js
index 5d2758c..2d3bb9d 100644
--- a/src/v8/test/mjsunit/regress/regress-deep-proto.js
+++ b/src/v8/test/mjsunit/regress/regress-deep-proto.js
@@ -25,10 +25,12 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// Flags: --allow-natives-syntax
+
 function poly(x) {
   return x.foo;
-}
-
+};
+%PrepareFunctionForOptimization(poly);
 var one = {foo: 0};
 var two = {foo: 0, bar: 1};
 var three = {bar: 0};
@@ -38,8 +40,12 @@
 three.__proto__.__proto__.__proto__.__proto__ = {};
 three.__proto__.__proto__.__proto__.__proto__.__proto__ = {};
 
-for (var i = 0; i < 1e6; i++) {
-  poly(one);
-  poly(two);
-  poly(three);
-}
+poly(one);
+poly(two);
+poly(three);
+
+%OptimizeFunctionOnNextCall(poly);
+
+poly(one);
+poly(two);
+poly(three);
diff --git a/src/v8/test/mjsunit/regress/regress-deopt-in-array-literal-spread.js b/src/v8/test/mjsunit/regress/regress-deopt-in-array-literal-spread.js
index 8bebbe2..31375e1 100644
--- a/src/v8/test/mjsunit/regress/regress-deopt-in-array-literal-spread.js
+++ b/src/v8/test/mjsunit/regress/regress-deopt-in-array-literal-spread.js
@@ -4,9 +4,11 @@
 
 // Flags: --allow-natives-syntax
 
-function f(a,b,c,d) { return [a, ...(%DeoptimizeNow(), [b,c]), d]; }
-
-assertEquals([1,2,3,4], f(1,2,3,4));
-assertEquals([1,2,3,4], f(1,2,3,4));
+function f(a, b, c, d) {
+  return [a, ...(%DeoptimizeNow(), [b, c]), d];
+};
+%PrepareFunctionForOptimization(f);
+assertEquals([1, 2, 3, 4], f(1, 2, 3, 4));
+assertEquals([1, 2, 3, 4], f(1, 2, 3, 4));
 %OptimizeFunctionOnNextCall(f);
-assertEquals([1,2,3,4], f(1,2,3,4));
+assertEquals([1, 2, 3, 4], f(1, 2, 3, 4));
diff --git a/src/v8/test/mjsunit/regress/regress-deopt-store-effect.js b/src/v8/test/mjsunit/regress/regress-deopt-store-effect.js
index 59094d3..47264b6 100644
--- a/src/v8/test/mjsunit/regress/regress-deopt-store-effect.js
+++ b/src/v8/test/mjsunit/regress/regress-deopt-store-effect.js
@@ -28,36 +28,40 @@
 // Flags: --allow-natives-syntax
 
 // Test deopt after generic store with effect context.
-var pro = { x : 1 }
-var a = {}
-a.__proto__ = pro
-delete pro.x
+var pro = {x: 1};
+var a = {};
+a.__proto__ = pro;
+delete pro.x;
 
 function g(o) {
   return 7 + (o.z = 1, 20);
-}
-
+};
+%PrepareFunctionForOptimization(g);
 g(a);
 g(a);
 %OptimizeFunctionOnNextCall(g);
-Object.defineProperty(pro, "z", {
-    set: function(v) { %DeoptimizeFunction(g); },
-    get: function() { return 20; }
+Object.defineProperty(pro, 'z', {
+  set: function(v) {
+    %DeoptimizeFunction(g);
+  },
+  get: function() {
+    return 20;
+  }
 });
 
 assertEquals(27, g(a));
 
 // Test deopt after polymorphic as monomorphic store with effect context.
 
-var i = { z : 2, r : 1 }
-var j = { z : 2 }
-var p = { a : 10 }
-var pp = { a : 20, b : 1 }
+var i = {z: 2, r: 1};
+var j = {z: 2};
+var p = {a: 10};
+var pp = {a: 20, b: 1};
 
 function bar(o, p) {
   return 7 + (o.z = 1, p.a);
-}
-
+};
+%PrepareFunctionForOptimization(bar);
 bar(i, p);
 bar(i, p);
 bar(j, p);
@@ -66,15 +70,15 @@
 
 // Test deopt after polymorphic store with effect context.
 
-var i = { r : 1, z : 2 }
-var j = { z : 2 }
-var p = { a : 10 }
-var pp = { a : 20, b : 1 }
+var i = {r: 1, z: 2};
+var j = {z: 2};
+var p = {a: 10};
+var pp = {a: 20, b: 1};
 
 function bar1(o, p) {
   return 7 + (o.z = 1, p.a);
-}
-
+};
+%PrepareFunctionForOptimization(bar1);
 bar1(i, p);
 bar1(i, p);
 bar1(j, p);
diff --git a/src/v8/test/mjsunit/regress/regress-deoptimize-constant-keyed-load.js b/src/v8/test/mjsunit/regress/regress-deoptimize-constant-keyed-load.js
index ed63133..b4bd9e3 100644
--- a/src/v8/test/mjsunit/regress/regress-deoptimize-constant-keyed-load.js
+++ b/src/v8/test/mjsunit/regress/regress-deoptimize-constant-keyed-load.js
@@ -4,18 +4,21 @@
 
 // Flags: --allow-natives-syntax
 
-var o = { };
-o.__defineGetter__("progressChanged", function() { %DeoptimizeFunction(f); return 10; })
+var o = {};
+o.__defineGetter__('progressChanged', function() {
+  %DeoptimizeFunction(f);
+  return 10;
+});
 
 function g(a, b, c) {
   return a + b + c;
 }
 
 function f() {
-  var t="progressChanged";
+  var t = 'progressChanged';
   return g(1, o[t], 100);
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-directive.js b/src/v8/test/mjsunit/regress/regress-directive.js
new file mode 100644
index 0000000..ff38f86
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-directive.js
@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f() {
+  'use strict'
+  in Number
+}
+
+f.arguments
diff --git a/src/v8/test/mjsunit/regress/regress-double-canonicalization.js b/src/v8/test/mjsunit/regress/regress-double-canonicalization.js
index 2b345d2..6fb7ebd 100644
--- a/src/v8/test/mjsunit/regress/regress-double-canonicalization.js
+++ b/src/v8/test/mjsunit/regress/regress-double-canonicalization.js
@@ -6,16 +6,16 @@
 
 var ab = new ArrayBuffer(8);
 var i_view = new Int32Array(ab);
-i_view[0] = %GetHoleNaNUpper()
+i_view[0] = %GetHoleNaNUpper();
 i_view[1] = %GetHoleNaNLower();
-var hole_nan = (new Float64Array(ab))[0];
+var hole_nan = new Float64Array(ab)[0];
 
 var array = [];
 
 function write() {
   array[0] = hole_nan;
-}
-
+};
+%PrepareFunctionForOptimization(write);
 write();
 %OptimizeFunctionOnNextCall(write);
 write();
diff --git a/src/v8/test/mjsunit/regress/regress-embedded-cons-string.js b/src/v8/test/mjsunit/regress/regress-embedded-cons-string.js
index b95b619..f371c99 100644
--- a/src/v8/test/mjsunit/regress/regress-embedded-cons-string.js
+++ b/src/v8/test/mjsunit/regress/regress-embedded-cons-string.js
@@ -35,6 +35,7 @@
 }
 
 function test(fun) {
+  %PrepareFunctionForOptimization(fun);
   fun();
   fun();
   // Mark for concurrent optimization.
diff --git a/src/v8/test/mjsunit/regress/regress-empty-fixed-double-array.js b/src/v8/test/mjsunit/regress/regress-empty-fixed-double-array.js
index 1db9e2b..8da3208 100644
--- a/src/v8/test/mjsunit/regress/regress-empty-fixed-double-array.js
+++ b/src/v8/test/mjsunit/regress/regress-empty-fixed-double-array.js
@@ -7,8 +7,8 @@
 function f(a, x) {
   a.shift();
   a[0] = x;
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f([1], 1.1);
 f([1], 1.1);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-ensure-initial-map.js b/src/v8/test/mjsunit/regress/regress-ensure-initial-map.js
index dbd4762..e607915 100644
--- a/src/v8/test/mjsunit/regress/regress-ensure-initial-map.js
+++ b/src/v8/test/mjsunit/regress/regress-ensure-initial-map.js
@@ -4,19 +4,19 @@
 
 // Flags: --allow-natives-syntax
 
-var x = Object.getOwnPropertyDescriptor({get x() {}}, "x").get;
+var x = Object.getOwnPropertyDescriptor({get x() {}}, 'x').get;
 function f(o, b) {
   if (b) {
     return o instanceof x;
   }
-}
-
+};
+%PrepareFunctionForOptimization(f);
 %OptimizeFunctionOnNextCall(f);
 f();
 
 function g() {
   return new x();
-}
-
+};
+%PrepareFunctionForOptimization(g);
 %OptimizeFunctionOnNextCall(g);
-assertThrows(()=>g());
+assertThrows(() => g());
diff --git a/src/v8/test/mjsunit/regress/regress-escape-preserve-smi-representation.js b/src/v8/test/mjsunit/regress/regress-escape-preserve-smi-representation.js
index fd899d6..bace1ef 100644
--- a/src/v8/test/mjsunit/regress/regress-escape-preserve-smi-representation.js
+++ b/src/v8/test/mjsunit/regress/regress-escape-preserve-smi-representation.js
@@ -5,15 +5,22 @@
 // Flags: --allow-natives-syntax
 
 function deepEquals(a, b) {
-  if (a === b) { if (a === 0) return (1 / a) === (1 / b); return true; }
+  if (a === b) {
+    if (a === 0) return 1 / a === 1 / b;
+    return true;
+  }
   if (typeof a != typeof b) return false;
   if (typeof a == "number") return isNaN(a) && isNaN(b);
   if (typeof a !== "object" && typeof a !== "function") return false;
-  if (objectClass === "RegExp") { return (a.toString() === b.toString()); }
+  if (objectClass === 'RegExp') {
+    return a.toString() === b.toString();
+  }
   if (objectClass === "Function") return false;
   if (objectClass === "Array") {
     var elementsCount = 0;
-    if (a.length != b.length) { return false; }
+    if (a.length != b.length) {
+      return false;
+    }
     for (var i = 0; i < a.length; i++) {
       if (!deepEquals(a[i], b[i])) return false;
     }
@@ -21,14 +28,14 @@
   }
 }
 
-
-function __f_1(){
+function __f_1() {
   var __v_0 = [];
-  for(var i=0; i<2; i++){
-    __v_0.push([])
+  for (var i = 0; i < 2; i++) {
+    __v_0.push([]);
     deepEquals(2, __v_0.length);
   }
-}
+};
+%PrepareFunctionForOptimization(__f_1);
 __f_1();
 %OptimizeFunctionOnNextCall(__f_1);
 __f_1();
diff --git a/src/v8/test/mjsunit/regress/regress-et-clobbers-doubles.js b/src/v8/test/mjsunit/regress/regress-et-clobbers-doubles.js
index 47fa479..8179850 100644
--- a/src/v8/test/mjsunit/regress/regress-et-clobbers-doubles.js
+++ b/src/v8/test/mjsunit/regress/regress-et-clobbers-doubles.js
@@ -28,12 +28,12 @@
 // Flags: --allow-natives-syntax
 function t_smi(a) {
   a[0] = 1.5;
-}
-
-t_smi([1,,3]);
-t_smi([1,,3]);
-t_smi([1,,3]);
+};
+%PrepareFunctionForOptimization(t_smi);
+t_smi([1, , 3]);
+t_smi([1, , 3]);
+t_smi([1, , 3]);
 %OptimizeFunctionOnNextCall(t_smi);
-var ta = [1,,3];
+var ta = [1, , 3];
 t_smi(ta);
-assertEquals([1.5,,3], ta);
+assertEquals([1.5, , 3], ta);
diff --git a/src/v8/test/mjsunit/regress/regress-fast-literal-transition.js b/src/v8/test/mjsunit/regress/regress-fast-literal-transition.js
index 2dc6a97..90c0bb7 100644
--- a/src/v8/test/mjsunit/regress/regress-fast-literal-transition.js
+++ b/src/v8/test/mjsunit/regress/regress-fast-literal-transition.js
@@ -37,11 +37,15 @@
 // final --stress-opt run.
 
 function f(x) {
-  switch(x) {
-    case 1: return 1.4;
-    case 2: return 1.5;
-    case 3: return {};
-    default: gc();
+  switch (x) {
+    case 1:
+      return 1.4;
+    case 2:
+      return 1.5;
+    case 3:
+      return {};
+    default:
+      gc();
   }
 }
 
@@ -50,6 +54,8 @@
 }
 
 // Step 1: Optimize g() to contain a PACKED_DOUBLE_ELEMENTS boilerplate.
+;
+%PrepareFunctionForOptimization(g);
 assertEquals([1.1, 1.2, 1.3, 1.4], g(1));
 assertEquals([1.1, 1.2, 1.3, 1.5], g(2));
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/regress/regress-filter-contexts.js b/src/v8/test/mjsunit/regress/regress-filter-contexts.js
index d2abe00..5869a3f 100644
--- a/src/v8/test/mjsunit/regress/regress-filter-contexts.js
+++ b/src/v8/test/mjsunit/regress/regress-filter-contexts.js
@@ -4,7 +4,10 @@
 
 // Flags: --allow-natives-syntax
 
-function f() { return f.x; }
+function f() {
+  return f.x;
+};
+%PrepareFunctionForOptimization(f);
 f.__proto__ = null;
 f.prototype = "";
 
diff --git a/src/v8/test/mjsunit/regress/regress-force-constant-representation.js b/src/v8/test/mjsunit/regress/regress-force-constant-representation.js
index 4ec2a6a..77b2f8a 100644
--- a/src/v8/test/mjsunit/regress/regress-force-constant-representation.js
+++ b/src/v8/test/mjsunit/regress/regress-force-constant-representation.js
@@ -8,8 +8,8 @@
 var a = [{}];
 function f(a) {
   a.push(Infinity);
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f(a);
 f(a);
 f(a);
diff --git a/src/v8/test/mjsunit/regress/regress-force-representation.js b/src/v8/test/mjsunit/regress/regress-force-representation.js
index 8f6746b..706660a 100644
--- a/src/v8/test/mjsunit/regress/regress-force-representation.js
+++ b/src/v8/test/mjsunit/regress/regress-force-representation.js
@@ -5,6 +5,7 @@
 // Flags: --allow-natives-syntax
 
 function optimize(crankshaft_test) {
+  %PrepareFunctionForOptimization(crankshaft_test);
   crankshaft_test();
   crankshaft_test();
   %OptimizeFunctionOnNextCall(crankshaft_test);
diff --git a/src/v8/test/mjsunit/regress/regress-freeze.js b/src/v8/test/mjsunit/regress/regress-freeze.js
index 6f3de2a..d57acce 100644
--- a/src/v8/test/mjsunit/regress/regress-freeze.js
+++ b/src/v8/test/mjsunit/regress/regress-freeze.js
@@ -28,7 +28,11 @@
 // Flags: --allow-natives-syntax
 
 // CountOperation
-function f(o) { o.x++ };
+function f(o) {
+  o.x++;
+};
+%PrepareFunctionForOptimization(f);
+;
 var o = {x: 5};
 Object.freeze(o);
 f(o);
@@ -38,7 +42,11 @@
 assertEquals(5, o.x);
 
 // Compound Assignment
-function f2(o) { o.x+=3 };
+function f2(o) {
+  o.x += 3;
+};
+%PrepareFunctionForOptimization(f2);
+;
 f2(o);
 f2(o);
 %OptimizeFunctionOnNextCall(f2);
diff --git a/src/v8/test/mjsunit/regress/regress-fundecl.js b/src/v8/test/mjsunit/regress/regress-fundecl.js
index fddb589..b4e8856 100644
--- a/src/v8/test/mjsunit/regress/regress-fundecl.js
+++ b/src/v8/test/mjsunit/regress/regress-fundecl.js
@@ -32,13 +32,15 @@
 
 function h(a, b) {
   var r = a + b;
-  function X() { return 42; }
+  function X() {
+    return 42;
+  }
   return r + X();
-}
-
-for (var i = 0; i < 5; i++) h(1,2);
+};
+%PrepareFunctionForOptimization(h);
+for (var i = 0; i < 5; i++) h(1, 2);
 
 %OptimizeFunctionOnNextCall(h);
 
-assertEquals(45, h(1,2));
+assertEquals(45, h(1, 2));
 assertEquals("foo742", h("foo", 7));
diff --git a/src/v8/test/mjsunit/regress/regress-grow-deopt.js b/src/v8/test/mjsunit/regress/regress-grow-deopt.js
index df3a83f..281ae02 100644
--- a/src/v8/test/mjsunit/regress/regress-grow-deopt.js
+++ b/src/v8/test/mjsunit/regress/regress-grow-deopt.js
@@ -6,8 +6,8 @@
 
 function f(a, v) {
   a[a.length] = v;
-}
-
+};
+%PrepareFunctionForOptimization(f);
 var a = [1.4];
 f(a, 1);
 f(a, 2);
diff --git a/src/v8/test/mjsunit/regress/regress-grow-store-smi-check.js b/src/v8/test/mjsunit/regress/regress-grow-store-smi-check.js
index 381141d..c632997 100644
--- a/src/v8/test/mjsunit/regress/regress-grow-store-smi-check.js
+++ b/src/v8/test/mjsunit/regress/regress-grow-store-smi-check.js
@@ -35,15 +35,15 @@
     var c = i;
     for (var j = 0; j < 8; j++) {
       if (c & 1) {
-        c = -306674912 ^ ((c >> 1) & 0x7fffffff);
+        c = -306674912 ^ c >> 1 & 0x7fffffff;
       } else {
-        c = (c >> 1) & 0x7fffffff;
+        c = c >> 1 & 0x7fffffff;
       }
     }
     crc32[i] = c;
   }
-}
-
+};
+%PrepareFunctionForOptimization(test);
 var a = [0.5];
 for (var i = 0; i < 256; ++i) a[i] = i;
 
diff --git a/src/v8/test/mjsunit/regress/regress-gvn-ftt.js b/src/v8/test/mjsunit/regress/regress-gvn-ftt.js
index dee5765..7a71fc3 100644
--- a/src/v8/test/mjsunit/regress/regress-gvn-ftt.js
+++ b/src/v8/test/mjsunit/regress/regress-gvn-ftt.js
@@ -21,6 +21,7 @@
 
 var obj = {o: a1};
 
+%PrepareFunctionForOptimization(f);
 f(obj, a1);
 f(obj, a1);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-hoist-load-named-field.js b/src/v8/test/mjsunit/regress/regress-hoist-load-named-field.js
index 7df07a0..83f35cf 100644
--- a/src/v8/test/mjsunit/regress/regress-hoist-load-named-field.js
+++ b/src/v8/test/mjsunit/regress/regress-hoist-load-named-field.js
@@ -40,6 +40,7 @@
   return v;
 }
 
+%PrepareFunctionForOptimization(f);
 f({y:1.4}, [1]);
 f({y:1.6}, [1]);
 %OptimizeFunctionOnNextCall(f);
@@ -59,6 +60,7 @@
 var o1 = { x: 1.5 };
 var o2 = { y: 1, x: 1 };
 
+%PrepareFunctionForOptimization(f2);
 f2(o1);
 f2(o1);
 f2(o2);
diff --git a/src/v8/test/mjsunit/regress/regress-indirect-push-unchecked.js b/src/v8/test/mjsunit/regress/regress-indirect-push-unchecked.js
index dca7e96..73742fa 100644
--- a/src/v8/test/mjsunit/regress/regress-indirect-push-unchecked.js
+++ b/src/v8/test/mjsunit/regress/regress-indirect-push-unchecked.js
@@ -8,8 +8,8 @@
 
 function p() {
   Array.prototype.push.call(a, 1.7);
-}
-
+};
+%PrepareFunctionForOptimization(p);
 p();
 p();
 p();
diff --git a/src/v8/test/mjsunit/regress/regress-inline-arrow-as-construct.js b/src/v8/test/mjsunit/regress/regress-inline-arrow-as-construct.js
index bd8fa31..56b066a 100644
--- a/src/v8/test/mjsunit/regress/regress-inline-arrow-as-construct.js
+++ b/src/v8/test/mjsunit/regress/regress-inline-arrow-as-construct.js
@@ -7,12 +7,12 @@
 // This tests that inlining a constructor call to a function which cannot be
 // used as a constructor (e.g. arrow function) still throws correctly.
 
-var g = () => {}
+var g = () => {};
 
 function f() {
   return new g();
-}
-
+};
+%PrepareFunctionForOptimization(f);
 assertThrows(f);
 assertThrows(f);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-inline-class-constructor.js b/src/v8/test/mjsunit/regress/regress-inline-class-constructor.js
index 1d77176..6f3d627 100644
--- a/src/v8/test/mjsunit/regress/regress-inline-class-constructor.js
+++ b/src/v8/test/mjsunit/regress/regress-inline-class-constructor.js
@@ -6,14 +6,14 @@
 
 "use strict";
 
-var B = class extends Int32Array { }
+var B = class extends Int32Array {};
 
 function f(b) {
   if (b) {
     null instanceof B;
   }
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f();
 f();
 f();
@@ -22,7 +22,7 @@
 
 function f2() {
   return new B();
-}
-
+};
+%PrepareFunctionForOptimization(f2);
 %OptimizeFunctionOnNextCall(f2);
 f2();
diff --git a/src/v8/test/mjsunit/regress/regress-inline-constant-load.js b/src/v8/test/mjsunit/regress/regress-inline-constant-load.js
index 303639c..64f626d 100644
--- a/src/v8/test/mjsunit/regress/regress-inline-constant-load.js
+++ b/src/v8/test/mjsunit/regress/regress-inline-constant-load.js
@@ -11,17 +11,19 @@
   return x.bar;
 }
 
-Object.defineProperty(o1, "bar", {value:200});
+Object.defineProperty(o1, 'bar', {value: 200});
 foo(o1);
 foo(o1);
 
 function f(b) {
   var o = o2;
-  if (b) { return foo(o) }
-}
-
+  if (b) {
+    return foo(o);
+  }
+};
+%PrepareFunctionForOptimization(f);
 f(false);
 %OptimizeFunctionOnNextCall(f);
 assertEquals(undefined, f(false));
-Object.defineProperty(o2, "bar", {value: 100});
+Object.defineProperty(o2, 'bar', {value: 100});
 assertEquals(100, f(true));
diff --git a/src/v8/test/mjsunit/regress/regress-inline-getter-near-stack-limit.js b/src/v8/test/mjsunit/regress/regress-inline-getter-near-stack-limit.js
index d459a7a..e458302 100644
--- a/src/v8/test/mjsunit/regress/regress-inline-getter-near-stack-limit.js
+++ b/src/v8/test/mjsunit/regress/regress-inline-getter-near-stack-limit.js
@@ -6,14 +6,24 @@
 
 function runNearStackLimit(f) {
   function t() {
-    try { t(); } catch(e) { f(); }
+    try {
+      t();
+    } catch (e) {
+      f();
+    }
   };
-  try { t(); } catch(e) {}
+  try {
+    t();
+  } catch (e) {
+  }
 }
 
-function g(x) { return x.bar; }
-function f1() { }
-function f2() { }
+function g(x) {
+  return x.bar;
+};
+%PrepareFunctionForOptimization(g);
+function f1() {}
+function f2() {}
 
 var x = Object.defineProperty({}, "bar", { get: f1 });
 g(x);
@@ -21,4 +31,6 @@
 var y = Object.defineProperty({}, "bar", { get: f2 });
 g(y);
 %OptimizeFunctionOnNextCall(g);
-runNearStackLimit(function() { g(y); });
+runNearStackLimit(function() {
+  g(y);
+});
diff --git a/src/v8/test/mjsunit/regress/regress-inlining-function-literal-context.js b/src/v8/test/mjsunit/regress/regress-inlining-function-literal-context.js
index 9b7f7ac..d73dab5 100644
--- a/src/v8/test/mjsunit/regress/regress-inlining-function-literal-context.js
+++ b/src/v8/test/mjsunit/regress/regress-inlining-function-literal-context.js
@@ -29,9 +29,9 @@
 
 function mkbaz(x) {
   function baz() {
-    return function () {
+    return function() {
       return [x];
-    }
+    };
   }
   return baz;
 }
@@ -44,6 +44,8 @@
 }
 
 // Tenure.
+;
+%PrepareFunctionForOptimization(foo);
 gc();
 gc();
 
diff --git a/src/v8/test/mjsunit/regress/regress-int32-truncation.js b/src/v8/test/mjsunit/regress/regress-int32-truncation.js
index dec4ac1..438be59 100644
--- a/src/v8/test/mjsunit/regress/regress-int32-truncation.js
+++ b/src/v8/test/mjsunit/regress/regress-int32-truncation.js
@@ -35,8 +35,8 @@
   }
   var x = a >> 3;
   return a;
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f(1, false);
 f(1, true);
 %OptimizeFunctionOnNextCall(f);
@@ -52,8 +52,8 @@
   }
   var x = a >> 3;
   return a;
-}
-
+};
+%PrepareFunctionForOptimization(f2);
 f2(false);
 f2(true);
 %OptimizeFunctionOnNextCall(f2);
diff --git a/src/v8/test/mjsunit/regress/regress-is-smi-repr.js b/src/v8/test/mjsunit/regress/regress-is-smi-repr.js
index e9f2b51..d9a4d34 100644
--- a/src/v8/test/mjsunit/regress/regress-is-smi-repr.js
+++ b/src/v8/test/mjsunit/regress/regress-is-smi-repr.js
@@ -12,6 +12,7 @@
 Object.defineProperty(Number.prototype, "prop", { get: g });
 function f(s) { s.prop; }
 
+%PrepareFunctionForOptimization(f);
 f(1);
 f(1);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-keyed-access-string-length.js b/src/v8/test/mjsunit/regress/regress-keyed-access-string-length.js
index f2ead68..5a151fa 100644
--- a/src/v8/test/mjsunit/regress/regress-keyed-access-string-length.js
+++ b/src/v8/test/mjsunit/regress/regress-keyed-access-string-length.js
@@ -29,8 +29,8 @@
 
 function f(i) {
   return "abc"[i];
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f("length");
 f("length");
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-lazy-deopt-inlining.js b/src/v8/test/mjsunit/regress/regress-lazy-deopt-inlining.js
index 6cda168..5dbac6b 100644
--- a/src/v8/test/mjsunit/regress/regress-lazy-deopt-inlining.js
+++ b/src/v8/test/mjsunit/regress/regress-lazy-deopt-inlining.js
@@ -7,10 +7,12 @@
 "use strict";
 function f1(d) {
   return 1 + f2(f3(d));
+};
+%PrepareFunctionForOptimization(f1);
+function f2(v) {
+  return v;
 }
 
-function f2(v) { return v; }
-
 function f3(d) {
   if (d) %DeoptimizeFunction(f1);
   return 2;
diff --git a/src/v8/test/mjsunit/regress/regress-lazy-deopt-inlining2.js b/src/v8/test/mjsunit/regress/regress-lazy-deopt-inlining2.js
index 7b73b14..2cbd050 100644
--- a/src/v8/test/mjsunit/regress/regress-lazy-deopt-inlining2.js
+++ b/src/v8/test/mjsunit/regress/regress-lazy-deopt-inlining2.js
@@ -7,10 +7,12 @@
 "use strict";
 function f1(d) {
   return 1 + f2(1, f3(d), d);
+};
+%PrepareFunctionForOptimization(f1);
+function f2(v0, v1, v2) {
+  return v1;
 }
 
-function f2(v0, v1, v2) { return v1; }
-
 function f3(d) {
   if (d) %DeoptimizeFunction(f1);
   return 2;
diff --git a/src/v8/test/mjsunit/regress/regress-load-elements.js b/src/v8/test/mjsunit/regress/regress-load-elements.js
index 68cdc8e..e1aebfc 100644
--- a/src/v8/test/mjsunit/regress/regress-load-elements.js
+++ b/src/v8/test/mjsunit/regress/regress-load-elements.js
@@ -27,13 +27,13 @@
 
 // Flags: --allow-natives-syntax
 
-function bad_func(o,a) {
+function bad_func(o, a) {
   for (var i = 0; i < 1; ++i) {
     o.prop = 0;
     var x = a[0];
   }
-}
-
+};
+%PrepareFunctionForOptimization(bad_func);
 o = new Object();
 a = {};
 a[0] = 1;
diff --git a/src/v8/test/mjsunit/regress/regress-load-field-by-index.js b/src/v8/test/mjsunit/regress/regress-load-field-by-index.js
index c572c1e..2c4cff3 100644
--- a/src/v8/test/mjsunit/regress/regress-load-field-by-index.js
+++ b/src/v8/test/mjsunit/regress/regress-load-field-by-index.js
@@ -14,6 +14,7 @@
   return result;
 }
 
+%PrepareFunctionForOptimization(f);
 f(o);
 f(o);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-loop-var-assign-without-block-scope.js b/src/v8/test/mjsunit/regress/regress-loop-var-assign-without-block-scope.js
new file mode 100644
index 0000000..6698e40
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-loop-var-assign-without-block-scope.js
@@ -0,0 +1,15 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+function f() {
+  // Loop with a body that's not wrapped in a block.
+  for (i = 0; i < 2; i++)
+    var x = i, // var x that's assigned on each iteration
+        y = y||(()=>x), // single arrow function that returns x
+        z0 = (%PrepareFunctionForOptimization(y)), // prepare function for optimization
+        z = (%OptimizeFunctionOnNextCall(y), y()); // optimize y on first iteration
+  return y()
+};
+assertEquals(1, f())
diff --git a/src/v8/test/mjsunit/regress/regress-map-invalidation-2.js b/src/v8/test/mjsunit/regress/regress-map-invalidation-2.js
index ece96b3..769e82b 100644
--- a/src/v8/test/mjsunit/regress/regress-map-invalidation-2.js
+++ b/src/v8/test/mjsunit/regress/regress-map-invalidation-2.js
@@ -45,6 +45,7 @@
 }
 
 var fun = g();
+%PrepareFunctionForOptimization(fun);
 fun(false, c);
 fun(false, c);
 fun(false, c);
diff --git a/src/v8/test/mjsunit/regress/regress-mul-canoverflow.js b/src/v8/test/mjsunit/regress/regress-mul-canoverflow.js
index e3e21ca..02b1622 100644
--- a/src/v8/test/mjsunit/regress/regress-mul-canoverflow.js
+++ b/src/v8/test/mjsunit/regress/regress-mul-canoverflow.js
@@ -28,11 +28,14 @@
 // Flags: --allow-natives-syntax
 
 function boom(a) {
-  return ((a | 0) * (a | 0)) | 0;
-}
+  return (a | 0) * (a | 0) | 0;
+};
+%PrepareFunctionForOptimization(boom);
 function boom_unoptimized(a) {
-  try {} catch(_) {}
-  return ((a | 0) * (a | 0)) | 0;
+  try {
+  } catch (_) {
+  }
+  return (a | 0) * (a | 0) | 0;
 }
 
 boom(1, 1);
@@ -41,5 +44,5 @@
 %OptimizeFunctionOnNextCall(boom);
 var big_int = 0x5F00000F;
 var expected = boom_unoptimized(big_int);
-var actual = boom(big_int)
+var actual = boom(big_int);
 assertEquals(expected, actual);
diff --git a/src/v8/test/mjsunit/regress/regress-mul-canoverflowb.js b/src/v8/test/mjsunit/regress/regress-mul-canoverflowb.js
index 4203ac4..f5db0cd 100644
--- a/src/v8/test/mjsunit/regress/regress-mul-canoverflowb.js
+++ b/src/v8/test/mjsunit/regress/regress-mul-canoverflowb.js
@@ -28,11 +28,12 @@
 // Flags: --allow-natives-syntax
 
 function boom(a) {
-  return ((a | 0) * (a | 0)) | 0;
-}
+  return (a | 0) * (a | 0) | 0;
+};
+%PrepareFunctionForOptimization(boom);
 %NeverOptimizeFunction(boom_unoptimized);
 function boom_unoptimized(a) {
-  return ((a | 0) * (a | 0)) | 0;
+  return (a | 0) * (a | 0) | 0;
 }
 
 boom(1, 1);
@@ -41,5 +42,5 @@
 %OptimizeFunctionOnNextCall(boom);
 var big_int = 0x5F00000F;
 var expected = boom_unoptimized(big_int);
-var actual = boom(big_int)
+var actual = boom(big_int);
 assertEquals(expected, actual);
diff --git a/src/v8/test/mjsunit/regress/regress-no-dummy-use-for-arguments-object.js b/src/v8/test/mjsunit/regress/regress-no-dummy-use-for-arguments-object.js
index 658d776..3b3b4c1 100644
--- a/src/v8/test/mjsunit/regress/regress-no-dummy-use-for-arguments-object.js
+++ b/src/v8/test/mjsunit/regress/regress-no-dummy-use-for-arguments-object.js
@@ -13,8 +13,8 @@
 function f() {
   global.dummy = this;
   g({});
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-ntl.js b/src/v8/test/mjsunit/regress/regress-ntl.js
index 993599e..7cba114 100644
--- a/src/v8/test/mjsunit/regress/regress-ntl.js
+++ b/src/v8/test/mjsunit/regress/regress-ntl.js
@@ -20,6 +20,7 @@
 }
 
 var f = mod1();
+%PrepareFunctionForOptimization(f);
 assertThrows(f);
 %OptimizeFunctionOnNextCall(f);
 assertThrows(f);
@@ -36,6 +37,7 @@
   }
 }
 
+%PrepareFunctionForOptimization(bug2);
 assertThrows(bug2);
 %OptimizeFunctionOnNextCall(bug2);
 assertThrows(bug2);
diff --git a/src/v8/test/mjsunit/regress/regress-omit-checks.js b/src/v8/test/mjsunit/regress/regress-omit-checks.js
index e5d5074..cd60aac 100644
--- a/src/v8/test/mjsunit/regress/regress-omit-checks.js
+++ b/src/v8/test/mjsunit/regress/regress-omit-checks.js
@@ -27,11 +27,11 @@
 
 // Flags: --allow-natives-syntax
 
-var a = {x:1};
-var a_deprecate = {x:1};
+var a = {x: 1};
+var a_deprecate = {x: 1};
 a_deprecate.x = 1.5;
 function create() {
-  return {__proto__:a, y:1};
+  return {__proto__: a, y: 1};
 }
 var b1 = create();
 var b2 = create();
@@ -41,15 +41,19 @@
 function set(b) {
   b.x = 5;
   b.z = 10;
-}
-
+};
+%PrepareFunctionForOptimization(set);
 set(b1);
 set(b2);
 %OptimizeFunctionOnNextCall(set);
 set(b3);
 var called = false;
 a.x = 1.5;
-Object.defineProperty(a, "z", {set:function(v) { called = true; }});
+Object.defineProperty(a, 'z', {
+  set: function(v) {
+    called = true;
+  }
+});
 set(b4);
 assertTrue(called);
 assertEquals(undefined, b4.z);
diff --git a/src/v8/test/mjsunit/regress/regress-opt-typeof-null.js b/src/v8/test/mjsunit/regress/regress-opt-typeof-null.js
index e4721a1..250e03e 100644
--- a/src/v8/test/mjsunit/regress/regress-opt-typeof-null.js
+++ b/src/v8/test/mjsunit/regress/regress-opt-typeof-null.js
@@ -7,6 +7,7 @@
 function f() {
   return typeof null === "object";
 };
-
+%PrepareFunctionForOptimization(f);
+;
 %OptimizeFunctionOnNextCall(f);
 assertTrue(f());
diff --git a/src/v8/test/mjsunit/regress/regress-osr-context.js b/src/v8/test/mjsunit/regress/regress-osr-context.js
index a739541..7df16bb 100644
--- a/src/v8/test/mjsunit/regress/regress-osr-context.js
+++ b/src/v8/test/mjsunit/regress/regress-osr-context.js
@@ -16,5 +16,6 @@
     }
     return a;
   }
+  %PrepareFunctionForOptimization(f);
   assertEquals(18, f());
 })();
diff --git a/src/v8/test/mjsunit/regress/regress-param-local-type.js b/src/v8/test/mjsunit/regress/regress-param-local-type.js
index 0eaca50..99f2b3f 100644
--- a/src/v8/test/mjsunit/regress/regress-param-local-type.js
+++ b/src/v8/test/mjsunit/regress/regress-param-local-type.js
@@ -37,6 +37,7 @@
   n = i + a;
 }
 
+%PrepareFunctionForOptimization(f);
 f(1);
 f(1);
 %OptimizeFunctionOnNextCall(f);
@@ -51,6 +52,7 @@
   n = i + this;
 }
 
+%PrepareFunctionForOptimization(g);
 g.call(1);
 g.call(1);
 %OptimizeFunctionOnNextCall(g);
diff --git a/src/v8/test/mjsunit/regress/regress-parseint.js b/src/v8/test/mjsunit/regress/regress-parseint.js
index 05501f3..a500cc6 100644
--- a/src/v8/test/mjsunit/regress/regress-parseint.js
+++ b/src/v8/test/mjsunit/regress/regress-parseint.js
@@ -6,12 +6,12 @@
 
 function f(string, radix) {
   // Use a phi to force radix into heap number representation.
-  radix = (radix == 0) ? radix : (radix >> 0);
+  radix = radix == 0 ? radix : radix >> 0;
   if (radix != 2) return NaN;
   return %StringParseInt(string, radix);
-}
-
-assertEquals(2, (-4294967294) >> 0);
+};
+%PrepareFunctionForOptimization(f);
+assertEquals(2, -4294967294 >> 0);
 assertEquals(3, f("11", -4294967294));
 assertEquals(NaN, f("11", -2147483650));
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-phi-truncation.js b/src/v8/test/mjsunit/regress/regress-phi-truncation.js
index 940efe3..09db57f 100644
--- a/src/v8/test/mjsunit/regress/regress-phi-truncation.js
+++ b/src/v8/test/mjsunit/regress/regress-phi-truncation.js
@@ -28,6 +28,7 @@
 // Flags: --allow-natives-syntax
 
 function test(fun, expectation) {
+  %PrepareFunctionForOptimization(fun);
   assertEquals(1, fun(1));
   %OptimizeFunctionOnNextCall(fun);
   assertEquals(expectation, fun(0));
diff --git a/src/v8/test/mjsunit/regress/regress-polymorphic-load.js b/src/v8/test/mjsunit/regress/regress-polymorphic-load.js
index 2545e85..a6aa746 100644
--- a/src/v8/test/mjsunit/regress/regress-polymorphic-load.js
+++ b/src/v8/test/mjsunit/regress/regress-polymorphic-load.js
@@ -29,10 +29,10 @@
 
 function f(o) {
   return o.x;
-}
-
-var o1 = {x:1};
-var o2 = {__proto__: {x:2}};
+};
+%PrepareFunctionForOptimization(f);
+var o1 = {x: 1};
+var o2 = {__proto__: {x: 2}};
 
 f(o2);
 f(o2);
diff --git a/src/v8/test/mjsunit/regress/regress-polymorphic-store.js b/src/v8/test/mjsunit/regress/regress-polymorphic-store.js
index 4723a7f..bab5eb0 100644
--- a/src/v8/test/mjsunit/regress/regress-polymorphic-store.js
+++ b/src/v8/test/mjsunit/regress/regress-polymorphic-store.js
@@ -28,7 +28,9 @@
 // Flags: --allow-natives-syntax
 
 var o1 = {};
-o1.f1 = function() { return 10; };
+o1.f1 = function() {
+  return 10;
+};
 o1.x = 5;
 o1.y = 2;
 var o2 = {};
@@ -37,8 +39,8 @@
 
 function store(o, v) {
   o.y = v;
-}
-
+};
+%PrepareFunctionForOptimization(store);
 store(o2, 0);
 store(o1, 0);
 store(o2, 0);
diff --git a/src/v8/test/mjsunit/regress/regress-preparse-inner-arrow-duplicate-parameter.js b/src/v8/test/mjsunit/regress/regress-preparse-inner-arrow-duplicate-parameter.js
new file mode 100644
index 0000000..cff5fcc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-preparse-inner-arrow-duplicate-parameter.js
@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("()=>{ (x,x)=>1 }", SyntaxError)
diff --git a/src/v8/test/mjsunit/regress/regress-set-flags-stress-compact.js b/src/v8/test/mjsunit/regress/regress-set-flags-stress-compact.js
index 5bc59a7..f861486 100644
--- a/src/v8/test/mjsunit/regress/regress-set-flags-stress-compact.js
+++ b/src/v8/test/mjsunit/regress/regress-set-flags-stress-compact.js
@@ -2,9 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax
-
-%SetFlags("--gc-interval=164 --stress-compaction");
+// Flags: --allow-natives-syntax --gc-interval=164 --stress-compaction
 
 var a = [];
 for (var i = 0; i < 10000; i++) { a[i * 100] = 0; }
diff --git a/src/v8/test/mjsunit/regress/regress-sloppy-block-function-hoisting-dynamic.js b/src/v8/test/mjsunit/regress/regress-sloppy-block-function-hoisting-dynamic.js
new file mode 100644
index 0000000..59758ed
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-sloppy-block-function-hoisting-dynamic.js
@@ -0,0 +1,6 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+with({}) { eval("{function f(){f}}") };
+f()
diff --git a/src/v8/test/mjsunit/regress/regress-smi-math-floor-round.js b/src/v8/test/mjsunit/regress/regress-smi-math-floor-round.js
index 7c033a3..841594b 100644
--- a/src/v8/test/mjsunit/regress/regress-smi-math-floor-round.js
+++ b/src/v8/test/mjsunit/regress/regress-smi-math-floor-round.js
@@ -30,18 +30,18 @@
 
 function f(o) {
   return Math.floor(o.x_smi) + 1;
-}
-
-assertEquals(2, f({x_smi:1}));
-assertEquals(2, f({x_smi:1}));
+};
+%PrepareFunctionForOptimization(f);
+assertEquals(2, f({x_smi: 1}));
+assertEquals(2, f({x_smi: 1}));
 %OptimizeFunctionOnNextCall(f);
-assertEquals(2, f({x_smi:1}));
+assertEquals(2, f({x_smi: 1}));
 
 function f2(o) {
   return Math.floor(o.x_tagged) + 1;
-}
-
-var o = {x_tagged:{}};
+};
+%PrepareFunctionForOptimization(f2);
+var o = {x_tagged: {}};
 o.x_tagged = 1.4;
 assertEquals(2, f2(o));
 assertEquals(2, f2(o));
@@ -50,17 +50,17 @@
 
 function f3(o) {
   return Math.round(o.x_smi) + 1;
-}
-
-assertEquals(2, f3({x_smi:1}));
-assertEquals(2, f3({x_smi:1}));
+};
+%PrepareFunctionForOptimization(f3);
+assertEquals(2, f3({x_smi: 1}));
+assertEquals(2, f3({x_smi: 1}));
 %OptimizeFunctionOnNextCall(f3);
-assertEquals(2, f3({x_smi:1}));
+assertEquals(2, f3({x_smi: 1}));
 
 function f4(o) {
   return Math.round(o.x_tagged) + 1;
-}
-
+};
+%PrepareFunctionForOptimization(f4);
 assertEquals(2, f4(o));
 assertEquals(2, f4(o));
 %OptimizeFunctionOnNextCall(f4);
diff --git a/src/v8/test/mjsunit/regress/regress-sqrt.js b/src/v8/test/mjsunit/regress/regress-sqrt.js
index f2a7e55..2e5b454 100644
--- a/src/v8/test/mjsunit/regress/regress-sqrt.js
+++ b/src/v8/test/mjsunit/regress/regress-sqrt.js
@@ -32,8 +32,8 @@
 
 function f(x) {
   return Math.sqrt(x);
-}
-
+};
+%PrepareFunctionForOptimization(f);
 var x = 7.0506280066499245e-233;
 
 var a = f(x);
diff --git a/src/v8/test/mjsunit/regress/regress-store-heapobject.js b/src/v8/test/mjsunit/regress/regress-store-heapobject.js
index 9f2a1b8..f4e34c8 100644
--- a/src/v8/test/mjsunit/regress/regress-store-heapobject.js
+++ b/src/v8/test/mjsunit/regress/regress-store-heapobject.js
@@ -19,8 +19,8 @@
     store(o, 1);
   }
   return o;
-}
-
+};
+%PrepareFunctionForOptimization(f);
 f(false);
 f(false);
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-store-transition-dict.js b/src/v8/test/mjsunit/regress/regress-store-transition-dict.js
new file mode 100644
index 0000000..8199a1d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-store-transition-dict.js
@@ -0,0 +1,84 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+  function SetX(o, v) {
+    o.x = v;
+  }
+
+  function SetY(o, v) {
+    o.y = v;
+  }
+
+  var p = {};
+
+  function Create() {
+    var o = {__proto__:p, b:1, a:2};
+    delete o.b;
+    assertFalse(%HasFastProperties(o));
+    return o;
+  }
+
+  for (var i = 0; i < 10; i++) {
+    var o = Create();
+    SetX(o, 13);
+    SetY(o, 13);
+  }
+
+  Object.defineProperty(p, "x", {value:42, configurable: true, writable: false});
+
+  for (var i = 0; i < 10; i++) {
+    var o = Create();
+    SetY(o, 13);
+  }
+
+  var o = Create();
+  assertEquals(42, o.x);
+  SetX(o, 13);
+  assertEquals(42, o.x);
+})();
+
+
+(function() {
+  var p1 = {a:10};
+  Object.defineProperty(p1, "x", {value:42, configurable: true, writable: false});
+
+  var p2 = {__proto__: p1, x:153};
+  for (var i = 0; i < 2000; i++) {
+    p1["p" + i] = 0;
+    p2["p" + i] = 0;
+  }
+  assertFalse(%HasFastProperties(p1));
+  assertFalse(%HasFastProperties(p2));
+
+  function GetX(o) {
+    return o.x;
+  }
+  function SetX(o, v) {
+    o.x = v;
+  }
+
+  function Create() {
+    var o = {__proto__:p2, b:1, a:2};
+    return o;
+  }
+
+  for (var i = 0; i < 10; i++) {
+    var o = Create();
+    assertEquals(153, GetX(o));
+    SetX(o, 13);
+    assertEquals(13, GetX(o));
+  }
+
+  delete p2.x;
+  assertFalse(%HasFastProperties(p1));
+  assertFalse(%HasFastProperties(p2));
+
+  var o = Create();
+  assertEquals(42, GetX(o));
+  SetX(o, 13);
+  assertEquals(42, GetX(o));
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-store-uncacheable.js b/src/v8/test/mjsunit/regress/regress-store-uncacheable.js
index 4baedba..8a31f2c 100644
--- a/src/v8/test/mjsunit/regress/regress-store-uncacheable.js
+++ b/src/v8/test/mjsunit/regress/regress-store-uncacheable.js
@@ -32,6 +32,7 @@
   o["<abc>"] = 123;
 }
 
+%PrepareFunctionForOptimization(f);
 f();
 f();
 f();
diff --git a/src/v8/test/mjsunit/regress/regress-string-from-char-code-tonumber.js b/src/v8/test/mjsunit/regress/regress-string-from-char-code-tonumber.js
index a02a277..0bc180a 100644
--- a/src/v8/test/mjsunit/regress/regress-string-from-char-code-tonumber.js
+++ b/src/v8/test/mjsunit/regress/regress-string-from-char-code-tonumber.js
@@ -4,7 +4,11 @@
 
 // Flags: --allow-natives-syntax
 
-var thrower = { [Symbol.toPrimitive]: function() { FAIL } };
+var thrower = {
+  [Symbol.toPrimitive]: function() {
+    FAIL;
+  }
+};
 
 function testTrace(func) {
   try {
@@ -17,8 +21,10 @@
 
 testTrace(String.fromCharCode);
 
-function foo(x) { return String.fromCharCode(x); }
-
+function foo(x) {
+  return String.fromCharCode(x);
+};
+%PrepareFunctionForOptimization(foo);
 foo(1);
 foo(2);
 testTrace(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-stringAt-boundsCheck.js b/src/v8/test/mjsunit/regress/regress-stringAt-boundsCheck.js
new file mode 100644
index 0000000..c4e3648
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-stringAt-boundsCheck.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --opt --allow-natives-syntax
+
+(() => {
+  function f(u) {
+    for (var j = 0; j < 20; ++j) {
+      print('' + u.codePointAt());
+    }
+  };
+  %PrepareFunctionForOptimization(f);
+  f("test");
+  f("foo");
+  %OptimizeFunctionOnNextCall(f);
+  f("");
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-sync-optimized-lists.js b/src/v8/test/mjsunit/regress/regress-sync-optimized-lists.js
index 9297c2d..2e2cfd4 100644
--- a/src/v8/test/mjsunit/regress/regress-sync-optimized-lists.js
+++ b/src/v8/test/mjsunit/regress/regress-sync-optimized-lists.js
@@ -19,8 +19,8 @@
     return x;
   }
 }
-
 var f1 = get_closure();
+%PrepareFunctionForOptimization(f1);
 f1(new Ctor(), false);
 f1(new Ctor(), false);
 
@@ -28,6 +28,7 @@
 
 // Kick off concurrent recompilation and OSR.
 var o = new Ctor();
+%PrepareFunctionForOptimization(f1);
 f1(o, true);
 
 // Flush the optimizing compiler's queue.
@@ -37,4 +38,5 @@
 o.c = 2.2;
 
 var f2 = get_closure();
+%PrepareFunctionForOptimization(f2);
 f2(new Ctor(), true);
diff --git a/src/v8/test/mjsunit/regress/regress-trap-allocation-memento.js b/src/v8/test/mjsunit/regress/regress-trap-allocation-memento.js
index e31fb88..185f908 100644
--- a/src/v8/test/mjsunit/regress/regress-trap-allocation-memento.js
+++ b/src/v8/test/mjsunit/regress/regress-trap-allocation-memento.js
@@ -27,6 +27,10 @@
   function make2() { return new Array(); }
   function make3() { return new Array(); }
   function foo(a, i) { a[0] = i; }
+  %EnsureFeedbackVectorForFunction(make1);
+  %EnsureFeedbackVectorForFunction(make2);
+  %EnsureFeedbackVectorForFunction(make3);
+  %EnsureFeedbackVectorForFunction(foo);
 
   function run_test(maker_function) {
     var one = maker_function();
@@ -37,6 +41,7 @@
     var two = maker_function();
     assertKind(elements_kind.fast_double, two);
   }
+  %EnsureFeedbackVectorForFunction(run_test);
 
   // Initialize the KeyedStoreIC in foo; the actual operation will be done
   // in the runtime.
diff --git a/src/v8/test/mjsunit/regress/regress-typedarray-length.js b/src/v8/test/mjsunit/regress/regress-typedarray-length.js
index 0dde61f..22ede7c 100644
--- a/src/v8/test/mjsunit/regress/regress-typedarray-length.js
+++ b/src/v8/test/mjsunit/regress/regress-typedarray-length.js
@@ -9,8 +9,8 @@
 
 function get(a) {
   return a.length;
-}
-
+};
+%PrepareFunctionForOptimization(get);
 assertEquals(undefined, get(a));
 assertEquals(undefined, get(a));
 assertEquals(undefined, get(a));
@@ -19,8 +19,9 @@
 
 get = function(a) {
   return a.byteLength;
-}
-
+};
+;
+%PrepareFunctionForOptimization(get);
 assertEquals(undefined, get(a));
 assertEquals(undefined, get(a));
 assertEquals(undefined, get(a));
@@ -29,8 +30,9 @@
 
 get = function(a) {
   return a.byteOffset;
-}
-
+};
+;
+%PrepareFunctionForOptimization(get);
 assertEquals(undefined, get(a));
 assertEquals(undefined, get(a));
 assertEquals(undefined, get(a));
@@ -38,74 +40,82 @@
 assertEquals(undefined, get(a));
 
 (function() {
-  "use strict";
+"use strict";
 
-  class MyTypedArray extends Int32Array {
-    get length() {
-      return "length";
-    }
+class MyTypedArray extends Int32Array {
+  get length() {
+    return "length";
   }
+}
 
-  a = new MyTypedArray();
+a = new MyTypedArray();
 
-  get = function(a) {
-    return a.length;
-  }
+get = function(a) {
+  return a.length;
+};
+;
+%PrepareFunctionForOptimization(get);
+assertEquals("length", get(a));
+assertEquals("length", get(a));
+assertEquals("length", get(a));
+%OptimizeFunctionOnNextCall(get);
+assertEquals("length", get(a));
 
-  assertEquals("length", get(a));
-  assertEquals("length", get(a));
-  assertEquals("length", get(a));
-  %OptimizeFunctionOnNextCall(get);
-  assertEquals("length", get(a));
+a.__proto__ = null;
 
-  a.__proto__ = null;
-
-  get = function(a) {
-    return a.length;
-  }
-
-  assertEquals(undefined, get(a));
-  assertEquals(undefined, get(a));
-  assertEquals(undefined, get(a));
-  %OptimizeFunctionOnNextCall(get);
-  assertEquals(undefined, get(a));
+get = function(a) {
+  return a.length;
+};
+;
+%PrepareFunctionForOptimization(get);
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
+%OptimizeFunctionOnNextCall(get);
+assertEquals(undefined, get(a));
 })();
 
 (function() {
-  "use strict";
+"use strict";
 
-  class MyTypedArray extends Int32Array {
-    constructor(length) {
-      super(length);
-    }
+class MyTypedArray extends Int32Array {
+  constructor(length) {
+    super(length);
   }
+}
 
-  a = new MyTypedArray(1024);
+a = new MyTypedArray(1024);
 
-  get = function(a) {
-    return a.length;
-  }
-
-  assertEquals(1024, get(a));
-  assertEquals(1024, get(a));
-  assertEquals(1024, get(a));
-  %OptimizeFunctionOnNextCall(get);
-  assertEquals(1024, get(a));
+get = function(a) {
+  return a.length;
+};
+;
+%PrepareFunctionForOptimization(get);
+assertEquals(1024, get(a));
+assertEquals(1024, get(a));
+assertEquals(1024, get(a));
+%OptimizeFunctionOnNextCall(get);
+assertEquals(1024, get(a));
 })();
 
 (function() {
-  "use strict";
-  var a = new Uint8Array(4);
-  Object.defineProperty(a, "length", {get: function() { return "blah"; }});
-  get = function(a) {
-    return a.length;
+"use strict";
+var a = new Uint8Array(4);
+Object.defineProperty(a, 'length', {
+  get: function() {
+    return 'blah';
   }
-
-  assertEquals("blah", get(a));
-  assertEquals("blah", get(a));
-  assertEquals("blah", get(a));
-  %OptimizeFunctionOnNextCall(get);
-  assertEquals("blah", get(a));
+});
+get = function(a) {
+  return a.length;
+};
+;
+%PrepareFunctionForOptimization(get);
+assertEquals("blah", get(a));
+assertEquals("blah", get(a));
+assertEquals("blah", get(a));
+%OptimizeFunctionOnNextCall(get);
+assertEquals("blah", get(a));
 })();
 
 // Ensure we can delete length, byteOffset, byteLength.
@@ -120,8 +130,9 @@
 
 get = function(a) {
   return a.length;
-}
-
+};
+;
+%PrepareFunctionForOptimization(get);
 assertEquals(undefined, get(a));
 assertEquals(undefined, get(a));
 assertEquals(undefined, get(a));
@@ -130,8 +141,9 @@
 
 get = function(a) {
   return a.byteLength;
-}
-
+};
+;
+%PrepareFunctionForOptimization(get);
 assertEquals(undefined, get(a));
 assertEquals(undefined, get(a));
 assertEquals(undefined, get(a));
@@ -140,8 +152,9 @@
 
 get = function(a) {
   return a.byteOffset;
-}
-
+};
+;
+%PrepareFunctionForOptimization(get);
 assertEquals(undefined, get(a));
 assertEquals(undefined, get(a));
 assertEquals(undefined, get(a));
diff --git a/src/v8/test/mjsunit/regress/regress-undefined-nan.js b/src/v8/test/mjsunit/regress/regress-undefined-nan.js
index 0e9b3d3..3d14126 100644
--- a/src/v8/test/mjsunit/regress/regress-undefined-nan.js
+++ b/src/v8/test/mjsunit/regress/regress-undefined-nan.js
@@ -6,18 +6,20 @@
 
 function loader(dst, src, i) {
   dst[i] = src[i];
-}
-
+};
+%PrepareFunctionForOptimization(loader);
 var ab = new ArrayBuffer(8);
 var i_view = new Int32Array(ab);
-i_view[0] = %GetHoleNaNUpper()
+i_view[0] = %GetHoleNaNUpper();
 i_view[1] = %GetHoleNaNLower();
 var f_view = new Float64Array(ab);
 
 var fixed_double_elements = new Float64Array(1);
 
-function opt_store() { fixed_double_elements[0] = f_view[0]; }
-
+function opt_store() {
+  fixed_double_elements[0] = f_view[0];
+};
+%PrepareFunctionForOptimization(opt_store);
 opt_store();
 opt_store();
 %OptimizeFunctionOnNextCall(opt_store);
diff --git a/src/v8/test/mjsunit/regress/regress-undefined-nan3.js b/src/v8/test/mjsunit/regress/regress-undefined-nan3.js
index 5a0bc38..400434c 100644
--- a/src/v8/test/mjsunit/regress/regress-undefined-nan3.js
+++ b/src/v8/test/mjsunit/regress/regress-undefined-nan3.js
@@ -6,15 +6,17 @@
 
 var ab = new ArrayBuffer(8);
 var i_view = new Int32Array(ab);
-i_view[0] = %GetHoleNaNUpper()
+i_view[0] = %GetHoleNaNUpper();
 i_view[1] = %GetHoleNaNLower();
 var f_view = new Float64Array(ab);
 
 var fixed_double_elements = new Float64Array(1);
 fixed_double_elements[0] = f_view[0];
 
-function A(src) { this.x = src[0]; }
-
+function A(src) {
+  this.x = src[0];
+};
+%PrepareFunctionForOptimization(A);
 new A(fixed_double_elements);
 new A(fixed_double_elements);
 
@@ -22,8 +24,10 @@
 
 var obj = new A(fixed_double_elements);
 
-function move_x(dst, obj) { dst[0] = obj.x; }
-
+function move_x(dst, obj) {
+  dst[0] = obj.x;
+};
+%PrepareFunctionForOptimization(move_x);
 var doubles = [0.5];
 move_x(doubles, obj);
 move_x(doubles, obj);
diff --git a/src/v8/test/mjsunit/regress/regress-undefined-store-keyed-fast-element.js b/src/v8/test/mjsunit/regress/regress-undefined-store-keyed-fast-element.js
index 9e6ec9d..b11ef17 100644
--- a/src/v8/test/mjsunit/regress/regress-undefined-store-keyed-fast-element.js
+++ b/src/v8/test/mjsunit/regress/regress-undefined-store-keyed-fast-element.js
@@ -29,8 +29,8 @@
 
 function f(v) {
   return [0.0, 0.1, 0.2, v];
-}
-
+};
+%PrepareFunctionForOptimization(f);
 assertEquals([0.0, 0.1, 0.2, NaN], f(NaN));
 assertEquals([0.0, 0.1, 0.2, NaN], f(NaN));
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-unlink-closures-on-deopt.js b/src/v8/test/mjsunit/regress/regress-unlink-closures-on-deopt.js
index b7fa2b1..2b34159 100644
--- a/src/v8/test/mjsunit/regress/regress-unlink-closures-on-deopt.js
+++ b/src/v8/test/mjsunit/regress/regress-unlink-closures-on-deopt.js
@@ -13,6 +13,8 @@
 
 let g1 = foo();
 let g2 = foo();
+%PrepareFunctionForOptimization(g1);
+%PrepareFunctionForOptimization(g2);
 
 g1({ f : 1});
 g1({ f : 2});
diff --git a/src/v8/test/mjsunit/regress/regress-v8-4153-1.js b/src/v8/test/mjsunit/regress/regress-v8-4153-1.js
new file mode 100644
index 0000000..125b4e2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-4153-1.js
@@ -0,0 +1,14 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --verify-heap
+
+// Create tiny (on-heap) instances of TypedArrays to make sure
+// that the ByteArrays are properly sized (in new space).
+var arrays = [
+  Int8Array, Uint8Array, Int16Array, Uint16Array, Int32Array, Uint32Array,
+  Float32Array, Float64Array, Uint8ClampedArray, BigInt64Array, BigUint64Array
+].map(C => {
+  new C(1)
+});
diff --git a/src/v8/test/mjsunit/regress/regress-v8-4839.js b/src/v8/test/mjsunit/regress/regress-v8-4839.js
index 120685b..fc33deb 100644
--- a/src/v8/test/mjsunit/regress/regress-v8-4839.js
+++ b/src/v8/test/mjsunit/regress/regress-v8-4839.js
@@ -4,59 +4,71 @@
 
 // Flags: --allow-natives-syntax
 
-function dummy() { }
+function dummy() {}
 
 (function InlinedFunctionTestContext() {
-  var f = function() { }
+  var f = function() {};
 
   function g() {
-   var s = "hey";
-   dummy();  // Force a deopt point.
-   if (f()) return s;
-  }
-
+    var s = 'hey';
+    dummy();  // Force a deopt point.
+    if (f()) return s;
+  };
+  %PrepareFunctionForOptimization(g);
   g();
   g();
   g();
   %OptimizeFunctionOnNextCall(g);
-  f = function() { return true; }
+  f = function() {
+    return true;
+  };
   assertEquals("hey", g());
 })();
 
 (function InlinedConstructorReturnTestContext() {
-  function c() { return 1; }
-
-  var f = function() { return !(new c());  }
-
-  function g() {
-   var s = "hey";
-   dummy();  // Force a deopt point.
-   if (f()) return s;
+  function c() {
+    return 1;
   }
 
+  var f = function() {
+    return !new c();
+  };
+
+  function g() {
+    var s = 'hey';
+    dummy();  // Force a deopt point.
+    if (f()) return s;
+  };
+  %PrepareFunctionForOptimization(g);
   g();
   g();
   g();
   %OptimizeFunctionOnNextCall(g);
-  f = function() { return true; }
+  f = function() {
+    return true;
+  };
   assertEquals("hey", g());
 })();
 
 (function InlinedConstructorNoReturnTestContext() {
-  function c() { }
+  function c() {}
 
-  var f = function() { return !(new c());  }
+  var f = function() {
+    return !new c();
+  };
 
   function g() {
-   var s = "hey";
-   dummy();  // Force a deopt point.
-   if (f()) return s;
-  }
-
+    var s = 'hey';
+    dummy();  // Force a deopt point.
+    if (f()) return s;
+  };
+  %PrepareFunctionForOptimization(g);
   g();
   g();
   g();
   %OptimizeFunctionOnNextCall(g);
-  f = function() { return true; }
+  f = function() {
+    return true;
+  };
   assertEquals("hey", g());
 })();
diff --git a/src/v8/test/mjsunit/regress/regress-v8-5254-1.js b/src/v8/test/mjsunit/regress/regress-v8-5254-1.js
index 624c85f..c0d9f33 100644
--- a/src/v8/test/mjsunit/regress/regress-v8-5254-1.js
+++ b/src/v8/test/mjsunit/regress/regress-v8-5254-1.js
@@ -4,22 +4,22 @@
 
 // Flags: --allow-natives-syntax
 
-var foo = (function() {
+var foo = function() {
   "use asm";
   var a = new Uint16Array(2);
   a[0] = 32815;
   a[1] = 32114;
 
   function foo() {
-    var x = a[0]|0;
-    var y = a[1]|0;
-    if (x < 0) x = 4294967296 + x|0;
-    if (y < 0) y = 4294967296 + y|0;
+    var x = a[0] | 0;
+    var y = a[1] | 0;
+    if (x < 0) x = 4294967296 + x | 0;
+    if (y < 0) y = 4294967296 + y | 0;
     return x >= y;
-  }
-
+  };
+  %PrepareFunctionForOptimization(foo);
   return foo;
-})();
+}();
 
 assertTrue(foo());
 assertTrue(foo());
diff --git a/src/v8/test/mjsunit/regress/regress-v8-5254-2.js b/src/v8/test/mjsunit/regress/regress-v8-5254-2.js
index f486fa8..6efde90 100644
--- a/src/v8/test/mjsunit/regress/regress-v8-5254-2.js
+++ b/src/v8/test/mjsunit/regress/regress-v8-5254-2.js
@@ -4,22 +4,22 @@
 
 // Flags: --allow-natives-syntax
 
-var foo = (function() {
+var foo = function() {
   "use asm";
   var a = new Uint8Array(2);
   a[0] = 128;
   a[1] = 127;
 
   function foo() {
-    var x = a[0]|0;
-    var y = a[1]|0;
-    if (x < 0) x = 4294967296 + x|0;
-    if (y < 0) y = 4294967296 + y|0;
+    var x = a[0] | 0;
+    var y = a[1] | 0;
+    if (x < 0) x = 4294967296 + x | 0;
+    if (y < 0) y = 4294967296 + y | 0;
     return x >= y;
-  }
-
+  };
+  %PrepareFunctionForOptimization(foo);
   return foo;
-})();
+}();
 
 assertTrue(foo());
 assertTrue(foo());
diff --git a/src/v8/test/mjsunit/regress/regress-v8-5255-1.js b/src/v8/test/mjsunit/regress/regress-v8-5255-1.js
index cd14d63..55555dc 100644
--- a/src/v8/test/mjsunit/regress/regress-v8-5255-1.js
+++ b/src/v8/test/mjsunit/regress/regress-v8-5255-1.js
@@ -6,8 +6,8 @@
 
 function foo(x) {
   return (x ? true : "7") >> 0;
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 assertEquals(1, foo(1));
 assertEquals(1, foo(1));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-v8-5255-2.js b/src/v8/test/mjsunit/regress/regress-v8-5255-2.js
index 5ae57ce..2d7d29f 100644
--- a/src/v8/test/mjsunit/regress/regress-v8-5255-2.js
+++ b/src/v8/test/mjsunit/regress/regress-v8-5255-2.js
@@ -6,8 +6,8 @@
 
 function foo(x) {
   return (x ? true : "7") << 0;
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 assertEquals(1, foo(1));
 assertEquals(1, foo(1));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-v8-5255-3.js b/src/v8/test/mjsunit/regress/regress-v8-5255-3.js
index 004d687..f37c0f5 100644
--- a/src/v8/test/mjsunit/regress/regress-v8-5255-3.js
+++ b/src/v8/test/mjsunit/regress/regress-v8-5255-3.js
@@ -6,8 +6,8 @@
 
 function foo(x) {
   return (x ? true : "7") >>> 0;
-}
-
+};
+%PrepareFunctionForOptimization(foo);
 assertEquals(1, foo(1));
 assertEquals(1, foo(1));
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-v8-5697.js b/src/v8/test/mjsunit/regress/regress-v8-5697.js
index d7c1679..9dec917 100644
--- a/src/v8/test/mjsunit/regress/regress-v8-5697.js
+++ b/src/v8/test/mjsunit/regress/regress-v8-5697.js
@@ -4,25 +4,34 @@
 
 // Flags: --allow-natives-syntax --opt
 
-function load(o) { return o.x; }
-
+function load(o) {
+  return o.x;
+};
 for (var x = 0; x < 1000; ++x) {
+  %PrepareFunctionForOptimization(load);
   load({x});
   load({x});
   %OptimizeFunctionOnNextCall(load);
-  try { load(); } catch (e) { }
+  try {
+    load();
+  } catch (e) {
+  }
 }
 
 assertOptimized(load);
 
-
-function store(o) { o.x = -1; }
-
+function store(o) {
+  o.x = -1;
+};
 for (var x = 0; x < 1000; ++x) {
+  %PrepareFunctionForOptimization(store);
   store({x});
   store({x});
   %OptimizeFunctionOnNextCall(store);
-  try { store(); } catch (e) { }
+  try {
+    store();
+  } catch (e) {
+  }
 }
 
 assertOptimized(store);
diff --git a/src/v8/test/mjsunit/regress/regress-v8-5848.js b/src/v8/test/mjsunit/regress/regress-v8-5848.js
new file mode 100644
index 0000000..9db3666
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-5848.js
@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const inlineFromParser = 50 ** 50;
+
+const i = 50;
+const fromRuntimePowOp = i ** i;
+const fromRuntimeMath = Math.pow(i, i);
+
+// inlineFromParser === fromRuntimeOp === fromRuntimeMath
+
+assertEquals(inlineFromParser, fromRuntimePowOp);
+assertEquals(inlineFromParser - fromRuntimePowOp, 0);
+
+assertEquals(inlineFromParser, fromRuntimeMath);
+assertEquals(inlineFromParser - fromRuntimeMath, 0);
diff --git a/src/v8/test/mjsunit/regress/regress-v8-6515.js b/src/v8/test/mjsunit/regress/regress-v8-6515.js
new file mode 100644
index 0000000..7d7e759
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-6515.js
@@ -0,0 +1,8 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// These patterns shouldn't generate code of excessive size.
+assertNull(/\b\B\b\B\b\B\b\B\b\B\b\B\b\B\b\B\b\B/.exec(" aa "));
+assertNull(/\b\b\b\b\b\b\b\b\b\B\B\B\B\B\B\B\B\B/.exec(" aa "));
+assertNull(/\b\B$\b\B$\b\B$\b\B$\b\B$\b\B$\b\B$/.exec(" aa "));
diff --git a/src/v8/test/mjsunit/regress/regress-v8-6906.js b/src/v8/test/mjsunit/regress/regress-v8-6906.js
index 72aa985..cb16a15 100644
--- a/src/v8/test/mjsunit/regress/regress-v8-6906.js
+++ b/src/v8/test/mjsunit/regress/regress-v8-6906.js
@@ -4,8 +4,8 @@
 
 // Flags: --allow-natives-syntax
 
-function f() {}
-
+function f() {};
+%PrepareFunctionForOptimization(f);
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/src/v8/test/mjsunit/regress/regress-v8-7682.js b/src/v8/test/mjsunit/regress/regress-v8-7682.js
new file mode 100644
index 0000000..68f9e0b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-7682.js
@@ -0,0 +1,26 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const impl = Symbol();
+class MyArrayLike {
+  constructor() {
+    this[impl] = [2, 1];
+    Object.freeze(this);
+  }
+  get 0() { return this[impl][0]; }
+  set 0(value) { this[impl][0] = value; }
+  get 1() { return this[impl][1]; }
+  set 1(value) { this[impl][1] = value; }
+  get length() { return 2; }
+}
+
+const xs = new MyArrayLike();
+Array.prototype.sort.call(xs);
+
+// Sort-order is implementation-defined as we actually hit two conditions from
+// the spec:
+//   - "xs" is sparse and IsExtensible(xs) is false (its frozen).
+//   - "xs" is sparse and the prototype has properties in the sort range.
+assertEquals(1, xs[0]);
+assertEquals(2, xs[1]);
diff --git a/src/v8/test/mjsunit/regress/regress-v8-7725.js b/src/v8/test/mjsunit/regress/regress-v8-7725.js
new file mode 100644
index 0000000..6bda4a4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-7725.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var proxy = new Proxy({}, {});
+
+Object.assign(proxy, { b: "boom", a: "ah", o: "ouch" });
+assertEquals(["b", "a", "o"], Object.getOwnPropertyNames(proxy));
+assertEquals("boom", proxy.b);
+assertEquals("ah", proxy.a);
+assertEquals("ouch", proxy.o);
diff --git a/src/v8/test/mjsunit/regress/regress-v8-7848.js b/src/v8/test/mjsunit/regress/regress-v8-7848.js
new file mode 100644
index 0000000..fa673cf
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-7848.js
@@ -0,0 +1,26 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Should never be called in this test.
+Error.prepareStackTrace = () => 299792458;
+
+{
+  const that_realm = Realm.create();
+  const result = Realm.eval(that_realm,
+      "() => { Error.prepareStackTrace = () => 42; return new Error(); }")();
+  assertEquals(42, result.stack);
+}
+{
+  const that_realm = Realm.create();
+  const result = Realm.eval(that_realm,
+      "() => { Error.prepareStackTrace = () => 42; " +
+      "class MyError extends Error {}; return new MyError(); }")();
+  assertEquals(42, result.stack);
+}
+{
+  const that_realm = Realm.create();
+  const result = Realm.eval(that_realm,
+      "() => { Error.prepareStackTrace = () => 42; return {}; }")();
+  assertFalse("stack" in result);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-v8-8070.js b/src/v8/test/mjsunit/regress/regress-v8-8070.js
new file mode 100644
index 0000000..5ce8fdd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-8070.js
@@ -0,0 +1,24 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar(iterator) {
+  for (const entry of iterator) {}
+}
+
+%NeverOptimizeFunction(bar);
+
+function foo(a) {
+  const iterator = a.values();
+  bar(iterator);
+  return iterator.next().done;
+}
+
+const a = [1, 2, 3];
+%PrepareFunctionForOptimization(foo);
+assertTrue(foo(a));
+assertTrue(foo(a));
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo(a));
diff --git a/src/v8/test/mjsunit/regress/regress-v8-8357.js b/src/v8/test/mjsunit/regress/regress-v8-8357.js
new file mode 100644
index 0000000..6f27e84
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-8357.js
@@ -0,0 +1,31 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const s = "Umbridge has been reading your mail, Harry."
+
+{
+  let monkey_called = false;
+  s.__proto__.__proto__[Symbol.replace] =
+    () => { monkey_called = true; };
+  s.replace(s);
+  assertTrue(monkey_called);
+}
+
+{
+  let monkey_called = false;
+  s.__proto__.__proto__[Symbol.search] =
+    () => { monkey_called = true; };
+  s.search(s);
+  assertTrue(monkey_called);
+}
+
+{
+  let monkey_called = false;
+  s.__proto__.__proto__[Symbol.match] =
+    () => { monkey_called = true; };
+  s.match(s);
+  assertTrue(monkey_called);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-v8-8770.js b/src/v8/test/mjsunit/regress/regress-v8-8770.js
new file mode 100644
index 0000000..9a3b442
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-8770.js
@@ -0,0 +1,10 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const re = /^.*?Y((?=X?).)*Y$/s;
+const sult = "YABCY";
+const result = re.exec(sult);
+
+assertNotNull(result);
+assertArrayEquals([sult, "C"], result);
diff --git a/src/v8/test/mjsunit/regress/regress-v8-8799.js b/src/v8/test/mjsunit/regress/regress-v8-8799.js
new file mode 100644
index 0000000..6e3eb07
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-8799.js
@@ -0,0 +1,11 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --flush-bytecode --stress-flush-bytecode
+
+// Ensure tagged template objects are cached even after bytecode flushing.
+var f = (x) => eval`a${x}b`;
+var a = f();
+gc();
+assertSame(a, f());
diff --git a/src/v8/test/mjsunit/regress/regress-v8-9106.js b/src/v8/test/mjsunit/regress/regress-v8-9106.js
new file mode 100644
index 0000000..f51c2e9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-9106.js
@@ -0,0 +1,24 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-bulk-memory
+
+// Make sure DCHECK doesn't fire when passive data segment is at the end of the
+// module.
+let bytes = new Uint8Array([
+  0,   97,  115, 109, 1,   0,   0,   0,   1,   132, 128, 128, 128, 0,   1,
+  96,  0,   0,   3,   133, 128, 128, 128, 0,   4,   0,   0,   0,   0,   5,
+  131, 128, 128, 128, 0,   1,   0,   1,   7,   187, 128, 128, 128, 0,   4,
+  12,  100, 114, 111, 112, 95,  112, 97,  115, 115, 105, 118, 101, 0,   0,
+  12,  105, 110, 105, 116, 95,  112, 97,  115, 115, 105, 118, 101, 0,   1,
+  11,  100, 114, 111, 112, 95,  97,  99,  116, 105, 118, 101, 0,   2,   11,
+  105, 110, 105, 116, 95,  97,  99,  116, 105, 118, 101, 0,   3,   12,  129,
+  128, 128, 128, 0,   2,   10,  183, 128, 128, 128, 0,   4,   133, 128, 128,
+  128, 0,   0,   252, 9,   0,   11,  140, 128, 128, 128, 0,   0,   65,  0,
+  65,  0,   65,  0,   252, 8,   0,   0,   11,  133, 128, 128, 128, 0,   0,
+  252, 9,   1,   11,  140, 128, 128, 128, 0,   0,   65,  0,   65,  0,   65,
+  0,   252, 8,   1,   0,   11,  11,  136, 128, 128, 128, 0,   2,   1,   0,
+  0,   65,  0,   11,  0
+]);
+new WebAssembly.Instance(new WebAssembly.Module(bytes));
diff --git a/src/v8/test/mjsunit/regress/regress-v8-9233.js b/src/v8/test/mjsunit/regress/regress-v8-9233.js
new file mode 100644
index 0000000..ef3240b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-9233.js
@@ -0,0 +1,24 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+let o1 = { x: 999 };
+o1.y = 999;
+
+// o2 will share map with o1 in its initial state
+var o2 = { x: 1 };
+
+function f() {
+  return o2.x;
+};
+%PrepareFunctionForOptimization(f);
+assertEquals(1, f());
+assertEquals(1, f());
+%OptimizeFunctionOnNextCall(f);
+assertEquals(1, f());
+
+delete o2.x;
+o2.x = 2;
+assertEquals(2, f());
diff --git a/src/v8/test/mjsunit/regress/regress-v8-9243.js b/src/v8/test/mjsunit/regress/regress-v8-9243.js
new file mode 100644
index 0000000..23ca935
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-9243.js
@@ -0,0 +1,26 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// The special IterResultObject map that builtins use should be the same
+// as the one produced by the `{value, done}` object literal.
+const user = {value:undefined, done:true};
+
+// Array iterator.
+const arrayResult = (new Array())[Symbol.iterator]().next();
+assertTrue(%HaveSameMap(user, arrayResult));
+
+// Map iterator.
+const mapResult = (new Map())[Symbol.iterator]().next();
+assertTrue(%HaveSameMap(user, mapResult));
+
+// Set iterator.
+const setResult = (new Set())[Symbol.iterator]().next();
+assertTrue(%HaveSameMap(user, setResult));
+
+// Generator.
+function* generator() {}
+const generatorResult = generator().next();
+assertTrue(%HaveSameMap(user, setResult));
diff --git a/src/v8/test/mjsunit/regress/regress-v8-9267-1.js b/src/v8/test/mjsunit/regress/regress-v8-9267-1.js
new file mode 100644
index 0000000..fb3abea
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-9267-1.js
@@ -0,0 +1,23 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar(a) {
+  return Object.defineProperty(a, 'x', {get() { return 1; }});
+}
+
+function foo() {
+  return Array(1);
+}
+
+%NeverOptimizeFunction(bar);
+%PrepareFunctionForOptimization(foo);
+const o = foo();  // Keep a reference so the GC doesn't kill the map.
+bar(o);
+const a = bar(foo());
+%OptimizeFunctionOnNextCall(foo);
+const b = bar(foo());
+
+assertTrue(%HaveSameMap(a, b));
diff --git a/src/v8/test/mjsunit/regress/regress-v8-9267-2.js b/src/v8/test/mjsunit/regress/regress-v8-9267-2.js
new file mode 100644
index 0000000..cfe1b50
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-9267-2.js
@@ -0,0 +1,23 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar(a) {
+  return Object.defineProperty(a, 'x', {get() { return 1; }});
+}
+
+function foo() {
+  return {};
+}
+
+%NeverOptimizeFunction(bar);
+%PrepareFunctionForOptimization(foo);
+const o = foo();  // Keep a reference so the GC doesn't kill the map.
+bar(o);
+const a = bar(foo());
+%OptimizeFunctionOnNextCall(foo);
+const b = bar(foo());
+
+assertTrue(%HaveSameMap(a, b));
diff --git a/src/v8/test/mjsunit/regress/regress-v8-9394-2.js b/src/v8/test/mjsunit/regress/regress-v8-9394-2.js
new file mode 100644
index 0000000..8034eb9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-9394-2.js
@@ -0,0 +1,23 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --enable-lazy-source-positions --stress-lazy-source-positions
+
+function test() {
+  function f() {
+    with ({}) {
+      // This is a non-assigning shadowing access to value. If both f and test
+      // are fully parsed or both are preparsed, then this is resolved during
+      // scope analysis to the outer value, and the outer value knows it can be
+      // shadowed. If test is fully parsed and f is preparsed, value here
+      // doesn't resolve to anything during partial analysis, and the outer
+      // value does not know it can be shadowed.
+      return value;
+    }
+  }
+  var value = 2;
+  var status = f();
+  return value;
+}
+test();
diff --git a/src/v8/test/mjsunit/regress/regress-v8-9394.js b/src/v8/test/mjsunit/regress/regress-v8-9394.js
new file mode 100644
index 0000000..e59f39a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-9394.js
@@ -0,0 +1,83 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+(function testMaybeAssignedWithShadowing() {
+
+  function foo() {
+    let a = 0;
+    let g;
+
+    with ({}) {
+      g = function g() {
+        // Increment a, should set it maybe_assigned but doesn't in the bug.
+        ++a;
+      }
+      // Shadowing the outer 'a' with a dynamic one.
+      a;
+    }
+
+    return function () {
+      // The access to a would be context specialized (to 2 since it's after the
+      // second call) if maybe_assigned were incorrectly not set.
+      g(a);
+      return a;
+    }
+  };
+
+  f = foo();
+  %PrepareFunctionForOptimization(f);
+  assertEquals(f(), 1);
+  assertEquals(f(), 2);
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(f(), 3);
+
+})();
+
+// Same test as above, just with more shadowing (including dynamic->dynamic
+// shadowing) and skipping over scopes with shadows.
+(function testMaybeAssignedWithDeeplyNestedShadowing() {
+
+  function foo() {
+    let a = 0;
+    let g;
+
+    // Increment a, should set it maybe_assigned but doesn't in the bug.
+    with ({}) {
+      with ({}) {
+        with ({}) {
+          with ({}) {
+            with ({}) {
+              g = function g() { ++a; }
+              // Shadow the second dynamic 'a'.
+              a;
+            }
+            // Shadowing the first dynamic 'a'.
+            a;
+          }
+          // Skip shadowing here
+        }
+        // Skip shadowing here
+      }
+      // Shadowing the outer 'a' with a dynamic one.
+      a;
+    }
+
+    return function () {
+      // The access to a would be context specialized (to 2 since it's after the
+      // second call) if maybe_assigned were incorrectly not set.
+      g(a);
+      return a;
+    }
+  };
+
+  f = foo();
+  %PrepareFunctionForOptimization(f);
+  assertEquals(f(), 1);
+  assertEquals(f(), 2);
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(f(), 3);
+
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-v8-9460.js b/src/v8/test/mjsunit/regress/regress-v8-9460.js
new file mode 100644
index 0000000..b9db175
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-9460.js
@@ -0,0 +1,20 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var arr = [0, 1];
+
+assertThrows(
+  () => Object.defineProperty(arr, 'length', {value: 1, configurable: true}),
+  TypeError);
+assertEquals(2, arr.length);
+
+assertThrows(
+  () => Object.defineProperty(arr, 'length', {value: 2, configurable: true}),
+  TypeError);
+assertEquals(2, arr.length);
+
+assertThrows(
+  () => Object.defineProperty(arr, 'length', {value: 3, configurable: true}),
+  TypeError);
+assertEquals(2, arr.length);
diff --git a/src/v8/test/mjsunit/regress/regress_967104.js b/src/v8/test/mjsunit/regress/regress_967104.js
new file mode 100644
index 0000000..78c24b0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress_967104.js
@@ -0,0 +1,12 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Check that arrays with non-writable length are handled correctly
+
+arr = new Array();
+Object.defineProperty(arr, "length", {value: 3, writable: false});
+function foo(i, v) { arr[i] = v; }
+foo(3);
+foo(3, 3);
+assertEquals(arr[3], undefined);
diff --git a/src/v8/test/mjsunit/regress/string-next-encoding.js b/src/v8/test/mjsunit/regress/string-next-encoding.js
new file mode 100644
index 0000000..d66bab8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/string-next-encoding.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --opt --allow-natives-syntax
+
+function f() {
+  var s = "äϠ�𝌆";
+  var i = s[Symbol.iterator]();
+  assertEquals("ä", i.next().value);
+  assertEquals("Ϡ", i.next().value);
+  assertEquals("�", i.next().value);
+  assertEquals("𝌆", i.next().value);
+  assertSame(undefined, i.next().value);
+};
+%PrepareFunctionForOptimization(f);
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/typed-array-lifetime.js b/src/v8/test/mjsunit/regress/typed-array-lifetime.js
index db9a216..8f63ec6 100644
--- a/src/v8/test/mjsunit/regress/typed-array-lifetime.js
+++ b/src/v8/test/mjsunit/regress/typed-array-lifetime.js
@@ -15,6 +15,7 @@
   }
 })();
 
+%PrepareFunctionForOptimization(foo);
 foo(1);
 foo(1);
 %OptimizeFunctionOnNextCall(foo);
diff --git a/src/v8/test/mjsunit/regress/wasm/loop-stack-check.js b/src/v8/test/mjsunit/regress/wasm/loop-stack-check.js
index a76ad01..b1e92fa 100644
--- a/src/v8/test/mjsunit/regress/wasm/loop-stack-check.js
+++ b/src/v8/test/mjsunit/regress/wasm/loop-stack-check.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 (function() {
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-02256.js b/src/v8/test/mjsunit/regress/wasm/regress-02256.js
index 3b9b76b..199626b 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-02256.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-02256.js
@@ -264,7 +264,6 @@
 var __v_12 = {};
 var __v_13 = {};
 try {
-    load("test/mjsunit/wasm/wasm-constants.js");
     load("test/mjsunit/wasm/wasm-module-__v_1.js");
     __v_2 = 0x10000;
 } catch (e) {
@@ -274,7 +273,7 @@
 function __f_16() {
     var __v_1 = new WasmModuleBuilder();
     __v_1.addFunction("grow_memory", kSig_i_i)
-        .addBody([kExprGetLocal, 0, kExprGrowMemory])
+        .addBody([kExprGetLocal, 0, kExprMemoryGrow])
         .exportFunc();
     __v_1.addFunction("load", kSig_i_i)
         .addBody([kExprGetLocal, 0, kExprI32LoadMem, 0, 0])
@@ -937,6 +936,7 @@
     return 0;
 }
 try {
+    %PrepareFunctionForOptimization(__f_30);
     assertEquals(0, __f_30(0));
     assertEquals(0, __f_30(0));
     %OptimizeFunctionOnNextCall(__f_30);
@@ -957,6 +957,7 @@
     __f_32({});
 }
 try {
+    %PrepareFunctionForOptimization(__f_33);
     __f_33();
     __f_33();
     __f_33();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-02256b.js b/src/v8/test/mjsunit/regress/wasm/regress-02256b.js
index 1206438..249e96d 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-02256b.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-02256b.js
@@ -472,6 +472,7 @@
     return 0;
 }
 try {
+    %PrepareFunctionForOptimization(__f_30);
     assertEquals(0, __f_30(0));
     assertEquals(0, __f_30(0));
     %OptimizeFunctionOnNextCall(__f_30);
@@ -492,6 +493,7 @@
     __f_32({});
 }
 try {
+    %PrepareFunctionForOptimization(__f_33);
     __f_33();
     __f_33();
     __f_33();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-5531.js b/src/v8/test/mjsunit/regress/wasm/regress-5531.js
index 1363f96..cea547d 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-5531.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-5531.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 (function() {
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-5800.js b/src/v8/test/mjsunit/regress/wasm/regress-5800.js
index 2e56da8..77c4361 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-5800.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-5800.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 (function AddTest() {
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-5860.js b/src/v8/test/mjsunit/regress/wasm/regress-5860.js
index b193323..961e52d 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-5860.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-5860.js
@@ -4,7 +4,6 @@
 //
 // Flags: --expose-wasm
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 let module1 = (() => {
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-5884.js b/src/v8/test/mjsunit/regress/wasm/regress-5884.js
index 8677f10..c6013d3 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-5884.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-5884.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 (function() {
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-6054.js b/src/v8/test/mjsunit/regress/wasm/regress-6054.js
index 7b309b6..3afb371 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-6054.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-6054.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 (function() {
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-6164.js b/src/v8/test/mjsunit/regress/wasm/regress-6164.js
index 3035ea5..ed728f5 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-6164.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-6164.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 (function() {
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-644682.js b/src/v8/test/mjsunit/regress/wasm/regress-644682.js
index b58c0d9..a48e5ae 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-644682.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-644682.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 (function() {
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-648079.js b/src/v8/test/mjsunit/regress/wasm/regress-648079.js
index acc6146..fbb5414 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-648079.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-648079.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 // Non-standard opcodes.
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-651961.js b/src/v8/test/mjsunit/regress/wasm/regress-651961.js
index 30f6565..f42f431 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-651961.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-651961.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 (function() {
@@ -14,7 +13,7 @@
     .addBody([
               kExprMemorySize, kMemoryZero,
               kExprI32Const, 0x10,
-              kExprGrowMemory, kMemoryZero,
+              kExprMemoryGrow, kMemoryZero,
               kExprI32Mul,
               ])
               .exportFunc();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-654377.js b/src/v8/test/mjsunit/regress/wasm/regress-654377.js
index 871da72..455139f 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-654377.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-654377.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 (function() {
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-663994.js b/src/v8/test/mjsunit/regress/wasm/regress-663994.js
index da3d7c7..9643a86 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-663994.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-663994.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 (function() {
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-667745.js b/src/v8/test/mjsunit/regress/wasm/regress-667745.js
index 68c8803..cae5122 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-667745.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-667745.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 (function() {
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-680938.js b/src/v8/test/mjsunit/regress/wasm/regress-680938.js
index 75c8a45..5471f60 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-680938.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-680938.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-var v17 = {};
-var v32 = {};
+var v17 = 42;
+var v32 = { initial: 1 };
 v39 = new WebAssembly.Memory(v32);
 v49 = v39.grow(v17);
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-684858.js b/src/v8/test/mjsunit/regress/wasm/regress-684858.js
index bfef7fc..1ac3cc6 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-684858.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-684858.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 var name = 'regression_684858';
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-688876.js b/src/v8/test/mjsunit/regress/wasm/regress-688876.js
index 83bebbb..5e142b3 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-688876.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-688876.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 (function() {
@@ -26,7 +25,7 @@
    kExprI32And,
   kExprI32Eqz,
  kExprI32And,
-kExprGrowMemory, 0x00,
+kExprMemoryGrow, 0x00,
    kExprI32Const, 0x55,
   kExprI32LoadMem8S, 0x00, 0x3a,
    kExprI32LoadMem16U, 0x00, 0x71,
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-689450.js b/src/v8/test/mjsunit/regress/wasm/regress-689450.js
index 9a4989c..bcd2538 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-689450.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-689450.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 (function() {
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-6931.js b/src/v8/test/mjsunit/regress/wasm/regress-6931.js
index 364e95a..5edf257 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-6931.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-6931.js
@@ -3,7 +3,6 @@
 // found in the LICENSE file.
 
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-699485.js b/src/v8/test/mjsunit/regress/wasm/regress-699485.js
index 7f45607..8a70afa 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-699485.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-699485.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 (function() {
@@ -15,7 +14,7 @@
   .addBody([
       kExprI32Const, 0x04,
       kExprNop,
-      kExprGrowMemory, 0x00,
+      kExprMemoryGrow, 0x00,
       ]).exportFunc();
 let module = builder.instantiate();
 assertEquals(0, module.exports.regression_699485());
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-702460.js b/src/v8/test/mjsunit/regress/wasm/regress-702460.js
index 73c01e1..21a84bc 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-702460.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-702460.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 // Non-standard opcodes.
@@ -18,34 +17,34 @@
         kExprI32Const, 0x41,
         kExprI32Const, 0x3c,
         kExprI32Const, 0xdc, 0x01,
-        kExprGrowMemory, 0x00,
-        kExprGrowMemory, 0x00,
-        kExprGrowMemory, 0x00,
+        kExprMemoryGrow, 0x00,
+        kExprMemoryGrow, 0x00,
+        kExprMemoryGrow, 0x00,
         kExprSetLocal, 0x00,
-        kExprGrowMemory, 0x00,
-        kExprGrowMemory, 0x00,
-        kExprGrowMemory, 0x00,
-        kExprGrowMemory, 0x00,
-        kExprGrowMemory, 0x00,
-        kExprGrowMemory, 0x00,
-        kExprGrowMemory, 0x00,
-        kExprGrowMemory, 0x00,
-        kExprGrowMemory, 0x00,
-        kExprGrowMemory, 0x00,
-        kExprGrowMemory, 0x00,
-        kExprGrowMemory, 0x00,
-        kExprGrowMemory, 0x00,
-        kExprGrowMemory, 0x00,
-        kExprGrowMemory, 0x00,
-        kExprGrowMemory, 0x00,
-        kExprGrowMemory, 0x00,
-        kExprGrowMemory, 0x00,
-        kExprGrowMemory, 0x00,
-        kExprGrowMemory, 0x00,
-        kExprGrowMemory, 0x00,
+        kExprMemoryGrow, 0x00,
+        kExprMemoryGrow, 0x00,
+        kExprMemoryGrow, 0x00,
+        kExprMemoryGrow, 0x00,
+        kExprMemoryGrow, 0x00,
+        kExprMemoryGrow, 0x00,
+        kExprMemoryGrow, 0x00,
+        kExprMemoryGrow, 0x00,
+        kExprMemoryGrow, 0x00,
+        kExprMemoryGrow, 0x00,
+        kExprMemoryGrow, 0x00,
+        kExprMemoryGrow, 0x00,
+        kExprMemoryGrow, 0x00,
+        kExprMemoryGrow, 0x00,
+        kExprMemoryGrow, 0x00,
+        kExprMemoryGrow, 0x00,
+        kExprMemoryGrow, 0x00,
+        kExprMemoryGrow, 0x00,
+        kExprMemoryGrow, 0x00,
+        kExprMemoryGrow, 0x00,
+        kExprMemoryGrow, 0x00,
         kExprS128LoadMem, 0x00, 0x40,
         kExprUnreachable,
-        kExprGrowMemory, 0x00
+        kExprMemoryGrow, 0x00
         ]).exportFunc();
   assertThrows(() => builder.instantiate());
 })();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-7033.js b/src/v8/test/mjsunit/regress/wasm/regress-7033.js
index 17d79c8..58dff5e 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-7033.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-7033.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 var builder = new WasmModuleBuilder();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-7035.js b/src/v8/test/mjsunit/regress/wasm/regress-7035.js
index cd69c7d..7348549 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-7035.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-7035.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 var builder = new WasmModuleBuilder();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-7049.js b/src/v8/test/mjsunit/regress/wasm/regress-7049.js
index b9ad1a0..6d2cd35 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-7049.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-7049.js
@@ -4,7 +4,6 @@
 
 // Flags: --allow-natives-syntax --expose-gc
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 // Build two instances, instance 2 is interpreted, and calls instance 1 (via
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-708714.js b/src/v8/test/mjsunit/regress/wasm/regress-708714.js
index 10cd67a..dc90a0a 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-708714.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-708714.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 var builder = new WasmModuleBuilder();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-709684.js b/src/v8/test/mjsunit/regress/wasm/regress-709684.js
index 1ca0cb6..a6e03e0 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-709684.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-709684.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm --allow-natives-syntax
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 let importingModuleBinary1 = (() => {
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-710844.js b/src/v8/test/mjsunit/regress/wasm/regress-710844.js
index a45e953..3bafe41 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-710844.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-710844.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 (function() {
@@ -13,7 +12,7 @@
     .addBody([
         kExprI32Const, 0x03,
         kExprNop,
-        kExprGrowMemory, 0x00,
+        kExprMemoryGrow, 0x00,
         kExprI32Const, 0x13,
         kExprNop,
         kExprI32StoreMem8, 0x00, 0x10
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-711203.js b/src/v8/test/mjsunit/regress/wasm/regress-711203.js
index 46f274a..beca86d 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-711203.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-711203.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 (function() {
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-715216b.js b/src/v8/test/mjsunit/regress/wasm/regress-715216b.js
index 0954f80..85e93e0 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-715216b.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-715216b.js
@@ -4,7 +4,6 @@
 
 // Flags: --wasm-interpret-all --wasm-lazy-compilation
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 var builder = new WasmModuleBuilder();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-722445.js b/src/v8/test/mjsunit/regress/wasm/regress-722445.js
index f6a96dc..5868d76 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-722445.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-722445.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 var builder = new WasmModuleBuilder();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-724846.js b/src/v8/test/mjsunit/regress/wasm/regress-724846.js
index 628d58f..b215b60 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-724846.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-724846.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 // Flags: --wasm-max-mem-pages=49152
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-724851.js b/src/v8/test/mjsunit/regress/wasm/regress-724851.js
index 1883479..5c4c421 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-724851.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-724851.js
@@ -4,7 +4,6 @@
 
 // Flags: --wasm-lazy-compilation
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 let builder = new WasmModuleBuilder();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-724972.js b/src/v8/test/mjsunit/regress/wasm/regress-724972.js
index 2af403c..cbe5d35 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-724972.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-724972.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 var builder = new WasmModuleBuilder();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-727222.js b/src/v8/test/mjsunit/regress/wasm/regress-727222.js
index 6b3f2fa..3096334 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-727222.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-727222.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 var builder = new WasmModuleBuilder();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-727560.js b/src/v8/test/mjsunit/regress/wasm/regress-727560.js
index f92d879..e9ed441 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-727560.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-727560.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 {
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-729991.js b/src/v8/test/mjsunit/regress/wasm/regress-729991.js
index 85a9ae7..8cabd51 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-729991.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-729991.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 let builder = new WasmModuleBuilder();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-734108.js b/src/v8/test/mjsunit/regress/wasm/regress-734108.js
index d8774f4..74a1717 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-734108.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-734108.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --wasm-async-compilation
-
 __v_0 = new Uint8Array([
   0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00, 0x01, 0x05, 0x01,
   0x60, 0x00, 0x01, 0x7f, 0x03, 0x02, 0x01, 0x00, 0x05, 0x03, 0x01,
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-734246.js b/src/v8/test/mjsunit/regress/wasm/regress-734246.js
index 57f9894..b861141 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-734246.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-734246.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 let builder = new WasmModuleBuilder();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-734345.js b/src/v8/test/mjsunit/regress/wasm/regress-734345.js
index f55a062..d7486d2 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-734345.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-734345.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-gc
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 builder1 = new WasmModuleBuilder();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-7353.js b/src/v8/test/mjsunit/regress/wasm/regress-7353.js
new file mode 100644
index 0000000..81f45fe
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-7353.js
@@ -0,0 +1,28 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-lazy-compilation
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(16, 32);
+builder.addFunction('grow', kSig_i_i).addBody([
+  kExprGetLocal, 0,
+  kExprMemoryGrow, 0,
+]).exportFunc();
+builder.addFunction('main', kSig_i_i).addBody([
+  ...wasmI32Const(0x41),
+  kExprSetLocal, 0,
+  // Enter loop, such that values are spilled to the stack.
+  kExprLoop, kWasmStmt,
+  kExprEnd,
+  // Reload value. This must be loaded as 32 bit value.
+  kExprGetLocal, 0,
+  kExprI32LoadMem, 0, 0,
+]).exportFunc();
+const instance = builder.instantiate();
+// Execute grow, such that the stack contains garbage data afterwards.
+instance.exports.grow(1);
+instance.exports.main();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-7364.js b/src/v8/test/mjsunit/regress/wasm/regress-7364.js
new file mode 100644
index 0000000..f508585
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-7364.js
@@ -0,0 +1,30 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const exportingModuleBinary = (() => {
+  const builder = new WasmModuleBuilder();
+  builder.addFunction('f', kSig_i_v).addBody([kExprI32Const, 42]).exportFunc();
+  return builder.toBuffer();
+})();
+
+const exportingModule = new WebAssembly.Module(exportingModuleBinary);
+const exportingInstance = new WebAssembly.Instance(exportingModule);
+
+const reExportingModuleBinary = (() => {
+  const builder = new WasmModuleBuilder();
+  const gIndex = builder.addImport('a', 'g', kSig_i_v);
+  builder.addExport('y', gIndex);
+  return builder.toBuffer();
+})();
+
+const module = new WebAssembly.Module(reExportingModuleBinary);
+const imports = {
+  a: {g: exportingInstance.exports.f},
+};
+const instance = new WebAssembly.Instance(module, imports);
+
+// Previously exported Wasm functions are re-exported with the same value
+assertEquals(instance.exports.y, exportingInstance.exports.f);
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-736584.js b/src/v8/test/mjsunit/regress/wasm/regress-736584.js
index 39f03c1..0e027f3 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-736584.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-736584.js
@@ -4,10 +4,9 @@
 
 // Flags: --wasm-lazy-compilation
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
-let mem = new WebAssembly.Memory({});
+let mem = new WebAssembly.Memory({initial: 0});
 let builder = new WasmModuleBuilder();
 builder.addImportedMemory("mod", "imported_mem");
 builder.addFunction('mem_size', kSig_i_v)
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-7366.js b/src/v8/test/mjsunit/regress/wasm/regress-7366.js
new file mode 100644
index 0000000..b5cae8d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-7366.js
@@ -0,0 +1,32 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addFunction(undefined, kSig_i_iii).addBody([
+  // Return the sum of all arguments.
+  kExprGetLocal, 0, kExprGetLocal, 1, kExprGetLocal, 2, kExprI32Add, kExprI32Add
+]);
+const sig = builder.addType(kSig_i_iii);
+builder.addFunction(undefined, kSig_i_iii)
+    .addBody([
+      ...wasmI32Const(1),         // i32.const 0x1
+      kExprSetLocal, 0,           // set_local 0
+      ...wasmI32Const(4),         // i32.const 0x1
+      kExprSetLocal, 1,           // set_local 1
+      ...wasmI32Const(16),        // i32.const 0x1
+      kExprSetLocal, 2,           // set_local 2
+      kExprLoop, kWasmStmt,       // loop
+      kExprEnd,                   // end
+      kExprGetLocal, 0,           // get_local 0
+      kExprGetLocal, 1,           // get_local 1
+      kExprGetLocal, 2,           // get_local 2
+      kExprI32Const, 0,           // i32.const 0 (func index)
+      kExprCallIndirect, sig, 0,  // call indirect
+    ])
+    .exportAs('main');
+builder.appendToTable([0]);
+const instance = builder.instantiate();
+assertEquals(21, instance.exports.main());
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-737069.js b/src/v8/test/mjsunit/regress/wasm/regress-737069.js
index c68d10f..e4c4fae 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-737069.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-737069.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 let binary = new Binary;
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-739768.js b/src/v8/test/mjsunit/regress/wasm/regress-739768.js
index bcf3cee..5fca49b 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-739768.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-739768.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 // Flags: --wasm-lazy-compilation
@@ -16,7 +15,7 @@
       kExprCallIndirect, sig_index, kTableZero
     ])  // --
     .exportAs('main');
-builder0.setFunctionTableBounds(3, 3);
+builder0.setTableBounds(3, 3);
 builder0.addExportOfKind('table', kExternalTable);
 let module0 = new WebAssembly.Module(builder0.toBuffer());
 let instance0 = new WebAssembly.Instance(module0);
@@ -25,7 +24,7 @@
 builder1.setName('module_1');
 builder1.addFunction('main', kSig_i_v).addBody([kExprUnreachable]);
 builder1.addImportedTable('z', 'table');
-builder1.addFunctionTableInit(0, false, [0], true);
+builder1.addElementSegment(0, 0, false, [0], true);
 let module1 = new WebAssembly.Module(builder1.toBuffer());
 let instance1 =
     new WebAssembly.Instance(module1, {z: {table: instance0.exports.table}});
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-7422.js b/src/v8/test/mjsunit/regress/wasm/regress-7422.js
new file mode 100644
index 0000000..71e1eb8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-7422.js
@@ -0,0 +1,26 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+sig = makeSig([kWasmI32, kWasmI32, kWasmI32, kWasmI32, kWasmI32], [kWasmI32]);
+builder.addFunction(undefined, sig).addBody([kExprGetLocal, 4]);
+builder.addMemory(16, 32);
+builder.addFunction('main', sig)
+    .addBody([
+      kExprI32Const, 0, kExprSetLocal, 0,
+      // Compute five arguments to the function call.
+      kExprI32Const, 0, kExprI32Const, 0, kExprI32Const, 0, kExprI32Const, 0,
+      kExprGetLocal, 4, kExprI32Const, 1, kExprI32Add,
+      // Now some intermediate computation to force the arguments to be spilled
+      // to the stack:
+      kExprGetLocal, 0, kExprI32Const, 1, kExprI32Add, kExprGetLocal, 1,
+      kExprGetLocal, 1, kExprI32Add, kExprI32Add, kExprDrop,
+      // Now call the function.
+      kExprCallFunction, 0
+    ])
+    .exportFunc();
+var instance = builder.instantiate();
+assertEquals(11, instance.exports.main(2, 4, 6, 8, 10));
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-7499.js b/src/v8/test/mjsunit/regress/wasm/regress-7499.js
new file mode 100644
index 0000000..74e4d53
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-7499.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(16, 32);
+builder.addFunction(undefined, kSig_v_v).addBody([
+  kExprI32Const, 0,  // i32.const 0
+  kExprI64LoadMem, 0, 0xff, 0xff, 0xff, 0xff,
+  0x0f,       // i64.load align=0 offset=0xffffffff
+  kExprDrop,  // drop
+]);
+builder.addExport('main', 0);
+const module = builder.instantiate();
+assertThrows(
+    () => module.exports.main(), WebAssembly.RuntimeError, /out of bounds/);
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-7508.js b/src/v8/test/mjsunit/regress/wasm/regress-7508.js
new file mode 100644
index 0000000..10ce500
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-7508.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addFunction(undefined, kSig_v_v).addLocals({i64_count: 1}).addBody([
+  kExprI64Const, 0xeb,     0xd7, 0xaf, 0xdf,
+  0xbe,          0xfd,     0xfa, 0xf5, 0x6b,  // i64.const
+  kExprI32Const, 0,                           // i32.const
+  kExprIf,       kWasmI32,                    // if i32
+  kExprI32Const, 0,                           // i32.const
+  kExprElse,                                  // else
+  kExprI32Const, 0,                           // i32.const
+  kExprEnd,                                   // end
+  kExprBrIf,     0,                           // br_if depth=0
+  kExprSetLocal, 0,                           // set_local 0
+]);
+builder.instantiate();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-752423.js b/src/v8/test/mjsunit/regress/wasm/regress-752423.js
index 15ee9a6..938ecbf 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-752423.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-752423.js
@@ -6,7 +6,6 @@
 
 'use strict';
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 var builder = new WasmModuleBuilder();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-7565.js b/src/v8/test/mjsunit/regress/wasm/regress-7565.js
new file mode 100644
index 0000000..c9d4e2c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-7565.js
@@ -0,0 +1,19 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+sig0 = makeSig([], [kWasmI32]);
+builder.addFunction(undefined, sig0).addLocals({i64_count: 1}).addBody([
+  kExprLoop, kWasmI32,                    // loop i32
+  kExprF32Const, 0x00, 0x00, 0x00, 0x00,  // f32.const 0      --> f32:0
+  kExprGetLocal, 0x00,                    // get_local 0      --> i64:0
+  kExprF32SConvertI64,                    // f32.sconvert/i64 --> f32:0
+  kExprF32Ge,                             // f32.ge           --> i32:1
+  kExprEnd,                               // end
+]);
+builder.addExport('main', 0);
+const module = builder.instantiate();
+assertEquals(1, module.exports.main());
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-757217.js b/src/v8/test/mjsunit/regress/wasm/regress-757217.js
index 218b090..28e554b 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-757217.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-757217.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 let builder = new WasmModuleBuilder();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-7579.js b/src/v8/test/mjsunit/regress/wasm/regress-7579.js
new file mode 100644
index 0000000..876a76c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-7579.js
@@ -0,0 +1,61 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+// Generate function 1 (out of 2).
+sig0 = makeSig([], [kWasmI32]);
+builder.addFunction(undefined, sig0)
+  .addBody([
+    kExprI64Const, 0xc8, 0xda, 0x9c, 0xbc, 0xf8, 0xf0, 0xe1, 0xc3, 0x87, 0x7f,
+    kExprLoop, kWasmF64,
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      ...wasmF64Const(0),
+      kExprCallFunction, 0x01,
+      ...wasmF64Const(0),
+      kExprEnd,
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    ...wasmF64Const(0),
+    kExprCallFunction, 0x01,
+    kExprI64Const, 0xb9, 0xf2, 0xe4, 0x01,
+    kExprI64LtS]);
+// Generate function 2 (out of 2).
+sig1 = makeSig(new Array(12).fill(kWasmF64), []);
+builder.addFunction(undefined, sig1).addBody([]);
+builder.addExport('main', 0);
+const instance = builder.instantiate();
+assertEquals(1, instance.exports.main());
+
+const builder2 = new WasmModuleBuilder();
+sig0 = makeSig([], [kWasmI32]);
+builder2.addFunction(undefined, sig0).addLocals({i64_count: 1}).addBody([
+  kExprLoop, kWasmI32,     // loop i32
+  kExprGetLocal, 0,        // get_local 3
+  kExprF32SConvertI64,     // f32.sconvert/i64
+  kExprI32ReinterpretF32,  // i32.reinterpret/f32
+  kExprEnd                 // end
+]);
+builder2.addExport('main', 0);
+const instance2 = builder2.instantiate();
+assertEquals(0, instance2.exports.main());
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-7582.js b/src/v8/test/mjsunit/regress/wasm/regress-7582.js
new file mode 100644
index 0000000..d8b5e9d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-7582.js
@@ -0,0 +1,47 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addGlobal(kWasmI32, 1);
+sig0 = makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]);
+builder.addFunction(undefined, sig0)
+  .addBody([
+kExprF32Const, 0x01, 0x00, 0x00, 0x00,
+kExprF32Const, 0x00, 0x00, 0x00, 0x00,
+kExprF32Eq,  // --> i32:0
+kExprF32Const, 0xc9, 0xc9, 0x69, 0xc9,
+kExprF32Const, 0xc9, 0xc9, 0xc9, 0x00,
+kExprF32Eq,  // --> i32:0 i32:0
+kExprIf, kWasmF32,
+  kExprF32Const, 0x00, 0x00, 0x00, 0x00,
+kExprElse,   // @32
+  kExprF32Const, 0x00, 0x00, 0x00, 0x00,
+  kExprEnd,   // --> i32:0 f32:0
+kExprF32Const, 0xc9, 0x00, 0x00, 0x00,
+kExprF32Const, 0xc9, 0xc9, 0xc9, 0x00,
+kExprF32Const, 0xc9, 0xc9, 0xa0, 0x00, // --> i32:0 f32:0 f32 f32 f32
+kExprF32Eq,  // --> i32:0 f32:0 f32 i32:0
+kExprIf, kWasmF32,
+  kExprF32Const, 0x00, 0x00, 0x00, 0x00,
+kExprElse,
+  kExprF32Const, 0x00, 0x00, 0x00, 0x00,
+  kExprEnd,  // --> i32:0 f32:0 f32 f32:0
+kExprF32Eq,  // --> i32:0 f32:0 i32:0
+kExprIf, kWasmF32,
+  kExprF32Const, 0x00, 0x00, 0x00, 0x00,
+kExprElse,
+  kExprF32Const, 0x00, 0x00, 0x00, 0x00,
+  kExprEnd,   // --> i32:0 f32:0 f32:0
+kExprF32Const, 0xc9, 0xc9, 0xff, 0xff,  // --> i32:0 f32:0 f32:0 f32
+kExprF32Eq,  // --> i32:0 f32:0 i32:0
+kExprDrop,
+kExprDrop, // --> i32:0
+kExprI32Const, 1, // --> i32:0 i32:1
+kExprI32GeU,  // --> i32:0
+          ]);
+builder.addExport('main', 0);
+const instance = builder.instantiate();
+assertEquals(0, instance.exports.main(1, 2, 3));
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-763439.js b/src/v8/test/mjsunit/regress/wasm/regress-763439.js
index 0f9d2b2..ef84b97 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-763439.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-763439.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 var builder = new WasmModuleBuilder();
@@ -10,7 +9,7 @@
 builder.addFunction('f', kSig_i_v)
     .addBody([
       kExprI32Const, 0x1d,                       // --
-      kExprGrowMemory, 0x00,                     // --
+      kExprMemoryGrow, 0x00,                     // --
       kExprI32LoadMem, 0x00, 0xff, 0xff, 0x45,  // --
     ])
     .exportFunc();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-763697.js b/src/v8/test/mjsunit/regress/wasm/regress-763697.js
index faf74e1..c831a55 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-763697.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-763697.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm --no-experimental-wasm-simd
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 let builder = new WasmModuleBuilder();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-766003.js b/src/v8/test/mjsunit/regress/wasm/regress-766003.js
index d8a1ea1..3aaff40 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-766003.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-766003.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm --wasm-interpret-all
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
  __v_6 = new WasmModuleBuilder();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-769637.js b/src/v8/test/mjsunit/regress/wasm/regress-769637.js
new file mode 100644
index 0000000..71aaa45
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-769637.js
@@ -0,0 +1,16 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+let builder = new WasmModuleBuilder();
+builder
+    .addMemory()
+    .addFunction("main", kSig_v_v)
+    .addBody([kExprI32Const, 4,
+              kExprI32Const, 8,
+              kExprI32StoreMem, 0, 16])
+    .exportAs("main");
+let instance = builder.instantiate();
+assertTraps(kTrapMemOutOfBounds, instance.exports.main);
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-771243.js b/src/v8/test/mjsunit/regress/wasm/regress-771243.js
index e1581fc..81b9e8f 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-771243.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-771243.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm --wasm-interpret-all
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 assertThrows(() => {
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-772332.js b/src/v8/test/mjsunit/regress/wasm/regress-772332.js
index 56e6f2c..e8547c8 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-772332.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-772332.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm --wasm-interpret-all
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 assertThrows(() => {
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-775366.js b/src/v8/test/mjsunit/regress/wasm/regress-775366.js
index e8db923..69a1f68 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-775366.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-775366.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load('test/mjsunit/wasm/wasm-constants.js');
+load("test/mjsunit/wasm/wasm-module-builder.js");
 
 (function BadTypeSection() {
   var data = bytes(
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-776677.js b/src/v8/test/mjsunit/regress/wasm/regress-776677.js
index 1b2357d..87bf8fa 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-776677.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-776677.js
@@ -16,7 +16,7 @@
 
 var global = {Uint32Array:Uint32Array};
 var env = {};
-memory = new WebAssembly.Memory({initial:200});
+memory = new WebAssembly.Memory({initial:128});
 var buffer = memory.buffer;
 evil_f = module(global,env,buffer);
 
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-7785.js b/src/v8/test/mjsunit/regress/wasm/regress-7785.js
new file mode 100644
index 0000000..72638b1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-7785.js
@@ -0,0 +1,43 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --experimental-wasm-anyref
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function testAnyRefNull() {
+  const builder = new WasmModuleBuilder();
+  builder.addFunction('main', kSig_r_v)
+      .addBody([kExprRefNull])
+      .exportFunc();
+
+  var wire_bytes = builder.toBuffer();
+  var module = new WebAssembly.Module(wire_bytes);
+  var buffer = %SerializeWasmModule(module);
+  module = %DeserializeWasmModule(buffer, wire_bytes);
+  var instance = new WebAssembly.Instance(module);
+
+  assertEquals(null, instance.exports.main());
+})();
+
+(function testAnyRefIsNull() {
+  const builder = new WasmModuleBuilder();
+  builder.addFunction('main', kSig_i_r)
+      .addBody([kExprGetLocal, 0, kExprRefIsNull])
+      .exportFunc();
+
+  var wire_bytes = builder.toBuffer();
+  var module = new WebAssembly.Module(wire_bytes);
+  var buffer = %SerializeWasmModule(module);
+  module = %DeserializeWasmModule(buffer, wire_bytes);
+  var instance = new WebAssembly.Instance(module);
+
+  assertEquals(0, instance.exports.main({'hello' : 'world'}));
+  assertEquals(0, instance.exports.main(1234));
+  assertEquals(0, instance.exports.main(0));
+  assertEquals(0, instance.exports.main(123.4));
+  assertEquals(0, instance.exports.main(undefined));
+  assertEquals(1, instance.exports.main(null));
+  assertEquals(0, instance.exports.main(print));
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-778917.js b/src/v8/test/mjsunit/regress/wasm/regress-778917.js
index 083f1d1..c7eb033 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-778917.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-778917.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm --wasm-interpret-all
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-782280.js b/src/v8/test/mjsunit/regress/wasm/regress-782280.js
index a94f061..008ab16 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-782280.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-782280.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 var builder = new WasmModuleBuilder();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-784050.js b/src/v8/test/mjsunit/regress/wasm/regress-784050.js
index 8f1a790..acf4539 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-784050.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-784050.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 var builder = new WasmModuleBuilder();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-7914.js b/src/v8/test/mjsunit/regress/wasm/regress-7914.js
new file mode 100644
index 0000000..48f8b90
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-7914.js
@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(16, 32, false);
+builder.addFunction('main', kSig_i_v)
+    .addBody([
+      ...wasmI32Const(10000),  // i32.const 10000
+      kExprMemoryGrow, 0,      // grow_memory --> -1
+      kExprI32Popcnt,          // i32.popcnt  --> 32
+    ])
+    .exportFunc();
+const instance = builder.instantiate();
+assertEquals(32, instance.exports.main());
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-791810.js b/src/v8/test/mjsunit/regress/wasm/regress-791810.js
index cd6c4e2..73b47bd 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-791810.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-791810.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 const builder = new WasmModuleBuilder();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-793551.js b/src/v8/test/mjsunit/regress/wasm/regress-793551.js
index 8aa0241..657b2c0 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-793551.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-793551.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 const builder = new WasmModuleBuilder();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-797846.js b/src/v8/test/mjsunit/regress/wasm/regress-797846.js
index 6a4fd5c..1470de4 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-797846.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-797846.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 // We need a module with one valid function.
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-799952.js b/src/v8/test/mjsunit/regress/wasm/regress-799952.js
new file mode 100644
index 0000000..1737134
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-799952.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var sentinel = {};
+Object.defineProperty(Promise, Symbol.species, {
+  value: function(f) {
+    f(function() {}, function() {})
+    return sentinel;
+  }
+});
+
+// According to the WebAssembly JavaScript API spec, WebAssembly.instantiate is
+// using the initial value of the Promise constructor. Specifically it ignores
+// the Promise species constructor installed above.
+var promise = WebAssembly.instantiate(new ArrayBuffer());
+assertInstanceof(promise, Promise);
+assertNotSame(promise, sentinel);
+
+// All further uses of the returned Promise, like using Promise.prototype.then,
+// will respect the Promise species constructor installed above however.
+var monkey = promise.then(r => { print(r) }, e => { print(e) });
+assertSame(monkey, sentinel);
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-800756.js b/src/v8/test/mjsunit/regress/wasm/regress-800756.js
index 2d29997..76afc88 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-800756.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-800756.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 const builder = new WasmModuleBuilder();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-801785.js b/src/v8/test/mjsunit/regress/wasm/regress-801785.js
new file mode 100644
index 0000000..105fd4b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-801785.js
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+// Flags: --print-wasm-code
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(8, 16);
+builder.addFunction(undefined, kSig_i_i).addBody([
+  // wasm to wasm call.
+  kExprGetLocal, 0, kExprCallFunction, 0x1
+]);
+builder.addFunction(undefined, kSig_i_i).addBody([
+  // load from <get_local 0> to create trap code.
+  kExprGetLocal, 0, kExprI32LoadMem, 0,
+  // unreachable to create a runtime call.
+  kExprUnreachable
+]);
+builder.instantiate();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-801850.js b/src/v8/test/mjsunit/regress/wasm/regress-801850.js
index ad6ff4c..0e0f5c2 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-801850.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-801850.js
@@ -2,10 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 var builder = new WasmModuleBuilder();
 let module = new WebAssembly.Module(builder.toBuffer());
-var worker = new Worker('onmessage = function() {};');
+var worker = new Worker('onmessage = function() {};', {type: 'string'});
 worker.postMessage(module)
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-802244.js b/src/v8/test/mjsunit/regress/wasm/regress-802244.js
index 0b8decb..aeaf850 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-802244.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-802244.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 const builder = new WasmModuleBuilder();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-803427.js b/src/v8/test/mjsunit/regress/wasm/regress-803427.js
new file mode 100644
index 0000000..26b1413
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-803427.js
@@ -0,0 +1,12 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-lazy-compilation
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+let module = new WebAssembly.Module(builder.toBuffer());
+var worker = new Worker('onmessage = function() {};', {type: 'string'});
+worker.postMessage(module)
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-803788.js b/src/v8/test/mjsunit/regress/wasm/regress-803788.js
new file mode 100644
index 0000000..5c894ae
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-803788.js
@@ -0,0 +1,26 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-lazy-compilation
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+let q_table = builder.addImportedTable("q", "table")
+let q_base = builder.addImportedGlobal("q", "base", kWasmI32);
+let q_fun = builder.addImport("q", "fun", kSig_v_v);
+builder.addType(kSig_i_ii);
+builder.addElementSegment(0, q_base, true, [ q_fun ])
+let module = new WebAssembly.Module(builder.toBuffer());
+let table = new WebAssembly.Table({
+  element: "anyfunc",
+  initial: 10,
+});
+let instance = new WebAssembly.Instance(module, {
+  q: {
+    base: 0,
+    table: table,
+    fun: () => (0)
+  }
+});
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-8059.js b/src/v8/test/mjsunit/regress/wasm/regress-8059.js
new file mode 100644
index 0000000..78ee6bd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-8059.js
@@ -0,0 +1,41 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-wasm-disable-structured-cloning
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function TestPostModule() {
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("add", kSig_i_ii)
+    .addBody([kExprGetLocal, 0, kExprGetLocal, 1, kExprI32Add])
+    .exportFunc();
+
+  let module = builder.toModule();
+
+  let workerScript = `
+    onmessage = function(module) {
+      try {
+        let instance = new WebAssembly.Instance(module);
+        let result = instance.exports.add(40, 2);
+        postMessage(result);
+      } catch(e) {
+        postMessage('ERROR: ' + e);
+      }
+    }
+  `;
+
+  let realm = Realm.create();
+  Realm.shared = { m:module, s:workerScript };
+
+  let realmScript = `
+    let worker = new Worker(Realm.shared.s, {type: 'string'});
+    worker.postMessage(Realm.shared.m);
+    let message = worker.getMessage();
+    worker.terminate();
+    message;
+  `;
+  let message = Realm.eval(realm, realmScript);
+  assertEquals(42, message);
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-808012.js b/src/v8/test/mjsunit/regress/wasm/regress-808012.js
new file mode 100644
index 0000000..a54b88a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-808012.js
@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-lazy-compilation
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addFunction('test', kSig_i_i).addBody([kExprUnreachable]);
+let module = new WebAssembly.Module(builder.toBuffer());
+var worker = new Worker('onmessage = function() {};', {type: 'string'});
+worker.postMessage(module);
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-808848.js b/src/v8/test/mjsunit/regress/wasm/regress-808848.js
new file mode 100644
index 0000000..57920de
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-808848.js
@@ -0,0 +1,66 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+// The number of locals must be greater than the constant defined here:
+// https://cs.chromium.org/chromium/src/v8/src/compiler/x64/code-generator-x64.cc?l=3146
+const kNumLocals = 128;
+
+function varuint32(val) {
+  let bytes = [];
+  for (let i = 0; i < 4; ++i) {
+    bytes.push(0x80 | ((val >> (7 * i)) & 0x7f));
+  }
+  bytes.push((val >> (7 * 4)) & 0x7f);
+  return bytes;
+}
+
+// Generate a function that calls the "get" import `kNumLocals` times, and
+// stores each result in a local, then calls the "call" import `kNumLocals`
+// times with the stored local values.
+//
+// The intention is to create a function that has a large stack frame.
+let body = [];
+
+for (let i = 0; i < kNumLocals; ++i) {
+  body.push(kExprCallFunction, 0, kExprSetLocal, ...varuint32(i));
+}
+
+for (let i = 0; i < kNumLocals; ++i) {
+  body.push(kExprGetLocal, ...varuint32(i), kExprCallFunction, 1);
+}
+
+let builder = new WasmModuleBuilder();
+builder.addImport('mod', 'get', kSig_i_v);
+builder.addImport('mod', 'call', kSig_v_i);
+builder.
+  addFunction('main', kSig_v_v).
+  addLocals({i32_count: kNumLocals}).
+  addBody(body).
+  exportAs('main');
+let m1_bytes = builder.toBuffer();
+let m1 = new WebAssembly.Module(m1_bytes);
+
+// Serialize the module and postMessage it to another thread.
+let serialized_m1 = %SerializeWasmModule(m1);
+
+let worker_onmessage = function(msg) {
+  let {serialized_m1, m1_bytes} = msg;
+
+  let m1_clone = %DeserializeWasmModule(serialized_m1, m1_bytes);
+  let imports = {mod: {get: () => 3, call: () => {}}};
+  let i2 = new WebAssembly.Instance(m1_clone, imports);
+  i2.exports.main();
+  postMessage('done');
+}
+let workerScript = "onmessage = " + worker_onmessage.toString();
+
+let worker = new Worker(workerScript, {type: 'string'});
+worker.postMessage({serialized_m1, m1_bytes});
+
+// Wait for worker to finish.
+print(worker.getMessage());
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-808980.js b/src/v8/test/mjsunit/regress/wasm/regress-808980.js
index 884572b..d78c07f 100644
--- a/src/v8/test/mjsunit/regress/wasm/regress-808980.js
+++ b/src/v8/test/mjsunit/regress/wasm/regress-808980.js
@@ -4,7 +4,6 @@
 
 // Flags: --allow-natives-syntax --throws
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 let kTableSize = 3;
 
@@ -17,7 +16,7 @@
     sig_index1,
     kTableZero
 ]).exportAs('main');
-builder.setFunctionTableBounds(kTableSize, kTableSize);
+builder.setTableBounds(kTableSize, kTableSize);
 var m1_bytes = builder.toBuffer();
 var m1 = new WebAssembly.Module(m1_bytes);
 
