deps: update V8 to 6.1.534.36

PR-URL: https://github.com/nodejs/node/pull/14730
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

53 files changed, 1082 insertions, 36 deletions

diff --git a/deps/v8/test/mjsunit/compiler/alloc-object-huge.js b/deps/v8/test/mjsunit/compiler/alloc-object-huge.js
index b0a981d6c2..7fd32eaa30 100644
--- a/deps/v8/test/mjsunit/compiler/alloc-object-huge.js
+++ b/deps/v8/test/mjsunit/compiler/alloc-object-huge.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --inline-construct
+// Flags: --allow-natives-syntax
 // Flags: --max-inlined-source-size=999999 --max-inlined-nodes=999999
 // Flags: --max-inlined-nodes-cumulative=999999
 
diff --git a/deps/v8/test/mjsunit/compiler/alloc-object.js b/deps/v8/test/mjsunit/compiler/alloc-object.js
index 5876134342..8d19816536 100644
--- a/deps/v8/test/mjsunit/compiler/alloc-object.js
+++ b/deps/v8/test/mjsunit/compiler/alloc-object.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --inline-construct
+// Flags: --allow-natives-syntax
 
 // Test that inlined object allocation works for different layouts of
 // objects (e.g. in object properties, slack tracking in progress or
diff --git a/deps/v8/test/mjsunit/compiler/array-constructor.js b/deps/v8/test/mjsunit/compiler/array-constructor.js
index 583817b7d8..eef242714b 100644
--- a/deps/v8/test/mjsunit/compiler/array-constructor.js
+++ b/deps/v8/test/mjsunit/compiler/array-constructor.js
@@ -87,3 +87,14 @@
   %OptimizeFunctionOnNextCall(foo);
   assertEquals([1, 2, 3], foo(1, 2, 3));
 })();
+
+// Test Array construct inside try-catch block.
+(() => {
+  function foo(x) { try { return new Array(x) } catch (e) { return e } }
+
+  assertEquals([], foo(0));
+  assertEquals([], foo(0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals([], foo(0));
+  assertInstanceof(foo(-1), RangeError);
+})();
diff --git a/deps/v8/test/mjsunit/compiler/deopt-accessors5.js b/deps/v8/test/mjsunit/compiler/deopt-accessors5.js
index 1b23c532dc..bf71585e25 100644
--- a/deps/v8/test/mjsunit/compiler/deopt-accessors5.js
+++ b/deps/v8/test/mjsunit/compiler/deopt-accessors5.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --harmony-tailcalls
+// Flags: --allow-natives-syntax
 
 "use strict";
 
diff --git a/deps/v8/test/mjsunit/compiler/deopt-accessors6.js b/deps/v8/test/mjsunit/compiler/deopt-accessors6.js
index 16fb4ddf64..784123ae6c 100644
--- a/deps/v8/test/mjsunit/compiler/deopt-accessors6.js
+++ b/deps/v8/test/mjsunit/compiler/deopt-accessors6.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --harmony-tailcalls
+// Flags: --allow-natives-syntax
 
 "use strict";
 
diff --git a/deps/v8/test/mjsunit/compiler/deopt-inlined-from-call.js b/deps/v8/test/mjsunit/compiler/deopt-inlined-from-call.js
index 8fa8af5a9b..28af2eebca 100644
--- a/deps/v8/test/mjsunit/compiler/deopt-inlined-from-call.js
+++ b/deps/v8/test/mjsunit/compiler/deopt-inlined-from-call.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --opt --no-always-opt
+// Flags: --allow-natives-syntax --opt --no-always-opt --no-stress-fullcodegen
 
 var global = this;
 
diff --git a/deps/v8/test/mjsunit/compiler/deopt-numberoroddball-binop.js b/deps/v8/test/mjsunit/compiler/deopt-numberoroddball-binop.js
index 2c6473d15f..6f19d45bb8 100644
--- a/deps/v8/test/mjsunit/compiler/deopt-numberoroddball-binop.js
+++ b/deps/v8/test/mjsunit/compiler/deopt-numberoroddball-binop.js
@@ -9,6 +9,7 @@
 
   foo(1.1, 0.1);
   foo(0.1, 1.1);
+  foo(true, false);
   %OptimizeFunctionOnNextCall(foo);
   foo(undefined, 1.1);
   assertOptimized(foo);
@@ -33,6 +34,7 @@
 
   foo(1.1, 0.1);
   foo(0.1, 1.1);
+  foo(true, false);
   %OptimizeFunctionOnNextCall(foo);
   foo(undefined, 1.1);
   assertOptimized(foo);
@@ -57,6 +59,7 @@
 
   foo(1.1, 0.1);
   foo(0.1, 1.1);
+  foo(true, false);
   %OptimizeFunctionOnNextCall(foo);
   foo(undefined, 1.1);
   assertOptimized(foo);
@@ -81,6 +84,7 @@
 
   foo(1.1, 0.1);
   foo(0.1, 1.1);
+  foo(true, false);
   %OptimizeFunctionOnNextCall(foo);
   foo(undefined, 1.1);
   assertOptimized(foo);
@@ -105,6 +109,7 @@
 
   foo(1.1, 0.1);
   foo(0.1, 1.1);
+  foo(true, false);
   %OptimizeFunctionOnNextCall(foo);
   foo(undefined, 1.1);
   assertOptimized(foo);
@@ -129,6 +134,7 @@
 
   foo(1.1, 0.1);
   foo(0.1, 1.1);
+  foo(true, false);
   %OptimizeFunctionOnNextCall(foo);
   foo(undefined, 1.1);
   assertOptimized(foo);
diff --git a/deps/v8/test/mjsunit/compiler/division-by-constant.js b/deps/v8/test/mjsunit/compiler/division-by-constant.js
index d3f3ac37f4..212bdb24b9 100644
--- a/deps/v8/test/mjsunit/compiler/division-by-constant.js
+++ b/deps/v8/test/mjsunit/compiler/division-by-constant.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --no-use-inlining
+// Flags: --allow-natives-syntax
 
