deps: update V8 to 5.4.500.27

Pick up latest commit from the 5.4-lkgr branch.

deps: edit V8 gitignore to allow trace event copy
deps: update V8 trace event to 315bf1e2d45be7d53346c31cfcc37424a32c30c8
deps: edit V8 gitignore to allow gtest_prod.h copy
deps: update V8 gtest to 6f8a66431cb592dad629028a50b3dd418a408c87

PR-URL: https://github.com/nodejs/node/pull/8317
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com>

86 files changed, 1254 insertions, 123 deletions

diff --git a/deps/v8/test/mjsunit/compiler/accessor-exceptions1.js b/deps/v8/test/mjsunit/compiler/accessor-exceptions1.js
new file mode 100644
index 0000000000..716d229aba
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/accessor-exceptions1.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var o = {}
+Object.defineProperty(o, "x", {
+  get: function() { throw 7; }
+});
+
+function foo(o) {
+  var x = 1;
+  try { o.x; } catch (e) { x = e; }
+  return x;
+}
+
+assertEquals(7, foo(o));
+assertEquals(7, foo(o));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(7, foo(o));
diff --git a/deps/v8/test/mjsunit/compiler/accessor-exceptions2.js b/deps/v8/test/mjsunit/compiler/accessor-exceptions2.js
new file mode 100644
index 0000000000..ed6e3e21c0
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/accessor-exceptions2.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var o = {}
+Object.defineProperty(o, "x", {
+  set: function(v) { throw 7; }
+});
+
+function foo(o) {
+  var x = 1;
+  try { o.x = 2; } catch (e) { x = e; }
+  return x;
+}
+
+assertEquals(7, foo(o));
+assertEquals(7, foo(o));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(7, foo(o));
diff --git a/deps/v8/test/mjsunit/compiler/deopt-accessors1.js b/deps/v8/test/mjsunit/compiler/deopt-accessors1.js
new file mode 100644
index 0000000000..3589258656
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/deopt-accessors1.js
@@ -0,0 +1,28 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var o = {v:1};
+var deopt = false;
+
+Object.defineProperty(o, "x", {
+  get: function() { return this.v; },
+  set: function(v) {
+    this.v = v;
+    if (deopt) {
+      %DeoptimizeFunction(foo);
+    }
+  }
+});
+
+function foo(o) {
+  return o.x++;
+}
+
+assertEquals(1, foo(o));
+assertEquals(2, foo(o));
+%OptimizeFunctionOnNextCall(foo);
+deopt = true;
+assertEquals(3, foo(o));
diff --git a/deps/v8/test/mjsunit/compiler/deopt-accessors2.js b/deps/v8/test/mjsunit/compiler/deopt-accessors2.js
new file mode 100644
index 0000000000..74d41397bf
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/deopt-accessors2.js
@@ -0,0 +1,28 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var o = {v:1};
+var deopt = false;
+
+Object.defineProperty(o, "x", {
+  get: function() { return this.v; },
+  set: function(v) {
+    this.v = v;
+    if (deopt) {
+      %DeoptimizeFunction(foo);
+    }
+  }
+});
+
+function foo(o) {
+  return ++o.x;
+}
+
+assertEquals(2, foo(o));
+assertEquals(3, foo(o));
+%OptimizeFunctionOnNextCall(foo);
+deopt = true;
+assertEquals(4, foo(o));
diff --git a/deps/v8/test/mjsunit/compiler/deopt-accessors3.js b/deps/v8/test/mjsunit/compiler/deopt-accessors3.js
new file mode 100644
index 0000000000..035cf2b359
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/deopt-accessors3.js
@@ -0,0 +1,29 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var o = {v:1};
+var deopt = false;
+
+Object.defineProperty(o, "x", {
+  get: function() { return this.v; },
+  set: function(v) {
+    this.v = v;
+    if (deopt) {
+      %DeoptimizeFunction(foo);
+    }
+  }
+});
+
+function foo(o) {
+  var x = "x";
+  return o[x]++;
+}
+
+assertEquals(1, foo(o));
+assertEquals(2, foo(o));
+%OptimizeFunctionOnNextCall(foo);
+deopt = true;
+assertEquals(3, foo(o));
diff --git a/deps/v8/test/mjsunit/compiler/deopt-accessors4.js b/deps/v8/test/mjsunit/compiler/deopt-accessors4.js
new file mode 100644
index 0000000000..5a8453f237
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/deopt-accessors4.js
@@ -0,0 +1,29 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var o = {v:1};
+var deopt = false;
+
+Object.defineProperty(o, "x", {
+  get: function() { return this.v; },
+  set: function(v) {
+    this.v = v;
+    if (deopt) {
+      %DeoptimizeFunction(foo);
+    }
+  }
+});
+
+function foo(o) {
+  var x = "x";
+  return ++o[x];
+}
+
+assertEquals(2, foo(o));
+assertEquals(3, foo(o));
+%OptimizeFunctionOnNextCall(foo);
+deopt = true;
+assertEquals(4, foo(o));
diff --git a/deps/v8/test/mjsunit/compiler/deopt-accessors5.js b/deps/v8/test/mjsunit/compiler/deopt-accessors5.js
new file mode 100644
index 0000000000..1b23c532dc
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/deopt-accessors5.js
@@ -0,0 +1,23 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-tailcalls
+
+"use strict";
+
+function f(v) {
+  %DeoptimizeFunction(test);
+  return 153;
+}
+
+function test() {
+  var o = {};
+  o.__defineSetter__('q', f);
+  assertEquals(1, o.q = 1);
+}
+
+test();
+test();
+%OptimizeFunctionOnNextCall(test);
+test();
diff --git a/deps/v8/test/mjsunit/compiler/deopt-accessors6.js b/deps/v8/test/mjsunit/compiler/deopt-accessors6.js
new file mode 100644
index 0000000000..16fb4ddf64
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/deopt-accessors6.js
@@ -0,0 +1,24 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-tailcalls
+
+"use strict";
+
+function f(v) {
+  %DeoptimizeFunction(test);
+  return 153;
+}
+
+function test() {
+  var o = {};
+  var q = "q";
+  o.__defineSetter__(q, f);
+  assertEquals(1, o[q] = 1);
+}
+
+test();
+test();
+%OptimizeFunctionOnNextCall(test);
+test();
diff --git a/deps/v8/test/mjsunit/compiler/deopt-accessors7.js b/deps/v8/test/mjsunit/compiler/deopt-accessors7.js
new file mode 100644
index 0000000000..8c7d7a1e3c
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/deopt-accessors7.js
@@ -0,0 +1,30 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var o = {v:1};
+var deopt = false;
+Object.defineProperty(o, "x", {
+  get: function() {
+    if (deopt) %DeoptimizeFunction(foo);
+    return 1;
+  }
+});
+
+function bar(x, y, z) {
+  return x + z;
+}
+
+function foo(o, x) {
+  return bar(1, (o[x], 2), 3);
+}
+
+assertEquals(4, foo(o, "v"));
+assertEquals(4, foo(o, "v"));
+assertEquals(4, foo(o, "x"));
+assertEquals(4, foo(o, "x"));
+%OptimizeFunctionOnNextCall(foo);
+deopt = true;
+assertEquals(4, foo(o, "x"));
diff --git a/deps/v8/test/mjsunit/compiler/deopt-materialize-accumulator.js b/deps/v8/test/mjsunit/compiler/deopt-materialize-accumulator.js
index 217de769d3..0b19df8a1c 100644
--- a/deps/v8/test/mjsunit/compiler/deopt-materialize-accumulator.js
+++ b/deps/v8/test/mjsunit/compiler/deopt-materialize-accumulator.js
@@ -34,7 +34,7 @@ var global = 3;
 function f(a) {
   // This will trigger a deopt since global was previously a SMI, with the
   // accumulator holding an unboxed double which needs materialized.
-  global = %math_sqrt(a);
+  global = Math.sqrt(a);
 }
 %OptimizeFunctionOnNextCall(f);
 f(0.25);
diff --git a/deps/v8/test/mjsunit/compiler/dont-constant-fold-deopting-checks.js b/deps/v8/test/mjsunit/compiler/dont-constant-fold-deopting-checks.js
new file mode 100644
index 0000000000..02bd8d9a25
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/dont-constant-fold-deopting-checks.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar(a) { a[0](true); }
+function foo(a) { return bar(1); }
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(function() {bar([foo])}, TypeError);
diff --git a/deps/v8/test/mjsunit/compiler/escape-analysis-1.js b/deps/v8/test/mjsunit/compiler/escape-analysis-1.js
index b8c66448dc..f05040bd02 100644
--- a/deps/v8/test/mjsunit/compiler/escape-analysis-1.js
+++ b/deps/v8/test/mjsunit/compiler/escape-analysis-1.js
@@ -26,7 +26,6 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --allow-natives-syntax --turbo-escape
-//
 