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-8094.js b/src/v8/test/mjsunit/regress/wasm/regress-8094.js
new file mode 100644
index 0000000..dc78366
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-8094.js
@@ -0,0 +1,29 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --experimental-wasm-eh
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+// Instantiate a throwing module.
+var builder = new WasmModuleBuilder();
+builder.addException(kSig_v_v);
+builder.addFunction("propel", kSig_v_v)
+       .addBody([kExprThrow, 0])
+       .exportFunc();
+var instance = builder.instantiate();
+
+// Catch the exception.
+var exception;
+try {
+  instance.exports.propel();
+} catch (e) {
+  exception = e;
+}
+
+// Check that the exception is an instance of the correct error function and
+// that no extraneous properties exist. Setting such properties could be
+// observable by JavaScript and could break compatibility.
+assertInstanceof(exception, WebAssembly.RuntimeError);
+assertArrayEquals(["stack", "message"], Object.getOwnPropertyNames(exception));
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-8095.js b/src/v8/test/mjsunit/regress/wasm/regress-8095.js
new file mode 100644
index 0000000..7d21932
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-8095.js
@@ -0,0 +1,24 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --experimental-wasm-eh
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+// Prepare a special error object to throw.
+var error = new Error("my error");
+error.__proto__ = new Proxy(new Error(), {
+  has(target, property, receiver) {
+    assertUnreachable();
+  }
+});
+
+// Throw it through a WebAssembly module.
+var builder = new WasmModuleBuilder();
+builder.addImport('mod', 'fun', kSig_v_v);
+builder.addFunction("funnel", kSig_v_v)
+       .addBody([kExprCallFunction, 0])
+       .exportFunc();
+var instance = builder.instantiate({ mod: {fun: function() { throw error }}});
+assertThrows(instance.exports.funnel, Error);
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-810973.js b/src/v8/test/mjsunit/regress/wasm/regress-810973.js
new file mode 100644
index 0000000..bd3d902
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-810973.js
@@ -0,0 +1,33 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+  this.WScript = new Proxy({}, {
+    get() {
+      switch (name) {
+      }
+    }
+  });
+function MjsUnitAssertionError() {
+};
+let __v_692 = `(function module() { "use asm";function foo(`;
+const __v_693 =
+1005;
+for (let __v_695 = 0; __v_695 < __v_693; ++__v_695) {
+    __v_692 += `arg${__v_695},`;
+}
+try {
+  __v_692 += `arg${__v_693}){`;
+} catch (e) {}
+for (let __v_696 = 0; __v_696 <= __v_693; ++__v_696) {
+    __v_692 += `arg${__v_696}=+arg${__v_696};`;
+}
+  __v_692 += "return 10;}function bar(){return foo(";
+for (let __v_697 = 0; __v_697 < __v_693; ++__v_697) {
+    __v_692 += "0.0,";
+}
+  __v_692 += "1.0)|0;}";
+
+__v_692 += "return bar})()()";
+
+const __v_694 = eval(__v_692);
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-810973b.js b/src/v8/test/mjsunit/regress/wasm/regress-810973b.js
new file mode 100644
index 0000000..227bf55
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-810973b.js
@@ -0,0 +1,1209 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function module() {
+  "use asm";
+  function foo(
+      a0, a1, a2, a3, a4, a5, a6, a7, a8, a9, a10, a11,
+      a12, a13, a14, a15, a16, a17, a18, a19, a20, a21,
+      a22, a23, a24, a25, a26, a27, a28, a29, a30, a31,
+      a32, a33, a34, a35, a36, a37, a38, a39, a40, a41,
+      a42, a43, a44, a45, a46, a47, a48, a49, a50, a51,
+      a52, a53, a54, a55, a56, a57, a58, a59, a60, a61,
+      a62, a63, a64, a65, a66, a67, a68, a69, a70, a71,
+      a72, a73, a74, a75, a76, a77, a78, a79, a80, a81,
+      a82, a83, a84, a85, a86, a87, a88, a89, a90, a91,
+      a92, a93, a94, a95, a96, a97, a98, a99, a100, a101,
+      a102, a103, a104, a105, a106, a107, a108, a109, a110,
+      a111, a112, a113, a114, a115, a116, a117, a118, a119,
+      a120, a121, a122, a123, a124, a125, a126, a127, a128,
+      a129, a130, a131, a132, a133, a134, a135, a136, a137,
+      a138, a139, a140, a141, a142, a143, a144, a145, a146,
+      a147, a148, a149, a150, a151, a152, a153, a154, a155,
+      a156, a157, a158, a159, a160, a161, a162, a163, a164,
+      a165, a166, a167, a168, a169, a170, a171, a172, a173,
+      a174, a175, a176, a177, a178, a179, a180, a181, a182,
+      a183, a184, a185, a186, a187, a188, a189, a190, a191,
+      a192, a193, a194, a195, a196, a197, a198, a199, a200,
+      a201, a202, a203, a204, a205, a206, a207, a208, a209,
+      a210, a211, a212, a213, a214, a215, a216, a217, a218,
+      a219, a220, a221, a222, a223, a224, a225, a226, a227,
+      a228, a229, a230, a231, a232, a233, a234, a235, a236,
+      a237, a238, a239, a240, a241, a242, a243, a244, a245,
+      a246, a247, a248, a249, a250, a251, a252, a253, a254,
+      a255, a256, a257, a258, a259, a260, a261, a262, a263,
+      a264, a265, a266, a267, a268, a269, a270, a271, a272,
+      a273, a274, a275, a276, a277, a278, a279, a280, a281,
+      a282, a283, a284, a285, a286, a287, a288, a289, a290,
+      a291, a292, a293, a294, a295, a296, a297, a298, a299,
+      a300, a301, a302, a303, a304, a305, a306, a307, a308,
+      a309, a310, a311, a312, a313, a314, a315, a316, a317,
+      a318, a319, a320, a321, a322, a323, a324, a325, a326,
+      a327, a328, a329, a330, a331, a332, a333, a334, a335,
+      a336, a337, a338, a339, a340, a341, a342, a343, a344,
+      a345, a346, a347, a348, a349, a350, a351, a352, a353,
+      a354, a355, a356, a357, a358, a359, a360, a361, a362,
+      a363, a364, a365, a366, a367, a368, a369, a370, a371,
+      a372, a373, a374, a375, a376, a377, a378, a379, a380,
+      a381, a382, a383, a384, a385, a386, a387, a388, a389,
+      a390, a391, a392, a393, a394, a395, a396, a397, a398,
+      a399, a400, a401, a402, a403, a404, a405, a406, a407,
+      a408, a409, a410, a411, a412, a413, a414, a415, a416,
+      a417, a418, a419, a420, a421, a422, a423, a424, a425,
+      a426, a427, a428, a429, a430, a431, a432, a433, a434,
+      a435, a436, a437, a438, a439, a440, a441, a442, a443,
+      a444, a445, a446, a447, a448, a449, a450, a451, a452,
+      a453, a454, a455, a456, a457, a458, a459, a460, a461,
+      a462, a463, a464, a465, a466, a467, a468, a469, a470,
+      a471, a472, a473, a474, a475, a476, a477, a478, a479,
+      a480, a481, a482, a483, a484, a485, a486, a487, a488,
+      a489, a490, a491, a492, a493, a494, a495, a496, a497,
+      a498, a499, a500, a501, a502, a503, a504, a505, a506,
+      a507, a508, a509, a510, a511, a512, a513, a514, a515,
+      a516, a517, a518, a519, a520, a521, a522, a523, a524,
+      a525, a526, a527, a528, a529, a530, a531, a532, a533,
+      a534, a535, a536, a537, a538, a539, a540, a541, a542,
+      a543, a544, a545, a546, a547, a548, a549, a550, a551,
+      a552, a553, a554, a555, a556, a557, a558, a559, a560,
+      a561, a562, a563, a564, a565, a566, a567, a568, a569,
+      a570, a571, a572, a573, a574, a575, a576, a577, a578,
+      a579, a580, a581, a582, a583, a584, a585, a586, a587,
+      a588, a589, a590, a591, a592, a593, a594, a595, a596,
+      a597, a598, a599, a600, a601, a602, a603, a604, a605,
+      a606, a607, a608, a609, a610, a611, a612, a613, a614,
+      a615, a616, a617, a618, a619, a620, a621, a622, a623,
+      a624, a625, a626, a627, a628, a629, a630, a631, a632,
+      a633, a634, a635, a636, a637, a638, a639, a640, a641,
+      a642, a643, a644, a645, a646, a647, a648, a649, a650,
+      a651, a652, a653, a654, a655, a656, a657, a658, a659,
+      a660, a661, a662, a663, a664, a665, a666, a667, a668,
+      a669, a670, a671, a672, a673, a674, a675, a676, a677,
+      a678, a679, a680, a681, a682, a683, a684, a685, a686,
+      a687, a688, a689, a690, a691, a692, a693, a694, a695,
+      a696, a697, a698, a699, a700, a701, a702, a703, a704,
+      a705, a706, a707, a708, a709, a710, a711, a712, a713,
+      a714, a715, a716, a717, a718, a719, a720, a721, a722,
+      a723, a724, a725, a726, a727, a728, a729, a730, a731,
+      a732, a733, a734, a735, a736, a737, a738, a739, a740,
+      a741, a742, a743, a744, a745, a746, a747, a748, a749,
+      a750, a751, a752, a753, a754, a755, a756, a757, a758,
+      a759, a760, a761, a762, a763, a764, a765, a766, a767,
+      a768, a769, a770, a771, a772, a773, a774, a775, a776,
+      a777, a778, a779, a780, a781, a782, a783, a784, a785,
+      a786, a787, a788, a789, a790, a791, a792, a793, a794,
+      a795, a796, a797, a798, a799, a800, a801, a802, a803,
+      a804, a805, a806, a807, a808, a809, a810, a811, a812,
+      a813, a814, a815, a816, a817, a818, a819, a820, a821,
+      a822, a823, a824, a825, a826, a827, a828, a829, a830,
+      a831, a832, a833, a834, a835, a836, a837, a838, a839,
+      a840, a841, a842, a843, a844, a845, a846, a847, a848,
+      a849, a850, a851, a852, a853, a854, a855, a856, a857,
+      a858, a859, a860, a861, a862, a863, a864, a865, a866,
+      a867, a868, a869, a870, a871, a872, a873, a874, a875,
+      a876, a877, a878, a879, a880, a881, a882, a883, a884,
+      a885, a886, a887, a888, a889, a890, a891, a892, a893,
+      a894, a895, a896, a897, a898, a899, a900, a901, a902,
+      a903, a904, a905, a906, a907, a908, a909, a910, a911,
+      a912, a913, a914, a915, a916, a917, a918, a919, a920,
+      a921, a922, a923, a924, a925, a926, a927, a928, a929,
+      a930, a931, a932, a933, a934, a935, a936, a937, a938,
+      a939, a940, a941, a942, a943, a944, a945, a946, a947,
+      a948, a949, a950, a951, a952, a953, a954, a955, a956,
+      a957, a958, a959, a960, a961, a962, a963, a964, a965,
+      a966, a967, a968, a969, a970, a971, a972, a973, a974,
+      a975, a976, a977, a978, a979, a980, a981, a982, a983,
+      a984, a985, a986, a987, a988, a989, a990, a991, a992,
+      a993, a994, a995, a996, a997, a998, a999, a1000, a1001,
+      a1002, a1003, a1004, a1005) {
+    a0 = +a0;
+    a1 = +a1;
+    a2 = +a2;
+    a3 = +a3;
+    a4 = +a4;
+    a5 = +a5;
+    a6 = +a6;
+    a7 = +a7;
+    a8 = +a8;
+    a9 = +a9;
+    a10 = +a10;
+    a11 = +a11;
+    a12 = +a12;
+    a13 = +a13;
+    a14 = +a14;
+    a15 = +a15;
+    a16 = +a16;
+    a17 = +a17;
+    a18 = +a18;
+    a19 = +a19;
+    a20 = +a20;
+    a21 = +a21;
+    a22 = +a22;
+    a23 = +a23;
+    a24 = +a24;
+    a25 = +a25;
+    a26 = +a26;
+    a27 = +a27;
+    a28 = +a28;
+    a29 = +a29;
+    a30 = +a30;
+    a31 = +a31;
+    a32 = +a32;
+    a33 = +a33;
+    a34 = +a34;
+    a35 = +a35;
+    a36 = +a36;
+    a37 = +a37;
+    a38 = +a38;
+    a39 = +a39;
+    a40 = +a40;
+    a41 = +a41;
+    a42 = +a42;
+    a43 = +a43;
+    a44 = +a44;
+    a45 = +a45;
+    a46 = +a46;
+    a47 = +a47;
+    a48 = +a48;
+    a49 = +a49;
+    a50 = +a50;
+    a51 = +a51;
+    a52 = +a52;
+    a53 = +a53;
+    a54 = +a54;
+    a55 = +a55;
+    a56 = +a56;
+    a57 = +a57;
+    a58 = +a58;
+    a59 = +a59;
+    a60 = +a60;
+    a61 = +a61;
+    a62 = +a62;
+    a63 = +a63;
+    a64 = +a64;
+    a65 = +a65;
+    a66 = +a66;
+    a67 = +a67;
+    a68 = +a68;
+    a69 = +a69;
+    a70 = +a70;
+    a71 = +a71;
+    a72 = +a72;
+    a73 = +a73;
+    a74 = +a74;
+    a75 = +a75;
+    a76 = +a76;
+    a77 = +a77;
+    a78 = +a78;
+    a79 = +a79;
+    a80 = +a80;
+    a81 = +a81;
+    a82 = +a82;
+    a83 = +a83;
+    a84 = +a84;
+    a85 = +a85;
+    a86 = +a86;
+    a87 = +a87;
+    a88 = +a88;
+    a89 = +a89;
+    a90 = +a90;
+    a91 = +a91;
+    a92 = +a92;
+    a93 = +a93;
+    a94 = +a94;
+    a95 = +a95;
+    a96 = +a96;
+    a97 = +a97;
+    a98 = +a98;
+    a99 = +a99;
+    a100 = +a100;
+    a101 = +a101;
+    a102 = +a102;
+    a103 = +a103;
+    a104 = +a104;
+    a105 = +a105;
+    a106 = +a106;
+    a107 = +a107;
+    a108 = +a108;
+    a109 = +a109;
+    a110 = +a110;
+    a111 = +a111;
+    a112 = +a112;
+    a113 = +a113;
+    a114 = +a114;
+    a115 = +a115;
+    a116 = +a116;
+    a117 = +a117;
+    a118 = +a118;
+    a119 = +a119;
+    a120 = +a120;
+    a121 = +a121;
+    a122 = +a122;
+    a123 = +a123;
+    a124 = +a124;
+    a125 = +a125;
+    a126 = +a126;
+    a127 = +a127;
+    a128 = +a128;
+    a129 = +a129;
+    a130 = +a130;
+    a131 = +a131;
+    a132 = +a132;
+    a133 = +a133;
+    a134 = +a134;
+    a135 = +a135;
+    a136 = +a136;
+    a137 = +a137;
+    a138 = +a138;
+    a139 = +a139;
+    a140 = +a140;
+    a141 = +a141;
+    a142 = +a142;
+    a143 = +a143;
+    a144 = +a144;
+    a145 = +a145;
+    a146 = +a146;
+    a147 = +a147;
+    a148 = +a148;
+    a149 = +a149;
+    a150 = +a150;
+    a151 = +a151;
+    a152 = +a152;
+    a153 = +a153;
+    a154 = +a154;
+    a155 = +a155;
+    a156 = +a156;
+    a157 = +a157;
+    a158 = +a158;
+    a159 = +a159;
+    a160 = +a160;
+    a161 = +a161;
+    a162 = +a162;
+    a163 = +a163;
+    a164 = +a164;
+    a165 = +a165;
+    a166 = +a166;
+    a167 = +a167;
+    a168 = +a168;
+    a169 = +a169;
+    a170 = +a170;
+    a171 = +a171;
+    a172 = +a172;
+    a173 = +a173;
+    a174 = +a174;
+    a175 = +a175;
+    a176 = +a176;
+    a177 = +a177;
+    a178 = +a178;
+    a179 = +a179;
+    a180 = +a180;
+    a181 = +a181;
+    a182 = +a182;
+    a183 = +a183;
+    a184 = +a184;
+    a185 = +a185;
+    a186 = +a186;
+    a187 = +a187;
+    a188 = +a188;
+    a189 = +a189;
+    a190 = +a190;
+    a191 = +a191;
+    a192 = +a192;
+    a193 = +a193;
+    a194 = +a194;
+    a195 = +a195;
+    a196 = +a196;
+    a197 = +a197;
+    a198 = +a198;
+    a199 = +a199;
+    a200 = +a200;
+    a201 = +a201;
+    a202 = +a202;
+    a203 = +a203;
+    a204 = +a204;
+    a205 = +a205;
+    a206 = +a206;
+    a207 = +a207;
+    a208 = +a208;
+    a209 = +a209;
+    a210 = +a210;
+    a211 = +a211;
+    a212 = +a212;
+    a213 = +a213;
+    a214 = +a214;
+    a215 = +a215;
+    a216 = +a216;
+    a217 = +a217;
+    a218 = +a218;
+    a219 = +a219;
+    a220 = +a220;
+    a221 = +a221;
+    a222 = +a222;
+    a223 = +a223;
+    a224 = +a224;
+    a225 = +a225;
+    a226 = +a226;
+    a227 = +a227;
+    a228 = +a228;
+    a229 = +a229;
+    a230 = +a230;
+    a231 = +a231;
+    a232 = +a232;
+    a233 = +a233;
+    a234 = +a234;
+    a235 = +a235;
+    a236 = +a236;
+    a237 = +a237;
+    a238 = +a238;
+    a239 = +a239;
+    a240 = +a240;
+    a241 = +a241;
+    a242 = +a242;
+    a243 = +a243;
+    a244 = +a244;
+    a245 = +a245;
+    a246 = +a246;
+    a247 = +a247;
+    a248 = +a248;
+    a249 = +a249;
+    a250 = +a250;
+    a251 = +a251;
+    a252 = +a252;
+    a253 = +a253;
+    a254 = +a254;
+    a255 = +a255;
+    a256 = +a256;
+    a257 = +a257;
+    a258 = +a258;
+    a259 = +a259;
+    a260 = +a260;
+    a261 = +a261;
+    a262 = +a262;
+    a263 = +a263;
+    a264 = +a264;
+    a265 = +a265;
+    a266 = +a266;
+    a267 = +a267;
+    a268 = +a268;
+    a269 = +a269;
+    a270 = +a270;
+    a271 = +a271;
+    a272 = +a272;
+    a273 = +a273;
+    a274 = +a274;
+    a275 = +a275;
+    a276 = +a276;
+    a277 = +a277;
+    a278 = +a278;
+    a279 = +a279;
+    a280 = +a280;
+    a281 = +a281;
+    a282 = +a282;
+    a283 = +a283;
+    a284 = +a284;
+    a285 = +a285;
+    a286 = +a286;
+    a287 = +a287;
+    a288 = +a288;
+    a289 = +a289;
+    a290 = +a290;
+    a291 = +a291;
+    a292 = +a292;
+    a293 = +a293;
+    a294 = +a294;
+    a295 = +a295;
+    a296 = +a296;
+    a297 = +a297;
+    a298 = +a298;
+    a299 = +a299;
+    a300 = +a300;
+    a301 = +a301;
+    a302 = +a302;
+    a303 = +a303;
+    a304 = +a304;
+    a305 = +a305;
+    a306 = +a306;
+    a307 = +a307;
+    a308 = +a308;
+    a309 = +a309;
+    a310 = +a310;
+    a311 = +a311;
+    a312 = +a312;
+    a313 = +a313;
+    a314 = +a314;
+    a315 = +a315;
+    a316 = +a316;
+    a317 = +a317;
+    a318 = +a318;
+    a319 = +a319;
+    a320 = +a320;
+    a321 = +a321;
+    a322 = +a322;
+    a323 = +a323;
+    a324 = +a324;
+    a325 = +a325;
+    a326 = +a326;
+    a327 = +a327;
+    a328 = +a328;
+    a329 = +a329;
+    a330 = +a330;
+    a331 = +a331;
+    a332 = +a332;
+    a333 = +a333;
+    a334 = +a334;
+    a335 = +a335;
+    a336 = +a336;
+    a337 = +a337;
+    a338 = +a338;
+    a339 = +a339;
+    a340 = +a340;
+    a341 = +a341;
+    a342 = +a342;
+    a343 = +a343;
+    a344 = +a344;
+    a345 = +a345;
+    a346 = +a346;
+    a347 = +a347;
+    a348 = +a348;
+    a349 = +a349;
+    a350 = +a350;
+    a351 = +a351;
+    a352 = +a352;
+    a353 = +a353;
+    a354 = +a354;
+    a355 = +a355;
+    a356 = +a356;
+    a357 = +a357;
+    a358 = +a358;
+    a359 = +a359;
+    a360 = +a360;
+    a361 = +a361;
+    a362 = +a362;
+    a363 = +a363;
+    a364 = +a364;
+    a365 = +a365;
+    a366 = +a366;
+    a367 = +a367;
+    a368 = +a368;
+    a369 = +a369;
+    a370 = +a370;
+    a371 = +a371;
+    a372 = +a372;
+    a373 = +a373;
+    a374 = +a374;
+    a375 = +a375;
+    a376 = +a376;
+    a377 = +a377;
+    a378 = +a378;
+    a379 = +a379;
+    a380 = +a380;
+    a381 = +a381;
+    a382 = +a382;
+    a383 = +a383;
+    a384 = +a384;
+    a385 = +a385;
+    a386 = +a386;
+    a387 = +a387;
+    a388 = +a388;
+    a389 = +a389;
+    a390 = +a390;
+    a391 = +a391;
+    a392 = +a392;
+    a393 = +a393;
+    a394 = +a394;
+    a395 = +a395;
+    a396 = +a396;
+    a397 = +a397;
+    a398 = +a398;
+    a399 = +a399;
+    a400 = +a400;
+    a401 = +a401;
+    a402 = +a402;
+    a403 = +a403;
+    a404 = +a404;
+    a405 = +a405;
+    a406 = +a406;
+    a407 = +a407;
+    a408 = +a408;
+    a409 = +a409;
+    a410 = +a410;
+    a411 = +a411;
+    a412 = +a412;
+    a413 = +a413;
+    a414 = +a414;
+    a415 = +a415;
+    a416 = +a416;
+    a417 = +a417;
+    a418 = +a418;
+    a419 = +a419;
+    a420 = +a420;
+    a421 = +a421;
+    a422 = +a422;
+    a423 = +a423;
+    a424 = +a424;
+    a425 = +a425;
+    a426 = +a426;
+    a427 = +a427;
+    a428 = +a428;
+    a429 = +a429;
+    a430 = +a430;
+    a431 = +a431;
+    a432 = +a432;
+    a433 = +a433;
+    a434 = +a434;
+    a435 = +a435;
+    a436 = +a436;
+    a437 = +a437;
+    a438 = +a438;
+    a439 = +a439;
+    a440 = +a440;
+    a441 = +a441;
+    a442 = +a442;
+    a443 = +a443;
+    a444 = +a444;
+    a445 = +a445;
+    a446 = +a446;
+    a447 = +a447;
+    a448 = +a448;
+    a449 = +a449;
+    a450 = +a450;
+    a451 = +a451;
+    a452 = +a452;
+    a453 = +a453;
+    a454 = +a454;
+    a455 = +a455;
+    a456 = +a456;
+    a457 = +a457;
+    a458 = +a458;
+    a459 = +a459;
+    a460 = +a460;
+    a461 = +a461;
+    a462 = +a462;
+    a463 = +a463;
+    a464 = +a464;
+    a465 = +a465;
+    a466 = +a466;
+    a467 = +a467;
+    a468 = +a468;
+    a469 = +a469;
+    a470 = +a470;
+    a471 = +a471;
+    a472 = +a472;
+    a473 = +a473;
+    a474 = +a474;
+    a475 = +a475;
+    a476 = +a476;
+    a477 = +a477;
+    a478 = +a478;
+    a479 = +a479;
+    a480 = +a480;
+    a481 = +a481;
+    a482 = +a482;
+    a483 = +a483;
+    a484 = +a484;
+    a485 = +a485;
+    a486 = +a486;
+    a487 = +a487;
+    a488 = +a488;
+    a489 = +a489;
+    a490 = +a490;
+    a491 = +a491;
+    a492 = +a492;
+    a493 = +a493;
+    a494 = +a494;
+    a495 = +a495;
+    a496 = +a496;
+    a497 = +a497;
+    a498 = +a498;
+    a499 = +a499;
+    a500 = +a500;
+    a501 = +a501;
+    a502 = +a502;
+    a503 = +a503;
+    a504 = +a504;
+    a505 = +a505;
+    a506 = +a506;
+    a507 = +a507;
+    a508 = +a508;
+    a509 = +a509;
+    a510 = +a510;
+    a511 = +a511;
+    a512 = +a512;
+    a513 = +a513;
+    a514 = +a514;
+    a515 = +a515;
+    a516 = +a516;
+    a517 = +a517;
+    a518 = +a518;
+    a519 = +a519;
+    a520 = +a520;
+    a521 = +a521;
+    a522 = +a522;
+    a523 = +a523;
+    a524 = +a524;
+    a525 = +a525;
+    a526 = +a526;
+    a527 = +a527;
+    a528 = +a528;
+    a529 = +a529;
+    a530 = +a530;
+    a531 = +a531;
+    a532 = +a532;
+    a533 = +a533;
+    a534 = +a534;
+    a535 = +a535;
+    a536 = +a536;
+    a537 = +a537;
+    a538 = +a538;
+    a539 = +a539;
+    a540 = +a540;
+    a541 = +a541;
+    a542 = +a542;
+    a543 = +a543;
+    a544 = +a544;
+    a545 = +a545;
+    a546 = +a546;
+    a547 = +a547;
+    a548 = +a548;
+    a549 = +a549;
+    a550 = +a550;
+    a551 = +a551;
+    a552 = +a552;
+    a553 = +a553;
+    a554 = +a554;
+    a555 = +a555;
+    a556 = +a556;
+    a557 = +a557;
+    a558 = +a558;
+    a559 = +a559;
+    a560 = +a560;
+    a561 = +a561;
+    a562 = +a562;
+    a563 = +a563;
+    a564 = +a564;
+    a565 = +a565;
+    a566 = +a566;
+    a567 = +a567;
+    a568 = +a568;
+    a569 = +a569;
+    a570 = +a570;
+    a571 = +a571;
+    a572 = +a572;
+    a573 = +a573;
+    a574 = +a574;
+    a575 = +a575;
+    a576 = +a576;
+    a577 = +a577;
+    a578 = +a578;
+    a579 = +a579;
+    a580 = +a580;
+    a581 = +a581;
+    a582 = +a582;
+    a583 = +a583;
+    a584 = +a584;
+    a585 = +a585;
+    a586 = +a586;
+    a587 = +a587;
+    a588 = +a588;
+    a589 = +a589;
+    a590 = +a590;
+    a591 = +a591;
+    a592 = +a592;
+    a593 = +a593;
+    a594 = +a594;
+    a595 = +a595;
+    a596 = +a596;
+    a597 = +a597;
+    a598 = +a598;
+    a599 = +a599;
+    a600 = +a600;
+    a601 = +a601;
+    a602 = +a602;
+    a603 = +a603;
+    a604 = +a604;
+    a605 = +a605;
+    a606 = +a606;
+    a607 = +a607;
+    a608 = +a608;
+    a609 = +a609;
+    a610 = +a610;
+    a611 = +a611;
+    a612 = +a612;
+    a613 = +a613;
+    a614 = +a614;
+    a615 = +a615;
+    a616 = +a616;
+    a617 = +a617;
+    a618 = +a618;
+    a619 = +a619;
+    a620 = +a620;
+    a621 = +a621;
+    a622 = +a622;
+    a623 = +a623;
+    a624 = +a624;
+    a625 = +a625;
+    a626 = +a626;
+    a627 = +a627;
+    a628 = +a628;
+    a629 = +a629;
+    a630 = +a630;
+    a631 = +a631;
+    a632 = +a632;
+    a633 = +a633;
+    a634 = +a634;
+    a635 = +a635;
+    a636 = +a636;
+    a637 = +a637;
+    a638 = +a638;
+    a639 = +a639;
+    a640 = +a640;
+    a641 = +a641;
+    a642 = +a642;
+    a643 = +a643;
+    a644 = +a644;
+    a645 = +a645;
+    a646 = +a646;
+    a647 = +a647;
+    a648 = +a648;
+    a649 = +a649;
+    a650 = +a650;
+    a651 = +a651;
+    a652 = +a652;
+    a653 = +a653;
+    a654 = +a654;
+    a655 = +a655;
+    a656 = +a656;
+    a657 = +a657;
+    a658 = +a658;
+    a659 = +a659;
+    a660 = +a660;
+    a661 = +a661;
+    a662 = +a662;
+    a663 = +a663;
+    a664 = +a664;
+    a665 = +a665;
+    a666 = +a666;
+    a667 = +a667;
+    a668 = +a668;
+    a669 = +a669;
+    a670 = +a670;
+    a671 = +a671;
+    a672 = +a672;
+    a673 = +a673;
+    a674 = +a674;
+    a675 = +a675;
+    a676 = +a676;
+    a677 = +a677;
+    a678 = +a678;
+    a679 = +a679;
+    a680 = +a680;
+    a681 = +a681;
+    a682 = +a682;
+    a683 = +a683;
+    a684 = +a684;
+    a685 = +a685;
+    a686 = +a686;
+    a687 = +a687;
+    a688 = +a688;
+    a689 = +a689;
+    a690 = +a690;
+    a691 = +a691;
+    a692 = +a692;
+    a693 = +a693;
+    a694 = +a694;
+    a695 = +a695;
+    a696 = +a696;
+    a697 = +a697;
+    a698 = +a698;
+    a699 = +a699;
+    a700 = +a700;
+    a701 = +a701;
+    a702 = +a702;
+    a703 = +a703;
+    a704 = +a704;
+    a705 = +a705;
+    a706 = +a706;
+    a707 = +a707;
+    a708 = +a708;
+    a709 = +a709;
+    a710 = +a710;
+    a711 = +a711;
+    a712 = +a712;
+    a713 = +a713;
+    a714 = +a714;
+    a715 = +a715;
+    a716 = +a716;
+    a717 = +a717;
+    a718 = +a718;
+    a719 = +a719;
+    a720 = +a720;
+    a721 = +a721;
+    a722 = +a722;
+    a723 = +a723;
+    a724 = +a724;
+    a725 = +a725;
+    a726 = +a726;
+    a727 = +a727;
+    a728 = +a728;
+    a729 = +a729;
+    a730 = +a730;
+    a731 = +a731;
+    a732 = +a732;
+    a733 = +a733;
+    a734 = +a734;
+    a735 = +a735;
+    a736 = +a736;
+    a737 = +a737;
+    a738 = +a738;
+    a739 = +a739;
+    a740 = +a740;
+    a741 = +a741;
+    a742 = +a742;
+    a743 = +a743;
+    a744 = +a744;
+    a745 = +a745;
+    a746 = +a746;
+    a747 = +a747;
+    a748 = +a748;
+    a749 = +a749;
+    a750 = +a750;
+    a751 = +a751;
+    a752 = +a752;
+    a753 = +a753;
+    a754 = +a754;
+    a755 = +a755;
+    a756 = +a756;
+    a757 = +a757;
+    a758 = +a758;
+    a759 = +a759;
+    a760 = +a760;
+    a761 = +a761;
+    a762 = +a762;
+    a763 = +a763;
+    a764 = +a764;
+    a765 = +a765;
+    a766 = +a766;
+    a767 = +a767;
+    a768 = +a768;
+    a769 = +a769;
+    a770 = +a770;
+    a771 = +a771;
+    a772 = +a772;
+    a773 = +a773;
+    a774 = +a774;
+    a775 = +a775;
+    a776 = +a776;
+    a777 = +a777;
+    a778 = +a778;
+    a779 = +a779;
+    a780 = +a780;
+    a781 = +a781;
+    a782 = +a782;
+    a783 = +a783;
+    a784 = +a784;
+    a785 = +a785;
+    a786 = +a786;
+    a787 = +a787;
+    a788 = +a788;
+    a789 = +a789;
+    a790 = +a790;
+    a791 = +a791;
+    a792 = +a792;
+    a793 = +a793;
+    a794 = +a794;
+    a795 = +a795;
+    a796 = +a796;
+    a797 = +a797;
+    a798 = +a798;
+    a799 = +a799;
+    a800 = +a800;
+    a801 = +a801;
+    a802 = +a802;
+    a803 = +a803;
+    a804 = +a804;
+    a805 = +a805;
+    a806 = +a806;
+    a807 = +a807;
+    a808 = +a808;
+    a809 = +a809;
+    a810 = +a810;
+    a811 = +a811;
+    a812 = +a812;
+    a813 = +a813;
+    a814 = +a814;
+    a815 = +a815;
+    a816 = +a816;
+    a817 = +a817;
+    a818 = +a818;
+    a819 = +a819;
+    a820 = +a820;
+    a821 = +a821;
+    a822 = +a822;
+    a823 = +a823;
+    a824 = +a824;
+    a825 = +a825;
+    a826 = +a826;
+    a827 = +a827;
+    a828 = +a828;
+    a829 = +a829;
+    a830 = +a830;
+    a831 = +a831;
+    a832 = +a832;
+    a833 = +a833;
+    a834 = +a834;
+    a835 = +a835;
+    a836 = +a836;
+    a837 = +a837;
+    a838 = +a838;
+    a839 = +a839;
+    a840 = +a840;
+    a841 = +a841;
+    a842 = +a842;
+    a843 = +a843;
+    a844 = +a844;
+    a845 = +a845;
+    a846 = +a846;
+    a847 = +a847;
+    a848 = +a848;
+    a849 = +a849;
+    a850 = +a850;
+    a851 = +a851;
+    a852 = +a852;
+    a853 = +a853;
+    a854 = +a854;
+    a855 = +a855;
+    a856 = +a856;
+    a857 = +a857;
+    a858 = +a858;
+    a859 = +a859;
+    a860 = +a860;
+    a861 = +a861;
+    a862 = +a862;
+    a863 = +a863;
+    a864 = +a864;
+    a865 = +a865;
+    a866 = +a866;
+    a867 = +a867;
+    a868 = +a868;
+    a869 = +a869;
+    a870 = +a870;
+    a871 = +a871;
+    a872 = +a872;
+    a873 = +a873;
+    a874 = +a874;
+    a875 = +a875;
+    a876 = +a876;
+    a877 = +a877;
+    a878 = +a878;
+    a879 = +a879;
+    a880 = +a880;
+    a881 = +a881;
+    a882 = +a882;
+    a883 = +a883;
+    a884 = +a884;
+    a885 = +a885;
+    a886 = +a886;
+    a887 = +a887;
+    a888 = +a888;
+    a889 = +a889;
+    a890 = +a890;
+    a891 = +a891;
+    a892 = +a892;
+    a893 = +a893;
+    a894 = +a894;
+    a895 = +a895;
+    a896 = +a896;
+    a897 = +a897;
+    a898 = +a898;
+    a899 = +a899;
+    a900 = +a900;
+    a901 = +a901;
+    a902 = +a902;
+    a903 = +a903;
+    a904 = +a904;
+    a905 = +a905;
+    a906 = +a906;
+    a907 = +a907;
+    a908 = +a908;
+    a909 = +a909;
+    a910 = +a910;
+    a911 = +a911;
+    a912 = +a912;
+    a913 = +a913;
+    a914 = +a914;
+    a915 = +a915;
+    a916 = +a916;
+    a917 = +a917;
+    a918 = +a918;
+    a919 = +a919;
+    a920 = +a920;
+    a921 = +a921;
+    a922 = +a922;
+    a923 = +a923;
+    a924 = +a924;
+    a925 = +a925;
+    a926 = +a926;
+    a927 = +a927;
+    a928 = +a928;
+    a929 = +a929;
+    a930 = +a930;
+    a931 = +a931;
+    a932 = +a932;
+    a933 = +a933;
+    a934 = +a934;
+    a935 = +a935;
+    a936 = +a936;
+    a937 = +a937;
+    a938 = +a938;
+    a939 = +a939;
+    a940 = +a940;
+    a941 = +a941;
+    a942 = +a942;
+    a943 = +a943;
+    a944 = +a944;
+    a945 = +a945;
+    a946 = +a946;
+    a947 = +a947;
+    a948 = +a948;
+    a949 = +a949;
+    a950 = +a950;
+    a951 = +a951;
+    a952 = +a952;
+    a953 = +a953;
+    a954 = +a954;
+    a955 = +a955;
+    a956 = +a956;
+    a957 = +a957;
+    a958 = +a958;
+    a959 = +a959;
+    a960 = +a960;
+    a961 = +a961;
+    a962 = +a962;
+    a963 = +a963;
+    a964 = +a964;
+    a965 = +a965;
+    a966 = +a966;
+    a967 = +a967;
+    a968 = +a968;
+    a969 = +a969;
+    a970 = +a970;
+    a971 = +a971;
+    a972 = +a972;
+    a973 = +a973;
+    a974 = +a974;
+    a975 = +a975;
+    a976 = +a976;
+    a977 = +a977;
+    a978 = +a978;
+    a979 = +a979;
+    a980 = +a980;
+    a981 = +a981;
+    a982 = +a982;
+    a983 = +a983;
+    a984 = +a984;
+    a985 = +a985;
+    a986 = +a986;
+    a987 = +a987;
+    a988 = +a988;
+    a989 = +a989;
+    a990 = +a990;
+    a991 = +a991;
+    a992 = +a992;
+    a993 = +a993;
+    a994 = +a994;
+    a995 = +a995;
+    a996 = +a996;
+    a997 = +a997;
+    a998 = +a998;
+    a999 = +a999;
+    a1000 = +a1000;
+    a1001 = +a1001;
+    a1002 = +a1002;
+    a1003 = +a1003;
+    a1004 = +a1004;
+    a1005 = +a1005;
+    return 10;
+  }
+  function bar() {
+    return foo(0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0,
+               0.0, 0.0, 0.0, 0.0, 1.0) |
+           0;
+  }
+  return bar
+})()();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-812005.js b/src/v8/test/mjsunit/regress/wasm/regress-812005.js
new file mode 100644
index 0000000..ba49987
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-812005.js
@@ -0,0 +1,15 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addFunction(undefined, kSig_d_v).addBody([
+  ...wasmF64Const(0),  // f64.const 0
+  ...wasmF64Const(0),  // f64.const 0
+  ...wasmI32Const(0),  // i32.const 0
+  kExprBrIf, 0x00,     // br_if depth=0
+  kExprF64Add          // f64.add
+]);
+builder.instantiate();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-816226.js b/src/v8/test/mjsunit/regress/wasm/regress-816226.js
new file mode 100644
index 0000000..1fca02f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-816226.js
@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(new Int8Array((new WebAssembly.Memory({initial: 0})).buffer)).buffer;
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-817380.js b/src/v8/test/mjsunit/regress/wasm/regress-817380.js
new file mode 100644
index 0000000..c7748d8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-817380.js
@@ -0,0 +1,24 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-lazy-compilation
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder1 = new WasmModuleBuilder();
+builder1.addFunction('mul', kSig_i_ii)
+    .addBody([kExprGetLocal, 0, kExprGetLocal, 1, kExprI32Mul])
+    .exportFunc();
+const mul = builder1.instantiate().exports.mul;
+const table = new WebAssembly.Table({
+  element: 'anyfunc',
+  initial: 10,
+});
+const builder2 = new WasmModuleBuilder();
+const mul_import = builder2.addImport('q', 'wasm_mul', kSig_i_ii);
+builder2.addImportedTable('q', 'table');
+const glob_import = builder2.addImportedGlobal('q', 'glob', kWasmI32);
+builder2.addElementSegment(0, glob_import, true, [mul_import]);
+builder2.instantiate(
+    {q: {glob: 0, js_div: i => i, wasm_mul: mul, table: table}});
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-819869.js b/src/v8/test/mjsunit/regress/wasm/regress-819869.js
new file mode 100644
index 0000000..a32928a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-819869.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+builder.addFunction(undefined, kSig_i_i)
+    .addLocals({i32_count: 0xffffffff})
+    .addBody([]);
+assertThrows(() => builder.instantiate(), WebAssembly.CompileError);
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-820802.js b/src/v8/test/mjsunit/regress/wasm/regress-820802.js
new file mode 100644
index 0000000..214e718
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-820802.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(16, 32);
+builder.addGlobal(kWasmI32, 0);
+const sig0 = makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]);
+builder.addFunction(undefined, sig0).addBody([
+  kExprI32Const, 1,  // i32.const 1
+  kExprI32Const, 0,  // i32.const 0
+  kExprI32Const, 3,  // i32.const 3
+  kExprI32GeU,       // i32.ge_u
+  kExprI32Rol,       // i32.rol
+]);
+builder.addExport('main', 0);
+const instance = builder.instantiate();
+assertEquals(1, instance.exports.main());
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-824681.js b/src/v8/test/mjsunit/regress/wasm/regress-824681.js
new file mode 100644
index 0000000..9d712e6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-824681.js
@@ -0,0 +1,19 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+let chain = Promise.resolve();
+const builder = new WasmModuleBuilder();
+for (let i = 0; i < 50; ++i) {
+  builder.addFunction('fun' + i, kSig_i_v)
+      .addBody([...wasmI32Const(i)])
+      .exportFunc();
+}
+const buffer = builder.toBuffer();
+for (let i = 0; i < 100; ++i) {
+  chain = chain.then(() => WebAssembly.instantiate(buffer));
+}
+chain.then(({module, instance}) => instance.exports.fun1155())
+    .then(res => print('Result of executing fun1155: ' + res));
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-825087a.js b/src/v8/test/mjsunit/regress/wasm/regress-825087a.js
new file mode 100644
index 0000000..9a986d0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-825087a.js
@@ -0,0 +1,9 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+PAGES = 10;
+memory = new WebAssembly.Memory({initial: PAGES});
+buffer = memory.buffer;
+memory.grow(0);
+WebAssembly.validate(buffer);
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-825087b.js b/src/v8/test/mjsunit/regress/wasm/regress-825087b.js
new file mode 100644
index 0000000..266fd53
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-825087b.js
@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+PAGES = 10;
+memory = new WebAssembly.Memory({initial: PAGES});
+buffer = memory.buffer;
+buffer = new Uint8Array(buffer);
+memory.grow(0);
+WebAssembly.validate(buffer);
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-827806.js b/src/v8/test/mjsunit/regress/wasm/regress-827806.js
new file mode 100644
index 0000000..8576de2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-827806.js
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+try {
+  (function () {
+    let m = new WasmModuleBuilder();
+    m.addFunction("sub", kSig_i_ii)
+    m.instantiate();
+  })();
+} catch (e) {
+  console.info("caught exception");
+  console.info(e);
+}
+for (let i = 0; i < 150; i++) {
+  var m = new WasmModuleBuilder();
+  m.addMemory(2);
+  m.instantiate();
+}
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-831463.js b/src/v8/test/mjsunit/regress/wasm/regress-831463.js
new file mode 100644
index 0000000..2818ad3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-831463.js
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-interpret-all
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+const builder = new WasmModuleBuilder();
+const sig = builder.addType(kSig_i_i);
+builder.addFunction('call', kSig_i_v)
+    .addBody([
+      kExprI32Const, 0, kExprI32Const, 0, kExprCallIndirect, sig, kTableZero
+    ])
+    .exportAs('call');
+builder.addImportedTable('imp', 'table');
+const table = new WebAssembly.Table({element: 'anyfunc', initial: 1});
+const instance = builder.instantiate({imp: {table: table}});
+assertThrows(
+    () => instance.exports.call(), WebAssembly.RuntimeError,
+    /function signature mismatch/);
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-834619.js b/src/v8/test/mjsunit/regress/wasm/regress-834619.js
new file mode 100644
index 0000000..1062d55
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-834619.js
@@ -0,0 +1,49 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-lazy-compilation
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function ExportedFunctionsImportedOrder() {
+  print(arguments.callee.name);
+
+  let i1 = (() => {
+    let builder = new WasmModuleBuilder();
+    builder.addFunction("f1", kSig_i_v)
+      .addBody(
+        [kExprI32Const, 1])
+      .exportFunc();
+    builder.addFunction("f2", kSig_i_v)
+      .addBody(
+        [kExprI32Const, 2])
+      .exportFunc();
+    return builder.instantiate();
+  })();
+
+  let i2 = (() => {
+    let builder = new WasmModuleBuilder();
+    builder.addImport("q", "f2", kSig_i_v);
+    builder.addImport("q", "f1", kSig_i_v);
+    builder.addTable(kWasmAnyFunc, 4);
+    builder.addFunction("main", kSig_i_i)
+      .addBody([
+        kExprGetLocal, 0,
+        kExprCallIndirect, 0, kTableZero
+      ])
+      .exportFunc();
+    builder.addElementSegment(0, 0, false, [0, 1, 1, 0]);
+
+    return builder.instantiate({q: {f2: i1.exports.f2, f1: i1.exports.f1}});
+  })();
+
+  print("--->calling 0");
+  assertEquals(2, i2.exports.main(0));
+  print("--->calling 1");
+  assertEquals(1, i2.exports.main(1));
+  print("--->calling 2");
+  assertEquals(1, i2.exports.main(2));
+  print("--->calling 3");
+  assertEquals(2, i2.exports.main(3));
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-834624.js b/src/v8/test/mjsunit/regress/wasm/regress-834624.js
new file mode 100644
index 0000000..45af23c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-834624.js
@@ -0,0 +1,29 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-interpret-all
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+let instance;
+(function DoTest() {
+  function call_main() {
+    instance.exports.main();
+  }
+  let module = new WasmModuleBuilder();
+  module.addImport('mod', 'func', kSig_v_i);
+  module.addFunction('main', kSig_v_i)
+    .addBody([kExprGetLocal, 0, kExprCallFunction, 0])
+    .exportFunc();
+  instance = module.instantiate({
+    mod: {
+      func: call_main
+    }
+  });
+  try {
+    instance.exports.main();
+  } catch (e) {
+    // ignore
+  }
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-834693.js b/src/v8/test/mjsunit/regress/wasm/regress-834693.js
new file mode 100644
index 0000000..ad51b2a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-834693.js
@@ -0,0 +1,19 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// flags: --wasm-lazy-compilation
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+var module = new WasmModuleBuilder();
+module.addMemory();
+module.addFunction("main", kSig_v_v)
+  .addBody([
+    kExprI32Const, 20,
+    kExprI32Const, 29,
+    kExprMemoryGrow, kMemoryZero,
+    kExprI32StoreMem, 0, 0xFF, 0xFF, 0x7A])
+  .exportAs("main");
+var instance = module.instantiate();
+assertTraps(kTrapMemOutOfBounds, instance.exports.main);
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-836141.js b/src/v8/test/mjsunit/regress/wasm/regress-836141.js
new file mode 100644
index 0000000..5ac5804
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-836141.js
@@ -0,0 +1,19 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(16, 32);
+builder.addFunction("test", kSig_i_v).addBody([
+  kExprI32Const, 12,         // i32.const 0
+]);
+
+let module = new WebAssembly.Module(builder.toBuffer());
+module.then = () => {
+  // Use setTimeout to get out of the promise chain.
+  setTimeout(assertUnreachable);
+};
+
+WebAssembly.instantiate(module);
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-837417.js b/src/v8/test/mjsunit/regress/wasm/regress-837417.js
new file mode 100644
index 0000000..ef1d3cf
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-837417.js
@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(16, 32);
+builder.addFunction("test", kSig_i_v).addBody([
+  kExprI32Const, 12,         // i32.const 12
+]);
+
+WebAssembly.Module.prototype.then = resolve => {
+  assertUnreachable();
+};
+
+WebAssembly.instantiate(builder.toBuffer());
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-840757.js b/src/v8/test/mjsunit/regress/wasm/regress-840757.js
new file mode 100644
index 0000000..ad1cf9f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-840757.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+// Also enable predictable mode. Otherwise, concurrent recompilation will be
+// enabled, and the code generator will not try to print the InliningStack
+// (see CodeGenerator::AssembleSourcePosition).
+// These preconditions make this test quite fragile, but it's the only way
+// currently to reproduce the crash.
+// Flags: --code-comments --predictable --print-wasm-code
+
+const builder = new WasmModuleBuilder();
+// Add a call instruction, because the segfault happens when processing source
+// positions.
+builder.addFunction('foo', kSig_v_v).addBody([]);
+builder.addFunction('test', kSig_v_v).addBody([kExprCallFunction, 0]);
+
+builder.instantiate();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-842501.js b/src/v8/test/mjsunit/regress/wasm/regress-842501.js
new file mode 100644
index 0000000..d54507c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-842501.js
@@ -0,0 +1,34 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-wasm-trap-handler
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function() {
+  const builder = new WasmModuleBuilder();
+  builder.addMemory(16, 32);
+  // Generate function 1 (out of 1).
+  sig1 = makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]);
+  builder.addFunction(undefined, sig1)
+    .addBodyWithEnd([
+      // signature: i_iii
+      // body:
+      kExprI32Const, 0xe1, 0xc8, 0xd5, 0x01,
+      kExprI32Const, 0xe2, 0xe4, 0x00,
+      kExprI32Sub,
+      kExprF32Const, 0x00, 0x00, 0x00, 0x00,
+      kExprF32Const, 0xc9, 0xc9, 0xc9, 0x00,
+      kExprF32Eq,
+      kExprI32LoadMem, 0x01, 0xef, 0xec, 0x95, 0x93, 0x07,
+      kExprI32Add,
+      kExprIf, kWasmStmt,   // @30
+      kExprEnd,             // @32
+      kExprI32Const, 0xc9, 0x93, 0xdf, 0xcc, 0x7c,
+      kExprEnd,             // @39
+    ]);
+  builder.addExport('main', 0);
+  const instance = builder.instantiate();
+  assertTraps(kTrapMemOutOfBounds, _ => instance.exports.main(1, 2, 3));
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-843563.js b/src/v8/test/mjsunit/regress/wasm/regress-843563.js
new file mode 100644
index 0000000..ca22299
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-843563.js
@@ -0,0 +1,19 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+sig1 = makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]);
+const imp_idx = builder.addImport('q', 'imp', kSig_i_i);
+builder.addExport('exp', imp_idx);
+const module = builder.toModule();
+
+function bad(a, b, c, d, e, f, g, h) {
+    print(JSON.stringify([a, b, c, d, e, f, g, h]));
+}
+const instance1 = new WebAssembly.Instance(module, {q: {imp: bad}});
+const instance2 = new WebAssembly.Instance(module, {q: {imp: i => i}});
+
+print(instance1.exports.exp(5));
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-8505.js b/src/v8/test/mjsunit/regress/wasm/regress-8505.js
new file mode 100644
index 0000000..0488723
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-8505.js
@@ -0,0 +1,203 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --wasm-math-intrinsics  --validate-asm --allow-natives-syntax
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+function verbose(args) {
+  // print(...args);
+}
+
+//=============================================
+// Global count of failures
+//=============================================
+let numFailures = 0;
+
+function reportFailure(name, vals, m, w) {
+  print("  error: " + name + "(" + vals + ") == " + w + ", expected " + m);
+  numFailures++;
+}
+
+let global_imports = {Math: Math};
+
+let inputs = [
+  1 / 0,
+  -1 / 0,
+  0 / 0,
+  -2.70497e+38,
+  -1.4698e+37,
+  -1.22813e+35,
+  -1.34584e+34,
+  -1.0079e+32,
+  -6.49364e+26,
+  -3.06077e+25,
+  -1.46821e+25,
+  -1.17658e+23,
+  -1.9617e+22,
+  -2.7357e+20,
+  -9223372036854775808.0,  // INT64_MIN
+  -1.48708e+13,
+  -1.89633e+12,
+  -4.66622e+11,
+  -2.22581e+11,
+  -1.45381e+10,
+  -2147483904.0,  // First float32 after INT32_MIN
+  -2147483648.0,  // INT32_MIN
+  -2147483520.0,  // Last float32 before INT32_MIN
+  -1.3956e+09,
+  -1.32951e+09,
+  -1.30721e+09,
+  -1.19756e+09,
+  -9.26822e+08,
+  -5.09256e+07,
+  -964300.0,
+  -192446.0,
+  -28455.0,
+  -27194.0,
+  -20575.0,
+  -17069.0,
+  -9167.0,
+  -960.178,
+  -113.0,
+  -62.0,
+  -15.0,
+  -7.0,
+  -1.0,
+  -0.0256635,
+  -4.60374e-07,
+  -3.63759e-10,
+  -4.30175e-14,
+  -5.27385e-15,
+  -1.5707963267948966,
+  -1.48084e-15,
+  -2.220446049250313e-16,
+  -1.05755e-19,
+  -3.2995e-21,
+  -1.67354e-23,
+  -1.11885e-23,
+  -1.78506e-30,
+  -1.43718e-34,
+  -1.27126e-38,
+  -0.0,
+  3e-88,
+  -2e66,
+  0.0,
+  2e66,
+  1.17549e-38,
+  1.56657e-37,
+  4.08512e-29,
+  6.25073e-22,
+  4.1723e-13,
+  1.44343e-09,
+  1.5707963267948966,
+  5.27004e-08,
+  9.48298e-08,
+  5.57888e-07,
+  4.89988e-05,
+  0.244326,
+  1.0,
+  12.4895,
+  19.0,
+  47.0,
+  106.0,
+  538.324,
+  564.536,
+  819.124,
+  7048.0,
+  12611.0,
+  19878.0,
+  20309.0,
+  797056.0,
+  1.77219e+09,
+  2147483648.0,  // INT32_MAX + 1
+  4294967296.0,  // UINT32_MAX + 1
+  1.51116e+11,
+  4.18193e+13,
+  3.59167e+16,
+  9223372036854775808.0,   // INT64_MAX + 1
+  18446744073709551616.0,  // UINT64_MAX + 1
+  3.38211e+19,
+  2.67488e+20,
+  1.78831e+21,
+  9.20914e+21,
+  8.35654e+23,
+  1.4495e+24,
+  5.94015e+25,
+  4.43608e+30,
+  2.44502e+33,
+  1.38178e+37,
+  1.71306e+37,
+  3.31899e+38,
+  3.40282e+38,
+];
+
+function assertBinop(name, math_func, wasm_func) {
+  let inputs2 = [ 1, 0.5, -1, -0.5,  0, -0, 1/0, -1/0, 0/0 ];
+  for (val of inputs) {
+    verbose("  ", val);
+    for (val2 of inputs2) {
+      verbose("    ", val2);
+      let m = math_func(val, val2);
+      let w = wasm_func(val, val2);
+      if (!deepEquals(m, w)) reportFailure(name, [val, val2], m, w);
+      m = math_func(val2, val);
+      w = wasm_func(val2, val);
+      if (!deepEquals(m, w)) reportFailure(name, [val2, val], m, w);
+    }
+  }
+}
+
+let stdlib = this;
+function Module_exp(stdlib) {
+  "use asm";
+
+  var Stdlib = stdlib.Math.exp;
+
+  function NAME(a, b) {
+    a = +a;
+    b = +b;
+    return +Stdlib(a, b);
+  }
+
+  return {exp: exp};
+}
+
+function wasmBinop(name, sig) {
+  var builder = new WasmModuleBuilder();
+
+  var sig_index = builder.addType(sig);
+  builder.addImport('Math', name, sig_index);
+  builder.addFunction('main', sig_index)
+      .addBody([
+        kExprGetLocal, 0,  // --
+        kExprGetLocal, 1,  // --
+        kExprCallFunction, 0
+      ])  // --
+      .exportAs('main');
+
+  return builder.instantiate(global_imports).exports.main;
+}
+
+function asmBinop(name) {
+  let instance = Module_exp(stdlib);
+  assertTrue(%IsAsmWasmCode(Module_exp));
+
+  let asm_func = instance[name];
+  if (typeof asm_func != "function") throw "asm[" + full_name + "] not found";
+  return asm_func;
+}
+
+(function TestF64() {
+  let name = 'exp';
+  let math_func = Math[name];
+
+  let wasm_func = wasmBinop(name, kSig_d_dd);
+  assertBinop("(f64)" + name, math_func, wasm_func);
+
+  let asm_func = asmBinop(name);
+  assertBinop("(f64)" + name, math_func, asm_func);
+})();
+
+assertEquals(0, numFailures);
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-8533.js b/src/v8/test/mjsunit/regress/wasm/regress-8533.js
new file mode 100644
index 0000000..da5f449
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-8533.js
@@ -0,0 +1,84 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-shared-engine --no-wasm-disable-structured-cloning --allow-natives-syntax --experimental-wasm-threads
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+
+// In  this test we start a worker which enters wasm and stays there in a loop.
+// The main thread stays in JS and checks that its thread-in-wasm flag is not
+// set. The main thread calls setTimeout after every check to give the worker a
+// chance to be scheculed.
+const sync_address = 12;
+(function TestPostModule() {
+  let builder = new WasmModuleBuilder();
+  let sig_index = builder.addType(kSig_v_v);
+  let import_id = builder.addImport('m', 'func', sig_index);
+  builder.addFunction('wait', kSig_v_v)
+      .addBody([
+        // Calling the imported function sets the thread-in-wasm flag of the
+        // main thread.
+        kExprCallFunction, import_id,  // --
+        kExprLoop, kWasmStmt,          // --
+        kExprI32Const, sync_address,   // --
+        kExprI32LoadMem, 0, 0,         // --
+        kExprI32Eqz,
+        kExprBrIf, 0,                  // --
+        kExprEnd,
+      ])
+      .exportFunc();
+
+  builder.addFunction('signal', kSig_v_v)
+      .addBody([
+        kExprI32Const, sync_address,  // --
+        kExprI32Const, 1,             // --
+        kExprI32StoreMem, 0, 0,       // --
+        ])
+      .exportFunc();
+  builder.addImportedMemory("m", "imported_mem", 0, 1, "shared");
+
+  let module = builder.toModule();
+  let memory = new WebAssembly.Memory({initial: 1, maximum: 1, shared: true});
+
+  let workerScript = `
+    onmessage = function(msg) {
+      try {
+        let worker_instance = new WebAssembly.Instance(msg.module,
+            {m: {imported_mem: msg.memory,
+                 func: _ => 5}});
+        postMessage("start running");
+        worker_instance.exports.wait();
+        postMessage("finished");
+      } catch(e) {
+        postMessage('ERROR: ' + e);
+      }
+    }
+  `;
+
+  let worker = new Worker(workerScript, {type: 'string'});
+  worker.postMessage({module: module, memory: memory});
+
+  let main_instance = new WebAssembly.Instance(
+      module, {m: {imported_mem: memory, func: _ => 7}});
+
+  let counter = 0;
+  function CheckThreadNotInWasm() {
+    // We check the thread-in-wasm flag many times and reschedule ourselves in
+    // between to increase the chance that we read the flag set by the worker.
+    assertFalse(%IsThreadInWasm());
+    counter++;
+    if (counter < 100) {
+      setTimeout(CheckThreadNotInWasm, 0);
+    } else {
+      main_instance.exports.signal(sync_address);
+      assertEquals('finished', worker.getMessage());
+      worker.terminate();
+    }
+  }
+
+  assertFalse(%IsThreadInWasm());
+  assertEquals('start running', worker.getMessage());
+  CheckThreadNotInWasm();
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-853453.js b/src/v8/test/mjsunit/regress/wasm/regress-853453.js
new file mode 100644
index 0000000..fcf5f67
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-853453.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-threads
+
+assertThrows(() => new WebAssembly.Module(
+    new Uint8Array([
+      0x00, 0x61, 0x73, 0x6d,     // wasm magic
+      0x01, 0x00, 0x00, 0x00,     // wasm version
+      0x04,                       // section code
+      0x04,                       // section length
+      /* Section: Table */
+      0x01,                       // table count
+      0x70,                       // table type
+      0x03,                       // resizable limits flags
+      0x00])),
+    WebAssembly.CompileError);
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-854011.js b/src/v8/test/mjsunit/regress/wasm/regress-854011.js
new file mode 100644
index 0000000..b0356a8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-854011.js
@@ -0,0 +1,46 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addFunction('main', kSig_d_d)
+    .addBody([
+      // Call with param 0 (converted to i64), to fill the stack with non-zero
+      // values.
+      kExprGetLocal, 0, kExprI64SConvertF64,  // arg 0
+      kExprGetLocal, 0, kExprI64SConvertF64,  // arg 1
+      kExprGetLocal, 0, kExprI64SConvertF64,  // arg 2
+      kExprGetLocal, 0, kExprI64SConvertF64,  // arg 3
+      kExprGetLocal, 0, kExprI64SConvertF64,  // arg 4
+      kExprGetLocal, 0, kExprI64SConvertF64,  // arg 5
+      kExprGetLocal, 0, kExprI64SConvertF64,  // arg 6
+      kExprGetLocal, 0, kExprI64SConvertF64,  // arg 7
+      kExprCallFunction, 1,                   // call #1
+      // Now call with 0 constants.
+      // The bug was that they were written out as i32 values, thus the upper 32
+      // bit were the previous values on that stack memory.
+      kExprI64Const, 0,      // i64.const 0  [0]
+      kExprI64Const, 0,      // i64.const 0  [1]
+      kExprI64Const, 0,      // i64.const 0  [2]
+      kExprI64Const, 0,      // i64.const 0  [3]
+      kExprI64Const, 0,      // i64.const 0  [4]
+      kExprI64Const, 0,      // i64.const 0  [5]
+      kExprI64Const, 0,      // i64.const 0  [6]
+      kExprI64Const, 0,      // i64.const 0  [7]
+      kExprCallFunction, 1,  // call #1
+      // Return the sum of the two returned values.
+      kExprF64Add
+    ])
+    .exportFunc();
+builder.addFunction(undefined, makeSig(new Array(8).fill(kWasmI64), [kWasmF64]))
+    .addBody([
+      kExprGetLocal, 7,     // get_local 7 (last parameter)
+      kExprF64SConvertI64,  // f64.convert_s/i64
+    ]);
+const instance = builder.instantiate();
+const big_num_1 = 2 ** 48;
+const big_num_2 = 2 ** 56 / 3;
+assertEquals(big_num_1, instance.exports.main(big_num_1));
+assertEquals(big_num_2, instance.exports.main(big_num_2));
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-854050.js b/src/v8/test/mjsunit/regress/wasm/regress-854050.js
new file mode 100644
index 0000000..d6c4829
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-854050.js
@@ -0,0 +1,27 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addFunction(undefined, makeSig([kWasmI32, kWasmF32], []))
+    .addLocals({i32_count: 7})
+    .addBody([
+      kExprGetLocal,    0,          // get_local
+      kExprI32Const,    0,          // i32.const 0
+      kExprIf,          kWasmStmt,  // if
+      kExprUnreachable,             // unreachable
+      kExprEnd,                     // end if
+      kExprGetLocal,    4,          // get_local
+      kExprTeeLocal,    8,          // tee_local
+      kExprBrIf,        0,          // br_if depth=0
+      kExprTeeLocal,    7,          // tee_local
+      kExprTeeLocal,    0,          // tee_local
+      kExprTeeLocal,    2,          // tee_local
+      kExprTeeLocal,    8,          // tee_local
+      kExprDrop,                    // drop
+      kExprLoop,        kWasmStmt,  // loop
+      kExprEnd,                     // end loop
+    ]);
+builder.instantiate();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-864509.js b/src/v8/test/mjsunit/regress/wasm/regress-864509.js
new file mode 100644
index 0000000..19e3bfc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-864509.js
@@ -0,0 +1,61 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --liftoff --no-wasm-tier-up --no-future --wasm-tier-mask-for-testing=2
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(1, 1);
+// First function is Liftoff. The first parameter is used as memory offset.
+builder.addFunction(undefined, kSig_v_i).addBody([
+  kExprGetLocal, 0,        // get_local 0
+  kExprI32Const, 0,        // i32.const 0
+  kExprI32StoreMem, 0, 0,  // i32.store offset=0
+]);
+// Second function is Turbofan. It loads the sixth parameter from the stack
+// into a register for the first argument. Even though it's a 32-bit value, it
+// is loaded as 64-bit value on x64.
+builder.addFunction(undefined, makeSig(new Array(6).fill(kWasmI32), []))
+    .addBody([
+      kExprGetLocal, 5,     // get_local 5
+      kExprCallFunction, 0  // call 0
+    ]);
+// The third function is Liftoff again. A value is spilled on the stack as i32,
+// then used as a call argument, passed via the stack. The full 64-bit are
+// copied on the stack, even though just 32-bit were written before. Hence, the
+// stack slot is not zero-extended.
+const gen_i32_code = [
+  kExprTeeLocal, 0,  // tee_local 0
+  kExprGetLocal, 0,  // get_local 0
+  kExprI32Const, 1,  // i32.const 1
+  kExprI32Add        // i32.add     --> 2nd param
+];
+builder.addFunction(undefined, kSig_v_v).addLocals({i32_count: 1}).addBody([
+  // Generate six values on the stack, then six more to force the other six on
+  // the stack.
+  ...wasmI32Const(0),    // i32.const 0
+  ...wasmI32Const(1),    // i32.const 1
+  kExprI32Add,           // i32.add --> 1st param
+  ...gen_i32_code,       // --> 2nd param
+  ...gen_i32_code,       // --> 3rd param
+  ...gen_i32_code,       // --> 4th param
+  ...gen_i32_code,       // --> 5th param
+  ...gen_i32_code,       // --> 6th param
+  ...gen_i32_code,       // --> garbage
+  ...gen_i32_code,       // --> garbage
+  ...gen_i32_code,       // --> garbage
+  ...gen_i32_code,       // --> garbage
+  ...gen_i32_code,       // --> garbage
+  ...gen_i32_code,       // --> garbage
+  kExprDrop,             // drop garbage
+  kExprDrop,             // drop garbage
+  kExprDrop,             // drop garbage
+  kExprDrop,             // drop garbage
+  kExprDrop,             // drop garbage
+  kExprDrop,             // drop garbage
+  kExprCallFunction,  1  // call 1
+]).exportAs('three');
+const instance = builder.instantiate();
+instance.exports.three();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-873600.js b/src/v8/test/mjsunit/regress/wasm/regress-873600.js
new file mode 100644
index 0000000..b3f2d73
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-873600.js
@@ -0,0 +1,50 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function DoTest() {
+
+  var stdlib = this;
+  try {
+    var buffer = new ArrayBuffer((2097120) * 1024);
+  } catch (e) {
+    // Out of memory: soft pass because 2GiB is actually a lot!
+    print("OOM: soft pass");
+    return;
+  }
+  var foreign = {}
+
+  var m = (function Module(stdlib, foreign, heap) {
+    "use asm";
+    var MEM16 = new stdlib.Int16Array(heap);
+    function load(i) {
+      i = i|0;
+      i = MEM16[i >> 1]|0;
+      return i | 0;
+    }
+    function store(i, v) {
+      i = i|0;
+      v = v|0;
+      MEM16[i >> 1] = v;
+    }
+    function load8(i) {
+      i = i|0;
+      i = MEM16[i + 8 >> 1]|0;
+      return i | 0;
+    }
+    function store8(i, v) {
+      i = i|0;
+      v = v|0;
+      MEM16[i + 8 >> 1] = v;
+    }
+    return { load: load, store: store, load8: load8, store8: store8 };
+  })(stdlib, foreign, buffer);
+
+  assertEquals(0, m.load(-8));
+  assertEquals(0, m.load8(-16));
+  m.store(2014, 2, 30, 1, 0);
+  assertEquals(0, m.load8(-8));
+  m.store8(-8, 99);
+  assertEquals(99, m.load(0));
+  assertEquals(99, m.load8(-8));
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-875556.js b/src/v8/test/mjsunit/regress/wasm/regress-875556.js
new file mode 100644
index 0000000..cc8bc5c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-875556.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+// Flags: --expose-wasm --experimental-wasm-mv
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function() {
+  const builder = new WasmModuleBuilder();
+  // Generate function 1 (out of 2).
+  sig1 = makeSig([kWasmI32], []);
+  builder.addFunction("main", sig1).addBodyWithEnd([
+    // signature: v_i
+    // body:
+    kExprBlock,
+  ]);
+  assertThrows(function() { builder.instantiate(); }, WebAssembly.CompileError);
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-8846.js b/src/v8/test/mjsunit/regress/wasm/regress-8846.js
new file mode 100644
index 0000000..e508572
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-8846.js
@@ -0,0 +1,27 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-eh --wasm-test-streaming
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function TestAsyncCompileExceptionSection() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_v);
+  builder.addFunction("thrw", kSig_v_v)
+      .addBody([
+        kExprThrow, except,
+      ]).exportFunc();
+  function step1(buffer) {
+    assertPromiseResult(WebAssembly.compile(buffer), module => step2(module));
+  }
+  function step2(module) {
+    assertPromiseResult(WebAssembly.instantiate(module), inst => step3(inst));
+  }
+  function step3(instance) {
+    assertThrows(() => instance.exports.thrw(), WebAssembly.RuntimeError);
+  }
+  step1(builder.toBuffer());
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-8896.js b/src/v8/test/mjsunit/regress/wasm/regress-8896.js
new file mode 100644
index 0000000..51f1b27
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-8896.js
@@ -0,0 +1,23 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-eh --allow-natives-syntax
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function TestSerializeDeserializeRuntimeCall() {
+  var builder = new WasmModuleBuilder();
+  var except = builder.addException(kSig_v_v);
+  builder.addFunction("f", kSig_v_v)
+      .addBody([
+        kExprThrow, except,
+      ]).exportFunc();
+  var wire_bytes = builder.toBuffer();
+  var module = new WebAssembly.Module(wire_bytes);
+  var instance1 = new WebAssembly.Instance(module);
+  var serialized = %SerializeWasmModule(module);
+  module = %DeserializeWasmModule(serialized, wire_bytes);
+  var instance2 = new WebAssembly.Instance(module);
+  assertThrows(() => instance2.exports.f(), WebAssembly.RuntimeError);
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-894307.js b/src/v8/test/mjsunit/regress/wasm/regress-894307.js
new file mode 100644
index 0000000..f40388f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-894307.js
@@ -0,0 +1,15 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+const sig = makeSig([kWasmI32, kWasmI64, kWasmI64], [kWasmI64]);
+builder.addFunction(undefined, sig)
+  .addBody([
+    kExprGetLocal, 2,
+    kExprGetLocal, 1,
+    kExprI64Shl,
+]);
+builder.instantiate();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-894374.js b/src/v8/test/mjsunit/regress/wasm/regress-894374.js
new file mode 100644
index 0000000..02be008
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-894374.js
@@ -0,0 +1,19 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(16, 32, false);
+const sig = makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]);
+builder.addFunction(undefined, sig)
+  .addBodyWithEnd([
+    kExprMemorySize, 0,
+    kExprI32Const, 0,
+    kExprI64Const, 0,
+    kExprI64StoreMem8, 0, 0,
+    kExprEnd,
+  ]);
+builder.addExport('main', 0);
+builder.instantiate();  // shouldn't crash
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-898932.js b/src/v8/test/mjsunit/regress/wasm/regress-898932.js
new file mode 100644
index 0000000..e3d1bbf
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-898932.js
@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-max-mem-pages=49152
+
+let mem = new WebAssembly.Memory({initial: 1});
+try {
+  mem.grow(49151);
+} catch (e) {
+  // This can fail on 32-bit systems if we cannot make such a big reservation.
+  if (!(e instanceof RangeError)) throw e;
+}
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-9017.js b/src/v8/test/mjsunit/regress/wasm/regress-9017.js
new file mode 100644
index 0000000..7a8930a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-9017.js
@@ -0,0 +1,38 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --liftoff --nowasm-tier-up
+//
+// This test is intended to make Liftoff generate code that uses a very large
+// stack frame, and then try to call another function (which would write to the
+// stack pointer location). On Windows, large frames need extra code to touch
+// every page in order, because the OS only leaves a small guard area for the
+// stack, and trying to access past that area, even into memory that was
+// intentionally reserved for this thread's stack, will crash the program.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+
+var func_idx = builder.addFunction('helper', kSig_i_v)
+    .addLocals({i32_count: 1})
+    .addBody([
+        kExprI32Const, 0x01,
+    ]).index;
+
+var large_function_body = [];
+const num_temporaries = 16 * 1024;
+for (let i = 0; i < num_temporaries; ++i) {
+  large_function_body.push(kExprCallFunction, func_idx);
+}
+for (let i = 1; i < num_temporaries; ++i) {
+  large_function_body.push(kExprI32Add);
+}
+
+builder.addFunction('test', kSig_i_v)
+    .addBody(large_function_body)
+    .exportFunc();
+var module = builder.instantiate();
+
+assertEquals(num_temporaries, module.exports.test());
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-905815.js b/src/v8/test/mjsunit/regress/wasm/regress-905815.js
new file mode 100644
index 0000000..b49881f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-905815.js
@@ -0,0 +1,26 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function() {
+  const builder = new WasmModuleBuilder();
+  builder.addType(makeSig([], []));
+  builder.addType(makeSig([kWasmI32], [kWasmI32]));
+  builder.addFunction(undefined, 0 /* sig */)
+    .addBodyWithEnd([
+        kExprEnd,   // @1
+    ]);
+  builder.addFunction(undefined, 1 /* sig */)
+    .addLocals({i32_count: 65})
+    .addBodyWithEnd([
+        kExprLoop, kWasmStmt,   // @3
+        kSimdPrefix,
+        kExprF32x4Min,
+        kExprI64UConvertI32,
+        kExprI64RemS,
+        kExprUnreachable,
+        kExprLoop, 0x02,   // @10
+    ]);
+})
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-910824.js b/src/v8/test/mjsunit/regress/wasm/regress-910824.js
new file mode 100644
index 0000000..b795425
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-910824.js
@@ -0,0 +1,36 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addGlobal(kWasmI32, 1);
+builder.addGlobal(kWasmF32, 1);
+builder.addType(makeSig([kWasmI32, kWasmF32, kWasmF32, kWasmF64], [kWasmI32]));
+builder.addFunction(undefined, 0 /* sig */)
+  .addLocals({i32_count: 504})
+  .addBody([
+kExprGetGlobal, 0x00,
+kExprSetLocal, 0x04,
+kExprGetLocal, 0x04,
+kExprI32Const, 0x01,
+kExprI32Sub,
+kExprGetGlobal, 0x00,
+kExprI32Const, 0x00,
+kExprI32Eqz,
+kExprGetGlobal, 0x00,
+kExprI32Const, 0x01,
+kExprI32Const, 0x01,
+kExprI32Sub,
+kExprGetGlobal, 0x00,
+kExprI32Const, 0x00,
+kExprI32Eqz,
+kExprGetGlobal, 0x00,
+kExprI32Const, 0x00,
+kExprI32Const, 0x01,
+kExprI32Sub,
+kExprGetGlobal, 0x01,
+kExprUnreachable,
+]);
+builder.instantiate();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-913804.js b/src/v8/test/mjsunit/regress/wasm/regress-913804.js
new file mode 100644
index 0000000..e9d4026
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-913804.js
@@ -0,0 +1,16 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addFunction('main', kSig_v_v).addBody([
+  kExprLoop, kWasmStmt,        // loop
+  /**/ kExprBr, 0x01,          //   br depth=1
+  /**/ kExprBlock, kWasmStmt,  //   block
+  /**/ /**/ kExprBr, 0x02,     //     br depth=2
+  /**/ /**/ kExprEnd,          //     end [block]
+  /**/ kExprEnd                //   end [loop]
+]);
+builder.instantiate();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-916869.js b/src/v8/test/mjsunit/regress/wasm/regress-916869.js
new file mode 100644
index 0000000..30bb011
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-916869.js
@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+const sig = builder.addType(makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]));
+builder.addFunction('main', sig)
+    .addBody([kExprI32Const, 0x01, kExprI32SExtendI8])
+    .exportFunc();
+const instance = builder.instantiate();
+assertEquals(1, instance.exports.main());
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-917412.js b/src/v8/test/mjsunit/regress/wasm/regress-917412.js
new file mode 100644
index 0000000..b74572a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-917412.js
@@ -0,0 +1,33 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+const sig = builder.addType(makeSig([kWasmI32, kWasmI64], []));
+builder.addFunction(undefined, sig)
+  .addBody([
+kExprI32Const, 0,
+kExprIf, kWasmI32,
+  kExprI32Const, 0,
+kExprElse,
+  kExprI32Const, 1,
+  kExprEnd,
+kExprTeeLocal, 0,
+kExprGetLocal, 0,
+kExprLoop, kWasmStmt,
+  kExprI64Const, 0x80, 0x80, 0x80, 0x70,
+  kExprSetLocal, 0x01,
+  kExprI32Const, 0x00,
+  kExprIf, kWasmI32,
+    kExprI32Const, 0x00,
+  kExprElse,
+    kExprI32Const, 0x00,
+    kExprEnd,
+  kExprBrIf, 0x00,
+  kExprUnreachable,
+  kExprEnd,
+kExprUnreachable,
+]);
+builder.instantiate();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-917588.js b/src/v8/test/mjsunit/regress/wasm/regress-917588.js
new file mode 100644
index 0000000..b078144
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-917588.js
@@ -0,0 +1,25 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+const sig = builder.addType(makeSig([], [kWasmF64]));
+builder.addFunction(undefined, sig)
+  .addLocals({f32_count: 5}).addLocals({f64_count: 3})
+  .addBody([
+kExprBlock, kWasmF64,
+  kExprF64Const, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf0, 0x3f,
+  kExprF64Const, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  kExprI32Const, 0,
+  kExprIf, kWasmI32,
+    kExprI32Const, 0,
+  kExprElse,
+    kExprI32Const, 1,
+    kExprEnd,
+  kExprBrIf, 0,
+  kExprUnreachable,
+kExprEnd
+]);
+builder.instantiate();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-917588b.js b/src/v8/test/mjsunit/regress/wasm/regress-917588b.js
new file mode 100644
index 0000000..1e5c1a4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-917588b.js
@@ -0,0 +1,54 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+const sig0 = builder.addType(makeSig([kWasmF32], [kWasmI32]));
+const sig1 = builder.addType(makeSig([kWasmI64, kWasmI32, kWasmI64, kWasmF32, kWasmI64], [kWasmF32]));
+const sig2 = builder.addType(makeSig([kWasmF32], [kWasmF32]));
+// Generate function 1 (out of 3).
+builder.addFunction(undefined, sig0).addBody([kExprI32Const, 0x00]);
+// Generate function 2 (out of 3).
+builder.addFunction(undefined, sig1)
+  .addBody([
+    // signature: f_lilfl
+    kExprBlock, kWasmF32,   // @1 f32
+    kExprI32Const, 0x00,
+    kExprIf, kWasmStmt,   // @5
+      kExprLoop, kWasmStmt,   // @7
+        kExprBlock, kWasmI32,   // @9 i32
+          kExprF32Const, 0x00, 0x00, 0x80, 0xc1,
+          kExprF32Const, 0x00, 0x00, 0x80, 0x45,
+          kExprCallFunction, 0x00, // function #0: i_f
+          kExprBrIf, 0x03,   // depth=3
+          kExprDrop,
+          kExprI32Const, 0xd8, 0x00,
+          kExprEnd,   // @29
+        kExprBrIf, 0x00,   // depth=0
+        kExprEnd,   // @32
+      kExprF32Const, 0x00, 0x00, 0x80, 0x3f,
+      kExprF32Const, 0x00, 0x00, 0x80, 0xc6,
+      kExprBlock, kWasmI32,   // @43 i32
+        kExprF32Const, 0x00, 0x00, 0x80, 0x3f,
+        kExprCallFunction, 0x02, // function #2: f_f
+        kExprDrop,
+        kExprI32Const, 0x68,
+        kExprEnd,   // @55
+      kExprBrIf, 0x01,   // depth=1
+      kExprI32Const, 0x00,
+      kExprSelect,
+      kExprDrop,
+      kExprUnreachable,
+    kExprElse,   // @63
+      kExprNop,
+      kExprEnd,   // @65
+    kExprF32Const, 0x00, 0x00, 0x69, 0x43,
+    kExprEnd   // @71
+]);
+// Generate function 3 (out of 3).
+builder.addFunction(undefined, sig2).addBody([
+  kExprF32Const, 0x00, 0x00, 0x80, 0x3f
+]);
+builder.instantiate();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-918149.js b/src/v8/test/mjsunit/regress/wasm/regress-918149.js
new file mode 100644
index 0000000..cc79030
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-918149.js
@@ -0,0 +1,11 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+const sig =
+    builder.addType(makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI64]));
+builder.addFunction('main', sig).addBody([kExprI64Const, 1, kExprI64SExtendI8]);
+builder.instantiate();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-918284.js b/src/v8/test/mjsunit/regress/wasm/regress-918284.js
new file mode 100644
index 0000000..dadbf3f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-918284.js
@@ -0,0 +1,20 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addFunction(undefined, kSig_i_i)
+  .addLocals({i32_count: 7})
+  .addBody([
+    kExprI32Const, 0,
+    kExprIf, kWasmI32,   // @11 i32
+      kExprI32Const, 0,
+    kExprElse,   // @15
+      kExprI32Const, 1,
+      kExprEnd,   // @18
+    kExprTeeLocal, 0,
+    kExprI32Popcnt
+]);
+builder.instantiate();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-918917.js b/src/v8/test/mjsunit/regress/wasm/regress-918917.js
new file mode 100644
index 0000000..f007957
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-918917.js
@@ -0,0 +1,21 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addFunction(undefined, kSig_v_v)
+  .addLocals({i32_count: 1}).addLocals({f32_count: 1}).addLocals({f64_count: 1})
+  .addBody([
+kExprGetLocal, 1,
+kExprGetLocal, 2,
+kExprGetLocal, 0,
+kExprIf, kWasmI32,
+  kExprI32Const, 1,
+kExprElse,
+  kExprUnreachable,
+  kExprEnd,
+kExprUnreachable
+]);
+builder.instantiate();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-919308.js b/src/v8/test/mjsunit/regress/wasm/regress-919308.js
new file mode 100644
index 0000000..8c45441
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-919308.js
@@ -0,0 +1,36 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addFunction(undefined, kSig_i_i)
+  .addLocals({i32_count: 5})
+  .addBody([
+    kExprGetLocal, 0,    // --> 1
+    kExprIf, kWasmI32,
+      kExprGetLocal, 0,  // --> 1
+    kExprElse,
+      kExprUnreachable,
+      kExprEnd,
+    kExprIf, kWasmI32,
+      kExprGetLocal, 0,  // --> 1
+    kExprElse,
+      kExprUnreachable,
+      kExprEnd,
+    kExprIf, kWasmI32,
+      kExprI32Const, 0,
+      kExprGetLocal, 0,
+      kExprI32Sub,       // --> -1
+      kExprGetLocal, 0,
+      kExprGetLocal, 0,
+      kExprI32Sub,       // --> 0
+      kExprI32Sub,       // --> -1
+    kExprElse,
+      kExprUnreachable,
+      kExprEnd
+]);
+builder.addExport('main', 0);
+const instance = builder.instantiate();
+assertEquals(-1, instance.exports.main(1));
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-919533.js b/src/v8/test/mjsunit/regress/wasm/regress-919533.js
new file mode 100644
index 0000000..706d3cc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-919533.js
@@ -0,0 +1,24 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addFunction(undefined, kSig_v_v).addBody([]);
+builder.addFunction(undefined, kSig_i_i)
+  .addBody([
+    kExprGetLocal, 0,
+    kExprGetLocal, 0,
+    // Stack now contains two copies of the first param register.
+    // Start a loop to create a merge point (values still in registers).
+    kExprLoop, kWasmStmt,
+      // The call spills all values.
+      kExprCallFunction, 0,
+      // Break to the loop. Now the spilled values need to be loaded back *into
+      // the same register*.
+      kExprBr, 0,
+      kExprEnd,
+    kExprDrop
+]);
+builder.instantiate();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-922432.js b/src/v8/test/mjsunit/regress/wasm/regress-922432.js
new file mode 100644
index 0000000..f6175b3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-922432.js
@@ -0,0 +1,20 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-eh
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function TestTruncatedBrOnExnInLoop() {
+  let builder = new WasmModuleBuilder();
+  let fun = builder.addFunction(undefined, kSig_v_v)
+      .addLocals({except_count: 1})
+      .addBody([
+        kExprLoop, kWasmStmt,
+          kExprGetLocal, 0,
+          kExprBrOnExn  // Bytecode truncated here.
+      ]).exportFunc();
+  fun.body.pop();  // Pop implicitly added kExprEnd from body.
+  assertThrows(() => builder.instantiate(), WebAssembly.CompileError);
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-922670.js b/src/v8/test/mjsunit/regress/wasm/regress-922670.js
new file mode 100644
index 0000000..2988edd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-922670.js
@@ -0,0 +1,31 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+const sig = builder.addType(makeSig([kWasmI32], []));
+builder.addFunction(undefined, sig)
+  .addLocals({i64_count: 1})
+  .addBody([
+    kExprLoop, kWasmI32,
+      kExprGetLocal, 1,
+      kExprI64Const, 1,
+      kExprLoop, kWasmI32,
+        kExprGetLocal, 0,
+        kExprI32Const, 1,
+        kExprI32Const, 1,
+        kExprIf, kWasmI32,
+          kExprI32Const, 1,
+        kExprElse,
+          kExprUnreachable,
+          kExprEnd,
+        kExprSelect,
+        kExprUnreachable,
+        kExprEnd,
+      kExprUnreachable,
+      kExprEnd,
+    kExprUnreachable
+]);
+builder.instantiate();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-922933.js b/src/v8/test/mjsunit/regress/wasm/regress-922933.js
new file mode 100644
index 0000000..4d44509
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-922933.js
@@ -0,0 +1,51 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+const sig = builder.addType(makeSig([kWasmI64], [kWasmI64]));
+builder.addFunction(undefined, sig)
+  .addLocals({i32_count: 14}).addLocals({i64_count: 17}).addLocals({f32_count: 14})
+  .addBody([
+    kExprBlock, kWasmStmt,
+      kExprBr, 0x00,
+      kExprEnd,
+    kExprBlock, kWasmStmt,
+      kExprI32Const, 0x00,
+      kExprSetLocal, 0x09,
+      kExprI32Const, 0x00,
+      kExprIf, kWasmStmt,
+        kExprBlock, kWasmStmt,
+          kExprI32Const, 0x00,
+          kExprSetLocal, 0x0a,
+          kExprBr, 0x00,
+          kExprEnd,
+        kExprBlock, kWasmStmt,
+          kExprBlock, kWasmStmt,
+            kExprGetLocal, 0x00,
+            kExprSetLocal, 0x12,
+            kExprBr, 0x00,
+            kExprEnd,
+          kExprGetLocal, 0x16,
+          kExprSetLocal, 0x0f,
+          kExprGetLocal, 0x0f,
+          kExprSetLocal, 0x17,
+          kExprGetLocal, 0x0f,
+          kExprSetLocal, 0x18,
+          kExprGetLocal, 0x17,
+          kExprGetLocal, 0x18,
+          kExprI64ShrS,
+          kExprSetLocal, 0x19,
+          kExprUnreachable,
+          kExprEnd,
+        kExprUnreachable,
+      kExprElse,
+        kExprUnreachable,
+        kExprEnd,
+      kExprUnreachable,
+      kExprEnd,
+    kExprUnreachable
+]);
+builder.instantiate();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-924843.js b/src/v8/test/mjsunit/regress/wasm/regress-924843.js
new file mode 100644
index 0000000..0549a76
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-924843.js
@@ -0,0 +1,16 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+const sig = builder.addType(makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]));
+builder.addFunction(undefined, sig)
+  .addBody([
+    kExprGetLocal, 2,
+    kExprIf, kWasmStmt,
+      kExprBlock, kWasmStmt
+  ]);
+builder.addExport('main', 0);
+assertThrows(() => builder.instantiate(), WebAssembly.CompileError);
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-924905.js b/src/v8/test/mjsunit/regress/wasm/regress-924905.js
new file mode 100644
index 0000000..9dbdf7e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-924905.js
@@ -0,0 +1,17 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+let builder = new WasmModuleBuilder();
+builder.addFunction("kaboom", kSig_i_v)
+    .addBody([
+      kExprI32Const, 0,
+      kExprI32Const, 0,
+      kExprI32And,
+      kExprI32Const, 0,
+      kExprI32ShrU,
+    ]).exportFunc();
+let instance = builder.instantiate();
+assertEquals(0, instance.exports.kaboom());
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-925671.js b/src/v8/test/mjsunit/regress/wasm/regress-925671.js
new file mode 100644
index 0000000..c6113c2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-925671.js
@@ -0,0 +1,12 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-tier-mask-for-testing=1
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+builder.addFunction('f0', kSig_v_v).addBody([]);
+builder.addFunction('f1', kSig_v_v).addBody([]);
+builder.instantiate();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-935138.js b/src/v8/test/mjsunit/regress/wasm/regress-935138.js
new file mode 100644
index 0000000..2083542
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-935138.js
@@ -0,0 +1,19 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-test-streaming
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function TestAsyncCompileMultipleCodeSections() {
+  let binary = new Binary();
+  binary.emit_header();
+  binary.emit_bytes([kTypeSectionCode, 4, 1, kWasmFunctionTypeForm, 0, 0]);
+  binary.emit_bytes([kFunctionSectionCode, 2, 1, 0]);
+  binary.emit_bytes([kCodeSectionCode, 6, 1, 4, 0, kExprGetLocal, 0, kExprEnd]);
+  binary.emit_bytes([kCodeSectionCode, 6, 1, 4, 0, kExprGetLocal, 0, kExprEnd]);
+  let buffer = binary.trunc_buffer();
+  assertPromiseResult(WebAssembly.compile(buffer), assertUnreachable,
+                      e => assertInstanceof(e, WebAssembly.CompileError));
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-940296.js b/src/v8/test/mjsunit/regress/wasm/regress-940296.js
new file mode 100644
index 0000000..747d91d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-940296.js
@@ -0,0 +1,6 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let table = new WebAssembly.Table({element: "anyfunc", initial: 1});
+assertThrows(() => table.get(3612882876), RangeError);
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-9425.js b/src/v8/test/mjsunit/regress/wasm/regress-9425.js
new file mode 100644
index 0000000..eb2ca15
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-9425.js
@@ -0,0 +1,20 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+// Flags: --experimental-wasm-threads
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+
+builder.addMemory(1, 1, /*exp*/ false, /*shared*/ true);
+
+builder.addFunction('test', kSig_v_v).addBody([
+  kExprI32Const, 0,                         //
+  kExprI64Const, 0,                         //
+  kExprI64Const, 0,                         //
+  kAtomicPrefix, kExprI64AtomicWait, 3, 0,  //
+  kExprDrop,                                //
+]);
+
+builder.instantiate();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-9447.js b/src/v8/test/mjsunit/regress/wasm/regress-9447.js
new file mode 100644
index 0000000..80d64b9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-9447.js
@@ -0,0 +1,37 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-experimental-wasm-bigint
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+// Generate a re-exported function that wraps a JavaScript callable, but with a
+// function signature that is incompatible (i.e. i64 return type) with JS.
+var fun1 = (function GenerateFun1() {
+  let builder = new WasmModuleBuilder();
+  function fun() { return 0 }
+  let fun_index = builder.addImport("m", "fun", kSig_l_v)
+  builder.addExport("fun", fun_index);
+  let instance = builder.instantiate({ m: { fun: fun }});
+  return instance.exports.fun;
+})();
+
+// Generate an exported function that calls the above re-export from another
+// module, still with a function signature that is incompatible with JS.
+var fun2 = (function GenerateFun2() {
+  let builder = new WasmModuleBuilder();
+  let fun_index = builder.addImport("m", "fun", kSig_l_v)
+  builder.addFunction('main', kSig_v_v)
+      .addBody([
+        kExprCallFunction, fun_index,
+        kExprDrop
+      ])
+      .exportFunc();
+  let instance = builder.instantiate({ m: { fun: fun1 }});
+  return instance.exports.main;
+})();
+
+// Both exported functions should throw, no matter how often they get wrapped.
+assertThrows(fun1, TypeError, /wasm function signature contains illegal type/);
+assertThrows(fun2, TypeError, /wasm function signature contains illegal type/);
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-946350.js b/src/v8/test/mjsunit/regress/wasm/regress-946350.js
new file mode 100644
index 0000000..127e71f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-946350.js
@@ -0,0 +1,13 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+var instance = builder.instantiate();
+instance[1] = undefined;
+gc();
+Object.getOwnPropertyNames(instance);
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-948228.js b/src/v8/test/mjsunit/regress/wasm/regress-948228.js
new file mode 100644
index 0000000..f9009e2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-948228.js
@@ -0,0 +1,11 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var {proxy, revoke} = Proxy.revocable({}, {});
+revoke();
+let builder = new WasmModuleBuilder();
+builder.addImport('m', 'q', kSig_v_v);
+WebAssembly.instantiate(builder.toModule(), proxy);
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-952342.js b/src/v8/test/mjsunit/regress/wasm/regress-952342.js
new file mode 100644
index 0000000..eb81f5a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-952342.js
@@ -0,0 +1,18 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const memory = new WebAssembly.Memory({initial: 1});
+
+let builder = new WasmModuleBuilder();
+builder.addImportedMemory("imports", "mem", 1);
+builder.addFunction("copy", kSig_v_iii)
+       .addBody([kExprGetLocal, 0, // dst
+                 kExprGetLocal, 1, // src
+                 kExprGetLocal, 2, // size
+                 kNumericPrefix, kExprMemoryCopy, 0, 0]).exportAs("copy");
+let instance = builder.instantiate({imports: {mem: memory}});
+memory.grow(1);
+instance.exports.copy(0, kPageSize, 11);
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-956771.js b/src/v8/test/mjsunit/regress/wasm/regress-956771.js
new file mode 100644
index 0000000..3fac6c8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-956771.js
@@ -0,0 +1,28 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-lazy-compilation
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function testLazyModuleAsyncCompilation() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("some", kSig_i_ii)
+  assertPromiseResult(WebAssembly.compile(builder.toBuffer())
+    .then(assertUnreachable,
+          error => assertEquals("WebAssembly.compile(): function body must " +
+                                "end with \"end\" opcode @+26",
+                                error.message)));
+})();
+
+(function testLazyModuleSyncCompilation() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("some", kSig_i_ii)
+  assertThrows(() => builder.toModule(),
+               WebAssembly.CompileError,
+               "WebAssembly.Module(): Compiling function #0:\"some\" failed: " +
+               "function body must end with \"end\" opcode @+26");
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-956771b.js b/src/v8/test/mjsunit/regress/wasm/regress-956771b.js
new file mode 100644
index 0000000..1c819cb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-956771b.js
@@ -0,0 +1,19 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-lazy-compilation --wasm-test-streaming
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function testLazyModuleStreamingCompilation() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("some", kSig_i_ii);
+  let bytes = builder.toBuffer();
+  assertPromiseResult(WebAssembly.compileStreaming(Promise.resolve(bytes))
+    .then(assertUnreachable,
+          error => assertEquals("WebAssembly.compileStreaming(): function " +
+                                "body must end with \"end\" opcode @+26",
+                                error.message)));
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-957405.js b/src/v8/test/mjsunit/regress/wasm/regress-957405.js
new file mode 100644
index 0000000..a831042
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-957405.js
@@ -0,0 +1,20 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const memory = new WebAssembly.Memory({initial: 1});
+
+let builder = new WasmModuleBuilder();
+builder.addImportedMemory("imports", "mem");
+builder.addFunction("fill", kSig_v_iii)
+       .addBody([kExprGetLocal, 0, // dst
+                 kExprGetLocal, 1, // value
+                 kExprGetLocal, 2, // size
+                 kNumericPrefix, kExprMemoryFill, 0]).exportAs("fill");
+let instance = builder.instantiate({imports: {mem: memory}});
+memory.grow(1);
+assertTraps(
+    kTrapMemOutOfBounds,
+    () => instance.exports.fill(kPageSize + 1, 123, kPageSize));
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-961129.js b/src/v8/test/mjsunit/regress/wasm/regress-961129.js
new file mode 100644
index 0000000..7a4903a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-961129.js
@@ -0,0 +1,18 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+%EnableCodeLoggingForTesting();
+
+function module() {
+  "use asm";
+  function f() {
+    var i = 4;
+    return i | 0;
+  }
+  return {f: f};
+}
+
+module().f();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-964607.js b/src/v8/test/mjsunit/regress/wasm/regress-964607.js
new file mode 100644
index 0000000..0a6d762
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-964607.js
@@ -0,0 +1,29 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --experimental-wasm-anyref
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+let builder = new WasmModuleBuilder();
+
+builder.addImportedTable('ffi', 't1', 5, 5, kWasmAnyFunc);
+builder.addImportedTable('ffi', 't2', 9, 9, kWasmAnyFunc);
+
+builder.addFunction('foo', kSig_v_v).addBody([]).exportFunc();
+
+let module = builder.toModule();
+let table1 =
+    new WebAssembly.Table({element: 'anyfunc', initial: 5, maximum: 5});
+
+let table2 =
+    new WebAssembly.Table({element: 'anyfunc', initial: 9, maximum: 9});
+
+let instance =
+    new WebAssembly.Instance(module, {ffi: {t1: table1, t2: table2}});
+let table3 =
+    new WebAssembly.Table({element: 'anyfunc', initial: 9, maximum: 9});
+
+table3.set(8, instance.exports.foo);
+new WebAssembly.Instance(module, {ffi: {t1: table1, t2: table3}});
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-968078.js b/src/v8/test/mjsunit/regress/wasm/regress-968078.js
new file mode 100644
index 0000000..2935ea0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-968078.js
@@ -0,0 +1,47 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function() {
+  function repeat(value, length) {
+    var arr = new Array(length);
+    for (let i = 0; i < length; i++) {
+      arr[i] = value;
+    }
+    return arr;
+  }
+  function br_table(block_index, length, def_block) {
+    const bytes = new Binary();
+    bytes.emit_bytes([kExprBrTable]);
+    // Functions count (different than the count in the functions section.
+    bytes.emit_u32v(length);
+    bytes.emit_bytes(repeat(block_index, length));
+    bytes.emit_bytes([def_block]);
+    return Array.from(bytes.trunc_buffer());
+  }
+  var builder = new WasmModuleBuilder();
+  builder.addMemory(12, 12, false);
+  builder.addFunction("foo", kSig_v_iii)
+    .addBody([].concat([
+      kExprBlock, kWasmStmt,
+        kExprGetLocal, 0x2,
+        kExprI32Const, 0x01,
+        kExprI32And,
+        // Generate a test branch (which has 32k limited reach).
+        kExprIf, kWasmStmt,
+          kExprGetLocal, 0x0,
+          kExprI32Const, 0x01,
+          kExprI32And,
+          kExprBrIf, 0x1,
+          kExprGetLocal, 0x0,
+          // Emit a br_table that is long enough to make the test branch go out of range.
+          ], br_table(0x1, 9000, 0x00), [
+        kExprEnd,
+      kExprEnd,
+    ])).exportFunc();
+  builder.instantiate();
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-980007.js b/src/v8/test/mjsunit/regress/wasm/regress-980007.js
new file mode 100644
index 0000000..5715c6f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-980007.js
@@ -0,0 +1,14 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addFunction(undefined, kSig_i_i).addBody([
+  kExprI64Const, 0x01,
+  kExprI32ConvertI64,
+  kExprI32Const, 0x80, 0x80, 0x80, 0x80, 0x78,
+  kExprI32Sub,
+]);
+builder.instantiate();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-985154.js b/src/v8/test/mjsunit/regress/wasm/regress-985154.js
new file mode 100644
index 0000000..30f34d5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-985154.js
@@ -0,0 +1,34 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function TestSloppynessPropagates() {
+  let f = (function() {
+    function Module() {
+      "use asm";
+      function f() {}
+      return {f: f}
+    }
+    return Module;
+  })()().f;
+  let p = Object.getOwnPropertyNames(f);
+  assertArrayEquals(["length", "name", "arguments", "caller", "prototype"], p);
+  assertEquals(null, f.arguments);
+  assertEquals(null, f.caller);
+})();
+
+(function TestStrictnessPropagates() {
+  let f = (function() {
+    "use strict";
+    function Module() {
+      "use asm";
+      function f() {}
+      return {f: f}
+    }
+    return Module;
+  })()().f;
+  let p = Object.getOwnPropertyNames(f);
+  assertArrayEquals(["length", "name", "prototype"], p);
+  assertThrows(() => f.arguments, TypeError);
+  assertThrows(() => f.caller, TypeError);
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-ubsan.js b/src/v8/test/mjsunit/regress/wasm/regress-ubsan.js
new file mode 100644
index 0000000..5308775
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-ubsan.js
@@ -0,0 +1,19 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+// crbug.com/933134
+(function() {
+  var builder = new WasmModuleBuilder();
+  builder.addImportedGlobal("mod", "i32", kWasmI32);
+  builder.addImportedGlobal("mod", "f32", kWasmF32);
+  var module = new WebAssembly.Module(builder.toBuffer());
+  return new WebAssembly.Instance(module, {
+    mod: {
+      i32: 1e12,
+      f32: 1e300,
+    }
+  });
+})();
diff --git a/src/v8/test/mjsunit/reindexing-in-classes.js b/src/v8/test/mjsunit/reindexing-in-classes.js
new file mode 100644
index 0000000..9bb9ae4
--- /dev/null
+++ b/src/v8/test/mjsunit/reindexing-in-classes.js
@@ -0,0 +1,72 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Test the reindexer visiting classes, avoiding repeat visits of the same
+// function.
+//
+// For each test, create function literals inside a class, where the functions
+// have to be reindexed due to the whole thing being inside an arrow head scope.
+
+((arg = (function wrapper() {
+  // Class with field that has computed property name with a function in the
+  // computation.
+  class g {
+    [{b: function in_computed_field_name() {}}]
+  }
+})) => {})();
+
+((arg = (function wrapper() {
+  // Class with initialized field that has computed property name with a
+  // function in the computation.
+  class g {
+    [{b: function in_computed_field_name_with_init() {}}] = ""
+  }
+})) => {})();
+
+((arg = (function wrapper() {
+  // Class with initialized field that has literal property name with a function
+  // in the initializer value.
+  class g {
+    b = (function in_init_value_of_field(){})()
+  }
+})) => {})();
+
+((arg = (function wrapper() {
+  // Class with initialized field that has private property name with a function
+  // in the initializer value.
+  class g {
+    #b = (function in_init_value_of_private_field(){})()
+  }
+})) => {})();
+
+((arg = (function wrapper() {
+  // Class with initialized field that has computed property name with a
+  // function in the initializer value.
+  class g {
+    ["b"] = (function in_init_value_of_computed_field_name(){})()
+  }
+})) => {})();
+
+((arg = (function wrapper() {
+  // Class with method that has computed property name with a function in the
+  // computation.
+  class g {
+    [{b: function in_computed_method_name() {}}] () {}
+  }
+})) => {})();
+
+((arg = (function wrapper() {
+  // Class with method that has an argument with a default function init.
+  class g {
+    b(arg = function in_method_arg_default_init() {}) {}
+  }
+})) => {})();
+
+((arg = (function wrapper() {
+  // Class with method that has a computed property name and an argument with a
+  // default function init.
+  class g {
+    ["b"] (arg = function in_computed_method_arg_default_init() {}) {}
+  }
+})) => {})();
diff --git a/src/v8/test/mjsunit/samevalue.js b/src/v8/test/mjsunit/samevalue.js
index 356e888..30cce35 100644
--- a/src/v8/test/mjsunit/samevalue.js
+++ b/src/v8/test/mjsunit/samevalue.js
@@ -26,14 +26,17 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 
-// Flags: --expose-natives-as natives --allow-natives-syntax
+// Flags: --allow-natives-syntax
 // Test the SameValue and SameValueZero internal methods.
 
 var obj1 = {x: 10, y: 11, z: "test"};
 var obj2 = {x: 10, y: 11, z: "test"};
 
+// Object.is() uses the SameValue algorithm.
 var sameValue = Object.is;
-var sameValueZero = function(x, y) { return %SameValueZero(x, y); }
+
+// Set#has() uses the SameValueZero algorithm.
+var sameValueZero = (x, y) => new Set([x]).has(y);
 
 // Calls SameValue and SameValueZero and checks that their results match.
 function sameValueBoth(a, b) {
diff --git a/src/v8/test/mjsunit/sealed-array-reduce.js b/src/v8/test/mjsunit/sealed-array-reduce.js
new file mode 100644
index 0000000..a572aa2
--- /dev/null
+++ b/src/v8/test/mjsunit/sealed-array-reduce.js
@@ -0,0 +1,1431 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+/**
+ * @fileoverview Test reduce and reduceRight
+ */
+
+function clone(v) {
+  // Shallow-copies arrays, returns everything else verbatim.
+  if (v instanceof Array) {
+    // Shallow-copy an array.
+    var newArray = new Array(v.length);
+    for (var i in v) {
+      newArray[i] = v[i];
+    }
+    return newArray;
+  }
+  return v;
+}
+
+
+// Creates a callback function for reduce/reduceRight that tests the number
+// of arguments and otherwise behaves as "func", but which also
+// records all calls in an array on the function (as arrays of arguments
+// followed by result).
+function makeRecorder(func, testName) {
+  var record = [];
+  var f = function recorder(a, b, i, s) {
+    assertEquals(4, arguments.length,
+                 testName + "(number of arguments: " + arguments.length + ")");
+    assertEquals("number", typeof(i), testName + "(index must be number)");
+    assertEquals(s[i], b, testName + "(current argument is at index)");
+    if (record.length > 0) {
+      var prevRecord = record[record.length - 1];
+      var prevResult = prevRecord[prevRecord.length - 1];
+      assertEquals(prevResult, a,
+                   testName + "(prev result -> current input)");
+    }
+    var args = [clone(a), clone(b), i, clone(s)];
+    var result = func.apply(this, arguments);
+    args.push(clone(result));
+    record.push(args);
+    return result;
+  };
+  f.record = record;
+  return f;
+}
+
+
+function testReduce(type,
+                    testName,
+                    expectedResult,
+                    expectedCalls,
+                    array,
+                    combine,
+                    init) {
+  var rec = makeRecorder(combine);
+  var result;
+  if (arguments.length > 6) {
+    result = array[type](rec, init);
+  } else {
+    result = array[type](rec);
+  }
+  var calls = rec.record;
+  assertEquals(expectedCalls.length, calls.length,
+               testName + " (number of calls)");
+  for (var i = 0; i < expectedCalls.length; i++) {
+    assertEquals(expectedCalls[i], calls[i],
+                 testName + " (call " + (i + 1) + ")");
+  }
+  assertEquals(expectedResult, result, testName + " (result)");
+}
+
+
+function sum(a, b) { return Number(a) + Number(b); }
+function prod(a, b) { return Number(a) * Number(b); }
+function dec(a, b, i, arr) { return Number(a) + Number(b) * Math.pow(10, arr.length - i - 1); }
+function accumulate(acc, elem, i) { acc[i] = elem; return acc; }
+
+// ---- Test Reduce[Left]
+
+var simpleArray = ['2',4,6];
+Object.seal(simpleArray);
+
+testReduce("reduce", "SimpleReduceSum", 12,
+           [[0, '2', 0, simpleArray, 2],
+            [2, 4, 1, simpleArray, 6],
+            [6, 6, 2, simpleArray, 12]],
+           simpleArray, sum, 0);
+
+testReduce("reduce", "SimpleReduceProd", 48,
+           [[1, '2', 0, simpleArray, 2],
+            [2, 4, 1, simpleArray, 8],
+            [8, 6, 2, simpleArray, 48]],
+           simpleArray, prod, 1);
+
+testReduce("reduce", "SimpleReduceDec", 246,
+           [[0, '2', 0, simpleArray, 200],
+            [200, 4, 1, simpleArray, 240],
+            [240, 6, 2, simpleArray, 246]],
+           simpleArray, dec, 0);
+
+testReduce("reduce", "SimpleReduceAccumulate", simpleArray,
+           [[[], '2', 0, simpleArray, ['2']],
+            [['2'], 4, 1, simpleArray, ['2', 4]],
+            [['2', 4], 6, 2, simpleArray, simpleArray]],
+           simpleArray, accumulate, []);
+
+var emptyArray = [];
+Object.seal(emptyArray);
+
+testReduce("reduce", "EmptyReduceSum", 0, [], emptyArray, sum, 0);
+testReduce("reduce", "EmptyReduceProd", 1, [], emptyArray, prod, 1);
+testReduce("reduce", "EmptyReduceDec", 0, [], emptyArray, dec, 0);
+testReduce("reduce", "EmptyReduceAccumulate", [], [], emptyArray, accumulate, []);
+
+testReduce("reduce", "EmptyReduceSumNoInit", 0, emptyArray, [0], sum);
+testReduce("reduce", "EmptyReduceProdNoInit", 1, emptyArray, [1], prod);
+testReduce("reduce", "EmptyReduceDecNoInit", 0, emptyArray, [0], dec);
+testReduce("reduce", "EmptyReduceAccumulateNoInit", [], emptyArray, [[]], accumulate);
+
+
+var simpleSparseArray = [,,,'2',,4,,6,,];
+Object.seal(simpleSparseArray);
+
+testReduce("reduce", "SimpleSparseReduceSum", 12,
+           [[0, '2', 3, simpleSparseArray, 2],
+            [2, 4, 5, simpleSparseArray, 6],
+            [6, 6, 7, simpleSparseArray, 12]],
+           simpleSparseArray, sum, 0);
+
+testReduce("reduce", "SimpleSparseReduceProd", 48,
+           [[1, '2', 3, simpleSparseArray, 2],
+            [2, 4, 5, simpleSparseArray, 8],
+            [8, 6, 7, simpleSparseArray, 48]],
+           simpleSparseArray, prod, 1);
+
+testReduce("reduce", "SimpleSparseReduceDec", 204060,
+           [[0, '2', 3, simpleSparseArray, 200000],
+            [200000, 4, 5, simpleSparseArray, 204000],
+            [204000, 6, 7, simpleSparseArray, 204060]],
+           simpleSparseArray, dec, 0);
+
+testReduce("reduce", "SimpleSparseReduceAccumulate", [,,,'2',,4,,6],
+           [[[], '2', 3, simpleSparseArray, [,,,'2']],
+            [[,,,'2'], 4, 5, simpleSparseArray, [,,,'2',,4]],
+            [[,,,'2',,4], 6, 7, simpleSparseArray, [,,,'2',,4,,6]]],
+           simpleSparseArray, accumulate, []);
+
+
+testReduce("reduce", "EmptySparseReduceSumNoInit", 0, [], [,,0,,], sum);
+testReduce("reduce", "EmptySparseReduceProdNoInit", 1, [], [,,1,,], prod);
+testReduce("reduce", "EmptySparseReduceDecNoInit", 0, [], [,,0,,], dec);
+testReduce("reduce", "EmptySparseReduceAccumulateNoInit",
+           [], [], [,,[],,], accumulate);
+
+
+var verySparseArray = [];
+verySparseArray.length = 10000;
+verySparseArray[2000] = '2';
+verySparseArray[5000] = 4;
+verySparseArray[9000] = 6;
+var verySparseSlice2 = verySparseArray.slice(0, 2001);
+var verySparseSlice4 = verySparseArray.slice(0, 5001);
+var verySparseSlice6 = verySparseArray.slice(0, 9001);
+Object.seal(verySparseArray);
+
+testReduce("reduce", "VerySparseReduceSum", 12,
+           [[0, '2', 2000, verySparseArray, 2],
+            [2, 4, 5000, verySparseArray, 6],
+            [6, 6, 9000, verySparseArray, 12]],
+           verySparseArray, sum, 0);
+
+testReduce("reduce", "VerySparseReduceProd", 48,
+           [[1, '2', 2000, verySparseArray, 2],
+            [2, 4, 5000, verySparseArray, 8],
+            [8, 6, 9000, verySparseArray, 48]],
+           verySparseArray, prod, 1);
+
+testReduce("reduce", "VerySparseReduceDec", Infinity,
+           [[0, '2', 2000, verySparseArray, Infinity],
+            [Infinity, 4, 5000, verySparseArray, Infinity],
+            [Infinity, 6, 9000, verySparseArray, Infinity]],
+           verySparseArray, dec, 0);
+
+testReduce("reduce", "VerySparseReduceAccumulate",
+           verySparseSlice6,
+           [[[], '2', 2000, verySparseArray, verySparseSlice2],
+            [verySparseSlice2, 4, 5000, verySparseArray, verySparseSlice4],
+            [verySparseSlice4, 6, 9000, verySparseArray, verySparseSlice6]],
+           verySparseArray, accumulate, []);
+
+
+testReduce("reduce", "VerySparseReduceSumNoInit", 12,
+           [['2', 4, 5000, verySparseArray, 6],
+            [6, 6, 9000, verySparseArray, 12]],
+           verySparseArray, sum);
+
+testReduce("reduce", "VerySparseReduceProdNoInit", 48,
+           [['2', 4, 5000, verySparseArray, 8],
+            [8, 6, 9000, verySparseArray, 48]],
+           verySparseArray, prod);
+
+testReduce("reduce", "VerySparseReduceDecNoInit", Infinity,
+           [['2', 4, 5000, verySparseArray, Infinity],
+            [Infinity, 6, 9000, verySparseArray, Infinity]],
+           verySparseArray, dec);
+
+testReduce("reduce", "SimpleSparseReduceAccumulateNoInit",
+           '2',
+           [['2', 4, 5000, verySparseArray, '2'],
+            ['2', 6, 9000, verySparseArray, '2']],
+           verySparseArray, accumulate);
+
+
+// ---- Test ReduceRight
+
+testReduce("reduceRight", "SimpleReduceRightSum", 12,
+           [[0, 6, 2, simpleArray, 6],
+            [6, 4, 1, simpleArray, 10],
+            [10, '2', 0, simpleArray, 12]],
+           simpleArray, sum, 0);
+
+testReduce("reduceRight", "SimpleReduceRightProd", 48,
+           [[1, 6, 2, simpleArray, 6],
+            [6, 4, 1, simpleArray, 24],
+            [24, '2', 0, simpleArray, 48]],
+           simpleArray, prod, 1);
+
+testReduce("reduceRight", "SimpleReduceRightDec", 246,
+           [[0, 6, 2, simpleArray, 6],
+            [6, 4, 1, simpleArray, 46],
+            [46, '2', 0, simpleArray, 246]],
+           simpleArray, dec, 0);
+
+testReduce("reduceRight", "SimpleReduceRightAccumulate", simpleArray,
+           [[[], 6, 2, simpleArray, [,,6]],
+            [[,,6], 4, 1, simpleArray, [,4,6]],
+            [[,4,6], '2', 0, simpleArray, simpleArray]],
+           simpleArray, accumulate, []);
+
+
+testReduce("reduceRight", "EmptyReduceRightSum", 0, [], [], sum, 0);
+testReduce("reduceRight", "EmptyReduceRightProd", 1, [], [], prod, 1);
+testReduce("reduceRight", "EmptyReduceRightDec", 0, [], [], dec, 0);
+testReduce("reduceRight", "EmptyReduceRightAccumulate", [],
+           [], [], accumulate, []);
+
+testReduce("reduceRight", "EmptyReduceRightSumNoInit", 0, [], [0], sum);
+testReduce("reduceRight", "EmptyReduceRightProdNoInit", 1, [], [1], prod);
+testReduce("reduceRight", "EmptyReduceRightDecNoInit", 0, [], [0], dec);
+testReduce("reduceRight", "EmptyReduceRightAccumulateNoInit",
+           [], [], [[]], accumulate);
+
+
+testReduce("reduceRight", "SimpleSparseReduceRightSum", 12,
+           [[0, 6, 7, simpleSparseArray, 6],
+            [6, 4, 5, simpleSparseArray, 10],
+            [10, '2', 3, simpleSparseArray, 12]],
+           simpleSparseArray, sum, 0);
+
+testReduce("reduceRight", "SimpleSparseReduceRightProd", 48,
+           [[1, 6, 7, simpleSparseArray, 6],
+            [6, 4, 5, simpleSparseArray, 24],
+            [24, '2', 3, simpleSparseArray, 48]],
+           simpleSparseArray, prod, 1);
+
+testReduce("reduceRight", "SimpleSparseReduceRightDec", 204060,
+           [[0, 6, 7, simpleSparseArray, 60],
+            [60, 4, 5, simpleSparseArray, 4060],
+            [4060, '2', 3, simpleSparseArray, 204060]],
+           simpleSparseArray, dec, 0);
+
+testReduce("reduceRight", "SimpleSparseReduceRightAccumulate", [,,,'2',,4,,6],
+           [[[], 6, 7, simpleSparseArray, [,,,,,,,6]],
+            [[,,,,,,,6], 4, 5, simpleSparseArray, [,,,,,4,,6]],
+            [[,,,,,4,,6], '2', 3, simpleSparseArray, [,,,'2',,4,,6]]],
+           simpleSparseArray, accumulate, []);
+
+
+testReduce("reduceRight", "EmptySparseReduceRightSumNoInit",
+           0, [], [,,0,,], sum);
+testReduce("reduceRight", "EmptySparseReduceRightProdNoInit",
+           1, [], [,,1,,], prod);
+testReduce("reduceRight", "EmptySparseReduceRightDecNoInit",
+           0, [], [,,0,,], dec);
+testReduce("reduceRight", "EmptySparseReduceRightAccumulateNoInit",
+           [], [], [,,[],,], accumulate);
+
+
+var verySparseSuffix6 = [];
+verySparseSuffix6[9000] = 6;
+var verySparseSuffix4 = [];
+verySparseSuffix4[5000] = 4;
+verySparseSuffix4[9000] = 6;
+var verySparseSuffix2 = verySparseSlice6;
+
+
+testReduce("reduceRight", "VerySparseReduceRightSum", 12,
+           [[0, 6, 9000, verySparseArray, 6],
+            [6, 4, 5000, verySparseArray, 10],
+            [10, '2', 2000, verySparseArray, 12]],
+           verySparseArray, sum, 0);
+
+testReduce("reduceRight", "VerySparseReduceRightProd", 48,
+           [[1, 6, 9000, verySparseArray, 6],
+            [6, 4, 5000, verySparseArray, 24],
+            [24, '2', 2000, verySparseArray, 48]],
+           verySparseArray, prod, 1);
+
+testReduce("reduceRight", "VerySparseReduceRightDec", Infinity,
+           [[0, 6, 9000, verySparseArray, Infinity],
+            [Infinity, 4, 5000, verySparseArray, Infinity],
+            [Infinity, '2', 2000, verySparseArray, Infinity]],
+           verySparseArray, dec, 0);
+
+testReduce("reduceRight", "VerySparseReduceRightAccumulate",
+           verySparseSuffix2,
+           [[[], 6, 9000, verySparseArray, verySparseSuffix6],
+            [verySparseSuffix6, 4, 5000, verySparseArray, verySparseSuffix4],
+            [verySparseSuffix4, '2', 2000, verySparseArray, verySparseSuffix2]],
+           verySparseArray, accumulate, []);
+
+
+testReduce("reduceRight", "VerySparseReduceRightSumNoInit", 12,
+           [[6, 4, 5000, verySparseArray, 10],
+            [10, '2', 2000, verySparseArray, 12]],
+           verySparseArray, sum);
+
+testReduce("reduceRight", "VerySparseReduceRightProdNoInit", 48,
+           [[6, 4, 5000, verySparseArray, 24],
+            [24, '2', 2000, verySparseArray, 48]],
+           verySparseArray, prod);
+
+testReduce("reduceRight", "VerySparseReduceRightDecNoInit", Infinity,
+           [[6, 4, 5000, verySparseArray, Infinity],
+            [Infinity, '2', 2000, verySparseArray, Infinity]],
+           verySparseArray, dec);
+
+testReduce("reduceRight", "SimpleSparseReduceRightAccumulateNoInit",
+           6,
+           [[6, 4, 5000, verySparseArray, 6],
+            [6, '2', 2000, verySparseArray, 6]],
+           verySparseArray, accumulate);
+
+
+// undefined is an element
+var undefArray = [,,undefined,,undefined,,];
+Object.seal(undefArray);
+
+testReduce("reduce", "SparseUndefinedReduceAdd", NaN,
+           [[0, undefined, 2, undefArray, NaN],
+            [NaN, undefined, 4, undefArray, NaN],
+           ],
+           undefArray, sum, 0);
+
+testReduce("reduceRight", "SparseUndefinedReduceRightAdd", NaN,
+           [[0, undefined, 4, undefArray, NaN],
+            [NaN, undefined, 2, undefArray, NaN],
+           ], undefArray, sum, 0);
+
+testReduce("reduce", "SparseUndefinedReduceAddNoInit", NaN,
+           [[undefined, undefined, 4, undefArray, NaN],
+           ], undefArray, sum);
+
+testReduce("reduceRight", "SparseUndefinedReduceRightAddNoInit", NaN,
+           [[undefined, undefined, 2, undefArray, NaN],
+           ], undefArray, sum);
+
+
+// Ignore non-array properties:
+
+var arrayPlus = [1,'2',,3];
+arrayPlus[-1] = NaN;
+arrayPlus[Math.pow(2,32)] = NaN;
+arrayPlus[NaN] = NaN;
+arrayPlus["00"] = NaN;
+arrayPlus["02"] = NaN;
+arrayPlus["-0"] = NaN;
+Object.seal(arrayPlus);
+
+testReduce("reduce", "ArrayWithNonElementPropertiesReduce", 6,
+           [[0, 1, 0, arrayPlus, 1],
+            [1, '2', 1, arrayPlus, 3],
+            [3, 3, 3, arrayPlus, 6],
+           ], arrayPlus, sum, 0);
+
+testReduce("reduceRight", "ArrayWithNonElementPropertiesReduceRight", 6,
+           [[0, 3, 3, arrayPlus, 3],
+            [3, '2', 1, arrayPlus, 5],
+            [5, 1, 0, arrayPlus, 6],
+           ], arrayPlus, sum, 0);
+
+// Test passing undefined as initial value (to test missing parameter
+// detection).
+Object.seal(['1']).reduce((a, b) => { assertEquals(a, undefined); assertEquals(b, '1') },
+           undefined);
+Object.seal(['1', 2]).reduce((a, b) => { assertEquals(a, '1'); assertEquals(b, 2); });
+Object.seal(['1']).reduce((a, b) => { assertTrue(false); });
+
+// Test error conditions:
+
+var exception = false;
+try {
+  Object.seal(['1']).reduce("not a function");
+} catch (e) {
+  exception = true;
+  assertTrue(e instanceof TypeError,
+             "reduce callback not a function not throwing TypeError");
+  assertTrue(e.message.indexOf(" is not a function") >= 0,
+             "reduce non function TypeError type");
+}
+assertTrue(exception);
+
+exception = false;
+try {
+  Object.seal(['1']).reduceRight("not a function");
+} catch (e) {
+  exception = true;
+  assertTrue(e instanceof TypeError,
+             "reduceRight callback not a function not throwing TypeError");
+  assertTrue(e.message.indexOf(" is not a function") >= 0,
+             "reduceRight non function TypeError type");
+}
+assertTrue(exception);
+
+exception = false;
+try {
+  Object.seal([]).reduce(sum);
+} catch (e) {
+  exception = true;
+  assertTrue(e instanceof TypeError,
+             "reduce no initial value not throwing TypeError");
+  assertEquals("Reduce of empty array with no initial value", e.message,
+               "reduce no initial TypeError type");
+}
+assertTrue(exception);
+
+exception = false;
+try {
+  Object.seal([]).reduceRight(sum);
+} catch (e) {
+  exception = true;
+  assertTrue(e instanceof TypeError,
+             "reduceRight no initial value not throwing TypeError");
+  assertEquals("Reduce of empty array with no initial value", e.message,
+               "reduceRight no initial TypeError type");
+}
+assertTrue(exception);
+
+exception = false;
+try {
+  Object.seal([,,,]).reduce(sum);
+} catch (e) {
+  exception = true;
+  assertTrue(e instanceof TypeError,
+             "reduce sparse no initial value not throwing TypeError");
+  assertEquals("Reduce of empty array with no initial value", e.message,
+               "reduce no initial TypeError type");
+}
+assertTrue(exception);
+
+exception = false;
+try {
+  Object.seal([,,,]).reduceRight(sum);
+} catch (e) {
+  exception = true;
+  assertTrue(e instanceof TypeError,
+             "reduceRight sparse no initial value not throwing TypeError");
+  assertEquals("Reduce of empty array with no initial value", e.message,
+               "reduceRight no initial TypeError type");
+}
+assertTrue(exception);
+
+
+// Array changing length
+
+function extender(a, b, i, s) {
+  s[s.length] = s.length;
+  return Number(a) + Number(b);
+}
+
+var arr = [1, '2', 3, 4];
+Object.seal(arr);
+testReduce("reduce", "ArrayManipulationExtender", 10,
+           [[0, 1, 0, [1, '2', 3, 4], 1],
+            [1, '2', 1, [1, '2', 3, 4], 3],
+            [3, 3, 2, [1, '2', 3, 4], 6],
+            [6, 4, 3, [1, '2', 3, 4], 10],
+           ], arr, extender, 0);
+
+var arr = [];
+Object.defineProperty(arr, "0", { get: function() { delete this[0] },
+  configurable: true });
+assertEquals(undefined, Object.seal(arr).reduce(function(val) { return val }));
+
+var arr = [];
+Object.defineProperty(arr, "0", { get: function() { delete this[0] },
+  configurable: true});
+assertEquals(undefined, Object.seal(arr).reduceRight(function(val) { return val }));
+
+
+(function ReduceRightMaxIndex() {
+  const kMaxIndex = 0xffffffff-1;
+  let array = [];
+  array[kMaxIndex-2] = 'value-2';
+  array[kMaxIndex-1] = 'value-1';
+  // Use the maximum array index possible.
+  array[kMaxIndex] = 'value';
+  // Add the next index which is a normal property and thus will not show up.
+  array[kMaxIndex+1] = 'normal property';
+  assertThrowsEquals( () => {
+      Object.seal(array).reduceRight((sum, value) => {
+        assertEquals('initial', sum);
+        assertEquals('value', value);
+        // Throw at this point as we would very slowly loop down from kMaxIndex.
+        throw 'do not continue';
+      }, 'initial')
+  }, 'do not continue');
+})();
+
+(function OptimizedReduce() {
+  let f = (a,current) => a + Number(current);
+  let g = function(a) {
+    return a.reduce(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  let a = [1,'2',3,4,5,6,7,8,9,10];
+  Object.seal(a);
+  g(a); g(a);
+  let total = g(a);
+  %OptimizeFunctionOnNextCall(g);
+  assertEquals(total, g(a));
+  assertOptimized(g);
+})();
+
+(function OptimizedReduceEmpty() {
+  let f = (a,current) => a + Number(current);
+  let g = function(a) {
+    return a.reduce(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  let a = [1,'2',3,4,5,6,7,8,9,10];
+  Object.seal(a);
+  g(a); g(a); g(a);
+  %OptimizeFunctionOnNextCall(g);
+  g(a);
+  assertOptimized(g);
+  assertThrows(() => g([]));
+  assertUnoptimized(g);
+})();
+
+(function OptimizedReduceLazyDeopt() {
+  let deopt = false;
+  let f = (a,current) => { if (deopt) %DeoptimizeNow(); return a + Number(current); };
+  let g = function(a) {
+    return a.reduce(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  let a = [1,'2',3,4,5,6,7,8,9,10];
+  Object.seal(a);
+  g(a); g(a);
+  let total = g(a);
+  %OptimizeFunctionOnNextCall(g);
+  g(a);
+  assertOptimized(g);
+  deopt = true;
+  assertEquals(total, g(a));
+  assertOptimized(g);
+})();
+
+(function OptimizedReduceLazyDeoptMiddleOfIteration() {
+  let deopt = false;
+  let f = (a,current) => {
+    if (current == 6 && deopt) %DeoptimizeNow();
+    return a + Number(current);
+  };
+  let g = function(a) {
+    return a.reduce(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  let a = [11,'22',33,45,56,6,77,84,93,101];
+  Object.seal(a);
+  g(a); g(a);
+  let total = g(a);
+  %OptimizeFunctionOnNextCall(g);
+  g(a);
+  assertOptimized(g);
+  deopt = true;
+  assertEquals(total, g(a));
+  assertOptimized(g);
+})();
+
+(function OptimizedReduceEagerDeoptMiddleOfIteration() {
+  let deopt = false;
+  let array = [11,'22',33,45,56,6,77,84,93,101];
+  Object.seal(array);
+  let f = (a,current) => {
+    if (current == 6 && deopt) {array[0] = 1.5; }
+    return a + Number(current);
+  };
+  let g = function() {
+    return array.reduce(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertOptimized(g);
+  deopt = true;
+  g();
+  assertOptimized(g);
+  %PrepareFunctionForOptimization(g);
+  deopt = false;
+  array = [11,'22',33,45,56,6,77,84,93,101];
+  Object.seal(array);
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertOptimized(g);
+  deopt = true;
+  assertEquals(total, g());
+  assertOptimized(g);
+})();
+
+(function OptimizedReduceEagerDeoptMiddleOfIterationHoley() {
+  let deopt = false;
+  let array = [, ,11,'22',,33,45,56,,6,77,84,93,101,];
+  Object.seal(array);
+  let f = (a,current) => {
+    if (current == 6 && deopt) {array[0] = 1.5; }
+    return a + Number(current);
+  };
+  let g = function() {
+    return array.reduce(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertOptimized(g);
+  deopt = true;
+  g();
+  assertOptimized(g);
+  %PrepareFunctionForOptimization(g);
+  deopt = false;
+  array = [11,'22',33,45,56,6,77,84,93,101];
+  Object.seal(array);
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertUnoptimized(g);
+  deopt = true;
+  assertEquals(total, g());
+  assertUnoptimized(g);
+})();
+
+(function TriggerReduceRightPreLoopDeopt() {
+  function f(a) {
+    a.reduceRight((x) => { return Number(x) + 1 });
+  };
+  %PrepareFunctionForOptimization(f);
+  var arr = Object.seal([1, '2', ]);
+  f(arr);
+  f(arr);
+  %OptimizeFunctionOnNextCall(f);
+  assertThrows(() => f([]), TypeError);
+  assertUnoptimized(f);
+})();
+
+(function OptimizedReduceRightEagerDeoptMiddleOfIterationHoley() {
+  let deopt = false;
+  let array = [, ,11,'22',,33,45,56,,6,77,84,93,101,];
+  Object.seal(array);
+  let f = (a,current) => {
+    if (current == 6 && deopt) {array[array.length-1] = 1.5; }
+    return a + Number(current);
+  };
+  let g = function() {
+    return array.reduceRight(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertOptimized(g);
+  deopt = true;
+  g();
+  assertOptimized(g);
+  %PrepareFunctionForOptimization(g);
+  deopt = false;
+  array = [11,'22',33,45,56,6,77,84,93,101];
+  Object.seal(array);
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertUnoptimized(g);
+  deopt = true;
+  assertEquals(total, g());
+  assertUnoptimized(g);
+})();
+
+(function ReduceCatch() {
+  let f = (a,current) => {
+    return a + current;
+  };
+  let g = function() {
+    try {
+      return Object.seal(array).reduce(f);
+    } catch (e) {
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  g();
+  assertEquals(total, g());
+  assertOptimized(g);
+})();
+
+(function ReduceThrow() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) throw "x";
+    return a + Number(current);
+  };
+  let array = [1,'2',3];
+  Object.seal(array);
+  let g = function() {
+    try {
+      return array.reduce(f);
+    } catch (e) {
+      return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  %PrepareFunctionForOptimization(g);
+  %OptimizeFunctionOnNextCall(g);
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceThrow() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) throw "x";
+    return a + Number(current);
+  };
+  %NeverOptimizeFunction(f);
+  let array = [1,'2',3];
+  Object.seal(array);
+  let g = function() {
+    try {
+      return array.reduce(f);
+    } catch (e) {
+      return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  %PrepareFunctionForOptimization(g);
+  done = false;
+  %OptimizeFunctionOnNextCall(g);
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceFinally() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) throw "x";
+    return a + Number(current);
+  };
+  let array = [1,'2',3];
+  Object.seal(array);
+  let g = function() {
+    try {
+      return array.reduce(f);
+    } catch (e) {
+    } finally {
+      if (done) return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceFinallyNoInline() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) throw "x";
+    return a + Number(current);
+  };
+  %NeverOptimizeFunction(f);
+  let array = [1, '2', 3];
+  Object.seal(array);
+  let g = function() {
+    try {
+      return array.reduce(f);
+    } catch (e) {
+    } finally {
+      if (done) return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceNonCallableOpt() {
+  let done = false;
+  let f = (a, current) => {
+    return a + Number(current);
+  };
+  let array = [1,'2',3];
+  Object.seal(array);
+  let g = function() {
+    return array.reduce(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g(); g();
+  assertEquals(6, g());
+  assertOptimized(g);
+  f = null;
+  assertThrows(() => g());
+  assertOptimized(g);
+})();
+
+(function ReduceCatchInlineDeopt() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) {
+      %DeoptimizeNow();
+      throw "x";
+    }
+    return a + Number(current);
+  };
+  let array = [1,2,3];
+  Object.seal(array);
+  let g = function() {
+    try {
+      return array.reduce(f);
+    } catch (e) {
+      if (done) return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceFinallyInlineDeopt() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) {
+      %DeoptimizeNow();
+      throw "x";
+    }
+    return a + Number(current);
+  };
+  let array = [1,'2',3];
+  Object.seal(array);
+  let g = function() {
+    try {
+      return array.reduce(f);
+    } catch (e) {
+    } finally {
+      if (done) return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function OptimizedReduceRight() {
+  let count = 0;
+  let f = (a,current,i) => a + Number(current) * ++count;
+  let g = function(a) {
+    count = 0;
+    return a.reduceRight(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  let a = [1,'2',3,4,5,6,7,8,9,10];
+  Object.seal(a);
+  g(a); g(a);
+  let total = g(a);
+  %OptimizeFunctionOnNextCall(g);
+  assertEquals(total, g(a));
+  assertOptimized(g);
+})();
+
+(function OptimizedReduceEmpty() {
+  let count = 0;
+  let f = (a,current,i) => a + Number(current) * ++count;
+  let g = function(a) {
+    count = 0;
+    return a.reduceRight(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  let a = [1,'2',3,4,5,6,7,8,9,10];
+  Object.seal(a);
+  g(a); g(a); g(a);
+  %OptimizeFunctionOnNextCall(g);
+  g(a);
+  assertOptimized(g);
+  assertThrows(() => g([]));
+  assertUnoptimized(g);
+})();
+
+(function OptimizedReduceLazyDeopt() {
+  let deopt = false;
+  let f = (a,current) => { if (deopt) %DeoptimizeNow(); return a + Number(current); };
+  let g = function(a) {
+    return a.reduceRight(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  let a = [1,'2',3,4,5,6,7,8,9,10];
+  Object.seal(a);
+  g(a); g(a);
+  let total = g(a);
+  %OptimizeFunctionOnNextCall(g);
+  g(a);
+  deopt = true;
+  assertEquals(total, g(a));
+  assertOptimized(g);
+})();
+
+(function OptimizedReduceLazyDeoptMiddleOfIteration() {
+  let deopt = false;
+  let f = (a,current) => {
+    if (current == 6 && deopt) %DeoptimizeNow();
+    return a + Number(current);
+  };
+  let g = function(a) {
+    return a.reduceRight(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  let a = [11,'22',33,45,56,6,77,84,93,101];
+  Object.seal(a);
+  g(a); g(a);
+  let total = g(a);
+  %OptimizeFunctionOnNextCall(g);
+  g(a);
+  deopt = true;
+  assertEquals(total, g(a));
+  assertOptimized(g);
+})();
+
+(function OptimizedReduceEagerDeoptMiddleOfIteration() {
+  let deopt = false;
+  let array = [11,'22',33,45,56,6,77,84,93,101];
+  Object.seal(array);
+  let f = (a,current) => {
+    if (current == 6 && deopt) {array[9] = 1.5; }
+    return a + Number(current);
+  };
+  let g = function() {
+    return array.reduceRight(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertOptimized(g);
+  deopt = true;
+  %PrepareFunctionForOptimization(g);
+  g();
+  deopt = false;
+  array = [11,'22',33,45,56,6,77,84,93,101];
+  Object.seal(array);
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  deopt = true;
+  assertEquals(total, g());
+  assertOptimized(g);
+})();
+
+(function ReduceCatch() {
+  let f = (a,current) => {
+    return a + Number(current);
+  };
+  let g = function() {
+    try {
+      return Object.seal(array).reduceRight(f);
+    } catch (e) {
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  g();
+  assertEquals(total, g());
+  assertOptimized(g);
+})();
+
+(function ReduceThrow() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) throw "x";
+    return a + Number(current);
+  };
+  let array = [1,'2',3];
+  Object.seal(array);
+  let g = function() {
+    try {
+      return array.reduceRight(f);
+    } catch (e) {
+      return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  assertOptimized(g);
+  done = true;
+  assertEquals(null, g());
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceThrow() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) throw "x";
+    return a + Number(current);
+  };
+  %NeverOptimizeFunction(f);
+  let array = [1,'2',3];
+  Object.seal(array);
+  let g = function() {
+    try {
+      return array.reduceRight(f);
+    } catch (e) {
+      return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceFinally() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) throw "x";
+    return a + Number(current);
+  };
+  let array = [1, '2', 3];
+  Object.seal(array);
+  let g = function() {
+    try {
+      return array.reduceRight(f);
+    } catch (e) {
+    } finally {
+      if (done) return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceFinallyNoInline() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) throw "x";
+    return a + Number(current);
+  };
+  %NeverOptimizeFunction(f);
+  let array = [1,'2',3];
+  Object.seal(array);
+  let g = function() {
+    try {
+      return array.reduceRight(f);
+    } catch (e) {
+    } finally {
+      if (done) return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  assertOptimized(g);
+  done = true;
+  assertEquals(null, g());
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceNonCallableOpt() {
+  let done = false;
+  let f = (a, current) => {
+    return a + Number(current);
+  };
+  let array = [1,'2',3];
+  Object.seal(array);
+  let g = function() {
+    return array.reduceRight(f);
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g(); g();
+  assertEquals(6, g());
+  f = null;
+  assertThrows(() => g());
+  assertOptimized(g);
+})();
+
+(function ReduceCatchInlineDeopt() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) {
+      %DeoptimizeNow();
+      throw "x";
+    }
+    return a + Number(current);
+  };
+  let array = [1,'2',3];
+  Object.seal(array);
+  let g = function() {
+    try {
+      return array.reduceRight(f);
+    } catch (e) {
+      if (done) return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceFinallyInlineDeopt() {
+  let done = false;
+  let f = (a, current) => {
+    if (done) {
+      %DeoptimizeNow();
+      throw "x";
+    }
+    return a + Number(current);
+  };
+  let array = [1,'2',3];
+  Object.seal(array);
+  let g = function() {
+    try {
+      return array.reduceRight(f);
+    } catch (e) {
+    } finally {
+      if (done) return null;
+    }
+  };
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  let total = g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+  done = false;
+  %PrepareFunctionForOptimization(g);
+  g(); g();
+  %OptimizeFunctionOnNextCall(g);
+  g();
+  assertEquals(6, g());
+  done = true;
+  assertEquals(null, g());
+  assertOptimized(g);
+})();
+
+(function ReduceHoleyArrayWithDefaultAccumulator() {
+  var holey = new Array(10);
+  Object.seal(holey);
+  function reduce(a) {
+    let callback = function(accumulator, currentValue) {
+      return currentValue;
+    };
+    return a.reduce(callback, 13);
+  };
+  %PrepareFunctionForOptimization(reduce);
+  assertEquals(13, reduce(holey));
+  assertEquals(13, reduce(holey));
+  assertEquals(13, reduce(holey));
+  %OptimizeFunctionOnNextCall(reduce);
+  assertEquals(13, reduce(holey));
+  assertOptimized(reduce);
+})();
+
+(function ReduceRightHoleyArrayWithDefaultAccumulator() {
+  var holey = new Array(10);
+  Object.seal(holey);
+  function reduce(a) {
+    let callback = function(accumulator, currentValue) {
+      return currentValue;
+    };
+    return a.reduceRight(callback, 13);
+  };
+  %PrepareFunctionForOptimization(reduce);
+  assertEquals(13, reduce(holey));
+  assertEquals(13, reduce(holey));
+  assertEquals(13, reduce(holey));
+  %OptimizeFunctionOnNextCall(reduce);
+  assertEquals(13, reduce(holey));
+  assertOptimized(reduce);
+})();
+
+(function ReduceHoleyArrayOneElementWithDefaultAccumulator() {
+  var holey = new Array(10);
+  holey[1] = '5';
+  Object.seal(holey);
+  function reduce(a) {
+    let callback = function(accumulator, currentValue) {
+      return Number(currentValue) + accumulator;
+    };
+    return a.reduce(callback, 13);
+  };
+  %PrepareFunctionForOptimization(reduce);
+  assertEquals(18, reduce(holey));
+  assertEquals(18, reduce(holey));
+  assertEquals(18, reduce(holey));
+  %OptimizeFunctionOnNextCall(reduce);
+  assertEquals(18, reduce(holey));
+  assertOptimized(reduce);
+})();
+
+(function ReduceRightHoleyArrayOneElementWithDefaultAccumulator() {
+  var holey = new Array(10);
+  holey[1] = '5';
+  Object.seal(holey);
+  function reduce(a) {
+    let callback = function(accumulator, currentValue) {
+      return Number(currentValue) + accumulator;
+    };
+    return a.reduceRight(callback, 13);
+  };
+  %PrepareFunctionForOptimization(reduce);
+  assertEquals(18, reduce(holey));
+  assertEquals(18, reduce(holey));
+  assertEquals(18, reduce(holey));
+  %OptimizeFunctionOnNextCall(reduce);
+  assertEquals(18, reduce(holey));
+  assertOptimized(reduce);
+})();
+
+(function ReduceMixedHoleyArrays() {
+  function r(a) {
+    return a.reduce((acc, i) => {acc[0]});
+  };
+
+  // Hold on to the objects, otherwise their maps might be garbage
+  // collected and {r} will get deoptmized before the {assertOptimized}.
+  const object1 = Object.seal([[0]]);
+  const object2 = Object.seal([0,,]);
+  const object3 = Object.seal([,0,0]);
+
+  %PrepareFunctionForOptimization(r);
+  assertEquals(r(object1), [0]);
+  assertEquals(r(object1), [0]);
+  assertEquals(r(object2), 0);
+  %OptimizeFunctionOnNextCall(r);
+  assertEquals(r(object3), undefined);
+  assertOptimized(r);
+})();
diff --git a/src/v8/test/mjsunit/setters-on-elements.js b/src/v8/test/mjsunit/setters-on-elements.js
index 48fa33b..5ea0c93 100644
--- a/src/v8/test/mjsunit/setters-on-elements.js
+++ b/src/v8/test/mjsunit/setters-on-elements.js
@@ -55,6 +55,7 @@
   optimize = empty_func;
   clearFunctionTypeFeedback = empty_func;
   deoptimizeFunction = empty_func;
+  prepareForOptimize = empty_func;
 } else {
   optimize = function(name) {
     %OptimizeFunctionOnNextCall(name);
@@ -65,6 +66,9 @@
   deoptimizeFunction = function(name) {
     %DeoptimizeFunction(name);
   }
+  prepareForOptimize = function(name) {
+    %PrepareFunctionForOptimization(name);
+  }
 }
 
 function base_setter_test(create_func, index, store_value) {
@@ -76,6 +80,7 @@
   var ap = [];
   ap.__defineSetter__(index, function() { calls++; });
 
+  prepareForOptimize(foo);
   foo(a);
   foo(a);
   foo(a);
@@ -141,6 +146,7 @@
   a = create_func();
   ap2 = [];
   a.__proto__ = ap2;
+  prepareForOptimize(foo);
   foo(a);
   foo(a);
   foo(a);
@@ -161,6 +167,7 @@
   a = create_func();
   a.__proto__ = ap2;
   bar = function(a) { a[index+1] = store_value; }
+  prepareForOptimize(bar);
   bar(a);
   bar(a);
   bar(a);  // store should be generic
diff --git a/src/v8/test/mjsunit/shared-function-tier-up-turbo.js b/src/v8/test/mjsunit/shared-function-tier-up-turbo.js
index f8e9117..de53699 100644
--- a/src/v8/test/mjsunit/shared-function-tier-up-turbo.js
+++ b/src/v8/test/mjsunit/shared-function-tier-up-turbo.js
@@ -6,6 +6,10 @@
 // Flags: --opt --no-always-opt --turbo-filter=*
 
 // If we are always or never optimizing it is useless.
+if (isNeverOptimizeLiteMode()) {
+  print("Warning: skipping test that requires optimization in Lite mode.");
+  testRunner.quit(0);
+}
 assertFalse(isAlwaysOptimize());
 assertFalse(isNeverOptimize());
 
@@ -15,7 +19,8 @@
   for (var i = 0; i < 3; ++i) {
     var f = function(x) {
       return 2 * x;
-    }
+    };
+    %PrepareFunctionForOptimization(f);
     sum += f(i);
 
     if (i == 1) {
diff --git a/src/v8/test/mjsunit/shift-for-integer-div.js b/src/v8/test/mjsunit/shift-for-integer-div.js
index 9264242..353f79b 100644
--- a/src/v8/test/mjsunit/shift-for-integer-div.js
+++ b/src/v8/test/mjsunit/shift-for-integer-div.js
@@ -31,6 +31,7 @@
   return x / 4;
 }
 
+%PrepareFunctionForOptimization(divp4);
 divp4(8);
 divp4(8);
 %OptimizeFunctionOnNextCall(divp4);
@@ -42,6 +43,7 @@
   return x / (-4);
 }
 
+%PrepareFunctionForOptimization(divn4);
 divn4(8);
 divn4(8);
 %OptimizeFunctionOnNextCall(divn4);
@@ -55,6 +57,7 @@
   return x / (-1);
 }
 
+%PrepareFunctionForOptimization(divn1);
 var two_31 = 1 << 31;
 divn1(2);
 divn1(2);
@@ -68,6 +71,7 @@
   return (x / 4) | 0;
 }
 
+%PrepareFunctionForOptimization(divp4t);
 divp4t(8);
 divp4t(8);
 %OptimizeFunctionOnNextCall(divp4t);
@@ -79,6 +83,7 @@
   return (x / -4) | 0;
 }
 
+%PrepareFunctionForOptimization(divn4t);
 divn4t(8);
 divn4t(8);
 %OptimizeFunctionOnNextCall(divn4t);
@@ -91,6 +96,7 @@
   return (x / 2) | 0;
 }
 
+%PrepareFunctionForOptimization(div_by_two);
 div_by_two(12);
 div_by_two(34);
 %OptimizeFunctionOnNextCall(div_by_two);
diff --git a/src/v8/test/mjsunit/sin-cos.js b/src/v8/test/mjsunit/sin-cos.js
index 7af471d..17d48ce 100644
--- a/src/v8/test/mjsunit/sin-cos.js
+++ b/src/v8/test/mjsunit/sin-cos.js
@@ -38,6 +38,7 @@
   return Math.sin(x) + Math.cos(x) + Math.tan(x);
 }
 
+%PrepareFunctionForOptimization(no_deopt_on_minus_zero);
 no_deopt_on_minus_zero(1);
 no_deopt_on_minus_zero(1);
 %OptimizeFunctionOnNextCall(no_deopt_on_minus_zero);
diff --git a/src/v8/test/mjsunit/skipping-inner-functions.js b/src/v8/test/mjsunit/skipping-inner-functions.js
index e228b25..fba9a3e 100644
--- a/src/v8/test/mjsunit/skipping-inner-functions.js
+++ b/src/v8/test/mjsunit/skipping-inner-functions.js
@@ -365,3 +365,15 @@
   function lazy(p = (function() {}, class {}, function() {}, class { method1() { } })) { }
   lazy();
 })();
+
+(function TestOneByteTwoByteMismatch() {
+  // Regression test for
+  // https://bugs.chromium.org/p/v8/issues/detail?id=7428
+
+  let name = 'weird_string\u2653'.slice(0, 12);
+  let o = {};
+  o[name] = null;
+  var x;
+  eval('x = function weird_string() { function skip() {} };');
+  x();
+})();
diff --git a/src/v8/test/mjsunit/smi-mul-const.js b/src/v8/test/mjsunit/smi-mul-const.js
index e525501..1501231 100644
--- a/src/v8/test/mjsunit/smi-mul-const.js
+++ b/src/v8/test/mjsunit/smi-mul-const.js
@@ -28,6 +28,7 @@
 // Flags: --allow-natives-syntax --opt --noalways-opt
 
 function check(func, input, expected) {
+  %PrepareFunctionForOptimization(func);
   func(-1);
   func(-1);
   %OptimizeFunctionOnNextCall(func);
diff --git a/src/v8/test/mjsunit/smi-mul.js b/src/v8/test/mjsunit/smi-mul.js
index 12d206a..a99b27a 100644
--- a/src/v8/test/mjsunit/smi-mul.js
+++ b/src/v8/test/mjsunit/smi-mul.js
@@ -32,6 +32,7 @@
 }
 
 
+%PrepareFunctionForOptimization(mul);
 mul(-1, 2);
 mul(-1, 2);
 %OptimizeFunctionOnNextCall(mul);
@@ -47,6 +48,7 @@
     return a * b;
 }
 
+%PrepareFunctionForOptimization(mul2);
 mul2(-1, 2);
 mul2(-1, 2);
 %OptimizeFunctionOnNextCall(mul2);
diff --git a/src/v8/test/mjsunit/smi-ops-inlined.js b/src/v8/test/mjsunit/smi-ops-inlined.js
index afc6cc0..dd753d1 100644
--- a/src/v8/test/mjsunit/smi-ops-inlined.js
+++ b/src/v8/test/mjsunit/smi-ops-inlined.js
@@ -25,8 +25,6 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --always-inline-smi-code
-
 const SMI_MAX = (1 << 30) - 1;
 const SMI_MIN = -(1 << 30);
 const ONE = 1;
diff --git a/src/v8/test/mjsunit/smi-representation.js b/src/v8/test/mjsunit/smi-representation.js
index 10545c7..95580f5 100644
--- a/src/v8/test/mjsunit/smi-representation.js
+++ b/src/v8/test/mjsunit/smi-representation.js
@@ -29,7 +29,6 @@
 
 function smi_field() {
   // Assign twice to make the field non-constant.
-  // TODO(ishell): update test once constant field tracking is done.
   var o = {smi: 1};
   o.smi = 0;
   return o;
@@ -41,8 +40,8 @@
   s = s + d;
   o.smi = s;
   return o;
-}
-
+};
+%PrepareFunctionForOptimization(check_smi_repr);
 var test = smi_field();
 check_smi_repr(smi_field(), 5, 3);
 check_smi_repr(smi_field(), 6, 2);
@@ -51,7 +50,7 @@
 assertTrue(%HaveSameMap(val, test));
 
 function tagged_smi_field() {
-  var o = {"tag":false};
+  var o = {'tag': false};
   o.tag = 10;
   return o;
 }
@@ -60,8 +59,8 @@
   var t = o2.tag;
   o.smi = t;
   return o;
-}
-
+};
+%PrepareFunctionForOptimization(check_smi_repr_from_tagged);
 check_smi_repr_from_tagged(smi_field(), tagged_smi_field());
 check_smi_repr_from_tagged(smi_field(), tagged_smi_field());
 %OptimizeFunctionOnNextCall(check_smi_repr_from_tagged);
diff --git a/src/v8/test/mjsunit/spread-large-array.js b/src/v8/test/mjsunit/spread-large-array.js
new file mode 100644
index 0000000..5ec7a82
--- /dev/null
+++ b/src/v8/test/mjsunit/spread-large-array.js
@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Test that spread can create arrays in large object space.
+
+const n = 130000;
+
+{
+  let x = new Array(n);
+  for (let i = 0; i < n; ++i) x[i] = i;
+  let a = [...x];
+}
diff --git a/src/v8/test/mjsunit/spread-large-map.js b/src/v8/test/mjsunit/spread-large-map.js
new file mode 100644
index 0000000..f70770d
--- /dev/null
+++ b/src/v8/test/mjsunit/spread-large-map.js
@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Test that spread can create arrays in large object space.
+
+const n = 130000;
+
+{
+  let x = new Map();
+  for (let i = 0; i < n; ++i) x.set(i, String(i));
+  let a = [...x.values()];
+}{
+  let x = new Map();
+  for (let i = 0; i < n; ++i) x.set(i, String(i));
+  let a = [...x.keys()];
+}
diff --git a/src/v8/test/mjsunit/spread-large-set.js b/src/v8/test/mjsunit/spread-large-set.js
new file mode 100644
index 0000000..e9f406e
--- /dev/null
+++ b/src/v8/test/mjsunit/spread-large-set.js
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Test that spread can create arrays in large object space.
+
+const n = 130000;
+
+{
+  let x = new Set();
+  for (let i = 0; i < n; ++i) x.add(i);
+  let a = [...x];
+}{
+  let x = new Set();
+  for (let i = 0; i < n; ++i) x.add(i);
+  let a = [...x.values()];
+}{
+  let x = new Set();
+  for (let i = 0; i < n; ++i) x.add(i);
+  let a = [...x.keys()];
+}
diff --git a/src/v8/test/mjsunit/spread-large-string.js b/src/v8/test/mjsunit/spread-large-string.js
new file mode 100644
index 0000000..14320ee
--- /dev/null
+++ b/src/v8/test/mjsunit/spread-large-string.js
@@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Test that spread can create arrays in large object space.
+
+const n = 130000;
+
+{
+  let x = new Array(n);
+  for (let i = 0; i < n; ++i) x[i] = i;
+  let a = [...String(x)];
+}
diff --git a/src/v8/test/mjsunit/stack-trace-cpp-function-template-1.js b/src/v8/test/mjsunit/stack-trace-cpp-function-template-1.js
new file mode 100644
index 0000000..c3b7cc0
--- /dev/null
+++ b/src/v8/test/mjsunit/stack-trace-cpp-function-template-1.js
@@ -0,0 +1,37 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-stack-trace-frames
+
+// Verifies that "print" shows up in Error.stack:
+// Error
+//     at foo (...)
+//     at Object.toString (...)
+//     at print (<anonymous>)
+//     at bar (...)
+//     at (...)
+let prepareStackTraceCalled = false;
+Error.prepareStackTrace = (e, frames) => {
+  prepareStackTraceCalled = true;
+  assertEquals(5, frames.length);
+
+  assertEquals(foo, frames[0].getFunction());
+  assertEquals(object.toString, frames[1].getFunction());
+  assertEquals("print", frames[2].getFunctionName());
+  assertEquals(bar, frames[3].getFunction());
+  return frames;
+};
+
+function foo() { throw new Error(); }
+const object = { toString: () => { return foo(); } };
+
+function bar() {
+  print(object);
+}
+
+try { bar(); } catch(e) {
+  // Trigger prepareStackTrace.
+  e.stack;
+}
+assertTrue(prepareStackTraceCalled);
diff --git a/src/v8/test/mjsunit/stack-trace-cpp-function-template-2.js b/src/v8/test/mjsunit/stack-trace-cpp-function-template-2.js
new file mode 100644
index 0000000..14fb851
--- /dev/null
+++ b/src/v8/test/mjsunit/stack-trace-cpp-function-template-2.js
@@ -0,0 +1,45 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --experimental-stack-trace-frames
+
+// Verifies that "print" shows up in Error.stack when "bar" is optimized
+// by Turbofan:
+// Error
+//     at foo (...)
+//     at Object.toString (...)
+//     at print (<anonymous>)
+//     at bar (...)
+//     at (...)
+let prepareStackTraceCalled = false;
+Error.prepareStackTrace = (e, frames) => {
+  prepareStackTraceCalled = true;
+  assertEquals(5, frames.length);
+
+  assertEquals(foo, frames[0].getFunction());
+  assertEquals(object.toString, frames[1].getFunction());
+  assertEquals("print", frames[2].getFunctionName());
+  assertEquals(bar, frames[3].getFunction());
+  return frames;
+};
+
+function foo() { throw new Error(); }
+const object = { toString: () => { return foo(); } };
+
+function bar() {
+  print(object);
+}
+
+%PrepareFunctionForOptimization(bar);
+try { bar(); } catch (e) {}
+try { bar(); } catch (e) {}
+%OptimizeFunctionOnNextCall(bar);
+
+try { bar(); } catch(e) {
+  // Trigger prepareStackTrace.
+  e.stack;
+}
+
+assertOptimized(bar);
+assertTrue(prepareStackTraceCalled);
diff --git a/src/v8/test/mjsunit/stack-traces-2.js b/src/v8/test/mjsunit/stack-traces-2.js
index 45dfe3a..ca78ed3 100644
--- a/src/v8/test/mjsunit/stack-traces-2.js
+++ b/src/v8/test/mjsunit/stack-traces-2.js
@@ -57,25 +57,8 @@
   }
 }
 
-
-function testNotOmittedBuiltin(throwing, included) {
-  try {
-    throwing();
-    assertUnreachable(included);
-  } catch (e) {
-    assertTrue(e.stack.indexOf(included) >= 0, included);
-  }
-}
-
-
 testTraceNativeConversion(String);  // Does ToString on argument.
 testTraceNativeConversion(RegExp);  // Does ToString on argument.
 
 testTraceNativeConstructor(String);  // Does ToString on argument.
 testTraceNativeConstructor(RegExp);  // Does ToString on argument.
-
-// QuickSort has builtins object as receiver, and is non-native
-// builtin. Should not be omitted with the --builtins-in-stack-traces flag.
-testNotOmittedBuiltin(function(){ [thrower, 2].sort(function (a,b) {
-                                                     (b < a) - (a < b); });
-                      }, "QuickSort");
diff --git a/src/v8/test/mjsunit/stack-traces-class-fields.js b/src/v8/test/mjsunit/stack-traces-class-fields.js
new file mode 100644
index 0000000..d40abba
--- /dev/null
+++ b/src/v8/test/mjsunit/stack-traces-class-fields.js
@@ -0,0 +1,246 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --harmony-class-fields
+
+// Utility function for testing that the expected strings occur
+// in the stack trace produced when running the given function.
+function testTrace(name, fun, expected, unexpected) {
+  var threw = false;
+  try {
+    fun();
+  } catch (e) {
+    for (var i = 0; i < expected.length; i++) {
+      assertTrue(
+        e.stack.indexOf(expected[i]) != -1,
+        name + " doesn't contain expected[" + i + "] stack = " + e.stack
+      );
+    }
+    if (unexpected) {
+      for (var i = 0; i < unexpected.length; i++) {
+        assertEquals(
+          e.stack.indexOf(unexpected[i]),
+          -1,
+          name + " contains unexpected[" + i + "]"
+        );
+      }
+    }
+    threw = true;
+  }
+  assertTrue(threw, name + " didn't throw");
+}
+
+function thrower() {
+  FAIL;
+}
+
+function testClassConstruction() {
+  class X {
+    static x = thrower();
+  }
+}
+
+// ReferenceError: FAIL is not defined
+//     at thrower
+//     at <static_fields_initializer>
+//     at testClassConstruction
+//     at testTrace
+testTrace(
+  "during class construction",
+  testClassConstruction,
+  ["thrower", "<static_fields_initializer>"],
+  ["anonymous"]
+);
+
+function testClassConstruction2() {
+  class X {
+    [thrower()];
+  }
+}
+
+// ReferenceError: FAIL is not defined
+//    at thrower
+//    at testClassConstruction2
+//    at testTrace
+testTrace("during class construction2", testClassConstruction2, ["thrower"]);
+
+function testClassInstantiation() {
+  class X {
+    x = thrower();
+  }
+
+  new X();
+}
+
+// ReferenceError: FAIL is not defined
+//     at thrower
+//     at X.<instance_members_initializer>
+//     at new X
+//     at testClassInstantiation
+//     at testTrace
+testTrace(
+  "during class instantiation",
+  testClassInstantiation,
+  ["thrower", "X.<instance_members_initializer>", "new X"],
+  ["anonymous"]
+);
+
+function testClassInstantiationWithSuper() {
+  class Base {}
+
+  class X extends Base {
+    x = thrower();
+  }
+
+  new X();
+}
+
+// ReferenceError: FAIL is not defined
+//     at thrower
+//     at X.<instance_members_initializer>
+//     at new X
+//     at testClassInstantiation
+//     at testTrace
+testTrace(
+  "during class instantiation with super",
+  testClassInstantiationWithSuper,
+  ["thrower", "X.<instance_members_initializer>", "new X"],
+  ["Base", "anonymous"]
+);
+
+function testClassInstantiationWithSuper2() {
+  class Base {}
+
+  class X extends Base {
+    constructor() {
+      super();
+    }
+    x = thrower();
+  }
+
+  new X();
+}
+
+// ReferenceError: FAIL is not defined
+//     at thrower
+//     at X.<instance_members_initializer>
+//     at new X
+//     at testClassInstantiation
+//     at testTrace
+testTrace(
+  "during class instantiation with super2",
+  testClassInstantiationWithSuper2,
+  ["thrower", "X.<instance_members_initializer>", "new X"],
+  ["Base", "anonymous"]
+);
+
+function testClassInstantiationWithSuper3() {
+  class Base {
+    x = thrower();
+  }
+
+  class X extends Base {
+    constructor() {
+      super();
+    }
+  }
+
+  new X();
+}
+
+// ReferenceError: FAIL is not defined
+//     at thrower
+//     at X.<instance_members_initializer>
+//     at new Base
+//     at new X
+//     at testClassInstantiationWithSuper3
+//     at testTrace
+testTrace(
+  "during class instantiation with super3",
+  testClassInstantiationWithSuper3,
+  ["thrower", "X.<instance_members_initializer>", "new Base", "new X"],
+  ["anonymous"]
+);
+
+function testClassFieldCall() {
+  class X {
+    x = thrower;
+  }
+
+  let x = new X();
+  x.x();
+}
+
+// ReferenceError: FAIL is not defined
+//     at X.thrower [as x]
+//     at testClassFieldCall
+//     at testTrace
+testTrace(
+  "during class field call",
+  testClassFieldCall,
+  ["X.thrower"],
+  ["anonymous"]
+);
+
+function testStaticClassFieldCall() {
+  class X {
+    static x = thrower;
+  }
+
+  X.x();
+}
+
+// ReferenceError: FAIL is not defined
+//     at Function.thrower [as x]
+//     at testStaticClassFieldCall
+//     at testTrace
+testTrace(
+  "during static class field call",
+  testStaticClassFieldCall,
+  ["Function.thrower"],
+  ["anonymous"]
+);
+
+function testClassFieldCallWithFNI() {
+  class X {
+    x = function() {
+      FAIL;
+    };
+  }
+
+  let x = new X();
+  x.x();
+}
+
+// ReferenceError: FAIL is not defined
+//     at X.x
+//     at testClassFieldCallWithFNI
+//     at testTrace
+testTrace(
+  "during class field call with FNI",
+  testClassFieldCallWithFNI,
+  ["X.x"],
+  ["anonymous"]
+);
+
+function testStaticClassFieldCallWithFNI() {
+  class X {
+    static x = function() {
+      FAIL;
+    };
+  }
+
+  X.x();
+}
+
+// ReferenceError: FAIL is not defined
+//     at Function.x
+//     at testStaticClassFieldCallWithFNI
+//     at testTrace
+testTrace(
+  "during static class field call with FNI",
+  testStaticClassFieldCallWithFNI,
+  ["Function.x"],
+  ["anonymous"]
+);
diff --git a/src/v8/test/mjsunit/stack-traces.js b/src/v8/test/mjsunit/stack-traces.js
index 81418f7..a46b2b3 100644
--- a/src/v8/test/mjsunit/stack-traces.js
+++ b/src/v8/test/mjsunit/stack-traces.js
@@ -368,13 +368,17 @@
 
 // Check that overwriting the stack property during stack trace formatting
 // does not crash.
-error = new Error();
+error = new Error("foobar");
 error.__defineGetter__("name", function() { error.stack = "abc"; });
-assertEquals("abc", error.stack);
+assertTrue(error.stack.startsWith("Error"));
+assertTrue(error.stack.includes("foobar"));
 
-error = new Error();
+error = new Error("foobar");
 error.__defineGetter__("name", function() { delete error.stack; });
-assertEquals(undefined, error.stack);
+// The first time, Error.stack returns the formatted stack trace,
+// not the content of the property.
+assertTrue(error.stack.startsWith("Error"));
+assertEquals(error.stack, undefined);
 
 // Check that repeated trace collection does not crash.
 error = new Error();
diff --git a/src/v8/test/mjsunit/strict-mode-implicit-receiver.js b/src/v8/test/mjsunit/strict-mode-implicit-receiver.js
index 8284edd..4e57be0 100644
--- a/src/v8/test/mjsunit/strict-mode-implicit-receiver.js
+++ b/src/v8/test/mjsunit/strict-mode-implicit-receiver.js
@@ -114,6 +114,7 @@
 function g() {
   return strict_return_receiver();
 }
+%PrepareFunctionForOptimization(g);
 
 for (var i = 0; i < 5; i++) {
   assertEquals(void 0, g());
@@ -129,6 +130,7 @@
   o.f = strict_return_receiver;
   return o.f();
 }
+%PrepareFunctionForOptimization(g2);
 
 for (var i = 0; i < 5; i++) {
   assertTrue(typeof g2() == "object");
diff --git a/src/v8/test/mjsunit/strict-mode-opt.js b/src/v8/test/mjsunit/strict-mode-opt.js
index 5ca5c27..d6c03d2 100644
--- a/src/v8/test/mjsunit/strict-mode-opt.js
+++ b/src/v8/test/mjsunit/strict-mode-opt.js
@@ -41,6 +41,7 @@
 function nonstrictCallStrict(n) {
   strictToBeInlined(n);
 }
+%PrepareFunctionForOptimization(nonstrictCallStrict);
 
 (function testInlineStrictInNonStrict() {
   for (var i = 0; i <= MAX; i ++) {
@@ -67,11 +68,12 @@
   "use strict";
   nonstrictToBeInlined(n);
 }
+%PrepareFunctionForOptimization(strictCallNonStrict);
 
 (function testInlineNonStrictInStrict() {
   for (var i = 0; i <= MAX; i ++) {
     try {
-      if (i == MAX - 1) %OptimizeFunctionOnNextCall(nonstrictCallStrict);
+      if (i == MAX - 1) %OptimizeFunctionOnNextCall(strictCallNonStrict);
       strictCallNonStrict(i);
     } catch (e) {
       fail("no exception", "exception");
@@ -87,6 +89,7 @@
   global = "strict";
   if (n == MAX) { undefined_variable_strict_2 = "value"; }
 }
+%PrepareFunctionForOptimization(nonstrictCallStrict);
 
 (function testOptimizeStrictAssignToUndefined() {
   for (var i = 0; i <= MAX; i ++) {
diff --git a/src/v8/test/mjsunit/strict-mode.js b/src/v8/test/mjsunit/strict-mode.js
index 736ff1b..27b89ec 100644
--- a/src/v8/test/mjsunit/strict-mode.js
+++ b/src/v8/test/mjsunit/strict-mode.js
@@ -147,11 +147,11 @@
 })();
 
 // Octal literal
-CheckStrictMode("var x = 012");
-CheckStrictMode("012");
-CheckStrictMode("'Hello octal\\032'");
-CheckStrictMode("function octal() { return 012; }");
-CheckStrictMode("function octal() { return '\\032'; }");
+CheckStrictMode("var x = 012", SyntaxError);
+CheckStrictMode("012", SyntaxError);
+CheckStrictMode("'Hello octal\\032'", SyntaxError);
+CheckStrictMode("function octal() { return 012; }", SyntaxError);
+CheckStrictMode("function octal() { return '\\032'; }", SyntaxError);
 
 (function ValidEscape() {
   "use strict";
diff --git a/src/v8/test/mjsunit/string-charcodeat-external.js b/src/v8/test/mjsunit/string-charcodeat-external.js
new file mode 100644
index 0000000..be74650
--- /dev/null
+++ b/src/v8/test/mjsunit/string-charcodeat-external.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-externalize-string --expose-gc --allow-natives-syntax
+
+function foo(s) {
+  return s.charCodeAt(12);
+}
+
+var extern = "internalized dummy";
+extern = "1234567890qiaipppiúöäöáœba"+"jalsdjasldjasdlasjdalsdjasldk";
+externalizeString(extern, true /* force two-byte */);
+%PrepareFunctionForOptimization(foo);
+assertEquals(97, foo(extern));
+assertEquals(97, foo(extern));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(97, foo(extern));
diff --git a/src/v8/test/mjsunit/string-charcodeat.js b/src/v8/test/mjsunit/string-charcodeat.js
index 6031096..f71b3ce 100644
--- a/src/v8/test/mjsunit/string-charcodeat.js
+++ b/src/v8/test/mjsunit/string-charcodeat.js
@@ -94,7 +94,9 @@
 
 function NotAString() {
   var n = new Thing();
-  n.toString = function() { return "Test"; };
+  n.toString = function() {
+    return 'Test';
+  };
   n.charCodeAt = String.prototype.charCodeAt;
   return n;
 }
@@ -102,7 +104,9 @@
 
 function NotAString16() {
   var n = new Thing();
-  n.toString = function() { return "Te\u1234t"; };
+  n.toString = function() {
+    return 'Te\u1234t';
+  };
   n.charCodeAt = String.prototype.charCodeAt;
   return n;
 }
@@ -111,7 +115,7 @@
 function TestStringType(generator, sixteen) {
   var g = generator;
   var len = g().toString().length;
-  var t = sixteen ? "t" : "f"
+  var t = sixteen ? 't' : 'f';
   t += generator.name;
   assertTrue(isNaN(g().charCodeAt(-1e19)), 1 + t);
   assertTrue(isNaN(g().charCodeAt(-0x80000001)), 2 + t);
@@ -157,8 +161,8 @@
 function Flat16Optimized() {
   var str = Flat16();
   return str.charCodeAt(2);
-}
-
+};
+%PrepareFunctionForOptimization(Flat16Optimized);
 assertEquals(0x1234, Flat16Optimized());
 assertEquals(0x1234, Flat16Optimized());
 %OptimizeFunctionOnNextCall(Flat16Optimized);
@@ -167,8 +171,8 @@
 function ConsNotSmiIndex() {
   var str = Cons();
   assertTrue(isNaN(str.charCodeAt(0x7fffffff)));
-}
-
+};
+%PrepareFunctionForOptimization(ConsNotSmiIndex);
 for (var i = 0; i < 5; i++) {
   ConsNotSmiIndex();
 }
@@ -183,7 +187,9 @@
 
 function StupidThing() {
   // Doesn't return a string from toString!
-  this.toString = function() { return 42; }
+  this.toString = function() {
+    return 42;
+  };
   this.charCodeAt = String.prototype.charCodeAt;
 }
 
@@ -203,10 +209,10 @@
 medium += medium; // 256.
 
 var long = medium;
-long += long + long + long;     // 1024.
-long += long + long + long;     // 4096.
-long += long + long + long;     // 16384.
-long += long + long + long;     // 65536.
+long += long + long + long;  // 1024.
+long += long + long + long;  // 4096.
+long += long + long + long;  // 16384.
+long += long + long + long;  // 65536.
 
 assertTrue(isNaN(medium.charCodeAt(-1)), 31);
 assertEquals(49, medium.charCodeAt(0), 32);
@@ -232,8 +238,8 @@
   assertEquals(97, "a".x(0));
   assertEquals(98, "b".x(0));
   assertEquals(99, "c".x(0));
-}
-
+};
+%PrepareFunctionForOptimization(directlyOnPrototype);
 for (var i = 0; i < 5; i++) {
   directlyOnPrototype();
 }
diff --git a/src/v8/test/mjsunit/string-deopt.js b/src/v8/test/mjsunit/string-deopt.js
new file mode 100644
index 0000000..2574484
--- /dev/null
+++ b/src/v8/test/mjsunit/string-deopt.js
@@ -0,0 +1,65 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license
+// that can be found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+(()=> {
+  function f(a, b, c) {
+    return a.indexOf(b, c);
+  };
+  %PrepareFunctionForOptimization(f);
+  f("abc", "de", 1);
+  f("abc", "de", 1);
+  %OptimizeFunctionOnNextCall(f);
+  f("abc", "de", {});
+  %PrepareFunctionForOptimization(f);
+  %OptimizeFunctionOnNextCall(f);
+  f("abc", "de", {});
+  assertOptimized(f);
+})();
+
+(()=> {
+  function f(a, b, c) {
+    return a.indexOf(b, c);
+  };
+  %PrepareFunctionForOptimization(f);
+  f("abc", "de", 1);
+  f("abc", "de", 1);
+  %OptimizeFunctionOnNextCall(f);
+  f("abc", {}, 1);
+  %PrepareFunctionForOptimization(f);
+  %OptimizeFunctionOnNextCall(f);
+  f("abc", {}, 1);
+  assertOptimized(f);
+})();
+
+(()=> {
+  function f(a, b, c) {
+    return a.substring(b, c);
+  };
+  %PrepareFunctionForOptimization(f);
+  f("abcde", 1, 4);
+  f("abcde", 1, 4);
+  %OptimizeFunctionOnNextCall(f);
+  f("abcde", 1, {});
+  %PrepareFunctionForOptimization(f);
+  %OptimizeFunctionOnNextCall(f);
+  f("abcde", 1, {});
+  assertOptimized(f);
+})();
+
+(()=> {
+  function f(a, b, c) {
+    return a.substring(b, c);
+  };
+  %PrepareFunctionForOptimization(f);
+  f("abcde", 1, 4);
+  f("abcde", 1, 4);
+  %OptimizeFunctionOnNextCall(f);
+  f("abcde", {}, 4);
+  %PrepareFunctionForOptimization(f);
+  %OptimizeFunctionOnNextCall(f);
+  f("abcde", {}, 4);
+  assertOptimized(f);
+})();
diff --git a/src/v8/test/mjsunit/string-external-cached.js b/src/v8/test/mjsunit/string-external-cached.js
index cd368f6..dd8a993 100644
--- a/src/v8/test/mjsunit/string-external-cached.js
+++ b/src/v8/test/mjsunit/string-external-cached.js
@@ -53,7 +53,7 @@
     assertEquals('B', charat_str[i].charAt(3*16 + 11));
   }
 
-  charat_short = "012";
+  charat_short = "01234";
   try {  // String can only be externalized once
     externalizeString(charat_short, true);
   } catch (ex) { }
diff --git a/src/v8/test/mjsunit/string-externalize.js b/src/v8/test/mjsunit/string-externalize.js
index dd861e8..22840c2 100644
--- a/src/v8/test/mjsunit/string-externalize.js
+++ b/src/v8/test/mjsunit/string-externalize.js
@@ -45,7 +45,7 @@
   assertTrue(isOneByteString(str));
 
   var twoByteExternalWithOneByteData =
-      "AA" + dont_inline();
+      "AAAA" + dont_inline();
   externalizeString(twoByteExternalWithOneByteData, true /* force two-byte */);
   assertFalse(isOneByteString(twoByteExternalWithOneByteData));
 
@@ -54,12 +54,10 @@
   externalizeString(realTwoByteExternalString);
   assertFalse(isOneByteString(realTwoByteExternalString));
 
-  assertTrue(isOneByteString(["a", twoByteExternalWithOneByteData].join("")));
+  assertFalse(isOneByteString(["a", twoByteExternalWithOneByteData].join("")));
 
-  // Appending a two-byte string that contains only ascii chars should
-  // still produce an ascii cons.
   var str1 = str + twoByteExternalWithOneByteData;
-  assertTrue(isOneByteString(str1));
+  assertFalse(isOneByteString(str1));
 
   // Force flattening of the string.
   var old_length = str1.length - twoByteExternalWithOneByteData.length;
@@ -70,11 +68,11 @@
     assertEquals("A", str1[i]);
   }
 
-  // Flattened string should still be ascii.
-  assertTrue(isOneByteString(str1));
+  // Flattened string should still be two-byte.
+  assertFalse(isOneByteString(str1));
 
-  // Lower-casing an ascii string should produce ascii.
-  assertTrue(isOneByteString(str1.toLowerCase()));
+  // Lower-casing an ascii string should produce two-byte.
+  assertFalse(isOneByteString(str1.toLowerCase()));
 
   assertFalse(isOneByteString(["a", realTwoByteExternalString].join("")));
 
diff --git a/src/v8/test/mjsunit/string-fromcharcode.js b/src/v8/test/mjsunit/string-fromcharcode.js
index ac51682..b9f5eae 100644
--- a/src/v8/test/mjsunit/string-fromcharcode.js
+++ b/src/v8/test/mjsunit/string-fromcharcode.js
@@ -42,8 +42,8 @@
   }
   assertEquals(String.fromCharCode(0xFFFF), String.fromCharCode(0xFFFFFFFF));
   return result;
-}
-
+};
+%PrepareFunctionForOptimization(testCharCodeTruncation);
 assertEquals(expected, testCharCodeTruncation());
 assertEquals(expected, testCharCodeTruncation());
 %OptimizeFunctionOnNextCall(testCharCodeTruncation);
@@ -51,12 +51,18 @@
 
 // Test various receivers and arguments passed to String.fromCharCode.
 