 // -----------------------------------------------------------------------------
 
diff --git a/deps/v8/test/mjsunit/compiler/escape-analysis-11.js b/deps/v8/test/mjsunit/compiler/escape-analysis-11.js
index f33cf2d991..e922fc15c8 100644
--- a/deps/v8/test/mjsunit/compiler/escape-analysis-11.js
+++ b/deps/v8/test/mjsunit/compiler/escape-analysis-11.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --turbo --turbo-escape
+// Flags: --allow-natives-syntax --turbo-escape
 
 function g() {
   ({}).a += '';
@@ -15,5 +15,5 @@ function f() {
 
 f();
 f();
-% OptimizeFunctionOnNextCall(f);
+%OptimizeFunctionOnNextCall(f);
 f();
diff --git a/deps/v8/test/mjsunit/compiler/escape-analysis-12.js b/deps/v8/test/mjsunit/compiler/escape-analysis-12.js
index 20d5f2a1b0..16029a0ad3 100644
--- a/deps/v8/test/mjsunit/compiler/escape-analysis-12.js
+++ b/deps/v8/test/mjsunit/compiler/escape-analysis-12.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --turbo --turbo-escape
+// Flags: --allow-natives-syntax --turbo-escape
 
 var x = {};
 x = {};
@@ -13,5 +13,5 @@ function f() {
 }
 f();
 f();
-% OptimizeFunctionOnNextCall(f);
+%OptimizeFunctionOnNextCall(f);
 f();
diff --git a/deps/v8/test/mjsunit/compiler/escape-analysis-13.js b/deps/v8/test/mjsunit/compiler/escape-analysis-13.js
index b1334f1f27..fca4da618e 100644
--- a/deps/v8/test/mjsunit/compiler/escape-analysis-13.js
+++ b/deps/v8/test/mjsunit/compiler/escape-analysis-13.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --turbo --turbo-escape --turbo-experimental
+// Flags: --allow-natives-syntax --turbo-escape --turbo-experimental
 
 function f() {
   var x = {};
@@ -13,5 +13,5 @@ function f() {
 }
 f();
 f();
-% OptimizeFunctionOnNextCall(f);
+%OptimizeFunctionOnNextCall(f);
 f();
diff --git a/deps/v8/test/mjsunit/compiler/escape-analysis-15.js b/deps/v8/test/mjsunit/compiler/escape-analysis-15.js
index 4ebd0f7887..4f9a40ad5c 100644
--- a/deps/v8/test/mjsunit/compiler/escape-analysis-15.js
+++ b/deps/v8/test/mjsunit/compiler/escape-analysis-15.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --turbo --turbo-escape --turbo-experimental --no-turbo-load-elimination
+// Flags: --allow-natives-syntax --turbo-escape --turbo-experimental --no-turbo-load-elimination
 
 function f(i) {
   var o1 = {a: 1, b: 2};
diff --git a/deps/v8/test/mjsunit/compiler/escape-analysis-arguments.js b/deps/v8/test/mjsunit/compiler/escape-analysis-arguments.js
index bdab182fed..f520167e19 100644
--- a/deps/v8/test/mjsunit/compiler/escape-analysis-arguments.js
+++ b/deps/v8/test/mjsunit/compiler/escape-analysis-arguments.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --use-escape-analysis --expose-gc
+// Flags: --allow-natives-syntax --expose-gc
 
 
 // Simple test of capture
diff --git a/deps/v8/test/mjsunit/compiler/escape-analysis-framestate-use-at-branchpoint.js b/deps/v8/test/mjsunit/compiler/escape-analysis-framestate-use-at-branchpoint.js
index d7ed61b6eb..c86674e52e 100644
--- a/deps/v8/test/mjsunit/compiler/escape-analysis-framestate-use-at-branchpoint.js
+++ b/deps/v8/test/mjsunit/compiler/escape-analysis-framestate-use-at-branchpoint.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --turbo --turbo-escape
+// Flags: --allow-natives-syntax --turbo-escape
 
 function foo() {
   var o = {x:0};
diff --git a/deps/v8/test/mjsunit/compiler/escape-analysis-materialize.js b/deps/v8/test/mjsunit/compiler/escape-analysis-materialize.js
index e72797d823..6ad3a53218 100644
--- a/deps/v8/test/mjsunit/compiler/escape-analysis-materialize.js
+++ b/deps/v8/test/mjsunit/compiler/escape-analysis-materialize.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --turbo --turbo-escape
+// Flags: --allow-natives-syntax --turbo-escape
 
 (function TestMaterializeArray() {
   function f() {
diff --git a/deps/v8/test/mjsunit/compiler/escape-analysis-representation.js b/deps/v8/test/mjsunit/compiler/escape-analysis-representation.js
index 1c7cae76c9..e6cc9f1ed2 100644
--- a/deps/v8/test/mjsunit/compiler/escape-analysis-representation.js
+++ b/deps/v8/test/mjsunit/compiler/escape-analysis-representation.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --use-escape-analysis
+// Flags: --allow-natives-syntax
 
 // This tests that captured objects materialized through the deoptimizer
 // have field descriptors with a representation matching the values that
diff --git a/deps/v8/test/mjsunit/compiler/escape-analysis.js b/deps/v8/test/mjsunit/compiler/escape-analysis.js
index b12e7bfca0..111ed634fd 100644
--- a/deps/v8/test/mjsunit/compiler/escape-analysis.js
+++ b/deps/v8/test/mjsunit/compiler/escape-analysis.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --use-escape-analysis --expose-gc
+// Flags: --allow-natives-syntax --expose-gc
 