 function f(a) {
   "use strict";
diff --git a/deps/v8/test/mjsunit/compiler/escape-analysis-10.js b/deps/v8/test/mjsunit/compiler/escape-analysis-10.js
index c53cf4d989..4f06d57dcf 100644
--- a/deps/v8/test/mjsunit/compiler/escape-analysis-10.js
+++ b/deps/v8/test/mjsunit/compiler/escape-analysis-10.js
@@ -26,6 +26,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --allow-natives-syntax --turbo-escape
+
 (function() {
   "use strict";
   function f() {
diff --git a/deps/v8/test/mjsunit/compiler/escape-analysis-2.js b/deps/v8/test/mjsunit/compiler/escape-analysis-2.js
index d116e9a364..49f440e856 100644
--- a/deps/v8/test/mjsunit/compiler/escape-analysis-2.js
+++ b/deps/v8/test/mjsunit/compiler/escape-analysis-2.js
@@ -26,7 +26,6 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --allow-natives-syntax --turbo-escape
-//
 
 function f(a) {
   "use strict";
diff --git a/deps/v8/test/mjsunit/compiler/escape-analysis-3.js b/deps/v8/test/mjsunit/compiler/escape-analysis-3.js
index d1ebc9b1f8..b92d1c3876 100644
--- a/deps/v8/test/mjsunit/compiler/escape-analysis-3.js
+++ b/deps/v8/test/mjsunit/compiler/escape-analysis-3.js
@@ -26,7 +26,6 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --allow-natives-syntax --turbo-escape
-//
 
 function f(a) {
   "use strict";
diff --git a/deps/v8/test/mjsunit/compiler/escape-analysis-4.js b/deps/v8/test/mjsunit/compiler/escape-analysis-4.js
index d9fdccc143..ef9f95fd36 100644
--- a/deps/v8/test/mjsunit/compiler/escape-analysis-4.js
+++ b/deps/v8/test/mjsunit/compiler/escape-analysis-4.js
@@ -26,7 +26,6 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --allow-natives-syntax --turbo-escape
-//
 
 function f(a) {
   "use strict";
diff --git a/deps/v8/test/mjsunit/compiler/escape-analysis-5.js b/deps/v8/test/mjsunit/compiler/escape-analysis-5.js
index cfaf81dbc3..54b5e82958 100644
--- a/deps/v8/test/mjsunit/compiler/escape-analysis-5.js
+++ b/deps/v8/test/mjsunit/compiler/escape-analysis-5.js
@@ -26,7 +26,6 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --allow-natives-syntax --turbo-escape
-//
 
 function f(h) {
   "use strict";
diff --git a/deps/v8/test/mjsunit/compiler/escape-analysis-6.js b/deps/v8/test/mjsunit/compiler/escape-analysis-6.js
index 6143cfbc1f..c36e7d956e 100644
--- a/deps/v8/test/mjsunit/compiler/escape-analysis-6.js
+++ b/deps/v8/test/mjsunit/compiler/escape-analysis-6.js
@@ -26,7 +26,6 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --allow-natives-syntax --turbo-escape
-//
 
 function f(a) {
   "use strict";
diff --git a/deps/v8/test/mjsunit/compiler/escape-analysis-7.js b/deps/v8/test/mjsunit/compiler/escape-analysis-7.js
index 16bc71c017..cfa30cbeb4 100644
--- a/deps/v8/test/mjsunit/compiler/escape-analysis-7.js
+++ b/deps/v8/test/mjsunit/compiler/escape-analysis-7.js
@@ -26,7 +26,6 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --allow-natives-syntax --turbo-escape
-//
 
 function f() {
   this.x=0;
diff --git a/deps/v8/test/mjsunit/compiler/escape-analysis-8.js b/deps/v8/test/mjsunit/compiler/escape-analysis-8.js
index bc5b1d963e..d9c6d254ef 100644
--- a/deps/v8/test/mjsunit/compiler/escape-analysis-8.js
+++ b/deps/v8/test/mjsunit/compiler/escape-analysis-8.js
@@ -26,7 +26,6 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --allow-natives-syntax --turbo-escape
-//
 
 function f(a) {
   this.x=a;
diff --git a/deps/v8/test/mjsunit/compiler/escape-analysis-9.js b/deps/v8/test/mjsunit/compiler/escape-analysis-9.js
index a19786b360..0b8f75c576 100644
--- a/deps/v8/test/mjsunit/compiler/escape-analysis-9.js
+++ b/deps/v8/test/mjsunit/compiler/escape-analysis-9.js
@@ -26,7 +26,6 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --allow-natives-syntax --turbo-escape
-//
 