-Object.prototype.fromCharCode = function(x) { return this; };
+Object.prototype.fromCharCode = function(x) {
+  return this;
+};
 
 var fcc = String.fromCharCode;
 var fcc2 = fcc;
 
-function constFun(x) { return function(y) { return x; }; }
+function constFun(x) {
+  return function(y) {
+    return x;
+  };
+}
 
 function test(num) {
   assertEquals(" ", String.fromCharCode(0x20));
@@ -85,11 +91,10 @@
   assertEquals("  ", fcc(0x20, 0x20));
   assertEquals("  ", fcc(0x20 + 0.5, 0x20));
 
-  var receiver = (num < 5) ? String : (num < 9) ? "dummy" : 42;
-  fcc2 = (num < 5) ? fcc
-                   : (num < 9) ? constFun(Object("dummy"))
-                               : constFun(Object(42));
-  var expected = (num < 5) ? " " : (num < 9) ? Object("dummy") : Object(42);
+  var receiver = num < 5 ? String : num < 9 ? 'dummy' : 42;
+  fcc2 = num < 5 ? fcc :
+                   num < 9 ? constFun(Object('dummy')) : constFun(Object(42));
+  var expected = num < 5 ? ' ' : num < 9 ? Object('dummy') : Object(42);
   assertEquals(expected, receiver.fromCharCode(0x20));
   assertEquals(expected, receiver.fromCharCode(0x20 - 0x10000));
   assertEquals(expected, receiver.fromCharCode(0x20 + 0.5));
@@ -105,7 +110,10 @@
 
 // Test the custom IC works correctly when the map changes.
 for (var i = 0; i < 10; i++) {
-  var expected = (i < 5) ? " " : 42;
-  if (i == 5) String.fromCharCode = function() { return 42; };
+  var expected = i < 5 ? ' ' : 42;
+  if (i == 5)
+    String.fromCharCode = function() {
+      return 42;
+    };
   assertEquals(expected, String.fromCharCode(0x20));
 }
diff --git a/src/v8/test/mjsunit/string-indexof-1.js b/src/v8/test/mjsunit/string-indexof-1.js
index 0267b2c..5a2043c 100644
--- a/src/v8/test/mjsunit/string-indexof-1.js
+++ b/src/v8/test/mjsunit/string-indexof-1.js
@@ -212,6 +212,7 @@
   function f() {
     return 'abc'.indexOf('a');
   }
+  %PrepareFunctionForOptimization(f);
   assertEquals(0, f());
   assertEquals(0, f());
   assertEquals(0, f());
@@ -221,6 +222,7 @@
   function f2() {
     return 'abc'.indexOf('a', 1);
   }
+  %PrepareFunctionForOptimization(f2);
   assertEquals(-1, f2());
   assertEquals(-1, f2());
   assertEquals(-1, f2());
@@ -230,6 +232,7 @@
   function f3() {
     return 'abc'.indexOf('a');
   }
+  %PrepareFunctionForOptimization(f3);
   assertEquals(0, f3());
   assertEquals(0, f3());
   assertEquals(0, f3());
@@ -239,6 +242,7 @@
   function f4() {
     return 'abcbc'.indexOf('bc', 2);
   }
+  %PrepareFunctionForOptimization(f4);
   assertEquals(3, f4());
   assertEquals(3, f4());
   assertEquals(3, f4());
@@ -248,6 +252,7 @@
   function f5() {
     return 'abcbc'.indexOf('b', -1);
   }
+  %PrepareFunctionForOptimization(f5);
   assertEquals(1, f5());
   assertEquals(1, f5());
   assertEquals(1, f5());
@@ -257,6 +262,7 @@
   function f6() {
     return 'abcbc'.indexOf('b', -10737418);
   }
+  %PrepareFunctionForOptimization(f6);
   assertEquals(1, f6());
   assertEquals(1, f6());
   assertEquals(1, f6());
diff --git a/src/v8/test/mjsunit/string-pad.js b/src/v8/test/mjsunit/string-pad.js
new file mode 100644
index 0000000..836ab81
--- /dev/null
+++ b/src/v8/test/mjsunit/string-pad.js
@@ -0,0 +1,155 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+class MyError {};
+const throwing = {toString() {throw new MyError}};
+const empties = ['', {toString() {return ''}}];
+
+{
+  const s = '';
+
+  assertThrows(_ => s.padStart(Symbol(), throwing), TypeError);
+  assertEquals(s, s.padStart(NaN, throwing));
+  assertEquals(s, s.padStart(-Infinity, throwing));
+  assertEquals(s, s.padStart(-9, throwing));
+  assertEquals(s, s.padStart(-1, throwing));
+  assertEquals(s, s.padStart(-0, throwing));
+  assertEquals(s, s.padStart(0, throwing));
+  assertThrows(_ => s.padStart(3, throwing), MyError);
+  assertThrows(_ => s.padStart(9, throwing), MyError);
+  assertThrows(_ => s.padStart(2**31-1, throwing), MyError);
+  assertThrows(_ => s.padStart(2**31, throwing), MyError);
+  assertThrows(_ => s.padStart(2**32-1, throwing), MyError);
+  assertThrows(_ => s.padStart(2**32, throwing), MyError);
+  assertThrows(_ => s.padStart(2**53-1, throwing), MyError);
+  assertThrows(_ => s.padStart(2**53, throwing), MyError);
+  assertThrows(_ => s.padStart(Infinity, throwing), MyError);
+
+  assertThrows(_ => s.padEnd(Symbol(), throwing), TypeError);
+  assertEquals(s, s.padEnd(NaN, throwing));
+  assertEquals(s, s.padEnd(-Infinity, throwing));
+  assertEquals(s, s.padEnd(-9, throwing));
+  assertEquals(s, s.padEnd(-1, throwing));
+  assertEquals(s, s.padEnd(-0, throwing));
+  assertEquals(s, s.padEnd(0, throwing));
+  assertThrows(_ => s.padEnd(3, throwing), MyError);
+  assertThrows(_ => s.padEnd(9, throwing), MyError);
+  assertThrows(_ => s.padEnd(2**31-1, throwing), MyError);
+  assertThrows(_ => s.padEnd(2**31, throwing), MyError);
+  assertThrows(_ => s.padEnd(2**32-1, throwing), MyError);
+  assertThrows(_ => s.padEnd(2**32, throwing), MyError);
+  assertThrows(_ => s.padEnd(2**53-1, throwing), MyError);
+  assertThrows(_ => s.padEnd(2**53, throwing), MyError);
+  assertThrows(_ => s.padEnd(Infinity, throwing), MyError);
+
+  for (const empty of empties) {
+    assertThrows(_ => s.padStart(Symbol(), empty), TypeError);
+    assertEquals(s, s.padStart(NaN, empty));
+    assertEquals(s, s.padStart(-Infinity, empty));
+    assertEquals(s, s.padStart(-9, empty));
+    assertEquals(s, s.padStart(-1, empty));
+    assertEquals(s, s.padStart(-0, empty));
+    assertEquals(s, s.padStart(0, empty));
+    assertEquals(s, s.padStart(3, empty));
+    assertEquals(s, s.padStart(9, empty));
+    assertEquals(s, s.padStart(2**31-1, empty));
+    assertEquals(s, s.padStart(2**31, empty));
+    assertEquals(s, s.padStart(2**32-1, empty));
+    assertEquals(s, s.padStart(2**32, empty));
+    assertEquals(s, s.padStart(2**53-1, empty));
+    assertEquals(s, s.padStart(2**53, empty));
+    assertEquals(s, s.padStart(Infinity, empty));
+
+    assertThrows(_ => s.padEnd(Symbol(), empty), TypeError);
+    assertEquals(s, s.padEnd(NaN, empty));
+    assertEquals(s, s.padEnd(-Infinity, empty));
+    assertEquals(s, s.padEnd(-9, empty));
+    assertEquals(s, s.padEnd(-1, empty));
+    assertEquals(s, s.padEnd(-0, empty));
+    assertEquals(s, s.padEnd(0, empty));
+    assertEquals(s, s.padEnd(3, empty));
+    assertEquals(s, s.padEnd(9, empty));
+    assertEquals(s, s.padEnd(2**31-1, empty));
+    assertEquals(s, s.padEnd(2**31, empty));
+    assertEquals(s, s.padEnd(2**32-1, empty));
+    assertEquals(s, s.padEnd(2**32, empty));
+    assertEquals(s, s.padEnd(2**53-1, empty));
+    assertEquals(s, s.padEnd(2**53, empty));
+    assertEquals(s, s.padEnd(Infinity, empty));
+  }
+}
+
+{
+  const s = 'hello';
+
+  assertThrows(_ => s.padStart(Symbol(), throwing), TypeError);
+  assertEquals(s, s.padStart(NaN, throwing));
+  assertEquals(s, s.padStart(-Infinity, throwing));
+  assertEquals(s, s.padStart(-9, throwing));
+  assertEquals(s, s.padStart(-1, throwing));
+  assertEquals(s, s.padStart(-0, throwing));
+  assertEquals(s, s.padStart(0, throwing));
+  assertEquals(s, s.padStart(3, throwing));
+  assertThrows(_ => s.padStart(9, throwing), MyError);
+  assertThrows(_ => s.padStart(2**31-1, throwing), MyError);
+  assertThrows(_ => s.padStart(2**31, throwing), MyError);
+  assertThrows(_ => s.padStart(2**32-1, throwing), MyError);
+  assertThrows(_ => s.padStart(2**32, throwing), MyError);
+  assertThrows(_ => s.padStart(2**53-1, throwing), MyError);
+  assertThrows(_ => s.padStart(2**53, throwing), MyError);
+  assertThrows(_ => s.padStart(Infinity, throwing), MyError);
+
+  assertThrows(_ => s.padEnd(Symbol(), throwing), TypeError);
+  assertEquals(s, s.padEnd(NaN, throwing));
+  assertEquals(s, s.padEnd(-Infinity, throwing));
+  assertEquals(s, s.padEnd(-9, throwing));
+  assertEquals(s, s.padEnd(-1, throwing));
+  assertEquals(s, s.padEnd(-0, throwing));
+  assertEquals(s, s.padEnd(0, throwing));
+  assertEquals(s, s.padEnd(3, throwing));
+  assertThrows(_ => s.padEnd(9, throwing), MyError);
+  assertThrows(_ => s.padEnd(2**31-1, throwing), MyError);
+  assertThrows(_ => s.padEnd(2**31, throwing), MyError);
+  assertThrows(_ => s.padEnd(2**32-1, throwing), MyError);
+  assertThrows(_ => s.padEnd(2**32, throwing), MyError);
+  assertThrows(_ => s.padEnd(2**53-1, throwing), MyError);
+  assertThrows(_ => s.padEnd(2**53, throwing), MyError);
+  assertThrows(_ => s.padEnd(Infinity, throwing), MyError);
+
+  for (const empty of empties) {
+    assertThrows(_ => s.padStart(Symbol(), empty), TypeError);
+    assertEquals(s, s.padStart(NaN, empty));
+    assertEquals(s, s.padStart(-Infinity, empty));
+    assertEquals(s, s.padStart(-9, empty));
+    assertEquals(s, s.padStart(-1, empty));
+    assertEquals(s, s.padStart(-0, empty));
+    assertEquals(s, s.padStart(0, empty));
+    assertEquals(s, s.padStart(3, empty));
+    assertEquals(s, s.padStart(9, empty));
+    assertEquals(s, s.padStart(2**31-1, empty));
+    assertEquals(s, s.padStart(2**31, empty));
+    assertEquals(s, s.padStart(2**32-1, empty));
+    assertEquals(s, s.padStart(2**32, empty));
+    assertEquals(s, s.padStart(2**53-1, empty));
+    assertEquals(s, s.padStart(2**53, empty));
+    assertEquals(s, s.padStart(Infinity, empty));
+
+    assertThrows(_ => s.padEnd(Symbol(), empty), TypeError);
+    assertEquals(s, s.padEnd(NaN, empty));
+    assertEquals(s, s.padEnd(-Infinity, empty));
+    assertEquals(s, s.padEnd(-9, empty));
+    assertEquals(s, s.padEnd(-1, empty));
+    assertEquals(s, s.padEnd(-0, empty));
+    assertEquals(s, s.padEnd(0, empty));
+    assertEquals(s, s.padEnd(3, empty));
+    assertEquals(s, s.padEnd(9, empty));
+    assertEquals(s, s.padEnd(2**31-1, empty));
+    assertEquals(s, s.padEnd(2**31, empty));
+    assertEquals(s, s.padEnd(2**32-1, empty));
+    assertEquals(s, s.padEnd(2**32, empty));
+    assertEquals(s, s.padEnd(2**53-1, empty));
+    assertEquals(s, s.padEnd(2**53, empty));
+    assertEquals(s, s.padEnd(Infinity, empty));
+  }
+}
diff --git a/src/v8/test/mjsunit/string-slices.js b/src/v8/test/mjsunit/string-slices.js
index 52f1506..77b5de6 100644
--- a/src/v8/test/mjsunit/string-slices.js
+++ b/src/v8/test/mjsunit/string-slices.js
@@ -35,17 +35,32 @@
 assertEquals(s, s.substr(null));
 assertEquals(s, s.substr(false));
 assertEquals(s, s.substr(0.9));
-assertEquals(s, s.substr({ valueOf: function() { return 0; } }));
-assertEquals(s, s.substr({ toString: function() { return '0'; } }));
+assertEquals(s, s.substr({
+  valueOf: function() {
+    return 0;
+  }
+}));
+assertEquals(s, s.substr({
+  toString: function() {
+    return '0';
+  }
+}));
 
 var s1 = s.substring(1);
 assertEquals(s1, s.substr(1));
 assertEquals(s1, s.substr('1'));
 assertEquals(s1, s.substr(true));
 assertEquals(s1, s.substr(1.1));
-assertEquals(s1, s.substr({ valueOf: function() { return 1; } }));
-assertEquals(s1, s.substr({ toString: function() { return '1'; } }));
-
+assertEquals(s1, s.substr({
+  valueOf: function() {
+    return 1;
+  }
+}));
+assertEquals(s1, s.substr({
+  toString: function() {
+    return '1';
+  }
+}));
 
 assertEquals(s.substring(s.length - 1), s.substr(-1));
 assertEquals(s.substring(s.length - 1), s.substr(-1.2));
@@ -73,16 +88,16 @@
 /x/.exec(x);  // Try to force a flatten.
 for (var i = 5; i < 25; i++) {
   for (var j = 0; j < 25; j++) {
-    var z = x.substring(i, i+j);
+    var z = x.substring(i, i + j);
     var w = Math.random() * 42;  // Allocate something new in new-space.
     assertEquals(j, z.length);
     for (var k = 0; k < j; k++) {
-      assertEquals(x.charAt(i+k), z.charAt(k));
+      assertEquals(x.charAt(i + k), z.charAt(k));
     }
   }
 }
 // Then two-byte strings.
-x = "UC16\u2028";  // Non-ascii char forces two-byte string.
+x = 'UC16\u2028';  // Non-ascii char forces two-byte string.
 for (var i = 0; i < 25; i++) {
   x += (i >> 4).toString(16) + (i & 0x0f).toString(16);
 }
@@ -93,7 +108,7 @@
     var w = Math.random() * 42;  // Allocate something new in new-space.
     assertEquals(j, z.length);
     for (var k = 0; k < j; k++) {
-      assertEquals(x.charAt(i+k), z.charAt(k));
+      assertEquals(x.charAt(i + k), z.charAt(k));
     }
   }
 }
@@ -105,7 +120,7 @@
 var cache = [];
 for (var i = 0; i < 1000; i++) {
   var z = x.substring(i % xl);
-  assertEquals(xl - (i % xl), z.length);
+  assertEquals(xl - i % xl, z.length);
   cache.push(z);
 }
 
@@ -117,7 +132,7 @@
 var cache = [];
 for (var i = 0; i < 1000; i++) {
   var z = x.substring(i % xl);
-  assertEquals(xl - (i % xl), z.length);
+  assertEquals(xl - i % xl, z.length);
   cache.push(z);
 }
 
@@ -135,28 +150,28 @@
   var z = cache.pop();
   assertTrue(/\u2028123456789ABCDEF/.test(z));
   assertEquals(xl - offset, z.length);
-  assertEquals(x.charAt(i*(i+1)/2), z.charAt(0));
+  assertEquals(x.charAt(i * (i + 1) / 2), z.charAt(0));
   offset -= i;
 }
 
 // Test charAt for different strings.
 function f(s1, s2, s3, i) {
-  assertEquals(String.fromCharCode(97+i%11), s1.charAt(i%11));
-  assertEquals(String.fromCharCode(97+i%11), s2.charAt(i%11));
-  assertEquals(String.fromCharCode(98+i%11), s3.charAt(i%11));
+  assertEquals(String.fromCharCode(97 + i % 11), s1.charAt(i % 11));
+  assertEquals(String.fromCharCode(97 + i % 11), s2.charAt(i % 11));
+  assertEquals(String.fromCharCode(98 + i % 11), s3.charAt(i % 11));
   assertEquals(String.fromCharCode(101), s3.charAt(3));
 }
 
 flat = "abcdefghijkl12345";
 cons = flat + flat.toUpperCase();
 slice = "abcdefghijklmn12345".slice(1, -1);
-for ( var i = 0; i < 1000; i++) {
+for (var i = 0; i < 1000; i++) {
   f(flat, cons, slice, i);
 }
 flat = "abcdefghijkl1\u20232345";
 cons = flat + flat.toUpperCase();
 slice = "abcdefghijklmn1\u20232345".slice(1, -1);
-for ( var i = 0; i < 1000; i++) {
+for (var i = 0; i < 1000; i++) {
   f(flat, cons, slice, i);
 }
 
@@ -180,35 +195,38 @@
 // Concatenate substrings.
 var ascii = 'abcdefghijklmnop';
 var utf = '\u03B1\u03B2\u03B3\u03B4\u03B5\u03B6\u03B7\u03B8\u03B9\u03BA\u03BB';
-assertEquals("klmno", ascii.substring(10,15) + ascii.substring(16));
-assertEquals("\u03B4\u03B7", utf.substring(3,4) + utf.substring(6,7));
-assertEquals("klp", ascii.substring(10,12) + ascii.substring(15,16));
-assertEquals("\u03B1\u03B4\u03B5", utf.substring(0,1) + utf.substring(5,3));
+assertEquals('klmno', ascii.substring(10, 15) + ascii.substring(16));
+assertEquals('\u03B4\u03B7', utf.substring(3, 4) + utf.substring(6, 7));
+assertEquals('klp', ascii.substring(10, 12) + ascii.substring(15, 16));
+assertEquals('\u03B1\u03B4\u03B5', utf.substring(0, 1) + utf.substring(5, 3));
 assertEquals("", ascii.substring(16) + utf.substring(16));
-assertEquals("bcdef\u03B4\u03B5\u03B6\u03B7\u03B8\u03B9",
-    ascii.substring(1,6) + utf.substring(3,9));
-assertEquals("\u03B4\u03B5\u03B6\u03B7\u03B8\u03B9abcdefghijklmnop",
-    utf.substring(3,9) + ascii);
-assertEquals("\u03B2\u03B3\u03B4\u03B5\u03B4\u03B5\u03B6\u03B7",
-    utf.substring(5,1) + utf.substring(3,7));
+assertEquals(
+    'bcdef\u03B4\u03B5\u03B6\u03B7\u03B8\u03B9',
+    ascii.substring(1, 6) + utf.substring(3, 9));
+assertEquals(
+    '\u03B4\u03B5\u03B6\u03B7\u03B8\u03B9abcdefghijklmnop',
+    utf.substring(3, 9) + ascii);
+assertEquals(
+    '\u03B2\u03B3\u03B4\u03B5\u03B4\u03B5\u03B6\u03B7',
+    utf.substring(5, 1) + utf.substring(3, 7));
 
 // Externalizing strings.
 var a = "internalized dummy";
 a = "123456789" + "qwertyuiopasdfghjklzxcvbnm";
-var b = "23456789qwertyuiopasdfghjklzxcvbn"
-assertEquals(a.slice(1,-1), b);
+var b = '23456789qwertyuiopasdfghjklzxcvbn';
+assertEquals(a.slice(1, -1), b);
 
 assertTrue(isOneByteString(a));
 externalizeString(a, true);
 assertFalse(isOneByteString(a));
 
-assertEquals(a.slice(1,-1), b);
+assertEquals(a.slice(1, -1), b);
 assertTrue(/3456789qwe/.test(a));
 assertEquals(5, a.indexOf("678"));
 assertEquals("12345", a.split("6")[0]);
 
 // Create a slice with an external string as parent string.
-var c = a.slice(1,-1);
+var c = a.slice(1, -1);
 
 function test_crankshaft() {
   for (var i = 0; i < 20; i++) {
@@ -219,8 +237,8 @@
     assertEquals(4, c.indexOf("678"));
     assertEquals("2345", c.split("6")[0]);
   }
-}
-
+};
+%PrepareFunctionForOptimization(test_crankshaft);
 test_crankshaft();
 %OptimizeFunctionOnNextCall(test_crankshaft);
 test_crankshaft();
diff --git a/src/v8/test/mjsunit/string-split.js b/src/v8/test/mjsunit/string-split.js
index 8068838..9ee7446 100644
--- a/src/v8/test/mjsunit/string-split.js
+++ b/src/v8/test/mjsunit/string-split.js
@@ -25,6 +25,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// Flags: --allow-natives-syntax
+
 expected = ["A", undefined, "B", "bold", "/", "B", "and", undefined, "CODE", "coded", "/", "CODE", ""];
 result = "A<B>bold</B>and<CODE>coded</CODE>".split(/<(\/)?([^<>]+)>/);
 assertArrayEquals(expected, result);
@@ -134,6 +136,11 @@
 assertEquals(["a", "b", "c"], "abc".split("", 4));
 assertEquals(["a", "b", "c"], "abc".split("", numberObj(4)));
 
+// Check if split works also for sliced strings.
+let sliced_string = %ConstructSlicedString("abcdefghijklmnopqrstuvwxyz", 13);
+assertEquals("nopqrstuvwxyz".split(""), sliced_string.split(""));
+// Invoke twice for caching
+assertEquals("nopqrstuvwxyz".split(""), sliced_string.split(""));
 
 var all_ascii_codes = [];
 for (var i = 0; i < 128; i++) all_ascii_codes[i] = i;
@@ -174,3 +181,5 @@
 assertArrayEquals(["a", "b", "c"], "a,b,c,d,e,f".split(/,/, -4294967293));
 assertArrayEquals(["a", "b", "c", "d"], "a,b,c,d,e,f".split(/,/, -4294967292));
 assertArrayEquals(["a", "b", "c", "d", "e", "f"], "a,b,c,d,e,f".split(/,/, -1));
+assertArrayEquals(["a", "b", "c"], "abc".split("", 0xffffffff));
+assertArrayEquals(["\u0427", "\u0427"], "\u0427\u0427".split("", 0xffffffff));
diff --git a/src/v8/test/mjsunit/string-trim.js b/src/v8/test/mjsunit/string-trim.js
new file mode 100644
index 0000000..587e7db
--- /dev/null
+++ b/src/v8/test/mjsunit/string-trim.js
@@ -0,0 +1,9 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals('trim',      String.prototype.trim.name);
+assertEquals('trimStart', String.prototype.trimStart.name);
+assertEquals('trimStart', String.prototype.trimLeft.name);
+assertEquals('trimEnd',   String.prototype.trimEnd.name);
+assertEquals('trimEnd',   String.prototype.trimRight.name);
diff --git a/src/v8/test/mjsunit/strong-rooted-literals.js b/src/v8/test/mjsunit/strong-rooted-literals.js
index 68804e5..92dfb0e 100644
--- a/src/v8/test/mjsunit/strong-rooted-literals.js
+++ b/src/v8/test/mjsunit/strong-rooted-literals.js
@@ -13,6 +13,7 @@
     return a;
   }
 
+  %PrepareFunctionForOptimization(foo);
   foo();
   foo();
   %OptimizeFunctionOnNextCall(foo);
@@ -26,9 +27,13 @@
     return o.x + o.y;
   }
   function mapPlus(a, y) {
-    return a.map(x => hot({x, y}));
+    var f = (x => hot({x, y}));
+    %EnsureFeedbackVectorForFunction(f);
+    return a.map(f);
   }
 
+  %EnsureFeedbackVectorForFunction(mapPlus);
+  %PrepareFunctionForOptimization(hot);
   var a = [1, 2, 3];
   print(mapPlus(a, 1));
   print(mapPlus(a, 2));
@@ -44,10 +49,12 @@
 (function() {
   var sopen = 'function wrapper() {  ';
   var s1 = 'function foo() { return bar(5); } ';
-  var s2 = 'foo(); foo(); %OptimizeFunctionOnNextCall(foo); foo(); ';
+  var s2 = '%PrepareFunctionForOptimization(foo); ';
+  var s3 = 'foo(); foo(); %OptimizeFunctionOnNextCall(foo); foo(); ';
   var sclose = '}  wrapper(); ';
-  var s = sopen + s1 + s2 + sclose;
+  var s = sopen + s1 + s2 + s3 + sclose;
   function bar(i){return i + 3};
+  %EnsureFeedbackVectorForFunction(bar);
 
   for (var i = 0; i < 4; i++) {
     eval(s);
diff --git a/src/v8/test/mjsunit/sum-0-plus-undefined-is-NaN.js b/src/v8/test/mjsunit/sum-0-plus-undefined-is-NaN.js
index 5d662d1..c820f49 100644
--- a/src/v8/test/mjsunit/sum-0-plus-undefined-is-NaN.js
+++ b/src/v8/test/mjsunit/sum-0-plus-undefined-is-NaN.js
@@ -31,9 +31,12 @@
  * @fileoverview Test addition of 0 and undefined.
  */
 
-function sum(a, b) { return a + b; }
-
+function sum(a, b) {
+  return a + b;
+};
+%PrepareFunctionForOptimization(sum);
 function test(x, y, expectNaN) {
+  %PrepareFunctionForOptimization(sum);
   for (var i = 0; i < 5; i++) {
     assertEquals(expectNaN, isNaN(sum(x, y)));
   }
diff --git a/src/v8/test/mjsunit/switch-opt.js b/src/v8/test/mjsunit/switch-opt.js
index c1d5d38..875a8de 100644
--- a/src/v8/test/mjsunit/switch-opt.js
+++ b/src/v8/test/mjsunit/switch-opt.js
@@ -61,6 +61,7 @@
         break;
     }
   }
+  %PrepareFunctionForOptimization(f);
 
   function assertResult(r, label, b1, b2, b3) {
     f(label, b1, b2, b3);
@@ -94,30 +95,36 @@
   assertEquals(9, x);
 
   // Test deopt at the beginning of the case label evaluation.
+  %PrepareFunctionForOptimization(f);
   assertResult([2], "ca", "deopt", true);
   %OptimizeFunctionOnNextCall(f);
   assertResult([4], "ca", "deopt", false);
   assertEquals(10, x);
+  %PrepareFunctionForOptimization(f);
   %OptimizeFunctionOnNextCall(f);
 
   // Test deopt in the middle of the case label evaluation.
   assertResult([2], "ac", true, "deopt");
+  %PrepareFunctionForOptimization(f);
   %OptimizeFunctionOnNextCall(f);
   assertResult([4], "ac", false, "deopt");
   assertEquals(11, x);
 
   // Test deopt in the default case.
+  %PrepareFunctionForOptimization(f);
   %OptimizeFunctionOnNextCall(f);
   print("here");
   assertResult([4], 10000, false, false, "deopt");
   assertEquals(12, x);
 
   // Test deopt in the default case.
+  %PrepareFunctionForOptimization(f);
   %OptimizeFunctionOnNextCall(f);
   assertResult([4], 10000, false, false, "deopt");
   assertEquals(13, x);
 
   // Test deopt in x++ case.
+  %PrepareFunctionForOptimization(f);
   %OptimizeFunctionOnNextCall(f);
   assertResult([5], 13, false, false, "deopt");
   assertEquals(14, x);
@@ -158,6 +165,7 @@
         break;
     }
   }
+  %PrepareFunctionForOptimization(f);
 
   function assertResult(r, label, b1, b2, b3) {
     f(label, b1, b2, b3);
@@ -191,30 +199,36 @@
   assertEquals(9, x);
 
   // Test deopt at the beginning of the case label evaluation.
+  %PrepareFunctionForOptimization(f);
   assertResult([2,3], "ca", "deopt", true);
   %OptimizeFunctionOnNextCall(f);
   assertResult([4,5], "ca", "deopt", false);
   assertEquals(10, x);
+  %PrepareFunctionForOptimization(f);
   %OptimizeFunctionOnNextCall(f);
 
   // Test deopt in the middle of the case label evaluation.
   assertResult([2,3], "ac", true, "deopt");
+  %PrepareFunctionForOptimization(f);
   %OptimizeFunctionOnNextCall(f);
   assertResult([4,5], "ac", false, "deopt");
   assertEquals(11, x);
 
   // Test deopt in the default case.
+  %PrepareFunctionForOptimization(f);
   %OptimizeFunctionOnNextCall(f);
   print("here");
   assertResult([4,5], 10000, false, false, "deopt");
   assertEquals(12, x);
 
   // Test deopt in the default case.
+  %PrepareFunctionForOptimization(f);
   %OptimizeFunctionOnNextCall(f);
   assertResult([4,5], 10000, false, false, "deopt");
   assertEquals(13, x);
 
   // Test deopt in x++ case.
+  %PrepareFunctionForOptimization(f);
   %OptimizeFunctionOnNextCall(f);
   assertResult([5], 13, false, false, "deopt");
   assertEquals(14, x);
diff --git a/src/v8/test/mjsunit/switch.js b/src/v8/test/mjsunit/switch.js
index 4722e9e..4096f41 100644
--- a/src/v8/test/mjsunit/switch.js
+++ b/src/v8/test/mjsunit/switch.js
@@ -350,6 +350,7 @@
   var values = clause_values[clause_type];
 
   function opt(fn) {
+    if (optimize) %PrepareFunctionForOptimization(fn);
     if (feedback === 'all') {
       values.forEach(fn);
     } else if (Array.isArray(feedback)) {
@@ -515,3 +516,13 @@
   }
   assertEquals(1, i);
 })();
+
+assertThrows(function() {
+  function f(){}
+  // The f()-- unconditionally throws a ReferenceError.
+  switch(f()--) {
+    // This label is dead.
+    default:
+      break;
+  }
+}, ReferenceError);
diff --git a/src/v8/test/mjsunit/test-async.js b/src/v8/test/mjsunit/test-async.js
new file mode 100644
index 0000000..8f7b553
--- /dev/null
+++ b/src/v8/test/mjsunit/test-async.js
@@ -0,0 +1,117 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Used for async tests. See definition below for more documentation.
+var testAsync;
+
+(function () {  // Scope for utility functions.
+  /**
+   * This is to be used through the testAsync helper function defined
+   * below.
+   *
+   * This requires the --allow-natives-syntax flag to allow calling
+   * runtime functions.
+   *
+   * There must be at least one assertion in an async test. A test
+   * with no assertions will fail.
+   *
+   * @example
+   * testAsync(assert => {
+   *   assert.plan(1) // There should be one assertion in this test.
+   *   Promise.resolve(1)
+   *    .then(val => assert.equals(1, val),
+   *          assert.unreachable);
+   * })
+   */
+  class AsyncAssertion {
+    constructor(test, name) {
+      this.expectedAsserts_ = -1;
+      this.actualAsserts_ = 0;
+      this.test_ = test;
+      this.name_ = name || '';
+    }
+
+    /**
+     * Sets the number of expected asserts in the test. The test fails
+     * if the number of asserts computed after running the test is not
+     * equal to this specified value.
+     * @param {number} expectedAsserts
+     */
+    plan(expectedAsserts) {
+      this.expectedAsserts_ = expectedAsserts;
+    }
+
+    fail(expectedText, found) {
+      let message = formatFailureText(expectedText, found);
+      message += "\nin test:" + this.name_
+      message += "\n" + Function.prototype.toString.apply(this.test_);
+      %AbortJS(message);
+    }
+
+    equals(expected, found, name_opt) {
+      this.actualAsserts_++;
+      if (!deepEquals(expected, found)) {
+        this.fail(prettyPrinted(expected), found, name_opt);
+      }
+    }
+
+    unreachable() {
+      let message = "Failure: unreachable in test: " + this.name_;
+      message += "\n" + Function.prototype.toString.apply(this.test_);
+      %AbortJS(message);
+    }
+
+    unexpectedRejection(details) {
+      return (error) => {
+        let message =
+            "Failure: unexpected Promise rejection in test: " + this.name_;
+        if (details) message += "\n    @" + details;
+        if (error instanceof Error) {
+          message += "\n" + String(error.stack);
+        } else {
+          message += "\n" + String(error);
+        }
+        message += "\n\n" + Function.prototype.toString.apply(this.test_);
+        %AbortJS(message);
+      };
+    }
+
+    drainMicrotasks() {
+      %PerformMicrotaskCheckpoint();
+    }
+
+    done_() {
+      if (this.expectedAsserts_ === -1) {
+        let message = "Please call t.plan(count) to initialize test harness " +
+            "with correct assert count (Note: count > 0)";
+        %AbortJS(message);
+      }
+
+      if (this.expectedAsserts_ !== this.actualAsserts_) {
+        let message = "Expected asserts: " + this.expectedAsserts_;
+        message += ", Actual asserts: " + this.actualAsserts_;
+        message += "\nin test: " + this.name_;
+        message += "\n" + Function.prototype.toString.apply(this.test_);
+        %AbortJS(message);
+      }
+    }
+  }
+
+  /** This is used to test async functions and promises.
+   * @param {testCallback} test - test function
+   * @param {string} [name] - optional name of the test
+   *
+   *
+   * @callback testCallback
+   * @param {AsyncAssertion} assert
+   */
+  testAsync = function(test, name) {
+    let assert = new AsyncAssertion(test, name);
+    test(assert);
+    %PerformMicrotaskCheckpoint();
+    assert.done_();
+  }
+})();
diff --git a/src/v8/test/mjsunit/testcfg.py b/src/v8/test/mjsunit/testcfg.py
index bc9d69f..2112b1d 100644
--- a/src/v8/test/mjsunit/testcfg.py
+++ b/src/v8/test/mjsunit/testcfg.py
@@ -25,41 +25,63 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+from collections import OrderedDict
+import itertools
 import os
 import re
 
+from testrunner.local import statusfile
 from testrunner.local import testsuite
 from testrunner.objects import testcase
+from testrunner.outproc import base as outproc
+
+try:
+  basestring       # Python 2
+except NameError:  # Python 3
+  basestring = str
 
 FILES_PATTERN = re.compile(r"//\s+Files:(.*)")
 ENV_PATTERN = re.compile(r"//\s+Environment Variables:(.*)")
 SELF_SCRIPT_PATTERN = re.compile(r"//\s+Env: TEST_FILE_NAME")
-MODULE_PATTERN = re.compile(r"^// MODULE$", flags=re.MULTILINE)
 NO_HARNESS_PATTERN = re.compile(r"^// NO HARNESS$", flags=re.MULTILINE)
 
 
+# Flags known to misbehave when combining arbitrary mjsunit tests. Can also
+# be compiled regular expressions.
+COMBINE_TESTS_FLAGS_BLACKLIST = [
+  '--check-handle-count',
+  '--enable-tracing',
+  re.compile('--experimental.*'),
+  '--expose-trigger-failure',
+  re.compile('--harmony.*'),
+  '--mock-arraybuffer-allocator',
+  '--print-ast',
+  re.compile('--trace.*'),
+  '--wasm-lazy-compilation',
+]
+
+
+class TestLoader(testsuite.JSTestLoader):
+  @property
+  def excluded_files(self):
+    return {
+      "mjsunit.js",
+      "mjsunit_numfuzz.js",
+    }
+
+
 class TestSuite(testsuite.TestSuite):
-  def ListTests(self, context):
-    tests = []
-    for dirname, dirs, files in os.walk(self.root, followlinks=True):
-      for dotted in [x for x in dirs if x.startswith('.')]:
-        dirs.remove(dotted)
-      dirs.sort()
-      files.sort()
-      for filename in files:
-        if filename.endswith(".js") and filename != "mjsunit.js":
-          fullpath = os.path.join(dirname, filename)
-          relpath = fullpath[len(self.root) + 1 : -3]
-          testname = relpath.replace(os.path.sep, "/")
-          test = self._create_test(testname)
-          tests.append(test)
-    return tests
+  def _test_loader_class(self):
+    return TestLoader
+
+  def _test_combiner_class(self):
+    return TestCombiner
 
   def _test_class(self):
     return TestCase
 
 
-class TestCase(testcase.TestCase):
+class TestCase(testcase.D8TestCase):
   def __init__(self, *args, **kwargs):
     super(TestCase, self).__init__(*args, **kwargs)
 
@@ -76,8 +98,7 @@
         break
     files = [ os.path.normpath(os.path.join(self.suite.root, '..', '..', f))
               for f in files_list ]
-    testfilename = os.path.join(self.suite.root,
-                                self.path + self._get_suffix())
+    testfilename = self._get_source_path()
     if SELF_SCRIPT_PATTERN.search(source):
       files = (
         ["-e", "TEST_FILE_NAME=\"%s\"" % testfilename.replace("\\", "\\\\")] +
@@ -88,15 +109,13 @@
     else:
       mjsunit_files = [os.path.join(self.suite.root, "mjsunit.js")]
 
-    files_suffix = []
-    if MODULE_PATTERN.search(source):
-      files_suffix.append("--module")
-    files_suffix.append(testfilename)
+    if self.suite.framework_name == 'num_fuzzer':
+      mjsunit_files.append(os.path.join(self.suite.root, "mjsunit_numfuzz.js"))
 
     self._source_files = files
     self._source_flags = self._parse_source_flags(source)
     self._mjsunit_files = mjsunit_files
-    self._files_suffix = files_suffix
+    self._files_suffix = [testfilename]
     self._env = self._parse_source_env(source)
 
   def _parse_source_env(self, source):
@@ -111,12 +130,12 @@
   def _get_source_flags(self):
     return self._source_flags
 
-  def _get_files_params(self, ctx):
+  def _get_files_params(self):
     files = list(self._source_files)
-    if not ctx.no_harness:
+    if not self._test_config.no_harness:
       files += self._mjsunit_files
     files += self._files_suffix
-    if ctx.isolates:
+    if self._test_config.isolates:
       files += ['--isolate'] + files
 
     return files
@@ -125,8 +144,142 @@
     return self._env
 
   def _get_source_path(self):
-    return os.path.join(self.suite.root, self.path + self._get_suffix())
+    base_path = os.path.join(self.suite.root, self.path)
+    # Try .js first, and fall back to .mjs.
+    # TODO(v8:9406): clean this up by never separating the path from
+    # the extension in the first place.
+    if os.path.exists(base_path + self._get_suffix()):
+      return base_path + self._get_suffix()
+    return base_path + '.mjs'
 
 
-def GetSuite(name, root):
-  return TestSuite(name, root)
+class TestCombiner(testsuite.TestCombiner):
+  def get_group_key(self, test):
+    """Combine tests with the same set of flags.
+    Ignore:
+    1. Some special cases where it's not obvious what to pass in the command.
+    2. Tests with flags that can cause failure even inside try-catch wrapper.
+    3. Tests that use async functions. Async functions can be scheduled after
+      exiting from try-catch wrapper and cause failure.
+    """
+    if (len(test._files_suffix) > 1 or
+        test._env or
+        not test._mjsunit_files or
+        test._source_files):
+      return None
+
+    source_flags = test._get_source_flags()
+    if ('--expose-trigger-failure' in source_flags or
+        '--throws' in source_flags):
+      return None
+
+    source_code = test.get_source()
+    # Maybe we could just update the tests to await all async functions they
+    # call?
+    if 'async' in source_code:
+      return None
+
+    # TODO(machenbach): Remove grouping if combining tests in a flag-independent
+    # way works well.
+    return 1
+
+  def _combined_test_class(self):
+    return CombinedTest
+
+
+class CombinedTest(testcase.D8TestCase):
+  """Behaves like normal mjsunit tests except:
+    1. Expected outcome is always PASS
+    2. Instead of one file there is a try-catch wrapper with all combined tests
+      passed as arguments.
+  """
+  def __init__(self, name, tests):
+    super(CombinedTest, self).__init__(tests[0].suite, '', name,
+                                       tests[0]._test_config)
+    self._tests = tests
+
+  def _prepare_outcomes(self, force_update=True):
+    self._statusfile_outcomes = outproc.OUTCOMES_PASS_OR_TIMEOUT
+    self.expected_outcomes = outproc.OUTCOMES_PASS_OR_TIMEOUT
+
+  def _get_shell_flags(self):
+    """In addition to standard set of shell flags it appends:
+      --disable-abortjs: %AbortJS can abort the test even inside
+        trycatch-wrapper, so we disable it.
+      --es-staging: We blacklist all harmony flags due to false positives,
+          but always pass the staging flag to cover the mature features.
+      --omit-quit: Calling quit() in JS would otherwise early terminate.
+      --quiet-load: suppress any stdout from load() function used by
+        trycatch-wrapper.
+    """
+    return [
+      '--test',
+      '--disable-abortjs',
+      '--es-staging',
+      '--omit-quit',
+      '--quiet-load',
+    ]
+
+  def _get_cmd_params(self):
+    return (
+      super(CombinedTest, self)._get_cmd_params() +
+      ['tools/testrunner/trycatch_loader.js', '--'] +
+      self._tests[0]._mjsunit_files +
+      ['--'] +
+      [t._files_suffix[0] for t in self._tests]
+    )
+
+  def _merge_flags(self, flags):
+    """Merges flags from a list of flags.
+
+    Flag values not starting with '-' are merged with the preceeding flag,
+    e.g. --foo 1 will become --foo=1. All other flags remain the same.
+
+    Returns: A generator of flags.
+    """
+    if not flags:
+      return
+    # Iterate over flag pairs. ['-'] is a sentinel value for the last iteration.
+    for flag1, flag2 in itertools.izip(flags, flags[1:] + ['-']):
+      if not flag2.startswith('-'):
+        assert '=' not in flag1
+        yield flag1 + '=' + flag2
+      elif flag1.startswith('-'):
+        yield flag1
+
+  def _is_flag_blacklisted(self, flag):
+    for item in COMBINE_TESTS_FLAGS_BLACKLIST:
+      if isinstance(item, basestring):
+        if item == flag:
+          return True
+      elif item.match(flag):
+        return True
+    return False
+
+  def _get_combined_flags(self, flags_gen):
+    """Combines all flags - dedupes, keeps order and filters some flags.
+
+    Args:
+      flags_gen: Generator for flag lists.
+    Returns: A list of flags.
+    """
+    merged_flags = self._merge_flags(list(itertools.chain(*flags_gen)))
+    unique_flags = OrderedDict((flag, True) for flag in merged_flags).keys()
+    return [
+      flag for flag in unique_flags
+      if not self._is_flag_blacklisted(flag)
+    ]
+
+  def _get_source_flags(self):
+    # Combine flags from all source files.
+    return self._get_combined_flags(
+        test._get_source_flags() for test in self._tests)
+
+  def _get_statusfile_flags(self):
+    # Combine flags from all status file entries.
+    return self._get_combined_flags(
+        test._get_statusfile_flags() for test in self._tests)
+
+
+def GetSuite(*args, **kwargs):
+  return TestSuite(*args, **kwargs)
diff --git a/src/v8/test/mjsunit/thin-strings.js b/src/v8/test/mjsunit/thin-strings.js
index c867642..0c50cf6 100644
--- a/src/v8/test/mjsunit/thin-strings.js
+++ b/src/v8/test/mjsunit/thin-strings.js
@@ -22,17 +22,21 @@
   assertEquals("o", str.substring(1, 2));
   assertEquals("f".charCodeAt(0), str.charCodeAt(0));
   assertEquals("f", str.split(/oo/)[0]);
-}
+};
+%PrepareFunctionForOptimization(CheckCS);
 CheckCS();
 %OptimizeFunctionOnNextCall(CheckCS);
 CheckCS();
 
 function CheckTF() {
-  try {} catch(e) {}  // Turbofan.
+  try {
+  } catch (e) {
+  }  // Turbofan.
   assertEquals("o", str.substring(1, 2));
   assertEquals("f".charCodeAt(0), str.charCodeAt(0));
   assertEquals("f", str.split(/oo/)[0]);
-}
+};
+%PrepareFunctionForOptimization(CheckTF);
 CheckTF();
 %OptimizeFunctionOnNextCall(CheckTF);
 CheckTF();
@@ -57,7 +61,8 @@
 function cc1(s) {
   assertEquals(95, s.charCodeAt(0));
   assertEquals(95, s.codePointAt(0));
-}
+};
+%PrepareFunctionForOptimization(cc1);
 cc1(s);
 cc1(s);
 %OptimizeFunctionOnNextCall(cc1);
@@ -76,14 +81,15 @@
   return slice;
 }
 
-var t = get_sliced_thin_string("abcdefghijklmnopqrstuvwxyz",
-                               "abcdefghijklmnopqrstuvwxyz");
+var t = get_sliced_thin_string(
+    'abcdefghijklmnopqrstuvwxyz', 'abcdefghijklmnopqrstuvwxyz');
 assertEquals("abcdefghijklmnopqrst", decodeURI(t));
 
 function cc2(s) {
   assertEquals(97, s.charCodeAt(0));
   assertEquals(97, s.codePointAt(0));
-}
+};
+%PrepareFunctionForOptimization(cc2);
 cc2(t);
 cc2(t);
 %OptimizeFunctionOnNextCall(cc2);
diff --git a/src/v8/test/mjsunit/tools/compiler-trace-flags-wasm.js b/src/v8/test/mjsunit/tools/compiler-trace-flags-wasm.js
new file mode 100644
index 0000000..2d7cd00
--- /dev/null
+++ b/src/v8/test/mjsunit/tools/compiler-trace-flags-wasm.js
@@ -0,0 +1,30 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Disable liftoff to make sure we generate turbofan traces.
+// Flags: --no-liftoff
+// Flags: --trace-turbo --trace-turbo-graph
+// Flags: --trace-turbo-cfg-file=test/mjsunit/tools/turbo.cfg
+// Flags: --trace-turbo-path=test/mjsunit/tools
+
+// Only trace the wasm functions:
+// Flags: --trace-turbo-filter=wasm*
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+// The idea behind this test is to make sure we do not crash when using the
+// --trace-turbo flag given different sort of inputs.
+
+(function testWASM() {
+  let builder = new WasmModuleBuilder();
+
+  builder.addFunction("add", kSig_i_ii)
+    .addBody([kExprGetLocal, 0,
+              kExprGetLocal, 1,
+              kExprI32Add])
+    .exportFunc();
+
+  let instance = builder.instantiate();
+  instance.exports.add(21, 21);
+})();
diff --git a/src/v8/test/mjsunit/tools/compiler-trace-flags.js b/src/v8/test/mjsunit/tools/compiler-trace-flags.js
new file mode 100644
index 0000000..e0dfb37
--- /dev/null
+++ b/src/v8/test/mjsunit/tools/compiler-trace-flags.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --trace-turbo --trace-turbo-graph
+// Flags: --trace-turbo-cfg-file=test/mjsunit/tools/turbo.cfg
+// Flags: --trace-turbo-path=test/mjsunit/tools
+
+// Only trace the "add" function:
+// Flags: --trace-turbo-filter=add
+
+// The idea behind this test is to make sure we do not crash when using the
+// --trace-turbo flag given different sort of inputs.
+
+(function testOptimizedJS() {
+  function add(a, b) {
+    return a + b;
+  };
+  %PrepareFunctionForOptimization(add);
+  add(21, 21);
+  %OptimizeFunctionOnNextCall(add);
+  add(20, 22);
+})();
diff --git a/src/v8/test/mjsunit/tools/csvparser.js b/src/v8/test/mjsunit/tools/csvparser.js
index ffca9dd..91eb3e4 100644
--- a/src/v8/test/mjsunit/tools/csvparser.js
+++ b/src/v8/test/mjsunit/tools/csvparser.js
@@ -84,3 +84,7 @@
 assertEquals(
     ['code-creation','Function','0x42f0a0','163','""'],
     parser.parseLine('code-creation,Function,0x42f0a0,163,""'));
+
+assertEquals(
+    ['foo C:\\Users\\someuser\\script.js:1:13'],
+    parser.parseLine('foo C:\\\\Users\\\\someuser\\\\script.js:1:13'));
diff --git a/src/v8/test/mjsunit/tools/profviz-test.default b/src/v8/test/mjsunit/tools/profviz-test.default
index 040afb4..0c33e11 100644
--- a/src/v8/test/mjsunit/tools/profviz-test.default
+++ b/src/v8/test/mjsunit/tools/profviz-test.default
@@ -1435,8 +1435,8 @@
   "46.74 0.08499999999999375",
   "57.64849999999997 0.08249999999999602",
   "58.316999999999965 0.08099999999999596",
-  "23.506 0.08050000000000068",
   "46.37200000000001 0.08050000000000068",
+  "23.506 0.08050000000000068",
   "42.70600000000002 0.07900000000000063",
   "129.4124999999999 0.07800000000000296",
   "20.5975 0.07750000000000057",
@@ -1450,16 +1450,16 @@
   "44.917000000000016 0.07200000000000273",
   "25.591500000000003 0.07199999999999918",
   "50.62049999999999 0.07150000000000034",
-  "46.621 0.07099999999999795",
   "88.82299999999992 0.07099999999999795",
+  "46.621 0.07099999999999795",
   "78.23049999999994 0.0660000000000025",
   "46.060500000000005 0.0659999999999954",
   "50.43099999999999 0.06400000000000006",
   "129.48849999999987 0.06349999999997635",
   "45.55900000000001 0.06150000000000233",
   "19.152 0.06050000000000111",
-  "50.20799999999999 0.060499999999997556",
   "57.33299999999997 0.060499999999997556",
+  "50.20799999999999 0.060499999999997556",
   "68.76649999999995 0.06049999999999045",
   "23.5775 0.059499999999999886",
   "47.135000000000005 0.05850000000000222",
@@ -1468,8 +1468,8 @@
   "21.2695 0.057500000000000995",
   "50.14149999999999 0.05749999999999744",
   "91.96649999999993 0.056500000000013983",
-  "57.934999999999974 0.05649999999999977",
   "83.63999999999993 0.05649999999999977",
+  "57.934999999999974 0.05649999999999977",
   "132.92249999999987 0.05649999999997135",
   "67.59199999999996 0.056000000000011596",
   "99.92199999999991 0.055499999999995",
@@ -1490,9 +1490,9 @@
   "75.46799999999995 0.04950000000000898",
   "45.76150000000001 0.049500000000001876",
   "94.6054999999999 0.04949999999998056",
-  "45.97850000000001 0.048500000000004206",
-  "115.4124999999999 0.048500000000004206",
   "118.19199999999991 0.048500000000004206",
+  "115.4124999999999 0.048500000000004206",
+  "45.97850000000001 0.048500000000004206",
   "49.780499999999996 0.0484999999999971",
   "42.795000000000016 0.04800000000000182",
   "126.59899999999989 0.04749999999999943",
@@ -1512,23 +1512,23 @@
   "52.15399999999998 0.0379999999999967",
   "42.88200000000001 0.0379999999999967",
   "24.430500000000002 0.03750000000000142",
-  "23.907 0.036499999999996646",
   "60.08349999999996 0.036499999999996646",
+  "23.907 0.036499999999996646",
   "50.32899999999999 0.036000000000001364",
   "42.31450000000002 0.034000000000006025",
   "45.02900000000001 0.032999999999994145",
   "23.189 0.031500000000001194",
   "21.49 0.03049999999999997",
-  "42.83300000000001 0.030000000000001137",
   "58.12149999999997 0.030000000000001137",
   "45.41750000000002 0.030000000000001137",
+  "42.83300000000001 0.030000000000001137",
   "140.89599999999987 0.028999999999996362",
   "2.4490000000000003 0.028500000000000636",
   "52.31499999999998 0.027999999999998693",
   "45.17200000000002 0.027999999999998693",
-  "43.632500000000014 0.027000000000001023",
-  "49.8685 0.027000000000001023",
   "51.30249999999999 0.027000000000001023",
+  "49.8685 0.027000000000001023",
+  "43.632500000000014 0.027000000000001023",
   "21.175 0.026499999999998636",
   "44.82200000000002 0.026000000000003354",
   "22.528 0.02599999999999625",
diff --git a/src/v8/test/mjsunit/tools/profviz.js b/src/v8/test/mjsunit/tools/profviz.js
index fc0da5d..f89a2ad 100644
--- a/src/v8/test/mjsunit/tools/profviz.js
+++ b/src/v8/test/mjsunit/tools/profviz.js
@@ -30,6 +30,8 @@
 // Files: tools/consarray.js tools/profile.js tools/profile_view.js
 // Files: tools/logreader.js tools/arguments.js tools/tickprocessor.js
 // Files: tools/profviz/composer.js
+// Resources: test/mjsunit/tools/profviz-test.log
+// Resources: test/mjsunit/tools/profviz-test.default
 // Env: TEST_FILE_NAME
 
 assertEquals('string', typeof TEST_FILE_NAME);
diff --git a/src/v8/test/mjsunit/tools/tickprocessor.js b/src/v8/test/mjsunit/tools/tickprocessor.js
index cf38985..07d0646 100644
--- a/src/v8/test/mjsunit/tools/tickprocessor.js
+++ b/src/v8/test/mjsunit/tools/tickprocessor.js
@@ -29,6 +29,14 @@
 // Files: tools/splaytree.js tools/codemap.js tools/csvparser.js
 // Files: tools/consarray.js tools/profile.js tools/profile_view.js
 // Files: tools/logreader.js tools/arguments.js tools/tickprocessor.js
+// Resources: test/mjsunit/tools/tickprocessor-test-func-info.log
+// Resources: test/mjsunit/tools/tickprocessor-test.default
+// Resources: test/mjsunit/tools/tickprocessor-test.func-info
+// Resources: test/mjsunit/tools/tickprocessor-test.gc-state
+// Resources: test/mjsunit/tools/tickprocessor-test.ignore-unknown
+// Resources: test/mjsunit/tools/tickprocessor-test.log
+// Resources: test/mjsunit/tools/tickprocessor-test.only-summary
+// Resources: test/mjsunit/tools/tickprocessor-test.separate-ic
 // Env: TEST_FILE_NAME
 
 
@@ -126,6 +134,47 @@
   }
   assertEquals(libc_ref_syms, libc_syms);
 
+  // Android library with zero length duplicates.
+  UnixCppEntriesProvider.prototype.loadSymbols = function(libName) {
+    this.symbols = [[
+      '00000000013a1088 0000000000000224 t v8::internal::interpreter::BytecodeGenerator::BytecodeGenerator(v8::internal::UnoptimizedCompilationInfo*)',
+      '00000000013a1088 0000000000000224 t v8::internal::interpreter::BytecodeGenerator::BytecodeGenerator(v8::internal::UnoptimizedCompilationInfo*)',
+      '00000000013a12ac t $x.4',
+      '00000000013a12ac 00000000000000d0 t v8::internal::interpreter::BytecodeGenerator::FinalizeBytecode(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Script>)',
+      '00000000013a137c t $x.5',
+      '00000000013a137c 0000000000000528 t v8::internal::interpreter::BytecodeGenerator::AllocateDeferredConstants(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Script>)',
+      '00000000013a1578 N $d.46',
+      '00000000013a18a4 t $x.6',
+      '00000000013a18a4 0000000000000 t v8::internal::interpreter::BytecodeGenerator::GlobalDeclarationsBuilder::AllocateDeclarations(v8::internal::UnoptimizedCompilationInfo*, v8::internal::Handle<v8::internal::Script>, v8::internal::Isolate*)',
+      '00000000013a19e0 t $x.7',
+      '00000000013a19e0 0000000000000244 t v8::internal::interpreter::BytecodeGenerator::GenerateBytecode(unsigned long)',
+      '00000000013a1a88 N $d.7',
+      '00000000013a1ac8 N $d.5',
+      '00000000013a1af8 N $d.35',
+      '00000000013a1c24 t $x.8',
+      '00000000013a1c24 000000000000009c t v8::internal::interpreter::BytecodeGenerator::ContextScope::ContextScope(v8::internal::interpreter::BytecodeGenerator*, v8::internal::Scope*)\n',
+    ].join('\n'), ''];
+  };
+  var android_prov = new UnixCppEntriesProvider();
+  var android_syms = [];
+  android_prov.parseVmSymbols('libmonochrome', 0xf7c5c000, 0xf9c5c000, 0,
+      function (name, start, end) {
+        android_syms.push(Array.prototype.slice.apply(arguments, [0]));
+      });
+  var android_ref_syms = [
+       ['v8::internal::interpreter::BytecodeGenerator::BytecodeGenerator(v8::internal::UnoptimizedCompilationInfo*)', 0x013a1088, 0x013a1088 + 0x224],
+       ['v8::internal::interpreter::BytecodeGenerator::FinalizeBytecode(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Script>)', 0x013a12ac, 0x013a12ac + 0xd0],
+       ['v8::internal::interpreter::BytecodeGenerator::AllocateDeferredConstants(v8::internal::Isolate*, v8::internal::Handle<v8::internal::Script>)', 0x013a137c, 0x013a137c + 0x528],
+       ['v8::internal::interpreter::BytecodeGenerator::GlobalDeclarationsBuilder::AllocateDeclarations(v8::internal::UnoptimizedCompilationInfo*, v8::internal::Handle<v8::internal::Script>, v8::internal::Isolate*)', 0x013a18a4, 0x013a18a4 + 0x13c],
+       ['v8::internal::interpreter::BytecodeGenerator::GenerateBytecode(unsigned long)', 0x013a19e0, 0x013a19e0 + 0x244],
+       ['v8::internal::interpreter::BytecodeGenerator::ContextScope::ContextScope(v8::internal::interpreter::BytecodeGenerator*, v8::internal::Scope*)', 0x013a1c24, 0x013a1c24 + 0x9c],
+  ];
+  for (var i = 0; i < android_ref_syms.length; ++i) {
+    android_ref_syms[i][1] += 0xf7c5c000;
+    android_ref_syms[i][2] += 0xf7c5c000;
+  }
+  assertEquals(android_ref_syms, android_syms);
+
   UnixCppEntriesProvider.prototype.loadSymbols = oldLoadSymbols;
 })();
 
diff --git a/src/v8/test/mjsunit/tools/trace-ic.js b/src/v8/test/mjsunit/tools/trace-ic.js
new file mode 100644
index 0000000..35fe209
--- /dev/null
+++ b/src/v8/test/mjsunit/tools/trace-ic.js
@@ -0,0 +1,62 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --trace-ic --logfile=test/mjsunit/tools/trace-ic-test.log
+// Flags: --allow-natives-syntax
+
+// The idea behind this test is to make sure we do not crash when using the
+// --trace-ic flag.
+
+
+(function testLoadIC() {
+  function loadIC(obj) {
+    return obj.field;
+  }
+
+  %EnsureFeedbackVectorForFunction(loadIC);
+
+  var obj = {field: 'hello'};
+  loadIC(obj);
+  loadIC(obj);
+  loadIC(obj);
+})();
+
+(function testStoreIC() {
+  function storeIC(obj, value) {
+    return obj.field = value;
+  }
+
+  %EnsureFeedbackVectorForFunction(storeIC);
+
+  var obj = {field: 'hello'};
+  storeIC(obj, 'world');
+  storeIC(obj, 'world');
+  storeIC(obj, 'world');
+})();
+
+(function testKeyedLoadIC() {
+  function keyedLoadIC(obj, field) {
+    return obj[field];
+  }
+
+  %EnsureFeedbackVectorForFunction(keyedLoadIC);
+
+  var obj = {field: 'hello'};
+  keyedLoadIC(obj, 'field');
+  keyedLoadIC(obj, 'field');
+  keyedLoadIC(obj, 'field');
+})();
+
+(function testKeyedStoreIC() {
+  function keyedStoreIC(obj, field, value) {
+    return obj[field] = value;
+  }
+
+  %EnsureFeedbackVectorForFunction(keyedStoreIC);
+
+  var obj = {field: 'hello'};
+  keyedStoreIC(obj, 'field', 'world');
+  keyedStoreIC(obj, 'field', 'world');
+  keyedStoreIC(obj, 'field', 'world');
+})();
diff --git a/src/v8/test/mjsunit/track-fields.js b/src/v8/test/mjsunit/track-fields.js
index 7804fff..9edd260 100644
--- a/src/v8/test/mjsunit/track-fields.js
+++ b/src/v8/test/mjsunit/track-fields.js
@@ -26,6 +26,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --track-fields --track-double-fields --allow-natives-syntax
+// Flags: --modify-field-representation-inplace
 
 // Test transitions caused by changes to field representations.
 
@@ -95,7 +96,7 @@
 assertFalse(%HaveSameMap(o6, o7));
 // Smi, double, object.
 o7.c = {};
-assertFalse(%HaveSameMap(o6, o7));
+assertTrue(%HaveSameMap(o6, o7));
 // Smi, double, object.
 o6.c = {};
 assertTrue(%HaveSameMap(o6, o7));
@@ -113,6 +114,7 @@
 var of2 = {b:0};
 of2.field = 10;
 
+%PrepareFunctionForOptimization(poly_load);
 poly_load(of1, false);
 poly_load(of1, false);
 poly_load(of2, true);
@@ -131,6 +133,7 @@
   return o.a;
 }
 
+%PrepareFunctionForOptimization(load_poly);
 var o10 = { "a": 1.6 };
 var o11 = { "b": 1, "a": 1.7 };
 load_poly(o10);
@@ -149,6 +152,7 @@
   return o.a1;
 }
 
+%PrepareFunctionForOptimization(load_mono);
 var object = {"x": 1};
 var o10 = { "a1": 1.6 };
 var o11 = { "a1": object, "b": 1 };
@@ -163,6 +167,7 @@
   return o.a2;
 }
 
+%PrepareFunctionForOptimization(load_mono2);
 var o12 = { "a2": 5 };
 var o13 = { "a2": object, "b": 1 };
 load_mono2(o12);
@@ -176,6 +181,7 @@
   return o.a3;
 }
 
+%PrepareFunctionForOptimization(load_mono3);
 var o14 = { "a3": 1.6 };
 var o15 = { "a3": 1.8, "b": 1 };
 load_mono3(o14);
@@ -264,7 +270,6 @@
 function attr_mismatch_obj(v, writable) {
   var o = {};
   // Assign twice to make the field non-constant.
-  // TODO(ishell): update test once constant field tracking is done.
   o.some_value = 0;
   o.some_value = v;
   Object.defineProperty(o, "second_value", {value:10, writable:writable});
@@ -331,7 +336,8 @@
 // Test boilerplates with computed values.
 function none_boilerplate(a) {
   return {"a_none":a};
-}
+};
+%PrepareFunctionForOptimization(none_boilerplate);
 %OptimizeFunctionOnNextCall(none_boilerplate);
 var none_double1 = none_boilerplate(1.7);
 var none_double2 = none_boilerplate(1.9);
@@ -346,6 +352,7 @@
   return {"a_smi":a};
 }
 
+%PrepareFunctionForOptimization(none_to_smi);
 var none_smi1 = none_to_smi(1);
 var none_smi2 = none_to_smi(2);
 %OptimizeFunctionOnNextCall(none_to_smi);
@@ -360,6 +367,7 @@
   return {"a_double":a};
 }
 
+%PrepareFunctionForOptimization(none_to_double);
 var none_to_double1 = none_to_double(1.5);
 var none_to_double2 = none_to_double(2.8);
 %OptimizeFunctionOnNextCall(none_to_double);
@@ -374,6 +382,7 @@
   return {"an_object":a};
 }
 
+%PrepareFunctionForOptimization(none_to_object);
 var none_to_object1 = none_to_object(true);
 var none_to_object2 = none_to_object(false);
 %OptimizeFunctionOnNextCall(none_to_object);
diff --git a/src/v8/test/mjsunit/transition-elements-kind.js b/src/v8/test/mjsunit/transition-elements-kind.js
index 9acf52c..edb5846 100644
--- a/src/v8/test/mjsunit/transition-elements-kind.js
+++ b/src/v8/test/mjsunit/transition-elements-kind.js
@@ -35,9 +35,10 @@
 a[0] = 1.1;
 
 // Emit a TransitionElementsKindStub which transitions from double to object.
-function store(a,x) {
+function store(a, x) {
   a[0] = x;
-}
+};
+%PrepareFunctionForOptimization(store);
 store([1.1], 'a');
 store([1.1], 1.1);
 %OptimizeFunctionOnNextCall(store);
diff --git a/src/v8/test/mjsunit/try-catch-default-destructuring.js b/src/v8/test/mjsunit/try-catch-default-destructuring.js
new file mode 100644
index 0000000..c254a25
--- /dev/null
+++ b/src/v8/test/mjsunit/try-catch-default-destructuring.js
@@ -0,0 +1,24 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f1() {
+  let y = 200;
+  try {
+    throw {}
+  } catch ({x=()=>y, y=300}) {
+    return x()
+  }
+}
+assertEquals(300, f1());
+
+function f2() {
+  let y = 200;
+  try {
+    throw {}
+  } catch ({x=()=>y}) {
+    let y = 300;
+    return x()
+  }
+}
+assertEquals(200, f2());
diff --git a/src/v8/test/mjsunit/type-profile/regress-707223.js b/src/v8/test/mjsunit/type-profile/regress-707223.js
index 078b687..ea0e84b 100644
--- a/src/v8/test/mjsunit/type-profile/regress-707223.js
+++ b/src/v8/test/mjsunit/type-profile/regress-707223.js
@@ -2,7 +2,5 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --type-profile
-
 let e;
 eval("e");
diff --git a/src/v8/test/mjsunit/typeof.js b/src/v8/test/mjsunit/typeof.js
index 864f1cf..f6c47f8 100644
--- a/src/v8/test/mjsunit/typeof.js
+++ b/src/v8/test/mjsunit/typeof.js
@@ -1,39 +1,42 @@
 // Copyright 2008 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+'use strict';
 
 // The type of a regular expression should be 'object', including in
 // the context of string equality comparisons.
+{
+  const r = new RegExp;
 
-var r = new RegExp;
-assertEquals('object', typeof r);
-assertTrue(typeof r == 'object');
-assertFalse(typeof r == 'function');
+  assertEquals('object', typeof r);
+  assertTrue(typeof r == 'object');
+  assertFalse(typeof r == 'function');
 
-function test(x, y) { return x == y; }
-assertTrue(test('object', typeof r));
+  function equals(x, y) { return x == y; }
+  assertTrue(equals('object', typeof r));
+}
 
 assertFalse(typeof null == "undefined");
+
+assertEquals('undefined', typeof undefined);
+assertEquals('object', typeof null);
+assertEquals('boolean', typeof true);
+assertEquals('boolean', typeof false);
+assertEquals('number', typeof 42.42);
+assertEquals('number', typeof 42);
+assertEquals('bigint', typeof 42n);
+assertEquals('string', typeof '42');
+assertEquals('symbol', typeof Symbol(42));
+assertEquals('object', typeof {});
+assertEquals('object', typeof []);
+assertEquals('object', typeof new Proxy({}, {}));
+assertEquals('object', typeof new Proxy([], {}));
+assertEquals('function', typeof (_ => 42));
+assertEquals('function', typeof function() {});
+assertEquals('function', typeof function*() {});
+assertEquals('function', typeof async function() {});
+assertEquals('function', typeof async function*() {});
+assertEquals('function', typeof new Proxy(_ => 42, {}));
+assertEquals('function', typeof class {});
+assertEquals('function', typeof Object);
diff --git a/src/v8/test/mjsunit/tzoffset-seoul-noi18n.js b/src/v8/test/mjsunit/tzoffset-seoul-noi18n.js
new file mode 100644
index 0000000..6894c24
--- /dev/null
+++ b/src/v8/test/mjsunit/tzoffset-seoul-noi18n.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-icu-timezone-data
+// Environment Variables: TZ=Asia/Seoul
+
+// Seoul has DST (UTC+10) in 1987 and 1988.
+assertEquals(new Date(Date.UTC(1986, 5, 22, 3)),
+   new Date(1986, 5, 22, 12))
+assertEquals(new Date(Date.UTC(1987, 5, 22, 2)),
+   new Date(1987, 5, 22, 12))
+assertEquals(new Date(Date.UTC(1987, 11, 22, 3)),
+   new Date(1987, 11, 22, 12))
+assertEquals(new Date(Date.UTC(1988, 5, 22, 2)),
+   new Date(1988, 5, 22, 12))
+assertEquals(new Date(Date.UTC(1988, 11, 22, 3)),
+   new Date(1988, 11, 22, 12))
+assertEquals(new Date(Date.UTC(1989, 5, 22, 3)),
+   new Date(1989, 5, 22, 12))
diff --git a/src/v8/test/mjsunit/tzoffset-seoul.js b/src/v8/test/mjsunit/tzoffset-seoul.js
new file mode 100644
index 0000000..5afa1f8
--- /dev/null
+++ b/src/v8/test/mjsunit/tzoffset-seoul.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --icu-timezone-data
+// Environment Variables: TZ=Asia/Seoul
+
+// Seoul has DST (UTC+10) in 1987 and 1988.
+assertEquals(new Date(Date.UTC(1986, 5, 22, 3)),
+   new Date(1986, 5, 22, 12))
+assertEquals(new Date(Date.UTC(1987, 5, 22, 2)),
+   new Date(1987, 5, 22, 12))
+assertEquals(new Date(Date.UTC(1987, 11, 22, 3)),
+   new Date(1987, 11, 22, 12))
+assertEquals(new Date(Date.UTC(1988, 5, 22, 2)),
+   new Date(1988, 5, 22, 12))
+assertEquals(new Date(Date.UTC(1988, 11, 22, 3)),
+   new Date(1988, 11, 22, 12))
+assertEquals(new Date(Date.UTC(1989, 5, 22, 3)),
+   new Date(1989, 5, 22, 12))
diff --git a/src/v8/test/mjsunit/tzoffset-transition-apia.js b/src/v8/test/mjsunit/tzoffset-transition-apia.js
new file mode 100644
index 0000000..bd6b6f7
--- /dev/null
+++ b/src/v8/test/mjsunit/tzoffset-transition-apia.js
@@ -0,0 +1,48 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --icu-timezone-data
+// Environment Variables: TZ=Pacific/Apia
+
+// https://www.timeanddate.com/time/zone/samoa/apia
+
+// 2011-09-24T03:00 : UTC-11 => UTC-10
+assertEquals(new Date(Date.UTC(2011, 8, 24, 13, 59)),
+   new Date(2011, 8, 24, 2, 59))
+assertEquals(new Date(Date.UTC(2011, 8, 24, 14, 30)),
+   new Date(2011, 8, 24, 3, 30));
+assertEquals(new Date(Date.UTC(2011, 8, 24, 14)),
+   new Date(2011, 8, 24, 4));
+assertEquals(new Date(Date.UTC(2011, 8, 24, 14, 30)),
+   new Date(2011, 8, 24, 4, 30));
+assertEquals((new Date(2011, 8, 24, 4, 30)).getTimezoneOffset(),
+   (new Date(2011, 8, 24, 3, 30)).getTimezoneOffset());
+
+// 2011-12-30T00:00 : UTC-10 => UTC+14
+// A whole day(2011-12-30; 24 hours) is skipped, but the skipped
+// time is to be interpreted with an offset before the transition.
+assertEquals(new Date(Date.UTC(2011, 11, 30, 9, 59)),
+   new Date(2011, 11, 29, 23, 59));
+for (var h = 0; h < 24; ++h) {
+  assertEquals(new Date(Date.UTC(2011, 11, 30, h + 10)),
+     new Date(2011, 11, 30, h));
+  assertEquals(new Date(Date.UTC(2011, 11, 30, h + 10, 30)),
+     new Date(2011, 11, 30, h, 30));
+  assertEquals(new Date(Date.UTC(2011, 11, 30, h + 10)),
+     new Date(2011, 11, 31, h));
+  assertEquals(new Date(Date.UTC(2011, 11, 30, h + 10, 30)),
+     new Date(2011, 11, 31, h, 30));
+}
+assertEquals(new Date(Date.UTC(2011, 11, 31, 10)),
+   new Date(2012, 0, 1, 0));
+
+// 2012-04-01T0400: UTC+14 => UTC+13
+assertEquals(new Date(Date.UTC(2012, 2, 31, 13)),
+   new Date(2012, 3, 1, 3));
+assertEquals(new Date(Date.UTC(2012, 2, 31, 13, 30)),
+   new Date(2012, 3, 1, 3, 30));
+assertEquals(new Date(Date.UTC(2012, 2, 31, 13, 59)),
+   new Date(2012, 3, 1, 3, 59))
+assertEquals(new Date(Date.UTC(2012, 2, 31, 15)),
+   new Date(2012, 3, 1, 4))
diff --git a/src/v8/test/mjsunit/tzoffset-transition-lord-howe.js b/src/v8/test/mjsunit/tzoffset-transition-lord-howe.js
new file mode 100644
index 0000000..8ca6e87
--- /dev/null
+++ b/src/v8/test/mjsunit/tzoffset-transition-lord-howe.js
@@ -0,0 +1,35 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --icu-timezone-data
+// Environment Variables: TZ=Australia/Lord_Howe
+
+
+// 2017-04-02T02:00 : UTC+11 => UTC+1030
+assertEquals(new Date(Date.UTC(2017, 3, 1, 14, 29)),
+   new Date(2017, 3, 2, 1, 29));
+assertEquals(new Date(Date.UTC(2017, 3, 1, 14, 30)),
+   new Date(2017, 3, 2, 1, 30));
+assertEquals(new Date(Date.UTC(2017, 3, 1, 14, 45)),
+   new Date(2017, 3, 2, 1, 45));
+assertEquals(new Date(Date.UTC(2017, 3, 1, 14, 59)),
+   new Date(2017, 3, 2, 1, 59));
+assertEquals(new Date(Date.UTC(2017, 3, 1, 15, 30)),
+   new Date(2017, 3, 2, 2));
+assertEquals(new Date(Date.UTC(2017, 3, 1, 15, 31)),
+   new Date(2017, 3, 2, 2, 1));
+
+// 2017-10-07T02:00 : UTC+1030 => UTC+11
+assertEquals(new Date(Date.UTC(2017, 8, 30, 15, 29)),
+   new Date(2017, 9, 1, 1, 59))
+assertEquals(new Date(Date.UTC(2017, 8, 30, 15, 30)),
+   new Date(2017, 9, 1, 2));
+assertEquals(new Date(Date.UTC(2017, 8, 30, 15, 45)),
+   new Date(2017, 9, 1, 2, 15));
+assertEquals(new Date(Date.UTC(2017, 8, 30, 15, 30)),
+   new Date(2017, 9, 1, 2, 30));
+assertEquals(new Date(Date.UTC(2017, 8, 30, 15, 45)),
+   new Date(2017, 9, 1, 2, 45));
+assertEquals((new Date(2017, 9, 1, 2, 45)).getTimezoneOffset(),
+   (new Date(2017, 9, 1, 2, 15)).getTimezoneOffset());
diff --git a/src/v8/test/mjsunit/tzoffset-transition-moscow.js b/src/v8/test/mjsunit/tzoffset-transition-moscow.js
new file mode 100644
index 0000000..c94f454
--- /dev/null
+++ b/src/v8/test/mjsunit/tzoffset-transition-moscow.js
@@ -0,0 +1,85 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --icu-timezone-data
+// Environment Variables: TZ=Europe/Moscow
+
+// https://www.timeanddate.com/time/zone/russia/moscow
+
+// 2010-03-28T02:00 : UTC+3 => UTC+4
+assertEquals(new Date(Date.UTC(2010, 2, 27, 22, 59)),
+   new Date(2010, 2, 28, 1, 59));
+assertEquals(new Date(Date.UTC(2010, 2, 27, 23)),
+   new Date(2010, 2, 28, 2));
+assertEquals(new Date(Date.UTC(2010, 2, 27, 23, 30)),
+   new Date(2010, 2, 28, 2, 30));
+assertEquals(new Date(Date.UTC(2010, 2, 27, 23)),
+   new Date(2010, 2, 28, 3));
+assertEquals(new Date(Date.UTC(2010, 2, 27, 23, 30)),
+   new Date(2010, 2, 28, 3, 30));
+assertEquals((new Date(2010, 2, 28, 3, 30)).getTimezoneOffset(),
+   (new Date(2010, 2, 28, 2, 30)).getTimezoneOffset());
+
+// 2010-10-31T03:00 : UTC+4 => UTC+3
+assertEquals(new Date(Date.UTC(2010, 9, 30, 21, 59)),
+   new Date(2010, 9, 31, 1, 59));
+assertEquals(new Date(Date.UTC(2010, 9, 30, 22)),
+   new Date(2010, 9, 31, 2));
+assertEquals(new Date(Date.UTC(2010, 9, 30, 22, 30)),
+   new Date(2010, 9, 31, 2, 30));
+assertEquals(new Date(Date.UTC(2010, 9, 30, 22, 59)),
+   new Date(2010, 9, 31, 2, 59))
+assertEquals(new Date(Date.UTC(2010, 9, 31, 0)),
+   new Date(2010, 9, 31, 3))
+assertEquals(new Date(Date.UTC(2010, 9, 31, 0, 30)),
+   new Date(2010, 9, 31, 3, 30))
+
+// 2011-03-27T02:00 : UTC+3 => UTC+4
+assertEquals(new Date(Date.UTC(2011, 2, 26, 22, 59)),
+   new Date(2011, 2, 27, 1, 59))
+assertEquals(new Date(Date.UTC(2011, 2, 26, 23)),
+   new Date(2011, 2, 27, 2));
+assertEquals(new Date(Date.UTC(2011, 2, 26, 23, 30)),
+   new Date(2011, 2, 27, 2, 30));
+assertEquals(new Date(Date.UTC(2011, 2, 26, 23)),
+   new Date(2011, 2, 27, 3));
+assertEquals(new Date(Date.UTC(2011, 2, 26, 23, 30)),
+   new Date(2011, 2, 27, 3, 30));
+assertEquals((new Date(2011, 2, 27, 3, 30)).getTimezoneOffset(),
+   (new Date(2011, 2, 27, 2, 30)).getTimezoneOffset());
+
+// No daylight saving time in 2012, 2013: UTC+4 year-round
+assertEquals(new Date(Date.UTC(2012, 5, 21, 0)),
+   new Date(2012, 5, 21, 4))
+assertEquals(new Date(Date.UTC(2012, 11, 21, 0)),
+   new Date(2012, 11, 21, 4))
+assertEquals(new Date(Date.UTC(2013, 5, 21, 0)),
+   new Date(2013, 5, 21, 4))
+assertEquals(new Date(Date.UTC(2013, 11, 21, 0)),
+   new Date(2013, 11, 21, 4))
+
+// 2014-10-26T0200: UTC+4 => UTC+3 (year-round)
+assertEquals(new Date(Date.UTC(2014, 9, 25, 20, 59)),
+   new Date(2014, 9, 26, 0, 59));
+assertEquals(new Date(Date.UTC(2014, 9, 25, 21)),
+   new Date(2014, 9, 26, 1));
+assertEquals(new Date(Date.UTC(2014, 9, 25, 21, 30)),
+   new Date(2014, 9, 26, 1, 30));
+assertEquals(new Date(Date.UTC(2014, 9, 25, 21, 59)),
+   new Date(2014, 9, 26, 1, 59))
+assertEquals(new Date(Date.UTC(2014, 9, 25, 23)),
+   new Date(2014, 9, 26, 2))
+assertEquals(new Date(Date.UTC(2014, 9, 25, 23, 1)),
+   new Date(2014, 9, 26, 2, 1))
+
+assertEquals(new Date(Date.UTC(2014, 11, 21, 0)),
+   new Date(2014, 11, 21, 3))
+assertEquals(new Date(Date.UTC(2015, 5, 21, 0)),
+   new Date(2015, 5, 21, 3))
+assertEquals(new Date(Date.UTC(2015, 11, 21, 0)),
+   new Date(2015, 11, 21, 3))
+assertEquals(new Date(Date.UTC(2016, 5, 21, 0)),
+   new Date(2016, 5, 21, 3))
+assertEquals(new Date(Date.UTC(2015, 11, 21, 0)),
+   new Date(2015, 11, 21, 3))
diff --git a/src/v8/test/mjsunit/tzoffset-transition-new-york-noi18n.js b/src/v8/test/mjsunit/tzoffset-transition-new-york-noi18n.js
new file mode 100644
index 0000000..b4547ad
--- /dev/null
+++ b/src/v8/test/mjsunit/tzoffset-transition-new-york-noi18n.js
@@ -0,0 +1,34 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-icu-timezone-data
+// Environment Variables: TZ=America/New_York
+
+// 2017-03-12T02:00 : UTC-5 => UTC-4
+assertEquals(new Date(Date.UTC(2017, 2, 12, 6, 59)),
+   new Date(2017, 2, 12, 1, 59))
+assertEquals(new Date(Date.UTC(2017, 2, 12, 7)),
+   new Date(2017, 2, 12, 2));
+assertEquals(new Date(Date.UTC(2017, 2, 12, 7, 30)),
+   new Date(2017, 2, 12, 2, 30));
+assertEquals(new Date(Date.UTC(2017, 2, 12, 7)),
+   new Date(2017, 2, 12, 3));
+assertEquals(new Date(Date.UTC(2017, 2, 12, 7, 30)),
+   new Date(2017, 2, 12, 3, 30));
+assertEquals((new Date(2017, 2, 12, 3, 30)).getTimezoneOffset(),
+   (new Date(2017, 2, 12, 2, 30)).getTimezoneOffset());
+
+// 2017-11-05T02:00 : UTC-4 => UTC-5
+assertEquals(new Date(Date.UTC(2017, 10, 5, 4, 59)),
+   new Date(2017, 10, 5, 0, 59));
+assertEquals(new Date(Date.UTC(2017, 10, 5, 5)),
+   new Date(2017, 10, 5, 1));
+assertEquals(new Date(Date.UTC(2017, 10, 5, 5, 30)),
+   new Date(2017, 10, 5, 1, 30));
+assertEquals(new Date(Date.UTC(2017, 10, 5, 5, 59)),
+   new Date(2017, 10, 5, 1, 59));
+assertEquals(new Date(Date.UTC(2017, 10, 5, 7)),
+   new Date(2017, 10, 5, 2))
+assertEquals(new Date(Date.UTC(2017, 10, 5, 8)),
+   new Date(2017, 10, 5, 3))
diff --git a/src/v8/test/mjsunit/tzoffset-transition-new-york.js b/src/v8/test/mjsunit/tzoffset-transition-new-york.js
new file mode 100644
index 0000000..1f84792
--- /dev/null
+++ b/src/v8/test/mjsunit/tzoffset-transition-new-york.js
@@ -0,0 +1,34 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --icu-timezone-data
+// Environment Variables: TZ=America/New_York
+
+// 2017-03-12T02:00 : UTC-5 => UTC-4
+assertEquals(new Date(Date.UTC(2017, 2, 12, 6, 59)),
+   new Date(2017, 2, 12, 1, 59))
+assertEquals(new Date(Date.UTC(2017, 2, 12, 7)),
+   new Date(2017, 2, 12, 2));
+assertEquals(new Date(Date.UTC(2017, 2, 12, 7, 30)),
+   new Date(2017, 2, 12, 2, 30));
+assertEquals(new Date(Date.UTC(2017, 2, 12, 7)),
+   new Date(2017, 2, 12, 3));
+assertEquals(new Date(Date.UTC(2017, 2, 12, 7, 30)),
+   new Date(2017, 2, 12, 3, 30));
+assertEquals((new Date(2017, 2, 12, 3, 30)).getTimezoneOffset(),
+   (new Date(2017, 2, 12, 2, 30)).getTimezoneOffset());
+
+// 2017-11-05T02:00 : UTC-4 => UTC-5
+assertEquals(new Date(Date.UTC(2017, 10, 5, 4, 59)),
+   new Date(2017, 10, 5, 0, 59));
+assertEquals(new Date(Date.UTC(2017, 10, 5, 5)),
+   new Date(2017, 10, 5, 1));
+assertEquals(new Date(Date.UTC(2017, 10, 5, 5, 30)),
+   new Date(2017, 10, 5, 1, 30));
+assertEquals(new Date(Date.UTC(2017, 10, 5, 5, 59)),
+   new Date(2017, 10, 5, 1, 59));
+assertEquals(new Date(Date.UTC(2017, 10, 5, 7)),
+   new Date(2017, 10, 5, 2))
+assertEquals(new Date(Date.UTC(2017, 10, 5, 8)),
+   new Date(2017, 10, 5, 3))
diff --git a/src/v8/test/mjsunit/ubsan-fuzzerbugs.js b/src/v8/test/mjsunit/ubsan-fuzzerbugs.js
new file mode 100644
index 0000000..41ed368
--- /dev/null
+++ b/src/v8/test/mjsunit/ubsan-fuzzerbugs.js
@@ -0,0 +1,76 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// crbug.com/923466
+__v_5 = [ -1073741825, -2147483648];
+__v_5.sort();
+
+// crbug.com/923642
+new RegExp("(abcd){2148473648,}", "");
+
+// crbug.com/923626
+new Date(2146399200000).toString();
+new Date(2146940400000).toString();
+new Date(2147481600000).toString();
+new Date(2148022800000).toString();
+
+// crbug.com/927212
+assertThrows(() => (2n).toString(-2147483657), RangeError);
+
+// crbug.com/927894
+var typed_array = new Uint8Array(16);
+typed_array.fill(0, -1.7976931348623157e+308);
+
+// crbug.com/927996
+var float_array = new Float32Array(1);
+float_array[0] = 1e51;
+
+// crbug.com/930086
+(function() {
+  try {
+    // Build up a 536870910-character string (just under 2**30).
+    var string = "ff";
+    var long_string = "0x";
+    for (var i = 2; i < 29; i++) {
+      string = string + string;
+      long_string += string;
+    }
+    assertThrows(() => BigInt(long_string), SyntaxError);
+  } catch (e) {
+    /* 32-bit architectures have a lower string length limit. */
+  }
+})();
+
+// crbug.com/932679
+(function() {
+  const buffer = new DataView(new ArrayBuffer(2));
+  function __f_14159(buffer) {
+    try { return buffer.getUint16(Infinity, true); } catch(e) { return 0; }
+  }
+  %PrepareFunctionForOptimization(__f_14159);
+  __f_14159(buffer);
+  %OptimizeFunctionOnNextCall(__f_14159);
+  __f_14159(buffer);
+})();
+
+// crbug.com/937652
+(function() {
+  function f() {
+    for (var i = 0; i < 1; i++) {
+      var shift = 1;
+      for (var j = 0; j < 2; ++j) {
+        if (shift == shift) shift = 0;
+        var x = 1;
+        print((x << shift | x >>> 32 - shift));
+      }
+    }
+  }
+  %PrepareFunctionForOptimization(f);
+  f();
+  f();
+  %OptimizeFunctionOnNextCall(f);
+  f();
+})();
diff --git a/src/v8/test/mjsunit/unary-minus-deopt.js b/src/v8/test/mjsunit/unary-minus-deopt.js
index 07f7e0e..dc60d07 100644
--- a/src/v8/test/mjsunit/unary-minus-deopt.js
+++ b/src/v8/test/mjsunit/unary-minus-deopt.js
@@ -37,6 +37,7 @@
   return (g & -g) - 1 | 0;
 }
 
+%PrepareFunctionForOptimization(unaryMinusTest);
 unaryMinusTest(3);
 unaryMinusTest(3);
 %OptimizeFunctionOnNextCall(unaryMinusTest);
@@ -47,6 +48,7 @@
 unaryMinusTest(31);
 // The following is normally true, but not with --stress-opt. :-/
 // assertUnoptimized(unaryMinusTest);
+%PrepareFunctionForOptimization(unaryMinusTest);
 
 // We should have learned something from the deopt.
 unaryMinusTest(31);
diff --git a/src/v8/test/mjsunit/unbox-double-arrays.js b/src/v8/test/mjsunit/unbox-double-arrays.js
index d6fc093..ee08cdd 100644
--- a/src/v8/test/mjsunit/unbox-double-arrays.js
+++ b/src/v8/test/mjsunit/unbox-double-arrays.js
@@ -149,6 +149,13 @@
     assertTrue(%HasDoubleElements(a));
   }
 
+  %PrepareFunctionForOptimization(test_various_loads);
+  %PrepareFunctionForOptimization(test_various_loads2);
+  %PrepareFunctionForOptimization(test_various_loads3);
+  %PrepareFunctionForOptimization(test_various_loads6);
+  %PrepareFunctionForOptimization(test_various_loads7);
+  %PrepareFunctionForOptimization(test_various_stores);
+
   // Test double and integer values
   test_various_loads(large_array,
                      expected_array_value(5),
@@ -463,6 +470,7 @@
   called_by_apply.apply({}, large_array3);
 }
 
+%PrepareFunctionForOptimization(call_apply);
 call_apply();
 call_apply();
 call_apply();
@@ -483,6 +491,7 @@
   assertTrue(next_expected == 96);
 }
 
+%PrepareFunctionForOptimization(test_for_in);
 test_for_in();
 test_for_in();
 test_for_in();
@@ -503,6 +512,7 @@
   assertEquals(expected_array_value(10), large_array3[2]);
 }
 
+%PrepareFunctionForOptimization(test_getter);
 test_getter();
 test_getter();
 test_getter();
@@ -531,6 +541,7 @@
   assertEquals(expected_array_value(2), large_array4[2]);
 }
 
+%PrepareFunctionForOptimization(test_setter);
 test_setter();
 test_setter();
 test_setter();
diff --git a/src/v8/test/mjsunit/unbox-double-field-indexed.js b/src/v8/test/mjsunit/unbox-double-field-indexed.js
index 29dfc79..6ddde73 100644
--- a/src/v8/test/mjsunit/unbox-double-field-indexed.js
+++ b/src/v8/test/mjsunit/unbox-double-field-indexed.js
@@ -14,8 +14,8 @@
 function add(a, b) {
   var name = "x";
   return a[name] + b[name];
-}
-
+};
+%PrepareFunctionForOptimization(add);
 assertEquals(3.5, add(f, g));
 assertEquals(3.5, add(g, f));
 %OptimizeFunctionOnNextCall(add);
diff --git a/src/v8/test/mjsunit/unbox-double-field.js b/src/v8/test/mjsunit/unbox-double-field.js
index 9fb5479..d0876a8 100644
--- a/src/v8/test/mjsunit/unbox-double-field.js
+++ b/src/v8/test/mjsunit/unbox-double-field.js
@@ -13,8 +13,8 @@
 
 function add(a, b) {
   return a.x + b.x;
-}
-
+};
+%PrepareFunctionForOptimization(add);
 assertEquals(3.5, add(f, g));
 assertEquals(3.5, add(g, f));
 %OptimizeFunctionOnNextCall(add);
diff --git a/src/v8/test/mjsunit/unbox-smi-field-indexed.js b/src/v8/test/mjsunit/unbox-smi-field-indexed.js
index 9e77da0..038ee0a 100644
--- a/src/v8/test/mjsunit/unbox-smi-field-indexed.js
+++ b/src/v8/test/mjsunit/unbox-smi-field-indexed.js
@@ -14,8 +14,8 @@
 function add(a, b) {
   var name = "x";
   return a[name] + b[name];
-}
-
+};
+%PrepareFunctionForOptimization(add);
 assertEquals(3, add(f, g));
 assertEquals(3, add(g, f));
 %OptimizeFunctionOnNextCall(add);
diff --git a/src/v8/test/mjsunit/unbox-smi-field.js b/src/v8/test/mjsunit/unbox-smi-field.js
index 3619118..e0561f1 100644
--- a/src/v8/test/mjsunit/unbox-smi-field.js
+++ b/src/v8/test/mjsunit/unbox-smi-field.js
@@ -15,6 +15,7 @@
   return a.x + b.x;
 }
 
+%PrepareFunctionForOptimization(add);
 assertEquals(3, add(f, g));
 assertEquals(3, add(g, f));
 %OptimizeFunctionOnNextCall(add);
diff --git a/src/v8/test/mjsunit/undetectable-compare.js b/src/v8/test/mjsunit/undetectable-compare.js
index c785934..0ea79e3 100644
--- a/src/v8/test/mjsunit/undetectable-compare.js
+++ b/src/v8/test/mjsunit/undetectable-compare.js
@@ -99,6 +99,7 @@
 function test2(a, b) {
   return a == b;
 }
+%PrepareFunctionForOptimization(test2);
 test2(0, 1);
 test2(undetectable, {});
 %OptimizeFunctionOnNextCall(test2);
diff --git a/src/v8/test/mjsunit/undetectable.js b/src/v8/test/mjsunit/undetectable.js
index 69a370a..873aa30 100644
--- a/src/v8/test/mjsunit/undetectable.js
+++ b/src/v8/test/mjsunit/undetectable.js
@@ -76,6 +76,11 @@
   obj();
 }
 
+%PrepareFunctionForOptimization(testCompares);
+%PrepareFunctionForOptimization(testIfs);
+%PrepareFunctionForOptimization(testWhiles);
+%PrepareFunctionForOptimization(testFors);
+%PrepareFunctionForOptimization(testCall);
 for (var j = 0; j < 5; j++) {
   testCompares();
   testIfs();
diff --git a/src/v8/test/mjsunit/unicodelctest-no-optimization.js b/src/v8/test/mjsunit/unicodelctest-no-optimization.js
index 3bcb5bf..0b31c56 100644
--- a/src/v8/test/mjsunit/unicodelctest-no-optimization.js
+++ b/src/v8/test/mjsunit/unicodelctest-no-optimization.js
@@ -60,6 +60,7 @@
   // To make the test results predictable, we use a 100% deterministic
   // alternative.
   // Robert Jenkins' 32 bit integer hash function.
+  seed = seed & 0xffffffff;
   seed = ((seed + 0x7ed55d16) + (seed << 12))  & 0xffffffff;
   seed = ((seed ^ 0xc761c23c) ^ (seed >>> 19)) & 0xffffffff;
   seed = ((seed + 0x165667b1) + (seed << 5))   & 0xffffffff;
diff --git a/src/v8/test/mjsunit/unicodelctest.js b/src/v8/test/mjsunit/unicodelctest.js
index 2caaabd..95d6dac 100644
--- a/src/v8/test/mjsunit/unicodelctest.js
+++ b/src/v8/test/mjsunit/unicodelctest.js
@@ -59,6 +59,7 @@
   // To make the test results predictable, we use a 100% deterministic
   // alternative.
   // Robert Jenkins' 32 bit integer hash function.
+  seed = seed & 0xffffffff;
   seed = ((seed + 0x7ed55d16) + (seed << 12))  & 0xffffffff;
   seed = ((seed ^ 0xc761c23c) ^ (seed >>> 19)) & 0xffffffff;
   seed = ((seed + 0x165667b1) + (seed << 5))   & 0xffffffff;
diff --git a/src/v8/test/mjsunit/value-wrapper-accessor.js b/src/v8/test/mjsunit/value-wrapper-accessor.js
index 79db407..e4fd83a 100644
--- a/src/v8/test/mjsunit/value-wrapper-accessor.js
+++ b/src/v8/test/mjsunit/value-wrapper-accessor.js
@@ -49,6 +49,7 @@
       return s.strict;
     }
 
+    %PrepareFunctionForOptimization(nonstrict);
     nonstrict(object);
     nonstrict(object);
     %OptimizeFunctionOnNextCall(nonstrict);
@@ -56,6 +57,7 @@
     nonstrict(object);
     assertEquals("object", typeof result);
 
+    %PrepareFunctionForOptimization(strict);
     strict(object);
     strict(object);
     %OptimizeFunctionOnNextCall(strict);
@@ -72,6 +74,7 @@
       return s.strict = 10;
     }
 
+    %PrepareFunctionForOptimization(nonstrict);
     nonstrict(object);
     nonstrict(object);
     %OptimizeFunctionOnNextCall(nonstrict);
@@ -79,6 +82,7 @@
     nonstrict(object);
     assertEquals("object", typeof result);
 
+    %PrepareFunctionForOptimization(strict);
     strict(object);
     strict(object);
     %OptimizeFunctionOnNextCall(strict);
diff --git a/src/v8/test/mjsunit/wasm/adapter-frame.js b/src/v8/test/mjsunit/wasm/adapter-frame.js
index 284adb9..5563416 100644
--- a/src/v8/test/mjsunit/wasm/adapter-frame.js
+++ b/src/v8/test/mjsunit/wasm/adapter-frame.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 const JS = false;  // for testing the tests.
diff --git a/src/v8/test/mjsunit/wasm/add-getters.js b/src/v8/test/mjsunit/wasm/add-getters.js
index ca5783a..fc5c5d2 100644
--- a/src/v8/test/mjsunit/wasm/add-getters.js
+++ b/src/v8/test/mjsunit/wasm/add-getters.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 function testAddGetter(object, name, val) {
diff --git a/src/v8/test/mjsunit/wasm/anyfunc-interpreter.js b/src/v8/test/mjsunit/wasm/anyfunc-interpreter.js
new file mode 100644
index 0000000..10d66c6
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/anyfunc-interpreter.js
@@ -0,0 +1,12 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --experimental-wasm-anyref --expose-gc
+// Flags: --wasm-interpret-all
+
+// This is just a wrapper for an existing reference types test case that runs
+// with the --wasm-interpret-all flag added. If we ever decide to add a test
+// variant for this, then we can remove this file.
+
+load("test/mjsunit/wasm/anyfunc.js");
diff --git a/src/v8/test/mjsunit/wasm/anyfunc.js b/src/v8/test/mjsunit/wasm/anyfunc.js
new file mode 100644
index 0000000..f0d587b
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/anyfunc.js
@@ -0,0 +1,246 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --experimental-wasm-anyref --expose-gc
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function testAnyFuncIdentityFunction() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  builder.addFunction('main', kSig_a_a)
+      .addBody([kExprGetLocal, 0])
+      .exportFunc();
+
+  const instance = builder.instantiate();
+
+  assertThrows(() => instance.exports.main(print), TypeError);
+  assertThrows(() => instance.exports.main({'hello': 'world'}), TypeError);
+  assertSame(
+      instance.exports.main, instance.exports.main(instance.exports.main));
+})();
+
+(function testPassAnyFuncToImportedFunction() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const sig_index = builder.addType(kSig_v_a);
+  const imp_index = builder.addImport('q', 'func', sig_index);
+  builder.addFunction('main', sig_index)
+      .addBody([kExprGetLocal, 0, kExprCallFunction, imp_index])
+      .exportFunc();
+
+  const main = builder.instantiate({q: {func: checkFunction}}).exports.main;
+
+  function checkFunction(value) {
+    assertSame(main, value);
+  }
+
+  main(main);
+})();
+
+(function testPassAnyFuncWithGCWithLocals() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const ref_sig = builder.addType(kSig_v_a);
+  const void_sig = builder.addType(kSig_v_v);
+  const imp_index = builder.addImport('q', 'func', ref_sig);
+  const gc_index = builder.addImport('q', 'gc', void_sig);
+  // First call the gc, then check if the object still exists.
+  builder.addFunction('main', ref_sig)
+      .addLocals({anyfunc_count: 10})
+      .addBody([
+        kExprGetLocal,     0,
+        kExprSetLocal,     1,  // Set local
+        kExprGetLocal,     0,
+        kExprSetLocal,     2,  // Set local
+        kExprGetLocal,     0,
+        kExprSetLocal,     3,  // Set local
+        kExprGetLocal,     0,
+        kExprSetLocal,     4,  // Set local
+        kExprGetLocal,     0,
+        kExprSetLocal,     5,  // Set local
+        kExprGetLocal,     0,
+        kExprSetLocal,     6,  // Set local
+        kExprGetLocal,     0,
+        kExprSetLocal,     7,  // Set local
+        kExprGetLocal,     0,
+        kExprSetLocal,     8,  // Set local
+        kExprGetLocal,     0,
+        kExprSetLocal,     9,  // Set local
+        kExprGetLocal,     0,
+        kExprSetLocal,     10,        // Set local
+        kExprCallFunction, gc_index,  // call gc
+        kExprGetLocal,     9,
+        kExprCallFunction, imp_index  // call import
+      ])
+      .exportFunc();
+
+  const main =
+      builder.instantiate({q: {func: checkFunction, gc: gc}}).exports.main;
+
+  function checkFunction(value) {
+    assertSame(main, value);
+  }
+
+  main(main);
+})();
+
+(function testPassAnyFuncWithGC() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const ref_sig = builder.addType(kSig_v_a);
+  const void_sig = builder.addType(kSig_v_v);
+  const imp_index = builder.addImport('q', 'func', ref_sig);
+  const gc_index = builder.addImport('q', 'gc', void_sig);
+  // First call the gc, then check if the object still exists.
+  builder.addFunction('main', ref_sig)
+      .addBody([
+        kExprCallFunction, gc_index,                    // call gc
+        kExprGetLocal, 0, kExprCallFunction, imp_index  // call import
+      ])
+      .exportFunc();
+
+  function checkFunction(value) {
+    assertSame(main, value);
+  }
+
+  const main =
+      builder.instantiate({q: {func: checkFunction, gc: gc}}).exports.main;
+
+  main(main);
+})();
+
+(function testPassAnyFuncWithGCInWrapper() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const kSig_a_iai =
+      makeSig([kWasmI32, kWasmAnyFunc, kWasmI32], [kWasmAnyFunc]);
+  const sig_index = builder.addType(kSig_a_iai);
+  builder.addFunction('main', sig_index)
+      .addBody([kExprGetLocal, 1])
+      .exportFunc();
+
+  const main = builder.instantiate().exports.main;
+
+  const triggerGCParam = {
+    valueOf: () => {
+      gc();
+      return 17;
+    }
+  };
+
+  const result = main(triggerGCParam, main, triggerGCParam);
+  assertSame(main, result);
+})();
+
+(function testAnyFuncDefaultValue() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const sig_index = builder.addType(kSig_a_v);
+  builder.addFunction('main', sig_index)
+      .addLocals({anyfunc_count: 1})
+      .addBody([kExprGetLocal, 0])
+      .exportFunc();
+
+  const main = builder.instantiate().exports.main;
+  assertEquals(null, main());
+})();
+
+(function testAssignNullRefToAnyFuncLocal() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const sig_index = builder.addType(kSig_a_a);
+  builder.addFunction('main', sig_index)
+      .addBody([kExprRefNull, kExprSetLocal, 0, kExprGetLocal, 0])
+      .exportFunc();
+
+  const main = builder.instantiate().exports.main;
+  assertEquals(null, main(main));
+})();
+
+(function testImplicitReturnNullRefAsAnyFunc() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const sig_index = builder.addType(kSig_a_v);
+  builder.addFunction('main', sig_index).addBody([kExprRefNull]).exportFunc();
+
+  const main = builder.instantiate().exports.main;
+  assertEquals(null, main());
+})();
+
+(function testExplicitReturnNullRefAsAnyFunc() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const sig_index = builder.addType(kSig_a_v);
+  builder.addFunction('main', sig_index)
+      .addBody([kExprRefNull, kExprReturn])
+      .exportFunc();
+
+  const main = builder.instantiate().exports.main;
+  assertEquals(null, main());
+})();
+
+(function testImplicitReturnAnyFuncAsAnyRef() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const sig_index = builder.addType(kSig_r_v);
+  builder.addFunction('main', sig_index)
+      .addLocals({anyfunc_count: 1})
+      .addBody([kExprGetLocal, 0])
+      .exportFunc();
+
+  const main = builder.instantiate().exports.main;
+  assertEquals(null, main());
+})();
+
+(function testExplicitReturnAnyFuncAsAnyRef() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const sig_index = builder.addType(kSig_r_v);
+  builder.addFunction('main', sig_index)
+      .addLocals({anyfunc_count: 1})
+      .addBody([kExprGetLocal, 0, kExprReturn])
+      .exportFunc();
+
+  const main = builder.instantiate().exports.main;
+  assertEquals(null, main());
+})();
+
+(function testRefFuncOutOfBounds() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  builder.addFunction('main', kSig_a_v).addBody([kExprRefFunc, 10]);
+
+  assertThrows(() => builder.toModule(), WebAssembly.CompileError);
+})();
+
+(function testRefFuncIsCallable() {
+  print(arguments.callee.name);
+  const expected = 54;
+  const builder = new WasmModuleBuilder();
+  const function_index = builder.addFunction('hidden', kSig_i_v)
+                             .addBody([kExprI32Const, expected])
+                             .index;
+  builder.addFunction('main', kSig_a_v)
+      .addBody([kExprRefFunc, function_index])
+      .exportFunc();
+
+  const instance = builder.instantiate();
+  assertEquals(expected, instance.exports.main()());
+})();
+
+(function testRefFuncPreservesIdentity() {
+  print(arguments.callee.name);
+  const expected = 54;
+  const builder = new WasmModuleBuilder();
+  const foo = builder.addFunction('foo', kSig_i_v)
+                  .addBody([kExprI32Const, expected])
+                  .exportFunc();
+  builder.addFunction('main', kSig_a_v)
+      .addBody([kExprRefFunc, foo.index])
+      .exportFunc();
+
+  const instance = builder.instantiate();
+  assertSame(instance.exports.foo, instance.exports.main());
+})();
diff --git a/src/v8/test/mjsunit/wasm/anyref-globals-interpreter.js b/src/v8/test/mjsunit/wasm/anyref-globals-interpreter.js
new file mode 100644
index 0000000..bca5d6c
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/anyref-globals-interpreter.js
@@ -0,0 +1,12 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-anyref --expose-gc
+// Flags: --wasm-interpret-all
+
+// This is just a wrapper for an existing reference types test case that runs
+// with the --wasm-interpret-all flag added. If we ever decide to add a test
+// variant for this, then we can remove this file.
+
+load("test/mjsunit/wasm/anyref-globals.js");
diff --git a/src/v8/test/mjsunit/wasm/anyref-globals.js b/src/v8/test/mjsunit/wasm/anyref-globals.js
new file mode 100644
index 0000000..39d3bcb
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/anyref-globals.js
@@ -0,0 +1,616 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-anyref --expose-gc
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function TestDefaultValue() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  const g_nullref = builder.addGlobal(kWasmAnyRef, true).index;
+  const g_nullfunc = builder.addGlobal(kWasmAnyFunc, true).index;
+  builder.addFunction("get_anyref_global", kSig_r_v)
+    .addBody([kExprGetGlobal, g_nullref])
+    .exportAs("get_anyref_global");
+  builder.addFunction("get_anyfunc_global", kSig_a_v)
+    .addBody([kExprGetGlobal, g_nullfunc])
+    .exportAs("get_anyfunc_global");
+
+  const instance = builder.instantiate();
+  assertEquals(null, instance.exports.get_anyref_global());
+  assertEquals(null, instance.exports.get_anyfunc_global());
+})();
+
+(function TestDefaultValueSecondGlobal() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  const g_setref = builder.addGlobal(kWasmAnyRef, true);
+  const g_setfunc = builder.addGlobal(kWasmAnyFunc, true);
+  const g_nullref = builder.addGlobal(kWasmAnyRef, true);
+  const g_nullfunc = builder.addGlobal(kWasmAnyFunc, true);
+  builder.addFunction("get_anyref_global", kSig_r_r)
+    .addBody([
+      kExprGetLocal, 0,
+      kExprSetGlobal, g_setref.index,
+      kExprGetGlobal, g_nullref.index
+    ])
+    .exportAs("get_anyref_global");
+  builder.addFunction("get_anyfunc_global", kSig_a_a)
+    .addBody([
+      kExprGetLocal, 0,
+      kExprSetGlobal, g_setfunc.index,
+      kExprGetGlobal, g_nullfunc.index
+    ])
+    .exportAs("get_anyfunc_global");
+
+  const instance = builder.instantiate();
+  assertEquals(null, instance.exports.get_anyref_global({}));
+  assertEquals(null, instance.exports.get_anyfunc_global(
+    instance.exports.get_anyref_global));
+})();
+
+(function TestAnyRefGlobalChangeValue() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  // Dummy global for offset.
+  builder.addGlobal(kWasmAnyRef, true);
+  const g = builder.addGlobal(kWasmAnyRef, true);
+  builder.addFunction("main", kSig_r_r)
+    .addBody([
+      kExprGetLocal, 0,
+      kExprSetGlobal, g.index,
+      kExprGetGlobal, g.index
+    ])
+    .exportAs("main");
+
+  const instance = builder.instantiate();
+
+  const test_value = { hello: 'world' };
+  assertSame(test_value, instance.exports.main(test_value));
+})();
+
+(function TestAnyFuncGlobalChangeValue() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  // Dummy global for offset.
+  builder.addGlobal(kWasmAnyFunc, true);
+  const g = builder.addGlobal(kWasmAnyFunc, true);
+  builder.addFunction("main", kSig_a_a)
+    .addBody([
+      kExprGetLocal, 0,
+      kExprSetGlobal, g.index,
+      kExprGetGlobal, g.index
+    ])
+    .exportAs("main");
+
+  const instance = builder.instantiate();
+
+  const test_value = instance.exports.main;
+  assertSame(test_value, instance.exports.main(test_value));
+})();
+
+(function TestGlobalChangeValueWithGC() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  const gc_index = builder.addImport("q", "gc", kSig_v_v);
+  // Dummy global for offset.
+  builder.addGlobal(kWasmAnyRef, true);
+  const g = builder.addGlobal(kWasmAnyRef, true);
+  builder.addFunction("main", kSig_r_r)
+    .addBody([
+      kExprGetLocal, 0,
+      kExprSetGlobal, g.index,
+      kExprCallFunction, gc_index,  // call gc
+      kExprGetGlobal, g.index
+    ])
+    .exportAs("main");
+
+  const instance = builder.instantiate({ q: { gc: gc } });
+
+  const test_value = { hello: 'world' };
+  assertSame(test_value, instance.exports.main(test_value));
+  assertSame(5, instance.exports.main(5));
+  assertSame("Hello", instance.exports.main("Hello"));
+})();
+
+(function TestGlobalAsRoot() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  const g = builder.addGlobal(kWasmAnyRef, true);
+  builder.addFunction("get_global", kSig_r_v)
+    .addBody([
+      kExprGetGlobal, g.index
+    ])
+    .exportAs("get_global");
+
+  builder.addFunction("set_global", kSig_v_r)
+    .addBody([
+      kExprGetLocal, 0,
+      kExprSetGlobal, g.index
+    ])
+    .exportAs("set_global");
+
+  const instance = builder.instantiate();
+
+  let test_value = { hello: 'world' };
+  instance.exports.set_global(test_value);
+  test_value = null;
+  gc();
+
+  const result = instance.exports.get_global();
+
+  assertEquals('world', result.hello);
+})();
+
+(function TestImportedAnyRef() {
+  print(arguments.callee.name);
+  function Test(obj) {
+    let builder = new WasmModuleBuilder();
+    const g = builder.addImportedGlobal('m', 'val', kWasmAnyRef);
+    builder.addFunction('main', kSig_r_v)
+      .addBody([kExprGetGlobal, g])
+      .exportAs('main');
+
+    const instance = builder.instantiate({ m: { val: obj } });
+    assertSame(obj, instance.exports.main());
+  }
+  Test(null);
+  Test(undefined);
+  Test(1653);
+  Test("mystring");
+  Test({ q: 14 });
+  Test(print);
+})();
+
+function dummy_func() {
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("dummy", kSig_i_v)
+    .addBody([kExprI32Const, 12])
+    .exportAs("dummy");
+  return builder.instantiate().exports.dummy;
+}
+
+(function TestImportedAnyFunc() {
+  print(arguments.callee.name);
+
+  let builder = new WasmModuleBuilder();
+  const g = builder.addImportedGlobal('m', 'val', kWasmAnyFunc);
+  builder.addFunction('main', kSig_a_v)
+    .addBody([kExprGetGlobal, g])
+    .exportAs('main');
+
+  const module = builder.toModule();
+  const instance = new WebAssembly.Instance(module, { m: { val: null } });
+  assertSame(null, instance.exports.main());
+
+  const instance2 = new WebAssembly.Instance(
+    module, { m: { val: instance.exports.main } });
+  assertSame(instance.exports.main, instance2.exports.main());
+
+  assertThrows(() => new WebAssembly.Instance(module, { m: { val: {} } }),
+    WebAssembly.LinkError);
+})();
+
+(function TestAnyRefGlobalObjectDefaultValue() {
+  print(arguments.callee.name);
+  let default_init = new WebAssembly.Global({ value: 'anyref', mutable: true });
+  assertSame(null, default_init.value);
+  assertSame(null, default_init.valueOf());
+})();
+
+(function TestAnyFuncGlobalObjectDefaultValue() {
+  print(arguments.callee.name);
+  let default_init = new WebAssembly.Global({ value: 'anyfunc', mutable: true });
+  assertSame(null, default_init.value);
+  assertSame(null, default_init.valueOf());
+})();
+
+(function TestAnyRefGlobalObject() {
+  print(arguments.callee.name);
+  function TestGlobal(obj) {
+    const global = new WebAssembly.Global({ value: 'anyref' }, obj);
+    assertSame(obj, global.value);
+    assertSame(obj, global.valueOf());
+  }
+
+  TestGlobal(null);
+  TestGlobal(undefined);
+  TestGlobal(1663);
+  TestGlobal("testmyglobal");
+  TestGlobal({ a: 11 });
+  TestGlobal(print);
+})();
+
+(function TestAnyFuncGlobalObject() {
+  print(arguments.callee.name);
+
+  const dummy = dummy_func();
+  const global = new WebAssembly.Global({ value: 'anyfunc' }, dummy);
+  assertSame(dummy, global.value);
+  assertSame(dummy, global.valueOf());
+
+  const global_null = new WebAssembly.Global({ value: 'anyfunc' }, null);
+  assertSame(null, global_null.value);
+  assertSame(null, global_null.valueOf());
+
+  assertThrows(() => new WebAssembly.Global({ value: 'anyfunc' }, {}), TypeError);
+})();
+
+(function TestAnyRefGlobalObjectSetValue() {
+  print(arguments.callee.name);
+  let global = new WebAssembly.Global({ value: 'anyref', mutable: true });
+
+  function TestGlobal(obj) {
+    global.value = obj;
+    assertSame(obj, global.value);
+    assertSame(obj, global.valueOf());
+  }
+
+  TestGlobal(null);
+  assertThrows(() => TestGlobal(undefined), TypeError);
+  TestGlobal(1663);
+  TestGlobal("testmyglobal");
+  TestGlobal({ a: 11 });
+  TestGlobal(print);
+})();
+
+
+(function TestAnyFuncGlobalObjectSetValue() {
+  print(arguments.callee.name);
+  let global = new WebAssembly.Global({ value: 'anyfunc', mutable: true });
+
+  const dummy = dummy_func();
+  global.value = dummy;
+  assertSame(dummy, global.value);
+  assertSame(dummy, global.valueOf());
+
+  global.value = null;
+  assertSame(null, global.value);
+  assertSame(null, global.valueOf());
+
+  assertThrows(() => global.value = {}, TypeError);
+})();
+
+(function TestExportMutableRefGlobal() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  const g1 = builder.addGlobal(kWasmAnyRef, true).exportAs("global1");
+  const g2 = builder.addGlobal(kWasmAnyFunc, true).exportAs("global2");
+  builder.addGlobal(kWasmI32, true); // Dummy.
+  builder.addGlobal(kWasmAnyRef, true); // Dummy.
+  const g3 = builder.addGlobal(kWasmAnyRef, true).exportAs("global3");
+  const g4 = builder.addGlobal(kWasmAnyFunc, true).exportAs("global4");
+  builder.addFunction("main",
+    makeSig([kWasmAnyRef, kWasmAnyFunc, kWasmAnyRef, kWasmAnyFunc], []))
+    .addBody([
+      kExprGetLocal, 0,
+      kExprSetGlobal, g1.index,
+      kExprGetLocal, 1,
+      kExprSetGlobal, g2.index,
+      kExprGetLocal, 2,
+      kExprSetGlobal, g3.index,
+      kExprGetLocal, 3,
+      kExprSetGlobal, g4.index
+    ])
+    .exportAs("main");
+
+  const instance = builder.instantiate();
+  const obj1 = { x: 221 };
+  const func2 = instance.exports.main;
+  const obj3 = print;
+  const func4 = dummy_func();
+  instance.exports.main(obj1, func2, obj3, func4);
+  assertSame(obj1, instance.exports.global1.value);
+  assertSame(func2, instance.exports.global2.value);
+  assertSame(obj3, instance.exports.global3.value);
+  assertSame(func4, instance.exports.global4.value);
+})();
+
+(function TestImportMutableAnyRefGlobal() {
+  print(arguments.callee.name);
+  function Test(obj) {
+    let builder = new WasmModuleBuilder();
+    const g = builder.addImportedGlobal('m', 'val', kWasmAnyRef, true);
+    builder.addFunction('main', kSig_r_v)
+      .addBody([kExprGetGlobal, g])
+      .exportAs('main');
+
+    const global = new WebAssembly.Global({ value: 'anyref', mutable: 'true' }, obj);
+    const instance = builder.instantiate({ m: { val: global } });
+    assertSame(obj, instance.exports.main());
+  }
+  Test(null);
+  Test(undefined);
+  Test(1653);
+  Test("mystring");
+  Test({ q: 14 });
+  Test(print);
+})();
+
+(function TestImportMutableAnyFuncGlobal() {
+  print(arguments.callee.name);
+  function Test(obj) {
+    let builder = new WasmModuleBuilder();
+    const g = builder.addImportedGlobal('m', 'val', kWasmAnyFunc, true);
+    builder.addFunction('main', kSig_a_v)
+      .addBody([kExprGetGlobal, g])
+      .exportAs('main');
+
+    const global = new WebAssembly.Global({ value: 'anyfunc', mutable: 'true' }, obj);
+    const instance = builder.instantiate({ m: { val: global } });
+    assertSame(obj, instance.exports.main());
+  }
+  Test(dummy_func());
+  Test(null);
+})();
+
+(function TestImportMutableAnyRefGlobalFromOtherInstance() {
+  print(arguments.callee.name);
+
+  // Create an instance which exports globals.
+  let builder1 = new WasmModuleBuilder();
+  const g3 = builder1.addGlobal(kWasmAnyRef, true).exportAs("e3");
+  builder1.addGlobal(kWasmI32, true).exportAs("e1"); // Dummy.
+  builder1.addGlobal(kWasmAnyRef, true).exportAs("e4"); // Dummy.
+  const g2 = builder1.addGlobal(kWasmAnyRef, true).exportAs("e2");
+
+  builder1.addFunction("set_globals", kSig_v_rr)
+    .addBody([
+      kExprGetLocal, 0,
+      kExprSetGlobal, g2.index,
+      kExprGetLocal, 1,
+      kExprSetGlobal, g3.index,
+    ])
+    .exportAs("set_globals");
+
+  builder1.addFunction('get_global2', kSig_r_v)
+    .addBody([kExprGetGlobal, g2.index])
+    .exportAs('get_global2');
+
+  builder1.addFunction('get_global3', kSig_r_v)
+    .addBody([kExprGetGlobal, g3.index])
+    .exportAs('get_global3');
+
+  const instance1 = builder1.instantiate();
+  const obj2 = { x: 221 };
+  const obj3 = print;
+  instance1.exports.set_globals(obj2, obj3);
+
+  // Create an instance which imports the globals of the other instance.
+  let builder2 = new WasmModuleBuilder();
+  const i1 = builder2.addImportedGlobal('exports', 'e1', kWasmI32, true);
+  const i2 = builder2.addImportedGlobal('exports', 'e2', kWasmAnyRef, true);
+  const i3 = builder2.addImportedGlobal('exports', 'e3', kWasmAnyRef, true);
+  const i4 = builder2.addImportedGlobal('exports', 'e4', kWasmAnyRef, true);
+
+  builder2.addExportOfKind("reexport1", kExternalGlobal, i1);
+  builder2.addExportOfKind("reexport2", kExternalGlobal, i2);
+  builder2.addExportOfKind("reexport3", kExternalGlobal, i3);
+  builder2.addExportOfKind("reexport4", kExternalGlobal, i4);
+
+  builder2.addFunction("set_globals", kSig_v_rr)
+    .addBody([
+      kExprGetLocal, 0,
+      kExprSetGlobal, i2,
+      kExprGetLocal, 1,
+      kExprSetGlobal, i3,
+    ])
+    .exportAs("set_globals");
+
+  builder2.addFunction('get_global2', kSig_r_v)
+    .addBody([kExprGetGlobal, i2])
+    .exportAs('get_global2');
+
+  builder2.addFunction('get_global3', kSig_r_v)
+    .addBody([kExprGetGlobal, i3])
+    .exportAs('get_global3');
+
+  const instance2 = builder2.instantiate(instance1);
+  // Check if the globals were imported correctly.
+  assertSame(obj2, instance2.exports.get_global2());
+  assertSame(obj3, instance2.exports.get_global3());
+
+  assertSame(obj2, instance2.exports.reexport2.value);
+  assertSame(obj3, instance2.exports.reexport3.value);
+
+  // Check if instance2 can make changes visible for instance1.
+  instance2.exports.set_globals(null, undefined);
+  assertEquals(null, instance1.exports.get_global2());
+  assertEquals(undefined, instance1.exports.get_global3());
+
+  assertEquals(null, instance2.exports.reexport2.value);
+  assertEquals(undefined, instance2.exports.reexport3.value);
+
+  // Check if instance1 can make changes visible for instance2.
+  instance1.exports.set_globals("foo", 66343);
+  assertEquals("foo", instance2.exports.get_global2());
+  assertEquals(66343, instance2.exports.get_global3());
+
+  assertEquals("foo", instance2.exports.reexport2.value);
+  assertEquals(66343, instance2.exports.reexport3.value);
+
+  const bar2 = { f: "oo" };
+  const bar3 = { b: "ar" };
+  instance2.exports.reexport2.value = bar2;
+  instance2.exports.reexport3.value = bar3;
+
+  assertSame(bar2, instance1.exports.get_global2());
+  assertSame(bar3, instance1.exports.get_global3());
+  assertSame(bar2, instance2.exports.get_global2());
+  assertSame(bar3, instance2.exports.get_global3());
+})();
+
+(function TestImportMutableAnyFuncGlobalFromOtherInstance() {
+  print(arguments.callee.name);
+
+  // Create an instance which exports globals.
+  let builder1 = new WasmModuleBuilder();
+  const g3 = builder1.addGlobal(kWasmAnyFunc, true).exportAs("e3");
+  builder1.addGlobal(kWasmI32, true).exportAs("e1"); // Dummy.
+  builder1.addGlobal(kWasmAnyFunc, true).exportAs("e4"); // Dummy.
+  const g2 = builder1.addGlobal(kWasmAnyFunc, true).exportAs("e2");
+
+  builder1.addFunction("set_globals", kSig_v_aa)
+    .addBody([
+      kExprGetLocal, 0,
+      kExprSetGlobal, g2.index,
+      kExprGetLocal, 1,
+      kExprSetGlobal, g3.index,
+    ])
+    .exportAs("set_globals");
+
+  builder1.addFunction('get_global2', kSig_a_v)
+    .addBody([kExprGetGlobal, g2.index])
+    .exportAs('get_global2');
+
+  builder1.addFunction('get_global3', kSig_a_v)
+    .addBody([kExprGetGlobal, g3.index])
+    .exportAs('get_global3');
+
+  const instance1 = builder1.instantiate();
+  const obj2 = dummy_func();
+  const obj3 = instance1.exports.set_globals;
+  const obj4 = instance1.exports.get_global3;
+  instance1.exports.set_globals(obj2, obj3);
+
+  // Create an instance which imports the globals of the other instance.
+  let builder2 = new WasmModuleBuilder();
+  const i1 = builder2.addImportedGlobal('exports', 'e1', kWasmI32, true);
+  const i2 = builder2.addImportedGlobal('exports', 'e2', kWasmAnyFunc, true);
+  const i3 = builder2.addImportedGlobal('exports', 'e3', kWasmAnyFunc, true);
+  const i4 = builder2.addImportedGlobal('exports', 'e4', kWasmAnyFunc, true);
+
+  builder2.addExportOfKind("reexport1", kExternalGlobal, i1);
+  builder2.addExportOfKind("reexport2", kExternalGlobal, i2);
+  builder2.addExportOfKind("reexport3", kExternalGlobal, i3);
+  builder2.addExportOfKind("reexport4", kExternalGlobal, i4);
+
+  builder2.addFunction("set_globals", kSig_v_aa)
+    .addBody([
+      kExprGetLocal, 0,
+      kExprSetGlobal, i2,
+      kExprGetLocal, 1,
+      kExprSetGlobal, i3,
+    ])
+    .exportAs("set_globals");
+
+  builder2.addFunction('get_global2', kSig_a_v)
+    .addBody([kExprGetGlobal, i2])
+    .exportAs('get_global2');
+
+  builder2.addFunction('get_global3', kSig_a_v)
+    .addBody([kExprGetGlobal, i3])
+    .exportAs('get_global3');
+
+  const instance2 = builder2.instantiate(instance1);
+  // Check if the globals were imported correctly.
+  assertSame(obj2, instance2.exports.get_global2());
+  assertSame(obj3, instance2.exports.get_global3());
+
+  assertSame(obj2, instance2.exports.reexport2.value);
+  assertSame(obj3, instance2.exports.reexport3.value);
+
+  // Check if instance2 can make changes visible for instance1.
+  instance2.exports.set_globals(null, obj4);
+  assertEquals(null, instance1.exports.get_global2());
+  assertEquals(obj4, instance1.exports.get_global3());
+
+  assertEquals(null, instance2.exports.reexport2.value);
+  assertEquals(obj4, instance2.exports.reexport3.value);
+
+  // Check if instance1 can make changes visible for instance2.
+  instance1.exports.set_globals(obj2, obj3);
+  assertEquals(obj2, instance2.exports.get_global2());
+  assertEquals(obj3, instance2.exports.get_global3());
+
+  assertEquals(obj2, instance2.exports.reexport2.value);
+  assertEquals(obj3, instance2.exports.reexport3.value);
+})();
+
+(function TestImportImmutableAnyFuncGlobalAsAnyRef() {
+  print(arguments.callee.name);
+  let builder1 = new WasmModuleBuilder();
+  const g3 = builder1.addGlobal(kWasmAnyFunc, true).exportAs("e3");
+  builder1.addGlobal(kWasmAnyRef, false).exportAs("e1"); // Dummy.
+  builder1.addGlobal(kWasmAnyFunc, false).exportAs("e2"); // Dummy.
+  const instance1 = builder1.instantiate();
+
+  let builder2 = new WasmModuleBuilder();
+  const i1 = builder2.addImportedGlobal('exports', 'e1', kWasmAnyRef, false);
+  const i2 = builder2.addImportedGlobal('exports', 'e2', kWasmAnyRef, false);
+  builder2.instantiate(instance1);
+})();
+
+(function TestImportMutableAnyFuncGlobalAsAnyRefFails() {
+  print(arguments.callee.name);
+  let builder1 = new WasmModuleBuilder();
+  const g3 = builder1.addGlobal(kWasmAnyFunc, true).exportAs("e3");
+  builder1.addGlobal(kWasmAnyRef, true).exportAs("e1"); // Dummy.
+  builder1.addGlobal(kWasmAnyFunc, true).exportAs("e2"); // Dummy.
+  const instance1 = builder1.instantiate();
+
+  let builder2 = new WasmModuleBuilder();
+  const i1 = builder2.addImportedGlobal('exports', 'e1', kWasmAnyRef, true);
+  const i2 = builder2.addImportedGlobal('exports', 'e2', kWasmAnyRef, true);
+  assertThrows(() => builder2.instantiate(instance1), WebAssembly.LinkError);
+})();
+
+(function TestRefFuncGlobalInit() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  const g_ref = builder.addGlobal(kWasmAnyRef, true);
+  const g_func = builder.addGlobal(kWasmAnyFunc, true);
+  const f_ref = builder.addFunction('get_anyref_global', kSig_r_v)
+                    .addBody([kExprGetGlobal, g_ref.index])
+                    .exportAs('get_anyref_global');
+  const f_func = builder.addFunction('get_anyfunc_global', kSig_a_v)
+                     .addBody([kExprGetGlobal, g_func.index])
+                     .exportAs('get_anyfunc_global');
+
+  g_ref.function_index = f_ref.index;
+  g_func.function_index = f_func.index;
+
+  const instance = builder.instantiate();
+  assertEquals(
+      instance.exports.get_anyref_global, instance.exports.get_anyref_global());
+  assertEquals(
+      instance.exports.get_anyfunc_global,
+      instance.exports.get_anyfunc_global());
+})();
+
+(function TestRefFuncGlobalInitWithImport() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  const sig_index = builder.addType(kSig_i_v);
+  const import_wasm = builder.addImport('m', 'wasm', sig_index);
+  const import_js = builder.addImport('m', 'js', sig_index);
+  const g_wasm = builder.addGlobal(kWasmAnyFunc, true);
+  const g_js = builder.addGlobal(kWasmAnyFunc, true);
+  g_wasm.function_index = import_wasm;
+  g_js.function_index = import_js;
+  builder.addFunction('get_global_wasm', kSig_a_v)
+      .addBody([kExprGetGlobal, g_wasm.index])
+      .exportFunc();
+  builder.addFunction('get_global_js', kSig_a_v)
+      .addBody([kExprGetGlobal, g_js.index])
+      .exportFunc();
+
+  const expected_wasm = dummy_func();
+  const expected_val = 27;
+  // I want to test here that imported JS functions get wrapped by wasm-to-js
+  // and js-to-wasm wrappers. That's why {expected_js} does not return an
+  // integer directly but an object with a {valueOf} function.
+  function expected_js() {
+    const result = {};
+    result.valueOf = () => expected_val;
+    return result;
+  };
+
+  const instance =
+      builder.instantiate({m: {wasm: expected_wasm, js: expected_js}});
+
+  assertSame(expected_wasm, instance.exports.get_global_wasm());
+  assertSame(expected_val, instance.exports.get_global_js()());
+})();
diff --git a/src/v8/test/mjsunit/wasm/anyref-interpreter.js b/src/v8/test/mjsunit/wasm/anyref-interpreter.js
new file mode 100644
index 0000000..d22e841
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/anyref-interpreter.js
@@ -0,0 +1,12 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --experimental-wasm-anyref --expose-gc
+// Flags: --wasm-interpret-all
+
+// This is just a wrapper for an existing reference types test case that runs
+// with the --wasm-interpret-all flag added. If we ever decide to add a test
+// variant for this, then we can remove this file.
+
+load("test/mjsunit/wasm/anyref.js");
diff --git a/src/v8/test/mjsunit/wasm/anyref-table.js b/src/v8/test/mjsunit/wasm/anyref-table.js
new file mode 100644
index 0000000..de35dc8
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/anyref-table.js
@@ -0,0 +1,47 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-anyref
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function TestAnyRefTableSetWithMultipleTypes() {
+  print(arguments.callee.name);
+  let table = new WebAssembly.Table({element: "anyref", initial: 10});
+
+  // Table should be initialized with null.
+  assertEquals(null, table.get(1));
+  let obj = {'hello' : 'world'};
+  table.set(2, obj);
+  assertSame(obj, table.get(2));
+  table.set(3, 1234);
+  assertEquals(1234, table.get(3));
+  table.set(4, 123.5);
+  assertEquals(123.5, table.get(4));
+  table.set(5, undefined);
+  assertEquals(undefined, table.get(5));
+  // Overwrite entry 4, because null would otherwise be the default value.
+  table.set(4, null);
+  assertEquals(null, table.get(4));
+  table.set(7, print);
+  assertEquals(print, table.get(7));
+
+  assertThrows(() => table.set(12), RangeError);
+})();
+
+(function TestImportAnyRefTable() {
+  print(arguments.callee.name);
+
+  const builder = new WasmModuleBuilder();
+  const table_index = builder.addImportedTable("imp", "table", 3, 10, kWasmAnyRef);
+  builder.addFunction('get', kSig_r_v)
+  .addBody([kExprI32Const, 0, kExprTableGet, table_index]);
+
+  let table_ref = new WebAssembly.Table({element: "anyref", initial: 3, maximum: 10});
+  builder.instantiate({imp:{table: table_ref}});
+
+  let table_func = new WebAssembly.Table({ element: "anyfunc", initial: 3, maximum: 10 });
+  assertThrows(() => builder.instantiate({ imp: { table: table_func } }),
+    WebAssembly.LinkError, /imported table does not match the expected type/);
+})();
diff --git a/src/v8/test/mjsunit/wasm/anyref.js b/src/v8/test/mjsunit/wasm/anyref.js
new file mode 100644
index 0000000..141d25d
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/anyref.js
@@ -0,0 +1,242 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --experimental-wasm-anyref --expose-gc
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function testAnyRefIdentityFunction() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  builder.addFunction('main', kSig_r_r)
+      .addBody([kExprGetLocal, 0])
+      .exportFunc();
+
+
+  const instance = builder.instantiate();
+
+  let obj = {'hello' : 'world'};
+  assertEquals(obj, instance.exports.main(obj));
+  assertEquals(1234, instance.exports.main(1234));
+  assertEquals(123.4, instance.exports.main(123.4));
+  assertEquals(undefined, instance.exports.main(undefined));
+  assertEquals(null, instance.exports.main(null));
+  assertEquals(print, instance.exports.main(print));
+})();
+
+(function testPassAnyRefToImportedFunction() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const sig_index = builder.addType(kSig_v_r);
+  const imp_index = builder.addImport("q", "func", sig_index);
+  builder.addFunction('main', sig_index)
+      .addBody([kExprGetLocal, 0,
+      kExprCallFunction, imp_index])
+      .exportFunc();
+
+  function checkFunction(value) {
+    assertEquals('world', value.hello);
+  }
+
+  const instance = builder.instantiate({q: {func: checkFunction}});
+
+  instance.exports.main({hello: 'world'});
+})();
+
+(function testPassAnyRefWithGCWithLocals() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const ref_sig = builder.addType(kSig_v_r);
+  const void_sig = builder.addType(kSig_v_v);
+  const imp_index = builder.addImport("q", "func", ref_sig);
+  const gc_index = builder.addImport("q", "gc", void_sig);
+  // First call the gc, then check if the object still exists.
+  builder.addFunction('main', ref_sig)
+      .addLocals({anyref_count: 10})
+      .addBody([
+        kExprGetLocal, 0, kExprSetLocal, 1,             // Set local
+        kExprGetLocal, 0, kExprSetLocal, 2,             // Set local
+        kExprGetLocal, 0, kExprSetLocal, 3,             // Set local
+        kExprGetLocal, 0, kExprSetLocal, 4,             // Set local
+        kExprGetLocal, 0, kExprSetLocal, 5,             // Set local
+        kExprGetLocal, 0, kExprSetLocal, 6,             // Set local
+        kExprGetLocal, 0, kExprSetLocal, 7,             // Set local
+        kExprGetLocal, 0, kExprSetLocal, 8,             // Set local
+        kExprGetLocal, 0, kExprSetLocal, 9,             // Set local
+        kExprGetLocal, 0, kExprSetLocal, 10,            // Set local
+        kExprCallFunction, gc_index,                    // call gc
+        kExprGetLocal, 9, kExprCallFunction, imp_index  // call import
+      ])
+      .exportFunc();
+
+  function checkFunction(value) {
+    assertEquals('world', value.hello);
+  }
+
+  const instance = builder.instantiate({q: {func: checkFunction, gc: gc}});
+
+  instance.exports.main({hello: 'world'});
+})();
+
+(function testPassAnyRefWithGC() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const ref_sig = builder.addType(kSig_v_r);
+  const void_sig = builder.addType(kSig_v_v);
+  const imp_index = builder.addImport("q", "func", ref_sig);
+  const gc_index = builder.addImport("q", "gc", void_sig);
+  // First call the gc, then check if the object still exists.
+  builder.addFunction('main', ref_sig)
+      .addBody([
+        kExprCallFunction, gc_index,                    // call gc
+        kExprGetLocal, 0, kExprCallFunction, imp_index  // call import
+      ])
+      .exportFunc();
+
+  function checkFunction(value) {
+    assertEquals('world', value.hello);
+  }
+
+  const instance = builder.instantiate({q: {func: checkFunction, gc: gc}});
+
+  instance.exports.main({hello: 'world'});
+})();
+
+(function testPassAnyRefWithGCWithStackParameters() {
+  print(arguments.callee.name);
+  const num_params = 15;
+  for (let index = 0; index < num_params; index++) {
+    const builder = new WasmModuleBuilder();
+    // Make a signature with {num_params} many anyref parameters.
+    const mysig = makeSig(Array(num_params).fill(kWasmAnyRef), []);
+    const main_sig = builder.addType(mysig);
+    const ref_sig = builder.addType(kSig_v_r);
+    const void_sig = builder.addType(kSig_v_v);
+    const imp_index = builder.addImport('q', 'func', ref_sig);
+    const gc_index = builder.addImport('q', 'gc', void_sig);
+    // First call the gc, then check if the object still exists.
+    builder.addFunction('main', main_sig)
+        .addBody([
+          kExprCallFunction, gc_index,                        // call gc
+          kExprGetLocal, index, kExprCallFunction, imp_index  // call import
+        ])
+        .exportFunc();
+
+    function checkFunction(value) {
+      assertEquals(index, value.hello);
+    }
+
+    const instance = builder.instantiate({q: {func: checkFunction, gc: gc}});
+
+    // Pass {num_params} many parameters to main. Note that it is important
+    // that no other references to these objects exist. They are kept alive
+    // only through references stored in the parameters slots of a stack frame.
+    instance.exports.main(
+        {hello: 0}, {hello: 1}, {hello: 2}, {hello: 3}, {hello: 4}, {hello: 5},
+        {hello: 6}, {hello: 7}, {hello: 8}, {hello: 9}, {hello: 10},
+        {hello: 11}, {hello: 12}, {hello: 13}, {hello: 14});
+  }
+})();
+
+(function testPassAnyRefWithGCInWrapper() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const kSig_r_iri = makeSig([kWasmI32, kWasmAnyRef, kWasmI32], [kWasmAnyRef]);
+  const sig_index = builder.addType(kSig_r_iri);
+  builder.addFunction('main', sig_index)
+      .addBody([kExprGetLocal, 1])
+      .exportFunc();
+
+  const instance = builder.instantiate();
+
+  const triggerGCParam = {
+    valueOf: () => {
+      gc();
+      return 17;
+    }
+  };
+
+  const result = instance.exports.main(triggerGCParam, {hello: 'world'}, triggerGCParam);
+  assertEquals('world', result.hello);
+})();
+
+(function testAnyRefNull() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  builder.addFunction('main', kSig_r_v)
+      .addBody([kExprRefNull])
+      .exportFunc();
+
+  const instance = builder.instantiate();
+
+  assertEquals(null, instance.exports.main());
+})();
+
+(function testAnyRefIsNull() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  builder.addFunction('main', kSig_i_r)
+      .addBody([kExprGetLocal, 0, kExprRefIsNull])
+      .exportFunc();
+
+  const instance = builder.instantiate();
+
+  assertEquals(0, instance.exports.main({'hello' : 'world'}));
+  assertEquals(0, instance.exports.main(1234));
+  assertEquals(0, instance.exports.main(0));
+  assertEquals(0, instance.exports.main(123.4));
+  assertEquals(0, instance.exports.main(undefined));
+  assertEquals(1, instance.exports.main(null));
+  assertEquals(0, instance.exports.main(print));
+})();
+
+(function testAnyRefNullIsNull() {
+  print(arguments.callee.name);
+
+  const builder = new WasmModuleBuilder();
+  builder.addFunction('main', kSig_i_v)
+      .addBody([kExprRefNull, kExprRefIsNull])
+      .exportFunc();
+
+  const instance = builder.instantiate();
+
+  assertEquals(1, instance.exports.main());
+})();
+
+(function testAnyRefLocalDefaultValue() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  builder.addFunction('main', kSig_r_v)
+      .addBody([kExprGetLocal, 0])
+      .addLocals({anyref_count: 1})
+      .exportFunc();
+
+  const instance = builder.instantiate();
+
+  assertEquals(null, instance.exports.main());
+})();
+
+(function testImplicitReturnNullRefAsAnyRef() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const sig_index = builder.addType(kSig_r_v);
+  builder.addFunction('main', sig_index)
+      .addBody([kExprRefNull])
+      .exportFunc();
+
+  const main = builder.instantiate().exports.main;
+  assertEquals(null, main());
+})();
+
+(function testExplicitReturnNullRefAsAnyRef() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const sig_index = builder.addType(kSig_r_v);
+  builder.addFunction('main', sig_index)
+      .addBody([kExprRefNull, kExprReturn])
+      .exportFunc();
+
+  const main = builder.instantiate().exports.main;
+  assertEquals(null, main());
+})();
diff --git a/src/v8/test/mjsunit/wasm/asm-wasm-f32.js b/src/v8/test/mjsunit/wasm/asm-wasm-f32.js
index a1af7a4..1a89c3e 100644
--- a/src/v8/test/mjsunit/wasm/asm-wasm-f32.js
+++ b/src/v8/test/mjsunit/wasm/asm-wasm-f32.js
@@ -200,23 +200,8 @@
 ];
 
 var funcs = [
-  f32_add,
-  f32_sub,
-  f32_mul,
-  f32_div,
-  f32_ceil,
-  f32_floor,
-// TODO(bradnelson) f32_sqrt,
-// TODO(bradnelson) f32_abs,
-// TODO(bradnelson) f32_min is wrong for -0
-// TODO(bradnelson) f32_max is wrong for -0
-  f32_eq,
-  f32_ne,
-  f32_lt,
-  f32_lteq,
-  f32_gt,
-  f32_gteq,
-  f32_neg,
+  f32_add, f32_sub, f32_mul, f32_div, f32_ceil, f32_floor, f32_sqrt, f32_abs,
+  f32_min, f32_max, f32_eq, f32_ne, f32_lt, f32_lteq, f32_gt, f32_gteq, f32_neg
 ];
 