 
 // Test stores on a join path.
diff --git a/deps/v8/test/mjsunit/compiler/function-apply.js b/deps/v8/test/mjsunit/compiler/function-apply.js
new file mode 100644
index 0000000000..f9440dede1
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/function-apply.js
@@ -0,0 +1,136 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Test Function.prototype.apply with null/undefined argumentsList
+(function() {
+  "use strict";
+  function bar() { return this; }
+  function foo() { return bar.apply(this, null); }
+
+  assertEquals(42, foo.call(42));
+  assertEquals(42, foo.call(42));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(42, foo.call(42));
+})();
+(function() {
+  "use strict";
+  function bar() { return this; }
+  function foo() { return bar.apply(this, undefined); }
+
+  assertEquals(42, foo.call(42));
+  assertEquals(42, foo.call(42));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(42, foo.call(42));
+})();
+
+// Test Function.prototype.apply within try/catch.
+(function() {
+  "use strict";
+  function foo(bar) {
+    try {
+      return Function.prototype.apply.call(bar, bar, arguments);
+    } catch (e) {
+      return 1;
+    }
+  }
+
+  assertEquals(1, foo());
+  assertEquals(1, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo());
+})();
+(function() {
+  "use strict";
+  function foo(bar) {
+    try {
+      return Function.prototype.apply.call(bar, bar, bar);
+    } catch (e) {
+      return 1;
+    }
+  }
+
+  assertEquals(1, foo());
+  assertEquals(1, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo());
+})();
+
+// Test Function.prototype.apply with wrong number of arguments.
+(function() {
+  "use strict";
+  function bar() { return this; }
+  function foo() { return bar.apply(); }
+
+  assertEquals(undefined, foo());
+  assertEquals(undefined, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(undefined, foo());
+})();
+(function() {
+  "use strict";
+  function bar() { return this; }
+  function foo() { return bar.apply(this); }
+
+  assertEquals(42, foo.call(42));
+  assertEquals(42, foo.call(42));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(42, foo.call(42));
+})();
+(function() {
+  "use strict";
+  function bar() { return this; }
+  function foo() { return bar.apply(this, arguments, this); }
+
+  assertEquals(42, foo.call(42));
+  assertEquals(42, foo.call(42));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(42, foo.call(42));
+})();
+
+// Test proper order of callable check and array-like iteration
+// in Function.prototype.apply.
+(function() {
+  var dummy_length_counter = 0;
+  var dummy = { get length() { ++dummy_length_counter; return 0; } };
+
+  function foo() {
+    return Function.prototype.apply.call(undefined, this, dummy);
+  }
+
+  assertThrows(foo, TypeError);
+  assertThrows(foo, TypeError);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(foo, TypeError);
+  assertEquals(0, dummy_length_counter);
+})();
+(function() {
+  var dummy_length_counter = 0;
+  var dummy = { get length() { ++dummy_length_counter; return 0; } };
+
+  function foo() {
+    return Function.prototype.apply.call(null, this, dummy);
+  }
+
+  assertThrows(foo, TypeError);
+  assertThrows(foo, TypeError);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(foo, TypeError);
+  assertEquals(0, dummy_length_counter);
+})();
+(function() {
+  var dummy_length_counter = 0;
+  var dummy = { get length() { ++dummy_length_counter; return 0; } };
+
+  function foo() {
+    return Function.prototype.apply.call(null, this, dummy);
+  }
+
+  assertThrows(foo, TypeError);
+  assertThrows(foo, TypeError);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(foo, TypeError);
+  assertEquals(0, dummy_length_counter);
+})();
diff --git a/deps/v8/test/mjsunit/compiler/function-bind.js b/deps/v8/test/mjsunit/compiler/function-bind.js
new file mode 100644
index 0000000000..11337b4bf9
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/function-bind.js
@@ -0,0 +1,77 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+  "use strict";
+  function bar() { return this; }
+
+  function foo(x) {
+    return bar.bind(x);
+  }
+
+  assertEquals(0, foo(0)());
+  assertEquals(1, foo(1)());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals("", foo("")());
+})();
+
+(function() {
+  "use strict";
+  function bar(x) { return x; }
+
+  function foo(x) {
+    return bar.bind(undefined, x);
+  }
+
+  assertEquals(0, foo(0)());
+  assertEquals(1, foo(1)());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals("", foo("")());
+})();
+
+(function() {
+  function bar(x) { return x; }
+
+  function foo(x) {
+    return bar.bind(undefined, x);
+  }
+
+  assertEquals(0, foo(0)());
+  assertEquals(1, foo(1)());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals("", foo("")());
+})();
+
+(function() {
+  "use strict";
+  function bar(x, y) { return x + y; }
+
+  function foo(x, y) {
+    return bar.bind(undefined, x, y);
+  }
+
+  assertEquals(0, foo(0, 0)());
+  assertEquals(2, foo(1, 1)());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals("ab", foo("a", "b")());
+  assertEquals(0, foo(0, 1).length);
+  assertEquals("bound bar", foo(1, 2).name)
+})();
+
+(function() {
+  function bar(x, y) { return x + y; }
+
+  function foo(x, y) {
+    return bar.bind(undefined, x, y);
+  }
+
+  assertEquals(0, foo(0, 0)());
+  assertEquals(2, foo(1, 1)());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals("ab", foo("a", "b")());
+  assertEquals(0, foo(0, 1).length);
+  assertEquals("bound bar", foo(1, 2).name)
+})();
diff --git a/deps/v8/test/mjsunit/compiler/inline-accessors1.js b/deps/v8/test/mjsunit/compiler/inline-accessors1.js
new file mode 100644
index 0000000000..daa01ec022
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/inline-accessors1.js
@@ -0,0 +1,77 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+  class O {
+    get x() {
+      return 1;
+    }
+  }
+  var o = new O;
+
+  function foo(o) {
+    try {
+      return o.x;
+    } catch (e) {
+      return 0;
+    }
+  }
+
+  assertEquals(1, foo(o));
+  assertEquals(1, foo(o));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(o));
+})();
+
+(function() {
+  class O {
+    get x() {
+      %DeoptimizeFunction(foo);
+      return 1;
+    }
+  }
+  var o = new O;
+
+  function foo(o) {
+    try {
+      return o.x;
+    } catch (e) {
+      return 0;
+    }
+  }
+
+  assertEquals(1, foo(o));
+  assertEquals(1, foo(o));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(o));
+})();
+
+(function() {
+  function bar(x) {
+    throw x;
+  }
+
+  class O {
+    get x() {
+      %DeoptimizeFunction(foo);
+      return bar("x");
+    }
+  }
+  var o = new O;
+
+  function foo(o) {
+    try {
+      return o.x;
+    } catch (e) {
+      return 0;
+    }
+  }
+
+  assertEquals(0, foo(o));
+  assertEquals(0, foo(o));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(o));
+})();
diff --git a/deps/v8/test/mjsunit/compiler/inline-accessors.js b/deps/v8/test/mjsunit/compiler/inline-accessors2.js
index b3985bf9dc..b3985bf9dc 100644
--- a/deps/v8/test/mjsunit/compiler/inline-accessors.js
+++ b/deps/v8/test/mjsunit/compiler/inline-accessors2.js
diff --git a/deps/v8/test/mjsunit/compiler/inline-construct.js b/deps/v8/test/mjsunit/compiler/inline-construct.js
index aea1bb4848..111c0f32ad 100644
--- a/deps/v8/test/mjsunit/compiler/inline-construct.js
+++ b/deps/v8/test/mjsunit/compiler/inline-construct.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --inline-construct
+// Flags: --allow-natives-syntax
 