 function f() {
   return arguments;
diff --git a/deps/v8/test/mjsunit/compiler/inline-dead-jscreate.js b/deps/v8/test/mjsunit/compiler/inline-dead-jscreate.js
new file mode 100644
index 0000000000..a9778758c4
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/inline-dead-jscreate.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var bar = 0;
+
+function baz() { return this; }
+
+function foo() {
+  bar += 1;
+  if (bar === 2) throw new baz();
+}
+
+foo();
diff --git a/deps/v8/test/mjsunit/compiler/inlined-array-pop-getter1.js b/deps/v8/test/mjsunit/compiler/inlined-array-pop-getter1.js
new file mode 100644
index 0000000000..8eb1c308a3
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/inlined-array-pop-getter1.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(a) {
+  return a.pop();
+}
+
+var a = new Array(4);
+
+assertEquals(undefined, foo(a));
+assertEquals(undefined, foo(a));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(undefined, foo(a));
+Object.prototype.__defineGetter__(0, function() { return 1; });
+assertEquals(1, foo(a));
diff --git a/deps/v8/test/mjsunit/compiler/inlined-array-pop-getter2.js b/deps/v8/test/mjsunit/compiler/inlined-array-pop-getter2.js
new file mode 100644
index 0000000000..8ae642619e
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/inlined-array-pop-getter2.js
@@ -0,0 +1,23 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var pop = Array.prototype.pop;
+
+function foo(a) {
+  a.length;
+  return pop.call(a);
+}
+
+var a = new Array(4);
+var o = {}
+o.__defineGetter__(0, function() { return 1; });
+
+assertEquals(undefined, foo(a));
+assertEquals(undefined, foo(a));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(undefined, foo(a));
+Array.prototype.__proto__ = o;
+assertEquals(1, foo(a));
diff --git a/deps/v8/test/mjsunit/compiler/inlined-array-pop-opt.js b/deps/v8/test/mjsunit/compiler/inlined-array-pop-opt.js
new file mode 100644
index 0000000000..c1301489e7
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/inlined-array-pop-opt.js
@@ -0,0 +1,83 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+  function foo(a) { return a.pop(); }
+
+  var x = {};
+  var a = [x,x,];
+
+  assertEquals(x, foo(a));
+  assertEquals(x, foo(a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(undefined, foo(a));
+  assertOptimized(foo);
+})();
+
+(function() {
+  function foo(a) { return a.pop(); }
+
+  var x = 0;
+  var a = [x,x,];
+
+  assertEquals(x, foo(a));
+  assertEquals(x, foo(a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(undefined, foo(a));
+  assertOptimized(foo);
+})();
+
+(function() {
+  function foo(a) { return a.pop(); }
+
+  var x = 0;
+  var a = [x,x,x];
+
+  assertEquals(x, foo(a));
+  assertEquals(x, foo(a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(x, foo(a));
+  assertOptimized(foo);
+})();
+
+(function() {
+  function foo(a) { return a.pop(); }
+
+  var x = {};
+  var a = [x,x,x];
+
+  assertEquals(x, foo(a));
+  assertEquals(x, foo(a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(x, foo(a));
+  assertOptimized(foo);
+})();
+
+(function() {
+  function foo(a) { return a.pop(); }
+
+  var a = [,,];
+
+  assertEquals(undefined, foo(a));
+  assertEquals(undefined, foo(a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(undefined, foo(a));
+  assertOptimized(foo);
+})();
+
+(function() {
+  var pop = Array.prototype.pop;
+
+  function foo(a) { return a.pop(); }
+
+  var a = [1, 2, 3];
+
+  assertEquals(3, foo(a));
+  assertEquals(2, foo(a));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(a));
+  assertOptimized(foo);
+})();
diff --git a/deps/v8/test/mjsunit/compiler/integral32-add-sub.js b/deps/v8/test/mjsunit/compiler/integral32-add-sub.js
new file mode 100644
index 0000000000..2dd370c9dd
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/integral32-add-sub.js
@@ -0,0 +1,131 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+  function foo(x) {
+    x = x >>> 0;
+    var y = 0 - 2147483648;
+    return x + y;
+  }
+
+  assertEquals(-2147483648, foo(0));
+  assertEquals(0, foo(2147483648));
+  assertEquals(2147483647, foo(4294967295));
+  %BaselineFunctionOnNextCall(foo);
+  assertEquals(-2147483648, foo(0));
+  assertEquals(0, foo(2147483648));
+  assertEquals(2147483647, foo(4294967295));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(-2147483648, foo(0));
+  assertEquals(0, foo(2147483648));
+  assertEquals(2147483647, foo(4294967295));
+  assertOptimized(foo);
+})();
+
+(function() {
+  function foo(x) {
+    x = x >>> 0;
+    var y = 2147483648;
+    return x - y;
+  }
+
+  assertEquals(-2147483648, foo(0));
+  assertEquals(0, foo(2147483648));
+  assertEquals(2147483647, foo(4294967295));
+  %BaselineFunctionOnNextCall(foo);
+  assertEquals(-2147483648, foo(0));
+  assertEquals(0, foo(2147483648));
+  assertEquals(2147483647, foo(4294967295));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(-2147483648, foo(0));
+  assertEquals(0, foo(2147483648));
+  assertEquals(2147483647, foo(4294967295));
+  assertOptimized(foo);
+})();
+
+(function() {
+  function foo(x) {
+    x = x | 0;
+    var y = 2147483648;
+    return x + y;
+  }
+
+  assertEquals(2147483648, foo(0));
+  assertEquals(0, foo(-2147483648));
+  assertEquals(4294967295, foo(2147483647));
+  %BaselineFunctionOnNextCall(foo);
+  assertEquals(2147483648, foo(0));
+  assertEquals(0, foo(-2147483648));
+  assertEquals(4294967295, foo(2147483647));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2147483648, foo(0));
+  assertEquals(0, foo(-2147483648));
+  assertEquals(4294967295, foo(2147483647));
+  assertOptimized(foo);
+})();
+
+(function() {
+  function foo(x) {
+    x = x | 0;
+    var y = 0 - 2147483648;
+    return x - y;
+  }
+
+  assertEquals(2147483648, foo(0));
+  assertEquals(0, foo(-2147483648));
+  assertEquals(4294967295, foo(2147483647));
+  %BaselineFunctionOnNextCall(foo);
+  assertEquals(2147483648, foo(0));
+  assertEquals(0, foo(-2147483648));
+  assertEquals(4294967295, foo(2147483647));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2147483648, foo(0));
+  assertEquals(0, foo(-2147483648));
+  assertEquals(4294967295, foo(2147483647));
+  assertOptimized(foo);
+})();
+
+(function() {
+  function foo(x) {
+    x = x | 0;
+    var y = -0;
+    return x + y;
+  }
+
+  assertEquals(2147483647, foo(2147483647));
+  assertEquals(-2147483648, foo(-2147483648));
+  assertEquals(0, foo(0));
+  %BaselineFunctionOnNextCall(foo);
+  assertEquals(2147483647, foo(2147483647));
+  assertEquals(-2147483648, foo(-2147483648));
+  assertEquals(0, foo(0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2147483647, foo(2147483647));
+  assertEquals(-2147483648, foo(-2147483648));
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();
+
+(function() {
+  function foo(x) {
+    var y = (x < 0) ? 4294967295 : 4294967296;
+    var z = (x > 0) ? 2147483647 : 2147483648;
+    return y - z;
+  }
+
+  assertEquals(2147483647, foo(-1));
+  assertEquals(2147483648, foo(0));
+  assertEquals(2147483649, foo(1));
+  %BaselineFunctionOnNextCall(foo);
+  assertEquals(2147483647, foo(-1));
+  assertEquals(2147483648, foo(0));
+  assertEquals(2147483649, foo(1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2147483647, foo(-1));
+  assertEquals(2147483648, foo(0));
+  assertEquals(2147483649, foo(1));
+  assertOptimized(foo);
+})();
diff --git a/deps/v8/test/mjsunit/compiler/math-mul.js b/deps/v8/test/mjsunit/compiler/math-mul.js
new file mode 100644
index 0000000000..a391b445fe
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/math-mul.js
@@ -0,0 +1,45 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// For TurboFan, make sure we can eliminate the -0 return value check
+// by recognizing a constant value.
+function gotaconstant(y) { return 15 * y; }
+assertEquals(45, gotaconstant(3));
+gotaconstant(3);
+%OptimizeFunctionOnNextCall(gotaconstant);
+gotaconstant(3);
+
+function gotaconstant_truncated(x, y) { return x * y | 0; }
+assertEquals(45, gotaconstant_truncated(3, 15));
+gotaconstant_truncated(3, 15);
+%OptimizeFunctionOnNextCall(gotaconstant_truncated);
+gotaconstant_truncated(3, 15);
+
+function test(x, y) { return x * y; }
+
+assertEquals(12, test(3, 4));
+assertEquals(16, test(4, 4));
+
+%OptimizeFunctionOnNextCall(test);
+assertEquals(27, test(9, 3));
+
+assertEquals(-0, test(-3, 0));
+assertEquals(-0, test(0, -0));
+
+
+const SMI_MAX = (1 << 29) - 1 + (1 << 29);  // Create without overflowing.
+const SMI_MIN = -SMI_MAX - 1;  // Create without overflowing.
+
+// multiply by 3 to avoid compiler optimizations that convert 2*x to x + x.
+assertEquals(SMI_MAX + SMI_MAX + SMI_MAX, test(SMI_MAX, 3));
+
+// Verify that strength reduction will reduce the -0 check quite a bit
+// if we have a negative integer constant.
+function negtest(y) { return -3 * y; }
+assertEquals(-12, negtest(4));
+assertEquals(-12, negtest(4));
+%OptimizeFunctionOnNextCall(negtest);
+negtest(4);
diff --git a/deps/v8/test/mjsunit/compiler/optimized-float32array-length.js b/deps/v8/test/mjsunit/compiler/optimized-float32array-length.js
new file mode 100644
index 0000000000..eed8922c07
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/optimized-float32array-length.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = new Float32Array(1);
+function len(a) { return a.length; }
+assertEquals(1, len(a));
+assertEquals(1, len(a));
+%OptimizeFunctionOnNextCall(len);
+assertEquals(1, len(a));
+assertOptimized(len);
diff --git a/deps/v8/test/mjsunit/compiler/optimized-float64array-length.js b/deps/v8/test/mjsunit/compiler/optimized-float64array-length.js
new file mode 100644
index 0000000000..f6a3d77677
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/optimized-float64array-length.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = new Float64Array(1);
+function len(a) { return a.length; }
+assertEquals(1, len(a));
+assertEquals(1, len(a));
+%OptimizeFunctionOnNextCall(len);
+assertEquals(1, len(a));
+assertOptimized(len);
diff --git a/deps/v8/test/mjsunit/compiler/optimized-for-in.js b/deps/v8/test/mjsunit/compiler/optimized-for-in.js
index 9f5e4e7f83..ca17ee6a75 100644
--- a/deps/v8/test/mjsunit/compiler/optimized-for-in.js
+++ b/deps/v8/test/mjsunit/compiler/optimized-for-in.js
@@ -35,28 +35,28 @@
 function a(t) {
   var result = [];
   for (var i in t) {
-    result.push(i + t[i]);
+    result.push([i, t[i]]);
   }
-  return result.join('');
+  return result;
 }
 