 (function () {
diff --git a/src/v8/test/mjsunit/wasm/asm-wasm-f64.js b/src/v8/test/mjsunit/wasm/asm-wasm-f64.js
index c7b439f..a07de98 100644
--- a/src/v8/test/mjsunit/wasm/asm-wasm-f64.js
+++ b/src/v8/test/mjsunit/wasm/asm-wasm-f64.js
@@ -262,32 +262,10 @@
 ];
 
 var funcs = [
-  f64_add,
-  f64_sub,
-  f64_mul,
-  f64_div,
-  f64_eq,
-  f64_ne,
-  f64_lt,
-  f64_lteq,
-  f64_gt,
-  f64_gteq,
-  f64_ceil,
-  f64_floor,
-// TODO(bradnelson) f64_sqrt,
-  f64_abs,
-  f64_neg,
-// TODO(bradnelson) f64_min is wrong for -0
-// TODO(bradnelson) f64_max is wrong for -0
-  f64_acos,
-  f64_asin,
-  f64_atan,
-  f64_cos,
-  f64_sin,
-  f64_tan,
-  f64_exp,
-  f64_log,
-  f64_atan2,
+  f64_add,  f64_sub, f64_mul,  f64_div,  f64_eq,    f64_ne,   f64_lt,
+  f64_lteq, f64_gt,  f64_gteq, f64_ceil, f64_floor, f64_sqrt, f64_abs,
+  f64_neg,  f64_min, f64_max,  f64_acos, f64_asin,  f64_atan, f64_cos,
+  f64_sin,  f64_tan, f64_exp,  f64_log,  f64_atan2,
 ];
 
 (function () {
diff --git a/src/v8/test/mjsunit/wasm/asm-wasm-imports.js b/src/v8/test/mjsunit/wasm/asm-wasm-imports.js
new file mode 100644
index 0000000..bfcb25b
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/asm-wasm-imports.js
@@ -0,0 +1,181 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+var stdlib = this;
+
+function assertValidAsm(func) {
+  assertTrue(%IsAsmWasmCode(func), "must be valid asm code");
+}
+
+function assertWasm(expected, func, ffi) {
+  print("Testing " + func.name + "...");
+  assertEquals(
+      expected, func(stdlib, ffi, new ArrayBuffer(1024)).caller());
+  assertValidAsm(func);
+}
+
+
+function TestForeignFunctions() {
+  function AsmModule(stdlib, foreign, buffer) {
+    "use asm";
+
+    var setVal = foreign.setVal;
+    var getVal = foreign.getVal;
+
+    function caller(initial_value, new_value) {
+      initial_value = initial_value|0;
+      new_value = new_value|0;
+      if ((getVal()|0) == (initial_value|0)) {
+        setVal(new_value|0);
+        return getVal()|0;
+      }
+      return 0;
+    }
+
+    return {caller:caller};
+  }
+
+  function ffi(initial_val) {
+    var val = initial_val;
+
+    function getVal() {
+      return val;
+    }
+
+    function setVal(new_val) {
+      val = new_val;
+    }
+
+    return {getVal:getVal, setVal:setVal};
+  }
+
+  var foreign = new ffi(23);
+
+  var module = AsmModule({Math: Math}, foreign, null);
+  assertValidAsm(AsmModule);
+
+  assertEquals(103, module.caller(23, 103));
+}
+
+print("TestForeignFunctions...");
+TestForeignFunctions();
+
+
+function TestForeignFunctionMultipleUse() {
+  function AsmModule(stdlib, foreign, buffer) {
+    "use asm";
+
+    var getVal = foreign.getVal;
+
+    function caller(int_val, double_val) {
+      int_val = int_val|0;
+      double_val = +double_val;
+      if ((getVal()|0) == (int_val|0)) {
+        if ((+getVal()) == (+double_val)) {
+          return 89;
+        }
+      }
+      return 0;
+    }
+
+    return {caller:caller};
+  }
+
+  function ffi() {
+    function getVal() {
+      return 83.25;
+    }
+
+    return {getVal:getVal};
+  }
+
+  var foreign = new ffi();
+
+  var module_decl = eval('(' + AsmModule.toString() + ')');
+  var module = module_decl(stdlib, foreign, null);
+  assertValidAsm(module_decl);
+
+  assertEquals(89, module.caller(83, 83.25));
+}
+
+print("TestForeignFunctionMultipleUse...");
+TestForeignFunctionMultipleUse();
+
+function TestForeignVariables() {
+  function AsmModule(stdlib, foreign, buffer) {
+    "use asm";
+
+    var i1 = foreign.foo | 0;
+    var f1 = +foreign.bar;
+    var i2 = foreign.baz | 0;
+    var f2 = +foreign.baz;
+
+    function geti1() {
+      return i1|0;
+    }
+
+    function getf1() {
+      return +f1;
+    }
+
+    function geti2() {
+      return i2|0;
+    }
+
+    function getf2() {
+      return +f2;
+    }
+
+    return {geti1:geti1, getf1:getf1, geti2:geti2, getf2:getf2};
+  }
+
+  function TestCase(env, i1, f1, i2, f2) {
+    print("Testing foreign variables...");
+    var module_decl = eval('(' + AsmModule.toString() + ')');
+    var module = module_decl(stdlib, env);
+    assertValidAsm(module_decl);
+    assertEquals(i1, module.geti1());
+    assertEquals(f1, module.getf1());
+    assertEquals(i2, module.geti2());
+    assertEquals(f2, module.getf2());
+  }
+
+  // Check normal operation.
+  TestCase({foo: 123, bar: 234.5, baz: 345.7}, 123, 234.5, 345, 345.7);
+  // Check partial operation.
+  TestCase({baz: 345.7}, 0, NaN, 345, 345.7);
+  // Check that undefined values are converted to proper defaults.
+  TestCase({qux: 999}, 0, NaN, 0, NaN);
+  // Check that true values are converted properly.
+  TestCase({foo: true, bar: true, baz: true}, 1, 1.0, 1, 1.0);
+  // Check that false values are converted properly.
+  TestCase({foo: false, bar: false, baz: false}, 0, 0, 0, 0);
+  // Check that null values are converted properly.
+  TestCase({foo: null, bar: null, baz: null}, 0, 0, 0, 0);
+  // Check that string values are converted properly.
+  TestCase({foo: 'hi', bar: 'there', baz: 'dude'}, 0, NaN, 0, NaN);
+  TestCase({foo: '0xff', bar: '234', baz: '456.1'}, 255, 234, 456, 456.1);
+  // Check that function values are converted properly.
+  TestCase({foo: TestCase, bar: TestCase, qux: TestCase}, 0, NaN, 0, NaN);
+}
+
+print("TestForeignVariables...");
+TestForeignVariables();
+
+
+function TestGlobalBlock(stdlib, foreign, buffer) {
+  "use asm";
+
+  var x = foreign.x | 0, y = foreign.y | 0;
+
+  function test() {
+    return (x + y) | 0;
+  }
+
+  return {caller: test};
+}
+
+assertWasm(15, TestGlobalBlock, { x: 4, y: 11 });
diff --git a/src/v8/test/mjsunit/wasm/asm-wasm-math-intrinsic.js b/src/v8/test/mjsunit/wasm/asm-wasm-math-intrinsic.js
new file mode 100644
index 0000000..f683436
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/asm-wasm-math-intrinsic.js
@@ -0,0 +1,295 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm  --allow-natives-syntax
+
+function verbose(args) {
+  // print(...args);
+}
+
+//=============================================
+// Global count of failures
+//=============================================
+let numFailures = 0;
+
+function reportFailure(name, vals, m, w) {
+  print('  error: ' + name + '(' + vals + ') == ' + w + ', expected ' + m);
+  numFailures++;
+}
+
+let inputs = [
+  1 / 0,
+  -1 / 0,
+  0 / 0,
+  -2.70497e+38,
+  -1.4698e+37,
+  -1.22813e+35,
+  -1.34584e+34,
+  -1.0079e+32,
+  -6.49364e+26,
+  -3.06077e+25,
+  -1.46821e+25,
+  -1.17658e+23,
+  -1.9617e+22,
+  -2.7357e+20,
+  -9223372036854775808.0,  // INT64_MIN
+  -1.48708e+13,
+  -1.89633e+12,
+  -4.66622e+11,
+  -2.22581e+11,
+  -1.45381e+10,
+  -2147483904.0,  // First float32 after INT32_MIN
+  -2147483648.0,  // INT32_MIN
+  -2147483520.0,  // Last float32 before INT32_MIN
+  -1.3956e+09,
+  -1.32951e+09,
+  -1.30721e+09,
+  -1.19756e+09,
+  -9.26822e+08,
+  -5.09256e+07,
+  -964300.0,
+  -192446.0,
+  -28455.0,
+  -27194.0,
+  -20575.0,
+  -17069.0,
+  -9167.0,
+  -960.178,
+  -113.0,
+  -62.0,
+  -15.0,
+  -7.0,
+  -1.0,
+  -0.0256635,
+  -4.60374e-07,
+  -3.63759e-10,
+  -4.30175e-14,
+  -5.27385e-15,
+  -1.5707963267948966,
+  -1.48084e-15,
+  -2.220446049250313e-16,
+  -1.05755e-19,
+  -3.2995e-21,
+  -1.67354e-23,
+  -1.11885e-23,
+  -1.78506e-30,
+  -1.43718e-34,
+  -1.27126e-38,
+  -0.0,
+  3e-88,
+  -2e66,
+  0.0,
+  2e66,
+  1.17549e-38,
+  1.56657e-37,
+  4.08512e-29,
+  6.25073e-22,
+  4.1723e-13,
+  1.44343e-09,
+  1.5707963267948966,
+  5.27004e-08,
+  9.48298e-08,
+  5.57888e-07,
+  4.89988e-05,
+  0.244326,
+  1.0,
+  12.4895,
+  19.0,
+  47.0,
+  106.0,
+  538.324,
+  564.536,
+  819.124,
+  7048.0,
+  12611.0,
+  19878.0,
+  20309.0,
+  797056.0,
+  1.77219e+09,
+  2147483648.0,  // INT32_MAX + 1
+  4294967296.0,  // UINT32_MAX + 1
+  1.51116e+11,
+  4.18193e+13,
+  3.59167e+16,
+  9223372036854775808.0,   // INT64_MAX + 1
+  18446744073709551616.0,  // UINT64_MAX + 1
+  3.38211e+19,
+  2.67488e+20,
+  1.78831e+21,
+  9.20914e+21,
+  8.35654e+23,
+  1.4495e+24,
+  5.94015e+25,
+  4.43608e+30,
+  2.44502e+33,
+  1.38178e+37,
+  1.71306e+37,
+  3.31899e+38,
+  3.40282e+38,
+];
+
+let stdlib = this;
+
+// Module template for generating f64 unop functions.
+function ModuleTemplate_f64_unop(stdlib) {
+  'use asm';
+
+  var Stdlib = stdlib.Math.NAME;
+
+  function NAME(a) {
+    a = +a;
+    return +Stdlib(a);
+  }
+
+  return {NAME: NAME};
+}
+
+// Module template for generating f64 binop functions.
+function ModuleTemplate_f64_binop(stdlib) {
+  'use asm';
+
+  var Stdlib = stdlib.Math.NAME;
+
+  function NAME(a, b) {
+    a = +a;
+    b = +b;
+    return +Stdlib(a, b);
+  }
+
+  return {NAME: NAME};
+}
+
+// Module template for generating f64 unop functions.
+function ModuleTemplate_f32_unop(stdlib) {
+  'use asm';
+
+  var Stdlib = stdlib.Math.NAME;
+  var fround = stdlib.Math.fround;
+
+  function NAME(a) {
+    a = fround(a);
+    return fround(Stdlib(a));
+  }
+
+  return {NAME: NAME};
+}
+
+// Module template for generating f64 binop functions.
+function ModuleTemplate_f32_binop(stdlib) {
+  'use asm';
+
+  var Stdlib = stdlib.Math.NAME;
+  var fround = stdlib.Math.fround;
+
+  function NAME(a, b) {
+    a = fround(a);
+    b = fround(b);
+    return fround(Stdlib(a, b));
+  }
+
+  return {NAME: NAME};
+}
+
+function instantiateTemplate(func, name) {
+  let src = func.toString();
+  src = src.replace(/NAME/g, name);
+  let module = eval('(' + src + ')');
+  let instance = module(stdlib);
+  assertTrue(%IsAsmWasmCode(module));
+
+  let asm_func = instance[name];
+  if (typeof asm_func != 'function') throw 'asm[' + full_name + '] not found';
+  return asm_func;
+}
+
+function genUnop(name, f32) {
+  return instantiateTemplate(
+      f32 ? ModuleTemplate_f32_unop : ModuleTemplate_f64_unop, name);
+}
+
+function genBinop(name, f32) {
+  return instantiateTemplate(
+      f32 ? ModuleTemplate_f32_binop : ModuleTemplate_f64_binop, name);
+}
+
+function assertUnop(name, math_func, asm_func) {
+  for (val of inputs) {
+    verbose('  ', val);
+    let m = math_func(val);
+    let w = asm_func(val);
+    if (!deepEquals(m, w)) reportFailure(name, [val], m, w);
+  }
+}
+
+function assertBinop(name, math_func, asm_func) {
+  let inputs2 = [1, 0.5, -1, -0.5, 0, -0, 1 / 0, -1 / 0, 0 / 0];
+  for (val of inputs) {
+    verbose('  ', val);
+    for (val2 of inputs2) {
+      verbose('    ', val2);
+      let m = math_func(val, val2);
+      let w = asm_func(val, val2);
+      if (!deepEquals(m, w)) reportFailure(name, [val, val2], m, w);
+      m = math_func(val2, val);
+      w = asm_func(val2, val);
+      if (!deepEquals(m, w)) reportFailure(name, [val2, val], m, w);
+    }
+  }
+}
+
+(function TestF64() {
+  let f64_intrinsics = [
+    'acos',  'asin', 'atan', 'cos',   'sin',   'tan',  'exp', 'log',
+    'atan2', 'pow',  'ceil', 'floor', 'sqrt',  'min',  'max', 'abs',
+    'min',   'max',  'abs',  'ceil',  'floor', 'sqrt',
+  ];
+
+  for (name of f64_intrinsics) {
+    if (name == 'pow') continue;  // TODO(8505): asm.js correctness
+    let math_func = Math[name];
+    let f32 = false;
+    print('Testing (f64) Math.' + name);
+    switch (math_func.length) {
+      case 1: {
+        let asm_func = genUnop(name, false);
+        assertUnop('(f64)' + name, math_func, asm_func);
+        break;
+      }
+      case 2: {
+        let asm_func = genBinop(name, false);
+        assertBinop('(f64)' + name, math_func, asm_func);
+        break;
+      }
+      default:
+        throw 'Unexpected param count: ' + func.length;
+    }
+  }
+})();
+
+(function TestF32() {
+  let f32_intrinsics = ['min', 'max', 'abs', 'ceil', 'floor', 'sqrt'];
+
+  for (name of f32_intrinsics) {
+    let r = Math.fround, f = Math[name];
+    print('Testing (f32) Math.' + name);
+    switch (f.length) {
+      case 1: {
+        let asm_func = genUnop(name, true);
+        let math_func = (val) => r(f(r(val)));
+        assertUnop('(f32)' + name, math_func, asm_func);
+        break;
+      }
+      case 2: {
+        let asm_func = genBinop(name, true);
+        let math_func = (v1, v2) => r(f(r(v1), r(v2)));
+        assertBinop('(f32)' + name, math_func, asm_func);
+        break;
+      }
+      default:
+        throw 'Unexpected param count: ' + func.length;
+    }
+  }
+})();
+
+assertEquals(0, numFailures);
diff --git a/src/v8/test/mjsunit/wasm/asm-wasm-memory.js b/src/v8/test/mjsunit/wasm/asm-wasm-memory.js
new file mode 100644
index 0000000..9c2ff77
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/asm-wasm-memory.js
@@ -0,0 +1,212 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+var stdlib = this;
+let kMinHeapSize = 4096;
+
+function assertValidAsm(func) {
+  assertTrue(%IsAsmWasmCode(func), "must be valid asm code");
+}
+
+function assertWasm(expected, func, ffi) {
+  print("Testing " + func.name + "...");
+  assertEquals(
+      expected, func(stdlib, ffi, new ArrayBuffer(kMinHeapSize)).caller());
+  assertValidAsm(func);
+}
+
+
+function TestInt32HeapAccess(stdlib, foreign, buffer) {
+  "use asm";
+
+  var m = new stdlib.Int32Array(buffer);
+  function caller() {
+    var i = 4;
+
+    m[0] = (i + 1) | 0;
+    m[i >> 2] = ((m[0]|0) + 1) | 0;
+    m[2] = ((m[i >> 2]|0) + 1) | 0;
+    return m[2] | 0;
+  }
+
+  return {caller: caller};
+}
+
+assertWasm(7, TestInt32HeapAccess);
+
+
+function TestInt32HeapAccessExternal() {
+  var memory = new ArrayBuffer(kMinHeapSize);
+  var memory_int32 = new Int32Array(memory);
+  var module_decl = eval('(' + TestInt32HeapAccess.toString() + ')');
+  var module = module_decl(stdlib, null, memory);
+  assertValidAsm(module_decl);
+  assertEquals(7, module.caller());
+  assertEquals(7, memory_int32[2]);
+}
+
+TestInt32HeapAccessExternal();
+
+
+function TestHeapAccessIntTypes() {
+  var types = [
+    [Int8Array, 'Int8Array', '>> 0'],
+    [Uint8Array, 'Uint8Array', '>> 0'],
+    [Int16Array, 'Int16Array', '>> 1'],
+    [Uint16Array, 'Uint16Array', '>> 1'],
+    [Int32Array, 'Int32Array', '>> 2'],
+    [Uint32Array, 'Uint32Array', '>> 2'],
+  ];
+  for (var i = 0; i < types.length; i++) {
+    var code = TestInt32HeapAccess.toString();
+    code = code.replace('Int32Array', types[i][1]);
+    code = code.replace(/>> 2/g, types[i][2]);
+    var memory = new ArrayBuffer(kMinHeapSize);
+    var memory_view = new types[i][0](memory);
+    var module_decl = eval('(' + code + ')');
+    var module = module_decl(stdlib, null, memory);
+    assertValidAsm(module_decl);
+    assertEquals(7, module.caller());
+    assertEquals(7, memory_view[2]);
+    assertValidAsm(module_decl);
+  }
+}
+
+TestHeapAccessIntTypes();
+
+
+function TestFloatHeapAccess(stdlib, foreign, buffer) {
+  "use asm";
+
+  var f32 = new stdlib.Float32Array(buffer);
+  var f64 = new stdlib.Float64Array(buffer);
+  var fround = stdlib.Math.fround;
+  function caller() {
+    var i = 8;
+    var j = 8;
+    var v = 6.0;
+
+    f64[2] = v + 1.0;
+    f64[i >> 3] = +f64[2] + 1.0;
+    f64[j >> 3] = +f64[j >> 3] + 1.0;
+    i = +f64[i >> 3] == 9.0;
+    return i|0;
+  }
+
+  return {caller: caller};
+}
+
+assertWasm(1, TestFloatHeapAccess);
+
+
+function TestFloatHeapAccessExternal() {
+  var memory = new ArrayBuffer(kMinHeapSize);
+  var memory_float64 = new Float64Array(memory);
+  var module_decl = eval('(' + TestFloatHeapAccess.toString() + ')');
+  var module = module_decl(stdlib, null, memory);
+  assertValidAsm(module_decl);
+  assertEquals(1, module.caller());
+  assertEquals(9.0, memory_float64[1]);
+}
+
+TestFloatHeapAccessExternal();
+
+
+(function() {
+  function TestByteHeapAccessCompat(stdlib, foreign, buffer) {
+    "use asm";
+
+    var HEAP8 = new stdlib.Uint8Array(buffer);
+    var HEAP32 = new stdlib.Int32Array(buffer);
+
+    function store(i, v) {
+      i = i | 0;
+      v = v | 0;
+      HEAP32[i >> 2] = v;
+    }
+
+    function storeb(i, v) {
+      i = i | 0;
+      v = v | 0;
+      HEAP8[i | 0] = v;
+    }
+
+    function load(i) {
+      i = i | 0;
+      return HEAP8[i] | 0;
+    }
+
+    function iload(i) {
+      i = i | 0;
+      return HEAP8[HEAP32[i >> 2] | 0] | 0;
+    }
+
+    return {load: load, iload: iload, store: store, storeb: storeb};
+  }
+
+  var memory = new ArrayBuffer(kMinHeapSize);
+  var module_decl = eval('(' + TestByteHeapAccessCompat.toString() + ')');
+  var m = module_decl(stdlib, null, memory);
+  assertValidAsm(module_decl);
+  m.store(0, 20);
+  m.store(4, 21);
+  m.store(8, 22);
+  m.storeb(20, 123);
+  m.storeb(21, 42);
+  m.storeb(22, 77);
+  assertEquals(123, m.load(20));
+  assertEquals(42, m.load(21));
+  assertEquals(77, m.load(22));
+  assertEquals(123, m.iload(0));
+  assertEquals(42, m.iload(4));
+  assertEquals(77, m.iload(8));
+})();
+
+
+function TestIntishAssignment(stdlib, foreign, heap) {
+  "use asm";
+  var HEAP32 = new stdlib.Int32Array(heap);
+  function func() {
+    var a = 1;
+    var b = 2;
+    HEAP32[0] = a + b;
+    return HEAP32[0] | 0;
+  }
+  return {caller: func};
+}
+
+assertWasm(3, TestIntishAssignment);
+
+
+function TestFloatishAssignment(stdlib, foreign, heap) {
+  "use asm";
+  var HEAPF32 = new stdlib.Float32Array(heap);
+  var fround = stdlib.Math.fround;
+  function func() {
+    var a = fround(1.0);
+    var b = fround(2.0);
+    HEAPF32[0] = a + b;
+    return +HEAPF32[0];
+  }
+  return {caller: func};
+}
+
+assertWasm(3, TestFloatishAssignment);
+
+
+function TestDoubleToFloatAssignment(stdlib, foreign, heap) {
+  "use asm";
+  var HEAPF32 = new stdlib.Float32Array(heap);
+  var fround = stdlib.Math.fround;
+  function func() {
+    var a = 1.23;
+    HEAPF32[0] = a;
+    return +HEAPF32[0];
+  }
+  return {caller: func};
+}
+
+assertWasm(Math.fround(1.23), TestDoubleToFloatAssignment);
diff --git a/src/v8/test/mjsunit/wasm/asm-wasm.js b/src/v8/test/mjsunit/wasm/asm-wasm.js
index 71c6b10..97219f1 100644
--- a/src/v8/test/mjsunit/wasm/asm-wasm.js
+++ b/src/v8/test/mjsunit/wasm/asm-wasm.js
@@ -5,6 +5,7 @@
 // Flags: --validate-asm --allow-natives-syntax
 
 var stdlib = this;
+let kMinHeapSize = 4096;
 
 function assertValidAsm(func) {
   assertTrue(%IsAsmWasmCode(func), "must be valid asm code");
@@ -13,7 +14,7 @@
 function assertWasm(expected, func, ffi) {
   print("Testing " + func.name + "...");
   assertEquals(
-      expected, func(stdlib, ffi, new ArrayBuffer(1024)).caller());
+      expected, func(stdlib, ffi, new ArrayBuffer(kMinHeapSize)).caller());
   assertValidAsm(func);
 }
 
@@ -514,100 +515,6 @@
 assertWasm(23, TestMixedAdd);
 
 
-function TestInt32HeapAccess(stdlib, foreign, buffer) {
-  "use asm";
-
-  var m = new stdlib.Int32Array(buffer);
-  function caller() {
-    var i = 4;
-
-    m[0] = (i + 1) | 0;
-    m[i >> 2] = ((m[0]|0) + 1) | 0;
-    m[2] = ((m[i >> 2]|0) + 1) | 0;
-    return m[2] | 0;
-  }
-
-  return {caller: caller};
-}
-
-assertWasm(7, TestInt32HeapAccess);
-
-
-function TestInt32HeapAccessExternal() {
-  var memory = new ArrayBuffer(1024);
-  var memory_int32 = new Int32Array(memory);
-  var module_decl = eval('(' + TestInt32HeapAccess.toString() + ')');
-  var module = module_decl(stdlib, null, memory);
-  assertValidAsm(module_decl);
-  assertEquals(7, module.caller());
-  assertEquals(7, memory_int32[2]);
-}
-
-TestInt32HeapAccessExternal();
-
-
-function TestHeapAccessIntTypes() {
-  var types = [
-    [Int8Array, 'Int8Array', '>> 0'],
-    [Uint8Array, 'Uint8Array', '>> 0'],
-    [Int16Array, 'Int16Array', '>> 1'],
-    [Uint16Array, 'Uint16Array', '>> 1'],
-    [Int32Array, 'Int32Array', '>> 2'],
-    [Uint32Array, 'Uint32Array', '>> 2'],
-  ];
-  for (var i = 0; i < types.length; i++) {
-    var code = TestInt32HeapAccess.toString();
-    code = code.replace('Int32Array', types[i][1]);
-    code = code.replace(/>> 2/g, types[i][2]);
-    var memory = new ArrayBuffer(1024);
-    var memory_view = new types[i][0](memory);
-    var module_decl = eval('(' + code + ')');
-    var module = module_decl(stdlib, null, memory);
-    assertValidAsm(module_decl);
-    assertEquals(7, module.caller());
-    assertEquals(7, memory_view[2]);
-    assertValidAsm(module_decl);
-  }
-}
-
-TestHeapAccessIntTypes();
-
-
-function TestFloatHeapAccess(stdlib, foreign, buffer) {
-  "use asm";
-
-  var f32 = new stdlib.Float32Array(buffer);
-  var f64 = new stdlib.Float64Array(buffer);
-  var fround = stdlib.Math.fround;
-  function caller() {
-    var i = 8;
-    var j = 8;
-    var v = 6.0;
-
-    f64[2] = v + 1.0;
-    f64[i >> 3] = +f64[2] + 1.0;
-    f64[j >> 3] = +f64[j >> 3] + 1.0;
-    i = +f64[i >> 3] == 9.0;
-    return i|0;
-  }
-
-  return {caller: caller};
-}
-
-assertWasm(1, TestFloatHeapAccess);
-
-
-function TestFloatHeapAccessExternal() {
-  var memory = new ArrayBuffer(1024);
-  var memory_float64 = new Float64Array(memory);
-  var module_decl = eval('(' + TestFloatHeapAccess.toString() + ')');
-  var module = module_decl(stdlib, null, memory);
-  assertValidAsm(module_decl);
-  assertEquals(1, module.caller());
-  assertEquals(9.0, memory_float64[1]);
-}
-
-TestFloatHeapAccessExternal();
 
 
 function TestConvertI32() {
@@ -1031,219 +938,6 @@
 })();
 
 
-function TestForeignFunctions() {
-  function AsmModule(stdlib, foreign, buffer) {
-    "use asm";
-
-    var setVal = foreign.setVal;
-    var getVal = foreign.getVal;
-
-    function caller(initial_value, new_value) {
-      initial_value = initial_value|0;
-      new_value = new_value|0;
-      if ((getVal()|0) == (initial_value|0)) {
-        setVal(new_value|0);
-        return getVal()|0;
-      }
-      return 0;
-    }
-
-    return {caller:caller};
-  }
-
-  function ffi(initial_val) {
-    var val = initial_val;
-
-    function getVal() {
-      return val;
-    }
-
-    function setVal(new_val) {
-      val = new_val;
-    }
-
-    return {getVal:getVal, setVal:setVal};
-  }
-
-  var foreign = new ffi(23);
-
-  var module = AsmModule({Math: Math}, foreign, null);
-  assertValidAsm(AsmModule);
-
-  assertEquals(103, module.caller(23, 103));
-}
-
-print("TestForeignFunctions...");
-TestForeignFunctions();
-
-
-function TestForeignFunctionMultipleUse() {
-  function AsmModule(stdlib, foreign, buffer) {
-    "use asm";
-
-    var getVal = foreign.getVal;
-
-    function caller(int_val, double_val) {
-      int_val = int_val|0;
-      double_val = +double_val;
-      if ((getVal()|0) == (int_val|0)) {
-        if ((+getVal()) == (+double_val)) {
-          return 89;
-        }
-      }
-      return 0;
-    }
-
-    return {caller:caller};
-  }
-
-  function ffi() {
-    function getVal() {
-      return 83.25;
-    }
-
-    return {getVal:getVal};
-  }
-
-  var foreign = new ffi();
-
-  var module_decl = eval('(' + AsmModule.toString() + ')');
-  var module = module_decl(stdlib, foreign, null);
-  assertValidAsm(module_decl);
-
-  assertEquals(89, module.caller(83, 83.25));
-}
-
-print("TestForeignFunctionMultipleUse...");
-TestForeignFunctionMultipleUse();
-
-function TestForeignVariables() {
-  function AsmModule(stdlib, foreign, buffer) {
-    "use asm";
-
-    var i1 = foreign.foo | 0;
-    var f1 = +foreign.bar;
-    var i2 = foreign.baz | 0;
-    var f2 = +foreign.baz;
-
-    function geti1() {
-      return i1|0;
-    }
-
-    function getf1() {
-      return +f1;
-    }
-
-    function geti2() {
-      return i2|0;
-    }
-
-    function getf2() {
-      return +f2;
-    }
-
-    return {geti1:geti1, getf1:getf1, geti2:geti2, getf2:getf2};
-  }
-
-  function TestCase(env, i1, f1, i2, f2) {
-    print("Testing foreign variables...");
-    var module_decl = eval('(' + AsmModule.toString() + ')');
-    var module = module_decl(stdlib, env);
-    assertValidAsm(module_decl);
-    assertEquals(i1, module.geti1());
-    assertEquals(f1, module.getf1());
-    assertEquals(i2, module.geti2());
-    assertEquals(f2, module.getf2());
-  }
-
-  // Check normal operation.
-  TestCase({foo: 123, bar: 234.5, baz: 345.7}, 123, 234.5, 345, 345.7);
-  // Check partial operation.
-  TestCase({baz: 345.7}, 0, NaN, 345, 345.7);
-  // Check that undefined values are converted to proper defaults.
-  TestCase({qux: 999}, 0, NaN, 0, NaN);
-  // Check that true values are converted properly.
-  TestCase({foo: true, bar: true, baz: true}, 1, 1.0, 1, 1.0);
-  // Check that false values are converted properly.
-  TestCase({foo: false, bar: false, baz: false}, 0, 0, 0, 0);
-  // Check that null values are converted properly.
-  TestCase({foo: null, bar: null, baz: null}, 0, 0, 0, 0);
-  // Check that string values are converted properly.
-  TestCase({foo: 'hi', bar: 'there', baz: 'dude'}, 0, NaN, 0, NaN);
-  TestCase({foo: '0xff', bar: '234', baz: '456.1'}, 255, 234, 456, 456.1);
-  // Check that function values are converted properly.
-  TestCase({foo: TestCase, bar: TestCase, qux: TestCase}, 0, NaN, 0, NaN);
-}
-
-print("TestForeignVariables...");
-TestForeignVariables();
-
-
-(function() {
-  function TestByteHeapAccessCompat(stdlib, foreign, buffer) {
-    "use asm";
-
-    var HEAP8 = new stdlib.Uint8Array(buffer);
-    var HEAP32 = new stdlib.Int32Array(buffer);
-
-    function store(i, v) {
-      i = i | 0;
-      v = v | 0;
-      HEAP32[i >> 2] = v;
-    }
-
-    function storeb(i, v) {
-      i = i | 0;
-      v = v | 0;
-      HEAP8[i | 0] = v;
-    }
-
-    function load(i) {
-      i = i | 0;
-      return HEAP8[i] | 0;
-    }
-
-    function iload(i) {
-      i = i | 0;
-      return HEAP8[HEAP32[i >> 2] | 0] | 0;
-    }
-
-    return {load: load, iload: iload, store: store, storeb: storeb};
-  }
-
-  var memory = new ArrayBuffer(1024);
-  var module_decl = eval('(' + TestByteHeapAccessCompat.toString() + ')');
-  var m = module_decl(stdlib, null, memory);
-  assertValidAsm(module_decl);
-  m.store(0, 20);
-  m.store(4, 21);
-  m.store(8, 22);
-  m.storeb(20, 123);
-  m.storeb(21, 42);
-  m.storeb(22, 77);
-  assertEquals(123, m.load(20));
-  assertEquals(42, m.load(21));
-  assertEquals(77, m.load(22));
-  assertEquals(123, m.iload(0));
-  assertEquals(42, m.iload(4));
-  assertEquals(77, m.iload(8));
-})();
-
-
-function TestGlobalBlock(stdlib, foreign, buffer) {
-  "use asm";
-
-  var x = foreign.x | 0, y = foreign.y | 0;
-
-  function test() {
-    return (x + y) | 0;
-  }
-
-  return {caller: test};
-}
-
-assertWasm(15, TestGlobalBlock, { x: 4, y: 11 });
-
 (function TestComma() {
   function CommaModule() {
     "use asm";
@@ -1322,52 +1016,6 @@
 assertWasm(1, TestXor);
 
 
-function TestIntishAssignment(stdlib, foreign, heap) {
-  "use asm";
-  var HEAP32 = new stdlib.Int32Array(heap);
-  function func() {
-    var a = 1;
-    var b = 2;
-    HEAP32[0] = a + b;
-    return HEAP32[0] | 0;
-  }
-  return {caller: func};
-}
-
-assertWasm(3, TestIntishAssignment);
-
-
-function TestFloatishAssignment(stdlib, foreign, heap) {
-  "use asm";
-  var HEAPF32 = new stdlib.Float32Array(heap);
-  var fround = stdlib.Math.fround;
-  function func() {
-    var a = fround(1.0);
-    var b = fround(2.0);
-    HEAPF32[0] = a + b;
-    return +HEAPF32[0];
-  }
-  return {caller: func};
-}
-
-assertWasm(3, TestFloatishAssignment);
-
-
-function TestDoubleToFloatAssignment(stdlib, foreign, heap) {
-  "use asm";
-  var HEAPF32 = new stdlib.Float32Array(heap);
-  var fround = stdlib.Math.fround;
-  function func() {
-    var a = 1.23;
-    HEAPF32[0] = a;
-    return +HEAPF32[0];
-  }
-  return {caller: func};
-}
-
-assertWasm(Math.fround(1.23), TestDoubleToFloatAssignment);
-
-
 function TestIntegerMultiplyBothWays(stdlib, foreign, heap) {
   "use asm";
   function func() {
diff --git a/src/v8/test/mjsunit/wasm/async-compile.js b/src/v8/test/mjsunit/wasm/async-compile.js
index fe7b1aa..4660ec7 100644
--- a/src/v8/test/mjsunit/wasm/async-compile.js
+++ b/src/v8/test/mjsunit/wasm/async-compile.js
@@ -2,22 +2,18 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --wasm-async-compilation --expose-wasm --allow-natives-syntax
-
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
-function assertCompiles(buffer) {
-  return assertPromiseResult(
-      WebAssembly.compile(buffer),
-      module => assertTrue(module instanceof WebAssembly.Module),
-      ex => assertUnreachable);
+async function assertCompiles(buffer) {
+  var module = await WebAssembly.compile(buffer);
+  assertInstanceof(module, WebAssembly.Module);
 }
 
-function assertCompileError(buffer) {
-  return assertPromiseResult(
-      WebAssembly.compile(buffer), module => assertUnreachable,
-      ex => assertTrue(ex instanceof WebAssembly.CompileError));
+function assertCompileError(buffer, msg) {
+  assertEquals('string', typeof msg);
+  return assertThrowsAsync(
+      WebAssembly.compile(buffer), WebAssembly.CompileError,
+      'WebAssembly.compile(): ' + msg);
 }
 
 assertPromiseResult(async function basicCompile() {
@@ -49,7 +45,7 @@
 
   // Three compilations of the bad module should fail.
   for (var i = 0; i < kNumCompiles; i++) {
-    await assertCompileError(bad_buffer);
+    await assertCompileError(bad_buffer, 'BufferSource argument is empty');
   }
 }());
 
@@ -68,5 +64,15 @@
     builder.addFunction('b' + i, sig).addBody([kExprI32Const, 42]);
   }
   let buffer = builder.toBuffer();
-  await assertCompileError(buffer);
+  await assertCompileError(
+      buffer,
+      'Compiling function #10:\"bad\" failed: ' +
+          'expected 1 elements on the stack for fallthru to @1, found 0 @+94');
+}());
+
+assertPromiseResult(async function importWithoutCode() {
+  // Regression test for https://crbug.com/898310.
+  let builder = new WasmModuleBuilder();
+  builder.addImport('m', 'q', kSig_i_i);
+  await builder.asyncInstantiate({'m': {'q': i => i}});
 }());
diff --git a/src/v8/test/mjsunit/wasm/atomics-stress.js b/src/v8/test/mjsunit/wasm/atomics-stress.js
new file mode 100644
index 0000000..8622919
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/atomics-stress.js
@@ -0,0 +1,505 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-threads
+
+// This test might time out if the search space for a sequential
+// interleaving becomes to large. However, it should never fail.
+// Note that results of this test are flaky by design. While the test is
+// deterministic with a fixed seed, bugs may introduce non-determinism.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const kDebug = false;
+
+const kSequenceLength = 256;
+const kNumberOfWorker = 4;
+const kNumberOfSteps = 10000000;
+
+const kFirstOpcodeWithInput = 3;
+const kFirstOpcodeWithoutOutput = 3;
+const kLastOpcodeWithoutOutput = 5;
+
+const opCodes = [
+  kExprI32AtomicLoad,     kExprI32AtomicLoad8U,     kExprI32AtomicLoad16U,
+  kExprI32AtomicStore,    kExprI32AtomicStore8U,    kExprI32AtomicStore16U,
+  kExprI32AtomicAdd,      kExprI32AtomicAdd8U,      kExprI32AtomicAdd16U,
+  kExprI32AtomicSub,      kExprI32AtomicSub8U,      kExprI32AtomicSub16U,
+  kExprI32AtomicAnd,      kExprI32AtomicAnd8U,      kExprI32AtomicAnd16U,
+  kExprI32AtomicOr,       kExprI32AtomicOr8U,       kExprI32AtomicOr16U,
+  kExprI32AtomicXor,      kExprI32AtomicXor8U,      kExprI32AtomicXor16U,
+  kExprI32AtomicExchange, kExprI32AtomicExchange8U, kExprI32AtomicExchange16U
+];
+
+const opCodeNames = [
+  'kExprI32AtomicLoad',       'kExprI32AtomicLoad8U',
+  'kExprI32AtomicLoad16U',    'kExprI32AtomicStore',
+  'kExprI32AtomicStore8U',    'kExprI32AtomicStore16U',
+  'kExprI32AtomicAdd',        'kExprI32AtomicAdd8U',
+  'kExprI32AtomicAdd16U',     'kExprI32AtomicSub',
+  'kExprI32AtomicSub8U',      'kExprI32AtomicSub16U',
+  'kExprI32AtomicAnd',        'kExprI32AtomicAnd8U',
+  'kExprI32AtomicAnd16U',     'kExprI32AtomicOr',
+  'kExprI32AtomicOr8U',       'kExprI32AtomicOr16U',
+  'kExprI32AtomicXor',        'kExprI32AtomicXor8U',
+  'kExprI32AtomicXor16U',     'kExprI32AtomicExchange',
+  'kExprI32AtomicExchange8U', 'kExprI32AtomicExchange16U'
+];
+
+let kMaxMemPages = 10;
+let gSharedMemory =
+    new WebAssembly.Memory({initial: 1, maximum: kMaxMemPages, shared: true});
+let gSharedMemoryView = new Int32Array(gSharedMemory.buffer);
+
+let gPrivateMemory =
+    new WebAssembly.Memory({initial: 1, maximum: kMaxMemPages, shared: true});
+let gPrivateMemoryView = new Int32Array(gPrivateMemory.buffer);
+
+class Operation {
+  constructor(opcode, input, offset) {
+    this.opcode = opcode != undefined ? opcode : Operation.nextOpcode();
+    this.size = Operation.opcodeToSize(this.opcode);
+    this.input = input != undefined ? input : Operation.inputForSize(this.size);
+    this.offset =
+        offset != undefined ? offset : Operation.offsetForSize(this.size);
+  }
+
+  static nextOpcode() {
+    let random = Math.random();
+    return Math.floor(random * opCodes.length);
+  }
+
+  static opcodeToSize(opcode) {
+    // Instructions are ordered in 32, 8, 16 bits size
+    return [32, 8, 16][opcode % 3];
+  }
+
+  static opcodeToAlignment(opcode) {
+    // Instructions are ordered in 32, 8, 16 bits size
+    return [2, 0, 1][opcode % 3];
+  }
+
+  static inputForSize(size) {
+    let random = Math.random();
+    // Avoid 32 bit overflow for integer here :(
+    return Math.floor(random * (1 << (size - 1)) * 2);
+  }
+
+  static offsetForSize(size) {
+    // Pick an offset in bytes between 0 and 7.
+    let offset = Math.floor(Math.random() * 8);
+    // Make sure the offset matches the required alignment by masking out the
+    // lower bits.
+    let size_in_bytes = size / 8;
+    let mask = ~(size_in_bytes - 1);
+    return offset & mask;
+  }
+
+  get wasmOpcode() {
+    // [opcode, alignment, offset]
+    return [
+      opCodes[this.opcode], Operation.opcodeToAlignment(this.opcode),
+      this.offset
+    ];
+  }
+
+  get hasInput() {
+    return this.opcode >= kFirstOpcodeWithInput;
+  }
+
+  get hasOutput() {
+    return this.opcode < kFirstOpcodeWithoutOutput ||
+        this.opcode > kLastOpcodeWithoutOutput;
+  }
+
+  truncateResultBits(low, high) {
+    // Shift the lower part. For offsets greater four it drops out of the
+    // visible window.
+    let shiftedL = this.offset >= 4 ? 0 : low >>> (this.offset * 8);
+    // The higher part is zero for offset 0, left shifted for [1..3] and right
+    // shifted for [4..7].
+    let shiftedH = this.offset == 0 ?
+        0 :
+        this.offset >= 4 ? high >>> (this.offset - 4) * 8 :
+                           high << ((4 - this.offset) * 8);
+    let value = shiftedL | shiftedH;
+
+    switch (this.size) {
+      case 8:
+        return value & 0xFF;
+      case 16:
+        return value & 0xFFFF;
+      case 32:
+        return value;
+      default:
+        throw 'Unexpected size: ' + this.size;
+    }
+  }
+
+  static get builder() {
+    if (!Operation.__builder) {
+      let builder = new WasmModuleBuilder();
+      builder.addImportedMemory('m', 'imported_mem', 0, kMaxMemPages, 'shared');
+      Operation.__builder = builder;
+    }
+    return Operation.__builder;
+  }
+
+  static get exports() {
+    if (!Operation.__instance) {
+      return {};
+    }
+    return Operation.__instance.exports;
+  }
+
+  static set instance(instance) {
+    Operation.__instance = instance;
+  }
+
+  compute(state) {
+    let evalFun = Operation.exports[this.key];
+    if (!evalFun) {
+      let builder = Operation.builder;
+      let body = [
+        // Load address of low 32 bits.
+        kExprI32Const, 0,
+        // Load expected value.
+        kExprGetLocal, 0, kExprI32StoreMem, 2, 0,
+        // Load address of high 32 bits.
+        kExprI32Const, 4,
+        // Load expected value.
+        kExprGetLocal, 1, kExprI32StoreMem, 2, 0,
+        // Load address of where our window starts.
+        kExprI32Const, 0,
+        // Load input if there is one.
+        ...(this.hasInput ? [kExprGetLocal, 2] : []),
+        // Perform operation.
+        kAtomicPrefix, ...this.wasmOpcode,
+        // Drop output if it had any.
+        ...(this.hasOutput ? [kExprDrop] : []),
+        // Load resulting value.
+        kExprI32Const, 0, kExprI32LoadMem, 2, 0,
+        // Return.
+        kExprReturn
+      ]
+      builder.addFunction(this.key, kSig_i_iii)
+          .addBody(body)
+          .exportAs(this.key);
+      // Instantiate module, get function exports.
+      let module = new WebAssembly.Module(builder.toBuffer());
+      Operation.instance =
+          new WebAssembly.Instance(module, {m: {imported_mem: gPrivateMemory}});
+      evalFun = Operation.exports[this.key];
+    }
+    let result = evalFun(state.low, state.high, this.input);
+    let ta = gPrivateMemoryView;
+    if (kDebug) {
+      print(
+          state.high + ':' + state.low + ' ' + this.toString() + ' -> ' +
+          ta[1] + ':' + ta[0]);
+    }
+    if (result != ta[0]) throw '!';
+    return {low: ta[0], high: ta[1]};
+  }
+
+  toString() {
+    return opCodeNames[this.opcode] + '[+' + this.offset + '] ' + this.input;
+  }
+
+  get key() {
+    return this.opcode + '-' + this.offset;
+  }
+}
+
+class State {
+  constructor(low, high, indices, count) {
+    this.low = low;
+    this.high = high;
+    this.indices = indices;
+    this.count = count;
+  }
+
+  isFinal() {
+    return (this.count == kNumberOfWorker * kSequenceLength);
+  }
+
+  toString() {
+    return this.high + ':' + this.low + ' @ ' + this.indices;
+  }
+}
+
+function makeSequenceOfOperations(size) {
+  let result = new Array(size);
+  for (let i = 0; i < size; i++) {
+    result[i] = new Operation();
+  }
+  return result;
+}
+
+function toSLeb128(val) {
+  let result = [];
+  while (true) {
+    let v = val & 0x7f;
+    val = val >> 7;
+    let msbIsSet = (v & 0x40) || false;
+    if (((val == 0) && !msbIsSet) || ((val == -1) && msbIsSet)) {
+      result.push(v);
+      break;
+    }
+    result.push(v | 0x80);
+  }
+  return result;
+}
+
+function generateFunctionBodyForSequence(sequence) {
+  // We expect the int32* to perform ops on as arg 0 and
+  // the int32* for our value log as arg1. Argument 2 gives
+  // an int32* we use to count down spinning workers.
+  let body = [];
+  // Initially, we spin until all workers start running.
+  if (!kDebug) {
+    body.push(
+        // Decrement the wait count.
+        kExprGetLocal, 2, kExprI32Const, 1, kAtomicPrefix, kExprI32AtomicSub, 2,
+        0,
+        // Spin until zero.
+        kExprLoop, kWasmStmt, kExprGetLocal, 2, kAtomicPrefix,
+        kExprI32AtomicLoad, 2, 0, kExprI32Const, 0, kExprI32GtU, kExprBrIf, 0,
+        kExprEnd);
+  }
+  for (let operation of sequence) {
+    body.push(
+        // Pre-load address of results sequence pointer for later.
+        kExprGetLocal, 1,
+        // Load address where atomic pointers are stored.
+        kExprGetLocal, 0,
+        // Load the second argument if it had any.
+        ...(operation.hasInput ?
+                [kExprI32Const, ...toSLeb128(operation.input)] :
+                []),
+        // Perform operation
+        kAtomicPrefix, ...operation.wasmOpcode,
+        // Generate fake output in needed.
+        ...(operation.hasOutput ? [] : [kExprI32Const, 0]),
+        // Store read intermediate to sequence.
+        kExprI32StoreMem, 2, 0,
+        // Increment result sequence pointer.
+        kExprGetLocal, 1, kExprI32Const, 4, kExprI32Add, kExprSetLocal, 1);
+  }
+  // Return end of sequence index.
+  body.push(kExprGetLocal, 1, kExprReturn);
+  return body;
+}
+
+function getSequence(start, end) {
+  return new Int32Array(
+      gSharedMemory.buffer, start,
+      (end - start) / Int32Array.BYTES_PER_ELEMENT);
+}
+
+function spawnWorkers() {
+  let workers = [];
+  for (let i = 0; i < kNumberOfWorker; i++) {
+    let worker = new Worker(
+        `onmessage = function(msg) {
+            if (msg.module) {
+              let module = msg.module;
+              let mem = msg.mem;
+              this.instance = new WebAssembly.Instance(module, {m: {imported_mem: mem}});
+              postMessage({instantiated: true});
+            } else {
+              let address = msg.address;
+              let sequence = msg.sequence;
+              let index = msg.index;
+              let spin = msg.spin;
+              let result = instance.exports["worker" + index](address, sequence, spin);
+              postMessage({index: index, sequence: sequence, result: result});
+            }
+        }`,
+        {type: 'string'});
+    workers.push(worker);
+  }
+  return workers;
+}
+
+function instantiateModuleInWorkers(workers) {
+  for (let worker of workers) {
+    worker.postMessage({module: module, mem: gSharedMemory});
+    let msg = worker.getMessage();
+    if (!msg.instantiated) throw 'Worker failed to instantiate';
+  }
+}
+
+function executeSequenceInWorkers(workers) {
+  for (i = 0; i < workers.length; i++) {
+    let worker = workers[i];
+    worker.postMessage({
+      index: i,
+      address: 0,
+      spin: 16,
+      sequence: 32 + ((kSequenceLength * 4) + 32) * i
+    });
+    // In debug mode, keep execution sequential.
+    if (kDebug) {
+      let msg = worker.getMessage();
+      results[msg.index] = getSequence(msg.sequence, msg.result);
+    }
+  }
+}
+
+function selectMatchingWorkers(state) {
+  let matching = [];
+  let indices = state.indices;
+  for (let i = 0; i < indices.length; i++) {
+    let index = indices[i];
+    if (index >= kSequenceLength) continue;
+    // We need to project the expected value to the number of bits this
+    // operation will read at runtime.
+    let expected =
+        sequences[i][index].truncateResultBits(state.low, state.high);
+    let hasOutput = sequences[i][index].hasOutput;
+    if (!hasOutput || (results[i][index] == expected)) {
+      matching.push(i);
+    }
+  }
+  return matching;
+}
+
+function computeNextState(state, advanceIdx) {
+  let newIndices = state.indices.slice();
+  let sequence = sequences[advanceIdx];
+  let operation = sequence[state.indices[advanceIdx]];
+  newIndices[advanceIdx]++;
+  let {low, high} = operation.compute(state);
+  return new State(low, high, newIndices, state.count + 1);
+}
+
+function findSequentialOrdering() {
+  let startIndices = new Array(results.length);
+  let steps = 0;
+  startIndices.fill(0);
+  let matchingStates = [new State(0, 0, startIndices, 0)];
+  while (matchingStates.length > 0) {
+    let current = matchingStates.pop();
+    if (kDebug) {
+      print(current);
+    }
+    let matchingResults = selectMatchingWorkers(current);
+    if (matchingResults.length == 0) {
+      continue;
+    }
+    for (let match of matchingResults) {
+      let newState = computeNextState(current, match);
+      if (newState.isFinal()) {
+        return true;
+      }
+      matchingStates.push(newState);
+    }
+    if (steps++ > kNumberOfSteps) {
+      print('Search timed out, aborting...');
+      return true;
+    }
+  }
+  // We have no options left.
+  return false;
+}
+
+// Helpful for debugging failed tests.
+function loadSequencesFromStrings(inputs) {
+  let reverseOpcodes = {};
+  for (let i = 0; i < opCodeNames.length; i++) {
+    reverseOpcodes[opCodeNames[i]] = i;
+  }
+  let sequences = [];
+  let parseRE = /([a-zA-Z0-9]*)\[\+([0-9])\] ([\-0-9]*)/;
+  for (let input of inputs) {
+    let parts = input.split(',');
+    let sequence = [];
+    for (let part of parts) {
+      let parsed = parseRE.exec(part);
+      sequence.push(
+          new Operation(reverseOpcodes[parsed[1]], parsed[3], parsed[2] | 0));
+    }
+    sequences.push(sequence);
+  }
+  return sequences;
+}
+
+// Helpful for debugging failed tests.
+function loadResultsFromStrings(inputs) {
+  let results = [];
+  for (let input of inputs) {
+    let parts = input.split(',');
+    let result = [];
+    for (let number of parts) {
+      result.push(number | 0);
+    }
+    results.push(result);
+  }
+  return results;
+}
+
+let sequences = [];
+let results = [];
+
+let builder = new WasmModuleBuilder();
+builder.addImportedMemory('m', 'imported_mem', 0, kMaxMemPages, 'shared');
+
+for (let i = 0; i < kNumberOfWorker; i++) {
+  sequences[i] = makeSequenceOfOperations(kSequenceLength);
+  builder.addFunction('worker' + i, kSig_i_iii)
+      .addBody(generateFunctionBodyForSequence(sequences[i]))
+      .exportAs('worker' + i);
+}
+
+// Instantiate module, get function exports.
+let module = new WebAssembly.Module(builder.toBuffer());
+let instance =
+    new WebAssembly.Instance(module, {m: {imported_mem: gSharedMemory}});
+
+// Spawn off the workers and run the sequences.
+let workers = spawnWorkers();
+// Set spin count.
+gSharedMemoryView[4] = kNumberOfWorker;
+instantiateModuleInWorkers(workers);
+executeSequenceInWorkers(workers);
+
+if (!kDebug) {
+  // Collect results, d8 style.
+  for (let worker of workers) {
+    let msg = worker.getMessage();
+    results[msg.index] = getSequence(msg.sequence, msg.result);
+  }
+}
+
+// Terminate all workers.
+for (let worker of workers) {
+  worker.terminate();
+}
+
+// In debug mode, print sequences and results.
+if (kDebug) {
+  for (let result of results) {
+    print(result);
+  }
+
+  for (let sequence of sequences) {
+    print(sequence);
+  }
+}
+
+// Try to reconstruct a sequential ordering.
+let passed = findSequentialOrdering();
+
+if (passed) {
+  print('PASS');
+} else {
+  for (let i = 0; i < kNumberOfWorker; i++) {
+    print('Worker ' + i);
+    print(sequences[i]);
+    print(results[i]);
+  }
+  print('FAIL');
+  quit(-1);
+}
diff --git a/src/v8/test/mjsunit/wasm/atomics.js b/src/v8/test/mjsunit/wasm/atomics.js
index 63d8eb0..08714bb 100644
--- a/src/v8/test/mjsunit/wasm/atomics.js
+++ b/src/v8/test/mjsunit/wasm/atomics.js
@@ -4,7 +4,6 @@
 
 // Flags: --experimental-wasm-threads
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 const kMemtypeSize32 = 4;
@@ -145,109 +144,109 @@
 }
 
 (function TestAtomicAdd() {
-  print("TestAtomicAdd");
+  print(arguments.callee.name);
   let wasmAdd = GetAtomicBinOpFunction(kExprI32AtomicAdd, 2, 0);
   Test32Op(Add, wasmAdd);
 })();
 
 (function TestAtomicAdd16U() {
-  print("TestAtomicAdd16U");
+  print(arguments.callee.name);
   let wasmAdd = GetAtomicBinOpFunction(kExprI32AtomicAdd16U, 1, 0);
   Test16Op(Add, wasmAdd);
 })();
 
 (function TestAtomicAdd8U() {
-  print("TestAtomicAdd8U");
+  print(arguments.callee.name);
   let wasmAdd = GetAtomicBinOpFunction(kExprI32AtomicAdd8U, 0, 0);
   Test8Op(Add, wasmAdd);
 })();
 
 (function TestAtomicSub() {
-  print("TestAtomicSub");
+  print(arguments.callee.name);
   let wasmSub = GetAtomicBinOpFunction(kExprI32AtomicSub, 2, 0);
   Test32Op(Sub, wasmSub);
 })();
 
 (function TestAtomicSub16U() {
-  print("TestAtomicSub16U");
+  print(arguments.callee.name);
   let wasmSub = GetAtomicBinOpFunction(kExprI32AtomicSub16U, 1, 0);
   Test16Op(Sub, wasmSub);
 })();
 
 (function TestAtomicSub8U() {
-  print("TestAtomicSub8U");
+  print(arguments.callee.name);
   let wasmSub = GetAtomicBinOpFunction(kExprI32AtomicSub8U, 0, 0);
   Test8Op(Sub, wasmSub);
 })();
 
 (function TestAtomicAnd() {
-  print("TestAtomicAnd");
+  print(arguments.callee.name);
   let wasmAnd = GetAtomicBinOpFunction(kExprI32AtomicAnd, 2, 0);
   Test32Op(And, wasmAnd);
 })();
 
 (function TestAtomicAnd16U() {
-  print("TestAtomicAnd16U");
+  print(arguments.callee.name);
   let wasmAnd = GetAtomicBinOpFunction(kExprI32AtomicAnd16U, 1, 0);
   Test16Op(And, wasmAnd);
 })();
 
 (function TestAtomicAnd8U() {
-  print("TestAtomicAnd8U");
+  print(arguments.callee.name);
   let wasmAnd = GetAtomicBinOpFunction(kExprI32AtomicAnd8U, 0, 0);
   Test8Op(And, wasmAnd);
 })();
 
 (function TestAtomicOr() {
-  print("TestAtomicOr");
+  print(arguments.callee.name);
   let wasmOr = GetAtomicBinOpFunction(kExprI32AtomicOr, 2, 0);
   Test32Op(Or, wasmOr);
 })();
 
 (function TestAtomicOr16U() {
-  print("TestAtomicOr16U");
+  print(arguments.callee.name);
   let wasmOr = GetAtomicBinOpFunction(kExprI32AtomicOr16U, 1, 0);
   Test16Op(Or, wasmOr);
 })();
 
 (function TestAtomicOr8U() {
-  print("TestAtomicOr8U");
+  print(arguments.callee.name);
   let wasmOr = GetAtomicBinOpFunction(kExprI32AtomicOr8U, 0, 0);
   Test8Op(Or, wasmOr);
 })();
 
 (function TestAtomicXor() {
-  print("TestAtomicXor");
+  print(arguments.callee.name);
   let wasmXor = GetAtomicBinOpFunction(kExprI32AtomicXor, 2, 0);
   Test32Op(Xor, wasmXor);
 })();
 
 (function TestAtomicXor16U() {
-  print("TestAtomicXor16U");
+  print(arguments.callee.name);
   let wasmXor = GetAtomicBinOpFunction(kExprI32AtomicXor16U, 1, 0);
   Test16Op(Xor, wasmXor);
 })();
 
 (function TestAtomicXor8U() {
-  print("TestAtomicXor8U");
+  print(arguments.callee.name);
   let wasmXor = GetAtomicBinOpFunction(kExprI32AtomicXor8U, 0, 0);
   Test8Op(Xor, wasmXor);
 })();
 
 (function TestAtomicExchange() {
-  print("TestAtomicExchange");
+  print(arguments.callee.name);
   let wasmExchange = GetAtomicBinOpFunction(kExprI32AtomicExchange, 2, 0);
   Test32Op(Exchange, wasmExchange);
 })();
 
 (function TestAtomicExchange16U() {
-  print("TestAtomicExchange16U");
+  print(arguments.callee.name);
   let wasmExchange = GetAtomicBinOpFunction(kExprI32AtomicExchange16U, 1, 0);
   Test16Op(Exchange, wasmExchange);
 })();
 
 (function TestAtomicExchange8U() {
-  print("TestAtomicExchange8U");
+  print(arguments.callee.name);
   let wasmExchange = GetAtomicBinOpFunction(kExprI32AtomicExchange8U, 0, 0);
   Test8Op(Exchange, wasmExchange);
 })();
@@ -268,7 +267,7 @@
 }
 
 (function TestAtomicCompareExchange() {
-  print("TestAtomicCompareExchange");
+  print(arguments.callee.name);
   let wasmCmpExchange =
       GetAtomicCmpExchangeFunction(kExprI32AtomicCompareExchange, 2, 0);
   let i32 = new Uint32Array(memory.buffer);
@@ -277,7 +276,7 @@
 })();
 
 (function TestAtomicCompareExchange16U() {
-  print("TestAtomicCompareExchange16U");
+  print(arguments.callee.name);
   let wasmCmpExchange =
       GetAtomicCmpExchangeFunction(kExprI32AtomicCompareExchange16U, 1, 0);
   let i16 = new Uint16Array(memory.buffer);
@@ -286,7 +285,7 @@
 })();
 
 (function TestAtomicCompareExchange8U() {
-  print("TestAtomicCompareExchange8U");
+  print(arguments.callee.name);
   let wasmCmpExchange =
       GetAtomicCmpExchangeFunction(kExprI32AtomicCompareExchange8U, 0, 0);
   let i8 = new Uint8Array(memory.buffer);
@@ -303,7 +302,7 @@
 }
 
 (function TestAtomicLoad() {
-  print("TestAtomicLoad");
+  print(arguments.callee.name);
   let wasmLoad = GetAtomicLoadFunction(kExprI32AtomicLoad, 2, 0);
   let i32 = new Uint32Array(memory.buffer);
   let value = 0xacedaced;
@@ -311,7 +310,7 @@
 })();
 
 (function TestAtomicLoad16U() {
-  print("TestAtomicLoad16U");
+  print(arguments.callee.name);
   let wasmLoad = GetAtomicLoadFunction(kExprI32AtomicLoad16U, 1, 0);
   let i16 = new Uint16Array(memory.buffer);
   let value = 0xaced;
@@ -319,7 +318,7 @@
 })();
 
 (function TestAtomicLoad8U() {
-  print("TestAtomicLoad8U");
+  print(arguments.callee.name);
   let wasmLoad = GetAtomicLoadFunction(kExprI32AtomicLoad8U, 0, 0);
   let i8 = new Uint8Array(memory.buffer);
   let value = 0xac;
@@ -335,7 +334,7 @@
 }
 
 (function TestAtomicStore() {
-  print("TestAtomicStore");
+  print(arguments.callee.name);
   let wasmStore = GetAtomicStoreFunction(kExprI32AtomicStore, 2, 0);
   let i32 = new Uint32Array(memory.buffer);
   let value = 0xacedaced;
@@ -343,7 +342,7 @@
 })();
 
 (function TestAtomicStore16U() {
-  print("TestAtomicStore16U");
+  print(arguments.callee.name);
   let wasmStore = GetAtomicStoreFunction(kExprI32AtomicStore16U, 1, 0);
   let i16 = new Uint16Array(memory.buffer);
   let value = 0xaced;
@@ -351,7 +350,7 @@
 })();
 
 (function TestAtomicStore8U() {
-  print("TestAtomicStore8U");
+  print(arguments.callee.name);
   let wasmStore = GetAtomicStoreFunction(kExprI32AtomicStore8U, 0, 0);
   let i8 = new Uint8Array(memory.buffer);
   let value = 0xac;
@@ -359,7 +358,7 @@
 })();
 
 (function TestAtomicLoadStoreOffset() {
-  print("TestAtomicLoadStoreOffset");
+  print(arguments.callee.name);
   var builder = new WasmModuleBuilder();
   let memory = new WebAssembly.Memory({
     initial: 16, maximum: 128, shared: true});
@@ -390,7 +389,7 @@
 })();
 
 (function TestAtomicOpinLoop() {
-  print("TestAtomicOpinLoop");
+  print(arguments.callee.name);
   var builder = new WasmModuleBuilder();
   let memory = new WebAssembly.Memory({
     initial: 16, maximum: 128, shared: true});
@@ -415,3 +414,50 @@
         {m: {imported_mem: memory}}));
   assertEquals(20, instance.exports.main());
 })();
+
+(function TestUnalignedAtomicAccesses() {
+  print(arguments.callee.name);
+  let wasmAdd = GetAtomicBinOpFunction(kExprI32AtomicAdd, 2, 17);
+  assertTraps(kTrapUnalignedAccess, () => wasmAdd(4, 1001));
+  let wasmLoad = GetAtomicLoadFunction(kExprI32AtomicLoad16U, 1, 0);
+  assertTraps(kTrapUnalignedAccess, () => wasmLoad(15));
+  let wasmStore = GetAtomicStoreFunction(kExprI32AtomicStore, 2, 0);
+  assertTraps(kTrapUnalignedAccess, () => wasmStore(22, 5));
+  let wasmCmpExchange =
+      GetAtomicCmpExchangeFunction(kExprI32AtomicCompareExchange, 2, 0x16);
+  assertTraps(kTrapUnalignedAccess, () => wasmCmpExchange(11, 6, 5));
+
+  // Building functions with bad alignment should fail to compile
+  assertThrows(() => GetAtomicBinOpFunction(kExprI32AtomicSub16U, 3, 0),
+      WebAssembly.CompileError);
+})();
+
+function CmpExchgLoop(opcode, alignment) {
+  print("TestI64AtomicCompareExchangeLoop" + alignment);
+  let builder = new WasmModuleBuilder();
+  builder.addImportedMemory("m", "imported_mem", 0, 2, "shared");
+  builder.addFunction("main", makeSig([kWasmI32], []))
+      .addLocals({i64_count: 2})
+      .addBody([
+        kExprLoop, kWasmStmt,
+          kExprGetLocal, 0,
+          kExprGetLocal, 1,
+          kExprGetLocal, 2,
+          kAtomicPrefix, opcode, alignment, 0,
+          kExprGetLocal, 1,
+          kExprI64Ne,
+          kExprBrIf, 0,
+          kExprEnd
+      ])
+      .exportFunc();
+  let mem = new WebAssembly.Memory({initial: 2, maximum: 2, shared: true});
+  let module = new WebAssembly.Module(builder.toBuffer());
+  let instance = new WebAssembly.Instance(module, {m: {imported_mem: mem}});
+}
+
+(function TestAtomicCompareExchgLoop() {
+  CmpExchgLoop(kExprI64AtomicCompareExchange, 3);
+  CmpExchgLoop(kExprI64AtomicCompareExchange32U, 2);
+  CmpExchgLoop(kExprI64AtomicCompareExchange16U, 1);
+  CmpExchgLoop(kExprI64AtomicCompareExchange8U, 0);
+})();
diff --git a/src/v8/test/mjsunit/wasm/atomics64-stress.js b/src/v8/test/mjsunit/wasm/atomics64-stress.js
new file mode 100644
index 0000000..386a3b5
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/atomics64-stress.js
@@ -0,0 +1,549 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-threads
+
+// This test might time out if the search space for a sequential
+// interleaving becomes to large. However, it should never fail.
+// Note that results of this test are flaky by design. While the test is
+// deterministic with a fixed seed, bugs may introduce non-determinism.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const kDebug = false;
+
+const kSequenceLength = 256;
+const kNumberOfWorker = 4;
+const kNumberOfSteps = 10000000;
+
+const kFirstOpcodeWithInput = 4;
+const kFirstOpcodeWithoutOutput = 4;
+const kLastOpcodeWithoutOutput = 7;
+
+const opCodes = [
+  kExprI64AtomicLoad,        kExprI64AtomicLoad8U,     kExprI64AtomicLoad16U,
+  kExprI64AtomicLoad32U,     kExprI64AtomicStore,      kExprI64AtomicStore8U,
+  kExprI64AtomicStore16U,    kExprI64AtomicStore32U,   kExprI64AtomicAdd,
+  kExprI64AtomicAdd8U,       kExprI64AtomicAdd16U,     kExprI64AtomicAdd32U,
+  kExprI64AtomicSub,         kExprI64AtomicSub8U,      kExprI64AtomicSub16U,
+  kExprI64AtomicSub32U,      kExprI64AtomicAnd,        kExprI64AtomicAnd8U,
+  kExprI64AtomicAnd16U,      kExprI64AtomicAnd32U,     kExprI64AtomicOr,
+  kExprI64AtomicOr8U,        kExprI64AtomicOr16U,      kExprI64AtomicOr32U,
+  kExprI64AtomicXor,         kExprI64AtomicXor8U,      kExprI64AtomicXor16U,
+  kExprI64AtomicXor32U,      kExprI64AtomicExchange,   kExprI64AtomicExchange8U,
+  kExprI64AtomicExchange16U, kExprI64AtomicExchange32U
+];
+
+const opCodeNames = [
+  'kExprI64AtomicLoad',        'kExprI64AtomicLoad8U',
+  'kExprI64AtomicLoad16U',     'kExprI64AtomicLoad32U',
+  'kExprI64AtomicStore',       'kExprI64AtomicStore8U',
+  'kExprI64AtomicStore16U',    'kExprI64AtomicStore32U',
+  'kExprI64AtomicAdd',         'kExprI64AtomicAdd8U',
+  'kExprI64AtomicAdd16U',      'kExprI64AtomicAdd32U',
+  'kExprI64AtomicSub',         'kExprI64AtomicSub8U',
+  'kExprI64AtomicSub16U',      'kExprI64AtomicSub32U',
+  'kExprI64AtomicAnd',         'kExprI64AtomicAnd8U',
+  'kExprI64AtomicAnd16U',      'kExprI64AtomicAnd32U',
+  'kExprI64AtomicOr',          'kExprI64AtomicOr8U',
+  'kExprI64AtomicOr16U',       'kExprI64AtomicOr32U',
+  'kExprI64AtomicXor',         'kExprI64AtomicXor8U',
+  'kExprI64AtomicXor16U',      'kExprI64AtomicXor32U',
+  'kExprI64AtomicExchange',    'kExprI64AtomicExchange8U',
+  'kExprI64AtomicExchange16U', 'kExprI64AtomicExchange32U'
+];
+
+let kMaxMemPages = 10;
+let gSharedMemory =
+    new WebAssembly.Memory({initial: 1, maximum: kMaxMemPages, shared: true});
+let gSharedMemoryView = new Int32Array(gSharedMemory.buffer);
+
+let gPrivateMemory =
+    new WebAssembly.Memory({initial: 1, maximum: kMaxMemPages, shared: true});
+let gPrivateMemoryView = new Int32Array(gPrivateMemory.buffer);
+
+const kMaxInt32 = (1 << 31) * 2;
+
+class Operation {
+  constructor(opcode, low_input, high_input, offset) {
+    this.opcode = opcode != undefined ? opcode : Operation.nextOpcode();
+    this.size = Operation.opcodeToSize(this.opcode);
+    if (low_input == undefined) {
+      [low_input, high_input] = Operation.inputForSize(this.size);
+    }
+    this.low_input = low_input;
+    this.high_input = high_input;
+    this.offset =
+        offset != undefined ? offset : Operation.offsetForSize(this.size);
+  }
+
+  static nextOpcode() {
+    let random = Math.random();
+    return Math.floor(random * opCodes.length);
+  }
+
+  static opcodeToSize(opcode) {
+    // Instructions are ordered in 64, 8, 16, 32 bits size
+    return [64, 8, 16, 32][opcode % 4];
+  }
+
+  static opcodeToAlignment(opcode) {
+    // Instructions are ordered in 64, 8, 16, 32 bits size
+    return [3, 0, 1, 2][opcode % 4];
+  }
+
+  static inputForSize(size) {
+    if (size <= 32) {
+      let random = Math.random();
+      // Avoid 32 bit overflow for integer here :(
+      return [Math.floor(random * (1 << (size - 1)) * 2), 0];
+    }
+    return [
+      Math.floor(Math.random() * kMaxInt32),
+      Math.floor(Math.random() * kMaxInt32)
+    ];
+  }
+
+  static offsetForSize(size) {
+    // Pick an offset in bytes between 0 and 8.
+    let offset = Math.floor(Math.random() * 8);
+    // Make sure the offset matches the required alignment by masking out the
+    // lower bits.
+    let size_in_bytes = size / 8;
+    let mask = ~(size_in_bytes - 1);
+    return offset & mask;
+  }
+
+  get wasmOpcode() {
+    // [opcode, alignment, offset]
+    return [
+      opCodes[this.opcode], Operation.opcodeToAlignment(this.opcode),
+      this.offset
+    ];
+  }
+
+  get hasInput() {
+    return this.opcode >= kFirstOpcodeWithInput;
+  }
+
+  get hasOutput() {
+    return this.opcode < kFirstOpcodeWithoutOutput ||
+        this.opcode > kLastOpcodeWithoutOutput;
+  }
+
+  truncateResultBits(low, high) {
+    if (this.size == 64)
+      return [low, high]
+
+          // Shift the lower part. For offsets greater four it drops out of the
+          // visible window.
+          let shiftedL = this.offset >= 4 ? 0 : low >>> (this.offset * 8);
+    // The higher part is zero for offset 0, left shifted for [1..3] and right
+    // shifted for [4..7].
+    let shiftedH = this.offset == 0 ?
+        0 :
+        this.offset >= 4 ? high >>> (this.offset - 4) * 8 :
+                           high << ((4 - this.offset) * 8);
+    let value = shiftedL | shiftedH;
+
+    switch (this.size) {
+      case 8:
+        return [value & 0xFF, 0];
+      case 16:
+        return [value & 0xFFFF, 0];
+      case 32:
+        return [value, 0];
+      default:
+        throw 'Unexpected size: ' + this.size;
+    }
+  }
+
+  static get builder() {
+    if (!Operation.__builder) {
+      let builder = new WasmModuleBuilder();
+      builder.addImportedMemory('m', 'imported_mem', 0, kMaxMemPages, 'shared');
+      Operation.__builder = builder;
+    }
+    return Operation.__builder;
+  }
+
+  static get exports() {
+    if (!Operation.__instance) {
+      return {};
+    }
+    return Operation.__instance.exports;
+  }
+
+  static get memory() {
+    return Operation.exports.mem;
+  }
+
+  static set instance(instance) {
+    Operation.__instance = instance;
+  }
+
+  compute(state) {
+    let evalFun = Operation.exports[this.key];
+    if (!evalFun) {
+      let builder = Operation.builder;
+      let body = [
+        // Load address of low 32 bits.
+        kExprI32Const, 0,
+        // Load expected value.
+        kExprGetLocal, 0, kExprI32StoreMem, 2, 0,
+        // Load address of high 32 bits.
+        kExprI32Const, 4,
+        // Load expected value.
+        kExprGetLocal, 1, kExprI32StoreMem, 2, 0,
+        // Load address of where our window starts.
+        kExprI32Const, 0,
+        // Load input if there is one.
+        ...(this.hasInput ?
+                [
+                  kExprGetLocal, 3, kExprI64UConvertI32, kExprI64Const, 32,
+                  kExprI64Shl, kExprGetLocal, 2, kExprI64UConvertI32,
+                  kExprI64Ior
+                ] :
+                []),
+        // Perform operation.
+        kAtomicPrefix, ...this.wasmOpcode,
+        // Drop output if it had any.
+        ...(this.hasOutput ? [kExprDrop] : []),
+        // Return.
+        kExprReturn
+      ]
+      builder.addFunction(this.key, kSig_v_iiii)
+          .addBody(body)
+          .exportAs(this.key);
+      // Instantiate module, get function exports.
+      let module = new WebAssembly.Module(builder.toBuffer());
+      Operation.instance =
+          new WebAssembly.Instance(module, {m: {imported_mem: gPrivateMemory}});
+      evalFun = Operation.exports[this.key];
+    }
+    evalFun(state.low, state.high, this.low_input, this.high_input);
+    let ta = gPrivateMemoryView;
+    if (kDebug) {
+      print(
+          state.high + ':' + state.low + ' ' + this.toString() + ' -> ' +
+          ta[1] + ':' + ta[0]);
+    }
+    return {low: ta[0], high: ta[1]};
+  }
+
+  toString() {
+    return opCodeNames[this.opcode] + '[+' + this.offset + '] ' +
+        this.high_input + ':' + this.low_input;
+  }
+
+  get key() {
+    return this.opcode + '-' + this.offset;
+  }
+}
+
+class State {
+  constructor(low, high, indices, count) {
+    this.low = low;
+    this.high = high;
+    this.indices = indices;
+    this.count = count;
+  }
+
+  isFinal() {
+    return (this.count == kNumberOfWorker * kSequenceLength);
+  }
+
+  toString() {
+    return this.high + ':' + this.low + ' @ ' + this.indices;
+  }
+}
+
+function makeSequenceOfOperations(size) {
+  let result = new Array(size);
+  for (let i = 0; i < size; i++) {
+    result[i] = new Operation();
+  }
+  return result;
+}
+
+function toSLeb128(low, high) {
+  let result = [];
+  while (true) {
+    let v = low & 0x7f;
+    // For low, fill up with zeros, high will add extra bits.
+    low = low >>> 7;
+    if (high != 0) {
+      let shiftIn = high << (32 - 7);
+      low = low | shiftIn;
+      // For high, fill up with ones, so that we keep trailing one.
+      high = high >> 7;
+    }
+    let msbIsSet = (v & 0x40) || false;
+    if (((low == 0) && (high == 0) && !msbIsSet) ||
+        ((low == -1) && (high == -1) && msbIsSet)) {
+      result.push(v);
+      break;
+    }
+    result.push(v | 0x80);
+  }
+  return result;
+}
+
+function generateFunctionBodyForSequence(sequence) {
+  // We expect the int64* to perform ops on as arg 0 and
+  // the int64* for our value log as arg1. Argument 2 gives
+  // an int32* we use to count down spinning workers.
+  let body = [];
+  // Initially, we spin until all workers start running.
+  if (!kDebug) {
+    body.push(
+        // Decrement the wait count.
+        kExprGetLocal, 2, kExprI32Const, 1, kAtomicPrefix, kExprI32AtomicSub, 2,
+        0,
+        // Spin until zero.
+        kExprLoop, kWasmStmt, kExprGetLocal, 2, kAtomicPrefix,
+        kExprI32AtomicLoad, 2, 0, kExprI32Const, 0, kExprI32GtU, kExprBrIf, 0,
+        kExprEnd);
+  }
+  for (let operation of sequence) {
+    body.push(
+        // Pre-load address of results sequence pointer for later.
+        kExprGetLocal, 1,
+        // Load address where atomic pointers are stored.
+        kExprGetLocal, 0,
+        // Load the second argument if it had any.
+        ...(operation.hasInput ?
+                [
+                  kExprI64Const,
+                  ...toSLeb128(operation.low_input, operation.high_input)
+                ] :
+                []),
+        // Perform operation
+        kAtomicPrefix, ...operation.wasmOpcode,
+        // Generate fake output in needed.
+        ...(operation.hasOutput ? [] : [kExprI64Const, 0]),
+        // Store read intermediate to sequence.
+        kExprI64StoreMem, 3, 0,
+        // Increment result sequence pointer.
+        kExprGetLocal, 1, kExprI32Const, 8, kExprI32Add, kExprSetLocal, 1);
+  }
+  // Return end of sequence index.
+  body.push(kExprGetLocal, 1, kExprReturn);
+  return body;
+}
+
+function getSequence(start, end) {
+  return new Int32Array(
+      gSharedMemory.buffer, start,
+      (end - start) / Int32Array.BYTES_PER_ELEMENT);
+}
+
+function spawnWorkers() {
+  let workers = [];
+  for (let i = 0; i < kNumberOfWorker; i++) {
+    let worker = new Worker(
+        `onmessage = function(msg) {
+            if (msg.module) {
+              let module = msg.module;
+              let mem = msg.mem;
+              this.instance = new WebAssembly.Instance(module, {m: {imported_mem: mem}});
+              postMessage({instantiated: true});
+            } else {
+              let address = msg.address;
+              let sequence = msg.sequence;
+              let index = msg.index;
+              let spin = msg.spin;
+              let result = instance.exports["worker" + index](address, sequence, spin);
+              postMessage({index: index, sequence: sequence, result: result});
+            }
+        }`,
+        {type: 'string'});
+    workers.push(worker);
+  }
+  return workers;
+}
+
+function instantiateModuleInWorkers(workers) {
+  for (let worker of workers) {
+    worker.postMessage({module: module, mem: gSharedMemory});
+    let msg = worker.getMessage();
+    if (!msg.instantiated) throw 'Worker failed to instantiate';
+  }
+}
+
+function executeSequenceInWorkers(workers) {
+  for (i = 0; i < workers.length; i++) {
+    let worker = workers[i];
+    worker.postMessage({
+      index: i,
+      address: 0,
+      spin: 16,
+      sequence: 32 + ((kSequenceLength * 8) + 32) * i
+    });
+    // In debug mode, keep execution sequential.
+    if (kDebug) {
+      let msg = worker.getMessage();
+      results[msg.index] = getSequence(msg.sequence, msg.result);
+    }
+  }
+}
+
+function selectMatchingWorkers(state) {
+  let matching = [];
+  let indices = state.indices;
+  for (let i = 0; i < indices.length; i++) {
+    let index = indices[i];
+    if (index >= kSequenceLength) continue;
+    // We need to project the expected value to the number of bits this
+    // operation will read at runtime.
+    let [expected_low, expected_high] =
+        sequences[i][index].truncateResultBits(state.low, state.high);
+    let hasOutput = sequences[i][index].hasOutput;
+    if (!hasOutput ||
+        ((results[i][index * 2] == expected_low) &&
+         (results[i][index * 2 + 1] == expected_high))) {
+      matching.push(i);
+    }
+  }
+  return matching;
+}
+
+function computeNextState(state, advanceIdx) {
+  let newIndices = state.indices.slice();
+  let sequence = sequences[advanceIdx];
+  let operation = sequence[state.indices[advanceIdx]];
+  newIndices[advanceIdx]++;
+  let {low, high} = operation.compute(state);
+
+  return new State(low, high, newIndices, state.count + 1);
+}
+
+function findSequentialOrdering() {
+  let startIndices = new Array(results.length);
+  let steps = 0;
+  startIndices.fill(0);
+  let matchingStates = [new State(0, 0, startIndices, 0)];
+  while (matchingStates.length > 0) {
+    let current = matchingStates.pop();
+    if (kDebug) {
+      print(current);
+    }
+    let matchingResults = selectMatchingWorkers(current);
+    if (matchingResults.length == 0) {
+      continue;
+    }
+    for (let match of matchingResults) {
+      let newState = computeNextState(current, match);
+      if (newState.isFinal()) {
+        return true;
+      }
+      matchingStates.push(newState);
+    }
+    if (steps++ > kNumberOfSteps) {
+      print('Search timed out, aborting...');
+      return true;
+    }
+  }
+  // We have no options left.
+  return false;
+}
+
+// Helpful for debugging failed tests.
+function loadSequencesFromStrings(inputs) {
+  let reverseOpcodes = {};
+  for (let i = 0; i < opCodeNames.length; i++) {
+    reverseOpcodes[opCodeNames[i]] = i;
+  }
+  let sequences = [];
+  let parseRE = /([a-zA-Z0-9]*)\[\+([0-9])\] ([\-0-9]*)/;
+  for (let input of inputs) {
+    let parts = input.split(',');
+    let sequence = [];
+    for (let part of parts) {
+      let parsed = parseRE.exec(part);
+      sequence.push(
+          new Operation(reverseOpcodes[parsed[1]], parsed[3], parsed[2] | 0));
+    }
+    sequences.push(sequence);
+  }
+  return sequences;
+}
+
+// Helpful for debugging failed tests.
+function loadResultsFromStrings(inputs) {
+  let results = [];
+  for (let input of inputs) {
+    let parts = input.split(',');
+    let result = [];
+    for (let number of parts) {
+      result.push(number | 0);
+    }
+    results.push(result);
+  }
+  return results;
+}
+
+let sequences = [];
+let results = [];
+
+let builder = new WasmModuleBuilder();
+builder.addImportedMemory('m', 'imported_mem', 0, kMaxMemPages, 'shared');
+
+for (let i = 0; i < kNumberOfWorker; i++) {
+  sequences[i] = makeSequenceOfOperations(kSequenceLength);
+  builder.addFunction('worker' + i, kSig_i_iii)
+      .addBody(generateFunctionBodyForSequence(sequences[i]))
+      .exportAs('worker' + i);
+}
+
+// Instantiate module, get function exports.
+let module = new WebAssembly.Module(builder.toBuffer());
+let instance =
+    new WebAssembly.Instance(module, {m: {imported_mem: gSharedMemory}});
+
+// Spawn off the workers and run the sequences.
+let workers = spawnWorkers();
+// Set spin count.
+gSharedMemoryView[4] = kNumberOfWorker;
+instantiateModuleInWorkers(workers);
+executeSequenceInWorkers(workers);
+
+if (!kDebug) {
+  // Collect results, d8 style.
+  for (let worker of workers) {
+    let msg = worker.getMessage();
+    results[msg.index] = getSequence(msg.sequence, msg.result);
+  }
+}
+
+// Terminate all workers.
+for (let worker of workers) {
+  worker.terminate();
+}
+
+// In debug mode, print sequences and results.
+if (kDebug) {
+  for (let result of results) {
+    print(result);
+  }
+
+  for (let sequence of sequences) {
+    print(sequence);
+  }
+}
+
+// Try to reconstruct a sequential ordering.
+let passed = findSequentialOrdering();
+
+if (passed) {
+  print('PASS');
+} else {
+  for (let i = 0; i < kNumberOfWorker; i++) {
+    print('Worker ' + i);
+    print(sequences[i]);
+    print(results[i]);
+  }
+  print('FAIL');
+  quit(-1);
+}
diff --git a/src/v8/test/mjsunit/wasm/bigint-i64-to-imported-js-func.js b/src/v8/test/mjsunit/wasm/bigint-i64-to-imported-js-func.js
new file mode 100644
index 0000000..2fa48d9
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/bigint-i64-to-imported-js-func.js
@@ -0,0 +1,39 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-bigint
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function TestWasmI64ToJSBigIntImportedFunc() {
+  var builder = new WasmModuleBuilder();
+
+  var a_index = builder
+    .addImport("a", "a", kSig_l_l) // i64 -> i64
+
+  builder
+    .addFunction("fn", kSig_l_v) // () -> i64
+    .addBody([
+      kExprI64Const, 0x7,
+      kExprCallFunction, a_index
+    ])
+    .exportFunc();
+
+  a_was_called = false;
+
+  var module = builder.instantiate({
+    a: {
+      a(param) {
+        assertEquals(typeof param, "bigint");
+        assertEquals(param, 7n);
+        a_was_called = true;
+        return 12n;
+      },
+    }
+  });
+
+  assertEquals(module.exports.fn(), 12n);
+
+  assertTrue(a_was_called);
+})();
diff --git a/src/v8/test/mjsunit/wasm/bigint.js b/src/v8/test/mjsunit/wasm/bigint.js
new file mode 100644
index 0000000..d64c0e0
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/bigint.js
@@ -0,0 +1,174 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-bigint
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function TestWasmI64ToJSBigInt() {
+  var builder = new WasmModuleBuilder();
+
+  builder
+    .addFunction("fn", kSig_l_v) // () -> i64
+    .addBody([
+      kExprI64Const, 0x3,
+    ])
+    .exportFunc();
+
+  var module = builder.instantiate();
+
+  assertEquals(typeof module.exports.fn(), "bigint");
+  assertEquals(module.exports.fn(), 3n);
+})();
+
+(function TestJSBigIntToWasmI64Global() {
+  var builder = new WasmModuleBuilder();
+
+  var a_global_index = builder
+    .addImportedGlobal("mod", "a", kWasmI64)
+
+  var b_global_index = builder
+    .addImportedGlobal("mod", "b", kWasmI64);
+
+  var c_global_index = builder
+    .addImportedGlobal("mod", "c", kWasmI64);
+
+  builder
+    .addExportOfKind('a', kExternalGlobal, a_global_index)
+    .addExportOfKind('b', kExternalGlobal, b_global_index)
+    .addExportOfKind('c', kExternalGlobal, c_global_index);
+
+  var module = builder.instantiate({
+    mod: {
+      a: 1n,
+      b: 2n ** 63n,
+      c: "123",
+    }
+  });
+
+  assertEquals(module.exports.a.value, 1n);
+  assertEquals(module.exports.b.value, - (2n ** 63n));
+  assertEquals(module.exports.c.value, 123n);
+})();
+
+(function TestJSBigIntToWasmI64MutableGlobal() {
+  var builder = new WasmModuleBuilder();
+
+  var a_global_index = builder
+    .addImportedGlobal("mod", "a", kWasmI64, /* mutable = */ true)
+
+  builder
+    .addExportOfKind('a', kExternalGlobal, a_global_index);
+
+  // as non object
+  var fn = () => builder.instantiate({
+    mod: {
+      a: 1n,
+    }
+  });
+
+  assertThrows(fn, WebAssembly.LinkError);
+
+  // as WebAssembly.Global object
+  var module = builder.instantiate({
+    mod: {
+      a: new WebAssembly.Global({ value: "i64", mutable: true }, 1n),
+    }
+  });
+
+  assertEquals(module.exports.a.value, 1n);
+})();
+
+(function TestJSBigIntToWasmI64Identity() {
+  var builder = new WasmModuleBuilder();
+
+  builder
+    .addFunction("f", kSig_l_l) // i64 -> i64
+    .addBody([
+      kExprGetLocal, 0x0,
+    ])
+    .exportFunc();
+
+  var module = builder.instantiate();
+  var f = module.exports.f;
+
+  assertEquals(f(0n), 0n);
+  assertEquals(f(-0n), -0n);
+  assertEquals(f(123n), 123n);
+  assertEquals(f(-123n), -123n);
+
+  assertEquals(f("5"), 5n);
+
+  assertThrows(() => f(5), TypeError);
+})();
+
+(function TestI64Global() {
+  var argument = { "value": "i64", "mutable": true };
+  var global = new WebAssembly.Global(argument);
+
+  assertEquals(global.value, 0n); // initial value
+
+  global.value = 123n;
+  assertEquals(global.valueOf(), 123n);
+
+  global.value = 2n ** 63n;
+  assertEquals(global.valueOf(), - (2n ** 63n));
+})();
+
+(function TestI64GlobalValueOf() {
+  var argument = { "value": "i64" };
+
+  // as literal
+  var global = new WebAssembly.Global(argument, {
+    valueOf() {
+      return 123n;
+    }
+  });
+  assertEquals(global.value, 123n);
+
+  // as string
+  var global2 = new WebAssembly.Global(argument, {
+    valueOf() {
+      return "321";
+    }
+  });
+  assertEquals(global2.value, 321n);
+})();
+
+(function TestInvalidValtypeGlobalErrorMessage() {
+  var argument = { "value": "some string" };
+  assertThrows(() => new WebAssembly.Global(argument), TypeError);
+
+  try {
+    new WebAssembly.Global(argument);
+  } catch (e) {
+    assertContains("'value' must be", e.message);
+    assertContains("i64", e.message);
+  }
+})();
+
+(function TestGlobalI64ValueWrongType() {
+  var argument = { "value": "i64" };
+  assertThrows(() => new WebAssembly.Global(argument, 666), TypeError);
+})();
+
+(function TestGlobalI64SetWrongType() {
+  var argument = { "value": "i64", "mutable": true };
+  var global = new WebAssembly.Global(argument);
+
+  assertThrows(() => global.value = 1, TypeError);
+})();
+
+(function TestFuncParamF64PassingBigInt() {
+  var builder = new WasmModuleBuilder();
+
+  builder
+      .addFunction("f", kSig_v_d) // f64 -> ()
+      .addBody([])
+      .exportFunc();
+
+  var module = builder.instantiate();
+
+  assertThrows(() => module.exports.f(123n), TypeError);
+})();
diff --git a/src/v8/test/mjsunit/wasm/bounds-check-64bit.js b/src/v8/test/mjsunit/wasm/bounds-check-64bit.js
index 8643093..43ff857 100644
--- a/src/v8/test/mjsunit/wasm/bounds-check-64bit.js
+++ b/src/v8/test/mjsunit/wasm/bounds-check-64bit.js
@@ -2,11 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 const builder = new WasmModuleBuilder();
-builder.addMemory(1, kV8MaxPages, false);
+builder.addMemory(1, undefined, false);
 builder.addFunction('load', kSig_i_ii)
     .addBody([
         kExprGetLocal, 0,
@@ -21,13 +20,14 @@
 const module = builder.instantiate();
 let start = 12;
 let address = start;
-for (i = 1; i < 64; i++) {
+for (i = 0; i < 64; i++) {
   // This is the address which will be accessed in the code. We cannot use
   // shifts to calculate the address because JS shifts work on 32-bit integers.
-  address = (address * 2) % 4294967296;
+  print(`address=${address}`);
   if (address < kPageSize) {
     assertEquals(0, module.exports.load(start, i));
   } else {
     assertTraps(kTrapMemOutOfBounds, _ => { module.exports.load(start, i);});
   }
+  address = (address * 2) % 4294967296;
 }
diff --git a/src/v8/test/mjsunit/wasm/bounds-check-turbofan.js b/src/v8/test/mjsunit/wasm/bounds-check-turbofan.js
new file mode 100644
index 0000000..d972e78
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/bounds-check-turbofan.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(1, undefined, false);
+builder.addFunction('load', kSig_i_i)
+    .addBody([
+        kExprGetLocal, 0,
+    kExprI32LoadMem, 0, 100])
+    .exportFunc();
+
+const module = builder.instantiate();
+%WasmTierUpFunction(module, 0);
+// 100 is added as part of the load instruction above
+// Last valid address (64k - 100 - 4)
+assertEquals(0, module.exports.load(0x10000 - 100 - 4));
+// First invalid address (64k - 100)
+assertTraps(kTrapMemOutOfBounds, _ => { module.exports.load(0x10000 - 100);});
diff --git a/src/v8/test/mjsunit/wasm/bulk-memory.js b/src/v8/test/mjsunit/wasm/bulk-memory.js
new file mode 100644
index 0000000..d783c6b
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/bulk-memory.js
@@ -0,0 +1,233 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-bulk-memory
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function TestPassiveDataSegment() {
+  const builder = new WasmModuleBuilder();
+  builder.addMemory(1, 1, false);
+  builder.addPassiveDataSegment([0, 1, 2]);
+  builder.addPassiveDataSegment([3, 4]);
+
+  // Should not throw.
+  builder.instantiate();
+})();
+
+(function TestPassiveElementSegment() {
+  const builder = new WasmModuleBuilder();
+  builder.addFunction('f', kSig_v_v).addBody([]);
+  builder.setTableBounds(1, 1);
+  builder.addPassiveElementSegment([0, 0, 0]);
+  builder.addPassiveElementSegment([0, 0]);
+
+  // Should not throw.
+  builder.instantiate();
+})();
+
+function getMemoryInit(mem, segment_data) {
+  const builder = new WasmModuleBuilder();
+  builder.addImportedMemory("", "mem", 0);
+  builder.addPassiveDataSegment(segment_data);
+  builder.addFunction('init', kSig_v_iii)
+      .addBody([
+        kExprGetLocal, 0,  // Dest.
+        kExprGetLocal, 1,  // Source.
+        kExprGetLocal, 2,  // Size in bytes.
+        kNumericPrefix, kExprMemoryInit,
+        0,  // Data segment index.
+        0,  // Memory index.
+      ])
+      .exportAs('init');
+  return builder.instantiate({'': {mem}}).exports.init;
+}
+
+(function TestMemoryInitOutOfBoundsGrow() {
+  const mem = new WebAssembly.Memory({initial: 1});
+  // Create a data segment that has a length of kPageSize.
+  const memoryInit = getMemoryInit(mem, new Array(kPageSize));
+
+  mem.grow(1);
+
+  // Works properly after grow.
+  memoryInit(kPageSize, 0, 1000);
+
+  // Traps at new boundary.
+  assertTraps(
+      kTrapMemOutOfBounds, () => memoryInit(kPageSize + 1, 0, kPageSize));
+})();
+
+(function TestMemoryInitOnActiveSegment() {
+  const builder = new WasmModuleBuilder();
+  builder.addMemory(1);
+  builder.addPassiveDataSegment([1, 2, 3]);
+  builder.addDataSegment(0, [4, 5, 6]);
+  builder.addFunction('init', kSig_v_v)
+      .addBody([
+        kExprI32Const, 0,  // Dest.
+        kExprI32Const, 0,  // Source.
+        kExprI32Const, 0,  // Size in bytes.
+        kNumericPrefix, kExprMemoryInit,
+        1,  // Data segment index.
+        0,  // Memory index.
+      ])
+      .exportAs('init');
+
+  // Instantiation succeeds, because using memory.init with an active segment
+  // is a trap, not a validation error.
+  const instance = builder.instantiate();
+
+  assertTraps(kTrapDataSegmentDropped, () => instance.exports.init());
+})();
+
+(function TestDataDropOnActiveSegment() {
+  const builder = new WasmModuleBuilder();
+  builder.addMemory(1);
+  builder.addPassiveDataSegment([1, 2, 3]);
+  builder.addDataSegment(0, [4, 5, 6]);
+  builder.addFunction('drop', kSig_v_v)
+      .addBody([
+        kNumericPrefix, kExprDataDrop,
+        1,  // Data segment index.
+      ])
+      .exportAs('drop');
+
+  const instance = builder.instantiate();
+  assertTraps(kTrapDataSegmentDropped, () => instance.exports.drop());
+})();
+
+function getMemoryCopy(mem) {
+  const builder = new WasmModuleBuilder();
+  builder.addImportedMemory("", "mem", 0);
+  builder.addFunction("copy", kSig_v_iii).addBody([
+    kExprGetLocal, 0,  // Dest.
+    kExprGetLocal, 1,  // Source.
+    kExprGetLocal, 2,  // Size in bytes.
+    kNumericPrefix, kExprMemoryCopy, 0, 0,
+  ]).exportAs("copy");
+  return builder.instantiate({'': {mem}}).exports.copy;
+}
+
+(function TestMemoryCopyOutOfBoundsGrow() {
+  const mem = new WebAssembly.Memory({initial: 1});
+  const memoryCopy = getMemoryCopy(mem);
+
+  mem.grow(1);
+
+  // Works properly after grow.
+  memoryCopy(0, kPageSize, 1000);
+
+  // Traps at new boundary.
+  assertTraps(
+      kTrapMemOutOfBounds, () => memoryCopy(0, kPageSize + 1, kPageSize));
+})();
+
+function getMemoryFill(mem) {
+  const builder = new WasmModuleBuilder();
+  builder.addImportedMemory("", "mem", 0);
+  builder.addFunction("fill", kSig_v_iii).addBody([
+    kExprGetLocal, 0,  // Dest.
+    kExprGetLocal, 1,  // Byte value.
+    kExprGetLocal, 2,  // Size.
+    kNumericPrefix, kExprMemoryFill, 0,
+  ]).exportAs("fill");
+  return builder.instantiate({'': {mem}}).exports.fill;
+}
+
+(function TestMemoryFillOutOfBoundsGrow() {
+  const mem = new WebAssembly.Memory({initial: 1});
+  const memoryFill = getMemoryFill(mem);
+  const v = 123;
+
+  mem.grow(1);
+
+  // Works properly after grow.
+  memoryFill(kPageSize, v, 1000);
+
+  // Traps at new boundary.
+  assertTraps(
+      kTrapMemOutOfBounds, () => memoryFill(kPageSize + 1, v, kPageSize));
+})();
+
+(function TestElemDropActive() {
+  const builder = new WasmModuleBuilder();
+  builder.setTableBounds(5, 5);
+  builder.addElementSegment(0, 0, false, [0, 0, 0]);
+  builder.addFunction('drop', kSig_v_v)
+      .addBody([
+        kNumericPrefix, kExprElemDrop,
+        0,  // Element segment index.
+      ])
+      .exportAs('drop');
+
+  const instance = builder.instantiate();
+  assertTraps(kTrapElemSegmentDropped, () => instance.exports.drop());
+})();
+
+(function TestLazyDataSegmentBoundsCheck() {
+  const memory = new WebAssembly.Memory({initial: 1});
+  const view = new Uint8Array(memory.buffer);
+  const builder = new WasmModuleBuilder();
+  builder.addImportedMemory('m', 'memory', 1);
+  builder.addDataSegment(kPageSize - 1, [42, 42]);
+  builder.addDataSegment(0, [111, 111]);
+
+  assertEquals(0, view[kPageSize - 1]);
+
+  // Instantiation fails, but still modifies memory.
+  assertThrows(() => builder.instantiate({m: {memory}}), WebAssembly.LinkError);
+
+  assertEquals(42, view[kPageSize - 1]);
+  // The second segment is not initialized.
+  assertEquals(0, view[0]);
+})();
+
+(function TestLazyElementSegmentBoundsCheck() {
+  const table = new WebAssembly.Table({initial: 3, element: 'anyfunc'});
+  const builder = new WasmModuleBuilder();
+  builder.addImportedTable('m', 'table', 1);
+  const f = builder.addFunction('f', kSig_i_v).addBody([kExprI32Const, 42]);
+
+  const tableIndex = 0;
+  const isGlobal = false;
+  builder.addElementSegment(tableIndex, 2, isGlobal, [f.index, f.index]);
+  builder.addElementSegment(tableIndex, 0, isGlobal, [f.index, f.index]);
+
+  assertEquals(null, table.get(0));
+  assertEquals(null, table.get(1));
+  assertEquals(null, table.get(2));
+
+  // Instantiation fails, but still modifies the table.
+  assertThrows(() => builder.instantiate({m: {table}}), WebAssembly.LinkError);
+
+  // The second segment is not initialized.
+  assertEquals(null, table.get(0));
+  assertEquals(null, table.get(1));
+  assertEquals(42, table.get(2)());
+})();
+
+(function TestLazyDataAndElementSegments() {
+  const table = new WebAssembly.Table({initial: 1, element: 'anyfunc'});
+  const memory = new WebAssembly.Memory({initial: 1});
+  const view = new Uint8Array(memory.buffer);
+  const builder = new WasmModuleBuilder();
+
+  builder.addImportedMemory('m', 'memory', 1);
+  builder.addImportedTable('m', 'table', 1);
+  const f = builder.addFunction('f', kSig_i_v).addBody([kExprI32Const, 42]);
+
+  const tableIndex = 0;
+  const isGlobal = false;
+  builder.addElementSegment(tableIndex, 0, isGlobal, [f.index, f.index]);
+  builder.addDataSegment(0, [42]);
+
+  // Instantiation fails, but still modifies the table. The memory is not
+  // modified, since data segments are initialized after element segments.
+  assertThrows(
+      () => builder.instantiate({m: {memory, table}}), WebAssembly.LinkError);
+
+  assertEquals(42, table.get(0)());
+  assertEquals(0, view[0]);
+})();
diff --git a/src/v8/test/mjsunit/wasm/calls.js b/src/v8/test/mjsunit/wasm/calls.js
index b0feda8..9718896 100644
--- a/src/v8/test/mjsunit/wasm/calls.js
+++ b/src/v8/test/mjsunit/wasm/calls.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 function assertModule(module, memsize) {
diff --git a/src/v8/test/mjsunit/wasm/code-space-exhaustion.js b/src/v8/test/mjsunit/wasm/code-space-exhaustion.js
new file mode 100644
index 0000000..6f4698c
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/code-space-exhaustion.js
@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-max-code-space=1
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+// We only have 1 MB code space. This is enough for the code below, but for all
+// 1000 modules, it requires several GCs to get rid of the old code.
+const builder = new WasmModuleBuilder();
+builder.addFunction('main', kSig_i_i).addBody([kExprGetLocal, 0]);
+const buffer = builder.toBuffer();
+
+for (let i = 0; i < 1000; ++i) {
+  new WebAssembly.Module(buffer);
+}
diff --git a/src/v8/test/mjsunit/wasm/compare-exchange-stress.js b/src/v8/test/mjsunit/wasm/compare-exchange-stress.js
new file mode 100644
index 0000000..5102216
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/compare-exchange-stress.js
@@ -0,0 +1,206 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-threads
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+const kSequenceLength = 8192;
+const kNumberOfWorkers = 4;
+const kBitMask = kNumberOfWorkers - 1;
+const kSequenceStartAddress = 32;
+
+function makeWorkerCodeForOpcode(compareExchangeOpcode, size, functionName,
+    builder) {
+    let loadMemOpcode = kTrapUnreachable;
+    switch (size) {
+        case 32:
+            loadMemOpcode = kExprI32LoadMem;
+            break;
+        case 16:
+            loadMemOpcode = kExprI32LoadMem16U;
+            break;
+        case 8:
+            loadMemOpcode = kExprI32LoadMem8U;
+            break;
+        default:
+            throw "!";
+    }
+    const kArgMemoryCell = 0; // target for atomic ops
+    const kArgSequencePtr = 1; // address of sequence
+    const kArgSeqenceLength = 2; // lenght of sequence
+    const kArgWorkerId = 3; // id of this worker
+    const kArgBitMask = 4; // mask to extract worker id from value
+    const kLocalCurrentOffset = 5; // current position in sequence in bytes
+    const kLocalExpectedValue = 6; // the value we are waiting for
+    const kLocalNextValue = 7; // the value to write in the update
+    let body = [
+        // Turn sequence length to equivalent in bytes.
+        kExprGetLocal, kArgSeqenceLength,
+        kExprI32Const, size / 8,
+        kExprI32Mul,
+        kExprSetLocal, kArgSeqenceLength,
+        // Outer block so we have something to jump for return.
+        ...[kExprBlock, kWasmStmt,
+            // Set counter to 0.
+            kExprI32Const, 0,
+            kExprSetLocal, kLocalCurrentOffset,
+            // Outer loop until maxcount.
+            ...[kExprLoop, kWasmStmt,
+                // Find the next value to wait for.
+                ...[kExprLoop, kWasmStmt,
+                    // Check end of sequence.
+                    kExprGetLocal, kLocalCurrentOffset,
+                    kExprGetLocal, kArgSeqenceLength,
+                    kExprI32Eq,
+                    kExprBrIf, 2, // return
+                    ...[kExprBlock, kWasmStmt,
+                        // Load next value.
+                        kExprGetLocal, kArgSequencePtr,
+                        kExprGetLocal, kLocalCurrentOffset,
+                        kExprI32Add,
+                        loadMemOpcode, 0, 0,
+                        // Mask off bits.
+                        kExprGetLocal, kArgBitMask,
+                        kExprI32And,
+                        // Compare with worker id.
+                        kExprGetLocal, kArgWorkerId,
+                        kExprI32Eq,
+                        kExprBrIf, 0,
+                        // Not found, increment position.
+                        kExprGetLocal, kLocalCurrentOffset,
+                        kExprI32Const, size / 8,
+                        kExprI32Add,
+                        kExprSetLocal, kLocalCurrentOffset,
+                        kExprBr, 1,
+                        kExprEnd
+                    ],
+                    // Found, end loop.
+                    kExprEnd
+                ],
+                // Load expected value to local.
+                kExprGetLocal, kArgSequencePtr,
+                kExprGetLocal, kLocalCurrentOffset,
+                kExprI32Add,
+                loadMemOpcode, 0, 0,
+                kExprSetLocal, kLocalExpectedValue,
+                // Load value after expected one.
+                kExprGetLocal, kArgSequencePtr,
+                kExprGetLocal, kLocalCurrentOffset,
+                kExprI32Add,
+                kExprI32Const, size / 8,
+                kExprI32Add,
+                loadMemOpcode, 0, 0,
+                kExprSetLocal, kLocalNextValue,
+                // Hammer on memory until value found.
+                ...[kExprLoop, kWasmStmt,
+                    // Load address.
+                    kExprGetLocal, kArgMemoryCell,
+                    // Load expected value.
+                    kExprGetLocal, kLocalExpectedValue,
+                    // Load updated value.
+                    kExprGetLocal, kLocalNextValue,
+                    // Try update.
+                    kAtomicPrefix, compareExchangeOpcode, 0, 0,
+                    // Load expected value.
+                    kExprGetLocal, kLocalExpectedValue,
+                    // Spin if not what expected.
+                    kExprI32Ne,
+                    kExprBrIf, 0,
+                    kExprEnd
+                ],
+                // Next iteration of loop.
+                kExprGetLocal, kLocalCurrentOffset,
+                kExprI32Const, size / 8,
+                kExprI32Add,
+                kExprSetLocal, kLocalCurrentOffset,
+                kExprBr, 0,
+                kExprEnd
+            ], // outer loop
+            kExprEnd
+        ], // the block
+        kExprReturn
+    ];
+    builder.addFunction(functionName, makeSig([kWasmI32, kWasmI32, kWasmI32,
+            kWasmI32, kWasmI32
+        ], []))
+        .addLocals({
+            i32_count: 3
+        })
+        .addBody(body)
+        .exportAs(functionName);
+}
+
+function generateSequence(typedarray, start, count) {
+    let end = count + start;
+    for (let i = start; i < end; i++) {
+        typedarray[i] = Math.floor(Math.random() * 256);
+    }
+}
+
+function spawnWorker(module, memory, address, sequence) {
+    let workers = [];
+    for (let i = 0; i < kNumberOfWorkers; i++) {
+        let worker = new Worker(
+            `onmessage = function(msg) {
+                this.instance = new WebAssembly.Instance(msg.module,
+                    {m: {imported_mem: msg.memory}});
+                instance.exports.worker(msg.address, msg.sequence, msg.sequenceLength, msg.workerId,
+                    msg.bitMask);
+                postMessage({workerId: msg.workerId});
+            }`,
+            {type: 'string'}
+        );
+        workers.push(worker);
+        worker.postMessage({
+            module: module,
+            memory: memory,
+            address: address,
+            sequence: sequence,
+            sequenceLength: kSequenceLength,
+            workerId: i,
+            bitMask: kBitMask
+        });
+    }
+    return workers;
+}
+
+function waitForWorkers(workers) {
+    for (let worker of workers) {
+        worker.getMessage();
+        worker.terminate();
+    }
+}
+
+function testOpcode(opcode, opcodeSize) {
+    print("Testing I32AtomicCompareExchange" + opcodeSize);
+    let builder = new WasmModuleBuilder();
+    builder.addImportedMemory("m", "imported_mem", 0, 1, "shared");
+
+    makeWorkerCodeForOpcode(opcode, opcodeSize, "worker", builder);
+
+    let memory = new WebAssembly.Memory({
+        initial: 1,
+        maximum: 1,
+        shared: true
+    });
+    let memoryView = new Uint8Array(memory.buffer);
+    generateSequence(memoryView, kSequenceStartAddress, kSequenceLength * (opcodeSize / 8));
+
+    let module = new WebAssembly.Module(builder.toBuffer());
+    let workers = spawnWorker(module, memory, 0, kSequenceStartAddress);
+
+    // Fire the workers off
+    for (let i = opcodeSize / 8 - 1; i >= 0; i--) {
+        memoryView[i] = memoryView[kSequenceStartAddress + i];
+    }
+
+    waitForWorkers(workers);
+
+    print("DONE");
+}
+
+testOpcode(kExprI32AtomicCompareExchange, 32);
+testOpcode(kExprI32AtomicCompareExchange16U, 16);
+testOpcode(kExprI32AtomicCompareExchange8U, 8);
diff --git a/src/v8/test/mjsunit/wasm/compare-exchange64-stress.js b/src/v8/test/mjsunit/wasm/compare-exchange64-stress.js
new file mode 100644
index 0000000..bd1c5c9
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/compare-exchange64-stress.js
@@ -0,0 +1,212 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-threads
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+const kSequenceLength = 8192;
+const kNumberOfWorkers = 4;
+const kBitMask = kNumberOfWorkers - 1;
+const kSequenceStartAddress = 32;
+
+function makeWorkerCodeForOpcode(compareExchangeOpcode, size, functionName,
+    builder) {
+    let loadMemOpcode = kTrapUnreachable;
+    switch (size) {
+        case 64:
+            loadMemOpcode = kExprI64LoadMem;
+            break;
+        case 32:
+            loadMemOpcode = kExprI64LoadMem32U;
+            break;
+        case 16:
+            loadMemOpcode = kExprI64LoadMem16U;
+            break;
+        case 8:
+            loadMemOpcode = kExprI64LoadMem8U;
+            break;
+        default:
+            throw "!";
+    }
+    const kArgMemoryCell = 0; // target for atomic ops
+    const kArgSequencePtr = 1; // address of sequence
+    const kArgSeqenceLength = 2; // lenght of sequence
+    const kArgWorkerId = 3; // id of this worker
+    const kArgBitMask = 4; // mask to extract worker id from value
+    const kLocalCurrentOffset = 5; // current position in sequence in bytes
+    const kLocalExpectedValue = 6; // the value we are waiting for
+    const kLocalNextValue = 7; // the value to write in the update
+    let body = [
+        // Turn sequence length to equivalent in bytes.
+        kExprGetLocal, kArgSeqenceLength,
+        kExprI32Const, size / 8,
+        kExprI32Mul,
+        kExprSetLocal, kArgSeqenceLength,
+        // Outer block so we have something to jump for return.
+        ...[kExprBlock, kWasmStmt,
+            // Set counter to 0.
+            kExprI32Const, 0,
+            kExprSetLocal, kLocalCurrentOffset,
+            // Outer loop until maxcount.
+            ...[kExprLoop, kWasmStmt,
+                // Find the next value to wait for.
+                ...[kExprLoop, kWasmStmt,
+                    // Check end of sequence.
+                    kExprGetLocal, kLocalCurrentOffset,
+                    kExprGetLocal, kArgSeqenceLength,
+                    kExprI32Eq,
+                    kExprBrIf, 2, // return
+                    ...[kExprBlock, kWasmStmt,
+                        // Load next value.
+                        kExprGetLocal, kArgSequencePtr,
+                        kExprGetLocal, kLocalCurrentOffset,
+                        kExprI32Add,
+                        loadMemOpcode, 0, 0,
+                        // Mask off bits.
+                        kExprGetLocal, kArgBitMask,
+                        kExprI64UConvertI32,
+                        kExprI64And,
+                        // Compare with worker id.
+                        kExprGetLocal, kArgWorkerId,
+                        kExprI64UConvertI32,
+                        kExprI64Eq,
+                        kExprBrIf, 0,
+                        // Not found, increment position.
+                        kExprGetLocal, kLocalCurrentOffset,
+                        kExprI32Const, size / 8,
+                        kExprI32Add,
+                        kExprSetLocal, kLocalCurrentOffset,
+                        kExprBr, 1,
+                        kExprEnd
+                    ],
+                    // Found, end loop.
+                    kExprEnd
+                ],
+                // Load expected value to local.
+                kExprGetLocal, kArgSequencePtr,
+                kExprGetLocal, kLocalCurrentOffset,
+                kExprI32Add,
+                loadMemOpcode, 0, 0,
+                kExprSetLocal, kLocalExpectedValue,
+                // Load value after expected one.
+                kExprGetLocal, kArgSequencePtr,
+                kExprGetLocal, kLocalCurrentOffset,
+                kExprI32Add,
+                kExprI32Const, size / 8,
+                kExprI32Add,
+                loadMemOpcode, 0, 0,
+                kExprSetLocal, kLocalNextValue,
+                // Hammer on memory until value found.
+                ...[kExprLoop, kWasmStmt,
+                    // Load address.
+                    kExprGetLocal, kArgMemoryCell,
+                    // Load expected value.
+                    kExprGetLocal, kLocalExpectedValue,
+                    // Load updated value.
+                    kExprGetLocal, kLocalNextValue,
+                    // Try update.
+                    kAtomicPrefix, compareExchangeOpcode, 0, 0,
+                    // Load expected value.
+                    kExprGetLocal, kLocalExpectedValue,
+                    // Spin if not what expected.
+                    kExprI64Ne,
+                    kExprBrIf, 0,
+                    kExprEnd
+                ],
+                // Next iteration of loop.
+                kExprGetLocal, kLocalCurrentOffset,
+                kExprI32Const, size / 8,
+                kExprI32Add,
+                kExprSetLocal, kLocalCurrentOffset,
+                kExprBr, 0,
+                kExprEnd
+            ], // outer loop
+            kExprEnd
+        ], // the block
+        kExprReturn
+    ];
+    builder.addFunction(functionName, makeSig([kWasmI32, kWasmI32, kWasmI32,
+            kWasmI32, kWasmI32
+        ], []))
+        .addLocals({
+            i32_count: 1, i64_count: 2
+        })
+        .addBody(body)
+        .exportAs(functionName);
+}
+
+function generateSequence(typedarray, start, count) {
+    let end = count + start;
+    for (let i = start; i < end; i++) {
+        typedarray[i] = Math.floor(Math.random() * 256);
+    }
+}
+
+function spawnWorker(module, memory, address, sequence) {
+    let workers = [];
+    for (let i = 0; i < kNumberOfWorkers; i++) {
+        let worker = new Worker(
+            `onmessage = function(msg) {
+                this.instance = new WebAssembly.Instance(msg.module,
+                    {m: {imported_mem: msg.memory}});
+                instance.exports.worker(msg.address, msg.sequence, msg.sequenceLength, msg.workerId,
+                    msg.bitMask);
+                postMessage({workerId: msg.workerId});
+            }`,
+            {type: 'string'}
+        );
+        workers.push(worker);
+        worker.postMessage({
+            module: module,
+            memory: memory,
+            address: address,
+            sequence: sequence,
+            sequenceLength: kSequenceLength,
+            workerId: i,
+            bitMask: kBitMask
+        });
+    }
+    return workers;
+}
+
+function waitForWorkers(workers) {
+    for (let worker of workers) {
+        worker.getMessage();
+        worker.terminate();
+    }
+}
+
+function testOpcode(opcode, opcodeSize) {
+    print("Testing I64AtomicCompareExchange" + opcodeSize);
+    let builder = new WasmModuleBuilder();
+    builder.addImportedMemory("m", "imported_mem", 0, 2, "shared");
+
+    makeWorkerCodeForOpcode(opcode, opcodeSize, "worker", builder);
+
+    let memory = new WebAssembly.Memory({
+        initial: 2,
+        maximum: 2,
+        shared: true
+    });
+    let memoryView = new Uint8Array(memory.buffer);
+    generateSequence(memoryView, kSequenceStartAddress, kSequenceLength * (opcodeSize / 8));
+
+    let module = new WebAssembly.Module(builder.toBuffer());
+    let workers = spawnWorker(module, memory, 0, kSequenceStartAddress);
+
+    // Fire the workers off
+    for (let i = opcodeSize / 8 - 1; i >= 0; i--) {
+      memoryView[i] = memoryView[kSequenceStartAddress + i];
+    }
+
+    waitForWorkers(workers);
+
+    print("DONE");
+}
+
+testOpcode(kExprI64AtomicCompareExchange, 64);
+testOpcode(kExprI64AtomicCompareExchange32U, 32);
+testOpcode(kExprI64AtomicCompareExchange16U, 16);
+testOpcode(kExprI64AtomicCompareExchange8U, 8);
diff --git a/src/v8/test/mjsunit/wasm/compilation-hints-async-compilation.js b/src/v8/test/mjsunit/wasm/compilation-hints-async-compilation.js
new file mode 100644
index 0000000..5ca20cb
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/compilation-hints-async-compilation.js
@@ -0,0 +1,74 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be found
+// in the LICENSE file.
+
+// Flags: --experimental-wasm-compilation-hints
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function testCompileWithBadLazyHint() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction('id', kSig_i_i)
+         .addBody([kExprGetLocal, 0])
+         .setCompilationHint(kCompilationHintStrategyLazy,
+                             kCompilationHintTierOptimized,
+                             kCompilationHintTierBaseline)
+         .exportFunc();
+  let bytes = builder.toBuffer();
+  assertPromiseResult(WebAssembly.compile(bytes)
+    .then(assertUnreachable,
+          error => assertEquals("WebAssembly.compile(): Invalid compilation " +
+          "hint 0x2d (forbidden downgrade) @+49", error.message)));
+})();
+
+(function testCompileWithBadLazyFunctionBody() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction('id', kSig_i_l)
+         .addBody([kExprGetLocal, 0])
+         .setCompilationHint(kCompilationHintStrategyLazy,
+                             kCompilationHintTierDefault,
+                             kCompilationHintTierDefault)
+         .exportFunc();
+  let bytes = builder.toBuffer();
+  assertPromiseResult(WebAssembly.compile(bytes)
+    .then(assertUnreachable,
+          error => assertEquals("WebAssembly.compile(): type error in " +
+          "merge[0] (expected i32, got i64) @+56", error.message)));
+})();
+
+(function testCompileEmptyModule() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let bytes = builder.toBuffer();
+  assertPromiseResult(WebAssembly.compile(bytes));
+})();
+
+(function testCompileLazyModule() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction('id', kSig_i_i)
+         .addBody([kExprGetLocal, 0])
+         .setCompilationHint(kCompilationHintStrategyLazy,
+                             kCompilationHintTierDefault,
+                             kCompilationHintTierDefault)
+         .exportFunc();
+  let bytes = builder.toBuffer();
+  assertPromiseResult(WebAssembly.instantiate(bytes)
+    .then(({module, instance}) => assertEquals(42, instance.exports.id(42))));
+})();
+
+(function testCompileLazyBaselineEagerTopTierModule() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction('id', kSig_i_i)
+         .addBody([kExprGetLocal, 0])
+         .setCompilationHint(kCompilationHintStrategyLazyBaselineEagerTopTier,
+                             kCompilationHintTierDefault,
+                             kCompilationHintTierDefault)
+         .exportFunc();
+  let bytes = builder.toBuffer();
+  assertPromiseResult(WebAssembly.instantiate(bytes)
+    .then(({module, instance}) => assertEquals(42, instance.exports.id(42))));
+})();
diff --git a/src/v8/test/mjsunit/wasm/compilation-hints-decoder.js b/src/v8/test/mjsunit/wasm/compilation-hints-decoder.js
new file mode 100644
index 0000000..e39e15f
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/compilation-hints-decoder.js
@@ -0,0 +1,130 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be found
+// in the LICENSE file.
+
+// Flags: --experimental-wasm-compilation-hints
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function testDecodeCompilationHintsSectionNoDowngrade() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addImport('mod', 'pow', kSig_i_ii);
+  builder.addFunction('upow', kSig_i_i)
+         .addBody([kExprGetLocal, 0,
+                   kExprGetLocal, 0,
+                   kExprCallFunction, 0])
+         .setCompilationHint(kCompilationHintStrategyLazy,
+                             kCompilationHintTierOptimized,
+                             kCompilationHintTierBaseline)
+         .exportFunc();
+  assertThrows(() => builder.instantiate({mod: {pow: Math.pow}}),
+               WebAssembly.CompileError,
+               "WebAssembly.Module(): Invalid compilation hint 0x2d " +
+               "(forbidden downgrade) @+70");
+})();
+
+(function testDecodeCompilationHintsSectionNoTiering() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addImport('mod', 'pow', kSig_i_ii);
+  builder.addFunction('upow', kSig_i_i)
+         .addBody([kExprGetLocal, 0,
+                   kExprGetLocal, 0,
+                   kExprCallFunction, 0])
+         .setCompilationHint(kCompilationHintStrategyDefault,
+                             kCompilationHintTierInterpreter,
+                             kCompilationHintTierInterpreter)
+         .exportFunc();
+  builder.addFunction('upow2', kSig_i_i)
+         .addBody([kExprGetLocal, 0,
+                   kExprGetLocal, 0,
+                   kExprCallFunction, 0])
+  builder.addFunction('upow3', kSig_i_i)
+         .addBody([kExprGetLocal, 0,
+                   kExprGetLocal, 0,
+                   kExprCallFunction, 0])
+  let instance = builder.instantiate({mod: {pow: Math.pow}});
+  assertEquals(27, instance.exports.upow(3))
+})();
+
+(function testDecodeCompilationHintsSectionUpgrade() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addImport('mod', 'pow', kSig_i_ii);
+  builder.addFunction('upow2', kSig_i_i)
+         .addBody([kExprGetLocal, 0,
+                   kExprGetLocal, 0,
+                   kExprCallFunction, 0])
+  builder.addFunction('upow3', kSig_i_i)
+         .addBody([kExprGetLocal, 0,
+                   kExprGetLocal, 0,
+                   kExprCallFunction, 0])
+  builder.addFunction('upow', kSig_i_i)
+         .addBody([kExprGetLocal, 0,
+                   kExprGetLocal, 0,
+                   kExprCallFunction, 0])
+         .setCompilationHint(kCompilationHintStrategyEager,
+                             kCompilationHintTierBaseline,
+                             kCompilationHintTierOptimized)
+         .exportFunc();
+  let instance = builder.instantiate({mod: {pow: Math.pow}});
+  assertEquals(27, instance.exports.upow(3))
+})();
+
+(function testDecodeCompilationHintsSectionNoImport() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction('sq', kSig_i_i)
+         .addBody([kExprGetLocal, 0,
+                   kExprGetLocal, 0,
+                   kExprI32Mul])
+         .setCompilationHint(kCompilationHintStrategyEager,
+                             kCompilationHintTierDefault,
+                             kCompilationHintTierOptimized)
+         .exportFunc();
+  let instance = builder.instantiate();
+  assertEquals(9, instance.exports.sq(3))
+})();
+
+(function testDecodeCompilationHintsSectionNoExport() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction('sq', kSig_i_i)
+         .addBody([kExprGetLocal, 0,
+                   kExprGetLocal, 0,
+                   kExprI32Mul])
+         .setCompilationHint(kCompilationHintStrategyEager,
+                             kCompilationHintTierDefault,
+                             kCompilationHintTierOptimized)
+  builder.instantiate();
+})();
+
+(function testDecodeCompilationHintsSectionTopTierDefault() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction('sq', kSig_i_i)
+         .addBody([kExprGetLocal, 0,
+                   kExprGetLocal, 0,
+                   kExprI32Mul])
+         .setCompilationHint(kCompilationHintStrategyEager,
+                             kCompilationHintTierOptimized,
+                             kCompilationHintTierDefault)
+         .exportFunc();
+  let instance = builder.instantiate();
+  assertEquals(9, instance.exports.sq(3))
+})();
+
+(function testDecodeCompilationHintsLazyBaselineEagerTopTier() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction('sq', kSig_i_i)
+         .addBody([kExprGetLocal, 0,
+                   kExprGetLocal, 0,
+                   kExprI32Mul])
+         .setCompilationHint(kCompilationHintStrategyLazyBaselineEagerTopTier,
+                             kCompilationHintTierOptimized,
+                             kCompilationHintTierDefault)
+         .exportFunc();
+  builder.instantiate();
+})();
diff --git a/src/v8/test/mjsunit/wasm/compilation-hints-ignored.js b/src/v8/test/mjsunit/wasm/compilation-hints-ignored.js
new file mode 100644
index 0000000..553426d
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/compilation-hints-ignored.js
@@ -0,0 +1,21 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be found
+// in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function testIgnoreCompilationHintsSectionUnlessEnabled() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addImport('mod', 'pow', kSig_i_ii);
+  builder.addFunction('upow', kSig_i_i)
+         .addBody([kExprGetLocal, 0,
+                   kExprGetLocal, 0,
+                   kExprCallFunction, 0])
+         .setCompilationHint(kCompilationHintStrategyDefault,
+                             kCompilationHintTierInterpreter,
+                             kCompilationHintTierInterpreter)
+         .exportFunc();
+  let instance = builder.instantiate({mod: {pow: Math.pow}});
+  assertEquals(27, instance.exports.upow(3))
+})();
diff --git a/src/v8/test/mjsunit/wasm/compilation-hints-interpreter.js b/src/v8/test/mjsunit/wasm/compilation-hints-interpreter.js
new file mode 100644
index 0000000..f0a46b9
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/compilation-hints-interpreter.js
@@ -0,0 +1,113 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be found
+// in the LICENSE file.
+
+// Flags: --experimental-wasm-compilation-hints --wasm-lazy-validation
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function testInterpreterCallsLazyFunctionInOtherInstance() {
+  print(arguments.callee.name);
+  let builder0 = new WasmModuleBuilder();
+  builder0.addFunction("getX", kSig_i_v)
+          .addBody([kExprI32Const, 42])
+          .setCompilationHint(kCompilationHintStrategyLazy,
+                              kCompilationHintTierBaseline,
+                              kCompilationHintTierBaseline)
+          .exportFunc();
+  let builder1 = new WasmModuleBuilder();
+  builder1.addImport("otherModule", "getX", kSig_i_v);
+  builder1.addFunction("plusX", kSig_i_i)
+          .addBody([kExprCallFunction, 0,
+                    kExprGetLocal, 0,
+                    kExprI32Add])
+          .setCompilationHint(kCompilationHintStrategyLazy,
+                              kCompilationHintTierInterpreter,
+                              kCompilationHintTierInterpreter)
+          .exportFunc();
+  let instance0 = builder0.instantiate();
+  let instance1 = builder1.instantiate(
+      {otherModule: {getX: instance0.exports.getX}});
+  assertEquals(46, instance1.exports.plusX(4));
+})();
+
+(function testInterpreterCallsLazyBadFunctionInOtherInstance() {
+  print(arguments.callee.name);
+  let builder0 = new WasmModuleBuilder();
+  builder0.addFunction("getX", kSig_i_v)
+          .addBody([kExprI64Const, 42])
+          .setCompilationHint(kCompilationHintStrategyLazy,
+                              kCompilationHintTierBaseline,
+                              kCompilationHintTierBaseline)
+          .exportFunc();
+  let builder1 = new WasmModuleBuilder();
+  builder1.addImport("otherModule", "getX", kSig_i_v);
+  builder1.addFunction("plusX", kSig_i_i)
+          .addBody([kExprCallFunction, 0,
+                    kExprGetLocal, 0,
+                    kExprI32Add])
+          .setCompilationHint(kCompilationHintStrategyLazy,
+                              kCompilationHintTierInterpreter,
+                              kCompilationHintTierInterpreter)
+          .exportFunc();
+  let instance0 = builder0.instantiate();
+  let instance1 = builder1.instantiate(
+      {otherModule: {getX: instance0.exports.getX}});
+  assertThrows(() => instance1.exports.plusX(4),
+               WebAssembly.CompileError,
+               "Compiling function #0:\"getX\" failed: type error in " +
+               "merge[0] (expected i32, got i64) @+57");
+})();
+
+(function testInterpreterCallsLazyFunctionThroughIndirection() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let sig_i_ii = builder.addType(kSig_i_ii);
+  let add = builder.addFunction('add', sig_i_ii)
+                   .addBody([kExprGetLocal, 0,
+                             kExprGetLocal, 1,
+                             kExprI32Add])
+                   .setCompilationHint(kCompilationHintStrategyLazy,
+                                       kCompilationHintTierInterpreter,
+                                       kCompilationHintTierInterpreter);
+  builder.appendToTable([add.index]);
+  builder.addFunction('main', kSig_i_iii)
+         .addBody([// Call indirect #0 with args <#1, #2>.
+                   kExprGetLocal, 1,
+                   kExprGetLocal, 2,
+                   kExprGetLocal, 0,
+                   kExprCallIndirect, sig_i_ii, kTableZero])
+         .setCompilationHint(kCompilationHintStrategyLazy,
+                             kCompilationHintTierInterpreter,
+                             kCompilationHintTierInterpreter)
+         .exportFunc();
+  assertEquals(99, builder.instantiate().exports.main(0, 22, 77));
+})();
+
+(function testInterpreterCallsLazyBadFunctionThroughIndirection() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let sig_i_ii = builder.addType(kSig_i_ii);
+  let add = builder.addFunction('add', sig_i_ii)
+                   .addBody([kExprGetLocal, 0,
+                             kExprGetLocal, 1,
+                             kExprI64Add])
+                   .setCompilationHint(kCompilationHintStrategyLazy,
+                                       kCompilationHintTierInterpreter,
+                                       kCompilationHintTierInterpreter);
+  builder.appendToTable([add.index]);
+  builder.addFunction('main', kSig_i_iii)
+         .addBody([// Call indirect #0 with args <#1, #2>.
+                   kExprGetLocal, 1,
+                   kExprGetLocal, 2,
+                   kExprGetLocal, 0,
+                   kExprCallIndirect, sig_i_ii, kTableZero])
+         .setCompilationHint(kCompilationHintStrategyLazy,
+                             kCompilationHintTierInterpreter,
+                             kCompilationHintTierInterpreter)
+         .exportFunc();
+  assertThrows(() => builder.instantiate().exports.main(0, 22, 77),
+               WebAssembly.CompileError,
+               "Compiling function #0:\"add\" failed: i64.add[1] expected " +
+               "type i64, found local.get of type i32 @+83");
+})();
diff --git a/src/v8/test/mjsunit/wasm/compilation-hints-lazy-validation.js b/src/v8/test/mjsunit/wasm/compilation-hints-lazy-validation.js
new file mode 100644
index 0000000..e6958cb
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/compilation-hints-lazy-validation.js
@@ -0,0 +1,38 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be found
+// in the LICENSE file.
+
+// Flags: --experimental-wasm-compilation-hints --wasm-lazy-validation
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function testInstantiateLazyValidation() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction('id', kSig_i_i)
+         .addBody([kExprGetLocal, 0,
+                   kExprI64Const, 1,
+                   kExprI32Mul])
+         .setCompilationHint(kCompilationHintStrategyLazy,
+                             kCompilationHintTierBaseline,
+                             kCompilationHintTierBaseline)
+         .exportFunc();
+
+  let expected_error_msg = "Compiling function #0:\"id\" failed: i32.mul[1] " +
+                           "expected type i32, found i64.const of type i64 " +
+                           "@+56";
+  let assertCompileErrorOnInvocation = function(instance) {
+    assertThrows(() => instance.exports.id(3),
+                 WebAssembly.CompileError,
+                 expected_error_msg)
+  };
+
+  // Synchronous case.
+  let instance = builder.instantiate();
+  assertCompileErrorOnInvocation(instance);
+
+  // Asynchronous case.
+  let bytes = builder.toBuffer();
+  assertPromiseResult(WebAssembly.instantiate(bytes)
+    .then(p => assertCompileErrorOnInvocation(p.instance)));
+})();
diff --git a/src/v8/test/mjsunit/wasm/compilation-hints-streaming-compilation.js b/src/v8/test/mjsunit/wasm/compilation-hints-streaming-compilation.js
new file mode 100644
index 0000000..f48169f
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/compilation-hints-streaming-compilation.js
@@ -0,0 +1,126 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be found
+// in the LICENSE file.
+
+// Flags: --experimental-wasm-compilation-hints --wasm-test-streaming
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function testInstantiateStreamingWithLazyHint() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addImport('mod', 'pow', kSig_i_ii);
+  builder.addFunction('upow', kSig_i_i)
+         .addBody([kExprGetLocal, 0,
+                   kExprGetLocal, 0,
+                   kExprCallFunction, 0])
+  builder.addFunction('upow2', kSig_i_i)
+         .addBody([kExprGetLocal, 0,
+                   kExprGetLocal, 0,
+                   kExprCallFunction, 0])
+         .setCompilationHint(kCompilationHintStrategyLazy,
+                             kCompilationHintTierDefault,
+                             kCompilationHintTierDefault)
+         .exportFunc();
+  let bytes = builder.toBuffer();
+  assertPromiseResult(WebAssembly.instantiateStreaming(Promise.resolve(bytes),
+                                                       {mod: {pow: Math.pow}})
+    .then(({module, instance}) => assertEquals(27, instance.exports.upow2(3))));
+})();
+
+(function testInstantiateStreamingWithBadLazyHint() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addImport('mod', 'pow', kSig_i_ii);
+  builder.addFunction('upow', kSig_i_i)
+         .addBody([kExprGetLocal, 0,
+                   kExprGetLocal, 0,
+                   kExprCallFunction, 0])
+  builder.addFunction('upow2', kSig_i_i)
+         .addBody([kExprGetLocal, 0,
+                   kExprGetLocal, 0,
+                   kExprCallFunction, 0])
+         .setCompilationHint(kCompilationHintStrategyLazy,
+                             kCompilationHintTierOptimized,
+                             kCompilationHintTierBaseline)
+         .exportFunc();
+  let bytes = builder.toBuffer();
+  assertPromiseResult(WebAssembly.instantiateStreaming(Promise.resolve(bytes),
+                                                       {mod: {pow: Math.pow}})
+    .then(assertUnreachable,
+          error => assertEquals("WebAssembly.instantiateStreaming(): Invalid " +
+                                "compilation hint 0x2d (forbidden downgrade) " +
+                                "@+78",
+                                error.message)));
+})();
+
+(function testInstantiateStreamingWithBadLazyFunctionBody() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addImport('mod', 'pow', kSig_f_ff);
+  builder.addFunction('upow', kSig_i_i)
+         .addBody([kExprGetLocal, 0,
+                   kExprGetLocal, 0,
+                   kExprCallFunction, 0])
+  builder.addFunction('upow2', kSig_i_i)
+         .addBody([kExprGetLocal, 0,
+                   kExprGetLocal, 0,
+                   kExprCallFunction, 0])
+         .setCompilationHint(kCompilationHintStrategyLazy,
+                             kCompilationHintTierDefault,
+                             kCompilationHintTierDefault)
+         .exportFunc();
+  let bytes = builder.toBuffer();
+  assertPromiseResult(WebAssembly.instantiateStreaming(Promise.resolve(bytes),
+                                                       {mod: {pow: Math.pow}})
+    .then(assertUnreachable,
+          error => assertEquals("WebAssembly.instantiateStreaming(): call[1] " +
+                                "expected type f32, found local.get of type " +
+                                "i32 @+94",
+                                error.message)));
+})();
+
+(function testInstantiateStreamingEmptyModule() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addImport('mod', 'pow', kSig_i_ii);
+  let bytes = builder.toBuffer();
+  assertPromiseResult(WebAssembly.instantiateStreaming(Promise.resolve(bytes),
+                                                       {mod: {pow: Math.pow}}));
+})();
+
+(function testInstantiateStreamingLazyModule() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addImport('mod', 'pow', kSig_i_ii);
+  builder.addFunction('upow', kSig_i_i)
+         .addBody([kExprGetLocal, 0,
+                   kExprGetLocal, 0,
+                   kExprCallFunction, 0])
+         .setCompilationHint(kCompilationHintStrategyLazy,
+                             kCompilationHintTierDefault,
+                             kCompilationHintTierDefault)
+         .exportFunc();
+  let bytes = builder.toBuffer();
+  assertPromiseResult(WebAssembly.instantiateStreaming(Promise.resolve(bytes),
+                                                       {mod: {pow: Math.pow}})
+    .then(({module, instance}) => assertEquals(27, instance.exports.upow(3))));
+})();
+
+(function testInstantiateStreamingLazyBaselineModule() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addImport('mod', 'pow', kSig_i_ii);
+  builder.addFunction('upow', kSig_i_i)
+         .addBody([kExprGetLocal, 0,
+                   kExprGetLocal, 0,
+                   kExprCallFunction, 0])
+         .setCompilationHint(kCompilationHintStrategyLazyBaselineEagerTopTier,
+                             kCompilationHintTierDefault,
+                             kCompilationHintTierDefault)
+         .exportFunc();
+  let bytes = builder.toBuffer();
+  assertPromiseResult(WebAssembly.instantiateStreaming(Promise.resolve(bytes),
+                                                       {mod: {pow: Math.pow}})
+    .then(({module, instance}) => assertEquals(27, instance.exports.upow(3))));
+})();
diff --git a/src/v8/test/mjsunit/wasm/compilation-hints-streaming-lazy-validation.js b/src/v8/test/mjsunit/wasm/compilation-hints-streaming-lazy-validation.js
new file mode 100644
index 0000000..6db4c0e
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/compilation-hints-streaming-lazy-validation.js
@@ -0,0 +1,33 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be found
+// in the LICENSE file.
+
+// Flags: --experimental-wasm-compilation-hints --wasm-test-streaming --wasm-lazy-validation
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function testInstantiateStreamingLazyValidation() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction('id', kSig_i_i)
+         .addBody([kExprGetLocal, 0,
+                   kExprI64Const, 1,
+                   kExprI32Mul])
+         .setCompilationHint(kCompilationHintStrategyLazy,
+                             kCompilationHintTierDefault,
+                             kCompilationHintTierDefault)
+         .exportFunc();
+
+  let expected_error_msg = "Compiling function #0:\"id\" failed: i32.mul[1] " +
+                           "expected type i32, found i64.const of type i64 " +
+                           "@+56";
+  let assertCompileErrorOnInvocation = function(instance) {
+    assertThrows(() => instance.exports.id(3),
+                 WebAssembly.CompileError,
+                 expected_error_msg)
+  };
+
+  let bytes = builder.toBuffer();
+  assertPromiseResult(WebAssembly.instantiateStreaming(Promise.resolve(bytes))
+    .then(({module, instance}) => assertCompileErrorOnInvocation(instance)));
+})();
diff --git a/src/v8/test/mjsunit/wasm/compilation-hints-sync-compilation.js b/src/v8/test/mjsunit/wasm/compilation-hints-sync-compilation.js
new file mode 100644
index 0000000..6c4364b
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/compilation-hints-sync-compilation.js
@@ -0,0 +1,67 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be found
+// in the LICENSE file.
+
+// Flags: --experimental-wasm-compilation-hints
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function testCompileWithBadLazyHint() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction('id', kSig_i_i)
+         .addBody([kExprGetLocal, 0])
+         .setCompilationHint(kCompilationHintStrategyLazy,
+                             kCompilationHintTierOptimized,
+                             kCompilationHintTierBaseline)
+         .exportFunc();
+  assertThrows(() => builder.toModule(),
+    WebAssembly.CompileError,
+    "WebAssembly.Module(): Invalid compilation hint 0x2d " +
+    "(forbidden downgrade) @+49");
+})();
+
+(function testCompileWithBadLazyFunctionBody() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction('id', kSig_i_l)
+         .addBody([kExprGetLocal, 0])
+         .setCompilationHint(kCompilationHintStrategyLazy,
+                             kCompilationHintTierDefault,
+                             kCompilationHintTierDefault)
+         .exportFunc();
+  assertThrows(() => builder.toModule(),
+    WebAssembly.CompileError,
+    "WebAssembly.Module(): Compiling function #0:\"id\" failed: type error " +
+    "in merge[0] (expected i32, got i64) @+56");
+})();
+
+(function testCompileEmptyModule() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.toModule();
+})();
+
+(function testCompileLazyModule() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction('id', kSig_i_i)
+         .addBody([kExprGetLocal, 0])
+         .setCompilationHint(kCompilationHintStrategyLazy,
+                             kCompilationHintTierDefault,
+                             kCompilationHintTierDefault)
+         .exportFunc();
+  assertEquals(42, builder.instantiate().exports.id(42));
+})();
+
+(function testCompileLazyBaselineEagerTopTierModule() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction('id', kSig_i_i)
+         .addBody([kExprGetLocal, 0])
+         .setCompilationHint(kCompilationHintStrategyLazyBaselineEagerTopTier,
+                             kCompilationHintTierDefault,
+                             kCompilationHintTierDefault)
+         .exportFunc();
+  assertEquals(42, builder.instantiate().exports.id(42));
+})();
diff --git a/src/v8/test/mjsunit/wasm/compilation-limits.js b/src/v8/test/mjsunit/wasm/compilation-limits.js
index 2b79de0..2fe2d32 100644
--- a/src/v8/test/mjsunit/wasm/compilation-limits.js
+++ b/src/v8/test/mjsunit/wasm/compilation-limits.js
@@ -4,7 +4,6 @@
 