 // Test inlining of constructor calls.
 
diff --git a/deps/v8/test/mjsunit/compiler/inline-exception-1.js b/deps/v8/test/mjsunit/compiler/inline-exception-1.js
index ac259afad7..8da6845c3b 100644
--- a/deps/v8/test/mjsunit/compiler/inline-exception-1.js
+++ b/deps/v8/test/mjsunit/compiler/inline-exception-1.js
@@ -4,7 +4,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --turbo --no-always-opt
+// Flags: --allow-natives-syntax --no-always-opt
 
 // This test file was generated by tools/gen-inlining-tests.py .
 
diff --git a/deps/v8/test/mjsunit/compiler/inline-exception-2.js b/deps/v8/test/mjsunit/compiler/inline-exception-2.js
index 89523cc6b2..6dbc7a478b 100644
--- a/deps/v8/test/mjsunit/compiler/inline-exception-2.js
+++ b/deps/v8/test/mjsunit/compiler/inline-exception-2.js
@@ -4,7 +4,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --turbo --no-always-opt
+// Flags: --allow-natives-syntax --no-always-opt
 
 // This test file was generated by tools/gen-inlining-tests.py .
 
diff --git a/deps/v8/test/mjsunit/compiler/minus-zero.js b/deps/v8/test/mjsunit/compiler/minus-zero.js
index ac66350051..23639dfcc3 100644
--- a/deps/v8/test/mjsunit/compiler/minus-zero.js
+++ b/deps/v8/test/mjsunit/compiler/minus-zero.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --no-fold-constants
+// Flags: --allow-natives-syntax
 