 // Check that we correctly deoptimize on map check.
 function b(t) {
   var result = [];
   for (var i in t) {
-    result.push(i + t[i]);
+    result.push([i, t[i]]);
     delete t[i];
   }
-  return result.join('');
+  return result;
 }
 
 // Check that we correctly deoptimize during preparation step.
 function c(t) {
   var result = [];
   for (var i in t) {
-    result.push(i + t[i]);
+    result.push([i, t[i]]);
   }
-  return result.join('');
+  return result;
 }
 
 // Check that we deoptimize to the place after side effect in the right state.
@@ -64,9 +64,9 @@ function d(t) {
   var result = [];
   var o;
   for (var i in (o = t())) {
-    result.push(i + o[i]);
+    result.push([i, o[i]]);
   }
-  return result.join('');
+  return result;
 }
 
 // Check that we correctly deoptimize on map check inserted for fused load.
@@ -75,9 +75,9 @@ function e(t) {
   for (var i in t) {
     delete t[i];
     t[i] = i;
-    result.push(i + t[i]);
+    result.push([i, t[i]]);
   }
-  return result.join('');
+  return result;
 }
 
 // Nested for-in loops.
@@ -85,10 +85,10 @@ function f(t) {
   var result = [];
   for (var i in t) {
     for (var j in t) {
-      result.push(i + j + t[i] + t[j]);
+      result.push([i, j, t[i], t[j]]);
     }
   }
-  return result.join('');
+  return result;
 }
 
 // Deoptimization from the inner for-in loop.
@@ -96,13 +96,13 @@ function g(t) {
   var result = [];
   for (var i in t) {
     for (var j in t) {
-      result.push(i + j + t[i] + t[j]);
+      result.push([i, j, t[i], t[j]]);
       var v = t[i];
       delete t[i];
       t[i] = v;
     }
   }
-  return result.join('');
+  return result;
 }
 
 
@@ -111,12 +111,12 @@ function h(t, deopt) {
   var result = [];
   for (var i in t) {
     for (var j in t) {
-      result.push(i + j + t[i] + t[j]);
+      result.push([i, j, t[i], t[j]]);
       break;
     }
   }
   deopt.deopt;
-  return result.join('');
+  return result;
 }
 
 // Continue in the inner loop.
@@ -124,12 +124,12 @@ function j(t, deopt) {
   var result = [];
   for (var i in t) {
     for (var j in t) {
-      result.push(i + j + t[i] + t[j]);
+      result.push([i, j, t[i], t[j]]);
       continue;
     }
   }
   deopt.deopt;
-  return result.join('');
+  return result;
 }
 
 // Continue of the outer loop.
@@ -137,12 +137,12 @@ function k(t, deopt) {
   var result = [];
   outer: for (var i in t) {
     for (var j in t) {
-      result.push(i + j + t[i] + t[j]);
+      result.push([i, j, t[i], t[j]]);
       continue outer;
     }
   }
   deopt.deopt;
-  return result.join('');
+  return result;
 }
 
 // Break of the outer loop.
@@ -150,12 +150,12 @@ function l(t, deopt) {
   var result = [];
   outer: for (var i in t) {
     for (var j in t) {
-      result.push(i + j + t[i] + t[j]);
+      result.push([i, j, t[i], t[j]]);
       break outer;
     }
   }
   deopt.deopt;
-  return result.join('');
+  return result;
 }
 
 // Test deoptimization from inlined frame (currently it is not inlined).
@@ -163,7 +163,7 @@ function m0(t, deopt) {
   for (var i in t) {
     for (var j in t) {
       deopt.deopt;
-      return i + j + t[i] + t[j];
+      return [i, j,  t[i], t[j]];
     }
   }
 }
@@ -173,42 +173,53 @@ function m(t, deopt) {
 }
 
 
-function tryFunction(s, mkT, f) {
+function tryFunction(result, mkT, f) {
   var d = {deopt: false};
-  assertEquals(s, f(mkT(), d));
-  assertEquals(s, f(mkT(), d));
-  assertEquals(s, f(mkT(), d));
+  assertEquals(result, f(mkT(), d));
+  assertEquals(result, f(mkT(), d));
+  assertEquals(result, f(mkT(), d));
   %OptimizeFunctionOnNextCall(f);
-  assertEquals(s, f(mkT(), d));
-  assertEquals(s, f(mkT(), {}));
+  assertEquals(result, f(mkT(), d));
+  assertEquals(result, f(mkT(), {}));
 }
 
-var s = "a1b2c3d4";
+var expectedResult = [["a","1"],["b","2"],["c","3"],["d","4"]];
 function mkTable() { return { a: "1", b: "2", c: "3", d: "4" }; }
 
 
-tryFunction(s, mkTable, a);
-tryFunction(s, mkTable, b);
-tryFunction("0a1b2c3d", function () { return "abcd"; }, c);
-tryFunction("0a1b2c3d", function () {
+tryFunction(expectedResult, mkTable, a);
+tryFunction(expectedResult, mkTable, b);
+
+expectedResult = [["0","a"],["1","b"],["2","c"],["3","d"]];
+tryFunction(expectedResult, function () { return "abcd"; }, c);
+tryFunction(expectedResult, function () {
   var cnt = false;
   return function () {
     cnt = true;
     return "abcd";
   }
 }, d);
-tryFunction("aabbccdd", mkTable, e);
+tryFunction([["a","a"],["b","b"],["c","c"],["d","d"]], mkTable, e);
 
 function mkSmallTable() { return { a: "1", b: "2" }; }
 
-tryFunction("aa11ab12ba21bb22", mkSmallTable, f);
-tryFunction("aa11ab12bb22ba21", mkSmallTable, g);
-tryFunction("aa11ba21", mkSmallTable, h);
-tryFunction("aa11ab12ba21bb22", mkSmallTable, j);
-tryFunction("aa11ba21", mkSmallTable, h);
-tryFunction("aa11ba21", mkSmallTable, k);
-tryFunction("aa11", mkSmallTable, l);
-tryFunction("aa11", mkSmallTable, m);
+tryFunction([
+    ["a","a","1","1"],["a","b","1","2"],
+    ["b","a","2","1"],["b","b","2","2"]],
+    mkSmallTable, f);
+tryFunction([
+    ["a","a","1","1"],["a","b","1","2"],
+    ["b","b","2","2"],["b","a","2","1"]],
+    mkSmallTable, g);
+tryFunction([["a","a","1","1"],["b","a","2","1"]], mkSmallTable, h);
+tryFunction([
+    ["a","a","1","1"],["a","b","1","2"],
+    ["b","a","2","1"],["b","b","2","2"]],
+    mkSmallTable, j);
+tryFunction([["a","a","1","1"],["b","a","2","1"]], mkSmallTable, h);
+tryFunction([["a","a","1","1"],["b","a","2","1"]], mkSmallTable, k);
+tryFunction([["a","a","1","1"]], mkSmallTable, l);
+tryFunction(["a","a","1","1"], mkSmallTable, m);
 
 // Test handling of null.
 tryFunction("", function () {
@@ -229,7 +240,7 @@ tryFunction("", function () {
 // Test LoadFieldByIndex for out of object properties.
 function O() { this.a = 1; }
 for (var i = 0; i < 10; i++) new O();
-tryFunction("a1b2c3d4e5f6", function () {
+tryFunction([["a",1],["b",2],["c",3],["d",4],["e",5],["f",6]], function () {
   var o = new O();
   o.b = 2;
   o.c = 3;
@@ -239,8 +250,8 @@ tryFunction("a1b2c3d4e5f6", function () {
   return o;
 }, function (t) {
   var r = [];
-  for (var i in t) r.push(i + t[i]);
-  return r.join('');
+  for (var i in t) r.push([i, t[i]]);
+  return r;
 });
 