 // Flags: --allow-natives-syntax
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 %SetWasmCompileControls(100000, true);
diff --git a/src/v8/test/mjsunit/wasm/compiled-module-management.js b/src/v8/test/mjsunit/wasm/compiled-module-management.js
index f2777d1..a2b102f 100644
--- a/src/v8/test/mjsunit/wasm/compiled-module-management.js
+++ b/src/v8/test/mjsunit/wasm/compiled-module-management.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm --expose-gc --allow-natives-syntax
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 // Use global variables for all values where the test wants to maintain strict
@@ -27,14 +26,21 @@
     ]).exportFunc();
 
   module = new WebAssembly.Module(builder.toBuffer());
-  %ValidateWasmModuleState(module);
-  %ValidateWasmInstancesChain(module, 0);
+
+  print("Initial instances=0");
+  assertEquals(0, %WasmGetNumberOfInstances(module));
   instance1 = new WebAssembly.Instance(module, {"": {getValue: () => 1}});
-  %ValidateWasmInstancesChain(module, 1);
+
+  print("Initial instances=1");
+  assertEquals(1, %WasmGetNumberOfInstances(module));
   instance2 = new WebAssembly.Instance(module, {"": {getValue: () => 2}});
-  %ValidateWasmInstancesChain(module, 2);
+
+  print("Initial instances=2");
+  assertEquals(2, %WasmGetNumberOfInstances(module));
   instance3 = new WebAssembly.Instance(module, {"": {getValue: () => 3}});
-  %ValidateWasmInstancesChain(module, 3);
+
+  print("Initial instances=3");
+  assertEquals(3, %WasmGetNumberOfInstances(module));
 })();
 
 (function CompiledModuleInstancesClear1() {
@@ -42,24 +48,33 @@
   instance1 = null;
 })();
 
+// Note that two GC's are required because weak slots clearing is deferred.
 gc();
-%ValidateWasmInstancesChain(module, 2);
+gc();
+print("After gc instances=2");
+assertEquals(2, %WasmGetNumberOfInstances(module));
 
 (function CompiledModuleInstancesClear3() {
   assertEquals(3, instance3.exports.f());
   instance3 = null;
 })();
 
+// Note that two GC's are required because weak slots clearing is deferred.
 gc();
-%ValidateWasmInstancesChain(module, 1);
+gc();
+print("After gc instances=1");
+assertEquals(1, %WasmGetNumberOfInstances(module));
 
 (function CompiledModuleInstancesClear2() {
   assertEquals(2, instance2.exports.f());
   instance2 = null;
 })();
 
+// Note that two GC's are required because weak slots clearing is deferred.
 gc();
-%ValidateWasmModuleState(module);
+gc();
+print("After gc instances=0");
+assertEquals(0, %WasmGetNumberOfInstances(module));
 
 (function CompiledModuleInstancesInitialize4AndClearModule() {
   instance4 = new WebAssembly.Instance(module, {"": {getValue: () => 4}});
@@ -67,7 +82,6 @@
   module = null;
 })();
 
+// Note that two GC's are required because weak slots clearing is deferred.
 gc();
-// the first GC will clear the module, the second the instance.
 gc();
-%ValidateWasmOrphanedInstance(instance4);
diff --git a/src/v8/test/mjsunit/wasm/compiled-module-serialization.js b/src/v8/test/mjsunit/wasm/compiled-module-serialization.js
index 0ec3296..c95e4d0 100644
--- a/src/v8/test/mjsunit/wasm/compiled-module-serialization.js
+++ b/src/v8/test/mjsunit/wasm/compiled-module-serialization.js
@@ -4,10 +4,10 @@
 
 // Flags: --expose-wasm --allow-natives-syntax --expose-gc
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 (function SerializeAndDeserializeModule() {
+  print(arguments.callee.name);
   var builder = new WasmModuleBuilder();
   builder.addImportedMemory("", "memory", 1);
   var kSig_v_i = makeSig([kWasmI32], []);
@@ -75,13 +75,16 @@
 })();
 
 (function DeserializeInvalidObject() {
-  var invalid_buffer = new ArrayBuffer(10);
+  print(arguments.callee.name);
+  const invalid_buffer = new ArrayBuffer(10);
+  const invalid_buffer_view = new Uint8Array(10);
 
-  module = %DeserializeWasmModule(invalid_buffer, invalid_buffer);
+  module = %DeserializeWasmModule(invalid_buffer, invalid_buffer_view);
   assertEquals(module, undefined);
 })();
 
 (function RelationBetweenModuleAndClone() {
+  print(arguments.callee.name);
   let builder = new WasmModuleBuilder();
   builder.addFunction("main", kSig_i_v)
     .addBody([kExprI32Const, 42])
@@ -98,7 +101,29 @@
   assertEquals(clone.constructor, compiled_module.constructor);
 })();
 
+(function SerializeWrappersWithSameSignature() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("main", kSig_i_v)
+    .addBody([kExprI32Const, 42])
+    .exportFunc();
+  builder.addFunction("main_same_signature", kSig_i_v)
+    .addBody([kExprI32Const, 23])
+    .exportFunc();
+
+  var wire_bytes = builder.toBuffer();
+  var compiled_module = new WebAssembly.Module(wire_bytes);
+  var serialized = %SerializeWasmModule(compiled_module);
+  var clone = %DeserializeWasmModule(serialized, wire_bytes);
+
+  assertNotNull(clone);
+  assertFalse(clone == undefined);
+  assertFalse(clone == compiled_module);
+  assertEquals(clone.constructor, compiled_module.constructor);
+})();
+
 (function SerializeAfterInstantiation() {
+  print(arguments.callee.name);
   let builder = new WasmModuleBuilder();
   builder.addFunction("main", kSig_i_v)
     .addBody([kExprI32Const, 42])
@@ -121,6 +146,7 @@
 
 
 (function SerializeAfterInstantiationWithMemory() {
+  print(arguments.callee.name);
   let builder = new WasmModuleBuilder();
   builder.addImportedMemory("", "memory", 1);
   builder.addFunction("main", kSig_i_v)
@@ -144,6 +170,7 @@
 })();
 
 (function GlobalsArePrivateBetweenClones() {
+  print(arguments.callee.name);
   var builder = new WasmModuleBuilder();
   builder.addGlobal(kWasmI32, true);
   builder.addFunction("read", kSig_i_v)
@@ -171,6 +198,7 @@
 })();
 
 (function SharedTableTest() {
+  print(arguments.callee.name);
   let kTableSize = 3;
   var sig_index1;
 
@@ -189,8 +217,8 @@
         kExprCallIndirect, sig_index1, kTableZero])  // --
       .exportAs("main");
 
-    builder.setFunctionTableBounds(kTableSize, kTableSize);
-    builder.addFunctionTableInit(0, false, [f1.index]);
+    builder.setTableBounds(kTableSize, kTableSize);
+    builder.addElementSegment(0, 0, false, [f1.index]);
     builder.addExportOfKind("table", kExternalTable, 0);
 
     return new WebAssembly.Module(builder.toBuffer());
@@ -211,7 +239,7 @@
     .exportAs("main");
 
   builder.addImportedTable("z", "table", kTableSize, kTableSize);
-  builder.addFunctionTableInit(1, false, [f2.index], true);
+  builder.addElementSegment(0, 1, false, [f2.index]);
   var m2_bytes = builder.toBuffer();
   var m2 = new WebAssembly.Module(m2_bytes);
 
@@ -241,5 +269,138 @@
   assertThrows(() => i2.exports.main(2));
   assertThrows(() => i1.exports.main(3));
   assertThrows(() => i2.exports.main(3));
+})();
 
+(function StackOverflowAfterSerialization() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  var fun = builder.addFunction('main', kSig_v_v);
+  fun.addBody([kExprCallFunction, fun.index]);
+  fun.exportFunc();
+
+  var wire_bytes = builder.toBuffer();
+  var module = new WebAssembly.Module(wire_bytes);
+  var buffer = %SerializeWasmModule(module);
+  module = %DeserializeWasmModule(buffer, wire_bytes);
+  var instance = new WebAssembly.Instance(module);
+
+  assertThrows(instance.exports.main, RangeError);
+})();
+
+(function TrapAfterDeserialization() {
+  print(arguments.callee.name);
+  function GenerateSerializedModule() {
+    const builder = new WasmModuleBuilder();
+    builder.addMemory(1, 1);
+    builder.addFunction('main', kSig_i_i)
+        .addBody([kExprGetLocal, 0, kExprI32LoadMem, 0, 0])
+        .exportFunc();
+    const wire_bytes = builder.toBuffer();
+    const module = new WebAssembly.Module(wire_bytes);
+    const buffer = %SerializeWasmModule(module);
+    return [wire_bytes, buffer];
+  }
+  const [wire_bytes, buffer] = GenerateSerializedModule();
+  module = %DeserializeWasmModule(buffer, wire_bytes);
+  const instance = new WebAssembly.Instance(module);
+
+  assertEquals(0, instance.exports.main(0));
+  assertEquals(0, instance.exports.main(kPageSize - 4));
+  assertTraps(
+      kTrapMemOutOfBounds, _ => instance.exports.main(kPageSize - 3));
+})();
+
+(function DirectCallAfterSerialization() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  var fun1 = builder.addFunction('fun1', kSig_i_v)
+      .addBody([kExprI32Const, 23]);
+  var fun2 = builder.addFunction('fun2', kSig_i_v)
+      .addBody([kExprI32Const, 42]);
+  builder.addFunction('main', kSig_i_v)
+      .addBody([kExprCallFunction, fun1.index,
+                kExprCallFunction, fun2.index,
+                kExprI32Add])
+      .exportFunc();
+
+  var wire_bytes = builder.toBuffer();
+  var module = new WebAssembly.Module(wire_bytes);
+  var buffer = %SerializeWasmModule(module);
+  module = %DeserializeWasmModule(buffer, wire_bytes);
+  var instance = new WebAssembly.Instance(module);
+
+  assertEquals(65, instance.exports.main());
+})();
+
+(function ImportCallAfterSerialization() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  var fun_import = builder.addImport("", "my_import", kSig_i_v);
+  var fun = builder.addFunction('fun', kSig_i_v)
+      .addBody([kExprI32Const, 23]);
+  builder.addFunction('main', kSig_i_v)
+      .addBody([kExprCallFunction, fun.index,
+                kExprCallFunction, fun_import,
+                kExprI32Add])
+      .exportFunc();
+
+  var wire_bytes = builder.toBuffer();
+  var module = new WebAssembly.Module(wire_bytes);
+  var buffer = %SerializeWasmModule(module);
+  module = %DeserializeWasmModule(buffer, wire_bytes);
+  var instance = new WebAssembly.Instance(module, {"": {my_import: () => 42 }});
+
+  assertEquals(65, instance.exports.main());
+})();
+
+(function BranchTableAfterSerialization() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  builder.addFunction('main', kSig_i_i)
+      .addBody([kExprBlock, kWasmStmt,
+                  kExprBlock, kWasmStmt,
+                    kExprBlock, kWasmStmt,
+                      kExprBlock, kWasmStmt,
+                        kExprBlock, kWasmStmt,
+                          kExprBlock, kWasmStmt,
+                            kExprBlock, kWasmStmt,
+                              kExprGetLocal, 0,
+                              kExprBrTable, 6, 0, 1, 2, 3, 4, 5, 6,
+                            kExprEnd,
+                            kExprI32Const, 3,
+                            kExprReturn,
+                          kExprEnd,
+                          kExprI32Const, 7,
+                          kExprReturn,
+                        kExprEnd,
+                        kExprI32Const, 9,
+                        kExprReturn,
+                      kExprEnd,
+                      kExprI32Const, 11,
+                      kExprReturn,
+                    kExprEnd,
+                    kExprI32Const, 23,
+                    kExprReturn,
+                  kExprEnd,
+                  kExprI32Const, 35,
+                  kExprReturn,
+                kExprEnd,
+                kExprI32Const, 42,
+                kExprReturn])
+      .exportFunc();
+
+  var wire_bytes = builder.toBuffer();
+  var module = new WebAssembly.Module(wire_bytes);
+  var buffer = %SerializeWasmModule(module);
+  module = %DeserializeWasmModule(buffer, wire_bytes);
+  var instance = new WebAssembly.Instance(module);
+
+  assertEquals(3, instance.exports.main(0));
+  assertEquals(7, instance.exports.main(1));
+  assertEquals(9, instance.exports.main(2));
+  assertEquals(11, instance.exports.main(3));
+  assertEquals(23, instance.exports.main(4));
+  assertEquals(35, instance.exports.main(5));
+  assertEquals(42, instance.exports.main(6));
+  assertEquals(42, instance.exports.main(9));
 })();
diff --git a/src/v8/test/mjsunit/wasm/data-segments.js b/src/v8/test/mjsunit/wasm/data-segments.js
index 5719959..91b6525 100644
--- a/src/v8/test/mjsunit/wasm/data-segments.js
+++ b/src/v8/test/mjsunit/wasm/data-segments.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 var debug = false;
@@ -37,8 +36,6 @@
   var builder = new WasmModuleBuilder();
   builder.addMemory(1, 1, false);
 
-  while (pad-- > 0) builder.addGlobal(kWasmI32);  // pad
-
   var g = builder.addImportedGlobal("mod", "offset", kWasmI32);
 
   while (pad-- > 0) builder.addGlobal(kWasmI32);  // pad
diff --git a/src/v8/test/mjsunit/wasm/disallow-codegen.js b/src/v8/test/mjsunit/wasm/disallow-codegen.js
index 9ac2bcd..c1dfb8a 100644
--- a/src/v8/test/mjsunit/wasm/disallow-codegen.js
+++ b/src/v8/test/mjsunit/wasm/disallow-codegen.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm --allow-natives-syntax
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 let kReturnValue = 19;
@@ -65,6 +64,16 @@
     promise, module => assertInstanceof(module, WebAssembly.Module));
 }
 
+async function AsyncTestWithInstantiateOk() {
+  print('async module instantiate (ok)...');
+  %DisallowCodegenFromStrings(false);
+  %DisallowWasmCodegen(false);
+  let promise = WebAssembly.instantiate(buffer);
+  assertPromiseResult(
+      promise,
+      module => assertInstanceof(module.instance, WebAssembly.Instance));
+}
+
 async function AsyncTestFail() {
   print('async module compile (fail)...');
   %DisallowCodegenFromStrings(true);
@@ -78,6 +87,19 @@
   }
 }
 
+async function AsyncTestWithInstantiateFail() {
+  print('async module instantiate (fail)...');
+  %DisallowCodegenFromStrings(true);
+  %DisallowWasmCodegen(false);
+  try {
+    let m = await WebAssembly.instantiate(buffer);
+    assertUnreachable();
+  } catch (e) {
+    print("  " + e);
+    assertInstanceof(e, WebAssembly.CompileError);
+  }
+}
+
 async function AsyncTestWasmFail(disallow_codegen) {
   print('async wasm module compile (fail)...');
   %DisallowCodegenFromStrings(disallow_codegen);
@@ -91,6 +113,19 @@
   }
 }
 
+async function AsyncTestWasmWithInstantiateFail(disallow_codegen) {
+  print('async wasm module instantiate (fail)...');
+  %DisallowCodegenFromStrings(disallow_codegen);
+  %DisallowWasmCodegen(true);
+  try {
+    let m = await WebAssembly.instantiate(buffer);
+    assertUnreachable();
+  } catch (e) {
+    print("  " + e);
+    assertInstanceof(e, WebAssembly.CompileError);
+  }
+}
+
 async function StreamingTestOk() {
   print('streaming module compile (ok)...');
   // TODO(titzer): compileStreaming must be supplied by embedder.
@@ -149,7 +184,9 @@
   await SyncTestOk();
   await SyncTestFail();
   await AsyncTestOk();
+  await AsyncTestWithInstantiateOk();
   await AsyncTestFail();
+  await AsyncTestWithInstantiateFail();
   await StreamingTestOk();
   await StreamingTestFail();
 
@@ -157,6 +194,7 @@
   for (count = 0; count < 2; ++count) {
     SyncTestWasmFail(disallow_codegen);
     AsyncTestWasmFail(disallow_codegen);
+    AsyncTestWasmWithInstantiateFail(disallow_codegen);
     StreamingTestWasmFail(disallow_codegen)
     disallow_codegen = true;
   }
diff --git a/src/v8/test/mjsunit/wasm/divrem-trap.js b/src/v8/test/mjsunit/wasm/divrem-trap.js
index d78e170..d9a2369 100644
--- a/src/v8/test/mjsunit/wasm/divrem-trap.js
+++ b/src/v8/test/mjsunit/wasm/divrem-trap.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm --expose-gc --allow-natives-syntax
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 var assertTraps = function(messageId, code) {
diff --git a/src/v8/test/mjsunit/wasm/empirical_max_memory.js b/src/v8/test/mjsunit/wasm/empirical_max_memory.js
new file mode 100644
index 0000000..e2ff7ca
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/empirical_max_memory.js
@@ -0,0 +1,84 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+let k1MiB = 1 * 1024 * 1024;
+let k1GiB = 1 * 1024 * 1024 * 1024;
+let k4GiB = 4 * k1GiB;
+let kMaxMemory = 2 * k1GiB - kPageSize; // TODO(titzer): raise this to 4GiB
+
+(function Test() {
+  var memory;
+
+  function BuildAccessors(type, load_opcode, store_opcode) {
+    builder = new WasmModuleBuilder();
+    builder.addImportedMemory("i", "mem");
+    builder.addFunction("load", makeSig([kWasmI32], [type]))
+      .addBody([           // --
+        kExprGetLocal, 0,  // --
+        load_opcode, 0, 0, // --
+      ])                   // --
+      .exportFunc();
+    builder.addFunction("store", makeSig([kWasmI32, type], []))
+      .addBody([             // --
+        kExprGetLocal, 0,    // --
+        kExprGetLocal, 1,    // --
+        store_opcode, 0, 0,  // --
+      ])                     // --
+      .exportFunc();
+    let i = builder.instantiate({i: {mem: memory}});
+    return {load: i.exports.load, store: i.exports.store};
+  }
+
+  function probe(a, f) {
+    print("------------------------");
+    let stride = kPageSize;
+    let max = kMaxMemory;
+    for (let i = 0; i < max; i += stride) {
+      a.store(i, f(i));
+    }
+    for (let i = 0; i < max; i += stride) {
+      //    print(`${i} = ${f(i)}`);
+      assertEquals(f(i), a.load(i));
+    }
+  }
+
+  try {
+    let kPages = kMaxMemory / kPageSize;
+    memory = new WebAssembly.Memory({initial: kPages, maximum: kPages});
+  } catch (e) {
+    print("OOM: sorry, best effort max memory size test.");
+    return;
+  }
+
+  assertEquals(kMaxMemory, memory.buffer.byteLength);
+
+  {
+    let a = BuildAccessors(kWasmI32, kExprI32LoadMem, kExprI32StoreMem);
+    probe(a, i => (0xaabbccee ^ ((i >> 11) * 0x110005)) | 0);
+  }
+
+  {
+    let a = BuildAccessors(kWasmI32, kExprI32LoadMem16U, kExprI32StoreMem16);
+    probe(a, i => (0xccee ^ ((i >> 11) * 0x110005)) & 0xFFFF);
+  }
+
+  {
+    let a = BuildAccessors(kWasmI32, kExprI32LoadMem8U, kExprI32StoreMem8);
+    probe(a, i => (0xee ^ ((i >> 11) * 0x05)) & 0xFF);
+  }
+
+  {
+    let a = BuildAccessors(kWasmF64, kExprF64LoadMem, kExprF64StoreMem);
+    probe(a, i => 0xaabbccee ^ ((i >> 11) * 0x110005));
+  }
+
+  {
+    let a = BuildAccessors(kWasmF32, kExprF32LoadMem, kExprF32StoreMem);
+    probe(a, i => Math.fround(0xaabbccee ^ ((i >> 11) * 0x110005)));
+  }
+})();
diff --git a/src/v8/test/mjsunit/wasm/ensure-wasm-binaries-up-to-date.js b/src/v8/test/mjsunit/wasm/ensure-wasm-binaries-up-to-date.js
index 26bdf8e..9f7a7f7 100644
--- a/src/v8/test/mjsunit/wasm/ensure-wasm-binaries-up-to-date.js
+++ b/src/v8/test/mjsunit/wasm/ensure-wasm-binaries-up-to-date.js
@@ -10,7 +10,6 @@
 (function print_incrementer() {
   if (true) return; // remove to regenerate the module
 
-  load('test/mjsunit/wasm/wasm-constants.js');
   load('test/mjsunit/wasm/wasm-module-builder.js');
 
   var module = new WasmModuleBuilder();
diff --git a/src/v8/test/mjsunit/wasm/errors.js b/src/v8/test/mjsunit/wasm/errors.js
index a902364..d98452e 100644
--- a/src/v8/test/mjsunit/wasm/errors.js
+++ b/src/v8/test/mjsunit/wasm/errors.js
@@ -4,181 +4,186 @@
 
 // Flags: --expose-wasm --allow-natives-syntax
 
-'use strict';
-
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
-function module(bytes) {
-  let buffer = bytes;
-  if (typeof buffer === 'string') {
-    buffer = new ArrayBuffer(bytes.length);
-    let view = new Uint8Array(buffer);
-    for (let i = 0; i < bytes.length; ++i) {
-      view[i] = bytes.charCodeAt(i);
-    }
-  }
-  return new WebAssembly.Module(buffer);
-}
-
-function instance(bytes, imports = {}) {
-  return new WebAssembly.Instance(module(bytes), imports);
-}
-
-// instantiate should succeed but run should fail.
-function instantiateAndFailAtRuntime(bytes, imports = {}) {
-  var instance =
-      assertDoesNotThrow(new WebAssembly.Instance(module(bytes), imports));
-  instance.exports.run();
-}
-
 function builder() {
   return new WasmModuleBuilder;
 }
 
 function assertCompileError(bytes, msg) {
-  assertThrows(() => module(bytes), WebAssembly.CompileError, msg);
+  assertThrows(
+      () => new WebAssembly.Module(bytes), WebAssembly.CompileError,
+      'WebAssembly.Module(): ' + msg);
+  assertThrowsAsync(
+      WebAssembly.compile(bytes), WebAssembly.CompileError,
+      'WebAssembly.compile(): ' + msg);
+}
+
+function assertInstantiateError(error, bytes, imports = {}, msg) {
+  assertThrows(
+      () => new WebAssembly.Instance(new WebAssembly.Module(bytes), imports),
+      error, 'WebAssembly.Instance(): ' + msg);
+  assertThrowsAsync(
+      WebAssembly.instantiate(bytes, imports), error,
+      'WebAssembly.instantiate(): ' + msg);
 }
 
 // default imports to {} so we get LinkError by default, thus allowing us to
 // distinguish the TypeError we want to catch
 function assertTypeError(bytes, imports = {}, msg) {
-  assertThrows(() => instance(bytes, imports), TypeError, msg);
+  assertInstantiateError(TypeError, bytes, imports, msg);
 }
 
 function assertLinkError(bytes, imports, msg) {
-  assertThrows(() => instance(bytes, imports), WebAssembly.LinkError, msg);
-}
-
-function assertRuntimeError(bytes, imports, msg) {
-  assertThrows(
-      () => instantiateAndFailAtRuntime(bytes, imports),
-      WebAssembly.RuntimeError, msg);
+  assertInstantiateError(WebAssembly.LinkError, bytes, imports, msg);
 }
 
 function assertConversionError(bytes, imports, msg) {
-  assertThrows(
-      () => instantiateAndFailAtRuntime(bytes, imports), TypeError, msg);
+  let instance =
+      new WebAssembly.Instance(new WebAssembly.Module(bytes), imports);
+  assertThrows(() => instance.exports.run(), TypeError, msg);
 }
 
 (function TestDecodingError() {
-  assertCompileError("", /is empty/);
-  assertCompileError("X", /expected 4 bytes, fell off end @\+0/);
+  print(arguments.callee.name);
+  assertCompileError(bytes(), 'BufferSource argument is empty');
+  assertCompileError(bytes('X'), 'expected 4 bytes, fell off end @+0');
   assertCompileError(
-    "\0x00asm", /expected magic word 00 61 73 6d, found 00 78 30 30 @\+0/);
+      bytes('\0x00asm'),
+      'expected magic word 00 61 73 6d, found 00 78 30 30 @+0');
 })();
 
 (function TestValidationError() {
+  print(arguments.callee.name);
+  let f_error = msg => 'Compiling function #0:"f" failed: ' + msg;
   assertCompileError(
-      builder().addFunction("f", kSig_i_v).end().toBuffer(),
-      /function body must end with "end" opcode @/);
-  assertCompileError(builder().addFunction("f", kSig_i_v).addBody([
-    kExprReturn
-  ]).end().toBuffer(), /return found empty stack @/);
-  assertCompileError(builder().addFunction("f", kSig_v_v).addBody([
+      builder().addFunction('f', kSig_i_v).end().toBuffer(),
+      f_error('function body must end with "end" opcode @+24'));
+  assertCompileError(
+      builder().addFunction('f', kSig_i_v).addBody([kExprReturn])
+          .end().toBuffer(),
+      f_error('expected 1 elements on the stack for return, found 0 @+24'));
+  assertCompileError(builder().addFunction('f', kSig_v_v).addBody([
     kExprGetLocal, 0
-  ]).end().toBuffer(), /invalid local index: 0 @/);
+  ]).end().toBuffer(), f_error('invalid local index: 0 @+24'));
   assertCompileError(
-      builder().addStart(0).toBuffer(), /function index 0 out of bounds/);
+      builder().addStart(0).toBuffer(),
+      'start function index 0 out of bounds (0 entries) @+10');
 })();
 
+function import_error(index, module, func, msg) {
+  let full_msg = 'Import #' + index + ' module=\"' + module + '\"';
+  if (func !== undefined) full_msg += ' function=\"' + func + '\"';
+  return full_msg + ' error: ' + msg;
+}
+
 (function TestTypeError() {
-  let b;
-  b = builder();
-  b.addImport("foo", "bar", kSig_v_v);
-  assertTypeError(b.toBuffer(), {}, /module is not an object or function/);
+  print(arguments.callee.name);
+  let b = builder();
+  b.addImport('foo', 'bar', kSig_v_v);
+  let msg =
+      import_error(0, 'foo', undefined, 'module is not an object or function');
+  assertTypeError(b.toBuffer(), {}, msg);
 
   b = builder();
-  b.addImportedGlobal("foo", "bar", kWasmI32);
-  assertTypeError(b.toBuffer(), {}, /module is not an object or function/);
+  b.addImportedGlobal('foo', 'bar', kWasmI32);
+  assertTypeError(b.toBuffer(), {}, msg);
 
   b = builder();
-  b.addImportedMemory("foo", "bar");
-  assertTypeError(b.toBuffer(), {}, /module is not an object or function/);
+  b.addImportedMemory('foo', 'bar');
+  assertTypeError(b.toBuffer(), {}, msg);
 })();
 
 (function TestLinkingError() {
+  print(arguments.callee.name);
   let b;
+  let msg;
 
   b = builder();
-  b.addImport("foo", "bar", kSig_v_v);
-  assertLinkError(
-      b.toBuffer(), {foo: {}}, /function import requires a callable/);
+  msg = import_error(0, 'foo', 'bar', 'function import requires a callable');
+  b.addImport('foo', 'bar', kSig_v_v);
+  assertLinkError(b.toBuffer(), {foo: {}}, msg);
   b = builder();
-  b.addImport("foo", "bar", kSig_v_v);
-  assertLinkError(
-      b.toBuffer(), {foo: {bar: 9}}, /function import requires a callable/);
+  b.addImport('foo', 'bar', kSig_v_v);
+  assertLinkError(b.toBuffer(), {foo: {bar: 9}}, msg);
 
   b = builder();
-  b.addImportedGlobal("foo", "bar", kWasmI32);
-  assertLinkError(b.toBuffer(), {foo: {}}, /global import must be a number/);
+  msg = import_error(
+      0, 'foo', 'bar',
+      'global import must be a number or WebAssembly.Global object');
+  b.addImportedGlobal('foo', 'bar', kWasmI32);
+  assertLinkError(b.toBuffer(), {foo: {}}, msg);
   b = builder();
-  b.addImportedGlobal("foo", "bar", kWasmI32);
-  assertLinkError(
-      b.toBuffer(), {foo: {bar: ""}}, /global import must be a number/);
+  b.addImportedGlobal('foo', 'bar', kWasmI32);
+  assertLinkError(b.toBuffer(), {foo: {bar: ''}}, msg);
   b = builder();
-  b.addImportedGlobal("foo", "bar", kWasmI32);
-  assertLinkError(
-      b.toBuffer(), {foo: {bar: () => 9}}, /global import must be a number/);
+  b.addImportedGlobal('foo', 'bar', kWasmI32);
+  assertLinkError(b.toBuffer(), {foo: {bar: () => 9}}, msg);
 
   b = builder();
-  b.addImportedMemory("foo", "bar");
-  assertLinkError(
-      b.toBuffer(), {foo: {}},
-      /memory import must be a WebAssembly\.Memory object/);
+  msg = import_error(
+      0, 'foo', 'bar', 'memory import must be a WebAssembly.Memory object');
+  b.addImportedMemory('foo', 'bar');
+  assertLinkError(b.toBuffer(), {foo: {}}, msg);
   b = builder();
-  b.addImportedMemory("foo", "bar", 1);
+  b.addImportedMemory('foo', 'bar', 1);
   assertLinkError(
       b.toBuffer(), {foo: {bar: () => new WebAssembly.Memory({initial: 0})}},
-      /memory import must be a WebAssembly\.Memory object/);
-
-  b = builder();
-  b.addFunction("startup", kSig_v_v).addBody([
-    kExprUnreachable,
-  ]).end().addStart(0);
-  assertRuntimeError(b.toBuffer(), {}, "unreachable");
+      msg);
 })();
 
-(function TestTrapError() {
-  assertRuntimeError(builder().addFunction("run", kSig_v_v).addBody([
-    kExprUnreachable
-  ]).exportFunc().end().toBuffer(), {}, "unreachable");
+(function TestTrapUnreachable() {
+  print(arguments.callee.name);
+  let instance = builder().addFunction('run', kSig_v_v)
+    .addBody([kExprUnreachable]).exportFunc().end().instantiate();
+  assertTraps(kTrapUnreachable, instance.exports.run);
+})();
 
-  assertRuntimeError(builder().addFunction("run", kSig_v_v).addBody([
-    kExprI32Const, 1,
-    kExprI32Const, 0,
-    kExprI32DivS,
-    kExprDrop
-  ]).exportFunc().end().toBuffer(), {}, "divide by zero");
+(function TestTrapDivByZero() {
+  print(arguments.callee.name);
+  let instance = builder().addFunction('run', kSig_v_v).addBody(
+     [kExprI32Const, 1, kExprI32Const, 0, kExprI32DivS, kExprDrop])
+    .exportFunc().end().instantiate();
+  assertTraps(kTrapDivByZero, instance.exports.run);
+})();
 
-  assertRuntimeError(builder().
-      addFunction("run", kSig_v_v).addBody([]).exportFunc().end().
-      addFunction("start", kSig_v_v).addBody([kExprUnreachable]).end().
-      addStart(1).toBuffer(),
-    {}, "unreachable");
+(function TestUnreachableInStart() {
+  print(arguments.callee.name);
+
+  let b = builder().addFunction("start", kSig_v_v).addBody(
+     [kExprUnreachable]).end().addStart(0);
+  assertTraps(kTrapUnreachable, () => b.instantiate());
 })();
 
 (function TestConversionError() {
+  print(arguments.callee.name);
   let b = builder();
-  b.addImport("foo", "bar", kSig_v_l);
-  assertConversionError(b.addFunction("run", kSig_v_v).addBody([
-    kExprI64Const, 0, kExprCallFunction, 0
-  ]).exportFunc().end().toBuffer(), {foo:{bar: (l)=>{}}}, "invalid type");
+  b.addImport('foo', 'bar', kSig_v_l);
+  let buffer = b.addFunction('run', kSig_v_v)
+                   .addBody([kExprI64Const, 0, kExprCallFunction, 0])
+                   .exportFunc()
+                   .end()
+                   .toBuffer();
+  assertConversionError(
+      buffer, {foo: {bar: (l) => {}}}, kTrapMsgs[kTrapTypeError]);
 
-  b = builder()
-  assertConversionError(builder().addFunction("run", kSig_l_v).addBody([
-    kExprI64Const, 0
-  ]).exportFunc().end().toBuffer(), {}, "invalid type");
+  buffer = builder()
+               .addFunction('run', kSig_l_v)
+               .addBody([kExprI64Const, 0])
+               .exportFunc()
+               .end()
+               .toBuffer();
+  assertConversionError(buffer, {}, kTrapMsgs[kTrapTypeError]);
 })();
 
-
 (function InternalDebugTrace() {
+  print(arguments.callee.name);
   var builder = new WasmModuleBuilder();
   var sig = builder.addType(kSig_i_dd);
   builder.addImport("mod", "func", sig);
   builder.addFunction("main", sig)
     .addBody([kExprGetLocal, 0, kExprGetLocal, 1, kExprCallFunction, 0])
-    .exportAs("main")
+    .exportAs("main");
   var main = builder.instantiate({
     mod: {
       func: ()=>{%DebugTrace();}
@@ -186,3 +191,18 @@
   }).exports.main;
   main();
 })();
+
+(function TestMultipleCorruptFunctions() {
+  print(arguments.callee.name);
+  // Generate a module with multiple corrupt functions. The error message must
+  // be deterministic.
+  var builder = new WasmModuleBuilder();
+  var sig = builder.addType(kSig_v_v);
+  for (let i = 0; i < 10; ++i) {
+    builder.addFunction('f' + i, sig).addBody([kExprEnd]);
+  }
+  assertCompileError(
+      builder.toBuffer(),
+      'Compiling function #0:"f0" failed: ' +
+          'trailing code after function end @+33');
+})();
diff --git a/src/v8/test/mjsunit/wasm/exceptions-anyref-interpreter.js b/src/v8/test/mjsunit/wasm/exceptions-anyref-interpreter.js
new file mode 100644
index 0000000..14d1e60
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/exceptions-anyref-interpreter.js
@@ -0,0 +1,12 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-eh --experimental-wasm-anyref --allow-natives-syntax
+// Flags: --wasm-interpret-all
+
+// This is just a wrapper for existing exception handling test cases that runs
+// with the --wasm-interpret-all flag added. If we ever decide to add a test
+// variant for this, then we can remove this file.
+
+load("test/mjsunit/wasm/exceptions-anyref.js");
diff --git a/src/v8/test/mjsunit/wasm/exceptions-anyref.js b/src/v8/test/mjsunit/wasm/exceptions-anyref.js
new file mode 100644
index 0000000..a41d69c
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/exceptions-anyref.js
@@ -0,0 +1,145 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-eh --experimental-wasm-anyref --allow-natives-syntax
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+load("test/mjsunit/wasm/exceptions-utils.js");
+
+// Test the encoding of a thrown exception with a null-ref value.
+(function TestThrowRefNull() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_r);
+  builder.addFunction("throw_null", kSig_v_v)
+      .addBody([
+        kExprRefNull,
+        kExprThrow, except,
+      ]).exportFunc();
+  let instance = builder.instantiate();
+
+  assertWasmThrows(instance, except, [null], () => instance.exports.throw_null());
+})();
+
+// Test throwing/catching the null-ref value.
+(function TestThrowCatchRefNull() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_r);
+  builder.addFunction("throw_catch_null", kSig_i_i)
+      .addBody([
+        kExprTry, kWasmAnyRef,
+          kExprGetLocal, 0,
+          kExprI32Eqz,
+          kExprIf, kWasmAnyRef,
+            kExprRefNull,
+            kExprThrow, except,
+          kExprElse,
+            kExprI32Const, 42,
+            kExprReturn,
+          kExprEnd,
+        kExprCatch,
+          kExprBrOnExn, 0, except,
+          kExprRethrow,
+        kExprEnd,
+        kExprRefIsNull,
+        kExprIf, kWasmI32,
+          kExprI32Const, 23,
+        kExprElse,
+          kExprUnreachable,
+        kExprEnd,
+      ]).exportFunc();
+  let instance = builder.instantiate();
+
+  assertEquals(23, instance.exports.throw_catch_null(0));
+  assertEquals(42, instance.exports.throw_catch_null(1));
+})();
+
+// Test the encoding of a thrown exception with a reference type value.
+(function TestThrowRefParam() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_r);
+  builder.addFunction("throw_param", kSig_v_r)
+      .addBody([
+        kExprGetLocal, 0,
+        kExprThrow, except,
+      ]).exportFunc();
+  let instance = builder.instantiate();
+  let o = new Object();
+
+  assertWasmThrows(instance, except, [o], () => instance.exports.throw_param(o));
+  assertWasmThrows(instance, except, [1], () => instance.exports.throw_param(1));
+  assertWasmThrows(instance, except, [2.3], () => instance.exports.throw_param(2.3));
+  assertWasmThrows(instance, except, ["str"], () => instance.exports.throw_param("str"));
+})();
+
+// Test throwing/catching the reference type value.
+(function TestThrowCatchRefParam() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_r);
+  builder.addFunction("throw_catch_param", kSig_r_r)
+      .addBody([
+        kExprTry, kWasmAnyRef,
+          kExprGetLocal, 0,
+          kExprThrow, except,
+        kExprCatch,
+          kExprBrOnExn, 0, except,
+          kExprRethrow,
+        kExprEnd,
+      ]).exportFunc();
+  let instance = builder.instantiate();
+  let o = new Object();
+
+  assertEquals(o, instance.exports.throw_catch_param(o));
+  assertEquals(1, instance.exports.throw_catch_param(1));
+  assertEquals(2.3, instance.exports.throw_catch_param(2.3));
+  assertEquals("str", instance.exports.throw_catch_param("str"));
+})();
+
+// Test throwing/catching a function reference type value.
+(function TestThrowCatchAnyFunc() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_a);
+  builder.addFunction("throw_catch_local", kSig_r_v)
+      .addLocals({anyfunc_count: 1})
+      .addBody([
+        kExprTry, kWasmAnyFunc,
+          kExprGetLocal, 0,
+          kExprThrow, except,
+        kExprCatch,
+          kExprBrOnExn, 0, except,
+          kExprRethrow,
+        kExprEnd,
+      ]).exportFunc();
+  let instance = builder.instantiate();
+
+  assertEquals(null, instance.exports.throw_catch_local());
+})();
+
+// Test throwing/catching an encapsulated exception type value.
+(function TestThrowCatchExnRef() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_e);
+  builder.addFunction("throw_catch_param", kSig_e_e)
+      .addBody([
+        kExprTry, kWasmExnRef,
+          kExprGetLocal, 0,
+          kExprThrow, except,
+        kExprCatch,
+          kExprBrOnExn, 0, except,
+          kExprRethrow,
+        kExprEnd,
+      ]).exportFunc();
+  let instance = builder.instantiate();
+  let e = new Error("my encapsulated error");
+
+  assertEquals(e, instance.exports.throw_catch_param(e));
+  assertEquals(1, instance.exports.throw_catch_param(1));
+  assertEquals(2.3, instance.exports.throw_catch_param(2.3));
+  assertEquals("str", instance.exports.throw_catch_param("str"));
+})();
diff --git a/src/v8/test/mjsunit/wasm/exceptions-export.js b/src/v8/test/mjsunit/wasm/exceptions-export.js
new file mode 100644
index 0000000..b698cce
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/exceptions-export.js
@@ -0,0 +1,81 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --experimental-wasm-eh
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function TestExportSimple() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_v);
+  builder.addExportOfKind("ex", kExternalException, except);
+  let instance = builder.instantiate();
+
+  assertTrue(Object.prototype.hasOwnProperty.call(instance.exports, 'ex'));
+  assertEquals("object", typeof instance.exports.ex);
+  assertInstanceof(instance.exports.ex, WebAssembly.Exception);
+  assertSame(instance.exports.ex.constructor, WebAssembly.Exception);
+})();
+
+(function TestExportMultiple() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except1 = builder.addException(kSig_v_v);
+  let except2 = builder.addException(kSig_v_i);
+  builder.addExportOfKind("ex1a", kExternalException, except1);
+  builder.addExportOfKind("ex1b", kExternalException, except1);
+  builder.addExportOfKind("ex2", kExternalException, except2);
+  let instance = builder.instantiate();
+
+  assertTrue(Object.prototype.hasOwnProperty.call(instance.exports, 'ex1a'));
+  assertTrue(Object.prototype.hasOwnProperty.call(instance.exports, 'ex1b'));
+  assertTrue(Object.prototype.hasOwnProperty.call(instance.exports, 'ex2'));
+  assertSame(instance.exports.ex1a, instance.exports.ex1b);
+  assertNotSame(instance.exports.ex1a, instance.exports.ex2);
+})();
+
+(function TestExportOutOfBounds() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_v);
+  builder.addExportOfKind("ex_oob", kExternalException, except + 1);
+  assertThrows(
+      () => builder.instantiate(), WebAssembly.CompileError,
+      'WebAssembly.Module(): exception index 1 out of bounds (1 entry) @+30');
+})();
+
+(function TestExportSameNameTwice() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_v);
+  builder.addExportOfKind("ex", kExternalException, except);
+  builder.addExportOfKind("ex", kExternalException, except);
+  assertThrows(
+      () => builder.instantiate(), WebAssembly.CompileError,
+      'WebAssembly.Module(): Duplicate export name \'ex\' ' +
+          'for exception 0 and exception 0 @+28');
+})();
+
+(function TestExportModuleGetExports() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_v);
+  builder.addExportOfKind("ex", kExternalException, except);
+  let module = new WebAssembly.Module(builder.toBuffer());
+
+  let exports = WebAssembly.Module.exports(module);
+  assertArrayEquals([{ name: "ex", kind: "exception" }], exports);
+})();
+
+(function TestConstructorNonCallable() {
+  print(arguments.callee.name);
+  // TODO(wasm): Currently the constructor function of an exported exception is
+  // not callable. This can/will change once the proposal matures, at which
+  // point we should add a full exceptions-api.js test suite for the API and
+  // remove this test case from this file.
+  assertThrows(
+      () => WebAssembly.Exception(), TypeError,
+      /WebAssembly.Exception cannot be called/);
+})();
diff --git a/src/v8/test/mjsunit/wasm/exceptions-global-interpreter.js b/src/v8/test/mjsunit/wasm/exceptions-global-interpreter.js
new file mode 100644
index 0000000..ae06ff0
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/exceptions-global-interpreter.js
@@ -0,0 +1,12 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --experimental-wasm-eh --allow-natives-syntax
+// Flags: --wasm-interpret-all
+
+// This is just a wrapper for existing exception handling test cases that runs
+// with the --wasm-interpret-all flag added. If we ever decide to add a test
+// variant for this, then we can remove this file.
+
+load("test/mjsunit/wasm/exceptions-global.js");
diff --git a/src/v8/test/mjsunit/wasm/exceptions-global.js b/src/v8/test/mjsunit/wasm/exceptions-global.js
new file mode 100644
index 0000000..c3f208c
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/exceptions-global.js
@@ -0,0 +1,154 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --experimental-wasm-eh --allow-natives-syntax
+
+// Note that this test does not pass --experimental-wasm-anyref on purpose so
+// that we make sure the two flags can be controlled separately/independently.
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+// First we just test that "exnref" global variables are allowed.
+(function TestGlobalExnRefSupported() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let g = builder.addGlobal(kWasmExnRef);
+  builder.addFunction("push_and_drop_exnref", kSig_v_v)
+      .addBody([
+        kExprGetGlobal, g.index,
+        kExprDrop,
+      ]).exportFunc();
+  let instance = builder.instantiate();
+
+  assertDoesNotThrow(instance.exports.push_and_drop_exnref);
+})();
+
+// Test default value that global "exnref" variables are initialized with.
+(function TestGlobalExnRefDefaultValue() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let g = builder.addGlobal(kWasmExnRef);
+  builder.addFunction('push_and_return_exnref', kSig_e_v)
+      .addBody([kExprGetGlobal, g.index])
+      .exportFunc();
+  let instance = builder.instantiate();
+
+  assertEquals(null, instance.exports.push_and_return_exnref());
+})();
+
+// Test storing a caught exception into an exported mutable "exnref" global.
+(function TestGlobalExnRefSetCaught() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_i);
+  let g = builder.addGlobal(kWasmExnRef, true).exportAs("exn");
+  builder.addFunction('catch_and_set_exnref', kSig_v_i)
+      .addBody([
+        kExprTry, kWasmStmt,
+          kExprGetLocal, 0,
+          kExprThrow, except,
+        kExprCatch,
+          kExprSetGlobal, g.index,
+        kExprEnd,
+      ]).exportFunc();
+  let instance = builder.instantiate();
+
+  assertDoesNotThrow(() => instance.exports.catch_and_set_exnref(23));
+  let exception = instance.exports.exn.value;  // Exported mutable global.
+  assertInstanceof(exception, WebAssembly.RuntimeError);
+  assertEquals(except, %GetWasmExceptionId(exception, instance));
+})();
+
+// Test storing a parameter into an exported mutable "exnref" global.
+(function TestGlobalExnRefSetParameter() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let g = builder.addGlobal(kWasmExnRef, true).exportAs("exn");
+  builder.addFunction('set_param_exnref', kSig_v_e)
+      .addBody([
+        kExprTry, kWasmStmt,
+          kExprGetLocal, 0,
+          kExprRethrow,
+        kExprCatch,
+          kExprSetGlobal, g.index,
+        kExprEnd,
+      ]).exportFunc();
+  let exception = "my fancy exception";
+  let instance = builder.instantiate();
+
+  assertDoesNotThrow(() => instance.exports.set_param_exnref(exception));
+  assertEquals(exception, instance.exports.exn.value);
+})();
+
+// Test loading an imported "exnref" global and re-throwing the exception.
+(function TestGlobalExnRefGetImportedAndRethrow() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let g_index = builder.addImportedGlobal("m", "exn", kWasmExnRef);
+  builder.addFunction('rethrow_exnref', kSig_v_v)
+      .addBody([
+        kExprGetGlobal, g_index,
+        kExprRethrow,
+      ]).exportFunc();
+  let exception = "my fancy exception";
+  let instance = builder.instantiate({ "m": { "exn": exception }});
+
+  assertThrowsEquals(() => instance.exports.rethrow_exnref(), exception);
+})();
+
+// Test loading an exported mutable "exnref" being changed from the outside.
+(function TestGlobalExnRefGetExportedMutableAndRethrow() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let g = builder.addGlobal(kWasmExnRef, true).exportAs("exn");
+  builder.addFunction('rethrow_exnref', kSig_v_v)
+      .addBody([
+        kExprGetGlobal, g.index,
+        kExprRethrow,
+      ]).exportFunc();
+  let instance = builder.instantiate();
+
+  let exception1 = instance.exports.exn.value = "my fancy exception";
+  assertThrowsEquals(() => instance.exports.rethrow_exnref(), exception1);
+  let exception2 = instance.exports.exn.value = "an even fancier exception";
+  assertThrowsEquals(() => instance.exports.rethrow_exnref(), exception2);
+})();
+
+// TODO(mstarzinger): Add the following test once proposal makes it clear how
+// far interaction with the mutable globals proposal is intended to go.
+// Test loading an imported mutable "exnref" being changed from the outside.
+/*(function TestGlobalExnRefGetImportedMutableAndRethrow() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let g_index = builder.addImportedGlobal("m", "exn", kWasmExnRef, true);
+  builder.addFunction('rethrow_exnref', kSig_v_v)
+      .addBody([
+        kExprGetGlobal, g_index,
+        kExprRethrow,
+      ]).exportFunc();
+  let exception1 = "my fancy exception";
+  let desc = { value: 'exnref', mutable: true };
+  let mutable_global = new WebAssembly.Global(desc, exception1);
+  let instance = builder.instantiate({ "m": { "exn": mutable_global }});
+
+  assertThrowsEquals(() => instance.exports.rethrow_exnref(), exception1);
+  let exception2 = mutable_global.value = "an even fancier exception";
+  assertThrowsEquals(() => instance.exports.rethrow_exnref(), exception2);
+})();*/
+
+// Test custom initialization index for a global "exnref" variable.
+(function TestGlobalExnRefInitIndex() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let g1_index = builder.addImportedGlobal("m", "exn", kWasmExnRef);
+  let g2 = builder.addGlobal(kWasmExnRef);
+  g2.init_index = g1_index;  // Initialize {g2} to equal {g1}.
+  builder.addFunction('push_and_return_exnref', kSig_e_v)
+      .addBody([kExprGetGlobal, g2.index])
+      .exportFunc();
+  let exception = { x: "my fancy exception" };
+  let instance = builder.instantiate({ "m": { "exn": exception }});
+
+  assertSame(exception, instance.exports.push_and_return_exnref());
+})();
diff --git a/src/v8/test/mjsunit/wasm/exceptions-import.js b/src/v8/test/mjsunit/wasm/exceptions-import.js
new file mode 100644
index 0000000..bf6d5ee
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/exceptions-import.js
@@ -0,0 +1,95 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --experimental-wasm-eh
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+// Helper function to return a new exported exception with the {kSig_v_v} type
+// signature from an anonymous module. The underlying module is thrown away.
+// This allows tests to reason solely about importing exceptions.
+function NewExportedException() {
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_v);
+  builder.addExportOfKind("ex", kExternalException, except);
+  let instance = builder.instantiate();
+  return instance.exports.ex;
+}
+
+(function TestImportSimple() {
+  print(arguments.callee.name);
+  let exported = NewExportedException();
+  let builder = new WasmModuleBuilder();
+  let except = builder.addImportedException("m", "ex", kSig_v_v);
+
+  assertDoesNotThrow(() => builder.instantiate({ m: { ex: exported }}));
+})();
+
+(function TestImportMultiple() {
+  print(arguments.callee.name);
+  let exported = NewExportedException();
+  let builder = new WasmModuleBuilder();
+  let except1 = builder.addImportedException("m", "ex1", kSig_v_v);
+  let except2 = builder.addImportedException("m", "ex2", kSig_v_v);
+  let except3 = builder.addException(kSig_v_v);
+  builder.addExportOfKind("ex2", kExternalException, except2);
+  builder.addExportOfKind("ex3", kExternalException, except3);
+  let instance = builder.instantiate({ m: { ex1: exported, ex2: exported }});
+
+  assertTrue(except1 < except3 && except2 < except3);
+  assertEquals(undefined, instance.exports.ex1);
+  assertSame(exported, instance.exports.ex2);
+  assertNotSame(exported, instance.exports.ex3);
+})();
+
+(function TestImportMissing() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addImportedException("m", "ex", kSig_v_v);
+
+  assertThrows(
+      () => builder.instantiate({}), TypeError,
+      /module is not an object or function/);
+  assertThrows(
+      () => builder.instantiate({ m: {}}), WebAssembly.LinkError,
+      /exception import requires a WebAssembly.Exception/);
+})();
+
+(function TestImportValueMismatch() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addImportedException("m", "ex", kSig_v_v);
+
+  assertThrows(
+      () => builder.instantiate({ m: { ex: 23 }}), WebAssembly.LinkError,
+      /exception import requires a WebAssembly.Exception/);
+  assertThrows(
+      () => builder.instantiate({ m: { ex: {} }}), WebAssembly.LinkError,
+      /exception import requires a WebAssembly.Exception/);
+  var monkey = Object.create(NewExportedException());
+  assertThrows(
+      () => builder.instantiate({ m: { ex: monkey }}), WebAssembly.LinkError,
+      /exception import requires a WebAssembly.Exception/);
+})();
+
+(function TestImportSignatureMismatch() {
+  print(arguments.callee.name);
+  let exported = NewExportedException();
+  let builder = new WasmModuleBuilder();
+  let except = builder.addImportedException("m", "ex", kSig_v_i);
+
+  assertThrows(
+      () => builder.instantiate({ m: { ex: exported }}), WebAssembly.LinkError,
+      /imported exception does not match the expected type/);
+})();
+
+(function TestImportModuleGetImports() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addImportedException("m", "ex", kSig_v_v);
+  let module = new WebAssembly.Module(builder.toBuffer());
+
+  let imports = WebAssembly.Module.imports(module);
+  assertArrayEquals([{ module: "m", name: "ex", kind: "exception" }], imports);
+})();
diff --git a/src/v8/test/mjsunit/wasm/exceptions-interpreter.js b/src/v8/test/mjsunit/wasm/exceptions-interpreter.js
new file mode 100644
index 0000000..9393aad
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/exceptions-interpreter.js
@@ -0,0 +1,12 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --experimental-wasm-eh --allow-natives-syntax
+// Flags: --wasm-interpret-all
+
+// This is just a wrapper for existing exception handling test cases that runs
+// with the --wasm-interpret-all flag added. If we ever decide to add a test
+// variant for this, then we can remove this file.
+
+load("test/mjsunit/wasm/exceptions.js");
diff --git a/src/v8/test/mjsunit/wasm/exceptions-rethrow-interpreter.js b/src/v8/test/mjsunit/wasm/exceptions-rethrow-interpreter.js
new file mode 100644
index 0000000..42285ba
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/exceptions-rethrow-interpreter.js
@@ -0,0 +1,12 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --experimental-wasm-eh --allow-natives-syntax
+// Flags: --wasm-interpret-all
+
+// This is just a wrapper for existing exception handling test cases that runs
+// with the --wasm-interpret-all flag added. If we ever decide to add a test
+// variant for this, then we can remove this file.
+
+load("test/mjsunit/wasm/exceptions-rethrow.js");
diff --git a/src/v8/test/mjsunit/wasm/exceptions-rethrow.js b/src/v8/test/mjsunit/wasm/exceptions-rethrow.js
new file mode 100644
index 0000000..3b3fa36
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/exceptions-rethrow.js
@@ -0,0 +1,120 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --experimental-wasm-eh --allow-natives-syntax
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+load("test/mjsunit/wasm/exceptions-utils.js");
+
+// Test that rethrow expressions work inside catch blocks.
+(function TestRethrowInCatch() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_v);
+  builder.addFunction("rethrow0", kSig_v_v)
+      .addBody([
+        kExprTry, kWasmStmt,
+          kExprThrow, except,
+        kExprCatch,
+          kExprRethrow,
+        kExprEnd,
+  ]).exportFunc();
+  builder.addFunction("rethrow1", kSig_i_i)
+      .addLocals({except_count: 1})
+      .addBody([
+        kExprTry, kWasmI32,
+          kExprThrow, except,
+        kExprCatch,
+          kExprSetLocal, 1,
+          kExprGetLocal, 0,
+          kExprI32Eqz,
+          kExprIf, kWasmStmt,
+            kExprGetLocal, 1,
+            kExprRethrow,
+          kExprEnd,
+          kExprI32Const, 23,
+        kExprEnd
+  ]).exportFunc();
+  let instance = builder.instantiate();
+
+  assertWasmThrows(instance, except, [], () => instance.exports.rethrow0());
+  assertWasmThrows(instance, except, [], () => instance.exports.rethrow1(0));
+  assertEquals(23, instance.exports.rethrow1(1));
+})();
+
+// Test that rethrow expressions work properly even in the presence of multiple
+// nested handlers being involved.
+(function TestRethrowNested() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except1 = builder.addException(kSig_v_v);
+  let except2 = builder.addException(kSig_v_v);
+  builder.addFunction("rethrow_nested", kSig_i_i)
+      .addLocals({except_count: 2})
+      .addBody([
+        kExprTry, kWasmI32,
+          kExprThrow, except2,
+        kExprCatch,
+          kExprSetLocal, 2,
+          kExprTry, kWasmI32,
+            kExprThrow, except1,
+          kExprCatch,
+            kExprSetLocal, 1,
+            kExprGetLocal, 0,
+            kExprI32Const, 0,
+            kExprI32Eq,
+            kExprIf, kWasmStmt,
+              kExprGetLocal, 1,
+              kExprRethrow,
+            kExprEnd,
+            kExprGetLocal, 0,
+            kExprI32Const, 1,
+            kExprI32Eq,
+            kExprIf, kWasmStmt,
+              kExprGetLocal, 2,
+              kExprRethrow,
+            kExprEnd,
+            kExprI32Const, 23,
+          kExprEnd,
+        kExprEnd,
+  ]).exportFunc();
+  let instance = builder.instantiate();
+
+  assertWasmThrows(instance, except1, [], () => instance.exports.rethrow_nested(0));
+  assertWasmThrows(instance, except2, [], () => instance.exports.rethrow_nested(1));
+  assertEquals(23, instance.exports.rethrow_nested(2));
+})();
+
+// Test that an exception being rethrow can be caught by another local catch
+// block in the same function without ever unwinding the activation.
+(function TestRethrowRecatch() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_v);
+  builder.addFunction("rethrow_recatch", kSig_i_i)
+      .addLocals({except_count: 1})
+      .addBody([
+        kExprTry, kWasmI32,
+          kExprThrow, except,
+        kExprCatch,
+          kExprSetLocal, 1,
+          kExprTry, kWasmI32,
+            kExprGetLocal, 0,
+            kExprI32Eqz,
+            kExprIf, kWasmStmt,
+              kExprGetLocal, 1,
+              kExprRethrow,
+            kExprEnd,
+            kExprI32Const, 42,
+          kExprCatch,
+            kExprDrop,
+            kExprI32Const, 23,
+          kExprEnd,
+        kExprEnd,
+  ]).exportFunc();
+  let instance = builder.instantiate();
+
+  assertEquals(23, instance.exports.rethrow_recatch(0));
+  assertEquals(42, instance.exports.rethrow_recatch(1));
+})();
diff --git a/src/v8/test/mjsunit/wasm/exceptions-shared.js b/src/v8/test/mjsunit/wasm/exceptions-shared.js
new file mode 100644
index 0000000..4883590
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/exceptions-shared.js
@@ -0,0 +1,165 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --experimental-wasm-eh
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+// Helper function to return a new exported exception with the {kSig_v_v} type
+// signature from an anonymous module. The underlying module is thrown away.
+function NewExportedException() {
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_v);
+  builder.addExportOfKind("ex", kExternalException, except);
+  let instance = builder.instantiate();
+  return instance.exports.ex;
+}
+
+// Check that an instance matches an exception thrown by itself, even when the
+// exception is re-thrown by a regular JavaScript function.
+(function TestSingleInstance() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let sig_index = builder.addType(kSig_v_v);
+  let fun = builder.addImport("m", "f", sig_index);
+  let except = builder.addException(kSig_v_v);
+  builder.addFunction("throw", kSig_v_v)
+      .addBody([
+        kExprThrow, except
+      ]).exportFunc();
+  builder.addFunction("catch", kSig_v_v)
+      .addBody([
+        kExprTry, kWasmStmt,
+          kExprCallFunction, fun,
+        kExprCatch,
+          kExprBrOnExn, 0, except,
+          kExprRethrow,
+        kExprEnd,
+      ]).exportFunc();
+  let ex_obj = new Error("my exception");
+  let instance = builder.instantiate({ m: { f: function() { throw ex_obj }}});
+
+  assertThrows(() => instance.exports.throw(), WebAssembly.RuntimeError);
+  assertThrowsEquals(() => instance.exports.catch(), ex_obj);
+  try {
+    instance.exports.throw();
+  } catch (e) {
+    ex_obj = e;
+  }
+  assertDoesNotThrow(() => instance.exports.catch());
+})();
+
+// Check that two instances distinguish their individual exceptions if they are
+// not shared, even when declared by the same underlying module.
+(function TestMultiInstanceNonShared() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let sig_index = builder.addType(kSig_v_v);
+  let fun = builder.addImport("m", "f", sig_index);
+  let except = builder.addException(kSig_v_v);
+  builder.addFunction("throw", kSig_v_v)
+      .addBody([
+        kExprThrow, except
+      ]).exportFunc();
+  builder.addFunction("catch", kSig_v_v)
+      .addBody([
+        kExprTry, kWasmStmt,
+          kExprCallFunction, fun,
+        kExprCatch,
+          kExprBrOnExn, 0, except,
+          kExprRethrow,
+        kExprEnd,
+      ]).exportFunc();
+  let ex_obj = new Error("my exception");
+  let instance1 = builder.instantiate({ m: { f: assertUnreachable }});
+  let instance2 = builder.instantiate({ m: { f: function() { throw ex_obj }}});
+
+  assertThrows(() => instance1.exports.throw(), WebAssembly.RuntimeError);
+  assertThrowsEquals(() => instance2.exports.catch(), ex_obj);
+  try {
+    instance1.exports.throw();
+  } catch (e) {
+    ex_obj = e;
+  }
+  assertThrowsEquals(() => instance2.exports.catch(), ex_obj);
+})();
+
+// Check that two instances match their exceptions if they are shared properly,
+// even if the local exception index of export and import is different.
+(function TestMultiInstanceShared() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let sig_index = builder.addType(kSig_v_v);
+  let fun = builder.addImport("m", "f", sig_index);
+  let except1 = builder.addImportedException("m", "ex1", kSig_v_v);
+  let except2 = builder.addException(kSig_v_v);
+  builder.addExportOfKind("ex2", kExternalException, except2);
+  builder.addFunction("throw", kSig_v_v)
+      .addBody([
+        kExprThrow, except2
+      ]).exportFunc();
+  builder.addFunction("catch", kSig_v_v)
+      .addBody([
+        kExprTry, kWasmStmt,
+          kExprCallFunction, fun,
+        kExprCatch,
+          kExprBrOnExn, 0, except1,
+          kExprRethrow,
+        kExprEnd,
+      ]).exportFunc();
+  let ex_obj = new Error("my exception");
+  let instance1 = builder.instantiate({ m: { f: assertUnreachable,
+                                             ex1: NewExportedException() }});
+  let instance2 = builder.instantiate({ m: { f: function() { throw ex_obj },
+                                             ex1: instance1.exports.ex2 }});
+
+  assertThrows(() => instance1.exports.throw(), WebAssembly.RuntimeError);
+  assertThrowsEquals(() => instance2.exports.catch(), ex_obj);
+  try {
+    instance1.exports.throw();
+  } catch (e) {
+    ex_obj = e;
+  }
+  assertDoesNotThrow(() => instance2.exports.catch());
+})();
+
+// Check that two instances based on different modules match their exceptions if
+// they are shared properly, even if the local exception index is different.
+(function TestMultiModuleShared() {
+  print(arguments.callee.name);
+  let builder1 = new WasmModuleBuilder();
+  let except1 = builder1.addException(kSig_v_v);
+  let except2 = builder1.addException(kSig_v_v);
+  builder1.addExportOfKind("ex", kExternalException, except2);
+  builder1.addFunction("throw", kSig_v_v)
+      .addBody([
+        kExprThrow, except2
+      ]).exportFunc();
+  let builder2 = new WasmModuleBuilder();
+  let sig_index = builder2.addType(kSig_v_v);
+  let fun = builder2.addImport("m", "f", sig_index);
+  let except = builder2.addImportedException("m", "ex", kSig_v_v);
+  builder2.addFunction("catch", kSig_v_v)
+      .addBody([
+        kExprTry, kWasmStmt,
+          kExprCallFunction, fun,
+        kExprCatch,
+          kExprBrOnExn, 0, except,
+          kExprRethrow,
+        kExprEnd,
+      ]).exportFunc();
+  let ex_obj = new Error("my exception");
+  let instance1 = builder1.instantiate();
+  let instance2 = builder2.instantiate({ m: { f: function() { throw ex_obj },
+                                              ex: instance1.exports.ex }});
+
+  assertThrows(() => instance1.exports.throw(), WebAssembly.RuntimeError);
+  assertThrowsEquals(() => instance2.exports.catch(), ex_obj);
+  try {
+    instance1.exports.throw();
+  } catch (e) {
+    ex_obj = e;
+  }
+  assertDoesNotThrow(() => instance2.exports.catch());
+})();
diff --git a/src/v8/test/mjsunit/wasm/exceptions-simd-interpreter.js b/src/v8/test/mjsunit/wasm/exceptions-simd-interpreter.js
new file mode 100644
index 0000000..7fd4e60
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/exceptions-simd-interpreter.js
@@ -0,0 +1,12 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --experimental-wasm-eh --experimental-wasm-simd --allow-natives-syntax
+// Flags: --wasm-interpret-all
+
+// This is just a wrapper for existing exception handling test cases that runs
+// with the --wasm-interpret-all flag added. If we ever decide to add a test
+// variant for this, then we can remove this file.
+
+load("test/mjsunit/wasm/exceptions-simd.js");
diff --git a/src/v8/test/mjsunit/wasm/exceptions-simd.js b/src/v8/test/mjsunit/wasm/exceptions-simd.js
new file mode 100644
index 0000000..ed16a7f
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/exceptions-simd.js
@@ -0,0 +1,50 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --experimental-wasm-eh --experimental-wasm-simd --allow-natives-syntax
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+load("test/mjsunit/wasm/exceptions-utils.js");
+
+(function TestThrowS128Default() {
+  var builder = new WasmModuleBuilder();
+  var kSig_v_s = makeSig([kWasmS128], []);
+  var except = builder.addException(kSig_v_s);
+  builder.addFunction("throw_simd", kSig_v_v)
+      .addLocals({s128_count: 1})
+      .addBody([
+        kExprGetLocal, 0,
+        kExprThrow, 0,
+      ])
+      .exportFunc();
+  var instance = builder.instantiate();
+
+  assertWasmThrows(instance, except, [0, 0, 0, 0, 0, 0, 0, 0],
+                   () => instance.exports.throw_simd());
+})();
+
+(function TestThrowCatchS128Default() {
+  var builder = new WasmModuleBuilder();
+  var kSig_v_s = makeSig([kWasmS128], []);
+  var except = builder.addException(kSig_v_s);
+  builder.addFunction("throw_catch_simd", kSig_i_v)
+      .addLocals({s128_count: 1})
+      .addBody([
+        kExprTry, kWasmS128,
+          kExprGetLocal, 0,
+          kExprThrow, 0,
+        kExprCatch,
+          kExprBrOnExn, 0, except,
+          kExprRethrow,
+        kExprEnd,
+        // TODO(mstarzinger): Actually return some compressed form of the s128
+        // value here to make sure it is extracted properly from the exception.
+        kExprDrop,
+        kExprI32Const, 1,
+      ])
+      .exportFunc();
+  var instance = builder.instantiate();
+
+  assertEquals(1, instance.exports.throw_catch_simd());
+})();
diff --git a/src/v8/test/mjsunit/wasm/exceptions-utils.js b/src/v8/test/mjsunit/wasm/exceptions-utils.js
new file mode 100644
index 0000000..344ca64
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/exceptions-utils.js
@@ -0,0 +1,28 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// This file is intended to be loaded by other tests to provide utility methods
+// requiring natives syntax (and hence not suited for the mjsunit.js file).
+
+function assertWasmThrows(instance, runtime_id, values, code) {
+  try {
+    if (typeof code === 'function') {
+      code();
+    } else {
+      eval(code);
+    }
+  } catch (e) {
+    assertInstanceof(e, WebAssembly.RuntimeError);
+    var e_runtime_id = %GetWasmExceptionId(e, instance);
+    assertTrue(Number.isInteger(e_runtime_id));
+    assertEquals(e_runtime_id, runtime_id);
+    var e_values = %GetWasmExceptionValues(e);
+    assertArrayEquals(values, e_values);
+    return;  // Success.
+  }
+  throw new MjsUnitAssertionError('Did not throw expected <' + runtime_id +
+                                  '> with values: ' + values);
+}
diff --git a/src/v8/test/mjsunit/wasm/exceptions.js b/src/v8/test/mjsunit/wasm/exceptions.js
index 74d8e7d..7d53037 100644
--- a/src/v8/test/mjsunit/wasm/exceptions.js
+++ b/src/v8/test/mjsunit/wasm/exceptions.js
@@ -1,298 +1,347 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
+// Copyright 2018 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-wasm --experimental-wasm-eh
+// Flags: --expose-wasm --experimental-wasm-eh --allow-natives-syntax
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
+load("test/mjsunit/wasm/exceptions-utils.js");
+
+// First we just test that "exnref" local variables are allowed.
+(function TestLocalExnRef() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("push_and_drop_exnref", kSig_v_v)
+      .addLocals({except_count: 1})
+      .addBody([
+        kExprGetLocal, 0,
+        kExprDrop,
+      ]).exportFunc();
+  let instance = builder.instantiate();
+
+  assertDoesNotThrow(instance.exports.push_and_drop_exnref);
+})();
 
 // The following method doesn't attempt to catch an raised exception.
-var test_throw = (function () {
-  var builder = new WasmModuleBuilder();
-
-  builder.addException(kSig_v_v);
-
+(function TestThrowSimple() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_v);
   builder.addFunction("throw_if_param_not_zero", kSig_i_i)
       .addBody([
         kExprGetLocal, 0,
         kExprI32Const, 0,
         kExprI32Ne,
         kExprIf, kWasmStmt,
-          kExprThrow, 0,
+          kExprThrow, except,
         kExprEnd,
         kExprI32Const, 1
       ]).exportFunc();
+  let instance = builder.instantiate();
 
-  return builder.instantiate();
+  assertEquals(1, instance.exports.throw_if_param_not_zero(0));
+  assertWasmThrows(instance, except, [], () => instance.exports.throw_if_param_not_zero(10));
+  assertWasmThrows(instance, except, [], () => instance.exports.throw_if_param_not_zero(-1));
 })();
 
-// Check the test_throw exists.
-assertFalse(test_throw === undefined);
-assertFalse(test_throw === null);
-assertFalse(test_throw === 0);
-assertEquals("object", typeof test_throw.exports);
-assertEquals("function", typeof test_throw.exports.throw_if_param_not_zero);
+// Test that empty try/catch blocks work.
+(function TestCatchEmptyBlocks() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("catch_empty_try", kSig_v_v)
+      .addBody([
+        kExprTry, kWasmStmt,
+        kExprCatch,
+          kExprDrop,
+        kExprEnd,
+      ]).exportFunc();
+  let instance = builder.instantiate();
 
-// Test expected behavior of throws
-assertEquals(1, test_throw.exports.throw_if_param_not_zero(0));
-assertWasmThrows(0, [], function() { test_throw.exports.throw_if_param_not_zero(10) });
-assertWasmThrows(0, [], function() { test_throw.exports.throw_if_param_not_zero(-1) });
+  assertDoesNotThrow(instance.exports.catch_empty_try);
+})();
 
 // Now that we know throwing works, we test catching the exceptions we raise.
-var test_catch = (function () {
-  var builder = new WasmModuleBuilder();
-
-  builder.addException(kSig_v_v);
+(function TestCatchSimple() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_v);
   builder.addFunction("simple_throw_catch_to_0_1", kSig_i_i)
       .addBody([
         kExprTry, kWasmI32,
           kExprGetLocal, 0,
           kExprI32Eqz,
           kExprIf, kWasmStmt,
-            kExprThrow, 0,
+            kExprThrow, except,
           kExprEnd,
-          kExprI32Const, 1,
-        kExprCatch, 0,
-          kExprI32Const, 0,
+          kExprI32Const, 42,
+        kExprCatch,
+          kExprDrop,
+          kExprI32Const, 23,
         kExprEnd
       ]).exportFunc();
+  let instance = builder.instantiate();
 
-  return builder.instantiate();
+  assertEquals(23, instance.exports.simple_throw_catch_to_0_1(0));
+  assertEquals(42, instance.exports.simple_throw_catch_to_0_1(1));
 })();
 
-// Check the test_catch exists.
-assertFalse(test_catch === undefined);
-assertFalse(test_catch === null);
-assertFalse(test_catch === 0);
-assertEquals("object", typeof test_catch.exports);
-assertEquals("function", typeof test_catch.exports.simple_throw_catch_to_0_1);
-
-// Test expected behavior of simple catch.
-assertEquals(0, test_catch.exports.simple_throw_catch_to_0_1(0));
-assertEquals(1, test_catch.exports.simple_throw_catch_to_0_1(1));
-
-// Test that we can distinguish which exception was thrown.
-var test_catch_2 = (function () {
-  var builder = new WasmModuleBuilder();
-
-  builder.addException(kSig_v_v);
-  builder.addException(kSig_v_v);
-  builder.addException(kSig_v_v);
-  builder.addFunction("catch_different_exceptions", kSig_i_i)
+// Test that we can distinguish which exception was thrown by using a cascaded
+// sequence of nested try blocks with a single handler in each catch block.
+(function TestCatchComplex1() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except1 = builder.addException(kSig_v_v);
+  let except2 = builder.addException(kSig_v_v);
+  let except3 = builder.addException(kSig_v_v);
+  builder.addFunction("catch_complex", kSig_i_i)
       .addBody([
-        kExprTry, kWasmI32,
-          kExprTry, kWasmI32,
+        kExprBlock, kWasmStmt,
+          kExprBlock, kWasmStmt,
+            kExprTry, kWasmStmt,
+              kExprTry, kWasmStmt,
+                kExprGetLocal, 0,
+                kExprI32Eqz,
+                kExprIf, kWasmStmt,
+                  kExprThrow, except1,
+                kExprElse,
+                  kExprGetLocal, 0,
+                  kExprI32Const, 1,
+                  kExprI32Eq,
+                  kExprIf, kWasmStmt,
+                    kExprThrow, except2,
+                  kExprElse,
+                    kExprThrow, except3,
+                  kExprEnd,
+                kExprEnd,
+                kExprI32Const, 2,
+                kExprReturn,
+              kExprCatch,
+                kExprBrOnExn, 2, except1,
+                kExprRethrow,
+              kExprEnd,
+            kExprCatch,
+              kExprBrOnExn, 2, except2,
+              kExprRethrow,
+            kExprEnd,
+          kExprEnd,
+          kExprI32Const, 3,
+          kExprReturn,
+        kExprEnd,
+        kExprI32Const, 4,
+      ]).exportFunc();
+  let instance = builder.instantiate();
+
+  assertEquals(3, instance.exports.catch_complex(0));
+  assertEquals(4, instance.exports.catch_complex(1));
+  assertWasmThrows(instance, except3, [], () => instance.exports.catch_complex(2));
+})();
+
+// Test that we can distinguish which exception was thrown by using a single
+// try block with multiple handlers in the associated catch block.
+(function TestCatchComplex2() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except1 = builder.addException(kSig_v_v);
+  let except2 = builder.addException(kSig_v_v);
+  let except3 = builder.addException(kSig_v_v);
+  builder.addFunction("catch_complex", kSig_i_i)
+      .addBody([
+        kExprBlock, kWasmStmt,
+          kExprBlock, kWasmStmt,
+            kExprTry, kWasmStmt,
+              kExprGetLocal, 0,
+              kExprI32Eqz,
+              kExprIf, kWasmStmt,
+                kExprThrow, except1,
+              kExprElse,
+                kExprGetLocal, 0,
+                kExprI32Const, 1,
+                kExprI32Eq,
+                kExprIf, kWasmStmt,
+                  kExprThrow, except2,
+                kExprElse,
+                  kExprThrow, except3,
+                kExprEnd,
+              kExprEnd,
+              kExprI32Const, 2,
+              kExprReturn,
+            kExprCatch,
+              kExprBrOnExn, 1, except1,
+              kExprBrOnExn, 2, except2,
+              kExprRethrow,
+            kExprEnd,
+          kExprEnd,
+          kExprI32Const, 3,
+          kExprReturn,
+        kExprEnd,
+        kExprI32Const, 4,
+      ]).exportFunc();
+  let instance = builder.instantiate();
+
+  assertEquals(3, instance.exports.catch_complex(0));
+  assertEquals(4, instance.exports.catch_complex(1));
+  assertWasmThrows(instance, except3, [], () => instance.exports.catch_complex(2));
+})();
+
+// Test that br-on-exn also is allowed to consume values already present on the
+// operand stack, instead of solely values being pushed by the branch itself.
+(function TestCatchBranchWithValueOnStack() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_v);
+  builder.addFunction("catch_complex", kSig_i_i)
+      .addLocals({except_count: 1})
+      .addBody([
+        kExprBlock, kWasmI32,
+          kExprTry, kWasmStmt,
             kExprGetLocal, 0,
             kExprI32Eqz,
             kExprIf, kWasmStmt,
-              kExprThrow, 0,
-            kExprElse,
-              kExprGetLocal, 0,
-              kExprI32Const, 1,
-              kExprI32Eq,
-              kExprIf, kWasmStmt,
-                kExprThrow, 1,
-              kExprElse,
-                kExprThrow, 2,
-              kExprEnd,
+              kExprThrow, except,
             kExprEnd,
-            kExprI32Const, 2,
-          kExprCatch, 0,
-            kExprI32Const, 3,
+          kExprCatch,
+            kExprSetLocal, 1,
+            kExprI32Const, 23,
+            kExprGetLocal, 1,
+            kExprBrOnExn, 1, except,
+            kExprRethrow,
           kExprEnd,
-        kExprCatch, 1,
-          kExprI32Const, 4,
-        kExprEnd
+          kExprI32Const, 42,
+        kExprEnd,
       ]).exportFunc();
-  return builder.instantiate();
+  let instance = builder.instantiate();
+
+  assertEquals(23, instance.exports.catch_complex(0));
+  assertEquals(42, instance.exports.catch_complex(1));
 })();
 
-assertFalse(test_catch_2 === undefined);
-assertFalse(test_catch_2 === null);
-assertFalse(test_catch_2 === 0);
-assertEquals("object", typeof test_catch_2.exports);
-assertEquals("function", typeof test_catch_2.exports.catch_different_exceptions);
-
-assertEquals(3, test_catch_2.exports.catch_different_exceptions(0));
-assertEquals(4, test_catch_2.exports.catch_different_exceptions(1));
-assertWasmThrows(2, [], function() { test_catch_2.exports.catch_different_exceptions(2) });
-
 // Test throwing an exception with multiple values.
-var test_throw_1_2 = (function() {
-  var builder = new WasmModuleBuilder();
-  builder.addException(kSig_v_ii);
+(function TestThrowMultipleValues() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_ii);
   builder.addFunction("throw_1_2", kSig_v_v)
       .addBody([
         kExprI32Const, 1,
         kExprI32Const, 2,
-        kExprThrow, 0,
+        kExprThrow, except,
       ]).exportFunc();
+  let instance = builder.instantiate();
 
-  return builder.instantiate();
+  assertWasmThrows(instance, except, [0, 1, 0, 2], () => instance.exports.throw_1_2());
 })();
 
-assertFalse(test_throw_1_2 === undefined);
-assertFalse(test_throw_1_2 === null);
-assertFalse(test_throw_1_2 === 0);
-assertEquals("object", typeof test_throw_1_2.exports);
-assertEquals("function", typeof test_throw_1_2.exports.throw_1_2);
-
-assertWasmThrows(0, [0, 1, 0, 2], function() { test_throw_1_2.exports.throw_1_2(); });
-
 // Test throwing/catching the i32 parameter value.
-var test_throw_catch_param_i = (function () {
-  var builder = new WasmModuleBuilder();
-  builder.addException(kSig_v_i);
+(function TestThrowCatchParamI() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_i);
   builder.addFunction("throw_catch_param", kSig_i_i)
       .addBody([
         kExprTry, kWasmI32,
           kExprGetLocal, 0,
-          kExprThrow, 0,
+          kExprThrow, except,
           kExprI32Const, 2,
-        kExprCatch, 0,
-          kExprReturn,
+        kExprCatch,
+          kExprBrOnExn, 0, except,
+          kExprRethrow,
         kExprEnd,
       ]).exportFunc();
+  let instance = builder.instantiate();
 
-  return builder.instantiate();
+  assertEquals(0, instance.exports.throw_catch_param(0));
+  assertEquals(1, instance.exports.throw_catch_param(1));
+  assertEquals(10, instance.exports.throw_catch_param(10));
 })();
 
-assertFalse(test_throw_catch_param_i === undefined);
-assertFalse(test_throw_catch_param_i === null);
-assertFalse(test_throw_catch_param_i === 0);
-assertEquals("object", typeof test_throw_catch_param_i.exports);
-assertEquals("function",
-             typeof test_throw_catch_param_i.exports.throw_catch_param);
-
-assertEquals(0, test_throw_catch_param_i.exports.throw_catch_param(0));
-assertEquals(1, test_throw_catch_param_i.exports.throw_catch_param(1));
-assertEquals(10, test_throw_catch_param_i.exports.throw_catch_param(10));
-
 // Test the encoding of a thrown exception with an integer exception.
-
-var test_throw_param_i = (function () {
-  var builder = new WasmModuleBuilder();
-  builder.addException(kSig_v_i);
+(function TestThrowParamI() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_i);
   builder.addFunction("throw_param", kSig_v_i)
       .addBody([
         kExprGetLocal, 0,
-        kExprThrow, 0,
+        kExprThrow, except,
       ]).exportFunc();
+  let instance = builder.instantiate();
 
-  return builder.instantiate();
+  assertWasmThrows(instance, except, [0, 5], () => instance.exports.throw_param(5));
+  assertWasmThrows(instance, except, [6, 31026], () => instance.exports.throw_param(424242));
 })();
 
-assertFalse(test_throw_param_i === undefined);
-assertFalse(test_throw_param_i === null);
-assertFalse(test_throw_param_i === 0);
-assertEquals("object", typeof test_throw_param_i.exports);
-assertEquals("function",
-             typeof test_throw_param_i.exports.throw_param);
-
-assertWasmThrows(0, [0, 5], function() { test_throw_param_i.exports.throw_param(5); });
-assertWasmThrows(0, [6, 31026],
-                 function() { test_throw_param_i.exports.throw_param(424242); });
-
 // Test throwing/catching the f32 parameter value.
-var test_throw_catch_param_f = (function () {
-  var builder = new WasmModuleBuilder();
-  builder.addException(kSig_v_f);
+(function TestThrowCatchParamF() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_f);
   builder.addFunction("throw_catch_param", kSig_f_f)
       .addBody([
         kExprTry, kWasmF32,
           kExprGetLocal, 0,
-          kExprThrow, 0,
+          kExprThrow, except,
           kExprF32Const, 0, 0, 0, 0,
-        kExprCatch, 0,
-          kExprReturn,
+        kExprCatch,
+          kExprBrOnExn, 0, except,
+          kExprRethrow,
         kExprEnd,
       ]).exportFunc();
+  let instance = builder.instantiate();
 
-  return builder.instantiate();
+  assertEquals(5.0, instance.exports.throw_catch_param(5.0));
+  assertEquals(10.5, instance.exports.throw_catch_param(10.5));
 })();
 
-assertFalse(test_throw_catch_param_f === undefined);
-assertFalse(test_throw_catch_param_f === null);
-assertFalse(test_throw_catch_param_f === 0);
-assertEquals("object", typeof test_throw_catch_param_f.exports);
-assertEquals("function",
-             typeof test_throw_catch_param_f.exports.throw_catch_param);
-
-assertEquals(5.0, test_throw_catch_param_f.exports.throw_catch_param(5.0));
-assertEquals(10.5, test_throw_catch_param_f.exports.throw_catch_param(10.5));
-
 // Test the encoding of a thrown exception with a float value.
-
-var test_throw_param_f = (function () {
-  var builder = new WasmModuleBuilder();
-  builder.addException(kSig_v_f);
+(function TestThrowParamF() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_f);
   builder.addFunction("throw_param", kSig_v_f)
       .addBody([
         kExprGetLocal, 0,
-        kExprThrow, 0,
+        kExprThrow, except,
       ]).exportFunc();
+  let instance = builder.instantiate();
 
-  return builder.instantiate();
+  assertWasmThrows(instance, except, [16544, 0], () => instance.exports.throw_param(5.0));
+  assertWasmThrows(instance, except, [16680, 0], () => instance.exports.throw_param(10.5));
 })();
 
-assertFalse(test_throw_param_f === undefined);
-assertFalse(test_throw_param_f === null);
-assertFalse(test_throw_param_f === 0);
-assertEquals("object", typeof test_throw_param_f.exports);
-assertEquals("function",
-             typeof test_throw_param_f.exports.throw_param);
-
-assertWasmThrows(0, [16544, 0],
-                 function() { test_throw_param_f.exports.throw_param(5.0); });
-assertWasmThrows(0, [16680, 0],
-                 function() { test_throw_param_f.exports.throw_param(10.5); });
-
 // Test throwing/catching an I64 value
-var test_throw_catch_param_l = (function () {
-  var builder = new WasmModuleBuilder();
-  builder.addException(kSig_v_l);
+(function TestThrowCatchParamL() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_l);
   builder.addFunction("throw_catch_param", kSig_i_i)
+      .addLocals({i64_count: 1})
       .addBody([
         kExprGetLocal, 0,
         kExprI64UConvertI32,
         kExprSetLocal, 1,
-        kExprTry, kWasmI32,
+        kExprTry, kWasmI64,
           kExprGetLocal, 1,
-          kExprThrow, 0,
-          kExprI32Const, 2,
-        kExprCatch, 0,
-          kExprGetLocal, 1,
-          kExprI64Eq,
-          kExprIf, kWasmI32,
-            kExprI32Const, 1,
-          kExprElse,
-            kExprI32Const, 0,
-          kExprEnd,
-          // TODO(kschimpf): Why is this return necessary?
-          kExprReturn,
+          kExprThrow, except,
+          kExprI64Const, 23,
+        kExprCatch,
+          kExprBrOnExn, 0, except,
+          kExprRethrow,
         kExprEnd,
-      ]).addLocals({i64_count: 1}).exportFunc();
+        kExprGetLocal, 1,
+        kExprI64Eq,
+      ]).exportFunc();
+  let instance = builder.instantiate();
 
-  return builder.instantiate();
+  assertEquals(1, instance.exports.throw_catch_param(5));
+  assertEquals(1, instance.exports.throw_catch_param(0));
+  assertEquals(1, instance.exports.throw_catch_param(-1));
 })();
 
-assertFalse(test_throw_catch_param_l === undefined);
-assertFalse(test_throw_catch_param_l === null);
-assertFalse(test_throw_catch_param_l === 0);
-assertEquals("object", typeof test_throw_catch_param_l.exports);
-assertEquals("function",
-             typeof test_throw_catch_param_l.exports.throw_catch_param);
-
-assertEquals(1, test_throw_catch_param_l.exports.throw_catch_param(5));
-assertEquals(1, test_throw_catch_param_l.exports.throw_catch_param(0));
-assertEquals(1, test_throw_catch_param_l.exports.throw_catch_param(-1));
-
 // Test the encoding of a thrown exception with an I64 value.
-
-var test_throw_param_l = (function () {
-  var builder = new WasmModuleBuilder();
-  builder.addException(kSig_v_l);
+(function TestThrowParamL() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_l);
   builder.addFunction("throw_param", kSig_v_ii)
       .addBody([
         kExprGetLocal, 0,
@@ -302,428 +351,398 @@
         kExprGetLocal, 1,
         kExprI64UConvertI32,
         kExprI64Ior,
-        kExprThrow, 0
+        kExprThrow, except,
       ]).exportFunc();
+  let instance = builder.instantiate();
 
-  return builder.instantiate();
+  assertWasmThrows(instance, except, [0, 10, 0, 5], () => instance.exports.throw_param(10, 5));
+  assertWasmThrows(instance, except, [65535, 65535, 0, 13], () => instance.exports.throw_param(-1, 13));
 })();
 
-assertFalse(test_throw_param_l === undefined);
-assertFalse(test_throw_param_l === null);
-assertFalse(test_throw_param_l === 0);
-assertEquals("object", typeof test_throw_param_l.exports);
-assertEquals("function",
-             typeof test_throw_param_l.exports.throw_param);
-
-assertWasmThrows(0, [0, 10, 0, 5],
-                 function() { test_throw_param_l.exports.throw_param(10, 5); });
-assertWasmThrows(0, [65535, 65535, 0, 13],
-                 function() { test_throw_param_l.exports.throw_param(-1, 13); });
-
 // Test throwing/catching the F64 parameter value
-var test_throw_catch_param_d = (function () {
-  var builder = new WasmModuleBuilder();
-  builder.addException(kSig_v_d);
+(function TestThrowCatchParamD() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_d);
   builder.addFunction("throw_catch_param", kSig_d_d)
       .addBody([
         kExprTry, kWasmF64,
           kExprGetLocal, 0,
-          kExprThrow, 0,
+          kExprThrow, except,
           kExprF64Const, 0, 0, 0, 0, 0, 0, 0, 0,
-        kExprCatch, 0,
-          kExprReturn,
+        kExprCatch,
+          kExprBrOnExn, 0, except,
+          kExprRethrow,
         kExprEnd,
       ]).exportFunc();
+  let instance = builder.instantiate();
 
-  return builder.instantiate();
+  assertEquals(5.0, instance.exports.throw_catch_param(5.0));
+  assertEquals(10.5, instance.exports.throw_catch_param(10.5));
 })();
 
-assertFalse(test_throw_catch_param_d === undefined);
-assertFalse(test_throw_catch_param_d === null);
-assertFalse(test_throw_catch_param_d === 0);
-assertEquals("object", typeof test_throw_catch_param_d.exports);
-assertEquals("function",
-             typeof test_throw_catch_param_d.exports.throw_catch_param);
-
-assertEquals(5.0, test_throw_catch_param_d.exports.throw_catch_param(5.0));
-assertEquals(10.5, test_throw_catch_param_d.exports.throw_catch_param(10.5));
-
 // Test the encoding of a thrown exception with an f64 value.
-
-var test_throw_param_d = (function () {
-  var builder = new WasmModuleBuilder();
-  builder.addException(kSig_v_d);
+(function TestThrowParamD() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_d);
   builder.addFunction("throw_param", kSig_v_f)
       .addBody([
         kExprGetLocal, 0,
         kExprF64ConvertF32,
-        kExprThrow, 0
+        kExprThrow, except,
       ]).exportFunc();
+  let instance = builder.instantiate();
 
-  return builder.instantiate();
+  assertWasmThrows(instance, except, [16404, 0, 0, 0], () => instance.exports.throw_param(5.0));
+  assertWasmThrows(instance, except, [16739, 4816, 0, 0], () => instance.exports.throw_param(10000000.5));
 })();
 
-assertFalse(test_throw_param_d === undefined);
-assertFalse(test_throw_param_d === null);
-assertFalse(test_throw_param_d === 0);
-assertEquals("object", typeof test_throw_param_d.exports);
-assertEquals("function",
-             typeof test_throw_param_d.exports.throw_param);
-
-assertWasmThrows(0, [16404, 0, 0, 0],
-                 function() { test_throw_param_d.exports.throw_param(5.0); });
-assertWasmThrows(0, [16739, 4816, 0, 0],
-                 function() { test_throw_param_d.exports.throw_param(10000000.5); });
-
-/* TODO(kschimpf) Convert these tests to work for the proposed exceptions.
-
-// The following methods do not attempt to catch the exception they raise.
-var test_throw = (function () {
-  var builder = new WasmModuleBuilder();
-
+// Test the encoding of a computed parameter value.
+(function TestThrowParamComputed() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_i);
   builder.addFunction("throw_expr_with_params", kSig_v_ddi)
-    .addBody([
-      // p2 * (p0 + min(p0, p1))|0 - 20
-      kExprGetLocal, 2,
-      kExprGetLocal, 0,
-      kExprGetLocal, 0,
-      kExprGetLocal, 1,
-      kExprF64Min,
-      kExprF64Add,
-      kExprI32SConvertF64,
-      kExprI32Mul,
-      kExprI32Const, 20,
-      kExprI32Sub,
-      kExprThrow,
-    ])
-    .exportFunc()
+      .addBody([
+        // p2 * (p0 + min(p0, p1))|0 - 20
+        kExprGetLocal, 2,
+        kExprGetLocal, 0,
+        kExprGetLocal, 0,
+        kExprGetLocal, 1,
+        kExprF64Min,
+        kExprF64Add,
+        kExprI32SConvertF64,
+        kExprI32Mul,
+        kExprI32Const, 20,
+        kExprI32Sub,
+        kExprThrow, except,
+      ]).exportFunc()
+  let instance = builder.instantiate();
 
-  return builder.instantiate();
+  assertWasmThrows(instance, except, [65535, 65536-8], () => instance.exports.throw_expr_with_params(1.5, 2.5, 4));
+  assertWasmThrows(instance, except, [0, 12], () => instance.exports.throw_expr_with_params(5.7, 2.5, 4));
 })();
 
-// Check the test_throw exists.
-assertFalse(test_throw === undefined);
-assertFalse(test_throw === null);
-assertFalse(test_throw === 0);
-assertEquals("object", typeof test_throw.exports);
-assertEquals("function", typeof test_throw.exports.throw_expr_with_params);
+// Now that we know catching works locally, we test catching exceptions that
+// cross function boundaries and/or raised by JavaScript.
+(function TestCatchCrossFunctions() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let except = builder.addException(kSig_v_i);
 
-assertEquals(1, test_throw.exports.throw_param_if_not_zero(0));
-assertWasmThrows(
-    -8, function() { test_throw.exports.throw_expr_with_params(1.5, 2.5, 4); });
-assertWasmThrows(
-    12, function() { test_throw.exports.throw_expr_with_params(5.7, 2.5, 4); });
+  // Helper function for throwing from JS. It is imported by the Wasm module
+  // as throw_i.
+  function throw_value(value) {
+    throw value;
+  }
+  let sig_index = builder.addType(kSig_v_i);
+  let kJSThrowI = builder.addImport("", "throw_i", sig_index);
 
-// Now that we know throwing works, we test catching the exceptions we raise.
-var test_catch = (function () {
-  var builder = new WasmModuleBuilder();
+  // Helper function that throws a string. Wasm should not catch it.
+  function throw_string() {
+    throw "use wasm";
+  }
+  sig_index = builder.addType(kSig_v_v);
+  let kJSThrowString = builder.addImport("", "throw_string", sig_index);
 
-    // Helper function for throwing from js. It is imported by the Wasm module
-    // as throw_i.
-    function throw_value(value) {
-      throw value;
-    }
-    var sig_index = builder.addType(kSig_v_i);
-    var kJSThrowI = builder.addImport("", "throw_i", sig_index);
+  // Helper function that throws undefined. Wasm should not catch it.
+  function throw_undefined() {
+    throw undefined;
+  }
+  let kJSThrowUndefined = builder.addImport("", "throw_undefined", sig_index);
 
-    // Helper function that throws a string. Wasm should not catch it.
-    function throw_string() {
-      throw "use wasm;";
-    }
-    sig_index = builder.addType(kSig_v_v);
-    var kJSThrowString = builder.addImport("", "throw_string", sig_index);
+  // Helper function that throws an fp. Wasm should not catch it.
+  function throw_fp() {
+    throw 10.5;
+  }
+  let kJSThrowFP = builder.addImport("", "throw_fp", sig_index);
 
-    // Helper function that throws undefined. Wasm should not catch it.
-    function throw_undefined() {
-      throw undefined;
-    }
-    var kJSThrowUndefined = builder.addImport("", "throw_undefined", sig_index);
+  // Helper function that throws a large number. Wasm should not catch it.
+  function throw_large() {
+    throw 1e+28;
+  }
+  let kJSThrowLarge = builder.addImport("", "throw_large", sig_index);
 
-    // Helper function that throws an fp. Wasm should not catch it.
-    function throw_fp() {
-      throw 10.5;
-    }
-    var kJSThrowFP = builder.addImport("", "throw_fp", sig_index);
-
-    // Helper function that throws a large number. Wasm should not catch it.
-    function throw_large() {
-      throw 1e+28;
-    }
-    var kJSThrowLarge = builder.addImport("", "throw_large", sig_index);
-
-    // Helper function for throwing from WebAssembly.
-    var kWasmThrowFunction =
-      builder.addFunction("throw", kSig_v_i)
-        .addBody([
-          kExprGetLocal, 0,
-          kExprThrow
-        ])
-        .index;
-
-    // Scenario 1: Throw and catch appear on the same function. This should
-    // happen in case of inlining, for example.
-    builder.addFunction("same_scope", kSig_i_i)
-      .addBody([
-        kExprTry, kWasmI32,
-          kExprGetLocal, 0,
-          kExprI32Const, 0,
-          kExprI32Ne,
-          kExprIf, kWasmStmt,
-            kExprGetLocal, 0,
-            kExprThrow,
-            kExprUnreachable,
-          kExprEnd,
-          kExprI32Const, 63,
-        kExprCatch, 1,
-          kExprGetLocal, 1,
-        kExprEnd
-      ])
-      .addLocals({i32_count: 1})
-      .exportFunc()
-      .index;
-
-    builder.addFunction("same_scope_ignore", kSig_i_i)
-      .addBody([
-          kExprTry, kWasmI32,
-            kExprGetLocal, 0,
-            kExprThrow,
-            kExprUnreachable,
-          kExprCatch, 1,
-            kExprGetLocal, 0,
-          kExprEnd,
-      ])
-      .addLocals({i32_count: 1})
-      .exportFunc();
-
-    builder.addFunction("same_scope_multiple", kSig_i_i)
-      // path = 0;
-      //
-      // try {
-      //   try {
-      //     try {
-      //       if (p == 1)
-      //         throw 1;
-      //       path |= 2
-      //     } catch (v) {
-      //       path |= v | 4;
-      //       throw path;
-      //     }
-      //     if (p == 2)
-      //       throw path|8;
-      //     path |= 16;
-      //   } catch (v) {
-      //     path |= v | 32;
-      //     throw path;
-      //   }
-      //   if (p == 3)
-      //     throw path|64;
-      //   path |= 128
-      // } catch (v) {
-      //   path |= v | 256;
-      // }
-      //
-      // return path;
-      //
-      // p == 1 -> path == 293
-      // p == 2 -> path == 298
-      // p == 3 -> path == 338
-      // else   -> path == 146
-      .addBody([
-          kExprTry, kWasmI32,
-            kExprTry, kWasmI32,
-              kExprTry, kWasmI32,
-                kExprGetLocal, 0,
-                kExprI32Const, 1,
-                kExprI32Eq,
-                kExprIf, kWasmStmt,
-                  kExprI32Const, 1,
-                  kExprThrow,
-                  kExprUnreachable,
-                kExprEnd,
-                kExprI32Const, 2,
-              kExprCatch, 1,
-                kExprGetLocal, 1,
-                kExprI32Const, 4,
-                kExprI32Ior,
-                kExprThrow,
-                kExprUnreachable,
-              kExprEnd,
-              kExprTeeLocal, 2,
-              kExprGetLocal, 0,
-              kExprI32Const, 2,
-              kExprI32Eq,
-              kExprIf, kWasmStmt,
-                kExprGetLocal, 2,
-                kExprI32Const, 8,
-                kExprI32Ior,
-                kExprThrow,
-                kExprUnreachable,
-              kExprEnd,
-              kExprI32Const, 16,
-              kExprI32Ior,
-            kExprCatch, 1,
-              kExprGetLocal, 1,
-              kExprI32Const, 32,
-              kExprI32Ior,
-              kExprThrow,
-              kExprUnreachable,
-            kExprEnd,
-            kExprTeeLocal, 2,
-            kExprGetLocal, 0,
-            kExprI32Const, 3,
-            kExprI32Eq,
-            kExprIf, kWasmStmt,
-              kExprGetLocal, 2,
-              kExprI32Const, / *64=* / 192, 0,
-              kExprI32Ior,
-              kExprThrow,
-              kExprUnreachable,
-            kExprEnd,
-            kExprI32Const, / *128=* / 128, 1,
-            kExprI32Ior,
-          kExprCatch, 1,
-            kExprGetLocal, 1,
-            kExprI32Const, / *256=* / 128, 2,
-            kExprI32Ior,
-          kExprEnd,
-      ])
-      .addLocals({i32_count: 2})
-      .exportFunc();
-
-    // Scenario 2: Catches an exception raised from the direct callee.
-    var kFromDirectCallee =
-      builder.addFunction("from_direct_callee", kSig_i_i)
-        .addBody([
-          kExprTry, kWasmI32,
-            kExprGetLocal, 0,
-            kExprCallFunction, kWasmThrowFunction,
-            kExprI32Const, / *-1=* / 127,
-          kExprCatch, 1,
-            kExprGetLocal, 1,
-          kExprEnd
-        ])
-        .addLocals({i32_count: 1})
-        .exportFunc()
-        .index;
-
-    // Scenario 3: Catches an exception raised from an indirect callee.
-    var kFromIndirectCalleeHelper = kFromDirectCallee + 1;
-    builder.addFunction("from_indirect_callee_helper", kSig_v_ii)
+  // Helper function for throwing from WebAssembly.
+  let kWasmThrowFunction =
+    builder.addFunction("throw", kSig_v_i)
       .addBody([
         kExprGetLocal, 0,
+        kExprThrow, except,
+      ])
+      .index;
+
+  // Scenario 1: Throw and catch appear on the same function. This should
+  // happen in case of inlining, for example.
+  builder.addFunction("same_scope", kSig_i_i)
+    .addBody([
+      kExprTry, kWasmI32,
+        kExprGetLocal, 0,
         kExprI32Const, 0,
-        kExprI32GtS,
+        kExprI32Ne,
         kExprIf, kWasmStmt,
           kExprGetLocal, 0,
-          kExprI32Const, 1,
-          kExprI32Sub,
-          kExprGetLocal, 1,
-          kExprI32Const, 1,
-          kExprI32Sub,
-          kExprCallFunction, kFromIndirectCalleeHelper,
+          kExprThrow, except,
+          kExprUnreachable,
         kExprEnd,
-        kExprGetLocal, 1,
+        kExprI32Const, 63,
+      kExprCatch,
+        kExprBrOnExn, 0, except,
+        kExprRethrow,
+      kExprEnd
+    ])
+    .exportFunc();
+
+  builder.addFunction("same_scope_ignore", kSig_i_i)
+    .addBody([
+        kExprTry, kWasmI32,
+          kExprGetLocal, 0,
+          kExprThrow, except,
+          kExprUnreachable,
+        kExprCatch,
+          kExprBrOnExn, 0, except,
+          kExprRethrow,
+        kExprEnd,
+    ])
+    .exportFunc();
+
+  builder.addFunction("same_scope_multiple", kSig_i_i)
+    .addLocals({i32_count: 1, except_count: 1})
+    // path = 0;
+    //
+    // try {
+    //   try {
+    //     try {
+    //       if (p == 1)
+    //         throw 1;
+    //       path |= 2
+    //     } catch (v) {
+    //       path |= v | 4;
+    //       throw path;
+    //     }
+    //     if (p == 2)
+    //       throw path|8;
+    //     path |= 16;
+    //   } catch (v) {
+    //     path |= v | 32;
+    //     throw path;
+    //   }
+    //   if (p == 3)
+    //     throw path|64;
+    //   path |= 128
+    // } catch (v) {
+    //   path |= v | 256;
+    // }
+    //
+    // return path;
+    //
+    // p == 1 -> path == 293
+    // p == 2 -> path == 298
+    // p == 3 -> path == 338
+    // else   -> path == 146
+    .addBody([
+        kExprTry, kWasmI32,
+          kExprTry, kWasmI32,
+            kExprTry, kWasmI32,
+              kExprGetLocal, 0,
+              kExprI32Const, 1,
+              kExprI32Eq,
+              kExprIf, kWasmStmt,
+                kExprI32Const, 1,
+                kExprThrow, except,
+                kExprUnreachable,
+              kExprEnd,
+              kExprI32Const, 2,
+            kExprCatch,
+              kExprSetLocal, 2,
+              kExprBlock, kWasmI32,
+                kExprGetLocal, 2,
+                kExprBrOnExn, 0, except,
+                kExprRethrow,
+              kExprEnd,
+              kExprI32Const, 4,
+              kExprI32Ior,
+              kExprThrow, except,
+              kExprUnreachable,
+            kExprEnd,
+            kExprTeeLocal, 1,
+            kExprGetLocal, 0,
+            kExprI32Const, 2,
+            kExprI32Eq,
+            kExprIf, kWasmStmt,
+              kExprGetLocal, 1,
+              kExprI32Const, 8,
+              kExprI32Ior,
+              kExprThrow, except,
+              kExprUnreachable,
+            kExprEnd,
+            kExprI32Const, 16,
+            kExprI32Ior,
+          kExprCatch,
+            kExprSetLocal, 2,
+            kExprBlock, kWasmI32,
+              kExprGetLocal, 2,
+              kExprBrOnExn, 0, except,
+              kExprRethrow,
+            kExprEnd,
+            kExprI32Const, 32,
+            kExprI32Ior,
+            kExprThrow, except,
+            kExprUnreachable,
+          kExprEnd,
+          kExprTeeLocal, 1,
+          kExprGetLocal, 0,
+          kExprI32Const, 3,
+          kExprI32Eq,
+          kExprIf, kWasmStmt,
+            kExprGetLocal, 1,
+            kExprI32Const, /*64=*/ 192, 0,
+            kExprI32Ior,
+            kExprThrow, except,
+            kExprUnreachable,
+          kExprEnd,
+          kExprI32Const, /*128=*/ 128, 1,
+          kExprI32Ior,
+        kExprCatch,
+          kExprSetLocal, 2,
+          kExprBlock, kWasmI32,
+            kExprGetLocal, 2,
+            kExprBrOnExn, 0, except,
+            kExprRethrow,
+          kExprEnd,
+          kExprI32Const, /*256=*/ 128, 2,
+          kExprI32Ior,
+        kExprEnd,
+    ])
+    .exportFunc();
+
+  // Scenario 2: Catches an exception raised from the direct callee.
+  builder.addFunction("from_direct_callee", kSig_i_i)
+    .addBody([
+      kExprTry, kWasmI32,
+        kExprGetLocal, 0,
         kExprCallFunction, kWasmThrowFunction,
-      ]);
+        kExprUnreachable,
+      kExprCatch,
+        kExprBrOnExn, 0, except,
+        kExprRethrow,
+      kExprEnd,
+    ])
+    .exportFunc();
 
-    builder.addFunction("from_indirect_callee", kSig_i_i)
-      .addBody([
-        kExprTry, kWasmI32,
-          kExprGetLocal, 0,
-          kExprI32Const, 0,
-          kExprCallFunction, kFromIndirectCalleeHelper,
-          kExprI32Const, / *-1=* / 127,
-        kExprCatch, 1,
-          kExprGetLocal, 1,
-        kExprEnd
-      ])
-      .addLocals({i32_count: 1})
-      .exportFunc();
+  // Scenario 3: Catches an exception raised from an indirect callee.
+  let sig_v_i = builder.addType(kSig_v_i);
+  builder.appendToTable([kWasmThrowFunction, kWasmThrowFunction]);
+  builder.addFunction("from_indirect_callee", kSig_i_ii)
+    .addBody([
+      kExprTry, kWasmI32,
+        kExprGetLocal, 0,
+        kExprGetLocal, 1,
+        kExprCallIndirect, sig_v_i, kTableZero,
+        kExprUnreachable,
+      kExprCatch,
+        kExprBrOnExn, 0, except,
+        kExprRethrow,
+      kExprEnd
+    ])
+    .exportFunc();
 
-    // Scenario 4: Catches an exception raised in JS.
-    builder.addFunction("from_js", kSig_i_i)
-      .addBody([
-        kExprTry, kWasmI32,
-          kExprGetLocal, 0,
-          kExprCallFunction, kJSThrowI,
-          kExprI32Const, / *-1=* / 127,
-        kExprCatch, 1,
-          kExprGetLocal, 1,
-        kExprEnd,
-      ])
-      .addLocals({i32_count: 1})
-      .exportFunc();
+  // Scenario 4: Does not catch an exception raised in JS, even if primitive
+  // values are being used as exceptions.
+  builder.addFunction("i_from_js", kSig_i_i)
+    .addBody([
+      kExprTry, kWasmI32,
+        kExprGetLocal, 0,
+        kExprCallFunction, kJSThrowI,
+        kExprUnreachable,
+      kExprCatch,
+        kExprBrOnExn, 0, except,
+        kExprRethrow,
+      kExprEnd,
+      kExprUnreachable,
+    ])
+    .exportFunc();
 
-    // Scenario 5: Does not catch an exception raised in JS if it is not a
-    // number.
-    builder.addFunction("string_from_js", kSig_v_v)
-      .addBody([
-          kExprCallFunction, kJSThrowString
-      ])
-      .exportFunc();
+  builder.addFunction("string_from_js", kSig_v_v)
+    .addBody([
+      kExprTry, kWasmStmt,
+        kExprCallFunction, kJSThrowString,
+      kExprCatch,
+        kExprBrOnExn, 0, except,
+        kExprRethrow,
+      kExprEnd,
+      kExprUnreachable,
+    ])
+    .exportFunc();
 
-    builder.addFunction("fp_from_js", kSig_v_v)
-      .addBody([
-          kExprCallFunction, kJSThrowFP
-      ])
-      .exportFunc();
+  builder.addFunction("fp_from_js", kSig_v_v)
+    .addBody([
+      kExprTry, kWasmStmt,
+        kExprCallFunction, kJSThrowFP,
+      kExprCatch,
+        kExprBrOnExn, 0, except,
+        kExprRethrow,
+      kExprEnd,
+      kExprUnreachable,
+    ])
+    .exportFunc();
 
-    builder.addFunction("large_from_js", kSig_v_v)
-      .addBody([
-          kExprCallFunction, kJSThrowLarge
-      ])
-      .exportFunc();
+  builder.addFunction("large_from_js", kSig_v_v)
+    .addBody([
+      kExprTry, kWasmStmt,
+        kExprCallFunction, kJSThrowLarge,
+      kExprCatch,
+        kExprBrOnExn, 0, except,
+        kExprRethrow,
+      kExprEnd,
+      kExprUnreachable,
+    ])
+    .exportFunc();
 
-    builder.addFunction("undefined_from_js", kSig_v_v)
-      .addBody([
-          kExprCallFunction, kJSThrowUndefined
-      ])
-      .exportFunc();
+  builder.addFunction("undefined_from_js", kSig_v_v)
+    .addBody([
+      kExprTry, kWasmStmt,
+        kExprCallFunction, kJSThrowUndefined,
+      kExprCatch,
+        kExprBrOnExn, 0, except,
+        kExprRethrow,
+      kExprEnd,
+      kExprUnreachable,
+    ])
+    .exportFunc();
 
-  return builder.instantiate({"": {
+  let instance = builder.instantiate({"": {
       throw_i: throw_value,
       throw_string: throw_string,
       throw_fp: throw_fp,
       throw_large, throw_large,
       throw_undefined: throw_undefined
   }});
+
+  assertEquals(63, instance.exports.same_scope(0));
+  assertEquals(1024, instance.exports.same_scope(1024));
+  assertEquals(-3, instance.exports.same_scope(-3));
+  assertEquals(-1, instance.exports.same_scope_ignore(-1));
+  assertEquals(1, instance.exports.same_scope_ignore(1));
+  assertEquals(0x7FFFFFFF, instance.exports.same_scope_ignore(0x7FFFFFFF));
+  assertEquals(1024, instance.exports.same_scope_ignore(1024));
+  assertEquals(-1, instance.exports.same_scope_ignore(-1));
+  assertEquals(293, instance.exports.same_scope_multiple(1));
+  assertEquals(298, instance.exports.same_scope_multiple(2));
+  assertEquals(338, instance.exports.same_scope_multiple(3));
+  assertEquals(146, instance.exports.same_scope_multiple(0));
+  assertEquals(-10024, instance.exports.from_direct_callee(-10024));
+  assertEquals(3334333, instance.exports.from_direct_callee(3334333));
+  assertEquals(-1, instance.exports.from_direct_callee(0xFFFFFFFF));
+  assertEquals(0x7FFFFFFF, instance.exports.from_direct_callee(0x7FFFFFFF));
+  assertEquals(10, instance.exports.from_indirect_callee(10, 0));
+  assertEquals(77, instance.exports.from_indirect_callee(77, 1));
+
+  assertThrowsEquals(() => instance.exports.i_from_js(10), 10);
+  assertThrowsEquals(() => instance.exports.i_from_js(-10), -10);
+  assertThrowsEquals(instance.exports.string_from_js, "use wasm");
+  assertThrowsEquals(instance.exports.fp_from_js, 10.5);
+  assertThrowsEquals(instance.exports.large_from_js, 1e+28);
+  assertThrowsEquals(instance.exports.undefined_from_js, undefined);
 })();
-
-// Check the test_catch exists.
-assertFalse(test_catch === undefined);
-assertFalse(test_catch === null);
-assertFalse(test_catch === 0);
-assertEquals("object", typeof test_catch.exports);
-assertEquals("function", typeof test_catch.exports.same_scope);
-assertEquals("function", typeof test_catch.exports.same_scope_ignore);
-assertEquals("function", typeof test_catch.exports.same_scope_multiple);
-assertEquals("function", typeof test_catch.exports.from_direct_callee);
-assertEquals("function", typeof test_catch.exports.from_indirect_callee);
-assertEquals("function", typeof test_catch.exports.from_js);
-assertEquals("function", typeof test_catch.exports.string_from_js);
-
-assertEquals(63, test_catch.exports.same_scope(0));
-assertEquals(1024, test_catch.exports.same_scope(1024));
-assertEquals(-3, test_catch.exports.same_scope(-3));
-assertEquals(-1, test_catch.exports.same_scope_ignore(-1));
-assertEquals(1, test_catch.exports.same_scope_ignore(1));
-assertEquals(0x7FFFFFFF, test_catch.exports.same_scope_ignore(0x7FFFFFFF));
-assertEquals(1024, test_catch.exports.same_scope_ignore(1024));
-assertEquals(-1, test_catch.exports.same_scope_ignore(-1));
-assertEquals(293, test_catch.exports.same_scope_multiple(1));
-assertEquals(298, test_catch.exports.same_scope_multiple(2));
-assertEquals(338, test_catch.exports.same_scope_multiple(3));
-assertEquals(146, test_catch.exports.same_scope_multiple(0));
-assertEquals(-10024, test_catch.exports.from_direct_callee(-10024));
-assertEquals(3334333, test_catch.exports.from_direct_callee(3334333));
-assertEquals(-1, test_catch.exports.from_direct_callee(0xFFFFFFFF));
-assertEquals(0x7FFFFFFF, test_catch.exports.from_direct_callee(0x7FFFFFFF));
-assertEquals(-10, test_catch.exports.from_indirect_callee(10));
-assertEquals(-77, test_catch.exports.from_indirect_callee(77));
-assertEquals(10, test_catch.exports.from_js(10));
-assertEquals(-10, test_catch.exports.from_js(-10));
-
-assertThrowsEquals(test_catch.exports.string_from_js, "use wasm;");
-assertThrowsEquals(test_catch.exports.large_from_js, 1e+28);
-assertThrowsEquals(test_catch.exports.undefined_from_js, undefined);
-*/
diff --git a/src/v8/test/mjsunit/wasm/export-global.js b/src/v8/test/mjsunit/wasm/export-global.js
index 43c788c..89ca5b5 100644
--- a/src/v8/test/mjsunit/wasm/export-global.js
+++ b/src/v8/test/mjsunit/wasm/export-global.js
@@ -2,43 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
-(function exportImmutableGlobal() {
-  var builder = new WasmModuleBuilder();
-  let globals = [
-    [kWasmI32, 'i32_noinit'],              // -
-    [kWasmI32, 'i32', 4711],               // -
-    [kWasmF32, 'f32_noinit'],              // -
-    [kWasmF32, 'f32', Math.fround(3.14)],  // -
-    [kWasmF64, 'f64_noinit'],              // -
-    [kWasmF64, 'f64', 1 / 7]               // -
-  ];
-  for (let g of globals) {
-    let global_builder = builder.addGlobal(g[0], false).exportAs(g[1]);
-    if (g[2]) global_builder.init = g[2];
-  }
-  var module = builder.instantiate();
-
-  for (let g of globals) {
-    assertEquals("number", typeof module.exports[g[1]], g[1]);
-    assertEquals(g[2] || 0, module.exports[g[1]], g[1]);
-  }
-})();
-
-(function cannotExportMutableGlobal() {
-  var builder = new WasmModuleBuilder();
-  builder.addGlobal(kWasmI32, true).exportAs('g');
-  assertThrows(() => builder.instantiate(), WebAssembly.CompileError);
-})();
-
-(function cannotExportI64Global() {
-  var builder = new WasmModuleBuilder();
-  builder.addGlobal(kWasmI64, false).exportAs('g');
-  assertThrows(() => builder.instantiate(), WebAssembly.LinkError);
-})();
-
 (function duplicateGlobalExportName() {
   var builder = new WasmModuleBuilder();
   builder.addGlobal(kWasmI64, false).exportAs('g');
diff --git a/src/v8/test/mjsunit/wasm/export-identity.js b/src/v8/test/mjsunit/wasm/export-identity.js
new file mode 100644
index 0000000..2b9e9ac
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/export-identity.js
@@ -0,0 +1,46 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+function createExport(fun) {
+  let builder = new WasmModuleBuilder();
+  let fun_index = builder.addImport("m", "fun", kSig_i_v)
+  builder.addExport("fun", fun_index);
+  let instance = builder.instantiate({ m: { fun: fun }});
+  return instance.exports.fun;
+}
+
+// Test that re-exporting a generic JavaScript function changes identity, as
+// the resulting export is an instance of {WebAssembly.Function} instead.
+(function TestReExportOfJS() {
+  print(arguments.callee.name);
+  function fun() { return 7 }
+  let exported = createExport(fun);
+  assertNotSame(exported, fun);
+  assertEquals(7, exported());
+  assertEquals(7, fun());
+})();
+
+// Test that re-exporting and existing {WebAssembly.Function} that represents
+// regular WebAssembly functions preserves identity.
+(function TestReReExportOfWasm() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction('fun', kSig_i_v).addBody([kExprI32Const, 9]).exportFunc();
+  let fun = builder.instantiate().exports.fun;
+  let exported = createExport(fun);
+  assertSame(exported, fun);
+  assertEquals(9, fun());
+})();
+
+// Test that re-exporting and existing {WebAssembly.Function} that represents
+// generic JavaScript functions preserves identity.
+(function TestReReExportOfJS() {
+  print(arguments.callee.name);
+  let fun = createExport(() => 11)
+  let exported = createExport(fun);
+  assertSame(exported, fun);
+  assertEquals(11, fun());
+})();
diff --git a/src/v8/test/mjsunit/wasm/export-mutable-global.js b/src/v8/test/mjsunit/wasm/export-mutable-global.js
new file mode 100644
index 0000000..1ce918c
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/export-mutable-global.js
@@ -0,0 +1,98 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function exportImmutableGlobal() {
+  var builder = new WasmModuleBuilder();
+  let globals = [
+    [kWasmI32, 'i32_noinit'],
+    [kWasmI32, 'i32', 4711],
+    [kWasmF32, 'f32_noinit'],
+    [kWasmF32, 'f32', Math.fround(3.14)],
+    [kWasmF64, 'f64_noinit'],
+    [kWasmF64, 'f64', 1 / 7]
+  ];
+  for (let [type, name, value] of globals) {
+    let global_builder = builder.addGlobal(type, false).exportAs(name);
+    if (value) global_builder.init = value;
+  }
+  var instance = builder.instantiate();
+
+  for (let [type, name, value] of globals) {
+    let obj = instance.exports[name];
+    assertEquals("object", typeof obj, name);
+    assertTrue(obj instanceof WebAssembly.Global, name);
+    assertEquals(value || 0, obj.value, name);
+    assertThrows(() => obj.value = 0);
+  }
+})();
+
+(function canExportI64Global() {
+  var builder = new WasmModuleBuilder();
+  builder.addGlobal(kWasmI64, false).exportAs('g');
+  builder.instantiate();
+})();
+
+(function canExportAndImportI64() {
+  var builder = new WasmModuleBuilder();
+  builder.addGlobal(kWasmI64, false).exportAs('g');
+  let g = builder.instantiate().exports.g;
+
+  builder = new WasmModuleBuilder();
+  builder.addImportedGlobal("mod", "g", kWasmI64);
+  builder.instantiate({mod: {g: g}});
+})();
+
+(function exportMutableGlobal() {
+  var builder = new WasmModuleBuilder();
+  let globals = [
+    [kWasmI32, 'i32_noinit'],              // -
+    [kWasmI32, 'i32', 4711],               // -
+    [kWasmF32, 'f32_noinit'],              // -
+    [kWasmF32, 'f32', Math.fround(3.14)],  // -
+    [kWasmF64, 'f64_noinit'],              // -
+    [kWasmF64, 'f64', 1 / 7]               // -
+  ];
+  for (let [index, [type, name, value]] of globals.entries()) {
+    let global_builder = builder.addGlobal(type, true).exportAs(name);
+    if (value) global_builder.init = value;
+    builder.addFunction("get " + name, makeSig([], [type]))
+      .addBody([kExprGetGlobal, index])
+      .exportFunc();
+    builder.addFunction("set " + name, makeSig([type], []))
+      .addBody([kExprGetLocal, 0, kExprSetGlobal, index])
+      .exportFunc();
+  }
+  var instance = builder.instantiate();
+
+  for (let [type, name, value] of globals) {
+    let obj = instance.exports[name];
+
+    assertEquals(value || 0, obj.value, name);
+
+    // Changing the exported global should change the instance's global.
+    obj.value = 1001;
+    assertEquals(1001, instance.exports['get ' + name](), name);
+
+    // Changing the instance's global should change the exported global.
+    instance.exports['set ' + name](112358);
+    assertEquals(112358, obj.value, name);
+  }
+})();
+
+(function exportImportedMutableGlobal() {
+  let builder = new WasmModuleBuilder();
+  builder.addGlobal(kWasmI32, true).exportAs('g1');
+  let g1 = builder.instantiate().exports.g1;
+
+  builder = new WasmModuleBuilder();
+  builder.addImportedGlobal("mod", "g1", kWasmI32, true);
+  builder.addExportOfKind('g2', kExternalGlobal, 0);
+  let g2 = builder.instantiate({mod: {g1: g1}}).exports.g2;
+
+  g1.value = 123;
+
+  assertEquals(g1.value, g2.value);
+})();
diff --git a/src/v8/test/mjsunit/wasm/export-table.js b/src/v8/test/mjsunit/wasm/export-table.js
index cb9d565..3d523f2 100644
--- a/src/v8/test/mjsunit/wasm/export-table.js
+++ b/src/v8/test/mjsunit/wasm/export-table.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 (function testExportedMain() {
diff --git a/src/v8/test/mjsunit/wasm/ffi-error.js b/src/v8/test/mjsunit/wasm/ffi-error.js
index e7811d2..5f777ef 100644
--- a/src/v8/test/mjsunit/wasm/ffi-error.js
+++ b/src/v8/test/mjsunit/wasm/ffi-error.js
@@ -4,180 +4,224 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
-load("test/mjsunit/wasm/wasm-module-builder.js");
+load('test/mjsunit/wasm/wasm-module-builder.js');
 
-function instantiateWithFFI(ffi) {
-  var builder = new WasmModuleBuilder();
+function CreateDefaultBuilder() {
+  const builder = new WasmModuleBuilder();
 
-  var sig_index = kSig_i_dd;
-  builder.addImport("mod", "fun", sig_index);
-  builder.addFunction("main", sig_index)
-    .addBody([
-      kExprGetLocal, 0,              // --
-      kExprGetLocal, 1,              // --
-      kExprCallFunction, 0, // --
-    ])    // --
-    .exportFunc();
-
-  return builder.instantiate(ffi);
+  const sig_index = kSig_i_dd;
+  builder.addImport('mod', 'fun', sig_index);
+  builder.addFunction('main', sig_index)
+      .addBody([
+        kExprGetLocal, 0,      // --
+        kExprGetLocal, 1,      // --
+        kExprCallFunction, 0,  // --
+      ])                       // --
+      .exportFunc();
+  return builder;
 }
 
-// everything is good.
-(function() {
-  var ffi = {"mod": {fun: function(a, b) { print(a, b); }}}
-  instantiateWithFFI(ffi);
+function checkSuccessfulInstantiation(builder, ffi, handler) {
+  // Test synchronous instantiation.
+  const instance = builder.instantiate(ffi);
+  if (handler) handler(instance);
+
+  // Test asynchronous instantiation.
+  assertPromiseResult(builder.asyncInstantiate(ffi), handler);
+}
+
+function checkFailingInstantiation(
+    builder, ffi, error, message, prepend_context = true) {
+  // Test synchronous instantiation.
+  assertThrows(
+      _ => builder.instantiate(ffi), error,
+      (prepend_context ? 'WebAssembly.Instance(): ' : '') + message);
+
+  // Test asynchronous instantiation.
+  assertThrowsAsync(
+      builder.asyncInstantiate(ffi), error,
+      (prepend_context ? 'WebAssembly.instantiate(): ' : '') + message);
+}
+
+(function testValidFFI() {
+  print(arguments.callee.name);
+  let ffi = {'mod': {fun: print}};
+  checkSuccessfulInstantiation(CreateDefaultBuilder(), ffi, undefined);
 })();
 
+(function testInvalidFFIs() {
+  print(arguments.callee.name);
+  checkFailingInstantiation(
+      CreateDefaultBuilder(), 17, TypeError,
+      'Argument 1 must be an object');
+  checkFailingInstantiation(
+      CreateDefaultBuilder(), {}, TypeError,
+      'Import #0 module="mod" error: module is not an object or function');
+  checkFailingInstantiation(
+      CreateDefaultBuilder(), {mod: {}}, WebAssembly.LinkError,
+      'Import #0 module="mod" function="fun" error: function import requires a callable');
+  checkFailingInstantiation(
+      CreateDefaultBuilder(), {mod: {fun: {}}}, WebAssembly.LinkError,
+      'Import #0 module="mod" function="fun" error: function import requires a callable');
+  checkFailingInstantiation(
+      CreateDefaultBuilder(), {mod: {fun: 0}}, WebAssembly.LinkError,
+      'Import #0 module="mod" function="fun" error: function import requires a callable');
+})();
 
-// FFI object should be an object.
-assertThrows(function() {
-  var ffi = 0;
-  instantiateWithFFI(ffi);
-});
+(function testImportWithInvalidSignature() {
+  print(arguments.callee.name);
+  // "fun" should have signature "i_dd"
+  let builder = new WasmModuleBuilder();
 
+  let sig_index = kSig_i_dd;
+  builder.addFunction('exp', kSig_i_i)
+      .addBody([
+        kExprGetLocal,
+        0,
+      ])  // --
+      .exportFunc();
 
-// FFI object should have a "mod" property.
-assertThrows(function() {
-  instantiateWithFFI({});
-});
+  let exported = builder.instantiate().exports.exp;
+  checkFailingInstantiation(
+      CreateDefaultBuilder(), {mod: {fun: exported}}, WebAssembly.LinkError,
+      'Import #0 module="mod" function="fun" error: imported function does not match the expected type');
+})();
 
+(function regression870646() {
+  print(arguments.callee.name);
+  const ffi = {mod: {fun: function() {}}};
+  Object.defineProperty(ffi, 'mod', {
+    get: function() {
+      throw new Error('my_exception');
+    }
+  });
 
-// FFI object should have a "fun" property.
-assertThrows(function() {
-  instantiateWithFFI({mod: {}});
-});
-
-
-// "fun" should be a JS function.
-assertThrows(function() {
-  instantiateWithFFI({mod: {fun: new Object()}});
-});
-
-
-// "fun" should be a JS function.
-assertThrows(function() {
-  instantiateWithFFI({mod: {fun: 0}});
-});
-
-// "fun" should have signature "i_dd"
-assertThrows(function () {
-  var builder = new WasmModuleBuilder();
-
-  var sig_index = kSig_i_dd;
-  builder.addFunction("exp", kSig_i_i)
-    .addBody([
-      kExprGetLocal, 0,
-    ])    // --
-    .exportFunc();
-
-  var exported = builder.instantiate().exports.exp;
-  instantiateWithFFI({mod: {fun: exported}});
-});
+  checkFailingInstantiation(
+      CreateDefaultBuilder(), ffi, Error, 'my_exception', false);
+})();
 
 // "fun" matches signature "i_dd"
-(function () {
-  var builder = new WasmModuleBuilder();
+(function testImportWithValidSignature() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
 
-  builder.addFunction("exp", kSig_i_dd)
-    .addBody([
-      kExprI32Const, 33,
-    ])    // --
-    .exportFunc();
+  builder.addFunction('exp', kSig_i_dd)
+      .addBody([
+        kExprI32Const,
+        33,
+      ])  // --
+      .exportFunc();
 
-  var exported = builder.instantiate().exports.exp;
-  var instance = instantiateWithFFI({mod: {fun: exported}});
-  assertEquals(33, instance.exports.main());
+  let exported = builder.instantiate().exports.exp;
+
+  checkSuccessfulInstantiation(
+      CreateDefaultBuilder(), {mod: {fun: exported}},
+      instance => assertEquals(33, instance.exports.main()));
 })();
 
 (function I64InSignatureThrows() {
-  var builder = new WasmModuleBuilder();
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
 
   builder.addMemory(1, 1, true);
-  builder.addFunction("function_with_invalid_signature", kSig_l_ll)
+  builder.addFunction('function_with_invalid_signature', kSig_l_ll)
     .addBody([           // --
       kExprGetLocal, 0,  // --
       kExprGetLocal, 1,  // --
       kExprI64Sub])      // --
     .exportFunc()
 
-  var module = builder.instantiate();
-
-  assertThrows(function() {
-      module.exports.function_with_invalid_signature(33, 88);
-    }, TypeError);
+  checkSuccessfulInstantiation(
+      builder, undefined,
+      instance => assertThrows(function() {
+        instance.exports.function_with_invalid_signature(33, 88);
+      }, TypeError, 'wasm function signature contains illegal type'));
 })();
 
 (function I64ParamsInSignatureThrows() {
-  var builder = new WasmModuleBuilder();
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
 
   builder.addMemory(1, 1, true);
-  builder.addFunction("function_with_invalid_signature", kSig_i_l)
-    .addBody([
-       kExprGetLocal, 0,
-       kExprI32ConvertI64
-     ])
-    .exportFunc()
+  builder.addFunction('function_with_invalid_signature', kSig_i_l)
+      .addBody([kExprGetLocal, 0, kExprI32ConvertI64])
+      .exportFunc();
 
-  var module = builder.instantiate();
+  checkSuccessfulInstantiation(
+      builder, undefined,
+      instance => assertThrows(
+          _ => instance.exports.function_with_invalid_signature(12), TypeError,
+          'wasm function signature contains illegal type'));
 
-  assertThrows(function() {
-      module.exports.function_with_invalid_signature(33);
-    }, TypeError);
 })();
 
 (function I64JSImportThrows() {
-  var builder = new WasmModuleBuilder();
-  var sig_index = builder.addType(kSig_i_i);
-  var sig_i64_index = builder.addType(kSig_i_l);
-  var index = builder.addImport("", "func", sig_i64_index);
-  builder.addFunction("main", sig_index)
-    .addBody([
-      kExprGetLocal, 0,
-      kExprI64SConvertI32,
-      kExprCallFunction, index  // --
-    ])        // --
-    .exportFunc();
-  var func = function() {return {};};
-  var main = builder.instantiate({"": {func: func}}).exports.main;
-  assertThrows(function() {
-    main(13);
-  }, TypeError);
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let sig_index = builder.addType(kSig_i_i);
+  let sig_i64_index = builder.addType(kSig_i_l);
+  let index = builder.addImport('', 'func', sig_i64_index);
+  builder.addFunction('main', sig_index)
+      .addBody([
+        kExprGetLocal, 0, kExprI64SConvertI32, kExprCallFunction, index  // --
+      ])                                                                 // --
+      .exportFunc();
+
+  checkSuccessfulInstantiation(
+      builder, {'': {func: _ => {}}},
+      instance => assertThrows(
+          instance.exports.main, TypeError,
+          'wasm function signature contains illegal type'));
+
 })();
 
 (function ImportI64ParamWithF64ReturnThrows() {
+  print(arguments.callee.name);
   // This tests that we generate correct code by using the correct return
   // register. See bug 6096.
-  var builder = new WasmModuleBuilder();
+  let builder = new WasmModuleBuilder();
   builder.addImport('', 'f', makeSig([kWasmI64], [kWasmF64]));
   builder.addFunction('main', kSig_v_v)
       .addBody([kExprI64Const, 0, kExprCallFunction, 0, kExprDrop])
       .exportFunc();
-  var instance = builder.instantiate({'': {f: i => i}});
 
-  assertThrows(() => instance.exports.main(), TypeError);
+  checkSuccessfulInstantiation(
+      builder, {'': {f: i => i}},
+      instance => assertThrows(
+          instance.exports.main, TypeError,
+          'wasm function signature contains illegal type'));
+
 })();
 
 (function ImportI64Return() {
+  print(arguments.callee.name);
   // This tests that we generate correct code by using the correct return
   // register(s). See bug 6104.
-  var builder = new WasmModuleBuilder();
+  let builder = new WasmModuleBuilder();
   builder.addImport('', 'f', makeSig([], [kWasmI64]));
   builder.addFunction('main', kSig_v_v)
       .addBody([kExprCallFunction, 0, kExprDrop])
       .exportFunc();
-  var instance = builder.instantiate({'': {f: () => 1}});
 
-  assertThrows(() => instance.exports.main(), TypeError);
+  checkSuccessfulInstantiation(
+      builder, {'': {f: _ => 1}},
+      instance => assertThrows(
+          instance.exports.main, TypeError,
+          'wasm function signature contains illegal type'));
+
 })();
 
 (function ImportSymbolToNumberThrows() {
-  var builder = new WasmModuleBuilder();
-  var index = builder.addImport("", "func", kSig_i_v);
-  builder.addFunction("main", kSig_i_v)
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let index = builder.addImport('', 'f', kSig_i_v);
+  builder.addFunction('main', kSig_i_v)
       .addBody([kExprCallFunction, 0])
       .exportFunc();
-  var func = () => Symbol();
-  var main = builder.instantiate({"": {func: func}}).exports.main;
-  assertThrows(() => main(), TypeError);
+
+  checkSuccessfulInstantiation(
+      builder, {'': {f: _ => Symbol()}},
+      instance => assertThrows(
+          instance.exports.main, TypeError,
+          'Cannot convert a Symbol value to a number'));
 })();
diff --git a/src/v8/test/mjsunit/wasm/ffi.js b/src/v8/test/mjsunit/wasm/ffi.js
index 67b1ccc..72cc57f 100644
--- a/src/v8/test/mjsunit/wasm/ffi.js
+++ b/src/v8/test/mjsunit/wasm/ffi.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm --allow-natives-syntax
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 function testCallFFI(func, check) {
@@ -68,9 +67,8 @@
 var bind_sub = FOREIGN_SUB.bind();
 testCallFFI(bind_sub, check_FOREIGN_SUB);
 
-var main_for_constructor_test;
-print("Constructor");
 (function testCallConstructor() {
+  print(arguments.callee.name);
   class C {}
   var builder = new WasmModuleBuilder();
 
@@ -84,13 +82,30 @@
     ])        // --
     .exportFunc();
 
-  main_for_constructor_test = builder.instantiate({"": {func: C}}).exports.main;
+  let main_for_constructor_test = builder.instantiate({"": {func: C}}).exports.main;
 
-  assertThrows("main_for_constructor_test(12, 43)", TypeError);
+  assertThrows(_ => main_for_constructor_test(12, 43), TypeError);
 }) ();
 
-print("Native function");
+(function testCallConstructorWithSuperClass() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let sig_index = builder.addType(kSig_v_v);
+  let func_index = builder.addImport('', 'func', sig_index);
+  builder.addExport('exp', func_index);
+
+  class B {}
+  class C extends B {
+    constructor() {
+      super();
+    }
+  };
+  let exports = builder.instantiate({'': {func: C}}).exports;
+  assertThrows(_ => exports.exp(), TypeError);
+})();
+
 (function test_ffi_call_to_native() {
+  print(arguments.callee.name);
 
   var builder = new WasmModuleBuilder();
 
diff --git a/src/v8/test/mjsunit/wasm/float-constant-folding.js b/src/v8/test/mjsunit/wasm/float-constant-folding.js
index b08aee3..6205da7 100644
--- a/src/v8/test/mjsunit/wasm/float-constant-folding.js
+++ b/src/v8/test/mjsunit/wasm/float-constant-folding.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 (function() {
diff --git a/src/v8/test/mjsunit/wasm/function-names.js b/src/v8/test/mjsunit/wasm/function-names.js
index 9320c50..4bb8e31 100644
--- a/src/v8/test/mjsunit/wasm/function-names.js
+++ b/src/v8/test/mjsunit/wasm/function-names.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 var builder = new WasmModuleBuilder();
@@ -40,7 +39,7 @@
     for (var i = 0; i < names.length; ++i) {
       var line = lines[i].trim();
       if (names[i] === null) continue;
-      var printed_name = names[i] === undefined ? "<WASM UNNAMED>" : names[i]
+      var printed_name = names[i];
       var expected_start = "at " + printed_name + " (";
       assertTrue(line.startsWith(expected_start),
           "should start with '" + expected_start + "': '" + line + "'");
diff --git a/src/v8/test/mjsunit/wasm/function-prototype.js b/src/v8/test/mjsunit/wasm/function-prototype.js
index d3356ce..f3a9971 100644
--- a/src/v8/test/mjsunit/wasm/function-prototype.js
+++ b/src/v8/test/mjsunit/wasm/function-prototype.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 (function TestFunctionPrototype() {
@@ -17,8 +16,9 @@
   var func = builder.instantiate().exports.nine;
 