 function add(x, y) {
   return x + y;
diff --git a/deps/v8/test/mjsunit/compiler/native-context-specialization-hole-check.js b/deps/v8/test/mjsunit/compiler/native-context-specialization-hole-check.js
new file mode 100644
index 0000000000..18e383bfb0
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/native-context-specialization-hole-check.js
@@ -0,0 +1,44 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt --no-stress-fullcodegen
+
+function f() {
+  Array.prototype[10] = 2;
+  var arr = new Array();
+  arr[500] = 20;
+  arr[10] = arr[50];
+}
+
+function g() {
+  f();
+}
+g();
+g();
+%OptimizeFunctionOnNextCall(g);
+g();
+assertTrue(%GetDeoptCount(g) > 0);
diff --git a/deps/v8/test/mjsunit/compiler/native-context-specialization-string-concat.js b/deps/v8/test/mjsunit/compiler/native-context-specialization-string-concat.js
new file mode 100644
index 0000000000..3b931c3a71
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/native-context-specialization-string-concat.js
@@ -0,0 +1,37 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var foo = 'foo';
+var bar = 'bar';
+
+var a;
+var b;
+var c;
+var d;
+
+function baz() { return 'baz'; }
+
+function test(arg) {
+  // All operands are constant folded by native context
+  // specialization / inlining.
+  a = '"' + foo + '-' + bar + '"';
+  b = '"' + foo + '-' + baz() + '"';
+
+  // Reduce down to a JSAdd of folded constant + arg.
+  c = foo + bar + arg;
+
+  // Reduces to a StringConcat with three operands.
+  d = '"' + foo + arg + bar + '"';
+}
+
+test('boo');
+%OptimizeFunctionOnNextCall(test);
+test('baa');
+
+assertEquals('"foo-bar"', a);
+assertEquals('"foo-baz"', b);
+assertEquals('foobarbaa', c);
+assertEquals('"foobaabar"', d);
diff --git a/deps/v8/test/mjsunit/compiler/object-isprototypeof.js b/deps/v8/test/mjsunit/compiler/object-isprototypeof.js
new file mode 100644
index 0000000000..284a4387d6
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/object-isprototypeof.js
@@ -0,0 +1,153 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Test corner cases with null/undefined receivers.
+(function() {
+  function foo(x, y) { return Object.prototype.isPrototypeOf.call(x, y); }
+
+  assertThrows(() => foo(null, {}));
+  assertThrows(() => foo(undefined, {}));
+  assertThrows(() => foo(null, []));
+  assertThrows(() => foo(undefined, []));
+  assertFalse(foo(null, 0));
+  assertFalse(foo(undefined, 0));
+  assertFalse(foo(null, ""));
+  assertFalse(foo(undefined, ""));
+  assertFalse(foo(null, null));
+  assertFalse(foo(undefined, null));
+  assertFalse(foo(null, undefined));
+  assertFalse(foo(undefined, undefined));
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(() => foo(null, {}));
+  assertThrows(() => foo(undefined, {}));
+  assertThrows(() => foo(null, []));
+  assertThrows(() => foo(undefined, []));
+  assertFalse(foo(null, 0));
+  assertFalse(foo(undefined, 0));
+  assertFalse(foo(null, ""));
+  assertFalse(foo(undefined, ""));
+  assertFalse(foo(null, null));
+  assertFalse(foo(undefined, null));
+  assertFalse(foo(null, undefined));
+  assertFalse(foo(undefined, undefined));
+})();
+
+// Test general constructor prototype case.
+(function() {
+  function A() {}
+  A.prototype = {};
+  var a = new A;
+
+  function foo(x) { return A.prototype.isPrototypeOf(x); }
+
+  assertFalse(foo(0));
+  assertFalse(foo(""));
+  assertFalse(foo(null));
+  assertFalse(foo(undefined));
+  assertFalse(foo({}));
+  assertFalse(foo([]));
+  assertTrue(foo(a));
+  assertTrue(foo(new A));
+  assertTrue(foo({__proto__: a}));
+  assertTrue(foo({__proto__: A.prototype}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(0));
+  assertFalse(foo(""));
+  assertFalse(foo(null));
+  assertFalse(foo(undefined));
+  assertFalse(foo({}));
+  assertFalse(foo([]));
+  assertTrue(foo(a));
+  assertTrue(foo(new A));
+  assertTrue(foo({__proto__: a}));
+  assertTrue(foo({__proto__: A.prototype}));
+})();
+
+// Test known primitive values.
+(function() {
+  function A() {}
+  A.prototype = {};
+  var a = new A;
+
+  function foo() { return A.prototype.isPrototypeOf(0); }
+
+  assertFalse(foo());
+  assertFalse(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo());
+})();
+(function() {
+  function A() {}
+  A.prototype = {};
+  var a = new A;
+
+  function foo() { return A.prototype.isPrototypeOf(null); }
+
+  assertFalse(foo());
+  assertFalse(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo());
+})();
+(function() {
+  function A() {}
+  A.prototype = {};
+  var a = new A;
+
+  function foo() { return A.prototype.isPrototypeOf(undefined); }
+
+  assertFalse(foo());
+  assertFalse(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo());
+})();
+
+// Test constant-folded prototype chain checks.
+(function() {
+  function A() {}
+  A.prototype = {};
+  var a = new A;
+
+  function foo() { return A.prototype.isPrototypeOf(a); }
+
+  assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();
+(function() {
+  function A() {}
+  var a = new A;
+  A.prototype = {};
+
+  function foo() { return A.prototype.isPrototypeOf(a); }
+
+  assertFalse(foo());
+  assertFalse(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo());
+})();
+
+// Test Array prototype chain checks.
+(function() {
+  var a = [];
+
+  function foo() { return Array.prototype.isPrototypeOf(a); }
+
+  assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();
+(function() {
+  var a = [];
+
+  function foo() { return Object.prototype.isPrototypeOf(a); }
+
+  assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();
diff --git a/deps/v8/test/mjsunit/compiler/optimized-with.js b/deps/v8/test/mjsunit/compiler/optimized-with.js
new file mode 100644
index 0000000000..9bc8713722
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/optimized-with.js
@@ -0,0 +1,23 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Test with-statements inside a try-catch block.
+(() => {
+  function f(object) {
+    try {
+      with (object) { return x }
+    } catch(e) {
+      return e
+    }
+  }
+  assertEquals(23, f({ x:23 }));
+  assertEquals(42, f({ x:42 }));
+  assertInstanceof(f(null), TypeError);
+  assertInstanceof(f(undefined), TypeError);
+  %OptimizeFunctionOnNextCall(f);
+  assertInstanceof(f(null), TypeError);
+  assertInstanceof(f(undefined), TypeError);
+})();
diff --git a/deps/v8/test/mjsunit/compiler/reflect-apply.js b/deps/v8/test/mjsunit/compiler/reflect-apply.js
new file mode 100644
index 0000000000..fb8f201a72
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/reflect-apply.js
@@ -0,0 +1,114 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Test Reflect.apply with wrong number of arguments.
+(function() {
+  "use strict";
+  function bar() { return this; }
+  function foo() { return Reflect.apply(bar); }
+
+  assertThrows(foo);
+  assertThrows(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(foo);
+})();
+(function() {
+  "use strict";
+  function bar() { return this; }
+  function foo() { return Reflect.apply(bar, this); }
+
+  assertThrows(foo);
+  assertThrows(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(foo);
+})();
+(function() {
+  "use strict";
+  function bar() { return this; }
+  function foo() { return Reflect.apply(bar, this, arguments, this); }
+
+  assertEquals(42, foo.call(42));
+  assertEquals(42, foo.call(42));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(42, foo.call(42));
+})();
+
+// Test Reflect.apply within try/catch.
+(function() {
+  "use strict";
+  function foo(bar) {
+    try {
+      return Reflect.apply(bar, bar, arguments);
+    } catch (e) {
+      return 1;
+    }
+  }
+
+  assertEquals(1, foo());
+  assertEquals(1, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo());
+})();
+(function() {
+  "use strict";
+  function foo(bar) {
+    try {
+      return Reflect.apply(bar, bar, bar);
+    } catch (e) {
+      return 1;
+    }
+  }
+
+  assertEquals(1, foo());
+  assertEquals(1, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo());
+})();
+
+// Test proper order of callable check and array-like iteration
+// in Reflect.apply.
+(function() {
+  var dummy_length_counter = 0;
+  var dummy = { get length() { ++dummy_length_counter; return 0; } };
+
+  function foo() {
+    return Reflect.apply(undefined, this, dummy);
+  }
+
+  assertThrows(foo, TypeError);
+  assertThrows(foo, TypeError);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(foo, TypeError);
+  assertEquals(0, dummy_length_counter);
+})();
+(function() {
+  var dummy_length_counter = 0;
+  var dummy = { get length() { ++dummy_length_counter; return 0; } };
+
+  function foo() {
+    return Reflect.apply(null, this, dummy);
+  }
+
+  assertThrows(foo, TypeError);
+  assertThrows(foo, TypeError);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(foo, TypeError);
+  assertEquals(0, dummy_length_counter);
+})();
+(function() {
+  var dummy_length_counter = 0;
+  var dummy = { get length() { ++dummy_length_counter; return 0; } };
+
+  function foo() {
+    return Reflect.apply(null, this, dummy);
+  }
+
+  assertThrows(foo, TypeError);
+  assertThrows(foo, TypeError);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(foo, TypeError);
+  assertEquals(0, dummy_length_counter);
+})();
diff --git a/deps/v8/test/mjsunit/compiler/reflect-construct.js b/deps/v8/test/mjsunit/compiler/reflect-construct.js
new file mode 100644
index 0000000000..fb70ff4412
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/reflect-construct.js
@@ -0,0 +1,130 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Test Reflect.construct with wrong number of arguments.
+(function() {
+  "use strict";
+  function A() {}
+  function foo() { return Reflect.construct(A); }
+
+  assertThrows(foo);
+  assertThrows(foo);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(foo);
+})();
+(function() {
+  "use strict";
+  function A(x) { this.x = x; }
+  function foo() { return Reflect.construct(A, arguments); }
+
+  assertInstanceof(foo(), A);
+  assertInstanceof(foo(), A);
+  assertEquals(1, foo(1).x);
+  %OptimizeFunctionOnNextCall(foo);
+  assertInstanceof(foo(), A);
+  assertEquals(1, foo(1).x);
+})();
+(function() {
+  "use strict";
+  function A(x) { this.x = x; }
+  function foo() { return Reflect.construct(A, arguments, A, A); }
+
+  assertInstanceof(foo(), A);
+  assertInstanceof(foo(), A);
+  assertEquals(1, foo(1).x);
+  %OptimizeFunctionOnNextCall(foo);
+  assertInstanceof(foo(), A);
+  assertEquals(1, foo(1).x);
+})();
+
+// Test Reflect.construct within try/catch.
+(function() {
+  "use strict";
+  function foo(bar) {
+    try {
+      return Reflect.construct(bar, arguments, bar);
+    } catch (e) {
+      return 1;
+    }
+  }
+
+  assertEquals(1, foo());
+  assertEquals(1, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo());
+})();
+(function() {
+  "use strict";
+  function foo(bar) {
+    try {
+      return Reflect.construct(bar, bar, bar);
+    } catch (e) {
+      return 1;
+    }
+  }
+
+  assertEquals(1, foo());
+  assertEquals(1, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo());
+})();
+
+// Test proper order of constructor check(s) and array-like iteration.
+(function() {
+  var dummy_length_counter = 0;
+  var dummy = { get length() { ++dummy_length_counter; return 0; } };
+
+  function foo() {
+    return Reflect.construct(undefined, dummy, undefined);
+  }
+
+  assertThrows(foo, TypeError);
+  assertThrows(foo, TypeError);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(foo, TypeError);
+  assertEquals(0, dummy_length_counter);
+})();
+(function() {
+  var dummy_length_counter = 0;
+  var dummy = { get length() { ++dummy_length_counter; return 0; } };
+
+  function foo() {
+    return Reflect.construct(undefined, dummy);
+  }
+
+  assertThrows(foo, TypeError);
+  assertThrows(foo, TypeError);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(foo, TypeError);
+  assertEquals(0, dummy_length_counter);
+})();
+(function() {
+  var dummy_length_counter = 0;
+  var dummy = { get length() { ++dummy_length_counter; return 0; } };
+
+  function foo() {
+    return Reflect.construct(null, dummy, null);
+  }
+
+  assertThrows(foo, TypeError);
+  assertThrows(foo, TypeError);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(foo, TypeError);
+  assertEquals(0, dummy_length_counter);
+})();(function() {
+  var dummy_length_counter = 0;
+  var dummy = { get length() { ++dummy_length_counter; return 0; } };
+
+  function foo() {
+    return Reflect.construct(null, dummy);
+  }
+
+  assertThrows(foo, TypeError);
+  assertThrows(foo, TypeError);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(foo, TypeError);
+  assertEquals(0, dummy_length_counter);
+})();
diff --git a/deps/v8/test/mjsunit/compiler/regress-4389-1.js b/deps/v8/test/mjsunit/compiler/regress-4389-1.js
index c58ce2da40..adb37165db 100644
--- a/deps/v8/test/mjsunit/compiler/regress-4389-1.js
+++ b/deps/v8/test/mjsunit/compiler/regress-4389-1.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --dead-code-elimination
+// Flags: --allow-natives-syntax
 