 // Test OSR inside for-in.
diff --git a/deps/v8/test/mjsunit/compiler/optimized-instanceof-1.js b/deps/v8/test/mjsunit/compiler/optimized-instanceof-1.js
new file mode 100644
index 0000000000..242b4be772
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/optimized-instanceof-1.js
@@ -0,0 +1,17 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function F() {}
+var f = new F
+
+var proto = Object.getPrototypeOf(F);
+Object.setPrototypeOf(F, null);
+F[Symbol.hasInstance] = function(v) { return true };
+Object.setPrototypeOf(F, proto);
+
+function foo(x) { return x instanceof F };
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo(1));
diff --git a/deps/v8/test/mjsunit/compiler/optimized-instanceof-2.js b/deps/v8/test/mjsunit/compiler/optimized-instanceof-2.js
new file mode 100644
index 0000000000..38a35b73f1
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/optimized-instanceof-2.js
@@ -0,0 +1,19 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function F() {}
+var f = new F
+
+function foo(x) { return x instanceof F };
+%OptimizeFunctionOnNextCall(foo);
+assertFalse(foo(1));
+
+var proto = Object.getPrototypeOf(F);
+Object.setPrototypeOf(F, null);
+F[Symbol.hasInstance] = function(v) { return true };
+Object.setPrototypeOf(F, proto);
+
+assertTrue(foo(1));
diff --git a/deps/v8/test/mjsunit/compiler/optimized-int32array-length.js b/deps/v8/test/mjsunit/compiler/optimized-int32array-length.js
new file mode 100644
index 0000000000..250d523cc9
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/optimized-int32array-length.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = new Int32Array(1);
+function len(a) { return a.length; }
+assertEquals(1, len(a));
+assertEquals(1, len(a));
+%OptimizeFunctionOnNextCall(len);
+assertEquals(1, len(a));
+assertOptimized(len);
diff --git a/deps/v8/test/mjsunit/compiler/optimized-uint32array-length.js b/deps/v8/test/mjsunit/compiler/optimized-uint32array-length.js
new file mode 100644
index 0000000000..d389370a4f
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/optimized-uint32array-length.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = new Uint32Array(1);
+function len(a) { return a.length; }
+assertEquals(1, len(a));
+assertEquals(1, len(a));
+%OptimizeFunctionOnNextCall(len);
+assertEquals(1, len(a));
+assertOptimized(len);
diff --git a/deps/v8/test/mjsunit/compiler/osr-alignment.js b/deps/v8/test/mjsunit/compiler/osr-alignment.js
index 085d6c4d68..f815e712ee 100644
--- a/deps/v8/test/mjsunit/compiler/osr-alignment.js
+++ b/deps/v8/test/mjsunit/compiler/osr-alignment.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --use-osr --turbo-osr
+// Flags: --allow-natives-syntax --use-osr
 
 function f1() {
   var sum = 0;
diff --git a/deps/v8/test/mjsunit/compiler/osr-backedges1.js b/deps/v8/test/mjsunit/compiler/osr-backedges1.js
index d415f4a107..18a7e0469e 100644
--- a/deps/v8/test/mjsunit/compiler/osr-backedges1.js
+++ b/deps/v8/test/mjsunit/compiler/osr-backedges1.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --use-osr --turbo-osr
+// Flags: --allow-natives-syntax --use-osr
 
 function foo(a) {
   var i = a | 0;
diff --git a/deps/v8/test/mjsunit/compiler/osr-block-scope-func.js b/deps/v8/test/mjsunit/compiler/osr-block-scope-func.js
index df4076c411..7c41f54074 100644
--- a/deps/v8/test/mjsunit/compiler/osr-block-scope-func.js
+++ b/deps/v8/test/mjsunit/compiler/osr-block-scope-func.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --use-osr --turbo-osr
+// Flags: --allow-natives-syntax --use-osr
 
 "use strict";
 
diff --git a/deps/v8/test/mjsunit/compiler/osr-block-scope-id.js b/deps/v8/test/mjsunit/compiler/osr-block-scope-id.js
index 923c72f422..bcc7cdd47d 100644
--- a/deps/v8/test/mjsunit/compiler/osr-block-scope-id.js
+++ b/deps/v8/test/mjsunit/compiler/osr-block-scope-id.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --use-osr --turbo-osr
+// Flags: --allow-natives-syntax --use-osr
 
 "use strict";
 
diff --git a/deps/v8/test/mjsunit/compiler/osr-block-scope.js b/deps/v8/test/mjsunit/compiler/osr-block-scope.js
index 0d78cdcb64..c60f8af6c9 100644
--- a/deps/v8/test/mjsunit/compiler/osr-block-scope.js
+++ b/deps/v8/test/mjsunit/compiler/osr-block-scope.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --use-osr --turbo-osr
+// Flags: --allow-natives-syntax --use-osr
 
 "use strict";
 
diff --git a/deps/v8/test/mjsunit/compiler/osr-follow.js b/deps/v8/test/mjsunit/compiler/osr-follow.js
index b6a2e8e4be..46581a8e5a 100644
--- a/deps/v8/test/mjsunit/compiler/osr-follow.js
+++ b/deps/v8/test/mjsunit/compiler/osr-follow.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --use-osr --turbo-osr
+// Flags: --use-osr
 
 function foo(a) {
   var sum = 0;
diff --git a/deps/v8/test/mjsunit/compiler/osr-for-let.js b/deps/v8/test/mjsunit/compiler/osr-for-let.js
index 4b2fa3e532..b8cef780b5 100644
--- a/deps/v8/test/mjsunit/compiler/osr-for-let.js
+++ b/deps/v8/test/mjsunit/compiler/osr-for-let.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --use-osr --turbo-osr
+// Flags: --allow-natives-syntax --use-osr
 
 "use strict";
 
diff --git a/deps/v8/test/mjsunit/compiler/osr-forin-nested.js b/deps/v8/test/mjsunit/compiler/osr-forin-nested.js
index ad55b30bd8..dd810897e0 100644
--- a/deps/v8/test/mjsunit/compiler/osr-forin-nested.js
+++ b/deps/v8/test/mjsunit/compiler/osr-forin-nested.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --turbo-osr --allow-natives-syntax
+// Flags: --allow-natives-syntax
 
 function test(e, f, v) {
   assertEquals(e, f(v));
diff --git a/deps/v8/test/mjsunit/compiler/osr-forin.js b/deps/v8/test/mjsunit/compiler/osr-forin.js
index 8d1678224c..b45d200d1b 100644
--- a/deps/v8/test/mjsunit/compiler/osr-forin.js
+++ b/deps/v8/test/mjsunit/compiler/osr-forin.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --use-osr --turbo-osr
+// Flags: --use-osr
 
 function f(a) {
   var sum = 0;
diff --git a/deps/v8/test/mjsunit/compiler/osr-forof.js b/deps/v8/test/mjsunit/compiler/osr-forof.js
index 36bff09c58..ce7b24de13 100644
--- a/deps/v8/test/mjsunit/compiler/osr-forof.js
+++ b/deps/v8/test/mjsunit/compiler/osr-forof.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --use-osr --turbo-osr
+// Flags: --use-osr
 
 function f(a) {
   var sum = 0;
diff --git a/deps/v8/test/mjsunit/compiler/osr-function-id.js b/deps/v8/test/mjsunit/compiler/osr-function-id.js
index c506ae8282..8761e8517e 100644
--- a/deps/v8/test/mjsunit/compiler/osr-function-id.js
+++ b/deps/v8/test/mjsunit/compiler/osr-function-id.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --use-osr --turbo-osr
+// Flags: --use-osr
 
 function id(f) { return f; }
 
diff --git a/deps/v8/test/mjsunit/compiler/osr-function-id2.js b/deps/v8/test/mjsunit/compiler/osr-function-id2.js
index 561c62e1bc..e25ec31480 100644
--- a/deps/v8/test/mjsunit/compiler/osr-function-id2.js
+++ b/deps/v8/test/mjsunit/compiler/osr-function-id2.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --use-osr --turbo-osr
+// Flags: --use-osr
 
 function id(f) { return f; }
 
diff --git a/deps/v8/test/mjsunit/compiler/osr-function.js b/deps/v8/test/mjsunit/compiler/osr-function.js
index 06d137b62c..cee7e9d3d0 100644
--- a/deps/v8/test/mjsunit/compiler/osr-function.js
+++ b/deps/v8/test/mjsunit/compiler/osr-function.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --use-osr --turbo-osr
+// Flags: --use-osr
 