   // Check type and existence of prototype
-  assertEquals("function", typeof func.apply);
-  assertTrue(func.prototype != undefined);
+  assertEquals('function', typeof func);
+  assertEquals('function', typeof func.apply);
+  assertEquals('prototype' in func, false);
   assertEquals(String(f.index), func.name);
   assertEquals(undefined, func.displayName);
 
diff --git a/src/v8/test/mjsunit/wasm/futex.js b/src/v8/test/mjsunit/wasm/futex.js
new file mode 100644
index 0000000..00353d4
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/futex.js
@@ -0,0 +1,344 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-sharedarraybuffer
+// Flags: --experimental-wasm-threads
+
+'use strict';
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+function WasmAtomicNotify(memory, offset, index, num) {
+  let builder = new WasmModuleBuilder();
+  builder.addImportedMemory("m", "memory", 0, 20, "shared");
+  builder.addFunction("main", kSig_i_ii)
+    .addBody([
+      kExprGetLocal, 0,
+      kExprGetLocal, 1,
+      kAtomicPrefix,
+      kExprAtomicNotify, /* alignment */ 0, offset])
+    .exportAs("main");
+
+  // Instantiate module, get function exports
+  let module = new WebAssembly.Module(builder.toBuffer());
+  let instance = new WebAssembly.Instance(module, {m: {memory}});
+  return instance.exports.main(index, num);
+}
+
+function WasmI32AtomicWait(memory, offset, index, val, timeout) {
+  let builder = new WasmModuleBuilder();
+  builder.addImportedMemory("m", "memory", 0, 20, "shared");
+  builder.addFunction("main",
+    makeSig([kWasmI32, kWasmI32, kWasmF64], [kWasmI32]))
+    .addBody([
+      kExprGetLocal, 0,
+      kExprGetLocal, 1,
+      kExprGetLocal, 2,
+      kExprI64SConvertF64,
+      kAtomicPrefix,
+      kExprI32AtomicWait, /* alignment */ 0, offset])
+      .exportAs("main");
+
+  // Instantiate module, get function exports
+  let module = new WebAssembly.Module(builder.toBuffer());
+  let instance = new WebAssembly.Instance(module, {m: {memory}});
+  return instance.exports.main(index, val, timeout);
+}
+
+function WasmI64AtomicWait(memory, offset, index, val_low,
+                                   val_high, timeout) {
+  let builder = new WasmModuleBuilder();
+  builder.addImportedMemory("m", "memory", 0, 20, "shared");
+  // Wrapper for I64AtomicWait that takes two I32 values and combines to into
+  // I64 for the instruction parameter.
+  builder.addFunction("main",
+    makeSig([kWasmI32, kWasmI32, kWasmI32, kWasmF64], [kWasmI32]))
+    .addLocals({i64_count: 1}) // local that is passed as value param to wait
+    .addBody([
+      kExprGetLocal, 1,
+      kExprI64UConvertI32,
+      kExprI64Const, 32,
+      kExprI64Shl,
+      kExprGetLocal, 2,
+      kExprI64UConvertI32,
+      kExprI64Ior,
+      kExprSetLocal, 4, // Store the created I64 value in local
+      kExprGetLocal, 0,
+      kExprGetLocal, 4,
+      kExprGetLocal, 3,
+      kExprI64SConvertF64,
+      kAtomicPrefix,
+      kExprI64AtomicWait, /* alignment */ 0, offset])
+      .exportAs("main");
+
+  // Instantiate module, get function exports
+  let module = new WebAssembly.Module(builder.toBuffer());
+  let instance = new WebAssembly.Instance(module, {m: {memory}});
+  return instance.exports.main(index, val_high, val_low, timeout);
+}
+
+(function TestInvalidIndex() {
+  let memory = new WebAssembly.Memory({initial: 1, maximum: 1, shared: true});
+
+  // Valid indexes are 0-65535 (1 page).
+  [-2, 65536, 0xffffffff].forEach(function(invalidIndex) {
+    assertThrows(function() {
+      WasmAtomicNotify(memory, 0, invalidIndex, -1);
+    }, Error);
+    assertThrows(function() {
+      WasmI32AtomicWait(memory, 0, invalidIndex, 0, -1);
+    }, Error);
+    assertThrows(function() {
+      WasmI64AtomicWait(memory, 0, invalidIndex, 0, 0, -1);
+    }, Error);
+    assertThrows(function() {
+      WasmAtomicNotify(memory, invalidIndex, 0, -1);
+    }, Error);
+    assertThrows(function() {
+      WasmI32AtomicWait(memory, invalidIndex, 0, 0, -1);
+    }, Error);
+    assertThrows(function() {
+      WasmI64AtomicWait(memory, invalidIndex, 0, 0, 0, -1);
+    }, Error);
+    assertThrows(function() {
+      WasmAtomicNotify(memory, invalidIndex/2, invalidIndex/2, -1);
+    }, Error);
+    assertThrows(function() {
+      WasmI32AtomicWait(memory, invalidIndex/2, invalidIndex/2, 0, -1);
+    }, Error);
+    assertThrows(function() {
+      WasmI64AtomicWait(memory, invalidIndex/2, invalidIndex/2, 0, 0, -1);
+    }, Error);
+  });
+})();
+
+(function TestInvalidAlignment() {
+  let memory = new WebAssembly.Memory({initial: 1, maximum: 1, shared: true});
+
+  // Wait and wake must be 4 byte aligned.
+  [1, 2, 3].forEach(function(invalid) {
+    assertThrows(function() {
+      WasmAtomicNotify(memory, invalid, 0, -1)
+    }, Error);
+    assertThrows(function() {
+      WasmAtomicNotify(memory, 0, invalid, -1)
+    }, Error);
+    assertThrows(function() {
+      WasmI32AtomicWait(memory, invalid, 0, 0, -1)
+    }, Error);
+    assertThrows(function() {
+      WasmI32AtomicWait(memory, 0, invalid, 0, -1)
+    }, Error);
+    assertThrows(function() {
+      WasmI64AtomicWait(memory, invalid, 0, 0, 0, -1)
+    }, Error);
+    assertThrows(function() {
+      WasmI64AtomicWait(memory, 0, invalid, 0, 0, -1)
+    }, Error);
+  });
+
+  //WasmI64AtomicWait must be 8 byte aligned.
+  [4, 5, 6, 7].forEach(function(invalid) {
+    assertThrows(function() {
+      WasmI64AtomicWait(memory, 0, invalid, 0, 0, -1)
+    }, Error);
+    assertThrows(function() {
+      WasmI64AtomicWait(memory, invalid, 0, 0, 0, -1)
+    }, Error);
+  });
+})();
+
+(function TestI32WaitTimeout() {
+  let memory = new WebAssembly.Memory({initial: 1, maximum: 1, shared: true});
+  var waitMs = 100;
+  var startTime = new Date();
+  assertEquals(2, WasmI32AtomicWait(memory, 0, 0, 0, waitMs*1000000));
+  var endTime = new Date();
+  assertTrue(endTime - startTime >= waitMs);
+})();
+
+(function TestI64WaitTimeout() {
+  let memory = new WebAssembly.Memory({initial: 1, maximum: 1, shared: true});
+  var waitMs = 100;
+  var startTime = new Date();
+  assertEquals(2, WasmI64AtomicWait(memory, 0, 0, 0, 0, waitMs*1000000));
+  var endTime = new Date();
+  assertTrue(endTime - startTime >= waitMs);
+})();
+
+(function TestI32WaitNotEqual() {
+  let memory = new WebAssembly.Memory({initial: 1, maximum: 1, shared: true});
+  assertEquals(1, WasmI32AtomicWait(memory, 0, 0, 42, -1));
+
+  assertEquals(2, WasmI32AtomicWait(memory, 0, 0, 0, 0));
+
+  let i32a = new Int32Array(memory.buffer);
+  i32a[0] = 1;
+  assertEquals(1, WasmI32AtomicWait(memory, 0, 0, 0, -1));
+  assertEquals(2, WasmI32AtomicWait(memory, 0, 0, 1, 0));
+})();
+
+(function TestI64WaitNotEqual() {
+  let memory = new WebAssembly.Memory({initial: 1, maximum: 1, shared: true});
+  assertEquals(1, WasmI64AtomicWait(memory, 0, 0, 42, 0, -1));
+
+  assertEquals(2, WasmI64AtomicWait(memory, 0, 0, 0, 0, 0));
+
+  let i32a = new Int32Array(memory.buffer);
+  i32a[0] = 1;
+  i32a[1] = 2;
+  assertEquals(1, WasmI64AtomicWait(memory, 0, 0, 0, 0, -1));
+  assertEquals(2, WasmI64AtomicWait(memory, 0, 0, 1, 2, 0));
+})();
+
+(function TestWakeCounts() {
+  let memory = new WebAssembly.Memory({initial: 1, maximum: 1, shared: true});
+
+  [-1, 0, 4, 100, 0xffffffff].forEach(function(count) {
+    WasmAtomicNotify(memory, 0, 0, count);
+  });
+})();
+
+//// WORKER ONLY TESTS
+
+if (this.Worker) {
+
+  // This test creates 4 workers that wait on consecutive (8 byte separated to
+  // satisfy alignments for all kinds of wait) memory locations to test various
+  // wait/wake combinations. For each combination, each thread waits 3 times
+  // expecting all 4 threads to be woken with wake(4) in first iteration, all 4
+  // to be woken with wake(5) in second iteration and, 3 and 1 to be woken in
+  // third iteration.
+
+  let memory = new WebAssembly.Memory({initial: 1, maximum: 1, shared: true});
+  let i32a = new Int32Array(memory.buffer);
+  const numWorkers = 4;
+
+  let workerScript = `onmessage = function(msg) {
+    load("test/mjsunit/wasm/wasm-module-builder.js");
+    ${WasmI32AtomicWait.toString()}
+    ${WasmI64AtomicWait.toString()}
+    let id = msg.id;
+    let memory = msg.memory;
+    let i32a = new Int32Array(memory.buffer);
+    // indices are right shifted by 2 for Atomics.wait to convert them to index
+    // for Int32Array
+    // for wasm-wake numWorkers threads
+    let result = Atomics.wait(i32a, 0>>>2, 0);
+    postMessage(result);
+    // for wasm-wake numWorkers + 1 threads
+    result = Atomics.wait(i32a, 8>>>2, 0);
+    postMessage(result);
+    // for wasm-wake numWorkers - 1 threads
+    result = Atomics.wait(i32a, 16>>>2, 0);
+    postMessage(result);
+    // for js-wake numWorkers threads
+    result = WasmI32AtomicWait(memory, 0, 24, 0, -1);
+    postMessage(result);
+    // for js-wake numWorkers + 1 threads
+    result = WasmI32AtomicWait(memory, 0, 32, 0, -1);
+    postMessage(result);
+    // for js-wake numWorkers - 1 threads
+    result = WasmI32AtomicWait(memory, 0, 40, 0, -1);
+    postMessage(result);
+    // for wasm-wake numWorkers threads
+    result = WasmI32AtomicWait(memory, 0, 48, 0, -1);
+    postMessage(result);
+    // for wasm-wake numWorkers + 1 threads
+    result = WasmI32AtomicWait(memory, 0, 56, 0, -1);
+    postMessage(result);
+    // for wasm-wake numWorkers - 1 threads
+    result = WasmI32AtomicWait(memory, 0, 64, 0, -1);
+    postMessage(result);
+    // for js-wake numWorkers threads
+    result = WasmI64AtomicWait(memory, 0, 72, 0, 0, -1);
+    postMessage(result);
+    // for js-wake numWorkers + 1 threads
+    result = WasmI64AtomicWait(memory, 0, 80, 0, 0, -1);
+    postMessage(result);
+    // for js-wake numWorkers - 1 threads
+    result = WasmI64AtomicWait(memory, 0, 88, 0, 0, -1);
+    postMessage(result);
+    // for wasm-wake numWorkers threads
+    result = WasmI64AtomicWait(memory, 0, 96, 0, 0, -1);
+    postMessage(result);
+    // for wasm-wake numWorkers + 1 threads
+    result = WasmI64AtomicWait(memory, 0, 104, 0, 0, -1);
+    postMessage(result);
+    // for wasm-wake numWorkers - 1 threads
+    result = WasmI64AtomicWait(memory, 0, 112, 0, 0, -1);
+    postMessage(result);
+  };`;
+
+  let waitForAllWorkers = function(index) {
+    // index is right shifted by 2 to convert to index in Int32Array
+    while (%AtomicsNumWaitersForTesting(i32a, index>>>2) != numWorkers) {}
+  }
+
+  let jsWakeCheck = function(index, num, workers, msg) {
+    waitForAllWorkers(index);
+    let indexJs = index>>>2; // convert to index in Int32Array
+    if (num >= numWorkers) {
+      // if numWorkers or more is passed to wake, numWorkers workers should be
+      // woken.
+      assertEquals(numWorkers, Atomics.wake(i32a, indexJs, num));
+    } else {
+      // if num < numWorkers is passed to wake, num workers should be woken.
+      // Then the remaining workers are woken for the next part
+      assertEquals(num, Atomics.wake(i32a, indexJs, num));
+      assertEquals(numWorkers-num, Atomics.wake(i32a, indexJs, numWorkers));
+    }
+    for (let id = 0; id < numWorkers; id++) {
+      assertEquals(msg, workers[id].getMessage());
+    }
+  };
+
+  let wasmWakeCheck = function(index, num, workers, msg) {
+    waitForAllWorkers(index);
+    if (num >= numWorkers) {
+      // if numWorkers or more is passed to wake, numWorkers workers should be
+      // woken.
+      assertEquals(numWorkers, WasmAtomicNotify(memory, 0, index, num));
+    } else {
+      // if num < numWorkers is passed to wake, num workers should be woken.
+      // Then the remaining workers are woken for the next part
+      assertEquals(num, WasmAtomicNotify(memory, 0, index, num));
+      assertEquals(numWorkers-num,
+                   WasmAtomicNotify(memory, 0, index, numWorkers));
+    }
+    for (let id = 0; id < numWorkers; id++) {
+      assertEquals(msg, workers[id].getMessage());
+    }
+  };
+
+  let workers = [];
+  for (let id = 0; id < numWorkers; id++) {
+    workers[id] = new Worker(workerScript, {type: 'string'});
+    workers[id].postMessage({id, memory});
+  }
+
+  wasmWakeCheck(0, numWorkers, workers, "ok");
+  wasmWakeCheck(8, numWorkers + 1, workers, "ok");
+  wasmWakeCheck(16, numWorkers - 1, workers, "ok");
+
+  jsWakeCheck(24, numWorkers, workers, 0);
+  jsWakeCheck(32, numWorkers + 1, workers, 0);
+  jsWakeCheck(40, numWorkers - 1, workers, 0);
+
+  wasmWakeCheck(48, numWorkers, workers, 0);
+  wasmWakeCheck(56, numWorkers + 1, workers, 0);
+  wasmWakeCheck(64, numWorkers - 1, workers, 0);
+
+  jsWakeCheck(72, numWorkers, workers, 0);
+  jsWakeCheck(80, numWorkers + 1, workers, 0);
+  jsWakeCheck(88, numWorkers - 1, workers, 0);
+
+  wasmWakeCheck(96, numWorkers, workers, 0);
+  wasmWakeCheck(104, numWorkers + 1, workers, 0);
+  wasmWakeCheck(112, numWorkers - 1, workers, 0);
+
+  for (let id = 0; id < numWorkers; id++) {
+    workers[id].terminate();
+  }
+}
diff --git a/src/v8/test/mjsunit/wasm/gc-buffer.js b/src/v8/test/mjsunit/wasm/gc-buffer.js
index 42cf6ae..d8aa9a8 100644
--- a/src/v8/test/mjsunit/wasm/gc-buffer.js
+++ b/src/v8/test/mjsunit/wasm/gc-buffer.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm --gc-interval=500 --stress-compaction --expose-gc
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 function run(f) {
diff --git a/src/v8/test/mjsunit/wasm/gc-frame.js b/src/v8/test/mjsunit/wasm/gc-frame.js
index c5ff0ff..de8bdab 100644
--- a/src/v8/test/mjsunit/wasm/gc-frame.js
+++ b/src/v8/test/mjsunit/wasm/gc-frame.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm --expose-gc
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 function makeFFI(func, t) {
diff --git a/src/v8/test/mjsunit/wasm/gc-stress.js b/src/v8/test/mjsunit/wasm/gc-stress.js
index db425ea..8daff42 100644
--- a/src/v8/test/mjsunit/wasm/gc-stress.js
+++ b/src/v8/test/mjsunit/wasm/gc-stress.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm --gc-interval=500 --stress-compaction
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 function run(f) {
diff --git a/src/v8/test/mjsunit/wasm/globals.js b/src/v8/test/mjsunit/wasm/globals.js
index 21f73eb..b29993a 100644
--- a/src/v8/test/mjsunit/wasm/globals.js
+++ b/src/v8/test/mjsunit/wasm/globals.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 (function TestMultipleInstances() {
@@ -102,7 +101,7 @@
   builder.addGlobal(kWasmI32);  // pad
 
   var instance = builder.instantiate();
-  assertEquals(expected, instance.exports.foo);
+  assertEquals(expected, instance.exports.foo.value);
 }
 
 TestExported(kWasmI32, 455.5, 455);
@@ -118,7 +117,9 @@
   g.init = 1234;
   builder.addGlobal(kWasmI32);  // pad
 
-  assertThrows(()=> {builder.instantiate()}, WebAssembly.LinkError);
+  var instance = builder.instantiate();
+  assertTrue(instance.exports.foo instanceof WebAssembly.Global);
+  assertThrows(() => {instance.exports.foo.value}, TypeError);
 })();
 
 function TestImportedExported(type, val, expected) {
@@ -133,7 +134,7 @@
   builder.addGlobal(kWasmI32);  // pad
 
   var instance = builder.instantiate({ttt: {foo: val}});
-  assertEquals(expected, instance.exports.bar);
+  assertEquals(expected, instance.exports.bar.value);
 }
 
 TestImportedExported(kWasmI32, 415.5, 415);
diff --git a/src/v8/test/mjsunit/wasm/graceful_shutdown.js b/src/v8/test/mjsunit/wasm/graceful_shutdown.js
index 53d3801..aa50e6c 100644
--- a/src/v8/test/mjsunit/wasm/graceful_shutdown.js
+++ b/src/v8/test/mjsunit/wasm/graceful_shutdown.js
@@ -2,9 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-wasm --wasm-async-compilation
+// Flags: --expose-wasm --no-wait-for-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 (function CompileFunctionsTest() {
diff --git a/src/v8/test/mjsunit/wasm/graceful_shutdown_during_tierup.js b/src/v8/test/mjsunit/wasm/graceful_shutdown_during_tierup.js
new file mode 100644
index 0000000..17c6803
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/graceful_shutdown_during_tierup.js
@@ -0,0 +1,27 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-wait-for-wasm --wasm-tier-up
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function ShutdownDuringTierUp() {
+  // Create a big module.
+  var builder = new WasmModuleBuilder();
+
+  builder.addMemory(1, 1, true);
+  for (i = 0; i < 100; i++) {
+    builder.addFunction("sub" + i, kSig_i_i)
+      .addBody([                // --
+        kExprGetLocal, 0,       // --
+        kExprI32Const, i % 61,  // --
+        kExprI32Sub])           // --
+      .exportFunc()
+  }
+
+  var buffer = builder.toBuffer();
+  // Wait for compilation to finish, but then shutdown while tier-up is still
+  // running.
+  assertPromiseResult(WebAssembly.compile(buffer));
+})();
diff --git a/src/v8/test/mjsunit/wasm/grow-memory-detaching.js b/src/v8/test/mjsunit/wasm/grow-memory-detaching.js
index da6516a..9ab2334 100644
--- a/src/v8/test/mjsunit/wasm/grow-memory-detaching.js
+++ b/src/v8/test/mjsunit/wasm/grow-memory-detaching.js
@@ -4,14 +4,13 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 let module = (() => {
   let builder = new WasmModuleBuilder();
-  builder.addMemory(1, kV8MaxPages, false);
+  builder.addMemory(1, undefined, false);
   builder.addFunction("grow_memory", kSig_i_i)
-              .addBody([kExprGetLocal, 0, kExprGrowMemory, kMemoryZero])
+              .addBody([kExprGetLocal, 0, kExprMemoryGrow, kMemoryZero])
     .exportFunc();
   builder.exportMemoryAs("memory");
   return builder.toModule();
diff --git a/src/v8/test/mjsunit/wasm/grow-memory-in-branch.js b/src/v8/test/mjsunit/wasm/grow-memory-in-branch.js
index f0e526f..93bb56d 100644
--- a/src/v8/test/mjsunit/wasm/grow-memory-in-branch.js
+++ b/src/v8/test/mjsunit/wasm/grow-memory-in-branch.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm --stress-compaction
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 var initialMemoryPages = 1;
@@ -27,8 +26,8 @@
 
 // This test verifies that the effects of growing memory in an if branch
 // affect the result of current_memory when the branch is merged.
-(function TestGrowMemoryInIfBranchNoElse() {
-  print('TestGrowMemoryInIfBranchNoElse ...');
+(function TestMemoryGrowInIfBranchNoElse() {
+  print('TestMemoryGrowInIfBranchNoElse ...');
   let deltaPages = 4;
   let builder = generateBuilder();
   builder.addFunction('main', kSig_i_i)
@@ -36,7 +35,7 @@
         kExprGetLocal, 0,                       // get condition parameter
         kExprIf, kWasmStmt,                     // if it's 1 then enter if
           kExprI32Const, deltaPages,            // put deltaPages on stack
-          kExprGrowMemory, kMemoryZero,         // grow memory
+          kExprMemoryGrow, kMemoryZero,         // grow memory
           kExprDrop,                            // drop the result of grow
         kExprEnd,
         kExprMemorySize, kMemoryZero            // get the memory size
@@ -51,8 +50,8 @@
 
 // This test verifies that the effects of growing memory in an if branch are
 // retained when the branch is merged even when an else branch exists.
-(function TestGrowMemoryInIfBranchWithElse() {
-  print('TestGrowMemoryInIfBranchWithElse ...');
+(function TestMemoryGrowInIfBranchWithElse() {
+  print('TestMemoryGrowInIfBranchWithElse ...');
   let index = 0;
   let oldValue = 21;
   let newValue = 42;
@@ -63,7 +62,7 @@
         kExprGetLocal, 0,                       // get condition parameter
         kExprIf, kWasmStmt,                     // if it's 1 then enter if
           kExprI32Const, deltaPages,            // put deltaPages on stack
-          kExprGrowMemory, kMemoryZero,         // grow memory
+          kExprMemoryGrow, kMemoryZero,         // grow memory
           kExprDrop,                            // drop the result of grow
         kExprElse,
           kExprI32Const, index,                 // put index on stack
@@ -86,8 +85,8 @@
 
 // This test verifies that the effects of growing memory in an else branch
 // affect the result of current_memory when the branch is merged.
-(function TestGrowMemoryInElseBranch() {
-  print('TestGrowMemoryInElseBranch ...');
+(function TestMemoryGrowInElseBranch() {
+  print('TestMemoryGrowInElseBranch ...');
   let index = 0;
   let oldValue = 21;
   let newValue = 42;
@@ -102,7 +101,7 @@
           kExprI32StoreMem, 0, 0,               // store
         kExprElse,
           kExprI32Const, deltaPages,            // put deltaPages on stack
-          kExprGrowMemory, kMemoryZero,         // grow memory
+          kExprMemoryGrow, kMemoryZero,         // grow memory
           kExprDrop,                            // drop the result of grow
         kExprEnd,
         kExprMemorySize, kMemoryZero            // get the memory size
@@ -121,8 +120,8 @@
 
 // This test verifies that the effects of growing memory in an if/else
 // branch affect the result of current_memory when the branches are merged.
-(function TestGrowMemoryInBothIfAndElse() {
-  print('TestGrowMemoryInBothIfAndElse ...');
+(function TestMemoryGrowInBothIfAndElse() {
+  print('TestMemoryGrowInBothIfAndElse ...');
   let deltaPagesIf = 1;
   let deltaPagesElse = 2;
   let builder = generateBuilder();
@@ -131,11 +130,11 @@
         kExprGetLocal, 0,                       // get condition parameter
         kExprIf, kWasmStmt,                     // if it's 1 then enter if
           kExprI32Const, deltaPagesIf,          // put deltaPagesIf on stack
-          kExprGrowMemory, kMemoryZero,         // grow memory
+          kExprMemoryGrow, kMemoryZero,         // grow memory
           kExprDrop,                            // drop the result of grow
         kExprElse,
           kExprI32Const, deltaPagesElse,        // put deltaPagesElse on stack
-          kExprGrowMemory, kMemoryZero,         // grow memory
+          kExprMemoryGrow, kMemoryZero,         // grow memory
           kExprDrop,                            // drop the result of grow
         kExprEnd,
         kExprMemorySize, kMemoryZero            // get the memory size
@@ -152,8 +151,8 @@
 
 // This test verifies that the effects of growing memory in an if branch are
 // retained when the branch is merged.
-(function TestGrowMemoryAndStoreInIfBranchNoElse() {
-  print('TestGrowMemoryAndStoreInIfBranchNoElse ...');
+(function TestMemoryGrowAndStoreInIfBranchNoElse() {
+  print('TestMemoryGrowAndStoreInIfBranchNoElse ...');
   let index = 2 * kPageSize - 4;
   let value = 42;
   let deltaPages = 1;
@@ -163,7 +162,7 @@
         kExprGetLocal, 0,                       // get condition parameter
         kExprIf, kWasmStmt,                     // if it's 1 then enter if
           kExprI32Const, deltaPages,            // put deltaPages on stack
-          kExprGrowMemory, kMemoryZero,         // grow memory
+          kExprMemoryGrow, kMemoryZero,         // grow memory
           kExprDrop,                            // drop the result of grow
           kExprGetLocal, 1,                     // get index parameter
           kExprI32Const, value,                 // put the value on stack
@@ -184,8 +183,8 @@
 
 // This test verifies that the effects of growing memory in an if branch are
 // retained when the branch is merged even when  an else branch exists.
-(function TestGrowMemoryAndStoreInIfBranchWithElse() {
-  print('TestGrowMemoryAndStoreInIfBranchWithElse ...');
+(function TestMemoryGrowAndStoreInIfBranchWithElse() {
+  print('TestMemoryGrowAndStoreInIfBranchWithElse ...');
   let index = 2 * kPageSize - 4;
   let value = 42;
   let deltaPages = 1;
@@ -195,7 +194,7 @@
         kExprGetLocal, 0,                       // get condition parameter
         kExprIf, kWasmStmt,                     // if it's 1 then enter if
           kExprI32Const, deltaPages,            // put deltaPages on stack
-          kExprGrowMemory, kMemoryZero,         // grow memory
+          kExprMemoryGrow, kMemoryZero,         // grow memory
           kExprDrop,                            // drop the result of grow
           kExprGetLocal, 1,                     // get index parameter
           kExprI32Const, value,                 // put the value on stack
@@ -219,8 +218,8 @@
 
 // This test verifies that the effects of growing memory in an else branch are
 // retained when the branch is merged.
-(function TestGrowMemoryAndStoreInElseBranch() {
-  print('TestGrowMemoryAndStoreInElseBranch ...');
+(function TestMemoryGrowAndStoreInElseBranch() {
+  print('TestMemoryGrowAndStoreInElseBranch ...');
   let index = 2 * kPageSize - 4;
   let value = 42;
   let deltaPages = 1;
@@ -234,7 +233,7 @@
           kExprI32StoreMem, 0, 0,               // store
         kExprElse,
           kExprI32Const, deltaPages,            // put deltaPages on stack
-          kExprGrowMemory, kMemoryZero,         // grow memory
+          kExprMemoryGrow, kMemoryZero,         // grow memory
           kExprDrop,                            // drop the result of grow
           kExprGetLocal, 1,                     // get index parameter
           kExprI32Const, value,                 // put the value on stack
@@ -254,8 +253,8 @@
 
 // This test verifies that the effects of growing memory in an if/else branch
 // are retained when the branch is merged.
-(function TestGrowMemoryAndStoreInBothIfAndElse() {
-  print('TestGrowMemoryAndStoreInBothIfAndElse ...');
+(function TestMemoryGrowAndStoreInBothIfAndElse() {
+  print('TestMemoryGrowAndStoreInBothIfAndElse ...');
   let index = 0;
   let valueIf = 21;
   let valueElse = 42;
@@ -267,14 +266,14 @@
         kExprGetLocal, 0,                       // get condition parameter
         kExprIf, kWasmStmt,                     // if it's 1 then enter if
           kExprI32Const, deltaPagesIf,          // put deltaPagesIf on stack
-          kExprGrowMemory, kMemoryZero,         // grow memory
+          kExprMemoryGrow, kMemoryZero,         // grow memory
           kExprDrop,                            // drop the result of grow
           kExprGetLocal, 1,                     // get index parameter
           kExprI32Const, valueIf,               // put valueIf on stack
           kExprI32StoreMem, 0, 0,               // store
         kExprElse,
           kExprI32Const, deltaPagesElse,        // put deltaPagesElse on stack
-          kExprGrowMemory, kMemoryZero,         // grow memory
+          kExprMemoryGrow, kMemoryZero,         // grow memory
           kExprDrop,                            // drop the result of grow
           kExprGetLocal, 1,                     // get index parameter
           kExprI32Const, valueElse,             // put valueElse on stack
diff --git a/src/v8/test/mjsunit/wasm/grow-memory-in-call.js b/src/v8/test/mjsunit/wasm/grow-memory-in-call.js
index 750e769..1790f97 100644
--- a/src/v8/test/mjsunit/wasm/grow-memory-in-call.js
+++ b/src/v8/test/mjsunit/wasm/grow-memory-in-call.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm --stress-compaction
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 var initialMemoryPages = 1;
@@ -15,13 +14,13 @@
 
 // This test verifies that the current_memory instruction returns the correct
 // value after returning from a function (direct call) that grew memory.
-(function TestGrowMemoryInFunction() {
-  print('TestGrowMemoryInFunction ...');
+(function TestMemoryGrowInFunction() {
+  print('TestMemoryGrowInFunction ...');
   let builder = new WasmModuleBuilder();
   builder.addMemory(initialMemoryPages, maximumMemoryPages, true);
   let kGrowFunction =
       builder.addFunction('grow', kSig_i_i)
-          .addBody([kExprGetLocal, 0, kExprGrowMemory, kMemoryZero])
+          .addBody([kExprGetLocal, 0, kExprMemoryGrow, kMemoryZero])
           .exportFunc()
           .index;
   builder.addFunction('main', kSig_i_i)
@@ -41,14 +40,14 @@
 
 // This test verifies that accessing a memory page that has been created inside
 // a function (direct call) does not trap in the caller.
-(function TestGrowMemoryAndAccessInFunction() {
-  print('TestGrowMemoryAndAccessInFunction ...');
+(function TestMemoryGrowAndAccessInFunction() {
+  print('TestMemoryGrowAndAccessInFunction ...');
   let index = 2 * kPageSize - 4;
   let builder = new WasmModuleBuilder();
   builder.addMemory(initialMemoryPages, maximumMemoryPages, true);
   let kGrowFunction =
       builder.addFunction('grow', kSig_i_i)
-          .addBody([kExprGetLocal, 0, kExprGrowMemory, kMemoryZero])
+          .addBody([kExprGetLocal, 0, kExprMemoryGrow, kMemoryZero])
           .exportFunc()
           .index;
   builder.addFunction('load', kSig_i_i)
@@ -75,8 +74,8 @@
 // This test verifies that when a function (direct call) grows and store
 // something in the grown memory, the caller always reads from the grown
 // memory. This checks that the memory start address gets updated in the caller.
-(function TestGrowMemoryAndStoreInFunction() {
-  print('TestGrowMemoryAndStoreInFunction ...');
+(function TestMemoryGrowAndStoreInFunction() {
+  print('TestMemoryGrowAndStoreInFunction ...');
   let index = 0;
   let oldValue = 21;
   let newValue = 42;
@@ -87,7 +86,7 @@
       builder.addFunction('grow', kSig_v_v)
           .addBody([
             kExprI32Const, deltaPages,     // always grow memory by deltaPages
-            kExprGrowMemory, kMemoryZero,  // grow memory
+            kExprMemoryGrow, kMemoryZero,  // grow memory
             kExprDrop,                     // drop the result of grow
             kExprI32Const, index,          // put index on stack
             kExprI32Const, newValue,       // put new value on stack
@@ -113,13 +112,13 @@
 // This test verifies that the effects of growing memory in an directly
 // called function inside a loop affect the result of current_memory when
 // the loop is over.
-(function TestGrowMemoryInFunctionInsideLoop() {
-  print('TestGrowMemoryInFunctionInsideLoop ...');
+(function TestMemoryGrowInFunctionInsideLoop() {
+  print('TestMemoryGrowInFunctionInsideLoop ...');
   let builder = new WasmModuleBuilder();
   builder.addMemory(initialMemoryPages, maximumMemoryPages, true);
   let kGrowFunction =
       builder.addFunction('grow', kSig_i_i)
-          .addBody([kExprGetLocal, 0, kExprGrowMemory, kMemoryZero])
+          .addBody([kExprGetLocal, 0, kExprMemoryGrow, kMemoryZero])
           .exportFunc()
           .index;
   builder.addFunction('main', kSig_i_ii)
@@ -156,8 +155,8 @@
 
 // This test verifies that the effects of writing to memory grown in an
 // directly called function inside a loop are retained when the loop is over.
-(function TestGrowMemoryAndStoreInFunctionInsideLoop() {
-  print('TestGrowMemoryAndStoreInFunctionInsideLoop ...');
+(function TestMemoryGrowAndStoreInFunctionInsideLoop() {
+  print('TestMemoryGrowAndStoreInFunctionInsideLoop ...');
   let builder = new WasmModuleBuilder();
   builder.addMemory(initialMemoryPages, maximumMemoryPages, true);
   builder.addFunction('store', kSig_i_ii)
@@ -168,7 +167,7 @@
       .exportFunc();
   let kGrowFunction =
       builder.addFunction('grow', kSig_i_i)
-          .addBody([kExprGetLocal, 0, kExprGrowMemory, kMemoryZero])
+          .addBody([kExprGetLocal, 0, kExprMemoryGrow, kMemoryZero])
           .exportFunc()
           .index;
   // parameters:  iterations, deltaPages, index
@@ -220,13 +219,13 @@
 
 // This test verifies that the current_memory instruction returns the correct
 // value after returning from a function (indirect call) that grew memory.
-(function TestGrowMemoryInIndirectCall() {
-  print('TestGrowMemoryInIndirectCall ...');
+(function TestMemoryGrowInIndirectCall() {
+  print('TestMemoryGrowInIndirectCall ...');
   let builder = new WasmModuleBuilder();
   builder.addMemory(initialMemoryPages, maximumMemoryPages, true);
   let kGrowFunction =
       builder.addFunction('grow', kSig_i_i)
-          .addBody([kExprGetLocal, 0, kExprGrowMemory, kMemoryZero])
+          .addBody([kExprGetLocal, 0, kExprMemoryGrow, kMemoryZero])
           .exportFunc()
           .index;
   builder.addFunction('main', kSig_i_ii)
@@ -249,14 +248,14 @@
 
 // This test verifies that accessing a memory page that has been created inside
 // a function (indirect call) does not trap in the caller.
-(function TestGrowMemoryAndAccessInIndirectCall() {
-  print('TestGrowMemoryAndAccessInIndirectCall ...');
+(function TestMemoryGrowAndAccessInIndirectCall() {
+  print('TestMemoryGrowAndAccessInIndirectCall ...');
   let index = 2 * kPageSize - 4;
   let builder = new WasmModuleBuilder();
   builder.addMemory(initialMemoryPages, maximumMemoryPages, true);
   let kGrowFunction =
       builder.addFunction('grow', kSig_i_i)
-          .addBody([kExprGetLocal, 0, kExprGrowMemory, kMemoryZero])
+          .addBody([kExprGetLocal, 0, kExprMemoryGrow, kMemoryZero])
           .exportFunc()
           .index;
   builder.addFunction('load', kSig_i_i)
@@ -287,8 +286,8 @@
 // This test verifies that when a function (indirect call) grows and store
 // something in the grown memory, the caller always reads from the grown
 // memory. This checks that the memory start address gets updated in the caller.
-(function TestGrowMemoryAndStoreInIndirectCall() {
-  print('TestGrowMemoryAndStoreInIndirectCall ...');
+(function TestMemoryGrowAndStoreInIndirectCall() {
+  print('TestMemoryGrowAndStoreInIndirectCall ...');
   let index = 0;
   let oldValue = 21;
   let newValue = 42;
@@ -299,7 +298,7 @@
       builder.addFunction('grow', kSig_v_v)
           .addBody([
             kExprI32Const, deltaPages,     // always grow memory by deltaPages
-            kExprGrowMemory, kMemoryZero,  // grow memory
+            kExprMemoryGrow, kMemoryZero,  // grow memory
             kExprDrop,                     // drop the result of grow
             kExprI32Const, index,          // put index on stack
             kExprI32Const, newValue,       // put new value on stack
@@ -327,13 +326,13 @@
 // This test verifies that the effects of growing memory in an indirectly
 // called function inside a loop affect the result of current_memory when
 // the loop is over.
-(function TestGrowMemoryInIndirectCallInsideLoop() {
-  print('TestGrowMemoryInIndirectCallInsideLoop ...');
+(function TestMemoryGrowInIndirectCallInsideLoop() {
+  print('TestMemoryGrowInIndirectCallInsideLoop ...');
   let builder = new WasmModuleBuilder();
   builder.addMemory(initialMemoryPages, maximumMemoryPages, true);
   let kGrowFunction =
       builder.addFunction('grow', kSig_i_i)
-          .addBody([kExprGetLocal, 0, kExprGrowMemory, kMemoryZero])
+          .addBody([kExprGetLocal, 0, kExprMemoryGrow, kMemoryZero])
           .exportFunc()
           .index;
   builder.addFunction('main', kSig_i_iii)
@@ -372,14 +371,14 @@
 
 // This test verifies that the effects of writing to memory grown in an
 // indirectly called function inside a loop are retained when the loop is over.
-(function TestGrowMemoryAndStoreInIndirectCallInsideLoop() {
-  print('TestGrowMemoryAndStoreInIndirectCallInsideLoop ...');
+(function TestMemoryGrowAndStoreInIndirectCallInsideLoop() {
+  print('TestMemoryGrowAndStoreInIndirectCallInsideLoop ...');
   let builder = new WasmModuleBuilder();
   let deltaPages = 1;
   builder.addMemory(initialMemoryPages, maximumMemoryPages, true);
   let kGrowFunction =
       builder.addFunction('grow', kSig_i_i)
-          .addBody([kExprGetLocal, 0, kExprGrowMemory, kMemoryZero])
+          .addBody([kExprGetLocal, 0, kExprMemoryGrow, kMemoryZero])
           .exportFunc()
           .index;
   builder.addFunction('store', kSig_i_ii)
diff --git a/src/v8/test/mjsunit/wasm/grow-memory-in-loop.js b/src/v8/test/mjsunit/wasm/grow-memory-in-loop.js
index 8bb1018..ed04e23 100644
--- a/src/v8/test/mjsunit/wasm/grow-memory-in-loop.js
+++ b/src/v8/test/mjsunit/wasm/grow-memory-in-loop.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm --stress-compaction
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 let initialPages = 1;
@@ -24,8 +23,8 @@
 
 // This test verifies that the effects of growing memory inside a loop
 // affect the result of current_memory when the loop is over.
-(function TestGrowMemoryInsideLoop() {
-  print('TestGrowMemoryInsideLoop ...');
+(function TestMemoryGrowInsideLoop() {
+  print('TestMemoryGrowInsideLoop ...');
   let deltaPages = 1;
   let builder = generateBuilder();
   builder.addFunction('main', kSig_i_i)
@@ -36,7 +35,7 @@
           kExprIf, kWasmStmt,                   // if <param0> != 0
             // Grow memory.
             kExprI32Const, deltaPages,          // -
-            kExprGrowMemory, kMemoryZero,       // grow memory
+            kExprMemoryGrow, kMemoryZero,       // grow memory
             kExprDrop,                          // drop the result of grow
             // Decrease loop variable.
             kExprGetLocal, 0,                   // -
@@ -71,8 +70,8 @@
 
 // This test verifies that a loop does not affect the result of current_memory
 // when the memory is grown both inside and outside the loop.
-(function TestGrowMemoryInsideAndOutsideLoop() {
-  print('TestGrowMemoryInsideAndOutsideLoop ...');
+(function TestMemoryGrowInsideAndOutsideLoop() {
+  print('TestMemoryGrowInsideAndOutsideLoop ...');
   let deltaPagesIn = 1;
   let deltaPagesOut = 2;
   let builder = generateBuilder();
@@ -81,14 +80,14 @@
         // clang-format off
         // Grow memory.
         kExprI32Const, deltaPagesOut,           // -
-        kExprGrowMemory, kMemoryZero,           // grow memory
+        kExprMemoryGrow, kMemoryZero,           // grow memory
         kExprDrop,                              // drop the result of grow
         kExprLoop, kWasmStmt,                   // while
           kExprGetLocal, 0,                     // -
           kExprIf, kWasmStmt,                   // if <param0> != 0
             // Grow memory.
             kExprI32Const, deltaPagesIn,        // -
-            kExprGrowMemory, kMemoryZero,       // grow memory
+            kExprMemoryGrow, kMemoryZero,       // grow memory
             kExprDrop,                          // drop the result of grow
             // Decrease loop variable.
             kExprGetLocal, 0,                   // -
@@ -125,8 +124,8 @@
 
 // This test verifies that the effects of writing to memory grown inside a loop
 // are retained when the loop is over.
-(function TestGrowMemoryAndStoreInsideLoop() {
-  print('TestGrowMemoryAndStoreInsideLoop ...');
+(function TestMemoryGrowAndStoreInsideLoop() {
+  print('TestMemoryGrowAndStoreInsideLoop ...');
   let deltaPages = 1;
   let builder = generateBuilder();
   builder.addFunction('main', kSig_i_ii)
@@ -137,7 +136,7 @@
           kExprIf, kWasmStmt,                   // if <param0> != 0
             // Grow memory.
             kExprI32Const, deltaPages,          // -
-            kExprGrowMemory, kMemoryZero,       // grow memory
+            kExprMemoryGrow, kMemoryZero,       // grow memory
             kExprDrop,                          // drop the result of grow
             // Increase counter in memory.
             kExprGetLocal, 1,                   // put index (for store)
@@ -183,8 +182,8 @@
 
 // This test verifies that a loop does not affect the memory when the
 // memory is grown both inside and outside the loop.
-(function TestGrowMemoryAndStoreInsideAndOutsideLoop() {
-  print('TestGrowMemoryAndStoreInsideAndOutsideLoop ...');
+(function TestMemoryGrowAndStoreInsideAndOutsideLoop() {
+  print('TestMemoryGrowAndStoreInsideAndOutsideLoop ...');
   let deltaPagesIn = 1;
   let deltaPagesOut = 2;
   let builder = generateBuilder();
@@ -193,7 +192,7 @@
         // clang-format off
         // Grow memory.
         kExprI32Const, deltaPagesOut,           // -
-        kExprGrowMemory, kMemoryZero,           // grow memory
+        kExprMemoryGrow, kMemoryZero,           // grow memory
         kExprDrop,                              // drop the result of grow
         // Increase counter in memory.
         kExprGetLocal, 1,                       // put index (for store)
@@ -208,7 +207,7 @@
           kExprIf, kWasmStmt,                   // if <param0> != 0
             // Grow memory.
             kExprI32Const, deltaPagesIn,        // -
-            kExprGrowMemory, kMemoryZero,       // grow memory
+            kExprMemoryGrow, kMemoryZero,       // grow memory
             kExprDrop,                          // drop the result of grow
             // Increase counter in memory.
             kExprGetLocal, 1,                   // put index (for store)
diff --git a/src/v8/test/mjsunit/wasm/grow-memory.js b/src/v8/test/mjsunit/wasm/grow-memory.js
index fc82dc6..0e5618a 100644
--- a/src/v8/test/mjsunit/wasm/grow-memory.js
+++ b/src/v8/test/mjsunit/wasm/grow-memory.js
@@ -4,14 +4,13 @@
 
 // Flags: --expose-wasm --stress-compaction
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 
-function genGrowMemoryBuilder() {
+function genMemoryGrowBuilder() {
   var builder = new WasmModuleBuilder();
   builder.addFunction("grow_memory", kSig_i_i)
-      .addBody([kExprGetLocal, 0, kExprGrowMemory, kMemoryZero])
+      .addBody([kExprGetLocal, 0, kExprMemoryGrow, kMemoryZero])
       .exportFunc();
   builder.addFunction("load", kSig_i_i)
       .addBody([kExprGetLocal, 0, kExprI32LoadMem, 0, 0])
@@ -37,11 +36,15 @@
   return builder;
 }
 
+// V8 internal memory size limit.
+var kV8MaxPages = 32767;
+
+
 // TODO(gdeepti): Generate tests programatically for all the sizes instead of
 // current implementation.
-function testGrowMemoryReadWrite32() {
-  var builder = genGrowMemoryBuilder();
-  builder.addMemory(1, kV8MaxPages, false);
+function testMemoryGrowReadWrite32() {
+  var builder = genMemoryGrowBuilder();
+  builder.addMemory(1, undefined, false);
   var module = builder.instantiate();
   var offset;
   function peek() { return module.exports.load(offset); }
@@ -84,11 +87,11 @@
   }
 }
 
-testGrowMemoryReadWrite32();
+testMemoryGrowReadWrite32();
 
-function testGrowMemoryReadWrite16() {
-  var builder = genGrowMemoryBuilder();
-  builder.addMemory(1, kV8MaxPages, false);
+function testMemoryGrowReadWrite16() {
+  var builder = genMemoryGrowBuilder();
+  builder.addMemory(1, undefined, false);
   var module = builder.instantiate();
   var offset;
   function peek() { return module.exports.load16(offset); }
@@ -131,11 +134,11 @@
   }
 }
 
-testGrowMemoryReadWrite16();
+testMemoryGrowReadWrite16();
 
-function testGrowMemoryReadWrite8() {
-  var builder = genGrowMemoryBuilder();
-  builder.addMemory(1, kV8MaxPages, false);
+function testMemoryGrowReadWrite8() {
+  var builder = genMemoryGrowBuilder();
+  builder.addMemory(1, undefined, false);
   var module = builder.instantiate();
   var offset;
   function peek() { return module.exports.load8(offset); }
@@ -178,11 +181,11 @@
   }
 }
 
-testGrowMemoryReadWrite8();
+testMemoryGrowReadWrite8();
 
-function testGrowMemoryZeroInitialSize() {
-  var builder = genGrowMemoryBuilder();
-  builder.addMemory(0, kV8MaxPages, false);
+function testMemoryGrowZeroInitialSize() {
+  var builder = genMemoryGrowBuilder();
+  builder.addMemory(0, undefined, false);
   var module = builder.instantiate();
   var offset;
   function peek() { return module.exports.load(offset); }
@@ -212,11 +215,11 @@
   assertEquals(20, peek());
 }
 
-testGrowMemoryZeroInitialSize();
+testMemoryGrowZeroInitialSize();
 
-function testGrowMemoryZeroInitialSize32() {
-  var builder = genGrowMemoryBuilder();
-  builder.addMemory(0, kV8MaxPages, false);
+function testMemoryGrowZeroInitialSize32() {
+  var builder = genMemoryGrowBuilder();
+  builder.addMemory(0, undefined, false);
   var module = builder.instantiate();
   var offset;
   function peek() { return module.exports.load(offset); }
@@ -238,11 +241,11 @@
   }
 }
 
-testGrowMemoryZeroInitialSize32();
+testMemoryGrowZeroInitialSize32();
 
-function testGrowMemoryZeroInitialSize16() {
-  var builder = genGrowMemoryBuilder();
-  builder.addMemory(0, kV8MaxPages, false);
+function testMemoryGrowZeroInitialSize16() {
+  var builder = genMemoryGrowBuilder();
+  builder.addMemory(0, undefined, false);
   var module = builder.instantiate();
   var offset;
   function peek() { return module.exports.load16(offset); }
@@ -264,11 +267,11 @@
   }
 }
 
-testGrowMemoryZeroInitialSize16();
+testMemoryGrowZeroInitialSize16();
 
-function testGrowMemoryZeroInitialSize8() {
-  var builder = genGrowMemoryBuilder();
-  builder.addMemory(0, kV8MaxPages, false);
+function testMemoryGrowZeroInitialSize8() {
+  var builder = genMemoryGrowBuilder();
+  builder.addMemory(0, undefined, false);
   var module = builder.instantiate();
   var offset;
   function peek() { return module.exports.load8(offset); }
@@ -290,31 +293,31 @@
   }
 }
 
-testGrowMemoryZeroInitialSize8();
+testMemoryGrowZeroInitialSize8();
 
-function testGrowMemoryTrapMaxPagesZeroInitialMemory() {
-  var builder = genGrowMemoryBuilder();
-  builder.addMemory(0, kV8MaxPages, false);
+function testMemoryGrowTrapMaxPagesZeroInitialMemory() {
+  var builder = genMemoryGrowBuilder();
+  builder.addMemory(0, undefined, false);
   var module = builder.instantiate();
   function growMem(pages) { return module.exports.grow_memory(pages); }
   assertEquals(-1, growMem(kV8MaxPages + 1));
 }
 
-testGrowMemoryTrapMaxPagesZeroInitialMemory();
+testMemoryGrowTrapMaxPagesZeroInitialMemory();
 
-function testGrowMemoryTrapMaxPages() {
-  var builder = genGrowMemoryBuilder();
+function testMemoryGrowTrapMaxPages() {
+  var builder = genMemoryGrowBuilder();
   builder.addMemory(1, 1, false);
   var module = builder.instantiate();
   function growMem(pages) { return module.exports.grow_memory(pages); }
   assertEquals(-1, growMem(kV8MaxPages));
 }
 
-testGrowMemoryTrapMaxPages();
+testMemoryGrowTrapMaxPages();
 
-function testGrowMemoryTrapsWithNonSmiInput() {
-  var builder = genGrowMemoryBuilder();
-  builder.addMemory(0, kV8MaxPages, false);
+function testMemoryGrowTrapsWithNonSmiInput() {
+  var builder = genMemoryGrowBuilder();
+  builder.addMemory(0, undefined, false);
   var module = builder.instantiate();
   function growMem(pages) { return module.exports.grow_memory(pages); }
   // The parameter of grow_memory is unsigned. Therefore -1 stands for
@@ -322,11 +325,11 @@
   assertEquals(-1, growMem(-1));
 };
 
-testGrowMemoryTrapsWithNonSmiInput();
+testMemoryGrowTrapsWithNonSmiInput();
 
-function testGrowMemoryCurrentMemory() {
-  var builder = genGrowMemoryBuilder();
-  builder.addMemory(1, kV8MaxPages, false);
+function testMemoryGrowCurrentMemory() {
+  var builder = genMemoryGrowBuilder();
+  builder.addMemory(1, undefined, false);
   builder.addFunction("memory_size", kSig_i_v)
       .addBody([kExprMemorySize, kMemoryZero])
       .exportFunc();
@@ -338,11 +341,11 @@
   assertEquals(2, MemSize());
 }
 
-testGrowMemoryCurrentMemory();
+testMemoryGrowCurrentMemory();
 
-function testGrowMemoryPreservesDataMemOp32() {
-  var builder = genGrowMemoryBuilder();
-  builder.addMemory(1, kV8MaxPages, false);
+function testMemoryGrowPreservesDataMemOp32() {
+  var builder = genMemoryGrowBuilder();
+  builder.addMemory(1, undefined, false);
   var module = builder.instantiate();
   var offset, val;
   function peek() { return module.exports.load(offset); }
@@ -361,11 +364,11 @@
   }
 }
 
-testGrowMemoryPreservesDataMemOp32();
+testMemoryGrowPreservesDataMemOp32();
 
-function testGrowMemoryPreservesDataMemOp16() {
-  var builder = genGrowMemoryBuilder();
-  builder.addMemory(1, kV8MaxPages, false);
+function testMemoryGrowPreservesDataMemOp16() {
+  var builder = genMemoryGrowBuilder();
+  builder.addMemory(1, undefined, false);
   var module = builder.instantiate();
   var offset, val;
   function peek() { return module.exports.load16(offset); }
@@ -384,11 +387,11 @@
   }
 }
 
-testGrowMemoryPreservesDataMemOp16();
+testMemoryGrowPreservesDataMemOp16();
 
-function testGrowMemoryPreservesDataMemOp8() {
-  var builder = genGrowMemoryBuilder();
-  builder.addMemory(1, kV8MaxPages, false);
+function testMemoryGrowPreservesDataMemOp8() {
+  var builder = genMemoryGrowBuilder();
+  builder.addMemory(1, undefined, false);
   var module = builder.instantiate();
   var offset, val = 0;
   function peek() { return module.exports.load8(offset); }
@@ -411,11 +414,11 @@
   }
 }
 
-testGrowMemoryPreservesDataMemOp8();
+testMemoryGrowPreservesDataMemOp8();
 
-function testGrowMemoryOutOfBoundsOffset() {
-  var builder = genGrowMemoryBuilder();
-  builder.addMemory(1, kV8MaxPages, false);
+function testMemoryGrowOutOfBoundsOffset() {
+  var builder = genMemoryGrowBuilder();
+  builder.addMemory(1, undefined, false);
   var module = builder.instantiate();
   var offset, val;
   function peek() { return module.exports.load(offset); }
@@ -443,16 +446,16 @@
   }
 }
 
-testGrowMemoryOutOfBoundsOffset();
+testMemoryGrowOutOfBoundsOffset();
 
-function testGrowMemoryOutOfBoundsOffset2() {
+function testMemoryGrowOutOfBoundsOffset2() {
   var builder = new WasmModuleBuilder();
   builder.addMemory(16, 128, false);
   builder.addFunction("main", kSig_v_v)
       .addBody([
           kExprI32Const, 20,
           kExprI32Const, 29,
-          kExprGrowMemory, kMemoryZero,
+          kExprMemoryGrow, kMemoryZero,
           kExprI32StoreMem, 0, 0xFF, 0xFF, 0xFF, 0x3a
           ])
       .exportAs("main");
@@ -460,10 +463,10 @@
   assertTraps(kTrapMemOutOfBounds, module.exports.main);
 }
 
-testGrowMemoryOutOfBoundsOffset2();
+testMemoryGrowOutOfBoundsOffset2();
 
-function testGrowMemoryDeclaredMaxTraps() {
-  var builder = genGrowMemoryBuilder();
+function testMemoryGrowDeclaredMaxTraps() {
+  var builder = genMemoryGrowBuilder();
   builder.addMemory(1, 16, false);
   var module = builder.instantiate();
   function growMem(pages) { return module.exports.grow_memory(pages); }
@@ -472,13 +475,13 @@
   assertEquals(-1, growMem(6));
 }
 
-testGrowMemoryDeclaredMaxTraps();
+testMemoryGrowDeclaredMaxTraps();
 
-function testGrowMemoryDeclaredSpecMaxTraps() {
+function testMemoryGrowDeclaredSpecMaxTraps() {
   // The spec maximum is higher than the internal V8 maximum. This test only
   // checks that grow_memory does not grow past the internally defined maximum
   // to reflect the current implementation.
-  var builder = genGrowMemoryBuilder();
+  var builder = genMemoryGrowBuilder();
   builder.addMemory(1, kSpecMaxPages, false);
   var module = builder.instantiate();
   function poke(value) { return module.exports.store(offset, value); }
@@ -487,12 +490,12 @@
   assertEquals(-1, growMem(kV8MaxPages - 20));
 }
 
-testGrowMemoryDeclaredSpecMaxTraps();
+testMemoryGrowDeclaredSpecMaxTraps();
 
-function testGrowMemory2Gb() {
-  print("testGrowMemory2Gb");
-  var builder = genGrowMemoryBuilder();
-  builder.addMemory(1, kV8MaxPages, false);
+function testMemoryGrow2Gb() {
+  print("testMemoryGrow2Gb");
+  var builder = genMemoryGrowBuilder();
+  builder.addMemory(1, undefined, false);
   var module = builder.instantiate();
   var offset, val;
   function peek() { return module.exports.load(offset); }
@@ -538,4 +541,4 @@
   }
 }
 
-testGrowMemory2Gb();
+testMemoryGrow2Gb();
diff --git a/src/v8/test/mjsunit/wasm/grow-shared-memory.js b/src/v8/test/mjsunit/wasm/grow-shared-memory.js
new file mode 100644
index 0000000..bbd180b
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/grow-shared-memory.js
@@ -0,0 +1,348 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// TODO(v8:8832): Enable --stress-opt on these tests
+// Flags: --wasm-grow-shared-memory
+// Flags: --experimental-wasm-threads --no-stress-opt
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function TestGrowSharedMemoryWithoutPostMessage() {
+  print(arguments.callee.name);
+  let memory = new WebAssembly.Memory({initial: 1, maximum: 5, shared: true});
+  assertEquals(memory.buffer.byteLength, kPageSize);
+  assertEquals(1, memory.grow(1));
+  assertEquals(memory.buffer.byteLength, 2 * kPageSize);
+})();
+
+function assertIsWasmSharedMemory(memory) {
+ assertTrue(memory instanceof Object,
+     "Memory is not an object");
+ assertTrue(memory instanceof WebAssembly.Memory,
+     "Object is not WebAssembly.Memory" );
+ assertTrue(memory.buffer instanceof SharedArrayBuffer,
+     "Memory.buffer is not a SharedArrayBuffer");
+ assertTrue(Object.isFrozen(memory.buffer),
+     "Memory.buffer not frozen");
+}
+
+function assertTrue(value, msg) {
+  if (!value) {
+    postMessage("Error: " + msg);
+    throw new Error("Exit");  // To stop testing.
+  }
+}
+
+let workerHelpers = assertTrue.toString() + assertIsWasmSharedMemory.toString();
+
+(function TestPostMessageWithGrow() {
+  print(arguments.callee.name);
+  let worker = new Worker(workerHelpers +
+    `onmessage = function(obj) {
+       assertIsWasmSharedMemory(obj.memory);
+       assertTrue(1 === obj.memory.grow(1));
+       assertTrue(obj.memory.buffer.byteLength === obj.expected_size);
+       assertIsWasmSharedMemory(obj.memory);
+       postMessage("OK");
+     }`, {type: 'string'});
+
+  let memory = new WebAssembly.Memory({initial: 1, maximum: 5, shared: true});
+  let obj = {memory: memory, expected_size: 2 * kPageSize};
+  assertEquals(obj.memory.buffer.byteLength, kPageSize);
+  worker.postMessage(obj);
+  assertEquals("OK", worker.getMessage());
+  assertEquals(obj.memory.buffer.byteLength, 2 * kPageSize);
+  worker.terminate();
+})();
+
+
+// PostMessage from two different workers, and assert that the grow
+// operations are performed on the same memory object.
+(function TestWorkersWithGrowEarlyWorkerTerminate() {
+  print(arguments.callee.name);
+  let workerScript = workerHelpers +
+    `onmessage = function(obj) {
+       assertIsWasmSharedMemory(obj.memory);
+       obj.memory.grow(1);
+       assertIsWasmSharedMemory(obj.memory);
+       assertTrue(obj.memory.buffer.byteLength === obj.expected_size);
+       postMessage("OK");
+     };`;
+
+  let workers = [new Worker(workerScript, {type: 'string'}),
+                 new Worker(workerScript, {type: 'string'})];
+  let memory = new WebAssembly.Memory({initial: 1, maximum: 5, shared: true});
+  let expected_pages = 1;
+  for (let worker of workers) {
+    assertEquals(memory.buffer.byteLength, expected_pages++ * kPageSize);
+    let obj = {memory: memory, expected_size: expected_pages * kPageSize};
+    worker.postMessage(obj);
+    assertEquals("OK", worker.getMessage());
+    assertEquals(memory.buffer.byteLength, expected_pages * kPageSize);
+    worker.terminate();
+  }
+  assertEquals(memory.buffer.byteLength, expected_pages * kPageSize);
+})();
+
+// PostMessage of Multiple memories and grow
+(function TestGrowSharedWithMultipleMemories() {
+  print(arguments.callee.name);
+  let workerScript = workerHelpers +
+    `onmessage = function(obj) {
+       let expected_size = 0;
+       let kPageSize = 0x10000;
+       for (let memory of obj.memories) {
+         assertIsWasmSharedMemory(memory);
+         assertTrue(expected_size === memory.grow(2));
+         expected_size+=2;
+         assertIsWasmSharedMemory(memory);
+         assertTrue(memory.buffer.byteLength === expected_size * kPageSize);
+       }
+       postMessage("OK");
+     };`;
+
+  let worker = new Worker(workerScript, {type: 'string'});
+  let memories = [new WebAssembly.Memory({initial: 0, maximum: 2, shared: true}),
+                  new WebAssembly.Memory({initial: 2, maximum: 10, shared: true}),
+                  new WebAssembly.Memory({initial: 4, maximum: 12, shared: true})];
+  let obj = {memories: memories};
+  worker.postMessage(obj);
+  assertEquals("OK", worker.getMessage());
+  assertEquals(2 * kPageSize, memories[0].buffer.byteLength);
+  assertEquals(4 * kPageSize, memories[1].buffer.byteLength);
+  assertEquals(6 * kPageSize, memories[2].buffer.byteLength);
+  worker.terminate();
+})();
+
+// SharedMemory Object shared between different instances
+(function TestPostMessageJSAndWasmInterop() {
+  print(arguments.callee.name);
+  let worker = new Worker(workerHelpers +
+    `onmessage = function(obj) {
+       let kPageSize = 0x10000;
+       assertIsWasmSharedMemory(obj.memory);
+       let instance = new WebAssembly.Instance(
+           obj.module, {m: {memory: obj.memory}});
+       assertTrue(5 === obj.memory.grow(10));
+       assertIsWasmSharedMemory(obj.memory);
+       assertTrue(obj.memory.buffer.byteLength === 15 * kPageSize);
+       assertTrue(15 === instance.exports.grow(5));
+       assertIsWasmSharedMemory(obj.memory);
+       assertTrue(obj.memory.buffer.byteLength === 20 * kPageSize);
+       postMessage("OK");
+     }`, {type: 'string'});
+
+  let memory = new WebAssembly.Memory({initial: 5, maximum: 50, shared: true});
+  var builder = new WasmModuleBuilder();
+  builder.addImportedMemory("m", "memory", 5, 100, "shared");
+  builder.addFunction("grow", kSig_i_i)
+    .addBody([kExprGetLocal, 0, kExprMemoryGrow, kMemoryZero])
+    .exportFunc();
+  var module = new WebAssembly.Module(builder.toBuffer());
+  let obj = {memory: memory, module: module};
+  assertEquals(obj.memory.buffer.byteLength, 5 * kPageSize);
+  worker.postMessage(obj);
+  assertEquals("OK", worker.getMessage());
+  worker.terminate();
+  assertEquals(obj.memory.buffer.byteLength, 20 * kPageSize);
+})();
+
+(function TestConsecutiveJSAndWasmSharedGrow() {
+  print(arguments.callee.name);
+  let worker = new Worker(workerHelpers +
+    `onmessage = function(obj) {
+       let kPageSize = 0x10000;
+       assertIsWasmSharedMemory(obj.memory);
+       let instance = new WebAssembly.Instance(
+           obj.module, {m: {memory: obj.memory}});
+       assertTrue(5 === obj.memory.grow(10));
+       assertIsWasmSharedMemory(obj.memory);
+       assertTrue(obj.memory.buffer.byteLength === 15 * kPageSize);
+       assertTrue(15 === instance.exports.grow(5));
+       assertIsWasmSharedMemory(obj.memory);
+       assertTrue(obj.memory.buffer.byteLength === 20 * kPageSize);
+       postMessage("OK");
+     }`, {type: 'string'});
+
+  let memory = new WebAssembly.Memory({initial: 5, maximum: 50, shared: true});
+  var builder = new WasmModuleBuilder();
+  builder.addImportedMemory("m", "memory", 5, 100, "shared");
+  builder.addFunction("grow", kSig_i_i)
+    .addBody([kExprGetLocal, 0, kExprMemoryGrow, kMemoryZero])
+    .exportFunc();
+  var module = new WebAssembly.Module(builder.toBuffer());
+  let obj = {memory: memory, module: module};
+  assertEquals(obj.memory.buffer.byteLength, 5 * kPageSize);
+  worker.postMessage(obj);
+  assertEquals("OK", worker.getMessage());
+  assertEquals(obj.memory.buffer.byteLength, 20 * kPageSize);
+})();
+
+(function TestConsecutiveWasmSharedGrow() {
+  print(arguments.callee.name);
+  let worker = new Worker(workerHelpers +
+    `onmessage = function(obj) {
+       let kPageSize = 0x10000;
+       assertIsWasmSharedMemory(obj.memory);
+       let instance = new WebAssembly.Instance(
+           obj.module, {m: {memory: obj.memory}});
+       assertTrue(5 === obj.memory.grow(10));
+       assertIsWasmSharedMemory(obj.memory);
+       assertTrue(obj.memory.buffer.byteLength === 15 * kPageSize);
+       assertTrue(17 === instance.exports.grow_twice(2));
+       assertIsWasmSharedMemory(obj.memory);
+       assertTrue(obj.memory.buffer.byteLength === 19 * kPageSize);
+       postMessage("OK");
+     }`, {type: 'string'});
+
+  let memory = new WebAssembly.Memory({initial: 5, maximum: 50, shared: true});
+  var builder = new WasmModuleBuilder();
+  builder.addImportedMemory("m", "memory", 5, 100, "shared");
+  builder.addFunction("grow_twice", kSig_i_i)
+    .addBody([kExprGetLocal, 0,
+        kExprMemoryGrow, kMemoryZero,
+        kExprDrop,
+        kExprGetLocal, 0,
+        kExprMemoryGrow, kMemoryZero])
+    .exportFunc();
+  var module = new WebAssembly.Module(builder.toBuffer());
+  let obj = {memory: memory, module: module};
+  assertEquals(obj.memory.buffer.byteLength, 5 * kPageSize);
+  worker.postMessage(obj);
+  assertEquals("OK", worker.getMessage());
+  assertEquals(obj.memory.buffer.byteLength, 19 * kPageSize);
+  let instance = new WebAssembly.Instance(module, {m: {memory: memory}});
+  assertEquals(21, instance.exports.grow_twice(2));
+  assertEquals(obj.memory.buffer.byteLength, 23 * kPageSize);
+})();
+
+(function TestConsecutiveSharedGrowAndMemorySize() {
+  print(arguments.callee.name);
+  let worker = new Worker(workerHelpers +
+    `onmessage = function(obj) {
+       let kPageSize = 0x10000;
+       assertIsWasmSharedMemory(obj.memory);
+       let instance = new WebAssembly.Instance(
+           obj.module, {m: {memory: obj.memory}});
+       assertTrue(5 === obj.memory.grow(10));
+       assertTrue(15 === instance.exports.memory_size());
+       assertIsWasmSharedMemory(obj.memory);
+       assertTrue(obj.memory.buffer.byteLength === 15 * kPageSize);
+       assertTrue(19 === instance.exports.grow_and_size(2));
+       assertIsWasmSharedMemory(obj.memory);
+       assertTrue(obj.memory.buffer.byteLength === 19 * kPageSize);
+       postMessage("OK");
+     }`, {type: 'string'});
+
+  let memory = new WebAssembly.Memory({initial: 5, maximum: 50, shared: true});
+  var builder = new WasmModuleBuilder();
+  builder.addImportedMemory("m", "memory", 5, 100, "shared");
+  builder.addFunction("grow_and_size", kSig_i_i)
+    .addBody([kExprGetLocal, 0,
+        kExprMemoryGrow, kMemoryZero,
+        kExprDrop,
+        kExprGetLocal, 0,
+        kExprMemoryGrow, kMemoryZero,
+        kExprDrop,
+        kExprMemorySize, kMemoryZero])
+    .exportFunc();
+  builder.addFunction("memory_size", kSig_i_v)
+    .addBody([kExprMemorySize, kMemoryZero])
+    .exportFunc();
+  var module = new WebAssembly.Module(builder.toBuffer());
+  let obj = {memory: memory, module: module};
+  assertEquals(obj.memory.buffer.byteLength, 5 * kPageSize);
+  worker.postMessage(obj);
+  assertEquals("OK", worker.getMessage());
+  assertEquals(memory.buffer.byteLength, 19 * kPageSize);
+  let instance = new WebAssembly.Instance(module, {m: {memory: memory}});
+  assertEquals(23, instance.exports.grow_and_size(2));
+  assertEquals(obj.memory.buffer.byteLength, 23 * kPageSize);
+  assertEquals(23, memory.grow(2));
+  assertEquals(25, instance.exports.memory_size());
+})();
+
+// Only spot checking here because currently the underlying buffer doesn't move.
+// In the case that the underlying buffer does move, more comprehensive memory
+// integrity checking and bounds checks testing are needed.
+(function TestSpotCheckMemoryWithSharedGrow() {
+  print(arguments.callee.name);
+  let worker = new Worker(workerHelpers +
+    `onmessage = function(obj) {
+       let kPageSize = 0x10000;
+       assertIsWasmSharedMemory(obj.memory);
+       let instance = new WebAssembly.Instance(
+           obj.module, {m: {memory: obj.memory}});
+       assertTrue(5 === obj.memory.grow(10));
+       assertIsWasmSharedMemory(obj.memory);
+       assertTrue(obj.memory.buffer.byteLength === 15 * kPageSize);
+       // Store again, and verify that the previous stores are still reflected.
+       instance.exports.atomic_store(15 * kPageSize - 4, 0xACED);
+       assertTrue(0xACED === instance.exports.atomic_load(0));
+       assertTrue(0xACED === instance.exports.atomic_load(5 * kPageSize - 4));
+       assertTrue(0xACED === instance.exports.atomic_load(15 * kPageSize - 4));
+       assertTrue(15 === instance.exports.grow(2));
+       assertIsWasmSharedMemory(obj.memory);
+       assertTrue(obj.memory.buffer.byteLength === 17 * kPageSize);
+       // Validate previous writes.
+       instance.exports.atomic_store(17 * kPageSize - 4, 0xACED);
+       assertTrue(0xACED === instance.exports.atomic_load(0));
+       assertTrue(0xACED === instance.exports.atomic_load(5 * kPageSize - 4));
+       assertTrue(0xACED === instance.exports.atomic_load(15 * kPageSize - 4));
+       assertTrue(0xACED === instance.exports.atomic_load(17 * kPageSize - 4));
+       postMessage("OK");
+     }`, {type: 'string'});
+
+  let memory = new WebAssembly.Memory({initial: 5, maximum: 50, shared: true});
+  var builder = new WasmModuleBuilder();
+  builder.addImportedMemory("m", "memory", 5, 100, "shared");
+  builder.addFunction("grow", kSig_i_i)
+    .addBody([kExprGetLocal, 0, kExprMemoryGrow, kMemoryZero])
+    .exportFunc();
+  builder.addFunction("atomic_load", kSig_i_i)
+    .addBody([kExprGetLocal, 0, kAtomicPrefix, kExprI32AtomicLoad, 2, 0])
+    .exportFunc();
+  builder.addFunction("atomic_store", kSig_v_ii)
+    .addBody([kExprGetLocal, 0, kExprGetLocal, 1,
+      kAtomicPrefix, kExprI32AtomicStore, 2, 0])
+    .exportFunc();
+  var module = new WebAssembly.Module(builder.toBuffer());
+  let instance = new WebAssembly.Instance(module, {m: {memory: memory}});
+  // Store at first and last accessible 32 bit offset.
+  instance.exports.atomic_store(0, 0xACED);
+  instance.exports.atomic_store(5 * kPageSize - 4, 0xACED);
+  // Verify that these were stored.
+  assertEquals(0xACED, instance.exports.atomic_load(0));
+  assertEquals(0xACED, instance.exports.atomic_load(5 * kPageSize - 4));
+  // Verify bounds.
+  assertTraps(kTrapMemOutOfBounds,
+      () => instance.exports.atomic_load(5 * kPageSize - 3));
+  let obj = {memory: memory, module: module};
+  assertEquals(obj.memory.buffer.byteLength, 5 * kPageSize);
+  // PostMessage
+  worker.postMessage(obj);
+  assertEquals("OK", worker.getMessage());
+  assertEquals(memory.buffer.byteLength, 17 * kPageSize);
+  assertEquals(17, instance.exports.grow(2));
+  assertEquals(obj.memory.buffer.byteLength, 19 * kPageSize);
+  // Validate previous writes, and check bounds.
+  assertTrue(0xACED === instance.exports.atomic_load(0));
+  assertTrue(0xACED === instance.exports.atomic_load(5 * kPageSize - 4));
+  assertTrue(0xACED === instance.exports.atomic_load(15 * kPageSize - 4));
+  assertTrue(0xACED === instance.exports.atomic_load(17 * kPageSize - 4));
+  assertTraps(kTrapMemOutOfBounds,
+      () => instance.exports.atomic_load(19 * kPageSize - 3));
+  assertEquals(19, memory.grow(6));
+  assertEquals(obj.memory.buffer.byteLength, 25 * kPageSize);
+  assertTraps(kTrapMemOutOfBounds,
+      () => instance.exports.atomic_load(25 * kPageSize - 3));
+})();
+
+(function TestMemoryBufferTypeAfterGrow() {
+  const memory = new WebAssembly.Memory({
+    "initial": 1, "maximum": 2, "shared": true });
+  assertInstanceof(memory.buffer, SharedArrayBuffer);
+  assertEquals(memory.grow(1), 1);
+  assertInstanceof(memory.buffer, SharedArrayBuffer);
+})();
diff --git a/src/v8/test/mjsunit/wasm/huge-memory.js b/src/v8/test/mjsunit/wasm/huge-memory.js
index 9719ad4..bf037b0 100644
--- a/src/v8/test/mjsunit/wasm/huge-memory.js
+++ b/src/v8/test/mjsunit/wasm/huge-memory.js
@@ -5,10 +5,10 @@
 // Flags: --wasm-max-mem-pages=49152
 
 // This test makes sure things don't break once we support >2GB wasm memories.
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
-function testHugeMemory() {
+(function testHugeMemory() {
+  print(arguments.callee.name);
   var builder = new WasmModuleBuilder();
 
   const num_pages = 49152;  // 3GB
@@ -30,10 +30,10 @@
   assertEquals(0, geti(2500, 1 << 20));
   print("Out of bounds");
   assertTraps(kTrapMemOutOfBounds, () => geti(3500, 1 << 20));
-}
-testHugeMemory();
+})();
 
-function testHugeMemoryConstInBounds() {
+(function testHugeMemoryConstInBounds() {
+  print(arguments.callee.name);
   var builder = new WasmModuleBuilder();
 
   const num_pages = 49152;  // 3GB
@@ -51,10 +51,10 @@
 
   print("In bounds");
   assertEquals(0, geti());
-}
-testHugeMemoryConstInBounds();
+})();
 
-function testHugeMemoryConstOutOfBounds() {
+(function testHugeMemoryConstOutOfBounds() {
+  print(arguments.callee.name);
   var builder = new WasmModuleBuilder();
 
   const num_pages = 49152;  // 3GB
@@ -72,5 +72,11 @@
 
   print("Out of bounds");
   assertTraps(kTrapMemOutOfBounds, geti);
-}
-testHugeMemoryConstOutOfBounds();
+})();
+
+(function testGrowHugeMemory() {
+  print(arguments.callee.name);
+
+  let mem = new WebAssembly.Memory({initial: 1});
+  mem.grow(49151);
+})();
diff --git a/src/v8/test/mjsunit/wasm/import-function.js b/src/v8/test/mjsunit/wasm/import-function.js
new file mode 100644
index 0000000..ec187af
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/import-function.js
@@ -0,0 +1,386 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+function testCallImport(func, check) {
+  var builder = new WasmModuleBuilder();
+
+  var sig_index = builder.addType(kSig_i_dd);
+  builder.addImport("q", "func", sig_index);
+  builder.addFunction("main", sig_index)
+    .addBody([
+      kExprGetLocal, 0,            // --
+      kExprGetLocal, 1,            // --
+      kExprCallFunction, 0])         // --
+    .exportAs("main");
+
+  var main = builder.instantiate({q: {func: func}}).exports.main;
+
+  for (var i = 0; i < 100000; i += 10003) {
+    var a = 22.5 + i, b = 10.5 + i;
+    var r = main(a, b);
+    check(r, a, b);
+  }
+}
+
+var global = (function() { return this; })();
+var params = [-99, -99, -99, -99];
+var was_called = false;
+var length = -1;
+
+function FOREIGN_SUB(a, b) {
+  print("FOREIGN_SUB(" + a + ", " + b + ")");
+  was_called = true;
+  params[0] = this;
+  params[1] = a;
+  params[2] = b;
+  return (a - b) | 0;
+}
+
+function check_FOREIGN_SUB(r, a, b) {
+    assertEquals(a - b | 0, r);
+    assertTrue(was_called);
+    assertEquals(global, params[0]);  // sloppy mode
+    assertEquals(a, params[1]);
+    assertEquals(b, params[2]);
+    was_called = false;
+}
+
+testCallImport(FOREIGN_SUB, check_FOREIGN_SUB);
+
+
+function FOREIGN_ABCD(a, b, c, d) {
+  print("FOREIGN_ABCD(" + a + ", " + b + ", " + c + ", " + d + ")");
+  was_called = true;
+  params[0] = this;
+  params[1] = a;
+  params[2] = b;
+  params[3] = c;
+  params[4] = d;
+  return (a * b * 6) | 0;
+}
+
+function check_FOREIGN_ABCD(r, a, b) {
+    assertEquals((a * b * 6) | 0, r);
+    assertTrue(was_called);
+    assertEquals(global, params[0]);  // sloppy mode.
+    assertEquals(a, params[1]);
+    assertEquals(b, params[2]);
+    assertEquals(undefined, params[3]);
+    assertEquals(undefined, params[4]);
+    was_called = false;
+}
+
+testCallImport(FOREIGN_ABCD, check_FOREIGN_ABCD);
+
+function FOREIGN_ARGUMENTS0() {
+  print("FOREIGN_ARGUMENTS0");
+  was_called = true;
+  length = arguments.length;
+  for (var i = 0; i < arguments.length; i++) {
+    params[i] = arguments[i];
+  }
+  return (arguments[0] * arguments[1] * 7) | 0;
+}
+
+function FOREIGN_ARGUMENTS1(a) {
+  print("FOREIGN_ARGUMENTS1", a);
+  was_called = true;
+  length = arguments.length;
+  for (var i = 0; i < arguments.length; i++) {
+    params[i] = arguments[i];
+  }
+  return (arguments[0] * arguments[1] * 7) | 0;
+}
+
+function FOREIGN_ARGUMENTS2(a, b) {
+  print("FOREIGN_ARGUMENTS2", a, b);
+  was_called = true;
+  length = arguments.length;
+  for (var i = 0; i < arguments.length; i++) {
+    params[i] = arguments[i];
+  }
+  return (a * b * 7) | 0;
+}
+
+function FOREIGN_ARGUMENTS3(a, b, c) {
+  print("FOREIGN_ARGUMENTS3", a, b, c);
+  was_called = true;
+  length = arguments.length;
+  for (var i = 0; i < arguments.length; i++) {
+    params[i] = arguments[i];
+  }
+  return (a * b * 7) | 0;
+}
+
+function FOREIGN_ARGUMENTS4(a, b, c, d) {
+  print("FOREIGN_ARGUMENTS4", a, b, c, d);
+  was_called = true;
+  length = arguments.length;
+  for (var i = 0; i < arguments.length; i++) {
+    params[i] = arguments[i];
+  }
+  return (a * b * 7) | 0;
+}
+
+function check_FOREIGN_ARGUMENTS(r, a, b) {
+  assertEquals((a * b * 7) | 0, r);
+  assertTrue(was_called);
+  assertEquals(2, length);
+  assertEquals(a, params[0]);
+  assertEquals(b, params[1]);
+  was_called = false;
+}
+
+// Check a bunch of uses of the arguments object.
+testCallImport(FOREIGN_ARGUMENTS0, check_FOREIGN_ARGUMENTS);
+testCallImport(FOREIGN_ARGUMENTS1, check_FOREIGN_ARGUMENTS);
+testCallImport(FOREIGN_ARGUMENTS2, check_FOREIGN_ARGUMENTS);
+testCallImport(FOREIGN_ARGUMENTS3, check_FOREIGN_ARGUMENTS);
+testCallImport(FOREIGN_ARGUMENTS4, check_FOREIGN_ARGUMENTS);
+
+function returnValue(val) {
+  return function(a, b) {
+    print("RETURN_VALUE ", val);
+    return val;
+  }
+}
+
+
+function checkReturn(expected) {
+  return function(r, a, b) { assertEquals(expected, r); }
+}
+
+// Check that returning weird values doesn't crash
+testCallImport(returnValue(undefined), checkReturn(0));
+testCallImport(returnValue(null), checkReturn(0));
+testCallImport(returnValue("0"), checkReturn(0));
+testCallImport(returnValue("-77"), checkReturn(-77));
+
+var objWithValueOf = {valueOf: function() { return 198; }}
+
+testCallImport(returnValue(objWithValueOf), checkReturn(198));
+
+
+function testCallBinopVoid(type, func, check) {
+  var passed_length = -1;
+  var passed_a = -1;
+  var passed_b = -1;
+  var args_a = -1;
+  var args_b = -1;
+
+  var ffi = {q: {func: function(a, b) {
+    passed_length = arguments.length;
+    passed_a = a;
+    passed_b = b;
+    args_a = arguments[0];
+    args_b = arguments[1];
+  }}};
+
+  var builder = new WasmModuleBuilder();
+
+  builder.addImport("q", "func", makeSig_v_xx(type));
+  builder.addFunction("main", makeSig_r_xx(kWasmI32, type))
+    .addBody([
+      kExprGetLocal, 0,           // --
+      kExprGetLocal, 1,           // --
+      kExprCallFunction, 0,       // --
+      kExprI32Const, 39,          // --
+    ])
+    .exportFunc("main");
+
+  var main = builder.instantiate(ffi).exports.main;
+
+  print("testCallBinopVoid", type);
+
+  for (var i = 0; i < 100000; i += 10003.1) {
+    var a = 22.5 + i, b = 10.5 + i;
+    var r = main(a, b);
+    assertEquals(39, r);
+    assertEquals(2, passed_length);
+    var expected_a, expected_b;
+    switch (type) {
+      case kWasmI32: {
+        expected_a = a | 0;
+        expected_b = b | 0;
+        break;
+      }
+      case kWasmF32: {
+        expected_a = Math.fround(a);
+        expected_b = Math.fround(b);
+        break;
+      }
+      case kWasmF64: {
+        expected_a = a;
+        expected_b = b;
+        break;
+      }
+    }
+
+    assertEquals(expected_a, args_a);
+    assertEquals(expected_b, args_b);
+    assertEquals(expected_a, passed_a);
+    assertEquals(expected_b, passed_b);
+  }
+}
+
+
+testCallBinopVoid(kWasmI32);
+// TODO testCallBinopVoid(kWasmI64);
+testCallBinopVoid(kWasmF32);
+testCallBinopVoid(kWasmF64);
+
+
+
+function testCallPrint() {
+  var builder = new WasmModuleBuilder();
+  builder.addImport("q", "print", makeSig_v_x(kWasmI32));
+  builder.addImport("q", "print", makeSig_r_x(kWasmF64, kWasmF64));
+  builder.addFunction("main", makeSig_r_x(kWasmF64, kWasmF64))
+    .addBody([
+      kExprI32Const, 27,     // --
+      kExprCallFunction, 0,  // --
+      kExprGetLocal, 0,      // --
+      kExprCallFunction, 1   // --
+    ])
+    .exportFunc();
+
+  var main = builder.instantiate({q: {print: print}}).exports.main;
+
+  for (var i = -9; i < 900; i += 16.125) {
+    main(i);
+  }
+}
+
+testCallPrint();
+testCallPrint();
+
+
+function testCallImport2(foo, bar, expected) {
+  var builder = new WasmModuleBuilder();
+
+  builder.addImport("q", "foo", kSig_i_v);
+  builder.addImport("t", "bar", kSig_i_v);
+  builder.addFunction("main", kSig_i_v)
+    .addBody([
+      kExprCallFunction, 0, // --
+      kExprCallFunction, 1, // --
+      kExprI32Add,                 // --
+    ])                             // --
+    .exportFunc();
+
+  var main = builder.instantiate({q: {foo: foo}, t: {bar: bar}}).exports.main;
+  assertEquals(expected, main());
+}
+
+testCallImport2(function() { return 33; }, function () { return 44; }, 77);
+
+
+function testImportName(name) {
+  var builder = new WasmModuleBuilder();
+  builder.addImport("M", name, kSig_i_v);
+  builder.addFunction("main", kSig_i_v)
+    .addBody([
+      kExprCallFunction, 0
+    ])
+    .exportFunc();
+
+  let main = builder.instantiate({M: {[name]: () => 42}}).exports.main;
+  assertEquals(42, main());
+}
+
+testImportName('bla');
+testImportName('0');
+testImportName('  a @#$2 324 ');
+testImportName('');
+
+(function testExportedImportsOnDifferentInstances() {
+  print(arguments.callee.name);
+  const exp = (function() {
+    const builder = new WasmModuleBuilder();
+    builder.addFunction('f11', kSig_i_v)
+        .addBody([kExprI32Const, 11])
+        .exportFunc();
+    builder.addFunction('f17', kSig_i_v)
+        .addBody([kExprI32Const, 17])
+        .exportFunc();
+    return builder.instantiate().exports;
+  })();
+
+  const builder = new WasmModuleBuilder();
+  const imp_index = builder.addImport('q', 'imp', kSig_i_v);
+  builder.addExport('exp', imp_index);
+
+  const module = builder.toModule();
+  const instance0 = new WebAssembly.Instance(module, {q: {imp: exp.f11}});
+  const instance1 = new WebAssembly.Instance(module, {q: {imp: exp.f17}});
+  const instance2 = new WebAssembly.Instance(module, {q: {imp: _ => 21}});
+  const instance3 = new WebAssembly.Instance(module, {q: {imp: _ => 27}});
+
+  assertEquals(11, instance0.exports.exp());
+  assertEquals(17, instance1.exports.exp());
+  assertEquals(21, instance2.exports.exp());
+  assertEquals(27, instance3.exports.exp());
+})();
+
+(function testImportedStartFunctionOnDifferentInstances() {
+  print(arguments.callee.name);
+  var global = 0;
+  const set_global = n => global = n;
+  const exp = (function() {
+    const builder = new WasmModuleBuilder();
+    const imp_index = builder.addImport('q', 'imp', kSig_v_i);
+    builder.addFunction('f11', kSig_v_v)
+        .addBody([kExprI32Const, 11, kExprCallFunction, imp_index])
+        .exportFunc();
+    builder.addFunction('f17', kSig_v_v)
+        .addBody([kExprI32Const, 17, kExprCallFunction, imp_index])
+        .exportFunc();
+    return builder.instantiate({q: {imp: set_global}}).exports;
+  })();
+
+  const builder = new WasmModuleBuilder();
+  const imp_index = builder.addImport('q', 'imp', kSig_v_v);
+  builder.addStart(imp_index);
+
+  const module = builder.toModule();
+
+  assertEquals(0, global);
+  new WebAssembly.Instance(module, {q: {imp: exp.f11}});
+  assertEquals(11, global);
+  new WebAssembly.Instance(module, {q: {imp: exp.f17}});
+  assertEquals(17, global);
+  new WebAssembly.Instance(module, {q: {imp: _ => set_global(21)}});
+  assertEquals(21, global);
+  new WebAssembly.Instance(module, {q: {imp: _ => set_global(27)}});
+  assertEquals(27, global);
+})();
+
+(function testImportedStartFunctionUsesRightInstance() {
+  print(arguments.callee.name);
+  var global = 0;
+  const set_global = n => global = n;
+  const exp = (function() {
+    const builder = new WasmModuleBuilder();
+    builder.addMemory(1, 1);
+    builder.exportMemoryAs('mem');
+    const imp_index = builder.addImport('q', 'imp', kSig_v_i);
+    builder.addFunction('f', kSig_v_v)
+        .addBody([kExprI32Const, 0, kExprI32Const, 11, kExprI32StoreMem8, 0, 0])
+        .exportFunc();
+    return builder.instantiate({q: {imp: set_global}}).exports;
+  })();
+
+  const builder = new WasmModuleBuilder();
+  const imp_index = builder.addImport('q', 'imp', kSig_v_v);
+  builder.addStart(imp_index);
+  const module = builder.toModule();
+
+  assertEquals(0, new Uint8Array(exp.mem.buffer)[0], 'memory initially 0');
+  new WebAssembly.Instance(module, {q: {imp: exp.f}});
+  assertEquals(11, new Uint8Array(exp.mem.buffer)[0], 'memory changed to 11');
+})();
diff --git a/src/v8/test/mjsunit/wasm/import-memory.js b/src/v8/test/mjsunit/wasm/import-memory.js
index df4f0d3..fc688dc 100644
--- a/src/v8/test/mjsunit/wasm/import-memory.js
+++ b/src/v8/test/mjsunit/wasm/import-memory.js
@@ -4,9 +4,11 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
+// V8 internal memory size limit.
+var kV8MaxPages = 32767;
+
 (function TestOne() {
   print("TestOne");
   let memory = new WebAssembly.Memory({initial: 1});
@@ -109,7 +111,7 @@
   }
 })();
 
-(function TestGrowMemoryMaxDesc() {
+(function TestMemoryGrowMaxDesc() {
   print("MaximumDescriptor");
   let memory = new WebAssembly.Memory({initial: 1, maximum: 5});
   assertEquals(kPageSize, memory.buffer.byteLength);
@@ -147,7 +149,7 @@
   assertThrows(() => memory.grow(1));
 })();
 
-(function TestGrowMemoryZeroInitialMemory() {
+(function TestMemoryGrowZeroInitialMemory() {
   print("ZeroInitialMemory");
   let memory = new WebAssembly.Memory({initial: 0});
   assertEquals(0, memory.buffer.byteLength);
@@ -185,7 +187,7 @@
   assertEquals(2*kPageSize, memory.buffer.byteLength);
   let builder = new WasmModuleBuilder();
   builder.addFunction("grow", kSig_i_i)
-      .addBody([kExprGetLocal, 0, kExprGrowMemory, kMemoryZero])
+      .addBody([kExprGetLocal, 0, kExprMemoryGrow, kMemoryZero])
       .exportFunc();
   builder.addImportedMemory("cat", "mine");
   let instance = builder.instantiate({cat: {mine: memory}});
@@ -197,8 +199,8 @@
   assertThrows(() => memory.grow(1));
 })();
 
-(function TestGrowMemoryExportedMaximum() {
-  print("TestGrowMemoryExportedMaximum");
+(function TestMemoryGrowExportedMaximum() {
+  print("TestMemoryGrowExportedMaximum");
   let initial_size = 1, maximum_size = 10;
   var exp_instance;
   {
@@ -215,7 +217,7 @@
       .addBody([kExprMemorySize, kMemoryZero])
       .exportFunc();
     builder.addFunction("grow", kSig_i_i)
-      .addBody([kExprGetLocal, 0, kExprGrowMemory, kMemoryZero])
+      .addBody([kExprGetLocal, 0, kExprMemoryGrow, kMemoryZero])
       .exportFunc();
     instance = builder.instantiate({fur: {
       imported_mem: exp_instance.exports.exported_mem}});
@@ -236,7 +238,7 @@
     .addBody([kExprMemorySize, kMemoryZero])
     .exportAs("mem_size");
   builder.addFunction("grow", kSig_i_i)
-    .addBody([kExprGetLocal, 0, kExprGrowMemory, kMemoryZero])
+    .addBody([kExprGetLocal, 0, kExprMemoryGrow, kMemoryZero])
     .exportFunc();
   var module = new WebAssembly.Module(builder.toBuffer());
   var instances = [];
@@ -255,7 +257,7 @@
   verify_mem_size(1);
 
   // Verify memory size with interleaving calls to Memory.grow,
-  // GrowMemory opcode.
+  // MemoryGrow opcode.
   var current_mem_size = 1;
   for (var i = 0; i < 5; i++) {
     function grow(pages) { return instances[i].exports.grow(pages); }
@@ -277,7 +279,7 @@
     .addBody([kExprMemorySize, kMemoryZero])
     .exportFunc();
   builder.addFunction("grow", kSig_i_i)
-    .addBody([kExprGetLocal, 0, kExprGrowMemory, kMemoryZero])
+    .addBody([kExprGetLocal, 0, kExprMemoryGrow, kMemoryZero])
     .exportFunc();
   var instances = [];
   for (var i = 0; i < 5; i++) {
@@ -342,7 +344,7 @@
     .addBody([kExprMemorySize, kMemoryZero])
     .exportFunc();
   builder.addFunction("grow", kSig_i_i)
-    .addBody([kExprGetLocal, 0, kExprGrowMemory, kMemoryZero])
+    .addBody([kExprGetLocal, 0, kExprMemoryGrow, kMemoryZero])
     .exportFunc();
   var instances = [];
   for (var i = 0; i < 10; i++) {
@@ -377,7 +379,7 @@
     builder.addMemory(1, kSpecMaxPages, true);
     builder.exportMemoryAs("exported_mem");
     builder.addFunction("grow", kSig_i_i)
-      .addBody([kExprGetLocal, 0, kExprGrowMemory, kMemoryZero])
+      .addBody([kExprGetLocal, 0, kExprMemoryGrow, kMemoryZero])
       .exportFunc();
     instance_1 = builder.instantiate();
   }
@@ -385,7 +387,7 @@
     let builder = new WasmModuleBuilder();
     builder.addImportedMemory("doo", "imported_mem");
     builder.addFunction("grow", kSig_i_i)
-      .addBody([kExprGetLocal, 0, kExprGrowMemory, kMemoryZero])
+      .addBody([kExprGetLocal, 0, kExprMemoryGrow, kMemoryZero])
       .exportFunc();
     instance_2 = builder.instantiate({
       doo: {imported_mem: instance_1.exports.exported_mem}});
@@ -405,7 +407,7 @@
     .addBody([kExprMemorySize, kMemoryZero])
     .exportFunc();
   builder.addFunction("grow", kSig_i_i)
-    .addBody([kExprGetLocal, 0, kExprGrowMemory, kMemoryZero])
+    .addBody([kExprGetLocal, 0, kExprMemoryGrow, kMemoryZero])
     .exportFunc();
   instance = builder.instantiate();
   assertEquals(kPageSize, instance.exports.exported_mem.buffer.byteLength);
diff --git a/src/v8/test/mjsunit/wasm/import-mutable-global.js b/src/v8/test/mjsunit/wasm/import-mutable-global.js
new file mode 100644
index 0000000..715549a
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/import-mutable-global.js
@@ -0,0 +1,200 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function TestBasic() {
+  let global = new WebAssembly.Global({value: 'i32'}, 1);
+  let builder = new WasmModuleBuilder();
+  builder.addImportedGlobal("mod", "g", kWasmI32);
+  builder.addFunction("main", kSig_i_v)
+    .addBody([kExprGetGlobal, 0])
+    .exportAs("main");
+
+  let main = builder.instantiate({mod: {g: global}}).exports.main;
+  assertEquals(1, main());
+})();
+
+(function TestTypeMismatch() {
+  let global = new WebAssembly.Global({value: 'f32'}, 1);
+  let builder = new WasmModuleBuilder();
+  builder.addImportedGlobal("mod", "g", kWasmI32);
+
+  assertThrows(() => builder.instantiate({mod: {g: global}}));
+})();
+
+(function TestMutableMismatch() {
+  let global = new WebAssembly.Global({value: 'f64'}, 1);
+  let builder = new WasmModuleBuilder();
+  builder.addImportedGlobal("mod", "g", kWasmF64, true);
+
+  assertThrows(() => builder.instantiate({mod: {g: global}}));
+
+  global = new WebAssembly.Global({value: 'i32', mutable: true}, 1);
+  builder = new WasmModuleBuilder();
+  builder.addImportedGlobal("mod", "g", kWasmI32);
+
+  assertThrows(() => builder.instantiate({mod: {g: global}}));
+})();
+
+(function TestImportMutableAsNumber() {
+  let builder = new WasmModuleBuilder();
+  builder.addImportedGlobal("mod", "g", kWasmF32, true);
+  assertThrows(() => builder.instantiate({mod: {g: 1234}}));
+})();
+
+(function TestImportI64AsNumber() {
+  let builder = new WasmModuleBuilder();
+  builder.addImportedGlobal("mod", "g", kWasmI64);
+  assertThrows(() => builder.instantiate({mod: {g: 1234}}));
+})();
+
+function addGlobalGetterAndSetter(builder, index, name, type) {
+  builder.addFunction('get' + name, makeSig([], [type]))
+      .addBody([kExprGetGlobal, index])
+      .exportFunc();
+  builder.addFunction('set' + name, makeSig([type], []))
+      .addBody([kExprGetLocal, 0, kExprSetGlobal, index])
+      .exportFunc();
+}
+
+(function TestImportMutableGlobal() {
+  const globalDesc = [
+    {name: 'i32', type: kWasmI32},
+    {name: 'f32', type: kWasmF32},
+    {name: 'f64', type: kWasmF64},
+  ];
+
+  let globals = {};
+  let builder = new WasmModuleBuilder();
+
+  for (let [index, {name, type}] of globalDesc.entries()) {
+    globals[name] = new WebAssembly.Global({value: name, mutable: true});
+    builder.addImportedGlobal("mod", name, type, true);
+    addGlobalGetterAndSetter(builder, index, name, type);
+  }
+
+  let inst = builder.instantiate(
+      {mod: {i32: globals.i32, f32: globals.f32, f64: globals.f64}});
+
+  for (let type of ['i32', 'f32', 'f64']) {
+    let global = globals[type];
+    let get = inst.exports['get' + type];
+    let set = inst.exports['set' + type];
+
+    assertEquals(get(), global.value, type);
+    set(1234567);
+    assertEquals(1234567, global.value, type);
+    global.value = 7654321;
+    assertEquals(7654321, get(), type);
+  }
+})();
+
+(function TestImportExportedMutableGlobal() {
+  const globalDesc = [
+    {name: 'i32', type: kWasmI32},
+    {name: 'f32', type: kWasmF32},
+    {name: 'f64', type: kWasmF64},
+  ];
+
+  let builder1 = new WasmModuleBuilder();
+  let builder2 = new WasmModuleBuilder();
+  for (let [index, {name, type}] of globalDesc.entries()) {
+    builder1.addGlobal(type, true).exportAs(name);
+    addGlobalGetterAndSetter(builder1, index, name, type);
+
+    builder2.addImportedGlobal("mod", name, type, true);
+    addGlobalGetterAndSetter(builder2, index, name, type);
+  }
+  let inst1 = builder1.instantiate();
+  let inst2 = builder2.instantiate({
+    mod: {
+      i32: inst1.exports.i32,
+      f32: inst1.exports.f32,
+      f64: inst1.exports.f64
+    }
+  });
+
+  for (let type of ['i32', 'f32', 'f64']) {
+    let get1 = inst1.exports['get' + type];
+    let get2 = inst2.exports['get' + type];
+    let set1 = inst1.exports['set' + type];
+    let set2 = inst2.exports['set' + type];
+
+    assertEquals(get1(), get2(), type);
+    set1(1234567);
+    assertEquals(1234567, get2(), type);
+    set2(7654321);
+    assertEquals(7654321, get1(), type);
+  }
+})();
+
+(function TestImportExportedMutableGlobalI64() {
+  function addGettersAndSetters(builder) {
+    const index = 0;
+    builder.addFunction('geti64_hi', makeSig([], [kWasmI32]))
+      .addBody([
+        kExprGetGlobal, index,
+        kExprI64Const, 32, kExprI64ShrU,
+        kExprI32ConvertI64])
+      .exportFunc();
+    builder.addFunction('geti64_lo', makeSig([], [kWasmI32]))
+      .addBody([kExprGetGlobal, index, kExprI32ConvertI64])
+      .exportFunc();
+    builder.addFunction("seti64", makeSig([kWasmI32, kWasmI32], []))
+      .addBody([
+        kExprGetLocal, 1, kExprI64UConvertI32,
+        kExprGetLocal, 0, kExprI64UConvertI32,
+        kExprI64Const, 32, kExprI64Shl,
+        kExprI64Ior,
+        kExprSetGlobal, index])
+      .exportFunc();
+  };
+
+  let builder = new WasmModuleBuilder();
+  builder.addGlobal(kWasmI64, true).exportAs('i64');
+  addGettersAndSetters(builder);
+  let inst1 = builder.instantiate();
+
+  builder = new WasmModuleBuilder();
+  builder.addImportedGlobal("mod", 'i64', kWasmI64, true);
+  addGettersAndSetters(builder);
+  let inst2 = builder.instantiate({ mod: { i64: inst1.exports.i64 } });
+
+  assertEquals(inst1.exports.geti64_lo(), inst2.exports.geti64_lo());
+  assertEquals(inst1.exports.geti64_hi(), inst2.exports.geti64_hi());
+  inst1.exports.seti64(13579, 24680);
+  assertEquals(13579, inst2.exports.geti64_hi());
+  assertEquals(24680, inst2.exports.geti64_lo());
+  inst2.exports.seti64(97531, 86420);
+  assertEquals(97531, inst1.exports.geti64_hi());
+  assertEquals(86420, inst1.exports.geti64_lo());
+})();
+
+(function TestImportMutableAcrossGc() {
+  let builder = new WasmModuleBuilder();
+  builder.addGlobal(kWasmI32, true).exportAs('i32');
+  let inst1 = builder.instantiate();
+
+  builder = new WasmModuleBuilder();
+  builder.addImportedGlobal("mod", 'i32', kWasmI32, true);
+  addGlobalGetterAndSetter(builder, 0, 'i32', kWasmI32);
+  let inst2 = builder.instantiate({ mod: { i32: inst1.exports.i32 } });
+
+  delete inst1;
+  gc();
+
+  inst2.exports.seti32(0x789abcde);
+  assertEquals(0x789abcde, inst2.exports.geti32());
+})();
+
+(function TestImportedAndNonImportedMutableGlobal() {
+  let global = new WebAssembly.Global({value: 'i32', mutable: true}, 1);
+  let builder = new WasmModuleBuilder();
+  builder.addImportedGlobal("mod", "g", kWasmI32, true);
+  builder.addGlobal(kWasmI32, true).exportAs('i32');
+  builder.instantiate({mod: {g: global}});
+})();
diff --git a/src/v8/test/mjsunit/wasm/import-table.js b/src/v8/test/mjsunit/wasm/import-table.js
index 2c89e45..098d03d 100644
--- a/src/v8/test/mjsunit/wasm/import-table.js
+++ b/src/v8/test/mjsunit/wasm/import-table.js
@@ -1,301 +1,243 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
+// Copyright 2018 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
-function testCallImport(func, check) {
-  var builder = new WasmModuleBuilder();
+function addConstFunc(builder, val) {
+  return builder.addFunction("const" + val, kSig_i_v)
+    .addBody(wasmI32Const(val)).index;
+}
 
-  var sig_index = builder.addType(kSig_i_dd);
-  builder.addImport("q", "func", sig_index);
-  builder.addFunction("main", sig_index)
+function addSigs(builder, pad) {
+  for (let i = 0; i < pad; i++) {
+    let params = [];
+    for (let j = 0; j < i; j++) params.push(kWasmF32);
+    builder.addType(makeSig(params, []));
+  }
+
+  return { i_v: builder.addType(kSig_i_v) };
+}
+
+let kTableSize = 50;
+
+(function TestAliasedImportedTable() {
+  print(arguments.callee.name);
+
+  {
+    let builder = new WasmModuleBuilder();
+    let signums = addSigs(builder, 1);
+
+    builder.addImportedTable("m", "table", kTableSize, kTableSize);
+    let f15 = addConstFunc(builder, 15);
+    let call = builder.addFunction("call", kSig_i_i)
+        .addBody([
+          kExprGetLocal, 0,
+          kExprCallIndirect, signums.i_v, kTableZero
+        ])
+        .exportAs("call");
+    let f17 = addConstFunc(builder, 17);
+    builder.addExport("f15", f15);
+    builder.addExport("f17", f17);
+    builder.addElementSegment(0, 15, false, [f15]);
+    builder.addElementSegment(0, 1, false, [call.index]);
+
+    var mod1 = builder.toModule();
+  }
+
+  {
+    let builder = new WasmModuleBuilder();
+    let signums = addSigs(builder, 5);  // ensure different sigids
+
+    builder.addImportedTable("m", "table", kTableSize, kTableSize);
+    let f15 = builder.addImport("m", "f15", kSig_i_v);
+    let f17 = builder.addImport("m", "f17", kSig_i_v);
+    let f21 = addConstFunc(builder, 21);
+    let call = builder.addFunction("call", kSig_i_i)
+        .addBody([
+          kExprGetLocal, 0,
+          kExprCallIndirect, signums.i_v, kTableZero
+        ])
+        .exportAs("call");
+    let f26 = addConstFunc(builder, 26);
+    builder.addElementSegment(0, 17, false, [f17]);
+    builder.addElementSegment(0, 21, false, [f21]);
+    builder.addElementSegment(0, 26, false, [f26]);
+    builder.addElementSegment(0, 5, false, [call.index]);
+
+    var mod2 = builder.toModule();
+  }
+
+  var table = new WebAssembly.Table({initial: kTableSize,
+                                     maximum: kTableSize, element: "anyfunc"});
+  var i1 = new WebAssembly.Instance(mod1, {m: {table: table}});
+
+  var i2 = new WebAssembly.Instance(mod2,
+      {m: {table: table, f15: i1.exports.f15, f17: i1.exports.f17}});
+
+  for (i of [15, 17, 21, 26]) {
+    print(i);
+    assertEquals(i, i1.exports.call(i));
+    assertEquals(i, i2.exports.call(i));
+  }
+  for (i of [0, 1, 5, 16]) {
+    assertThrows(() => i1.exports.call(i));
+    assertThrows(() => i2.exports.call(i));
+  }
+})();
+
+function addConstFuncUsingGlobal(builder, val) {
+  let g = builder.addGlobal(kWasmI32, false);
+  g.init = val;
+  return builder.addFunction("global" + val, kSig_i_v)
+    .addBody([kExprGetGlobal, g.index]).index;
+}
+
+(function TestAliasedImportedTableInstanceGlobals() {
+  print(arguments.callee.name);
+
+  {
+    let builder = new WasmModuleBuilder();
+    let signums = addSigs(builder, 1);
+
+    builder.addImportedTable("m", "table", kTableSize, kTableSize);
+    let f14 = addConstFuncUsingGlobal(builder, 14);
+    let call = builder.addFunction("call", kSig_i_i)
+        .addBody([
+          kExprGetLocal, 0,
+          kExprCallIndirect, signums.i_v, kTableZero
+        ])
+        .exportAs("call");
+    let f18 = addConstFuncUsingGlobal(builder, 18);
+    builder.addExport("f14", f14);
+    builder.addExport("f18", f18);
+    builder.addElementSegment(0, 14, false, [f14]);
+    builder.addElementSegment(0, 1, false, [call.index]);
+
+    var mod1 = builder.toModule();
+  }
+
+  {
+    let builder = new WasmModuleBuilder();
+    let signums = addSigs(builder, 3);  // ensure different sigids
+
+    builder.addImportedTable("m", "table", kTableSize, kTableSize);
+    let f14 = builder.addImport("m", "f14", kSig_i_v);
+    let f18 = builder.addImport("m", "f18", kSig_i_v);
+    let f22 = addConstFuncUsingGlobal(builder, 22);
+    let call = builder.addFunction("call", kSig_i_i)
+        .addBody([
+          kExprGetLocal, 0,
+          kExprCallIndirect, signums.i_v, kTableZero
+        ])
+        .exportAs("call");
+    let f28 = addConstFuncUsingGlobal(builder, 28);
+    builder.addElementSegment(0, 18, false, [f18]);
+    builder.addElementSegment(0, 22, false, [f22]);
+    builder.addElementSegment(0, 28, false, [f28]);
+    builder.addElementSegment(0, 5, false, [call.index]);
+
+    var mod2 = builder.toModule();
+  }
+
+  var table = new WebAssembly.Table({initial: kTableSize,
+                                     maximum: kTableSize, element: "anyfunc"});
+  var i1 = new WebAssembly.Instance(mod1, {m: {table: table}});
+
+  var i2 = new WebAssembly.Instance(mod2,
+      {m: {table: table, f14: i1.exports.f14, f18: i1.exports.f18}});
+
+  for (i of [14, 18, 22, 28]) {
+    print(i);
+    assertEquals(i, i1.exports.call(i));
+    assertEquals(i, i2.exports.call(i));
+  }
+  for (i of [0, 1, 5, 16]) {
+    assertThrows(() => i1.exports.call(i));
+    assertThrows(() => i2.exports.call(i));
+  }
+})();
+
+
+function addConstFuncUsingMemory(builder, val) {
+  var addr = builder.address;
+  builder.address += 8;
+  var bytes = [val & 0xff, (val>>8) & 0xff, (val>>16) & 0xff, (val>>24) & 0xff];
+  builder.addDataSegment(addr, bytes);
+  return builder.addFunction("mem" + val, kSig_i_v)
     .addBody([
-      kExprGetLocal, 0,            // --
-      kExprGetLocal, 1,            // --
-      kExprCallFunction, 0])         // --
-    .exportAs("main");
+      ...wasmI32Const(addr),
+      kExprI32LoadMem, 0, 0
+    ]).index;
+}
 
-  var main = builder.instantiate({q: {func: func}}).exports.main;
+(function TestAliasedImportedTableInstanceMemories() {
+  print(arguments.callee.name);
 
-  for (var i = 0; i < 100000; i += 10003) {
-    var a = 22.5 + i, b = 10.5 + i;
-    var r = main(a, b);
-    check(r, a, b);
+  {
+    let builder = new WasmModuleBuilder();
+    builder.address = 8;
+    let signums = addSigs(builder, 1);
+
+    builder.addMemory(1, 1, false);
+    builder.addImportedTable("m", "table", kTableSize, kTableSize);
+    let f13 = addConstFuncUsingMemory(builder, 13);
+    let call = builder.addFunction("call", kSig_i_i)
+        .addBody([
+          kExprGetLocal, 0,
+          kExprCallIndirect, signums.i_v, kTableZero
+        ])
+        .exportAs("call");
+    let f19 = addConstFuncUsingMemory(builder, 19);
+    builder.addExport("f13", f13);
+    builder.addExport("f19", f19);
+    builder.addElementSegment(0, 13, false, [f13]);
+    builder.addElementSegment(0, 1, false, [call.index]);
+
+    var mod1 = builder.toModule();
   }
-}
 
-var global = (function() { return this; })();
-var params = [-99, -99, -99, -99];
-var was_called = false;
-var length = -1;
+  {
+    let builder = new WasmModuleBuilder();
+    builder.address = 8;
+    let signums = addSigs(builder, 4);  // ensure different sigids
 
-function FOREIGN_SUB(a, b) {
-  print("FOREIGN_SUB(" + a + ", " + b + ")");
-  was_called = true;
-  params[0] = this;
-  params[1] = a;
-  params[2] = b;
-  return (a - b) | 0;
-}
+    builder.addMemory(1, 1, false);
+    builder.addImportedTable("m", "table", kTableSize, kTableSize);
+    let f13 = builder.addImport("m", "f13", kSig_i_v);
+    let f19 = builder.addImport("m", "f19", kSig_i_v);
+    let f23 = addConstFuncUsingMemory(builder, 23);
+    let call = builder.addFunction("call", kSig_i_i)
+        .addBody([
+          kExprGetLocal, 0,
+          kExprCallIndirect, signums.i_v, kTableZero
+        ])
+        .exportAs("call");
+    let f29 = addConstFuncUsingMemory(builder, 29);
+    builder.addElementSegment(0, 19, false, [f19]);
+    builder.addElementSegment(0, 23, false, [f23]);
+    builder.addElementSegment(0, 29, false, [f29]);
+    builder.addElementSegment(0, 5, false, [call.index]);
 
-function check_FOREIGN_SUB(r, a, b) {
-    assertEquals(a - b | 0, r);
-    assertTrue(was_called);
-    assertEquals(global, params[0]);  // sloppy mode
-    assertEquals(a, params[1]);
-    assertEquals(b, params[2]);
-    was_called = false;
-}
-
-testCallImport(FOREIGN_SUB, check_FOREIGN_SUB);
-
-
-function FOREIGN_ABCD(a, b, c, d) {
-  print("FOREIGN_ABCD(" + a + ", " + b + ", " + c + ", " + d + ")");
-  was_called = true;
-  params[0] = this;
-  params[1] = a;
-  params[2] = b;
-  params[3] = c;
-  params[4] = d;
-  return (a * b * 6) | 0;
-}
-
-function check_FOREIGN_ABCD(r, a, b) {
-    assertEquals((a * b * 6) | 0, r);
-    assertTrue(was_called);
-    assertEquals(global, params[0]);  // sloppy mode.
-    assertEquals(a, params[1]);
-    assertEquals(b, params[2]);
-    assertEquals(undefined, params[3]);
-    assertEquals(undefined, params[4]);
-    was_called = false;
-}
-
-testCallImport(FOREIGN_ABCD, check_FOREIGN_ABCD);
-
-function FOREIGN_ARGUMENTS0() {
-  print("FOREIGN_ARGUMENTS0");
-  was_called = true;
-  length = arguments.length;
-  for (var i = 0; i < arguments.length; i++) {
-    params[i] = arguments[i];
+    var mod2 = builder.toModule();
   }
-  return (arguments[0] * arguments[1] * 7) | 0;
-}
 
-function FOREIGN_ARGUMENTS1(a) {
-  print("FOREIGN_ARGUMENTS1", a);
-  was_called = true;
-  length = arguments.length;
-  for (var i = 0; i < arguments.length; i++) {
-    params[i] = arguments[i];
+  var table = new WebAssembly.Table({initial: kTableSize,
+                                     maximum: kTableSize, element: "anyfunc"});
+  var i1 = new WebAssembly.Instance(mod1, {m: {table: table}});
+
+  var i2 = new WebAssembly.Instance(mod2,
+      {m: {table: table, f13: i1.exports.f13, f19: i1.exports.f19}});
+
+  for (i of [13, 19, 23, 29]) {
+    print(i);
+    assertEquals(i, i1.exports.call(i));
+    assertEquals(i, i2.exports.call(i));
   }
-  return (arguments[0] * arguments[1] * 7) | 0;
-}
-
-function FOREIGN_ARGUMENTS2(a, b) {
-  print("FOREIGN_ARGUMENTS2", a, b);
-  was_called = true;
-  length = arguments.length;
-  for (var i = 0; i < arguments.length; i++) {
-    params[i] = arguments[i];
+  for (i of [0, 1, 5, 16]) {
+    assertThrows(() => i1.exports.call(i));
+    assertThrows(() => i2.exports.call(i));
   }
-  return (a * b * 7) | 0;
-}
-
-function FOREIGN_ARGUMENTS3(a, b, c) {
-  print("FOREIGN_ARGUMENTS3", a, b, c);
-  was_called = true;
-  length = arguments.length;
-  for (var i = 0; i < arguments.length; i++) {
-    params[i] = arguments[i];
-  }
-  return (a * b * 7) | 0;
-}
-
-function FOREIGN_ARGUMENTS4(a, b, c, d) {
-  print("FOREIGN_ARGUMENTS4", a, b, c, d);
-  was_called = true;
-  length = arguments.length;
-  for (var i = 0; i < arguments.length; i++) {
-    params[i] = arguments[i];
-  }
-  return (a * b * 7) | 0;
-}
-
-function check_FOREIGN_ARGUMENTS(r, a, b) {
-  assertEquals((a * b * 7) | 0, r);
-  assertTrue(was_called);
-  assertEquals(2, length);
-  assertEquals(a, params[0]);
-  assertEquals(b, params[1]);
-  was_called = false;
-}
-
-// Check a bunch of uses of the arguments object.
-testCallImport(FOREIGN_ARGUMENTS0, check_FOREIGN_ARGUMENTS);
-testCallImport(FOREIGN_ARGUMENTS1, check_FOREIGN_ARGUMENTS);
-testCallImport(FOREIGN_ARGUMENTS2, check_FOREIGN_ARGUMENTS);
-testCallImport(FOREIGN_ARGUMENTS3, check_FOREIGN_ARGUMENTS);
-testCallImport(FOREIGN_ARGUMENTS4, check_FOREIGN_ARGUMENTS);
-
-function returnValue(val) {
-  return function(a, b) {
-    print("RETURN_VALUE ", val);
-    return val;
-  }
-}
-
-
-function checkReturn(expected) {
-  return function(r, a, b) { assertEquals(expected, r); }
-}
-
-// Check that returning weird values doesn't crash
-testCallImport(returnValue(undefined), checkReturn(0));
-testCallImport(returnValue(null), checkReturn(0));
-testCallImport(returnValue("0"), checkReturn(0));
-testCallImport(returnValue("-77"), checkReturn(-77));
-
-var objWithValueOf = {valueOf: function() { return 198; }}
-
-testCallImport(returnValue(objWithValueOf), checkReturn(198));
-
-
-function testCallBinopVoid(type, func, check) {
-  var passed_length = -1;
-  var passed_a = -1;
-  var passed_b = -1;
-  var args_a = -1;
-  var args_b = -1;
-
-  var ffi = {q: {func: function(a, b) {
-    passed_length = arguments.length;
-    passed_a = a;
-    passed_b = b;
-    args_a = arguments[0];
-    args_b = arguments[1];
-  }}};
-
-  var builder = new WasmModuleBuilder();
-
-  builder.addImport("q", "func", makeSig_v_xx(type));
-  builder.addFunction("main", makeSig_r_xx(kWasmI32, type))
-    .addBody([
-      kExprGetLocal, 0,           // --
-      kExprGetLocal, 1,           // --
-      kExprCallFunction, 0,       // --
-      kExprI32Const, 39,          // --
-    ])
-    .exportFunc("main");
-
-  var main = builder.instantiate(ffi).exports.main;
-
-  print("testCallBinopVoid", type);
-
-  for (var i = 0; i < 100000; i += 10003.1) {
-    var a = 22.5 + i, b = 10.5 + i;
-    var r = main(a, b);
-    assertEquals(39, r);
-    assertEquals(2, passed_length);
-    var expected_a, expected_b;
-    switch (type) {
-      case kWasmI32: {
-        expected_a = a | 0;
-        expected_b = b | 0;
-        break;
-      }
-      case kWasmF32: {
-        expected_a = Math.fround(a);
-        expected_b = Math.fround(b);
-        break;
-      }
-      case kWasmF64: {
-        expected_a = a;
-        expected_b = b;
-        break;
-      }
-    }
-
-    assertEquals(expected_a, args_a);
-    assertEquals(expected_b, args_b);
-    assertEquals(expected_a, passed_a);
-    assertEquals(expected_b, passed_b);
-  }
-}
-
-
-testCallBinopVoid(kWasmI32);
-// TODO testCallBinopVoid(kWasmI64);
-testCallBinopVoid(kWasmF32);
-testCallBinopVoid(kWasmF64);
-
-
-
-function testCallPrint() {
-  var builder = new WasmModuleBuilder();
-  builder.addImport("q", "print", makeSig_v_x(kWasmI32));
-  builder.addImport("q", "print", makeSig_r_x(kWasmF64, kWasmF64));
-  builder.addFunction("main", makeSig_r_x(kWasmF64, kWasmF64))
-    .addBody([
-      kExprI32Const, 27,     // --
-      kExprCallFunction, 0,  // --
-      kExprGetLocal, 0,      // --
-      kExprCallFunction, 1   // --
-    ])
-    .exportFunc();
-
-  var main = builder.instantiate({q: {print: print}}).exports.main;
-
-  for (var i = -9; i < 900; i += 16.125) {
-    main(i);
-  }
-}
-
-testCallPrint();
-testCallPrint();
-
-
-function testCallImport2(foo, bar, expected) {
-  var builder = new WasmModuleBuilder();
-
-  builder.addImport("q", "foo", kSig_i_v);
-  builder.addImport("t", "bar", kSig_i_v);
-  builder.addFunction("main", kSig_i_v)
-    .addBody([
-      kExprCallFunction, 0, // --
-      kExprCallFunction, 1, // --
-      kExprI32Add,                 // --
-    ])                             // --
-    .exportFunc();
-
-  var main = builder.instantiate({q: {foo: foo}, t: {bar: bar}}).exports.main;
-  assertEquals(expected, main());
-}
-
-testCallImport2(function() { return 33; }, function () { return 44; }, 77);
-
-
-function testImportName(name) {
-  var builder = new WasmModuleBuilder();
-  builder.addImport("M", name, kSig_i_v);
-  builder.addFunction("main", kSig_i_v)
-    .addBody([
-      kExprCallFunction, 0
-    ])
-    .exportFunc();
-
-  let main = builder.instantiate({M: {[name]: () => 42}}).exports.main;
-  assertEquals(42, main());
-}
-
-testImportName("bla");
-testImportName("0");
-testImportName("  a @#$2 324 ");
-// TODO(bradnelson): This should succeed.
-// testImportName("");
+})();
diff --git a/src/v8/test/mjsunit/wasm/indirect-call-non-zero-table-interpreter.js b/src/v8/test/mjsunit/wasm/indirect-call-non-zero-table-interpreter.js
new file mode 100644
index 0000000..f9275d7
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/indirect-call-non-zero-table-interpreter.js
@@ -0,0 +1,12 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --experimental-wasm-anyref --experimental-wasm-return-call
+// Flags: --wasm-interpret-all
+
+// This is just a wrapper for an existing reference types test case that runs
+// with the --wasm-interpret-all flag added. If we ever decide to add a test
+// variant for this, then we can remove this file.
+
+load("test/mjsunit/wasm/indirect-call-non-zero-table.js");
diff --git a/src/v8/test/mjsunit/wasm/indirect-call-non-zero-table.js b/src/v8/test/mjsunit/wasm/indirect-call-non-zero-table.js
new file mode 100644
index 0000000..414ca19
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/indirect-call-non-zero-table.js
@@ -0,0 +1,202 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --experimental-wasm-anyref --experimental-wasm-return-call
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function IndirectCallToNonZeroTable() {
+  print(arguments.callee.name);
+
+  const builder = new WasmModuleBuilder();
+  const placeholder = builder.addTable(kWasmAnyFunc, 3).index;
+  const table1 = builder.addTable(kWasmAnyFunc, 3).index;
+  const table2 = builder.addTable(kWasmAnyFunc, 5).index;
+  const sig_index = builder.addType(kSig_i_v);
+  const other_sig = builder.addType(kSig_i_i);
+
+  const v1 = 16;
+  const v2 = 26;
+  const v3 = 36;
+  const v4 = 46;
+  const v5 = 56;
+
+  const f_unreachable = builder.addFunction('unreachable', sig_index)
+    .addBody([kExprUnreachable]).index;
+  const f1 = builder.addFunction('f1', sig_index)
+    .addBody([kExprI32Const, v1])
+    .index;
+  const f2 = builder.addFunction('f2', sig_index)
+    .addBody([kExprI32Const, v2])
+    .index;
+  const f3 = builder.addFunction('f3', sig_index)
+    .addBody([kExprI32Const, v3])
+    .index;
+  const f4 = builder.addFunction('f4', sig_index)
+    .addBody([kExprI32Const, v4])
+    .index;
+  const f5 = builder.addFunction('f5', sig_index)
+    .addBody([kExprI32Const, v5])
+    .index;
+
+  builder.addFunction('call1', kSig_i_i)
+    .addBody([kExprGetLocal, 0,   // function index
+      kExprCallIndirect, sig_index, table1])
+    .exportAs('call1');
+  builder.addFunction('return_call1', kSig_i_i)
+    .addBody([kExprGetLocal, 0,   // function index
+      kExprReturnCallIndirect, sig_index, table1])
+    .exportAs('return_call1');
+  builder.addFunction('call2', kSig_i_i)
+    .addBody([kExprGetLocal, 0,   // function index
+      kExprCallIndirect, sig_index, table2])
+    .exportAs('call2');
+  builder.addFunction('return_call2', kSig_i_i)
+    .addBody([kExprGetLocal, 0,   // function index
+      kExprReturnCallIndirect, sig_index, table2])
+    .exportAs('return_call2');
+
+  builder.addFunction('call_invalid_sig', kSig_i_i)
+    .addBody([kExprGetLocal, 0, kExprGetLocal, 0,   // function index + param
+      kExprCallIndirect, other_sig, table2])
+    .exportAs('call_invalid_sig');
+  builder.addFunction('return_call_invalid_sig', kSig_i_i)
+    .addBody([kExprGetLocal, 0, kExprGetLocal, 0,   // function index + param
+      kExprReturnCallIndirect, other_sig, table2])
+    .exportAs('return_call_invalid_sig');
+
+  // We want to crash if we call through the table with index 0.
+  builder.addElementSegment(placeholder, 0, false,
+    [f_unreachable, f_unreachable, f_unreachable]);
+  builder.addElementSegment(table1, 0, false, [f1, f2, f3]);
+  // Keep one slot in table2 uninitialized. We should trap if we call it.
+  builder.addElementSegment(table2, 1, false,
+    [f_unreachable, f_unreachable, f4, f5]);
+
+  const instance = builder.instantiate();
+
+  assertEquals(v1, instance.exports.call1(0));
+  assertEquals(v2, instance.exports.call1(1));
+  assertEquals(v3, instance.exports.call1(2));
+  assertTraps(kTrapFuncInvalid, () => instance.exports.call1(3));
+  assertEquals(v1, instance.exports.return_call1(0));
+  assertEquals(v2, instance.exports.return_call1(1));
+  assertEquals(v3, instance.exports.return_call1(2));
+  assertTraps(kTrapFuncInvalid, () => instance.exports.return_call1(3));
+
+  // Try to call through the uninitialized table entry.
+  assertTraps(kTrapFuncSigMismatch, () => instance.exports.call2(0));
+  assertEquals(v4, instance.exports.call2(3));
+  assertEquals(v5, instance.exports.call2(4));
+  assertTraps(kTrapFuncSigMismatch,
+    () => instance.exports.call_invalid_sig(4));
+  assertTraps(kTrapFuncSigMismatch, () => instance.exports.return_call2(0));
+  assertEquals(v4, instance.exports.return_call2(3));
+  assertEquals(v5, instance.exports.return_call2(4));
+  assertTraps(kTrapFuncSigMismatch,
+    () => instance.exports.return_call_invalid_sig(4));
+})();
+
+(function IndirectCallToImportedNonZeroTable() {
+  print(arguments.callee.name);
+
+  const table_size = 10;
+  const placeholder = new WebAssembly.Table(
+    { initial: table_size, maximum: table_size, element: "anyfunc" });
+  const table = new WebAssembly.Table(
+    { initial: table_size, maximum: table_size, element: "anyfunc" });
+
+  const builder = new WasmModuleBuilder();
+  builder.addImportedTable("m", "placeholder", table_size, table_size);
+  const t1 = builder.addImportedTable("m", "table", table_size, table_size);
+
+  // We initialize the module twice and put the function f1 in the table at
+  // the index defined by {g}. Thereby we can initialize the table at different
+  // slots for different instances. The function f1 also returns {g} so that we
+  // can see that actually different functions get called.
+  const g = builder.addImportedGlobal("m", "base", kWasmI32);
+
+  const sig_index = builder.addType(kSig_i_v);
+  const f1 = builder.addFunction("foo", sig_index)
+    .addBody([kExprGetGlobal, g, kExprI32Const, 12, kExprI32Add]);
+
+  builder.addFunction('call', kSig_i_i)
+    .addBody([kExprGetLocal, 0,   // function index
+      kExprCallIndirect, sig_index, t1])
+    .exportAs('call');
+
+  builder.addElementSegment(t1, g, true, [f1.index]);
+  const base1 = 3;
+  const base2 = 5;
+
+  const instance1 = builder.instantiate({
+    m: {
+      placeholder: placeholder,
+      table: table,
+      base: base1
+    }
+  });
+
+  const instance2 = builder.instantiate({
+    m: {
+      placeholder: placeholder,
+      table: table,
+      base: base2
+    }
+  });
+
+  assertEquals(base1 + 12, instance1.exports.call(base1));
+  assertEquals(base2 + 12, instance1.exports.call(base2));
+  assertEquals(base1 + 12, instance2.exports.call(base1));
+  assertEquals(base2 + 12, instance2.exports.call(base2));
+})();
+
+function js_div(a, b) { return (a / b) | 0; }
+
+(function CallImportedFunction() {
+  let kTableSize = 10;
+  print(arguments.callee.name);
+
+  var builder = new WasmModuleBuilder();
+
+  let div = builder.addImport("q", "js_div", kSig_i_ii);
+  builder.addImportedTable("q", "placeholder", kTableSize, kTableSize);
+  let table_index = builder.addImportedTable("q", "table", kTableSize, kTableSize);
+  let g = builder.addImportedGlobal("q", "base", kWasmI32);
+
+  let sig_index = builder.addType(kSig_i_ii);
+  builder.addFunction("placeholder", sig_index)
+    .addBody([kExprGetLocal, 0]);
+
+  builder.addElementSegment(table_index, g, true, [div]);
+  builder.addFunction("main", kSig_i_ii)
+    .addBody([
+      kExprI32Const, 55,  // --
+      kExprGetLocal, 0,   // --
+      kExprGetLocal, 1,   // --
+      kExprCallIndirect, 0, table_index])  // --
+    .exportAs("main");
+
+  let m = new WebAssembly.Module(builder.toBuffer());
+
+  let table = new WebAssembly.Table({
+    element: "anyfunc",
+    initial: kTableSize,
+    maximum: kTableSize
+  });
+  let placeholder = new WebAssembly.Table({
+    element: "anyfunc",
+    initial: kTableSize,
+    maximum: kTableSize
+  });
+
+  let instance = new WebAssembly.Instance(m, {
+    q: {
+      base: 0, table: table, placeholder: placeholder,
+      js_div: js_div
+    }
+  });
+
+  assertEquals(13, instance.exports.main(4, 0));
+})();
diff --git a/src/v8/test/mjsunit/wasm/indirect-calls.js b/src/v8/test/mjsunit/wasm/indirect-calls.js
index bcb7acd..e9f560a 100644
--- a/src/v8/test/mjsunit/wasm/indirect-calls.js
+++ b/src/v8/test/mjsunit/wasm/indirect-calls.js
@@ -4,86 +4,104 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
-var module = (function () {
-  var builder = new WasmModuleBuilder();
+(function Test1() {
+  print("Test1...");
+  var module = (function () {
+    var builder = new WasmModuleBuilder();
 
-  var sig_index = builder.addType(kSig_i_ii);
-  builder.addImport("q", "add", sig_index);
-  builder.addFunction("add", sig_index)
-    .addBody([
-      kExprGetLocal, 0, kExprGetLocal, 1, kExprCallFunction, 0
-    ]);
-  builder.addFunction("sub", sig_index)
-    .addBody([
-      kExprGetLocal, 0,             // --
-      kExprGetLocal, 1,             // --
-      kExprI32Sub,                  // --
-    ]);
-  builder.addFunction("main", kSig_i_iii)
-    .addBody([
-      kExprGetLocal, 1,
-      kExprGetLocal, 2,
-      kExprGetLocal, 0,
-      kExprCallIndirect, sig_index, kTableZero
-    ])
-    .exportFunc()
-  builder.appendToTable([1, 2, 3]);
+    var sig_index = builder.addType(kSig_i_ii);
+    builder.addImport("q", "add", sig_index);
+    var f = builder.addFunction("add", sig_index)
+      .addBody([
+        kExprGetLocal, 0, kExprGetLocal, 1, kExprCallFunction, 0
+      ]);
+    print("internal add index = " + f.index);
+    builder.addFunction("sub", sig_index)
+      .addBody([
+        kExprGetLocal, 0,             // --
+        kExprGetLocal, 1,             // --
+        kExprI32Sub,                  // --
+      ]);
+    builder.addFunction("main", kSig_i_iii)
+      .addBody([
+        kExprGetLocal, 1,
+        kExprGetLocal, 2,
+        kExprGetLocal, 0,
+        kExprCallIndirect, sig_index, kTableZero
+      ])
+      .exportFunc()
+    builder.appendToTable([1, 2, 3]);
 
-  return builder.instantiate({q: {add: function(a, b) { return a + b | 0; }}});
+    return builder.instantiate({q: {add: function(a, b) {
+      print("  --extadd");
+      return a + b | 0;
+    }}});
+  })();
+
+  // Check the module exists.
+  assertFalse(module === undefined);
+  assertFalse(module === null);
+  assertFalse(module === 0);
+
+  assertEquals("object", typeof module.exports);
+  assertEquals("function", typeof module.exports.main);
+
+  print(" --x1--");
+  assertEquals(19, module.exports.main(0, 12, 7));
+  print(" --y1--");
+  assertEquals(5, module.exports.main(1, 12, 7));
+  print(" --z1--");
+  assertTraps(kTrapFuncSigMismatch, () => module.exports.main(2, 12, 33));
+  print(" --w1--");
+  assertTraps(kTrapFuncInvalid, () => module.exports.main(3, 12, 33));
 })();
 
-// Check the module exists.
-assertFalse(module === undefined);
-assertFalse(module === null);
-assertFalse(module === 0);
-assertEquals("object", typeof module.exports);
-assertEquals("function", typeof module.exports.main);
+(function Test2() {
+  print("Test2...");
+  var module = (function () {
+    var builder = new WasmModuleBuilder();
 
-assertEquals(5, module.exports.main(1, 12, 7));
-assertEquals(19, module.exports.main(0, 12, 7));
+    var sig_i_ii = builder.addType(kSig_i_ii);
+    var sig_i_i = builder.addType(kSig_i_i);
+    var mul = builder.addImport("q", "mul", sig_i_ii);
+    var add = builder.addFunction("add", sig_i_ii)
+        .addBody([
+          kExprGetLocal, 0,  // --
+          kExprGetLocal, 1,  // --
+          kExprI32Add        // --
+        ]);
+    var popcnt = builder.addFunction("popcnt", sig_i_i)
+        .addBody([
+          kExprGetLocal, 0,  // --
+          kExprI32Popcnt     // --
+        ]);
+    var main = builder.addFunction("main", kSig_i_iii)
+        .addBody([
+          kExprGetLocal, 1,
+          kExprGetLocal, 2,
+          kExprGetLocal, 0,
+          kExprCallIndirect, sig_i_ii, kTableZero
+        ])
+        .exportFunc();
+    builder.appendToTable([mul, add.index, popcnt.index, main.index]);
 
-assertTraps(kTrapFuncSigMismatch, "module.exports.main(2, 12, 33)");
-assertTraps(kTrapFuncInvalid, "module.exports.main(3, 12, 33)");
+    return builder.instantiate({q: {mul: function(a, b) { return a * b | 0; }}});
+  })();
 
-
-module = (function () {
-  var builder = new WasmModuleBuilder();
-
-  var sig_i_ii = builder.addType(kSig_i_ii);
-  var sig_i_i = builder.addType(kSig_i_i);
-  var mul = builder.addImport("q", "mul", sig_i_ii);
-  var add = builder.addFunction("add", sig_i_ii)
-    .addBody([
-      kExprGetLocal, 0,  // --
-      kExprGetLocal, 1,  // --
-      kExprI32Add        // --
-    ]);
-  var popcnt = builder.addFunction("popcnt", sig_i_i)
-    .addBody([
-      kExprGetLocal, 0,  // --
-      kExprI32Popcnt     // --
-    ]);
-  var main = builder.addFunction("main", kSig_i_iii)
-    .addBody([
-      kExprGetLocal, 1,
-      kExprGetLocal, 2,
-      kExprGetLocal, 0,
-      kExprCallIndirect, sig_i_ii, kTableZero
-    ])
-    .exportFunc();
-  builder.appendToTable([mul, add.index, popcnt.index, main.index]);
-
-  return builder.instantiate({q: {mul: function(a, b) { return a * b | 0; }}});
+  print(" --x2--");
+  assertEquals(-6, module.exports.main(0, -2, 3));
+  print(" --y2--");
+  assertEquals(99, module.exports.main(1, 22, 77));
+  print(" --z2--");
+  assertTraps(kTrapFuncSigMismatch, () => module.exports.main(2, 12, 33));
+  print(" --q2--");
+  assertTraps(kTrapFuncSigMismatch, () => module.exports.main(3, 12, 33));
+  print(" --t2--");
+  assertTraps(kTrapFuncInvalid, () => module.exports.main(4, 12, 33));
 })();
 
-assertEquals(-6, module.exports.main(0, -2, 3));
-assertEquals(99, module.exports.main(1, 22, 77));
-assertTraps(kTrapFuncSigMismatch, "module.exports.main(2, 12, 33)");
-assertTraps(kTrapFuncSigMismatch, "module.exports.main(3, 12, 33)");
-assertTraps(kTrapFuncInvalid, "module.exports.main(4, 12, 33)");
 
 function AddFunctions(builder) {
   var mul = builder.addFunction("mul", kSig_i_ii)
@@ -108,31 +126,34 @@
 }
 
 
-module = (function () {
-  var builder = new WasmModuleBuilder();
+(function Test3() {
+  print("Test3...");
+  var module = (function () {
+    var builder = new WasmModuleBuilder();
 
-  var f = AddFunctions(builder);
-  builder.addFunction("main", kSig_i_ii)
-    .addBody([
-      kExprI32Const, 33,  // --
-      kExprGetLocal, 0,   // --
-      kExprGetLocal, 1,   // --
-      kExprCallIndirect, 0, kTableZero])  // --
-    .exportAs("main");
+    var f = AddFunctions(builder);
+    builder.addFunction("main", kSig_i_ii)
+      .addBody([
+        kExprI32Const, 33,  // --
+        kExprGetLocal, 0,   // --
+        kExprGetLocal, 1,   // --
+        kExprCallIndirect, 0, kTableZero])  // --
+      .exportAs("main");
 
-  builder.appendToTable([f.mul.index, f.add.index, f.sub.index]);
+    builder.appendToTable([f.mul.index, f.add.index, f.sub.index]);
 
-  return builder.instantiate();
+    return builder.instantiate();
+  })();
+
+  assertEquals(33, module.exports.main(1, 0));
+  assertEquals(66, module.exports.main(2, 0));
+  assertEquals(34, module.exports.main(1, 1));
+  assertEquals(35, module.exports.main(2, 1));
+  assertEquals(32, module.exports.main(1, 2));
+  assertEquals(31, module.exports.main(2, 2));
+  assertTraps(kTrapFuncInvalid, () => module.exports.main(12, 3));
 })();
 
-assertEquals(33, module.exports.main(1, 0));
-assertEquals(66, module.exports.main(2, 0));
-assertEquals(34, module.exports.main(1, 1));
-assertEquals(35, module.exports.main(2, 1));
-assertEquals(32, module.exports.main(1, 2));
-assertEquals(31, module.exports.main(2, 2));
-assertTraps(kTrapFuncInvalid, "module.exports.main(12, 3)");
-
 (function ConstBaseTest() {
   print("ConstBaseTest...");
   function instanceWithTable(base, length) {
@@ -147,8 +168,8 @@
         kExprCallIndirect, 0, kTableZero])  // --
       .exportAs("main");
 
-    builder.setFunctionTableBounds(length, length);
-    builder.addFunctionTableInit(base, false, [f.add.index, f.sub.index, f.mul.index]);
+    builder.setTableBounds(length, length);
+    builder.addElementSegment(0, base, false, [f.add.index, f.sub.index, f.mul.index]);
 
     return builder.instantiate();
   }
@@ -166,7 +187,7 @@
     assertEquals(31, main(2, i + 1));
     assertEquals(33, main(1, i + 2));
     assertEquals(66, main(2, i + 2));
-    assertTraps(kTrapFuncInvalid, "main(12, 10)");
+    assertTraps(kTrapFuncInvalid, () => main(12, 10));
   }
 })();
 
@@ -184,9 +205,9 @@
       kExprCallIndirect, 0, kTableZero])  // --
     .exportAs("main");
 
-  builder.setFunctionTableBounds(10, 10);
+  builder.setTableBounds(10, 10);
   var g = builder.addImportedGlobal("fff", "base", kWasmI32);
-  builder.addFunctionTableInit(g, true, [f.mul.index, f.add.index, f.sub.index]);
+  builder.addElementSegment(0, g, true, [f.mul.index, f.add.index, f.sub.index]);
 
   var module = new WebAssembly.Module(builder.toBuffer());
 
@@ -203,6 +224,6 @@
     assertEquals(35, main(2, i + 1));
     assertEquals(32, main(1, i + 2));
     assertEquals(31, main(2, i + 2));
-    assertTraps(kTrapFuncInvalid, "main(12, 10)");
+    assertTraps(kTrapFuncInvalid, () => main(12, 10));
   }
 })();
diff --git a/src/v8/test/mjsunit/wasm/indirect-sig-mismatch.js b/src/v8/test/mjsunit/wasm/indirect-sig-mismatch.js
index 5e6e716..9e8ddac 100644
--- a/src/v8/test/mjsunit/wasm/indirect-sig-mismatch.js
+++ b/src/v8/test/mjsunit/wasm/indirect-sig-mismatch.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 const kTableSize = 3;
diff --git a/src/v8/test/mjsunit/wasm/indirect-tables.js b/src/v8/test/mjsunit/wasm/indirect-tables.js
index 88d1bb7..58df978 100644
--- a/src/v8/test/mjsunit/wasm/indirect-tables.js
+++ b/src/v8/test/mjsunit/wasm/indirect-tables.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm --expose-gc
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 function AddFunctions(builder) {
@@ -33,7 +32,7 @@
 function js_div(a, b) { return (a / b) | 0; }
 
 (function ExportedTableTest() {
-  print("ExportedTableTest...");
+  print(arguments.callee.name);
 
   let builder = new WasmModuleBuilder();
 
@@ -49,11 +48,10 @@
 
   f.add.exportAs("blarg");
 
-  builder.setFunctionTableBounds(10, 10);
+  builder.setTableBounds(10, 10);
   let g = builder.addImportedGlobal("q", "base", kWasmI32);
-  builder.addFunctionTableInit(g, true, [f.mul.index, f.add.index,
-                                         f.sub.index,
-                                         d]);
+  builder.addElementSegment(
+      0, g, true, [f.mul.index, f.add.index, f.sub.index, d]);
   builder.addExportOfKind("table", kExternalTable, 0);
 
   let module = new WebAssembly.Module(builder.toBuffer());
@@ -102,18 +100,17 @@
 })();
 
 
-(function ImportedTableTest() {
+(function ImportedTableTest1() {
   let kTableSize = 10;
-  print("ImportedTableTest...");
+  print(arguments.callee.name);
   var builder = new WasmModuleBuilder();
 
   let d = builder.addImport("q", "js_div", kSig_i_ii);
   let f = AddFunctions(builder);
-  builder.setFunctionTableBounds(kTableSize, kTableSize);
+  builder.setTableBounds(kTableSize, kTableSize);
   let g = builder.addImportedGlobal("q", "base", kWasmI32);
-  builder.addFunctionTableInit(g, true, [f.mul.index, f.add.index,
-                                         f.sub.index,
-                                         d]);
+  builder.addElementSegment(
+      0, g, true, [f.mul.index, f.add.index, f.sub.index, d]);
   builder.addExportOfKind("table", kExternalTable, 0);
 
   let m1 = new WebAssembly.Module(builder.toBuffer());
@@ -172,9 +169,9 @@
   }
 })();
 
-(function ImportedTableTest() {
+(function ImportedTableTest2() {
   let kTableSize = 10;
-  print("ManualTableTest...");
+  print(arguments.callee.name);
 
   var builder = new WasmModuleBuilder();
 
@@ -182,9 +179,8 @@
   builder.addImportedTable("q", "table", kTableSize, kTableSize);
   let g = builder.addImportedGlobal("q", "base", kWasmI32);
   let f = AddFunctions(builder);
-  builder.addFunctionTableInit(g, true, [f.mul.index, f.add.index,
-                                         f.sub.index,
-                                         d]);
+  builder.addElementSegment(
+      0, g, true, [f.mul.index, f.add.index, f.sub.index, d]);
   builder.addFunction("main", kSig_i_ii)
     .addBody([
       kExprI32Const, 55,  // --
@@ -240,7 +236,7 @@
 
 
 (function CumulativeTest() {
-  print("CumulativeTest...");
+  print(arguments.callee.name);
 
   let kTableSize = 10;
   let table = new WebAssembly.Table(
@@ -251,7 +247,7 @@
   builder.addImportedTable("x", "table", kTableSize, kTableSize);
   let g = builder.addImportedGlobal("x", "base", kWasmI32);
   let sig_index = builder.addType(kSig_i_v);
-  builder.addFunction("g", sig_index)
+  let f = builder.addFunction("f", sig_index)
     .addBody([
       kExprGetGlobal, g
     ]);
@@ -260,7 +256,7 @@
       kExprGetLocal, 0,
       kExprCallIndirect, sig_index, kTableZero])  // --
     .exportAs("main");
-  builder.addFunctionTableInit(g, true, [g]);
+  builder.addElementSegment(0, g, true, [f.index]);
 
   let module = new WebAssembly.Module(builder.toBuffer());
 
@@ -283,7 +279,7 @@
 })();
 
 (function TwoWayTest() {
-  print("TwoWayTest...");
+  print(arguments.callee.name);
   let kTableSize = 3;
 
   // Module {m1} defines the table and exports it.
@@ -300,8 +296,8 @@
       kExprCallIndirect, sig_index1, kTableZero])  // --
     .exportAs("main");
 
-  builder.setFunctionTableBounds(kTableSize, kTableSize);
-  builder.addFunctionTableInit(0, false, [f1.index]);
+  builder.setTableBounds(kTableSize, kTableSize);
+  builder.addElementSegment(0, 0, false, [f1.index]);
   builder.addExportOfKind("table", kExternalTable, 0);
 
   var m1 = new WebAssembly.Module(builder.toBuffer());
@@ -320,7 +316,7 @@
     .exportAs("main");
 
   builder.addImportedTable("z", "table", kTableSize, kTableSize);
-  builder.addFunctionTableInit(1, false, [f2.index], true);
+  builder.addElementSegment(0, 1, false, [f2.index]);
 
   var m2 = new WebAssembly.Module(builder.toBuffer());
 
@@ -342,14 +338,14 @@
 })();
 
 (function MismatchedTableSize() {
-  print("MismatchedTableSize...");
+  print(arguments.callee.name);
   let kTableSize = 5;
 
   for (var expsize = 1; expsize < 4; expsize++) {
     for (var impsize = 1; impsize < 4; impsize++) {
       print(" expsize = " + expsize + ", impsize = " + impsize);
       var builder = new WasmModuleBuilder();
-      builder.setFunctionTableBounds(expsize, expsize);
+      builder.setTableBounds(expsize, expsize);
       builder.addExportOfKind("expfoo", kExternalTable, 0);
 
       let m1 = new WebAssembly.Module(builder.toBuffer());
@@ -374,7 +370,7 @@
 })();
 
 (function TableGrowBoundsCheck() {
-  print("TableGrowBoundsCheck");
+  print(arguments.callee.name);
   var kMaxSize = 30, kInitSize = 5;
   let table = new WebAssembly.Table({element: "anyfunc",
     initial: kInitSize, maximum: kMaxSize});
@@ -398,7 +394,7 @@
 })();
 
 (function CumulativeGrowTest() {
-  print("CumulativeGrowTest...");
+  print(arguments.callee.name);
   let table = new WebAssembly.Table({
     element: "anyfunc", initial: 10, maximum: 30});
   var builder = new WasmModuleBuilder();
@@ -415,7 +411,7 @@
       kExprGetLocal, 0,
       kExprCallIndirect, sig_index, kTableZero])  // --
     .exportAs("main");
-  builder.addFunctionTableInit(g, true, [g]);
+  builder.addElementSegment(0, g, true, [g]);
   let module = new WebAssembly.Module(builder.toBuffer());
 
   var instances = [];
@@ -460,7 +456,7 @@
 
 
 (function TestImportTooLarge() {
-  print("TestImportTooLarge...");
+  print(arguments.callee.name);
   let builder = new WasmModuleBuilder();
   builder.addImportedTable("t", "t", 1, 2);
 
@@ -478,7 +474,7 @@
 })();
 