 function foo(x) { Math.fround(x); }
 foo(1);
diff --git a/deps/v8/test/mjsunit/compiler/regress-4389-2.js b/deps/v8/test/mjsunit/compiler/regress-4389-2.js
index 3b720a5a95..edfcf7a8f5 100644
--- a/deps/v8/test/mjsunit/compiler/regress-4389-2.js
+++ b/deps/v8/test/mjsunit/compiler/regress-4389-2.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --dead-code-elimination
+// Flags: --allow-natives-syntax
 
 function foo(x) { Math.sqrt(x); }
 foo(1);
diff --git a/deps/v8/test/mjsunit/compiler/regress-4389-3.js b/deps/v8/test/mjsunit/compiler/regress-4389-3.js
index 9aa72d1ac9..f4dbc48670 100644
--- a/deps/v8/test/mjsunit/compiler/regress-4389-3.js
+++ b/deps/v8/test/mjsunit/compiler/regress-4389-3.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --dead-code-elimination
+// Flags: --allow-natives-syntax
 
 function foo(x) { Math.floor(x); }
 foo(1);
diff --git a/deps/v8/test/mjsunit/compiler/regress-4389-4.js b/deps/v8/test/mjsunit/compiler/regress-4389-4.js
index e824973fac..2b9b1493eb 100644
--- a/deps/v8/test/mjsunit/compiler/regress-4389-4.js
+++ b/deps/v8/test/mjsunit/compiler/regress-4389-4.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --dead-code-elimination
+// Flags: --allow-natives-syntax
 
 function foo(x) { Math.round(x); }
 foo(1);
diff --git a/deps/v8/test/mjsunit/compiler/regress-4389-5.js b/deps/v8/test/mjsunit/compiler/regress-4389-5.js
index 64797bc76c..e72a3c38ea 100644
--- a/deps/v8/test/mjsunit/compiler/regress-4389-5.js
+++ b/deps/v8/test/mjsunit/compiler/regress-4389-5.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --dead-code-elimination
+// Flags: --allow-natives-syntax
 