 function foo() {
   var sum = 0;
diff --git a/deps/v8/test/mjsunit/compiler/osr-infinite.js b/deps/v8/test/mjsunit/compiler/osr-infinite.js
index aa74c877d5..24c7add272 100644
--- a/deps/v8/test/mjsunit/compiler/osr-infinite.js
+++ b/deps/v8/test/mjsunit/compiler/osr-infinite.js
@@ -2,13 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --use-osr --allow-natives-syntax --turbo-osr
+// Flags: --use-osr --allow-natives-syntax
 
 var global_counter = 0;
 
 function thrower() {
   var x = global_counter++;
-  if (x == 5)  %OptimizeOsr(thrower.caller);
+  if (x == 5)  %OptimizeOsr(1);
   if (x == 10) throw "terminate";
 }
 
diff --git a/deps/v8/test/mjsunit/compiler/osr-labeled.js b/deps/v8/test/mjsunit/compiler/osr-labeled.js
index 1a9709285e..1384e9a715 100644
--- a/deps/v8/test/mjsunit/compiler/osr-labeled.js
+++ b/deps/v8/test/mjsunit/compiler/osr-labeled.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --use-osr --turbo-osr
+// Flags: --allow-natives-syntax --use-osr
 
 function foo() {
   var sum = 0;
diff --git a/deps/v8/test/mjsunit/compiler/osr-literals-adapted.js b/deps/v8/test/mjsunit/compiler/osr-literals-adapted.js
index 950d8b0762..4d1798c929 100644
--- a/deps/v8/test/mjsunit/compiler/osr-literals-adapted.js
+++ b/deps/v8/test/mjsunit/compiler/osr-literals-adapted.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --use-osr --turbo-osr
+// Flags: --allow-natives-syntax --use-osr
 
 function mod() {
   function f0() {
diff --git a/deps/v8/test/mjsunit/compiler/osr-literals.js b/deps/v8/test/mjsunit/compiler/osr-literals.js
index d9f68a0b37..f2051dced7 100644
--- a/deps/v8/test/mjsunit/compiler/osr-literals.js
+++ b/deps/v8/test/mjsunit/compiler/osr-literals.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --use-osr --turbo-osr
+// Flags: --allow-natives-syntax --use-osr
 
 function mod() {
   function f0() {
diff --git a/deps/v8/test/mjsunit/compiler/osr-manual1.js b/deps/v8/test/mjsunit/compiler/osr-manual1.js
index 29a4948a65..c3db796f11 100644
--- a/deps/v8/test/mjsunit/compiler/osr-manual1.js
+++ b/deps/v8/test/mjsunit/compiler/osr-manual1.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --use-osr --turbo-osr
+// Flags: --allow-natives-syntax --use-osr
 
 var counter = 111;
 
diff --git a/deps/v8/test/mjsunit/compiler/osr-manual2.js b/deps/v8/test/mjsunit/compiler/osr-manual2.js
index 8aa5d69db3..de7ec243fe 100644
--- a/deps/v8/test/mjsunit/compiler/osr-manual2.js
+++ b/deps/v8/test/mjsunit/compiler/osr-manual2.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --use-osr --turbo-osr
+// Flags: --allow-natives-syntax --use-osr
 
 var counter = 188;
 
diff --git a/deps/v8/test/mjsunit/compiler/osr-multiple.js b/deps/v8/test/mjsunit/compiler/osr-multiple.js
index c318645d32..72fff8546c 100644
--- a/deps/v8/test/mjsunit/compiler/osr-multiple.js
+++ b/deps/v8/test/mjsunit/compiler/osr-multiple.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --use-osr --turbo-osr
+// Flags: --use-osr
 
 function f1(a,b,c) {
   var x = 0;
diff --git a/deps/v8/test/mjsunit/compiler/osr-multiple2.js b/deps/v8/test/mjsunit/compiler/osr-multiple2.js
index 9a81bfb658..edb627a57b 100644
--- a/deps/v8/test/mjsunit/compiler/osr-multiple2.js
+++ b/deps/v8/test/mjsunit/compiler/osr-multiple2.js
@@ -3,7 +3,6 @@
 // found in the LICENSE file.
 
 // Flags: --use-osr
-// TODO(titzer): enable --turbo-osr when nested OSR works.
 
 function f1(a,b,c) {
   var x = 0;
diff --git a/deps/v8/test/mjsunit/compiler/osr-multiple3.js b/deps/v8/test/mjsunit/compiler/osr-multiple3.js
index 0fb1ac73a3..fa703eaeac 100644
--- a/deps/v8/test/mjsunit/compiler/osr-multiple3.js
+++ b/deps/v8/test/mjsunit/compiler/osr-multiple3.js
@@ -3,7 +3,6 @@
 // found in the LICENSE file.
 
 // Flags: --use-osr
-// TODO(titzer): enable --turbo-osr when nested OSR works.
 
 function f1(a,b,c) {
   var x = 0;
diff --git a/deps/v8/test/mjsunit/compiler/osr-nested2.js b/deps/v8/test/mjsunit/compiler/osr-nested2.js
index 41bd9b247b..efe31f1177 100644
--- a/deps/v8/test/mjsunit/compiler/osr-nested2.js
+++ b/deps/v8/test/mjsunit/compiler/osr-nested2.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --use-osr --turbo-osr
+// Flags: --allow-natives-syntax --use-osr
 
 function f() {
   var sum = 0;
diff --git a/deps/v8/test/mjsunit/compiler/osr-nested2b.js b/deps/v8/test/mjsunit/compiler/osr-nested2b.js
index e64c10ccb4..18088114a4 100644
--- a/deps/v8/test/mjsunit/compiler/osr-nested2b.js
+++ b/deps/v8/test/mjsunit/compiler/osr-nested2b.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --use-osr --turbo-osr
+// Flags: --allow-natives-syntax --use-osr
 
 function f() {
   var sum = 0;
diff --git a/deps/v8/test/mjsunit/compiler/osr-nested3.js b/deps/v8/test/mjsunit/compiler/osr-nested3.js
index f5d09ba166..d7c144b9e6 100644
--- a/deps/v8/test/mjsunit/compiler/osr-nested3.js
+++ b/deps/v8/test/mjsunit/compiler/osr-nested3.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --use-osr --turbo-osr
+// Flags: --allow-natives-syntax --use-osr
 
 function f() {
   var sum = 0;
diff --git a/deps/v8/test/mjsunit/compiler/osr-nested3b.js b/deps/v8/test/mjsunit/compiler/osr-nested3b.js
index 32ac2a7058..a10d328e03 100644
--- a/deps/v8/test/mjsunit/compiler/osr-nested3b.js
+++ b/deps/v8/test/mjsunit/compiler/osr-nested3b.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --use-osr --turbo-osr
+// Flags: --allow-natives-syntax --use-osr
 
 function f() {
   var sum = 0;
diff --git a/deps/v8/test/mjsunit/compiler/osr-regex-id.js b/deps/v8/test/mjsunit/compiler/osr-regex-id.js
index 7831b14840..e0b4dad1dc 100644
--- a/deps/v8/test/mjsunit/compiler/osr-regex-id.js
+++ b/deps/v8/test/mjsunit/compiler/osr-regex-id.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --use-osr --turbo-osr
+// Flags: --allow-natives-syntax --use-osr
 
 function id(f) { return f; }
 
diff --git a/deps/v8/test/mjsunit/compiler/osr-sar.js b/deps/v8/test/mjsunit/compiler/osr-sar.js
index cc04adca8a..02684f088c 100644
--- a/deps/v8/test/mjsunit/compiler/osr-sar.js
+++ b/deps/v8/test/mjsunit/compiler/osr-sar.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --use-osr --turbo-osr
+// Flags: --allow-natives-syntax --use-osr
 
 function test() {
   // Loop to force OSR.
diff --git a/deps/v8/test/mjsunit/compiler/osr-warm.js b/deps/v8/test/mjsunit/compiler/osr-warm.js
index 7c30c07f20..73e1fd5cd2 100644
--- a/deps/v8/test/mjsunit/compiler/osr-warm.js
+++ b/deps/v8/test/mjsunit/compiler/osr-warm.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --use-osr --turbo-osr
+// Flags: --use-osr
 
 function f1(x) {
   while (x > 0) {
diff --git a/deps/v8/test/mjsunit/compiler/osr-while-let.js b/deps/v8/test/mjsunit/compiler/osr-while-let.js
index c19cf6cb24..11ebc4bb35 100644
--- a/deps/v8/test/mjsunit/compiler/osr-while-let.js
+++ b/deps/v8/test/mjsunit/compiler/osr-while-let.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --use-osr --turbo-osr
+// Flags: --allow-natives-syntax --use-osr
 