 (function TableImportLargerThanCompiled() {
-  print("TableImportLargerThanCompiled...");
+  print(arguments.callee.name);
   var kMaxSize = 30, kInitSize = 5;
   var builder = new WasmModuleBuilder();
   builder.addImportedTable("x", "table", 1, 35);
@@ -492,7 +488,7 @@
 })();
 
 (function ModulesShareTableAndGrow() {
-  print("ModulesShareTableAndGrow...");
+  print(arguments.callee.name);
   let module1 = (() => {
     let builder = new WasmModuleBuilder();
     builder.addImportedTable("x", "table", 1, 35);
@@ -525,7 +521,7 @@
 
 (function MultipleElementSegments() {
   let kTableSize = 10;
-  print("MultipleElementSegments...");
+  print(arguments.callee.name);
 
   let mul = (a, b) => a * b;
   let add = (a, b) => a + b;
@@ -538,7 +534,7 @@
   for (let num_segments = 1; num_segments < 4; ++num_segments) {
     var builder = new WasmModuleBuilder();
 
-    builder.setFunctionTableBounds(kTableSize, kTableSize);
+    builder.setTableBounds(kTableSize, kTableSize);
     builder.addExportOfKind("table", kExternalTable, 0);
     let f = AddFunctions(builder);
     let indexes = [f.mul.index, f.add.index, f.sub.index];
@@ -546,7 +542,7 @@
       let offset = i + 1;
       let len = i + 2;
       let index = indexes[i];
-      builder.addFunctionTableInit(offset, false, new Array(len).fill(index));
+      builder.addElementSegment(0, offset, false, new Array(len).fill(index));
     }
 
     let instance = builder.instantiate();
@@ -580,7 +576,7 @@
         kExprCallIndirect, sig_index, kTableZero
       ])
       .exportAs('main');
-  builder0.setFunctionTableBounds(3, 3);
+  builder0.setTableBounds(3, 3);
   builder0.addExportOfKind('table', kExternalTable);
   let module0 = new WebAssembly.Module(builder0.toBuffer());
   let instance0 = new WebAssembly.Instance(module0);
@@ -590,7 +586,7 @@
   builder1.setName('module_1');
   builder1.addFunction('f', kSig_i_i).addBody([kExprGetLocal, 0]);
   builder1.addImportedTable('z', 'table');
-  builder1.addFunctionTableInit(0, false, [0], true);
+  builder1.addElementSegment(0, 0, false, [0]);
   let module1 = new WebAssembly.Module(builder1.toBuffer());
   let instance1 =
       new WebAssembly.Instance(module1, {z: {table: instance0.exports.table}});
@@ -603,7 +599,8 @@
 })();
 
 (function IndirectCallIntoOtherInstance() {
-  print("IndirectCallIntoOtherInstance...");
+  print(arguments.callee.name);
+
   var mem_1 = new WebAssembly.Memory({initial: 1});
   var mem_2 = new WebAssembly.Memory({initial: 1});
   var view_1 = new Int32Array(mem_1.buffer);
@@ -618,7 +615,7 @@
     .exportAs('main');
   builder.addImportedMemory('', 'memory', 1);
 
-  builder.setFunctionTableBounds(1, 1);
+  builder.setTableBounds(1, 1);
   builder.addExportOfKind('table', kExternalTable);
 
   let module1 = new WebAssembly.Module(builder.toBuffer());
@@ -627,7 +624,7 @@
   builder = new WasmModuleBuilder();
   builder.addFunction('main', kSig_i_v).addBody([kExprI32Const, 0, kExprI32LoadMem, 0, 0]);
   builder.addImportedTable('', 'table');
-  builder.addFunctionTableInit(0, false, [0], true);
+  builder.addElementSegment(0, 0, false, [0]);
   builder.addImportedMemory('', 'memory', 1);
 
 
@@ -644,7 +641,7 @@
 
 
 (function ImportedFreestandingTable() {
-  print("ImportedFreestandingTable...");
+  print(arguments.callee.name);
 
   function forceGc() {
     gc();
@@ -707,39 +704,196 @@
 })();
 
 
-// Remove this test when v8:7232 is addressed comprehensively.
-(function TablesAreImmutableInWasmCallstacks() {
-  print('TablesAreImmutableInWasmCallstacks...');
-  let table = new WebAssembly.Table({initial:2, element:'anyfunc'});
+(function ImportedWasmFunctionPutIntoTable() {
+  print(arguments.callee.name);
+
+  let wasm_mul = (() => {
+    let builder = new WasmModuleBuilder();
+    builder.addFunction("mul", kSig_i_ii)
+      .addBody(
+        [kExprGetLocal, 0,
+         kExprGetLocal, 1,
+         kExprI32Mul])
+      .exportFunc();
+    return builder.instantiate().exports.mul;
+  })();
 
   let builder = new WasmModuleBuilder();
-  builder.addImport('', 'mutator', kSig_v_v);
-  builder.addFunction('main', kSig_v_v)
+
+  let j = builder.addImport("q", "js_div", kSig_i_ii);
+  let w = builder.addImport("q", "wasm_mul", kSig_i_ii);
+  builder.addFunction("main", kSig_i_ii)
     .addBody([
-      kExprCallFunction, 0
-    ]).exportAs('main');
+      kExprI32Const, 33,  // --
+      kExprGetLocal, 0,   // --
+      kExprGetLocal, 1,   // --
+      kExprCallIndirect, 0, kTableZero])  // --
+    .exportAs("main");
+
+  builder.setTableBounds(10, 10);
+  let g = builder.addImportedGlobal("q", "base", kWasmI32);
+  builder.addElementSegment(0, g, true, [j, w]);
 
   let module = new WebAssembly.Module(builder.toBuffer());
-  let instance = new WebAssembly.Instance(module, {
-    '': {
-      'mutator': () => {table.set(0, null);}
-    }
-  });
+  for (var i = 0; i < 5; i++) {
+    let instance = new WebAssembly.Instance(module, {q: {base: i, js_div: js_div, wasm_mul: wasm_mul}});
+    let j = i + 1;
 
-  table.set(0, instance.exports.main);
+    assertThrows(() => {instance.exports.main(j, i-1)});
+    assertEquals((33/j)|0, instance.exports.main(j, i+0));
+    assertEquals((33*j)|0, instance.exports.main(j, i+1));
+    assertThrows(() => {instance.exports.main(j, i+2)});
+  }
 
-  try {
-    instance.exports.main();
-    assertUnreached();
-  } catch (e) {
-    assertTrue(e instanceof RangeError);
+})();
+
+(function ImportedWasmFunctionPutIntoImportedTable() {
+  print(arguments.callee.name);
+
+  let kTableSize = 10;
+
+  let wasm_mul = (() => {
+    let builder = new WasmModuleBuilder();
+    builder.addFunction("mul", kSig_i_ii)
+      .addBody(
+        [kExprGetLocal, 0,
+         kExprGetLocal, 1,
+         kExprI32Mul])
+      .exportFunc();
+    return builder.instantiate().exports.mul;
+  })();
+
+  let table = new WebAssembly.Table({element: "anyfunc",
+                                     initial: kTableSize,
+                                     maximum: kTableSize});
+
+  let builder = new WasmModuleBuilder();
+
+  let j = builder.addImport("q", "js_div", kSig_i_ii);
+  let w = builder.addImport("q", "wasm_mul", kSig_i_ii);
+  builder.addImportedTable("q", "table", kTableSize, kTableSize);
+  builder.addFunction("main", kSig_i_ii)
+    .addBody([
+      kExprI32Const, 44,  // --
+      kExprGetLocal, 0,   // --
+      kExprGetLocal, 1,   // --
+      kExprCallIndirect, 0, kTableZero])  // --
+    .exportAs("main");
+
+  let g = builder.addImportedGlobal("q", "base", kWasmI32);
+  builder.addElementSegment(0, g, true, [j, w]);
+
+  let module = new WebAssembly.Module(builder.toBuffer());
+  for (var i = 0; i < 5; i++) {
+    let instance = new WebAssembly.Instance(module, {q: {base: i, js_div: js_div, wasm_mul: wasm_mul, table: table}});
+    let j = i + 1;
+
+    assertEquals((44/j)|0, instance.exports.main(j, i+0));
+    assertEquals((44*j)|0, instance.exports.main(j, i+1));
+    assertThrows(() => {instance.exports.main(j, i+2)});
   }
-  try {
-    instance.exports.main();
-    assertUnreached();
-  } catch (e) {
-    assertTrue(e instanceof RangeError);
+})();
+
+(function ExportedFunctionsImportedOrder() {
+  print(arguments.callee.name);
+
+  let i1 = (() => {
+    let builder = new WasmModuleBuilder();
+    builder.addFunction("f1", kSig_i_v)
+      .addBody(
+        [kExprI32Const, 1])
+      .exportFunc();
+    builder.addFunction("f2", kSig_i_v)
+      .addBody(
+        [kExprI32Const, 2])
+      .exportFunc();
+    return builder.instantiate();
+  })();
+
+  let i2 = (() => {
+    let builder = new WasmModuleBuilder();
+    builder.addTable(kWasmAnyFunc, 4);
+    builder.addImport("q", "f2", kSig_i_v);
+    builder.addImport("q", "f1", kSig_i_v);
+    builder.addFunction("main", kSig_i_i)
+      .addBody([
+        kExprGetLocal, 0,
+        kExprCallIndirect, 0, kTableZero
+      ])
+      .exportFunc();
+    builder.addElementSegment(0, 0, false, [0, 1, 1, 0]);
+
+    return builder.instantiate({q: {f2: i1.exports.f2, f1: i1.exports.f1}});
+  })();
+
+  assertEquals(2, i2.exports.main(0));
+  assertEquals(1, i2.exports.main(1));
+  assertEquals(1, i2.exports.main(2));
+  assertEquals(2, i2.exports.main(3));
+})();
+
+(function IndirectCallsToImportedFunctions() {
+  print(arguments.callee.name);
+
+  let module = (() => {
+    let builder = new WasmModuleBuilder();
+    builder.addMemory(1, 1, false);
+    builder.addFunction("f", kSig_i_v)
+      .addBody([
+        kExprI32Const, 0,
+        kExprI32LoadMem, 0, 4,
+      ])
+      .exportFunc();
+    builder.exportMemoryAs("memory");
+    return new WebAssembly.Module(builder.toBuffer());
+  })();
+
+  function setMemI32(instance, offset, val) {
+    var array = new Int32Array(instance.exports.memory.buffer);
+    array[offset/4] = val;
   }
-  table.set(0, null);
-  assertEquals(null, table.get(0));
+
+  function makeFun(val) {
+    let instance = new WebAssembly.Instance(module);
+    setMemI32(instance, 0, 2000000);
+    setMemI32(instance, 4, val);
+    setMemI32(instance, 8, 3000000);
+    return instance.exports.f;
+  }
+
+  let f300 = makeFun(300);
+  let f100 = makeFun(100);
+  let f200 = makeFun(200);
+
+  let main = (() => {
+    let builder = new WasmModuleBuilder();
+    builder.addMemory(1, 1, false);
+    builder.addTable(kWasmAnyFunc, 4);
+    builder.addImport("q", "f1", kSig_i_v);
+    builder.addImport("q", "f2", kSig_i_v);
+    builder.addImport("q", "f3", kSig_i_v);
+    builder.addFunction("f", kSig_i_v)
+      .addBody([
+        kExprI32Const, 8,
+        kExprI32LoadMem, 0, 0,
+      ]);
+    builder.addFunction("main", kSig_i_i)
+      .addBody([
+        kExprGetLocal, 0,
+        kExprCallIndirect, 0, kTableZero
+      ])
+      .exportFunc();
+    builder.exportMemoryAs("memory");
+    builder.addElementSegment(0, 0, false, [0, 1, 2, 3]);
+    var instance = builder.instantiate({q: {f1: f100, f2: f200, f3: f300}});
+    setMemI32(instance, 0, 5000000);
+    setMemI32(instance, 4, 6000000);
+    setMemI32(instance, 8, 400);
+    return instance.exports.main;
+  })();
+
+  assertEquals(100, main(0));
+  assertEquals(200, main(1));
+  assertEquals(300, main(2));
+  assertEquals(400, main(3));
 })();
diff --git a/src/v8/test/mjsunit/wasm/instance-gc.js b/src/v8/test/mjsunit/wasm/instance-gc.js
index e5dd4ed..aed9589 100644
--- a/src/v8/test/mjsunit/wasm/instance-gc.js
+++ b/src/v8/test/mjsunit/wasm/instance-gc.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm --expose-gc
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 let nogc = () => {};
diff --git a/src/v8/test/mjsunit/wasm/instance-memory-gc-stress.js b/src/v8/test/mjsunit/wasm/instance-memory-gc-stress.js
index 64909eb..29b65bc 100644
--- a/src/v8/test/mjsunit/wasm/instance-memory-gc-stress.js
+++ b/src/v8/test/mjsunit/wasm/instance-memory-gc-stress.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm --expose-gc
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 // This test verifies that when instances are exported, Gc'ed, the other
@@ -18,7 +17,7 @@
     .addBody([kExprMemorySize, kMemoryZero])
     .exportFunc();
   builder.addFunction("grow", kSig_i_i)
-    .addBody([kExprGetLocal, 0, kExprGrowMemory, kMemoryZero])
+    .addBody([kExprGetLocal, 0, kExprMemoryGrow, kMemoryZero])
     .exportFunc();
   var instances = [];
   for (var i = 0; i < 5; i++) {
diff --git a/src/v8/test/mjsunit/wasm/instantiate-module-basic.js b/src/v8/test/mjsunit/wasm/instantiate-module-basic.js
index d2489f3..1c5f10a 100644
--- a/src/v8/test/mjsunit/wasm/instantiate-module-basic.js
+++ b/src/v8/test/mjsunit/wasm/instantiate-module-basic.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm --allow-natives-syntax
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 let kReturnValue = 17;
@@ -97,11 +96,8 @@
   print('InvalidBinaryAsyncCompilation...');
   let builder = new WasmModuleBuilder();
   builder.addFunction('f', kSig_i_i).addBody([kExprCallFunction, 0]);
-  let promise = WebAssembly.compile(builder.toBuffer());
-  assertPromiseResult(
-      promise, compiled => assertUnreachable(
-                   'should not be able to compile invalid blob.'),
-      e => assertInstanceof(e, WebAssembly.CompileError));
+  assertThrowsAsync(
+      WebAssembly.compile(builder.toBuffer()), WebAssembly.CompileError);
 })();
 
 // Multiple instances tests.
diff --git a/src/v8/test/mjsunit/wasm/instantiate-run-basic.js b/src/v8/test/mjsunit/wasm/instantiate-run-basic.js
index b0016ec..ead01df 100644
--- a/src/v8/test/mjsunit/wasm/instantiate-run-basic.js
+++ b/src/v8/test/mjsunit/wasm/instantiate-run-basic.js
@@ -4,7 +4,6 @@
 
 // Flags: --allow-natives-syntax
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 const kReturnValue = 15;
diff --git a/src/v8/test/mjsunit/wasm/interpreter-mixed.js b/src/v8/test/mjsunit/wasm/interpreter-mixed.js
index 08cfc8c..573e1e1 100644
--- a/src/v8/test/mjsunit/wasm/interpreter-mixed.js
+++ b/src/v8/test/mjsunit/wasm/interpreter-mixed.js
@@ -4,7 +4,6 @@
 
 // Flags: --allow-natives-syntax
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 // =============================================================================
@@ -26,11 +25,11 @@
   }
 }
 
-(function testGrowMemoryBetweenInterpretedAndCompiled() {
+(function testMemoryGrowBetweenInterpretedAndCompiled() {
   // grow_memory can be called from interpreted or compiled code, and changes
   // should be reflected in either execution.
   var builder = new WasmModuleBuilder();
-  var grow_body = [kExprGetLocal, 0, kExprGrowMemory, kMemoryZero];
+  var grow_body = [kExprGetLocal, 0, kExprMemoryGrow, kMemoryZero];
   var load_body = [kExprGetLocal, 0, kExprI32LoadMem, 0, 0];
   var store_body = [kExprGetLocal, 0, kExprGetLocal, 1, kExprI32StoreMem, 0, 0];
   builder.addFunction('grow_memory', kSig_i_i).addBody(grow_body).exportFunc();
@@ -185,11 +184,35 @@
       checkStack(stripPath(e.stack), [
         'Error: i=8',                                                // -
         /^    at imp \(file:\d+:29\)$/,                              // -
-        '    at plus_one (wasm-function[1]:6)',                      // -
-        '    at plus_two (wasm-function[1]:3)',                      // -
+        '    at plus_one (wasm-function[1]:0x3b)',                   // -
+        '    at plus_two (wasm-function[1]:0x3e)',                   // -
         /^    at testStackTraceThroughCWasmEntry \(file:\d+:25\)$/,  // -
         /^    at file:\d+:3$/
       ]);
     }
   }
 })();
+
+(function testInterpreterPreservedOnTierUp() {
+  print(arguments.callee.name);
+  var builder = new WasmModuleBuilder();
+  var fun_body = [kExprI32Const, 23];
+  var fun = builder.addFunction('fun', kSig_i_v).addBody(fun_body).exportFunc();
+  var instance = builder.instantiate();
+  var exp = instance.exports;
+
+  // Initially the interpreter is not being called.
+  var initial_interpreted = %WasmNumInterpretedCalls(instance);
+  assertEquals(23, exp.fun());
+  assertEquals(initial_interpreted + 0, %WasmNumInterpretedCalls(instance));
+
+  // Redirection will cause the interpreter to be called.
+  %RedirectToWasmInterpreter(instance, fun.index);
+  assertEquals(23, exp.fun());
+  assertEquals(initial_interpreted + 1, %WasmNumInterpretedCalls(instance));
+
+  // Requesting a tier-up still ensure the interpreter is being called.
+  %WasmTierUpFunction(instance, fun.index);
+  assertEquals(23, exp.fun());
+  assertEquals(initial_interpreted + 2, %WasmNumInterpretedCalls(instance));
+})();
diff --git a/src/v8/test/mjsunit/wasm/interpreter.js b/src/v8/test/mjsunit/wasm/interpreter.js
index f5697eb..c1c03a4 100644
--- a/src/v8/test/mjsunit/wasm/interpreter.js
+++ b/src/v8/test/mjsunit/wasm/interpreter.js
@@ -4,7 +4,6 @@
 
 // Flags: --wasm-interpret-all --allow-natives-syntax --expose-gc
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 // The stack trace contains file path, only keep "interpreter.js".
@@ -40,7 +39,7 @@
     checkStack(stripPath(stack), [
       'Error: test imported stack',                           // -
       /^    at func \(interpreter.js:\d+:28\)$/,              // -
-      '    at main (wasm-function[1]:1)',                     // -
+      '    at main (wasm-function[1]:0x32)',                  // -
       /^    at testCallImported \(interpreter.js:\d+:22\)$/,  // -
       /^    at interpreter.js:\d+:3$/
     ]);
@@ -104,8 +103,8 @@
     assertEquals(interpreted_before + 2, %WasmNumInterpretedCalls(instance));
     checkStack(stripPath(stack), [
       'RuntimeError: unreachable',                    // -
-      '    at foo (wasm-function[0]:3)',              // -
-      '    at main (wasm-function[1]:2)',             // -
+      '    at foo (wasm-function[0]:0x27)',           // -
+      '    at main (wasm-function[1]:0x2c)',          // -
       /^    at testTrap \(interpreter.js:\d+:24\)$/,  // -
       /^    at interpreter.js:\d+:3$/
     ]);
@@ -137,7 +136,7 @@
     checkStack(stripPath(stack), [
       'Error: thrown from imported function',                    // -
       /^    at func \(interpreter.js:\d+:11\)$/,                 // -
-      '    at main (wasm-function[1]:1)',                        // -
+      '    at main (wasm-function[1]:0x32)',                     // -
       /^    at testThrowFromImport \(interpreter.js:\d+:24\)$/,  // -
       /^    at interpreter.js:\d+:3$/
     ]);
@@ -219,10 +218,10 @@
     for (var e = 0; e < stacks.length; ++e) {
       expected = ['Error: reentrant interpreter test #' + e];
       expected.push(/^    at func \(interpreter.js:\d+:17\)$/);
-      expected.push('    at main (wasm-function[1]:3)');
+      expected.push('    at main (wasm-function[1]:0x36)');
       for (var k = e; k > 0; --k) {
         expected.push(/^    at func \(interpreter.js:\d+:33\)$/);
-        expected.push('    at main (wasm-function[1]:3)');
+        expected.push('    at main (wasm-function[1]:0x36)');
       }
       expected.push(
           /^    at testReentrantInterpreter \(interpreter.js:\d+:22\)$/);
@@ -296,9 +295,9 @@
   } catch (e) {
     if (!(e instanceof TypeError)) throw e;
     checkStack(stripPath(e.stack), [
-      'TypeError: invalid type',                                // -
-      '    at direct (wasm-function[1]:1)',                     // -
-      '    at main (wasm-function[3]:3)',                       // -
+      'TypeError: ' + kTrapMsgs[kTrapTypeError],                // -
+      '    at direct (wasm-function[1]:0x55)',                  // -
+      '    at main (wasm-function[3]:0x64)',                    // -
       /^    at testIllegalImports \(interpreter.js:\d+:22\)$/,  // -
       /^    at interpreter.js:\d+:3$/
     ]);
@@ -309,15 +308,40 @@
   } catch (e) {
     if (!(e instanceof TypeError)) throw e;
     checkStack(stripPath(e.stack), [
-      'TypeError: invalid type',                                // -
-      '    at indirect (wasm-function[2]:1)',                   // -
-      '    at main (wasm-function[3]:3)',                       // -
+      'TypeError: ' + kTrapMsgs[kTrapTypeError],                // -
+      '    at indirect (wasm-function[2]:0x5c)',                // -
+      '    at main (wasm-function[3]:0x64)',                    // -
       /^    at testIllegalImports \(interpreter.js:\d+:22\)$/,  // -
       /^    at interpreter.js:\d+:3$/
     ]);
   }
 })();
 
+(function testImportExportedFunction() {
+  // See https://crbug.com/860392.
+  print(arguments.callee.name);
+  let instance0 = (() => {
+    let builder = new WasmModuleBuilder();
+    builder.addFunction('f11', kSig_i_v).addBody(wasmI32Const(11)).exportFunc();
+    builder.addFunction('f17', kSig_i_v).addBody(wasmI32Const(17)).exportFunc();
+    return builder.instantiate();
+  })();
+
+  let builder = new WasmModuleBuilder();
+  let sig_i_v = builder.addType(kSig_i_v);
+  let f11_imp = builder.addImport('q', 'f11', sig_i_v);
+  let f17_imp = builder.addImport('q', 'f17', sig_i_v);
+  let add = builder.addFunction('add', sig_i_v).addBody([
+    kExprCallFunction, f11_imp,  // call f11
+    kExprCallFunction, f17_imp,  // call f17
+    kExprI32Add                  // i32.add
+  ]).exportFunc();
+  let instance = builder.instantiate(
+      {q: {f11: instance0.exports.f11, f17: instance0.exports.f17}});
+
+  assertEquals(28, instance.exports.add());
+})();
+
 (function testInfiniteRecursion() {
   print(arguments.callee.name);
   var builder = new WasmModuleBuilder();
@@ -334,8 +358,8 @@
     if (!(e instanceof RangeError)) throw e;
     checkStack(stripPath(e.stack), [
       'RangeError: Maximum call stack size exceeded',
-      '    at main (wasm-function[0]:0)'
-    ].concat(Array(9).fill('    at main (wasm-function[0]:2)')));
+      '    at main (wasm-function[0]:0x20)'
+    ].concat(Array(9).fill('    at main (wasm-function[0]:0x22)')));
   }
 })();
 
@@ -493,3 +517,53 @@
   tab.set(0, instance1.exports.exp);
   instance2.exports.call2();
 })();
+
+(function testTableCall3() {
+  // See crbug.com/814562.
+  print(arguments.callee.name);
+  const builder0 = new WasmModuleBuilder();
+  const sig_index = builder0.addType(kSig_i_v);
+  builder0.addFunction('main', kSig_i_i)
+      .addBody([
+        kExprGetLocal, 0,  // --
+        kExprCallIndirect, sig_index, kTableZero
+      ])  // --
+      .exportAs('main');
+  builder0.setTableBounds(3, 3);
+  builder0.addExportOfKind('table', kExternalTable);
+  const module0 = new WebAssembly.Module(builder0.toBuffer());
+  const instance0 = new WebAssembly.Instance(module0);
+
+  const builder1 = new WasmModuleBuilder();
+  builder1.addFunction('main', kSig_i_v).addBody([kExprUnreachable]);
+  builder1.addImportedTable('z', 'table');
+  builder1.addElementSegment(0, 0, false, [0]);
+  const module1 = new WebAssembly.Module(builder1.toBuffer());
+  const instance1 =
+      new WebAssembly.Instance(module1, {z: {table: instance0.exports.table}});
+  assertThrows(
+      () => instance0.exports.main(0), WebAssembly.RuntimeError, 'unreachable');
+})();
+
+(function testSerializeInterpreted() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  builder.addFunction('main', kSig_i_i)
+      .addBody([kExprGetLocal, 0, kExprI32Const, 7, kExprI32Add])
+      .exportFunc();
+
+  const wire_bytes = builder.toBuffer();
+  var module = new WebAssembly.Module(wire_bytes);
+  const i1 = new WebAssembly.Instance(module);
+
+  assertEquals(11, i1.exports.main(4));
+
+  const buff = %SerializeWasmModule(module);
+  module = null;
+  gc();
+
+  module = %DeserializeWasmModule(buff, wire_bytes);
+  const i2 = new WebAssembly.Instance(module);
+
+  assertEquals(11, i2.exports.main(4));
+})();
diff --git a/src/v8/test/mjsunit/wasm/js-api.js b/src/v8/test/mjsunit/wasm/js-api.js
index f27fa7a..031f2e0 100644
--- a/src/v8/test/mjsunit/wasm/js-api.js
+++ b/src/v8/test/mjsunit/wasm/js-api.js
@@ -2,19 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-wasm --allow-natives-syntax
+// Flags: --expose-wasm
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
-function unexpectedSuccess() {
-  %AbortJS('unexpected success');
-}
-
-function unexpectedFail(error) {
-  %AbortJS('unexpected fail: ' + error);
-}
-
 function assertEq(val, expected) {
   assertSame(expected, val);
 }
@@ -26,13 +17,6 @@
     assertEq(expected[i], input[i]);
   }
 }
-function wasmIsSupported() {
-  return (typeof WebAssembly.Module) == 'function';
-}
-function assertErrorMessage(func, type, msg) {
-  // TODO   assertThrows(func, type, msg);
-  assertThrows(func, type);
-}
 
 let emptyModuleBinary = (() => {
   var builder = new WasmModuleBuilder();
@@ -147,25 +131,25 @@
 assertEq(Module, moduleDesc.value);
 assertEq(Module.length, 1);
 assertEq(Module.name, 'Module');
-assertErrorMessage(
-    () => Module(), TypeError, /constructor without new is forbidden/);
-assertErrorMessage(
-    () => new Module(), TypeError, /requires more than 0 arguments/);
-assertErrorMessage(
+assertThrows(
+    () => Module(), TypeError, /must be invoked with 'new'/);
+assertThrows(
+    () => new Module(), TypeError, /Argument 0 must be a buffer source/);
+assertThrows(
     () => new Module(undefined), TypeError,
-    'first argument must be an ArrayBuffer or typed array object');
-assertErrorMessage(
+    'WebAssembly.Module(): Argument 0 must be a buffer source');
+assertThrows(
     () => new Module(1), TypeError,
-    'first argument must be an ArrayBuffer or typed array object');
-assertErrorMessage(
+    'WebAssembly.Module(): Argument 0 must be a buffer source');
+assertThrows(
     () => new Module({}), TypeError,
-    'first argument must be an ArrayBuffer or typed array object');
-assertErrorMessage(
+    'WebAssembly.Module(): Argument 0 must be a buffer source');
+assertThrows(
     () => new Module(new Uint8Array()), CompileError,
-    /failed to match magic number/);
-assertErrorMessage(
+    /BufferSource argument is empty/);
+assertThrows(
     () => new Module(new ArrayBuffer()), CompileError,
-    /failed to match magic number/);
+    /BufferSource argument is empty/);
 assertTrue(new Module(emptyModuleBinary) instanceof Module);
 assertTrue(new Module(emptyModuleBinary.buffer) instanceof Module);
 
@@ -194,20 +178,20 @@
 let moduleImportsDesc = Object.getOwnPropertyDescriptor(Module, 'imports');
 assertEq(typeof moduleImportsDesc.value, 'function');
 assertTrue(moduleImportsDesc.writable);
-assertFalse(moduleImportsDesc.enumerable);
+assertTrue(moduleImportsDesc.enumerable);
 assertTrue(moduleImportsDesc.configurable);
 
 // 'WebAssembly.Module.imports' method
 let moduleImports = moduleImportsDesc.value;
 assertEq(moduleImports.length, 1);
-assertErrorMessage(
-    () => moduleImports(), TypeError, /requires more than 0 arguments/);
-assertErrorMessage(
+assertThrows(
+    () => moduleImports(), TypeError, /Argument 0 must be a WebAssembly.Module/);
+assertThrows(
     () => moduleImports(undefined), TypeError,
-    /first argument must be a WebAssembly.Module/);
-assertErrorMessage(
+    /Argument 0 must be a WebAssembly.Module/);
+assertThrows(
     () => moduleImports({}), TypeError,
-    /first argument must be a WebAssembly.Module/);
+    /Argument 0 must be a WebAssembly.Module/);
 var arr = moduleImports(new Module(emptyModuleBinary));
 assertTrue(arr instanceof Array);
 assertEq(arr.length, 0);
@@ -241,20 +225,20 @@
 let moduleExportsDesc = Object.getOwnPropertyDescriptor(Module, 'exports');
 assertEq(typeof moduleExportsDesc.value, 'function');
 assertTrue(moduleExportsDesc.writable);
-assertFalse(moduleExportsDesc.enumerable);
+assertTrue(moduleExportsDesc.enumerable);
 assertTrue(moduleExportsDesc.configurable);
 
 // 'WebAssembly.Module.exports' method
 let moduleExports = moduleExportsDesc.value;
 assertEq(moduleExports.length, 1);
-assertErrorMessage(
-    () => moduleExports(), TypeError, /requires more than 0 arguments/);
-assertErrorMessage(
+assertThrows(
+    () => moduleExports(), TypeError, /Argument 0 must be a WebAssembly.Module/);
+assertThrows(
     () => moduleExports(undefined), TypeError,
-    /first argument must be a WebAssembly.Module/);
-assertErrorMessage(
+    /Argument 0 must be a WebAssembly.Module/);
+assertThrows(
     () => moduleExports({}), TypeError,
-    /first argument must be a WebAssembly.Module/);
+    /Argument 0 must be a WebAssembly.Module/);
 var arr = moduleExports(emptyModule);
 assertTrue(arr instanceof Array);
 assertEq(arr.length, 0);
@@ -265,7 +249,7 @@
   builder.addFunction('foo', kSig_v_v).addBody([]).exportAs('a');
   builder.addMemory(1, 1, false);
   builder.exportMemoryAs('b');
-  builder.setFunctionTableBounds(1, 1);
+  builder.setTableBounds(1, 1);
   builder.addExportOfKind('c', kExternalTable, 0);
   var o = builder.addGlobal(kWasmI32, false).exportAs('x');
   return new Int8Array(builder.toBuffer());
@@ -286,27 +270,27 @@
 let moduleCustomSectionsDesc =
     Object.getOwnPropertyDescriptor(Module, 'customSections');
 assertEq(typeof moduleCustomSectionsDesc.value, 'function');
-assertEq(moduleCustomSectionsDesc.writable, true);
-assertEq(moduleCustomSectionsDesc.enumerable, false);
-assertEq(moduleCustomSectionsDesc.configurable, true);
+assertTrue(moduleCustomSectionsDesc.writable);
+assertTrue(moduleCustomSectionsDesc.enumerable);
+assertTrue(moduleCustomSectionsDesc.configurable);
 
 let moduleCustomSections = moduleCustomSectionsDesc.value;
 assertEq(moduleCustomSections.length, 2);
-assertErrorMessage(
-    () => moduleCustomSections(), TypeError, /requires more than 0 arguments/);
-assertErrorMessage(
+assertThrows(
+    () => moduleCustomSections(), TypeError, /Argument 0 must be a WebAssembly.Module/);
+assertThrows(
     () => moduleCustomSections(undefined), TypeError,
-    /first argument must be a WebAssembly.Module/);
-assertErrorMessage(
+    /Argument 0 must be a WebAssembly.Module/);
+assertThrows(
     () => moduleCustomSections({}), TypeError,
-    /first argument must be a WebAssembly.Module/);
+    /Argument 0 must be a WebAssembly.Module/);
 var arr = moduleCustomSections(emptyModule, 'x');
 assertEq(arr instanceof Array, true);
 assertEq(arr.length, 0);
 
-assertErrorMessage(
+assertThrows(
     () => moduleCustomSections(1), TypeError,
-    'first argument must be a WebAssembly.Module');
+    'WebAssembly.Module.customSections(): Argument 0 must be a WebAssembly.Module');
 
 let customSectionModuleBinary2 = (() => {
   let builder = new WasmModuleBuilder();
@@ -351,24 +335,24 @@
 assertEq(Instance.length, 1);
 assertEq(Instance.name, 'Instance');
 
-assertErrorMessage(
-    () => Instance(), TypeError, /constructor without new is forbidden/);
-assertErrorMessage(
+assertThrows(
+    () => Instance(), TypeError, /must be invoked with 'new'/);
+assertThrows(
     () => new Instance(1), TypeError,
-    'first argument must be a WebAssembly.Module');
-assertErrorMessage(
+    'WebAssembly.Instance(): Argument 0 must be a WebAssembly.Module');
+assertThrows(
     () => new Instance({}), TypeError,
-    'first argument must be a WebAssembly.Module');
-assertErrorMessage(
+    'WebAssembly.Instance(): Argument 0 must be a WebAssembly.Module');
+assertThrows(
     () => new Instance(emptyModule, null), TypeError,
-    'second argument must be an object');
-assertErrorMessage(() => new Instance(importingModule, null), TypeError, '');
-assertErrorMessage(
-    () => new Instance(importingModule, undefined), TypeError, '');
-assertErrorMessage(
-    () => new Instance(importingModule, {'': {g: () => {}}}), LinkError, '');
-assertErrorMessage(
-    () => new Instance(importingModule, {t: {f: () => {}}}), TypeError, '');
+    'WebAssembly.Instance(): Argument 1 must be an object');
+assertThrows(() => new Instance(importingModule, null), TypeError);
+assertThrows(
+    () => new Instance(importingModule, undefined), TypeError);
+assertThrows(
+    () => new Instance(importingModule, {'': {g: () => {}}}), LinkError);
+assertThrows(
+    () => new Instance(importingModule, {t: {f: () => {}}}), TypeError);
 
 assertTrue(new Instance(emptyModule) instanceof Instance);
 assertTrue(new Instance(emptyModule, {}) instanceof Instance);
@@ -397,7 +381,7 @@
     Object.getOwnPropertyDescriptor(instanceProto, 'exports');
 assertEq(typeof instanceExportsDesc.get, 'function');
 assertEq(instanceExportsDesc.set, undefined);
-assertFalse(instanceExportsDesc.enumerable);
+assertTrue(instanceExportsDesc.enumerable);
 assertTrue(instanceExportsDesc.configurable);
 
 exportsObj = exportingInstance.exports;
@@ -412,7 +396,7 @@
 assertEq(f.length, 0);
 assertTrue('name' in f);
 assertEq(Function.prototype.call.call(f), 42);
-assertErrorMessage(() => new f(), TypeError, /is not a constructor/);
+assertThrows(() => new f(), TypeError, /is not a constructor/);
 
 // 'WebAssembly.Memory' data property
 let memoryDesc = Object.getOwnPropertyDescriptor(WebAssembly, 'Memory');
@@ -426,27 +410,27 @@
 assertEq(Memory, memoryDesc.value);
 assertEq(Memory.length, 1);
 assertEq(Memory.name, 'Memory');
-assertErrorMessage(
-    () => Memory(), TypeError, /constructor without new is forbidden/);
-assertErrorMessage(
+assertThrows(
+    () => Memory(), TypeError, /must be invoked with 'new'/);
+assertThrows(
     () => new Memory(1), TypeError,
-    'first argument must be a memory descriptor');
-assertErrorMessage(
+    'WebAssembly.Memory(): Argument 0 must be a memory descriptor');
+assertThrows(
     () => new Memory({initial: {valueOf() { throw new Error('here') }}}), Error,
     'here');
-assertErrorMessage(
-    () => new Memory({initial: -1}), RangeError, /bad Memory initial size/);
-assertErrorMessage(
-    () => new Memory({initial: Math.pow(2, 32)}), RangeError,
-    /bad Memory initial size/);
-assertErrorMessage(
+assertThrows(
+    () => new Memory({initial: -1}), TypeError, /must be non-negative/);
+assertThrows(
+    () => new Memory({initial: Math.pow(2, 32)}), TypeError,
+    /must be in the unsigned long range/);
+assertThrows(
     () => new Memory({initial: 1, maximum: Math.pow(2, 32) / Math.pow(2, 14)}),
-    RangeError, /bad Memory maximum size/);
-assertErrorMessage(
+    RangeError, /is above the upper bound/);
+assertThrows(
     () => new Memory({initial: 2, maximum: 1}), RangeError,
-    /bad Memory maximum size/);
-assertErrorMessage(
-    () => new Memory({maximum: -1}), RangeError, /bad Memory maximum size/);
+    /is below the lower bound/);
+assertThrows(
+    () => new Memory({maximum: -1}), TypeError, /'initial' is required/);
 assertTrue(new Memory({initial: 1}) instanceof Memory);
 assertEq(new Memory({initial: 1.5}).buffer.byteLength, kPageSize);
 
@@ -473,37 +457,37 @@
 let bufferDesc = Object.getOwnPropertyDescriptor(memoryProto, 'buffer');
 assertEq(typeof bufferDesc.get, 'function');
 assertEq(bufferDesc.set, undefined);
-assertFalse(bufferDesc.enumerable);
+assertTrue(bufferDesc.enumerable);
 assertTrue(bufferDesc.configurable);
 
 // 'WebAssembly.Memory.prototype.buffer' getter
 let bufferGetter = bufferDesc.get;
-assertErrorMessage(
-    () => bufferGetter.call(), TypeError, /called on incompatible undefined/);
-assertErrorMessage(
-    () => bufferGetter.call({}), TypeError, /called on incompatible Object/);
+assertThrows(
+    () => bufferGetter.call(), TypeError, /Receiver is not a WebAssembly.Memory/);
+assertThrows(
+    () => bufferGetter.call({}), TypeError, /Receiver is not a WebAssembly.Memory/);
 assertTrue(bufferGetter.call(mem1) instanceof ArrayBuffer);
 assertEq(bufferGetter.call(mem1).byteLength, kPageSize);
 
 // 'WebAssembly.Memory.prototype.grow' data property
 let memGrowDesc = Object.getOwnPropertyDescriptor(memoryProto, 'grow');
 assertEq(typeof memGrowDesc.value, 'function');
-assertFalse(memGrowDesc.enumerable);
+assertTrue(memGrowDesc.enumerable);
 assertTrue(memGrowDesc.configurable);
 
 // 'WebAssembly.Memory.prototype.grow' method
 
 let memGrow = memGrowDesc.value;
 assertEq(memGrow.length, 1);
-assertErrorMessage(
-    () => memGrow.call(), TypeError, /called on incompatible undefined/);
-assertErrorMessage(
-    () => memGrow.call({}), TypeError, /called on incompatible Object/);
-assertErrorMessage(
-    () => memGrow.call(mem1, -1), RangeError, /bad Memory grow delta/);
-assertErrorMessage(
-    () => memGrow.call(mem1, Math.pow(2, 32)), RangeError,
-    /bad Memory grow delta/);
+assertThrows(
+    () => memGrow.call(), TypeError, /Receiver is not a WebAssembly.Memory/);
+assertThrows(
+    () => memGrow.call({}), TypeError, /Receiver is not a WebAssembly.Memory/);
+assertThrows(
+    () => memGrow.call(mem1, -1), TypeError, /must be non-negative/);
+assertThrows(
+    () => memGrow.call(mem1, Math.pow(2, 32)), TypeError,
+    /must be in the unsigned long range/);
 var mem = new Memory({initial: 1, maximum: 2});
 var buf = mem.buffer;
 assertEq(buf.byteLength, kPageSize);
@@ -517,21 +501,21 @@
 assertEq(buf.byteLength, 0);
 buf = mem.buffer;
 assertEq(buf.byteLength, 2 * kPageSize);
-assertEq(mem.grow(), 2);
+assertEq(mem.grow(0), 2);
 assertTrue(buf !== mem.buffer);
 assertEq(buf.byteLength, 0);
 buf = mem.buffer;
 assertEq(buf.byteLength, 2 * kPageSize);
-assertErrorMessage(() => mem.grow(1), Error, /failed to grow memory/);
-assertErrorMessage(() => mem.grow(Infinity), Error, /failed to grow memory/);
-assertErrorMessage(() => mem.grow(-Infinity), Error, /failed to grow memory/);
+assertThrows(() => mem.grow(1), Error, /Maximum memory size exceeded/);
+assertThrows(() => mem.grow(Infinity), Error, /must be convertible to a valid number/);
+assertThrows(() => mem.grow(-Infinity), Error, /must be convertible to a valid number/);
 assertEq(buf, mem.buffer);
 let throwOnValueOf = {
   valueOf: function() {
     throw Error('throwOnValueOf')
   }
 };
-assertErrorMessage(() => mem.grow(throwOnValueOf), Error, /throwOnValueOf/);
+assertThrows(() => mem.grow(throwOnValueOf), Error, /throwOnValueOf/);
 assertEq(buf, mem.buffer);
 let zero_wrapper = {
   valueOf: function() {
@@ -566,41 +550,41 @@
 assertEq(Table, tableDesc.value);
 assertEq(Table.length, 1);
 assertEq(Table.name, 'Table');
-assertErrorMessage(
-    () => Table(), TypeError, /constructor without new is forbidden/);
-assertErrorMessage(
-    () => new Table(1), TypeError, 'first argument must be a table descriptor');
-assertErrorMessage(
-    () => new Table({initial: 1, element: 1}), TypeError, /must be "anyfunc"/);
-assertErrorMessage(
+assertThrows(
+    () => Table(), TypeError, /must be invoked with 'new'/);
+assertThrows(
+    () => new Table(1), TypeError, 'WebAssembly.Module(): Argument 0 must be a table descriptor');
+assertThrows(
+    () => new Table({initial: 1, element: 1}), TypeError, /must be 'anyfunc'/);
+assertThrows(
     () => new Table({initial: 1, element: 'any'}), TypeError,
-    /must be "anyfunc"/);
-assertErrorMessage(
+    /must be 'anyfunc'/);
+assertThrows(
     () => new Table({initial: 1, element: {valueOf() { return 'anyfunc' }}}),
-    TypeError, /must be "anyfunc"/);
-assertErrorMessage(
+    TypeError, /must be 'anyfunc'/);
+assertThrows(
     () => new Table(
         {initial: {valueOf() { throw new Error('here') }}, element: 'anyfunc'}),
     Error, 'here');
-assertErrorMessage(
-    () => new Table({initial: -1, element: 'anyfunc'}), RangeError,
-    /bad Table initial size/);
-assertErrorMessage(
-    () => new Table({initial: Math.pow(2, 32), element: 'anyfunc'}), RangeError,
-    /bad Table initial size/);
-assertErrorMessage(
+assertThrows(
+    () => new Table({initial: -1, element: 'anyfunc'}), TypeError,
+    /must be non-negative/);
+assertThrows(
+    () => new Table({initial: Math.pow(2, 32), element: 'anyfunc'}), TypeError,
+    /must be in the unsigned long range/);
+assertThrows(
     () => new Table({initial: 2, maximum: 1, element: 'anyfunc'}), RangeError,
-    /bad Table maximum size/);
-assertErrorMessage(
+    /is below the lower bound/);
+assertThrows(
     () => new Table({initial: 2, maximum: Math.pow(2, 32), element: 'anyfunc'}),
-    RangeError, /bad Table maximum size/);
+    TypeError, /must be in the unsigned long range/);
 assertTrue(new Table({initial: 1, element: 'anyfunc'}) instanceof Table);
 assertTrue(new Table({initial: 1.5, element: 'anyfunc'}) instanceof Table);
 assertTrue(
     new Table({initial: 1, maximum: 1.5, element: 'anyfunc'}) instanceof Table);
-assertTrue(
-    new Table({initial: 1, maximum: Math.pow(2, 32) - 1, element: 'anyfunc'})
-        instanceof Table);
+assertThrows(
+    () => new Table({initial: 1, maximum: Math.pow(2, 32) - 1, element: 'anyfunc'}),
+    RangeError, /above the upper bound/);
 
 // 'WebAssembly.Table.prototype' data property
 let tableProtoDesc = Object.getOwnPropertyDescriptor(Table, 'prototype');
@@ -625,135 +609,140 @@
 let lengthDesc = Object.getOwnPropertyDescriptor(tableProto, 'length');
 assertEq(typeof lengthDesc.get, 'function');
 assertEq(lengthDesc.set, undefined);
-assertFalse(lengthDesc.enumerable);
+assertTrue(lengthDesc.enumerable);
 assertTrue(lengthDesc.configurable);
 
 // 'WebAssembly.Table.prototype.length' getter
 let lengthGetter = lengthDesc.get;
 assertEq(lengthGetter.length, 0);
-assertErrorMessage(
-    () => lengthGetter.call(), TypeError, /called on incompatible undefined/);
-assertErrorMessage(
-    () => lengthGetter.call({}), TypeError, /called on incompatible Object/);
+assertThrows(
+    () => lengthGetter.call(), TypeError, /Receiver is not a WebAssembly.Table/);
+assertThrows(
+    () => lengthGetter.call({}), TypeError, /Receiver is not a WebAssembly.Table/);
 assertEq(typeof lengthGetter.call(tbl1), 'number');
 assertEq(lengthGetter.call(tbl1), 2);
 
 // 'WebAssembly.Table.prototype.get' data property
 let getDesc = Object.getOwnPropertyDescriptor(tableProto, 'get');
 assertEq(typeof getDesc.value, 'function');
-assertFalse(getDesc.enumerable);
+assertTrue(getDesc.enumerable);
 assertTrue(getDesc.configurable);
 
 // 'WebAssembly.Table.prototype.get' method
 let get = getDesc.value;
 assertEq(get.length, 1);
-assertErrorMessage(
-    () => get.call(), TypeError, /called on incompatible undefined/);
-assertErrorMessage(
-    () => get.call({}), TypeError, /called on incompatible Object/);
-assertEq(get.call(tbl1), null);
+assertThrows(
+    () => get.call(), TypeError, /Receiver is not a WebAssembly.Table/);
+assertThrows(
+    () => get.call({}), TypeError, /Receiver is not a WebAssembly.Table/);
+assertThrows(
+    () => get.call(tbl1), TypeError, /must be convertible to a valid number/);
 assertEq(get.call(tbl1, 0), null);
 assertEq(get.call(tbl1, 0, Infinity), null);
 assertEq(get.call(tbl1, 1), null);
 assertEq(get.call(tbl1, 1.5), null);
-assertErrorMessage(() => get.call(tbl1, 2), RangeError, /bad Table get index/);
-assertErrorMessage(
-    () => get.call(tbl1, 2.5), RangeError, /bad Table get index/);
-assertErrorMessage(() => get.call(tbl1, -1), RangeError, /bad Table get index/);
-assertErrorMessage(
-    () => get.call(tbl1, Math.pow(2, 33)), RangeError, /bad Table get index/);
-assertErrorMessage(
+assertThrows(() => get.call(tbl1, 2), RangeError, /invalid index \d+ into function table/);
+assertThrows(
+    () => get.call(tbl1, 2.5), RangeError, /invalid index \d+ into function table/);
+assertThrows(() => get.call(tbl1, -1), TypeError, /must be non-negative/);
+assertThrows(
+    () => get.call(tbl1, Math.pow(2, 33)), TypeError,
+  /must be in the unsigned long range/);
+assertThrows(
     () => get.call(tbl1, {valueOf() { throw new Error('hi') }}), Error, 'hi');
 
 // 'WebAssembly.Table.prototype.set' data property
 let setDesc = Object.getOwnPropertyDescriptor(tableProto, 'set');
 assertEq(typeof setDesc.value, 'function');
-assertFalse(setDesc.enumerable);
+assertTrue(setDesc.enumerable);
 assertTrue(setDesc.configurable);
 
 // 'WebAssembly.Table.prototype.set' method
 let set = setDesc.value;
 assertEq(set.length, 2);
-assertErrorMessage(
-    () => set.call(), TypeError, /called on incompatible undefined/);
-assertErrorMessage(
-    () => set.call({}), TypeError, /called on incompatible Object/);
-assertErrorMessage(
-    () => set.call(tbl1, 0), TypeError, /requires more than 1 argument/);
-assertErrorMessage(
+assertThrows(
+    () => set.call(), TypeError, /Receiver is not a WebAssembly.Table/);
+assertThrows(
+    () => set.call({}), TypeError, /Receiver is not a WebAssembly.Table/);
+assertThrows(
+    () => set.call(tbl1, 0), TypeError, /must be null or a WebAssembly function/);
+assertThrows(
     () => set.call(tbl1, undefined), TypeError,
-    /requires more than 1 argument/);
-assertErrorMessage(
-    () => set.call(tbl1, 2, null), RangeError, /bad Table set index/);
-assertErrorMessage(
-    () => set.call(tbl1, -1, null), RangeError, /bad Table set index/);
-assertErrorMessage(
-    () => set.call(tbl1, Math.pow(2, 33), null), RangeError,
-    /bad Table set index/);
-assertErrorMessage(
-    () => set.call(tbl1, Infinity, null), RangeError, /bad Table set index/);
-assertErrorMessage(
-    () => set.call(tbl1, -Infinity, null), RangeError, /bad Table set index/);
-assertErrorMessage(
+    /must be convertible to a valid number/);
+assertThrows(
+    () => set.call(tbl1, 2, null), RangeError, /invalid index \d+ into function table/);
+assertThrows(
+    () => set.call(tbl1, -1, null), TypeError, /must be non-negative/);
+assertThrows(
+    () => set.call(tbl1, Math.pow(2, 33), null), TypeError,
+    /must be in the unsigned long range/);
+assertThrows(
+    () => set.call(tbl1, Infinity, null), TypeError,
+  /must be convertible to a valid number/);
+assertThrows(
+    () => set.call(tbl1, -Infinity, null), TypeError,
+  /must be convertible to a valid number/);
+assertThrows(
     () => set.call(tbl1, 0, undefined), TypeError,
-    /can only assign WebAssembly exported functions to Table/);
-assertErrorMessage(
+    /must be null or a WebAssembly function/);
+assertThrows(
     () => set.call(tbl1, undefined, undefined), TypeError,
-    /can only assign WebAssembly exported functions to Table/);
-assertErrorMessage(
+    /must be convertible to a valid number/);
+assertThrows(
     () => set.call(tbl1, 0, {}), TypeError,
-    /can only assign WebAssembly exported functions to Table/);
-assertErrorMessage(() => set.call(tbl1, 0, function() {
-}), TypeError, /can only assign WebAssembly exported functions to Table/);
-assertErrorMessage(
+    /must be null or a WebAssembly function/);
+assertThrows(() => set.call(tbl1, 0, function() {
+}), TypeError, /must be null or a WebAssembly function/);
+assertThrows(
     () => set.call(tbl1, 0, Math.sin), TypeError,
-    /can only assign WebAssembly exported functions to Table/);
-assertErrorMessage(
+    /must be null or a WebAssembly function/);
+assertThrows(
     () => set.call(tbl1, {valueOf() { throw Error('hai') }}, null), Error,
     'hai');
 assertEq(set.call(tbl1, 0, null), undefined);
 assertEq(set.call(tbl1, 1, null), undefined);
-assertEq(set.call(tbl1, undefined, null), undefined);
+assertThrows(
+    () => set.call(tbl1, undefined, null), TypeError,
+    /must be convertible to a valid number/);
 
 // 'WebAssembly.Table.prototype.grow' data property
 let tblGrowDesc = Object.getOwnPropertyDescriptor(tableProto, 'grow');
 assertEq(typeof tblGrowDesc.value, 'function');
-assertFalse(tblGrowDesc.enumerable);
+assertTrue(tblGrowDesc.enumerable);
 assertTrue(tblGrowDesc.configurable);
 
 // 'WebAssembly.Table.prototype.grow' method
 let tblGrow = tblGrowDesc.value;
 assertEq(tblGrow.length, 1);
-assertErrorMessage(
-    () => tblGrow.call(), TypeError, /called on incompatible undefined/);
-assertErrorMessage(
-    () => tblGrow.call({}), TypeError, /called on incompatible Object/);
-assertErrorMessage(
-    () => tblGrow.call(tbl1, -1), RangeError, /bad Table grow delta/);
-assertErrorMessage(
-    () => tblGrow.call(tbl1, Math.pow(2, 32)), RangeError,
-    /bad Table grow delta/);
+assertThrows(
+    () => tblGrow.call(), TypeError, /Receiver is not a WebAssembly.Table/);
+assertThrows(
+    () => tblGrow.call({}), TypeError, /Receiver is not a WebAssembly.Table/);
+assertThrows(
+    () => tblGrow.call(tbl1, -1), TypeError, /must be non-negative/);
+assertThrows(
+    () => tblGrow.call(tbl1, Math.pow(2, 32)), TypeError,
+    /must be in the unsigned long range/);
 var tbl = new Table({element: 'anyfunc', initial: 1, maximum: 2});
 assertEq(tbl.length, 1);
-assertErrorMessage(
-    () => tbl.grow(Infinity), RangeError, /failed to grow table/);
-assertErrorMessage(
-    () => tbl.grow(-Infinity), RangeError, /failed to grow table/);
+assertThrows(
+    () => tbl.grow(Infinity), TypeError, /must be convertible to a valid number/);
+assertThrows(
+    () => tbl.grow(-Infinity), TypeError, /must be convertible to a valid number/);
 assertEq(tbl.grow(0), 1);
 assertEq(tbl.length, 1);
 assertEq(tbl.grow(1, 4), 1);
 assertEq(tbl.length, 2);
-assertEq(tbl.grow(), 2);
 assertEq(tbl.length, 2);
-assertErrorMessage(() => tbl.grow(1), Error, /failed to grow table/);
-assertErrorMessage(
-    () => tbl.grow(Infinity), RangeError, /failed to grow table/);
-assertErrorMessage(
-    () => tbl.grow(-Infinity), RangeError, /failed to grow table/);
+assertThrows(() => tbl.grow(1), Error, /failed to grow table by \d+/);
+assertThrows(
+    () => tbl.grow(Infinity), TypeError, /must be convertible to a valid number/);
+assertThrows(
+    () => tbl.grow(-Infinity), TypeError, /must be convertible to a valid number/);
 
 // 'WebAssembly.validate' function
-assertErrorMessage(() => WebAssembly.validate(), TypeError);
-assertErrorMessage(() => WebAssembly.validate('hi'), TypeError);
+assertThrows(() => WebAssembly.validate(), TypeError);
+assertThrows(() => WebAssembly.validate('hi'), TypeError);
 assertTrue(WebAssembly.validate(emptyModuleBinary));
 // TODO: other ways for validate to return false.
 assertFalse(WebAssembly.validate(moduleBinaryImporting2Memories));
@@ -763,7 +752,7 @@
 let compileDesc = Object.getOwnPropertyDescriptor(WebAssembly, 'compile');
 assertEq(typeof compileDesc.value, 'function');
 assertTrue(compileDesc.writable);
-assertFalse(compileDesc.enumerable);
+assertTrue(compileDesc.enumerable);
 assertTrue(compileDesc.configurable);
 
 // 'WebAssembly.compile' function
@@ -772,22 +761,18 @@
 assertEq(compile.length, 1);
 assertEq(compile.name, 'compile');
 function assertCompileError(args, err, msg) {
-  var error = null;
-  assertPromiseResult(compile(...args), unexpectedSuccess, error => {
-    assertTrue(error instanceof err);
-    // TODO  assertTrue(Boolean(error.message.match(msg)));
-  });
+  assertThrowsAsync(compile(...args), err /* TODO , msg */);
 }
 assertCompileError([], TypeError, /requires more than 0 arguments/);
 assertCompileError(
     [undefined], TypeError,
-    /first argument must be an ArrayBuffer or typed array object/);
+    /Argument 0 must be a buffer source/);
 assertCompileError(
     [1], TypeError,
-    /first argument must be an ArrayBuffer or typed array object/);
+    /Argument 0 must be a buffer source/);
 assertCompileError(
     [{}], TypeError,
-    /first argument must be an ArrayBuffer or typed array object/);
+    /Argument 0 must be a buffer source/);
 assertCompileError(
     [new Uint8Array()], CompileError, /BufferSource argument is empty/);
 assertCompileError(
@@ -809,7 +794,7 @@
     Object.getOwnPropertyDescriptor(WebAssembly, 'instantiate');
 assertEq(typeof instantiateDesc.value, 'function');
 assertTrue(instantiateDesc.writable);
-assertFalse(instantiateDesc.enumerable);
+assertTrue(instantiateDesc.enumerable);
 assertTrue(instantiateDesc.configurable);
 
 // 'WebAssembly.instantiate' function
@@ -818,13 +803,9 @@
 assertEq(instantiate.length, 1);
 assertEq(instantiate.name, 'instantiate');
 function assertInstantiateError(args, err, msg) {
-  var error = null;
-  assertPromiseResult(instantiate(...args), unexpectedSuccess, error => {
-    assertTrue(error instanceof err);
-    // TODO assertTrue(Boolean(error.message.match(msg)));
-  });
+  assertThrowsAsync(instantiate(...args), err /* TODO , msg */);
 }
-var scratch_memory = new WebAssembly.Memory(new ArrayBuffer(10));
+var scratch_memory = new WebAssembly.Memory({ initial: 0 });
 assertInstantiateError([], TypeError, /requires more than 0 arguments/);
 assertInstantiateError(
     [undefined], TypeError, /first argument must be a BufferSource/);
@@ -925,3 +906,10 @@
   var instance = new WebAssembly.Instance(module);
   assertTrue(instance instanceof Instance);
 })();
+
+(function TestPassBigIntInGlobalWhenNotEnabled() {
+  assertThrows(() => new WebAssembly.Global({ value: "i64" }, 1), TypeError,
+               /Can't set the value/);
+  assertThrows(() => new WebAssembly.Global({ value: "i64" }, 1n), TypeError,
+               /Can't set the value/);
+})();
diff --git a/src/v8/test/mjsunit/wasm/large-offset.js b/src/v8/test/mjsunit/wasm/large-offset.js
index 7c45897..919891a 100644
--- a/src/v8/test/mjsunit/wasm/large-offset.js
+++ b/src/v8/test/mjsunit/wasm/large-offset.js
@@ -2,18 +2,17 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
-function testGrowMemoryOutOfBoundsOffset() {
-  print("testGrowMemoryOutOfBoundsOffset2");
+function testMemoryGrowOutOfBoundsOffset() {
+  print("testMemoryGrowOutOfBoundsOffset2");
   var builder = new WasmModuleBuilder();
   builder.addMemory(16, 128, false);
   builder.addFunction("main", kSig_v_v)
       .addBody([
           kExprI32Const, 20,
           kExprI32Const, 29,
-          kExprGrowMemory, kMemoryZero,
+          kExprMemoryGrow, kMemoryZero,
           // Assembly equivalent Move <reg>,0xf5fffff
           // with wasm memory reference relocation information
           kExprI32StoreMem, 0, 0xFF, 0xFF, 0xFF, 0x7A
@@ -23,4 +22,4 @@
   assertTraps(kTrapMemOutOfBounds, module.exports.main);
 }
 
-testGrowMemoryOutOfBoundsOffset();
+testMemoryGrowOutOfBoundsOffset();
diff --git a/src/v8/test/mjsunit/wasm/lazy-compilation.js b/src/v8/test/mjsunit/wasm/lazy-compilation.js
index fc41fbd..c7cd40d 100644
--- a/src/v8/test/mjsunit/wasm/lazy-compilation.js
+++ b/src/v8/test/mjsunit/wasm/lazy-compilation.js
@@ -4,7 +4,6 @@
 
 // Flags: --wasm-lazy-compilation --allow-natives-syntax
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 (function importFromOtherInstance() {
diff --git a/src/v8/test/mjsunit/wasm/liftoff-trap-handler.js b/src/v8/test/mjsunit/wasm/liftoff-trap-handler.js
new file mode 100644
index 0000000..3ce7481
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/liftoff-trap-handler.js
@@ -0,0 +1,27 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --liftoff --wasm-trap-handler
+
+// A simple test to make sure Liftoff can compile memory operations with trap
+// handlers enabled.
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+function testCompileLoadStore() {
+  const builder = new WasmModuleBuilder();
+  // These functions generate statically out of bounds accesses.
+  builder.addFunction("load", kSig_i_i)
+      .addBody([kExprGetLocal, 0, kExprI32LoadMem, 0, 0x80, 0x80, 0x80, 1])
+      .exportFunc();
+  builder.addFunction("store", kSig_i_ii)
+      .addBody([kExprGetLocal, 0,
+                kExprGetLocal, 1,
+                kExprI32StoreMem, 0, 0x80, 0x80, 0x80, 1,
+                kExprGetLocal, 1])
+      .exportFunc();
+  builder.addMemory(1, 1, false);
+  const instance = builder.instantiate();
+}
+testCompileLoadStore();
diff --git a/src/v8/test/mjsunit/wasm/liftoff.js b/src/v8/test/mjsunit/wasm/liftoff.js
index b65f83f..51b3087 100644
--- a/src/v8/test/mjsunit/wasm/liftoff.js
+++ b/src/v8/test/mjsunit/wasm/liftoff.js
@@ -2,11 +2,26 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --liftoff --wasm-async-compilation
+// Flags: --allow-natives-syntax --liftoff --no-future --no-wasm-tier-up
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
+(function testLiftoffFlag() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  builder.addFunction('i32_add', kSig_i_ii)
+      .addBody([kExprGetLocal, 0, kExprGetLocal, 1, kExprI32Add])
+      .exportFunc();
+
+  const module = new WebAssembly.Module(builder.toBuffer());
+  const instance = new WebAssembly.Instance(module);
+  const instance2 = new WebAssembly.Instance(module);
+
+  assertEquals(%IsLiftoffFunction(instance.exports.i32_add),
+               %IsLiftoffFunction(instance2.exports.i32_add));
+})();
+
+
 (function testLiftoffSync() {
   print(arguments.callee.name);
   const builder = new WasmModuleBuilder();
diff --git a/src/v8/test/mjsunit/wasm/loop-rotation.js b/src/v8/test/mjsunit/wasm/loop-rotation.js
new file mode 100644
index 0000000..92ad1f3
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/loop-rotation.js
@@ -0,0 +1,76 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --turbo-loop-rotation --noliftoff --nowasm-tier-up
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function TestTrivialLoop1() {
+  print(arguments.callee.name);
+  var builder = new WasmModuleBuilder();
+  builder.addFunction("main", kSig_v_i)
+    .addBody([
+      kExprLoop, kWasmStmt,
+        kExprGetLocal, 0,
+        kExprI32Const, 1,
+        kExprI32Sub,
+        kExprTeeLocal, 0,
+        kExprBrIf, 0,
+      kExprEnd,
+    ])
+    .exportFunc();
+  let module = new WebAssembly.Module(builder.toBuffer());
+  let instance = new WebAssembly.Instance(module);
+  instance.exports.main(1);
+  instance.exports.main(10);
+  instance.exports.main(100);
+})();
+
+(function TestTrivialLoop2() {
+  print(arguments.callee.name);
+  var builder = new WasmModuleBuilder();
+  builder.addFunction("main", kSig_v_i)
+    .addBody([
+      kExprLoop, kWasmStmt,
+        kExprGetLocal, 0,
+        kExprI32Const, 1,
+        kExprI32Sub,
+        kExprTeeLocal, 0,
+        kExprBrIf, 1,
+        kExprBr, 0,
+      kExprEnd,
+    ])
+    .exportFunc();
+  let module = new WebAssembly.Module(builder.toBuffer());
+  let instance = new WebAssembly.Instance(module);
+  instance.exports.main(1);
+  instance.exports.main(10);
+  instance.exports.main(100);
+})();
+
+(function TestNonRotatedLoopWithStore() {
+  print(arguments.callee.name);
+  var builder = new WasmModuleBuilder();
+  builder.addMemory(1, undefined, false);
+  builder.addFunction("main", kSig_v_i)
+    .addBody([
+      kExprLoop, kWasmStmt,
+        kExprGetLocal, 0,
+        kExprI32Const, 1,
+        kExprI32Sub,
+        kExprTeeLocal, 0,
+      kExprBrIf, 1,
+        kExprI32Const, 0,
+        kExprI32Const, 0,
+        kExprI32StoreMem, 0, 0,
+        kExprBr, 0,
+      kExprEnd,
+    ])
+    .exportFunc();
+  let module = new WebAssembly.Module(builder.toBuffer());
+  let instance = new WebAssembly.Instance(module);
+  instance.exports.main(1);
+  instance.exports.main(10);
+  instance.exports.main(100);
+})();
diff --git a/src/v8/test/mjsunit/wasm/many-parameters.js b/src/v8/test/mjsunit/wasm/many-parameters.js
index a56619a..46b2319 100644
--- a/src/v8/test/mjsunit/wasm/many-parameters.js
+++ b/src/v8/test/mjsunit/wasm/many-parameters.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 let types = [kWasmI32, kWasmF32, kWasmF64];
diff --git a/src/v8/test/mjsunit/wasm/memory-external-call.js b/src/v8/test/mjsunit/wasm/memory-external-call.js
index 2af5888..853cdf6 100644
--- a/src/v8/test/mjsunit/wasm/memory-external-call.js
+++ b/src/v8/test/mjsunit/wasm/memory-external-call.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 let initialMemoryPages = 1;
diff --git a/src/v8/test/mjsunit/wasm/memory-instance-validation.js b/src/v8/test/mjsunit/wasm/memory-instance-validation.js
index 9828cd2..ef65840 100644
--- a/src/v8/test/mjsunit/wasm/memory-instance-validation.js
+++ b/src/v8/test/mjsunit/wasm/memory-instance-validation.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm --expose-gc
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 // This test verifies that when instances are exported, Gc'ed, the other
@@ -18,7 +17,7 @@
     .addBody([kExprMemorySize, kMemoryZero])
     .exportFunc();
   builder.addFunction("grow", kSig_i_i)
-    .addBody([kExprGetLocal, 0, kExprGrowMemory, kMemoryZero])
+    .addBody([kExprGetLocal, 0, kExprMemoryGrow, kMemoryZero])
     .exportFunc();
   var instances = [];
   for (var i = 0; i < 5; i++) {
diff --git a/src/v8/test/mjsunit/wasm/memory-size.js b/src/v8/test/mjsunit/wasm/memory-size.js
index 0c96efb..b83a424 100644
--- a/src/v8/test/mjsunit/wasm/memory-size.js
+++ b/src/v8/test/mjsunit/wasm/memory-size.js
@@ -4,11 +4,13 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
+var kV8MaxWasmMemoryPages = 32767;  // ~ 2 GiB
+var kSpecMaxWasmMemoryPages = 65536;  // 4 GiB
+
 (function testMemorySizeZero() {
-  print("testMemorySizeZero()");
+  print(arguments.callee.name);
   var builder = new WasmModuleBuilder();
   builder.addMemory(0, 0, false);
   builder.addFunction("memory_size", kSig_i_v)
@@ -19,7 +21,7 @@
 })();
 
 (function testMemorySizeNonZero() {
-  print("testMemorySizeNonZero()");
+  print(arguments.callee.name);
   var builder = new WasmModuleBuilder();
   var size = 11;
   builder.addMemory(size, size, false);
@@ -29,3 +31,42 @@
   var module = builder.instantiate();
   assertEquals(size, module.exports.memory_size());
 })();
+
+(function testMemorySizeSpecMaxOk() {
+  print(arguments.callee.name);
+  var builder = new WasmModuleBuilder();
+  builder.addMemory(1, kSpecMaxWasmMemoryPages, true);
+  builder.addFunction("memory_size", kSig_i_v)
+         .addBody([kExprMemorySize, kMemoryZero])
+         .exportFunc();
+  var module = builder.instantiate();
+  assertEquals(1, module.exports.memory_size());
+})();
+
+(function testMemorySizeV8MaxPlus1Throws() {
+  print(arguments.callee.name);
+  var builder = new WasmModuleBuilder();
+  builder.addMemory(kV8MaxWasmMemoryPages + 1,
+                    kV8MaxWasmMemoryPages + 1, false);
+  builder.addFunction("memory_size", kSig_i_v)
+         .addBody([kExprMemorySize, kMemoryZero])
+         .exportFunc();
+  assertThrows(() => builder.instantiate());
+})();
+
+(function testMemorySpecMaxOk() {
+  print(arguments.callee.name);
+  var builder = new WasmModuleBuilder();
+  builder.addMemory(1, kSpecMaxWasmMemoryPages, false);
+  builder.addFunction("memory_size", kSig_i_v)
+         .addBody([kExprMemorySize, kMemoryZero])
+    .exportFunc();
+  var module = builder.instantiate();
+  assertEquals(1, module.exports.memory_size());
+})();
+
+(function testMemoryInitialMaxPlus1Throws() {
+  print(arguments.callee.name);
+  assertThrows(() => new WebAssembly.Memory(
+      {initial: kV8WasmMaxMemoryPages + 1}));
+})();
diff --git a/src/v8/test/mjsunit/wasm/memory.js b/src/v8/test/mjsunit/wasm/memory.js
index fbf4b18..f266dd4 100644
--- a/src/v8/test/mjsunit/wasm/memory.js
+++ b/src/v8/test/mjsunit/wasm/memory.js
@@ -4,7 +4,7 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
 
 // Basic tests.
 
@@ -29,11 +29,11 @@
   assertThrows(() => new WebAssembly.Memory(1), TypeError);
   assertThrows(() => new WebAssembly.Memory(""), TypeError);
 
-  assertThrows(() => new WebAssembly.Memory({initial: -1}), RangeError);
-  assertThrows(() => new WebAssembly.Memory({initial: outOfUint32RangeValue}), RangeError);
+  assertThrows(() => new WebAssembly.Memory({initial: -1}), TypeError);
+  assertThrows(() => new WebAssembly.Memory({initial: outOfUint32RangeValue}), TypeError);
 
-  assertThrows(() => new WebAssembly.Memory({initial: 10, maximum: -1}), RangeError);
-  assertThrows(() => new WebAssembly.Memory({initial: 10, maximum: outOfUint32RangeValue}), RangeError);
+  assertThrows(() => new WebAssembly.Memory({initial: 10, maximum: -1}), TypeError);
+  assertThrows(() => new WebAssembly.Memory({initial: 10, maximum: outOfUint32RangeValue}), TypeError);
   assertThrows(() => new WebAssembly.Memory({initial: 10, maximum: 9}), RangeError);
 
   let memory = new WebAssembly.Memory({initial: 1});
@@ -45,12 +45,6 @@
   assertMemoryIsValid(memory);
 })();
 
-(function TestInitialIsUndefined() {
-  // New memory with initial = undefined, which means initial = 0.
-  let memory = new WebAssembly.Memory({initial: undefined});
-  assertMemoryIsValid(memory);
-})();
-
 (function TestMaximumIsUndefined() {
   // New memory with maximum = undefined, which means maximum = 0.
   let memory = new WebAssembly.Memory({initial: 0, maximum: undefined});
@@ -74,7 +68,7 @@
   assertMemoryIsValid(memory);
 })();
 
-(function TestMaximumDoesHasProperty() {
+(function TestMaximumDoesNotHasProperty() {
   var hasPropertyWasCalled = false;
   var desc = {initial: 10};
   var proxy = new Proxy({maximum: 16}, {
@@ -83,7 +77,7 @@
   Object.setPrototypeOf(desc, proxy);
   let memory = new WebAssembly.Memory(desc);
   assertMemoryIsValid(memory);
-  assertTrue(hasPropertyWasCalled);
+  assertFalse(hasPropertyWasCalled);
 })();
 
 (function TestBuffer() {
diff --git a/src/v8/test/mjsunit/wasm/memory_1gb_oob.js b/src/v8/test/mjsunit/wasm/memory_1gb_oob.js
new file mode 100644
index 0000000..f2b22d9
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/memory_1gb_oob.js
@@ -0,0 +1,98 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-max-mem-pages=16384
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const k1MiB = 1 * 1024 * 1024;
+const k1GiB = 1 * 1024 * 1024 * 1024;
+const k2GiB = 2 * k1GiB;
+const k3GiB = 3 * k1GiB;
+const k4GiB = 4 * k1GiB;
+const kMaxMemory = k1GiB;
+
+// Indexes (and offsets) used to systematically probe the memory.
+const indexes = (() => {
+  const a = k1GiB, b = k2GiB, c = k3GiB, d = k4GiB;
+  return [
+    0,   1,   2,   3,   4,   5,   7,   8,   9,            // near 0
+  a-8, a-4, a+0, a+1, a+2, a+3, a+4, a+5, a+7, a+8, a+9,  // near 1GiB
+  b-8, b-4, b+0, b+1, b+2, b+3, b+4, b+5, b+7, b+8, b+9,  // near 2GiB
+  c-8, c-4, c+0, c+1, c+2, c+3, c+4, c+5, c+7, c+8, c+9,  // near 3GiB
+  d-9, d-8, d-7, d-5, d-4, d-3, d-2, d-1                  // near 4GiB
+];
+})();
+
+(function Test() {
+  var memory;
+
+  function BuildAccessors(type, load_opcode, store_opcode, offset) {
+    builder = new WasmModuleBuilder();
+    builder.addImportedMemory("i", "mem");
+    const h = 0x80;
+    const m = 0x7f;
+    let offset_bytes = [h|((offset >>> 0) & m),  // LEB encoding of offset
+                        h|((offset >>> 7) & m),
+                        h|((offset >>> 14) & m),
+                        h|((offset >>> 21) & m),
+                        0|((offset >>> 28) & m)];
+    builder.addFunction("load", makeSig([kWasmI32], [type]))
+      .addBody([                         // --
+        kExprGetLocal, 0,                // --
+        load_opcode, 0, ...offset_bytes, // --
+      ])                                 // --
+      .exportFunc();
+    builder.addFunction("store", makeSig([kWasmI32, type], []))
+      .addBody([                           // --
+        kExprGetLocal, 0,                  // --
+        kExprGetLocal, 1,                  // --
+        store_opcode, 0, ...offset_bytes,  // --
+      ])                                   // --
+      .exportFunc();
+    let i = builder.instantiate({i: {mem: memory}});
+    return {offset: offset, load: i.exports.load, store: i.exports.store};
+  }
+
+  function probe(a, size, offset, f) {
+    print(`size=${size} offset=${offset}`);
+    for (let i of indexes) {
+      let oob = (i + size + offset) > kMaxMemory;
+      if (oob) {
+//        print(`  ${i} + ${offset} OOB`);
+        assertThrows(() => a.store(i, f(i)));
+        assertThrows(() => a.load(i));
+      } else {
+//        print(`  ${i} = ${f(i)}`);
+        a.store(i, f(i));
+        assertEquals(f(i), a.load(i));
+      }
+    }
+  }
+
+  try {
+    const kPages = kMaxMemory / kPageSize;
+    memory = new WebAssembly.Memory({initial: kPages, maximum: kPages});
+  } catch (e) {
+    print("OOM: sorry, best effort max memory size test.");
+    return;
+  }
+
+  assertEquals(kMaxMemory, memory.buffer.byteLength);
+
+  for (let offset of indexes) {
+    let a = BuildAccessors(kWasmI32, kExprI32LoadMem, kExprI32StoreMem, offset);
+    probe(a, 4, offset, i => (0xaabbccee ^ ((i >> 11) * 0x110005)) | 0);
+  }
+
+  for (let offset of indexes) {
+    let a = BuildAccessors(kWasmI32, kExprI32LoadMem8U, kExprI32StoreMem8, offset);
+    probe(a, 1, offset, i => (0xee ^ ((i >> 11) * 0x05)) & 0xFF);
+  }
+
+  for (let offset of indexes) {
+    let a = BuildAccessors(kWasmF64, kExprF64LoadMem, kExprF64StoreMem, offset);
+    probe(a, 8, offset, i => 0xaabbccee ^ ((i >> 11) * 0x110005));
+  }
+})();
diff --git a/src/v8/test/mjsunit/wasm/memory_2gb_oob.js b/src/v8/test/mjsunit/wasm/memory_2gb_oob.js
new file mode 100644
index 0000000..6baf0f3
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/memory_2gb_oob.js
@@ -0,0 +1,98 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-max-mem-pages=32768
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const k1MiB = 1 * 1024 * 1024;
+const k1GiB = 1 * 1024 * 1024 * 1024;
+const k2GiB = 2 * k1GiB;
+const k3GiB = 3 * k1GiB;
+const k4GiB = 4 * k1GiB;
+const kMaxMemory = k2GiB;
+
+// Indexes (and offsets) used to systematically probe the memory.
+const indexes = (() => {
+  const a = k1GiB, b = k2GiB, c = k3GiB, d = k4GiB;
+  return [
+    0,   1,   2,   3,   4,   5,   7,   8,   9,            // near 0
+  a-8, a-4, a+0, a+1, a+2, a+3, a+4, a+5, a+7, a+8, a+9,  // near 1GiB
+  b-8, b-4, b+0, b+1, b+2, b+3, b+4, b+5, b+7, b+8, b+9,  // near 2GiB
+  c-8, c-4, c+0, c+1, c+2, c+3, c+4, c+5, c+7, c+8, c+9,  // near 3GiB
+  d-9, d-8, d-7, d-5, d-4, d-3, d-2, d-1                  // near 4GiB
+];
+})();
+
+(function Test() {
+  var memory;
+
+  function BuildAccessors(type, load_opcode, store_opcode, offset) {
+    builder = new WasmModuleBuilder();
+    builder.addImportedMemory("i", "mem");
+    const h = 0x80;
+    const m = 0x7f;
+    let offset_bytes = [h|((offset >>> 0) & m),  // LEB encoding of offset
+                        h|((offset >>> 7) & m),
+                        h|((offset >>> 14) & m),
+                        h|((offset >>> 21) & m),
+                        0|((offset >>> 28) & m)];
+    builder.addFunction("load", makeSig([kWasmI32], [type]))
+      .addBody([                         // --
+        kExprGetLocal, 0,                // --
+        load_opcode, 0, ...offset_bytes, // --
+      ])                                 // --
+      .exportFunc();
+    builder.addFunction("store", makeSig([kWasmI32, type], []))
+      .addBody([                           // --
+        kExprGetLocal, 0,                  // --
+        kExprGetLocal, 1,                  // --
+        store_opcode, 0, ...offset_bytes,  // --
+      ])                                   // --
+      .exportFunc();
+    let i = builder.instantiate({i: {mem: memory}});
+    return {offset: offset, load: i.exports.load, store: i.exports.store};
+  }
+
+  function probe(a, size, offset, f) {
+    print(`size=${size} offset=${offset}`);
+    for (let i of indexes) {
+      let oob = (i + size + offset) > kMaxMemory;
+      if (oob) {
+//        print(`  ${i} + ${offset} OOB`);
+        assertThrows(() => a.store(i, f(i)));
+        assertThrows(() => a.load(i));
+      } else {
+//        print(`  ${i} = ${f(i)}`);
+        a.store(i, f(i));
+        assertEquals(f(i), a.load(i));
+      }
+    }
+  }
+
+  try {
+    let kPages = kMaxMemory / kPageSize;
+    memory = new WebAssembly.Memory({initial: kPages, maximum: kPages});
+  } catch (e) {
+    print("OOM: sorry, best effort max memory size test.");
+    return;
+  }
+
+  assertEquals(kMaxMemory, memory.buffer.byteLength);
+
+  for (let offset of indexes) {
+    let a = BuildAccessors(kWasmI32, kExprI32LoadMem, kExprI32StoreMem, offset);
+    probe(a, 4, offset, i => (0xaabbccee ^ ((i >> 11) * 0x110005)) | 0);
+  }
+
+  for (let offset of indexes) {
+    let a = BuildAccessors(kWasmI32, kExprI32LoadMem8U, kExprI32StoreMem8, offset);
+    probe(a, 1, offset, i => (0xee ^ ((i >> 11) * 0x05)) & 0xFF);
+  }
+
+  for (let offset of indexes) {
+    let a = BuildAccessors(kWasmF64, kExprF64LoadMem, kExprF64StoreMem, offset);
+    probe(a, 8, offset, i => 0xaabbccee ^ ((i >> 11) * 0x110005));
+  }
+})();
diff --git a/src/v8/test/mjsunit/wasm/memory_4gb_oob.js b/src/v8/test/mjsunit/wasm/memory_4gb_oob.js
new file mode 100644
index 0000000..39b9f95
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/memory_4gb_oob.js
@@ -0,0 +1,96 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const k1MiB = 1 * 1024 * 1024;
+const k1GiB = 1 * 1024 * 1024 * 1024;
+const k2GiB = 2 * k1GiB;
+const k3GiB = 3 * k1GiB;
+const k4GiB = 4 * k1GiB;
+const kMaxMemory = k4GiB;
+
+// Indexes (and offsets) used to systematically probe the memory.
+const indexes = (() => {
+  const a = k1GiB, b = k2GiB, c = k3GiB, d = k4GiB;
+  return [
+    0,   1,   2,   3,   4,   5,   7,   8,   9,            // near 0
+  a-8, a-4, a+0, a+1, a+2, a+3, a+4, a+5, a+7, a+8, a+9,  // near 1GiB
+  b-8, b-4, b+0, b+1, b+2, b+3, b+4, b+5, b+7, b+8, b+9,  // near 2GiB
+  c-8, c-4, c+0, c+1, c+2, c+3, c+4, c+5, c+7, c+8, c+9,  // near 3GiB
+  d-9, d-8, d-7, d-5, d-4, d-3, d-2, d-1                  // near 4GiB
+];
+})();
+
+(function Test() {
+  var memory;
+
+  function BuildAccessors(type, load_opcode, store_opcode, offset) {
+    builder = new WasmModuleBuilder();
+    builder.addImportedMemory("i", "mem");
+    const h = 0x80;
+    const m = 0x7f;
+    let offset_bytes = [h|((offset >>> 0) & m),  // LEB encoding of offset
+                        h|((offset >>> 7) & m),
+                        h|((offset >>> 14) & m),
+                        h|((offset >>> 21) & m),
+                        0|((offset >>> 28) & m)];
+    builder.addFunction("load", makeSig([kWasmI32], [type]))
+      .addBody([                         // --
+        kExprGetLocal, 0,                // --
+        load_opcode, 0, ...offset_bytes, // --
+      ])                                 // --
+      .exportFunc();
+    builder.addFunction("store", makeSig([kWasmI32, type], []))
+      .addBody([                           // --
+        kExprGetLocal, 0,                  // --
+        kExprGetLocal, 1,                  // --
+        store_opcode, 0, ...offset_bytes,  // --
+      ])                                   // --
+      .exportFunc();
+    let i = builder.instantiate({i: {mem: memory}});
+    return {offset: offset, load: i.exports.load, store: i.exports.store};
+  }
+
+  function probe(a, size, offset, f) {
+    print(`size=${size} offset=${offset}`);
+    for (let i of indexes) {
+      let oob = (i + size + offset) > kMaxMemory;
+      if (oob) {
+//        print(`  ${i} + ${offset} OOB`);
+        assertThrows(() => a.store(i, f(i)));
+        assertThrows(() => a.load(i));
+      } else {
+//        print(`  ${i} = ${f(i)}`);
+        a.store(i, f(i));
+        assertEquals(f(i), a.load(i));
+      }
+    }
+  }
+
+  try {
+    let kPages = kMaxMemory / kPageSize;
+    memory = new WebAssembly.Memory({initial: kPages, maximum: kPages});
+  } catch (e) {
+    print("OOM: sorry, best effort max memory size test.");
+    return;
+  }
+
+  assertEquals(kMaxMemory, memory.buffer.byteLength);
+
+  for (let offset of indexes) {
+    let a = BuildAccessors(kWasmI32, kExprI32LoadMem, kExprI32StoreMem, offset);
+    probe(a, 4, offset, i => (0xaabbccee ^ ((i >> 11) * 0x110005)) | 0);
+  }
+
+  for (let offset of indexes) {
+    let a = BuildAccessors(kWasmI32, kExprI32LoadMem8U, kExprI32StoreMem8, offset);
+    probe(a, 1, offset, i => (0xee ^ ((i >> 11) * 0x05)) & 0xFF);
+  }
+
+  for (let offset of indexes) {
+    let a = BuildAccessors(kWasmF64, kExprF64LoadMem, kExprF64StoreMem, offset);
+    probe(a, 8, offset, i => 0xaabbccee ^ ((i >> 11) * 0x110005));
+  }
+})();
diff --git a/src/v8/test/mjsunit/wasm/module-memory.js b/src/v8/test/mjsunit/wasm/module-memory.js
index e9d2bb9..3dd580d 100644
--- a/src/v8/test/mjsunit/wasm/module-memory.js
+++ b/src/v8/test/mjsunit/wasm/module-memory.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm --expose-gc --stress-compaction --allow-natives-syntax
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 var kMemSize = 65536;
@@ -160,13 +159,15 @@
     assertEquals(0, write());
   }
 
-
+  // Note that this test might be run concurrently in multiple Isolates, which
+  // makes an exact comparison of the expected trap count unreliable. But is is
+  // still possible to check the lower bound for the expected trap count.
   for (offset = 65534; offset < 66536; offset++) {
     const trap_count = %GetWasmRecoveredTrapCount();
     assertTraps(kTrapMemOutOfBounds, read);
     assertTraps(kTrapMemOutOfBounds, write);
     if (%IsWasmTrapHandlerEnabled()) {
-      assertEquals(trap_count + 2, %GetWasmRecoveredTrapCount());
+      assertTrue(trap_count + 2 <= %GetWasmRecoveredTrapCount());
     }
   }
 }
@@ -174,22 +175,25 @@
 testOOBThrows();
 
 function testAddressSpaceLimit() {
-  // 1TiB, see wasm-memory.h
-  const kMaxAddressSpace = 1 * 1024 * 1024 * 1024 * 1024;
-  const kAddressSpacePerMemory = 8 * 1024 * 1024 * 1024;
+  // 1TiB + 4 GiB, see wasm-memory.h
+  const kMaxAddressSpace = 1 * 1024 * 1024 * 1024 * 1024
+                         + 4 * 1024 * 1024 * 1024;
+  const kAddressSpacePerMemory = 10 * 1024 * 1024 * 1024;
 
+  let last_memory;
   try {
     let memories = [];
     let address_space = 0;
     while (address_space <= kMaxAddressSpace + 1) {
-      memories.push(new WebAssembly.Memory({initial: 1}));
+      last_memory = new WebAssembly.Memory({initial: 1})
+      memories.push(last_memory);
       address_space += kAddressSpacePerMemory;
     }
   } catch (e) {
     assertTrue(e instanceof RangeError);
     return;
   }
-  failWithMessage("allocated too much memory");
+  assertUnreachable("should have reached the address space limit");
 }
 
 if(%IsWasmTrapHandlerEnabled()) {
diff --git a/src/v8/test/mjsunit/wasm/multi-table-element-section.js b/src/v8/test/mjsunit/wasm/multi-table-element-section.js
new file mode 100644
index 0000000..59a21ef
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/multi-table-element-section.js
@@ -0,0 +1,98 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --experimental-wasm-anyref
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function TestInitMultipleTables() {
+  print(arguments.callee.name);
+
+  const value1 = 11;
+  const value2 = 22;
+  const value3 = 46;
+  const value4 = 57;
+  const value5 = 13;
+
+  // The offsets for the initialization of tables. The segement for table2 should
+  // overlap with the segment of table1, because table2 is actually the imported
+  // table1.
+  const offset1 = 2;
+  const offset2 = offset1 + 1;
+  const offset3 = 4;
+  const offset4 = 1;
+
+  const instance_for_import = (function () {
+    const builder_for_import = new WasmModuleBuilder();
+    const t1 = builder_for_import.addTable(kWasmAnyFunc, 15, 15)
+      .exportAs("table").index;
+    const f1 = builder_for_import.addFunction('f1', kSig_i_v)
+      .addBody([kExprI32Const, value1]).index;
+    const f2 = builder_for_import.addFunction('f2', kSig_i_v)
+      .addBody([kExprI32Const, value2]).index;
+
+    builder_for_import.addElementSegment(t1, offset1, false, [f1, f2]);
+    const instance_for_import = builder_for_import.instantiate();
+    const table1 = instance_for_import.exports.table;
+    assertEquals(value1, table1.get(offset1)());
+    assertEquals(value2, table1.get(offset1 + 1)());
+    return instance_for_import;
+  })();
+
+  const builder = new WasmModuleBuilder();
+
+  const t2 = builder.addImportedTable("exports", "table", 15, 15);
+  builder.addExportOfKind("table2", kExternalTable, t2);
+  const t3 = builder.addTable(kWasmAnyFunc, 10).exportAs("table3").index;
+  const t4 = builder.addTable(kWasmAnyFunc, 12).exportAs("table4").index;
+
+  const f3 = builder.addFunction('f3', kSig_i_v)
+    .addBody([kExprI32Const, value3]).index;
+  const f4 = builder.addFunction('f4', kSig_i_v)
+    .addBody([kExprI32Const, value4]).index;
+  const f5 = builder.addFunction('f5', kSig_i_v)
+    .addBody([kExprI32Const, value5]).index;
+
+
+  builder.addElementSegment(t2, offset2, false, [f3, f4]);
+  builder.addElementSegment(t3, offset3, false, [f5, f4]);
+  builder.addElementSegment(t4, offset4, false, [f3, f5]);
+  // Add one more overlapping offset
+  builder.addElementSegment(t4, offset4 + 1, false, [f4, f3]);
+
+  const instance = builder.instantiate(instance_for_import);
+  // table2 == table1
+  const table2 = instance.exports.table2;
+  const table3 = instance.exports.table3;
+  const table4 = instance.exports.table4;
+  // table1 == table2
+  assertEquals(value1, table2.get(offset1)());
+  assertEquals(value3, table2.get(offset2)());
+  assertEquals(value4, table2.get(offset2 + 1)());
+
+  assertEquals(value5, table3.get(offset3)());
+  assertEquals(value4, table3.get(offset3 + 1)());
+
+  assertEquals(value3, table4.get(offset4)());
+  assertEquals(value4, table4.get(offset4 + 1)());
+  assertEquals(value3, table4.get(offset4 + 2)());
+})();
+
+(function TestAnyRefTableWithAnyFuncInit() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  const table = builder.addTable(kWasmAnyRef, 5).index;
+  builder.addExportOfKind("table", kExternalTable, table);
+  const f1 = builder.addFunction('f1', kSig_i_v)
+                    .addBody([kExprI32Const, 11])
+                    .exportFunc().index;
+  const f2 = builder.addFunction('f2', kSig_i_v)
+                    .addBody([kExprI32Const, 22])
+                    .exportFunc().index;
+
+  builder.addElementSegment(table, 1, false, [f1, f2]);
+  const instance = builder.instantiate();
+  assertEquals(instance.exports.table.get(1)(), 11);
+  assertEquals(instance.exports.table.get(2)(), 22);
+})();
diff --git a/src/v8/test/mjsunit/wasm/multi-value.js b/src/v8/test/mjsunit/wasm/multi-value.js
index d6eff16..1948801 100644
--- a/src/v8/test/mjsunit/wasm/multi-value.js
+++ b/src/v8/test/mjsunit/wasm/multi-value.js
@@ -4,7 +4,6 @@
 
 // Flags: --experimental-wasm-mv
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 (function MultiBlockResultTest() {
diff --git a/src/v8/test/mjsunit/wasm/mutable-globals.js b/src/v8/test/mjsunit/wasm/mutable-globals.js
new file mode 100644
index 0000000..261da56
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/mutable-globals.js
@@ -0,0 +1,329 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function assertGlobalIsValid(global) {
+  assertSame(WebAssembly.Global.prototype, global.__proto__);
+  assertSame(WebAssembly.Global, global.constructor);
+  assertTrue(global instanceof Object);
+  assertTrue(global instanceof WebAssembly.Global);
+}
+
+(function TestConstructor() {
+
+  assertTrue(WebAssembly.Global instanceof Function);
+  assertSame(WebAssembly.Global, WebAssembly.Global.prototype.constructor);
+
+  assertThrows(() => new WebAssembly.Global(), TypeError);
+  assertThrows(() => new WebAssembly.Global(1), TypeError);
+  assertThrows(() => new WebAssembly.Global(""), TypeError);
+
+  assertThrows(() => new WebAssembly.Global({}), TypeError);
+  assertThrows(() => new WebAssembly.Global({value: 'foo'}), TypeError);
+  assertThrows(() => new WebAssembly.Global({value: 'i128'}), TypeError);
+  // Without --experimental-wasm-anyref, globals of type {anyref} and {anyfunc}
+  // are not allowed.
+  assertThrows(() => new WebAssembly.Global({value: 'anyref'}), TypeError);
+  assertThrows(() => new WebAssembly.Global({value: 'anyfunc'}), TypeError);
+
+  for (let type of ['i32', 'f32', 'f64', 'i64']) {
+    assertGlobalIsValid(new WebAssembly.Global({value: type}));
+  }
+})();
+
+// Copied from //src/v8/test/cctest/compiler/value-helper.h
+const u32_values = [
+  0x00000000, 0x00000001, 0xFFFFFFFF, 0x1B09788B, 0x04C5FCE8, 0xCC0DE5BF,
+  // This row is useful for testing lea optimizations on intel.
+  0x00000002, 0x00000003, 0x00000004, 0x00000005, 0x00000008, 0x00000009,
+  0x273A798E, 0x187937A3, 0xECE3AF83, 0x5495A16B, 0x0B668ECC, 0x11223344,
+  0x0000009E, 0x00000043, 0x0000AF73, 0x0000116B, 0x00658ECC, 0x002B3B4C,
+  0x88776655, 0x70000000, 0x07200000, 0x7FFFFFFF, 0x56123761, 0x7FFFFF00,
+  0x761C4761, 0x80000000, 0x88888888, 0xA0000000, 0xDDDDDDDD, 0xE0000000,
+  0xEEEEEEEE, 0xFFFFFFFD, 0xF0000000, 0x007FFFFF, 0x003FFFFF, 0x001FFFFF,
+  0x000FFFFF, 0x0007FFFF, 0x0003FFFF, 0x0001FFFF, 0x0000FFFF, 0x00007FFF,
+  0x00003FFF, 0x00001FFF, 0x00000FFF, 0x000007FF, 0x000003FF, 0x000001FF,
+  // Bit pattern of a quiet NaN and signaling NaN, with or without
+  // additional payload.
+  0x7FC00000, 0x7F800000, 0x7FFFFFFF, 0x7F876543
+];
+
+const f32_values = [
+  -Infinity,
+  -2.70497e+38,
+  -1.4698e+37,
+  -1.22813e+35,
+  -1.20555e+35,
+  -1.34584e+34,
+  -1.0079e+32,
+  -6.49364e+26,
+  -3.06077e+25,
+  -1.46821e+25,
+  -1.17658e+23,
+  -1.9617e+22,
+  -2.7357e+20,
+  -9223372036854775808.0,  // INT64_MIN
+  -1.48708e+13,
+  -1.89633e+12,
+  -4.66622e+11,
+  -2.22581e+11,
+  -1.45381e+10,
+  -2147483904.0,  // First float32 after INT32_MIN
+  -2147483648.0,  // INT32_MIN
+  -2147483520.0,  // Last float32 before INT32_MIN
+  -1.3956e+09,
+  -1.32951e+09,
+  -1.30721e+09,
+  -1.19756e+09,
+  -9.26822e+08,
+  -6.35647e+08,
+  -4.00037e+08,
+  -1.81227e+08,
+  -5.09256e+07,
+  -964300.0,
+  -192446.0,
+  -28455.0,
+  -27194.0,
+  -26401.0,
+  -20575.0,
+  -17069.0,
+  -9167.0,
+  -960.178,
+  -113.0,
+  -62.0,
+  -15.0,
+  -7.0,
+  -1.0,
+  -0.0256635,
+  -4.60374e-07,
+  -3.63759e-10,
+  -4.30175e-14,
+  -5.27385e-15,
+  -1.5707963267948966,
+  -1.48084e-15,
+  -2.220446049250313e-16,
+  -1.05755e-19,
+  -3.2995e-21,
+  -1.67354e-23,
+  -1.11885e-23,
+  -1.78506e-30,
+  -5.07594e-31,
+  -3.65799e-31,
+  -1.43718e-34,
+  -1.27126e-38,
+  -0.0,
+  0.0,
+  1.17549e-38,
+  1.56657e-37,
+  4.08512e-29,
+  3.31357e-28,
+  6.25073e-22,
+  4.1723e-13,
+  1.44343e-09,
+  1.5707963267948966,
+  5.27004e-08,
+  9.48298e-08,
+  5.57888e-07,
+  4.89988e-05,
+  0.244326,
+  1.0,
+  12.4895,
+  19.0,
+  47.0,
+  106.0,
+  538.324,
+  564.536,
+  819.124,
+  7048.0,
+  12611.0,
+  19878.0,
+  20309.0,
+  797056.0,
+  1.77219e+09,
+  2147483648.0,  // INT32_MAX + 1
+  4294967296.0,  // UINT32_MAX + 1
+  1.51116e+11,
+  4.18193e+13,
+  3.59167e+16,
+  9223372036854775808.0,   // INT64_MAX + 1
+  18446744073709551616.0,  // UINT64_MAX + 1
+  3.38211e+19,
+  2.67488e+20,
+  1.78831e+21,
+  9.20914e+21,
+  8.35654e+23,
+  1.4495e+24,
+  5.94015e+25,
+  4.43608e+30,
+  2.44502e+33,
+  2.61152e+33,
+  1.38178e+37,
+  1.71306e+37,
+  3.31899e+38,
+  3.40282e+38,
+  Infinity,
+  NaN
+];
+
+const f64_values = [
+  -2e66,
+  -2.220446049250313e-16,
+  -9223373136366403584.0,
+  -9223372036854775808.0,  // INT64_MIN
+  -2147483649.5,
+  -2147483648.25,
+  -2147483648.0,
+  -2147483647.875,
+  -2147483647.125,
+  -2147483647.0,
+  -999.75,
+  -2e66,
+  -1.75,
+  -1.5707963267948966,
+  -1.0,
+  -0.5,
+  -0.0,
+  0.0,
+  3e-88,
+  0.125,
+  0.25,
+  0.375,
+  0.5,
+  1.0,
+  1.17549e-38,
+  1.56657e-37,
+  1.0000001,
+  1.25,
+  1.5707963267948966,
+  2,
+  3.1e7,
+  5.125,
+  6.25,
+  888,
+  982983.25,
+  2147483647.0,
+  2147483647.375,
+  2147483647.75,
+  2147483648.0,
+  2147483648.25,
+  2147483649.25,
+  9223372036854775808.0,  // INT64_MAX + 1
+  9223373136366403584.0,
+  18446744073709551616.0,  // UINT64_MAX + 1
+  2e66,
+  Infinity,
+  -Infinity,
+  NaN
+];
+
+function GlobalI32(value, mutable = false) {
+  return new WebAssembly.Global({value: 'i32', mutable}, value);
+}
+
+function GlobalI64(mutable = false) {
+  let builder = new WasmModuleBuilder();
+  builder.addGlobal(kWasm64, mutable).exportAs('i64');
+  let module = new WebAssembly.Module(builder.toBuffer());
+  let instance = new WebAssembly.Instance(module);
+  return instance.exports.i64;
+}
+
+function GlobalF32(value, mutable = false) {
+  return new WebAssembly.Global({value: 'f32', mutable}, value);
+}
+
+function GlobalF64(value, mutable = false) {
+  return new WebAssembly.Global({value: 'f64', mutable}, value);
+}
+
+(function TestDefaultValue() {
+  assertSame(0, GlobalI32().value);
+  assertSame(0, GlobalF32().value);
+  assertSame(0, GlobalF64().value);
+})();
+
+(function TestValueOf() {
+  assertTrue(WebAssembly.Global.prototype.valueOf instanceof Function);
+  assertSame(0, WebAssembly.Global.prototype.valueOf.length);
+
+  for (let u32_value of u32_values) {
+    let i32_value = u32_value | 0;
+
+    assertSame(i32_value, GlobalI32(u32_value).valueOf());
+    assertSame(i32_value, GlobalI32(i32_value).valueOf());
+  }
+
+  assertThrows(() => GlobalI64().valueOf());
+
+  for (let f32_value of f32_values) {
+    assertSame(Math.fround(f32_value), GlobalF32(f32_value).valueOf());
+  }
+
+  for (let f64_value of f64_values) {
+    assertSame(f64_value, GlobalF64(f64_value).valueOf());
+  }
+})();
+
+(function TestGetValue() {
+  let getter =
+      Object.getOwnPropertyDescriptor(WebAssembly.Global.prototype, 'value')
+          .get;
+  assertTrue(getter instanceof Function);
+  assertSame(0, getter.length);
+
+  for (let u32_value of u32_values) {
+    let i32_value = u32_value | 0;
+    assertSame(i32_value, GlobalI32(u32_value).value);
+    assertSame(i32_value, GlobalI32(i32_value).value);
+  }
+
+  assertThrows(() => GlobalI64().value);
+
+  for (let f32_value of f32_values) {
+    assertSame(Math.fround(f32_value), GlobalF32(f32_value).value);
+  }
+
+  for (let f64_value of f64_values) {
+    assertSame(f64_value, GlobalF64(f64_value).value);
+  }
+})();
+
+(function TestSetValueImmutable() {
+  assertThrows(() => GlobalI32().value = 0);
+  assertThrows(() => GlobalI64().value = 0);
+  assertThrows(() => GlobalF32().value = 0);
+  assertThrows(() => GlobalF64().value = 0);
+})();
+
+(function TestSetValue() {
+  let setter =
+      Object.getOwnPropertyDescriptor(WebAssembly.Global.prototype, 'value')
+          .set;
+  assertTrue(setter instanceof Function);
+  assertSame(1, setter.length);
+
+  for (let u32_value of u32_values) {
+    let i32_value = u32_value | 0;
+
+    let global = GlobalI32(0, true);
+    global.value = u32_value;
+    assertSame(i32_value, global.value);
+
+    global.value = i32_value;
+    assertSame(i32_value, global.value);
+  }
+
+  assertThrows(() => GlobalI64(true).value = 0);
+
+  for (let f32_value of f32_values) {
+    let global = GlobalF32(0, true);
+    global.value = f32_value;
+    assertSame(Math.fround(f32_value), global.value);
+  }
+
+  for (let f64_value of f64_values) {
+    let global = GlobalF64(0, true);
+    global.value = f64_value;
+    assertSame(f64_value, global.value);
+  }
+})();
diff --git a/src/v8/test/mjsunit/wasm/names.js b/src/v8/test/mjsunit/wasm/names.js
index 8b635e6..4904d67 100644
--- a/src/v8/test/mjsunit/wasm/names.js
+++ b/src/v8/test/mjsunit/wasm/names.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 function toBytes(string) {
diff --git a/src/v8/test/mjsunit/wasm/origin-trial-flags.js b/src/v8/test/mjsunit/wasm/origin-trial-flags.js
new file mode 100644
index 0000000..b9ce6f7
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/origin-trial-flags.js
@@ -0,0 +1,34 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --noexperimental-wasm-threads --allow-natives-syntax
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+function instantiateModuleWithThreads() {
+  // Build a WebAssembly module which uses threads-features.
+  const builder = new WasmModuleBuilder();
+  const shared = true;
+  builder.addMemory(2, 10, false, shared);
+  builder.addFunction('main', kSig_i_ii)
+      .addBody([
+        kExprGetLocal, 0, kExprGetLocal, 1, kAtomicPrefix, kExprI32AtomicAdd, 2,
+        0
+      ])
+      .exportFunc();
+
+  return builder.instantiate();
+}
+
+// Disable WebAssembly threads initially.
+%SetWasmThreadsEnabled(false);
+assertThrows(instantiateModuleWithThreads, WebAssembly.CompileError);
+
+// Enable WebAssembly threads.
+%SetWasmThreadsEnabled(true);
+assertInstanceof(instantiateModuleWithThreads(), WebAssembly.Instance);
+
+// Disable WebAssembly threads.
+%SetWasmThreadsEnabled(false);
+assertThrows(instantiateModuleWithThreads, WebAssembly.CompileError);
diff --git a/src/v8/test/mjsunit/wasm/parallel_compilation.js b/src/v8/test/mjsunit/wasm/parallel_compilation.js
index 208232c..6eca124 100644
--- a/src/v8/test/mjsunit/wasm/parallel_compilation.js
+++ b/src/v8/test/mjsunit/wasm/parallel_compilation.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm --wasm-num-compilation-tasks=10
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 function assertModule(module, memsize) {
diff --git a/src/v8/test/mjsunit/wasm/params.js b/src/v8/test/mjsunit/wasm/params.js
index e964cee..3385842 100644
--- a/src/v8/test/mjsunit/wasm/params.js
+++ b/src/v8/test/mjsunit/wasm/params.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 function runSelect2(select, which, a, b) {
diff --git a/src/v8/test/mjsunit/wasm/print-code.js b/src/v8/test/mjsunit/wasm/print-code.js
new file mode 100644
index 0000000..c604ca7
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/print-code.js
@@ -0,0 +1,31 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --print-wasm-code
+
+// Just test that printing the code of the following wasm modules does not
+// crash.
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function print_deserialized_code() {
+  // https://crbug.com/849656
+  print(arguments.callee.name);
+  var builder = new WasmModuleBuilder();
+  builder.addImport('', 'imp', kSig_i_v);
+
+  builder.addFunction('main', kSig_i_v)
+      .addBody([
+        kExprCallFunction,
+        0,
+      ])
+      .exportFunc();
+
+  var wire_bytes = builder.toBuffer();
+  var module = new WebAssembly.Module(wire_bytes);
+  print('serializing');
+  var buff = %SerializeWasmModule(module);
+  print('deserializing');
+  module = %DeserializeWasmModule(buff, wire_bytes);
+})();
diff --git a/src/v8/test/mjsunit/wasm/receiver.js b/src/v8/test/mjsunit/wasm/receiver.js
index b3373c1..10e8855 100644
--- a/src/v8/test/mjsunit/wasm/receiver.js
+++ b/src/v8/test/mjsunit/wasm/receiver.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 function testCallImport(func, expected, a, b) {
diff --git a/src/v8/test/mjsunit/wasm/return-calls.js b/src/v8/test/mjsunit/wasm/return-calls.js
new file mode 100644
index 0000000..22d2860
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/return-calls.js
@@ -0,0 +1,161 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --experimental-wasm-return-call --stack-size=64
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function TestFactorialReturnCall() {
+  print(arguments.callee.name);
+
+  let builder = new WasmModuleBuilder();
+
+  const sig_i_iii = builder.addType(kSig_i_iii);
+
+  // construct the code for the function
+  // f_aux(N,X) where N=<1 => X
+  // f_aux(N,X) => f_aux(N-1,X*N)
+  let fact_aux = builder.addFunction("fact_aux",kSig_i_ii);
+  fact_aux.addBody([
+    kExprGetLocal, 0, kExprI32Const, 1, kExprI32LeS,
+    kExprIf, kWasmI32,
+      kExprGetLocal, 1,
+    kExprElse,
+      kExprGetLocal, 0,
+      kExprI32Const, 1,
+      kExprI32Sub,
+      kExprGetLocal, 0,
+      kExprGetLocal, 1,
+      kExprI32Mul,
+      kExprReturnCall, fact_aux.index,
+    kExprEnd
+      ]);
+
+  //main(N)=>fact_aux(N,1)
+  let main = builder.addFunction("main", kSig_i_i)
+        .addBody([
+          kExprGetLocal, 0,
+          kExprI32Const, 1,
+          kExprReturnCall,0
+    ]).exportFunc();
+
+  let module = builder.instantiate();
+
+  print(" --three--");
+  assertEquals(6, module.exports.main(3));
+  print(" --four--");
+  assertEquals(24, module.exports.main(4));
+})();
+
+(function TestIndirectFactorialReturnCall() {
+  print(arguments.callee.name);
+
+  let builder = new WasmModuleBuilder();
+
+  const sig_i_iii = builder.addType(kSig_i_iii);
+
+  // construct the code for the function
+  // fact(N) => f_ind(N,1,f).
+  //
+  // f_ind(N,X,_) where N=<1 => X
+  // f_ind(N,X,F) => F(N-1,X*N,F).
+
+  let f_ind = builder.addFunction("f_ind",kSig_i_iii).
+      addBody([
+    kExprGetLocal, 0, kExprI32Const, 1, kExprI32LeS,
+    kExprIf, kWasmI32,
+      kExprGetLocal, 1,
+    kExprElse,
+      kExprGetLocal, 0,
+      kExprI32Const, 1,
+      kExprI32Sub,
+      kExprGetLocal, 0,
+      kExprGetLocal, 1,
+      kExprI32Mul,
+      kExprGetLocal, 2,
+      kExprGetLocal, 2,
+      kExprReturnCallIndirect, sig_i_iii, kTableZero,
+    kExprEnd
+      ]);
+
+  //main(N)=>fact_aux(N,1)
+  let main = builder.addFunction("main", kSig_i_i)
+        .addBody([
+      kExprGetLocal, 0,
+      kExprI32Const, 1,
+      kExprI32Const, f_ind.index,
+      kExprReturnCall, f_ind.index
+    ]).exportFunc();
+
+  builder.appendToTable([f_ind.index, main.index]);
+
+  let module = builder.instantiate();
+
+  print(" --three--");
+  assertEquals(6, module.exports.main(3));
+  print(" --four--");
+  assertEquals(24, module.exports.main(4));
+})();
+
+(function TestImportReturnCall() {
+  print(arguments.callee.name);
+
+  let builder = new WasmModuleBuilder();
+
+  const sig_i_iii = builder.addType(kSig_i_iii);
+
+  let pick = builder.addImport("q", "pick", sig_i_iii);
+
+  let main = builder.addFunction("main", kSig_i_iii)
+        .addBody([
+          kExprGetLocal, 1,
+          kExprGetLocal, 2,
+          kExprGetLocal, 0,
+          kExprReturnCall, pick
+        ])
+        .exportFunc();
+
+  let module = builder.instantiate({q: {
+    pick: function(a, b, c) { return c ? a : b; }}});
+
+  print(" --left--");
+  assertEquals(-2, module.exports.main(1, -2, 3));
+  print(" --right--");
+  assertEquals(3, module.exports.main(0, -2, 3));
+})();
+
+(function TestImportIndirectReturnCall() {
+  print(arguments.callee.name);
+
+  let builder = new WasmModuleBuilder();
+
+  const sig_i_iii = builder.addType(kSig_i_iii);
+
+  let pick = builder.addImport("q", "pick", sig_i_iii);
+  builder.addTable(kWasmAnyFunc, 4);
+  // Arbitrary location in the table.
+  const tableIndex = 3;
+
+  builder.addElementSegment(0, tableIndex,false,[pick]);
+
+  let main = builder.addFunction("main", kSig_i_iii)
+        .addBody([
+          kExprGetLocal, 1,
+          kExprGetLocal, 2,
+          kExprGetLocal, 0,
+          kExprI32Const, tableIndex,
+          kExprReturnCallIndirect, sig_i_iii, kTableZero
+        ])
+        .exportFunc();
+  builder.appendToTable([pick, main.index]);
+
+  let module = builder.instantiate({q: {
+    pick: function(a, b, c) { return c ? a : b; }
+  }});
+
+  print(" --left--");
+  assertEquals(-2, module.exports.main(1, -2, 3));
+  print(" --right--");
+  assertEquals(3, module.exports.main(0, -2, 3));
+})();
diff --git a/src/v8/test/mjsunit/wasm/serialize-lazy-module.js b/src/v8/test/mjsunit/wasm/serialize-lazy-module.js
new file mode 100644
index 0000000..86b6855
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/serialize-lazy-module.js
@@ -0,0 +1,67 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-lazy-compilation --allow-natives-syntax --expose-gc
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function SerializeUncompiledModule() {
+  print(arguments.callee.name);
+  const [wire_bytes, i1, buff] = (function GenerateInstance() {
+    const builder = new WasmModuleBuilder();
+
+    // Add 20 functions.
+    for (let i = 0; i < 20; ++i) {
+      builder.addFunction('f' + i, kSig_i_i)
+          .addBody([kExprI32Const, i])
+          .exportFunc();
+    }
+
+    const wire_bytes = builder.toBuffer();
+    const module = new WebAssembly.Module(wire_bytes);
+    const buff = %SerializeWasmModule(module);
+    return [wire_bytes, new WebAssembly.Instance(module), buff];
+  })();
+
+  gc();
+  const module = %DeserializeWasmModule(buff, wire_bytes);
+
+  const i2 = new WebAssembly.Instance(module);
+
+  assertEquals(13, i2.exports.f13());
+  assertEquals(11, i1.exports.f11());
+})();
+
+(function SerializePartlyCompiledModule() {
+  print(arguments.callee.name);
+  const [wire_bytes, i1, buff] = (function GenerateInstance() {
+    const builder = new WasmModuleBuilder();
+
+    // Add 20 functions.
+    for (let i = 0; i < 20; ++i) {
+      builder.addFunction('f' + i, kSig_i_i)
+          .addBody([kExprI32Const, i])
+          .exportFunc();
+    }
+
+    const wire_bytes = builder.toBuffer();
+    const module = new WebAssembly.Module(wire_bytes);
+    const buff = %SerializeWasmModule(module);
+    const i1 = new WebAssembly.Instance(module);
+
+    assertEquals(2, i1.exports.f2());
+    assertEquals(11, i1.exports.f11());
+
+    return [wire_bytes, i1, buff];
+  })();
+
+  gc();
+  const module = %DeserializeWasmModule(buff, wire_bytes);
+
+  const i2 = new WebAssembly.Instance(module);
+
+  assertEquals(13, i2.exports.f13());
+  assertEquals(11, i1.exports.f11());
+  assertEquals(9, i1.exports.f9());
+})();
diff --git a/src/v8/test/mjsunit/wasm/shared-memory-gc-stress.js b/src/v8/test/mjsunit/wasm/shared-memory-gc-stress.js
new file mode 100644
index 0000000..8721d8d
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/shared-memory-gc-stress.js
@@ -0,0 +1,37 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function AllocMemory(pages, max = pages) {
+  let m =
+      new WebAssembly.Memory({initial : pages, maximum : max, shared : true});
+  let v = new Int32Array(m.buffer);
+  return {memory : m, view : v};
+}
+
+function RunSomeAllocs(total, retained, pages, max = pages) {
+  print(`-------iterations = ${total}, retained = $ { retained } -------`);
+  var array = new Array(retained);
+  for (var i = 0; i < total; i++) {
+    if ((i % 25) == 0)
+      print(`iteration $ { i }`);
+    let pair = AllocMemory(pages, max);
+    // For some iterations, retain the memory, view, or both.
+    switch (i % 3) {
+    case 0:
+      pair.memory = null;
+      break;
+    case 1:
+      pair.view = null;
+      break;
+    case 2:
+      break;
+    }
+    array[i % retained] = pair;
+  }
+}
+
+RunSomeAllocs(10, 1, 1, 1);
+RunSomeAllocs(100, 3, 1, 1);
+RunSomeAllocs(1000, 10, 1, 1);
+RunSomeAllocs(10000, 20, 1, 1);
diff --git a/src/v8/test/mjsunit/wasm/shared-memory-worker-explicit-gc-stress.js b/src/v8/test/mjsunit/wasm/shared-memory-worker-explicit-gc-stress.js
new file mode 100644
index 0000000..aa9088e
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/shared-memory-worker-explicit-gc-stress.js
@@ -0,0 +1,33 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-threads --expose-gc
+
+load("test/mjsunit/worker-ping-test.js");
+
+let kDisabledAbort = false; // TODO(9380): enable abort for this test
+
+let config = {
+  numThings: 4,       // size of circular buffer
+  numWorkers: 4,      // number of workers
+  numMessages: 500,   // number of messages sent to each worker
+  allocInterval: 11,  // interval for allocating new things per worker
+  traceScript: false, // print the script
+  traceAlloc: true,   // print each allocation attempt
+  traceIteration: 10, // print diagnostics every so many iterations
+  abortOnFail: kDisabledAbort,  // kill worker if allocation fails
+
+  AllocThing: function AllocThing(id) {
+    let pages = 1, max = 1;
+    return new WebAssembly.Memory({initial : pages, maximum : max, shared : true});
+  },
+  BeforeSend: function BeforeSend(msg) {
+    gc();
+  },
+  BeforeReceive: function BeforeReceive(msg) {
+    gc();
+  }
+}
+
+RunWorkerPingTest(config);
diff --git a/src/v8/test/mjsunit/wasm/shared-memory-worker-gc-stress.js b/src/v8/test/mjsunit/wasm/shared-memory-worker-gc-stress.js
new file mode 100644
index 0000000..6f244cf
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/shared-memory-worker-gc-stress.js
@@ -0,0 +1,27 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-threads
+
+load("test/mjsunit/worker-ping-test.js");
+
+let kDisabledAbort = false; // TODO(9380): enable abort for this test
+
+let config = {
+  numThings: 4,       // size of circular buffer
+  numWorkers: 4,      // number of workers
+  numMessages: 1000,  // number of messages sent to each worker
+  allocInterval: 11,  // interval for allocating new things per worker
+  traceScript: false, // print the script
+  traceAlloc: true,   // print each allocation attempt
+  traceIteration: 10, // print diagnostics every so many iterations
+  abortOnFail: kDisabledAbort,  // kill worker if allocation fails
+
+  AllocThing: function AllocThing(id) {
+    let pages = 1, max = 1;
+    return new WebAssembly.Memory({initial : pages, maximum : max, shared : true});
+  },
+}
+
+RunWorkerPingTest(config);
diff --git a/src/v8/test/mjsunit/wasm/shared-memory-worker-gc.js b/src/v8/test/mjsunit/wasm/shared-memory-worker-gc.js
new file mode 100644
index 0000000..376917b
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/shared-memory-worker-gc.js
@@ -0,0 +1,34 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-threads
+
+const kNumMessages = 5000;
+
+function AllocMemory(pages = 1, max = pages) {
+  return new WebAssembly.Memory({initial : pages, maximum : max, shared : true});
+}
+
+(function RunTest() {
+  let worker = new Worker(
+`onmessage =
+   function(msg) {
+     if (msg.memory) postMessage({memory : msg.memory});
+}`, {type : 'string'});
+
+  let time = performance.now();
+
+  for (let i = 0; i < kNumMessages; i++) {
+    let now = performance.now();
+    print(`iteration ${i}, Δ = ${(now - time).toFixed(3)} ms`);
+    time = now;
+
+    let memory = AllocMemory();
+    worker.postMessage({memory : memory});
+    let msg = worker.getMessage();
+    if (msg.memory) {
+      assertInstanceof(msg.memory, WebAssembly.Memory);
+    }
+  }
+})();
diff --git a/src/v8/test/mjsunit/wasm/shared-memory-worker-stress.js b/src/v8/test/mjsunit/wasm/shared-memory-worker-stress.js
new file mode 100644
index 0000000..53ec4a5
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/shared-memory-worker-stress.js
@@ -0,0 +1,27 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-threads
+
+load("test/mjsunit/worker-ping-test.js");
+
+// TODO(v8:9380): increase {numThings} and {numWorkers} when stress-opt mode
+// no longer leaks wasm memories.
+let config = {
+  numThings: 2,         // size of circular buffer
+  numWorkers: 2,        // number of workers
+  numMessages: 2000,    // number of messages sent to each worker
+  allocInterval: 10001, // interval for allocating new things per worker
+  traceScript: false,   // print the script
+  traceAlloc: true,     // print each allocation attempt
+  traceIteration: 10,   // print diagnostics every so many iterations
+  abortOnFail: true,    // kill worker if allocation fails
+
+  AllocThing: function AllocThing(id) {
+    let pages = 1, max = 1;
+    return new WebAssembly.Memory({initial : pages, maximum : max, shared : true});
+  },
+}
+
+RunWorkerPingTest(config);
diff --git a/src/v8/test/mjsunit/wasm/shared-memory.js b/src/v8/test/mjsunit/wasm/shared-memory.js
index bbe89a3..80e894b 100644
--- a/src/v8/test/mjsunit/wasm/shared-memory.js
+++ b/src/v8/test/mjsunit/wasm/shared-memory.js
@@ -4,7 +4,6 @@
 
 // Flags: --experimental-wasm-threads
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 function assertMemoryIsValid(memory, shared) {
@@ -130,3 +129,17 @@
   assertEquals(0, instance.exports.main(0, 0x11111111));
   assertEquals(0x11111111, instance.exports.main(0, 0x11111111));
 })();
+
+(function TestMemoryConstructorShouldNotCallHasProperty() {
+  print(arguments.callee.name);
+  // from test/wasm-js/data/test/js-api/memory/constructor.any.js
+  const proxy = new Proxy({}, {
+    has(o, x) {
+      throw new Error(`Should not call [[HasProperty]] with ${x}`);
+    },
+    get(o, x) {
+      return 0;
+    },
+  });
+  new WebAssembly.Memory(proxy);
+})();
diff --git a/src/v8/test/mjsunit/wasm/stack.js b/src/v8/test/mjsunit/wasm/stack.js
index f49dca3..7e592e7 100644
--- a/src/v8/test/mjsunit/wasm/stack.js
+++ b/src/v8/test/mjsunit/wasm/stack.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 // The stack trace contains file path, only keep "stack.js".
@@ -24,7 +23,7 @@
     assertContains(exp[4], frames[i].getFileName(), "["+i+"].getFileName()");
     var toString;
     if (exp[0]) {
-      toString = "wasm-function[" + exp[2] + "]:" + exp[3];
+      toString = "wasm-function[" + exp[2] + "]:" + exp[5];
       if (exp[1] !== null) toString = exp[1] + " (" + toString + ")";
     } else {
       toString = exp[4] + ":" + exp[2] + ":";
@@ -70,10 +69,10 @@
 (function testSimpleStack() {
   var expected_string = 'Error\n' +
       // The line numbers below will change as this test gains / loses lines..
-      '    at STACK (stack.js:39:11)\n' +            // --
-      '    at main (wasm-function[1]:1)\n' +         // --
-      '    at testSimpleStack (stack.js:78:18)\n' +  // --
-      '    at stack.js:80:3';                        // --
+      '    at STACK (stack.js:38:11)\n' +            // --
+      '    at main (wasm-function[1]:0x86)\n' +      // --
+      '    at testSimpleStack (stack.js:77:18)\n' +  // --
+      '    at stack.js:79:3';                        // --
 
   module.exports.main();
   assertEquals(expected_string, stripPath(stack));
@@ -89,11 +88,11 @@
   module.exports.main();
 
   verifyStack(stack, [
-      // isWasm           function   line  pos        file
-      [   false,           "STACK",    39,   0, "stack.js"],
-      [    true,            "main",     1,   1,       null],
-      [   false, "testStackFrames",    89,   0, "stack.js"],
-      [   false,              null,    98,   0, "stack.js"]
+      // isWasm           function   line  pos        file  offset
+      [   false,           "STACK",    38,   0, "stack.js"],
+      [    true,            "main",     1,   1,       null, '0x86'],
+      [   false, "testStackFrames",    88,   0, "stack.js"],
+      [   false,              null,    97,   0, "stack.js"]
   ]);
 })();
 
@@ -104,10 +103,10 @@
   } catch (e) {
     assertContains("unreachable", e.message);
     verifyStack(e.stack, [
-        // isWasm               function   line  pos        file
-        [    true,    "exec_unreachable",    2,    1,       null],
-        [   false, "testWasmUnreachable",  102,    0, "stack.js"],
-        [   false,                  null,  113,    0, "stack.js"]
+        // isWasm               function   line  pos        file  offset
+        [    true,    "exec_unreachable",    2,    1,       null, '0x8b'],
+        [   false, "testWasmUnreachable",  101,    0, "stack.js"],
+        [   false,                  null,  112,    0, "stack.js"]
     ]);
   }
 })();
@@ -119,11 +118,11 @@
   } catch (e) {
     assertContains("out of bounds", e.message);
     verifyStack(e.stack, [
-        // isWasm                  function   line  pos        file
-        [    true,                     null,     3,   3,       null],
-        [    true, "call_mem_out_of_bounds",     4,   1,       null],
-        [   false, "testWasmMemOutOfBounds",   117,   0, "stack.js"],
-        [   false,                     null,   129,   0, "stack.js"]
+        // isWasm                  function   line  pos        file  offset
+        [    true,                     null,     3,   3,       null, '0x91'],
+        [    true, "call_mem_out_of_bounds",     4,   1,       null, '0x97'],
+        [   false, "testWasmMemOutOfBounds",   116,   0, "stack.js"],
+        [   false,                     null,   128,   0, "stack.js"]
     ]);
   }
 })();
@@ -148,11 +147,11 @@
     assertEquals("Maximum call stack size exceeded", e.message, "trap reason");
     assertTrue(e.stack.length >= 4, "expected at least 4 stack entries");
     verifyStack(e.stack.splice(0, 4), [
-        // isWasm     function  line  pos  file
-        [    true, "recursion",    0,   0, null],
-        [    true, "recursion",    0,   3, null],
-        [    true, "recursion",    0,   3, null],
-        [    true, "recursion",    0,   3, null]
+        // isWasm     function  line  pos  file  offset
+        [    true, "recursion",    0,   0, null, '0x34'],
+        [    true, "recursion",    0,   3, null, '0x37'],
+        [    true, "recursion",    0,   3, null, '0x37'],
+        [    true, "recursion",    0,   3, null, '0x37']
     ]);
   }
 })();
@@ -174,10 +173,11 @@
     fail('expected wasm exception');
   } catch (e) {
     assertEquals('unreachable', e.message, 'trap reason');
+    let hexOffset = '0x' + (unreachable_pos + 0x25).toString(16);
     verifyStack(e.stack, [
-      // isWasm, function, line, pos, file
-      [true, 'main', 0, unreachable_pos + 1, null],  // -
-      [false, 'testBigOffset', 173, 0, 'stack.js'],  //-
+      // isWasm, function, line, pos, file, offset
+      [true, 'main', 0, unreachable_pos + 1, null, hexOffset],  // -
+      [false, 'testBigOffset', 172, 0, 'stack.js'],             //-
       [false, null, 184, 0, 'stack.js']
     ]);
   }
diff --git a/src/v8/test/mjsunit/wasm/stackwalk.js b/src/v8/test/mjsunit/wasm/stackwalk.js
index d2810fc..91951ff 100644
--- a/src/v8/test/mjsunit/wasm/stackwalk.js
+++ b/src/v8/test/mjsunit/wasm/stackwalk.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm --expose-gc --allow-natives-syntax
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 function makeFFI(func) {
diff --git a/src/v8/test/mjsunit/wasm/start-function.js b/src/v8/test/mjsunit/wasm/start-function.js
index d6ec341..e17c8f1 100644
--- a/src/v8/test/mjsunit/wasm/start-function.js
+++ b/src/v8/test/mjsunit/wasm/start-function.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 function instantiate(sig, body) {
@@ -46,8 +45,8 @@
 
   assertThrows(
       () => builder.instantiate(), WebAssembly.CompileError,
-      'WebAssembly.Module(): Wasm decoding failed: ' +
-          'function index 1 out of bounds (1 entry) @+20');
+      'WebAssembly.Module(): ' +
+          'start function index 1 out of bounds (1 entry) @+20');
 })();
 
 
@@ -63,8 +62,7 @@
 
   assertThrows(
       () => builder.instantiate(), WebAssembly.CompileError,
-      'WebAssembly.Module(): Wasm decoding failed: ' +
-          'unexpected section: Start @+27');
+      'WebAssembly.Module(): unexpected section <Start> @+27');
 })();
 
 
@@ -126,15 +124,23 @@
 (function testStartFunctionThrowsExplicitly() {
   print('testStartFunctionThrowsExplicitly');
   let error = new Error('my explicit error');
-  function throw_fn() {
-    throw error;
-  }
+  var ffi = {
+    foo: {
+      throw_fn: function() {
+        throw error;
+      }
+    }
+  };
   let builder = new WasmModuleBuilder();
-  builder.addImport('foo', 'bar', kSig_v_v);
+  builder.addImport('foo', 'throw_fn', kSig_v_v);
   let func = builder.addFunction('', kSig_v_v).addBody([kExprCallFunction, 0]);
   builder.addStart(func.index);
 
   assertThrowsEquals(() => builder.instantiate(ffi), error);
+  assertPromiseResult(builder.asyncInstantiate(ffi), assertUnreachable,
+    e => assertSame(e, error));
+  assertPromiseResult(WebAssembly.instantiate(builder.toModule(), ffi),
+    assertUnreachable, e => assertSame(e, error));
 })();
 
 (function testStartFunctionThrowsImplicitly() {
@@ -145,4 +151,7 @@
 
   assertThrows(
       () => builder.instantiate(), WebAssembly.RuntimeError, /unreachable/);
+  assertThrowsAsync(builder.asyncInstantiate(), WebAssembly.RuntimeError);
+  assertThrowsAsync(
+      WebAssembly.instantiate(builder.toModule()), WebAssembly.RuntimeError);
 })();
diff --git a/src/v8/test/mjsunit/wasm/streaming-api.js b/src/v8/test/mjsunit/wasm/streaming-api.js
new file mode 100644
index 0000000..3decc1a
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/streaming-api.js
@@ -0,0 +1,67 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-test-streaming
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function TestCompileStreaming() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("main", kSig_i_i)
+         .addBody([kExprGetLocal, 0])
+         .exportAs("main");
+  let bytes = builder.toBuffer();
+  assertPromiseResult(WebAssembly.compileStreaming(Promise.resolve(bytes)).then(
+    module => WebAssembly.instantiate(module)).then(
+      instance => assertEquals(5, instance.exports.main(5))));
+})();
+
+(function TestInstantiateStreaming() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("main", kSig_i_i)
+         .addBody([kExprGetLocal, 0])
+         .exportAs("main");
+  let bytes = builder.toBuffer();
+  assertPromiseResult(WebAssembly.instantiateStreaming(Promise.resolve(bytes)).then(
+    ({module, instance}) => assertEquals(5, instance.exports.main(5))));
+})();
+
+(function TestCompileStreamingRejectedInputPromise() {
+  print(arguments.callee.name);
+  assertPromiseResult(WebAssembly.compileStreaming(Promise.reject("myError")),
+    assertUnreachable,
+    error => assertEquals(error, "myError"));
+})();
+
+(function TestInstantiateStreamingRejectedInputPromise() {
+  print(arguments.callee.name);
+  assertPromiseResult(WebAssembly.instantiateStreaming(Promise.reject("myError")),
+    assertUnreachable,
+    error => assertEquals(error, "myError"));
+})();
+
+(function TestStreamingErrorMessage() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("main", kSig_i_i)
+         .addBody([kExprGetLocal, 0,
+                   kExprGetLocal, 0,
+                   kExprF32Mul])
+         .exportAs("main");
+  let bytes = builder.toBuffer();
+  assertPromiseResult(WebAssembly.compileStreaming(Promise.resolve(bytes)),
+    assertUnreachable,
+    error => assertEquals("WebAssembly.compileStreaming(): Compiling " +
+                          "function #0:\"main\" failed: f32.mul[1] expected " +
+                          "type f32, found local.get of type i32 @+37",
+                          error.message));
+  assertPromiseResult(WebAssembly.instantiateStreaming(Promise.resolve(bytes)),
+    assertUnreachable,
+    error => assertEquals("WebAssembly.instantiateStreaming(): Compiling " +
+                          "function #0:\"main\" failed: f32.mul[1] expected " +
+                          "type f32, found local.get of type i32 @+37",
+                          error.message));
+})();
diff --git a/src/v8/test/mjsunit/wasm/streaming-compile.js b/src/v8/test/mjsunit/wasm/streaming-compile.js
index 5f2ca6b..74f107b 100644
--- a/src/v8/test/mjsunit/wasm/streaming-compile.js
+++ b/src/v8/test/mjsunit/wasm/streaming-compile.js
@@ -2,6 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --wasm-test-streaming -async-compilation --expose-wasm --allow-natives-syntax
+// Flags: --wasm-test-streaming --expose-wasm --allow-natives-syntax
 
 load("test/mjsunit/wasm/async-compile.js");
diff --git a/src/v8/test/mjsunit/wasm/streaming-error-position.js b/src/v8/test/mjsunit/wasm/streaming-error-position.js
index c2b86c0..b6d008c 100644
--- a/src/v8/test/mjsunit/wasm/streaming-error-position.js
+++ b/src/v8/test/mjsunit/wasm/streaming-error-position.js
@@ -2,11 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --wasm-test-streaming --wasm-async-compilation --expose-wasm --allow-natives-syntax
+// Flags: --wasm-test-streaming --expose-wasm
 
 'use strict';
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 function module(bytes) {
@@ -21,42 +20,26 @@
   return new WebAssembly.Module(buffer);
 }
 
-function toBuffer(binary) {
-  let buffer = new ArrayBuffer(binary.length);
-  let view = new Uint8Array(buffer);
-  for (let i = 0; i < binary.length; i++) {
-    let val = binary[i];
-    if ((typeof val) == 'string') val = val.charCodeAt(0);
-    view[i] = val | 0;
-  }
-  return buffer;
-}
-
 function testErrorPosition(bytes, pos, test_name) {
-  assertPromiseResult(
-      WebAssembly.compile(toBuffer(bytes)), assertUnreachable, e => {
-        print(test_name);
-        assertInstanceof(e, WebAssembly.CompileError);
-        let regex = new RegExp('@\\+' + pos);
-        print(e.message);
-        assertMatches(regex, e.message, 'Error Position');
-      });
+  assertThrowsAsync(
+      WebAssembly.compile(bytes.trunc_buffer()), WebAssembly.CompileError,
+      new RegExp('@\\+' + pos));
 }
 
 (function testInvalidMagic() {
   let bytes = new Binary;
-  bytes.push(
-      kWasmH0, kWasmH1 + 1, kWasmH2, kWasmH3, kWasmV0, kWasmV1, kWasmV2,
-      kWasmV3);
+  bytes.emit_bytes([
+    kWasmH0, kWasmH1 + 1, kWasmH2, kWasmH3, kWasmV0, kWasmV1, kWasmV2, kWasmV3
+  ]);
   // Error at pos==0 because that's where the magic word is.
   testErrorPosition(bytes, 0, 'testInvalidMagic');
 })();
 
 (function testInvalidVersion() {
   let bytes = new Binary;
-  bytes.push(
-      kWasmH0, kWasmH1, kWasmH2, kWasmH3, kWasmV0, kWasmV1 + 1, kWasmV2,
-      kWasmV3);
+  bytes.emit_bytes([
+    kWasmH0, kWasmH1, kWasmH2, kWasmH3, kWasmV0, kWasmV1 + 1, kWasmV2, kWasmV3
+  ]);
   // Error at pos==4 because that's where the version word is.
   testErrorPosition(bytes, 4, 'testInvalidVersion');
 })();
@@ -65,7 +48,7 @@
   let bytes = new Binary;
   bytes.emit_header();
   bytes.emit_u8(kTypeSectionCode);
-  bytes.push(0x80, 0x80, 0x80, 0x80, 0x80, 0x00);
+  bytes.emit_bytes([0x80, 0x80, 0x80, 0x80, 0x80, 0x00]);
   let pos = bytes.length - 1 - 1;
   testErrorPosition(bytes, pos, 'testSectionLengthInvalidVarint');
 })();
@@ -82,22 +65,22 @@
 (function testFunctionsCountInvalidVarint() {
   let bytes = new Binary;
   bytes.emit_header();
-  bytes.push(
+  bytes.emit_bytes([
       kTypeSectionCode,  // section id
       1,                 // section length
       0                  // number of types
-  );
-  bytes.push(
+  ]);
+  bytes.emit_bytes([
       kFunctionSectionCode,  // section id
       1,                     // section length
       0                      // number of functions
-  );
-  bytes.push(
+  ]);
+  bytes.emit_bytes([
       kCodeSectionCode,  // section id
       20,                // section length (arbitrary value > 6)
-  );
+  ]);
   // Functions count
-  bytes.push(0x80, 0x80, 0x80, 0x80, 0x80, 0x00);
+  bytes.emit_bytes([0x80, 0x80, 0x80, 0x80, 0x80, 0x00]);
 
   let pos = bytes.length - 1 - 1;
   testErrorPosition(bytes, pos, 'testFunctionsCountInvalidVarint');
@@ -106,20 +89,20 @@
 (function testFunctionsCountTooBig() {
   let bytes = new Binary;
   bytes.emit_header();
-  bytes.push(
+  bytes.emit_bytes([
       kTypeSectionCode,  // section id
       1,                 // section length
       0                  // number of types
-  );
-  bytes.push(
+  ]);
+  bytes.emit_bytes([
       kFunctionSectionCode,  // section id
       1,                     // section length
       0                      // number of functions
-  );
-  bytes.push(
+  ]);
+  bytes.emit_bytes([
       kCodeSectionCode,  // section id
       20,                // section length (arbitrary value > 6)
-  );
+  ]);
   // Functions count
   bytes.emit_u32v(0xffffff23);
 
@@ -130,20 +113,20 @@
 (function testFunctionsCountDoesNotMatch() {
   let bytes = new Binary;
   bytes.emit_header();
-  bytes.push(
+  bytes.emit_bytes([
       kTypeSectionCode,  // section id
       1,                 // section length
       0                  // number of types
-  );
-  bytes.push(
+  ]);
+  bytes.emit_bytes([
       kFunctionSectionCode,  // section id
       1,                     // section length
       0                      // number of functions
-  );
-  bytes.push(
+  ]);
+  bytes.emit_bytes([
       kCodeSectionCode,  // section id
       20,                // section length (arbitrary value > 6)
-  );
+  ]);
   // Functions count (different than the count in the functions section.
   bytes.emit_u32v(5);
 
@@ -154,27 +137,27 @@
 (function testBodySizeInvalidVarint() {
   let bytes = new Binary;
   bytes.emit_header();
-  bytes.push(
+  bytes.emit_bytes([
       kTypeSectionCode,       // section id
       4,                      // section length
       1,                      // number of types
       kWasmFunctionTypeForm,  // type
       0,                      // number of parameter
       0                       // number of returns
-  );
-  bytes.push(
+  ]);
+  bytes.emit_bytes([
       kFunctionSectionCode,  // section id
       2,                     // section length
       1,                     // number of functions
       0                      // signature index
-  );
-  bytes.push(
+  ]);
+  bytes.emit_bytes([
       kCodeSectionCode,  // section id
       20,                // section length (arbitrary value > 6)
       1                  // functions count
-  );
+  ]);
   // Invalid function body size.
-  bytes.push(0x80, 0x80, 0x80, 0x80, 0x80, 0x00);
+  bytes.emit_bytes([0x80, 0x80, 0x80, 0x80, 0x80, 0x00]);
 
   let pos = bytes.length - 1 - 1;
   testErrorPosition(bytes, pos, 'testBodySizeInvalidVarint');
@@ -183,25 +166,25 @@
 (function testBodySizeTooBig() {
   let bytes = new Binary;
   bytes.emit_header();
-  bytes.push(
+  bytes.emit_bytes([
       kTypeSectionCode,       // section id
       4,                      // section length
       1,                      // number of types
       kWasmFunctionTypeForm,  // type
       0,                      // number of parameter
       0                       // number of returns
-  );
-  bytes.push(
+  ]);
+  bytes.emit_bytes([
       kFunctionSectionCode,  // section id
       2,                     // section length
       1,                     // number of functions
       0                      // signature index
-  );
-  bytes.push(
+  ]);
+  bytes.emit_bytes([
       kCodeSectionCode,  // section id
       20,                // section length (arbitrary value > 6)
       1                  // functions count
-  );
+  ]);
   // Invalid function body size.
   bytes.emit_u32v(0xffffff23);
 
@@ -212,25 +195,25 @@
 (function testBodySizeDoesNotFit() {
   let bytes = new Binary;
   bytes.emit_header();
-  bytes.push(
+  bytes.emit_bytes([
       kTypeSectionCode,       // section id
       4,                      // section length
       1,                      // number of types
       kWasmFunctionTypeForm,  // type
       0,                      // number of parameter
       0                       // number of returns
-  );
-  bytes.push(
+  ]);
+  bytes.emit_bytes([
       kFunctionSectionCode,  // section id
       2,                     // section length
       1,                     // number of functions
       0                      // signature index
-  );
-  bytes.push(
+  ]);
+  bytes.emit_bytes([
       kCodeSectionCode,  // section id
       20,                // section length (arbitrary value > 6)
       1                  // functions count
-  );
+  ]);
   // Invalid function body size (does not fit into the code section).
   bytes.emit_u32v(20);
 
@@ -241,25 +224,25 @@
 (function testBodySizeIsZero() {
   let bytes = new Binary;
   bytes.emit_header();
-  bytes.push(
+  bytes.emit_bytes([
       kTypeSectionCode,       // section id
       4,                      // section length
       1,                      // number of types
       kWasmFunctionTypeForm,  // type
       0,                      // number of parameter
       0                       // number of returns
-  );
-  bytes.push(
+  ]);
+  bytes.emit_bytes([
       kFunctionSectionCode,  // section id
       2,                     // section length
       1,                     // number of functions
       0                      // signature index
-  );
-  bytes.push(
+  ]);
+  bytes.emit_bytes([
       kCodeSectionCode,  // section id
       20,                // section length (arbitrary value > 6)
       1                  // functions count
-  );
+  ]);
   // Invalid function body size (body size of 0 is invalid).
   bytes.emit_u32v(0);
 
@@ -270,28 +253,28 @@
 (function testStaleCodeSectionBytes() {
   let bytes = new Binary;
   bytes.emit_header();
-  bytes.push(
+  bytes.emit_bytes([
       kTypeSectionCode,       // section id
       4,                      // section length
       1,                      // number of types
       kWasmFunctionTypeForm,  // type
       0,                      // number of parameter
       0                       // number of returns
-  );
-  bytes.push(
+  ]);
+  bytes.emit_bytes([
       kFunctionSectionCode,  // section id
       2,                     // section length
       1,                     // number of functions
       0                      // signature index
-  );
-  bytes.push(
+  ]);
+  bytes.emit_bytes([
       kCodeSectionCode,  // section id
       20,                // section length (too big)
       1,                 // functions count
       2,                 // body size
       0,                 // locals count
       kExprEnd           // body
-  );
+  ]);
 
   let pos = bytes.length - 1;
   testErrorPosition(bytes, pos, 'testStaleCodeSectionBytes');
@@ -300,21 +283,21 @@
 (function testInvalidCode() {
   let bytes = new Binary;
   bytes.emit_header();
-  bytes.push(
+  bytes.emit_bytes([
       kTypeSectionCode,       // section id
       4,                      // section length
       1,                      // number of types
       kWasmFunctionTypeForm,  // type
       0,                      // number of parameter
       0                       // number of returns
-  );
-  bytes.push(
+  ]);
+  bytes.emit_bytes([
       kFunctionSectionCode,  // section id
       2,                     // section length
       1,                     // number of functions
       0                      // signature index
-  );
-  bytes.push(
+  ]);
+  bytes.emit_bytes([
       kCodeSectionCode,  // section id
       6,                 // section length (too big)
       1,                 // functions count
@@ -322,7 +305,7 @@
       0,                 // locals count
       kExprGetLocal, 0,  // Access a non-existing local
       kExprEnd           // --
-  );
+  ]);
 
   // Find error at the index of kExprGetLocal.
   let pos = bytes.length - 1 - 1;
@@ -332,24 +315,24 @@
 (function testCodeSectionSizeZero() {
   let bytes = new Binary;
   bytes.emit_header();
-  bytes.push(
+  bytes.emit_bytes([
       kTypeSectionCode,       // section id
       4,                      // section length
       1,                      // number of types
       kWasmFunctionTypeForm,  // type
       0,                      // number of parameter
       0                       // number of returns
-  );
-  bytes.push(
+  ]);
+  bytes.emit_bytes([
       kFunctionSectionCode,  // section id
       2,                     // section length
       1,                     // number of functions
       0                      // signature index
-  );
-  bytes.push(
+  ]);
+  bytes.emit_bytes([
       kCodeSectionCode,  // section id
       0,                 // section length (too big)
-  );
+  ]);
 