 function foo(x) { Math.abs(x); }
 foo(1);
diff --git a/deps/v8/test/mjsunit/compiler/regress-4389-6.js b/deps/v8/test/mjsunit/compiler/regress-4389-6.js
index fe065707f4..72a8856525 100644
--- a/deps/v8/test/mjsunit/compiler/regress-4389-6.js
+++ b/deps/v8/test/mjsunit/compiler/regress-4389-6.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --dead-code-elimination
+// Flags: --allow-natives-syntax
 
 function foo(x) { Math.log(x); }
 foo(1);
diff --git a/deps/v8/test/mjsunit/compiler/regress-4413-1.js b/deps/v8/test/mjsunit/compiler/regress-4413-1.js
index 6f5371127d..569823530f 100644
--- a/deps/v8/test/mjsunit/compiler/regress-4413-1.js
+++ b/deps/v8/test/mjsunit/compiler/regress-4413-1.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --turbo-asm
+// Flags: --allow-natives-syntax
 
 var foo = (function(stdlib) {
   "use asm";
diff --git a/deps/v8/test/mjsunit/compiler/regress-445732.js b/deps/v8/test/mjsunit/compiler/regress-445732.js
index 199a29a5f8..725e1282d6 100644
--- a/deps/v8/test/mjsunit/compiler/regress-445732.js
+++ b/deps/v8/test/mjsunit/compiler/regress-445732.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --turbo-asm
+// Flags: --allow-natives-syntax
 
 "use asm";
 
diff --git a/deps/v8/test/mjsunit/compiler/regress-628773.js b/deps/v8/test/mjsunit/compiler/regress-628773.js
index 3c315b3828..cb1fa6fd64 100644
--- a/deps/v8/test/mjsunit/compiler/regress-628773.js
+++ b/deps/v8/test/mjsunit/compiler/regress-628773.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-tailcalls
-
 "use strict";
 
 function foo() {
diff --git a/deps/v8/test/mjsunit/compiler/regress-713367.js b/deps/v8/test/mjsunit/compiler/regress-713367.js
index 9cca5a8325..1bf0a04493 100644
--- a/deps/v8/test/mjsunit/compiler/regress-713367.js
+++ b/deps/v8/test/mjsunit/compiler/regress-713367.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --turbo --turbo-escape
+// Flags: --allow-natives-syntax --turbo-escape
 
 var mp = Object.getPrototypeOf(0);
 
diff --git a/deps/v8/test/mjsunit/compiler/regress-725743.js b/deps/v8/test/mjsunit/compiler/regress-725743.js
new file mode 100644
index 0000000000..95904bc632
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-725743.js
@@ -0,0 +1,16 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-turbo --cache=code --no-lazy
+
+function f() {
+  var n = a.length;
+  for (var i = 0; i < n; i++) {
+  }
+  for (var i = 0; i < n; i++) {
+  }
+}
+var a = "xxxxxxxxxxxxxxxxxxxxxxxxx";
+while (a.length < 100000) a = a + a;
+f();
diff --git a/deps/v8/test/mjsunit/compiler/regress-729369.js b/deps/v8/test/mjsunit/compiler/regress-729369.js
new file mode 100644
index 0000000000..3294564715
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-729369.js
@@ -0,0 +1,15 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function* f() {
+  x.__defineGetter__();
+  var x = 0;
+  for (let y of iterable) {
+    yield y;
+  }
+}
+
+f();
diff --git a/deps/v8/test/mjsunit/compiler/regress-731495.js b/deps/v8/test/mjsunit/compiler/regress-731495.js
new file mode 100644
index 0000000000..7e0d850efb
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-731495.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  global = "";
+  global = global + "bar";
+  return global;
+};
+
+assertEquals(foo(), "bar");
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(foo(), "bar");
diff --git a/deps/v8/test/mjsunit/compiler/regress-733181.js b/deps/v8/test/mjsunit/compiler/regress-733181.js
new file mode 100644
index 0000000000..0a76ab70ea
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-733181.js
@@ -0,0 +1,23 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function l(s) {
+  return ("xxxxxxxxxxxxxxxxxxxxxxx" + s).toLowerCase();
+}
+
+l("abcd");
+l("abcd");
+%OptimizeFunctionOnNextCall(l);
+l("abcd");
+
+function u(s) {
+  return ("xxxxxxxxxxxxxxxxxxxxxxx" + s).toUpperCase();
+}
+
+u("abcd");
+u("abcd");
+%OptimizeFunctionOnNextCall(u);
+u("abcd");
diff --git a/deps/v8/test/mjsunit/compiler/regress-736567.js b/deps/v8/test/mjsunit/compiler/regress-736567.js
new file mode 100644
index 0000000000..84c6dce1ff
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-736567.js
@@ -0,0 +1,20 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(b, x) {
+  var o = b ? { a : 1 } : undefined;
+  return o.a + !(x & 1);
+}
+
+f(1);
+
+function g() {
+  f(0, "s");
+}
+
+assertThrows(g);
+%OptimizeFunctionOnNextCall(g);
+assertThrows(g);
diff --git a/deps/v8/test/mjsunit/compiler/regress-739902.js b/deps/v8/test/mjsunit/compiler/regress-739902.js
new file mode 100644
index 0000000000..8f94995840
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-739902.js
@@ -0,0 +1,28 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+  function f(x) {
+    return String.fromCharCode(x >>> 24);
+  };
+
+  var e = 0x41000001;
+
+  f(e);
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("A", f(e));
+})();
+
+(function() {
+  function f(x) {
+    return (x >>> 24) & 0xffff;
+  };
+
+  f(1);
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(0, f(1));
+  assertEquals(100, f((100 << 24) + 42));
+})();
diff --git a/deps/v8/test/mjsunit/compiler/regress-compare-negate.js b/deps/v8/test/mjsunit/compiler/regress-compare-negate.js
index 5591af1b32..e18d6a0f0e 100644
--- a/deps/v8/test/mjsunit/compiler/regress-compare-negate.js
+++ b/deps/v8/test/mjsunit/compiler/regress-compare-negate.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --turbo --opt
+// Flags: --allow-natives-syntax --opt
 