 "use strict";
 
diff --git a/deps/v8/test/mjsunit/compiler/regress-5074.js b/deps/v8/test/mjsunit/compiler/regress-5074.js
new file mode 100644
index 0000000000..903b54ad98
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-5074.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var s = [,0.1];
+
+function foo(a, b) {
+  var x = s[a];
+  s[1] = 0.1;
+  return x + b;
+}
+
+assertEquals(2.1, foo(1, 2));
+assertEquals(2.1, foo(1, 2));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals("undefined2", foo(0, "2"));
diff --git a/deps/v8/test/mjsunit/compiler/regress-5100.js b/deps/v8/test/mjsunit/compiler/regress-5100.js
new file mode 100644
index 0000000000..694cd8a75b
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-5100.js
@@ -0,0 +1,51 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = [0, 1];
+a["true"] = "true";
+a["false"] = "false";
+a["null"] = "null";
+a["undefined"] = "undefined";
+
+// Ensure we don't accidentially truncate true when used to index arrays.
+(function() {
+  function f(x) { return a[x]; }
+
+  assertEquals(0, f(0));
+  assertEquals(0, f(0));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("true", f(true));
+})();
+
+// Ensure we don't accidentially truncate false when used to index arrays.
+(function() {
+  function f( x) { return a[x]; }
+
+  assertEquals(0, f(0));
+  assertEquals(0, f(0));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("false", f(false));
+})();
+
+// Ensure we don't accidentially truncate null when used to index arrays.
+(function() {
+  function f( x) { return a[x]; }
+
+  assertEquals(0, f(0));
+  assertEquals(0, f(0));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("null", f(null));
+})();
+
+// Ensure we don't accidentially truncate undefined when used to index arrays.
+(function() {
+  function f( x) { return a[x]; }
+
+  assertEquals(0, f(0));
+  assertEquals(0, f(0));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("undefined", f(undefined));
+})();
diff --git a/deps/v8/test/mjsunit/compiler/regress-5129.js b/deps/v8/test/mjsunit/compiler/regress-5129.js
new file mode 100644
index 0000000000..1d100ab34c
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-5129.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo($a,$b) {
+ $a = $a|0;
+ $b = $b|0;
+ var $sub = $a - $b;
+ return ($sub|0) < 0;
+}
+
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo(0x7fffffff,-1));
diff --git a/deps/v8/test/mjsunit/compiler/regress-5158.js b/deps/v8/test/mjsunit/compiler/regress-5158.js
new file mode 100644
index 0000000000..ead5f4ed9d
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-5158.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+  x = +x;
+  return (x > 0) ? x : 0 - x;
+}
+
+foo(1);
+foo(-1);
+foo(0);
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(2147483648, foo(-2147483648));
diff --git a/deps/v8/test/mjsunit/compiler/regress-5278.js b/deps/v8/test/mjsunit/compiler/regress-5278.js
new file mode 100644
index 0000000000..25b1fb03d5
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-5278.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(a, b) {
+  return a % b;
+}
+foo(2, 1);
+foo(2, 1);
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(-0, foo(-2, 1));
diff --git a/deps/v8/test/mjsunit/compiler/regress-607493.js b/deps/v8/test/mjsunit/compiler/regress-607493.js
new file mode 100644
index 0000000000..540b47e2d2
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-607493.js
@@ -0,0 +1,37 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function ForInTryCatchContrinueOsr() {
+  var a = [1];
+
+  function g() {
+    for (var x in a) {
+      try {
+        for (var i = 0; i < 10; i++) { %OptimizeOsr(); }
+        return;
+      } catch(e) {
+        continue;
+      }
+    }
+  }
+
+  g();
+})();
+
+(function ForInContinueNestedOsr() {
+  var a = [1];
+
+  function g() {
+    for (var x in a) {
+      if (x) {
+        for (var i = 0; i < 10; i++) { %OptimizeOsr(); }
+      }
+      continue;
+    }
+  }
+
+  g();
+})();
diff --git a/deps/v8/test/mjsunit/compiler/regress-621423.js b/deps/v8/test/mjsunit/compiler/regress-621423.js
new file mode 100644
index 0000000000..962176ffbf
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-621423.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = [0, ""];
+a[0] = 0;
+
+function g(array) {
+  array[1] = undefined;
+}
+
+function f() {
+  g(function() {});
+  g(a);
+}
+
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/deps/v8/test/mjsunit/compiler/regress-625558.js b/deps/v8/test/mjsunit/compiler/regress-625558.js
new file mode 100644
index 0000000000..5d6b372632
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-625558.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+for (var global = 0; global <= 256; global++) { }
+
+function f() {
+  global = "luft";
+  global += ++global;
+}
+
+f();
diff --git a/deps/v8/test/mjsunit/compiler/regress-628403.js b/deps/v8/test/mjsunit/compiler/regress-628403.js
new file mode 100644
index 0000000000..4096ac32ae
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-628403.js
@@ -0,0 +1,27 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var dothrow = false;
+
+function g() {
+  if (dothrow) throw 1;
+}
+
+function f(a) {
+  try {
+    g();
+  } catch(e) {
+    if (typeof e !== 'number' && e !== 1) throw e;
+    return a[0];
+  }
+}
+
+%NeverOptimizeFunction(g);
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+dothrow = true;
+assertEquals(42, f([42]));
diff --git a/deps/v8/test/mjsunit/compiler/regress-628516.js b/deps/v8/test/mjsunit/compiler/regress-628516.js
new file mode 100644
index 0000000000..8cb43b4bea
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-628516.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f() {
+  var i = 0;
+  while (1) {
+    if ({}) i = expected[0] == x[0];
+    i++;
+  }
+}
+
+assertThrows(f);
diff --git a/deps/v8/test/mjsunit/compiler/regress-628773.js b/deps/v8/test/mjsunit/compiler/regress-628773.js
new file mode 100644
index 0000000000..3c315b3828
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-628773.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-tailcalls
+
+"use strict";
+
+function foo() {
+  for  (var i = 0; i < 10000; i++) {
+    try {
+      for (var j = 0; j < 2; j++) {
+      }
+      throw 1;
+    } catch(e) {
+      if (typeof a == "number") return a && isNaN(b);
+    }
+  }
+}
+
+foo();
diff --git a/deps/v8/test/mjsunit/compiler/regress-630611.js b/deps/v8/test/mjsunit/compiler/regress-630611.js
new file mode 100644
index 0000000000..be75777ba7
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-630611.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var global = 1;
+global = 2;
+
+function f() {
+  var o = { a : 1 };
+  global = "a";
+  for (var i = global; i < 2; i++) {
+    delete o[i];
+  }
+}
+
+f();
diff --git a/deps/v8/test/mjsunit/compiler/regress-633497.js b/deps/v8/test/mjsunit/compiler/regress-633497.js
new file mode 100644
index 0000000000..8bf358af00
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-633497.js
@@ -0,0 +1,29 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(a) {
+  var x;
+  a = a|0;
+  var dummy;
+  if (a === 1) {
+    x = 277.5;
+  } else if (a === 2) {
+    x = 0;
+  } else {
+    dummy = 527.5;
+    dummy = 958.5;
+    dummy = 1143.5;
+    dummy = 1368.5;
+    dummy = 1558.5;
+    x = 277.5;
+  }
+  return +x;
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+assertEquals(277.5, f());
diff --git a/deps/v8/test/mjsunit/compiler/regress-loop-variable-if.js b/deps/v8/test/mjsunit/compiler/regress-loop-variable-if.js
new file mode 100644
index 0000000000..ec284e9222
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-loop-variable-if.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --turbo-loop-variable
+
+function f() {
+  for (var i = 0; i != 10; i++) {
+    if (i < 8) print("x");
+  }
+}
+
+f();
diff --git a/deps/v8/test/mjsunit/compiler/regress-loop-variable-unsigned.js b/deps/v8/test/mjsunit/compiler/regress-loop-variable-unsigned.js
new file mode 100644
index 0000000000..751136eb13
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-loop-variable-unsigned.js
@@ -0,0 +1,23 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --turbo-loop-variable
+
+(function() {
+  function f() {
+    for (var i = 0; i < 4294967295; i += 2) {
+      if (i === 10) break;
+    }
+  }
+  f();
+})();
+
+(function() {
+  function f() {
+    for (var i = 0; i < 4294967293; i += 2) {
+      if (i === 10) break;
+    }
+  }
+  f();
+})();
diff --git a/deps/v8/test/mjsunit/compiler/regress-number-is-hole-nan.js b/deps/v8/test/mjsunit/compiler/regress-number-is-hole-nan.js
new file mode 100644
index 0000000000..368c837163
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-number-is-hole-nan.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = [, 2.121736758e-314];
+
+function foo() { return a[1]; }
+
+assertEquals(2.121736758e-314, foo());
+assertEquals(2.121736758e-314, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(2.121736758e-314, foo());
diff --git a/deps/v8/test/mjsunit/compiler/regress-store-holey-double-array.js b/deps/v8/test/mjsunit/compiler/regress-store-holey-double-array.js
new file mode 100644
index 0000000000..81231984e0
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-store-holey-double-array.js
@@ -0,0 +1,43 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function StoreHoleBitPattern() {
+  function g(src, dst, i) {
+    dst[i] = src[i];
+  }
+
+  var b = new ArrayBuffer(16);
+  var i32 = new Int32Array(b);
+  i32[0] = 0xFFF7FFFF;
+  i32[1] = 0xFFF7FFFF;
+  i32[3] = 0xFFF7FFFF;
+  i32[4] = 0xFFF7FFFF;
+  var f64 = new Float64Array(b);
+
+  var a = [,0.1];
+
+  g(f64, a, 1);
+  g(f64, a, 1);
+  %OptimizeFunctionOnNextCall(g);
+  g(f64, a, 0);
+
+  assertTrue(Number.isNaN(a[0]));
+})();
+
+
+(function ConvertHoleToNumberAndStore() {
+  function g(a, i) {
+    var x = a[i];
+    a[i] = +x;
+  }
+
+  var a=[,0.1];
+  g(a, 1);
+  g(a, 1);
+  %OptimizeFunctionOnNextCall(g);
+  g(a, 0);
+  assertTrue(Number.isNaN(a[0]));
+})();
diff --git a/deps/v8/test/mjsunit/compiler/regress-string-to-number-add.js b/deps/v8/test/mjsunit/compiler/regress-string-to-number-add.js
new file mode 100644
index 0000000000..e872401c0b
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-string-to-number-add.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-type-feedback
+
+function f(x) {
+  var s = x ? "0" : "1";
+  return 1 + Number(s);
+}
+
+f(0);
+f(0);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(2, f(0));
diff --git a/deps/v8/test/mjsunit/compiler/regress-truncate-number-or-undefined-to-float64.js b/deps/v8/test/mjsunit/compiler/regress-truncate-number-or-undefined-to-float64.js
new file mode 100644
index 0000000000..1dc3042ea7
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-truncate-number-or-undefined-to-float64.js
@@ -0,0 +1,19 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function g(a, b) {
+  a = +a;
+  if (b) {
+    a = undefined;
+  }
+  print(a);
+  return +a;
+}
+
+g(0);
+g(0);
+%OptimizeFunctionOnNextCall(g);
+assertTrue(Number.isNaN(g(0, true)));
diff --git a/deps/v8/test/mjsunit/compiler/regress-valueof.js b/deps/v8/test/mjsunit/compiler/regress-valueof.js
deleted file mode 100644
index 7b29b46a66..0000000000
--- a/deps/v8/test/mjsunit/compiler/regress-valueof.js
+++ /dev/null
@@ -1,35 +0,0 @@
-// Copyright 2011 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Flags: --allow-natives-syntax
-
-// Test valueof with integer input.
-function f(x) { var y = x + 1; return %_ValueOf(y); }
-
-for (var i=0; i<100000; i++) f(42);
-
-assertEquals(43, f(42));
diff --git a/deps/v8/test/mjsunit/compiler/try-osr.js b/deps/v8/test/mjsunit/compiler/try-osr.js
index e4eb8dd9fa..c0ef27add3 100644
--- a/deps/v8/test/mjsunit/compiler/try-osr.js
+++ b/deps/v8/test/mjsunit/compiler/try-osr.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --turbo-osr
+// Flags: --allow-natives-syntax
 