   // Find error at the index of kExprGetLocal.
   let pos = bytes.length - 1;
@@ -359,7 +342,7 @@
 (function testInvalidSection() {
   let bytes = new Binary;
   bytes.emit_header();
-  bytes.push(
+  bytes.emit_bytes([
       kTypeSectionCode,       // section id
       5,                      // section length
       1,                      // number of types
@@ -367,7 +350,7 @@
       1,                      // number of parameter
       0x7b,                   // invalid type
       0                       // number of returns
-  );
+  ]);
 
   let pos = bytes.length - 1 - 1;
   testErrorPosition(bytes, pos, 'testInvalidSection');
diff --git a/src/v8/test/mjsunit/wasm/streaming-trap-location.js b/src/v8/test/mjsunit/wasm/streaming-trap-location.js
index 1607ca7..5d693ae 100644
--- a/src/v8/test/mjsunit/wasm/streaming-trap-location.js
+++ b/src/v8/test/mjsunit/wasm/streaming-trap-location.js
@@ -2,6 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --wasm-test-streaming --wasm-async-compilation --expose-wasm
+// Flags: --wasm-test-streaming --expose-wasm
 
 load("test/mjsunit/wasm/trap-location.js");
diff --git a/src/v8/test/mjsunit/wasm/table-access-interpreter.js b/src/v8/test/mjsunit/wasm/table-access-interpreter.js
new file mode 100644
index 0000000..561ac5a
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/table-access-interpreter.js
@@ -0,0 +1,12 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --experimental-wasm-anyref
+// Flags: --wasm-interpret-all
+
+// This is just a wrapper for an existing reference types test case that runs
+// with the --wasm-interpret-all flag added. If we ever decide to add a test
+// variant for this, then we can remove this file.
+
+load("test/mjsunit/wasm/table-access.js");
diff --git a/src/v8/test/mjsunit/wasm/table-access.js b/src/v8/test/mjsunit/wasm/table-access.js
new file mode 100644
index 0000000..b91934d
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/table-access.js
@@ -0,0 +1,155 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --experimental-wasm-anyref
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function TestGetAndSet() {
+function addTableWithAccessors(builder, type, size, name) {
+  const table = builder.addTable(type, size);
+  const set_sig = makeSig([kWasmI32, type], []);
+  builder.addFunction('set_' + name, set_sig)
+      .addBody([kExprGetLocal, 0,
+          kExprGetLocal, 1,
+          kExprTableSet, table.index])
+      .exportFunc();
+
+  const get_sig = makeSig([kWasmI32], [type]);
+  builder.addFunction('get_' + name, get_sig)
+      .addBody([kExprGetLocal, 0, kExprTableGet, table.index])
+      .exportFunc();
+}
+
+const builder = new WasmModuleBuilder();
+
+addTableWithAccessors(builder, kWasmAnyFunc, 10, 'table_func1');
+addTableWithAccessors(builder, kWasmAnyRef, 20, 'table_ref1');
+addTableWithAccessors(builder, kWasmAnyRef, 9, 'table_ref2');
+addTableWithAccessors(builder, kWasmAnyFunc, 12, 'table_func2');
+
+let exports = builder.instantiate().exports;
+const dummy_ref = {foo : 1, bar : 3};
+const dummy_func = exports.set_table_func1;
+
+(function testTableGetInitialValue() {
+  print(arguments.callee.name);
+  // Tables are initialized with `null`.
+  assertSame(null, exports.get_table_func1(1));
+  assertSame(null, exports.get_table_func2(2));
+  assertSame(null, exports.get_table_ref1(3));
+  assertSame(null, exports.get_table_ref2(4));
+})();
+
+(function testTableGetOOB() {
+  print(arguments.callee.name);
+  assertSame(null, exports.get_table_func2(11));
+  assertTraps(kTrapTableOutOfBounds, () => exports.get_table_func1(11));
+  assertTraps(kTrapTableOutOfBounds, () => exports.get_table_func2(21));
+  assertTraps(kTrapTableOutOfBounds, () => exports.get_table_func1(-1));
+  assertTraps(kTrapTableOutOfBounds, () => exports.get_table_func2(-2));
+  assertSame(null, exports.get_table_ref1(14));
+  assertTraps(kTrapTableOutOfBounds, () => exports.get_table_ref2(14));
+  assertTraps(kTrapTableOutOfBounds, () => exports.get_table_ref1(44));
+  assertTraps(kTrapTableOutOfBounds, () => exports.get_table_ref2(-1));
+  assertTraps(kTrapTableOutOfBounds, () => exports.get_table_ref1(-4));
+})();
+
+(function testTableSetOOB() {
+  print(arguments.callee.name);
+  exports.set_table_func2(11, dummy_func);
+  assertTraps(kTrapTableOutOfBounds, () => exports.set_table_func1(11, dummy_func));
+  assertTraps(kTrapTableOutOfBounds, () => exports.set_table_func2(21, dummy_func));
+  exports.set_table_ref1(14, dummy_ref);
+  assertTraps(kTrapTableOutOfBounds, () => exports.set_table_ref2(14, dummy_ref));
+  assertTraps(kTrapTableOutOfBounds, () => exports.set_table_ref1(44, dummy_ref));
+})();
+
+(function testTableSet() {
+  print(arguments.callee.name);
+  assertSame(null, exports.get_table_func1(3));
+  exports.set_table_func1(3, dummy_func);
+  assertSame(dummy_func, exports.get_table_func1(3));
+  assertSame(null, exports.get_table_func2(3));
+
+  assertSame(null, exports.get_table_func2(7));
+  exports.set_table_func2(7, dummy_func);
+  assertSame(dummy_func, exports.get_table_func2(7));
+  assertSame(null, exports.get_table_func1(7));
+
+  assertSame(null, exports.get_table_ref1(3));
+  exports.set_table_ref1(3, dummy_ref);
+  assertSame(dummy_ref, exports.get_table_ref1(3));
+  assertSame(null, exports.get_table_ref2(3));
+
+  assertSame(null, exports.get_table_ref2(7));
+  exports.set_table_ref2(7, dummy_ref);
+  assertSame(dummy_ref, exports.get_table_ref2(7));
+  assertSame(null, exports.get_table_ref1(7));
+})();
+
+(function testSetFunctionTableInvalidType() {
+  print(arguments.callee.name);
+  assertThrows(() => exports.set_table_func2(7, dummy_ref), TypeError);
+})();
+})();
+
+(function testGetFunctionFromInitializedTable() {
+  print(arguments.callee.name);
+  const value1 = 11;
+  const value2 = 22;
+  const value3 = 13;
+
+  const builder = new WasmModuleBuilder();
+  const t1 = builder.addTable(kWasmAnyFunc, 10).index;
+  const t2 = builder.addTable(kWasmAnyFunc, 12).index;
+
+  const f1 = builder.addFunction('f', kSig_i_v).addBody([kExprI32Const, value1]);
+  const f2 = builder.addFunction('f', kSig_i_v).addBody([kExprI32Const, value2]);
+  const f3 = builder.addFunction('f', kSig_i_v).addBody([kExprI32Const, value3]);
+  builder.addFunction('get_t1', kSig_a_i)
+      .addBody([kExprGetLocal, 0, kExprTableGet, t1])
+      .exportFunc();
+  builder.addFunction('get_t2', kSig_a_i)
+      .addBody([kExprGetLocal, 0, kExprTableGet, t2])
+      .exportFunc();
+
+  const offset1 = 3;
+  const offset2 = 9;
+  builder.addElementSegment(t1, offset1, false, [f1.index, f2.index]);
+  builder.addElementSegment(t2, offset2, false, [f3.index, f1.index]);
+
+  const instance = builder.instantiate();
+
+  assertEquals(value1, instance.exports.get_t1(offset1)());
+  assertEquals(value2, instance.exports.get_t1(offset1 + 1)());
+  assertEquals(value3, instance.exports.get_t2(offset2)());
+  assertEquals(value1, instance.exports.get_t2(offset2 + 1)());
+})();
+
+(function testRefFuncInTableIsCallable() {
+  print(arguments.callee.name);
+  const expected = 54;
+  const index = 3;
+  const builder = new WasmModuleBuilder();
+  const table_index = builder.addTable(kWasmAnyFunc, 15, 15).index;
+  const sig_index = builder.addType(kSig_i_v);
+  const function_index = builder.addFunction('hidden', sig_index)
+                             .addBody([kExprI32Const, expected])
+                             .index;
+
+  builder.addFunction('main', kSig_i_v)
+      .addBody([
+        kExprI32Const, index,                      // entry index
+        kExprRefFunc, function_index,              // function reference
+        kExprTableSet, table_index,                // --
+        kExprI32Const, index,                      // entry index
+        kExprCallIndirect, sig_index, table_index  // --
+
+      ])
+      .exportFunc();
+
+  const instance = builder.instantiate();
+  assertEquals(expected, instance.exports.main());
+})();
diff --git a/src/v8/test/mjsunit/wasm/table-copy-anyref.js b/src/v8/test/mjsunit/wasm/table-copy-anyref.js
new file mode 100644
index 0000000..d5cddb3
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/table-copy-anyref.js
@@ -0,0 +1,73 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-bulk-memory --experimental-wasm-anyref
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+let kTableSize = 5;
+
+let table = new WebAssembly.Table(
+    {element: 'anyref', initial: kTableSize, maximum: kTableSize});
+
+let builder = new WasmModuleBuilder();
+builder.addImportedTable('m', 'table', kTableSize, kTableSize, kWasmAnyRef);
+builder.addTable(kWasmAnyFunc, 1000);
+
+builder.addFunction('copy', kSig_v_iii)
+    .addBody([
+      kExprGetLocal, 0, kExprGetLocal, 1, kExprGetLocal, 2, kNumericPrefix,
+      kExprTableCopy, kTableZero, kTableZero
+    ])
+    .exportFunc();
+
+const instance = builder.instantiate({m: {table: table}});
+
+function resetTable() {
+  table.set(0, 1000);
+  table.set(1, 1001);
+  table.set(2, 1002);
+  table.set(3, 1003);
+  table.set(4, 1004);
+}
+
+function assertTable(values) {
+  for (let i = 0; i < kTableSize; ++i) {
+    assertEquals(table.get(i), values[i]);
+  }
+}
+
+resetTable();
+instance.exports.copy(0, 1, 1);
+assertTable([1001, 1001, 1002, 1003, 1004]);
+
+resetTable();
+instance.exports.copy(0, 1, 2);
+assertTable([1001, 1002, 1002, 1003, 1004]);
+
+resetTable();
+instance.exports.copy(3, 0, 2);
+assertTable([1000, 1001, 1002, 1000, 1001]);
+
+// Non-overlapping, src < dst. Because of src < dst, we copy backwards.
+// Therefore the first access already traps, and the table is not changed.
+resetTable();
+assertTraps(kTrapTableOutOfBounds, () => instance.exports.copy(3, 0, 3));
+assertTable([1000, 1001, 1002, 1003, 1004]);
+
+// Non-overlapping, dst < src.
+resetTable();
+assertTraps(kTrapTableOutOfBounds, () => instance.exports.copy(0, 4, 2));
+assertTable([1004, 1001, 1002, 1003, 1004]);
+
+// Overlapping, src < dst. This is required to copy backward, but the first
+// access will be out-of-bounds, so nothing changes.
+resetTable();
+assertTraps(kTrapTableOutOfBounds, () => instance.exports.copy(3, 0, 99));
+assertTable([1000, 1001, 1002, 1003, 1004]);
+
+// Overlapping, dst < src.
+resetTable();
+assertTraps(kTrapTableOutOfBounds, () => instance.exports.copy(0, 1, 99));
+assertTable([1001, 1002, 1003, 1004, 1004]);
diff --git a/src/v8/test/mjsunit/wasm/table-copy.js b/src/v8/test/mjsunit/wasm/table-copy.js
new file mode 100644
index 0000000..db0dc83
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/table-copy.js
@@ -0,0 +1,104 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-bulk-memory
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+function addFunction(builder, k) {
+  let m = builder.addFunction("", kSig_i_v)
+      .addBody([...wasmI32Const(k)]);
+  return m;
+}
+
+function assertCall(call, ...elems) {
+  for (var i = 0; i < elems.length; i++) {
+    assertEquals(elems[i], call(i));
+  }
+}
+
+(function TestTableCopyShared() {
+  print(arguments.callee.name);
+  let kTableSize = 5;
+
+  let table = new WebAssembly.Table({element: "anyfunc",
+                                     initial: kTableSize,
+                                     maximum: kTableSize});
+
+  let module = (() => {
+    let builder = new WasmModuleBuilder();
+    let sig_v_iii = builder.addType(kSig_v_iii);
+    let sig_i_i = builder.addType(kSig_i_i);
+    let sig_i_v = builder.addType(kSig_i_v);
+
+    builder.addImportedTable("m", "table", kTableSize, kTableSize);
+    var g = builder.addImportedGlobal("m", "g", kWasmI32);
+
+    for (let i = 0; i < kTableSize; i++) {
+      let f = builder.addFunction("", kSig_i_v)
+          .addBody([
+            kExprGetGlobal, g,
+            ...wasmI32Const(i),
+            kExprI32Add
+          ]);
+      f.exportAs(`f${i}`);
+    }
+
+    builder.addFunction("copy", sig_v_iii)
+      .addBody([
+        kExprGetLocal, 0,
+        kExprGetLocal, 1,
+        kExprGetLocal, 2,
+        kNumericPrefix, kExprTableCopy, kTableZero, kTableZero])
+      .exportAs("copy");
+
+    builder.addFunction("call", sig_i_i)
+      .addBody([
+        kExprGetLocal, 0,
+        kExprCallIndirect, sig_i_v, kTableZero])
+      .exportAs("call");
+
+    return builder.toModule();
+  })();
+
+  // Two different instances with different globals, to verify that
+  // dispatch tables get updated with the right instance.
+  let x = new WebAssembly.Instance(module, {m: {g: 1000, table: table}});
+  let y = new WebAssembly.Instance(module, {m: {g: 2000, table: table}});
+
+  let x_call = x.exports.call;
+  let y_call = y.exports.call;
+
+  assertNotEquals(x.exports.f3, y.exports.f3);
+
+  table.set(0, x.exports.f0);
+  table.set(1, x.exports.f1);
+  table.set(2, x.exports.f2);
+  table.set(3, y.exports.f3);
+  table.set(4, y.exports.f4);
+
+  assertEquals(2003, table.get(3)(3));
+  assertEquals(2003, x_call(3));
+  assertEquals(2003, y_call(3));
+
+  // Check that calling copy on either of them updates the dispatch table
+  // on both of them.
+  assertCall(x_call, 1000, 1001, 1002, 2003, 2004);
+  assertCall(y_call, 1000, 1001, 1002, 2003, 2004);
+
+  x.exports.copy(0, 1, 1);
+
+  assertCall(x_call, 1001, 1001, 1002, 2003, 2004);
+  assertCall(y_call, 1001, 1001, 1002, 2003, 2004);
+
+  y.exports.copy(0, 1, 2);
+
+  assertCall(x_call, 1001, 1002, 1002, 2003, 2004);
+  assertCall(y_call, 1001, 1002, 1002, 2003, 2004);
+
+  x.exports.copy(3, 0, 2);
+
+  assertCall(x_call, 1001, 1002, 1002, 1001, 1002);
+  assertCall(y_call, 1001, 1002, 1002, 1001, 1002);
+})();
diff --git a/src/v8/test/mjsunit/wasm/table-fill-interpreter.js b/src/v8/test/mjsunit/wasm/table-fill-interpreter.js
new file mode 100644
index 0000000..ed9c48b
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/table-fill-interpreter.js
@@ -0,0 +1,12 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --experimental-wasm-anyref
+// Flags: --wasm-interpret-all
+
+// This is just a wrapper for an existing reference types test case that runs
+// with the --wasm-interpret-all flag added. If we ever decide to add a test
+// variant for this, then we can remove this file.
+
+load("test/mjsunit/wasm/table-fill.js");
diff --git a/src/v8/test/mjsunit/wasm/table-fill.js b/src/v8/test/mjsunit/wasm/table-fill.js
new file mode 100644
index 0000000..ed5938f
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/table-fill.js
@@ -0,0 +1,200 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --experimental-wasm-anyref
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+function dummy_func(val) {
+  let builder = new WasmModuleBuilder();
+  builder.addFunction('dummy', kSig_i_v)
+      .addBody([kExprI32Const, val])
+      .exportAs('dummy');
+  return builder.instantiate().exports.dummy;
+}
+
+let kSig_v_iri = makeSig([kWasmI32, kWasmAnyRef, kWasmI32], []);
+let kSig_v_iai = makeSig([kWasmI32, kWasmAnyFunc, kWasmI32], []);
+let kSig_r_i = makeSig([kWasmI32], [kWasmAnyRef]);
+
+const builder = new WasmModuleBuilder();
+const size = 10;
+const maximum = size;
+const import_ref =
+    builder.addImportedTable('imp', 'table_ref', size, maximum, kWasmAnyRef);
+const import_func =
+    builder.addImportedTable('imp', 'table_func', size, maximum, kWasmAnyFunc);
+const internal_ref = builder.addTable(kWasmAnyRef, size, maximum).index;
+const internal_func = builder.addTable(kWasmAnyFunc, size, maximum).index;
+
+// Add fill and get functions for the anyref tables.
+for (index of [import_ref, internal_ref]) {
+  builder.addFunction(`fill${index}`, kSig_v_iri)
+      .addBody([
+        kExprGetLocal, 0, kExprGetLocal, 1, kExprGetLocal, 2, kNumericPrefix,
+        kExprTableFill, index
+      ])
+      .exportFunc();
+
+  builder.addFunction(`get${index}`, kSig_r_i)
+      .addBody([kExprGetLocal, 0, kExprTableGet, index])
+      .exportFunc();
+}
+
+// Add fill and call functions for the anyfunc tables.
+const sig_index = builder.addType(kSig_i_v);
+for (index of [import_func, internal_func]) {
+  builder.addFunction(`fill${index}`, kSig_v_iai)
+      .addBody([
+        kExprGetLocal, 0, kExprGetLocal, 1, kExprGetLocal, 2, kNumericPrefix,
+        kExprTableFill, index
+      ])
+      .exportFunc();
+
+  builder.addFunction(`call${index}`, kSig_i_i)
+      .addBody([kExprGetLocal, 0, kExprCallIndirect, sig_index, index])
+      .exportFunc();
+}
+
+const table_ref =
+    new WebAssembly.Table({element: 'anyref', initial: size, maximum: maximum});
+const table_func = new WebAssembly.Table(
+    {element: 'anyfunc', initial: size, maximum: maximum});
+
+const instance =
+    builder.instantiate({imp: {table_ref: table_ref, table_func: table_func}});
+
+function checkAnyRefTable(getter, start, count, value) {
+  for (i = 0; i < count; ++i) {
+    assertEquals(value, getter(start + i));
+  }
+}
+
+(function testAnyRefTableIsUninitialized() {
+  print(arguments.callee.name);
+
+  checkAnyRefTable(instance.exports[`get${import_ref}`], 0, size, null);
+  checkAnyRefTable(instance.exports[`get${internal_ref}`], 0, size, null);
+})();
+
+(function testAnyRefTableFill() {
+  print(arguments.callee.name);
+  // Fill table and check the content.
+  let start = 1;
+  let value = {foo: 23};
+  let count = 3;
+  instance.exports[`fill${import_ref}`](start, value, count);
+  checkAnyRefTable(instance.exports[`get${import_ref}`], start, count, value);
+  value = 'foo';
+  instance.exports[`fill${internal_ref}`](start, value, count);
+  checkAnyRefTable(instance.exports[`get${internal_ref}`], start, count, value);
+})();
+
+(function testAnyRefTableFillOOB() {
+  print(arguments.callee.name);
+  // Fill table out-of-bounds, check if the table got filled as much as
+  // possible.
+  let start = 7;
+  let value = {foo: 27};
+  // {maximum + 4} elements definitely don't fit into the table.
+  let count = maximum + 4;
+  assertTraps(
+      kTrapTableOutOfBounds,
+      () => instance.exports[`fill${import_ref}`](start, value, count));
+  checkAnyRefTable(
+      instance.exports[`get${import_ref}`], start, size - start, value);
+
+  value = 45;
+  assertTraps(
+      kTrapTableOutOfBounds,
+      () => instance.exports[`fill${internal_ref}`](start, value, count));
+  checkAnyRefTable(
+      instance.exports[`get${internal_ref}`], start, size - start, value);
+})();
+
+(function testAnyRefTableFillOOBCountZero() {
+  print(arguments.callee.name);
+  // Fill 0 elements at an oob position. This should trap.
+  let start = size + 32;
+  let value = 'bar';
+  assertTraps(
+      kTrapTableOutOfBounds,
+      () => instance.exports[`fill${import_ref}`](start, value, 0));
+  assertTraps(
+      kTrapTableOutOfBounds,
+      () => instance.exports[`fill${internal_ref}`](start, value, 0));
+})();
+
+function checkAnyFuncTable(call, start, count, value) {
+  for (i = 0; i < count; ++i) {
+    if (value) {
+      assertEquals(value, call(start + i));
+    } else {
+      assertTraps(kTrapFuncSigMismatch, () => call(start + i));
+    }
+  }
+}
+
+(function testAnyRefTableIsUninitialized() {
+  print(arguments.callee.name);
+  // Check that the table is uninitialized.
+  checkAnyFuncTable(instance.exports[`call${import_func}`], 0, size);
+  checkAnyFuncTable(instance.exports[`call${internal_func}`], 0, size);
+})();
+
+(function testAnyFuncTableFill() {
+  print(arguments.callee.name);
+  // Fill and check the result.
+  let start = 1;
+  let value = 44;
+  let count = 3;
+  instance.exports[`fill${import_func}`](start, dummy_func(value), count);
+  checkAnyFuncTable(
+      instance.exports[`call${import_func}`], start, count, value);
+  value = 21;
+  instance.exports[`fill${internal_func}`](start, dummy_func(value), count);
+  checkAnyFuncTable(
+      instance.exports[`call${internal_func}`], start, count, value);
+})();
+
+(function testAnyFuncTableFillOOB() {
+  print(arguments.callee.name);
+  // Fill table out-of-bounds, check if the table got filled as much as
+  // possible.
+  let start = 7;
+  let value = 38;
+  // {maximum + 4} elements definitely don't fit into the table.
+  let count = maximum + 4;
+  assertTraps(
+      kTrapTableOutOfBounds,
+      () => instance.exports[`fill${import_func}`](
+          start, dummy_func(value), count));
+  checkAnyFuncTable(
+      instance.exports[`call${import_func}`], start, size - start, value);
+
+  value = 46;
+  assertTraps(
+      kTrapTableOutOfBounds,
+      () => instance.exports[`fill${internal_func}`](
+          start, dummy_func(value), count));
+  checkAnyFuncTable(
+      instance.exports[`call${internal_func}`], start, size - start, value);
+})();
+
+(function testAnyFuncTableFillOOBCountZero() {
+  print(arguments.callee.name);
+  // Fill 0 elements at an oob position. This should trap.
+  let start = size + 32;
+  let value = dummy_func(33);
+  assertTraps(
+      kTrapTableOutOfBounds,
+      () => instance.exports[`fill${import_func}`](start, null, 0));
+  assertTraps(
+      kTrapTableOutOfBounds,
+      () => instance.exports[`fill${internal_func}`](start, null, 0));
+
+  // Check that table.fill at position `size` is still valid.
+  instance.exports[`fill${import_func}`](size, null, 0);
+  instance.exports[`fill${internal_func}`](size, null, 0);
+})();
diff --git a/src/v8/test/mjsunit/wasm/table-get.js b/src/v8/test/mjsunit/wasm/table-get.js
new file mode 100644
index 0000000..9ec0667
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/table-get.js
@@ -0,0 +1,132 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function testTableGetNonExportedFunction() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const table = builder.addTable(kWasmAnyFunc, 20).exportAs("table");
+  const f1 = builder.addFunction('f', kSig_i_v).addBody([kExprI32Const, 11]);
+  const f2 = builder.addFunction('f', kSig_i_v).addBody([kExprI32Const, 22]);
+  const offset = 3;
+  builder.addElementSegment(0, offset, false, [f1.index, f2.index]);
+
+  const instance = builder.instantiate();
+
+  const table_function2 = instance.exports.table.get(offset + 1);
+  assertEquals(22, table_function2());
+})();
+
+(function testTableGetExportedFunction() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const table = builder.addTable(kWasmAnyFunc, 20).exportAs("table");
+  const f1 = builder.addFunction('f', kSig_i_v).addBody([kExprI32Const, 11]);
+  const f2 = builder.addFunction('f', kSig_i_v).addBody([kExprI32Const, 22])
+                    .exportAs("f2");
+  const offset = 3;
+  builder.addElementSegment(0, offset, false, [f1.index, f2.index]);
+
+  const instance = builder.instantiate();
+
+  const table_function2 = instance.exports.table.get(offset + 1);
+  assertEquals(22, table_function2());
+})();
+
+(function testTableGetOverlappingSegments() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const table = builder.addTable(kWasmAnyFunc, 20).exportAs("table");
+  const f1 = builder.addFunction('f', kSig_i_v).addBody([kExprI32Const, 11]);
+  const f2 = builder.addFunction('f', kSig_i_v).addBody([kExprI32Const, 22]);
+  const offset = 3;
+  builder.addElementSegment(0, offset, false, [f1.index, f2.index]);
+  builder.addElementSegment(0, offset + 1, false, [f1.index, f2.index]);
+
+  const instance = builder.instantiate();
+
+  const table_function1 = instance.exports.table.get(offset + 1);
+  assertEquals(11, table_function1());
+})();
+
+(function testTableGetUniqueWrapperExportedFunction() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const table = builder.addTable(kWasmAnyFunc, 20).exportAs("table");
+  const f1 = builder.addFunction('f', kSig_i_v).addBody([kExprI32Const, 11]).exportAs("f1");
+  const f2 = builder.addFunction('f', kSig_i_v).addBody([kExprI32Const, 22]);
+  const offset = 3;
+  builder.addElementSegment(0, offset, false, [f1.index, f1.index, f1.index]);
+
+  const instance = builder.instantiate();
+
+  assertEquals(undefined, instance.exports.f1.tag);
+  const my_tag = { hello: 15 };
+  instance.exports.f1.tag = my_tag;
+
+  assertSame(my_tag, instance.exports.table.get(offset).tag);
+  assertSame(my_tag, instance.exports.table.get(offset + 1).tag);
+  assertSame(my_tag, instance.exports.table.get(offset + 2).tag);
+})();
+
+(function testTableGetUniqueWrapperNonExportedFunction() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const table = builder.addTable(kWasmAnyFunc, 20).exportAs("table");
+  const f1 = builder.addFunction('f', kSig_i_v).addBody([kExprI32Const, 11]);
+  const f2 = builder.addFunction('f', kSig_i_v).addBody([kExprI32Const, 22]);
+  const offset = 3;
+  builder.addElementSegment(0, offset, false, [f1.index, f1.index, f1.index]);
+
+  const instance = builder.instantiate();
+
+  assertEquals(undefined, instance.exports.table.get(offset).tag);
+  const my_tag = { hello: 15 };
+  instance.exports.table.get(offset).tag = my_tag;
+
+  assertSame(my_tag, instance.exports.table.get(offset + 1).tag);
+  assertSame(my_tag, instance.exports.table.get(offset + 2).tag);
+})();
+
+(function testTableGetEmptyValue() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const table = builder.addTable(kWasmAnyFunc, 20).exportAs("table");
+  const f1 = builder.addFunction('f', kSig_i_v).addBody([kExprI32Const, 11]);
+  const f2 = builder.addFunction('f', kSig_i_v).addBody([kExprI32Const, 22]);
+  const offset = 3;
+  builder.addElementSegment(0, offset, false, [f1.index, f1.index, f1.index]);
+
+  const instance = builder.instantiate();
+  assertEquals(null, instance.exports.table.get(offset - 1));
+})();
+
+(function testTableGetOOB() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const size = 20;
+  const table = builder.addTable(kWasmAnyFunc, size).exportAs("table");
+  const f1 = builder.addFunction('f', kSig_i_v).addBody([kExprI32Const, 11]);
+  const f2 = builder.addFunction('f', kSig_i_v).addBody([kExprI32Const, 22]);
+  const offset = 3;
+  builder.addElementSegment(0, offset, false, [f1.index, f1.index, f1.index]);
+
+  const instance = builder.instantiate();
+  assertThrows(() => instance.exports.table.get(size + 3), RangeError);
+})();
+
+(function testTableGetImportedFunction() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const size = 20;
+  const table = builder.addTable(kWasmAnyFunc, size).exportAs("table");
+  const import1 = builder.addImport("q", "fun", kSig_i_ii);
+  const f1 = builder.addFunction('f', kSig_i_v).addBody([kExprI32Const, 11]);
+  const offset = 3;
+  builder.addElementSegment(0, offset, false, [f1.index, import1]);
+
+  const instance = builder.instantiate({q: {fun: () => 33}});
+  assertEquals(33, instance.exports.table.get(offset + 1)());
+})();
diff --git a/src/v8/test/mjsunit/wasm/table-grow-from-wasm-interpreter.js b/src/v8/test/mjsunit/wasm/table-grow-from-wasm-interpreter.js
new file mode 100644
index 0000000..15bbc63
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/table-grow-from-wasm-interpreter.js
@@ -0,0 +1,12 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --experimental-wasm-anyref
+// Flags: --wasm-interpret-all
+
+// This is just a wrapper for an existing reference types test case that runs
+// with the --wasm-interpret-all flag added. If we ever decide to add a test
+// variant for this, then we can remove this file.
+
+load("test/mjsunit/wasm/table-grow-from-wasm.js");
diff --git a/src/v8/test/mjsunit/wasm/table-grow-from-wasm.js b/src/v8/test/mjsunit/wasm/table-grow-from-wasm.js
new file mode 100644
index 0000000..5b37af3
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/table-grow-from-wasm.js
@@ -0,0 +1,240 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --experimental-wasm-anyref
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+function dummy_func(val) {
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("dummy", kSig_i_v)
+    .addBody([kExprI32Const, val])
+    .exportAs("dummy");
+  return builder.instantiate().exports.dummy;
+}
+
+let kSig_i_ri = makeSig([kWasmAnyRef, kWasmI32], [kWasmI32]);
+let kSig_r_i = makeSig([kWasmI32], [kWasmAnyRef]);
+let kSig_i_ai = makeSig([kWasmAnyFunc, kWasmI32], [kWasmI32]);
+
+function testGrowInternalAnyRefTable(table_index) {
+  print(arguments.callee.name, table_index);
+
+  const builder = new WasmModuleBuilder();
+  const initial_size = 5;
+  // Add 10 tables, we only test one.
+  for (let i = 0; i < 10; ++i) {
+    builder.addTable(kWasmAnyRef, initial_size).index;
+  }
+  builder.addFunction('grow', kSig_i_ri)
+    .addBody([kExprGetLocal, 0,
+      kExprGetLocal, 1,
+      kNumericPrefix, kExprTableGrow, table_index])
+    .exportFunc();
+
+  builder.addFunction('size', kSig_i_v)
+    .addBody([kNumericPrefix, kExprTableSize, table_index])
+    .exportFunc();
+
+  builder.addFunction('get', kSig_r_i)
+    .addBody([kExprGetLocal, 0, kExprTableGet, table_index])
+    .exportFunc();
+
+  const instance = builder.instantiate();
+
+  let size = initial_size;
+  assertEquals(null, instance.exports.get(size - 2));
+
+  function growAndCheck(element, grow_by) {
+    assertEquals(size, instance.exports.size());
+    assertTraps(kTrapTableOutOfBounds, () => instance.exports.get(size));
+    assertEquals(size, instance.exports.grow(element, grow_by));
+    for (let i = 0; i < grow_by; ++i) {
+      assertEquals(element, instance.exports.get(size + i));
+    }
+    size += grow_by;
+  }
+  growAndCheck("Hello", 3);
+  growAndCheck(undefined, 4);
+  growAndCheck(4, 2);
+  growAndCheck({Hello: "World"}, 3);
+  growAndCheck(null, 2);
+}
+
+testGrowInternalAnyRefTable(0);
+testGrowInternalAnyRefTable(7);
+testGrowInternalAnyRefTable(9);
+
+function testGrowInternalAnyFuncTable(table_index) {
+  print(arguments.callee.name, table_index);
+
+  const builder = new WasmModuleBuilder();
+  let size = 5;
+  for (let i = 0; i < 10; ++i) {
+    builder.addTable(kWasmAnyFunc, size).index;
+  }
+  builder.addFunction('grow', kSig_i_ai)
+    .addBody([kExprGetLocal, 0,
+      kExprGetLocal, 1,
+      kNumericPrefix, kExprTableGrow, table_index])
+    .exportFunc();
+
+  builder.addFunction('size', kSig_i_v)
+    .addBody([kNumericPrefix, kExprTableSize, table_index])
+    .exportFunc();
+
+  const sig_index = builder.addType(kSig_i_v);
+  builder.addFunction('call', kSig_i_i)
+    .addBody([kExprGetLocal, 0, kExprCallIndirect, sig_index, table_index])
+    .exportFunc();
+
+  const instance = builder.instantiate();
+  assertTraps(kTrapFuncSigMismatch, () => instance.exports.call(size - 2));
+  function growAndCheck(element, grow_by) {
+    assertEquals(size, instance.exports.size());
+    assertTraps(kTrapFuncInvalid, () => instance.exports.call(size));
+    assertEquals(size, instance.exports.grow(dummy_func(element), grow_by));
+    for (let i = 0; i < grow_by; ++i) {
+      assertEquals(element, instance.exports.call(size + i));
+    }
+    size += grow_by;
+  }
+  growAndCheck(56, 3);
+  growAndCheck(12, 4);
+
+  assertEquals(size, instance.exports.grow(null, 1));
+  assertTraps(kTrapFuncSigMismatch, () => instance.exports.call(size));
+}
+
+testGrowInternalAnyFuncTable(0);
+testGrowInternalAnyFuncTable(7);
+testGrowInternalAnyFuncTable(9);
+
+(function testGrowImportedTable() {
+  print(arguments.callee.name);
+
+  let size = 3;
+  const builder = new WasmModuleBuilder();
+  const table_index = builder.addImportedTable("imp", "table", size, undefined, kWasmAnyRef);
+  builder.addFunction('grow', kSig_i_ri)
+    .addBody([kExprGetLocal, 0,
+      kExprGetLocal, 1,
+      kNumericPrefix, kExprTableGrow, table_index])
+    .exportFunc();
+
+  builder.addFunction('size', kSig_i_v)
+    .addBody([kNumericPrefix, kExprTableSize, table_index])
+    .exportFunc();
+
+  const table = new WebAssembly.Table({element: "anyref", initial: size});
+
+  const instance = builder.instantiate({imp: {table: table}});
+  assertEquals(null, table.get(size - 2));
+
+  function growAndCheck(element, grow_by) {
+    assertEquals(size, instance.exports.size());
+    assertEquals(size, instance.exports.grow(element, grow_by));
+    for (let i = 0; i < grow_by; ++i) {
+      assertEquals(element, table.get(size + i));
+    }
+    size += grow_by;
+  }
+  growAndCheck("Hello", 3);
+  growAndCheck(undefined, 4);
+  growAndCheck(4, 2);
+  growAndCheck({ Hello: "World" }, 3);
+  growAndCheck(null, 2);
+})();
+
+(function testGrowTableOutOfBounds() {
+  print(arguments.callee.name);
+
+  const initial = 3;
+  const maximum = 10;
+  const max_delta = maximum - initial;
+  const invalid_delta = max_delta + 1;
+
+  const builder = new WasmModuleBuilder();
+  const import_ref = builder.addImportedTable(
+    "imp", "table_ref", initial, maximum, kWasmAnyRef);
+  const import_func = builder.addImportedTable(
+    "imp", "table_func", initial, maximum, kWasmAnyFunc);
+  const internal_ref = builder.addTable(kWasmAnyRef, initial, maximum).index;
+  const internal_func = builder.addTable(kWasmAnyFunc, initial, maximum).index;
+
+  builder.addFunction('grow_imported_ref', kSig_i_ri)
+  .addBody([kExprGetLocal, 0,
+    kExprGetLocal, 1,
+    kNumericPrefix, kExprTableGrow, import_ref])
+  .exportFunc();
+
+  builder.addFunction('grow_imported_func', kSig_i_ai)
+  .addBody([kExprGetLocal, 0,
+    kExprGetLocal, 1,
+    kNumericPrefix, kExprTableGrow, import_func])
+  .exportFunc();
+
+  builder.addFunction('grow_internal_ref', kSig_i_ri)
+  .addBody([kExprGetLocal, 0,
+    kExprGetLocal, 1,
+    kNumericPrefix, kExprTableGrow, internal_ref])
+  .exportFunc();
+
+  builder.addFunction('grow_internal_func', kSig_i_ai)
+  .addBody([kExprGetLocal, 0,
+    kExprGetLocal, 1,
+    kNumericPrefix, kExprTableGrow, internal_func])
+  .exportFunc();
+
+  builder.addFunction('size_imported_ref', kSig_i_v)
+    .addBody([kNumericPrefix, kExprTableSize, import_ref])
+    .exportFunc();
+
+  builder.addFunction('size_imported_func', kSig_i_v)
+    .addBody([kNumericPrefix, kExprTableSize, import_func])
+    .exportFunc();
+
+  builder.addFunction('size_internal_ref', kSig_i_v)
+    .addBody([kNumericPrefix, kExprTableSize, internal_ref])
+    .exportFunc();
+
+  builder.addFunction('size_internal_func', kSig_i_v)
+    .addBody([kNumericPrefix, kExprTableSize, internal_func])
+    .exportFunc();
+
+  const table_ref = new WebAssembly.Table(
+    { element: "anyref", initial: initial, maximum: maximum });
+  const table_func = new WebAssembly.Table(
+    {element: "anyfunc", initial: initial, maximum: maximum});
+
+  const instance = builder.instantiate(
+    {imp: {table_ref: table_ref, table_func: table_func}});
+
+  const ref = { foo: "bar" };
+  const func = dummy_func(17);
+
+  // First check that growing out-of-bounds is not possible.
+  assertEquals(-1, instance.exports.grow_imported_ref(ref, invalid_delta));
+  assertEquals(initial, table_ref.length);
+  assertEquals(initial, instance.exports.size_imported_ref());
+  assertEquals(-1, instance.exports.grow_imported_func(func, invalid_delta));
+  assertEquals(initial, table_func.length);
+  assertEquals(initial, instance.exports.size_imported_func());
+  assertEquals(-1, instance.exports.grow_internal_ref(ref, invalid_delta));
+  assertEquals(initial, instance.exports.size_internal_ref());
+  assertEquals(-1, instance.exports.grow_internal_func(func, invalid_delta));
+  assertEquals(initial, instance.exports.size_internal_func());
+
+  // Check that we can grow to the maximum size.
+  assertEquals(initial, instance.exports.grow_imported_ref(ref, max_delta));
+  assertEquals(maximum, table_ref.length);
+  assertEquals(maximum, instance.exports.size_imported_ref());
+  assertEquals(initial, instance.exports.grow_imported_func(func, max_delta));
+  assertEquals(maximum, table_func.length);
+  assertEquals(maximum, instance.exports.size_imported_func());
+  assertEquals(initial, instance.exports.grow_internal_ref(ref, max_delta));
+  assertEquals(maximum, instance.exports.size_internal_ref());
+  assertEquals(initial, instance.exports.grow_internal_func(func, max_delta));
+  assertEquals(maximum, instance.exports.size_internal_func());
+})();
diff --git a/src/v8/test/mjsunit/wasm/table-grow.js b/src/v8/test/mjsunit/wasm/table-grow.js
index a9a4ba2..a8508b4 100644
--- a/src/v8/test/mjsunit/wasm/table-grow.js
+++ b/src/v8/test/mjsunit/wasm/table-grow.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 let kMaxTableSize = 10000000;
@@ -133,7 +132,7 @@
 
   builder.addImportedTable("q", "table", 5, 32);
   let g = builder.addImportedGlobal("q", "base", kWasmI32);
-  builder.addFunctionTableInit(g, true,
+  builder.addElementSegment(0, g, true,
       [funcs.mul.index, funcs.add.index, funcs.sub.index]);
   builder.addExportOfKind("table", kExternalTable, 0);
   let module = new WebAssembly.Module(builder.toBuffer());
@@ -179,10 +178,8 @@
   let i = builder.addImport("q", "exp_inc", sig_i_i);
   let t = builder.addImport("q", "exp_ten", sig_i_v);
 
-  builder.setFunctionTableBounds(7, 35);
-  // builder.addFunctionTableInit(g1, true,
-  //     [funcs.mul.index, funcs.add.index, funcs.sub.index]);
-  builder.addFunctionTableInit(g1, true, [a, i, t]);
+  builder.setTableBounds(7, 35);
+  builder.addElementSegment(0, g1, true, [a, i, t]);
 
   builder.addExportOfKind("table", kExternalTable, 0);
   let module = new WebAssembly.Module(builder.toBuffer());
@@ -195,41 +192,47 @@
     exp_add: exp_add, exp_inc: exp_inc, exp_ten: exp_ten}});
 
   let table = instance.exports.table;
-  exp_a = table.get(0);
-  exp_i = table.get(1);
-  exp_t = table.get(2);
 
-  assertEquals(exp_a(1, 4), 5);
-  assertEquals(exp_i(8), 9);
-  assertEquals(exp_t(0), 10);
+  print("   initial check");
+
+  function checkTableFunc(index, expected, ...args) {
+    let f = table.get(index);
+    print("  table[" + index + "] = " + f);
+    result = f(...args);
+    print("    -> expect " + expected + ", got " + result);
+    assertEquals(expected, result);
+  }
+
+  checkTableFunc(0, 5, 1, 4);
+  checkTableFunc(1, 9, 8);
+  checkTableFunc(2, 10, 0);
 
   let builder1 = new WasmModuleBuilder();
   let g = builder1.addImportedGlobal("q", "base", kWasmI32);
   let funcs = addFunctions(builder1);
 
   builder1.addImportedTable("q", "table", 6, 36);
-  builder1.addFunctionTableInit(g, true,
+  builder1.addElementSegment(0, g, true,
       [funcs.mul.index, funcs.add.index, funcs.sub.index]);
   let module1 = new WebAssembly.Module(builder1.toBuffer());
 
   function verifyTableFuncs(base) {
-    assertEquals(exp_a(1, 4), 5);
-    assertEquals(exp_i(8), 9);
-    assertEquals(exp_t(0), 10);
+    print("  base = " + base);
+    checkTableFunc(0, 5, 1, 4);
+    checkTableFunc(1, 9, 8);
+    checkTableFunc(2, 10, 0);
 
-    mul = table.get(base);
-    add = table.get(base + 1);
-    sub = table.get(base + 2);
-
-    assertEquals(20, mul(10, 2));
-    assertEquals(12, add(10, 2));
-    assertEquals(8, sub(10, 2));
+    checkTableFunc(base+0, 20, 10, 2); // mul
+    checkTableFunc(base+1, 12, 10, 2); // add
+    checkTableFunc(base+2,  8, 10, 2); // sub
   }
 
   for (let i = 3; i < 10; i++) {
     let instance1 = new WebAssembly.Instance(module1, {q: {base: i, table: table}});
     verifyTableFuncs(i);
-    assertEquals(table.length, table.grow(3));
+    var prev = table.length;
+    assertEquals(prev,     table.grow(3));
+    assertEquals(prev + 3, table.length);
     verifyTableFuncs(i);
 
     assertThrows(() => table.set(table.length, id), RangeError);
@@ -261,7 +264,7 @@
         kExprGetLocal, 0,
         kExprCallIndirect, index_i_ii, kTableZero])
       .exportAs("main");
-    builder.addFunctionTableInit(0, false, [0], true);
+    builder.addElementSegment(0, 0, false, [0]);
     return new WebAssembly.Module(builder.toBuffer());
   }
 
@@ -286,7 +289,7 @@
       assertInvalidFunction = function(s) {
         assertThrows(
             () => instances[i].exports.main(s), WebAssembly.RuntimeError,
-            /invalid function/);
+            kTrapMsgs[kTrapFuncInvalid]);
       }
       assertInvalidFunction(size);
       assertInvalidFunction(size + 1);
diff --git a/src/v8/test/mjsunit/wasm/table-limits.js b/src/v8/test/mjsunit/wasm/table-limits.js
new file mode 100644
index 0000000..7e31bf1
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/table-limits.js
@@ -0,0 +1,42 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-max-table-size=10
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+// With the flags we set the maximum table size to 10, so 11 is out-of-bounds.
+const oob = 11;
+
+(function TestJSTableInitialAboveTheLimit() {
+  print(arguments.callee.name);
+  assertThrows(
+    () => new WebAssembly.Table({ initial: oob, element: "anyfunc" }),
+    RangeError, /above the upper bound/);
+})();
+
+(function TestJSTableMaximumAboveTheLimit() {
+  print(arguments.callee.name);
+  assertThrows(
+    () => new WebAssembly.Table({ initial: 1, maximum: oob, element: "anyfunc" }),
+    RangeError, /above the upper bound/);
+})();
+
+(function TestDecodeTableInitialAboveTheLimit() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  builder.setTableBounds(oob);
+  assertThrows(
+    () => builder.instantiate(),
+    WebAssembly.CompileError, /is larger than implementation limit/);
+})();
+
+(function TestDecodeTableMaximumAboveTheLimit() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  builder.setTableBounds(1, oob);
+  assertThrows(
+    () => builder.instantiate(),
+    WebAssembly.CompileError, /is larger than implementation limit/);
+})();
diff --git a/src/v8/test/mjsunit/wasm/table.js b/src/v8/test/mjsunit/wasm/table.js
index 4724561..3ee33be 100644
--- a/src/v8/test/mjsunit/wasm/table.js
+++ b/src/v8/test/mjsunit/wasm/table.js
@@ -6,16 +6,12 @@
 
 'use strict';
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 // Basic tests.
 
-var outOfUint32RangeValue = 1e12;
-var int32ButOob = 1073741824;
-var kMaxUint32 = (4 * 1024 * 1024 * 1024) - 1;
-var kMaxUint31 = (2 * 1024 * 1024 * 1024) - 1;
-var kV8MaxWasmTableSize = 10000000;
+const outOfUint32RangeValue = 1e12;
+const kV8MaxWasmTableSize = 10000000;
 
 function assertTableIsValid(table, length) {
   assertSame(WebAssembly.Table.prototype, table.__proto__);
@@ -46,14 +42,14 @@
   assertThrows(() => new WebAssembly.Table({element: "any", initial: 10}), TypeError);
 
   assertThrows(() => new WebAssembly.Table(
-    {element: "anyfunc", initial: -1}), RangeError);
+    {element: "anyfunc", initial: -1}), TypeError);
   assertThrows(() => new WebAssembly.Table(
-    {element: "anyfunc", initial: outOfUint32RangeValue}), RangeError);
+    {element: "anyfunc", initial: outOfUint32RangeValue}), TypeError);
 
   assertThrows(() => new WebAssembly.Table(
-    {element: "anyfunc", initial: 10, maximum: -1}), RangeError);
+    {element: "anyfunc", initial: 10, maximum: -1}), TypeError);
   assertThrows(() => new WebAssembly.Table(
-    {element: "anyfunc", initial: 10, maximum: outOfUint32RangeValue}), RangeError);
+    {element: "anyfunc", initial: 10, maximum: outOfUint32RangeValue}), TypeError);
   assertThrows(() => new WebAssembly.Table(
     {element: "anyfunc", initial: 10, maximum: 9}), RangeError);
 
@@ -75,32 +71,28 @@
   assertEquals(null, table.get(0));
   assertEquals(undefined, table[0]);
 
-  table = new WebAssembly.Table({element: "anyfunc", initial: undefined});
+  table = new WebAssembly.Table({element: "anyfunc", initial: 0, maximum: 10});
   assertTableIsValid(table, 0);
 
-  table = new WebAssembly.Table({element: "anyfunc"});
+  table = new WebAssembly.Table({element: "anyfunc", initial: 0,  maximum: "10"});
   assertTableIsValid(table, 0);
 
-  table = new WebAssembly.Table({element: "anyfunc", maximum: 10});
-  assertTableIsValid(table, 0);
-
-  table = new WebAssembly.Table({element: "anyfunc", maximum: "10"});
-  assertTableIsValid(table, 0);
-
-  table = new WebAssembly.Table({element: "anyfunc", maximum: {valueOf() { return "10" }}});
+  table = new WebAssembly.Table({element: "anyfunc", initial: 0, maximum: {valueOf() { return "10" }}});
   assertTableIsValid(table, 0);
 
   table = new WebAssembly.Table({element: "anyfunc", initial: 0, maximum: undefined});
   assertTableIsValid(table, 0);
 
-  table = new WebAssembly.Table({element: "anyfunc", maximum: kMaxUint31});
+  table = new WebAssembly.Table({element: "anyfunc", initial: 0, maximum: 1000000});
   assertTableIsValid(table, 0);
 
-  table = new WebAssembly.Table({element: "anyfunc", maximum: kMaxUint32});
+  table = new WebAssembly.Table({element: "anyfunc", initial: 0, maximum: kV8MaxWasmTableSize});
   assertTableIsValid(table, 0);
 
-  table = new WebAssembly.Table({element: "anyfunc", maximum: kV8MaxWasmTableSize + 1});
-  assertTableIsValid(table, 0);
+  assertThrows(
+    () => new WebAssembly.Table(
+      {element: "anyfunc", initial: 0, maximum: kV8MaxWasmTableSize + 1}),
+    RangeError, /above the upper bound/);
 })();
 
 (function TestMaximumIsReadOnce() {
@@ -147,10 +139,13 @@
     assertEquals(null, table.get(i));
     assertEquals(null, table.get(String(i)));
   }
-  for (let key of [0.4, "", NaN, {}, [], () => {}]) {
+  for (let key of [0.4, "", []]) {
     assertEquals(null, table.get(key));
   }
-  for (let key of [-1, table.length, table.length * 10]) {
+  for (let key of [-1, NaN, {}, () => {}]) {
+    assertThrows(() => table.get(key), TypeError);
+  }
+  for (let key of [table.length, table.length * 10]) {
     assertThrows(() => table.get(key), RangeError);
   }
   assertThrows(() => table.get(Symbol()), TypeError);
@@ -159,8 +154,8 @@
 
 (function TestSet() {
   let builder = new WasmModuleBuilder;
-  builder.addExport("wasm", builder.addFunction("", kSig_v_v).addBody([]));
   builder.addExport("host", builder.addImport("test", "f", kSig_v_v));
+  builder.addExport("wasm", builder.addFunction("", kSig_v_v).addBody([]));
   let {wasm, host} = builder.instantiate({test: {f() {}}}).exports;
 
   let table = new WebAssembly.Table({element: "anyfunc", initial: 10});
@@ -182,14 +177,19 @@
       assertSame(undefined, table[i]);
     }
 
-    for (let key of [0.4, "", NaN, {}, [], () => {}]) {
+    for (let key of [0.4, "", []]) {
       assertSame(undefined, table.set(0, null));
       assertSame(undefined, table.set(key, f));
       assertSame(f, table.get(0));
       assertSame(undefined, table[key]);
     }
+    for (let key of [NaN, {}, () => {}]) {
+      assertSame(undefined, table[key]);
+      assertThrows(() => table.set(key, f), TypeError);
+    }
 
-    for (let key of [-1, table.length, table.length * 10]) {
+    assertThrows(() => table.set(-1, f), TypeError);
+    for (let key of [table.length, table.length * 10]) {
       assertThrows(() => table.set(key, f), RangeError);
     }
 
@@ -207,8 +207,8 @@
 
 (function TestIndexing() {
   let builder = new WasmModuleBuilder;
-  builder.addExport("wasm", builder.addFunction("", kSig_v_v).addBody([]));
   builder.addExport("host", builder.addImport("test", "f", kSig_v_v));
+  builder.addExport("wasm", builder.addFunction("", kSig_v_v).addBody([]));
   let {wasm, host} = builder.instantiate({test: {f() {}}}).exports;
 
   let table = new WebAssembly.Table({element: "anyfunc", initial: 10});
@@ -220,7 +220,12 @@
       assertSame(f, table[i]);
     }
 
-    for (let key of [0.4, "", NaN, {}, [], () => {}]) {
+    for (let key of [NaN, {}, () => {}]) {
+      assertSame(f, table[key] = f);
+      assertSame(f, table[key]);
+      assertThrows(() => table.get(key), TypeError);
+    }
+    for (let key of [0.4, "", []]) {
       assertSame(f, table[key] = f);
       assertSame(f, table[key]);
       assertSame(null, table.get(key));
@@ -230,8 +235,8 @@
 
 (function TestGrow() {
   let builder = new WasmModuleBuilder;
-  builder.addExport("wasm", builder.addFunction("", kSig_v_v).addBody([]));
   builder.addExport("host", builder.addImport("test", "f", kSig_v_v));
+  builder.addExport("wasm", builder.addFunction("", kSig_v_v).addBody([]));
   let {wasm, host} = builder.instantiate({test: {f() {}}}).exports;
 
   function init(table) {
@@ -252,7 +257,7 @@
   check(table);
   table.grow(10);
   check(table);
-  assertThrows(() => table.grow(-10), RangeError);
+  assertThrows(() => table.grow(-10), TypeError);
 
   table = new WebAssembly.Table({element: "anyfunc", initial: 20, maximum: 25});
   init(table);
@@ -264,7 +269,7 @@
   table.grow(0);
   check(table);
   assertThrows(() => table.grow(1), RangeError);
-  assertThrows(() => table.grow(-10), RangeError);
+  assertThrows(() => table.grow(-10), TypeError);
 
   assertThrows(() => WebAssembly.Table.prototype.grow.call([], 0), TypeError);
 
diff --git a/src/v8/test/mjsunit/wasm/test-wasm-module-builder.js b/src/v8/test/mjsunit/wasm/test-wasm-module-builder.js
index 02f28ff..eb0a953 100644
--- a/src/v8/test/mjsunit/wasm/test-wasm-module-builder.js
+++ b/src/v8/test/mjsunit/wasm/test-wasm-module-builder.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load('test/mjsunit/wasm/wasm-constants.js');
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 var debug = true;
diff --git a/src/v8/test/mjsunit/wasm/tier-up-testing-flag.js b/src/v8/test/mjsunit/wasm/tier-up-testing-flag.js
new file mode 100644
index 0000000..20aa309
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/tier-up-testing-flag.js
@@ -0,0 +1,45 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --liftoff --no-future --no-wasm-tier-up
+// Compile functions 0 and 2 with Turbofan, the rest with Liftoff:
+// Flags: --wasm-tier-mask-for-testing=5
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const num_functions = 5;
+
+function create_builder() {
+  const builder = new WasmModuleBuilder();
+  for (let i = 0; i < num_functions; ++i) {
+    builder.addFunction('f' + i, kSig_i_v)
+        .addBody(wasmI32Const(i))
+        .exportFunc();
+  }
+  return builder;
+}
+
+function check(instance) {
+  for (let i = 0; i < num_functions; ++i) {
+    const expect_liftoff = i != 0 && i != 2;
+    assertEquals(
+        expect_liftoff, %IsLiftoffFunction(instance.exports['f' + i]),
+        'function ' + i);
+  }
+}
+
+(function testTierTestingFlag() {
+  print(arguments.callee.name);
+  const instance = create_builder().instantiate();
+  check(instance);
+})();
+
+
+async function testTierTestingFlag() {
+  print(arguments.callee.name);
+  const instance = await create_builder().asyncInstantiate();
+  check(instance);
+}
+
+assertPromiseResult(testTierTestingFlag());
diff --git a/src/v8/test/mjsunit/wasm/trap-location.js b/src/v8/test/mjsunit/wasm/trap-location.js
index c4a0f4d..d893f97 100644
--- a/src/v8/test/mjsunit/wasm/trap-location.js
+++ b/src/v8/test/mjsunit/wasm/trap-location.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 // Collect the Callsite objects instead of just a string:
diff --git a/src/v8/test/mjsunit/wasm/type-reflection-with-anyref.js b/src/v8/test/mjsunit/wasm/type-reflection-with-anyref.js
new file mode 100644
index 0000000..0b857fb
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/type-reflection-with-anyref.js
@@ -0,0 +1,81 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-type-reflection --experimental-wasm-anyref
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function TestTableType() {
+  let table = new WebAssembly.Table({initial: 1, element: "anyref"});
+  let type = WebAssembly.Table.type(table);
+  assertEquals(1, type.minimum);
+  assertEquals("anyref", type.element);
+  assertEquals(2, Object.getOwnPropertyNames(type).length);
+
+  table = new WebAssembly.Table({initial: 2, maximum: 15, element: "anyref"});
+  type = WebAssembly.Table.type(table);
+  assertEquals(2, type.minimum);
+  assertEquals(15, type.maximum);
+  assertEquals("anyref", type.element);
+  assertEquals(3, Object.getOwnPropertyNames(type).length);
+})();
+
+(function TestGlobalType() {
+  let global = new WebAssembly.Global({value: "anyref", mutable: true});
+  let type = WebAssembly.Global.type(global);
+  assertEquals("anyref", type.value);
+  assertEquals(true, type.mutable);
+  assertEquals(2, Object.getOwnPropertyNames(type).length);
+
+  global = new WebAssembly.Global({value: "anyref"});
+  type = WebAssembly.Global.type(global);
+  assertEquals("anyref", type.value);
+  assertEquals(false, type.mutable);
+  assertEquals(2, Object.getOwnPropertyNames(type).length);
+})();
+
+// This is an extension of "type-reflection.js/TestFunctionTableSetAndCall" to
+// multiple table indexes. If --experimental-wasm-anyref is enabled by default
+// this test case can supersede the other one.
+(function TestFunctionMultiTableSetAndCall() {
+  let builder = new WasmModuleBuilder();
+  let v1 = 7; let v2 = 9; let v3 = 0.0;
+  let f1 = new WebAssembly.Function({parameters:[], results:["i32"]}, _ => v1);
+  let f2 = new WebAssembly.Function({parameters:[], results:["i32"]}, _ => v2);
+  let f3 = new WebAssembly.Function({parameters:[], results:["f64"]}, _ => v3);
+  let table = new WebAssembly.Table({element: "anyfunc", initial: 2});
+  let table_index0 = builder.addImportedTable("m", "table", 2);
+  let table_index1 = builder.addTable(kWasmAnyFunc, 1).exportAs("tbl").index;
+  let sig_index = builder.addType(kSig_i_v);
+  table.set(0, f1);
+  builder.addFunction('call0', kSig_i_i)
+      .addBody([
+        kExprGetLocal, 0,
+        kExprCallIndirect, sig_index, table_index0
+      ])
+      .exportFunc();
+  builder.addFunction('call1', kSig_i_i)
+      .addBody([
+        kExprGetLocal, 0,
+        kExprCallIndirect, sig_index, table_index1
+      ])
+      .exportFunc();
+  let instance = builder.instantiate({ m: { table: table }});
+
+  // Test table #0 first.
+  assertEquals(v1, instance.exports.call0(0));
+  table.set(1, f2);
+  assertEquals(v2, instance.exports.call0(1));
+  table.set(1, f3);
+  assertTraps(kTrapFuncSigMismatch, () => instance.exports.call0(1));
+
+  // Test table #1 next.
+  assertTraps(kTrapFuncSigMismatch, () => instance.exports.call1(0));
+  instance.exports.tbl.set(0, f1);
+  assertEquals(v1, instance.exports.call1(0));
+  instance.exports.tbl.set(0, f2);
+  assertEquals(v2, instance.exports.call1(0));
+  instance.exports.tbl.set(0, f3);
+  assertTraps(kTrapFuncSigMismatch, () => instance.exports.call1(0));
+})();
diff --git a/src/v8/test/mjsunit/wasm/type-reflection.js b/src/v8/test/mjsunit/wasm/type-reflection.js
new file mode 100644
index 0000000..da9ef83
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/type-reflection.js
@@ -0,0 +1,355 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-type-reflection
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function TestInvalidArgumentToType() {
+  ["abc", 123, {}, _ => 0].forEach(function(invalidInput) {
+    assertThrows(
+      () => WebAssembly.Memory.type(invalidInput), TypeError,
+        "WebAssembly.Memory.type(): Argument 0 must be a WebAssembly.Memory");
+    assertThrows(
+      () => WebAssembly.Table.type(invalidInput), TypeError,
+        "WebAssembly.Table.type(): Argument 0 must be a WebAssembly.Table");
+    assertThrows(
+      () => WebAssembly.Global.type(invalidInput), TypeError,
+        "WebAssembly.Global.type(): Argument 0 must be a WebAssembly.Global");
+    assertThrows(
+      () => WebAssembly.Function.type(invalidInput), TypeError,
+        "WebAssembly.Function.type(): Argument 0 must be a WebAssembly.Function");
+  });
+
+  assertThrows(
+    () => WebAssembly.Memory.type(
+      new WebAssembly.Table({initial:1, element: "anyfunc"})),
+      TypeError,
+      "WebAssembly.Memory.type(): Argument 0 must be a WebAssembly.Memory");
+
+  assertThrows(
+    () => WebAssembly.Table.type(
+      new WebAssembly.Memory({initial:1})), TypeError,
+      "WebAssembly.Table.type(): Argument 0 must be a WebAssembly.Table");
+
+  assertThrows(
+    () => WebAssembly.Global.type(
+      new WebAssembly.Memory({initial:1})), TypeError,
+      "WebAssembly.Global.type(): Argument 0 must be a WebAssembly.Global");
+
+  assertThrows(
+    () => WebAssembly.Function.type(
+      new WebAssembly.Memory({initial:1})), TypeError,
+      "WebAssembly.Function.type(): Argument 0 must be a WebAssembly.Function");
+})();
+
+(function TestMemoryType() {
+  let mem = new WebAssembly.Memory({initial: 1});
+  let type = WebAssembly.Memory.type(mem);
+  assertEquals(1, type.minimum);
+  assertEquals(1, Object.getOwnPropertyNames(type).length);
+
+  mem = new WebAssembly.Memory({initial: 2, maximum: 15});
+  type = WebAssembly.Memory.type(mem);
+  assertEquals(2, type.minimum);
+  assertEquals(15, type.maximum);
+  assertEquals(2, Object.getOwnPropertyNames(type).length);
+})();
+
+(function TestTableType() {
+  let table = new WebAssembly.Table({initial: 1, element: "anyfunc"});
+  let type = WebAssembly.Table.type(table);
+  assertEquals(1, type.minimum);
+  assertEquals("anyfunc", type.element);
+  assertEquals(undefined, type.maximum);
+  assertEquals(2, Object.getOwnPropertyNames(type).length);
+
+  table = new WebAssembly.Table({initial: 2, maximum: 15, element: "anyfunc"});
+  type = WebAssembly.Table.type(table);
+  assertEquals(2, type.minimum);
+  assertEquals(15, type.maximum);
+  assertEquals("anyfunc", type.element);
+  assertEquals(3, Object.getOwnPropertyNames(type).length);
+})();
+
+(function TestGlobalType() {
+  let global = new WebAssembly.Global({value: "i32", mutable: true});
+  let type = WebAssembly.Global.type(global);
+  assertEquals("i32", type.value);
+  assertEquals(true, type.mutable);
+  assertEquals(2, Object.getOwnPropertyNames(type).length);
+
+  global = new WebAssembly.Global({value: "i32"});
+  type = WebAssembly.Global.type(global);
+  assertEquals("i32", type.value);
+  assertEquals(false, type.mutable);
+  assertEquals(2, Object.getOwnPropertyNames(type).length);
+
+  global = new WebAssembly.Global({value: "i64"});
+  type = WebAssembly.Global.type(global);
+  assertEquals("i64", type.value);
+  assertEquals(false, type.mutable);
+  assertEquals(2, Object.getOwnPropertyNames(type).length);
+
+  global = new WebAssembly.Global({value: "f32"});
+  type = WebAssembly.Global.type(global);
+  assertEquals("f32", type.value);
+  assertEquals(false, type.mutable);
+  assertEquals(2, Object.getOwnPropertyNames(type).length);
+
+  global = new WebAssembly.Global({value: "f64"});
+  type = WebAssembly.Global.type(global);
+  assertEquals("f64", type.value);
+  assertEquals(false, type.mutable);
+  assertEquals(2, Object.getOwnPropertyNames(type).length);
+})();
+
+(function TestMemoryConstructorWithMinimum() {
+  let mem = new WebAssembly.Memory({minimum: 1});
+  assertTrue(mem instanceof WebAssembly.Memory);
+  let type = WebAssembly.Memory.type(mem);
+  assertEquals(1, type.minimum);
+  assertEquals(1, Object.getOwnPropertyNames(type).length);
+
+  mem = new WebAssembly.Memory({minimum: 1, maximum: 5});
+  assertTrue(mem instanceof WebAssembly.Memory);
+  type = WebAssembly.Memory.type(mem);
+  assertEquals(1, type.minimum);
+  assertEquals(5, type.maximum);
+  assertEquals(2, Object.getOwnPropertyNames(type).length);
+
+  mem = new WebAssembly.Memory({minimum: 1, initial: 2});
+  assertTrue(mem instanceof WebAssembly.Memory);
+  type = WebAssembly.Memory.type(mem);
+  assertEquals(2, type.minimum);
+  assertEquals(1, Object.getOwnPropertyNames(type).length);
+
+  mem = new WebAssembly.Memory({minimum: 1, initial: 2, maximum: 5});
+  assertTrue(mem instanceof WebAssembly.Memory);
+  type = WebAssembly.Memory.type(mem);
+  assertEquals(2, type.minimum);
+  assertEquals(5, type.maximum);
+  assertEquals(2, Object.getOwnPropertyNames(type).length);
+})();
+
+(function TestTableConstructorWithMinimum() {
+  let table = new WebAssembly.Table({minimum: 1, element: 'anyfunc'});
+  assertTrue(table instanceof WebAssembly.Table);
+  let type = WebAssembly.Table.type(table);
+  assertEquals(1, type.minimum);
+  assertEquals('anyfunc', type.element);
+  assertEquals(2, Object.getOwnPropertyNames(type).length);
+
+  table = new WebAssembly.Table({minimum: 1, element: 'anyfunc', maximum: 5});
+  assertTrue(table instanceof WebAssembly.Table);
+  type = WebAssembly.Table.type(table);
+  assertEquals(1, type.minimum);
+  assertEquals(5, type.maximum);
+  assertEquals('anyfunc', type.element);
+  assertEquals(3, Object.getOwnPropertyNames(type).length);
+
+  table = new WebAssembly.Table({minimum: 1, initial: 2, element: 'anyfunc'});
+  assertTrue(table instanceof WebAssembly.Table);
+  type = WebAssembly.Table.type(table);
+  assertEquals(2, type.minimum);
+  assertEquals('anyfunc', type.element);
+  assertEquals(2, Object.getOwnPropertyNames(type).length);
+
+  table = new WebAssembly.Table({minimum: 1, initial: 2, element: 'anyfunc',
+                                 maximum: 5});
+  assertTrue(table instanceof WebAssembly.Table);
+  type = WebAssembly.Table.type(table);
+  assertEquals(2, type.minimum);
+  assertEquals(5, type.maximum);
+  assertEquals('anyfunc', type.element);
+  assertEquals(3, Object.getOwnPropertyNames(type).length);
+})();
+
+(function TestFunctionConstructor() {
+  let toolong = new Array(1000 + 1);
+  let desc = Object.getOwnPropertyDescriptor(WebAssembly, 'Function');
+  assertEquals(typeof desc.value, 'function');
+  assertTrue(desc.writable);
+  assertFalse(desc.enumerable);
+  assertTrue(desc.configurable);
+  // TODO(7742): The length should probably be 2 instead.
+  assertEquals(WebAssembly.Function.length, 1);
+  assertEquals(WebAssembly.Function.name, 'Function');
+  assertThrows(
+      () => WebAssembly.Function(), TypeError, /must be invoked with 'new'/);
+  assertThrows(
+    () => new WebAssembly.Function(), TypeError,
+    /Argument 0 must be a function type/);
+  assertThrows(
+    () => new WebAssembly.Function({}), TypeError,
+    /Argument 0 must be a function type with 'parameters'/);
+  assertThrows(
+    () => new WebAssembly.Function({parameters:[]}), TypeError,
+    /Argument 0 must be a function type with 'results'/);
+  assertThrows(
+    () => new WebAssembly.Function({parameters:['foo'], results:[]}), TypeError,
+    /Argument 0 parameter type at index #0 must be a value type/);
+  assertThrows(
+    () => new WebAssembly.Function({parameters:[], results:['foo']}), TypeError,
+    /Argument 0 result type at index #0 must be a value type/);
+  assertThrows(
+    () => new WebAssembly.Function({parameters:toolong, results:[]}), TypeError,
+    /Argument 0 contains too many parameters/);
+  assertThrows(
+    () => new WebAssembly.Function({parameters:[], results:toolong}), TypeError,
+    /Argument 0 contains too many results/);
+  assertThrows(
+    () => new WebAssembly.Function({parameters:[], results:[]}), TypeError,
+    /Argument 1 must be a function/);
+  assertThrows(
+    () => new WebAssembly.Function({parameters:[], results:[]}, {}), TypeError,
+    /Argument 1 must be a function/);
+  assertDoesNotThrow(
+    () => new WebAssembly.Function({parameters:[], results:[]}, _ => 0));
+})();
+
+(function TestFunctionConstructedFunction() {
+  let fun = new WebAssembly.Function({parameters:[], results:[]}, _ => 0);
+  assertTrue(fun instanceof WebAssembly.Function);
+  assertTrue(fun instanceof Function);
+  assertTrue(fun instanceof Object);
+  assertSame(fun.__proto__, WebAssembly.Function.prototype);
+  assertSame(fun.__proto__.__proto__, Function.prototype);
+  assertSame(fun.__proto__.__proto__.__proto__, Object.prototype);
+  assertSame(fun.constructor, WebAssembly.Function);
+  assertEquals(typeof fun, 'function');
+  // TODO(7742): Enable once it is callable.
+  // assertDoesNotThrow(() => fun());
+})();
+
+(function TestFunctionExportedFunction() {
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("fun", kSig_v_v).addBody([]).exportFunc();
+  let instance = builder.instantiate();
+  let fun = instance.exports.fun;
+  assertTrue(fun instanceof WebAssembly.Function);
+  assertTrue(fun instanceof Function);
+  assertTrue(fun instanceof Object);
+  assertSame(fun.__proto__, WebAssembly.Function.prototype);
+  assertSame(fun.__proto__.__proto__, Function.prototype);
+  assertSame(fun.__proto__.__proto__.__proto__, Object.prototype);
+  assertSame(fun.constructor, WebAssembly.Function);
+  assertEquals(typeof fun, 'function');
+  assertDoesNotThrow(() => fun());
+})();
+
+(function TestFunctionTypeOfConstructedFunction() {
+  let testcases = [
+    {parameters:[], results:[]},
+    {parameters:["i32"], results:[]},
+    {parameters:["i64"], results:["i32"]},
+    {parameters:["f64", "f64", "i32"], results:[]},
+    {parameters:["f32"], results:["f32"]},
+  ];
+  testcases.forEach(function(expected) {
+    let fun = new WebAssembly.Function(expected, _ => 0);
+    let type = WebAssembly.Function.type(fun);
+    assertEquals(expected, type)
+  });
+})();
+
+(function TestFunctionTypeOfExportedFunction() {
+  let testcases = [
+    [kSig_v_v, {parameters:[], results:[]}],
+    [kSig_v_i, {parameters:["i32"], results:[]}],
+    [kSig_i_l, {parameters:["i64"], results:["i32"]}],
+    [kSig_v_ddi, {parameters:["f64", "f64", "i32"], results:[]}],
+    [kSig_f_f, {parameters:["f32"], results:["f32"]}],
+  ];
+  testcases.forEach(function([sig, expected]) {
+    let builder = new WasmModuleBuilder();
+    builder.addFunction("fun", sig).addBody([kExprUnreachable]).exportFunc();
+    let instance = builder.instantiate();
+    let type = WebAssembly.Function.type(instance.exports.fun);
+    assertEquals(expected, type)
+  });
+})();
+
+(function TestFunctionTableSetAndCall() {
+  let builder = new WasmModuleBuilder();
+  let fun1 = new WebAssembly.Function({parameters:[], results:["i32"]}, _ => 7);
+  let fun2 = new WebAssembly.Function({parameters:[], results:["i32"]}, _ => 9);
+  let fun3 = new WebAssembly.Function({parameters:[], results:["f64"]}, _ => 0);
+  let table = new WebAssembly.Table({element: "anyfunc", initial: 2});
+  let table_index = builder.addImportedTable("m", "table", 2);
+  let sig_index = builder.addType(kSig_i_v);
+  table.set(0, fun1);
+  builder.addFunction('main', kSig_i_i)
+      .addBody([
+        kExprGetLocal, 0,
+        kExprCallIndirect, sig_index, table_index
+      ])
+      .exportFunc();
+  let instance = builder.instantiate({ m: { table: table }});
+  assertEquals(7, instance.exports.main(0));
+  table.set(1, fun2);
+  assertEquals(9, instance.exports.main(1));
+  table.set(1, fun3);
+  assertTraps(kTrapFuncSigMismatch, () => instance.exports.main(1));
+})();
+
+(function TestFunctionTableSetIncompatibleSig() {
+  let builder = new WasmModuleBuilder();
+  let fun = new WebAssembly.Function({parameters:[], results:["i64"]}, _ => 0);
+  let table = new WebAssembly.Table({element: "anyfunc", initial: 2});
+  let table_index = builder.addImportedTable("m", "table", 2);
+  let sig_index = builder.addType(kSig_l_v);
+  table.set(0, fun);
+  builder.addFunction('main', kSig_v_i)
+      .addBody([
+        kExprGetLocal, 0,
+        kExprCallIndirect, sig_index, table_index,
+        kExprDrop
+      ])
+      .exportFunc();
+  let instance = builder.instantiate({ m: { table: table }});
+  assertThrows(
+    () => instance.exports.main(0), TypeError,
+    /wasm function signature contains illegal type/);
+  assertTraps(kTrapFuncSigMismatch, () => instance.exports.main(1));
+  table.set(1, fun);
+  assertThrows(
+    () => instance.exports.main(1), TypeError,
+    /wasm function signature contains illegal type/);
+})();
+
+(function TestFunctionModuleImportMatchingSig() {
+  let builder = new WasmModuleBuilder();
+  let fun = new WebAssembly.Function({parameters:[], results:["i32"]}, _ => 7);
+  let fun_index = builder.addImport("m", "fun", kSig_i_v)
+  builder.addFunction('main', kSig_i_v)
+      .addBody([
+        kExprCallFunction, fun_index
+      ])
+      .exportFunc();
+  let instance = builder.instantiate({ m: { fun: fun }});
+  assertEquals(7, instance.exports.main());
+})();
+
+(function TestFunctionModuleImportMismatchingSig() {
+  let builder = new WasmModuleBuilder();
+  let fun1 = new WebAssembly.Function({parameters:[], results:[]}, _ => 7);
+  let fun2 = new WebAssembly.Function({parameters:["i32"], results:[]}, _ => 8);
+  let fun3 = new WebAssembly.Function({parameters:[], results:["f32"]}, _ => 9);
+  let fun_index = builder.addImport("m", "fun", kSig_i_v)
+  builder.addFunction('main', kSig_i_v)
+      .addBody([
+        kExprCallFunction, fun_index
+      ])
+      .exportFunc();
+  assertThrows(
+    () => builder.instantiate({ m: { fun: fun1 }}), WebAssembly.LinkError,
+    /imported function does not match the expected type/);
+  assertThrows(
+    () => builder.instantiate({ m: { fun: fun2 }}), WebAssembly.LinkError,
+    /imported function does not match the expected type/);
+  assertThrows(
+    () => builder.instantiate({ m: { fun: fun3 }}), WebAssembly.LinkError,
+    /imported function does not match the expected type/);
+})();
diff --git a/src/v8/test/mjsunit/wasm/unicode-validation.js b/src/v8/test/mjsunit/wasm/unicode-validation.js
index 8932c32..e331c00 100644
--- a/src/v8/test/mjsunit/wasm/unicode-validation.js
+++ b/src/v8/test/mjsunit/wasm/unicode-validation.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 function toByteArray(s) {
diff --git a/src/v8/test/mjsunit/wasm/unicode.js b/src/v8/test/mjsunit/wasm/unicode.js
index 49c95da..2b5f5ce 100644
--- a/src/v8/test/mjsunit/wasm/unicode.js
+++ b/src/v8/test/mjsunit/wasm/unicode.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 function checkImport(
@@ -52,7 +51,7 @@
   builder.addFunction('three snowmen: ☃☃☃', kSig_i_v).addBody([]).exportFunc();
   assertThrows(
       () => builder.instantiate(), WebAssembly.CompileError,
-      /Compiling wasm function #0:three snowmen: ☃☃☃ failed: /);
+      /Compiling function #0:"three snowmen: ☃☃☃" failed: /);
 })();
 
 (function errorMessageUnicodeInImportModuleName() {
@@ -60,7 +59,7 @@
   builder.addImport('three snowmen: ☃☃☃', 'foo', kSig_i_v);
   assertThrows(
       () => builder.instantiate({}), TypeError,
-      /WebAssembly Instantiation: Import #0 module="three snowmen: ☃☃☃" error: /);
+      /WebAssembly.Instance\(\): Import #0 module="three snowmen: ☃☃☃" error: /);
 })();
 
 (function errorMessageUnicodeInImportElemName() {
@@ -68,7 +67,7 @@
   builder.addImport('mod', 'three snowmen: ☃☃☃', kSig_i_v);
   assertThrows(
       () => builder.instantiate({mod: {}}), WebAssembly.LinkError,
-      'WebAssembly Instantiation: Import #0 module="mod" function="three ' +
+      'WebAssembly.Instance\(\): Import #0 module="mod" function="three ' +
           'snowmen: ☃☃☃" error: function import requires a callable');
 })();
 
@@ -79,7 +78,7 @@
   builder.addImport(mod_name, func_name, kSig_i_v);
   assertThrows(
       () => builder.instantiate({[mod_name]: {}}), WebAssembly.LinkError,
-      'WebAssembly Instantiation: Import #0 module="' + mod_name +
+      'WebAssembly.Instance(): Import #0 module="' + mod_name +
           '" function="' + func_name +
           '" error: function import requires a callable');
 })();
diff --git a/src/v8/test/mjsunit/wasm/unreachable-validation.js b/src/v8/test/mjsunit/wasm/unreachable-validation.js
index 5b98b17..70768ff 100644
--- a/src/v8/test/mjsunit/wasm/unreachable-validation.js
+++ b/src/v8/test/mjsunit/wasm/unreachable-validation.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 // Set unittest to false to run this test and just print results, without failing.
diff --git a/src/v8/test/mjsunit/wasm/unreachable.js b/src/v8/test/mjsunit/wasm/unreachable.js
index d77b53e..38be729 100644
--- a/src/v8/test/mjsunit/wasm/unreachable.js
+++ b/src/v8/test/mjsunit/wasm/unreachable.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 var main = (function () {
diff --git a/src/v8/test/mjsunit/wasm/user-properties-common.js b/src/v8/test/mjsunit/wasm/user-properties-common.js
index ab6b2bc..f736593 100644
--- a/src/v8/test/mjsunit/wasm/user-properties-common.js
+++ b/src/v8/test/mjsunit/wasm/user-properties-common.js
@@ -4,7 +4,6 @@
 
 // Flags: --expose-wasm --expose-gc --verify-heap
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 const verifyHeap = gc;
diff --git a/src/v8/test/mjsunit/wasm/wasm-api-overloading.js b/src/v8/test/mjsunit/wasm/wasm-api-overloading.js
index 6a39510..0ae9db5 100644
--- a/src/v8/test/mjsunit/wasm/wasm-api-overloading.js
+++ b/src/v8/test/mjsunit/wasm/wasm-api-overloading.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
 let buffer = (() => {
diff --git a/src/v8/test/mjsunit/wasm/wasm-math-intrinsic.js b/src/v8/test/mjsunit/wasm/wasm-math-intrinsic.js
new file mode 100644
index 0000000..3b1a333
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/wasm-math-intrinsic.js
@@ -0,0 +1,256 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --wasm-math-intrinsics
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+function verbose(args) {
+  // print(...args);
+}
+
+//=============================================
+// Global count of failures
+//=============================================
+let numFailures = 0;
+
+function reportFailure(name, vals, m, w) {
+  print('  error: ' + name + '(' + vals + ') == ' + w + ', expected ' + m);
+  numFailures++;
+}
+
+let global_imports = {Math: Math};
+
+let inputs = [
+  1 / 0,
+  -1 / 0,
+  0 / 0,
+  -2.70497e+38,
+  -1.4698e+37,
+  -1.22813e+35,
+  -1.34584e+34,
+  -1.0079e+32,
+  -6.49364e+26,
+  -3.06077e+25,
+  -1.46821e+25,
+  -1.17658e+23,
+  -1.9617e+22,
+  -2.7357e+20,
+  -9223372036854775808.0,  // INT64_MIN
+  -1.48708e+13,
+  -1.89633e+12,
+  -4.66622e+11,
+  -2.22581e+11,
+  -1.45381e+10,
+  -2147483904.0,  // First float32 after INT32_MIN
+  -2147483648.0,  // INT32_MIN
+  -2147483520.0,  // Last float32 before INT32_MIN
+  -1.3956e+09,
+  -1.32951e+09,
+  -1.30721e+09,
+  -1.19756e+09,
+  -9.26822e+08,
+  -5.09256e+07,
+  -964300.0,
+  -192446.0,
+  -28455.0,
+  -27194.0,
+  -20575.0,
+  -17069.0,
+  -9167.0,
+  -960.178,
+  -113.0,
+  -62.0,
+  -15.0,
+  -7.0,
+  -1.0,
+  -0.0256635,
+  -4.60374e-07,
+  -3.63759e-10,
+  -4.30175e-14,
+  -5.27385e-15,
+  -1.5707963267948966,
+  -1.48084e-15,
+  -2.220446049250313e-16,
+  -1.05755e-19,
+  -3.2995e-21,
+  -1.67354e-23,
+  -1.11885e-23,
+  -1.78506e-30,
+  -1.43718e-34,
+  -1.27126e-38,
+  -0.0,
+  3e-88,
+  -2e66,
+  0.0,
+  2e66,
+  1.17549e-38,
+  1.56657e-37,
+  4.08512e-29,
+  6.25073e-22,
+  4.1723e-13,
+  1.44343e-09,
+  1.5707963267948966,
+  5.27004e-08,
+  9.48298e-08,
+  5.57888e-07,
+  4.89988e-05,
+  0.244326,
+  1.0,
+  12.4895,
+  19.0,
+  47.0,
+  106.0,
+  538.324,
+  564.536,
+  819.124,
+  7048.0,
+  12611.0,
+  19878.0,
+  20309.0,
+  797056.0,
+  1.77219e+09,
+  2147483648.0,  // INT32_MAX + 1
+  4294967296.0,  // UINT32_MAX + 1
+  1.51116e+11,
+  4.18193e+13,
+  3.59167e+16,
+  9223372036854775808.0,   // INT64_MAX + 1
+  18446744073709551616.0,  // UINT64_MAX + 1
+  3.38211e+19,
+  2.67488e+20,
+  1.78831e+21,
+  9.20914e+21,
+  8.35654e+23,
+  1.4495e+24,
+  5.94015e+25,
+  4.43608e+30,
+  2.44502e+33,
+  1.38178e+37,
+  1.71306e+37,
+  3.31899e+38,
+  3.40282e+38,
+];
+
+function genUnop(name, sig) {
+  var builder = new WasmModuleBuilder();
+
+  var sig_index = builder.addType(sig);
+  builder.addImport('Math', name, sig_index);
+  builder.addFunction('main', sig_index)
+      .addBody([
+        kExprGetLocal, 0,  // --
+        kExprCallFunction, 0
+      ])  // --
+      .exportAs('main');
+
+  return builder.instantiate(global_imports).exports.main;
+}
+
+function genBinop(name, sig) {
+  var builder = new WasmModuleBuilder();
+
+  var sig_index = builder.addType(sig);
+  builder.addImport('Math', name, sig_index);
+  builder.addFunction('main', sig_index)
+      .addBody([
+        kExprGetLocal, 0,  // --
+        kExprGetLocal, 1,  // --
+        kExprCallFunction, 0
+      ])  // --
+      .exportAs('main');
+
+  return builder.instantiate(global_imports).exports.main;
+}
+
+function assertUnop(name, math_func, wasm_func) {
+  for (val of inputs) {
+    verbose('  ', val);
+    let m = math_func(val);
+    let w = wasm_func(val);
+    if (!deepEquals(m, w)) reportFailure(name, [val], m, w);
+  }
+}
+
+function assertBinop(name, math_func, wasm_func) {
+  let inputs2 = [1, 0.5, -1, -0.5, 0, -0, 1 / 0, -1 / 0, 0 / 0];
+  for (val of inputs) {
+    verbose('  ', val);
+    for (val2 of inputs2) {
+      verbose('    ', val2);
+      let m = math_func(val, val2);
+      let w = wasm_func(val, val2);
+      if (!deepEquals(m, w)) reportFailure(name, [val, val2], m, w);
+      m = math_func(val2, val);
+      w = wasm_func(val2, val);
+      if (!deepEquals(m, w)) reportFailure(name, [val2, val], m, w);
+    }
+  }
+}
+
+(function TestF64() {
+  let f64_intrinsics = [
+    'acos',  'asin', 'atan', 'cos',   'sin',   'tan',  'exp', 'log',
+    'atan2', 'pow',  'ceil', 'floor', 'sqrt',  'min',  'max', 'abs',
+    'min',   'max',  'abs',  'ceil',  'floor', 'sqrt',
+  ];
+
+  for (name of f64_intrinsics) {
+    let math_func = Math[name];
+    let f32 = false;
+    print('Testing (f64) Math.' + name);
+    switch (math_func.length) {
+      case 1: {
+        let wasm_func = genUnop(name, kSig_d_d);
+        assertUnop('(f64)' + name, math_func, wasm_func);
+        break;
+      }
+      case 2: {
+        let wasm_func = genBinop(name, kSig_d_dd);
+        assertBinop('(f64)' + name, math_func, wasm_func);
+        break;
+      }
+      default:
+        throw 'Unexpected param count: ' + func.length;
+    }
+  }
+})();
+
+(function TestF32() {
+  let f32_intrinsics = ['min', 'max', 'abs', 'ceil', 'floor', 'sqrt'];
+
+  for (name of f32_intrinsics) {
+    let r = Math.fround, f = Math[name];
+    print('Testing (f32) Math.' + name);
+    switch (f.length) {
+      case 1: {
+        let wasm_func = genUnop(name, kSig_f_f);
+        let math_func = (val) => r(f(r(val)));
+        assertUnop('(f32)' + name, math_func, wasm_func);
+        break;
+      }
+      case 2: {
+        let wasm_func = genBinop(name, kSig_f_ff);
+        let math_func = (v1, v2) => r(f(r(v1), r(v2)));
+        assertBinop('(f32)' + name, math_func, wasm_func);
+        break;
+      }
+      default:
+        throw 'Unexpected param count: ' + func.length;
+    }
+  }
+})();
+
+(function TestFround() {
+  let name = 'fround';
+  print('Testing (f32) Math.' + name);
+
+  let wasm_func = genUnop(name, kSig_f_d);  // fround has a special signature.
+  let f = Math[name];
+  let r = Math.fround;
+  let math_func = (val) => r(f(r(val)));
+  assertUnop(name, math_func, wasm_func);
+})();
+
+assertEquals(0, numFailures);
diff --git a/src/v8/test/mjsunit/wasm/wasm-module-builder.js b/src/v8/test/mjsunit/wasm/wasm-module-builder.js
index c00c2c8..8e423bd 100644
--- a/src/v8/test/mjsunit/wasm/wasm-module-builder.js
+++ b/src/v8/test/mjsunit/wasm/wasm-module-builder.js
@@ -3,44 +3,581 @@
 // found in the LICENSE file.
 
 // Used for encoding f32 and double constants to bits.
-let __buffer = new ArrayBuffer(8);
-let byte_view = new Int8Array(__buffer);
-let f32_view = new Float32Array(__buffer);
-let f64_view = new Float64Array(__buffer);
+let f32_view = new Float32Array(1);
+let f32_bytes_view = new Uint8Array(f32_view.buffer);
+let f64_view = new Float64Array(1);
+let f64_bytes_view = new Uint8Array(f64_view.buffer);
 
-class Binary extends Array {
+// The bytes function receives one of
+//  - several arguments, each of which is either a number or a string of length
+//    1; if it's a string, the charcode of the contained character is used.
+//  - a single array argument containing the actual arguments
+//  - a single string; the returned buffer will contain the char codes of all
+//    contained characters.
+function bytes(...input) {
+  if (input.length == 1 && typeof input[0] == 'array') input = input[0];
+  if (input.length == 1 && typeof input[0] == 'string') {
+    let len = input[0].length;
+    let view = new Uint8Array(len);
+    for (let i = 0; i < len; i++) view[i] = input[0].charCodeAt(i);
+    return view.buffer;
+  }
+  let view = new Uint8Array(input.length);
+  for (let i = 0; i < input.length; i++) {
+    let val = input[i];
+    if (typeof val == 'string') {
+      assertEquals(1, val.length, 'string inputs must have length 1');
+      val = val.charCodeAt(0);
+    }
+    view[i] = val | 0;
+  }
+  return view.buffer;
+}
+
+// Header declaration constants
+var kWasmH0 = 0;
+var kWasmH1 = 0x61;
+var kWasmH2 = 0x73;
+var kWasmH3 = 0x6d;
+
+var kWasmV0 = 0x1;
+var kWasmV1 = 0;
+var kWasmV2 = 0;
+var kWasmV3 = 0;
+
+var kHeaderSize = 8;
+var kPageSize = 65536;
+var kSpecMaxPages = 65535;
+var kMaxVarInt32Size = 5;
+var kMaxVarInt64Size = 10;
+
+let kDeclNoLocals = 0;
+
+// Section declaration constants
+let kUnknownSectionCode = 0;
+let kTypeSectionCode = 1;        // Function signature declarations
+let kImportSectionCode = 2;      // Import declarations
+let kFunctionSectionCode = 3;    // Function declarations
+let kTableSectionCode = 4;       // Indirect function table and other tables
+let kMemorySectionCode = 5;      // Memory attributes
+let kGlobalSectionCode = 6;      // Global declarations
+let kExportSectionCode = 7;      // Exports
+let kStartSectionCode = 8;       // Start function declaration
+let kElementSectionCode = 9;     // Elements section
+let kCodeSectionCode = 10;       // Function code
+let kDataSectionCode = 11;       // Data segments
+let kDataCountSectionCode = 12;  // Data segment count (between Element & Code)
+let kExceptionSectionCode = 13;  // Exception section (between Global & Export)
+
+// Name section types
+let kModuleNameCode = 0;
+let kFunctionNamesCode = 1;
+let kLocalNamesCode = 2;
+
+let kWasmFunctionTypeForm = 0x60;
+let kWasmAnyFunctionTypeForm = 0x70;
+
+let kHasMaximumFlag = 1;
+let kSharedHasMaximumFlag = 3;
+
+// Segment flags
+let kActiveNoIndex = 0;
+let kPassive = 1;
+let kActiveWithIndex = 2;
+
+// Function declaration flags
+let kDeclFunctionName   = 0x01;
+let kDeclFunctionImport = 0x02;
+let kDeclFunctionLocals = 0x04;
+let kDeclFunctionExport = 0x08;
+
+// Local types
+let kWasmStmt = 0x40;
+let kWasmI32 = 0x7f;
+let kWasmI64 = 0x7e;
+let kWasmF32 = 0x7d;
+let kWasmF64 = 0x7c;
+let kWasmS128 = 0x7b;
+let kWasmAnyRef = 0x6f;
+let kWasmAnyFunc = 0x70;
+let kWasmExnRef = 0x68;
+
+let kExternalFunction = 0;
+let kExternalTable = 1;
+let kExternalMemory = 2;
+let kExternalGlobal = 3;
+let kExternalException = 4;
+
+let kTableZero = 0;
+let kMemoryZero = 0;
+let kSegmentZero = 0;
+
+let kExceptionAttribute = 0;
+
+// Useful signatures
+let kSig_i_i = makeSig([kWasmI32], [kWasmI32]);
+let kSig_l_l = makeSig([kWasmI64], [kWasmI64]);
+let kSig_i_l = makeSig([kWasmI64], [kWasmI32]);
+let kSig_i_ii = makeSig([kWasmI32, kWasmI32], [kWasmI32]);
+let kSig_i_iii = makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]);
+let kSig_v_iiii = makeSig([kWasmI32, kWasmI32, kWasmI32, kWasmI32], []);
+let kSig_f_ff = makeSig([kWasmF32, kWasmF32], [kWasmF32]);
+let kSig_d_dd = makeSig([kWasmF64, kWasmF64], [kWasmF64]);
+let kSig_l_ll = makeSig([kWasmI64, kWasmI64], [kWasmI64]);
+let kSig_i_dd = makeSig([kWasmF64, kWasmF64], [kWasmI32]);
+let kSig_v_v = makeSig([], []);
+let kSig_i_v = makeSig([], [kWasmI32]);
+let kSig_l_v = makeSig([], [kWasmI64]);
+let kSig_f_v = makeSig([], [kWasmF32]);
+let kSig_d_v = makeSig([], [kWasmF64]);
+let kSig_v_i = makeSig([kWasmI32], []);
+let kSig_v_ii = makeSig([kWasmI32, kWasmI32], []);
+let kSig_v_iii = makeSig([kWasmI32, kWasmI32, kWasmI32], []);
+let kSig_v_l = makeSig([kWasmI64], []);
+let kSig_v_d = makeSig([kWasmF64], []);
+let kSig_v_dd = makeSig([kWasmF64, kWasmF64], []);
+let kSig_v_ddi = makeSig([kWasmF64, kWasmF64, kWasmI32], []);
+let kSig_ii_v = makeSig([], [kWasmI32, kWasmI32]);
+let kSig_iii_v = makeSig([], [kWasmI32, kWasmI32, kWasmI32]);
+let kSig_ii_i = makeSig([kWasmI32], [kWasmI32, kWasmI32]);
+let kSig_iii_i = makeSig([kWasmI32], [kWasmI32, kWasmI32, kWasmI32]);
+let kSig_ii_ii = makeSig([kWasmI32, kWasmI32], [kWasmI32, kWasmI32]);
+let kSig_iii_ii = makeSig([kWasmI32, kWasmI32], [kWasmI32, kWasmI32, kWasmI32]);
+
+let kSig_v_f = makeSig([kWasmF32], []);
+let kSig_f_f = makeSig([kWasmF32], [kWasmF32]);
+let kSig_f_d = makeSig([kWasmF64], [kWasmF32]);
+let kSig_d_d = makeSig([kWasmF64], [kWasmF64]);
+let kSig_r_r = makeSig([kWasmAnyRef], [kWasmAnyRef]);
+let kSig_a_a = makeSig([kWasmAnyFunc], [kWasmAnyFunc]);
+let kSig_e_e = makeSig([kWasmExnRef], [kWasmExnRef]);
+let kSig_i_r = makeSig([kWasmAnyRef], [kWasmI32]);
+let kSig_v_r = makeSig([kWasmAnyRef], []);
+let kSig_v_a = makeSig([kWasmAnyFunc], []);
+let kSig_v_e = makeSig([kWasmExnRef], []);
+let kSig_v_rr = makeSig([kWasmAnyRef, kWasmAnyRef], []);
+let kSig_v_aa = makeSig([kWasmAnyFunc, kWasmAnyFunc], []);
+let kSig_r_v = makeSig([], [kWasmAnyRef]);
+let kSig_a_v = makeSig([], [kWasmAnyFunc]);
+let kSig_a_i = makeSig([kWasmI32], [kWasmAnyFunc]);
+let kSig_e_v = makeSig([], [kWasmExnRef]);
+
+function makeSig(params, results) {
+  return {params: params, results: results};
+}
+
+function makeSig_v_x(x) {
+  return makeSig([x], []);
+}
+
+function makeSig_v_xx(x) {
+  return makeSig([x, x], []);
+}
+
+function makeSig_r_v(r) {
+  return makeSig([], [r]);
+}
+
+function makeSig_r_x(r, x) {
+  return makeSig([x], [r]);
+}
+
+function makeSig_r_xx(r, x) {
+  return makeSig([x, x], [r]);
+}
+
+// Opcodes
+let kExprUnreachable = 0x00;
+let kExprNop = 0x01;
+let kExprBlock = 0x02;
+let kExprLoop = 0x03;
+let kExprIf = 0x04;
+let kExprElse = 0x05;
+let kExprTry = 0x06;
+let kExprCatch = 0x07;
+let kExprThrow = 0x08;
+let kExprRethrow = 0x09;
+let kExprBrOnExn = 0x0a;
+let kExprEnd = 0x0b;
+let kExprBr = 0x0c;
+let kExprBrIf = 0x0d;
+let kExprBrTable = 0x0e;
+let kExprReturn = 0x0f;
+let kExprCallFunction = 0x10;
+let kExprCallIndirect = 0x11;
+let kExprReturnCall = 0x12;
+let kExprReturnCallIndirect = 0x13;
+let kExprDrop = 0x1a;
+let kExprSelect = 0x1b;
+let kExprGetLocal = 0x20;
+let kExprSetLocal = 0x21;
+let kExprTeeLocal = 0x22;
+let kExprGetGlobal = 0x23;
+let kExprSetGlobal = 0x24;
+let kExprTableGet = 0x25;
+let kExprTableSet = 0x26;
+let kExprI32LoadMem = 0x28;
+let kExprI64LoadMem = 0x29;
+let kExprF32LoadMem = 0x2a;
+let kExprF64LoadMem = 0x2b;
+let kExprI32LoadMem8S = 0x2c;
+let kExprI32LoadMem8U = 0x2d;
+let kExprI32LoadMem16S = 0x2e;
+let kExprI32LoadMem16U = 0x2f;
+let kExprI64LoadMem8S = 0x30;
+let kExprI64LoadMem8U = 0x31;
+let kExprI64LoadMem16S = 0x32;
+let kExprI64LoadMem16U = 0x33;
+let kExprI64LoadMem32S = 0x34;
+let kExprI64LoadMem32U = 0x35;
+let kExprI32StoreMem = 0x36;
+let kExprI64StoreMem = 0x37;
+let kExprF32StoreMem = 0x38;
+let kExprF64StoreMem = 0x39;
+let kExprI32StoreMem8 = 0x3a;
+let kExprI32StoreMem16 = 0x3b;
+let kExprI64StoreMem8 = 0x3c;
+let kExprI64StoreMem16 = 0x3d;
+let kExprI64StoreMem32 = 0x3e;
+let kExprMemorySize = 0x3f;
+let kExprMemoryGrow = 0x40;
+let kExprI32Const = 0x41;
+let kExprI64Const = 0x42;
+let kExprF32Const = 0x43;
+let kExprF64Const = 0x44;
+let kExprI32Eqz = 0x45;
+let kExprI32Eq = 0x46;
+let kExprI32Ne = 0x47;
+let kExprI32LtS = 0x48;
+let kExprI32LtU = 0x49;
+let kExprI32GtS = 0x4a;
+let kExprI32GtU = 0x4b;
+let kExprI32LeS = 0x4c;
+let kExprI32LeU = 0x4d;
+let kExprI32GeS = 0x4e;
+let kExprI32GeU = 0x4f;
+let kExprI64Eqz = 0x50;
+let kExprI64Eq = 0x51;
+let kExprI64Ne = 0x52;
+let kExprI64LtS = 0x53;
+let kExprI64LtU = 0x54;
+let kExprI64GtS = 0x55;
+let kExprI64GtU = 0x56;
+let kExprI64LeS = 0x57;
+let kExprI64LeU = 0x58;
+let kExprI64GeS = 0x59;
+let kExprI64GeU = 0x5a;
+let kExprF32Eq = 0x5b;
+let kExprF32Ne = 0x5c;
+let kExprF32Lt = 0x5d;
+let kExprF32Gt = 0x5e;
+let kExprF32Le = 0x5f;
+let kExprF32Ge = 0x60;
+let kExprF64Eq = 0x61;
+let kExprF64Ne = 0x62;
+let kExprF64Lt = 0x63;
+let kExprF64Gt = 0x64;
+let kExprF64Le = 0x65;
+let kExprF64Ge = 0x66;
+let kExprI32Clz = 0x67;
+let kExprI32Ctz = 0x68;
+let kExprI32Popcnt = 0x69;
+let kExprI32Add = 0x6a;
+let kExprI32Sub = 0x6b;
+let kExprI32Mul = 0x6c;
+let kExprI32DivS = 0x6d;
+let kExprI32DivU = 0x6e;
+let kExprI32RemS = 0x6f;
+let kExprI32RemU = 0x70;
+let kExprI32And = 0x71;
+let kExprI32Ior = 0x72;
+let kExprI32Xor = 0x73;
+let kExprI32Shl = 0x74;
+let kExprI32ShrS = 0x75;
+let kExprI32ShrU = 0x76;
+let kExprI32Rol = 0x77;
+let kExprI32Ror = 0x78;
+let kExprI64Clz = 0x79;
+let kExprI64Ctz = 0x7a;
+let kExprI64Popcnt = 0x7b;
+let kExprI64Add = 0x7c;
+let kExprI64Sub = 0x7d;
+let kExprI64Mul = 0x7e;
+let kExprI64DivS = 0x7f;
+let kExprI64DivU = 0x80;
+let kExprI64RemS = 0x81;
+let kExprI64RemU = 0x82;
+let kExprI64And = 0x83;
+let kExprI64Ior = 0x84;
+let kExprI64Xor = 0x85;
+let kExprI64Shl = 0x86;
+let kExprI64ShrS = 0x87;
+let kExprI64ShrU = 0x88;
+let kExprI64Rol = 0x89;
+let kExprI64Ror = 0x8a;
+let kExprF32Abs = 0x8b;
+let kExprF32Neg = 0x8c;
+let kExprF32Ceil = 0x8d;
+let kExprF32Floor = 0x8e;
+let kExprF32Trunc = 0x8f;
+let kExprF32NearestInt = 0x90;
+let kExprF32Sqrt = 0x91;
+let kExprF32Add = 0x92;
+let kExprF32Sub = 0x93;
+let kExprF32Mul = 0x94;
+let kExprF32Div = 0x95;
+let kExprF32Min = 0x96;
+let kExprF32Max = 0x97;
+let kExprF32CopySign = 0x98;
+let kExprF64Abs = 0x99;
+let kExprF64Neg = 0x9a;
+let kExprF64Ceil = 0x9b;
+let kExprF64Floor = 0x9c;
+let kExprF64Trunc = 0x9d;
+let kExprF64NearestInt = 0x9e;
+let kExprF64Sqrt = 0x9f;
+let kExprF64Add = 0xa0;
+let kExprF64Sub = 0xa1;
+let kExprF64Mul = 0xa2;
+let kExprF64Div = 0xa3;
+let kExprF64Min = 0xa4;
+let kExprF64Max = 0xa5;
+let kExprF64CopySign = 0xa6;
+let kExprI32ConvertI64 = 0xa7;
+let kExprI32SConvertF32 = 0xa8;
+let kExprI32UConvertF32 = 0xa9;
+let kExprI32SConvertF64 = 0xaa;
+let kExprI32UConvertF64 = 0xab;
+let kExprI64SConvertI32 = 0xac;
+let kExprI64UConvertI32 = 0xad;
+let kExprI64SConvertF32 = 0xae;
+let kExprI64UConvertF32 = 0xaf;
+let kExprI64SConvertF64 = 0xb0;
+let kExprI64UConvertF64 = 0xb1;
+let kExprF32SConvertI32 = 0xb2;
+let kExprF32UConvertI32 = 0xb3;
+let kExprF32SConvertI64 = 0xb4;
+let kExprF32UConvertI64 = 0xb5;
+let kExprF32ConvertF64 = 0xb6;
+let kExprF64SConvertI32 = 0xb7;
+let kExprF64UConvertI32 = 0xb8;
+let kExprF64SConvertI64 = 0xb9;
+let kExprF64UConvertI64 = 0xba;
+let kExprF64ConvertF32 = 0xbb;
+let kExprI32ReinterpretF32 = 0xbc;
+let kExprI64ReinterpretF64 = 0xbd;
+let kExprF32ReinterpretI32 = 0xbe;
+let kExprF64ReinterpretI64 = 0xbf;
+let kExprI32SExtendI8 = 0xc0;
+let kExprI32SExtendI16 = 0xc1;
+let kExprI64SExtendI8 = 0xc2;
+let kExprI64SExtendI16 = 0xc3;
+let kExprI64SExtendI32 = 0xc4;
+let kExprRefNull = 0xd0;
+let kExprRefIsNull = 0xd1;
+let kExprRefFunc = 0xd2;
+
+// Prefix opcodes
+let kNumericPrefix = 0xfc;
+let kSimdPrefix = 0xfd;
+let kAtomicPrefix = 0xfe;
+
+// Numeric opcodes.
+let kExprMemoryInit = 0x08;
+let kExprDataDrop = 0x09;
+let kExprMemoryCopy = 0x0a;
+let kExprMemoryFill = 0x0b;
+let kExprTableInit = 0x0c;
+let kExprElemDrop = 0x0d;
+let kExprTableCopy = 0x0e;
+let kExprTableGrow = 0x0f;
+let kExprTableSize = 0x10;
+let kExprTableFill = 0x11;
+
+// Atomic opcodes.
+let kExprAtomicNotify = 0x00;
+let kExprI32AtomicWait = 0x01;
+let kExprI64AtomicWait = 0x02;
+let kExprI32AtomicLoad = 0x10;
+let kExprI32AtomicLoad8U = 0x12;
+let kExprI32AtomicLoad16U = 0x13;
+let kExprI32AtomicStore = 0x17;
+let kExprI32AtomicStore8U = 0x19;
+let kExprI32AtomicStore16U = 0x1a;
+let kExprI32AtomicAdd = 0x1e;
+let kExprI32AtomicAdd8U = 0x20;
+let kExprI32AtomicAdd16U = 0x21;
+let kExprI32AtomicSub = 0x25;
+let kExprI32AtomicSub8U = 0x27;
+let kExprI32AtomicSub16U = 0x28;
+let kExprI32AtomicAnd = 0x2c;
+let kExprI32AtomicAnd8U = 0x2e;
+let kExprI32AtomicAnd16U = 0x2f;
+let kExprI32AtomicOr = 0x33;
+let kExprI32AtomicOr8U = 0x35;
+let kExprI32AtomicOr16U = 0x36;
+let kExprI32AtomicXor = 0x3a;
+let kExprI32AtomicXor8U = 0x3c;
+let kExprI32AtomicXor16U = 0x3d;
+let kExprI32AtomicExchange = 0x41;
+let kExprI32AtomicExchange8U = 0x43;
+let kExprI32AtomicExchange16U = 0x44;
+let kExprI32AtomicCompareExchange = 0x48;
+let kExprI32AtomicCompareExchange8U = 0x4a;
+let kExprI32AtomicCompareExchange16U = 0x4b;
+
+let kExprI64AtomicLoad = 0x11;
+let kExprI64AtomicLoad8U = 0x14;
+let kExprI64AtomicLoad16U = 0x15;
+let kExprI64AtomicLoad32U = 0x16;
+let kExprI64AtomicStore = 0x18;
+let kExprI64AtomicStore8U = 0x1b;
+let kExprI64AtomicStore16U = 0x1c;
+let kExprI64AtomicStore32U = 0x1d;
+let kExprI64AtomicAdd = 0x1f;
+let kExprI64AtomicAdd8U = 0x22;
+let kExprI64AtomicAdd16U = 0x23;
+let kExprI64AtomicAdd32U = 0x24;
+let kExprI64AtomicSub = 0x26;
+let kExprI64AtomicSub8U = 0x29;
+let kExprI64AtomicSub16U = 0x2a;
+let kExprI64AtomicSub32U = 0x2b;
+let kExprI64AtomicAnd = 0x2d;
+let kExprI64AtomicAnd8U = 0x30;
+let kExprI64AtomicAnd16U = 0x31;
+let kExprI64AtomicAnd32U = 0x32;
+let kExprI64AtomicOr = 0x34;
+let kExprI64AtomicOr8U = 0x37;
+let kExprI64AtomicOr16U = 0x38;
+let kExprI64AtomicOr32U = 0x39;
+let kExprI64AtomicXor = 0x3b;
+let kExprI64AtomicXor8U = 0x3e;
+let kExprI64AtomicXor16U = 0x3f;
+let kExprI64AtomicXor32U = 0x40;
+let kExprI64AtomicExchange = 0x42;
+let kExprI64AtomicExchange8U = 0x45;
+let kExprI64AtomicExchange16U = 0x46;
+let kExprI64AtomicExchange32U = 0x47;
+let kExprI64AtomicCompareExchange = 0x49
+let kExprI64AtomicCompareExchange8U = 0x4c;
+let kExprI64AtomicCompareExchange16U = 0x4d;
+let kExprI64AtomicCompareExchange32U = 0x4e;
+
+// Simd opcodes.
+let kExprF32x4Min = 0x9e;
+
+// Compilation hint constants.
+let kCompilationHintStrategyDefault = 0x00;
+let kCompilationHintStrategyLazy = 0x01;
+let kCompilationHintStrategyEager = 0x02;
+let kCompilationHintStrategyLazyBaselineEagerTopTier = 0x03;
+let kCompilationHintTierDefault = 0x00;
+let kCompilationHintTierInterpreter = 0x01;
+let kCompilationHintTierBaseline = 0x02;
+let kCompilationHintTierOptimized = 0x03;
+
+let kTrapUnreachable          = 0;
+let kTrapMemOutOfBounds       = 1;
+let kTrapDivByZero            = 2;
+let kTrapDivUnrepresentable   = 3;
+let kTrapRemByZero            = 4;
+let kTrapFloatUnrepresentable = 5;
+let kTrapFuncInvalid          = 6;
+let kTrapFuncSigMismatch      = 7;
+let kTrapTypeError            = 8;
+let kTrapUnalignedAccess      = 9;
+let kTrapDataSegmentDropped   = 10;
+let kTrapElemSegmentDropped   = 11;
+let kTrapTableOutOfBounds     = 12;
+
+let kTrapMsgs = [
+  "unreachable",
+  "memory access out of bounds",
+  "divide by zero",
+  "divide result unrepresentable",
+  "remainder by zero",
+  "float unrepresentable in integer range",
+  "invalid index into function table",
+  "function signature mismatch",
+  "wasm function signature contains illegal type",
+  "operation does not support unaligned accesses",
+  "data segment has been dropped",
+  "element segment has been dropped",
+  "table access out of bounds"
+];
+
+function assertTraps(trap, code) {
+  assertThrows(code, WebAssembly.RuntimeError, kTrapMsgs[trap]);
+}
+
+class Binary {
+  constructor() {
+    this.length = 0;
+    this.buffer = new Uint8Array(8192);
+  }
+
+  ensure_space(needed) {
+    if (this.buffer.length - this.length >= needed) return;
+    let new_capacity = this.buffer.length * 2;
+    while (new_capacity - this.length < needed) new_capacity *= 2;
+    let new_buffer = new Uint8Array(new_capacity);
+    new_buffer.set(this.buffer);
+    this.buffer = new_buffer;
+  }
+
+  trunc_buffer() {
+    return new Uint8Array(this.buffer.buffer, 0, this.length);
+  }
+
+  reset() {
+    this.length = 0;
+  }
+
   emit_u8(val) {
-    this.push(val);
+    this.ensure_space(1);
+    this.buffer[this.length++] = val;
   }
 
   emit_u16(val) {
-    this.push(val & 0xff);
-    this.push((val >> 8) & 0xff);
+    this.ensure_space(2);
+    this.buffer[this.length++] = val;
+    this.buffer[this.length++] = val >> 8;
   }
 
   emit_u32(val) {
-    this.push(val & 0xff);
-    this.push((val >> 8) & 0xff);
-    this.push((val >> 16) & 0xff);
-    this.push((val >> 24) & 0xff);
+    this.ensure_space(4);
+    this.buffer[this.length++] = val;
+    this.buffer[this.length++] = val >> 8;
+    this.buffer[this.length++] = val >> 16;
+    this.buffer[this.length++] = val >> 24;
   }
 
-  emit_u32v(val) {
-    while (true) {
+  emit_leb(val, max_len) {
+    this.ensure_space(max_len);
+    for (let i = 0; i < max_len; ++i) {
       let v = val & 0xff;
       val = val >>> 7;
       if (val == 0) {
-        this.push(v);
-        break;
+        this.buffer[this.length++] = v;
+        return;
       }
-      this.push(v | 0x80);
+      this.buffer[this.length++] = v | 0x80;
     }
+    throw new Error("Leb value exceeds maximum length of " + max_len);
+  }
+
+  emit_u32v(val) {
+    this.emit_leb(val, kMaxVarInt32Size);
+  }
+
+  emit_u64v(val) {
+    this.emit_leb(val, kMaxVarInt64Size);
   }
 
   emit_bytes(data) {
-    for (let i = 0; i < data.length; i++) {
-      this.push(data[i] & 0xff);
-    }
+    this.ensure_space(data.length);
+    this.buffer.set(data, this.length);
+    this.length += data.length;
   }
 
   emit_string(string) {
@@ -61,20 +598,22 @@
   }
 
   emit_header() {
-    this.push(kWasmH0, kWasmH1, kWasmH2, kWasmH3,
-              kWasmV0, kWasmV1, kWasmV2, kWasmV3);
+    this.emit_bytes([
+      kWasmH0, kWasmH1, kWasmH2, kWasmH3, kWasmV0, kWasmV1, kWasmV2, kWasmV3
+    ]);
   }
 
   emit_section(section_code, content_generator) {
     // Emit section name.
     this.emit_u8(section_code);
     // Emit the section to a temporary buffer: its full length isn't know yet.
-    let section = new Binary;
+    const section = new Binary;
     content_generator(section);
     // Emit section length.
     this.emit_u32v(section.length);
     // Copy the temporary buffer.
-    for (var i = 0; i < section.length; i++) this.push(section[i]);
+    // Avoid spread because {section} can be huge.
+    this.emit_bytes(section.trunc_buffer());
   }
 }
 
@@ -84,10 +623,11 @@
     this.name = name;
     this.type_index = type_index;
     this.body = [];
+    this.locals = [];
+    this.local_names = [];
   }
 
   numLocalNames() {
-    if (this.local_names === undefined) return 0;
     let num_local_names = 0;
     for (let loc_name of this.local_names) {
       if (loc_name !== undefined) ++num_local_names;
@@ -105,6 +645,11 @@
     return this;
   }
 
+  setCompilationHint(strategy, baselineTier, topTier) {
+    this.module.setCompilationHint(strategy, baselineTier, topTier, this.index);
+    return this;
+  }
+
   addBody(body) {
     for (let b of body) {
       if (typeof b !== 'number' || (b & (~0xFF)) !== 0 )
@@ -123,7 +668,7 @@
 
   getNumLocals() {
     let total_locals = 0;
-    for (let l of this.locals || []) {
+    for (let l of this.locals) {
       for (let type of ["i32", "i64", "f32", "f64", "s128"]) {
         total_locals += l[type + "_count"] || 0;
       }
@@ -133,10 +678,8 @@
 
   addLocals(locals, names) {
     const old_num_locals = this.getNumLocals();
-    if (!this.locals) this.locals = []
     this.locals.push(locals);
     if (names) {
-      if (!this.local_names) this.local_names = [];
       const missing_names = old_num_locals - this.local_names.length;
       this.local_names.push(...new Array(missing_names), ...names);
     }
@@ -163,22 +706,39 @@
   }
 }
 
+class WasmTableBuilder {
+  constructor(module, type, initial_size, max_size) {
+    this.module = module;
+    this.type = type;
+    this.initial_size = initial_size;
+    this.has_max = max_size != undefined;
+    this.max_size = max_size;
+  }
+
+  exportAs(name) {
+    this.module.exports.push({name: name, kind: kExternalTable,
+                              index: this.index});
+    return this;
+  }
+}
+
 class WasmModuleBuilder {
   constructor() {
     this.types = [];
     this.imports = [];
     this.exports = [];
     this.globals = [];
+    this.tables = [];
     this.exceptions = [];
     this.functions = [];
-    this.function_table = [];
-    this.function_table_length_min = 0;
-    this.function_table_length_max = 0;
-    this.function_table_inits = [];
-    this.segments = [];
+    this.compilation_hints = [];
+    this.element_segments = [];
+    this.data_segments = [];
     this.explicit = [];
     this.num_imported_funcs = 0;
     this.num_imported_globals = 0;
+    this.num_imported_tables = 0;
+    this.num_imported_exceptions = 0;
     return this;
   }
 
@@ -203,14 +763,21 @@
     for (var i = 0; i < name.length; i++) {
       result.emit_u8(name.charCodeAt(i));
     }
-    return result;
+    return result.trunc_buffer()
+  }
+
+  createCustomSection(name, bytes) {
+    name = this.stringToBytes(name);
+    var section = new Binary();
+    section.emit_u8(0);
+    section.emit_u32v(name.length + bytes.length);
+    section.emit_bytes(name);
+    section.emit_bytes(bytes);
+    return section.trunc_buffer();
   }
 
   addCustomSection(name, bytes) {
-    name = this.stringToBytes(name);
-    var length = new Binary();
-    length.emit_u32v(name.length + bytes.length);
-    this.explicit.push([0, ...length, ...name, ...bytes]);
+    this.explicit.push(this.createCustomSection(name, bytes));
   }
 
   addType(type) {
@@ -227,11 +794,21 @@
     return glob;
   }
 
+  addTable(type, initial_size, max_size = undefined) {
+    if (type != kWasmAnyRef && type != kWasmAnyFunc) {
+      throw new Error('Tables must be of type kWasmAnyRef or kWasmAnyFunc');
+    }
+    let table = new WasmTableBuilder(this, type, initial_size, max_size);
+    table.index = this.tables.length + this.num_imported_tables;
+    this.tables.push(table);
+    return table;
+  }
+
   addException(type) {
-    if (type.results.length != 0)
-      throw new Error('Invalid exception signature: ' + type);
-    this.exceptions.push(type);
-    return this.exceptions.length - 1;
+    let type_index = (typeof type) == "number" ? type : this.addType(type);
+    let except_index = this.exceptions.length + this.num_imported_exceptions;
+    this.exceptions.push(type_index);
+    return except_index;
   }
 
   addFunction(name, type) {
@@ -242,31 +819,51 @@
     return func;
   }
 
-  addImport(module = "", name, type) {
+  addImport(module, name, type) {
+    if (this.functions.length != 0) {
+      throw new Error('Imported functions must be declared before local ones');
+    }
     let type_index = (typeof type) == "number" ? type : this.addType(type);
     this.imports.push({module: module, name: name, kind: kExternalFunction,
                        type: type_index});
     return this.num_imported_funcs++;
   }
 
-  addImportedGlobal(module = "", name, type) {
+  addImportedGlobal(module, name, type, mutable = false) {
+    if (this.globals.length != 0) {
+      throw new Error('Imported globals must be declared before local ones');
+    }
     let o = {module: module, name: name, kind: kExternalGlobal, type: type,
-             mutable: false}
+             mutable: mutable};
     this.imports.push(o);
     return this.num_imported_globals++;
   }
 
-  addImportedMemory(module = "", name, initial = 0, maximum, shared) {
+  addImportedMemory(module, name, initial = 0, maximum, shared) {
     let o = {module: module, name: name, kind: kExternalMemory,
              initial: initial, maximum: maximum, shared: shared};
     this.imports.push(o);
     return this;
   }
 
-  addImportedTable(module = "", name, initial, maximum) {
+  addImportedTable(module, name, initial, maximum, type) {
+    if (this.tables.length != 0) {
+      throw new Error('Imported tables must be declared before local ones');
+    }
     let o = {module: module, name: name, kind: kExternalTable, initial: initial,
-             maximum: maximum};
+             maximum: maximum, type: type || kWasmAnyFunctionTypeForm};
     this.imports.push(o);
+    return this.num_imported_tables++;
+  }
+
+  addImportedException(module, name, type) {
+    if (this.exceptions.length != 0) {
+      throw new Error('Imported exceptions must be declared before local ones');
+    }
+    let type_index = (typeof type) == "number" ? type : this.addType(type);
+    let o = {module: module, name: name, kind: kExternalException, type: type_index};
+    this.imports.push(o);
+    return this.num_imported_exceptions++;
   }
 
   addExport(name, index) {
@@ -279,27 +876,35 @@
     return this;
   }
 
+  setCompilationHint(strategy, baselineTier, topTier, index) {
+    this.compilation_hints[index] = {strategy: strategy, baselineTier:
+      baselineTier, topTier: topTier};
+    return this;
+  }
+
   addDataSegment(addr, data, is_global = false) {
-    this.segments.push({addr: addr, data: data, is_global: is_global});
-    return this.segments.length - 1;
+    this.data_segments.push(
+        {addr: addr, data: data, is_global: is_global, is_active: true});
+    return this.data_segments.length - 1;
+  }
+
+  addPassiveDataSegment(data) {
+    this.data_segments.push({data: data, is_active: false});
+    return this.data_segments.length - 1;
   }
 
   exportMemoryAs(name) {
     this.exports.push({name: name, kind: kExternalMemory, index: 0});
   }
 
-  addFunctionTableInit(base, is_global, array, is_import = false) {
-    this.function_table_inits.push({base: base, is_global: is_global,
-                                    array: array});
-    if (!is_global) {
-      var length = base + array.length;
-      if (length > this.function_table_length_min && !is_import) {
-        this.function_table_length_min = length;
-      }
-      if (length > this.function_table_length_max && !is_import) {
-         this.function_table_length_max = length;
-      }
-    }
+  addElementSegment(table, base, is_global, array) {
+    this.element_segments.push({table: table, base: base, is_global: is_global,
+                                    array: array, is_active: true});
+    return this;
+  }
+
+  addPassiveElementSegment(array, is_import = false) {
+    this.element_segments.push({array: array, is_active: false});
     return this;
   }
 
@@ -308,12 +913,25 @@
       if (typeof n != 'number')
         throw new Error('invalid table (entries have to be numbers): ' + array);
     }
-    return this.addFunctionTableInit(this.function_table.length, false, array);
+    if (this.tables.length == 0) {
+      this.addTable(kWasmAnyFunc, 0);
+    }
+    // Adjust the table to the correct size.
+    let table = this.tables[0];
+    const base = table.initial_size;
+    const table_size = base + array.length;
+    table.initial_size = table_size;
+    if (table.has_max && table_size > table.max_size) {
+      table.max_size = table_size;
+    }
+    return this.addElementSegment(0, base, false, array);
   }
 
-  setFunctionTableBounds(min, max) {
-    this.function_table_length_min = min;
-    this.function_table_length_max = max;
+  setTableBounds(min, max = undefined) {
+    if (this.tables.length != 0) {
+      throw new Error("The table bounds of table '0' have already been set.");
+    }
+    this.addTable(kWasmAnyFunc, min, max);
     return this;
   }
 
@@ -322,7 +940,7 @@
     return this;
   }
 
-  toArray(debug = false) {
+  toBuffer(debug = false) {
     let binary = new Binary;
     let wasm = this;
 
@@ -373,11 +991,14 @@
             section.emit_u32v(imp.initial); // initial
             if (has_max) section.emit_u32v(imp.maximum); // maximum
           } else if (imp.kind == kExternalTable) {
-            section.emit_u8(kWasmAnyFunctionTypeForm);
+            section.emit_u8(imp.type);
             var has_max = (typeof imp.maximum) != "undefined";
             section.emit_u8(has_max ? 1 : 0); // flags
             section.emit_u32v(imp.initial); // initial
             if (has_max) section.emit_u32v(imp.maximum); // maximum
+          } else if (imp.kind == kExternalException) {
+            section.emit_u32v(kExceptionAttribute);
+            section.emit_u32v(imp.type);
           } else {
             throw new Error("unknown/unsupported import kind " + imp.kind);
           }
@@ -396,17 +1017,17 @@
       });
     }
 
-    // Add function_table.
-    if (wasm.function_table_length_min > 0) {
-      if (debug) print("emitting table @ " + binary.length);
+    // Add table section
+    if (wasm.tables.length > 0) {
+      if (debug) print ("emitting tables @ " + binary.length);
       binary.emit_section(kTableSectionCode, section => {
-        section.emit_u8(1);  // one table entry
-        section.emit_u8(kWasmAnyFunctionTypeForm);
-        // TODO(gdeepti): Cleanup to use optional max flag,
-        // fix up tests to set correct initial/maximum values
-        section.emit_u32v(1);
-        section.emit_u32v(wasm.function_table_length_min);
-        section.emit_u32v(wasm.function_table_length_max);
+        section.emit_u32v(wasm.tables.length);
+        for (let table of wasm.tables) {
+          section.emit_u8(table.type);
+          section.emit_u8(table.has_max);
+          section.emit_u32v(table.initial_size);
+          if (table.has_max) section.emit_u32v(table.max_size);
+        }
       });
     }
 
@@ -419,9 +1040,9 @@
         const is_shared = wasm.memory.shared !== undefined;
         // Emit flags (bit 0: reszeable max, bit 1: shared memory)
         if (is_shared) {
-          section.emit_u8(has_max ? 3 : 2);
+          section.emit_u8(has_max ? kSharedHasMaximumFlag : 2);
         } else {
-          section.emit_u8(has_max ? 1 : 0);
+          section.emit_u8(has_max ? kHasMaximumFlag : 0);
         }
         section.emit_u32v(wasm.memory.min);
         if (has_max) section.emit_u32v(wasm.memory.max);
@@ -445,27 +1066,29 @@
               break;
             case kWasmI64:
               section.emit_u8(kExprI64Const);
-              section.emit_u32v(global.init);
+              section.emit_u64v(global.init);
               break;
             case kWasmF32:
               section.emit_u8(kExprF32Const);
               f32_view[0] = global.init;
-              section.emit_u8(byte_view[0]);
-              section.emit_u8(byte_view[1]);
-              section.emit_u8(byte_view[2]);
-              section.emit_u8(byte_view[3]);
+              section.emit_bytes(f32_bytes_view);
               break;
             case kWasmF64:
               section.emit_u8(kExprF64Const);
               f64_view[0] = global.init;
-              section.emit_u8(byte_view[0]);
-              section.emit_u8(byte_view[1]);
-              section.emit_u8(byte_view[2]);
-              section.emit_u8(byte_view[3]);
-              section.emit_u8(byte_view[4]);
-              section.emit_u8(byte_view[5]);
-              section.emit_u8(byte_view[6]);
-              section.emit_u8(byte_view[7]);
+              section.emit_bytes(f64_bytes_view);
+              break;
+            case kWasmAnyFunc:
+            case kWasmAnyRef:
+              if (global.function_index !== undefined) {
+                section.emit_u8(kExprRefFunc);
+                section.emit_u32v(global.function_index);
+              } else {
+                section.emit_u8(kExprRefNull);
+              }
+              break;
+            case kWasmExnRef:
+              section.emit_u8(kExprRefNull);
               break;
             }
           } else {
@@ -478,6 +1101,18 @@
       });
     }
 
+    // Add exceptions.
+    if (wasm.exceptions.length > 0) {
+      if (debug) print("emitting exceptions @ " + binary.length);
+      binary.emit_section(kExceptionSectionCode, section => {
+        section.emit_u32v(wasm.exceptions.length);
+        for (let type of wasm.exceptions) {
+          section.emit_u32v(kExceptionAttribute);
+          section.emit_u32v(type);
+        }
+      });
+    }
+
     // Add export table.
     var mem_export = (wasm.memory !== undefined && wasm.memory.exp);
     var exports_count = wasm.exports.length + (mem_export ? 1 : 0);
@@ -506,51 +1141,103 @@
       });
     }
 
-    // Add table elements.
-    if (wasm.function_table_inits.length > 0) {
-      if (debug) print("emitting table @ " + binary.length);
+    // Add element segments
+    if (wasm.element_segments.length > 0) {
+      if (debug) print("emitting element segments @ " + binary.length);
       binary.emit_section(kElementSectionCode, section => {
-        var inits = wasm.function_table_inits;
+        var inits = wasm.element_segments;
         section.emit_u32v(inits.length);
 
         for (let init of inits) {
-          section.emit_u8(0); // table index
-          if (init.is_global) {
-            section.emit_u8(kExprGetGlobal);
+          if (init.is_active) {
+            // Active segment.
+            if (init.table == 0) {
+              section.emit_u32v(kActiveNoIndex);
+            } else {
+              section.emit_u32v(kActiveWithIndex);
+              section.emit_u32v(init.table);
+            }
+            if (init.is_global) {
+              section.emit_u8(kExprGetGlobal);
+            } else {
+              section.emit_u8(kExprI32Const);
+            }
+            section.emit_u32v(init.base);
+            section.emit_u8(kExprEnd);
+            section.emit_u32v(init.array.length);
+            for (let index of init.array) {
+              section.emit_u32v(index);
+            }
           } else {
-            section.emit_u8(kExprI32Const);
-          }
-          section.emit_u32v(init.base);
-          section.emit_u8(kExprEnd);
-          section.emit_u32v(init.array.length);
-          for (let index of init.array) {
-            section.emit_u32v(index);
+            // Passive segment.
+            section.emit_u8(kPassive);  // flags
+            section.emit_u8(kWasmAnyFunc);
+            section.emit_u32v(init.array.length);
+            for (let index of init.array) {
+              if (index === null) {
+                section.emit_u8(kExprRefNull);
+                section.emit_u8(kExprEnd);
+              } else {
+                section.emit_u8(kExprRefFunc);
+                section.emit_u32v(index);
+                section.emit_u8(kExprEnd);
+              }
+            }
           }
         }
       });
     }
 
-    // Add exceptions.
-    if (wasm.exceptions.length > 0) {
-      if (debug) print("emitting exceptions @ " + binary.length);
-      binary.emit_section(kExceptionSectionCode, section => {
-        section.emit_u32v(wasm.exceptions.length);
-        for (let type of wasm.exceptions) {
-          section.emit_u32v(type.params.length);
-          for (let param of type.params) {
-            section.emit_u8(param);
-          }
-        }
+    // If there are any passive data segments, add the DataCount section.
+    if (wasm.data_segments.some(seg => !seg.is_active)) {
+      binary.emit_section(kDataCountSectionCode, section => {
+        section.emit_u32v(wasm.data_segments.length);
       });
     }
 
+    // If there are compilation hints add a custom section 'compilationHints'
+    // after the function section and before the code section.
+    if (wasm.compilation_hints.length > 0) {
+      if (debug) print("emitting compilation hints @ " + binary.length);
+      // Build custom section payload.
+      let payloadBinary = new Binary();
+      let implicit_compilation_hints_count = wasm.functions.length;
+      payloadBinary.emit_u32v(implicit_compilation_hints_count);
+
+      // Defaults to the compiler's choice if no better hint was given (0x00).
+      let defaultHintByte = kCompilationHintStrategyDefault |
+          (kCompilationHintTierDefault << 2) |
+          (kCompilationHintTierDefault << 4);
+
+      // Emit hint byte for every function defined in this module.
+      for (let i = 0; i < implicit_compilation_hints_count; i++) {
+        let index = wasm.num_imported_funcs + i;
+        var hintByte;
+        if(index in wasm.compilation_hints) {
+          let hint = wasm.compilation_hints[index];
+          hintByte = hint.strategy | (hint.baselineTier << 2) |
+              (hint.topTier << 4);
+        } else{
+          hintByte = defaultHintByte;
+        }
+        payloadBinary.emit_u8(hintByte);
+      }
+
+      // Finalize as custom section.
+      let name = "compilationHints";
+      let bytes = this.createCustomSection(name, payloadBinary.trunc_buffer());
+      binary.emit_bytes(bytes);
+    }
+
     // Add function bodies.
     if (wasm.functions.length > 0) {
       // emit function bodies
       if (debug) print("emitting code @ " + binary.length);
       binary.emit_section(kCodeSectionCode, section => {
         section.emit_u32v(wasm.functions.length);
+        let header = new Binary;
         for (let func of wasm.functions) {
+          header.reset();
           // Function body length will be patched later.
           let local_decls = [];
           for (let l of func.locals || []) {
@@ -569,9 +1256,17 @@
             if (l.s128_count > 0) {
               local_decls.push({count: l.s128_count, type: kWasmS128});
             }
+            if (l.anyref_count > 0) {
+              local_decls.push({count: l.anyref_count, type: kWasmAnyRef});
+            }
+            if (l.anyfunc_count > 0) {
+              local_decls.push({count: l.anyfunc_count, type: kWasmAnyFunc});
+            }
+            if (l.except_count > 0) {
+              local_decls.push({count: l.except_count, type: kWasmExnRef});
+            }
           }
 
-          let header = new Binary;
           header.emit_u32v(local_decls.length);
           for (let decl of local_decls) {
             header.emit_u32v(decl.count);
@@ -579,29 +1274,33 @@
           }
 
           section.emit_u32v(header.length + func.body.length);
-          section.emit_bytes(header);
+          section.emit_bytes(header.trunc_buffer());
           section.emit_bytes(func.body);
         }
       });
     }
 
     // Add data segments.
-    if (wasm.segments.length > 0) {
+    if (wasm.data_segments.length > 0) {
       if (debug) print("emitting data segments @ " + binary.length);
       binary.emit_section(kDataSectionCode, section => {
-        section.emit_u32v(wasm.segments.length);
-        for (let seg of wasm.segments) {
-          section.emit_u8(0);  // linear memory index 0
-          if (seg.is_global) {
-            // initializer is a global variable
-            section.emit_u8(kExprGetGlobal);
-            section.emit_u32v(seg.addr);
+        section.emit_u32v(wasm.data_segments.length);
+        for (let seg of wasm.data_segments) {
+          if (seg.is_active) {
+            section.emit_u8(0);  // linear memory index 0 / flags
+            if (seg.is_global) {
+              // initializer is a global variable
+              section.emit_u8(kExprGetGlobal);
+              section.emit_u32v(seg.addr);
+            } else {
+              // initializer is a constant
+              section.emit_u8(kExprI32Const);
+              section.emit_u32v(seg.addr);
+            }
+            section.emit_u8(kExprEnd);
           } else {
-            // initializer is a constant
-            section.emit_u8(kExprI32Const);
-            section.emit_u32v(seg.addr);
+            section.emit_u8(kPassive);  // flags
           }
-          section.emit_u8(kExprEnd);
           section.emit_u32v(seg.data.length);
           section.emit_bytes(seg.data);
         }
@@ -662,28 +1361,51 @@
       });
     }
 
-    return binary;
+    return binary.trunc_buffer();
   }
 
-  toBuffer(debug = false) {
-    let bytes = this.toArray(debug);
-    let buffer = new ArrayBuffer(bytes.length);
-    let view = new Uint8Array(buffer);
-    for (let i = 0; i < bytes.length; i++) {
-      let val = bytes[i];
-      if ((typeof val) == "string") val = val.charCodeAt(0);
-      view[i] = val | 0;
-    }
-    return buffer;
+  toArray(debug = false) {
+    return Array.from(this.toBuffer(debug));
   }
 
   instantiate(ffi) {
-    let module = new WebAssembly.Module(this.toBuffer());
+    let module = this.toModule();
     let instance = new WebAssembly.Instance(module, ffi);
     return instance;
   }
 
+  asyncInstantiate(ffi) {
+    return WebAssembly.instantiate(this.toBuffer(), ffi)
+        .then(({module, instance}) => instance);
+  }
+
   toModule(debug = false) {
     return new WebAssembly.Module(this.toBuffer(debug));
   }
 }
+
+function wasmI32Const(val) {
+  let bytes = [kExprI32Const];
+  for (let i = 0; i < 4; ++i) {
+    bytes.push(0x80 | ((val >> (7 * i)) & 0x7f));
+  }
+  bytes.push((val >> (7 * 4)) & 0x7f);
+  return bytes;
+}
+
+function wasmF32Const(f) {
+  f32_view[0] = f;
+  return [
+    kExprF32Const, f32_bytes_view[0], f32_bytes_view[1], f32_bytes_view[2],
+    f32_bytes_view[3]
+  ];
+}
+
+function wasmF64Const(f) {
+  f64_view[0] = f;
+  return [
+    kExprF64Const, f64_bytes_view[0], f64_bytes_view[1], f64_bytes_view[2],
+    f64_bytes_view[3], f64_bytes_view[4], f64_bytes_view[5], f64_bytes_view[6],
+    f64_bytes_view[7]
+  ];
+}
diff --git a/src/v8/test/mjsunit/wasm/worker-interpreter.js b/src/v8/test/mjsunit/wasm/worker-interpreter.js
new file mode 100644
index 0000000..ccf6d27
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/worker-interpreter.js
@@ -0,0 +1,62 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-wasm-disable-structured-cloning
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function TestPostInterpretedModule() {
+  let builder = new WasmModuleBuilder();
+  let add = builder.addFunction("add", kSig_i_ii)
+    .addBody([kExprGetLocal, 0, kExprGetLocal, 1, kExprI32Add])
+    .exportFunc();
+
+  let module = builder.toModule();
+  let instance = new WebAssembly.Instance(module);
+  let exp = instance.exports;
+
+  let workerScript = `
+    var instance = null;
+    onmessage = function(message) {
+      try {
+        if (message.command == 'module') {
+          instance = new WebAssembly.Instance(message.module);
+          postMessage('OK');
+        }
+        if (message.command == 'call') {
+          let result = instance.exports.add(40, 2);
+          postMessage(result);
+        }
+      } catch(e) {
+        postMessage('ERROR: ' + e);
+      }
+    }
+  `;
+  let worker = new Worker(workerScript, {type: 'string'});
+
+  // Call method without using the interpreter.
+  var initial_interpreted = %WasmNumInterpretedCalls(instance);
+  assertEquals(23, exp.add(20, 3));
+  assertEquals(initial_interpreted + 0, %WasmNumInterpretedCalls(instance));
+
+  // Send module to the worker, still not interpreting.
+  worker.postMessage({ command:'module', module:module });
+  assertEquals('OK', worker.getMessage());
+  worker.postMessage({ command:'call' });
+  assertEquals(42, worker.getMessage());
+  assertEquals(initial_interpreted + 0, %WasmNumInterpretedCalls(instance));
+
+  // Switch to the interpreter and call method.
+  %RedirectToWasmInterpreter(instance, add.index);
+  assertEquals(23, exp.add(20, 3));
+  assertEquals(initial_interpreted + 1, %WasmNumInterpretedCalls(instance));
+
+  // Let worker call interpreted function.
+  worker.postMessage({ command:'call' });
+  assertEquals(42, worker.getMessage());
+  assertEquals(initial_interpreted + 1, %WasmNumInterpretedCalls(instance));
+
+  // All done.
+  worker.terminate();
+})();
diff --git a/src/v8/test/mjsunit/wasm/worker-memory.js b/src/v8/test/mjsunit/wasm/worker-memory.js
index 6d96e7b..c5b99ed 100644
--- a/src/v8/test/mjsunit/wasm/worker-memory.js
+++ b/src/v8/test/mjsunit/wasm/worker-memory.js
@@ -5,7 +5,7 @@
 // Flags: --experimental-wasm-threads
 
 (function TestPostMessageUnsharedMemory() {
-  let worker = new Worker('');
+  let worker = new Worker('', {type: 'string'});
   let memory = new WebAssembly.Memory({initial: 1, maximum: 2});
 
   assertThrows(() => worker.postMessage(memory), Error);
@@ -39,7 +39,7 @@
        postMessage("OK");
      };`;
 
-  let worker = new Worker(workerScript);
+  let worker = new Worker(workerScript, {type: 'string'});
   let memory = new WebAssembly.Memory({initial: 1, maximum: 2, shared: true});
   worker.postMessage(memory);
   assertEquals("OK", worker.getMessage());
@@ -60,10 +60,27 @@
        postMessage("OK");
      };`;
 
-  let worker = new Worker(workerScript);
+  let worker = new Worker(workerScript, {type: 'string'});
   let memory = new WebAssembly.Memory({initial: 1, maximum: 2, shared: true});
   let obj = {memories: [memory, memory], buffer: memory.buffer, foo: 1};
   worker.postMessage(obj);
   assertEquals("OK", worker.getMessage());
   worker.terminate();
 })();
+
+(function TestTwoWorkers() {
+  let workerScript = workerHelpers +
+    `onmessage = function(memory) {
+       assertIsWasmMemory(memory, 65536);
+       postMessage("OK");
+     };`;
+
+  let workers = [new Worker(workerScript, {type: 'string'}),
+                 new Worker(workerScript, {type: 'string'})];
+  let memory = new WebAssembly.Memory({initial: 1, maximum: 2, shared: true});
+  for (let worker of workers) {
+    worker.postMessage(memory);
+    assertEquals("OK", worker.getMessage());
+    worker.terminate();
+  }
+})();
diff --git a/src/v8/test/mjsunit/wasm/worker-module.js b/src/v8/test/mjsunit/wasm/worker-module.js
new file mode 100644
index 0000000..f626263
--- /dev/null
+++ b/src/v8/test/mjsunit/wasm/worker-module.js
@@ -0,0 +1,33 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-shared-engine --no-wasm-disable-structured-cloning
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function TestPostModule() {
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("add", kSig_i_ii)
+    .addBody([kExprGetLocal, 0, kExprGetLocal, 1, kExprI32Add])
+    .exportFunc();
+
+  let module = builder.toModule();
+
+  let workerScript = `
+    onmessage = function(module) {
+      try {
+        let instance = new WebAssembly.Instance(module);
+        let result = instance.exports.add(40, 2);
+        postMessage(result);
+      } catch(e) {
+        postMessage('ERROR: ' + e);
+      }
+    }
+  `;
+
+  let worker = new Worker(workerScript, {type: 'string'});
+  worker.postMessage(module);
+  assertEquals(42, worker.getMessage());
+  worker.terminate();
+})();
diff --git a/src/v8/test/mjsunit/worker-ping-test.js b/src/v8/test/mjsunit/worker-ping-test.js
new file mode 100644
index 0000000..046e217
--- /dev/null
+++ b/src/v8/test/mjsunit/worker-ping-test.js
@@ -0,0 +1,125 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// A test utility for pinging objects back and forth among a pool of workers.
+// Use by calling {RunWorkerPingTest} with a {config} object.
+{
+// Reference config object for demonstrating the interface.
+let config = {
+  numThings: 4,       // size of circular buffer
+  numWorkers: 4,      // number of workers
+  numMessages: 100,   // number of messages sent to each worker
+  allocInterval: 11,  // interval for allocating new things per worker
+  traceScript: false, // print the script
+  traceAlloc: false,  // print each allocation attempt
+  traceIteration: 10, // print diagnostics every so many iterations
+  abortOnFail: false, // kill worker if allocation fails
+
+  // Note that because the functions are appended to a worker script
+  // *as source*, they need to be named properly.
+
+  // The function that allocates things. Required.
+  AllocThing: function AllocThing(id) {
+    return new Array(2);
+  },
+  // Before message send behavior. Optional.
+  BeforeSend: function BeforeSend(msg) { },
+  // Before message reception behavior. Optional.
+  BeforeReceive: function BeforeReceive(msg) { },
+}
+}
+
+function RunWorkerPingTest(config) {
+  let workers = [];
+  let beforeSend = (typeof config.BeforeSend == "function") ?
+      config.BeforeSend :
+      function BeforeSend(msg) { };
+  let beforeReceive = (typeof config.BeforeReceive == "function") ?
+      config.BeforeReceive :
+      function BeforeReceive(msg) { };
+
+  // Each worker has a circular buffer of size {config.numThings}, recording
+  // received things into the buffer and responding with a previous thing.
+  // Every {config.allocInterval}, a worker creates a new thing by
+  // {config.AllocThing}.
+
+  let script =
+`const kNumThings = ${config.numThings};
+  const kAllocInterval = ${config.allocInterval};
+  let index = 0;
+  let total = 0;
+  let id = 0;
+  let things = new Array(kNumThings);
+  for (let i = 0; i < kNumThings; i++) {
+    things[i] = TryAllocThing();
+  }
+
+  function TryAllocThing() {
+     try {
+       let thing = AllocThing(id++);
+       ${config.traceAlloc ? "print(\"alloc success\");" : ""}
+       return thing;
+     } catch(e) {
+       ${config.abortOnFail ? "postMessage({error: e.toString()}); throw e;" : "" }
+       ${config.traceAlloc ? "print(\"alloc fail: \" + e);" : ""}
+     }
+  }
+
+  onmessage = function(msg) {
+    BeforeReceive(msg);
+    if (msg.thing !== undefined) {
+      let reply = things[index];
+      if ((total % kAllocInterval) == 0) {
+        reply = TryAllocThing();
+      }
+      things[index] = msg.thing;
+      postMessage({thing : reply});
+      index = (index + 1) % kNumThings;
+      total++;
+    }
+  }
+  ${config.AllocThing.toString()}
+  ${beforeReceive.toString()}
+  `;
+
+  if (config.traceScript) {
+    print("========== Worker script ==========");
+    print(script);
+    print("===================================");
+  }
+
+  for (let i = 0; i < config.numWorkers; i++) {
+    let worker = new Worker(script, {type : 'string'});
+    workers.push(worker);
+  }
+
+  let time = performance.now();
+
+  // The main thread posts {config.numMessages} messages to {config.numWorkers}
+  // workers, with each message containing a "thing" created by {config.AllocThing}.
+  let thing = config.AllocThing(-1);
+  for (let i = 0; i < config.numMessages; i++) {
+    if ((i % config.traceIteration) == 0) {
+      let now = performance.now();
+      print(`iteration ${i}, Δ = ${(now - time).toFixed(3)} ms`);
+      time = now;
+    }
+
+    for (let worker of workers) {
+      let msg = {thing: thing};
+      beforeSend(msg);
+      worker.postMessage(msg);
+      msg = worker.getMessage();
+      if (msg.thing) {
+        thing = msg.thing;
+      } else if (msg.error) {
+        worker.terminate();
+        throw msg.error;
+      }
+    }
+  }
+  for (let worker of workers) {
+    worker.terminate();
+  }
+}