 function CompareNegate(a,b) {
  a = a|0;
diff --git a/deps/v8/test/mjsunit/compiler/regress-escape-analysis-indirect.js b/deps/v8/test/mjsunit/compiler/regress-escape-analysis-indirect.js
index 6d79a93133..01f3e13466 100644
--- a/deps/v8/test/mjsunit/compiler/regress-escape-analysis-indirect.js
+++ b/deps/v8/test/mjsunit/compiler/regress-escape-analysis-indirect.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --turbo --turbo-escape
+// Flags: --allow-natives-syntax --turbo-escape
 
 function f(apply) {
   var value = 23;
diff --git a/deps/v8/test/mjsunit/compiler/rest-parameters.js b/deps/v8/test/mjsunit/compiler/rest-parameters.js
index b960a23aaf..45b8cb34df 100644
--- a/deps/v8/test/mjsunit/compiler/rest-parameters.js
+++ b/deps/v8/test/mjsunit/compiler/rest-parameters.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --turbo
+// Flags: --allow-natives-syntax
 
 (function Rest0Params() {
 
diff --git a/deps/v8/test/mjsunit/compiler/spread-call.js b/deps/v8/test/mjsunit/compiler/spread-call.js
new file mode 100644
index 0000000000..1b7ae6f301
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/spread-call.js
@@ -0,0 +1,80 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function tests() {
+  "use strict"
+  function countArgs() { return arguments.length; }
+
+  // Array params
+  assertEquals(3, countArgs(...[1, 2, 3]));                       // Smi
+  assertEquals(4, countArgs(...[1, 2, , 3]));                     // HoleySmi
+  assertEquals(3, countArgs(...[1.1, 2, 3]));                     // Double
+  assertEquals(4, countArgs(...[1.1, 2, , 3]));                   // HoleyDouble
+  assertEquals(3, countArgs(...[{valueOf: () => 0}, 1.1, '2']));  // Object
+  assertEquals(
+      4, countArgs(...[{valueOf: () => 0}, 1.1, , '2']));  // HoleyObject
+
+  // Smi param
+  assertThrows(() => countArgs(...1), TypeError);
+
+  // Object param
+  assertThrows(() => countArgs(...{0: 0}), TypeError);
+
+  // Strict arguments
+  assertEquals(0, countArgs(...arguments));
+}
+
+tests();
+tests();
+%OptimizeFunctionOnNextCall(tests);
+tests();
+
+function testRest(...args) {
+  function countArgs() { return arguments.length; }
+  assertEquals(3, countArgs(...args));
+  assertEquals(4, countArgs(1, ...args));
+  assertEquals(5, countArgs(1, 2, ...args));
+}
+testRest(1, 2, 3);
+testRest(1, 2, 3);
+%OptimizeFunctionOnNextCall(testRest);
+testRest(1, 2, 3);
+
+function testRestAndArgs(a, b, ...args) {
+  function countArgs() { return arguments.length; }
+  assertEquals(1, countArgs(...args));
+  assertEquals(2, countArgs(b, ...args));
+  assertEquals(3, countArgs(a, b, ...args));
+  assertEquals(4, countArgs(1, a, b, ...args));
+  assertEquals(5, countArgs(1, 2, a, b, ...args));
+}
+testRestAndArgs(1, 2, 3);
+testRestAndArgs(1, 2, 3);
+%OptimizeFunctionOnNextCall(testRestAndArgs);
+testRestAndArgs(1, 2, 3);
+
+function testArgumentsStrict() {
+  "use strict"
+  function countArgs() { return arguments.length; }
+  assertEquals(3, countArgs(...arguments));
+  assertEquals(4, countArgs(1, ...arguments));
+  assertEquals(5, countArgs(1, 2, ...arguments));
+}
+testArgumentsStrict(1, 2, 3);
+testArgumentsStrict(1, 2, 3);
+%OptimizeFunctionOnNextCall(testArgumentsStrict);
+testArgumentsStrict(1, 2, 3);
+
+function testArgumentsSloppy() {
+  function countArgs() { return arguments.length; }
+  assertEquals(3, countArgs(...arguments));
+  assertEquals(4, countArgs(1, ...arguments));
+  assertEquals(5, countArgs(1, 2, ...arguments));
+}
+testArgumentsSloppy(1, 2, 3);
+testArgumentsSloppy(1, 2, 3);
+%OptimizeFunctionOnNextCall(testArgumentsSloppy);
+testArgumentsSloppy(1, 2, 3);
diff --git a/deps/v8/test/mjsunit/compiler/string-concat-try-catch.js b/deps/v8/test/mjsunit/compiler/string-concat-try-catch.js
new file mode 100644
index 0000000000..dfd6edbb27
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/string-concat-try-catch.js
@@ -0,0 +1,28 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = "a".repeat(268435440);
+
+(function() {
+  function foo(a) {
+    try {
+      return "longer than ConsString:kMinLength" + a + "0123456789012";
+    } catch (e) {
+      return e;
+    }
+  }
+
+  foo("a");
+  foo("a");
+  // Optimize with string length protector check.
+  %OptimizeFunctionOnNextCall(foo);
+  foo("a");
+  assertInstanceof(foo(a), RangeError);
+  // Optimize without string length protector check.
+  %OptimizeFunctionOnNextCall(foo);
+  foo("a");
+  assertInstanceof(foo(a), RangeError);
+})();
diff --git a/deps/v8/test/mjsunit/compiler/string-concat-yield.js b/deps/v8/test/mjsunit/compiler/string-concat-yield.js
new file mode 100644
index 0000000000..d6611d2d36
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/string-concat-yield.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function* foo() {
+  var f = `foo${ yield 'yielded' }bar`;
+  return f;
+}
+
+%OptimizeFunctionOnNextCall(foo);
+var gen = foo();
+assertEquals('yielded', gen.next('unused').value);
+assertEquals('foobazbar', gen.next('baz').value);