 function OSRInsideTry(x) {
   try {
diff --git a/deps/v8/test/mjsunit/compiler/turbo-number-feedback.js b/deps/v8/test/mjsunit/compiler/turbo-number-feedback.js
new file mode 100644
index 0000000000..8dcc42c8a1
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/turbo-number-feedback.js
@@ -0,0 +1,102 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-type-feedback
+
+(function AddSubtractSmis() {
+  function f0(a, b, c) {
+    return a + b - c;
+  }
+
+  assertEquals(4, f0(3, 2, 1));
+  assertEquals(4, f0(3, 2, 1));
+  %OptimizeFunctionOnNextCall(f0);
+  assertEquals(4, f0(3, 2, 1));
+})();
+
+(function AddSubtractDoubles() {
+  function f1(a, b, c) {
+    return a + b - c;
+  }
+
+  assertEquals(4.5, f1(3.5, 2.5, 1.5));
+  assertEquals(4.5, f1(3.5, 2.5, 1.5));
+  %OptimizeFunctionOnNextCall(f1);
+  assertEquals(4.5, f1(3.5, 2.5, 1.5));
+  assertEquals(4, f1(3, 2, 1));
+  assertTrue(isNaN(f1(3, 2, undefined)));
+  assertTrue(isNaN(f1(3, undefined, 1)));
+})();
+
+(function CheckUint32ToInt32Conv() {
+  function f2(a) {
+    return (a >>> 0) + 1;
+  }
+
+  assertEquals(1, f2(0));
+  assertEquals(1, f2(0));
+  %OptimizeFunctionOnNextCall(f2);
+  assertEquals(1, f2(0));
+  assertEquals(4294967295, f2(-2));
+})();
+
+(function CheckFloat64ToInt32Conv() {
+  function f3(a, b) {
+    var x = 0;
+    if (a) {
+      x = 0.5;
+    }
+    return x + b;
+  }
+
+  assertEquals(1, f3(0, 1));
+  assertEquals(1, f3(0, 1));
+  %OptimizeFunctionOnNextCall(f3);
+  assertEquals(1, f3(0, 1));
+  assertEquals(1.5, f3(1, 1));
+})();
+
+(function ShiftLeftSmis() {
+  function f4(a, b) {
+    return a << b;
+  }
+
+  assertEquals(24, f4(3, 3));
+  assertEquals(40, f4(5, 3));
+  %OptimizeFunctionOnNextCall(f4);
+  assertEquals(64, f4(4, 4));
+})();
+
+(function ShiftLeftNumbers() {
+  function f5(a, b) {
+    return a << b;
+  }
+
+  assertEquals(24, f5(3.3, 3.4));
+  assertEquals(40, f5(5.1, 3.9));
+  %OptimizeFunctionOnNextCall(f5);
+  assertEquals(64, f5(4.9, 4.1));
+})();
+
+(function ShiftRightNumbers() {
+  function f6(a, b) {
+    return a >> b;
+  }
+
+  assertEquals(1, f6(8.3, 3.4));
+  assertEquals(-2, f6(-16.1, 3.9));
+  %OptimizeFunctionOnNextCall(f6);
+  assertEquals(0, f6(16.2, 5.1));
+})();
+
+(function ShiftRightLogicalNumbers() {
+  function f7(a, b) {
+    return a >>> b;
+  }
+
+  assertEquals(1, f7(8.3, 3.4));
+  assertEquals(536870910, f7(-16.1, 3.9));
+  %OptimizeFunctionOnNextCall(f7);
+  assertEquals(0, f7(16.2, 5.1));
+})();